]> git.ipfire.org Git - thirdparty/systemd.git/blame_incremental - src/resolve/resolved-dns-query.c
projects / thirdparty / systemd.git / blame_incremental
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (non-incremental) | history | HEAD
Two follow-ups for recent PRs (#38062)
[thirdparty/systemd.git] / src / resolve / resolved-dns-query.c
... / ...
CommitLineData
1/* SPDX-License-Identifier: LGPL-2.1-or-later */
2
3#include "sd-bus.h"
4#include "sd-varlink.h"
5
6#include "alloc-util.h"
7#include "dns-domain.h"
8#include "dns-type.h"
9#include "event-util.h"
10#include "glyph-util.h"
11#include "log.h"
12#include "resolved-dns-answer.h"
13#include "resolved-dns-packet.h"
14#include "resolved-dns-query.h"
15#include "resolved-dns-question.h"
16#include "resolved-dns-rr.h"
17#include "resolved-dns-scope.h"
18#include "resolved-dns-search-domain.h"
19#include "resolved-dns-synthesize.h"
20#include "resolved-dns-transaction.h"
21#include "resolved-etc-hosts.h"
22#include "resolved-manager.h"
23#include "resolved-timeouts.h"
24#include "set.h"
25#include "string-util.h"
26
27#define QUERIES_MAX 2048
28#define AUXILIARY_QUERIES_MAX 64
29#define CNAME_REDIRECTS_MAX 16
30
31assert_cc(AUXILIARY_QUERIES_MAX < UINT8_MAX);
32assert_cc(CNAME_REDIRECTS_MAX < UINT8_MAX);
33
34static int dns_query_candidate_new(DnsQueryCandidate **ret, DnsQuery *q, DnsScope *s) {
35 DnsQueryCandidate *c;
36
37 assert(ret);
38 assert(q);
39 assert(s);
40
41 c = new(DnsQueryCandidate, 1);
42 if (!c)
43 return -ENOMEM;
44
45 *c = (DnsQueryCandidate) {
46 .n_ref = 1,
47 .query = q,
48 .scope = s,
49 };
50
51 LIST_PREPEND(candidates_by_query, q->candidates, c);
52 LIST_PREPEND(candidates_by_scope, s->query_candidates, c);
53
54 *ret = c;
55 return 0;
56}
57
58static void dns_query_candidate_stop(DnsQueryCandidate *c) {
59 DnsTransaction *t;
60
61 assert(c);
62
63 (void) event_source_disable(c->timeout_event_source);
64
65 /* Detach all the DnsTransactions attached to this query */
66
67 while ((t = set_steal_first(c->transactions))) {
68 set_remove(t->notify_query_candidates, c);
69 set_remove(t->notify_query_candidates_done, c);
70 dns_transaction_gc(t);
71 }
72}
73
74static void dns_query_candidate_abandon(DnsQueryCandidate *c) {
75 DnsTransaction *t;
76
77 assert(c);
78
79 (void) event_source_disable(c->timeout_event_source);
80
81 /* Abandon all the DnsTransactions attached to this query */
82
83 while ((t = set_steal_first(c->transactions))) {
84 t->wait_for_answer = true;
85 set_remove(t->notify_query_candidates, c);
86 set_remove(t->notify_query_candidates_done, c);
87 dns_transaction_gc(t);
88 }
89}
90
91static DnsQueryCandidate* dns_query_candidate_unlink(DnsQueryCandidate *c) {
92 assert(c);
93
94 /* Detach this DnsQueryCandidate from the Query and Scope objects */
95
96 if (c->query) {
97 LIST_REMOVE(candidates_by_query, c->query->candidates, c);
98 c->query = NULL;
99 }
100
101 if (c->scope) {
102 LIST_REMOVE(candidates_by_scope, c->scope->query_candidates, c);
103 c->scope = NULL;
104 }
105
106 return c;
107}
108
109static DnsQueryCandidate* dns_query_candidate_free(DnsQueryCandidate *c) {
110 if (!c)
111 return NULL;
112
113 c->timeout_event_source = sd_event_source_disable_unref(c->timeout_event_source);
114
115 dns_query_candidate_stop(c);
116 dns_query_candidate_unlink(c);
117
118 set_free(c->transactions);
119 dns_search_domain_unref(c->search_domain);
120
121 return mfree(c);
122}
123
124DEFINE_PUBLIC_TRIVIAL_REF_UNREF_FUNC(DnsQueryCandidate, dns_query_candidate, dns_query_candidate_free);
125
126static int dns_query_candidate_next_search_domain(DnsQueryCandidate *c) {
127 DnsSearchDomain *next;
128
129 assert(c);
130
131 if (c->search_domain && c->search_domain->linked)
132 next = c->search_domain->domains_next;
133 else
134 next = dns_scope_get_search_domains(c->scope);
135
136 for (;;) {
137 if (!next) /* We hit the end of the list */
138 return 0;
139
140 if (!next->route_only)
141 break;
142
143 /* Skip over route-only domains */
144 next = next->domains_next;
145 }
146
147 dns_search_domain_unref(c->search_domain);
148 c->search_domain = dns_search_domain_ref(next);
149
150 return 0;
151}
152
153static int dns_query_candidate_add_transaction(
154 DnsQueryCandidate *c,
155 DnsResourceKey *key,
156 DnsPacket *bypass) {
157
158 _cleanup_(dns_transaction_gcp) DnsTransaction *t = NULL;
159 int r;
160
161 assert(c);
162 assert(c->query); /* We shan't add transactions to a candidate that has been detached already */
163
164 if (key) {
165 /* Regular lookup with a resource key */
166 assert(!bypass);
167
168 t = dns_scope_find_transaction(c->scope, key, c->query->flags);
169 if (!t) {
170 r = dns_transaction_new(&t, c->scope, key, NULL, c->query->flags);
171 if (r < 0)
172 return r;
173 } else if (set_contains(c->transactions, t))
174 return 0;
175 } else {
176 /* "Bypass" lookup with a query packet */
177 assert(bypass);
178
179 r = dns_transaction_new(&t, c->scope, NULL, bypass, c->query->flags);
180 if (r < 0)
181 return r;
182 }
183
184 r = set_ensure_allocated(&t->notify_query_candidates_done, NULL);
185 if (r < 0)
186 return r;
187
188 r = set_ensure_put(&t->notify_query_candidates, NULL, c);
189 if (r < 0)
190 return r;
191
192 r = set_ensure_put(&c->transactions, NULL, t);
193 if (r < 0) {
194 (void) set_remove(t->notify_query_candidates, c);
195 return r;
196 }
197
198 TAKE_PTR(t);
199 return 1;
200}
201
202static int dns_query_candidate_go(DnsQueryCandidate *c) {
203 _unused_ _cleanup_(dns_query_candidate_unrefp) DnsQueryCandidate *keep_c = NULL;
204 DnsTransaction *t;
205 int r;
206 unsigned n = 0;
207
208 assert(c);
209
210 /* Let's keep a reference to the query while we're operating */
211 keep_c = dns_query_candidate_ref(c);
212
213 uint64_t generation = c->generation;
214
215 /* Start the transactions that are not started yet */
216 SET_FOREACH(t, c->transactions) {
217 if (t->state != DNS_TRANSACTION_NULL)
218 continue;
219
220 r = dns_transaction_go(t);
221 if (r < 0)
222 return r;
223
224 if (c->generation != generation)
225 /* The transaction has been completed, and dns_transaction_complete() ->
226 * dns_query_candidate_notify() has been already called. Moreover, the query
227 * candidate has been regenerated, and the query should be already restarted.
228 * Let's exit from the loop now. */
229 return 0;
230
231 n++;
232 }
233
234 /* If there was nothing to start, then let's proceed immediately */
235 if (n == 0)
236 dns_query_candidate_notify(c);
237
238 return 0;
239}
240
241static DnsTransactionState dns_query_candidate_state(DnsQueryCandidate *c) {
242 DnsTransactionState state = DNS_TRANSACTION_NO_SERVERS;
243 DnsTransaction *t;
244
245 assert(c);
246
247 if (c->error_code != 0)
248 return DNS_TRANSACTION_ERRNO;
249
250 SET_FOREACH(t, c->transactions)
251
252 switch (t->state) {
253
254 case DNS_TRANSACTION_NULL:
255 /* If there's a NULL transaction pending, then
256 * this means not all transactions where
257 * started yet, and we were called from within
258 * the stackframe that is supposed to start
259 * remaining transactions. In this case,
260 * simply claim the candidate is pending. */
261
262 case DNS_TRANSACTION_PENDING:
263 case DNS_TRANSACTION_VALIDATING:
264 /* If there's one transaction currently in
265 * VALIDATING state, then this means there's
266 * also one in PENDING state, hence we can
267 * return PENDING immediately. */
268 return DNS_TRANSACTION_PENDING;
269
270 case DNS_TRANSACTION_SUCCESS:
271 state = t->state;
272 break;
273
274 default:
275 if (state != DNS_TRANSACTION_SUCCESS)
276 state = t->state;
277 }
278
279 return state;
280}
281
282static int dns_query_candidate_setup_transactions(DnsQueryCandidate *c) {
283 DnsQuestion *question;
284 DnsResourceKey *key;
285 int n = 0, r;
286
287 assert(c);
288 assert(c->query); /* We shan't add transactions to a candidate that has been detached already */
289
290 dns_query_candidate_stop(c);
291
292 c->generation++;
293
294 if (c->query->question_bypass) {
295 /* If this is a bypass query, then pass the original query packet along to the transaction */
296
297 assert(dns_question_size(c->query->question_bypass->question) == 1);
298
299 if (!dns_scope_good_key(c->scope, dns_question_first_key(c->query->question_bypass->question)))
300 return 0;
301
302 r = dns_query_candidate_add_transaction(c, NULL, c->query->question_bypass);
303 if (r < 0)
304 goto fail;
305
306 return 1;
307 }
308
309 question = dns_query_question_for_protocol(c->query, c->scope->protocol);
310
311 /* Create one transaction per question key */
312 DNS_QUESTION_FOREACH(key, question) {
313 _cleanup_(dns_resource_key_unrefp) DnsResourceKey *new_key = NULL;
314 DnsResourceKey *qkey;
315
316 if (c->search_domain) {
317 r = dns_resource_key_new_append_suffix(&new_key, key, c->search_domain->name);
318 if (r < 0)
319 goto fail;
320
321 qkey = new_key;
322 } else
323 qkey = key;
324
325 if (!dns_scope_good_key(c->scope, qkey))
326 continue;
327
328 r = dns_query_candidate_add_transaction(c, qkey, NULL);
329 if (r < 0)
330 goto fail;
331
332 n++;
333 }
334
335 return n;
336
337fail:
338 dns_query_candidate_stop(c);
339 return r;
340}
341
342static void dns_query_accept(DnsQuery *q, DnsQueryCandidate *c);
343
344static int on_candidate_timeout(sd_event_source *s, usec_t usec, void *userdata) {
345 DnsQueryCandidate *c = userdata;
346
347 assert(s);
348 assert(c);
349
350 log_debug("Accepting incomplete query candidate after expedited timeout on partial success.");
351 dns_query_accept(c->query, c);
352
353 return 0;
354}
355
356static bool dns_query_candidate_has_partially_succeeded(DnsQueryCandidate *c) {
357 DnsTransaction *t;
358
359 SET_FOREACH(t, c->transactions)
360 if (t->state == DNS_TRANSACTION_SUCCESS)
361 return true;
362
363 return false;
364}
365
366void dns_query_candidate_notify(DnsQueryCandidate *c) {
367 DnsTransactionState state;
368 int r;
369
370 assert(c);
371
372 if (!c->query) /* This candidate has been abandoned, do nothing. */
373 return;
374
375 state = dns_query_candidate_state(c);
376
377 if (DNS_TRANSACTION_IS_LIVE(state)) {
378 if (dns_query_candidate_has_partially_succeeded(c))
379 (void) event_reset_time_relative(
380 c->query->manager->event,
381 &c->timeout_event_source,
382 CLOCK_BOOTTIME,
383 CANDIDATE_EXPEDITED_TIMEOUT_USEC, /* accuracy= */ 0,
384 on_candidate_timeout, c,
385 /* priority= */ 0, "candidate-timeout",
386 /* force_reset= */ false);
387
388 return;
389 }
390
391 if (state != DNS_TRANSACTION_SUCCESS && c->search_domain) {
392
393 (void) event_source_disable(c->timeout_event_source);
394
395 r = dns_query_candidate_next_search_domain(c);
396 if (r < 0)
397 goto fail;
398
399 if (r > 0) {
400 /* OK, there's another search domain to try, let's do so. */
401
402 r = dns_query_candidate_setup_transactions(c);
403 if (r < 0)
404 goto fail;
405
406 if (r > 0) {
407 /* New transactions have been queued. Start them and wait */
408
409 r = dns_query_candidate_go(c);
410 if (r < 0)
411 goto fail;
412
413 return;
414 }
415 }
416
417 }
418
419 dns_query_ready(c->query);
420 return;
421
422fail:
423 c->error_code = log_warning_errno(r, "Failed to follow search domains: %m");
424 dns_query_ready(c->query);
425}
426
427static void dns_query_stop(DnsQuery *q) {
428 assert(q);
429
430 event_source_disable(q->timeout_event_source);
431
432 LIST_FOREACH(candidates_by_query, c, q->candidates)
433 dns_query_candidate_stop(c);
434}
435
436static void dns_query_abandon(DnsQuery *q) {
437 assert(q);
438
439 /* Thankfully transactions have their own timeouts */
440 event_source_disable(q->timeout_event_source);
441
442 LIST_FOREACH(candidates_by_query, c, q->candidates)
443 dns_query_candidate_abandon(c);
444}
445
446static void dns_query_unlink_candidates(DnsQuery *q) {
447 assert(q);
448
449 while (q->candidates)
450 /* Here we drop *our* references to each of the candidates. If we had the only reference, the
451 * DnsQueryCandidate object will be freed. */
452 dns_query_candidate_unref(dns_query_candidate_unlink(q->candidates));
453}
454
455static void dns_query_reset_answer(DnsQuery *q) {
456 assert(q);
457
458 q->answer = dns_answer_unref(q->answer);
459 q->answer_rcode = 0;
460 q->answer_ede_rcode = _DNS_EDE_RCODE_INVALID;
461 q->answer_ede_msg = mfree(q->answer_ede_msg);
462 q->answer_dnssec_result = _DNSSEC_RESULT_INVALID;
463 q->answer_errno = 0;
464 q->answer_query_flags = 0;
465 q->answer_protocol = _DNS_PROTOCOL_INVALID;
466 q->answer_family = AF_UNSPEC;
467 q->answer_search_domain = dns_search_domain_unref(q->answer_search_domain);
468 q->answer_full_packet = dns_packet_unref(q->answer_full_packet);
469}
470
471DnsQuery *dns_query_free(DnsQuery *q) {
472 if (!q)
473 return NULL;
474
475 q->timeout_event_source = sd_event_source_disable_unref(q->timeout_event_source);
476
477 while (q->auxiliary_queries)
478 dns_query_free(q->auxiliary_queries);
479
480 if (q->auxiliary_for) {
481 assert(q->auxiliary_for->n_auxiliary_queries > 0);
482 q->auxiliary_for->n_auxiliary_queries--;
483 LIST_REMOVE(auxiliary_queries, q->auxiliary_for->auxiliary_queries, q);
484 }
485
486 dns_query_unlink_candidates(q);
487
488 dns_question_unref(q->question_idna);
489 dns_question_unref(q->question_utf8);
490 dns_packet_unref(q->question_bypass);
491 dns_question_unref(q->collected_questions);
492
493 dns_query_reset_answer(q);
494
495 sd_bus_message_unref(q->bus_request);
496 sd_bus_track_unref(q->bus_track);
497
498 if (q->varlink_request) {
499 sd_varlink_set_userdata(q->varlink_request, NULL);
500 sd_varlink_unref(q->varlink_request);
501 }
502
503 if (q->request_packet)
504 hashmap_remove_value(q->stub_listener_extra ?
505 q->stub_listener_extra->queries_by_packet :
506 q->manager->stub_queries_by_packet,
507 q->request_packet,
508 q);
509
510 dns_packet_unref(q->request_packet);
511 dns_answer_unref(q->reply_answer);
512 dns_answer_unref(q->reply_authoritative);
513 dns_answer_unref(q->reply_additional);
514
515 if (q->request_stream) {
516 /* Detach the stream from our query, in case something else keeps a reference to it. */
517 (void) set_remove(q->request_stream->queries, q);
518 q->request_stream = dns_stream_unref(q->request_stream);
519 }
520
521 free(q->request_address_string);
522
523 if (q->manager) {
524 LIST_REMOVE(queries, q->manager->dns_queries, q);
525 q->manager->n_dns_queries--;
526 }
527
528 return mfree(q);
529}
530
531typedef enum RefuseRecordTypeResult {
532 REFUSE_BAD,
533 REFUSE_GOOD,
534 REFUSE_PARTIAL,
535} RefuseRecordTypeResult;
536
537static RefuseRecordTypeResult test_refuse_record_types(Set *refuse_record_types, DnsQuestion *question) {
538 bool has_good = false, has_bad = false;
539 DnsResourceKey *key;
540
541 DNS_QUESTION_FOREACH(key, question)
542 if (set_contains(refuse_record_types, INT_TO_PTR(key->type)))
543 has_bad = true;
544 else
545 has_good = true;
546
547 if (has_bad && !has_good)
548 return REFUSE_BAD;
549 if (!has_bad) {
550 assert(has_good); /* The question should have at least one key. */
551 return REFUSE_GOOD;
552 }
553
554 return REFUSE_PARTIAL;
555}
556
557static int manager_validate_and_mangle_question(Manager *manager, DnsQuestion **question, DnsQuestion **ret_allocated) {
558 int r;
559
560 assert(manager);
561 assert(question);
562 assert(ret_allocated);
563
564 if (dns_question_isempty(*question)) {
565 *ret_allocated = NULL;
566 return 0;
567 }
568
569 if (set_isempty(manager->refuse_record_types)) {
570 *ret_allocated = NULL;
571 return 0; /* No filtering configured. Let's shortcut. */
572 }
573
574 RefuseRecordTypeResult result = test_refuse_record_types(manager->refuse_record_types, *question);
575 if (result == REFUSE_BAD)
576 return -ENOANO; /* All bad, refuse.*/
577 if (result == REFUSE_GOOD) {
578 *ret_allocated = NULL;
579 return 0; /* All good. Not necessary to filter. */
580 }
581
582 assert(result == REFUSE_PARTIAL);
583
584 /* Mangle the question suppressing bad entries, leaving good entries */
585 _cleanup_(dns_question_unrefp) DnsQuestion *new_question = dns_question_new(dns_question_size(*question));
586 if (!new_question)
587 return -ENOMEM;
588
589 DnsQuestionItem *item;
590 DNS_QUESTION_FOREACH_ITEM(item, *question) {
591 if (set_contains(manager->refuse_record_types, INT_TO_PTR(item->key->type)))
592 continue;
593 r = dns_question_add_raw(new_question, item->key, item->flags);
594 if (r < 0)
595 return r;
596 }
597
598 *question = new_question;
599 *ret_allocated = TAKE_PTR(new_question);
600 return 0;
601}
602
603int dns_query_new(
604 Manager *m,
605 DnsQuery **ret,
606 DnsQuestion *question_utf8,
607 DnsQuestion *question_idna,
608 DnsPacket *question_bypass,
609 int ifindex,
610 uint64_t flags) {
611
612 _cleanup_(dns_query_freep) DnsQuery *q = NULL;
613 char key_str[DNS_RESOURCE_KEY_STRING_MAX];
614 DnsResourceKey *key;
615 int r;
616
617 assert(m);
618
619 /* Check for records that is refused and refuse query for the records if matched in configuration */
620 _unused_ _cleanup_(dns_question_unrefp) DnsQuestion *filtered_question_utf8 = NULL;
621 r = manager_validate_and_mangle_question(m, &question_utf8, &filtered_question_utf8);
622 if (r < 0)
623 return r;
624
625 _unused_ _cleanup_(dns_question_unrefp) DnsQuestion *filtered_question_idna = NULL;
626 r = manager_validate_and_mangle_question(m, &question_idna, &filtered_question_idna);
627 if (r < 0)
628 return r;
629
630 if (question_bypass) {
631 /* It's either a "bypass" query, or a regular one, but can't be both. */
632 if (question_utf8 || question_idna)
633 return -EINVAL;
634
635 assert(dns_question_size(question_bypass->question) == 1);
636
637 /* In bypass mode we'll never mangle the question, but only deny or allow. (In bypass mode
638 * there's only going to be one entry in the query, hence there's no point in mangling
639 * questions, i.e. leaving some entries in and removing others.) */
640 if (test_refuse_record_types(m->refuse_record_types, question_bypass->question) != REFUSE_GOOD)
641 return -ENOANO;
642 } else {
643 bool good = false;
644
645 /* This (primarily) checks two things:
646 *
647 * 1. That the question is not empty
648 * 2. That all RR keys in the question objects are for the same domain
649 *
650 * Or in other words, a single DnsQuery object may be used to look up A+AAAA combination for
651 * the same domain name, or SRV+TXT (for DNS-SD services), but not for unrelated lookups. */
652
653 if (dns_question_size(question_utf8) > 0) {
654 r = dns_question_is_valid_for_query(question_utf8);
655 if (r < 0)
656 return r;
657 if (r == 0)
658 return -EINVAL;
659
660 good = true;
661 }
662
663 /* If the IDNA and UTF8 questions are the same, merge their references */
664 r = dns_question_is_equal(question_idna, question_utf8);
665 if (r < 0)
666 return r;
667 if (r > 0)
668 question_idna = question_utf8;
669 else {
670 if (dns_question_size(question_idna) > 0) {
671 r = dns_question_is_valid_for_query(question_idna);
672 if (r < 0)
673 return r;
674 if (r == 0)
675 return -EINVAL;
676
677 good = true;
678 }
679 }
680
681 if (!good) /* don't allow empty queries */
682 return -EINVAL;
683 }
684
685 if (m->n_dns_queries >= QUERIES_MAX)
686 return -EBUSY;
687
688 q = new(DnsQuery, 1);
689 if (!q)
690 return -ENOMEM;
691
692 *q = (DnsQuery) {
693 .question_utf8 = dns_question_ref(question_utf8),
694 .question_idna = dns_question_ref(question_idna),
695 .question_bypass = dns_packet_ref(question_bypass),
696 .ifindex = ifindex,
697 .flags = flags,
698 .answer_ede_rcode = _DNS_EDE_RCODE_INVALID,
699 .answer_dnssec_result = _DNSSEC_RESULT_INVALID,
700 .answer_protocol = _DNS_PROTOCOL_INVALID,
701 .answer_family = AF_UNSPEC,
702 };
703
704 if (question_bypass) {
705 DNS_QUESTION_FOREACH(key, question_bypass->question)
706 log_debug("Looking up bypass packet for %s.",
707 dns_resource_key_to_string(key, key_str, sizeof key_str));
708 } else {
709 /* First dump UTF8 question */
710 DNS_QUESTION_FOREACH(key, question_utf8)
711 log_debug("Looking up RR for %s.",
712 dns_resource_key_to_string(key, key_str, sizeof key_str));
713
714 /* And then dump the IDNA question, but only what hasn't been dumped already through the UTF8 question. */
715 DNS_QUESTION_FOREACH(key, question_idna) {
716 r = dns_question_contains_key(question_utf8, key);
717 if (r < 0)
718 return r;
719 if (r > 0)
720 continue;
721
722 log_debug("Looking up IDNA RR for %s.",
723 dns_resource_key_to_string(key, key_str, sizeof key_str));
724 }
725 }
726
727 LIST_PREPEND(queries, m->dns_queries, q);
728 m->n_dns_queries++;
729 q->manager = m;
730
731 if (ret)
732 *ret = q;
733
734 TAKE_PTR(q);
735 return 0;
736}
737
738int dns_query_make_auxiliary(DnsQuery *q, DnsQuery *auxiliary_for) {
739 assert(q);
740 assert(auxiliary_for);
741
742 /* Ensure that the query is not auxiliary yet, and
743 * nothing else is auxiliary to it either */
744 assert(!q->auxiliary_for);
745 assert(!q->auxiliary_queries);
746
747 /* Ensure that the unit we shall be made auxiliary for isn't
748 * auxiliary itself */
749 assert(!auxiliary_for->auxiliary_for);
750
751 if (auxiliary_for->n_auxiliary_queries >= AUXILIARY_QUERIES_MAX)
752 return -EAGAIN;
753
754 LIST_PREPEND(auxiliary_queries, auxiliary_for->auxiliary_queries, q);
755 q->auxiliary_for = auxiliary_for;
756
757 auxiliary_for->n_auxiliary_queries++;
758 return 0;
759}
760
761void dns_query_complete(DnsQuery *q, DnsTransactionState state) {
762 assert(q);
763 assert(!DNS_TRANSACTION_IS_LIVE(state));
764 assert(DNS_TRANSACTION_IS_LIVE(q->state));
765
766 /* Note that this call might invalidate the query. Callers should hence not attempt to access the
767 * query or transaction after calling this function. */
768
769 q->state = state;
770
771 (void) manager_monitor_send(q->manager, q);
772
773 dns_query_abandon(q);
774 if (q->complete)
775 q->complete(q);
776}
777
778static int on_query_timeout(sd_event_source *s, usec_t usec, void *userdata) {
779 DnsQuery *q = ASSERT_PTR(userdata);
780
781 assert(s);
782
783 dns_query_complete(q, DNS_TRANSACTION_TIMEOUT);
784 return 0;
785}
786
787static int dns_query_add_candidate(DnsQuery *q, DnsScope *s) {
788 _cleanup_(dns_query_candidate_unrefp) DnsQueryCandidate *c = NULL;
789 int r;
790
791 assert(q);
792 assert(s);
793
794 r = dns_query_candidate_new(&c, q, s);
795 if (r < 0)
796 return r;
797
798 /* If this a single-label domain on DNS, we might append a suitable search domain first. */
799 if (!FLAGS_SET(q->flags, SD_RESOLVED_NO_SEARCH) &&
800 dns_scope_name_wants_search_domain(s, dns_question_first_name(q->question_idna))) {
801 /* OK, we want a search domain now. Let's find one for this scope */
802
803 r = dns_query_candidate_next_search_domain(c);
804 if (r < 0)
805 return r;
806 }
807
808 r = dns_query_candidate_setup_transactions(c);
809 if (r < 0)
810 return r;
811
812 TAKE_PTR(c);
813 return 0;
814}
815
816static int dns_query_synthesize_reply(DnsQuery *q, DnsTransactionState *state) {
817 _cleanup_(dns_answer_unrefp) DnsAnswer *answer = NULL;
818 int r;
819
820 assert(q);
821 assert(state);
822
823 /* Tries to synthesize localhost RR replies (and others) where appropriate. Note that this is done *after* the
824 * the normal lookup finished. The data from the network hence takes precedence over the data we
825 * synthesize. (But note that many scopes refuse to resolve certain domain names) */
826
827 if (!IN_SET(*state,
828 DNS_TRANSACTION_RCODE_FAILURE,
829 DNS_TRANSACTION_NO_SERVERS,
830 DNS_TRANSACTION_TIMEOUT,
831 DNS_TRANSACTION_ATTEMPTS_MAX_REACHED,
832 DNS_TRANSACTION_NETWORK_DOWN,
833 DNS_TRANSACTION_NOT_FOUND))
834 return 0;
835
836 if (FLAGS_SET(q->flags, SD_RESOLVED_NO_SYNTHESIZE))
837 return 0;
838
839 r = dns_synthesize_answer(
840 q->manager,
841 q->question_bypass ? q->question_bypass->question : q->question_utf8,
842 q->ifindex,
843 &answer);
844 if (r == -ENXIO) {
845 /* If we get ENXIO this tells us to generate NXDOMAIN unconditionally. */
846
847 dns_query_reset_answer(q);
848 q->answer_rcode = DNS_RCODE_NXDOMAIN;
849 q->answer_protocol = dns_synthesize_protocol(q->flags);
850 q->answer_family = dns_synthesize_family(q->flags);
851 q->answer_query_flags = SD_RESOLVED_AUTHENTICATED|SD_RESOLVED_CONFIDENTIAL|SD_RESOLVED_SYNTHETIC;
852 *state = DNS_TRANSACTION_RCODE_FAILURE;
853
854 log_debug("Found synthetic NXDOMAIN response.");
855
856 return 0;
857 }
858 if (r <= 0)
859 return r;
860
861 dns_query_reset_answer(q);
862
863 q->answer = TAKE_PTR(answer);
864 q->answer_rcode = DNS_RCODE_SUCCESS;
865 q->answer_protocol = dns_synthesize_protocol(q->flags);
866 q->answer_family = dns_synthesize_family(q->flags);
867 q->answer_query_flags = SD_RESOLVED_AUTHENTICATED|SD_RESOLVED_CONFIDENTIAL|SD_RESOLVED_SYNTHETIC;
868
869 *state = DNS_TRANSACTION_SUCCESS;
870
871 log_debug("Found synthetic success response.");
872
873 return 1;
874}
875
876static int dns_query_try_etc_hosts(DnsQuery *q) {
877 _cleanup_(dns_answer_unrefp) DnsAnswer *answer = NULL;
878 int r;
879
880 assert(q);
881
882 /* Looks in /etc/hosts for matching entries. Note that this is done *before* the normal lookup is
883 * done. The data from /etc/hosts hence takes precedence over the network. */
884
885 if (FLAGS_SET(q->flags, SD_RESOLVED_NO_SYNTHESIZE))
886 return 0;
887
888 r = manager_etc_hosts_lookup(
889 q->manager,
890 q->question_bypass ? q->question_bypass->question : q->question_utf8,
891 &answer);
892 if (r <= 0)
893 return r;
894
895 dns_query_reset_answer(q);
896
897 q->answer = TAKE_PTR(answer);
898 q->answer_rcode = DNS_RCODE_SUCCESS;
899 q->answer_protocol = dns_synthesize_protocol(q->flags);
900 q->answer_family = dns_synthesize_family(q->flags);
901 q->answer_query_flags = SD_RESOLVED_AUTHENTICATED|SD_RESOLVED_CONFIDENTIAL|SD_RESOLVED_SYNTHETIC;
902
903 return 1;
904}
905
906int dns_query_go(DnsQuery *q) {
907 DnsScopeMatch found = DNS_SCOPE_NO;
908 DnsScope *first = NULL;
909 int r;
910
911 assert(q);
912
913 if (q->state != DNS_TRANSACTION_NULL)
914 return 0;
915
916 r = dns_query_try_etc_hosts(q);
917 if (r < 0)
918 return r;
919 if (r > 0) {
920 dns_query_complete(q, DNS_TRANSACTION_SUCCESS);
921 return 1;
922 }
923
924 LIST_FOREACH(scopes, s, q->manager->dns_scopes) {
925 DnsScopeMatch match;
926
927 match = dns_scope_good_domain(s, q, q->flags);
928 assert(match >= 0);
929 if (match > found) { /* Does this match better? If so, remember how well it matched, and the first one
930 * that matches this well */
931 found = match;
932 first = s;
933 }
934 }
935
936 if (found == DNS_SCOPE_NO) {
937 DnsTransactionState state = DNS_TRANSACTION_NO_SERVERS;
938
939 r = dns_query_synthesize_reply(q, &state);
940 if (r < 0)
941 return r;
942
943 dns_query_complete(q, state);
944 return 1;
945 }
946
947 r = dns_query_add_candidate(q, first);
948 if (r < 0)
949 goto fail;
950
951 LIST_FOREACH(scopes, s, first->scopes_next) {
952 DnsScopeMatch match;
953
954 match = dns_scope_good_domain(s, q, q->flags);
955 assert(match >= 0);
956 if (match < found)
957 continue;
958
959 r = dns_query_add_candidate(q, s);
960 if (r < 0)
961 goto fail;
962 }
963
964 dns_query_reset_answer(q);
965
966 r = event_reset_time_relative(
967 q->manager->event,
968 &q->timeout_event_source,
969 CLOCK_BOOTTIME,
970 SD_RESOLVED_QUERY_TIMEOUT_USEC,
971 0, on_query_timeout, q,
972 0, "query-timeout", true);
973 if (r < 0)
974 goto fail;
975
976 q->state = DNS_TRANSACTION_PENDING;
977 q->block_ready++;
978
979 /* Start the transactions */
980 LIST_FOREACH(candidates_by_query, c, q->candidates) {
981 r = dns_query_candidate_go(c);
982 if (r < 0) {
983 q->block_ready--;
984 goto fail;
985 }
986 }
987
988 q->block_ready--;
989 dns_query_ready(q);
990
991 return 1;
992
993fail:
994 dns_query_stop(q);
995 return r;
996}
997
998static void dns_query_accept(DnsQuery *q, DnsQueryCandidate *c) {
999 DnsTransactionState state = DNS_TRANSACTION_NO_SERVERS;
1000 bool has_authenticated = false, has_non_authenticated = false, has_confidential = false, has_non_confidential = false;
1001 DnssecResult dnssec_result_authenticated = _DNSSEC_RESULT_INVALID, dnssec_result_non_authenticated = _DNSSEC_RESULT_INVALID;
1002 DnsTransaction *t;
1003 int r;
1004
1005 assert(q);
1006
1007 if (!c) {
1008 r = dns_query_synthesize_reply(q, &state);
1009 if (r < 0)
1010 goto fail;
1011
1012 dns_query_complete(q, state);
1013 return;
1014 }
1015
1016 if (c->error_code != 0) {
1017 /* If the candidate had an error condition of its own, start with that. */
1018 state = DNS_TRANSACTION_ERRNO;
1019 q->answer = dns_answer_unref(q->answer);
1020 q->answer_rcode = 0;
1021 q->answer_dnssec_result = _DNSSEC_RESULT_INVALID;
1022 q->answer_query_flags = 0;
1023 q->answer_errno = c->error_code;
1024 q->answer_full_packet = dns_packet_unref(q->answer_full_packet);
1025 }
1026
1027 SET_FOREACH(t, c->transactions) {
1028
1029 switch (t->state) {
1030
1031 case DNS_TRANSACTION_SUCCESS: {
1032 /* We found a successful reply, merge it into the answer */
1033
1034 if (state == DNS_TRANSACTION_SUCCESS) {
1035 r = dns_answer_extend(&q->answer, t->answer);
1036 if (r < 0)
1037 goto fail;
1038
1039 q->answer_query_flags |= dns_transaction_source_to_query_flags(t->answer_source);
1040 } else {
1041 /* Override non-successful previous answers */
1042 DNS_ANSWER_REPLACE(q->answer, dns_answer_ref(t->answer));
1043 q->answer_query_flags = dns_transaction_source_to_query_flags(t->answer_source);
1044 }
1045
1046 q->answer_rcode = t->answer_rcode;
1047 q->answer_errno = 0;
1048
1049 DNS_PACKET_REPLACE(q->answer_full_packet, dns_packet_ref(t->received));
1050
1051 if (FLAGS_SET(t->answer_query_flags, SD_RESOLVED_AUTHENTICATED)) {
1052 has_authenticated = true;
1053 dnssec_result_authenticated = t->answer_dnssec_result;
1054 } else {
1055 has_non_authenticated = true;
1056 dnssec_result_non_authenticated = t->answer_dnssec_result;
1057 }
1058
1059 if (FLAGS_SET(t->answer_query_flags, SD_RESOLVED_CONFIDENTIAL))
1060 has_confidential = true;
1061 else
1062 has_non_confidential = true;
1063
1064 state = DNS_TRANSACTION_SUCCESS;
1065 break;
1066 }
1067
1068 case DNS_TRANSACTION_NULL:
1069 case DNS_TRANSACTION_PENDING:
1070 case DNS_TRANSACTION_VALIDATING:
1071 case DNS_TRANSACTION_ABORTED:
1072 /* Ignore transactions that didn't complete */
1073 continue;
1074
1075 default:
1076 /* Any kind of failure? Store the data away, if there's nothing stored yet. */
1077 if (state == DNS_TRANSACTION_SUCCESS)
1078 continue;
1079
1080 /* If there's already an authenticated negative reply stored, then prefer that over any unauthenticated one */
1081 if (FLAGS_SET(q->answer_query_flags, SD_RESOLVED_AUTHENTICATED) &&
1082 !FLAGS_SET(t->answer_query_flags, SD_RESOLVED_AUTHENTICATED))
1083 continue;
1084
1085 DNS_ANSWER_REPLACE(q->answer, dns_answer_ref(t->answer));
1086 q->answer_rcode = t->answer_rcode;
1087 q->answer_ede_rcode = t->answer_ede_rcode;
1088 r = free_and_strdup_warn(&q->answer_ede_msg, t->answer_ede_msg);
1089 if (r < 0)
1090 goto fail;
1091 q->answer_dnssec_result = t->answer_dnssec_result;
1092 q->answer_query_flags = t->answer_query_flags | dns_transaction_source_to_query_flags(t->answer_source);
1093 q->answer_errno = t->answer_errno;
1094 DNS_PACKET_REPLACE(q->answer_full_packet, dns_packet_ref(t->received));
1095
1096 state = t->state;
1097 }
1098 }
1099
1100 if (state == DNS_TRANSACTION_SUCCESS) {
1101 SET_FLAG(q->answer_query_flags, SD_RESOLVED_AUTHENTICATED, has_authenticated && !has_non_authenticated);
1102 SET_FLAG(q->answer_query_flags, SD_RESOLVED_CONFIDENTIAL, has_confidential && !has_non_confidential);
1103 q->answer_dnssec_result = FLAGS_SET(q->answer_query_flags, SD_RESOLVED_AUTHENTICATED) ? dnssec_result_authenticated : dnssec_result_non_authenticated;
1104 }
1105
1106 q->answer_protocol = c->scope->protocol;
1107 q->answer_family = c->scope->family;
1108
1109 dns_search_domain_unref(q->answer_search_domain);
1110 q->answer_search_domain = dns_search_domain_ref(c->search_domain);
1111
1112 r = dns_query_synthesize_reply(q, &state);
1113 if (r < 0)
1114 goto fail;
1115
1116 dns_query_complete(q, state);
1117 return;
1118
1119fail:
1120 q->answer_errno = -r;
1121 dns_query_complete(q, DNS_TRANSACTION_ERRNO);
1122}
1123
1124void dns_query_ready(DnsQuery *q) {
1125 DnsQueryCandidate *bad = NULL;
1126 bool pending = false;
1127
1128 assert(q);
1129 assert(DNS_TRANSACTION_IS_LIVE(q->state));
1130
1131 /* Note that this call might invalidate the query. Callers
1132 * should hence not attempt to access the query or transaction
1133 * after calling this function, unless the block_ready
1134 * counter was explicitly bumped before doing so. */
1135
1136 if (q->block_ready > 0)
1137 return;
1138
1139 LIST_FOREACH(candidates_by_query, c, q->candidates) {
1140 DnsTransactionState state;
1141
1142 state = dns_query_candidate_state(c);
1143 switch (state) {
1144
1145 case DNS_TRANSACTION_SUCCESS:
1146 /* One of the candidates is successful,
1147 * let's use it, and copy its data out */
1148 dns_query_accept(q, c);
1149 return;
1150
1151 case DNS_TRANSACTION_NULL:
1152 case DNS_TRANSACTION_PENDING:
1153 case DNS_TRANSACTION_VALIDATING:
1154 /* One of the candidates is still going on,
1155 * let's maybe wait for it */
1156 pending = true;
1157 break;
1158
1159 default:
1160 /* Any kind of failure: save the most recent error, as long as we never saved one
1161 * before or our current one is "conclusive" in the sense that we definitely did a
1162 * lookup, and thus have a real answer (which might be a failure, but is still *some*
1163 * answer). */
1164
1165 if (!bad || !IN_SET(state, DNS_TRANSACTION_NO_SERVERS, DNS_TRANSACTION_NETWORK_DOWN, DNS_TRANSACTION_NO_SOURCE))
1166 bad = c;
1167 break;
1168 }
1169 }
1170
1171 if (pending)
1172 return;
1173
1174 dns_query_accept(q, bad);
1175}
1176
1177static int dns_query_collect_question(DnsQuery *q, DnsQuestion *question) {
1178 _cleanup_(dns_question_unrefp) DnsQuestion *merged = NULL;
1179 int r;
1180
1181 assert(q);
1182
1183 if (dns_question_size(question) == 0)
1184 return 0;
1185
1186 /* When redirecting, save the first element in the chain, for informational purposes when monitoring */
1187 r = dns_question_merge(q->collected_questions, question, &merged);
1188 if (r < 0)
1189 return r;
1190
1191 dns_question_unref(q->collected_questions);
1192 q->collected_questions = TAKE_PTR(merged);
1193
1194 return 0;
1195}
1196
1197static int dns_query_cname_redirect(DnsQuery *q, const DnsResourceRecord *cname) {
1198 _cleanup_(dns_question_unrefp) DnsQuestion *nq_idna = NULL, *nq_utf8 = NULL;
1199 int r, k;
1200
1201 assert(q);
1202
1203 if (q->n_cname_redirects >= CNAME_REDIRECTS_MAX)
1204 return -ELOOP;
1205 q->n_cname_redirects++;
1206
1207 r = dns_question_cname_redirect(q->question_idna, cname, &nq_idna);
1208 if (r < 0)
1209 return r;
1210 if (r > 0)
1211 log_debug("Following CNAME/DNAME %s %s %s.",
1212 dns_question_first_name(q->question_idna),
1213 glyph(GLYPH_ARROW_RIGHT),
1214 dns_question_first_name(nq_idna));
1215
1216 k = dns_question_is_equal(q->question_idna, q->question_utf8);
1217 if (k < 0)
1218 return k;
1219 if (k > 0) {
1220 /* Same question? Shortcut new question generation */
1221 nq_utf8 = dns_question_ref(nq_idna);
1222 k = r;
1223 } else {
1224 k = dns_question_cname_redirect(q->question_utf8, cname, &nq_utf8);
1225 if (k < 0)
1226 return k;
1227 if (k > 0)
1228 log_debug("Following UTF8 CNAME/DNAME %s %s %s.",
1229 dns_question_first_name(q->question_utf8),
1230 glyph(GLYPH_ARROW_RIGHT),
1231 dns_question_first_name(nq_utf8));
1232 }
1233
1234 if (r == 0 && k == 0) /* No actual cname happened? */
1235 return -ELOOP;
1236
1237 if (q->answer_protocol == DNS_PROTOCOL_DNS)
1238 /* Don't permit CNAME redirects from unicast DNS to LLMNR or MulticastDNS, so that global resources
1239 * cannot invade the local namespace. The opposite way we permit: local names may redirect to global
1240 * ones. */
1241 q->flags &= ~(SD_RESOLVED_LLMNR|SD_RESOLVED_MDNS); /* mask away the local protocols */
1242
1243 /* Turn off searching for the new name */
1244 q->flags |= SD_RESOLVED_NO_SEARCH;
1245
1246 r = dns_query_collect_question(q, q->question_idna);
1247 if (r < 0)
1248 return r;
1249 r = dns_query_collect_question(q, q->question_utf8);
1250 if (r < 0)
1251 return r;
1252
1253 /* Install the redirected question */
1254 dns_question_unref(q->question_idna);
1255 q->question_idna = TAKE_PTR(nq_idna);
1256
1257 dns_question_unref(q->question_utf8);
1258 q->question_utf8 = TAKE_PTR(nq_utf8);
1259
1260 dns_query_unlink_candidates(q);
1261
1262 /* Note that we do *not* reset the answer here, because the answer we previously got might already
1263 * include everything we need, let's check that first */
1264
1265 q->state = DNS_TRANSACTION_NULL;
1266
1267 return 0;
1268}
1269
1270int dns_query_process_cname_one(DnsQuery *q) {
1271 _cleanup_(dns_resource_record_unrefp) DnsResourceRecord *cname = NULL;
1272 DnsQuestion *question;
1273 DnsResourceRecord *rr;
1274 bool full_match = true;
1275 DnsResourceKey *k;
1276 int r;
1277
1278 assert(q);
1279
1280 /* Processes a CNAME redirect if there's one. Returns one of three values:
1281 *
1282 * CNAME_QUERY_MATCH → direct RR match, caller should just use the RRs in this answer (and not
1283 * bother with any CNAME/DNAME stuff)
1284 *
1285 * CNAME_QUERY_NOMATCH → no match at all, neither direct nor CNAME/DNAME, caller might decide to
1286 * restart query or take things as NODATA reply.
1287 *
1288 * CNAME_QUERY_CNAME → no direct RR match, but a CNAME/DNAME match that we now followed for one step.
1289 *
1290 * The function might also return a failure, in particular -ELOOP if we encountered too many
1291 * CNAMEs/DNAMEs in a chain or if following CNAMEs/DNAMEs was turned off.
1292 *
1293 * Note that this function doesn't actually restart the query. The caller can decide to do that in
1294 * case of CNAME_QUERY_CNAME, though. */
1295
1296 if (!IN_SET(q->state, DNS_TRANSACTION_SUCCESS, DNS_TRANSACTION_NULL))
1297 return DNS_QUERY_NOMATCH;
1298
1299 question = dns_query_question_for_protocol(q, q->answer_protocol);
1300
1301 /* Small reminder: our question will consist of one or more RR keys that match in name, but not in
1302 * record type. Specifically, when we do an address lookup the question will typically consist of one
1303 * A and one AAAA key lookup for the same domain name. When we get a response from a server we need
1304 * to check if the answer answers all our questions to use it. Note that a response of CNAME/DNAME
1305 * can answer both an A and the AAAA question for us, but an A/AAAA response only the relevant
1306 * type.
1307 *
1308 * Hence we first check of the answers we collected are sufficient to answer all our questions
1309 * directly. If one question wasn't answered we go on, waiting for more replies. However, if there's
1310 * a CNAME/DNAME response we use it, and redirect to it, regardless if it was a response to the A or
1311 * the AAAA query. */
1312
1313 DNS_QUESTION_FOREACH(k, question) {
1314 bool match = false;
1315
1316 DNS_ANSWER_FOREACH(rr, q->answer) {
1317 r = dns_resource_key_match_rr(k, rr, DNS_SEARCH_DOMAIN_NAME(q->answer_search_domain));
1318 if (r < 0)
1319 return r;
1320 if (r > 0) {
1321 match = true; /* Yay, we found an RR that matches the key we are looking for */
1322 break;
1323 }
1324 }
1325
1326 if (!match) {
1327 /* Hmm. :-( there's no response for this key. This doesn't match. */
1328 full_match = false;
1329 break;
1330 }
1331 }
1332
1333 if (full_match)
1334 return DNS_QUERY_MATCH; /* The answer can answer our question in full, no need to follow CNAMEs/DNAMEs */
1335
1336 /* Let's see if there is a CNAME/DNAME to match. This case is simpler: we accept the CNAME/DNAME that
1337 * matches any of our questions. */
1338 DNS_ANSWER_FOREACH(rr, q->answer) {
1339 r = dns_question_matches_cname_or_dname(question, rr, DNS_SEARCH_DOMAIN_NAME(q->answer_search_domain));
1340 if (r < 0)
1341 return r;
1342 if (r > 0 && !cname)
1343 cname = dns_resource_record_ref(rr);
1344 }
1345
1346 if (!cname)
1347 return DNS_QUERY_NOMATCH; /* No match and no CNAME/DNAME to follow */
1348
1349 if (q->flags & SD_RESOLVED_NO_CNAME)
1350 return -ELOOP;
1351
1352 if (!FLAGS_SET(q->answer_query_flags, SD_RESOLVED_AUTHENTICATED))
1353 q->previous_redirect_unauthenticated = true;
1354 if (!FLAGS_SET(q->answer_query_flags, SD_RESOLVED_CONFIDENTIAL))
1355 q->previous_redirect_non_confidential = true;
1356 if (!FLAGS_SET(q->answer_query_flags, SD_RESOLVED_SYNTHETIC))
1357 q->previous_redirect_non_synthetic = true;
1358
1359 /* OK, let's actually follow the CNAME */
1360 r = dns_query_cname_redirect(q, cname);
1361 if (r < 0)
1362 return r;
1363
1364 return DNS_QUERY_CNAME; /* Tell caller that we did a single CNAME/DNAME redirection step */
1365}
1366
1367int dns_query_process_cname_many(DnsQuery *q) {
1368 int r;
1369
1370 assert(q);
1371
1372 /* Follows CNAMEs through the current packet: as long as the current packet can fulfill our
1373 * redirected CNAME queries we keep going, and restart the query once the current packet isn't good
1374 * enough anymore. It's a wrapper around dns_query_process_cname_one() and returns the same values,
1375 * but with extended semantics. Specifically:
1376 *
1377 * DNS_QUERY_MATCH → as above
1378 *
1379 * DNS_QUERY_CNAME → we ran into a CNAME/DNAME redirect that we could not answer from the current
1380 * message, and thus restarted the query to resolve it.
1381 *
1382 * DNS_QUERY_NOMATCH → we reached the end of CNAME/DNAME chain, and there are no direct matches nor a
1383 * CNAME/DNAME match. i.e. this is a NODATA case.
1384 *
1385 * Note that this function will restart the query for the caller if needed, and that's the case
1386 * DNS_QUERY_CNAME is returned.
1387 */
1388
1389 r = dns_query_process_cname_one(q);
1390 if (r != DNS_QUERY_CNAME)
1391 return r; /* The first redirect is special: if it doesn't answer the question that's no
1392 * reason to restart the query, we just accept this as a NODATA answer. */
1393
1394 for (;;) {
1395 r = dns_query_process_cname_one(q);
1396 if (r < 0 || r == DNS_QUERY_MATCH)
1397 return r;
1398 if (r == DNS_QUERY_NOMATCH) {
1399 /* OK, so we followed one or more CNAME/DNAME RR but the existing packet can't answer
1400 * this. Let's restart the query hence, with the new question. Why the different
1401 * handling than the first chain element? Because if the server answers a direct
1402 * question with an empty answer then this is a NODATA response. But if it responds
1403 * with a CNAME chain that ultimately is incomplete (i.e. a non-empty but truncated
1404 * CNAME chain) then we better follow up ourselves and ask for the rest of the
1405 * chain. This is particular relevant since our cache will store CNAME/DNAME
1406 * redirects that we learnt about for lookups of certain DNS types, but later on we
1407 * can reuse this data even for other DNS types, but in that case need to follow up
1408 * with the final lookup of the chain ourselves with the RR type we ourselves are
1409 * interested in. */
1410 r = dns_query_go(q);
1411 if (r < 0)
1412 return r;
1413
1414 return DNS_QUERY_CNAME;
1415 }
1416
1417 /* So we found a CNAME that the existing packet already answers, again via a CNAME, let's
1418 * continue going then. */
1419 assert(r == DNS_QUERY_CNAME);
1420 }
1421}
1422
1423DnsQuestion* dns_query_question_for_protocol(DnsQuery *q, DnsProtocol protocol) {
1424 assert(q);
1425
1426 if (q->question_bypass)
1427 return q->question_bypass->question;
1428
1429 switch (protocol) {
1430
1431 case DNS_PROTOCOL_DNS:
1432 return q->question_idna;
1433
1434 case DNS_PROTOCOL_MDNS:
1435 case DNS_PROTOCOL_LLMNR:
1436 return q->question_utf8;
1437
1438 default:
1439 return NULL;
1440 }
1441}
1442
1443const char* dns_query_string(DnsQuery *q) {
1444 const char *name;
1445 int r;
1446
1447 /* Returns a somewhat useful human-readable lookup key string for this query */
1448
1449 if (q->question_bypass)
1450 return dns_question_first_name(q->question_bypass->question);
1451
1452 if (q->request_address_string)
1453 return q->request_address_string;
1454
1455 if (q->request_address_valid) {
1456 r = in_addr_to_string(q->request_family, &q->request_address, &q->request_address_string);
1457 if (r >= 0)
1458 return q->request_address_string;
1459 }
1460
1461 name = dns_question_first_name(q->question_utf8);
1462 if (name)
1463 return name;
1464
1465 return dns_question_first_name(q->question_idna);
1466}
1467
1468bool dns_query_fully_authenticated(DnsQuery *q) {
1469 assert(q);
1470
1471 return FLAGS_SET(q->answer_query_flags, SD_RESOLVED_AUTHENTICATED) && !q->previous_redirect_unauthenticated;
1472}
1473
1474bool dns_query_fully_confidential(DnsQuery *q) {
1475 assert(q);
1476
1477 return FLAGS_SET(q->answer_query_flags, SD_RESOLVED_CONFIDENTIAL) && !q->previous_redirect_non_confidential;
1478}
1479
1480bool dns_query_fully_authoritative(DnsQuery *q) {
1481 assert(q);
1482
1483 /* We are authoritative for everything synthetic (except if a previous CNAME/DNAME) wasn't
1484 * synthetic. (Note: SD_RESOLVED_SYNTHETIC is reset on each CNAME/DNAME, hence the explicit check for
1485 * previous synthetic DNAME/CNAME redirections.) */
1486 if ((q->answer_query_flags & SD_RESOLVED_SYNTHETIC) && !q->previous_redirect_non_synthetic)
1487 return true;
1488
1489 /* We are also authoritative for everything coming only from the trust anchor and the local
1490 * zones. (Note: the SD_RESOLVED_FROM_xyz flags we merge on each redirect, hence no need to
1491 * explicitly check previous redirects here.) */
1492 return (q->answer_query_flags & SD_RESOLVED_FROM_MASK & ~(SD_RESOLVED_FROM_TRUST_ANCHOR | SD_RESOLVED_FROM_ZONE)) == 0;
1493}
1494
1495int validate_and_mangle_query_flags(
1496 Manager *manager,
1497 uint64_t *flags,
1498 const char *name,
1499 uint64_t ok) {
1500
1501 assert(manager);
1502 assert(flags);
1503
1504 /* Checks that the client supplied interface index and flags parameter actually are valid and make
1505 * sense in our method call context. Specifically:
1506 *
1507 * 1. Checks that the interface index is either 0 (meaning *all* interfaces) or positive
1508 *
1509 * 2. Only the protocols flags and a bunch of NO_XYZ flags are set, at most. Plus additional flags
1510 * specific to our method, passed in the "ok" parameter.
1511 *
1512 * 3. If zero protocol flags are specified it is automatically turned into *all* protocols. This way
1513 * clients can simply pass 0 as flags and all will work as it should. They can also use this so
1514 * that clients don't have to know all the protocols resolved implements, but can just specify 0
1515 * to mean "all supported protocols".
1516 */
1517
1518 if (*flags & ~(SD_RESOLVED_PROTOCOLS_ALL|
1519 SD_RESOLVED_NO_CNAME|
1520 SD_RESOLVED_NO_VALIDATE|
1521 SD_RESOLVED_NO_SYNTHESIZE|
1522 SD_RESOLVED_NO_CACHE|
1523 SD_RESOLVED_NO_ZONE|
1524 SD_RESOLVED_NO_TRUST_ANCHOR|
1525 SD_RESOLVED_NO_NETWORK|
1526 SD_RESOLVED_NO_STALE|
1527 SD_RESOLVED_RELAX_SINGLE_LABEL|
1528 ok))
1529 return -EINVAL;
1530
1531 if ((*flags & SD_RESOLVED_PROTOCOLS_ALL) == 0) /* If no protocol is enabled, enable all */
1532 *flags |= SD_RESOLVED_PROTOCOLS_ALL;
1533
1534 /* Imply SD_RESOLVED_NO_SEARCH if permitted and name is dot suffixed. */
1535 if (name && FLAGS_SET(ok, SD_RESOLVED_NO_SEARCH) && dns_name_dot_suffixed(name) > 0)
1536 *flags |= SD_RESOLVED_NO_SEARCH;
1537
1538 /* If both A and AAAA are refused, set SD_RESOLVED_NO_ADDRESS flag if it is allowed. */
1539 if (set_contains(manager->refuse_record_types, INT_TO_PTR(DNS_TYPE_A)) &&
1540 set_contains(manager->refuse_record_types, INT_TO_PTR(DNS_TYPE_AAAA)) &&
1541 FLAGS_SET(ok, SD_RESOLVED_NO_ADDRESS))
1542 *flags |= SD_RESOLVED_NO_ADDRESS;
1543
1544 /* Similarly, if TXT is refused, set SD_RESOLVED_NO_TXT flag if it is allowed. */
1545 if (set_contains(manager->refuse_record_types, INT_TO_PTR(DNS_TYPE_TXT)) &&
1546 FLAGS_SET(ok, SD_RESOLVED_NO_TXT))
1547 *flags |= SD_RESOLVED_NO_TXT;
1548
1549 return 0;
1550}
1551
1552uint64_t dns_query_reply_flags_make(DnsQuery *q) {
1553 assert(q);
1554
1555 return SD_RESOLVED_FLAGS_MAKE(q->answer_protocol,
1556 q->answer_family,
1557 dns_query_fully_authenticated(q),
1558 dns_query_fully_confidential(q)) |
1559 (q->answer_query_flags & (SD_RESOLVED_FROM_MASK|SD_RESOLVED_SYNTHETIC));
1560}
Unnamed repository; edit this file 'description' to name the repository.