]> git.ipfire.org Git - thirdparty/systemd.git/blob - src/resolve/resolved-dns-transaction.c
projects / thirdparty / systemd.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
tree-wide: use mfree more
[thirdparty/systemd.git] / src / resolve / resolved-dns-transaction.c
1 /***
2 This file is part of systemd.
3
4 Copyright 2014 Lennart Poettering
5
6 systemd is free software; you can redistribute it and/or modify it
7 under the terms of the GNU Lesser General Public License as published by
8 the Free Software Foundation; either version 2.1 of the License, or
9 (at your option) any later version.
10
11 systemd is distributed in the hope that it will be useful, but
12 WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 Lesser General Public License for more details.
15
16 You should have received a copy of the GNU Lesser General Public License
17 along with systemd; If not, see <http://www.gnu.org/licenses/>.
18 ***/
19
20 #include <sd-messages.h>
21
22 #include "af-list.h"
23 #include "alloc-util.h"
24 #include "dns-domain.h"
25 #include "errno-list.h"
26 #include "fd-util.h"
27 #include "random-util.h"
28 #include "resolved-dns-cache.h"
29 #include "resolved-dns-transaction.h"
30 #include "resolved-llmnr.h"
31 #include "string-table.h"
32
33 #define TRANSACTIONS_MAX 4096
34
35 static void dns_transaction_reset_answer(DnsTransaction *t) {
36 assert(t);
37
38 t->received = dns_packet_unref(t->received);
39 t->answer = dns_answer_unref(t->answer);
40 t->answer_rcode = 0;
41 t->answer_dnssec_result = _DNSSEC_RESULT_INVALID;
42 t->answer_source = _DNS_TRANSACTION_SOURCE_INVALID;
43 t->answer_authenticated = false;
44 t->answer_nsec_ttl = (uint32_t) -1;
45 t->answer_errno = 0;
46 }
47
48 static void dns_transaction_flush_dnssec_transactions(DnsTransaction *t) {
49 DnsTransaction *z;
50
51 assert(t);
52
53 while ((z = set_steal_first(t->dnssec_transactions))) {
54 set_remove(z->notify_transactions, t);
55 set_remove(z->notify_transactions_done, t);
56 dns_transaction_gc(z);
57 }
58 }
59
60 static void dns_transaction_close_connection(DnsTransaction *t) {
61 assert(t);
62
63 if (t->stream) {
64 /* Let's detach the stream from our transaction, in case something else keeps a reference to it. */
65 t->stream->complete = NULL;
66 t->stream->on_packet = NULL;
67 t->stream->transaction = NULL;
68 t->stream = dns_stream_unref(t->stream);
69 }
70
71 t->dns_udp_event_source = sd_event_source_unref(t->dns_udp_event_source);
72 t->dns_udp_fd = safe_close(t->dns_udp_fd);
73 }
74
75 static void dns_transaction_stop_timeout(DnsTransaction *t) {
76 assert(t);
77
78 t->timeout_event_source = sd_event_source_unref(t->timeout_event_source);
79 }
80
81 DnsTransaction* dns_transaction_free(DnsTransaction *t) {
82 DnsQueryCandidate *c;
83 DnsZoneItem *i;
84 DnsTransaction *z;
85
86 if (!t)
87 return NULL;
88
89 log_debug("Freeing transaction %" PRIu16 ".", t->id);
90
91 dns_transaction_close_connection(t);
92 dns_transaction_stop_timeout(t);
93
94 dns_packet_unref(t->sent);
95 dns_transaction_reset_answer(t);
96
97 dns_server_unref(t->server);
98
99 if (t->scope) {
100 hashmap_remove_value(t->scope->transactions_by_key, t->key, t);
101 LIST_REMOVE(transactions_by_scope, t->scope->transactions, t);
102
103 if (t->id != 0)
104 hashmap_remove(t->scope->manager->dns_transactions, UINT_TO_PTR(t->id));
105 }
106
107 while ((c = set_steal_first(t->notify_query_candidates)))
108 set_remove(c->transactions, t);
109 set_free(t->notify_query_candidates);
110
111 while ((c = set_steal_first(t->notify_query_candidates_done)))
112 set_remove(c->transactions, t);
113 set_free(t->notify_query_candidates_done);
114
115 while ((i = set_steal_first(t->notify_zone_items)))
116 i->probe_transaction = NULL;
117 set_free(t->notify_zone_items);
118
119 while ((i = set_steal_first(t->notify_zone_items_done)))
120 i->probe_transaction = NULL;
121 set_free(t->notify_zone_items_done);
122
123 while ((z = set_steal_first(t->notify_transactions)))
124 set_remove(z->dnssec_transactions, t);
125 set_free(t->notify_transactions);
126
127 while ((z = set_steal_first(t->notify_transactions_done)))
128 set_remove(z->dnssec_transactions, t);
129 set_free(t->notify_transactions_done);
130
131 dns_transaction_flush_dnssec_transactions(t);
132 set_free(t->dnssec_transactions);
133
134 dns_answer_unref(t->validated_keys);
135 dns_resource_key_unref(t->key);
136
137 return mfree(t);
138 }
139
140 DEFINE_TRIVIAL_CLEANUP_FUNC(DnsTransaction*, dns_transaction_free);
141
142 bool dns_transaction_gc(DnsTransaction *t) {
143 assert(t);
144
145 if (t->block_gc > 0)
146 return true;
147
148 if (set_isempty(t->notify_query_candidates) &&
149 set_isempty(t->notify_query_candidates_done) &&
150 set_isempty(t->notify_zone_items) &&
151 set_isempty(t->notify_zone_items_done) &&
152 set_isempty(t->notify_transactions) &&
153 set_isempty(t->notify_transactions_done)) {
154 dns_transaction_free(t);
155 return false;
156 }
157
158 return true;
159 }
160
161 static uint16_t pick_new_id(Manager *m) {
162 uint16_t new_id;
163
164 /* Find a fresh, unused transaction id. Note that this loop is bounded because there's a limit on the number of
165 * transactions, and it's much lower than the space of IDs. */
166
167 assert_cc(TRANSACTIONS_MAX < 0xFFFF);
168
169 do
170 random_bytes(&new_id, sizeof(new_id));
171 while (new_id == 0 ||
172 hashmap_get(m->dns_transactions, UINT_TO_PTR(new_id)));
173
174 return new_id;
175 }
176
177 int dns_transaction_new(DnsTransaction **ret, DnsScope *s, DnsResourceKey *key) {
178 _cleanup_(dns_transaction_freep) DnsTransaction *t = NULL;
179 int r;
180
181 assert(ret);
182 assert(s);
183 assert(key);
184
185 /* Don't allow looking up invalid or pseudo RRs */
186 if (!dns_type_is_valid_query(key->type))
187 return -EINVAL;
188 if (dns_type_is_obsolete(key->type))
189 return -EOPNOTSUPP;
190
191 /* We only support the IN class */
192 if (key->class != DNS_CLASS_IN && key->class != DNS_CLASS_ANY)
193 return -EOPNOTSUPP;
194
195 if (hashmap_size(s->manager->dns_transactions) >= TRANSACTIONS_MAX)
196 return -EBUSY;
197
198 r = hashmap_ensure_allocated(&s->manager->dns_transactions, NULL);
199 if (r < 0)
200 return r;
201
202 r = hashmap_ensure_allocated(&s->transactions_by_key, &dns_resource_key_hash_ops);
203 if (r < 0)
204 return r;
205
206 t = new0(DnsTransaction, 1);
207 if (!t)
208 return -ENOMEM;
209
210 t->dns_udp_fd = -1;
211 t->answer_source = _DNS_TRANSACTION_SOURCE_INVALID;
212 t->answer_dnssec_result = _DNSSEC_RESULT_INVALID;
213 t->answer_nsec_ttl = (uint32_t) -1;
214 t->key = dns_resource_key_ref(key);
215 t->current_feature_level = _DNS_SERVER_FEATURE_LEVEL_INVALID;
216 t->clamp_feature_level = _DNS_SERVER_FEATURE_LEVEL_INVALID;
217
218 t->id = pick_new_id(s->manager);
219
220 r = hashmap_put(s->manager->dns_transactions, UINT_TO_PTR(t->id), t);
221 if (r < 0) {
222 t->id = 0;
223 return r;
224 }
225
226 r = hashmap_replace(s->transactions_by_key, t->key, t);
227 if (r < 0) {
228 hashmap_remove(s->manager->dns_transactions, UINT_TO_PTR(t->id));
229 return r;
230 }
231
232 LIST_PREPEND(transactions_by_scope, s->transactions, t);
233 t->scope = s;
234
235 s->manager->n_transactions_total++;
236
237 if (ret)
238 *ret = t;
239
240 t = NULL;
241
242 return 0;
243 }
244
245 static void dns_transaction_shuffle_id(DnsTransaction *t) {
246 uint16_t new_id;
247 assert(t);
248
249 /* Pick a new ID for this transaction. */
250
251 new_id = pick_new_id(t->scope->manager);
252 assert_se(hashmap_remove_and_put(t->scope->manager->dns_transactions, UINT_TO_PTR(t->id), UINT_TO_PTR(new_id), t) >= 0);
253
254 log_debug("Transaction %" PRIu16 " is now %" PRIu16 ".", t->id, new_id);
255 t->id = new_id;
256
257 /* Make sure we generate a new packet with the new ID */
258 t->sent = dns_packet_unref(t->sent);
259 }
260
261 static void dns_transaction_tentative(DnsTransaction *t, DnsPacket *p) {
262 _cleanup_free_ char *pretty = NULL;
263 char key_str[DNS_RESOURCE_KEY_STRING_MAX];
264 DnsZoneItem *z;
265
266 assert(t);
267 assert(p);
268
269 if (manager_our_packet(t->scope->manager, p) != 0)
270 return;
271
272 (void) in_addr_to_string(p->family, &p->sender, &pretty);
273
274 log_debug("Transaction %" PRIu16 " for <%s> on scope %s on %s/%s got tentative packet from %s.",
275 t->id,
276 dns_resource_key_to_string(t->key, key_str, sizeof key_str),
277 dns_protocol_to_string(t->scope->protocol),
278 t->scope->link ? t->scope->link->name : "*",
279 af_to_name_short(t->scope->family),
280 strnull(pretty));
281
282 /* RFC 4795, Section 4.1 says that the peer with the
283 * lexicographically smaller IP address loses */
284 if (memcmp(&p->sender, &p->destination, FAMILY_ADDRESS_SIZE(p->family)) >= 0) {
285 log_debug("Peer has lexicographically larger IP address and thus lost in the conflict.");
286 return;
287 }
288
289 log_debug("We have the lexicographically larger IP address and thus lost in the conflict.");
290
291 t->block_gc++;
292
293 while ((z = set_first(t->notify_zone_items))) {
294 /* First, make sure the zone item drops the reference
295 * to us */
296 dns_zone_item_probe_stop(z);
297
298 /* Secondly, report this as conflict, so that we might
299 * look for a different hostname */
300 dns_zone_item_conflict(z);
301 }
302 t->block_gc--;
303
304 dns_transaction_gc(t);
305 }
306
307 void dns_transaction_complete(DnsTransaction *t, DnsTransactionState state) {
308 DnsQueryCandidate *c;
309 DnsZoneItem *z;
310 DnsTransaction *d;
311 const char *st;
312 char key_str[DNS_RESOURCE_KEY_STRING_MAX];
313
314 assert(t);
315 assert(!DNS_TRANSACTION_IS_LIVE(state));
316
317 if (state == DNS_TRANSACTION_DNSSEC_FAILED) {
318 dns_resource_key_to_string(t->key, key_str, sizeof key_str);
319
320 log_struct(LOG_NOTICE,
321 LOG_MESSAGE_ID(SD_MESSAGE_DNSSEC_FAILURE),
322 LOG_MESSAGE("DNSSEC validation failed for question %s: %s", key_str, dnssec_result_to_string(t->answer_dnssec_result)),
323 "DNS_TRANSACTION=%" PRIu16, t->id,
324 "DNS_QUESTION=%s", key_str,
325 "DNSSEC_RESULT=%s", dnssec_result_to_string(t->answer_dnssec_result),
326 "DNS_SERVER=%s", dns_server_string(t->server),
327 "DNS_SERVER_FEATURE_LEVEL=%s", dns_server_feature_level_to_string(t->server->possible_feature_level),
328 NULL);
329 }
330
331 /* Note that this call might invalidate the query. Callers
332 * should hence not attempt to access the query or transaction
333 * after calling this function. */
334
335 if (state == DNS_TRANSACTION_ERRNO)
336 st = errno_to_name(t->answer_errno);
337 else
338 st = dns_transaction_state_to_string(state);
339
340 log_debug("Transaction %" PRIu16 " for <%s> on scope %s on %s/%s now complete with <%s> from %s (%s).",
341 t->id,
342 dns_resource_key_to_string(t->key, key_str, sizeof key_str),
343 dns_protocol_to_string(t->scope->protocol),
344 t->scope->link ? t->scope->link->name : "*",
345 af_to_name_short(t->scope->family),
346 st,
347 t->answer_source < 0 ? "none" : dns_transaction_source_to_string(t->answer_source),
348 t->answer_authenticated ? "authenticated" : "unsigned");
349
350 t->state = state;
351
352 dns_transaction_close_connection(t);
353 dns_transaction_stop_timeout(t);
354
355 /* Notify all queries that are interested, but make sure the
356 * transaction isn't freed while we are still looking at it */
357 t->block_gc++;
358
359 SET_FOREACH_MOVE(c, t->notify_query_candidates_done, t->notify_query_candidates)
360 dns_query_candidate_notify(c);
361 SWAP_TWO(t->notify_query_candidates, t->notify_query_candidates_done);
362
363 SET_FOREACH_MOVE(z, t->notify_zone_items_done, t->notify_zone_items)
364 dns_zone_item_notify(z);
365 SWAP_TWO(t->notify_zone_items, t->notify_zone_items_done);
366
367 SET_FOREACH_MOVE(d, t->notify_transactions_done, t->notify_transactions)
368 dns_transaction_notify(d, t);
369 SWAP_TWO(t->notify_transactions, t->notify_transactions_done);
370
371 t->block_gc--;
372 dns_transaction_gc(t);
373 }
374
375 static int dns_transaction_pick_server(DnsTransaction *t) {
376 DnsServer *server;
377
378 assert(t);
379 assert(t->scope->protocol == DNS_PROTOCOL_DNS);
380
381 /* Pick a DNS server and a feature level for it. */
382
383 server = dns_scope_get_dns_server(t->scope);
384 if (!server)
385 return -ESRCH;
386
387 /* If we changed the server invalidate the feature level clamping, as the new server might have completely
388 * different properties. */
389 if (server != t->server)
390 t->clamp_feature_level = _DNS_SERVER_FEATURE_LEVEL_INVALID;
391
392 t->current_feature_level = dns_server_possible_feature_level(server);
393
394 /* Clamp the feature level if that is requested. */
395 if (t->clamp_feature_level != _DNS_SERVER_FEATURE_LEVEL_INVALID &&
396 t->current_feature_level > t->clamp_feature_level)
397 t->current_feature_level = t->clamp_feature_level;
398
399 log_debug("Using feature level %s for transaction %u.", dns_server_feature_level_to_string(t->current_feature_level), t->id);
400
401 if (server == t->server)
402 return 0;
403
404 dns_server_unref(t->server);
405 t->server = dns_server_ref(server);
406
407 log_debug("Using DNS server %s for transaction %u.", dns_server_string(t->server), t->id);
408
409 return 1;
410 }
411
412 static void dns_transaction_retry(DnsTransaction *t, bool next_server) {
413 int r;
414
415 assert(t);
416
417 log_debug("Retrying transaction %" PRIu16 ".", t->id);
418
419 /* Before we try again, switch to a new server. */
420 if (next_server)
421 dns_scope_next_dns_server(t->scope);
422
423 r = dns_transaction_go(t);
424 if (r < 0) {
425 t->answer_errno = -r;
426 dns_transaction_complete(t, DNS_TRANSACTION_ERRNO);
427 }
428 }
429
430 static int dns_transaction_maybe_restart(DnsTransaction *t) {
431 int r;
432
433 assert(t);
434
435 /* Returns > 0 if the transaction was restarted, 0 if not */
436
437 if (!t->server)
438 return 0;
439
440 if (t->current_feature_level <= dns_server_possible_feature_level(t->server))
441 return 0;
442
443 /* The server's current feature level is lower than when we sent the original query. We learnt something from
444 the response or possibly an auxiliary DNSSEC response that we didn't know before. We take that as reason to
445 restart the whole transaction. This is a good idea to deal with servers that respond rubbish if we include
446 OPT RR or DO bit. One of these cases is documented here, for example:
447 https://open.nlnetlabs.nl/pipermail/dnssec-trigger/2014-November/000376.html */
448
449 log_debug("Server feature level is now lower than when we began our transaction. Restarting with new ID.");
450 dns_transaction_shuffle_id(t);
451
452 r = dns_transaction_go(t);
453 if (r < 0)
454 return r;
455
456 return 1;
457 }
458
459 static int on_stream_complete(DnsStream *s, int error) {
460 _cleanup_(dns_packet_unrefp) DnsPacket *p = NULL;
461 DnsTransaction *t;
462
463 assert(s);
464 assert(s->transaction);
465
466 /* Copy the data we care about out of the stream before we
467 * destroy it. */
468 t = s->transaction;
469 p = dns_packet_ref(s->read_packet);
470
471 dns_transaction_close_connection(t);
472
473 if (ERRNO_IS_DISCONNECT(error)) {
474 usec_t usec;
475
476 if (t->scope->protocol == DNS_PROTOCOL_LLMNR) {
477 /* If the LLMNR/TCP connection failed, the host doesn't support LLMNR, and we cannot answer the
478 * question on this scope. */
479 dns_transaction_complete(t, DNS_TRANSACTION_NOT_FOUND);
480 return 0;
481 }
482
483 log_debug_errno(error, "Connection failure for DNS TCP stream: %m");
484 assert_se(sd_event_now(t->scope->manager->event, clock_boottime_or_monotonic(), &usec) >= 0);
485 dns_server_packet_lost(t->server, IPPROTO_TCP, t->current_feature_level, usec - t->start_usec);
486
487 dns_transaction_retry(t, true);
488 return 0;
489 }
490 if (error != 0) {
491 t->answer_errno = error;
492 dns_transaction_complete(t, DNS_TRANSACTION_ERRNO);
493 return 0;
494 }
495
496 if (dns_packet_validate_reply(p) <= 0) {
497 log_debug("Invalid TCP reply packet.");
498 dns_transaction_complete(t, DNS_TRANSACTION_INVALID_REPLY);
499 return 0;
500 }
501
502 dns_scope_check_conflicts(t->scope, p);
503
504 t->block_gc++;
505 dns_transaction_process_reply(t, p);
506 t->block_gc--;
507
508 /* If the response wasn't useful, then complete the transition
509 * now. After all, we are the worst feature set now with TCP
510 * sockets, and there's really no point in retrying. */
511 if (t->state == DNS_TRANSACTION_PENDING)
512 dns_transaction_complete(t, DNS_TRANSACTION_INVALID_REPLY);
513 else
514 dns_transaction_gc(t);
515
516 return 0;
517 }
518
519 static int dns_transaction_open_tcp(DnsTransaction *t) {
520 _cleanup_close_ int fd = -1;
521 int r;
522
523 assert(t);
524
525 dns_transaction_close_connection(t);
526
527 switch (t->scope->protocol) {
528
529 case DNS_PROTOCOL_DNS:
530 r = dns_transaction_pick_server(t);
531 if (r < 0)
532 return r;
533
534 if (!dns_server_dnssec_supported(t->server) && dns_type_is_dnssec(t->key->type))
535 return -EOPNOTSUPP;
536
537 r = dns_server_adjust_opt(t->server, t->sent, t->current_feature_level);
538 if (r < 0)
539 return r;
540
541 fd = dns_scope_socket_tcp(t->scope, AF_UNSPEC, NULL, t->server, 53);
542 break;
543
544 case DNS_PROTOCOL_LLMNR:
545 /* When we already received a reply to this (but it was truncated), send to its sender address */
546 if (t->received)
547 fd = dns_scope_socket_tcp(t->scope, t->received->family, &t->received->sender, NULL, t->received->sender_port);
548 else {
549 union in_addr_union address;
550 int family = AF_UNSPEC;
551
552 /* Otherwise, try to talk to the owner of a
553 * the IP address, in case this is a reverse
554 * PTR lookup */
555
556 r = dns_name_address(dns_resource_key_name(t->key), &family, &address);
557 if (r < 0)
558 return r;
559 if (r == 0)
560 return -EINVAL;
561 if (family != t->scope->family)
562 return -ESRCH;
563
564 fd = dns_scope_socket_tcp(t->scope, family, &address, NULL, LLMNR_PORT);
565 }
566
567 break;
568
569 default:
570 return -EAFNOSUPPORT;
571 }
572
573 if (fd < 0)
574 return fd;
575
576 r = dns_stream_new(t->scope->manager, &t->stream, t->scope->protocol, fd);
577 if (r < 0)
578 return r;
579 fd = -1;
580
581 r = dns_stream_write_packet(t->stream, t->sent);
582 if (r < 0) {
583 t->stream = dns_stream_unref(t->stream);
584 return r;
585 }
586
587 t->stream->complete = on_stream_complete;
588 t->stream->transaction = t;
589
590 /* The interface index is difficult to determine if we are
591 * connecting to the local host, hence fill this in right away
592 * instead of determining it from the socket */
593 t->stream->ifindex = dns_scope_ifindex(t->scope);
594
595 dns_transaction_reset_answer(t);
596
597 t->tried_stream = true;
598
599 return 0;
600 }
601
602 static void dns_transaction_cache_answer(DnsTransaction *t) {
603 assert(t);
604
605 /* For mDNS we cache whenever we get the packet, rather than
606 * in each transaction. */
607 if (!IN_SET(t->scope->protocol, DNS_PROTOCOL_DNS, DNS_PROTOCOL_LLMNR))
608 return;
609
610 /* Caching disabled? */
611 if (!t->scope->manager->enable_cache)
612 return;
613
614 /* We never cache if this packet is from the local host, under
615 * the assumption that a locally running DNS server would
616 * cache this anyway, and probably knows better when to flush
617 * the cache then we could. */
618 if (!DNS_PACKET_SHALL_CACHE(t->received))
619 return;
620
621 dns_cache_put(&t->scope->cache,
622 t->key,
623 t->answer_rcode,
624 t->answer,
625 t->answer_authenticated,
626 t->answer_nsec_ttl,
627 0,
628 t->received->family,
629 &t->received->sender);
630 }
631
632 static bool dns_transaction_dnssec_is_live(DnsTransaction *t) {
633 DnsTransaction *dt;
634 Iterator i;
635
636 assert(t);
637
638 SET_FOREACH(dt, t->dnssec_transactions, i)
639 if (DNS_TRANSACTION_IS_LIVE(dt->state))
640 return true;
641
642 return false;
643 }
644
645 static int dns_transaction_dnssec_ready(DnsTransaction *t) {
646 DnsTransaction *dt;
647 Iterator i;
648
649 assert(t);
650
651 /* Checks whether the auxiliary DNSSEC transactions of our transaction have completed, or are still
652 * ongoing. Returns 0, if we aren't ready for the DNSSEC validation, positive if we are. */
653
654 SET_FOREACH(dt, t->dnssec_transactions, i) {
655
656 switch (dt->state) {
657
658 case DNS_TRANSACTION_NULL:
659 case DNS_TRANSACTION_PENDING:
660 case DNS_TRANSACTION_VALIDATING:
661 /* Still ongoing */
662 return 0;
663
664 case DNS_TRANSACTION_RCODE_FAILURE:
665 if (!IN_SET(dt->answer_rcode, DNS_RCODE_NXDOMAIN, DNS_RCODE_SERVFAIL)) {
666 log_debug("Auxiliary DNSSEC RR query failed with rcode=%s.", dns_rcode_to_string(dt->answer_rcode));
667 goto fail;
668 }
669
670 /* Fall-through: NXDOMAIN/SERVFAIL is good enough for us. This is because some DNS servers
671 * erronously return NXDOMAIN/SERVFAIL for empty non-terminals (Akamai...) or missing DS
672 * records (Facebook), and we need to handle that nicely, when asking for parent SOA or similar
673 * RRs to make unsigned proofs. */
674
675 case DNS_TRANSACTION_SUCCESS:
676 /* All good. */
677 break;
678
679 case DNS_TRANSACTION_DNSSEC_FAILED:
680 /* We handle DNSSEC failures different from other errors, as we care about the DNSSEC
681 * validationr result */
682
683 log_debug("Auxiliary DNSSEC RR query failed validation: %s", dnssec_result_to_string(dt->answer_dnssec_result));
684 t->answer_dnssec_result = dt->answer_dnssec_result; /* Copy error code over */
685 dns_transaction_complete(t, DNS_TRANSACTION_DNSSEC_FAILED);
686 return 0;
687
688
689 default:
690 log_debug("Auxiliary DNSSEC RR query failed with %s", dns_transaction_state_to_string(dt->state));
691 goto fail;
692 }
693 }
694
695 /* All is ready, we can go and validate */
696 return 1;
697
698 fail:
699 t->answer_dnssec_result = DNSSEC_FAILED_AUXILIARY;
700 dns_transaction_complete(t, DNS_TRANSACTION_DNSSEC_FAILED);
701 return 0;
702 }
703
704 static void dns_transaction_process_dnssec(DnsTransaction *t) {
705 int r;
706
707 assert(t);
708
709 /* Are there ongoing DNSSEC transactions? If so, let's wait for them. */
710 r = dns_transaction_dnssec_ready(t);
711 if (r < 0)
712 goto fail;
713 if (r == 0) /* We aren't ready yet (or one of our auxiliary transactions failed, and we shouldn't validate now */
714 return;
715
716 /* See if we learnt things from the additional DNSSEC transactions, that we didn't know before, and better
717 * restart the lookup immediately. */
718 r = dns_transaction_maybe_restart(t);
719 if (r < 0)
720 goto fail;
721 if (r > 0) /* Transaction got restarted... */
722 return;
723
724 /* All our auxiliary DNSSEC transactions are complete now. Try
725 * to validate our RRset now. */
726 r = dns_transaction_validate_dnssec(t);
727 if (r == -EBADMSG) {
728 dns_transaction_complete(t, DNS_TRANSACTION_INVALID_REPLY);
729 return;
730 }
731 if (r < 0)
732 goto fail;
733
734 if (t->answer_dnssec_result == DNSSEC_INCOMPATIBLE_SERVER &&
735 t->scope->dnssec_mode == DNSSEC_YES) {
736 /* We are not in automatic downgrade mode, and the
737 * server is bad, refuse operation. */
738 dns_transaction_complete(t, DNS_TRANSACTION_DNSSEC_FAILED);
739 return;
740 }
741
742 if (!IN_SET(t->answer_dnssec_result,
743 _DNSSEC_RESULT_INVALID, /* No DNSSEC validation enabled */
744 DNSSEC_VALIDATED, /* Answer is signed and validated successfully */
745 DNSSEC_UNSIGNED, /* Answer is right-fully unsigned */
746 DNSSEC_INCOMPATIBLE_SERVER)) { /* Server does not do DNSSEC (Yay, we are downgrade attack vulnerable!) */
747 dns_transaction_complete(t, DNS_TRANSACTION_DNSSEC_FAILED);
748 return;
749 }
750
751 if (t->answer_dnssec_result == DNSSEC_INCOMPATIBLE_SERVER)
752 dns_server_warn_downgrade(t->server);
753
754 dns_transaction_cache_answer(t);
755
756 if (t->answer_rcode == DNS_RCODE_SUCCESS)
757 dns_transaction_complete(t, DNS_TRANSACTION_SUCCESS);
758 else
759 dns_transaction_complete(t, DNS_TRANSACTION_RCODE_FAILURE);
760
761 return;
762
763 fail:
764 t->answer_errno = -r;
765 dns_transaction_complete(t, DNS_TRANSACTION_ERRNO);
766 }
767
768 static int dns_transaction_has_positive_answer(DnsTransaction *t, DnsAnswerFlags *flags) {
769 int r;
770
771 assert(t);
772
773 /* Checks whether the answer is positive, i.e. either a direct
774 * answer to the question, or a CNAME/DNAME for it */
775
776 r = dns_answer_match_key(t->answer, t->key, flags);
777 if (r != 0)
778 return r;
779
780 r = dns_answer_find_cname_or_dname(t->answer, t->key, NULL, flags);
781 if (r != 0)
782 return r;
783
784 return false;
785 }
786
787 static int dns_transaction_fix_rcode(DnsTransaction *t) {
788 int r;
789
790 assert(t);
791
792 /* Fix up the RCODE to SUCCESS if we get at least one matching RR in a response. Note that this contradicts the
793 * DNS RFCs a bit. Specifically, RFC 6604 Section 3 clarifies that the RCODE shall say something about a
794 * CNAME/DNAME chain element coming after the last chain element contained in the message, and not the first
795 * one included. However, it also indicates that not all DNS servers implement this correctly. Moreover, when
796 * using DNSSEC we usually only can prove the first element of a CNAME/DNAME chain anyway, hence let's settle
797 * on always processing the RCODE as referring to the immediate look-up we do, i.e. the first element of a
798 * CNAME/DNAME chain. This way, we uniformly handle CNAME/DNAME chains, regardless if the DNS server
799 * incorrectly implements RCODE, whether DNSSEC is in use, or whether the DNS server only supplied us with an
800 * incomplete CNAME/DNAME chain.
801 *
802 * Or in other words: if we get at least one positive reply in a message we patch NXDOMAIN to become SUCCESS,
803 * and then rely on the CNAME chasing logic to figure out that there's actually a CNAME error with a new
804 * lookup. */
805
806 if (t->answer_rcode != DNS_RCODE_NXDOMAIN)
807 return 0;
808
809 r = dns_transaction_has_positive_answer(t, NULL);
810 if (r <= 0)
811 return r;
812
813 t->answer_rcode = DNS_RCODE_SUCCESS;
814 return 0;
815 }
816
817 void dns_transaction_process_reply(DnsTransaction *t, DnsPacket *p) {
818 usec_t ts;
819 int r;
820
821 assert(t);
822 assert(p);
823 assert(t->scope);
824 assert(t->scope->manager);
825
826 if (t->state != DNS_TRANSACTION_PENDING)
827 return;
828
829 /* Note that this call might invalidate the query. Callers
830 * should hence not attempt to access the query or transaction
831 * after calling this function. */
832
833 log_debug("Processing incoming packet on transaction %" PRIu16".", t->id);
834
835 switch (t->scope->protocol) {
836
837 case DNS_PROTOCOL_LLMNR:
838 /* For LLMNR we will not accept any packets from other interfaces */
839
840 if (p->ifindex != dns_scope_ifindex(t->scope))
841 return;
842
843 if (p->family != t->scope->family)
844 return;
845
846 /* Tentative packets are not full responses but still
847 * useful for identifying uniqueness conflicts during
848 * probing. */
849 if (DNS_PACKET_LLMNR_T(p)) {
850 dns_transaction_tentative(t, p);
851 return;
852 }
853
854 break;
855
856 case DNS_PROTOCOL_MDNS:
857 /* For mDNS we will not accept any packets from other interfaces */
858
859 if (p->ifindex != dns_scope_ifindex(t->scope))
860 return;
861
862 if (p->family != t->scope->family)
863 return;
864
865 break;
866
867 case DNS_PROTOCOL_DNS:
868 /* Note that we do not need to verify the
869 * addresses/port numbers of incoming traffic, as we
870 * invoked connect() on our UDP socket in which case
871 * the kernel already does the needed verification for
872 * us. */
873 break;
874
875 default:
876 assert_not_reached("Invalid DNS protocol.");
877 }
878
879 if (t->received != p) {
880 dns_packet_unref(t->received);
881 t->received = dns_packet_ref(p);
882 }
883
884 t->answer_source = DNS_TRANSACTION_NETWORK;
885
886 if (p->ipproto == IPPROTO_TCP) {
887 if (DNS_PACKET_TC(p)) {
888 /* Truncated via TCP? Somebody must be fucking with us */
889 dns_transaction_complete(t, DNS_TRANSACTION_INVALID_REPLY);
890 return;
891 }
892
893 if (DNS_PACKET_ID(p) != t->id) {
894 /* Not the reply to our query? Somebody must be fucking with us */
895 dns_transaction_complete(t, DNS_TRANSACTION_INVALID_REPLY);
896 return;
897 }
898 }
899
900 assert_se(sd_event_now(t->scope->manager->event, clock_boottime_or_monotonic(), &ts) >= 0);
901
902 switch (t->scope->protocol) {
903
904 case DNS_PROTOCOL_DNS:
905 assert(t->server);
906
907 if (IN_SET(DNS_PACKET_RCODE(p), DNS_RCODE_FORMERR, DNS_RCODE_SERVFAIL, DNS_RCODE_NOTIMP)) {
908
909 /* Request failed, immediately try again with reduced features */
910
911 if (t->current_feature_level <= DNS_SERVER_FEATURE_LEVEL_WORST) {
912 /* This was already at the lowest possible feature level? If so, we can't downgrade
913 * this transaction anymore, hence let's process the response, and accept the rcode. */
914 log_debug("Server returned error: %s", dns_rcode_to_string(DNS_PACKET_RCODE(p)));
915 break;
916 }
917
918 /* Reduce this feature level by one and try again. */
919 t->clamp_feature_level = t->current_feature_level - 1;
920
921 log_debug("Server returned error %s, retrying transaction with reduced feature level %s.",
922 dns_rcode_to_string(DNS_PACKET_RCODE(p)),
923 dns_server_feature_level_to_string(t->clamp_feature_level));
924
925 dns_transaction_retry(t, false /* use the same server */);
926 return;
927 } else if (DNS_PACKET_TC(p))
928 dns_server_packet_truncated(t->server, t->current_feature_level);
929
930 break;
931
932 case DNS_PROTOCOL_LLMNR:
933 case DNS_PROTOCOL_MDNS:
934 dns_scope_packet_received(t->scope, ts - t->start_usec);
935 break;
936
937 default:
938 assert_not_reached("Invalid DNS protocol.");
939 }
940
941 if (DNS_PACKET_TC(p)) {
942
943 /* Truncated packets for mDNS are not allowed. Give up immediately. */
944 if (t->scope->protocol == DNS_PROTOCOL_MDNS) {
945 dns_transaction_complete(t, DNS_TRANSACTION_INVALID_REPLY);
946 return;
947 }
948
949 log_debug("Reply truncated, retrying via TCP.");
950
951 /* Response was truncated, let's try again with good old TCP */
952 r = dns_transaction_open_tcp(t);
953 if (r == -ESRCH) {
954 /* No servers found? Damn! */
955 dns_transaction_complete(t, DNS_TRANSACTION_NO_SERVERS);
956 return;
957 }
958 if (r == -EOPNOTSUPP) {
959 /* Tried to ask for DNSSEC RRs, on a server that doesn't do DNSSEC */
960 dns_transaction_complete(t, DNS_TRANSACTION_RR_TYPE_UNSUPPORTED);
961 return;
962 }
963 if (r < 0) {
964 /* On LLMNR, if we cannot connect to the host,
965 * we immediately give up */
966 if (t->scope->protocol != DNS_PROTOCOL_DNS)
967 goto fail;
968
969 /* On DNS, couldn't send? Try immediately again, with a new server */
970 dns_transaction_retry(t, true);
971 }
972
973 return;
974 }
975
976 /* After the superficial checks, actually parse the message. */
977 r = dns_packet_extract(p);
978 if (r < 0) {
979 dns_transaction_complete(t, DNS_TRANSACTION_INVALID_REPLY);
980 return;
981 }
982
983 if (t->server) {
984 /* Report that we successfully received a valid packet with a good rcode after we initially got a bad
985 * rcode and subsequently downgraded the protocol */
986
987 if (IN_SET(DNS_PACKET_RCODE(p), DNS_RCODE_SUCCESS, DNS_RCODE_NXDOMAIN) &&
988 t->clamp_feature_level != _DNS_SERVER_FEATURE_LEVEL_INVALID)
989 dns_server_packet_rcode_downgrade(t->server, t->clamp_feature_level);
990
991 /* Report that the OPT RR was missing */
992 if (!p->opt)
993 dns_server_packet_bad_opt(t->server, t->current_feature_level);
994
995 /* Report that we successfully received a packet */
996 dns_server_packet_received(t->server, p->ipproto, t->current_feature_level, ts - t->start_usec, p->size);
997 }
998
999 /* See if we know things we didn't know before that indicate we better restart the lookup immediately. */
1000 r = dns_transaction_maybe_restart(t);
1001 if (r < 0)
1002 goto fail;
1003 if (r > 0) /* Transaction got restarted... */
1004 return;
1005
1006 if (IN_SET(t->scope->protocol, DNS_PROTOCOL_DNS, DNS_PROTOCOL_LLMNR)) {
1007
1008 /* Only consider responses with equivalent query section to the request */
1009 r = dns_packet_is_reply_for(p, t->key);
1010 if (r < 0)
1011 goto fail;
1012 if (r == 0) {
1013 dns_transaction_complete(t, DNS_TRANSACTION_INVALID_REPLY);
1014 return;
1015 }
1016
1017 /* Install the answer as answer to the transaction */
1018 dns_answer_unref(t->answer);
1019 t->answer = dns_answer_ref(p->answer);
1020 t->answer_rcode = DNS_PACKET_RCODE(p);
1021 t->answer_dnssec_result = _DNSSEC_RESULT_INVALID;
1022 t->answer_authenticated = false;
1023
1024 r = dns_transaction_fix_rcode(t);
1025 if (r < 0)
1026 goto fail;
1027
1028 /* Block GC while starting requests for additional DNSSEC RRs */
1029 t->block_gc++;
1030 r = dns_transaction_request_dnssec_keys(t);
1031 t->block_gc--;
1032
1033 /* Maybe the transaction is ready for GC'ing now? If so, free it and return. */
1034 if (!dns_transaction_gc(t))
1035 return;
1036
1037 /* Requesting additional keys might have resulted in
1038 * this transaction to fail, since the auxiliary
1039 * request failed for some reason. If so, we are not
1040 * in pending state anymore, and we should exit
1041 * quickly. */
1042 if (t->state != DNS_TRANSACTION_PENDING)
1043 return;
1044 if (r < 0)
1045 goto fail;
1046 if (r > 0) {
1047 /* There are DNSSEC transactions pending now. Update the state accordingly. */
1048 t->state = DNS_TRANSACTION_VALIDATING;
1049 dns_transaction_close_connection(t);
1050 dns_transaction_stop_timeout(t);
1051 return;
1052 }
1053 }
1054
1055 dns_transaction_process_dnssec(t);
1056 return;
1057
1058 fail:
1059 t->answer_errno = -r;
1060 dns_transaction_complete(t, DNS_TRANSACTION_ERRNO);
1061 }
1062
1063 static int on_dns_packet(sd_event_source *s, int fd, uint32_t revents, void *userdata) {
1064 _cleanup_(dns_packet_unrefp) DnsPacket *p = NULL;
1065 DnsTransaction *t = userdata;
1066 int r;
1067
1068 assert(t);
1069 assert(t->scope);
1070
1071 r = manager_recv(t->scope->manager, fd, DNS_PROTOCOL_DNS, &p);
1072 if (ERRNO_IS_DISCONNECT(-r)) {
1073 usec_t usec;
1074
1075 /* UDP connection failure get reported via ICMP and then are possible delivered to us on the next
1076 * recvmsg(). Treat this like a lost packet. */
1077
1078 log_debug_errno(r, "Connection failure for DNS UDP packet: %m");
1079 assert_se(sd_event_now(t->scope->manager->event, clock_boottime_or_monotonic(), &usec) >= 0);
1080 dns_server_packet_lost(t->server, IPPROTO_UDP, t->current_feature_level, usec - t->start_usec);
1081
1082 dns_transaction_retry(t, true);
1083 return 0;
1084 }
1085 if (r < 0) {
1086 dns_transaction_complete(t, DNS_TRANSACTION_ERRNO);
1087 t->answer_errno = -r;
1088 return 0;
1089 }
1090
1091 r = dns_packet_validate_reply(p);
1092 if (r < 0) {
1093 log_debug_errno(r, "Received invalid DNS packet as response, ignoring: %m");
1094 return 0;
1095 }
1096 if (r == 0) {
1097 log_debug("Received inappropriate DNS packet as response, ignoring.");
1098 return 0;
1099 }
1100
1101 if (DNS_PACKET_ID(p) != t->id) {
1102 log_debug("Received packet with incorrect transaction ID, ignoring.");
1103 return 0;
1104 }
1105
1106 dns_transaction_process_reply(t, p);
1107 return 0;
1108 }
1109
1110 static int dns_transaction_emit_udp(DnsTransaction *t) {
1111 int r;
1112
1113 assert(t);
1114
1115 if (t->scope->protocol == DNS_PROTOCOL_DNS) {
1116
1117 r = dns_transaction_pick_server(t);
1118 if (r < 0)
1119 return r;
1120
1121 if (t->current_feature_level < DNS_SERVER_FEATURE_LEVEL_UDP)
1122 return -EAGAIN;
1123
1124 if (!dns_server_dnssec_supported(t->server) && dns_type_is_dnssec(t->key->type))
1125 return -EOPNOTSUPP;
1126
1127 if (r > 0 || t->dns_udp_fd < 0) { /* Server changed, or no connection yet. */
1128 int fd;
1129
1130 dns_transaction_close_connection(t);
1131
1132 fd = dns_scope_socket_udp(t->scope, t->server, 53);
1133 if (fd < 0)
1134 return fd;
1135
1136 r = sd_event_add_io(t->scope->manager->event, &t->dns_udp_event_source, fd, EPOLLIN, on_dns_packet, t);
1137 if (r < 0) {
1138 safe_close(fd);
1139 return r;
1140 }
1141
1142 (void) sd_event_source_set_description(t->dns_udp_event_source, "dns-transaction-udp");
1143 t->dns_udp_fd = fd;
1144 }
1145
1146 r = dns_server_adjust_opt(t->server, t->sent, t->current_feature_level);
1147 if (r < 0)
1148 return r;
1149 } else
1150 dns_transaction_close_connection(t);
1151
1152 r = dns_scope_emit_udp(t->scope, t->dns_udp_fd, t->sent);
1153 if (r < 0)
1154 return r;
1155
1156 dns_transaction_reset_answer(t);
1157
1158 return 0;
1159 }
1160
1161 static int on_transaction_timeout(sd_event_source *s, usec_t usec, void *userdata) {
1162 DnsTransaction *t = userdata;
1163
1164 assert(s);
1165 assert(t);
1166
1167 if (!t->initial_jitter_scheduled || t->initial_jitter_elapsed) {
1168 /* Timeout reached? Increase the timeout for the server used */
1169 switch (t->scope->protocol) {
1170
1171 case DNS_PROTOCOL_DNS:
1172 assert(t->server);
1173 dns_server_packet_lost(t->server, t->stream ? IPPROTO_TCP : IPPROTO_UDP, t->current_feature_level, usec - t->start_usec);
1174 break;
1175
1176 case DNS_PROTOCOL_LLMNR:
1177 case DNS_PROTOCOL_MDNS:
1178 dns_scope_packet_lost(t->scope, usec - t->start_usec);
1179 break;
1180
1181 default:
1182 assert_not_reached("Invalid DNS protocol.");
1183 }
1184
1185 if (t->initial_jitter_scheduled)
1186 t->initial_jitter_elapsed = true;
1187 }
1188
1189 log_debug("Timeout reached on transaction %" PRIu16 ".", t->id);
1190
1191 dns_transaction_retry(t, true);
1192 return 0;
1193 }
1194
1195 static usec_t transaction_get_resend_timeout(DnsTransaction *t) {
1196 assert(t);
1197 assert(t->scope);
1198
1199 switch (t->scope->protocol) {
1200
1201 case DNS_PROTOCOL_DNS:
1202 assert(t->server);
1203 return t->server->resend_timeout;
1204
1205 case DNS_PROTOCOL_MDNS:
1206 assert(t->n_attempts > 0);
1207 return (1 << (t->n_attempts - 1)) * USEC_PER_SEC;
1208
1209 case DNS_PROTOCOL_LLMNR:
1210 return t->scope->resend_timeout;
1211
1212 default:
1213 assert_not_reached("Invalid DNS protocol.");
1214 }
1215 }
1216
1217 static int dns_transaction_prepare(DnsTransaction *t, usec_t ts) {
1218 int r;
1219
1220 assert(t);
1221
1222 dns_transaction_stop_timeout(t);
1223
1224 r = dns_scope_network_good(t->scope);
1225 if (r < 0)
1226 return r;
1227 if (r == 0) {
1228 dns_transaction_complete(t, DNS_TRANSACTION_NETWORK_DOWN);
1229 return 0;
1230 }
1231
1232 if (t->n_attempts >= TRANSACTION_ATTEMPTS_MAX(t->scope->protocol)) {
1233 dns_transaction_complete(t, DNS_TRANSACTION_ATTEMPTS_MAX_REACHED);
1234 return 0;
1235 }
1236
1237 if (t->scope->protocol == DNS_PROTOCOL_LLMNR && t->tried_stream) {
1238 /* If we already tried via a stream, then we don't
1239 * retry on LLMNR. See RFC 4795, Section 2.7. */
1240 dns_transaction_complete(t, DNS_TRANSACTION_ATTEMPTS_MAX_REACHED);
1241 return 0;
1242 }
1243
1244 t->n_attempts++;
1245 t->start_usec = ts;
1246
1247 dns_transaction_reset_answer(t);
1248 dns_transaction_flush_dnssec_transactions(t);
1249
1250 /* Check the trust anchor. Do so only on classic DNS, since DNSSEC does not apply otherwise. */
1251 if (t->scope->protocol == DNS_PROTOCOL_DNS) {
1252 r = dns_trust_anchor_lookup_positive(&t->scope->manager->trust_anchor, t->key, &t->answer);
1253 if (r < 0)
1254 return r;
1255 if (r > 0) {
1256 t->answer_rcode = DNS_RCODE_SUCCESS;
1257 t->answer_source = DNS_TRANSACTION_TRUST_ANCHOR;
1258 t->answer_authenticated = true;
1259 dns_transaction_complete(t, DNS_TRANSACTION_SUCCESS);
1260 return 0;
1261 }
1262
1263 if (dns_name_is_root(dns_resource_key_name(t->key)) &&
1264 t->key->type == DNS_TYPE_DS) {
1265
1266 /* Hmm, this is a request for the root DS? A
1267 * DS RR doesn't exist in the root zone, and
1268 * if our trust anchor didn't know it either,
1269 * this means we cannot do any DNSSEC logic
1270 * anymore. */
1271
1272 if (t->scope->dnssec_mode == DNSSEC_ALLOW_DOWNGRADE) {
1273 /* We are in downgrade mode. In this
1274 * case, synthesize an unsigned empty
1275 * response, so that the any lookup
1276 * depending on this one can continue
1277 * assuming there was no DS, and hence
1278 * the root zone was unsigned. */
1279
1280 t->answer_rcode = DNS_RCODE_SUCCESS;
1281 t->answer_source = DNS_TRANSACTION_TRUST_ANCHOR;
1282 t->answer_authenticated = false;
1283 dns_transaction_complete(t, DNS_TRANSACTION_SUCCESS);
1284 } else
1285 /* If we are not in downgrade mode,
1286 * then fail the lookup, because we
1287 * cannot reasonably answer it. There
1288 * might be DS RRs, but we don't know
1289 * them, and the DNS server won't tell
1290 * them to us (and even if it would,
1291 * we couldn't validate and trust them. */
1292 dns_transaction_complete(t, DNS_TRANSACTION_NO_TRUST_ANCHOR);
1293
1294 return 0;
1295 }
1296 }
1297
1298 /* Check the zone, but only if this transaction is not used
1299 * for probing or verifying a zone item. */
1300 if (set_isempty(t->notify_zone_items)) {
1301
1302 r = dns_zone_lookup(&t->scope->zone, t->key, dns_scope_ifindex(t->scope), &t->answer, NULL, NULL);
1303 if (r < 0)
1304 return r;
1305 if (r > 0) {
1306 t->answer_rcode = DNS_RCODE_SUCCESS;
1307 t->answer_source = DNS_TRANSACTION_ZONE;
1308 t->answer_authenticated = true;
1309 dns_transaction_complete(t, DNS_TRANSACTION_SUCCESS);
1310 return 0;
1311 }
1312 }
1313
1314 /* Check the cache, but only if this transaction is not used
1315 * for probing or verifying a zone item. */
1316 if (set_isempty(t->notify_zone_items)) {
1317
1318 /* Before trying the cache, let's make sure we figured out a
1319 * server to use. Should this cause a change of server this
1320 * might flush the cache. */
1321 dns_scope_get_dns_server(t->scope);
1322
1323 /* Let's then prune all outdated entries */
1324 dns_cache_prune(&t->scope->cache);
1325
1326 r = dns_cache_lookup(&t->scope->cache, t->key, t->clamp_ttl, &t->answer_rcode, &t->answer, &t->answer_authenticated);
1327 if (r < 0)
1328 return r;
1329 if (r > 0) {
1330 t->answer_source = DNS_TRANSACTION_CACHE;
1331 if (t->answer_rcode == DNS_RCODE_SUCCESS)
1332 dns_transaction_complete(t, DNS_TRANSACTION_SUCCESS);
1333 else
1334 dns_transaction_complete(t, DNS_TRANSACTION_RCODE_FAILURE);
1335 return 0;
1336 }
1337 }
1338
1339 return 1;
1340 }
1341
1342 static int dns_transaction_make_packet_mdns(DnsTransaction *t) {
1343
1344 _cleanup_(dns_packet_unrefp) DnsPacket *p = NULL;
1345 bool add_known_answers = false;
1346 DnsTransaction *other;
1347 unsigned qdcount;
1348 usec_t ts;
1349 int r;
1350
1351 assert(t);
1352 assert(t->scope->protocol == DNS_PROTOCOL_MDNS);
1353
1354 /* Discard any previously prepared packet, so we can start over and coalesce again */
1355 t->sent = dns_packet_unref(t->sent);
1356
1357 r = dns_packet_new_query(&p, t->scope->protocol, 0, false);
1358 if (r < 0)
1359 return r;
1360
1361 r = dns_packet_append_key(p, t->key, NULL);
1362 if (r < 0)
1363 return r;
1364
1365 qdcount = 1;
1366
1367 if (dns_key_is_shared(t->key))
1368 add_known_answers = true;
1369
1370 /*
1371 * For mDNS, we want to coalesce as many open queries in pending transactions into one single
1372 * query packet on the wire as possible. To achieve that, we iterate through all pending transactions
1373 * in our current scope, and see whether their timing contraints allow them to be sent.
1374 */
1375
1376 assert_se(sd_event_now(t->scope->manager->event, clock_boottime_or_monotonic(), &ts) >= 0);
1377
1378 LIST_FOREACH(transactions_by_scope, other, t->scope->transactions) {
1379
1380 /* Skip ourselves */
1381 if (other == t)
1382 continue;
1383
1384 if (other->state != DNS_TRANSACTION_PENDING)
1385 continue;
1386
1387 if (other->next_attempt_after > ts)
1388 continue;
1389
1390 if (qdcount >= UINT16_MAX)
1391 break;
1392
1393 r = dns_packet_append_key(p, other->key, NULL);
1394
1395 /*
1396 * If we can't stuff more questions into the packet, just give up.
1397 * One of the 'other' transactions will fire later and take care of the rest.
1398 */
1399 if (r == -EMSGSIZE)
1400 break;
1401
1402 if (r < 0)
1403 return r;
1404
1405 r = dns_transaction_prepare(other, ts);
1406 if (r <= 0)
1407 continue;
1408
1409 ts += transaction_get_resend_timeout(other);
1410
1411 r = sd_event_add_time(
1412 other->scope->manager->event,
1413 &other->timeout_event_source,
1414 clock_boottime_or_monotonic(),
1415 ts, 0,
1416 on_transaction_timeout, other);
1417 if (r < 0)
1418 return r;
1419
1420 (void) sd_event_source_set_description(t->timeout_event_source, "dns-transaction-timeout");
1421
1422 other->state = DNS_TRANSACTION_PENDING;
1423 other->next_attempt_after = ts;
1424
1425 qdcount++;
1426
1427 if (dns_key_is_shared(other->key))
1428 add_known_answers = true;
1429 }
1430
1431 DNS_PACKET_HEADER(p)->qdcount = htobe16(qdcount);
1432
1433 /* Append known answer section if we're asking for any shared record */
1434 if (add_known_answers) {
1435 r = dns_cache_export_shared_to_packet(&t->scope->cache, p);
1436 if (r < 0)
1437 return r;
1438 }
1439
1440 t->sent = p;
1441 p = NULL;
1442
1443 return 0;
1444 }
1445
1446 static int dns_transaction_make_packet(DnsTransaction *t) {
1447 _cleanup_(dns_packet_unrefp) DnsPacket *p = NULL;
1448 int r;
1449
1450 assert(t);
1451
1452 if (t->scope->protocol == DNS_PROTOCOL_MDNS)
1453 return dns_transaction_make_packet_mdns(t);
1454
1455 if (t->sent)
1456 return 0;
1457
1458 r = dns_packet_new_query(&p, t->scope->protocol, 0, t->scope->dnssec_mode != DNSSEC_NO);
1459 if (r < 0)
1460 return r;
1461
1462 r = dns_packet_append_key(p, t->key, NULL);
1463 if (r < 0)
1464 return r;
1465
1466 DNS_PACKET_HEADER(p)->qdcount = htobe16(1);
1467 DNS_PACKET_HEADER(p)->id = t->id;
1468
1469 t->sent = p;
1470 p = NULL;
1471
1472 return 0;
1473 }
1474
1475 int dns_transaction_go(DnsTransaction *t) {
1476 usec_t ts;
1477 int r;
1478 char key_str[DNS_RESOURCE_KEY_STRING_MAX];
1479
1480 assert(t);
1481
1482 /* Returns > 0 if the transaction is now pending, returns 0 if could be processed immediately and has finished
1483 * now. */
1484
1485 assert_se(sd_event_now(t->scope->manager->event, clock_boottime_or_monotonic(), &ts) >= 0);
1486
1487 r = dns_transaction_prepare(t, ts);
1488 if (r <= 0)
1489 return r;
1490
1491 log_debug("Transaction %" PRIu16 " for <%s> scope %s on %s/%s.",
1492 t->id,
1493 dns_resource_key_to_string(t->key, key_str, sizeof key_str),
1494 dns_protocol_to_string(t->scope->protocol),
1495 t->scope->link ? t->scope->link->name : "*",
1496 af_to_name_short(t->scope->family));
1497
1498 if (!t->initial_jitter_scheduled &&
1499 (t->scope->protocol == DNS_PROTOCOL_LLMNR ||
1500 t->scope->protocol == DNS_PROTOCOL_MDNS)) {
1501 usec_t jitter, accuracy;
1502
1503 /* RFC 4795 Section 2.7 suggests all queries should be
1504 * delayed by a random time from 0 to JITTER_INTERVAL. */
1505
1506 t->initial_jitter_scheduled = true;
1507
1508 random_bytes(&jitter, sizeof(jitter));
1509
1510 switch (t->scope->protocol) {
1511
1512 case DNS_PROTOCOL_LLMNR:
1513 jitter %= LLMNR_JITTER_INTERVAL_USEC;
1514 accuracy = LLMNR_JITTER_INTERVAL_USEC;
1515 break;
1516
1517 case DNS_PROTOCOL_MDNS:
1518 jitter %= MDNS_JITTER_RANGE_USEC;
1519 jitter += MDNS_JITTER_MIN_USEC;
1520 accuracy = MDNS_JITTER_RANGE_USEC;
1521 break;
1522 default:
1523 assert_not_reached("bad protocol");
1524 }
1525
1526 r = sd_event_add_time(
1527 t->scope->manager->event,
1528 &t->timeout_event_source,
1529 clock_boottime_or_monotonic(),
1530 ts + jitter, accuracy,
1531 on_transaction_timeout, t);
1532 if (r < 0)
1533 return r;
1534
1535 (void) sd_event_source_set_description(t->timeout_event_source, "dns-transaction-timeout");
1536
1537 t->n_attempts = 0;
1538 t->next_attempt_after = ts;
1539 t->state = DNS_TRANSACTION_PENDING;
1540
1541 log_debug("Delaying %s transaction for " USEC_FMT "us.", dns_protocol_to_string(t->scope->protocol), jitter);
1542 return 0;
1543 }
1544
1545 /* Otherwise, we need to ask the network */
1546 r = dns_transaction_make_packet(t);
1547 if (r < 0)
1548 return r;
1549
1550 if (t->scope->protocol == DNS_PROTOCOL_LLMNR &&
1551 (dns_name_endswith(dns_resource_key_name(t->key), "in-addr.arpa") > 0 ||
1552 dns_name_endswith(dns_resource_key_name(t->key), "ip6.arpa") > 0)) {
1553
1554 /* RFC 4795, Section 2.4. says reverse lookups shall
1555 * always be made via TCP on LLMNR */
1556 r = dns_transaction_open_tcp(t);
1557 } else {
1558 /* Try via UDP, and if that fails due to large size or lack of
1559 * support try via TCP */
1560 r = dns_transaction_emit_udp(t);
1561 if (r == -EMSGSIZE)
1562 log_debug("Sending query via TCP since it is too large.");
1563 if (r == -EAGAIN)
1564 log_debug("Sending query via TCP since server doesn't support UDP.");
1565 if (r == -EMSGSIZE || r == -EAGAIN)
1566 r = dns_transaction_open_tcp(t);
1567 }
1568
1569 if (r == -ESRCH) {
1570 /* No servers to send this to? */
1571 dns_transaction_complete(t, DNS_TRANSACTION_NO_SERVERS);
1572 return 0;
1573 }
1574 if (r == -EOPNOTSUPP) {
1575 /* Tried to ask for DNSSEC RRs, on a server that doesn't do DNSSEC */
1576 dns_transaction_complete(t, DNS_TRANSACTION_RR_TYPE_UNSUPPORTED);
1577 return 0;
1578 }
1579 if (t->scope->protocol == DNS_PROTOCOL_LLMNR && ERRNO_IS_DISCONNECT(-r)) {
1580 /* On LLMNR, if we cannot connect to a host via TCP when doing reverse lookups. This means we cannot
1581 * answer this request with this protocol. */
1582 dns_transaction_complete(t, DNS_TRANSACTION_NOT_FOUND);
1583 return 0;
1584 }
1585 if (r < 0) {
1586 if (t->scope->protocol != DNS_PROTOCOL_DNS)
1587 return r;
1588
1589 /* Couldn't send? Try immediately again, with a new server */
1590 dns_scope_next_dns_server(t->scope);
1591
1592 return dns_transaction_go(t);
1593 }
1594
1595 ts += transaction_get_resend_timeout(t);
1596
1597 r = sd_event_add_time(
1598 t->scope->manager->event,
1599 &t->timeout_event_source,
1600 clock_boottime_or_monotonic(),
1601 ts, 0,
1602 on_transaction_timeout, t);
1603 if (r < 0)
1604 return r;
1605
1606 (void) sd_event_source_set_description(t->timeout_event_source, "dns-transaction-timeout");
1607
1608 t->state = DNS_TRANSACTION_PENDING;
1609 t->next_attempt_after = ts;
1610
1611 return 1;
1612 }
1613
1614 static int dns_transaction_find_cyclic(DnsTransaction *t, DnsTransaction *aux) {
1615 DnsTransaction *n;
1616 Iterator i;
1617 int r;
1618
1619 assert(t);
1620 assert(aux);
1621
1622 /* Try to find cyclic dependencies between transaction objects */
1623
1624 if (t == aux)
1625 return 1;
1626
1627 SET_FOREACH(n, aux->dnssec_transactions, i) {
1628 r = dns_transaction_find_cyclic(t, n);
1629 if (r != 0)
1630 return r;
1631 }
1632
1633 return 0;
1634 }
1635
1636 static int dns_transaction_add_dnssec_transaction(DnsTransaction *t, DnsResourceKey *key, DnsTransaction **ret) {
1637 DnsTransaction *aux;
1638 int r;
1639
1640 assert(t);
1641 assert(ret);
1642 assert(key);
1643
1644 aux = dns_scope_find_transaction(t->scope, key, true);
1645 if (!aux) {
1646 r = dns_transaction_new(&aux, t->scope, key);
1647 if (r < 0)
1648 return r;
1649 } else {
1650 if (set_contains(t->dnssec_transactions, aux)) {
1651 *ret = aux;
1652 return 0;
1653 }
1654
1655 r = dns_transaction_find_cyclic(t, aux);
1656 if (r < 0)
1657 return r;
1658 if (r > 0) {
1659 char s[DNS_RESOURCE_KEY_STRING_MAX], saux[DNS_RESOURCE_KEY_STRING_MAX];
1660
1661 log_debug("Potential cyclic dependency, refusing to add transaction %" PRIu16 " (%s) as dependency for %" PRIu16 " (%s).",
1662 aux->id,
1663 dns_resource_key_to_string(t->key, s, sizeof s),
1664 t->id,
1665 dns_resource_key_to_string(aux->key, saux, sizeof saux));
1666
1667 return -ELOOP;
1668 }
1669 }
1670
1671 r = set_ensure_allocated(&t->dnssec_transactions, NULL);
1672 if (r < 0)
1673 goto gc;
1674
1675 r = set_ensure_allocated(&aux->notify_transactions, NULL);
1676 if (r < 0)
1677 goto gc;
1678
1679 r = set_ensure_allocated(&aux->notify_transactions_done, NULL);
1680 if (r < 0)
1681 goto gc;
1682
1683 r = set_put(t->dnssec_transactions, aux);
1684 if (r < 0)
1685 goto gc;
1686
1687 r = set_put(aux->notify_transactions, t);
1688 if (r < 0) {
1689 (void) set_remove(t->dnssec_transactions, aux);
1690 goto gc;
1691 }
1692
1693 *ret = aux;
1694 return 1;
1695
1696 gc:
1697 dns_transaction_gc(aux);
1698 return r;
1699 }
1700
1701 static int dns_transaction_request_dnssec_rr(DnsTransaction *t, DnsResourceKey *key) {
1702 _cleanup_(dns_answer_unrefp) DnsAnswer *a = NULL;
1703 DnsTransaction *aux;
1704 int r;
1705
1706 assert(t);
1707 assert(key);
1708
1709 /* Try to get the data from the trust anchor */
1710 r = dns_trust_anchor_lookup_positive(&t->scope->manager->trust_anchor, key, &a);
1711 if (r < 0)
1712 return r;
1713 if (r > 0) {
1714 r = dns_answer_extend(&t->validated_keys, a);
1715 if (r < 0)
1716 return r;
1717
1718 return 0;
1719 }
1720
1721 /* This didn't work, ask for it via the network/cache then. */
1722 r = dns_transaction_add_dnssec_transaction(t, key, &aux);
1723 if (r == -ELOOP) /* This would result in a cyclic dependency */
1724 return 0;
1725 if (r < 0)
1726 return r;
1727
1728 if (aux->state == DNS_TRANSACTION_NULL) {
1729 r = dns_transaction_go(aux);
1730 if (r < 0)
1731 return r;
1732 }
1733
1734 return 1;
1735 }
1736
1737 static int dns_transaction_negative_trust_anchor_lookup(DnsTransaction *t, const char *name) {
1738 int r;
1739
1740 assert(t);
1741
1742 /* Check whether the specified name is in the NTA
1743 * database, either in the global one, or the link-local
1744 * one. */
1745
1746 r = dns_trust_anchor_lookup_negative(&t->scope->manager->trust_anchor, name);
1747 if (r != 0)
1748 return r;
1749
1750 if (!t->scope->link)
1751 return 0;
1752
1753 return set_contains(t->scope->link->dnssec_negative_trust_anchors, name);
1754 }
1755
1756 static int dns_transaction_has_unsigned_negative_answer(DnsTransaction *t) {
1757 int r;
1758
1759 assert(t);
1760
1761 /* Checks whether the answer is negative, and lacks NSEC/NSEC3
1762 * RRs to prove it */
1763
1764 r = dns_transaction_has_positive_answer(t, NULL);
1765 if (r < 0)
1766 return r;
1767 if (r > 0)
1768 return false;
1769
1770 /* Is this key explicitly listed as a negative trust anchor?
1771 * If so, it's nothing we need to care about */
1772 r = dns_transaction_negative_trust_anchor_lookup(t, dns_resource_key_name(t->key));
1773 if (r < 0)
1774 return r;
1775 if (r > 0)
1776 return false;
1777
1778 /* The answer does not contain any RRs that match to the
1779 * question. If so, let's see if there are any NSEC/NSEC3 RRs
1780 * included. If not, the answer is unsigned. */
1781
1782 r = dns_answer_contains_nsec_or_nsec3(t->answer);
1783 if (r < 0)
1784 return r;
1785 if (r > 0)
1786 return false;
1787
1788 return true;
1789 }
1790
1791 static int dns_transaction_is_primary_response(DnsTransaction *t, DnsResourceRecord *rr) {
1792 int r;
1793
1794 assert(t);
1795 assert(rr);
1796
1797 /* Check if the specified RR is the "primary" response,
1798 * i.e. either matches the question precisely or is a
1799 * CNAME/DNAME for it. */
1800
1801 r = dns_resource_key_match_rr(t->key, rr, NULL);
1802 if (r != 0)
1803 return r;
1804
1805 return dns_resource_key_match_cname_or_dname(t->key, rr->key, NULL);
1806 }
1807
1808 static bool dns_transaction_dnssec_supported(DnsTransaction *t) {
1809 assert(t);
1810
1811 /* Checks whether our transaction's DNS server is assumed to be compatible with DNSSEC. Returns false as soon
1812 * as we changed our mind about a server, and now believe it is incompatible with DNSSEC. */
1813
1814 if (t->scope->protocol != DNS_PROTOCOL_DNS)
1815 return false;
1816
1817 /* If we have picked no server, then we are working from the cache or some other source, and DNSSEC might well
1818 * be supported, hence return true. */
1819 if (!t->server)
1820 return true;
1821
1822 /* Note that we do not check the feature level actually used for the transaction but instead the feature level
1823 * the server is known to support currently, as the transaction feature level might be lower than what the
1824 * server actually supports, since we might have downgraded this transaction's feature level because we got a
1825 * SERVFAIL earlier and wanted to check whether downgrading fixes it. */
1826
1827 return dns_server_dnssec_supported(t->server);
1828 }
1829
1830 static bool dns_transaction_dnssec_supported_full(DnsTransaction *t) {
1831 DnsTransaction *dt;
1832 Iterator i;
1833
1834 assert(t);
1835
1836 /* Checks whether our transaction our any of the auxiliary transactions couldn't do DNSSEC. */
1837
1838 if (!dns_transaction_dnssec_supported(t))
1839 return false;
1840
1841 SET_FOREACH(dt, t->dnssec_transactions, i)
1842 if (!dns_transaction_dnssec_supported(dt))
1843 return false;
1844
1845 return true;
1846 }
1847
1848 int dns_transaction_request_dnssec_keys(DnsTransaction *t) {
1849 DnsResourceRecord *rr;
1850
1851 int r;
1852
1853 assert(t);
1854
1855 /*
1856 * Retrieve all auxiliary RRs for the answer we got, so that
1857 * we can verify signatures or prove that RRs are rightfully
1858 * unsigned. Specifically:
1859 *
1860 * - For RRSIG we get the matching DNSKEY
1861 * - For DNSKEY we get the matching DS
1862 * - For unsigned SOA/NS we get the matching DS
1863 * - For unsigned CNAME/DNAME/DS we get the parent SOA RR
1864 * - For other unsigned RRs we get the matching SOA RR
1865 * - For SOA/NS queries with no matching response RR, and no NSEC/NSEC3, the DS RR
1866 * - For DS queries with no matching response RRs, and no NSEC/NSEC3, the parent's SOA RR
1867 * - For other queries with no matching response RRs, and no NSEC/NSEC3, the SOA RR
1868 */
1869
1870 if (t->scope->dnssec_mode == DNSSEC_NO)
1871 return 0;
1872 if (t->answer_source != DNS_TRANSACTION_NETWORK)
1873 return 0; /* We only need to validate stuff from the network */
1874 if (!dns_transaction_dnssec_supported(t))
1875 return 0; /* If we can't do DNSSEC anyway there's no point in geting the auxiliary RRs */
1876
1877 DNS_ANSWER_FOREACH(rr, t->answer) {
1878
1879 if (dns_type_is_pseudo(rr->key->type))
1880 continue;
1881
1882 /* If this RR is in the negative trust anchor, we don't need to validate it. */
1883 r = dns_transaction_negative_trust_anchor_lookup(t, dns_resource_key_name(rr->key));
1884 if (r < 0)
1885 return r;
1886 if (r > 0)
1887 continue;
1888
1889 switch (rr->key->type) {
1890
1891 case DNS_TYPE_RRSIG: {
1892 /* For each RRSIG we request the matching DNSKEY */
1893 _cleanup_(dns_resource_key_unrefp) DnsResourceKey *dnskey = NULL;
1894
1895 /* If this RRSIG is about a DNSKEY RR and the
1896 * signer is the same as the owner, then we
1897 * already have the DNSKEY, and we don't have
1898 * to look for more. */
1899 if (rr->rrsig.type_covered == DNS_TYPE_DNSKEY) {
1900 r = dns_name_equal(rr->rrsig.signer, dns_resource_key_name(rr->key));
1901 if (r < 0)
1902 return r;
1903 if (r > 0)
1904 continue;
1905 }
1906
1907 /* If the signer is not a parent of our
1908 * original query, then this is about an
1909 * auxiliary RRset, but not anything we asked
1910 * for. In this case we aren't interested,
1911 * because we don't want to request additional
1912 * RRs for stuff we didn't really ask for, and
1913 * also to avoid request loops, where
1914 * additional RRs from one transaction result
1915 * in another transaction whose additonal RRs
1916 * point back to the original transaction, and
1917 * we deadlock. */
1918 r = dns_name_endswith(dns_resource_key_name(t->key), rr->rrsig.signer);
1919 if (r < 0)
1920 return r;
1921 if (r == 0)
1922 continue;
1923
1924 dnskey = dns_resource_key_new(rr->key->class, DNS_TYPE_DNSKEY, rr->rrsig.signer);
1925 if (!dnskey)
1926 return -ENOMEM;
1927
1928 log_debug("Requesting DNSKEY to validate transaction %" PRIu16" (%s, RRSIG with key tag: %" PRIu16 ").",
1929 t->id, dns_resource_key_name(rr->key), rr->rrsig.key_tag);
1930 r = dns_transaction_request_dnssec_rr(t, dnskey);
1931 if (r < 0)
1932 return r;
1933 break;
1934 }
1935
1936 case DNS_TYPE_DNSKEY: {
1937 /* For each DNSKEY we request the matching DS */
1938 _cleanup_(dns_resource_key_unrefp) DnsResourceKey *ds = NULL;
1939
1940 /* If the DNSKEY we are looking at is not for
1941 * zone we are interested in, nor any of its
1942 * parents, we aren't interested, and don't
1943 * request it. After all, we don't want to end
1944 * up in request loops, and want to keep
1945 * additional traffic down. */
1946
1947 r = dns_name_endswith(dns_resource_key_name(t->key), dns_resource_key_name(rr->key));
1948 if (r < 0)
1949 return r;
1950 if (r == 0)
1951 continue;
1952
1953 ds = dns_resource_key_new(rr->key->class, DNS_TYPE_DS, dns_resource_key_name(rr->key));
1954 if (!ds)
1955 return -ENOMEM;
1956
1957 log_debug("Requesting DS to validate transaction %" PRIu16" (%s, DNSKEY with key tag: %" PRIu16 ").",
1958 t->id, dns_resource_key_name(rr->key), dnssec_keytag(rr, false));
1959 r = dns_transaction_request_dnssec_rr(t, ds);
1960 if (r < 0)
1961 return r;
1962
1963 break;
1964 }
1965
1966 case DNS_TYPE_SOA:
1967 case DNS_TYPE_NS: {
1968 _cleanup_(dns_resource_key_unrefp) DnsResourceKey *ds = NULL;
1969
1970 /* For an unsigned SOA or NS, try to acquire
1971 * the matching DS RR, as we are at a zone cut
1972 * then, and whether a DS exists tells us
1973 * whether the zone is signed. Do so only if
1974 * this RR matches our original question,
1975 * however. */
1976
1977 r = dns_resource_key_match_rr(t->key, rr, NULL);
1978 if (r < 0)
1979 return r;
1980 if (r == 0)
1981 continue;
1982
1983 r = dnssec_has_rrsig(t->answer, rr->key);
1984 if (r < 0)
1985 return r;
1986 if (r > 0)
1987 continue;
1988
1989 ds = dns_resource_key_new(rr->key->class, DNS_TYPE_DS, dns_resource_key_name(rr->key));
1990 if (!ds)
1991 return -ENOMEM;
1992
1993 log_debug("Requesting DS to validate transaction %" PRIu16 " (%s, unsigned SOA/NS RRset).",
1994 t->id, dns_resource_key_name(rr->key));
1995 r = dns_transaction_request_dnssec_rr(t, ds);
1996 if (r < 0)
1997 return r;
1998
1999 break;
2000 }
2001
2002 case DNS_TYPE_DS:
2003 case DNS_TYPE_CNAME:
2004 case DNS_TYPE_DNAME: {
2005 _cleanup_(dns_resource_key_unrefp) DnsResourceKey *soa = NULL;
2006 const char *name;
2007
2008 /* CNAMEs and DNAMEs cannot be located at a
2009 * zone apex, hence ask for the parent SOA for
2010 * unsigned CNAME/DNAME RRs, maybe that's the
2011 * apex. But do all that only if this is
2012 * actually a response to our original
2013 * question.
2014 *
2015 * Similar for DS RRs, which are signed when
2016 * the parent SOA is signed. */
2017
2018 r = dns_transaction_is_primary_response(t, rr);
2019 if (r < 0)
2020 return r;
2021 if (r == 0)
2022 continue;
2023
2024 r = dnssec_has_rrsig(t->answer, rr->key);
2025 if (r < 0)
2026 return r;
2027 if (r > 0)
2028 continue;
2029
2030 r = dns_answer_has_dname_for_cname(t->answer, rr);
2031 if (r < 0)
2032 return r;
2033 if (r > 0)
2034 continue;
2035
2036 name = dns_resource_key_name(rr->key);
2037 r = dns_name_parent(&name);
2038 if (r < 0)
2039 return r;
2040 if (r == 0)
2041 continue;
2042
2043 soa = dns_resource_key_new(rr->key->class, DNS_TYPE_SOA, name);
2044 if (!soa)
2045 return -ENOMEM;
2046
2047 log_debug("Requesting parent SOA to validate transaction %" PRIu16 " (%s, unsigned CNAME/DNAME/DS RRset).",
2048 t->id, dns_resource_key_name(rr->key));
2049 r = dns_transaction_request_dnssec_rr(t, soa);
2050 if (r < 0)
2051 return r;
2052
2053 break;
2054 }
2055
2056 default: {
2057 _cleanup_(dns_resource_key_unrefp) DnsResourceKey *soa = NULL;
2058
2059 /* For other unsigned RRsets (including
2060 * NSEC/NSEC3!), look for proof the zone is
2061 * unsigned, by requesting the SOA RR of the
2062 * zone. However, do so only if they are
2063 * directly relevant to our original
2064 * question. */
2065
2066 r = dns_transaction_is_primary_response(t, rr);
2067 if (r < 0)
2068 return r;
2069 if (r == 0)
2070 continue;
2071
2072 r = dnssec_has_rrsig(t->answer, rr->key);
2073 if (r < 0)
2074 return r;
2075 if (r > 0)
2076 continue;
2077
2078 soa = dns_resource_key_new(rr->key->class, DNS_TYPE_SOA, dns_resource_key_name(rr->key));
2079 if (!soa)
2080 return -ENOMEM;
2081
2082 log_debug("Requesting SOA to validate transaction %" PRIu16 " (%s, unsigned non-SOA/NS RRset <%s>).",
2083 t->id, dns_resource_key_name(rr->key), dns_resource_record_to_string(rr));
2084 r = dns_transaction_request_dnssec_rr(t, soa);
2085 if (r < 0)
2086 return r;
2087 break;
2088 }}
2089 }
2090
2091 /* Above, we requested everything necessary to validate what
2092 * we got. Now, let's request what we need to validate what we
2093 * didn't get... */
2094
2095 r = dns_transaction_has_unsigned_negative_answer(t);
2096 if (r < 0)
2097 return r;
2098 if (r > 0) {
2099 const char *name;
2100 uint16_t type = 0;
2101
2102 name = dns_resource_key_name(t->key);
2103
2104 /* If this was a SOA or NS request, then check if there's a DS RR for the same domain. Note that this
2105 * could also be used as indication that we are not at a zone apex, but in real world setups there are
2106 * too many broken DNS servers (Hello, incapdns.net!) where non-terminal zones return NXDOMAIN even
2107 * though they have further children. If this was a DS request, then it's signed when the parent zone
2108 * is signed, hence ask the parent SOA in that case. If this was any other RR then ask for the SOA RR,
2109 * to see if that is signed. */
2110
2111 if (t->key->type == DNS_TYPE_DS) {
2112 r = dns_name_parent(&name);
2113 if (r > 0) {
2114 type = DNS_TYPE_SOA;
2115 log_debug("Requesting parent SOA to validate transaction %" PRIu16 " (%s, unsigned empty DS response).",
2116 t->id, dns_resource_key_name(t->key));
2117 } else
2118 name = NULL;
2119
2120 } else if (IN_SET(t->key->type, DNS_TYPE_SOA, DNS_TYPE_NS)) {
2121
2122 type = DNS_TYPE_DS;
2123 log_debug("Requesting DS to validate transaction %" PRIu16 " (%s, unsigned empty SOA/NS response).",
2124 t->id, dns_resource_key_name(t->key));
2125
2126 } else {
2127 type = DNS_TYPE_SOA;
2128 log_debug("Requesting SOA to validate transaction %" PRIu16 " (%s, unsigned empty non-SOA/NS/DS response).",
2129 t->id, dns_resource_key_name(t->key));
2130 }
2131
2132 if (name) {
2133 _cleanup_(dns_resource_key_unrefp) DnsResourceKey *soa = NULL;
2134
2135 soa = dns_resource_key_new(t->key->class, type, name);
2136 if (!soa)
2137 return -ENOMEM;
2138
2139 r = dns_transaction_request_dnssec_rr(t, soa);
2140 if (r < 0)
2141 return r;
2142 }
2143 }
2144
2145 return dns_transaction_dnssec_is_live(t);
2146 }
2147
2148 void dns_transaction_notify(DnsTransaction *t, DnsTransaction *source) {
2149 assert(t);
2150 assert(source);
2151
2152 /* Invoked whenever any of our auxiliary DNSSEC transactions completed its work. If the state is still PENDING,
2153 we are still in the loop that adds further DNSSEC transactions, hence don't check if we are ready yet. If
2154 the state is VALIDATING however, we should check if we are complete now. */
2155
2156 if (t->state == DNS_TRANSACTION_VALIDATING)
2157 dns_transaction_process_dnssec(t);
2158 }
2159
2160 static int dns_transaction_validate_dnskey_by_ds(DnsTransaction *t) {
2161 DnsResourceRecord *rr;
2162 int ifindex, r;
2163
2164 assert(t);
2165
2166 /* Add all DNSKEY RRs from the answer that are validated by DS
2167 * RRs from the list of validated keys to the list of
2168 * validated keys. */
2169
2170 DNS_ANSWER_FOREACH_IFINDEX(rr, ifindex, t->answer) {
2171
2172 r = dnssec_verify_dnskey_by_ds_search(rr, t->validated_keys);
2173 if (r < 0)
2174 return r;
2175 if (r == 0)
2176 continue;
2177
2178 /* If so, the DNSKEY is validated too. */
2179 r = dns_answer_add_extend(&t->validated_keys, rr, ifindex, DNS_ANSWER_AUTHENTICATED);
2180 if (r < 0)
2181 return r;
2182 }
2183
2184 return 0;
2185 }
2186
2187 static int dns_transaction_requires_rrsig(DnsTransaction *t, DnsResourceRecord *rr) {
2188 int r;
2189
2190 assert(t);
2191 assert(rr);
2192
2193 /* Checks if the RR we are looking for must be signed with an
2194 * RRSIG. This is used for positive responses. */
2195
2196 if (t->scope->dnssec_mode == DNSSEC_NO)
2197 return false;
2198
2199 if (dns_type_is_pseudo(rr->key->type))
2200 return -EINVAL;
2201
2202 r = dns_transaction_negative_trust_anchor_lookup(t, dns_resource_key_name(rr->key));
2203 if (r < 0)
2204 return r;
2205 if (r > 0)
2206 return false;
2207
2208 switch (rr->key->type) {
2209
2210 case DNS_TYPE_RRSIG:
2211 /* RRSIGs are the signatures themselves, they need no signing. */
2212 return false;
2213
2214 case DNS_TYPE_SOA:
2215 case DNS_TYPE_NS: {
2216 DnsTransaction *dt;
2217 Iterator i;
2218
2219 /* For SOA or NS RRs we look for a matching DS transaction */
2220
2221 SET_FOREACH(dt, t->dnssec_transactions, i) {
2222
2223 if (dt->key->class != rr->key->class)
2224 continue;
2225 if (dt->key->type != DNS_TYPE_DS)
2226 continue;
2227
2228 r = dns_name_equal(dns_resource_key_name(dt->key), dns_resource_key_name(rr->key));
2229 if (r < 0)
2230 return r;
2231 if (r == 0)
2232 continue;
2233
2234 /* We found a DS transactions for the SOA/NS
2235 * RRs we are looking at. If it discovered signed DS
2236 * RRs, then we need to be signed, too. */
2237
2238 if (!dt->answer_authenticated)
2239 return false;
2240
2241 return dns_answer_match_key(dt->answer, dt->key, NULL);
2242 }
2243
2244 /* We found nothing that proves this is safe to leave
2245 * this unauthenticated, hence ask inist on
2246 * authentication. */
2247 return true;
2248 }
2249
2250 case DNS_TYPE_DS:
2251 case DNS_TYPE_CNAME:
2252 case DNS_TYPE_DNAME: {
2253 const char *parent = NULL;
2254 DnsTransaction *dt;
2255 Iterator i;
2256
2257 /*
2258 * CNAME/DNAME RRs cannot be located at a zone apex, hence look directly for the parent SOA.
2259 *
2260 * DS RRs are signed if the parent is signed, hence also look at the parent SOA
2261 */
2262
2263 SET_FOREACH(dt, t->dnssec_transactions, i) {
2264
2265 if (dt->key->class != rr->key->class)
2266 continue;
2267 if (dt->key->type != DNS_TYPE_SOA)
2268 continue;
2269
2270 if (!parent) {
2271 parent = dns_resource_key_name(rr->key);
2272 r = dns_name_parent(&parent);
2273 if (r < 0)
2274 return r;
2275 if (r == 0) {
2276 if (rr->key->type == DNS_TYPE_DS)
2277 return true;
2278
2279 /* A CNAME/DNAME without a parent? That's sooo weird. */
2280 log_debug("Transaction %" PRIu16 " claims CNAME/DNAME at root. Refusing.", t->id);
2281 return -EBADMSG;
2282 }
2283 }
2284
2285 r = dns_name_equal(dns_resource_key_name(dt->key), parent);
2286 if (r < 0)
2287 return r;
2288 if (r == 0)
2289 continue;
2290
2291 return t->answer_authenticated;
2292 }
2293
2294 return true;
2295 }
2296
2297 default: {
2298 DnsTransaction *dt;
2299 Iterator i;
2300
2301 /* Any other kind of RR (including DNSKEY/NSEC/NSEC3). Let's see if our SOA lookup was authenticated */
2302
2303 SET_FOREACH(dt, t->dnssec_transactions, i) {
2304
2305 if (dt->key->class != rr->key->class)
2306 continue;
2307 if (dt->key->type != DNS_TYPE_SOA)
2308 continue;
2309
2310 r = dns_name_equal(dns_resource_key_name(dt->key), dns_resource_key_name(rr->key));
2311 if (r < 0)
2312 return r;
2313 if (r == 0)
2314 continue;
2315
2316 /* We found the transaction that was supposed to find
2317 * the SOA RR for us. It was successful, but found no
2318 * RR for us. This means we are not at a zone cut. In
2319 * this case, we require authentication if the SOA
2320 * lookup was authenticated too. */
2321 return t->answer_authenticated;
2322 }
2323
2324 return true;
2325 }}
2326 }
2327
2328 static int dns_transaction_in_private_tld(DnsTransaction *t, const DnsResourceKey *key) {
2329 DnsTransaction *dt;
2330 const char *tld;
2331 Iterator i;
2332 int r;
2333
2334 /* If DNSSEC downgrade mode is on, checks whether the
2335 * specified RR is one level below a TLD we have proven not to
2336 * exist. In such a case we assume that this is a private
2337 * domain, and permit it.
2338 *
2339 * This detects cases like the Fritz!Box router networks. Each
2340 * Fritz!Box router serves a private "fritz.box" zone, in the
2341 * non-existing TLD "box". Requests for the "fritz.box" domain
2342 * are served by the router itself, while requests for the
2343 * "box" domain will result in NXDOMAIN.
2344 *
2345 * Note that this logic is unable to detect cases where a
2346 * router serves a private DNS zone directly under
2347 * non-existing TLD. In such a case we cannot detect whether
2348 * the TLD is supposed to exist or not, as all requests we
2349 * make for it will be answered by the router's zone, and not
2350 * by the root zone. */
2351
2352 assert(t);
2353
2354 if (t->scope->dnssec_mode != DNSSEC_ALLOW_DOWNGRADE)
2355 return false; /* In strict DNSSEC mode what doesn't exist, doesn't exist */
2356
2357 tld = dns_resource_key_name(key);
2358 r = dns_name_parent(&tld);
2359 if (r < 0)
2360 return r;
2361 if (r == 0)
2362 return false; /* Already the root domain */
2363
2364 if (!dns_name_is_single_label(tld))
2365 return false;
2366
2367 SET_FOREACH(dt, t->dnssec_transactions, i) {
2368
2369 if (dt->key->class != key->class)
2370 continue;
2371
2372 r = dns_name_equal(dns_resource_key_name(dt->key), tld);
2373 if (r < 0)
2374 return r;
2375 if (r == 0)
2376 continue;
2377
2378 /* We found an auxiliary lookup we did for the TLD. If
2379 * that returned with NXDOMAIN, we know the TLD didn't
2380 * exist, and hence this might be a private zone. */
2381
2382 return dt->answer_rcode == DNS_RCODE_NXDOMAIN;
2383 }
2384
2385 return false;
2386 }
2387
2388 static int dns_transaction_requires_nsec(DnsTransaction *t) {
2389 char key_str[DNS_RESOURCE_KEY_STRING_MAX];
2390 DnsTransaction *dt;
2391 const char *name;
2392 uint16_t type = 0;
2393 Iterator i;
2394 int r;
2395
2396 assert(t);
2397
2398 /* Checks if we need to insist on NSEC/NSEC3 RRs for proving
2399 * this negative reply */
2400
2401 if (t->scope->dnssec_mode == DNSSEC_NO)
2402 return false;
2403
2404 if (dns_type_is_pseudo(t->key->type))
2405 return -EINVAL;
2406
2407 r = dns_transaction_negative_trust_anchor_lookup(t, dns_resource_key_name(t->key));
2408 if (r < 0)
2409 return r;
2410 if (r > 0)
2411 return false;
2412
2413 r = dns_transaction_in_private_tld(t, t->key);
2414 if (r < 0)
2415 return r;
2416 if (r > 0) {
2417 /* The lookup is from a TLD that is proven not to
2418 * exist, and we are in downgrade mode, hence ignore
2419 * that fact that we didn't get any NSEC RRs.*/
2420
2421 log_info("Detected a negative query %s in a private DNS zone, permitting unsigned response.",
2422 dns_resource_key_to_string(t->key, key_str, sizeof key_str));
2423 return false;
2424 }
2425
2426 name = dns_resource_key_name(t->key);
2427
2428 if (t->key->type == DNS_TYPE_DS) {
2429
2430 /* We got a negative reply for this DS lookup? DS RRs are signed when their parent zone is signed,
2431 * hence check the parent SOA in this case. */
2432
2433 r = dns_name_parent(&name);
2434 if (r < 0)
2435 return r;
2436 if (r == 0)
2437 return true;
2438
2439 type = DNS_TYPE_SOA;
2440
2441 } else if (IN_SET(t->key->type, DNS_TYPE_SOA, DNS_TYPE_NS))
2442 /* We got a negative reply for this SOA/NS lookup? If so, check if there's a DS RR for this */
2443 type = DNS_TYPE_DS;
2444 else
2445 /* For all other negative replies, check for the SOA lookup */
2446 type = DNS_TYPE_SOA;
2447
2448 /* For all other RRs we check the SOA on the same level to see
2449 * if it's signed. */
2450
2451 SET_FOREACH(dt, t->dnssec_transactions, i) {
2452
2453 if (dt->key->class != t->key->class)
2454 continue;
2455 if (dt->key->type != type)
2456 continue;
2457
2458 r = dns_name_equal(dns_resource_key_name(dt->key), name);
2459 if (r < 0)
2460 return r;
2461 if (r == 0)
2462 continue;
2463
2464 return dt->answer_authenticated;
2465 }
2466
2467 /* If in doubt, require NSEC/NSEC3 */
2468 return true;
2469 }
2470
2471 static int dns_transaction_dnskey_authenticated(DnsTransaction *t, DnsResourceRecord *rr) {
2472 DnsResourceRecord *rrsig;
2473 bool found = false;
2474 int r;
2475
2476 /* Checks whether any of the DNSKEYs used for the RRSIGs for
2477 * the specified RRset is authenticated (i.e. has a matching
2478 * DS RR). */
2479
2480 r = dns_transaction_negative_trust_anchor_lookup(t, dns_resource_key_name(rr->key));
2481 if (r < 0)
2482 return r;
2483 if (r > 0)
2484 return false;
2485
2486 DNS_ANSWER_FOREACH(rrsig, t->answer) {
2487 DnsTransaction *dt;
2488 Iterator i;
2489
2490 r = dnssec_key_match_rrsig(rr->key, rrsig);
2491 if (r < 0)
2492 return r;
2493 if (r == 0)
2494 continue;
2495
2496 SET_FOREACH(dt, t->dnssec_transactions, i) {
2497
2498 if (dt->key->class != rr->key->class)
2499 continue;
2500
2501 if (dt->key->type == DNS_TYPE_DNSKEY) {
2502
2503 r = dns_name_equal(dns_resource_key_name(dt->key), rrsig->rrsig.signer);
2504 if (r < 0)
2505 return r;
2506 if (r == 0)
2507 continue;
2508
2509 /* OK, we found an auxiliary DNSKEY
2510 * lookup. If that lookup is
2511 * authenticated, report this. */
2512
2513 if (dt->answer_authenticated)
2514 return true;
2515
2516 found = true;
2517
2518 } else if (dt->key->type == DNS_TYPE_DS) {
2519
2520 r = dns_name_equal(dns_resource_key_name(dt->key), rrsig->rrsig.signer);
2521 if (r < 0)
2522 return r;
2523 if (r == 0)
2524 continue;
2525
2526 /* OK, we found an auxiliary DS
2527 * lookup. If that lookup is
2528 * authenticated and non-zero, we
2529 * won! */
2530
2531 if (!dt->answer_authenticated)
2532 return false;
2533
2534 return dns_answer_match_key(dt->answer, dt->key, NULL);
2535 }
2536 }
2537 }
2538
2539 return found ? false : -ENXIO;
2540 }
2541
2542 static int dns_transaction_known_signed(DnsTransaction *t, DnsResourceRecord *rr) {
2543 assert(t);
2544 assert(rr);
2545
2546 /* We know that the root domain is signed, hence if it appears
2547 * not to be signed, there's a problem with the DNS server */
2548
2549 return rr->key->class == DNS_CLASS_IN &&
2550 dns_name_is_root(dns_resource_key_name(rr->key));
2551 }
2552
2553 static int dns_transaction_check_revoked_trust_anchors(DnsTransaction *t) {
2554 DnsResourceRecord *rr;
2555 int r;
2556
2557 assert(t);
2558
2559 /* Maybe warn the user that we encountered a revoked DNSKEY
2560 * for a key from our trust anchor. Note that we don't care
2561 * whether the DNSKEY can be authenticated or not. It's
2562 * sufficient if it is self-signed. */
2563
2564 DNS_ANSWER_FOREACH(rr, t->answer) {
2565 r = dns_trust_anchor_check_revoked(&t->scope->manager->trust_anchor, rr, t->answer);
2566 if (r < 0)
2567 return r;
2568 }
2569
2570 return 0;
2571 }
2572
2573 static int dns_transaction_invalidate_revoked_keys(DnsTransaction *t) {
2574 bool changed;
2575 int r;
2576
2577 assert(t);
2578
2579 /* Removes all DNSKEY/DS objects from t->validated_keys that
2580 * our trust anchors database considers revoked. */
2581
2582 do {
2583 DnsResourceRecord *rr;
2584
2585 changed = false;
2586
2587 DNS_ANSWER_FOREACH(rr, t->validated_keys) {
2588 r = dns_trust_anchor_is_revoked(&t->scope->manager->trust_anchor, rr);
2589 if (r < 0)
2590 return r;
2591 if (r > 0) {
2592 r = dns_answer_remove_by_rr(&t->validated_keys, rr);
2593 if (r < 0)
2594 return r;
2595
2596 assert(r > 0);
2597 changed = true;
2598 break;
2599 }
2600 }
2601 } while (changed);
2602
2603 return 0;
2604 }
2605
2606 static int dns_transaction_copy_validated(DnsTransaction *t) {
2607 DnsTransaction *dt;
2608 Iterator i;
2609 int r;
2610
2611 assert(t);
2612
2613 /* Copy all validated RRs from the auxiliary DNSSEC transactions into our set of validated RRs */
2614
2615 SET_FOREACH(dt, t->dnssec_transactions, i) {
2616
2617 if (DNS_TRANSACTION_IS_LIVE(dt->state))
2618 continue;
2619
2620 if (!dt->answer_authenticated)
2621 continue;
2622
2623 r = dns_answer_extend(&t->validated_keys, dt->answer);
2624 if (r < 0)
2625 return r;
2626 }
2627
2628 return 0;
2629 }
2630
2631 typedef enum {
2632 DNSSEC_PHASE_DNSKEY, /* Phase #1, only validate DNSKEYs */
2633 DNSSEC_PHASE_NSEC, /* Phase #2, only validate NSEC+NSEC3 */
2634 DNSSEC_PHASE_ALL, /* Phase #3, validate everything else */
2635 } Phase;
2636
2637 static int dnssec_validate_records(
2638 DnsTransaction *t,
2639 Phase phase,
2640 bool *have_nsec,
2641 DnsAnswer **validated) {
2642
2643 DnsResourceRecord *rr;
2644 int r;
2645
2646 /* Returns negative on error, 0 if validation failed, 1 to restart validation, 2 when finished. */
2647
2648 DNS_ANSWER_FOREACH(rr, t->answer) {
2649 DnsResourceRecord *rrsig = NULL;
2650 DnssecResult result;
2651
2652 switch (rr->key->type) {
2653 case DNS_TYPE_RRSIG:
2654 continue;
2655
2656 case DNS_TYPE_DNSKEY:
2657 /* We validate DNSKEYs only in the DNSKEY and ALL phases */
2658 if (phase == DNSSEC_PHASE_NSEC)
2659 continue;
2660 break;
2661
2662 case DNS_TYPE_NSEC:
2663 case DNS_TYPE_NSEC3:
2664 *have_nsec = true;
2665
2666 /* We validate NSEC/NSEC3 only in the NSEC and ALL phases */
2667 if (phase == DNSSEC_PHASE_DNSKEY)
2668 continue;
2669 break;
2670
2671 default:
2672 /* We validate all other RRs only in the ALL phases */
2673 if (phase != DNSSEC_PHASE_ALL)
2674 continue;
2675 }
2676
2677 r = dnssec_verify_rrset_search(t->answer, rr->key, t->validated_keys, USEC_INFINITY, &result, &rrsig);
2678 if (r < 0)
2679 return r;
2680
2681 log_debug("Looking at %s: %s", strna(dns_resource_record_to_string(rr)), dnssec_result_to_string(result));
2682
2683 if (result == DNSSEC_VALIDATED) {
2684
2685 if (rr->key->type == DNS_TYPE_DNSKEY) {
2686 /* If we just validated a DNSKEY RRset, then let's add these keys to
2687 * the set of validated keys for this transaction. */
2688
2689 r = dns_answer_copy_by_key(&t->validated_keys, t->answer, rr->key, DNS_ANSWER_AUTHENTICATED);
2690 if (r < 0)
2691 return r;
2692
2693 /* Some of the DNSKEYs we just added might already have been revoked,
2694 * remove them again in that case. */
2695 r = dns_transaction_invalidate_revoked_keys(t);
2696 if (r < 0)
2697 return r;
2698 }
2699
2700 /* Add the validated RRset to the new list of validated
2701 * RRsets, and remove it from the unvalidated RRsets.
2702 * We mark the RRset as authenticated and cacheable. */
2703 r = dns_answer_move_by_key(validated, &t->answer, rr->key, DNS_ANSWER_AUTHENTICATED|DNS_ANSWER_CACHEABLE);
2704 if (r < 0)
2705 return r;
2706
2707 manager_dnssec_verdict(t->scope->manager, DNSSEC_SECURE, rr->key);
2708
2709 /* Exit the loop, we dropped something from the answer, start from the beginning */
2710 return 1;
2711 }
2712
2713 /* If we haven't read all DNSKEYs yet a negative result of the validation is irrelevant, as
2714 * there might be more DNSKEYs coming. Similar, if we haven't read all NSEC/NSEC3 RRs yet,
2715 * we cannot do positive wildcard proofs yet, as those require the NSEC/NSEC3 RRs. */
2716 if (phase != DNSSEC_PHASE_ALL)
2717 continue;
2718
2719 if (result == DNSSEC_VALIDATED_WILDCARD) {
2720 bool authenticated = false;
2721 const char *source;
2722
2723 /* This RRset validated, but as a wildcard. This means we need
2724 * to prove via NSEC/NSEC3 that no matching non-wildcard RR exists.*/
2725
2726 /* First step, determine the source of synthesis */
2727 r = dns_resource_record_source(rrsig, &source);
2728 if (r < 0)
2729 return r;
2730
2731 r = dnssec_test_positive_wildcard(*validated,
2732 dns_resource_key_name(rr->key),
2733 source,
2734 rrsig->rrsig.signer,
2735 &authenticated);
2736
2737 /* Unless the NSEC proof showed that the key really doesn't exist something is off. */
2738 if (r == 0)
2739 result = DNSSEC_INVALID;
2740 else {
2741 r = dns_answer_move_by_key(validated, &t->answer, rr->key,
2742 authenticated ? (DNS_ANSWER_AUTHENTICATED|DNS_ANSWER_CACHEABLE) : 0);
2743 if (r < 0)
2744 return r;
2745
2746 manager_dnssec_verdict(t->scope->manager, authenticated ? DNSSEC_SECURE : DNSSEC_INSECURE, rr->key);
2747
2748 /* Exit the loop, we dropped something from the answer, start from the beginning */
2749 return 1;
2750 }
2751 }
2752
2753 if (result == DNSSEC_NO_SIGNATURE) {
2754 r = dns_transaction_requires_rrsig(t, rr);
2755 if (r < 0)
2756 return r;
2757 if (r == 0) {
2758 /* Data does not require signing. In that case, just copy it over,
2759 * but remember that this is by no means authenticated.*/
2760 r = dns_answer_move_by_key(validated, &t->answer, rr->key, 0);
2761 if (r < 0)
2762 return r;
2763
2764 manager_dnssec_verdict(t->scope->manager, DNSSEC_INSECURE, rr->key);
2765 return 1;
2766 }
2767
2768 r = dns_transaction_known_signed(t, rr);
2769 if (r < 0)
2770 return r;
2771 if (r > 0) {
2772 /* This is an RR we know has to be signed. If it isn't this means
2773 * the server is not attaching RRSIGs, hence complain. */
2774
2775 dns_server_packet_rrsig_missing(t->server, t->current_feature_level);
2776
2777 if (t->scope->dnssec_mode == DNSSEC_ALLOW_DOWNGRADE) {
2778
2779 /* Downgrading is OK? If so, just consider the information unsigned */
2780
2781 r = dns_answer_move_by_key(validated, &t->answer, rr->key, 0);
2782 if (r < 0)
2783 return r;
2784
2785 manager_dnssec_verdict(t->scope->manager, DNSSEC_INSECURE, rr->key);
2786 return 1;
2787 }
2788
2789 /* Otherwise, fail */
2790 t->answer_dnssec_result = DNSSEC_INCOMPATIBLE_SERVER;
2791 return 0;
2792 }
2793
2794 r = dns_transaction_in_private_tld(t, rr->key);
2795 if (r < 0)
2796 return r;
2797 if (r > 0) {
2798 char s[DNS_RESOURCE_KEY_STRING_MAX];
2799
2800 /* The data is from a TLD that is proven not to exist, and we are in downgrade
2801 * mode, hence ignore the fact that this was not signed. */
2802
2803 log_info("Detected RRset %s is in a private DNS zone, permitting unsigned RRs.",
2804 dns_resource_key_to_string(rr->key, s, sizeof s));
2805
2806 r = dns_answer_move_by_key(validated, &t->answer, rr->key, 0);
2807 if (r < 0)
2808 return r;
2809
2810 manager_dnssec_verdict(t->scope->manager, DNSSEC_INSECURE, rr->key);
2811 return 1;
2812 }
2813 }
2814
2815 if (IN_SET(result,
2816 DNSSEC_MISSING_KEY,
2817 DNSSEC_SIGNATURE_EXPIRED,
2818 DNSSEC_UNSUPPORTED_ALGORITHM)) {
2819
2820 r = dns_transaction_dnskey_authenticated(t, rr);
2821 if (r < 0 && r != -ENXIO)
2822 return r;
2823 if (r == 0) {
2824 /* The DNSKEY transaction was not authenticated, this means there's
2825 * no DS for this, which means it's OK if no keys are found for this signature. */
2826
2827 r = dns_answer_move_by_key(validated, &t->answer, rr->key, 0);
2828 if (r < 0)
2829 return r;
2830
2831 manager_dnssec_verdict(t->scope->manager, DNSSEC_INSECURE, rr->key);
2832 return 1;
2833 }
2834 }
2835
2836 r = dns_transaction_is_primary_response(t, rr);
2837 if (r < 0)
2838 return r;
2839 if (r > 0) {
2840 /* Look for a matching DNAME for this CNAME */
2841 r = dns_answer_has_dname_for_cname(t->answer, rr);
2842 if (r < 0)
2843 return r;
2844 if (r == 0) {
2845 /* Also look among the stuff we already validated */
2846 r = dns_answer_has_dname_for_cname(*validated, rr);
2847 if (r < 0)
2848 return r;
2849 }
2850
2851 if (r == 0) {
2852 if (IN_SET(result,
2853 DNSSEC_INVALID,
2854 DNSSEC_SIGNATURE_EXPIRED,
2855 DNSSEC_NO_SIGNATURE))
2856 manager_dnssec_verdict(t->scope->manager, DNSSEC_BOGUS, rr->key);
2857 else /* DNSSEC_MISSING_KEY or DNSSEC_UNSUPPORTED_ALGORITHM */
2858 manager_dnssec_verdict(t->scope->manager, DNSSEC_INDETERMINATE, rr->key);
2859
2860 /* This is a primary response to our question, and it failed validation.
2861 * That's fatal. */
2862 t->answer_dnssec_result = result;
2863 return 0;
2864 }
2865
2866 /* This is a primary response, but we do have a DNAME RR
2867 * in the RR that can replay this CNAME, hence rely on
2868 * that, and we can remove the CNAME in favour of it. */
2869 }
2870
2871 /* This is just some auxiliary data. Just remove the RRset and continue. */
2872 r = dns_answer_remove_by_key(&t->answer, rr->key);
2873 if (r < 0)
2874 return r;
2875
2876 /* We dropped something from the answer, start from the beginning. */
2877 return 1;
2878 }
2879
2880 return 2; /* Finito. */
2881 }
2882
2883 int dns_transaction_validate_dnssec(DnsTransaction *t) {
2884 _cleanup_(dns_answer_unrefp) DnsAnswer *validated = NULL;
2885 Phase phase;
2886 DnsAnswerFlags flags;
2887 int r;
2888 char key_str[DNS_RESOURCE_KEY_STRING_MAX];
2889
2890 assert(t);
2891
2892 /* We have now collected all DS and DNSKEY RRs in
2893 * t->validated_keys, let's see which RRs we can now
2894 * authenticate with that. */
2895
2896 if (t->scope->dnssec_mode == DNSSEC_NO)
2897 return 0;
2898
2899 /* Already validated */
2900 if (t->answer_dnssec_result != _DNSSEC_RESULT_INVALID)
2901 return 0;
2902
2903 /* Our own stuff needs no validation */
2904 if (IN_SET(t->answer_source, DNS_TRANSACTION_ZONE, DNS_TRANSACTION_TRUST_ANCHOR)) {
2905 t->answer_dnssec_result = DNSSEC_VALIDATED;
2906 t->answer_authenticated = true;
2907 return 0;
2908 }
2909
2910 /* Cached stuff is not affected by validation. */
2911 if (t->answer_source != DNS_TRANSACTION_NETWORK)
2912 return 0;
2913
2914 if (!dns_transaction_dnssec_supported_full(t)) {
2915 /* The server does not support DNSSEC, or doesn't augment responses with RRSIGs. */
2916 t->answer_dnssec_result = DNSSEC_INCOMPATIBLE_SERVER;
2917 log_debug("Not validating response for %" PRIu16 ", used server feature level does not support DNSSEC.", t->id);
2918 return 0;
2919 }
2920
2921 log_debug("Validating response from transaction %" PRIu16 " (%s).",
2922 t->id,
2923 dns_resource_key_to_string(t->key, key_str, sizeof key_str));
2924
2925 /* First, see if this response contains any revoked trust
2926 * anchors we care about */
2927 r = dns_transaction_check_revoked_trust_anchors(t);
2928 if (r < 0)
2929 return r;
2930
2931 /* Third, copy all RRs we acquired successfully from auxiliary RRs over. */
2932 r = dns_transaction_copy_validated(t);
2933 if (r < 0)
2934 return r;
2935
2936 /* Second, see if there are DNSKEYs we already know a
2937 * validated DS for. */
2938 r = dns_transaction_validate_dnskey_by_ds(t);
2939 if (r < 0)
2940 return r;
2941
2942 /* Fourth, remove all DNSKEY and DS RRs again that our trust
2943 * anchor says are revoked. After all we might have marked
2944 * some keys revoked above, but they might still be lingering
2945 * in our validated_keys list. */
2946 r = dns_transaction_invalidate_revoked_keys(t);
2947 if (r < 0)
2948 return r;
2949
2950 phase = DNSSEC_PHASE_DNSKEY;
2951 for (;;) {
2952 bool have_nsec = false;
2953
2954 r = dnssec_validate_records(t, phase, &have_nsec, &validated);
2955 if (r <= 0)
2956 return r;
2957
2958 /* Try again as long as we managed to achieve something */
2959 if (r == 1)
2960 continue;
2961
2962 if (phase == DNSSEC_PHASE_DNSKEY && have_nsec) {
2963 /* OK, we processed all DNSKEYs, and there are NSEC/NSEC3 RRs, look at those now. */
2964 phase = DNSSEC_PHASE_NSEC;
2965 continue;
2966 }
2967
2968 if (phase != DNSSEC_PHASE_ALL) {
2969 /* OK, we processed all DNSKEYs and NSEC/NSEC3 RRs, look at all the rest now.
2970 * Note that in this third phase we start to remove RRs we couldn't validate. */
2971 phase = DNSSEC_PHASE_ALL;
2972 continue;
2973 }
2974
2975 /* We're done */
2976 break;
2977 }
2978
2979 dns_answer_unref(t->answer);
2980 t->answer = validated;
2981 validated = NULL;
2982
2983 /* At this point the answer only contains validated
2984 * RRsets. Now, let's see if it actually answers the question
2985 * we asked. If so, great! If it doesn't, then see if
2986 * NSEC/NSEC3 can prove this. */
2987 r = dns_transaction_has_positive_answer(t, &flags);
2988 if (r > 0) {
2989 /* Yes, it answers the question! */
2990
2991 if (flags & DNS_ANSWER_AUTHENTICATED) {
2992 /* The answer is fully authenticated, yay. */
2993 t->answer_dnssec_result = DNSSEC_VALIDATED;
2994 t->answer_rcode = DNS_RCODE_SUCCESS;
2995 t->answer_authenticated = true;
2996 } else {
2997 /* The answer is not fully authenticated. */
2998 t->answer_dnssec_result = DNSSEC_UNSIGNED;
2999 t->answer_authenticated = false;
3000 }
3001
3002 } else if (r == 0) {
3003 DnssecNsecResult nr;
3004 bool authenticated = false;
3005
3006 /* Bummer! Let's check NSEC/NSEC3 */
3007 r = dnssec_nsec_test(t->answer, t->key, &nr, &authenticated, &t->answer_nsec_ttl);
3008 if (r < 0)
3009 return r;
3010
3011 switch (nr) {
3012
3013 case DNSSEC_NSEC_NXDOMAIN:
3014 /* NSEC proves the domain doesn't exist. Very good. */
3015 log_debug("Proved NXDOMAIN via NSEC/NSEC3 for transaction %u (%s)", t->id, key_str);
3016 t->answer_dnssec_result = DNSSEC_VALIDATED;
3017 t->answer_rcode = DNS_RCODE_NXDOMAIN;
3018 t->answer_authenticated = authenticated;
3019
3020 manager_dnssec_verdict(t->scope->manager, authenticated ? DNSSEC_SECURE : DNSSEC_INSECURE, t->key);
3021 break;
3022
3023 case DNSSEC_NSEC_NODATA:
3024 /* NSEC proves that there's no data here, very good. */
3025 log_debug("Proved NODATA via NSEC/NSEC3 for transaction %u (%s)", t->id, key_str);
3026 t->answer_dnssec_result = DNSSEC_VALIDATED;
3027 t->answer_rcode = DNS_RCODE_SUCCESS;
3028 t->answer_authenticated = authenticated;
3029
3030 manager_dnssec_verdict(t->scope->manager, authenticated ? DNSSEC_SECURE : DNSSEC_INSECURE, t->key);
3031 break;
3032
3033 case DNSSEC_NSEC_OPTOUT:
3034 /* NSEC3 says the data might not be signed */
3035 log_debug("Data is NSEC3 opt-out via NSEC/NSEC3 for transaction %u (%s)", t->id, key_str);
3036 t->answer_dnssec_result = DNSSEC_UNSIGNED;
3037 t->answer_authenticated = false;
3038
3039 manager_dnssec_verdict(t->scope->manager, DNSSEC_INSECURE, t->key);
3040 break;
3041
3042 case DNSSEC_NSEC_NO_RR:
3043 /* No NSEC data? Bummer! */
3044
3045 r = dns_transaction_requires_nsec(t);
3046 if (r < 0)
3047 return r;
3048 if (r > 0) {
3049 t->answer_dnssec_result = DNSSEC_NO_SIGNATURE;
3050 manager_dnssec_verdict(t->scope->manager, DNSSEC_BOGUS, t->key);
3051 } else {
3052 t->answer_dnssec_result = DNSSEC_UNSIGNED;
3053 t->answer_authenticated = false;
3054 manager_dnssec_verdict(t->scope->manager, DNSSEC_INSECURE, t->key);
3055 }
3056
3057 break;
3058
3059 case DNSSEC_NSEC_UNSUPPORTED_ALGORITHM:
3060 /* We don't know the NSEC3 algorithm used? */
3061 t->answer_dnssec_result = DNSSEC_UNSUPPORTED_ALGORITHM;
3062 manager_dnssec_verdict(t->scope->manager, DNSSEC_INDETERMINATE, t->key);
3063 break;
3064
3065 case DNSSEC_NSEC_FOUND:
3066 case DNSSEC_NSEC_CNAME:
3067 /* NSEC says it needs to be there, but we couldn't find it? Bummer! */
3068 t->answer_dnssec_result = DNSSEC_NSEC_MISMATCH;
3069 manager_dnssec_verdict(t->scope->manager, DNSSEC_BOGUS, t->key);
3070 break;
3071
3072 default:
3073 assert_not_reached("Unexpected NSEC result.");
3074 }
3075 }
3076
3077 return 1;
3078 }
3079
3080 static const char* const dns_transaction_state_table[_DNS_TRANSACTION_STATE_MAX] = {
3081 [DNS_TRANSACTION_NULL] = "null",
3082 [DNS_TRANSACTION_PENDING] = "pending",
3083 [DNS_TRANSACTION_VALIDATING] = "validating",
3084 [DNS_TRANSACTION_RCODE_FAILURE] = "rcode-failure",
3085 [DNS_TRANSACTION_SUCCESS] = "success",
3086 [DNS_TRANSACTION_NO_SERVERS] = "no-servers",
3087 [DNS_TRANSACTION_TIMEOUT] = "timeout",
3088 [DNS_TRANSACTION_ATTEMPTS_MAX_REACHED] = "attempts-max-reached",
3089 [DNS_TRANSACTION_INVALID_REPLY] = "invalid-reply",
3090 [DNS_TRANSACTION_ERRNO] = "errno",
3091 [DNS_TRANSACTION_ABORTED] = "aborted",
3092 [DNS_TRANSACTION_DNSSEC_FAILED] = "dnssec-failed",
3093 [DNS_TRANSACTION_NO_TRUST_ANCHOR] = "no-trust-anchor",
3094 [DNS_TRANSACTION_RR_TYPE_UNSUPPORTED] = "rr-type-unsupported",
3095 [DNS_TRANSACTION_NETWORK_DOWN] = "network-down",
3096 [DNS_TRANSACTION_NOT_FOUND] = "not-found",
3097 };
3098 DEFINE_STRING_TABLE_LOOKUP(dns_transaction_state, DnsTransactionState);
3099
3100 static const char* const dns_transaction_source_table[_DNS_TRANSACTION_SOURCE_MAX] = {
3101 [DNS_TRANSACTION_NETWORK] = "network",
3102 [DNS_TRANSACTION_CACHE] = "cache",
3103 [DNS_TRANSACTION_ZONE] = "zone",
3104 [DNS_TRANSACTION_TRUST_ANCHOR] = "trust-anchor",
3105 };
3106 DEFINE_STRING_TABLE_LOOKUP(dns_transaction_source, DnsTransactionSource);
Unnamed repository; edit this file 'description' to name the repository.