9175021428

Committed 21 May 2024 12:52PM UTC coverage: 64.593% (+0.003%) from 64.59%

Build # 9175021428

Build Type

push

github

Committed by

web-flow

Commit Message

Merge pull request #14206 from omoerbeek/rec-wildcard-denial-proof

rec: be a bit more strict with respect to positive answers expanded from a wildcard

Run Details

36957 of 87922 branches covered (42.03%)

Branch coverage included in aggregate %.

239 of 296 new or added lines in 4 files covered. (80.74%)

54 existing lines in 12 files now uncovered.

124140 of 161482 relevant lines covered (76.88%)

5377080.56 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

77.58

/pdns/stubresolver.cc

#include <sys/stat.h>

#ifdef HAVE_CONFIG_H
#include "config.h"
#endif

#include "logger.hh"
#include "arguments.hh"
#include "version.hh"
#include "misc.hh"

#include "sstuff.hh"
#include "dnswriter.hh"
#include "dns_random.hh"
#include "namespaces.hh"
#include "statbag.hh"
#include "stubresolver.hh"
#include "ednsoptions.hh"
#include "ednssubnet.hh"

#define LOCAL_RESOLV_CONF_PATH "/etc/resolv.conf"
// don't stat() for local resolv.conf more than once every INTERVAL secs.
#define LOCAL_RESOLV_CONF_MAX_CHECK_INTERVAL 60

// s_resolversForStub contains the ComboAddresses that are used by
// stubDoResolve
static SharedLockGuarded<vector<ComboAddress>> s_resolversForStub;
static bool s_stubResolvConfigured = false;

// /etc/resolv.conf last modification time
static time_t s_localResolvConfMtime = 0;
static time_t s_localResolvConfLastCheck = 0;

static string logPrefix = "[stub-resolver] ";

/*
 * Returns false if no resolvers are configured, while emitting a warning about this
 */
bool resolversDefined()
{
  if (s_resolversForStub.read_lock()->empty()) {
    g_log << Logger::Warning << logPrefix << "No upstream resolvers configured, stub resolving (including secpoll and ALIAS) impossible." << endl;
    return false;
  }
  return true;
}

/*
 * Parse /etc/resolv.conf and add those nameservers to s_resolversForStub
 */
static void parseLocalResolvConf_locked(vector<ComboAddress>& resolversForStub, const time_t& now)
{
  struct stat statResult
  {
  };
  s_localResolvConfLastCheck = now;

  if (stat(LOCAL_RESOLV_CONF_PATH, &statResult) != -1) {
    if (statResult.st_mtime != s_localResolvConfMtime) {
      std::vector<ComboAddress> resolvers = getResolvers(LOCAL_RESOLV_CONF_PATH);

      s_localResolvConfMtime = statResult.st_mtime;

      if (resolvers.empty()) {
        return;
      }

      resolversForStub = std::move(resolvers);
    }
  }
}

static void parseLocalResolvConf()
{
  const time_t now = time(nullptr);
  if ((s_localResolvConfLastCheck + LOCAL_RESOLV_CONF_MAX_CHECK_INTERVAL) > now) {
    return;
  }

  parseLocalResolvConf_locked(*(s_resolversForStub.write_lock()), now);
}

/*
 * Fill the s_resolversForStub vector with addresses for the upstream resolvers.
 * First, parse the `resolver` configuration option for IP addresses to use.
 * If that doesn't work, parse /etc/resolv.conf and add those nameservers to
 * s_resolversForStub.
 *
 * mainthread() calls this so you don't have to.
 */
void stubParseResolveConf()
{
  if (::arg().mustDo("resolver")) {
    auto resolversForStub = s_resolversForStub.write_lock();
    vector<string> parts;
    stringtok(parts, ::arg()["resolver"], " ,\t");
    for (const auto& addr : parts) {
      resolversForStub->push_back(ComboAddress(addr, 53));
    }
  }

  if (s_resolversForStub.read_lock()->empty()) {
    parseLocalResolvConf();
  }
  // Emit a warning if there are no stubs.
  resolversDefined();
  s_stubResolvConfigured = true;
}

// s_resolversForStub contains the ComboAddresses that are used to resolve the
int stubDoResolve(const DNSName& qname, uint16_t qtype, vector<DNSZoneRecord>& ret, const EDNSSubnetOpts* d_eso)
{
  // ensure resolver gets always configured
  if (!s_stubResolvConfigured) {
    stubParseResolveConf();
  }
  // only check if resolvers come from local resolv.conf in the first place
  if (s_localResolvConfMtime != 0) {
    parseLocalResolvConf();
  }
  if (!resolversDefined()) {
    return RCode::ServFail;
  }

  auto resolversForStub = s_resolversForStub.read_lock();
  vector<uint8_t> packet;

  DNSPacketWriter packetWriter(packet, qname, qtype);
  packetWriter.getHeader()->id = dns_random_uint16();
  packetWriter.getHeader()->rd = 1;

  if (d_eso != nullptr) {
    // pass along EDNS subnet from client if given - issue #5469
    string origECSOptionStr = makeEDNSSubnetOptsString(*d_eso);
    DNSPacketWriter::optvect_t opts;
    opts.emplace_back(EDNSOptionCode::ECS, origECSOptionStr);
    packetWriter.addOpt(512, 0, 0, opts);
    packetWriter.commit();
  }

  string queryNameType = qname.toString() + "|" + QType(qtype).toString();
  string msg = "Doing stub resolving for '" + queryNameType + "', using resolvers: ";
  for (const auto& server : *resolversForStub) {
    msg += server.toString() + ", ";
  }
  g_log << Logger::Debug << logPrefix << msg.substr(0, msg.length() - 2) << endl;

  for (const ComboAddress& dest : *resolversForStub) {
    Socket sock(dest.sin4.sin_family, SOCK_DGRAM);
    sock.setNonBlocking();
    sock.connect(dest);
    sock.send(string(packet.begin(), packet.end()));

    string reply;

    // error handled after this
    (void)waitForData(sock.getHandle(), 2, 0);
    try {
    retry:
      sock.read(reply); // this calls recv
      if (reply.size() > sizeof(struct dnsheader)) {
        struct dnsheader dHeader
        {
        };
        memcpy(&dHeader, reply.c_str(), sizeof(dHeader));
        if (dHeader.id != packetWriter.getHeader()->id) {
          goto retry;
        }
      }
    }
    catch (...) {
      continue;
    }
    MOADNSParser mdp(false, reply);
    if (mdp.d_header.rcode == RCode::ServFail) {
      continue;
    }

    for (const auto& answer : mdp.d_answers) {
      if (answer.first.d_place == 1 && answer.first.d_type == qtype) {
        DNSZoneRecord zrr;
        zrr.dr = answer.first;
        zrr.auth = true;
        ret.push_back(zrr);
      }
    }
    g_log << Logger::Debug << logPrefix << "Question for '" << queryNameType << "' got answered by " << dest.toString() << endl;
    return mdp.d_header.rcode;
  }
  return RCode::ServFail;
}

int stubDoResolve(const DNSName& qname, uint16_t qtype, vector<DNSRecord>& ret, const EDNSSubnetOpts* d_eso)
{
  vector<DNSZoneRecord> ret2;
  int res = stubDoResolve(qname, qtype, ret2, d_eso);
  for (const auto& record : ret2) {
    ret.push_back(record.dr);
  }
  return res;
}

1	#include <sys/stat.h>
2
3	#ifdef HAVE_CONFIG_H
4	#include "config.h"
5	#endif
6
7	#include "logger.hh"
8	#include "arguments.hh"
9	#include "version.hh"
10	#include "misc.hh"
11
12	#include "sstuff.hh"
13	#include "dnswriter.hh"
14	#include "dns_random.hh"
15	#include "namespaces.hh"
16	#include "statbag.hh"
17	#include "stubresolver.hh"
18	#include "ednsoptions.hh"
19	#include "ednssubnet.hh"
20
21	#define LOCAL_RESOLV_CONF_PATH "/etc/resolv.conf"	118✔
22	// don't stat() for local resolv.conf more than once every INTERVAL secs.
23	#define LOCAL_RESOLV_CONF_MAX_CHECK_INTERVAL 60	118✔
24
25	// s_resolversForStub contains the ComboAddresses that are used by
26	// stubDoResolve
27	static SharedLockGuarded<vector<ComboAddress>> s_resolversForStub;
28	static bool s_stubResolvConfigured = false;
29
30	// /etc/resolv.conf last modification time
31	static time_t s_localResolvConfMtime = 0;
32	static time_t s_localResolvConfLastCheck = 0;
33
34	static string logPrefix = "[stub-resolver] ";
35
36	/*
37	* Returns false if no resolvers are configured, while emitting a warning about this
38	*/
39	bool resolversDefined()
40	{	344✔
41	if (s_resolversForStub.read_lock()->empty()) {	344!
42	g_log << Logger::Warning << logPrefix << "No upstream resolvers configured, stub resolving (including secpoll and ALIAS) impossible." << endl;	×
43	return false;	×
44	}	×
45	return true;	344✔
46	}	344✔
47
48	/*
49	* Parse /etc/resolv.conf and add those nameservers to s_resolversForStub
50	*/
51	static void parseLocalResolvConf_locked(vector<ComboAddress>& resolversForStub, const time_t& now)
52	{	59✔
53	struct stat statResult	59✔
54	{	59✔
55	};	59✔
56	s_localResolvConfLastCheck = now;	59✔
57
58	if (stat(LOCAL_RESOLV_CONF_PATH, &statResult) != -1) {	59!
59	if (statResult.st_mtime != s_localResolvConfMtime) {	59!
60	std::vector<ComboAddress> resolvers = getResolvers(LOCAL_RESOLV_CONF_PATH);	59✔
61
62	s_localResolvConfMtime = statResult.st_mtime;	59✔
63
64	if (resolvers.empty()) {	59!
65	return;	×
66	}	×
67
68	resolversForStub = std::move(resolvers);	59✔
69	}	59✔
70	}	59✔
71	}	59✔
72
73	static void parseLocalResolvConf()
74	{	118✔
75	const time_t now = time(nullptr);	118✔
76	if ((s_localResolvConfLastCheck + LOCAL_RESOLV_CONF_MAX_CHECK_INTERVAL) > now) {	118✔
77	return;	59✔
78	}	59✔
79
80	parseLocalResolvConf_locked(*(s_resolversForStub.write_lock()), now);	59✔
81	}	59✔
82
83	/*
84	* Fill the s_resolversForStub vector with addresses for the upstream resolvers.
85	* First, parse the `resolver` configuration option for IP addresses to use.
86	* If that doesn't work, parse /etc/resolv.conf and add those nameservers to
87	* s_resolversForStub.
88	*
89	* mainthread() calls this so you don't have to.
90	*/
91	void stubParseResolveConf()
92	{	96✔
93	if (::arg().mustDo("resolver")) {	96✔
94	auto resolversForStub = s_resolversForStub.write_lock();	37✔
95	vector<string> parts;	37✔
96	stringtok(parts, ::arg()["resolver"], " ,\t");	37✔
97	for (const auto& addr : parts) {	37✔
98	resolversForStub->push_back(ComboAddress(addr, 53));	37✔
99	}	37✔
100	}	37✔
101
102	if (s_resolversForStub.read_lock()->empty()) {	96✔
103	parseLocalResolvConf();	59✔
104	}	59✔
105	// Emit a warning if there are no stubs.
106	resolversDefined();	96✔
107	s_stubResolvConfigured = true;	96✔
108	}	96✔
109
110	// s_resolversForStub contains the ComboAddresses that are used to resolve the
111	int stubDoResolve(const DNSName& qname, uint16_t qtype, vector<DNSZoneRecord>& ret, const EDNSSubnetOpts* d_eso)
112	{	248✔
113	// ensure resolver gets always configured
114	if (!s_stubResolvConfigured) {	248!
115	stubParseResolveConf();	×
116	}	×
117	// only check if resolvers come from local resolv.conf in the first place
118	if (s_localResolvConfMtime != 0) {	248✔
119	parseLocalResolvConf();	59✔
120	}	59✔
121	if (!resolversDefined()) {	248!
122	return RCode::ServFail;	×
123	}	×
124
125	auto resolversForStub = s_resolversForStub.read_lock();	248✔
126	vector<uint8_t> packet;	248✔
127
128	DNSPacketWriter packetWriter(packet, qname, qtype);	248✔
129	packetWriter.getHeader()->id = dns_random_uint16();	248✔
130	packetWriter.getHeader()->rd = 1;	248✔
131
132	if (d_eso != nullptr) {	248!
133	// pass along EDNS subnet from client if given - issue #5469
134	string origECSOptionStr = makeEDNSSubnetOptsString(*d_eso);	×
135	DNSPacketWriter::optvect_t opts;	×
136	opts.emplace_back(EDNSOptionCode::ECS, origECSOptionStr);	×
137	packetWriter.addOpt(512, 0, 0, opts);	×
138	packetWriter.commit();	×
139	}	×
140
141	string queryNameType = qname.toString() + "\|" + QType(qtype).toString();	248✔
142	string msg = "Doing stub resolving for '" + queryNameType + "', using resolvers: ";	248✔
143	for (const auto& server : *resolversForStub) {	248✔
144	msg += server.toString() + ", ";	248✔
145	}	248✔
146	g_log << Logger::Debug << logPrefix << msg.substr(0, msg.length() - 2) << endl;	248✔
147
148	for (const ComboAddress& dest : *resolversForStub) {	248!
149	Socket sock(dest.sin4.sin_family, SOCK_DGRAM);	248✔
150	sock.setNonBlocking();	248✔
151	sock.connect(dest);	248✔
152	sock.send(string(packet.begin(), packet.end()));	248✔
153
154	string reply;	248✔
155
156	// error handled after this
157	(void)waitForData(sock.getHandle(), 2, 0);	248✔
158	try {	248✔
159	retry:	248✔
160	sock.read(reply); // this calls recv	248✔
161	if (reply.size() > sizeof(struct dnsheader)) {	248!
162	struct dnsheader dHeader	248✔
163	{	248✔
164	};	248✔
165	memcpy(&dHeader, reply.c_str(), sizeof(dHeader));	248✔
166	if (dHeader.id != packetWriter.getHeader()->id) {	248!
167	goto retry;	×
168	}	×
169	}	248✔
170	}	248✔
171	catch (...) {	248✔
UNCOV 172	continue;	×
UNCOV 173	}	×
174	MOADNSParser mdp(false, reply);	248✔
175	if (mdp.d_header.rcode == RCode::ServFail) {	248!
176	continue;	×
177	}	×
178
179	for (const auto& answer : mdp.d_answers) {	248✔
180	if (answer.first.d_place == 1 && answer.first.d_type == qtype) {	248!
181	DNSZoneRecord zrr;	152✔
182	zrr.dr = answer.first;	152✔
183	zrr.auth = true;	152✔
184	ret.push_back(zrr);	152✔
185	}	152✔
186	}	248✔
187	g_log << Logger::Debug << logPrefix << "Question for '" << queryNameType << "' got answered by " << dest.toString() << endl;	248✔
188	return mdp.d_header.rcode;	248✔
189	}	248✔
UNCOV 190	return RCode::ServFail;	×
191	}	248✔
192
193	int stubDoResolve(const DNSName& qname, uint16_t qtype, vector<DNSRecord>& ret, const EDNSSubnetOpts* d_eso)
194	{	96✔
195	vector<DNSZoneRecord> ret2;	96✔
196	int res = stubDoResolve(qname, qtype, ret2, d_eso);	96✔
197	for (const auto& record : ret2) {	96!
198	ret.push_back(record.dr);	×
199	}	×
200	return res;	96✔
201	}	96✔

PowerDNS / pdns / 9175021428

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous