/src/gdal/curl/lib/vdns/cf-dns.c

Source
/***************************************************************************
 *                                  _   _ ____  _
 *  Project                     ___| | | |  _ \| |
 *                             / __| | | | |_) | |
 *                            | (__| |_| |  _ <| |___
 *                             \___|\___/|_| \_\_____|
 *
 * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
 *
 * This software is licensed as described in the file COPYING, which
 * you should have received as part of this distribution. The terms
 * are also available at https://curl.se/docs/copyright.html.
 *
 * You may opt to use, copy, modify, merge, publish, distribute and/or sell
 * copies of the Software, and permit persons to whom the Software is
 * furnished to do so, under the terms of the COPYING file.
 *
 * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
 * KIND, either express or implied.
 *
 * SPDX-License-Identifier: curl
 *
 ***************************************************************************/
#include "curl_setup.h"

#include "urldata.h"
#include "curl_addrinfo.h"
#include "cfilters.h"
#include "connect.h"
#include "curl_trc.h"
#include "multiif.h"
#include "progress.h"
#include "url.h"
#include "vdns/cf-dns.h"
#include "vdns/dnscache.h"
#include "vdns/httpsrr.h"
#include "curlx/strparse.h"

#define CURL_HE_AAAA_AWAIT_MS    50

struct cf_dns_ctx {
  struct Curl_dns_entry *dns;
  struct Curl_peer *peer;
  CURLcode resolv_result;
  timediff_t he_aaaa_await_ms;
  uint32_t resolv_id;
  uint8_t dns_queries;
  uint8_t transport;
  BIT(started);
  BIT(announced);
  BIT(for_proxy);
};

static struct cf_dns_ctx *cf_dns_ctx_create(struct Curl_easy *data,
                                            struct Curl_peer *peer,
                                            uint8_t dns_queries,
                                            uint8_t transport,
                                            bool for_proxy)
{
  struct cf_dns_ctx *ctx;

  ctx = curlx_calloc(1, sizeof(*ctx));
  if(!ctx)
    return NULL;

  Curl_peer_link(&ctx->peer, peer);
  ctx->dns_queries = dns_queries;
  ctx->transport = transport;
  ctx->for_proxy = for_proxy;
  ctx->he_aaaa_await_ms = CURL_HE_AAAA_AWAIT_MS;
#ifdef DEBUGBUILD
  {
    const char *p = getenv("CURL_DBG_HE_AAAA_AWAIT_MS");
    if(p) {
      curl_off_t l;
      if(!curlx_str_number(&p, &l, UINT32_MAX)) {
        ctx->he_aaaa_await_ms = (uint32_t)l;
      }
    }
  }
#endif

  CURL_TRC_DNS(data, "[%s] created DNS filter for %s:%u, transport=%x",
               Curl_resolv_query_str(ctx->dns_queries),
               peer->hostname, peer->port, ctx->transport);
  return ctx;
}

static void cf_dns_ctx_destroy(struct Curl_easy *data,
                               struct cf_dns_ctx *ctx)
{
  if(ctx) {
    Curl_peer_unlink(&ctx->peer);
    Curl_dns_entry_unlink(data, &ctx->dns);
    curlx_free(ctx);
  }
}

#ifdef CURLVERBOSE
static void cf_dns_report_addr(struct Curl_easy *data,
                               struct dynbuf *tmp,
                               const char *label,
                               int ai_family,
                               const struct Curl_addrinfo *ai)
{
  char buf[MAX_IPADR_LEN];
  const char *sep = "";
  CURLcode result;

  curlx_dyn_reset(tmp);
  for(; ai; ai = ai->ai_next) {
    if(ai->ai_family == ai_family) {
      Curl_printable_address(ai, buf, sizeof(buf));
      result = curlx_dyn_addf(tmp, "%s%s", sep, buf);
      if(result) {
        infof(data, "too many IP, cannot show");
        return;
      }
      sep = ", ";
    }
  }

  infof(data, "%s%s", label,
        (curlx_dyn_len(tmp) ? curlx_dyn_ptr(tmp) : "(none)"));
}

static void cf_dns_report(struct Curl_cfilter *cf,
                          struct Curl_easy *data,
                          struct Curl_dns_entry *dns)
{
  struct cf_dns_ctx *ctx = cf->ctx;
  struct dynbuf tmp;

  if(!Curl_trc_is_verbose(data) ||
     /* ignore no name or numerical IP addresses */
     !dns->hostname[0] || Curl_host_is_ipnum(dns->hostname))
    return;

  if(ctx->peer->unix_socket) {
#ifdef USE_UNIX_SOCKETS
    CURL_TRC_CF(data, cf, "resolved unix://%s", ctx->peer->hostname);
#else
    DEBUGASSERT(0);
#endif
  }
  else {
    curlx_dyn_init(&tmp, 1024);
    if(CURL_DNSQ_IS_ADDR(ctx->dns_queries)) {
      infof(data, "Host %s:%u was resolved.", dns->hostname, dns->port);
#ifdef CURLRES_IPV6
      cf_dns_report_addr(data, &tmp, "IPv6: ", AF_INET6, dns->addr);
#endif
      cf_dns_report_addr(data, &tmp, "IPv4: ", AF_INET, dns->addr);
    }
#ifdef USE_HTTPSRR
    else if(ctx->dns_queries & CURL_DNSQ_HTTPS) {
      if(!dns->hinfo)
        infof(data, "HTTPS-RR %s:%u: -", dns->hostname, dns->port);
      else if(!Curl_httpsrr_applicable(data, dns->hinfo))
        infof(data, "HTTPS-RR %s:%u: not applicable",
              dns->hostname, dns->port);
      else {
        CURLcode result = Curl_httpsrr_print(&tmp, dns->hinfo);
        if(!result)
          infof(data, "HTTPS-RR %s:%u: %s",
                dns->hostname, dns->port, curlx_dyn_ptr(&tmp));
        else
          infof(data, "Error printing HTTPS-RR information");
      }
    }
#endif
    curlx_dyn_free(&tmp);
  }
}
#else
#define cf_dns_report(x, y, z) Curl_nop_stmt
#endif

/*************************************************************
 * Resolve the address of the server or proxy
 *************************************************************/
static CURLcode cf_dns_start(struct Curl_cfilter *cf,
                             struct Curl_easy *data,
                             struct Curl_dns_entry **pdns)
{
  struct cf_dns_ctx *ctx = cf->ctx;
  timediff_t timeout_ms = Curl_timeleft_ms(data);
  CURLcode result = CURLE_OK;

  *pdns = NULL;

  CURL_TRC_CF(data, cf, "[%s] cf_dns_start %s %s:%u",
              Curl_resolv_query_str(ctx->dns_queries),
              ctx->peer->unix_socket ? "unix-domain-socket" : "host",
              ctx->peer->hostname, ctx->peer->port);
  if(ctx->peer->unix_socket)
    ctx->dns_queries = CURL_DNSQ_A; /* treat it like an A resolve */

  if(CURL_DNSQ_IS_ADDR(ctx->dns_queries)) {
    if(Curl_is_ipv4addr(ctx->peer->hostname))
      ctx->dns_queries |= CURL_DNSQ_A;
#ifdef USE_IPV6
    else if(ctx->peer->ipv6)
      ctx->dns_queries |= CURL_DNSQ_AAAA;
#endif

    result = Curl_resolv(data, ctx->peer, ctx->dns_queries, ctx->transport,
                         (bool)ctx->for_proxy, timeout_ms,
                         &ctx->resolv_id, pdns);
  }
#ifdef USE_HTTPSRR
  else if(ctx->dns_queries == CURL_DNSQ_HTTPS) {
    result = Curl_resolv_https(data, ctx->peer, (bool)ctx->for_proxy,
                               timeout_ms, &ctx->resolv_id, pdns);
  }
#endif
  else {
    failf(data, "unsupported DNS queries %x", ctx->dns_queries);
    return CURLE_FAILED_INIT;
  }

  DEBUGASSERT(!result || !*pdns);
  if(!result) { /* resolved right away, either sync or from dnscache */
    DEBUGASSERT(*pdns);
    return CURLE_OK;
  }
  else if(result == CURLE_AGAIN) { /* async resolv in progress */
    return CURLE_OK;
  }
  else if(result == CURLE_OPERATION_TIMEDOUT) { /* took too long */
    failf(data, "Failed to resolve '%s' with timeout after %"
          FMT_TIMEDIFF_T " ms", ctx->peer->hostname,
          curlx_ptimediff_ms(Curl_pgrs_now(data),
                             &data->progress.t_startsingle));
    return CURLE_OPERATION_TIMEDOUT;
  }
  else {
    DEBUGASSERT(result);
    if(ctx->dns_queries & (CURL_DNSQ_A|CURL_DNSQ_AAAA))
      failf(data, "Could not resolve: %s", ctx->peer->hostname);
    return result;
  }
}

static bool cf_dns_ready_to_connect(struct Curl_cfilter *cf,
                                    struct Curl_easy *data)
{
  struct cf_dns_ctx *ctx = cf->ctx;

  if(ctx->resolv_result)
    return TRUE;
  else if(ctx->dns)
    return TRUE;
#ifdef USE_CURL_ASYNC
  else if(CURL_DNSQ_IS_ADDR(ctx->dns_queries)) {
    timediff_t remain_ms;
    /* For Happy Eyeballing, we can start on either A or AAAA resolves,
     * but AAAA is preferred. We enforce a small delay for missing
     * AAAA to arrive, then we let the connect continue.
     * Note: if AAAA was never started (-4), it is considered to have
     * an answer (e.g. a negative one). */
    if(Curl_resolv_has_answers(data, ctx->resolv_id, CURL_DNSQ_AAAA))
      return TRUE;
    remain_ms = ctx->he_aaaa_await_ms -
                Curl_resolv_elapsed_ms(data, ctx->resolv_id);
    if(remain_ms <= 0)
      return TRUE;
    CURL_TRC_CF(data, cf, "[%s] still waiting %" FMT_TIMEDIFF_T
                "ms for AAAA result",
                Curl_resolv_query_str(ctx->dns_queries), remain_ms);
    Curl_expire(data, remain_ms, EXPIRE_HAPPY_EYEBALLS);
    return FALSE;
  }
  else {
    return TRUE;
  }
#else
  (void)data;
  DEBUGASSERT(0); /* We should not come here */
  return FALSE;
#endif /* USE_CURL_ASYNC */
}

static CURLcode cf_dns_connect(struct Curl_cfilter *cf,
                               struct Curl_easy *data,
                               bool *done)
{
  struct cf_dns_ctx *ctx = cf->ctx;
  bool ip_query = (ctx->dns_queries & (CURL_DNSQ_A|CURL_DNSQ_AAAA));

  if(cf->connected) {
    *done = TRUE;
    return CURLE_OK;
  }

  *done = FALSE;
  if(!ctx->started) {
    ctx->started = TRUE;
    ctx->resolv_result = cf_dns_start(cf, data, &ctx->dns);
  }

  if(!ctx->dns && !ctx->resolv_result) {
    ctx->resolv_result =
      Curl_resolv_take_result(data, ctx->resolv_id, &ctx->dns);
  }

  if(ctx->resolv_result && ip_query) {
    /* failing A|AAAA resolves is a hard failure. */
    CURL_TRC_CF(data, cf, "[%s] error resolving: %d",
                Curl_resolv_query_str(ctx->dns_queries),
                (int)ctx->resolv_result);
    return ctx->resolv_result;
  }

  if(ctx->dns && !ctx->announced) {
    ctx->announced = TRUE;
    if((cf->sockindex == FIRSTSOCKET) && ip_query) {
      cf->conn->bits.dns_resolved = TRUE;
      Curl_pgrsTime(data, TIMER_NAMELOOKUP);
    }
    cf_dns_report(cf, data, ctx->dns);
  }

  if(!cf_dns_ready_to_connect(cf, data)) {
    return CURLE_OK;
  }

  if(cf->next && !cf->next->connected) {
    bool sub_done;
    CURLcode result = Curl_conn_cf_connect(cf->next, data, &sub_done);
    if(result || !sub_done)
      return result;
    DEBUGASSERT(sub_done);
  }

  /* sub filter chain is connected, this means the filter has done
   * its work and is connected as well, if it has results or not. */
  CURL_TRC_CF(data, cf, "connected filter chain below");
  *done = TRUE;
  cf->connected = TRUE;
  Curl_resolv_destroy(data, ctx->resolv_id);
  return CURLE_OK;
}

static void cf_dns_destroy(struct Curl_cfilter *cf, struct Curl_easy *data)
{
  struct cf_dns_ctx *ctx = cf->ctx;

  CURL_TRC_CF(data, cf, "destroy");
  cf_dns_ctx_destroy(data, ctx);
}

static CURLcode cf_dns_adjust_pollset(struct Curl_cfilter *cf,
                                      struct Curl_easy *data,
                                      struct easy_pollset *ps)
{
#ifdef USE_CURL_ASYNC
  if(!cf->connected) {
    /* The pollset only works when we have started the resolving.
     * Otherwise we might wait on the WAKEUP socketpair forever.
     * Since DNS filters can be added in the middle of a connect
     * attempt, they are not always started that way. */
    struct cf_dns_ctx *ctx = cf->ctx;
    if(!ctx->started) {
      CURL_TRC_CF(data, cf, "adjust_pollset, starting %s:%u queries=%s",
                  ctx->peer->hostname, ctx->peer->port,
                  Curl_resolv_query_str(ctx->dns_queries));
      ctx->started = TRUE;
      ctx->resolv_result = cf_dns_start(cf, data, &ctx->dns);
      if(ctx->resolv_result || ctx->dns) {
        Curl_multi_mark_dirty(data);
      }
    }
    return Curl_resolv_pollset(data, ps);
  }
#else
  (void)cf;
  (void)data;
  (void)ps;
#endif
  return CURLE_OK;
}

static CURLcode cf_dns_cntrl(struct Curl_cfilter *cf,
                             struct Curl_easy *data,
                             int event, int arg1, void *arg2)
{
  struct cf_dns_ctx *ctx = cf->ctx;
  CURLcode result = CURLE_OK;

  (void)arg1;
  (void)arg2;
  switch(event) {
  case CF_CTRL_DATA_DONE:
    if(ctx->dns) {
      /* Should only come here when the connect attempt failed and
       * `data` is giving up on it. On a successful connect, we already
       * unlinked the DNS entry. */
      Curl_dns_entry_unlink(data, &ctx->dns);
    }
    break;
  default:
    break;
  }
  return result;
}

struct Curl_cftype Curl_cft_dns = {
  "DNS",
  CF_TYPE_SETUP | CF_TYPE_DNS,
  CURL_LOG_LVL_NONE,
  cf_dns_destroy,
  cf_dns_connect,
  Curl_cf_def_shutdown,
  cf_dns_adjust_pollset,
  Curl_cf_def_data_pending,
  Curl_cf_def_send,
  Curl_cf_def_recv,
  cf_dns_cntrl,
  Curl_cf_def_conn_is_alive,
  Curl_cf_def_conn_keep_alive,
  Curl_cf_def_query,
};

static CURLcode cf_dns_create(struct Curl_cfilter **pcf,
                              struct Curl_easy *data,
                              struct Curl_peer *peer,
                              uint8_t dns_queries,
                              uint8_t transport,
                              bool for_proxy)
{
  struct Curl_cfilter *cf = NULL;
  struct cf_dns_ctx *ctx;
  CURLcode result = CURLE_OK;

  (void)data;
  ctx = cf_dns_ctx_create(data, peer, dns_queries, transport,
                          for_proxy);
  if(!ctx) {
    result = CURLE_OUT_OF_MEMORY;
    goto out;
  }

  result = Curl_cf_create(&cf, &Curl_cft_dns, ctx);

out:
  *pcf = result ? NULL : cf;
  if(result)
    cf_dns_ctx_destroy(data, ctx);
  return result;
}

/* Adds a "resolv" filter at the top of the connection's filter chain.
 * The filter will resolve the peer on the first connect attempt. */
static CURLcode cf_dns_add(struct Curl_easy *data,
                           struct connectdata *conn,
                           int sockindex,
                           struct Curl_peer *peer,
                           uint8_t dns_queries,
                           uint8_t transport)
{
  struct Curl_cfilter *cf = NULL;
  bool for_proxy = FALSE;
  CURLcode result;

  if(!peer)
    return CURLE_FAILED_INIT;
#ifndef CURL_DISABLE_PROXY
  for_proxy = (peer == conn->socks_proxy.peer) ||
              (peer == conn->http_proxy.peer);
#endif

  result = cf_dns_create(&cf, data, peer, dns_queries, transport, for_proxy);
  if(result)
    goto out;
  Curl_conn_cf_add(data, conn, sockindex, cf);
out:
  return result;
}

/* Insert a new "resolv" filter directly after `cf`. It will
 * start a DNS resolve for the given peer on the
 * first connect attempt.
 * See socks.c on how this is used to make a non-blocking DNS
 * resolve during connect.
 */
static CURLcode cf_dns_insert_after(struct Curl_cfilter *cf_at,
                                    struct Curl_easy *data,
                                    struct Curl_peer *peer,
                                    uint8_t dns_queries,
                                    uint8_t transport)
{
  struct Curl_cfilter *cf;
  CURLcode result;

  result = cf_dns_create(&cf, data, peer, dns_queries, transport, FALSE);
  if(result)
    return result;

  Curl_conn_cf_insert_after(cf_at, cf);
  return CURLE_OK;
}

static CURLcode cf_dns_add_resolve(struct Curl_easy *data,
                                   struct connectdata *conn,
                                   int sockindex,
                                   struct Curl_peer *peer,
                                   uint8_t dns_queries,
                                   uint8_t transport)
{
  struct Curl_cfilter *cf = data->conn->cfilter[sockindex];
  struct Curl_cfilter *cf_dns = NULL;
  bool is_addr = CURL_DNSQ_IS_ADDR(dns_queries);

  if((dns_queries & CURL_DNSQ_HTTPS) &&
     Curl_is_ipaddr(peer->hostname)) {
    dns_queries = (uint8_t)(dns_queries & ~CURL_DNSQ_HTTPS);
  }

  for(; cf && dns_queries; cf = cf->next) {
    if(cf->cft == &Curl_cft_dns) {
      struct cf_dns_ctx *ctx = cf->ctx;
      cf_dns = cf;
      if(Curl_peer_same_destination(ctx->peer, peer)) {
        /* subtract queries already being scheduled/ongoing */
        dns_queries = (uint8_t)(~ctx->dns_queries & dns_queries);
        if(!dns_queries) { /* already there */
          return CURLE_OK;
        }
        else if(is_addr && !ctx->started &&
                CURL_DNSQ_IS_ADDR(ctx->dns_queries)) {
          ctx->dns_queries |= dns_queries;
          CURL_TRC_DNS(data, "[%s] added queries=%s for %s:%u",
                       Curl_resolv_query_str(ctx->dns_queries),
                       Curl_resolv_query_str(dns_queries),
                       peer->hostname, peer->port);
          return CURLE_OK;
        }
      }
    }
  }

  if(dns_queries) {
    /* No existing filter is handling these, add a new DNS filter
     * (after the last one if there was one already. FCFS. */
    if(cf_dns)
      return cf_dns_insert_after(cf_dns, data, peer, dns_queries, transport);
    else
      return cf_dns_add(data, conn, sockindex, peer, dns_queries, transport);
  }
  return CURLE_OK;
}

CURLcode Curl_conn_dns_add_addr_resolve(struct Curl_easy *data,
                                        struct connectdata *conn,
                                        int sockindex,
                                        struct Curl_peer *peer,
                                        uint8_t dns_queries,
                                        uint8_t transport)
{
  /* should only have address query bits */
  DEBUGASSERT(!(dns_queries & ~CURL_DNSQ_ADDR));
  return cf_dns_add_resolve(data, conn, sockindex, peer,
                            (dns_queries & CURL_DNSQ_ADDR), transport);
}

/* Return the result of the DNS address resolution for peer.
 * Searches for a DNS filter from the top of the filter chain down. Returns
 * - CURLE_AGAIN when not done yet
 * - CURLE_OK when DNS was successfully resolved
 * - CURLR_FAILED_INIT when no resolv filter was found
 * - error returned by the DNS resolv
 */
CURLcode Curl_conn_dns_addr_result(struct connectdata *conn,
                                   int sockindex,
                                   struct Curl_peer *peer)
{
  struct Curl_cfilter *cf = conn->cfilter[sockindex];
  for(; cf; cf = cf->next) {
    if(cf->cft == &Curl_cft_dns) {
      struct cf_dns_ctx *ctx = cf->ctx;
      if(Curl_peer_same_destination(ctx->peer, peer) &&
         (ctx->dns_queries & (CURL_DNSQ_A|CURL_DNSQ_AAAA))) {
        if(ctx->dns || ctx->resolv_result)
          return ctx->resolv_result;
        return CURLE_AGAIN;
      }
    }
  }
  return CURLE_FAILED_INIT; /* no one is resolving */
}

/* Return the addrinfo at `index` for the given `family` from the
 * first "resolve" filter at the connection. If the DNS resolving is
 * not done yet or if no address for the family exists, returns NULL.
 */
const struct Curl_addrinfo *Curl_conn_dns_get_ai(struct Curl_easy *data,
                                                 struct Curl_peer *peer,
                                                 int sockindex,
                                                 int ai_family,
                                                 unsigned int index)
{
  struct connectdata *conn = data->conn;
  struct Curl_cfilter *cf = conn->cfilter[sockindex];

  for(; cf; cf = cf->next) {
    if(cf->cft == &Curl_cft_dns) {
      struct cf_dns_ctx *ctx = cf->ctx;
      if(Curl_peer_same_destination(ctx->peer, peer) &&
         (ctx->dns_queries & (CURL_DNSQ_A|CURL_DNSQ_AAAA))) {
        CURL_TRC_CF(data, cf, "get %uth result for %s:%u, family=%d, dns=%d",
                    index, peer->hostname, peer->port, ai_family, !!ctx->dns);
        if(ctx->resolv_result)
          return NULL;
        else if(ctx->dns) {
          /* A cached DNS entry may contain address families that we
           * here never queried for. We want to give no results for those. */
          if((ai_family == AF_INET) && !(ctx->dns_queries & CURL_DNSQ_A))
            return NULL;
#ifdef USE_IPV6
          if((ai_family == AF_INET6) && !(ctx->dns_queries & CURL_DNSQ_AAAA))
            return NULL;
#endif
          return Curl_addrinfo_get(ctx->dns->addr, ai_family, index);
        }
        else
          return Curl_resolv_get_ai(data, ctx->resolv_id, ai_family, index);
      }
    }
  }
  return NULL;
}

#ifdef USE_HTTPSRR
CURLcode Curl_conn_dns_add_https_resolve(struct Curl_easy *data,
                                         struct connectdata *conn,
                                         int sockindex,
                                         struct Curl_peer *peer)
{
  return cf_dns_add_resolve(data, conn, sockindex, peer,
                            CURL_DNSQ_HTTPS, conn->transport_wanted);
}

/* Return the HTTPS-RR info from the first "resolve" filter at the
 * connection. If the DNS resolving is not done yet or if there
 * is no HTTPS-RR info, returns NULL.
 */
const struct Curl_https_rrinfo *
Curl_conn_dns_get_https(struct Curl_easy *data,
                        int sockindex,
                        struct Curl_peer *peer)
{
  struct Curl_cfilter *cf = data->conn->cfilter[sockindex];
  for(; cf; cf = cf->next) {
    if(cf->cft == &Curl_cft_dns) {
      struct cf_dns_ctx *ctx = cf->ctx;
      if(Curl_peer_same_destination(ctx->peer, peer) &&
         (ctx->dns_queries & CURL_DNSQ_HTTPS)) {
        if(ctx->dns)
          return ctx->dns->hinfo;
        else
          return Curl_resolv_get_https(data, ctx->resolv_id);
      }
    }
  }
  return NULL;
}

bool Curl_conn_dns_resolved_https(struct Curl_easy *data,
                                  int sockindex,
                                  struct Curl_peer *peer)
{
  struct Curl_cfilter *cf = data->conn->cfilter[sockindex];
  for(; cf; cf = cf->next) {
    if(cf->cft == &Curl_cft_dns) {
      struct cf_dns_ctx *ctx = cf->ctx;
      if(Curl_peer_same_destination(ctx->peer, peer) &&
         (ctx->dns_queries & CURL_DNSQ_HTTPS)) {
        if(ctx->dns)
          return TRUE;
        else
          return Curl_resolv_knows_https(data, ctx->resolv_id);
      }
    }
  }
  return TRUE;
}

#endif /* USE_HTTPSRR */

Coverage Report

Created: 2026-08-11 08:26