src/resolve/resolved-dns-server.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2
   3 #include "sd-messages.h"
   4
   5 #include "alloc-util.h"
   6 #include "resolved-dns-server.h"
   7 #include "resolved-dns-stub.h"
   8 #include "resolved-resolv-conf.h"
   9 #include "siphash24.h"
  10 #include "string-table.h"
  11 #include "string-util.h"
  12
  13 /* The amount of time to wait before retrying with a full feature set */
  14 #define DNS_SERVER_FEATURE_GRACE_PERIOD_MAX_USEC (6 * USEC_PER_HOUR)
  15 #define DNS_SERVER_FEATURE_GRACE_PERIOD_MIN_USEC (5 * USEC_PER_MINUTE)
  16
  17 /* The number of times we will attempt a certain feature set before degrading */
  18 #define DNS_SERVER_FEATURE_RETRY_ATTEMPTS 3
  19
  20 int dns_server_new(
  21                 Manager *m,
  22                 DnsServer **ret,
  23                 DnsServerType type,
  24                 Link *l,
  25                 int family,
  26                 const union in_addr_union *in_addr,
  27                 int ifindex) {
  28
  29         DnsServer *s;
  30
  31         assert(m);
  32         assert((type == DNS_SERVER_LINK) == !!l);
  33         assert(in_addr);
  34
  35         if (!IN_SET(family, AF_INET, AF_INET6))
  36                 return -EAFNOSUPPORT;
  37
  38         if (l) {
  39                 if (l->n_dns_servers >= LINK_DNS_SERVERS_MAX)
  40                         return -E2BIG;
  41         } else {
  42                 if (m->n_dns_servers >= MANAGER_DNS_SERVERS_MAX)
  43                         return -E2BIG;
  44         }
  45
  46         s = new(DnsServer, 1);
  47         if (!s)
  48                 return -ENOMEM;
  49
  50         *s = (DnsServer) {
  51                 .n_ref = 1,
  52                 .manager = m,
  53                 .type = type,
  54                 .family = family,
  55                 .address = *in_addr,
  56                 .ifindex = ifindex,
  57         };
  58
  59         dns_server_reset_features(s);
  60
  61         switch (type) {
  62
  63         case DNS_SERVER_LINK:
  64                 s->link = l;
  65                 LIST_APPEND(servers, l->dns_servers, s);
  66                 l->n_dns_servers++;
  67                 break;
  68
  69         case DNS_SERVER_SYSTEM:
  70                 LIST_APPEND(servers, m->dns_servers, s);
  71                 m->n_dns_servers++;
  72                 break;
  73
  74         case DNS_SERVER_FALLBACK:
  75                 LIST_APPEND(servers, m->fallback_dns_servers, s);
  76                 m->n_dns_servers++;
  77                 break;
  78
  79         default:
  80                 assert_not_reached("Unknown server type");
  81         }
  82
  83         s->linked = true;
  84
  85 #if ENABLE_DNS_OVER_TLS
  86         dnstls_server_init(s);
  87 #endif
  88
  89         /* A new DNS server that isn't fallback is added and the one
  90          * we used so far was a fallback one? Then let's try to pick
  91          * the new one */
  92         if (type != DNS_SERVER_FALLBACK &&
  93             m->current_dns_server &&
  94             m->current_dns_server->type == DNS_SERVER_FALLBACK)
  95                 manager_set_dns_server(m, NULL);
  96
  97         if (ret)
  98                 *ret = s;
  99
 100         return 0;
 101 }
 102
 103 static DnsServer* dns_server_free(DnsServer *s)  {
 104         assert(s);
 105
 106         dns_server_unref_stream(s);
 107
 108 #if ENABLE_DNS_OVER_TLS
 109         dnstls_server_free(s);
 110 #endif
 111
 112         free(s->server_string);
 113         return mfree(s);
 114 }
 115
 116 DEFINE_TRIVIAL_REF_UNREF_FUNC(DnsServer, dns_server, dns_server_free);
 117
 118 void dns_server_unlink(DnsServer *s) {
 119         assert(s);
 120         assert(s->manager);
 121
 122         /* This removes the specified server from the linked list of
 123          * servers, but any server might still stay around if it has
 124          * refs, for example from an ongoing transaction. */
 125
 126         if (!s->linked)
 127                 return;
 128
 129         switch (s->type) {
 130
 131         case DNS_SERVER_LINK:
 132                 assert(s->link);
 133                 assert(s->link->n_dns_servers > 0);
 134                 LIST_REMOVE(servers, s->link->dns_servers, s);
 135                 s->link->n_dns_servers--;
 136                 break;
 137
 138         case DNS_SERVER_SYSTEM:
 139                 assert(s->manager->n_dns_servers > 0);
 140                 LIST_REMOVE(servers, s->manager->dns_servers, s);
 141                 s->manager->n_dns_servers--;
 142                 break;
 143
 144         case DNS_SERVER_FALLBACK:
 145                 assert(s->manager->n_dns_servers > 0);
 146                 LIST_REMOVE(servers, s->manager->fallback_dns_servers, s);
 147                 s->manager->n_dns_servers--;
 148                 break;
 149         default:
 150                 assert_not_reached("Unknown server type");
 151         }
 152
 153         s->linked = false;
 154
 155         if (s->link && s->link->current_dns_server == s)
 156                 link_set_dns_server(s->link, NULL);
 157
 158         if (s->manager->current_dns_server == s)
 159                 manager_set_dns_server(s->manager, NULL);
 160
 161         /* No need to keep a default stream around anymore */
 162         dns_server_unref_stream(s);
 163
 164         dns_server_unref(s);
 165 }
 166
 167 void dns_server_move_back_and_unmark(DnsServer *s) {
 168         DnsServer *tail;
 169
 170         assert(s);
 171
 172         if (!s->marked)
 173                 return;
 174
 175         s->marked = false;
 176
 177         if (!s->linked || !s->servers_next)
 178                 return;
 179
 180         /* Move us to the end of the list, so that the order is
 181          * strictly kept, if we are not at the end anyway. */
 182
 183         switch (s->type) {
 184
 185         case DNS_SERVER_LINK:
 186                 assert(s->link);
 187                 LIST_FIND_TAIL(servers, s, tail);
 188                 LIST_REMOVE(servers, s->link->dns_servers, s);
 189                 LIST_INSERT_AFTER(servers, s->link->dns_servers, tail, s);
 190                 break;
 191
 192         case DNS_SERVER_SYSTEM:
 193                 LIST_FIND_TAIL(servers, s, tail);
 194                 LIST_REMOVE(servers, s->manager->dns_servers, s);
 195                 LIST_INSERT_AFTER(servers, s->manager->dns_servers, tail, s);
 196                 break;
 197
 198         case DNS_SERVER_FALLBACK:
 199                 LIST_FIND_TAIL(servers, s, tail);
 200                 LIST_REMOVE(servers, s->manager->fallback_dns_servers, s);
 201                 LIST_INSERT_AFTER(servers, s->manager->fallback_dns_servers, tail, s);
 202                 break;
 203
 204         default:
 205                 assert_not_reached("Unknown server type");
 206         }
 207 }
 208
 209 static void dns_server_verified(DnsServer *s, DnsServerFeatureLevel level) {
 210         assert(s);
 211
 212         if (s->verified_feature_level > level)
 213                 return;
 214
 215         if (s->verified_feature_level != level) {
 216                 log_debug("Verified we get a response at feature level %s from DNS server %s.",
 217                           dns_server_feature_level_to_string(level),
 218                           dns_server_string(s));
 219                 s->verified_feature_level = level;
 220         }
 221
 222         assert_se(sd_event_now(s->manager->event, clock_boottime_or_monotonic(), &s->verified_usec) >= 0);
 223 }
 224
 225 static void dns_server_reset_counters(DnsServer *s) {
 226         assert(s);
 227
 228         s->n_failed_udp = 0;
 229         s->n_failed_tcp = 0;
 230         s->n_failed_tls = 0;
 231         s->packet_truncated = false;
 232         s->verified_usec = 0;
 233
 234         /* Note that we do not reset s->packet_bad_opt and s->packet_rrsig_missing here. We reset them only when the
 235          * grace period ends, but not when lowering the possible feature level, as a lower level feature level should
 236          * not make RRSIGs appear or OPT appear, but rather make them disappear. If the reappear anyway, then that's
 237          * indication for a differently broken OPT/RRSIG implementation, and we really don't want to support that
 238          * either.
 239          *
 240          * This is particularly important to deal with certain Belkin routers which break OPT for certain lookups (A),
 241          * but pass traffic through for others (AAAA). If we detect the broken behaviour on one lookup we should not
 242          * reenable it for another, because we cannot validate things anyway, given that the RRSIG/OPT data will be
 243          * incomplete. */
 244 }
 245
 246 void dns_server_packet_received(DnsServer *s, int protocol, DnsServerFeatureLevel level, size_t size) {
 247         assert(s);
 248
 249         if (protocol == IPPROTO_UDP) {
 250                 if (s->possible_feature_level == level)
 251                         s->n_failed_udp = 0;
 252         } else if (protocol == IPPROTO_TCP) {
 253                 if (DNS_SERVER_FEATURE_LEVEL_IS_TLS(level)) {
 254                         if (s->possible_feature_level == level)
 255                                 s->n_failed_tls = 0;
 256                 } else {
 257                         if (s->possible_feature_level == level)
 258                                 s->n_failed_tcp = 0;
 259
 260                         /* Successful TCP connections are only useful to verify the TCP feature level. */
 261                         level = DNS_SERVER_FEATURE_LEVEL_TCP;
 262                 }
 263         }
 264
 265         /* If the RRSIG data is missing, then we can only validate EDNS0 at max */
 266         if (s->packet_rrsig_missing && level >= DNS_SERVER_FEATURE_LEVEL_DO)
 267                 level = DNS_SERVER_FEATURE_LEVEL_IS_TLS(level) ? DNS_SERVER_FEATURE_LEVEL_TLS_PLAIN : DNS_SERVER_FEATURE_LEVEL_EDNS0;
 268
 269         /* If the OPT RR got lost, then we can only validate UDP at max */
 270         if (s->packet_bad_opt && level >= DNS_SERVER_FEATURE_LEVEL_EDNS0)
 271                 level = DNS_SERVER_FEATURE_LEVEL_EDNS0 - 1;
 272
 273         /* Even if we successfully receive a reply to a request announcing support for large packets,
 274                 that does not mean we can necessarily receive large packets. */
 275         if (level == DNS_SERVER_FEATURE_LEVEL_LARGE)
 276                 level = DNS_SERVER_FEATURE_LEVEL_LARGE - 1;
 277
 278         dns_server_verified(s, level);
 279
 280         /* Remember the size of the largest UDP packet we received from a server,
 281            we know that we can always announce support for packets with at least
 282            this size. */
 283         if (protocol == IPPROTO_UDP && s->received_udp_packet_max < size)
 284                 s->received_udp_packet_max = size;
 285 }
 286
 287 void dns_server_packet_lost(DnsServer *s, int protocol, DnsServerFeatureLevel level) {
 288         assert(s);
 289         assert(s->manager);
 290
 291         if (s->possible_feature_level == level) {
 292                 if (protocol == IPPROTO_UDP)
 293                         s->n_failed_udp++;
 294                 else if (protocol == IPPROTO_TCP) {
 295                         if (DNS_SERVER_FEATURE_LEVEL_IS_TLS(level))
 296                                 s->n_failed_tls++;
 297                         else
 298                                 s->n_failed_tcp++;
 299                 }
 300         }
 301 }
 302
 303 void dns_server_packet_truncated(DnsServer *s, DnsServerFeatureLevel level) {
 304         assert(s);
 305
 306         /* Invoked whenever we get a packet with TC bit set. */
 307
 308         if (s->possible_feature_level != level)
 309                 return;
 310
 311         s->packet_truncated = true;
 312 }
 313
 314 void dns_server_packet_rrsig_missing(DnsServer *s, DnsServerFeatureLevel level) {
 315         assert(s);
 316
 317         if (level < DNS_SERVER_FEATURE_LEVEL_DO)
 318                 return;
 319
 320         /* If the RRSIG RRs are missing, we have to downgrade what we previously verified */
 321         if (s->verified_feature_level >= DNS_SERVER_FEATURE_LEVEL_DO)
 322                 s->verified_feature_level = DNS_SERVER_FEATURE_LEVEL_IS_TLS(level) ? DNS_SERVER_FEATURE_LEVEL_TLS_PLAIN : DNS_SERVER_FEATURE_LEVEL_EDNS0;
 323
 324         s->packet_rrsig_missing = true;
 325 }
 326
 327 void dns_server_packet_bad_opt(DnsServer *s, DnsServerFeatureLevel level) {
 328         assert(s);
 329
 330         if (level < DNS_SERVER_FEATURE_LEVEL_EDNS0)
 331                 return;
 332
 333         /* If the OPT RR got lost, we have to downgrade what we previously verified */
 334         if (s->verified_feature_level >= DNS_SERVER_FEATURE_LEVEL_EDNS0)
 335                 s->verified_feature_level = DNS_SERVER_FEATURE_LEVEL_EDNS0-1;
 336
 337         s->packet_bad_opt = true;
 338 }
 339
 340 void dns_server_packet_rcode_downgrade(DnsServer *s, DnsServerFeatureLevel level) {
 341         assert(s);
 342
 343         /* Invoked whenever we got a FORMERR, SERVFAIL or NOTIMP rcode from a server and downgrading the feature level
 344          * for the transaction made it go away. In this case we immediately downgrade to the feature level that made
 345          * things work. */
 346
 347         if (s->verified_feature_level > level)
 348                 s->verified_feature_level = level;
 349
 350         if (s->possible_feature_level > level) {
 351                 s->possible_feature_level = level;
 352                 dns_server_reset_counters(s);
 353         }
 354
 355         log_debug("Downgrading transaction feature level fixed an RCODE error, downgrading server %s too.", dns_server_string(s));
 356 }
 357
 358 static bool dns_server_grace_period_expired(DnsServer *s) {
 359         usec_t ts;
 360
 361         assert(s);
 362         assert(s->manager);
 363
 364         if (s->verified_usec == 0)
 365                 return false;
 366
 367         assert_se(sd_event_now(s->manager->event, clock_boottime_or_monotonic(), &ts) >= 0);
 368
 369         if (s->verified_usec + s->features_grace_period_usec > ts)
 370                 return false;
 371
 372         s->features_grace_period_usec = MIN(s->features_grace_period_usec * 2, DNS_SERVER_FEATURE_GRACE_PERIOD_MAX_USEC);
 373
 374         return true;
 375 }
 376
 377 DnsServerFeatureLevel dns_server_possible_feature_level(DnsServer *s) {
 378         DnsServerFeatureLevel best;
 379
 380         assert(s);
 381
 382         /* Determine the best feature level we care about. If DNSSEC mode is off there's no point in using anything
 383          * better than EDNS0, hence don't even try. */
 384         if (dns_server_get_dnssec_mode(s) != DNSSEC_NO)
 385                 best = dns_server_get_dns_over_tls_mode(s) == DNS_OVER_TLS_NO ?
 386                         DNS_SERVER_FEATURE_LEVEL_LARGE :
 387                         DNS_SERVER_FEATURE_LEVEL_TLS_DO;
 388         else
 389                 best = dns_server_get_dns_over_tls_mode(s) == DNS_OVER_TLS_NO ?
 390                         DNS_SERVER_FEATURE_LEVEL_EDNS0 :
 391                         DNS_SERVER_FEATURE_LEVEL_TLS_PLAIN;
 392
 393         /* Clamp the feature level the highest level we care about. The DNSSEC mode might have changed since the last
 394          * time, hence let's downgrade if we are still at a higher level. */
 395         if (s->possible_feature_level > best)
 396                 s->possible_feature_level = best;
 397
 398         if (s->possible_feature_level < best && dns_server_grace_period_expired(s)) {
 399
 400                 s->possible_feature_level = best;
 401
 402                 dns_server_reset_counters(s);
 403
 404                 s->packet_bad_opt = false;
 405                 s->packet_rrsig_missing = false;
 406
 407                 log_info("Grace period over, resuming full feature set (%s) for DNS server %s.",
 408                          dns_server_feature_level_to_string(s->possible_feature_level),
 409                          dns_server_string(s));
 410
 411                 dns_server_flush_cache(s);
 412
 413         } else if (s->possible_feature_level <= s->verified_feature_level)
 414                 s->possible_feature_level = s->verified_feature_level;
 415         else {
 416                 DnsServerFeatureLevel p = s->possible_feature_level;
 417
 418                 if (s->n_failed_tcp >= DNS_SERVER_FEATURE_RETRY_ATTEMPTS &&
 419                     s->possible_feature_level == DNS_SERVER_FEATURE_LEVEL_TCP) {
 420
 421                         /* We are at the TCP (lowest) level, and we tried a couple of TCP connections, and it didn't
 422                          * work. Upgrade back to UDP again. */
 423                         log_debug("Reached maximum number of failed TCP connection attempts, trying UDP again...");
 424                         s->possible_feature_level = DNS_SERVER_FEATURE_LEVEL_UDP;
 425                 } else if (s->n_failed_tls > 0 &&
 426                            DNS_SERVER_FEATURE_LEVEL_IS_TLS(s->possible_feature_level)) {
 427
 428                         /* We tried to connect using DNS-over-TLS, and it didn't work. Downgrade to plaintext UDP
 429                          * if we don't require DNS-over-TLS */
 430
 431                         log_debug("Server doesn't support DNS-over-TLS, downgrading protocol...");
 432                         s->possible_feature_level--;
 433                 } else if (s->packet_bad_opt &&
 434                            s->possible_feature_level >= DNS_SERVER_FEATURE_LEVEL_EDNS0) {
 435
 436                         /* A reply to one of our EDNS0 queries didn't carry a valid OPT RR, then downgrade to below
 437                          * EDNS0 levels. After all, some records generate different responses with and without OPT RR
 438                          * in the request. Example:
 439                          * https://open.nlnetlabs.nl/pipermail/dnssec-trigger/2014-November/000376.html */
 440
 441                         log_debug("Server doesn't support EDNS(0) properly, downgrading feature level...");
 442                         s->possible_feature_level = DNS_SERVER_FEATURE_LEVEL_UDP;
 443
 444                 } else if (s->packet_rrsig_missing &&
 445                            s->possible_feature_level >= DNS_SERVER_FEATURE_LEVEL_DO) {
 446
 447                         /* RRSIG data was missing on a EDNS0 packet with DO bit set. This means the server doesn't
 448                          * augment responses with DNSSEC RRs. If so, let's better not ask the server for it anymore,
 449                          * after all some servers generate different replies depending if an OPT RR is in the query or
 450                          * not. */
 451
 452                         log_debug("Detected server responses lack RRSIG records, downgrading feature level...");
 453                         s->possible_feature_level = DNS_SERVER_FEATURE_LEVEL_IS_TLS(s->possible_feature_level) ? DNS_SERVER_FEATURE_LEVEL_TLS_PLAIN : DNS_SERVER_FEATURE_LEVEL_EDNS0;
 454
 455                 } else if (s->n_failed_udp >= DNS_SERVER_FEATURE_RETRY_ATTEMPTS &&
 456                            s->possible_feature_level >= (dns_server_get_dnssec_mode(s) == DNSSEC_YES ? DNS_SERVER_FEATURE_LEVEL_LARGE : DNS_SERVER_FEATURE_LEVEL_UDP)) {
 457
 458                         /* We lost too many UDP packets in a row, and are on a feature level of UDP or higher. If the
 459                          * packets are lost, maybe the server cannot parse them, hence downgrading sounds like a good
 460                          * idea. We might downgrade all the way down to TCP this way.
 461                          *
 462                          * If strict DNSSEC mode is used we won't downgrade below DO level however, as packet loss
 463                          * might have many reasons, a broken DNSSEC implementation being only one reason. And if the
 464                          * user is strict on DNSSEC, then let's assume that DNSSEC is not the fault here. */
 465
 466                         log_debug("Lost too many UDP packets, downgrading feature level...");
 467                         s->possible_feature_level--;
 468
 469                 } else if (s->n_failed_tcp >= DNS_SERVER_FEATURE_RETRY_ATTEMPTS &&
 470                            s->packet_truncated &&
 471                            s->possible_feature_level > (dns_server_get_dnssec_mode(s) == DNSSEC_YES ? DNS_SERVER_FEATURE_LEVEL_LARGE : DNS_SERVER_FEATURE_LEVEL_UDP)) {
 472
 473                          /* We got too many TCP connection failures in a row, we had at least one truncated packet, and
 474                           * are on a feature level above UDP. By downgrading things and getting rid of DNSSEC or EDNS0
 475                           * data we hope to make the packet smaller, so that it still works via UDP given that TCP
 476                           * appears not to be a fallback. Note that if we are already at the lowest UDP level, we don't
 477                           * go further down, since that's TCP, and TCP failed too often after all. */
 478
 479                         log_debug("Got too many failed TCP connection failures and truncated UDP packets, downgrading feature level...");
 480                         s->possible_feature_level--;
 481                 }
 482
 483                 if (p != s->possible_feature_level) {
 484
 485                         /* We changed the feature level, reset the counting */
 486                         dns_server_reset_counters(s);
 487
 488                         log_warning("Using degraded feature set (%s) for DNS server %s.",
 489                                     dns_server_feature_level_to_string(s->possible_feature_level),
 490                                     dns_server_string(s));
 491                 }
 492         }
 493
 494         return s->possible_feature_level;
 495 }
 496
 497 int dns_server_adjust_opt(DnsServer *server, DnsPacket *packet, DnsServerFeatureLevel level) {
 498         size_t packet_size;
 499         bool edns_do;
 500         int r;
 501
 502         assert(server);
 503         assert(packet);
 504         assert(packet->protocol == DNS_PROTOCOL_DNS);
 505
 506         /* Fix the OPT field in the packet to match our current feature level. */
 507
 508         r = dns_packet_truncate_opt(packet);
 509         if (r < 0)
 510                 return r;
 511
 512         if (level < DNS_SERVER_FEATURE_LEVEL_EDNS0)
 513                 return 0;
 514
 515         edns_do = level >= DNS_SERVER_FEATURE_LEVEL_DO;
 516
 517         if (level >= DNS_SERVER_FEATURE_LEVEL_LARGE)
 518                 packet_size = DNS_PACKET_UNICAST_SIZE_LARGE_MAX;
 519         else
 520                 packet_size = server->received_udp_packet_max;
 521
 522         return dns_packet_append_opt(packet, packet_size, edns_do, 0, NULL);
 523 }
 524
 525 int dns_server_ifindex(const DnsServer *s) {
 526         assert(s);
 527
 528         /* The link ifindex always takes precedence */
 529         if (s->link)
 530                 return s->link->ifindex;
 531
 532         if (s->ifindex > 0)
 533                 return s->ifindex;
 534
 535         return 0;
 536 }
 537
 538 const char *dns_server_string(DnsServer *server) {
 539         assert(server);
 540
 541         if (!server->server_string)
 542                 (void) in_addr_ifindex_to_string(server->family, &server->address, dns_server_ifindex(server), &server->server_string);
 543
 544         return strna(server->server_string);
 545 }
 546
 547 bool dns_server_dnssec_supported(DnsServer *server) {
 548         assert(server);
 549
 550         /* Returns whether the server supports DNSSEC according to what we know about it */
 551
 552         if (server->possible_feature_level < DNS_SERVER_FEATURE_LEVEL_DO)
 553                 return false;
 554
 555         if (server->packet_bad_opt)
 556                 return false;
 557
 558         if (server->packet_rrsig_missing)
 559                 return false;
 560
 561         /* DNSSEC servers need to support TCP properly (see RFC5966), if they don't, we assume DNSSEC is borked too */
 562         if (server->n_failed_tcp >= DNS_SERVER_FEATURE_RETRY_ATTEMPTS)
 563                 return false;
 564
 565         return true;
 566 }
 567
 568 void dns_server_warn_downgrade(DnsServer *server) {
 569         assert(server);
 570
 571         if (server->warned_downgrade)
 572                 return;
 573
 574         log_struct(LOG_NOTICE,
 575                    "MESSAGE_ID=" SD_MESSAGE_DNSSEC_DOWNGRADE_STR,
 576                    LOG_MESSAGE("Server %s does not support DNSSEC, downgrading to non-DNSSEC mode.", dns_server_string(server)),
 577                    "DNS_SERVER=%s", dns_server_string(server),
 578                    "DNS_SERVER_FEATURE_LEVEL=%s", dns_server_feature_level_to_string(server->possible_feature_level));
 579
 580         server->warned_downgrade = true;
 581 }
 582
 583 static void dns_server_hash_func(const DnsServer *s, struct siphash *state) {
 584         assert(s);
 585
 586         siphash24_compress(&s->family, sizeof(s->family), state);
 587         siphash24_compress(&s->address, FAMILY_ADDRESS_SIZE(s->family), state);
 588         siphash24_compress(&s->ifindex, sizeof(s->ifindex), state);
 589 }
 590
 591 static int dns_server_compare_func(const DnsServer *x, const DnsServer *y) {
 592         int r;
 593
 594         r = CMP(x->family, y->family);
 595         if (r != 0)
 596                 return r;
 597
 598         r = memcmp(&x->address, &y->address, FAMILY_ADDRESS_SIZE(x->family));
 599         if (r != 0)
 600                 return r;
 601
 602         r = CMP(x->ifindex, y->ifindex);
 603         if (r != 0)
 604                 return r;
 605
 606         return 0;
 607 }
 608
 609 DEFINE_HASH_OPS(dns_server_hash_ops, DnsServer, dns_server_hash_func, dns_server_compare_func);
 610
 611 void dns_server_unlink_all(DnsServer *first) {
 612         DnsServer *next;
 613
 614         if (!first)
 615                 return;
 616
 617         next = first->servers_next;
 618         dns_server_unlink(first);
 619
 620         dns_server_unlink_all(next);
 621 }
 622
 623 void dns_server_unlink_marked(DnsServer *first) {
 624         DnsServer *next;
 625
 626         if (!first)
 627                 return;
 628
 629         next = first->servers_next;
 630
 631         if (first->marked)
 632                 dns_server_unlink(first);
 633
 634         dns_server_unlink_marked(next);
 635 }
 636
 637 void dns_server_mark_all(DnsServer *first) {
 638         if (!first)
 639                 return;
 640
 641         first->marked = true;
 642         dns_server_mark_all(first->servers_next);
 643 }
 644
 645 DnsServer *dns_server_find(DnsServer *first, int family, const union in_addr_union *in_addr, int ifindex) {
 646         DnsServer *s;
 647
 648         LIST_FOREACH(servers, s, first)
 649                 if (s->family == family && in_addr_equal(family, &s->address, in_addr) > 0 && s->ifindex == ifindex)
 650                         return s;
 651
 652         return NULL;
 653 }
 654
 655 DnsServer *manager_get_first_dns_server(Manager *m, DnsServerType t) {
 656         assert(m);
 657
 658         switch (t) {
 659
 660         case DNS_SERVER_SYSTEM:
 661                 return m->dns_servers;
 662
 663         case DNS_SERVER_FALLBACK:
 664                 return m->fallback_dns_servers;
 665
 666         default:
 667                 return NULL;
 668         }
 669 }
 670
 671 DnsServer *manager_set_dns_server(Manager *m, DnsServer *s) {
 672         assert(m);
 673
 674         if (m->current_dns_server == s)
 675                 return s;
 676
 677         if (s)
 678                 log_debug("Switching to %s DNS server %s.",
 679                           dns_server_type_to_string(s->type),
 680                           dns_server_string(s));
 681
 682         dns_server_unref(m->current_dns_server);
 683         m->current_dns_server = dns_server_ref(s);
 684
 685         if (m->unicast_scope)
 686                 dns_cache_flush(&m->unicast_scope->cache);
 687
 688         return s;
 689 }
 690
 691 DnsServer *manager_get_dns_server(Manager *m) {
 692         Link *l;
 693         assert(m);
 694
 695         /* Try to read updates resolv.conf */
 696         manager_read_resolv_conf(m);
 697
 698         /* If no DNS server was chosen so far, pick the first one */
 699         if (!m->current_dns_server)
 700                 manager_set_dns_server(m, m->dns_servers);
 701
 702         if (!m->current_dns_server) {
 703                 bool found = false;
 704                 Iterator i;
 705
 706                 /* No DNS servers configured, let's see if there are
 707                  * any on any links. If not, we use the fallback
 708                  * servers */
 709
 710                 HASHMAP_FOREACH(l, m->links, i)
 711                         if (l->dns_servers) {
 712                                 found = true;
 713                                 break;
 714                         }
 715
 716                 if (!found)
 717                         manager_set_dns_server(m, m->fallback_dns_servers);
 718         }
 719
 720         return m->current_dns_server;
 721 }
 722
 723 void manager_next_dns_server(Manager *m) {
 724         assert(m);
 725
 726         /* If there's currently no DNS server set, then the next
 727          * manager_get_dns_server() will find one */
 728         if (!m->current_dns_server)
 729                 return;
 730
 731         /* Change to the next one, but make sure to follow the linked
 732          * list only if the server is still linked. */
 733         if (m->current_dns_server->linked && m->current_dns_server->servers_next) {
 734                 manager_set_dns_server(m, m->current_dns_server->servers_next);
 735                 return;
 736         }
 737
 738         /* If there was no next one, then start from the beginning of
 739          * the list */
 740         if (m->current_dns_server->type == DNS_SERVER_FALLBACK)
 741                 manager_set_dns_server(m, m->fallback_dns_servers);
 742         else
 743                 manager_set_dns_server(m, m->dns_servers);
 744 }
 745
 746 bool dns_server_address_valid(int family, const union in_addr_union *sa) {
 747
 748         /* Refuses the 0 IP addresses as well as 127.0.0.53 (which is our own DNS stub) */
 749
 750         if (in_addr_is_null(family, sa))
 751                 return false;
 752
 753         if (family == AF_INET && sa->in.s_addr == htobe32(INADDR_DNS_STUB))
 754                 return false;
 755
 756         return true;
 757 }
 758
 759 DnssecMode dns_server_get_dnssec_mode(DnsServer *s) {
 760         assert(s);
 761
 762         if (s->link)
 763                 return link_get_dnssec_mode(s->link);
 764
 765         return manager_get_dnssec_mode(s->manager);
 766 }
 767
 768 DnsOverTlsMode dns_server_get_dns_over_tls_mode(DnsServer *s) {
 769         assert(s);
 770
 771         if (s->link)
 772                 return link_get_dns_over_tls_mode(s->link);
 773
 774         return manager_get_dns_over_tls_mode(s->manager);
 775 }
 776
 777 void dns_server_flush_cache(DnsServer *s) {
 778         DnsServer *current;
 779         DnsScope *scope;
 780
 781         assert(s);
 782
 783         /* Flush the cache of the scope this server belongs to */
 784
 785         current = s->link ? s->link->current_dns_server : s->manager->current_dns_server;
 786         if (current != s)
 787                 return;
 788
 789         scope = s->link ? s->link->unicast_scope : s->manager->unicast_scope;
 790         if (!scope)
 791                 return;
 792
 793         dns_cache_flush(&scope->cache);
 794 }
 795
 796 void dns_server_reset_features(DnsServer *s) {
 797         assert(s);
 798
 799         s->verified_feature_level = _DNS_SERVER_FEATURE_LEVEL_INVALID;
 800         s->possible_feature_level = DNS_SERVER_FEATURE_LEVEL_BEST;
 801
 802         s->received_udp_packet_max = DNS_PACKET_UNICAST_SIZE_MAX;
 803
 804         s->packet_bad_opt = false;
 805         s->packet_rrsig_missing = false;
 806
 807         s->features_grace_period_usec = DNS_SERVER_FEATURE_GRACE_PERIOD_MIN_USEC;
 808
 809         s->warned_downgrade = false;
 810
 811         dns_server_reset_counters(s);
 812
 813         /* Let's close the default stream, so that we reprobe with the new features */
 814         dns_server_unref_stream(s);
 815 }
 816
 817 void dns_server_reset_features_all(DnsServer *s) {
 818         DnsServer *i;
 819
 820         LIST_FOREACH(servers, i, s)
 821                 dns_server_reset_features(i);
 822 }
 823
 824 void dns_server_dump(DnsServer *s, FILE *f) {
 825         assert(s);
 826
 827         if (!f)
 828                 f = stdout;
 829
 830         fputs("[Server ", f);
 831         fputs(dns_server_string(s), f);
 832         fputs(" type=", f);
 833         fputs(dns_server_type_to_string(s->type), f);
 834
 835         if (s->type == DNS_SERVER_LINK) {
 836                 assert(s->link);
 837
 838                 fputs(" interface=", f);
 839                 fputs(s->link->ifname, f);
 840         }
 841
 842         fputs("]\n", f);
 843
 844         fputs("\tVerified feature level: ", f);
 845         fputs(strna(dns_server_feature_level_to_string(s->verified_feature_level)), f);
 846         fputc('\n', f);
 847
 848         fputs("\tPossible feature level: ", f);
 849         fputs(strna(dns_server_feature_level_to_string(s->possible_feature_level)), f);
 850         fputc('\n', f);
 851
 852         fputs("\tDNSSEC Mode: ", f);
 853         fputs(strna(dnssec_mode_to_string(dns_server_get_dnssec_mode(s))), f);
 854         fputc('\n', f);
 855
 856         fputs("\tCan do DNSSEC: ", f);
 857         fputs(yes_no(dns_server_dnssec_supported(s)), f);
 858         fputc('\n', f);
 859
 860         fprintf(f,
 861                 "\tMaximum UDP packet size received: %zu\n"
 862                 "\tFailed UDP attempts: %u\n"
 863                 "\tFailed TCP attempts: %u\n"
 864                 "\tSeen truncated packet: %s\n"
 865                 "\tSeen OPT RR getting lost: %s\n"
 866                 "\tSeen RRSIG RR missing: %s\n",
 867                 s->received_udp_packet_max,
 868                 s->n_failed_udp,
 869                 s->n_failed_tcp,
 870                 yes_no(s->packet_truncated),
 871                 yes_no(s->packet_bad_opt),
 872                 yes_no(s->packet_rrsig_missing));
 873 }
 874
 875 void dns_server_unref_stream(DnsServer *s) {
 876         DnsStream *ref;
 877
 878         assert(s);
 879
 880         /* Detaches the default stream of this server. Some special care needs to be taken here, as that stream and
 881          * this server reference each other. First, take the stream out of the server. It's destructor will check if it
 882          * is registered with us, hence let's invalidate this separatly, so that it is already unregistered. */
 883         ref = TAKE_PTR(s->stream);
 884
 885         /* And then, unref it */
 886         dns_stream_unref(ref);
 887 }
 888
 889 DnsScope *dns_server_scope(DnsServer *s) {
 890         assert(s);
 891         assert((s->type == DNS_SERVER_LINK) == !!s->link);
 892
 893         if (s->link)
 894                 return s->link->unicast_scope;
 895
 896         return s->manager->unicast_scope;
 897 }
 898
 899 static const char* const dns_server_type_table[_DNS_SERVER_TYPE_MAX] = {
 900         [DNS_SERVER_SYSTEM] = "system",
 901         [DNS_SERVER_FALLBACK] = "fallback",
 902         [DNS_SERVER_LINK] = "link",
 903 };
 904 DEFINE_STRING_TABLE_LOOKUP(dns_server_type, DnsServerType);
 905
 906 static const char* const dns_server_feature_level_table[_DNS_SERVER_FEATURE_LEVEL_MAX] = {
 907         [DNS_SERVER_FEATURE_LEVEL_TCP] = "TCP",
 908         [DNS_SERVER_FEATURE_LEVEL_UDP] = "UDP",
 909         [DNS_SERVER_FEATURE_LEVEL_EDNS0] = "UDP+EDNS0",
 910         [DNS_SERVER_FEATURE_LEVEL_TLS_PLAIN] = "TLS+EDNS0",
 911         [DNS_SERVER_FEATURE_LEVEL_DO] = "UDP+EDNS0+DO",
 912         [DNS_SERVER_FEATURE_LEVEL_LARGE] = "UDP+EDNS0+DO+LARGE",
 913         [DNS_SERVER_FEATURE_LEVEL_TLS_DO] = "TLS+EDNS0+D0",
 914 };
 915 DEFINE_STRING_TABLE_LOOKUP(dns_server_feature_level, DnsServerFeatureLevel);