src/resolve/resolved-dns-server.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2
   3 #include "sd-messages.h"
   4
   5 #include "alloc-util.h"
   6 #include "resolved-bus.h"
   7 #include "resolved-dns-server.h"
   8 #include "resolved-dns-stub.h"
   9 #include "resolved-manager.h"
  10 #include "resolved-resolv-conf.h"
  11 #include "siphash24.h"
  12 #include "string-table.h"
  13 #include "string-util.h"
  14
  15 /* The amount of time to wait before retrying with a full feature set */
  16 #define DNS_SERVER_FEATURE_GRACE_PERIOD_MAX_USEC (6 * USEC_PER_HOUR)
  17 #define DNS_SERVER_FEATURE_GRACE_PERIOD_MIN_USEC (5 * USEC_PER_MINUTE)
  18
  19 /* The number of times we will attempt a certain feature set before degrading */
  20 #define DNS_SERVER_FEATURE_RETRY_ATTEMPTS 3
  21
  22 int dns_server_new(
  23                 Manager *m,
  24                 DnsServer **ret,
  25                 DnsServerType type,
  26                 Link *l,
  27                 int family,
  28                 const union in_addr_union *in_addr,
  29                 int ifindex,
  30                 const char *server_name) {
  31
  32         _cleanup_free_ char *name = NULL;
  33         DnsServer *s;
  34
  35         assert(m);
  36         assert((type == DNS_SERVER_LINK) == !!l);
  37         assert(in_addr);
  38
  39         if (!IN_SET(family, AF_INET, AF_INET6))
  40                 return -EAFNOSUPPORT;
  41
  42         if (l) {
  43                 if (l->n_dns_servers >= LINK_DNS_SERVERS_MAX)
  44                         return -E2BIG;
  45         } else {
  46                 if (m->n_dns_servers >= MANAGER_DNS_SERVERS_MAX)
  47                         return -E2BIG;
  48         }
  49
  50         if (server_name) {
  51                 name = strdup(server_name);
  52                 if (!name)
  53                         return -ENOMEM;
  54         }
  55
  56         s = new(DnsServer, 1);
  57         if (!s)
  58                 return -ENOMEM;
  59
  60         *s = (DnsServer) {
  61                 .n_ref = 1,
  62                 .manager = m,
  63                 .type = type,
  64                 .family = family,
  65                 .address = *in_addr,
  66                 .ifindex = ifindex,
  67                 .server_name = TAKE_PTR(name),
  68         };
  69
  70         dns_server_reset_features(s);
  71
  72         switch (type) {
  73
  74         case DNS_SERVER_LINK:
  75                 s->link = l;
  76                 LIST_APPEND(servers, l->dns_servers, s);
  77                 l->n_dns_servers++;
  78                 break;
  79
  80         case DNS_SERVER_SYSTEM:
  81                 LIST_APPEND(servers, m->dns_servers, s);
  82                 m->n_dns_servers++;
  83                 break;
  84
  85         case DNS_SERVER_FALLBACK:
  86                 LIST_APPEND(servers, m->fallback_dns_servers, s);
  87                 m->n_dns_servers++;
  88                 break;
  89
  90         default:
  91                 assert_not_reached("Unknown server type");
  92         }
  93
  94         s->linked = true;
  95
  96         /* A new DNS server that isn't fallback is added and the one
  97          * we used so far was a fallback one? Then let's try to pick
  98          * the new one */
  99         if (type != DNS_SERVER_FALLBACK &&
 100             m->current_dns_server &&
 101             m->current_dns_server->type == DNS_SERVER_FALLBACK)
 102                 manager_set_dns_server(m, NULL);
 103
 104         if (ret)
 105                 *ret = s;
 106
 107         return 0;
 108 }
 109
 110 static DnsServer* dns_server_free(DnsServer *s)  {
 111         assert(s);
 112
 113         dns_server_unref_stream(s);
 114
 115 #if ENABLE_DNS_OVER_TLS
 116         dnstls_server_free(s);
 117 #endif
 118
 119         free(s->server_string);
 120         free(s->server_name);
 121         return mfree(s);
 122 }
 123
 124 DEFINE_TRIVIAL_REF_UNREF_FUNC(DnsServer, dns_server, dns_server_free);
 125
 126 void dns_server_unlink(DnsServer *s) {
 127         assert(s);
 128         assert(s->manager);
 129
 130         /* This removes the specified server from the linked list of
 131          * servers, but any server might still stay around if it has
 132          * refs, for example from an ongoing transaction. */
 133
 134         if (!s->linked)
 135                 return;
 136
 137         switch (s->type) {
 138
 139         case DNS_SERVER_LINK:
 140                 assert(s->link);
 141                 assert(s->link->n_dns_servers > 0);
 142                 LIST_REMOVE(servers, s->link->dns_servers, s);
 143                 s->link->n_dns_servers--;
 144                 break;
 145
 146         case DNS_SERVER_SYSTEM:
 147                 assert(s->manager->n_dns_servers > 0);
 148                 LIST_REMOVE(servers, s->manager->dns_servers, s);
 149                 s->manager->n_dns_servers--;
 150                 break;
 151
 152         case DNS_SERVER_FALLBACK:
 153                 assert(s->manager->n_dns_servers > 0);
 154                 LIST_REMOVE(servers, s->manager->fallback_dns_servers, s);
 155                 s->manager->n_dns_servers--;
 156                 break;
 157         default:
 158                 assert_not_reached("Unknown server type");
 159         }
 160
 161         s->linked = false;
 162
 163         if (s->link && s->link->current_dns_server == s)
 164                 link_set_dns_server(s->link, NULL);
 165
 166         if (s->manager->current_dns_server == s)
 167                 manager_set_dns_server(s->manager, NULL);
 168
 169         /* No need to keep a default stream around anymore */
 170         dns_server_unref_stream(s);
 171
 172         dns_server_unref(s);
 173 }
 174
 175 void dns_server_move_back_and_unmark(DnsServer *s) {
 176         DnsServer *tail;
 177
 178         assert(s);
 179
 180         if (!s->marked)
 181                 return;
 182
 183         s->marked = false;
 184
 185         if (!s->linked || !s->servers_next)
 186                 return;
 187
 188         /* Move us to the end of the list, so that the order is
 189          * strictly kept, if we are not at the end anyway. */
 190
 191         switch (s->type) {
 192
 193         case DNS_SERVER_LINK:
 194                 assert(s->link);
 195                 LIST_FIND_TAIL(servers, s, tail);
 196                 LIST_REMOVE(servers, s->link->dns_servers, s);
 197                 LIST_INSERT_AFTER(servers, s->link->dns_servers, tail, s);
 198                 break;
 199
 200         case DNS_SERVER_SYSTEM:
 201                 LIST_FIND_TAIL(servers, s, tail);
 202                 LIST_REMOVE(servers, s->manager->dns_servers, s);
 203                 LIST_INSERT_AFTER(servers, s->manager->dns_servers, tail, s);
 204                 break;
 205
 206         case DNS_SERVER_FALLBACK:
 207                 LIST_FIND_TAIL(servers, s, tail);
 208                 LIST_REMOVE(servers, s->manager->fallback_dns_servers, s);
 209                 LIST_INSERT_AFTER(servers, s->manager->fallback_dns_servers, tail, s);
 210                 break;
 211
 212         default:
 213                 assert_not_reached("Unknown server type");
 214         }
 215 }
 216
 217 static void dns_server_verified(DnsServer *s, DnsServerFeatureLevel level) {
 218         assert(s);
 219
 220         if (s->verified_feature_level > level)
 221                 return;
 222
 223         if (s->verified_feature_level != level) {
 224                 log_debug("Verified we get a response at feature level %s from DNS server %s.",
 225                           dns_server_feature_level_to_string(level),
 226                           dns_server_string(s));
 227                 s->verified_feature_level = level;
 228         }
 229
 230         assert_se(sd_event_now(s->manager->event, clock_boottime_or_monotonic(), &s->verified_usec) >= 0);
 231 }
 232
 233 static void dns_server_reset_counters(DnsServer *s) {
 234         assert(s);
 235
 236         s->n_failed_udp = 0;
 237         s->n_failed_tcp = 0;
 238         s->n_failed_tls = 0;
 239         s->packet_truncated = false;
 240         s->verified_usec = 0;
 241
 242         /* Note that we do not reset s->packet_bad_opt and s->packet_rrsig_missing here. We reset them only when the
 243          * grace period ends, but not when lowering the possible feature level, as a lower level feature level should
 244          * not make RRSIGs appear or OPT appear, but rather make them disappear. If the reappear anyway, then that's
 245          * indication for a differently broken OPT/RRSIG implementation, and we really don't want to support that
 246          * either.
 247          *
 248          * This is particularly important to deal with certain Belkin routers which break OPT for certain lookups (A),
 249          * but pass traffic through for others (AAAA). If we detect the broken behaviour on one lookup we should not
 250          * re-enable it for another, because we cannot validate things anyway, given that the RRSIG/OPT data will be
 251          * incomplete. */
 252 }
 253
 254 void dns_server_packet_received(DnsServer *s, int protocol, DnsServerFeatureLevel level, size_t size) {
 255         assert(s);
 256
 257         if (protocol == IPPROTO_UDP) {
 258                 if (s->possible_feature_level == level)
 259                         s->n_failed_udp = 0;
 260         } else if (protocol == IPPROTO_TCP) {
 261                 if (DNS_SERVER_FEATURE_LEVEL_IS_TLS(level)) {
 262                         if (s->possible_feature_level == level)
 263                                 s->n_failed_tls = 0;
 264                 } else {
 265                         if (s->possible_feature_level == level)
 266                                 s->n_failed_tcp = 0;
 267
 268                         /* Successful TCP connections are only useful to verify the TCP feature level. */
 269                         level = DNS_SERVER_FEATURE_LEVEL_TCP;
 270                 }
 271         }
 272
 273         /* If the RRSIG data is missing, then we can only validate EDNS0 at max */
 274         if (s->packet_rrsig_missing && level >= DNS_SERVER_FEATURE_LEVEL_DO)
 275                 level = DNS_SERVER_FEATURE_LEVEL_IS_TLS(level) ? DNS_SERVER_FEATURE_LEVEL_TLS_PLAIN : DNS_SERVER_FEATURE_LEVEL_EDNS0;
 276
 277         /* If the OPT RR got lost, then we can only validate UDP at max */
 278         if (s->packet_bad_opt && level >= DNS_SERVER_FEATURE_LEVEL_EDNS0)
 279                 level = DNS_SERVER_FEATURE_LEVEL_EDNS0 - 1;
 280
 281         /* Even if we successfully receive a reply to a request announcing support for large packets,
 282                 that does not mean we can necessarily receive large packets. */
 283         if (level == DNS_SERVER_FEATURE_LEVEL_LARGE)
 284                 level = DNS_SERVER_FEATURE_LEVEL_LARGE - 1;
 285
 286         dns_server_verified(s, level);
 287
 288         /* Remember the size of the largest UDP packet we received from a server,
 289            we know that we can always announce support for packets with at least
 290            this size. */
 291         if (protocol == IPPROTO_UDP && s->received_udp_packet_max < size)
 292                 s->received_udp_packet_max = size;
 293 }
 294
 295 void dns_server_packet_lost(DnsServer *s, int protocol, DnsServerFeatureLevel level) {
 296         assert(s);
 297         assert(s->manager);
 298
 299         if (s->possible_feature_level == level) {
 300                 if (protocol == IPPROTO_UDP)
 301                         s->n_failed_udp++;
 302                 else if (protocol == IPPROTO_TCP) {
 303                         if (DNS_SERVER_FEATURE_LEVEL_IS_TLS(level))
 304                                 s->n_failed_tls++;
 305                         else
 306                                 s->n_failed_tcp++;
 307                 }
 308         }
 309 }
 310
 311 void dns_server_packet_truncated(DnsServer *s, DnsServerFeatureLevel level) {
 312         assert(s);
 313
 314         /* Invoked whenever we get a packet with TC bit set. */
 315
 316         if (s->possible_feature_level != level)
 317                 return;
 318
 319         s->packet_truncated = true;
 320 }
 321
 322 void dns_server_packet_rrsig_missing(DnsServer *s, DnsServerFeatureLevel level) {
 323         assert(s);
 324
 325         if (level < DNS_SERVER_FEATURE_LEVEL_DO)
 326                 return;
 327
 328         /* If the RRSIG RRs are missing, we have to downgrade what we previously verified */
 329         if (s->verified_feature_level >= DNS_SERVER_FEATURE_LEVEL_DO)
 330                 s->verified_feature_level = DNS_SERVER_FEATURE_LEVEL_IS_TLS(level) ? DNS_SERVER_FEATURE_LEVEL_TLS_PLAIN : DNS_SERVER_FEATURE_LEVEL_EDNS0;
 331
 332         s->packet_rrsig_missing = true;
 333 }
 334
 335 void dns_server_packet_bad_opt(DnsServer *s, DnsServerFeatureLevel level) {
 336         assert(s);
 337
 338         if (level < DNS_SERVER_FEATURE_LEVEL_EDNS0)
 339                 return;
 340
 341         /* If the OPT RR got lost, we have to downgrade what we previously verified */
 342         if (s->verified_feature_level >= DNS_SERVER_FEATURE_LEVEL_EDNS0)
 343                 s->verified_feature_level = DNS_SERVER_FEATURE_LEVEL_EDNS0-1;
 344
 345         s->packet_bad_opt = true;
 346 }
 347
 348 void dns_server_packet_rcode_downgrade(DnsServer *s, DnsServerFeatureLevel level) {
 349         assert(s);
 350
 351         /* Invoked whenever we got a FORMERR, SERVFAIL or NOTIMP rcode from a server and downgrading the feature level
 352          * for the transaction made it go away. In this case we immediately downgrade to the feature level that made
 353          * things work. */
 354
 355         if (s->verified_feature_level > level)
 356                 s->verified_feature_level = level;
 357
 358         if (s->possible_feature_level > level) {
 359                 s->possible_feature_level = level;
 360                 dns_server_reset_counters(s);
 361         }
 362
 363         log_debug("Downgrading transaction feature level fixed an RCODE error, downgrading server %s too.", dns_server_string(s));
 364 }
 365
 366 static bool dns_server_grace_period_expired(DnsServer *s) {
 367         usec_t ts;
 368
 369         assert(s);
 370         assert(s->manager);
 371
 372         if (s->verified_usec == 0)
 373                 return false;
 374
 375         assert_se(sd_event_now(s->manager->event, clock_boottime_or_monotonic(), &ts) >= 0);
 376
 377         if (s->verified_usec + s->features_grace_period_usec > ts)
 378                 return false;
 379
 380         s->features_grace_period_usec = MIN(s->features_grace_period_usec * 2, DNS_SERVER_FEATURE_GRACE_PERIOD_MAX_USEC);
 381
 382         return true;
 383 }
 384
 385 DnsServerFeatureLevel dns_server_possible_feature_level(DnsServer *s) {
 386         DnsServerFeatureLevel best;
 387
 388         assert(s);
 389
 390         /* Determine the best feature level we care about. If DNSSEC mode is off there's no point in using anything
 391          * better than EDNS0, hence don't even try. */
 392         if (dns_server_get_dnssec_mode(s) != DNSSEC_NO)
 393                 best = dns_server_get_dns_over_tls_mode(s) == DNS_OVER_TLS_NO ?
 394                         DNS_SERVER_FEATURE_LEVEL_LARGE :
 395                         DNS_SERVER_FEATURE_LEVEL_TLS_DO;
 396         else
 397                 best = dns_server_get_dns_over_tls_mode(s) == DNS_OVER_TLS_NO ?
 398                         DNS_SERVER_FEATURE_LEVEL_EDNS0 :
 399                         DNS_SERVER_FEATURE_LEVEL_TLS_PLAIN;
 400
 401         /* Clamp the feature level the highest level we care about. The DNSSEC mode might have changed since the last
 402          * time, hence let's downgrade if we are still at a higher level. */
 403         if (s->possible_feature_level > best)
 404                 s->possible_feature_level = best;
 405
 406         if (s->possible_feature_level < best && dns_server_grace_period_expired(s)) {
 407
 408                 s->possible_feature_level = best;
 409
 410                 dns_server_reset_counters(s);
 411
 412                 s->packet_bad_opt = false;
 413                 s->packet_rrsig_missing = false;
 414
 415                 log_info("Grace period over, resuming full feature set (%s) for DNS server %s.",
 416                          dns_server_feature_level_to_string(s->possible_feature_level),
 417                          dns_server_string(s));
 418
 419                 dns_server_flush_cache(s);
 420
 421         } else if (s->possible_feature_level <= s->verified_feature_level)
 422                 s->possible_feature_level = s->verified_feature_level;
 423         else {
 424                 DnsServerFeatureLevel p = s->possible_feature_level;
 425                 int log_level = LOG_WARNING;
 426
 427                 if (s->n_failed_tcp >= DNS_SERVER_FEATURE_RETRY_ATTEMPTS &&
 428                     s->possible_feature_level == DNS_SERVER_FEATURE_LEVEL_TCP) {
 429
 430                         /* We are at the TCP (lowest) level, and we tried a couple of TCP connections, and it didn't
 431                          * work. Upgrade back to UDP again. */
 432                         log_debug("Reached maximum number of failed TCP connection attempts, trying UDP again...");
 433                         s->possible_feature_level = DNS_SERVER_FEATURE_LEVEL_UDP;
 434                 } else if (s->n_failed_tls > 0 &&
 435                            DNS_SERVER_FEATURE_LEVEL_IS_TLS(s->possible_feature_level) && dns_server_get_dns_over_tls_mode(s) != DNS_OVER_TLS_YES) {
 436
 437                         /* We tried to connect using DNS-over-TLS, and it didn't work. Downgrade to plaintext UDP
 438                          * if we don't require DNS-over-TLS */
 439
 440                         log_debug("Server doesn't support DNS-over-TLS, downgrading protocol...");
 441                         s->possible_feature_level--;
 442                 } else if (s->packet_bad_opt &&
 443                            s->possible_feature_level >= DNS_SERVER_FEATURE_LEVEL_EDNS0) {
 444
 445                         /* A reply to one of our EDNS0 queries didn't carry a valid OPT RR, then downgrade to below
 446                          * EDNS0 levels. After all, some records generate different responses with and without OPT RR
 447                          * in the request. Example:
 448                          * https://open.nlnetlabs.nl/pipermail/dnssec-trigger/2014-November/000376.html */
 449
 450                         log_debug("Server doesn't support EDNS(0) properly, downgrading feature level...");
 451                         s->possible_feature_level = DNS_SERVER_FEATURE_LEVEL_UDP;
 452
 453                         /* Users often don't control the DNS server they use so let's not complain too loudly
 454                          * when we can't use EDNS because the DNS server doesn't support it. */
 455                         log_level = LOG_NOTICE;
 456
 457                 } else if (s->packet_rrsig_missing &&
 458                            s->possible_feature_level >= DNS_SERVER_FEATURE_LEVEL_DO) {
 459
 460                         /* RRSIG data was missing on a EDNS0 packet with DO bit set. This means the server doesn't
 461                          * augment responses with DNSSEC RRs. If so, let's better not ask the server for it anymore,
 462                          * after all some servers generate different replies depending if an OPT RR is in the query or
 463                          * not. */
 464
 465                         log_debug("Detected server responses lack RRSIG records, downgrading feature level...");
 466                         s->possible_feature_level = DNS_SERVER_FEATURE_LEVEL_IS_TLS(s->possible_feature_level) ? DNS_SERVER_FEATURE_LEVEL_TLS_PLAIN : DNS_SERVER_FEATURE_LEVEL_EDNS0;
 467
 468                 } else if (s->n_failed_udp >= DNS_SERVER_FEATURE_RETRY_ATTEMPTS &&
 469                            s->possible_feature_level >= (dns_server_get_dnssec_mode(s) == DNSSEC_YES ? DNS_SERVER_FEATURE_LEVEL_LARGE : DNS_SERVER_FEATURE_LEVEL_UDP)) {
 470
 471                         /* We lost too many UDP packets in a row, and are on a feature level of UDP or higher. If the
 472                          * packets are lost, maybe the server cannot parse them, hence downgrading sounds like a good
 473                          * idea. We might downgrade all the way down to TCP this way.
 474                          *
 475                          * If strict DNSSEC mode is used we won't downgrade below DO level however, as packet loss
 476                          * might have many reasons, a broken DNSSEC implementation being only one reason. And if the
 477                          * user is strict on DNSSEC, then let's assume that DNSSEC is not the fault here. */
 478
 479                         log_debug("Lost too many UDP packets, downgrading feature level...");
 480                         s->possible_feature_level--;
 481
 482                 } else if (s->n_failed_tcp >= DNS_SERVER_FEATURE_RETRY_ATTEMPTS &&
 483                            s->packet_truncated &&
 484                            s->possible_feature_level > (dns_server_get_dnssec_mode(s) == DNSSEC_YES ? DNS_SERVER_FEATURE_LEVEL_LARGE : DNS_SERVER_FEATURE_LEVEL_UDP)) {
 485
 486                          /* We got too many TCP connection failures in a row, we had at least one truncated packet, and
 487                           * are on a feature level above UDP. By downgrading things and getting rid of DNSSEC or EDNS0
 488                           * data we hope to make the packet smaller, so that it still works via UDP given that TCP
 489                           * appears not to be a fallback. Note that if we are already at the lowest UDP level, we don't
 490                           * go further down, since that's TCP, and TCP failed too often after all. */
 491
 492                         log_debug("Got too many failed TCP connection failures and truncated UDP packets, downgrading feature level...");
 493                         s->possible_feature_level--;
 494                 }
 495
 496                 if (p != s->possible_feature_level) {
 497
 498                         /* We changed the feature level, reset the counting */
 499                         dns_server_reset_counters(s);
 500
 501                         log_full(log_level, "Using degraded feature set %s instead of %s for DNS server %s.",
 502                                  dns_server_feature_level_to_string(s->possible_feature_level),
 503                                  dns_server_feature_level_to_string(p), dns_server_string(s));
 504                 }
 505         }
 506
 507         return s->possible_feature_level;
 508 }
 509
 510 int dns_server_adjust_opt(DnsServer *server, DnsPacket *packet, DnsServerFeatureLevel level) {
 511         size_t packet_size;
 512         bool edns_do;
 513         int r;
 514
 515         assert(server);
 516         assert(packet);
 517         assert(packet->protocol == DNS_PROTOCOL_DNS);
 518
 519         /* Fix the OPT field in the packet to match our current feature level. */
 520
 521         r = dns_packet_truncate_opt(packet);
 522         if (r < 0)
 523                 return r;
 524
 525         if (level < DNS_SERVER_FEATURE_LEVEL_EDNS0)
 526                 return 0;
 527
 528         edns_do = level >= DNS_SERVER_FEATURE_LEVEL_DO;
 529
 530         if (level >= DNS_SERVER_FEATURE_LEVEL_LARGE)
 531                 packet_size = DNS_PACKET_UNICAST_SIZE_LARGE_MAX;
 532         else
 533                 packet_size = server->received_udp_packet_max;
 534
 535         return dns_packet_append_opt(packet, packet_size, edns_do, 0, NULL);
 536 }
 537
 538 int dns_server_ifindex(const DnsServer *s) {
 539         assert(s);
 540
 541         /* The link ifindex always takes precedence */
 542         if (s->link)
 543                 return s->link->ifindex;
 544
 545         if (s->ifindex > 0)
 546                 return s->ifindex;
 547
 548         return 0;
 549 }
 550
 551 const char *dns_server_string(DnsServer *server) {
 552         assert(server);
 553
 554         if (!server->server_string)
 555                 (void) in_addr_ifindex_to_string(server->family, &server->address, dns_server_ifindex(server), &server->server_string);
 556
 557         return strna(server->server_string);
 558 }
 559
 560 bool dns_server_dnssec_supported(DnsServer *server) {
 561         assert(server);
 562
 563         /* Returns whether the server supports DNSSEC according to what we know about it */
 564
 565         if (server->possible_feature_level < DNS_SERVER_FEATURE_LEVEL_DO)
 566                 return false;
 567
 568         if (server->packet_bad_opt)
 569                 return false;
 570
 571         if (server->packet_rrsig_missing)
 572                 return false;
 573
 574         /* DNSSEC servers need to support TCP properly (see RFC5966), if they don't, we assume DNSSEC is borked too */
 575         if (server->n_failed_tcp >= DNS_SERVER_FEATURE_RETRY_ATTEMPTS)
 576                 return false;
 577
 578         return true;
 579 }
 580
 581 void dns_server_warn_downgrade(DnsServer *server) {
 582         assert(server);
 583
 584         if (server->warned_downgrade)
 585                 return;
 586
 587         log_struct(LOG_NOTICE,
 588                    "MESSAGE_ID=" SD_MESSAGE_DNSSEC_DOWNGRADE_STR,
 589                    LOG_MESSAGE("Server %s does not support DNSSEC, downgrading to non-DNSSEC mode.", dns_server_string(server)),
 590                    "DNS_SERVER=%s", dns_server_string(server),
 591                    "DNS_SERVER_FEATURE_LEVEL=%s", dns_server_feature_level_to_string(server->possible_feature_level));
 592
 593         server->warned_downgrade = true;
 594 }
 595
 596 static void dns_server_hash_func(const DnsServer *s, struct siphash *state) {
 597         assert(s);
 598
 599         siphash24_compress(&s->family, sizeof(s->family), state);
 600         siphash24_compress(&s->address, FAMILY_ADDRESS_SIZE(s->family), state);
 601         siphash24_compress(&s->ifindex, sizeof(s->ifindex), state);
 602 }
 603
 604 static int dns_server_compare_func(const DnsServer *x, const DnsServer *y) {
 605         int r;
 606
 607         r = CMP(x->family, y->family);
 608         if (r != 0)
 609                 return r;
 610
 611         r = memcmp(&x->address, &y->address, FAMILY_ADDRESS_SIZE(x->family));
 612         if (r != 0)
 613                 return r;
 614
 615         r = CMP(x->ifindex, y->ifindex);
 616         if (r != 0)
 617                 return r;
 618
 619         return 0;
 620 }
 621
 622 DEFINE_HASH_OPS(dns_server_hash_ops, DnsServer, dns_server_hash_func, dns_server_compare_func);
 623
 624 void dns_server_unlink_all(DnsServer *first) {
 625         DnsServer *next;
 626
 627         if (!first)
 628                 return;
 629
 630         next = first->servers_next;
 631         dns_server_unlink(first);
 632
 633         dns_server_unlink_all(next);
 634 }
 635
 636 void dns_server_unlink_marked(DnsServer *first) {
 637         DnsServer *next;
 638
 639         if (!first)
 640                 return;
 641
 642         next = first->servers_next;
 643
 644         if (first->marked)
 645                 dns_server_unlink(first);
 646
 647         dns_server_unlink_marked(next);
 648 }
 649
 650 void dns_server_mark_all(DnsServer *first) {
 651         if (!first)
 652                 return;
 653
 654         first->marked = true;
 655         dns_server_mark_all(first->servers_next);
 656 }
 657
 658 DnsServer *dns_server_find(DnsServer *first, int family, const union in_addr_union *in_addr, int ifindex) {
 659         DnsServer *s;
 660
 661         LIST_FOREACH(servers, s, first)
 662                 if (s->family == family && in_addr_equal(family, &s->address, in_addr) > 0 && s->ifindex == ifindex)
 663                         return s;
 664
 665         return NULL;
 666 }
 667
 668 DnsServer *manager_get_first_dns_server(Manager *m, DnsServerType t) {
 669         assert(m);
 670
 671         switch (t) {
 672
 673         case DNS_SERVER_SYSTEM:
 674                 return m->dns_servers;
 675
 676         case DNS_SERVER_FALLBACK:
 677                 return m->fallback_dns_servers;
 678
 679         default:
 680                 return NULL;
 681         }
 682 }
 683
 684 DnsServer *manager_set_dns_server(Manager *m, DnsServer *s) {
 685         assert(m);
 686
 687         if (m->current_dns_server == s)
 688                 return s;
 689
 690         if (s)
 691                 log_debug("Switching to %s DNS server %s.",
 692                           dns_server_type_to_string(s->type),
 693                           dns_server_string(s));
 694
 695         dns_server_unref(m->current_dns_server);
 696         m->current_dns_server = dns_server_ref(s);
 697
 698         if (m->unicast_scope)
 699                 dns_cache_flush(&m->unicast_scope->cache);
 700
 701         (void) manager_send_changed(m, "CurrentDNSServer");
 702
 703         return s;
 704 }
 705
 706 DnsServer *manager_get_dns_server(Manager *m) {
 707         Link *l;
 708         assert(m);
 709
 710         /* Try to read updates resolv.conf */
 711         manager_read_resolv_conf(m);
 712
 713         /* If no DNS server was chosen so far, pick the first one */
 714         if (!m->current_dns_server)
 715                 manager_set_dns_server(m, m->dns_servers);
 716
 717         if (!m->current_dns_server) {
 718                 bool found = false;
 719                 Iterator i;
 720
 721                 /* No DNS servers configured, let's see if there are
 722                  * any on any links. If not, we use the fallback
 723                  * servers */
 724
 725                 HASHMAP_FOREACH(l, m->links, i)
 726                         if (l->dns_servers) {
 727                                 found = true;
 728                                 break;
 729                         }
 730
 731                 if (!found)
 732                         manager_set_dns_server(m, m->fallback_dns_servers);
 733         }
 734
 735         return m->current_dns_server;
 736 }
 737
 738 void manager_next_dns_server(Manager *m) {
 739         assert(m);
 740
 741         /* If there's currently no DNS server set, then the next
 742          * manager_get_dns_server() will find one */
 743         if (!m->current_dns_server)
 744                 return;
 745
 746         /* Change to the next one, but make sure to follow the linked
 747          * list only if the server is still linked. */
 748         if (m->current_dns_server->linked && m->current_dns_server->servers_next) {
 749                 manager_set_dns_server(m, m->current_dns_server->servers_next);
 750                 return;
 751         }
 752
 753         /* If there was no next one, then start from the beginning of
 754          * the list */
 755         if (m->current_dns_server->type == DNS_SERVER_FALLBACK)
 756                 manager_set_dns_server(m, m->fallback_dns_servers);
 757         else
 758                 manager_set_dns_server(m, m->dns_servers);
 759 }
 760
 761 DnssecMode dns_server_get_dnssec_mode(DnsServer *s) {
 762         assert(s);
 763
 764         if (s->link)
 765                 return link_get_dnssec_mode(s->link);
 766
 767         return manager_get_dnssec_mode(s->manager);
 768 }
 769
 770 DnsOverTlsMode dns_server_get_dns_over_tls_mode(DnsServer *s) {
 771         assert(s);
 772
 773         if (s->link)
 774                 return link_get_dns_over_tls_mode(s->link);
 775
 776         return manager_get_dns_over_tls_mode(s->manager);
 777 }
 778
 779 void dns_server_flush_cache(DnsServer *s) {
 780         DnsServer *current;
 781         DnsScope *scope;
 782
 783         assert(s);
 784
 785         /* Flush the cache of the scope this server belongs to */
 786
 787         current = s->link ? s->link->current_dns_server : s->manager->current_dns_server;
 788         if (current != s)
 789                 return;
 790
 791         scope = s->link ? s->link->unicast_scope : s->manager->unicast_scope;
 792         if (!scope)
 793                 return;
 794
 795         dns_cache_flush(&scope->cache);
 796 }
 797
 798 void dns_server_reset_features(DnsServer *s) {
 799         assert(s);
 800
 801         s->verified_feature_level = _DNS_SERVER_FEATURE_LEVEL_INVALID;
 802         s->possible_feature_level = DNS_SERVER_FEATURE_LEVEL_BEST;
 803
 804         s->received_udp_packet_max = DNS_PACKET_UNICAST_SIZE_MAX;
 805
 806         s->packet_bad_opt = false;
 807         s->packet_rrsig_missing = false;
 808
 809         s->features_grace_period_usec = DNS_SERVER_FEATURE_GRACE_PERIOD_MIN_USEC;
 810
 811         s->warned_downgrade = false;
 812
 813         dns_server_reset_counters(s);
 814
 815         /* Let's close the default stream, so that we reprobe with the new features */
 816         dns_server_unref_stream(s);
 817 }
 818
 819 void dns_server_reset_features_all(DnsServer *s) {
 820         DnsServer *i;
 821
 822         LIST_FOREACH(servers, i, s)
 823                 dns_server_reset_features(i);
 824 }
 825
 826 void dns_server_dump(DnsServer *s, FILE *f) {
 827         assert(s);
 828
 829         if (!f)
 830                 f = stdout;
 831
 832         fputs("[Server ", f);
 833         fputs(dns_server_string(s), f);
 834         fputs(" type=", f);
 835         fputs(dns_server_type_to_string(s->type), f);
 836
 837         if (s->type == DNS_SERVER_LINK) {
 838                 assert(s->link);
 839
 840                 fputs(" interface=", f);
 841                 fputs(s->link->ifname, f);
 842         }
 843
 844         fputs("]\n", f);
 845
 846         fputs("\tVerified feature level: ", f);
 847         fputs(strna(dns_server_feature_level_to_string(s->verified_feature_level)), f);
 848         fputc('\n', f);
 849
 850         fputs("\tPossible feature level: ", f);
 851         fputs(strna(dns_server_feature_level_to_string(s->possible_feature_level)), f);
 852         fputc('\n', f);
 853
 854         fputs("\tDNSSEC Mode: ", f);
 855         fputs(strna(dnssec_mode_to_string(dns_server_get_dnssec_mode(s))), f);
 856         fputc('\n', f);
 857
 858         fputs("\tCan do DNSSEC: ", f);
 859         fputs(yes_no(dns_server_dnssec_supported(s)), f);
 860         fputc('\n', f);
 861
 862         fprintf(f,
 863                 "\tMaximum UDP packet size received: %zu\n"
 864                 "\tFailed UDP attempts: %u\n"
 865                 "\tFailed TCP attempts: %u\n"
 866                 "\tSeen truncated packet: %s\n"
 867                 "\tSeen OPT RR getting lost: %s\n"
 868                 "\tSeen RRSIG RR missing: %s\n",
 869                 s->received_udp_packet_max,
 870                 s->n_failed_udp,
 871                 s->n_failed_tcp,
 872                 yes_no(s->packet_truncated),
 873                 yes_no(s->packet_bad_opt),
 874                 yes_no(s->packet_rrsig_missing));
 875 }
 876
 877 void dns_server_unref_stream(DnsServer *s) {
 878         DnsStream *ref;
 879
 880         assert(s);
 881
 882         /* Detaches the default stream of this server. Some special care needs to be taken here, as that stream and
 883          * this server reference each other. First, take the stream out of the server. It's destructor will check if it
 884          * is registered with us, hence let's invalidate this separately, so that it is already unregistered. */
 885         ref = TAKE_PTR(s->stream);
 886
 887         /* And then, unref it */
 888         dns_stream_unref(ref);
 889 }
 890
 891 DnsScope *dns_server_scope(DnsServer *s) {
 892         assert(s);
 893         assert((s->type == DNS_SERVER_LINK) == !!s->link);
 894
 895         if (s->link)
 896                 return s->link->unicast_scope;
 897
 898         return s->manager->unicast_scope;
 899 }
 900
 901 static const char* const dns_server_type_table[_DNS_SERVER_TYPE_MAX] = {
 902         [DNS_SERVER_SYSTEM] = "system",
 903         [DNS_SERVER_FALLBACK] = "fallback",
 904         [DNS_SERVER_LINK] = "link",
 905 };
 906 DEFINE_STRING_TABLE_LOOKUP(dns_server_type, DnsServerType);
 907
 908 static const char* const dns_server_feature_level_table[_DNS_SERVER_FEATURE_LEVEL_MAX] = {
 909         [DNS_SERVER_FEATURE_LEVEL_TCP] = "TCP",
 910         [DNS_SERVER_FEATURE_LEVEL_UDP] = "UDP",
 911         [DNS_SERVER_FEATURE_LEVEL_EDNS0] = "UDP+EDNS0",
 912         [DNS_SERVER_FEATURE_LEVEL_TLS_PLAIN] = "TLS+EDNS0",
 913         [DNS_SERVER_FEATURE_LEVEL_DO] = "UDP+EDNS0+DO",
 914         [DNS_SERVER_FEATURE_LEVEL_LARGE] = "UDP+EDNS0+DO+LARGE",
 915         [DNS_SERVER_FEATURE_LEVEL_TLS_DO] = "TLS+EDNS0+D0",
 916 };
 917 DEFINE_STRING_TABLE_LOOKUP(dns_server_feature_level, DnsServerFeatureLevel);