src/resolve/resolved-dns-server.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2
   3 #include "sd-messages.h"
   4
   5 #include "alloc-util.h"
   6 #include "resolved-dns-server.h"
   7 #include "resolved-dns-stub.h"
   8 #include "resolved-resolv-conf.h"
   9 #include "siphash24.h"
  10 #include "string-table.h"
  11 #include "string-util.h"
  12
  13 /* The amount of time to wait before retrying with a full feature set */
  14 #define DNS_SERVER_FEATURE_GRACE_PERIOD_MAX_USEC (6 * USEC_PER_HOUR)
  15 #define DNS_SERVER_FEATURE_GRACE_PERIOD_MIN_USEC (5 * USEC_PER_MINUTE)
  16
  17 /* The number of times we will attempt a certain feature set before degrading */
  18 #define DNS_SERVER_FEATURE_RETRY_ATTEMPTS 3
  19
  20 int dns_server_new(
  21                 Manager *m,
  22                 DnsServer **ret,
  23                 DnsServerType type,
  24                 Link *l,
  25                 int family,
  26                 const union in_addr_union *in_addr,
  27                 int ifindex) {
  28
  29         DnsServer *s;
  30
  31         assert(m);
  32         assert((type == DNS_SERVER_LINK) == !!l);
  33         assert(in_addr);
  34
  35         if (!IN_SET(family, AF_INET, AF_INET6))
  36                 return -EAFNOSUPPORT;
  37
  38         if (l) {
  39                 if (l->n_dns_servers >= LINK_DNS_SERVERS_MAX)
  40                         return -E2BIG;
  41         } else {
  42                 if (m->n_dns_servers >= MANAGER_DNS_SERVERS_MAX)
  43                         return -E2BIG;
  44         }
  45
  46         s = new0(DnsServer, 1);
  47         if (!s)
  48                 return -ENOMEM;
  49
  50         s->n_ref = 1;
  51         s->manager = m;
  52         s->type = type;
  53         s->family = family;
  54         s->address = *in_addr;
  55         s->ifindex = ifindex;
  56
  57         dns_server_reset_features(s);
  58
  59         switch (type) {
  60
  61         case DNS_SERVER_LINK:
  62                 s->link = l;
  63                 LIST_APPEND(servers, l->dns_servers, s);
  64                 l->n_dns_servers++;
  65                 break;
  66
  67         case DNS_SERVER_SYSTEM:
  68                 LIST_APPEND(servers, m->dns_servers, s);
  69                 m->n_dns_servers++;
  70                 break;
  71
  72         case DNS_SERVER_FALLBACK:
  73                 LIST_APPEND(servers, m->fallback_dns_servers, s);
  74                 m->n_dns_servers++;
  75                 break;
  76
  77         default:
  78                 assert_not_reached("Unknown server type");
  79         }
  80
  81         s->linked = true;
  82
  83 #if ENABLE_DNS_OVER_TLS
  84         dnstls_server_init(s);
  85 #endif
  86
  87         /* A new DNS server that isn't fallback is added and the one
  88          * we used so far was a fallback one? Then let's try to pick
  89          * the new one */
  90         if (type != DNS_SERVER_FALLBACK &&
  91             m->current_dns_server &&
  92             m->current_dns_server->type == DNS_SERVER_FALLBACK)
  93                 manager_set_dns_server(m, NULL);
  94
  95         if (ret)
  96                 *ret = s;
  97
  98         return 0;
  99 }
 100
 101 static DnsServer* dns_server_free(DnsServer *s)  {
 102         assert(s);
 103
 104         dns_stream_unref(s->stream);
 105
 106 #if ENABLE_DNS_OVER_TLS
 107         dnstls_server_free(s);
 108 #endif
 109
 110         free(s->server_string);
 111         return mfree(s);
 112 }
 113
 114 DEFINE_TRIVIAL_REF_UNREF_FUNC(DnsServer, dns_server, dns_server_free);
 115
 116 void dns_server_unlink(DnsServer *s) {
 117         assert(s);
 118         assert(s->manager);
 119
 120         /* This removes the specified server from the linked list of
 121          * servers, but any server might still stay around if it has
 122          * refs, for example from an ongoing transaction. */
 123
 124         if (!s->linked)
 125                 return;
 126
 127         switch (s->type) {
 128
 129         case DNS_SERVER_LINK:
 130                 assert(s->link);
 131                 assert(s->link->n_dns_servers > 0);
 132                 LIST_REMOVE(servers, s->link->dns_servers, s);
 133                 s->link->n_dns_servers--;
 134                 break;
 135
 136         case DNS_SERVER_SYSTEM:
 137                 assert(s->manager->n_dns_servers > 0);
 138                 LIST_REMOVE(servers, s->manager->dns_servers, s);
 139                 s->manager->n_dns_servers--;
 140                 break;
 141
 142         case DNS_SERVER_FALLBACK:
 143                 assert(s->manager->n_dns_servers > 0);
 144                 LIST_REMOVE(servers, s->manager->fallback_dns_servers, s);
 145                 s->manager->n_dns_servers--;
 146                 break;
 147         default:
 148                 assert_not_reached("Unknown server type");
 149         }
 150
 151         s->linked = false;
 152
 153         if (s->link && s->link->current_dns_server == s)
 154                 link_set_dns_server(s->link, NULL);
 155
 156         if (s->manager->current_dns_server == s)
 157                 manager_set_dns_server(s->manager, NULL);
 158
 159         dns_server_unref(s);
 160 }
 161
 162 void dns_server_move_back_and_unmark(DnsServer *s) {
 163         DnsServer *tail;
 164
 165         assert(s);
 166
 167         if (!s->marked)
 168                 return;
 169
 170         s->marked = false;
 171
 172         if (!s->linked || !s->servers_next)
 173                 return;
 174
 175         /* Move us to the end of the list, so that the order is
 176          * strictly kept, if we are not at the end anyway. */
 177
 178         switch (s->type) {
 179
 180         case DNS_SERVER_LINK:
 181                 assert(s->link);
 182                 LIST_FIND_TAIL(servers, s, tail);
 183                 LIST_REMOVE(servers, s->link->dns_servers, s);
 184                 LIST_INSERT_AFTER(servers, s->link->dns_servers, tail, s);
 185                 break;
 186
 187         case DNS_SERVER_SYSTEM:
 188                 LIST_FIND_TAIL(servers, s, tail);
 189                 LIST_REMOVE(servers, s->manager->dns_servers, s);
 190                 LIST_INSERT_AFTER(servers, s->manager->dns_servers, tail, s);
 191                 break;
 192
 193         case DNS_SERVER_FALLBACK:
 194                 LIST_FIND_TAIL(servers, s, tail);
 195                 LIST_REMOVE(servers, s->manager->fallback_dns_servers, s);
 196                 LIST_INSERT_AFTER(servers, s->manager->fallback_dns_servers, tail, s);
 197                 break;
 198
 199         default:
 200                 assert_not_reached("Unknown server type");
 201         }
 202 }
 203
 204 static void dns_server_verified(DnsServer *s, DnsServerFeatureLevel level) {
 205         assert(s);
 206
 207         if (s->verified_feature_level > level)
 208                 return;
 209
 210         if (s->verified_feature_level != level) {
 211                 log_debug("Verified we get a response at feature level %s from DNS server %s.",
 212                           dns_server_feature_level_to_string(level),
 213                           dns_server_string(s));
 214                 s->verified_feature_level = level;
 215         }
 216
 217         assert_se(sd_event_now(s->manager->event, clock_boottime_or_monotonic(), &s->verified_usec) >= 0);
 218 }
 219
 220 static void dns_server_reset_counters(DnsServer *s) {
 221         assert(s);
 222
 223         s->n_failed_udp = 0;
 224         s->n_failed_tcp = 0;
 225         s->n_failed_tls = 0;
 226         s->packet_truncated = false;
 227         s->verified_usec = 0;
 228
 229         /* Note that we do not reset s->packet_bad_opt and s->packet_rrsig_missing here. We reset them only when the
 230          * grace period ends, but not when lowering the possible feature level, as a lower level feature level should
 231          * not make RRSIGs appear or OPT appear, but rather make them disappear. If the reappear anyway, then that's
 232          * indication for a differently broken OPT/RRSIG implementation, and we really don't want to support that
 233          * either.
 234          *
 235          * This is particularly important to deal with certain Belkin routers which break OPT for certain lookups (A),
 236          * but pass traffic through for others (AAAA). If we detect the broken behaviour on one lookup we should not
 237          * reenable it for another, because we cannot validate things anyway, given that the RRSIG/OPT data will be
 238          * incomplete. */
 239 }
 240
 241 void dns_server_packet_received(DnsServer *s, int protocol, DnsServerFeatureLevel level, size_t size) {
 242         assert(s);
 243
 244         if (protocol == IPPROTO_UDP) {
 245                 if (s->possible_feature_level == level)
 246                         s->n_failed_udp = 0;
 247         } else if (protocol == IPPROTO_TCP) {
 248                 if (DNS_SERVER_FEATURE_LEVEL_IS_TLS(level)) {
 249                         if (s->possible_feature_level == level)
 250                                 s->n_failed_tls = 0;
 251                 } else {
 252                         if (s->possible_feature_level == level)
 253                                 s->n_failed_tcp = 0;
 254
 255                         /* Successful TCP connections are only useful to verify the TCP feature level. */
 256                         level = DNS_SERVER_FEATURE_LEVEL_TCP;
 257                 }
 258         }
 259
 260         /* If the RRSIG data is missing, then we can only validate EDNS0 at max */
 261         if (s->packet_rrsig_missing && level >= DNS_SERVER_FEATURE_LEVEL_DO)
 262                 level = DNS_SERVER_FEATURE_LEVEL_IS_TLS(level) ? DNS_SERVER_FEATURE_LEVEL_TLS_PLAIN : DNS_SERVER_FEATURE_LEVEL_EDNS0;
 263
 264         /* If the OPT RR got lost, then we can only validate UDP at max */
 265         if (s->packet_bad_opt && level >= DNS_SERVER_FEATURE_LEVEL_EDNS0)
 266                 level = DNS_SERVER_FEATURE_LEVEL_EDNS0 - 1;
 267
 268         /* Even if we successfully receive a reply to a request announcing support for large packets,
 269                 that does not mean we can necessarily receive large packets. */
 270         if (level == DNS_SERVER_FEATURE_LEVEL_LARGE)
 271                 level = DNS_SERVER_FEATURE_LEVEL_LARGE - 1;
 272
 273         dns_server_verified(s, level);
 274
 275         /* Remember the size of the largest UDP packet we received from a server,
 276            we know that we can always announce support for packets with at least
 277            this size. */
 278         if (protocol == IPPROTO_UDP && s->received_udp_packet_max < size)
 279                 s->received_udp_packet_max = size;
 280 }
 281
 282 void dns_server_packet_lost(DnsServer *s, int protocol, DnsServerFeatureLevel level) {
 283         assert(s);
 284         assert(s->manager);
 285
 286         if (s->possible_feature_level == level) {
 287                 if (protocol == IPPROTO_UDP)
 288                         s->n_failed_udp++;
 289                 else if (protocol == IPPROTO_TCP) {
 290                         if (DNS_SERVER_FEATURE_LEVEL_IS_TLS(level))
 291                                 s->n_failed_tls++;
 292                         else
 293                                 s->n_failed_tcp++;
 294                 }
 295         }
 296 }
 297
 298 void dns_server_packet_truncated(DnsServer *s, DnsServerFeatureLevel level) {
 299         assert(s);
 300
 301         /* Invoked whenever we get a packet with TC bit set. */
 302
 303         if (s->possible_feature_level != level)
 304                 return;
 305
 306         s->packet_truncated = true;
 307 }
 308
 309 void dns_server_packet_rrsig_missing(DnsServer *s, DnsServerFeatureLevel level) {
 310         assert(s);
 311
 312         if (level < DNS_SERVER_FEATURE_LEVEL_DO)
 313                 return;
 314
 315         /* If the RRSIG RRs are missing, we have to downgrade what we previously verified */
 316         if (s->verified_feature_level >= DNS_SERVER_FEATURE_LEVEL_DO)
 317                 s->verified_feature_level = DNS_SERVER_FEATURE_LEVEL_IS_TLS(level) ? DNS_SERVER_FEATURE_LEVEL_TLS_PLAIN : DNS_SERVER_FEATURE_LEVEL_EDNS0;
 318
 319         s->packet_rrsig_missing = true;
 320 }
 321
 322 void dns_server_packet_bad_opt(DnsServer *s, DnsServerFeatureLevel level) {
 323         assert(s);
 324
 325         if (level < DNS_SERVER_FEATURE_LEVEL_EDNS0)
 326                 return;
 327
 328         /* If the OPT RR got lost, we have to downgrade what we previously verified */
 329         if (s->verified_feature_level >= DNS_SERVER_FEATURE_LEVEL_EDNS0)
 330                 s->verified_feature_level = DNS_SERVER_FEATURE_LEVEL_EDNS0-1;
 331
 332         s->packet_bad_opt = true;
 333 }
 334
 335 void dns_server_packet_rcode_downgrade(DnsServer *s, DnsServerFeatureLevel level) {
 336         assert(s);
 337
 338         /* Invoked whenever we got a FORMERR, SERVFAIL or NOTIMP rcode from a server and downgrading the feature level
 339          * for the transaction made it go away. In this case we immediately downgrade to the feature level that made
 340          * things work. */
 341
 342         if (s->verified_feature_level > level)
 343                 s->verified_feature_level = level;
 344
 345         if (s->possible_feature_level > level) {
 346                 s->possible_feature_level = level;
 347                 dns_server_reset_counters(s);
 348         }
 349
 350         log_debug("Downgrading transaction feature level fixed an RCODE error, downgrading server %s too.", dns_server_string(s));
 351 }
 352
 353 static bool dns_server_grace_period_expired(DnsServer *s) {
 354         usec_t ts;
 355
 356         assert(s);
 357         assert(s->manager);
 358
 359         if (s->verified_usec == 0)
 360                 return false;
 361
 362         assert_se(sd_event_now(s->manager->event, clock_boottime_or_monotonic(), &ts) >= 0);
 363
 364         if (s->verified_usec + s->features_grace_period_usec > ts)
 365                 return false;
 366
 367         s->features_grace_period_usec = MIN(s->features_grace_period_usec * 2, DNS_SERVER_FEATURE_GRACE_PERIOD_MAX_USEC);
 368
 369         return true;
 370 }
 371
 372 DnsServerFeatureLevel dns_server_possible_feature_level(DnsServer *s) {
 373         DnsServerFeatureLevel best;
 374
 375         assert(s);
 376
 377         /* Determine the best feature level we care about. If DNSSEC mode is off there's no point in using anything
 378          * better than EDNS0, hence don't even try. */
 379         if (dns_server_get_dnssec_mode(s) != DNSSEC_NO)
 380                 best = dns_server_get_dns_over_tls_mode(s) == DNS_OVER_TLS_NO ?
 381                         DNS_SERVER_FEATURE_LEVEL_LARGE :
 382                         DNS_SERVER_FEATURE_LEVEL_TLS_DO;
 383         else
 384                 best = dns_server_get_dns_over_tls_mode(s) == DNS_OVER_TLS_NO ?
 385                         DNS_SERVER_FEATURE_LEVEL_EDNS0 :
 386                         DNS_SERVER_FEATURE_LEVEL_TLS_PLAIN;
 387
 388         /* Clamp the feature level the highest level we care about. The DNSSEC mode might have changed since the last
 389          * time, hence let's downgrade if we are still at a higher level. */
 390         if (s->possible_feature_level > best)
 391                 s->possible_feature_level = best;
 392
 393         if (s->possible_feature_level < best && dns_server_grace_period_expired(s)) {
 394
 395                 s->possible_feature_level = best;
 396
 397                 dns_server_reset_counters(s);
 398
 399                 s->packet_bad_opt = false;
 400                 s->packet_rrsig_missing = false;
 401
 402                 log_info("Grace period over, resuming full feature set (%s) for DNS server %s.",
 403                          dns_server_feature_level_to_string(s->possible_feature_level),
 404                          dns_server_string(s));
 405
 406                 dns_server_flush_cache(s);
 407
 408         } else if (s->possible_feature_level <= s->verified_feature_level)
 409                 s->possible_feature_level = s->verified_feature_level;
 410         else {
 411                 DnsServerFeatureLevel p = s->possible_feature_level;
 412
 413                 if (s->n_failed_tcp >= DNS_SERVER_FEATURE_RETRY_ATTEMPTS &&
 414                     s->possible_feature_level == DNS_SERVER_FEATURE_LEVEL_TCP) {
 415
 416                         /* We are at the TCP (lowest) level, and we tried a couple of TCP connections, and it didn't
 417                          * work. Upgrade back to UDP again. */
 418                         log_debug("Reached maximum number of failed TCP connection attempts, trying UDP again...");
 419                         s->possible_feature_level = DNS_SERVER_FEATURE_LEVEL_UDP;
 420                 } else if (s->n_failed_tls > 0 &&
 421                            DNS_SERVER_FEATURE_LEVEL_IS_TLS(s->possible_feature_level)) {
 422
 423                         /* We tried to connect using DNS-over-TLS, and it didn't work. Downgrade to plaintext UDP
 424                          * if we don't require DNS-over-TLS */
 425
 426                         log_debug("Server doesn't support DNS-over-TLS, downgrading protocol...");
 427                         s->possible_feature_level--;
 428                 } else if (s->packet_bad_opt &&
 429                            s->possible_feature_level >= DNS_SERVER_FEATURE_LEVEL_EDNS0) {
 430
 431                         /* A reply to one of our EDNS0 queries didn't carry a valid OPT RR, then downgrade to below
 432                          * EDNS0 levels. After all, some records generate different responses with and without OPT RR
 433                          * in the request. Example:
 434                          * https://open.nlnetlabs.nl/pipermail/dnssec-trigger/2014-November/000376.html */
 435
 436                         log_debug("Server doesn't support EDNS(0) properly, downgrading feature level...");
 437                         s->possible_feature_level = DNS_SERVER_FEATURE_LEVEL_UDP;
 438
 439                 } else if (s->packet_rrsig_missing &&
 440                            s->possible_feature_level >= DNS_SERVER_FEATURE_LEVEL_DO) {
 441
 442                         /* RRSIG data was missing on a EDNS0 packet with DO bit set. This means the server doesn't
 443                          * augment responses with DNSSEC RRs. If so, let's better not ask the server for it anymore,
 444                          * after all some servers generate different replies depending if an OPT RR is in the query or
 445                          * not. */
 446
 447                         log_debug("Detected server responses lack RRSIG records, downgrading feature level...");
 448                         s->possible_feature_level = DNS_SERVER_FEATURE_LEVEL_IS_TLS(s->possible_feature_level) ? DNS_SERVER_FEATURE_LEVEL_TLS_PLAIN : DNS_SERVER_FEATURE_LEVEL_EDNS0;
 449
 450                 } else if (s->n_failed_udp >= DNS_SERVER_FEATURE_RETRY_ATTEMPTS &&
 451                            s->possible_feature_level >= (dns_server_get_dnssec_mode(s) == DNSSEC_YES ? DNS_SERVER_FEATURE_LEVEL_LARGE : DNS_SERVER_FEATURE_LEVEL_UDP)) {
 452
 453                         /* We lost too many UDP packets in a row, and are on a feature level of UDP or higher. If the
 454                          * packets are lost, maybe the server cannot parse them, hence downgrading sounds like a good
 455                          * idea. We might downgrade all the way down to TCP this way.
 456                          *
 457                          * If strict DNSSEC mode is used we won't downgrade below DO level however, as packet loss
 458                          * might have many reasons, a broken DNSSEC implementation being only one reason. And if the
 459                          * user is strict on DNSSEC, then let's assume that DNSSEC is not the fault here. */
 460
 461                         log_debug("Lost too many UDP packets, downgrading feature level...");
 462                         s->possible_feature_level--;
 463
 464                 } else if (s->n_failed_tcp >= DNS_SERVER_FEATURE_RETRY_ATTEMPTS &&
 465                            s->packet_truncated &&
 466                            s->possible_feature_level > (dns_server_get_dnssec_mode(s) == DNSSEC_YES ? DNS_SERVER_FEATURE_LEVEL_LARGE : DNS_SERVER_FEATURE_LEVEL_UDP)) {
 467
 468                          /* We got too many TCP connection failures in a row, we had at least one truncated packet, and
 469                           * are on a feature level above UDP. By downgrading things and getting rid of DNSSEC or EDNS0
 470                           * data we hope to make the packet smaller, so that it still works via UDP given that TCP
 471                           * appears not to be a fallback. Note that if we are already at the lowest UDP level, we don't
 472                           * go further down, since that's TCP, and TCP failed too often after all. */
 473
 474                         log_debug("Got too many failed TCP connection failures and truncated UDP packets, downgrading feature level...");
 475                         s->possible_feature_level--;
 476                 }
 477
 478                 if (p != s->possible_feature_level) {
 479
 480                         /* We changed the feature level, reset the counting */
 481                         dns_server_reset_counters(s);
 482
 483                         log_warning("Using degraded feature set (%s) for DNS server %s.",
 484                                     dns_server_feature_level_to_string(s->possible_feature_level),
 485                                     dns_server_string(s));
 486                 }
 487         }
 488
 489         return s->possible_feature_level;
 490 }
 491
 492 int dns_server_adjust_opt(DnsServer *server, DnsPacket *packet, DnsServerFeatureLevel level) {
 493         size_t packet_size;
 494         bool edns_do;
 495         int r;
 496
 497         assert(server);
 498         assert(packet);
 499         assert(packet->protocol == DNS_PROTOCOL_DNS);
 500
 501         /* Fix the OPT field in the packet to match our current feature level. */
 502
 503         r = dns_packet_truncate_opt(packet);
 504         if (r < 0)
 505                 return r;
 506
 507         if (level < DNS_SERVER_FEATURE_LEVEL_EDNS0)
 508                 return 0;
 509
 510         edns_do = level >= DNS_SERVER_FEATURE_LEVEL_DO;
 511
 512         if (level >= DNS_SERVER_FEATURE_LEVEL_LARGE)
 513                 packet_size = DNS_PACKET_UNICAST_SIZE_LARGE_MAX;
 514         else
 515                 packet_size = server->received_udp_packet_max;
 516
 517         return dns_packet_append_opt(packet, packet_size, edns_do, 0, NULL);
 518 }
 519
 520 int dns_server_ifindex(const DnsServer *s) {
 521         assert(s);
 522
 523         /* The link ifindex always takes precedence */
 524         if (s->link)
 525                 return s->link->ifindex;
 526
 527         if (s->ifindex > 0)
 528                 return s->ifindex;
 529
 530         return 0;
 531 }
 532
 533 const char *dns_server_string(DnsServer *server) {
 534         assert(server);
 535
 536         if (!server->server_string)
 537                 (void) in_addr_ifindex_to_string(server->family, &server->address, dns_server_ifindex(server), &server->server_string);
 538
 539         return strna(server->server_string);
 540 }
 541
 542 bool dns_server_dnssec_supported(DnsServer *server) {
 543         assert(server);
 544
 545         /* Returns whether the server supports DNSSEC according to what we know about it */
 546
 547         if (server->possible_feature_level < DNS_SERVER_FEATURE_LEVEL_DO)
 548                 return false;
 549
 550         if (server->packet_bad_opt)
 551                 return false;
 552
 553         if (server->packet_rrsig_missing)
 554                 return false;
 555
 556         /* DNSSEC servers need to support TCP properly (see RFC5966), if they don't, we assume DNSSEC is borked too */
 557         if (server->n_failed_tcp >= DNS_SERVER_FEATURE_RETRY_ATTEMPTS)
 558                 return false;
 559
 560         return true;
 561 }
 562
 563 void dns_server_warn_downgrade(DnsServer *server) {
 564         assert(server);
 565
 566         if (server->warned_downgrade)
 567                 return;
 568
 569         log_struct(LOG_NOTICE,
 570                    "MESSAGE_ID=" SD_MESSAGE_DNSSEC_DOWNGRADE_STR,
 571                    LOG_MESSAGE("Server %s does not support DNSSEC, downgrading to non-DNSSEC mode.", dns_server_string(server)),
 572                    "DNS_SERVER=%s", dns_server_string(server),
 573                    "DNS_SERVER_FEATURE_LEVEL=%s", dns_server_feature_level_to_string(server->possible_feature_level));
 574
 575         server->warned_downgrade = true;
 576 }
 577
 578 bool dns_server_limited_domains(DnsServer *server) {
 579         DnsSearchDomain *domain;
 580         bool domain_restricted = false;
 581
 582         /* Check if the server has route-only domains without ~., i. e. whether
 583          * it should only be used for particular domains */
 584         if (!server->link)
 585                 return false;
 586
 587         LIST_FOREACH(domains, domain, server->link->search_domains)
 588                 if (domain->route_only) {
 589                         domain_restricted = true;
 590                         /* ~. means "any domain", thus it is a global server */
 591                         if (dns_name_is_root(DNS_SEARCH_DOMAIN_NAME(domain)))
 592                                 return false;
 593                 }
 594
 595         return domain_restricted;
 596 }
 597
 598 static void dns_server_hash_func(const void *p, struct siphash *state) {
 599         const DnsServer *s = p;
 600
 601         assert(s);
 602
 603         siphash24_compress(&s->family, sizeof(s->family), state);
 604         siphash24_compress(&s->address, FAMILY_ADDRESS_SIZE(s->family), state);
 605         siphash24_compress(&s->ifindex, sizeof(s->ifindex), state);
 606 }
 607
 608 static int dns_server_compare_func(const void *a, const void *b) {
 609         const DnsServer *x = a, *y = b;
 610         int r;
 611
 612         r = CMP(x->family, y->family);
 613         if (r != 0)
 614                 return r;
 615
 616         r = memcmp(&x->address, &y->address, FAMILY_ADDRESS_SIZE(x->family));
 617         if (r != 0)
 618                 return r;
 619
 620         r = CMP(x->ifindex, y->ifindex);
 621         if (r != 0)
 622                 return r;
 623
 624         return 0;
 625 }
 626
 627 const struct hash_ops dns_server_hash_ops = {
 628         .hash = dns_server_hash_func,
 629         .compare = dns_server_compare_func
 630 };
 631
 632 void dns_server_unlink_all(DnsServer *first) {
 633         DnsServer *next;
 634
 635         if (!first)
 636                 return;
 637
 638         next = first->servers_next;
 639         dns_server_unlink(first);
 640
 641         dns_server_unlink_all(next);
 642 }
 643
 644 void dns_server_unlink_marked(DnsServer *first) {
 645         DnsServer *next;
 646
 647         if (!first)
 648                 return;
 649
 650         next = first->servers_next;
 651
 652         if (first->marked)
 653                 dns_server_unlink(first);
 654
 655         dns_server_unlink_marked(next);
 656 }
 657
 658 void dns_server_mark_all(DnsServer *first) {
 659         if (!first)
 660                 return;
 661
 662         first->marked = true;
 663         dns_server_mark_all(first->servers_next);
 664 }
 665
 666 DnsServer *dns_server_find(DnsServer *first, int family, const union in_addr_union *in_addr, int ifindex) {
 667         DnsServer *s;
 668
 669         LIST_FOREACH(servers, s, first)
 670                 if (s->family == family && in_addr_equal(family, &s->address, in_addr) > 0 && s->ifindex == ifindex)
 671                         return s;
 672
 673         return NULL;
 674 }
 675
 676 DnsServer *manager_get_first_dns_server(Manager *m, DnsServerType t) {
 677         assert(m);
 678
 679         switch (t) {
 680
 681         case DNS_SERVER_SYSTEM:
 682                 return m->dns_servers;
 683
 684         case DNS_SERVER_FALLBACK:
 685                 return m->fallback_dns_servers;
 686
 687         default:
 688                 return NULL;
 689         }
 690 }
 691
 692 DnsServer *manager_set_dns_server(Manager *m, DnsServer *s) {
 693         assert(m);
 694
 695         if (m->current_dns_server == s)
 696                 return s;
 697
 698         if (s)
 699                 log_debug("Switching to %s DNS server %s.",
 700                           dns_server_type_to_string(s->type),
 701                           dns_server_string(s));
 702
 703         dns_server_unref(m->current_dns_server);
 704         m->current_dns_server = dns_server_ref(s);
 705
 706         if (m->unicast_scope)
 707                 dns_cache_flush(&m->unicast_scope->cache);
 708
 709         return s;
 710 }
 711
 712 DnsServer *manager_get_dns_server(Manager *m) {
 713         Link *l;
 714         assert(m);
 715
 716         /* Try to read updates resolv.conf */
 717         manager_read_resolv_conf(m);
 718
 719         /* If no DNS server was chosen so far, pick the first one */
 720         if (!m->current_dns_server)
 721                 manager_set_dns_server(m, m->dns_servers);
 722
 723         if (!m->current_dns_server) {
 724                 bool found = false;
 725                 Iterator i;
 726
 727                 /* No DNS servers configured, let's see if there are
 728                  * any on any links. If not, we use the fallback
 729                  * servers */
 730
 731                 HASHMAP_FOREACH(l, m->links, i)
 732                         if (l->dns_servers) {
 733                                 found = true;
 734                                 break;
 735                         }
 736
 737                 if (!found)
 738                         manager_set_dns_server(m, m->fallback_dns_servers);
 739         }
 740
 741         return m->current_dns_server;
 742 }
 743
 744 void manager_next_dns_server(Manager *m) {
 745         assert(m);
 746
 747         /* If there's currently no DNS server set, then the next
 748          * manager_get_dns_server() will find one */
 749         if (!m->current_dns_server)
 750                 return;
 751
 752         /* Change to the next one, but make sure to follow the linked
 753          * list only if the server is still linked. */
 754         if (m->current_dns_server->linked && m->current_dns_server->servers_next) {
 755                 manager_set_dns_server(m, m->current_dns_server->servers_next);
 756                 return;
 757         }
 758
 759         /* If there was no next one, then start from the beginning of
 760          * the list */
 761         if (m->current_dns_server->type == DNS_SERVER_FALLBACK)
 762                 manager_set_dns_server(m, m->fallback_dns_servers);
 763         else
 764                 manager_set_dns_server(m, m->dns_servers);
 765 }
 766
 767 bool dns_server_address_valid(int family, const union in_addr_union *sa) {
 768
 769         /* Refuses the 0 IP addresses as well as 127.0.0.53 (which is our own DNS stub) */
 770
 771         if (in_addr_is_null(family, sa))
 772                 return false;
 773
 774         if (family == AF_INET && sa->in.s_addr == htobe32(INADDR_DNS_STUB))
 775                 return false;
 776
 777         return true;
 778 }
 779
 780 DnssecMode dns_server_get_dnssec_mode(DnsServer *s) {
 781         assert(s);
 782
 783         if (s->link)
 784                 return link_get_dnssec_mode(s->link);
 785
 786         return manager_get_dnssec_mode(s->manager);
 787 }
 788
 789 DnsOverTlsMode dns_server_get_dns_over_tls_mode(DnsServer *s) {
 790         assert(s);
 791
 792         if (s->link)
 793                 return link_get_dns_over_tls_mode(s->link);
 794
 795         return manager_get_dns_over_tls_mode(s->manager);
 796 }
 797
 798 void dns_server_flush_cache(DnsServer *s) {
 799         DnsServer *current;
 800         DnsScope *scope;
 801
 802         assert(s);
 803
 804         /* Flush the cache of the scope this server belongs to */
 805
 806         current = s->link ? s->link->current_dns_server : s->manager->current_dns_server;
 807         if (current != s)
 808                 return;
 809
 810         scope = s->link ? s->link->unicast_scope : s->manager->unicast_scope;
 811         if (!scope)
 812                 return;
 813
 814         dns_cache_flush(&scope->cache);
 815 }
 816
 817 void dns_server_reset_features(DnsServer *s) {
 818         assert(s);
 819
 820         s->verified_feature_level = _DNS_SERVER_FEATURE_LEVEL_INVALID;
 821         s->possible_feature_level = DNS_SERVER_FEATURE_LEVEL_BEST;
 822
 823         s->received_udp_packet_max = DNS_PACKET_UNICAST_SIZE_MAX;
 824
 825         s->packet_bad_opt = false;
 826         s->packet_rrsig_missing = false;
 827
 828         s->features_grace_period_usec = DNS_SERVER_FEATURE_GRACE_PERIOD_MIN_USEC;
 829
 830         s->warned_downgrade = false;
 831
 832         dns_server_reset_counters(s);
 833 }
 834
 835 void dns_server_reset_features_all(DnsServer *s) {
 836         DnsServer *i;
 837
 838         LIST_FOREACH(servers, i, s)
 839                 dns_server_reset_features(i);
 840 }
 841
 842 void dns_server_dump(DnsServer *s, FILE *f) {
 843         assert(s);
 844
 845         if (!f)
 846                 f = stdout;
 847
 848         fputs("[Server ", f);
 849         fputs(dns_server_string(s), f);
 850         fputs(" type=", f);
 851         fputs(dns_server_type_to_string(s->type), f);
 852
 853         if (s->type == DNS_SERVER_LINK) {
 854                 assert(s->link);
 855
 856                 fputs(" interface=", f);
 857                 fputs(s->link->name, f);
 858         }
 859
 860         fputs("]\n", f);
 861
 862         fputs("\tVerified feature level: ", f);
 863         fputs(strna(dns_server_feature_level_to_string(s->verified_feature_level)), f);
 864         fputc('\n', f);
 865
 866         fputs("\tPossible feature level: ", f);
 867         fputs(strna(dns_server_feature_level_to_string(s->possible_feature_level)), f);
 868         fputc('\n', f);
 869
 870         fputs("\tDNSSEC Mode: ", f);
 871         fputs(strna(dnssec_mode_to_string(dns_server_get_dnssec_mode(s))), f);
 872         fputc('\n', f);
 873
 874         fputs("\tCan do DNSSEC: ", f);
 875         fputs(yes_no(dns_server_dnssec_supported(s)), f);
 876         fputc('\n', f);
 877
 878         fprintf(f,
 879                 "\tMaximum UDP packet size received: %zu\n"
 880                 "\tFailed UDP attempts: %u\n"
 881                 "\tFailed TCP attempts: %u\n"
 882                 "\tSeen truncated packet: %s\n"
 883                 "\tSeen OPT RR getting lost: %s\n"
 884                 "\tSeen RRSIG RR missing: %s\n",
 885                 s->received_udp_packet_max,
 886                 s->n_failed_udp,
 887                 s->n_failed_tcp,
 888                 yes_no(s->packet_truncated),
 889                 yes_no(s->packet_bad_opt),
 890                 yes_no(s->packet_rrsig_missing));
 891 }
 892
 893 static const char* const dns_server_type_table[_DNS_SERVER_TYPE_MAX] = {
 894         [DNS_SERVER_SYSTEM] = "system",
 895         [DNS_SERVER_FALLBACK] = "fallback",
 896         [DNS_SERVER_LINK] = "link",
 897 };
 898 DEFINE_STRING_TABLE_LOOKUP(dns_server_type, DnsServerType);
 899
 900 static const char* const dns_server_feature_level_table[_DNS_SERVER_FEATURE_LEVEL_MAX] = {
 901         [DNS_SERVER_FEATURE_LEVEL_TCP] = "TCP",
 902         [DNS_SERVER_FEATURE_LEVEL_UDP] = "UDP",
 903         [DNS_SERVER_FEATURE_LEVEL_EDNS0] = "UDP+EDNS0",
 904         [DNS_SERVER_FEATURE_LEVEL_TLS_PLAIN] = "TLS+EDNS0",
 905         [DNS_SERVER_FEATURE_LEVEL_DO] = "UDP+EDNS0+DO",
 906         [DNS_SERVER_FEATURE_LEVEL_LARGE] = "UDP+EDNS0+DO+LARGE",
 907         [DNS_SERVER_FEATURE_LEVEL_TLS_DO] = "TLS+EDNS0+D0",
 908 };
 909 DEFINE_STRING_TABLE_LOOKUP(dns_server_feature_level, DnsServerFeatureLevel);