diff --git a/configure.ac b/configure.ac index 5a71ad25..6961311f 100644 --- a/configure.ac +++ b/configure.ac @@ -392,7 +392,14 @@ case "$enable_ecdsa" in ;; esac - +AC_ARG_ENABLE(draft-dnssec-roadblock-avoidance, AC_HELP_STRING([--enable-draft-dnssec-roadblock-avoidance], [Enable experimental dnssec roadblock avoidance])) +case "$enable_draft_dnssec_roadblock_avoidance" in + yes) + AC_DEFINE_UNQUOTED([DNSSEC_ROADBLOCK_AVOIDANCE], [1], [Define this to enable the experimental draft dnssec roadblock avoidance.]) + ;; + no|*) + ;; +esac AC_ARG_ENABLE(draft-edns-cookies, AC_HELP_STRING([--enable-draft-edns-cookies], [Enable experimental edns cookies])) case "$enable_draft_edns_cookies" in diff --git a/src/Makefile.in b/src/Makefile.in index 381ab6bd..d6d90054 100644 --- a/src/Makefile.in +++ b/src/Makefile.in @@ -117,7 +117,7 @@ install: libgetdns.la $(INSTALL) -m 755 -d $(DESTDIR)$(includedir) $(INSTALL) -m 755 -d $(DESTDIR)$(includedir)/getdns $(INSTALL) -m 644 getdns/getdns.h $(DESTDIR)$(includedir)/getdns/getdns.h - $(INSTALL) -m 644 $(srcdir)/getdns/getdns_extra.h $(DESTDIR)$(includedir)/getdns/getdns_extra.h + $(INSTALL) -m 644 getdns/getdns_extra.h $(DESTDIR)$(includedir)/getdns/getdns_extra.h $(INSTALL) -m 755 -d $(DESTDIR)$(libdir) $(LIBTOOL) --mode=install cp libgetdns.la $(DESTDIR)$(libdir) if test $(have_libevent) = 1 ; then $(INSTALL) -m 644 $(srcdir)/getdns/getdns_ext_libevent.h $(DESTDIR)$(includedir)/getdns/ ; $(LIBTOOL) --mode=install cp $(EXTENSION_LIBEVENT_LIB) $(DESTDIR)$(libdir) ; fi diff --git a/src/context.c b/src/context.c index 9dd7661e..7cf844ea 100644 --- a/src/context.c +++ b/src/context.c @@ -2176,13 +2176,35 @@ ub_setup_stub(struct ub_ctx *ctx, getdns_context *context) } #endif + static getdns_return_t -_getdns_ns_dns_setup(struct getdns_context *context) +ub_setup_recursing(struct ub_ctx *ctx, getdns_context *context) { #ifdef HAVE_LIBUNBOUND _getdns_rr_iter rr_spc, *rr; char ta_str[8192]; #endif + + /* TODO: use the root servers via root hints file */ + (void) ub_ctx_set_fwd(ctx, NULL); + if (!context->unbound_ta_set && context->trust_anchors) { + for ( rr = _getdns_rr_iter_init( &rr_spc + , context->trust_anchors + , context->trust_anchors_len) + ; rr ; rr = _getdns_rr_iter_next(rr) ) { + + (void) gldns_wire2str_rr_buf(rr->pos, + rr->nxt - rr->pos, ta_str, sizeof(ta_str)); + (void) ub_ctx_add_ta(ctx, ta_str); + } + context->unbound_ta_set = 1; + } + return GETDNS_RETURN_GOOD; +} + +static getdns_return_t +_getdns_ns_dns_setup(struct getdns_context *context) +{ assert(context); switch (context->resolution_type) { @@ -2190,31 +2212,20 @@ _getdns_ns_dns_setup(struct getdns_context *context) if (!context->upstreams || !context->upstreams->count) return GETDNS_RETURN_GENERIC_ERROR; #ifdef STUB_NATIVE_DNSSEC +#ifdef DNSSEC_ROADBLOCK_AVOIDANCE + return ub_setup_recursing(context->unbound_ctx, context); +#else return GETDNS_RETURN_GOOD; +#endif #else return ub_setup_stub(context->unbound_ctx, context); #endif case GETDNS_RESOLUTION_RECURSING: #ifdef HAVE_LIBUNBOUND - /* TODO: use the root servers via root hints file */ - (void) ub_ctx_set_fwd(context->unbound_ctx, NULL); - if (!context->unbound_ta_set && context->trust_anchors) { - for ( rr = _getdns_rr_iter_init( &rr_spc - , context->trust_anchors - , context->trust_anchors_len) - ; rr ; rr = _getdns_rr_iter_next(rr) ) { - - (void) gldns_wire2str_rr_buf(rr->pos, - rr->nxt - rr->pos, ta_str, sizeof(ta_str)); - (void) ub_ctx_add_ta( - context->unbound_ctx, ta_str); - } - context->unbound_ta_set = 1; - } - return GETDNS_RETURN_GOOD; + return ub_setup_recursing(context->unbound_ctx, context); #else - return GETDNS_RETURN_GENERIC_ERROR; + return GETDNS_RETURN_NOT_IMPLEMENTED; #endif } return GETDNS_RETURN_BAD_CONTEXT; @@ -2234,7 +2245,7 @@ _getdns_context_prepare_for_resolution(struct getdns_context *context, /* Transport can in theory be set per query in stub mode */ if (context->resolution_type == GETDNS_RESOLUTION_STUB && - tls_is_in_transports_list(context) == 1) { + tls_is_in_transports_list(context) == 1) { if (context->tls_ctx == NULL) { #ifdef HAVE_TLS_v1_2 /* Create client context, use TLS v1.2 only for now */ diff --git a/src/dict.c b/src/dict.c index 16e0b3fb..dd59d346 100644 --- a/src/dict.c +++ b/src/dict.c @@ -981,6 +981,7 @@ getdns_pp_dict(gldns_buffer * buf, size_t indent, if (!json && (strcmp(item->node.key, "type") == 0 || strcmp(item->node.key, "type_covered") == 0 || + strcmp(item->node.key, "query_type") == 0 || strcmp(item->node.key, "qtype") == 0) && (strval = _getdns_rr_type_name(item->i.data.n))) { if (gldns_buffer_printf( @@ -994,6 +995,7 @@ getdns_pp_dict(gldns_buffer * buf, size_t indent, strcmp(item->node.key, "status") == 0 || strcmp(item->node.key, "append_name") == 0 || strcmp(item->node.key, "follow_redirects") == 0 || + strcmp(item->node.key, "transport") == 0 || strcmp(item->node.key, "resolution_type") == 0) && (strval = _getdns_get_const_info(item->i.data.n)->name)) { diff --git a/src/dnssec.c b/src/dnssec.c index 780ac6de..db0b7caa 100644 --- a/src/dnssec.c +++ b/src/dnssec.c @@ -1108,6 +1108,15 @@ static void add_question2val_chain(struct mem_funcs *mf, /************* Schedule Queries to Provision Validation Chain *************** *****************************************************************************/ +static getdns_dict *CD_extension(getdns_dns_req *dnsreq) +{ + return !dnsreq->dnssec_roadblock_avoidance + ? dnssec_ok_checking_disabled + : !dnsreq->avoid_dnssec_roadblocks + ? dnssec_ok_checking_disabled_roadblock_avoidance + : dnssec_ok_checking_disabled_avoid_roadblocks; +} + static void check_chain_complete(chain_head *chain); static void val_chain_node_soa_cb(getdns_dns_req *dnsreq); static void val_chain_sched_soa_node(chain_node *node) @@ -1127,7 +1136,7 @@ static void val_chain_sched_soa_node(chain_node *node) if (! node->soa_req && ! _getdns_general_loop(context, loop, name, GETDNS_RRTYPE_SOA, - dnssec_ok_checking_disabled, node, &dnsreq, NULL, + CD_extension(node->chains->netreq->owner), node, &dnsreq, NULL, val_chain_node_soa_cb)) node->soa_req = dnsreq->netreqs[0]; @@ -1174,13 +1183,15 @@ static void val_chain_sched_node(chain_node *node) if (! node->dnskey_req /* not scheduled */ && ! _getdns_general_loop(context, loop, name, GETDNS_RRTYPE_DNSKEY, - dnssec_ok_checking_disabled, node, &dnsreq, NULL, val_chain_node_cb)) + CD_extension(node->chains->netreq->owner), + node, &dnsreq, NULL, val_chain_node_cb)) node->dnskey_req = dnsreq->netreqs[0]; if (! node->ds_req && node->parent /* not root */ && ! _getdns_general_loop(context, loop, name, GETDNS_RRTYPE_DS, - dnssec_ok_checking_disabled, node, &dnsreq, NULL, val_chain_node_cb)) + CD_extension(node->chains->netreq->owner), + node, &dnsreq, NULL, val_chain_node_cb)) node->ds_req = dnsreq->netreqs[0]; } @@ -1216,7 +1227,8 @@ static void val_chain_sched_ds_node(chain_node *node) if (! node->ds_req && node->parent /* not root */ && ! _getdns_general_loop(context, loop, name, GETDNS_RRTYPE_DS, - dnssec_ok_checking_disabled, node, &ds_req, NULL, val_chain_node_cb)) + CD_extension(node->chains->netreq->owner), + node, &ds_req, NULL, val_chain_node_cb)) node->ds_req = ds_req->netreqs[0]; } @@ -3088,6 +3100,25 @@ static void check_chain_complete(chain_head *chain) chain, rrset_iter_init( &tas_iter , context->trust_anchors , context->trust_anchors_len)); +#endif +#ifdef DNSSEC_ROADBLOCK_AVOIDANCE + if ( dnsreq->dnssec_roadblock_avoidance + && dnsreq->netreqs[0]->dnssec_status == GETDNS_DNSSEC_BOGUS) { + + getdns_return_t r = GETDNS_RETURN_GOOD; + getdns_network_req **netreq_p, *netreq; + + dnsreq->avoid_dnssec_roadblocks = 1; + + for ( netreq_p = dnsreq->netreqs + ; !r && (netreq = *netreq_p) + ; netreq_p++) { + + netreq->state = NET_REQ_NOT_SENT; + (void) _getdns_submit_netreq(netreq); + } + return; + } #endif val_chain_list = dnsreq->dnssec_return_validation_chain ? getdns_list_create_with_context(context) : NULL; diff --git a/src/general.c b/src/general.c index 2cb9b0f0..c73a2e9e 100644 --- a/src/general.c +++ b/src/general.c @@ -90,10 +90,16 @@ _getdns_check_dns_req_complete(getdns_dns_req *dns_req) else if (! results_found) _getdns_call_user_callback(dns_req, NULL); else if (dns_req->dnssec_return_validation_chain +#ifdef DNSSEC_ROADBLOCK_AVOIDANCE + || ( dns_req->dnssec_roadblock_avoidance + && !dns_req->avoid_dnssec_roadblocks) +#endif + #ifdef STUB_NATIVE_DNSSEC || (dns_req->context->resolution_type == GETDNS_RESOLUTION_STUB && (dns_req->dnssec_return_status || - dns_req->dnssec_return_only_secure)) + dns_req->dnssec_return_only_secure + )) #endif ) _getdns_get_validation_chain(dns_req); @@ -128,24 +134,29 @@ ub_resolve_callback(void* arg, int err, struct ub_result* ub_res) #endif -static getdns_return_t -submit_network_request(getdns_network_req *netreq) +getdns_return_t +_getdns_submit_netreq(getdns_network_req *netreq) { getdns_return_t r; getdns_dns_req *dns_req = netreq->owner; char name[1024]; - if (dns_req->context->resolution_type == GETDNS_RESOLUTION_RECURSING - /* TODO: Until DNSSEC with the new async stub resolver is finished, - * use unbound when we need DNSSEC. - */ -#ifndef STUB_NATIVE_DNSSEC + +#ifdef STUB_NATIVE_DNSSEC +# ifdef DNSSEC_ROADBLOCK_AVOIDANCE + + if ((dns_req->context->resolution_type == GETDNS_RESOLUTION_RECURSING + && !dns_req->dnssec_roadblock_avoidance) + || dns_req->avoid_dnssec_roadblocks) { +# else + if ( dns_req->context->resolution_type == GETDNS_RESOLUTION_RECURSING) { +# endif +#else + if ( dns_req->context->resolution_type == GETDNS_RESOLUTION_RECURSING || dns_req->dnssec_return_status || dns_req->dnssec_return_only_secure - || dns_req->dnssec_return_validation_chain + || dns_req->dnssec_return_validation_chain) { #endif - ) { - /* schedule the timeout */ if (! dns_req->timeout.timeout_cb) { dns_req->timeout.userarg = dns_req; @@ -217,7 +228,7 @@ getdns_general_ns(getdns_context *context, getdns_eventloop *loop, for ( netreq_p = req->netreqs ; !r && (netreq = *netreq_p) ; netreq_p++) - r = submit_network_request(netreq); + r = _getdns_submit_netreq(netreq); else for (i = 0; i < context->namespace_count; i++) { if (context->namespaces[i] == GETDNS_NAMESPACE_LOCALNAMES) { @@ -239,7 +250,7 @@ getdns_general_ns(getdns_context *context, getdns_eventloop *loop, for ( netreq_p = req->netreqs ; !r && (netreq = *netreq_p) ; netreq_p++) - r = submit_network_request(netreq); + r = _getdns_submit_netreq(netreq); break; } else r = GETDNS_RETURN_BAD_CONTEXT; diff --git a/src/general.h b/src/general.h index 94c32219..58201056 100644 --- a/src/general.h +++ b/src/general.h @@ -44,6 +44,8 @@ void _getdns_call_user_callback(getdns_dns_req *, getdns_dict *); void _getdns_check_dns_req_complete(getdns_dns_req *dns_req); +getdns_return_t _getdns_submit_netreq(getdns_network_req *netreq); + getdns_return_t _getdns_general_loop(getdns_context *context, getdns_eventloop *loop, diff --git a/src/request-internal.c b/src/request-internal.c index 31a080b1..5c8de2bc 100644 --- a/src/request-internal.c +++ b/src/request-internal.c @@ -48,6 +48,21 @@ getdns_dict dnssec_ok_checking_disabled_spc = { }; getdns_dict *dnssec_ok_checking_disabled = &dnssec_ok_checking_disabled_spc; +getdns_dict dnssec_ok_checking_disabled_roadblock_avoidance_spc = { + { RBTREE_NULL, 0, (int (*)(const void *, const void *)) strcmp }, + { 0 } +}; +getdns_dict *dnssec_ok_checking_disabled_roadblock_avoidance + = &dnssec_ok_checking_disabled_roadblock_avoidance_spc; + +getdns_dict dnssec_ok_checking_disabled_avoid_roadblocks_spc = { + { RBTREE_NULL, 0, (int (*)(const void *, const void *)) strcmp }, + { 0 } +}; +getdns_dict *dnssec_ok_checking_disabled_avoid_roadblocks + = &dnssec_ok_checking_disabled_avoid_roadblocks_spc; + + static int is_extension_set(getdns_dict *extensions, const char *extension) { @@ -56,7 +71,9 @@ is_extension_set(getdns_dict *extensions, const char *extension) if (! extensions) return 0; - else if (extensions == dnssec_ok_checking_disabled) + else if (extensions == dnssec_ok_checking_disabled + || extensions == dnssec_ok_checking_disabled_roadblock_avoidance + || extensions == dnssec_ok_checking_disabled_avoid_roadblocks) return 0; r = getdns_dict_get_int(extensions, extension, &value); @@ -115,6 +132,11 @@ network_req_init(getdns_network_req *net_req, getdns_dns_req *owner, net_req->response_len = 0; net_req->base_query_option_sz = opt_options_size; + /* Some fields to record info for return_call_debugging */ + net_req->debug_start_time = 0; + net_req->debug_end_time = 0; + net_req->debug_tls_auth_status = 0; + net_req->wire_data_sz = wire_data_sz; if (max_query_sz) { /* first two bytes will contain query length (for tcp) */ @@ -291,10 +313,24 @@ _getdns_dns_req_new(getdns_context *context, getdns_eventloop *loop, = is_extension_set(extensions, "dnssec_return_validation_chain"); int edns_cookies = is_extension_set(extensions, "edns_cookies"); +#ifdef DNSSEC_ROADBLOCK_AVOIDANCE + int avoid_dnssec_roadblocks + = (extensions == dnssec_ok_checking_disabled_avoid_roadblocks); + int dnssec_roadblock_avoidance + = is_extension_set(extensions, "dnssec_roadblock_avoidance") + || (extensions == dnssec_ok_checking_disabled_roadblock_avoidance) + || avoid_dnssec_roadblocks; +#endif int dnssec_extension_set = dnssec_return_status || dnssec_return_only_secure || dnssec_return_validation_chain - || (extensions == dnssec_ok_checking_disabled); + || (extensions == dnssec_ok_checking_disabled) + || (extensions == dnssec_ok_checking_disabled_roadblock_avoidance) + || (extensions == dnssec_ok_checking_disabled_avoid_roadblocks) +#ifdef DNSSEC_ROADBLOCK_AVOIDANCE + || dnssec_roadblock_avoidance +#endif + ; uint32_t edns_do_bit; int edns_maximum_udp_payload_size; @@ -329,7 +365,9 @@ _getdns_dns_req_new(getdns_context *context, getdns_eventloop *loop, size_t max_query_sz, max_response_sz, netreq_sz, dnsreq_base_sz; uint8_t *region; - if (extensions == dnssec_ok_checking_disabled) + if (extensions == dnssec_ok_checking_disabled || + extensions == dnssec_ok_checking_disabled_roadblock_avoidance || + extensions == dnssec_ok_checking_disabled_avoid_roadblocks) extensions = NULL; have_add_opt_parameters = getdns_dict_get_dict(extensions, @@ -376,7 +414,12 @@ _getdns_dns_req_new(getdns_context *context, getdns_eventloop *loop, ? edns_maximum_udp_payload_size : 512; /* (x + 7) / 8 * 8 to align on 8 byte boundries */ +#ifdef DNSSEC_ROADBLOCK_AVOIDANCE + if (context->resolution_type == GETDNS_RESOLUTION_RECURSING + && (!dnssec_roadblock_avoidance || avoid_dnssec_roadblocks)) +#else if (context->resolution_type == GETDNS_RESOLUTION_RECURSING) +#endif max_query_sz = 0; else { for (i = 0; i < noptions; i++) { @@ -438,9 +481,15 @@ _getdns_dns_req_new(getdns_context *context, getdns_eventloop *loop, result->dnssec_return_only_secure = dnssec_return_only_secure; result->dnssec_return_validation_chain = dnssec_return_validation_chain; result->edns_cookies = edns_cookies; +#ifdef DNSSEC_ROADBLOCK_AVOIDANCE + result->dnssec_roadblock_avoidance = dnssec_roadblock_avoidance; + result->avoid_dnssec_roadblocks = avoid_dnssec_roadblocks; +#endif result->edns_client_subnet_private = context->edns_client_subnet_private; result->tls_query_padding_blocksize = context->tls_query_padding_blocksize; - + result->return_call_debugging + = is_extension_set(extensions, "return_call_debugging"); + /* will be set by caller */ result->user_pointer = NULL; result->user_callback = NULL; diff --git a/src/stub.c b/src/stub.c index 839d42d5..34ee625c 100644 --- a/src/stub.c +++ b/src/stub.c @@ -1207,6 +1207,19 @@ stub_tls_write(getdns_upstream *upstream, getdns_tcp_state *tcp, return STUB_TCP_ERROR; } +static uint64_t +_getdns_get_time_as_uintt64() { + + struct timeval tv; + uint64_t now; + + if (gettimeofday(&tv, NULL)) { + return 0; + } + now = tv.tv_sec * 1000000 + tv.tv_usec; + return now; +} + /**************************/ /* UDP callback functions */ /**************************/ @@ -1268,6 +1281,7 @@ stub_udp_read_cb(void *userarg) netreq->response_len = read; dnsreq->upstreams->current = 0; done: + netreq->debug_end_time = _getdns_get_time_as_uintt64(); netreq->state = NET_REQ_FINISHED; _getdns_check_dns_req_complete(dnsreq); } @@ -1282,6 +1296,7 @@ stub_udp_write_cb(void *userarg) GETDNS_CLEAR_EVENT(dnsreq->loop, &netreq->event); + netreq->debug_start_time = _getdns_get_time_as_uintt64(); netreq->query_id = arc4random(); GLDNS_ID_SET(netreq->query, netreq->query_id); if (netreq->opt) { @@ -1347,7 +1362,7 @@ stub_tcp_read_cb(void *userarg) netreq->tcp.read_pos - netreq->tcp.read_buf; netreq->tcp.read_buf = NULL; dnsreq->upstreams->current = 0; - + netreq->debug_end_time = _getdns_get_time_as_uintt64(); stub_cleanup(netreq); close(netreq->fd); _getdns_check_dns_req_complete(dnsreq); @@ -1360,7 +1375,7 @@ stub_tcp_write_cb(void *userarg) getdns_network_req *netreq = (getdns_network_req *)userarg; getdns_dns_req *dnsreq = netreq->owner; int q; - + netreq->debug_start_time = _getdns_get_time_as_uintt64(); switch ((q = stub_tcp_write(netreq->fd, &netreq->tcp, netreq))) { case STUB_TCP_AGAIN: return; @@ -1453,7 +1468,7 @@ upstream_read_cb(void *userarg) getdns_eventloop_event_init(&upstream->event, upstream, NULL, upstream_write_cb, NULL)); } - + netreq->debug_end_time = _getdns_get_time_as_uintt64(); /* This also reschedules events for the upstream*/ stub_cleanup(netreq); @@ -1480,7 +1495,10 @@ upstream_write_cb(void *userarg) getdns_network_req *netreq = upstream->write_queue; getdns_dns_req *dnsreq = netreq->owner; int q; - + + /* TODO: think about TCP AGAIN */ + netreq->debug_start_time = _getdns_get_time_as_uintt64(); + DEBUG_STUB("--- WRITE: %s: %p TYPE: %d\n", __FUNCTION__, netreq, netreq->request_type); if (tls_requested(netreq) && tls_should_write(upstream)) @@ -1510,6 +1528,8 @@ upstream_write_cb(void *userarg) return; default: + /* Need this because auth status is reset on connection clode */ + netreq->debug_tls_auth_status = netreq->upstream->tls_auth_failed; upstream->writes_done++; netreq->query_id = (uint16_t) q; /* Unqueue the netreq from the write_queue */ diff --git a/src/types-internal.h b/src/types-internal.h index 96b458f0..c1ca1e3e 100644 --- a/src/types-internal.h +++ b/src/types-internal.h @@ -226,6 +226,11 @@ typedef struct getdns_network_req /* Network requests scheduled to write after me */ struct getdns_network_req *write_queue_tail; + /* Some fields to record info for return_call_debugging */ + uint64_t debug_start_time; + uint64_t debug_end_time; + size_t debug_tls_auth_status; + /* When more space is needed for the wire_data response than is * available in wire_data[], it will be allocated seperately. * response will then not point to wire_data anymore. @@ -250,6 +255,8 @@ typedef struct getdns_network_req size_t wire_data_sz; uint8_t wire_data[]; + + } getdns_network_req; /** @@ -274,9 +281,14 @@ typedef struct getdns_dns_req { int dnssec_return_status; int dnssec_return_only_secure; int dnssec_return_validation_chain; +#ifdef DNSSEC_ROADBLOCK_AVOIDANCE + int dnssec_roadblock_avoidance; + int avoid_dnssec_roadblocks; +#endif int edns_cookies; int edns_client_subnet_private; uint16_t tls_query_padding_blocksize; + int return_call_debugging; /* Internally used by return_validation_chain */ int dnssec_ok_checking_disabled; @@ -352,6 +364,8 @@ typedef struct getdns_dns_req { /* utility methods */ extern getdns_dict *dnssec_ok_checking_disabled; +extern getdns_dict *dnssec_ok_checking_disabled_roadblock_avoidance; +extern getdns_dict *dnssec_ok_checking_disabled_avoid_roadblocks; /* dns request utils */ getdns_dns_req *_getdns_dns_req_new(getdns_context *context, getdns_eventloop *loop, diff --git a/src/util-internal.c b/src/util-internal.c index d6e9299e..02ae659f 100644 --- a/src/util-internal.c +++ b/src/util-internal.c @@ -38,6 +38,7 @@ #include #include #include +#include "config.h" #include "getdns/getdns.h" #include "dict.h" #include "list.h" @@ -63,6 +64,9 @@ static getdns_extension_format extformats[] = { {"dnssec_return_only_secure", t_int}, {"dnssec_return_status", t_int}, {"dnssec_return_validation_chain", t_int}, +#ifdef DNSSEC_ROADBLOCK_AVOIDANCE + {"dnssec_roadblock_avoidance", t_int}, +#endif #ifdef EDNS_COOKIES {"edns_cookies", t_int}, #endif @@ -671,6 +675,69 @@ success: return result; } +getdns_dict * +_getdns_create_call_debugging_dict( + getdns_context *context, getdns_network_req *netreq) +{ + getdns_bindata qname; + getdns_dict *netreq_debug; + getdns_dict *address_debug = NULL; + + assert(netreq); + + /* It is the responsibility of the caller to free this */ + if (!(netreq_debug = getdns_dict_create_with_context(context))) + return NULL; + + qname.data = netreq->owner->name; + qname.size = netreq->owner->name_len; + + if (getdns_dict_set_bindata(netreq_debug, "query_name", &qname) || + getdns_dict_set_int( netreq_debug, "query_type" + , netreq->request_type ) || + + /* Safe, because uint32_t facilitates RRT's of almost 50 days*/ + getdns_dict_set_int(netreq_debug, "run_time/ms", + (uint32_t)(( netreq->debug_end_time + - netreq->debug_start_time)/1000))) { + + getdns_dict_destroy(netreq_debug); + return NULL; + + } else if (!netreq->upstream) + + /* Nothing more for full recursion */ + return netreq_debug; + + + /* Stub resolver debug data */ + _getdns_sockaddr_to_dict( + context, &netreq->upstream->addr, &address_debug); + + if (getdns_dict_set_dict(netreq_debug, "query_to", address_debug) || + getdns_dict_set_int( netreq_debug, "transport" + , netreq->upstream->transport)) { + + getdns_dict_destroy(address_debug); + getdns_dict_destroy(netreq_debug); + return NULL; + } + getdns_dict_destroy(address_debug); + + if (netreq->upstream->transport != GETDNS_TRANSPORT_TLS) + return netreq_debug; + + /* Only include the auth status if TLS was used */ + if (getdns_dict_util_set_string(netreq_debug, "tls_auth_status", + netreq->debug_tls_auth_status == 0 ? + "OK: Hostname matched valid cert":"FAILED: Server not validated")){ + + getdns_dict_destroy(netreq_debug); + return NULL; + } + return netreq_debug; +} + getdns_dict * _getdns_create_getdns_response(getdns_dns_req *completed_request) { @@ -678,12 +745,14 @@ _getdns_create_getdns_response(getdns_dns_req *completed_request) getdns_list *just_addrs = NULL; getdns_list *replies_full; getdns_list *replies_tree; + getdns_list *call_debugging = NULL; getdns_network_req *netreq, **netreq_p; int rrsigs_in_answer = 0; getdns_dict *reply; getdns_bindata *canonical_name = NULL; int nreplies = 0, nanswers = 0, nsecure = 0, ninsecure = 0, nbogus = 0; getdns_bindata full_data; + getdns_dict *netreq_debug; /* info (bools) about dns_req */ int dnssec_return_status; @@ -696,7 +765,11 @@ _getdns_create_getdns_response(getdns_dns_req *completed_request) return NULL; dnssec_return_status = completed_request->dnssec_return_status || - completed_request->dnssec_return_only_secure; + completed_request->dnssec_return_only_secure +#ifdef DNSSEC_ROADBLOCK_AVOIDANCE + || completed_request->dnssec_roadblock_avoidance +#endif + ; if (completed_request->netreqs[0]->request_type == GETDNS_RRTYPE_A || completed_request->netreqs[0]->request_type == GETDNS_RRTYPE_AAAA) @@ -713,6 +786,10 @@ _getdns_create_getdns_response(getdns_dns_req *completed_request) if (!(replies_tree = getdns_list_create_with_context(context))) goto error_free_replies_full; + if (completed_request->return_call_debugging && + !(call_debugging = getdns_list_create_with_context(context))) + goto error_free_replies_full; + for ( netreq_p = completed_request->netreqs ; (netreq = *netreq_p) ; netreq_p++) { @@ -769,6 +846,21 @@ _getdns_create_getdns_response(getdns_dns_req *completed_request) getdns_dict_destroy(reply); goto error; } + + if (call_debugging) { + if (!(netreq_debug = + _getdns_create_call_debugging_dict(context,netreq))) + goto error; + + if (_getdns_list_append_dict( + call_debugging, netreq_debug)) { + + getdns_dict_destroy(netreq_debug); + goto error; + } + getdns_dict_destroy(netreq_debug); + } + getdns_dict_destroy(reply); /* buffer */ @@ -781,6 +873,10 @@ _getdns_create_getdns_response(getdns_dns_req *completed_request) goto error; getdns_list_destroy(replies_tree); + if (call_debugging && + getdns_dict_set_list(result, "call_debugging", call_debugging)) + goto error_free_call_debugging; + if (getdns_dict_set_list(result, "replies_full", replies_full)) goto error_free_replies_full; getdns_list_destroy(replies_full); @@ -804,6 +900,8 @@ _getdns_create_getdns_response(getdns_dns_req *completed_request) error: /* cleanup */ getdns_list_destroy(replies_tree); +error_free_call_debugging: + getdns_list_destroy(call_debugging); error_free_replies_full: getdns_list_destroy(replies_full); error_free_result: