]> git.ipfire.org Git - thirdparty/systemd.git/blame - src/resolve/resolved-dns-server.c
resolved: respond to local resolver requests on 127.0.0.53:53
[thirdparty/systemd.git] / src / resolve / resolved-dns-server.c
CommitLineData
74b2466e
LP
1/***
2 This file is part of systemd.
3
4 Copyright 2014 Lennart Poettering
5
6 systemd is free software; you can redistribute it and/or modify it
7 under the terms of the GNU Lesser General Public License as published by
8 the Free Software Foundation; either version 2.1 of the License, or
9 (at your option) any later version.
10
11 systemd is distributed in the hope that it will be useful, but
12 WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 Lesser General Public License for more details.
15
16 You should have received a copy of the GNU Lesser General Public License
17 along with systemd; If not, see <http://www.gnu.org/licenses/>.
18***/
19
1e02e182
LP
20#include <sd-messages.h>
21
b5efdb8a 22#include "alloc-util.h"
74b2466e 23#include "resolved-dns-server.h"
b30bf55d 24#include "resolved-dns-stub.h"
f2f1dbe5 25#include "resolved-resolv-conf.h"
b5efdb8a 26#include "siphash24.h"
be808ea0 27#include "string-table.h"
f2f1dbe5 28#include "string-util.h"
74b2466e 29
9df3ba6c
TG
30/* After how much time to repeat classic DNS requests */
31#define DNS_TIMEOUT_MIN_USEC (500 * USEC_PER_MSEC)
32#define DNS_TIMEOUT_MAX_USEC (5 * USEC_PER_SEC)
33
be808ea0
TG
34/* The amount of time to wait before retrying with a full feature set */
35#define DNS_SERVER_FEATURE_GRACE_PERIOD_MAX_USEC (6 * USEC_PER_HOUR)
36#define DNS_SERVER_FEATURE_GRACE_PERIOD_MIN_USEC (5 * USEC_PER_MINUTE)
37
38/* The number of times we will attempt a certain feature set before degrading */
39#define DNS_SERVER_FEATURE_RETRY_ATTEMPTS 3
40
74b2466e
LP
41int dns_server_new(
42 Manager *m,
43 DnsServer **ret,
4e945a6f 44 DnsServerType type,
74b2466e 45 Link *l,
0dd25fb9 46 int family,
2817157b
LP
47 const union in_addr_union *in_addr,
48 int ifindex) {
74b2466e 49
eed857b7 50 DnsServer *s;
74b2466e
LP
51
52 assert(m);
4e945a6f 53 assert((type == DNS_SERVER_LINK) == !!l);
74b2466e 54 assert(in_addr);
74b2466e 55
eed857b7
LP
56 if (!IN_SET(family, AF_INET, AF_INET6))
57 return -EAFNOSUPPORT;
58
59 if (l) {
60 if (l->n_dns_servers >= LINK_DNS_SERVERS_MAX)
61 return -E2BIG;
62 } else {
63 if (m->n_dns_servers >= MANAGER_DNS_SERVERS_MAX)
64 return -E2BIG;
65 }
66
74b2466e
LP
67 s = new0(DnsServer, 1);
68 if (!s)
69 return -ENOMEM;
70
91b14d6f 71 s->n_ref = 1;
0b58db65 72 s->manager = m;
f4461e56
LP
73 s->verified_feature_level = _DNS_SERVER_FEATURE_LEVEL_INVALID;
74 s->possible_feature_level = DNS_SERVER_FEATURE_LEVEL_BEST;
be808ea0 75 s->features_grace_period_usec = DNS_SERVER_FEATURE_GRACE_PERIOD_MIN_USEC;
d74fb368 76 s->received_udp_packet_max = DNS_PACKET_UNICAST_SIZE_MAX;
4e945a6f 77 s->type = type;
74b2466e
LP
78 s->family = family;
79 s->address = *in_addr;
2817157b 80 s->ifindex = ifindex;
9df3ba6c 81 s->resend_timeout = DNS_TIMEOUT_MIN_USEC;
74b2466e 82
0b58db65
LP
83 switch (type) {
84
85 case DNS_SERVER_LINK:
86 s->link = l;
eed857b7
LP
87 LIST_APPEND(servers, l->dns_servers, s);
88 l->n_dns_servers++;
0b58db65
LP
89 break;
90
91 case DNS_SERVER_SYSTEM:
eed857b7
LP
92 LIST_APPEND(servers, m->dns_servers, s);
93 m->n_dns_servers++;
0b58db65
LP
94 break;
95
96 case DNS_SERVER_FALLBACK:
eed857b7
LP
97 LIST_APPEND(servers, m->fallback_dns_servers, s);
98 m->n_dns_servers++;
0b58db65
LP
99 break;
100
101 default:
4e945a6f 102 assert_not_reached("Unknown server type");
0b58db65 103 }
74b2466e 104
0eac4623 105 s->linked = true;
74b2466e 106
4e945a6f
LP
107 /* A new DNS server that isn't fallback is added and the one
108 * we used so far was a fallback one? Then let's try to pick
109 * the new one */
110 if (type != DNS_SERVER_FALLBACK &&
3e684349
LP
111 m->current_dns_server &&
112 m->current_dns_server->type == DNS_SERVER_FALLBACK)
113 manager_set_dns_server(m, NULL);
4e945a6f 114
74b2466e
LP
115 if (ret)
116 *ret = s;
117
118 return 0;
119}
120
91b14d6f 121DnsServer* dns_server_ref(DnsServer *s) {
74b2466e
LP
122 if (!s)
123 return NULL;
124
91b14d6f 125 assert(s->n_ref > 0);
313cefa1 126 s->n_ref++;
cab5b059 127
91b14d6f
TG
128 return s;
129}
130
0eac4623 131DnsServer* dns_server_unref(DnsServer *s) {
91b14d6f
TG
132 if (!s)
133 return NULL;
3e684349 134
0eac4623 135 assert(s->n_ref > 0);
313cefa1 136 s->n_ref--;
91b14d6f 137
0eac4623
LP
138 if (s->n_ref > 0)
139 return NULL;
74b2466e 140
6cb08a89 141 free(s->server_string);
74b2466e 142 free(s);
74b2466e
LP
143 return NULL;
144}
87f5a193 145
0eac4623
LP
146void dns_server_unlink(DnsServer *s) {
147 assert(s);
148 assert(s->manager);
91b14d6f 149
0eac4623
LP
150 /* This removes the specified server from the linked list of
151 * servers, but any server might still stay around if it has
152 * refs, for example from an ongoing transaction. */
91b14d6f 153
0eac4623
LP
154 if (!s->linked)
155 return;
91b14d6f 156
0eac4623
LP
157 switch (s->type) {
158
159 case DNS_SERVER_LINK:
160 assert(s->link);
eed857b7 161 assert(s->link->n_dns_servers > 0);
0eac4623 162 LIST_REMOVE(servers, s->link->dns_servers, s);
0e3e1aef 163 s->link->n_dns_servers--;
0eac4623
LP
164 break;
165
166 case DNS_SERVER_SYSTEM:
eed857b7 167 assert(s->manager->n_dns_servers > 0);
0eac4623 168 LIST_REMOVE(servers, s->manager->dns_servers, s);
eed857b7 169 s->manager->n_dns_servers--;
0eac4623
LP
170 break;
171
172 case DNS_SERVER_FALLBACK:
eed857b7 173 assert(s->manager->n_dns_servers > 0);
0eac4623 174 LIST_REMOVE(servers, s->manager->fallback_dns_servers, s);
eed857b7 175 s->manager->n_dns_servers--;
0eac4623
LP
176 break;
177 }
178
179 s->linked = false;
180
181 if (s->link && s->link->current_dns_server == s)
182 link_set_dns_server(s->link, NULL);
183
184 if (s->manager->current_dns_server == s)
185 manager_set_dns_server(s->manager, NULL);
186
187 dns_server_unref(s);
91b14d6f
TG
188}
189
0b58db65
LP
190void dns_server_move_back_and_unmark(DnsServer *s) {
191 DnsServer *tail;
192
193 assert(s);
194
195 if (!s->marked)
196 return;
197
198 s->marked = false;
199
200 if (!s->linked || !s->servers_next)
201 return;
202
203 /* Move us to the end of the list, so that the order is
204 * strictly kept, if we are not at the end anyway. */
205
206 switch (s->type) {
207
208 case DNS_SERVER_LINK:
209 assert(s->link);
210 LIST_FIND_TAIL(servers, s, tail);
211 LIST_REMOVE(servers, s->link->dns_servers, s);
212 LIST_INSERT_AFTER(servers, s->link->dns_servers, tail, s);
213 break;
214
215 case DNS_SERVER_SYSTEM:
216 LIST_FIND_TAIL(servers, s, tail);
217 LIST_REMOVE(servers, s->manager->dns_servers, s);
218 LIST_INSERT_AFTER(servers, s->manager->dns_servers, tail, s);
219 break;
220
221 case DNS_SERVER_FALLBACK:
222 LIST_FIND_TAIL(servers, s, tail);
223 LIST_REMOVE(servers, s->manager->fallback_dns_servers, s);
224 LIST_INSERT_AFTER(servers, s->manager->fallback_dns_servers, tail, s);
225 break;
226
227 default:
228 assert_not_reached("Unknown server type");
229 }
230}
231
6bb2c085 232static void dns_server_verified(DnsServer *s, DnsServerFeatureLevel level) {
9df3ba6c
TG
233 assert(s);
234
6bb2c085
LP
235 if (s->verified_feature_level > level)
236 return;
b652d4a2 237
6bb2c085 238 if (s->verified_feature_level != level) {
de54e62b
LP
239 log_debug("Verified we get a response at feature level %s from DNS server %s.",
240 dns_server_feature_level_to_string(level),
241 dns_server_string(s));
f4461e56 242 s->verified_feature_level = level;
be808ea0
TG
243 }
244
6bb2c085
LP
245 assert_se(sd_event_now(s->manager->event, clock_boottime_or_monotonic(), &s->verified_usec) >= 0);
246}
247
248void dns_server_packet_received(DnsServer *s, int protocol, DnsServerFeatureLevel level, usec_t rtt, size_t size) {
249 assert(s);
250
251 if (protocol == IPPROTO_UDP) {
252 if (s->possible_feature_level == level)
253 s->n_failed_udp = 0;
254
b6451358
LP
255 /* If the RRSIG data is missing, then we can only validate EDNS0 at max */
256 if (s->packet_rrsig_missing && level >= DNS_SERVER_FEATURE_LEVEL_DO)
257 level = DNS_SERVER_FEATURE_LEVEL_DO - 1;
258
259 /* If the OPT RR got lost, then we can only validate UDP at max */
260 if (s->packet_bad_opt && level >= DNS_SERVER_FEATURE_LEVEL_EDNS0)
261 level = DNS_SERVER_FEATURE_LEVEL_EDNS0 - 1;
262
263 /* Even if we successfully receive a reply to a request announcing support for large packets,
264 that does not mean we can necessarily receive large packets. */
6bb2c085 265 if (level == DNS_SERVER_FEATURE_LEVEL_LARGE)
b6451358 266 level = DNS_SERVER_FEATURE_LEVEL_LARGE - 1;
6bb2c085
LP
267
268 } else if (protocol == IPPROTO_TCP) {
269
270 if (s->possible_feature_level == level)
271 s->n_failed_tcp = 0;
272
273 /* Successful TCP connections are only useful to verify the TCP feature level. */
b6451358 274 level = DNS_SERVER_FEATURE_LEVEL_TCP;
6bb2c085 275 }
84129d46 276
b6451358
LP
277 dns_server_verified(s, level);
278
d74fb368
TG
279 /* Remember the size of the largest UDP packet we received from a server,
280 we know that we can always announce support for packets with at least
281 this size. */
6bb2c085 282 if (protocol == IPPROTO_UDP && s->received_udp_packet_max < size)
d74fb368
TG
283 s->received_udp_packet_max = size;
284
be808ea0
TG
285 if (s->max_rtt < rtt) {
286 s->max_rtt = rtt;
efd46a69 287 s->resend_timeout = CLAMP(s->max_rtt * 2, DNS_TIMEOUT_MIN_USEC, DNS_TIMEOUT_MAX_USEC);
be808ea0 288 }
9df3ba6c
TG
289}
290
6bb2c085 291void dns_server_packet_lost(DnsServer *s, int protocol, DnsServerFeatureLevel level, usec_t usec) {
9df3ba6c 292 assert(s);
be808ea0
TG
293 assert(s->manager);
294
6bb2c085
LP
295 if (s->possible_feature_level == level) {
296 if (protocol == IPPROTO_UDP)
313cefa1 297 s->n_failed_udp++;
6bb2c085 298 else if (protocol == IPPROTO_TCP)
313cefa1 299 s->n_failed_tcp++;
6bb2c085 300 }
9df3ba6c 301
84129d46
LP
302 if (s->resend_timeout > usec)
303 return;
304
305 s->resend_timeout = MIN(s->resend_timeout * 2, DNS_TIMEOUT_MAX_USEC);
9df3ba6c
TG
306}
307
f4461e56 308void dns_server_packet_failed(DnsServer *s, DnsServerFeatureLevel level) {
4e0b8b17 309 assert(s);
4e0b8b17 310
6bb2c085
LP
311 /* Invoked whenever we get a FORMERR, SERVFAIL or NOTIMP rcode from a server. */
312
f4461e56 313 if (s->possible_feature_level != level)
4e0b8b17
TG
314 return;
315
6bb2c085
LP
316 s->packet_failed = true;
317}
318
319void dns_server_packet_truncated(DnsServer *s, DnsServerFeatureLevel level) {
320 assert(s);
571370c1 321
6bb2c085
LP
322 /* Invoked whenever we get a packet with TC bit set. */
323
324 if (s->possible_feature_level != level)
571370c1
LP
325 return;
326
6bb2c085 327 s->packet_truncated = true;
4e0b8b17
TG
328}
329
de54e62b
LP
330void dns_server_packet_rrsig_missing(DnsServer *s, DnsServerFeatureLevel level) {
331 assert(s);
332
333 if (level < DNS_SERVER_FEATURE_LEVEL_DO)
334 return;
335
b6451358
LP
336 /* If the RRSIG RRs are missing, we have to downgrade what we previously verified */
337 if (s->verified_feature_level >= DNS_SERVER_FEATURE_LEVEL_DO)
338 s->verified_feature_level = DNS_SERVER_FEATURE_LEVEL_DO-1;
339
de54e62b
LP
340 s->packet_rrsig_missing = true;
341}
342
343void dns_server_packet_bad_opt(DnsServer *s, DnsServerFeatureLevel level) {
b652d4a2 344 assert(s);
b652d4a2 345
de54e62b
LP
346 if (level < DNS_SERVER_FEATURE_LEVEL_EDNS0)
347 return;
b652d4a2 348
b6451358
LP
349 /* If the OPT RR got lost, we have to downgrade what we previously verified */
350 if (s->verified_feature_level >= DNS_SERVER_FEATURE_LEVEL_EDNS0)
351 s->verified_feature_level = DNS_SERVER_FEATURE_LEVEL_EDNS0-1;
352
de54e62b 353 s->packet_bad_opt = true;
b652d4a2
LP
354}
355
be808ea0
TG
356static bool dns_server_grace_period_expired(DnsServer *s) {
357 usec_t ts;
358
359 assert(s);
360 assert(s->manager);
361
362 if (s->verified_usec == 0)
363 return false;
364
365 assert_se(sd_event_now(s->manager->event, clock_boottime_or_monotonic(), &ts) >= 0);
366
367 if (s->verified_usec + s->features_grace_period_usec > ts)
368 return false;
369
370 s->features_grace_period_usec = MIN(s->features_grace_period_usec * 2, DNS_SERVER_FEATURE_GRACE_PERIOD_MAX_USEC);
371
372 return true;
373}
374
01184277
LP
375static void dns_server_reset_counters(DnsServer *s) {
376 assert(s);
377
378 s->n_failed_udp = 0;
379 s->n_failed_tcp = 0;
380 s->packet_failed = false;
381 s->packet_truncated = false;
382 s->verified_usec = 0;
cc450722
LP
383
384 /* Note that we do not reset s->packet_bad_opt and s->packet_rrsig_missing here. We reset them only when the
385 * grace period ends, but not when lowering the possible feature level, as a lower level feature level should
386 * not make RRSIGs appear or OPT appear, but rather make them disappear. If the reappear anyway, then that's
387 * indication for a differently broken OPT/RRSIG implementation, and we really don't want to support that
388 * either.
389 *
390 * This is particularly important to deal with certain Belkin routers which break OPT for certain lookups (A),
391 * but pass traffic through for others (AAAA). If we detect the broken behaviour on one lookup we should not
392 * reenable it for another, because we cannot validate things anyway, given that the RRSIG/OPT data will be
393 * incomplete. */
01184277
LP
394}
395
f4461e56 396DnsServerFeatureLevel dns_server_possible_feature_level(DnsServer *s) {
be808ea0
TG
397 assert(s);
398
f4461e56 399 if (s->possible_feature_level != DNS_SERVER_FEATURE_LEVEL_BEST &&
be808ea0 400 dns_server_grace_period_expired(s)) {
be808ea0 401
f4461e56 402 s->possible_feature_level = DNS_SERVER_FEATURE_LEVEL_BEST;
cc450722 403
01184277
LP
404 dns_server_reset_counters(s);
405
cc450722
LP
406 s->packet_bad_opt = false;
407 s->packet_rrsig_missing = false;
408
de54e62b 409 log_info("Grace period over, resuming full feature set (%s) for DNS server %s.",
6cb08a89
LP
410 dns_server_feature_level_to_string(s->possible_feature_level),
411 dns_server_string(s));
6bb2c085 412
f4461e56
LP
413 } else if (s->possible_feature_level <= s->verified_feature_level)
414 s->possible_feature_level = s->verified_feature_level;
6bb2c085
LP
415 else {
416 DnsServerFeatureLevel p = s->possible_feature_level;
be808ea0 417
6bb2c085 418 if (s->n_failed_tcp >= DNS_SERVER_FEATURE_RETRY_ATTEMPTS &&
de54e62b 419 s->possible_feature_level == DNS_SERVER_FEATURE_LEVEL_TCP) {
6a1a5eec 420
6bb2c085
LP
421 /* We are at the TCP (lowest) level, and we tried a couple of TCP connections, and it didn't
422 * work. Upgrade back to UDP again. */
de54e62b
LP
423 log_debug("Reached maximum number of failed TCP connection attempts, trying UDP again...");
424 s->possible_feature_level = DNS_SERVER_FEATURE_LEVEL_UDP;
425
426 } else if (s->packet_bad_opt &&
427 s->possible_feature_level >= DNS_SERVER_FEATURE_LEVEL_EDNS0) {
428
429 /* A reply to one of our EDNS0 queries didn't carry a valid OPT RR, then downgrade to below
430 * EDNS0 levels. After all, some records generate different responses with and without OPT RR
431 * in the request. Example:
432 * https://open.nlnetlabs.nl/pipermail/dnssec-trigger/2014-November/000376.html */
433
434 log_debug("Server doesn't support EDNS(0) properly, downgrading feature level...");
6a1a5eec 435 s->possible_feature_level = DNS_SERVER_FEATURE_LEVEL_UDP;
be808ea0 436
de54e62b
LP
437 } else if (s->packet_rrsig_missing &&
438 s->possible_feature_level >= DNS_SERVER_FEATURE_LEVEL_DO) {
6bb2c085 439
de54e62b
LP
440 /* RRSIG data was missing on a EDNS0 packet with DO bit set. This means the server doesn't
441 * augment responses with DNSSEC RRs. If so, let's better not ask the server for it anymore,
442 * after all some servers generate different replies depending if an OPT RR is in the query or
443 * not. */
444
445 log_debug("Detected server responses lack RRSIG records, downgrading feature level...");
446 s->possible_feature_level = DNS_SERVER_FEATURE_LEVEL_EDNS0;
447
448 } else if (s->n_failed_udp >= DNS_SERVER_FEATURE_RETRY_ATTEMPTS &&
449 s->possible_feature_level >= DNS_SERVER_FEATURE_LEVEL_UDP) {
450
451 /* We lost too many UDP packets in a row, and are on a feature level of UDP or higher. If the
452 * packets are lost, maybe the server cannot parse them, hence downgrading sounds like a good
453 * idea. We might downgrade all the way down to TCP this way. */
454
455 log_debug("Lost too many UDP packets, downgrading feature level...");
456 s->possible_feature_level--;
457
458 } else if (s->packet_failed &&
459 s->possible_feature_level > DNS_SERVER_FEATURE_LEVEL_UDP) {
460
461 /* We got a failure packet, and are at a feature level above UDP. Note that in this case we
462 * downgrade no further than UDP, under the assumption that a failure packet indicates an
463 * incompatible packet contents, but not a problem with the transport. */
464
465 log_debug("Got server failure, downgrading feature level...");
6bb2c085
LP
466 s->possible_feature_level--;
467
de54e62b
LP
468 } else if (s->n_failed_tcp >= DNS_SERVER_FEATURE_RETRY_ATTEMPTS &&
469 s->packet_truncated &&
470 s->possible_feature_level > DNS_SERVER_FEATURE_LEVEL_UDP) {
471
472 /* We got too many TCP connection failures in a row, we had at least one truncated packet, and
473 * are on a feature level above UDP. By downgrading things and getting rid of DNSSEC or EDNS0
474 * data we hope to make the packet smaller, so that it still works via UDP given that TCP
475 * appears not to be a fallback. Note that if we are already at the lowest UDP level, we don't
476 * go further down, since that's TCP, and TCP failed too often after all. */
477
478 log_debug("Got too many failed TCP connection failures and truncated UDP packets, downgrading feature level...");
479 s->possible_feature_level--;
480 }
481
6bb2c085 482 if (p != s->possible_feature_level) {
6bb2c085
LP
483
484 /* We changed the feature level, reset the counting */
01184277 485 dns_server_reset_counters(s);
6bb2c085 486
de54e62b 487 log_warning("Using degraded feature set (%s) for DNS server %s.",
6cb08a89
LP
488 dns_server_feature_level_to_string(s->possible_feature_level),
489 dns_server_string(s));
6bb2c085 490 }
be808ea0
TG
491 }
492
f4461e56 493 return s->possible_feature_level;
be808ea0
TG
494}
495
519ef046
LP
496int dns_server_adjust_opt(DnsServer *server, DnsPacket *packet, DnsServerFeatureLevel level) {
497 size_t packet_size;
498 bool edns_do;
499 int r;
500
501 assert(server);
502 assert(packet);
503 assert(packet->protocol == DNS_PROTOCOL_DNS);
504
505 /* Fix the OPT field in the packet to match our current feature level. */
506
507 r = dns_packet_truncate_opt(packet);
508 if (r < 0)
509 return r;
510
511 if (level < DNS_SERVER_FEATURE_LEVEL_EDNS0)
512 return 0;
513
514 edns_do = level >= DNS_SERVER_FEATURE_LEVEL_DO;
515
516 if (level >= DNS_SERVER_FEATURE_LEVEL_LARGE)
517 packet_size = DNS_PACKET_UNICAST_SIZE_LARGE_MAX;
518 else
519 packet_size = server->received_udp_packet_max;
520
f2ed4c69 521 return dns_packet_append_opt(packet, packet_size, edns_do, 0, NULL);
519ef046
LP
522}
523
2817157b
LP
524int dns_server_ifindex(const DnsServer *s) {
525 assert(s);
526
527 /* The link ifindex always takes precedence */
528 if (s->link)
529 return s->link->ifindex;
530
531 if (s->ifindex > 0)
532 return s->ifindex;
533
534 return 0;
535}
536
6cb08a89
LP
537const char *dns_server_string(DnsServer *server) {
538 assert(server);
539
540 if (!server->server_string)
2817157b 541 (void) in_addr_ifindex_to_string(server->family, &server->address, dns_server_ifindex(server), &server->server_string);
6cb08a89
LP
542
543 return strna(server->server_string);
544}
545
92ec902a
LP
546bool dns_server_dnssec_supported(DnsServer *server) {
547 assert(server);
548
549 /* Returns whether the server supports DNSSEC according to what we know about it */
550
551 if (server->possible_feature_level < DNS_SERVER_FEATURE_LEVEL_DO)
552 return false;
553
de54e62b
LP
554 if (server->packet_bad_opt)
555 return false;
556
557 if (server->packet_rrsig_missing)
92ec902a
LP
558 return false;
559
560 /* DNSSEC servers need to support TCP properly (see RFC5966), if they don't, we assume DNSSEC is borked too */
561 if (server->n_failed_tcp >= DNS_SERVER_FEATURE_RETRY_ATTEMPTS)
562 return false;
563
564 return true;
565}
566
1e02e182
LP
567void dns_server_warn_downgrade(DnsServer *server) {
568 assert(server);
569
570 if (server->warned_downgrade)
571 return;
572
573 log_struct(LOG_NOTICE,
574 LOG_MESSAGE_ID(SD_MESSAGE_DNSSEC_DOWNGRADE),
575 LOG_MESSAGE("Server %s does not support DNSSEC, downgrading to non-DNSSEC mode.", dns_server_string(server)),
576 "DNS_SERVER=%s", dns_server_string(server),
577 "DNS_SERVER_FEATURE_LEVEL=%s", dns_server_feature_level_to_string(server->possible_feature_level),
578 NULL);
579
580 server->warned_downgrade = true;
581}
582
b826ab58 583static void dns_server_hash_func(const void *p, struct siphash *state) {
87f5a193 584 const DnsServer *s = p;
87f5a193 585
b826ab58 586 assert(s);
87f5a193 587
b826ab58
TG
588 siphash24_compress(&s->family, sizeof(s->family), state);
589 siphash24_compress(&s->address, FAMILY_ADDRESS_SIZE(s->family), state);
2817157b 590 siphash24_compress(&s->ifindex, sizeof(s->ifindex), state);
87f5a193
LP
591}
592
d5099efc 593static int dns_server_compare_func(const void *a, const void *b) {
87f5a193 594 const DnsServer *x = a, *y = b;
2817157b 595 int r;
87f5a193
LP
596
597 if (x->family < y->family)
598 return -1;
599 if (x->family > y->family)
600 return 1;
601
2817157b
LP
602 r = memcmp(&x->address, &y->address, FAMILY_ADDRESS_SIZE(x->family));
603 if (r != 0)
604 return r;
605
606 if (x->ifindex < y->ifindex)
607 return -1;
608 if (x->ifindex > y->ifindex)
609 return 1;
610
611 return 0;
87f5a193 612}
d5099efc
MS
613
614const struct hash_ops dns_server_hash_ops = {
615 .hash = dns_server_hash_func,
616 .compare = dns_server_compare_func
617};
636e813d 618
4b95f179
LP
619void dns_server_unlink_all(DnsServer *first) {
620 DnsServer *next;
0eac4623 621
4b95f179
LP
622 if (!first)
623 return;
0eac4623 624
4b95f179
LP
625 next = first->servers_next;
626 dns_server_unlink(first);
636e813d 627
4b95f179 628 dns_server_unlink_all(next);
0eac4623
LP
629}
630
4b95f179
LP
631void dns_server_unlink_marked(DnsServer *first) {
632 DnsServer *next;
636e813d 633
4b95f179
LP
634 if (!first)
635 return;
636e813d 636
4b95f179 637 next = first->servers_next;
636e813d 638
4b95f179 639 if (first->marked)
0eac4623 640 dns_server_unlink(first);
636e813d 641
4b95f179
LP
642 dns_server_unlink_marked(next);
643}
636e813d 644
4b95f179
LP
645void dns_server_mark_all(DnsServer *first) {
646 if (!first)
647 return;
636e813d 648
4b95f179
LP
649 first->marked = true;
650 dns_server_mark_all(first->servers_next);
636e813d
LP
651}
652
2817157b 653DnsServer *dns_server_find(DnsServer *first, int family, const union in_addr_union *in_addr, int ifindex) {
4b95f179 654 DnsServer *s;
636e813d 655
636e813d 656 LIST_FOREACH(servers, s, first)
2817157b 657 if (s->family == family && in_addr_equal(family, &s->address, in_addr) > 0 && s->ifindex == ifindex)
4b95f179 658 return s;
f2f1dbe5 659
4b95f179
LP
660 return NULL;
661}
f2f1dbe5 662
4b95f179 663DnsServer *manager_get_first_dns_server(Manager *m, DnsServerType t) {
f2f1dbe5 664 assert(m);
f2f1dbe5 665
4b95f179 666 switch (t) {
f2f1dbe5 667
4b95f179
LP
668 case DNS_SERVER_SYSTEM:
669 return m->dns_servers;
f2f1dbe5 670
4b95f179
LP
671 case DNS_SERVER_FALLBACK:
672 return m->fallback_dns_servers;
673
674 default:
675 return NULL;
676 }
f2f1dbe5
LP
677}
678
679DnsServer *manager_set_dns_server(Manager *m, DnsServer *s) {
680 assert(m);
681
682 if (m->current_dns_server == s)
683 return s;
684
6cb08a89 685 if (s)
e3309036
ZJS
686 log_info("Switching to %s DNS server %s.",
687 dns_server_type_to_string(s->type),
688 dns_server_string(s));
f2f1dbe5 689
0eac4623
LP
690 dns_server_unref(m->current_dns_server);
691 m->current_dns_server = dns_server_ref(s);
f2f1dbe5
LP
692
693 if (m->unicast_scope)
694 dns_cache_flush(&m->unicast_scope->cache);
695
696 return s;
697}
698
699DnsServer *manager_get_dns_server(Manager *m) {
700 Link *l;
701 assert(m);
702
703 /* Try to read updates resolv.conf */
704 manager_read_resolv_conf(m);
705
e3309036 706 /* If no DNS server was chosen so far, pick the first one */
f2f1dbe5
LP
707 if (!m->current_dns_server)
708 manager_set_dns_server(m, m->dns_servers);
709
710 if (!m->current_dns_server) {
711 bool found = false;
712 Iterator i;
713
714 /* No DNS servers configured, let's see if there are
715 * any on any links. If not, we use the fallback
716 * servers */
717
718 HASHMAP_FOREACH(l, m->links, i)
719 if (l->dns_servers) {
720 found = true;
721 break;
722 }
723
724 if (!found)
725 manager_set_dns_server(m, m->fallback_dns_servers);
726 }
727
728 return m->current_dns_server;
729}
730
731void manager_next_dns_server(Manager *m) {
732 assert(m);
733
734 /* If there's currently no DNS server set, then the next
735 * manager_get_dns_server() will find one */
736 if (!m->current_dns_server)
737 return;
738
0eac4623
LP
739 /* Change to the next one, but make sure to follow the linked
740 * list only if the server is still linked. */
741 if (m->current_dns_server->linked && m->current_dns_server->servers_next) {
f2f1dbe5
LP
742 manager_set_dns_server(m, m->current_dns_server->servers_next);
743 return;
744 }
745
746 /* If there was no next one, then start from the beginning of
747 * the list */
748 if (m->current_dns_server->type == DNS_SERVER_FALLBACK)
749 manager_set_dns_server(m, m->fallback_dns_servers);
750 else
751 manager_set_dns_server(m, m->dns_servers);
752}
be808ea0 753
b30bf55d
LP
754bool dns_server_address_valid(int family, const union in_addr_union *sa) {
755
756 /* Refuses the 0 IP addresses as well as 127.0.0.53 (which is our own DNS stub) */
757
758 if (in_addr_is_null(family, sa))
759 return false;
760
761 if (family == AF_INET && sa->in.s_addr == htobe32(INADDR_DNS_STUB))
762 return false;
763
764 return true;
765}
766
e3309036
ZJS
767static const char* const dns_server_type_table[_DNS_SERVER_TYPE_MAX] = {
768 [DNS_SERVER_SYSTEM] = "system",
769 [DNS_SERVER_FALLBACK] = "fallback",
770 [DNS_SERVER_LINK] = "link",
771};
772DEFINE_STRING_TABLE_LOOKUP(dns_server_type, DnsServerType);
773
be808ea0
TG
774static const char* const dns_server_feature_level_table[_DNS_SERVER_FEATURE_LEVEL_MAX] = {
775 [DNS_SERVER_FEATURE_LEVEL_TCP] = "TCP",
776 [DNS_SERVER_FEATURE_LEVEL_UDP] = "UDP",
9c5e12a4 777 [DNS_SERVER_FEATURE_LEVEL_EDNS0] = "UDP+EDNS0",
7586f4d1 778 [DNS_SERVER_FEATURE_LEVEL_DO] = "UDP+EDNS0+DO",
d74fb368 779 [DNS_SERVER_FEATURE_LEVEL_LARGE] = "UDP+EDNS0+DO+LARGE",
be808ea0
TG
780};
781DEFINE_STRING_TABLE_LOOKUP(dns_server_feature_level, DnsServerFeatureLevel);