/usr/src/sbin/unwind/frontend.c

Bug Summary

File:	src/sbin/unwind/frontend.c
Warning:	line 1749, column 20 Use of memory after it is freed
Annotated Source Code

Press '?' to see keyboard shortcuts
Show analyzer invocation
clang -cc1 -cc1 -triple amd64-unknown-openbsd7.0 -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name frontend.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -fno-rounding-math -mconstructor-aliases -munwind-tables -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/sbin/unwind/obj -resource-dir /usr/local/lib/clang/13.0.0 -I /usr/src/sbin/unwind -I /usr/src/sbin/unwind -I /usr/src/sbin/unwind/libunbound/libunbound -I /usr/src/sbin/unwind/libunbound -internal-isystem /usr/local/lib/clang/13.0.0/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/sbin/unwind/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/vmm/scan-build/2022-01-12-194120-40624-1 -x c /usr/src/sbin/unwind/frontend.c
1/*	$OpenBSD: frontend.c,v 1.69 2021/11/16 16:45:23 kn Exp $	*/

3/*
* Copyright (c) 2018 Florian Obser <florian@openbsd.org>
* Copyright (c) 2005 Claudio Jeker <claudio@openbsd.org>
* Copyright (c) 2004 Esben Norby <norby@openbsd.org>
* Copyright (c) 2003, 2004 Henning Brauer <henning@openbsd.org>
*
* Permission to use, copy, modify, and distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/

22#include <sys/types.h>
23#include <sys/queue.h>
24#include <sys/socket.h>
25#include <sys/syslog.h>
26#include <sys/tree.h>
27#include <sys/uio.h>

29#include <netinet/in.h>
30#include <net/if.h>
31#include <net/route.h>

33#include <errno(*__errno()).h>
34#include <event.h>
35#include <ifaddrs.h>
36#include <imsg.h>
37#include <netdb.h>
38#include <pwd.h>
39#include <signal.h>
40#include <stdint.h>
41#include <stdio.h>
42#include <stdlib.h>
43#include <string.h>
44#include <time.h>
45#include <unistd.h>

47#include "libunbound/config.h"
48#include "libunbound/sldns/pkthdr.h"
49#include "libunbound/sldns/sbuffer.h"
50#include "libunbound/sldns/str2wire.h"
51#include "libunbound/sldns/wire2str.h"
52#include "libunbound/util/alloc.h"
53#include "libunbound/util/net_help.h"
54#include "libunbound/util/regional.h"
55#include "libunbound/util/data/dname.h"
56#include "libunbound/util/data/msgencode.h"
57#include "libunbound/util/data/msgparse.h"
58#include "libunbound/util/data/msgreply.h"

60#include "log.h"
61#include "unwind.h"
62#include "frontend.h"
63#include "control.h"
64#include "dns64_synth.h"

66#define	ROUTE_SOCKET_BUF_SIZE16384   16384

68/*
* size of a resource record with name a two octed pointer to qname
* 2 octets pointer to qname
* 2 octets TYPE
* 2 octets CLASS
* 4 octets TTL
* 2 octets RDLENGTH
*/
76#define COMPRESSED_RR_SIZE12	12
77#define MINIMIZE_ANSWER1		1

79#define FD_RESERVE5		5
80#define TCP_TIMEOUT15		15
81#define DEFAULT_TCP_SIZE512	512

83struct udp_ev {
struct event		 ev;
uint8_t			 query[65536];
struct msghdr		 rcvmhdr;
struct iovec		 rcviov[1];
struct sockaddr_storage	 from;
89} udp4ev, udp6ev;

91struct tcp_accept_ev {
struct event		 ev;
struct event		 pause;
94} tcp4ev, tcp6ev;

96struct pending_query {
TAILQ_ENTRY(pending_query)struct { struct pending_query *tqe_next; struct pending_query
 **tqe_prev; }	 entry;
struct sockaddr_storage		 from;
struct sldns_buffer		*qbuf;
struct sldns_buffer		*abuf;
struct regional			*region;
struct query_info		 qinfo;
struct msg_parse		*qmsg;
struct edns_data		 edns;
struct event			 ev;		/* for tcp */
struct event			 resp_ev;	/* for tcp */
struct event			 tmo_ev;	/* for tcp */
uint64_t			 imsg_id;
int				 fd;
int				 tcp;
int				 dns64_synthesize;
112};

114TAILQ_HEAD(, pending_query)struct { struct pending_query *tqh_first; struct pending_query
 **tqh_last; }	 pending_queries;

116struct bl_node {
RB_ENTRY(bl_node)struct { struct bl_node *rbe_left; struct bl_node *rbe_right;
 struct bl_node *rbe_parent; int rbe_color; }	 entry;
char			*domain;
119};

121__dead__attribute__((__noreturn__)) void		 frontend_shutdown(void);
122void			 frontend_sig_handler(int, short, void *);
123void			 frontend_startup(void);
124void			 udp_receive(int, short, void *);
125void			 handle_query(struct pending_query *);
126void			 free_pending_query(struct pending_query *);
127void			 tcp_accept(int, short, void *);
128int			 accept_reserve(int, struct sockaddr *, socklen_t *);
129void			 accept_paused(int, short, void *);
130void			 tcp_request(int, short, void *);
131void			 tcp_response(int, short, void *);
132void			 tcp_timeout(int, short, void *);
133int			 check_query(sldns_buffer*);
134void			 noerror_answer(struct pending_query *);
135void			 synthesize_dns64_answer(struct pending_query *);
136void			 resend_dns64_query(struct pending_query *);
137void			 chaos_answer(struct pending_query *);
138void			 error_answer(struct pending_query *, int rcode);
139void			 send_answer(struct pending_query *);
140void			 route_receive(int, short, void *);
141void			 handle_route_message(struct rt_msghdr *,
	     struct sockaddr **);
143void			 get_rtaddrs(int, struct sockaddr *,
	     struct sockaddr **);
145void			 rtmget_default(void);
146struct pending_query	*find_pending_query(uint64_t);
147void			 parse_trust_anchor(struct trust_anchor_head *, int);
148void			 send_trust_anchors(struct trust_anchor_head *);
149void			 write_trust_anchors(struct trust_anchor_head *, int);
150void			 parse_blocklist(int);
151int			 bl_cmp(struct bl_node *, struct bl_node *);
152void			 free_bl(void);
153int			 pending_query_cnt(void);
154void			 check_available_af(void);

156struct uw_conf		*frontend_conf;
157static struct imsgev	*iev_main;
158static struct imsgev	*iev_resolver;
159struct event		 ev_route;
160int			 udp4sock = -1, udp6sock = -1;
161int			 tcp4sock = -1, tcp6sock = -1;
162int			 ta_fd = -1;

164static struct trust_anchor_head	 trust_anchors, new_trust_anchors;

166RB_HEAD(bl_tree, bl_node)struct bl_tree { struct bl_node *rbh_root; }	 bl_head = RB_INITIALIZER(&bl_head){ ((void*)0) };
167RB_PROTOTYPE(bl_tree, bl_node, entry, bl_cmp)void bl_tree_RB_INSERT_COLOR(struct bl_tree *, struct bl_node
 *); void bl_tree_RB_REMOVE_COLOR(struct bl_tree *, struct bl_node
 *, struct bl_node *); struct bl_node *bl_tree_RB_REMOVE(struct
 bl_tree *, struct bl_node *); struct bl_node *bl_tree_RB_INSERT
(struct bl_tree *, struct bl_node *); struct bl_node *bl_tree_RB_FIND
(struct bl_tree *, struct bl_node *); struct bl_node *bl_tree_RB_NFIND
(struct bl_tree *, struct bl_node *); struct bl_node *bl_tree_RB_NEXT
(struct bl_node *); struct bl_node *bl_tree_RB_PREV(struct bl_node
 *); struct bl_node *bl_tree_RB_MINMAX(struct bl_tree *, int)
;
168RB_GENERATE(bl_tree, bl_node, entry, bl_cmp)void bl_tree_RB_INSERT_COLOR(struct bl_tree *head, struct bl_node
 *elm) { struct bl_node *parent, *gparent, *tmp; while ((parent
 = (elm)->entry.rbe_parent) && (parent)->entry.
rbe_color == 1) { gparent = (parent)->entry.rbe_parent; if
 (parent == (gparent)->entry.rbe_left) { tmp = (gparent)->
entry.rbe_right; if (tmp && (tmp)->entry.rbe_color
 == 1) { (tmp)->entry.rbe_color = 0; do { (parent)->entry
.rbe_color = 0; (gparent)->entry.rbe_color = 1; } while (0
); elm = gparent; continue; } if ((parent)->entry.rbe_right
 == elm) { do { (tmp) = (parent)->entry.rbe_right; if (((parent
)->entry.rbe_right = (tmp)->entry.rbe_left)) { ((tmp)->
entry.rbe_left)->entry.rbe_parent = (parent); } do {} while
 (0); if (((tmp)->entry.rbe_parent = (parent)->entry.rbe_parent
)) { if ((parent) == ((parent)->entry.rbe_parent)->entry
.rbe_left) ((parent)->entry.rbe_parent)->entry.rbe_left
 = (tmp); else ((parent)->entry.rbe_parent)->entry.rbe_right
 = (tmp); } else (head)->rbh_root = (tmp); (tmp)->entry
.rbe_left = (parent); (parent)->entry.rbe_parent = (tmp); do
 {} while (0); if (((tmp)->entry.rbe_parent)) do {} while (
0); } while (0); tmp = parent; parent = elm; elm = tmp; } do {
 (parent)->entry.rbe_color = 0; (gparent)->entry.rbe_color
 = 1; } while (0); do { (tmp) = (gparent)->entry.rbe_left;
 if (((gparent)->entry.rbe_left = (tmp)->entry.rbe_right
)) { ((tmp)->entry.rbe_right)->entry.rbe_parent = (gparent
); } do {} while (0); if (((tmp)->entry.rbe_parent = (gparent
)->entry.rbe_parent)) { if ((gparent) == ((gparent)->entry
.rbe_parent)->entry.rbe_left) ((gparent)->entry.rbe_parent
)->entry.rbe_left = (tmp); else ((gparent)->entry.rbe_parent
)->entry.rbe_right = (tmp); } else (head)->rbh_root = (
tmp); (tmp)->entry.rbe_right = (gparent); (gparent)->entry
.rbe_parent = (tmp); do {} while (0); if (((tmp)->entry.rbe_parent
)) do {} while (0); } while (0); } else { tmp = (gparent)->
entry.rbe_left; if (tmp && (tmp)->entry.rbe_color ==
 1) { (tmp)->entry.rbe_color = 0; do { (parent)->entry.
rbe_color = 0; (gparent)->entry.rbe_color = 1; } while (0)
; elm = gparent; continue; } if ((parent)->entry.rbe_left ==
 elm) { do { (tmp) = (parent)->entry.rbe_left; if (((parent
)->entry.rbe_left = (tmp)->entry.rbe_right)) { ((tmp)->
entry.rbe_right)->entry.rbe_parent = (parent); } do {} while
 (0); if (((tmp)->entry.rbe_parent = (parent)->entry.rbe_parent
)) { if ((parent) == ((parent)->entry.rbe_parent)->entry
.rbe_left) ((parent)->entry.rbe_parent)->entry.rbe_left
 = (tmp); else ((parent)->entry.rbe_parent)->entry.rbe_right
 = (tmp); } else (head)->rbh_root = (tmp); (tmp)->entry
.rbe_right = (parent); (parent)->entry.rbe_parent = (tmp);
 do {} while (0); if (((tmp)->entry.rbe_parent)) do {} while
 (0); } while (0); tmp = parent; parent = elm; elm = tmp; } do
 { (parent)->entry.rbe_color = 0; (gparent)->entry.rbe_color
 = 1; } while (0); do { (tmp) = (gparent)->entry.rbe_right
; if (((gparent)->entry.rbe_right = (tmp)->entry.rbe_left
)) { ((tmp)->entry.rbe_left)->entry.rbe_parent = (gparent
); } do {} while (0); if (((tmp)->entry.rbe_parent = (gparent
)->entry.rbe_parent)) { if ((gparent) == ((gparent)->entry
.rbe_parent)->entry.rbe_left) ((gparent)->entry.rbe_parent
)->entry.rbe_left = (tmp); else ((gparent)->entry.rbe_parent
)->entry.rbe_right = (tmp); } else (head)->rbh_root = (
tmp); (tmp)->entry.rbe_left = (gparent); (gparent)->entry
.rbe_parent = (tmp); do {} while (0); if (((tmp)->entry.rbe_parent
)) do {} while (0); } while (0); } } (head->rbh_root)->
entry.rbe_color = 0; } void bl_tree_RB_REMOVE_COLOR(struct bl_tree
 *head, struct bl_node *parent, struct bl_node *elm) { struct
 bl_node *tmp; while ((elm == ((void*)0) || (elm)->entry.rbe_color
 == 0) && elm != (head)->rbh_root) { if ((parent)->
entry.rbe_left == elm) { tmp = (parent)->entry.rbe_right; if
 ((tmp)->entry.rbe_color == 1) { do { (tmp)->entry.rbe_color
 = 0; (parent)->entry.rbe_color = 1; } while (0); do { (tmp
) = (parent)->entry.rbe_right; if (((parent)->entry.rbe_right
 = (tmp)->entry.rbe_left)) { ((tmp)->entry.rbe_left)->
entry.rbe_parent = (parent); } do {} while (0); if (((tmp)->
entry.rbe_parent = (parent)->entry.rbe_parent)) { if ((parent
) == ((parent)->entry.rbe_parent)->entry.rbe_left) ((parent
)->entry.rbe_parent)->entry.rbe_left = (tmp); else ((parent
)->entry.rbe_parent)->entry.rbe_right = (tmp); } else (
head)->rbh_root = (tmp); (tmp)->entry.rbe_left = (parent
); (parent)->entry.rbe_parent = (tmp); do {} while (0); if
 (((tmp)->entry.rbe_parent)) do {} while (0); } while (0);
 tmp = (parent)->entry.rbe_right; } if (((tmp)->entry.rbe_left
 == ((void*)0) || ((tmp)->entry.rbe_left)->entry.rbe_color
 == 0) && ((tmp)->entry.rbe_right == ((void*)0) ||
 ((tmp)->entry.rbe_right)->entry.rbe_color == 0)) { (tmp
)->entry.rbe_color = 1; elm = parent; parent = (elm)->entry
.rbe_parent; } else { if ((tmp)->entry.rbe_right == ((void
*)0) || ((tmp)->entry.rbe_right)->entry.rbe_color == 0)
 { struct bl_node *oleft; if ((oleft = (tmp)->entry.rbe_left
)) (oleft)->entry.rbe_color = 0; (tmp)->entry.rbe_color
 = 1; do { (oleft) = (tmp)->entry.rbe_left; if (((tmp)->
entry.rbe_left = (oleft)->entry.rbe_right)) { ((oleft)->
entry.rbe_right)->entry.rbe_parent = (tmp); } do {} while (
0); if (((oleft)->entry.rbe_parent = (tmp)->entry.rbe_parent
)) { if ((tmp) == ((tmp)->entry.rbe_parent)->entry.rbe_left
) ((tmp)->entry.rbe_parent)->entry.rbe_left = (oleft); else
 ((tmp)->entry.rbe_parent)->entry.rbe_right = (oleft); }
 else (head)->rbh_root = (oleft); (oleft)->entry.rbe_right
 = (tmp); (tmp)->entry.rbe_parent = (oleft); do {} while (
0); if (((oleft)->entry.rbe_parent)) do {} while (0); } while
 (0); tmp = (parent)->entry.rbe_right; } (tmp)->entry.rbe_color
 = (parent)->entry.rbe_color; (parent)->entry.rbe_color
 = 0; if ((tmp)->entry.rbe_right) ((tmp)->entry.rbe_right
)->entry.rbe_color = 0; do { (tmp) = (parent)->entry.rbe_right
; if (((parent)->entry.rbe_right = (tmp)->entry.rbe_left
)) { ((tmp)->entry.rbe_left)->entry.rbe_parent = (parent
); } do {} while (0); if (((tmp)->entry.rbe_parent = (parent
)->entry.rbe_parent)) { if ((parent) == ((parent)->entry
.rbe_parent)->entry.rbe_left) ((parent)->entry.rbe_parent
)->entry.rbe_left = (tmp); else ((parent)->entry.rbe_parent
)->entry.rbe_right = (tmp); } else (head)->rbh_root = (
tmp); (tmp)->entry.rbe_left = (parent); (parent)->entry
.rbe_parent = (tmp); do {} while (0); if (((tmp)->entry.rbe_parent
)) do {} while (0); } while (0); elm = (head)->rbh_root; break
; } } else { tmp = (parent)->entry.rbe_left; if ((tmp)->
entry.rbe_color == 1) { do { (tmp)->entry.rbe_color = 0; (
parent)->entry.rbe_color = 1; } while (0); do { (tmp) = (parent
)->entry.rbe_left; if (((parent)->entry.rbe_left = (tmp
)->entry.rbe_right)) { ((tmp)->entry.rbe_right)->entry
.rbe_parent = (parent); } do {} while (0); if (((tmp)->entry
.rbe_parent = (parent)->entry.rbe_parent)) { if ((parent) ==
 ((parent)->entry.rbe_parent)->entry.rbe_left) ((parent
)->entry.rbe_parent)->entry.rbe_left = (tmp); else ((parent
)->entry.rbe_parent)->entry.rbe_right = (tmp); } else (
head)->rbh_root = (tmp); (tmp)->entry.rbe_right = (parent
); (parent)->entry.rbe_parent = (tmp); do {} while (0); if
 (((tmp)->entry.rbe_parent)) do {} while (0); } while (0);
 tmp = (parent)->entry.rbe_left; } if (((tmp)->entry.rbe_left
 == ((void*)0) || ((tmp)->entry.rbe_left)->entry.rbe_color
 == 0) && ((tmp)->entry.rbe_right == ((void*)0) ||
 ((tmp)->entry.rbe_right)->entry.rbe_color == 0)) { (tmp
)->entry.rbe_color = 1; elm = parent; parent = (elm)->entry
.rbe_parent; } else { if ((tmp)->entry.rbe_left == ((void*
)0) || ((tmp)->entry.rbe_left)->entry.rbe_color == 0) {
 struct bl_node *oright; if ((oright = (tmp)->entry.rbe_right
)) (oright)->entry.rbe_color = 0; (tmp)->entry.rbe_color
 = 1; do { (oright) = (tmp)->entry.rbe_right; if (((tmp)->
entry.rbe_right = (oright)->entry.rbe_left)) { ((oright)->
entry.rbe_left)->entry.rbe_parent = (tmp); } do {} while (
0); if (((oright)->entry.rbe_parent = (tmp)->entry.rbe_parent
)) { if ((tmp) == ((tmp)->entry.rbe_parent)->entry.rbe_left
) ((tmp)->entry.rbe_parent)->entry.rbe_left = (oright);
 else ((tmp)->entry.rbe_parent)->entry.rbe_right = (oright
); } else (head)->rbh_root = (oright); (oright)->entry.
rbe_left = (tmp); (tmp)->entry.rbe_parent = (oright); do {
} while (0); if (((oright)->entry.rbe_parent)) do {} while
 (0); } while (0); tmp = (parent)->entry.rbe_left; } (tmp)
->entry.rbe_color = (parent)->entry.rbe_color; (parent)
->entry.rbe_color = 0; if ((tmp)->entry.rbe_left) ((tmp
)->entry.rbe_left)->entry.rbe_color = 0; do { (tmp) = (
parent)->entry.rbe_left; if (((parent)->entry.rbe_left =
 (tmp)->entry.rbe_right)) { ((tmp)->entry.rbe_right)->
entry.rbe_parent = (parent); } do {} while (0); if (((tmp)->
entry.rbe_parent = (parent)->entry.rbe_parent)) { if ((parent
) == ((parent)->entry.rbe_parent)->entry.rbe_left) ((parent
)->entry.rbe_parent)->entry.rbe_left = (tmp); else ((parent
)->entry.rbe_parent)->entry.rbe_right = (tmp); } else (
head)->rbh_root = (tmp); (tmp)->entry.rbe_right = (parent
); (parent)->entry.rbe_parent = (tmp); do {} while (0); if
 (((tmp)->entry.rbe_parent)) do {} while (0); } while (0);
 elm = (head)->rbh_root; break; } } } if (elm) (elm)->entry
.rbe_color = 0; } struct bl_node * bl_tree_RB_REMOVE(struct bl_tree
 *head, struct bl_node *elm) { struct bl_node *child, *parent
, *old = elm; int color; if ((elm)->entry.rbe_left == ((void
*)0)) child = (elm)->entry.rbe_right; else if ((elm)->entry
.rbe_right == ((void*)0)) child = (elm)->entry.rbe_left; else
 { struct bl_node *left; elm = (elm)->entry.rbe_right; while
 ((left = (elm)->entry.rbe_left)) elm = left; child = (elm
)->entry.rbe_right; parent = (elm)->entry.rbe_parent; color
 = (elm)->entry.rbe_color; if (child) (child)->entry.rbe_parent
 = parent; if (parent) { if ((parent)->entry.rbe_left == elm
) (parent)->entry.rbe_left = child; else (parent)->entry
.rbe_right = child; do {} while (0); } else (head)->rbh_root
 = child; if ((elm)->entry.rbe_parent == old) parent = elm
; (elm)->entry = (old)->entry; if ((old)->entry.rbe_parent
) { if (((old)->entry.rbe_parent)->entry.rbe_left == old
) ((old)->entry.rbe_parent)->entry.rbe_left = elm; else
 ((old)->entry.rbe_parent)->entry.rbe_right = elm; do {
} while (0); } else (head)->rbh_root = elm; ((old)->entry
.rbe_left)->entry.rbe_parent = elm; if ((old)->entry.rbe_right
) ((old)->entry.rbe_right)->entry.rbe_parent = elm; if (
parent) { left = parent; do { do {} while (0); } while ((left
 = (left)->entry.rbe_parent)); } goto color; } parent = (elm
)->entry.rbe_parent; color = (elm)->entry.rbe_color; if
 (child) (child)->entry.rbe_parent = parent; if (parent) {
 if ((parent)->entry.rbe_left == elm) (parent)->entry.rbe_left
 = child; else (parent)->entry.rbe_right = child; do {} while
 (0); } else (head)->rbh_root = child; color: if (color ==
 0) bl_tree_RB_REMOVE_COLOR(head, parent, child); return (old
); } struct bl_node * bl_tree_RB_INSERT(struct bl_tree *head,
 struct bl_node *elm) { struct bl_node *tmp; struct bl_node *
parent = ((void*)0); int comp = 0; tmp = (head)->rbh_root;
 while (tmp) { parent = tmp; comp = (bl_cmp)(elm, parent); if
 (comp < 0) tmp = (tmp)->entry.rbe_left; else if (comp >
 0) tmp = (tmp)->entry.rbe_right; else return (tmp); } do {
 (elm)->entry.rbe_parent = parent; (elm)->entry.rbe_left
 = (elm)->entry.rbe_right = ((void*)0); (elm)->entry.rbe_color
 = 1; } while (0); if (parent != ((void*)0)) { if (comp < 0
) (parent)->entry.rbe_left = elm; else (parent)->entry.
rbe_right = elm; do {} while (0); } else (head)->rbh_root =
 elm; bl_tree_RB_INSERT_COLOR(head, elm); return (((void*)0))
; } struct bl_node * bl_tree_RB_FIND(struct bl_tree *head, struct
 bl_node *elm) { struct bl_node *tmp = (head)->rbh_root; int
 comp; while (tmp) { comp = bl_cmp(elm, tmp); if (comp < 0
) tmp = (tmp)->entry.rbe_left; else if (comp > 0) tmp =
 (tmp)->entry.rbe_right; else return (tmp); } return (((void
*)0)); } struct bl_node * bl_tree_RB_NFIND(struct bl_tree *head
, struct bl_node *elm) { struct bl_node *tmp = (head)->rbh_root
; struct bl_node *res = ((void*)0); int comp; while (tmp) { comp
 = bl_cmp(elm, tmp); if (comp < 0) { res = tmp; tmp = (tmp
)->entry.rbe_left; } else if (comp > 0) tmp = (tmp)->
entry.rbe_right; else return (tmp); } return (res); } struct bl_node
 * bl_tree_RB_NEXT(struct bl_node *elm) { if ((elm)->entry
.rbe_right) { elm = (elm)->entry.rbe_right; while ((elm)->
entry.rbe_left) elm = (elm)->entry.rbe_left; } else { if (
(elm)->entry.rbe_parent && (elm == ((elm)->entry
.rbe_parent)->entry.rbe_left)) elm = (elm)->entry.rbe_parent
; else { while ((elm)->entry.rbe_parent && (elm ==
 ((elm)->entry.rbe_parent)->entry.rbe_right)) elm = (elm
)->entry.rbe_parent; elm = (elm)->entry.rbe_parent; } }
 return (elm); } struct bl_node * bl_tree_RB_PREV(struct bl_node
 *elm) { if ((elm)->entry.rbe_left) { elm = (elm)->entry
.rbe_left; while ((elm)->entry.rbe_right) elm = (elm)->
entry.rbe_right; } else { if ((elm)->entry.rbe_parent &&
 (elm == ((elm)->entry.rbe_parent)->entry.rbe_right)) elm
 = (elm)->entry.rbe_parent; else { while ((elm)->entry.
rbe_parent && (elm == ((elm)->entry.rbe_parent)->
entry.rbe_left)) elm = (elm)->entry.rbe_parent; elm = (elm
)->entry.rbe_parent; } } return (elm); } struct bl_node * bl_tree_RB_MINMAX
(struct bl_tree *head, int val) { struct bl_node *tmp = (head
)->rbh_root; struct bl_node *parent = ((void*)0); while (tmp
) { parent = tmp; if (val < 0) tmp = (tmp)->entry.rbe_left
; else tmp = (tmp)->entry.rbe_right; } return (parent); }

170struct dns64_prefix	*dns64_prefixes;
171int			 dns64_prefix_count;

173void
174frontend_sig_handler(int sig, short event, void *bula)
175{
/*
* Normal signal handler rules don't apply because libevent
* decouples for us.
*/

switch (sig) {
case SIGINT2:
case SIGTERM15:
frontend_shutdown();
default:
fatalx("unexpected signal");
}
188}

190void
191frontend(int debug, int verbose)
192{
struct event	 ev_sigint, ev_sigterm;
struct passwd	*pw;

frontend_conf = config_new_empty();

log_init(debug, LOG_DAEMON)uw_log_init(debug, (3<<3));
log_setverbose(verbose);

if ((pw = getpwnam(UNWIND_USER"_unwind")) == NULL((void*)0))
fatal("getpwnam");

if (chroot(pw->pw_dir) == -1)
fatal("chroot");
if (chdir("/") == -1)
fatal("chdir(\"/\")");

setproctitle("%s", "frontend");
log_procinit("frontend");

if (setgroups(1, &pw->pw_gid) ||
   setresgid(pw->pw_gid, pw->pw_gid, pw->pw_gid) ||
   setresuid(pw->pw_uid, pw->pw_uid, pw->pw_uid))
fatal("can't drop privileges");

if (pledge("stdio dns unix recvfd", NULL((void*)0)) == -1)
fatal("pledge");

event_init();

/* Setup signal handler. */
signal_set(&ev_sigint, SIGINT, frontend_sig_handler, NULL)event_set(&ev_sigint, 2, 0x08|0x10, frontend_sig_handler,
 ((void*)0));
signal_set(&ev_sigterm, SIGTERM, frontend_sig_handler, NULL)event_set(&ev_sigterm, 15, 0x08|0x10, frontend_sig_handler
, ((void*)0));
signal_add(&ev_sigint, NULL)event_add(&ev_sigint, ((void*)0));
signal_add(&ev_sigterm, NULL)event_add(&ev_sigterm, ((void*)0));
signal(SIGPIPE13, SIG_IGN(void (*)(int))1);
signal(SIGHUP1, SIG_IGN(void (*)(int))1);

/* Setup pipe and event handler to the parent process. */
if (iev_main != NULL((void*)0))
fatal("iev_main");
if ((iev_main = malloc(sizeof(struct imsgev))) == NULL((void*)0))
fatal(NULL((void*)0));
imsg_init(&iev_main->ibuf, 3);
iev_main->handler = frontend_dispatch_main;
iev_main->events = EV_READ0x02;
event_set(&iev_main->ev, iev_main->ibuf.fd, iev_main->events,
   iev_main->handler, iev_main);
event_add(&iev_main->ev, NULL((void*)0));

udp4ev.rcviov[0].iov_base = (caddr_t)udp4ev.query;
udp4ev.rcviov[0].iov_len = sizeof(udp4ev.query);
udp4ev.rcvmhdr.msg_name = (caddr_t)&udp4ev.from;
udp4ev.rcvmhdr.msg_namelen = sizeof(udp4ev.from);
udp4ev.rcvmhdr.msg_iov = udp4ev.rcviov;
udp4ev.rcvmhdr.msg_iovlen = 1;

udp6ev.rcviov[0].iov_base = (caddr_t)udp6ev.query;
udp6ev.rcviov[0].iov_len = sizeof(udp6ev.query);
udp6ev.rcvmhdr.msg_name = (caddr_t)&udp6ev.from;
udp6ev.rcvmhdr.msg_namelen = sizeof(udp6ev.from);
udp6ev.rcvmhdr.msg_iov = udp6ev.rcviov;
udp6ev.rcvmhdr.msg_iovlen = 1;

TAILQ_INIT(&pending_queries)do { (&pending_queries)->tqh_first = ((void*)0); (&
pending_queries)->tqh_last = &(&pending_queries)->
tqh_first; } while (0);

TAILQ_INIT(&trust_anchors)do { (&trust_anchors)->tqh_first = ((void*)0); (&trust_anchors
)->tqh_last = &(&trust_anchors)->tqh_first; } while
 (0);
TAILQ_INIT(&new_trust_anchors)do { (&new_trust_anchors)->tqh_first = ((void*)0); (&
new_trust_anchors)->tqh_last = &(&new_trust_anchors
)->tqh_first; } while (0);

add_new_ta(&trust_anchors, KSK2017".	172800	IN	DNSKEY	257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU=");

event_dispatch();

frontend_shutdown();
266}

268__dead__attribute__((__noreturn__)) void
269frontend_shutdown(void)
270{
/* Close pipes. */
msgbuf_write(&iev_resolver->ibuf.w);
msgbuf_clear(&iev_resolver->ibuf.w);
close(iev_resolver->ibuf.fd);
msgbuf_write(&iev_main->ibuf.w);
msgbuf_clear(&iev_main->ibuf.w);
close(iev_main->ibuf.fd);

config_clear(frontend_conf);

free(iev_resolver);
free(iev_main);

log_info("frontend exiting")uw_log_info("frontend exiting");
exit(0);
286}

288int
289frontend_imsg_compose_main(int type, pid_t pid, void *data, uint16_t datalen)
290{
return (imsg_compose_event(iev_main, type, 0, pid, -1, data, datalen));
292}

294int
295frontend_imsg_compose_resolver(int type, pid_t pid, void *data,
  uint16_t datalen)
297{
return (imsg_compose_event(iev_resolver, type, 0, pid, -1, data,
   datalen));
300}

302void
303frontend_dispatch_main(int fd, short event, void *bula)
304{
static struct uw_conf	*nconf;
struct imsg		 imsg;
struct imsgev		*iev = bula;
struct imsgbuf		*ibuf = &iev->ibuf;
int			 n, shut = 0;

if (event & EV_READ0x02) {
if ((n = imsg_read(ibuf)) == -1 && errno(*__errno()) != EAGAIN35)
	fatal("imsg_read error");
if (n == 0)	/* Connection closed. */
	shut = 1;
}
if (event & EV_WRITE0x04) {
if ((n = msgbuf_write(&ibuf->w)) == -1 && errno(*__errno()) != EAGAIN35)
	fatal("msgbuf_write");
if (n == 0)	/* Connection closed. */
	shut = 1;
}

for (;;) {
if ((n = imsg_get(ibuf, &imsg)) == -1)
	fatal("%s: imsg_get error", __func__);
if (n == 0)	/* No more messages. */
	break;

switch (imsg.hdr.type) {
case IMSG_SOCKET_IPC_RESOLVER:
	/*
	 * Setup pipe and event handler to the resolver
	 * process.
	 */
	if (iev_resolver) {
		fatalx("%s: received unexpected imsg fd "
		    "to frontend", __func__);
		break;
	}
	if ((fd = imsg.fd) == -1) {
		fatalx("%s: expected to receive imsg fd to "
		   "frontend but didn't receive any",
		   __func__);
		break;
	}

	if (iev_resolver != NULL((void*)0))
		fatal("iev_resolver");
	iev_resolver = malloc(sizeof(struct imsgev));
	if (iev_resolver == NULL((void*)0))
		fatal(NULL((void*)0));

	imsg_init(&iev_resolver->ibuf, fd);
	iev_resolver->handler = frontend_dispatch_resolver;
	iev_resolver->events = EV_READ0x02;

	event_set(&iev_resolver->ev, iev_resolver->ibuf.fd,
	    iev_resolver->events, iev_resolver->handler,
	    iev_resolver);
	event_add(&iev_resolver->ev, NULL((void*)0));
	break;
case IMSG_RECONF_CONF:
case IMSG_RECONF_BLOCKLIST_FILE:
case IMSG_RECONF_FORWARDER:
case IMSG_RECONF_DOT_FORWARDER:
case IMSG_RECONF_FORCE:
	imsg_receive_config(&imsg, &nconf);
	break;
case IMSG_RECONF_END:
	if (nconf == NULL((void*)0))
		fatalx("%s: IMSG_RECONF_END without "
		    "IMSG_RECONF_CONF", __func__);
	merge_config(frontend_conf, nconf);
	if (frontend_conf->blocklist_file == NULL((void*)0))
		free_bl();
	nconf = NULL((void*)0);
	break;
case IMSG_UDP6SOCK:
	if (udp6sock != -1)
		fatalx("%s: received unexpected udp6sock",
		    __func__);
	if ((udp6sock = imsg.fd) == -1)
		fatalx("%s: expected to receive imsg "
		    "UDP6 fd but didn't receive any", __func__);
	event_set(&udp6ev.ev, udp6sock, EV_READ0x02 | EV_PERSIST0x10,
	    udp_receive, &udp6ev);
	event_add(&udp6ev.ev, NULL((void*)0));
	break;
case IMSG_UDP4SOCK:
	if (udp4sock != -1)
		fatalx("%s: received unexpected udp4sock",
		    __func__);
	if ((udp4sock = imsg.fd) == -1)
		fatalx("%s: expected to receive imsg "
		    "UDP4 fd but didn't receive any", __func__);
	event_set(&udp4ev.ev, udp4sock, EV_READ0x02 | EV_PERSIST0x10,
	    udp_receive, &udp4ev);
	event_add(&udp4ev.ev, NULL((void*)0));
	break;
case IMSG_TCP4SOCK:
	if (tcp4sock != -1)
		fatalx("%s: received unexpected tcp4sock",
		    __func__);
	if ((tcp4sock = imsg.fd) == -1)
		fatalx("%s: expected to receive imsg "
		    "TCP4 fd but didn't receive any", __func__);
	event_set(&tcp4ev.ev, tcp4sock, EV_READ0x02 | EV_PERSIST0x10,
	    tcp_accept, &tcp4ev);
	event_add(&tcp4ev.ev, NULL((void*)0));
	evtimer_set(&tcp4ev.pause, accept_paused, &tcp4ev)event_set(&tcp4ev.pause, -1, 0, accept_paused, &tcp4ev
);
	break;
case IMSG_TCP6SOCK:
	if (tcp6sock != -1)
		fatalx("%s: received unexpected tcp6sock",
		    __func__);
	if ((tcp6sock = imsg.fd) == -1)
		fatalx("%s: expected to receive imsg "
		    "TCP6 fd but didn't receive any", __func__);
	event_set(&tcp6ev.ev, tcp6sock, EV_READ0x02 | EV_PERSIST0x10,
	    tcp_accept, &tcp6ev);
	event_add(&tcp6ev.ev, NULL((void*)0));
	evtimer_set(&tcp6ev.pause, accept_paused, &tcp6ev)event_set(&tcp6ev.pause, -1, 0, accept_paused, &tcp6ev
);
	break;
case IMSG_ROUTESOCK: {
	static int	 routesock = -1;

	if (routesock != -1)
		fatalx("%s: received unexpected routesock",
		    __func__);
	if ((fd = imsg.fd) == -1)
		fatalx("%s: expected to receive imsg "
		    "routesocket fd but didn't receive any",
		    __func__);
	routesock = fd;
	event_set(&ev_route, fd, EV_READ0x02 | EV_PERSIST0x10,
	    route_receive, NULL((void*)0));
	break;
}
case IMSG_STARTUP:
	frontend_startup();
	break;
case IMSG_CONTROLFD:
	if ((fd = imsg.fd) == -1)
		fatalx("%s: expected to receive imsg control "
		    "fd but didn't receive any", __func__);
	/* Listen on control socket. */
	control_listen(fd);
	break;
case IMSG_TAFD:
	if ((ta_fd = imsg.fd) != -1)
		parse_trust_anchor(&trust_anchors, ta_fd);
	if (!TAILQ_EMPTY(&trust_anchors)(((&trust_anchors)->tqh_first) == ((void*)0)))
		send_trust_anchors(&trust_anchors);
	break;
case IMSG_BLFD:
	if ((fd = imsg.fd) == -1)
		fatalx("%s: expected to receive imsg block "
		   "list fd but didn't receive any", __func__);
	parse_blocklist(fd);
	break;
default:
	log_debug("%s: error handling imsg %d", __func__,
	    imsg.hdr.type);
	break;
}
imsg_free(&imsg);
}
if (!shut)
imsg_event_add(iev);
else {
/* This pipe is dead. Remove its event handler. */
event_del(&iev->ev);
event_loopexit(NULL((void*)0));
}
476}

478void
479frontend_dispatch_resolver(int fd, short event, void *bula)
480{
static struct dns64_prefix	*new_dns64_prefixes = NULL((void*)0);
static int			 new_dns64_prefix_count = 0;
static int			 new_dns64_prefix_pos = 0;
struct pending_query		*pq;
struct imsgev			*iev = bula;
struct imsgbuf			*ibuf = &iev->ibuf;
struct imsg			 imsg;
int				 n, shut = 0, chg;

if (event & EV_READ0x02) {
if ((n = imsg_read(ibuf)) == -1 && errno(*__errno()) != EAGAIN35)
	fatal("imsg_read error");
if (n == 0)	/* Connection closed. */
	shut = 1;
}
if (event & EV_WRITE0x04) {
if ((n = msgbuf_write(&ibuf->w)) == -1 && errno(*__errno()) != EAGAIN35)
	fatal("msgbuf_write");
if (n == 0)	/* Connection closed. */
	shut = 1;
}

for (;;) {
if ((n = imsg_get(ibuf, &imsg)) == -1)
	fatal("%s: imsg_get error", __func__);
if (n == 0)	/* No more messages. */
	break;

switch (imsg.hdr.type) {
case IMSG_ANSWER: {
	struct answer_header	*answer_header;
	int			 data_len;
	uint8_t			*data;

	if (IMSG_DATA_SIZE(imsg)((imsg).hdr.len - sizeof(struct imsg_hdr)) < sizeof(*answer_header))
		fatalx("%s: IMSG_ANSWER wrong length: "
		    "%lu", __func__, IMSG_DATA_SIZE(imsg)((imsg).hdr.len - sizeof(struct imsg_hdr)));
	answer_header = (struct answer_header *)imsg.data;
	data = (uint8_t *)imsg.data + sizeof(*answer_header);
	if (answer_header->answer_len > UINT16_MAX0xffff)
		fatalx("%s: IMSG_ANSWER answer too big: %d",
		    __func__, answer_header->answer_len);
	data_len = IMSG_DATA_SIZE(imsg)((imsg).hdr.len - sizeof(struct imsg_hdr)) -
	    sizeof(*answer_header);

	if ((pq = find_pending_query(answer_header->id)) ==
	    NULL((void*)0)) {
		log_warnx("%s: cannot find pending query %llu",
		    __func__, answer_header->id);
		break;
	}

	if (answer_header->srvfail) {
		error_answer(pq, LDNS_RCODE_SERVFAIL);
		send_answer(pq);
		break;
	}

	if (answer_header->bogus && !(pq->qmsg->flags &
	    BIT_CD0x0010)) {
		error_answer(pq, LDNS_RCODE_SERVFAIL);
		send_answer(pq);
		break;
	}

	if (sldns_buffer_position(pq->abuf) == 0 &&
	    !sldns_buffer_set_capacity(pq->abuf,
	    answer_header->answer_len)) {
		error_answer(pq, LDNS_RCODE_SERVFAIL);
		send_answer(pq);
		break;
	}

	if (sldns_buffer_position(pq->abuf) + data_len >
	    sldns_buffer_capacity(pq->abuf))
		fatalx("%s: IMSG_ANSWER answer too big: %d",
		    __func__, data_len);
	sldns_buffer_write(pq->abuf, data, data_len);

	if (sldns_buffer_position(pq->abuf) ==
	    sldns_buffer_capacity(pq->abuf)) {
		sldns_buffer_flip(pq->abuf);
		if (pq->dns64_synthesize) {
			synthesize_dns64_answer(pq);
			send_answer(pq);
		} else {
			noerror_answer(pq);
			if (pq->dns64_synthesize)
				/* we did not find a answer */
				resend_dns64_query(pq);
			else
				send_answer(pq);
		}
	}
	break;
}
case IMSG_CTL_RESOLVER_INFO:
case IMSG_CTL_AUTOCONF_RESOLVER_INFO:
case IMSG_CTL_MEM_INFO:
case IMSG_CTL_END:
	control_imsg_relay(&imsg);
	break;
case IMSG_NEW_TA:
	/* make sure this is a string */
	((char *)imsg.data)[IMSG_DATA_SIZE(imsg)((imsg).hdr.len - sizeof(struct imsg_hdr)) - 1] = '\0';
	add_new_ta(&new_trust_anchors, imsg.data);
	break;
case IMSG_NEW_TAS_ABORT:
	free_tas(&new_trust_anchors);
	break;
case IMSG_NEW_TAS_DONE:
	chg = merge_tas(&new_trust_anchors, &trust_anchors);
	if (chg)
		send_trust_anchors(&trust_anchors);

	/*
	 * always write trust anchors, the modify date on
	 * the file is an indication when we made progress
	 */
	if (ta_fd != -1)
		write_trust_anchors(&trust_anchors, ta_fd);
	break;
case IMSG_NEW_DNS64_PREFIXES_START:
	if (IMSG_DATA_SIZE(imsg)((imsg).hdr.len - sizeof(struct imsg_hdr)) !=
	    sizeof(new_dns64_prefix_count))
		fatalx("%s: IMSG_NEW_DNS64_PREFIXES_START "
		    "wrong length: %lu", __func__,
		    IMSG_DATA_SIZE(imsg)((imsg).hdr.len - sizeof(struct imsg_hdr)));
	memcpy(&new_dns64_prefix_count, imsg.data,
	    sizeof(new_dns64_prefix_count));
	free(new_dns64_prefixes);
	new_dns64_prefixes = NULL((void*)0);
	if (new_dns64_prefix_count > 0)
		new_dns64_prefixes =
		    calloc(new_dns64_prefix_count,
		    sizeof(struct dns64_prefix));
	new_dns64_prefix_pos = 0;
	break;
case IMSG_NEW_DNS64_PREFIX: {
	if (IMSG_DATA_SIZE(imsg)((imsg).hdr.len - sizeof(struct imsg_hdr)) != sizeof(struct dns64_prefix))
		fatalx("%s: IMSG_NEW_DNS64_PREFIX wrong "
		    "length: %lu", __func__,
		    IMSG_DATA_SIZE(imsg)((imsg).hdr.len - sizeof(struct imsg_hdr)));
	if (new_dns64_prefixes == NULL((void*)0))
		break;
	if (new_dns64_prefix_pos >= new_dns64_prefix_count)
		fatalx("%s: IMSG_NEW_DNS64_PREFIX: too many "
		    "prefixes", __func__);
	memcpy(&new_dns64_prefixes[new_dns64_prefix_pos++],
	    imsg.data, sizeof(struct dns64_prefix));
	break;
}
case IMSG_NEW_DNS64_PREFIXES_DONE:
	free(dns64_prefixes);
	dns64_prefixes = new_dns64_prefixes;
	dns64_prefix_count = new_dns64_prefix_count;
	new_dns64_prefixes = NULL((void*)0);
	break;
default:
	log_debug("%s: error handling imsg %d", __func__,
	    imsg.hdr.type);
	break;
}
imsg_free(&imsg);
}
if (!shut)
imsg_event_add(iev);
else {
/* This pipe is dead. Remove its event handler. */
event_del(&iev->ev);
event_loopexit(NULL((void*)0));
}
653}

655void
656frontend_startup(void)
657{
if (!event_initialized(&ev_route)((&ev_route)->ev_flags & 0x80))
fatalx("%s: did not receive a route socket from the main "
    "process", __func__);

event_add(&ev_route, NULL((void*)0));

frontend_imsg_compose_main(IMSG_STARTUP_DONE, 0, NULL((void*)0), 0);
check_available_af();
666}

668void
669free_pending_query(struct pending_query *pq)
670{
if (!pq6.1
'pq' is non-null
)
7
←
Taking false branch→
return;

TAILQ_REMOVE(&pending_queries, pq, entry)do { if (((pq)->entry.tqe_next) != ((void*)0)) (pq)->entry
.tqe_next->entry.tqe_prev = (pq)->entry.tqe_prev; else (
&pending_queries)->tqh_last = (pq)->entry.tqe_prev;
 *(pq)->entry.tqe_prev = (pq)->entry.tqe_next; ; ; } while
 (0);
8
←
Assuming field 'tqe_next' is equal to null→
9
←
Taking false branch→
10
←
Loop condition is false.  Exiting loop→
regional_destroy(pq->region);
sldns_buffer_free(pq->qbuf);
sldns_buffer_free(pq->abuf);
if (pq->tcp) {
11
←
Assuming field 'tcp' is 0→
12
←
Taking false branch→
if (event_initialized(&pq->ev)((&pq->ev)->ev_flags & 0x80))
	event_del(&pq->ev);
if (event_initialized(&pq->resp_ev)((&pq->resp_ev)->ev_flags & 0x80))
	event_del(&pq->resp_ev);
if (event_initialized(&pq->tmo_ev)((&pq->tmo_ev)->ev_flags & 0x80))
	event_del(&pq->tmo_ev);
if (pq->fd != -1)
	close(pq->fd);
}
free(pq);
13
←
Memory is released→
689}

691void
692udp_receive(int fd, short events, void *arg)
693{
struct udp_ev		*udpev = (struct udp_ev *)arg;
struct pending_query	*pq = NULL((void*)0);
ssize_t			 len;

if ((len = recvmsg(fd, &udpev->rcvmhdr, 0)) == -1) {
log_warn("recvmsg")uw_log_warn("recvmsg");
return;
}

if ((pq = calloc(1, sizeof(*pq))) == NULL((void*)0)) {
log_warn(NULL)uw_log_warn(((void*)0));
return;
}

do {
arc4random_buf(&pq->imsg_id, sizeof(pq->imsg_id));
} while(find_pending_query(pq->imsg_id) != NULL((void*)0));

TAILQ_INSERT_TAIL(&pending_queries, pq, entry)do { (pq)->entry.tqe_next = ((void*)0); (pq)->entry.tqe_prev
 = (&pending_queries)->tqh_last; *(&pending_queries
)->tqh_last = (pq); (&pending_queries)->tqh_last = &
(pq)->entry.tqe_next; } while (0);

pq->from = udpev->from;
pq->fd = fd;
pq->qbuf = sldns_buffer_new(len);
pq->abuf = sldns_buffer_new(len); /* make sure we can send errors */
pq->region = regional_create();
pq->qmsg = regional_alloc(pq->region, sizeof(*pq->qmsg));

if (!pq->qbuf || !pq->abuf || !pq->region || !pq->qmsg) {
log_warnx("out of memory");
free_pending_query(pq);
return;
}

memset(pq->qmsg, 0, sizeof(*pq->qmsg));
sldns_buffer_write(pq->qbuf, udpev->query, len);
sldns_buffer_flip(pq->qbuf);
handle_query(pq);
731}

733void
734handle_query(struct pending_query *pq)
735{
struct query_imsg	 query_imsg;
struct bl_node		 find;
int			 rcode;
char			*str;
char			 dname[LDNS_MAX_DOMAINLEN255 + 1];
char			 qclass_buf[16];
char			 qtype_buf[16];

if (log_getverbose() & OPT_VERBOSE20x00000002 && (str =
   sldns_wire2str_pkt(sldns_buffer_begin(pq->qbuf),
   sldns_buffer_limit(pq->qbuf))) != NULL((void*)0)) {
log_debug("from: %s\n%s", ip_port((struct sockaddr *)
    &pq->from), str);
free(str);
}

if (!query_info_parse(&pq->qinfo, pq->qbuf)) {
log_warnx("query_info_parse failed");
goto drop;
}

sldns_buffer_rewind(pq->qbuf);

if (parse_packet(pq->qbuf, pq->qmsg, pq->region) !=
   LDNS_RCODE_NOERROR) {
log_warnx("parse_packet failed");
goto drop;
}

rcode = check_query(pq->qbuf);
switch (rcode) {
case LDNS_RCODE_NOERROR:
break;
case -1:
goto drop;
default:
error_answer(pq, rcode);
goto send_answer;
}

rcode = parse_extract_edns(pq->qmsg, &pq->edns, pq->region);
if (rcode != LDNS_RCODE_NOERROR) {
error_answer(pq, rcode);
goto send_answer;
}

if (!dname_valid(pq->qinfo.qname, pq->qinfo.qname_len)) {
error_answer(pq, LDNS_RCODE_FORMERR);
goto send_answer;
}
dname_str(pq->qinfo.qname, dname);

sldns_wire2str_class_buf(pq->qinfo.qclass, qclass_buf,
   sizeof(qclass_buf));
sldns_wire2str_type_buf(pq->qinfo.qtype, qtype_buf, sizeof(qtype_buf));
log_debug("%s: %s %s %s ?", ip_port((struct sockaddr *)&pq->from),
   dname, qclass_buf, qtype_buf);

find.domain = dname;
if (RB_FIND(bl_tree, &bl_head, &find)bl_tree_RB_FIND(&bl_head, &find) != NULL((void*)0)) {
if (frontend_conf->blocklist_log)
	log_info("blocking %s", dname)uw_log_info("blocking %s", dname);
error_answer(pq, LDNS_RCODE_REFUSED);
goto send_answer;
}

if (pq->qinfo.qtype == LDNS_RR_TYPE_AXFR || pq->qinfo.qtype ==
   LDNS_RR_TYPE_IXFR) {
error_answer(pq, LDNS_RCODE_REFUSED);
goto send_answer;
}

if(pq->qinfo.qtype == LDNS_RR_TYPE_OPT ||
   pq->qinfo.qtype == LDNS_RR_TYPE_TSIG ||
   pq->qinfo.qtype == LDNS_RR_TYPE_TKEY ||
   pq->qinfo.qtype == LDNS_RR_TYPE_MAILA ||
   pq->qinfo.qtype == LDNS_RR_TYPE_MAILB ||
   (pq->qinfo.qtype >= 128 && pq->qinfo.qtype <= 248)) {
error_answer(pq, LDNS_RCODE_FORMERR);
goto send_answer;
}

if (pq->qinfo.qclass == LDNS_RR_CLASS_CH) {
if (strcasecmp(dname, "version.server.") == 0 ||
    strcasecmp(dname, "version.bind.") == 0) {
	chaos_answer(pq);
} else
	error_answer(pq, LDNS_RCODE_REFUSED);
goto send_answer;
}

if (strlcpy(query_imsg.qname, dname, sizeof(query_imsg.qname)) >=
   sizeof(query_imsg.qname)) {
log_warnx("qname too long");
error_answer(pq, LDNS_RCODE_FORMERR);
goto send_answer;
}
query_imsg.id = pq->imsg_id;
query_imsg.t = pq->qinfo.qtype;
query_imsg.c = pq->qinfo.qclass;

if (frontend_imsg_compose_resolver(IMSG_QUERY, 0, &query_imsg,
   sizeof(query_imsg)) == -1) {
error_answer(pq, LDNS_RCODE_SERVFAIL);
goto send_answer;
}
return;

send_answer:
send_answer(pq);
return;

drop:
free_pending_query(pq);
850}

852void
853noerror_answer(struct pending_query *pq)
854{
struct query_info		 skip, qinfo;
struct reply_info		*rinfo = NULL((void*)0);
struct alloc_cache		 alloc;
struct edns_data		 edns;
struct ub_packed_rrset_key	*an_rrset = NULL((void*)0);
struct packed_rrset_data	*an_rrset_data = NULL((void*)0);

alloc_init(&alloc, NULL((void*)0), 0);
memset(&qinfo, 0, sizeof(qinfo));
/* read past query section, no memory is allocated */
if (!query_info_parse(&skip, pq->abuf))
goto srvfail;

if (reply_info_parse(pq->abuf, &alloc, &qinfo, &rinfo, pq->region,
   &edns) != 0)
goto srvfail;

if ((an_rrset = reply_find_answer_rrset(&qinfo, rinfo)) != NULL((void*)0))
an_rrset_data = (struct packed_rrset_data*)an_rrset->entry.data;

/* reply_info_parse() allocates memory */
query_info_clear(&qinfo);

/* XXX check that there a no AAAA records in answer section? */
if ((an_rrset_data == NULL((void*)0) || an_rrset_data->count == 0) &&
   !pq->dns64_synthesize && pq->qinfo.qtype == LDNS_RR_TYPE_AAAA &&
   pq->qinfo.qclass == LDNS_RR_CLASS_IN && dns64_prefix_count > 0) {
pq->dns64_synthesize = 1;
return;
}

sldns_buffer_clear(pq->abuf);
if (reply_info_encode(&pq->qinfo, rinfo, pq->qmsg->id, rinfo->flags,
   pq->abuf, 0, pq->region, pq->tcp ? UINT16_MAX0xffff : pq->edns.udp_size,
   pq->edns.bits & EDNS_DO0x8000, MINIMIZE_ANSWER1) == 0)
goto srvfail;

reply_info_parsedelete(rinfo, &alloc);
alloc_clear(&alloc);
return;

srvfail:
reply_info_parsedelete(rinfo, &alloc);
alloc_clear(&alloc);
error_answer(pq, LDNS_RCODE_SERVFAIL);
900}

902void
903synthesize_dns64_answer(struct pending_query *pq)
904{
struct query_info		 skip, qinfo;
struct reply_info		*rinfo = NULL((void*)0), *synth_rinfo = NULL((void*)0);
struct alloc_cache		 alloc;
struct edns_data		 edns;
size_t				 i;

pq->dns64_synthesize = 0;

alloc_init(&alloc, NULL((void*)0), 0);
memset(&qinfo, 0, sizeof(qinfo));
/* read past query section, no memory is allocated */
if (!query_info_parse(&skip, pq->abuf))
goto srvfail;

if (reply_info_parse(pq->abuf, &alloc, &qinfo, &rinfo, pq->region,
   &edns) != 0)
goto srvfail;

/* reply_info_parse() allocates memory */
query_info_clear(&qinfo);

synth_rinfo = construct_reply_info_base(pq->region, rinfo->flags,
   rinfo->qdcount, rinfo->ttl, rinfo->prefetch_ttl,
   rinfo->serve_expired_ttl, rinfo->an_numrrsets,
   rinfo->ns_numrrsets, rinfo->ar_numrrsets, rinfo->rrset_count,
   rinfo->security);

if (!synth_rinfo)
goto srvfail;

if(!reply_info_alloc_rrset_keys(synth_rinfo, NULL((void*)0), pq->region))
goto srvfail;

for (i = 0; i < synth_rinfo->rrset_count; i++) {
struct ub_packed_rrset_key	*src_rrset_key, *dst_rrset_key;
struct packed_rrset_data	*src_rrset_data;
struct packed_rrset_data	*dst_rrset_data;

src_rrset_key = rinfo->rrsets[i];
src_rrset_data =
    (struct packed_rrset_data *)src_rrset_key->entry.data;
dst_rrset_key = synth_rinfo->rrsets[i];

dst_rrset_key->id = src_rrset_key->id;
dst_rrset_key->rk = src_rrset_key->rk;

if (i < rinfo->an_numrrsets && src_rrset_key->rk.type ==
    htons(LDNS_RR_TYPE_A)(__uint16_t)(__builtin_constant_p(LDNS_RR_TYPE_A) ? (__uint16_t
)(((__uint16_t)(LDNS_RR_TYPE_A) & 0xffU) << 8 | ((__uint16_t
)(LDNS_RR_TYPE_A) & 0xff00U) >> 8) : __swap16md(LDNS_RR_TYPE_A
))) {
	dns64_synth_aaaa_data(src_rrset_key, src_rrset_data,
	    dst_rrset_key, &dst_rrset_data, pq->region);
	if (dst_rrset_data == NULL((void*)0))
		goto srvfail;
} else {
	dst_rrset_key->entry.hash = src_rrset_key->entry.hash;
	dst_rrset_key->rk.dname = regional_alloc_init(
	    pq->region, src_rrset_key->rk.dname,
	    src_rrset_key->rk.dname_len);
	if (dst_rrset_key->rk.dname == NULL((void*)0))
		goto srvfail;

	dst_rrset_data = regional_alloc_init(pq->region,
	    src_rrset_data,
	    packed_rrset_sizeof(src_rrset_data));
	if (dst_rrset_data == NULL((void*)0))
		goto srvfail;
}

packed_rrset_ptr_fixup(dst_rrset_data);
dst_rrset_key->entry.data = dst_rrset_data;
}

if (!sldns_buffer_set_capacity(pq->abuf, pq->tcp ? UINT16_MAX0xffff :
   pq->edns.udp_size))
goto srvfail;

sldns_buffer_clear(pq->abuf);

if (reply_info_encode(&pq->qinfo, synth_rinfo, pq->qmsg->id,
   synth_rinfo->flags, pq->abuf, 0, pq->region,
   pq->tcp ? UINT16_MAX0xffff : pq->edns.udp_size,
   pq->edns.bits & EDNS_DO0x8000, MINIMIZE_ANSWER1) == 0)
goto srvfail;

reply_info_parsedelete(rinfo, &alloc);
alloc_clear(&alloc);
return;

srvfail:
reply_info_parsedelete(rinfo, &alloc);
alloc_clear(&alloc);
error_answer(pq, LDNS_RCODE_SERVFAIL);
996}

998void
999resend_dns64_query(struct pending_query *opq) {
struct pending_query	*pq;
struct query_imsg	 query_imsg;
int			 rcode;
char			 dname[LDNS_MAX_DOMAINLEN255 + 1];

if ((pq = calloc(1, sizeof(*pq))) == NULL((void*)0)) {
log_warn(NULL)uw_log_warn(((void*)0));
return;
}

do {
arc4random_buf(&pq->imsg_id, sizeof(pq->imsg_id));
} while(find_pending_query(pq->imsg_id) != NULL((void*)0));

TAILQ_INSERT_TAIL(&pending_queries, pq, entry)do { (pq)->entry.tqe_next = ((void*)0); (pq)->entry.tqe_prev
 = (&pending_queries)->tqh_last; *(&pending_queries
)->tqh_last = (pq); (&pending_queries)->tqh_last = &
(pq)->entry.tqe_next; } while (0);

pq->from = opq->from;
pq->fd = opq->fd;
opq->fd = -1;
pq->tcp = opq->tcp;
pq->qbuf = sldns_buffer_new(sldns_buffer_capacity(opq->qbuf));
pq->abuf = sldns_buffer_new(sldns_buffer_capacity(opq->abuf));
pq->region = regional_create();
pq->qmsg = regional_alloc(pq->region, sizeof(*pq->qmsg));

if (!pq->qbuf || !pq->abuf || !pq->region || !pq->qmsg) {
log_warnx("out of memory");
free_pending_query(pq);
free_pending_query(opq);
return;
}

sldns_buffer_rewind(opq->qbuf);
sldns_buffer_write(pq->qbuf, sldns_buffer_current(opq->qbuf),
   sldns_buffer_remaining(opq->qbuf));
sldns_buffer_flip(pq->qbuf);
memset(pq->qmsg, 0, sizeof(*pq->qmsg));

if (pq->tcp) {
struct timeval	 timeout = {TCP_TIMEOUT15, 0};

event_set(&pq->ev, pq->fd, EV_READ0x02 | EV_PERSIST0x10, tcp_request,
    pq);
event_set(&pq->resp_ev, pq->fd, EV_WRITE0x04 | EV_PERSIST0x10,
    tcp_response, pq);
evtimer_set(&pq->tmo_ev, tcp_timeout, pq)event_set(&pq->tmo_ev, -1, 0, tcp_timeout, pq);
evtimer_add(&pq->tmo_ev, &timeout)event_add(&pq->tmo_ev, &timeout);
}

if (!query_info_parse(&pq->qinfo, pq->qbuf)) {
log_warnx("query_info_parse failed");
goto drop;
}

sldns_buffer_rewind(pq->qbuf);

if (parse_packet(pq->qbuf, pq->qmsg, pq->region) !=
   LDNS_RCODE_NOERROR) {
log_warnx("parse_packet failed");
goto drop;
}

rcode = parse_extract_edns(pq->qmsg, &pq->edns, pq->region);
if (rcode != LDNS_RCODE_NOERROR) {
error_answer(pq, rcode);
goto send_answer;
}

dname_str(pq->qinfo.qname, dname);
strlcpy(query_imsg.qname, dname, sizeof(query_imsg.qname));
query_imsg.id = pq->imsg_id;
query_imsg.t = LDNS_RR_TYPE_A;
query_imsg.c = pq->qinfo.qclass;

pq->dns64_synthesize = 1;

if (frontend_imsg_compose_resolver(IMSG_QUERY, 0, &query_imsg,
   sizeof(query_imsg)) == -1) {
error_answer(pq, LDNS_RCODE_SERVFAIL);
goto send_answer;
}

free_pending_query(opq);
return;

send_answer:
free_pending_query(opq);
send_answer(pq);
return;

drop:
free_pending_query(opq);
free_pending_query(pq);
1093}

1095void
1096chaos_answer(struct pending_query *pq)
1097{
size_t		 len;
const char	*name = "unwind";

len = strlen(name);
if (!sldns_buffer_set_capacity(pq->abuf,
   sldns_buffer_capacity(pq->qbuf) + COMPRESSED_RR_SIZE12 + 1 + len)) {
error_answer(pq, LDNS_RCODE_SERVFAIL);
return;
}

sldns_buffer_copy(pq->abuf, pq->qbuf);

sldns_buffer_clear(pq->abuf);

sldns_buffer_skip(pq->abuf, sizeof(uint16_t));	/* skip id */
sldns_buffer_write_u16(pq->abuf, 0);		/* clear flags */
LDNS_QR_SET(sldns_buffer_begin(pq->abuf))(*(sldns_buffer_begin(pq->abuf)+2) |= 0x80U);
LDNS_RA_SET(sldns_buffer_begin(pq->abuf))(*(sldns_buffer_begin(pq->abuf)+3) |= 0x80U);
if (LDNS_RD_WIRE(sldns_buffer_begin(pq->qbuf))(*(sldns_buffer_begin(pq->qbuf)+2) & 0x01U))
LDNS_RD_SET(sldns_buffer_begin(pq->abuf))(*(sldns_buffer_begin(pq->abuf)+2) |= 0x01U);
if (LDNS_CD_WIRE(sldns_buffer_begin(pq->qbuf))(*(sldns_buffer_begin(pq->qbuf)+3) & 0x10U))
LDNS_CD_SET(sldns_buffer_begin(pq->abuf))(*(sldns_buffer_begin(pq->abuf)+3) |= 0x10U);
LDNS_RCODE_SET(sldns_buffer_begin(pq->abuf), LDNS_RCODE_NOERROR)(*(sldns_buffer_begin(pq->abuf)+3) = ((*(sldns_buffer_begin
(pq->abuf)+3)) & ~0x0fU) | (LDNS_RCODE_NOERROR));
sldns_buffer_write_u16(pq->abuf, 1);		/* qdcount */
sldns_buffer_write_u16(pq->abuf, 1);		/* ancount */
sldns_buffer_write_u16(pq->abuf, 0);		/* nscount */
sldns_buffer_write_u16(pq->abuf, 0);		/* arcount */
(void)query_dname_len(pq->abuf);		/* skip qname */
sldns_buffer_skip(pq->abuf, sizeof(uint16_t));	/* skip qtype */
sldns_buffer_skip(pq->abuf, sizeof(uint16_t));	/* skip qclass */

sldns_buffer_write_u16(pq->abuf, 0xc00c);	/* ptr to query */
sldns_buffer_write_u16(pq->abuf, LDNS_RR_TYPE_TXT);
sldns_buffer_write_u16(pq->abuf, LDNS_RR_CLASS_CH);
sldns_buffer_write_u32(pq->abuf, 0);		/* TTL */
sldns_buffer_write_u16(pq->abuf, 1 + len);	/* RDLENGTH */
sldns_buffer_write_u8(pq->abuf, len);		/* length octed */
sldns_buffer_write(pq->abuf, name, len);
sldns_buffer_flip(pq->abuf);
1137}

1139void
1140error_answer(struct pending_query *pq, int rcode)
1141{
sldns_buffer_clear(pq->abuf);
error_encode(pq->abuf, rcode, &pq->qinfo, pq->qmsg->id,
   pq->qmsg->flags, pq->edns.edns_present ? &pq->edns : NULL((void*)0));
1145}

1147int
1148check_query(sldns_buffer* pkt)
1149{
if(sldns_buffer_limit(pkt) < LDNS_HEADER_SIZE12) {
log_warnx("bad query: too short, dropped");
return -1;
}
if(LDNS_QR_WIRE(sldns_buffer_begin(pkt))(*(sldns_buffer_begin(pkt)+2) & 0x80U)) {
log_warnx("bad query: QR set, dropped");
return -1;
}
if(LDNS_TC_WIRE(sldns_buffer_begin(pkt))(*(sldns_buffer_begin(pkt)+2) & 0x02U)) {
LDNS_TC_CLR(sldns_buffer_begin(pkt))(*(sldns_buffer_begin(pkt)+2) &= ~0x02U);
log_warnx("bad query: TC set");
return (LDNS_RCODE_FORMERR);
}
if(!(LDNS_RD_WIRE(sldns_buffer_begin(pkt))(*(sldns_buffer_begin(pkt)+2) & 0x01U))) {
log_warnx("bad query: RD not set");
return (LDNS_RCODE_REFUSED);
}
if(LDNS_OPCODE_WIRE(sldns_buffer_begin(pkt))((*(sldns_buffer_begin(pkt)+2) & 0x78U) >> 3) != LDNS_PACKET_QUERY) {
log_warnx("bad query: unknown opcode %d",
    LDNS_OPCODE_WIRE(sldns_buffer_begin(pkt))((*(sldns_buffer_begin(pkt)+2) & 0x78U) >> 3));
return (LDNS_RCODE_NOTIMPL);
}

if (LDNS_QDCOUNT(sldns_buffer_begin(pkt))(sldns_read_uint16(sldns_buffer_begin(pkt)+4)) != 1 &&
   LDNS_ANCOUNT(sldns_buffer_begin(pkt))(sldns_read_uint16(sldns_buffer_begin(pkt)+6))!= 0 &&
   LDNS_NSCOUNT(sldns_buffer_begin(pkt))(sldns_read_uint16(sldns_buffer_begin(pkt)+8))!= 0 &&
   LDNS_ARCOUNT(sldns_buffer_begin(pkt))(sldns_read_uint16(sldns_buffer_begin(pkt)+10)) > 1) {
log_warnx("bad query: qdcount: %d, ancount: %d "
    "nscount: %d, arcount: %d",
    LDNS_QDCOUNT(sldns_buffer_begin(pkt))(sldns_read_uint16(sldns_buffer_begin(pkt)+4)),
    LDNS_ANCOUNT(sldns_buffer_begin(pkt))(sldns_read_uint16(sldns_buffer_begin(pkt)+6)),
    LDNS_NSCOUNT(sldns_buffer_begin(pkt))(sldns_read_uint16(sldns_buffer_begin(pkt)+8)),
    LDNS_ARCOUNT(sldns_buffer_begin(pkt))(sldns_read_uint16(sldns_buffer_begin(pkt)+10)));
return (LDNS_RCODE_FORMERR);
}
return 0;
1186}

1188void
1189send_answer(struct pending_query *pq)
1190{
char	*str;

if (log_getverbose() & OPT_VERBOSE20x00000002 && (str =
   sldns_wire2str_pkt(sldns_buffer_begin(pq->abuf),
   sldns_buffer_limit(pq->abuf))) != NULL((void*)0)) {
log_debug("from: %s\n%s", ip_port((struct sockaddr *)
    &pq->from), str);
free(str);
}

if (!pq->tcp) {
if(sendto(pq->fd, sldns_buffer_current(pq->abuf),
    sldns_buffer_remaining(pq->abuf), 0,
    (struct sockaddr *)&pq->from, pq->from.ss_len) == -1)
	log_warn("sendto")uw_log_warn("sendto");
free_pending_query(pq);
} else {
struct sldns_buffer	*tmp;

tmp = sldns_buffer_new(sldns_buffer_limit(pq->abuf) + 2);

if (!tmp) {
	free_pending_query(pq);
	return;
}

sldns_buffer_write_u16(tmp, sldns_buffer_limit(pq->abuf));
sldns_buffer_write(tmp, sldns_buffer_current(pq->abuf),
    sldns_buffer_remaining(pq->abuf));
sldns_buffer_flip(tmp);
sldns_buffer_free(pq->abuf);
pq->abuf = tmp;
event_add(&pq->resp_ev, NULL((void*)0));
}
1225}

1227char*
1228ip_port(struct sockaddr *sa)
1229{
static char	 hbuf[NI_MAXHOST256], buf[NI_MAXHOST256];

if (getnameinfo(sa, sa->sa_len, hbuf, sizeof(hbuf), NULL((void*)0), 0,
   NI_NUMERICHOST1) != 0) {
snprintf(buf, sizeof(buf), "%s", "(unknown)");
return buf;
}

if (sa->sa_family == AF_INET624)
snprintf(buf, sizeof(buf), "[%s]:%d", hbuf, ntohs((__uint16_t)(__builtin_constant_p(((struct sockaddr_in6 *)sa)
->sin6_port) ? (__uint16_t)(((__uint16_t)(((struct sockaddr_in6
 *)sa)->sin6_port) & 0xffU) << 8 | ((__uint16_t)
(((struct sockaddr_in6 *)sa)->sin6_port) & 0xff00U) >>
 8) : __swap16md(((struct sockaddr_in6 *)sa)->sin6_port))
    ((struct sockaddr_in6 *)sa)->sin6_port)(__uint16_t)(__builtin_constant_p(((struct sockaddr_in6 *)sa)
->sin6_port) ? (__uint16_t)(((__uint16_t)(((struct sockaddr_in6
 *)sa)->sin6_port) & 0xffU) << 8 | ((__uint16_t)
(((struct sockaddr_in6 *)sa)->sin6_port) & 0xff00U) >>
 8) : __swap16md(((struct sockaddr_in6 *)sa)->sin6_port)));
if (sa->sa_family == AF_INET2)
snprintf(buf, sizeof(buf), "[%s]:%d", hbuf, ntohs((__uint16_t)(__builtin_constant_p(((struct sockaddr_in *)sa)->
sin_port) ? (__uint16_t)(((__uint16_t)(((struct sockaddr_in *
)sa)->sin_port) & 0xffU) << 8 | ((__uint16_t)(((
struct sockaddr_in *)sa)->sin_port) & 0xff00U) >>
 8) : __swap16md(((struct sockaddr_in *)sa)->sin_port))
    ((struct sockaddr_in *)sa)->sin_port)(__uint16_t)(__builtin_constant_p(((struct sockaddr_in *)sa)->
sin_port) ? (__uint16_t)(((__uint16_t)(((struct sockaddr_in *
)sa)->sin_port) & 0xffU) << 8 | ((__uint16_t)(((
struct sockaddr_in *)sa)->sin_port) & 0xff00U) >>
 8) : __swap16md(((struct sockaddr_in *)sa)->sin_port)));

return buf;
1246}

1248struct pending_query*
1249find_pending_query(uint64_t id)
1250{
struct pending_query	*pq;

TAILQ_FOREACH(pq, &pending_queries, entry)for((pq) = ((&pending_queries)->tqh_first); (pq) != ((
void*)0); (pq) = ((pq)->entry.tqe_next))
if (pq->imsg_id == id)
	return pq;
return NULL((void*)0);
1257}

1259void
1260route_receive(int fd, short events, void *arg)
1261{
static uint8_t		*buf;

struct rt_msghdr	*rtm;
struct sockaddr		*sa, *rti_info[RTAX_MAX15];
ssize_t			 n;

if (buf == NULL((void*)0)) {
buf = malloc(ROUTE_SOCKET_BUF_SIZE16384);
if (buf == NULL((void*)0))
	fatal("malloc");
}
rtm = (struct rt_msghdr *)buf;
if ((n = read(fd, buf, ROUTE_SOCKET_BUF_SIZE16384)) == -1) {
if (errno(*__errno()) == EAGAIN35 || errno(*__errno()) == EINTR4)
	return;
log_warn("dispatch_rtmsg: read error")uw_log_warn("dispatch_rtmsg: read error");
return;
}

if (n == 0)
fatal("routing socket closed");

if (n < (ssize_t)sizeof(rtm->rtm_msglen) || n < rtm->rtm_msglen) {
log_warnx("partial rtm of %zd in buffer", n);
return;
}

if (rtm->rtm_version != RTM_VERSION5)
return;

sa = (struct sockaddr *)(buf + rtm->rtm_hdrlen);
get_rtaddrs(rtm->rtm_addrs, sa, rti_info);

handle_route_message(rtm, rti_info);
1296}

1298#define ROUNDUP(a)((a) > 0 ? (1 + (((a) - 1) | (sizeof(long) - 1))) : sizeof
(long)) \
((a) > 0 ? (1 + (((a) - 1) | (sizeof(long) - 1))) : sizeof(long))

1301void
1302get_rtaddrs(int addrs, struct sockaddr *sa, struct sockaddr **rti_info)
1303{
int	i;

for (i = 0; i < RTAX_MAX15; i++) {
if (addrs & (1 << i)) {
	rti_info[i] = sa;
	sa = (struct sockaddr *)((char *)(sa) +
	    ROUNDUP(sa->sa_len)((sa->sa_len) > 0 ? (1 + (((sa->sa_len) - 1) | (sizeof
(long) - 1))) : sizeof(long)));
} else
	rti_info[i] = NULL((void*)0);
}
1314}

1316void
1317handle_route_message(struct rt_msghdr *rtm, struct sockaddr **rti_info)
1318{
struct imsg_rdns_proposal	 rdns_proposal;
struct sockaddr_rtdns		*rtdns;
struct if_announcemsghdr	*ifan;

switch (rtm->rtm_type) {
case RTM_IFANNOUNCE0xf:
ifan = (struct if_announcemsghdr *)rtm;
if (ifan->ifan_what == IFAN_ARRIVAL0)
	break;
rdns_proposal.if_index = ifan->ifan_index;
rdns_proposal.src = 0;
rdns_proposal.rtdns.sr_family = AF_INET2;
rdns_proposal.rtdns.sr_len = offsetof(struct sockaddr_rtdns,__builtin_offsetof(struct sockaddr_rtdns, sr_dns)
    sr_dns)__builtin_offsetof(struct sockaddr_rtdns, sr_dns);
frontend_imsg_compose_resolver(IMSG_REPLACE_DNS, 0,
    &rdns_proposal, sizeof(rdns_proposal));
break;
case RTM_IFINFO0xe:
frontend_imsg_compose_resolver(IMSG_NETWORK_CHANGED, 0, NULL((void*)0),
    0);
break;
case RTM_PROPOSAL0x13:
if (!(rtm->rtm_addrs & RTA_DNS0x1000))
	break;

rtdns = (struct sockaddr_rtdns*)rti_info[RTAX_DNS12];
rdns_proposal.if_index = rtm->rtm_index;
rdns_proposal.src = rtm->rtm_priority;
memcpy(&rdns_proposal.rtdns, rtdns, sizeof(rdns_proposal.rtdns));
frontend_imsg_compose_resolver(IMSG_REPLACE_DNS, 0,
    &rdns_proposal, sizeof(rdns_proposal));
break;
case RTM_NEWADDR0xc:
case RTM_DELADDR0xd:
case RTM_DESYNC0x10:
check_available_af();
break;
default:
break;
}
1359}

1361void
1362add_new_ta(struct trust_anchor_head *tah, char *val)
1363{
struct trust_anchor	*ta, *i;
int			 cmp;

if ((ta = malloc(sizeof(*ta))) == NULL((void*)0))
fatal("%s", __func__);
if ((ta->ta = strdup(val)) == NULL((void*)0))
fatal("%s", __func__);

/* keep the list sorted to prevent churn if the order changes in DNS */
TAILQ_FOREACH(i, tah, entry)for((i) = ((tah)->tqh_first); (i) != ((void*)0); (i) = ((i
)->entry.tqe_next)) {
cmp = strcmp(i->ta, ta->ta);
if ( cmp == 0) {
	/* duplicate */
	free(ta->ta);
	free(ta);
	return;
} else if (cmp > 0) {
	TAILQ_INSERT_BEFORE(i, ta, entry)do { (ta)->entry.tqe_prev = (i)->entry.tqe_prev; (ta)->
entry.tqe_next = (i); *(i)->entry.tqe_prev = (ta); (i)->
entry.tqe_prev = &(ta)->entry.tqe_next; } while (0);
	return;
}
}
TAILQ_INSERT_TAIL(tah, ta, entry)do { (ta)->entry.tqe_next = ((void*)0); (ta)->entry.tqe_prev
 = (tah)->tqh_last; *(tah)->tqh_last = (ta); (tah)->
tqh_last = &(ta)->entry.tqe_next; } while (0);
1386}

1388void
1389free_tas(struct trust_anchor_head *tah)
1390{
struct trust_anchor	*ta;

while ((ta = TAILQ_FIRST(tah)((tah)->tqh_first))) {
TAILQ_REMOVE(tah, ta, entry)do { if (((ta)->entry.tqe_next) != ((void*)0)) (ta)->entry
.tqe_next->entry.tqe_prev = (ta)->entry.tqe_prev; else (
tah)->tqh_last = (ta)->entry.tqe_prev; *(ta)->entry.
tqe_prev = (ta)->entry.tqe_next; ; ; } while (0);
free(ta->ta);
free(ta);
}
1398}

1400int
1401merge_tas(struct trust_anchor_head *newh, struct trust_anchor_head *oldh)
1402{
struct trust_anchor	*i, *j;
int			 chg = 0;

j = TAILQ_FIRST(oldh)((oldh)->tqh_first);

TAILQ_FOREACH(i, newh, entry)for((i) = ((newh)->tqh_first); (i) != ((void*)0); (i) = ((
i)->entry.tqe_next)) {
if (j == NULL((void*)0) || strcmp(i->ta, j->ta) != 0) {
	chg = 1;
	break;
}
j = TAILQ_NEXT(j, entry)((j)->entry.tqe_next);
}
if (j != NULL((void*)0))
chg = 1;

if (chg) {
free_tas(oldh);
TAILQ_CONCAT(oldh, newh, entry)do { if (!(((newh)->tqh_first) == ((void*)0))) { *(oldh)->
tqh_last = (newh)->tqh_first; (newh)->tqh_first->entry
.tqe_prev = (oldh)->tqh_last; (oldh)->tqh_last = (newh)
->tqh_last; do { ((newh))->tqh_first = ((void*)0); ((newh
))->tqh_last = &((newh))->tqh_first; } while (0); }
 } while (0);
} else {
free_tas(newh);
}
return (chg);
1425}

1427void
1428parse_trust_anchor(struct trust_anchor_head *tah, int fd)
1429{
size_t	 len, dname_len;
ssize_t	 n, sz;
uint8_t	 rr[LDNS_RR_BUF_SIZE65535];
char	*str, *p, buf[512], *line;

sz = 0;
str = NULL((void*)0);

while ((n = read(fd, buf, sizeof(buf))) > 0) {
p = recallocarray(str, sz, sz + n, 1);
if (p == NULL((void*)0)) {
	log_warn("%s", __func__)uw_log_warn("%s", __func__);
	goto out;
}
str = p;
memcpy(str + sz, buf, n);
sz += n;
}

if (n == -1) {
log_warn("%s", __func__)uw_log_warn("%s", __func__);
goto out;
}

/* make it a string */
p = recallocarray(str, sz, sz + 1, 1);
if (p == NULL((void*)0)) {
log_warn("%s", __func__)uw_log_warn("%s", __func__);
goto out;
}
str = p;
sz++;

len = sizeof(rr);

while ((line = strsep(&p, "\n")) != NULL((void*)0)) {
if (sldns_str2wire_rr_buf(line, rr, &len, &dname_len,
    ROOT_DNSKEY_TTL172800, NULL((void*)0), 0, NULL((void*)0), 0) != 0)
	continue;
if (sldns_wirerr_get_type(rr, len, dname_len) ==
    LDNS_RR_TYPE_DNSKEY)
	add_new_ta(tah, line);
}

1474out:
free(str);
return;
1477}

1479void
1480send_trust_anchors(struct trust_anchor_head *tah)
1481{
struct trust_anchor	*ta;

TAILQ_FOREACH(ta, tah, entry)for((ta) = ((tah)->tqh_first); (ta) != ((void*)0); (ta) = (
(ta)->entry.tqe_next))
frontend_imsg_compose_resolver(IMSG_NEW_TA, 0, ta->ta,
    strlen(ta->ta) + 1);
frontend_imsg_compose_resolver(IMSG_NEW_TAS_DONE, 0, NULL((void*)0), 0);
1488}

1490void
1491write_trust_anchors(struct trust_anchor_head *tah, int fd)
1492{
struct trust_anchor	*ta;
size_t			 len = 0;
ssize_t			 n;
char			*str;

if (lseek(fd, 0, SEEK_SET0) == -1) {
log_warn("%s", __func__)uw_log_warn("%s", __func__);
goto out;
}

TAILQ_FOREACH(ta, tah, entry)for((ta) = ((tah)->tqh_first); (ta) != ((void*)0); (ta) = (
(ta)->entry.tqe_next)) {
if ((n = asprintf(&str, "%s\n", ta->ta)) == -1) {
	log_warn("%s", __func__)uw_log_warn("%s", __func__);
	len = 0;
	goto out;
}
len += n;
if (write(fd, str, n) != n) {
	log_warn("%s", __func__)uw_log_warn("%s", __func__);
	free(str);
	len = 0;
	goto out;
}
free(str);
}
1518out:
ftruncate(fd, len);
fsync(fd);
1521}

1523void
1524parse_blocklist(int fd)
1525{
FILE		 *f;
struct bl_node	*bl_node;
char		 *line = NULL((void*)0);
size_t		  linesize = 0;
ssize_t		  linelen;

if((f = fdopen(fd, "r")) == NULL((void*)0)) {
log_warn("cannot read block list")uw_log_warn("cannot read block list");
close(fd);
return;
}

free_bl();

while ((linelen = getline(&line, &linesize, f)) != -1) {
if (line[linelen - 1] == '\n') {
	if (linelen >= 2 && line[linelen - 2] != '.')
		line[linelen - 1] = '.';
	else
		line[linelen - 1] = '\0';
}

bl_node = malloc(sizeof *bl_node);
if (bl_node == NULL((void*)0))
	fatal("%s: malloc", __func__);
if ((bl_node->domain = strdup(line)) == NULL((void*)0))
	fatal("%s: strdup", __func__);
if (RB_INSERT(bl_tree, &bl_head, bl_node)bl_tree_RB_INSERT(&bl_head, bl_node) != NULL((void*)0)) {
	log_warnx("duplicate blocked domain \"%s\"", line);
	free(bl_node->domain);
	free(bl_node);
}
}
free(line);
if (ferror(f)(!__isthreaded ? (((f)->_flags & 0x0040) != 0) : (ferror
)(f)))
log_warn("getline")uw_log_warn("getline");
fclose(f);
1563}

1565int
1566bl_cmp(struct bl_node *e1, struct bl_node *e2) {
return (strcasecmp(e1->domain, e2->domain));
1568}

1570void
1571free_bl(void)
1572{
struct bl_node	*n, *nxt;

RB_FOREACH_SAFE(n, bl_tree, &bl_head, nxt)for ((n) = bl_tree_RB_MINMAX(&bl_head, -1); ((n) != ((void
*)0)) && ((nxt) = bl_tree_RB_NEXT(n), 1); (n) = (nxt)
) {
RB_REMOVE(bl_tree, &bl_head, n)bl_tree_RB_REMOVE(&bl_head, n);
free(n->domain);
free(n);
}
1580}

1582int
1583pending_query_cnt(void)
1584{
struct pending_query	*e;
int			 cnt = 0;

TAILQ_FOREACH(e, &pending_queries, entry)for((e) = ((&pending_queries)->tqh_first); (e) != ((void
*)0); (e) = ((e)->entry.tqe_next))
cnt++;
return cnt;
1591}

1593void
1594accept_paused(int fd, short events, void *arg)
1595{
struct tcp_accept_ev	*tcpev = arg;
event_add(&tcpev->ev, NULL((void*)0));
1598}

1600int
1601accept_reserve(int sockfd, struct sockaddr *addr, socklen_t *addrlen)
1602{
if (getdtablecount() + FD_RESERVE5 >= getdtablesize()) {
log_debug("%s: inflight fds exceeded", __func__);
errno(*__errno()) = EMFILE24;
return -1;
}
return accept4(sockfd, addr, addrlen, SOCK_NONBLOCK0x4000 | SOCK_CLOEXEC0x8000);
1609}

1611void
1612tcp_accept(int fd, short events, void *arg)
1613{
static struct timeval	 timeout = {TCP_TIMEOUT15, 0};
static struct timeval	 backoff = {1, 0};
struct pending_query	*pq;
struct tcp_accept_ev	*tcpev;
struct sockaddr_storage	 ss;
socklen_t		 len;
int			 s;

tcpev = arg;
len = sizeof(ss);

if ((s = accept_reserve(fd, (struct sockaddr *)&ss, &len)) == -1) {
switch (errno(*__errno())) {
case EINTR4:
case EWOULDBLOCK35:
case ECONNABORTED53:
	return;
case EMFILE24:
case ENFILE23:
	event_del(&tcpev->ev);
	evtimer_add(&tcpev->pause, &backoff)event_add(&tcpev->pause, &backoff);
	return;
default:
	fatal("accept");
}
}

if ((pq = calloc(1, sizeof(*pq))) == NULL((void*)0)) {
log_warn(NULL)uw_log_warn(((void*)0));
close(s);
return;
}

do {
arc4random_buf(&pq->imsg_id, sizeof(pq->imsg_id));
} while(find_pending_query(pq->imsg_id) != NULL((void*)0));

TAILQ_INSERT_TAIL(&pending_queries, pq, entry)do { (pq)->entry.tqe_next = ((void*)0); (pq)->entry.tqe_prev
 = (&pending_queries)->tqh_last; *(&pending_queries
)->tqh_last = (pq); (&pending_queries)->tqh_last = &
(pq)->entry.tqe_next; } while (0);

pq->from = ss;
pq->fd = s;
pq->tcp = 1;
pq->qbuf = sldns_buffer_new(DEFAULT_TCP_SIZE512);
pq->region = regional_create();
pq->qmsg = regional_alloc(pq->region, sizeof(*pq->qmsg));

if (!pq->qbuf || !pq->region || !pq->qmsg) {
free_pending_query(pq);
return;
}

memset(pq->qmsg, 0, sizeof(*pq->qmsg));

event_set(&pq->ev, s, EV_READ0x02 | EV_PERSIST0x10, tcp_request, pq);
event_add(&pq->ev, NULL((void*)0));
event_set(&pq->resp_ev, s, EV_WRITE0x04 | EV_PERSIST0x10, tcp_response, pq);

evtimer_set(&pq->tmo_ev, tcp_timeout, pq)event_set(&pq->tmo_ev, -1, 0, tcp_timeout, pq);
evtimer_add(&pq->tmo_ev, &timeout)event_add(&pq->tmo_ev, &timeout);
1673}

1675void
1676tcp_request(int fd, short events, void *arg)
1677{
struct pending_query	*pq;
ssize_t			 n;

pq = arg;

n = read(fd, sldns_buffer_current(pq->qbuf),
   sldns_buffer_remaining(pq->qbuf));

switch (n) {
case -1:
switch (errno(*__errno())) {
case EINTR4:
case EAGAIN35:
	return;
default:
	goto fail;
}
break;
case 0:
log_debug("closed connection");
goto fail;
default:
break;
}

sldns_buffer_skip(pq->qbuf, n);

if (sldns_buffer_position(pq->qbuf) >= 2 && !pq->abuf) {
struct sldns_buffer	*tmp;
uint16_t		 len;

sldns_buffer_flip(pq->qbuf);
len = sldns_buffer_read_u16(pq->qbuf);
tmp = sldns_buffer_new(len);
pq->abuf = sldns_buffer_new(len);

if (!tmp || !pq->abuf)
	goto fail;

sldns_buffer_write(tmp, sldns_buffer_current(pq->qbuf),
    sldns_buffer_remaining(pq->qbuf));
sldns_buffer_free(pq->qbuf);
pq->qbuf = tmp;
}
if (sldns_buffer_remaining(pq->qbuf) == 0) {
sldns_buffer_flip(pq->qbuf);
shutdown(fd, SHUT_RD0);
event_del(&pq->ev);
handle_query(pq);
}
return;
1729fail:
free_pending_query(pq);
1731}

1733void
1734tcp_response(int fd, short events, void *arg)
1735{
struct pending_query	*pq;
ssize_t			 n;

pq = arg;

n = write(fd, sldns_buffer_current(pq->abuf),
   sldns_buffer_remaining(pq->abuf));

if (n == -1) {
1
Assuming the condition is true→
2
←
Taking true branch→
if (errno(*__errno()) == EAGAIN35 || errno(*__errno()) == EINTR4)
3
←
Assuming the condition is false→
4
←
Assuming the condition is false→
5
←
Taking false branch→
	return;
free_pending_query(pq);
6
←
Calling 'free_pending_query'→
14
←
Returning; memory was released via 1st parameter→
}
sldns_buffer_skip(pq->abuf, n);
15
←
Use of memory after it is freed
if (sldns_buffer_remaining(pq->abuf) == 0)
free_pending_query(pq);
1752}

1754void
1755tcp_timeout(int fd, short events, void *arg)
1756{
free_pending_query(arg);
1758}

1760void
1761check_available_af()
1762{
static int		 available_af = HAVE_IPV41 | HAVE_IPV62;
static int		 rtable = -1;
struct ifaddrs		*ifap, *ifa;
struct if_data		*ifa_data;
struct sockaddr_in	*sin4;
struct sockaddr_in6	*sin6;
int			 new_available_af = 0, ifa_rtable = -1;

if (rtable == -1)
rtable = getrtable();

if (getifaddrs(&ifap) != 0) {
log_warn("getifaddrs")uw_log_warn("getifaddrs");
return;
}

for (ifa = ifap; ifa != NULL((void*)0); ifa = ifa->ifa_next) {
if (ifa->ifa_addr == NULL((void*)0))
	continue;
switch(ifa->ifa_addr->sa_family) {
case AF_LINK18:
	/* AF_LINK comes before inet / inet6 on an interface */
	ifa_data = (struct if_data *)ifa->ifa_data;
	ifa_rtable = ifa_data->ifi_rdomain;
	break;
case AF_INET2:
	if (ifa_rtable != rtable)
		continue;

	sin4 = (struct sockaddr_in *)ifa->ifa_addr;
	if ((ntohl(sin4->sin_addr.s_addr)(__uint32_t)(__builtin_constant_p(sin4->sin_addr.s_addr) ?
 (__uint32_t)(((__uint32_t)(sin4->sin_addr.s_addr) & 0xff
) << 24 | ((__uint32_t)(sin4->sin_addr.s_addr) &
 0xff00) << 8 | ((__uint32_t)(sin4->sin_addr.s_addr)
 & 0xff0000) >> 8 | ((__uint32_t)(sin4->sin_addr
.s_addr) & 0xff000000) >> 24) : __swap32md(sin4->
sin_addr.s_addr)) >> 24) ==
	    IN_LOOPBACKNET127)
		continue;
	new_available_af |= HAVE_IPV41;
	break;
case AF_INET624:
	if (ifa_rtable != rtable)
		continue;

	sin6 = (struct sockaddr_in6 *)ifa->ifa_addr;
	if (IN6_IS_ADDR_LOOPBACK(&sin6->sin6_addr)((*(const u_int32_t *)(const void *)(&(&sin6->sin6_addr
)->__u6_addr.__u6_addr8[0]) == 0) && (*(const u_int32_t
 *)(const void *)(&(&sin6->sin6_addr)->__u6_addr
.__u6_addr8[4]) == 0) && (*(const u_int32_t *)(const void
 *)(&(&sin6->sin6_addr)->__u6_addr.__u6_addr8[8
]) == 0) && (*(const u_int32_t *)(const void *)(&
(&sin6->sin6_addr)->__u6_addr.__u6_addr8[12]) == (__uint32_t
)(__builtin_constant_p(1) ? (__uint32_t)(((__uint32_t)(1) &
 0xff) << 24 | ((__uint32_t)(1) & 0xff00) << 8
 | ((__uint32_t)(1) & 0xff0000) >> 8 | ((__uint32_t
)(1) & 0xff000000) >> 24) : __swap32md(1)))) ||
	    IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)(((&sin6->sin6_addr)->__u6_addr.__u6_addr8[0] == 0xfe
) && (((&sin6->sin6_addr)->__u6_addr.__u6_addr8
[1] & 0xc0) == 0x80)) ||
	    IN6_IS_ADDR_MC_LINKLOCAL(&sin6->sin6_addr)(((&sin6->sin6_addr)->__u6_addr.__u6_addr8[0] == 0xff
) && (((&sin6->sin6_addr)->__u6_addr.__u6_addr8
[1] & 0x0f) == 0x02)) ||
	    IN6_IS_ADDR_MC_INTFACELOCAL(&sin6->sin6_addr)(((&sin6->sin6_addr)->__u6_addr.__u6_addr8[0] == 0xff
) && (((&sin6->sin6_addr)->__u6_addr.__u6_addr8
[1] & 0x0f) == 0x01)))
		continue;
	new_available_af |= HAVE_IPV62;
	break;
default:
	break;
}
if (new_available_af == (HAVE_IPV41 | HAVE_IPV62))
	break;
}
freeifaddrs(ifap);
if (new_available_af != available_af) {
available_af = new_available_af;
frontend_imsg_compose_resolver(IMSG_CHANGE_AFS, 0,
    &available_af, sizeof(available_af));
}
1822}