src/resolve/resolved-dns-server.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2
   3 #include "sd-messages.h"
   4
   5 #include "alloc-util.h"
   6 #include "resolved-dns-server.h"
   7 #include "resolved-dns-stub.h"
   8 #include "resolved-resolv-conf.h"
   9 #include "siphash24.h"
  10 #include "string-table.h"
  11 #include "string-util.h"
  12
  13 /* The amount of time to wait before retrying with a full feature set */
  14 #define DNS_SERVER_FEATURE_GRACE_PERIOD_MAX_USEC (6 * USEC_PER_HOUR)
  15 #define DNS_SERVER_FEATURE_GRACE_PERIOD_MIN_USEC (5 * USEC_PER_MINUTE)
  16
  17 /* The number of times we will attempt a certain feature set before degrading */
  18 #define DNS_SERVER_FEATURE_RETRY_ATTEMPTS 3
  19
  20 int dns_server_new(
  21                 Manager *m,
  22                 DnsServer **ret,
  23                 DnsServerType type,
  24                 Link *l,
  25                 int family,
  26                 const union in_addr_union *in_addr,
  27                 int ifindex) {
  28
  29         DnsServer *s;
  30
  31         assert(m);
  32         assert((type == DNS_SERVER_LINK) == !!l);
  33         assert(in_addr);
  34
  35         if (!IN_SET(family, AF_INET, AF_INET6))
  36                 return -EAFNOSUPPORT;
  37
  38         if (l) {
  39                 if (l->n_dns_servers >= LINK_DNS_SERVERS_MAX)
  40                         return -E2BIG;
  41         } else {
  42                 if (m->n_dns_servers >= MANAGER_DNS_SERVERS_MAX)
  43                         return -E2BIG;
  44         }
  45
  46         s = new0(DnsServer, 1);
  47         if (!s)
  48                 return -ENOMEM;
  49
  50         s->n_ref = 1;
  51         s->manager = m;
  52         s->type = type;
  53         s->family = family;
  54         s->address = *in_addr;
  55         s->ifindex = ifindex;
  56
  57         dns_server_reset_features(s);
  58
  59         switch (type) {
  60
  61         case DNS_SERVER_LINK:
  62                 s->link = l;
  63                 LIST_APPEND(servers, l->dns_servers, s);
  64                 l->n_dns_servers++;
  65                 break;
  66
  67         case DNS_SERVER_SYSTEM:
  68                 LIST_APPEND(servers, m->dns_servers, s);
  69                 m->n_dns_servers++;
  70                 break;
  71
  72         case DNS_SERVER_FALLBACK:
  73                 LIST_APPEND(servers, m->fallback_dns_servers, s);
  74                 m->n_dns_servers++;
  75                 break;
  76
  77         default:
  78                 assert_not_reached("Unknown server type");
  79         }
  80
  81         s->linked = true;
  82
  83 #if ENABLE_DNS_OVER_TLS
  84         /* Do not verify cerificate */
  85         gnutls_certificate_allocate_credentials(&s->tls_cert_cred);
  86 #endif
  87
  88         /* A new DNS server that isn't fallback is added and the one
  89          * we used so far was a fallback one? Then let's try to pick
  90          * the new one */
  91         if (type != DNS_SERVER_FALLBACK &&
  92             m->current_dns_server &&
  93             m->current_dns_server->type == DNS_SERVER_FALLBACK)
  94                 manager_set_dns_server(m, NULL);
  95
  96         if (ret)
  97                 *ret = s;
  98
  99         return 0;
 100 }
 101
 102 DnsServer* dns_server_ref(DnsServer *s)  {
 103         if (!s)
 104                 return NULL;
 105
 106         assert(s->n_ref > 0);
 107         s->n_ref++;
 108
 109         return s;
 110 }
 111
 112 DnsServer* dns_server_unref(DnsServer *s)  {
 113         if (!s)
 114                 return NULL;
 115
 116         assert(s->n_ref > 0);
 117         s->n_ref--;
 118
 119         if (s->n_ref > 0)
 120                 return NULL;
 121
 122         dns_stream_unref(s->stream);
 123
 124 #if ENABLE_DNS_OVER_TLS
 125         if (s->tls_cert_cred)
 126                 gnutls_certificate_free_credentials(s->tls_cert_cred);
 127
 128         if (s->tls_session_data.data)
 129                 gnutls_free(s->tls_session_data.data);
 130 #endif
 131
 132         free(s->server_string);
 133         return mfree(s);
 134 }
 135
 136 void dns_server_unlink(DnsServer *s) {
 137         assert(s);
 138         assert(s->manager);
 139
 140         /* This removes the specified server from the linked list of
 141          * servers, but any server might still stay around if it has
 142          * refs, for example from an ongoing transaction. */
 143
 144         if (!s->linked)
 145                 return;
 146
 147         switch (s->type) {
 148
 149         case DNS_SERVER_LINK:
 150                 assert(s->link);
 151                 assert(s->link->n_dns_servers > 0);
 152                 LIST_REMOVE(servers, s->link->dns_servers, s);
 153                 s->link->n_dns_servers--;
 154                 break;
 155
 156         case DNS_SERVER_SYSTEM:
 157                 assert(s->manager->n_dns_servers > 0);
 158                 LIST_REMOVE(servers, s->manager->dns_servers, s);
 159                 s->manager->n_dns_servers--;
 160                 break;
 161
 162         case DNS_SERVER_FALLBACK:
 163                 assert(s->manager->n_dns_servers > 0);
 164                 LIST_REMOVE(servers, s->manager->fallback_dns_servers, s);
 165                 s->manager->n_dns_servers--;
 166                 break;
 167         }
 168
 169         s->linked = false;
 170
 171         if (s->link && s->link->current_dns_server == s)
 172                 link_set_dns_server(s->link, NULL);
 173
 174         if (s->manager->current_dns_server == s)
 175                 manager_set_dns_server(s->manager, NULL);
 176
 177         dns_server_unref(s);
 178 }
 179
 180 void dns_server_move_back_and_unmark(DnsServer *s) {
 181         DnsServer *tail;
 182
 183         assert(s);
 184
 185         if (!s->marked)
 186                 return;
 187
 188         s->marked = false;
 189
 190         if (!s->linked || !s->servers_next)
 191                 return;
 192
 193         /* Move us to the end of the list, so that the order is
 194          * strictly kept, if we are not at the end anyway. */
 195
 196         switch (s->type) {
 197
 198         case DNS_SERVER_LINK:
 199                 assert(s->link);
 200                 LIST_FIND_TAIL(servers, s, tail);
 201                 LIST_REMOVE(servers, s->link->dns_servers, s);
 202                 LIST_INSERT_AFTER(servers, s->link->dns_servers, tail, s);
 203                 break;
 204
 205         case DNS_SERVER_SYSTEM:
 206                 LIST_FIND_TAIL(servers, s, tail);
 207                 LIST_REMOVE(servers, s->manager->dns_servers, s);
 208                 LIST_INSERT_AFTER(servers, s->manager->dns_servers, tail, s);
 209                 break;
 210
 211         case DNS_SERVER_FALLBACK:
 212                 LIST_FIND_TAIL(servers, s, tail);
 213                 LIST_REMOVE(servers, s->manager->fallback_dns_servers, s);
 214                 LIST_INSERT_AFTER(servers, s->manager->fallback_dns_servers, tail, s);
 215                 break;
 216
 217         default:
 218                 assert_not_reached("Unknown server type");
 219         }
 220 }
 221
 222 static void dns_server_verified(DnsServer *s, DnsServerFeatureLevel level) {
 223         assert(s);
 224
 225         if (s->verified_feature_level > level)
 226                 return;
 227
 228         if (s->verified_feature_level != level) {
 229                 log_debug("Verified we get a response at feature level %s from DNS server %s.",
 230                           dns_server_feature_level_to_string(level),
 231                           dns_server_string(s));
 232                 s->verified_feature_level = level;
 233         }
 234
 235         assert_se(sd_event_now(s->manager->event, clock_boottime_or_monotonic(), &s->verified_usec) >= 0);
 236 }
 237
 238 static void dns_server_reset_counters(DnsServer *s) {
 239         assert(s);
 240
 241         s->n_failed_udp = 0;
 242         s->n_failed_tcp = 0;
 243         s->n_failed_tls = 0;
 244         s->packet_truncated = false;
 245         s->verified_usec = 0;
 246
 247         /* Note that we do not reset s->packet_bad_opt and s->packet_rrsig_missing here. We reset them only when the
 248          * grace period ends, but not when lowering the possible feature level, as a lower level feature level should
 249          * not make RRSIGs appear or OPT appear, but rather make them disappear. If the reappear anyway, then that's
 250          * indication for a differently broken OPT/RRSIG implementation, and we really don't want to support that
 251          * either.
 252          *
 253          * This is particularly important to deal with certain Belkin routers which break OPT for certain lookups (A),
 254          * but pass traffic through for others (AAAA). If we detect the broken behaviour on one lookup we should not
 255          * reenable it for another, because we cannot validate things anyway, given that the RRSIG/OPT data will be
 256          * incomplete. */
 257 }
 258
 259 void dns_server_packet_received(DnsServer *s, int protocol, DnsServerFeatureLevel level, size_t size) {
 260         assert(s);
 261
 262         if (protocol == IPPROTO_UDP) {
 263                 if (s->possible_feature_level == level)
 264                         s->n_failed_udp = 0;
 265         } else if (protocol == IPPROTO_TCP) {
 266                 if (DNS_SERVER_FEATURE_LEVEL_IS_TLS(level)) {
 267                         if (s->possible_feature_level == level)
 268                                 s->n_failed_tls = 0;
 269                 } else {
 270                         if (s->possible_feature_level == level)
 271                                 s->n_failed_tcp = 0;
 272
 273                         /* Successful TCP connections are only useful to verify the TCP feature level. */
 274                         level = DNS_SERVER_FEATURE_LEVEL_TCP;
 275                 }
 276         }
 277
 278         /* If the RRSIG data is missing, then we can only validate EDNS0 at max */
 279         if (s->packet_rrsig_missing && level >= DNS_SERVER_FEATURE_LEVEL_DO)
 280                 level = DNS_SERVER_FEATURE_LEVEL_IS_TLS(level) ? DNS_SERVER_FEATURE_LEVEL_TLS_PLAIN : DNS_SERVER_FEATURE_LEVEL_EDNS0;
 281
 282         /* If the OPT RR got lost, then we can only validate UDP at max */
 283         if (s->packet_bad_opt && level >= DNS_SERVER_FEATURE_LEVEL_EDNS0)
 284                 level = DNS_SERVER_FEATURE_LEVEL_EDNS0 - 1;
 285
 286         /* Even if we successfully receive a reply to a request announcing support for large packets,
 287                 that does not mean we can necessarily receive large packets. */
 288         if (level == DNS_SERVER_FEATURE_LEVEL_LARGE)
 289                 level = DNS_SERVER_FEATURE_LEVEL_LARGE - 1;
 290
 291         dns_server_verified(s, level);
 292
 293         /* Remember the size of the largest UDP packet we received from a server,
 294            we know that we can always announce support for packets with at least
 295            this size. */
 296         if (protocol == IPPROTO_UDP && s->received_udp_packet_max < size)
 297                 s->received_udp_packet_max = size;
 298 }
 299
 300 void dns_server_packet_lost(DnsServer *s, int protocol, DnsServerFeatureLevel level) {
 301         assert(s);
 302         assert(s->manager);
 303
 304         if (s->possible_feature_level == level) {
 305                 if (protocol == IPPROTO_UDP)
 306                         s->n_failed_udp++;
 307                 else if (protocol == IPPROTO_TCP) {
 308                         if (DNS_SERVER_FEATURE_LEVEL_IS_TLS(level))
 309                                 s->n_failed_tls++;
 310                         else
 311                                 s->n_failed_tcp++;
 312                 }
 313         }
 314 }
 315
 316 void dns_server_packet_truncated(DnsServer *s, DnsServerFeatureLevel level) {
 317         assert(s);
 318
 319         /* Invoked whenever we get a packet with TC bit set. */
 320
 321         if (s->possible_feature_level != level)
 322                 return;
 323
 324         s->packet_truncated = true;
 325 }
 326
 327 void dns_server_packet_rrsig_missing(DnsServer *s, DnsServerFeatureLevel level) {
 328         assert(s);
 329
 330         if (level < DNS_SERVER_FEATURE_LEVEL_DO)
 331                 return;
 332
 333         /* If the RRSIG RRs are missing, we have to downgrade what we previously verified */
 334         if (s->verified_feature_level >= DNS_SERVER_FEATURE_LEVEL_DO)
 335                 s->verified_feature_level = DNS_SERVER_FEATURE_LEVEL_IS_TLS(level) ? DNS_SERVER_FEATURE_LEVEL_TLS_PLAIN : DNS_SERVER_FEATURE_LEVEL_EDNS0;
 336
 337         s->packet_rrsig_missing = true;
 338 }
 339
 340 void dns_server_packet_bad_opt(DnsServer *s, DnsServerFeatureLevel level) {
 341         assert(s);
 342
 343         if (level < DNS_SERVER_FEATURE_LEVEL_EDNS0)
 344                 return;
 345
 346         /* If the OPT RR got lost, we have to downgrade what we previously verified */
 347         if (s->verified_feature_level >= DNS_SERVER_FEATURE_LEVEL_EDNS0)
 348                 s->verified_feature_level = DNS_SERVER_FEATURE_LEVEL_EDNS0-1;
 349
 350         s->packet_bad_opt = true;
 351 }
 352
 353 void dns_server_packet_rcode_downgrade(DnsServer *s, DnsServerFeatureLevel level) {
 354         assert(s);
 355
 356         /* Invoked whenever we got a FORMERR, SERVFAIL or NOTIMP rcode from a server and downgrading the feature level
 357          * for the transaction made it go away. In this case we immediately downgrade to the feature level that made
 358          * things work. */
 359
 360         if (s->verified_feature_level > level)
 361                 s->verified_feature_level = level;
 362
 363         if (s->possible_feature_level > level) {
 364                 s->possible_feature_level = level;
 365                 dns_server_reset_counters(s);
 366         }
 367
 368         log_debug("Downgrading transaction feature level fixed an RCODE error, downgrading server %s too.", dns_server_string(s));
 369 }
 370
 371 static bool dns_server_grace_period_expired(DnsServer *s) {
 372         usec_t ts;
 373
 374         assert(s);
 375         assert(s->manager);
 376
 377         if (s->verified_usec == 0)
 378                 return false;
 379
 380         assert_se(sd_event_now(s->manager->event, clock_boottime_or_monotonic(), &ts) >= 0);
 381
 382         if (s->verified_usec + s->features_grace_period_usec > ts)
 383                 return false;
 384
 385         s->features_grace_period_usec = MIN(s->features_grace_period_usec * 2, DNS_SERVER_FEATURE_GRACE_PERIOD_MAX_USEC);
 386
 387         return true;
 388 }
 389
 390 DnsServerFeatureLevel dns_server_possible_feature_level(DnsServer *s) {
 391         DnsServerFeatureLevel best;
 392
 393         assert(s);
 394
 395         /* Determine the best feature level we care about. If DNSSEC mode is off there's no point in using anything
 396          * better than EDNS0, hence don't even try. */
 397         if (dns_server_get_dnssec_mode(s) != DNSSEC_NO)
 398                 best = dns_server_get_dns_over_tls_mode(s) == DNS_OVER_TLS_NO ?
 399                         DNS_SERVER_FEATURE_LEVEL_LARGE :
 400                         DNS_SERVER_FEATURE_LEVEL_TLS_DO;
 401         else
 402                 best = dns_server_get_dns_over_tls_mode(s) == DNS_OVER_TLS_NO ?
 403                         DNS_SERVER_FEATURE_LEVEL_EDNS0 :
 404                         DNS_SERVER_FEATURE_LEVEL_TLS_PLAIN;
 405
 406         /* Clamp the feature level the highest level we care about. The DNSSEC mode might have changed since the last
 407          * time, hence let's downgrade if we are still at a higher level. */
 408         if (s->possible_feature_level > best)
 409                 s->possible_feature_level = best;
 410
 411         if (s->possible_feature_level < best && dns_server_grace_period_expired(s)) {
 412
 413                 s->possible_feature_level = best;
 414
 415                 dns_server_reset_counters(s);
 416
 417                 s->packet_bad_opt = false;
 418                 s->packet_rrsig_missing = false;
 419
 420                 log_info("Grace period over, resuming full feature set (%s) for DNS server %s.",
 421                          dns_server_feature_level_to_string(s->possible_feature_level),
 422                          dns_server_string(s));
 423
 424                 dns_server_flush_cache(s);
 425
 426         } else if (s->possible_feature_level <= s->verified_feature_level)
 427                 s->possible_feature_level = s->verified_feature_level;
 428         else {
 429                 DnsServerFeatureLevel p = s->possible_feature_level;
 430
 431                 if (s->n_failed_tcp >= DNS_SERVER_FEATURE_RETRY_ATTEMPTS &&
 432                     s->possible_feature_level == DNS_SERVER_FEATURE_LEVEL_TCP) {
 433
 434                         /* We are at the TCP (lowest) level, and we tried a couple of TCP connections, and it didn't
 435                          * work. Upgrade back to UDP again. */
 436                         log_debug("Reached maximum number of failed TCP connection attempts, trying UDP again...");
 437                         s->possible_feature_level = DNS_SERVER_FEATURE_LEVEL_UDP;
 438                 } else if (s->n_failed_tls > 0 &&
 439                            DNS_SERVER_FEATURE_LEVEL_IS_TLS(s->possible_feature_level)) {
 440
 441                         /* We tried to connect using DNS-over-TLS, and it didn't work. Downgrade to plaintext UDP
 442                          * if we don't require DNS-over-TLS */
 443
 444                         log_debug("Server doesn't support DNS-over-TLS, downgrading protocol...");
 445                         s->possible_feature_level--;
 446                 } else if (s->packet_bad_opt &&
 447                            s->possible_feature_level >= DNS_SERVER_FEATURE_LEVEL_EDNS0) {
 448
 449                         /* A reply to one of our EDNS0 queries didn't carry a valid OPT RR, then downgrade to below
 450                          * EDNS0 levels. After all, some records generate different responses with and without OPT RR
 451                          * in the request. Example:
 452                          * https://open.nlnetlabs.nl/pipermail/dnssec-trigger/2014-November/000376.html */
 453
 454                         log_debug("Server doesn't support EDNS(0) properly, downgrading feature level...");
 455                         s->possible_feature_level = DNS_SERVER_FEATURE_LEVEL_UDP;
 456
 457                 } else if (s->packet_rrsig_missing &&
 458                            s->possible_feature_level >= DNS_SERVER_FEATURE_LEVEL_DO) {
 459
 460                         /* RRSIG data was missing on a EDNS0 packet with DO bit set. This means the server doesn't
 461                          * augment responses with DNSSEC RRs. If so, let's better not ask the server for it anymore,
 462                          * after all some servers generate different replies depending if an OPT RR is in the query or
 463                          * not. */
 464
 465                         log_debug("Detected server responses lack RRSIG records, downgrading feature level...");
 466                         s->possible_feature_level = DNS_SERVER_FEATURE_LEVEL_IS_TLS(s->possible_feature_level) ? DNS_SERVER_FEATURE_LEVEL_TLS_PLAIN : DNS_SERVER_FEATURE_LEVEL_EDNS0;
 467
 468                 } else if (s->n_failed_udp >= DNS_SERVER_FEATURE_RETRY_ATTEMPTS &&
 469                            s->possible_feature_level >= (dns_server_get_dnssec_mode(s) == DNSSEC_YES ? DNS_SERVER_FEATURE_LEVEL_LARGE : DNS_SERVER_FEATURE_LEVEL_UDP)) {
 470
 471                         /* We lost too many UDP packets in a row, and are on a feature level of UDP or higher. If the
 472                          * packets are lost, maybe the server cannot parse them, hence downgrading sounds like a good
 473                          * idea. We might downgrade all the way down to TCP this way.
 474                          *
 475                          * If strict DNSSEC mode is used we won't downgrade below DO level however, as packet loss
 476                          * might have many reasons, a broken DNSSEC implementation being only one reason. And if the
 477                          * user is strict on DNSSEC, then let's assume that DNSSEC is not the fault here. */
 478
 479                         log_debug("Lost too many UDP packets, downgrading feature level...");
 480                         s->possible_feature_level--;
 481
 482                 } else if (s->n_failed_tcp >= DNS_SERVER_FEATURE_RETRY_ATTEMPTS &&
 483                            s->packet_truncated &&
 484                            s->possible_feature_level > (dns_server_get_dnssec_mode(s) == DNSSEC_YES ? DNS_SERVER_FEATURE_LEVEL_LARGE : DNS_SERVER_FEATURE_LEVEL_UDP)) {
 485
 486                          /* We got too many TCP connection failures in a row, we had at least one truncated packet, and
 487                           * are on a feature level above UDP. By downgrading things and getting rid of DNSSEC or EDNS0
 488                           * data we hope to make the packet smaller, so that it still works via UDP given that TCP
 489                           * appears not to be a fallback. Note that if we are already at the lowest UDP level, we don't
 490                           * go further down, since that's TCP, and TCP failed too often after all. */
 491
 492                         log_debug("Got too many failed TCP connection failures and truncated UDP packets, downgrading feature level...");
 493                         s->possible_feature_level--;
 494                 }
 495
 496                 if (p != s->possible_feature_level) {
 497
 498                         /* We changed the feature level, reset the counting */
 499                         dns_server_reset_counters(s);
 500
 501                         log_warning("Using degraded feature set (%s) for DNS server %s.",
 502                                     dns_server_feature_level_to_string(s->possible_feature_level),
 503                                     dns_server_string(s));
 504                 }
 505         }
 506
 507         return s->possible_feature_level;
 508 }
 509
 510 int dns_server_adjust_opt(DnsServer *server, DnsPacket *packet, DnsServerFeatureLevel level) {
 511         size_t packet_size;
 512         bool edns_do;
 513         int r;
 514
 515         assert(server);
 516         assert(packet);
 517         assert(packet->protocol == DNS_PROTOCOL_DNS);
 518
 519         /* Fix the OPT field in the packet to match our current feature level. */
 520
 521         r = dns_packet_truncate_opt(packet);
 522         if (r < 0)
 523                 return r;
 524
 525         if (level < DNS_SERVER_FEATURE_LEVEL_EDNS0)
 526                 return 0;
 527
 528         edns_do = level >= DNS_SERVER_FEATURE_LEVEL_DO;
 529
 530         if (level >= DNS_SERVER_FEATURE_LEVEL_LARGE)
 531                 packet_size = DNS_PACKET_UNICAST_SIZE_LARGE_MAX;
 532         else
 533                 packet_size = server->received_udp_packet_max;
 534
 535         return dns_packet_append_opt(packet, packet_size, edns_do, 0, NULL);
 536 }
 537
 538 int dns_server_ifindex(const DnsServer *s) {
 539         assert(s);
 540
 541         /* The link ifindex always takes precedence */
 542         if (s->link)
 543                 return s->link->ifindex;
 544
 545         if (s->ifindex > 0)
 546                 return s->ifindex;
 547
 548         return 0;
 549 }
 550
 551 const char *dns_server_string(DnsServer *server) {
 552         assert(server);
 553
 554         if (!server->server_string)
 555                 (void) in_addr_ifindex_to_string(server->family, &server->address, dns_server_ifindex(server), &server->server_string);
 556
 557         return strna(server->server_string);
 558 }
 559
 560 bool dns_server_dnssec_supported(DnsServer *server) {
 561         assert(server);
 562
 563         /* Returns whether the server supports DNSSEC according to what we know about it */
 564
 565         if (server->possible_feature_level < DNS_SERVER_FEATURE_LEVEL_DO)
 566                 return false;
 567
 568         if (server->packet_bad_opt)
 569                 return false;
 570
 571         if (server->packet_rrsig_missing)
 572                 return false;
 573
 574         /* DNSSEC servers need to support TCP properly (see RFC5966), if they don't, we assume DNSSEC is borked too */
 575         if (server->n_failed_tcp >= DNS_SERVER_FEATURE_RETRY_ATTEMPTS)
 576                 return false;
 577
 578         return true;
 579 }
 580
 581 void dns_server_warn_downgrade(DnsServer *server) {
 582         assert(server);
 583
 584         if (server->warned_downgrade)
 585                 return;
 586
 587         log_struct(LOG_NOTICE,
 588                    "MESSAGE_ID=" SD_MESSAGE_DNSSEC_DOWNGRADE_STR,
 589                    LOG_MESSAGE("Server %s does not support DNSSEC, downgrading to non-DNSSEC mode.", dns_server_string(server)),
 590                    "DNS_SERVER=%s", dns_server_string(server),
 591                    "DNS_SERVER_FEATURE_LEVEL=%s", dns_server_feature_level_to_string(server->possible_feature_level));
 592
 593         server->warned_downgrade = true;
 594 }
 595
 596 bool dns_server_limited_domains(DnsServer *server) {
 597         DnsSearchDomain *domain;
 598         bool domain_restricted = false;
 599
 600         /* Check if the server has route-only domains without ~., i. e. whether
 601          * it should only be used for particular domains */
 602         if (!server->link)
 603                 return false;
 604
 605         LIST_FOREACH(domains, domain, server->link->search_domains)
 606                 if (domain->route_only) {
 607                         domain_restricted = true;
 608                         /* ~. means "any domain", thus it is a global server */
 609                         if (dns_name_is_root(DNS_SEARCH_DOMAIN_NAME(domain)))
 610                                 return false;
 611                 }
 612
 613         return domain_restricted;
 614 }
 615
 616 static void dns_server_hash_func(const void *p, struct siphash *state) {
 617         const DnsServer *s = p;
 618
 619         assert(s);
 620
 621         siphash24_compress(&s->family, sizeof(s->family), state);
 622         siphash24_compress(&s->address, FAMILY_ADDRESS_SIZE(s->family), state);
 623         siphash24_compress(&s->ifindex, sizeof(s->ifindex), state);
 624 }
 625
 626 static int dns_server_compare_func(const void *a, const void *b) {
 627         const DnsServer *x = a, *y = b;
 628         int r;
 629
 630         if (x->family < y->family)
 631                 return -1;
 632         if (x->family > y->family)
 633                 return 1;
 634
 635         r = memcmp(&x->address, &y->address, FAMILY_ADDRESS_SIZE(x->family));
 636         if (r != 0)
 637                 return r;
 638
 639         if (x->ifindex < y->ifindex)
 640                 return -1;
 641         if (x->ifindex > y->ifindex)
 642                 return 1;
 643
 644         return 0;
 645 }
 646
 647 const struct hash_ops dns_server_hash_ops = {
 648         .hash = dns_server_hash_func,
 649         .compare = dns_server_compare_func
 650 };
 651
 652 void dns_server_unlink_all(DnsServer *first) {
 653         DnsServer *next;
 654
 655         if (!first)
 656                 return;
 657
 658         next = first->servers_next;
 659         dns_server_unlink(first);
 660
 661         dns_server_unlink_all(next);
 662 }
 663
 664 void dns_server_unlink_marked(DnsServer *first) {
 665         DnsServer *next;
 666
 667         if (!first)
 668                 return;
 669
 670         next = first->servers_next;
 671
 672         if (first->marked)
 673                 dns_server_unlink(first);
 674
 675         dns_server_unlink_marked(next);
 676 }
 677
 678 void dns_server_mark_all(DnsServer *first) {
 679         if (!first)
 680                 return;
 681
 682         first->marked = true;
 683         dns_server_mark_all(first->servers_next);
 684 }
 685
 686 DnsServer *dns_server_find(DnsServer *first, int family, const union in_addr_union *in_addr, int ifindex) {
 687         DnsServer *s;
 688
 689         LIST_FOREACH(servers, s, first)
 690                 if (s->family == family && in_addr_equal(family, &s->address, in_addr) > 0 && s->ifindex == ifindex)
 691                         return s;
 692
 693         return NULL;
 694 }
 695
 696 DnsServer *manager_get_first_dns_server(Manager *m, DnsServerType t) {
 697         assert(m);
 698
 699         switch (t) {
 700
 701         case DNS_SERVER_SYSTEM:
 702                 return m->dns_servers;
 703
 704         case DNS_SERVER_FALLBACK:
 705                 return m->fallback_dns_servers;
 706
 707         default:
 708                 return NULL;
 709         }
 710 }
 711
 712 DnsServer *manager_set_dns_server(Manager *m, DnsServer *s) {
 713         assert(m);
 714
 715         if (m->current_dns_server == s)
 716                 return s;
 717
 718         if (s)
 719                 log_debug("Switching to %s DNS server %s.",
 720                           dns_server_type_to_string(s->type),
 721                           dns_server_string(s));
 722
 723         dns_server_unref(m->current_dns_server);
 724         m->current_dns_server = dns_server_ref(s);
 725
 726         if (m->unicast_scope)
 727                 dns_cache_flush(&m->unicast_scope->cache);
 728
 729         return s;
 730 }
 731
 732 DnsServer *manager_get_dns_server(Manager *m) {
 733         Link *l;
 734         assert(m);
 735
 736         /* Try to read updates resolv.conf */
 737         manager_read_resolv_conf(m);
 738
 739         /* If no DNS server was chosen so far, pick the first one */
 740         if (!m->current_dns_server)
 741                 manager_set_dns_server(m, m->dns_servers);
 742
 743         if (!m->current_dns_server) {
 744                 bool found = false;
 745                 Iterator i;
 746
 747                 /* No DNS servers configured, let's see if there are
 748                  * any on any links. If not, we use the fallback
 749                  * servers */
 750
 751                 HASHMAP_FOREACH(l, m->links, i)
 752                         if (l->dns_servers) {
 753                                 found = true;
 754                                 break;
 755                         }
 756
 757                 if (!found)
 758                         manager_set_dns_server(m, m->fallback_dns_servers);
 759         }
 760
 761         return m->current_dns_server;
 762 }
 763
 764 void manager_next_dns_server(Manager *m) {
 765         assert(m);
 766
 767         /* If there's currently no DNS server set, then the next
 768          * manager_get_dns_server() will find one */
 769         if (!m->current_dns_server)
 770                 return;
 771
 772         /* Change to the next one, but make sure to follow the linked
 773          * list only if the server is still linked. */
 774         if (m->current_dns_server->linked && m->current_dns_server->servers_next) {
 775                 manager_set_dns_server(m, m->current_dns_server->servers_next);
 776                 return;
 777         }
 778
 779         /* If there was no next one, then start from the beginning of
 780          * the list */
 781         if (m->current_dns_server->type == DNS_SERVER_FALLBACK)
 782                 manager_set_dns_server(m, m->fallback_dns_servers);
 783         else
 784                 manager_set_dns_server(m, m->dns_servers);
 785 }
 786
 787 bool dns_server_address_valid(int family, const union in_addr_union *sa) {
 788
 789         /* Refuses the 0 IP addresses as well as 127.0.0.53 (which is our own DNS stub) */
 790
 791         if (in_addr_is_null(family, sa))
 792                 return false;
 793
 794         if (family == AF_INET && sa->in.s_addr == htobe32(INADDR_DNS_STUB))
 795                 return false;
 796
 797         return true;
 798 }
 799
 800 DnssecMode dns_server_get_dnssec_mode(DnsServer *s) {
 801         assert(s);
 802
 803         if (s->link)
 804                 return link_get_dnssec_mode(s->link);
 805
 806         return manager_get_dnssec_mode(s->manager);
 807 }
 808
 809 DnsOverTlsMode dns_server_get_dns_over_tls_mode(DnsServer *s) {
 810         assert(s);
 811
 812         if (s->link)
 813                 return link_get_dns_over_tls_mode(s->link);
 814
 815         return manager_get_dns_over_tls_mode(s->manager);
 816 }
 817
 818 void dns_server_flush_cache(DnsServer *s) {
 819         DnsServer *current;
 820         DnsScope *scope;
 821
 822         assert(s);
 823
 824         /* Flush the cache of the scope this server belongs to */
 825
 826         current = s->link ? s->link->current_dns_server : s->manager->current_dns_server;
 827         if (current != s)
 828                 return;
 829
 830         scope = s->link ? s->link->unicast_scope : s->manager->unicast_scope;
 831         if (!scope)
 832                 return;
 833
 834         dns_cache_flush(&scope->cache);
 835 }
 836
 837 void dns_server_reset_features(DnsServer *s) {
 838         assert(s);
 839
 840         s->verified_feature_level = _DNS_SERVER_FEATURE_LEVEL_INVALID;
 841         s->possible_feature_level = DNS_SERVER_FEATURE_LEVEL_BEST;
 842
 843         s->received_udp_packet_max = DNS_PACKET_UNICAST_SIZE_MAX;
 844
 845         s->packet_bad_opt = false;
 846         s->packet_rrsig_missing = false;
 847
 848         s->features_grace_period_usec = DNS_SERVER_FEATURE_GRACE_PERIOD_MIN_USEC;
 849
 850         s->warned_downgrade = false;
 851
 852         dns_server_reset_counters(s);
 853 }
 854
 855 void dns_server_reset_features_all(DnsServer *s) {
 856         DnsServer *i;
 857
 858         LIST_FOREACH(servers, i, s)
 859                 dns_server_reset_features(i);
 860 }
 861
 862 void dns_server_dump(DnsServer *s, FILE *f) {
 863         assert(s);
 864
 865         if (!f)
 866                 f = stdout;
 867
 868         fputs("[Server ", f);
 869         fputs(dns_server_string(s), f);
 870         fputs(" type=", f);
 871         fputs(dns_server_type_to_string(s->type), f);
 872
 873         if (s->type == DNS_SERVER_LINK) {
 874                 assert(s->link);
 875
 876                 fputs(" interface=", f);
 877                 fputs(s->link->name, f);
 878         }
 879
 880         fputs("]\n", f);
 881
 882         fputs("\tVerified feature level: ", f);
 883         fputs(strna(dns_server_feature_level_to_string(s->verified_feature_level)), f);
 884         fputc('\n', f);
 885
 886         fputs("\tPossible feature level: ", f);
 887         fputs(strna(dns_server_feature_level_to_string(s->possible_feature_level)), f);
 888         fputc('\n', f);
 889
 890         fputs("\tDNSSEC Mode: ", f);
 891         fputs(strna(dnssec_mode_to_string(dns_server_get_dnssec_mode(s))), f);
 892         fputc('\n', f);
 893
 894         fputs("\tCan do DNSSEC: ", f);
 895         fputs(yes_no(dns_server_dnssec_supported(s)), f);
 896         fputc('\n', f);
 897
 898         fprintf(f,
 899                 "\tMaximum UDP packet size received: %zu\n"
 900                 "\tFailed UDP attempts: %u\n"
 901                 "\tFailed TCP attempts: %u\n"
 902                 "\tSeen truncated packet: %s\n"
 903                 "\tSeen OPT RR getting lost: %s\n"
 904                 "\tSeen RRSIG RR missing: %s\n",
 905                 s->received_udp_packet_max,
 906                 s->n_failed_udp,
 907                 s->n_failed_tcp,
 908                 yes_no(s->packet_truncated),
 909                 yes_no(s->packet_bad_opt),
 910                 yes_no(s->packet_rrsig_missing));
 911 }
 912
 913 static const char* const dns_server_type_table[_DNS_SERVER_TYPE_MAX] = {
 914         [DNS_SERVER_SYSTEM] = "system",
 915         [DNS_SERVER_FALLBACK] = "fallback",
 916         [DNS_SERVER_LINK] = "link",
 917 };
 918 DEFINE_STRING_TABLE_LOOKUP(dns_server_type, DnsServerType);
 919
 920 static const char* const dns_server_feature_level_table[_DNS_SERVER_FEATURE_LEVEL_MAX] = {
 921         [DNS_SERVER_FEATURE_LEVEL_TCP] = "TCP",
 922         [DNS_SERVER_FEATURE_LEVEL_UDP] = "UDP",
 923         [DNS_SERVER_FEATURE_LEVEL_EDNS0] = "UDP+EDNS0",
 924         [DNS_SERVER_FEATURE_LEVEL_TLS_PLAIN] = "TLS+EDNS0",
 925         [DNS_SERVER_FEATURE_LEVEL_DO] = "UDP+EDNS0+DO",
 926         [DNS_SERVER_FEATURE_LEVEL_LARGE] = "UDP+EDNS0+DO+LARGE",
 927         [DNS_SERVER_FEATURE_LEVEL_TLS_DO] = "TLS+EDNS0+D0",
 928 };
 929 DEFINE_STRING_TABLE_LOOKUP(dns_server_feature_level, DnsServerFeatureLevel);