• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /*	$NetBSD: getaddrinfo.c,v 1.82 2006/03/25 12:09:40 rpaulo Exp $	*/
2 /*	$KAME: getaddrinfo.c,v 1.29 2000/08/31 17:26:57 itojun Exp $	*/
3 
4 /*
5  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
6  * All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  * 3. Neither the name of the project nor the names of its contributors
17  *    may be used to endorse or promote products derived from this software
18  *    without specific prior written permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30  * SUCH DAMAGE.
31  */
32 
33 #define LOG_TAG "getaddrinfo"
34 
35 #include "getaddrinfo.h"
36 
37 #include <arpa/inet.h>
38 #include <arpa/nameser.h>
39 #include <assert.h>
40 #include <ctype.h>
41 #include <errno.h>
42 #include <fcntl.h>
43 #include <net/if.h>
44 #include <netdb.h>
45 #include <netinet/in.h>
46 #include <stdbool.h>
47 #include <stddef.h>
48 #include <stdio.h>
49 #include <stdlib.h>
50 #include <string.h>
51 #include <sys/param.h>
52 #include <sys/socket.h>
53 #include <sys/stat.h>
54 #include <sys/types.h>
55 #include <sys/un.h>
56 #include <unistd.h>
57 
58 #include <android-base/logging.h>
59 
60 #include "netd_resolv/resolv.h"
61 #include "resolv_cache.h"
62 #include "resolv_private.h"
63 
64 #define ANY 0
65 
66 const char in_addrany[] = {0, 0, 0, 0};
67 const char in_loopback[] = {127, 0, 0, 1};
68 const char in6_addrany[] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
69 const char in6_loopback[] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1};
70 
71 const struct afd {
72     int a_af;
73     int a_addrlen;
74     int a_socklen;
75     int a_off;
76     const char* a_addrany;
77     const char* a_loopback;
78     int a_scoped;
79 } afdl[] = {
80         {PF_INET6, sizeof(struct in6_addr), sizeof(struct sockaddr_in6),
81          offsetof(struct sockaddr_in6, sin6_addr), in6_addrany, in6_loopback, 1},
82         {PF_INET, sizeof(struct in_addr), sizeof(struct sockaddr_in),
83          offsetof(struct sockaddr_in, sin_addr), in_addrany, in_loopback, 0},
84         {0, 0, 0, 0, NULL, NULL, 0},
85 };
86 
87 struct Explore {
88     int e_af;
89     int e_socktype;
90     int e_protocol;
91     int e_wild;
92 #define WILD_AF(ex) ((ex).e_wild & 0x01)
93 #define WILD_SOCKTYPE(ex) ((ex).e_wild & 0x02)
94 #define WILD_PROTOCOL(ex) ((ex).e_wild & 0x04)
95 };
96 
97 const Explore explore_options[] = {
98         {PF_INET6, SOCK_DGRAM, IPPROTO_UDP, 0x07},
99         {PF_INET6, SOCK_STREAM, IPPROTO_TCP, 0x07},
100         {PF_INET6, SOCK_RAW, ANY, 0x05},
101         {PF_INET, SOCK_DGRAM, IPPROTO_UDP, 0x07},
102         {PF_INET, SOCK_STREAM, IPPROTO_TCP, 0x07},
103         {PF_INET, SOCK_RAW, ANY, 0x05},
104         {PF_UNSPEC, SOCK_DGRAM, IPPROTO_UDP, 0x07},
105         {PF_UNSPEC, SOCK_STREAM, IPPROTO_TCP, 0x07},
106         {PF_UNSPEC, SOCK_RAW, ANY, 0x05},
107 };
108 
109 #define PTON_MAX 16
110 #define MAXPACKET (8 * 1024)
111 
112 typedef union {
113     HEADER hdr;
114     u_char buf[MAXPACKET];
115 } querybuf;
116 
117 struct res_target {
118     struct res_target* next;
119     const char* name;  /* domain name */
120     int qclass, qtype; /* class and type of query */
121     u_char* answer;    /* buffer to put answer */
122     int anslen;        /* size of answer buffer */
123     int n;             /* result length */
124 };
125 
126 static int str2number(const char*);
127 static int explore_fqdn(const struct addrinfo*, const char*, const char*, struct addrinfo**,
128                         const struct android_net_context*);
129 static int explore_null(const struct addrinfo*, const char*, struct addrinfo**);
130 static int explore_numeric(const struct addrinfo*, const char*, const char*, struct addrinfo**,
131                            const char*);
132 static int explore_numeric_scope(const struct addrinfo*, const char*, const char*,
133                                  struct addrinfo**);
134 static int get_canonname(const struct addrinfo*, struct addrinfo*, const char*);
135 static struct addrinfo* get_ai(const struct addrinfo*, const struct afd*, const char*);
136 static int get_portmatch(const struct addrinfo*, const char*);
137 static int get_port(const struct addrinfo*, const char*, int);
138 static const struct afd* find_afd(int);
139 static int ip6_str2scopeid(const char*, struct sockaddr_in6*, u_int32_t*);
140 
141 static struct addrinfo* getanswer(const querybuf*, int, const char*, int, const struct addrinfo*,
142                                   int* herrno);
143 static int dns_getaddrinfo(const char* name, const addrinfo* pai,
144                            const android_net_context* netcontext, addrinfo** rv);
145 static void _sethtent(FILE**);
146 static void _endhtent(FILE**);
147 static struct addrinfo* _gethtent(FILE**, const char*, const struct addrinfo*);
148 static bool files_getaddrinfo(const char* name, const addrinfo* pai, addrinfo** res);
149 static int _find_src_addr(const struct sockaddr*, struct sockaddr*, unsigned, uid_t);
150 
151 static int res_queryN(const char* name, res_target* target, res_state res, int* herrno);
152 static int res_searchN(const char* name, res_target* target, res_state res, int* herrno);
153 static int res_querydomainN(const char* name, const char* domain, res_target* target, res_state res,
154                             int* herrno);
155 
156 const char* const ai_errlist[] = {
157         "Success",
158         "Address family for hostname not supported",    /* EAI_ADDRFAMILY */
159         "Temporary failure in name resolution",         /* EAI_AGAIN      */
160         "Invalid value for ai_flags",                   /* EAI_BADFLAGS   */
161         "Non-recoverable failure in name resolution",   /* EAI_FAIL       */
162         "ai_family not supported",                      /* EAI_FAMILY     */
163         "Memory allocation failure",                    /* EAI_MEMORY     */
164         "No address associated with hostname",          /* EAI_NODATA     */
165         "hostname nor servname provided, or not known", /* EAI_NONAME     */
166         "servname not supported for ai_socktype",       /* EAI_SERVICE    */
167         "ai_socktype not supported",                    /* EAI_SOCKTYPE   */
168         "System error returned in errno",               /* EAI_SYSTEM     */
169         "Invalid value for hints",                      /* EAI_BADHINTS	  */
170         "Resolved protocol is unknown",                 /* EAI_PROTOCOL   */
171         "Argument buffer overflow",                     /* EAI_OVERFLOW   */
172         "Unknown error",                                /* EAI_MAX        */
173 };
174 
175 /* XXX macros that make external reference is BAD. */
176 
177 #define GET_AI(ai, afd, addr)                                \
178     do {                                                     \
179         /* external reference: pai, error, and label free */ \
180         (ai) = get_ai(pai, (afd), (addr));                   \
181         if ((ai) == NULL) {                                  \
182             error = EAI_MEMORY;                              \
183             goto free;                                       \
184         }                                                    \
185     } while (0)
186 
187 #define GET_PORT(ai, serv)                             \
188     do {                                               \
189         /* external reference: error and label free */ \
190         error = get_port((ai), (serv), 0);             \
191         if (error != 0) goto free;                     \
192     } while (0)
193 
194 #define MATCH_FAMILY(x, y, w) \
195     ((x) == (y) || ((w) && ((x) == PF_UNSPEC || (y) == PF_UNSPEC)))
196 #define MATCH(x, y, w) ((x) == (y) || ((w) && ((x) == ANY || (y) == ANY)))
197 
gai_strerror(int ecode)198 const char* gai_strerror(int ecode) {
199     if (ecode < 0 || ecode > EAI_MAX) ecode = EAI_MAX;
200     return ai_errlist[ecode];
201 }
202 
freeaddrinfo(struct addrinfo * ai)203 void freeaddrinfo(struct addrinfo* ai) {
204     while (ai) {
205         struct addrinfo* next = ai->ai_next;
206         if (ai->ai_canonname) free(ai->ai_canonname);
207         // Also frees ai->ai_addr which points to extra space beyond addrinfo
208         free(ai);
209         ai = next;
210     }
211 }
212 
str2number(const char * p)213 static int str2number(const char* p) {
214     char* ep;
215     unsigned long v;
216 
217     assert(p != NULL);
218 
219     if (*p == '\0') return -1;
220     ep = NULL;
221     errno = 0;
222     v = strtoul(p, &ep, 10);
223     if (errno == 0 && ep && *ep == '\0' && v <= UINT_MAX)
224         return v;
225     else
226         return -1;
227 }
228 
229 /*
230  * The following functions determine whether IPv4 or IPv6 connectivity is
231  * available in order to implement AI_ADDRCONFIG.
232  *
233  * Strictly speaking, AI_ADDRCONFIG should not look at whether connectivity is
234  * available, but whether addresses of the specified family are "configured
235  * on the local system". However, bionic doesn't currently support getifaddrs,
236  * so checking for connectivity is the next best thing.
237  */
have_ipv6(unsigned mark,uid_t uid)238 static int have_ipv6(unsigned mark, uid_t uid) {
239     static const struct sockaddr_in6 sin6_test = {
240             .sin6_family = AF_INET6,
241             .sin6_addr.s6_addr = {// 2000::
242                                   0x20, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0}};
243     sockaddr_union addr = {.sin6 = sin6_test};
244     return _find_src_addr(&addr.sa, NULL, mark, uid) == 1;
245 }
246 
have_ipv4(unsigned mark,uid_t uid)247 static int have_ipv4(unsigned mark, uid_t uid) {
248     static const struct sockaddr_in sin_test = {
249             .sin_family = AF_INET,
250             .sin_addr.s_addr = __constant_htonl(0x08080808L)  // 8.8.8.8
251     };
252     sockaddr_union addr = {.sin = sin_test};
253     return _find_src_addr(&addr.sa, NULL, mark, uid) == 1;
254 }
255 
256 // Internal version of getaddrinfo(), but limited to AI_NUMERICHOST.
257 // NOTE: also called by resolv_set_nameservers_for_net().
getaddrinfo_numeric(const char * hostname,const char * servname,addrinfo hints,addrinfo ** result)258 int getaddrinfo_numeric(const char* hostname, const char* servname, addrinfo hints,
259                         addrinfo** result) {
260     hints.ai_flags = AI_NUMERICHOST;
261     const android_net_context netcontext = {
262             .app_netid = NETID_UNSET,
263             .app_mark = MARK_UNSET,
264             .dns_netid = NETID_UNSET,
265             .dns_mark = MARK_UNSET,
266             .uid = NET_CONTEXT_INVALID_UID,
267     };
268     return android_getaddrinfofornetcontext(hostname, servname, &hints, &netcontext, result);
269 }
270 
android_getaddrinfofornetcontext(const char * hostname,const char * servname,const struct addrinfo * hints,const struct android_net_context * netcontext,struct addrinfo ** res)271 int android_getaddrinfofornetcontext(const char* hostname, const char* servname,
272                                      const struct addrinfo* hints,
273                                      const struct android_net_context* netcontext,
274                                      struct addrinfo** res) {
275     struct addrinfo sentinel = {};
276     struct addrinfo* cur = &sentinel;
277     int error = 0;
278 
279     // hostname is allowed to be nullptr
280     // servname is allowed to be nullptr
281     // hints is allowed to be nullptr
282     assert(res != nullptr);
283     assert(netcontext != nullptr);
284 
285     struct addrinfo ai = {
286             .ai_flags = 0,
287             .ai_family = PF_UNSPEC,
288             .ai_socktype = ANY,
289             .ai_protocol = ANY,
290             .ai_addrlen = 0,
291             .ai_canonname = nullptr,
292             .ai_addr = nullptr,
293             .ai_next = nullptr,
294     };
295 
296     do {
297         if (hostname == NULL && servname == NULL) {
298             error = EAI_NONAME;
299             break;
300         }
301         if (hints) {
302             /* error check for hints */
303             if (hints->ai_addrlen || hints->ai_canonname || hints->ai_addr || hints->ai_next) {
304                 error = EAI_BADHINTS;
305                 break;
306             }
307             if (hints->ai_flags & ~AI_MASK) {
308                 error = EAI_BADFLAGS;
309                 break;
310             }
311 
312             if (!(hints->ai_family == PF_UNSPEC || hints->ai_family == PF_INET ||
313                   hints->ai_family == PF_INET6)) {
314                 error = EAI_FAMILY;
315                 break;
316             }
317 
318             ai = *hints;
319 
320             /*
321              * if both socktype/protocol are specified, check if they
322              * are meaningful combination.
323              */
324             if (ai.ai_socktype != ANY && ai.ai_protocol != ANY) {
325                 for (const Explore& ex : explore_options) {
326                     if (ai.ai_family != ex.e_af) continue;
327                     if (ex.e_socktype == ANY) continue;
328                     if (ex.e_protocol == ANY) continue;
329                     if (ai.ai_socktype == ex.e_socktype && ai.ai_protocol != ex.e_protocol) {
330                         error = EAI_BADHINTS;
331                         break;
332                     }
333                 }
334                 if (error) break;
335             }
336         }
337 
338         /*
339          * Check for special cases:
340          * (1) numeric servname is disallowed if socktype/protocol are left unspecified.
341          * (2) servname is disallowed for raw and other inet{,6} sockets.
342          */
343         if (MATCH_FAMILY(ai.ai_family, PF_INET, 1) || MATCH_FAMILY(ai.ai_family, PF_INET6, 1)) {
344             struct addrinfo tmp = ai;
345             if (tmp.ai_family == PF_UNSPEC) {
346                 tmp.ai_family = PF_INET6;
347             }
348             error = get_portmatch(&tmp, servname);
349             if (error) break;
350         }
351 
352         // NULL hostname, or numeric hostname
353         for (const Explore& ex : explore_options) {
354             /* PF_UNSPEC entries are prepared for DNS queries only */
355             if (ex.e_af == PF_UNSPEC) continue;
356 
357             if (!MATCH_FAMILY(ai.ai_family, ex.e_af, WILD_AF(ex))) continue;
358             if (!MATCH(ai.ai_socktype, ex.e_socktype, WILD_SOCKTYPE(ex))) continue;
359             if (!MATCH(ai.ai_protocol, ex.e_protocol, WILD_PROTOCOL(ex))) continue;
360 
361             struct addrinfo tmp = ai;
362             if (tmp.ai_family == PF_UNSPEC) tmp.ai_family = ex.e_af;
363             if (tmp.ai_socktype == ANY && ex.e_socktype != ANY) tmp.ai_socktype = ex.e_socktype;
364             if (tmp.ai_protocol == ANY && ex.e_protocol != ANY) tmp.ai_protocol = ex.e_protocol;
365 
366             LOG(DEBUG) << __func__ << ": explore_numeric: ai_family=" << tmp.ai_family
367                        << " ai_socktype=" << tmp.ai_socktype << " ai_protocol=" << tmp.ai_protocol;
368             if (hostname == nullptr)
369                 error = explore_null(&tmp, servname, &cur->ai_next);
370             else
371                 error = explore_numeric_scope(&tmp, hostname, servname, &cur->ai_next);
372 
373             if (error) break;
374 
375             while (cur->ai_next) cur = cur->ai_next;
376         }
377         if (error) break;
378 
379         /*
380          * XXX
381          * If numeric representation of AF1 can be interpreted as FQDN
382          * representation of AF2, we need to think again about the code below.
383          */
384         if (sentinel.ai_next) break;
385 
386         if (hostname == nullptr) {
387             error = EAI_NODATA;
388             break;
389         }
390         if (ai.ai_flags & AI_NUMERICHOST) {
391             error = EAI_NONAME;
392             break;
393         }
394 
395         /*
396          * hostname as alphabetical name.
397          * We would like to prefer AF_INET6 over AF_INET, so we'll make a outer loop by AFs.
398          */
399         for (const Explore& ex : explore_options) {
400             // Require exact match for family field
401             if (ai.ai_family != ex.e_af) continue;
402 
403             if (!MATCH(ai.ai_socktype, ex.e_socktype, WILD_SOCKTYPE(ex))) {
404                 continue;
405             }
406             if (!MATCH(ai.ai_protocol, ex.e_protocol, WILD_PROTOCOL(ex))) {
407                 continue;
408             }
409 
410             struct addrinfo tmp = ai;
411             if (tmp.ai_socktype == ANY && ex.e_socktype != ANY) tmp.ai_socktype = ex.e_socktype;
412             if (tmp.ai_protocol == ANY && ex.e_protocol != ANY) tmp.ai_protocol = ex.e_protocol;
413 
414             LOG(DEBUG) << __func__ << ": explore_fqdn(): ai_family=" << tmp.ai_family
415                        << " ai_socktype=" << tmp.ai_socktype << " ai_protocol=" << tmp.ai_protocol;
416             error = explore_fqdn(&tmp, hostname, servname, &cur->ai_next, netcontext);
417 
418             while (cur->ai_next) cur = cur->ai_next;
419         }
420 
421         if (sentinel.ai_next) {
422             error = 0;
423         } else if (error == 0) {
424             error = EAI_FAIL;
425         }
426     } while (0);
427 
428     if (error) {
429         freeaddrinfo(sentinel.ai_next);
430         *res = nullptr;
431     } else {
432         *res = sentinel.ai_next;
433     }
434     return error;
435 }
436 
437 // FQDN hostname, DNS lookup
explore_fqdn(const struct addrinfo * pai,const char * hostname,const char * servname,struct addrinfo ** res,const struct android_net_context * netcontext)438 static int explore_fqdn(const struct addrinfo* pai, const char* hostname, const char* servname,
439                         struct addrinfo** res, const struct android_net_context* netcontext) {
440     struct addrinfo* result;
441     int error = 0;
442 
443     assert(pai != NULL);
444     /* hostname may be NULL */
445     /* servname may be NULL */
446     assert(res != NULL);
447 
448     result = NULL;
449 
450     // If the servname does not match socktype/protocol, ignore it.
451     if (get_portmatch(pai, servname) != 0) return 0;
452 
453     if (!files_getaddrinfo(hostname, pai, &result)) {
454         error = dns_getaddrinfo(hostname, pai, netcontext, &result);
455     }
456     if (!error) {
457         struct addrinfo* cur;
458         for (cur = result; cur; cur = cur->ai_next) {
459             GET_PORT(cur, servname);
460             /* canonname should be filled already */
461         }
462         *res = result;
463         return 0;
464     }
465 
466 free:
467     freeaddrinfo(result);
468     return error;
469 }
470 
471 /*
472  * hostname == NULL.
473  * passive socket -> anyaddr (0.0.0.0 or ::)
474  * non-passive socket -> localhost (127.0.0.1 or ::1)
475  */
explore_null(const struct addrinfo * pai,const char * servname,struct addrinfo ** res)476 static int explore_null(const struct addrinfo* pai, const char* servname, struct addrinfo** res) {
477     int s;
478     const struct afd* afd;
479     struct addrinfo* cur;
480     struct addrinfo sentinel;
481     int error;
482 
483     LOG(DEBUG) << __func__;
484 
485     assert(pai != NULL);
486     /* servname may be NULL */
487     assert(res != NULL);
488 
489     *res = NULL;
490     sentinel.ai_next = NULL;
491     cur = &sentinel;
492 
493     /*
494      * filter out AFs that are not supported by the kernel
495      * XXX errno?
496      */
497     s = socket(pai->ai_family, SOCK_DGRAM | SOCK_CLOEXEC, 0);
498     if (s < 0) {
499         if (errno != EMFILE) return 0;
500     } else
501         close(s);
502 
503     /*
504      * if the servname does not match socktype/protocol, ignore it.
505      */
506     if (get_portmatch(pai, servname) != 0) return 0;
507 
508     afd = find_afd(pai->ai_family);
509     if (afd == NULL) return 0;
510 
511     if (pai->ai_flags & AI_PASSIVE) {
512         GET_AI(cur->ai_next, afd, afd->a_addrany);
513         GET_PORT(cur->ai_next, servname);
514     } else {
515         GET_AI(cur->ai_next, afd, afd->a_loopback);
516         GET_PORT(cur->ai_next, servname);
517     }
518     cur = cur->ai_next;
519 
520     *res = sentinel.ai_next;
521     return 0;
522 
523 free:
524     freeaddrinfo(sentinel.ai_next);
525     return error;
526 }
527 
528 /*
529  * numeric hostname
530  */
explore_numeric(const struct addrinfo * pai,const char * hostname,const char * servname,struct addrinfo ** res,const char * canonname)531 static int explore_numeric(const struct addrinfo* pai, const char* hostname, const char* servname,
532                            struct addrinfo** res, const char* canonname) {
533     const struct afd* afd;
534     struct addrinfo* cur;
535     struct addrinfo sentinel;
536     int error;
537     char pton[PTON_MAX];
538 
539     assert(pai != NULL);
540     /* hostname may be NULL */
541     /* servname may be NULL */
542     assert(res != NULL);
543 
544     *res = NULL;
545     sentinel.ai_next = NULL;
546     cur = &sentinel;
547 
548     /*
549      * if the servname does not match socktype/protocol, ignore it.
550      */
551     if (get_portmatch(pai, servname) != 0) return 0;
552 
553     afd = find_afd(pai->ai_family);
554     if (afd == NULL) return 0;
555 
556     if (inet_pton(afd->a_af, hostname, pton) == 1) {
557         if (pai->ai_family == afd->a_af || pai->ai_family == PF_UNSPEC /*?*/) {
558             GET_AI(cur->ai_next, afd, pton);
559             GET_PORT(cur->ai_next, servname);
560             if ((pai->ai_flags & AI_CANONNAME)) {
561                 /*
562                  * Set the numeric address itself as
563                  * the canonical name, based on a
564                  * clarification in rfc2553bis-03.
565                  */
566                 error = get_canonname(pai, cur->ai_next, canonname);
567                 if (error != 0) {
568                     freeaddrinfo(sentinel.ai_next);
569                     return error;
570                 }
571             }
572             while (cur->ai_next) cur = cur->ai_next;
573         } else
574             return EAI_FAMILY;
575     }
576 
577     *res = sentinel.ai_next;
578     return 0;
579 
580 free:
581     freeaddrinfo(sentinel.ai_next);
582     return error;
583 }
584 
585 /*
586  * numeric hostname with scope
587  */
explore_numeric_scope(const struct addrinfo * pai,const char * hostname,const char * servname,struct addrinfo ** res)588 static int explore_numeric_scope(const struct addrinfo* pai, const char* hostname,
589                                  const char* servname, struct addrinfo** res) {
590     const struct afd* afd;
591     struct addrinfo* cur;
592     int error;
593     const char *cp, *scope, *addr;
594     struct sockaddr_in6* sin6;
595 
596     LOG(DEBUG) << __func__;
597 
598     assert(pai != NULL);
599     /* hostname may be NULL */
600     /* servname may be NULL */
601     assert(res != NULL);
602 
603     /*
604      * if the servname does not match socktype/protocol, ignore it.
605      */
606     if (get_portmatch(pai, servname) != 0) return 0;
607 
608     afd = find_afd(pai->ai_family);
609     if (afd == NULL) return 0;
610 
611     if (!afd->a_scoped) return explore_numeric(pai, hostname, servname, res, hostname);
612 
613     cp = strchr(hostname, SCOPE_DELIMITER);
614     if (cp == NULL) return explore_numeric(pai, hostname, servname, res, hostname);
615 
616     /*
617      * Handle special case of <scoped_address><delimiter><scope id>
618      */
619     char* hostname2 = strdup(hostname);
620     if (hostname2 == NULL) return EAI_MEMORY;
621     /* terminate at the delimiter */
622     hostname2[cp - hostname] = '\0';
623     addr = hostname2;
624     scope = cp + 1;
625 
626     error = explore_numeric(pai, addr, servname, res, hostname);
627     if (error == 0) {
628         u_int32_t scopeid;
629 
630         for (cur = *res; cur; cur = cur->ai_next) {
631             if (cur->ai_family != AF_INET6) continue;
632             sin6 = (struct sockaddr_in6*) (void*) cur->ai_addr;
633             if (ip6_str2scopeid(scope, sin6, &scopeid) == -1) {
634                 free(hostname2);
635                 return (EAI_NODATA); /* XXX: is return OK? */
636             }
637             sin6->sin6_scope_id = scopeid;
638         }
639     }
640 
641     free(hostname2);
642 
643     return error;
644 }
645 
get_canonname(const struct addrinfo * pai,struct addrinfo * ai,const char * str)646 static int get_canonname(const struct addrinfo* pai, struct addrinfo* ai, const char* str) {
647     assert(pai != NULL);
648     assert(ai != NULL);
649     assert(str != NULL);
650 
651     if ((pai->ai_flags & AI_CANONNAME) != 0) {
652         ai->ai_canonname = strdup(str);
653         if (ai->ai_canonname == NULL) return EAI_MEMORY;
654     }
655     return 0;
656 }
657 
get_ai(const struct addrinfo * pai,const struct afd * afd,const char * addr)658 static struct addrinfo* get_ai(const struct addrinfo* pai, const struct afd* afd,
659                                const char* addr) {
660     char* p;
661     struct addrinfo* ai;
662 
663     assert(pai != NULL);
664     assert(afd != NULL);
665     assert(addr != NULL);
666 
667     ai = (struct addrinfo*) malloc(sizeof(struct addrinfo) + sizeof(sockaddr_union));
668     if (ai == NULL) return NULL;
669 
670     memcpy(ai, pai, sizeof(struct addrinfo));
671     ai->ai_addr = (struct sockaddr*) (void*) (ai + 1);
672     memset(ai->ai_addr, 0, sizeof(sockaddr_union));
673 
674     ai->ai_addrlen = afd->a_socklen;
675     ai->ai_addr->sa_family = ai->ai_family = afd->a_af;
676     p = (char*) (void*) (ai->ai_addr);
677     memcpy(p + afd->a_off, addr, (size_t) afd->a_addrlen);
678     return ai;
679 }
680 
get_portmatch(const struct addrinfo * ai,const char * servname)681 static int get_portmatch(const struct addrinfo* ai, const char* servname) {
682     assert(ai != NULL);
683     /* servname may be NULL */
684 
685     return get_port(ai, servname, 1);
686 }
687 
get_port(const struct addrinfo * ai,const char * servname,int matchonly)688 static int get_port(const struct addrinfo* ai, const char* servname, int matchonly) {
689     const char* proto;
690     struct servent* sp;
691     int port;
692     int allownumeric;
693 
694     assert(ai != NULL);
695     /* servname may be NULL */
696 
697     if (servname == NULL) return 0;
698     switch (ai->ai_family) {
699         case AF_INET:
700         case AF_INET6:
701             break;
702         default:
703             return 0;
704     }
705 
706     switch (ai->ai_socktype) {
707         case SOCK_RAW:
708             return EAI_SERVICE;
709         case SOCK_DGRAM:
710         case SOCK_STREAM:
711             allownumeric = 1;
712             break;
713         case ANY:
714             allownumeric = 1;
715             break;
716         default:
717             return EAI_SOCKTYPE;
718     }
719 
720     port = str2number(servname);
721     if (port >= 0) {
722         if (!allownumeric) return EAI_SERVICE;
723         if (port < 0 || port > 65535) return EAI_SERVICE;
724         port = htons(port);
725     } else {
726         if (ai->ai_flags & AI_NUMERICSERV) return EAI_NONAME;
727 
728         switch (ai->ai_socktype) {
729             case SOCK_DGRAM:
730                 proto = "udp";
731                 break;
732             case SOCK_STREAM:
733                 proto = "tcp";
734                 break;
735             default:
736                 proto = NULL;
737                 break;
738         }
739 
740         if ((sp = getservbyname(servname, proto)) == NULL) return EAI_SERVICE;
741         port = sp->s_port;
742     }
743 
744     if (!matchonly) {
745         switch (ai->ai_family) {
746             case AF_INET:
747                 ((struct sockaddr_in*) (void*) ai->ai_addr)->sin_port = port;
748                 break;
749             case AF_INET6:
750                 ((struct sockaddr_in6*) (void*) ai->ai_addr)->sin6_port = port;
751                 break;
752         }
753     }
754 
755     return 0;
756 }
757 
find_afd(int af)758 static const struct afd* find_afd(int af) {
759     const struct afd* afd;
760 
761     if (af == PF_UNSPEC) return NULL;
762     for (afd = afdl; afd->a_af; afd++) {
763         if (afd->a_af == af) return afd;
764     }
765     return NULL;
766 }
767 
768 // Convert a string to a scope identifier.
ip6_str2scopeid(const char * scope,struct sockaddr_in6 * sin6,u_int32_t * scopeid)769 static int ip6_str2scopeid(const char* scope, struct sockaddr_in6* sin6, u_int32_t* scopeid) {
770     u_long lscopeid;
771     struct in6_addr* a6;
772     char* ep;
773 
774     assert(scope != NULL);
775     assert(sin6 != NULL);
776     assert(scopeid != NULL);
777 
778     a6 = &sin6->sin6_addr;
779 
780     /* empty scopeid portion is invalid */
781     if (*scope == '\0') return -1;
782 
783     if (IN6_IS_ADDR_LINKLOCAL(a6) || IN6_IS_ADDR_MC_LINKLOCAL(a6)) {
784         /*
785          * We currently assume a one-to-one mapping between links
786          * and interfaces, so we simply use interface indices for
787          * like-local scopes.
788          */
789         *scopeid = if_nametoindex(scope);
790         if (*scopeid == 0) goto trynumeric;
791         return 0;
792     }
793 
794     /* still unclear about literal, allow numeric only - placeholder */
795     if (IN6_IS_ADDR_SITELOCAL(a6) || IN6_IS_ADDR_MC_SITELOCAL(a6)) goto trynumeric;
796     if (IN6_IS_ADDR_MC_ORGLOCAL(a6))
797         goto trynumeric;
798     else
799         goto trynumeric; /* global */
800 
801     /* try to convert to a numeric id as a last resort */
802 trynumeric:
803     errno = 0;
804     lscopeid = strtoul(scope, &ep, 10);
805     *scopeid = (u_int32_t)(lscopeid & 0xffffffffUL);
806     if (errno == 0 && ep && *ep == '\0' && *scopeid == lscopeid)
807         return 0;
808     else
809         return -1;
810 }
811 
812 /* code duplicate with gethnamaddr.c */
813 
814 #define BOUNDED_INCR(x)      \
815     do {                     \
816         BOUNDS_CHECK(cp, x); \
817         cp += (x);           \
818     } while (0)
819 
820 #define BOUNDS_CHECK(ptr, count)     \
821     do {                             \
822         if (eom - (ptr) < (count)) { \
823             *herrno = NO_RECOVERY;   \
824             return NULL;             \
825         }                            \
826     } while (0)
827 
getanswer(const querybuf * answer,int anslen,const char * qname,int qtype,const struct addrinfo * pai,int * herrno)828 static struct addrinfo* getanswer(const querybuf* answer, int anslen, const char* qname, int qtype,
829                                   const struct addrinfo* pai, int* herrno) {
830     struct addrinfo sentinel = {};
831     struct addrinfo *cur;
832     struct addrinfo ai;
833     const struct afd* afd;
834     char* canonname;
835     const HEADER* hp;
836     const u_char* cp;
837     int n;
838     const u_char* eom;
839     char *bp, *ep;
840     int type, ancount, qdcount;
841     int haveanswer, had_error;
842     char tbuf[MAXDNAME];
843     int (*name_ok)(const char*);
844     char hostbuf[8 * 1024];
845 
846     assert(answer != NULL);
847     assert(qname != NULL);
848     assert(pai != NULL);
849 
850     cur = &sentinel;
851 
852     canonname = NULL;
853     eom = answer->buf + anslen;
854     switch (qtype) {
855         case T_A:
856         case T_AAAA:
857         case T_ANY: /*use T_ANY only for T_A/T_AAAA lookup*/
858             name_ok = res_hnok;
859             break;
860         default:
861             return NULL; /* XXX should be abort(); */
862     }
863     /*
864      * find first satisfactory answer
865      */
866     hp = &answer->hdr;
867     ancount = ntohs(hp->ancount);
868     qdcount = ntohs(hp->qdcount);
869     bp = hostbuf;
870     ep = hostbuf + sizeof hostbuf;
871     cp = answer->buf;
872     BOUNDED_INCR(HFIXEDSZ);
873     if (qdcount != 1) {
874         *herrno = NO_RECOVERY;
875         return (NULL);
876     }
877     n = dn_expand(answer->buf, eom, cp, bp, ep - bp);
878     if ((n < 0) || !(*name_ok)(bp)) {
879         *herrno = NO_RECOVERY;
880         return (NULL);
881     }
882     BOUNDED_INCR(n + QFIXEDSZ);
883     if (qtype == T_A || qtype == T_AAAA || qtype == T_ANY) {
884         /* res_send() has already verified that the query name is the
885          * same as the one we sent; this just gets the expanded name
886          * (i.e., with the succeeding search-domain tacked on).
887          */
888         n = strlen(bp) + 1; /* for the \0 */
889         if (n >= MAXHOSTNAMELEN) {
890             *herrno = NO_RECOVERY;
891             return (NULL);
892         }
893         canonname = bp;
894         bp += n;
895         /* The qname can be abbreviated, but h_name is now absolute. */
896         qname = canonname;
897     }
898     haveanswer = 0;
899     had_error = 0;
900     while (ancount-- > 0 && cp < eom && !had_error) {
901         n = dn_expand(answer->buf, eom, cp, bp, ep - bp);
902         if ((n < 0) || !(*name_ok)(bp)) {
903             had_error++;
904             continue;
905         }
906         cp += n; /* name */
907         BOUNDS_CHECK(cp, 3 * INT16SZ + INT32SZ);
908         type = ntohs(*reinterpret_cast<const uint16_t*>(cp));
909         cp += INT16SZ; /* type */
910         int cl = ntohs(*reinterpret_cast<const uint16_t*>(cp));
911         cp += INT16SZ + INT32SZ; /* class, TTL */
912         n = ntohs(*reinterpret_cast<const uint16_t*>(cp));
913         cp += INT16SZ; /* len */
914         BOUNDS_CHECK(cp, n);
915         if (cl != C_IN) {
916             /* XXX - debug? syslog? */
917             cp += n;
918             continue; /* XXX - had_error++ ? */
919         }
920         if ((qtype == T_A || qtype == T_AAAA || qtype == T_ANY) && type == T_CNAME) {
921             n = dn_expand(answer->buf, eom, cp, tbuf, sizeof tbuf);
922             if ((n < 0) || !(*name_ok)(tbuf)) {
923                 had_error++;
924                 continue;
925             }
926             cp += n;
927             /* Get canonical name. */
928             n = strlen(tbuf) + 1; /* for the \0 */
929             if (n > ep - bp || n >= MAXHOSTNAMELEN) {
930                 had_error++;
931                 continue;
932             }
933             strlcpy(bp, tbuf, (size_t)(ep - bp));
934             canonname = bp;
935             bp += n;
936             continue;
937         }
938         if (qtype == T_ANY) {
939             if (!(type == T_A || type == T_AAAA)) {
940                 cp += n;
941                 continue;
942             }
943         } else if (type != qtype) {
944             if (type != T_KEY && type != T_SIG)
945                 LOG(DEBUG) << __func__ << ": asked for \"" << qname << " " << p_class(C_IN) << " "
946                            << p_type(qtype) << "\", got type \"" << p_type(type) << "\"";
947             cp += n;
948             continue; /* XXX - had_error++ ? */
949         }
950         switch (type) {
951             case T_A:
952             case T_AAAA:
953                 if (strcasecmp(canonname, bp) != 0) {
954                     LOG(DEBUG) << __func__ << ": asked for \"" << canonname << "\", got \"" << bp
955                                << "\"";
956                     cp += n;
957                     continue; /* XXX - had_error++ ? */
958                 }
959                 if (type == T_A && n != INADDRSZ) {
960                     cp += n;
961                     continue;
962                 }
963                 if (type == T_AAAA && n != IN6ADDRSZ) {
964                     cp += n;
965                     continue;
966                 }
967                 if (type == T_AAAA) {
968                     struct in6_addr in6;
969                     memcpy(&in6, cp, IN6ADDRSZ);
970                     if (IN6_IS_ADDR_V4MAPPED(&in6)) {
971                         cp += n;
972                         continue;
973                     }
974                 }
975                 if (!haveanswer) {
976                     int nn;
977 
978                     canonname = bp;
979                     nn = strlen(bp) + 1; /* for the \0 */
980                     bp += nn;
981                 }
982 
983                 /* don't overwrite pai */
984                 ai = *pai;
985                 ai.ai_family = (type == T_A) ? AF_INET : AF_INET6;
986                 afd = find_afd(ai.ai_family);
987                 if (afd == NULL) {
988                     cp += n;
989                     continue;
990                 }
991                 cur->ai_next = get_ai(&ai, afd, (const char*) cp);
992                 if (cur->ai_next == NULL) had_error++;
993                 while (cur && cur->ai_next) cur = cur->ai_next;
994                 cp += n;
995                 break;
996             default:
997                 abort();
998         }
999         if (!had_error) haveanswer++;
1000     }
1001     if (haveanswer) {
1002         if (!canonname)
1003             (void) get_canonname(pai, sentinel.ai_next, qname);
1004         else
1005             (void) get_canonname(pai, sentinel.ai_next, canonname);
1006         *herrno = NETDB_SUCCESS;
1007         return sentinel.ai_next;
1008     }
1009 
1010     *herrno = NO_RECOVERY;
1011     return NULL;
1012 }
1013 
1014 struct addrinfo_sort_elem {
1015     struct addrinfo* ai;
1016     int has_src_addr;
1017     sockaddr_union src_addr;
1018     int original_order;
1019 };
1020 
_get_scope(const struct sockaddr * addr)1021 static int _get_scope(const struct sockaddr* addr) {
1022     if (addr->sa_family == AF_INET6) {
1023         const struct sockaddr_in6* addr6 = (const struct sockaddr_in6*) addr;
1024         if (IN6_IS_ADDR_MULTICAST(&addr6->sin6_addr)) {
1025             return IPV6_ADDR_MC_SCOPE(&addr6->sin6_addr);
1026         } else if (IN6_IS_ADDR_LOOPBACK(&addr6->sin6_addr) ||
1027                    IN6_IS_ADDR_LINKLOCAL(&addr6->sin6_addr)) {
1028             /*
1029              * RFC 4291 section 2.5.3 says loopback is to be treated as having
1030              * link-local scope.
1031              */
1032             return IPV6_ADDR_SCOPE_LINKLOCAL;
1033         } else if (IN6_IS_ADDR_SITELOCAL(&addr6->sin6_addr)) {
1034             return IPV6_ADDR_SCOPE_SITELOCAL;
1035         } else {
1036             return IPV6_ADDR_SCOPE_GLOBAL;
1037         }
1038     } else if (addr->sa_family == AF_INET) {
1039         const struct sockaddr_in* addr4 = (const struct sockaddr_in*) addr;
1040         unsigned long int na = ntohl(addr4->sin_addr.s_addr);
1041 
1042         if (IN_LOOPBACK(na) ||                 /* 127.0.0.0/8 */
1043             (na & 0xffff0000) == 0xa9fe0000) { /* 169.254.0.0/16 */
1044             return IPV6_ADDR_SCOPE_LINKLOCAL;
1045         } else {
1046             /*
1047              * RFC 6724 section 3.2. Other IPv4 addresses, including private addresses
1048              * and shared addresses (100.64.0.0/10), are assigned global scope.
1049              */
1050             return IPV6_ADDR_SCOPE_GLOBAL;
1051         }
1052     } else {
1053         /*
1054          * This should never happen.
1055          * Return a scope with low priority as a last resort.
1056          */
1057         return IPV6_ADDR_SCOPE_NODELOCAL;
1058     }
1059 }
1060 
1061 /* These macros are modelled after the ones in <netinet/in6.h>. */
1062 
1063 /* RFC 4380, section 2.6 */
1064 #define IN6_IS_ADDR_TEREDO(a) \
1065     ((*(const uint32_t*) (const void*) (&(a)->s6_addr[0]) == ntohl(0x20010000)))
1066 
1067 /* RFC 3056, section 2. */
1068 #define IN6_IS_ADDR_6TO4(a) (((a)->s6_addr[0] == 0x20) && ((a)->s6_addr[1] == 0x02))
1069 
1070 /* 6bone testing address area (3ffe::/16), deprecated in RFC 3701. */
1071 #define IN6_IS_ADDR_6BONE(a) (((a)->s6_addr[0] == 0x3f) && ((a)->s6_addr[1] == 0xfe))
1072 
1073 /*
1074  * Get the label for a given IPv4/IPv6 address.
1075  * RFC 6724, section 2.1.
1076  */
1077 
_get_label(const struct sockaddr * addr)1078 static int _get_label(const struct sockaddr* addr) {
1079     if (addr->sa_family == AF_INET) {
1080         return 4;
1081     } else if (addr->sa_family == AF_INET6) {
1082         const struct sockaddr_in6* addr6 = (const struct sockaddr_in6*) addr;
1083         if (IN6_IS_ADDR_LOOPBACK(&addr6->sin6_addr)) {
1084             return 0;
1085         } else if (IN6_IS_ADDR_V4MAPPED(&addr6->sin6_addr)) {
1086             return 4;
1087         } else if (IN6_IS_ADDR_6TO4(&addr6->sin6_addr)) {
1088             return 2;
1089         } else if (IN6_IS_ADDR_TEREDO(&addr6->sin6_addr)) {
1090             return 5;
1091         } else if (IN6_IS_ADDR_ULA(&addr6->sin6_addr)) {
1092             return 13;
1093         } else if (IN6_IS_ADDR_V4COMPAT(&addr6->sin6_addr)) {
1094             return 3;
1095         } else if (IN6_IS_ADDR_SITELOCAL(&addr6->sin6_addr)) {
1096             return 11;
1097         } else if (IN6_IS_ADDR_6BONE(&addr6->sin6_addr)) {
1098             return 12;
1099         } else {
1100             /* All other IPv6 addresses, including global unicast addresses. */
1101             return 1;
1102         }
1103     } else {
1104         /*
1105          * This should never happen.
1106          * Return a semi-random label as a last resort.
1107          */
1108         return 1;
1109     }
1110 }
1111 
1112 /*
1113  * Get the precedence for a given IPv4/IPv6 address.
1114  * RFC 6724, section 2.1.
1115  */
1116 
_get_precedence(const struct sockaddr * addr)1117 static int _get_precedence(const struct sockaddr* addr) {
1118     if (addr->sa_family == AF_INET) {
1119         return 35;
1120     } else if (addr->sa_family == AF_INET6) {
1121         const struct sockaddr_in6* addr6 = (const struct sockaddr_in6*) addr;
1122         if (IN6_IS_ADDR_LOOPBACK(&addr6->sin6_addr)) {
1123             return 50;
1124         } else if (IN6_IS_ADDR_V4MAPPED(&addr6->sin6_addr)) {
1125             return 35;
1126         } else if (IN6_IS_ADDR_6TO4(&addr6->sin6_addr)) {
1127             return 30;
1128         } else if (IN6_IS_ADDR_TEREDO(&addr6->sin6_addr)) {
1129             return 5;
1130         } else if (IN6_IS_ADDR_ULA(&addr6->sin6_addr)) {
1131             return 3;
1132         } else if (IN6_IS_ADDR_V4COMPAT(&addr6->sin6_addr) ||
1133                    IN6_IS_ADDR_SITELOCAL(&addr6->sin6_addr) ||
1134                    IN6_IS_ADDR_6BONE(&addr6->sin6_addr)) {
1135             return 1;
1136         } else {
1137             /* All other IPv6 addresses, including global unicast addresses. */
1138             return 40;
1139         }
1140     } else {
1141         return 1;
1142     }
1143 }
1144 
1145 /*
1146  * Find number of matching initial bits between the two addresses a1 and a2.
1147  */
1148 
_common_prefix_len(const struct in6_addr * a1,const struct in6_addr * a2)1149 static int _common_prefix_len(const struct in6_addr* a1, const struct in6_addr* a2) {
1150     const char* p1 = (const char*) a1;
1151     const char* p2 = (const char*) a2;
1152     unsigned i;
1153 
1154     for (i = 0; i < sizeof(*a1); ++i) {
1155         int x, j;
1156 
1157         if (p1[i] == p2[i]) {
1158             continue;
1159         }
1160         x = p1[i] ^ p2[i];
1161         for (j = 0; j < CHAR_BIT; ++j) {
1162             if (x & (1 << (CHAR_BIT - 1))) {
1163                 return i * CHAR_BIT + j;
1164             }
1165             x <<= 1;
1166         }
1167     }
1168     return sizeof(*a1) * CHAR_BIT;
1169 }
1170 
1171 /*
1172  * Compare two source/destination address pairs.
1173  * RFC 6724, section 6.
1174  */
1175 
_rfc6724_compare(const void * ptr1,const void * ptr2)1176 static int _rfc6724_compare(const void* ptr1, const void* ptr2) {
1177     const struct addrinfo_sort_elem* a1 = (const struct addrinfo_sort_elem*) ptr1;
1178     const struct addrinfo_sort_elem* a2 = (const struct addrinfo_sort_elem*) ptr2;
1179     int scope_src1, scope_dst1, scope_match1;
1180     int scope_src2, scope_dst2, scope_match2;
1181     int label_src1, label_dst1, label_match1;
1182     int label_src2, label_dst2, label_match2;
1183     int precedence1, precedence2;
1184     int prefixlen1, prefixlen2;
1185 
1186     /* Rule 1: Avoid unusable destinations. */
1187     if (a1->has_src_addr != a2->has_src_addr) {
1188         return a2->has_src_addr - a1->has_src_addr;
1189     }
1190 
1191     /* Rule 2: Prefer matching scope. */
1192     scope_src1 = _get_scope(&a1->src_addr.sa);
1193     scope_dst1 = _get_scope(a1->ai->ai_addr);
1194     scope_match1 = (scope_src1 == scope_dst1);
1195 
1196     scope_src2 = _get_scope(&a2->src_addr.sa);
1197     scope_dst2 = _get_scope(a2->ai->ai_addr);
1198     scope_match2 = (scope_src2 == scope_dst2);
1199 
1200     if (scope_match1 != scope_match2) {
1201         return scope_match2 - scope_match1;
1202     }
1203 
1204     /*
1205      * Rule 3: Avoid deprecated addresses.
1206      * TODO(sesse): We don't currently have a good way of finding this.
1207      */
1208 
1209     /*
1210      * Rule 4: Prefer home addresses.
1211      * TODO(sesse): We don't currently have a good way of finding this.
1212      */
1213 
1214     /* Rule 5: Prefer matching label. */
1215     label_src1 = _get_label(&a1->src_addr.sa);
1216     label_dst1 = _get_label(a1->ai->ai_addr);
1217     label_match1 = (label_src1 == label_dst1);
1218 
1219     label_src2 = _get_label(&a2->src_addr.sa);
1220     label_dst2 = _get_label(a2->ai->ai_addr);
1221     label_match2 = (label_src2 == label_dst2);
1222 
1223     if (label_match1 != label_match2) {
1224         return label_match2 - label_match1;
1225     }
1226 
1227     /* Rule 6: Prefer higher precedence. */
1228     precedence1 = _get_precedence(a1->ai->ai_addr);
1229     precedence2 = _get_precedence(a2->ai->ai_addr);
1230     if (precedence1 != precedence2) {
1231         return precedence2 - precedence1;
1232     }
1233 
1234     /*
1235      * Rule 7: Prefer native transport.
1236      * TODO(sesse): We don't currently have a good way of finding this.
1237      */
1238 
1239     /* Rule 8: Prefer smaller scope. */
1240     if (scope_dst1 != scope_dst2) {
1241         return scope_dst1 - scope_dst2;
1242     }
1243 
1244     /*
1245      * Rule 9: Use longest matching prefix.
1246      * We implement this for IPv6 only, as the rules in RFC 6724 don't seem
1247      * to work very well directly applied to IPv4. (glibc uses information from
1248      * the routing table for a custom IPv4 implementation here.)
1249      */
1250     if (a1->has_src_addr && a1->ai->ai_addr->sa_family == AF_INET6 && a2->has_src_addr &&
1251         a2->ai->ai_addr->sa_family == AF_INET6) {
1252         const struct sockaddr_in6* a1_src = &a1->src_addr.sin6;
1253         const struct sockaddr_in6* a1_dst = (const struct sockaddr_in6*) a1->ai->ai_addr;
1254         const struct sockaddr_in6* a2_src = &a2->src_addr.sin6;
1255         const struct sockaddr_in6* a2_dst = (const struct sockaddr_in6*) a2->ai->ai_addr;
1256         prefixlen1 = _common_prefix_len(&a1_src->sin6_addr, &a1_dst->sin6_addr);
1257         prefixlen2 = _common_prefix_len(&a2_src->sin6_addr, &a2_dst->sin6_addr);
1258         if (prefixlen1 != prefixlen2) {
1259             return prefixlen2 - prefixlen1;
1260         }
1261     }
1262 
1263     /*
1264      * Rule 10: Leave the order unchanged.
1265      * We need this since qsort() is not necessarily stable.
1266      */
1267     return a1->original_order - a2->original_order;
1268 }
1269 
1270 /*
1271  * Find the source address that will be used if trying to connect to the given
1272  * address. src_addr must be large enough to hold a struct sockaddr_in6.
1273  *
1274  * Returns 1 if a source address was found, 0 if the address is unreachable,
1275  * and -1 if a fatal error occurred. If 0 or -1, the contents of src_addr are
1276  * undefined.
1277  */
1278 
_find_src_addr(const struct sockaddr * addr,struct sockaddr * src_addr,unsigned mark,uid_t uid)1279 static int _find_src_addr(const struct sockaddr* addr, struct sockaddr* src_addr, unsigned mark,
1280                           uid_t uid) {
1281     int sock;
1282     int ret;
1283     socklen_t len;
1284 
1285     switch (addr->sa_family) {
1286         case AF_INET:
1287             len = sizeof(struct sockaddr_in);
1288             break;
1289         case AF_INET6:
1290             len = sizeof(struct sockaddr_in6);
1291             break;
1292         default:
1293             /* No known usable source address for non-INET families. */
1294             return 0;
1295     }
1296 
1297     sock = socket(addr->sa_family, SOCK_DGRAM | SOCK_CLOEXEC, IPPROTO_UDP);
1298     if (sock == -1) {
1299         if (errno == EAFNOSUPPORT) {
1300             return 0;
1301         } else {
1302             return -1;
1303         }
1304     }
1305     if (mark != MARK_UNSET && setsockopt(sock, SOL_SOCKET, SO_MARK, &mark, sizeof(mark)) < 0) {
1306         close(sock);
1307         return 0;
1308     }
1309     if (uid > 0 && uid != NET_CONTEXT_INVALID_UID && fchown(sock, uid, (gid_t) -1) < 0) {
1310         close(sock);
1311         return 0;
1312     }
1313     do {
1314         ret = connect(sock, addr, len);
1315     } while (ret == -1 && errno == EINTR);
1316 
1317     if (ret == -1) {
1318         close(sock);
1319         return 0;
1320     }
1321 
1322     if (src_addr && getsockname(sock, src_addr, &len) == -1) {
1323         close(sock);
1324         return -1;
1325     }
1326     close(sock);
1327     return 1;
1328 }
1329 
1330 /*
1331  * Sort the linked list starting at sentinel->ai_next in RFC6724 order.
1332  * Will leave the list unchanged if an error occurs.
1333  */
1334 
_rfc6724_sort(struct addrinfo * list_sentinel,unsigned mark,uid_t uid)1335 static void _rfc6724_sort(struct addrinfo* list_sentinel, unsigned mark, uid_t uid) {
1336     struct addrinfo* cur;
1337     int nelem = 0, i;
1338     struct addrinfo_sort_elem* elems;
1339 
1340     cur = list_sentinel->ai_next;
1341     while (cur) {
1342         ++nelem;
1343         cur = cur->ai_next;
1344     }
1345 
1346     elems = (struct addrinfo_sort_elem*) malloc(nelem * sizeof(struct addrinfo_sort_elem));
1347     if (elems == NULL) {
1348         goto error;
1349     }
1350 
1351     /*
1352      * Convert the linked list to an array that also contains the candidate
1353      * source address for each destination address.
1354      */
1355     for (i = 0, cur = list_sentinel->ai_next; i < nelem; ++i, cur = cur->ai_next) {
1356         int has_src_addr;
1357         assert(cur != NULL);
1358         elems[i].ai = cur;
1359         elems[i].original_order = i;
1360 
1361         has_src_addr = _find_src_addr(cur->ai_addr, &elems[i].src_addr.sa, mark, uid);
1362         if (has_src_addr == -1) {
1363             goto error;
1364         }
1365         elems[i].has_src_addr = has_src_addr;
1366     }
1367 
1368     /* Sort the addresses, and rearrange the linked list so it matches the sorted order. */
1369     qsort((void*) elems, nelem, sizeof(struct addrinfo_sort_elem), _rfc6724_compare);
1370 
1371     list_sentinel->ai_next = elems[0].ai;
1372     for (i = 0; i < nelem - 1; ++i) {
1373         elems[i].ai->ai_next = elems[i + 1].ai;
1374     }
1375     elems[nelem - 1].ai->ai_next = NULL;
1376 
1377 error:
1378     free(elems);
1379 }
1380 
dns_getaddrinfo(const char * name,const addrinfo * pai,const android_net_context * netcontext,addrinfo ** rv)1381 static int dns_getaddrinfo(const char* name, const addrinfo* pai,
1382                            const android_net_context* netcontext, addrinfo** rv) {
1383     res_target q = {};
1384     res_target q2 = {};
1385 
1386     auto buf = std::make_unique<querybuf>();
1387     auto buf2 = std::make_unique<querybuf>();
1388 
1389     switch (pai->ai_family) {
1390         case AF_UNSPEC: {
1391             /* prefer IPv6 */
1392             q.name = name;
1393             q.qclass = C_IN;
1394             q.answer = buf->buf;
1395             q.anslen = sizeof(buf->buf);
1396             int query_ipv6 = 1, query_ipv4 = 1;
1397             if (pai->ai_flags & AI_ADDRCONFIG) {
1398                 query_ipv6 = have_ipv6(netcontext->app_mark, netcontext->uid);
1399                 query_ipv4 = have_ipv4(netcontext->app_mark, netcontext->uid);
1400             }
1401             if (query_ipv6) {
1402                 q.qtype = T_AAAA;
1403                 if (query_ipv4) {
1404                     q.next = &q2;
1405                     q2.name = name;
1406                     q2.qclass = C_IN;
1407                     q2.qtype = T_A;
1408                     q2.answer = buf2->buf;
1409                     q2.anslen = sizeof(buf2->buf);
1410                 }
1411             } else if (query_ipv4) {
1412                 q.qtype = T_A;
1413             } else {
1414                 return EAI_NODATA;
1415             }
1416             break;
1417         }
1418         case AF_INET:
1419             q.name = name;
1420             q.qclass = C_IN;
1421             q.qtype = T_A;
1422             q.answer = buf->buf;
1423             q.anslen = sizeof(buf->buf);
1424             break;
1425         case AF_INET6:
1426             q.name = name;
1427             q.qclass = C_IN;
1428             q.qtype = T_AAAA;
1429             q.answer = buf->buf;
1430             q.anslen = sizeof(buf->buf);
1431             break;
1432         default:
1433             return EAI_FAMILY;
1434     }
1435 
1436     res_state res = res_get_state();
1437     if (!res) return EAI_MEMORY;
1438 
1439     /* this just sets our netid val in the thread private data so we don't have to
1440      * modify the api's all the way down to res_send.c's res_nsend.  We could
1441      * fully populate the thread private data here, but if we get down there
1442      * and have a cache hit that would be wasted, so we do the rest there on miss
1443      */
1444     res_setnetcontext(res, netcontext);
1445 
1446     int he;
1447     if (res_searchN(name, &q, res, &he) < 0) {
1448         // Return h_errno (he) to catch more detailed errors rather than EAI_NODATA.
1449         // Note that res_searchN() doesn't set the pair NETDB_INTERNAL and errno.
1450         // See also herrnoToAiErrno().
1451         return herrnoToAiErrno(he);
1452     }
1453 
1454     addrinfo sentinel = {};
1455     addrinfo* cur = &sentinel;
1456     addrinfo* ai = getanswer(buf.get(), q.n, q.name, q.qtype, pai, &he);
1457     if (ai) {
1458         cur->ai_next = ai;
1459         while (cur && cur->ai_next) cur = cur->ai_next;
1460     }
1461     if (q.next) {
1462         ai = getanswer(buf2.get(), q2.n, q2.name, q2.qtype, pai, &he);
1463         if (ai) cur->ai_next = ai;
1464     }
1465     if (sentinel.ai_next == NULL) {
1466         // Note that getanswer() doesn't set the pair NETDB_INTERNAL and errno.
1467         // See also herrnoToAiErrno().
1468         return herrnoToAiErrno(he);
1469     }
1470 
1471     _rfc6724_sort(&sentinel, netcontext->app_mark, netcontext->uid);
1472 
1473     *rv = sentinel.ai_next;
1474     return 0;
1475 }
1476 
_sethtent(FILE ** hostf)1477 static void _sethtent(FILE** hostf) {
1478     if (!*hostf)
1479         *hostf = fopen(_PATH_HOSTS, "re");
1480     else
1481         rewind(*hostf);
1482 }
1483 
_endhtent(FILE ** hostf)1484 static void _endhtent(FILE** hostf) {
1485     if (*hostf) {
1486         (void) fclose(*hostf);
1487         *hostf = NULL;
1488     }
1489 }
1490 
_gethtent(FILE ** hostf,const char * name,const struct addrinfo * pai)1491 static struct addrinfo* _gethtent(FILE** hostf, const char* name, const struct addrinfo* pai) {
1492     char* p;
1493     char *cp, *tname, *cname;
1494     struct addrinfo *res0, *res;
1495     int error;
1496     const char* addr;
1497     char hostbuf[8 * 1024];
1498 
1499     assert(name != NULL);
1500     assert(pai != NULL);
1501 
1502     if (!*hostf && !(*hostf = fopen(_PATH_HOSTS, "re"))) return (NULL);
1503 again:
1504     if (!(p = fgets(hostbuf, sizeof hostbuf, *hostf))) return (NULL);
1505     if (*p == '#') goto again;
1506     if (!(cp = strpbrk(p, "#\n"))) goto again;
1507     *cp = '\0';
1508     if (!(cp = strpbrk(p, " \t"))) goto again;
1509     *cp++ = '\0';
1510     addr = p;
1511     /* if this is not something we're looking for, skip it. */
1512     cname = NULL;
1513     while (cp && *cp) {
1514         if (*cp == ' ' || *cp == '\t') {
1515             cp++;
1516             continue;
1517         }
1518         if (!cname) cname = cp;
1519         tname = cp;
1520         if ((cp = strpbrk(cp, " \t")) != NULL) *cp++ = '\0';
1521         if (strcasecmp(name, tname) == 0) goto found;
1522     }
1523     goto again;
1524 
1525 found:
1526     error = getaddrinfo_numeric(addr, nullptr, *pai, &res0);
1527     if (error) goto again;
1528     for (res = res0; res; res = res->ai_next) {
1529         /* cover it up */
1530         res->ai_flags = pai->ai_flags;
1531 
1532         if (pai->ai_flags & AI_CANONNAME) {
1533             if (get_canonname(pai, res, cname) != 0) {
1534                 freeaddrinfo(res0);
1535                 goto again;
1536             }
1537         }
1538     }
1539     return res0;
1540 }
1541 
files_getaddrinfo(const char * name,const addrinfo * pai,addrinfo ** res)1542 static bool files_getaddrinfo(const char* name, const addrinfo* pai, addrinfo** res) {
1543     struct addrinfo sentinel = {};
1544     struct addrinfo *p, *cur;
1545     FILE* hostf = NULL;
1546 
1547     cur = &sentinel;
1548 
1549     _sethtent(&hostf);
1550     while ((p = _gethtent(&hostf, name, pai)) != NULL) {
1551         cur->ai_next = p;
1552         while (cur && cur->ai_next) cur = cur->ai_next;
1553     }
1554     _endhtent(&hostf);
1555 
1556     *res = sentinel.ai_next;
1557     return sentinel.ai_next != NULL;
1558 }
1559 
1560 /* resolver logic */
1561 
1562 /*
1563  * Formulate a normal query, send, and await answer.
1564  * Returned answer is placed in supplied buffer "answer".
1565  * Perform preliminary check of answer, returning success only
1566  * if no error is indicated and the answer count is nonzero.
1567  * Return the size of the response on success, -1 on error.
1568  * Error number is left in *herrno.
1569  *
1570  * Caller must parse answer and determine whether it answers the question.
1571  */
res_queryN(const char * name,res_target * target,res_state res,int * herrno)1572 static int res_queryN(const char* name, res_target* target, res_state res, int* herrno) {
1573     u_char buf[MAXPACKET];
1574     HEADER* hp;
1575     int n;
1576     struct res_target* t;
1577     int rcode;
1578     int ancount;
1579 
1580     assert(name != NULL);
1581     /* XXX: target may be NULL??? */
1582 
1583     rcode = NOERROR;
1584     ancount = 0;
1585 
1586     for (t = target; t; t = t->next) {
1587         u_char* answer;
1588         int anslen;
1589 
1590         hp = (HEADER*) (void*) t->answer;
1591         bool retried = false;
1592     again:
1593         hp->rcode = NOERROR; /* default */
1594 
1595         /* make it easier... */
1596         int cl = t->qclass;
1597         int type = t->qtype;
1598         answer = t->answer;
1599         anslen = t->anslen;
1600 
1601         LOG(DEBUG) << __func__ << ": (" << cl << ", " << type << ")";
1602 
1603         n = res_nmkquery(res, QUERY, name, cl, type, NULL, 0, NULL, buf, sizeof(buf));
1604         if (n > 0 && (res->options & (RES_USE_EDNS0 | RES_USE_DNSSEC)) != 0 && !retried)
1605             n = res_nopt(res, n, buf, sizeof(buf), anslen);
1606         if (n <= 0) {
1607             LOG(ERROR) << __func__ << ": res_nmkquery failed";
1608             *herrno = NO_RECOVERY;
1609             return n;
1610         }
1611 
1612         n = res_nsend(res, buf, n, answer, anslen, &rcode, 0);
1613         if (n < 0 || hp->rcode != NOERROR || ntohs(hp->ancount) == 0) {
1614             // Record rcode from DNS response header only if no timeout.
1615             // Keep rcode timeout for reporting later if any.
1616             if (rcode != RCODE_TIMEOUT) rcode = hp->rcode; /* record most recent error */
1617             /* if the query choked with EDNS0, retry without EDNS0 */
1618             if ((res->options & (RES_USE_EDNS0 | RES_USE_DNSSEC)) != 0 &&
1619                 (res->_flags & RES_F_EDNS0ERR) && !retried) {
1620                 LOG(DEBUG) << __func__ << ": retry without EDNS0";
1621                 retried = true;
1622                 goto again;
1623             }
1624             LOG(DEBUG) << __func__ << ": rcode=" << hp->rcode << ", ancount=" << ntohs(hp->ancount);
1625             continue;
1626         }
1627 
1628         ancount += ntohs(hp->ancount);
1629 
1630         t->n = n;
1631     }
1632 
1633     if (ancount == 0) {
1634         switch (rcode) {
1635             // Not defined in RFC.
1636             case RCODE_TIMEOUT:
1637                 // DNS metrics monitors DNS query timeout.
1638                 *herrno = NETD_RESOLV_H_ERRNO_EXT_TIMEOUT;  // extended h_errno.
1639                 break;
1640             // Defined in RFC 1035 section 4.1.1.
1641             case NXDOMAIN:
1642                 *herrno = HOST_NOT_FOUND;
1643                 break;
1644             case SERVFAIL:
1645                 *herrno = TRY_AGAIN;
1646                 break;
1647             case NOERROR:
1648                 *herrno = NO_DATA;
1649                 break;
1650             case FORMERR:
1651             case NOTIMP:
1652             case REFUSED:
1653             default:
1654                 *herrno = NO_RECOVERY;
1655                 break;
1656         }
1657         return -1;
1658     }
1659     return ancount;
1660 }
1661 
1662 /*
1663  * Formulate a normal query, send, and retrieve answer in supplied buffer.
1664  * Return the size of the response on success, -1 on error.
1665  * If enabled, implement search rules until answer or unrecoverable failure
1666  * is detected.  Error code, if any, is left in *herrno.
1667  */
res_searchN(const char * name,res_target * target,res_state res,int * herrno)1668 static int res_searchN(const char* name, res_target* target, res_state res, int* herrno) {
1669     const char *cp, *const *domain;
1670     HEADER* hp;
1671     u_int dots;
1672     int trailing_dot, ret, saved_herrno;
1673     int got_nodata = 0, got_servfail = 0, tried_as_is = 0;
1674 
1675     assert(name != NULL);
1676     assert(target != NULL);
1677 
1678     hp = (HEADER*) (void*) target->answer; /*XXX*/
1679 
1680     errno = 0;
1681     *herrno = HOST_NOT_FOUND; /* default, if we never query */
1682     dots = 0;
1683     for (cp = name; *cp; cp++) dots += (*cp == '.');
1684     trailing_dot = 0;
1685     if (cp > name && *--cp == '.') trailing_dot++;
1686 
1687     /*
1688      * If there are dots in the name already, let's just give it a try
1689      * 'as is'.  The threshold can be set with the "ndots" option.
1690      */
1691     saved_herrno = -1;
1692     if (dots >= res->ndots) {
1693         ret = res_querydomainN(name, NULL, target, res, herrno);
1694         if (ret > 0) return (ret);
1695         saved_herrno = *herrno;
1696         tried_as_is++;
1697     }
1698 
1699     /*
1700      * We do at least one level of search if
1701      *	- there is no dot and RES_DEFNAME is set, or
1702      *	- there is at least one dot, there is no trailing dot,
1703      *	  and RES_DNSRCH is set.
1704      */
1705     if ((!dots && (res->options & RES_DEFNAMES)) ||
1706         (dots && !trailing_dot && (res->options & RES_DNSRCH))) {
1707         int done = 0;
1708 
1709         /* Unfortunately we need to set stuff up before
1710          * the domain stuff is tried.  Will have a better
1711          * fix after thread pools are used.
1712          */
1713         _resolv_populate_res_for_net(res);
1714 
1715         for (domain = (const char* const*) res->dnsrch; *domain && !done; domain++) {
1716             ret = res_querydomainN(name, *domain, target, res, herrno);
1717             if (ret > 0) return ret;
1718 
1719             /*
1720              * If no server present, give up.
1721              * If name isn't found in this domain,
1722              * keep trying higher domains in the search list
1723              * (if that's enabled).
1724              * On a NO_DATA error, keep trying, otherwise
1725              * a wildcard entry of another type could keep us
1726              * from finding this entry higher in the domain.
1727              * If we get some other error (negative answer or
1728              * server failure), then stop searching up,
1729              * but try the input name below in case it's
1730              * fully-qualified.
1731              */
1732             if (errno == ECONNREFUSED) {
1733                 *herrno = TRY_AGAIN;
1734                 return -1;
1735             }
1736 
1737             switch (*herrno) {
1738                 case NO_DATA:
1739                     got_nodata++;
1740                     [[fallthrough]];
1741                 case HOST_NOT_FOUND:
1742                     /* keep trying */
1743                     break;
1744                 case TRY_AGAIN:
1745                     if (hp->rcode == SERVFAIL) {
1746                         /* try next search element, if any */
1747                         got_servfail++;
1748                         break;
1749                     }
1750                     [[fallthrough]];
1751                 default:
1752                     /* anything else implies that we're done */
1753                     done++;
1754             }
1755             /*
1756              * if we got here for some reason other than DNSRCH,
1757              * we only wanted one iteration of the loop, so stop.
1758              */
1759             if (!(res->options & RES_DNSRCH)) done++;
1760         }
1761     }
1762 
1763     /*
1764      * if we have not already tried the name "as is", do that now.
1765      * note that we do this regardless of how many dots were in the
1766      * name or whether it ends with a dot.
1767      */
1768     if (!tried_as_is) {
1769         ret = res_querydomainN(name, NULL, target, res, herrno);
1770         if (ret > 0) return ret;
1771     }
1772 
1773     /*
1774      * if we got here, we didn't satisfy the search.
1775      * if we did an initial full query, return that query's h_errno
1776      * (note that we wouldn't be here if that query had succeeded).
1777      * else if we ever got a nodata, send that back as the reason.
1778      * else send back meaningless h_errno, that being the one from
1779      * the last DNSRCH we did.
1780      */
1781     if (saved_herrno != -1)
1782         *herrno = saved_herrno;
1783     else if (got_nodata)
1784         *herrno = NO_DATA;
1785     else if (got_servfail)
1786         *herrno = TRY_AGAIN;
1787     return -1;
1788 }
1789 
1790 /*
1791  * Perform a call on res_query on the concatenation of name and domain,
1792  * removing a trailing dot from name if domain is NULL.
1793  */
res_querydomainN(const char * name,const char * domain,res_target * target,res_state res,int * herrno)1794 static int res_querydomainN(const char* name, const char* domain, res_target* target, res_state res,
1795                             int* herrno) {
1796     char nbuf[MAXDNAME];
1797     const char* longname = nbuf;
1798     size_t n, d;
1799 
1800     assert(name != NULL);
1801 
1802     if (domain == NULL) {
1803         // Check for trailing '.'; copy without '.' if present.
1804         n = strlen(name);
1805         if (n + 1 > sizeof(nbuf)) {
1806             *herrno = NO_RECOVERY;
1807             return -1;
1808         }
1809         if (n > 0 && name[--n] == '.') {
1810             strncpy(nbuf, name, n);
1811             nbuf[n] = '\0';
1812         } else
1813             longname = name;
1814     } else {
1815         n = strlen(name);
1816         d = strlen(domain);
1817         if (n + 1 + d + 1 > sizeof(nbuf)) {
1818             *herrno = NO_RECOVERY;
1819             return -1;
1820         }
1821         snprintf(nbuf, sizeof(nbuf), "%s.%s", name, domain);
1822     }
1823     return res_queryN(longname, target, res, herrno);
1824 }
1825