]> git.ipfire.org Git - thirdparty/systemd.git/blame - src/resolve/resolved-dns-packet.c
projects / thirdparty / systemd.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
resolved: add cache-flush bit to answers in mDNS announcements
[thirdparty/systemd.git] / src / resolve / resolved-dns-packet.c
CommitLineData
74b2466e
LP		 1/***
2 This file is part of systemd.
3
4 Copyright 2014 Lennart Poettering
5
6 systemd is free software; you can redistribute it and/or modify it
7 under the terms of the GNU Lesser General Public License as published by
8 the Free Software Foundation; either version 2.1 of the License, or
9 (at your option) any later version.
10
11 systemd is distributed in the hope that it will be useful, but
12 WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 Lesser General Public License for more details.
15
16 You should have received a copy of the GNU Lesser General Public License
17 along with systemd; If not, see <http://www.gnu.org/licenses/>.
18 ***/
19
b5efdb8a 20#include "alloc-util.h"
4ad7f276 21#include "dns-domain.h"
74b2466e 22#include "resolved-dns-packet.h"
8b43440b
LP		 23#include "string-table.h"
24#include "strv.h"
25#include "unaligned.h"
26#include "utf8.h"
27#include "util.h"
74b2466e 28
7586f4d1
TG		 29#define EDNS0_OPT_DO (1<<15)
30
e18a3c73
ZJS		 31typedef struct DnsPacketRewinder {
32 DnsPacket *packet;
33 size_t saved_rindex;
34} DnsPacketRewinder;
35
36static void rewind_dns_packet(DnsPacketRewinder *rewinder) {
37 if (rewinder->packet)
38 dns_packet_rewind(rewinder->packet, rewinder->saved_rindex);
39}
40
9ed794a3
VC		 41#define INIT_REWINDER(rewinder, p) do { rewinder.packet = p; rewinder.saved_rindex = p->rindex; } while (0)
42#define CANCEL_REWINDER(rewinder) do { rewinder.packet = NULL; } while (0)
e18a3c73 43
1716f6dc 44int dns_packet_new(DnsPacket **ret, DnsProtocol protocol, size_t mtu) {
74b2466e
LP		 45 DnsPacket *p;
46 size_t a;
47
48 assert(ret);
49
a0166609 50 if (mtu <= UDP_PACKET_HEADER_SIZE)
74b2466e
LP		 51 a = DNS_PACKET_SIZE_START;
52 else
a0166609 53 a = mtu - UDP_PACKET_HEADER_SIZE;
74b2466e
LP		 54
55 if (a < DNS_PACKET_HEADER_SIZE)
56 a = DNS_PACKET_HEADER_SIZE;
57
c73ce96b
LP		 58 /* round up to next page size */
59 a = PAGE_ALIGN(ALIGN(sizeof(DnsPacket)) + a) - ALIGN(sizeof(DnsPacket));
60
61 /* make sure we never allocate more than useful */
62 if (a > DNS_PACKET_SIZE_MAX)
63 a = DNS_PACKET_SIZE_MAX;
64
74b2466e
LP		 65 p = malloc0(ALIGN(sizeof(DnsPacket)) + a);
66 if (!p)
67 return -ENOMEM;
68
69 p->size = p->rindex = DNS_PACKET_HEADER_SIZE;
70 p->allocated = a;
1716f6dc 71 p->protocol = protocol;
519ef046 72 p->opt_start = p->opt_size = (size_t) -1;
74b2466e
LP		 73 p->n_ref = 1;
74
75 *ret = p;
76
77 return 0;
78}
79
dbfbb6e7 80void dns_packet_set_flags(DnsPacket *p, bool dnssec_checking_disabled, bool truncated) {
74b2466e 81
dbfbb6e7 82 DnsPacketHeader *h;
74b2466e 83
dbfbb6e7 84 assert(p);
74b2466e
LP		 85
86 h = DNS_PACKET_HEADER(p);
1716f6dc 87
dbfbb6e7
DM		 88 switch(p->protocol) {
89 case DNS_PROTOCOL_LLMNR:
90 assert(!truncated);
91
069360a6
LP		 92 h->flags = htobe16(DNS_PACKET_MAKE_FLAGS(0 /* qr */,
93 0 /* opcode */,
94 0 /* c */,
e5abebab 95 0 /* tc */,
069360a6
LP		 96 0 /* t */,
97 0 /* ra */,
98 0 /* ad */,
99 0 /* cd */,
100 0 /* rcode */));
dbfbb6e7
DM		 101 break;
102
103 case DNS_PROTOCOL_MDNS:
104 h->flags = htobe16(DNS_PACKET_MAKE_FLAGS(0 /* qr */,
105 0 /* opcode */,
106 0 /* aa */,
107 truncated /* tc */,
108 0 /* rd (ask for recursion) */,
109 0 /* ra */,
110 0 /* ad */,
111 0 /* cd */,
112 0 /* rcode */));
113 break;
114
115 default:
116 assert(!truncated);
117
069360a6
LP		 118 h->flags = htobe16(DNS_PACKET_MAKE_FLAGS(0 /* qr */,
119 0 /* opcode */,
120 0 /* aa */,
121 0 /* tc */,
122 1 /* rd (ask for recursion) */,
123 0 /* ra */,
124 0 /* ad */,
24710c48 125 dnssec_checking_disabled /* cd */,
069360a6 126 0 /* rcode */));
dbfbb6e7
DM		 127 }
128}
129
130int dns_packet_new_query(DnsPacket **ret, DnsProtocol protocol, size_t mtu, bool dnssec_checking_disabled) {
131 DnsPacket *p;
132 int r;
133
134 assert(ret);
135
136 r = dns_packet_new(&p, protocol, mtu);
137 if (r < 0)
138 return r;
139
140 /* Always set the TC bit to 0 initially.
141 * If there are multiple packets later, we'll update the bit shortly before sending.
142 */
143 dns_packet_set_flags(p, dnssec_checking_disabled, false);
74b2466e
LP		 144
145 *ret = p;
146 return 0;
147}
148
149DnsPacket *dns_packet_ref(DnsPacket *p) {
150
151 if (!p)
152 return NULL;
153
a8812dd7
LP		 154 assert(!p->on_stack);
155
74b2466e
LP		 156 assert(p->n_ref > 0);
157 p->n_ref++;
158 return p;
159}
160
161static void dns_packet_free(DnsPacket *p) {
162 char *s;
163
164 assert(p);
165
faa133f3
LP		 166 dns_question_unref(p->question);
167 dns_answer_unref(p->answer);
d75acfb0 168 dns_resource_record_unref(p->opt);
322345fd 169
74b2466e
LP		 170 while ((s = hashmap_steal_first_key(p->names)))
171 free(s);
172 hashmap_free(p->names);
173
faa133f3 174 free(p->_data);
a8812dd7
LP		 175
176 if (!p->on_stack)
177 free(p);
74b2466e
LP		 178}
179
180DnsPacket *dns_packet_unref(DnsPacket *p) {
181 if (!p)
182 return NULL;
183
184 assert(p->n_ref > 0);
185
6728a58d 186 dns_packet_unref(p->more);
9c491563 187
74b2466e
LP		 188 if (p->n_ref == 1)
189 dns_packet_free(p);
190 else
191 p->n_ref--;
192
193 return NULL;
194}
195
196int dns_packet_validate(DnsPacket *p) {
197 assert(p);
198
199 if (p->size < DNS_PACKET_HEADER_SIZE)
200 return -EBADMSG;
201
c73ce96b
LP		 202 if (p->size > DNS_PACKET_SIZE_MAX)
203 return -EBADMSG;
204
623a4c97 205 return 1;
74b2466e
LP		 206}
207
208int dns_packet_validate_reply(DnsPacket *p) {
74b2466e
LP		 209 int r;
210
211 assert(p);
212
213 r = dns_packet_validate(p);
214 if (r < 0)
215 return r;
216
623a4c97
LP		 217 if (DNS_PACKET_QR(p) != 1)
218 return 0;
219
220 if (DNS_PACKET_OPCODE(p) != 0)
74b2466e
LP		 221 return -EBADMSG;
222
818ef443 223 switch (p->protocol) {
d75acfb0 224
818ef443
DM		 225 case DNS_PROTOCOL_LLMNR:
226 /* RFC 4795, Section 2.1.1. says to discard all replies with QDCOUNT != 1 */
227 if (DNS_PACKET_QDCOUNT(p) != 1)
228 return -EBADMSG;
229
230 break;
231
4e5bf5e1
DM		 232 case DNS_PROTOCOL_MDNS:
233 /* RFC 6762, Section 18 */
234 if (DNS_PACKET_RCODE(p) != 0)
235 return -EBADMSG;
236
237 break;
238
818ef443
DM		 239 default:
240 break;
241 }
ea917db9 242
623a4c97
LP		 243 return 1;
244}
245
246int dns_packet_validate_query(DnsPacket *p) {
247 int r;
248
249 assert(p);
250
251 r = dns_packet_validate(p);
252 if (r < 0)
253 return r;
254
255 if (DNS_PACKET_QR(p) != 0)
256 return 0;
257
3cb10d3a 258 if (DNS_PACKET_OPCODE(p) != 0)
74b2466e
LP		 259 return -EBADMSG;
260
623a4c97
LP		 261 if (DNS_PACKET_TC(p))
262 return -EBADMSG;
263
818ef443 264 switch (p->protocol) {
d75acfb0 265
818ef443 266 case DNS_PROTOCOL_LLMNR:
b30bf55d 267 case DNS_PROTOCOL_DNS:
818ef443
DM		 268 /* RFC 4795, Section 2.1.1. says to discard all queries with QDCOUNT != 1 */
269 if (DNS_PACKET_QDCOUNT(p) != 1)
270 return -EBADMSG;
623a4c97 271
818ef443
DM		 272 /* RFC 4795, Section 2.1.1. says to discard all queries with ANCOUNT != 0 */
273 if (DNS_PACKET_ANCOUNT(p) > 0)
274 return -EBADMSG;
623a4c97 275
818ef443
DM		 276 /* RFC 4795, Section 2.1.1. says to discard all queries with NSCOUNT != 0 */
277 if (DNS_PACKET_NSCOUNT(p) > 0)
278 return -EBADMSG;
279
280 break;
281
4e5bf5e1
DM		 282 case DNS_PROTOCOL_MDNS:
283 /* RFC 6762, Section 18 */
284 if (DNS_PACKET_AA(p) != 0 ||
285 DNS_PACKET_RD(p) != 0 ||
286 DNS_PACKET_RA(p) != 0 ||
287 DNS_PACKET_AD(p) != 0 ||
288 DNS_PACKET_CD(p) != 0 ||
289 DNS_PACKET_RCODE(p) != 0)
290 return -EBADMSG;
291
292 break;
293
818ef443
DM		 294 default:
295 break;
296 }
623a4c97
LP		 297
298 return 1;
74b2466e
LP		 299}
300
301static int dns_packet_extend(DnsPacket *p, size_t add, void **ret, size_t *start) {
302 assert(p);
303
c73ce96b
LP		 304 if (p->size + add > p->allocated) {
305 size_t a;
306
307 a = PAGE_ALIGN((p->size + add) * 2);
308 if (a > DNS_PACKET_SIZE_MAX)
309 a = DNS_PACKET_SIZE_MAX;
310
311 if (p->size + add > a)
312 return -EMSGSIZE;
313
faa133f3 314 if (p->_data) {
c73ce96b
LP		 315 void *d;
316
faa133f3 317 d = realloc(p->_data, a);
c73ce96b
LP		 318 if (!d)
319 return -ENOMEM;
320
faa133f3 321 p->_data = d;
c73ce96b 322 } else {
faa133f3
LP		 323 p->_data = malloc(a);
324 if (!p->_data)
c73ce96b
LP		 325 return -ENOMEM;
326
faa133f3
LP		 327 memcpy(p->_data, (uint8_t*) p + ALIGN(sizeof(DnsPacket)), p->size);
328 memzero((uint8_t*) p->_data + p->size, a - p->size);
c73ce96b
LP		 329 }
330
331 p->allocated = a;
332 }
74b2466e
LP		 333
334 if (start)
335 *start = p->size;
336
337 if (ret)
338 *ret = (uint8_t*) DNS_PACKET_DATA(p) + p->size;
339
340 p->size += add;
341 return 0;
342}
343
9c5e12a4 344void dns_packet_truncate(DnsPacket *p, size_t sz) {
74b2466e
LP		 345 Iterator i;
346 char *s;
347 void *n;
348
349 assert(p);
350
351 if (p->size <= sz)
352 return;
353
0e03ade5 354 HASHMAP_FOREACH_KEY(n, s, p->names, i) {
74b2466e
LP		 355
356 if (PTR_TO_SIZE(n) < sz)
357 continue;
358
359 hashmap_remove(p->names, s);
360 free(s);
361 }
362
363 p->size = sz;
364}
365
623a4c97
LP		 366int dns_packet_append_blob(DnsPacket *p, const void *d, size_t l, size_t *start) {
367 void *q;
368 int r;
369
370 assert(p);
371
372 r = dns_packet_extend(p, l, &q, start);
373 if (r < 0)
374 return r;
375
376 memcpy(q, d, l);
377 return 0;
378}
379
74b2466e
LP		 380int dns_packet_append_uint8(DnsPacket *p, uint8_t v, size_t *start) {
381 void *d;
382 int r;
383
384 assert(p);
385
386 r = dns_packet_extend(p, sizeof(uint8_t), &d, start);
387 if (r < 0)
388 return r;
389
390 ((uint8_t*) d)[0] = v;
391
392 return 0;
393}
394
395int dns_packet_append_uint16(DnsPacket *p, uint16_t v, size_t *start) {
396 void *d;
397 int r;
398
399 assert(p);
400
401 r = dns_packet_extend(p, sizeof(uint16_t), &d, start);
402 if (r < 0)
403 return r;
404
725ca0e5 405 unaligned_write_be16(d, v);
623a4c97
LP		 406
407 return 0;
408}
409
410int dns_packet_append_uint32(DnsPacket *p, uint32_t v, size_t *start) {
411 void *d;
412 int r;
413
414 assert(p);
415
416 r = dns_packet_extend(p, sizeof(uint32_t), &d, start);
417 if (r < 0)
418 return r;
419
725ca0e5 420 unaligned_write_be32(d, v);
74b2466e
LP		 421
422 return 0;
423}
424
425int dns_packet_append_string(DnsPacket *p, const char *s, size_t *start) {
74b2466e
LP		 426 assert(p);
427 assert(s);
428
c38a52da 429 return dns_packet_append_raw_string(p, s, strlen(s), start);
74b2466e
LP		 430}
431
2001c805
LP		 432int dns_packet_append_raw_string(DnsPacket *p, const void *s, size_t size, size_t *start) {
433 void *d;
434 int r;
435
436 assert(p);
437 assert(s || size == 0);
438
439 if (size > 255)
440 return -E2BIG;
441
442 r = dns_packet_extend(p, 1 + size, &d, start);
443 if (r < 0)
444 return r;
445
446 ((uint8_t*) d)[0] = (uint8_t) size;
447
75f32f04 448 memcpy_safe(((uint8_t*) d) + 1, s, size);
2001c805
LP		 449
450 return 0;
451}
452
a3db237b 453int dns_packet_append_label(DnsPacket *p, const char *d, size_t l, bool canonical_candidate, size_t *start) {
a8812dd7 454 uint8_t *w;
74b2466e
LP		 455 int r;
456
a3db237b
LP		 457 /* Append a label to a packet. Optionally, does this in DNSSEC
458 * canonical form, if this label is marked as a candidate for
459 * it, and the canonical form logic is enabled for the
460 * packet */
461
74b2466e
LP		 462 assert(p);
463 assert(d);
464
465 if (l > DNS_LABEL_MAX)
466 return -E2BIG;
467
a8812dd7 468 r = dns_packet_extend(p, 1 + l, (void**) &w, start);
74b2466e
LP		 469 if (r < 0)
470 return r;
471
a8812dd7
LP		 472 *(w++) = (uint8_t) l;
473
a3db237b 474 if (p->canonical_form && canonical_candidate) {
a8812dd7
LP		 475 size_t i;
476
477 /* Generate in canonical form, as defined by DNSSEC
478 * RFC 4034, Section 6.2, i.e. all lower-case. */
479
b577e3d5
LP		 480 for (i = 0; i < l; i++)
481 w[i] = (uint8_t) ascii_tolower(d[i]);
a8812dd7
LP		 482 } else
483 /* Otherwise, just copy the string unaltered. This is
484 * essential for DNS-SD, where the casing of labels
485 * matters and needs to be retained. */
486 memcpy(w, d, l);
74b2466e
LP		 487
488 return 0;
489}
490
f6a5fec6
LP		 491int dns_packet_append_name(
492 DnsPacket *p,
493 const char *name,
494 bool allow_compression,
a3db237b 495 bool canonical_candidate,
f6a5fec6
LP		 496 size_t *start) {
497
74b2466e
LP		 498 size_t saved_size;
499 int r;
500
501 assert(p);
502 assert(name);
503
f6a5fec6
LP		 504 if (p->refuse_compression)
505 allow_compression = false;
506
74b2466e
LP		 507 saved_size = p->size;
508
e48b9a64 509 while (!dns_name_is_root(name)) {
08f904fd 510 const char *z = name;
74b2466e 511 char label[DNS_LABEL_MAX];
151226ab 512 size_t n = 0;
74b2466e 513
151226ab
ZJS		 514 if (allow_compression)
515 n = PTR_TO_SIZE(hashmap_get(p->names, name));
74b2466e
LP		 516 if (n > 0) {
517 assert(n < p->size);
518
519 if (n < 0x4000) {
520 r = dns_packet_append_uint16(p, 0xC000 | n, NULL);
521 if (r < 0)
522 goto fail;
523
524 goto done;
525 }
526 }
527
74b2466e
LP		 528 r = dns_label_unescape(&name, label, sizeof(label));
529 if (r < 0)
530 goto fail;
531
a3db237b 532 r = dns_packet_append_label(p, label, r, canonical_candidate, &n);
74b2466e
LP		 533 if (r < 0)
534 goto fail;
535
151226ab 536 if (allow_compression) {
08f904fd
LP		 537 _cleanup_free_ char *s = NULL;
538
539 s = strdup(z);
540 if (!s) {
541 r = -ENOMEM;
542 goto fail;
543 }
544
d5099efc 545 r = hashmap_ensure_allocated(&p->names, &dns_name_hash_ops);
151226ab
ZJS		 546 if (r < 0)
547 goto fail;
74b2466e 548
151226ab
ZJS		 549 r = hashmap_put(p->names, s, SIZE_TO_PTR(n));
550 if (r < 0)
551 goto fail;
74b2466e 552
151226ab
ZJS		 553 s = NULL;
554 }
74b2466e
LP		 555 }
556
557 r = dns_packet_append_uint8(p, 0, NULL);
558 if (r < 0)
559 return r;
560
561done:
562 if (start)
563 *start = saved_size;
564
565 return 0;
566
567fail:
568 dns_packet_truncate(p, saved_size);
569 return r;
570}
571
58ab31d5 572int dns_packet_append_key(DnsPacket *p, const DnsResourceKey *k, const DnsAnswerFlags flags, size_t *start) {
74b2466e 573 size_t saved_size;
58ab31d5 574 uint16_t class;
74b2466e
LP		 575 int r;
576
577 assert(p);
578 assert(k);
579
580 saved_size = p->size;
581
1c02e7ba 582 r = dns_packet_append_name(p, dns_resource_key_name(k), true, true, NULL);
74b2466e
LP		 583 if (r < 0)
584 goto fail;
585
586 r = dns_packet_append_uint16(p, k->type, NULL);
587 if (r < 0)
588 goto fail;
589
58ab31d5
DR		 590 class = flags & DNS_ANSWER_CACHE_FLUSH ? k->class | MDNS_RR_CACHE_FLUSH : k->class;
591 r = dns_packet_append_uint16(p, class, NULL);
74b2466e
LP		 592 if (r < 0)
593 goto fail;
594
595 if (start)
596 *start = saved_size;
597
598 return 0;
599
600fail:
601 dns_packet_truncate(p, saved_size);
602 return r;
603}
604
e1a9f1a8 605static int dns_packet_append_type_window(DnsPacket *p, uint8_t window, uint8_t length, const uint8_t *types, size_t *start) {
50f1e641
TG		 606 size_t saved_size;
607 int r;
608
609 assert(p);
610 assert(types);
1792f223 611 assert(length > 0);
50f1e641 612
50f1e641
TG		 613 saved_size = p->size;
614
1792f223
TG		 615 r = dns_packet_append_uint8(p, window, NULL);
616 if (r < 0)
617 goto fail;
50f1e641 618
1792f223
TG		 619 r = dns_packet_append_uint8(p, length, NULL);
620 if (r < 0)
621 goto fail;
6fa91901 622
1792f223
TG		 623 r = dns_packet_append_blob(p, types, length, NULL);
624 if (r < 0)
625 goto fail;
50f1e641
TG		 626
627 if (start)
628 *start = saved_size;
629
630 return 0;
631fail:
632 dns_packet_truncate(p, saved_size);
633 return r;
634}
635
636static int dns_packet_append_types(DnsPacket *p, Bitmap *types, size_t *start) {
cb57dd41 637 Iterator i;
50f1e641 638 uint8_t window = 0;
1792f223 639 uint8_t entry = 0;
50f1e641
TG		 640 uint8_t bitmaps[32] = {};
641 unsigned n;
642 size_t saved_size;
643 int r;
644
645 assert(p);
50f1e641
TG		 646
647 saved_size = p->size;
648
cb57dd41 649 BITMAP_FOREACH(n, types, i) {
50f1e641
TG		 650 assert(n <= 0xffff);
651
1792f223
TG		 652 if ((n >> 8) != window && bitmaps[entry / 8] != 0) {
653 r = dns_packet_append_type_window(p, window, entry / 8 + 1, bitmaps, NULL);
50f1e641
TG		 654 if (r < 0)
655 goto fail;
656
1792f223 657 zero(bitmaps);
50f1e641
TG		 658 }
659
1792f223 660 window = n >> 8;
50f1e641
TG		 661 entry = n & 255;
662
663 bitmaps[entry / 8] |= 1 << (7 - (entry % 8));
664 }
665
d0ae14ff
LP		 666 if (bitmaps[entry / 8] != 0) {
667 r = dns_packet_append_type_window(p, window, entry / 8 + 1, bitmaps, NULL);
668 if (r < 0)
669 goto fail;
670 }
50f1e641
TG		 671
672 if (start)
673 *start = saved_size;
674
675 return 0;
676fail:
677 dns_packet_truncate(p, saved_size);
678 return r;
679}
680
dc913c9a 681/* Append the OPT pseudo-RR described in RFC6891 */
f2ed4c69 682int dns_packet_append_opt(DnsPacket *p, uint16_t max_udp_size, bool edns0_do, int rcode, size_t *start) {
dc913c9a
TG		 683 size_t saved_size;
684 int r;
685
686 assert(p);
687 /* we must never advertise supported packet size smaller than the legacy max */
688 assert(max_udp_size >= DNS_PACKET_UNICAST_SIZE_MAX);
f2ed4c69
LP		 689 assert(rcode >= 0);
690 assert(rcode <= _DNS_RCODE_MAX);
dc913c9a 691
519ef046
LP		 692 if (p->opt_start != (size_t) -1)
693 return -EBUSY;
694
695 assert(p->opt_size == (size_t) -1);
696
dc913c9a
TG		 697 saved_size = p->size;
698
699 /* empty name */
700 r = dns_packet_append_uint8(p, 0, NULL);
701 if (r < 0)
702 return r;
703
704 /* type */
705 r = dns_packet_append_uint16(p, DNS_TYPE_OPT, NULL);
706 if (r < 0)
707 goto fail;
708
f2ed4c69 709 /* class: maximum udp packet that can be received */
dc913c9a
TG		 710 r = dns_packet_append_uint16(p, max_udp_size, NULL);
711 if (r < 0)
712 goto fail;
713
714 /* extended RCODE and VERSION */
f2ed4c69 715 r = dns_packet_append_uint16(p, ((uint16_t) rcode & 0x0FF0) << 4, NULL);
dc913c9a
TG		 716 if (r < 0)
717 goto fail;
718
7586f4d1
TG		 719 /* flags: DNSSEC OK (DO), see RFC3225 */
720 r = dns_packet_append_uint16(p, edns0_do ? EDNS0_OPT_DO : 0, NULL);
dc913c9a
TG		 721 if (r < 0)
722 goto fail;
723
724 /* RDLENGTH */
12c40d4c 725 if (edns0_do && !DNS_PACKET_QR(p)) {
b30bf55d 726 /* If DO is on and this is not a reply, also append RFC6975 Algorithm data */
665408ac
LP		 727
728 static const uint8_t rfc6975[] = {
729
730 0, 5, /* OPTION_CODE: DAU */
731 0, 6, /* LIST_LENGTH */
732 DNSSEC_ALGORITHM_RSASHA1,
733 DNSSEC_ALGORITHM_RSASHA1_NSEC3_SHA1,
734 DNSSEC_ALGORITHM_RSASHA256,
735 DNSSEC_ALGORITHM_RSASHA512,
736 DNSSEC_ALGORITHM_ECDSAP256SHA256,
737 DNSSEC_ALGORITHM_ECDSAP384SHA384,
738
739 0, 6, /* OPTION_CODE: DHU */
740 0, 3, /* LIST_LENGTH */
741 DNSSEC_DIGEST_SHA1,
742 DNSSEC_DIGEST_SHA256,
743 DNSSEC_DIGEST_SHA384,
744
745 0, 7, /* OPTION_CODE: N3U */
746 0, 1, /* LIST_LENGTH */
747 NSEC3_ALGORITHM_SHA1,
748 };
749
750 r = dns_packet_append_uint16(p, sizeof(rfc6975), NULL);
751 if (r < 0)
752 goto fail;
753
754 r = dns_packet_append_blob(p, rfc6975, sizeof(rfc6975), NULL);
755 } else
756 r = dns_packet_append_uint16(p, 0, NULL);
dc913c9a
TG		 757 if (r < 0)
758 goto fail;
759
519ef046
LP		 760 DNS_PACKET_HEADER(p)->arcount = htobe16(DNS_PACKET_ARCOUNT(p) + 1);
761
762 p->opt_start = saved_size;
763 p->opt_size = p->size - saved_size;
764
dc913c9a
TG		 765 if (start)
766 *start = saved_size;
767
768 return 0;
769
770fail:
771 dns_packet_truncate(p, saved_size);
772 return r;
773}
774
519ef046
LP		 775int dns_packet_truncate_opt(DnsPacket *p) {
776 assert(p);
777
778 if (p->opt_start == (size_t) -1) {
779 assert(p->opt_size == (size_t) -1);
780 return 0;
781 }
782
783 assert(p->opt_size != (size_t) -1);
784 assert(DNS_PACKET_ARCOUNT(p) > 0);
785
786 if (p->opt_start + p->opt_size != p->size)
787 return -EBUSY;
788
789 dns_packet_truncate(p, p->opt_start);
790 DNS_PACKET_HEADER(p)->arcount = htobe16(DNS_PACKET_ARCOUNT(p) - 1);
791 p->opt_start = p->opt_size = (size_t) -1;
792
793 return 1;
794}
795
58ab31d5 796int dns_packet_append_rr(DnsPacket *p, const DnsResourceRecord *rr, const DnsAnswerFlags flags, size_t *start, size_t *rdata_start) {
f471bc11 797
a8812dd7 798 size_t saved_size, rdlength_offset, end, rdlength, rds;
623a4c97
LP		 799 int r;
800
801 assert(p);
802 assert(rr);
803
804 saved_size = p->size;
805
58ab31d5 806 r = dns_packet_append_key(p, rr->key, flags, NULL);
623a4c97
LP		 807 if (r < 0)
808 goto fail;
809
810 r = dns_packet_append_uint32(p, rr->ttl, NULL);
811 if (r < 0)
812 goto fail;
813
814 /* Initially we write 0 here */
815 r = dns_packet_append_uint16(p, 0, &rdlength_offset);
816 if (r < 0)
817 goto fail;
818
a8812dd7
LP		 819 rds = p->size - saved_size;
820
0dae31d4 821 switch (rr->unparseable ? _DNS_TYPE_INVALID : rr->key->type) {
623a4c97 822
9c92ce6d
LP		 823 case DNS_TYPE_SRV:
824 r = dns_packet_append_uint16(p, rr->srv.priority, NULL);
825 if (r < 0)
826 goto fail;
827
828 r = dns_packet_append_uint16(p, rr->srv.weight, NULL);
829 if (r < 0)
830 goto fail;
831
832 r = dns_packet_append_uint16(p, rr->srv.port, NULL);
833 if (r < 0)
834 goto fail;
835
a3db237b 836 r = dns_packet_append_name(p, rr->srv.name, true, false, NULL);
9c92ce6d
LP		 837 break;
838
623a4c97
LP		 839 case DNS_TYPE_PTR:
840 case DNS_TYPE_NS:
841 case DNS_TYPE_CNAME:
8ac4e9e1 842 case DNS_TYPE_DNAME:
a3db237b 843 r = dns_packet_append_name(p, rr->ptr.name, true, false, NULL);
623a4c97
LP		 844 break;
845
846 case DNS_TYPE_HINFO:
847 r = dns_packet_append_string(p, rr->hinfo.cpu, NULL);
848 if (r < 0)
849 goto fail;
850
851 r = dns_packet_append_string(p, rr->hinfo.os, NULL);
852 break;
853
9de3e329 854 case DNS_TYPE_SPF: /* exactly the same as TXT */
2001c805 855 case DNS_TYPE_TXT:
2e276efc 856
2001c805 857 if (!rr->txt.items) {
1ccda9b7
LP		 858 /* RFC 6763, section 6.1 suggests to generate
859 * single empty string for an empty array. */
860
2001c805 861 r = dns_packet_append_raw_string(p, NULL, 0, NULL);
2e276efc
ZJS		 862 if (r < 0)
863 goto fail;
1ccda9b7 864 } else {
2001c805
LP		 865 DnsTxtItem *i;
866
867 LIST_FOREACH(items, i, rr->txt.items) {
868 r = dns_packet_append_raw_string(p, i->data, i->length, NULL);
1ccda9b7
LP		 869 if (r < 0)
870 goto fail;
871 }
2e276efc
ZJS		 872 }
873
6a6fc3df 874 r = 0;
2e276efc 875 break;
2e276efc 876
623a4c97
LP		 877 case DNS_TYPE_A:
878 r = dns_packet_append_blob(p, &rr->a.in_addr, sizeof(struct in_addr), NULL);
879 break;
880
881 case DNS_TYPE_AAAA:
882 r = dns_packet_append_blob(p, &rr->aaaa.in6_addr, sizeof(struct in6_addr), NULL);
883 break;
884
885 case DNS_TYPE_SOA:
a3db237b 886 r = dns_packet_append_name(p, rr->soa.mname, true, false, NULL);
623a4c97
LP		 887 if (r < 0)
888 goto fail;
889
a3db237b 890 r = dns_packet_append_name(p, rr->soa.rname, true, false, NULL);
623a4c97
LP		 891 if (r < 0)
892 goto fail;
893
894 r = dns_packet_append_uint32(p, rr->soa.serial, NULL);
895 if (r < 0)
896 goto fail;
897
898 r = dns_packet_append_uint32(p, rr->soa.refresh, NULL);
899 if (r < 0)
900 goto fail;
901
902 r = dns_packet_append_uint32(p, rr->soa.retry, NULL);
903 if (r < 0)
904 goto fail;
905
906 r = dns_packet_append_uint32(p, rr->soa.expire, NULL);
907 if (r < 0)
908 goto fail;
909
910 r = dns_packet_append_uint32(p, rr->soa.minimum, NULL);
911 break;
912
913 case DNS_TYPE_MX:
946c7094
ZJS		 914 r = dns_packet_append_uint16(p, rr->mx.priority, NULL);
915 if (r < 0)
916 goto fail;
917
a3db237b 918 r = dns_packet_append_name(p, rr->mx.exchange, true, false, NULL);
946c7094
ZJS		 919 break;
920
0dae31d4
ZJS		 921 case DNS_TYPE_LOC:
922 r = dns_packet_append_uint8(p, rr->loc.version, NULL);
923 if (r < 0)
924 goto fail;
925
926 r = dns_packet_append_uint8(p, rr->loc.size, NULL);
927 if (r < 0)
928 goto fail;
929
930 r = dns_packet_append_uint8(p, rr->loc.horiz_pre, NULL);
931 if (r < 0)
932 goto fail;
933
934 r = dns_packet_append_uint8(p, rr->loc.vert_pre, NULL);
935 if (r < 0)
936 goto fail;
937
afbc4f26 938 r = dns_packet_append_uint32(p, rr->loc.latitude, NULL);
0dae31d4
ZJS		 939 if (r < 0)
940 goto fail;
941
afbc4f26 942 r = dns_packet_append_uint32(p, rr->loc.longitude, NULL);
0dae31d4
ZJS		 943 if (r < 0)
944 goto fail;
945
afbc4f26 946 r = dns_packet_append_uint32(p, rr->loc.altitude, NULL);
0dae31d4
ZJS		 947 break;
948
abf126a3
TG		 949 case DNS_TYPE_DS:
950 r = dns_packet_append_uint16(p, rr->ds.key_tag, NULL);
951 if (r < 0)
952 goto fail;
953
954 r = dns_packet_append_uint8(p, rr->ds.algorithm, NULL);
955 if (r < 0)
956 goto fail;
957
958 r = dns_packet_append_uint8(p, rr->ds.digest_type, NULL);
959 if (r < 0)
960 goto fail;
961
962 r = dns_packet_append_blob(p, rr->ds.digest, rr->ds.digest_size, NULL);
963 break;
964
623a4c97 965 case DNS_TYPE_SSHFP:
42cc2eeb
LP		 966 r = dns_packet_append_uint8(p, rr->sshfp.algorithm, NULL);
967 if (r < 0)
968 goto fail;
8db0d2f5 969
42cc2eeb
LP		 970 r = dns_packet_append_uint8(p, rr->sshfp.fptype, NULL);
971 if (r < 0)
972 goto fail;
973
549c1a25 974 r = dns_packet_append_blob(p, rr->sshfp.fingerprint, rr->sshfp.fingerprint_size, NULL);
42cc2eeb
LP		 975 break;
976
8db0d2f5 977 case DNS_TYPE_DNSKEY:
f91dc240 978 r = dns_packet_append_uint16(p, rr->dnskey.flags, NULL);
8db0d2f5
ZJS		 979 if (r < 0)
980 goto fail;
981
f91dc240 982 r = dns_packet_append_uint8(p, rr->dnskey.protocol, NULL);
8db0d2f5
ZJS		 983 if (r < 0)
984 goto fail;
985
986 r = dns_packet_append_uint8(p, rr->dnskey.algorithm, NULL);
987 if (r < 0)
988 goto fail;
989
990 r = dns_packet_append_blob(p, rr->dnskey.key, rr->dnskey.key_size, NULL);
991 break;
992
151226ab
ZJS		 993 case DNS_TYPE_RRSIG:
994 r = dns_packet_append_uint16(p, rr->rrsig.type_covered, NULL);
995 if (r < 0)
996 goto fail;
997
998 r = dns_packet_append_uint8(p, rr->rrsig.algorithm, NULL);
999 if (r < 0)
1000 goto fail;
1001
1002 r = dns_packet_append_uint8(p, rr->rrsig.labels, NULL);
1003 if (r < 0)
1004 goto fail;
1005
1006 r = dns_packet_append_uint32(p, rr->rrsig.original_ttl, NULL);
1007 if (r < 0)
1008 goto fail;
1009
1010 r = dns_packet_append_uint32(p, rr->rrsig.expiration, NULL);
1011 if (r < 0)
1012 goto fail;
1013
1014 r = dns_packet_append_uint32(p, rr->rrsig.inception, NULL);
1015 if (r < 0)
1016 goto fail;
1017
0b1b17d3 1018 r = dns_packet_append_uint16(p, rr->rrsig.key_tag, NULL);
151226ab
ZJS		 1019 if (r < 0)
1020 goto fail;
1021
a3db237b 1022 r = dns_packet_append_name(p, rr->rrsig.signer, false, true, NULL);
151226ab
ZJS		 1023 if (r < 0)
1024 goto fail;
1025
1026 r = dns_packet_append_blob(p, rr->rrsig.signature, rr->rrsig.signature_size, NULL);
1027 break;
1028
50f1e641 1029 case DNS_TYPE_NSEC:
a3db237b 1030 r = dns_packet_append_name(p, rr->nsec.next_domain_name, false, false, NULL);
50f1e641
TG		 1031 if (r < 0)
1032 goto fail;
1033
1034 r = dns_packet_append_types(p, rr->nsec.types, NULL);
1035 if (r < 0)
1036 goto fail;
1037
5d45a880 1038 break;
d75acfb0 1039
5d45a880
TG		 1040 case DNS_TYPE_NSEC3:
1041 r = dns_packet_append_uint8(p, rr->nsec3.algorithm, NULL);
1042 if (r < 0)
1043 goto fail;
1044
1045 r = dns_packet_append_uint8(p, rr->nsec3.flags, NULL);
1046 if (r < 0)
1047 goto fail;
1048
1049 r = dns_packet_append_uint16(p, rr->nsec3.iterations, NULL);
1050 if (r < 0)
1051 goto fail;
1052
1053 r = dns_packet_append_uint8(p, rr->nsec3.salt_size, NULL);
1054 if (r < 0)
1055 goto fail;
1056
1057 r = dns_packet_append_blob(p, rr->nsec3.salt, rr->nsec3.salt_size, NULL);
1058 if (r < 0)
1059 goto fail;
1060
1061 r = dns_packet_append_uint8(p, rr->nsec3.next_hashed_name_size, NULL);
1062 if (r < 0)
1063 goto fail;
1064
1065 r = dns_packet_append_blob(p, rr->nsec3.next_hashed_name, rr->nsec3.next_hashed_name_size, NULL);
1066 if (r < 0)
1067 goto fail;
1068
1069 r = dns_packet_append_types(p, rr->nsec3.types, NULL);
1070 if (r < 0)
1071 goto fail;
1072
50f1e641 1073 break;
d75acfb0 1074
48d45d2b
ZJS		 1075 case DNS_TYPE_TLSA:
1076 r = dns_packet_append_uint8(p, rr->tlsa.cert_usage, NULL);
1077 if (r < 0)
1078 goto fail;
1079
1080 r = dns_packet_append_uint8(p, rr->tlsa.selector, NULL);
1081 if (r < 0)
1082 goto fail;
1083
1084 r = dns_packet_append_uint8(p, rr->tlsa.matching_type, NULL);
1085 if (r < 0)
1086 goto fail;
1087
1088 r = dns_packet_append_blob(p, rr->tlsa.data, rr->tlsa.data_size, NULL);
1089 break;
1090
95052df3
ZJS		 1091 case DNS_TYPE_CAA:
1092 r = dns_packet_append_uint8(p, rr->caa.flags, NULL);
1093 if (r < 0)
1094 goto fail;
1095
1096 r = dns_packet_append_string(p, rr->caa.tag, NULL);
1097 if (r < 0)
1098 goto fail;
1099
1100 r = dns_packet_append_blob(p, rr->caa.value, rr->caa.value_size, NULL);
1101 break;
1102
d75acfb0 1103 case DNS_TYPE_OPT:
d93a16b8 1104 case DNS_TYPE_OPENPGPKEY:
0dae31d4 1105 case _DNS_TYPE_INVALID: /* unparseable */
623a4c97 1106 default:
0dae31d4 1107
a43a068a 1108 r = dns_packet_append_blob(p, rr->generic.data, rr->generic.data_size, NULL);
623a4c97
LP		 1109 break;
1110 }
1111 if (r < 0)
1112 goto fail;
1113
1114 /* Let's calculate the actual data size and update the field */
1115 rdlength = p->size - rdlength_offset - sizeof(uint16_t);
1116 if (rdlength > 0xFFFF) {
555f5cdc 1117 r = -ENOSPC;
623a4c97
LP		 1118 goto fail;
1119 }
1120
1121 end = p->size;
1122 p->size = rdlength_offset;
1123 r = dns_packet_append_uint16(p, rdlength, NULL);
1124 if (r < 0)
1125 goto fail;
1126 p->size = end;
1127
351e6342
LP		 1128 if (start)
1129 *start = saved_size;
1130
a8812dd7
LP		 1131 if (rdata_start)
1132 *rdata_start = rds;
1133
623a4c97
LP		 1134 return 0;
1135
1136fail:
1137 dns_packet_truncate(p, saved_size);
1138 return r;
1139}
1140
f471bc11
LP		 1141int dns_packet_append_question(DnsPacket *p, DnsQuestion *q) {
1142 DnsResourceKey *key;
1143 int r;
1144
1145 assert(p);
1146
1147 DNS_QUESTION_FOREACH(key, q) {
58ab31d5 1148 r = dns_packet_append_key(p, key, 0, NULL);
f471bc11
LP		 1149 if (r < 0)
1150 return r;
1151 }
1152
1153 return 0;
1154}
1155
1156int dns_packet_append_answer(DnsPacket *p, DnsAnswer *a) {
1157 DnsResourceRecord *rr;
58ab31d5 1158 DnsAnswerFlags flags;
f471bc11
LP		 1159 int r;
1160
1161 assert(p);
1162
58ab31d5
DR		 1163 DNS_ANSWER_FOREACH_FLAGS(rr, flags, a) {
1164 r = dns_packet_append_rr(p, rr, flags, NULL, NULL);
f471bc11
LP		 1165 if (r < 0)
1166 return r;
1167 }
1168
1169 return 0;
1170}
1171
74b2466e
LP		 1172int dns_packet_read(DnsPacket *p, size_t sz, const void **ret, size_t *start) {
1173 assert(p);
1174
1175 if (p->rindex + sz > p->size)
1176 return -EMSGSIZE;
1177
1178 if (ret)
1179 *ret = (uint8_t*) DNS_PACKET_DATA(p) + p->rindex;
1180
1181 if (start)
1182 *start = p->rindex;
1183
1184 p->rindex += sz;
1185 return 0;
1186}
1187
8ba9fd9c 1188void dns_packet_rewind(DnsPacket *p, size_t idx) {
74b2466e
LP		 1189 assert(p);
1190 assert(idx <= p->size);
1191 assert(idx >= DNS_PACKET_HEADER_SIZE);
1192
1193 p->rindex = idx;
1194}
1195
623a4c97
LP		 1196int dns_packet_read_blob(DnsPacket *p, void *d, size_t sz, size_t *start) {
1197 const void *q;
1198 int r;
1199
1200 assert(p);
1201 assert(d);
1202
1203 r = dns_packet_read(p, sz, &q, start);
1204 if (r < 0)
1205 return r;
1206
1207 memcpy(d, q, sz);
1208 return 0;
1209}
1210
f5430a3e
LP		 1211static int dns_packet_read_memdup(
1212 DnsPacket *p, size_t size,
1213 void **ret, size_t *ret_size,
1214 size_t *ret_start) {
1215
1216 const void *src;
1217 size_t start;
1218 int r;
1219
1220 assert(p);
1221 assert(ret);
1222
1223 r = dns_packet_read(p, size, &src, &start);
1224 if (r < 0)
1225 return r;
1226
1227 if (size <= 0)
1228 *ret = NULL;
1229 else {
1230 void *copy;
1231
1232 copy = memdup(src, size);
1233 if (!copy)
1234 return -ENOMEM;
1235
1236 *ret = copy;
1237 }
1238
1239 if (ret_size)
1240 *ret_size = size;
1241 if (ret_start)
1242 *ret_start = start;
1243
1244 return 0;
1245}
1246
74b2466e
LP		 1247int dns_packet_read_uint8(DnsPacket *p, uint8_t *ret, size_t *start) {
1248 const void *d;
1249 int r;
1250
1251 assert(p);
1252
1253 r = dns_packet_read(p, sizeof(uint8_t), &d, start);
1254 if (r < 0)
1255 return r;
1256
1257 *ret = ((uint8_t*) d)[0];
1258 return 0;
1259}
1260
1261int dns_packet_read_uint16(DnsPacket *p, uint16_t *ret, size_t *start) {
1262 const void *d;
1263 int r;
1264
1265 assert(p);
1266
1267 r = dns_packet_read(p, sizeof(uint16_t), &d, start);
1268 if (r < 0)
1269 return r;
1270
725ca0e5
TG		 1271 *ret = unaligned_read_be16(d);
1272
74b2466e
LP		 1273 return 0;
1274}
1275
1276int dns_packet_read_uint32(DnsPacket *p, uint32_t *ret, size_t *start) {
1277 const void *d;
1278 int r;
1279
1280 assert(p);
1281
1282 r = dns_packet_read(p, sizeof(uint32_t), &d, start);
1283 if (r < 0)
1284 return r;
1285
725ca0e5 1286 *ret = unaligned_read_be32(d);
74b2466e
LP		 1287
1288 return 0;
1289}
1290
1291int dns_packet_read_string(DnsPacket *p, char **ret, size_t *start) {
e18a3c73 1292 _cleanup_(rewind_dns_packet) DnsPacketRewinder rewinder;
74b2466e
LP		 1293 const void *d;
1294 char *t;
1295 uint8_t c;
1296 int r;
1297
1298 assert(p);
e18a3c73 1299 INIT_REWINDER(rewinder, p);
74b2466e
LP		 1300
1301 r = dns_packet_read_uint8(p, &c, NULL);
1302 if (r < 0)
e18a3c73 1303 return r;
74b2466e
LP		 1304
1305 r = dns_packet_read(p, c, &d, NULL);
1306 if (r < 0)
e18a3c73 1307 return r;
74b2466e 1308
e18a3c73
ZJS		 1309 if (memchr(d, 0, c))
1310 return -EBADMSG;
74b2466e
LP		 1311
1312 t = strndup(d, c);
e18a3c73
ZJS		 1313 if (!t)
1314 return -ENOMEM;
74b2466e
LP		 1315
1316 if (!utf8_is_valid(t)) {
1317 free(t);
e18a3c73 1318 return -EBADMSG;
74b2466e
LP		 1319 }
1320
1321 *ret = t;
1322
1323 if (start)
e18a3c73
ZJS		 1324 *start = rewinder.saved_rindex;
1325 CANCEL_REWINDER(rewinder);
74b2466e
LP		 1326
1327 return 0;
74b2466e
LP		 1328}
1329
2001c805 1330int dns_packet_read_raw_string(DnsPacket *p, const void **ret, size_t *size, size_t *start) {
e18a3c73 1331 _cleanup_(rewind_dns_packet) DnsPacketRewinder rewinder;
2001c805
LP		 1332 uint8_t c;
1333 int r;
1334
1335 assert(p);
e18a3c73 1336 INIT_REWINDER(rewinder, p);
2001c805
LP		 1337
1338 r = dns_packet_read_uint8(p, &c, NULL);
1339 if (r < 0)
e18a3c73 1340 return r;
2001c805
LP		 1341
1342 r = dns_packet_read(p, c, ret, NULL);
1343 if (r < 0)
e18a3c73 1344 return r;
2001c805
LP		 1345
1346 if (size)
1347 *size = c;
1348 if (start)
e18a3c73
ZJS		 1349 *start = rewinder.saved_rindex;
1350 CANCEL_REWINDER(rewinder);
2001c805
LP		 1351
1352 return 0;
2001c805
LP		 1353}
1354
f6a5fec6
LP		 1355int dns_packet_read_name(
1356 DnsPacket *p,
1357 char **_ret,
1358 bool allow_compression,
1359 size_t *start) {
1360
e18a3c73
ZJS		 1361 _cleanup_(rewind_dns_packet) DnsPacketRewinder rewinder;
1362 size_t after_rindex = 0, jump_barrier;
74b2466e
LP		 1363 _cleanup_free_ char *ret = NULL;
1364 size_t n = 0, allocated = 0;
1365 bool first = true;
1366 int r;
1367
1368 assert(p);
1369 assert(_ret);
e18a3c73
ZJS		 1370 INIT_REWINDER(rewinder, p);
1371 jump_barrier = p->rindex;
74b2466e 1372
f6a5fec6
LP		 1373 if (p->refuse_compression)
1374 allow_compression = false;
1375
74b2466e
LP		 1376 for (;;) {
1377 uint8_t c, d;
1378
1379 r = dns_packet_read_uint8(p, &c, NULL);
1380 if (r < 0)
e18a3c73 1381 return r;
74b2466e
LP		 1382
1383 if (c == 0)
1384 /* End of name */
1385 break;
1386 else if (c <= 63) {
74b2466e
LP		 1387 const char *label;
1388
1389 /* Literal label */
1390 r = dns_packet_read(p, c, (const void**) &label, NULL);
1391 if (r < 0)
e18a3c73 1392 return r;
74b2466e 1393
e18a3c73
ZJS		 1394 if (!GREEDY_REALLOC(ret, allocated, n + !first + DNS_LABEL_ESCAPED_MAX))
1395 return -ENOMEM;
74b2466e 1396
422baca0 1397 if (first)
74b2466e 1398 first = false;
422baca0
LP		 1399 else
1400 ret[n++] = '.';
1401
1402 r = dns_label_escape(label, c, ret + n, DNS_LABEL_ESCAPED_MAX);
1403 if (r < 0)
e18a3c73 1404 return r;
74b2466e 1405
74b2466e
LP		 1406 n += r;
1407 continue;
151226ab 1408 } else if (allow_compression && (c & 0xc0) == 0xc0) {
74b2466e
LP		 1409 uint16_t ptr;
1410
1411 /* Pointer */
1412 r = dns_packet_read_uint8(p, &d, NULL);
1413 if (r < 0)
e18a3c73 1414 return r;
74b2466e
LP		 1415
1416 ptr = (uint16_t) (c & ~0xc0) << 8 | (uint16_t) d;
e18a3c73
ZJS		 1417 if (ptr < DNS_PACKET_HEADER_SIZE || ptr >= jump_barrier)
1418 return -EBADMSG;
74b2466e
LP		 1419
1420 if (after_rindex == 0)
1421 after_rindex = p->rindex;
1422
f131770b 1423 /* Jumps are limited to a "prior occurrence" (RFC-1035 4.1.4) */
c75dbf9b 1424 jump_barrier = ptr;
74b2466e 1425 p->rindex = ptr;
e18a3c73
ZJS		 1426 } else
1427 return -EBADMSG;
74b2466e
LP		 1428 }
1429
e18a3c73
ZJS		 1430 if (!GREEDY_REALLOC(ret, allocated, n + 1))
1431 return -ENOMEM;
74b2466e
LP		 1432
1433 ret[n] = 0;
1434
1435 if (after_rindex != 0)
1436 p->rindex= after_rindex;
1437
1438 *_ret = ret;
1439 ret = NULL;
1440
1441 if (start)
e18a3c73
ZJS		 1442 *start = rewinder.saved_rindex;
1443 CANCEL_REWINDER(rewinder);
74b2466e
LP		 1444
1445 return 0;
74b2466e
LP		 1446}
1447
50f1e641
TG		 1448static int dns_packet_read_type_window(DnsPacket *p, Bitmap **types, size_t *start) {
1449 uint8_t window;
1450 uint8_t length;
1451 const uint8_t *bitmap;
2ad613ad 1452 uint8_t bit = 0;
50f1e641
TG		 1453 unsigned i;
1454 bool found = false;
e18a3c73 1455 _cleanup_(rewind_dns_packet) DnsPacketRewinder rewinder;
50f1e641
TG		 1456 int r;
1457
1458 assert(p);
1459 assert(types);
e18a3c73 1460 INIT_REWINDER(rewinder, p);
50f1e641
TG		 1461
1462 r = bitmap_ensure_allocated(types);
1463 if (r < 0)
e18a3c73 1464 return r;
50f1e641
TG		 1465
1466 r = dns_packet_read_uint8(p, &window, NULL);
1467 if (r < 0)
e18a3c73 1468 return r;
50f1e641
TG		 1469
1470 r = dns_packet_read_uint8(p, &length, NULL);
1471 if (r < 0)
e18a3c73 1472 return r;
50f1e641
TG		 1473
1474 if (length == 0 || length > 32)
1475 return -EBADMSG;
1476
1477 r = dns_packet_read(p, length, (const void **)&bitmap, NULL);
1478 if (r < 0)
e18a3c73 1479 return r;
50f1e641
TG		 1480
1481 for (i = 0; i < length; i++) {
1482 uint8_t bitmask = 1 << 7;
50f1e641
TG		 1483
1484 if (!bitmap[i]) {
1485 found = false;
2ad613ad 1486 bit += 8;
50f1e641
TG		 1487 continue;
1488 }
1489
1490 found = true;
1491
1492 while (bitmask) {
1493 if (bitmap[i] & bitmask) {
1494 uint16_t n;
1495
50f1e641
TG		 1496 n = (uint16_t) window << 8 | (uint16_t) bit;
1497
8e6edc49
TG		 1498 /* Ignore pseudo-types. see RFC4034 section 4.1.2 */
1499 if (dns_type_is_pseudo(n))
1500 continue;
1501
50f1e641
TG		 1502 r = bitmap_set(*types, n);
1503 if (r < 0)
e18a3c73 1504 return r;
50f1e641
TG		 1505 }
1506
313cefa1 1507 bit++;
50f1e641
TG		 1508 bitmask >>= 1;
1509 }
1510 }
1511
1512 if (!found)
1513 return -EBADMSG;
1514
1515 if (start)
e18a3c73
ZJS		 1516 *start = rewinder.saved_rindex;
1517 CANCEL_REWINDER(rewinder);
50f1e641
TG		 1518
1519 return 0;
50f1e641
TG		 1520}
1521
89492aaf 1522static int dns_packet_read_type_windows(DnsPacket *p, Bitmap **types, size_t size, size_t *start) {
e18a3c73 1523 _cleanup_(rewind_dns_packet) DnsPacketRewinder rewinder;
89492aaf
TG		 1524 int r;
1525
e18a3c73 1526 INIT_REWINDER(rewinder, p);
89492aaf 1527
e18a3c73 1528 while (p->rindex < rewinder.saved_rindex + size) {
89492aaf
TG		 1529 r = dns_packet_read_type_window(p, types, NULL);
1530 if (r < 0)
e18a3c73 1531 return r;
89492aaf
TG		 1532
1533 /* don't read past end of current RR */
e18a3c73
ZJS		 1534 if (p->rindex > rewinder.saved_rindex + size)
1535 return -EBADMSG;
89492aaf
TG		 1536 }
1537
e18a3c73
ZJS		 1538 if (p->rindex != rewinder.saved_rindex + size)
1539 return -EBADMSG;
89492aaf
TG		 1540
1541 if (start)
e18a3c73
ZJS		 1542 *start = rewinder.saved_rindex;
1543 CANCEL_REWINDER(rewinder);
89492aaf
TG		 1544
1545 return 0;
89492aaf
TG		 1546}
1547
d2579eec 1548int dns_packet_read_key(DnsPacket *p, DnsResourceKey **ret, bool *ret_cache_flush, size_t *start) {
e18a3c73 1549 _cleanup_(rewind_dns_packet) DnsPacketRewinder rewinder;
faa133f3 1550 _cleanup_free_ char *name = NULL;
d2579eec 1551 bool cache_flush = false;
faa133f3
LP		 1552 uint16_t class, type;
1553 DnsResourceKey *key;
74b2466e
LP		 1554 int r;
1555
1556 assert(p);
1557 assert(ret);
e18a3c73 1558 INIT_REWINDER(rewinder, p);
74b2466e 1559
151226ab 1560 r = dns_packet_read_name(p, &name, true, NULL);
74b2466e 1561 if (r < 0)
e18a3c73 1562 return r;
74b2466e 1563
faa133f3 1564 r = dns_packet_read_uint16(p, &type, NULL);
74b2466e 1565 if (r < 0)
e18a3c73 1566 return r;
74b2466e 1567
faa133f3 1568 r = dns_packet_read_uint16(p, &class, NULL);
74b2466e 1569 if (r < 0)
e18a3c73 1570 return r;
74b2466e 1571
23502de3
DM		 1572 if (p->protocol == DNS_PROTOCOL_MDNS) {
1573 /* See RFC6762, Section 10.2 */
1574
d2579eec 1575 if (type != DNS_TYPE_OPT && (class & MDNS_RR_CACHE_FLUSH)) {
23502de3 1576 class &= ~MDNS_RR_CACHE_FLUSH;
d2579eec
LP		 1577 cache_flush = true;
1578 }
23502de3
DM		 1579 }
1580
faa133f3 1581 key = dns_resource_key_new_consume(class, type, name);
e18a3c73
ZJS		 1582 if (!key)
1583 return -ENOMEM;
faa133f3
LP		 1584
1585 name = NULL;
1586 *ret = key;
74b2466e 1587
d2579eec
LP		 1588 if (ret_cache_flush)
1589 *ret_cache_flush = cache_flush;
74b2466e 1590 if (start)
e18a3c73
ZJS		 1591 *start = rewinder.saved_rindex;
1592 CANCEL_REWINDER(rewinder);
74b2466e
LP		 1593
1594 return 0;
74b2466e
LP		 1595}
1596
afbc4f26
ZJS		 1597static bool loc_size_ok(uint8_t size) {
1598 uint8_t m = size >> 4, e = size & 0xF;
1599
1600 return m <= 9 && e <= 9 && (m > 0 || e == 0);
1601}
1602
d2579eec 1603int dns_packet_read_rr(DnsPacket *p, DnsResourceRecord **ret, bool *ret_cache_flush, size_t *start) {
faa133f3
LP		 1604 _cleanup_(dns_resource_record_unrefp) DnsResourceRecord *rr = NULL;
1605 _cleanup_(dns_resource_key_unrefp) DnsResourceKey *key = NULL;
e18a3c73
ZJS		 1606 _cleanup_(rewind_dns_packet) DnsPacketRewinder rewinder;
1607 size_t offset;
74b2466e 1608 uint16_t rdlength;
d2579eec 1609 bool cache_flush;
74b2466e
LP		 1610 int r;
1611
1612 assert(p);
1613 assert(ret);
1614
e18a3c73 1615 INIT_REWINDER(rewinder, p);
74b2466e 1616
d2579eec 1617 r = dns_packet_read_key(p, &key, &cache_flush, NULL);
74b2466e 1618 if (r < 0)
e18a3c73 1619 return r;
74b2466e 1620
e18a3c73
ZJS		 1621 if (!dns_class_is_valid_rr(key->class) || !dns_type_is_valid_rr(key->type))
1622 return -EBADMSG;
0e2bcd6a 1623
faa133f3 1624 rr = dns_resource_record_new(key);
e18a3c73
ZJS		 1625 if (!rr)
1626 return -ENOMEM;
faa133f3 1627
74b2466e
LP		 1628 r = dns_packet_read_uint32(p, &rr->ttl, NULL);
1629 if (r < 0)
e18a3c73 1630 return r;
74b2466e 1631
0d0b52d7
LP		 1632 /* RFC 2181, Section 8, suggests to
1633 * treat a TTL with the MSB set as a zero TTL. */
1634 if (rr->ttl & UINT32_C(0x80000000))
1635 rr->ttl = 0;
1636
74b2466e
LP		 1637 r = dns_packet_read_uint16(p, &rdlength, NULL);
1638 if (r < 0)
e18a3c73 1639 return r;
74b2466e 1640
e18a3c73
ZJS		 1641 if (p->rindex + rdlength > p->size)
1642 return -EBADMSG;
74b2466e
LP		 1643
1644 offset = p->rindex;
1645
faa133f3 1646 switch (rr->key->type) {
74b2466e 1647
9c92ce6d
LP		 1648 case DNS_TYPE_SRV:
1649 r = dns_packet_read_uint16(p, &rr->srv.priority, NULL);
1650 if (r < 0)
e18a3c73 1651 return r;
9c92ce6d
LP		 1652 r = dns_packet_read_uint16(p, &rr->srv.weight, NULL);
1653 if (r < 0)
e18a3c73 1654 return r;
9c92ce6d
LP		 1655 r = dns_packet_read_uint16(p, &rr->srv.port, NULL);
1656 if (r < 0)
e18a3c73 1657 return r;
151226ab 1658 r = dns_packet_read_name(p, &rr->srv.name, true, NULL);
9c92ce6d
LP		 1659 break;
1660
74b2466e
LP		 1661 case DNS_TYPE_PTR:
1662 case DNS_TYPE_NS:
1663 case DNS_TYPE_CNAME:
8ac4e9e1 1664 case DNS_TYPE_DNAME:
151226ab 1665 r = dns_packet_read_name(p, &rr->ptr.name, true, NULL);
74b2466e
LP		 1666 break;
1667
1668 case DNS_TYPE_HINFO:
1669 r = dns_packet_read_string(p, &rr->hinfo.cpu, NULL);
1670 if (r < 0)
e18a3c73 1671 return r;
74b2466e
LP		 1672
1673 r = dns_packet_read_string(p, &rr->hinfo.os, NULL);
1674 break;
1675
9de3e329 1676 case DNS_TYPE_SPF: /* exactly the same as TXT */
1ccda9b7
LP		 1677 case DNS_TYPE_TXT:
1678 if (rdlength <= 0) {
2001c805 1679 DnsTxtItem *i;
1ccda9b7
LP		 1680 /* RFC 6763, section 6.1 suggests to treat
1681 * empty TXT RRs as equivalent to a TXT record
1682 * with a single empty string. */
0e3434ae 1683
2001c805
LP		 1684 i = malloc0(offsetof(DnsTxtItem, data) + 1); /* for safety reasons we add an extra NUL byte */
1685 if (!i)
1686 return -ENOMEM;
1687
1688 rr->txt.items = i;
1ccda9b7 1689 } else {
2001c805
LP		 1690 DnsTxtItem *last = NULL;
1691
1ccda9b7 1692 while (p->rindex < offset + rdlength) {
2001c805
LP		 1693 DnsTxtItem *i;
1694 const void *data;
1695 size_t sz;
2e276efc 1696
2001c805 1697 r = dns_packet_read_raw_string(p, &data, &sz, NULL);
1ccda9b7 1698 if (r < 0)
2001c805 1699 return r;
1ccda9b7 1700
2001c805
LP		 1701 i = malloc0(offsetof(DnsTxtItem, data) + sz + 1); /* extra NUL byte at the end */
1702 if (!i)
1703 return -ENOMEM;
1704
1705 memcpy(i->data, data, sz);
1706 i->length = sz;
1707
1708 LIST_INSERT_AFTER(items, rr->txt.items, last, i);
1709 last = i;
1ccda9b7 1710 }
6a6fc3df
LP		 1711 }
1712
1713 r = 0;
2e276efc 1714 break;
2e276efc 1715
74b2466e 1716 case DNS_TYPE_A:
623a4c97 1717 r = dns_packet_read_blob(p, &rr->a.in_addr, sizeof(struct in_addr), NULL);
74b2466e
LP		 1718 break;
1719
1720 case DNS_TYPE_AAAA:
623a4c97 1721 r = dns_packet_read_blob(p, &rr->aaaa.in6_addr, sizeof(struct in6_addr), NULL);
74b2466e
LP		 1722 break;
1723
7e8e0422 1724 case DNS_TYPE_SOA:
151226ab 1725 r = dns_packet_read_name(p, &rr->soa.mname, true, NULL);
7e8e0422 1726 if (r < 0)
e18a3c73 1727 return r;
7e8e0422 1728
151226ab 1729 r = dns_packet_read_name(p, &rr->soa.rname, true, NULL);
7e8e0422 1730 if (r < 0)
e18a3c73 1731 return r;
7e8e0422
LP		 1732
1733 r = dns_packet_read_uint32(p, &rr->soa.serial, NULL);
1734 if (r < 0)
e18a3c73 1735 return r;
7e8e0422
LP		 1736
1737 r = dns_packet_read_uint32(p, &rr->soa.refresh, NULL);
1738 if (r < 0)
e18a3c73 1739 return r;
7e8e0422
LP		 1740
1741 r = dns_packet_read_uint32(p, &rr->soa.retry, NULL);
1742 if (r < 0)
e18a3c73 1743 return r;
7e8e0422
LP		 1744
1745 r = dns_packet_read_uint32(p, &rr->soa.expire, NULL);
1746 if (r < 0)
e18a3c73 1747 return r;
7e8e0422
LP		 1748
1749 r = dns_packet_read_uint32(p, &rr->soa.minimum, NULL);
1750 break;
1751
623a4c97 1752 case DNS_TYPE_MX:
946c7094
ZJS		 1753 r = dns_packet_read_uint16(p, &rr->mx.priority, NULL);
1754 if (r < 0)
e18a3c73 1755 return r;
946c7094 1756
151226ab 1757 r = dns_packet_read_name(p, &rr->mx.exchange, true, NULL);
946c7094
ZJS		 1758 break;
1759
0dae31d4
ZJS		 1760 case DNS_TYPE_LOC: {
1761 uint8_t t;
1762 size_t pos;
1763
1764 r = dns_packet_read_uint8(p, &t, &pos);
1765 if (r < 0)
e18a3c73 1766 return r;
0dae31d4
ZJS		 1767
1768 if (t == 0) {
1769 rr->loc.version = t;
1770
1771 r = dns_packet_read_uint8(p, &rr->loc.size, NULL);
1772 if (r < 0)
e18a3c73 1773 return r;
0dae31d4 1774
e18a3c73
ZJS		 1775 if (!loc_size_ok(rr->loc.size))
1776 return -EBADMSG;
afbc4f26 1777
0dae31d4
ZJS		 1778 r = dns_packet_read_uint8(p, &rr->loc.horiz_pre, NULL);
1779 if (r < 0)
e18a3c73 1780 return r;
0dae31d4 1781
e18a3c73
ZJS		 1782 if (!loc_size_ok(rr->loc.horiz_pre))
1783 return -EBADMSG;
afbc4f26 1784
0dae31d4
ZJS		 1785 r = dns_packet_read_uint8(p, &rr->loc.vert_pre, NULL);
1786 if (r < 0)
e18a3c73 1787 return r;
0dae31d4 1788
e18a3c73
ZJS		 1789 if (!loc_size_ok(rr->loc.vert_pre))
1790 return -EBADMSG;
afbc4f26 1791
0dae31d4
ZJS		 1792 r = dns_packet_read_uint32(p, &rr->loc.latitude, NULL);
1793 if (r < 0)
e18a3c73 1794 return r;
0dae31d4
ZJS		 1795
1796 r = dns_packet_read_uint32(p, &rr->loc.longitude, NULL);
1797 if (r < 0)
e18a3c73 1798 return r;
0dae31d4
ZJS		 1799
1800 r = dns_packet_read_uint32(p, &rr->loc.altitude, NULL);
1801 if (r < 0)
e18a3c73 1802 return r;
0dae31d4
ZJS		 1803
1804 break;
1805 } else {
1806 dns_packet_rewind(p, pos);
1807 rr->unparseable = true;
afbc4f26 1808 goto unparseable;
0dae31d4
ZJS		 1809 }
1810 }
1811
abf126a3
TG		 1812 case DNS_TYPE_DS:
1813 r = dns_packet_read_uint16(p, &rr->ds.key_tag, NULL);
1814 if (r < 0)
e18a3c73 1815 return r;
abf126a3
TG		 1816
1817 r = dns_packet_read_uint8(p, &rr->ds.algorithm, NULL);
1818 if (r < 0)
e18a3c73 1819 return r;
abf126a3
TG		 1820
1821 r = dns_packet_read_uint8(p, &rr->ds.digest_type, NULL);
1822 if (r < 0)
e18a3c73 1823 return r;
abf126a3 1824
f5430a3e
LP		 1825 r = dns_packet_read_memdup(p, rdlength - 4,
1826 &rr->ds.digest, &rr->ds.digest_size,
1827 NULL);
abf126a3 1828 if (r < 0)
e18a3c73 1829 return r;
abf126a3 1830
e18a3c73 1831 if (rr->ds.digest_size <= 0)
f1d178cc
TG		 1832 /* the accepted size depends on the algorithm, but for now
1833 just ensure that the value is greater than zero */
e18a3c73 1834 return -EBADMSG;
f1d178cc 1835
abf126a3 1836 break;
d75acfb0 1837
623a4c97 1838 case DNS_TYPE_SSHFP:
42cc2eeb
LP		 1839 r = dns_packet_read_uint8(p, &rr->sshfp.algorithm, NULL);
1840 if (r < 0)
e18a3c73 1841 return r;
42cc2eeb
LP		 1842
1843 r = dns_packet_read_uint8(p, &rr->sshfp.fptype, NULL);
1844 if (r < 0)
e18a3c73 1845 return r;
42cc2eeb 1846
f5430a3e 1847 r = dns_packet_read_memdup(p, rdlength - 2,
549c1a25 1848 &rr->sshfp.fingerprint, &rr->sshfp.fingerprint_size,
f5430a3e 1849 NULL);
f1d178cc 1850
e18a3c73 1851 if (rr->sshfp.fingerprint_size <= 0)
f1d178cc
TG		 1852 /* the accepted size depends on the algorithm, but for now
1853 just ensure that the value is greater than zero */
e18a3c73 1854 return -EBADMSG;
f1d178cc 1855
8db0d2f5
ZJS		 1856 break;
1857
f91dc240
LP		 1858 case DNS_TYPE_DNSKEY:
1859 r = dns_packet_read_uint16(p, &rr->dnskey.flags, NULL);
8db0d2f5 1860 if (r < 0)
e18a3c73 1861 return r;
8db0d2f5 1862
f91dc240 1863 r = dns_packet_read_uint8(p, &rr->dnskey.protocol, NULL);
8db0d2f5 1864 if (r < 0)
e18a3c73 1865 return r;
8db0d2f5 1866
8db0d2f5
ZJS		 1867 r = dns_packet_read_uint8(p, &rr->dnskey.algorithm, NULL);
1868 if (r < 0)
e18a3c73 1869 return r;
8db0d2f5 1870
f5430a3e
LP		 1871 r = dns_packet_read_memdup(p, rdlength - 4,
1872 &rr->dnskey.key, &rr->dnskey.key_size,
1873 NULL);
f1d178cc 1874
e18a3c73 1875 if (rr->dnskey.key_size <= 0)
f1d178cc
TG		 1876 /* the accepted size depends on the algorithm, but for now
1877 just ensure that the value is greater than zero */
e18a3c73 1878 return -EBADMSG;
f1d178cc 1879
42cc2eeb
LP		 1880 break;
1881
151226ab
ZJS		 1882 case DNS_TYPE_RRSIG:
1883 r = dns_packet_read_uint16(p, &rr->rrsig.type_covered, NULL);
1884 if (r < 0)
e18a3c73 1885 return r;
151226ab
ZJS		 1886
1887 r = dns_packet_read_uint8(p, &rr->rrsig.algorithm, NULL);
1888 if (r < 0)
e18a3c73 1889 return r;
151226ab
ZJS		 1890
1891 r = dns_packet_read_uint8(p, &rr->rrsig.labels, NULL);
1892 if (r < 0)
e18a3c73 1893 return r;
151226ab
ZJS		 1894
1895 r = dns_packet_read_uint32(p, &rr->rrsig.original_ttl, NULL);
1896 if (r < 0)
e18a3c73 1897 return r;
151226ab
ZJS		 1898
1899 r = dns_packet_read_uint32(p, &rr->rrsig.expiration, NULL);
1900 if (r < 0)
e18a3c73 1901 return r;
151226ab
ZJS		 1902
1903 r = dns_packet_read_uint32(p, &rr->rrsig.inception, NULL);
1904 if (r < 0)
e18a3c73 1905 return r;
151226ab
ZJS		 1906
1907 r = dns_packet_read_uint16(p, &rr->rrsig.key_tag, NULL);
1908 if (r < 0)
e18a3c73 1909 return r;
151226ab
ZJS		 1910
1911 r = dns_packet_read_name(p, &rr->rrsig.signer, false, NULL);
1912 if (r < 0)
e18a3c73 1913 return r;
151226ab 1914
f5430a3e
LP		 1915 r = dns_packet_read_memdup(p, offset + rdlength - p->rindex,
1916 &rr->rrsig.signature, &rr->rrsig.signature_size,
1917 NULL);
f1d178cc 1918
e18a3c73 1919 if (rr->rrsig.signature_size <= 0)
f1d178cc
TG		 1920 /* the accepted size depends on the algorithm, but for now
1921 just ensure that the value is greater than zero */
e18a3c73 1922 return -EBADMSG;
f1d178cc 1923
151226ab
ZJS		 1924 break;
1925
d84e543d
DM		 1926 case DNS_TYPE_NSEC: {
1927
1928 /*
e5abebab 1929 * RFC6762, section 18.14 explictly states mDNS should use name compression.
d84e543d
DM		 1930 * This contradicts RFC3845, section 2.1.1
1931 */
1932
1933 bool allow_compressed = p->protocol == DNS_PROTOCOL_MDNS;
1934
1935 r = dns_packet_read_name(p, &rr->nsec.next_domain_name, allow_compressed, NULL);
50f1e641 1936 if (r < 0)
e18a3c73 1937 return r;
50f1e641 1938
89492aaf 1939 r = dns_packet_read_type_windows(p, &rr->nsec.types, offset + rdlength - p->rindex, NULL);
89492aaf 1940
09eaf68c
TG		 1941 /* We accept empty NSEC bitmaps. The bit indicating the presence of the NSEC record itself
1942 * is redundant and in e.g., RFC4956 this fact is used to define a use for NSEC records
1943 * without the NSEC bit set. */
50f1e641
TG		 1944
1945 break;
d84e543d 1946 }
5d45a880
TG		 1947 case DNS_TYPE_NSEC3: {
1948 uint8_t size;
1949
1950 r = dns_packet_read_uint8(p, &rr->nsec3.algorithm, NULL);
1951 if (r < 0)
e18a3c73 1952 return r;
5d45a880
TG		 1953
1954 r = dns_packet_read_uint8(p, &rr->nsec3.flags, NULL);
1955 if (r < 0)
e18a3c73 1956 return r;
5d45a880
TG		 1957
1958 r = dns_packet_read_uint16(p, &rr->nsec3.iterations, NULL);
1959 if (r < 0)
e18a3c73 1960 return r;
5d45a880 1961
f1d178cc 1962 /* this may be zero */
5d45a880
TG		 1963 r = dns_packet_read_uint8(p, &size, NULL);
1964 if (r < 0)
e18a3c73 1965 return r;
5d45a880 1966
f5430a3e 1967 r = dns_packet_read_memdup(p, size, &rr->nsec3.salt, &rr->nsec3.salt_size, NULL);
5d45a880 1968 if (r < 0)
e18a3c73 1969 return r;
5d45a880 1970
5d45a880
TG		 1971 r = dns_packet_read_uint8(p, &size, NULL);
1972 if (r < 0)
e18a3c73 1973 return r;
5d45a880 1974
e18a3c73
ZJS		 1975 if (size <= 0)
1976 return -EBADMSG;
f1d178cc 1977
e18a3c73
ZJS		 1978 r = dns_packet_read_memdup(p, size,
1979 &rr->nsec3.next_hashed_name, &rr->nsec3.next_hashed_name_size,
1980 NULL);
5d45a880 1981 if (r < 0)
e18a3c73 1982 return r;
5d45a880 1983
6b9308d1 1984 r = dns_packet_read_type_windows(p, &rr->nsec3.types, offset + rdlength - p->rindex, NULL);
5d45a880 1985
0bbd72b2
TG		 1986 /* empty non-terminals can have NSEC3 records, so empty bitmaps are allowed */
1987
5d45a880
TG		 1988 break;
1989 }
d75acfb0 1990
48d45d2b
ZJS		 1991 case DNS_TYPE_TLSA:
1992 r = dns_packet_read_uint8(p, &rr->tlsa.cert_usage, NULL);
1993 if (r < 0)
e18a3c73 1994 return r;
48d45d2b
ZJS		 1995
1996 r = dns_packet_read_uint8(p, &rr->tlsa.selector, NULL);
1997 if (r < 0)
e18a3c73 1998 return r;
48d45d2b
ZJS		 1999
2000 r = dns_packet_read_uint8(p, &rr->tlsa.matching_type, NULL);
2001 if (r < 0)
e18a3c73 2002 return r;
48d45d2b
ZJS		 2003
2004 r = dns_packet_read_memdup(p, rdlength - 3,
2005 &rr->tlsa.data, &rr->tlsa.data_size,
2006 NULL);
e18a3c73
ZJS		 2007
2008 if (rr->tlsa.data_size <= 0)
48d45d2b
ZJS		 2009 /* the accepted size depends on the algorithm, but for now
2010 just ensure that the value is greater than zero */
e18a3c73 2011 return -EBADMSG;
48d45d2b
ZJS		 2012
2013 break;
2014
95052df3
ZJS		 2015 case DNS_TYPE_CAA:
2016 r = dns_packet_read_uint8(p, &rr->caa.flags, NULL);
2017 if (r < 0)
2018 return r;
2019
2020 r = dns_packet_read_string(p, &rr->caa.tag, NULL);
2021 if (r < 0)
2022 return r;
2023
2024 r = dns_packet_read_memdup(p,
2025 rdlength + offset - p->rindex,
2026 &rr->caa.value, &rr->caa.value_size, NULL);
48d45d2b
ZJS		 2027
2028 break;
2029
d75acfb0 2030 case DNS_TYPE_OPT: /* we only care about the header of OPT for now. */
d93a16b8 2031 case DNS_TYPE_OPENPGPKEY:
74b2466e 2032 default:
afbc4f26 2033 unparseable:
a43a068a 2034 r = dns_packet_read_memdup(p, rdlength, &rr->generic.data, &rr->generic.data_size, NULL);
e18a3c73 2035
74b2466e
LP		 2036 break;
2037 }
2038 if (r < 0)
e18a3c73
ZJS		 2039 return r;
2040 if (p->rindex != offset + rdlength)
2041 return -EBADMSG;
74b2466e
LP		 2042
2043 *ret = rr;
2044 rr = NULL;
2045
d2579eec
LP		 2046 if (ret_cache_flush)
2047 *ret_cache_flush = cache_flush;
74b2466e 2048 if (start)
e18a3c73
ZJS		 2049 *start = rewinder.saved_rindex;
2050 CANCEL_REWINDER(rewinder);
74b2466e
LP		 2051
2052 return 0;
74b2466e
LP		 2053}
2054
c3f7000e
LP		 2055static bool opt_is_good(DnsResourceRecord *rr, bool *rfc6975) {
2056 const uint8_t* p;
2057 bool found_dau_dhu_n3u = false;
2058 size_t l;
2059
2060 /* Checks whether the specified OPT RR is well-formed and whether it contains RFC6975 data (which is not OK in
2061 * a reply). */
2062
2063 assert(rr);
2064 assert(rr->key->type == DNS_TYPE_OPT);
2065
2066 /* Check that the version is 0 */
b30bf55d
LP		 2067 if (((rr->ttl >> 16) & UINT32_C(0xFF)) != 0) {
2068 *rfc6975 = false;
2069 return true; /* if it's not version 0, it's OK, but we will ignore the OPT field contents */
2070 }
c3f7000e
LP		 2071
2072 p = rr->opt.data;
a43a068a 2073 l = rr->opt.data_size;
c3f7000e
LP		 2074 while (l > 0) {
2075 uint16_t option_code, option_length;
2076
2077 /* At least four bytes for OPTION-CODE and OPTION-LENGTH are required */
2078 if (l < 4U)
2079 return false;
2080
2081 option_code = unaligned_read_be16(p);
2082 option_length = unaligned_read_be16(p + 2);
2083
2084 if (l < option_length + 4U)
2085 return false;
2086
2087 /* RFC 6975 DAU, DHU or N3U fields found. */
2088 if (IN_SET(option_code, 5, 6, 7))
2089 found_dau_dhu_n3u = true;
2090
2091 p += option_length + 4U;
2092 l -= option_length + 4U;
2093 }
2094
2095 *rfc6975 = found_dau_dhu_n3u;
2096 return true;
2097}
2098
faa133f3
LP		 2099int dns_packet_extract(DnsPacket *p) {
2100 _cleanup_(dns_question_unrefp) DnsQuestion *question = NULL;
2101 _cleanup_(dns_answer_unrefp) DnsAnswer *answer = NULL;
e18a3c73 2102 _cleanup_(rewind_dns_packet) DnsPacketRewinder rewinder = {};
faa133f3 2103 unsigned n, i;
74b2466e
LP		 2104 int r;
2105
a4076574
LP		 2106 if (p->extracted)
2107 return 0;
2108
e18a3c73 2109 INIT_REWINDER(rewinder, p);
322345fd
LP		 2110 dns_packet_rewind(p, DNS_PACKET_HEADER_SIZE);
2111
3cb10d3a 2112 n = DNS_PACKET_QDCOUNT(p);
faa133f3
LP		 2113 if (n > 0) {
2114 question = dns_question_new(n);
e18a3c73
ZJS		 2115 if (!question)
2116 return -ENOMEM;
74b2466e 2117
faa133f3
LP		 2118 for (i = 0; i < n; i++) {
2119 _cleanup_(dns_resource_key_unrefp) DnsResourceKey *key = NULL;
d2579eec 2120 bool cache_flush;
74b2466e 2121
d2579eec 2122 r = dns_packet_read_key(p, &key, &cache_flush, NULL);
faa133f3 2123 if (r < 0)
e18a3c73 2124 return r;
74b2466e 2125
e18a3c73
ZJS		 2126 if (cache_flush)
2127 return -EBADMSG;
d2579eec 2128
e18a3c73
ZJS		 2129 if (!dns_type_is_valid_query(key->type))
2130 return -EBADMSG;
c463eb78 2131
faa133f3
LP		 2132 r = dns_question_add(question, key);
2133 if (r < 0)
e18a3c73 2134 return r;
faa133f3
LP		 2135 }
2136 }
322345fd 2137
faa133f3
LP		 2138 n = DNS_PACKET_RRCOUNT(p);
2139 if (n > 0) {
ebc8a106 2140 _cleanup_(dns_resource_record_unrefp) DnsResourceRecord *previous = NULL;
c3f7000e
LP		 2141 bool bad_opt = false;
2142
faa133f3 2143 answer = dns_answer_new(n);
e18a3c73
ZJS		 2144 if (!answer)
2145 return -ENOMEM;
322345fd 2146
faa133f3
LP		 2147 for (i = 0; i < n; i++) {
2148 _cleanup_(dns_resource_record_unrefp) DnsResourceRecord *rr = NULL;
7429b2eb 2149 bool cache_flush = false;
322345fd 2150
ff7febd5 2151 r = dns_packet_read_rr(p, &rr, &cache_flush, NULL);
faa133f3 2152 if (r < 0)
e18a3c73 2153 return r;
322345fd 2154
f57e3cd5
LP		 2155 /* Try to reduce memory usage a bit */
2156 if (previous)
2157 dns_resource_key_reduce(&rr->key, &previous->key);
2158
d75acfb0 2159 if (rr->key->type == DNS_TYPE_OPT) {
c3f7000e
LP		 2160 bool has_rfc6975;
2161
2162 if (p->opt || bad_opt) {
2163 /* Multiple OPT RRs? if so, let's ignore all, because there's something wrong
2164 * with the server, and if one is valid we wouldn't know which one. */
2165 log_debug("Multiple OPT RRs detected, ignoring all.");
2166 bad_opt = true;
2167 continue;
2168 }
e6b57b37 2169
1c02e7ba 2170 if (!dns_name_is_root(dns_resource_key_name(rr->key))) {
1f133e0d 2171 /* If the OPT RR is not owned by the root domain, then it is bad, let's ignore
c3f7000e
LP		 2172 * it. */
2173 log_debug("OPT RR is not owned by root domain, ignoring.");
2174 bad_opt = true;
2175 continue;
2176 }
2177
2178 if (i < DNS_PACKET_ANCOUNT(p) + DNS_PACKET_NSCOUNT(p)) {
2179 /* OPT RR is in the wrong section? Some Belkin routers do this. This is a hint
2180 * the EDNS implementation is borked, like the Belkin one is, hence ignore
2181 * it. */
2182 log_debug("OPT RR in wrong section, ignoring.");
2183 bad_opt = true;
2184 continue;
ff7febd5
LP		 2185 }
2186
c3f7000e
LP		 2187 if (!opt_is_good(rr, &has_rfc6975)) {
2188 log_debug("Malformed OPT RR, ignoring.");
2189 bad_opt = true;
2190 continue;
2191 }
e6b57b37 2192
b30bf55d
LP		 2193 if (DNS_PACKET_QR(p)) {
2194 /* Additional checks for responses */
2195
2196 if (!DNS_RESOURCE_RECORD_OPT_VERSION_SUPPORTED(rr)) {
2197 /* If this is a reply and we don't know the EDNS version then something
2198 * is weird... */
2199 log_debug("EDNS version newer that our request, bad server.");
2200 return -EBADMSG;
2201 }
2202
2203 if (has_rfc6975) {
2204 /* If the OPT RR contains RFC6975 algorithm data, then this is indication that
2205 * the server just copied the OPT it got from us (which contained that data)
2206 * back into the reply. If so, then it doesn't properly support EDNS, as
2207 * RFC6975 makes it very clear that the algorithm data should only be contained
2208 * in questions, never in replies. Crappy Belkin routers copy the OPT data for
2209 * example, hence let's detect this so that we downgrade early. */
2210 log_debug("OPT RR contained RFC6975 data, ignoring.");
2211 bad_opt = true;
2212 continue;
2213 }
e6b57b37 2214 }
d75acfb0
LP		 2215
2216 p->opt = dns_resource_record_ref(rr);
2217 } else {
105e1512 2218
c3f7000e
LP		 2219 /* According to RFC 4795, section 2.9. only the RRs from the Answer section shall be
2220 * cached. Hence mark only those RRs as cacheable by default, but not the ones from the
2221 * Additional or Authority sections. */
105e1512
LP		 2222
2223 r = dns_answer_add(answer, rr, p->ifindex,
d2579eec
LP		 2224 (i < DNS_PACKET_ANCOUNT(p) ? DNS_ANSWER_CACHEABLE : 0) |
2225 (p->protocol == DNS_PROTOCOL_MDNS && !cache_flush ? DNS_ANSWER_SHARED_OWNER : 0));
d75acfb0 2226 if (r < 0)
e18a3c73 2227 return r;
d75acfb0 2228 }
ebc8a106
LP		 2229
2230 /* Remember this RR, so that we potentically can merge it's ->key object with the next RR. Note
2231 * that we only do this if we actually decided to keep the RR around. */
2232 dns_resource_record_unref(previous);
2233 previous = dns_resource_record_ref(rr);
faa133f3 2234 }
c3f7000e
LP		 2235
2236 if (bad_opt)
2237 p->opt = dns_resource_record_unref(p->opt);
322345fd
LP		 2238 }
2239
faa133f3
LP		 2240 p->question = question;
2241 question = NULL;
322345fd 2242
faa133f3
LP		 2243 p->answer = answer;
2244 answer = NULL;
322345fd 2245
a4076574
LP		 2246 p->extracted = true;
2247
e18a3c73
ZJS		 2248 /* no CANCEL, always rewind */
2249 return 0;
322345fd
LP		 2250}
2251
8af5b883
LP		 2252int dns_packet_is_reply_for(DnsPacket *p, const DnsResourceKey *key) {
2253 int r;
2254
2255 assert(p);
2256 assert(key);
2257
2258 /* Checks if the specified packet is a reply for the specified
2259 * key and the specified key is the only one in the question
2260 * section. */
2261
2262 if (DNS_PACKET_QR(p) != 1)
2263 return 0;
2264
2265 /* Let's unpack the packet, if that hasn't happened yet. */
2266 r = dns_packet_extract(p);
2267 if (r < 0)
2268 return r;
2269
2270 if (p->question->n_keys != 1)
2271 return 0;
2272
2273 return dns_resource_key_equal(p->question->keys[0], key);
2274}
2275
74b2466e
LP		 2276static const char* const dns_rcode_table[_DNS_RCODE_MAX_DEFINED] = {
2277 [DNS_RCODE_SUCCESS] = "SUCCESS",
2278 [DNS_RCODE_FORMERR] = "FORMERR",
2279 [DNS_RCODE_SERVFAIL] = "SERVFAIL",
2280 [DNS_RCODE_NXDOMAIN] = "NXDOMAIN",
2281 [DNS_RCODE_NOTIMP] = "NOTIMP",
2282 [DNS_RCODE_REFUSED] = "REFUSED",
2283 [DNS_RCODE_YXDOMAIN] = "YXDOMAIN",
2284 [DNS_RCODE_YXRRSET] = "YRRSET",
2285 [DNS_RCODE_NXRRSET] = "NXRRSET",
2286 [DNS_RCODE_NOTAUTH] = "NOTAUTH",
2287 [DNS_RCODE_NOTZONE] = "NOTZONE",
2288 [DNS_RCODE_BADVERS] = "BADVERS",
2289 [DNS_RCODE_BADKEY] = "BADKEY",
2290 [DNS_RCODE_BADTIME] = "BADTIME",
2291 [DNS_RCODE_BADMODE] = "BADMODE",
2292 [DNS_RCODE_BADNAME] = "BADNAME",
2293 [DNS_RCODE_BADALG] = "BADALG",
2294 [DNS_RCODE_BADTRUNC] = "BADTRUNC",
6f21e066 2295 [DNS_RCODE_BADCOOKIE] = "BADCOOKIE",
74b2466e
LP		 2296};
2297DEFINE_STRING_TABLE_LOOKUP(dns_rcode, int);
1716f6dc
LP		 2298
2299static const char* const dns_protocol_table[_DNS_PROTOCOL_MAX] = {
2300 [DNS_PROTOCOL_DNS] = "dns",
2301 [DNS_PROTOCOL_MDNS] = "mdns",
2302 [DNS_PROTOCOL_LLMNR] = "llmnr",
2303};
2304DEFINE_STRING_TABLE_LOOKUP(dns_protocol, DnsProtocol);
Unnamed repository; edit this file 'description' to name the repository.