bcopy(fname, anbuf, alen = (char *)*cpp - fname);
alen = (char *)*cpp - fname; if ((size_t)alen > sizeof anbuf) return (Refuse); bcopy(fname, anbuf, alen);
static enum req_action	req_iquery __P((HEADER *hp, u_char **cpp, u_char *eom,					int *buflenp, u_char *msg,					struct sockaddr_in *from));#ifdef BIND_NOTIFYstatic enum req_action	req_notify __P((HEADER *hp, u_char **cpp, u_char *eom,					u_char *msg,struct sockaddr_in *from));#endifstatic void		fwritemsg __P((FILE *, u_char *, int)),			doaxfr __P((struct namebuf *, FILE *,				    struct namebuf *, int)),			startxfr __P((struct qstream *, struct namebuf *,				      u_char *, int, int, const char *));static struct addinfo	addinfo[NADDRECS];static void		addname __P((const char *, const char *,				     u_int16_t, u_int16_t));static void		copyCharString __P((u_char **, const char *));/* * Process request using database; assemble and send response. */voidns_req(msg, msglen, buflen, qsp, from, dfd)	u_char *msg;	int msglen, buflen;	struct qstream *qsp;	struct sockaddr_in *from;	int dfd;{	register HEADER *hp = (HEADER *) msg;	u_char *cp, *eom;#ifdef DEBUG	const char *sortmsgtxt;#endif	enum req_action action;	int n;#ifdef DEBUG	if (debug > 3) {		fprintf(ddt, "ns_req(from=%s)\n", sin_ntoa(from));		fp_nquery(msg, msglen, ddt);	}#endif	/*	 * XXX - this decision should be made by our caller, not by us.	 */	if (hp->qr) {		ns_resp(msg, msglen);		/* Now is a safe time for housekeeping */		if (needs_prime_cache)			prime_cache();		return;	}	/* it's not a response so these bits have no business	 * being set. will later simplify work if we can	 * safely assume these are always 0 when a query	 * comes in.	 */	hp->aa = hp->ra = 0;	hp->rcode = NOERROR;	cp = msg + HFIXEDSZ;	eom = msg + msglen;	buflen -= HFIXEDSZ;	free_addinfo();	/* sets addcount to zero */	dnptrs[0] = NULL;	switch (hp->opcode) {	case QUERY:		action = req_query(hp, &cp, eom, qsp,				   &buflen, &msglen,				   msg, dfd, from);		break;	case IQUERY:		action = req_iquery(hp, &cp, eom, &buflen, msg, from);		break;#ifdef BIND_NOTIFY	case NS_NOTIFY_OP:		action = req_notify(hp, &cp, eom, msg, from);		break;#endif	default:		dprintf(1, (ddt, "ns_req: Opcode %d not implemented\n",			    hp->opcode));		/* XXX - should syslog, limited by haveComplained */		hp->qdcount = htons(0);		hp->ancount = htons(0);		hp->nscount = htons(0);		hp->arcount = htons(0);		hp->rcode = NOTIMP;		action = Finish;	}	/*	 * vector via internal opcode.  (yes, it was even uglier before.)	 */	switch (action) {	case Return:		return;	case Refuse:		hp->rcode = REFUSED;		/*FALLTHROUGH*/	case Finish:		/* rest of the function handles this case */		break;	default:		panic(-1, "ns_req: bad action variable");		/*NOTREACHED*/	}	/*	 * apply final polish	 */	hp->qr = 1;		/* set Response flag */	hp->ra = (NoRecurse == 0);	n = doaddinfo(hp, cp, buflen);	cp += n;	buflen -= n;#ifdef DEBUG#ifdef SORT_RESPONSE	sortmsgtxt = local(from) == NULL ? "Remote" : "Local";#else /*SORT*/	sortmsgtxt = "(not sorting)";#endif /*SORT*/	dprintf(1, (ddt, "ns_req: answer -> %s fd=%d id=%d size=%d %s\n",		    sin_ntoa(from), (qsp == QSTREAM_NULL) ? dfd : qsp->s_rfd,		    ntohs(hp->id), cp - msg, sortmsgtxt));	if (debug >= 10)		fp_nquery(msg, cp - msg, ddt);#endif /*DEBUG*/	if (qsp == QSTREAM_NULL) {		if (sendto(dfd, (char*)msg, cp - msg, 0,			   (struct sockaddr *)from,			   sizeof(*from)) < 0) {			if (!haveComplained((char*)from->sin_addr.s_addr,					    sendtoStr))				syslog(LOG_INFO,				       "ns_req: sendto(%s): %m",				       sin_ntoa(from));			nameserIncr(from->sin_addr, nssSendtoErr);		}		nameserIncr(from->sin_addr, nssSentAns);#ifdef XSTATS		if (hp->rcode == NXDOMAIN) 			nameserIncr(from->sin_addr, nssSentNXD);		if (!hp->aa) 			nameserIncr(from->sin_addr, nssSentNaAns);#endif	} else {		(void) writemsg(qsp->s_rfd, msg, cp - msg);		sq_done(qsp);	}	if (needs_prime_cache) {		prime_cache();		/* Now is a safe time */	}}#ifdef BIND_NOTIFYintfindZonePri(zp, from)	register const struct zoneinfo *zp;	const struct sockaddr_in *from;{	register u_int32_t from_addr = from->sin_addr.s_addr;	register int i;	for (i = 0; (u_int)i < zp->z_addrcnt; i++)		if (zp->z_addr[i].s_addr == from_addr)			return (i);	return (-1);}static enum req_actionreq_notify(hp, cpp, eom, msg, from)	HEADER *hp;	u_char **cpp, *eom, *msg;	struct sockaddr_in *from;{	int n, type, class, zn;	char dnbuf[MAXDNAME];	struct namebuf *np;	const char *fname;	struct hashbuf *htp = hashtab;		/* lookup relative to root */	/* valid notify's have one question and zero answers */	if ((ntohs(hp->qdcount) != 1)	    || ntohs(hp->ancount) != 0	    || ntohs(hp->nscount) != 0	    || ntohs(hp->arcount) != 0) {		dprintf(1, (ddt, "FORMERR Notify header counts wrong\n"));		hp->qdcount = htons(0);		hp->ancount = htons(0);		hp->nscount = htons(0);		hp->arcount = htons(0);		hp->rcode = FORMERR;		return (Finish);	}	n = dn_expand(msg, eom, *cpp, dnbuf, sizeof dnbuf);	if (n < 0) {		dprintf(1, (ddt, "FORMERR Query expand name failed\n"));		hp->rcode = FORMERR;		return (Finish);	}	*cpp += n;	GETSHORT(type, *cpp);	GETSHORT(class, *cpp);	syslog(LOG_INFO, "rcvd NOTIFY(%s %s %s)",	       dnbuf, p_class(class), p_type(type));	/* XXX - when answers are allowed, we'll need to do compression	 * correctly here, and we will need to check for packet underflow.	 */	np = nlookup(dnbuf, &htp, &fname, 0);	if (!np) {		syslog(LOG_INFO, "rcvd NOTIFY for \"%s\", name not in cache",		       dnbuf);		hp->rcode = SERVFAIL;		return (Finish);	}	zn = findMyZone(np, class);	if (zn == DB_Z_CACHE || zones[zn].z_type != Z_SECONDARY) {		/* this can come if a user did an AXFR of some zone somewhere		 * and that zone's server now wants to tell us that the SOA		 * has changed.  AXFR's always come from nonpriv ports so it		 * isn't possible to know whether it was the server or just		 * "dig".  this condition can be avoided by using secure zones		 * since that way only real secondaries can AXFR from you.		 */		syslog(LOG_INFO,		       "NOTIFY for non-secondary name (%s), from %s",		       dnbuf, sin_ntoa(from));		goto refuse;	}	if (findZonePri(&zones[zn], from) == -1) {		syslog(LOG_INFO,		       "NOTIFY from non-master server (zone %s), from %s",		       zones[zn].z_origin, sin_ntoa(from));		goto refuse;	}	switch (type) {	case T_SOA:		if (strcasecmp(dnbuf, zones[zn].z_origin) != 0) {			syslog(LOG_INFO,			       "NOTIFY(SOA) for non-origin (%s), from %s",			       dnbuf, sin_ntoa(from));			goto refuse;		}		if (zones[zn].z_flags &		    (Z_NEED_RELOAD|Z_NEED_XFER|Z_QSERIAL|Z_XFER_RUNNING)) {			syslog(LOG_INFO,			       "NOTIFY(SOA) for zone already xferring (%s)",			       dnbuf);			goto noerror;		}		zones[zn].z_time = tt.tv_sec;		qserial_query(&zones[zn]);		/* XXX: qserial_query() can fail due to queue full condition;		 *	we should detect that case here and do something.		 */		break;	default:		/* unimplemented, but it's not a protocol error, just		 * something to be ignored.		 */		break;	} noerror:	hp->rcode = NOERROR;	return (Finish); refuse:	hp->rcode = REFUSED;	return (Finish);}#endif /*BIND_NOTIFY*/static enum req_actionreq_query(hp, cpp, eom, qsp, buflenp, msglenp, msg, dfd, from)	HEADER *hp;	u_char **cpp;	u_char *eom;	struct qstream *qsp;	u_char *msg;	int *buflenp, *msglenp, dfd;	struct sockaddr_in *from;{	int n, class, type, count, foundname, founddata, omsglen, cname;	u_int16_t id;	u_char **dpp, *omsg, *answers;	char dnbuf[MAXDNAME], *dname;	const char *fname;	struct hashbuf *htp;	struct databuf *nsp[NSMAX];	struct namebuf *np, *anp;	struct qinfo *qp;	struct netinfo *lp;#ifdef SECURE_ZONES	struct zoneinfo *zp;#endif	struct databuf *dp;#ifdef XSTATS	nameserIncr(from->sin_addr, nssRcvdQ);#endif		nsp[0] = NULL;	dpp = dnptrs;	*dpp++ = msg;	*dpp = NULL;	/* valid queries have one question and zero answers */	if ((ntohs(hp->qdcount) != 1)	    || ntohs(hp->ancount) != 0	    || ntohs(hp->nscount) != 0	    || ntohs(hp->arcount) != 0) {		dprintf(1, (ddt, "FORMERR Query header counts wrong\n"));		hp->qdcount = htons(0);		hp->ancount = htons(0);		hp->nscount = htons(0);		hp->arcount = htons(0);		hp->rcode = FORMERR;		return (Finish);	}	/*	 * Get domain name, class, and type.	 */	if ((**cpp & INDIR_MASK) == 0) {		*dpp++ = *cpp;	/* remember name for compression */	}	*dpp = NULL;	n = dn_expand(msg, eom, *cpp, dnbuf, sizeof dnbuf);	if (n < 0) {		dprintf(1, (ddt, "FORMERR Query expand name failed\n"));		hp->rcode = FORMERR;		return (Finish);	}	*cpp += n;	GETSHORT(type, *cpp);	GETSHORT(class, *cpp);	if (*cpp > eom) {		dprintf(1, (ddt, "FORMERR Query message length short\n"));		hp->rcode = FORMERR;		return (Finish);	}	if (*cpp < eom) {		dprintf(6, (ddt,"message length > received message\n"));		*msglenp = *cpp - msg;	}	qtypeIncr(type);#if 0	/*	 * Yow!	 */	if (!strcasecmp(dnbuf, "VERSION.BIND") &&	    class == C_CHAOS && type == T_TXT) {		u_char *tp;		hp->ancount = htons(1);		hp->nscount = htons(0);		hp->arcount = htons(0);		hp->rcode = NOERROR;		hp->aa = 1;		hp->ra = 0;		copyCharString(cpp, "VERSION");	/* Name */		copyCharString(cpp, "BIND");		*(*cpp)++ = 0x00;		PUTSHORT(T_TXT, *cpp);		/* Type */		PUTSHORT(C_CHAOS, *cpp);	/* Class */		PUTLONG(0, *cpp);		/* TTL */		tp = *cpp;			/* Temp RdLength */		PUTSHORT(0, *cpp);		copyCharString(cpp, Version);		PUTSHORT((*cpp) - (tp + INT16SZ), tp);	/* Real RdLength */		*msglenp = *cpp - msg;		/* Total message length */		return (Finish);	}#endif	/*	 * Process query.	 */	if (type == T_AXFR) {		/* refuse request if not a TCP connection */		if (qsp == QSTREAM_NULL) {			syslog(LOG_INFO,			       "rejected UDP AXFR from %s for \"%s\"",			       sin_ntoa(from), *dnbuf ? dnbuf : ".");			return (Refuse);		}		/* the position of this is subtle. */		nameserIncr(from->sin_addr, nssRcvdAXFR);#ifdef XFRNETS		if (xfrnets) {			/* if xfrnets was specified, peer address			 * must be on it.  should probably allow			 * for negation some day.			 */			if (!addr_on_netlist(from->sin_addr, xfrnets)) {				syslog(LOG_INFO,				       "unapproved AXFR from %s for %s",				       sin_ntoa(from), *dnbuf ? dnbuf : ".");				return (Refuse);			}		}#endif /*XFRNETS*/		dnptrs[0] = NULL;	/* don't compress names */		hp->rd = 0;		/* recursion not possible */		syslog(LOG_INFO, "approved AXFR from %s for \"%s\"",		       sin_ntoa(from), *dnbuf ? dnbuf : ".");	}	*buflenp -= *msglenp;	count = 0;	foundname = 0;	founddata = 0;	dname = dnbuf;	cname = 0;#ifdef QRYLOG	if (qrylog) {		syslog(LOG_INFO, "XX /%s/%s/%s",		       inet_ntoa(from->sin_addr), 		       (dname[0] == '\0') ?"." :dname, 		       p_type(type));	}#endif /*QRYLOG*/ try_again:	dprintf(1, (ddt, "req: nlookup(%s) id %d type=%d class=%d\n",		    dname, ntohs(hp->id), type, class));	htp = hashtab;		/* lookup relative to root */	if ((anp = np = nlookup(dname, &htp, &fname, 0)) == NULL)		fname = "";	dprintf(1, (ddt, "req: %s '%s' as '%s' (cname=%d)\n",		    np == NULL ? "missed" : "found",		    dname, fname, cname));#ifdef LOCALDOM	/*	 * if nlookup failed to find the name then	 * see if there are any '.''s in the name	 * if not then add local domain name to the	 * name and try again.	 */	if (!np && localdomain && !strchr(dname, '.')) {		(void) strcat(dname, ".");		(void) strcat(dname, localdomain);		dprintf(1, (ddt,"req: nlookup(%s) type=%d\n", dname, type));		htp = hashtab;		np = nlookup(dname, &htp, &fname, 0);	}#endif /*LOCALDOM*/#ifdef YPKLUDGE	/* Some braindamaged resolver software will not 	   recognize internet addresses in dot notation and 	   send out address  queries for "names" such as 	   128.93.8.1.  This kludge will prevent those 	   from flooding higher level servers.	   We simply claim to be authoritative and that	   the domain doesn't exist.	   Note that we could return the address but we	   don't do that in order to encourage that broken	   software is fixed.	*/	if (!np && type == T_A && class == C_IN && dname) {		struct in_addr ina;		if (inet_aton(dname, &ina)) {			hp->rcode = NXDOMAIN;			hp->aa = 1;			dprintf(3, (ddt, "ypkludge: hit as '%s'\n", dname));			return (Finish);		}	}#endif /*YPKLUDGE*/	if ((!np) || (fname != dname))		goto fetchns;#ifdef SECURE_ZONES	/* (gdmr) Make sure the class is correct.  If we have the same name	 * with more than one class then we can't refuse a request for one	 * class just because another class is blocked.  We *really* ought	 * to look for the correct type too, but since everything in a	 * particular class of zone has the same secure_zone attribute it	 * doesn't really matter which type we use!  Alternatively, this lot	 * could all be moved to after the finddata(), by which time only	 * the correct class/type combinations will be left.	 */	dp = np->n_data;	while (dp && (dp->d_class != class))		dp = dp->d_next;	if (dp) {		zp = &zones[dp->d_zone];		if (zp->secure_nets		    && !addr_on_netlist(from->sin_addr, zp->secure_nets)) {			syslog(LOG_NOTICE, "Unauthorized request %s from %s",			       dname, sin_ntoa(from));			dprintf(1, (ddt, "req: refuse %s from %s class %d (%d)\n",				dname, sin_ntoa(from), class, zp->z_class));			return (Refuse);		}	}#endif	foundname++;	answers = *cpp;	count = *cpp - msg;#ifdef NCACHE	/* Look for NXDOMAIN record with appropriate class	 * if found return immediately	 */	for (dp = np->n_data; dp ; dp = dp->d_next) {		if (!stale(dp) && (dp->d_rcode == NXDOMAIN) &&		    (dp->d_class == class)) {#ifdef RETURNSOA			n = finddata(np, class, T_SOA, hp, &dname,				     buflenp, &count);			if (n != 0 ) {				if (count) {					*cpp += n;					*buflenp -= n;					*msglenp += n;					hp->nscount = htons((u_int16_t)count);				}				if (hp->rcode == NOERROR_NODATA) {					/* this should not occur */					hp->rcode = NOERROR;					return (Finish);				}			}#endif			hp->rcode = NXDOMAIN;			hp->aa = 1;			return (Finish);		}	}	/* if not NXDOMAIN, the NOERROR_NODATA record might be	 * anywhere in the chain. have to go through the grind.	 */#endif /*NCACHE*/	n = finddata(np, class, type, hp, &dname, buflenp, &count);	if (n == 0) {		/* NO data available.  Refuse AXFR requests, or		 * look for better servers for other requests.		 */		if (type == T_AXFR) {			dprintf(1, (ddt, "T_AXFR refused: no data\n"));			return (Refuse);		} else {			goto fetchns;		}	}#ifdef NCACHE	if (hp->rcode == NOERROR_NODATA) {		hp->rcode = NOERROR;#ifdef RETURNSOA		if (count) {			*cpp += n;			*buflenp -= n;			*msglenp += n;			hp->nscount = htons(count);		}#endif		founddata = 1;		return (Finish);	}#endif	*cpp += n;	*buflenp -= n;	*msglenp += n;	hp->ancount = htons(ntohs(hp->ancount) + (u_int16_t)count);	if (fname != dname && type != T_CNAME && type != T_ANY) {		if (cname++ >= MAXCNAMES) {			dprintf(3, (ddt,				    "resp: leaving, MAXCNAMES exceeded\n"));			hp->rcode = SERVFAIL;			return (Finish);		}		goto try_again;	}	founddata = 1;	dprintf(3, (ddt,		    "req: foundname=%d, count=%d, founddata=%d, cname=%d\n",		    foundname, count, founddata, cname));#ifdef SORT_RESPONSE	if ((lp = local(from)) != NULL) 		sort_response(answers, count, lp, *cpp);#endif#ifdef BIND_NOTIFY	if (type == T_SOA &&	    from->sin_port == ns_port &&	    np->n_data) {		int zn = np->n_data->d_zone;		if (zn != DB_Z_CACHE) {			struct notify	*ap;			/* Old? */			ap = findNotifyPeer(&zones[zn], from->sin_addr);			/* New? */			if (!ap && (ap = (struct notify *)malloc(sizeof *ap))) {				ap->addr = from->sin_addr;				ap->next = zones[zn].z_notifylist;				zones[zn].z_notifylist = ap;			}			/* Old or New? */			if (ap)				ap->last = tt.tv_sec;		}	}#endif /*BIND_NOTIFY*/	if (type == T_AXFR) {		startxfr(qsp, np, msg, *cpp - msg, class, dname);		return (Return);	}#ifdef notdef	/*	 * If we found an authoritative answer, we're done.	 */	if (hp->aa)		return (Finish);#endif fetchns:	/*	 * If we're already out of room in the response, we're done.	 */	if (hp->tc)		return (Finish);	/* 	 * Look for name servers to refer to and fill in the authority 	 * section or record the address for forwarding the query 	 * (recursion desired). 	 */	free_nsp(nsp);	nsp[0] = NULL;	count = 0;	switch (findns(&np, class, nsp, &count, 0)) {	case NXDOMAIN:		/* We are authoritative for this np. */		if (!foundname)			hp->rcode = NXDOMAIN;		dprintf(3, (ddt, "req: leaving (%s, rcode %d)\n",			    dname, hp->rcode));		if (class != C_ANY) {			hp->aa = 1;			if (np && (!foundname || !founddata)) {				n = doaddauth(hp, *cpp, *buflenp, np, nsp[0]);				*cpp += n;				*buflenp -= n;#ifdef ADDAUTH			} else if (ntohs(hp->ancount) != 0) {				/* don't add NS records for NOERROR NODATA				   as some servers can get confused */				free_nsp(nsp);				switch (findns(&np, class, nsp, &count, 1)) {				case NXDOMAIN:				case SERVFAIL:					break;				default:					if (np &&					    (type != T_NS || np != anp)					    ) {						n = add_data(np, nsp, *cpp,							     *buflenp, &count);						if (n < 0) {							hp->tc = 1;							n = (-n);						}						*cpp += n;						*buflenp -= n;						hp->nscount = 							htons((u_int16_t)							      count);					}				}#endif /*ADDAUTH*/			}		}		free_nsp(nsp);		return (Finish);	case SERVFAIL:		/* We're authoritative but the zone isn't loaded. */		if (!founddata && !(forward_only && fwdtab)) {			hp->rcode = SERVFAIL;			free_nsp(nsp);			return (Finish);		}	}	/*	 *  If we successfully found the answer in the cache,	 *  or this is not a recursive query, or we are purposely	 *  never recursing, then add the nameserver references	 *  ("authority section") here and we're done.	 */	if (founddata || !hp->rd || NoRecurse) {		/*		 * If the qtype was NS, and the np of the authority is		 * the same as the np of the data, we don't need to add		 * another copy of the answer here in the authority		 * section.		 */		if (!founddata || type != T_NS || anp != np) {			n = add_data(np, nsp, *cpp, *buflenp, &count);			if (n < 0) {				hp->tc = 1;				n = (-n);			}			*cpp += n;			*buflenp -= n;			hp->nscount = htons((u_int16_t)count);		}		free_nsp(nsp);		/* Our caller will handle the Additional section. */		return (Finish);	}	/*	 *  At this point, we don't have the answer, but we do	 *  have some NS's to try.  If the user would like us	 *  to recurse, create the initial query.  If a cname	 *  is involved, we need to build a new query and save	 *  the old one in cmsg/cmsglen.	 */	if (cname) {		omsg = (u_char *)malloc((unsigned) *msglenp);		if (omsg == (u_char *)NULL) {			syslog(LOG_INFO, "ns_req: Out Of Memory");			hp->rcode = SERVFAIL;			free_nsp(nsp);			return (Finish);		}		id = hp->id;		omsglen = *msglenp;		bcopy(msg, omsg, omsglen);		n = res_mkquery(QUERY, dname, class, type,				NULL, 0, NULL, msg,				*msglenp + *buflenp);		if (n < 0) {			syslog(LOG_INFO, "res_mkquery(%s) failed", dname);			hp->rcode = SERVFAIL;			free_nsp(nsp);			return (Finish);		}		*msglenp = n;	}	n = ns_forw(nsp, msg, *msglenp, from, qsp, dfd, &qp,		    dname, class, type, np);	if (n != FW_OK && cname)		free(omsg);	switch (n) {	case FW_OK:		if (cname) {			qp->q_cname = cname;			qp->q_cmsg = omsg;			qp->q_cmsglen = omsglen;			qp->q_id = id;		}		break;	case FW_DUP:		break;		/* Duplicate request dropped */	case FW_NOSERVER:		/* 		 * Don't go into an infinite loop if 		 * the admin gave root NS records in the cache		 * file without giving address records		 * for the root servers.		 */		if (np) {			if (NAME(*np)[0] == '\0') {				syslog(LOG_NOTICE, 				       "ns_req: no address for root server");				hp->rcode = SERVFAIL;				free_nsp(nsp);				return (Finish);			}#ifdef VALIDATE			/*			 * we need to kill all the NS records here as			 * validate will fail as we are talking to the parent			 * server			 */			delete_all(np, class, T_NS);#endif			for (dp = np->n_data; dp ; dp = dp->d_next)				if (dp->d_zone && match(dp, class, T_NS))					break;			if (dp) {				/*				 * we know the child zone exists but are				 * missing glue.				 *				 * nslookup has called sysquery() to get the				 * missing glue.				 *				 * for UDP, drop the response and let the				 * client retry.  for TCP, we should probably				 * (XXX) hold open the TCP connection for a				 * while in case the sysquery() comes back				 * soon.  meanwhile we SERVFAIL.				 */				if (qsp)					goto do_servfail;				break;			}			np = np_parent(np);		}		goto fetchns;	/* Try again. */	case FW_SERVFAIL: do_servfail:		hp->rcode = SERVFAIL;		free_nsp(nsp);		return (Finish);	}	free_nsp(nsp);	return (Return);}static enum req_actionreq_iquery(hp, cpp, eom, buflenp, msg, from)	HEADER *hp;	u_char **cpp, *eom;	int *buflenp;	u_char *msg;	struct sockaddr_in *from;{	int dlen, alen, n, type, class, count;	char dnbuf[MAXDNAME], anbuf[PACKETSZ], *data, *fname;#ifdef XSTATS	nameserIncr(from->sin_addr, nssRcvdIQ);#endif	if (ntohs(hp->ancount) != 1	    || ntohs(hp->qdcount) != 0	    || ntohs(hp->nscount) != 0	    || ntohs(hp->arcount) != 0) {		dprintf(1, (ddt, "FORMERR IQuery header counts wrong\n"));		hp->qdcount = htons(0);		hp->ancount = htons(0);		hp->nscount = htons(0);		hp->arcount = htons(0);		hp->rcode = FORMERR;		return (Finish);	}	/*	 * Skip domain name, get class, and type.	 */	if ((n = dn_skipname(*cpp, eom)) < 0) {		dprintf(1, (ddt, "FORMERR IQuery packet name problem\n"));		hp->rcode = FORMERR;		return (Finish);	}	*cpp += n;	GETSHORT(type, *cpp);	GETSHORT(class, *cpp);	*cpp += INT32SZ;	/* ttl */	GETSHORT(dlen, *cpp);	*cpp += dlen;	if (*cpp != eom) {		dprintf(1, (ddt, "FORMERR IQuery message length off\n"));		hp->rcode = FORMERR;		return (Finish);	}	/*	 * not all inverse queries are handled.	 */	switch (type) {	case T_A:#ifndef INVQ		if (!fake_iquery)			return (Refuse);#endif#ifdef INVQ	case T_UID:	case T_GID:#endif		break;	default:		return (Refuse);	}	dprintf(1, (ddt, "req: IQuery class %d type %d\n", class, type));	fname = (char *)msg + HFIXEDSZ;	bcopy(fname, anbuf, alen = (char *)*cpp - fname);	data = anbuf + alen - dlen;	*cpp = (u_char *)fname;	*buflenp -= HFIXEDSZ;	count = 0;#ifdef QRYLOG	if (qrylog) {		syslog(LOG_INFO, "XX /%s/%s/-%s",		       inet_ntoa(from->sin_addr), 		       inet_ntoa(data_inaddr((u_char *)data)),		       p_type(type));	}#endif /*QRYLOG*/#ifdef INVQ    {	register struct invbuf *ip;	for (ip = invtab[dhash((u_char *)data, dlen)];	     ip != NULL;	     ip = ip->i_next) {		int i;		for (i = 0; i < INVBLKSZ; i++) {			struct namebuf *np;			struct databuf *dp;			if ((np = ip->i_dname[i]) == NULL)				break;			dprintf(5, (ddt, "dname = %d\n", NAME(*np)));			for (dp = np->n_data; dp != NULL; dp = dp->d_next) {				if (!match(dp, class, type))					continue;				if (dp->d_size != dlen ||				    bcmp(dp->d_data, data, dlen))					continue;				getname(np, dnbuf, sizeof(dnbuf));				dprintf(2, (ddt, "req: IQuery found %s\n",					    dnbuf));				*buflenp -= QFIXEDSZ;				n = dn_comp(dnbuf, *cpp, *buflenp, NULL, NULL);				if (n < 0) {					hp->tc = 1;					return (Finish);				}				*cpp += n;				PUTSHORT((u_int16_t)dp->d_type, *cpp);				PUTSHORT((u_int16_t)dp->d_class, *cpp);				*buflenp -= n;				count++;			}		}	}    }#else /*INVQ*/	/*	 * We can only get here if we are compiled without INVQ (the default)	 * and the type is T_A and the option "fake-iquery" is on in the boot	 * file.	 *	 * What we do here is send back a bogus response of "[dottedquad]".	 * A better strategy would be to turn this into a PTR query, but that	 * would legitimize inverse queries in a way they do not deserve.	 */	sprintf(dnbuf, "[%s]", inet_ntoa(data_inaddr((u_char *)data)));	*buflenp -= QFIXEDSZ;	n = dn_comp(dnbuf, *cpp, *buflenp, NULL, NULL);	if (n < 0) {		hp->tc = 1;		return (Finish);	}	*cpp += n;	PUTSHORT((u_int16_t)type, *cpp);	PUTSHORT((u_int16_t)class, *cpp);	*buflenp -= n;	count++;#endif /*INVQ*/	dprintf(1, (ddt, "req: IQuery %d records\n", count));	hp->qdcount = htons((u_int16_t)count);	if (alen > *buflenp) {		hp->tc = 1;		return (Finish);	}	bcopy(anbuf, *cpp, alen);	*cpp += alen;	return (Finish);}