auth_data_delete(node);

}

if(z->rpz) {

}

return 1;

}

edns.opt_list_out = NULL;

edns.opt_list_inplace_cb_out = NULL;

edns.padding_block_size = 0;

if(sldns_buffer_capacity(buf) < 65535)

edns.udp_size = (uint16_t)sldns_buffer_capacity(buf);

else edns.udp_size = 65535;

edns.opt_list_out = NULL;

edns.opt_list_inplace_cb_out = NULL;

edns.padding_block_size = 0;

if(sldns_buffer_capacity(buf) < 65535)

edns.udp_size = (uint16_t)sldns_buffer_capacity(buf);

else edns.udp_size = 65535;

size_t j;

if(!rrlist[i])

continue;

query_dname_compare(z->name, node->name)==0) {

/* omit RRSIGs over type ZONEMD at apex */

continue;

slabhash_remove(env->msg_cache, h, &k);

}

void

dns_cache_store_msg(struct module_env* env, struct query_info* qinfo,

hashvalue_type hash, struct reply_info* rep, time_t leeway, int pside,

/* we do not store the message, but we did store the RRs,

* which could be useful for delegation information */

verbose(VERB_ALGO, "TTL 0: dropped msg from cache");

* so that the TTL 0 response can be returned for future

* cache, but instead go to recursion to get this TTL0

return;

}

if(!msg->rep)

return NULL;

msg->rep->reason_bogus = LDNS_EDE_NONE;

if(num > RR_COUNT_MAX)

return NULL; /* integer overflow protection */

msg->rep->rrsets = (struct ub_packed_rrset_key**)

msg->rep->rrset_count = r->rrset_count;

msg->rep->authoritative = r->authoritative;

msg->rep->reason_bogus = r->reason_bogus;

if(!rrset_array_lock(r->ref, r->rrset_count, now_control)) {

return NULL;

}

/* ttl must be relative ;i.e. 0..86400 not time(0)+86400.

* the env->now is added to message and RRsets in this routine. */

/* the leeway is used to invalidate other rrsets earlier */

if(is_referral) {

/* store rrsets */

struct rrset_ref ref;

((ntohs(ref.key->rk.type)==LDNS_RR_TYPE_NS

&& !pside) ? qstarttime:*env->now + leeway));

}

return 1;

} else {

/* store msg, and rrsets */

* in queries per second. */

int infra_ip_ratelimit = 0;

size_t

infra_sizefunc(void* k, void* ATTR_UNUSED(d))

{

return s;

}

int infra_ip_ratelimit_inc(struct infra_cache* infra,

struct sockaddr_storage* addr, socklen_t addrlen, time_t timenow,

{

int max;

struct lruhash_entry* entry;

(*cur)++;

max = infra_rate_max(entry->data, timenow, backoff);

lock_rw_unlock(&entry->lock);

}

/* create */

/** ip ratelimit, 0 is off */

extern int infra_ip_ratelimit;

/**

* key for ip_ratelimit lookups, a source IP.

* @param addr: client address

* @param addrlen: client address length

* @param timenow: what time it is now.

* @param backoff: if backoff is enabled.

* @param buffer: with query for logging.

* @return 1 if it could be incremented. 0 if the increment overshot the

* ratelimit and the query should be dropped. */

int infra_ip_ratelimit_inc(struct infra_cache* infra,

struct sockaddr_storage* addr, socklen_t addrlen, time_t timenow,

/**

* Get memory used by the infra cache.

* Copyright (c) 2007, NLnet Labs. All rights reserved.

*

* This software is open source.

* Redistribution and use in source and binary forms, with or without

* modification, are permitted provided that the following conditions

* are met:

* Redistributions of source code must retain the above copyright notice,

* this list of conditions and the following disclaimer.

* Redistributions in binary form must reproduce the above copyright notice,

* this list of conditions and the following disclaimer in the documentation

* and/or other materials provided with the distribution.

* Neither the name of the NLNET LABS nor the names of its contributors may

* be used to endorse or promote products derived from this software without

* specific prior written permission.

* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS

* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT

* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR

#ifdef HAVE_NET_IF_H

#include <net/if.h>

#endif

/** number of queued TCP connections for listen() */

#ifndef THREADS_DISABLED

/** lock on the counter of stream buffer memory */

log_err("systemd sd_listen_fds(): %s", strerror(-r));

return -1;

}

for(i = 0; i < r; i++) {

if(sd_is_socket(SD_LISTEN_FDS_START + i, family, socktype, listen)) {

s = SD_LISTEN_FDS_START + i;

return -1;

}

#else

WSAGetLastError() == WSAEPROTONOSUPPORT) {

*noproto = 1;

return -1;

#endif

if(listen) {

#ifdef SO_REUSEADDR

(socklen_t)sizeof(on)) < 0) {

log_err("setsockopt(.. SO_REUSEADDR ..) failed: %s",

sock_strerror(errno));

socklen_t slen = (socklen_t)sizeof(got);

# ifdef SO_RCVBUFFORCE

/* Linux specific: try to use root permission to override

* /proc/sys/net/core/rmem_max or sysctl net.core.rmem_max */

(socklen_t)sizeof(rcv)) < 0) {

if(errno != EPERM) {

log_err("setsockopt(..., SO_RCVBUFFORCE, "

return -1;

}

# endif /* SO_RCVBUFFORCE */

(socklen_t)sizeof(rcv)) < 0) {

log_err("setsockopt(..., SO_RCVBUF, "

"...) failed: %s", sock_strerror(errno));

}

/* check if we got the right thing or if system

* reduced to some system max. Warn if so */

&slen) >= 0 && got < rcv/2) {

log_warn("so-rcvbuf %u was not granted. "

"Got %u. To fix: start with "

socklen_t slen = (socklen_t)sizeof(got);

# ifdef SO_SNDBUFFORCE

/* Linux specific: try to use root permission to override

* /proc/sys/net/core/wmem_max or sysctl net.core.wmem_max */

(socklen_t)sizeof(snd)) < 0) {

if(errno != EPERM) {

log_err("setsockopt(..., SO_SNDBUFFORCE, "

return -1;

}

# endif /* SO_SNDBUFFORCE */

(socklen_t)sizeof(snd)) < 0) {

log_err("setsockopt(..., SO_SNDBUF, "

"...) failed: %s", sock_strerror(errno));

}

/* check if we got the right thing or if system

* reduced to some system max. Warn if so */

&slen) >= 0 && got < snd/2) {

log_warn("so-sndbuf %u was not granted. "

"Got %u. To fix: start with "

# endif

) {

int val=(v6only==2)?0:1;

(void*)&val, (socklen_t)sizeof(val)) < 0) {

log_err("setsockopt(..., IPV6_V6ONLY"

", ...) failed: %s", sock_strerror(errno));

int action;

# if defined(IP_PMTUDISC_OMIT)

action = IP_PMTUDISC_OMIT;

&action, (socklen_t)sizeof(action)) < 0) {

if (errno != EINVAL) {

/* the IP_DONTFRAG option if defined in the 11.0 OSX headers,

* but does not work on that version, so we exclude it */

int off = 0;

&off, (socklen_t)sizeof(off)) < 0) {

log_err("setsockopt(..., IP_DONTFRAG, ...) failed: %s",

strerror(errno));

if(WSAGetLastError() != WSAEADDRINUSE &&

WSAGetLastError() != WSAEADDRNOTAVAIL &&

!(WSAGetLastError() == WSAEACCES && verbosity < 4 && !listen)) {

wsa_strerror(WSAGetLastError()),

(struct sockaddr_storage*)addr, addrlen);

}

}

#endif

#ifdef SO_REUSEADDR

(socklen_t)sizeof(on)) < 0) {

log_err("setsockopt(.. SO_REUSEADDR ..) failed: %s",

sock_strerror(errno));

&& !got_fd_from_systemd

# endif

) {

(void*)&on, (socklen_t)sizeof(on)) < 0) {

log_err("setsockopt(..., IPV6_V6ONLY, ...) failed: %s",

sock_strerror(errno));

addr->ai_addrlen);

}

#else

wsa_strerror(WSAGetLastError()),

(struct sockaddr_storage*)addr->ai_addr,

addr->ai_addrlen);

/* 5 is recommended on linux */

qlen = 5;

#endif

sizeof(qlen))) == -1 ) {

#ifdef ENOPROTOOPT

/* squelch ENOPROTOOPT: freebsd server mode with kernel support

* Create socket from getaddrinfo results

*/

static int

struct addrinfo *hints, int v6only, int* noip6, size_t rcv, size_t snd,

int* reuseport, int transparent, int tcp_mss, int nodelay, int freebind,

int use_systemd, int dscp, struct unbound_socket* ub_sock)

return -1;

}

#endif

ifname?ifname:"default", port, gai_strerror(r),

#ifdef EAI_SYSTEM

#else

""

#endif

/** make socket and first see if ifname contains port override info */

static int

struct addrinfo *hints, int v6only, int* noip6, size_t rcv, size_t snd,

int* reuseport, int transparent, int tcp_mss, int nodelay, int freebind,

int use_systemd, int dscp, struct unbound_socket* ub_sock)

return 1;

}

/** set fd to receive source address packet info */

static int

{

#if defined(IPV6_RECVPKTINFO) || defined(IPV6_PKTINFO) || (defined(IP_RECVDSTADDR) && defined(IP_SENDSRCADDR)) || defined(IP_PKTINFO)

int on = 1;

* @param use_systemd: if true, fetch sockets from systemd.

* @param dnscrypt_port: dnscrypt service port number

* @param dscp: DSCP to use.

* @return: returns false on error.

*/

static int

struct config_strlist* tls_additional_port, int https_port,

struct config_strlist* proxy_protocol_port,

int* reuseport, int transparent, int tcp_mss, int freebind,

{

int s, noip6=0;

int is_https = if_is_https(ifname, port, https_port);

if((s = make_sock_port(SOCK_DGRAM, ifname, port, hints, 1,

&noip6, rcv, snd, reuseport, transparent,

tcp_mss, nodelay, freebind, use_systemd, dscp, ub_sock)) == -1) {

free(ub_sock);

if(noip6) {

log_warn("IPv6 protocol not available");

/* getting source addr packet info is highly non-portable */

if(!set_recvpktinfo(s, hints->ai_family)) {

sock_close(s);

free(ub_sock);

return 0;

}

if(!port_insert(list, s, is_dnscrypt

?listen_type_udpancil_dnscrypt:listen_type_udpancil,

is_pp2, ub_sock)) {

sock_close(s);

free(ub_sock);

return 0;

}

if((s = make_sock_port(SOCK_DGRAM, ifname, port, hints, 1,

&noip6, rcv, snd, reuseport, transparent,

tcp_mss, nodelay, freebind, use_systemd, dscp, ub_sock)) == -1) {

free(ub_sock);

if(noip6) {

log_warn("IPv6 protocol not available");

}

return 0;

}

if(!port_insert(list, s, is_dnscrypt

?listen_type_udp_dnscrypt:listen_type_udp,

is_pp2, ub_sock)) {

sock_close(s);

free(ub_sock);

return 0;

}

if((s = make_sock_port(SOCK_STREAM, ifname, port, hints, 1,

&noip6, 0, 0, reuseport, transparent, tcp_mss, nodelay,

freebind, use_systemd, dscp, ub_sock)) == -1) {

free(ub_sock);

if(noip6) {

/*log_warn("IPv6 protocol not available");*/

verbose(VERB_ALGO, "setup TCP for SSL service");

if(!port_insert(list, s, port_type, is_pp2, ub_sock)) {

sock_close(s);

free(ub_sock);

return 0;

}

return 1;

}

* Add items to commpoint list in front.

* @param c: commpoint to add.

* @param front: listen struct.

}

}

listen_create(struct comm_base* base, struct listen_port* ports,

size_t bufsize, int tcp_accept_count, int tcp_idle_timeout,

int harden_large_queries, uint32_t http_max_streams,

}

}

listen_delete(struct listen_dnsport* front)

{

return;

listen_list_delete(front->cps);

#ifdef USE_DNSCRYPT

reuseport, cfg->ip_transparent,

cfg->tcp_mss, cfg->ip_freebind,

cfg->http_nodelay, cfg->use_systemd,

listening_ports_free(list);

return NULL;

}

reuseport, cfg->ip_transparent,

cfg->tcp_mss, cfg->ip_freebind,

cfg->http_nodelay, cfg->use_systemd,

listening_ports_free(list);

return NULL;

}

reuseport, cfg->ip_transparent,

cfg->tcp_mss, cfg->ip_freebind,

cfg->http_nodelay, cfg->use_systemd,

listening_ports_free(list);

return NULL;

}

reuseport, cfg->ip_transparent,

cfg->tcp_mss, cfg->ip_freebind,

cfg->http_nodelay, cfg->use_systemd,

listening_ports_free(list);

return NULL;

}

reuseport, cfg->ip_transparent,

cfg->tcp_mss, cfg->ip_freebind,

cfg->http_nodelay, cfg->use_systemd,

listening_ports_free(list);

return NULL;

}

reuseport, cfg->ip_transparent,

cfg->tcp_mss, cfg->ip_freebind,

cfg->http_nodelay, cfg->use_systemd,

listening_ports_free(list);

return NULL;

}

}

/* rc_ports don't have ub_socket */

if(list->socket) {

free(list->socket);

}

free(list);

size_t listen_get_mem(struct listen_dnsport* listen)

{

struct listen_list* p;

sldns_buffer_capacity(listen->udp_buff);

#ifdef USE_DNSCRYPT

s += sizeof(*listen->dnscrypt_udp_buff);

}

req->open_req_list = NULL;

req->num_open_req = 0;

/* free pending writable result packets */

item = req->done_req_list;

while(item) {

wr = 1;

if(!req->read_is_closed)

rd = 1;

if(wr) {

req->cp->tcp_is_reading = 0;

comm_point_stop_listening(req->cp);

}

req->in_worker_handle = 0;

/* it should be waiting in the mesh for recursion.

* Then the mesh state has been cleared. */

if(req->is_drop) {

/* the reply has been dropped, stream has been closed. */

last = req->done_req_list;

while(last && last->next)

last = last->next;

/* create new element */

item = (struct tcp_req_done_item*)malloc(sizeof(*item));

if(!item) {

"buffer already assigned to stream");

return -1;

}

/* the c->buffer might be used by mesh_send_reply and no be cleard

* need to be cleared before use */

sldns_buffer_clear(h2_session->c->buffer);

else rep.ns_numrrsets = 1;

rep.rrset_count = 1;

rep.rrsets = &rrset;

udpsize = edns->udp_size;

edns->edns_version = EDNS_ADVERTISED_VERSION;

edns->udp_size = EDNS_ADVERTISED_SIZE;

struct local_data key;

struct local_data* ld = NULL;

struct local_rrset* lr = NULL;

return 1;

if(z->type != local_zone_transparent

&& z->type != local_zone_typetransparent

|| lz_type == local_zone_always_transparent) {

/* no NODATA or NXDOMAINS for this zone type */

return 0;

} else if(lz_type == local_zone_always_null) {

/* 0.0.0.0 or ::0 or noerror/nodata for this zone type,

* used for blocklists. */

if(z && (lzt == local_zone_transparent ||

lzt == local_zone_typetransparent ||

lzt == local_zone_inform ||

local_zone_does_not_cover(z, qinfo, labs)) {

lock_rw_unlock(&z->lock);

z = NULL;

if(lzt != local_zone_always_refuse

&& lzt != local_zone_always_transparent

&& lzt != local_zone_always_nxdomain

&& lzt != local_zone_always_nodata

&& lzt != local_zone_always_deny

case local_zone_inform_deny: return "inform_deny";

case local_zone_inform_redirect: return "inform_redirect";

case local_zone_always_transparent: return "always_transparent";

case local_zone_always_refuse: return "always_refuse";

case local_zone_always_nxdomain: return "always_nxdomain";

case local_zone_always_nodata: return "always_nodata";

*t = local_zone_inform_redirect;

else if(strcmp(type, "always_transparent") == 0)

*t = local_zone_always_transparent;

else if(strcmp(type, "always_refuse") == 0)

*t = local_zone_always_refuse;

else if(strcmp(type, "always_nxdomain") == 0)

local_zone_inform_redirect,

/** resolve normally, even when there is local data */

local_zone_always_transparent,

/** answer with error, even when there is local data */

local_zone_always_refuse,

/** answer with nxdomain, even when there is local data */

* Copyright (c) 2007, NLnet Labs. All rights reserved.

*

* This software is open source.

* Redistribution and use in source and binary forms, with or without

* modification, are permitted provided that the following conditions

* are met:

* Redistributions of source code must retain the above copyright notice,

* this list of conditions and the following disclaimer.

* Redistributions in binary form must reproduce the above copyright notice,

* this list of conditions and the following disclaimer in the documentation

* and/or other materials provided with the distribution.

* Neither the name of the NLNET LABS nor the names of its contributors may

* be used to endorse or promote products derived from this software without

* specific prior written permission.

* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS

* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT

* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR

#include "util/data/dname.h"

#include "respip/respip.h"

#include "services/listen_dnsport.h"

#ifdef CLIENT_SUBNET

#include "edns-subnet/subnetmod.h"

#include "edns-subnet/edns-subnet.h"

#endif

/**

* Compare two response-ip client info entries for the purpose of mesh state

* compare. It returns 0 if ci_a and ci_b are considered equal; otherwise

return mesh_state_compare(a->s, b->s);

}

mesh_create(struct module_stack* stack, struct module_env* env)

{

struct mesh_area* mesh = calloc(1, sizeof(struct mesh_area));

mesh->stats_jostled = 0;

mesh->stats_dropped = 0;

mesh->ans_expired = 0;

mesh->max_reply_states = env->cfg->num_queries_per_thread;

mesh->max_forever_states = (mesh->max_reply_states+1)/2;

#ifndef S_SPLINT_S

* traversal and rbtree rebalancing do not work together */

}

mesh_delete(struct mesh_area* mesh)

{

if(!mesh)

if(m && m->reply_list && m->list_select == mesh_jostle_list) {

/* how old is it? */

struct timeval age;

&m->reply_list->start_time);

if(timeval_smaller(&mesh->jostle_max, &age)) {

/* its a goner */

comm_point_send_reply(rep);

return;

}

if(unique)

mesh_state_make_unique(s);

s->s.rpz_passthru = rpz_passthru;

s->s.edns_opts_front_in = edns_opt_copy_region(edns->opt_list_in,

s->s.region);

if(!s->s.edns_opts_front_in) {

if(!inplace_cb_reply_servfail_call(mesh->env, qinfo, NULL,

NULL, LDNS_RCODE_SERVFAIL, edns, rep, mesh->env->scratch, mesh->env->now_tv))

edns->opt_list_inplace_cb_out = NULL;

error_encode(r_buffer, LDNS_RCODE_SERVFAIL,

qinfo, qid, qflags, edns);

comm_point_send_reply(rep);

return;

}

}

#endif

rbtree_insert(&mesh->all, &s->node);

log_assert(n != NULL);

added = 1;

}

if(!s->reply_list && !s->cb_list) {

/* move to either the forever or the jostle_list */

if(mesh->num_forever_states < mesh->max_forever_states) {

mesh->num_forever_states ++;

&mesh->forever_last);

s->list_select = mesh_forever_list;

} else {

&mesh->jostle_last);

s->list_select = mesh_jostle_list;

}

return;

}

mesh_new_callback(struct mesh_area* mesh, struct query_info* qinfo,

uint16_t qid, mesh_cb_func_type cb, void* cb_arg, int rpz_passthru)

{

struct mesh_state* s = NULL;

if(!s) {

return 0;

}

if(unique)

mesh_state_make_unique(s);

s->s.rpz_passthru = rpz_passthru;

s->s.edns_opts_front_in = edns_opt_copy_region(edns->opt_list_in,

s->s.region);

if(!s->s.edns_opts_front_in) {

return 0;

}

}

#endif

rbtree_insert(&mesh->all, &s->node);

log_assert(n != NULL);

added = 1;

}

if(!s->reply_list && !s->cb_list) {

}

/* add serve expired timer if not already there */

if(timeout && !mesh_serve_expired_init(s, timeout)) {

return 0;

}

/* update statistics */

* attached its own ECS data. */

static void mesh_schedule_prefetch_subnet(struct mesh_area* mesh,

struct query_info* qinfo, uint16_t qflags, time_t leeway, int run,

{

struct mesh_state* s = NULL;

struct edns_option* opt = NULL;

return;

}

} else {

}

#ifdef UNBOUND_DEBUG

n =

void mesh_new_prefetch(struct mesh_area* mesh, struct query_info* qinfo,

uint16_t qflags, time_t leeway, int rpz_passthru,

{

(void)opt_list;

#ifdef CLIENT_SUBNET

mesh_schedule_prefetch_subnet(mesh, qinfo, qflags, leeway, 1,

else

#endif

mesh_schedule_prefetch(mesh, qinfo, qflags, leeway, 1,

int i;

if(!region)

return NULL;

sizeof(struct mesh_state));

if(!mstate) {

alloc_reg_release(env->alloc, region);

return mstate;

}

void

mesh_state_make_unique(struct mesh_state* mstate)

{

mstate->unique = mstate;

}

mesh_state_cleanup(struct mesh_state* mstate)

{

struct mesh_area* mesh;

alloc_reg_release(mstate->s.env->alloc, mstate->s.region);

}

mesh_state_delete(struct module_qstate* qstate)

{

struct mesh_area* mesh;

mesh_detach_subs(&mstate->s);

if(mstate->list_select == mesh_forever_list) {

mesh->num_forever_states --;

&mesh->forever_last);

} else if(mstate->list_select == mesh_jostle_list) {

&mesh->jostle_last);

}

if(!mstate->reply_list && !mstate->cb_list

if(!ref->s->reply_list && !ref->s->cb_list

&& ref->s->super_set.count == 0) {

mesh->num_detached_states++;

mesh->num_reply_states <= mesh->all.count);

}

}

if(!mesh_state_attachment(qstate->mesh_info, sub))

return 0;

/* if it was a duplicate attachment, the count was not zero before */

sub->super_set.count == 1) {

/* it used to be detached, before this one got added */

log_assert(mesh->num_detached_states > 0);

else secure = 0;

if(!rep && rcode == LDNS_RCODE_NOERROR)

rcode = LDNS_RCODE_SERVFAIL;

rep->security == sec_status_secure_sentinel_fail)) {

if(!(reason = errinf_to_str_bogus(&m->s)))

rcode = LDNS_RCODE_SERVFAIL;

if(!inplace_cb_reply_call(m->s.env, &m->s.qinfo, &m->s, rep,

LDNS_RCODE_NOERROR, &r->edns, NULL, m->s.region, start_time) ||

{

fptr_ok(fptr_whitelist_mesh_cb(r->cb));

(*r->cb)(r->cb_arg, LDNS_RCODE_SERVFAIL, r->buf,

} else {

fptr_ok(fptr_whitelist_mesh_cb(r->cb));

(*r->cb)(r->cb_arg, LDNS_RCODE_NOERROR, r->buf,

}

}

free(reason);

}

static inline int

return r->query_reply.c->type == comm_udp;

}

/**

* Send reply to mesh reply entry

* @param m: mesh state to send it for.

/* examine security status */

if(m->s.env->need_to_validate && (!(r->qflags&BIT_CD) ||

(rep->security <= sec_status_bogus ||

rep->security == sec_status_secure_sentinel_fail)) {

rcode = LDNS_RCODE_SERVFAIL;

if(!inplace_cb_reply_servfail_call(m->s.env, &m->s.qinfo, &m->s,

rep, rcode, &r->edns, &r->query_reply, m->s.region, &r->start_time))

r->edns.opt_list_inplace_cb_out = NULL;

if(!inplace_cb_reply_call(m->s.env, &m->s.qinfo, &m->s, rep, rcode,

&r->edns, &r->query_reply, m->s.region, &r->start_time))

r->edns.opt_list_inplace_cb_out = NULL;

}

}

error_encode(r_buffer, rcode, &m->s.qinfo, r->qid,

r->qflags, &r->edns);

r->edns.bits &= EDNS_DO;

m->s.qinfo.qname = r->qname;

m->s.qinfo.local_alias = r->local_alias;

if(!inplace_cb_reply_call(m->s.env, &m->s.qinfo, &m->s, rep,

LDNS_RCODE_NOERROR, &r->edns, &r->query_reply, m->s.region, &r->start_time) ||

r->qflags, r_buffer, 0, 1, m->s.env->scratch,

udp_size, &r->edns, (int)(r->edns.bits & EDNS_DO),

{

if(!inplace_cb_reply_servfail_call(m->s.env, &m->s.qinfo, &m->s,

rep, LDNS_RCODE_SERVFAIL, &r->edns, &r->query_reply, m->s.region, &r->start_time))

struct reply_info* rep = (mstate->s.return_msg?

mstate->s.return_msg->rep:NULL);

struct timeval tv = {0, 0};

/* No need for the serve expired timer anymore; we are going to reply. */

if(mstate->s.serve_expired_data) {

comm_timer_delete(mstate->s.serve_expired_data->timer);

}

}

for(r = mstate->reply_list; r; r = r->next) {

tv = r->start_time;

/* if a response-ip address block has been stored the

mstate->s.qinfo.qclass, r->local_alias,

&r->query_reply.client_addr,

r->query_reply.client_addrlen);

}

/* if this query is determined to be dropped during the

prev_buffer = r_buffer;

}

}

if(mstate->reply_list) {

mstate->reply_list = NULL;

if(!mstate->reply_list && !mstate->cb_list) {

mstate->s.env->mesh->num_detached_states++;

}

mstate->replies_sent = 1;

while((c = mstate->cb_list) != NULL) {

/* take this cb off the list; so that the list can be

* changed, eg. by adds from the callback routine */

/* callback the function to inform super of result */

fptr_ok(fptr_whitelist_mod_inform_super(

mesh->mods.mod[ref->s->s.curmod]->inform_super));

ref->s->s.curmod, &ref->s->s);

/* copy state that is always relevant to super */

copy_state_to_super(&mstate->s, ref->s->s.curmod, &ref->s->s);

* desire aggregation).*/

key.unique = NULL;

key.s.client_info = cinfo;

result = (struct mesh_state*)rbtree_search(&mesh->all, &key);

return result;

}

sldns_buffer* buf, mesh_cb_func_type cb, void* cb_arg,

uint16_t qid, uint16_t qflags)

{

sizeof(struct mesh_cb));

if(!r)

return 0;

* Handles module finished.

* @param mesh: the mesh area.

* @param mstate: currently active mesh state.

* send replies to clients and inform other mesh states.

* This in turn may create additional runnable mesh states.

* @param s: state at which the current module exited.

}

if(s == module_restart_next) {

int curmod = mstate->s.curmod;

mstate->s.curmod++) {

fptr_ok(fptr_whitelist_mod_clear(

mesh->mods.mod[mstate->s.curmod]->clear));

if(s == module_finished) {

if(mstate->s.curmod == 0) {

struct query_info* qinfo = NULL;

uint16_t qflags;

int rpz_p = 0;

mesh_query_done(mstate);

mesh_walk_supers(mesh, mstate);

* we need to make a copy of the query info here. */

if(mstate->s.need_refetch) {

mesh_copy_qinfo(mstate, &qinfo, &qflags);

rpz_p = mstate->s.rpz_passthru;

}

if(qinfo) {

}

return 0;

}

mstate->s.reply = NULL;

regional_free_all(mstate->s.env->scratch);

s = mstate->s.ext_state[mstate->s.curmod];

mesh->mods.mod[mstate->s.curmod]->name, strextstate(s));

e = NULL;

if(mesh_continue(mesh, mstate, s, &ev))

}

}

mesh_log_list(struct mesh_area* mesh)

{

char buf[30];

struct mesh_state* m;

int num = 0;

RBTREE_FOR(m, struct mesh_state*, &mesh->all) {

num++, (m->s.is_priming)?"p":"", /* prime */

(m->s.is_valrec)?"v":"", /* prime */

(m->s.query_flags&BIT_RD)?"RD":"",

(m->sub_set.count!=0)?"c":"", /* children */

m->s.curmod, (m->reply_list)?"rep":"", /*hasreply*/

(m->cb_list)?"cb":"" /* callbacks */

log_query_info(VERB_ALGO, buf, &m->s.qinfo);

}

}

mesh_stats(struct mesh_area* mesh, const char* str)

{

verbose(VERB_DETAIL, "%s %u recursion states (%u with reply, "

"%u detached), %u waiting replies, %u recursion replies "

(unsigned)mesh->num_reply_states,

(unsigned)mesh->num_detached_states,

(unsigned)mesh->num_reply_addrs,

(unsigned)mesh->stats_jostled);

if(mesh->replies_sent > 0) {

struct timeval avg;

mesh->replies_sent);

log_info("average recursion processing time "

ARG_LL "d.%6.6d sec",

}

}

mesh_stats_clear(struct mesh_area* mesh)

{

if(!mesh)

mesh->ans_secure = 0;

mesh->ans_bogus = 0;

mesh->ans_expired = 0;

memset(&mesh->ans_rcode[0], 0, sizeof(size_t)*UB_STATS_RCODE_NUM);

memset(&mesh->rpz_action[0], 0, sizeof(size_t)*UB_STATS_RPZ_ACTION_NUM);

mesh->ans_nodata = 0;

}

mesh_get_mem(struct mesh_area* mesh)

{

struct mesh_state* m;

return s;

}

mesh_detect_cycle(struct module_qstate* qstate, struct query_info* qinfo,

uint16_t flags, int prime, int valrec)

{

struct timeval tv = {0, 0};

int must_validate = (!(qstate->query_flags&BIT_CD)

|| qstate->env->cfg->ignore_cd) && qstate->env->need_to_validate;

if(!qstate->serve_expired_data) return;

verbose(VERB_ALGO, "Serve expired: Trying to reply with expired data");

comm_timer_delete(qstate->serve_expired_data->timer);

log_dns_msg("Serve expired lookup", &qstate->qinfo, msg->rep);

for(r = mstate->reply_list; r; r = r->next) {

tv = r->start_time;

/* If address info is returned, it means the action should be an

qstate->qinfo.qtype, qstate->qinfo.qclass,

r->local_alias, &r->query_reply.client_addr,

r->query_reply.client_addrlen);

}

/* Add EDE Stale Answer (RCF8914). Ignore global ede as this is

tcp_req_info_remove_mesh_state(r->query_reply.c->tcp_req_info, mstate);

prev = r;

prev_buffer = r_buffer;

}

if(mstate->reply_list) {

mstate->reply_list = NULL;

if(!mstate->reply_list && !mstate->cb_list) {

}

}

}

while((c = mstate->cb_list) != NULL) {

/* take this cb off the list; so that the list can be

* changed, eg. by adds from the callback routine */

size_t stats_dropped;

/** stats, number of expired replies sent */

size_t ans_expired;

/** number of replies sent */

size_t replies_sent;

/** sum of waiting times for the replies */

* @param leeway: TTL leeway what to expire earlier for this update.

* @param rpz_passthru: if true, the rpz passthru was previously found and

* further rpz processing is stopped.

* @param opt_list: edns opt_list from the client; to be used when subnet is

* enabled.

*/

void mesh_new_prefetch(struct mesh_area* mesh, struct query_info* qinfo,

uint16_t qflags, time_t leeway, int rpz_passthru,

/**

* Handle new event from the wire. A serviced query has returned.

uint16_t qflags, int prime, int valrec);

/**

* Make a mesh state unique.

* A unique mesh state uses it's unique member to point to itself.

* @param mstate: mesh state to check.

stack->mod[i] = module_factory(&module_conf);

if(!stack->mod[i]) {

char md[256];

snprintf(md, sizeof(md), "%s", module_conf);

log_err("Unknown value in module-config, module: '%s'."

" This module is not present (not compiled in),"

return 0;

}

}

log_assert(&key_p != ((struct reuse_tcp*)result)->pending);

}

/* not found, return null */

if(!result || result == RBTREE_NULL)

return NULL;

verbose(VERB_CLIENT, "reuse_tcp_find check inexact match");

/* inexact match, find one of possibly several connections to the

* same destination address, with the correct port, ssl, and

log_assert(w->addrlen > 0);

pend->c->tcp_do_toggle_rw = 0;

pend->c->tcp_do_close = 0;

/* open socket */

s = outnet_get_tcp_fd(&w->addr, w->addrlen, w->outnet->tcp_mss, w->outnet->ip_dscp);

return z;

}

/**

* Remove RR from RPZ's local-data

* @param z: local-zone for RPZ, holding write lock

}

static void

{

struct local_zone* z;

int delete_zone = 1;

1 /* only exact */, 1 /* wr lock */, 1 /* keep lock*/);

if(!z) {

verbose(VERB_ALGO, "rpz: cannot remove RR from IXFR, "

dnamelen, rr_type, rdatawl, rdatalen);

else if(a != localzone_type_to_rpz_action(z->type)) {

lock_rw_unlock(&z->lock);

return;

}

lock_rw_unlock(&z->lock);

if(delete_zone) {

}

}

static void

lock_rw_unlock(&r->respip_set->lock);

}

void

{

size_t policydnamelen;

enum rpz_trigger t;

enum rpz_action a;

uint8_t* policydname;

if(!(policydname = calloc(1, LDNS_MAX_DOMAINLEN + 1)))

return;

return;

}

t = rpz_dname_to_trigger(policydname, policydnamelen);

if(t == RPZ_QNAME_TRIGGER) {

rpz_remove_qname_trigger(r, policydname, policydnamelen, a,

rr_type, rr_class, rdatawl, rdatalen);

} else if(t == RPZ_RESPONSE_IP_TRIGGER) {

rpz_remove_response_ip_trigger(r, policydname, policydnamelen,

a, rr_type, rdatawl, rdatalen);

}

free(policydname);

}

return 1;

}

/** allocate SOA record ubrrsetkey in region */

static struct ub_packed_rrset_key*

make_soa_ubrrset(struct auth_zone* auth_zone, struct auth_rrset* soa,

0, /* ns */

0, /* ar */

0, /* total */

if(msg->rep)

msg->rep->authoritative = 1;

if(!rpz_add_soa(msg->rep, ms, az))

0, /* ns */

0, /* ar */

0, /* total */

if(msg->rep)

msg->rep->authoritative = 1;

if(!rpz_add_soa(msg->rep, ms, az))

0, /* ns */

0, /* ar */

1, /* total */

if(new_reply_info == NULL) {

log_err("out of memory");

return NULL;

RPZ_CNAME_OVERRIDE_ACTION, /* RPZ CNAME action override*/

};

struct regional* region;

struct rbtree_type entries;

};

struct clientip_synthesized_rr {

struct addr_tree_node node;

/** lock on the node item */

lock_rw_type lock;

/** action for this address span */

enum rpz_action action;

/** "local data" for this node */

/**

* Delete policy matching RR, used for IXFR.

* @param r: the rpz to add the policy to.

* @param aznamelen: the length of the auth-zone name

* @param dname: dname of the RR

* @param dnamelen: length of the dname

* @param rdatawl: rdata of the RR, prepended with the rdata size

* @param rdatalen: length if the RR, including the prepended rdata size

*/

/**

* Walk over the RPZ zones to find and apply a QNAME trigger policy.