src/resolve/resolved-dns-server.c

   1 /***
   2   This file is part of systemd.
   3
   4   Copyright 2014 Lennart Poettering
   5
   6   systemd is free software; you can redistribute it and/or modify it
   7   under the terms of the GNU Lesser General Public License as published by
   8   the Free Software Foundation; either version 2.1 of the License, or
   9   (at your option) any later version.
  10
  11   systemd is distributed in the hope that it will be useful, but
  12   WITHOUT ANY WARRANTY; without even the implied warranty of
  13   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  14   Lesser General Public License for more details.
  15
  16   You should have received a copy of the GNU Lesser General Public License
  17   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  18 ***/
  19
  20 #include <sd-messages.h>
  21
  22 #include "alloc-util.h"
  23 #include "resolved-dns-server.h"
  24 #include "resolved-resolv-conf.h"
  25 #include "siphash24.h"
  26 #include "string-table.h"
  27 #include "string-util.h"
  28
  29 /* After how much time to repeat classic DNS requests */
  30 #define DNS_TIMEOUT_MIN_USEC (500 * USEC_PER_MSEC)
  31 #define DNS_TIMEOUT_MAX_USEC (5 * USEC_PER_SEC)
  32
  33 /* The amount of time to wait before retrying with a full feature set */
  34 #define DNS_SERVER_FEATURE_GRACE_PERIOD_MAX_USEC (6 * USEC_PER_HOUR)
  35 #define DNS_SERVER_FEATURE_GRACE_PERIOD_MIN_USEC (5 * USEC_PER_MINUTE)
  36
  37 /* The number of times we will attempt a certain feature set before degrading */
  38 #define DNS_SERVER_FEATURE_RETRY_ATTEMPTS 3
  39
  40 int dns_server_new(
  41                 Manager *m,
  42                 DnsServer **ret,
  43                 DnsServerType type,
  44                 Link *l,
  45                 int family,
  46                 const union in_addr_union *in_addr) {
  47
  48         DnsServer *s;
  49
  50         assert(m);
  51         assert((type == DNS_SERVER_LINK) == !!l);
  52         assert(in_addr);
  53
  54         if (!IN_SET(family, AF_INET, AF_INET6))
  55                 return -EAFNOSUPPORT;
  56
  57         if (l) {
  58                 if (l->n_dns_servers >= LINK_DNS_SERVERS_MAX)
  59                         return -E2BIG;
  60         } else {
  61                 if (m->n_dns_servers >= MANAGER_DNS_SERVERS_MAX)
  62                         return -E2BIG;
  63         }
  64
  65         s = new0(DnsServer, 1);
  66         if (!s)
  67                 return -ENOMEM;
  68
  69         s->n_ref = 1;
  70         s->manager = m;
  71         s->verified_feature_level = _DNS_SERVER_FEATURE_LEVEL_INVALID;
  72         s->possible_feature_level = DNS_SERVER_FEATURE_LEVEL_BEST;
  73         s->features_grace_period_usec = DNS_SERVER_FEATURE_GRACE_PERIOD_MIN_USEC;
  74         s->received_udp_packet_max = DNS_PACKET_UNICAST_SIZE_MAX;
  75         s->type = type;
  76         s->family = family;
  77         s->address = *in_addr;
  78         s->resend_timeout = DNS_TIMEOUT_MIN_USEC;
  79
  80         switch (type) {
  81
  82         case DNS_SERVER_LINK:
  83                 s->link = l;
  84                 LIST_APPEND(servers, l->dns_servers, s);
  85                 l->n_dns_servers++;
  86                 break;
  87
  88         case DNS_SERVER_SYSTEM:
  89                 LIST_APPEND(servers, m->dns_servers, s);
  90                 m->n_dns_servers++;
  91                 break;
  92
  93         case DNS_SERVER_FALLBACK:
  94                 LIST_APPEND(servers, m->fallback_dns_servers, s);
  95                 m->n_dns_servers++;
  96                 break;
  97
  98         default:
  99                 assert_not_reached("Unknown server type");
 100         }
 101
 102         s->linked = true;
 103
 104         /* A new DNS server that isn't fallback is added and the one
 105          * we used so far was a fallback one? Then let's try to pick
 106          * the new one */
 107         if (type != DNS_SERVER_FALLBACK &&
 108             m->current_dns_server &&
 109             m->current_dns_server->type == DNS_SERVER_FALLBACK)
 110                 manager_set_dns_server(m, NULL);
 111
 112         if (ret)
 113                 *ret = s;
 114
 115         return 0;
 116 }
 117
 118 DnsServer* dns_server_ref(DnsServer *s)  {
 119         if (!s)
 120                 return NULL;
 121
 122         assert(s->n_ref > 0);
 123         s->n_ref++;
 124
 125         return s;
 126 }
 127
 128 DnsServer* dns_server_unref(DnsServer *s)  {
 129         if (!s)
 130                 return NULL;
 131
 132         assert(s->n_ref > 0);
 133         s->n_ref--;
 134
 135         if (s->n_ref > 0)
 136                 return NULL;
 137
 138         free(s->server_string);
 139         free(s);
 140         return NULL;
 141 }
 142
 143 void dns_server_unlink(DnsServer *s) {
 144         assert(s);
 145         assert(s->manager);
 146
 147         /* This removes the specified server from the linked list of
 148          * servers, but any server might still stay around if it has
 149          * refs, for example from an ongoing transaction. */
 150
 151         if (!s->linked)
 152                 return;
 153
 154         switch (s->type) {
 155
 156         case DNS_SERVER_LINK:
 157                 assert(s->link);
 158                 assert(s->link->n_dns_servers > 0);
 159                 LIST_REMOVE(servers, s->link->dns_servers, s);
 160                 s->link->n_dns_servers--;
 161                 break;
 162
 163         case DNS_SERVER_SYSTEM:
 164                 assert(s->manager->n_dns_servers > 0);
 165                 LIST_REMOVE(servers, s->manager->dns_servers, s);
 166                 s->manager->n_dns_servers--;
 167                 break;
 168
 169         case DNS_SERVER_FALLBACK:
 170                 assert(s->manager->n_dns_servers > 0);
 171                 LIST_REMOVE(servers, s->manager->fallback_dns_servers, s);
 172                 s->manager->n_dns_servers--;
 173                 break;
 174         }
 175
 176         s->linked = false;
 177
 178         if (s->link && s->link->current_dns_server == s)
 179                 link_set_dns_server(s->link, NULL);
 180
 181         if (s->manager->current_dns_server == s)
 182                 manager_set_dns_server(s->manager, NULL);
 183
 184         dns_server_unref(s);
 185 }
 186
 187 void dns_server_move_back_and_unmark(DnsServer *s) {
 188         DnsServer *tail;
 189
 190         assert(s);
 191
 192         if (!s->marked)
 193                 return;
 194
 195         s->marked = false;
 196
 197         if (!s->linked || !s->servers_next)
 198                 return;
 199
 200         /* Move us to the end of the list, so that the order is
 201          * strictly kept, if we are not at the end anyway. */
 202
 203         switch (s->type) {
 204
 205         case DNS_SERVER_LINK:
 206                 assert(s->link);
 207                 LIST_FIND_TAIL(servers, s, tail);
 208                 LIST_REMOVE(servers, s->link->dns_servers, s);
 209                 LIST_INSERT_AFTER(servers, s->link->dns_servers, tail, s);
 210                 break;
 211
 212         case DNS_SERVER_SYSTEM:
 213                 LIST_FIND_TAIL(servers, s, tail);
 214                 LIST_REMOVE(servers, s->manager->dns_servers, s);
 215                 LIST_INSERT_AFTER(servers, s->manager->dns_servers, tail, s);
 216                 break;
 217
 218         case DNS_SERVER_FALLBACK:
 219                 LIST_FIND_TAIL(servers, s, tail);
 220                 LIST_REMOVE(servers, s->manager->fallback_dns_servers, s);
 221                 LIST_INSERT_AFTER(servers, s->manager->fallback_dns_servers, tail, s);
 222                 break;
 223
 224         default:
 225                 assert_not_reached("Unknown server type");
 226         }
 227 }
 228
 229 static void dns_server_verified(DnsServer *s, DnsServerFeatureLevel level) {
 230         assert(s);
 231
 232         if (s->verified_feature_level > level)
 233                 return;
 234
 235         if (s->verified_feature_level != level) {
 236                 log_debug("Verified we get a response at feature level %s from DNS server %s.",
 237                           dns_server_feature_level_to_string(level),
 238                           dns_server_string(s));
 239                 s->verified_feature_level = level;
 240         }
 241
 242         assert_se(sd_event_now(s->manager->event, clock_boottime_or_monotonic(), &s->verified_usec) >= 0);
 243 }
 244
 245 void dns_server_packet_received(DnsServer *s, int protocol, DnsServerFeatureLevel level, usec_t rtt, size_t size) {
 246         assert(s);
 247
 248         if (protocol == IPPROTO_UDP) {
 249                 if (s->possible_feature_level == level)
 250                         s->n_failed_udp = 0;
 251
 252                 /* If the RRSIG data is missing, then we can only validate EDNS0 at max */
 253                 if (s->packet_rrsig_missing && level >= DNS_SERVER_FEATURE_LEVEL_DO)
 254                         level = DNS_SERVER_FEATURE_LEVEL_DO - 1;
 255
 256                 /* If the OPT RR got lost, then we can only validate UDP at max */
 257                 if (s->packet_bad_opt && level >= DNS_SERVER_FEATURE_LEVEL_EDNS0)
 258                         level = DNS_SERVER_FEATURE_LEVEL_EDNS0 - 1;
 259
 260                 /* Even if we successfully receive a reply to a request announcing support for large packets,
 261                    that does not mean we can necessarily receive large packets. */
 262                 if (level == DNS_SERVER_FEATURE_LEVEL_LARGE)
 263                         level = DNS_SERVER_FEATURE_LEVEL_LARGE - 1;
 264
 265         } else if (protocol == IPPROTO_TCP) {
 266
 267                 if (s->possible_feature_level == level)
 268                         s->n_failed_tcp = 0;
 269
 270                 /* Successful TCP connections are only useful to verify the TCP feature level. */
 271                 level = DNS_SERVER_FEATURE_LEVEL_TCP;
 272         }
 273
 274         dns_server_verified(s, level);
 275
 276         /* Remember the size of the largest UDP packet we received from a server,
 277            we know that we can always announce support for packets with at least
 278            this size. */
 279         if (protocol == IPPROTO_UDP && s->received_udp_packet_max < size)
 280                 s->received_udp_packet_max = size;
 281
 282         if (s->max_rtt < rtt) {
 283                 s->max_rtt = rtt;
 284                 s->resend_timeout = CLAMP(s->max_rtt * 2, DNS_TIMEOUT_MIN_USEC, DNS_TIMEOUT_MAX_USEC);
 285         }
 286 }
 287
 288 void dns_server_packet_lost(DnsServer *s, int protocol, DnsServerFeatureLevel level, usec_t usec) {
 289         assert(s);
 290         assert(s->manager);
 291
 292         if (s->possible_feature_level == level) {
 293                 if (protocol == IPPROTO_UDP)
 294                         s->n_failed_udp++;
 295                 else if (protocol == IPPROTO_TCP)
 296                         s->n_failed_tcp++;
 297         }
 298
 299         if (s->resend_timeout > usec)
 300                 return;
 301
 302         s->resend_timeout = MIN(s->resend_timeout * 2, DNS_TIMEOUT_MAX_USEC);
 303 }
 304
 305 void dns_server_packet_failed(DnsServer *s, DnsServerFeatureLevel level) {
 306         assert(s);
 307
 308         /* Invoked whenever we get a FORMERR, SERVFAIL or NOTIMP rcode from a server. */
 309
 310         if (s->possible_feature_level != level)
 311                 return;
 312
 313         s->packet_failed = true;
 314 }
 315
 316 void dns_server_packet_truncated(DnsServer *s, DnsServerFeatureLevel level) {
 317         assert(s);
 318
 319         /* Invoked whenever we get a packet with TC bit set. */
 320
 321         if (s->possible_feature_level != level)
 322                 return;
 323
 324         s->packet_truncated = true;
 325 }
 326
 327 void dns_server_packet_rrsig_missing(DnsServer *s, DnsServerFeatureLevel level) {
 328         assert(s);
 329
 330         if (level < DNS_SERVER_FEATURE_LEVEL_DO)
 331                 return;
 332
 333         /* If the RRSIG RRs are missing, we have to downgrade what we previously verified */
 334         if (s->verified_feature_level >= DNS_SERVER_FEATURE_LEVEL_DO)
 335                 s->verified_feature_level = DNS_SERVER_FEATURE_LEVEL_DO-1;
 336
 337         s->packet_rrsig_missing = true;
 338 }
 339
 340 void dns_server_packet_bad_opt(DnsServer *s, DnsServerFeatureLevel level) {
 341         assert(s);
 342
 343         if (level < DNS_SERVER_FEATURE_LEVEL_EDNS0)
 344                 return;
 345
 346         /* If the OPT RR got lost, we have to downgrade what we previously verified */
 347         if (s->verified_feature_level >= DNS_SERVER_FEATURE_LEVEL_EDNS0)
 348                 s->verified_feature_level = DNS_SERVER_FEATURE_LEVEL_EDNS0-1;
 349
 350         s->packet_bad_opt = true;
 351 }
 352
 353 static bool dns_server_grace_period_expired(DnsServer *s) {
 354         usec_t ts;
 355
 356         assert(s);
 357         assert(s->manager);
 358
 359         if (s->verified_usec == 0)
 360                 return false;
 361
 362         assert_se(sd_event_now(s->manager->event, clock_boottime_or_monotonic(), &ts) >= 0);
 363
 364         if (s->verified_usec + s->features_grace_period_usec > ts)
 365                 return false;
 366
 367         s->features_grace_period_usec = MIN(s->features_grace_period_usec * 2, DNS_SERVER_FEATURE_GRACE_PERIOD_MAX_USEC);
 368
 369         return true;
 370 }
 371
 372 static void dns_server_reset_counters(DnsServer *s) {
 373         assert(s);
 374
 375         s->n_failed_udp = 0;
 376         s->n_failed_tcp = 0;
 377         s->packet_failed = false;
 378         s->packet_truncated = false;
 379         s->verified_usec = 0;
 380
 381         /* Note that we do not reset s->packet_bad_opt and s->packet_rrsig_missing here. We reset them only when the
 382          * grace period ends, but not when lowering the possible feature level, as a lower level feature level should
 383          * not make RRSIGs appear or OPT appear, but rather make them disappear. If the reappear anyway, then that's
 384          * indication for a differently broken OPT/RRSIG implementation, and we really don't want to support that
 385          * either.
 386          *
 387          * This is particularly important to deal with certain Belkin routers which break OPT for certain lookups (A),
 388          * but pass traffic through for others (AAAA). If we detect the broken behaviour on one lookup we should not
 389          * reenable it for another, because we cannot validate things anyway, given that the RRSIG/OPT data will be
 390          * incomplete. */
 391 }
 392
 393 DnsServerFeatureLevel dns_server_possible_feature_level(DnsServer *s) {
 394         assert(s);
 395
 396         if (s->possible_feature_level != DNS_SERVER_FEATURE_LEVEL_BEST &&
 397             dns_server_grace_period_expired(s)) {
 398
 399                 s->possible_feature_level = DNS_SERVER_FEATURE_LEVEL_BEST;
 400
 401                 dns_server_reset_counters(s);
 402
 403                 s->packet_bad_opt = false;
 404                 s->packet_rrsig_missing = false;
 405
 406                 log_info("Grace period over, resuming full feature set (%s) for DNS server %s.",
 407                          dns_server_feature_level_to_string(s->possible_feature_level),
 408                          dns_server_string(s));
 409
 410         } else if (s->possible_feature_level <= s->verified_feature_level)
 411                 s->possible_feature_level = s->verified_feature_level;
 412         else {
 413                 DnsServerFeatureLevel p = s->possible_feature_level;
 414
 415                 if (s->n_failed_tcp >= DNS_SERVER_FEATURE_RETRY_ATTEMPTS &&
 416                     s->possible_feature_level == DNS_SERVER_FEATURE_LEVEL_TCP) {
 417
 418                         /* We are at the TCP (lowest) level, and we tried a couple of TCP connections, and it didn't
 419                          * work. Upgrade back to UDP again. */
 420                         log_debug("Reached maximum number of failed TCP connection attempts, trying UDP again...");
 421                         s->possible_feature_level = DNS_SERVER_FEATURE_LEVEL_UDP;
 422
 423                 } else if (s->packet_bad_opt &&
 424                            s->possible_feature_level >= DNS_SERVER_FEATURE_LEVEL_EDNS0) {
 425
 426                         /* A reply to one of our EDNS0 queries didn't carry a valid OPT RR, then downgrade to below
 427                          * EDNS0 levels. After all, some records generate different responses with and without OPT RR
 428                          * in the request. Example:
 429                          * https://open.nlnetlabs.nl/pipermail/dnssec-trigger/2014-November/000376.html */
 430
 431                         log_debug("Server doesn't support EDNS(0) properly, downgrading feature level...");
 432                         s->possible_feature_level = DNS_SERVER_FEATURE_LEVEL_UDP;
 433
 434                 } else if (s->packet_rrsig_missing &&
 435                            s->possible_feature_level >= DNS_SERVER_FEATURE_LEVEL_DO) {
 436
 437                         /* RRSIG data was missing on a EDNS0 packet with DO bit set. This means the server doesn't
 438                          * augment responses with DNSSEC RRs. If so, let's better not ask the server for it anymore,
 439                          * after all some servers generate different replies depending if an OPT RR is in the query or
 440                          * not. */
 441
 442                         log_debug("Detected server responses lack RRSIG records, downgrading feature level...");
 443                         s->possible_feature_level = DNS_SERVER_FEATURE_LEVEL_EDNS0;
 444
 445                 } else if (s->n_failed_udp >= DNS_SERVER_FEATURE_RETRY_ATTEMPTS &&
 446                             s->possible_feature_level >= DNS_SERVER_FEATURE_LEVEL_UDP) {
 447
 448                         /* We lost too many UDP packets in a row, and are on a feature level of UDP or higher. If the
 449                          * packets are lost, maybe the server cannot parse them, hence downgrading sounds like a good
 450                          * idea. We might downgrade all the way down to TCP this way. */
 451
 452                         log_debug("Lost too many UDP packets, downgrading feature level...");
 453                         s->possible_feature_level--;
 454
 455                 } else if (s->packet_failed &&
 456                            s->possible_feature_level > DNS_SERVER_FEATURE_LEVEL_UDP) {
 457
 458                         /* We got a failure packet, and are at a feature level above UDP. Note that in this case we
 459                          * downgrade no further than UDP, under the assumption that a failure packet indicates an
 460                          * incompatible packet contents, but not a problem with the transport. */
 461
 462                         log_debug("Got server failure, downgrading feature level...");
 463                         s->possible_feature_level--;
 464
 465                 } else if (s->n_failed_tcp >= DNS_SERVER_FEATURE_RETRY_ATTEMPTS &&
 466                            s->packet_truncated &&
 467                            s->possible_feature_level > DNS_SERVER_FEATURE_LEVEL_UDP) {
 468
 469                          /* We got too many TCP connection failures in a row, we had at least one truncated packet, and
 470                           * are on a feature level above UDP. By downgrading things and getting rid of DNSSEC or EDNS0
 471                           * data we hope to make the packet smaller, so that it still works via UDP given that TCP
 472                           * appears not to be a fallback. Note that if we are already at the lowest UDP level, we don't
 473                           * go further down, since that's TCP, and TCP failed too often after all. */
 474
 475                         log_debug("Got too many failed TCP connection failures and truncated UDP packets, downgrading feature level...");
 476                         s->possible_feature_level--;
 477                 }
 478
 479                 if (p != s->possible_feature_level) {
 480
 481                         /* We changed the feature level, reset the counting */
 482                         dns_server_reset_counters(s);
 483
 484                         log_warning("Using degraded feature set (%s) for DNS server %s.",
 485                                     dns_server_feature_level_to_string(s->possible_feature_level),
 486                                     dns_server_string(s));
 487                 }
 488         }
 489
 490         return s->possible_feature_level;
 491 }
 492
 493 int dns_server_adjust_opt(DnsServer *server, DnsPacket *packet, DnsServerFeatureLevel level) {
 494         size_t packet_size;
 495         bool edns_do;
 496         int r;
 497
 498         assert(server);
 499         assert(packet);
 500         assert(packet->protocol == DNS_PROTOCOL_DNS);
 501
 502         /* Fix the OPT field in the packet to match our current feature level. */
 503
 504         r = dns_packet_truncate_opt(packet);
 505         if (r < 0)
 506                 return r;
 507
 508         if (level < DNS_SERVER_FEATURE_LEVEL_EDNS0)
 509                 return 0;
 510
 511         edns_do = level >= DNS_SERVER_FEATURE_LEVEL_DO;
 512
 513         if (level >= DNS_SERVER_FEATURE_LEVEL_LARGE)
 514                 packet_size = DNS_PACKET_UNICAST_SIZE_LARGE_MAX;
 515         else
 516                 packet_size = server->received_udp_packet_max;
 517
 518         return dns_packet_append_opt(packet, packet_size, edns_do, NULL);
 519 }
 520
 521 const char *dns_server_string(DnsServer *server) {
 522         assert(server);
 523
 524         if (!server->server_string)
 525                 (void) in_addr_to_string(server->family, &server->address, &server->server_string);
 526
 527         return strna(server->server_string);
 528 }
 529
 530 bool dns_server_dnssec_supported(DnsServer *server) {
 531         assert(server);
 532
 533         /* Returns whether the server supports DNSSEC according to what we know about it */
 534
 535         if (server->possible_feature_level < DNS_SERVER_FEATURE_LEVEL_DO)
 536                 return false;
 537
 538         if (server->packet_bad_opt)
 539                 return false;
 540
 541         if (server->packet_rrsig_missing)
 542                 return false;
 543
 544         /* DNSSEC servers need to support TCP properly (see RFC5966), if they don't, we assume DNSSEC is borked too */
 545         if (server->n_failed_tcp >= DNS_SERVER_FEATURE_RETRY_ATTEMPTS)
 546                 return false;
 547
 548         return true;
 549 }
 550
 551 void dns_server_warn_downgrade(DnsServer *server) {
 552         assert(server);
 553
 554         if (server->warned_downgrade)
 555                 return;
 556
 557         log_struct(LOG_NOTICE,
 558                    LOG_MESSAGE_ID(SD_MESSAGE_DNSSEC_DOWNGRADE),
 559                    LOG_MESSAGE("Server %s does not support DNSSEC, downgrading to non-DNSSEC mode.", dns_server_string(server)),
 560                    "DNS_SERVER=%s", dns_server_string(server),
 561                    "DNS_SERVER_FEATURE_LEVEL=%s", dns_server_feature_level_to_string(server->possible_feature_level),
 562                    NULL);
 563
 564         server->warned_downgrade = true;
 565 }
 566
 567 static void dns_server_hash_func(const void *p, struct siphash *state) {
 568         const DnsServer *s = p;
 569
 570         assert(s);
 571
 572         siphash24_compress(&s->family, sizeof(s->family), state);
 573         siphash24_compress(&s->address, FAMILY_ADDRESS_SIZE(s->family), state);
 574 }
 575
 576 static int dns_server_compare_func(const void *a, const void *b) {
 577         const DnsServer *x = a, *y = b;
 578
 579         if (x->family < y->family)
 580                 return -1;
 581         if (x->family > y->family)
 582                 return 1;
 583
 584         return memcmp(&x->address, &y->address, FAMILY_ADDRESS_SIZE(x->family));
 585 }
 586
 587 const struct hash_ops dns_server_hash_ops = {
 588         .hash = dns_server_hash_func,
 589         .compare = dns_server_compare_func
 590 };
 591
 592 void dns_server_unlink_all(DnsServer *first) {
 593         DnsServer *next;
 594
 595         if (!first)
 596                 return;
 597
 598         next = first->servers_next;
 599         dns_server_unlink(first);
 600
 601         dns_server_unlink_all(next);
 602 }
 603
 604 void dns_server_unlink_marked(DnsServer *first) {
 605         DnsServer *next;
 606
 607         if (!first)
 608                 return;
 609
 610         next = first->servers_next;
 611
 612         if (first->marked)
 613                 dns_server_unlink(first);
 614
 615         dns_server_unlink_marked(next);
 616 }
 617
 618 void dns_server_mark_all(DnsServer *first) {
 619         if (!first)
 620                 return;
 621
 622         first->marked = true;
 623         dns_server_mark_all(first->servers_next);
 624 }
 625
 626 DnsServer *dns_server_find(DnsServer *first, int family, const union in_addr_union *in_addr) {
 627         DnsServer *s;
 628
 629         LIST_FOREACH(servers, s, first)
 630                 if (s->family == family && in_addr_equal(family, &s->address, in_addr) > 0)
 631                         return s;
 632
 633         return NULL;
 634 }
 635
 636 DnsServer *manager_get_first_dns_server(Manager *m, DnsServerType t) {
 637         assert(m);
 638
 639         switch (t) {
 640
 641         case DNS_SERVER_SYSTEM:
 642                 return m->dns_servers;
 643
 644         case DNS_SERVER_FALLBACK:
 645                 return m->fallback_dns_servers;
 646
 647         default:
 648                 return NULL;
 649         }
 650 }
 651
 652 DnsServer *manager_set_dns_server(Manager *m, DnsServer *s) {
 653         assert(m);
 654
 655         if (m->current_dns_server == s)
 656                 return s;
 657
 658         if (s)
 659                 log_info("Switching to %s DNS server %s.",
 660                          dns_server_type_to_string(s->type),
 661                          dns_server_string(s));
 662
 663         dns_server_unref(m->current_dns_server);
 664         m->current_dns_server = dns_server_ref(s);
 665
 666         if (m->unicast_scope)
 667                 dns_cache_flush(&m->unicast_scope->cache);
 668
 669         return s;
 670 }
 671
 672 DnsServer *manager_get_dns_server(Manager *m) {
 673         Link *l;
 674         assert(m);
 675
 676         /* Try to read updates resolv.conf */
 677         manager_read_resolv_conf(m);
 678
 679         /* If no DNS server was chosen so far, pick the first one */
 680         if (!m->current_dns_server)
 681                 manager_set_dns_server(m, m->dns_servers);
 682
 683         if (!m->current_dns_server) {
 684                 bool found = false;
 685                 Iterator i;
 686
 687                 /* No DNS servers configured, let's see if there are
 688                  * any on any links. If not, we use the fallback
 689                  * servers */
 690
 691                 HASHMAP_FOREACH(l, m->links, i)
 692                         if (l->dns_servers) {
 693                                 found = true;
 694                                 break;
 695                         }
 696
 697                 if (!found)
 698                         manager_set_dns_server(m, m->fallback_dns_servers);
 699         }
 700
 701         return m->current_dns_server;
 702 }
 703
 704 void manager_next_dns_server(Manager *m) {
 705         assert(m);
 706
 707         /* If there's currently no DNS server set, then the next
 708          * manager_get_dns_server() will find one */
 709         if (!m->current_dns_server)
 710                 return;
 711
 712         /* Change to the next one, but make sure to follow the linked
 713          * list only if the server is still linked. */
 714         if (m->current_dns_server->linked && m->current_dns_server->servers_next) {
 715                 manager_set_dns_server(m, m->current_dns_server->servers_next);
 716                 return;
 717         }
 718
 719         /* If there was no next one, then start from the beginning of
 720          * the list */
 721         if (m->current_dns_server->type == DNS_SERVER_FALLBACK)
 722                 manager_set_dns_server(m, m->fallback_dns_servers);
 723         else
 724                 manager_set_dns_server(m, m->dns_servers);
 725 }
 726
 727 static const char* const dns_server_type_table[_DNS_SERVER_TYPE_MAX] = {
 728         [DNS_SERVER_SYSTEM] = "system",
 729         [DNS_SERVER_FALLBACK] = "fallback",
 730         [DNS_SERVER_LINK] = "link",
 731 };
 732 DEFINE_STRING_TABLE_LOOKUP(dns_server_type, DnsServerType);
 733
 734 static const char* const dns_server_feature_level_table[_DNS_SERVER_FEATURE_LEVEL_MAX] = {
 735         [DNS_SERVER_FEATURE_LEVEL_TCP] = "TCP",
 736         [DNS_SERVER_FEATURE_LEVEL_UDP] = "UDP",
 737         [DNS_SERVER_FEATURE_LEVEL_EDNS0] = "UDP+EDNS0",
 738         [DNS_SERVER_FEATURE_LEVEL_DO] = "UDP+EDNS0+DO",
 739         [DNS_SERVER_FEATURE_LEVEL_LARGE] = "UDP+EDNS0+DO+LARGE",
 740 };
 741 DEFINE_STRING_TABLE_LOOKUP(dns_server_feature_level, DnsServerFeatureLevel);