src/resolve/resolved-dns-transaction.c

   1 /*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
   2
   3 /***
   4   This file is part of systemd.
   5
   6   Copyright 2014 Lennart Poettering
   7
   8   systemd is free software; you can redistribute it and/or modify it
   9   under the terms of the GNU Lesser General Public License as published by
  10   the Free Software Foundation; either version 2.1 of the License, or
  11   (at your option) any later version.
  12
  13   systemd is distributed in the hope that it will be useful, but
  14   WITHOUT ANY WARRANTY; without even the implied warranty of
  15   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  16   Lesser General Public License for more details.
  17
  18   You should have received a copy of the GNU Lesser General Public License
  19   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  20 ***/
  21
  22 #include "af-list.h"
  23 #include "alloc-util.h"
  24 #include "dns-domain.h"
  25 #include "fd-util.h"
  26 #include "random-util.h"
  27 #include "resolved-dns-transaction.h"
  28 #include "resolved-llmnr.h"
  29 #include "string-table.h"
  30
  31 DnsTransaction* dns_transaction_free(DnsTransaction *t) {
  32         DnsQueryCandidate *c;
  33         DnsZoneItem *i;
  34
  35         if (!t)
  36                 return NULL;
  37
  38         sd_event_source_unref(t->timeout_event_source);
  39
  40         dns_packet_unref(t->sent);
  41         dns_packet_unref(t->received);
  42
  43         dns_answer_unref(t->answer);
  44
  45         sd_event_source_unref(t->dns_udp_event_source);
  46         safe_close(t->dns_udp_fd);
  47
  48         dns_server_unref(t->server);
  49         dns_stream_free(t->stream);
  50
  51         if (t->scope) {
  52                 hashmap_remove_value(t->scope->transactions_by_key, t->key, t);
  53                 LIST_REMOVE(transactions_by_scope, t->scope->transactions, t);
  54
  55                 if (t->id != 0)
  56                         hashmap_remove(t->scope->manager->dns_transactions, UINT_TO_PTR(t->id));
  57         }
  58
  59         dns_resource_key_unref(t->key);
  60
  61         while ((c = set_steal_first(t->query_candidates)))
  62                 set_remove(c->transactions, t);
  63
  64         set_free(t->query_candidates);
  65
  66         while ((i = set_steal_first(t->zone_items)))
  67                 i->probe_transaction = NULL;
  68         set_free(t->zone_items);
  69
  70         free(t);
  71         return NULL;
  72 }
  73
  74 DEFINE_TRIVIAL_CLEANUP_FUNC(DnsTransaction*, dns_transaction_free);
  75
  76 void dns_transaction_gc(DnsTransaction *t) {
  77         assert(t);
  78
  79         if (t->block_gc > 0)
  80                 return;
  81
  82         if (set_isempty(t->query_candidates) && set_isempty(t->zone_items))
  83                 dns_transaction_free(t);
  84 }
  85
  86 int dns_transaction_new(DnsTransaction **ret, DnsScope *s, DnsResourceKey *key) {
  87         _cleanup_(dns_transaction_freep) DnsTransaction *t = NULL;
  88         int r;
  89
  90         assert(ret);
  91         assert(s);
  92         assert(key);
  93
  94         r = hashmap_ensure_allocated(&s->manager->dns_transactions, NULL);
  95         if (r < 0)
  96                 return r;
  97
  98         r = hashmap_ensure_allocated(&s->transactions_by_key, &dns_resource_key_hash_ops);
  99         if (r < 0)
 100                 return r;
 101
 102         t = new0(DnsTransaction, 1);
 103         if (!t)
 104                 return -ENOMEM;
 105
 106         t->dns_udp_fd = -1;
 107         t->answer_source = _DNS_TRANSACTION_SOURCE_INVALID;
 108         t->key = dns_resource_key_ref(key);
 109
 110         /* Find a fresh, unused transaction id */
 111         do
 112                 random_bytes(&t->id, sizeof(t->id));
 113         while (t->id == 0 ||
 114                hashmap_get(s->manager->dns_transactions, UINT_TO_PTR(t->id)));
 115
 116         r = hashmap_put(s->manager->dns_transactions, UINT_TO_PTR(t->id), t);
 117         if (r < 0) {
 118                 t->id = 0;
 119                 return r;
 120         }
 121
 122         r = hashmap_replace(s->transactions_by_key, t->key, t);
 123         if (r < 0) {
 124                 hashmap_remove(s->manager->dns_transactions, UINT_TO_PTR(t->id));
 125                 return r;
 126         }
 127
 128         LIST_PREPEND(transactions_by_scope, s->transactions, t);
 129         t->scope = s;
 130
 131         if (ret)
 132                 *ret = t;
 133
 134         t = NULL;
 135
 136         return 0;
 137 }
 138
 139 static void dns_transaction_stop(DnsTransaction *t) {
 140         assert(t);
 141
 142         t->timeout_event_source = sd_event_source_unref(t->timeout_event_source);
 143         t->stream = dns_stream_free(t->stream);
 144
 145         /* Note that we do not drop the UDP socket here, as we want to
 146          * reuse it to repeat the interaction. */
 147 }
 148
 149 static void dns_transaction_tentative(DnsTransaction *t, DnsPacket *p) {
 150         _cleanup_free_ char *pretty = NULL;
 151         DnsZoneItem *z;
 152
 153         assert(t);
 154         assert(p);
 155
 156         if (manager_our_packet(t->scope->manager, p) != 0)
 157                 return;
 158
 159         in_addr_to_string(p->family, &p->sender, &pretty);
 160
 161         log_debug("Transaction on scope %s on %s/%s got tentative packet from %s",
 162                   dns_protocol_to_string(t->scope->protocol),
 163                   t->scope->link ? t->scope->link->name : "*",
 164                   t->scope->family == AF_UNSPEC ? "*" : af_to_name(t->scope->family),
 165                   pretty);
 166
 167         /* RFC 4795, Section 4.1 says that the peer with the
 168          * lexicographically smaller IP address loses */
 169         if (memcmp(&p->sender, &p->destination, FAMILY_ADDRESS_SIZE(p->family)) >= 0) {
 170                 log_debug("Peer has lexicographically larger IP address and thus lost in the conflict.");
 171                 return;
 172         }
 173
 174         log_debug("We have the lexicographically larger IP address and thus lost in the conflict.");
 175
 176         t->block_gc++;
 177         while ((z = set_first(t->zone_items))) {
 178                 /* First, make sure the zone item drops the reference
 179                  * to us */
 180                 dns_zone_item_probe_stop(z);
 181
 182                 /* Secondly, report this as conflict, so that we might
 183                  * look for a different hostname */
 184                 dns_zone_item_conflict(z);
 185         }
 186         t->block_gc--;
 187
 188         dns_transaction_gc(t);
 189 }
 190
 191 void dns_transaction_complete(DnsTransaction *t, DnsTransactionState state) {
 192         DnsQueryCandidate *c;
 193         DnsZoneItem *z;
 194         Iterator i;
 195
 196         assert(t);
 197         assert(!IN_SET(state, DNS_TRANSACTION_NULL, DNS_TRANSACTION_PENDING));
 198
 199         /* Note that this call might invalidate the query. Callers
 200          * should hence not attempt to access the query or transaction
 201          * after calling this function. */
 202
 203         log_debug("Transaction on scope %s on %s/%s now complete with <%s> from %s",
 204                   dns_protocol_to_string(t->scope->protocol),
 205                   t->scope->link ? t->scope->link->name : "*",
 206                   t->scope->family == AF_UNSPEC ? "*" : af_to_name(t->scope->family),
 207                   dns_transaction_state_to_string(state),
 208                   t->answer_source < 0 ? "none" : dns_transaction_source_to_string(t->answer_source));
 209
 210         t->state = state;
 211
 212         dns_transaction_stop(t);
 213
 214         /* Notify all queries that are interested, but make sure the
 215          * transaction isn't freed while we are still looking at it */
 216         t->block_gc++;
 217         SET_FOREACH(c, t->query_candidates, i)
 218                 dns_query_candidate_ready(c);
 219         SET_FOREACH(z, t->zone_items, i)
 220                 dns_zone_item_ready(z);
 221         t->block_gc--;
 222
 223         dns_transaction_gc(t);
 224 }
 225
 226 static int on_stream_complete(DnsStream *s, int error) {
 227         _cleanup_(dns_packet_unrefp) DnsPacket *p = NULL;
 228         DnsTransaction *t;
 229
 230         assert(s);
 231         assert(s->transaction);
 232
 233         /* Copy the data we care about out of the stream before we
 234          * destroy it. */
 235         t = s->transaction;
 236         p = dns_packet_ref(s->read_packet);
 237
 238         t->stream = dns_stream_free(t->stream);
 239
 240         if (error != 0) {
 241                 dns_transaction_complete(t, DNS_TRANSACTION_RESOURCES);
 242                 return 0;
 243         }
 244
 245         if (dns_packet_validate_reply(p) <= 0) {
 246                 log_debug("Invalid LLMNR TCP packet.");
 247                 dns_transaction_complete(t, DNS_TRANSACTION_INVALID_REPLY);
 248                 return 0;
 249         }
 250
 251         dns_scope_check_conflicts(t->scope, p);
 252
 253         t->block_gc++;
 254         dns_transaction_process_reply(t, p);
 255         t->block_gc--;
 256
 257         /* If the response wasn't useful, then complete the transition now */
 258         if (t->state == DNS_TRANSACTION_PENDING)
 259                 dns_transaction_complete(t, DNS_TRANSACTION_INVALID_REPLY);
 260
 261         return 0;
 262 }
 263
 264 static int dns_transaction_open_tcp(DnsTransaction *t) {
 265         DnsServer *server = NULL;
 266         _cleanup_close_ int fd = -1;
 267         int r;
 268
 269         assert(t);
 270
 271         if (t->stream)
 272                 return 0;
 273
 274         switch (t->scope->protocol) {
 275         case DNS_PROTOCOL_DNS:
 276                 fd = dns_scope_tcp_socket(t->scope, AF_UNSPEC, NULL, 53, &server);
 277                 break;
 278
 279         case DNS_PROTOCOL_LLMNR:
 280                 /* When we already received a reply to this (but it was truncated), send to its sender address */
 281                 if (t->received)
 282                         fd = dns_scope_tcp_socket(t->scope, t->received->family, &t->received->sender, t->received->sender_port, NULL);
 283                 else {
 284                         union in_addr_union address;
 285                         int family = AF_UNSPEC;
 286
 287                         /* Otherwise, try to talk to the owner of a
 288                          * the IP address, in case this is a reverse
 289                          * PTR lookup */
 290
 291                         r = dns_name_address(DNS_RESOURCE_KEY_NAME(t->key), &family, &address);
 292                         if (r < 0)
 293                                 return r;
 294                         if (r == 0)
 295                                 return -EINVAL;
 296                         if (family != t->scope->family)
 297                                 return -ESRCH;
 298
 299                         fd = dns_scope_tcp_socket(t->scope, family, &address, LLMNR_PORT, NULL);
 300                 }
 301
 302                 break;
 303
 304         default:
 305                 return -EAFNOSUPPORT;
 306         }
 307
 308         if (fd < 0)
 309                 return fd;
 310
 311         r = dns_stream_new(t->scope->manager, &t->stream, t->scope->protocol, fd);
 312         if (r < 0)
 313                 return r;
 314
 315         fd = -1;
 316
 317         r = dns_stream_write_packet(t->stream, t->sent);
 318         if (r < 0) {
 319                 t->stream = dns_stream_free(t->stream);
 320                 return r;
 321         }
 322
 323         dns_server_unref(t->server);
 324         t->server = dns_server_ref(server);
 325         t->received = dns_packet_unref(t->received);
 326         t->answer = dns_answer_unref(t->answer);
 327         t->answer_rcode = 0;
 328         t->stream->complete = on_stream_complete;
 329         t->stream->transaction = t;
 330
 331         /* The interface index is difficult to determine if we are
 332          * connecting to the local host, hence fill this in right away
 333          * instead of determining it from the socket */
 334         if (t->scope->link)
 335                 t->stream->ifindex = t->scope->link->ifindex;
 336
 337         return 0;
 338 }
 339
 340 static void dns_transaction_next_dns_server(DnsTransaction *t) {
 341         assert(t);
 342
 343         t->server = dns_server_unref(t->server);
 344         t->dns_udp_event_source = sd_event_source_unref(t->dns_udp_event_source);
 345         t->dns_udp_fd = safe_close(t->dns_udp_fd);
 346
 347         dns_scope_next_dns_server(t->scope);
 348 }
 349
 350 void dns_transaction_process_reply(DnsTransaction *t, DnsPacket *p) {
 351         usec_t ts;
 352         int r;
 353
 354         assert(t);
 355         assert(p);
 356         assert(t->state == DNS_TRANSACTION_PENDING);
 357         assert(t->scope);
 358         assert(t->scope->manager);
 359
 360         /* Note that this call might invalidate the query. Callers
 361          * should hence not attempt to access the query or transaction
 362          * after calling this function. */
 363
 364         switch (t->scope->protocol) {
 365         case DNS_PROTOCOL_LLMNR:
 366                 assert(t->scope->link);
 367
 368                 /* For LLMNR we will not accept any packets from other
 369                  * interfaces */
 370
 371                 if (p->ifindex != t->scope->link->ifindex)
 372                         return;
 373
 374                 if (p->family != t->scope->family)
 375                         return;
 376
 377                 /* Tentative packets are not full responses but still
 378                  * useful for identifying uniqueness conflicts during
 379                  * probing. */
 380                 if (DNS_PACKET_LLMNR_T(p)) {
 381                         dns_transaction_tentative(t, p);
 382                         return;
 383                 }
 384
 385                 break;
 386
 387         case DNS_PROTOCOL_DNS:
 388                 break;
 389
 390         default:
 391                 assert_not_reached("Invalid DNS protocol.");
 392         }
 393
 394         if (t->received != p) {
 395                 dns_packet_unref(t->received);
 396                 t->received = dns_packet_ref(p);
 397         }
 398
 399         t->answer_source = DNS_TRANSACTION_NETWORK;
 400
 401         if (p->ipproto == IPPROTO_TCP) {
 402                 if (DNS_PACKET_TC(p)) {
 403                         /* Truncated via TCP? Somebody must be fucking with us */
 404                         dns_transaction_complete(t, DNS_TRANSACTION_INVALID_REPLY);
 405                         return;
 406                 }
 407
 408                 if (DNS_PACKET_ID(p) != t->id) {
 409                         /* Not the reply to our query? Somebody must be fucking with us */
 410                         dns_transaction_complete(t, DNS_TRANSACTION_INVALID_REPLY);
 411                         return;
 412                 }
 413         }
 414
 415         assert_se(sd_event_now(t->scope->manager->event, clock_boottime_or_monotonic(), &ts) >= 0);
 416
 417         switch (t->scope->protocol) {
 418         case DNS_PROTOCOL_DNS:
 419                 assert(t->server);
 420
 421                 if (IN_SET(DNS_PACKET_RCODE(p), DNS_RCODE_FORMERR, DNS_RCODE_SERVFAIL, DNS_RCODE_NOTIMP)) {
 422
 423                         /* request failed, immediately try again with reduced features */
 424                         log_debug("Server returned error: %s", dns_rcode_to_string(DNS_PACKET_RCODE(p)));
 425
 426                         dns_server_packet_failed(t->server, t->current_features);
 427
 428                         r = dns_transaction_go(t);
 429                         if (r < 0) {
 430                                 dns_transaction_complete(t, DNS_TRANSACTION_RESOURCES);
 431                                 return;
 432                         }
 433
 434                         return;
 435                 } else
 436                         dns_server_packet_received(t->server, t->current_features, ts - t->start_usec, p->size);
 437
 438                 break;
 439         case DNS_PROTOCOL_LLMNR:
 440         case DNS_PROTOCOL_MDNS:
 441                 dns_scope_packet_received(t->scope, ts - t->start_usec);
 442
 443                 break;
 444         default:
 445                 break;
 446         }
 447
 448         if (DNS_PACKET_TC(p)) {
 449                 /* Response was truncated, let's try again with good old TCP */
 450                 r = dns_transaction_open_tcp(t);
 451                 if (r == -ESRCH) {
 452                         /* No servers found? Damn! */
 453                         dns_transaction_complete(t, DNS_TRANSACTION_NO_SERVERS);
 454                         return;
 455                 }
 456                 if (r < 0) {
 457                         /* On LLMNR, if we cannot connect to the host,
 458                          * we immediately give up */
 459                         if (t->scope->protocol == DNS_PROTOCOL_LLMNR) {
 460                                 dns_transaction_complete(t, DNS_TRANSACTION_RESOURCES);
 461                                 return;
 462                         }
 463
 464                         /* On DNS, couldn't send? Try immediately again, with a new server */
 465                         dns_transaction_next_dns_server(t);
 466
 467                         r = dns_transaction_go(t);
 468                         if (r < 0) {
 469                                 dns_transaction_complete(t, DNS_TRANSACTION_RESOURCES);
 470                                 return;
 471                         }
 472
 473                         return;
 474                 }
 475         }
 476
 477         /* Parse and update the cache */
 478         r = dns_packet_extract(p);
 479         if (r < 0) {
 480                 dns_transaction_complete(t, DNS_TRANSACTION_INVALID_REPLY);
 481                 return;
 482         }
 483
 484         /* Install the answer as answer to the transaction */
 485         dns_answer_unref(t->answer);
 486         t->answer = dns_answer_ref(p->answer);
 487         t->answer_rcode = DNS_PACKET_RCODE(p);
 488
 489         /* Only consider responses with equivalent query section to the request */
 490         if (p->question->n_keys != 1 || dns_resource_key_equal(p->question->keys[0], t->key) <= 0) {
 491                 dns_transaction_complete(t, DNS_TRANSACTION_INVALID_REPLY);
 492                 return;
 493         }
 494
 495         /* According to RFC 4795, section 2.9. only the RRs from the answer section shall be cached */
 496         if (DNS_PACKET_SHALL_CACHE(p))
 497                 dns_cache_put(&t->scope->cache, t->key, DNS_PACKET_RCODE(p), p->answer, DNS_PACKET_ANCOUNT(p), 0, p->family, &p->sender);
 498
 499         if (DNS_PACKET_RCODE(p) == DNS_RCODE_SUCCESS)
 500                 dns_transaction_complete(t, DNS_TRANSACTION_SUCCESS);
 501         else
 502                 dns_transaction_complete(t, DNS_TRANSACTION_FAILURE);
 503 }
 504
 505 static int on_dns_packet(sd_event_source *s, int fd, uint32_t revents, void *userdata) {
 506         _cleanup_(dns_packet_unrefp) DnsPacket *p = NULL;
 507         DnsTransaction *t = userdata;
 508         int r;
 509
 510         assert(t);
 511         assert(t->scope);
 512
 513         r = manager_recv(t->scope->manager, fd, DNS_PROTOCOL_DNS, &p);
 514         if (r <= 0)
 515                 return r;
 516
 517         if (dns_packet_validate_reply(p) > 0 &&
 518             DNS_PACKET_ID(p) == t->id)
 519                 dns_transaction_process_reply(t, p);
 520         else
 521                 log_debug("Invalid DNS packet.");
 522
 523         return 0;
 524 }
 525
 526 static int dns_transaction_emit(DnsTransaction *t) {
 527         int r;
 528
 529         assert(t);
 530
 531         if (t->scope->protocol == DNS_PROTOCOL_DNS && !t->server) {
 532                 DnsServer *server = NULL;
 533                 _cleanup_close_ int fd = -1;
 534
 535                 fd = dns_scope_udp_dns_socket(t->scope, &server);
 536                 if (fd < 0)
 537                         return fd;
 538
 539                 r = sd_event_add_io(t->scope->manager->event, &t->dns_udp_event_source, fd, EPOLLIN, on_dns_packet, t);
 540                 if (r < 0)
 541                         return r;
 542
 543                 t->dns_udp_fd = fd;
 544                 fd = -1;
 545                 t->server = dns_server_ref(server);
 546         }
 547
 548         r = dns_scope_emit(t->scope, t->dns_udp_fd, t->server, t->sent);
 549         if (r < 0)
 550                 return r;
 551
 552         if (t->server)
 553                 t->current_features = t->server->possible_features;
 554
 555         return 0;
 556 }
 557
 558 static int on_transaction_timeout(sd_event_source *s, usec_t usec, void *userdata) {
 559         DnsTransaction *t = userdata;
 560         int r;
 561
 562         assert(s);
 563         assert(t);
 564
 565         /* Timeout reached? Increase the timeout for the server used */
 566         switch (t->scope->protocol) {
 567         case DNS_PROTOCOL_DNS:
 568                 assert(t->server);
 569
 570                 dns_server_packet_lost(t->server, t->current_features, usec - t->start_usec);
 571
 572                 break;
 573         case DNS_PROTOCOL_LLMNR:
 574         case DNS_PROTOCOL_MDNS:
 575                 dns_scope_packet_lost(t->scope, usec - t->start_usec);
 576
 577                 break;
 578         default:
 579                 assert_not_reached("Invalid DNS protocol.");
 580         }
 581
 582         /* ...and try again with a new server */
 583         dns_transaction_next_dns_server(t);
 584
 585         r = dns_transaction_go(t);
 586         if (r < 0)
 587                 dns_transaction_complete(t, DNS_TRANSACTION_RESOURCES);
 588
 589         return 0;
 590 }
 591
 592 static int dns_transaction_make_packet(DnsTransaction *t) {
 593         _cleanup_(dns_packet_unrefp) DnsPacket *p = NULL;
 594         int r;
 595
 596         assert(t);
 597
 598         if (t->sent)
 599                 return 0;
 600
 601         r = dns_packet_new_query(&p, t->scope->protocol, 0);
 602         if (r < 0)
 603                 return r;
 604
 605         r = dns_scope_good_key(t->scope, t->key);
 606         if (r < 0)
 607                 return r;
 608         if (r == 0)
 609                 return -EDOM;
 610
 611         r = dns_packet_append_key(p, t->key, NULL);
 612         if (r < 0)
 613                 return r;
 614
 615         DNS_PACKET_HEADER(p)->qdcount = htobe16(1);
 616         DNS_PACKET_HEADER(p)->id = t->id;
 617
 618         t->sent = p;
 619         p = NULL;
 620
 621         return 0;
 622 }
 623
 624 static usec_t transaction_get_resend_timeout(DnsTransaction *t) {
 625         assert(t);
 626         assert(t->scope);
 627
 628         switch (t->scope->protocol) {
 629         case DNS_PROTOCOL_DNS:
 630                 assert(t->server);
 631
 632                 return t->server->resend_timeout;
 633         case DNS_PROTOCOL_LLMNR:
 634         case DNS_PROTOCOL_MDNS:
 635                 return t->scope->resend_timeout;
 636         default:
 637                 assert_not_reached("Invalid DNS protocol.");
 638         }
 639 }
 640
 641 int dns_transaction_go(DnsTransaction *t) {
 642         bool had_stream;
 643         usec_t ts;
 644         int r;
 645
 646         assert(t);
 647
 648         had_stream = !!t->stream;
 649
 650         dns_transaction_stop(t);
 651
 652         log_debug("Excercising transaction on scope %s on %s/%s",
 653                   dns_protocol_to_string(t->scope->protocol),
 654                   t->scope->link ? t->scope->link->name : "*",
 655                   t->scope->family == AF_UNSPEC ? "*" : af_to_name(t->scope->family));
 656
 657         if (t->n_attempts >= TRANSACTION_ATTEMPTS_MAX(t->scope->protocol)) {
 658                 dns_transaction_complete(t, DNS_TRANSACTION_ATTEMPTS_MAX_REACHED);
 659                 return 0;
 660         }
 661
 662         if (t->scope->protocol == DNS_PROTOCOL_LLMNR && had_stream) {
 663                 /* If we already tried via a stream, then we don't
 664                  * retry on LLMNR. See RFC 4795, Section 2.7. */
 665                 dns_transaction_complete(t, DNS_TRANSACTION_ATTEMPTS_MAX_REACHED);
 666                 return 0;
 667         }
 668
 669         assert_se(sd_event_now(t->scope->manager->event, clock_boottime_or_monotonic(), &ts) >= 0);
 670
 671         t->n_attempts++;
 672         t->start_usec = ts;
 673         t->received = dns_packet_unref(t->received);
 674         t->answer = dns_answer_unref(t->answer);
 675         t->answer_rcode = 0;
 676         t->answer_source = _DNS_TRANSACTION_SOURCE_INVALID;
 677
 678         /* Check the trust anchor. Do so only on classic DNS, since DNSSEC does not apply otherwise. */
 679         if (t->scope->protocol == DNS_PROTOCOL_DNS) {
 680                 r = dns_trust_anchor_lookup(&t->scope->manager->trust_anchor, t->key, &t->answer);
 681                 if (r < 0)
 682                         return r;
 683                 if (r > 0) {
 684                         t->answer_rcode = DNS_RCODE_SUCCESS;
 685                         t->answer_source = DNS_TRANSACTION_TRUST_ANCHOR;
 686                         dns_transaction_complete(t, DNS_TRANSACTION_SUCCESS);
 687                         return 0;
 688                 }
 689         }
 690
 691         /* Check the zone, but only if this transaction is not used
 692          * for probing or verifying a zone item. */
 693         if (set_isempty(t->zone_items)) {
 694
 695                 r = dns_zone_lookup(&t->scope->zone, t->key, &t->answer, NULL, NULL);
 696                 if (r < 0)
 697                         return r;
 698                 if (r > 0) {
 699                         t->answer_rcode = DNS_RCODE_SUCCESS;
 700                         t->answer_source = DNS_TRANSACTION_ZONE;
 701                         dns_transaction_complete(t, DNS_TRANSACTION_SUCCESS);
 702                         return 0;
 703                 }
 704         }
 705
 706         /* Check the cache, but only if this transaction is not used
 707          * for probing or verifying a zone item. */
 708         if (set_isempty(t->zone_items)) {
 709
 710                 /* Before trying the cache, let's make sure we figured out a
 711                  * server to use. Should this cause a change of server this
 712                  * might flush the cache. */
 713                 dns_scope_get_dns_server(t->scope);
 714
 715                 /* Let's then prune all outdated entries */
 716                 dns_cache_prune(&t->scope->cache);
 717
 718                 r = dns_cache_lookup(&t->scope->cache, t->key, &t->answer_rcode, &t->answer);
 719                 if (r < 0)
 720                         return r;
 721                 if (r > 0) {
 722                         t->answer_source = DNS_TRANSACTION_CACHE;
 723                         if (t->answer_rcode == DNS_RCODE_SUCCESS)
 724                                 dns_transaction_complete(t, DNS_TRANSACTION_SUCCESS);
 725                         else
 726                                 dns_transaction_complete(t, DNS_TRANSACTION_FAILURE);
 727                         return 0;
 728                 }
 729         }
 730
 731         if (t->scope->protocol == DNS_PROTOCOL_LLMNR && !t->initial_jitter) {
 732                 usec_t jitter;
 733
 734                 /* RFC 4795 Section 2.7 suggests all queries should be
 735                  * delayed by a random time from 0 to JITTER_INTERVAL. */
 736
 737                 t->initial_jitter = true;
 738
 739                 random_bytes(&jitter, sizeof(jitter));
 740                 jitter %= LLMNR_JITTER_INTERVAL_USEC;
 741
 742                 r = sd_event_add_time(
 743                                 t->scope->manager->event,
 744                                 &t->timeout_event_source,
 745                                 clock_boottime_or_monotonic(),
 746                                 ts + jitter,
 747                                 LLMNR_JITTER_INTERVAL_USEC,
 748                                 on_transaction_timeout, t);
 749                 if (r < 0)
 750                         return r;
 751
 752                 t->n_attempts = 0;
 753                 t->state = DNS_TRANSACTION_PENDING;
 754
 755                 log_debug("Delaying LLMNR transaction for " USEC_FMT "us.", jitter);
 756                 return 0;
 757         }
 758
 759         /* Otherwise, we need to ask the network */
 760         r = dns_transaction_make_packet(t);
 761         if (r == -EDOM) {
 762                 /* Not the right request to make on this network?
 763                  * (i.e. an A request made on IPv6 or an AAAA request
 764                  * made on IPv4, on LLMNR or mDNS.) */
 765                 dns_transaction_complete(t, DNS_TRANSACTION_NO_SERVERS);
 766                 return 0;
 767         }
 768         if (r < 0)
 769                 return r;
 770
 771         if (t->scope->protocol == DNS_PROTOCOL_LLMNR &&
 772             (dns_name_endswith(DNS_RESOURCE_KEY_NAME(t->key), "in-addr.arpa") > 0 ||
 773              dns_name_endswith(DNS_RESOURCE_KEY_NAME(t->key), "ip6.arpa") > 0)) {
 774
 775                 /* RFC 4795, Section 2.4. says reverse lookups shall
 776                  * always be made via TCP on LLMNR */
 777                 r = dns_transaction_open_tcp(t);
 778         } else {
 779                 /* Try via UDP, and if that fails due to large size or lack of
 780                  * support try via TCP */
 781                 r = dns_transaction_emit(t);
 782                 if (r == -EMSGSIZE || r == -EAGAIN)
 783                         r = dns_transaction_open_tcp(t);
 784         }
 785
 786         if (r == -ESRCH) {
 787                 /* No servers to send this to? */
 788                 dns_transaction_complete(t, DNS_TRANSACTION_NO_SERVERS);
 789                 return 0;
 790         } else if (r < 0) {
 791                 if (t->scope->protocol != DNS_PROTOCOL_DNS) {
 792                         dns_transaction_complete(t, DNS_TRANSACTION_RESOURCES);
 793                         return 0;
 794                 }
 795
 796                 /* Couldn't send? Try immediately again, with a new server */
 797                 dns_transaction_next_dns_server(t);
 798
 799                 return dns_transaction_go(t);
 800         }
 801
 802         r = sd_event_add_time(
 803                         t->scope->manager->event,
 804                         &t->timeout_event_source,
 805                         clock_boottime_or_monotonic(),
 806                         ts + transaction_get_resend_timeout(t), 0,
 807                         on_transaction_timeout, t);
 808         if (r < 0)
 809                 return r;
 810
 811         t->state = DNS_TRANSACTION_PENDING;
 812         return 1;
 813 }
 814
 815 static const char* const dns_transaction_state_table[_DNS_TRANSACTION_STATE_MAX] = {
 816         [DNS_TRANSACTION_NULL] = "null",
 817         [DNS_TRANSACTION_PENDING] = "pending",
 818         [DNS_TRANSACTION_FAILURE] = "failure",
 819         [DNS_TRANSACTION_SUCCESS] = "success",
 820         [DNS_TRANSACTION_NO_SERVERS] = "no-servers",
 821         [DNS_TRANSACTION_TIMEOUT] = "timeout",
 822         [DNS_TRANSACTION_ATTEMPTS_MAX_REACHED] = "attempts-max-reached",
 823         [DNS_TRANSACTION_INVALID_REPLY] = "invalid-reply",
 824         [DNS_TRANSACTION_RESOURCES] = "resources",
 825         [DNS_TRANSACTION_ABORTED] = "aborted",
 826 };
 827 DEFINE_STRING_TABLE_LOOKUP(dns_transaction_state, DnsTransactionState);
 828
 829 static const char* const dns_transaction_source_table[_DNS_TRANSACTION_SOURCE_MAX] = {
 830         [DNS_TRANSACTION_NETWORK] = "network",
 831         [DNS_TRANSACTION_CACHE] = "cache",
 832         [DNS_TRANSACTION_ZONE] = "zone",
 833         [DNS_TRANSACTION_TRUST_ANCHOR] = "trust-anchor",
 834 };
 835 DEFINE_STRING_TABLE_LOOKUP(dns_transaction_source, DnsTransactionSource);