src/resolve/resolved-dns-query.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2 /***
   3   Copyright 2014 Lennart Poettering
   4 ***/
   5
   6 #include "alloc-util.h"
   7 #include "dns-domain.h"
   8 #include "dns-type.h"
   9 #include "hostname-util.h"
  10 #include "local-addresses.h"
  11 #include "resolved-dns-query.h"
  12 #include "resolved-dns-synthesize.h"
  13 #include "resolved-etc-hosts.h"
  14 #include "string-util.h"
  15
  16 #define CNAME_MAX 8
  17 #define QUERIES_MAX 2048
  18 #define AUXILIARY_QUERIES_MAX 64
  19
  20 static int dns_query_candidate_new(DnsQueryCandidate **ret, DnsQuery *q, DnsScope *s) {
  21         DnsQueryCandidate *c;
  22
  23         assert(ret);
  24         assert(q);
  25         assert(s);
  26
  27         c = new0(DnsQueryCandidate, 1);
  28         if (!c)
  29                 return -ENOMEM;
  30
  31         c->query = q;
  32         c->scope = s;
  33
  34         LIST_PREPEND(candidates_by_query, q->candidates, c);
  35         LIST_PREPEND(candidates_by_scope, s->query_candidates, c);
  36
  37         *ret = c;
  38         return 0;
  39 }
  40
  41 static void dns_query_candidate_stop(DnsQueryCandidate *c) {
  42         DnsTransaction *t;
  43
  44         assert(c);
  45
  46         while ((t = set_steal_first(c->transactions))) {
  47                 set_remove(t->notify_query_candidates, c);
  48                 set_remove(t->notify_query_candidates_done, c);
  49                 dns_transaction_gc(t);
  50         }
  51 }
  52
  53 DnsQueryCandidate* dns_query_candidate_free(DnsQueryCandidate *c) {
  54
  55         if (!c)
  56                 return NULL;
  57
  58         dns_query_candidate_stop(c);
  59
  60         set_free(c->transactions);
  61         dns_search_domain_unref(c->search_domain);
  62
  63         if (c->query)
  64                 LIST_REMOVE(candidates_by_query, c->query->candidates, c);
  65
  66         if (c->scope)
  67                 LIST_REMOVE(candidates_by_scope, c->scope->query_candidates, c);
  68
  69         return mfree(c);
  70 }
  71
  72 static int dns_query_candidate_next_search_domain(DnsQueryCandidate *c) {
  73         DnsSearchDomain *next = NULL;
  74
  75         assert(c);
  76
  77         if (c->search_domain && c->search_domain->linked)
  78                 next = c->search_domain->domains_next;
  79         else
  80                 next = dns_scope_get_search_domains(c->scope);
  81
  82         for (;;) {
  83                 if (!next) /* We hit the end of the list */
  84                         return 0;
  85
  86                 if (!next->route_only)
  87                         break;
  88
  89                 /* Skip over route-only domains */
  90                 next = next->domains_next;
  91         }
  92
  93         dns_search_domain_unref(c->search_domain);
  94         c->search_domain = dns_search_domain_ref(next);
  95
  96         return 1;
  97 }
  98
  99 static int dns_query_candidate_add_transaction(DnsQueryCandidate *c, DnsResourceKey *key) {
 100         DnsTransaction *t;
 101         int r;
 102
 103         assert(c);
 104         assert(key);
 105
 106         t = dns_scope_find_transaction(c->scope, key, true);
 107         if (!t) {
 108                 r = dns_transaction_new(&t, c->scope, key);
 109                 if (r < 0)
 110                         return r;
 111         } else {
 112                 if (set_contains(c->transactions, t))
 113                         return 0;
 114         }
 115
 116         r = set_ensure_allocated(&c->transactions, NULL);
 117         if (r < 0)
 118                 goto gc;
 119
 120         r = set_ensure_allocated(&t->notify_query_candidates, NULL);
 121         if (r < 0)
 122                 goto gc;
 123
 124         r = set_ensure_allocated(&t->notify_query_candidates_done, NULL);
 125         if (r < 0)
 126                 goto gc;
 127
 128         r = set_put(t->notify_query_candidates, c);
 129         if (r < 0)
 130                 goto gc;
 131
 132         r = set_put(c->transactions, t);
 133         if (r < 0) {
 134                 (void) set_remove(t->notify_query_candidates, c);
 135                 goto gc;
 136         }
 137
 138         t->clamp_ttl = c->query->clamp_ttl;
 139         return 1;
 140
 141 gc:
 142         dns_transaction_gc(t);
 143         return r;
 144 }
 145
 146 static int dns_query_candidate_go(DnsQueryCandidate *c) {
 147         DnsTransaction *t;
 148         Iterator i;
 149         int r;
 150         unsigned n = 0;
 151
 152         assert(c);
 153
 154         /* Start the transactions that are not started yet */
 155         SET_FOREACH(t, c->transactions, i) {
 156                 if (t->state != DNS_TRANSACTION_NULL)
 157                         continue;
 158
 159                 r = dns_transaction_go(t);
 160                 if (r < 0)
 161                         return r;
 162
 163                 n++;
 164         }
 165
 166         /* If there was nothing to start, then let's proceed immediately */
 167         if (n == 0)
 168                 dns_query_candidate_notify(c);
 169
 170         return 0;
 171 }
 172
 173 static DnsTransactionState dns_query_candidate_state(DnsQueryCandidate *c) {
 174         DnsTransactionState state = DNS_TRANSACTION_NO_SERVERS;
 175         DnsTransaction *t;
 176         Iterator i;
 177
 178         assert(c);
 179
 180         if (c->error_code != 0)
 181                 return DNS_TRANSACTION_ERRNO;
 182
 183         SET_FOREACH(t, c->transactions, i) {
 184
 185                 switch (t->state) {
 186
 187                 case DNS_TRANSACTION_NULL:
 188                         /* If there's a NULL transaction pending, then
 189                          * this means not all transactions where
 190                          * started yet, and we were called from within
 191                          * the stackframe that is supposed to start
 192                          * remaining transactions. In this case,
 193                          * simply claim the candidate is pending. */
 194
 195                 case DNS_TRANSACTION_PENDING:
 196                 case DNS_TRANSACTION_VALIDATING:
 197                         /* If there's one transaction currently in
 198                          * VALIDATING state, then this means there's
 199                          * also one in PENDING state, hence we can
 200                          * return PENDING immediately. */
 201                         return DNS_TRANSACTION_PENDING;
 202
 203                 case DNS_TRANSACTION_SUCCESS:
 204                         state = t->state;
 205                         break;
 206
 207                 default:
 208                         if (state != DNS_TRANSACTION_SUCCESS)
 209                                 state = t->state;
 210
 211                         break;
 212                 }
 213         }
 214
 215         return state;
 216 }
 217
 218 static bool dns_query_candidate_is_routable(DnsQueryCandidate *c, uint16_t type) {
 219         int family;
 220
 221         assert(c);
 222
 223         /* Checks whether the specified RR type matches an address family that is routable on the link(s) the scope of
 224          * this candidate belongs to. Specifically, whether there's a routable IPv4 address on it if we query an A RR,
 225          * or a routable IPv6 address if we query an AAAA RR. */
 226
 227         if (!c->query->suppress_unroutable_family)
 228                 return true;
 229
 230         if (c->scope->protocol != DNS_PROTOCOL_DNS)
 231                 return true;
 232
 233         family = dns_type_to_af(type);
 234         if (family < 0)
 235                 return true;
 236
 237         if (c->scope->link)
 238                 return link_relevant(c->scope->link, family, false);
 239         else
 240                 return manager_routable(c->scope->manager, family);
 241 }
 242
 243 static int dns_query_candidate_setup_transactions(DnsQueryCandidate *c) {
 244         DnsQuestion *question;
 245         DnsResourceKey *key;
 246         int n = 0, r;
 247
 248         assert(c);
 249
 250         dns_query_candidate_stop(c);
 251
 252         question = dns_query_question_for_protocol(c->query, c->scope->protocol);
 253
 254         /* Create one transaction per question key */
 255         DNS_QUESTION_FOREACH(key, question) {
 256                 _cleanup_(dns_resource_key_unrefp) DnsResourceKey *new_key = NULL;
 257                 DnsResourceKey *qkey;
 258
 259                 if (!dns_query_candidate_is_routable(c, key->type))
 260                         continue;
 261
 262                 if (c->search_domain) {
 263                         r = dns_resource_key_new_append_suffix(&new_key, key, c->search_domain->name);
 264                         if (r < 0)
 265                                 goto fail;
 266
 267                         qkey = new_key;
 268                 } else
 269                         qkey = key;
 270
 271                 if (!dns_scope_good_key(c->scope, qkey))
 272                         continue;
 273
 274                 r = dns_query_candidate_add_transaction(c, qkey);
 275                 if (r < 0)
 276                         goto fail;
 277
 278                 n++;
 279         }
 280
 281         return n;
 282
 283 fail:
 284         dns_query_candidate_stop(c);
 285         return r;
 286 }
 287
 288 void dns_query_candidate_notify(DnsQueryCandidate *c) {
 289         DnsTransactionState state;
 290         int r;
 291
 292         assert(c);
 293
 294         state = dns_query_candidate_state(c);
 295
 296         if (DNS_TRANSACTION_IS_LIVE(state))
 297                 return;
 298
 299         if (state != DNS_TRANSACTION_SUCCESS && c->search_domain) {
 300
 301                 r = dns_query_candidate_next_search_domain(c);
 302                 if (r < 0)
 303                         goto fail;
 304
 305                 if (r > 0) {
 306                         /* OK, there's another search domain to try, let's do so. */
 307
 308                         r = dns_query_candidate_setup_transactions(c);
 309                         if (r < 0)
 310                                 goto fail;
 311
 312                         if (r > 0) {
 313                                 /* New transactions where queued. Start them and wait */
 314
 315                                 r = dns_query_candidate_go(c);
 316                                 if (r < 0)
 317                                         goto fail;
 318
 319                                 return;
 320                         }
 321                 }
 322
 323         }
 324
 325         dns_query_ready(c->query);
 326         return;
 327
 328 fail:
 329         log_warning_errno(r, "Failed to follow search domains: %m");
 330         c->error_code = r;
 331         dns_query_ready(c->query);
 332 }
 333
 334 static void dns_query_stop(DnsQuery *q) {
 335         DnsQueryCandidate *c;
 336
 337         assert(q);
 338
 339         q->timeout_event_source = sd_event_source_unref(q->timeout_event_source);
 340
 341         LIST_FOREACH(candidates_by_query, c, q->candidates)
 342                 dns_query_candidate_stop(c);
 343 }
 344
 345 static void dns_query_free_candidates(DnsQuery *q) {
 346         assert(q);
 347
 348         while (q->candidates)
 349                 dns_query_candidate_free(q->candidates);
 350 }
 351
 352 static void dns_query_reset_answer(DnsQuery *q) {
 353         assert(q);
 354
 355         q->answer = dns_answer_unref(q->answer);
 356         q->answer_rcode = 0;
 357         q->answer_dnssec_result = _DNSSEC_RESULT_INVALID;
 358         q->answer_errno = 0;
 359         q->answer_authenticated = false;
 360         q->answer_protocol = _DNS_PROTOCOL_INVALID;
 361         q->answer_family = AF_UNSPEC;
 362         q->answer_search_domain = dns_search_domain_unref(q->answer_search_domain);
 363 }
 364
 365 DnsQuery *dns_query_free(DnsQuery *q) {
 366         if (!q)
 367                 return NULL;
 368
 369         while (q->auxiliary_queries)
 370                 dns_query_free(q->auxiliary_queries);
 371
 372         if (q->auxiliary_for) {
 373                 assert(q->auxiliary_for->n_auxiliary_queries > 0);
 374                 q->auxiliary_for->n_auxiliary_queries--;
 375                 LIST_REMOVE(auxiliary_queries, q->auxiliary_for->auxiliary_queries, q);
 376         }
 377
 378         dns_query_free_candidates(q);
 379
 380         dns_question_unref(q->question_idna);
 381         dns_question_unref(q->question_utf8);
 382
 383         dns_query_reset_answer(q);
 384
 385         sd_bus_message_unref(q->request);
 386         sd_bus_track_unref(q->bus_track);
 387
 388         dns_packet_unref(q->request_dns_packet);
 389         dns_packet_unref(q->reply_dns_packet);
 390
 391         if (q->request_dns_stream) {
 392                 /* Detach the stream from our query, in case something else keeps a reference to it. */
 393                 q->request_dns_stream->complete = NULL;
 394                 q->request_dns_stream->on_packet = NULL;
 395                 q->request_dns_stream->query = NULL;
 396                 dns_stream_unref(q->request_dns_stream);
 397         }
 398
 399         free(q->request_address_string);
 400
 401         if (q->manager) {
 402                 LIST_REMOVE(queries, q->manager->dns_queries, q);
 403                 q->manager->n_dns_queries--;
 404         }
 405
 406         return mfree(q);
 407 }
 408
 409 int dns_query_new(
 410                 Manager *m,
 411                 DnsQuery **ret,
 412                 DnsQuestion *question_utf8,
 413                 DnsQuestion *question_idna,
 414                 int ifindex,
 415                 uint64_t flags) {
 416
 417         _cleanup_(dns_query_freep) DnsQuery *q = NULL;
 418         DnsResourceKey *key;
 419         bool good = false;
 420         int r;
 421         char key_str[DNS_RESOURCE_KEY_STRING_MAX];
 422
 423         assert(m);
 424
 425         if (dns_question_size(question_utf8) > 0) {
 426                 r = dns_question_is_valid_for_query(question_utf8);
 427                 if (r < 0)
 428                         return r;
 429                 if (r == 0)
 430                         return -EINVAL;
 431
 432                 good = true;
 433         }
 434
 435         /* If the IDNA and UTF8 questions are the same, merge their references */
 436         r = dns_question_is_equal(question_idna, question_utf8);
 437         if (r < 0)
 438                 return r;
 439         if (r > 0)
 440                 question_idna = question_utf8;
 441         else {
 442                 if (dns_question_size(question_idna) > 0) {
 443                         r = dns_question_is_valid_for_query(question_idna);
 444                         if (r < 0)
 445                                 return r;
 446                         if (r == 0)
 447                                 return -EINVAL;
 448
 449                         good = true;
 450                 }
 451         }
 452
 453         if (!good) /* don't allow empty queries */
 454                 return -EINVAL;
 455
 456         if (m->n_dns_queries >= QUERIES_MAX)
 457                 return -EBUSY;
 458
 459         q = new0(DnsQuery, 1);
 460         if (!q)
 461                 return -ENOMEM;
 462
 463         q->question_utf8 = dns_question_ref(question_utf8);
 464         q->question_idna = dns_question_ref(question_idna);
 465         q->ifindex = ifindex;
 466         q->flags = flags;
 467         q->answer_dnssec_result = _DNSSEC_RESULT_INVALID;
 468         q->answer_protocol = _DNS_PROTOCOL_INVALID;
 469         q->answer_family = AF_UNSPEC;
 470
 471         /* First dump UTF8  question */
 472         DNS_QUESTION_FOREACH(key, question_utf8)
 473                 log_debug("Looking up RR for %s.",
 474                           dns_resource_key_to_string(key, key_str, sizeof key_str));
 475
 476         /* And then dump the IDNA question, but only what hasn't been dumped already through the UTF8 question. */
 477         DNS_QUESTION_FOREACH(key, question_idna) {
 478                 r = dns_question_contains(question_utf8, key);
 479                 if (r < 0)
 480                         return r;
 481                 if (r > 0)
 482                         continue;
 483
 484                 log_debug("Looking up IDNA RR for %s.",
 485                           dns_resource_key_to_string(key, key_str, sizeof key_str));
 486         }
 487
 488         LIST_PREPEND(queries, m->dns_queries, q);
 489         m->n_dns_queries++;
 490         q->manager = m;
 491
 492         if (ret)
 493                 *ret = q;
 494         q = NULL;
 495
 496         return 0;
 497 }
 498
 499 int dns_query_make_auxiliary(DnsQuery *q, DnsQuery *auxiliary_for) {
 500         assert(q);
 501         assert(auxiliary_for);
 502
 503         /* Ensure that the query is not auxiliary yet, and
 504          * nothing else is auxiliary to it either */
 505         assert(!q->auxiliary_for);
 506         assert(!q->auxiliary_queries);
 507
 508         /* Ensure that the unit we shall be made auxiliary for isn't
 509          * auxiliary itself */
 510         assert(!auxiliary_for->auxiliary_for);
 511
 512         if (auxiliary_for->n_auxiliary_queries >= AUXILIARY_QUERIES_MAX)
 513                 return -EAGAIN;
 514
 515         LIST_PREPEND(auxiliary_queries, auxiliary_for->auxiliary_queries, q);
 516         q->auxiliary_for = auxiliary_for;
 517
 518         auxiliary_for->n_auxiliary_queries++;
 519         return 0;
 520 }
 521
 522 static void dns_query_complete(DnsQuery *q, DnsTransactionState state) {
 523         assert(q);
 524         assert(!DNS_TRANSACTION_IS_LIVE(state));
 525         assert(DNS_TRANSACTION_IS_LIVE(q->state));
 526
 527         /* Note that this call might invalidate the query. Callers
 528          * should hence not attempt to access the query or transaction
 529          * after calling this function. */
 530
 531         q->state = state;
 532
 533         dns_query_stop(q);
 534         if (q->complete)
 535                 q->complete(q);
 536 }
 537
 538 static int on_query_timeout(sd_event_source *s, usec_t usec, void *userdata) {
 539         DnsQuery *q = userdata;
 540
 541         assert(s);
 542         assert(q);
 543
 544         dns_query_complete(q, DNS_TRANSACTION_TIMEOUT);
 545         return 0;
 546 }
 547
 548 static int dns_query_add_candidate(DnsQuery *q, DnsScope *s) {
 549         DnsQueryCandidate *c;
 550         int r;
 551
 552         assert(q);
 553         assert(s);
 554
 555         r = dns_query_candidate_new(&c, q, s);
 556         if (r < 0)
 557                 return r;
 558
 559         /* If this a single-label domain on DNS, we might append a suitable search domain first. */
 560         if ((q->flags & SD_RESOLVED_NO_SEARCH) == 0)  {
 561                 r = dns_scope_name_needs_search_domain(s, dns_question_first_name(q->question_idna));
 562                 if (r < 0)
 563                         goto fail;
 564                 if (r > 0) {
 565                         /* OK, we need a search domain now. Let's find one for this scope */
 566
 567                         r = dns_query_candidate_next_search_domain(c);
 568                         if (r <= 0) /* if there's no search domain, then we won't add any transaction. */
 569                                 goto fail;
 570                 }
 571         }
 572
 573         r = dns_query_candidate_setup_transactions(c);
 574         if (r < 0)
 575                 goto fail;
 576
 577         return 0;
 578
 579 fail:
 580         dns_query_candidate_free(c);
 581         return r;
 582 }
 583
 584 static int dns_query_synthesize_reply(DnsQuery *q, DnsTransactionState *state) {
 585         _cleanup_(dns_answer_unrefp) DnsAnswer *answer = NULL;
 586         int r;
 587
 588         assert(q);
 589         assert(state);
 590
 591         /* Tries to synthesize localhost RR replies (and others) where appropriate. Note that this is done *after* the
 592          * the normal lookup finished. The data from the network hence takes precedence over the data we
 593          * synthesize. (But note that many scopes refuse to resolve certain domain names) */
 594
 595         if (!IN_SET(*state,
 596                     DNS_TRANSACTION_RCODE_FAILURE,
 597                     DNS_TRANSACTION_NO_SERVERS,
 598                     DNS_TRANSACTION_TIMEOUT,
 599                     DNS_TRANSACTION_ATTEMPTS_MAX_REACHED,
 600                     DNS_TRANSACTION_NETWORK_DOWN,
 601                     DNS_TRANSACTION_NOT_FOUND))
 602                 return 0;
 603
 604         r = dns_synthesize_answer(
 605                         q->manager,
 606                         q->question_utf8,
 607                         q->ifindex,
 608                         &answer);
 609         if (r == -ENXIO) {
 610                 /* If we get ENXIO this tells us to generate NXDOMAIN unconditionally. */
 611
 612                 dns_query_reset_answer(q);
 613                 q->answer_rcode = DNS_RCODE_NXDOMAIN;
 614                 q->answer_protocol = dns_synthesize_protocol(q->flags);
 615                 q->answer_family = dns_synthesize_family(q->flags);
 616                 q->answer_authenticated = true;
 617                 *state = DNS_TRANSACTION_RCODE_FAILURE;
 618
 619                 return 0;
 620         }
 621         if (r <= 0)
 622                 return r;
 623
 624         dns_query_reset_answer(q);
 625
 626         q->answer = TAKE_PTR(answer);
 627         q->answer_rcode = DNS_RCODE_SUCCESS;
 628         q->answer_protocol = dns_synthesize_protocol(q->flags);
 629         q->answer_family = dns_synthesize_family(q->flags);
 630         q->answer_authenticated = true;
 631
 632         *state = DNS_TRANSACTION_SUCCESS;
 633
 634         return 1;
 635 }
 636
 637 static int dns_query_try_etc_hosts(DnsQuery *q) {
 638         _cleanup_(dns_answer_unrefp) DnsAnswer *answer = NULL;
 639         int r;
 640
 641         assert(q);
 642
 643         /* Looks in /etc/hosts for matching entries. Note that this is done *before* the normal lookup is done. The
 644          * data from /etc/hosts hence takes precedence over the network. */
 645
 646         r = manager_etc_hosts_lookup(
 647                         q->manager,
 648                         q->question_utf8,
 649                         &answer);
 650         if (r <= 0)
 651                 return r;
 652
 653         dns_query_reset_answer(q);
 654
 655         q->answer = TAKE_PTR(answer);
 656         q->answer_rcode = DNS_RCODE_SUCCESS;
 657         q->answer_protocol = dns_synthesize_protocol(q->flags);
 658         q->answer_family = dns_synthesize_family(q->flags);
 659         q->answer_authenticated = true;
 660
 661         return 1;
 662 }
 663
 664 int dns_query_go(DnsQuery *q) {
 665         DnsScopeMatch found = DNS_SCOPE_NO;
 666         DnsScope *s, *first = NULL;
 667         DnsQueryCandidate *c;
 668         int r;
 669
 670         assert(q);
 671
 672         if (q->state != DNS_TRANSACTION_NULL)
 673                 return 0;
 674
 675         r = dns_query_try_etc_hosts(q);
 676         if (r < 0)
 677                 return r;
 678         if (r > 0) {
 679                 dns_query_complete(q, DNS_TRANSACTION_SUCCESS);
 680                 return 1;
 681         }
 682
 683         LIST_FOREACH(scopes, s, q->manager->dns_scopes) {
 684                 DnsScopeMatch match;
 685                 const char *name;
 686
 687                 name = dns_question_first_name(dns_query_question_for_protocol(q, s->protocol));
 688                 if (!name)
 689                         continue;
 690
 691                 match = dns_scope_good_domain(s, q->ifindex, q->flags, name);
 692                 if (match < 0)
 693                         return match;
 694
 695                 if (match == DNS_SCOPE_NO)
 696                         continue;
 697
 698                 found = match;
 699
 700                 if (match == DNS_SCOPE_YES) {
 701                         first = s;
 702                         break;
 703                 } else {
 704                         assert(match == DNS_SCOPE_MAYBE);
 705
 706                         if (!first)
 707                                 first = s;
 708                 }
 709         }
 710
 711         if (found == DNS_SCOPE_NO) {
 712                 DnsTransactionState state = DNS_TRANSACTION_NO_SERVERS;
 713
 714                 r = dns_query_synthesize_reply(q, &state);
 715                 if (r < 0)
 716                         return r;
 717
 718                 dns_query_complete(q, state);
 719                 return 1;
 720         }
 721
 722         r = dns_query_add_candidate(q, first);
 723         if (r < 0)
 724                 goto fail;
 725
 726         LIST_FOREACH(scopes, s, first->scopes_next) {
 727                 DnsScopeMatch match;
 728                 const char *name;
 729
 730                 name = dns_question_first_name(dns_query_question_for_protocol(q, s->protocol));
 731                 if (!name)
 732                         continue;
 733
 734                 match = dns_scope_good_domain(s, q->ifindex, q->flags, name);
 735                 if (match < 0)
 736                         goto fail;
 737
 738                 if (match != found)
 739                         continue;
 740
 741                 r = dns_query_add_candidate(q, s);
 742                 if (r < 0)
 743                         goto fail;
 744         }
 745
 746         dns_query_reset_answer(q);
 747
 748         r = sd_event_add_time(
 749                         q->manager->event,
 750                         &q->timeout_event_source,
 751                         clock_boottime_or_monotonic(),
 752                         now(clock_boottime_or_monotonic()) + SD_RESOLVED_QUERY_TIMEOUT_USEC,
 753                         0, on_query_timeout, q);
 754         if (r < 0)
 755                 goto fail;
 756
 757         (void) sd_event_source_set_description(q->timeout_event_source, "query-timeout");
 758
 759         q->state = DNS_TRANSACTION_PENDING;
 760         q->block_ready++;
 761
 762         /* Start the transactions */
 763         LIST_FOREACH(candidates_by_query, c, q->candidates) {
 764                 r = dns_query_candidate_go(c);
 765                 if (r < 0) {
 766                         q->block_ready--;
 767                         goto fail;
 768                 }
 769         }
 770
 771         q->block_ready--;
 772         dns_query_ready(q);
 773
 774         return 1;
 775
 776 fail:
 777         dns_query_stop(q);
 778         return r;
 779 }
 780
 781 static void dns_query_accept(DnsQuery *q, DnsQueryCandidate *c) {
 782         DnsTransactionState state = DNS_TRANSACTION_NO_SERVERS;
 783         bool has_authenticated = false, has_non_authenticated = false;
 784         DnssecResult dnssec_result_authenticated = _DNSSEC_RESULT_INVALID, dnssec_result_non_authenticated = _DNSSEC_RESULT_INVALID;
 785         DnsTransaction *t;
 786         Iterator i;
 787         int r;
 788
 789         assert(q);
 790
 791         if (!c) {
 792                 r = dns_query_synthesize_reply(q, &state);
 793                 if (r < 0)
 794                         goto fail;
 795
 796                 dns_query_complete(q, state);
 797                 return;
 798         }
 799
 800         if (c->error_code != 0) {
 801                 /* If the candidate had an error condition of its own, start with that. */
 802                 state = DNS_TRANSACTION_ERRNO;
 803                 q->answer = dns_answer_unref(q->answer);
 804                 q->answer_rcode = 0;
 805                 q->answer_dnssec_result = _DNSSEC_RESULT_INVALID;
 806                 q->answer_authenticated = false;
 807                 q->answer_errno = c->error_code;
 808         }
 809
 810         SET_FOREACH(t, c->transactions, i) {
 811
 812                 switch (t->state) {
 813
 814                 case DNS_TRANSACTION_SUCCESS: {
 815                         /* We found a successfully reply, merge it into the answer */
 816                         r = dns_answer_extend(&q->answer, t->answer);
 817                         if (r < 0)
 818                                 goto fail;
 819
 820                         q->answer_rcode = t->answer_rcode;
 821                         q->answer_errno = 0;
 822
 823                         if (t->answer_authenticated) {
 824                                 has_authenticated = true;
 825                                 dnssec_result_authenticated = t->answer_dnssec_result;
 826                         } else {
 827                                 has_non_authenticated = true;
 828                                 dnssec_result_non_authenticated = t->answer_dnssec_result;
 829                         }
 830
 831                         state = DNS_TRANSACTION_SUCCESS;
 832                         break;
 833                 }
 834
 835                 case DNS_TRANSACTION_NULL:
 836                 case DNS_TRANSACTION_PENDING:
 837                 case DNS_TRANSACTION_VALIDATING:
 838                 case DNS_TRANSACTION_ABORTED:
 839                         /* Ignore transactions that didn't complete */
 840                         continue;
 841
 842                 default:
 843                         /* Any kind of failure? Store the data away, if there's nothing stored yet. */
 844                         if (state == DNS_TRANSACTION_SUCCESS)
 845                                 continue;
 846
 847                         /* If there's already an authenticated negative reply stored, then prefer that over any unauthenticated one */
 848                         if (q->answer_authenticated && !t->answer_authenticated)
 849                                 continue;
 850
 851                         q->answer = dns_answer_unref(q->answer);
 852                         q->answer_rcode = t->answer_rcode;
 853                         q->answer_dnssec_result = t->answer_dnssec_result;
 854                         q->answer_authenticated = t->answer_authenticated;
 855                         q->answer_errno = t->answer_errno;
 856
 857                         state = t->state;
 858                         break;
 859                 }
 860         }
 861
 862         if (state == DNS_TRANSACTION_SUCCESS) {
 863                 q->answer_authenticated = has_authenticated && !has_non_authenticated;
 864                 q->answer_dnssec_result = q->answer_authenticated ? dnssec_result_authenticated : dnssec_result_non_authenticated;
 865         }
 866
 867         q->answer_protocol = c->scope->protocol;
 868         q->answer_family = c->scope->family;
 869
 870         dns_search_domain_unref(q->answer_search_domain);
 871         q->answer_search_domain = dns_search_domain_ref(c->search_domain);
 872
 873         r = dns_query_synthesize_reply(q, &state);
 874         if (r < 0)
 875                 goto fail;
 876
 877         dns_query_complete(q, state);
 878         return;
 879
 880 fail:
 881         q->answer_errno = -r;
 882         dns_query_complete(q, DNS_TRANSACTION_ERRNO);
 883 }
 884
 885 void dns_query_ready(DnsQuery *q) {
 886
 887         DnsQueryCandidate *bad = NULL, *c;
 888         bool pending = false;
 889
 890         assert(q);
 891         assert(DNS_TRANSACTION_IS_LIVE(q->state));
 892
 893         /* Note that this call might invalidate the query. Callers
 894          * should hence not attempt to access the query or transaction
 895          * after calling this function, unless the block_ready
 896          * counter was explicitly bumped before doing so. */
 897
 898         if (q->block_ready > 0)
 899                 return;
 900
 901         LIST_FOREACH(candidates_by_query, c, q->candidates) {
 902                 DnsTransactionState state;
 903
 904                 state = dns_query_candidate_state(c);
 905                 switch (state) {
 906
 907                 case DNS_TRANSACTION_SUCCESS:
 908                         /* One of the candidates is successful,
 909                          * let's use it, and copy its data out */
 910                         dns_query_accept(q, c);
 911                         return;
 912
 913                 case DNS_TRANSACTION_NULL:
 914                 case DNS_TRANSACTION_PENDING:
 915                 case DNS_TRANSACTION_VALIDATING:
 916                         /* One of the candidates is still going on,
 917                          * let's maybe wait for it */
 918                         pending = true;
 919                         break;
 920
 921                 default:
 922                         /* Any kind of failure */
 923                         bad = c;
 924                         break;
 925                 }
 926         }
 927
 928         if (pending)
 929                 return;
 930
 931         dns_query_accept(q, bad);
 932 }
 933
 934 static int dns_query_cname_redirect(DnsQuery *q, const DnsResourceRecord *cname) {
 935         _cleanup_(dns_question_unrefp) DnsQuestion *nq_idna = NULL, *nq_utf8 = NULL;
 936         int r, k;
 937
 938         assert(q);
 939
 940         q->n_cname_redirects++;
 941         if (q->n_cname_redirects > CNAME_MAX)
 942                 return -ELOOP;
 943
 944         r = dns_question_cname_redirect(q->question_idna, cname, &nq_idna);
 945         if (r < 0)
 946                 return r;
 947         else if (r > 0)
 948                 log_debug("Following CNAME/DNAME %s → %s.", dns_question_first_name(q->question_idna), dns_question_first_name(nq_idna));
 949
 950         k = dns_question_is_equal(q->question_idna, q->question_utf8);
 951         if (k < 0)
 952                 return r;
 953         if (k > 0) {
 954                 /* Same question? Shortcut new question generation */
 955                 nq_utf8 = dns_question_ref(nq_idna);
 956                 k = r;
 957         } else {
 958                 k = dns_question_cname_redirect(q->question_utf8, cname, &nq_utf8);
 959                 if (k < 0)
 960                         return k;
 961                 else if (k > 0)
 962                         log_debug("Following UTF8 CNAME/DNAME %s → %s.", dns_question_first_name(q->question_utf8), dns_question_first_name(nq_utf8));
 963         }
 964
 965         if (r == 0 && k == 0) /* No actual cname happened? */
 966                 return -ELOOP;
 967
 968         if (q->answer_protocol == DNS_PROTOCOL_DNS) {
 969                 /* Don't permit CNAME redirects from unicast DNS to LLMNR or MulticastDNS, so that global resources
 970                  * cannot invade the local namespace. The opposite way we permit: local names may redirect to global
 971                  * ones. */
 972
 973                 q->flags &= ~(SD_RESOLVED_LLMNR|SD_RESOLVED_MDNS); /* mask away the local protocols */
 974         }
 975
 976         /* Turn off searching for the new name */
 977         q->flags |= SD_RESOLVED_NO_SEARCH;
 978
 979         dns_question_unref(q->question_idna);
 980         q->question_idna = TAKE_PTR(nq_idna);
 981
 982         dns_question_unref(q->question_utf8);
 983         q->question_utf8 = TAKE_PTR(nq_utf8);
 984
 985         dns_query_free_candidates(q);
 986         dns_query_reset_answer(q);
 987
 988         q->state = DNS_TRANSACTION_NULL;
 989
 990         return 0;
 991 }
 992
 993 int dns_query_process_cname(DnsQuery *q) {
 994         _cleanup_(dns_resource_record_unrefp) DnsResourceRecord *cname = NULL;
 995         DnsQuestion *question;
 996         DnsResourceRecord *rr;
 997         int r;
 998
 999         assert(q);
1000
1001         if (!IN_SET(q->state, DNS_TRANSACTION_SUCCESS, DNS_TRANSACTION_NULL))
1002                 return DNS_QUERY_NOMATCH;
1003
1004         question = dns_query_question_for_protocol(q, q->answer_protocol);
1005
1006         DNS_ANSWER_FOREACH(rr, q->answer) {
1007                 r = dns_question_matches_rr(question, rr, DNS_SEARCH_DOMAIN_NAME(q->answer_search_domain));
1008                 if (r < 0)
1009                         return r;
1010                 if (r > 0)
1011                         return DNS_QUERY_MATCH; /* The answer matches directly, no need to follow cnames */
1012
1013                 r = dns_question_matches_cname_or_dname(question, rr, DNS_SEARCH_DOMAIN_NAME(q->answer_search_domain));
1014                 if (r < 0)
1015                         return r;
1016                 if (r > 0 && !cname)
1017                         cname = dns_resource_record_ref(rr);
1018         }
1019
1020         if (!cname)
1021                 return DNS_QUERY_NOMATCH; /* No match and no cname to follow */
1022
1023         if (q->flags & SD_RESOLVED_NO_CNAME)
1024                 return -ELOOP;
1025
1026         if (!q->answer_authenticated)
1027                 q->previous_redirect_unauthenticated = true;
1028
1029         /* OK, let's actually follow the CNAME */
1030         r = dns_query_cname_redirect(q, cname);
1031         if (r < 0)
1032                 return r;
1033
1034         /* Let's see if the answer can already answer the new
1035          * redirected question */
1036         r = dns_query_process_cname(q);
1037         if (r != DNS_QUERY_NOMATCH)
1038                 return r;
1039
1040         /* OK, it cannot, let's begin with the new query */
1041         r = dns_query_go(q);
1042         if (r < 0)
1043                 return r;
1044
1045         return DNS_QUERY_RESTARTED; /* We restarted the query for a new cname */
1046 }
1047
1048 static int on_bus_track(sd_bus_track *t, void *userdata) {
1049         DnsQuery *q = userdata;
1050
1051         assert(t);
1052         assert(q);
1053
1054         log_debug("Client of active query vanished, aborting query.");
1055         dns_query_complete(q, DNS_TRANSACTION_ABORTED);
1056         return 0;
1057 }
1058
1059 int dns_query_bus_track(DnsQuery *q, sd_bus_message *m) {
1060         int r;
1061
1062         assert(q);
1063         assert(m);
1064
1065         if (!q->bus_track) {
1066                 r = sd_bus_track_new(sd_bus_message_get_bus(m), &q->bus_track, on_bus_track, q);
1067                 if (r < 0)
1068                         return r;
1069         }
1070
1071         r = sd_bus_track_add_sender(q->bus_track, m);
1072         if (r < 0)
1073                 return r;
1074
1075         return 0;
1076 }
1077
1078 DnsQuestion* dns_query_question_for_protocol(DnsQuery *q, DnsProtocol protocol) {
1079         assert(q);
1080
1081         switch (protocol) {
1082
1083         case DNS_PROTOCOL_DNS:
1084                 return q->question_idna;
1085
1086         case DNS_PROTOCOL_MDNS:
1087         case DNS_PROTOCOL_LLMNR:
1088                 return q->question_utf8;
1089
1090         default:
1091                 return NULL;
1092         }
1093 }
1094
1095 const char *dns_query_string(DnsQuery *q) {
1096         const char *name;
1097         int r;
1098
1099         /* Returns a somewhat useful human-readable lookup key string for this query */
1100
1101         if (q->request_address_string)
1102                 return q->request_address_string;
1103
1104         if (q->request_address_valid) {
1105                 r = in_addr_to_string(q->request_family, &q->request_address, &q->request_address_string);
1106                 if (r >= 0)
1107                         return q->request_address_string;
1108         }
1109
1110         name = dns_question_first_name(q->question_utf8);
1111         if (name)
1112                 return name;
1113
1114         return dns_question_first_name(q->question_idna);
1115 }
1116
1117 bool dns_query_fully_authenticated(DnsQuery *q) {
1118         assert(q);
1119
1120         return q->answer_authenticated && !q->previous_redirect_unauthenticated;
1121 }