]> git.ipfire.org Git - thirdparty/systemd.git/blame - src/resolve/resolved-dns-packet.c
projects / thirdparty / systemd.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Merge pull request #2664 from zonque/bootchart-removal
[thirdparty/systemd.git] / src / resolve / resolved-dns-packet.c
CommitLineData
74b2466e
LP		 1/***
2 This file is part of systemd.
3
4 Copyright 2014 Lennart Poettering
5
6 systemd is free software; you can redistribute it and/or modify it
7 under the terms of the GNU Lesser General Public License as published by
8 the Free Software Foundation; either version 2.1 of the License, or
9 (at your option) any later version.
10
11 systemd is distributed in the hope that it will be useful, but
12 WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 Lesser General Public License for more details.
15
16 You should have received a copy of the GNU Lesser General Public License
17 along with systemd; If not, see <http://www.gnu.org/licenses/>.
18 ***/
19
b5efdb8a 20#include "alloc-util.h"
4ad7f276 21#include "dns-domain.h"
74b2466e 22#include "resolved-dns-packet.h"
8b43440b
LP		 23#include "string-table.h"
24#include "strv.h"
25#include "unaligned.h"
26#include "utf8.h"
27#include "util.h"
74b2466e 28
7586f4d1
TG		 29#define EDNS0_OPT_DO (1<<15)
30
e18a3c73
ZJS		 31typedef struct DnsPacketRewinder {
32 DnsPacket *packet;
33 size_t saved_rindex;
34} DnsPacketRewinder;
35
36static void rewind_dns_packet(DnsPacketRewinder *rewinder) {
37 if (rewinder->packet)
38 dns_packet_rewind(rewinder->packet, rewinder->saved_rindex);
39}
40
41#define INIT_REWINDER(rewinder, p) do { rewinder.packet = p; rewinder.saved_rindex = p->rindex; } while(0)
42#define CANCEL_REWINDER(rewinder) do { rewinder.packet = NULL; } while(0)
43
1716f6dc 44int dns_packet_new(DnsPacket **ret, DnsProtocol protocol, size_t mtu) {
74b2466e
LP		 45 DnsPacket *p;
46 size_t a;
47
48 assert(ret);
49
a0166609 50 if (mtu <= UDP_PACKET_HEADER_SIZE)
74b2466e
LP		 51 a = DNS_PACKET_SIZE_START;
52 else
a0166609 53 a = mtu - UDP_PACKET_HEADER_SIZE;
74b2466e
LP		 54
55 if (a < DNS_PACKET_HEADER_SIZE)
56 a = DNS_PACKET_HEADER_SIZE;
57
c73ce96b
LP		 58 /* round up to next page size */
59 a = PAGE_ALIGN(ALIGN(sizeof(DnsPacket)) + a) - ALIGN(sizeof(DnsPacket));
60
61 /* make sure we never allocate more than useful */
62 if (a > DNS_PACKET_SIZE_MAX)
63 a = DNS_PACKET_SIZE_MAX;
64
74b2466e
LP		 65 p = malloc0(ALIGN(sizeof(DnsPacket)) + a);
66 if (!p)
67 return -ENOMEM;
68
69 p->size = p->rindex = DNS_PACKET_HEADER_SIZE;
70 p->allocated = a;
1716f6dc 71 p->protocol = protocol;
519ef046 72 p->opt_start = p->opt_size = (size_t) -1;
74b2466e
LP		 73 p->n_ref = 1;
74
75 *ret = p;
76
77 return 0;
78}
79
dbfbb6e7 80void dns_packet_set_flags(DnsPacket *p, bool dnssec_checking_disabled, bool truncated) {
74b2466e 81
dbfbb6e7 82 DnsPacketHeader *h;
74b2466e 83
dbfbb6e7 84 assert(p);
74b2466e
LP		 85
86 h = DNS_PACKET_HEADER(p);
1716f6dc 87
dbfbb6e7
DM		 88 switch(p->protocol) {
89 case DNS_PROTOCOL_LLMNR:
90 assert(!truncated);
91
069360a6
LP		 92 h->flags = htobe16(DNS_PACKET_MAKE_FLAGS(0 /* qr */,
93 0 /* opcode */,
94 0 /* c */,
e5abebab 95 0 /* tc */,
069360a6
LP		 96 0 /* t */,
97 0 /* ra */,
98 0 /* ad */,
99 0 /* cd */,
100 0 /* rcode */));
dbfbb6e7
DM		 101 break;
102
103 case DNS_PROTOCOL_MDNS:
104 h->flags = htobe16(DNS_PACKET_MAKE_FLAGS(0 /* qr */,
105 0 /* opcode */,
106 0 /* aa */,
107 truncated /* tc */,
108 0 /* rd (ask for recursion) */,
109 0 /* ra */,
110 0 /* ad */,
111 0 /* cd */,
112 0 /* rcode */));
113 break;
114
115 default:
116 assert(!truncated);
117
069360a6
LP		 118 h->flags = htobe16(DNS_PACKET_MAKE_FLAGS(0 /* qr */,
119 0 /* opcode */,
120 0 /* aa */,
121 0 /* tc */,
122 1 /* rd (ask for recursion) */,
123 0 /* ra */,
124 0 /* ad */,
24710c48 125 dnssec_checking_disabled /* cd */,
069360a6 126 0 /* rcode */));
dbfbb6e7
DM		 127 }
128}
129
130int dns_packet_new_query(DnsPacket **ret, DnsProtocol protocol, size_t mtu, bool dnssec_checking_disabled) {
131 DnsPacket *p;
132 int r;
133
134 assert(ret);
135
136 r = dns_packet_new(&p, protocol, mtu);
137 if (r < 0)
138 return r;
139
140 /* Always set the TC bit to 0 initially.
141 * If there are multiple packets later, we'll update the bit shortly before sending.
142 */
143 dns_packet_set_flags(p, dnssec_checking_disabled, false);
74b2466e
LP		 144
145 *ret = p;
146 return 0;
147}
148
149DnsPacket *dns_packet_ref(DnsPacket *p) {
150
151 if (!p)
152 return NULL;
153
a8812dd7
LP		 154 assert(!p->on_stack);
155
74b2466e
LP		 156 assert(p->n_ref > 0);
157 p->n_ref++;
158 return p;
159}
160
161static void dns_packet_free(DnsPacket *p) {
162 char *s;
163
164 assert(p);
165
faa133f3
LP		 166 dns_question_unref(p->question);
167 dns_answer_unref(p->answer);
d75acfb0 168 dns_resource_record_unref(p->opt);
322345fd 169
74b2466e
LP		 170 while ((s = hashmap_steal_first_key(p->names)))
171 free(s);
172 hashmap_free(p->names);
173
faa133f3 174 free(p->_data);
a8812dd7
LP		 175
176 if (!p->on_stack)
177 free(p);
74b2466e
LP		 178}
179
180DnsPacket *dns_packet_unref(DnsPacket *p) {
181 if (!p)
182 return NULL;
183
184 assert(p->n_ref > 0);
185
6728a58d 186 dns_packet_unref(p->more);
9c491563 187
74b2466e
LP		 188 if (p->n_ref == 1)
189 dns_packet_free(p);
190 else
191 p->n_ref--;
192
193 return NULL;
194}
195
196int dns_packet_validate(DnsPacket *p) {
197 assert(p);
198
199 if (p->size < DNS_PACKET_HEADER_SIZE)
200 return -EBADMSG;
201
c73ce96b
LP		 202 if (p->size > DNS_PACKET_SIZE_MAX)
203 return -EBADMSG;
204
623a4c97 205 return 1;
74b2466e
LP		 206}
207
208int dns_packet_validate_reply(DnsPacket *p) {
74b2466e
LP		 209 int r;
210
211 assert(p);
212
213 r = dns_packet_validate(p);
214 if (r < 0)
215 return r;
216
623a4c97
LP		 217 if (DNS_PACKET_QR(p) != 1)
218 return 0;
219
220 if (DNS_PACKET_OPCODE(p) != 0)
74b2466e
LP		 221 return -EBADMSG;
222
818ef443 223 switch (p->protocol) {
d75acfb0 224
818ef443
DM		 225 case DNS_PROTOCOL_LLMNR:
226 /* RFC 4795, Section 2.1.1. says to discard all replies with QDCOUNT != 1 */
227 if (DNS_PACKET_QDCOUNT(p) != 1)
228 return -EBADMSG;
229
230 break;
231
4e5bf5e1
DM		 232 case DNS_PROTOCOL_MDNS:
233 /* RFC 6762, Section 18 */
234 if (DNS_PACKET_RCODE(p) != 0)
235 return -EBADMSG;
236
237 break;
238
818ef443
DM		 239 default:
240 break;
241 }
ea917db9 242
623a4c97
LP		 243 return 1;
244}
245
246int dns_packet_validate_query(DnsPacket *p) {
247 int r;
248
249 assert(p);
250
251 r = dns_packet_validate(p);
252 if (r < 0)
253 return r;
254
255 if (DNS_PACKET_QR(p) != 0)
256 return 0;
257
3cb10d3a 258 if (DNS_PACKET_OPCODE(p) != 0)
74b2466e
LP		 259 return -EBADMSG;
260
623a4c97
LP		 261 if (DNS_PACKET_TC(p))
262 return -EBADMSG;
263
818ef443 264 switch (p->protocol) {
d75acfb0 265
818ef443
DM		 266 case DNS_PROTOCOL_LLMNR:
267 /* RFC 4795, Section 2.1.1. says to discard all queries with QDCOUNT != 1 */
268 if (DNS_PACKET_QDCOUNT(p) != 1)
269 return -EBADMSG;
623a4c97 270
818ef443
DM		 271 /* RFC 4795, Section 2.1.1. says to discard all queries with ANCOUNT != 0 */
272 if (DNS_PACKET_ANCOUNT(p) > 0)
273 return -EBADMSG;
623a4c97 274
818ef443
DM		 275 /* RFC 4795, Section 2.1.1. says to discard all queries with NSCOUNT != 0 */
276 if (DNS_PACKET_NSCOUNT(p) > 0)
277 return -EBADMSG;
278
279 break;
280
4e5bf5e1
DM		 281 case DNS_PROTOCOL_MDNS:
282 /* RFC 6762, Section 18 */
283 if (DNS_PACKET_AA(p) != 0 ||
284 DNS_PACKET_RD(p) != 0 ||
285 DNS_PACKET_RA(p) != 0 ||
286 DNS_PACKET_AD(p) != 0 ||
287 DNS_PACKET_CD(p) != 0 ||
288 DNS_PACKET_RCODE(p) != 0)
289 return -EBADMSG;
290
291 break;
292
818ef443
DM		 293 default:
294 break;
295 }
623a4c97
LP		 296
297 return 1;
74b2466e
LP		 298}
299
300static int dns_packet_extend(DnsPacket *p, size_t add, void **ret, size_t *start) {
301 assert(p);
302
c73ce96b
LP		 303 if (p->size + add > p->allocated) {
304 size_t a;
305
306 a = PAGE_ALIGN((p->size + add) * 2);
307 if (a > DNS_PACKET_SIZE_MAX)
308 a = DNS_PACKET_SIZE_MAX;
309
310 if (p->size + add > a)
311 return -EMSGSIZE;
312
faa133f3 313 if (p->_data) {
c73ce96b
LP		 314 void *d;
315
faa133f3 316 d = realloc(p->_data, a);
c73ce96b
LP		 317 if (!d)
318 return -ENOMEM;
319
faa133f3 320 p->_data = d;
c73ce96b 321 } else {
faa133f3
LP		 322 p->_data = malloc(a);
323 if (!p->_data)
c73ce96b
LP		 324 return -ENOMEM;
325
faa133f3
LP		 326 memcpy(p->_data, (uint8_t*) p + ALIGN(sizeof(DnsPacket)), p->size);
327 memzero((uint8_t*) p->_data + p->size, a - p->size);
c73ce96b
LP		 328 }
329
330 p->allocated = a;
331 }
74b2466e
LP		 332
333 if (start)
334 *start = p->size;
335
336 if (ret)
337 *ret = (uint8_t*) DNS_PACKET_DATA(p) + p->size;
338
339 p->size += add;
340 return 0;
341}
342
9c5e12a4 343void dns_packet_truncate(DnsPacket *p, size_t sz) {
74b2466e
LP		 344 Iterator i;
345 char *s;
346 void *n;
347
348 assert(p);
349
350 if (p->size <= sz)
351 return;
352
0e03ade5 353 HASHMAP_FOREACH_KEY(n, s, p->names, i) {
74b2466e
LP		 354
355 if (PTR_TO_SIZE(n) < sz)
356 continue;
357
358 hashmap_remove(p->names, s);
359 free(s);
360 }
361
362 p->size = sz;
363}
364
623a4c97
LP		 365int dns_packet_append_blob(DnsPacket *p, const void *d, size_t l, size_t *start) {
366 void *q;
367 int r;
368
369 assert(p);
370
371 r = dns_packet_extend(p, l, &q, start);
372 if (r < 0)
373 return r;
374
375 memcpy(q, d, l);
376 return 0;
377}
378
74b2466e
LP		 379int dns_packet_append_uint8(DnsPacket *p, uint8_t v, size_t *start) {
380 void *d;
381 int r;
382
383 assert(p);
384
385 r = dns_packet_extend(p, sizeof(uint8_t), &d, start);
386 if (r < 0)
387 return r;
388
389 ((uint8_t*) d)[0] = v;
390
391 return 0;
392}
393
394int dns_packet_append_uint16(DnsPacket *p, uint16_t v, size_t *start) {
395 void *d;
396 int r;
397
398 assert(p);
399
400 r = dns_packet_extend(p, sizeof(uint16_t), &d, start);
401 if (r < 0)
402 return r;
403
725ca0e5 404 unaligned_write_be16(d, v);
623a4c97
LP		 405
406 return 0;
407}
408
409int dns_packet_append_uint32(DnsPacket *p, uint32_t v, size_t *start) {
410 void *d;
411 int r;
412
413 assert(p);
414
415 r = dns_packet_extend(p, sizeof(uint32_t), &d, start);
416 if (r < 0)
417 return r;
418
725ca0e5 419 unaligned_write_be32(d, v);
74b2466e
LP		 420
421 return 0;
422}
423
424int dns_packet_append_string(DnsPacket *p, const char *s, size_t *start) {
74b2466e
LP		 425 assert(p);
426 assert(s);
427
c38a52da 428 return dns_packet_append_raw_string(p, s, strlen(s), start);
74b2466e
LP		 429}
430
2001c805
LP		 431int dns_packet_append_raw_string(DnsPacket *p, const void *s, size_t size, size_t *start) {
432 void *d;
433 int r;
434
435 assert(p);
436 assert(s || size == 0);
437
438 if (size > 255)
439 return -E2BIG;
440
441 r = dns_packet_extend(p, 1 + size, &d, start);
442 if (r < 0)
443 return r;
444
445 ((uint8_t*) d)[0] = (uint8_t) size;
446
75f32f04 447 memcpy_safe(((uint8_t*) d) + 1, s, size);
2001c805
LP		 448
449 return 0;
450}
451
a3db237b 452int dns_packet_append_label(DnsPacket *p, const char *d, size_t l, bool canonical_candidate, size_t *start) {
a8812dd7 453 uint8_t *w;
74b2466e
LP		 454 int r;
455
a3db237b
LP		 456 /* Append a label to a packet. Optionally, does this in DNSSEC
457 * canonical form, if this label is marked as a candidate for
458 * it, and the canonical form logic is enabled for the
459 * packet */
460
74b2466e
LP		 461 assert(p);
462 assert(d);
463
464 if (l > DNS_LABEL_MAX)
465 return -E2BIG;
466
a8812dd7 467 r = dns_packet_extend(p, 1 + l, (void**) &w, start);
74b2466e
LP		 468 if (r < 0)
469 return r;
470
a8812dd7
LP		 471 *(w++) = (uint8_t) l;
472
a3db237b 473 if (p->canonical_form && canonical_candidate) {
a8812dd7
LP		 474 size_t i;
475
476 /* Generate in canonical form, as defined by DNSSEC
477 * RFC 4034, Section 6.2, i.e. all lower-case. */
478
b577e3d5
LP		 479 for (i = 0; i < l; i++)
480 w[i] = (uint8_t) ascii_tolower(d[i]);
a8812dd7
LP		 481 } else
482 /* Otherwise, just copy the string unaltered. This is
483 * essential for DNS-SD, where the casing of labels
484 * matters and needs to be retained. */
485 memcpy(w, d, l);
74b2466e
LP		 486
487 return 0;
488}
489
f6a5fec6
LP		 490int dns_packet_append_name(
491 DnsPacket *p,
492 const char *name,
493 bool allow_compression,
a3db237b 494 bool canonical_candidate,
f6a5fec6
LP		 495 size_t *start) {
496
74b2466e
LP		 497 size_t saved_size;
498 int r;
499
500 assert(p);
501 assert(name);
502
f6a5fec6
LP		 503 if (p->refuse_compression)
504 allow_compression = false;
505
74b2466e
LP		 506 saved_size = p->size;
507
e48b9a64 508 while (!dns_name_is_root(name)) {
08f904fd 509 const char *z = name;
74b2466e 510 char label[DNS_LABEL_MAX];
151226ab 511 size_t n = 0;
74b2466e 512
151226ab
ZJS		 513 if (allow_compression)
514 n = PTR_TO_SIZE(hashmap_get(p->names, name));
74b2466e
LP		 515 if (n > 0) {
516 assert(n < p->size);
517
518 if (n < 0x4000) {
519 r = dns_packet_append_uint16(p, 0xC000 | n, NULL);
520 if (r < 0)
521 goto fail;
522
523 goto done;
524 }
525 }
526
74b2466e
LP		 527 r = dns_label_unescape(&name, label, sizeof(label));
528 if (r < 0)
529 goto fail;
530
a3db237b 531 r = dns_packet_append_label(p, label, r, canonical_candidate, &n);
74b2466e
LP		 532 if (r < 0)
533 goto fail;
534
151226ab 535 if (allow_compression) {
08f904fd
LP		 536 _cleanup_free_ char *s = NULL;
537
538 s = strdup(z);
539 if (!s) {
540 r = -ENOMEM;
541 goto fail;
542 }
543
d5099efc 544 r = hashmap_ensure_allocated(&p->names, &dns_name_hash_ops);
151226ab
ZJS		 545 if (r < 0)
546 goto fail;
74b2466e 547
151226ab
ZJS		 548 r = hashmap_put(p->names, s, SIZE_TO_PTR(n));
549 if (r < 0)
550 goto fail;
74b2466e 551
151226ab
ZJS		 552 s = NULL;
553 }
74b2466e
LP		 554 }
555
556 r = dns_packet_append_uint8(p, 0, NULL);
557 if (r < 0)
558 return r;
559
560done:
561 if (start)
562 *start = saved_size;
563
564 return 0;
565
566fail:
567 dns_packet_truncate(p, saved_size);
568 return r;
569}
570
571int dns_packet_append_key(DnsPacket *p, const DnsResourceKey *k, size_t *start) {
572 size_t saved_size;
573 int r;
574
575 assert(p);
576 assert(k);
577
578 saved_size = p->size;
579
1c02e7ba 580 r = dns_packet_append_name(p, dns_resource_key_name(k), true, true, NULL);
74b2466e
LP		 581 if (r < 0)
582 goto fail;
583
584 r = dns_packet_append_uint16(p, k->type, NULL);
585 if (r < 0)
586 goto fail;
587
588 r = dns_packet_append_uint16(p, k->class, NULL);
589 if (r < 0)
590 goto fail;
591
592 if (start)
593 *start = saved_size;
594
595 return 0;
596
597fail:
598 dns_packet_truncate(p, saved_size);
599 return r;
600}
601
e1a9f1a8 602static int dns_packet_append_type_window(DnsPacket *p, uint8_t window, uint8_t length, const uint8_t *types, size_t *start) {
50f1e641
TG		 603 size_t saved_size;
604 int r;
605
606 assert(p);
607 assert(types);
1792f223 608 assert(length > 0);
50f1e641 609
50f1e641
TG		 610 saved_size = p->size;
611
1792f223
TG		 612 r = dns_packet_append_uint8(p, window, NULL);
613 if (r < 0)
614 goto fail;
50f1e641 615
1792f223
TG		 616 r = dns_packet_append_uint8(p, length, NULL);
617 if (r < 0)
618 goto fail;
6fa91901 619
1792f223
TG		 620 r = dns_packet_append_blob(p, types, length, NULL);
621 if (r < 0)
622 goto fail;
50f1e641
TG		 623
624 if (start)
625 *start = saved_size;
626
627 return 0;
628fail:
629 dns_packet_truncate(p, saved_size);
630 return r;
631}
632
633static int dns_packet_append_types(DnsPacket *p, Bitmap *types, size_t *start) {
cb57dd41 634 Iterator i;
50f1e641 635 uint8_t window = 0;
1792f223 636 uint8_t entry = 0;
50f1e641
TG		 637 uint8_t bitmaps[32] = {};
638 unsigned n;
639 size_t saved_size;
640 int r;
641
642 assert(p);
50f1e641
TG		 643
644 saved_size = p->size;
645
cb57dd41 646 BITMAP_FOREACH(n, types, i) {
50f1e641
TG		 647 assert(n <= 0xffff);
648
1792f223
TG		 649 if ((n >> 8) != window && bitmaps[entry / 8] != 0) {
650 r = dns_packet_append_type_window(p, window, entry / 8 + 1, bitmaps, NULL);
50f1e641
TG		 651 if (r < 0)
652 goto fail;
653
1792f223 654 zero(bitmaps);
50f1e641
TG		 655 }
656
1792f223 657 window = n >> 8;
50f1e641
TG		 658 entry = n & 255;
659
660 bitmaps[entry / 8] |= 1 << (7 - (entry % 8));
661 }
662
d0ae14ff
LP		 663 if (bitmaps[entry / 8] != 0) {
664 r = dns_packet_append_type_window(p, window, entry / 8 + 1, bitmaps, NULL);
665 if (r < 0)
666 goto fail;
667 }
50f1e641
TG		 668
669 if (start)
670 *start = saved_size;
671
672 return 0;
673fail:
674 dns_packet_truncate(p, saved_size);
675 return r;
676}
677
dc913c9a 678/* Append the OPT pseudo-RR described in RFC6891 */
519ef046 679int dns_packet_append_opt(DnsPacket *p, uint16_t max_udp_size, bool edns0_do, size_t *start) {
dc913c9a
TG		 680 size_t saved_size;
681 int r;
682
683 assert(p);
684 /* we must never advertise supported packet size smaller than the legacy max */
685 assert(max_udp_size >= DNS_PACKET_UNICAST_SIZE_MAX);
686
519ef046
LP		 687 if (p->opt_start != (size_t) -1)
688 return -EBUSY;
689
690 assert(p->opt_size == (size_t) -1);
691
dc913c9a
TG		 692 saved_size = p->size;
693
694 /* empty name */
695 r = dns_packet_append_uint8(p, 0, NULL);
696 if (r < 0)
697 return r;
698
699 /* type */
700 r = dns_packet_append_uint16(p, DNS_TYPE_OPT, NULL);
701 if (r < 0)
702 goto fail;
703
704 /* maximum udp packet that can be received */
705 r = dns_packet_append_uint16(p, max_udp_size, NULL);
706 if (r < 0)
707 goto fail;
708
709 /* extended RCODE and VERSION */
710 r = dns_packet_append_uint16(p, 0, NULL);
711 if (r < 0)
712 goto fail;
713
7586f4d1
TG		 714 /* flags: DNSSEC OK (DO), see RFC3225 */
715 r = dns_packet_append_uint16(p, edns0_do ? EDNS0_OPT_DO : 0, NULL);
dc913c9a
TG		 716 if (r < 0)
717 goto fail;
718
719 /* RDLENGTH */
665408ac
LP		 720
721 if (edns0_do) {
722 /* If DO is on, also append RFC6975 Algorithm data */
723
724 static const uint8_t rfc6975[] = {
725
726 0, 5, /* OPTION_CODE: DAU */
727 0, 6, /* LIST_LENGTH */
728 DNSSEC_ALGORITHM_RSASHA1,
729 DNSSEC_ALGORITHM_RSASHA1_NSEC3_SHA1,
730 DNSSEC_ALGORITHM_RSASHA256,
731 DNSSEC_ALGORITHM_RSASHA512,
732 DNSSEC_ALGORITHM_ECDSAP256SHA256,
733 DNSSEC_ALGORITHM_ECDSAP384SHA384,
734
735 0, 6, /* OPTION_CODE: DHU */
736 0, 3, /* LIST_LENGTH */
737 DNSSEC_DIGEST_SHA1,
738 DNSSEC_DIGEST_SHA256,
739 DNSSEC_DIGEST_SHA384,
740
741 0, 7, /* OPTION_CODE: N3U */
742 0, 1, /* LIST_LENGTH */
743 NSEC3_ALGORITHM_SHA1,
744 };
745
746 r = dns_packet_append_uint16(p, sizeof(rfc6975), NULL);
747 if (r < 0)
748 goto fail;
749
750 r = dns_packet_append_blob(p, rfc6975, sizeof(rfc6975), NULL);
751 } else
752 r = dns_packet_append_uint16(p, 0, NULL);
753
dc913c9a
TG		 754 if (r < 0)
755 goto fail;
756
519ef046
LP		 757 DNS_PACKET_HEADER(p)->arcount = htobe16(DNS_PACKET_ARCOUNT(p) + 1);
758
759 p->opt_start = saved_size;
760 p->opt_size = p->size - saved_size;
761
dc913c9a
TG		 762 if (start)
763 *start = saved_size;
764
765 return 0;
766
767fail:
768 dns_packet_truncate(p, saved_size);
769 return r;
770}
771
519ef046
LP		 772int dns_packet_truncate_opt(DnsPacket *p) {
773 assert(p);
774
775 if (p->opt_start == (size_t) -1) {
776 assert(p->opt_size == (size_t) -1);
777 return 0;
778 }
779
780 assert(p->opt_size != (size_t) -1);
781 assert(DNS_PACKET_ARCOUNT(p) > 0);
782
783 if (p->opt_start + p->opt_size != p->size)
784 return -EBUSY;
785
786 dns_packet_truncate(p, p->opt_start);
787 DNS_PACKET_HEADER(p)->arcount = htobe16(DNS_PACKET_ARCOUNT(p) - 1);
788 p->opt_start = p->opt_size = (size_t) -1;
789
790 return 1;
791}
792
a8812dd7
LP		 793int dns_packet_append_rr(DnsPacket *p, const DnsResourceRecord *rr, size_t *start, size_t *rdata_start) {
794 size_t saved_size, rdlength_offset, end, rdlength, rds;
623a4c97
LP		 795 int r;
796
797 assert(p);
798 assert(rr);
799
800 saved_size = p->size;
801
802 r = dns_packet_append_key(p, rr->key, NULL);
803 if (r < 0)
804 goto fail;
805
806 r = dns_packet_append_uint32(p, rr->ttl, NULL);
807 if (r < 0)
808 goto fail;
809
810 /* Initially we write 0 here */
811 r = dns_packet_append_uint16(p, 0, &rdlength_offset);
812 if (r < 0)
813 goto fail;
814
a8812dd7
LP		 815 rds = p->size - saved_size;
816
0dae31d4 817 switch (rr->unparseable ? _DNS_TYPE_INVALID : rr->key->type) {
623a4c97 818
9c92ce6d
LP		 819 case DNS_TYPE_SRV:
820 r = dns_packet_append_uint16(p, rr->srv.priority, NULL);
821 if (r < 0)
822 goto fail;
823
824 r = dns_packet_append_uint16(p, rr->srv.weight, NULL);
825 if (r < 0)
826 goto fail;
827
828 r = dns_packet_append_uint16(p, rr->srv.port, NULL);
829 if (r < 0)
830 goto fail;
831
a3db237b 832 r = dns_packet_append_name(p, rr->srv.name, true, false, NULL);
9c92ce6d
LP		 833 break;
834
623a4c97
LP		 835 case DNS_TYPE_PTR:
836 case DNS_TYPE_NS:
837 case DNS_TYPE_CNAME:
8ac4e9e1 838 case DNS_TYPE_DNAME:
a3db237b 839 r = dns_packet_append_name(p, rr->ptr.name, true, false, NULL);
623a4c97
LP		 840 break;
841
842 case DNS_TYPE_HINFO:
843 r = dns_packet_append_string(p, rr->hinfo.cpu, NULL);
844 if (r < 0)
845 goto fail;
846
847 r = dns_packet_append_string(p, rr->hinfo.os, NULL);
848 break;
849
9de3e329 850 case DNS_TYPE_SPF: /* exactly the same as TXT */
2001c805 851 case DNS_TYPE_TXT:
2e276efc 852
2001c805 853 if (!rr->txt.items) {
1ccda9b7
LP		 854 /* RFC 6763, section 6.1 suggests to generate
855 * single empty string for an empty array. */
856
2001c805 857 r = dns_packet_append_raw_string(p, NULL, 0, NULL);
2e276efc
ZJS		 858 if (r < 0)
859 goto fail;
1ccda9b7 860 } else {
2001c805
LP		 861 DnsTxtItem *i;
862
863 LIST_FOREACH(items, i, rr->txt.items) {
864 r = dns_packet_append_raw_string(p, i->data, i->length, NULL);
1ccda9b7
LP		 865 if (r < 0)
866 goto fail;
867 }
2e276efc
ZJS		 868 }
869
6a6fc3df 870 r = 0;
2e276efc 871 break;
2e276efc 872
623a4c97
LP		 873 case DNS_TYPE_A:
874 r = dns_packet_append_blob(p, &rr->a.in_addr, sizeof(struct in_addr), NULL);
875 break;
876
877 case DNS_TYPE_AAAA:
878 r = dns_packet_append_blob(p, &rr->aaaa.in6_addr, sizeof(struct in6_addr), NULL);
879 break;
880
881 case DNS_TYPE_SOA:
a3db237b 882 r = dns_packet_append_name(p, rr->soa.mname, true, false, NULL);
623a4c97
LP		 883 if (r < 0)
884 goto fail;
885
a3db237b 886 r = dns_packet_append_name(p, rr->soa.rname, true, false, NULL);
623a4c97
LP		 887 if (r < 0)
888 goto fail;
889
890 r = dns_packet_append_uint32(p, rr->soa.serial, NULL);
891 if (r < 0)
892 goto fail;
893
894 r = dns_packet_append_uint32(p, rr->soa.refresh, NULL);
895 if (r < 0)
896 goto fail;
897
898 r = dns_packet_append_uint32(p, rr->soa.retry, NULL);
899 if (r < 0)
900 goto fail;
901
902 r = dns_packet_append_uint32(p, rr->soa.expire, NULL);
903 if (r < 0)
904 goto fail;
905
906 r = dns_packet_append_uint32(p, rr->soa.minimum, NULL);
907 break;
908
909 case DNS_TYPE_MX:
946c7094
ZJS		 910 r = dns_packet_append_uint16(p, rr->mx.priority, NULL);
911 if (r < 0)
912 goto fail;
913
a3db237b 914 r = dns_packet_append_name(p, rr->mx.exchange, true, false, NULL);
946c7094
ZJS		 915 break;
916
0dae31d4
ZJS		 917 case DNS_TYPE_LOC:
918 r = dns_packet_append_uint8(p, rr->loc.version, NULL);
919 if (r < 0)
920 goto fail;
921
922 r = dns_packet_append_uint8(p, rr->loc.size, NULL);
923 if (r < 0)
924 goto fail;
925
926 r = dns_packet_append_uint8(p, rr->loc.horiz_pre, NULL);
927 if (r < 0)
928 goto fail;
929
930 r = dns_packet_append_uint8(p, rr->loc.vert_pre, NULL);
931 if (r < 0)
932 goto fail;
933
afbc4f26 934 r = dns_packet_append_uint32(p, rr->loc.latitude, NULL);
0dae31d4
ZJS		 935 if (r < 0)
936 goto fail;
937
afbc4f26 938 r = dns_packet_append_uint32(p, rr->loc.longitude, NULL);
0dae31d4
ZJS		 939 if (r < 0)
940 goto fail;
941
afbc4f26 942 r = dns_packet_append_uint32(p, rr->loc.altitude, NULL);
0dae31d4
ZJS		 943 break;
944
abf126a3
TG		 945 case DNS_TYPE_DS:
946 r = dns_packet_append_uint16(p, rr->ds.key_tag, NULL);
947 if (r < 0)
948 goto fail;
949
950 r = dns_packet_append_uint8(p, rr->ds.algorithm, NULL);
951 if (r < 0)
952 goto fail;
953
954 r = dns_packet_append_uint8(p, rr->ds.digest_type, NULL);
955 if (r < 0)
956 goto fail;
957
958 r = dns_packet_append_blob(p, rr->ds.digest, rr->ds.digest_size, NULL);
959 break;
960
623a4c97 961 case DNS_TYPE_SSHFP:
42cc2eeb
LP		 962 r = dns_packet_append_uint8(p, rr->sshfp.algorithm, NULL);
963 if (r < 0)
964 goto fail;
8db0d2f5 965
42cc2eeb
LP		 966 r = dns_packet_append_uint8(p, rr->sshfp.fptype, NULL);
967 if (r < 0)
968 goto fail;
969
549c1a25 970 r = dns_packet_append_blob(p, rr->sshfp.fingerprint, rr->sshfp.fingerprint_size, NULL);
42cc2eeb
LP		 971 break;
972
8db0d2f5 973 case DNS_TYPE_DNSKEY:
f91dc240 974 r = dns_packet_append_uint16(p, rr->dnskey.flags, NULL);
8db0d2f5
ZJS		 975 if (r < 0)
976 goto fail;
977
f91dc240 978 r = dns_packet_append_uint8(p, rr->dnskey.protocol, NULL);
8db0d2f5
ZJS		 979 if (r < 0)
980 goto fail;
981
982 r = dns_packet_append_uint8(p, rr->dnskey.algorithm, NULL);
983 if (r < 0)
984 goto fail;
985
986 r = dns_packet_append_blob(p, rr->dnskey.key, rr->dnskey.key_size, NULL);
987 break;
988
151226ab
ZJS		 989 case DNS_TYPE_RRSIG:
990 r = dns_packet_append_uint16(p, rr->rrsig.type_covered, NULL);
991 if (r < 0)
992 goto fail;
993
994 r = dns_packet_append_uint8(p, rr->rrsig.algorithm, NULL);
995 if (r < 0)
996 goto fail;
997
998 r = dns_packet_append_uint8(p, rr->rrsig.labels, NULL);
999 if (r < 0)
1000 goto fail;
1001
1002 r = dns_packet_append_uint32(p, rr->rrsig.original_ttl, NULL);
1003 if (r < 0)
1004 goto fail;
1005
1006 r = dns_packet_append_uint32(p, rr->rrsig.expiration, NULL);
1007 if (r < 0)
1008 goto fail;
1009
1010 r = dns_packet_append_uint32(p, rr->rrsig.inception, NULL);
1011 if (r < 0)
1012 goto fail;
1013
0b1b17d3 1014 r = dns_packet_append_uint16(p, rr->rrsig.key_tag, NULL);
151226ab
ZJS		 1015 if (r < 0)
1016 goto fail;
1017
a3db237b 1018 r = dns_packet_append_name(p, rr->rrsig.signer, false, true, NULL);
151226ab
ZJS		 1019 if (r < 0)
1020 goto fail;
1021
1022 r = dns_packet_append_blob(p, rr->rrsig.signature, rr->rrsig.signature_size, NULL);
1023 break;
1024
50f1e641 1025 case DNS_TYPE_NSEC:
a3db237b 1026 r = dns_packet_append_name(p, rr->nsec.next_domain_name, false, false, NULL);
50f1e641
TG		 1027 if (r < 0)
1028 goto fail;
1029
1030 r = dns_packet_append_types(p, rr->nsec.types, NULL);
1031 if (r < 0)
1032 goto fail;
1033
5d45a880 1034 break;
d75acfb0 1035
5d45a880
TG		 1036 case DNS_TYPE_NSEC3:
1037 r = dns_packet_append_uint8(p, rr->nsec3.algorithm, NULL);
1038 if (r < 0)
1039 goto fail;
1040
1041 r = dns_packet_append_uint8(p, rr->nsec3.flags, NULL);
1042 if (r < 0)
1043 goto fail;
1044
1045 r = dns_packet_append_uint16(p, rr->nsec3.iterations, NULL);
1046 if (r < 0)
1047 goto fail;
1048
1049 r = dns_packet_append_uint8(p, rr->nsec3.salt_size, NULL);
1050 if (r < 0)
1051 goto fail;
1052
1053 r = dns_packet_append_blob(p, rr->nsec3.salt, rr->nsec3.salt_size, NULL);
1054 if (r < 0)
1055 goto fail;
1056
1057 r = dns_packet_append_uint8(p, rr->nsec3.next_hashed_name_size, NULL);
1058 if (r < 0)
1059 goto fail;
1060
1061 r = dns_packet_append_blob(p, rr->nsec3.next_hashed_name, rr->nsec3.next_hashed_name_size, NULL);
1062 if (r < 0)
1063 goto fail;
1064
1065 r = dns_packet_append_types(p, rr->nsec3.types, NULL);
1066 if (r < 0)
1067 goto fail;
1068
50f1e641 1069 break;
d75acfb0 1070
48d45d2b
ZJS		 1071 case DNS_TYPE_TLSA:
1072 r = dns_packet_append_uint8(p, rr->tlsa.cert_usage, NULL);
1073 if (r < 0)
1074 goto fail;
1075
1076 r = dns_packet_append_uint8(p, rr->tlsa.selector, NULL);
1077 if (r < 0)
1078 goto fail;
1079
1080 r = dns_packet_append_uint8(p, rr->tlsa.matching_type, NULL);
1081 if (r < 0)
1082 goto fail;
1083
1084 r = dns_packet_append_blob(p, rr->tlsa.data, rr->tlsa.data_size, NULL);
1085 break;
1086
95052df3
ZJS		 1087 case DNS_TYPE_CAA:
1088 r = dns_packet_append_uint8(p, rr->caa.flags, NULL);
1089 if (r < 0)
1090 goto fail;
1091
1092 r = dns_packet_append_string(p, rr->caa.tag, NULL);
1093 if (r < 0)
1094 goto fail;
1095
1096 r = dns_packet_append_blob(p, rr->caa.value, rr->caa.value_size, NULL);
1097 break;
1098
d75acfb0 1099 case DNS_TYPE_OPT:
d93a16b8 1100 case DNS_TYPE_OPENPGPKEY:
0dae31d4 1101 case _DNS_TYPE_INVALID: /* unparseable */
623a4c97 1102 default:
0dae31d4 1103
a43a068a 1104 r = dns_packet_append_blob(p, rr->generic.data, rr->generic.data_size, NULL);
623a4c97
LP		 1105 break;
1106 }
1107 if (r < 0)
1108 goto fail;
1109
1110 /* Let's calculate the actual data size and update the field */
1111 rdlength = p->size - rdlength_offset - sizeof(uint16_t);
1112 if (rdlength > 0xFFFF) {
555f5cdc 1113 r = -ENOSPC;
623a4c97
LP		 1114 goto fail;
1115 }
1116
1117 end = p->size;
1118 p->size = rdlength_offset;
1119 r = dns_packet_append_uint16(p, rdlength, NULL);
1120 if (r < 0)
1121 goto fail;
1122 p->size = end;
1123
351e6342
LP		 1124 if (start)
1125 *start = saved_size;
1126
a8812dd7
LP		 1127 if (rdata_start)
1128 *rdata_start = rds;
1129
623a4c97
LP		 1130 return 0;
1131
1132fail:
1133 dns_packet_truncate(p, saved_size);
1134 return r;
1135}
1136
74b2466e
LP		 1137int dns_packet_read(DnsPacket *p, size_t sz, const void **ret, size_t *start) {
1138 assert(p);
1139
1140 if (p->rindex + sz > p->size)
1141 return -EMSGSIZE;
1142
1143 if (ret)
1144 *ret = (uint8_t*) DNS_PACKET_DATA(p) + p->rindex;
1145
1146 if (start)
1147 *start = p->rindex;
1148
1149 p->rindex += sz;
1150 return 0;
1151}
1152
8ba9fd9c 1153void dns_packet_rewind(DnsPacket *p, size_t idx) {
74b2466e
LP		 1154 assert(p);
1155 assert(idx <= p->size);
1156 assert(idx >= DNS_PACKET_HEADER_SIZE);
1157
1158 p->rindex = idx;
1159}
1160
623a4c97
LP		 1161int dns_packet_read_blob(DnsPacket *p, void *d, size_t sz, size_t *start) {
1162 const void *q;
1163 int r;
1164
1165 assert(p);
1166 assert(d);
1167
1168 r = dns_packet_read(p, sz, &q, start);
1169 if (r < 0)
1170 return r;
1171
1172 memcpy(d, q, sz);
1173 return 0;
1174}
1175
f5430a3e
LP		 1176static int dns_packet_read_memdup(
1177 DnsPacket *p, size_t size,
1178 void **ret, size_t *ret_size,
1179 size_t *ret_start) {
1180
1181 const void *src;
1182 size_t start;
1183 int r;
1184
1185 assert(p);
1186 assert(ret);
1187
1188 r = dns_packet_read(p, size, &src, &start);
1189 if (r < 0)
1190 return r;
1191
1192 if (size <= 0)
1193 *ret = NULL;
1194 else {
1195 void *copy;
1196
1197 copy = memdup(src, size);
1198 if (!copy)
1199 return -ENOMEM;
1200
1201 *ret = copy;
1202 }
1203
1204 if (ret_size)
1205 *ret_size = size;
1206 if (ret_start)
1207 *ret_start = start;
1208
1209 return 0;
1210}
1211
74b2466e
LP		 1212int dns_packet_read_uint8(DnsPacket *p, uint8_t *ret, size_t *start) {
1213 const void *d;
1214 int r;
1215
1216 assert(p);
1217
1218 r = dns_packet_read(p, sizeof(uint8_t), &d, start);
1219 if (r < 0)
1220 return r;
1221
1222 *ret = ((uint8_t*) d)[0];
1223 return 0;
1224}
1225
1226int dns_packet_read_uint16(DnsPacket *p, uint16_t *ret, size_t *start) {
1227 const void *d;
1228 int r;
1229
1230 assert(p);
1231
1232 r = dns_packet_read(p, sizeof(uint16_t), &d, start);
1233 if (r < 0)
1234 return r;
1235
725ca0e5
TG		 1236 *ret = unaligned_read_be16(d);
1237
74b2466e
LP		 1238 return 0;
1239}
1240
1241int dns_packet_read_uint32(DnsPacket *p, uint32_t *ret, size_t *start) {
1242 const void *d;
1243 int r;
1244
1245 assert(p);
1246
1247 r = dns_packet_read(p, sizeof(uint32_t), &d, start);
1248 if (r < 0)
1249 return r;
1250
725ca0e5 1251 *ret = unaligned_read_be32(d);
74b2466e
LP		 1252
1253 return 0;
1254}
1255
1256int dns_packet_read_string(DnsPacket *p, char **ret, size_t *start) {
e18a3c73 1257 _cleanup_(rewind_dns_packet) DnsPacketRewinder rewinder;
74b2466e
LP		 1258 const void *d;
1259 char *t;
1260 uint8_t c;
1261 int r;
1262
1263 assert(p);
e18a3c73 1264 INIT_REWINDER(rewinder, p);
74b2466e
LP		 1265
1266 r = dns_packet_read_uint8(p, &c, NULL);
1267 if (r < 0)
e18a3c73 1268 return r;
74b2466e
LP		 1269
1270 r = dns_packet_read(p, c, &d, NULL);
1271 if (r < 0)
e18a3c73 1272 return r;
74b2466e 1273
e18a3c73
ZJS		 1274 if (memchr(d, 0, c))
1275 return -EBADMSG;
74b2466e
LP		 1276
1277 t = strndup(d, c);
e18a3c73
ZJS		 1278 if (!t)
1279 return -ENOMEM;
74b2466e
LP		 1280
1281 if (!utf8_is_valid(t)) {
1282 free(t);
e18a3c73 1283 return -EBADMSG;
74b2466e
LP		 1284 }
1285
1286 *ret = t;
1287
1288 if (start)
e18a3c73
ZJS		 1289 *start = rewinder.saved_rindex;
1290 CANCEL_REWINDER(rewinder);
74b2466e
LP		 1291
1292 return 0;
74b2466e
LP		 1293}
1294
2001c805 1295int dns_packet_read_raw_string(DnsPacket *p, const void **ret, size_t *size, size_t *start) {
e18a3c73 1296 _cleanup_(rewind_dns_packet) DnsPacketRewinder rewinder;
2001c805
LP		 1297 uint8_t c;
1298 int r;
1299
1300 assert(p);
e18a3c73 1301 INIT_REWINDER(rewinder, p);
2001c805
LP		 1302
1303 r = dns_packet_read_uint8(p, &c, NULL);
1304 if (r < 0)
e18a3c73 1305 return r;
2001c805
LP		 1306
1307 r = dns_packet_read(p, c, ret, NULL);
1308 if (r < 0)
e18a3c73 1309 return r;
2001c805
LP		 1310
1311 if (size)
1312 *size = c;
1313 if (start)
e18a3c73
ZJS		 1314 *start = rewinder.saved_rindex;
1315 CANCEL_REWINDER(rewinder);
2001c805
LP		 1316
1317 return 0;
2001c805
LP		 1318}
1319
f6a5fec6
LP		 1320int dns_packet_read_name(
1321 DnsPacket *p,
1322 char **_ret,
1323 bool allow_compression,
1324 size_t *start) {
1325
e18a3c73
ZJS		 1326 _cleanup_(rewind_dns_packet) DnsPacketRewinder rewinder;
1327 size_t after_rindex = 0, jump_barrier;
74b2466e
LP		 1328 _cleanup_free_ char *ret = NULL;
1329 size_t n = 0, allocated = 0;
1330 bool first = true;
1331 int r;
1332
1333 assert(p);
1334 assert(_ret);
e18a3c73
ZJS		 1335 INIT_REWINDER(rewinder, p);
1336 jump_barrier = p->rindex;
74b2466e 1337
f6a5fec6
LP		 1338 if (p->refuse_compression)
1339 allow_compression = false;
1340
74b2466e
LP		 1341 for (;;) {
1342 uint8_t c, d;
1343
1344 r = dns_packet_read_uint8(p, &c, NULL);
1345 if (r < 0)
e18a3c73 1346 return r;
74b2466e
LP		 1347
1348 if (c == 0)
1349 /* End of name */
1350 break;
1351 else if (c <= 63) {
74b2466e
LP		 1352 const char *label;
1353
1354 /* Literal label */
1355 r = dns_packet_read(p, c, (const void**) &label, NULL);
1356 if (r < 0)
e18a3c73 1357 return r;
74b2466e 1358
e18a3c73
ZJS		 1359 if (!GREEDY_REALLOC(ret, allocated, n + !first + DNS_LABEL_ESCAPED_MAX))
1360 return -ENOMEM;
74b2466e 1361
422baca0 1362 if (first)
74b2466e 1363 first = false;
422baca0
LP		 1364 else
1365 ret[n++] = '.';
1366
1367 r = dns_label_escape(label, c, ret + n, DNS_LABEL_ESCAPED_MAX);
1368 if (r < 0)
e18a3c73 1369 return r;
74b2466e 1370
74b2466e
LP		 1371 n += r;
1372 continue;
151226ab 1373 } else if (allow_compression && (c & 0xc0) == 0xc0) {
74b2466e
LP		 1374 uint16_t ptr;
1375
1376 /* Pointer */
1377 r = dns_packet_read_uint8(p, &d, NULL);
1378 if (r < 0)
e18a3c73 1379 return r;
74b2466e
LP		 1380
1381 ptr = (uint16_t) (c & ~0xc0) << 8 | (uint16_t) d;
e18a3c73
ZJS		 1382 if (ptr < DNS_PACKET_HEADER_SIZE || ptr >= jump_barrier)
1383 return -EBADMSG;
74b2466e
LP		 1384
1385 if (after_rindex == 0)
1386 after_rindex = p->rindex;
1387
f131770b 1388 /* Jumps are limited to a "prior occurrence" (RFC-1035 4.1.4) */
c75dbf9b 1389 jump_barrier = ptr;
74b2466e 1390 p->rindex = ptr;
e18a3c73
ZJS		 1391 } else
1392 return -EBADMSG;
74b2466e
LP		 1393 }
1394
e18a3c73
ZJS		 1395 if (!GREEDY_REALLOC(ret, allocated, n + 1))
1396 return -ENOMEM;
74b2466e
LP		 1397
1398 ret[n] = 0;
1399
1400 if (after_rindex != 0)
1401 p->rindex= after_rindex;
1402
1403 *_ret = ret;
1404 ret = NULL;
1405
1406 if (start)
e18a3c73
ZJS		 1407 *start = rewinder.saved_rindex;
1408 CANCEL_REWINDER(rewinder);
74b2466e
LP		 1409
1410 return 0;
74b2466e
LP		 1411}
1412
50f1e641
TG		 1413static int dns_packet_read_type_window(DnsPacket *p, Bitmap **types, size_t *start) {
1414 uint8_t window;
1415 uint8_t length;
1416 const uint8_t *bitmap;
2ad613ad 1417 uint8_t bit = 0;
50f1e641
TG		 1418 unsigned i;
1419 bool found = false;
e18a3c73 1420 _cleanup_(rewind_dns_packet) DnsPacketRewinder rewinder;
50f1e641
TG		 1421 int r;
1422
1423 assert(p);
1424 assert(types);
e18a3c73 1425 INIT_REWINDER(rewinder, p);
50f1e641
TG		 1426
1427 r = bitmap_ensure_allocated(types);
1428 if (r < 0)
e18a3c73 1429 return r;
50f1e641
TG		 1430
1431 r = dns_packet_read_uint8(p, &window, NULL);
1432 if (r < 0)
e18a3c73 1433 return r;
50f1e641
TG		 1434
1435 r = dns_packet_read_uint8(p, &length, NULL);
1436 if (r < 0)
e18a3c73 1437 return r;
50f1e641
TG		 1438
1439 if (length == 0 || length > 32)
1440 return -EBADMSG;
1441
1442 r = dns_packet_read(p, length, (const void **)&bitmap, NULL);
1443 if (r < 0)
e18a3c73 1444 return r;
50f1e641
TG		 1445
1446 for (i = 0; i < length; i++) {
1447 uint8_t bitmask = 1 << 7;
50f1e641
TG		 1448
1449 if (!bitmap[i]) {
1450 found = false;
2ad613ad 1451 bit += 8;
50f1e641
TG		 1452 continue;
1453 }
1454
1455 found = true;
1456
1457 while (bitmask) {
1458 if (bitmap[i] & bitmask) {
1459 uint16_t n;
1460
50f1e641
TG		 1461 n = (uint16_t) window << 8 | (uint16_t) bit;
1462
8e6edc49
TG		 1463 /* Ignore pseudo-types. see RFC4034 section 4.1.2 */
1464 if (dns_type_is_pseudo(n))
1465 continue;
1466
50f1e641
TG		 1467 r = bitmap_set(*types, n);
1468 if (r < 0)
e18a3c73 1469 return r;
50f1e641
TG		 1470 }
1471
313cefa1 1472 bit++;
50f1e641
TG		 1473 bitmask >>= 1;
1474 }
1475 }
1476
1477 if (!found)
1478 return -EBADMSG;
1479
1480 if (start)
e18a3c73
ZJS		 1481 *start = rewinder.saved_rindex;
1482 CANCEL_REWINDER(rewinder);
50f1e641
TG		 1483
1484 return 0;
50f1e641
TG		 1485}
1486
89492aaf 1487static int dns_packet_read_type_windows(DnsPacket *p, Bitmap **types, size_t size, size_t *start) {
e18a3c73 1488 _cleanup_(rewind_dns_packet) DnsPacketRewinder rewinder;
89492aaf
TG		 1489 int r;
1490
e18a3c73 1491 INIT_REWINDER(rewinder, p);
89492aaf 1492
e18a3c73 1493 while (p->rindex < rewinder.saved_rindex + size) {
89492aaf
TG		 1494 r = dns_packet_read_type_window(p, types, NULL);
1495 if (r < 0)
e18a3c73 1496 return r;
89492aaf
TG		 1497
1498 /* don't read past end of current RR */
e18a3c73
ZJS		 1499 if (p->rindex > rewinder.saved_rindex + size)
1500 return -EBADMSG;
89492aaf
TG		 1501 }
1502
e18a3c73
ZJS		 1503 if (p->rindex != rewinder.saved_rindex + size)
1504 return -EBADMSG;
89492aaf
TG		 1505
1506 if (start)
e18a3c73
ZJS		 1507 *start = rewinder.saved_rindex;
1508 CANCEL_REWINDER(rewinder);
89492aaf
TG		 1509
1510 return 0;
89492aaf
TG		 1511}
1512
d2579eec 1513int dns_packet_read_key(DnsPacket *p, DnsResourceKey **ret, bool *ret_cache_flush, size_t *start) {
e18a3c73 1514 _cleanup_(rewind_dns_packet) DnsPacketRewinder rewinder;
faa133f3 1515 _cleanup_free_ char *name = NULL;
d2579eec 1516 bool cache_flush = false;
faa133f3
LP		 1517 uint16_t class, type;
1518 DnsResourceKey *key;
74b2466e
LP		 1519 int r;
1520
1521 assert(p);
1522 assert(ret);
e18a3c73 1523 INIT_REWINDER(rewinder, p);
74b2466e 1524
151226ab 1525 r = dns_packet_read_name(p, &name, true, NULL);
74b2466e 1526 if (r < 0)
e18a3c73 1527 return r;
74b2466e 1528
faa133f3 1529 r = dns_packet_read_uint16(p, &type, NULL);
74b2466e 1530 if (r < 0)
e18a3c73 1531 return r;
74b2466e 1532
faa133f3 1533 r = dns_packet_read_uint16(p, &class, NULL);
74b2466e 1534 if (r < 0)
e18a3c73 1535 return r;
74b2466e 1536
23502de3
DM		 1537 if (p->protocol == DNS_PROTOCOL_MDNS) {
1538 /* See RFC6762, Section 10.2 */
1539
d2579eec 1540 if (type != DNS_TYPE_OPT && (class & MDNS_RR_CACHE_FLUSH)) {
23502de3 1541 class &= ~MDNS_RR_CACHE_FLUSH;
d2579eec
LP		 1542 cache_flush = true;
1543 }
23502de3
DM		 1544 }
1545
faa133f3 1546 key = dns_resource_key_new_consume(class, type, name);
e18a3c73
ZJS		 1547 if (!key)
1548 return -ENOMEM;
faa133f3
LP		 1549
1550 name = NULL;
1551 *ret = key;
74b2466e 1552
d2579eec
LP		 1553 if (ret_cache_flush)
1554 *ret_cache_flush = cache_flush;
74b2466e 1555 if (start)
e18a3c73
ZJS		 1556 *start = rewinder.saved_rindex;
1557 CANCEL_REWINDER(rewinder);
74b2466e
LP		 1558
1559 return 0;
74b2466e
LP		 1560}
1561
afbc4f26
ZJS		 1562static bool loc_size_ok(uint8_t size) {
1563 uint8_t m = size >> 4, e = size & 0xF;
1564
1565 return m <= 9 && e <= 9 && (m > 0 || e == 0);
1566}
1567
d2579eec 1568int dns_packet_read_rr(DnsPacket *p, DnsResourceRecord **ret, bool *ret_cache_flush, size_t *start) {
faa133f3
LP		 1569 _cleanup_(dns_resource_record_unrefp) DnsResourceRecord *rr = NULL;
1570 _cleanup_(dns_resource_key_unrefp) DnsResourceKey *key = NULL;
e18a3c73
ZJS		 1571 _cleanup_(rewind_dns_packet) DnsPacketRewinder rewinder;
1572 size_t offset;
74b2466e 1573 uint16_t rdlength;
d2579eec 1574 bool cache_flush;
74b2466e
LP		 1575 int r;
1576
1577 assert(p);
1578 assert(ret);
1579
e18a3c73 1580 INIT_REWINDER(rewinder, p);
74b2466e 1581
d2579eec 1582 r = dns_packet_read_key(p, &key, &cache_flush, NULL);
74b2466e 1583 if (r < 0)
e18a3c73 1584 return r;
74b2466e 1585
e18a3c73
ZJS		 1586 if (!dns_class_is_valid_rr(key->class) || !dns_type_is_valid_rr(key->type))
1587 return -EBADMSG;
0e2bcd6a 1588
faa133f3 1589 rr = dns_resource_record_new(key);
e18a3c73
ZJS		 1590 if (!rr)
1591 return -ENOMEM;
faa133f3 1592
74b2466e
LP		 1593 r = dns_packet_read_uint32(p, &rr->ttl, NULL);
1594 if (r < 0)
e18a3c73 1595 return r;
74b2466e 1596
0d0b52d7
LP		 1597 /* RFC 2181, Section 8, suggests to
1598 * treat a TTL with the MSB set as a zero TTL. */
1599 if (rr->ttl & UINT32_C(0x80000000))
1600 rr->ttl = 0;
1601
74b2466e
LP		 1602 r = dns_packet_read_uint16(p, &rdlength, NULL);
1603 if (r < 0)
e18a3c73 1604 return r;
74b2466e 1605
e18a3c73
ZJS		 1606 if (p->rindex + rdlength > p->size)
1607 return -EBADMSG;
74b2466e
LP		 1608
1609 offset = p->rindex;
1610
faa133f3 1611 switch (rr->key->type) {
74b2466e 1612
9c92ce6d
LP		 1613 case DNS_TYPE_SRV:
1614 r = dns_packet_read_uint16(p, &rr->srv.priority, NULL);
1615 if (r < 0)
e18a3c73 1616 return r;
9c92ce6d
LP		 1617 r = dns_packet_read_uint16(p, &rr->srv.weight, NULL);
1618 if (r < 0)
e18a3c73 1619 return r;
9c92ce6d
LP		 1620 r = dns_packet_read_uint16(p, &rr->srv.port, NULL);
1621 if (r < 0)
e18a3c73 1622 return r;
151226ab 1623 r = dns_packet_read_name(p, &rr->srv.name, true, NULL);
9c92ce6d
LP		 1624 break;
1625
74b2466e
LP		 1626 case DNS_TYPE_PTR:
1627 case DNS_TYPE_NS:
1628 case DNS_TYPE_CNAME:
8ac4e9e1 1629 case DNS_TYPE_DNAME:
151226ab 1630 r = dns_packet_read_name(p, &rr->ptr.name, true, NULL);
74b2466e
LP		 1631 break;
1632
1633 case DNS_TYPE_HINFO:
1634 r = dns_packet_read_string(p, &rr->hinfo.cpu, NULL);
1635 if (r < 0)
e18a3c73 1636 return r;
74b2466e
LP		 1637
1638 r = dns_packet_read_string(p, &rr->hinfo.os, NULL);
1639 break;
1640
9de3e329 1641 case DNS_TYPE_SPF: /* exactly the same as TXT */
1ccda9b7
LP		 1642 case DNS_TYPE_TXT:
1643 if (rdlength <= 0) {
2001c805 1644 DnsTxtItem *i;
1ccda9b7
LP		 1645 /* RFC 6763, section 6.1 suggests to treat
1646 * empty TXT RRs as equivalent to a TXT record
1647 * with a single empty string. */
0e3434ae 1648
2001c805
LP		 1649 i = malloc0(offsetof(DnsTxtItem, data) + 1); /* for safety reasons we add an extra NUL byte */
1650 if (!i)
1651 return -ENOMEM;
1652
1653 rr->txt.items = i;
1ccda9b7 1654 } else {
2001c805
LP		 1655 DnsTxtItem *last = NULL;
1656
1ccda9b7 1657 while (p->rindex < offset + rdlength) {
2001c805
LP		 1658 DnsTxtItem *i;
1659 const void *data;
1660 size_t sz;
2e276efc 1661
2001c805 1662 r = dns_packet_read_raw_string(p, &data, &sz, NULL);
1ccda9b7 1663 if (r < 0)
2001c805 1664 return r;
1ccda9b7 1665
2001c805
LP		 1666 i = malloc0(offsetof(DnsTxtItem, data) + sz + 1); /* extra NUL byte at the end */
1667 if (!i)
1668 return -ENOMEM;
1669
1670 memcpy(i->data, data, sz);
1671 i->length = sz;
1672
1673 LIST_INSERT_AFTER(items, rr->txt.items, last, i);
1674 last = i;
1ccda9b7 1675 }
6a6fc3df
LP		 1676 }
1677
1678 r = 0;
2e276efc 1679 break;
2e276efc 1680
74b2466e 1681 case DNS_TYPE_A:
623a4c97 1682 r = dns_packet_read_blob(p, &rr->a.in_addr, sizeof(struct in_addr), NULL);
74b2466e
LP		 1683 break;
1684
1685 case DNS_TYPE_AAAA:
623a4c97 1686 r = dns_packet_read_blob(p, &rr->aaaa.in6_addr, sizeof(struct in6_addr), NULL);
74b2466e
LP		 1687 break;
1688
7e8e0422 1689 case DNS_TYPE_SOA:
151226ab 1690 r = dns_packet_read_name(p, &rr->soa.mname, true, NULL);
7e8e0422 1691 if (r < 0)
e18a3c73 1692 return r;
7e8e0422 1693
151226ab 1694 r = dns_packet_read_name(p, &rr->soa.rname, true, NULL);
7e8e0422 1695 if (r < 0)
e18a3c73 1696 return r;
7e8e0422
LP		 1697
1698 r = dns_packet_read_uint32(p, &rr->soa.serial, NULL);
1699 if (r < 0)
e18a3c73 1700 return r;
7e8e0422
LP		 1701
1702 r = dns_packet_read_uint32(p, &rr->soa.refresh, NULL);
1703 if (r < 0)
e18a3c73 1704 return r;
7e8e0422
LP		 1705
1706 r = dns_packet_read_uint32(p, &rr->soa.retry, NULL);
1707 if (r < 0)
e18a3c73 1708 return r;
7e8e0422
LP		 1709
1710 r = dns_packet_read_uint32(p, &rr->soa.expire, NULL);
1711 if (r < 0)
e18a3c73 1712 return r;
7e8e0422
LP		 1713
1714 r = dns_packet_read_uint32(p, &rr->soa.minimum, NULL);
1715 break;
1716
623a4c97 1717 case DNS_TYPE_MX:
946c7094
ZJS		 1718 r = dns_packet_read_uint16(p, &rr->mx.priority, NULL);
1719 if (r < 0)
e18a3c73 1720 return r;
946c7094 1721
151226ab 1722 r = dns_packet_read_name(p, &rr->mx.exchange, true, NULL);
946c7094
ZJS		 1723 break;
1724
0dae31d4
ZJS		 1725 case DNS_TYPE_LOC: {
1726 uint8_t t;
1727 size_t pos;
1728
1729 r = dns_packet_read_uint8(p, &t, &pos);
1730 if (r < 0)
e18a3c73 1731 return r;
0dae31d4
ZJS		 1732
1733 if (t == 0) {
1734 rr->loc.version = t;
1735
1736 r = dns_packet_read_uint8(p, &rr->loc.size, NULL);
1737 if (r < 0)
e18a3c73 1738 return r;
0dae31d4 1739
e18a3c73
ZJS		 1740 if (!loc_size_ok(rr->loc.size))
1741 return -EBADMSG;
afbc4f26 1742
0dae31d4
ZJS		 1743 r = dns_packet_read_uint8(p, &rr->loc.horiz_pre, NULL);
1744 if (r < 0)
e18a3c73 1745 return r;
0dae31d4 1746
e18a3c73
ZJS		 1747 if (!loc_size_ok(rr->loc.horiz_pre))
1748 return -EBADMSG;
afbc4f26 1749
0dae31d4
ZJS		 1750 r = dns_packet_read_uint8(p, &rr->loc.vert_pre, NULL);
1751 if (r < 0)
e18a3c73 1752 return r;
0dae31d4 1753
e18a3c73
ZJS		 1754 if (!loc_size_ok(rr->loc.vert_pre))
1755 return -EBADMSG;
afbc4f26 1756
0dae31d4
ZJS		 1757 r = dns_packet_read_uint32(p, &rr->loc.latitude, NULL);
1758 if (r < 0)
e18a3c73 1759 return r;
0dae31d4
ZJS		 1760
1761 r = dns_packet_read_uint32(p, &rr->loc.longitude, NULL);
1762 if (r < 0)
e18a3c73 1763 return r;
0dae31d4
ZJS		 1764
1765 r = dns_packet_read_uint32(p, &rr->loc.altitude, NULL);
1766 if (r < 0)
e18a3c73 1767 return r;
0dae31d4
ZJS		 1768
1769 break;
1770 } else {
1771 dns_packet_rewind(p, pos);
1772 rr->unparseable = true;
afbc4f26 1773 goto unparseable;
0dae31d4
ZJS		 1774 }
1775 }
1776
abf126a3
TG		 1777 case DNS_TYPE_DS:
1778 r = dns_packet_read_uint16(p, &rr->ds.key_tag, NULL);
1779 if (r < 0)
e18a3c73 1780 return r;
abf126a3
TG		 1781
1782 r = dns_packet_read_uint8(p, &rr->ds.algorithm, NULL);
1783 if (r < 0)
e18a3c73 1784 return r;
abf126a3
TG		 1785
1786 r = dns_packet_read_uint8(p, &rr->ds.digest_type, NULL);
1787 if (r < 0)
e18a3c73 1788 return r;
abf126a3 1789
f5430a3e
LP		 1790 r = dns_packet_read_memdup(p, rdlength - 4,
1791 &rr->ds.digest, &rr->ds.digest_size,
1792 NULL);
abf126a3 1793 if (r < 0)
e18a3c73 1794 return r;
abf126a3 1795
e18a3c73 1796 if (rr->ds.digest_size <= 0)
f1d178cc
TG		 1797 /* the accepted size depends on the algorithm, but for now
1798 just ensure that the value is greater than zero */
e18a3c73 1799 return -EBADMSG;
f1d178cc 1800
abf126a3 1801 break;
d75acfb0 1802
623a4c97 1803 case DNS_TYPE_SSHFP:
42cc2eeb
LP		 1804 r = dns_packet_read_uint8(p, &rr->sshfp.algorithm, NULL);
1805 if (r < 0)
e18a3c73 1806 return r;
42cc2eeb
LP		 1807
1808 r = dns_packet_read_uint8(p, &rr->sshfp.fptype, NULL);
1809 if (r < 0)
e18a3c73 1810 return r;
42cc2eeb 1811
f5430a3e 1812 r = dns_packet_read_memdup(p, rdlength - 2,
549c1a25 1813 &rr->sshfp.fingerprint, &rr->sshfp.fingerprint_size,
f5430a3e 1814 NULL);
f1d178cc 1815
e18a3c73 1816 if (rr->sshfp.fingerprint_size <= 0)
f1d178cc
TG		 1817 /* the accepted size depends on the algorithm, but for now
1818 just ensure that the value is greater than zero */
e18a3c73 1819 return -EBADMSG;
f1d178cc 1820
8db0d2f5
ZJS		 1821 break;
1822
f91dc240
LP		 1823 case DNS_TYPE_DNSKEY:
1824 r = dns_packet_read_uint16(p, &rr->dnskey.flags, NULL);
8db0d2f5 1825 if (r < 0)
e18a3c73 1826 return r;
8db0d2f5 1827
f91dc240 1828 r = dns_packet_read_uint8(p, &rr->dnskey.protocol, NULL);
8db0d2f5 1829 if (r < 0)
e18a3c73 1830 return r;
8db0d2f5 1831
8db0d2f5
ZJS		 1832 r = dns_packet_read_uint8(p, &rr->dnskey.algorithm, NULL);
1833 if (r < 0)
e18a3c73 1834 return r;
8db0d2f5 1835
f5430a3e
LP		 1836 r = dns_packet_read_memdup(p, rdlength - 4,
1837 &rr->dnskey.key, &rr->dnskey.key_size,
1838 NULL);
f1d178cc 1839
e18a3c73 1840 if (rr->dnskey.key_size <= 0)
f1d178cc
TG		 1841 /* the accepted size depends on the algorithm, but for now
1842 just ensure that the value is greater than zero */
e18a3c73 1843 return -EBADMSG;
f1d178cc 1844
42cc2eeb
LP		 1845 break;
1846
151226ab
ZJS		 1847 case DNS_TYPE_RRSIG:
1848 r = dns_packet_read_uint16(p, &rr->rrsig.type_covered, NULL);
1849 if (r < 0)
e18a3c73 1850 return r;
151226ab
ZJS		 1851
1852 r = dns_packet_read_uint8(p, &rr->rrsig.algorithm, NULL);
1853 if (r < 0)
e18a3c73 1854 return r;
151226ab
ZJS		 1855
1856 r = dns_packet_read_uint8(p, &rr->rrsig.labels, NULL);
1857 if (r < 0)
e18a3c73 1858 return r;
151226ab
ZJS		 1859
1860 r = dns_packet_read_uint32(p, &rr->rrsig.original_ttl, NULL);
1861 if (r < 0)
e18a3c73 1862 return r;
151226ab
ZJS		 1863
1864 r = dns_packet_read_uint32(p, &rr->rrsig.expiration, NULL);
1865 if (r < 0)
e18a3c73 1866 return r;
151226ab
ZJS		 1867
1868 r = dns_packet_read_uint32(p, &rr->rrsig.inception, NULL);
1869 if (r < 0)
e18a3c73 1870 return r;
151226ab
ZJS		 1871
1872 r = dns_packet_read_uint16(p, &rr->rrsig.key_tag, NULL);
1873 if (r < 0)
e18a3c73 1874 return r;
151226ab
ZJS		 1875
1876 r = dns_packet_read_name(p, &rr->rrsig.signer, false, NULL);
1877 if (r < 0)
e18a3c73 1878 return r;
151226ab 1879
f5430a3e
LP		 1880 r = dns_packet_read_memdup(p, offset + rdlength - p->rindex,
1881 &rr->rrsig.signature, &rr->rrsig.signature_size,
1882 NULL);
f1d178cc 1883
e18a3c73 1884 if (rr->rrsig.signature_size <= 0)
f1d178cc
TG		 1885 /* the accepted size depends on the algorithm, but for now
1886 just ensure that the value is greater than zero */
e18a3c73 1887 return -EBADMSG;
f1d178cc 1888
151226ab
ZJS		 1889 break;
1890
d84e543d
DM		 1891 case DNS_TYPE_NSEC: {
1892
1893 /*
e5abebab 1894 * RFC6762, section 18.14 explictly states mDNS should use name compression.
d84e543d
DM		 1895 * This contradicts RFC3845, section 2.1.1
1896 */
1897
1898 bool allow_compressed = p->protocol == DNS_PROTOCOL_MDNS;
1899
1900 r = dns_packet_read_name(p, &rr->nsec.next_domain_name, allow_compressed, NULL);
50f1e641 1901 if (r < 0)
e18a3c73 1902 return r;
50f1e641 1903
89492aaf 1904 r = dns_packet_read_type_windows(p, &rr->nsec.types, offset + rdlength - p->rindex, NULL);
89492aaf 1905
09eaf68c
TG		 1906 /* We accept empty NSEC bitmaps. The bit indicating the presence of the NSEC record itself
1907 * is redundant and in e.g., RFC4956 this fact is used to define a use for NSEC records
1908 * without the NSEC bit set. */
50f1e641
TG		 1909
1910 break;
d84e543d 1911 }
5d45a880
TG		 1912 case DNS_TYPE_NSEC3: {
1913 uint8_t size;
1914
1915 r = dns_packet_read_uint8(p, &rr->nsec3.algorithm, NULL);
1916 if (r < 0)
e18a3c73 1917 return r;
5d45a880
TG		 1918
1919 r = dns_packet_read_uint8(p, &rr->nsec3.flags, NULL);
1920 if (r < 0)
e18a3c73 1921 return r;
5d45a880
TG		 1922
1923 r = dns_packet_read_uint16(p, &rr->nsec3.iterations, NULL);
1924 if (r < 0)
e18a3c73 1925 return r;
5d45a880 1926
f1d178cc 1927 /* this may be zero */
5d45a880
TG		 1928 r = dns_packet_read_uint8(p, &size, NULL);
1929 if (r < 0)
e18a3c73 1930 return r;
5d45a880 1931
f5430a3e 1932 r = dns_packet_read_memdup(p, size, &rr->nsec3.salt, &rr->nsec3.salt_size, NULL);
5d45a880 1933 if (r < 0)
e18a3c73 1934 return r;
5d45a880 1935
5d45a880
TG		 1936 r = dns_packet_read_uint8(p, &size, NULL);
1937 if (r < 0)
e18a3c73 1938 return r;
5d45a880 1939
e18a3c73
ZJS		 1940 if (size <= 0)
1941 return -EBADMSG;
f1d178cc 1942
e18a3c73
ZJS		 1943 r = dns_packet_read_memdup(p, size,
1944 &rr->nsec3.next_hashed_name, &rr->nsec3.next_hashed_name_size,
1945 NULL);
5d45a880 1946 if (r < 0)
e18a3c73 1947 return r;
5d45a880 1948
6b9308d1 1949 r = dns_packet_read_type_windows(p, &rr->nsec3.types, offset + rdlength - p->rindex, NULL);
5d45a880 1950
0bbd72b2
TG		 1951 /* empty non-terminals can have NSEC3 records, so empty bitmaps are allowed */
1952
5d45a880
TG		 1953 break;
1954 }
d75acfb0 1955
48d45d2b
ZJS		 1956 case DNS_TYPE_TLSA:
1957 r = dns_packet_read_uint8(p, &rr->tlsa.cert_usage, NULL);
1958 if (r < 0)
e18a3c73 1959 return r;
48d45d2b
ZJS		 1960
1961 r = dns_packet_read_uint8(p, &rr->tlsa.selector, NULL);
1962 if (r < 0)
e18a3c73 1963 return r;
48d45d2b
ZJS		 1964
1965 r = dns_packet_read_uint8(p, &rr->tlsa.matching_type, NULL);
1966 if (r < 0)
e18a3c73 1967 return r;
48d45d2b
ZJS		 1968
1969 r = dns_packet_read_memdup(p, rdlength - 3,
1970 &rr->tlsa.data, &rr->tlsa.data_size,
1971 NULL);
e18a3c73
ZJS		 1972
1973 if (rr->tlsa.data_size <= 0)
48d45d2b
ZJS		 1974 /* the accepted size depends on the algorithm, but for now
1975 just ensure that the value is greater than zero */
e18a3c73 1976 return -EBADMSG;
48d45d2b
ZJS		 1977
1978 break;
1979
95052df3
ZJS		 1980 case DNS_TYPE_CAA:
1981 r = dns_packet_read_uint8(p, &rr->caa.flags, NULL);
1982 if (r < 0)
1983 return r;
1984
1985 r = dns_packet_read_string(p, &rr->caa.tag, NULL);
1986 if (r < 0)
1987 return r;
1988
1989 r = dns_packet_read_memdup(p,
1990 rdlength + offset - p->rindex,
1991 &rr->caa.value, &rr->caa.value_size, NULL);
48d45d2b
ZJS		 1992
1993 break;
1994
d75acfb0 1995 case DNS_TYPE_OPT: /* we only care about the header of OPT for now. */
d93a16b8 1996 case DNS_TYPE_OPENPGPKEY:
74b2466e 1997 default:
afbc4f26 1998 unparseable:
a43a068a 1999 r = dns_packet_read_memdup(p, rdlength, &rr->generic.data, &rr->generic.data_size, NULL);
e18a3c73 2000
74b2466e
LP		 2001 break;
2002 }
2003 if (r < 0)
e18a3c73
ZJS		 2004 return r;
2005 if (p->rindex != offset + rdlength)
2006 return -EBADMSG;
74b2466e
LP		 2007
2008 *ret = rr;
2009 rr = NULL;
2010
d2579eec
LP		 2011 if (ret_cache_flush)
2012 *ret_cache_flush = cache_flush;
74b2466e 2013 if (start)
e18a3c73
ZJS		 2014 *start = rewinder.saved_rindex;
2015 CANCEL_REWINDER(rewinder);
74b2466e
LP		 2016
2017 return 0;
74b2466e
LP		 2018}
2019
c3f7000e
LP		 2020static bool opt_is_good(DnsResourceRecord *rr, bool *rfc6975) {
2021 const uint8_t* p;
2022 bool found_dau_dhu_n3u = false;
2023 size_t l;
2024
2025 /* Checks whether the specified OPT RR is well-formed and whether it contains RFC6975 data (which is not OK in
2026 * a reply). */
2027
2028 assert(rr);
2029 assert(rr->key->type == DNS_TYPE_OPT);
2030
2031 /* Check that the version is 0 */
2032 if (((rr->ttl >> 16) & UINT32_C(0xFF)) != 0)
2033 return false;
2034
2035 p = rr->opt.data;
a43a068a 2036 l = rr->opt.data_size;
c3f7000e
LP		 2037 while (l > 0) {
2038 uint16_t option_code, option_length;
2039
2040 /* At least four bytes for OPTION-CODE and OPTION-LENGTH are required */
2041 if (l < 4U)
2042 return false;
2043
2044 option_code = unaligned_read_be16(p);
2045 option_length = unaligned_read_be16(p + 2);
2046
2047 if (l < option_length + 4U)
2048 return false;
2049
2050 /* RFC 6975 DAU, DHU or N3U fields found. */
2051 if (IN_SET(option_code, 5, 6, 7))
2052 found_dau_dhu_n3u = true;
2053
2054 p += option_length + 4U;
2055 l -= option_length + 4U;
2056 }
2057
2058 *rfc6975 = found_dau_dhu_n3u;
2059 return true;
2060}
2061
faa133f3
LP		 2062int dns_packet_extract(DnsPacket *p) {
2063 _cleanup_(dns_question_unrefp) DnsQuestion *question = NULL;
2064 _cleanup_(dns_answer_unrefp) DnsAnswer *answer = NULL;
e18a3c73 2065 _cleanup_(rewind_dns_packet) DnsPacketRewinder rewinder = {};
faa133f3 2066 unsigned n, i;
74b2466e
LP		 2067 int r;
2068
a4076574
LP		 2069 if (p->extracted)
2070 return 0;
2071
e18a3c73 2072 INIT_REWINDER(rewinder, p);
322345fd
LP		 2073 dns_packet_rewind(p, DNS_PACKET_HEADER_SIZE);
2074
3cb10d3a 2075 n = DNS_PACKET_QDCOUNT(p);
faa133f3
LP		 2076 if (n > 0) {
2077 question = dns_question_new(n);
e18a3c73
ZJS		 2078 if (!question)
2079 return -ENOMEM;
74b2466e 2080
faa133f3
LP		 2081 for (i = 0; i < n; i++) {
2082 _cleanup_(dns_resource_key_unrefp) DnsResourceKey *key = NULL;
d2579eec 2083 bool cache_flush;
74b2466e 2084
d2579eec 2085 r = dns_packet_read_key(p, &key, &cache_flush, NULL);
faa133f3 2086 if (r < 0)
e18a3c73 2087 return r;
74b2466e 2088
e18a3c73
ZJS		 2089 if (cache_flush)
2090 return -EBADMSG;
d2579eec 2091
e18a3c73
ZJS		 2092 if (!dns_type_is_valid_query(key->type))
2093 return -EBADMSG;
c463eb78 2094
faa133f3
LP		 2095 r = dns_question_add(question, key);
2096 if (r < 0)
e18a3c73 2097 return r;
faa133f3
LP		 2098 }
2099 }
322345fd 2100
faa133f3
LP		 2101 n = DNS_PACKET_RRCOUNT(p);
2102 if (n > 0) {
ebc8a106 2103 _cleanup_(dns_resource_record_unrefp) DnsResourceRecord *previous = NULL;
c3f7000e
LP		 2104 bool bad_opt = false;
2105
faa133f3 2106 answer = dns_answer_new(n);
e18a3c73
ZJS		 2107 if (!answer)
2108 return -ENOMEM;
322345fd 2109
faa133f3
LP		 2110 for (i = 0; i < n; i++) {
2111 _cleanup_(dns_resource_record_unrefp) DnsResourceRecord *rr = NULL;
ff7febd5 2112 bool cache_flush;
322345fd 2113
ff7febd5 2114 r = dns_packet_read_rr(p, &rr, &cache_flush, NULL);
faa133f3 2115 if (r < 0)
e18a3c73 2116 return r;
322345fd 2117
f57e3cd5
LP		 2118 /* Try to reduce memory usage a bit */
2119 if (previous)
2120 dns_resource_key_reduce(&rr->key, &previous->key);
2121
d75acfb0 2122 if (rr->key->type == DNS_TYPE_OPT) {
c3f7000e
LP		 2123 bool has_rfc6975;
2124
2125 if (p->opt || bad_opt) {
2126 /* Multiple OPT RRs? if so, let's ignore all, because there's something wrong
2127 * with the server, and if one is valid we wouldn't know which one. */
2128 log_debug("Multiple OPT RRs detected, ignoring all.");
2129 bad_opt = true;
2130 continue;
2131 }
e6b57b37 2132
1c02e7ba 2133 if (!dns_name_is_root(dns_resource_key_name(rr->key))) {
1f133e0d 2134 /* If the OPT RR is not owned by the root domain, then it is bad, let's ignore
c3f7000e
LP		 2135 * it. */
2136 log_debug("OPT RR is not owned by root domain, ignoring.");
2137 bad_opt = true;
2138 continue;
2139 }
2140
2141 if (i < DNS_PACKET_ANCOUNT(p) + DNS_PACKET_NSCOUNT(p)) {
2142 /* OPT RR is in the wrong section? Some Belkin routers do this. This is a hint
2143 * the EDNS implementation is borked, like the Belkin one is, hence ignore
2144 * it. */
2145 log_debug("OPT RR in wrong section, ignoring.");
2146 bad_opt = true;
2147 continue;
ff7febd5
LP		 2148 }
2149
c3f7000e
LP		 2150 if (!opt_is_good(rr, &has_rfc6975)) {
2151 log_debug("Malformed OPT RR, ignoring.");
2152 bad_opt = true;
2153 continue;
2154 }
e6b57b37 2155
c3f7000e 2156 if (has_rfc6975) {
ebc8a106
LP		 2157 /* If the OPT RR contains RFC6975 algorithm data, then this is indication that
2158 * the server just copied the OPT it got from us (which contained that data)
2159 * back into the reply. If so, then it doesn't properly support EDNS, as
2160 * RFC6975 makes it very clear that the algorithm data should only be contained
2161 * in questions, never in replies. Crappy Belkin routers copy the OPT data for
2162 * example, hence let's detect this so that we downgrade early. */
c3f7000e
LP		 2163 log_debug("OPT RR contained RFC6975 data, ignoring.");
2164 bad_opt = true;
2165 continue;
e6b57b37 2166 }
d75acfb0
LP		 2167
2168 p->opt = dns_resource_record_ref(rr);
2169 } else {
105e1512 2170
c3f7000e
LP		 2171 /* According to RFC 4795, section 2.9. only the RRs from the Answer section shall be
2172 * cached. Hence mark only those RRs as cacheable by default, but not the ones from the
2173 * Additional or Authority sections. */
105e1512
LP		 2174
2175 r = dns_answer_add(answer, rr, p->ifindex,
d2579eec
LP		 2176 (i < DNS_PACKET_ANCOUNT(p) ? DNS_ANSWER_CACHEABLE : 0) |
2177 (p->protocol == DNS_PROTOCOL_MDNS && !cache_flush ? DNS_ANSWER_SHARED_OWNER : 0));
d75acfb0 2178 if (r < 0)
e18a3c73 2179 return r;
d75acfb0 2180 }
ebc8a106
LP		 2181
2182 /* Remember this RR, so that we potentically can merge it's ->key object with the next RR. Note
2183 * that we only do this if we actually decided to keep the RR around. */
2184 dns_resource_record_unref(previous);
2185 previous = dns_resource_record_ref(rr);
faa133f3 2186 }
c3f7000e
LP		 2187
2188 if (bad_opt)
2189 p->opt = dns_resource_record_unref(p->opt);
322345fd
LP		 2190 }
2191
faa133f3
LP		 2192 p->question = question;
2193 question = NULL;
322345fd 2194
faa133f3
LP		 2195 p->answer = answer;
2196 answer = NULL;
322345fd 2197
a4076574
LP		 2198 p->extracted = true;
2199
e18a3c73
ZJS		 2200 /* no CANCEL, always rewind */
2201 return 0;
322345fd
LP		 2202}
2203
8af5b883
LP		 2204int dns_packet_is_reply_for(DnsPacket *p, const DnsResourceKey *key) {
2205 int r;
2206
2207 assert(p);
2208 assert(key);
2209
2210 /* Checks if the specified packet is a reply for the specified
2211 * key and the specified key is the only one in the question
2212 * section. */
2213
2214 if (DNS_PACKET_QR(p) != 1)
2215 return 0;
2216
2217 /* Let's unpack the packet, if that hasn't happened yet. */
2218 r = dns_packet_extract(p);
2219 if (r < 0)
2220 return r;
2221
2222 if (p->question->n_keys != 1)
2223 return 0;
2224
2225 return dns_resource_key_equal(p->question->keys[0], key);
2226}
2227
74b2466e
LP		 2228static const char* const dns_rcode_table[_DNS_RCODE_MAX_DEFINED] = {
2229 [DNS_RCODE_SUCCESS] = "SUCCESS",
2230 [DNS_RCODE_FORMERR] = "FORMERR",
2231 [DNS_RCODE_SERVFAIL] = "SERVFAIL",
2232 [DNS_RCODE_NXDOMAIN] = "NXDOMAIN",
2233 [DNS_RCODE_NOTIMP] = "NOTIMP",
2234 [DNS_RCODE_REFUSED] = "REFUSED",
2235 [DNS_RCODE_YXDOMAIN] = "YXDOMAIN",
2236 [DNS_RCODE_YXRRSET] = "YRRSET",
2237 [DNS_RCODE_NXRRSET] = "NXRRSET",
2238 [DNS_RCODE_NOTAUTH] = "NOTAUTH",
2239 [DNS_RCODE_NOTZONE] = "NOTZONE",
2240 [DNS_RCODE_BADVERS] = "BADVERS",
2241 [DNS_RCODE_BADKEY] = "BADKEY",
2242 [DNS_RCODE_BADTIME] = "BADTIME",
2243 [DNS_RCODE_BADMODE] = "BADMODE",
2244 [DNS_RCODE_BADNAME] = "BADNAME",
2245 [DNS_RCODE_BADALG] = "BADALG",
2246 [DNS_RCODE_BADTRUNC] = "BADTRUNC",
2247};
2248DEFINE_STRING_TABLE_LOOKUP(dns_rcode, int);
1716f6dc
LP		 2249
2250static const char* const dns_protocol_table[_DNS_PROTOCOL_MAX] = {
2251 [DNS_PROTOCOL_DNS] = "dns",
2252 [DNS_PROTOCOL_MDNS] = "mdns",
2253 [DNS_PROTOCOL_LLMNR] = "llmnr",
2254};
2255DEFINE_STRING_TABLE_LOOKUP(dns_protocol, DnsProtocol);
Unnamed repository; edit this file 'description' to name the repository.