src/resolve/resolved-dns-packet.c

   1 /*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
   2
   3 /***
   4   This file is part of systemd.
   5
   6   Copyright 2014 Lennart Poettering
   7
   8   systemd is free software; you can redistribute it and/or modify it
   9   under the terms of the GNU Lesser General Public License as published by
  10   the Free Software Foundation; either version 2.1 of the License, or
  11   (at your option) any later version.
  12
  13   systemd is distributed in the hope that it will be useful, but
  14   WITHOUT ANY WARRANTY; without even the implied warranty of
  15   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  16   Lesser General Public License for more details.
  17
  18   You should have received a copy of the GNU Lesser General Public License
  19   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  20  ***/
  21
  22 #include "utf8.h"
  23 #include "util.h"
  24 #include "strv.h"
  25 #include "unaligned.h"
  26 #include "dns-domain.h"
  27 #include "resolved-dns-packet.h"
  28
  29 int dns_packet_new(DnsPacket **ret, DnsProtocol protocol, size_t mtu) {
  30         DnsPacket *p;
  31         size_t a;
  32
  33         assert(ret);
  34
  35         if (mtu <= UDP_PACKET_HEADER_SIZE)
  36                 a = DNS_PACKET_SIZE_START;
  37         else
  38                 a = mtu - UDP_PACKET_HEADER_SIZE;
  39
  40         if (a < DNS_PACKET_HEADER_SIZE)
  41                 a = DNS_PACKET_HEADER_SIZE;
  42
  43         /* round up to next page size */
  44         a = PAGE_ALIGN(ALIGN(sizeof(DnsPacket)) + a) - ALIGN(sizeof(DnsPacket));
  45
  46         /* make sure we never allocate more than useful */
  47         if (a > DNS_PACKET_SIZE_MAX)
  48                 a = DNS_PACKET_SIZE_MAX;
  49
  50         p = malloc0(ALIGN(sizeof(DnsPacket)) + a);
  51         if (!p)
  52                 return -ENOMEM;
  53
  54         p->size = p->rindex = DNS_PACKET_HEADER_SIZE;
  55         p->allocated = a;
  56         p->protocol = protocol;
  57         p->n_ref = 1;
  58
  59         *ret = p;
  60
  61         return 0;
  62 }
  63
  64 int dns_packet_new_query(DnsPacket **ret, DnsProtocol protocol, size_t mtu) {
  65         DnsPacket *p;
  66         DnsPacketHeader *h;
  67         int r;
  68
  69         assert(ret);
  70
  71         r = dns_packet_new(&p, protocol, mtu);
  72         if (r < 0)
  73                 return r;
  74
  75         h = DNS_PACKET_HEADER(p);
  76
  77         if (protocol == DNS_PROTOCOL_LLMNR)
  78                 h->flags = htobe16(DNS_PACKET_MAKE_FLAGS(0 /* qr */,
  79                                                          0 /* opcode */,
  80                                                          0 /* c */,
  81                                                          0 /* tc */,
  82                                                          0 /* t */,
  83                                                          0 /* ra */,
  84                                                          0 /* ad */,
  85                                                          0 /* cd */,
  86                                                          0 /* rcode */));
  87         else
  88                 h->flags = htobe16(DNS_PACKET_MAKE_FLAGS(0 /* qr */,
  89                                                          0 /* opcode */,
  90                                                          0 /* aa */,
  91                                                          0 /* tc */,
  92                                                          1 /* rd (ask for recursion) */,
  93                                                          0 /* ra */,
  94                                                          0 /* ad */,
  95                                                          0 /* cd */,
  96                                                          0 /* rcode */));
  97
  98         *ret = p;
  99         return 0;
 100 }
 101
 102 DnsPacket *dns_packet_ref(DnsPacket *p) {
 103
 104         if (!p)
 105                 return NULL;
 106
 107         assert(p->n_ref > 0);
 108         p->n_ref++;
 109         return p;
 110 }
 111
 112 static void dns_packet_free(DnsPacket *p) {
 113         char *s;
 114
 115         assert(p);
 116
 117         dns_question_unref(p->question);
 118         dns_answer_unref(p->answer);
 119
 120         while ((s = hashmap_steal_first_key(p->names)))
 121                 free(s);
 122         hashmap_free(p->names);
 123
 124         free(p->_data);
 125         free(p);
 126 }
 127
 128 DnsPacket *dns_packet_unref(DnsPacket *p) {
 129         if (!p)
 130                 return NULL;
 131
 132         assert(p->n_ref > 0);
 133
 134         if (p->n_ref == 1)
 135                 dns_packet_free(p);
 136         else
 137                 p->n_ref--;
 138
 139         return NULL;
 140 }
 141
 142 int dns_packet_validate(DnsPacket *p) {
 143         assert(p);
 144
 145         if (p->size < DNS_PACKET_HEADER_SIZE)
 146                 return -EBADMSG;
 147
 148         if (p->size > DNS_PACKET_SIZE_MAX)
 149                 return -EBADMSG;
 150
 151         return 1;
 152 }
 153
 154 int dns_packet_validate_reply(DnsPacket *p) {
 155         int r;
 156
 157         assert(p);
 158
 159         r = dns_packet_validate(p);
 160         if (r < 0)
 161                 return r;
 162
 163         if (DNS_PACKET_QR(p) != 1)
 164                 return 0;
 165
 166         if (DNS_PACKET_OPCODE(p) != 0)
 167                 return -EBADMSG;
 168
 169         switch (p->protocol) {
 170         case DNS_PROTOCOL_LLMNR:
 171                 /* RFC 4795, Section 2.1.1. says to discard all replies with QDCOUNT != 1 */
 172                 if (DNS_PACKET_QDCOUNT(p) != 1)
 173                         return -EBADMSG;
 174
 175                 break;
 176
 177         default:
 178                 break;
 179         }
 180
 181         return 1;
 182 }
 183
 184 int dns_packet_validate_query(DnsPacket *p) {
 185         int r;
 186
 187         assert(p);
 188
 189         r = dns_packet_validate(p);
 190         if (r < 0)
 191                 return r;
 192
 193         if (DNS_PACKET_QR(p) != 0)
 194                 return 0;
 195
 196         if (DNS_PACKET_OPCODE(p) != 0)
 197                 return -EBADMSG;
 198
 199         if (DNS_PACKET_TC(p))
 200                 return -EBADMSG;
 201
 202         switch (p->protocol) {
 203         case DNS_PROTOCOL_LLMNR:
 204                 /* RFC 4795, Section 2.1.1. says to discard all queries with QDCOUNT != 1 */
 205                 if (DNS_PACKET_QDCOUNT(p) != 1)
 206                         return -EBADMSG;
 207
 208                 /* RFC 4795, Section 2.1.1. says to discard all queries with ANCOUNT != 0 */
 209                 if (DNS_PACKET_ANCOUNT(p) > 0)
 210                         return -EBADMSG;
 211
 212                 /* RFC 4795, Section 2.1.1. says to discard all queries with NSCOUNT != 0 */
 213                 if (DNS_PACKET_NSCOUNT(p) > 0)
 214                         return -EBADMSG;
 215
 216                 break;
 217
 218         default:
 219                 break;
 220         }
 221
 222         return 1;
 223 }
 224
 225 static int dns_packet_extend(DnsPacket *p, size_t add, void **ret, size_t *start) {
 226         assert(p);
 227
 228         if (p->size + add > p->allocated) {
 229                 size_t a;
 230
 231                 a = PAGE_ALIGN((p->size + add) * 2);
 232                 if (a > DNS_PACKET_SIZE_MAX)
 233                         a = DNS_PACKET_SIZE_MAX;
 234
 235                 if (p->size + add > a)
 236                         return -EMSGSIZE;
 237
 238                 if (p->_data) {
 239                         void *d;
 240
 241                         d = realloc(p->_data, a);
 242                         if (!d)
 243                                 return -ENOMEM;
 244
 245                         p->_data = d;
 246                 } else {
 247                         p->_data = malloc(a);
 248                         if (!p->_data)
 249                                 return -ENOMEM;
 250
 251                         memcpy(p->_data, (uint8_t*) p + ALIGN(sizeof(DnsPacket)), p->size);
 252                         memzero((uint8_t*) p->_data + p->size, a - p->size);
 253                 }
 254
 255                 p->allocated = a;
 256         }
 257
 258         if (start)
 259                 *start = p->size;
 260
 261         if (ret)
 262                 *ret = (uint8_t*) DNS_PACKET_DATA(p) + p->size;
 263
 264         p->size += add;
 265         return 0;
 266 }
 267
 268 static void dns_packet_truncate(DnsPacket *p, size_t sz) {
 269         Iterator i;
 270         char *s;
 271         void *n;
 272
 273         assert(p);
 274
 275         if (p->size <= sz)
 276                 return;
 277
 278         HASHMAP_FOREACH_KEY(s, n, p->names, i) {
 279
 280                 if (PTR_TO_SIZE(n) < sz)
 281                         continue;
 282
 283                 hashmap_remove(p->names, s);
 284                 free(s);
 285         }
 286
 287         p->size = sz;
 288 }
 289
 290 int dns_packet_append_blob(DnsPacket *p, const void *d, size_t l, size_t *start) {
 291         void *q;
 292         int r;
 293
 294         assert(p);
 295
 296         r = dns_packet_extend(p, l, &q, start);
 297         if (r < 0)
 298                 return r;
 299
 300         memcpy(q, d, l);
 301         return 0;
 302 }
 303
 304 int dns_packet_append_uint8(DnsPacket *p, uint8_t v, size_t *start) {
 305         void *d;
 306         int r;
 307
 308         assert(p);
 309
 310         r = dns_packet_extend(p, sizeof(uint8_t), &d, start);
 311         if (r < 0)
 312                 return r;
 313
 314         ((uint8_t*) d)[0] = v;
 315
 316         return 0;
 317 }
 318
 319 int dns_packet_append_uint16(DnsPacket *p, uint16_t v, size_t *start) {
 320         void *d;
 321         int r;
 322
 323         assert(p);
 324
 325         r = dns_packet_extend(p, sizeof(uint16_t), &d, start);
 326         if (r < 0)
 327                 return r;
 328
 329         unaligned_write_be16(d, v);
 330
 331         return 0;
 332 }
 333
 334 int dns_packet_append_uint32(DnsPacket *p, uint32_t v, size_t *start) {
 335         void *d;
 336         int r;
 337
 338         assert(p);
 339
 340         r = dns_packet_extend(p, sizeof(uint32_t), &d, start);
 341         if (r < 0)
 342                 return r;
 343
 344         unaligned_write_be32(d, v);
 345
 346         return 0;
 347 }
 348
 349 int dns_packet_append_string(DnsPacket *p, const char *s, size_t *start) {
 350         void *d;
 351         size_t l;
 352         int r;
 353
 354         assert(p);
 355         assert(s);
 356
 357         l = strlen(s);
 358         if (l > 255)
 359                 return -E2BIG;
 360
 361         r = dns_packet_extend(p, 1 + l, &d, start);
 362         if (r < 0)
 363                 return r;
 364
 365         ((uint8_t*) d)[0] = (uint8_t) l;
 366         memcpy(((uint8_t*) d) + 1, s, l);
 367
 368         return 0;
 369 }
 370
 371 int dns_packet_append_label(DnsPacket *p, const char *d, size_t l, size_t *start) {
 372         void *w;
 373         int r;
 374
 375         assert(p);
 376         assert(d);
 377
 378         if (l > DNS_LABEL_MAX)
 379                 return -E2BIG;
 380
 381         r = dns_packet_extend(p, 1 + l, &w, start);
 382         if (r < 0)
 383                 return r;
 384
 385         ((uint8_t*) w)[0] = (uint8_t) l;
 386         memcpy(((uint8_t*) w) + 1, d, l);
 387
 388         return 0;
 389 }
 390
 391 int dns_packet_append_name(DnsPacket *p, const char *name,
 392                            bool allow_compression, size_t *start) {
 393         size_t saved_size;
 394         int r;
 395
 396         assert(p);
 397         assert(name);
 398
 399         saved_size = p->size;
 400
 401         while (*name) {
 402                 _cleanup_free_ char *s = NULL;
 403                 char label[DNS_LABEL_MAX];
 404                 size_t n = 0;
 405                 int k;
 406
 407                 if (allow_compression)
 408                         n = PTR_TO_SIZE(hashmap_get(p->names, name));
 409                 if (n > 0) {
 410                         assert(n < p->size);
 411
 412                         if (n < 0x4000) {
 413                                 r = dns_packet_append_uint16(p, 0xC000 | n, NULL);
 414                                 if (r < 0)
 415                                         goto fail;
 416
 417                                 goto done;
 418                         }
 419                 }
 420
 421                 s = strdup(name);
 422                 if (!s) {
 423                         r = -ENOMEM;
 424                         goto fail;
 425                 }
 426
 427                 r = dns_label_unescape(&name, label, sizeof(label));
 428                 if (r < 0)
 429                         goto fail;
 430
 431                 if (p->protocol == DNS_PROTOCOL_DNS)
 432                         k = dns_label_apply_idna(label, r, label, sizeof(label));
 433                 else
 434                         k = dns_label_undo_idna(label, r, label, sizeof(label));
 435                 if (k < 0) {
 436                         r = k;
 437                         goto fail;
 438                 }
 439                 if (k > 0)
 440                         r = k;
 441
 442                 r = dns_packet_append_label(p, label, r, &n);
 443                 if (r < 0)
 444                         goto fail;
 445
 446                 if (allow_compression) {
 447                         r = hashmap_ensure_allocated(&p->names, &dns_name_hash_ops);
 448                         if (r < 0)
 449                                 goto fail;
 450
 451                         r = hashmap_put(p->names, s, SIZE_TO_PTR(n));
 452                         if (r < 0)
 453                                 goto fail;
 454
 455                         s = NULL;
 456                 }
 457         }
 458
 459         r = dns_packet_append_uint8(p, 0, NULL);
 460         if (r < 0)
 461                 return r;
 462
 463 done:
 464         if (start)
 465                 *start = saved_size;
 466
 467         return 0;
 468
 469 fail:
 470         dns_packet_truncate(p, saved_size);
 471         return r;
 472 }
 473
 474 int dns_packet_append_key(DnsPacket *p, const DnsResourceKey *k, size_t *start) {
 475         size_t saved_size;
 476         int r;
 477
 478         assert(p);
 479         assert(k);
 480
 481         saved_size = p->size;
 482
 483         r = dns_packet_append_name(p, DNS_RESOURCE_KEY_NAME(k), true, NULL);
 484         if (r < 0)
 485                 goto fail;
 486
 487         r = dns_packet_append_uint16(p, k->type, NULL);
 488         if (r < 0)
 489                 goto fail;
 490
 491         r = dns_packet_append_uint16(p, k->class, NULL);
 492         if (r < 0)
 493                 goto fail;
 494
 495         if (start)
 496                 *start = saved_size;
 497
 498         return 0;
 499
 500 fail:
 501         dns_packet_truncate(p, saved_size);
 502         return r;
 503 }
 504
 505 static int dns_packet_append_type_window(DnsPacket *p, uint8_t window, uint8_t length, uint8_t *types, size_t *start) {
 506         size_t saved_size;
 507         int r;
 508
 509         assert(p);
 510         assert(types);
 511
 512         saved_size = p->size;
 513
 514         if (length != 0) {
 515
 516                 r = dns_packet_append_uint8(p, window, NULL);
 517                 if (r < 0)
 518                         goto fail;
 519
 520                 r = dns_packet_append_uint8(p, length, NULL);
 521                 if (r < 0)
 522                         goto fail;
 523
 524                 r = dns_packet_append_blob(p, types, length, NULL);
 525                 if (r < 0)
 526                         goto fail;
 527         }
 528
 529         if (start)
 530                 *start = saved_size;
 531
 532         return 0;
 533 fail:
 534         dns_packet_truncate(p, saved_size);
 535         return r;
 536 }
 537
 538 static int dns_packet_append_types(DnsPacket *p, Bitmap *types, size_t *start) {
 539         Iterator i;
 540         uint8_t window = 0;
 541         uint8_t len = 0;
 542         uint8_t bitmaps[32] = {};
 543         unsigned n;
 544         size_t saved_size;
 545         int r;
 546
 547         assert(p);
 548         assert(types);
 549
 550         saved_size = p->size;
 551
 552         BITMAP_FOREACH(n, types, i) {
 553                 uint8_t entry;
 554
 555                 assert(n <= 0xffff);
 556
 557                 if ((n << 8) != window) {
 558                         r = dns_packet_append_type_window(p, window, len, bitmaps, NULL);
 559                         if (r < 0)
 560                                 goto fail;
 561
 562                         if (len > 0) {
 563                                 len = 0;
 564                                 zero(bitmaps);
 565                         }
 566                 }
 567
 568                 window = n << 8;
 569                 len ++;
 570
 571                 entry = n & 255;
 572
 573                 bitmaps[entry / 8] |= 1 << (7 - (entry % 8));
 574         }
 575
 576         r = dns_packet_append_type_window(p, window, len, bitmaps, NULL);
 577         if (r < 0)
 578                 goto fail;
 579
 580         if (start)
 581                 *start = saved_size;
 582
 583         return 0;
 584 fail:
 585         dns_packet_truncate(p, saved_size);
 586         return r;
 587 }
 588
 589 int dns_packet_append_rr(DnsPacket *p, const DnsResourceRecord *rr, size_t *start) {
 590         size_t saved_size, rdlength_offset, end, rdlength;
 591         int r;
 592
 593         assert(p);
 594         assert(rr);
 595
 596         saved_size = p->size;
 597
 598         r = dns_packet_append_key(p, rr->key, NULL);
 599         if (r < 0)
 600                 goto fail;
 601
 602         r = dns_packet_append_uint32(p, rr->ttl, NULL);
 603         if (r < 0)
 604                 goto fail;
 605
 606         /* Initially we write 0 here */
 607         r = dns_packet_append_uint16(p, 0, &rdlength_offset);
 608         if (r < 0)
 609                 goto fail;
 610
 611         switch (rr->unparseable ? _DNS_TYPE_INVALID : rr->key->type) {
 612
 613         case DNS_TYPE_SRV:
 614                 r = dns_packet_append_uint16(p, rr->srv.priority, NULL);
 615                 if (r < 0)
 616                         goto fail;
 617
 618                 r = dns_packet_append_uint16(p, rr->srv.weight, NULL);
 619                 if (r < 0)
 620                         goto fail;
 621
 622                 r = dns_packet_append_uint16(p, rr->srv.port, NULL);
 623                 if (r < 0)
 624                         goto fail;
 625
 626                 r = dns_packet_append_name(p, rr->srv.name, true, NULL);
 627                 break;
 628
 629         case DNS_TYPE_PTR:
 630         case DNS_TYPE_NS:
 631         case DNS_TYPE_CNAME:
 632         case DNS_TYPE_DNAME:
 633                 r = dns_packet_append_name(p, rr->ptr.name, true, NULL);
 634                 break;
 635
 636         case DNS_TYPE_HINFO:
 637                 r = dns_packet_append_string(p, rr->hinfo.cpu, NULL);
 638                 if (r < 0)
 639                         goto fail;
 640
 641                 r = dns_packet_append_string(p, rr->hinfo.os, NULL);
 642                 break;
 643
 644         case DNS_TYPE_SPF: /* exactly the same as TXT */
 645         case DNS_TYPE_TXT: {
 646                 char **s;
 647
 648                 if (strv_isempty(rr->txt.strings)) {
 649                         /* RFC 6763, section 6.1 suggests to generate
 650                          * single empty string for an empty array. */
 651
 652                         r = dns_packet_append_string(p, "", NULL);
 653                         if (r < 0)
 654                                 goto fail;
 655                 } else {
 656                         STRV_FOREACH(s, rr->txt.strings) {
 657                                 r = dns_packet_append_string(p, *s, NULL);
 658                                 if (r < 0)
 659                                         goto fail;
 660                         }
 661                 }
 662
 663                 r = 0;
 664                 break;
 665         }
 666
 667         case DNS_TYPE_A:
 668                 r = dns_packet_append_blob(p, &rr->a.in_addr, sizeof(struct in_addr), NULL);
 669                 break;
 670
 671         case DNS_TYPE_AAAA:
 672                 r = dns_packet_append_blob(p, &rr->aaaa.in6_addr, sizeof(struct in6_addr), NULL);
 673                 break;
 674
 675         case DNS_TYPE_SOA:
 676                 r = dns_packet_append_name(p, rr->soa.mname, true, NULL);
 677                 if (r < 0)
 678                         goto fail;
 679
 680                 r = dns_packet_append_name(p, rr->soa.rname, true, NULL);
 681                 if (r < 0)
 682                         goto fail;
 683
 684                 r = dns_packet_append_uint32(p, rr->soa.serial, NULL);
 685                 if (r < 0)
 686                         goto fail;
 687
 688                 r = dns_packet_append_uint32(p, rr->soa.refresh, NULL);
 689                 if (r < 0)
 690                         goto fail;
 691
 692                 r = dns_packet_append_uint32(p, rr->soa.retry, NULL);
 693                 if (r < 0)
 694                         goto fail;
 695
 696                 r = dns_packet_append_uint32(p, rr->soa.expire, NULL);
 697                 if (r < 0)
 698                         goto fail;
 699
 700                 r = dns_packet_append_uint32(p, rr->soa.minimum, NULL);
 701                 break;
 702
 703         case DNS_TYPE_MX:
 704                 r = dns_packet_append_uint16(p, rr->mx.priority, NULL);
 705                 if (r < 0)
 706                         goto fail;
 707
 708                 r = dns_packet_append_name(p, rr->mx.exchange, true, NULL);
 709                 break;
 710
 711         case DNS_TYPE_LOC:
 712                 r = dns_packet_append_uint8(p, rr->loc.version, NULL);
 713                 if (r < 0)
 714                         goto fail;
 715
 716                 r = dns_packet_append_uint8(p, rr->loc.size, NULL);
 717                 if (r < 0)
 718                         goto fail;
 719
 720                 r = dns_packet_append_uint8(p, rr->loc.horiz_pre, NULL);
 721                 if (r < 0)
 722                         goto fail;
 723
 724                 r = dns_packet_append_uint8(p, rr->loc.vert_pre, NULL);
 725                 if (r < 0)
 726                         goto fail;
 727
 728                 r = dns_packet_append_uint32(p, rr->loc.latitude, NULL);
 729                 if (r < 0)
 730                         goto fail;
 731
 732                 r = dns_packet_append_uint32(p, rr->loc.longitude, NULL);
 733                 if (r < 0)
 734                         goto fail;
 735
 736                 r = dns_packet_append_uint32(p, rr->loc.altitude, NULL);
 737                 break;
 738
 739         case DNS_TYPE_DS:
 740                 r = dns_packet_append_uint16(p, rr->ds.key_tag, NULL);
 741                 if (r < 0)
 742                         goto fail;
 743
 744                 r = dns_packet_append_uint8(p, rr->ds.algorithm, NULL);
 745                 if (r < 0)
 746                         goto fail;
 747
 748                 r = dns_packet_append_uint8(p, rr->ds.digest_type, NULL);
 749                 if (r < 0)
 750                         goto fail;
 751
 752                 r = dns_packet_append_blob(p, rr->ds.digest, rr->ds.digest_size, NULL);
 753                 break;
 754
 755         case DNS_TYPE_SSHFP:
 756                 r = dns_packet_append_uint8(p, rr->sshfp.algorithm, NULL);
 757                 if (r < 0)
 758                         goto fail;
 759
 760                 r = dns_packet_append_uint8(p, rr->sshfp.fptype, NULL);
 761                 if (r < 0)
 762                         goto fail;
 763
 764                 r = dns_packet_append_blob(p, rr->sshfp.fingerprint, rr->sshfp.fingerprint_size, NULL);
 765                 break;
 766
 767         case DNS_TYPE_DNSKEY:
 768                 r = dns_packet_append_uint16(p, dnskey_to_flags(rr), NULL);
 769                 if (r < 0)
 770                         goto fail;
 771
 772                 r = dns_packet_append_uint8(p, 3u, NULL);
 773                 if (r < 0)
 774                         goto fail;
 775
 776                 r = dns_packet_append_uint8(p, rr->dnskey.algorithm, NULL);
 777                 if (r < 0)
 778                         goto fail;
 779
 780                 r = dns_packet_append_blob(p, rr->dnskey.key, rr->dnskey.key_size, NULL);
 781                 break;
 782
 783         case DNS_TYPE_RRSIG:
 784                 r = dns_packet_append_uint16(p, rr->rrsig.type_covered, NULL);
 785                 if (r < 0)
 786                         goto fail;
 787
 788                 r = dns_packet_append_uint8(p, rr->rrsig.algorithm, NULL);
 789                 if (r < 0)
 790                         goto fail;
 791
 792                 r = dns_packet_append_uint8(p, rr->rrsig.labels, NULL);
 793                 if (r < 0)
 794                         goto fail;
 795
 796                 r = dns_packet_append_uint32(p, rr->rrsig.original_ttl, NULL);
 797                 if (r < 0)
 798                         goto fail;
 799
 800                 r = dns_packet_append_uint32(p, rr->rrsig.expiration, NULL);
 801                 if (r < 0)
 802                         goto fail;
 803
 804                 r = dns_packet_append_uint32(p, rr->rrsig.inception, NULL);
 805                 if (r < 0)
 806                         goto fail;
 807
 808                 r = dns_packet_append_uint16(p, rr->rrsig.key_tag, NULL);
 809                 if (r < 0)
 810                         goto fail;
 811
 812                 r = dns_packet_append_name(p, rr->rrsig.signer, false, NULL);
 813                 if (r < 0)
 814                         goto fail;
 815
 816                 r = dns_packet_append_blob(p, rr->rrsig.signature, rr->rrsig.signature_size, NULL);
 817                 break;
 818
 819         case DNS_TYPE_NSEC:
 820                 r = dns_packet_append_name(p, rr->nsec.next_domain_name, false, NULL);
 821                 if (r < 0)
 822                         goto fail;
 823
 824                 r = dns_packet_append_types(p, rr->nsec.types, NULL);
 825                 if (r < 0)
 826                         goto fail;
 827
 828                 break;
 829         case DNS_TYPE_NSEC3:
 830                 r = dns_packet_append_uint8(p, rr->nsec3.algorithm, NULL);
 831                 if (r < 0)
 832                         goto fail;
 833
 834                 r = dns_packet_append_uint8(p, rr->nsec3.flags, NULL);
 835                 if (r < 0)
 836                         goto fail;
 837
 838                 r = dns_packet_append_uint16(p, rr->nsec3.iterations, NULL);
 839                 if (r < 0)
 840                         goto fail;
 841
 842                 r = dns_packet_append_uint8(p, rr->nsec3.salt_size, NULL);
 843                 if (r < 0)
 844                         goto fail;
 845
 846                 r = dns_packet_append_blob(p, rr->nsec3.salt, rr->nsec3.salt_size, NULL);
 847                 if (r < 0)
 848                         goto fail;
 849
 850                 r = dns_packet_append_uint8(p, rr->nsec3.next_hashed_name_size, NULL);
 851                 if (r < 0)
 852                         goto fail;
 853
 854                 r = dns_packet_append_blob(p, rr->nsec3.next_hashed_name, rr->nsec3.next_hashed_name_size, NULL);
 855                 if (r < 0)
 856                         goto fail;
 857
 858                 r = dns_packet_append_types(p, rr->nsec3.types, NULL);
 859                 if (r < 0)
 860                         goto fail;
 861
 862                 break;
 863         case _DNS_TYPE_INVALID: /* unparseable */
 864         default:
 865
 866                 r = dns_packet_append_blob(p, rr->generic.data, rr->generic.size, NULL);
 867                 break;
 868         }
 869         if (r < 0)
 870                 goto fail;
 871
 872         /* Let's calculate the actual data size and update the field */
 873         rdlength = p->size - rdlength_offset - sizeof(uint16_t);
 874         if (rdlength > 0xFFFF) {
 875                 r = ENOSPC;
 876                 goto fail;
 877         }
 878
 879         end = p->size;
 880         p->size = rdlength_offset;
 881         r = dns_packet_append_uint16(p, rdlength, NULL);
 882         if (r < 0)
 883                 goto fail;
 884         p->size = end;
 885
 886         if (start)
 887                 *start = saved_size;
 888
 889         return 0;
 890
 891 fail:
 892         dns_packet_truncate(p, saved_size);
 893         return r;
 894 }
 895
 896
 897 int dns_packet_read(DnsPacket *p, size_t sz, const void **ret, size_t *start) {
 898         assert(p);
 899
 900         if (p->rindex + sz > p->size)
 901                 return -EMSGSIZE;
 902
 903         if (ret)
 904                 *ret = (uint8_t*) DNS_PACKET_DATA(p) + p->rindex;
 905
 906         if (start)
 907                 *start = p->rindex;
 908
 909         p->rindex += sz;
 910         return 0;
 911 }
 912
 913 void dns_packet_rewind(DnsPacket *p, size_t idx) {
 914         assert(p);
 915         assert(idx <= p->size);
 916         assert(idx >= DNS_PACKET_HEADER_SIZE);
 917
 918         p->rindex = idx;
 919 }
 920
 921 int dns_packet_read_blob(DnsPacket *p, void *d, size_t sz, size_t *start) {
 922         const void *q;
 923         int r;
 924
 925         assert(p);
 926         assert(d);
 927
 928         r = dns_packet_read(p, sz, &q, start);
 929         if (r < 0)
 930                 return r;
 931
 932         memcpy(d, q, sz);
 933         return 0;
 934 }
 935
 936 static int dns_packet_read_memdup(
 937                 DnsPacket *p, size_t size,
 938                 void **ret, size_t *ret_size,
 939                 size_t *ret_start) {
 940
 941         const void *src;
 942         size_t start;
 943         int r;
 944
 945         assert(p);
 946         assert(ret);
 947
 948         r = dns_packet_read(p, size, &src, &start);
 949         if (r < 0)
 950                 return r;
 951
 952         if (size <= 0)
 953                 *ret = NULL;
 954         else {
 955                 void *copy;
 956
 957                 copy = memdup(src, size);
 958                 if (!copy)
 959                         return -ENOMEM;
 960
 961                 *ret = copy;
 962         }
 963
 964         if (ret_size)
 965                 *ret_size = size;
 966         if (ret_start)
 967                 *ret_start = start;
 968
 969         return 0;
 970 }
 971
 972 int dns_packet_read_uint8(DnsPacket *p, uint8_t *ret, size_t *start) {
 973         const void *d;
 974         int r;
 975
 976         assert(p);
 977
 978         r = dns_packet_read(p, sizeof(uint8_t), &d, start);
 979         if (r < 0)
 980                 return r;
 981
 982         *ret = ((uint8_t*) d)[0];
 983         return 0;
 984 }
 985
 986 int dns_packet_read_uint16(DnsPacket *p, uint16_t *ret, size_t *start) {
 987         const void *d;
 988         int r;
 989
 990         assert(p);
 991
 992         r = dns_packet_read(p, sizeof(uint16_t), &d, start);
 993         if (r < 0)
 994                 return r;
 995
 996         *ret = unaligned_read_be16(d);
 997
 998         return 0;
 999 }
1000
1001 int dns_packet_read_uint32(DnsPacket *p, uint32_t *ret, size_t *start) {
1002         const void *d;
1003         int r;
1004
1005         assert(p);
1006
1007         r = dns_packet_read(p, sizeof(uint32_t), &d, start);
1008         if (r < 0)
1009                 return r;
1010
1011         *ret = unaligned_read_be32(d);
1012
1013         return 0;
1014 }
1015
1016 int dns_packet_read_string(DnsPacket *p, char **ret, size_t *start) {
1017         size_t saved_rindex;
1018         const void *d;
1019         char *t;
1020         uint8_t c;
1021         int r;
1022
1023         assert(p);
1024
1025         saved_rindex = p->rindex;
1026
1027         r = dns_packet_read_uint8(p, &c, NULL);
1028         if (r < 0)
1029                 goto fail;
1030
1031         r = dns_packet_read(p, c, &d, NULL);
1032         if (r < 0)
1033                 goto fail;
1034
1035         if (memchr(d, 0, c)) {
1036                 r = -EBADMSG;
1037                 goto fail;
1038         }
1039
1040         t = strndup(d, c);
1041         if (!t) {
1042                 r = -ENOMEM;
1043                 goto fail;
1044         }
1045
1046         if (!utf8_is_valid(t)) {
1047                 free(t);
1048                 r = -EBADMSG;
1049                 goto fail;
1050         }
1051
1052         *ret = t;
1053
1054         if (start)
1055                 *start = saved_rindex;
1056
1057         return 0;
1058
1059 fail:
1060         dns_packet_rewind(p, saved_rindex);
1061         return r;
1062 }
1063
1064 int dns_packet_read_name(DnsPacket *p, char **_ret,
1065                          bool allow_compression, size_t *start) {
1066         size_t saved_rindex, after_rindex = 0, jump_barrier;
1067         _cleanup_free_ char *ret = NULL;
1068         size_t n = 0, allocated = 0;
1069         bool first = true;
1070         int r;
1071
1072         assert(p);
1073         assert(_ret);
1074
1075         saved_rindex = p->rindex;
1076         jump_barrier = p->rindex;
1077
1078         for (;;) {
1079                 uint8_t c, d;
1080
1081                 r = dns_packet_read_uint8(p, &c, NULL);
1082                 if (r < 0)
1083                         goto fail;
1084
1085                 if (c == 0)
1086                         /* End of name */
1087                         break;
1088                 else if (c <= 63) {
1089                         _cleanup_free_ char *t = NULL;
1090                         const char *label;
1091
1092                         /* Literal label */
1093                         r = dns_packet_read(p, c, (const void**) &label, NULL);
1094                         if (r < 0)
1095                                 goto fail;
1096
1097                         r = dns_label_escape(label, c, &t);
1098                         if (r < 0)
1099                                 goto fail;
1100
1101                         if (!GREEDY_REALLOC(ret, allocated, n + !first + strlen(t) + 1)) {
1102                                 r = -ENOMEM;
1103                                 goto fail;
1104                         }
1105
1106                         if (!first)
1107                                 ret[n++] = '.';
1108                         else
1109                                 first = false;
1110
1111                         memcpy(ret + n, t, r);
1112                         n += r;
1113                         continue;
1114                 } else if (allow_compression && (c & 0xc0) == 0xc0) {
1115                         uint16_t ptr;
1116
1117                         /* Pointer */
1118                         r = dns_packet_read_uint8(p, &d, NULL);
1119                         if (r < 0)
1120                                 goto fail;
1121
1122                         ptr = (uint16_t) (c & ~0xc0) << 8 | (uint16_t) d;
1123                         if (ptr < DNS_PACKET_HEADER_SIZE || ptr >= jump_barrier) {
1124                                 r = -EBADMSG;
1125                                 goto fail;
1126                         }
1127
1128                         if (after_rindex == 0)
1129                                 after_rindex = p->rindex;
1130
1131                         /* Jumps are limited to a "prior occurrence" (RFC-1035 4.1.4) */
1132                         jump_barrier = ptr;
1133                         p->rindex = ptr;
1134                 } else {
1135                         r = -EBADMSG;
1136                         goto fail;
1137                 }
1138         }
1139
1140         if (!GREEDY_REALLOC(ret, allocated, n + 1)) {
1141                 r = -ENOMEM;
1142                 goto fail;
1143         }
1144
1145         ret[n] = 0;
1146
1147         if (after_rindex != 0)
1148                 p->rindex= after_rindex;
1149
1150         *_ret = ret;
1151         ret = NULL;
1152
1153         if (start)
1154                 *start = saved_rindex;
1155
1156         return 0;
1157
1158 fail:
1159         dns_packet_rewind(p, saved_rindex);
1160         return r;
1161 }
1162
1163 static int dns_packet_read_type_window(DnsPacket *p, Bitmap **types, size_t *start) {
1164         uint8_t window;
1165         uint8_t length;
1166         const uint8_t *bitmap;
1167         unsigned i;
1168         bool found = false;
1169         size_t saved_rindex;
1170         int r;
1171
1172         assert(p);
1173         assert(types);
1174
1175         saved_rindex = p->rindex;
1176
1177         r = bitmap_ensure_allocated(types);
1178         if (r < 0)
1179                 goto fail;
1180
1181         r = dns_packet_read_uint8(p, &window, NULL);
1182         if (r < 0)
1183                 goto fail;
1184
1185         r = dns_packet_read_uint8(p, &length, NULL);
1186         if (r < 0)
1187                 goto fail;
1188
1189         if (length == 0 || length > 32)
1190                 return -EBADMSG;
1191
1192         r = dns_packet_read(p, length, (const void **)&bitmap, NULL);
1193         if (r < 0)
1194                 goto fail;
1195
1196         for (i = 0; i < length; i++) {
1197                 uint8_t bitmask = 1 << 7;
1198                 uint8_t bit = 0;
1199
1200                 if (!bitmap[i]) {
1201                         found = false;
1202                         continue;
1203                 }
1204
1205                 found = true;
1206
1207                 while (bitmask) {
1208                         if (bitmap[i] & bitmask) {
1209                                 uint16_t n;
1210
1211                                 /* XXX: ignore pseudo-types? see RFC4034 section 4.1.2 */
1212                                 n = (uint16_t) window << 8 | (uint16_t) bit;
1213
1214                                 r = bitmap_set(*types, n);
1215                                 if (r < 0)
1216                                         goto fail;
1217                         }
1218
1219                         bit ++;
1220                         bitmask >>= 1;
1221                 }
1222         }
1223
1224         if (!found)
1225                 return -EBADMSG;
1226
1227         if (start)
1228                 *start = saved_rindex;
1229
1230         return 0;
1231 fail:
1232         dns_packet_rewind(p, saved_rindex);
1233         return r;
1234 }
1235
1236 static int dns_packet_read_type_windows(DnsPacket *p, Bitmap **types, size_t size, size_t *start) {
1237         size_t saved_rindex;
1238         int r;
1239
1240         saved_rindex = p->rindex;
1241
1242         while (p->rindex < saved_rindex + size) {
1243                 r = dns_packet_read_type_window(p, types, NULL);
1244                 if (r < 0)
1245                         goto fail;
1246
1247                 /* don't read past end of current RR */
1248                 if (p->rindex > saved_rindex + size) {
1249                         r = -EBADMSG;
1250                         goto fail;
1251                 }
1252         }
1253
1254         if (p->rindex != saved_rindex + size) {
1255                 r = -EBADMSG;
1256                 goto fail;
1257         }
1258
1259         if (start)
1260                 *start = saved_rindex;
1261
1262         return 0;
1263 fail:
1264         dns_packet_rewind(p, saved_rindex);
1265         return r;
1266 }
1267
1268 int dns_packet_read_key(DnsPacket *p, DnsResourceKey **ret, size_t *start) {
1269         _cleanup_free_ char *name = NULL;
1270         uint16_t class, type;
1271         DnsResourceKey *key;
1272         size_t saved_rindex;
1273         int r;
1274
1275         assert(p);
1276         assert(ret);
1277
1278         saved_rindex = p->rindex;
1279
1280         r = dns_packet_read_name(p, &name, true, NULL);
1281         if (r < 0)
1282                 goto fail;
1283
1284         r = dns_packet_read_uint16(p, &type, NULL);
1285         if (r < 0)
1286                 goto fail;
1287
1288         r = dns_packet_read_uint16(p, &class, NULL);
1289         if (r < 0)
1290                 goto fail;
1291
1292         key = dns_resource_key_new_consume(class, type, name);
1293         if (!key) {
1294                 r = -ENOMEM;
1295                 goto fail;
1296         }
1297
1298         name = NULL;
1299         *ret = key;
1300
1301         if (start)
1302                 *start = saved_rindex;
1303
1304         return 0;
1305 fail:
1306         dns_packet_rewind(p, saved_rindex);
1307         return r;
1308 }
1309
1310 static bool loc_size_ok(uint8_t size) {
1311         uint8_t m = size >> 4, e = size & 0xF;
1312
1313         return m <= 9 && e <= 9 && (m > 0 || e == 0);
1314 }
1315
1316 static int dnskey_parse_flags(DnsResourceRecord *rr, uint16_t flags) {
1317         assert(rr);
1318
1319         if (flags & ~(DNSKEY_FLAG_SEP | DNSKEY_FLAG_ZONE_KEY))
1320                 return -EBADMSG;
1321
1322         rr->dnskey.zone_key_flag = flags & DNSKEY_FLAG_ZONE_KEY;
1323         rr->dnskey.sep_flag = flags & DNSKEY_FLAG_SEP;
1324         return 0;
1325 }
1326
1327 int dns_packet_read_rr(DnsPacket *p, DnsResourceRecord **ret, size_t *start) {
1328         _cleanup_(dns_resource_record_unrefp) DnsResourceRecord *rr = NULL;
1329         _cleanup_(dns_resource_key_unrefp) DnsResourceKey *key = NULL;
1330         size_t saved_rindex, offset;
1331         uint16_t rdlength;
1332         int r;
1333
1334         assert(p);
1335         assert(ret);
1336
1337         saved_rindex = p->rindex;
1338
1339         r = dns_packet_read_key(p, &key, NULL);
1340         if (r < 0)
1341                 goto fail;
1342
1343         if (key->class == DNS_CLASS_ANY ||
1344             key->type == DNS_TYPE_ANY) {
1345                 r = -EBADMSG;
1346                 goto fail;
1347         }
1348
1349         rr = dns_resource_record_new(key);
1350         if (!rr) {
1351                 r = -ENOMEM;
1352                 goto fail;
1353         }
1354
1355         r = dns_packet_read_uint32(p, &rr->ttl, NULL);
1356         if (r < 0)
1357                 goto fail;
1358
1359         r = dns_packet_read_uint16(p, &rdlength, NULL);
1360         if (r < 0)
1361                 goto fail;
1362
1363         if (p->rindex + rdlength > p->size) {
1364                 r = -EBADMSG;
1365                 goto fail;
1366         }
1367
1368         offset = p->rindex;
1369
1370         switch (rr->key->type) {
1371
1372         case DNS_TYPE_SRV:
1373                 r = dns_packet_read_uint16(p, &rr->srv.priority, NULL);
1374                 if (r < 0)
1375                         goto fail;
1376                 r = dns_packet_read_uint16(p, &rr->srv.weight, NULL);
1377                 if (r < 0)
1378                         goto fail;
1379                 r = dns_packet_read_uint16(p, &rr->srv.port, NULL);
1380                 if (r < 0)
1381                         goto fail;
1382                 r = dns_packet_read_name(p, &rr->srv.name, true, NULL);
1383                 break;
1384
1385         case DNS_TYPE_PTR:
1386         case DNS_TYPE_NS:
1387         case DNS_TYPE_CNAME:
1388         case DNS_TYPE_DNAME:
1389                 r = dns_packet_read_name(p, &rr->ptr.name, true, NULL);
1390                 break;
1391
1392         case DNS_TYPE_HINFO:
1393                 r = dns_packet_read_string(p, &rr->hinfo.cpu, NULL);
1394                 if (r < 0)
1395                         goto fail;
1396
1397                 r = dns_packet_read_string(p, &rr->hinfo.os, NULL);
1398                 break;
1399
1400         case DNS_TYPE_SPF: /* exactly the same as TXT */
1401         case DNS_TYPE_TXT:
1402                 if (rdlength <= 0) {
1403                         /* RFC 6763, section 6.1 suggests to treat
1404                          * empty TXT RRs as equivalent to a TXT record
1405                          * with a single empty string. */
1406
1407                         r = strv_extend(&rr->txt.strings, "");
1408                         if (r < 0)
1409                                 goto fail;
1410                 } else {
1411                         while (p->rindex < offset + rdlength) {
1412                                 char *s;
1413
1414                                 r = dns_packet_read_string(p, &s, NULL);
1415                                 if (r < 0)
1416                                         goto fail;
1417
1418                                 r = strv_consume(&rr->txt.strings, s);
1419                                 if (r < 0)
1420                                         goto fail;
1421                         }
1422                 }
1423
1424                 r = 0;
1425                 break;
1426
1427         case DNS_TYPE_A:
1428                 r = dns_packet_read_blob(p, &rr->a.in_addr, sizeof(struct in_addr), NULL);
1429                 break;
1430
1431         case DNS_TYPE_AAAA:
1432                 r = dns_packet_read_blob(p, &rr->aaaa.in6_addr, sizeof(struct in6_addr), NULL);
1433                 break;
1434
1435         case DNS_TYPE_SOA:
1436                 r = dns_packet_read_name(p, &rr->soa.mname, true, NULL);
1437                 if (r < 0)
1438                         goto fail;
1439
1440                 r = dns_packet_read_name(p, &rr->soa.rname, true, NULL);
1441                 if (r < 0)
1442                         goto fail;
1443
1444                 r = dns_packet_read_uint32(p, &rr->soa.serial, NULL);
1445                 if (r < 0)
1446                         goto fail;
1447
1448                 r = dns_packet_read_uint32(p, &rr->soa.refresh, NULL);
1449                 if (r < 0)
1450                         goto fail;
1451
1452                 r = dns_packet_read_uint32(p, &rr->soa.retry, NULL);
1453                 if (r < 0)
1454                         goto fail;
1455
1456                 r = dns_packet_read_uint32(p, &rr->soa.expire, NULL);
1457                 if (r < 0)
1458                         goto fail;
1459
1460                 r = dns_packet_read_uint32(p, &rr->soa.minimum, NULL);
1461                 break;
1462
1463         case DNS_TYPE_MX:
1464                 r = dns_packet_read_uint16(p, &rr->mx.priority, NULL);
1465                 if (r < 0)
1466                         goto fail;
1467
1468                 r = dns_packet_read_name(p, &rr->mx.exchange, true, NULL);
1469                 break;
1470
1471         case DNS_TYPE_LOC: {
1472                 uint8_t t;
1473                 size_t pos;
1474
1475                 r = dns_packet_read_uint8(p, &t, &pos);
1476                 if (r < 0)
1477                         goto fail;
1478
1479                 if (t == 0) {
1480                         rr->loc.version = t;
1481
1482                         r = dns_packet_read_uint8(p, &rr->loc.size, NULL);
1483                         if (r < 0)
1484                                 goto fail;
1485
1486                         if (!loc_size_ok(rr->loc.size)) {
1487                                 r = -EBADMSG;
1488                                 goto fail;
1489                         }
1490
1491                         r = dns_packet_read_uint8(p, &rr->loc.horiz_pre, NULL);
1492                         if (r < 0)
1493                                 goto fail;
1494
1495                         if (!loc_size_ok(rr->loc.horiz_pre)) {
1496                                 r = -EBADMSG;
1497                                 goto fail;
1498                         }
1499
1500                         r = dns_packet_read_uint8(p, &rr->loc.vert_pre, NULL);
1501                         if (r < 0)
1502                                 goto fail;
1503
1504                         if (!loc_size_ok(rr->loc.vert_pre)) {
1505                                 r = -EBADMSG;
1506                                 goto fail;
1507                         }
1508
1509                         r = dns_packet_read_uint32(p, &rr->loc.latitude, NULL);
1510                         if (r < 0)
1511                                 goto fail;
1512
1513                         r = dns_packet_read_uint32(p, &rr->loc.longitude, NULL);
1514                         if (r < 0)
1515                                 goto fail;
1516
1517                         r = dns_packet_read_uint32(p, &rr->loc.altitude, NULL);
1518                         if (r < 0)
1519                                 goto fail;
1520
1521                         break;
1522                 } else {
1523                         dns_packet_rewind(p, pos);
1524                         rr->unparseable = true;
1525                         goto unparseable;
1526                 }
1527         }
1528
1529         case DNS_TYPE_DS:
1530                 r = dns_packet_read_uint16(p, &rr->ds.key_tag, NULL);
1531                 if (r < 0)
1532                         goto fail;
1533
1534                 r = dns_packet_read_uint8(p, &rr->ds.algorithm, NULL);
1535                 if (r < 0)
1536                         goto fail;
1537
1538                 r = dns_packet_read_uint8(p, &rr->ds.digest_type, NULL);
1539                 if (r < 0)
1540                         goto fail;
1541
1542                 r = dns_packet_read_memdup(p, rdlength - 4,
1543                                            &rr->ds.digest, &rr->ds.digest_size,
1544                                            NULL);
1545                 if (r < 0)
1546                         goto fail;
1547
1548                 if (rr->ds.digest_size <= 0) {
1549                         /* the accepted size depends on the algorithm, but for now
1550                            just ensure that the value is greater than zero */
1551                         r = -EBADMSG;
1552                         goto fail;
1553                 }
1554
1555                 break;
1556         case DNS_TYPE_SSHFP:
1557                 r = dns_packet_read_uint8(p, &rr->sshfp.algorithm, NULL);
1558                 if (r < 0)
1559                         goto fail;
1560
1561                 r = dns_packet_read_uint8(p, &rr->sshfp.fptype, NULL);
1562                 if (r < 0)
1563                         goto fail;
1564
1565                 r = dns_packet_read_memdup(p, rdlength - 2,
1566                                            &rr->sshfp.fingerprint, &rr->sshfp.fingerprint_size,
1567                                            NULL);
1568
1569                 if (rr->sshfp.fingerprint_size <= 0) {
1570                         /* the accepted size depends on the algorithm, but for now
1571                            just ensure that the value is greater than zero */
1572                         r = -EBADMSG;
1573                         goto fail;
1574                 }
1575
1576                 break;
1577
1578         case DNS_TYPE_DNSKEY: {
1579                 uint16_t flags;
1580                 uint8_t proto;
1581
1582                 r = dns_packet_read_uint16(p, &flags, NULL);
1583                 if (r < 0)
1584                         goto fail;
1585
1586                 r = dnskey_parse_flags(rr, flags);
1587                 if (r < 0)
1588                         goto fail;
1589
1590                 r = dns_packet_read_uint8(p, &proto, NULL);
1591                 if (r < 0)
1592                         goto fail;
1593
1594                 /* protocol is required to be always 3 */
1595                 if (proto != 3) {
1596                         r = -EBADMSG;
1597                         goto fail;
1598                 }
1599
1600                 r = dns_packet_read_uint8(p, &rr->dnskey.algorithm, NULL);
1601                 if (r < 0)
1602                         goto fail;
1603
1604                 r = dns_packet_read_memdup(p, rdlength - 4,
1605                                            &rr->dnskey.key, &rr->dnskey.key_size,
1606                                            NULL);
1607
1608                 if (rr->dnskey.key_size <= 0) {
1609                         /* the accepted size depends on the algorithm, but for now
1610                            just ensure that the value is greater than zero */
1611                         r = -EBADMSG;
1612                         goto fail;
1613                 }
1614
1615                 break;
1616         }
1617
1618         case DNS_TYPE_RRSIG:
1619                 r = dns_packet_read_uint16(p, &rr->rrsig.type_covered, NULL);
1620                 if (r < 0)
1621                         goto fail;
1622
1623                 r = dns_packet_read_uint8(p, &rr->rrsig.algorithm, NULL);
1624                 if (r < 0)
1625                         goto fail;
1626
1627                 r = dns_packet_read_uint8(p, &rr->rrsig.labels, NULL);
1628                 if (r < 0)
1629                         goto fail;
1630
1631                 r = dns_packet_read_uint32(p, &rr->rrsig.original_ttl, NULL);
1632                 if (r < 0)
1633                         goto fail;
1634
1635                 r = dns_packet_read_uint32(p, &rr->rrsig.expiration, NULL);
1636                 if (r < 0)
1637                         goto fail;
1638
1639                 r = dns_packet_read_uint32(p, &rr->rrsig.inception, NULL);
1640                 if (r < 0)
1641                         goto fail;
1642
1643                 r = dns_packet_read_uint16(p, &rr->rrsig.key_tag, NULL);
1644                 if (r < 0)
1645                         goto fail;
1646
1647                 r = dns_packet_read_name(p, &rr->rrsig.signer, false, NULL);
1648                 if (r < 0)
1649                         goto fail;
1650
1651                 r = dns_packet_read_memdup(p, offset + rdlength - p->rindex,
1652                                            &rr->rrsig.signature, &rr->rrsig.signature_size,
1653                                            NULL);
1654
1655                 if (rr->rrsig.signature_size <= 0) {
1656                         /* the accepted size depends on the algorithm, but for now
1657                            just ensure that the value is greater than zero */
1658                         r = -EBADMSG;
1659                         goto fail;
1660                 }
1661
1662                 break;
1663
1664         case DNS_TYPE_NSEC:
1665                 r = dns_packet_read_name(p, &rr->nsec.next_domain_name, false, NULL);
1666                 if (r < 0)
1667                         goto fail;
1668
1669                 r = dns_packet_read_type_windows(p, &rr->nsec.types, offset + rdlength - p->rindex, NULL);
1670                 if (r < 0)
1671                         goto fail;
1672
1673                 /* NSEC RRs with empty bitmpas makes no sense, but the RFC does not explicitly forbid them
1674                    so we allow it */
1675
1676                 break;
1677
1678         case DNS_TYPE_NSEC3: {
1679                 uint8_t size;
1680
1681                 r = dns_packet_read_uint8(p, &rr->nsec3.algorithm, NULL);
1682                 if (r < 0)
1683                         goto fail;
1684
1685                 r = dns_packet_read_uint8(p, &rr->nsec3.flags, NULL);
1686                 if (r < 0)
1687                         goto fail;
1688
1689                 r = dns_packet_read_uint16(p, &rr->nsec3.iterations, NULL);
1690                 if (r < 0)
1691                         goto fail;
1692
1693                 /* this may be zero */
1694                 r = dns_packet_read_uint8(p, &size, NULL);
1695                 if (r < 0)
1696                         goto fail;
1697
1698                 r = dns_packet_read_memdup(p, size, &rr->nsec3.salt, &rr->nsec3.salt_size, NULL);
1699                 if (r < 0)
1700                         goto fail;
1701
1702                 r = dns_packet_read_uint8(p, &size, NULL);
1703                 if (r < 0)
1704                         goto fail;
1705
1706                 if (size <= 0) {
1707                         r = -EBADMSG;
1708                         goto fail;
1709                 }
1710
1711                 r = dns_packet_read_memdup(p, size, &rr->nsec3.next_hashed_name, &rr->nsec3.next_hashed_name_size, NULL);
1712                 if (r < 0)
1713                         goto fail;
1714
1715                 r = dns_packet_append_types(p, rr->nsec3.types, NULL);
1716                 if (r < 0)
1717                         goto fail;
1718
1719                 break;
1720         }
1721         default:
1722         unparseable:
1723                 r = dns_packet_read_memdup(p, rdlength, &rr->generic.data, &rr->generic.size, NULL);
1724                 if (r < 0)
1725                         goto fail;
1726                 break;
1727         }
1728         if (r < 0)
1729                 goto fail;
1730         if (p->rindex != offset + rdlength) {
1731                 r = -EBADMSG;
1732                 goto fail;
1733         }
1734
1735         *ret = rr;
1736         rr = NULL;
1737
1738         if (start)
1739                 *start = saved_rindex;
1740
1741         return 0;
1742 fail:
1743         dns_packet_rewind(p, saved_rindex);
1744         return r;
1745 }
1746
1747 int dns_packet_extract(DnsPacket *p) {
1748         _cleanup_(dns_question_unrefp) DnsQuestion *question = NULL;
1749         _cleanup_(dns_answer_unrefp) DnsAnswer *answer = NULL;
1750         size_t saved_rindex;
1751         unsigned n, i;
1752         int r;
1753
1754         if (p->extracted)
1755                 return 0;
1756
1757         saved_rindex = p->rindex;
1758         dns_packet_rewind(p, DNS_PACKET_HEADER_SIZE);
1759
1760         n = DNS_PACKET_QDCOUNT(p);
1761         if (n > 0) {
1762                 question = dns_question_new(n);
1763                 if (!question) {
1764                         r = -ENOMEM;
1765                         goto finish;
1766                 }
1767
1768                 for (i = 0; i < n; i++) {
1769                         _cleanup_(dns_resource_key_unrefp) DnsResourceKey *key = NULL;
1770
1771                         r = dns_packet_read_key(p, &key, NULL);
1772                         if (r < 0)
1773                                 goto finish;
1774
1775                         r = dns_question_add(question, key);
1776                         if (r < 0)
1777                                 goto finish;
1778                 }
1779         }
1780
1781         n = DNS_PACKET_RRCOUNT(p);
1782         if (n > 0) {
1783                 answer = dns_answer_new(n);
1784                 if (!answer) {
1785                         r = -ENOMEM;
1786                         goto finish;
1787                 }
1788
1789                 for (i = 0; i < n; i++) {
1790                         _cleanup_(dns_resource_record_unrefp) DnsResourceRecord *rr = NULL;
1791
1792                         r = dns_packet_read_rr(p, &rr, NULL);
1793                         if (r < 0)
1794                                 goto finish;
1795
1796                         r = dns_answer_add(answer, rr);
1797                         if (r < 0)
1798                                 goto finish;
1799                 }
1800         }
1801
1802         p->question = question;
1803         question = NULL;
1804
1805         p->answer = answer;
1806         answer = NULL;
1807
1808         p->extracted = true;
1809
1810         r = 0;
1811
1812 finish:
1813         p->rindex = saved_rindex;
1814         return r;
1815 }
1816
1817 static const char* const dns_rcode_table[_DNS_RCODE_MAX_DEFINED] = {
1818         [DNS_RCODE_SUCCESS] = "SUCCESS",
1819         [DNS_RCODE_FORMERR] = "FORMERR",
1820         [DNS_RCODE_SERVFAIL] = "SERVFAIL",
1821         [DNS_RCODE_NXDOMAIN] = "NXDOMAIN",
1822         [DNS_RCODE_NOTIMP] = "NOTIMP",
1823         [DNS_RCODE_REFUSED] = "REFUSED",
1824         [DNS_RCODE_YXDOMAIN] = "YXDOMAIN",
1825         [DNS_RCODE_YXRRSET] = "YRRSET",
1826         [DNS_RCODE_NXRRSET] = "NXRRSET",
1827         [DNS_RCODE_NOTAUTH] = "NOTAUTH",
1828         [DNS_RCODE_NOTZONE] = "NOTZONE",
1829         [DNS_RCODE_BADVERS] = "BADVERS",
1830         [DNS_RCODE_BADKEY] = "BADKEY",
1831         [DNS_RCODE_BADTIME] = "BADTIME",
1832         [DNS_RCODE_BADMODE] = "BADMODE",
1833         [DNS_RCODE_BADNAME] = "BADNAME",
1834         [DNS_RCODE_BADALG] = "BADALG",
1835         [DNS_RCODE_BADTRUNC] = "BADTRUNC",
1836 };
1837 DEFINE_STRING_TABLE_LOOKUP(dns_rcode, int);
1838
1839 static const char* const dns_protocol_table[_DNS_PROTOCOL_MAX] = {
1840         [DNS_PROTOCOL_DNS] = "dns",
1841         [DNS_PROTOCOL_MDNS] = "mdns",
1842         [DNS_PROTOCOL_LLMNR] = "llmnr",
1843 };
1844 DEFINE_STRING_TABLE_LOOKUP(dns_protocol, DnsProtocol);
1845
1846 static const char* const dnssec_algorithm_table[_DNSSEC_ALGORITHM_MAX_DEFINED] = {
1847         [DNSSEC_ALGORITHM_RSAMD5]             = "RSAMD5",
1848         [DNSSEC_ALGORITHM_DH]                 = "DH",
1849         [DNSSEC_ALGORITHM_DSA]                = "DSA",
1850         [DNSSEC_ALGORITHM_ECC]                = "ECC",
1851         [DNSSEC_ALGORITHM_RSASHA1]            = "RSASHA1",
1852         [DNSSEC_ALGORITHM_DSA_NSEC3_SHA1]     = "DSA-NSEC3-SHA1",
1853         [DNSSEC_ALGORITHM_RSASHA1_NSEC3_SHA1] = "RSASHA1-NSEC3-SHA1",
1854         [DNSSEC_ALGORITHM_INDIRECT]           = "INDIRECT",
1855         [DNSSEC_ALGORITHM_PRIVATEDNS]         = "PRIVATEDNS",
1856         [DNSSEC_ALGORITHM_PRIVATEOID]         = "PRIVATEOID",
1857 };
1858 DEFINE_STRING_TABLE_LOOKUP(dnssec_algorithm, int);