]> git.ipfire.org Git - thirdparty/systemd.git/blob - src/resolve/resolved-dns-transaction.c
projects / thirdparty / systemd.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
resolved: before assuming we have a server, check we are talking DNS and not LLMNR...
[thirdparty/systemd.git] / src / resolve / resolved-dns-transaction.c
1 /* SPDX-License-Identifier: LGPL-2.1+ */
2
3 #include "sd-messages.h"
4
5 #include "af-list.h"
6 #include "alloc-util.h"
7 #include "dns-domain.h"
8 #include "errno-list.h"
9 #include "fd-util.h"
10 #include "random-util.h"
11 #include "resolved-dns-cache.h"
12 #include "resolved-dns-transaction.h"
13 #include "resolved-llmnr.h"
14 #if ENABLE_DNS_OVER_TLS
15 #include "resolved-dnstls.h"
16 #endif
17 #include "string-table.h"
18
19 #define TRANSACTIONS_MAX 4096
20 #define TRANSACTION_TCP_TIMEOUT_USEC (10U*USEC_PER_SEC)
21
22 /* After how much time to repeat classic DNS requests */
23 #define DNS_TIMEOUT_USEC (SD_RESOLVED_QUERY_TIMEOUT_USEC / DNS_TRANSACTION_ATTEMPTS_MAX)
24
25 static void dns_transaction_reset_answer(DnsTransaction *t) {
26 assert(t);
27
28 t->received = dns_packet_unref(t->received);
29 t->answer = dns_answer_unref(t->answer);
30 t->answer_rcode = 0;
31 t->answer_dnssec_result = _DNSSEC_RESULT_INVALID;
32 t->answer_source = _DNS_TRANSACTION_SOURCE_INVALID;
33 t->answer_authenticated = false;
34 t->answer_nsec_ttl = (uint32_t) -1;
35 t->answer_errno = 0;
36 }
37
38 static void dns_transaction_flush_dnssec_transactions(DnsTransaction *t) {
39 DnsTransaction *z;
40
41 assert(t);
42
43 while ((z = set_steal_first(t->dnssec_transactions))) {
44 set_remove(z->notify_transactions, t);
45 set_remove(z->notify_transactions_done, t);
46 dns_transaction_gc(z);
47 }
48 }
49
50 static void dns_transaction_close_connection(DnsTransaction *t) {
51 assert(t);
52
53 if (t->stream) {
54 /* Let's detach the stream from our transaction, in case something else keeps a reference to it. */
55 LIST_REMOVE(transactions_by_stream, t->stream->transactions, t);
56
57 /* Remove packet in case it's still in the queue */
58 dns_packet_unref(ordered_set_remove(t->stream->write_queue, t->sent));
59
60 t->stream = dns_stream_unref(t->stream);
61 }
62
63 t->dns_udp_event_source = sd_event_source_unref(t->dns_udp_event_source);
64 t->dns_udp_fd = safe_close(t->dns_udp_fd);
65 }
66
67 static void dns_transaction_stop_timeout(DnsTransaction *t) {
68 assert(t);
69
70 t->timeout_event_source = sd_event_source_unref(t->timeout_event_source);
71 }
72
73 DnsTransaction* dns_transaction_free(DnsTransaction *t) {
74 DnsQueryCandidate *c;
75 DnsZoneItem *i;
76 DnsTransaction *z;
77
78 if (!t)
79 return NULL;
80
81 log_debug("Freeing transaction %" PRIu16 ".", t->id);
82
83 dns_transaction_close_connection(t);
84 dns_transaction_stop_timeout(t);
85
86 dns_packet_unref(t->sent);
87 dns_transaction_reset_answer(t);
88
89 dns_server_unref(t->server);
90
91 if (t->scope) {
92 hashmap_remove_value(t->scope->transactions_by_key, t->key, t);
93 LIST_REMOVE(transactions_by_scope, t->scope->transactions, t);
94
95 if (t->id != 0)
96 hashmap_remove(t->scope->manager->dns_transactions, UINT_TO_PTR(t->id));
97 }
98
99 while ((c = set_steal_first(t->notify_query_candidates)))
100 set_remove(c->transactions, t);
101 set_free(t->notify_query_candidates);
102
103 while ((c = set_steal_first(t->notify_query_candidates_done)))
104 set_remove(c->transactions, t);
105 set_free(t->notify_query_candidates_done);
106
107 while ((i = set_steal_first(t->notify_zone_items)))
108 i->probe_transaction = NULL;
109 set_free(t->notify_zone_items);
110
111 while ((i = set_steal_first(t->notify_zone_items_done)))
112 i->probe_transaction = NULL;
113 set_free(t->notify_zone_items_done);
114
115 while ((z = set_steal_first(t->notify_transactions)))
116 set_remove(z->dnssec_transactions, t);
117 set_free(t->notify_transactions);
118
119 while ((z = set_steal_first(t->notify_transactions_done)))
120 set_remove(z->dnssec_transactions, t);
121 set_free(t->notify_transactions_done);
122
123 dns_transaction_flush_dnssec_transactions(t);
124 set_free(t->dnssec_transactions);
125
126 dns_answer_unref(t->validated_keys);
127 dns_resource_key_unref(t->key);
128
129 return mfree(t);
130 }
131
132 DEFINE_TRIVIAL_CLEANUP_FUNC(DnsTransaction*, dns_transaction_free);
133
134 bool dns_transaction_gc(DnsTransaction *t) {
135 assert(t);
136
137 if (t->block_gc > 0)
138 return true;
139
140 if (set_isempty(t->notify_query_candidates) &&
141 set_isempty(t->notify_query_candidates_done) &&
142 set_isempty(t->notify_zone_items) &&
143 set_isempty(t->notify_zone_items_done) &&
144 set_isempty(t->notify_transactions) &&
145 set_isempty(t->notify_transactions_done)) {
146 dns_transaction_free(t);
147 return false;
148 }
149
150 return true;
151 }
152
153 static uint16_t pick_new_id(Manager *m) {
154 uint16_t new_id;
155
156 /* Find a fresh, unused transaction id. Note that this loop is bounded because there's a limit on the number of
157 * transactions, and it's much lower than the space of IDs. */
158
159 assert_cc(TRANSACTIONS_MAX < 0xFFFF);
160
161 do
162 random_bytes(&new_id, sizeof(new_id));
163 while (new_id == 0 ||
164 hashmap_get(m->dns_transactions, UINT_TO_PTR(new_id)));
165
166 return new_id;
167 }
168
169 int dns_transaction_new(DnsTransaction **ret, DnsScope *s, DnsResourceKey *key) {
170 _cleanup_(dns_transaction_freep) DnsTransaction *t = NULL;
171 int r;
172
173 assert(ret);
174 assert(s);
175 assert(key);
176
177 /* Don't allow looking up invalid or pseudo RRs */
178 if (!dns_type_is_valid_query(key->type))
179 return -EINVAL;
180 if (dns_type_is_obsolete(key->type))
181 return -EOPNOTSUPP;
182
183 /* We only support the IN class */
184 if (!IN_SET(key->class, DNS_CLASS_IN, DNS_CLASS_ANY))
185 return -EOPNOTSUPP;
186
187 if (hashmap_size(s->manager->dns_transactions) >= TRANSACTIONS_MAX)
188 return -EBUSY;
189
190 r = hashmap_ensure_allocated(&s->manager->dns_transactions, NULL);
191 if (r < 0)
192 return r;
193
194 r = hashmap_ensure_allocated(&s->transactions_by_key, &dns_resource_key_hash_ops);
195 if (r < 0)
196 return r;
197
198 t = new0(DnsTransaction, 1);
199 if (!t)
200 return -ENOMEM;
201
202 t->dns_udp_fd = -1;
203 t->answer_source = _DNS_TRANSACTION_SOURCE_INVALID;
204 t->answer_dnssec_result = _DNSSEC_RESULT_INVALID;
205 t->answer_nsec_ttl = (uint32_t) -1;
206 t->key = dns_resource_key_ref(key);
207 t->current_feature_level = _DNS_SERVER_FEATURE_LEVEL_INVALID;
208 t->clamp_feature_level = _DNS_SERVER_FEATURE_LEVEL_INVALID;
209
210 t->id = pick_new_id(s->manager);
211
212 r = hashmap_put(s->manager->dns_transactions, UINT_TO_PTR(t->id), t);
213 if (r < 0) {
214 t->id = 0;
215 return r;
216 }
217
218 r = hashmap_replace(s->transactions_by_key, t->key, t);
219 if (r < 0) {
220 hashmap_remove(s->manager->dns_transactions, UINT_TO_PTR(t->id));
221 return r;
222 }
223
224 LIST_PREPEND(transactions_by_scope, s->transactions, t);
225 t->scope = s;
226
227 s->manager->n_transactions_total++;
228
229 if (ret)
230 *ret = t;
231
232 t = NULL;
233
234 return 0;
235 }
236
237 static void dns_transaction_shuffle_id(DnsTransaction *t) {
238 uint16_t new_id;
239 assert(t);
240
241 /* Pick a new ID for this transaction. */
242
243 new_id = pick_new_id(t->scope->manager);
244 assert_se(hashmap_remove_and_put(t->scope->manager->dns_transactions, UINT_TO_PTR(t->id), UINT_TO_PTR(new_id), t) >= 0);
245
246 log_debug("Transaction %" PRIu16 " is now %" PRIu16 ".", t->id, new_id);
247 t->id = new_id;
248
249 /* Make sure we generate a new packet with the new ID */
250 t->sent = dns_packet_unref(t->sent);
251 }
252
253 static void dns_transaction_tentative(DnsTransaction *t, DnsPacket *p) {
254 _cleanup_free_ char *pretty = NULL;
255 char key_str[DNS_RESOURCE_KEY_STRING_MAX];
256 DnsZoneItem *z;
257
258 assert(t);
259 assert(p);
260
261 if (manager_our_packet(t->scope->manager, p) != 0)
262 return;
263
264 (void) in_addr_to_string(p->family, &p->sender, &pretty);
265
266 log_debug("Transaction %" PRIu16 " for <%s> on scope %s on %s/%s got tentative packet from %s.",
267 t->id,
268 dns_resource_key_to_string(t->key, key_str, sizeof key_str),
269 dns_protocol_to_string(t->scope->protocol),
270 t->scope->link ? t->scope->link->name : "*",
271 af_to_name_short(t->scope->family),
272 strnull(pretty));
273
274 /* RFC 4795, Section 4.1 says that the peer with the
275 * lexicographically smaller IP address loses */
276 if (memcmp(&p->sender, &p->destination, FAMILY_ADDRESS_SIZE(p->family)) >= 0) {
277 log_debug("Peer has lexicographically larger IP address and thus lost in the conflict.");
278 return;
279 }
280
281 log_debug("We have the lexicographically larger IP address and thus lost in the conflict.");
282
283 t->block_gc++;
284
285 while ((z = set_first(t->notify_zone_items))) {
286 /* First, make sure the zone item drops the reference
287 * to us */
288 dns_zone_item_probe_stop(z);
289
290 /* Secondly, report this as conflict, so that we might
291 * look for a different hostname */
292 dns_zone_item_conflict(z);
293 }
294 t->block_gc--;
295
296 dns_transaction_gc(t);
297 }
298
299 void dns_transaction_complete(DnsTransaction *t, DnsTransactionState state) {
300 DnsQueryCandidate *c;
301 DnsZoneItem *z;
302 DnsTransaction *d;
303 const char *st;
304 char key_str[DNS_RESOURCE_KEY_STRING_MAX];
305
306 assert(t);
307 assert(!DNS_TRANSACTION_IS_LIVE(state));
308
309 if (state == DNS_TRANSACTION_DNSSEC_FAILED) {
310 dns_resource_key_to_string(t->key, key_str, sizeof key_str);
311
312 log_struct(LOG_NOTICE,
313 "MESSAGE_ID=" SD_MESSAGE_DNSSEC_FAILURE_STR,
314 LOG_MESSAGE("DNSSEC validation failed for question %s: %s", key_str, dnssec_result_to_string(t->answer_dnssec_result)),
315 "DNS_TRANSACTION=%" PRIu16, t->id,
316 "DNS_QUESTION=%s", key_str,
317 "DNSSEC_RESULT=%s", dnssec_result_to_string(t->answer_dnssec_result),
318 "DNS_SERVER=%s", dns_server_string(t->server),
319 "DNS_SERVER_FEATURE_LEVEL=%s", dns_server_feature_level_to_string(t->server->possible_feature_level));
320 }
321
322 /* Note that this call might invalidate the query. Callers
323 * should hence not attempt to access the query or transaction
324 * after calling this function. */
325
326 if (state == DNS_TRANSACTION_ERRNO)
327 st = errno_to_name(t->answer_errno);
328 else
329 st = dns_transaction_state_to_string(state);
330
331 log_debug("Transaction %" PRIu16 " for <%s> on scope %s on %s/%s now complete with <%s> from %s (%s).",
332 t->id,
333 dns_resource_key_to_string(t->key, key_str, sizeof key_str),
334 dns_protocol_to_string(t->scope->protocol),
335 t->scope->link ? t->scope->link->name : "*",
336 af_to_name_short(t->scope->family),
337 st,
338 t->answer_source < 0 ? "none" : dns_transaction_source_to_string(t->answer_source),
339 t->answer_authenticated ? "authenticated" : "unsigned");
340
341 t->state = state;
342
343 dns_transaction_close_connection(t);
344 dns_transaction_stop_timeout(t);
345
346 /* Notify all queries that are interested, but make sure the
347 * transaction isn't freed while we are still looking at it */
348 t->block_gc++;
349
350 SET_FOREACH_MOVE(c, t->notify_query_candidates_done, t->notify_query_candidates)
351 dns_query_candidate_notify(c);
352 SWAP_TWO(t->notify_query_candidates, t->notify_query_candidates_done);
353
354 SET_FOREACH_MOVE(z, t->notify_zone_items_done, t->notify_zone_items)
355 dns_zone_item_notify(z);
356 SWAP_TWO(t->notify_zone_items, t->notify_zone_items_done);
357 if (t->probing && t->state == DNS_TRANSACTION_ATTEMPTS_MAX_REACHED)
358 (void) dns_scope_announce(t->scope, false);
359
360 SET_FOREACH_MOVE(d, t->notify_transactions_done, t->notify_transactions)
361 dns_transaction_notify(d, t);
362 SWAP_TWO(t->notify_transactions, t->notify_transactions_done);
363
364 t->block_gc--;
365 dns_transaction_gc(t);
366 }
367
368 static int dns_transaction_pick_server(DnsTransaction *t) {
369 DnsServer *server;
370
371 assert(t);
372 assert(t->scope->protocol == DNS_PROTOCOL_DNS);
373
374 /* Pick a DNS server and a feature level for it. */
375
376 server = dns_scope_get_dns_server(t->scope);
377 if (!server)
378 return -ESRCH;
379
380 /* If we changed the server invalidate the feature level clamping, as the new server might have completely
381 * different properties. */
382 if (server != t->server)
383 t->clamp_feature_level = _DNS_SERVER_FEATURE_LEVEL_INVALID;
384
385 t->current_feature_level = dns_server_possible_feature_level(server);
386
387 /* Clamp the feature level if that is requested. */
388 if (t->clamp_feature_level != _DNS_SERVER_FEATURE_LEVEL_INVALID &&
389 t->current_feature_level > t->clamp_feature_level)
390 t->current_feature_level = t->clamp_feature_level;
391
392 log_debug("Using feature level %s for transaction %u.", dns_server_feature_level_to_string(t->current_feature_level), t->id);
393
394 if (server == t->server)
395 return 0;
396
397 dns_server_unref(t->server);
398 t->server = dns_server_ref(server);
399
400 t->n_picked_servers ++;
401
402 log_debug("Using DNS server %s for transaction %u.", dns_server_string(t->server), t->id);
403
404 return 1;
405 }
406
407 static void dns_transaction_retry(DnsTransaction *t, bool next_server) {
408 int r;
409
410 assert(t);
411
412 log_debug("Retrying transaction %" PRIu16 ".", t->id);
413
414 /* Before we try again, switch to a new server. */
415 if (next_server)
416 dns_scope_next_dns_server(t->scope);
417
418 r = dns_transaction_go(t);
419 if (r < 0) {
420 t->answer_errno = -r;
421 dns_transaction_complete(t, DNS_TRANSACTION_ERRNO);
422 }
423 }
424
425 static int dns_transaction_maybe_restart(DnsTransaction *t) {
426 int r;
427
428 assert(t);
429
430 /* Returns > 0 if the transaction was restarted, 0 if not */
431
432 if (!t->server)
433 return 0;
434
435 if (t->current_feature_level <= dns_server_possible_feature_level(t->server))
436 return 0;
437
438 /* The server's current feature level is lower than when we sent the original query. We learnt something from
439 the response or possibly an auxiliary DNSSEC response that we didn't know before. We take that as reason to
440 restart the whole transaction. This is a good idea to deal with servers that respond rubbish if we include
441 OPT RR or DO bit. One of these cases is documented here, for example:
442 https://open.nlnetlabs.nl/pipermail/dnssec-trigger/2014-November/000376.html */
443
444 log_debug("Server feature level is now lower than when we began our transaction. Restarting with new ID.");
445 dns_transaction_shuffle_id(t);
446
447 r = dns_transaction_go(t);
448 if (r < 0)
449 return r;
450
451 return 1;
452 }
453
454 static void on_transaction_stream_error(DnsTransaction *t, int error) {
455 assert(t);
456
457 dns_transaction_close_connection(t);
458
459 if (ERRNO_IS_DISCONNECT(error)) {
460 if (t->scope->protocol == DNS_PROTOCOL_LLMNR) {
461 /* If the LLMNR/TCP connection failed, the host doesn't support LLMNR, and we cannot answer the
462 * question on this scope. */
463 dns_transaction_complete(t, DNS_TRANSACTION_NOT_FOUND);
464 return;
465 }
466
467 dns_transaction_retry(t, true);
468 return;
469 }
470 if (error != 0) {
471 t->answer_errno = error;
472 dns_transaction_complete(t, DNS_TRANSACTION_ERRNO);
473 }
474 }
475
476 static int dns_transaction_on_stream_packet(DnsTransaction *t, DnsPacket *p) {
477 assert(t);
478 assert(p);
479
480 dns_transaction_close_connection(t);
481
482 if (dns_packet_validate_reply(p) <= 0) {
483 log_debug("Invalid TCP reply packet.");
484 dns_transaction_complete(t, DNS_TRANSACTION_INVALID_REPLY);
485 return 0;
486 }
487
488 dns_scope_check_conflicts(t->scope, p);
489
490 t->block_gc++;
491 dns_transaction_process_reply(t, p);
492 t->block_gc--;
493
494 /* If the response wasn't useful, then complete the transition
495 * now. After all, we are the worst feature set now with TCP
496 * sockets, and there's really no point in retrying. */
497 if (t->state == DNS_TRANSACTION_PENDING)
498 dns_transaction_complete(t, DNS_TRANSACTION_INVALID_REPLY);
499 else
500 dns_transaction_gc(t);
501
502 return 0;
503 }
504
505 static int on_stream_complete(DnsStream *s, int error) {
506 _cleanup_(dns_stream_unrefp) DnsStream *p = NULL;
507
508 /* Do not let new transactions use this stream */
509 if (s->server && s->server->stream == s)
510 p = TAKE_PTR(s->server->stream);
511
512 if (ERRNO_IS_DISCONNECT(error) && s->protocol != DNS_PROTOCOL_LLMNR) {
513 log_debug_errno(error, "Connection failure for DNS TCP stream: %m");
514
515 if (s->transactions) {
516 DnsTransaction *t;
517
518 t = s->transactions;
519 dns_server_packet_lost(t->server, IPPROTO_TCP, t->current_feature_level);
520 }
521 }
522
523 if (error != 0) {
524 DnsTransaction *t, *n;
525
526 LIST_FOREACH_SAFE(transactions_by_stream, t, n, s->transactions)
527 on_transaction_stream_error(t, error);
528 }
529
530 return 0;
531 }
532
533 static int on_stream_packet(DnsStream *s) {
534 _cleanup_(dns_packet_unrefp) DnsPacket *p = NULL;
535 DnsTransaction *t;
536
537 assert(s);
538
539 /* Take ownership of packet to be able to receive new packets */
540 p = dns_stream_take_read_packet(s);
541 assert(p);
542
543 t = hashmap_get(s->manager->dns_transactions, UINT_TO_PTR(DNS_PACKET_ID(p)));
544 if (t)
545 return dns_transaction_on_stream_packet(t, p);
546
547 /* Ignore incorrect transaction id as transaction can have been canceled */
548 if (dns_packet_validate_reply(p) <= 0) {
549 log_debug("Invalid TCP reply packet.");
550 on_stream_complete(s, 0);
551 }
552
553 return 0;
554 }
555
556 static uint16_t dns_port_for_feature_level(DnsServerFeatureLevel level) {
557 return DNS_SERVER_FEATURE_LEVEL_IS_TLS(level) ? 853 : 53;
558 }
559
560 static int dns_transaction_emit_tcp(DnsTransaction *t) {
561 _cleanup_close_ int fd = -1;
562 _cleanup_(dns_stream_unrefp) DnsStream *s = NULL;
563 union sockaddr_union sa;
564 int r;
565
566 assert(t);
567
568 dns_transaction_close_connection(t);
569
570 switch (t->scope->protocol) {
571
572 case DNS_PROTOCOL_DNS:
573 r = dns_transaction_pick_server(t);
574 if (r < 0)
575 return r;
576
577 if (!dns_server_dnssec_supported(t->server) && dns_type_is_dnssec(t->key->type))
578 return -EOPNOTSUPP;
579
580 r = dns_server_adjust_opt(t->server, t->sent, t->current_feature_level);
581 if (r < 0)
582 return r;
583
584 if (t->server->stream && (DNS_SERVER_FEATURE_LEVEL_IS_TLS(t->current_feature_level) == t->server->stream->encrypted))
585 s = dns_stream_ref(t->server->stream);
586 else
587 fd = dns_scope_socket_tcp(t->scope, AF_UNSPEC, NULL, t->server, dns_port_for_feature_level(t->current_feature_level), &sa);
588
589 break;
590
591 case DNS_PROTOCOL_LLMNR:
592 /* When we already received a reply to this (but it was truncated), send to its sender address */
593 if (t->received)
594 fd = dns_scope_socket_tcp(t->scope, t->received->family, &t->received->sender, NULL, t->received->sender_port, &sa);
595 else {
596 union in_addr_union address;
597 int family = AF_UNSPEC;
598
599 /* Otherwise, try to talk to the owner of a
600 * the IP address, in case this is a reverse
601 * PTR lookup */
602
603 r = dns_name_address(dns_resource_key_name(t->key), &family, &address);
604 if (r < 0)
605 return r;
606 if (r == 0)
607 return -EINVAL;
608 if (family != t->scope->family)
609 return -ESRCH;
610
611 fd = dns_scope_socket_tcp(t->scope, family, &address, NULL, LLMNR_PORT, &sa);
612 }
613
614 break;
615
616 default:
617 return -EAFNOSUPPORT;
618 }
619
620 if (!s) {
621 if (fd < 0)
622 return fd;
623
624 r = dns_stream_new(t->scope->manager, &s, t->scope->protocol, fd, &sa);
625 if (r < 0)
626 return r;
627
628 fd = -1;
629
630 #if ENABLE_DNS_OVER_TLS
631 if (t->scope->protocol == DNS_PROTOCOL_DNS &&
632 DNS_SERVER_FEATURE_LEVEL_IS_TLS(t->current_feature_level)) {
633
634 assert(t->server);
635 r = dnstls_stream_connect_tls(s, t->server);
636 if (r < 0)
637 return r;
638 }
639 #endif
640
641 if (t->server) {
642 dns_stream_unref(t->server->stream);
643 t->server->stream = dns_stream_ref(s);
644 s->server = dns_server_ref(t->server);
645 }
646
647 s->complete = on_stream_complete;
648 s->on_packet = on_stream_packet;
649
650 /* The interface index is difficult to determine if we are
651 * connecting to the local host, hence fill this in right away
652 * instead of determining it from the socket */
653 s->ifindex = dns_scope_ifindex(t->scope);
654 }
655
656 t->stream = TAKE_PTR(s);
657 LIST_PREPEND(transactions_by_stream, t->stream->transactions, t);
658
659 r = dns_stream_write_packet(t->stream, t->sent);
660 if (r < 0) {
661 dns_transaction_close_connection(t);
662 return r;
663 }
664
665 dns_transaction_reset_answer(t);
666
667 t->tried_stream = true;
668
669 return 0;
670 }
671
672 static void dns_transaction_cache_answer(DnsTransaction *t) {
673 assert(t);
674
675 /* For mDNS we cache whenever we get the packet, rather than
676 * in each transaction. */
677 if (!IN_SET(t->scope->protocol, DNS_PROTOCOL_DNS, DNS_PROTOCOL_LLMNR))
678 return;
679
680 /* Caching disabled? */
681 if (!t->scope->manager->enable_cache)
682 return;
683
684 /* We never cache if this packet is from the local host, under
685 * the assumption that a locally running DNS server would
686 * cache this anyway, and probably knows better when to flush
687 * the cache then we could. */
688 if (!DNS_PACKET_SHALL_CACHE(t->received))
689 return;
690
691 dns_cache_put(&t->scope->cache,
692 t->key,
693 t->answer_rcode,
694 t->answer,
695 t->answer_authenticated,
696 t->answer_nsec_ttl,
697 0,
698 t->received->family,
699 &t->received->sender);
700 }
701
702 static bool dns_transaction_dnssec_is_live(DnsTransaction *t) {
703 DnsTransaction *dt;
704 Iterator i;
705
706 assert(t);
707
708 SET_FOREACH(dt, t->dnssec_transactions, i)
709 if (DNS_TRANSACTION_IS_LIVE(dt->state))
710 return true;
711
712 return false;
713 }
714
715 static int dns_transaction_dnssec_ready(DnsTransaction *t) {
716 DnsTransaction *dt;
717 Iterator i;
718
719 assert(t);
720
721 /* Checks whether the auxiliary DNSSEC transactions of our transaction have completed, or are still
722 * ongoing. Returns 0, if we aren't ready for the DNSSEC validation, positive if we are. */
723
724 SET_FOREACH(dt, t->dnssec_transactions, i) {
725
726 switch (dt->state) {
727
728 case DNS_TRANSACTION_NULL:
729 case DNS_TRANSACTION_PENDING:
730 case DNS_TRANSACTION_VALIDATING:
731 /* Still ongoing */
732 return 0;
733
734 case DNS_TRANSACTION_RCODE_FAILURE:
735 if (!IN_SET(dt->answer_rcode, DNS_RCODE_NXDOMAIN, DNS_RCODE_SERVFAIL)) {
736 log_debug("Auxiliary DNSSEC RR query failed with rcode=%s.", dns_rcode_to_string(dt->answer_rcode));
737 goto fail;
738 }
739
740 /* Fall-through: NXDOMAIN/SERVFAIL is good enough for us. This is because some DNS servers
741 * erronously return NXDOMAIN/SERVFAIL for empty non-terminals (Akamai...) or missing DS
742 * records (Facebook), and we need to handle that nicely, when asking for parent SOA or similar
743 * RRs to make unsigned proofs. */
744
745 case DNS_TRANSACTION_SUCCESS:
746 /* All good. */
747 break;
748
749 case DNS_TRANSACTION_DNSSEC_FAILED:
750 /* We handle DNSSEC failures different from other errors, as we care about the DNSSEC
751 * validationr result */
752
753 log_debug("Auxiliary DNSSEC RR query failed validation: %s", dnssec_result_to_string(dt->answer_dnssec_result));
754 t->answer_dnssec_result = dt->answer_dnssec_result; /* Copy error code over */
755 dns_transaction_complete(t, DNS_TRANSACTION_DNSSEC_FAILED);
756 return 0;
757
758 default:
759 log_debug("Auxiliary DNSSEC RR query failed with %s", dns_transaction_state_to_string(dt->state));
760 goto fail;
761 }
762 }
763
764 /* All is ready, we can go and validate */
765 return 1;
766
767 fail:
768 t->answer_dnssec_result = DNSSEC_FAILED_AUXILIARY;
769 dns_transaction_complete(t, DNS_TRANSACTION_DNSSEC_FAILED);
770 return 0;
771 }
772
773 static void dns_transaction_process_dnssec(DnsTransaction *t) {
774 int r;
775
776 assert(t);
777
778 /* Are there ongoing DNSSEC transactions? If so, let's wait for them. */
779 r = dns_transaction_dnssec_ready(t);
780 if (r < 0)
781 goto fail;
782 if (r == 0) /* We aren't ready yet (or one of our auxiliary transactions failed, and we shouldn't validate now */
783 return;
784
785 /* See if we learnt things from the additional DNSSEC transactions, that we didn't know before, and better
786 * restart the lookup immediately. */
787 r = dns_transaction_maybe_restart(t);
788 if (r < 0)
789 goto fail;
790 if (r > 0) /* Transaction got restarted... */
791 return;
792
793 /* All our auxiliary DNSSEC transactions are complete now. Try
794 * to validate our RRset now. */
795 r = dns_transaction_validate_dnssec(t);
796 if (r == -EBADMSG) {
797 dns_transaction_complete(t, DNS_TRANSACTION_INVALID_REPLY);
798 return;
799 }
800 if (r < 0)
801 goto fail;
802
803 if (t->answer_dnssec_result == DNSSEC_INCOMPATIBLE_SERVER &&
804 t->scope->dnssec_mode == DNSSEC_YES) {
805
806 /* We are not in automatic downgrade mode, and the server is bad. Let's try a different server, maybe
807 * that works. */
808
809 if (t->n_picked_servers < dns_scope_get_n_dns_servers(t->scope)) {
810 /* We tried fewer servers on this transaction than we know, let's try another one then */
811 dns_transaction_retry(t, true);
812 return;
813 }
814
815 /* OK, let's give up, apparently all servers we tried didn't work. */
816 dns_transaction_complete(t, DNS_TRANSACTION_DNSSEC_FAILED);
817 return;
818 }
819
820 if (!IN_SET(t->answer_dnssec_result,
821 _DNSSEC_RESULT_INVALID, /* No DNSSEC validation enabled */
822 DNSSEC_VALIDATED, /* Answer is signed and validated successfully */
823 DNSSEC_UNSIGNED, /* Answer is right-fully unsigned */
824 DNSSEC_INCOMPATIBLE_SERVER)) { /* Server does not do DNSSEC (Yay, we are downgrade attack vulnerable!) */
825 dns_transaction_complete(t, DNS_TRANSACTION_DNSSEC_FAILED);
826 return;
827 }
828
829 if (t->answer_dnssec_result == DNSSEC_INCOMPATIBLE_SERVER)
830 dns_server_warn_downgrade(t->server);
831
832 dns_transaction_cache_answer(t);
833
834 if (t->answer_rcode == DNS_RCODE_SUCCESS)
835 dns_transaction_complete(t, DNS_TRANSACTION_SUCCESS);
836 else
837 dns_transaction_complete(t, DNS_TRANSACTION_RCODE_FAILURE);
838
839 return;
840
841 fail:
842 t->answer_errno = -r;
843 dns_transaction_complete(t, DNS_TRANSACTION_ERRNO);
844 }
845
846 static int dns_transaction_has_positive_answer(DnsTransaction *t, DnsAnswerFlags *flags) {
847 int r;
848
849 assert(t);
850
851 /* Checks whether the answer is positive, i.e. either a direct
852 * answer to the question, or a CNAME/DNAME for it */
853
854 r = dns_answer_match_key(t->answer, t->key, flags);
855 if (r != 0)
856 return r;
857
858 r = dns_answer_find_cname_or_dname(t->answer, t->key, NULL, flags);
859 if (r != 0)
860 return r;
861
862 return false;
863 }
864
865 static int dns_transaction_fix_rcode(DnsTransaction *t) {
866 int r;
867
868 assert(t);
869
870 /* Fix up the RCODE to SUCCESS if we get at least one matching RR in a response. Note that this contradicts the
871 * DNS RFCs a bit. Specifically, RFC 6604 Section 3 clarifies that the RCODE shall say something about a
872 * CNAME/DNAME chain element coming after the last chain element contained in the message, and not the first
873 * one included. However, it also indicates that not all DNS servers implement this correctly. Moreover, when
874 * using DNSSEC we usually only can prove the first element of a CNAME/DNAME chain anyway, hence let's settle
875 * on always processing the RCODE as referring to the immediate look-up we do, i.e. the first element of a
876 * CNAME/DNAME chain. This way, we uniformly handle CNAME/DNAME chains, regardless if the DNS server
877 * incorrectly implements RCODE, whether DNSSEC is in use, or whether the DNS server only supplied us with an
878 * incomplete CNAME/DNAME chain.
879 *
880 * Or in other words: if we get at least one positive reply in a message we patch NXDOMAIN to become SUCCESS,
881 * and then rely on the CNAME chasing logic to figure out that there's actually a CNAME error with a new
882 * lookup. */
883
884 if (t->answer_rcode != DNS_RCODE_NXDOMAIN)
885 return 0;
886
887 r = dns_transaction_has_positive_answer(t, NULL);
888 if (r <= 0)
889 return r;
890
891 t->answer_rcode = DNS_RCODE_SUCCESS;
892 return 0;
893 }
894
895 void dns_transaction_process_reply(DnsTransaction *t, DnsPacket *p) {
896 usec_t ts;
897 int r;
898
899 assert(t);
900 assert(p);
901 assert(t->scope);
902 assert(t->scope->manager);
903
904 if (t->state != DNS_TRANSACTION_PENDING)
905 return;
906
907 /* Note that this call might invalidate the query. Callers
908 * should hence not attempt to access the query or transaction
909 * after calling this function. */
910
911 log_debug("Processing incoming packet on transaction %" PRIu16" (rcode=%s).",
912 t->id, dns_rcode_to_string(DNS_PACKET_RCODE(p)));
913
914 switch (t->scope->protocol) {
915
916 case DNS_PROTOCOL_LLMNR:
917 /* For LLMNR we will not accept any packets from other interfaces */
918
919 if (p->ifindex != dns_scope_ifindex(t->scope))
920 return;
921
922 if (p->family != t->scope->family)
923 return;
924
925 /* Tentative packets are not full responses but still
926 * useful for identifying uniqueness conflicts during
927 * probing. */
928 if (DNS_PACKET_LLMNR_T(p)) {
929 dns_transaction_tentative(t, p);
930 return;
931 }
932
933 break;
934
935 case DNS_PROTOCOL_MDNS:
936 /* For mDNS we will not accept any packets from other interfaces */
937
938 if (p->ifindex != dns_scope_ifindex(t->scope))
939 return;
940
941 if (p->family != t->scope->family)
942 return;
943
944 break;
945
946 case DNS_PROTOCOL_DNS:
947 /* Note that we do not need to verify the
948 * addresses/port numbers of incoming traffic, as we
949 * invoked connect() on our UDP socket in which case
950 * the kernel already does the needed verification for
951 * us. */
952 break;
953
954 default:
955 assert_not_reached("Invalid DNS protocol.");
956 }
957
958 if (t->received != p) {
959 dns_packet_unref(t->received);
960 t->received = dns_packet_ref(p);
961 }
962
963 t->answer_source = DNS_TRANSACTION_NETWORK;
964
965 if (p->ipproto == IPPROTO_TCP) {
966 if (DNS_PACKET_TC(p)) {
967 /* Truncated via TCP? Somebody must be fucking with us */
968 dns_transaction_complete(t, DNS_TRANSACTION_INVALID_REPLY);
969 return;
970 }
971
972 if (DNS_PACKET_ID(p) != t->id) {
973 /* Not the reply to our query? Somebody must be fucking with us */
974 dns_transaction_complete(t, DNS_TRANSACTION_INVALID_REPLY);
975 return;
976 }
977 }
978
979 assert_se(sd_event_now(t->scope->manager->event, clock_boottime_or_monotonic(), &ts) >= 0);
980
981 switch (t->scope->protocol) {
982
983 case DNS_PROTOCOL_DNS:
984 assert(t->server);
985
986 if (IN_SET(DNS_PACKET_RCODE(p), DNS_RCODE_FORMERR, DNS_RCODE_SERVFAIL, DNS_RCODE_NOTIMP)) {
987
988 /* Request failed, immediately try again with reduced features */
989
990 if (t->current_feature_level <= DNS_SERVER_FEATURE_LEVEL_UDP) {
991
992 /* This was already at UDP feature level? If so, it doesn't make sense to downgrade
993 * this transaction anymore, but let's see if it might make sense to send the request
994 * to a different DNS server instead. If not let's process the response, and accept the
995 * rcode. Note that we don't retry on TCP, since that's a suitable way to mitigate
996 * packet loss, but is not going to give us better rcodes should we actually have
997 * managed to get them already at UDP level. */
998
999 if (t->n_picked_servers < dns_scope_get_n_dns_servers(t->scope)) {
1000 /* We tried fewer servers on this transaction than we know, let's try another one then */
1001 dns_transaction_retry(t, true);
1002 return;
1003 }
1004
1005 /* Give up, accept the rcode */
1006 log_debug("Server returned error: %s", dns_rcode_to_string(DNS_PACKET_RCODE(p)));
1007 break;
1008 }
1009
1010 /* Reduce this feature level by one and try again. */
1011 switch (t->current_feature_level) {
1012 case DNS_SERVER_FEATURE_LEVEL_TLS_DO:
1013 t->clamp_feature_level = DNS_SERVER_FEATURE_LEVEL_TLS_PLAIN;
1014 break;
1015 case DNS_SERVER_FEATURE_LEVEL_TLS_PLAIN + 1:
1016 /* Skip plain TLS when TLS is not supported */
1017 t->clamp_feature_level = DNS_SERVER_FEATURE_LEVEL_TLS_PLAIN - 1;
1018 break;
1019 default:
1020 t->clamp_feature_level = t->current_feature_level - 1;
1021 }
1022
1023 log_debug("Server returned error %s, retrying transaction with reduced feature level %s.",
1024 dns_rcode_to_string(DNS_PACKET_RCODE(p)),
1025 dns_server_feature_level_to_string(t->clamp_feature_level));
1026
1027 dns_transaction_retry(t, false /* use the same server */);
1028 return;
1029 }
1030
1031 if (DNS_PACKET_RCODE(p) == DNS_RCODE_REFUSED) {
1032 /* This server refused our request? If so, try again, use a different server */
1033 log_debug("Server returned REFUSED, switching servers, and retrying.");
1034 dns_transaction_retry(t, true /* pick a new server */);
1035 return;
1036 }
1037
1038 if (DNS_PACKET_TC(p))
1039 dns_server_packet_truncated(t->server, t->current_feature_level);
1040
1041 break;
1042
1043 case DNS_PROTOCOL_LLMNR:
1044 case DNS_PROTOCOL_MDNS:
1045 dns_scope_packet_received(t->scope, ts - t->start_usec);
1046 break;
1047
1048 default:
1049 assert_not_reached("Invalid DNS protocol.");
1050 }
1051
1052 if (DNS_PACKET_TC(p)) {
1053
1054 /* Truncated packets for mDNS are not allowed. Give up immediately. */
1055 if (t->scope->protocol == DNS_PROTOCOL_MDNS) {
1056 dns_transaction_complete(t, DNS_TRANSACTION_INVALID_REPLY);
1057 return;
1058 }
1059
1060 log_debug("Reply truncated, retrying via TCP.");
1061
1062 /* Response was truncated, let's try again with good old TCP */
1063 r = dns_transaction_emit_tcp(t);
1064 if (r == -ESRCH) {
1065 /* No servers found? Damn! */
1066 dns_transaction_complete(t, DNS_TRANSACTION_NO_SERVERS);
1067 return;
1068 }
1069 if (r == -EOPNOTSUPP) {
1070 /* Tried to ask for DNSSEC RRs, on a server that doesn't do DNSSEC */
1071 dns_transaction_complete(t, DNS_TRANSACTION_RR_TYPE_UNSUPPORTED);
1072 return;
1073 }
1074 if (r < 0) {
1075 /* On LLMNR, if we cannot connect to the host,
1076 * we immediately give up */
1077 if (t->scope->protocol != DNS_PROTOCOL_DNS)
1078 goto fail;
1079
1080 /* On DNS, couldn't send? Try immediately again, with a new server */
1081 dns_transaction_retry(t, true);
1082 }
1083
1084 return;
1085 }
1086
1087 /* After the superficial checks, actually parse the message. */
1088 r = dns_packet_extract(p);
1089 if (r < 0) {
1090 dns_transaction_complete(t, DNS_TRANSACTION_INVALID_REPLY);
1091 return;
1092 }
1093
1094 if (t->server) {
1095 /* Report that we successfully received a valid packet with a good rcode after we initially got a bad
1096 * rcode and subsequently downgraded the protocol */
1097
1098 if (IN_SET(DNS_PACKET_RCODE(p), DNS_RCODE_SUCCESS, DNS_RCODE_NXDOMAIN) &&
1099 t->clamp_feature_level != _DNS_SERVER_FEATURE_LEVEL_INVALID)
1100 dns_server_packet_rcode_downgrade(t->server, t->clamp_feature_level);
1101
1102 /* Report that the OPT RR was missing */
1103 if (!p->opt)
1104 dns_server_packet_bad_opt(t->server, t->current_feature_level);
1105
1106 /* Report that we successfully received a packet */
1107 dns_server_packet_received(t->server, p->ipproto, t->current_feature_level, p->size);
1108 }
1109
1110 /* See if we know things we didn't know before that indicate we better restart the lookup immediately. */
1111 r = dns_transaction_maybe_restart(t);
1112 if (r < 0)
1113 goto fail;
1114 if (r > 0) /* Transaction got restarted... */
1115 return;
1116
1117 if (IN_SET(t->scope->protocol, DNS_PROTOCOL_DNS, DNS_PROTOCOL_LLMNR, DNS_PROTOCOL_MDNS)) {
1118
1119 /* When dealing with protocols other than mDNS only consider responses with
1120 * equivalent query section to the request. For mDNS this check doesn't make
1121 * sense, because the section 6 of RFC6762 states that "Multicast DNS responses MUST NOT
1122 * contain any questions in the Question Section". */
1123 if (t->scope->protocol != DNS_PROTOCOL_MDNS) {
1124 r = dns_packet_is_reply_for(p, t->key);
1125 if (r < 0)
1126 goto fail;
1127 if (r == 0) {
1128 dns_transaction_complete(t, DNS_TRANSACTION_INVALID_REPLY);
1129 return;
1130 }
1131 }
1132
1133 /* Install the answer as answer to the transaction */
1134 dns_answer_unref(t->answer);
1135 t->answer = dns_answer_ref(p->answer);
1136 t->answer_rcode = DNS_PACKET_RCODE(p);
1137 t->answer_dnssec_result = _DNSSEC_RESULT_INVALID;
1138 t->answer_authenticated = false;
1139
1140 r = dns_transaction_fix_rcode(t);
1141 if (r < 0)
1142 goto fail;
1143
1144 /* Block GC while starting requests for additional DNSSEC RRs */
1145 t->block_gc++;
1146 r = dns_transaction_request_dnssec_keys(t);
1147 t->block_gc--;
1148
1149 /* Maybe the transaction is ready for GC'ing now? If so, free it and return. */
1150 if (!dns_transaction_gc(t))
1151 return;
1152
1153 /* Requesting additional keys might have resulted in
1154 * this transaction to fail, since the auxiliary
1155 * request failed for some reason. If so, we are not
1156 * in pending state anymore, and we should exit
1157 * quickly. */
1158 if (t->state != DNS_TRANSACTION_PENDING)
1159 return;
1160 if (r < 0)
1161 goto fail;
1162 if (r > 0) {
1163 /* There are DNSSEC transactions pending now. Update the state accordingly. */
1164 t->state = DNS_TRANSACTION_VALIDATING;
1165 dns_transaction_close_connection(t);
1166 dns_transaction_stop_timeout(t);
1167 return;
1168 }
1169 }
1170
1171 dns_transaction_process_dnssec(t);
1172 return;
1173
1174 fail:
1175 t->answer_errno = -r;
1176 dns_transaction_complete(t, DNS_TRANSACTION_ERRNO);
1177 }
1178
1179 static int on_dns_packet(sd_event_source *s, int fd, uint32_t revents, void *userdata) {
1180 _cleanup_(dns_packet_unrefp) DnsPacket *p = NULL;
1181 DnsTransaction *t = userdata;
1182 int r;
1183
1184 assert(t);
1185 assert(t->scope);
1186
1187 r = manager_recv(t->scope->manager, fd, DNS_PROTOCOL_DNS, &p);
1188 if (ERRNO_IS_DISCONNECT(-r)) {
1189 usec_t usec;
1190
1191 /* UDP connection failure get reported via ICMP and then are possible delivered to us on the next
1192 * recvmsg(). Treat this like a lost packet. */
1193
1194 log_debug_errno(r, "Connection failure for DNS UDP packet: %m");
1195 assert_se(sd_event_now(t->scope->manager->event, clock_boottime_or_monotonic(), &usec) >= 0);
1196 dns_server_packet_lost(t->server, IPPROTO_UDP, t->current_feature_level);
1197
1198 dns_transaction_retry(t, true);
1199 return 0;
1200 }
1201 if (r < 0) {
1202 dns_transaction_complete(t, DNS_TRANSACTION_ERRNO);
1203 t->answer_errno = -r;
1204 return 0;
1205 }
1206
1207 r = dns_packet_validate_reply(p);
1208 if (r < 0) {
1209 log_debug_errno(r, "Received invalid DNS packet as response, ignoring: %m");
1210 return 0;
1211 }
1212 if (r == 0) {
1213 log_debug("Received inappropriate DNS packet as response, ignoring.");
1214 return 0;
1215 }
1216
1217 if (DNS_PACKET_ID(p) != t->id) {
1218 log_debug("Received packet with incorrect transaction ID, ignoring.");
1219 return 0;
1220 }
1221
1222 dns_transaction_process_reply(t, p);
1223 return 0;
1224 }
1225
1226 static int dns_transaction_emit_udp(DnsTransaction *t) {
1227 int r;
1228
1229 assert(t);
1230
1231 if (t->scope->protocol == DNS_PROTOCOL_DNS) {
1232
1233 r = dns_transaction_pick_server(t);
1234 if (r < 0)
1235 return r;
1236
1237 if (t->current_feature_level < DNS_SERVER_FEATURE_LEVEL_UDP || DNS_SERVER_FEATURE_LEVEL_IS_TLS(t->current_feature_level))
1238 return -EAGAIN; /* Sorry, can't do UDP, try TCP! */
1239
1240 if (!dns_server_dnssec_supported(t->server) && dns_type_is_dnssec(t->key->type))
1241 return -EOPNOTSUPP;
1242
1243 if (r > 0 || t->dns_udp_fd < 0) { /* Server changed, or no connection yet. */
1244 int fd;
1245
1246 dns_transaction_close_connection(t);
1247
1248 fd = dns_scope_socket_udp(t->scope, t->server, 53);
1249 if (fd < 0)
1250 return fd;
1251
1252 r = sd_event_add_io(t->scope->manager->event, &t->dns_udp_event_source, fd, EPOLLIN, on_dns_packet, t);
1253 if (r < 0) {
1254 safe_close(fd);
1255 return r;
1256 }
1257
1258 (void) sd_event_source_set_description(t->dns_udp_event_source, "dns-transaction-udp");
1259 t->dns_udp_fd = fd;
1260 }
1261
1262 r = dns_server_adjust_opt(t->server, t->sent, t->current_feature_level);
1263 if (r < 0)
1264 return r;
1265 } else
1266 dns_transaction_close_connection(t);
1267
1268 r = dns_scope_emit_udp(t->scope, t->dns_udp_fd, t->sent);
1269 if (r < 0)
1270 return r;
1271
1272 dns_transaction_reset_answer(t);
1273
1274 return 0;
1275 }
1276
1277 static int on_transaction_timeout(sd_event_source *s, usec_t usec, void *userdata) {
1278 DnsTransaction *t = userdata;
1279
1280 assert(s);
1281 assert(t);
1282
1283 if (!t->initial_jitter_scheduled || t->initial_jitter_elapsed) {
1284 /* Timeout reached? Increase the timeout for the server used */
1285 switch (t->scope->protocol) {
1286
1287 case DNS_PROTOCOL_DNS:
1288 assert(t->server);
1289 dns_server_packet_lost(t->server, t->stream ? IPPROTO_TCP : IPPROTO_UDP, t->current_feature_level);
1290 break;
1291
1292 case DNS_PROTOCOL_LLMNR:
1293 case DNS_PROTOCOL_MDNS:
1294 dns_scope_packet_lost(t->scope, usec - t->start_usec);
1295 break;
1296
1297 default:
1298 assert_not_reached("Invalid DNS protocol.");
1299 }
1300
1301 if (t->initial_jitter_scheduled)
1302 t->initial_jitter_elapsed = true;
1303 }
1304
1305 log_debug("Timeout reached on transaction %" PRIu16 ".", t->id);
1306
1307 dns_transaction_retry(t, true);
1308 return 0;
1309 }
1310
1311 static usec_t transaction_get_resend_timeout(DnsTransaction *t) {
1312 assert(t);
1313 assert(t->scope);
1314
1315 switch (t->scope->protocol) {
1316
1317 case DNS_PROTOCOL_DNS:
1318
1319 /* When we do TCP, grant a much longer timeout, as in this case there's no need for us to quickly
1320 * resend, as the kernel does that anyway for us, and we really don't want to interrupt it in that
1321 * needlessly. */
1322 if (t->stream)
1323 return TRANSACTION_TCP_TIMEOUT_USEC;
1324
1325 return DNS_TIMEOUT_USEC;
1326
1327 case DNS_PROTOCOL_MDNS:
1328 assert(t->n_attempts > 0);
1329 if (t->probing)
1330 return MDNS_PROBING_INTERVAL_USEC;
1331 else
1332 return (1 << (t->n_attempts - 1)) * USEC_PER_SEC;
1333
1334 case DNS_PROTOCOL_LLMNR:
1335 return t->scope->resend_timeout;
1336
1337 default:
1338 assert_not_reached("Invalid DNS protocol.");
1339 }
1340 }
1341
1342 static int dns_transaction_prepare(DnsTransaction *t, usec_t ts) {
1343 int r;
1344
1345 assert(t);
1346
1347 dns_transaction_stop_timeout(t);
1348
1349 if (!dns_scope_network_good(t->scope)) {
1350 dns_transaction_complete(t, DNS_TRANSACTION_NETWORK_DOWN);
1351 return 0;
1352 }
1353
1354 if (t->n_attempts >= TRANSACTION_ATTEMPTS_MAX(t->scope->protocol)) {
1355 dns_transaction_complete(t, DNS_TRANSACTION_ATTEMPTS_MAX_REACHED);
1356 return 0;
1357 }
1358
1359 if (t->scope->protocol == DNS_PROTOCOL_LLMNR && t->tried_stream) {
1360 /* If we already tried via a stream, then we don't
1361 * retry on LLMNR. See RFC 4795, Section 2.7. */
1362 dns_transaction_complete(t, DNS_TRANSACTION_ATTEMPTS_MAX_REACHED);
1363 return 0;
1364 }
1365
1366 t->n_attempts++;
1367 t->start_usec = ts;
1368
1369 dns_transaction_reset_answer(t);
1370 dns_transaction_flush_dnssec_transactions(t);
1371
1372 /* Check the trust anchor. Do so only on classic DNS, since DNSSEC does not apply otherwise. */
1373 if (t->scope->protocol == DNS_PROTOCOL_DNS) {
1374 r = dns_trust_anchor_lookup_positive(&t->scope->manager->trust_anchor, t->key, &t->answer);
1375 if (r < 0)
1376 return r;
1377 if (r > 0) {
1378 t->answer_rcode = DNS_RCODE_SUCCESS;
1379 t->answer_source = DNS_TRANSACTION_TRUST_ANCHOR;
1380 t->answer_authenticated = true;
1381 dns_transaction_complete(t, DNS_TRANSACTION_SUCCESS);
1382 return 0;
1383 }
1384
1385 if (dns_name_is_root(dns_resource_key_name(t->key)) &&
1386 t->key->type == DNS_TYPE_DS) {
1387
1388 /* Hmm, this is a request for the root DS? A
1389 * DS RR doesn't exist in the root zone, and
1390 * if our trust anchor didn't know it either,
1391 * this means we cannot do any DNSSEC logic
1392 * anymore. */
1393
1394 if (t->scope->dnssec_mode == DNSSEC_ALLOW_DOWNGRADE) {
1395 /* We are in downgrade mode. In this
1396 * case, synthesize an unsigned empty
1397 * response, so that the any lookup
1398 * depending on this one can continue
1399 * assuming there was no DS, and hence
1400 * the root zone was unsigned. */
1401
1402 t->answer_rcode = DNS_RCODE_SUCCESS;
1403 t->answer_source = DNS_TRANSACTION_TRUST_ANCHOR;
1404 t->answer_authenticated = false;
1405 dns_transaction_complete(t, DNS_TRANSACTION_SUCCESS);
1406 } else
1407 /* If we are not in downgrade mode,
1408 * then fail the lookup, because we
1409 * cannot reasonably answer it. There
1410 * might be DS RRs, but we don't know
1411 * them, and the DNS server won't tell
1412 * them to us (and even if it would,
1413 * we couldn't validate and trust them. */
1414 dns_transaction_complete(t, DNS_TRANSACTION_NO_TRUST_ANCHOR);
1415
1416 return 0;
1417 }
1418 }
1419
1420 /* Check the zone, but only if this transaction is not used
1421 * for probing or verifying a zone item. */
1422 if (set_isempty(t->notify_zone_items)) {
1423
1424 r = dns_zone_lookup(&t->scope->zone, t->key, dns_scope_ifindex(t->scope), &t->answer, NULL, NULL);
1425 if (r < 0)
1426 return r;
1427 if (r > 0) {
1428 t->answer_rcode = DNS_RCODE_SUCCESS;
1429 t->answer_source = DNS_TRANSACTION_ZONE;
1430 t->answer_authenticated = true;
1431 dns_transaction_complete(t, DNS_TRANSACTION_SUCCESS);
1432 return 0;
1433 }
1434 }
1435
1436 /* Check the cache, but only if this transaction is not used
1437 * for probing or verifying a zone item. */
1438 if (set_isempty(t->notify_zone_items)) {
1439
1440 /* Before trying the cache, let's make sure we figured out a
1441 * server to use. Should this cause a change of server this
1442 * might flush the cache. */
1443 (void) dns_scope_get_dns_server(t->scope);
1444
1445 /* Let's then prune all outdated entries */
1446 dns_cache_prune(&t->scope->cache);
1447
1448 r = dns_cache_lookup(&t->scope->cache, t->key, t->clamp_ttl, &t->answer_rcode, &t->answer, &t->answer_authenticated);
1449 if (r < 0)
1450 return r;
1451 if (r > 0) {
1452 t->answer_source = DNS_TRANSACTION_CACHE;
1453 if (t->answer_rcode == DNS_RCODE_SUCCESS)
1454 dns_transaction_complete(t, DNS_TRANSACTION_SUCCESS);
1455 else
1456 dns_transaction_complete(t, DNS_TRANSACTION_RCODE_FAILURE);
1457 return 0;
1458 }
1459 }
1460
1461 return 1;
1462 }
1463
1464 static int dns_transaction_make_packet_mdns(DnsTransaction *t) {
1465
1466 _cleanup_(dns_packet_unrefp) DnsPacket *p = NULL;
1467 bool add_known_answers = false;
1468 DnsTransaction *other;
1469 Iterator i;
1470 DnsResourceKey *tkey;
1471 _cleanup_set_free_ Set *keys = NULL;
1472 unsigned qdcount;
1473 unsigned nscount = 0;
1474 usec_t ts;
1475 int r;
1476
1477 assert(t);
1478 assert(t->scope->protocol == DNS_PROTOCOL_MDNS);
1479
1480 /* Discard any previously prepared packet, so we can start over and coalesce again */
1481 t->sent = dns_packet_unref(t->sent);
1482
1483 r = dns_packet_new_query(&p, t->scope->protocol, 0, false);
1484 if (r < 0)
1485 return r;
1486
1487 r = dns_packet_append_key(p, t->key, 0, NULL);
1488 if (r < 0)
1489 return r;
1490
1491 qdcount = 1;
1492
1493 if (dns_key_is_shared(t->key))
1494 add_known_answers = true;
1495
1496 if (t->key->type == DNS_TYPE_ANY) {
1497 r = set_ensure_allocated(&keys, &dns_resource_key_hash_ops);
1498 if (r < 0)
1499 return r;
1500
1501 r = set_put(keys, t->key);
1502 if (r < 0)
1503 return r;
1504 }
1505
1506 /*
1507 * For mDNS, we want to coalesce as many open queries in pending transactions into one single
1508 * query packet on the wire as possible. To achieve that, we iterate through all pending transactions
1509 * in our current scope, and see whether their timing contraints allow them to be sent.
1510 */
1511
1512 assert_se(sd_event_now(t->scope->manager->event, clock_boottime_or_monotonic(), &ts) >= 0);
1513
1514 LIST_FOREACH(transactions_by_scope, other, t->scope->transactions) {
1515
1516 /* Skip ourselves */
1517 if (other == t)
1518 continue;
1519
1520 if (other->state != DNS_TRANSACTION_PENDING)
1521 continue;
1522
1523 if (other->next_attempt_after > ts)
1524 continue;
1525
1526 if (qdcount >= UINT16_MAX)
1527 break;
1528
1529 r = dns_packet_append_key(p, other->key, 0, NULL);
1530
1531 /*
1532 * If we can't stuff more questions into the packet, just give up.
1533 * One of the 'other' transactions will fire later and take care of the rest.
1534 */
1535 if (r == -EMSGSIZE)
1536 break;
1537
1538 if (r < 0)
1539 return r;
1540
1541 r = dns_transaction_prepare(other, ts);
1542 if (r <= 0)
1543 continue;
1544
1545 ts += transaction_get_resend_timeout(other);
1546
1547 r = sd_event_add_time(
1548 other->scope->manager->event,
1549 &other->timeout_event_source,
1550 clock_boottime_or_monotonic(),
1551 ts, 0,
1552 on_transaction_timeout, other);
1553 if (r < 0)
1554 return r;
1555
1556 (void) sd_event_source_set_description(other->timeout_event_source, "dns-transaction-timeout");
1557
1558 other->state = DNS_TRANSACTION_PENDING;
1559 other->next_attempt_after = ts;
1560
1561 qdcount++;
1562
1563 if (dns_key_is_shared(other->key))
1564 add_known_answers = true;
1565
1566 if (other->key->type == DNS_TYPE_ANY) {
1567 r = set_ensure_allocated(&keys, &dns_resource_key_hash_ops);
1568 if (r < 0)
1569 return r;
1570
1571 r = set_put(keys, other->key);
1572 if (r < 0)
1573 return r;
1574 }
1575 }
1576
1577 DNS_PACKET_HEADER(p)->qdcount = htobe16(qdcount);
1578
1579 /* Append known answer section if we're asking for any shared record */
1580 if (add_known_answers) {
1581 r = dns_cache_export_shared_to_packet(&t->scope->cache, p);
1582 if (r < 0)
1583 return r;
1584 }
1585
1586 SET_FOREACH(tkey, keys, i) {
1587 _cleanup_(dns_answer_unrefp) DnsAnswer *answer = NULL;
1588 bool tentative;
1589
1590 r = dns_zone_lookup(&t->scope->zone, tkey, t->scope->link->ifindex, &answer, NULL, &tentative);
1591 if (r < 0)
1592 return r;
1593
1594 r = dns_packet_append_answer(p, answer);
1595 if (r < 0)
1596 return r;
1597
1598 nscount += dns_answer_size(answer);
1599 }
1600 DNS_PACKET_HEADER(p)->nscount = htobe16(nscount);
1601
1602 t->sent = TAKE_PTR(p);
1603
1604 return 0;
1605 }
1606
1607 static int dns_transaction_make_packet(DnsTransaction *t) {
1608 _cleanup_(dns_packet_unrefp) DnsPacket *p = NULL;
1609 int r;
1610
1611 assert(t);
1612
1613 if (t->scope->protocol == DNS_PROTOCOL_MDNS)
1614 return dns_transaction_make_packet_mdns(t);
1615
1616 if (t->sent)
1617 return 0;
1618
1619 r = dns_packet_new_query(&p, t->scope->protocol, 0, t->scope->dnssec_mode != DNSSEC_NO);
1620 if (r < 0)
1621 return r;
1622
1623 r = dns_packet_append_key(p, t->key, 0, NULL);
1624 if (r < 0)
1625 return r;
1626
1627 DNS_PACKET_HEADER(p)->qdcount = htobe16(1);
1628 DNS_PACKET_HEADER(p)->id = t->id;
1629
1630 t->sent = TAKE_PTR(p);
1631
1632 return 0;
1633 }
1634
1635 int dns_transaction_go(DnsTransaction *t) {
1636 usec_t ts;
1637 int r;
1638 char key_str[DNS_RESOURCE_KEY_STRING_MAX];
1639
1640 assert(t);
1641
1642 /* Returns > 0 if the transaction is now pending, returns 0 if could be processed immediately and has finished
1643 * now. */
1644
1645 assert_se(sd_event_now(t->scope->manager->event, clock_boottime_or_monotonic(), &ts) >= 0);
1646
1647 r = dns_transaction_prepare(t, ts);
1648 if (r <= 0)
1649 return r;
1650
1651 log_debug("Transaction %" PRIu16 " for <%s> scope %s on %s/%s.",
1652 t->id,
1653 dns_resource_key_to_string(t->key, key_str, sizeof key_str),
1654 dns_protocol_to_string(t->scope->protocol),
1655 t->scope->link ? t->scope->link->name : "*",
1656 af_to_name_short(t->scope->family));
1657
1658 if (!t->initial_jitter_scheduled &&
1659 IN_SET(t->scope->protocol, DNS_PROTOCOL_LLMNR, DNS_PROTOCOL_MDNS)) {
1660 usec_t jitter, accuracy;
1661
1662 /* RFC 4795 Section 2.7 suggests all queries should be
1663 * delayed by a random time from 0 to JITTER_INTERVAL. */
1664
1665 t->initial_jitter_scheduled = true;
1666
1667 random_bytes(&jitter, sizeof(jitter));
1668
1669 switch (t->scope->protocol) {
1670
1671 case DNS_PROTOCOL_LLMNR:
1672 jitter %= LLMNR_JITTER_INTERVAL_USEC;
1673 accuracy = LLMNR_JITTER_INTERVAL_USEC;
1674 break;
1675
1676 case DNS_PROTOCOL_MDNS:
1677 jitter %= MDNS_JITTER_RANGE_USEC;
1678 jitter += MDNS_JITTER_MIN_USEC;
1679 accuracy = MDNS_JITTER_RANGE_USEC;
1680 break;
1681 default:
1682 assert_not_reached("bad protocol");
1683 }
1684
1685 r = sd_event_add_time(
1686 t->scope->manager->event,
1687 &t->timeout_event_source,
1688 clock_boottime_or_monotonic(),
1689 ts + jitter, accuracy,
1690 on_transaction_timeout, t);
1691 if (r < 0)
1692 return r;
1693
1694 (void) sd_event_source_set_description(t->timeout_event_source, "dns-transaction-timeout");
1695
1696 t->n_attempts = 0;
1697 t->next_attempt_after = ts;
1698 t->state = DNS_TRANSACTION_PENDING;
1699
1700 log_debug("Delaying %s transaction for " USEC_FMT "us.", dns_protocol_to_string(t->scope->protocol), jitter);
1701 return 0;
1702 }
1703
1704 /* Otherwise, we need to ask the network */
1705 r = dns_transaction_make_packet(t);
1706 if (r < 0)
1707 return r;
1708
1709 if (t->scope->protocol == DNS_PROTOCOL_LLMNR &&
1710 (dns_name_endswith(dns_resource_key_name(t->key), "in-addr.arpa") > 0 ||
1711 dns_name_endswith(dns_resource_key_name(t->key), "ip6.arpa") > 0)) {
1712
1713 /* RFC 4795, Section 2.4. says reverse lookups shall
1714 * always be made via TCP on LLMNR */
1715 r = dns_transaction_emit_tcp(t);
1716 } else {
1717 /* Try via UDP, and if that fails due to large size or lack of
1718 * support try via TCP */
1719 r = dns_transaction_emit_udp(t);
1720 if (r == -EMSGSIZE)
1721 log_debug("Sending query via TCP since it is too large.");
1722 else if (r == -EAGAIN)
1723 log_debug("Sending query via TCP since UDP isn't supported.");
1724 if (IN_SET(r, -EMSGSIZE, -EAGAIN))
1725 r = dns_transaction_emit_tcp(t);
1726 }
1727
1728 if (r == -ESRCH) {
1729 /* No servers to send this to? */
1730 dns_transaction_complete(t, DNS_TRANSACTION_NO_SERVERS);
1731 return 0;
1732 }
1733 if (r == -EOPNOTSUPP) {
1734 /* Tried to ask for DNSSEC RRs, on a server that doesn't do DNSSEC */
1735 dns_transaction_complete(t, DNS_TRANSACTION_RR_TYPE_UNSUPPORTED);
1736 return 0;
1737 }
1738 if (t->scope->protocol == DNS_PROTOCOL_LLMNR && ERRNO_IS_DISCONNECT(-r)) {
1739 /* On LLMNR, if we cannot connect to a host via TCP when doing reverse lookups. This means we cannot
1740 * answer this request with this protocol. */
1741 dns_transaction_complete(t, DNS_TRANSACTION_NOT_FOUND);
1742 return 0;
1743 }
1744 if (r < 0) {
1745 if (t->scope->protocol != DNS_PROTOCOL_DNS)
1746 return r;
1747
1748 /* Couldn't send? Try immediately again, with a new server */
1749 dns_scope_next_dns_server(t->scope);
1750
1751 return dns_transaction_go(t);
1752 }
1753
1754 ts += transaction_get_resend_timeout(t);
1755
1756 r = sd_event_add_time(
1757 t->scope->manager->event,
1758 &t->timeout_event_source,
1759 clock_boottime_or_monotonic(),
1760 ts, 0,
1761 on_transaction_timeout, t);
1762 if (r < 0)
1763 return r;
1764
1765 (void) sd_event_source_set_description(t->timeout_event_source, "dns-transaction-timeout");
1766
1767 t->state = DNS_TRANSACTION_PENDING;
1768 t->next_attempt_after = ts;
1769
1770 return 1;
1771 }
1772
1773 static int dns_transaction_find_cyclic(DnsTransaction *t, DnsTransaction *aux) {
1774 DnsTransaction *n;
1775 Iterator i;
1776 int r;
1777
1778 assert(t);
1779 assert(aux);
1780
1781 /* Try to find cyclic dependencies between transaction objects */
1782
1783 if (t == aux)
1784 return 1;
1785
1786 SET_FOREACH(n, aux->dnssec_transactions, i) {
1787 r = dns_transaction_find_cyclic(t, n);
1788 if (r != 0)
1789 return r;
1790 }
1791
1792 return 0;
1793 }
1794
1795 static int dns_transaction_add_dnssec_transaction(DnsTransaction *t, DnsResourceKey *key, DnsTransaction **ret) {
1796 DnsTransaction *aux;
1797 int r;
1798
1799 assert(t);
1800 assert(ret);
1801 assert(key);
1802
1803 aux = dns_scope_find_transaction(t->scope, key, true);
1804 if (!aux) {
1805 r = dns_transaction_new(&aux, t->scope, key);
1806 if (r < 0)
1807 return r;
1808 } else {
1809 if (set_contains(t->dnssec_transactions, aux)) {
1810 *ret = aux;
1811 return 0;
1812 }
1813
1814 r = dns_transaction_find_cyclic(t, aux);
1815 if (r < 0)
1816 return r;
1817 if (r > 0) {
1818 char s[DNS_RESOURCE_KEY_STRING_MAX], saux[DNS_RESOURCE_KEY_STRING_MAX];
1819
1820 return log_debug_errno(SYNTHETIC_ERRNO(ELOOP),
1821 "Potential cyclic dependency, refusing to add transaction %" PRIu16 " (%s) as dependency for %" PRIu16 " (%s).",
1822 aux->id,
1823 dns_resource_key_to_string(t->key, s, sizeof s),
1824 t->id,
1825 dns_resource_key_to_string(aux->key, saux, sizeof saux));
1826 }
1827 }
1828
1829 r = set_ensure_allocated(&t->dnssec_transactions, NULL);
1830 if (r < 0)
1831 goto gc;
1832
1833 r = set_ensure_allocated(&aux->notify_transactions, NULL);
1834 if (r < 0)
1835 goto gc;
1836
1837 r = set_ensure_allocated(&aux->notify_transactions_done, NULL);
1838 if (r < 0)
1839 goto gc;
1840
1841 r = set_put(t->dnssec_transactions, aux);
1842 if (r < 0)
1843 goto gc;
1844
1845 r = set_put(aux->notify_transactions, t);
1846 if (r < 0) {
1847 (void) set_remove(t->dnssec_transactions, aux);
1848 goto gc;
1849 }
1850
1851 *ret = aux;
1852 return 1;
1853
1854 gc:
1855 dns_transaction_gc(aux);
1856 return r;
1857 }
1858
1859 static int dns_transaction_request_dnssec_rr(DnsTransaction *t, DnsResourceKey *key) {
1860 _cleanup_(dns_answer_unrefp) DnsAnswer *a = NULL;
1861 DnsTransaction *aux;
1862 int r;
1863
1864 assert(t);
1865 assert(key);
1866
1867 /* Try to get the data from the trust anchor */
1868 r = dns_trust_anchor_lookup_positive(&t->scope->manager->trust_anchor, key, &a);
1869 if (r < 0)
1870 return r;
1871 if (r > 0) {
1872 r = dns_answer_extend(&t->validated_keys, a);
1873 if (r < 0)
1874 return r;
1875
1876 return 0;
1877 }
1878
1879 /* This didn't work, ask for it via the network/cache then. */
1880 r = dns_transaction_add_dnssec_transaction(t, key, &aux);
1881 if (r == -ELOOP) /* This would result in a cyclic dependency */
1882 return 0;
1883 if (r < 0)
1884 return r;
1885
1886 if (aux->state == DNS_TRANSACTION_NULL) {
1887 r = dns_transaction_go(aux);
1888 if (r < 0)
1889 return r;
1890 }
1891
1892 return 1;
1893 }
1894
1895 static int dns_transaction_negative_trust_anchor_lookup(DnsTransaction *t, const char *name) {
1896 int r;
1897
1898 assert(t);
1899
1900 /* Check whether the specified name is in the NTA
1901 * database, either in the global one, or the link-local
1902 * one. */
1903
1904 r = dns_trust_anchor_lookup_negative(&t->scope->manager->trust_anchor, name);
1905 if (r != 0)
1906 return r;
1907
1908 if (!t->scope->link)
1909 return 0;
1910
1911 return set_contains(t->scope->link->dnssec_negative_trust_anchors, name);
1912 }
1913
1914 static int dns_transaction_has_unsigned_negative_answer(DnsTransaction *t) {
1915 int r;
1916
1917 assert(t);
1918
1919 /* Checks whether the answer is negative, and lacks NSEC/NSEC3
1920 * RRs to prove it */
1921
1922 r = dns_transaction_has_positive_answer(t, NULL);
1923 if (r < 0)
1924 return r;
1925 if (r > 0)
1926 return false;
1927
1928 /* Is this key explicitly listed as a negative trust anchor?
1929 * If so, it's nothing we need to care about */
1930 r = dns_transaction_negative_trust_anchor_lookup(t, dns_resource_key_name(t->key));
1931 if (r < 0)
1932 return r;
1933 if (r > 0)
1934 return false;
1935
1936 /* The answer does not contain any RRs that match to the
1937 * question. If so, let's see if there are any NSEC/NSEC3 RRs
1938 * included. If not, the answer is unsigned. */
1939
1940 r = dns_answer_contains_nsec_or_nsec3(t->answer);
1941 if (r < 0)
1942 return r;
1943 if (r > 0)
1944 return false;
1945
1946 return true;
1947 }
1948
1949 static int dns_transaction_is_primary_response(DnsTransaction *t, DnsResourceRecord *rr) {
1950 int r;
1951
1952 assert(t);
1953 assert(rr);
1954
1955 /* Check if the specified RR is the "primary" response,
1956 * i.e. either matches the question precisely or is a
1957 * CNAME/DNAME for it. */
1958
1959 r = dns_resource_key_match_rr(t->key, rr, NULL);
1960 if (r != 0)
1961 return r;
1962
1963 return dns_resource_key_match_cname_or_dname(t->key, rr->key, NULL);
1964 }
1965
1966 static bool dns_transaction_dnssec_supported(DnsTransaction *t) {
1967 assert(t);
1968
1969 /* Checks whether our transaction's DNS server is assumed to be compatible with DNSSEC. Returns false as soon
1970 * as we changed our mind about a server, and now believe it is incompatible with DNSSEC. */
1971
1972 if (t->scope->protocol != DNS_PROTOCOL_DNS)
1973 return false;
1974
1975 /* If we have picked no server, then we are working from the cache or some other source, and DNSSEC might well
1976 * be supported, hence return true. */
1977 if (!t->server)
1978 return true;
1979
1980 /* Note that we do not check the feature level actually used for the transaction but instead the feature level
1981 * the server is known to support currently, as the transaction feature level might be lower than what the
1982 * server actually supports, since we might have downgraded this transaction's feature level because we got a
1983 * SERVFAIL earlier and wanted to check whether downgrading fixes it. */
1984
1985 return dns_server_dnssec_supported(t->server);
1986 }
1987
1988 static bool dns_transaction_dnssec_supported_full(DnsTransaction *t) {
1989 DnsTransaction *dt;
1990 Iterator i;
1991
1992 assert(t);
1993
1994 /* Checks whether our transaction our any of the auxiliary transactions couldn't do DNSSEC. */
1995
1996 if (!dns_transaction_dnssec_supported(t))
1997 return false;
1998
1999 SET_FOREACH(dt, t->dnssec_transactions, i)
2000 if (!dns_transaction_dnssec_supported(dt))
2001 return false;
2002
2003 return true;
2004 }
2005
2006 int dns_transaction_request_dnssec_keys(DnsTransaction *t) {
2007 DnsResourceRecord *rr;
2008
2009 int r;
2010
2011 assert(t);
2012
2013 /*
2014 * Retrieve all auxiliary RRs for the answer we got, so that
2015 * we can verify signatures or prove that RRs are rightfully
2016 * unsigned. Specifically:
2017 *
2018 * - For RRSIG we get the matching DNSKEY
2019 * - For DNSKEY we get the matching DS
2020 * - For unsigned SOA/NS we get the matching DS
2021 * - For unsigned CNAME/DNAME/DS we get the parent SOA RR
2022 * - For other unsigned RRs we get the matching SOA RR
2023 * - For SOA/NS queries with no matching response RR, and no NSEC/NSEC3, the DS RR
2024 * - For DS queries with no matching response RRs, and no NSEC/NSEC3, the parent's SOA RR
2025 * - For other queries with no matching response RRs, and no NSEC/NSEC3, the SOA RR
2026 */
2027
2028 if (t->scope->dnssec_mode == DNSSEC_NO)
2029 return 0;
2030 if (t->answer_source != DNS_TRANSACTION_NETWORK)
2031 return 0; /* We only need to validate stuff from the network */
2032 if (!dns_transaction_dnssec_supported(t))
2033 return 0; /* If we can't do DNSSEC anyway there's no point in geting the auxiliary RRs */
2034
2035 DNS_ANSWER_FOREACH(rr, t->answer) {
2036
2037 if (dns_type_is_pseudo(rr->key->type))
2038 continue;
2039
2040 /* If this RR is in the negative trust anchor, we don't need to validate it. */
2041 r = dns_transaction_negative_trust_anchor_lookup(t, dns_resource_key_name(rr->key));
2042 if (r < 0)
2043 return r;
2044 if (r > 0)
2045 continue;
2046
2047 switch (rr->key->type) {
2048
2049 case DNS_TYPE_RRSIG: {
2050 /* For each RRSIG we request the matching DNSKEY */
2051 _cleanup_(dns_resource_key_unrefp) DnsResourceKey *dnskey = NULL;
2052
2053 /* If this RRSIG is about a DNSKEY RR and the
2054 * signer is the same as the owner, then we
2055 * already have the DNSKEY, and we don't have
2056 * to look for more. */
2057 if (rr->rrsig.type_covered == DNS_TYPE_DNSKEY) {
2058 r = dns_name_equal(rr->rrsig.signer, dns_resource_key_name(rr->key));
2059 if (r < 0)
2060 return r;
2061 if (r > 0)
2062 continue;
2063 }
2064
2065 /* If the signer is not a parent of our
2066 * original query, then this is about an
2067 * auxiliary RRset, but not anything we asked
2068 * for. In this case we aren't interested,
2069 * because we don't want to request additional
2070 * RRs for stuff we didn't really ask for, and
2071 * also to avoid request loops, where
2072 * additional RRs from one transaction result
2073 * in another transaction whose additonal RRs
2074 * point back to the original transaction, and
2075 * we deadlock. */
2076 r = dns_name_endswith(dns_resource_key_name(t->key), rr->rrsig.signer);
2077 if (r < 0)
2078 return r;
2079 if (r == 0)
2080 continue;
2081
2082 dnskey = dns_resource_key_new(rr->key->class, DNS_TYPE_DNSKEY, rr->rrsig.signer);
2083 if (!dnskey)
2084 return -ENOMEM;
2085
2086 log_debug("Requesting DNSKEY to validate transaction %" PRIu16" (%s, RRSIG with key tag: %" PRIu16 ").",
2087 t->id, dns_resource_key_name(rr->key), rr->rrsig.key_tag);
2088 r = dns_transaction_request_dnssec_rr(t, dnskey);
2089 if (r < 0)
2090 return r;
2091 break;
2092 }
2093
2094 case DNS_TYPE_DNSKEY: {
2095 /* For each DNSKEY we request the matching DS */
2096 _cleanup_(dns_resource_key_unrefp) DnsResourceKey *ds = NULL;
2097
2098 /* If the DNSKEY we are looking at is not for
2099 * zone we are interested in, nor any of its
2100 * parents, we aren't interested, and don't
2101 * request it. After all, we don't want to end
2102 * up in request loops, and want to keep
2103 * additional traffic down. */
2104
2105 r = dns_name_endswith(dns_resource_key_name(t->key), dns_resource_key_name(rr->key));
2106 if (r < 0)
2107 return r;
2108 if (r == 0)
2109 continue;
2110
2111 ds = dns_resource_key_new(rr->key->class, DNS_TYPE_DS, dns_resource_key_name(rr->key));
2112 if (!ds)
2113 return -ENOMEM;
2114
2115 log_debug("Requesting DS to validate transaction %" PRIu16" (%s, DNSKEY with key tag: %" PRIu16 ").",
2116 t->id, dns_resource_key_name(rr->key), dnssec_keytag(rr, false));
2117 r = dns_transaction_request_dnssec_rr(t, ds);
2118 if (r < 0)
2119 return r;
2120
2121 break;
2122 }
2123
2124 case DNS_TYPE_SOA:
2125 case DNS_TYPE_NS: {
2126 _cleanup_(dns_resource_key_unrefp) DnsResourceKey *ds = NULL;
2127
2128 /* For an unsigned SOA or NS, try to acquire
2129 * the matching DS RR, as we are at a zone cut
2130 * then, and whether a DS exists tells us
2131 * whether the zone is signed. Do so only if
2132 * this RR matches our original question,
2133 * however. */
2134
2135 r = dns_resource_key_match_rr(t->key, rr, NULL);
2136 if (r < 0)
2137 return r;
2138 if (r == 0) {
2139 /* Hmm, so this SOA RR doesn't match our original question. In this case, maybe this is
2140 * a negative reply, and we need the a SOA RR's TTL in order to cache a negative entry?
2141 * If so, we need to validate it, too. */
2142
2143 r = dns_answer_match_key(t->answer, t->key, NULL);
2144 if (r < 0)
2145 return r;
2146 if (r > 0) /* positive reply, we won't need the SOA and hence don't need to validate
2147 * it. */
2148 continue;
2149 }
2150
2151 r = dnssec_has_rrsig(t->answer, rr->key);
2152 if (r < 0)
2153 return r;
2154 if (r > 0)
2155 continue;
2156
2157 ds = dns_resource_key_new(rr->key->class, DNS_TYPE_DS, dns_resource_key_name(rr->key));
2158 if (!ds)
2159 return -ENOMEM;
2160
2161 log_debug("Requesting DS to validate transaction %" PRIu16 " (%s, unsigned SOA/NS RRset).",
2162 t->id, dns_resource_key_name(rr->key));
2163 r = dns_transaction_request_dnssec_rr(t, ds);
2164 if (r < 0)
2165 return r;
2166
2167 break;
2168 }
2169
2170 case DNS_TYPE_DS:
2171 case DNS_TYPE_CNAME:
2172 case DNS_TYPE_DNAME: {
2173 _cleanup_(dns_resource_key_unrefp) DnsResourceKey *soa = NULL;
2174 const char *name;
2175
2176 /* CNAMEs and DNAMEs cannot be located at a
2177 * zone apex, hence ask for the parent SOA for
2178 * unsigned CNAME/DNAME RRs, maybe that's the
2179 * apex. But do all that only if this is
2180 * actually a response to our original
2181 * question.
2182 *
2183 * Similar for DS RRs, which are signed when
2184 * the parent SOA is signed. */
2185
2186 r = dns_transaction_is_primary_response(t, rr);
2187 if (r < 0)
2188 return r;
2189 if (r == 0)
2190 continue;
2191
2192 r = dnssec_has_rrsig(t->answer, rr->key);
2193 if (r < 0)
2194 return r;
2195 if (r > 0)
2196 continue;
2197
2198 r = dns_answer_has_dname_for_cname(t->answer, rr);
2199 if (r < 0)
2200 return r;
2201 if (r > 0)
2202 continue;
2203
2204 name = dns_resource_key_name(rr->key);
2205 r = dns_name_parent(&name);
2206 if (r < 0)
2207 return r;
2208 if (r == 0)
2209 continue;
2210
2211 soa = dns_resource_key_new(rr->key->class, DNS_TYPE_SOA, name);
2212 if (!soa)
2213 return -ENOMEM;
2214
2215 log_debug("Requesting parent SOA to validate transaction %" PRIu16 " (%s, unsigned CNAME/DNAME/DS RRset).",
2216 t->id, dns_resource_key_name(rr->key));
2217 r = dns_transaction_request_dnssec_rr(t, soa);
2218 if (r < 0)
2219 return r;
2220
2221 break;
2222 }
2223
2224 default: {
2225 _cleanup_(dns_resource_key_unrefp) DnsResourceKey *soa = NULL;
2226
2227 /* For other unsigned RRsets (including
2228 * NSEC/NSEC3!), look for proof the zone is
2229 * unsigned, by requesting the SOA RR of the
2230 * zone. However, do so only if they are
2231 * directly relevant to our original
2232 * question. */
2233
2234 r = dns_transaction_is_primary_response(t, rr);
2235 if (r < 0)
2236 return r;
2237 if (r == 0)
2238 continue;
2239
2240 r = dnssec_has_rrsig(t->answer, rr->key);
2241 if (r < 0)
2242 return r;
2243 if (r > 0)
2244 continue;
2245
2246 soa = dns_resource_key_new(rr->key->class, DNS_TYPE_SOA, dns_resource_key_name(rr->key));
2247 if (!soa)
2248 return -ENOMEM;
2249
2250 log_debug("Requesting SOA to validate transaction %" PRIu16 " (%s, unsigned non-SOA/NS RRset <%s>).",
2251 t->id, dns_resource_key_name(rr->key), dns_resource_record_to_string(rr));
2252 r = dns_transaction_request_dnssec_rr(t, soa);
2253 if (r < 0)
2254 return r;
2255 break;
2256 }}
2257 }
2258
2259 /* Above, we requested everything necessary to validate what
2260 * we got. Now, let's request what we need to validate what we
2261 * didn't get... */
2262
2263 r = dns_transaction_has_unsigned_negative_answer(t);
2264 if (r < 0)
2265 return r;
2266 if (r > 0) {
2267 const char *name;
2268 uint16_t type = 0;
2269
2270 name = dns_resource_key_name(t->key);
2271
2272 /* If this was a SOA or NS request, then check if there's a DS RR for the same domain. Note that this
2273 * could also be used as indication that we are not at a zone apex, but in real world setups there are
2274 * too many broken DNS servers (Hello, incapdns.net!) where non-terminal zones return NXDOMAIN even
2275 * though they have further children. If this was a DS request, then it's signed when the parent zone
2276 * is signed, hence ask the parent SOA in that case. If this was any other RR then ask for the SOA RR,
2277 * to see if that is signed. */
2278
2279 if (t->key->type == DNS_TYPE_DS) {
2280 r = dns_name_parent(&name);
2281 if (r > 0) {
2282 type = DNS_TYPE_SOA;
2283 log_debug("Requesting parent SOA to validate transaction %" PRIu16 " (%s, unsigned empty DS response).",
2284 t->id, dns_resource_key_name(t->key));
2285 } else
2286 name = NULL;
2287
2288 } else if (IN_SET(t->key->type, DNS_TYPE_SOA, DNS_TYPE_NS)) {
2289
2290 type = DNS_TYPE_DS;
2291 log_debug("Requesting DS to validate transaction %" PRIu16 " (%s, unsigned empty SOA/NS response).",
2292 t->id, dns_resource_key_name(t->key));
2293
2294 } else {
2295 type = DNS_TYPE_SOA;
2296 log_debug("Requesting SOA to validate transaction %" PRIu16 " (%s, unsigned empty non-SOA/NS/DS response).",
2297 t->id, dns_resource_key_name(t->key));
2298 }
2299
2300 if (name) {
2301 _cleanup_(dns_resource_key_unrefp) DnsResourceKey *soa = NULL;
2302
2303 soa = dns_resource_key_new(t->key->class, type, name);
2304 if (!soa)
2305 return -ENOMEM;
2306
2307 r = dns_transaction_request_dnssec_rr(t, soa);
2308 if (r < 0)
2309 return r;
2310 }
2311 }
2312
2313 return dns_transaction_dnssec_is_live(t);
2314 }
2315
2316 void dns_transaction_notify(DnsTransaction *t, DnsTransaction *source) {
2317 assert(t);
2318 assert(source);
2319
2320 /* Invoked whenever any of our auxiliary DNSSEC transactions completed its work. If the state is still PENDING,
2321 we are still in the loop that adds further DNSSEC transactions, hence don't check if we are ready yet. If
2322 the state is VALIDATING however, we should check if we are complete now. */
2323
2324 if (t->state == DNS_TRANSACTION_VALIDATING)
2325 dns_transaction_process_dnssec(t);
2326 }
2327
2328 static int dns_transaction_validate_dnskey_by_ds(DnsTransaction *t) {
2329 DnsResourceRecord *rr;
2330 int ifindex, r;
2331
2332 assert(t);
2333
2334 /* Add all DNSKEY RRs from the answer that are validated by DS
2335 * RRs from the list of validated keys to the list of
2336 * validated keys. */
2337
2338 DNS_ANSWER_FOREACH_IFINDEX(rr, ifindex, t->answer) {
2339
2340 r = dnssec_verify_dnskey_by_ds_search(rr, t->validated_keys);
2341 if (r < 0)
2342 return r;
2343 if (r == 0)
2344 continue;
2345
2346 /* If so, the DNSKEY is validated too. */
2347 r = dns_answer_add_extend(&t->validated_keys, rr, ifindex, DNS_ANSWER_AUTHENTICATED);
2348 if (r < 0)
2349 return r;
2350 }
2351
2352 return 0;
2353 }
2354
2355 static int dns_transaction_requires_rrsig(DnsTransaction *t, DnsResourceRecord *rr) {
2356 int r;
2357
2358 assert(t);
2359 assert(rr);
2360
2361 /* Checks if the RR we are looking for must be signed with an
2362 * RRSIG. This is used for positive responses. */
2363
2364 if (t->scope->dnssec_mode == DNSSEC_NO)
2365 return false;
2366
2367 if (dns_type_is_pseudo(rr->key->type))
2368 return -EINVAL;
2369
2370 r = dns_transaction_negative_trust_anchor_lookup(t, dns_resource_key_name(rr->key));
2371 if (r < 0)
2372 return r;
2373 if (r > 0)
2374 return false;
2375
2376 switch (rr->key->type) {
2377
2378 case DNS_TYPE_RRSIG:
2379 /* RRSIGs are the signatures themselves, they need no signing. */
2380 return false;
2381
2382 case DNS_TYPE_SOA:
2383 case DNS_TYPE_NS: {
2384 DnsTransaction *dt;
2385 Iterator i;
2386
2387 /* For SOA or NS RRs we look for a matching DS transaction */
2388
2389 SET_FOREACH(dt, t->dnssec_transactions, i) {
2390
2391 if (dt->key->class != rr->key->class)
2392 continue;
2393 if (dt->key->type != DNS_TYPE_DS)
2394 continue;
2395
2396 r = dns_name_equal(dns_resource_key_name(dt->key), dns_resource_key_name(rr->key));
2397 if (r < 0)
2398 return r;
2399 if (r == 0)
2400 continue;
2401
2402 /* We found a DS transactions for the SOA/NS
2403 * RRs we are looking at. If it discovered signed DS
2404 * RRs, then we need to be signed, too. */
2405
2406 if (!dt->answer_authenticated)
2407 return false;
2408
2409 return dns_answer_match_key(dt->answer, dt->key, NULL);
2410 }
2411
2412 /* We found nothing that proves this is safe to leave
2413 * this unauthenticated, hence ask inist on
2414 * authentication. */
2415 return true;
2416 }
2417
2418 case DNS_TYPE_DS:
2419 case DNS_TYPE_CNAME:
2420 case DNS_TYPE_DNAME: {
2421 const char *parent = NULL;
2422 DnsTransaction *dt;
2423 Iterator i;
2424
2425 /*
2426 * CNAME/DNAME RRs cannot be located at a zone apex, hence look directly for the parent SOA.
2427 *
2428 * DS RRs are signed if the parent is signed, hence also look at the parent SOA
2429 */
2430
2431 SET_FOREACH(dt, t->dnssec_transactions, i) {
2432
2433 if (dt->key->class != rr->key->class)
2434 continue;
2435 if (dt->key->type != DNS_TYPE_SOA)
2436 continue;
2437
2438 if (!parent) {
2439 parent = dns_resource_key_name(rr->key);
2440 r = dns_name_parent(&parent);
2441 if (r < 0)
2442 return r;
2443 if (r == 0) {
2444 if (rr->key->type == DNS_TYPE_DS)
2445 return true;
2446
2447 /* A CNAME/DNAME without a parent? That's sooo weird. */
2448 return log_debug_errno(SYNTHETIC_ERRNO(EBADMSG),
2449 "Transaction %" PRIu16 " claims CNAME/DNAME at root. Refusing.", t->id);
2450 }
2451 }
2452
2453 r = dns_name_equal(dns_resource_key_name(dt->key), parent);
2454 if (r < 0)
2455 return r;
2456 if (r == 0)
2457 continue;
2458
2459 return t->answer_authenticated;
2460 }
2461
2462 return true;
2463 }
2464
2465 default: {
2466 DnsTransaction *dt;
2467 Iterator i;
2468
2469 /* Any other kind of RR (including DNSKEY/NSEC/NSEC3). Let's see if our SOA lookup was authenticated */
2470
2471 SET_FOREACH(dt, t->dnssec_transactions, i) {
2472
2473 if (dt->key->class != rr->key->class)
2474 continue;
2475 if (dt->key->type != DNS_TYPE_SOA)
2476 continue;
2477
2478 r = dns_name_equal(dns_resource_key_name(dt->key), dns_resource_key_name(rr->key));
2479 if (r < 0)
2480 return r;
2481 if (r == 0)
2482 continue;
2483
2484 /* We found the transaction that was supposed to find
2485 * the SOA RR for us. It was successful, but found no
2486 * RR for us. This means we are not at a zone cut. In
2487 * this case, we require authentication if the SOA
2488 * lookup was authenticated too. */
2489 return t->answer_authenticated;
2490 }
2491
2492 return true;
2493 }}
2494 }
2495
2496 static int dns_transaction_in_private_tld(DnsTransaction *t, const DnsResourceKey *key) {
2497 DnsTransaction *dt;
2498 const char *tld;
2499 Iterator i;
2500 int r;
2501
2502 /* If DNSSEC downgrade mode is on, checks whether the
2503 * specified RR is one level below a TLD we have proven not to
2504 * exist. In such a case we assume that this is a private
2505 * domain, and permit it.
2506 *
2507 * This detects cases like the Fritz!Box router networks. Each
2508 * Fritz!Box router serves a private "fritz.box" zone, in the
2509 * non-existing TLD "box". Requests for the "fritz.box" domain
2510 * are served by the router itself, while requests for the
2511 * "box" domain will result in NXDOMAIN.
2512 *
2513 * Note that this logic is unable to detect cases where a
2514 * router serves a private DNS zone directly under
2515 * non-existing TLD. In such a case we cannot detect whether
2516 * the TLD is supposed to exist or not, as all requests we
2517 * make for it will be answered by the router's zone, and not
2518 * by the root zone. */
2519
2520 assert(t);
2521
2522 if (t->scope->dnssec_mode != DNSSEC_ALLOW_DOWNGRADE)
2523 return false; /* In strict DNSSEC mode what doesn't exist, doesn't exist */
2524
2525 tld = dns_resource_key_name(key);
2526 r = dns_name_parent(&tld);
2527 if (r < 0)
2528 return r;
2529 if (r == 0)
2530 return false; /* Already the root domain */
2531
2532 if (!dns_name_is_single_label(tld))
2533 return false;
2534
2535 SET_FOREACH(dt, t->dnssec_transactions, i) {
2536
2537 if (dt->key->class != key->class)
2538 continue;
2539
2540 r = dns_name_equal(dns_resource_key_name(dt->key), tld);
2541 if (r < 0)
2542 return r;
2543 if (r == 0)
2544 continue;
2545
2546 /* We found an auxiliary lookup we did for the TLD. If
2547 * that returned with NXDOMAIN, we know the TLD didn't
2548 * exist, and hence this might be a private zone. */
2549
2550 return dt->answer_rcode == DNS_RCODE_NXDOMAIN;
2551 }
2552
2553 return false;
2554 }
2555
2556 static int dns_transaction_requires_nsec(DnsTransaction *t) {
2557 char key_str[DNS_RESOURCE_KEY_STRING_MAX];
2558 DnsTransaction *dt;
2559 const char *name;
2560 uint16_t type = 0;
2561 Iterator i;
2562 int r;
2563
2564 assert(t);
2565
2566 /* Checks if we need to insist on NSEC/NSEC3 RRs for proving
2567 * this negative reply */
2568
2569 if (t->scope->dnssec_mode == DNSSEC_NO)
2570 return false;
2571
2572 if (dns_type_is_pseudo(t->key->type))
2573 return -EINVAL;
2574
2575 r = dns_transaction_negative_trust_anchor_lookup(t, dns_resource_key_name(t->key));
2576 if (r < 0)
2577 return r;
2578 if (r > 0)
2579 return false;
2580
2581 r = dns_transaction_in_private_tld(t, t->key);
2582 if (r < 0)
2583 return r;
2584 if (r > 0) {
2585 /* The lookup is from a TLD that is proven not to
2586 * exist, and we are in downgrade mode, hence ignore
2587 * that fact that we didn't get any NSEC RRs. */
2588
2589 log_info("Detected a negative query %s in a private DNS zone, permitting unsigned response.",
2590 dns_resource_key_to_string(t->key, key_str, sizeof key_str));
2591 return false;
2592 }
2593
2594 name = dns_resource_key_name(t->key);
2595
2596 if (t->key->type == DNS_TYPE_DS) {
2597
2598 /* We got a negative reply for this DS lookup? DS RRs are signed when their parent zone is signed,
2599 * hence check the parent SOA in this case. */
2600
2601 r = dns_name_parent(&name);
2602 if (r < 0)
2603 return r;
2604 if (r == 0)
2605 return true;
2606
2607 type = DNS_TYPE_SOA;
2608
2609 } else if (IN_SET(t->key->type, DNS_TYPE_SOA, DNS_TYPE_NS))
2610 /* We got a negative reply for this SOA/NS lookup? If so, check if there's a DS RR for this */
2611 type = DNS_TYPE_DS;
2612 else
2613 /* For all other negative replies, check for the SOA lookup */
2614 type = DNS_TYPE_SOA;
2615
2616 /* For all other RRs we check the SOA on the same level to see
2617 * if it's signed. */
2618
2619 SET_FOREACH(dt, t->dnssec_transactions, i) {
2620
2621 if (dt->key->class != t->key->class)
2622 continue;
2623 if (dt->key->type != type)
2624 continue;
2625
2626 r = dns_name_equal(dns_resource_key_name(dt->key), name);
2627 if (r < 0)
2628 return r;
2629 if (r == 0)
2630 continue;
2631
2632 return dt->answer_authenticated;
2633 }
2634
2635 /* If in doubt, require NSEC/NSEC3 */
2636 return true;
2637 }
2638
2639 static int dns_transaction_dnskey_authenticated(DnsTransaction *t, DnsResourceRecord *rr) {
2640 DnsResourceRecord *rrsig;
2641 bool found = false;
2642 int r;
2643
2644 /* Checks whether any of the DNSKEYs used for the RRSIGs for
2645 * the specified RRset is authenticated (i.e. has a matching
2646 * DS RR). */
2647
2648 r = dns_transaction_negative_trust_anchor_lookup(t, dns_resource_key_name(rr->key));
2649 if (r < 0)
2650 return r;
2651 if (r > 0)
2652 return false;
2653
2654 DNS_ANSWER_FOREACH(rrsig, t->answer) {
2655 DnsTransaction *dt;
2656 Iterator i;
2657
2658 r = dnssec_key_match_rrsig(rr->key, rrsig);
2659 if (r < 0)
2660 return r;
2661 if (r == 0)
2662 continue;
2663
2664 SET_FOREACH(dt, t->dnssec_transactions, i) {
2665
2666 if (dt->key->class != rr->key->class)
2667 continue;
2668
2669 if (dt->key->type == DNS_TYPE_DNSKEY) {
2670
2671 r = dns_name_equal(dns_resource_key_name(dt->key), rrsig->rrsig.signer);
2672 if (r < 0)
2673 return r;
2674 if (r == 0)
2675 continue;
2676
2677 /* OK, we found an auxiliary DNSKEY
2678 * lookup. If that lookup is
2679 * authenticated, report this. */
2680
2681 if (dt->answer_authenticated)
2682 return true;
2683
2684 found = true;
2685
2686 } else if (dt->key->type == DNS_TYPE_DS) {
2687
2688 r = dns_name_equal(dns_resource_key_name(dt->key), rrsig->rrsig.signer);
2689 if (r < 0)
2690 return r;
2691 if (r == 0)
2692 continue;
2693
2694 /* OK, we found an auxiliary DS
2695 * lookup. If that lookup is
2696 * authenticated and non-zero, we
2697 * won! */
2698
2699 if (!dt->answer_authenticated)
2700 return false;
2701
2702 return dns_answer_match_key(dt->answer, dt->key, NULL);
2703 }
2704 }
2705 }
2706
2707 return found ? false : -ENXIO;
2708 }
2709
2710 static int dns_transaction_known_signed(DnsTransaction *t, DnsResourceRecord *rr) {
2711 assert(t);
2712 assert(rr);
2713
2714 /* We know that the root domain is signed, hence if it appears
2715 * not to be signed, there's a problem with the DNS server */
2716
2717 return rr->key->class == DNS_CLASS_IN &&
2718 dns_name_is_root(dns_resource_key_name(rr->key));
2719 }
2720
2721 static int dns_transaction_check_revoked_trust_anchors(DnsTransaction *t) {
2722 DnsResourceRecord *rr;
2723 int r;
2724
2725 assert(t);
2726
2727 /* Maybe warn the user that we encountered a revoked DNSKEY
2728 * for a key from our trust anchor. Note that we don't care
2729 * whether the DNSKEY can be authenticated or not. It's
2730 * sufficient if it is self-signed. */
2731
2732 DNS_ANSWER_FOREACH(rr, t->answer) {
2733 r = dns_trust_anchor_check_revoked(&t->scope->manager->trust_anchor, rr, t->answer);
2734 if (r < 0)
2735 return r;
2736 }
2737
2738 return 0;
2739 }
2740
2741 static int dns_transaction_invalidate_revoked_keys(DnsTransaction *t) {
2742 bool changed;
2743 int r;
2744
2745 assert(t);
2746
2747 /* Removes all DNSKEY/DS objects from t->validated_keys that
2748 * our trust anchors database considers revoked. */
2749
2750 do {
2751 DnsResourceRecord *rr;
2752
2753 changed = false;
2754
2755 DNS_ANSWER_FOREACH(rr, t->validated_keys) {
2756 r = dns_trust_anchor_is_revoked(&t->scope->manager->trust_anchor, rr);
2757 if (r < 0)
2758 return r;
2759 if (r > 0) {
2760 r = dns_answer_remove_by_rr(&t->validated_keys, rr);
2761 if (r < 0)
2762 return r;
2763
2764 assert(r > 0);
2765 changed = true;
2766 break;
2767 }
2768 }
2769 } while (changed);
2770
2771 return 0;
2772 }
2773
2774 static int dns_transaction_copy_validated(DnsTransaction *t) {
2775 DnsTransaction *dt;
2776 Iterator i;
2777 int r;
2778
2779 assert(t);
2780
2781 /* Copy all validated RRs from the auxiliary DNSSEC transactions into our set of validated RRs */
2782
2783 SET_FOREACH(dt, t->dnssec_transactions, i) {
2784
2785 if (DNS_TRANSACTION_IS_LIVE(dt->state))
2786 continue;
2787
2788 if (!dt->answer_authenticated)
2789 continue;
2790
2791 r = dns_answer_extend(&t->validated_keys, dt->answer);
2792 if (r < 0)
2793 return r;
2794 }
2795
2796 return 0;
2797 }
2798
2799 typedef enum {
2800 DNSSEC_PHASE_DNSKEY, /* Phase #1, only validate DNSKEYs */
2801 DNSSEC_PHASE_NSEC, /* Phase #2, only validate NSEC+NSEC3 */
2802 DNSSEC_PHASE_ALL, /* Phase #3, validate everything else */
2803 } Phase;
2804
2805 static int dnssec_validate_records(
2806 DnsTransaction *t,
2807 Phase phase,
2808 bool *have_nsec,
2809 DnsAnswer **validated) {
2810
2811 DnsResourceRecord *rr;
2812 int r;
2813
2814 /* Returns negative on error, 0 if validation failed, 1 to restart validation, 2 when finished. */
2815
2816 DNS_ANSWER_FOREACH(rr, t->answer) {
2817 DnsResourceRecord *rrsig = NULL;
2818 DnssecResult result;
2819
2820 switch (rr->key->type) {
2821 case DNS_TYPE_RRSIG:
2822 continue;
2823
2824 case DNS_TYPE_DNSKEY:
2825 /* We validate DNSKEYs only in the DNSKEY and ALL phases */
2826 if (phase == DNSSEC_PHASE_NSEC)
2827 continue;
2828 break;
2829
2830 case DNS_TYPE_NSEC:
2831 case DNS_TYPE_NSEC3:
2832 *have_nsec = true;
2833
2834 /* We validate NSEC/NSEC3 only in the NSEC and ALL phases */
2835 if (phase == DNSSEC_PHASE_DNSKEY)
2836 continue;
2837 break;
2838
2839 default:
2840 /* We validate all other RRs only in the ALL phases */
2841 if (phase != DNSSEC_PHASE_ALL)
2842 continue;
2843 }
2844
2845 r = dnssec_verify_rrset_search(t->answer, rr->key, t->validated_keys, USEC_INFINITY, &result, &rrsig);
2846 if (r < 0)
2847 return r;
2848
2849 log_debug("Looking at %s: %s", strna(dns_resource_record_to_string(rr)), dnssec_result_to_string(result));
2850
2851 if (result == DNSSEC_VALIDATED) {
2852
2853 if (rr->key->type == DNS_TYPE_DNSKEY) {
2854 /* If we just validated a DNSKEY RRset, then let's add these keys to
2855 * the set of validated keys for this transaction. */
2856
2857 r = dns_answer_copy_by_key(&t->validated_keys, t->answer, rr->key, DNS_ANSWER_AUTHENTICATED);
2858 if (r < 0)
2859 return r;
2860
2861 /* Some of the DNSKEYs we just added might already have been revoked,
2862 * remove them again in that case. */
2863 r = dns_transaction_invalidate_revoked_keys(t);
2864 if (r < 0)
2865 return r;
2866 }
2867
2868 /* Add the validated RRset to the new list of validated
2869 * RRsets, and remove it from the unvalidated RRsets.
2870 * We mark the RRset as authenticated and cacheable. */
2871 r = dns_answer_move_by_key(validated, &t->answer, rr->key, DNS_ANSWER_AUTHENTICATED|DNS_ANSWER_CACHEABLE);
2872 if (r < 0)
2873 return r;
2874
2875 manager_dnssec_verdict(t->scope->manager, DNSSEC_SECURE, rr->key);
2876
2877 /* Exit the loop, we dropped something from the answer, start from the beginning */
2878 return 1;
2879 }
2880
2881 /* If we haven't read all DNSKEYs yet a negative result of the validation is irrelevant, as
2882 * there might be more DNSKEYs coming. Similar, if we haven't read all NSEC/NSEC3 RRs yet,
2883 * we cannot do positive wildcard proofs yet, as those require the NSEC/NSEC3 RRs. */
2884 if (phase != DNSSEC_PHASE_ALL)
2885 continue;
2886
2887 if (result == DNSSEC_VALIDATED_WILDCARD) {
2888 bool authenticated = false;
2889 const char *source;
2890
2891 /* This RRset validated, but as a wildcard. This means we need
2892 * to prove via NSEC/NSEC3 that no matching non-wildcard RR exists. */
2893
2894 /* First step, determine the source of synthesis */
2895 r = dns_resource_record_source(rrsig, &source);
2896 if (r < 0)
2897 return r;
2898
2899 r = dnssec_test_positive_wildcard(*validated,
2900 dns_resource_key_name(rr->key),
2901 source,
2902 rrsig->rrsig.signer,
2903 &authenticated);
2904
2905 /* Unless the NSEC proof showed that the key really doesn't exist something is off. */
2906 if (r == 0)
2907 result = DNSSEC_INVALID;
2908 else {
2909 r = dns_answer_move_by_key(validated, &t->answer, rr->key,
2910 authenticated ? (DNS_ANSWER_AUTHENTICATED|DNS_ANSWER_CACHEABLE) : 0);
2911 if (r < 0)
2912 return r;
2913
2914 manager_dnssec_verdict(t->scope->manager, authenticated ? DNSSEC_SECURE : DNSSEC_INSECURE, rr->key);
2915
2916 /* Exit the loop, we dropped something from the answer, start from the beginning */
2917 return 1;
2918 }
2919 }
2920
2921 if (result == DNSSEC_NO_SIGNATURE) {
2922 r = dns_transaction_requires_rrsig(t, rr);
2923 if (r < 0)
2924 return r;
2925 if (r == 0) {
2926 /* Data does not require signing. In that case, just copy it over,
2927 * but remember that this is by no means authenticated. */
2928 r = dns_answer_move_by_key(validated, &t->answer, rr->key, 0);
2929 if (r < 0)
2930 return r;
2931
2932 manager_dnssec_verdict(t->scope->manager, DNSSEC_INSECURE, rr->key);
2933 return 1;
2934 }
2935
2936 r = dns_transaction_known_signed(t, rr);
2937 if (r < 0)
2938 return r;
2939 if (r > 0) {
2940 /* This is an RR we know has to be signed. If it isn't this means
2941 * the server is not attaching RRSIGs, hence complain. */
2942
2943 dns_server_packet_rrsig_missing(t->server, t->current_feature_level);
2944
2945 if (t->scope->dnssec_mode == DNSSEC_ALLOW_DOWNGRADE) {
2946
2947 /* Downgrading is OK? If so, just consider the information unsigned */
2948
2949 r = dns_answer_move_by_key(validated, &t->answer, rr->key, 0);
2950 if (r < 0)
2951 return r;
2952
2953 manager_dnssec_verdict(t->scope->manager, DNSSEC_INSECURE, rr->key);
2954 return 1;
2955 }
2956
2957 /* Otherwise, fail */
2958 t->answer_dnssec_result = DNSSEC_INCOMPATIBLE_SERVER;
2959 return 0;
2960 }
2961
2962 r = dns_transaction_in_private_tld(t, rr->key);
2963 if (r < 0)
2964 return r;
2965 if (r > 0) {
2966 char s[DNS_RESOURCE_KEY_STRING_MAX];
2967
2968 /* The data is from a TLD that is proven not to exist, and we are in downgrade
2969 * mode, hence ignore the fact that this was not signed. */
2970
2971 log_info("Detected RRset %s is in a private DNS zone, permitting unsigned RRs.",
2972 dns_resource_key_to_string(rr->key, s, sizeof s));
2973
2974 r = dns_answer_move_by_key(validated, &t->answer, rr->key, 0);
2975 if (r < 0)
2976 return r;
2977
2978 manager_dnssec_verdict(t->scope->manager, DNSSEC_INSECURE, rr->key);
2979 return 1;
2980 }
2981 }
2982
2983 if (IN_SET(result,
2984 DNSSEC_MISSING_KEY,
2985 DNSSEC_SIGNATURE_EXPIRED,
2986 DNSSEC_UNSUPPORTED_ALGORITHM)) {
2987
2988 r = dns_transaction_dnskey_authenticated(t, rr);
2989 if (r < 0 && r != -ENXIO)
2990 return r;
2991 if (r == 0) {
2992 /* The DNSKEY transaction was not authenticated, this means there's
2993 * no DS for this, which means it's OK if no keys are found for this signature. */
2994
2995 r = dns_answer_move_by_key(validated, &t->answer, rr->key, 0);
2996 if (r < 0)
2997 return r;
2998
2999 manager_dnssec_verdict(t->scope->manager, DNSSEC_INSECURE, rr->key);
3000 return 1;
3001 }
3002 }
3003
3004 r = dns_transaction_is_primary_response(t, rr);
3005 if (r < 0)
3006 return r;
3007 if (r > 0) {
3008 /* Look for a matching DNAME for this CNAME */
3009 r = dns_answer_has_dname_for_cname(t->answer, rr);
3010 if (r < 0)
3011 return r;
3012 if (r == 0) {
3013 /* Also look among the stuff we already validated */
3014 r = dns_answer_has_dname_for_cname(*validated, rr);
3015 if (r < 0)
3016 return r;
3017 }
3018
3019 if (r == 0) {
3020 if (IN_SET(result,
3021 DNSSEC_INVALID,
3022 DNSSEC_SIGNATURE_EXPIRED,
3023 DNSSEC_NO_SIGNATURE))
3024 manager_dnssec_verdict(t->scope->manager, DNSSEC_BOGUS, rr->key);
3025 else /* DNSSEC_MISSING_KEY or DNSSEC_UNSUPPORTED_ALGORITHM */
3026 manager_dnssec_verdict(t->scope->manager, DNSSEC_INDETERMINATE, rr->key);
3027
3028 /* This is a primary response to our question, and it failed validation.
3029 * That's fatal. */
3030 t->answer_dnssec_result = result;
3031 return 0;
3032 }
3033
3034 /* This is a primary response, but we do have a DNAME RR
3035 * in the RR that can replay this CNAME, hence rely on
3036 * that, and we can remove the CNAME in favour of it. */
3037 }
3038
3039 /* This is just some auxiliary data. Just remove the RRset and continue. */
3040 r = dns_answer_remove_by_key(&t->answer, rr->key);
3041 if (r < 0)
3042 return r;
3043
3044 /* We dropped something from the answer, start from the beginning. */
3045 return 1;
3046 }
3047
3048 return 2; /* Finito. */
3049 }
3050
3051 int dns_transaction_validate_dnssec(DnsTransaction *t) {
3052 _cleanup_(dns_answer_unrefp) DnsAnswer *validated = NULL;
3053 Phase phase;
3054 DnsAnswerFlags flags;
3055 int r;
3056 char key_str[DNS_RESOURCE_KEY_STRING_MAX];
3057
3058 assert(t);
3059
3060 /* We have now collected all DS and DNSKEY RRs in
3061 * t->validated_keys, let's see which RRs we can now
3062 * authenticate with that. */
3063
3064 if (t->scope->dnssec_mode == DNSSEC_NO)
3065 return 0;
3066
3067 /* Already validated */
3068 if (t->answer_dnssec_result != _DNSSEC_RESULT_INVALID)
3069 return 0;
3070
3071 /* Our own stuff needs no validation */
3072 if (IN_SET(t->answer_source, DNS_TRANSACTION_ZONE, DNS_TRANSACTION_TRUST_ANCHOR)) {
3073 t->answer_dnssec_result = DNSSEC_VALIDATED;
3074 t->answer_authenticated = true;
3075 return 0;
3076 }
3077
3078 /* Cached stuff is not affected by validation. */
3079 if (t->answer_source != DNS_TRANSACTION_NETWORK)
3080 return 0;
3081
3082 if (!dns_transaction_dnssec_supported_full(t)) {
3083 /* The server does not support DNSSEC, or doesn't augment responses with RRSIGs. */
3084 t->answer_dnssec_result = DNSSEC_INCOMPATIBLE_SERVER;
3085 log_debug("Not validating response for %" PRIu16 ", used server feature level does not support DNSSEC.", t->id);
3086 return 0;
3087 }
3088
3089 log_debug("Validating response from transaction %" PRIu16 " (%s).",
3090 t->id,
3091 dns_resource_key_to_string(t->key, key_str, sizeof key_str));
3092
3093 /* First, see if this response contains any revoked trust
3094 * anchors we care about */
3095 r = dns_transaction_check_revoked_trust_anchors(t);
3096 if (r < 0)
3097 return r;
3098
3099 /* Third, copy all RRs we acquired successfully from auxiliary RRs over. */
3100 r = dns_transaction_copy_validated(t);
3101 if (r < 0)
3102 return r;
3103
3104 /* Second, see if there are DNSKEYs we already know a
3105 * validated DS for. */
3106 r = dns_transaction_validate_dnskey_by_ds(t);
3107 if (r < 0)
3108 return r;
3109
3110 /* Fourth, remove all DNSKEY and DS RRs again that our trust
3111 * anchor says are revoked. After all we might have marked
3112 * some keys revoked above, but they might still be lingering
3113 * in our validated_keys list. */
3114 r = dns_transaction_invalidate_revoked_keys(t);
3115 if (r < 0)
3116 return r;
3117
3118 phase = DNSSEC_PHASE_DNSKEY;
3119 for (;;) {
3120 bool have_nsec = false;
3121
3122 r = dnssec_validate_records(t, phase, &have_nsec, &validated);
3123 if (r <= 0)
3124 return r;
3125
3126 /* Try again as long as we managed to achieve something */
3127 if (r == 1)
3128 continue;
3129
3130 if (phase == DNSSEC_PHASE_DNSKEY && have_nsec) {
3131 /* OK, we processed all DNSKEYs, and there are NSEC/NSEC3 RRs, look at those now. */
3132 phase = DNSSEC_PHASE_NSEC;
3133 continue;
3134 }
3135
3136 if (phase != DNSSEC_PHASE_ALL) {
3137 /* OK, we processed all DNSKEYs and NSEC/NSEC3 RRs, look at all the rest now.
3138 * Note that in this third phase we start to remove RRs we couldn't validate. */
3139 phase = DNSSEC_PHASE_ALL;
3140 continue;
3141 }
3142
3143 /* We're done */
3144 break;
3145 }
3146
3147 dns_answer_unref(t->answer);
3148 t->answer = TAKE_PTR(validated);
3149
3150 /* At this point the answer only contains validated
3151 * RRsets. Now, let's see if it actually answers the question
3152 * we asked. If so, great! If it doesn't, then see if
3153 * NSEC/NSEC3 can prove this. */
3154 r = dns_transaction_has_positive_answer(t, &flags);
3155 if (r > 0) {
3156 /* Yes, it answers the question! */
3157
3158 if (flags & DNS_ANSWER_AUTHENTICATED) {
3159 /* The answer is fully authenticated, yay. */
3160 t->answer_dnssec_result = DNSSEC_VALIDATED;
3161 t->answer_rcode = DNS_RCODE_SUCCESS;
3162 t->answer_authenticated = true;
3163 } else {
3164 /* The answer is not fully authenticated. */
3165 t->answer_dnssec_result = DNSSEC_UNSIGNED;
3166 t->answer_authenticated = false;
3167 }
3168
3169 } else if (r == 0) {
3170 DnssecNsecResult nr;
3171 bool authenticated = false;
3172
3173 /* Bummer! Let's check NSEC/NSEC3 */
3174 r = dnssec_nsec_test(t->answer, t->key, &nr, &authenticated, &t->answer_nsec_ttl);
3175 if (r < 0)
3176 return r;
3177
3178 switch (nr) {
3179
3180 case DNSSEC_NSEC_NXDOMAIN:
3181 /* NSEC proves the domain doesn't exist. Very good. */
3182 log_debug("Proved NXDOMAIN via NSEC/NSEC3 for transaction %u (%s)", t->id, key_str);
3183 t->answer_dnssec_result = DNSSEC_VALIDATED;
3184 t->answer_rcode = DNS_RCODE_NXDOMAIN;
3185 t->answer_authenticated = authenticated;
3186
3187 manager_dnssec_verdict(t->scope->manager, authenticated ? DNSSEC_SECURE : DNSSEC_INSECURE, t->key);
3188 break;
3189
3190 case DNSSEC_NSEC_NODATA:
3191 /* NSEC proves that there's no data here, very good. */
3192 log_debug("Proved NODATA via NSEC/NSEC3 for transaction %u (%s)", t->id, key_str);
3193 t->answer_dnssec_result = DNSSEC_VALIDATED;
3194 t->answer_rcode = DNS_RCODE_SUCCESS;
3195 t->answer_authenticated = authenticated;
3196
3197 manager_dnssec_verdict(t->scope->manager, authenticated ? DNSSEC_SECURE : DNSSEC_INSECURE, t->key);
3198 break;
3199
3200 case DNSSEC_NSEC_OPTOUT:
3201 /* NSEC3 says the data might not be signed */
3202 log_debug("Data is NSEC3 opt-out via NSEC/NSEC3 for transaction %u (%s)", t->id, key_str);
3203 t->answer_dnssec_result = DNSSEC_UNSIGNED;
3204 t->answer_authenticated = false;
3205
3206 manager_dnssec_verdict(t->scope->manager, DNSSEC_INSECURE, t->key);
3207 break;
3208
3209 case DNSSEC_NSEC_NO_RR:
3210 /* No NSEC data? Bummer! */
3211
3212 r = dns_transaction_requires_nsec(t);
3213 if (r < 0)
3214 return r;
3215 if (r > 0) {
3216 t->answer_dnssec_result = DNSSEC_NO_SIGNATURE;
3217 manager_dnssec_verdict(t->scope->manager, DNSSEC_BOGUS, t->key);
3218 } else {
3219 t->answer_dnssec_result = DNSSEC_UNSIGNED;
3220 t->answer_authenticated = false;
3221 manager_dnssec_verdict(t->scope->manager, DNSSEC_INSECURE, t->key);
3222 }
3223
3224 break;
3225
3226 case DNSSEC_NSEC_UNSUPPORTED_ALGORITHM:
3227 /* We don't know the NSEC3 algorithm used? */
3228 t->answer_dnssec_result = DNSSEC_UNSUPPORTED_ALGORITHM;
3229 manager_dnssec_verdict(t->scope->manager, DNSSEC_INDETERMINATE, t->key);
3230 break;
3231
3232 case DNSSEC_NSEC_FOUND:
3233 case DNSSEC_NSEC_CNAME:
3234 /* NSEC says it needs to be there, but we couldn't find it? Bummer! */
3235 t->answer_dnssec_result = DNSSEC_NSEC_MISMATCH;
3236 manager_dnssec_verdict(t->scope->manager, DNSSEC_BOGUS, t->key);
3237 break;
3238
3239 default:
3240 assert_not_reached("Unexpected NSEC result.");
3241 }
3242 }
3243
3244 return 1;
3245 }
3246
3247 static const char* const dns_transaction_state_table[_DNS_TRANSACTION_STATE_MAX] = {
3248 [DNS_TRANSACTION_NULL] = "null",
3249 [DNS_TRANSACTION_PENDING] = "pending",
3250 [DNS_TRANSACTION_VALIDATING] = "validating",
3251 [DNS_TRANSACTION_RCODE_FAILURE] = "rcode-failure",
3252 [DNS_TRANSACTION_SUCCESS] = "success",
3253 [DNS_TRANSACTION_NO_SERVERS] = "no-servers",
3254 [DNS_TRANSACTION_TIMEOUT] = "timeout",
3255 [DNS_TRANSACTION_ATTEMPTS_MAX_REACHED] = "attempts-max-reached",
3256 [DNS_TRANSACTION_INVALID_REPLY] = "invalid-reply",
3257 [DNS_TRANSACTION_ERRNO] = "errno",
3258 [DNS_TRANSACTION_ABORTED] = "aborted",
3259 [DNS_TRANSACTION_DNSSEC_FAILED] = "dnssec-failed",
3260 [DNS_TRANSACTION_NO_TRUST_ANCHOR] = "no-trust-anchor",
3261 [DNS_TRANSACTION_RR_TYPE_UNSUPPORTED] = "rr-type-unsupported",
3262 [DNS_TRANSACTION_NETWORK_DOWN] = "network-down",
3263 [DNS_TRANSACTION_NOT_FOUND] = "not-found",
3264 };
3265 DEFINE_STRING_TABLE_LOOKUP(dns_transaction_state, DnsTransactionState);
3266
3267 static const char* const dns_transaction_source_table[_DNS_TRANSACTION_SOURCE_MAX] = {
3268 [DNS_TRANSACTION_NETWORK] = "network",
3269 [DNS_TRANSACTION_CACHE] = "cache",
3270 [DNS_TRANSACTION_ZONE] = "zone",
3271 [DNS_TRANSACTION_TRUST_ANCHOR] = "trust-anchor",
3272 };
3273 DEFINE_STRING_TABLE_LOOKUP(dns_transaction_source, DnsTransactionSource);
Unnamed repository; edit this file 'description' to name the repository.