src/resolve/resolved-dns-server.c

   1 /*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
   2
   3 /***
   4   This file is part of systemd.
   5
   6   Copyright 2014 Lennart Poettering
   7
   8   systemd is free software; you can redistribute it and/or modify it
   9   under the terms of the GNU Lesser General Public License as published by
  10   the Free Software Foundation; either version 2.1 of the License, or
  11   (at your option) any later version.
  12
  13   systemd is distributed in the hope that it will be useful, but
  14   WITHOUT ANY WARRANTY; without even the implied warranty of
  15   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  16   Lesser General Public License for more details.
  17
  18   You should have received a copy of the GNU Lesser General Public License
  19   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  20 ***/
  21
  22 #include "alloc-util.h"
  23 #include "resolved-dns-server.h"
  24 #include "resolved-resolv-conf.h"
  25 #include "siphash24.h"
  26 #include "string-table.h"
  27 #include "string-util.h"
  28
  29 /* After how much time to repeat classic DNS requests */
  30 #define DNS_TIMEOUT_MIN_USEC (500 * USEC_PER_MSEC)
  31 #define DNS_TIMEOUT_MAX_USEC (5 * USEC_PER_SEC)
  32
  33 /* The amount of time to wait before retrying with a full feature set */
  34 #define DNS_SERVER_FEATURE_GRACE_PERIOD_MAX_USEC (6 * USEC_PER_HOUR)
  35 #define DNS_SERVER_FEATURE_GRACE_PERIOD_MIN_USEC (5 * USEC_PER_MINUTE)
  36
  37 /* The number of times we will attempt a certain feature set before degrading */
  38 #define DNS_SERVER_FEATURE_RETRY_ATTEMPTS 3
  39
  40 int dns_server_new(
  41                 Manager *m,
  42                 DnsServer **ret,
  43                 DnsServerType type,
  44                 Link *l,
  45                 int family,
  46                 const union in_addr_union *in_addr) {
  47
  48         DnsServer *s;
  49
  50         assert(m);
  51         assert((type == DNS_SERVER_LINK) == !!l);
  52         assert(in_addr);
  53
  54         if (!IN_SET(family, AF_INET, AF_INET6))
  55                 return -EAFNOSUPPORT;
  56
  57         if (l) {
  58                 if (l->n_dns_servers >= LINK_DNS_SERVERS_MAX)
  59                         return -E2BIG;
  60         } else {
  61                 if (m->n_dns_servers >= MANAGER_DNS_SERVERS_MAX)
  62                         return -E2BIG;
  63         }
  64
  65         s = new0(DnsServer, 1);
  66         if (!s)
  67                 return -ENOMEM;
  68
  69         s->n_ref = 1;
  70         s->manager = m;
  71         s->verified_feature_level = _DNS_SERVER_FEATURE_LEVEL_INVALID;
  72         s->possible_feature_level = DNS_SERVER_FEATURE_LEVEL_BEST;
  73         s->features_grace_period_usec = DNS_SERVER_FEATURE_GRACE_PERIOD_MIN_USEC;
  74         s->received_udp_packet_max = DNS_PACKET_UNICAST_SIZE_MAX;
  75         s->type = type;
  76         s->family = family;
  77         s->address = *in_addr;
  78         s->resend_timeout = DNS_TIMEOUT_MIN_USEC;
  79
  80         switch (type) {
  81
  82         case DNS_SERVER_LINK:
  83                 s->link = l;
  84                 LIST_APPEND(servers, l->dns_servers, s);
  85                 l->n_dns_servers++;
  86                 break;
  87
  88         case DNS_SERVER_SYSTEM:
  89                 LIST_APPEND(servers, m->dns_servers, s);
  90                 m->n_dns_servers++;
  91                 break;
  92
  93         case DNS_SERVER_FALLBACK:
  94                 LIST_APPEND(servers, m->fallback_dns_servers, s);
  95                 m->n_dns_servers++;
  96                 break;
  97
  98         default:
  99                 assert_not_reached("Unknown server type");
 100         }
 101
 102         s->linked = true;
 103
 104         /* A new DNS server that isn't fallback is added and the one
 105          * we used so far was a fallback one? Then let's try to pick
 106          * the new one */
 107         if (type != DNS_SERVER_FALLBACK &&
 108             m->current_dns_server &&
 109             m->current_dns_server->type == DNS_SERVER_FALLBACK)
 110                 manager_set_dns_server(m, NULL);
 111
 112         if (ret)
 113                 *ret = s;
 114
 115         return 0;
 116 }
 117
 118 DnsServer* dns_server_ref(DnsServer *s)  {
 119         if (!s)
 120                 return NULL;
 121
 122         assert(s->n_ref > 0);
 123         s->n_ref ++;
 124
 125         return s;
 126 }
 127
 128 DnsServer* dns_server_unref(DnsServer *s)  {
 129         if (!s)
 130                 return NULL;
 131
 132         assert(s->n_ref > 0);
 133         s->n_ref --;
 134
 135         if (s->n_ref > 0)
 136                 return NULL;
 137
 138         free(s->server_string);
 139         free(s);
 140         return NULL;
 141 }
 142
 143 void dns_server_unlink(DnsServer *s) {
 144         assert(s);
 145         assert(s->manager);
 146
 147         /* This removes the specified server from the linked list of
 148          * servers, but any server might still stay around if it has
 149          * refs, for example from an ongoing transaction. */
 150
 151         if (!s->linked)
 152                 return;
 153
 154         switch (s->type) {
 155
 156         case DNS_SERVER_LINK:
 157                 assert(s->link);
 158                 assert(s->link->n_dns_servers > 0);
 159                 LIST_REMOVE(servers, s->link->dns_servers, s);
 160                 break;
 161
 162         case DNS_SERVER_SYSTEM:
 163                 assert(s->manager->n_dns_servers > 0);
 164                 LIST_REMOVE(servers, s->manager->dns_servers, s);
 165                 s->manager->n_dns_servers--;
 166                 break;
 167
 168         case DNS_SERVER_FALLBACK:
 169                 assert(s->manager->n_dns_servers > 0);
 170                 LIST_REMOVE(servers, s->manager->fallback_dns_servers, s);
 171                 s->manager->n_dns_servers--;
 172                 break;
 173         }
 174
 175         s->linked = false;
 176
 177         if (s->link && s->link->current_dns_server == s)
 178                 link_set_dns_server(s->link, NULL);
 179
 180         if (s->manager->current_dns_server == s)
 181                 manager_set_dns_server(s->manager, NULL);
 182
 183         dns_server_unref(s);
 184 }
 185
 186 void dns_server_move_back_and_unmark(DnsServer *s) {
 187         DnsServer *tail;
 188
 189         assert(s);
 190
 191         if (!s->marked)
 192                 return;
 193
 194         s->marked = false;
 195
 196         if (!s->linked || !s->servers_next)
 197                 return;
 198
 199         /* Move us to the end of the list, so that the order is
 200          * strictly kept, if we are not at the end anyway. */
 201
 202         switch (s->type) {
 203
 204         case DNS_SERVER_LINK:
 205                 assert(s->link);
 206                 LIST_FIND_TAIL(servers, s, tail);
 207                 LIST_REMOVE(servers, s->link->dns_servers, s);
 208                 LIST_INSERT_AFTER(servers, s->link->dns_servers, tail, s);
 209                 break;
 210
 211         case DNS_SERVER_SYSTEM:
 212                 LIST_FIND_TAIL(servers, s, tail);
 213                 LIST_REMOVE(servers, s->manager->dns_servers, s);
 214                 LIST_INSERT_AFTER(servers, s->manager->dns_servers, tail, s);
 215                 break;
 216
 217         case DNS_SERVER_FALLBACK:
 218                 LIST_FIND_TAIL(servers, s, tail);
 219                 LIST_REMOVE(servers, s->manager->fallback_dns_servers, s);
 220                 LIST_INSERT_AFTER(servers, s->manager->fallback_dns_servers, tail, s);
 221                 break;
 222
 223         default:
 224                 assert_not_reached("Unknown server type");
 225         }
 226 }
 227
 228 static void dns_server_verified(DnsServer *s, DnsServerFeatureLevel level) {
 229         assert(s);
 230
 231         if (s->verified_feature_level > level)
 232                 return;
 233
 234         if (s->verified_feature_level != level) {
 235                 log_debug("Verified we get a response at feature level %s from DNS server %s.",
 236                           dns_server_feature_level_to_string(level),
 237                           dns_server_string(s));
 238                 s->verified_feature_level = level;
 239         }
 240
 241         assert_se(sd_event_now(s->manager->event, clock_boottime_or_monotonic(), &s->verified_usec) >= 0);
 242 }
 243
 244 void dns_server_packet_received(DnsServer *s, int protocol, DnsServerFeatureLevel level, usec_t rtt, size_t size) {
 245         assert(s);
 246
 247         if (protocol == IPPROTO_UDP) {
 248                 if (s->possible_feature_level == level)
 249                         s->n_failed_udp = 0;
 250
 251                 /* If the RRSIG data is missing, then we can only validate EDNS0 at max */
 252                 if (s->packet_rrsig_missing && level >= DNS_SERVER_FEATURE_LEVEL_DO)
 253                         level = DNS_SERVER_FEATURE_LEVEL_DO - 1;
 254
 255                 /* If the OPT RR got lost, then we can only validate UDP at max */
 256                 if (s->packet_bad_opt && level >= DNS_SERVER_FEATURE_LEVEL_EDNS0)
 257                         level = DNS_SERVER_FEATURE_LEVEL_EDNS0 - 1;
 258
 259                 /* Even if we successfully receive a reply to a request announcing support for large packets,
 260                    that does not mean we can necessarily receive large packets. */
 261                 if (level == DNS_SERVER_FEATURE_LEVEL_LARGE)
 262                         level = DNS_SERVER_FEATURE_LEVEL_LARGE - 1;
 263
 264         } else if (protocol == IPPROTO_TCP) {
 265
 266                 if (s->possible_feature_level == level)
 267                         s->n_failed_tcp = 0;
 268
 269                 /* Successful TCP connections are only useful to verify the TCP feature level. */
 270                 level = DNS_SERVER_FEATURE_LEVEL_TCP;
 271         }
 272
 273         dns_server_verified(s, level);
 274
 275         /* Remember the size of the largest UDP packet we received from a server,
 276            we know that we can always announce support for packets with at least
 277            this size. */
 278         if (protocol == IPPROTO_UDP && s->received_udp_packet_max < size)
 279                 s->received_udp_packet_max = size;
 280
 281         if (s->max_rtt < rtt) {
 282                 s->max_rtt = rtt;
 283                 s->resend_timeout = CLAMP(s->max_rtt * 2, DNS_TIMEOUT_MIN_USEC, DNS_TIMEOUT_MAX_USEC);
 284         }
 285 }
 286
 287 void dns_server_packet_lost(DnsServer *s, int protocol, DnsServerFeatureLevel level, usec_t usec) {
 288         assert(s);
 289         assert(s->manager);
 290
 291         if (s->possible_feature_level == level) {
 292                 if (protocol == IPPROTO_UDP)
 293                         s->n_failed_udp ++;
 294                 else if (protocol == IPPROTO_TCP)
 295                         s->n_failed_tcp ++;
 296         }
 297
 298         if (s->resend_timeout > usec)
 299                 return;
 300
 301         s->resend_timeout = MIN(s->resend_timeout * 2, DNS_TIMEOUT_MAX_USEC);
 302 }
 303
 304 void dns_server_packet_failed(DnsServer *s, DnsServerFeatureLevel level) {
 305         assert(s);
 306
 307         /* Invoked whenever we get a FORMERR, SERVFAIL or NOTIMP rcode from a server. */
 308
 309         if (s->possible_feature_level != level)
 310                 return;
 311
 312         s->packet_failed = true;
 313 }
 314
 315 void dns_server_packet_truncated(DnsServer *s, DnsServerFeatureLevel level) {
 316         assert(s);
 317
 318         /* Invoked whenever we get a packet with TC bit set. */
 319
 320         if (s->possible_feature_level != level)
 321                 return;
 322
 323         s->packet_truncated = true;
 324 }
 325
 326 void dns_server_packet_rrsig_missing(DnsServer *s, DnsServerFeatureLevel level) {
 327         assert(s);
 328
 329         if (level < DNS_SERVER_FEATURE_LEVEL_DO)
 330                 return;
 331
 332         /* If the RRSIG RRs are missing, we have to downgrade what we previously verified */
 333         if (s->verified_feature_level >= DNS_SERVER_FEATURE_LEVEL_DO)
 334                 s->verified_feature_level = DNS_SERVER_FEATURE_LEVEL_DO-1;
 335
 336         s->packet_rrsig_missing = true;
 337 }
 338
 339 void dns_server_packet_bad_opt(DnsServer *s, DnsServerFeatureLevel level) {
 340         assert(s);
 341
 342         if (level < DNS_SERVER_FEATURE_LEVEL_EDNS0)
 343                 return;
 344
 345         /* If the OPT RR got lost, we have to downgrade what we previously verified */
 346         if (s->verified_feature_level >= DNS_SERVER_FEATURE_LEVEL_EDNS0)
 347                 s->verified_feature_level = DNS_SERVER_FEATURE_LEVEL_EDNS0-1;
 348
 349         s->packet_bad_opt = true;
 350 }
 351
 352 static bool dns_server_grace_period_expired(DnsServer *s) {
 353         usec_t ts;
 354
 355         assert(s);
 356         assert(s->manager);
 357
 358         if (s->verified_usec == 0)
 359                 return false;
 360
 361         assert_se(sd_event_now(s->manager->event, clock_boottime_or_monotonic(), &ts) >= 0);
 362
 363         if (s->verified_usec + s->features_grace_period_usec > ts)
 364                 return false;
 365
 366         s->features_grace_period_usec = MIN(s->features_grace_period_usec * 2, DNS_SERVER_FEATURE_GRACE_PERIOD_MAX_USEC);
 367
 368         return true;
 369 }
 370
 371 static void dns_server_reset_counters(DnsServer *s) {
 372         assert(s);
 373
 374         s->n_failed_udp = 0;
 375         s->n_failed_tcp = 0;
 376         s->packet_failed = false;
 377         s->packet_truncated = false;
 378         s->packet_bad_opt = false;
 379         s->packet_rrsig_missing = false;
 380         s->verified_usec = 0;
 381 }
 382
 383 DnsServerFeatureLevel dns_server_possible_feature_level(DnsServer *s) {
 384         assert(s);
 385
 386         if (s->possible_feature_level != DNS_SERVER_FEATURE_LEVEL_BEST &&
 387             dns_server_grace_period_expired(s)) {
 388
 389                 s->possible_feature_level = DNS_SERVER_FEATURE_LEVEL_BEST;
 390                 dns_server_reset_counters(s);
 391
 392                 log_info("Grace period over, resuming full feature set (%s) for DNS server %s.",
 393                          dns_server_feature_level_to_string(s->possible_feature_level),
 394                          dns_server_string(s));
 395
 396         } else if (s->possible_feature_level <= s->verified_feature_level)
 397                 s->possible_feature_level = s->verified_feature_level;
 398         else {
 399                 DnsServerFeatureLevel p = s->possible_feature_level;
 400
 401                 if (s->n_failed_tcp >= DNS_SERVER_FEATURE_RETRY_ATTEMPTS &&
 402                     s->possible_feature_level == DNS_SERVER_FEATURE_LEVEL_TCP) {
 403
 404                         /* We are at the TCP (lowest) level, and we tried a couple of TCP connections, and it didn't
 405                          * work. Upgrade back to UDP again. */
 406                         log_debug("Reached maximum number of failed TCP connection attempts, trying UDP again...");
 407                         s->possible_feature_level = DNS_SERVER_FEATURE_LEVEL_UDP;
 408
 409                 } else if (s->packet_bad_opt &&
 410                            s->possible_feature_level >= DNS_SERVER_FEATURE_LEVEL_EDNS0) {
 411
 412                         /* A reply to one of our EDNS0 queries didn't carry a valid OPT RR, then downgrade to below
 413                          * EDNS0 levels. After all, some records generate different responses with and without OPT RR
 414                          * in the request. Example:
 415                          * https://open.nlnetlabs.nl/pipermail/dnssec-trigger/2014-November/000376.html */
 416
 417                         log_debug("Server doesn't support EDNS(0) properly, downgrading feature level...");
 418                         s->possible_feature_level = DNS_SERVER_FEATURE_LEVEL_UDP;
 419
 420                 } else if (s->packet_rrsig_missing &&
 421                            s->possible_feature_level >= DNS_SERVER_FEATURE_LEVEL_DO) {
 422
 423                         /* RRSIG data was missing on a EDNS0 packet with DO bit set. This means the server doesn't
 424                          * augment responses with DNSSEC RRs. If so, let's better not ask the server for it anymore,
 425                          * after all some servers generate different replies depending if an OPT RR is in the query or
 426                          * not. */
 427
 428                         log_debug("Detected server responses lack RRSIG records, downgrading feature level...");
 429                         s->possible_feature_level = DNS_SERVER_FEATURE_LEVEL_EDNS0;
 430
 431                 } else if (s->n_failed_udp >= DNS_SERVER_FEATURE_RETRY_ATTEMPTS &&
 432                             s->possible_feature_level >= DNS_SERVER_FEATURE_LEVEL_UDP) {
 433
 434                         /* We lost too many UDP packets in a row, and are on a feature level of UDP or higher. If the
 435                          * packets are lost, maybe the server cannot parse them, hence downgrading sounds like a good
 436                          * idea. We might downgrade all the way down to TCP this way. */
 437
 438                         log_debug("Lost too many UDP packets, downgrading feature level...");
 439                         s->possible_feature_level--;
 440
 441                 } else if (s->packet_failed &&
 442                            s->possible_feature_level > DNS_SERVER_FEATURE_LEVEL_UDP) {
 443
 444                         /* We got a failure packet, and are at a feature level above UDP. Note that in this case we
 445                          * downgrade no further than UDP, under the assumption that a failure packet indicates an
 446                          * incompatible packet contents, but not a problem with the transport. */
 447
 448                         log_debug("Got server failure, downgrading feature level...");
 449                         s->possible_feature_level--;
 450
 451                 } else if (s->n_failed_tcp >= DNS_SERVER_FEATURE_RETRY_ATTEMPTS &&
 452                            s->packet_truncated &&
 453                            s->possible_feature_level > DNS_SERVER_FEATURE_LEVEL_UDP) {
 454
 455                          /* We got too many TCP connection failures in a row, we had at least one truncated packet, and
 456                           * are on a feature level above UDP. By downgrading things and getting rid of DNSSEC or EDNS0
 457                           * data we hope to make the packet smaller, so that it still works via UDP given that TCP
 458                           * appears not to be a fallback. Note that if we are already at the lowest UDP level, we don't
 459                           * go further down, since that's TCP, and TCP failed too often after all. */
 460
 461                         log_debug("Got too many failed TCP connection failures and truncated UDP packets, downgrading feature level...");
 462                         s->possible_feature_level--;
 463                 }
 464
 465                 if (p != s->possible_feature_level) {
 466
 467                         /* We changed the feature level, reset the counting */
 468                         dns_server_reset_counters(s);
 469
 470                         log_warning("Using degraded feature set (%s) for DNS server %s.",
 471                                     dns_server_feature_level_to_string(s->possible_feature_level),
 472                                     dns_server_string(s));
 473                 }
 474         }
 475
 476         return s->possible_feature_level;
 477 }
 478
 479 int dns_server_adjust_opt(DnsServer *server, DnsPacket *packet, DnsServerFeatureLevel level) {
 480         size_t packet_size;
 481         bool edns_do;
 482         int r;
 483
 484         assert(server);
 485         assert(packet);
 486         assert(packet->protocol == DNS_PROTOCOL_DNS);
 487
 488         /* Fix the OPT field in the packet to match our current feature level. */
 489
 490         r = dns_packet_truncate_opt(packet);
 491         if (r < 0)
 492                 return r;
 493
 494         if (level < DNS_SERVER_FEATURE_LEVEL_EDNS0)
 495                 return 0;
 496
 497         edns_do = level >= DNS_SERVER_FEATURE_LEVEL_DO;
 498
 499         if (level >= DNS_SERVER_FEATURE_LEVEL_LARGE)
 500                 packet_size = DNS_PACKET_UNICAST_SIZE_LARGE_MAX;
 501         else
 502                 packet_size = server->received_udp_packet_max;
 503
 504         return dns_packet_append_opt(packet, packet_size, edns_do, NULL);
 505 }
 506
 507 const char *dns_server_string(DnsServer *server) {
 508         assert(server);
 509
 510         if (!server->server_string)
 511                 (void) in_addr_to_string(server->family, &server->address, &server->server_string);
 512
 513         return strna(server->server_string);
 514 }
 515
 516 bool dns_server_dnssec_supported(DnsServer *server) {
 517         assert(server);
 518
 519         /* Returns whether the server supports DNSSEC according to what we know about it */
 520
 521         if (server->possible_feature_level < DNS_SERVER_FEATURE_LEVEL_DO)
 522                 return false;
 523
 524         if (server->packet_bad_opt)
 525                 return false;
 526
 527         if (server->packet_rrsig_missing)
 528                 return false;
 529
 530         /* DNSSEC servers need to support TCP properly (see RFC5966), if they don't, we assume DNSSEC is borked too */
 531         if (server->n_failed_tcp >= DNS_SERVER_FEATURE_RETRY_ATTEMPTS)
 532                 return false;
 533
 534         return true;
 535 }
 536
 537 static void dns_server_hash_func(const void *p, struct siphash *state) {
 538         const DnsServer *s = p;
 539
 540         assert(s);
 541
 542         siphash24_compress(&s->family, sizeof(s->family), state);
 543         siphash24_compress(&s->address, FAMILY_ADDRESS_SIZE(s->family), state);
 544 }
 545
 546 static int dns_server_compare_func(const void *a, const void *b) {
 547         const DnsServer *x = a, *y = b;
 548
 549         if (x->family < y->family)
 550                 return -1;
 551         if (x->family > y->family)
 552                 return 1;
 553
 554         return memcmp(&x->address, &y->address, FAMILY_ADDRESS_SIZE(x->family));
 555 }
 556
 557 const struct hash_ops dns_server_hash_ops = {
 558         .hash = dns_server_hash_func,
 559         .compare = dns_server_compare_func
 560 };
 561
 562 void dns_server_unlink_all(DnsServer *first) {
 563         DnsServer *next;
 564
 565         if (!first)
 566                 return;
 567
 568         next = first->servers_next;
 569         dns_server_unlink(first);
 570
 571         dns_server_unlink_all(next);
 572 }
 573
 574 void dns_server_unlink_marked(DnsServer *first) {
 575         DnsServer *next;
 576
 577         if (!first)
 578                 return;
 579
 580         next = first->servers_next;
 581
 582         if (first->marked)
 583                 dns_server_unlink(first);
 584
 585         dns_server_unlink_marked(next);
 586 }
 587
 588 void dns_server_mark_all(DnsServer *first) {
 589         if (!first)
 590                 return;
 591
 592         first->marked = true;
 593         dns_server_mark_all(first->servers_next);
 594 }
 595
 596 DnsServer *dns_server_find(DnsServer *first, int family, const union in_addr_union *in_addr) {
 597         DnsServer *s;
 598
 599         LIST_FOREACH(servers, s, first)
 600                 if (s->family == family && in_addr_equal(family, &s->address, in_addr) > 0)
 601                         return s;
 602
 603         return NULL;
 604 }
 605
 606 DnsServer *manager_get_first_dns_server(Manager *m, DnsServerType t) {
 607         assert(m);
 608
 609         switch (t) {
 610
 611         case DNS_SERVER_SYSTEM:
 612                 return m->dns_servers;
 613
 614         case DNS_SERVER_FALLBACK:
 615                 return m->fallback_dns_servers;
 616
 617         default:
 618                 return NULL;
 619         }
 620 }
 621
 622 DnsServer *manager_set_dns_server(Manager *m, DnsServer *s) {
 623         assert(m);
 624
 625         if (m->current_dns_server == s)
 626                 return s;
 627
 628         if (s)
 629                 log_info("Switching to system DNS server %s.", dns_server_string(s));
 630
 631         dns_server_unref(m->current_dns_server);
 632         m->current_dns_server = dns_server_ref(s);
 633
 634         if (m->unicast_scope)
 635                 dns_cache_flush(&m->unicast_scope->cache);
 636
 637         return s;
 638 }
 639
 640 DnsServer *manager_get_dns_server(Manager *m) {
 641         Link *l;
 642         assert(m);
 643
 644         /* Try to read updates resolv.conf */
 645         manager_read_resolv_conf(m);
 646
 647         /* If no DNS server was chose so far, pick the first one */
 648         if (!m->current_dns_server)
 649                 manager_set_dns_server(m, m->dns_servers);
 650
 651         if (!m->current_dns_server) {
 652                 bool found = false;
 653                 Iterator i;
 654
 655                 /* No DNS servers configured, let's see if there are
 656                  * any on any links. If not, we use the fallback
 657                  * servers */
 658
 659                 HASHMAP_FOREACH(l, m->links, i)
 660                         if (l->dns_servers) {
 661                                 found = true;
 662                                 break;
 663                         }
 664
 665                 if (!found)
 666                         manager_set_dns_server(m, m->fallback_dns_servers);
 667         }
 668
 669         return m->current_dns_server;
 670 }
 671
 672 void manager_next_dns_server(Manager *m) {
 673         assert(m);
 674
 675         /* If there's currently no DNS server set, then the next
 676          * manager_get_dns_server() will find one */
 677         if (!m->current_dns_server)
 678                 return;
 679
 680         /* Change to the next one, but make sure to follow the linked
 681          * list only if the server is still linked. */
 682         if (m->current_dns_server->linked && m->current_dns_server->servers_next) {
 683                 manager_set_dns_server(m, m->current_dns_server->servers_next);
 684                 return;
 685         }
 686
 687         /* If there was no next one, then start from the beginning of
 688          * the list */
 689         if (m->current_dns_server->type == DNS_SERVER_FALLBACK)
 690                 manager_set_dns_server(m, m->fallback_dns_servers);
 691         else
 692                 manager_set_dns_server(m, m->dns_servers);
 693 }
 694
 695 static const char* const dns_server_feature_level_table[_DNS_SERVER_FEATURE_LEVEL_MAX] = {
 696         [DNS_SERVER_FEATURE_LEVEL_TCP] = "TCP",
 697         [DNS_SERVER_FEATURE_LEVEL_UDP] = "UDP",
 698         [DNS_SERVER_FEATURE_LEVEL_EDNS0] = "UDP+EDNS0",
 699         [DNS_SERVER_FEATURE_LEVEL_DO] = "UDP+EDNS0+DO",
 700         [DNS_SERVER_FEATURE_LEVEL_LARGE] = "UDP+EDNS0+DO+LARGE",
 701 };
 702 DEFINE_STRING_TABLE_LOOKUP(dns_server_feature_level, DnsServerFeatureLevel);