src/resolve/resolved-dns-server.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2 /***
   3   This file is part of systemd.
   4
   5   Copyright 2014 Lennart Poettering
   6 ***/
   7
   8 #include "sd-messages.h"
   9
  10 #include "alloc-util.h"
  11 #include "resolved-dns-server.h"
  12 #include "resolved-dns-stub.h"
  13 #include "resolved-resolv-conf.h"
  14 #include "siphash24.h"
  15 #include "string-table.h"
  16 #include "string-util.h"
  17
  18 /* After how much time to repeat classic DNS requests */
  19 #define DNS_TIMEOUT_MIN_USEC (750 * USEC_PER_MSEC)
  20 #define DNS_TIMEOUT_MAX_USEC (SD_RESOLVED_QUERY_TIMEOUT_USEC / DNS_TRANSACTION_ATTEMPTS_MAX)
  21
  22 /* The amount of time to wait before retrying with a full feature set */
  23 #define DNS_SERVER_FEATURE_GRACE_PERIOD_MAX_USEC (6 * USEC_PER_HOUR)
  24 #define DNS_SERVER_FEATURE_GRACE_PERIOD_MIN_USEC (5 * USEC_PER_MINUTE)
  25
  26 /* The number of times we will attempt a certain feature set before degrading */
  27 #define DNS_SERVER_FEATURE_RETRY_ATTEMPTS 3
  28
  29 int dns_server_new(
  30                 Manager *m,
  31                 DnsServer **ret,
  32                 DnsServerType type,
  33                 Link *l,
  34                 int family,
  35                 const union in_addr_union *in_addr,
  36                 int ifindex) {
  37
  38         DnsServer *s;
  39
  40         assert(m);
  41         assert((type == DNS_SERVER_LINK) == !!l);
  42         assert(in_addr);
  43
  44         if (!IN_SET(family, AF_INET, AF_INET6))
  45                 return -EAFNOSUPPORT;
  46
  47         if (l) {
  48                 if (l->n_dns_servers >= LINK_DNS_SERVERS_MAX)
  49                         return -E2BIG;
  50         } else {
  51                 if (m->n_dns_servers >= MANAGER_DNS_SERVERS_MAX)
  52                         return -E2BIG;
  53         }
  54
  55         s = new0(DnsServer, 1);
  56         if (!s)
  57                 return -ENOMEM;
  58
  59         s->n_ref = 1;
  60         s->manager = m;
  61         s->type = type;
  62         s->family = family;
  63         s->address = *in_addr;
  64         s->ifindex = ifindex;
  65
  66         dns_server_reset_features(s);
  67
  68         switch (type) {
  69
  70         case DNS_SERVER_LINK:
  71                 s->link = l;
  72                 LIST_APPEND(servers, l->dns_servers, s);
  73                 l->n_dns_servers++;
  74                 break;
  75
  76         case DNS_SERVER_SYSTEM:
  77                 LIST_APPEND(servers, m->dns_servers, s);
  78                 m->n_dns_servers++;
  79                 break;
  80
  81         case DNS_SERVER_FALLBACK:
  82                 LIST_APPEND(servers, m->fallback_dns_servers, s);
  83                 m->n_dns_servers++;
  84                 break;
  85
  86         default:
  87                 assert_not_reached("Unknown server type");
  88         }
  89
  90         s->linked = true;
  91
  92         /* A new DNS server that isn't fallback is added and the one
  93          * we used so far was a fallback one? Then let's try to pick
  94          * the new one */
  95         if (type != DNS_SERVER_FALLBACK &&
  96             m->current_dns_server &&
  97             m->current_dns_server->type == DNS_SERVER_FALLBACK)
  98                 manager_set_dns_server(m, NULL);
  99
 100         if (ret)
 101                 *ret = s;
 102
 103         return 0;
 104 }
 105
 106 DnsServer* dns_server_ref(DnsServer *s)  {
 107         if (!s)
 108                 return NULL;
 109
 110         assert(s->n_ref > 0);
 111         s->n_ref++;
 112
 113         return s;
 114 }
 115
 116 DnsServer* dns_server_unref(DnsServer *s)  {
 117         if (!s)
 118                 return NULL;
 119
 120         assert(s->n_ref > 0);
 121         s->n_ref--;
 122
 123         if (s->n_ref > 0)
 124                 return NULL;
 125
 126         free(s->server_string);
 127         return mfree(s);
 128 }
 129
 130 void dns_server_unlink(DnsServer *s) {
 131         assert(s);
 132         assert(s->manager);
 133
 134         /* This removes the specified server from the linked list of
 135          * servers, but any server might still stay around if it has
 136          * refs, for example from an ongoing transaction. */
 137
 138         if (!s->linked)
 139                 return;
 140
 141         switch (s->type) {
 142
 143         case DNS_SERVER_LINK:
 144                 assert(s->link);
 145                 assert(s->link->n_dns_servers > 0);
 146                 LIST_REMOVE(servers, s->link->dns_servers, s);
 147                 s->link->n_dns_servers--;
 148                 break;
 149
 150         case DNS_SERVER_SYSTEM:
 151                 assert(s->manager->n_dns_servers > 0);
 152                 LIST_REMOVE(servers, s->manager->dns_servers, s);
 153                 s->manager->n_dns_servers--;
 154                 break;
 155
 156         case DNS_SERVER_FALLBACK:
 157                 assert(s->manager->n_dns_servers > 0);
 158                 LIST_REMOVE(servers, s->manager->fallback_dns_servers, s);
 159                 s->manager->n_dns_servers--;
 160                 break;
 161         }
 162
 163         s->linked = false;
 164
 165         if (s->link && s->link->current_dns_server == s)
 166                 link_set_dns_server(s->link, NULL);
 167
 168         if (s->manager->current_dns_server == s)
 169                 manager_set_dns_server(s->manager, NULL);
 170
 171         dns_server_unref(s);
 172 }
 173
 174 void dns_server_move_back_and_unmark(DnsServer *s) {
 175         DnsServer *tail;
 176
 177         assert(s);
 178
 179         if (!s->marked)
 180                 return;
 181
 182         s->marked = false;
 183
 184         if (!s->linked || !s->servers_next)
 185                 return;
 186
 187         /* Move us to the end of the list, so that the order is
 188          * strictly kept, if we are not at the end anyway. */
 189
 190         switch (s->type) {
 191
 192         case DNS_SERVER_LINK:
 193                 assert(s->link);
 194                 LIST_FIND_TAIL(servers, s, tail);
 195                 LIST_REMOVE(servers, s->link->dns_servers, s);
 196                 LIST_INSERT_AFTER(servers, s->link->dns_servers, tail, s);
 197                 break;
 198
 199         case DNS_SERVER_SYSTEM:
 200                 LIST_FIND_TAIL(servers, s, tail);
 201                 LIST_REMOVE(servers, s->manager->dns_servers, s);
 202                 LIST_INSERT_AFTER(servers, s->manager->dns_servers, tail, s);
 203                 break;
 204
 205         case DNS_SERVER_FALLBACK:
 206                 LIST_FIND_TAIL(servers, s, tail);
 207                 LIST_REMOVE(servers, s->manager->fallback_dns_servers, s);
 208                 LIST_INSERT_AFTER(servers, s->manager->fallback_dns_servers, tail, s);
 209                 break;
 210
 211         default:
 212                 assert_not_reached("Unknown server type");
 213         }
 214 }
 215
 216 static void dns_server_verified(DnsServer *s, DnsServerFeatureLevel level) {
 217         assert(s);
 218
 219         if (s->verified_feature_level > level)
 220                 return;
 221
 222         if (s->verified_feature_level != level) {
 223                 log_debug("Verified we get a response at feature level %s from DNS server %s.",
 224                           dns_server_feature_level_to_string(level),
 225                           dns_server_string(s));
 226                 s->verified_feature_level = level;
 227         }
 228
 229         assert_se(sd_event_now(s->manager->event, clock_boottime_or_monotonic(), &s->verified_usec) >= 0);
 230 }
 231
 232 static void dns_server_reset_counters(DnsServer *s) {
 233         assert(s);
 234
 235         s->n_failed_udp = 0;
 236         s->n_failed_tcp = 0;
 237         s->packet_truncated = false;
 238         s->verified_usec = 0;
 239
 240         /* Note that we do not reset s->packet_bad_opt and s->packet_rrsig_missing here. We reset them only when the
 241          * grace period ends, but not when lowering the possible feature level, as a lower level feature level should
 242          * not make RRSIGs appear or OPT appear, but rather make them disappear. If the reappear anyway, then that's
 243          * indication for a differently broken OPT/RRSIG implementation, and we really don't want to support that
 244          * either.
 245          *
 246          * This is particularly important to deal with certain Belkin routers which break OPT for certain lookups (A),
 247          * but pass traffic through for others (AAAA). If we detect the broken behaviour on one lookup we should not
 248          * reenable it for another, because we cannot validate things anyway, given that the RRSIG/OPT data will be
 249          * incomplete. */
 250 }
 251
 252 void dns_server_packet_received(DnsServer *s, int protocol, DnsServerFeatureLevel level, usec_t rtt, size_t size) {
 253         assert(s);
 254
 255         if (protocol == IPPROTO_UDP) {
 256                 if (s->possible_feature_level == level)
 257                         s->n_failed_udp = 0;
 258
 259                 /* If the RRSIG data is missing, then we can only validate EDNS0 at max */
 260                 if (s->packet_rrsig_missing && level >= DNS_SERVER_FEATURE_LEVEL_DO)
 261                         level = DNS_SERVER_FEATURE_LEVEL_DO - 1;
 262
 263                 /* If the OPT RR got lost, then we can only validate UDP at max */
 264                 if (s->packet_bad_opt && level >= DNS_SERVER_FEATURE_LEVEL_EDNS0)
 265                         level = DNS_SERVER_FEATURE_LEVEL_EDNS0 - 1;
 266
 267                 /* Even if we successfully receive a reply to a request announcing support for large packets,
 268                    that does not mean we can necessarily receive large packets. */
 269                 if (level == DNS_SERVER_FEATURE_LEVEL_LARGE)
 270                         level = DNS_SERVER_FEATURE_LEVEL_LARGE - 1;
 271
 272         } else if (protocol == IPPROTO_TCP) {
 273
 274                 if (s->possible_feature_level == level)
 275                         s->n_failed_tcp = 0;
 276
 277                 /* Successful TCP connections are only useful to verify the TCP feature level. */
 278                 level = DNS_SERVER_FEATURE_LEVEL_TCP;
 279         }
 280
 281         dns_server_verified(s, level);
 282
 283         /* Remember the size of the largest UDP packet we received from a server,
 284            we know that we can always announce support for packets with at least
 285            this size. */
 286         if (protocol == IPPROTO_UDP && s->received_udp_packet_max < size)
 287                 s->received_udp_packet_max = size;
 288
 289         if (s->max_rtt < rtt) {
 290                 s->max_rtt = rtt;
 291                 s->resend_timeout = CLAMP(s->max_rtt * 2, DNS_TIMEOUT_MIN_USEC, DNS_TIMEOUT_MAX_USEC);
 292         } else if (s->resend_timeout > rtt)
 293                 /* If we received the packet faster than the resend_timeout, bias
 294                  * the resend_timeout back to the rtt. */
 295                 s->resend_timeout = CLAMP((2 * s->resend_timeout + rtt) / 3, DNS_TIMEOUT_MIN_USEC, DNS_TIMEOUT_MAX_USEC);
 296 }
 297
 298 void dns_server_packet_lost(DnsServer *s, int protocol, DnsServerFeatureLevel level, usec_t usec) {
 299         assert(s);
 300         assert(s->manager);
 301
 302         if (s->possible_feature_level == level) {
 303                 if (protocol == IPPROTO_UDP)
 304                         s->n_failed_udp++;
 305                 else if (protocol == IPPROTO_TCP)
 306                         s->n_failed_tcp++;
 307         }
 308
 309         if (s->resend_timeout > usec)
 310                 return;
 311
 312         s->resend_timeout = MIN(s->resend_timeout * 2, DNS_TIMEOUT_MAX_USEC);
 313 }
 314
 315 void dns_server_packet_truncated(DnsServer *s, DnsServerFeatureLevel level) {
 316         assert(s);
 317
 318         /* Invoked whenever we get a packet with TC bit set. */
 319
 320         if (s->possible_feature_level != level)
 321                 return;
 322
 323         s->packet_truncated = true;
 324 }
 325
 326 void dns_server_packet_rrsig_missing(DnsServer *s, DnsServerFeatureLevel level) {
 327         assert(s);
 328
 329         if (level < DNS_SERVER_FEATURE_LEVEL_DO)
 330                 return;
 331
 332         /* If the RRSIG RRs are missing, we have to downgrade what we previously verified */
 333         if (s->verified_feature_level >= DNS_SERVER_FEATURE_LEVEL_DO)
 334                 s->verified_feature_level = DNS_SERVER_FEATURE_LEVEL_DO-1;
 335
 336         s->packet_rrsig_missing = true;
 337 }
 338
 339 void dns_server_packet_bad_opt(DnsServer *s, DnsServerFeatureLevel level) {
 340         assert(s);
 341
 342         if (level < DNS_SERVER_FEATURE_LEVEL_EDNS0)
 343                 return;
 344
 345         /* If the OPT RR got lost, we have to downgrade what we previously verified */
 346         if (s->verified_feature_level >= DNS_SERVER_FEATURE_LEVEL_EDNS0)
 347                 s->verified_feature_level = DNS_SERVER_FEATURE_LEVEL_EDNS0-1;
 348
 349         s->packet_bad_opt = true;
 350 }
 351
 352 void dns_server_packet_rcode_downgrade(DnsServer *s, DnsServerFeatureLevel level) {
 353         assert(s);
 354
 355         /* Invoked whenever we got a FORMERR, SERVFAIL or NOTIMP rcode from a server and downgrading the feature level
 356          * for the transaction made it go away. In this case we immediately downgrade to the feature level that made
 357          * things work. */
 358
 359         if (s->verified_feature_level > level)
 360                 s->verified_feature_level = level;
 361
 362         if (s->possible_feature_level > level) {
 363                 s->possible_feature_level = level;
 364                 dns_server_reset_counters(s);
 365         }
 366
 367         log_debug("Downgrading transaction feature level fixed an RCODE error, downgrading server %s too.", dns_server_string(s));
 368 }
 369
 370 static bool dns_server_grace_period_expired(DnsServer *s) {
 371         usec_t ts;
 372
 373         assert(s);
 374         assert(s->manager);
 375
 376         if (s->verified_usec == 0)
 377                 return false;
 378
 379         assert_se(sd_event_now(s->manager->event, clock_boottime_or_monotonic(), &ts) >= 0);
 380
 381         if (s->verified_usec + s->features_grace_period_usec > ts)
 382                 return false;
 383
 384         s->features_grace_period_usec = MIN(s->features_grace_period_usec * 2, DNS_SERVER_FEATURE_GRACE_PERIOD_MAX_USEC);
 385
 386         return true;
 387 }
 388
 389 DnsServerFeatureLevel dns_server_possible_feature_level(DnsServer *s) {
 390         DnsServerFeatureLevel best;
 391
 392         assert(s);
 393
 394         /* Determine the best feature level we care about. If DNSSEC mode is off there's no point in using anything
 395          * better than EDNS0, hence don't even try. */
 396         best = dns_server_get_dnssec_mode(s) == DNSSEC_NO ?
 397                 DNS_SERVER_FEATURE_LEVEL_EDNS0 :
 398                 DNS_SERVER_FEATURE_LEVEL_BEST;
 399
 400         /* Clamp the feature level the highest level we care about. The DNSSEC mode might have changed since the last
 401          * time, hence let's downgrade if we are still at a higher level. */
 402         if (s->possible_feature_level > best)
 403                 s->possible_feature_level = best;
 404
 405         if (s->possible_feature_level < best && dns_server_grace_period_expired(s)) {
 406
 407                 s->possible_feature_level = best;
 408
 409                 dns_server_reset_counters(s);
 410
 411                 s->packet_bad_opt = false;
 412                 s->packet_rrsig_missing = false;
 413
 414                 log_info("Grace period over, resuming full feature set (%s) for DNS server %s.",
 415                          dns_server_feature_level_to_string(s->possible_feature_level),
 416                          dns_server_string(s));
 417
 418                 dns_server_flush_cache(s);
 419
 420         } else if (s->possible_feature_level <= s->verified_feature_level)
 421                 s->possible_feature_level = s->verified_feature_level;
 422         else {
 423                 DnsServerFeatureLevel p = s->possible_feature_level;
 424
 425                 if (s->n_failed_tcp >= DNS_SERVER_FEATURE_RETRY_ATTEMPTS &&
 426                     s->possible_feature_level == DNS_SERVER_FEATURE_LEVEL_TCP) {
 427
 428                         /* We are at the TCP (lowest) level, and we tried a couple of TCP connections, and it didn't
 429                          * work. Upgrade back to UDP again. */
 430                         log_debug("Reached maximum number of failed TCP connection attempts, trying UDP again...");
 431                         s->possible_feature_level = DNS_SERVER_FEATURE_LEVEL_UDP;
 432
 433                 } else if (s->packet_bad_opt &&
 434                            s->possible_feature_level >= DNS_SERVER_FEATURE_LEVEL_EDNS0) {
 435
 436                         /* A reply to one of our EDNS0 queries didn't carry a valid OPT RR, then downgrade to below
 437                          * EDNS0 levels. After all, some records generate different responses with and without OPT RR
 438                          * in the request. Example:
 439                          * https://open.nlnetlabs.nl/pipermail/dnssec-trigger/2014-November/000376.html */
 440
 441                         log_debug("Server doesn't support EDNS(0) properly, downgrading feature level...");
 442                         s->possible_feature_level = DNS_SERVER_FEATURE_LEVEL_UDP;
 443
 444                 } else if (s->packet_rrsig_missing &&
 445                            s->possible_feature_level >= DNS_SERVER_FEATURE_LEVEL_DO) {
 446
 447                         /* RRSIG data was missing on a EDNS0 packet with DO bit set. This means the server doesn't
 448                          * augment responses with DNSSEC RRs. If so, let's better not ask the server for it anymore,
 449                          * after all some servers generate different replies depending if an OPT RR is in the query or
 450                          * not. */
 451
 452                         log_debug("Detected server responses lack RRSIG records, downgrading feature level...");
 453                         s->possible_feature_level = DNS_SERVER_FEATURE_LEVEL_EDNS0;
 454
 455                 } else if (s->n_failed_udp >= DNS_SERVER_FEATURE_RETRY_ATTEMPTS &&
 456                            s->possible_feature_level >= (dns_server_get_dnssec_mode(s) == DNSSEC_YES ? DNS_SERVER_FEATURE_LEVEL_LARGE : DNS_SERVER_FEATURE_LEVEL_UDP)) {
 457
 458                         /* We lost too many UDP packets in a row, and are on a feature level of UDP or higher. If the
 459                          * packets are lost, maybe the server cannot parse them, hence downgrading sounds like a good
 460                          * idea. We might downgrade all the way down to TCP this way.
 461                          *
 462                          * If strict DNSSEC mode is used we won't downgrade below DO level however, as packet loss
 463                          * might have many reasons, a broken DNSSEC implementation being only one reason. And if the
 464                          * user is strict on DNSSEC, then let's assume that DNSSEC is not the fault here. */
 465
 466                         log_debug("Lost too many UDP packets, downgrading feature level...");
 467                         s->possible_feature_level--;
 468
 469                 } else if (s->n_failed_tcp >= DNS_SERVER_FEATURE_RETRY_ATTEMPTS &&
 470                            s->packet_truncated &&
 471                            s->possible_feature_level > (dns_server_get_dnssec_mode(s) == DNSSEC_YES ? DNS_SERVER_FEATURE_LEVEL_LARGE : DNS_SERVER_FEATURE_LEVEL_UDP)) {
 472
 473                          /* We got too many TCP connection failures in a row, we had at least one truncated packet, and
 474                           * are on a feature level above UDP. By downgrading things and getting rid of DNSSEC or EDNS0
 475                           * data we hope to make the packet smaller, so that it still works via UDP given that TCP
 476                           * appears not to be a fallback. Note that if we are already at the lowest UDP level, we don't
 477                           * go further down, since that's TCP, and TCP failed too often after all. */
 478
 479                         log_debug("Got too many failed TCP connection failures and truncated UDP packets, downgrading feature level...");
 480                         s->possible_feature_level--;
 481                 }
 482
 483                 if (p != s->possible_feature_level) {
 484
 485                         /* We changed the feature level, reset the counting */
 486                         dns_server_reset_counters(s);
 487
 488                         log_warning("Using degraded feature set (%s) for DNS server %s.",
 489                                     dns_server_feature_level_to_string(s->possible_feature_level),
 490                                     dns_server_string(s));
 491                 }
 492         }
 493
 494         return s->possible_feature_level;
 495 }
 496
 497 int dns_server_adjust_opt(DnsServer *server, DnsPacket *packet, DnsServerFeatureLevel level) {
 498         size_t packet_size;
 499         bool edns_do;
 500         int r;
 501
 502         assert(server);
 503         assert(packet);
 504         assert(packet->protocol == DNS_PROTOCOL_DNS);
 505
 506         /* Fix the OPT field in the packet to match our current feature level. */
 507
 508         r = dns_packet_truncate_opt(packet);
 509         if (r < 0)
 510                 return r;
 511
 512         if (level < DNS_SERVER_FEATURE_LEVEL_EDNS0)
 513                 return 0;
 514
 515         edns_do = level >= DNS_SERVER_FEATURE_LEVEL_DO;
 516
 517         if (level >= DNS_SERVER_FEATURE_LEVEL_LARGE)
 518                 packet_size = DNS_PACKET_UNICAST_SIZE_LARGE_MAX;
 519         else
 520                 packet_size = server->received_udp_packet_max;
 521
 522         return dns_packet_append_opt(packet, packet_size, edns_do, 0, NULL);
 523 }
 524
 525 int dns_server_ifindex(const DnsServer *s) {
 526         assert(s);
 527
 528         /* The link ifindex always takes precedence */
 529         if (s->link)
 530                 return s->link->ifindex;
 531
 532         if (s->ifindex > 0)
 533                 return s->ifindex;
 534
 535         return 0;
 536 }
 537
 538 const char *dns_server_string(DnsServer *server) {
 539         assert(server);
 540
 541         if (!server->server_string)
 542                 (void) in_addr_ifindex_to_string(server->family, &server->address, dns_server_ifindex(server), &server->server_string);
 543
 544         return strna(server->server_string);
 545 }
 546
 547 bool dns_server_dnssec_supported(DnsServer *server) {
 548         assert(server);
 549
 550         /* Returns whether the server supports DNSSEC according to what we know about it */
 551
 552         if (server->possible_feature_level < DNS_SERVER_FEATURE_LEVEL_DO)
 553                 return false;
 554
 555         if (server->packet_bad_opt)
 556                 return false;
 557
 558         if (server->packet_rrsig_missing)
 559                 return false;
 560
 561         /* DNSSEC servers need to support TCP properly (see RFC5966), if they don't, we assume DNSSEC is borked too */
 562         if (server->n_failed_tcp >= DNS_SERVER_FEATURE_RETRY_ATTEMPTS)
 563                 return false;
 564
 565         return true;
 566 }
 567
 568 void dns_server_warn_downgrade(DnsServer *server) {
 569         assert(server);
 570
 571         if (server->warned_downgrade)
 572                 return;
 573
 574         log_struct(LOG_NOTICE,
 575                    "MESSAGE_ID=" SD_MESSAGE_DNSSEC_DOWNGRADE_STR,
 576                    LOG_MESSAGE("Server %s does not support DNSSEC, downgrading to non-DNSSEC mode.", dns_server_string(server)),
 577                    "DNS_SERVER=%s", dns_server_string(server),
 578                    "DNS_SERVER_FEATURE_LEVEL=%s", dns_server_feature_level_to_string(server->possible_feature_level));
 579
 580         server->warned_downgrade = true;
 581 }
 582
 583 bool dns_server_limited_domains(DnsServer *server) {
 584         DnsSearchDomain *domain;
 585         bool domain_restricted = false;
 586
 587         /* Check if the server has route-only domains without ~., i. e. whether
 588          * it should only be used for particular domains */
 589         if (!server->link)
 590                 return false;
 591
 592         LIST_FOREACH(domains, domain, server->link->search_domains)
 593                 if (domain->route_only) {
 594                         domain_restricted = true;
 595                         /* ~. means "any domain", thus it is a global server */
 596                         if (dns_name_is_root(DNS_SEARCH_DOMAIN_NAME(domain)))
 597                                 return false;
 598                 }
 599
 600         return domain_restricted;
 601 }
 602
 603 static void dns_server_hash_func(const void *p, struct siphash *state) {
 604         const DnsServer *s = p;
 605
 606         assert(s);
 607
 608         siphash24_compress(&s->family, sizeof(s->family), state);
 609         siphash24_compress(&s->address, FAMILY_ADDRESS_SIZE(s->family), state);
 610         siphash24_compress(&s->ifindex, sizeof(s->ifindex), state);
 611 }
 612
 613 static int dns_server_compare_func(const void *a, const void *b) {
 614         const DnsServer *x = a, *y = b;
 615         int r;
 616
 617         if (x->family < y->family)
 618                 return -1;
 619         if (x->family > y->family)
 620                 return 1;
 621
 622         r = memcmp(&x->address, &y->address, FAMILY_ADDRESS_SIZE(x->family));
 623         if (r != 0)
 624                 return r;
 625
 626         if (x->ifindex < y->ifindex)
 627                 return -1;
 628         if (x->ifindex > y->ifindex)
 629                 return 1;
 630
 631         return 0;
 632 }
 633
 634 const struct hash_ops dns_server_hash_ops = {
 635         .hash = dns_server_hash_func,
 636         .compare = dns_server_compare_func
 637 };
 638
 639 void dns_server_unlink_all(DnsServer *first) {
 640         DnsServer *next;
 641
 642         if (!first)
 643                 return;
 644
 645         next = first->servers_next;
 646         dns_server_unlink(first);
 647
 648         dns_server_unlink_all(next);
 649 }
 650
 651 void dns_server_unlink_marked(DnsServer *first) {
 652         DnsServer *next;
 653
 654         if (!first)
 655                 return;
 656
 657         next = first->servers_next;
 658
 659         if (first->marked)
 660                 dns_server_unlink(first);
 661
 662         dns_server_unlink_marked(next);
 663 }
 664
 665 void dns_server_mark_all(DnsServer *first) {
 666         if (!first)
 667                 return;
 668
 669         first->marked = true;
 670         dns_server_mark_all(first->servers_next);
 671 }
 672
 673 DnsServer *dns_server_find(DnsServer *first, int family, const union in_addr_union *in_addr, int ifindex) {
 674         DnsServer *s;
 675
 676         LIST_FOREACH(servers, s, first)
 677                 if (s->family == family && in_addr_equal(family, &s->address, in_addr) > 0 && s->ifindex == ifindex)
 678                         return s;
 679
 680         return NULL;
 681 }
 682
 683 DnsServer *manager_get_first_dns_server(Manager *m, DnsServerType t) {
 684         assert(m);
 685
 686         switch (t) {
 687
 688         case DNS_SERVER_SYSTEM:
 689                 return m->dns_servers;
 690
 691         case DNS_SERVER_FALLBACK:
 692                 return m->fallback_dns_servers;
 693
 694         default:
 695                 return NULL;
 696         }
 697 }
 698
 699 DnsServer *manager_set_dns_server(Manager *m, DnsServer *s) {
 700         assert(m);
 701
 702         if (m->current_dns_server == s)
 703                 return s;
 704
 705         if (s)
 706                 log_debug("Switching to %s DNS server %s.",
 707                           dns_server_type_to_string(s->type),
 708                           dns_server_string(s));
 709
 710         dns_server_unref(m->current_dns_server);
 711         m->current_dns_server = dns_server_ref(s);
 712
 713         if (m->unicast_scope)
 714                 dns_cache_flush(&m->unicast_scope->cache);
 715
 716         return s;
 717 }
 718
 719 DnsServer *manager_get_dns_server(Manager *m) {
 720         Link *l;
 721         assert(m);
 722
 723         /* Try to read updates resolv.conf */
 724         manager_read_resolv_conf(m);
 725
 726         /* If no DNS server was chosen so far, pick the first one */
 727         if (!m->current_dns_server)
 728                 manager_set_dns_server(m, m->dns_servers);
 729
 730         if (!m->current_dns_server) {
 731                 bool found = false;
 732                 Iterator i;
 733
 734                 /* No DNS servers configured, let's see if there are
 735                  * any on any links. If not, we use the fallback
 736                  * servers */
 737
 738                 HASHMAP_FOREACH(l, m->links, i)
 739                         if (l->dns_servers) {
 740                                 found = true;
 741                                 break;
 742                         }
 743
 744                 if (!found)
 745                         manager_set_dns_server(m, m->fallback_dns_servers);
 746         }
 747
 748         return m->current_dns_server;
 749 }
 750
 751 void manager_next_dns_server(Manager *m) {
 752         assert(m);
 753
 754         /* If there's currently no DNS server set, then the next
 755          * manager_get_dns_server() will find one */
 756         if (!m->current_dns_server)
 757                 return;
 758
 759         /* Change to the next one, but make sure to follow the linked
 760          * list only if the server is still linked. */
 761         if (m->current_dns_server->linked && m->current_dns_server->servers_next) {
 762                 manager_set_dns_server(m, m->current_dns_server->servers_next);
 763                 return;
 764         }
 765
 766         /* If there was no next one, then start from the beginning of
 767          * the list */
 768         if (m->current_dns_server->type == DNS_SERVER_FALLBACK)
 769                 manager_set_dns_server(m, m->fallback_dns_servers);
 770         else
 771                 manager_set_dns_server(m, m->dns_servers);
 772 }
 773
 774 bool dns_server_address_valid(int family, const union in_addr_union *sa) {
 775
 776         /* Refuses the 0 IP addresses as well as 127.0.0.53 (which is our own DNS stub) */
 777
 778         if (in_addr_is_null(family, sa))
 779                 return false;
 780
 781         if (family == AF_INET && sa->in.s_addr == htobe32(INADDR_DNS_STUB))
 782                 return false;
 783
 784         return true;
 785 }
 786
 787 DnssecMode dns_server_get_dnssec_mode(DnsServer *s) {
 788         assert(s);
 789
 790         if (s->link)
 791                 return link_get_dnssec_mode(s->link);
 792
 793         return manager_get_dnssec_mode(s->manager);
 794 }
 795
 796 void dns_server_flush_cache(DnsServer *s) {
 797         DnsServer *current;
 798         DnsScope *scope;
 799
 800         assert(s);
 801
 802         /* Flush the cache of the scope this server belongs to */
 803
 804         current = s->link ? s->link->current_dns_server : s->manager->current_dns_server;
 805         if (current != s)
 806                 return;
 807
 808         scope = s->link ? s->link->unicast_scope : s->manager->unicast_scope;
 809         if (!scope)
 810                 return;
 811
 812         dns_cache_flush(&scope->cache);
 813 }
 814
 815 void dns_server_reset_features(DnsServer *s) {
 816         assert(s);
 817
 818         s->max_rtt = 0;
 819         s->resend_timeout = DNS_TIMEOUT_MIN_USEC;
 820
 821         s->verified_feature_level = _DNS_SERVER_FEATURE_LEVEL_INVALID;
 822         s->possible_feature_level = DNS_SERVER_FEATURE_LEVEL_BEST;
 823
 824         s->received_udp_packet_max = DNS_PACKET_UNICAST_SIZE_MAX;
 825
 826         s->packet_bad_opt = false;
 827         s->packet_rrsig_missing = false;
 828
 829         s->features_grace_period_usec = DNS_SERVER_FEATURE_GRACE_PERIOD_MIN_USEC;
 830
 831         s->warned_downgrade = false;
 832
 833         dns_server_reset_counters(s);
 834 }
 835
 836 void dns_server_reset_features_all(DnsServer *s) {
 837         DnsServer *i;
 838
 839         LIST_FOREACH(servers, i, s)
 840                 dns_server_reset_features(i);
 841 }
 842
 843 void dns_server_dump(DnsServer *s, FILE *f) {
 844         assert(s);
 845
 846         if (!f)
 847                 f = stdout;
 848
 849         fputs("[Server ", f);
 850         fputs(dns_server_string(s), f);
 851         fputs(" type=", f);
 852         fputs(dns_server_type_to_string(s->type), f);
 853
 854         if (s->type == DNS_SERVER_LINK) {
 855                 assert(s->link);
 856
 857                 fputs(" interface=", f);
 858                 fputs(s->link->name, f);
 859         }
 860
 861         fputs("]\n", f);
 862
 863         fputs("\tVerified feature level: ", f);
 864         fputs(strna(dns_server_feature_level_to_string(s->verified_feature_level)), f);
 865         fputc('\n', f);
 866
 867         fputs("\tPossible feature level: ", f);
 868         fputs(strna(dns_server_feature_level_to_string(s->possible_feature_level)), f);
 869         fputc('\n', f);
 870
 871         fputs("\tDNSSEC Mode: ", f);
 872         fputs(strna(dnssec_mode_to_string(dns_server_get_dnssec_mode(s))), f);
 873         fputc('\n', f);
 874
 875         fputs("\tCan do DNSSEC: ", f);
 876         fputs(yes_no(dns_server_dnssec_supported(s)), f);
 877         fputc('\n', f);
 878
 879         fprintf(f,
 880                 "\tMaximum UDP packet size received: %zu\n"
 881                 "\tFailed UDP attempts: %u\n"
 882                 "\tFailed TCP attempts: %u\n"
 883                 "\tSeen truncated packet: %s\n"
 884                 "\tSeen OPT RR getting lost: %s\n"
 885                 "\tSeen RRSIG RR missing: %s\n",
 886                 s->received_udp_packet_max,
 887                 s->n_failed_udp,
 888                 s->n_failed_tcp,
 889                 yes_no(s->packet_truncated),
 890                 yes_no(s->packet_bad_opt),
 891                 yes_no(s->packet_rrsig_missing));
 892 }
 893
 894 static const char* const dns_server_type_table[_DNS_SERVER_TYPE_MAX] = {
 895         [DNS_SERVER_SYSTEM] = "system",
 896         [DNS_SERVER_FALLBACK] = "fallback",
 897         [DNS_SERVER_LINK] = "link",
 898 };
 899 DEFINE_STRING_TABLE_LOOKUP(dns_server_type, DnsServerType);
 900
 901 static const char* const dns_server_feature_level_table[_DNS_SERVER_FEATURE_LEVEL_MAX] = {
 902         [DNS_SERVER_FEATURE_LEVEL_TCP] = "TCP",
 903         [DNS_SERVER_FEATURE_LEVEL_UDP] = "UDP",
 904         [DNS_SERVER_FEATURE_LEVEL_EDNS0] = "UDP+EDNS0",
 905         [DNS_SERVER_FEATURE_LEVEL_DO] = "UDP+EDNS0+DO",
 906         [DNS_SERVER_FEATURE_LEVEL_LARGE] = "UDP+EDNS0+DO+LARGE",
 907 };
 908 DEFINE_STRING_TABLE_LOOKUP(dns_server_feature_level, DnsServerFeatureLevel);