]> git.ipfire.org Git - thirdparty/systemd.git/blame - src/resolve/resolved-dns-packet.c
projects / thirdparty / systemd.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Merge pull request #7388 from keszybz/doc-tweak
[thirdparty/systemd.git] / src / resolve / resolved-dns-packet.c
CommitLineData
74b2466e
LP		 1/***
2 This file is part of systemd.
3
4 Copyright 2014 Lennart Poettering
5
6 systemd is free software; you can redistribute it and/or modify it
7 under the terms of the GNU Lesser General Public License as published by
8 the Free Software Foundation; either version 2.1 of the License, or
9 (at your option) any later version.
10
11 systemd is distributed in the hope that it will be useful, but
12 WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 Lesser General Public License for more details.
15
16 You should have received a copy of the GNU Lesser General Public License
17 along with systemd; If not, see <http://www.gnu.org/licenses/>.
18 ***/
19
b5efdb8a 20#include "alloc-util.h"
4ad7f276 21#include "dns-domain.h"
74b2466e 22#include "resolved-dns-packet.h"
8b43440b
LP		 23#include "string-table.h"
24#include "strv.h"
25#include "unaligned.h"
26#include "utf8.h"
27#include "util.h"
74b2466e 28
7586f4d1
TG		 29#define EDNS0_OPT_DO (1<<15)
30
46a58596 31assert_cc(DNS_PACKET_SIZE_START > DNS_PACKET_HEADER_SIZE)
88795538 32
e18a3c73
ZJS		 33typedef struct DnsPacketRewinder {
34 DnsPacket *packet;
35 size_t saved_rindex;
36} DnsPacketRewinder;
37
38static void rewind_dns_packet(DnsPacketRewinder *rewinder) {
39 if (rewinder->packet)
40 dns_packet_rewind(rewinder->packet, rewinder->saved_rindex);
41}
42
9ed794a3
VC		 43#define INIT_REWINDER(rewinder, p) do { rewinder.packet = p; rewinder.saved_rindex = p->rindex; } while (0)
44#define CANCEL_REWINDER(rewinder) do { rewinder.packet = NULL; } while (0)
e18a3c73 45
51027656
LP		 46int dns_packet_new(
47 DnsPacket **ret,
48 DnsProtocol protocol,
49 size_t min_alloc_dsize,
50 size_t max_size) {
51
74b2466e
LP		 52 DnsPacket *p;
53 size_t a;
54
55 assert(ret);
51027656
LP		 56 assert(max_size >= DNS_PACKET_HEADER_SIZE);
57
58 if (max_size > DNS_PACKET_SIZE_MAX)
59 max_size = DNS_PACKET_SIZE_MAX;
74b2466e 60
46a58596
BR		 61 /* The caller may not check what is going to be truly allocated, so do not allow to
62 * allocate a DNS packet bigger than DNS_PACKET_SIZE_MAX.
63 */
64 if (min_alloc_dsize > DNS_PACKET_SIZE_MAX) {
65 log_error("Requested packet data size too big: %zu", min_alloc_dsize);
66 return -EFBIG;
67 }
68
69 /* When dns_packet_new() is called with min_alloc_dsize == 0, allocate more than the
88795538
ZJS		 70 * absolute minimum (which is the dns packet header size), to avoid
71 * resizing immediately again after appending the first data to the packet.
72 */
46a58596 73 if (min_alloc_dsize < DNS_PACKET_HEADER_SIZE)
88795538
ZJS		 74 a = DNS_PACKET_SIZE_START;
75 else
46a58596 76 a = min_alloc_dsize;
74b2466e 77
c73ce96b
LP		 78 /* round up to next page size */
79 a = PAGE_ALIGN(ALIGN(sizeof(DnsPacket)) + a) - ALIGN(sizeof(DnsPacket));
80
81 /* make sure we never allocate more than useful */
51027656
LP		 82 if (a > max_size)
83 a = max_size;
c73ce96b 84
74b2466e
LP		 85 p = malloc0(ALIGN(sizeof(DnsPacket)) + a);
86 if (!p)
87 return -ENOMEM;
88
89 p->size = p->rindex = DNS_PACKET_HEADER_SIZE;
90 p->allocated = a;
51027656 91 p->max_size = max_size;
1716f6dc 92 p->protocol = protocol;
519ef046 93 p->opt_start = p->opt_size = (size_t) -1;
74b2466e
LP		 94 p->n_ref = 1;
95
96 *ret = p;
97
98 return 0;
99}
100
dbfbb6e7 101void dns_packet_set_flags(DnsPacket *p, bool dnssec_checking_disabled, bool truncated) {
74b2466e 102
dbfbb6e7 103 DnsPacketHeader *h;
74b2466e 104
dbfbb6e7 105 assert(p);
74b2466e
LP		 106
107 h = DNS_PACKET_HEADER(p);
1716f6dc 108
dbfbb6e7
DM		 109 switch(p->protocol) {
110 case DNS_PROTOCOL_LLMNR:
111 assert(!truncated);
112
069360a6
LP		 113 h->flags = htobe16(DNS_PACKET_MAKE_FLAGS(0 /* qr */,
114 0 /* opcode */,
115 0 /* c */,
e5abebab 116 0 /* tc */,
069360a6
LP		 117 0 /* t */,
118 0 /* ra */,
119 0 /* ad */,
120 0 /* cd */,
121 0 /* rcode */));
dbfbb6e7
DM		 122 break;
123
124 case DNS_PROTOCOL_MDNS:
125 h->flags = htobe16(DNS_PACKET_MAKE_FLAGS(0 /* qr */,
126 0 /* opcode */,
127 0 /* aa */,
128 truncated /* tc */,
129 0 /* rd (ask for recursion) */,
130 0 /* ra */,
131 0 /* ad */,
132 0 /* cd */,
133 0 /* rcode */));
134 break;
135
136 default:
137 assert(!truncated);
138
069360a6
LP		 139 h->flags = htobe16(DNS_PACKET_MAKE_FLAGS(0 /* qr */,
140 0 /* opcode */,
141 0 /* aa */,
142 0 /* tc */,
143 1 /* rd (ask for recursion) */,
144 0 /* ra */,
145 0 /* ad */,
24710c48 146 dnssec_checking_disabled /* cd */,
069360a6 147 0 /* rcode */));
dbfbb6e7
DM		 148 }
149}
150
46a58596 151int dns_packet_new_query(DnsPacket **ret, DnsProtocol protocol, size_t min_alloc_dsize, bool dnssec_checking_disabled) {
dbfbb6e7
DM		 152 DnsPacket *p;
153 int r;
154
155 assert(ret);
156
51027656 157 r = dns_packet_new(&p, protocol, min_alloc_dsize, DNS_PACKET_SIZE_MAX);
dbfbb6e7
DM		 158 if (r < 0)
159 return r;
160
161 /* Always set the TC bit to 0 initially.
162 * If there are multiple packets later, we'll update the bit shortly before sending.
163 */
164 dns_packet_set_flags(p, dnssec_checking_disabled, false);
74b2466e
LP		 165
166 *ret = p;
167 return 0;
168}
169
170DnsPacket *dns_packet_ref(DnsPacket *p) {
171
172 if (!p)
173 return NULL;
174
a8812dd7
LP		 175 assert(!p->on_stack);
176
74b2466e
LP		 177 assert(p->n_ref > 0);
178 p->n_ref++;
179 return p;
180}
181
182static void dns_packet_free(DnsPacket *p) {
183 char *s;
184
185 assert(p);
186
faa133f3
LP		 187 dns_question_unref(p->question);
188 dns_answer_unref(p->answer);
d75acfb0 189 dns_resource_record_unref(p->opt);
322345fd 190
74b2466e
LP		 191 while ((s = hashmap_steal_first_key(p->names)))
192 free(s);
193 hashmap_free(p->names);
194
faa133f3 195 free(p->_data);
a8812dd7
LP		 196
197 if (!p->on_stack)
198 free(p);
74b2466e
LP		 199}
200
201DnsPacket *dns_packet_unref(DnsPacket *p) {
202 if (!p)
203 return NULL;
204
205 assert(p->n_ref > 0);
206
6728a58d 207 dns_packet_unref(p->more);
9c491563 208
74b2466e
LP		 209 if (p->n_ref == 1)
210 dns_packet_free(p);
211 else
212 p->n_ref--;
213
214 return NULL;
215}
216
217int dns_packet_validate(DnsPacket *p) {
218 assert(p);
219
220 if (p->size < DNS_PACKET_HEADER_SIZE)
221 return -EBADMSG;
222
c73ce96b
LP		 223 if (p->size > DNS_PACKET_SIZE_MAX)
224 return -EBADMSG;
225
623a4c97 226 return 1;
74b2466e
LP		 227}
228
229int dns_packet_validate_reply(DnsPacket *p) {
74b2466e
LP		 230 int r;
231
232 assert(p);
233
234 r = dns_packet_validate(p);
235 if (r < 0)
236 return r;
237
623a4c97
LP		 238 if (DNS_PACKET_QR(p) != 1)
239 return 0;
240
241 if (DNS_PACKET_OPCODE(p) != 0)
74b2466e
LP		 242 return -EBADMSG;
243
818ef443 244 switch (p->protocol) {
d75acfb0 245
818ef443
DM		 246 case DNS_PROTOCOL_LLMNR:
247 /* RFC 4795, Section 2.1.1. says to discard all replies with QDCOUNT != 1 */
248 if (DNS_PACKET_QDCOUNT(p) != 1)
249 return -EBADMSG;
250
251 break;
252
4e5bf5e1
DM		 253 case DNS_PROTOCOL_MDNS:
254 /* RFC 6762, Section 18 */
255 if (DNS_PACKET_RCODE(p) != 0)
256 return -EBADMSG;
257
258 break;
259
818ef443
DM		 260 default:
261 break;
262 }
ea917db9 263
623a4c97
LP		 264 return 1;
265}
266
267int dns_packet_validate_query(DnsPacket *p) {
268 int r;
269
270 assert(p);
271
272 r = dns_packet_validate(p);
273 if (r < 0)
274 return r;
275
276 if (DNS_PACKET_QR(p) != 0)
277 return 0;
278
3cb10d3a 279 if (DNS_PACKET_OPCODE(p) != 0)
74b2466e
LP		 280 return -EBADMSG;
281
623a4c97
LP		 282 if (DNS_PACKET_TC(p))
283 return -EBADMSG;
284
818ef443 285 switch (p->protocol) {
d75acfb0 286
818ef443 287 case DNS_PROTOCOL_LLMNR:
b30bf55d 288 case DNS_PROTOCOL_DNS:
818ef443
DM		 289 /* RFC 4795, Section 2.1.1. says to discard all queries with QDCOUNT != 1 */
290 if (DNS_PACKET_QDCOUNT(p) != 1)
291 return -EBADMSG;
623a4c97 292
818ef443
DM		 293 /* RFC 4795, Section 2.1.1. says to discard all queries with ANCOUNT != 0 */
294 if (DNS_PACKET_ANCOUNT(p) > 0)
295 return -EBADMSG;
623a4c97 296
818ef443
DM		 297 /* RFC 4795, Section 2.1.1. says to discard all queries with NSCOUNT != 0 */
298 if (DNS_PACKET_NSCOUNT(p) > 0)
299 return -EBADMSG;
300
301 break;
302
4e5bf5e1
DM		 303 case DNS_PROTOCOL_MDNS:
304 /* RFC 6762, Section 18 */
305 if (DNS_PACKET_AA(p) != 0 ||
306 DNS_PACKET_RD(p) != 0 ||
307 DNS_PACKET_RA(p) != 0 ||
308 DNS_PACKET_AD(p) != 0 ||
309 DNS_PACKET_CD(p) != 0 ||
310 DNS_PACKET_RCODE(p) != 0)
311 return -EBADMSG;
312
313 break;
314
818ef443
DM		 315 default:
316 break;
317 }
623a4c97
LP		 318
319 return 1;
74b2466e
LP		 320}
321
322static int dns_packet_extend(DnsPacket *p, size_t add, void **ret, size_t *start) {
323 assert(p);
324
c73ce96b 325 if (p->size + add > p->allocated) {
51027656 326 size_t a, ms;
c73ce96b
LP		 327
328 a = PAGE_ALIGN((p->size + add) * 2);
51027656
LP		 329
330 ms = dns_packet_size_max(p);
331 if (a > ms)
332 a = ms;
c73ce96b
LP		 333
334 if (p->size + add > a)
335 return -EMSGSIZE;
336
faa133f3 337 if (p->_data) {
c73ce96b
LP		 338 void *d;
339
faa133f3 340 d = realloc(p->_data, a);
c73ce96b
LP		 341 if (!d)
342 return -ENOMEM;
343
faa133f3 344 p->_data = d;
c73ce96b 345 } else {
faa133f3
LP		 346 p->_data = malloc(a);
347 if (!p->_data)
c73ce96b
LP		 348 return -ENOMEM;
349
faa133f3
LP		 350 memcpy(p->_data, (uint8_t*) p + ALIGN(sizeof(DnsPacket)), p->size);
351 memzero((uint8_t*) p->_data + p->size, a - p->size);
c73ce96b
LP		 352 }
353
354 p->allocated = a;
355 }
74b2466e
LP		 356
357 if (start)
358 *start = p->size;
359
360 if (ret)
361 *ret = (uint8_t*) DNS_PACKET_DATA(p) + p->size;
362
363 p->size += add;
364 return 0;
365}
366
9c5e12a4 367void dns_packet_truncate(DnsPacket *p, size_t sz) {
74b2466e
LP		 368 Iterator i;
369 char *s;
370 void *n;
371
372 assert(p);
373
374 if (p->size <= sz)
375 return;
376
0e03ade5 377 HASHMAP_FOREACH_KEY(n, s, p->names, i) {
74b2466e
LP		 378
379 if (PTR_TO_SIZE(n) < sz)
380 continue;
381
382 hashmap_remove(p->names, s);
383 free(s);
384 }
385
386 p->size = sz;
387}
388
623a4c97
LP		 389int dns_packet_append_blob(DnsPacket *p, const void *d, size_t l, size_t *start) {
390 void *q;
391 int r;
392
393 assert(p);
394
395 r = dns_packet_extend(p, l, &q, start);
396 if (r < 0)
397 return r;
398
399 memcpy(q, d, l);
400 return 0;
401}
402
74b2466e
LP		 403int dns_packet_append_uint8(DnsPacket *p, uint8_t v, size_t *start) {
404 void *d;
405 int r;
406
407 assert(p);
408
409 r = dns_packet_extend(p, sizeof(uint8_t), &d, start);
410 if (r < 0)
411 return r;
412
413 ((uint8_t*) d)[0] = v;
414
415 return 0;
416}
417
418int dns_packet_append_uint16(DnsPacket *p, uint16_t v, size_t *start) {
419 void *d;
420 int r;
421
422 assert(p);
423
424 r = dns_packet_extend(p, sizeof(uint16_t), &d, start);
425 if (r < 0)
426 return r;
427
725ca0e5 428 unaligned_write_be16(d, v);
623a4c97
LP		 429
430 return 0;
431}
432
433int dns_packet_append_uint32(DnsPacket *p, uint32_t v, size_t *start) {
434 void *d;
435 int r;
436
437 assert(p);
438
439 r = dns_packet_extend(p, sizeof(uint32_t), &d, start);
440 if (r < 0)
441 return r;
442
725ca0e5 443 unaligned_write_be32(d, v);
74b2466e
LP		 444
445 return 0;
446}
447
448int dns_packet_append_string(DnsPacket *p, const char *s, size_t *start) {
74b2466e
LP		 449 assert(p);
450 assert(s);
451
c38a52da 452 return dns_packet_append_raw_string(p, s, strlen(s), start);
74b2466e
LP		 453}
454
2001c805
LP		 455int dns_packet_append_raw_string(DnsPacket *p, const void *s, size_t size, size_t *start) {
456 void *d;
457 int r;
458
459 assert(p);
460 assert(s || size == 0);
461
462 if (size > 255)
463 return -E2BIG;
464
465 r = dns_packet_extend(p, 1 + size, &d, start);
466 if (r < 0)
467 return r;
468
469 ((uint8_t*) d)[0] = (uint8_t) size;
470
75f32f04 471 memcpy_safe(((uint8_t*) d) + 1, s, size);
2001c805
LP		 472
473 return 0;
474}
475
a3db237b 476int dns_packet_append_label(DnsPacket *p, const char *d, size_t l, bool canonical_candidate, size_t *start) {
a8812dd7 477 uint8_t *w;
74b2466e
LP		 478 int r;
479
a3db237b
LP		 480 /* Append a label to a packet. Optionally, does this in DNSSEC
481 * canonical form, if this label is marked as a candidate for
482 * it, and the canonical form logic is enabled for the
483 * packet */
484
74b2466e
LP		 485 assert(p);
486 assert(d);
487
488 if (l > DNS_LABEL_MAX)
489 return -E2BIG;
490
a8812dd7 491 r = dns_packet_extend(p, 1 + l, (void**) &w, start);
74b2466e
LP		 492 if (r < 0)
493 return r;
494
a8812dd7
LP		 495 *(w++) = (uint8_t) l;
496
a3db237b 497 if (p->canonical_form && canonical_candidate) {
a8812dd7
LP		 498 size_t i;
499
500 /* Generate in canonical form, as defined by DNSSEC
501 * RFC 4034, Section 6.2, i.e. all lower-case. */
502
b577e3d5
LP		 503 for (i = 0; i < l; i++)
504 w[i] = (uint8_t) ascii_tolower(d[i]);
a8812dd7
LP		 505 } else
506 /* Otherwise, just copy the string unaltered. This is
507 * essential for DNS-SD, where the casing of labels
508 * matters and needs to be retained. */
509 memcpy(w, d, l);
74b2466e
LP		 510
511 return 0;
512}
513
f6a5fec6
LP		 514int dns_packet_append_name(
515 DnsPacket *p,
516 const char *name,
517 bool allow_compression,
a3db237b 518 bool canonical_candidate,
f6a5fec6
LP		 519 size_t *start) {
520
74b2466e
LP		 521 size_t saved_size;
522 int r;
523
524 assert(p);
525 assert(name);
526
f6a5fec6
LP		 527 if (p->refuse_compression)
528 allow_compression = false;
529
74b2466e
LP		 530 saved_size = p->size;
531
e48b9a64 532 while (!dns_name_is_root(name)) {
08f904fd 533 const char *z = name;
74b2466e 534 char label[DNS_LABEL_MAX];
151226ab 535 size_t n = 0;
74b2466e 536
151226ab
ZJS		 537 if (allow_compression)
538 n = PTR_TO_SIZE(hashmap_get(p->names, name));
74b2466e
LP		 539 if (n > 0) {
540 assert(n < p->size);
541
542 if (n < 0x4000) {
543 r = dns_packet_append_uint16(p, 0xC000 | n, NULL);
544 if (r < 0)
545 goto fail;
546
547 goto done;
548 }
549 }
550
74b2466e
LP		 551 r = dns_label_unescape(&name, label, sizeof(label));
552 if (r < 0)
553 goto fail;
554
a3db237b 555 r = dns_packet_append_label(p, label, r, canonical_candidate, &n);
74b2466e
LP		 556 if (r < 0)
557 goto fail;
558
151226ab 559 if (allow_compression) {
08f904fd
LP		 560 _cleanup_free_ char *s = NULL;
561
562 s = strdup(z);
563 if (!s) {
564 r = -ENOMEM;
565 goto fail;
566 }
567
d5099efc 568 r = hashmap_ensure_allocated(&p->names, &dns_name_hash_ops);
151226ab
ZJS		 569 if (r < 0)
570 goto fail;
74b2466e 571
151226ab
ZJS		 572 r = hashmap_put(p->names, s, SIZE_TO_PTR(n));
573 if (r < 0)
574 goto fail;
74b2466e 575
151226ab
ZJS		 576 s = NULL;
577 }
74b2466e
LP		 578 }
579
580 r = dns_packet_append_uint8(p, 0, NULL);
581 if (r < 0)
582 return r;
583
584done:
585 if (start)
586 *start = saved_size;
587
588 return 0;
589
590fail:
591 dns_packet_truncate(p, saved_size);
592 return r;
593}
594
58ab31d5 595int dns_packet_append_key(DnsPacket *p, const DnsResourceKey *k, const DnsAnswerFlags flags, size_t *start) {
74b2466e 596 size_t saved_size;
58ab31d5 597 uint16_t class;
74b2466e
LP		 598 int r;
599
600 assert(p);
601 assert(k);
602
603 saved_size = p->size;
604
1c02e7ba 605 r = dns_packet_append_name(p, dns_resource_key_name(k), true, true, NULL);
74b2466e
LP		 606 if (r < 0)
607 goto fail;
608
609 r = dns_packet_append_uint16(p, k->type, NULL);
610 if (r < 0)
611 goto fail;
612
58ab31d5
DR		 613 class = flags & DNS_ANSWER_CACHE_FLUSH ? k->class | MDNS_RR_CACHE_FLUSH : k->class;
614 r = dns_packet_append_uint16(p, class, NULL);
74b2466e
LP		 615 if (r < 0)
616 goto fail;
617
618 if (start)
619 *start = saved_size;
620
621 return 0;
622
623fail:
624 dns_packet_truncate(p, saved_size);
625 return r;
626}
627
e1a9f1a8 628static int dns_packet_append_type_window(DnsPacket *p, uint8_t window, uint8_t length, const uint8_t *types, size_t *start) {
50f1e641
TG		 629 size_t saved_size;
630 int r;
631
632 assert(p);
633 assert(types);
1792f223 634 assert(length > 0);
50f1e641 635
50f1e641
TG		 636 saved_size = p->size;
637
1792f223
TG		 638 r = dns_packet_append_uint8(p, window, NULL);
639 if (r < 0)
640 goto fail;
50f1e641 641
1792f223
TG		 642 r = dns_packet_append_uint8(p, length, NULL);
643 if (r < 0)
644 goto fail;
6fa91901 645
1792f223
TG		 646 r = dns_packet_append_blob(p, types, length, NULL);
647 if (r < 0)
648 goto fail;
50f1e641
TG		 649
650 if (start)
651 *start = saved_size;
652
653 return 0;
654fail:
655 dns_packet_truncate(p, saved_size);
656 return r;
657}
658
659static int dns_packet_append_types(DnsPacket *p, Bitmap *types, size_t *start) {
cb57dd41 660 Iterator i;
50f1e641 661 uint8_t window = 0;
1792f223 662 uint8_t entry = 0;
50f1e641
TG		 663 uint8_t bitmaps[32] = {};
664 unsigned n;
665 size_t saved_size;
666 int r;
667
668 assert(p);
50f1e641
TG		 669
670 saved_size = p->size;
671
cb57dd41 672 BITMAP_FOREACH(n, types, i) {
50f1e641
TG		 673 assert(n <= 0xffff);
674
1792f223
TG		 675 if ((n >> 8) != window && bitmaps[entry / 8] != 0) {
676 r = dns_packet_append_type_window(p, window, entry / 8 + 1, bitmaps, NULL);
50f1e641
TG		 677 if (r < 0)
678 goto fail;
679
1792f223 680 zero(bitmaps);
50f1e641
TG		 681 }
682
1792f223 683 window = n >> 8;
50f1e641
TG		 684 entry = n & 255;
685
686 bitmaps[entry / 8] |= 1 << (7 - (entry % 8));
687 }
688
d0ae14ff
LP		 689 if (bitmaps[entry / 8] != 0) {
690 r = dns_packet_append_type_window(p, window, entry / 8 + 1, bitmaps, NULL);
691 if (r < 0)
692 goto fail;
693 }
50f1e641
TG		 694
695 if (start)
696 *start = saved_size;
697
698 return 0;
699fail:
700 dns_packet_truncate(p, saved_size);
701 return r;
702}
703
dc913c9a 704/* Append the OPT pseudo-RR described in RFC6891 */
f2ed4c69 705int dns_packet_append_opt(DnsPacket *p, uint16_t max_udp_size, bool edns0_do, int rcode, size_t *start) {
dc913c9a
TG		 706 size_t saved_size;
707 int r;
708
709 assert(p);
710 /* we must never advertise supported packet size smaller than the legacy max */
711 assert(max_udp_size >= DNS_PACKET_UNICAST_SIZE_MAX);
f2ed4c69
LP		 712 assert(rcode >= 0);
713 assert(rcode <= _DNS_RCODE_MAX);
dc913c9a 714
519ef046
LP		 715 if (p->opt_start != (size_t) -1)
716 return -EBUSY;
717
718 assert(p->opt_size == (size_t) -1);
719
dc913c9a
TG		 720 saved_size = p->size;
721
722 /* empty name */
723 r = dns_packet_append_uint8(p, 0, NULL);
724 if (r < 0)
725 return r;
726
727 /* type */
728 r = dns_packet_append_uint16(p, DNS_TYPE_OPT, NULL);
729 if (r < 0)
730 goto fail;
731
f2ed4c69 732 /* class: maximum udp packet that can be received */
dc913c9a
TG		 733 r = dns_packet_append_uint16(p, max_udp_size, NULL);
734 if (r < 0)
735 goto fail;
736
737 /* extended RCODE and VERSION */
f2ed4c69 738 r = dns_packet_append_uint16(p, ((uint16_t) rcode & 0x0FF0) << 4, NULL);
dc913c9a
TG		 739 if (r < 0)
740 goto fail;
741
7586f4d1
TG		 742 /* flags: DNSSEC OK (DO), see RFC3225 */
743 r = dns_packet_append_uint16(p, edns0_do ? EDNS0_OPT_DO : 0, NULL);
dc913c9a
TG		 744 if (r < 0)
745 goto fail;
746
747 /* RDLENGTH */
12c40d4c 748 if (edns0_do && !DNS_PACKET_QR(p)) {
b30bf55d 749 /* If DO is on and this is not a reply, also append RFC6975 Algorithm data */
665408ac
LP		 750
751 static const uint8_t rfc6975[] = {
752
753 0, 5, /* OPTION_CODE: DAU */
754 0, 6, /* LIST_LENGTH */
755 DNSSEC_ALGORITHM_RSASHA1,
756 DNSSEC_ALGORITHM_RSASHA1_NSEC3_SHA1,
757 DNSSEC_ALGORITHM_RSASHA256,
758 DNSSEC_ALGORITHM_RSASHA512,
759 DNSSEC_ALGORITHM_ECDSAP256SHA256,
760 DNSSEC_ALGORITHM_ECDSAP384SHA384,
761
762 0, 6, /* OPTION_CODE: DHU */
763 0, 3, /* LIST_LENGTH */
764 DNSSEC_DIGEST_SHA1,
765 DNSSEC_DIGEST_SHA256,
766 DNSSEC_DIGEST_SHA384,
767
768 0, 7, /* OPTION_CODE: N3U */
769 0, 1, /* LIST_LENGTH */
770 NSEC3_ALGORITHM_SHA1,
771 };
772
773 r = dns_packet_append_uint16(p, sizeof(rfc6975), NULL);
774 if (r < 0)
775 goto fail;
776
777 r = dns_packet_append_blob(p, rfc6975, sizeof(rfc6975), NULL);
778 } else
779 r = dns_packet_append_uint16(p, 0, NULL);
dc913c9a
TG		 780 if (r < 0)
781 goto fail;
782
519ef046
LP		 783 DNS_PACKET_HEADER(p)->arcount = htobe16(DNS_PACKET_ARCOUNT(p) + 1);
784
785 p->opt_start = saved_size;
786 p->opt_size = p->size - saved_size;
787
dc913c9a
TG		 788 if (start)
789 *start = saved_size;
790
791 return 0;
792
793fail:
794 dns_packet_truncate(p, saved_size);
795 return r;
796}
797
519ef046
LP		 798int dns_packet_truncate_opt(DnsPacket *p) {
799 assert(p);
800
801 if (p->opt_start == (size_t) -1) {
802 assert(p->opt_size == (size_t) -1);
803 return 0;
804 }
805
806 assert(p->opt_size != (size_t) -1);
807 assert(DNS_PACKET_ARCOUNT(p) > 0);
808
809 if (p->opt_start + p->opt_size != p->size)
810 return -EBUSY;
811
812 dns_packet_truncate(p, p->opt_start);
813 DNS_PACKET_HEADER(p)->arcount = htobe16(DNS_PACKET_ARCOUNT(p) - 1);
814 p->opt_start = p->opt_size = (size_t) -1;
815
816 return 1;
817}
818
58ab31d5 819int dns_packet_append_rr(DnsPacket *p, const DnsResourceRecord *rr, const DnsAnswerFlags flags, size_t *start, size_t *rdata_start) {
f471bc11 820
a8812dd7 821 size_t saved_size, rdlength_offset, end, rdlength, rds;
c3ae4188 822 uint32_t ttl;
623a4c97
LP		 823 int r;
824
825 assert(p);
826 assert(rr);
827
828 saved_size = p->size;
829
58ab31d5 830 r = dns_packet_append_key(p, rr->key, flags, NULL);
623a4c97
LP		 831 if (r < 0)
832 goto fail;
833
c3ae4188
DR		 834 ttl = flags & DNS_ANSWER_GOODBYE ? 0 : rr->ttl;
835 r = dns_packet_append_uint32(p, ttl, NULL);
623a4c97
LP		 836 if (r < 0)
837 goto fail;
838
839 /* Initially we write 0 here */
840 r = dns_packet_append_uint16(p, 0, &rdlength_offset);
841 if (r < 0)
842 goto fail;
843
a8812dd7
LP		 844 rds = p->size - saved_size;
845
0dae31d4 846 switch (rr->unparseable ? _DNS_TYPE_INVALID : rr->key->type) {
623a4c97 847
9c92ce6d
LP		 848 case DNS_TYPE_SRV:
849 r = dns_packet_append_uint16(p, rr->srv.priority, NULL);
850 if (r < 0)
851 goto fail;
852
853 r = dns_packet_append_uint16(p, rr->srv.weight, NULL);
854 if (r < 0)
855 goto fail;
856
857 r = dns_packet_append_uint16(p, rr->srv.port, NULL);
858 if (r < 0)
859 goto fail;
860
a3db237b 861 r = dns_packet_append_name(p, rr->srv.name, true, false, NULL);
9c92ce6d
LP		 862 break;
863
623a4c97
LP		 864 case DNS_TYPE_PTR:
865 case DNS_TYPE_NS:
866 case DNS_TYPE_CNAME:
8ac4e9e1 867 case DNS_TYPE_DNAME:
a3db237b 868 r = dns_packet_append_name(p, rr->ptr.name, true, false, NULL);
623a4c97
LP		 869 break;
870
871 case DNS_TYPE_HINFO:
872 r = dns_packet_append_string(p, rr->hinfo.cpu, NULL);
873 if (r < 0)
874 goto fail;
875
876 r = dns_packet_append_string(p, rr->hinfo.os, NULL);
877 break;
878
9de3e329 879 case DNS_TYPE_SPF: /* exactly the same as TXT */
2001c805 880 case DNS_TYPE_TXT:
2e276efc 881
2001c805 882 if (!rr->txt.items) {
1ccda9b7
LP		 883 /* RFC 6763, section 6.1 suggests to generate
884 * single empty string for an empty array. */
885
2001c805 886 r = dns_packet_append_raw_string(p, NULL, 0, NULL);
2e276efc
ZJS		 887 if (r < 0)
888 goto fail;
1ccda9b7 889 } else {
2001c805
LP		 890 DnsTxtItem *i;
891
892 LIST_FOREACH(items, i, rr->txt.items) {
893 r = dns_packet_append_raw_string(p, i->data, i->length, NULL);
1ccda9b7
LP		 894 if (r < 0)
895 goto fail;
896 }
2e276efc
ZJS		 897 }
898
6a6fc3df 899 r = 0;
2e276efc 900 break;
2e276efc 901
623a4c97
LP		 902 case DNS_TYPE_A:
903 r = dns_packet_append_blob(p, &rr->a.in_addr, sizeof(struct in_addr), NULL);
904 break;
905
906 case DNS_TYPE_AAAA:
907 r = dns_packet_append_blob(p, &rr->aaaa.in6_addr, sizeof(struct in6_addr), NULL);
908 break;
909
910 case DNS_TYPE_SOA:
a3db237b 911 r = dns_packet_append_name(p, rr->soa.mname, true, false, NULL);
623a4c97
LP		 912 if (r < 0)
913 goto fail;
914
a3db237b 915 r = dns_packet_append_name(p, rr->soa.rname, true, false, NULL);
623a4c97
LP		 916 if (r < 0)
917 goto fail;
918
919 r = dns_packet_append_uint32(p, rr->soa.serial, NULL);
920 if (r < 0)
921 goto fail;
922
923 r = dns_packet_append_uint32(p, rr->soa.refresh, NULL);
924 if (r < 0)
925 goto fail;
926
927 r = dns_packet_append_uint32(p, rr->soa.retry, NULL);
928 if (r < 0)
929 goto fail;
930
931 r = dns_packet_append_uint32(p, rr->soa.expire, NULL);
932 if (r < 0)
933 goto fail;
934
935 r = dns_packet_append_uint32(p, rr->soa.minimum, NULL);
936 break;
937
938 case DNS_TYPE_MX:
946c7094
ZJS		 939 r = dns_packet_append_uint16(p, rr->mx.priority, NULL);
940 if (r < 0)
941 goto fail;
942
a3db237b 943 r = dns_packet_append_name(p, rr->mx.exchange, true, false, NULL);
946c7094
ZJS		 944 break;
945
0dae31d4
ZJS		 946 case DNS_TYPE_LOC:
947 r = dns_packet_append_uint8(p, rr->loc.version, NULL);
948 if (r < 0)
949 goto fail;
950
951 r = dns_packet_append_uint8(p, rr->loc.size, NULL);
952 if (r < 0)
953 goto fail;
954
955 r = dns_packet_append_uint8(p, rr->loc.horiz_pre, NULL);
956 if (r < 0)
957 goto fail;
958
959 r = dns_packet_append_uint8(p, rr->loc.vert_pre, NULL);
960 if (r < 0)
961 goto fail;
962
afbc4f26 963 r = dns_packet_append_uint32(p, rr->loc.latitude, NULL);
0dae31d4
ZJS		 964 if (r < 0)
965 goto fail;
966
afbc4f26 967 r = dns_packet_append_uint32(p, rr->loc.longitude, NULL);
0dae31d4
ZJS		 968 if (r < 0)
969 goto fail;
970
afbc4f26 971 r = dns_packet_append_uint32(p, rr->loc.altitude, NULL);
0dae31d4
ZJS		 972 break;
973
abf126a3
TG		 974 case DNS_TYPE_DS:
975 r = dns_packet_append_uint16(p, rr->ds.key_tag, NULL);
976 if (r < 0)
977 goto fail;
978
979 r = dns_packet_append_uint8(p, rr->ds.algorithm, NULL);
980 if (r < 0)
981 goto fail;
982
983 r = dns_packet_append_uint8(p, rr->ds.digest_type, NULL);
984 if (r < 0)
985 goto fail;
986
987 r = dns_packet_append_blob(p, rr->ds.digest, rr->ds.digest_size, NULL);
988 break;
989
623a4c97 990 case DNS_TYPE_SSHFP:
42cc2eeb
LP		 991 r = dns_packet_append_uint8(p, rr->sshfp.algorithm, NULL);
992 if (r < 0)
993 goto fail;
8db0d2f5 994
42cc2eeb
LP		 995 r = dns_packet_append_uint8(p, rr->sshfp.fptype, NULL);
996 if (r < 0)
997 goto fail;
998
549c1a25 999 r = dns_packet_append_blob(p, rr->sshfp.fingerprint, rr->sshfp.fingerprint_size, NULL);
42cc2eeb
LP		 1000 break;
1001
8db0d2f5 1002 case DNS_TYPE_DNSKEY:
f91dc240 1003 r = dns_packet_append_uint16(p, rr->dnskey.flags, NULL);
8db0d2f5
ZJS		 1004 if (r < 0)
1005 goto fail;
1006
f91dc240 1007 r = dns_packet_append_uint8(p, rr->dnskey.protocol, NULL);
8db0d2f5
ZJS		 1008 if (r < 0)
1009 goto fail;
1010
1011 r = dns_packet_append_uint8(p, rr->dnskey.algorithm, NULL);
1012 if (r < 0)
1013 goto fail;
1014
1015 r = dns_packet_append_blob(p, rr->dnskey.key, rr->dnskey.key_size, NULL);
1016 break;
1017
151226ab
ZJS		 1018 case DNS_TYPE_RRSIG:
1019 r = dns_packet_append_uint16(p, rr->rrsig.type_covered, NULL);
1020 if (r < 0)
1021 goto fail;
1022
1023 r = dns_packet_append_uint8(p, rr->rrsig.algorithm, NULL);
1024 if (r < 0)
1025 goto fail;
1026
1027 r = dns_packet_append_uint8(p, rr->rrsig.labels, NULL);
1028 if (r < 0)
1029 goto fail;
1030
1031 r = dns_packet_append_uint32(p, rr->rrsig.original_ttl, NULL);
1032 if (r < 0)
1033 goto fail;
1034
1035 r = dns_packet_append_uint32(p, rr->rrsig.expiration, NULL);
1036 if (r < 0)
1037 goto fail;
1038
1039 r = dns_packet_append_uint32(p, rr->rrsig.inception, NULL);
1040 if (r < 0)
1041 goto fail;
1042
0b1b17d3 1043 r = dns_packet_append_uint16(p, rr->rrsig.key_tag, NULL);
151226ab
ZJS		 1044 if (r < 0)
1045 goto fail;
1046
a3db237b 1047 r = dns_packet_append_name(p, rr->rrsig.signer, false, true, NULL);
151226ab
ZJS		 1048 if (r < 0)
1049 goto fail;
1050
1051 r = dns_packet_append_blob(p, rr->rrsig.signature, rr->rrsig.signature_size, NULL);
1052 break;
1053
50f1e641 1054 case DNS_TYPE_NSEC:
a3db237b 1055 r = dns_packet_append_name(p, rr->nsec.next_domain_name, false, false, NULL);
50f1e641
TG		 1056 if (r < 0)
1057 goto fail;
1058
1059 r = dns_packet_append_types(p, rr->nsec.types, NULL);
1060 if (r < 0)
1061 goto fail;
1062
5d45a880 1063 break;
d75acfb0 1064
5d45a880
TG		 1065 case DNS_TYPE_NSEC3:
1066 r = dns_packet_append_uint8(p, rr->nsec3.algorithm, NULL);
1067 if (r < 0)
1068 goto fail;
1069
1070 r = dns_packet_append_uint8(p, rr->nsec3.flags, NULL);
1071 if (r < 0)
1072 goto fail;
1073
1074 r = dns_packet_append_uint16(p, rr->nsec3.iterations, NULL);
1075 if (r < 0)
1076 goto fail;
1077
1078 r = dns_packet_append_uint8(p, rr->nsec3.salt_size, NULL);
1079 if (r < 0)
1080 goto fail;
1081
1082 r = dns_packet_append_blob(p, rr->nsec3.salt, rr->nsec3.salt_size, NULL);
1083 if (r < 0)
1084 goto fail;
1085
1086 r = dns_packet_append_uint8(p, rr->nsec3.next_hashed_name_size, NULL);
1087 if (r < 0)
1088 goto fail;
1089
1090 r = dns_packet_append_blob(p, rr->nsec3.next_hashed_name, rr->nsec3.next_hashed_name_size, NULL);
1091 if (r < 0)
1092 goto fail;
1093
1094 r = dns_packet_append_types(p, rr->nsec3.types, NULL);
1095 if (r < 0)
1096 goto fail;
1097
50f1e641 1098 break;
d75acfb0 1099
48d45d2b
ZJS		 1100 case DNS_TYPE_TLSA:
1101 r = dns_packet_append_uint8(p, rr->tlsa.cert_usage, NULL);
1102 if (r < 0)
1103 goto fail;
1104
1105 r = dns_packet_append_uint8(p, rr->tlsa.selector, NULL);
1106 if (r < 0)
1107 goto fail;
1108
1109 r = dns_packet_append_uint8(p, rr->tlsa.matching_type, NULL);
1110 if (r < 0)
1111 goto fail;
1112
1113 r = dns_packet_append_blob(p, rr->tlsa.data, rr->tlsa.data_size, NULL);
1114 break;
1115
95052df3
ZJS		 1116 case DNS_TYPE_CAA:
1117 r = dns_packet_append_uint8(p, rr->caa.flags, NULL);
1118 if (r < 0)
1119 goto fail;
1120
1121 r = dns_packet_append_string(p, rr->caa.tag, NULL);
1122 if (r < 0)
1123 goto fail;
1124
1125 r = dns_packet_append_blob(p, rr->caa.value, rr->caa.value_size, NULL);
1126 break;
1127
d75acfb0 1128 case DNS_TYPE_OPT:
d93a16b8 1129 case DNS_TYPE_OPENPGPKEY:
0dae31d4 1130 case _DNS_TYPE_INVALID: /* unparseable */
623a4c97 1131 default:
0dae31d4 1132
a43a068a 1133 r = dns_packet_append_blob(p, rr->generic.data, rr->generic.data_size, NULL);
623a4c97
LP		 1134 break;
1135 }
1136 if (r < 0)
1137 goto fail;
1138
1139 /* Let's calculate the actual data size and update the field */
1140 rdlength = p->size - rdlength_offset - sizeof(uint16_t);
1141 if (rdlength > 0xFFFF) {
555f5cdc 1142 r = -ENOSPC;
623a4c97
LP		 1143 goto fail;
1144 }
1145
1146 end = p->size;
1147 p->size = rdlength_offset;
1148 r = dns_packet_append_uint16(p, rdlength, NULL);
1149 if (r < 0)
1150 goto fail;
1151 p->size = end;
1152
351e6342
LP		 1153 if (start)
1154 *start = saved_size;
1155
a8812dd7
LP		 1156 if (rdata_start)
1157 *rdata_start = rds;
1158
623a4c97
LP		 1159 return 0;
1160
1161fail:
1162 dns_packet_truncate(p, saved_size);
1163 return r;
1164}
1165
f471bc11
LP		 1166int dns_packet_append_question(DnsPacket *p, DnsQuestion *q) {
1167 DnsResourceKey *key;
1168 int r;
1169
1170 assert(p);
1171
1172 DNS_QUESTION_FOREACH(key, q) {
58ab31d5 1173 r = dns_packet_append_key(p, key, 0, NULL);
f471bc11
LP		 1174 if (r < 0)
1175 return r;
1176 }
1177
1178 return 0;
1179}
1180
1181int dns_packet_append_answer(DnsPacket *p, DnsAnswer *a) {
1182 DnsResourceRecord *rr;
58ab31d5 1183 DnsAnswerFlags flags;
f471bc11
LP		 1184 int r;
1185
1186 assert(p);
1187
58ab31d5
DR		 1188 DNS_ANSWER_FOREACH_FLAGS(rr, flags, a) {
1189 r = dns_packet_append_rr(p, rr, flags, NULL, NULL);
f471bc11
LP		 1190 if (r < 0)
1191 return r;
1192 }
1193
1194 return 0;
1195}
1196
74b2466e
LP		 1197int dns_packet_read(DnsPacket *p, size_t sz, const void **ret, size_t *start) {
1198 assert(p);
1199
1200 if (p->rindex + sz > p->size)
1201 return -EMSGSIZE;
1202
1203 if (ret)
1204 *ret = (uint8_t*) DNS_PACKET_DATA(p) + p->rindex;
1205
1206 if (start)
1207 *start = p->rindex;
1208
1209 p->rindex += sz;
1210 return 0;
1211}
1212
8ba9fd9c 1213void dns_packet_rewind(DnsPacket *p, size_t idx) {
74b2466e
LP		 1214 assert(p);
1215 assert(idx <= p->size);
1216 assert(idx >= DNS_PACKET_HEADER_SIZE);
1217
1218 p->rindex = idx;
1219}
1220
623a4c97
LP		 1221int dns_packet_read_blob(DnsPacket *p, void *d, size_t sz, size_t *start) {
1222 const void *q;
1223 int r;
1224
1225 assert(p);
1226 assert(d);
1227
1228 r = dns_packet_read(p, sz, &q, start);
1229 if (r < 0)
1230 return r;
1231
1232 memcpy(d, q, sz);
1233 return 0;
1234}
1235
f5430a3e
LP		 1236static int dns_packet_read_memdup(
1237 DnsPacket *p, size_t size,
1238 void **ret, size_t *ret_size,
1239 size_t *ret_start) {
1240
1241 const void *src;
1242 size_t start;
1243 int r;
1244
1245 assert(p);
1246 assert(ret);
1247
1248 r = dns_packet_read(p, size, &src, &start);
1249 if (r < 0)
1250 return r;
1251
1252 if (size <= 0)
1253 *ret = NULL;
1254 else {
1255 void *copy;
1256
1257 copy = memdup(src, size);
1258 if (!copy)
1259 return -ENOMEM;
1260
1261 *ret = copy;
1262 }
1263
1264 if (ret_size)
1265 *ret_size = size;
1266 if (ret_start)
1267 *ret_start = start;
1268
1269 return 0;
1270}
1271
74b2466e
LP		 1272int dns_packet_read_uint8(DnsPacket *p, uint8_t *ret, size_t *start) {
1273 const void *d;
1274 int r;
1275
1276 assert(p);
1277
1278 r = dns_packet_read(p, sizeof(uint8_t), &d, start);
1279 if (r < 0)
1280 return r;
1281
1282 *ret = ((uint8_t*) d)[0];
1283 return 0;
1284}
1285
1286int dns_packet_read_uint16(DnsPacket *p, uint16_t *ret, size_t *start) {
1287 const void *d;
1288 int r;
1289
1290 assert(p);
1291
1292 r = dns_packet_read(p, sizeof(uint16_t), &d, start);
1293 if (r < 0)
1294 return r;
1295
725ca0e5
TG		 1296 *ret = unaligned_read_be16(d);
1297
74b2466e
LP		 1298 return 0;
1299}
1300
1301int dns_packet_read_uint32(DnsPacket *p, uint32_t *ret, size_t *start) {
1302 const void *d;
1303 int r;
1304
1305 assert(p);
1306
1307 r = dns_packet_read(p, sizeof(uint32_t), &d, start);
1308 if (r < 0)
1309 return r;
1310
725ca0e5 1311 *ret = unaligned_read_be32(d);
74b2466e
LP		 1312
1313 return 0;
1314}
1315
1316int dns_packet_read_string(DnsPacket *p, char **ret, size_t *start) {
e18a3c73 1317 _cleanup_(rewind_dns_packet) DnsPacketRewinder rewinder;
74b2466e
LP		 1318 const void *d;
1319 char *t;
1320 uint8_t c;
1321 int r;
1322
1323 assert(p);
e18a3c73 1324 INIT_REWINDER(rewinder, p);
74b2466e
LP		 1325
1326 r = dns_packet_read_uint8(p, &c, NULL);
1327 if (r < 0)
e18a3c73 1328 return r;
74b2466e
LP		 1329
1330 r = dns_packet_read(p, c, &d, NULL);
1331 if (r < 0)
e18a3c73 1332 return r;
74b2466e 1333
e18a3c73
ZJS		 1334 if (memchr(d, 0, c))
1335 return -EBADMSG;
74b2466e
LP		 1336
1337 t = strndup(d, c);
e18a3c73
ZJS		 1338 if (!t)
1339 return -ENOMEM;
74b2466e
LP		 1340
1341 if (!utf8_is_valid(t)) {
1342 free(t);
e18a3c73 1343 return -EBADMSG;
74b2466e
LP		 1344 }
1345
1346 *ret = t;
1347
1348 if (start)
e18a3c73
ZJS		 1349 *start = rewinder.saved_rindex;
1350 CANCEL_REWINDER(rewinder);
74b2466e
LP		 1351
1352 return 0;
74b2466e
LP		 1353}
1354
2001c805 1355int dns_packet_read_raw_string(DnsPacket *p, const void **ret, size_t *size, size_t *start) {
e18a3c73 1356 _cleanup_(rewind_dns_packet) DnsPacketRewinder rewinder;
2001c805
LP		 1357 uint8_t c;
1358 int r;
1359
1360 assert(p);
e18a3c73 1361 INIT_REWINDER(rewinder, p);
2001c805
LP		 1362
1363 r = dns_packet_read_uint8(p, &c, NULL);
1364 if (r < 0)
e18a3c73 1365 return r;
2001c805
LP		 1366
1367 r = dns_packet_read(p, c, ret, NULL);
1368 if (r < 0)
e18a3c73 1369 return r;
2001c805
LP		 1370
1371 if (size)
1372 *size = c;
1373 if (start)
e18a3c73
ZJS		 1374 *start = rewinder.saved_rindex;
1375 CANCEL_REWINDER(rewinder);
2001c805
LP		 1376
1377 return 0;
2001c805
LP		 1378}
1379
f6a5fec6
LP		 1380int dns_packet_read_name(
1381 DnsPacket *p,
1382 char **_ret,
1383 bool allow_compression,
1384 size_t *start) {
1385
e18a3c73
ZJS		 1386 _cleanup_(rewind_dns_packet) DnsPacketRewinder rewinder;
1387 size_t after_rindex = 0, jump_barrier;
74b2466e
LP		 1388 _cleanup_free_ char *ret = NULL;
1389 size_t n = 0, allocated = 0;
1390 bool first = true;
1391 int r;
1392
1393 assert(p);
1394 assert(_ret);
e18a3c73
ZJS		 1395 INIT_REWINDER(rewinder, p);
1396 jump_barrier = p->rindex;
74b2466e 1397
f6a5fec6
LP		 1398 if (p->refuse_compression)
1399 allow_compression = false;
1400
74b2466e
LP		 1401 for (;;) {
1402 uint8_t c, d;
1403
1404 r = dns_packet_read_uint8(p, &c, NULL);
1405 if (r < 0)
e18a3c73 1406 return r;
74b2466e
LP		 1407
1408 if (c == 0)
1409 /* End of name */
1410 break;
1411 else if (c <= 63) {
74b2466e
LP		 1412 const char *label;
1413
1414 /* Literal label */
1415 r = dns_packet_read(p, c, (const void**) &label, NULL);
1416 if (r < 0)
e18a3c73 1417 return r;
74b2466e 1418
e18a3c73
ZJS		 1419 if (!GREEDY_REALLOC(ret, allocated, n + !first + DNS_LABEL_ESCAPED_MAX))
1420 return -ENOMEM;
74b2466e 1421
422baca0 1422 if (first)
74b2466e 1423 first = false;
422baca0
LP		 1424 else
1425 ret[n++] = '.';
1426
1427 r = dns_label_escape(label, c, ret + n, DNS_LABEL_ESCAPED_MAX);
1428 if (r < 0)
e18a3c73 1429 return r;
74b2466e 1430
74b2466e
LP		 1431 n += r;
1432 continue;
151226ab 1433 } else if (allow_compression && (c & 0xc0) == 0xc0) {
74b2466e
LP		 1434 uint16_t ptr;
1435
1436 /* Pointer */
1437 r = dns_packet_read_uint8(p, &d, NULL);
1438 if (r < 0)
e18a3c73 1439 return r;
74b2466e
LP		 1440
1441 ptr = (uint16_t) (c & ~0xc0) << 8 | (uint16_t) d;
e18a3c73
ZJS		 1442 if (ptr < DNS_PACKET_HEADER_SIZE || ptr >= jump_barrier)
1443 return -EBADMSG;
74b2466e
LP		 1444
1445 if (after_rindex == 0)
1446 after_rindex = p->rindex;
1447
f131770b 1448 /* Jumps are limited to a "prior occurrence" (RFC-1035 4.1.4) */
c75dbf9b 1449 jump_barrier = ptr;
74b2466e 1450 p->rindex = ptr;
e18a3c73
ZJS		 1451 } else
1452 return -EBADMSG;
74b2466e
LP		 1453 }
1454
e18a3c73
ZJS		 1455 if (!GREEDY_REALLOC(ret, allocated, n + 1))
1456 return -ENOMEM;
74b2466e
LP		 1457
1458 ret[n] = 0;
1459
1460 if (after_rindex != 0)
1461 p->rindex= after_rindex;
1462
1463 *_ret = ret;
1464 ret = NULL;
1465
1466 if (start)
e18a3c73
ZJS		 1467 *start = rewinder.saved_rindex;
1468 CANCEL_REWINDER(rewinder);
74b2466e
LP		 1469
1470 return 0;
74b2466e
LP		 1471}
1472
50f1e641
TG		 1473static int dns_packet_read_type_window(DnsPacket *p, Bitmap **types, size_t *start) {
1474 uint8_t window;
1475 uint8_t length;
1476 const uint8_t *bitmap;
2ad613ad 1477 uint8_t bit = 0;
50f1e641
TG		 1478 unsigned i;
1479 bool found = false;
e18a3c73 1480 _cleanup_(rewind_dns_packet) DnsPacketRewinder rewinder;
50f1e641
TG		 1481 int r;
1482
1483 assert(p);
1484 assert(types);
e18a3c73 1485 INIT_REWINDER(rewinder, p);
50f1e641
TG		 1486
1487 r = bitmap_ensure_allocated(types);
1488 if (r < 0)
e18a3c73 1489 return r;
50f1e641
TG		 1490
1491 r = dns_packet_read_uint8(p, &window, NULL);
1492 if (r < 0)
e18a3c73 1493 return r;
50f1e641
TG		 1494
1495 r = dns_packet_read_uint8(p, &length, NULL);
1496 if (r < 0)
e18a3c73 1497 return r;
50f1e641
TG		 1498
1499 if (length == 0 || length > 32)
1500 return -EBADMSG;
1501
1502 r = dns_packet_read(p, length, (const void **)&bitmap, NULL);
1503 if (r < 0)
e18a3c73 1504 return r;
50f1e641
TG		 1505
1506 for (i = 0; i < length; i++) {
1507 uint8_t bitmask = 1 << 7;
50f1e641
TG		 1508
1509 if (!bitmap[i]) {
1510 found = false;
2ad613ad 1511 bit += 8;
50f1e641
TG		 1512 continue;
1513 }
1514
1515 found = true;
1516
9f939335 1517 for (; bitmask; bit++, bitmask >>= 1)
50f1e641
TG		 1518 if (bitmap[i] & bitmask) {
1519 uint16_t n;
1520
50f1e641
TG		 1521 n = (uint16_t) window << 8 | (uint16_t) bit;
1522
8e6edc49
TG		 1523 /* Ignore pseudo-types. see RFC4034 section 4.1.2 */
1524 if (dns_type_is_pseudo(n))
1525 continue;
1526
50f1e641
TG		 1527 r = bitmap_set(*types, n);
1528 if (r < 0)
e18a3c73 1529 return r;
50f1e641 1530 }
50f1e641
TG		 1531 }
1532
1533 if (!found)
1534 return -EBADMSG;
1535
1536 if (start)
e18a3c73
ZJS		 1537 *start = rewinder.saved_rindex;
1538 CANCEL_REWINDER(rewinder);
50f1e641
TG		 1539
1540 return 0;
50f1e641
TG		 1541}
1542
89492aaf 1543static int dns_packet_read_type_windows(DnsPacket *p, Bitmap **types, size_t size, size_t *start) {
e18a3c73 1544 _cleanup_(rewind_dns_packet) DnsPacketRewinder rewinder;
89492aaf
TG		 1545 int r;
1546
e18a3c73 1547 INIT_REWINDER(rewinder, p);
89492aaf 1548
e18a3c73 1549 while (p->rindex < rewinder.saved_rindex + size) {
89492aaf
TG		 1550 r = dns_packet_read_type_window(p, types, NULL);
1551 if (r < 0)
e18a3c73 1552 return r;
89492aaf
TG		 1553
1554 /* don't read past end of current RR */
e18a3c73
ZJS		 1555 if (p->rindex > rewinder.saved_rindex + size)
1556 return -EBADMSG;
89492aaf
TG		 1557 }
1558
e18a3c73
ZJS		 1559 if (p->rindex != rewinder.saved_rindex + size)
1560 return -EBADMSG;
89492aaf
TG		 1561
1562 if (start)
e18a3c73
ZJS		 1563 *start = rewinder.saved_rindex;
1564 CANCEL_REWINDER(rewinder);
89492aaf
TG		 1565
1566 return 0;
89492aaf
TG		 1567}
1568
d2579eec 1569int dns_packet_read_key(DnsPacket *p, DnsResourceKey **ret, bool *ret_cache_flush, size_t *start) {
e18a3c73 1570 _cleanup_(rewind_dns_packet) DnsPacketRewinder rewinder;
faa133f3 1571 _cleanup_free_ char *name = NULL;
d2579eec 1572 bool cache_flush = false;
faa133f3
LP		 1573 uint16_t class, type;
1574 DnsResourceKey *key;
74b2466e
LP		 1575 int r;
1576
1577 assert(p);
1578 assert(ret);
e18a3c73 1579 INIT_REWINDER(rewinder, p);
74b2466e 1580
151226ab 1581 r = dns_packet_read_name(p, &name, true, NULL);
74b2466e 1582 if (r < 0)
e18a3c73 1583 return r;
74b2466e 1584
faa133f3 1585 r = dns_packet_read_uint16(p, &type, NULL);
74b2466e 1586 if (r < 0)
e18a3c73 1587 return r;
74b2466e 1588
faa133f3 1589 r = dns_packet_read_uint16(p, &class, NULL);
74b2466e 1590 if (r < 0)
e18a3c73 1591 return r;
74b2466e 1592
23502de3
DM		 1593 if (p->protocol == DNS_PROTOCOL_MDNS) {
1594 /* See RFC6762, Section 10.2 */
1595
d2579eec 1596 if (type != DNS_TYPE_OPT && (class & MDNS_RR_CACHE_FLUSH)) {
23502de3 1597 class &= ~MDNS_RR_CACHE_FLUSH;
d2579eec
LP		 1598 cache_flush = true;
1599 }
23502de3
DM		 1600 }
1601
faa133f3 1602 key = dns_resource_key_new_consume(class, type, name);
e18a3c73
ZJS		 1603 if (!key)
1604 return -ENOMEM;
faa133f3
LP		 1605
1606 name = NULL;
1607 *ret = key;
74b2466e 1608
d2579eec
LP		 1609 if (ret_cache_flush)
1610 *ret_cache_flush = cache_flush;
74b2466e 1611 if (start)
e18a3c73
ZJS		 1612 *start = rewinder.saved_rindex;
1613 CANCEL_REWINDER(rewinder);
74b2466e
LP		 1614
1615 return 0;
74b2466e
LP		 1616}
1617
afbc4f26
ZJS		 1618static bool loc_size_ok(uint8_t size) {
1619 uint8_t m = size >> 4, e = size & 0xF;
1620
1621 return m <= 9 && e <= 9 && (m > 0 || e == 0);
1622}
1623
d2579eec 1624int dns_packet_read_rr(DnsPacket *p, DnsResourceRecord **ret, bool *ret_cache_flush, size_t *start) {
faa133f3
LP		 1625 _cleanup_(dns_resource_record_unrefp) DnsResourceRecord *rr = NULL;
1626 _cleanup_(dns_resource_key_unrefp) DnsResourceKey *key = NULL;
e18a3c73
ZJS		 1627 _cleanup_(rewind_dns_packet) DnsPacketRewinder rewinder;
1628 size_t offset;
74b2466e 1629 uint16_t rdlength;
d2579eec 1630 bool cache_flush;
74b2466e
LP		 1631 int r;
1632
1633 assert(p);
1634 assert(ret);
1635
e18a3c73 1636 INIT_REWINDER(rewinder, p);
74b2466e 1637
d2579eec 1638 r = dns_packet_read_key(p, &key, &cache_flush, NULL);
74b2466e 1639 if (r < 0)
e18a3c73 1640 return r;
74b2466e 1641
e18a3c73
ZJS		 1642 if (!dns_class_is_valid_rr(key->class) || !dns_type_is_valid_rr(key->type))
1643 return -EBADMSG;
0e2bcd6a 1644
faa133f3 1645 rr = dns_resource_record_new(key);
e18a3c73
ZJS		 1646 if (!rr)
1647 return -ENOMEM;
faa133f3 1648
74b2466e
LP		 1649 r = dns_packet_read_uint32(p, &rr->ttl, NULL);
1650 if (r < 0)
e18a3c73 1651 return r;
74b2466e 1652
0d0b52d7
LP		 1653 /* RFC 2181, Section 8, suggests to
1654 * treat a TTL with the MSB set as a zero TTL. */
1655 if (rr->ttl & UINT32_C(0x80000000))
1656 rr->ttl = 0;
1657
74b2466e
LP		 1658 r = dns_packet_read_uint16(p, &rdlength, NULL);
1659 if (r < 0)
e18a3c73 1660 return r;
74b2466e 1661
e18a3c73
ZJS		 1662 if (p->rindex + rdlength > p->size)
1663 return -EBADMSG;
74b2466e
LP		 1664
1665 offset = p->rindex;
1666
faa133f3 1667 switch (rr->key->type) {
74b2466e 1668
9c92ce6d
LP		 1669 case DNS_TYPE_SRV:
1670 r = dns_packet_read_uint16(p, &rr->srv.priority, NULL);
1671 if (r < 0)
e18a3c73 1672 return r;
9c92ce6d
LP		 1673 r = dns_packet_read_uint16(p, &rr->srv.weight, NULL);
1674 if (r < 0)
e18a3c73 1675 return r;
9c92ce6d
LP		 1676 r = dns_packet_read_uint16(p, &rr->srv.port, NULL);
1677 if (r < 0)
e18a3c73 1678 return r;
151226ab 1679 r = dns_packet_read_name(p, &rr->srv.name, true, NULL);
9c92ce6d
LP		 1680 break;
1681
74b2466e
LP		 1682 case DNS_TYPE_PTR:
1683 case DNS_TYPE_NS:
1684 case DNS_TYPE_CNAME:
8ac4e9e1 1685 case DNS_TYPE_DNAME:
151226ab 1686 r = dns_packet_read_name(p, &rr->ptr.name, true, NULL);
74b2466e
LP		 1687 break;
1688
1689 case DNS_TYPE_HINFO:
1690 r = dns_packet_read_string(p, &rr->hinfo.cpu, NULL);
1691 if (r < 0)
e18a3c73 1692 return r;
74b2466e
LP		 1693
1694 r = dns_packet_read_string(p, &rr->hinfo.os, NULL);
1695 break;
1696
9de3e329 1697 case DNS_TYPE_SPF: /* exactly the same as TXT */
1ccda9b7
LP		 1698 case DNS_TYPE_TXT:
1699 if (rdlength <= 0) {
2001c805 1700 DnsTxtItem *i;
1ccda9b7
LP		 1701 /* RFC 6763, section 6.1 suggests to treat
1702 * empty TXT RRs as equivalent to a TXT record
1703 * with a single empty string. */
0e3434ae 1704
2001c805
LP		 1705 i = malloc0(offsetof(DnsTxtItem, data) + 1); /* for safety reasons we add an extra NUL byte */
1706 if (!i)
1707 return -ENOMEM;
1708
1709 rr->txt.items = i;
1ccda9b7 1710 } else {
2001c805
LP		 1711 DnsTxtItem *last = NULL;
1712
1ccda9b7 1713 while (p->rindex < offset + rdlength) {
2001c805
LP		 1714 DnsTxtItem *i;
1715 const void *data;
1716 size_t sz;
2e276efc 1717
2001c805 1718 r = dns_packet_read_raw_string(p, &data, &sz, NULL);
1ccda9b7 1719 if (r < 0)
2001c805 1720 return r;
1ccda9b7 1721
2001c805
LP		 1722 i = malloc0(offsetof(DnsTxtItem, data) + sz + 1); /* extra NUL byte at the end */
1723 if (!i)
1724 return -ENOMEM;
1725
1726 memcpy(i->data, data, sz);
1727 i->length = sz;
1728
1729 LIST_INSERT_AFTER(items, rr->txt.items, last, i);
1730 last = i;
1ccda9b7 1731 }
6a6fc3df
LP		 1732 }
1733
1734 r = 0;
2e276efc 1735 break;
2e276efc 1736
74b2466e 1737 case DNS_TYPE_A:
623a4c97 1738 r = dns_packet_read_blob(p, &rr->a.in_addr, sizeof(struct in_addr), NULL);
74b2466e
LP		 1739 break;
1740
1741 case DNS_TYPE_AAAA:
623a4c97 1742 r = dns_packet_read_blob(p, &rr->aaaa.in6_addr, sizeof(struct in6_addr), NULL);
74b2466e
LP		 1743 break;
1744
7e8e0422 1745 case DNS_TYPE_SOA:
151226ab 1746 r = dns_packet_read_name(p, &rr->soa.mname, true, NULL);
7e8e0422 1747 if (r < 0)
e18a3c73 1748 return r;
7e8e0422 1749
151226ab 1750 r = dns_packet_read_name(p, &rr->soa.rname, true, NULL);
7e8e0422 1751 if (r < 0)
e18a3c73 1752 return r;
7e8e0422
LP		 1753
1754 r = dns_packet_read_uint32(p, &rr->soa.serial, NULL);
1755 if (r < 0)
e18a3c73 1756 return r;
7e8e0422
LP		 1757
1758 r = dns_packet_read_uint32(p, &rr->soa.refresh, NULL);
1759 if (r < 0)
e18a3c73 1760 return r;
7e8e0422
LP		 1761
1762 r = dns_packet_read_uint32(p, &rr->soa.retry, NULL);
1763 if (r < 0)
e18a3c73 1764 return r;
7e8e0422
LP		 1765
1766 r = dns_packet_read_uint32(p, &rr->soa.expire, NULL);
1767 if (r < 0)
e18a3c73 1768 return r;
7e8e0422
LP		 1769
1770 r = dns_packet_read_uint32(p, &rr->soa.minimum, NULL);
1771 break;
1772
623a4c97 1773 case DNS_TYPE_MX:
946c7094
ZJS		 1774 r = dns_packet_read_uint16(p, &rr->mx.priority, NULL);
1775 if (r < 0)
e18a3c73 1776 return r;
946c7094 1777
151226ab 1778 r = dns_packet_read_name(p, &rr->mx.exchange, true, NULL);
946c7094
ZJS		 1779 break;
1780
0dae31d4
ZJS		 1781 case DNS_TYPE_LOC: {
1782 uint8_t t;
1783 size_t pos;
1784
1785 r = dns_packet_read_uint8(p, &t, &pos);
1786 if (r < 0)
e18a3c73 1787 return r;
0dae31d4
ZJS		 1788
1789 if (t == 0) {
1790 rr->loc.version = t;
1791
1792 r = dns_packet_read_uint8(p, &rr->loc.size, NULL);
1793 if (r < 0)
e18a3c73 1794 return r;
0dae31d4 1795
e18a3c73
ZJS		 1796 if (!loc_size_ok(rr->loc.size))
1797 return -EBADMSG;
afbc4f26 1798
0dae31d4
ZJS		 1799 r = dns_packet_read_uint8(p, &rr->loc.horiz_pre, NULL);
1800 if (r < 0)
e18a3c73 1801 return r;
0dae31d4 1802
e18a3c73
ZJS		 1803 if (!loc_size_ok(rr->loc.horiz_pre))
1804 return -EBADMSG;
afbc4f26 1805
0dae31d4
ZJS		 1806 r = dns_packet_read_uint8(p, &rr->loc.vert_pre, NULL);
1807 if (r < 0)
e18a3c73 1808 return r;
0dae31d4 1809
e18a3c73
ZJS		 1810 if (!loc_size_ok(rr->loc.vert_pre))
1811 return -EBADMSG;
afbc4f26 1812
0dae31d4
ZJS		 1813 r = dns_packet_read_uint32(p, &rr->loc.latitude, NULL);
1814 if (r < 0)
e18a3c73 1815 return r;
0dae31d4
ZJS		 1816
1817 r = dns_packet_read_uint32(p, &rr->loc.longitude, NULL);
1818 if (r < 0)
e18a3c73 1819 return r;
0dae31d4
ZJS		 1820
1821 r = dns_packet_read_uint32(p, &rr->loc.altitude, NULL);
1822 if (r < 0)
e18a3c73 1823 return r;
0dae31d4
ZJS		 1824
1825 break;
1826 } else {
1827 dns_packet_rewind(p, pos);
1828 rr->unparseable = true;
afbc4f26 1829 goto unparseable;
0dae31d4
ZJS		 1830 }
1831 }
1832
abf126a3
TG		 1833 case DNS_TYPE_DS:
1834 r = dns_packet_read_uint16(p, &rr->ds.key_tag, NULL);
1835 if (r < 0)
e18a3c73 1836 return r;
abf126a3
TG		 1837
1838 r = dns_packet_read_uint8(p, &rr->ds.algorithm, NULL);
1839 if (r < 0)
e18a3c73 1840 return r;
abf126a3
TG		 1841
1842 r = dns_packet_read_uint8(p, &rr->ds.digest_type, NULL);
1843 if (r < 0)
e18a3c73 1844 return r;
abf126a3 1845
f5430a3e
LP		 1846 r = dns_packet_read_memdup(p, rdlength - 4,
1847 &rr->ds.digest, &rr->ds.digest_size,
1848 NULL);
abf126a3 1849 if (r < 0)
e18a3c73 1850 return r;
abf126a3 1851
e18a3c73 1852 if (rr->ds.digest_size <= 0)
f1d178cc
TG		 1853 /* the accepted size depends on the algorithm, but for now
1854 just ensure that the value is greater than zero */
e18a3c73 1855 return -EBADMSG;
f1d178cc 1856
abf126a3 1857 break;
d75acfb0 1858
623a4c97 1859 case DNS_TYPE_SSHFP:
42cc2eeb
LP		 1860 r = dns_packet_read_uint8(p, &rr->sshfp.algorithm, NULL);
1861 if (r < 0)
e18a3c73 1862 return r;
42cc2eeb
LP		 1863
1864 r = dns_packet_read_uint8(p, &rr->sshfp.fptype, NULL);
1865 if (r < 0)
e18a3c73 1866 return r;
42cc2eeb 1867
f5430a3e 1868 r = dns_packet_read_memdup(p, rdlength - 2,
549c1a25 1869 &rr->sshfp.fingerprint, &rr->sshfp.fingerprint_size,
f5430a3e 1870 NULL);
f1d178cc 1871
e18a3c73 1872 if (rr->sshfp.fingerprint_size <= 0)
f1d178cc
TG		 1873 /* the accepted size depends on the algorithm, but for now
1874 just ensure that the value is greater than zero */
e18a3c73 1875 return -EBADMSG;
f1d178cc 1876
8db0d2f5
ZJS		 1877 break;
1878
f91dc240
LP		 1879 case DNS_TYPE_DNSKEY:
1880 r = dns_packet_read_uint16(p, &rr->dnskey.flags, NULL);
8db0d2f5 1881 if (r < 0)
e18a3c73 1882 return r;
8db0d2f5 1883
f91dc240 1884 r = dns_packet_read_uint8(p, &rr->dnskey.protocol, NULL);
8db0d2f5 1885 if (r < 0)
e18a3c73 1886 return r;
8db0d2f5 1887
8db0d2f5
ZJS		 1888 r = dns_packet_read_uint8(p, &rr->dnskey.algorithm, NULL);
1889 if (r < 0)
e18a3c73 1890 return r;
8db0d2f5 1891
f5430a3e
LP		 1892 r = dns_packet_read_memdup(p, rdlength - 4,
1893 &rr->dnskey.key, &rr->dnskey.key_size,
1894 NULL);
f1d178cc 1895
e18a3c73 1896 if (rr->dnskey.key_size <= 0)
f1d178cc
TG		 1897 /* the accepted size depends on the algorithm, but for now
1898 just ensure that the value is greater than zero */
e18a3c73 1899 return -EBADMSG;
f1d178cc 1900
42cc2eeb
LP		 1901 break;
1902
151226ab
ZJS		 1903 case DNS_TYPE_RRSIG:
1904 r = dns_packet_read_uint16(p, &rr->rrsig.type_covered, NULL);
1905 if (r < 0)
e18a3c73 1906 return r;
151226ab
ZJS		 1907
1908 r = dns_packet_read_uint8(p, &rr->rrsig.algorithm, NULL);
1909 if (r < 0)
e18a3c73 1910 return r;
151226ab
ZJS		 1911
1912 r = dns_packet_read_uint8(p, &rr->rrsig.labels, NULL);
1913 if (r < 0)
e18a3c73 1914 return r;
151226ab
ZJS		 1915
1916 r = dns_packet_read_uint32(p, &rr->rrsig.original_ttl, NULL);
1917 if (r < 0)
e18a3c73 1918 return r;
151226ab
ZJS		 1919
1920 r = dns_packet_read_uint32(p, &rr->rrsig.expiration, NULL);
1921 if (r < 0)
e18a3c73 1922 return r;
151226ab
ZJS		 1923
1924 r = dns_packet_read_uint32(p, &rr->rrsig.inception, NULL);
1925 if (r < 0)
e18a3c73 1926 return r;
151226ab
ZJS		 1927
1928 r = dns_packet_read_uint16(p, &rr->rrsig.key_tag, NULL);
1929 if (r < 0)
e18a3c73 1930 return r;
151226ab
ZJS		 1931
1932 r = dns_packet_read_name(p, &rr->rrsig.signer, false, NULL);
1933 if (r < 0)
e18a3c73 1934 return r;
151226ab 1935
f5430a3e
LP		 1936 r = dns_packet_read_memdup(p, offset + rdlength - p->rindex,
1937 &rr->rrsig.signature, &rr->rrsig.signature_size,
1938 NULL);
f1d178cc 1939
e18a3c73 1940 if (rr->rrsig.signature_size <= 0)
f1d178cc
TG		 1941 /* the accepted size depends on the algorithm, but for now
1942 just ensure that the value is greater than zero */
e18a3c73 1943 return -EBADMSG;
f1d178cc 1944
151226ab
ZJS		 1945 break;
1946
d84e543d
DM		 1947 case DNS_TYPE_NSEC: {
1948
1949 /*
e5abebab 1950 * RFC6762, section 18.14 explictly states mDNS should use name compression.
d84e543d
DM		 1951 * This contradicts RFC3845, section 2.1.1
1952 */
1953
1954 bool allow_compressed = p->protocol == DNS_PROTOCOL_MDNS;
1955
1956 r = dns_packet_read_name(p, &rr->nsec.next_domain_name, allow_compressed, NULL);
50f1e641 1957 if (r < 0)
e18a3c73 1958 return r;
50f1e641 1959
89492aaf 1960 r = dns_packet_read_type_windows(p, &rr->nsec.types, offset + rdlength - p->rindex, NULL);
89492aaf 1961
09eaf68c
TG		 1962 /* We accept empty NSEC bitmaps. The bit indicating the presence of the NSEC record itself
1963 * is redundant and in e.g., RFC4956 this fact is used to define a use for NSEC records
1964 * without the NSEC bit set. */
50f1e641
TG		 1965
1966 break;
d84e543d 1967 }
5d45a880
TG		 1968 case DNS_TYPE_NSEC3: {
1969 uint8_t size;
1970
1971 r = dns_packet_read_uint8(p, &rr->nsec3.algorithm, NULL);
1972 if (r < 0)
e18a3c73 1973 return r;
5d45a880
TG		 1974
1975 r = dns_packet_read_uint8(p, &rr->nsec3.flags, NULL);
1976 if (r < 0)
e18a3c73 1977 return r;
5d45a880
TG		 1978
1979 r = dns_packet_read_uint16(p, &rr->nsec3.iterations, NULL);
1980 if (r < 0)
e18a3c73 1981 return r;
5d45a880 1982
f1d178cc 1983 /* this may be zero */
5d45a880
TG		 1984 r = dns_packet_read_uint8(p, &size, NULL);
1985 if (r < 0)
e18a3c73 1986 return r;
5d45a880 1987
f5430a3e 1988 r = dns_packet_read_memdup(p, size, &rr->nsec3.salt, &rr->nsec3.salt_size, NULL);
5d45a880 1989 if (r < 0)
e18a3c73 1990 return r;
5d45a880 1991
5d45a880
TG		 1992 r = dns_packet_read_uint8(p, &size, NULL);
1993 if (r < 0)
e18a3c73 1994 return r;
5d45a880 1995
e18a3c73
ZJS		 1996 if (size <= 0)
1997 return -EBADMSG;
f1d178cc 1998
e18a3c73
ZJS		 1999 r = dns_packet_read_memdup(p, size,
2000 &rr->nsec3.next_hashed_name, &rr->nsec3.next_hashed_name_size,
2001 NULL);
5d45a880 2002 if (r < 0)
e18a3c73 2003 return r;
5d45a880 2004
6b9308d1 2005 r = dns_packet_read_type_windows(p, &rr->nsec3.types, offset + rdlength - p->rindex, NULL);
5d45a880 2006
0bbd72b2
TG		 2007 /* empty non-terminals can have NSEC3 records, so empty bitmaps are allowed */
2008
5d45a880
TG		 2009 break;
2010 }
d75acfb0 2011
48d45d2b
ZJS		 2012 case DNS_TYPE_TLSA:
2013 r = dns_packet_read_uint8(p, &rr->tlsa.cert_usage, NULL);
2014 if (r < 0)
e18a3c73 2015 return r;
48d45d2b
ZJS		 2016
2017 r = dns_packet_read_uint8(p, &rr->tlsa.selector, NULL);
2018 if (r < 0)
e18a3c73 2019 return r;
48d45d2b
ZJS		 2020
2021 r = dns_packet_read_uint8(p, &rr->tlsa.matching_type, NULL);
2022 if (r < 0)
e18a3c73 2023 return r;
48d45d2b
ZJS		 2024
2025 r = dns_packet_read_memdup(p, rdlength - 3,
2026 &rr->tlsa.data, &rr->tlsa.data_size,
2027 NULL);
e18a3c73
ZJS		 2028
2029 if (rr->tlsa.data_size <= 0)
48d45d2b
ZJS		 2030 /* the accepted size depends on the algorithm, but for now
2031 just ensure that the value is greater than zero */
e18a3c73 2032 return -EBADMSG;
48d45d2b
ZJS		 2033
2034 break;
2035
95052df3
ZJS		 2036 case DNS_TYPE_CAA:
2037 r = dns_packet_read_uint8(p, &rr->caa.flags, NULL);
2038 if (r < 0)
2039 return r;
2040
2041 r = dns_packet_read_string(p, &rr->caa.tag, NULL);
2042 if (r < 0)
2043 return r;
2044
2045 r = dns_packet_read_memdup(p,
2046 rdlength + offset - p->rindex,
2047 &rr->caa.value, &rr->caa.value_size, NULL);
48d45d2b
ZJS		 2048
2049 break;
2050
d75acfb0 2051 case DNS_TYPE_OPT: /* we only care about the header of OPT for now. */
d93a16b8 2052 case DNS_TYPE_OPENPGPKEY:
74b2466e 2053 default:
afbc4f26 2054 unparseable:
a43a068a 2055 r = dns_packet_read_memdup(p, rdlength, &rr->generic.data, &rr->generic.data_size, NULL);
e18a3c73 2056
74b2466e
LP		 2057 break;
2058 }
2059 if (r < 0)
e18a3c73
ZJS		 2060 return r;
2061 if (p->rindex != offset + rdlength)
2062 return -EBADMSG;
74b2466e
LP		 2063
2064 *ret = rr;
2065 rr = NULL;
2066
d2579eec
LP		 2067 if (ret_cache_flush)
2068 *ret_cache_flush = cache_flush;
74b2466e 2069 if (start)
e18a3c73
ZJS		 2070 *start = rewinder.saved_rindex;
2071 CANCEL_REWINDER(rewinder);
74b2466e
LP		 2072
2073 return 0;
74b2466e
LP		 2074}
2075
c3f7000e
LP		 2076static bool opt_is_good(DnsResourceRecord *rr, bool *rfc6975) {
2077 const uint8_t* p;
2078 bool found_dau_dhu_n3u = false;
2079 size_t l;
2080
2081 /* Checks whether the specified OPT RR is well-formed and whether it contains RFC6975 data (which is not OK in
2082 * a reply). */
2083
2084 assert(rr);
2085 assert(rr->key->type == DNS_TYPE_OPT);
2086
2087 /* Check that the version is 0 */
b30bf55d
LP		 2088 if (((rr->ttl >> 16) & UINT32_C(0xFF)) != 0) {
2089 *rfc6975 = false;
2090 return true; /* if it's not version 0, it's OK, but we will ignore the OPT field contents */
2091 }
c3f7000e
LP		 2092
2093 p = rr->opt.data;
a43a068a 2094 l = rr->opt.data_size;
c3f7000e
LP		 2095 while (l > 0) {
2096 uint16_t option_code, option_length;
2097
2098 /* At least four bytes for OPTION-CODE and OPTION-LENGTH are required */
2099 if (l < 4U)
2100 return false;
2101
2102 option_code = unaligned_read_be16(p);
2103 option_length = unaligned_read_be16(p + 2);
2104
2105 if (l < option_length + 4U)
2106 return false;
2107
2108 /* RFC 6975 DAU, DHU or N3U fields found. */
2109 if (IN_SET(option_code, 5, 6, 7))
2110 found_dau_dhu_n3u = true;
2111
2112 p += option_length + 4U;
2113 l -= option_length + 4U;
2114 }
2115
2116 *rfc6975 = found_dau_dhu_n3u;
2117 return true;
2118}
2119
faa133f3
LP		 2120int dns_packet_extract(DnsPacket *p) {
2121 _cleanup_(dns_question_unrefp) DnsQuestion *question = NULL;
2122 _cleanup_(dns_answer_unrefp) DnsAnswer *answer = NULL;
e18a3c73 2123 _cleanup_(rewind_dns_packet) DnsPacketRewinder rewinder = {};
faa133f3 2124 unsigned n, i;
74b2466e
LP		 2125 int r;
2126
a4076574
LP		 2127 if (p->extracted)
2128 return 0;
2129
e18a3c73 2130 INIT_REWINDER(rewinder, p);
322345fd
LP		 2131 dns_packet_rewind(p, DNS_PACKET_HEADER_SIZE);
2132
3cb10d3a 2133 n = DNS_PACKET_QDCOUNT(p);
faa133f3
LP		 2134 if (n > 0) {
2135 question = dns_question_new(n);
e18a3c73
ZJS		 2136 if (!question)
2137 return -ENOMEM;
74b2466e 2138
faa133f3
LP		 2139 for (i = 0; i < n; i++) {
2140 _cleanup_(dns_resource_key_unrefp) DnsResourceKey *key = NULL;
d2579eec 2141 bool cache_flush;
74b2466e 2142
d2579eec 2143 r = dns_packet_read_key(p, &key, &cache_flush, NULL);
faa133f3 2144 if (r < 0)
e18a3c73 2145 return r;
74b2466e 2146
e18a3c73
ZJS		 2147 if (cache_flush)
2148 return -EBADMSG;
d2579eec 2149
e18a3c73
ZJS		 2150 if (!dns_type_is_valid_query(key->type))
2151 return -EBADMSG;
c463eb78 2152
faa133f3
LP		 2153 r = dns_question_add(question, key);
2154 if (r < 0)
e18a3c73 2155 return r;
faa133f3
LP		 2156 }
2157 }
322345fd 2158
faa133f3
LP		 2159 n = DNS_PACKET_RRCOUNT(p);
2160 if (n > 0) {
ebc8a106 2161 _cleanup_(dns_resource_record_unrefp) DnsResourceRecord *previous = NULL;
c3f7000e
LP		 2162 bool bad_opt = false;
2163
faa133f3 2164 answer = dns_answer_new(n);
e18a3c73
ZJS		 2165 if (!answer)
2166 return -ENOMEM;
322345fd 2167
faa133f3
LP		 2168 for (i = 0; i < n; i++) {
2169 _cleanup_(dns_resource_record_unrefp) DnsResourceRecord *rr = NULL;
7429b2eb 2170 bool cache_flush = false;
322345fd 2171
ff7febd5 2172 r = dns_packet_read_rr(p, &rr, &cache_flush, NULL);
faa133f3 2173 if (r < 0)
e18a3c73 2174 return r;
322345fd 2175
f57e3cd5
LP		 2176 /* Try to reduce memory usage a bit */
2177 if (previous)
2178 dns_resource_key_reduce(&rr->key, &previous->key);
2179
d75acfb0 2180 if (rr->key->type == DNS_TYPE_OPT) {
c3f7000e
LP		 2181 bool has_rfc6975;
2182
2183 if (p->opt || bad_opt) {
2184 /* Multiple OPT RRs? if so, let's ignore all, because there's something wrong
2185 * with the server, and if one is valid we wouldn't know which one. */
2186 log_debug("Multiple OPT RRs detected, ignoring all.");
2187 bad_opt = true;
2188 continue;
2189 }
e6b57b37 2190
1c02e7ba 2191 if (!dns_name_is_root(dns_resource_key_name(rr->key))) {
1f133e0d 2192 /* If the OPT RR is not owned by the root domain, then it is bad, let's ignore
c3f7000e
LP		 2193 * it. */
2194 log_debug("OPT RR is not owned by root domain, ignoring.");
2195 bad_opt = true;
2196 continue;
2197 }
2198
2199 if (i < DNS_PACKET_ANCOUNT(p) + DNS_PACKET_NSCOUNT(p)) {
2200 /* OPT RR is in the wrong section? Some Belkin routers do this. This is a hint
2201 * the EDNS implementation is borked, like the Belkin one is, hence ignore
2202 * it. */
2203 log_debug("OPT RR in wrong section, ignoring.");
2204 bad_opt = true;
2205 continue;
ff7febd5
LP		 2206 }
2207
c3f7000e
LP		 2208 if (!opt_is_good(rr, &has_rfc6975)) {
2209 log_debug("Malformed OPT RR, ignoring.");
2210 bad_opt = true;
2211 continue;
2212 }
e6b57b37 2213
b30bf55d
LP		 2214 if (DNS_PACKET_QR(p)) {
2215 /* Additional checks for responses */
2216
2217 if (!DNS_RESOURCE_RECORD_OPT_VERSION_SUPPORTED(rr)) {
2218 /* If this is a reply and we don't know the EDNS version then something
2219 * is weird... */
2220 log_debug("EDNS version newer that our request, bad server.");
2221 return -EBADMSG;
2222 }
2223
2224 if (has_rfc6975) {
2225 /* If the OPT RR contains RFC6975 algorithm data, then this is indication that
2226 * the server just copied the OPT it got from us (which contained that data)
2227 * back into the reply. If so, then it doesn't properly support EDNS, as
2228 * RFC6975 makes it very clear that the algorithm data should only be contained
2229 * in questions, never in replies. Crappy Belkin routers copy the OPT data for
2230 * example, hence let's detect this so that we downgrade early. */
2231 log_debug("OPT RR contained RFC6975 data, ignoring.");
2232 bad_opt = true;
2233 continue;
2234 }
e6b57b37 2235 }
d75acfb0
LP		 2236
2237 p->opt = dns_resource_record_ref(rr);
2238 } else {
105e1512 2239
c3f7000e
LP		 2240 /* According to RFC 4795, section 2.9. only the RRs from the Answer section shall be
2241 * cached. Hence mark only those RRs as cacheable by default, but not the ones from the
2242 * Additional or Authority sections. */
105e1512
LP		 2243
2244 r = dns_answer_add(answer, rr, p->ifindex,
d2579eec
LP		 2245 (i < DNS_PACKET_ANCOUNT(p) ? DNS_ANSWER_CACHEABLE : 0) |
2246 (p->protocol == DNS_PROTOCOL_MDNS && !cache_flush ? DNS_ANSWER_SHARED_OWNER : 0));
d75acfb0 2247 if (r < 0)
e18a3c73 2248 return r;
d75acfb0 2249 }
ebc8a106
LP		 2250
2251 /* Remember this RR, so that we potentically can merge it's ->key object with the next RR. Note
2252 * that we only do this if we actually decided to keep the RR around. */
2253 dns_resource_record_unref(previous);
2254 previous = dns_resource_record_ref(rr);
faa133f3 2255 }
c3f7000e
LP		 2256
2257 if (bad_opt)
2258 p->opt = dns_resource_record_unref(p->opt);
322345fd
LP		 2259 }
2260
faa133f3
LP		 2261 p->question = question;
2262 question = NULL;
322345fd 2263
faa133f3
LP		 2264 p->answer = answer;
2265 answer = NULL;
322345fd 2266
a4076574
LP		 2267 p->extracted = true;
2268
e18a3c73
ZJS		 2269 /* no CANCEL, always rewind */
2270 return 0;
322345fd
LP		 2271}
2272
8af5b883
LP		 2273int dns_packet_is_reply_for(DnsPacket *p, const DnsResourceKey *key) {
2274 int r;
2275
2276 assert(p);
2277 assert(key);
2278
2279 /* Checks if the specified packet is a reply for the specified
2280 * key and the specified key is the only one in the question
2281 * section. */
2282
2283 if (DNS_PACKET_QR(p) != 1)
2284 return 0;
2285
2286 /* Let's unpack the packet, if that hasn't happened yet. */
2287 r = dns_packet_extract(p);
2288 if (r < 0)
2289 return r;
2290
a924f43f
EV		 2291 if (!p->question)
2292 return 0;
2293
8af5b883
LP		 2294 if (p->question->n_keys != 1)
2295 return 0;
2296
2297 return dns_resource_key_equal(p->question->keys[0], key);
2298}
2299
74b2466e
LP		 2300static const char* const dns_rcode_table[_DNS_RCODE_MAX_DEFINED] = {
2301 [DNS_RCODE_SUCCESS] = "SUCCESS",
2302 [DNS_RCODE_FORMERR] = "FORMERR",
2303 [DNS_RCODE_SERVFAIL] = "SERVFAIL",
2304 [DNS_RCODE_NXDOMAIN] = "NXDOMAIN",
2305 [DNS_RCODE_NOTIMP] = "NOTIMP",
2306 [DNS_RCODE_REFUSED] = "REFUSED",
2307 [DNS_RCODE_YXDOMAIN] = "YXDOMAIN",
2308 [DNS_RCODE_YXRRSET] = "YRRSET",
2309 [DNS_RCODE_NXRRSET] = "NXRRSET",
2310 [DNS_RCODE_NOTAUTH] = "NOTAUTH",
2311 [DNS_RCODE_NOTZONE] = "NOTZONE",
2312 [DNS_RCODE_BADVERS] = "BADVERS",
2313 [DNS_RCODE_BADKEY] = "BADKEY",
2314 [DNS_RCODE_BADTIME] = "BADTIME",
2315 [DNS_RCODE_BADMODE] = "BADMODE",
2316 [DNS_RCODE_BADNAME] = "BADNAME",
2317 [DNS_RCODE_BADALG] = "BADALG",
2318 [DNS_RCODE_BADTRUNC] = "BADTRUNC",
6f21e066 2319 [DNS_RCODE_BADCOOKIE] = "BADCOOKIE",
74b2466e
LP		 2320};
2321DEFINE_STRING_TABLE_LOOKUP(dns_rcode, int);
1716f6dc
LP		 2322
2323static const char* const dns_protocol_table[_DNS_PROTOCOL_MAX] = {
2324 [DNS_PROTOCOL_DNS] = "dns",
2325 [DNS_PROTOCOL_MDNS] = "mdns",
2326 [DNS_PROTOCOL_LLMNR] = "llmnr",
2327};
2328DEFINE_STRING_TABLE_LOOKUP(dns_protocol, DnsProtocol);
Unnamed repository; edit this file 'description' to name the repository.