clones/unbound
1
0
Fork 0
mirror of https://github.com/NLnetLabs/unbound.git synced 2024-09-21 06:37:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

- For #722: Minor fixes, formatting and refactoring.

Browse Source
This commit is contained in:
George Thessalonikefs 2023-05-01 18:23:13 +02:00
parent e1ec3cf893
commit adb4aeb609
12 changed files with 114 additions and 60 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
dns64/dns64.c
View File

@ -59,7 +59,7 @@
******************************************************************************/
/**
* This is the default DNS64 prefix that is used whent he dns64 module is listed
* This is the default DNS64 prefix that is used when the dns64 module is listed
* in module-config but when the dns64-prefix variable is not present.
*/
static const char DEFAULT_DNS64_PREFIX[] = "64:ff9b::/96";

2
doc/example.conf.in
View File

@ -248,6 +248,8 @@ server:
# the network, unbound can use NAT64 to reach these servers with
# the following option. This is NOT needed for enabling DNS64 on a
# system that has IPv4 connectivity.
# Consider also enabling prefer-ip6 to prefer native IPv6 connections
# to nameservers.
# do-nat64: no
# NAT64 prefix. Defaults to using dns64-prefix value.

7
doc/unbound.conf.5.in
View File

@ -2318,12 +2318,15 @@ NAT64 operation allows using a NAT64 prefix for outbound requests to IPv4-only
servers. It is controlled by two options in the \fBserver:\fR section:
.TP
.B do\-nat64: \fI<yes or no>\fR
Use NAT64 to reach IPv4-only servers. Default no.
Use NAT64 to reach IPv4-only servers.
Consider also enabling \fBprefer\-ip6\fR to prefer native IPv6 connections to
nameservers.
Default no.
.TP
.B nat64\-prefix: \fI<IPv6 prefix>\fR
Use a specific NAT64 prefix to reach IPv4-only servers. Defaults to using
the prefix configured in \fBdns64\-prefix\fR, which in turn defaults to
64:ff9b::/96. Must be /96 or shorter.
64:ff9b::/96. The prefix length must be one of /32, /40, /48, /56, /64 or /96.
.SS "DNSCrypt Options"
.LP
The

27
iterator/iter_utils.c
View File

@ -180,25 +180,23 @@ iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg)
}
nat64_prefix = cfg->nat64_prefix;
if (!nat64_prefix)
if(!nat64_prefix)
nat64_prefix = cfg->dns64_prefix;
if (!nat64_prefix)
if(!nat64_prefix)
nat64_prefix = DEFAULT_NAT64_PREFIX;
if (!netblockstrtoaddr(nat64_prefix, 0, &iter_env->nat64_prefix_addr,
&iter_env->nat64_prefix_addrlen,
&iter_env->nat64_prefix_net)) {
if(!netblockstrtoaddr(nat64_prefix, 0, &iter_env->nat64_prefix_addr,
&iter_env->nat64_prefix_addrlen,
&iter_env->nat64_prefix_net)) {
log_err("cannot parse nat64-prefix netblock: %s", nat64_prefix);
return 0;
}
if (!addr_is_ip6(&iter_env->nat64_prefix_addr,
iter_env->nat64_prefix_addrlen)) {
log_err("nat64_prefix is not IPv6: %s", cfg->nat64_prefix);
if(!addr_is_ip6(&iter_env->nat64_prefix_addr,
iter_env->nat64_prefix_addrlen)) {
log_err("nat64-prefix is not IPv6: %s", cfg->nat64_prefix);
return 0;
}
if (iter_env->nat64_prefix_net != 32 && iter_env->nat64_prefix_net != 40 &&
iter_env->nat64_prefix_net != 48 && iter_env->nat64_prefix_net != 56 &&
iter_env->nat64_prefix_net != 64 && iter_env->nat64_prefix_net != 96 ) {
log_err("dns64-prefix length it not 32, 40, 48, 56, 64 or 96: %s",
if(!prefixnet_is_nat64(iter_env->nat64_prefix_net)) {
log_err("nat64-prefix length it not 32, 40, 48, 56, 64 or 96: %s",
nat64_prefix);
return 0;
}
@ -780,12 +778,13 @@ iter_mark_pside_cycle_targets(struct module_qstate* qstate, struct delegpt* dp)
int
iter_dp_is_useless(struct query_info* qinfo, uint16_t qflags,
struct delegpt* dp, int supports_ipv4, int supports_ipv6, int use_nat64)
struct delegpt* dp, int supports_ipv4, int supports_ipv6,
int use_nat64)
{
struct delegpt_ns* ns;
struct delegpt_addr* a;
if (supports_ipv6 && use_nat64)
if(supports_ipv6 && use_nat64)
supports_ipv4 = 1;
/* check:

4
iterator/iter_utils.h
View File

@ -189,9 +189,11 @@ void iter_mark_pside_cycle_targets(struct module_qstate* qstate,
* if not, then the IPv4 addresses are useless.
* @param supports_ipv6: if we support ipv6 for lookups to the target.
* if not, then the IPv6 addresses are useless.
* @param use_nat64: if we support NAT64 for lookups to the target.
* if yes, IPv4 addresses are useful even if we don't support IPv4.
* @return true if dp is useless.
*/
int iter_dp_is_useless(struct query_info* qinfo, uint16_t qflags,
int iter_dp_is_useless(struct query_info* qinfo, uint16_t qflags,
struct delegpt* dp, int supports_ipv4, int supports_ipv6,
int use_nat64);

53
iterator/iterator.c
View File

@ -1557,17 +1557,17 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
/* see if this dp not useless.
* It is useless if:
* o all NS items are required glue.
* o all NS items are required glue.
* or the query is for NS item that is required glue.
* o no addresses are provided.
* o RD qflag is on.
* Instead, go up one level, and try to get even further
* If the root was useless, use safety belt information.
* If the root was useless, use safety belt information.
* Only check cache returns, because replies for servers
* could be useless but lead to loops (bumping into the
* same server reply) if useless-checked.
*/
if(iter_dp_is_useless(&qstate->qinfo, qstate->query_flags,
if(iter_dp_is_useless(&qstate->qinfo, qstate->query_flags,
iq->dp, ie->supports_ipv4, ie->supports_ipv6,
ie->use_nat64)) {
struct delegpt* retdp = NULL;
@ -1930,7 +1930,7 @@ query_for_targets(struct module_qstate* qstate, struct iter_qstate* iq,
break;
}
/* Send the A request. */
if(ie->supports_ipv4 &&
if((ie->supports_ipv4 || ie->use_nat64) &&
((ns->lame && !ns->done_pside4) ||
(!ns->lame && !ns->got4))) {
if(!generate_target_query(qstate, iq, id,
@ -2257,6 +2257,8 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
int tf_policy;
struct delegpt_addr* target;
struct outbound_entry* outq;
struct sockaddr_storage real_addr;
socklen_t real_addrlen;
int auth_fallback = 0;
uint8_t* qout_orig = NULL;
size_t qout_orig_len = 0;
@ -2803,45 +2805,22 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
/* We have a valid target. */
if(verbosity >= VERB_QUERY) {
log_query_info(VERB_QUERY, "sending query:", &iq->qinfo_out);
log_name_addr(VERB_QUERY, "sending to target:", iq->dp->name,
log_name_addr(VERB_QUERY, "sending to target:", iq->dp->name,
&target->addr, target->addrlen);
verbose(VERB_ALGO, "dnssec status: %s%s",
iq->dnssec_expected?"expected": "not expected",
iq->dnssec_lame_query?" but lame_query anyway": "");
}
struct sockaddr_storage real_addr = target->addr;
socklen_t real_addrlen = target->addrlen;
real_addr = target->addr;
real_addrlen = target->addrlen;
if (ie->use_nat64 && real_addr.ss_family == AF_INET) {
struct sockaddr_in *sin = (struct sockaddr_in *)&target->addr;
struct sockaddr_in6 *sin6;
int plen = ie->nat64_prefix_net;
uint8_t *v4_byte;
real_addr = ie->nat64_prefix_addr;
real_addrlen = ie->nat64_prefix_addrlen;
sin6 = (struct sockaddr_in6 *)&real_addr;
sin6->sin6_flowinfo = 0;
sin6->sin6_port = sin->sin_port;
/* config validation enforces these prefix lengths too */
log_assert(plen == 32 || plen == 40 || plen == 48 || plen == 56
|| plen == 64 || plen == 96);
plen = plen / 8;
v4_byte = (uint8_t *)&sin->sin_addr.s_addr;
for (int i = 0; i < 4; i++) {
if (plen == 8)
/* bits 64...72 are MBZ */
sin6->sin6_addr.s6_addr[plen++] = 0;
sin6->sin6_addr.s6_addr[plen++] = *v4_byte++;
}
log_name_addr(VERB_QUERY, "applied NAT64:", iq->dp->name,
&real_addr, real_addrlen);
if(ie->use_nat64 && target->addr.ss_family == AF_INET) {
addr_to_nat64(&target->addr, &ie->nat64_prefix_addr,
ie->nat64_prefix_addrlen, ie->nat64_prefix_net,
&real_addr, &real_addrlen);
log_name_addr(VERB_QUERY, "applied NAT64:",
iq->dp->name, &real_addr, real_addrlen);
}
fptr_ok(fptr_whitelist_modenv_send_query(qstate->env->send_query));
@ -2871,7 +2850,7 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
}
log_addr(VERB_QUERY, "error sending query to auth server",
&target->addr, target->addrlen);
&real_addr, real_addrlen);
if(qstate->env->cfg->qname_minimisation)
iq->minimisation_state = SKIP_MINIMISE_STATE;
return next_state(iq, QUERYTARGETS_STATE);

2
iterator/iterator.h
View File

@ -103,7 +103,7 @@ extern int BLACKLIST_PENALTY;
#define RTT_BAND 400
/**
* Global state for the iterator.
* Global state for the iterator.
*/
struct iter_env {
/** A flag to indicate whether or not we have an IPv6 route */

2
smallapp/unbound-checkconf.c
View File

@ -714,7 +714,7 @@ morechecks(struct config_file* cfg)
cfg->chrootdir, cfg);
}
#endif
/* remove chroot setting so that modules are not stripping pathnames*/
/* remove chroot setting so that modules are not stripping pathnames */
free(cfg->chrootdir);
cfg->chrootdir = NULL;

1
testdata/iter_nat64_prefix.rpl vendored
View File

@ -3,6 +3,7 @@ server:
do-nat64: yes
nat64-prefix: 2001:db8:1234::/96
target-fetch-policy: "0 0 0 0 0"
do-ip4: no
stub-zone:
name: "."

1
util/config_file.c
View File

@ -1648,6 +1648,7 @@ config_delete(struct config_file* cfg)
free(cfg->server_cert_file);
free(cfg->control_key_file);
free(cfg->control_cert_file);
free(cfg->nat64_prefix);
free(cfg->dns64_prefix);
config_delstrlist(cfg->dns64_ignore_aaaa);
free(cfg->dnstap_socket_path);

49
util/net_help.c
View File

@ -779,8 +779,8 @@ addr_in_common(struct sockaddr_storage* addr1, int net1,
return match;
}
void
addr_to_str(struct sockaddr_storage* addr, socklen_t addrlen,
void
addr_to_str(struct sockaddr_storage* addr, socklen_t addrlen,
char* buf, size_t len)
{
int af = (int)((struct sockaddr_in*)addr)->sin_family;
@ -792,7 +792,50 @@ addr_to_str(struct sockaddr_storage* addr, socklen_t addrlen,
}
}
int
int
prefixnet_is_nat64(int prefixnet)
{
return (prefixnet == 32 || prefixnet == 40 ||
prefixnet == 48 || prefixnet == 56 ||
prefixnet == 64 || prefixnet == 96);
}
void
addr_to_nat64(const struct sockaddr_storage* addr,
const struct sockaddr_storage* nat64_prefix,
socklen_t nat64_prefixlen, int nat64_prefixnet,
struct sockaddr_storage* nat64_addr, socklen_t* nat64_addrlen)
{
struct sockaddr_in *sin = (struct sockaddr_in *)addr;
struct sockaddr_in6 *sin6;
uint8_t *v4_byte;
/* This needs to be checked by the caller */
log_assert(addr->ss_family == AF_INET);
/* Current usage is only from config values; prefix lengths enforced
* during config validation */
log_assert(prefixnet_is_nat64(nat64_prefixnet));
*nat64_addr = *nat64_prefix;
*nat64_addrlen = nat64_prefixlen;
sin6 = (struct sockaddr_in6 *)nat64_addr;
sin6->sin6_flowinfo = 0;
sin6->sin6_port = sin->sin_port;
nat64_prefixnet = nat64_prefixnet / 8;
v4_byte = (uint8_t *)&sin->sin_addr.s_addr;
for(int i = 0; i < 4; i++) {
if(nat64_prefixnet == 8) {
/* bits 64...71 are MBZ */
sin6->sin6_addr.s6_addr[nat64_prefixnet++] = 0;
}
sin6->sin6_addr.s6_addr[nat64_prefixnet++] = *v4_byte++;
}
}
int
addr_is_ip4mapped(struct sockaddr_storage* addr, socklen_t addrlen)
{
/* prefix for ipv4 into ipv6 mapping is ::ffff:x.x.x.x */

24
util/net_help.h
View File

@ -331,6 +331,30 @@ int addr_in_common(struct sockaddr_storage* addr1, int net1,
void addr_to_str(struct sockaddr_storage* addr, socklen_t addrlen,
char* buf, size_t len);
/**
* Check if the prefix network length is one of the allowed 32, 40, 48, 56, 64,
* or 96.
* @param prefixnet: prefix network length to check.
* @return 1 on success, 0 on failure.
*/
int prefixnet_is_nat64(int prefixnet);
/**
* Create a NAT64 address from a given address (needs to be IPv4) and a given
* NAT64 prefix. The NAT64 prefix net needs to be one of 32, 40, 48, 56, 64, 96.
* @param addr: IPv4 address.
* @param nat64_prefix: NAT64 prefix.
* @param nat64_prefixlen: NAT64 prefix len.
* @param nat64_prefixnet: NAT64 prefix mask.
* @param nat64_addr: the resulting NAT64 address.
* @param nat64_addrlen: the resulting NAT64 address length.
* @return: 1 on success, 0 on input error.
*/
void addr_to_nat64(const struct sockaddr_storage* addr,
const struct sockaddr_storage* nat64_prefix,
socklen_t nat64_prefixlen, int nat64_prefixnet,
struct sockaddr_storage* nat64_addr, socklen_t* nat64_addrlen);
/**
* See if sockaddr is an ipv6 mapped ipv4 address, "::ffff:0.0.0.0"
* @param addr: address