2 This file is part of systemd.
4 Copyright 2014 Lennart Poettering
6 systemd is free software; you can redistribute it and/or modify it
7 under the terms of the GNU Lesser General Public License as published by
8 the Free Software Foundation; either version 2.1 of the License, or
9 (at your option) any later version.
11 systemd is distributed in the hope that it will be useful, but
12 WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 Lesser General Public License for more details.
16 You should have received a copy of the GNU Lesser General Public License
17 along with systemd; If not, see <http://www.gnu.org/licenses/>.
20 #include <sd-messages.h>
22 #include "alloc-util.h"
23 #include "resolved-dns-server.h"
24 #include "resolved-dns-stub.h"
25 #include "resolved-resolv-conf.h"
26 #include "siphash24.h"
27 #include "string-table.h"
28 #include "string-util.h"
30 /* After how much time to repeat classic DNS requests */
31 #define DNS_TIMEOUT_MIN_USEC (500 * USEC_PER_MSEC)
32 #define DNS_TIMEOUT_MAX_USEC (5 * USEC_PER_SEC)
34 /* The amount of time to wait before retrying with a full feature set */
35 #define DNS_SERVER_FEATURE_GRACE_PERIOD_MAX_USEC (6 * USEC_PER_HOUR)
36 #define DNS_SERVER_FEATURE_GRACE_PERIOD_MIN_USEC (5 * USEC_PER_MINUTE)
38 /* The number of times we will attempt a certain feature set before degrading */
39 #define DNS_SERVER_FEATURE_RETRY_ATTEMPTS 3
47 const union in_addr_union
*in_addr
,
53 assert((type
== DNS_SERVER_LINK
) == !!l
);
56 if (!IN_SET(family
, AF_INET
, AF_INET6
))
60 if (l
->n_dns_servers
>= LINK_DNS_SERVERS_MAX
)
63 if (m
->n_dns_servers
>= MANAGER_DNS_SERVERS_MAX
)
67 s
= new0(DnsServer
, 1);
73 s
->verified_feature_level
= _DNS_SERVER_FEATURE_LEVEL_INVALID
;
74 s
->possible_feature_level
= DNS_SERVER_FEATURE_LEVEL_BEST
;
75 s
->features_grace_period_usec
= DNS_SERVER_FEATURE_GRACE_PERIOD_MIN_USEC
;
76 s
->received_udp_packet_max
= DNS_PACKET_UNICAST_SIZE_MAX
;
79 s
->address
= *in_addr
;
81 s
->resend_timeout
= DNS_TIMEOUT_MIN_USEC
;
87 LIST_APPEND(servers
, l
->dns_servers
, s
);
91 case DNS_SERVER_SYSTEM
:
92 LIST_APPEND(servers
, m
->dns_servers
, s
);
96 case DNS_SERVER_FALLBACK
:
97 LIST_APPEND(servers
, m
->fallback_dns_servers
, s
);
102 assert_not_reached("Unknown server type");
107 /* A new DNS server that isn't fallback is added and the one
108 * we used so far was a fallback one? Then let's try to pick
110 if (type
!= DNS_SERVER_FALLBACK
&&
111 m
->current_dns_server
&&
112 m
->current_dns_server
->type
== DNS_SERVER_FALLBACK
)
113 manager_set_dns_server(m
, NULL
);
121 DnsServer
* dns_server_ref(DnsServer
*s
) {
125 assert(s
->n_ref
> 0);
131 DnsServer
* dns_server_unref(DnsServer
*s
) {
135 assert(s
->n_ref
> 0);
141 free(s
->server_string
);
146 void dns_server_unlink(DnsServer
*s
) {
150 /* This removes the specified server from the linked list of
151 * servers, but any server might still stay around if it has
152 * refs, for example from an ongoing transaction. */
159 case DNS_SERVER_LINK
:
161 assert(s
->link
->n_dns_servers
> 0);
162 LIST_REMOVE(servers
, s
->link
->dns_servers
, s
);
163 s
->link
->n_dns_servers
--;
166 case DNS_SERVER_SYSTEM
:
167 assert(s
->manager
->n_dns_servers
> 0);
168 LIST_REMOVE(servers
, s
->manager
->dns_servers
, s
);
169 s
->manager
->n_dns_servers
--;
172 case DNS_SERVER_FALLBACK
:
173 assert(s
->manager
->n_dns_servers
> 0);
174 LIST_REMOVE(servers
, s
->manager
->fallback_dns_servers
, s
);
175 s
->manager
->n_dns_servers
--;
181 if (s
->link
&& s
->link
->current_dns_server
== s
)
182 link_set_dns_server(s
->link
, NULL
);
184 if (s
->manager
->current_dns_server
== s
)
185 manager_set_dns_server(s
->manager
, NULL
);
190 void dns_server_move_back_and_unmark(DnsServer
*s
) {
200 if (!s
->linked
|| !s
->servers_next
)
203 /* Move us to the end of the list, so that the order is
204 * strictly kept, if we are not at the end anyway. */
208 case DNS_SERVER_LINK
:
210 LIST_FIND_TAIL(servers
, s
, tail
);
211 LIST_REMOVE(servers
, s
->link
->dns_servers
, s
);
212 LIST_INSERT_AFTER(servers
, s
->link
->dns_servers
, tail
, s
);
215 case DNS_SERVER_SYSTEM
:
216 LIST_FIND_TAIL(servers
, s
, tail
);
217 LIST_REMOVE(servers
, s
->manager
->dns_servers
, s
);
218 LIST_INSERT_AFTER(servers
, s
->manager
->dns_servers
, tail
, s
);
221 case DNS_SERVER_FALLBACK
:
222 LIST_FIND_TAIL(servers
, s
, tail
);
223 LIST_REMOVE(servers
, s
->manager
->fallback_dns_servers
, s
);
224 LIST_INSERT_AFTER(servers
, s
->manager
->fallback_dns_servers
, tail
, s
);
228 assert_not_reached("Unknown server type");
232 static void dns_server_verified(DnsServer
*s
, DnsServerFeatureLevel level
) {
235 if (s
->verified_feature_level
> level
)
238 if (s
->verified_feature_level
!= level
) {
239 log_debug("Verified we get a response at feature level %s from DNS server %s.",
240 dns_server_feature_level_to_string(level
),
241 dns_server_string(s
));
242 s
->verified_feature_level
= level
;
245 assert_se(sd_event_now(s
->manager
->event
, clock_boottime_or_monotonic(), &s
->verified_usec
) >= 0);
248 void dns_server_packet_received(DnsServer
*s
, int protocol
, DnsServerFeatureLevel level
, usec_t rtt
, size_t size
) {
251 if (protocol
== IPPROTO_UDP
) {
252 if (s
->possible_feature_level
== level
)
255 /* If the RRSIG data is missing, then we can only validate EDNS0 at max */
256 if (s
->packet_rrsig_missing
&& level
>= DNS_SERVER_FEATURE_LEVEL_DO
)
257 level
= DNS_SERVER_FEATURE_LEVEL_DO
- 1;
259 /* If the OPT RR got lost, then we can only validate UDP at max */
260 if (s
->packet_bad_opt
&& level
>= DNS_SERVER_FEATURE_LEVEL_EDNS0
)
261 level
= DNS_SERVER_FEATURE_LEVEL_EDNS0
- 1;
263 /* Even if we successfully receive a reply to a request announcing support for large packets,
264 that does not mean we can necessarily receive large packets. */
265 if (level
== DNS_SERVER_FEATURE_LEVEL_LARGE
)
266 level
= DNS_SERVER_FEATURE_LEVEL_LARGE
- 1;
268 } else if (protocol
== IPPROTO_TCP
) {
270 if (s
->possible_feature_level
== level
)
273 /* Successful TCP connections are only useful to verify the TCP feature level. */
274 level
= DNS_SERVER_FEATURE_LEVEL_TCP
;
277 dns_server_verified(s
, level
);
279 /* Remember the size of the largest UDP packet we received from a server,
280 we know that we can always announce support for packets with at least
282 if (protocol
== IPPROTO_UDP
&& s
->received_udp_packet_max
< size
)
283 s
->received_udp_packet_max
= size
;
285 if (s
->max_rtt
< rtt
) {
287 s
->resend_timeout
= CLAMP(s
->max_rtt
* 2, DNS_TIMEOUT_MIN_USEC
, DNS_TIMEOUT_MAX_USEC
);
291 void dns_server_packet_lost(DnsServer
*s
, int protocol
, DnsServerFeatureLevel level
, usec_t usec
) {
295 if (s
->possible_feature_level
== level
) {
296 if (protocol
== IPPROTO_UDP
)
298 else if (protocol
== IPPROTO_TCP
)
302 if (s
->resend_timeout
> usec
)
305 s
->resend_timeout
= MIN(s
->resend_timeout
* 2, DNS_TIMEOUT_MAX_USEC
);
308 void dns_server_packet_failed(DnsServer
*s
, DnsServerFeatureLevel level
) {
311 /* Invoked whenever we get a FORMERR, SERVFAIL or NOTIMP rcode from a server. */
313 if (s
->possible_feature_level
!= level
)
316 s
->packet_failed
= true;
319 void dns_server_packet_truncated(DnsServer
*s
, DnsServerFeatureLevel level
) {
322 /* Invoked whenever we get a packet with TC bit set. */
324 if (s
->possible_feature_level
!= level
)
327 s
->packet_truncated
= true;
330 void dns_server_packet_rrsig_missing(DnsServer
*s
, DnsServerFeatureLevel level
) {
333 if (level
< DNS_SERVER_FEATURE_LEVEL_DO
)
336 /* If the RRSIG RRs are missing, we have to downgrade what we previously verified */
337 if (s
->verified_feature_level
>= DNS_SERVER_FEATURE_LEVEL_DO
)
338 s
->verified_feature_level
= DNS_SERVER_FEATURE_LEVEL_DO
-1;
340 s
->packet_rrsig_missing
= true;
343 void dns_server_packet_bad_opt(DnsServer
*s
, DnsServerFeatureLevel level
) {
346 if (level
< DNS_SERVER_FEATURE_LEVEL_EDNS0
)
349 /* If the OPT RR got lost, we have to downgrade what we previously verified */
350 if (s
->verified_feature_level
>= DNS_SERVER_FEATURE_LEVEL_EDNS0
)
351 s
->verified_feature_level
= DNS_SERVER_FEATURE_LEVEL_EDNS0
-1;
353 s
->packet_bad_opt
= true;
356 static bool dns_server_grace_period_expired(DnsServer
*s
) {
362 if (s
->verified_usec
== 0)
365 assert_se(sd_event_now(s
->manager
->event
, clock_boottime_or_monotonic(), &ts
) >= 0);
367 if (s
->verified_usec
+ s
->features_grace_period_usec
> ts
)
370 s
->features_grace_period_usec
= MIN(s
->features_grace_period_usec
* 2, DNS_SERVER_FEATURE_GRACE_PERIOD_MAX_USEC
);
375 static void dns_server_reset_counters(DnsServer
*s
) {
380 s
->packet_failed
= false;
381 s
->packet_truncated
= false;
382 s
->verified_usec
= 0;
384 /* Note that we do not reset s->packet_bad_opt and s->packet_rrsig_missing here. We reset them only when the
385 * grace period ends, but not when lowering the possible feature level, as a lower level feature level should
386 * not make RRSIGs appear or OPT appear, but rather make them disappear. If the reappear anyway, then that's
387 * indication for a differently broken OPT/RRSIG implementation, and we really don't want to support that
390 * This is particularly important to deal with certain Belkin routers which break OPT for certain lookups (A),
391 * but pass traffic through for others (AAAA). If we detect the broken behaviour on one lookup we should not
392 * reenable it for another, because we cannot validate things anyway, given that the RRSIG/OPT data will be
396 DnsServerFeatureLevel
dns_server_possible_feature_level(DnsServer
*s
) {
399 if (s
->possible_feature_level
!= DNS_SERVER_FEATURE_LEVEL_BEST
&&
400 dns_server_grace_period_expired(s
)) {
402 s
->possible_feature_level
= DNS_SERVER_FEATURE_LEVEL_BEST
;
404 dns_server_reset_counters(s
);
406 s
->packet_bad_opt
= false;
407 s
->packet_rrsig_missing
= false;
409 log_info("Grace period over, resuming full feature set (%s) for DNS server %s.",
410 dns_server_feature_level_to_string(s
->possible_feature_level
),
411 dns_server_string(s
));
413 } else if (s
->possible_feature_level
<= s
->verified_feature_level
)
414 s
->possible_feature_level
= s
->verified_feature_level
;
416 DnsServerFeatureLevel p
= s
->possible_feature_level
;
418 if (s
->n_failed_tcp
>= DNS_SERVER_FEATURE_RETRY_ATTEMPTS
&&
419 s
->possible_feature_level
== DNS_SERVER_FEATURE_LEVEL_TCP
) {
421 /* We are at the TCP (lowest) level, and we tried a couple of TCP connections, and it didn't
422 * work. Upgrade back to UDP again. */
423 log_debug("Reached maximum number of failed TCP connection attempts, trying UDP again...");
424 s
->possible_feature_level
= DNS_SERVER_FEATURE_LEVEL_UDP
;
426 } else if (s
->packet_bad_opt
&&
427 s
->possible_feature_level
>= DNS_SERVER_FEATURE_LEVEL_EDNS0
) {
429 /* A reply to one of our EDNS0 queries didn't carry a valid OPT RR, then downgrade to below
430 * EDNS0 levels. After all, some records generate different responses with and without OPT RR
431 * in the request. Example:
432 * https://open.nlnetlabs.nl/pipermail/dnssec-trigger/2014-November/000376.html */
434 log_debug("Server doesn't support EDNS(0) properly, downgrading feature level...");
435 s
->possible_feature_level
= DNS_SERVER_FEATURE_LEVEL_UDP
;
437 } else if (s
->packet_rrsig_missing
&&
438 s
->possible_feature_level
>= DNS_SERVER_FEATURE_LEVEL_DO
) {
440 /* RRSIG data was missing on a EDNS0 packet with DO bit set. This means the server doesn't
441 * augment responses with DNSSEC RRs. If so, let's better not ask the server for it anymore,
442 * after all some servers generate different replies depending if an OPT RR is in the query or
445 log_debug("Detected server responses lack RRSIG records, downgrading feature level...");
446 s
->possible_feature_level
= DNS_SERVER_FEATURE_LEVEL_EDNS0
;
448 } else if (s
->n_failed_udp
>= DNS_SERVER_FEATURE_RETRY_ATTEMPTS
&&
449 s
->possible_feature_level
>= DNS_SERVER_FEATURE_LEVEL_UDP
) {
451 /* We lost too many UDP packets in a row, and are on a feature level of UDP or higher. If the
452 * packets are lost, maybe the server cannot parse them, hence downgrading sounds like a good
453 * idea. We might downgrade all the way down to TCP this way. */
455 log_debug("Lost too many UDP packets, downgrading feature level...");
456 s
->possible_feature_level
--;
458 } else if (s
->packet_failed
&&
459 s
->possible_feature_level
> DNS_SERVER_FEATURE_LEVEL_UDP
) {
461 /* We got a failure packet, and are at a feature level above UDP. Note that in this case we
462 * downgrade no further than UDP, under the assumption that a failure packet indicates an
463 * incompatible packet contents, but not a problem with the transport. */
465 log_debug("Got server failure, downgrading feature level...");
466 s
->possible_feature_level
--;
468 } else if (s
->n_failed_tcp
>= DNS_SERVER_FEATURE_RETRY_ATTEMPTS
&&
469 s
->packet_truncated
&&
470 s
->possible_feature_level
> DNS_SERVER_FEATURE_LEVEL_UDP
) {
472 /* We got too many TCP connection failures in a row, we had at least one truncated packet, and
473 * are on a feature level above UDP. By downgrading things and getting rid of DNSSEC or EDNS0
474 * data we hope to make the packet smaller, so that it still works via UDP given that TCP
475 * appears not to be a fallback. Note that if we are already at the lowest UDP level, we don't
476 * go further down, since that's TCP, and TCP failed too often after all. */
478 log_debug("Got too many failed TCP connection failures and truncated UDP packets, downgrading feature level...");
479 s
->possible_feature_level
--;
482 if (p
!= s
->possible_feature_level
) {
484 /* We changed the feature level, reset the counting */
485 dns_server_reset_counters(s
);
487 log_warning("Using degraded feature set (%s) for DNS server %s.",
488 dns_server_feature_level_to_string(s
->possible_feature_level
),
489 dns_server_string(s
));
493 return s
->possible_feature_level
;
496 int dns_server_adjust_opt(DnsServer
*server
, DnsPacket
*packet
, DnsServerFeatureLevel level
) {
503 assert(packet
->protocol
== DNS_PROTOCOL_DNS
);
505 /* Fix the OPT field in the packet to match our current feature level. */
507 r
= dns_packet_truncate_opt(packet
);
511 if (level
< DNS_SERVER_FEATURE_LEVEL_EDNS0
)
514 edns_do
= level
>= DNS_SERVER_FEATURE_LEVEL_DO
;
516 if (level
>= DNS_SERVER_FEATURE_LEVEL_LARGE
)
517 packet_size
= DNS_PACKET_UNICAST_SIZE_LARGE_MAX
;
519 packet_size
= server
->received_udp_packet_max
;
521 return dns_packet_append_opt(packet
, packet_size
, edns_do
, 0, NULL
);
524 int dns_server_ifindex(const DnsServer
*s
) {
527 /* The link ifindex always takes precedence */
529 return s
->link
->ifindex
;
537 const char *dns_server_string(DnsServer
*server
) {
540 if (!server
->server_string
)
541 (void) in_addr_ifindex_to_string(server
->family
, &server
->address
, dns_server_ifindex(server
), &server
->server_string
);
543 return strna(server
->server_string
);
546 bool dns_server_dnssec_supported(DnsServer
*server
) {
549 /* Returns whether the server supports DNSSEC according to what we know about it */
551 if (server
->possible_feature_level
< DNS_SERVER_FEATURE_LEVEL_DO
)
554 if (server
->packet_bad_opt
)
557 if (server
->packet_rrsig_missing
)
560 /* DNSSEC servers need to support TCP properly (see RFC5966), if they don't, we assume DNSSEC is borked too */
561 if (server
->n_failed_tcp
>= DNS_SERVER_FEATURE_RETRY_ATTEMPTS
)
567 void dns_server_warn_downgrade(DnsServer
*server
) {
570 if (server
->warned_downgrade
)
573 log_struct(LOG_NOTICE
,
574 LOG_MESSAGE_ID(SD_MESSAGE_DNSSEC_DOWNGRADE
),
575 LOG_MESSAGE("Server %s does not support DNSSEC, downgrading to non-DNSSEC mode.", dns_server_string(server
)),
576 "DNS_SERVER=%s", dns_server_string(server
),
577 "DNS_SERVER_FEATURE_LEVEL=%s", dns_server_feature_level_to_string(server
->possible_feature_level
),
580 server
->warned_downgrade
= true;
583 static void dns_server_hash_func(const void *p
, struct siphash
*state
) {
584 const DnsServer
*s
= p
;
588 siphash24_compress(&s
->family
, sizeof(s
->family
), state
);
589 siphash24_compress(&s
->address
, FAMILY_ADDRESS_SIZE(s
->family
), state
);
590 siphash24_compress(&s
->ifindex
, sizeof(s
->ifindex
), state
);
593 static int dns_server_compare_func(const void *a
, const void *b
) {
594 const DnsServer
*x
= a
, *y
= b
;
597 if (x
->family
< y
->family
)
599 if (x
->family
> y
->family
)
602 r
= memcmp(&x
->address
, &y
->address
, FAMILY_ADDRESS_SIZE(x
->family
));
606 if (x
->ifindex
< y
->ifindex
)
608 if (x
->ifindex
> y
->ifindex
)
614 const struct hash_ops dns_server_hash_ops
= {
615 .hash
= dns_server_hash_func
,
616 .compare
= dns_server_compare_func
619 void dns_server_unlink_all(DnsServer
*first
) {
625 next
= first
->servers_next
;
626 dns_server_unlink(first
);
628 dns_server_unlink_all(next
);
631 void dns_server_unlink_marked(DnsServer
*first
) {
637 next
= first
->servers_next
;
640 dns_server_unlink(first
);
642 dns_server_unlink_marked(next
);
645 void dns_server_mark_all(DnsServer
*first
) {
649 first
->marked
= true;
650 dns_server_mark_all(first
->servers_next
);
653 DnsServer
*dns_server_find(DnsServer
*first
, int family
, const union in_addr_union
*in_addr
, int ifindex
) {
656 LIST_FOREACH(servers
, s
, first
)
657 if (s
->family
== family
&& in_addr_equal(family
, &s
->address
, in_addr
) > 0 && s
->ifindex
== ifindex
)
663 DnsServer
*manager_get_first_dns_server(Manager
*m
, DnsServerType t
) {
668 case DNS_SERVER_SYSTEM
:
669 return m
->dns_servers
;
671 case DNS_SERVER_FALLBACK
:
672 return m
->fallback_dns_servers
;
679 DnsServer
*manager_set_dns_server(Manager
*m
, DnsServer
*s
) {
682 if (m
->current_dns_server
== s
)
686 log_info("Switching to %s DNS server %s.",
687 dns_server_type_to_string(s
->type
),
688 dns_server_string(s
));
690 dns_server_unref(m
->current_dns_server
);
691 m
->current_dns_server
= dns_server_ref(s
);
693 if (m
->unicast_scope
)
694 dns_cache_flush(&m
->unicast_scope
->cache
);
699 DnsServer
*manager_get_dns_server(Manager
*m
) {
703 /* Try to read updates resolv.conf */
704 manager_read_resolv_conf(m
);
706 /* If no DNS server was chosen so far, pick the first one */
707 if (!m
->current_dns_server
)
708 manager_set_dns_server(m
, m
->dns_servers
);
710 if (!m
->current_dns_server
) {
714 /* No DNS servers configured, let's see if there are
715 * any on any links. If not, we use the fallback
718 HASHMAP_FOREACH(l
, m
->links
, i
)
719 if (l
->dns_servers
) {
725 manager_set_dns_server(m
, m
->fallback_dns_servers
);
728 return m
->current_dns_server
;
731 void manager_next_dns_server(Manager
*m
) {
734 /* If there's currently no DNS server set, then the next
735 * manager_get_dns_server() will find one */
736 if (!m
->current_dns_server
)
739 /* Change to the next one, but make sure to follow the linked
740 * list only if the server is still linked. */
741 if (m
->current_dns_server
->linked
&& m
->current_dns_server
->servers_next
) {
742 manager_set_dns_server(m
, m
->current_dns_server
->servers_next
);
746 /* If there was no next one, then start from the beginning of
748 if (m
->current_dns_server
->type
== DNS_SERVER_FALLBACK
)
749 manager_set_dns_server(m
, m
->fallback_dns_servers
);
751 manager_set_dns_server(m
, m
->dns_servers
);
754 bool dns_server_address_valid(int family
, const union in_addr_union
*sa
) {
756 /* Refuses the 0 IP addresses as well as 127.0.0.53 (which is our own DNS stub) */
758 if (in_addr_is_null(family
, sa
))
761 if (family
== AF_INET
&& sa
->in
.s_addr
== htobe32(INADDR_DNS_STUB
))
767 static const char* const dns_server_type_table
[_DNS_SERVER_TYPE_MAX
] = {
768 [DNS_SERVER_SYSTEM
] = "system",
769 [DNS_SERVER_FALLBACK
] = "fallback",
770 [DNS_SERVER_LINK
] = "link",
772 DEFINE_STRING_TABLE_LOOKUP(dns_server_type
, DnsServerType
);
774 static const char* const dns_server_feature_level_table
[_DNS_SERVER_FEATURE_LEVEL_MAX
] = {
775 [DNS_SERVER_FEATURE_LEVEL_TCP
] = "TCP",
776 [DNS_SERVER_FEATURE_LEVEL_UDP
] = "UDP",
777 [DNS_SERVER_FEATURE_LEVEL_EDNS0
] = "UDP+EDNS0",
778 [DNS_SERVER_FEATURE_LEVEL_DO
] = "UDP+EDNS0+DO",
779 [DNS_SERVER_FEATURE_LEVEL_LARGE
] = "UDP+EDNS0+DO+LARGE",
781 DEFINE_STRING_TABLE_LOOKUP(dns_server_feature_level
, DnsServerFeatureLevel
);