src/resolve/resolved-dns-query.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2
   3 #include "alloc-util.h"
   4 #include "dns-domain.h"
   5 #include "dns-type.h"
   6 #include "hostname-util.h"
   7 #include "local-addresses.h"
   8 #include "resolved-dns-query.h"
   9 #include "resolved-dns-synthesize.h"
  10 #include "resolved-etc-hosts.h"
  11 #include "string-util.h"
  12
  13 #define CNAME_MAX 8
  14 #define QUERIES_MAX 2048
  15 #define AUXILIARY_QUERIES_MAX 64
  16
  17 static int dns_query_candidate_new(DnsQueryCandidate **ret, DnsQuery *q, DnsScope *s) {
  18         DnsQueryCandidate *c;
  19
  20         assert(ret);
  21         assert(q);
  22         assert(s);
  23
  24         c = new0(DnsQueryCandidate, 1);
  25         if (!c)
  26                 return -ENOMEM;
  27
  28         c->query = q;
  29         c->scope = s;
  30
  31         LIST_PREPEND(candidates_by_query, q->candidates, c);
  32         LIST_PREPEND(candidates_by_scope, s->query_candidates, c);
  33
  34         *ret = c;
  35         return 0;
  36 }
  37
  38 static void dns_query_candidate_stop(DnsQueryCandidate *c) {
  39         DnsTransaction *t;
  40
  41         assert(c);
  42
  43         while ((t = set_steal_first(c->transactions))) {
  44                 set_remove(t->notify_query_candidates, c);
  45                 set_remove(t->notify_query_candidates_done, c);
  46                 dns_transaction_gc(t);
  47         }
  48 }
  49
  50 DnsQueryCandidate* dns_query_candidate_free(DnsQueryCandidate *c) {
  51
  52         if (!c)
  53                 return NULL;
  54
  55         dns_query_candidate_stop(c);
  56
  57         set_free(c->transactions);
  58         dns_search_domain_unref(c->search_domain);
  59
  60         if (c->query)
  61                 LIST_REMOVE(candidates_by_query, c->query->candidates, c);
  62
  63         if (c->scope)
  64                 LIST_REMOVE(candidates_by_scope, c->scope->query_candidates, c);
  65
  66         return mfree(c);
  67 }
  68
  69 static int dns_query_candidate_next_search_domain(DnsQueryCandidate *c) {
  70         DnsSearchDomain *next = NULL;
  71
  72         assert(c);
  73
  74         if (c->search_domain && c->search_domain->linked)
  75                 next = c->search_domain->domains_next;
  76         else
  77                 next = dns_scope_get_search_domains(c->scope);
  78
  79         for (;;) {
  80                 if (!next) /* We hit the end of the list */
  81                         return 0;
  82
  83                 if (!next->route_only)
  84                         break;
  85
  86                 /* Skip over route-only domains */
  87                 next = next->domains_next;
  88         }
  89
  90         dns_search_domain_unref(c->search_domain);
  91         c->search_domain = dns_search_domain_ref(next);
  92
  93         return 1;
  94 }
  95
  96 static int dns_query_candidate_add_transaction(DnsQueryCandidate *c, DnsResourceKey *key) {
  97         DnsTransaction *t;
  98         int r;
  99
 100         assert(c);
 101         assert(key);
 102
 103         t = dns_scope_find_transaction(c->scope, key, true);
 104         if (!t) {
 105                 r = dns_transaction_new(&t, c->scope, key);
 106                 if (r < 0)
 107                         return r;
 108         } else {
 109                 if (set_contains(c->transactions, t))
 110                         return 0;
 111         }
 112
 113         r = set_ensure_allocated(&c->transactions, NULL);
 114         if (r < 0)
 115                 goto gc;
 116
 117         r = set_ensure_allocated(&t->notify_query_candidates, NULL);
 118         if (r < 0)
 119                 goto gc;
 120
 121         r = set_ensure_allocated(&t->notify_query_candidates_done, NULL);
 122         if (r < 0)
 123                 goto gc;
 124
 125         r = set_put(t->notify_query_candidates, c);
 126         if (r < 0)
 127                 goto gc;
 128
 129         r = set_put(c->transactions, t);
 130         if (r < 0) {
 131                 (void) set_remove(t->notify_query_candidates, c);
 132                 goto gc;
 133         }
 134
 135         t->clamp_ttl = c->query->clamp_ttl;
 136         return 1;
 137
 138 gc:
 139         dns_transaction_gc(t);
 140         return r;
 141 }
 142
 143 static int dns_query_candidate_go(DnsQueryCandidate *c) {
 144         DnsTransaction *t;
 145         Iterator i;
 146         int r;
 147         unsigned n = 0;
 148
 149         assert(c);
 150
 151         /* Start the transactions that are not started yet */
 152         SET_FOREACH(t, c->transactions, i) {
 153                 if (t->state != DNS_TRANSACTION_NULL)
 154                         continue;
 155
 156                 r = dns_transaction_go(t);
 157                 if (r < 0)
 158                         return r;
 159
 160                 n++;
 161         }
 162
 163         /* If there was nothing to start, then let's proceed immediately */
 164         if (n == 0)
 165                 dns_query_candidate_notify(c);
 166
 167         return 0;
 168 }
 169
 170 static DnsTransactionState dns_query_candidate_state(DnsQueryCandidate *c) {
 171         DnsTransactionState state = DNS_TRANSACTION_NO_SERVERS;
 172         DnsTransaction *t;
 173         Iterator i;
 174
 175         assert(c);
 176
 177         if (c->error_code != 0)
 178                 return DNS_TRANSACTION_ERRNO;
 179
 180         SET_FOREACH(t, c->transactions, i) {
 181
 182                 switch (t->state) {
 183
 184                 case DNS_TRANSACTION_NULL:
 185                         /* If there's a NULL transaction pending, then
 186                          * this means not all transactions where
 187                          * started yet, and we were called from within
 188                          * the stackframe that is supposed to start
 189                          * remaining transactions. In this case,
 190                          * simply claim the candidate is pending. */
 191
 192                 case DNS_TRANSACTION_PENDING:
 193                 case DNS_TRANSACTION_VALIDATING:
 194                         /* If there's one transaction currently in
 195                          * VALIDATING state, then this means there's
 196                          * also one in PENDING state, hence we can
 197                          * return PENDING immediately. */
 198                         return DNS_TRANSACTION_PENDING;
 199
 200                 case DNS_TRANSACTION_SUCCESS:
 201                         state = t->state;
 202                         break;
 203
 204                 default:
 205                         if (state != DNS_TRANSACTION_SUCCESS)
 206                                 state = t->state;
 207
 208                         break;
 209                 }
 210         }
 211
 212         return state;
 213 }
 214
 215 static int dns_query_candidate_setup_transactions(DnsQueryCandidate *c) {
 216         DnsQuestion *question;
 217         DnsResourceKey *key;
 218         int n = 0, r;
 219
 220         assert(c);
 221
 222         dns_query_candidate_stop(c);
 223
 224         question = dns_query_question_for_protocol(c->query, c->scope->protocol);
 225
 226         /* Create one transaction per question key */
 227         DNS_QUESTION_FOREACH(key, question) {
 228                 _cleanup_(dns_resource_key_unrefp) DnsResourceKey *new_key = NULL;
 229                 DnsResourceKey *qkey;
 230
 231                 if (c->search_domain) {
 232                         r = dns_resource_key_new_append_suffix(&new_key, key, c->search_domain->name);
 233                         if (r < 0)
 234                                 goto fail;
 235
 236                         qkey = new_key;
 237                 } else
 238                         qkey = key;
 239
 240                 if (!dns_scope_good_key(c->scope, qkey))
 241                         continue;
 242
 243                 r = dns_query_candidate_add_transaction(c, qkey);
 244                 if (r < 0)
 245                         goto fail;
 246
 247                 n++;
 248         }
 249
 250         return n;
 251
 252 fail:
 253         dns_query_candidate_stop(c);
 254         return r;
 255 }
 256
 257 void dns_query_candidate_notify(DnsQueryCandidate *c) {
 258         DnsTransactionState state;
 259         int r;
 260
 261         assert(c);
 262
 263         state = dns_query_candidate_state(c);
 264
 265         if (DNS_TRANSACTION_IS_LIVE(state))
 266                 return;
 267
 268         if (state != DNS_TRANSACTION_SUCCESS && c->search_domain) {
 269
 270                 r = dns_query_candidate_next_search_domain(c);
 271                 if (r < 0)
 272                         goto fail;
 273
 274                 if (r > 0) {
 275                         /* OK, there's another search domain to try, let's do so. */
 276
 277                         r = dns_query_candidate_setup_transactions(c);
 278                         if (r < 0)
 279                                 goto fail;
 280
 281                         if (r > 0) {
 282                                 /* New transactions where queued. Start them and wait */
 283
 284                                 r = dns_query_candidate_go(c);
 285                                 if (r < 0)
 286                                         goto fail;
 287
 288                                 return;
 289                         }
 290                 }
 291
 292         }
 293
 294         dns_query_ready(c->query);
 295         return;
 296
 297 fail:
 298         log_warning_errno(r, "Failed to follow search domains: %m");
 299         c->error_code = r;
 300         dns_query_ready(c->query);
 301 }
 302
 303 static void dns_query_stop(DnsQuery *q) {
 304         DnsQueryCandidate *c;
 305
 306         assert(q);
 307
 308         q->timeout_event_source = sd_event_source_unref(q->timeout_event_source);
 309
 310         LIST_FOREACH(candidates_by_query, c, q->candidates)
 311                 dns_query_candidate_stop(c);
 312 }
 313
 314 static void dns_query_free_candidates(DnsQuery *q) {
 315         assert(q);
 316
 317         while (q->candidates)
 318                 dns_query_candidate_free(q->candidates);
 319 }
 320
 321 static void dns_query_reset_answer(DnsQuery *q) {
 322         assert(q);
 323
 324         q->answer = dns_answer_unref(q->answer);
 325         q->answer_rcode = 0;
 326         q->answer_dnssec_result = _DNSSEC_RESULT_INVALID;
 327         q->answer_errno = 0;
 328         q->answer_authenticated = false;
 329         q->answer_protocol = _DNS_PROTOCOL_INVALID;
 330         q->answer_family = AF_UNSPEC;
 331         q->answer_search_domain = dns_search_domain_unref(q->answer_search_domain);
 332 }
 333
 334 DnsQuery *dns_query_free(DnsQuery *q) {
 335         if (!q)
 336                 return NULL;
 337
 338         while (q->auxiliary_queries)
 339                 dns_query_free(q->auxiliary_queries);
 340
 341         if (q->auxiliary_for) {
 342                 assert(q->auxiliary_for->n_auxiliary_queries > 0);
 343                 q->auxiliary_for->n_auxiliary_queries--;
 344                 LIST_REMOVE(auxiliary_queries, q->auxiliary_for->auxiliary_queries, q);
 345         }
 346
 347         dns_query_free_candidates(q);
 348
 349         dns_question_unref(q->question_idna);
 350         dns_question_unref(q->question_utf8);
 351
 352         dns_query_reset_answer(q);
 353
 354         sd_bus_message_unref(q->request);
 355         sd_bus_track_unref(q->bus_track);
 356
 357         dns_packet_unref(q->request_dns_packet);
 358         dns_packet_unref(q->reply_dns_packet);
 359
 360         if (q->request_dns_stream) {
 361                 /* Detach the stream from our query, in case something else keeps a reference to it. */
 362                 (void) set_remove(q->request_dns_stream->queries, q);
 363                 q->request_dns_stream = dns_stream_unref(q->request_dns_stream);
 364         }
 365
 366         free(q->request_address_string);
 367
 368         if (q->manager) {
 369                 LIST_REMOVE(queries, q->manager->dns_queries, q);
 370                 q->manager->n_dns_queries--;
 371         }
 372
 373         return mfree(q);
 374 }
 375
 376 int dns_query_new(
 377                 Manager *m,
 378                 DnsQuery **ret,
 379                 DnsQuestion *question_utf8,
 380                 DnsQuestion *question_idna,
 381                 int ifindex,
 382                 uint64_t flags) {
 383
 384         _cleanup_(dns_query_freep) DnsQuery *q = NULL;
 385         DnsResourceKey *key;
 386         bool good = false;
 387         int r;
 388         char key_str[DNS_RESOURCE_KEY_STRING_MAX];
 389
 390         assert(m);
 391
 392         if (dns_question_size(question_utf8) > 0) {
 393                 r = dns_question_is_valid_for_query(question_utf8);
 394                 if (r < 0)
 395                         return r;
 396                 if (r == 0)
 397                         return -EINVAL;
 398
 399                 good = true;
 400         }
 401
 402         /* If the IDNA and UTF8 questions are the same, merge their references */
 403         r = dns_question_is_equal(question_idna, question_utf8);
 404         if (r < 0)
 405                 return r;
 406         if (r > 0)
 407                 question_idna = question_utf8;
 408         else {
 409                 if (dns_question_size(question_idna) > 0) {
 410                         r = dns_question_is_valid_for_query(question_idna);
 411                         if (r < 0)
 412                                 return r;
 413                         if (r == 0)
 414                                 return -EINVAL;
 415
 416                         good = true;
 417                 }
 418         }
 419
 420         if (!good) /* don't allow empty queries */
 421                 return -EINVAL;
 422
 423         if (m->n_dns_queries >= QUERIES_MAX)
 424                 return -EBUSY;
 425
 426         q = new0(DnsQuery, 1);
 427         if (!q)
 428                 return -ENOMEM;
 429
 430         q->question_utf8 = dns_question_ref(question_utf8);
 431         q->question_idna = dns_question_ref(question_idna);
 432         q->ifindex = ifindex;
 433         q->flags = flags;
 434         q->answer_dnssec_result = _DNSSEC_RESULT_INVALID;
 435         q->answer_protocol = _DNS_PROTOCOL_INVALID;
 436         q->answer_family = AF_UNSPEC;
 437
 438         /* First dump UTF8  question */
 439         DNS_QUESTION_FOREACH(key, question_utf8)
 440                 log_debug("Looking up RR for %s.",
 441                           dns_resource_key_to_string(key, key_str, sizeof key_str));
 442
 443         /* And then dump the IDNA question, but only what hasn't been dumped already through the UTF8 question. */
 444         DNS_QUESTION_FOREACH(key, question_idna) {
 445                 r = dns_question_contains(question_utf8, key);
 446                 if (r < 0)
 447                         return r;
 448                 if (r > 0)
 449                         continue;
 450
 451                 log_debug("Looking up IDNA RR for %s.",
 452                           dns_resource_key_to_string(key, key_str, sizeof key_str));
 453         }
 454
 455         LIST_PREPEND(queries, m->dns_queries, q);
 456         m->n_dns_queries++;
 457         q->manager = m;
 458
 459         if (ret)
 460                 *ret = q;
 461         q = NULL;
 462
 463         return 0;
 464 }
 465
 466 int dns_query_make_auxiliary(DnsQuery *q, DnsQuery *auxiliary_for) {
 467         assert(q);
 468         assert(auxiliary_for);
 469
 470         /* Ensure that the query is not auxiliary yet, and
 471          * nothing else is auxiliary to it either */
 472         assert(!q->auxiliary_for);
 473         assert(!q->auxiliary_queries);
 474
 475         /* Ensure that the unit we shall be made auxiliary for isn't
 476          * auxiliary itself */
 477         assert(!auxiliary_for->auxiliary_for);
 478
 479         if (auxiliary_for->n_auxiliary_queries >= AUXILIARY_QUERIES_MAX)
 480                 return -EAGAIN;
 481
 482         LIST_PREPEND(auxiliary_queries, auxiliary_for->auxiliary_queries, q);
 483         q->auxiliary_for = auxiliary_for;
 484
 485         auxiliary_for->n_auxiliary_queries++;
 486         return 0;
 487 }
 488
 489 static void dns_query_complete(DnsQuery *q, DnsTransactionState state) {
 490         assert(q);
 491         assert(!DNS_TRANSACTION_IS_LIVE(state));
 492         assert(DNS_TRANSACTION_IS_LIVE(q->state));
 493
 494         /* Note that this call might invalidate the query. Callers
 495          * should hence not attempt to access the query or transaction
 496          * after calling this function. */
 497
 498         q->state = state;
 499
 500         dns_query_stop(q);
 501         if (q->complete)
 502                 q->complete(q);
 503 }
 504
 505 static int on_query_timeout(sd_event_source *s, usec_t usec, void *userdata) {
 506         DnsQuery *q = userdata;
 507
 508         assert(s);
 509         assert(q);
 510
 511         dns_query_complete(q, DNS_TRANSACTION_TIMEOUT);
 512         return 0;
 513 }
 514
 515 static int dns_query_add_candidate(DnsQuery *q, DnsScope *s) {
 516         DnsQueryCandidate *c;
 517         int r;
 518
 519         assert(q);
 520         assert(s);
 521
 522         r = dns_query_candidate_new(&c, q, s);
 523         if (r < 0)
 524                 return r;
 525
 526         /* If this a single-label domain on DNS, we might append a suitable search domain first. */
 527         if ((q->flags & SD_RESOLVED_NO_SEARCH) == 0 &&
 528             dns_scope_name_needs_search_domain(s, dns_question_first_name(q->question_idna))) {
 529                 /* OK, we need a search domain now. Let's find one for this scope */
 530
 531                 r = dns_query_candidate_next_search_domain(c);
 532                 if (r <= 0) /* if there's no search domain, then we won't add any transaction. */
 533                         goto fail;
 534         }
 535
 536         r = dns_query_candidate_setup_transactions(c);
 537         if (r < 0)
 538                 goto fail;
 539
 540         return 0;
 541
 542 fail:
 543         dns_query_candidate_free(c);
 544         return r;
 545 }
 546
 547 static int dns_query_synthesize_reply(DnsQuery *q, DnsTransactionState *state) {
 548         _cleanup_(dns_answer_unrefp) DnsAnswer *answer = NULL;
 549         int r;
 550
 551         assert(q);
 552         assert(state);
 553
 554         /* Tries to synthesize localhost RR replies (and others) where appropriate. Note that this is done *after* the
 555          * the normal lookup finished. The data from the network hence takes precedence over the data we
 556          * synthesize. (But note that many scopes refuse to resolve certain domain names) */
 557
 558         if (!IN_SET(*state,
 559                     DNS_TRANSACTION_RCODE_FAILURE,
 560                     DNS_TRANSACTION_NO_SERVERS,
 561                     DNS_TRANSACTION_TIMEOUT,
 562                     DNS_TRANSACTION_ATTEMPTS_MAX_REACHED,
 563                     DNS_TRANSACTION_NETWORK_DOWN,
 564                     DNS_TRANSACTION_NOT_FOUND))
 565                 return 0;
 566
 567         r = dns_synthesize_answer(
 568                         q->manager,
 569                         q->question_utf8,
 570                         q->ifindex,
 571                         &answer);
 572         if (r == -ENXIO) {
 573                 /* If we get ENXIO this tells us to generate NXDOMAIN unconditionally. */
 574
 575                 dns_query_reset_answer(q);
 576                 q->answer_rcode = DNS_RCODE_NXDOMAIN;
 577                 q->answer_protocol = dns_synthesize_protocol(q->flags);
 578                 q->answer_family = dns_synthesize_family(q->flags);
 579                 q->answer_authenticated = true;
 580                 *state = DNS_TRANSACTION_RCODE_FAILURE;
 581
 582                 return 0;
 583         }
 584         if (r <= 0)
 585                 return r;
 586
 587         dns_query_reset_answer(q);
 588
 589         q->answer = TAKE_PTR(answer);
 590         q->answer_rcode = DNS_RCODE_SUCCESS;
 591         q->answer_protocol = dns_synthesize_protocol(q->flags);
 592         q->answer_family = dns_synthesize_family(q->flags);
 593         q->answer_authenticated = true;
 594
 595         *state = DNS_TRANSACTION_SUCCESS;
 596
 597         return 1;
 598 }
 599
 600 static int dns_query_try_etc_hosts(DnsQuery *q) {
 601         _cleanup_(dns_answer_unrefp) DnsAnswer *answer = NULL;
 602         int r;
 603
 604         assert(q);
 605
 606         /* Looks in /etc/hosts for matching entries. Note that this is done *before* the normal lookup is done. The
 607          * data from /etc/hosts hence takes precedence over the network. */
 608
 609         r = manager_etc_hosts_lookup(
 610                         q->manager,
 611                         q->question_utf8,
 612                         &answer);
 613         if (r <= 0)
 614                 return r;
 615
 616         dns_query_reset_answer(q);
 617
 618         q->answer = TAKE_PTR(answer);
 619         q->answer_rcode = DNS_RCODE_SUCCESS;
 620         q->answer_protocol = dns_synthesize_protocol(q->flags);
 621         q->answer_family = dns_synthesize_family(q->flags);
 622         q->answer_authenticated = true;
 623
 624         return 1;
 625 }
 626
 627 int dns_query_go(DnsQuery *q) {
 628         DnsScopeMatch found = DNS_SCOPE_NO;
 629         DnsScope *s, *first = NULL;
 630         DnsQueryCandidate *c;
 631         int r;
 632
 633         assert(q);
 634
 635         if (q->state != DNS_TRANSACTION_NULL)
 636                 return 0;
 637
 638         r = dns_query_try_etc_hosts(q);
 639         if (r < 0)
 640                 return r;
 641         if (r > 0) {
 642                 dns_query_complete(q, DNS_TRANSACTION_SUCCESS);
 643                 return 1;
 644         }
 645
 646         LIST_FOREACH(scopes, s, q->manager->dns_scopes) {
 647                 DnsScopeMatch match;
 648                 const char *name;
 649
 650                 name = dns_question_first_name(dns_query_question_for_protocol(q, s->protocol));
 651                 if (!name)
 652                         continue;
 653
 654                 match = dns_scope_good_domain(s, q->ifindex, q->flags, name);
 655                 if (match < 0) {
 656                         log_debug("Couldn't check if '%s' matches against scope, ignoring.", name);
 657                         continue;
 658                 }
 659
 660                 if (match > found) { /* Does this match better? If so, remember how well it matched, and the first one
 661                                       * that matches this well */
 662                         found = match;
 663                         first = s;
 664                 }
 665         }
 666
 667         if (found == DNS_SCOPE_NO) {
 668                 DnsTransactionState state = DNS_TRANSACTION_NO_SERVERS;
 669
 670                 r = dns_query_synthesize_reply(q, &state);
 671                 if (r < 0)
 672                         return r;
 673
 674                 dns_query_complete(q, state);
 675                 return 1;
 676         }
 677
 678         r = dns_query_add_candidate(q, first);
 679         if (r < 0)
 680                 goto fail;
 681
 682         LIST_FOREACH(scopes, s, first->scopes_next) {
 683                 DnsScopeMatch match;
 684                 const char *name;
 685
 686                 name = dns_question_first_name(dns_query_question_for_protocol(q, s->protocol));
 687                 if (!name)
 688                         continue;
 689
 690                 match = dns_scope_good_domain(s, q->ifindex, q->flags, name);
 691                 if (match < 0) {
 692                         log_debug("Couldn't check if '%s' matches against scope, ignoring.", name);
 693                         continue;
 694                 }
 695
 696                 if (match < found)
 697                         continue;
 698
 699                 r = dns_query_add_candidate(q, s);
 700                 if (r < 0)
 701                         goto fail;
 702         }
 703
 704         dns_query_reset_answer(q);
 705
 706         r = sd_event_add_time(
 707                         q->manager->event,
 708                         &q->timeout_event_source,
 709                         clock_boottime_or_monotonic(),
 710                         now(clock_boottime_or_monotonic()) + SD_RESOLVED_QUERY_TIMEOUT_USEC,
 711                         0, on_query_timeout, q);
 712         if (r < 0)
 713                 goto fail;
 714
 715         (void) sd_event_source_set_description(q->timeout_event_source, "query-timeout");
 716
 717         q->state = DNS_TRANSACTION_PENDING;
 718         q->block_ready++;
 719
 720         /* Start the transactions */
 721         LIST_FOREACH(candidates_by_query, c, q->candidates) {
 722                 r = dns_query_candidate_go(c);
 723                 if (r < 0) {
 724                         q->block_ready--;
 725                         goto fail;
 726                 }
 727         }
 728
 729         q->block_ready--;
 730         dns_query_ready(q);
 731
 732         return 1;
 733
 734 fail:
 735         dns_query_stop(q);
 736         return r;
 737 }
 738
 739 static void dns_query_accept(DnsQuery *q, DnsQueryCandidate *c) {
 740         DnsTransactionState state = DNS_TRANSACTION_NO_SERVERS;
 741         bool has_authenticated = false, has_non_authenticated = false;
 742         DnssecResult dnssec_result_authenticated = _DNSSEC_RESULT_INVALID, dnssec_result_non_authenticated = _DNSSEC_RESULT_INVALID;
 743         DnsTransaction *t;
 744         Iterator i;
 745         int r;
 746
 747         assert(q);
 748
 749         if (!c) {
 750                 r = dns_query_synthesize_reply(q, &state);
 751                 if (r < 0)
 752                         goto fail;
 753
 754                 dns_query_complete(q, state);
 755                 return;
 756         }
 757
 758         if (c->error_code != 0) {
 759                 /* If the candidate had an error condition of its own, start with that. */
 760                 state = DNS_TRANSACTION_ERRNO;
 761                 q->answer = dns_answer_unref(q->answer);
 762                 q->answer_rcode = 0;
 763                 q->answer_dnssec_result = _DNSSEC_RESULT_INVALID;
 764                 q->answer_authenticated = false;
 765                 q->answer_errno = c->error_code;
 766         }
 767
 768         SET_FOREACH(t, c->transactions, i) {
 769
 770                 switch (t->state) {
 771
 772                 case DNS_TRANSACTION_SUCCESS: {
 773                         /* We found a successfully reply, merge it into the answer */
 774                         r = dns_answer_extend(&q->answer, t->answer);
 775                         if (r < 0)
 776                                 goto fail;
 777
 778                         q->answer_rcode = t->answer_rcode;
 779                         q->answer_errno = 0;
 780
 781                         if (t->answer_authenticated) {
 782                                 has_authenticated = true;
 783                                 dnssec_result_authenticated = t->answer_dnssec_result;
 784                         } else {
 785                                 has_non_authenticated = true;
 786                                 dnssec_result_non_authenticated = t->answer_dnssec_result;
 787                         }
 788
 789                         state = DNS_TRANSACTION_SUCCESS;
 790                         break;
 791                 }
 792
 793                 case DNS_TRANSACTION_NULL:
 794                 case DNS_TRANSACTION_PENDING:
 795                 case DNS_TRANSACTION_VALIDATING:
 796                 case DNS_TRANSACTION_ABORTED:
 797                         /* Ignore transactions that didn't complete */
 798                         continue;
 799
 800                 default:
 801                         /* Any kind of failure? Store the data away, if there's nothing stored yet. */
 802                         if (state == DNS_TRANSACTION_SUCCESS)
 803                                 continue;
 804
 805                         /* If there's already an authenticated negative reply stored, then prefer that over any unauthenticated one */
 806                         if (q->answer_authenticated && !t->answer_authenticated)
 807                                 continue;
 808
 809                         q->answer = dns_answer_unref(q->answer);
 810                         q->answer_rcode = t->answer_rcode;
 811                         q->answer_dnssec_result = t->answer_dnssec_result;
 812                         q->answer_authenticated = t->answer_authenticated;
 813                         q->answer_errno = t->answer_errno;
 814
 815                         state = t->state;
 816                         break;
 817                 }
 818         }
 819
 820         if (state == DNS_TRANSACTION_SUCCESS) {
 821                 q->answer_authenticated = has_authenticated && !has_non_authenticated;
 822                 q->answer_dnssec_result = q->answer_authenticated ? dnssec_result_authenticated : dnssec_result_non_authenticated;
 823         }
 824
 825         q->answer_protocol = c->scope->protocol;
 826         q->answer_family = c->scope->family;
 827
 828         dns_search_domain_unref(q->answer_search_domain);
 829         q->answer_search_domain = dns_search_domain_ref(c->search_domain);
 830
 831         r = dns_query_synthesize_reply(q, &state);
 832         if (r < 0)
 833                 goto fail;
 834
 835         dns_query_complete(q, state);
 836         return;
 837
 838 fail:
 839         q->answer_errno = -r;
 840         dns_query_complete(q, DNS_TRANSACTION_ERRNO);
 841 }
 842
 843 void dns_query_ready(DnsQuery *q) {
 844
 845         DnsQueryCandidate *bad = NULL, *c;
 846         bool pending = false;
 847
 848         assert(q);
 849         assert(DNS_TRANSACTION_IS_LIVE(q->state));
 850
 851         /* Note that this call might invalidate the query. Callers
 852          * should hence not attempt to access the query or transaction
 853          * after calling this function, unless the block_ready
 854          * counter was explicitly bumped before doing so. */
 855
 856         if (q->block_ready > 0)
 857                 return;
 858
 859         LIST_FOREACH(candidates_by_query, c, q->candidates) {
 860                 DnsTransactionState state;
 861
 862                 state = dns_query_candidate_state(c);
 863                 switch (state) {
 864
 865                 case DNS_TRANSACTION_SUCCESS:
 866                         /* One of the candidates is successful,
 867                          * let's use it, and copy its data out */
 868                         dns_query_accept(q, c);
 869                         return;
 870
 871                 case DNS_TRANSACTION_NULL:
 872                 case DNS_TRANSACTION_PENDING:
 873                 case DNS_TRANSACTION_VALIDATING:
 874                         /* One of the candidates is still going on,
 875                          * let's maybe wait for it */
 876                         pending = true;
 877                         break;
 878
 879                 default:
 880                         /* Any kind of failure */
 881                         bad = c;
 882                         break;
 883                 }
 884         }
 885
 886         if (pending)
 887                 return;
 888
 889         dns_query_accept(q, bad);
 890 }
 891
 892 static int dns_query_cname_redirect(DnsQuery *q, const DnsResourceRecord *cname) {
 893         _cleanup_(dns_question_unrefp) DnsQuestion *nq_idna = NULL, *nq_utf8 = NULL;
 894         int r, k;
 895
 896         assert(q);
 897
 898         q->n_cname_redirects++;
 899         if (q->n_cname_redirects > CNAME_MAX)
 900                 return -ELOOP;
 901
 902         r = dns_question_cname_redirect(q->question_idna, cname, &nq_idna);
 903         if (r < 0)
 904                 return r;
 905         else if (r > 0)
 906                 log_debug("Following CNAME/DNAME %s → %s.", dns_question_first_name(q->question_idna), dns_question_first_name(nq_idna));
 907
 908         k = dns_question_is_equal(q->question_idna, q->question_utf8);
 909         if (k < 0)
 910                 return r;
 911         if (k > 0) {
 912                 /* Same question? Shortcut new question generation */
 913                 nq_utf8 = dns_question_ref(nq_idna);
 914                 k = r;
 915         } else {
 916                 k = dns_question_cname_redirect(q->question_utf8, cname, &nq_utf8);
 917                 if (k < 0)
 918                         return k;
 919                 else if (k > 0)
 920                         log_debug("Following UTF8 CNAME/DNAME %s → %s.", dns_question_first_name(q->question_utf8), dns_question_first_name(nq_utf8));
 921         }
 922
 923         if (r == 0 && k == 0) /* No actual cname happened? */
 924                 return -ELOOP;
 925
 926         if (q->answer_protocol == DNS_PROTOCOL_DNS) {
 927                 /* Don't permit CNAME redirects from unicast DNS to LLMNR or MulticastDNS, so that global resources
 928                  * cannot invade the local namespace. The opposite way we permit: local names may redirect to global
 929                  * ones. */
 930
 931                 q->flags &= ~(SD_RESOLVED_LLMNR|SD_RESOLVED_MDNS); /* mask away the local protocols */
 932         }
 933
 934         /* Turn off searching for the new name */
 935         q->flags |= SD_RESOLVED_NO_SEARCH;
 936
 937         dns_question_unref(q->question_idna);
 938         q->question_idna = TAKE_PTR(nq_idna);
 939
 940         dns_question_unref(q->question_utf8);
 941         q->question_utf8 = TAKE_PTR(nq_utf8);
 942
 943         dns_query_free_candidates(q);
 944         dns_query_reset_answer(q);
 945
 946         q->state = DNS_TRANSACTION_NULL;
 947
 948         return 0;
 949 }
 950
 951 int dns_query_process_cname(DnsQuery *q) {
 952         _cleanup_(dns_resource_record_unrefp) DnsResourceRecord *cname = NULL;
 953         DnsQuestion *question;
 954         DnsResourceRecord *rr;
 955         int r;
 956
 957         assert(q);
 958
 959         if (!IN_SET(q->state, DNS_TRANSACTION_SUCCESS, DNS_TRANSACTION_NULL))
 960                 return DNS_QUERY_NOMATCH;
 961
 962         question = dns_query_question_for_protocol(q, q->answer_protocol);
 963
 964         DNS_ANSWER_FOREACH(rr, q->answer) {
 965                 r = dns_question_matches_rr(question, rr, DNS_SEARCH_DOMAIN_NAME(q->answer_search_domain));
 966                 if (r < 0)
 967                         return r;
 968                 if (r > 0)
 969                         return DNS_QUERY_MATCH; /* The answer matches directly, no need to follow cnames */
 970
 971                 r = dns_question_matches_cname_or_dname(question, rr, DNS_SEARCH_DOMAIN_NAME(q->answer_search_domain));
 972                 if (r < 0)
 973                         return r;
 974                 if (r > 0 && !cname)
 975                         cname = dns_resource_record_ref(rr);
 976         }
 977
 978         if (!cname)
 979                 return DNS_QUERY_NOMATCH; /* No match and no cname to follow */
 980
 981         if (q->flags & SD_RESOLVED_NO_CNAME)
 982                 return -ELOOP;
 983
 984         if (!q->answer_authenticated)
 985                 q->previous_redirect_unauthenticated = true;
 986
 987         /* OK, let's actually follow the CNAME */
 988         r = dns_query_cname_redirect(q, cname);
 989         if (r < 0)
 990                 return r;
 991
 992         /* Let's see if the answer can already answer the new
 993          * redirected question */
 994         r = dns_query_process_cname(q);
 995         if (r != DNS_QUERY_NOMATCH)
 996                 return r;
 997
 998         /* OK, it cannot, let's begin with the new query */
 999         r = dns_query_go(q);
1000         if (r < 0)
1001                 return r;
1002
1003         return DNS_QUERY_RESTARTED; /* We restarted the query for a new cname */
1004 }
1005
1006 static int on_bus_track(sd_bus_track *t, void *userdata) {
1007         DnsQuery *q = userdata;
1008
1009         assert(t);
1010         assert(q);
1011
1012         log_debug("Client of active query vanished, aborting query.");
1013         dns_query_complete(q, DNS_TRANSACTION_ABORTED);
1014         return 0;
1015 }
1016
1017 int dns_query_bus_track(DnsQuery *q, sd_bus_message *m) {
1018         int r;
1019
1020         assert(q);
1021         assert(m);
1022
1023         if (!q->bus_track) {
1024                 r = sd_bus_track_new(sd_bus_message_get_bus(m), &q->bus_track, on_bus_track, q);
1025                 if (r < 0)
1026                         return r;
1027         }
1028
1029         r = sd_bus_track_add_sender(q->bus_track, m);
1030         if (r < 0)
1031                 return r;
1032
1033         return 0;
1034 }
1035
1036 DnsQuestion* dns_query_question_for_protocol(DnsQuery *q, DnsProtocol protocol) {
1037         assert(q);
1038
1039         switch (protocol) {
1040
1041         case DNS_PROTOCOL_DNS:
1042                 return q->question_idna;
1043
1044         case DNS_PROTOCOL_MDNS:
1045         case DNS_PROTOCOL_LLMNR:
1046                 return q->question_utf8;
1047
1048         default:
1049                 return NULL;
1050         }
1051 }
1052
1053 const char *dns_query_string(DnsQuery *q) {
1054         const char *name;
1055         int r;
1056
1057         /* Returns a somewhat useful human-readable lookup key string for this query */
1058
1059         if (q->request_address_string)
1060                 return q->request_address_string;
1061
1062         if (q->request_address_valid) {
1063                 r = in_addr_to_string(q->request_family, &q->request_address, &q->request_address_string);
1064                 if (r >= 0)
1065                         return q->request_address_string;
1066         }
1067
1068         name = dns_question_first_name(q->question_utf8);
1069         if (name)
1070                 return name;
1071
1072         return dns_question_first_name(q->question_idna);
1073 }
1074
1075 bool dns_query_fully_authenticated(DnsQuery *q) {
1076         assert(q);
1077
1078         return q->answer_authenticated && !q->previous_redirect_unauthenticated;
1079 }