src/resolve/resolved-dns-server.c

   1 /***
   2   This file is part of systemd.
   3
   4   Copyright 2014 Lennart Poettering
   5
   6   systemd is free software; you can redistribute it and/or modify it
   7   under the terms of the GNU Lesser General Public License as published by
   8   the Free Software Foundation; either version 2.1 of the License, or
   9   (at your option) any later version.
  10
  11   systemd is distributed in the hope that it will be useful, but
  12   WITHOUT ANY WARRANTY; without even the implied warranty of
  13   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  14   Lesser General Public License for more details.
  15
  16   You should have received a copy of the GNU Lesser General Public License
  17   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  18 ***/
  19
  20 #include <sd-messages.h>
  21
  22 #include "alloc-util.h"
  23 #include "resolved-dns-server.h"
  24 #include "resolved-dns-stub.h"
  25 #include "resolved-resolv-conf.h"
  26 #include "siphash24.h"
  27 #include "string-table.h"
  28 #include "string-util.h"
  29
  30 /* After how much time to repeat classic DNS requests */
  31 #define DNS_TIMEOUT_MIN_USEC (500 * USEC_PER_MSEC)
  32 #define DNS_TIMEOUT_MAX_USEC (5 * USEC_PER_SEC)
  33
  34 /* The amount of time to wait before retrying with a full feature set */
  35 #define DNS_SERVER_FEATURE_GRACE_PERIOD_MAX_USEC (6 * USEC_PER_HOUR)
  36 #define DNS_SERVER_FEATURE_GRACE_PERIOD_MIN_USEC (5 * USEC_PER_MINUTE)
  37
  38 /* The number of times we will attempt a certain feature set before degrading */
  39 #define DNS_SERVER_FEATURE_RETRY_ATTEMPTS 3
  40
  41 int dns_server_new(
  42                 Manager *m,
  43                 DnsServer **ret,
  44                 DnsServerType type,
  45                 Link *l,
  46                 int family,
  47                 const union in_addr_union *in_addr,
  48                 int ifindex) {
  49
  50         DnsServer *s;
  51
  52         assert(m);
  53         assert((type == DNS_SERVER_LINK) == !!l);
  54         assert(in_addr);
  55
  56         if (!IN_SET(family, AF_INET, AF_INET6))
  57                 return -EAFNOSUPPORT;
  58
  59         if (l) {
  60                 if (l->n_dns_servers >= LINK_DNS_SERVERS_MAX)
  61                         return -E2BIG;
  62         } else {
  63                 if (m->n_dns_servers >= MANAGER_DNS_SERVERS_MAX)
  64                         return -E2BIG;
  65         }
  66
  67         s = new0(DnsServer, 1);
  68         if (!s)
  69                 return -ENOMEM;
  70
  71         s->n_ref = 1;
  72         s->manager = m;
  73         s->verified_feature_level = _DNS_SERVER_FEATURE_LEVEL_INVALID;
  74         s->possible_feature_level = DNS_SERVER_FEATURE_LEVEL_BEST;
  75         s->features_grace_period_usec = DNS_SERVER_FEATURE_GRACE_PERIOD_MIN_USEC;
  76         s->received_udp_packet_max = DNS_PACKET_UNICAST_SIZE_MAX;
  77         s->type = type;
  78         s->family = family;
  79         s->address = *in_addr;
  80         s->ifindex = ifindex;
  81         s->resend_timeout = DNS_TIMEOUT_MIN_USEC;
  82
  83         switch (type) {
  84
  85         case DNS_SERVER_LINK:
  86                 s->link = l;
  87                 LIST_APPEND(servers, l->dns_servers, s);
  88                 l->n_dns_servers++;
  89                 break;
  90
  91         case DNS_SERVER_SYSTEM:
  92                 LIST_APPEND(servers, m->dns_servers, s);
  93                 m->n_dns_servers++;
  94                 break;
  95
  96         case DNS_SERVER_FALLBACK:
  97                 LIST_APPEND(servers, m->fallback_dns_servers, s);
  98                 m->n_dns_servers++;
  99                 break;
 100
 101         default:
 102                 assert_not_reached("Unknown server type");
 103         }
 104
 105         s->linked = true;
 106
 107         /* A new DNS server that isn't fallback is added and the one
 108          * we used so far was a fallback one? Then let's try to pick
 109          * the new one */
 110         if (type != DNS_SERVER_FALLBACK &&
 111             m->current_dns_server &&
 112             m->current_dns_server->type == DNS_SERVER_FALLBACK)
 113                 manager_set_dns_server(m, NULL);
 114
 115         if (ret)
 116                 *ret = s;
 117
 118         return 0;
 119 }
 120
 121 DnsServer* dns_server_ref(DnsServer *s)  {
 122         if (!s)
 123                 return NULL;
 124
 125         assert(s->n_ref > 0);
 126         s->n_ref++;
 127
 128         return s;
 129 }
 130
 131 DnsServer* dns_server_unref(DnsServer *s)  {
 132         if (!s)
 133                 return NULL;
 134
 135         assert(s->n_ref > 0);
 136         s->n_ref--;
 137
 138         if (s->n_ref > 0)
 139                 return NULL;
 140
 141         free(s->server_string);
 142         free(s);
 143         return NULL;
 144 }
 145
 146 void dns_server_unlink(DnsServer *s) {
 147         assert(s);
 148         assert(s->manager);
 149
 150         /* This removes the specified server from the linked list of
 151          * servers, but any server might still stay around if it has
 152          * refs, for example from an ongoing transaction. */
 153
 154         if (!s->linked)
 155                 return;
 156
 157         switch (s->type) {
 158
 159         case DNS_SERVER_LINK:
 160                 assert(s->link);
 161                 assert(s->link->n_dns_servers > 0);
 162                 LIST_REMOVE(servers, s->link->dns_servers, s);
 163                 s->link->n_dns_servers--;
 164                 break;
 165
 166         case DNS_SERVER_SYSTEM:
 167                 assert(s->manager->n_dns_servers > 0);
 168                 LIST_REMOVE(servers, s->manager->dns_servers, s);
 169                 s->manager->n_dns_servers--;
 170                 break;
 171
 172         case DNS_SERVER_FALLBACK:
 173                 assert(s->manager->n_dns_servers > 0);
 174                 LIST_REMOVE(servers, s->manager->fallback_dns_servers, s);
 175                 s->manager->n_dns_servers--;
 176                 break;
 177         }
 178
 179         s->linked = false;
 180
 181         if (s->link && s->link->current_dns_server == s)
 182                 link_set_dns_server(s->link, NULL);
 183
 184         if (s->manager->current_dns_server == s)
 185                 manager_set_dns_server(s->manager, NULL);
 186
 187         dns_server_unref(s);
 188 }
 189
 190 void dns_server_move_back_and_unmark(DnsServer *s) {
 191         DnsServer *tail;
 192
 193         assert(s);
 194
 195         if (!s->marked)
 196                 return;
 197
 198         s->marked = false;
 199
 200         if (!s->linked || !s->servers_next)
 201                 return;
 202
 203         /* Move us to the end of the list, so that the order is
 204          * strictly kept, if we are not at the end anyway. */
 205
 206         switch (s->type) {
 207
 208         case DNS_SERVER_LINK:
 209                 assert(s->link);
 210                 LIST_FIND_TAIL(servers, s, tail);
 211                 LIST_REMOVE(servers, s->link->dns_servers, s);
 212                 LIST_INSERT_AFTER(servers, s->link->dns_servers, tail, s);
 213                 break;
 214
 215         case DNS_SERVER_SYSTEM:
 216                 LIST_FIND_TAIL(servers, s, tail);
 217                 LIST_REMOVE(servers, s->manager->dns_servers, s);
 218                 LIST_INSERT_AFTER(servers, s->manager->dns_servers, tail, s);
 219                 break;
 220
 221         case DNS_SERVER_FALLBACK:
 222                 LIST_FIND_TAIL(servers, s, tail);
 223                 LIST_REMOVE(servers, s->manager->fallback_dns_servers, s);
 224                 LIST_INSERT_AFTER(servers, s->manager->fallback_dns_servers, tail, s);
 225                 break;
 226
 227         default:
 228                 assert_not_reached("Unknown server type");
 229         }
 230 }
 231
 232 static void dns_server_verified(DnsServer *s, DnsServerFeatureLevel level) {
 233         assert(s);
 234
 235         if (s->verified_feature_level > level)
 236                 return;
 237
 238         if (s->verified_feature_level != level) {
 239                 log_debug("Verified we get a response at feature level %s from DNS server %s.",
 240                           dns_server_feature_level_to_string(level),
 241                           dns_server_string(s));
 242                 s->verified_feature_level = level;
 243         }
 244
 245         assert_se(sd_event_now(s->manager->event, clock_boottime_or_monotonic(), &s->verified_usec) >= 0);
 246 }
 247
 248 static void dns_server_reset_counters(DnsServer *s) {
 249         assert(s);
 250
 251         s->n_failed_udp = 0;
 252         s->n_failed_tcp = 0;
 253         s->packet_truncated = false;
 254         s->verified_usec = 0;
 255
 256         /* Note that we do not reset s->packet_bad_opt and s->packet_rrsig_missing here. We reset them only when the
 257          * grace period ends, but not when lowering the possible feature level, as a lower level feature level should
 258          * not make RRSIGs appear or OPT appear, but rather make them disappear. If the reappear anyway, then that's
 259          * indication for a differently broken OPT/RRSIG implementation, and we really don't want to support that
 260          * either.
 261          *
 262          * This is particularly important to deal with certain Belkin routers which break OPT for certain lookups (A),
 263          * but pass traffic through for others (AAAA). If we detect the broken behaviour on one lookup we should not
 264          * reenable it for another, because we cannot validate things anyway, given that the RRSIG/OPT data will be
 265          * incomplete. */
 266 }
 267
 268 void dns_server_packet_received(DnsServer *s, int protocol, DnsServerFeatureLevel level, usec_t rtt, size_t size) {
 269         assert(s);
 270
 271         if (protocol == IPPROTO_UDP) {
 272                 if (s->possible_feature_level == level)
 273                         s->n_failed_udp = 0;
 274
 275                 /* If the RRSIG data is missing, then we can only validate EDNS0 at max */
 276                 if (s->packet_rrsig_missing && level >= DNS_SERVER_FEATURE_LEVEL_DO)
 277                         level = DNS_SERVER_FEATURE_LEVEL_DO - 1;
 278
 279                 /* If the OPT RR got lost, then we can only validate UDP at max */
 280                 if (s->packet_bad_opt && level >= DNS_SERVER_FEATURE_LEVEL_EDNS0)
 281                         level = DNS_SERVER_FEATURE_LEVEL_EDNS0 - 1;
 282
 283                 /* Even if we successfully receive a reply to a request announcing support for large packets,
 284                    that does not mean we can necessarily receive large packets. */
 285                 if (level == DNS_SERVER_FEATURE_LEVEL_LARGE)
 286                         level = DNS_SERVER_FEATURE_LEVEL_LARGE - 1;
 287
 288         } else if (protocol == IPPROTO_TCP) {
 289
 290                 if (s->possible_feature_level == level)
 291                         s->n_failed_tcp = 0;
 292
 293                 /* Successful TCP connections are only useful to verify the TCP feature level. */
 294                 level = DNS_SERVER_FEATURE_LEVEL_TCP;
 295         }
 296
 297         dns_server_verified(s, level);
 298
 299         /* Remember the size of the largest UDP packet we received from a server,
 300            we know that we can always announce support for packets with at least
 301            this size. */
 302         if (protocol == IPPROTO_UDP && s->received_udp_packet_max < size)
 303                 s->received_udp_packet_max = size;
 304
 305         if (s->max_rtt < rtt) {
 306                 s->max_rtt = rtt;
 307                 s->resend_timeout = CLAMP(s->max_rtt * 2, DNS_TIMEOUT_MIN_USEC, DNS_TIMEOUT_MAX_USEC);
 308         }
 309 }
 310
 311 void dns_server_packet_lost(DnsServer *s, int protocol, DnsServerFeatureLevel level, usec_t usec) {
 312         assert(s);
 313         assert(s->manager);
 314
 315         if (s->possible_feature_level == level) {
 316                 if (protocol == IPPROTO_UDP)
 317                         s->n_failed_udp++;
 318                 else if (protocol == IPPROTO_TCP)
 319                         s->n_failed_tcp++;
 320         }
 321
 322         if (s->resend_timeout > usec)
 323                 return;
 324
 325         s->resend_timeout = MIN(s->resend_timeout * 2, DNS_TIMEOUT_MAX_USEC);
 326 }
 327
 328 void dns_server_packet_truncated(DnsServer *s, DnsServerFeatureLevel level) {
 329         assert(s);
 330
 331         /* Invoked whenever we get a packet with TC bit set. */
 332
 333         if (s->possible_feature_level != level)
 334                 return;
 335
 336         s->packet_truncated = true;
 337 }
 338
 339 void dns_server_packet_rrsig_missing(DnsServer *s, DnsServerFeatureLevel level) {
 340         assert(s);
 341
 342         if (level < DNS_SERVER_FEATURE_LEVEL_DO)
 343                 return;
 344
 345         /* If the RRSIG RRs are missing, we have to downgrade what we previously verified */
 346         if (s->verified_feature_level >= DNS_SERVER_FEATURE_LEVEL_DO)
 347                 s->verified_feature_level = DNS_SERVER_FEATURE_LEVEL_DO-1;
 348
 349         s->packet_rrsig_missing = true;
 350 }
 351
 352 void dns_server_packet_bad_opt(DnsServer *s, DnsServerFeatureLevel level) {
 353         assert(s);
 354
 355         if (level < DNS_SERVER_FEATURE_LEVEL_EDNS0)
 356                 return;
 357
 358         /* If the OPT RR got lost, we have to downgrade what we previously verified */
 359         if (s->verified_feature_level >= DNS_SERVER_FEATURE_LEVEL_EDNS0)
 360                 s->verified_feature_level = DNS_SERVER_FEATURE_LEVEL_EDNS0-1;
 361
 362         s->packet_bad_opt = true;
 363 }
 364
 365 void dns_server_packet_rcode_downgrade(DnsServer *s, DnsServerFeatureLevel level) {
 366         assert(s);
 367
 368         /* Invoked whenever we got a FORMERR, SERVFAIL or NOTIMP rcode from a server and downgrading the feature level
 369          * for the transaction made it go away. In this case we immediately downgrade to the feature level that made
 370          * things work. */
 371
 372         if (s->verified_feature_level > level)
 373                 s->verified_feature_level = level;
 374
 375         if (s->possible_feature_level > level) {
 376                 s->possible_feature_level = level;
 377                 dns_server_reset_counters(s);
 378         }
 379
 380         log_debug("Downgrading transaction feature level fixed an RCODE error, downgrading server %s too.", dns_server_string(s));
 381 }
 382
 383 static bool dns_server_grace_period_expired(DnsServer *s) {
 384         usec_t ts;
 385
 386         assert(s);
 387         assert(s->manager);
 388
 389         if (s->verified_usec == 0)
 390                 return false;
 391
 392         assert_se(sd_event_now(s->manager->event, clock_boottime_or_monotonic(), &ts) >= 0);
 393
 394         if (s->verified_usec + s->features_grace_period_usec > ts)
 395                 return false;
 396
 397         s->features_grace_period_usec = MIN(s->features_grace_period_usec * 2, DNS_SERVER_FEATURE_GRACE_PERIOD_MAX_USEC);
 398
 399         return true;
 400 }
 401
 402 DnsServerFeatureLevel dns_server_possible_feature_level(DnsServer *s) {
 403         assert(s);
 404
 405         if (s->possible_feature_level != DNS_SERVER_FEATURE_LEVEL_BEST &&
 406             dns_server_grace_period_expired(s)) {
 407
 408                 s->possible_feature_level = DNS_SERVER_FEATURE_LEVEL_BEST;
 409
 410                 dns_server_reset_counters(s);
 411
 412                 s->packet_bad_opt = false;
 413                 s->packet_rrsig_missing = false;
 414
 415                 log_info("Grace period over, resuming full feature set (%s) for DNS server %s.",
 416                          dns_server_feature_level_to_string(s->possible_feature_level),
 417                          dns_server_string(s));
 418
 419         } else if (s->possible_feature_level <= s->verified_feature_level)
 420                 s->possible_feature_level = s->verified_feature_level;
 421         else {
 422                 DnsServerFeatureLevel p = s->possible_feature_level;
 423
 424                 if (s->n_failed_tcp >= DNS_SERVER_FEATURE_RETRY_ATTEMPTS &&
 425                     s->possible_feature_level == DNS_SERVER_FEATURE_LEVEL_TCP) {
 426
 427                         /* We are at the TCP (lowest) level, and we tried a couple of TCP connections, and it didn't
 428                          * work. Upgrade back to UDP again. */
 429                         log_debug("Reached maximum number of failed TCP connection attempts, trying UDP again...");
 430                         s->possible_feature_level = DNS_SERVER_FEATURE_LEVEL_UDP;
 431
 432                 } else if (s->packet_bad_opt &&
 433                            s->possible_feature_level >= DNS_SERVER_FEATURE_LEVEL_EDNS0) {
 434
 435                         /* A reply to one of our EDNS0 queries didn't carry a valid OPT RR, then downgrade to below
 436                          * EDNS0 levels. After all, some records generate different responses with and without OPT RR
 437                          * in the request. Example:
 438                          * https://open.nlnetlabs.nl/pipermail/dnssec-trigger/2014-November/000376.html */
 439
 440                         log_debug("Server doesn't support EDNS(0) properly, downgrading feature level...");
 441                         s->possible_feature_level = DNS_SERVER_FEATURE_LEVEL_UDP;
 442
 443                 } else if (s->packet_rrsig_missing &&
 444                            s->possible_feature_level >= DNS_SERVER_FEATURE_LEVEL_DO) {
 445
 446                         /* RRSIG data was missing on a EDNS0 packet with DO bit set. This means the server doesn't
 447                          * augment responses with DNSSEC RRs. If so, let's better not ask the server for it anymore,
 448                          * after all some servers generate different replies depending if an OPT RR is in the query or
 449                          * not. */
 450
 451                         log_debug("Detected server responses lack RRSIG records, downgrading feature level...");
 452                         s->possible_feature_level = DNS_SERVER_FEATURE_LEVEL_EDNS0;
 453
 454                 } else if (s->n_failed_udp >= DNS_SERVER_FEATURE_RETRY_ATTEMPTS &&
 455                             s->possible_feature_level >= DNS_SERVER_FEATURE_LEVEL_UDP) {
 456
 457                         /* We lost too many UDP packets in a row, and are on a feature level of UDP or higher. If the
 458                          * packets are lost, maybe the server cannot parse them, hence downgrading sounds like a good
 459                          * idea. We might downgrade all the way down to TCP this way. */
 460
 461                         log_debug("Lost too many UDP packets, downgrading feature level...");
 462                         s->possible_feature_level--;
 463
 464                 } else if (s->n_failed_tcp >= DNS_SERVER_FEATURE_RETRY_ATTEMPTS &&
 465                            s->packet_truncated &&
 466                            s->possible_feature_level > DNS_SERVER_FEATURE_LEVEL_UDP) {
 467
 468                          /* We got too many TCP connection failures in a row, we had at least one truncated packet, and
 469                           * are on a feature level above UDP. By downgrading things and getting rid of DNSSEC or EDNS0
 470                           * data we hope to make the packet smaller, so that it still works via UDP given that TCP
 471                           * appears not to be a fallback. Note that if we are already at the lowest UDP level, we don't
 472                           * go further down, since that's TCP, and TCP failed too often after all. */
 473
 474                         log_debug("Got too many failed TCP connection failures and truncated UDP packets, downgrading feature level...");
 475                         s->possible_feature_level--;
 476                 }
 477
 478                 if (p != s->possible_feature_level) {
 479
 480                         /* We changed the feature level, reset the counting */
 481                         dns_server_reset_counters(s);
 482
 483                         log_warning("Using degraded feature set (%s) for DNS server %s.",
 484                                     dns_server_feature_level_to_string(s->possible_feature_level),
 485                                     dns_server_string(s));
 486                 }
 487         }
 488
 489         return s->possible_feature_level;
 490 }
 491
 492 int dns_server_adjust_opt(DnsServer *server, DnsPacket *packet, DnsServerFeatureLevel level) {
 493         size_t packet_size;
 494         bool edns_do;
 495         int r;
 496
 497         assert(server);
 498         assert(packet);
 499         assert(packet->protocol == DNS_PROTOCOL_DNS);
 500
 501         /* Fix the OPT field in the packet to match our current feature level. */
 502
 503         r = dns_packet_truncate_opt(packet);
 504         if (r < 0)
 505                 return r;
 506
 507         if (level < DNS_SERVER_FEATURE_LEVEL_EDNS0)
 508                 return 0;
 509
 510         edns_do = level >= DNS_SERVER_FEATURE_LEVEL_DO;
 511
 512         if (level >= DNS_SERVER_FEATURE_LEVEL_LARGE)
 513                 packet_size = DNS_PACKET_UNICAST_SIZE_LARGE_MAX;
 514         else
 515                 packet_size = server->received_udp_packet_max;
 516
 517         return dns_packet_append_opt(packet, packet_size, edns_do, 0, NULL);
 518 }
 519
 520 int dns_server_ifindex(const DnsServer *s) {
 521         assert(s);
 522
 523         /* The link ifindex always takes precedence */
 524         if (s->link)
 525                 return s->link->ifindex;
 526
 527         if (s->ifindex > 0)
 528                 return s->ifindex;
 529
 530         return 0;
 531 }
 532
 533 const char *dns_server_string(DnsServer *server) {
 534         assert(server);
 535
 536         if (!server->server_string)
 537                 (void) in_addr_ifindex_to_string(server->family, &server->address, dns_server_ifindex(server), &server->server_string);
 538
 539         return strna(server->server_string);
 540 }
 541
 542 bool dns_server_dnssec_supported(DnsServer *server) {
 543         assert(server);
 544
 545         /* Returns whether the server supports DNSSEC according to what we know about it */
 546
 547         if (server->possible_feature_level < DNS_SERVER_FEATURE_LEVEL_DO)
 548                 return false;
 549
 550         if (server->packet_bad_opt)
 551                 return false;
 552
 553         if (server->packet_rrsig_missing)
 554                 return false;
 555
 556         /* DNSSEC servers need to support TCP properly (see RFC5966), if they don't, we assume DNSSEC is borked too */
 557         if (server->n_failed_tcp >= DNS_SERVER_FEATURE_RETRY_ATTEMPTS)
 558                 return false;
 559
 560         return true;
 561 }
 562
 563 void dns_server_warn_downgrade(DnsServer *server) {
 564         assert(server);
 565
 566         if (server->warned_downgrade)
 567                 return;
 568
 569         log_struct(LOG_NOTICE,
 570                    LOG_MESSAGE_ID(SD_MESSAGE_DNSSEC_DOWNGRADE),
 571                    LOG_MESSAGE("Server %s does not support DNSSEC, downgrading to non-DNSSEC mode.", dns_server_string(server)),
 572                    "DNS_SERVER=%s", dns_server_string(server),
 573                    "DNS_SERVER_FEATURE_LEVEL=%s", dns_server_feature_level_to_string(server->possible_feature_level),
 574                    NULL);
 575
 576         server->warned_downgrade = true;
 577 }
 578
 579 bool dns_server_limited_domains(DnsServer *server)
 580 {
 581         DnsSearchDomain *domain;
 582         bool domain_restricted = false;
 583
 584         /* Check if the server has route-only domains without ~., i. e. whether
 585          * it should only be used for particular domains */
 586         if (!server->link)
 587                 return false;
 588
 589         LIST_FOREACH(domains, domain, server->link->search_domains)
 590                 if (domain->route_only) {
 591                         domain_restricted = true;
 592                         /* ~. means "any domain", thus it is a global server */
 593                         if (streq(DNS_SEARCH_DOMAIN_NAME(domain), "."))
 594                                 return false;
 595                 }
 596
 597         return domain_restricted;
 598 }
 599
 600 static void dns_server_hash_func(const void *p, struct siphash *state) {
 601         const DnsServer *s = p;
 602
 603         assert(s);
 604
 605         siphash24_compress(&s->family, sizeof(s->family), state);
 606         siphash24_compress(&s->address, FAMILY_ADDRESS_SIZE(s->family), state);
 607         siphash24_compress(&s->ifindex, sizeof(s->ifindex), state);
 608 }
 609
 610 static int dns_server_compare_func(const void *a, const void *b) {
 611         const DnsServer *x = a, *y = b;
 612         int r;
 613
 614         if (x->family < y->family)
 615                 return -1;
 616         if (x->family > y->family)
 617                 return 1;
 618
 619         r = memcmp(&x->address, &y->address, FAMILY_ADDRESS_SIZE(x->family));
 620         if (r != 0)
 621                 return r;
 622
 623         if (x->ifindex < y->ifindex)
 624                 return -1;
 625         if (x->ifindex > y->ifindex)
 626                 return 1;
 627
 628         return 0;
 629 }
 630
 631 const struct hash_ops dns_server_hash_ops = {
 632         .hash = dns_server_hash_func,
 633         .compare = dns_server_compare_func
 634 };
 635
 636 void dns_server_unlink_all(DnsServer *first) {
 637         DnsServer *next;
 638
 639         if (!first)
 640                 return;
 641
 642         next = first->servers_next;
 643         dns_server_unlink(first);
 644
 645         dns_server_unlink_all(next);
 646 }
 647
 648 void dns_server_unlink_marked(DnsServer *first) {
 649         DnsServer *next;
 650
 651         if (!first)
 652                 return;
 653
 654         next = first->servers_next;
 655
 656         if (first->marked)
 657                 dns_server_unlink(first);
 658
 659         dns_server_unlink_marked(next);
 660 }
 661
 662 void dns_server_mark_all(DnsServer *first) {
 663         if (!first)
 664                 return;
 665
 666         first->marked = true;
 667         dns_server_mark_all(first->servers_next);
 668 }
 669
 670 DnsServer *dns_server_find(DnsServer *first, int family, const union in_addr_union *in_addr, int ifindex) {
 671         DnsServer *s;
 672
 673         LIST_FOREACH(servers, s, first)
 674                 if (s->family == family && in_addr_equal(family, &s->address, in_addr) > 0 && s->ifindex == ifindex)
 675                         return s;
 676
 677         return NULL;
 678 }
 679
 680 DnsServer *manager_get_first_dns_server(Manager *m, DnsServerType t) {
 681         assert(m);
 682
 683         switch (t) {
 684
 685         case DNS_SERVER_SYSTEM:
 686                 return m->dns_servers;
 687
 688         case DNS_SERVER_FALLBACK:
 689                 return m->fallback_dns_servers;
 690
 691         default:
 692                 return NULL;
 693         }
 694 }
 695
 696 DnsServer *manager_set_dns_server(Manager *m, DnsServer *s) {
 697         assert(m);
 698
 699         if (m->current_dns_server == s)
 700                 return s;
 701
 702         if (s)
 703                 log_info("Switching to %s DNS server %s.",
 704                          dns_server_type_to_string(s->type),
 705                          dns_server_string(s));
 706
 707         dns_server_unref(m->current_dns_server);
 708         m->current_dns_server = dns_server_ref(s);
 709
 710         if (m->unicast_scope)
 711                 dns_cache_flush(&m->unicast_scope->cache);
 712
 713         return s;
 714 }
 715
 716 DnsServer *manager_get_dns_server(Manager *m) {
 717         Link *l;
 718         assert(m);
 719
 720         /* Try to read updates resolv.conf */
 721         manager_read_resolv_conf(m);
 722
 723         /* If no DNS server was chosen so far, pick the first one */
 724         if (!m->current_dns_server)
 725                 manager_set_dns_server(m, m->dns_servers);
 726
 727         if (!m->current_dns_server) {
 728                 bool found = false;
 729                 Iterator i;
 730
 731                 /* No DNS servers configured, let's see if there are
 732                  * any on any links. If not, we use the fallback
 733                  * servers */
 734
 735                 HASHMAP_FOREACH(l, m->links, i)
 736                         if (l->dns_servers) {
 737                                 found = true;
 738                                 break;
 739                         }
 740
 741                 if (!found)
 742                         manager_set_dns_server(m, m->fallback_dns_servers);
 743         }
 744
 745         return m->current_dns_server;
 746 }
 747
 748 void manager_next_dns_server(Manager *m) {
 749         assert(m);
 750
 751         /* If there's currently no DNS server set, then the next
 752          * manager_get_dns_server() will find one */
 753         if (!m->current_dns_server)
 754                 return;
 755
 756         /* Change to the next one, but make sure to follow the linked
 757          * list only if the server is still linked. */
 758         if (m->current_dns_server->linked && m->current_dns_server->servers_next) {
 759                 manager_set_dns_server(m, m->current_dns_server->servers_next);
 760                 return;
 761         }
 762
 763         /* If there was no next one, then start from the beginning of
 764          * the list */
 765         if (m->current_dns_server->type == DNS_SERVER_FALLBACK)
 766                 manager_set_dns_server(m, m->fallback_dns_servers);
 767         else
 768                 manager_set_dns_server(m, m->dns_servers);
 769 }
 770
 771 bool dns_server_address_valid(int family, const union in_addr_union *sa) {
 772
 773         /* Refuses the 0 IP addresses as well as 127.0.0.53 (which is our own DNS stub) */
 774
 775         if (in_addr_is_null(family, sa))
 776                 return false;
 777
 778         if (family == AF_INET && sa->in.s_addr == htobe32(INADDR_DNS_STUB))
 779                 return false;
 780
 781         return true;
 782 }
 783
 784 static const char* const dns_server_type_table[_DNS_SERVER_TYPE_MAX] = {
 785         [DNS_SERVER_SYSTEM] = "system",
 786         [DNS_SERVER_FALLBACK] = "fallback",
 787         [DNS_SERVER_LINK] = "link",
 788 };
 789 DEFINE_STRING_TABLE_LOOKUP(dns_server_type, DnsServerType);
 790
 791 static const char* const dns_server_feature_level_table[_DNS_SERVER_FEATURE_LEVEL_MAX] = {
 792         [DNS_SERVER_FEATURE_LEVEL_TCP] = "TCP",
 793         [DNS_SERVER_FEATURE_LEVEL_UDP] = "UDP",
 794         [DNS_SERVER_FEATURE_LEVEL_EDNS0] = "UDP+EDNS0",
 795         [DNS_SERVER_FEATURE_LEVEL_DO] = "UDP+EDNS0+DO",
 796         [DNS_SERVER_FEATURE_LEVEL_LARGE] = "UDP+EDNS0+DO+LARGE",
 797 };
 798 DEFINE_STRING_TABLE_LOOKUP(dns_server_feature_level, DnsServerFeatureLevel);