]> git.ipfire.org Git - thirdparty/systemd.git/blob - src/resolve/resolved-dns-transaction.c
projects / thirdparty / systemd.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Merge pull request #10871 from keszybz/more-cleanup-2
[thirdparty/systemd.git] / src / resolve / resolved-dns-transaction.c
1 /* SPDX-License-Identifier: LGPL-2.1+ */
2
3 #include "sd-messages.h"
4
5 #include "af-list.h"
6 #include "alloc-util.h"
7 #include "dns-domain.h"
8 #include "errno-list.h"
9 #include "fd-util.h"
10 #include "random-util.h"
11 #include "resolved-dns-cache.h"
12 #include "resolved-dns-transaction.h"
13 #include "resolved-llmnr.h"
14 #if ENABLE_DNS_OVER_TLS
15 #include "resolved-dnstls.h"
16 #endif
17 #include "string-table.h"
18
19 #define TRANSACTIONS_MAX 4096
20 #define TRANSACTION_TCP_TIMEOUT_USEC (10U*USEC_PER_SEC)
21
22 /* After how much time to repeat classic DNS requests */
23 #define DNS_TIMEOUT_USEC (SD_RESOLVED_QUERY_TIMEOUT_USEC / DNS_TRANSACTION_ATTEMPTS_MAX)
24
25 static void dns_transaction_reset_answer(DnsTransaction *t) {
26 assert(t);
27
28 t->received = dns_packet_unref(t->received);
29 t->answer = dns_answer_unref(t->answer);
30 t->answer_rcode = 0;
31 t->answer_dnssec_result = _DNSSEC_RESULT_INVALID;
32 t->answer_source = _DNS_TRANSACTION_SOURCE_INVALID;
33 t->answer_authenticated = false;
34 t->answer_nsec_ttl = (uint32_t) -1;
35 t->answer_errno = 0;
36 }
37
38 static void dns_transaction_flush_dnssec_transactions(DnsTransaction *t) {
39 DnsTransaction *z;
40
41 assert(t);
42
43 while ((z = set_steal_first(t->dnssec_transactions))) {
44 set_remove(z->notify_transactions, t);
45 set_remove(z->notify_transactions_done, t);
46 dns_transaction_gc(z);
47 }
48 }
49
50 static void dns_transaction_close_connection(DnsTransaction *t) {
51 assert(t);
52
53 if (t->stream) {
54 /* Let's detach the stream from our transaction, in case something else keeps a reference to it. */
55 LIST_REMOVE(transactions_by_stream, t->stream->transactions, t);
56
57 /* Remove packet in case it's still in the queue */
58 dns_packet_unref(ordered_set_remove(t->stream->write_queue, t->sent));
59
60 t->stream = dns_stream_unref(t->stream);
61 }
62
63 t->dns_udp_event_source = sd_event_source_unref(t->dns_udp_event_source);
64 t->dns_udp_fd = safe_close(t->dns_udp_fd);
65 }
66
67 static void dns_transaction_stop_timeout(DnsTransaction *t) {
68 assert(t);
69
70 t->timeout_event_source = sd_event_source_unref(t->timeout_event_source);
71 }
72
73 DnsTransaction* dns_transaction_free(DnsTransaction *t) {
74 DnsQueryCandidate *c;
75 DnsZoneItem *i;
76 DnsTransaction *z;
77
78 if (!t)
79 return NULL;
80
81 log_debug("Freeing transaction %" PRIu16 ".", t->id);
82
83 dns_transaction_close_connection(t);
84 dns_transaction_stop_timeout(t);
85
86 dns_packet_unref(t->sent);
87 dns_transaction_reset_answer(t);
88
89 dns_server_unref(t->server);
90
91 if (t->scope) {
92 hashmap_remove_value(t->scope->transactions_by_key, t->key, t);
93 LIST_REMOVE(transactions_by_scope, t->scope->transactions, t);
94
95 if (t->id != 0)
96 hashmap_remove(t->scope->manager->dns_transactions, UINT_TO_PTR(t->id));
97 }
98
99 while ((c = set_steal_first(t->notify_query_candidates)))
100 set_remove(c->transactions, t);
101 set_free(t->notify_query_candidates);
102
103 while ((c = set_steal_first(t->notify_query_candidates_done)))
104 set_remove(c->transactions, t);
105 set_free(t->notify_query_candidates_done);
106
107 while ((i = set_steal_first(t->notify_zone_items)))
108 i->probe_transaction = NULL;
109 set_free(t->notify_zone_items);
110
111 while ((i = set_steal_first(t->notify_zone_items_done)))
112 i->probe_transaction = NULL;
113 set_free(t->notify_zone_items_done);
114
115 while ((z = set_steal_first(t->notify_transactions)))
116 set_remove(z->dnssec_transactions, t);
117 set_free(t->notify_transactions);
118
119 while ((z = set_steal_first(t->notify_transactions_done)))
120 set_remove(z->dnssec_transactions, t);
121 set_free(t->notify_transactions_done);
122
123 dns_transaction_flush_dnssec_transactions(t);
124 set_free(t->dnssec_transactions);
125
126 dns_answer_unref(t->validated_keys);
127 dns_resource_key_unref(t->key);
128
129 return mfree(t);
130 }
131
132 DEFINE_TRIVIAL_CLEANUP_FUNC(DnsTransaction*, dns_transaction_free);
133
134 bool dns_transaction_gc(DnsTransaction *t) {
135 assert(t);
136
137 if (t->block_gc > 0)
138 return true;
139
140 if (set_isempty(t->notify_query_candidates) &&
141 set_isempty(t->notify_query_candidates_done) &&
142 set_isempty(t->notify_zone_items) &&
143 set_isempty(t->notify_zone_items_done) &&
144 set_isempty(t->notify_transactions) &&
145 set_isempty(t->notify_transactions_done)) {
146 dns_transaction_free(t);
147 return false;
148 }
149
150 return true;
151 }
152
153 static uint16_t pick_new_id(Manager *m) {
154 uint16_t new_id;
155
156 /* Find a fresh, unused transaction id. Note that this loop is bounded because there's a limit on the number of
157 * transactions, and it's much lower than the space of IDs. */
158
159 assert_cc(TRANSACTIONS_MAX < 0xFFFF);
160
161 do
162 random_bytes(&new_id, sizeof(new_id));
163 while (new_id == 0 ||
164 hashmap_get(m->dns_transactions, UINT_TO_PTR(new_id)));
165
166 return new_id;
167 }
168
169 int dns_transaction_new(DnsTransaction **ret, DnsScope *s, DnsResourceKey *key) {
170 _cleanup_(dns_transaction_freep) DnsTransaction *t = NULL;
171 int r;
172
173 assert(ret);
174 assert(s);
175 assert(key);
176
177 /* Don't allow looking up invalid or pseudo RRs */
178 if (!dns_type_is_valid_query(key->type))
179 return -EINVAL;
180 if (dns_type_is_obsolete(key->type))
181 return -EOPNOTSUPP;
182
183 /* We only support the IN class */
184 if (!IN_SET(key->class, DNS_CLASS_IN, DNS_CLASS_ANY))
185 return -EOPNOTSUPP;
186
187 if (hashmap_size(s->manager->dns_transactions) >= TRANSACTIONS_MAX)
188 return -EBUSY;
189
190 r = hashmap_ensure_allocated(&s->manager->dns_transactions, NULL);
191 if (r < 0)
192 return r;
193
194 r = hashmap_ensure_allocated(&s->transactions_by_key, &dns_resource_key_hash_ops);
195 if (r < 0)
196 return r;
197
198 t = new0(DnsTransaction, 1);
199 if (!t)
200 return -ENOMEM;
201
202 t->dns_udp_fd = -1;
203 t->answer_source = _DNS_TRANSACTION_SOURCE_INVALID;
204 t->answer_dnssec_result = _DNSSEC_RESULT_INVALID;
205 t->answer_nsec_ttl = (uint32_t) -1;
206 t->key = dns_resource_key_ref(key);
207 t->current_feature_level = _DNS_SERVER_FEATURE_LEVEL_INVALID;
208 t->clamp_feature_level = _DNS_SERVER_FEATURE_LEVEL_INVALID;
209
210 t->id = pick_new_id(s->manager);
211
212 r = hashmap_put(s->manager->dns_transactions, UINT_TO_PTR(t->id), t);
213 if (r < 0) {
214 t->id = 0;
215 return r;
216 }
217
218 r = hashmap_replace(s->transactions_by_key, t->key, t);
219 if (r < 0) {
220 hashmap_remove(s->manager->dns_transactions, UINT_TO_PTR(t->id));
221 return r;
222 }
223
224 LIST_PREPEND(transactions_by_scope, s->transactions, t);
225 t->scope = s;
226
227 s->manager->n_transactions_total++;
228
229 if (ret)
230 *ret = t;
231
232 t = NULL;
233
234 return 0;
235 }
236
237 static void dns_transaction_shuffle_id(DnsTransaction *t) {
238 uint16_t new_id;
239 assert(t);
240
241 /* Pick a new ID for this transaction. */
242
243 new_id = pick_new_id(t->scope->manager);
244 assert_se(hashmap_remove_and_put(t->scope->manager->dns_transactions, UINT_TO_PTR(t->id), UINT_TO_PTR(new_id), t) >= 0);
245
246 log_debug("Transaction %" PRIu16 " is now %" PRIu16 ".", t->id, new_id);
247 t->id = new_id;
248
249 /* Make sure we generate a new packet with the new ID */
250 t->sent = dns_packet_unref(t->sent);
251 }
252
253 static void dns_transaction_tentative(DnsTransaction *t, DnsPacket *p) {
254 _cleanup_free_ char *pretty = NULL;
255 char key_str[DNS_RESOURCE_KEY_STRING_MAX];
256 DnsZoneItem *z;
257
258 assert(t);
259 assert(p);
260
261 if (manager_our_packet(t->scope->manager, p) != 0)
262 return;
263
264 (void) in_addr_to_string(p->family, &p->sender, &pretty);
265
266 log_debug("Transaction %" PRIu16 " for <%s> on scope %s on %s/%s got tentative packet from %s.",
267 t->id,
268 dns_resource_key_to_string(t->key, key_str, sizeof key_str),
269 dns_protocol_to_string(t->scope->protocol),
270 t->scope->link ? t->scope->link->name : "*",
271 af_to_name_short(t->scope->family),
272 strnull(pretty));
273
274 /* RFC 4795, Section 4.1 says that the peer with the
275 * lexicographically smaller IP address loses */
276 if (memcmp(&p->sender, &p->destination, FAMILY_ADDRESS_SIZE(p->family)) >= 0) {
277 log_debug("Peer has lexicographically larger IP address and thus lost in the conflict.");
278 return;
279 }
280
281 log_debug("We have the lexicographically larger IP address and thus lost in the conflict.");
282
283 t->block_gc++;
284
285 while ((z = set_first(t->notify_zone_items))) {
286 /* First, make sure the zone item drops the reference
287 * to us */
288 dns_zone_item_probe_stop(z);
289
290 /* Secondly, report this as conflict, so that we might
291 * look for a different hostname */
292 dns_zone_item_conflict(z);
293 }
294 t->block_gc--;
295
296 dns_transaction_gc(t);
297 }
298
299 void dns_transaction_complete(DnsTransaction *t, DnsTransactionState state) {
300 DnsQueryCandidate *c;
301 DnsZoneItem *z;
302 DnsTransaction *d;
303 const char *st;
304 char key_str[DNS_RESOURCE_KEY_STRING_MAX];
305
306 assert(t);
307 assert(!DNS_TRANSACTION_IS_LIVE(state));
308
309 if (state == DNS_TRANSACTION_DNSSEC_FAILED) {
310 dns_resource_key_to_string(t->key, key_str, sizeof key_str);
311
312 log_struct(LOG_NOTICE,
313 "MESSAGE_ID=" SD_MESSAGE_DNSSEC_FAILURE_STR,
314 LOG_MESSAGE("DNSSEC validation failed for question %s: %s", key_str, dnssec_result_to_string(t->answer_dnssec_result)),
315 "DNS_TRANSACTION=%" PRIu16, t->id,
316 "DNS_QUESTION=%s", key_str,
317 "DNSSEC_RESULT=%s", dnssec_result_to_string(t->answer_dnssec_result),
318 "DNS_SERVER=%s", dns_server_string(t->server),
319 "DNS_SERVER_FEATURE_LEVEL=%s", dns_server_feature_level_to_string(t->server->possible_feature_level));
320 }
321
322 /* Note that this call might invalidate the query. Callers
323 * should hence not attempt to access the query or transaction
324 * after calling this function. */
325
326 if (state == DNS_TRANSACTION_ERRNO)
327 st = errno_to_name(t->answer_errno);
328 else
329 st = dns_transaction_state_to_string(state);
330
331 log_debug("Transaction %" PRIu16 " for <%s> on scope %s on %s/%s now complete with <%s> from %s (%s).",
332 t->id,
333 dns_resource_key_to_string(t->key, key_str, sizeof key_str),
334 dns_protocol_to_string(t->scope->protocol),
335 t->scope->link ? t->scope->link->name : "*",
336 af_to_name_short(t->scope->family),
337 st,
338 t->answer_source < 0 ? "none" : dns_transaction_source_to_string(t->answer_source),
339 t->answer_authenticated ? "authenticated" : "unsigned");
340
341 t->state = state;
342
343 dns_transaction_close_connection(t);
344 dns_transaction_stop_timeout(t);
345
346 /* Notify all queries that are interested, but make sure the
347 * transaction isn't freed while we are still looking at it */
348 t->block_gc++;
349
350 SET_FOREACH_MOVE(c, t->notify_query_candidates_done, t->notify_query_candidates)
351 dns_query_candidate_notify(c);
352 SWAP_TWO(t->notify_query_candidates, t->notify_query_candidates_done);
353
354 SET_FOREACH_MOVE(z, t->notify_zone_items_done, t->notify_zone_items)
355 dns_zone_item_notify(z);
356 SWAP_TWO(t->notify_zone_items, t->notify_zone_items_done);
357 if (t->probing && t->state == DNS_TRANSACTION_ATTEMPTS_MAX_REACHED)
358 (void) dns_scope_announce(t->scope, false);
359
360 SET_FOREACH_MOVE(d, t->notify_transactions_done, t->notify_transactions)
361 dns_transaction_notify(d, t);
362 SWAP_TWO(t->notify_transactions, t->notify_transactions_done);
363
364 t->block_gc--;
365 dns_transaction_gc(t);
366 }
367
368 static int dns_transaction_pick_server(DnsTransaction *t) {
369 DnsServer *server;
370
371 assert(t);
372 assert(t->scope->protocol == DNS_PROTOCOL_DNS);
373
374 /* Pick a DNS server and a feature level for it. */
375
376 server = dns_scope_get_dns_server(t->scope);
377 if (!server)
378 return -ESRCH;
379
380 /* If we changed the server invalidate the feature level clamping, as the new server might have completely
381 * different properties. */
382 if (server != t->server)
383 t->clamp_feature_level = _DNS_SERVER_FEATURE_LEVEL_INVALID;
384
385 t->current_feature_level = dns_server_possible_feature_level(server);
386
387 /* Clamp the feature level if that is requested. */
388 if (t->clamp_feature_level != _DNS_SERVER_FEATURE_LEVEL_INVALID &&
389 t->current_feature_level > t->clamp_feature_level)
390 t->current_feature_level = t->clamp_feature_level;
391
392 log_debug("Using feature level %s for transaction %u.", dns_server_feature_level_to_string(t->current_feature_level), t->id);
393
394 if (server == t->server)
395 return 0;
396
397 dns_server_unref(t->server);
398 t->server = dns_server_ref(server);
399
400 t->n_picked_servers ++;
401
402 log_debug("Using DNS server %s for transaction %u.", dns_server_string(t->server), t->id);
403
404 return 1;
405 }
406
407 static void dns_transaction_retry(DnsTransaction *t, bool next_server) {
408 int r;
409
410 assert(t);
411
412 log_debug("Retrying transaction %" PRIu16 ".", t->id);
413
414 /* Before we try again, switch to a new server. */
415 if (next_server)
416 dns_scope_next_dns_server(t->scope);
417
418 r = dns_transaction_go(t);
419 if (r < 0) {
420 t->answer_errno = -r;
421 dns_transaction_complete(t, DNS_TRANSACTION_ERRNO);
422 }
423 }
424
425 static int dns_transaction_maybe_restart(DnsTransaction *t) {
426 int r;
427
428 assert(t);
429
430 /* Returns > 0 if the transaction was restarted, 0 if not */
431
432 if (!t->server)
433 return 0;
434
435 if (t->current_feature_level <= dns_server_possible_feature_level(t->server))
436 return 0;
437
438 /* The server's current feature level is lower than when we sent the original query. We learnt something from
439 the response or possibly an auxiliary DNSSEC response that we didn't know before. We take that as reason to
440 restart the whole transaction. This is a good idea to deal with servers that respond rubbish if we include
441 OPT RR or DO bit. One of these cases is documented here, for example:
442 https://open.nlnetlabs.nl/pipermail/dnssec-trigger/2014-November/000376.html */
443
444 log_debug("Server feature level is now lower than when we began our transaction. Restarting with new ID.");
445 dns_transaction_shuffle_id(t);
446
447 r = dns_transaction_go(t);
448 if (r < 0)
449 return r;
450
451 return 1;
452 }
453
454 static void on_transaction_stream_error(DnsTransaction *t, int error) {
455 assert(t);
456
457 dns_transaction_close_connection(t);
458
459 if (ERRNO_IS_DISCONNECT(error)) {
460 if (t->scope->protocol == DNS_PROTOCOL_LLMNR) {
461 /* If the LLMNR/TCP connection failed, the host doesn't support LLMNR, and we cannot answer the
462 * question on this scope. */
463 dns_transaction_complete(t, DNS_TRANSACTION_NOT_FOUND);
464 return;
465 }
466
467 dns_transaction_retry(t, true);
468 return;
469 }
470 if (error != 0) {
471 t->answer_errno = error;
472 dns_transaction_complete(t, DNS_TRANSACTION_ERRNO);
473 }
474 }
475
476 static int dns_transaction_on_stream_packet(DnsTransaction *t, DnsPacket *p) {
477 assert(t);
478 assert(p);
479
480 dns_transaction_close_connection(t);
481
482 if (dns_packet_validate_reply(p) <= 0) {
483 log_debug("Invalid TCP reply packet.");
484 dns_transaction_complete(t, DNS_TRANSACTION_INVALID_REPLY);
485 return 0;
486 }
487
488 dns_scope_check_conflicts(t->scope, p);
489
490 t->block_gc++;
491 dns_transaction_process_reply(t, p);
492 t->block_gc--;
493
494 /* If the response wasn't useful, then complete the transition
495 * now. After all, we are the worst feature set now with TCP
496 * sockets, and there's really no point in retrying. */
497 if (t->state == DNS_TRANSACTION_PENDING)
498 dns_transaction_complete(t, DNS_TRANSACTION_INVALID_REPLY);
499 else
500 dns_transaction_gc(t);
501
502 return 0;
503 }
504
505 static int on_stream_complete(DnsStream *s, int error) {
506 _cleanup_(dns_stream_unrefp) DnsStream *p = NULL;
507 DnsTransaction *t, *n;
508 int r = 0;
509
510 /* Do not let new transactions use this stream */
511 if (s->server && s->server->stream == s)
512 p = TAKE_PTR(s->server->stream);
513
514 if (ERRNO_IS_DISCONNECT(error) && s->protocol != DNS_PROTOCOL_LLMNR) {
515 usec_t usec;
516
517 log_debug_errno(error, "Connection failure for DNS TCP stream: %m");
518
519 if (s->transactions) {
520 t = s->transactions;
521 assert_se(sd_event_now(t->scope->manager->event, clock_boottime_or_monotonic(), &usec) >= 0);
522 dns_server_packet_lost(t->server, IPPROTO_TCP, t->current_feature_level);
523 }
524 }
525
526 LIST_FOREACH_SAFE(transactions_by_stream, t, n, s->transactions)
527 if (error != 0)
528 on_transaction_stream_error(t, error);
529 else if (DNS_PACKET_ID(s->read_packet) == t->id)
530 /* As each transaction have a unique id the return code is only set once */
531 r = dns_transaction_on_stream_packet(t, s->read_packet);
532
533 return r;
534 }
535
536 static int dns_stream_on_packet(DnsStream *s) {
537 _cleanup_(dns_packet_unrefp) DnsPacket *p = NULL;
538 int r = 0;
539 DnsTransaction *t;
540
541 /* Take ownership of packet to be able to receive new packets */
542 p = TAKE_PTR(s->read_packet);
543 s->n_read = 0;
544
545 t = hashmap_get(s->manager->dns_transactions, UINT_TO_PTR(DNS_PACKET_ID(p)));
546
547 /* Ignore incorrect transaction id as transaction can have been canceled */
548 if (t)
549 r = dns_transaction_on_stream_packet(t, p);
550 else {
551 if (dns_packet_validate_reply(p) <= 0) {
552 log_debug("Invalid TCP reply packet.");
553 on_stream_complete(s, 0);
554 }
555 return 0;
556 }
557
558 return r;
559 }
560
561 static int dns_transaction_emit_tcp(DnsTransaction *t) {
562 _cleanup_close_ int fd = -1;
563 _cleanup_(dns_stream_unrefp) DnsStream *s = NULL;
564 union sockaddr_union sa;
565 int r;
566
567 assert(t);
568
569 dns_transaction_close_connection(t);
570
571 switch (t->scope->protocol) {
572
573 case DNS_PROTOCOL_DNS:
574 r = dns_transaction_pick_server(t);
575 if (r < 0)
576 return r;
577
578 if (!dns_server_dnssec_supported(t->server) && dns_type_is_dnssec(t->key->type))
579 return -EOPNOTSUPP;
580
581 r = dns_server_adjust_opt(t->server, t->sent, t->current_feature_level);
582 if (r < 0)
583 return r;
584
585 if (t->server->stream && (DNS_SERVER_FEATURE_LEVEL_IS_TLS(t->current_feature_level) == t->server->stream->encrypted))
586 s = dns_stream_ref(t->server->stream);
587 else
588 fd = dns_scope_socket_tcp(t->scope, AF_UNSPEC, NULL, t->server, DNS_SERVER_FEATURE_LEVEL_IS_TLS(t->current_feature_level) ? 853 : 53, &sa);
589
590 break;
591
592 case DNS_PROTOCOL_LLMNR:
593 /* When we already received a reply to this (but it was truncated), send to its sender address */
594 if (t->received)
595 fd = dns_scope_socket_tcp(t->scope, t->received->family, &t->received->sender, NULL, t->received->sender_port, &sa);
596 else {
597 union in_addr_union address;
598 int family = AF_UNSPEC;
599
600 /* Otherwise, try to talk to the owner of a
601 * the IP address, in case this is a reverse
602 * PTR lookup */
603
604 r = dns_name_address(dns_resource_key_name(t->key), &family, &address);
605 if (r < 0)
606 return r;
607 if (r == 0)
608 return -EINVAL;
609 if (family != t->scope->family)
610 return -ESRCH;
611
612 fd = dns_scope_socket_tcp(t->scope, family, &address, NULL, LLMNR_PORT, &sa);
613 }
614
615 break;
616
617 default:
618 return -EAFNOSUPPORT;
619 }
620
621 if (!s) {
622 if (fd < 0)
623 return fd;
624
625 r = dns_stream_new(t->scope->manager, &s, t->scope->protocol, fd, &sa);
626 if (r < 0)
627 return r;
628
629 fd = -1;
630
631 #if ENABLE_DNS_OVER_TLS
632 if (DNS_SERVER_FEATURE_LEVEL_IS_TLS(t->current_feature_level)) {
633 assert(t->server);
634 r = dnstls_stream_connect_tls(s, t->server);
635 if (r < 0)
636 return r;
637 }
638 #endif
639
640 if (t->server) {
641 dns_stream_unref(t->server->stream);
642 t->server->stream = dns_stream_ref(s);
643 s->server = dns_server_ref(t->server);
644 }
645
646 s->complete = on_stream_complete;
647 s->on_packet = dns_stream_on_packet;
648
649 /* The interface index is difficult to determine if we are
650 * connecting to the local host, hence fill this in right away
651 * instead of determining it from the socket */
652 s->ifindex = dns_scope_ifindex(t->scope);
653 }
654
655 t->stream = TAKE_PTR(s);
656 LIST_PREPEND(transactions_by_stream, t->stream->transactions, t);
657
658 r = dns_stream_write_packet(t->stream, t->sent);
659 if (r < 0) {
660 dns_transaction_close_connection(t);
661 return r;
662 }
663
664 dns_transaction_reset_answer(t);
665
666 t->tried_stream = true;
667
668 return 0;
669 }
670
671 static void dns_transaction_cache_answer(DnsTransaction *t) {
672 assert(t);
673
674 /* For mDNS we cache whenever we get the packet, rather than
675 * in each transaction. */
676 if (!IN_SET(t->scope->protocol, DNS_PROTOCOL_DNS, DNS_PROTOCOL_LLMNR))
677 return;
678
679 /* Caching disabled? */
680 if (!t->scope->manager->enable_cache)
681 return;
682
683 /* We never cache if this packet is from the local host, under
684 * the assumption that a locally running DNS server would
685 * cache this anyway, and probably knows better when to flush
686 * the cache then we could. */
687 if (!DNS_PACKET_SHALL_CACHE(t->received))
688 return;
689
690 dns_cache_put(&t->scope->cache,
691 t->key,
692 t->answer_rcode,
693 t->answer,
694 t->answer_authenticated,
695 t->answer_nsec_ttl,
696 0,
697 t->received->family,
698 &t->received->sender);
699 }
700
701 static bool dns_transaction_dnssec_is_live(DnsTransaction *t) {
702 DnsTransaction *dt;
703 Iterator i;
704
705 assert(t);
706
707 SET_FOREACH(dt, t->dnssec_transactions, i)
708 if (DNS_TRANSACTION_IS_LIVE(dt->state))
709 return true;
710
711 return false;
712 }
713
714 static int dns_transaction_dnssec_ready(DnsTransaction *t) {
715 DnsTransaction *dt;
716 Iterator i;
717
718 assert(t);
719
720 /* Checks whether the auxiliary DNSSEC transactions of our transaction have completed, or are still
721 * ongoing. Returns 0, if we aren't ready for the DNSSEC validation, positive if we are. */
722
723 SET_FOREACH(dt, t->dnssec_transactions, i) {
724
725 switch (dt->state) {
726
727 case DNS_TRANSACTION_NULL:
728 case DNS_TRANSACTION_PENDING:
729 case DNS_TRANSACTION_VALIDATING:
730 /* Still ongoing */
731 return 0;
732
733 case DNS_TRANSACTION_RCODE_FAILURE:
734 if (!IN_SET(dt->answer_rcode, DNS_RCODE_NXDOMAIN, DNS_RCODE_SERVFAIL)) {
735 log_debug("Auxiliary DNSSEC RR query failed with rcode=%s.", dns_rcode_to_string(dt->answer_rcode));
736 goto fail;
737 }
738
739 /* Fall-through: NXDOMAIN/SERVFAIL is good enough for us. This is because some DNS servers
740 * erronously return NXDOMAIN/SERVFAIL for empty non-terminals (Akamai...) or missing DS
741 * records (Facebook), and we need to handle that nicely, when asking for parent SOA or similar
742 * RRs to make unsigned proofs. */
743
744 case DNS_TRANSACTION_SUCCESS:
745 /* All good. */
746 break;
747
748 case DNS_TRANSACTION_DNSSEC_FAILED:
749 /* We handle DNSSEC failures different from other errors, as we care about the DNSSEC
750 * validationr result */
751
752 log_debug("Auxiliary DNSSEC RR query failed validation: %s", dnssec_result_to_string(dt->answer_dnssec_result));
753 t->answer_dnssec_result = dt->answer_dnssec_result; /* Copy error code over */
754 dns_transaction_complete(t, DNS_TRANSACTION_DNSSEC_FAILED);
755 return 0;
756
757 default:
758 log_debug("Auxiliary DNSSEC RR query failed with %s", dns_transaction_state_to_string(dt->state));
759 goto fail;
760 }
761 }
762
763 /* All is ready, we can go and validate */
764 return 1;
765
766 fail:
767 t->answer_dnssec_result = DNSSEC_FAILED_AUXILIARY;
768 dns_transaction_complete(t, DNS_TRANSACTION_DNSSEC_FAILED);
769 return 0;
770 }
771
772 static void dns_transaction_process_dnssec(DnsTransaction *t) {
773 int r;
774
775 assert(t);
776
777 /* Are there ongoing DNSSEC transactions? If so, let's wait for them. */
778 r = dns_transaction_dnssec_ready(t);
779 if (r < 0)
780 goto fail;
781 if (r == 0) /* We aren't ready yet (or one of our auxiliary transactions failed, and we shouldn't validate now */
782 return;
783
784 /* See if we learnt things from the additional DNSSEC transactions, that we didn't know before, and better
785 * restart the lookup immediately. */
786 r = dns_transaction_maybe_restart(t);
787 if (r < 0)
788 goto fail;
789 if (r > 0) /* Transaction got restarted... */
790 return;
791
792 /* All our auxiliary DNSSEC transactions are complete now. Try
793 * to validate our RRset now. */
794 r = dns_transaction_validate_dnssec(t);
795 if (r == -EBADMSG) {
796 dns_transaction_complete(t, DNS_TRANSACTION_INVALID_REPLY);
797 return;
798 }
799 if (r < 0)
800 goto fail;
801
802 if (t->answer_dnssec_result == DNSSEC_INCOMPATIBLE_SERVER &&
803 t->scope->dnssec_mode == DNSSEC_YES) {
804
805 /* We are not in automatic downgrade mode, and the server is bad. Let's try a different server, maybe
806 * that works. */
807
808 if (t->n_picked_servers < dns_scope_get_n_dns_servers(t->scope)) {
809 /* We tried fewer servers on this transaction than we know, let's try another one then */
810 dns_transaction_retry(t, true);
811 return;
812 }
813
814 /* OK, let's give up, apparently all servers we tried didn't work. */
815 dns_transaction_complete(t, DNS_TRANSACTION_DNSSEC_FAILED);
816 return;
817 }
818
819 if (!IN_SET(t->answer_dnssec_result,
820 _DNSSEC_RESULT_INVALID, /* No DNSSEC validation enabled */
821 DNSSEC_VALIDATED, /* Answer is signed and validated successfully */
822 DNSSEC_UNSIGNED, /* Answer is right-fully unsigned */
823 DNSSEC_INCOMPATIBLE_SERVER)) { /* Server does not do DNSSEC (Yay, we are downgrade attack vulnerable!) */
824 dns_transaction_complete(t, DNS_TRANSACTION_DNSSEC_FAILED);
825 return;
826 }
827
828 if (t->answer_dnssec_result == DNSSEC_INCOMPATIBLE_SERVER)
829 dns_server_warn_downgrade(t->server);
830
831 dns_transaction_cache_answer(t);
832
833 if (t->answer_rcode == DNS_RCODE_SUCCESS)
834 dns_transaction_complete(t, DNS_TRANSACTION_SUCCESS);
835 else
836 dns_transaction_complete(t, DNS_TRANSACTION_RCODE_FAILURE);
837
838 return;
839
840 fail:
841 t->answer_errno = -r;
842 dns_transaction_complete(t, DNS_TRANSACTION_ERRNO);
843 }
844
845 static int dns_transaction_has_positive_answer(DnsTransaction *t, DnsAnswerFlags *flags) {
846 int r;
847
848 assert(t);
849
850 /* Checks whether the answer is positive, i.e. either a direct
851 * answer to the question, or a CNAME/DNAME for it */
852
853 r = dns_answer_match_key(t->answer, t->key, flags);
854 if (r != 0)
855 return r;
856
857 r = dns_answer_find_cname_or_dname(t->answer, t->key, NULL, flags);
858 if (r != 0)
859 return r;
860
861 return false;
862 }
863
864 static int dns_transaction_fix_rcode(DnsTransaction *t) {
865 int r;
866
867 assert(t);
868
869 /* Fix up the RCODE to SUCCESS if we get at least one matching RR in a response. Note that this contradicts the
870 * DNS RFCs a bit. Specifically, RFC 6604 Section 3 clarifies that the RCODE shall say something about a
871 * CNAME/DNAME chain element coming after the last chain element contained in the message, and not the first
872 * one included. However, it also indicates that not all DNS servers implement this correctly. Moreover, when
873 * using DNSSEC we usually only can prove the first element of a CNAME/DNAME chain anyway, hence let's settle
874 * on always processing the RCODE as referring to the immediate look-up we do, i.e. the first element of a
875 * CNAME/DNAME chain. This way, we uniformly handle CNAME/DNAME chains, regardless if the DNS server
876 * incorrectly implements RCODE, whether DNSSEC is in use, or whether the DNS server only supplied us with an
877 * incomplete CNAME/DNAME chain.
878 *
879 * Or in other words: if we get at least one positive reply in a message we patch NXDOMAIN to become SUCCESS,
880 * and then rely on the CNAME chasing logic to figure out that there's actually a CNAME error with a new
881 * lookup. */
882
883 if (t->answer_rcode != DNS_RCODE_NXDOMAIN)
884 return 0;
885
886 r = dns_transaction_has_positive_answer(t, NULL);
887 if (r <= 0)
888 return r;
889
890 t->answer_rcode = DNS_RCODE_SUCCESS;
891 return 0;
892 }
893
894 void dns_transaction_process_reply(DnsTransaction *t, DnsPacket *p) {
895 usec_t ts;
896 int r;
897
898 assert(t);
899 assert(p);
900 assert(t->scope);
901 assert(t->scope->manager);
902
903 if (t->state != DNS_TRANSACTION_PENDING)
904 return;
905
906 /* Note that this call might invalidate the query. Callers
907 * should hence not attempt to access the query or transaction
908 * after calling this function. */
909
910 log_debug("Processing incoming packet on transaction %" PRIu16" (rcode=%s).",
911 t->id, dns_rcode_to_string(DNS_PACKET_RCODE(p)));
912
913 switch (t->scope->protocol) {
914
915 case DNS_PROTOCOL_LLMNR:
916 /* For LLMNR we will not accept any packets from other interfaces */
917
918 if (p->ifindex != dns_scope_ifindex(t->scope))
919 return;
920
921 if (p->family != t->scope->family)
922 return;
923
924 /* Tentative packets are not full responses but still
925 * useful for identifying uniqueness conflicts during
926 * probing. */
927 if (DNS_PACKET_LLMNR_T(p)) {
928 dns_transaction_tentative(t, p);
929 return;
930 }
931
932 break;
933
934 case DNS_PROTOCOL_MDNS:
935 /* For mDNS we will not accept any packets from other interfaces */
936
937 if (p->ifindex != dns_scope_ifindex(t->scope))
938 return;
939
940 if (p->family != t->scope->family)
941 return;
942
943 break;
944
945 case DNS_PROTOCOL_DNS:
946 /* Note that we do not need to verify the
947 * addresses/port numbers of incoming traffic, as we
948 * invoked connect() on our UDP socket in which case
949 * the kernel already does the needed verification for
950 * us. */
951 break;
952
953 default:
954 assert_not_reached("Invalid DNS protocol.");
955 }
956
957 if (t->received != p) {
958 dns_packet_unref(t->received);
959 t->received = dns_packet_ref(p);
960 }
961
962 t->answer_source = DNS_TRANSACTION_NETWORK;
963
964 if (p->ipproto == IPPROTO_TCP) {
965 if (DNS_PACKET_TC(p)) {
966 /* Truncated via TCP? Somebody must be fucking with us */
967 dns_transaction_complete(t, DNS_TRANSACTION_INVALID_REPLY);
968 return;
969 }
970
971 if (DNS_PACKET_ID(p) != t->id) {
972 /* Not the reply to our query? Somebody must be fucking with us */
973 dns_transaction_complete(t, DNS_TRANSACTION_INVALID_REPLY);
974 return;
975 }
976 }
977
978 assert_se(sd_event_now(t->scope->manager->event, clock_boottime_or_monotonic(), &ts) >= 0);
979
980 switch (t->scope->protocol) {
981
982 case DNS_PROTOCOL_DNS:
983 assert(t->server);
984
985 if (IN_SET(DNS_PACKET_RCODE(p), DNS_RCODE_FORMERR, DNS_RCODE_SERVFAIL, DNS_RCODE_NOTIMP)) {
986
987 /* Request failed, immediately try again with reduced features */
988
989 if (t->current_feature_level <= DNS_SERVER_FEATURE_LEVEL_UDP) {
990
991 /* This was already at UDP feature level? If so, it doesn't make sense to downgrade
992 * this transaction anymore, but let's see if it might make sense to send the request
993 * to a different DNS server instead. If not let's process the response, and accept the
994 * rcode. Note that we don't retry on TCP, since that's a suitable way to mitigate
995 * packet loss, but is not going to give us better rcodes should we actually have
996 * managed to get them already at UDP level. */
997
998 if (t->n_picked_servers < dns_scope_get_n_dns_servers(t->scope)) {
999 /* We tried fewer servers on this transaction than we know, let's try another one then */
1000 dns_transaction_retry(t, true);
1001 return;
1002 }
1003
1004 /* Give up, accept the rcode */
1005 log_debug("Server returned error: %s", dns_rcode_to_string(DNS_PACKET_RCODE(p)));
1006 break;
1007 }
1008
1009 /* Reduce this feature level by one and try again. */
1010 switch (t->current_feature_level) {
1011 case DNS_SERVER_FEATURE_LEVEL_TLS_DO:
1012 t->clamp_feature_level = DNS_SERVER_FEATURE_LEVEL_TLS_PLAIN;
1013 break;
1014 case DNS_SERVER_FEATURE_LEVEL_TLS_PLAIN + 1:
1015 /* Skip plain TLS when TLS is not supported */
1016 t->clamp_feature_level = DNS_SERVER_FEATURE_LEVEL_TLS_PLAIN - 1;
1017 break;
1018 default:
1019 t->clamp_feature_level = t->current_feature_level - 1;
1020 }
1021
1022 log_debug("Server returned error %s, retrying transaction with reduced feature level %s.",
1023 dns_rcode_to_string(DNS_PACKET_RCODE(p)),
1024 dns_server_feature_level_to_string(t->clamp_feature_level));
1025
1026 dns_transaction_retry(t, false /* use the same server */);
1027 return;
1028 }
1029
1030 if (DNS_PACKET_RCODE(p) == DNS_RCODE_REFUSED) {
1031 /* This server refused our request? If so, try again, use a different server */
1032 log_debug("Server returned REFUSED, switching servers, and retrying.");
1033 dns_transaction_retry(t, true /* pick a new server */);
1034 return;
1035 }
1036
1037 if (DNS_PACKET_TC(p))
1038 dns_server_packet_truncated(t->server, t->current_feature_level);
1039
1040 break;
1041
1042 case DNS_PROTOCOL_LLMNR:
1043 case DNS_PROTOCOL_MDNS:
1044 dns_scope_packet_received(t->scope, ts - t->start_usec);
1045 break;
1046
1047 default:
1048 assert_not_reached("Invalid DNS protocol.");
1049 }
1050
1051 if (DNS_PACKET_TC(p)) {
1052
1053 /* Truncated packets for mDNS are not allowed. Give up immediately. */
1054 if (t->scope->protocol == DNS_PROTOCOL_MDNS) {
1055 dns_transaction_complete(t, DNS_TRANSACTION_INVALID_REPLY);
1056 return;
1057 }
1058
1059 log_debug("Reply truncated, retrying via TCP.");
1060
1061 /* Response was truncated, let's try again with good old TCP */
1062 r = dns_transaction_emit_tcp(t);
1063 if (r == -ESRCH) {
1064 /* No servers found? Damn! */
1065 dns_transaction_complete(t, DNS_TRANSACTION_NO_SERVERS);
1066 return;
1067 }
1068 if (r == -EOPNOTSUPP) {
1069 /* Tried to ask for DNSSEC RRs, on a server that doesn't do DNSSEC */
1070 dns_transaction_complete(t, DNS_TRANSACTION_RR_TYPE_UNSUPPORTED);
1071 return;
1072 }
1073 if (r < 0) {
1074 /* On LLMNR, if we cannot connect to the host,
1075 * we immediately give up */
1076 if (t->scope->protocol != DNS_PROTOCOL_DNS)
1077 goto fail;
1078
1079 /* On DNS, couldn't send? Try immediately again, with a new server */
1080 dns_transaction_retry(t, true);
1081 }
1082
1083 return;
1084 }
1085
1086 /* After the superficial checks, actually parse the message. */
1087 r = dns_packet_extract(p);
1088 if (r < 0) {
1089 dns_transaction_complete(t, DNS_TRANSACTION_INVALID_REPLY);
1090 return;
1091 }
1092
1093 if (t->server) {
1094 /* Report that we successfully received a valid packet with a good rcode after we initially got a bad
1095 * rcode and subsequently downgraded the protocol */
1096
1097 if (IN_SET(DNS_PACKET_RCODE(p), DNS_RCODE_SUCCESS, DNS_RCODE_NXDOMAIN) &&
1098 t->clamp_feature_level != _DNS_SERVER_FEATURE_LEVEL_INVALID)
1099 dns_server_packet_rcode_downgrade(t->server, t->clamp_feature_level);
1100
1101 /* Report that the OPT RR was missing */
1102 if (!p->opt)
1103 dns_server_packet_bad_opt(t->server, t->current_feature_level);
1104
1105 /* Report that we successfully received a packet */
1106 dns_server_packet_received(t->server, p->ipproto, t->current_feature_level, p->size);
1107 }
1108
1109 /* See if we know things we didn't know before that indicate we better restart the lookup immediately. */
1110 r = dns_transaction_maybe_restart(t);
1111 if (r < 0)
1112 goto fail;
1113 if (r > 0) /* Transaction got restarted... */
1114 return;
1115
1116 if (IN_SET(t->scope->protocol, DNS_PROTOCOL_DNS, DNS_PROTOCOL_LLMNR, DNS_PROTOCOL_MDNS)) {
1117
1118 /* When dealing with protocols other than mDNS only consider responses with
1119 * equivalent query section to the request. For mDNS this check doesn't make
1120 * sense, because the section 6 of RFC6762 states that "Multicast DNS responses MUST NOT
1121 * contain any questions in the Question Section". */
1122 if (t->scope->protocol != DNS_PROTOCOL_MDNS) {
1123 r = dns_packet_is_reply_for(p, t->key);
1124 if (r < 0)
1125 goto fail;
1126 if (r == 0) {
1127 dns_transaction_complete(t, DNS_TRANSACTION_INVALID_REPLY);
1128 return;
1129 }
1130 }
1131
1132 /* Install the answer as answer to the transaction */
1133 dns_answer_unref(t->answer);
1134 t->answer = dns_answer_ref(p->answer);
1135 t->answer_rcode = DNS_PACKET_RCODE(p);
1136 t->answer_dnssec_result = _DNSSEC_RESULT_INVALID;
1137 t->answer_authenticated = false;
1138
1139 r = dns_transaction_fix_rcode(t);
1140 if (r < 0)
1141 goto fail;
1142
1143 /* Block GC while starting requests for additional DNSSEC RRs */
1144 t->block_gc++;
1145 r = dns_transaction_request_dnssec_keys(t);
1146 t->block_gc--;
1147
1148 /* Maybe the transaction is ready for GC'ing now? If so, free it and return. */
1149 if (!dns_transaction_gc(t))
1150 return;
1151
1152 /* Requesting additional keys might have resulted in
1153 * this transaction to fail, since the auxiliary
1154 * request failed for some reason. If so, we are not
1155 * in pending state anymore, and we should exit
1156 * quickly. */
1157 if (t->state != DNS_TRANSACTION_PENDING)
1158 return;
1159 if (r < 0)
1160 goto fail;
1161 if (r > 0) {
1162 /* There are DNSSEC transactions pending now. Update the state accordingly. */
1163 t->state = DNS_TRANSACTION_VALIDATING;
1164 dns_transaction_close_connection(t);
1165 dns_transaction_stop_timeout(t);
1166 return;
1167 }
1168 }
1169
1170 dns_transaction_process_dnssec(t);
1171 return;
1172
1173 fail:
1174 t->answer_errno = -r;
1175 dns_transaction_complete(t, DNS_TRANSACTION_ERRNO);
1176 }
1177
1178 static int on_dns_packet(sd_event_source *s, int fd, uint32_t revents, void *userdata) {
1179 _cleanup_(dns_packet_unrefp) DnsPacket *p = NULL;
1180 DnsTransaction *t = userdata;
1181 int r;
1182
1183 assert(t);
1184 assert(t->scope);
1185
1186 r = manager_recv(t->scope->manager, fd, DNS_PROTOCOL_DNS, &p);
1187 if (ERRNO_IS_DISCONNECT(-r)) {
1188 usec_t usec;
1189
1190 /* UDP connection failure get reported via ICMP and then are possible delivered to us on the next
1191 * recvmsg(). Treat this like a lost packet. */
1192
1193 log_debug_errno(r, "Connection failure for DNS UDP packet: %m");
1194 assert_se(sd_event_now(t->scope->manager->event, clock_boottime_or_monotonic(), &usec) >= 0);
1195 dns_server_packet_lost(t->server, IPPROTO_UDP, t->current_feature_level);
1196
1197 dns_transaction_retry(t, true);
1198 return 0;
1199 }
1200 if (r < 0) {
1201 dns_transaction_complete(t, DNS_TRANSACTION_ERRNO);
1202 t->answer_errno = -r;
1203 return 0;
1204 }
1205
1206 r = dns_packet_validate_reply(p);
1207 if (r < 0) {
1208 log_debug_errno(r, "Received invalid DNS packet as response, ignoring: %m");
1209 return 0;
1210 }
1211 if (r == 0) {
1212 log_debug("Received inappropriate DNS packet as response, ignoring.");
1213 return 0;
1214 }
1215
1216 if (DNS_PACKET_ID(p) != t->id) {
1217 log_debug("Received packet with incorrect transaction ID, ignoring.");
1218 return 0;
1219 }
1220
1221 dns_transaction_process_reply(t, p);
1222 return 0;
1223 }
1224
1225 static int dns_transaction_emit_udp(DnsTransaction *t) {
1226 int r;
1227
1228 assert(t);
1229
1230 if (t->scope->protocol == DNS_PROTOCOL_DNS) {
1231
1232 r = dns_transaction_pick_server(t);
1233 if (r < 0)
1234 return r;
1235
1236 if (t->current_feature_level < DNS_SERVER_FEATURE_LEVEL_UDP || DNS_SERVER_FEATURE_LEVEL_IS_TLS(t->current_feature_level))
1237 return -EAGAIN; /* Sorry, can't do UDP, try TCP! */
1238
1239 if (!dns_server_dnssec_supported(t->server) && dns_type_is_dnssec(t->key->type))
1240 return -EOPNOTSUPP;
1241
1242 if (r > 0 || t->dns_udp_fd < 0) { /* Server changed, or no connection yet. */
1243 int fd;
1244
1245 dns_transaction_close_connection(t);
1246
1247 fd = dns_scope_socket_udp(t->scope, t->server, 53);
1248 if (fd < 0)
1249 return fd;
1250
1251 r = sd_event_add_io(t->scope->manager->event, &t->dns_udp_event_source, fd, EPOLLIN, on_dns_packet, t);
1252 if (r < 0) {
1253 safe_close(fd);
1254 return r;
1255 }
1256
1257 (void) sd_event_source_set_description(t->dns_udp_event_source, "dns-transaction-udp");
1258 t->dns_udp_fd = fd;
1259 }
1260
1261 r = dns_server_adjust_opt(t->server, t->sent, t->current_feature_level);
1262 if (r < 0)
1263 return r;
1264 } else
1265 dns_transaction_close_connection(t);
1266
1267 r = dns_scope_emit_udp(t->scope, t->dns_udp_fd, t->sent);
1268 if (r < 0)
1269 return r;
1270
1271 dns_transaction_reset_answer(t);
1272
1273 return 0;
1274 }
1275
1276 static int on_transaction_timeout(sd_event_source *s, usec_t usec, void *userdata) {
1277 DnsTransaction *t = userdata;
1278
1279 assert(s);
1280 assert(t);
1281
1282 if (!t->initial_jitter_scheduled || t->initial_jitter_elapsed) {
1283 /* Timeout reached? Increase the timeout for the server used */
1284 switch (t->scope->protocol) {
1285
1286 case DNS_PROTOCOL_DNS:
1287 assert(t->server);
1288 dns_server_packet_lost(t->server, t->stream ? IPPROTO_TCP : IPPROTO_UDP, t->current_feature_level);
1289 break;
1290
1291 case DNS_PROTOCOL_LLMNR:
1292 case DNS_PROTOCOL_MDNS:
1293 dns_scope_packet_lost(t->scope, usec - t->start_usec);
1294 break;
1295
1296 default:
1297 assert_not_reached("Invalid DNS protocol.");
1298 }
1299
1300 if (t->initial_jitter_scheduled)
1301 t->initial_jitter_elapsed = true;
1302 }
1303
1304 log_debug("Timeout reached on transaction %" PRIu16 ".", t->id);
1305
1306 dns_transaction_retry(t, true);
1307 return 0;
1308 }
1309
1310 static usec_t transaction_get_resend_timeout(DnsTransaction *t) {
1311 assert(t);
1312 assert(t->scope);
1313
1314 switch (t->scope->protocol) {
1315
1316 case DNS_PROTOCOL_DNS:
1317
1318 /* When we do TCP, grant a much longer timeout, as in this case there's no need for us to quickly
1319 * resend, as the kernel does that anyway for us, and we really don't want to interrupt it in that
1320 * needlessly. */
1321 if (t->stream)
1322 return TRANSACTION_TCP_TIMEOUT_USEC;
1323
1324 return DNS_TIMEOUT_USEC;
1325
1326 case DNS_PROTOCOL_MDNS:
1327 assert(t->n_attempts > 0);
1328 if (t->probing)
1329 return MDNS_PROBING_INTERVAL_USEC;
1330 else
1331 return (1 << (t->n_attempts - 1)) * USEC_PER_SEC;
1332
1333 case DNS_PROTOCOL_LLMNR:
1334 return t->scope->resend_timeout;
1335
1336 default:
1337 assert_not_reached("Invalid DNS protocol.");
1338 }
1339 }
1340
1341 static int dns_transaction_prepare(DnsTransaction *t, usec_t ts) {
1342 int r;
1343
1344 assert(t);
1345
1346 dns_transaction_stop_timeout(t);
1347
1348 if (!dns_scope_network_good(t->scope)) {
1349 dns_transaction_complete(t, DNS_TRANSACTION_NETWORK_DOWN);
1350 return 0;
1351 }
1352
1353 if (t->n_attempts >= TRANSACTION_ATTEMPTS_MAX(t->scope->protocol)) {
1354 dns_transaction_complete(t, DNS_TRANSACTION_ATTEMPTS_MAX_REACHED);
1355 return 0;
1356 }
1357
1358 if (t->scope->protocol == DNS_PROTOCOL_LLMNR && t->tried_stream) {
1359 /* If we already tried via a stream, then we don't
1360 * retry on LLMNR. See RFC 4795, Section 2.7. */
1361 dns_transaction_complete(t, DNS_TRANSACTION_ATTEMPTS_MAX_REACHED);
1362 return 0;
1363 }
1364
1365 t->n_attempts++;
1366 t->start_usec = ts;
1367
1368 dns_transaction_reset_answer(t);
1369 dns_transaction_flush_dnssec_transactions(t);
1370
1371 /* Check the trust anchor. Do so only on classic DNS, since DNSSEC does not apply otherwise. */
1372 if (t->scope->protocol == DNS_PROTOCOL_DNS) {
1373 r = dns_trust_anchor_lookup_positive(&t->scope->manager->trust_anchor, t->key, &t->answer);
1374 if (r < 0)
1375 return r;
1376 if (r > 0) {
1377 t->answer_rcode = DNS_RCODE_SUCCESS;
1378 t->answer_source = DNS_TRANSACTION_TRUST_ANCHOR;
1379 t->answer_authenticated = true;
1380 dns_transaction_complete(t, DNS_TRANSACTION_SUCCESS);
1381 return 0;
1382 }
1383
1384 if (dns_name_is_root(dns_resource_key_name(t->key)) &&
1385 t->key->type == DNS_TYPE_DS) {
1386
1387 /* Hmm, this is a request for the root DS? A
1388 * DS RR doesn't exist in the root zone, and
1389 * if our trust anchor didn't know it either,
1390 * this means we cannot do any DNSSEC logic
1391 * anymore. */
1392
1393 if (t->scope->dnssec_mode == DNSSEC_ALLOW_DOWNGRADE) {
1394 /* We are in downgrade mode. In this
1395 * case, synthesize an unsigned empty
1396 * response, so that the any lookup
1397 * depending on this one can continue
1398 * assuming there was no DS, and hence
1399 * the root zone was unsigned. */
1400
1401 t->answer_rcode = DNS_RCODE_SUCCESS;
1402 t->answer_source = DNS_TRANSACTION_TRUST_ANCHOR;
1403 t->answer_authenticated = false;
1404 dns_transaction_complete(t, DNS_TRANSACTION_SUCCESS);
1405 } else
1406 /* If we are not in downgrade mode,
1407 * then fail the lookup, because we
1408 * cannot reasonably answer it. There
1409 * might be DS RRs, but we don't know
1410 * them, and the DNS server won't tell
1411 * them to us (and even if it would,
1412 * we couldn't validate and trust them. */
1413 dns_transaction_complete(t, DNS_TRANSACTION_NO_TRUST_ANCHOR);
1414
1415 return 0;
1416 }
1417 }
1418
1419 /* Check the zone, but only if this transaction is not used
1420 * for probing or verifying a zone item. */
1421 if (set_isempty(t->notify_zone_items)) {
1422
1423 r = dns_zone_lookup(&t->scope->zone, t->key, dns_scope_ifindex(t->scope), &t->answer, NULL, NULL);
1424 if (r < 0)
1425 return r;
1426 if (r > 0) {
1427 t->answer_rcode = DNS_RCODE_SUCCESS;
1428 t->answer_source = DNS_TRANSACTION_ZONE;
1429 t->answer_authenticated = true;
1430 dns_transaction_complete(t, DNS_TRANSACTION_SUCCESS);
1431 return 0;
1432 }
1433 }
1434
1435 /* Check the cache, but only if this transaction is not used
1436 * for probing or verifying a zone item. */
1437 if (set_isempty(t->notify_zone_items)) {
1438
1439 /* Before trying the cache, let's make sure we figured out a
1440 * server to use. Should this cause a change of server this
1441 * might flush the cache. */
1442 (void) dns_scope_get_dns_server(t->scope);
1443
1444 /* Let's then prune all outdated entries */
1445 dns_cache_prune(&t->scope->cache);
1446
1447 r = dns_cache_lookup(&t->scope->cache, t->key, t->clamp_ttl, &t->answer_rcode, &t->answer, &t->answer_authenticated);
1448 if (r < 0)
1449 return r;
1450 if (r > 0) {
1451 t->answer_source = DNS_TRANSACTION_CACHE;
1452 if (t->answer_rcode == DNS_RCODE_SUCCESS)
1453 dns_transaction_complete(t, DNS_TRANSACTION_SUCCESS);
1454 else
1455 dns_transaction_complete(t, DNS_TRANSACTION_RCODE_FAILURE);
1456 return 0;
1457 }
1458 }
1459
1460 return 1;
1461 }
1462
1463 static int dns_transaction_make_packet_mdns(DnsTransaction *t) {
1464
1465 _cleanup_(dns_packet_unrefp) DnsPacket *p = NULL;
1466 bool add_known_answers = false;
1467 DnsTransaction *other;
1468 Iterator i;
1469 DnsResourceKey *tkey;
1470 _cleanup_set_free_ Set *keys = NULL;
1471 unsigned qdcount;
1472 unsigned nscount = 0;
1473 usec_t ts;
1474 int r;
1475
1476 assert(t);
1477 assert(t->scope->protocol == DNS_PROTOCOL_MDNS);
1478
1479 /* Discard any previously prepared packet, so we can start over and coalesce again */
1480 t->sent = dns_packet_unref(t->sent);
1481
1482 r = dns_packet_new_query(&p, t->scope->protocol, 0, false);
1483 if (r < 0)
1484 return r;
1485
1486 r = dns_packet_append_key(p, t->key, 0, NULL);
1487 if (r < 0)
1488 return r;
1489
1490 qdcount = 1;
1491
1492 if (dns_key_is_shared(t->key))
1493 add_known_answers = true;
1494
1495 if (t->key->type == DNS_TYPE_ANY) {
1496 r = set_ensure_allocated(&keys, &dns_resource_key_hash_ops);
1497 if (r < 0)
1498 return r;
1499
1500 r = set_put(keys, t->key);
1501 if (r < 0)
1502 return r;
1503 }
1504
1505 /*
1506 * For mDNS, we want to coalesce as many open queries in pending transactions into one single
1507 * query packet on the wire as possible. To achieve that, we iterate through all pending transactions
1508 * in our current scope, and see whether their timing contraints allow them to be sent.
1509 */
1510
1511 assert_se(sd_event_now(t->scope->manager->event, clock_boottime_or_monotonic(), &ts) >= 0);
1512
1513 LIST_FOREACH(transactions_by_scope, other, t->scope->transactions) {
1514
1515 /* Skip ourselves */
1516 if (other == t)
1517 continue;
1518
1519 if (other->state != DNS_TRANSACTION_PENDING)
1520 continue;
1521
1522 if (other->next_attempt_after > ts)
1523 continue;
1524
1525 if (qdcount >= UINT16_MAX)
1526 break;
1527
1528 r = dns_packet_append_key(p, other->key, 0, NULL);
1529
1530 /*
1531 * If we can't stuff more questions into the packet, just give up.
1532 * One of the 'other' transactions will fire later and take care of the rest.
1533 */
1534 if (r == -EMSGSIZE)
1535 break;
1536
1537 if (r < 0)
1538 return r;
1539
1540 r = dns_transaction_prepare(other, ts);
1541 if (r <= 0)
1542 continue;
1543
1544 ts += transaction_get_resend_timeout(other);
1545
1546 r = sd_event_add_time(
1547 other->scope->manager->event,
1548 &other->timeout_event_source,
1549 clock_boottime_or_monotonic(),
1550 ts, 0,
1551 on_transaction_timeout, other);
1552 if (r < 0)
1553 return r;
1554
1555 (void) sd_event_source_set_description(other->timeout_event_source, "dns-transaction-timeout");
1556
1557 other->state = DNS_TRANSACTION_PENDING;
1558 other->next_attempt_after = ts;
1559
1560 qdcount++;
1561
1562 if (dns_key_is_shared(other->key))
1563 add_known_answers = true;
1564
1565 if (other->key->type == DNS_TYPE_ANY) {
1566 r = set_ensure_allocated(&keys, &dns_resource_key_hash_ops);
1567 if (r < 0)
1568 return r;
1569
1570 r = set_put(keys, other->key);
1571 if (r < 0)
1572 return r;
1573 }
1574 }
1575
1576 DNS_PACKET_HEADER(p)->qdcount = htobe16(qdcount);
1577
1578 /* Append known answer section if we're asking for any shared record */
1579 if (add_known_answers) {
1580 r = dns_cache_export_shared_to_packet(&t->scope->cache, p);
1581 if (r < 0)
1582 return r;
1583 }
1584
1585 SET_FOREACH(tkey, keys, i) {
1586 _cleanup_(dns_answer_unrefp) DnsAnswer *answer = NULL;
1587 bool tentative;
1588
1589 r = dns_zone_lookup(&t->scope->zone, tkey, t->scope->link->ifindex, &answer, NULL, &tentative);
1590 if (r < 0)
1591 return r;
1592
1593 r = dns_packet_append_answer(p, answer);
1594 if (r < 0)
1595 return r;
1596
1597 nscount += dns_answer_size(answer);
1598 }
1599 DNS_PACKET_HEADER(p)->nscount = htobe16(nscount);
1600
1601 t->sent = TAKE_PTR(p);
1602
1603 return 0;
1604 }
1605
1606 static int dns_transaction_make_packet(DnsTransaction *t) {
1607 _cleanup_(dns_packet_unrefp) DnsPacket *p = NULL;
1608 int r;
1609
1610 assert(t);
1611
1612 if (t->scope->protocol == DNS_PROTOCOL_MDNS)
1613 return dns_transaction_make_packet_mdns(t);
1614
1615 if (t->sent)
1616 return 0;
1617
1618 r = dns_packet_new_query(&p, t->scope->protocol, 0, t->scope->dnssec_mode != DNSSEC_NO);
1619 if (r < 0)
1620 return r;
1621
1622 r = dns_packet_append_key(p, t->key, 0, NULL);
1623 if (r < 0)
1624 return r;
1625
1626 DNS_PACKET_HEADER(p)->qdcount = htobe16(1);
1627 DNS_PACKET_HEADER(p)->id = t->id;
1628
1629 t->sent = TAKE_PTR(p);
1630
1631 return 0;
1632 }
1633
1634 int dns_transaction_go(DnsTransaction *t) {
1635 usec_t ts;
1636 int r;
1637 char key_str[DNS_RESOURCE_KEY_STRING_MAX];
1638
1639 assert(t);
1640
1641 /* Returns > 0 if the transaction is now pending, returns 0 if could be processed immediately and has finished
1642 * now. */
1643
1644 assert_se(sd_event_now(t->scope->manager->event, clock_boottime_or_monotonic(), &ts) >= 0);
1645
1646 r = dns_transaction_prepare(t, ts);
1647 if (r <= 0)
1648 return r;
1649
1650 log_debug("Transaction %" PRIu16 " for <%s> scope %s on %s/%s.",
1651 t->id,
1652 dns_resource_key_to_string(t->key, key_str, sizeof key_str),
1653 dns_protocol_to_string(t->scope->protocol),
1654 t->scope->link ? t->scope->link->name : "*",
1655 af_to_name_short(t->scope->family));
1656
1657 if (!t->initial_jitter_scheduled &&
1658 IN_SET(t->scope->protocol, DNS_PROTOCOL_LLMNR, DNS_PROTOCOL_MDNS)) {
1659 usec_t jitter, accuracy;
1660
1661 /* RFC 4795 Section 2.7 suggests all queries should be
1662 * delayed by a random time from 0 to JITTER_INTERVAL. */
1663
1664 t->initial_jitter_scheduled = true;
1665
1666 random_bytes(&jitter, sizeof(jitter));
1667
1668 switch (t->scope->protocol) {
1669
1670 case DNS_PROTOCOL_LLMNR:
1671 jitter %= LLMNR_JITTER_INTERVAL_USEC;
1672 accuracy = LLMNR_JITTER_INTERVAL_USEC;
1673 break;
1674
1675 case DNS_PROTOCOL_MDNS:
1676 jitter %= MDNS_JITTER_RANGE_USEC;
1677 jitter += MDNS_JITTER_MIN_USEC;
1678 accuracy = MDNS_JITTER_RANGE_USEC;
1679 break;
1680 default:
1681 assert_not_reached("bad protocol");
1682 }
1683
1684 r = sd_event_add_time(
1685 t->scope->manager->event,
1686 &t->timeout_event_source,
1687 clock_boottime_or_monotonic(),
1688 ts + jitter, accuracy,
1689 on_transaction_timeout, t);
1690 if (r < 0)
1691 return r;
1692
1693 (void) sd_event_source_set_description(t->timeout_event_source, "dns-transaction-timeout");
1694
1695 t->n_attempts = 0;
1696 t->next_attempt_after = ts;
1697 t->state = DNS_TRANSACTION_PENDING;
1698
1699 log_debug("Delaying %s transaction for " USEC_FMT "us.", dns_protocol_to_string(t->scope->protocol), jitter);
1700 return 0;
1701 }
1702
1703 /* Otherwise, we need to ask the network */
1704 r = dns_transaction_make_packet(t);
1705 if (r < 0)
1706 return r;
1707
1708 if (t->scope->protocol == DNS_PROTOCOL_LLMNR &&
1709 (dns_name_endswith(dns_resource_key_name(t->key), "in-addr.arpa") > 0 ||
1710 dns_name_endswith(dns_resource_key_name(t->key), "ip6.arpa") > 0)) {
1711
1712 /* RFC 4795, Section 2.4. says reverse lookups shall
1713 * always be made via TCP on LLMNR */
1714 r = dns_transaction_emit_tcp(t);
1715 } else {
1716 /* Try via UDP, and if that fails due to large size or lack of
1717 * support try via TCP */
1718 r = dns_transaction_emit_udp(t);
1719 if (r == -EMSGSIZE)
1720 log_debug("Sending query via TCP since it is too large.");
1721 else if (r == -EAGAIN)
1722 log_debug("Sending query via TCP since UDP isn't supported.");
1723 if (IN_SET(r, -EMSGSIZE, -EAGAIN))
1724 r = dns_transaction_emit_tcp(t);
1725 }
1726
1727 if (r == -ESRCH) {
1728 /* No servers to send this to? */
1729 dns_transaction_complete(t, DNS_TRANSACTION_NO_SERVERS);
1730 return 0;
1731 }
1732 if (r == -EOPNOTSUPP) {
1733 /* Tried to ask for DNSSEC RRs, on a server that doesn't do DNSSEC */
1734 dns_transaction_complete(t, DNS_TRANSACTION_RR_TYPE_UNSUPPORTED);
1735 return 0;
1736 }
1737 if (t->scope->protocol == DNS_PROTOCOL_LLMNR && ERRNO_IS_DISCONNECT(-r)) {
1738 /* On LLMNR, if we cannot connect to a host via TCP when doing reverse lookups. This means we cannot
1739 * answer this request with this protocol. */
1740 dns_transaction_complete(t, DNS_TRANSACTION_NOT_FOUND);
1741 return 0;
1742 }
1743 if (r < 0) {
1744 if (t->scope->protocol != DNS_PROTOCOL_DNS)
1745 return r;
1746
1747 /* Couldn't send? Try immediately again, with a new server */
1748 dns_scope_next_dns_server(t->scope);
1749
1750 return dns_transaction_go(t);
1751 }
1752
1753 ts += transaction_get_resend_timeout(t);
1754
1755 r = sd_event_add_time(
1756 t->scope->manager->event,
1757 &t->timeout_event_source,
1758 clock_boottime_or_monotonic(),
1759 ts, 0,
1760 on_transaction_timeout, t);
1761 if (r < 0)
1762 return r;
1763
1764 (void) sd_event_source_set_description(t->timeout_event_source, "dns-transaction-timeout");
1765
1766 t->state = DNS_TRANSACTION_PENDING;
1767 t->next_attempt_after = ts;
1768
1769 return 1;
1770 }
1771
1772 static int dns_transaction_find_cyclic(DnsTransaction *t, DnsTransaction *aux) {
1773 DnsTransaction *n;
1774 Iterator i;
1775 int r;
1776
1777 assert(t);
1778 assert(aux);
1779
1780 /* Try to find cyclic dependencies between transaction objects */
1781
1782 if (t == aux)
1783 return 1;
1784
1785 SET_FOREACH(n, aux->dnssec_transactions, i) {
1786 r = dns_transaction_find_cyclic(t, n);
1787 if (r != 0)
1788 return r;
1789 }
1790
1791 return 0;
1792 }
1793
1794 static int dns_transaction_add_dnssec_transaction(DnsTransaction *t, DnsResourceKey *key, DnsTransaction **ret) {
1795 DnsTransaction *aux;
1796 int r;
1797
1798 assert(t);
1799 assert(ret);
1800 assert(key);
1801
1802 aux = dns_scope_find_transaction(t->scope, key, true);
1803 if (!aux) {
1804 r = dns_transaction_new(&aux, t->scope, key);
1805 if (r < 0)
1806 return r;
1807 } else {
1808 if (set_contains(t->dnssec_transactions, aux)) {
1809 *ret = aux;
1810 return 0;
1811 }
1812
1813 r = dns_transaction_find_cyclic(t, aux);
1814 if (r < 0)
1815 return r;
1816 if (r > 0) {
1817 char s[DNS_RESOURCE_KEY_STRING_MAX], saux[DNS_RESOURCE_KEY_STRING_MAX];
1818
1819 return log_debug_errno(SYNTHETIC_ERRNO(ELOOP),
1820 "Potential cyclic dependency, refusing to add transaction %" PRIu16 " (%s) as dependency for %" PRIu16 " (%s).",
1821 aux->id,
1822 dns_resource_key_to_string(t->key, s, sizeof s),
1823 t->id,
1824 dns_resource_key_to_string(aux->key, saux, sizeof saux));
1825 }
1826 }
1827
1828 r = set_ensure_allocated(&t->dnssec_transactions, NULL);
1829 if (r < 0)
1830 goto gc;
1831
1832 r = set_ensure_allocated(&aux->notify_transactions, NULL);
1833 if (r < 0)
1834 goto gc;
1835
1836 r = set_ensure_allocated(&aux->notify_transactions_done, NULL);
1837 if (r < 0)
1838 goto gc;
1839
1840 r = set_put(t->dnssec_transactions, aux);
1841 if (r < 0)
1842 goto gc;
1843
1844 r = set_put(aux->notify_transactions, t);
1845 if (r < 0) {
1846 (void) set_remove(t->dnssec_transactions, aux);
1847 goto gc;
1848 }
1849
1850 *ret = aux;
1851 return 1;
1852
1853 gc:
1854 dns_transaction_gc(aux);
1855 return r;
1856 }
1857
1858 static int dns_transaction_request_dnssec_rr(DnsTransaction *t, DnsResourceKey *key) {
1859 _cleanup_(dns_answer_unrefp) DnsAnswer *a = NULL;
1860 DnsTransaction *aux;
1861 int r;
1862
1863 assert(t);
1864 assert(key);
1865
1866 /* Try to get the data from the trust anchor */
1867 r = dns_trust_anchor_lookup_positive(&t->scope->manager->trust_anchor, key, &a);
1868 if (r < 0)
1869 return r;
1870 if (r > 0) {
1871 r = dns_answer_extend(&t->validated_keys, a);
1872 if (r < 0)
1873 return r;
1874
1875 return 0;
1876 }
1877
1878 /* This didn't work, ask for it via the network/cache then. */
1879 r = dns_transaction_add_dnssec_transaction(t, key, &aux);
1880 if (r == -ELOOP) /* This would result in a cyclic dependency */
1881 return 0;
1882 if (r < 0)
1883 return r;
1884
1885 if (aux->state == DNS_TRANSACTION_NULL) {
1886 r = dns_transaction_go(aux);
1887 if (r < 0)
1888 return r;
1889 }
1890
1891 return 1;
1892 }
1893
1894 static int dns_transaction_negative_trust_anchor_lookup(DnsTransaction *t, const char *name) {
1895 int r;
1896
1897 assert(t);
1898
1899 /* Check whether the specified name is in the NTA
1900 * database, either in the global one, or the link-local
1901 * one. */
1902
1903 r = dns_trust_anchor_lookup_negative(&t->scope->manager->trust_anchor, name);
1904 if (r != 0)
1905 return r;
1906
1907 if (!t->scope->link)
1908 return 0;
1909
1910 return set_contains(t->scope->link->dnssec_negative_trust_anchors, name);
1911 }
1912
1913 static int dns_transaction_has_unsigned_negative_answer(DnsTransaction *t) {
1914 int r;
1915
1916 assert(t);
1917
1918 /* Checks whether the answer is negative, and lacks NSEC/NSEC3
1919 * RRs to prove it */
1920
1921 r = dns_transaction_has_positive_answer(t, NULL);
1922 if (r < 0)
1923 return r;
1924 if (r > 0)
1925 return false;
1926
1927 /* Is this key explicitly listed as a negative trust anchor?
1928 * If so, it's nothing we need to care about */
1929 r = dns_transaction_negative_trust_anchor_lookup(t, dns_resource_key_name(t->key));
1930 if (r < 0)
1931 return r;
1932 if (r > 0)
1933 return false;
1934
1935 /* The answer does not contain any RRs that match to the
1936 * question. If so, let's see if there are any NSEC/NSEC3 RRs
1937 * included. If not, the answer is unsigned. */
1938
1939 r = dns_answer_contains_nsec_or_nsec3(t->answer);
1940 if (r < 0)
1941 return r;
1942 if (r > 0)
1943 return false;
1944
1945 return true;
1946 }
1947
1948 static int dns_transaction_is_primary_response(DnsTransaction *t, DnsResourceRecord *rr) {
1949 int r;
1950
1951 assert(t);
1952 assert(rr);
1953
1954 /* Check if the specified RR is the "primary" response,
1955 * i.e. either matches the question precisely or is a
1956 * CNAME/DNAME for it. */
1957
1958 r = dns_resource_key_match_rr(t->key, rr, NULL);
1959 if (r != 0)
1960 return r;
1961
1962 return dns_resource_key_match_cname_or_dname(t->key, rr->key, NULL);
1963 }
1964
1965 static bool dns_transaction_dnssec_supported(DnsTransaction *t) {
1966 assert(t);
1967
1968 /* Checks whether our transaction's DNS server is assumed to be compatible with DNSSEC. Returns false as soon
1969 * as we changed our mind about a server, and now believe it is incompatible with DNSSEC. */
1970
1971 if (t->scope->protocol != DNS_PROTOCOL_DNS)
1972 return false;
1973
1974 /* If we have picked no server, then we are working from the cache or some other source, and DNSSEC might well
1975 * be supported, hence return true. */
1976 if (!t->server)
1977 return true;
1978
1979 /* Note that we do not check the feature level actually used for the transaction but instead the feature level
1980 * the server is known to support currently, as the transaction feature level might be lower than what the
1981 * server actually supports, since we might have downgraded this transaction's feature level because we got a
1982 * SERVFAIL earlier and wanted to check whether downgrading fixes it. */
1983
1984 return dns_server_dnssec_supported(t->server);
1985 }
1986
1987 static bool dns_transaction_dnssec_supported_full(DnsTransaction *t) {
1988 DnsTransaction *dt;
1989 Iterator i;
1990
1991 assert(t);
1992
1993 /* Checks whether our transaction our any of the auxiliary transactions couldn't do DNSSEC. */
1994
1995 if (!dns_transaction_dnssec_supported(t))
1996 return false;
1997
1998 SET_FOREACH(dt, t->dnssec_transactions, i)
1999 if (!dns_transaction_dnssec_supported(dt))
2000 return false;
2001
2002 return true;
2003 }
2004
2005 int dns_transaction_request_dnssec_keys(DnsTransaction *t) {
2006 DnsResourceRecord *rr;
2007
2008 int r;
2009
2010 assert(t);
2011
2012 /*
2013 * Retrieve all auxiliary RRs for the answer we got, so that
2014 * we can verify signatures or prove that RRs are rightfully
2015 * unsigned. Specifically:
2016 *
2017 * - For RRSIG we get the matching DNSKEY
2018 * - For DNSKEY we get the matching DS
2019 * - For unsigned SOA/NS we get the matching DS
2020 * - For unsigned CNAME/DNAME/DS we get the parent SOA RR
2021 * - For other unsigned RRs we get the matching SOA RR
2022 * - For SOA/NS queries with no matching response RR, and no NSEC/NSEC3, the DS RR
2023 * - For DS queries with no matching response RRs, and no NSEC/NSEC3, the parent's SOA RR
2024 * - For other queries with no matching response RRs, and no NSEC/NSEC3, the SOA RR
2025 */
2026
2027 if (t->scope->dnssec_mode == DNSSEC_NO)
2028 return 0;
2029 if (t->answer_source != DNS_TRANSACTION_NETWORK)
2030 return 0; /* We only need to validate stuff from the network */
2031 if (!dns_transaction_dnssec_supported(t))
2032 return 0; /* If we can't do DNSSEC anyway there's no point in geting the auxiliary RRs */
2033
2034 DNS_ANSWER_FOREACH(rr, t->answer) {
2035
2036 if (dns_type_is_pseudo(rr->key->type))
2037 continue;
2038
2039 /* If this RR is in the negative trust anchor, we don't need to validate it. */
2040 r = dns_transaction_negative_trust_anchor_lookup(t, dns_resource_key_name(rr->key));
2041 if (r < 0)
2042 return r;
2043 if (r > 0)
2044 continue;
2045
2046 switch (rr->key->type) {
2047
2048 case DNS_TYPE_RRSIG: {
2049 /* For each RRSIG we request the matching DNSKEY */
2050 _cleanup_(dns_resource_key_unrefp) DnsResourceKey *dnskey = NULL;
2051
2052 /* If this RRSIG is about a DNSKEY RR and the
2053 * signer is the same as the owner, then we
2054 * already have the DNSKEY, and we don't have
2055 * to look for more. */
2056 if (rr->rrsig.type_covered == DNS_TYPE_DNSKEY) {
2057 r = dns_name_equal(rr->rrsig.signer, dns_resource_key_name(rr->key));
2058 if (r < 0)
2059 return r;
2060 if (r > 0)
2061 continue;
2062 }
2063
2064 /* If the signer is not a parent of our
2065 * original query, then this is about an
2066 * auxiliary RRset, but not anything we asked
2067 * for. In this case we aren't interested,
2068 * because we don't want to request additional
2069 * RRs for stuff we didn't really ask for, and
2070 * also to avoid request loops, where
2071 * additional RRs from one transaction result
2072 * in another transaction whose additonal RRs
2073 * point back to the original transaction, and
2074 * we deadlock. */
2075 r = dns_name_endswith(dns_resource_key_name(t->key), rr->rrsig.signer);
2076 if (r < 0)
2077 return r;
2078 if (r == 0)
2079 continue;
2080
2081 dnskey = dns_resource_key_new(rr->key->class, DNS_TYPE_DNSKEY, rr->rrsig.signer);
2082 if (!dnskey)
2083 return -ENOMEM;
2084
2085 log_debug("Requesting DNSKEY to validate transaction %" PRIu16" (%s, RRSIG with key tag: %" PRIu16 ").",
2086 t->id, dns_resource_key_name(rr->key), rr->rrsig.key_tag);
2087 r = dns_transaction_request_dnssec_rr(t, dnskey);
2088 if (r < 0)
2089 return r;
2090 break;
2091 }
2092
2093 case DNS_TYPE_DNSKEY: {
2094 /* For each DNSKEY we request the matching DS */
2095 _cleanup_(dns_resource_key_unrefp) DnsResourceKey *ds = NULL;
2096
2097 /* If the DNSKEY we are looking at is not for
2098 * zone we are interested in, nor any of its
2099 * parents, we aren't interested, and don't
2100 * request it. After all, we don't want to end
2101 * up in request loops, and want to keep
2102 * additional traffic down. */
2103
2104 r = dns_name_endswith(dns_resource_key_name(t->key), dns_resource_key_name(rr->key));
2105 if (r < 0)
2106 return r;
2107 if (r == 0)
2108 continue;
2109
2110 ds = dns_resource_key_new(rr->key->class, DNS_TYPE_DS, dns_resource_key_name(rr->key));
2111 if (!ds)
2112 return -ENOMEM;
2113
2114 log_debug("Requesting DS to validate transaction %" PRIu16" (%s, DNSKEY with key tag: %" PRIu16 ").",
2115 t->id, dns_resource_key_name(rr->key), dnssec_keytag(rr, false));
2116 r = dns_transaction_request_dnssec_rr(t, ds);
2117 if (r < 0)
2118 return r;
2119
2120 break;
2121 }
2122
2123 case DNS_TYPE_SOA:
2124 case DNS_TYPE_NS: {
2125 _cleanup_(dns_resource_key_unrefp) DnsResourceKey *ds = NULL;
2126
2127 /* For an unsigned SOA or NS, try to acquire
2128 * the matching DS RR, as we are at a zone cut
2129 * then, and whether a DS exists tells us
2130 * whether the zone is signed. Do so only if
2131 * this RR matches our original question,
2132 * however. */
2133
2134 r = dns_resource_key_match_rr(t->key, rr, NULL);
2135 if (r < 0)
2136 return r;
2137 if (r == 0) {
2138 /* Hmm, so this SOA RR doesn't match our original question. In this case, maybe this is
2139 * a negative reply, and we need the a SOA RR's TTL in order to cache a negative entry?
2140 * If so, we need to validate it, too. */
2141
2142 r = dns_answer_match_key(t->answer, t->key, NULL);
2143 if (r < 0)
2144 return r;
2145 if (r > 0) /* positive reply, we won't need the SOA and hence don't need to validate
2146 * it. */
2147 continue;
2148 }
2149
2150 r = dnssec_has_rrsig(t->answer, rr->key);
2151 if (r < 0)
2152 return r;
2153 if (r > 0)
2154 continue;
2155
2156 ds = dns_resource_key_new(rr->key->class, DNS_TYPE_DS, dns_resource_key_name(rr->key));
2157 if (!ds)
2158 return -ENOMEM;
2159
2160 log_debug("Requesting DS to validate transaction %" PRIu16 " (%s, unsigned SOA/NS RRset).",
2161 t->id, dns_resource_key_name(rr->key));
2162 r = dns_transaction_request_dnssec_rr(t, ds);
2163 if (r < 0)
2164 return r;
2165
2166 break;
2167 }
2168
2169 case DNS_TYPE_DS:
2170 case DNS_TYPE_CNAME:
2171 case DNS_TYPE_DNAME: {
2172 _cleanup_(dns_resource_key_unrefp) DnsResourceKey *soa = NULL;
2173 const char *name;
2174
2175 /* CNAMEs and DNAMEs cannot be located at a
2176 * zone apex, hence ask for the parent SOA for
2177 * unsigned CNAME/DNAME RRs, maybe that's the
2178 * apex. But do all that only if this is
2179 * actually a response to our original
2180 * question.
2181 *
2182 * Similar for DS RRs, which are signed when
2183 * the parent SOA is signed. */
2184
2185 r = dns_transaction_is_primary_response(t, rr);
2186 if (r < 0)
2187 return r;
2188 if (r == 0)
2189 continue;
2190
2191 r = dnssec_has_rrsig(t->answer, rr->key);
2192 if (r < 0)
2193 return r;
2194 if (r > 0)
2195 continue;
2196
2197 r = dns_answer_has_dname_for_cname(t->answer, rr);
2198 if (r < 0)
2199 return r;
2200 if (r > 0)
2201 continue;
2202
2203 name = dns_resource_key_name(rr->key);
2204 r = dns_name_parent(&name);
2205 if (r < 0)
2206 return r;
2207 if (r == 0)
2208 continue;
2209
2210 soa = dns_resource_key_new(rr->key->class, DNS_TYPE_SOA, name);
2211 if (!soa)
2212 return -ENOMEM;
2213
2214 log_debug("Requesting parent SOA to validate transaction %" PRIu16 " (%s, unsigned CNAME/DNAME/DS RRset).",
2215 t->id, dns_resource_key_name(rr->key));
2216 r = dns_transaction_request_dnssec_rr(t, soa);
2217 if (r < 0)
2218 return r;
2219
2220 break;
2221 }
2222
2223 default: {
2224 _cleanup_(dns_resource_key_unrefp) DnsResourceKey *soa = NULL;
2225
2226 /* For other unsigned RRsets (including
2227 * NSEC/NSEC3!), look for proof the zone is
2228 * unsigned, by requesting the SOA RR of the
2229 * zone. However, do so only if they are
2230 * directly relevant to our original
2231 * question. */
2232
2233 r = dns_transaction_is_primary_response(t, rr);
2234 if (r < 0)
2235 return r;
2236 if (r == 0)
2237 continue;
2238
2239 r = dnssec_has_rrsig(t->answer, rr->key);
2240 if (r < 0)
2241 return r;
2242 if (r > 0)
2243 continue;
2244
2245 soa = dns_resource_key_new(rr->key->class, DNS_TYPE_SOA, dns_resource_key_name(rr->key));
2246 if (!soa)
2247 return -ENOMEM;
2248
2249 log_debug("Requesting SOA to validate transaction %" PRIu16 " (%s, unsigned non-SOA/NS RRset <%s>).",
2250 t->id, dns_resource_key_name(rr->key), dns_resource_record_to_string(rr));
2251 r = dns_transaction_request_dnssec_rr(t, soa);
2252 if (r < 0)
2253 return r;
2254 break;
2255 }}
2256 }
2257
2258 /* Above, we requested everything necessary to validate what
2259 * we got. Now, let's request what we need to validate what we
2260 * didn't get... */
2261
2262 r = dns_transaction_has_unsigned_negative_answer(t);
2263 if (r < 0)
2264 return r;
2265 if (r > 0) {
2266 const char *name;
2267 uint16_t type = 0;
2268
2269 name = dns_resource_key_name(t->key);
2270
2271 /* If this was a SOA or NS request, then check if there's a DS RR for the same domain. Note that this
2272 * could also be used as indication that we are not at a zone apex, but in real world setups there are
2273 * too many broken DNS servers (Hello, incapdns.net!) where non-terminal zones return NXDOMAIN even
2274 * though they have further children. If this was a DS request, then it's signed when the parent zone
2275 * is signed, hence ask the parent SOA in that case. If this was any other RR then ask for the SOA RR,
2276 * to see if that is signed. */
2277
2278 if (t->key->type == DNS_TYPE_DS) {
2279 r = dns_name_parent(&name);
2280 if (r > 0) {
2281 type = DNS_TYPE_SOA;
2282 log_debug("Requesting parent SOA to validate transaction %" PRIu16 " (%s, unsigned empty DS response).",
2283 t->id, dns_resource_key_name(t->key));
2284 } else
2285 name = NULL;
2286
2287 } else if (IN_SET(t->key->type, DNS_TYPE_SOA, DNS_TYPE_NS)) {
2288
2289 type = DNS_TYPE_DS;
2290 log_debug("Requesting DS to validate transaction %" PRIu16 " (%s, unsigned empty SOA/NS response).",
2291 t->id, dns_resource_key_name(t->key));
2292
2293 } else {
2294 type = DNS_TYPE_SOA;
2295 log_debug("Requesting SOA to validate transaction %" PRIu16 " (%s, unsigned empty non-SOA/NS/DS response).",
2296 t->id, dns_resource_key_name(t->key));
2297 }
2298
2299 if (name) {
2300 _cleanup_(dns_resource_key_unrefp) DnsResourceKey *soa = NULL;
2301
2302 soa = dns_resource_key_new(t->key->class, type, name);
2303 if (!soa)
2304 return -ENOMEM;
2305
2306 r = dns_transaction_request_dnssec_rr(t, soa);
2307 if (r < 0)
2308 return r;
2309 }
2310 }
2311
2312 return dns_transaction_dnssec_is_live(t);
2313 }
2314
2315 void dns_transaction_notify(DnsTransaction *t, DnsTransaction *source) {
2316 assert(t);
2317 assert(source);
2318
2319 /* Invoked whenever any of our auxiliary DNSSEC transactions completed its work. If the state is still PENDING,
2320 we are still in the loop that adds further DNSSEC transactions, hence don't check if we are ready yet. If
2321 the state is VALIDATING however, we should check if we are complete now. */
2322
2323 if (t->state == DNS_TRANSACTION_VALIDATING)
2324 dns_transaction_process_dnssec(t);
2325 }
2326
2327 static int dns_transaction_validate_dnskey_by_ds(DnsTransaction *t) {
2328 DnsResourceRecord *rr;
2329 int ifindex, r;
2330
2331 assert(t);
2332
2333 /* Add all DNSKEY RRs from the answer that are validated by DS
2334 * RRs from the list of validated keys to the list of
2335 * validated keys. */
2336
2337 DNS_ANSWER_FOREACH_IFINDEX(rr, ifindex, t->answer) {
2338
2339 r = dnssec_verify_dnskey_by_ds_search(rr, t->validated_keys);
2340 if (r < 0)
2341 return r;
2342 if (r == 0)
2343 continue;
2344
2345 /* If so, the DNSKEY is validated too. */
2346 r = dns_answer_add_extend(&t->validated_keys, rr, ifindex, DNS_ANSWER_AUTHENTICATED);
2347 if (r < 0)
2348 return r;
2349 }
2350
2351 return 0;
2352 }
2353
2354 static int dns_transaction_requires_rrsig(DnsTransaction *t, DnsResourceRecord *rr) {
2355 int r;
2356
2357 assert(t);
2358 assert(rr);
2359
2360 /* Checks if the RR we are looking for must be signed with an
2361 * RRSIG. This is used for positive responses. */
2362
2363 if (t->scope->dnssec_mode == DNSSEC_NO)
2364 return false;
2365
2366 if (dns_type_is_pseudo(rr->key->type))
2367 return -EINVAL;
2368
2369 r = dns_transaction_negative_trust_anchor_lookup(t, dns_resource_key_name(rr->key));
2370 if (r < 0)
2371 return r;
2372 if (r > 0)
2373 return false;
2374
2375 switch (rr->key->type) {
2376
2377 case DNS_TYPE_RRSIG:
2378 /* RRSIGs are the signatures themselves, they need no signing. */
2379 return false;
2380
2381 case DNS_TYPE_SOA:
2382 case DNS_TYPE_NS: {
2383 DnsTransaction *dt;
2384 Iterator i;
2385
2386 /* For SOA or NS RRs we look for a matching DS transaction */
2387
2388 SET_FOREACH(dt, t->dnssec_transactions, i) {
2389
2390 if (dt->key->class != rr->key->class)
2391 continue;
2392 if (dt->key->type != DNS_TYPE_DS)
2393 continue;
2394
2395 r = dns_name_equal(dns_resource_key_name(dt->key), dns_resource_key_name(rr->key));
2396 if (r < 0)
2397 return r;
2398 if (r == 0)
2399 continue;
2400
2401 /* We found a DS transactions for the SOA/NS
2402 * RRs we are looking at. If it discovered signed DS
2403 * RRs, then we need to be signed, too. */
2404
2405 if (!dt->answer_authenticated)
2406 return false;
2407
2408 return dns_answer_match_key(dt->answer, dt->key, NULL);
2409 }
2410
2411 /* We found nothing that proves this is safe to leave
2412 * this unauthenticated, hence ask inist on
2413 * authentication. */
2414 return true;
2415 }
2416
2417 case DNS_TYPE_DS:
2418 case DNS_TYPE_CNAME:
2419 case DNS_TYPE_DNAME: {
2420 const char *parent = NULL;
2421 DnsTransaction *dt;
2422 Iterator i;
2423
2424 /*
2425 * CNAME/DNAME RRs cannot be located at a zone apex, hence look directly for the parent SOA.
2426 *
2427 * DS RRs are signed if the parent is signed, hence also look at the parent SOA
2428 */
2429
2430 SET_FOREACH(dt, t->dnssec_transactions, i) {
2431
2432 if (dt->key->class != rr->key->class)
2433 continue;
2434 if (dt->key->type != DNS_TYPE_SOA)
2435 continue;
2436
2437 if (!parent) {
2438 parent = dns_resource_key_name(rr->key);
2439 r = dns_name_parent(&parent);
2440 if (r < 0)
2441 return r;
2442 if (r == 0) {
2443 if (rr->key->type == DNS_TYPE_DS)
2444 return true;
2445
2446 /* A CNAME/DNAME without a parent? That's sooo weird. */
2447 return log_debug_errno(SYNTHETIC_ERRNO(EBADMSG),
2448 "Transaction %" PRIu16 " claims CNAME/DNAME at root. Refusing.", t->id);
2449 }
2450 }
2451
2452 r = dns_name_equal(dns_resource_key_name(dt->key), parent);
2453 if (r < 0)
2454 return r;
2455 if (r == 0)
2456 continue;
2457
2458 return t->answer_authenticated;
2459 }
2460
2461 return true;
2462 }
2463
2464 default: {
2465 DnsTransaction *dt;
2466 Iterator i;
2467
2468 /* Any other kind of RR (including DNSKEY/NSEC/NSEC3). Let's see if our SOA lookup was authenticated */
2469
2470 SET_FOREACH(dt, t->dnssec_transactions, i) {
2471
2472 if (dt->key->class != rr->key->class)
2473 continue;
2474 if (dt->key->type != DNS_TYPE_SOA)
2475 continue;
2476
2477 r = dns_name_equal(dns_resource_key_name(dt->key), dns_resource_key_name(rr->key));
2478 if (r < 0)
2479 return r;
2480 if (r == 0)
2481 continue;
2482
2483 /* We found the transaction that was supposed to find
2484 * the SOA RR for us. It was successful, but found no
2485 * RR for us. This means we are not at a zone cut. In
2486 * this case, we require authentication if the SOA
2487 * lookup was authenticated too. */
2488 return t->answer_authenticated;
2489 }
2490
2491 return true;
2492 }}
2493 }
2494
2495 static int dns_transaction_in_private_tld(DnsTransaction *t, const DnsResourceKey *key) {
2496 DnsTransaction *dt;
2497 const char *tld;
2498 Iterator i;
2499 int r;
2500
2501 /* If DNSSEC downgrade mode is on, checks whether the
2502 * specified RR is one level below a TLD we have proven not to
2503 * exist. In such a case we assume that this is a private
2504 * domain, and permit it.
2505 *
2506 * This detects cases like the Fritz!Box router networks. Each
2507 * Fritz!Box router serves a private "fritz.box" zone, in the
2508 * non-existing TLD "box". Requests for the "fritz.box" domain
2509 * are served by the router itself, while requests for the
2510 * "box" domain will result in NXDOMAIN.
2511 *
2512 * Note that this logic is unable to detect cases where a
2513 * router serves a private DNS zone directly under
2514 * non-existing TLD. In such a case we cannot detect whether
2515 * the TLD is supposed to exist or not, as all requests we
2516 * make for it will be answered by the router's zone, and not
2517 * by the root zone. */
2518
2519 assert(t);
2520
2521 if (t->scope->dnssec_mode != DNSSEC_ALLOW_DOWNGRADE)
2522 return false; /* In strict DNSSEC mode what doesn't exist, doesn't exist */
2523
2524 tld = dns_resource_key_name(key);
2525 r = dns_name_parent(&tld);
2526 if (r < 0)
2527 return r;
2528 if (r == 0)
2529 return false; /* Already the root domain */
2530
2531 if (!dns_name_is_single_label(tld))
2532 return false;
2533
2534 SET_FOREACH(dt, t->dnssec_transactions, i) {
2535
2536 if (dt->key->class != key->class)
2537 continue;
2538
2539 r = dns_name_equal(dns_resource_key_name(dt->key), tld);
2540 if (r < 0)
2541 return r;
2542 if (r == 0)
2543 continue;
2544
2545 /* We found an auxiliary lookup we did for the TLD. If
2546 * that returned with NXDOMAIN, we know the TLD didn't
2547 * exist, and hence this might be a private zone. */
2548
2549 return dt->answer_rcode == DNS_RCODE_NXDOMAIN;
2550 }
2551
2552 return false;
2553 }
2554
2555 static int dns_transaction_requires_nsec(DnsTransaction *t) {
2556 char key_str[DNS_RESOURCE_KEY_STRING_MAX];
2557 DnsTransaction *dt;
2558 const char *name;
2559 uint16_t type = 0;
2560 Iterator i;
2561 int r;
2562
2563 assert(t);
2564
2565 /* Checks if we need to insist on NSEC/NSEC3 RRs for proving
2566 * this negative reply */
2567
2568 if (t->scope->dnssec_mode == DNSSEC_NO)
2569 return false;
2570
2571 if (dns_type_is_pseudo(t->key->type))
2572 return -EINVAL;
2573
2574 r = dns_transaction_negative_trust_anchor_lookup(t, dns_resource_key_name(t->key));
2575 if (r < 0)
2576 return r;
2577 if (r > 0)
2578 return false;
2579
2580 r = dns_transaction_in_private_tld(t, t->key);
2581 if (r < 0)
2582 return r;
2583 if (r > 0) {
2584 /* The lookup is from a TLD that is proven not to
2585 * exist, and we are in downgrade mode, hence ignore
2586 * that fact that we didn't get any NSEC RRs. */
2587
2588 log_info("Detected a negative query %s in a private DNS zone, permitting unsigned response.",
2589 dns_resource_key_to_string(t->key, key_str, sizeof key_str));
2590 return false;
2591 }
2592
2593 name = dns_resource_key_name(t->key);
2594
2595 if (t->key->type == DNS_TYPE_DS) {
2596
2597 /* We got a negative reply for this DS lookup? DS RRs are signed when their parent zone is signed,
2598 * hence check the parent SOA in this case. */
2599
2600 r = dns_name_parent(&name);
2601 if (r < 0)
2602 return r;
2603 if (r == 0)
2604 return true;
2605
2606 type = DNS_TYPE_SOA;
2607
2608 } else if (IN_SET(t->key->type, DNS_TYPE_SOA, DNS_TYPE_NS))
2609 /* We got a negative reply for this SOA/NS lookup? If so, check if there's a DS RR for this */
2610 type = DNS_TYPE_DS;
2611 else
2612 /* For all other negative replies, check for the SOA lookup */
2613 type = DNS_TYPE_SOA;
2614
2615 /* For all other RRs we check the SOA on the same level to see
2616 * if it's signed. */
2617
2618 SET_FOREACH(dt, t->dnssec_transactions, i) {
2619
2620 if (dt->key->class != t->key->class)
2621 continue;
2622 if (dt->key->type != type)
2623 continue;
2624
2625 r = dns_name_equal(dns_resource_key_name(dt->key), name);
2626 if (r < 0)
2627 return r;
2628 if (r == 0)
2629 continue;
2630
2631 return dt->answer_authenticated;
2632 }
2633
2634 /* If in doubt, require NSEC/NSEC3 */
2635 return true;
2636 }
2637
2638 static int dns_transaction_dnskey_authenticated(DnsTransaction *t, DnsResourceRecord *rr) {
2639 DnsResourceRecord *rrsig;
2640 bool found = false;
2641 int r;
2642
2643 /* Checks whether any of the DNSKEYs used for the RRSIGs for
2644 * the specified RRset is authenticated (i.e. has a matching
2645 * DS RR). */
2646
2647 r = dns_transaction_negative_trust_anchor_lookup(t, dns_resource_key_name(rr->key));
2648 if (r < 0)
2649 return r;
2650 if (r > 0)
2651 return false;
2652
2653 DNS_ANSWER_FOREACH(rrsig, t->answer) {
2654 DnsTransaction *dt;
2655 Iterator i;
2656
2657 r = dnssec_key_match_rrsig(rr->key, rrsig);
2658 if (r < 0)
2659 return r;
2660 if (r == 0)
2661 continue;
2662
2663 SET_FOREACH(dt, t->dnssec_transactions, i) {
2664
2665 if (dt->key->class != rr->key->class)
2666 continue;
2667
2668 if (dt->key->type == DNS_TYPE_DNSKEY) {
2669
2670 r = dns_name_equal(dns_resource_key_name(dt->key), rrsig->rrsig.signer);
2671 if (r < 0)
2672 return r;
2673 if (r == 0)
2674 continue;
2675
2676 /* OK, we found an auxiliary DNSKEY
2677 * lookup. If that lookup is
2678 * authenticated, report this. */
2679
2680 if (dt->answer_authenticated)
2681 return true;
2682
2683 found = true;
2684
2685 } else if (dt->key->type == DNS_TYPE_DS) {
2686
2687 r = dns_name_equal(dns_resource_key_name(dt->key), rrsig->rrsig.signer);
2688 if (r < 0)
2689 return r;
2690 if (r == 0)
2691 continue;
2692
2693 /* OK, we found an auxiliary DS
2694 * lookup. If that lookup is
2695 * authenticated and non-zero, we
2696 * won! */
2697
2698 if (!dt->answer_authenticated)
2699 return false;
2700
2701 return dns_answer_match_key(dt->answer, dt->key, NULL);
2702 }
2703 }
2704 }
2705
2706 return found ? false : -ENXIO;
2707 }
2708
2709 static int dns_transaction_known_signed(DnsTransaction *t, DnsResourceRecord *rr) {
2710 assert(t);
2711 assert(rr);
2712
2713 /* We know that the root domain is signed, hence if it appears
2714 * not to be signed, there's a problem with the DNS server */
2715
2716 return rr->key->class == DNS_CLASS_IN &&
2717 dns_name_is_root(dns_resource_key_name(rr->key));
2718 }
2719
2720 static int dns_transaction_check_revoked_trust_anchors(DnsTransaction *t) {
2721 DnsResourceRecord *rr;
2722 int r;
2723
2724 assert(t);
2725
2726 /* Maybe warn the user that we encountered a revoked DNSKEY
2727 * for a key from our trust anchor. Note that we don't care
2728 * whether the DNSKEY can be authenticated or not. It's
2729 * sufficient if it is self-signed. */
2730
2731 DNS_ANSWER_FOREACH(rr, t->answer) {
2732 r = dns_trust_anchor_check_revoked(&t->scope->manager->trust_anchor, rr, t->answer);
2733 if (r < 0)
2734 return r;
2735 }
2736
2737 return 0;
2738 }
2739
2740 static int dns_transaction_invalidate_revoked_keys(DnsTransaction *t) {
2741 bool changed;
2742 int r;
2743
2744 assert(t);
2745
2746 /* Removes all DNSKEY/DS objects from t->validated_keys that
2747 * our trust anchors database considers revoked. */
2748
2749 do {
2750 DnsResourceRecord *rr;
2751
2752 changed = false;
2753
2754 DNS_ANSWER_FOREACH(rr, t->validated_keys) {
2755 r = dns_trust_anchor_is_revoked(&t->scope->manager->trust_anchor, rr);
2756 if (r < 0)
2757 return r;
2758 if (r > 0) {
2759 r = dns_answer_remove_by_rr(&t->validated_keys, rr);
2760 if (r < 0)
2761 return r;
2762
2763 assert(r > 0);
2764 changed = true;
2765 break;
2766 }
2767 }
2768 } while (changed);
2769
2770 return 0;
2771 }
2772
2773 static int dns_transaction_copy_validated(DnsTransaction *t) {
2774 DnsTransaction *dt;
2775 Iterator i;
2776 int r;
2777
2778 assert(t);
2779
2780 /* Copy all validated RRs from the auxiliary DNSSEC transactions into our set of validated RRs */
2781
2782 SET_FOREACH(dt, t->dnssec_transactions, i) {
2783
2784 if (DNS_TRANSACTION_IS_LIVE(dt->state))
2785 continue;
2786
2787 if (!dt->answer_authenticated)
2788 continue;
2789
2790 r = dns_answer_extend(&t->validated_keys, dt->answer);
2791 if (r < 0)
2792 return r;
2793 }
2794
2795 return 0;
2796 }
2797
2798 typedef enum {
2799 DNSSEC_PHASE_DNSKEY, /* Phase #1, only validate DNSKEYs */
2800 DNSSEC_PHASE_NSEC, /* Phase #2, only validate NSEC+NSEC3 */
2801 DNSSEC_PHASE_ALL, /* Phase #3, validate everything else */
2802 } Phase;
2803
2804 static int dnssec_validate_records(
2805 DnsTransaction *t,
2806 Phase phase,
2807 bool *have_nsec,
2808 DnsAnswer **validated) {
2809
2810 DnsResourceRecord *rr;
2811 int r;
2812
2813 /* Returns negative on error, 0 if validation failed, 1 to restart validation, 2 when finished. */
2814
2815 DNS_ANSWER_FOREACH(rr, t->answer) {
2816 DnsResourceRecord *rrsig = NULL;
2817 DnssecResult result;
2818
2819 switch (rr->key->type) {
2820 case DNS_TYPE_RRSIG:
2821 continue;
2822
2823 case DNS_TYPE_DNSKEY:
2824 /* We validate DNSKEYs only in the DNSKEY and ALL phases */
2825 if (phase == DNSSEC_PHASE_NSEC)
2826 continue;
2827 break;
2828
2829 case DNS_TYPE_NSEC:
2830 case DNS_TYPE_NSEC3:
2831 *have_nsec = true;
2832
2833 /* We validate NSEC/NSEC3 only in the NSEC and ALL phases */
2834 if (phase == DNSSEC_PHASE_DNSKEY)
2835 continue;
2836 break;
2837
2838 default:
2839 /* We validate all other RRs only in the ALL phases */
2840 if (phase != DNSSEC_PHASE_ALL)
2841 continue;
2842 }
2843
2844 r = dnssec_verify_rrset_search(t->answer, rr->key, t->validated_keys, USEC_INFINITY, &result, &rrsig);
2845 if (r < 0)
2846 return r;
2847
2848 log_debug("Looking at %s: %s", strna(dns_resource_record_to_string(rr)), dnssec_result_to_string(result));
2849
2850 if (result == DNSSEC_VALIDATED) {
2851
2852 if (rr->key->type == DNS_TYPE_DNSKEY) {
2853 /* If we just validated a DNSKEY RRset, then let's add these keys to
2854 * the set of validated keys for this transaction. */
2855
2856 r = dns_answer_copy_by_key(&t->validated_keys, t->answer, rr->key, DNS_ANSWER_AUTHENTICATED);
2857 if (r < 0)
2858 return r;
2859
2860 /* Some of the DNSKEYs we just added might already have been revoked,
2861 * remove them again in that case. */
2862 r = dns_transaction_invalidate_revoked_keys(t);
2863 if (r < 0)
2864 return r;
2865 }
2866
2867 /* Add the validated RRset to the new list of validated
2868 * RRsets, and remove it from the unvalidated RRsets.
2869 * We mark the RRset as authenticated and cacheable. */
2870 r = dns_answer_move_by_key(validated, &t->answer, rr->key, DNS_ANSWER_AUTHENTICATED|DNS_ANSWER_CACHEABLE);
2871 if (r < 0)
2872 return r;
2873
2874 manager_dnssec_verdict(t->scope->manager, DNSSEC_SECURE, rr->key);
2875
2876 /* Exit the loop, we dropped something from the answer, start from the beginning */
2877 return 1;
2878 }
2879
2880 /* If we haven't read all DNSKEYs yet a negative result of the validation is irrelevant, as
2881 * there might be more DNSKEYs coming. Similar, if we haven't read all NSEC/NSEC3 RRs yet,
2882 * we cannot do positive wildcard proofs yet, as those require the NSEC/NSEC3 RRs. */
2883 if (phase != DNSSEC_PHASE_ALL)
2884 continue;
2885
2886 if (result == DNSSEC_VALIDATED_WILDCARD) {
2887 bool authenticated = false;
2888 const char *source;
2889
2890 /* This RRset validated, but as a wildcard. This means we need
2891 * to prove via NSEC/NSEC3 that no matching non-wildcard RR exists. */
2892
2893 /* First step, determine the source of synthesis */
2894 r = dns_resource_record_source(rrsig, &source);
2895 if (r < 0)
2896 return r;
2897
2898 r = dnssec_test_positive_wildcard(*validated,
2899 dns_resource_key_name(rr->key),
2900 source,
2901 rrsig->rrsig.signer,
2902 &authenticated);
2903
2904 /* Unless the NSEC proof showed that the key really doesn't exist something is off. */
2905 if (r == 0)
2906 result = DNSSEC_INVALID;
2907 else {
2908 r = dns_answer_move_by_key(validated, &t->answer, rr->key,
2909 authenticated ? (DNS_ANSWER_AUTHENTICATED|DNS_ANSWER_CACHEABLE) : 0);
2910 if (r < 0)
2911 return r;
2912
2913 manager_dnssec_verdict(t->scope->manager, authenticated ? DNSSEC_SECURE : DNSSEC_INSECURE, rr->key);
2914
2915 /* Exit the loop, we dropped something from the answer, start from the beginning */
2916 return 1;
2917 }
2918 }
2919
2920 if (result == DNSSEC_NO_SIGNATURE) {
2921 r = dns_transaction_requires_rrsig(t, rr);
2922 if (r < 0)
2923 return r;
2924 if (r == 0) {
2925 /* Data does not require signing. In that case, just copy it over,
2926 * but remember that this is by no means authenticated. */
2927 r = dns_answer_move_by_key(validated, &t->answer, rr->key, 0);
2928 if (r < 0)
2929 return r;
2930
2931 manager_dnssec_verdict(t->scope->manager, DNSSEC_INSECURE, rr->key);
2932 return 1;
2933 }
2934
2935 r = dns_transaction_known_signed(t, rr);
2936 if (r < 0)
2937 return r;
2938 if (r > 0) {
2939 /* This is an RR we know has to be signed. If it isn't this means
2940 * the server is not attaching RRSIGs, hence complain. */
2941
2942 dns_server_packet_rrsig_missing(t->server, t->current_feature_level);
2943
2944 if (t->scope->dnssec_mode == DNSSEC_ALLOW_DOWNGRADE) {
2945
2946 /* Downgrading is OK? If so, just consider the information unsigned */
2947
2948 r = dns_answer_move_by_key(validated, &t->answer, rr->key, 0);
2949 if (r < 0)
2950 return r;
2951
2952 manager_dnssec_verdict(t->scope->manager, DNSSEC_INSECURE, rr->key);
2953 return 1;
2954 }
2955
2956 /* Otherwise, fail */
2957 t->answer_dnssec_result = DNSSEC_INCOMPATIBLE_SERVER;
2958 return 0;
2959 }
2960
2961 r = dns_transaction_in_private_tld(t, rr->key);
2962 if (r < 0)
2963 return r;
2964 if (r > 0) {
2965 char s[DNS_RESOURCE_KEY_STRING_MAX];
2966
2967 /* The data is from a TLD that is proven not to exist, and we are in downgrade
2968 * mode, hence ignore the fact that this was not signed. */
2969
2970 log_info("Detected RRset %s is in a private DNS zone, permitting unsigned RRs.",
2971 dns_resource_key_to_string(rr->key, s, sizeof s));
2972
2973 r = dns_answer_move_by_key(validated, &t->answer, rr->key, 0);
2974 if (r < 0)
2975 return r;
2976
2977 manager_dnssec_verdict(t->scope->manager, DNSSEC_INSECURE, rr->key);
2978 return 1;
2979 }
2980 }
2981
2982 if (IN_SET(result,
2983 DNSSEC_MISSING_KEY,
2984 DNSSEC_SIGNATURE_EXPIRED,
2985 DNSSEC_UNSUPPORTED_ALGORITHM)) {
2986
2987 r = dns_transaction_dnskey_authenticated(t, rr);
2988 if (r < 0 && r != -ENXIO)
2989 return r;
2990 if (r == 0) {
2991 /* The DNSKEY transaction was not authenticated, this means there's
2992 * no DS for this, which means it's OK if no keys are found for this signature. */
2993
2994 r = dns_answer_move_by_key(validated, &t->answer, rr->key, 0);
2995 if (r < 0)
2996 return r;
2997
2998 manager_dnssec_verdict(t->scope->manager, DNSSEC_INSECURE, rr->key);
2999 return 1;
3000 }
3001 }
3002
3003 r = dns_transaction_is_primary_response(t, rr);
3004 if (r < 0)
3005 return r;
3006 if (r > 0) {
3007 /* Look for a matching DNAME for this CNAME */
3008 r = dns_answer_has_dname_for_cname(t->answer, rr);
3009 if (r < 0)
3010 return r;
3011 if (r == 0) {
3012 /* Also look among the stuff we already validated */
3013 r = dns_answer_has_dname_for_cname(*validated, rr);
3014 if (r < 0)
3015 return r;
3016 }
3017
3018 if (r == 0) {
3019 if (IN_SET(result,
3020 DNSSEC_INVALID,
3021 DNSSEC_SIGNATURE_EXPIRED,
3022 DNSSEC_NO_SIGNATURE))
3023 manager_dnssec_verdict(t->scope->manager, DNSSEC_BOGUS, rr->key);
3024 else /* DNSSEC_MISSING_KEY or DNSSEC_UNSUPPORTED_ALGORITHM */
3025 manager_dnssec_verdict(t->scope->manager, DNSSEC_INDETERMINATE, rr->key);
3026
3027 /* This is a primary response to our question, and it failed validation.
3028 * That's fatal. */
3029 t->answer_dnssec_result = result;
3030 return 0;
3031 }
3032
3033 /* This is a primary response, but we do have a DNAME RR
3034 * in the RR that can replay this CNAME, hence rely on
3035 * that, and we can remove the CNAME in favour of it. */
3036 }
3037
3038 /* This is just some auxiliary data. Just remove the RRset and continue. */
3039 r = dns_answer_remove_by_key(&t->answer, rr->key);
3040 if (r < 0)
3041 return r;
3042
3043 /* We dropped something from the answer, start from the beginning. */
3044 return 1;
3045 }
3046
3047 return 2; /* Finito. */
3048 }
3049
3050 int dns_transaction_validate_dnssec(DnsTransaction *t) {
3051 _cleanup_(dns_answer_unrefp) DnsAnswer *validated = NULL;
3052 Phase phase;
3053 DnsAnswerFlags flags;
3054 int r;
3055 char key_str[DNS_RESOURCE_KEY_STRING_MAX];
3056
3057 assert(t);
3058
3059 /* We have now collected all DS and DNSKEY RRs in
3060 * t->validated_keys, let's see which RRs we can now
3061 * authenticate with that. */
3062
3063 if (t->scope->dnssec_mode == DNSSEC_NO)
3064 return 0;
3065
3066 /* Already validated */
3067 if (t->answer_dnssec_result != _DNSSEC_RESULT_INVALID)
3068 return 0;
3069
3070 /* Our own stuff needs no validation */
3071 if (IN_SET(t->answer_source, DNS_TRANSACTION_ZONE, DNS_TRANSACTION_TRUST_ANCHOR)) {
3072 t->answer_dnssec_result = DNSSEC_VALIDATED;
3073 t->answer_authenticated = true;
3074 return 0;
3075 }
3076
3077 /* Cached stuff is not affected by validation. */
3078 if (t->answer_source != DNS_TRANSACTION_NETWORK)
3079 return 0;
3080
3081 if (!dns_transaction_dnssec_supported_full(t)) {
3082 /* The server does not support DNSSEC, or doesn't augment responses with RRSIGs. */
3083 t->answer_dnssec_result = DNSSEC_INCOMPATIBLE_SERVER;
3084 log_debug("Not validating response for %" PRIu16 ", used server feature level does not support DNSSEC.", t->id);
3085 return 0;
3086 }
3087
3088 log_debug("Validating response from transaction %" PRIu16 " (%s).",
3089 t->id,
3090 dns_resource_key_to_string(t->key, key_str, sizeof key_str));
3091
3092 /* First, see if this response contains any revoked trust
3093 * anchors we care about */
3094 r = dns_transaction_check_revoked_trust_anchors(t);
3095 if (r < 0)
3096 return r;
3097
3098 /* Third, copy all RRs we acquired successfully from auxiliary RRs over. */
3099 r = dns_transaction_copy_validated(t);
3100 if (r < 0)
3101 return r;
3102
3103 /* Second, see if there are DNSKEYs we already know a
3104 * validated DS for. */
3105 r = dns_transaction_validate_dnskey_by_ds(t);
3106 if (r < 0)
3107 return r;
3108
3109 /* Fourth, remove all DNSKEY and DS RRs again that our trust
3110 * anchor says are revoked. After all we might have marked
3111 * some keys revoked above, but they might still be lingering
3112 * in our validated_keys list. */
3113 r = dns_transaction_invalidate_revoked_keys(t);
3114 if (r < 0)
3115 return r;
3116
3117 phase = DNSSEC_PHASE_DNSKEY;
3118 for (;;) {
3119 bool have_nsec = false;
3120
3121 r = dnssec_validate_records(t, phase, &have_nsec, &validated);
3122 if (r <= 0)
3123 return r;
3124
3125 /* Try again as long as we managed to achieve something */
3126 if (r == 1)
3127 continue;
3128
3129 if (phase == DNSSEC_PHASE_DNSKEY && have_nsec) {
3130 /* OK, we processed all DNSKEYs, and there are NSEC/NSEC3 RRs, look at those now. */
3131 phase = DNSSEC_PHASE_NSEC;
3132 continue;
3133 }
3134
3135 if (phase != DNSSEC_PHASE_ALL) {
3136 /* OK, we processed all DNSKEYs and NSEC/NSEC3 RRs, look at all the rest now.
3137 * Note that in this third phase we start to remove RRs we couldn't validate. */
3138 phase = DNSSEC_PHASE_ALL;
3139 continue;
3140 }
3141
3142 /* We're done */
3143 break;
3144 }
3145
3146 dns_answer_unref(t->answer);
3147 t->answer = TAKE_PTR(validated);
3148
3149 /* At this point the answer only contains validated
3150 * RRsets. Now, let's see if it actually answers the question
3151 * we asked. If so, great! If it doesn't, then see if
3152 * NSEC/NSEC3 can prove this. */
3153 r = dns_transaction_has_positive_answer(t, &flags);
3154 if (r > 0) {
3155 /* Yes, it answers the question! */
3156
3157 if (flags & DNS_ANSWER_AUTHENTICATED) {
3158 /* The answer is fully authenticated, yay. */
3159 t->answer_dnssec_result = DNSSEC_VALIDATED;
3160 t->answer_rcode = DNS_RCODE_SUCCESS;
3161 t->answer_authenticated = true;
3162 } else {
3163 /* The answer is not fully authenticated. */
3164 t->answer_dnssec_result = DNSSEC_UNSIGNED;
3165 t->answer_authenticated = false;
3166 }
3167
3168 } else if (r == 0) {
3169 DnssecNsecResult nr;
3170 bool authenticated = false;
3171
3172 /* Bummer! Let's check NSEC/NSEC3 */
3173 r = dnssec_nsec_test(t->answer, t->key, &nr, &authenticated, &t->answer_nsec_ttl);
3174 if (r < 0)
3175 return r;
3176
3177 switch (nr) {
3178
3179 case DNSSEC_NSEC_NXDOMAIN:
3180 /* NSEC proves the domain doesn't exist. Very good. */
3181 log_debug("Proved NXDOMAIN via NSEC/NSEC3 for transaction %u (%s)", t->id, key_str);
3182 t->answer_dnssec_result = DNSSEC_VALIDATED;
3183 t->answer_rcode = DNS_RCODE_NXDOMAIN;
3184 t->answer_authenticated = authenticated;
3185
3186 manager_dnssec_verdict(t->scope->manager, authenticated ? DNSSEC_SECURE : DNSSEC_INSECURE, t->key);
3187 break;
3188
3189 case DNSSEC_NSEC_NODATA:
3190 /* NSEC proves that there's no data here, very good. */
3191 log_debug("Proved NODATA via NSEC/NSEC3 for transaction %u (%s)", t->id, key_str);
3192 t->answer_dnssec_result = DNSSEC_VALIDATED;
3193 t->answer_rcode = DNS_RCODE_SUCCESS;
3194 t->answer_authenticated = authenticated;
3195
3196 manager_dnssec_verdict(t->scope->manager, authenticated ? DNSSEC_SECURE : DNSSEC_INSECURE, t->key);
3197 break;
3198
3199 case DNSSEC_NSEC_OPTOUT:
3200 /* NSEC3 says the data might not be signed */
3201 log_debug("Data is NSEC3 opt-out via NSEC/NSEC3 for transaction %u (%s)", t->id, key_str);
3202 t->answer_dnssec_result = DNSSEC_UNSIGNED;
3203 t->answer_authenticated = false;
3204
3205 manager_dnssec_verdict(t->scope->manager, DNSSEC_INSECURE, t->key);
3206 break;
3207
3208 case DNSSEC_NSEC_NO_RR:
3209 /* No NSEC data? Bummer! */
3210
3211 r = dns_transaction_requires_nsec(t);
3212 if (r < 0)
3213 return r;
3214 if (r > 0) {
3215 t->answer_dnssec_result = DNSSEC_NO_SIGNATURE;
3216 manager_dnssec_verdict(t->scope->manager, DNSSEC_BOGUS, t->key);
3217 } else {
3218 t->answer_dnssec_result = DNSSEC_UNSIGNED;
3219 t->answer_authenticated = false;
3220 manager_dnssec_verdict(t->scope->manager, DNSSEC_INSECURE, t->key);
3221 }
3222
3223 break;
3224
3225 case DNSSEC_NSEC_UNSUPPORTED_ALGORITHM:
3226 /* We don't know the NSEC3 algorithm used? */
3227 t->answer_dnssec_result = DNSSEC_UNSUPPORTED_ALGORITHM;
3228 manager_dnssec_verdict(t->scope->manager, DNSSEC_INDETERMINATE, t->key);
3229 break;
3230
3231 case DNSSEC_NSEC_FOUND:
3232 case DNSSEC_NSEC_CNAME:
3233 /* NSEC says it needs to be there, but we couldn't find it? Bummer! */
3234 t->answer_dnssec_result = DNSSEC_NSEC_MISMATCH;
3235 manager_dnssec_verdict(t->scope->manager, DNSSEC_BOGUS, t->key);
3236 break;
3237
3238 default:
3239 assert_not_reached("Unexpected NSEC result.");
3240 }
3241 }
3242
3243 return 1;
3244 }
3245
3246 static const char* const dns_transaction_state_table[_DNS_TRANSACTION_STATE_MAX] = {
3247 [DNS_TRANSACTION_NULL] = "null",
3248 [DNS_TRANSACTION_PENDING] = "pending",
3249 [DNS_TRANSACTION_VALIDATING] = "validating",
3250 [DNS_TRANSACTION_RCODE_FAILURE] = "rcode-failure",
3251 [DNS_TRANSACTION_SUCCESS] = "success",
3252 [DNS_TRANSACTION_NO_SERVERS] = "no-servers",
3253 [DNS_TRANSACTION_TIMEOUT] = "timeout",
3254 [DNS_TRANSACTION_ATTEMPTS_MAX_REACHED] = "attempts-max-reached",
3255 [DNS_TRANSACTION_INVALID_REPLY] = "invalid-reply",
3256 [DNS_TRANSACTION_ERRNO] = "errno",
3257 [DNS_TRANSACTION_ABORTED] = "aborted",
3258 [DNS_TRANSACTION_DNSSEC_FAILED] = "dnssec-failed",
3259 [DNS_TRANSACTION_NO_TRUST_ANCHOR] = "no-trust-anchor",
3260 [DNS_TRANSACTION_RR_TYPE_UNSUPPORTED] = "rr-type-unsupported",
3261 [DNS_TRANSACTION_NETWORK_DOWN] = "network-down",
3262 [DNS_TRANSACTION_NOT_FOUND] = "not-found",
3263 };
3264 DEFINE_STRING_TABLE_LOOKUP(dns_transaction_state, DnsTransactionState);
3265
3266 static const char* const dns_transaction_source_table[_DNS_TRANSACTION_SOURCE_MAX] = {
3267 [DNS_TRANSACTION_NETWORK] = "network",
3268 [DNS_TRANSACTION_CACHE] = "cache",
3269 [DNS_TRANSACTION_ZONE] = "zone",
3270 [DNS_TRANSACTION_TRUST_ANCHOR] = "trust-anchor",
3271 };
3272 DEFINE_STRING_TABLE_LOOKUP(dns_transaction_source, DnsTransactionSource);
Unnamed repository; edit this file 'description' to name the repository.