1 /*
2 * daemon/daemon.c - collection of workers that handles requests.
3 *
4 * Copyright (c) 2007, NLnet Labs. All rights reserved.
5 *
6 * This software is open source.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * Redistributions of source code must retain the above copyright notice,
13 * this list of conditions and the following disclaimer.
14 *
15 * Redistributions in binary form must reproduce the above copyright notice,
16 * this list of conditions and the following disclaimer in the documentation
17 * and/or other materials provided with the distribution.
18 *
19 * Neither the name of the NLNET LABS nor the names of its contributors may
20 * be used to endorse or promote products derived from this software without
21 * specific prior written permission.
22 *
23 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
24 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
25 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
26 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
27 * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
28 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
29 * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
30 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
31 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
32 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
33 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
34 */
35
36 /**
37 * \file
38 *
39 * The daemon consists of global settings and a number of workers.
40 */
41
42 #include "config.h"
43 #ifdef HAVE_OPENSSL_ERR_H
44 #include <openssl/err.h>
45 #endif
46
47 #ifdef HAVE_OPENSSL_RAND_H
48 #include <openssl/rand.h>
49 #endif
50
51 #ifdef HAVE_OPENSSL_CONF_H
52 #include <openssl/conf.h>
53 #endif
54
55 #ifdef HAVE_OPENSSL_ENGINE_H
56 #include <openssl/engine.h>
57 #endif
58
59 #ifdef HAVE_TIME_H
60 #include <time.h>
61 #endif
62 #include <sys/time.h>
63
64 #ifdef HAVE_NSS
65 /* nss3 */
66 #include "nss.h"
67 #endif
68
69 #include "daemon/daemon.h"
70 #include "daemon/worker.h"
71 #include "daemon/remote.h"
72 #include "daemon/acl_list.h"
73 #include "util/log.h"
74 #include "util/config_file.h"
75 #include "util/data/msgreply.h"
76 #include "util/shm_side/shm_main.h"
77 #include "util/storage/lookup3.h"
78 #include "util/storage/slabhash.h"
79 #include "util/tcp_conn_limit.h"
80 #include "util/edns.h"
81 #include "services/listen_dnsport.h"
82 #include "services/cache/rrset.h"
83 #include "services/cache/infra.h"
84 #include "services/localzone.h"
85 #include "services/view.h"
86 #include "services/modstack.h"
87 #include "services/authzone.h"
88 #include "util/module.h"
89 #include "util/random.h"
90 #include "util/tube.h"
91 #include "util/net_help.h"
92 #include "sldns/keyraw.h"
93 #include "respip/respip.h"
94 #include "iterator/iter_fwd.h"
95 #include "iterator/iter_hints.h"
96 #include <signal.h>
97
98 #ifdef HAVE_SYSTEMD
99 #include <systemd/sd-daemon.h>
100 #endif
101 #ifdef HAVE_NETDB_H
102 #include <netdb.h>
103 #endif
104 #ifdef USE_CACHEDB
105 #include "cachedb/cachedb.h"
106 #endif
107
108 /** How many quit requests happened. */
109 static int sig_record_quit = 0;
110 /** How many reload requests happened. */
111 static int sig_record_reload = 0;
112
113 #if HAVE_DECL_SSL_COMP_GET_COMPRESSION_METHODS
114 /** cleaner ssl memory freeup */
115 static void* comp_meth = NULL;
116 #endif
117 /** remove buffers for parsing and init */
118 int ub_c_lex_destroy(void);
119
120 /** used when no other sighandling happens, so we don't die
121 * when multiple signals in quick succession are sent to us.
122 * @param sig: signal number.
123 * @return signal handler return type (void or int).
124 */
record_sigh(int sig)125 static RETSIGTYPE record_sigh(int sig)
126 {
127 #ifdef LIBEVENT_SIGNAL_PROBLEM
128 /* cannot log, verbose here because locks may be held */
129 /* quit on signal, no cleanup and statistics,
130 because installed libevent version is not threadsafe */
131 exit(0);
132 #endif
133 switch(sig)
134 {
135 case SIGTERM:
136 #ifdef SIGQUIT
137 case SIGQUIT:
138 #endif
139 #ifdef SIGBREAK
140 case SIGBREAK:
141 #endif
142 case SIGINT:
143 sig_record_quit++;
144 break;
145 #ifdef SIGHUP
146 case SIGHUP:
147 sig_record_reload++;
148 break;
149 #endif
150 #ifdef SIGPIPE
151 case SIGPIPE:
152 break;
153 #endif
154 default:
155 /* ignoring signal */
156 break;
157 }
158 }
159
160 /**
161 * Signal handling during the time when netevent is disabled.
162 * Stores signals to replay later.
163 */
164 static void
signal_handling_record(void)165 signal_handling_record(void)
166 {
167 if( signal(SIGTERM, record_sigh) == SIG_ERR ||
168 #ifdef SIGQUIT
169 signal(SIGQUIT, record_sigh) == SIG_ERR ||
170 #endif
171 #ifdef SIGBREAK
172 signal(SIGBREAK, record_sigh) == SIG_ERR ||
173 #endif
174 #ifdef SIGHUP
175 signal(SIGHUP, record_sigh) == SIG_ERR ||
176 #endif
177 #ifdef SIGPIPE
178 signal(SIGPIPE, SIG_IGN) == SIG_ERR ||
179 #endif
180 signal(SIGINT, record_sigh) == SIG_ERR
181 )
182 log_err("install sighandler: %s", strerror(errno));
183 }
184
185 /**
186 * Replay old signals.
187 * @param wrk: worker that handles signals.
188 */
189 static void
signal_handling_playback(struct worker * wrk)190 signal_handling_playback(struct worker* wrk)
191 {
192 #ifdef SIGHUP
193 if(sig_record_reload)
194 worker_sighandler(SIGHUP, wrk);
195 #endif
196 if(sig_record_quit)
197 worker_sighandler(SIGTERM, wrk);
198 sig_record_quit = 0;
199 sig_record_reload = 0;
200 }
201
202 struct daemon*
daemon_init(void)203 daemon_init(void)
204 {
205 struct daemon* daemon = (struct daemon*)calloc(1,
206 sizeof(struct daemon));
207 #ifdef USE_WINSOCK
208 int r;
209 WSADATA wsa_data;
210 #endif
211 if(!daemon)
212 return NULL;
213 #ifdef USE_WINSOCK
214 r = WSAStartup(MAKEWORD(2,2), &wsa_data);
215 if(r != 0) {
216 fatal_exit("could not init winsock. WSAStartup: %s",
217 wsa_strerror(r));
218 }
219 #endif /* USE_WINSOCK */
220 signal_handling_record();
221 #ifdef HAVE_SSL
222 # ifdef HAVE_ERR_LOAD_CRYPTO_STRINGS
223 ERR_load_crypto_strings();
224 # endif
225 #if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_SSL)
226 ERR_load_SSL_strings();
227 #endif
228 # ifdef USE_GOST
229 (void)sldns_key_EVP_load_gost_id();
230 # endif
231 # if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_CRYPTO)
232 # ifndef S_SPLINT_S
233 OpenSSL_add_all_algorithms();
234 # endif
235 # else
236 OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS
237 | OPENSSL_INIT_ADD_ALL_DIGESTS
238 | OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL);
239 # endif
240 # if HAVE_DECL_SSL_COMP_GET_COMPRESSION_METHODS
241 /* grab the COMP method ptr because openssl leaks it */
242 comp_meth = (void*)SSL_COMP_get_compression_methods();
243 # endif
244 # if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_SSL)
245 (void)SSL_library_init();
246 # else
247 (void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL);
248 # endif
249 # if defined(HAVE_SSL) && defined(OPENSSL_THREADS) && !defined(THREADS_DISABLED)
250 if(!ub_openssl_lock_init())
251 fatal_exit("could not init openssl locks");
252 # endif
253 #elif defined(HAVE_NSS)
254 if(NSS_NoDB_Init(NULL) != SECSuccess)
255 fatal_exit("could not init NSS");
256 #endif /* HAVE_SSL or HAVE_NSS */
257 #ifdef HAVE_TZSET
258 /* init timezone info while we are not chrooted yet */
259 tzset();
260 #endif
261 daemon->need_to_exit = 0;
262 modstack_init(&daemon->mods);
263 if(!(daemon->env = (struct module_env*)calloc(1,
264 sizeof(*daemon->env)))) {
265 free(daemon);
266 return NULL;
267 }
268 daemon->env->modstack = &daemon->mods;
269 /* init edns_known_options */
270 if(!edns_known_options_init(daemon->env)) {
271 free(daemon->env);
272 free(daemon);
273 return NULL;
274 }
275 alloc_init(&daemon->superalloc, NULL, 0);
276 daemon->acl = acl_list_create();
277 if(!daemon->acl) {
278 edns_known_options_delete(daemon->env);
279 free(daemon->env);
280 free(daemon);
281 return NULL;
282 }
283 daemon->acl_interface = acl_list_create();
284 if(!daemon->acl_interface) {
285 acl_list_delete(daemon->acl);
286 edns_known_options_delete(daemon->env);
287 free(daemon->env);
288 free(daemon);
289 return NULL;
290 }
291 daemon->tcl = tcl_list_create();
292 if(!daemon->tcl) {
293 acl_list_delete(daemon->acl_interface);
294 acl_list_delete(daemon->acl);
295 edns_known_options_delete(daemon->env);
296 free(daemon->env);
297 free(daemon);
298 return NULL;
299 }
300 listen_setup_locks();
301 if(gettimeofday(&daemon->time_boot, NULL) < 0)
302 log_err("gettimeofday: %s", strerror(errno));
303 daemon->time_last_stat = daemon->time_boot;
304 if((daemon->env->auth_zones = auth_zones_create()) == 0) {
305 acl_list_delete(daemon->acl_interface);
306 acl_list_delete(daemon->acl);
307 tcl_list_delete(daemon->tcl);
308 edns_known_options_delete(daemon->env);
309 free(daemon->env);
310 free(daemon);
311 return NULL;
312 }
313 if(!(daemon->env->edns_strings = edns_strings_create())) {
314 auth_zones_delete(daemon->env->auth_zones);
315 acl_list_delete(daemon->acl_interface);
316 acl_list_delete(daemon->acl);
317 tcl_list_delete(daemon->tcl);
318 edns_known_options_delete(daemon->env);
319 free(daemon->env);
320 free(daemon);
321 return NULL;
322 }
323 return daemon;
324 }
325
setup_acl_for_ports(struct acl_list * list,struct listen_port * port_list)326 int setup_acl_for_ports(struct acl_list* list, struct listen_port* port_list)
327 {
328 struct acl_addr* acl_node;
329 for(; port_list; port_list=port_list->next) {
330 if(!port_list->socket) {
331 /* This is mainly for testbound where port_list is
332 * empty. */
333 continue;
334 }
335 if(!(acl_node = acl_interface_insert(list,
336 (struct sockaddr_storage*)port_list->socket->addr,
337 port_list->socket->addrlen,
338 acl_refuse))) {
339 return 0;
340 }
341 port_list->socket->acl = acl_node;
342 }
343 return 1;
344 }
345
346 int
daemon_open_shared_ports(struct daemon * daemon)347 daemon_open_shared_ports(struct daemon* daemon)
348 {
349 log_assert(daemon);
350 if(daemon->cfg->port != daemon->listening_port) {
351 char** resif = NULL;
352 int num_resif = 0;
353 size_t i;
354 struct listen_port* p0;
355 daemon->reuseport = 0;
356 /* free and close old ports */
357 if(daemon->ports != NULL) {
358 for(i=0; i<daemon->num_ports; i++)
359 listening_ports_free(daemon->ports[i]);
360 free(daemon->ports);
361 daemon->ports = NULL;
362 }
363 /* clean acl_interface */
364 acl_interface_init(daemon->acl_interface);
365 if(!resolve_interface_names(daemon->cfg->ifs,
366 daemon->cfg->num_ifs, NULL, &resif, &num_resif))
367 return 0;
368 /* see if we want to reuseport */
369 #ifdef SO_REUSEPORT
370 if(daemon->cfg->so_reuseport && daemon->cfg->num_threads > 0)
371 daemon->reuseport = 1;
372 #endif
373 /* try to use reuseport */
374 p0 = listening_ports_open(daemon->cfg, resif, num_resif,
375 &daemon->reuseport);
376 if(!p0) {
377 listening_ports_free(p0);
378 config_del_strarray(resif, num_resif);
379 return 0;
380 }
381 if(daemon->reuseport) {
382 /* reuseport was successful, allocate for it */
383 daemon->num_ports = (size_t)daemon->cfg->num_threads;
384 } else {
385 /* do the normal, singleportslist thing,
386 * reuseport not enabled or did not work */
387 daemon->num_ports = 1;
388 }
389 if(!(daemon->ports = (struct listen_port**)calloc(
390 daemon->num_ports, sizeof(*daemon->ports)))) {
391 listening_ports_free(p0);
392 config_del_strarray(resif, num_resif);
393 return 0;
394 }
395 daemon->ports[0] = p0;
396 if(!setup_acl_for_ports(daemon->acl_interface,
397 daemon->ports[0])) {
398 listening_ports_free(p0);
399 config_del_strarray(resif, num_resif);
400 return 0;
401 }
402 if(daemon->reuseport) {
403 /* continue to use reuseport */
404 for(i=1; i<daemon->num_ports; i++) {
405 if(!(daemon->ports[i]=
406 listening_ports_open(daemon->cfg,
407 resif, num_resif,
408 &daemon->reuseport))
409 || !daemon->reuseport ) {
410 for(i=0; i<daemon->num_ports; i++)
411 listening_ports_free(daemon->ports[i]);
412 free(daemon->ports);
413 daemon->ports = NULL;
414 config_del_strarray(resif, num_resif);
415 return 0;
416 }
417 if(!setup_acl_for_ports(daemon->acl_interface,
418 daemon->ports[i])) {
419 for(i=0; i<daemon->num_ports; i++)
420 listening_ports_free(daemon->ports[i]);
421 free(daemon->ports);
422 daemon->ports = NULL;
423 config_del_strarray(resif, num_resif);
424 return 0;
425 }
426 }
427 }
428 config_del_strarray(resif, num_resif);
429 daemon->listening_port = daemon->cfg->port;
430 }
431 if(!daemon->cfg->remote_control_enable && daemon->rc_port) {
432 listening_ports_free(daemon->rc_ports);
433 daemon->rc_ports = NULL;
434 daemon->rc_port = 0;
435 }
436 if(daemon->cfg->remote_control_enable &&
437 daemon->cfg->control_port != daemon->rc_port) {
438 listening_ports_free(daemon->rc_ports);
439 if(!(daemon->rc_ports=daemon_remote_open_ports(daemon->cfg)))
440 return 0;
441 daemon->rc_port = daemon->cfg->control_port;
442 }
443 return 1;
444 }
445
446 int
daemon_privileged(struct daemon * daemon)447 daemon_privileged(struct daemon* daemon)
448 {
449 daemon->env->cfg = daemon->cfg;
450 daemon->env->alloc = &daemon->superalloc;
451 daemon->env->worker = NULL;
452 if(!modstack_call_startup(&daemon->mods, daemon->cfg->module_conf,
453 daemon->env)) {
454 fatal_exit("failed to startup modules");
455 }
456 return 1;
457 }
458
459 /**
460 * Setup modules. setup module stack.
461 * @param daemon: the daemon
462 */
daemon_setup_modules(struct daemon * daemon)463 static void daemon_setup_modules(struct daemon* daemon)
464 {
465 daemon->env->cfg = daemon->cfg;
466 daemon->env->alloc = &daemon->superalloc;
467 daemon->env->worker = NULL;
468 if(daemon->mods_inited) {
469 modstack_call_deinit(&daemon->mods, daemon->env);
470 }
471 daemon->env->need_to_validate = 0; /* set by module init below */
472 if(!modstack_call_init(&daemon->mods, daemon->cfg->module_conf,
473 daemon->env)) {
474 fatal_exit("failed to init modules");
475 }
476 daemon->mods_inited = 1;
477 log_edns_known_options(VERB_ALGO, daemon->env);
478 }
479
480 /**
481 * Obtain allowed port numbers, concatenate the list, and shuffle them
482 * (ready to be handed out to threads).
483 * @param daemon: the daemon. Uses rand and cfg.
484 * @param shufport: the portlist output.
485 * @return number of ports available.
486 */
daemon_get_shufport(struct daemon * daemon,int * shufport)487 static int daemon_get_shufport(struct daemon* daemon, int* shufport)
488 {
489 int i, n, k, temp;
490 int avail = 0;
491 for(i=0; i<65536; i++) {
492 if(daemon->cfg->outgoing_avail_ports[i]) {
493 shufport[avail++] = daemon->cfg->
494 outgoing_avail_ports[i];
495 }
496 }
497 if(avail == 0)
498 fatal_exit("no ports are permitted for UDP, add "
499 "with outgoing-port-permit");
500 /* Knuth shuffle */
501 n = avail;
502 while(--n > 0) {
503 k = ub_random_max(daemon->rand, n+1); /* 0<= k<= n */
504 temp = shufport[k];
505 shufport[k] = shufport[n];
506 shufport[n] = temp;
507 }
508 return avail;
509 }
510
511 /**
512 * Clear and delete per-worker alloc caches, and free memory maintained in
513 * superalloc.
514 * The rrset and message caches must be empty at the time of call.
515 * @param daemon: the daemon that maintains the alloc caches to be cleared.
516 */
517 static void
daemon_clear_allocs(struct daemon * daemon)518 daemon_clear_allocs(struct daemon* daemon)
519 {
520 int i;
521
522 /* daemon->num may be different during reloads (after configuration
523 * read). Use old_num which has the correct value used to setup the
524 * worker_allocs */
525 for(i=0; i<daemon->old_num; i++) {
526 alloc_clear(daemon->worker_allocs[i]);
527 free(daemon->worker_allocs[i]);
528 }
529 free(daemon->worker_allocs);
530 daemon->worker_allocs = NULL;
531
532 alloc_clear_special(&daemon->superalloc);
533 }
534
535 /**
536 * Allocate empty worker structures. With backptr and thread-number,
537 * from 0..numthread initialised. Used as user arguments to new threads.
538 * Creates the daemon random generator if it does not exist yet.
539 * The random generator stays existing between reloads with a unique state.
540 * @param daemon: the daemon with (new) config settings.
541 */
542 static void
daemon_create_workers(struct daemon * daemon)543 daemon_create_workers(struct daemon* daemon)
544 {
545 int i, numport;
546 int* shufport;
547 log_assert(daemon && daemon->cfg);
548 if(!daemon->rand) {
549 daemon->rand = ub_initstate(NULL);
550 if(!daemon->rand)
551 fatal_exit("could not init random generator");
552 hash_set_raninit((uint32_t)ub_random(daemon->rand));
553 }
554 shufport = (int*)calloc(65536, sizeof(int));
555 if(!shufport)
556 fatal_exit("out of memory during daemon init");
557 numport = daemon_get_shufport(daemon, shufport);
558 verbose(VERB_ALGO, "total of %d outgoing ports available", numport);
559
560 #ifdef HAVE_NGTCP2
561 daemon->doq_table = doq_table_create(daemon->cfg, daemon->rand);
562 if(!daemon->doq_table)
563 fatal_exit("could not create doq_table: out of memory");
564 #endif
565
566 daemon->num = (daemon->cfg->num_threads?daemon->cfg->num_threads:1);
567 if(daemon->reuseport && (int)daemon->num < (int)daemon->num_ports) {
568 log_warn("cannot reduce num-threads to %d because so-reuseport "
569 "so continuing with %d threads.", (int)daemon->num,
570 (int)daemon->num_ports);
571 daemon->num = (int)daemon->num_ports;
572 }
573 daemon->workers = (struct worker**)calloc((size_t)daemon->num,
574 sizeof(struct worker*));
575 if(!daemon->workers)
576 fatal_exit("out of memory during daemon init");
577 if(daemon->cfg->dnstap) {
578 #ifdef USE_DNSTAP
579 daemon->dtenv = dt_create(daemon->cfg);
580 if (!daemon->dtenv)
581 fatal_exit("dt_create failed");
582 #else
583 fatal_exit("dnstap enabled in config but not built with dnstap support");
584 #endif
585 }
586 for(i=0; i<daemon->num; i++) {
587 if(!(daemon->workers[i] = worker_create(daemon, i,
588 shufport+numport*i/daemon->num,
589 numport*(i+1)/daemon->num - numport*i/daemon->num)))
590 /* the above is not ports/numthr, due to rounding */
591 fatal_exit("could not create worker");
592 }
593 /* create per-worker alloc caches if not reusing existing ones. */
594 if(!daemon->worker_allocs) {
595 daemon->worker_allocs = (struct alloc_cache**)calloc(
596 (size_t)daemon->num, sizeof(struct alloc_cache*));
597 if(!daemon->worker_allocs)
598 fatal_exit("could not allocate worker allocs");
599 for(i=0; i<daemon->num; i++) {
600 struct alloc_cache* alloc = calloc(1,
601 sizeof(struct alloc_cache));
602 if (!alloc)
603 fatal_exit("could not allocate worker alloc");
604 alloc_init(alloc, &daemon->superalloc, i);
605 daemon->worker_allocs[i] = alloc;
606 }
607 }
608 free(shufport);
609 }
610
611 #ifdef THREADS_DISABLED
612 /**
613 * Close all pipes except for the numbered thread.
614 * @param daemon: daemon to close pipes in.
615 * @param thr: thread number 0..num-1 of thread to skip.
616 */
close_other_pipes(struct daemon * daemon,int thr)617 static void close_other_pipes(struct daemon* daemon, int thr)
618 {
619 int i;
620 for(i=0; i<daemon->num; i++)
621 if(i!=thr) {
622 if(i==0) {
623 /* only close read part, need to write stats */
624 tube_close_read(daemon->workers[i]->cmd);
625 } else {
626 /* complete close channel to others */
627 tube_delete(daemon->workers[i]->cmd);
628 daemon->workers[i]->cmd = NULL;
629 }
630 }
631 }
632 #endif /* THREADS_DISABLED */
633
634 /**
635 * Function to start one thread.
636 * @param arg: user argument.
637 * @return: void* user return value could be used for thread_join results.
638 */
639 static void*
thread_start(void * arg)640 thread_start(void* arg)
641 {
642 struct worker* worker = (struct worker*)arg;
643 int port_num = 0;
644 log_thread_set(&worker->thread_num);
645 ub_thread_blocksigs();
646 #ifdef THREADS_DISABLED
647 /* close pipe ends used by main */
648 tube_close_write(worker->cmd);
649 close_other_pipes(worker->daemon, worker->thread_num);
650 #endif
651 #ifdef SO_REUSEPORT
652 if(worker->daemon->cfg->so_reuseport)
653 port_num = worker->thread_num % worker->daemon->num_ports;
654 else
655 port_num = 0;
656 #endif
657 if(!worker_init(worker, worker->daemon->cfg,
658 worker->daemon->ports[port_num], 0))
659 fatal_exit("Could not initialize thread");
660
661 worker_work(worker);
662 return NULL;
663 }
664
665 /**
666 * Fork and init the other threads. Main thread returns for special handling.
667 * @param daemon: the daemon with other threads to fork.
668 */
669 static void
daemon_start_others(struct daemon * daemon)670 daemon_start_others(struct daemon* daemon)
671 {
672 int i;
673 log_assert(daemon);
674 verbose(VERB_ALGO, "start threads");
675 /* skip i=0, is this thread */
676 for(i=1; i<daemon->num; i++) {
677 ub_thread_create(&daemon->workers[i]->thr_id,
678 thread_start, daemon->workers[i]);
679 #ifdef THREADS_DISABLED
680 /* close pipe end of child */
681 tube_close_read(daemon->workers[i]->cmd);
682 #endif /* no threads */
683 }
684 }
685
686 /**
687 * Stop the other threads.
688 * @param daemon: the daemon with other threads.
689 */
690 static void
daemon_stop_others(struct daemon * daemon)691 daemon_stop_others(struct daemon* daemon)
692 {
693 int i;
694 log_assert(daemon);
695 verbose(VERB_ALGO, "stop threads");
696 /* skip i=0, is this thread */
697 /* use i=0 buffer for sending cmds; because we are #0 */
698 for(i=1; i<daemon->num; i++) {
699 worker_send_cmd(daemon->workers[i], worker_cmd_quit);
700 }
701 /* wait for them to quit */
702 for(i=1; i<daemon->num; i++) {
703 /* join it to make sure its dead */
704 verbose(VERB_ALGO, "join %d", i);
705 ub_thread_join(daemon->workers[i]->thr_id);
706 verbose(VERB_ALGO, "join success %d", i);
707 }
708 }
709
710 void
daemon_fork(struct daemon * daemon)711 daemon_fork(struct daemon* daemon)
712 {
713 int have_view_respip_cfg = 0;
714 #ifdef HAVE_SYSTEMD
715 int ret;
716 #endif
717
718 log_assert(daemon);
719 if(!(daemon->env->views = views_create()))
720 fatal_exit("Could not create views: out of memory");
721 /* create individual views and their localzone/data trees */
722 if(!views_apply_cfg(daemon->env->views, daemon->cfg))
723 fatal_exit("Could not set up views");
724
725 if(!acl_list_apply_cfg(daemon->acl, daemon->cfg, daemon->env->views))
726 fatal_exit("Could not setup access control list");
727 if(!acl_interface_apply_cfg(daemon->acl_interface, daemon->cfg,
728 daemon->env->views))
729 fatal_exit("Could not setup interface control list");
730 if(!tcl_list_apply_cfg(daemon->tcl, daemon->cfg))
731 fatal_exit("Could not setup TCP connection limits");
732 if(daemon->cfg->dnscrypt) {
733 #ifdef USE_DNSCRYPT
734 daemon->dnscenv = dnsc_create();
735 if (!daemon->dnscenv)
736 fatal_exit("dnsc_create failed");
737 dnsc_apply_cfg(daemon->dnscenv, daemon->cfg);
738 #else
739 fatal_exit("dnscrypt enabled in config but unbound was not built with "
740 "dnscrypt support");
741 #endif
742 }
743 if(daemon->cfg->cookie_secret_file &&
744 daemon->cfg->cookie_secret_file[0]) {
745 if(!(daemon->cookie_secrets = cookie_secrets_create()))
746 fatal_exit("Could not create cookie_secrets: out of memory");
747 if(!cookie_secrets_apply_cfg(daemon->cookie_secrets,
748 daemon->cfg->cookie_secret_file))
749 fatal_exit("Could not setup cookie_secrets");
750 }
751 /* create global local_zones */
752 if(!(daemon->local_zones = local_zones_create()))
753 fatal_exit("Could not create local zones: out of memory");
754 if(!local_zones_apply_cfg(daemon->local_zones, daemon->cfg))
755 fatal_exit("Could not set up local zones");
756 if(!(daemon->env->fwds = forwards_create()) ||
757 !forwards_apply_cfg(daemon->env->fwds, daemon->cfg))
758 fatal_exit("Could not set forward zones");
759 if(!(daemon->env->hints = hints_create()) ||
760 !hints_apply_cfg(daemon->env->hints, daemon->cfg))
761 fatal_exit("Could not set root or stub hints");
762
763 /* process raw response-ip configuration data */
764 if(!(daemon->env->respip_set = respip_set_create()))
765 fatal_exit("Could not create response IP set");
766 if(!respip_global_apply_cfg(daemon->env->respip_set, daemon->cfg))
767 fatal_exit("Could not set up response IP set");
768 if(!respip_views_apply_cfg(daemon->env->views, daemon->cfg,
769 &have_view_respip_cfg))
770 fatal_exit("Could not set up per-view response IP sets");
771 daemon->use_response_ip = !respip_set_is_empty(
772 daemon->env->respip_set) || have_view_respip_cfg;
773
774 /* setup modules */
775 daemon_setup_modules(daemon);
776
777 /* read auth zonefiles */
778 if(!auth_zones_apply_cfg(daemon->env->auth_zones, daemon->cfg, 1,
779 &daemon->use_rpz, daemon->env, &daemon->mods))
780 fatal_exit("auth_zones could not be setup");
781
782 /* Set-up EDNS strings */
783 if(!edns_strings_apply_cfg(daemon->env->edns_strings, daemon->cfg))
784 fatal_exit("Could not set up EDNS strings");
785
786 #ifdef USE_CACHEDB
787 daemon->env->cachedb_enabled = cachedb_is_enabled(&daemon->mods,
788 daemon->env);
789 #endif
790 /* response-ip-xxx options don't work as expected without the respip
791 * module. To avoid run-time operational surprise we reject such
792 * configuration. */
793 if(daemon->use_response_ip &&
794 modstack_find(&daemon->mods, "respip") < 0)
795 fatal_exit("response-ip options require respip module");
796 /* RPZ response ip triggers don't work as expected without the respip
797 * module. To avoid run-time operational surprise we reject such
798 * configuration. */
799 if(daemon->use_rpz &&
800 modstack_find(&daemon->mods, "respip") < 0)
801 fatal_exit("RPZ requires the respip module");
802
803 /* first create all the worker structures, so we can pass
804 * them to the newly created threads.
805 */
806 daemon_create_workers(daemon);
807
808 #if defined(HAVE_EV_LOOP) || defined(HAVE_EV_DEFAULT_LOOP)
809 /* in libev the first inited base gets signals */
810 if(!worker_init(daemon->workers[0], daemon->cfg, daemon->ports[0], 1))
811 fatal_exit("Could not initialize main thread");
812 #endif
813
814 /* Now create the threads and init the workers.
815 * By the way, this is thread #0 (the main thread).
816 */
817 daemon_start_others(daemon);
818
819 /* Special handling for the main thread. This is the thread
820 * that handles signals and remote control.
821 */
822 #if !(defined(HAVE_EV_LOOP) || defined(HAVE_EV_DEFAULT_LOOP))
823 /* libevent has the last inited base get signals (or any base) */
824 if(!worker_init(daemon->workers[0], daemon->cfg, daemon->ports[0], 1))
825 fatal_exit("Could not initialize main thread");
826 #endif
827 signal_handling_playback(daemon->workers[0]);
828
829 if (!shm_main_init(daemon))
830 log_warn("SHM has failed");
831
832 /* Start resolver service on main thread. */
833 #ifdef HAVE_SYSTEMD
834 ret = sd_notify(0, "READY=1");
835 if(ret <= 0 && getenv("NOTIFY_SOCKET"))
836 fatal_exit("sd_notify failed %s: %s. Make sure that unbound has "
837 "access/permission to use the socket presented by systemd.",
838 getenv("NOTIFY_SOCKET"),
839 (ret==0?"no $NOTIFY_SOCKET": strerror(-ret)));
840 #endif
841 log_info("start of service (%s).", PACKAGE_STRING);
842 worker_work(daemon->workers[0]);
843 #ifdef HAVE_SYSTEMD
844 if (daemon->workers[0]->need_to_exit)
845 sd_notify(0, "STOPPING=1");
846 else
847 sd_notify(0, "RELOADING=1");
848 #endif
849 log_info("service stopped (%s).", PACKAGE_STRING);
850
851 /* we exited! a signal happened! Stop other threads */
852 daemon_stop_others(daemon);
853
854 /* Shutdown SHM */
855 shm_main_shutdown(daemon);
856
857 daemon->reuse_cache = daemon->workers[0]->reuse_cache;
858 daemon->need_to_exit = daemon->workers[0]->need_to_exit;
859 }
860
861 void
daemon_cleanup(struct daemon * daemon)862 daemon_cleanup(struct daemon* daemon)
863 {
864 int i;
865 log_assert(daemon);
866 /* before stopping main worker, handle signals ourselves, so we
867 don't die on multiple reload signals for example. */
868 signal_handling_record();
869 log_thread_set(NULL);
870 /* clean up caches because
871 * a) RRset IDs will be recycled after a reload, causing collisions
872 * b) validation config can change, thus rrset, msg, keycache clear
873 *
874 * If we are trying to keep the cache as long as possible, we should
875 * defer the cleanup until we know whether the new configuration allows
876 * the reuse. (If we're exiting, cleanup should be done here). */
877 if(!daemon->reuse_cache || daemon->need_to_exit) {
878 slabhash_clear(&daemon->env->rrset_cache->table);
879 slabhash_clear(daemon->env->msg_cache);
880 }
881 daemon->old_num = daemon->num; /* save the current num */
882 forwards_delete(daemon->env->fwds);
883 daemon->env->fwds = NULL;
884 hints_delete(daemon->env->hints);
885 daemon->env->hints = NULL;
886 local_zones_delete(daemon->local_zones);
887 daemon->local_zones = NULL;
888 respip_set_delete(daemon->env->respip_set);
889 daemon->env->respip_set = NULL;
890 views_delete(daemon->env->views);
891 daemon->env->views = NULL;
892 if(daemon->env->auth_zones)
893 auth_zones_cleanup(daemon->env->auth_zones);
894 /* key cache is cleared by module deinit during next daemon_fork() */
895 daemon_remote_clear(daemon->rc);
896 if(daemon->fast_reload_thread)
897 fast_reload_thread_stop(daemon->fast_reload_thread);
898 if(daemon->fast_reload_printq_list)
899 fast_reload_printq_list_delete(daemon->fast_reload_printq_list);
900 for(i=0; i<daemon->num; i++)
901 worker_delete(daemon->workers[i]);
902 free(daemon->workers);
903 daemon->workers = NULL;
904 /* Unless we're trying to keep the cache, worker alloc_caches should be
905 * cleared and freed here. We do this after deleting workers to
906 * guarantee that the alloc caches are valid throughout the lifetime
907 * of workers. */
908 if(!daemon->reuse_cache || daemon->need_to_exit)
909 daemon_clear_allocs(daemon);
910 daemon->num = 0;
911 #ifdef USE_DNSTAP
912 dt_delete(daemon->dtenv);
913 daemon->dtenv = NULL;
914 #endif
915 #ifdef USE_DNSCRYPT
916 dnsc_delete(daemon->dnscenv);
917 daemon->dnscenv = NULL;
918 #endif
919 #ifdef HAVE_NGTCP2
920 doq_table_delete(daemon->doq_table);
921 daemon->doq_table = NULL;
922 #endif
923 daemon->cfg = NULL;
924 }
925
926 void
daemon_delete(struct daemon * daemon)927 daemon_delete(struct daemon* daemon)
928 {
929 size_t i;
930 if(!daemon)
931 return;
932 modstack_call_deinit(&daemon->mods, daemon->env);
933 modstack_call_destartup(&daemon->mods, daemon->env);
934 modstack_free(&daemon->mods);
935 daemon_remote_delete(daemon->rc);
936 for(i = 0; i < daemon->num_ports; i++)
937 listening_ports_free(daemon->ports[i]);
938 free(daemon->ports);
939 listening_ports_free(daemon->rc_ports);
940 if(daemon->env) {
941 slabhash_delete(daemon->env->msg_cache);
942 rrset_cache_delete(daemon->env->rrset_cache);
943 infra_delete(daemon->env->infra_cache);
944 edns_known_options_delete(daemon->env);
945 edns_strings_delete(daemon->env->edns_strings);
946 auth_zones_delete(daemon->env->auth_zones);
947 }
948 ub_randfree(daemon->rand);
949 alloc_clear(&daemon->superalloc);
950 acl_list_delete(daemon->acl);
951 acl_list_delete(daemon->acl_interface);
952 tcl_list_delete(daemon->tcl);
953 cookie_secrets_delete(daemon->cookie_secrets);
954 listen_desetup_locks();
955 free(daemon->chroot);
956 free(daemon->pidfile);
957 free(daemon->cfgfile);
958 free(daemon->env);
959 #ifdef HAVE_SSL
960 listen_sslctx_delete_ticket_keys();
961 SSL_CTX_free((SSL_CTX*)daemon->listen_dot_sslctx);
962 SSL_CTX_free((SSL_CTX*)daemon->listen_doh_sslctx);
963 SSL_CTX_free((SSL_CTX*)daemon->connect_dot_sslctx);
964 #endif
965 #ifdef HAVE_NGTCP2
966 SSL_CTX_free((SSL_CTX*)daemon->listen_quic_sslctx);
967 #endif
968 free(daemon);
969 /* lex cleanup */
970 ub_c_lex_destroy();
971 /* libcrypto cleanup */
972 #ifdef HAVE_SSL
973 # if defined(USE_GOST)
974 sldns_key_EVP_unload_gost();
975 # endif
976 # if HAVE_DECL_SSL_COMP_GET_COMPRESSION_METHODS && HAVE_DECL_SK_SSL_COMP_POP_FREE
977 # ifndef S_SPLINT_S
978 # if OPENSSL_VERSION_NUMBER < 0x10100000
979 sk_SSL_COMP_pop_free(comp_meth, (void(*)())CRYPTO_free);
980 # endif
981 # endif
982 # endif
983 # ifdef HAVE_OPENSSL_CONFIG
984 EVP_cleanup();
985 # if (OPENSSL_VERSION_NUMBER < 0x10100000) && !defined(OPENSSL_NO_ENGINE) && defined(HAVE_ENGINE_CLEANUP)
986 ENGINE_cleanup();
987 # endif
988 CONF_modules_free();
989 # endif
990 # ifdef HAVE_CRYPTO_CLEANUP_ALL_EX_DATA
991 CRYPTO_cleanup_all_ex_data(); /* safe, no more threads right now */
992 # endif
993 # ifdef HAVE_ERR_FREE_STRINGS
994 ERR_free_strings();
995 # endif
996 # if OPENSSL_VERSION_NUMBER < 0x10100000
997 RAND_cleanup();
998 # endif
999 # if defined(HAVE_SSL) && defined(OPENSSL_THREADS) && !defined(THREADS_DISABLED)
1000 ub_openssl_lock_delete();
1001 # endif
1002 #ifndef HAVE_ARC4RANDOM
1003 _ARC4_LOCK_DESTROY();
1004 #endif
1005 #elif defined(HAVE_NSS)
1006 NSS_Shutdown();
1007 #endif /* HAVE_SSL or HAVE_NSS */
1008 checklock_stop();
1009 #ifdef USE_WINSOCK
1010 if(WSACleanup() != 0) {
1011 log_err("Could not WSACleanup: %s",
1012 wsa_strerror(WSAGetLastError()));
1013 }
1014 #endif
1015 }
1016
daemon_apply_cfg(struct daemon * daemon,struct config_file * cfg)1017 void daemon_apply_cfg(struct daemon* daemon, struct config_file* cfg)
1018 {
1019 int new_num = cfg->num_threads?cfg->num_threads:1;
1020
1021 daemon->cfg = cfg;
1022 config_apply(cfg);
1023
1024 /* If this is a reload and we deferred the decision on whether to
1025 * reuse the alloc, RRset, and message caches, then check to see if
1026 * it's safe to keep the caches:
1027 * - changing the number of threads is obviously incompatible with
1028 * keeping the per-thread alloc caches. It also means we have to
1029 * clear RRset and message caches. (note that 'new_num' may be
1030 * adjusted in daemon_create_workers, but for our purpose we can
1031 * simply compare it with 'old_num'; if they are equal here,
1032 * 'new_num' won't be adjusted to a different value than 'old_num').
1033 * - changing RRset cache size effectively clears any remaining cache
1034 * entries. We could keep their keys in alloc caches, but it would
1035 * be more consistent with the sense of the change to clear allocs
1036 * and free memory. To do so we also have to clear message cache.
1037 * - only changing message cache size does not necessarily affect
1038 * RRset or alloc cache. But almost all new subsequent queries will
1039 * require recursive resolution anyway, so it doesn't help much to
1040 * just keep RRset and alloc caches. For simplicity we clear/free
1041 * the other two, too. */
1042 if(daemon->worker_allocs &&
1043 (new_num != daemon->old_num ||
1044 !slabhash_is_size(daemon->env->msg_cache, cfg->msg_cache_size,
1045 cfg->msg_cache_slabs) ||
1046 !slabhash_is_size(&daemon->env->rrset_cache->table,
1047 cfg->rrset_cache_size, cfg->rrset_cache_slabs)))
1048 {
1049 log_warn("cannot reuse caches due to critical config change");
1050 slabhash_clear(&daemon->env->rrset_cache->table);
1051 slabhash_clear(daemon->env->msg_cache);
1052 daemon_clear_allocs(daemon);
1053 }
1054
1055 if(!slabhash_is_size(daemon->env->msg_cache, cfg->msg_cache_size,
1056 cfg->msg_cache_slabs)) {
1057 slabhash_delete(daemon->env->msg_cache);
1058 daemon->env->msg_cache = slabhash_create(cfg->msg_cache_slabs,
1059 HASH_DEFAULT_STARTARRAY, cfg->msg_cache_size,
1060 msgreply_sizefunc, query_info_compare,
1061 query_entry_delete, reply_info_delete, NULL);
1062 if(!daemon->env->msg_cache) {
1063 fatal_exit("malloc failure updating config settings");
1064 }
1065 }
1066 if((daemon->env->rrset_cache = rrset_cache_adjust(
1067 daemon->env->rrset_cache, cfg, &daemon->superalloc)) == 0)
1068 fatal_exit("malloc failure updating config settings");
1069 if((daemon->env->infra_cache = infra_adjust(daemon->env->infra_cache,
1070 cfg))==0)
1071 fatal_exit("malloc failure updating config settings");
1072 }
1073