src/resolve/resolved-dns-query.c

   1 /***
   2   This file is part of systemd.
   3
   4   Copyright 2014 Lennart Poettering
   5
   6   systemd is free software; you can redistribute it and/or modify it
   7   under the terms of the GNU Lesser General Public License as published by
   8   the Free Software Foundation; either version 2.1 of the License, or
   9   (at your option) any later version.
  10
  11   systemd is distributed in the hope that it will be useful, but
  12   WITHOUT ANY WARRANTY; without even the implied warranty of
  13   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  14   Lesser General Public License for more details.
  15
  16   You should have received a copy of the GNU Lesser General Public License
  17   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  18 ***/
  19
  20 #include "alloc-util.h"
  21 #include "dns-domain.h"
  22 #include "dns-type.h"
  23 #include "hostname-util.h"
  24 #include "local-addresses.h"
  25 #include "resolved-dns-query.h"
  26 #include "resolved-dns-synthesize.h"
  27 #include "resolved-etc-hosts.h"
  28 #include "string-util.h"
  29
  30 /* How long to wait for the query in total */
  31 #define QUERY_TIMEOUT_USEC (60 * USEC_PER_SEC)
  32
  33 #define CNAME_MAX 8
  34 #define QUERIES_MAX 2048
  35 #define AUXILIARY_QUERIES_MAX 64
  36
  37 static int dns_query_candidate_new(DnsQueryCandidate **ret, DnsQuery *q, DnsScope *s) {
  38         DnsQueryCandidate *c;
  39
  40         assert(ret);
  41         assert(q);
  42         assert(s);
  43
  44         c = new0(DnsQueryCandidate, 1);
  45         if (!c)
  46                 return -ENOMEM;
  47
  48         c->query = q;
  49         c->scope = s;
  50
  51         LIST_PREPEND(candidates_by_query, q->candidates, c);
  52         LIST_PREPEND(candidates_by_scope, s->query_candidates, c);
  53
  54         *ret = c;
  55         return 0;
  56 }
  57
  58 static void dns_query_candidate_stop(DnsQueryCandidate *c) {
  59         DnsTransaction *t;
  60
  61         assert(c);
  62
  63         while ((t = set_steal_first(c->transactions))) {
  64                 set_remove(t->notify_query_candidates, c);
  65                 set_remove(t->notify_query_candidates_done, c);
  66                 dns_transaction_gc(t);
  67         }
  68 }
  69
  70 DnsQueryCandidate* dns_query_candidate_free(DnsQueryCandidate *c) {
  71
  72         if (!c)
  73                 return NULL;
  74
  75         dns_query_candidate_stop(c);
  76
  77         set_free(c->transactions);
  78         dns_search_domain_unref(c->search_domain);
  79
  80         if (c->query)
  81                 LIST_REMOVE(candidates_by_query, c->query->candidates, c);
  82
  83         if (c->scope)
  84                 LIST_REMOVE(candidates_by_scope, c->scope->query_candidates, c);
  85
  86         return mfree(c);
  87 }
  88
  89 static int dns_query_candidate_next_search_domain(DnsQueryCandidate *c) {
  90         DnsSearchDomain *next = NULL;
  91
  92         assert(c);
  93
  94         if (c->search_domain && c->search_domain->linked)
  95                 next = c->search_domain->domains_next;
  96         else
  97                 next = dns_scope_get_search_domains(c->scope);
  98
  99         for (;;) {
 100                 if (!next) /* We hit the end of the list */
 101                         return 0;
 102
 103                 if (!next->route_only)
 104                         break;
 105
 106                 /* Skip over route-only domains */
 107                 next = next->domains_next;
 108         }
 109
 110         dns_search_domain_unref(c->search_domain);
 111         c->search_domain = dns_search_domain_ref(next);
 112
 113         return 1;
 114 }
 115
 116 static int dns_query_candidate_add_transaction(DnsQueryCandidate *c, DnsResourceKey *key) {
 117         DnsTransaction *t;
 118         int r;
 119
 120         assert(c);
 121         assert(key);
 122
 123         t = dns_scope_find_transaction(c->scope, key, true);
 124         if (!t) {
 125                 r = dns_transaction_new(&t, c->scope, key);
 126                 if (r < 0)
 127                         return r;
 128         } else {
 129                 if (set_contains(c->transactions, t))
 130                         return 0;
 131         }
 132
 133         r = set_ensure_allocated(&c->transactions, NULL);
 134         if (r < 0)
 135                 goto gc;
 136
 137         r = set_ensure_allocated(&t->notify_query_candidates, NULL);
 138         if (r < 0)
 139                 goto gc;
 140
 141         r = set_ensure_allocated(&t->notify_query_candidates_done, NULL);
 142         if (r < 0)
 143                 goto gc;
 144
 145         r = set_put(t->notify_query_candidates, c);
 146         if (r < 0)
 147                 goto gc;
 148
 149         r = set_put(c->transactions, t);
 150         if (r < 0) {
 151                 (void) set_remove(t->notify_query_candidates, c);
 152                 goto gc;
 153         }
 154
 155         t->clamp_ttl = c->query->clamp_ttl;
 156         return 1;
 157
 158 gc:
 159         dns_transaction_gc(t);
 160         return r;
 161 }
 162
 163 static int dns_query_candidate_go(DnsQueryCandidate *c) {
 164         DnsTransaction *t;
 165         Iterator i;
 166         int r;
 167         unsigned n = 0;
 168
 169         assert(c);
 170
 171         /* Start the transactions that are not started yet */
 172         SET_FOREACH(t, c->transactions, i) {
 173                 if (t->state != DNS_TRANSACTION_NULL)
 174                         continue;
 175
 176                 r = dns_transaction_go(t);
 177                 if (r < 0)
 178                         return r;
 179
 180                 n++;
 181         }
 182
 183         /* If there was nothing to start, then let's proceed immediately */
 184         if (n == 0)
 185                 dns_query_candidate_notify(c);
 186
 187         return 0;
 188 }
 189
 190 static DnsTransactionState dns_query_candidate_state(DnsQueryCandidate *c) {
 191         DnsTransactionState state = DNS_TRANSACTION_NO_SERVERS;
 192         DnsTransaction *t;
 193         Iterator i;
 194
 195         assert(c);
 196
 197         if (c->error_code != 0)
 198                 return DNS_TRANSACTION_ERRNO;
 199
 200         SET_FOREACH(t, c->transactions, i) {
 201
 202                 switch (t->state) {
 203
 204                 case DNS_TRANSACTION_NULL:
 205                         /* If there's a NULL transaction pending, then
 206                          * this means not all transactions where
 207                          * started yet, and we were called from within
 208                          * the stackframe that is supposed to start
 209                          * remaining transactions. In this case,
 210                          * simply claim the candidate is pending. */
 211
 212                 case DNS_TRANSACTION_PENDING:
 213                 case DNS_TRANSACTION_VALIDATING:
 214                         /* If there's one transaction currently in
 215                          * VALIDATING state, then this means there's
 216                          * also one in PENDING state, hence we can
 217                          * return PENDING immediately. */
 218                         return DNS_TRANSACTION_PENDING;
 219
 220                 case DNS_TRANSACTION_SUCCESS:
 221                         state = t->state;
 222                         break;
 223
 224                 default:
 225                         if (state != DNS_TRANSACTION_SUCCESS)
 226                                 state = t->state;
 227
 228                         break;
 229                 }
 230         }
 231
 232         return state;
 233 }
 234
 235 static bool dns_query_candidate_is_routable(DnsQueryCandidate *c, uint16_t type) {
 236         int family;
 237
 238         assert(c);
 239
 240         /* Checks whether the specified RR type matches an address family that is routable on the link(s) the scope of
 241          * this candidate belongs to. Specifically, whether there's a routable IPv4 address on it if we query an A RR,
 242          * or a routable IPv6 address if we query an AAAA RR. */
 243
 244         if (!c->query->suppress_unroutable_family)
 245                 return true;
 246
 247         if (c->scope->protocol != DNS_PROTOCOL_DNS)
 248                 return true;
 249
 250         family = dns_type_to_af(type);
 251         if (family < 0)
 252                 return true;
 253
 254         if (c->scope->link)
 255                 return link_relevant(c->scope->link, family, false);
 256         else
 257                 return manager_routable(c->scope->manager, family);
 258 }
 259
 260 static int dns_query_candidate_setup_transactions(DnsQueryCandidate *c) {
 261         DnsQuestion *question;
 262         DnsResourceKey *key;
 263         int n = 0, r;
 264
 265         assert(c);
 266
 267         dns_query_candidate_stop(c);
 268
 269         question = dns_query_question_for_protocol(c->query, c->scope->protocol);
 270
 271         /* Create one transaction per question key */
 272         DNS_QUESTION_FOREACH(key, question) {
 273                 _cleanup_(dns_resource_key_unrefp) DnsResourceKey *new_key = NULL;
 274                 DnsResourceKey *qkey;
 275
 276                 if (!dns_query_candidate_is_routable(c, key->type))
 277                         continue;
 278
 279                 if (c->search_domain) {
 280                         r = dns_resource_key_new_append_suffix(&new_key, key, c->search_domain->name);
 281                         if (r < 0)
 282                                 goto fail;
 283
 284                         qkey = new_key;
 285                 } else
 286                         qkey = key;
 287
 288                 if (!dns_scope_good_key(c->scope, qkey))
 289                         continue;
 290
 291                 r = dns_query_candidate_add_transaction(c, qkey);
 292                 if (r < 0)
 293                         goto fail;
 294
 295                 n++;
 296         }
 297
 298         return n;
 299
 300 fail:
 301         dns_query_candidate_stop(c);
 302         return r;
 303 }
 304
 305 void dns_query_candidate_notify(DnsQueryCandidate *c) {
 306         DnsTransactionState state;
 307         int r;
 308
 309         assert(c);
 310
 311         state = dns_query_candidate_state(c);
 312
 313         if (DNS_TRANSACTION_IS_LIVE(state))
 314                 return;
 315
 316         if (state != DNS_TRANSACTION_SUCCESS && c->search_domain) {
 317
 318                 r = dns_query_candidate_next_search_domain(c);
 319                 if (r < 0)
 320                         goto fail;
 321
 322                 if (r > 0) {
 323                         /* OK, there's another search domain to try, let's do so. */
 324
 325                         r = dns_query_candidate_setup_transactions(c);
 326                         if (r < 0)
 327                                 goto fail;
 328
 329                         if (r > 0) {
 330                                 /* New transactions where queued. Start them and wait */
 331
 332                                 r = dns_query_candidate_go(c);
 333                                 if (r < 0)
 334                                         goto fail;
 335
 336                                 return;
 337                         }
 338                 }
 339
 340         }
 341
 342         dns_query_ready(c->query);
 343         return;
 344
 345 fail:
 346         log_warning_errno(r, "Failed to follow search domains: %m");
 347         c->error_code = r;
 348         dns_query_ready(c->query);
 349 }
 350
 351 static void dns_query_stop(DnsQuery *q) {
 352         DnsQueryCandidate *c;
 353
 354         assert(q);
 355
 356         q->timeout_event_source = sd_event_source_unref(q->timeout_event_source);
 357
 358         LIST_FOREACH(candidates_by_query, c, q->candidates)
 359                 dns_query_candidate_stop(c);
 360 }
 361
 362 static void dns_query_free_candidates(DnsQuery *q) {
 363         assert(q);
 364
 365         while (q->candidates)
 366                 dns_query_candidate_free(q->candidates);
 367 }
 368
 369 static void dns_query_reset_answer(DnsQuery *q) {
 370         assert(q);
 371
 372         q->answer = dns_answer_unref(q->answer);
 373         q->answer_rcode = 0;
 374         q->answer_dnssec_result = _DNSSEC_RESULT_INVALID;
 375         q->answer_errno = 0;
 376         q->answer_authenticated = false;
 377         q->answer_protocol = _DNS_PROTOCOL_INVALID;
 378         q->answer_family = AF_UNSPEC;
 379         q->answer_search_domain = dns_search_domain_unref(q->answer_search_domain);
 380 }
 381
 382 DnsQuery *dns_query_free(DnsQuery *q) {
 383         if (!q)
 384                 return NULL;
 385
 386         while (q->auxiliary_queries)
 387                 dns_query_free(q->auxiliary_queries);
 388
 389         if (q->auxiliary_for) {
 390                 assert(q->auxiliary_for->n_auxiliary_queries > 0);
 391                 q->auxiliary_for->n_auxiliary_queries--;
 392                 LIST_REMOVE(auxiliary_queries, q->auxiliary_for->auxiliary_queries, q);
 393         }
 394
 395         dns_query_free_candidates(q);
 396
 397         dns_question_unref(q->question_idna);
 398         dns_question_unref(q->question_utf8);
 399
 400         dns_query_reset_answer(q);
 401
 402         sd_bus_message_unref(q->request);
 403         sd_bus_track_unref(q->bus_track);
 404
 405         dns_packet_unref(q->request_dns_packet);
 406         dns_packet_unref(q->reply_dns_packet);
 407
 408         if (q->request_dns_stream) {
 409                 /* Detach the stream from our query, in case something else keeps a reference to it. */
 410                 q->request_dns_stream->complete = NULL;
 411                 q->request_dns_stream->on_packet = NULL;
 412                 q->request_dns_stream->query = NULL;
 413                 dns_stream_unref(q->request_dns_stream);
 414         }
 415
 416         free(q->request_address_string);
 417
 418         if (q->manager) {
 419                 LIST_REMOVE(queries, q->manager->dns_queries, q);
 420                 q->manager->n_dns_queries--;
 421         }
 422
 423         return mfree(q);
 424 }
 425
 426 int dns_query_new(
 427                 Manager *m,
 428                 DnsQuery **ret,
 429                 DnsQuestion *question_utf8,
 430                 DnsQuestion *question_idna,
 431                 int ifindex,
 432                 uint64_t flags) {
 433
 434         _cleanup_(dns_query_freep) DnsQuery *q = NULL;
 435         DnsResourceKey *key;
 436         bool good = false;
 437         int r;
 438         char key_str[DNS_RESOURCE_KEY_STRING_MAX];
 439
 440         assert(m);
 441
 442         if (dns_question_size(question_utf8) > 0) {
 443                 r = dns_question_is_valid_for_query(question_utf8);
 444                 if (r < 0)
 445                         return r;
 446                 if (r == 0)
 447                         return -EINVAL;
 448
 449                 good = true;
 450         }
 451
 452         /* If the IDNA and UTF8 questions are the same, merge their references */
 453         r = dns_question_is_equal(question_idna, question_utf8);
 454         if (r < 0)
 455                 return r;
 456         if (r > 0)
 457                 question_idna = question_utf8;
 458         else {
 459                 if (dns_question_size(question_idna) > 0) {
 460                         r = dns_question_is_valid_for_query(question_idna);
 461                         if (r < 0)
 462                                 return r;
 463                         if (r == 0)
 464                                 return -EINVAL;
 465
 466                         good = true;
 467                 }
 468         }
 469
 470         if (!good) /* don't allow empty queries */
 471                 return -EINVAL;
 472
 473         if (m->n_dns_queries >= QUERIES_MAX)
 474                 return -EBUSY;
 475
 476         q = new0(DnsQuery, 1);
 477         if (!q)
 478                 return -ENOMEM;
 479
 480         q->question_utf8 = dns_question_ref(question_utf8);
 481         q->question_idna = dns_question_ref(question_idna);
 482         q->ifindex = ifindex;
 483         q->flags = flags;
 484         q->answer_dnssec_result = _DNSSEC_RESULT_INVALID;
 485         q->answer_protocol = _DNS_PROTOCOL_INVALID;
 486         q->answer_family = AF_UNSPEC;
 487
 488         /* First dump UTF8  question */
 489         DNS_QUESTION_FOREACH(key, question_utf8)
 490                 log_debug("Looking up RR for %s.",
 491                           dns_resource_key_to_string(key, key_str, sizeof key_str));
 492
 493         /* And then dump the IDNA question, but only what hasn't been dumped already through the UTF8 question. */
 494         DNS_QUESTION_FOREACH(key, question_idna) {
 495                 r = dns_question_contains(question_utf8, key);
 496                 if (r < 0)
 497                         return r;
 498                 if (r > 0)
 499                         continue;
 500
 501                 log_debug("Looking up IDNA RR for %s.",
 502                           dns_resource_key_to_string(key, key_str, sizeof key_str));
 503         }
 504
 505         LIST_PREPEND(queries, m->dns_queries, q);
 506         m->n_dns_queries++;
 507         q->manager = m;
 508
 509         if (ret)
 510                 *ret = q;
 511         q = NULL;
 512
 513         return 0;
 514 }
 515
 516 int dns_query_make_auxiliary(DnsQuery *q, DnsQuery *auxiliary_for) {
 517         assert(q);
 518         assert(auxiliary_for);
 519
 520         /* Ensure that the query is not auxiliary yet, and
 521          * nothing else is auxiliary to it either */
 522         assert(!q->auxiliary_for);
 523         assert(!q->auxiliary_queries);
 524
 525         /* Ensure that the unit we shall be made auxiliary for isn't
 526          * auxiliary itself */
 527         assert(!auxiliary_for->auxiliary_for);
 528
 529         if (auxiliary_for->n_auxiliary_queries >= AUXILIARY_QUERIES_MAX)
 530                 return -EAGAIN;
 531
 532         LIST_PREPEND(auxiliary_queries, auxiliary_for->auxiliary_queries, q);
 533         q->auxiliary_for = auxiliary_for;
 534
 535         auxiliary_for->n_auxiliary_queries++;
 536         return 0;
 537 }
 538
 539 static void dns_query_complete(DnsQuery *q, DnsTransactionState state) {
 540         assert(q);
 541         assert(!DNS_TRANSACTION_IS_LIVE(state));
 542         assert(DNS_TRANSACTION_IS_LIVE(q->state));
 543
 544         /* Note that this call might invalidate the query. Callers
 545          * should hence not attempt to access the query or transaction
 546          * after calling this function. */
 547
 548         q->state = state;
 549
 550         dns_query_stop(q);
 551         if (q->complete)
 552                 q->complete(q);
 553 }
 554
 555 static int on_query_timeout(sd_event_source *s, usec_t usec, void *userdata) {
 556         DnsQuery *q = userdata;
 557
 558         assert(s);
 559         assert(q);
 560
 561         dns_query_complete(q, DNS_TRANSACTION_TIMEOUT);
 562         return 0;
 563 }
 564
 565 static int dns_query_add_candidate(DnsQuery *q, DnsScope *s) {
 566         DnsQueryCandidate *c;
 567         int r;
 568
 569         assert(q);
 570         assert(s);
 571
 572         r = dns_query_candidate_new(&c, q, s);
 573         if (r < 0)
 574                 return r;
 575
 576         /* If this a single-label domain on DNS, we might append a suitable search domain first. */
 577         if ((q->flags & SD_RESOLVED_NO_SEARCH) == 0)  {
 578                 r = dns_scope_name_needs_search_domain(s, dns_question_first_name(q->question_idna));
 579                 if (r < 0)
 580                         goto fail;
 581                 if (r > 0) {
 582                         /* OK, we need a search domain now. Let's find one for this scope */
 583
 584                         r = dns_query_candidate_next_search_domain(c);
 585                         if (r <= 0) /* if there's no search domain, then we won't add any transaction. */
 586                                 goto fail;
 587                 }
 588         }
 589
 590         r = dns_query_candidate_setup_transactions(c);
 591         if (r < 0)
 592                 goto fail;
 593
 594         return 0;
 595
 596 fail:
 597         dns_query_candidate_free(c);
 598         return r;
 599 }
 600
 601 static int dns_query_synthesize_reply(DnsQuery *q, DnsTransactionState *state) {
 602         _cleanup_(dns_answer_unrefp) DnsAnswer *answer = NULL;
 603         int r;
 604
 605         assert(q);
 606         assert(state);
 607
 608         /* Tries to synthesize localhost RR replies (and others) where appropriate. Note that this is done *after* the
 609          * the normal lookup finished. The data from the network hence takes precedence over the data we
 610          * synthesize. (But note that many scopes refuse to resolve certain domain names) */
 611
 612         if (!IN_SET(*state,
 613                     DNS_TRANSACTION_RCODE_FAILURE,
 614                     DNS_TRANSACTION_NO_SERVERS,
 615                     DNS_TRANSACTION_TIMEOUT,
 616                     DNS_TRANSACTION_ATTEMPTS_MAX_REACHED,
 617                     DNS_TRANSACTION_NETWORK_DOWN,
 618                     DNS_TRANSACTION_NOT_FOUND))
 619                 return 0;
 620
 621         r = dns_synthesize_answer(
 622                         q->manager,
 623                         q->question_utf8,
 624                         q->ifindex,
 625                         &answer);
 626
 627         if (r <= 0)
 628                 return r;
 629
 630         dns_query_reset_answer(q);
 631
 632         q->answer = answer;
 633         answer = NULL;
 634         q->answer_rcode = DNS_RCODE_SUCCESS;
 635         q->answer_protocol = dns_synthesize_protocol(q->flags);
 636         q->answer_family = dns_synthesize_family(q->flags);
 637         q->answer_authenticated = true;
 638
 639         *state = DNS_TRANSACTION_SUCCESS;
 640
 641         return 1;
 642 }
 643
 644 static int dns_query_try_etc_hosts(DnsQuery *q) {
 645         _cleanup_(dns_answer_unrefp) DnsAnswer *answer = NULL;
 646         int r;
 647
 648         assert(q);
 649
 650         /* Looks in /etc/hosts for matching entries. Note that this is done *before* the normal lookup is done. The
 651          * data from /etc/hosts hence takes precedence over the network. */
 652
 653         r = manager_etc_hosts_lookup(
 654                         q->manager,
 655                         q->question_utf8,
 656                         &answer);
 657         if (r <= 0)
 658                 return r;
 659
 660         dns_query_reset_answer(q);
 661
 662         q->answer = answer;
 663         answer = NULL;
 664         q->answer_rcode = DNS_RCODE_SUCCESS;
 665         q->answer_protocol = dns_synthesize_protocol(q->flags);
 666         q->answer_family = dns_synthesize_family(q->flags);
 667         q->answer_authenticated = true;
 668
 669         return 1;
 670 }
 671
 672 int dns_query_go(DnsQuery *q) {
 673         DnsScopeMatch found = DNS_SCOPE_NO;
 674         DnsScope *s, *first = NULL;
 675         DnsQueryCandidate *c;
 676         int r;
 677
 678         assert(q);
 679
 680         if (q->state != DNS_TRANSACTION_NULL)
 681                 return 0;
 682
 683         r = dns_query_try_etc_hosts(q);
 684         if (r < 0)
 685                 return r;
 686         if (r > 0) {
 687                 dns_query_complete(q, DNS_TRANSACTION_SUCCESS);
 688                 return 1;
 689         }
 690
 691         LIST_FOREACH(scopes, s, q->manager->dns_scopes) {
 692                 DnsScopeMatch match;
 693                 const char *name;
 694
 695                 name = dns_question_first_name(dns_query_question_for_protocol(q, s->protocol));
 696                 if (!name)
 697                         continue;
 698
 699                 match = dns_scope_good_domain(s, q->ifindex, q->flags, name);
 700                 if (match < 0)
 701                         return match;
 702
 703                 if (match == DNS_SCOPE_NO)
 704                         continue;
 705
 706                 found = match;
 707
 708                 if (match == DNS_SCOPE_YES) {
 709                         first = s;
 710                         break;
 711                 } else {
 712                         assert(match == DNS_SCOPE_MAYBE);
 713
 714                         if (!first)
 715                                 first = s;
 716                 }
 717         }
 718
 719         if (found == DNS_SCOPE_NO) {
 720                 DnsTransactionState state = DNS_TRANSACTION_NO_SERVERS;
 721
 722                 r = dns_query_synthesize_reply(q, &state);
 723                 if (r < 0)
 724                         return r;
 725
 726                 dns_query_complete(q, state);
 727                 return 1;
 728         }
 729
 730         r = dns_query_add_candidate(q, first);
 731         if (r < 0)
 732                 goto fail;
 733
 734         LIST_FOREACH(scopes, s, first->scopes_next) {
 735                 DnsScopeMatch match;
 736                 const char *name;
 737
 738                 name = dns_question_first_name(dns_query_question_for_protocol(q, s->protocol));
 739                 if (!name)
 740                         continue;
 741
 742                 match = dns_scope_good_domain(s, q->ifindex, q->flags, name);
 743                 if (match < 0)
 744                         goto fail;
 745
 746                 if (match != found)
 747                         continue;
 748
 749                 r = dns_query_add_candidate(q, s);
 750                 if (r < 0)
 751                         goto fail;
 752         }
 753
 754         dns_query_reset_answer(q);
 755
 756         r = sd_event_add_time(
 757                         q->manager->event,
 758                         &q->timeout_event_source,
 759                         clock_boottime_or_monotonic(),
 760                         now(clock_boottime_or_monotonic()) + QUERY_TIMEOUT_USEC, 0,
 761                         on_query_timeout, q);
 762         if (r < 0)
 763                 goto fail;
 764
 765         (void) sd_event_source_set_description(q->timeout_event_source, "query-timeout");
 766
 767         q->state = DNS_TRANSACTION_PENDING;
 768         q->block_ready++;
 769
 770         /* Start the transactions */
 771         LIST_FOREACH(candidates_by_query, c, q->candidates) {
 772                 r = dns_query_candidate_go(c);
 773                 if (r < 0) {
 774                         q->block_ready--;
 775                         goto fail;
 776                 }
 777         }
 778
 779         q->block_ready--;
 780         dns_query_ready(q);
 781
 782         return 1;
 783
 784 fail:
 785         dns_query_stop(q);
 786         return r;
 787 }
 788
 789 static void dns_query_accept(DnsQuery *q, DnsQueryCandidate *c) {
 790         DnsTransactionState state = DNS_TRANSACTION_NO_SERVERS;
 791         bool has_authenticated = false, has_non_authenticated = false;
 792         DnssecResult dnssec_result_authenticated = _DNSSEC_RESULT_INVALID, dnssec_result_non_authenticated = _DNSSEC_RESULT_INVALID;
 793         DnsTransaction *t;
 794         Iterator i;
 795         int r;
 796
 797         assert(q);
 798
 799         if (!c) {
 800                 r = dns_query_synthesize_reply(q, &state);
 801                 if (r < 0)
 802                         goto fail;
 803
 804                 dns_query_complete(q, state);
 805                 return;
 806         }
 807
 808         if (c->error_code != 0) {
 809                 /* If the candidate had an error condition of its own, start with that. */
 810                 state = DNS_TRANSACTION_ERRNO;
 811                 q->answer = dns_answer_unref(q->answer);
 812                 q->answer_rcode = 0;
 813                 q->answer_dnssec_result = _DNSSEC_RESULT_INVALID;
 814                 q->answer_authenticated = false;
 815                 q->answer_errno = c->error_code;
 816         }
 817
 818         SET_FOREACH(t, c->transactions, i) {
 819
 820                 switch (t->state) {
 821
 822                 case DNS_TRANSACTION_SUCCESS: {
 823                         /* We found a successfully reply, merge it into the answer */
 824                         r = dns_answer_extend(&q->answer, t->answer);
 825                         if (r < 0)
 826                                 goto fail;
 827
 828                         q->answer_rcode = t->answer_rcode;
 829                         q->answer_errno = 0;
 830
 831                         if (t->answer_authenticated) {
 832                                 has_authenticated = true;
 833                                 dnssec_result_authenticated = t->answer_dnssec_result;
 834                         } else {
 835                                 has_non_authenticated = true;
 836                                 dnssec_result_non_authenticated = t->answer_dnssec_result;
 837                         }
 838
 839                         state = DNS_TRANSACTION_SUCCESS;
 840                         break;
 841                 }
 842
 843                 case DNS_TRANSACTION_NULL:
 844                 case DNS_TRANSACTION_PENDING:
 845                 case DNS_TRANSACTION_VALIDATING:
 846                 case DNS_TRANSACTION_ABORTED:
 847                         /* Ignore transactions that didn't complete */
 848                         continue;
 849
 850                 default:
 851                         /* Any kind of failure? Store the data away, if there's nothing stored yet. */
 852                         if (state == DNS_TRANSACTION_SUCCESS)
 853                                 continue;
 854
 855                         /* If there's already an authenticated negative reply stored, then prefer that over any unauthenticated one */
 856                         if (q->answer_authenticated && !t->answer_authenticated)
 857                                 continue;
 858
 859                         q->answer = dns_answer_unref(q->answer);
 860                         q->answer_rcode = t->answer_rcode;
 861                         q->answer_dnssec_result = t->answer_dnssec_result;
 862                         q->answer_authenticated = t->answer_authenticated;
 863                         q->answer_errno = t->answer_errno;
 864
 865                         state = t->state;
 866                         break;
 867                 }
 868         }
 869
 870         if (state == DNS_TRANSACTION_SUCCESS) {
 871                 q->answer_authenticated = has_authenticated && !has_non_authenticated;
 872                 q->answer_dnssec_result = q->answer_authenticated ? dnssec_result_authenticated : dnssec_result_non_authenticated;
 873         }
 874
 875         q->answer_protocol = c->scope->protocol;
 876         q->answer_family = c->scope->family;
 877
 878         dns_search_domain_unref(q->answer_search_domain);
 879         q->answer_search_domain = dns_search_domain_ref(c->search_domain);
 880
 881         r = dns_query_synthesize_reply(q, &state);
 882         if (r < 0)
 883                 goto fail;
 884
 885         dns_query_complete(q, state);
 886         return;
 887
 888 fail:
 889         q->answer_errno = -r;
 890         dns_query_complete(q, DNS_TRANSACTION_ERRNO);
 891 }
 892
 893 void dns_query_ready(DnsQuery *q) {
 894
 895         DnsQueryCandidate *bad = NULL, *c;
 896         bool pending = false;
 897
 898         assert(q);
 899         assert(DNS_TRANSACTION_IS_LIVE(q->state));
 900
 901         /* Note that this call might invalidate the query. Callers
 902          * should hence not attempt to access the query or transaction
 903          * after calling this function, unless the block_ready
 904          * counter was explicitly bumped before doing so. */
 905
 906         if (q->block_ready > 0)
 907                 return;
 908
 909         LIST_FOREACH(candidates_by_query, c, q->candidates) {
 910                 DnsTransactionState state;
 911
 912                 state = dns_query_candidate_state(c);
 913                 switch (state) {
 914
 915                 case DNS_TRANSACTION_SUCCESS:
 916                         /* One of the candidates is successful,
 917                          * let's use it, and copy its data out */
 918                         dns_query_accept(q, c);
 919                         return;
 920
 921                 case DNS_TRANSACTION_NULL:
 922                 case DNS_TRANSACTION_PENDING:
 923                 case DNS_TRANSACTION_VALIDATING:
 924                         /* One of the candidates is still going on,
 925                          * let's maybe wait for it */
 926                         pending = true;
 927                         break;
 928
 929                 default:
 930                         /* Any kind of failure */
 931                         bad = c;
 932                         break;
 933                 }
 934         }
 935
 936         if (pending)
 937                 return;
 938
 939         dns_query_accept(q, bad);
 940 }
 941
 942 static int dns_query_cname_redirect(DnsQuery *q, const DnsResourceRecord *cname) {
 943         _cleanup_(dns_question_unrefp) DnsQuestion *nq_idna = NULL, *nq_utf8 = NULL;
 944         int r, k;
 945
 946         assert(q);
 947
 948         q->n_cname_redirects++;
 949         if (q->n_cname_redirects > CNAME_MAX)
 950                 return -ELOOP;
 951
 952         r = dns_question_cname_redirect(q->question_idna, cname, &nq_idna);
 953         if (r < 0)
 954                 return r;
 955         else if (r > 0)
 956                 log_debug("Following CNAME/DNAME %s → %s.", dns_question_first_name(q->question_idna), dns_question_first_name(nq_idna));
 957
 958         k = dns_question_is_equal(q->question_idna, q->question_utf8);
 959         if (k < 0)
 960                 return r;
 961         if (k > 0) {
 962                 /* Same question? Shortcut new question generation */
 963                 nq_utf8 = dns_question_ref(nq_idna);
 964                 k = r;
 965         } else {
 966                 k = dns_question_cname_redirect(q->question_utf8, cname, &nq_utf8);
 967                 if (k < 0)
 968                         return k;
 969                 else if (k > 0)
 970                         log_debug("Following UTF8 CNAME/DNAME %s → %s.", dns_question_first_name(q->question_utf8), dns_question_first_name(nq_utf8));
 971         }
 972
 973         if (r == 0 && k == 0) /* No actual cname happened? */
 974                 return -ELOOP;
 975
 976         if (q->answer_protocol == DNS_PROTOCOL_DNS) {
 977                 /* Don't permit CNAME redirects from unicast DNS to LLMNR or MulticastDNS, so that global resources
 978                  * cannot invade the local namespace. The opposite way we permit: local names may redirect to global
 979                  * ones. */
 980
 981                 q->flags &= ~(SD_RESOLVED_LLMNR|SD_RESOLVED_MDNS); /* mask away the local protocols */
 982         }
 983
 984         /* Turn off searching for the new name */
 985         q->flags |= SD_RESOLVED_NO_SEARCH;
 986
 987         dns_question_unref(q->question_idna);
 988         q->question_idna = nq_idna;
 989         nq_idna = NULL;
 990
 991         dns_question_unref(q->question_utf8);
 992         q->question_utf8 = nq_utf8;
 993         nq_utf8 = NULL;
 994
 995         dns_query_free_candidates(q);
 996         dns_query_reset_answer(q);
 997
 998         q->state = DNS_TRANSACTION_NULL;
 999
1000         return 0;
1001 }
1002
1003 int dns_query_process_cname(DnsQuery *q) {
1004         _cleanup_(dns_resource_record_unrefp) DnsResourceRecord *cname = NULL;
1005         DnsQuestion *question;
1006         DnsResourceRecord *rr;
1007         int r;
1008
1009         assert(q);
1010
1011         if (!IN_SET(q->state, DNS_TRANSACTION_SUCCESS, DNS_TRANSACTION_NULL))
1012                 return DNS_QUERY_NOMATCH;
1013
1014         question = dns_query_question_for_protocol(q, q->answer_protocol);
1015
1016         DNS_ANSWER_FOREACH(rr, q->answer) {
1017                 r = dns_question_matches_rr(question, rr, DNS_SEARCH_DOMAIN_NAME(q->answer_search_domain));
1018                 if (r < 0)
1019                         return r;
1020                 if (r > 0)
1021                         return DNS_QUERY_MATCH; /* The answer matches directly, no need to follow cnames */
1022
1023                 r = dns_question_matches_cname_or_dname(question, rr, DNS_SEARCH_DOMAIN_NAME(q->answer_search_domain));
1024                 if (r < 0)
1025                         return r;
1026                 if (r > 0 && !cname)
1027                         cname = dns_resource_record_ref(rr);
1028         }
1029
1030         if (!cname)
1031                 return DNS_QUERY_NOMATCH; /* No match and no cname to follow */
1032
1033         if (q->flags & SD_RESOLVED_NO_CNAME)
1034                 return -ELOOP;
1035
1036         if (!q->answer_authenticated)
1037                 q->previous_redirect_unauthenticated = true;
1038
1039         /* OK, let's actually follow the CNAME */
1040         r = dns_query_cname_redirect(q, cname);
1041         if (r < 0)
1042                 return r;
1043
1044         /* Let's see if the answer can already answer the new
1045          * redirected question */
1046         r = dns_query_process_cname(q);
1047         if (r != DNS_QUERY_NOMATCH)
1048                 return r;
1049
1050         /* OK, it cannot, let's begin with the new query */
1051         r = dns_query_go(q);
1052         if (r < 0)
1053                 return r;
1054
1055         return DNS_QUERY_RESTARTED; /* We restarted the query for a new cname */
1056 }
1057
1058 static int on_bus_track(sd_bus_track *t, void *userdata) {
1059         DnsQuery *q = userdata;
1060
1061         assert(t);
1062         assert(q);
1063
1064         log_debug("Client of active query vanished, aborting query.");
1065         dns_query_complete(q, DNS_TRANSACTION_ABORTED);
1066         return 0;
1067 }
1068
1069 int dns_query_bus_track(DnsQuery *q, sd_bus_message *m) {
1070         int r;
1071
1072         assert(q);
1073         assert(m);
1074
1075         if (!q->bus_track) {
1076                 r = sd_bus_track_new(sd_bus_message_get_bus(m), &q->bus_track, on_bus_track, q);
1077                 if (r < 0)
1078                         return r;
1079         }
1080
1081         r = sd_bus_track_add_sender(q->bus_track, m);
1082         if (r < 0)
1083                 return r;
1084
1085         return 0;
1086 }
1087
1088 DnsQuestion* dns_query_question_for_protocol(DnsQuery *q, DnsProtocol protocol) {
1089         assert(q);
1090
1091         switch (protocol) {
1092
1093         case DNS_PROTOCOL_DNS:
1094                 return q->question_idna;
1095
1096         case DNS_PROTOCOL_MDNS:
1097         case DNS_PROTOCOL_LLMNR:
1098                 return q->question_utf8;
1099
1100         default:
1101                 return NULL;
1102         }
1103 }
1104
1105 const char *dns_query_string(DnsQuery *q) {
1106         const char *name;
1107         int r;
1108
1109         /* Returns a somewhat useful human-readable lookup key string for this query */
1110
1111         if (q->request_address_string)
1112                 return q->request_address_string;
1113
1114         if (q->request_address_valid) {
1115                 r = in_addr_to_string(q->request_family, &q->request_address, &q->request_address_string);
1116                 if (r >= 0)
1117                         return q->request_address_string;
1118         }
1119
1120         name = dns_question_first_name(q->question_utf8);
1121         if (name)
1122                 return name;
1123
1124         return dns_question_first_name(q->question_idna);
1125 }
1126
1127 bool dns_query_fully_authenticated(DnsQuery *q) {
1128         assert(q);
1129
1130         return q->answer_authenticated && !q->previous_redirect_unauthenticated;
1131 }