src/resolve/resolved-dns-query.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2
   3 #include "alloc-util.h"
   4 #include "dns-domain.h"
   5 #include "dns-type.h"
   6 #include "hostname-util.h"
   7 #include "local-addresses.h"
   8 #include "resolved-dns-query.h"
   9 #include "resolved-dns-synthesize.h"
  10 #include "resolved-etc-hosts.h"
  11 #include "string-util.h"
  12
  13 #define CNAME_MAX 8
  14 #define QUERIES_MAX 2048
  15 #define AUXILIARY_QUERIES_MAX 64
  16
  17 static int dns_query_candidate_new(DnsQueryCandidate **ret, DnsQuery *q, DnsScope *s) {
  18         DnsQueryCandidate *c;
  19
  20         assert(ret);
  21         assert(q);
  22         assert(s);
  23
  24         c = new0(DnsQueryCandidate, 1);
  25         if (!c)
  26                 return -ENOMEM;
  27
  28         c->query = q;
  29         c->scope = s;
  30
  31         LIST_PREPEND(candidates_by_query, q->candidates, c);
  32         LIST_PREPEND(candidates_by_scope, s->query_candidates, c);
  33
  34         *ret = c;
  35         return 0;
  36 }
  37
  38 static void dns_query_candidate_stop(DnsQueryCandidate *c) {
  39         DnsTransaction *t;
  40
  41         assert(c);
  42
  43         while ((t = set_steal_first(c->transactions))) {
  44                 set_remove(t->notify_query_candidates, c);
  45                 set_remove(t->notify_query_candidates_done, c);
  46                 dns_transaction_gc(t);
  47         }
  48 }
  49
  50 DnsQueryCandidate* dns_query_candidate_free(DnsQueryCandidate *c) {
  51
  52         if (!c)
  53                 return NULL;
  54
  55         dns_query_candidate_stop(c);
  56
  57         set_free(c->transactions);
  58         dns_search_domain_unref(c->search_domain);
  59
  60         if (c->query)
  61                 LIST_REMOVE(candidates_by_query, c->query->candidates, c);
  62
  63         if (c->scope)
  64                 LIST_REMOVE(candidates_by_scope, c->scope->query_candidates, c);
  65
  66         return mfree(c);
  67 }
  68
  69 static int dns_query_candidate_next_search_domain(DnsQueryCandidate *c) {
  70         DnsSearchDomain *next = NULL;
  71
  72         assert(c);
  73
  74         if (c->search_domain && c->search_domain->linked)
  75                 next = c->search_domain->domains_next;
  76         else
  77                 next = dns_scope_get_search_domains(c->scope);
  78
  79         for (;;) {
  80                 if (!next) /* We hit the end of the list */
  81                         return 0;
  82
  83                 if (!next->route_only)
  84                         break;
  85
  86                 /* Skip over route-only domains */
  87                 next = next->domains_next;
  88         }
  89
  90         dns_search_domain_unref(c->search_domain);
  91         c->search_domain = dns_search_domain_ref(next);
  92
  93         return 1;
  94 }
  95
  96 static int dns_query_candidate_add_transaction(DnsQueryCandidate *c, DnsResourceKey *key) {
  97         _cleanup_(dns_transaction_gcp) DnsTransaction *t = NULL;
  98         int r;
  99
 100         assert(c);
 101         assert(key);
 102
 103         t = dns_scope_find_transaction(c->scope, key, true);
 104         if (!t) {
 105                 r = dns_transaction_new(&t, c->scope, key);
 106                 if (r < 0)
 107                         return r;
 108         } else if (set_contains(c->transactions, t))
 109                 return 0;
 110
 111         r = set_ensure_allocated(&t->notify_query_candidates_done, NULL);
 112         if (r < 0)
 113                 return r;
 114
 115         r = set_ensure_put(&t->notify_query_candidates, NULL, c);
 116         if (r < 0)
 117                 return r;
 118
 119         r = set_ensure_put(&c->transactions, NULL, t);
 120         if (r < 0) {
 121                 (void) set_remove(t->notify_query_candidates, c);
 122                 return r;
 123         }
 124
 125         t->clamp_ttl = c->query->clamp_ttl;
 126         TAKE_PTR(t);
 127         return 1;
 128 }
 129
 130 static int dns_query_candidate_go(DnsQueryCandidate *c) {
 131         DnsTransaction *t;
 132         Iterator i;
 133         int r;
 134         unsigned n = 0;
 135
 136         assert(c);
 137
 138         /* Start the transactions that are not started yet */
 139         SET_FOREACH(t, c->transactions, i) {
 140                 if (t->state != DNS_TRANSACTION_NULL)
 141                         continue;
 142
 143                 r = dns_transaction_go(t);
 144                 if (r < 0)
 145                         return r;
 146
 147                 n++;
 148         }
 149
 150         /* If there was nothing to start, then let's proceed immediately */
 151         if (n == 0)
 152                 dns_query_candidate_notify(c);
 153
 154         return 0;
 155 }
 156
 157 static DnsTransactionState dns_query_candidate_state(DnsQueryCandidate *c) {
 158         DnsTransactionState state = DNS_TRANSACTION_NO_SERVERS;
 159         DnsTransaction *t;
 160         Iterator i;
 161
 162         assert(c);
 163
 164         if (c->error_code != 0)
 165                 return DNS_TRANSACTION_ERRNO;
 166
 167         SET_FOREACH(t, c->transactions, i) {
 168
 169                 switch (t->state) {
 170
 171                 case DNS_TRANSACTION_NULL:
 172                         /* If there's a NULL transaction pending, then
 173                          * this means not all transactions where
 174                          * started yet, and we were called from within
 175                          * the stackframe that is supposed to start
 176                          * remaining transactions. In this case,
 177                          * simply claim the candidate is pending. */
 178
 179                 case DNS_TRANSACTION_PENDING:
 180                 case DNS_TRANSACTION_VALIDATING:
 181                         /* If there's one transaction currently in
 182                          * VALIDATING state, then this means there's
 183                          * also one in PENDING state, hence we can
 184                          * return PENDING immediately. */
 185                         return DNS_TRANSACTION_PENDING;
 186
 187                 case DNS_TRANSACTION_SUCCESS:
 188                         state = t->state;
 189                         break;
 190
 191                 default:
 192                         if (state != DNS_TRANSACTION_SUCCESS)
 193                                 state = t->state;
 194
 195                         break;
 196                 }
 197         }
 198
 199         return state;
 200 }
 201
 202 static int dns_query_candidate_setup_transactions(DnsQueryCandidate *c) {
 203         DnsQuestion *question;
 204         DnsResourceKey *key;
 205         int n = 0, r;
 206
 207         assert(c);
 208
 209         dns_query_candidate_stop(c);
 210
 211         question = dns_query_question_for_protocol(c->query, c->scope->protocol);
 212
 213         /* Create one transaction per question key */
 214         DNS_QUESTION_FOREACH(key, question) {
 215                 _cleanup_(dns_resource_key_unrefp) DnsResourceKey *new_key = NULL;
 216                 DnsResourceKey *qkey;
 217
 218                 if (c->search_domain) {
 219                         r = dns_resource_key_new_append_suffix(&new_key, key, c->search_domain->name);
 220                         if (r < 0)
 221                                 goto fail;
 222
 223                         qkey = new_key;
 224                 } else
 225                         qkey = key;
 226
 227                 if (!dns_scope_good_key(c->scope, qkey))
 228                         continue;
 229
 230                 r = dns_query_candidate_add_transaction(c, qkey);
 231                 if (r < 0)
 232                         goto fail;
 233
 234                 n++;
 235         }
 236
 237         return n;
 238
 239 fail:
 240         dns_query_candidate_stop(c);
 241         return r;
 242 }
 243
 244 void dns_query_candidate_notify(DnsQueryCandidate *c) {
 245         DnsTransactionState state;
 246         int r;
 247
 248         assert(c);
 249
 250         state = dns_query_candidate_state(c);
 251
 252         if (DNS_TRANSACTION_IS_LIVE(state))
 253                 return;
 254
 255         if (state != DNS_TRANSACTION_SUCCESS && c->search_domain) {
 256
 257                 r = dns_query_candidate_next_search_domain(c);
 258                 if (r < 0)
 259                         goto fail;
 260
 261                 if (r > 0) {
 262                         /* OK, there's another search domain to try, let's do so. */
 263
 264                         r = dns_query_candidate_setup_transactions(c);
 265                         if (r < 0)
 266                                 goto fail;
 267
 268                         if (r > 0) {
 269                                 /* New transactions where queued. Start them and wait */
 270
 271                                 r = dns_query_candidate_go(c);
 272                                 if (r < 0)
 273                                         goto fail;
 274
 275                                 return;
 276                         }
 277                 }
 278
 279         }
 280
 281         dns_query_ready(c->query);
 282         return;
 283
 284 fail:
 285         log_warning_errno(r, "Failed to follow search domains: %m");
 286         c->error_code = r;
 287         dns_query_ready(c->query);
 288 }
 289
 290 static void dns_query_stop(DnsQuery *q) {
 291         DnsQueryCandidate *c;
 292
 293         assert(q);
 294
 295         q->timeout_event_source = sd_event_source_unref(q->timeout_event_source);
 296
 297         LIST_FOREACH(candidates_by_query, c, q->candidates)
 298                 dns_query_candidate_stop(c);
 299 }
 300
 301 static void dns_query_free_candidates(DnsQuery *q) {
 302         assert(q);
 303
 304         while (q->candidates)
 305                 dns_query_candidate_free(q->candidates);
 306 }
 307
 308 static void dns_query_reset_answer(DnsQuery *q) {
 309         assert(q);
 310
 311         q->answer = dns_answer_unref(q->answer);
 312         q->answer_rcode = 0;
 313         q->answer_dnssec_result = _DNSSEC_RESULT_INVALID;
 314         q->answer_errno = 0;
 315         q->answer_authenticated = false;
 316         q->answer_protocol = _DNS_PROTOCOL_INVALID;
 317         q->answer_family = AF_UNSPEC;
 318         q->answer_search_domain = dns_search_domain_unref(q->answer_search_domain);
 319 }
 320
 321 DnsQuery *dns_query_free(DnsQuery *q) {
 322         if (!q)
 323                 return NULL;
 324
 325         while (q->auxiliary_queries)
 326                 dns_query_free(q->auxiliary_queries);
 327
 328         if (q->auxiliary_for) {
 329                 assert(q->auxiliary_for->n_auxiliary_queries > 0);
 330                 q->auxiliary_for->n_auxiliary_queries--;
 331                 LIST_REMOVE(auxiliary_queries, q->auxiliary_for->auxiliary_queries, q);
 332         }
 333
 334         dns_query_free_candidates(q);
 335
 336         dns_question_unref(q->question_idna);
 337         dns_question_unref(q->question_utf8);
 338
 339         dns_query_reset_answer(q);
 340
 341         sd_bus_message_unref(q->request);
 342         sd_bus_track_unref(q->bus_track);
 343
 344         dns_packet_unref(q->request_dns_packet);
 345         dns_packet_unref(q->reply_dns_packet);
 346
 347         if (q->request_dns_stream) {
 348                 /* Detach the stream from our query, in case something else keeps a reference to it. */
 349                 (void) set_remove(q->request_dns_stream->queries, q);
 350                 q->request_dns_stream = dns_stream_unref(q->request_dns_stream);
 351         }
 352
 353         free(q->request_address_string);
 354
 355         if (q->manager) {
 356                 LIST_REMOVE(queries, q->manager->dns_queries, q);
 357                 q->manager->n_dns_queries--;
 358         }
 359
 360         return mfree(q);
 361 }
 362
 363 int dns_query_new(
 364                 Manager *m,
 365                 DnsQuery **ret,
 366                 DnsQuestion *question_utf8,
 367                 DnsQuestion *question_idna,
 368                 int ifindex,
 369                 uint64_t flags) {
 370
 371         _cleanup_(dns_query_freep) DnsQuery *q = NULL;
 372         DnsResourceKey *key;
 373         bool good = false;
 374         int r;
 375         char key_str[DNS_RESOURCE_KEY_STRING_MAX];
 376
 377         assert(m);
 378
 379         if (dns_question_size(question_utf8) > 0) {
 380                 r = dns_question_is_valid_for_query(question_utf8);
 381                 if (r < 0)
 382                         return r;
 383                 if (r == 0)
 384                         return -EINVAL;
 385
 386                 good = true;
 387         }
 388
 389         /* If the IDNA and UTF8 questions are the same, merge their references */
 390         r = dns_question_is_equal(question_idna, question_utf8);
 391         if (r < 0)
 392                 return r;
 393         if (r > 0)
 394                 question_idna = question_utf8;
 395         else {
 396                 if (dns_question_size(question_idna) > 0) {
 397                         r = dns_question_is_valid_for_query(question_idna);
 398                         if (r < 0)
 399                                 return r;
 400                         if (r == 0)
 401                                 return -EINVAL;
 402
 403                         good = true;
 404                 }
 405         }
 406
 407         if (!good) /* don't allow empty queries */
 408                 return -EINVAL;
 409
 410         if (m->n_dns_queries >= QUERIES_MAX)
 411                 return -EBUSY;
 412
 413         q = new0(DnsQuery, 1);
 414         if (!q)
 415                 return -ENOMEM;
 416
 417         q->question_utf8 = dns_question_ref(question_utf8);
 418         q->question_idna = dns_question_ref(question_idna);
 419         q->ifindex = ifindex;
 420         q->flags = flags;
 421         q->answer_dnssec_result = _DNSSEC_RESULT_INVALID;
 422         q->answer_protocol = _DNS_PROTOCOL_INVALID;
 423         q->answer_family = AF_UNSPEC;
 424
 425         /* First dump UTF8  question */
 426         DNS_QUESTION_FOREACH(key, question_utf8)
 427                 log_debug("Looking up RR for %s.",
 428                           dns_resource_key_to_string(key, key_str, sizeof key_str));
 429
 430         /* And then dump the IDNA question, but only what hasn't been dumped already through the UTF8 question. */
 431         DNS_QUESTION_FOREACH(key, question_idna) {
 432                 r = dns_question_contains(question_utf8, key);
 433                 if (r < 0)
 434                         return r;
 435                 if (r > 0)
 436                         continue;
 437
 438                 log_debug("Looking up IDNA RR for %s.",
 439                           dns_resource_key_to_string(key, key_str, sizeof key_str));
 440         }
 441
 442         LIST_PREPEND(queries, m->dns_queries, q);
 443         m->n_dns_queries++;
 444         q->manager = m;
 445
 446         if (ret)
 447                 *ret = q;
 448         q = NULL;
 449
 450         return 0;
 451 }
 452
 453 int dns_query_make_auxiliary(DnsQuery *q, DnsQuery *auxiliary_for) {
 454         assert(q);
 455         assert(auxiliary_for);
 456
 457         /* Ensure that the query is not auxiliary yet, and
 458          * nothing else is auxiliary to it either */
 459         assert(!q->auxiliary_for);
 460         assert(!q->auxiliary_queries);
 461
 462         /* Ensure that the unit we shall be made auxiliary for isn't
 463          * auxiliary itself */
 464         assert(!auxiliary_for->auxiliary_for);
 465
 466         if (auxiliary_for->n_auxiliary_queries >= AUXILIARY_QUERIES_MAX)
 467                 return -EAGAIN;
 468
 469         LIST_PREPEND(auxiliary_queries, auxiliary_for->auxiliary_queries, q);
 470         q->auxiliary_for = auxiliary_for;
 471
 472         auxiliary_for->n_auxiliary_queries++;
 473         return 0;
 474 }
 475
 476 static void dns_query_complete(DnsQuery *q, DnsTransactionState state) {
 477         assert(q);
 478         assert(!DNS_TRANSACTION_IS_LIVE(state));
 479         assert(DNS_TRANSACTION_IS_LIVE(q->state));
 480
 481         /* Note that this call might invalidate the query. Callers
 482          * should hence not attempt to access the query or transaction
 483          * after calling this function. */
 484
 485         q->state = state;
 486
 487         dns_query_stop(q);
 488         if (q->complete)
 489                 q->complete(q);
 490 }
 491
 492 static int on_query_timeout(sd_event_source *s, usec_t usec, void *userdata) {
 493         DnsQuery *q = userdata;
 494
 495         assert(s);
 496         assert(q);
 497
 498         dns_query_complete(q, DNS_TRANSACTION_TIMEOUT);
 499         return 0;
 500 }
 501
 502 static int dns_query_add_candidate(DnsQuery *q, DnsScope *s) {
 503         DnsQueryCandidate *c;
 504         int r;
 505
 506         assert(q);
 507         assert(s);
 508
 509         r = dns_query_candidate_new(&c, q, s);
 510         if (r < 0)
 511                 return r;
 512
 513         /* If this a single-label domain on DNS, we might append a suitable search domain first. */
 514         if ((q->flags & SD_RESOLVED_NO_SEARCH) == 0 &&
 515             dns_scope_name_needs_search_domain(s, dns_question_first_name(q->question_idna))) {
 516                 /* OK, we need a search domain now. Let's find one for this scope */
 517
 518                 r = dns_query_candidate_next_search_domain(c);
 519                 if (r <= 0) /* if there's no search domain, then we won't add any transaction. */
 520                         goto fail;
 521         }
 522
 523         r = dns_query_candidate_setup_transactions(c);
 524         if (r < 0)
 525                 goto fail;
 526
 527         return 0;
 528
 529 fail:
 530         dns_query_candidate_free(c);
 531         return r;
 532 }
 533
 534 static int dns_query_synthesize_reply(DnsQuery *q, DnsTransactionState *state) {
 535         _cleanup_(dns_answer_unrefp) DnsAnswer *answer = NULL;
 536         int r;
 537
 538         assert(q);
 539         assert(state);
 540
 541         /* Tries to synthesize localhost RR replies (and others) where appropriate. Note that this is done *after* the
 542          * the normal lookup finished. The data from the network hence takes precedence over the data we
 543          * synthesize. (But note that many scopes refuse to resolve certain domain names) */
 544
 545         if (!IN_SET(*state,
 546                     DNS_TRANSACTION_RCODE_FAILURE,
 547                     DNS_TRANSACTION_NO_SERVERS,
 548                     DNS_TRANSACTION_TIMEOUT,
 549                     DNS_TRANSACTION_ATTEMPTS_MAX_REACHED,
 550                     DNS_TRANSACTION_NETWORK_DOWN,
 551                     DNS_TRANSACTION_NOT_FOUND))
 552                 return 0;
 553
 554         r = dns_synthesize_answer(
 555                         q->manager,
 556                         q->question_utf8,
 557                         q->ifindex,
 558                         &answer);
 559         if (r == -ENXIO) {
 560                 /* If we get ENXIO this tells us to generate NXDOMAIN unconditionally. */
 561
 562                 dns_query_reset_answer(q);
 563                 q->answer_rcode = DNS_RCODE_NXDOMAIN;
 564                 q->answer_protocol = dns_synthesize_protocol(q->flags);
 565                 q->answer_family = dns_synthesize_family(q->flags);
 566                 q->answer_authenticated = true;
 567                 *state = DNS_TRANSACTION_RCODE_FAILURE;
 568
 569                 return 0;
 570         }
 571         if (r <= 0)
 572                 return r;
 573
 574         dns_query_reset_answer(q);
 575
 576         q->answer = TAKE_PTR(answer);
 577         q->answer_rcode = DNS_RCODE_SUCCESS;
 578         q->answer_protocol = dns_synthesize_protocol(q->flags);
 579         q->answer_family = dns_synthesize_family(q->flags);
 580         q->answer_authenticated = true;
 581
 582         *state = DNS_TRANSACTION_SUCCESS;
 583
 584         return 1;
 585 }
 586
 587 static int dns_query_try_etc_hosts(DnsQuery *q) {
 588         _cleanup_(dns_answer_unrefp) DnsAnswer *answer = NULL;
 589         int r;
 590
 591         assert(q);
 592
 593         /* Looks in /etc/hosts for matching entries. Note that this is done *before* the normal lookup is done. The
 594          * data from /etc/hosts hence takes precedence over the network. */
 595
 596         r = manager_etc_hosts_lookup(
 597                         q->manager,
 598                         q->question_utf8,
 599                         &answer);
 600         if (r <= 0)
 601                 return r;
 602
 603         dns_query_reset_answer(q);
 604
 605         q->answer = TAKE_PTR(answer);
 606         q->answer_rcode = DNS_RCODE_SUCCESS;
 607         q->answer_protocol = dns_synthesize_protocol(q->flags);
 608         q->answer_family = dns_synthesize_family(q->flags);
 609         q->answer_authenticated = true;
 610
 611         return 1;
 612 }
 613
 614 int dns_query_go(DnsQuery *q) {
 615         DnsScopeMatch found = DNS_SCOPE_NO;
 616         DnsScope *s, *first = NULL;
 617         DnsQueryCandidate *c;
 618         int r;
 619
 620         assert(q);
 621
 622         if (q->state != DNS_TRANSACTION_NULL)
 623                 return 0;
 624
 625         r = dns_query_try_etc_hosts(q);
 626         if (r < 0)
 627                 return r;
 628         if (r > 0) {
 629                 dns_query_complete(q, DNS_TRANSACTION_SUCCESS);
 630                 return 1;
 631         }
 632
 633         LIST_FOREACH(scopes, s, q->manager->dns_scopes) {
 634                 DnsScopeMatch match;
 635                 const char *name;
 636
 637                 name = dns_question_first_name(dns_query_question_for_protocol(q, s->protocol));
 638                 if (!name)
 639                         continue;
 640
 641                 match = dns_scope_good_domain(s, q->ifindex, q->flags, name);
 642                 if (match < 0) {
 643                         log_debug("Couldn't check if '%s' matches against scope, ignoring.", name);
 644                         continue;
 645                 }
 646
 647                 if (match > found) { /* Does this match better? If so, remember how well it matched, and the first one
 648                                       * that matches this well */
 649                         found = match;
 650                         first = s;
 651                 }
 652         }
 653
 654         if (found == DNS_SCOPE_NO) {
 655                 DnsTransactionState state = DNS_TRANSACTION_NO_SERVERS;
 656
 657                 r = dns_query_synthesize_reply(q, &state);
 658                 if (r < 0)
 659                         return r;
 660
 661                 dns_query_complete(q, state);
 662                 return 1;
 663         }
 664
 665         r = dns_query_add_candidate(q, first);
 666         if (r < 0)
 667                 goto fail;
 668
 669         LIST_FOREACH(scopes, s, first->scopes_next) {
 670                 DnsScopeMatch match;
 671                 const char *name;
 672
 673                 name = dns_question_first_name(dns_query_question_for_protocol(q, s->protocol));
 674                 if (!name)
 675                         continue;
 676
 677                 match = dns_scope_good_domain(s, q->ifindex, q->flags, name);
 678                 if (match < 0) {
 679                         log_debug("Couldn't check if '%s' matches against scope, ignoring.", name);
 680                         continue;
 681                 }
 682
 683                 if (match < found)
 684                         continue;
 685
 686                 r = dns_query_add_candidate(q, s);
 687                 if (r < 0)
 688                         goto fail;
 689         }
 690
 691         dns_query_reset_answer(q);
 692
 693         r = sd_event_add_time(
 694                         q->manager->event,
 695                         &q->timeout_event_source,
 696                         clock_boottime_or_monotonic(),
 697                         now(clock_boottime_or_monotonic()) + SD_RESOLVED_QUERY_TIMEOUT_USEC,
 698                         0, on_query_timeout, q);
 699         if (r < 0)
 700                 goto fail;
 701
 702         (void) sd_event_source_set_description(q->timeout_event_source, "query-timeout");
 703
 704         q->state = DNS_TRANSACTION_PENDING;
 705         q->block_ready++;
 706
 707         /* Start the transactions */
 708         LIST_FOREACH(candidates_by_query, c, q->candidates) {
 709                 r = dns_query_candidate_go(c);
 710                 if (r < 0) {
 711                         q->block_ready--;
 712                         goto fail;
 713                 }
 714         }
 715
 716         q->block_ready--;
 717         dns_query_ready(q);
 718
 719         return 1;
 720
 721 fail:
 722         dns_query_stop(q);
 723         return r;
 724 }
 725
 726 static void dns_query_accept(DnsQuery *q, DnsQueryCandidate *c) {
 727         DnsTransactionState state = DNS_TRANSACTION_NO_SERVERS;
 728         bool has_authenticated = false, has_non_authenticated = false;
 729         DnssecResult dnssec_result_authenticated = _DNSSEC_RESULT_INVALID, dnssec_result_non_authenticated = _DNSSEC_RESULT_INVALID;
 730         DnsTransaction *t;
 731         Iterator i;
 732         int r;
 733
 734         assert(q);
 735
 736         if (!c) {
 737                 r = dns_query_synthesize_reply(q, &state);
 738                 if (r < 0)
 739                         goto fail;
 740
 741                 dns_query_complete(q, state);
 742                 return;
 743         }
 744
 745         if (c->error_code != 0) {
 746                 /* If the candidate had an error condition of its own, start with that. */
 747                 state = DNS_TRANSACTION_ERRNO;
 748                 q->answer = dns_answer_unref(q->answer);
 749                 q->answer_rcode = 0;
 750                 q->answer_dnssec_result = _DNSSEC_RESULT_INVALID;
 751                 q->answer_authenticated = false;
 752                 q->answer_errno = c->error_code;
 753         }
 754
 755         SET_FOREACH(t, c->transactions, i) {
 756
 757                 switch (t->state) {
 758
 759                 case DNS_TRANSACTION_SUCCESS: {
 760                         /* We found a successfully reply, merge it into the answer */
 761                         r = dns_answer_extend(&q->answer, t->answer);
 762                         if (r < 0)
 763                                 goto fail;
 764
 765                         q->answer_rcode = t->answer_rcode;
 766                         q->answer_errno = 0;
 767
 768                         if (t->answer_authenticated) {
 769                                 has_authenticated = true;
 770                                 dnssec_result_authenticated = t->answer_dnssec_result;
 771                         } else {
 772                                 has_non_authenticated = true;
 773                                 dnssec_result_non_authenticated = t->answer_dnssec_result;
 774                         }
 775
 776                         state = DNS_TRANSACTION_SUCCESS;
 777                         break;
 778                 }
 779
 780                 case DNS_TRANSACTION_NULL:
 781                 case DNS_TRANSACTION_PENDING:
 782                 case DNS_TRANSACTION_VALIDATING:
 783                 case DNS_TRANSACTION_ABORTED:
 784                         /* Ignore transactions that didn't complete */
 785                         continue;
 786
 787                 default:
 788                         /* Any kind of failure? Store the data away, if there's nothing stored yet. */
 789                         if (state == DNS_TRANSACTION_SUCCESS)
 790                                 continue;
 791
 792                         /* If there's already an authenticated negative reply stored, then prefer that over any unauthenticated one */
 793                         if (q->answer_authenticated && !t->answer_authenticated)
 794                                 continue;
 795
 796                         q->answer = dns_answer_unref(q->answer);
 797                         q->answer_rcode = t->answer_rcode;
 798                         q->answer_dnssec_result = t->answer_dnssec_result;
 799                         q->answer_authenticated = t->answer_authenticated;
 800                         q->answer_errno = t->answer_errno;
 801
 802                         state = t->state;
 803                         break;
 804                 }
 805         }
 806
 807         if (state == DNS_TRANSACTION_SUCCESS) {
 808                 q->answer_authenticated = has_authenticated && !has_non_authenticated;
 809                 q->answer_dnssec_result = q->answer_authenticated ? dnssec_result_authenticated : dnssec_result_non_authenticated;
 810         }
 811
 812         q->answer_protocol = c->scope->protocol;
 813         q->answer_family = c->scope->family;
 814
 815         dns_search_domain_unref(q->answer_search_domain);
 816         q->answer_search_domain = dns_search_domain_ref(c->search_domain);
 817
 818         r = dns_query_synthesize_reply(q, &state);
 819         if (r < 0)
 820                 goto fail;
 821
 822         dns_query_complete(q, state);
 823         return;
 824
 825 fail:
 826         q->answer_errno = -r;
 827         dns_query_complete(q, DNS_TRANSACTION_ERRNO);
 828 }
 829
 830 void dns_query_ready(DnsQuery *q) {
 831
 832         DnsQueryCandidate *bad = NULL, *c;
 833         bool pending = false;
 834
 835         assert(q);
 836         assert(DNS_TRANSACTION_IS_LIVE(q->state));
 837
 838         /* Note that this call might invalidate the query. Callers
 839          * should hence not attempt to access the query or transaction
 840          * after calling this function, unless the block_ready
 841          * counter was explicitly bumped before doing so. */
 842
 843         if (q->block_ready > 0)
 844                 return;
 845
 846         LIST_FOREACH(candidates_by_query, c, q->candidates) {
 847                 DnsTransactionState state;
 848
 849                 state = dns_query_candidate_state(c);
 850                 switch (state) {
 851
 852                 case DNS_TRANSACTION_SUCCESS:
 853                         /* One of the candidates is successful,
 854                          * let's use it, and copy its data out */
 855                         dns_query_accept(q, c);
 856                         return;
 857
 858                 case DNS_TRANSACTION_NULL:
 859                 case DNS_TRANSACTION_PENDING:
 860                 case DNS_TRANSACTION_VALIDATING:
 861                         /* One of the candidates is still going on,
 862                          * let's maybe wait for it */
 863                         pending = true;
 864                         break;
 865
 866                 default:
 867                         /* Any kind of failure */
 868                         bad = c;
 869                         break;
 870                 }
 871         }
 872
 873         if (pending)
 874                 return;
 875
 876         dns_query_accept(q, bad);
 877 }
 878
 879 static int dns_query_cname_redirect(DnsQuery *q, const DnsResourceRecord *cname) {
 880         _cleanup_(dns_question_unrefp) DnsQuestion *nq_idna = NULL, *nq_utf8 = NULL;
 881         int r, k;
 882
 883         assert(q);
 884
 885         q->n_cname_redirects++;
 886         if (q->n_cname_redirects > CNAME_MAX)
 887                 return -ELOOP;
 888
 889         r = dns_question_cname_redirect(q->question_idna, cname, &nq_idna);
 890         if (r < 0)
 891                 return r;
 892         else if (r > 0)
 893                 log_debug("Following CNAME/DNAME %s → %s.", dns_question_first_name(q->question_idna), dns_question_first_name(nq_idna));
 894
 895         k = dns_question_is_equal(q->question_idna, q->question_utf8);
 896         if (k < 0)
 897                 return r;
 898         if (k > 0) {
 899                 /* Same question? Shortcut new question generation */
 900                 nq_utf8 = dns_question_ref(nq_idna);
 901                 k = r;
 902         } else {
 903                 k = dns_question_cname_redirect(q->question_utf8, cname, &nq_utf8);
 904                 if (k < 0)
 905                         return k;
 906                 else if (k > 0)
 907                         log_debug("Following UTF8 CNAME/DNAME %s → %s.", dns_question_first_name(q->question_utf8), dns_question_first_name(nq_utf8));
 908         }
 909
 910         if (r == 0 && k == 0) /* No actual cname happened? */
 911                 return -ELOOP;
 912
 913         if (q->answer_protocol == DNS_PROTOCOL_DNS) {
 914                 /* Don't permit CNAME redirects from unicast DNS to LLMNR or MulticastDNS, so that global resources
 915                  * cannot invade the local namespace. The opposite way we permit: local names may redirect to global
 916                  * ones. */
 917
 918                 q->flags &= ~(SD_RESOLVED_LLMNR|SD_RESOLVED_MDNS); /* mask away the local protocols */
 919         }
 920
 921         /* Turn off searching for the new name */
 922         q->flags |= SD_RESOLVED_NO_SEARCH;
 923
 924         dns_question_unref(q->question_idna);
 925         q->question_idna = TAKE_PTR(nq_idna);
 926
 927         dns_question_unref(q->question_utf8);
 928         q->question_utf8 = TAKE_PTR(nq_utf8);
 929
 930         dns_query_free_candidates(q);
 931         dns_query_reset_answer(q);
 932
 933         q->state = DNS_TRANSACTION_NULL;
 934
 935         return 0;
 936 }
 937
 938 int dns_query_process_cname(DnsQuery *q) {
 939         _cleanup_(dns_resource_record_unrefp) DnsResourceRecord *cname = NULL;
 940         DnsQuestion *question;
 941         DnsResourceRecord *rr;
 942         int r;
 943
 944         assert(q);
 945
 946         if (!IN_SET(q->state, DNS_TRANSACTION_SUCCESS, DNS_TRANSACTION_NULL))
 947                 return DNS_QUERY_NOMATCH;
 948
 949         question = dns_query_question_for_protocol(q, q->answer_protocol);
 950
 951         DNS_ANSWER_FOREACH(rr, q->answer) {
 952                 r = dns_question_matches_rr(question, rr, DNS_SEARCH_DOMAIN_NAME(q->answer_search_domain));
 953                 if (r < 0)
 954                         return r;
 955                 if (r > 0)
 956                         return DNS_QUERY_MATCH; /* The answer matches directly, no need to follow cnames */
 957
 958                 r = dns_question_matches_cname_or_dname(question, rr, DNS_SEARCH_DOMAIN_NAME(q->answer_search_domain));
 959                 if (r < 0)
 960                         return r;
 961                 if (r > 0 && !cname)
 962                         cname = dns_resource_record_ref(rr);
 963         }
 964
 965         if (!cname)
 966                 return DNS_QUERY_NOMATCH; /* No match and no cname to follow */
 967
 968         if (q->flags & SD_RESOLVED_NO_CNAME)
 969                 return -ELOOP;
 970
 971         if (!q->answer_authenticated)
 972                 q->previous_redirect_unauthenticated = true;
 973
 974         /* OK, let's actually follow the CNAME */
 975         r = dns_query_cname_redirect(q, cname);
 976         if (r < 0)
 977                 return r;
 978
 979         /* Let's see if the answer can already answer the new
 980          * redirected question */
 981         r = dns_query_process_cname(q);
 982         if (r != DNS_QUERY_NOMATCH)
 983                 return r;
 984
 985         /* OK, it cannot, let's begin with the new query */
 986         r = dns_query_go(q);
 987         if (r < 0)
 988                 return r;
 989
 990         return DNS_QUERY_RESTARTED; /* We restarted the query for a new cname */
 991 }
 992
 993 static int on_bus_track(sd_bus_track *t, void *userdata) {
 994         DnsQuery *q = userdata;
 995
 996         assert(t);
 997         assert(q);
 998
 999         log_debug("Client of active query vanished, aborting query.");
1000         dns_query_complete(q, DNS_TRANSACTION_ABORTED);
1001         return 0;
1002 }
1003
1004 int dns_query_bus_track(DnsQuery *q, sd_bus_message *m) {
1005         int r;
1006
1007         assert(q);
1008         assert(m);
1009
1010         if (!q->bus_track) {
1011                 r = sd_bus_track_new(sd_bus_message_get_bus(m), &q->bus_track, on_bus_track, q);
1012                 if (r < 0)
1013                         return r;
1014         }
1015
1016         r = sd_bus_track_add_sender(q->bus_track, m);
1017         if (r < 0)
1018                 return r;
1019
1020         return 0;
1021 }
1022
1023 DnsQuestion* dns_query_question_for_protocol(DnsQuery *q, DnsProtocol protocol) {
1024         assert(q);
1025
1026         switch (protocol) {
1027
1028         case DNS_PROTOCOL_DNS:
1029                 return q->question_idna;
1030
1031         case DNS_PROTOCOL_MDNS:
1032         case DNS_PROTOCOL_LLMNR:
1033                 return q->question_utf8;
1034
1035         default:
1036                 return NULL;
1037         }
1038 }
1039
1040 const char *dns_query_string(DnsQuery *q) {
1041         const char *name;
1042         int r;
1043
1044         /* Returns a somewhat useful human-readable lookup key string for this query */
1045
1046         if (q->request_address_string)
1047                 return q->request_address_string;
1048
1049         if (q->request_address_valid) {
1050                 r = in_addr_to_string(q->request_family, &q->request_address, &q->request_address_string);
1051                 if (r >= 0)
1052                         return q->request_address_string;
1053         }
1054
1055         name = dns_question_first_name(q->question_utf8);
1056         if (name)
1057                 return name;
1058
1059         return dns_question_first_name(q->question_idna);
1060 }
1061
1062 bool dns_query_fully_authenticated(DnsQuery *q) {
1063         assert(q);
1064
1065         return q->answer_authenticated && !q->previous_redirect_unauthenticated;
1066 }