doh.c 40 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385138613871388138913901391139213931394139513961397139813991400140114021403
  1. /***************************************************************************
  2. * _ _ ____ _
  3. * Project ___| | | | _ \| |
  4. * / __| | | | |_) | |
  5. * | (__| |_| | _ <| |___
  6. * \___|\___/|_| \_\_____|
  7. *
  8. * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
  9. *
  10. * This software is licensed as described in the file COPYING, which
  11. * you should have received as part of this distribution. The terms
  12. * are also available at https://curl.se/docs/copyright.html.
  13. *
  14. * You may opt to use, copy, modify, merge, publish, distribute and/or sell
  15. * copies of the Software, and permit persons to whom the Software is
  16. * furnished to do so, under the terms of the COPYING file.
  17. *
  18. * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
  19. * KIND, either express or implied.
  20. *
  21. * SPDX-License-Identifier: curl
  22. *
  23. ***************************************************************************/
  24. #include "curl_setup.h"
  25. #ifndef CURL_DISABLE_DOH
  26. #include "urldata.h"
  27. #include "curl_addrinfo.h"
  28. #include "doh.h"
  29. #include "sendf.h"
  30. #include "multiif.h"
  31. #include "url.h"
  32. #include "share.h"
  33. #include "curl_base64.h"
  34. #include "connect.h"
  35. #include "strdup.h"
  36. #include "dynbuf.h"
  37. /* The last 3 #include files should be in this order */
  38. #include "curl_printf.h"
  39. #include "curl_memory.h"
  40. #include "memdebug.h"
  41. #include "escape.h"
  42. #define DNS_CLASS_IN 0x01
  43. /* local_print_buf truncates if the hex string will be more than this */
  44. #define LOCAL_PB_HEXMAX 400
  45. #ifndef CURL_DISABLE_VERBOSE_STRINGS
  46. static const char * const errors[]={
  47. "",
  48. "Bad label",
  49. "Out of range",
  50. "Label loop",
  51. "Too small",
  52. "Out of memory",
  53. "RDATA length",
  54. "Malformat",
  55. "Bad RCODE",
  56. "Unexpected TYPE",
  57. "Unexpected CLASS",
  58. "No content",
  59. "Bad ID",
  60. "Name too long"
  61. };
  62. static const char *doh_strerror(DOHcode code)
  63. {
  64. if((code >= DOH_OK) && (code <= DOH_DNS_NAME_TOO_LONG))
  65. return errors[code];
  66. return "bad error code";
  67. }
  68. struct curl_trc_feat Curl_doh_trc = {
  69. "DoH",
  70. CURL_LOG_LVL_NONE,
  71. };
  72. #endif /* !CURL_DISABLE_VERBOSE_STRINGS */
  73. /* @unittest 1655
  74. */
  75. UNITTEST DOHcode doh_encode(const char *host,
  76. DNStype dnstype,
  77. unsigned char *dnsp, /* buffer */
  78. size_t len, /* buffer size */
  79. size_t *olen) /* output length */
  80. {
  81. const size_t hostlen = strlen(host);
  82. unsigned char *orig = dnsp;
  83. const char *hostp = host;
  84. /* The expected output length is 16 bytes more than the length of
  85. * the QNAME-encoding of the host name.
  86. *
  87. * A valid DNS name may not contain a zero-length label, except at
  88. * the end. For this reason, a name beginning with a dot, or
  89. * containing a sequence of two or more consecutive dots, is invalid
  90. * and cannot be encoded as a QNAME.
  91. *
  92. * If the host name ends with a trailing dot, the corresponding
  93. * QNAME-encoding is one byte longer than the host name. If (as is
  94. * also valid) the hostname is shortened by the omission of the
  95. * trailing dot, then its QNAME-encoding will be two bytes longer
  96. * than the host name.
  97. *
  98. * Each [ label, dot ] pair is encoded as [ length, label ],
  99. * preserving overall length. A final [ label ] without a dot is
  100. * also encoded as [ length, label ], increasing overall length
  101. * by one. The encoding is completed by appending a zero byte,
  102. * representing the zero-length root label, again increasing
  103. * the overall length by one.
  104. */
  105. size_t expected_len;
  106. DEBUGASSERT(hostlen);
  107. expected_len = 12 + 1 + hostlen + 4;
  108. if(host[hostlen-1]!='.')
  109. expected_len++;
  110. if(expected_len > (256 + 16)) /* RFCs 1034, 1035 */
  111. return DOH_DNS_NAME_TOO_LONG;
  112. if(len < expected_len)
  113. return DOH_TOO_SMALL_BUFFER;
  114. *dnsp++ = 0; /* 16 bit id */
  115. *dnsp++ = 0;
  116. *dnsp++ = 0x01; /* |QR| Opcode |AA|TC|RD| Set the RD bit */
  117. *dnsp++ = '\0'; /* |RA| Z | RCODE | */
  118. *dnsp++ = '\0';
  119. *dnsp++ = 1; /* QDCOUNT (number of entries in the question section) */
  120. *dnsp++ = '\0';
  121. *dnsp++ = '\0'; /* ANCOUNT */
  122. *dnsp++ = '\0';
  123. *dnsp++ = '\0'; /* NSCOUNT */
  124. *dnsp++ = '\0';
  125. *dnsp++ = '\0'; /* ARCOUNT */
  126. /* encode each label and store it in the QNAME */
  127. while(*hostp) {
  128. size_t labellen;
  129. char *dot = strchr(hostp, '.');
  130. if(dot)
  131. labellen = dot - hostp;
  132. else
  133. labellen = strlen(hostp);
  134. if((labellen > 63) || (!labellen)) {
  135. /* label is too long or too short, error out */
  136. *olen = 0;
  137. return DOH_DNS_BAD_LABEL;
  138. }
  139. /* label is non-empty, process it */
  140. *dnsp++ = (unsigned char)labellen;
  141. memcpy(dnsp, hostp, labellen);
  142. dnsp += labellen;
  143. hostp += labellen;
  144. /* advance past dot, but only if there is one */
  145. if(dot)
  146. hostp++;
  147. } /* next label */
  148. *dnsp++ = 0; /* append zero-length label for root */
  149. /* There are assigned TYPE codes beyond 255: use range [1..65535] */
  150. *dnsp++ = (unsigned char)(255 & (dnstype>>8)); /* upper 8 bit TYPE */
  151. *dnsp++ = (unsigned char)(255 & dnstype); /* lower 8 bit TYPE */
  152. *dnsp++ = '\0'; /* upper 8 bit CLASS */
  153. *dnsp++ = DNS_CLASS_IN; /* IN - "the Internet" */
  154. *olen = dnsp - orig;
  155. /* verify that our estimation of length is valid, since
  156. * this has led to buffer overflows in this function */
  157. DEBUGASSERT(*olen == expected_len);
  158. return DOH_OK;
  159. }
  160. static size_t
  161. doh_write_cb(const void *contents, size_t size, size_t nmemb, void *userp)
  162. {
  163. size_t realsize = size * nmemb;
  164. struct dynbuf *mem = (struct dynbuf *)userp;
  165. if(Curl_dyn_addn(mem, contents, realsize))
  166. return 0;
  167. return realsize;
  168. }
  169. #if defined(USE_HTTPSRR) && defined(CURLDEBUG)
  170. static void local_print_buf(struct Curl_easy *data,
  171. const char *prefix,
  172. unsigned char *buf, size_t len)
  173. {
  174. unsigned char hexstr[LOCAL_PB_HEXMAX];
  175. size_t hlen = LOCAL_PB_HEXMAX;
  176. bool truncated = false;
  177. if(len > (LOCAL_PB_HEXMAX / 2))
  178. truncated = true;
  179. Curl_hexencode(buf, len, hexstr, hlen);
  180. if(!truncated)
  181. infof(data, "%s: len=%d, val=%s", prefix, (int)len, hexstr);
  182. else
  183. infof(data, "%s: len=%d (truncated)val=%s", prefix, (int)len, hexstr);
  184. return;
  185. }
  186. #endif
  187. /* called from multi.c when this DoH transfer is complete */
  188. static int doh_done(struct Curl_easy *doh, CURLcode result)
  189. {
  190. struct Curl_easy *data = doh->set.dohfor;
  191. struct dohdata *dohp = data->req.doh;
  192. /* so one of the DoH request done for the 'data' transfer is now complete! */
  193. dohp->pending--;
  194. infof(doh, "a DoH request is completed, %u to go", dohp->pending);
  195. if(result)
  196. infof(doh, "DoH request %s", curl_easy_strerror(result));
  197. if(!dohp->pending) {
  198. /* DoH completed */
  199. curl_slist_free_all(dohp->headers);
  200. dohp->headers = NULL;
  201. Curl_expire(data, 0, EXPIRE_RUN_NOW);
  202. }
  203. return 0;
  204. }
  205. #define ERROR_CHECK_SETOPT(x,y) \
  206. do { \
  207. result = curl_easy_setopt(doh, x, y); \
  208. if(result && \
  209. result != CURLE_NOT_BUILT_IN && \
  210. result != CURLE_UNKNOWN_OPTION) \
  211. goto error; \
  212. } while(0)
  213. static CURLcode dohprobe(struct Curl_easy *data,
  214. struct dnsprobe *p, DNStype dnstype,
  215. const char *host,
  216. const char *url, CURLM *multi,
  217. struct curl_slist *headers)
  218. {
  219. struct Curl_easy *doh = NULL;
  220. CURLcode result = CURLE_OK;
  221. timediff_t timeout_ms;
  222. DOHcode d = doh_encode(host, dnstype, p->dohbuffer, sizeof(p->dohbuffer),
  223. &p->dohlen);
  224. if(d) {
  225. failf(data, "Failed to encode DoH packet [%d]", d);
  226. return CURLE_OUT_OF_MEMORY;
  227. }
  228. p->dnstype = dnstype;
  229. Curl_dyn_init(&p->serverdoh, DYN_DOH_RESPONSE);
  230. timeout_ms = Curl_timeleft(data, NULL, TRUE);
  231. if(timeout_ms <= 0) {
  232. result = CURLE_OPERATION_TIMEDOUT;
  233. goto error;
  234. }
  235. /* Curl_open() is the internal version of curl_easy_init() */
  236. result = Curl_open(&doh);
  237. if(!result) {
  238. /* pass in the struct pointer via a local variable to please coverity and
  239. the gcc typecheck helpers */
  240. struct dynbuf *resp = &p->serverdoh;
  241. doh->state.internal = true;
  242. #ifndef CURL_DISABLE_VERBOSE_STRINGS
  243. doh->state.feat = &Curl_doh_trc;
  244. #endif
  245. ERROR_CHECK_SETOPT(CURLOPT_URL, url);
  246. ERROR_CHECK_SETOPT(CURLOPT_DEFAULT_PROTOCOL, "https");
  247. ERROR_CHECK_SETOPT(CURLOPT_WRITEFUNCTION, doh_write_cb);
  248. ERROR_CHECK_SETOPT(CURLOPT_WRITEDATA, resp);
  249. ERROR_CHECK_SETOPT(CURLOPT_POSTFIELDS, p->dohbuffer);
  250. ERROR_CHECK_SETOPT(CURLOPT_POSTFIELDSIZE, (long)p->dohlen);
  251. ERROR_CHECK_SETOPT(CURLOPT_HTTPHEADER, headers);
  252. #ifdef USE_HTTP2
  253. ERROR_CHECK_SETOPT(CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_2TLS);
  254. ERROR_CHECK_SETOPT(CURLOPT_PIPEWAIT, 1L);
  255. #endif
  256. #ifndef CURLDEBUG
  257. /* enforce HTTPS if not debug */
  258. ERROR_CHECK_SETOPT(CURLOPT_PROTOCOLS, CURLPROTO_HTTPS);
  259. #else
  260. /* in debug mode, also allow http */
  261. ERROR_CHECK_SETOPT(CURLOPT_PROTOCOLS, CURLPROTO_HTTP|CURLPROTO_HTTPS);
  262. #endif
  263. ERROR_CHECK_SETOPT(CURLOPT_TIMEOUT_MS, (long)timeout_ms);
  264. ERROR_CHECK_SETOPT(CURLOPT_SHARE, data->share);
  265. if(data->set.err && data->set.err != stderr)
  266. ERROR_CHECK_SETOPT(CURLOPT_STDERR, data->set.err);
  267. if(Curl_trc_ft_is_verbose(data, &Curl_doh_trc))
  268. ERROR_CHECK_SETOPT(CURLOPT_VERBOSE, 1L);
  269. if(data->set.no_signal)
  270. ERROR_CHECK_SETOPT(CURLOPT_NOSIGNAL, 1L);
  271. ERROR_CHECK_SETOPT(CURLOPT_SSL_VERIFYHOST,
  272. data->set.doh_verifyhost ? 2L : 0L);
  273. ERROR_CHECK_SETOPT(CURLOPT_SSL_VERIFYPEER,
  274. data->set.doh_verifypeer ? 1L : 0L);
  275. ERROR_CHECK_SETOPT(CURLOPT_SSL_VERIFYSTATUS,
  276. data->set.doh_verifystatus ? 1L : 0L);
  277. /* Inherit *some* SSL options from the user's transfer. This is a
  278. best-guess as to which options are needed for compatibility. #3661
  279. Note DoH does not inherit the user's proxy server so proxy SSL settings
  280. have no effect and are not inherited. If that changes then two new
  281. options should be added to check doh proxy insecure separately,
  282. CURLOPT_DOH_PROXY_SSL_VERIFYHOST and CURLOPT_DOH_PROXY_SSL_VERIFYPEER.
  283. */
  284. if(data->set.ssl.falsestart)
  285. ERROR_CHECK_SETOPT(CURLOPT_SSL_FALSESTART, 1L);
  286. if(data->set.str[STRING_SSL_CAFILE]) {
  287. ERROR_CHECK_SETOPT(CURLOPT_CAINFO,
  288. data->set.str[STRING_SSL_CAFILE]);
  289. }
  290. if(data->set.blobs[BLOB_CAINFO]) {
  291. ERROR_CHECK_SETOPT(CURLOPT_CAINFO_BLOB,
  292. data->set.blobs[BLOB_CAINFO]);
  293. }
  294. if(data->set.str[STRING_SSL_CAPATH]) {
  295. ERROR_CHECK_SETOPT(CURLOPT_CAPATH,
  296. data->set.str[STRING_SSL_CAPATH]);
  297. }
  298. if(data->set.str[STRING_SSL_CRLFILE]) {
  299. ERROR_CHECK_SETOPT(CURLOPT_CRLFILE,
  300. data->set.str[STRING_SSL_CRLFILE]);
  301. }
  302. if(data->set.ssl.certinfo)
  303. ERROR_CHECK_SETOPT(CURLOPT_CERTINFO, 1L);
  304. if(data->set.ssl.fsslctx)
  305. ERROR_CHECK_SETOPT(CURLOPT_SSL_CTX_FUNCTION, data->set.ssl.fsslctx);
  306. if(data->set.ssl.fsslctxp)
  307. ERROR_CHECK_SETOPT(CURLOPT_SSL_CTX_DATA, data->set.ssl.fsslctxp);
  308. if(data->set.fdebug)
  309. ERROR_CHECK_SETOPT(CURLOPT_DEBUGFUNCTION, data->set.fdebug);
  310. if(data->set.debugdata)
  311. ERROR_CHECK_SETOPT(CURLOPT_DEBUGDATA, data->set.debugdata);
  312. if(data->set.str[STRING_SSL_EC_CURVES]) {
  313. ERROR_CHECK_SETOPT(CURLOPT_SSL_EC_CURVES,
  314. data->set.str[STRING_SSL_EC_CURVES]);
  315. }
  316. {
  317. long mask =
  318. (data->set.ssl.enable_beast ?
  319. CURLSSLOPT_ALLOW_BEAST : 0) |
  320. (data->set.ssl.no_revoke ?
  321. CURLSSLOPT_NO_REVOKE : 0) |
  322. (data->set.ssl.no_partialchain ?
  323. CURLSSLOPT_NO_PARTIALCHAIN : 0) |
  324. (data->set.ssl.revoke_best_effort ?
  325. CURLSSLOPT_REVOKE_BEST_EFFORT : 0) |
  326. (data->set.ssl.native_ca_store ?
  327. CURLSSLOPT_NATIVE_CA : 0) |
  328. (data->set.ssl.auto_client_cert ?
  329. CURLSSLOPT_AUTO_CLIENT_CERT : 0);
  330. (void)curl_easy_setopt(doh, CURLOPT_SSL_OPTIONS, mask);
  331. }
  332. doh->set.fmultidone = doh_done;
  333. doh->set.dohfor = data; /* identify for which transfer this is done */
  334. p->easy = doh;
  335. /* DoH handles must not inherit private_data. The handles may be passed to
  336. the user via callbacks and the user will be able to identify them as
  337. internal handles because private data is not set. The user can then set
  338. private_data via CURLOPT_PRIVATE if they so choose. */
  339. DEBUGASSERT(!doh->set.private_data);
  340. if(curl_multi_add_handle(multi, doh))
  341. goto error;
  342. }
  343. else
  344. goto error;
  345. return CURLE_OK;
  346. error:
  347. Curl_close(&doh);
  348. return result;
  349. }
  350. /*
  351. * Curl_doh() resolves a name using DoH. It resolves a name and returns a
  352. * 'Curl_addrinfo *' with the address information.
  353. */
  354. struct Curl_addrinfo *Curl_doh(struct Curl_easy *data,
  355. const char *hostname,
  356. int port,
  357. int *waitp)
  358. {
  359. CURLcode result = CURLE_OK;
  360. int slot;
  361. struct dohdata *dohp;
  362. struct connectdata *conn = data->conn;
  363. #ifdef USE_HTTPSRR
  364. /* for now, this is only used when ECH is enabled */
  365. # ifdef USE_ECH
  366. char *qname = NULL;
  367. # endif
  368. #endif
  369. *waitp = FALSE;
  370. (void)hostname;
  371. (void)port;
  372. DEBUGASSERT(!data->req.doh);
  373. DEBUGASSERT(conn);
  374. /* start clean, consider allocating this struct on demand */
  375. dohp = data->req.doh = calloc(1, sizeof(struct dohdata));
  376. if(!dohp)
  377. return NULL;
  378. conn->bits.doh = TRUE;
  379. dohp->host = hostname;
  380. dohp->port = port;
  381. dohp->headers =
  382. curl_slist_append(NULL,
  383. "Content-Type: application/dns-message");
  384. if(!dohp->headers)
  385. goto error;
  386. /* create IPv4 DoH request */
  387. result = dohprobe(data, &dohp->probe[DOH_PROBE_SLOT_IPADDR_V4],
  388. DNS_TYPE_A, hostname, data->set.str[STRING_DOH],
  389. data->multi, dohp->headers);
  390. if(result)
  391. goto error;
  392. dohp->pending++;
  393. #ifdef USE_IPV6
  394. if((conn->ip_version != CURL_IPRESOLVE_V4) && Curl_ipv6works(data)) {
  395. /* create IPv6 DoH request */
  396. result = dohprobe(data, &dohp->probe[DOH_PROBE_SLOT_IPADDR_V6],
  397. DNS_TYPE_AAAA, hostname, data->set.str[STRING_DOH],
  398. data->multi, dohp->headers);
  399. if(result)
  400. goto error;
  401. dohp->pending++;
  402. }
  403. #endif
  404. #ifdef USE_HTTPSRR
  405. /*
  406. * TODO: Figure out the conditions under which we want to make
  407. * a request for an HTTPS RR when we are not doing ECH. For now,
  408. * making this request breaks a bunch of DoH tests, e.g. test2100,
  409. * where the additional request doesn't match the pre-cooked data
  410. * files, so there's a bit of work attached to making the request
  411. * in a non-ECH use-case. For the present, we'll only make the
  412. * request when ECH is enabled in the build and is being used for
  413. * the curl operation.
  414. */
  415. # ifdef USE_ECH
  416. if(data->set.tls_ech & CURLECH_ENABLE
  417. || data->set.tls_ech & CURLECH_HARD) {
  418. if(port == 443)
  419. qname = strdup(hostname);
  420. else
  421. qname = aprintf("_%d._https.%s", port, hostname);
  422. if(!qname)
  423. goto error;
  424. result = dohprobe(data, &dohp->probe[DOH_PROBE_SLOT_HTTPS],
  425. DNS_TYPE_HTTPS, qname, data->set.str[STRING_DOH],
  426. data->multi, dohp->headers);
  427. free(qname);
  428. if(result)
  429. goto error;
  430. dohp->pending++;
  431. }
  432. # endif
  433. #endif
  434. *waitp = TRUE; /* this never returns synchronously */
  435. return NULL;
  436. error:
  437. curl_slist_free_all(dohp->headers);
  438. data->req.doh->headers = NULL;
  439. for(slot = 0; slot < DOH_PROBE_SLOTS; slot++) {
  440. (void)curl_multi_remove_handle(data->multi, dohp->probe[slot].easy);
  441. Curl_close(&dohp->probe[slot].easy);
  442. }
  443. Curl_safefree(data->req.doh);
  444. return NULL;
  445. }
  446. static DOHcode skipqname(const unsigned char *doh, size_t dohlen,
  447. unsigned int *indexp)
  448. {
  449. unsigned char length;
  450. do {
  451. if(dohlen < (*indexp + 1))
  452. return DOH_DNS_OUT_OF_RANGE;
  453. length = doh[*indexp];
  454. if((length & 0xc0) == 0xc0) {
  455. /* name pointer, advance over it and be done */
  456. if(dohlen < (*indexp + 2))
  457. return DOH_DNS_OUT_OF_RANGE;
  458. *indexp += 2;
  459. break;
  460. }
  461. if(length & 0xc0)
  462. return DOH_DNS_BAD_LABEL;
  463. if(dohlen < (*indexp + 1 + length))
  464. return DOH_DNS_OUT_OF_RANGE;
  465. *indexp += (unsigned int)(1 + length);
  466. } while(length);
  467. return DOH_OK;
  468. }
  469. static unsigned short get16bit(const unsigned char *doh, int index)
  470. {
  471. return (unsigned short)((doh[index] << 8) | doh[index + 1]);
  472. }
  473. static unsigned int get32bit(const unsigned char *doh, int index)
  474. {
  475. /* make clang and gcc optimize this to bswap by incrementing
  476. the pointer first. */
  477. doh += index;
  478. /* avoid undefined behavior by casting to unsigned before shifting
  479. 24 bits, possibly into the sign bit. codegen is same, but
  480. ub sanitizer won't be upset */
  481. return ((unsigned)doh[0] << 24) | ((unsigned)doh[1] << 16) |
  482. ((unsigned)doh[2] << 8) | doh[3];
  483. }
  484. static DOHcode store_a(const unsigned char *doh, int index, struct dohentry *d)
  485. {
  486. /* silently ignore addresses over the limit */
  487. if(d->numaddr < DOH_MAX_ADDR) {
  488. struct dohaddr *a = &d->addr[d->numaddr];
  489. a->type = DNS_TYPE_A;
  490. memcpy(&a->ip.v4, &doh[index], 4);
  491. d->numaddr++;
  492. }
  493. return DOH_OK;
  494. }
  495. static DOHcode store_aaaa(const unsigned char *doh,
  496. int index,
  497. struct dohentry *d)
  498. {
  499. /* silently ignore addresses over the limit */
  500. if(d->numaddr < DOH_MAX_ADDR) {
  501. struct dohaddr *a = &d->addr[d->numaddr];
  502. a->type = DNS_TYPE_AAAA;
  503. memcpy(&a->ip.v6, &doh[index], 16);
  504. d->numaddr++;
  505. }
  506. return DOH_OK;
  507. }
  508. #ifdef USE_HTTPSRR
  509. static DOHcode store_https(const unsigned char *doh,
  510. int index,
  511. struct dohentry *d,
  512. uint16_t len)
  513. {
  514. /* silently ignore RRs over the limit */
  515. if(d->numhttps_rrs < DOH_MAX_HTTPS) {
  516. struct dohhttps_rr *h = &d->https_rrs[d->numhttps_rrs];
  517. h->val = Curl_memdup(&doh[index], len);
  518. if(!h->val)
  519. return DOH_OUT_OF_MEM;
  520. h->len = len;
  521. d->numhttps_rrs++;
  522. }
  523. return DOH_OK;
  524. }
  525. #endif
  526. static DOHcode store_cname(const unsigned char *doh,
  527. size_t dohlen,
  528. unsigned int index,
  529. struct dohentry *d)
  530. {
  531. struct dynbuf *c;
  532. unsigned int loop = 128; /* a valid DNS name can never loop this much */
  533. unsigned char length;
  534. if(d->numcname == DOH_MAX_CNAME)
  535. return DOH_OK; /* skip! */
  536. c = &d->cname[d->numcname++];
  537. do {
  538. if(index >= dohlen)
  539. return DOH_DNS_OUT_OF_RANGE;
  540. length = doh[index];
  541. if((length & 0xc0) == 0xc0) {
  542. int newpos;
  543. /* name pointer, get the new offset (14 bits) */
  544. if((index + 1) >= dohlen)
  545. return DOH_DNS_OUT_OF_RANGE;
  546. /* move to the new index */
  547. newpos = (length & 0x3f) << 8 | doh[index + 1];
  548. index = newpos;
  549. continue;
  550. }
  551. else if(length & 0xc0)
  552. return DOH_DNS_BAD_LABEL; /* bad input */
  553. else
  554. index++;
  555. if(length) {
  556. if(Curl_dyn_len(c)) {
  557. if(Curl_dyn_addn(c, STRCONST(".")))
  558. return DOH_OUT_OF_MEM;
  559. }
  560. if((index + length) > dohlen)
  561. return DOH_DNS_BAD_LABEL;
  562. if(Curl_dyn_addn(c, &doh[index], length))
  563. return DOH_OUT_OF_MEM;
  564. index += length;
  565. }
  566. } while(length && --loop);
  567. if(!loop)
  568. return DOH_DNS_LABEL_LOOP;
  569. return DOH_OK;
  570. }
  571. static DOHcode rdata(const unsigned char *doh,
  572. size_t dohlen,
  573. unsigned short rdlength,
  574. unsigned short type,
  575. int index,
  576. struct dohentry *d)
  577. {
  578. /* RDATA
  579. - A (TYPE 1): 4 bytes
  580. - AAAA (TYPE 28): 16 bytes
  581. - NS (TYPE 2): N bytes
  582. - HTTPS (TYPE 65): N bytes */
  583. DOHcode rc;
  584. switch(type) {
  585. case DNS_TYPE_A:
  586. if(rdlength != 4)
  587. return DOH_DNS_RDATA_LEN;
  588. rc = store_a(doh, index, d);
  589. if(rc)
  590. return rc;
  591. break;
  592. case DNS_TYPE_AAAA:
  593. if(rdlength != 16)
  594. return DOH_DNS_RDATA_LEN;
  595. rc = store_aaaa(doh, index, d);
  596. if(rc)
  597. return rc;
  598. break;
  599. #ifdef USE_HTTPSRR
  600. case DNS_TYPE_HTTPS:
  601. rc = store_https(doh, index, d, rdlength);
  602. if(rc)
  603. return rc;
  604. break;
  605. #endif
  606. case DNS_TYPE_CNAME:
  607. rc = store_cname(doh, dohlen, index, d);
  608. if(rc)
  609. return rc;
  610. break;
  611. case DNS_TYPE_DNAME:
  612. /* explicit for clarity; just skip; rely on synthesized CNAME */
  613. break;
  614. default:
  615. /* unsupported type, just skip it */
  616. break;
  617. }
  618. return DOH_OK;
  619. }
  620. UNITTEST void de_init(struct dohentry *de)
  621. {
  622. int i;
  623. memset(de, 0, sizeof(*de));
  624. de->ttl = INT_MAX;
  625. for(i = 0; i < DOH_MAX_CNAME; i++)
  626. Curl_dyn_init(&de->cname[i], DYN_DOH_CNAME);
  627. }
  628. UNITTEST DOHcode doh_decode(const unsigned char *doh,
  629. size_t dohlen,
  630. DNStype dnstype,
  631. struct dohentry *d)
  632. {
  633. unsigned char rcode;
  634. unsigned short qdcount;
  635. unsigned short ancount;
  636. unsigned short type = 0;
  637. unsigned short rdlength;
  638. unsigned short nscount;
  639. unsigned short arcount;
  640. unsigned int index = 12;
  641. DOHcode rc;
  642. if(dohlen < 12)
  643. return DOH_TOO_SMALL_BUFFER; /* too small */
  644. if(!doh || doh[0] || doh[1])
  645. return DOH_DNS_BAD_ID; /* bad ID */
  646. rcode = doh[3] & 0x0f;
  647. if(rcode)
  648. return DOH_DNS_BAD_RCODE; /* bad rcode */
  649. qdcount = get16bit(doh, 4);
  650. while(qdcount) {
  651. rc = skipqname(doh, dohlen, &index);
  652. if(rc)
  653. return rc; /* bad qname */
  654. if(dohlen < (index + 4))
  655. return DOH_DNS_OUT_OF_RANGE;
  656. index += 4; /* skip question's type and class */
  657. qdcount--;
  658. }
  659. ancount = get16bit(doh, 6);
  660. while(ancount) {
  661. unsigned short class;
  662. unsigned int ttl;
  663. rc = skipqname(doh, dohlen, &index);
  664. if(rc)
  665. return rc; /* bad qname */
  666. if(dohlen < (index + 2))
  667. return DOH_DNS_OUT_OF_RANGE;
  668. type = get16bit(doh, index);
  669. if((type != DNS_TYPE_CNAME) /* may be synthesized from DNAME */
  670. && (type != DNS_TYPE_DNAME) /* if present, accept and ignore */
  671. && (type != dnstype))
  672. /* Not the same type as was asked for nor CNAME nor DNAME */
  673. return DOH_DNS_UNEXPECTED_TYPE;
  674. index += 2;
  675. if(dohlen < (index + 2))
  676. return DOH_DNS_OUT_OF_RANGE;
  677. class = get16bit(doh, index);
  678. if(DNS_CLASS_IN != class)
  679. return DOH_DNS_UNEXPECTED_CLASS; /* unsupported */
  680. index += 2;
  681. if(dohlen < (index + 4))
  682. return DOH_DNS_OUT_OF_RANGE;
  683. ttl = get32bit(doh, index);
  684. if(ttl < d->ttl)
  685. d->ttl = ttl;
  686. index += 4;
  687. if(dohlen < (index + 2))
  688. return DOH_DNS_OUT_OF_RANGE;
  689. rdlength = get16bit(doh, index);
  690. index += 2;
  691. if(dohlen < (index + rdlength))
  692. return DOH_DNS_OUT_OF_RANGE;
  693. rc = rdata(doh, dohlen, rdlength, type, index, d);
  694. if(rc)
  695. return rc; /* bad rdata */
  696. index += rdlength;
  697. ancount--;
  698. }
  699. nscount = get16bit(doh, 8);
  700. while(nscount) {
  701. rc = skipqname(doh, dohlen, &index);
  702. if(rc)
  703. return rc; /* bad qname */
  704. if(dohlen < (index + 8))
  705. return DOH_DNS_OUT_OF_RANGE;
  706. index += 2 + 2 + 4; /* type, class and ttl */
  707. if(dohlen < (index + 2))
  708. return DOH_DNS_OUT_OF_RANGE;
  709. rdlength = get16bit(doh, index);
  710. index += 2;
  711. if(dohlen < (index + rdlength))
  712. return DOH_DNS_OUT_OF_RANGE;
  713. index += rdlength;
  714. nscount--;
  715. }
  716. arcount = get16bit(doh, 10);
  717. while(arcount) {
  718. rc = skipqname(doh, dohlen, &index);
  719. if(rc)
  720. return rc; /* bad qname */
  721. if(dohlen < (index + 8))
  722. return DOH_DNS_OUT_OF_RANGE;
  723. index += 2 + 2 + 4; /* type, class and ttl */
  724. if(dohlen < (index + 2))
  725. return DOH_DNS_OUT_OF_RANGE;
  726. rdlength = get16bit(doh, index);
  727. index += 2;
  728. if(dohlen < (index + rdlength))
  729. return DOH_DNS_OUT_OF_RANGE;
  730. index += rdlength;
  731. arcount--;
  732. }
  733. if(index != dohlen)
  734. return DOH_DNS_MALFORMAT; /* something is wrong */
  735. #ifdef USE_HTTTPS
  736. if((type != DNS_TYPE_NS) && !d->numcname && !d->numaddr && !d->numhttps_rrs)
  737. #else
  738. if((type != DNS_TYPE_NS) && !d->numcname && !d->numaddr)
  739. #endif
  740. /* nothing stored! */
  741. return DOH_NO_CONTENT;
  742. return DOH_OK; /* ok */
  743. }
  744. #ifndef CURL_DISABLE_VERBOSE_STRINGS
  745. static void showdoh(struct Curl_easy *data,
  746. const struct dohentry *d)
  747. {
  748. int i;
  749. infof(data, "[DoH] TTL: %u seconds", d->ttl);
  750. for(i = 0; i < d->numaddr; i++) {
  751. const struct dohaddr *a = &d->addr[i];
  752. if(a->type == DNS_TYPE_A) {
  753. infof(data, "[DoH] A: %u.%u.%u.%u",
  754. a->ip.v4[0], a->ip.v4[1],
  755. a->ip.v4[2], a->ip.v4[3]);
  756. }
  757. else if(a->type == DNS_TYPE_AAAA) {
  758. int j;
  759. char buffer[128];
  760. char *ptr;
  761. size_t len;
  762. len = msnprintf(buffer, 128, "[DoH] AAAA: ");
  763. ptr = &buffer[len];
  764. len = sizeof(buffer) - len;
  765. for(j = 0; j < 16; j += 2) {
  766. size_t l;
  767. msnprintf(ptr, len, "%s%02x%02x", j?":":"", d->addr[i].ip.v6[j],
  768. d->addr[i].ip.v6[j + 1]);
  769. l = strlen(ptr);
  770. len -= l;
  771. ptr += l;
  772. }
  773. infof(data, "%s", buffer);
  774. }
  775. }
  776. #ifdef USE_HTTPSRR
  777. for(i = 0; i < d->numhttps_rrs; i++) {
  778. # ifdef CURLDEBUG
  779. local_print_buf(data, "DoH HTTPS",
  780. d->https_rrs[i].val, d->https_rrs[i].len);
  781. # else
  782. infof(data, "DoH HTTPS RR: length %d", d->https_rrs[i].len);
  783. # endif
  784. }
  785. #endif
  786. for(i = 0; i < d->numcname; i++) {
  787. infof(data, "CNAME: %s", Curl_dyn_ptr(&d->cname[i]));
  788. }
  789. }
  790. #else
  791. #define showdoh(x,y)
  792. #endif
  793. /*
  794. * doh2ai()
  795. *
  796. * This function returns a pointer to the first element of a newly allocated
  797. * Curl_addrinfo struct linked list filled with the data from a set of DoH
  798. * lookups. Curl_addrinfo is meant to work like the addrinfo struct does for
  799. * a IPv6 stack, but usable also for IPv4, all hosts and environments.
  800. *
  801. * The memory allocated by this function *MUST* be free'd later on calling
  802. * Curl_freeaddrinfo(). For each successful call to this function there
  803. * must be an associated call later to Curl_freeaddrinfo().
  804. */
  805. static CURLcode doh2ai(const struct dohentry *de, const char *hostname,
  806. int port, struct Curl_addrinfo **aip)
  807. {
  808. struct Curl_addrinfo *ai;
  809. struct Curl_addrinfo *prevai = NULL;
  810. struct Curl_addrinfo *firstai = NULL;
  811. struct sockaddr_in *addr;
  812. #ifdef USE_IPV6
  813. struct sockaddr_in6 *addr6;
  814. #endif
  815. CURLcode result = CURLE_OK;
  816. int i;
  817. size_t hostlen = strlen(hostname) + 1; /* include null-terminator */
  818. DEBUGASSERT(de);
  819. if(!de->numaddr)
  820. return CURLE_COULDNT_RESOLVE_HOST;
  821. for(i = 0; i < de->numaddr; i++) {
  822. size_t ss_size;
  823. CURL_SA_FAMILY_T addrtype;
  824. if(de->addr[i].type == DNS_TYPE_AAAA) {
  825. #ifndef USE_IPV6
  826. /* we can't handle IPv6 addresses */
  827. continue;
  828. #else
  829. ss_size = sizeof(struct sockaddr_in6);
  830. addrtype = AF_INET6;
  831. #endif
  832. }
  833. else {
  834. ss_size = sizeof(struct sockaddr_in);
  835. addrtype = AF_INET;
  836. }
  837. ai = calloc(1, sizeof(struct Curl_addrinfo) + ss_size + hostlen);
  838. if(!ai) {
  839. result = CURLE_OUT_OF_MEMORY;
  840. break;
  841. }
  842. ai->ai_addr = (void *)((char *)ai + sizeof(struct Curl_addrinfo));
  843. ai->ai_canonname = (void *)((char *)ai->ai_addr + ss_size);
  844. memcpy(ai->ai_canonname, hostname, hostlen);
  845. if(!firstai)
  846. /* store the pointer we want to return from this function */
  847. firstai = ai;
  848. if(prevai)
  849. /* make the previous entry point to this */
  850. prevai->ai_next = ai;
  851. ai->ai_family = addrtype;
  852. /* we return all names as STREAM, so when using this address for TFTP
  853. the type must be ignored and conn->socktype be used instead! */
  854. ai->ai_socktype = SOCK_STREAM;
  855. ai->ai_addrlen = (curl_socklen_t)ss_size;
  856. /* leave the rest of the struct filled with zero */
  857. switch(ai->ai_family) {
  858. case AF_INET:
  859. addr = (void *)ai->ai_addr; /* storage area for this info */
  860. DEBUGASSERT(sizeof(struct in_addr) == sizeof(de->addr[i].ip.v4));
  861. memcpy(&addr->sin_addr, &de->addr[i].ip.v4, sizeof(struct in_addr));
  862. addr->sin_family = addrtype;
  863. addr->sin_port = htons((unsigned short)port);
  864. break;
  865. #ifdef USE_IPV6
  866. case AF_INET6:
  867. addr6 = (void *)ai->ai_addr; /* storage area for this info */
  868. DEBUGASSERT(sizeof(struct in6_addr) == sizeof(de->addr[i].ip.v6));
  869. memcpy(&addr6->sin6_addr, &de->addr[i].ip.v6, sizeof(struct in6_addr));
  870. addr6->sin6_family = addrtype;
  871. addr6->sin6_port = htons((unsigned short)port);
  872. break;
  873. #endif
  874. }
  875. prevai = ai;
  876. }
  877. if(result) {
  878. Curl_freeaddrinfo(firstai);
  879. firstai = NULL;
  880. }
  881. *aip = firstai;
  882. return result;
  883. }
  884. #ifndef CURL_DISABLE_VERBOSE_STRINGS
  885. static const char *type2name(DNStype dnstype)
  886. {
  887. switch(dnstype) {
  888. case DNS_TYPE_A:
  889. return "A";
  890. case DNS_TYPE_AAAA:
  891. return "AAAA";
  892. #ifdef USE_HTTPSRR
  893. case DNS_TYPE_HTTPS:
  894. return "HTTPS";
  895. #endif
  896. default:
  897. return "unknown";
  898. }
  899. }
  900. #endif
  901. UNITTEST void de_cleanup(struct dohentry *d)
  902. {
  903. int i = 0;
  904. for(i = 0; i < d->numcname; i++) {
  905. Curl_dyn_free(&d->cname[i]);
  906. }
  907. #ifdef USE_HTTPSRR
  908. for(i = 0; i < d->numhttps_rrs; i++)
  909. free(d->https_rrs[i].val);
  910. #endif
  911. }
  912. #ifdef USE_HTTPSRR
  913. /*
  914. * @brief decode the DNS name in a binary RRData
  915. * @param buf points to the buffer (in/out)
  916. * @param remaining points to the remaining buffer length (in/out)
  917. * @param dnsname returns the string form name on success
  918. * @return is 1 for success, error otherwise
  919. *
  920. * The encoding here is defined in
  921. * https://tools.ietf.org/html/rfc1035#section-3.1
  922. *
  923. * The input buffer pointer will be modified so it points to
  924. * just after the end of the DNS name encoding on output. (And
  925. * that's why it's an "unsigned char **" :-)
  926. */
  927. static CURLcode local_decode_rdata_name(unsigned char **buf, size_t *remaining,
  928. char **dnsname)
  929. {
  930. unsigned char *cp = NULL;
  931. int rem = 0;
  932. unsigned char clen = 0; /* chunk len */
  933. struct dynbuf thename;
  934. DEBUGASSERT(buf && remaining && dnsname);
  935. if(!buf || !remaining || !dnsname)
  936. return CURLE_OUT_OF_MEMORY;
  937. rem = (int)*remaining;
  938. if(rem <= 0) {
  939. Curl_dyn_free(&thename);
  940. return CURLE_OUT_OF_MEMORY;
  941. }
  942. Curl_dyn_init(&thename, CURL_MAXLEN_host_name);
  943. cp = *buf;
  944. clen = *cp++;
  945. if(clen == 0) {
  946. /* special case - return "." as name */
  947. if(Curl_dyn_addn(&thename, ".", 1))
  948. return CURLE_OUT_OF_MEMORY;
  949. }
  950. while(clen) {
  951. if(clen >= rem) {
  952. Curl_dyn_free(&thename);
  953. return CURLE_OUT_OF_MEMORY;
  954. }
  955. if(Curl_dyn_addn(&thename, cp, clen) ||
  956. Curl_dyn_addn(&thename, ".", 1))
  957. return CURLE_TOO_LARGE;
  958. cp += clen;
  959. rem -= (clen + 1);
  960. if(rem <= 0) {
  961. Curl_dyn_free(&thename);
  962. return CURLE_OUT_OF_MEMORY;
  963. }
  964. clen = *cp++;
  965. }
  966. *buf = cp;
  967. *remaining = rem - 1;
  968. *dnsname = Curl_dyn_ptr(&thename);
  969. return CURLE_OK;
  970. }
  971. static CURLcode local_decode_rdata_alpn(unsigned char *rrval, size_t len,
  972. char **alpns)
  973. {
  974. /*
  975. * spec here is as per draft-ietf-dnsop-svcb-https, section-7.1.1
  976. * encoding is catenated list of strings each preceded by a one
  977. * octet length
  978. * output is comma-sep list of the strings
  979. * implementations may or may not handle quoting of comma within
  980. * string values, so we might see a comma within the wire format
  981. * version of a string, in which case we'll precede that by a
  982. * backslash - same goes for a backslash character, and of course
  983. * we need to use two backslashes in strings when we mean one;-)
  984. */
  985. int remaining = (int) len;
  986. char *oval;
  987. size_t i;
  988. unsigned char *cp = rrval;
  989. struct dynbuf dval;
  990. if(!alpns)
  991. return CURLE_OUT_OF_MEMORY;
  992. Curl_dyn_init(&dval, DYN_DOH_RESPONSE);
  993. remaining = (int)len;
  994. cp = rrval;
  995. while(remaining > 0) {
  996. size_t tlen = (size_t) *cp++;
  997. /* if not 1st time, add comma */
  998. if(remaining != (int)len && Curl_dyn_addn(&dval, ",", 1))
  999. goto err;
  1000. remaining--;
  1001. if(tlen > (size_t)remaining)
  1002. goto err;
  1003. /* add escape char if needed, clunky but easier to read */
  1004. for(i = 0; i != tlen; i++) {
  1005. if('\\' == *cp || ',' == *cp) {
  1006. if(Curl_dyn_addn(&dval, "\\", 1))
  1007. goto err;
  1008. }
  1009. if(Curl_dyn_addn(&dval, cp++, 1))
  1010. goto err;
  1011. }
  1012. remaining -= (int)tlen;
  1013. }
  1014. /* this string is always null terminated */
  1015. oval = Curl_dyn_ptr(&dval);
  1016. if(!oval)
  1017. goto err;
  1018. *alpns = oval;
  1019. return CURLE_OK;
  1020. err:
  1021. Curl_dyn_free(&dval);
  1022. return CURLE_BAD_CONTENT_ENCODING;
  1023. }
  1024. #ifdef CURLDEBUG
  1025. static CURLcode test_alpn_escapes(void)
  1026. {
  1027. /* we'll use an example from draft-ietf-dnsop-svcb, figure 10 */
  1028. static unsigned char example[] = {
  1029. 0x08, /* length 8 */
  1030. 0x66, 0x5c, 0x6f, 0x6f, 0x2c, 0x62, 0x61, 0x72, /* value "f\\oo,bar" */
  1031. 0x02, /* length 2 */
  1032. 0x68, 0x32 /* value "h2" */
  1033. };
  1034. size_t example_len = sizeof(example);
  1035. char *aval = NULL;
  1036. static const char *expected = "f\\\\oo\\,bar,h2";
  1037. if(local_decode_rdata_alpn(example, example_len, &aval) != CURLE_OK)
  1038. return CURLE_BAD_CONTENT_ENCODING;
  1039. if(strlen(aval) != strlen(expected))
  1040. return CURLE_BAD_CONTENT_ENCODING;
  1041. if(memcmp(aval, expected, strlen(aval)))
  1042. return CURLE_BAD_CONTENT_ENCODING;
  1043. return CURLE_OK;
  1044. }
  1045. #endif
  1046. static CURLcode Curl_doh_decode_httpsrr(unsigned char *rrval, size_t len,
  1047. struct Curl_https_rrinfo **hrr)
  1048. {
  1049. size_t remaining = len;
  1050. unsigned char *cp = rrval;
  1051. uint16_t pcode = 0, plen = 0;
  1052. struct Curl_https_rrinfo *lhrr = NULL;
  1053. char *dnsname = NULL;
  1054. #ifdef CURLDEBUG
  1055. /* a few tests of escaping, shouldn't be here but ok for now */
  1056. if(test_alpn_escapes() != CURLE_OK)
  1057. return CURLE_OUT_OF_MEMORY;
  1058. #endif
  1059. lhrr = calloc(1, sizeof(struct Curl_https_rrinfo));
  1060. if(!lhrr)
  1061. return CURLE_OUT_OF_MEMORY;
  1062. lhrr->val = Curl_memdup(rrval, len);
  1063. if(!lhrr->val)
  1064. goto err;
  1065. lhrr->len = len;
  1066. if(remaining <= 2)
  1067. goto err;
  1068. lhrr->priority = (uint16_t)((cp[0] << 8) + cp[1]);
  1069. cp += 2;
  1070. remaining -= (uint16_t)2;
  1071. if(local_decode_rdata_name(&cp, &remaining, &dnsname) != CURLE_OK)
  1072. goto err;
  1073. lhrr->target = dnsname;
  1074. while(remaining >= 4) {
  1075. pcode = (uint16_t)((*cp << 8) + (*(cp + 1)));
  1076. cp += 2;
  1077. plen = (uint16_t)((*cp << 8) + (*(cp + 1)));
  1078. cp += 2;
  1079. remaining -= 4;
  1080. if(pcode == HTTPS_RR_CODE_ALPN) {
  1081. if(local_decode_rdata_alpn(cp, plen, &lhrr->alpns) != CURLE_OK)
  1082. goto err;
  1083. }
  1084. if(pcode == HTTPS_RR_CODE_NO_DEF_ALPN)
  1085. lhrr->no_def_alpn = TRUE;
  1086. else if(pcode == HTTPS_RR_CODE_IPV4) {
  1087. lhrr->ipv4hints = Curl_memdup(cp, plen);
  1088. if(!lhrr->ipv4hints)
  1089. goto err;
  1090. lhrr->ipv4hints_len = (size_t)plen;
  1091. }
  1092. else if(pcode == HTTPS_RR_CODE_ECH) {
  1093. lhrr->echconfiglist = Curl_memdup(cp, plen);
  1094. if(!lhrr->echconfiglist)
  1095. goto err;
  1096. lhrr->echconfiglist_len = (size_t)plen;
  1097. }
  1098. else if(pcode == HTTPS_RR_CODE_IPV6) {
  1099. lhrr->ipv6hints = Curl_memdup(cp, plen);
  1100. if(!lhrr->ipv6hints)
  1101. goto err;
  1102. lhrr->ipv6hints_len = (size_t)plen;
  1103. }
  1104. if(plen > 0 && plen <= remaining) {
  1105. cp += plen;
  1106. remaining -= plen;
  1107. }
  1108. }
  1109. DEBUGASSERT(!remaining);
  1110. *hrr = lhrr;
  1111. return CURLE_OK;
  1112. err:
  1113. if(lhrr) {
  1114. free(lhrr->target);
  1115. free(lhrr->echconfiglist);
  1116. free(lhrr->val);
  1117. free(lhrr);
  1118. }
  1119. return CURLE_OUT_OF_MEMORY;
  1120. }
  1121. # ifdef CURLDEBUG
  1122. static void local_print_httpsrr(struct Curl_easy *data,
  1123. struct Curl_https_rrinfo *hrr)
  1124. {
  1125. DEBUGASSERT(hrr);
  1126. infof(data, "HTTPS RR: priority %d, target: %s",
  1127. hrr->priority, hrr->target);
  1128. if(hrr->alpns)
  1129. infof(data, "HTTPS RR: alpns %s", hrr->alpns);
  1130. else
  1131. infof(data, "HTTPS RR: no alpns");
  1132. if(hrr->no_def_alpn)
  1133. infof(data, "HTTPS RR: no_def_alpn set");
  1134. else
  1135. infof(data, "HTTPS RR: no_def_alpn not set");
  1136. if(hrr->ipv4hints) {
  1137. local_print_buf(data, "HTTPS RR: ipv4hints",
  1138. hrr->ipv4hints, hrr->ipv4hints_len);
  1139. }
  1140. else
  1141. infof(data, "HTTPS RR: no ipv4hints");
  1142. if(hrr->echconfiglist) {
  1143. local_print_buf(data, "HTTPS RR: ECHConfigList",
  1144. hrr->echconfiglist, hrr->echconfiglist_len);
  1145. }
  1146. else
  1147. infof(data, "HTTPS RR: no ECHConfigList");
  1148. if(hrr->ipv6hints) {
  1149. local_print_buf(data, "HTTPS RR: ipv6hint",
  1150. hrr->ipv6hints, hrr->ipv6hints_len);
  1151. }
  1152. else
  1153. infof(data, "HTTPS RR: no ipv6hints");
  1154. return;
  1155. }
  1156. # endif
  1157. #endif
  1158. CURLcode Curl_doh_is_resolved(struct Curl_easy *data,
  1159. struct Curl_dns_entry **dnsp)
  1160. {
  1161. CURLcode result;
  1162. struct dohdata *dohp = data->req.doh;
  1163. *dnsp = NULL; /* defaults to no response */
  1164. if(!dohp)
  1165. return CURLE_OUT_OF_MEMORY;
  1166. if(!dohp->probe[DOH_PROBE_SLOT_IPADDR_V4].easy &&
  1167. !dohp->probe[DOH_PROBE_SLOT_IPADDR_V6].easy) {
  1168. failf(data, "Could not DoH-resolve: %s", data->state.async.hostname);
  1169. return CONN_IS_PROXIED(data->conn)?CURLE_COULDNT_RESOLVE_PROXY:
  1170. CURLE_COULDNT_RESOLVE_HOST;
  1171. }
  1172. else if(!dohp->pending) {
  1173. #ifndef USE_HTTPSRR
  1174. DOHcode rc[DOH_PROBE_SLOTS] = {
  1175. DOH_OK, DOH_OK
  1176. };
  1177. #else
  1178. DOHcode rc[DOH_PROBE_SLOTS] = {
  1179. DOH_OK, DOH_OK, DOH_OK
  1180. };
  1181. #endif
  1182. struct dohentry de;
  1183. int slot;
  1184. /* remove DoH handles from multi handle and close them */
  1185. for(slot = 0; slot < DOH_PROBE_SLOTS; slot++) {
  1186. curl_multi_remove_handle(data->multi, dohp->probe[slot].easy);
  1187. Curl_close(&dohp->probe[slot].easy);
  1188. }
  1189. /* parse the responses, create the struct and return it! */
  1190. de_init(&de);
  1191. for(slot = 0; slot < DOH_PROBE_SLOTS; slot++) {
  1192. struct dnsprobe *p = &dohp->probe[slot];
  1193. if(!p->dnstype)
  1194. continue;
  1195. rc[slot] = doh_decode(Curl_dyn_uptr(&p->serverdoh),
  1196. Curl_dyn_len(&p->serverdoh),
  1197. p->dnstype,
  1198. &de);
  1199. Curl_dyn_free(&p->serverdoh);
  1200. #ifndef CURL_DISABLE_VERBOSE_STRINGS
  1201. if(rc[slot]) {
  1202. infof(data, "DoH: %s type %s for %s", doh_strerror(rc[slot]),
  1203. type2name(p->dnstype), dohp->host);
  1204. }
  1205. #endif
  1206. } /* next slot */
  1207. result = CURLE_COULDNT_RESOLVE_HOST; /* until we know better */
  1208. if(!rc[DOH_PROBE_SLOT_IPADDR_V4] || !rc[DOH_PROBE_SLOT_IPADDR_V6]) {
  1209. /* we have an address, of one kind or other */
  1210. struct Curl_dns_entry *dns;
  1211. struct Curl_addrinfo *ai;
  1212. if(Curl_trc_ft_is_verbose(data, &Curl_doh_trc)) {
  1213. infof(data, "[DoH] Host name: %s", dohp->host);
  1214. showdoh(data, &de);
  1215. }
  1216. result = doh2ai(&de, dohp->host, dohp->port, &ai);
  1217. if(result) {
  1218. de_cleanup(&de);
  1219. return result;
  1220. }
  1221. if(data->share)
  1222. Curl_share_lock(data, CURL_LOCK_DATA_DNS, CURL_LOCK_ACCESS_SINGLE);
  1223. /* we got a response, store it in the cache */
  1224. dns = Curl_cache_addr(data, ai, dohp->host, 0, dohp->port);
  1225. if(data->share)
  1226. Curl_share_unlock(data, CURL_LOCK_DATA_DNS);
  1227. if(!dns) {
  1228. /* returned failure, bail out nicely */
  1229. Curl_freeaddrinfo(ai);
  1230. }
  1231. else {
  1232. data->state.async.dns = dns;
  1233. *dnsp = dns;
  1234. result = CURLE_OK; /* address resolution OK */
  1235. }
  1236. } /* address processing done */
  1237. /* Now process any build-specific attributes retrieved from DNS */
  1238. #ifdef USE_HTTPSRR
  1239. if(de.numhttps_rrs > 0 && result == CURLE_OK && *dnsp) {
  1240. struct Curl_https_rrinfo *hrr = NULL;
  1241. result = Curl_doh_decode_httpsrr(de.https_rrs->val, de.https_rrs->len,
  1242. &hrr);
  1243. if(result) {
  1244. infof(data, "Failed to decode HTTPS RR");
  1245. return result;
  1246. }
  1247. infof(data, "Some HTTPS RR to process");
  1248. # ifdef CURLDEBUG
  1249. local_print_httpsrr(data, hrr);
  1250. # endif
  1251. (*dnsp)->hinfo = hrr;
  1252. }
  1253. #endif
  1254. /* All done */
  1255. de_cleanup(&de);
  1256. Curl_safefree(data->req.doh);
  1257. return result;
  1258. } /* !dohp->pending */
  1259. /* else wait for pending DoH transactions to complete */
  1260. return CURLE_OK;
  1261. }
  1262. #endif /* CURL_DISABLE_DOH */