package/network/services/dnsmasq/patches/0001-Impove-cache-behaviour-for-TCP-connections.patch

   1 From a799ca0c6314ad73a97bc6c89382d2712a9c0b0e Mon Sep 17 00:00:00 2001
   2 From: Simon Kelley <simon@thekelleys.org.uk>
   3 Date: Thu, 18 Oct 2018 19:35:29 +0100
   4 Subject: [PATCH 01/32] Impove cache behaviour for TCP connections.
   5
   6 For ease of implementaion, dnsmasq has always forked a new process to
   7 handle each incoming TCP connection. A side-effect of this is that any
   8 DNS queries answered from TCP connections are not cached: when TCP
   9 connections were rare, this was not a problem.  With the coming of
  10 DNSSEC, it's now the case that some DNSSEC queries have answers which
  11 spill to TCP, and if, for instance, this applies to the keys for the
  12 root then those never get cached, and performance is very bad.  This
  13 fix passes cache entries back from the TCP child process to the main
  14 server process, and fixes the problem.
  15
  16 Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
  17 ---
  18  CHANGELOG       |  14 ++++
  19  src/blockdata.c |  37 ++++++++-
  20  src/cache.c     | 196 ++++++++++++++++++++++++++++++++++++++++++++++--
  21  src/dnsmasq.c   |  58 ++++++++++++--
  22  src/dnsmasq.h   |   5 ++
  23  5 files changed, 291 insertions(+), 19 deletions(-)
  24
  25 --- a/CHANGELOG
  26 +++ b/CHANGELOG
  27 @@ -1,3 +1,17 @@
  28 +version 2.81
  29 +       Impove cache behaviour for TCP connections. For ease of
  30 +       implementaion, dnsmasq has always forked a new process to handle
  31 +       each incoming TCP connection. A side-effect of this is that
  32 +       any DNS queries answered from TCP connections are not cached:
  33 +       when TCP connections were rare, this was not a problem.
  34 +       With the coming of DNSSEC, it's now the case that some
  35 +       DNSSEC queries have answers which spill to TCP, and if,
  36 +       for instance, this applies to the keys for the root then
  37 +       those never get cached, and performance is very bad.
  38 +       This fix passes cache entries back from the TCP child process to
  39 +       the main server process, and fixes the problem.
  40 +
  41 +
  42  version 2.80
  43         Add support for RFC 4039 DHCP rapid commit. Thanks to Ashram Method
  44         for the initial patch and motivation.
  45 --- a/src/blockdata.c
  46 +++ b/src/blockdata.c
  47 @@ -61,7 +61,7 @@ void blockdata_report(void)
  48               blockdata_alloced * sizeof(struct blockdata));
  49  }
  50
  51 -struct blockdata *blockdata_alloc(char *data, size_t len)
  52 +static struct blockdata *blockdata_alloc_real(int fd, char *data, size_t len)
  53  {
  54    struct blockdata *block, *ret = NULL;
  55    struct blockdata **prev = &ret;
  56 @@ -89,8 +89,17 @@ struct blockdata *blockdata_alloc(char *
  57         blockdata_hwm = blockdata_count;
  58
  59        blen = len > KEYBLOCK_LEN ? KEYBLOCK_LEN : len;
  60 -      memcpy(block->key, data, blen);
  61 -      data += blen;
  62 +      if (data)
  63 +       {
  64 +         memcpy(block->key, data, blen);
  65 +         data += blen;
  66 +       }
  67 +      else if (!read_write(fd, block->key, blen, 1))
  68 +       {
  69 +         /* failed read free partial chain */
  70 +         blockdata_free(ret);
  71 +         return NULL;
  72 +       }
  73        len -= blen;
  74        *prev = block;
  75        prev = &block->next;
  76 @@ -100,6 +109,10 @@ struct blockdata *blockdata_alloc(char *
  77    return ret;
  78  }
  79
  80 +struct blockdata *blockdata_alloc(char *data, size_t len)
  81 +{
  82 +  return blockdata_alloc_real(0, data, len);
  83 +}
  84
  85  void blockdata_free(struct blockdata *blocks)
  86  {
  87 @@ -148,5 +161,21 @@ void *blockdata_retrieve(struct blockdat
  88
  89    return data;
  90  }
  91 -
  92 +
  93 +
  94 +void blockdata_write(struct blockdata *block, size_t len, int fd)
  95 +{
  96 +  for (; len > 0 && block; block = block->next)
  97 +    {
  98 +      size_t blen = len > KEYBLOCK_LEN ? KEYBLOCK_LEN : len;
  99 +      read_write(fd, block->key, blen, 0);
 100 +      len -= blen;
 101 +    }
 102 +}
 103 +
 104 +struct blockdata *blockdata_read(int fd, size_t len)
 105 +{
 106 +  return blockdata_alloc_real(fd, NULL, len);
 107 +}
 108 +
 109  #endif
 110 --- a/src/cache.c
 111 +++ b/src/cache.c
 112 @@ -26,6 +26,8 @@ static union bigname *big_free = NULL;
 113  static int bignames_left, hash_size;
 114
 115  static void make_non_terminals(struct crec *source);
 116 +static struct crec *really_insert(char *name, struct all_addr *addr,
 117 +                                 time_t now,  unsigned long ttl, unsigned short flags);
 118
 119  /* type->string mapping: this is also used by the name-hash function as a mixing table. */
 120  static const struct {
 121 @@ -464,16 +466,10 @@ void cache_start_insert(void)
 122    new_chain = NULL;
 123    insert_error = 0;
 124  }
 125 -
 126 +
 127  struct crec *cache_insert(char *name, struct all_addr *addr,
 128                           time_t now,  unsigned long ttl, unsigned short flags)
 129  {
 130 -  struct crec *new, *target_crec = NULL;
 131 -  union bigname *big_name = NULL;
 132 -  int freed_all = flags & F_REVERSE;
 133 -  int free_avail = 0;
 134 -  unsigned int target_uid;
 135 -
 136    /* Don't log DNSSEC records here, done elsewhere */
 137    if (flags & (F_IPV4 | F_IPV6 | F_CNAME))
 138      {
 139 @@ -484,7 +480,20 @@ struct crec *cache_insert(char *name, st
 140        if (daemon->min_cache_ttl != 0 && daemon->min_cache_ttl > ttl)
 141         ttl = daemon->min_cache_ttl;
 142      }
 143 +
 144 +  return really_insert(name, addr, now, ttl, flags);
 145 +}
 146
 147 +
 148 +static struct crec *really_insert(char *name, struct all_addr *addr,
 149 +                                 time_t now,  unsigned long ttl, unsigned short flags)
 150 +{
 151 +  struct crec *new, *target_crec = NULL;
 152 +  union bigname *big_name = NULL;
 153 +  int freed_all = flags & F_REVERSE;
 154 +  int free_avail = 0;
 155 +  unsigned int target_uid;
 156 +
 157    /* if previous insertion failed give up now. */
 158    if (insert_error)
 159      return NULL;
 160 @@ -645,12 +654,185 @@ void cache_end_insert(void)
 161           cache_hash(new_chain);
 162           cache_link(new_chain);
 163           daemon->metrics[METRIC_DNS_CACHE_INSERTED]++;
 164 +
 165 +         /* If we're a child process, send this cache entry up the pipe to the master.
 166 +            The marshalling process is rather nasty. */
 167 +         if (daemon->pipe_to_parent != -1)
 168 +           {
 169 +             char *name = cache_get_name(new_chain);
 170 +             ssize_t m = strlen(name);
 171 +             unsigned short flags = new_chain->flags;
 172 +#ifdef HAVE_DNSSEC
 173 +             u16 class = new_chain->uid;
 174 +#endif
 175 +
 176 +             read_write(daemon->pipe_to_parent, (unsigned char *)&m, sizeof(m), 0);
 177 +             read_write(daemon->pipe_to_parent, (unsigned char *)name, m, 0);
 178 +             read_write(daemon->pipe_to_parent, (unsigned char *)&new_chain->ttd, sizeof(new_chain->ttd), 0);
 179 +             read_write(daemon->pipe_to_parent, (unsigned  char *)&flags, sizeof(flags), 0);
 180 +
 181 +             if (flags & (F_IPV4 | F_IPV6))
 182 +               read_write(daemon->pipe_to_parent, (unsigned char *)&new_chain->addr, sizeof(new_chain->addr), 0);
 183 +#ifdef HAVE_DNSSEC
 184 +             else if (flags & F_DNSKEY)
 185 +               {
 186 +                 read_write(daemon->pipe_to_parent, (unsigned char *)&class, sizeof(class), 0);
 187 +                 read_write(daemon->pipe_to_parent, (unsigned char *)&new_chain->addr.key.algo, sizeof(new_chain->addr.key.algo), 0);
 188 +                 read_write(daemon->pipe_to_parent, (unsigned char *)&new_chain->addr.key.keytag, sizeof(new_chain->addr.key.keytag), 0);
 189 +                 read_write(daemon->pipe_to_parent, (unsigned char *)&new_chain->addr.key.flags, sizeof(new_chain->addr.key.flags), 0);
 190 +                 read_write(daemon->pipe_to_parent, (unsigned char *)&new_chain->addr.key.keylen, sizeof(new_chain->addr.key.keylen), 0);
 191 +                 blockdata_write(new_chain->addr.key.keydata, new_chain->addr.key.keylen, daemon->pipe_to_parent);
 192 +               }
 193 +             else if (flags & F_DS)
 194 +               {
 195 +                 read_write(daemon->pipe_to_parent, (unsigned char *)&class, sizeof(class), 0);
 196 +                 /* A negative DS entry is possible and has no data, obviously. */
 197 +                 if (!(flags & F_NEG))
 198 +                   {
 199 +                     read_write(daemon->pipe_to_parent, (unsigned char *)&new_chain->addr.ds.algo, sizeof(new_chain->addr.ds.algo), 0);
 200 +                     read_write(daemon->pipe_to_parent, (unsigned char *)&new_chain->addr.ds.keytag, sizeof(new_chain->addr.ds.keytag), 0);
 201 +                     read_write(daemon->pipe_to_parent, (unsigned char *)&new_chain->addr.ds.digest, sizeof(new_chain->addr.ds.digest), 0);
 202 +                     read_write(daemon->pipe_to_parent, (unsigned char *)&new_chain->addr.ds.keylen, sizeof(new_chain->addr.ds.keylen), 0);
 203 +                     blockdata_write(new_chain->addr.ds.keydata, new_chain->addr.ds.keylen, daemon->pipe_to_parent);
 204 +                   }
 205 +               }
 206 +#endif
 207 +
 208 +           }
 209         }
 210 +
 211        new_chain = tmp;
 212      }
 213 +
 214 +  /* signal end of cache insert in master process */
 215 +  if (daemon->pipe_to_parent != -1)
 216 +    {
 217 +      ssize_t m = -1;
 218 +      read_write(daemon->pipe_to_parent, (unsigned char *)&m, sizeof(m), 0);
 219 +    }
 220 +
 221    new_chain = NULL;
 222  }
 223
 224 +
 225 +/* A marshalled cache entry arrives on fd, read, unmarshall and insert into cache of master process. */
 226 +int cache_recv_insert(time_t now, int fd)
 227 +{
 228 +  ssize_t m;
 229 +  struct all_addr addr;
 230 +  unsigned long ttl;
 231 +  time_t ttd;
 232 +  unsigned short flags;
 233 +  struct crec *crecp = NULL;
 234 +
 235 +  cache_start_insert();
 236 +
 237 +  while(1)
 238 +    {
 239 +
 240 +      if (!read_write(fd, (unsigned char *)&m, sizeof(m), 1))
 241 +       return 0;
 242 +
 243 +      if (m == -1)
 244 +       {
 245 +         cache_end_insert();
 246 +         return 1;
 247 +       }
 248 +
 249 +      if (!read_write(fd, (unsigned char *)daemon->namebuff, m, 1) ||
 250 +         !read_write(fd, (unsigned char *)&ttd, sizeof(ttd), 1) ||
 251 +         !read_write(fd, (unsigned char *)&flags, sizeof(flags), 1))
 252 +       return 0;
 253 +
 254 +      daemon->namebuff[m] = 0;
 255 +
 256 +      ttl = difftime(ttd, now);
 257 +
 258 +      if (flags & (F_IPV4 | F_IPV6))
 259 +       {
 260 +         if (!read_write(fd, (unsigned char *)&addr, sizeof(addr), 1))
 261 +           return 0;
 262 +         crecp = really_insert(daemon->namebuff, &addr, now, ttl, flags);
 263 +       }
 264 +      else if (flags & F_CNAME)
 265 +       {
 266 +         struct crec *newc = really_insert(daemon->namebuff, NULL, now, ttl, flags);
 267 +         /* This relies on the fact the the target of a CNAME immediately preceeds
 268 +            it because of the order of extraction in extract_addresses, and
 269 +            the order reversal on the new_chain. */
 270 +         if (newc)
 271 +           {
 272 +             if (!crecp)
 273 +               {
 274 +                 newc->addr.cname.target.cache = NULL;
 275 +                 /* anything other than zero, to avoid being mistaken for CNAME to interface-name */
 276 +                 newc->addr.cname.uid = 1;
 277 +               }
 278 +             else
 279 +               {
 280 +                 next_uid(crecp);
 281 +                 newc->addr.cname.target.cache = crecp;
 282 +                 newc->addr.cname.uid = crecp->uid;
 283 +               }
 284 +           }
 285 +       }
 286 +#ifdef HAVE_DNSSEC
 287 +      else if (flags & (F_DNSKEY | F_DS))
 288 +       {
 289 +         unsigned short class, keylen, keyflags, keytag;
 290 +         unsigned char algo, digest;
 291 +         struct blockdata *keydata;
 292 +
 293 +         if (!read_write(fd, (unsigned char *)&class, sizeof(class), 1))
 294 +           return 0;
 295 +         /* Cache needs to known class for DNSSEC stuff */
 296 +         addr.addr.dnssec.class = class;
 297 +
 298 +         crecp = really_insert(daemon->namebuff, &addr, now, ttl, flags);
 299 +
 300 +         if (flags & F_DNSKEY)
 301 +           {
 302 +             if (!read_write(fd, (unsigned char *)&algo, sizeof(algo), 1) ||
 303 +                 !read_write(fd, (unsigned char *)&keytag, sizeof(keytag), 1) ||
 304 +                 !read_write(fd, (unsigned char *)&keyflags, sizeof(keyflags), 1) ||
 305 +                 !read_write(fd, (unsigned char *)&keylen, sizeof(keylen), 1) ||
 306 +                 !(keydata = blockdata_read(fd, keylen)))
 307 +               return 0;
 308 +           }
 309 +         else if (!(flags & F_NEG))
 310 +           {
 311 +             if (!read_write(fd, (unsigned char *)&algo, sizeof(algo), 1) ||
 312 +                 !read_write(fd, (unsigned char *)&keytag, sizeof(keytag), 1) ||
 313 +                 !read_write(fd, (unsigned char *)&digest, sizeof(digest), 1) ||
 314 +                 !read_write(fd, (unsigned char *)&keylen, sizeof(keylen), 1) ||
 315 +                 !(keydata = blockdata_read(fd, keylen)))
 316 +               return 0;
 317 +           }
 318 +
 319 +         if (crecp)
 320 +           {
 321 +              if (flags & F_DNSKEY)
 322 +                {
 323 +                  crecp->addr.key.algo = algo;
 324 +                  crecp->addr.key.keytag = keytag;
 325 +                  crecp->addr.key.flags = flags;
 326 +                  crecp->addr.key.keylen = keylen;
 327 +                  crecp->addr.key.keydata = keydata;
 328 +                }
 329 +              else if (!(flags & F_NEG))
 330 +                {
 331 +                  crecp->addr.ds.algo = algo;
 332 +                  crecp->addr.ds.keytag = keytag;
 333 +                  crecp->addr.ds.digest = digest;
 334 +                  crecp->addr.ds.keylen = keylen;
 335 +                  crecp->addr.ds.keydata = keydata;
 336 +                }
 337 +           }
 338 +       }
 339 +#endif
 340 +    }
 341 +}
 342 +
 343  int cache_find_non_terminal(char *name, time_t now)
 344  {
 345    struct crec *crecp;
 346 --- a/src/dnsmasq.c
 347 +++ b/src/dnsmasq.c
 348 @@ -930,6 +930,10 @@ int main (int argc, char **argv)
 349      check_servers();
 350
 351    pid = getpid();
 352 +
 353 +  daemon->pipe_to_parent = -1;
 354 +  for (i = 0; i < MAX_PROCS; i++)
 355 +    daemon->tcp_pipes[i] = -1;
 356
 357  #ifdef HAVE_INOTIFY
 358    /* Using inotify, have to select a resolv file at startup */
 359 @@ -1611,7 +1615,7 @@ static int set_dns_listeners(time_t now)
 360          we don't need to explicitly arrange to wake up here */
 361        if  (listener->tcpfd != -1)
 362         for (i = 0; i < MAX_PROCS; i++)
 363 -         if (daemon->tcp_pids[i] == 0)
 364 +         if (daemon->tcp_pids[i] == 0 && daemon->tcp_pipes[i] == -1)
 365             {
 366               poll_listen(listener->tcpfd, POLLIN);
 367               break;
 368 @@ -1624,6 +1628,13 @@ static int set_dns_listeners(time_t now)
 369
 370      }
 371
 372 +#ifndef NO_FORK
 373 +  if (!option_bool(OPT_DEBUG))
 374 +    for (i = 0; i < MAX_PROCS; i++)
 375 +      if (daemon->tcp_pipes[i] != -1)
 376 +       poll_listen(daemon->tcp_pipes[i], POLLIN);
 377 +#endif
 378 +
 379    return wait;
 380  }
 381
 382 @@ -1632,7 +1643,10 @@ static void check_dns_listeners(time_t n
 383    struct serverfd *serverfdp;
 384    struct listener *listener;
 385    int i;
 386 -
 387 +#ifndef NO_FORK
 388 +  int pipefd[2];
 389 +#endif
 390 +
 391    for (serverfdp = daemon->sfds; serverfdp; serverfdp = serverfdp->next)
 392      if (poll_check(serverfdp->fd, POLLIN))
 393        reply_query(serverfdp->fd, serverfdp->source_addr.sa.sa_family, now);
 394 @@ -1642,7 +1656,26 @@ static void check_dns_listeners(time_t n
 395        if (daemon->randomsocks[i].refcount != 0 &&
 396           poll_check(daemon->randomsocks[i].fd, POLLIN))
 397         reply_query(daemon->randomsocks[i].fd, daemon->randomsocks[i].family, now);
 398 -
 399 +
 400 +#ifndef NO_FORK
 401 +  /* Races. The child process can die before we read all of the data from the
 402 +     pipe, or vice versa. Therefore send tcp_pids to zero when we wait() the
 403 +     process, and tcp_pipes to -1 and close the FD when we read the last
 404 +     of the data - indicated by cache_recv_insert returning zero.
 405 +     The order of these events is indeterminate, and both are needed
 406 +     to free the process slot. Once the child process has gone, poll()
 407 +     returns POLLHUP, not POLLIN, so have to check for both here. */
 408 +  if (!option_bool(OPT_DEBUG))
 409 +    for (i = 0; i < MAX_PROCS; i++)
 410 +      if (daemon->tcp_pipes[i] != -1 &&
 411 +         poll_check(daemon->tcp_pipes[i], POLLIN | POLLHUP) &&
 412 +         !cache_recv_insert(now, daemon->tcp_pipes[i]))
 413 +       {
 414 +         close(daemon->tcp_pipes[i]);
 415 +         daemon->tcp_pipes[i] = -1;
 416 +       }
 417 +#endif
 418 +
 419    for (listener = daemon->listeners; listener; listener = listener->next)
 420      {
 421        if (listener->fd != -1 && poll_check(listener->fd, POLLIN))
 422 @@ -1736,15 +1769,20 @@ static void check_dns_listeners(time_t n
 423               while (retry_send(close(confd)));
 424             }
 425  #ifndef NO_FORK
 426 -         else if (!option_bool(OPT_DEBUG) && (p = fork()) != 0)
 427 +         else if (!option_bool(OPT_DEBUG) && pipe(pipefd) == 0 && (p = fork()) != 0)
 428             {
 429 -             if (p != -1)
 430 +             close(pipefd[1]); /* parent needs read pipe end. */
 431 +             if (p == -1)
 432 +               close(pipefd[0]);
 433 +             else
 434                 {
 435                   int i;
 436 +
 437                   for (i = 0; i < MAX_PROCS; i++)
 438 -                   if (daemon->tcp_pids[i] == 0)
 439 +                   if (daemon->tcp_pids[i] == 0 && daemon->tcp_pipes[i] == -1)
 440                       {
 441                         daemon->tcp_pids[i] = p;
 442 +                       daemon->tcp_pipes[i] = pipefd[0];
 443                         break;
 444                       }
 445                 }
 446 @@ -1761,7 +1799,7 @@ static void check_dns_listeners(time_t n
 447               int flags;
 448               struct in_addr netmask;
 449               int auth_dns;
 450 -
 451 +
 452               if (iface)
 453                 {
 454                   netmask = iface->netmask;
 455 @@ -1777,7 +1815,11 @@ static void check_dns_listeners(time_t n
 456               /* Arrange for SIGALRM after CHILD_LIFETIME seconds to
 457                  terminate the process. */
 458               if (!option_bool(OPT_DEBUG))
 459 -               alarm(CHILD_LIFETIME);
 460 +               {
 461 +                 alarm(CHILD_LIFETIME);
 462 +                 close(pipefd[0]); /* close read end in child. */
 463 +                 daemon->pipe_to_parent = pipefd[1];
 464 +               }
 465  #endif
 466
 467               /* start with no upstream connections. */
 468 --- a/src/dnsmasq.h
 469 +++ b/src/dnsmasq.h
 470 @@ -1091,6 +1091,8 @@ extern struct daemon {
 471    size_t packet_len;       /*      "        "        */
 472    struct randfd *rfd_save; /*      "        "        */
 473    pid_t tcp_pids[MAX_PROCS];
 474 +  int tcp_pipes[MAX_PROCS];
 475 +  int pipe_to_parent;
 476    struct randfd randomsocks[RANDOM_SOCKS];
 477    int v6pktinfo;
 478    struct addrlist *interface_addrs; /* list of all addresses/prefix lengths associated with all local interfaces */
 479 @@ -1152,6 +1154,7 @@ struct crec *cache_find_by_name(struct c
 480                                 char *name, time_t now, unsigned int prot);
 481  void cache_end_insert(void);
 482  void cache_start_insert(void);
 483 +int cache_recv_insert(time_t now, int fd);
 484  struct crec *cache_insert(char *name, struct all_addr *addr,
 485                           time_t now, unsigned long ttl, unsigned short flags);
 486  void cache_reload(void);
 487 @@ -1174,6 +1177,8 @@ void blockdata_init(void);
 488  void blockdata_report(void);
 489  struct blockdata *blockdata_alloc(char *data, size_t len);
 490  void *blockdata_retrieve(struct blockdata *block, size_t len, void *data);
 491 +struct blockdata *blockdata_read(int fd, size_t len);
 492 +void blockdata_write(struct blockdata *block, size_t len, int fd);
 493  void blockdata_free(struct blockdata *blocks);
 494  #endif
 495