]> git.ipfire.org Git - thirdparty/systemd.git/blob - src/resolve/resolved-dns-transaction.c
projects / thirdparty / systemd.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
resolved: implement mDNS probing and announcement
[thirdparty/systemd.git] / src / resolve / resolved-dns-transaction.c
1 /***
2 This file is part of systemd.
3
4 Copyright 2014 Lennart Poettering
5
6 systemd is free software; you can redistribute it and/or modify it
7 under the terms of the GNU Lesser General Public License as published by
8 the Free Software Foundation; either version 2.1 of the License, or
9 (at your option) any later version.
10
11 systemd is distributed in the hope that it will be useful, but
12 WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 Lesser General Public License for more details.
15
16 You should have received a copy of the GNU Lesser General Public License
17 along with systemd; If not, see <http://www.gnu.org/licenses/>.
18 ***/
19
20 #include <sd-messages.h>
21
22 #include "af-list.h"
23 #include "alloc-util.h"
24 #include "dns-domain.h"
25 #include "errno-list.h"
26 #include "fd-util.h"
27 #include "random-util.h"
28 #include "resolved-dns-cache.h"
29 #include "resolved-dns-transaction.h"
30 #include "resolved-llmnr.h"
31 #include "string-table.h"
32
33 #define TRANSACTIONS_MAX 4096
34
35 static void dns_transaction_reset_answer(DnsTransaction *t) {
36 assert(t);
37
38 t->received = dns_packet_unref(t->received);
39 t->answer = dns_answer_unref(t->answer);
40 t->answer_rcode = 0;
41 t->answer_dnssec_result = _DNSSEC_RESULT_INVALID;
42 t->answer_source = _DNS_TRANSACTION_SOURCE_INVALID;
43 t->answer_authenticated = false;
44 t->answer_nsec_ttl = (uint32_t) -1;
45 t->answer_errno = 0;
46 }
47
48 static void dns_transaction_flush_dnssec_transactions(DnsTransaction *t) {
49 DnsTransaction *z;
50
51 assert(t);
52
53 while ((z = set_steal_first(t->dnssec_transactions))) {
54 set_remove(z->notify_transactions, t);
55 set_remove(z->notify_transactions_done, t);
56 dns_transaction_gc(z);
57 }
58 }
59
60 static void dns_transaction_close_connection(DnsTransaction *t) {
61 assert(t);
62
63 if (t->stream) {
64 /* Let's detach the stream from our transaction, in case something else keeps a reference to it. */
65 t->stream->complete = NULL;
66 t->stream->on_packet = NULL;
67 t->stream->transaction = NULL;
68 t->stream = dns_stream_unref(t->stream);
69 }
70
71 t->dns_udp_event_source = sd_event_source_unref(t->dns_udp_event_source);
72 t->dns_udp_fd = safe_close(t->dns_udp_fd);
73 }
74
75 static void dns_transaction_stop_timeout(DnsTransaction *t) {
76 assert(t);
77
78 t->timeout_event_source = sd_event_source_unref(t->timeout_event_source);
79 }
80
81 DnsTransaction* dns_transaction_free(DnsTransaction *t) {
82 DnsQueryCandidate *c;
83 DnsZoneItem *i;
84 DnsTransaction *z;
85
86 if (!t)
87 return NULL;
88
89 log_debug("Freeing transaction %" PRIu16 ".", t->id);
90
91 dns_transaction_close_connection(t);
92 dns_transaction_stop_timeout(t);
93
94 dns_packet_unref(t->sent);
95 dns_transaction_reset_answer(t);
96
97 dns_server_unref(t->server);
98
99 if (t->scope) {
100 hashmap_remove_value(t->scope->transactions_by_key, t->key, t);
101 LIST_REMOVE(transactions_by_scope, t->scope->transactions, t);
102
103 if (t->id != 0)
104 hashmap_remove(t->scope->manager->dns_transactions, UINT_TO_PTR(t->id));
105 }
106
107 while ((c = set_steal_first(t->notify_query_candidates)))
108 set_remove(c->transactions, t);
109 set_free(t->notify_query_candidates);
110
111 while ((c = set_steal_first(t->notify_query_candidates_done)))
112 set_remove(c->transactions, t);
113 set_free(t->notify_query_candidates_done);
114
115 while ((i = set_steal_first(t->notify_zone_items)))
116 i->probe_transaction = NULL;
117 set_free(t->notify_zone_items);
118
119 while ((i = set_steal_first(t->notify_zone_items_done)))
120 i->probe_transaction = NULL;
121 set_free(t->notify_zone_items_done);
122
123 while ((z = set_steal_first(t->notify_transactions)))
124 set_remove(z->dnssec_transactions, t);
125 set_free(t->notify_transactions);
126
127 while ((z = set_steal_first(t->notify_transactions_done)))
128 set_remove(z->dnssec_transactions, t);
129 set_free(t->notify_transactions_done);
130
131 dns_transaction_flush_dnssec_transactions(t);
132 set_free(t->dnssec_transactions);
133
134 dns_answer_unref(t->validated_keys);
135 dns_resource_key_unref(t->key);
136
137 return mfree(t);
138 }
139
140 DEFINE_TRIVIAL_CLEANUP_FUNC(DnsTransaction*, dns_transaction_free);
141
142 bool dns_transaction_gc(DnsTransaction *t) {
143 assert(t);
144
145 if (t->block_gc > 0)
146 return true;
147
148 if (set_isempty(t->notify_query_candidates) &&
149 set_isempty(t->notify_query_candidates_done) &&
150 set_isempty(t->notify_zone_items) &&
151 set_isempty(t->notify_zone_items_done) &&
152 set_isempty(t->notify_transactions) &&
153 set_isempty(t->notify_transactions_done)) {
154 dns_transaction_free(t);
155 return false;
156 }
157
158 return true;
159 }
160
161 static uint16_t pick_new_id(Manager *m) {
162 uint16_t new_id;
163
164 /* Find a fresh, unused transaction id. Note that this loop is bounded because there's a limit on the number of
165 * transactions, and it's much lower than the space of IDs. */
166
167 assert_cc(TRANSACTIONS_MAX < 0xFFFF);
168
169 do
170 random_bytes(&new_id, sizeof(new_id));
171 while (new_id == 0 ||
172 hashmap_get(m->dns_transactions, UINT_TO_PTR(new_id)));
173
174 return new_id;
175 }
176
177 int dns_transaction_new(DnsTransaction **ret, DnsScope *s, DnsResourceKey *key) {
178 _cleanup_(dns_transaction_freep) DnsTransaction *t = NULL;
179 int r;
180
181 assert(ret);
182 assert(s);
183 assert(key);
184
185 /* Don't allow looking up invalid or pseudo RRs */
186 if (!dns_type_is_valid_query(key->type))
187 return -EINVAL;
188 if (dns_type_is_obsolete(key->type))
189 return -EOPNOTSUPP;
190
191 /* We only support the IN class */
192 if (key->class != DNS_CLASS_IN && key->class != DNS_CLASS_ANY)
193 return -EOPNOTSUPP;
194
195 if (hashmap_size(s->manager->dns_transactions) >= TRANSACTIONS_MAX)
196 return -EBUSY;
197
198 r = hashmap_ensure_allocated(&s->manager->dns_transactions, NULL);
199 if (r < 0)
200 return r;
201
202 r = hashmap_ensure_allocated(&s->transactions_by_key, &dns_resource_key_hash_ops);
203 if (r < 0)
204 return r;
205
206 t = new0(DnsTransaction, 1);
207 if (!t)
208 return -ENOMEM;
209
210 t->dns_udp_fd = -1;
211 t->answer_source = _DNS_TRANSACTION_SOURCE_INVALID;
212 t->answer_dnssec_result = _DNSSEC_RESULT_INVALID;
213 t->answer_nsec_ttl = (uint32_t) -1;
214 t->key = dns_resource_key_ref(key);
215 t->current_feature_level = _DNS_SERVER_FEATURE_LEVEL_INVALID;
216 t->clamp_feature_level = _DNS_SERVER_FEATURE_LEVEL_INVALID;
217
218 t->id = pick_new_id(s->manager);
219
220 r = hashmap_put(s->manager->dns_transactions, UINT_TO_PTR(t->id), t);
221 if (r < 0) {
222 t->id = 0;
223 return r;
224 }
225
226 r = hashmap_replace(s->transactions_by_key, t->key, t);
227 if (r < 0) {
228 hashmap_remove(s->manager->dns_transactions, UINT_TO_PTR(t->id));
229 return r;
230 }
231
232 LIST_PREPEND(transactions_by_scope, s->transactions, t);
233 t->scope = s;
234
235 s->manager->n_transactions_total++;
236
237 if (ret)
238 *ret = t;
239
240 t = NULL;
241
242 return 0;
243 }
244
245 static void dns_transaction_shuffle_id(DnsTransaction *t) {
246 uint16_t new_id;
247 assert(t);
248
249 /* Pick a new ID for this transaction. */
250
251 new_id = pick_new_id(t->scope->manager);
252 assert_se(hashmap_remove_and_put(t->scope->manager->dns_transactions, UINT_TO_PTR(t->id), UINT_TO_PTR(new_id), t) >= 0);
253
254 log_debug("Transaction %" PRIu16 " is now %" PRIu16 ".", t->id, new_id);
255 t->id = new_id;
256
257 /* Make sure we generate a new packet with the new ID */
258 t->sent = dns_packet_unref(t->sent);
259 }
260
261 static void dns_transaction_tentative(DnsTransaction *t, DnsPacket *p) {
262 _cleanup_free_ char *pretty = NULL;
263 char key_str[DNS_RESOURCE_KEY_STRING_MAX];
264 DnsZoneItem *z;
265
266 assert(t);
267 assert(p);
268
269 if (manager_our_packet(t->scope->manager, p) != 0)
270 return;
271
272 (void) in_addr_to_string(p->family, &p->sender, &pretty);
273
274 log_debug("Transaction %" PRIu16 " for <%s> on scope %s on %s/%s got tentative packet from %s.",
275 t->id,
276 dns_resource_key_to_string(t->key, key_str, sizeof key_str),
277 dns_protocol_to_string(t->scope->protocol),
278 t->scope->link ? t->scope->link->name : "*",
279 af_to_name_short(t->scope->family),
280 strnull(pretty));
281
282 /* RFC 4795, Section 4.1 says that the peer with the
283 * lexicographically smaller IP address loses */
284 if (memcmp(&p->sender, &p->destination, FAMILY_ADDRESS_SIZE(p->family)) >= 0) {
285 log_debug("Peer has lexicographically larger IP address and thus lost in the conflict.");
286 return;
287 }
288
289 log_debug("We have the lexicographically larger IP address and thus lost in the conflict.");
290
291 t->block_gc++;
292
293 while ((z = set_first(t->notify_zone_items))) {
294 /* First, make sure the zone item drops the reference
295 * to us */
296 dns_zone_item_probe_stop(z);
297
298 /* Secondly, report this as conflict, so that we might
299 * look for a different hostname */
300 dns_zone_item_conflict(z);
301 }
302 t->block_gc--;
303
304 dns_transaction_gc(t);
305 }
306
307 void dns_transaction_complete(DnsTransaction *t, DnsTransactionState state) {
308 DnsQueryCandidate *c;
309 DnsZoneItem *z;
310 DnsTransaction *d;
311 const char *st;
312 char key_str[DNS_RESOURCE_KEY_STRING_MAX];
313
314 assert(t);
315 assert(!DNS_TRANSACTION_IS_LIVE(state));
316
317 if (state == DNS_TRANSACTION_DNSSEC_FAILED) {
318 dns_resource_key_to_string(t->key, key_str, sizeof key_str);
319
320 log_struct(LOG_NOTICE,
321 LOG_MESSAGE_ID(SD_MESSAGE_DNSSEC_FAILURE),
322 LOG_MESSAGE("DNSSEC validation failed for question %s: %s", key_str, dnssec_result_to_string(t->answer_dnssec_result)),
323 "DNS_TRANSACTION=%" PRIu16, t->id,
324 "DNS_QUESTION=%s", key_str,
325 "DNSSEC_RESULT=%s", dnssec_result_to_string(t->answer_dnssec_result),
326 "DNS_SERVER=%s", dns_server_string(t->server),
327 "DNS_SERVER_FEATURE_LEVEL=%s", dns_server_feature_level_to_string(t->server->possible_feature_level),
328 NULL);
329 }
330
331 /* Note that this call might invalidate the query. Callers
332 * should hence not attempt to access the query or transaction
333 * after calling this function. */
334
335 if (state == DNS_TRANSACTION_ERRNO)
336 st = errno_to_name(t->answer_errno);
337 else
338 st = dns_transaction_state_to_string(state);
339
340 log_debug("Transaction %" PRIu16 " for <%s> on scope %s on %s/%s now complete with <%s> from %s (%s).",
341 t->id,
342 dns_resource_key_to_string(t->key, key_str, sizeof key_str),
343 dns_protocol_to_string(t->scope->protocol),
344 t->scope->link ? t->scope->link->name : "*",
345 af_to_name_short(t->scope->family),
346 st,
347 t->answer_source < 0 ? "none" : dns_transaction_source_to_string(t->answer_source),
348 t->answer_authenticated ? "authenticated" : "unsigned");
349
350 t->state = state;
351
352 dns_transaction_close_connection(t);
353 dns_transaction_stop_timeout(t);
354
355 /* Notify all queries that are interested, but make sure the
356 * transaction isn't freed while we are still looking at it */
357 t->block_gc++;
358
359 SET_FOREACH_MOVE(c, t->notify_query_candidates_done, t->notify_query_candidates)
360 dns_query_candidate_notify(c);
361 SWAP_TWO(t->notify_query_candidates, t->notify_query_candidates_done);
362
363 SET_FOREACH_MOVE(z, t->notify_zone_items_done, t->notify_zone_items)
364 dns_zone_item_notify(z);
365 SWAP_TWO(t->notify_zone_items, t->notify_zone_items_done);
366 if (t->probing) {
367 dns_scope_announce(t->scope);
368 }
369
370 SET_FOREACH_MOVE(d, t->notify_transactions_done, t->notify_transactions)
371 dns_transaction_notify(d, t);
372 SWAP_TWO(t->notify_transactions, t->notify_transactions_done);
373
374 t->block_gc--;
375 dns_transaction_gc(t);
376 }
377
378 static int dns_transaction_pick_server(DnsTransaction *t) {
379 DnsServer *server;
380
381 assert(t);
382 assert(t->scope->protocol == DNS_PROTOCOL_DNS);
383
384 /* Pick a DNS server and a feature level for it. */
385
386 server = dns_scope_get_dns_server(t->scope);
387 if (!server)
388 return -ESRCH;
389
390 /* If we changed the server invalidate the feature level clamping, as the new server might have completely
391 * different properties. */
392 if (server != t->server)
393 t->clamp_feature_level = _DNS_SERVER_FEATURE_LEVEL_INVALID;
394
395 t->current_feature_level = dns_server_possible_feature_level(server);
396
397 /* Clamp the feature level if that is requested. */
398 if (t->clamp_feature_level != _DNS_SERVER_FEATURE_LEVEL_INVALID &&
399 t->current_feature_level > t->clamp_feature_level)
400 t->current_feature_level = t->clamp_feature_level;
401
402 log_debug("Using feature level %s for transaction %u.", dns_server_feature_level_to_string(t->current_feature_level), t->id);
403
404 if (server == t->server)
405 return 0;
406
407 dns_server_unref(t->server);
408 t->server = dns_server_ref(server);
409
410 log_debug("Using DNS server %s for transaction %u.", dns_server_string(t->server), t->id);
411
412 return 1;
413 }
414
415 static void dns_transaction_retry(DnsTransaction *t, bool next_server) {
416 int r;
417
418 assert(t);
419
420 log_debug("Retrying transaction %" PRIu16 ".", t->id);
421
422 /* Before we try again, switch to a new server. */
423 if (next_server)
424 dns_scope_next_dns_server(t->scope);
425
426 r = dns_transaction_go(t);
427 if (r < 0) {
428 t->answer_errno = -r;
429 dns_transaction_complete(t, DNS_TRANSACTION_ERRNO);
430 }
431 }
432
433 static int dns_transaction_maybe_restart(DnsTransaction *t) {
434 int r;
435
436 assert(t);
437
438 /* Returns > 0 if the transaction was restarted, 0 if not */
439
440 if (!t->server)
441 return 0;
442
443 if (t->current_feature_level <= dns_server_possible_feature_level(t->server))
444 return 0;
445
446 /* The server's current feature level is lower than when we sent the original query. We learnt something from
447 the response or possibly an auxiliary DNSSEC response that we didn't know before. We take that as reason to
448 restart the whole transaction. This is a good idea to deal with servers that respond rubbish if we include
449 OPT RR or DO bit. One of these cases is documented here, for example:
450 https://open.nlnetlabs.nl/pipermail/dnssec-trigger/2014-November/000376.html */
451
452 log_debug("Server feature level is now lower than when we began our transaction. Restarting with new ID.");
453 dns_transaction_shuffle_id(t);
454
455 r = dns_transaction_go(t);
456 if (r < 0)
457 return r;
458
459 return 1;
460 }
461
462 static int on_stream_complete(DnsStream *s, int error) {
463 _cleanup_(dns_packet_unrefp) DnsPacket *p = NULL;
464 DnsTransaction *t;
465
466 assert(s);
467 assert(s->transaction);
468
469 /* Copy the data we care about out of the stream before we
470 * destroy it. */
471 t = s->transaction;
472 p = dns_packet_ref(s->read_packet);
473
474 dns_transaction_close_connection(t);
475
476 if (ERRNO_IS_DISCONNECT(error)) {
477 usec_t usec;
478
479 if (t->scope->protocol == DNS_PROTOCOL_LLMNR) {
480 /* If the LLMNR/TCP connection failed, the host doesn't support LLMNR, and we cannot answer the
481 * question on this scope. */
482 dns_transaction_complete(t, DNS_TRANSACTION_NOT_FOUND);
483 return 0;
484 }
485
486 log_debug_errno(error, "Connection failure for DNS TCP stream: %m");
487 assert_se(sd_event_now(t->scope->manager->event, clock_boottime_or_monotonic(), &usec) >= 0);
488 dns_server_packet_lost(t->server, IPPROTO_TCP, t->current_feature_level, usec - t->start_usec);
489
490 dns_transaction_retry(t, true);
491 return 0;
492 }
493 if (error != 0) {
494 t->answer_errno = error;
495 dns_transaction_complete(t, DNS_TRANSACTION_ERRNO);
496 return 0;
497 }
498
499 if (dns_packet_validate_reply(p) <= 0) {
500 log_debug("Invalid TCP reply packet.");
501 dns_transaction_complete(t, DNS_TRANSACTION_INVALID_REPLY);
502 return 0;
503 }
504
505 dns_scope_check_conflicts(t->scope, p);
506
507 t->block_gc++;
508 dns_transaction_process_reply(t, p);
509 t->block_gc--;
510
511 /* If the response wasn't useful, then complete the transition
512 * now. After all, we are the worst feature set now with TCP
513 * sockets, and there's really no point in retrying. */
514 if (t->state == DNS_TRANSACTION_PENDING)
515 dns_transaction_complete(t, DNS_TRANSACTION_INVALID_REPLY);
516 else
517 dns_transaction_gc(t);
518
519 return 0;
520 }
521
522 static int dns_transaction_open_tcp(DnsTransaction *t) {
523 _cleanup_close_ int fd = -1;
524 int r;
525
526 assert(t);
527
528 dns_transaction_close_connection(t);
529
530 switch (t->scope->protocol) {
531
532 case DNS_PROTOCOL_DNS:
533 r = dns_transaction_pick_server(t);
534 if (r < 0)
535 return r;
536
537 if (!dns_server_dnssec_supported(t->server) && dns_type_is_dnssec(t->key->type))
538 return -EOPNOTSUPP;
539
540 r = dns_server_adjust_opt(t->server, t->sent, t->current_feature_level);
541 if (r < 0)
542 return r;
543
544 fd = dns_scope_socket_tcp(t->scope, AF_UNSPEC, NULL, t->server, 53);
545 break;
546
547 case DNS_PROTOCOL_LLMNR:
548 /* When we already received a reply to this (but it was truncated), send to its sender address */
549 if (t->received)
550 fd = dns_scope_socket_tcp(t->scope, t->received->family, &t->received->sender, NULL, t->received->sender_port);
551 else {
552 union in_addr_union address;
553 int family = AF_UNSPEC;
554
555 /* Otherwise, try to talk to the owner of a
556 * the IP address, in case this is a reverse
557 * PTR lookup */
558
559 r = dns_name_address(dns_resource_key_name(t->key), &family, &address);
560 if (r < 0)
561 return r;
562 if (r == 0)
563 return -EINVAL;
564 if (family != t->scope->family)
565 return -ESRCH;
566
567 fd = dns_scope_socket_tcp(t->scope, family, &address, NULL, LLMNR_PORT);
568 }
569
570 break;
571
572 default:
573 return -EAFNOSUPPORT;
574 }
575
576 if (fd < 0)
577 return fd;
578
579 r = dns_stream_new(t->scope->manager, &t->stream, t->scope->protocol, fd);
580 if (r < 0)
581 return r;
582 fd = -1;
583
584 r = dns_stream_write_packet(t->stream, t->sent);
585 if (r < 0) {
586 t->stream = dns_stream_unref(t->stream);
587 return r;
588 }
589
590 t->stream->complete = on_stream_complete;
591 t->stream->transaction = t;
592
593 /* The interface index is difficult to determine if we are
594 * connecting to the local host, hence fill this in right away
595 * instead of determining it from the socket */
596 t->stream->ifindex = dns_scope_ifindex(t->scope);
597
598 dns_transaction_reset_answer(t);
599
600 t->tried_stream = true;
601
602 return 0;
603 }
604
605 static void dns_transaction_cache_answer(DnsTransaction *t) {
606 assert(t);
607
608 /* For mDNS we cache whenever we get the packet, rather than
609 * in each transaction. */
610 if (!IN_SET(t->scope->protocol, DNS_PROTOCOL_DNS, DNS_PROTOCOL_LLMNR))
611 return;
612
613 /* Caching disabled? */
614 if (!t->scope->manager->enable_cache)
615 return;
616
617 /* We never cache if this packet is from the local host, under
618 * the assumption that a locally running DNS server would
619 * cache this anyway, and probably knows better when to flush
620 * the cache then we could. */
621 if (!DNS_PACKET_SHALL_CACHE(t->received))
622 return;
623
624 dns_cache_put(&t->scope->cache,
625 t->key,
626 t->answer_rcode,
627 t->answer,
628 t->answer_authenticated,
629 t->answer_nsec_ttl,
630 0,
631 t->received->family,
632 &t->received->sender);
633 }
634
635 static bool dns_transaction_dnssec_is_live(DnsTransaction *t) {
636 DnsTransaction *dt;
637 Iterator i;
638
639 assert(t);
640
641 SET_FOREACH(dt, t->dnssec_transactions, i)
642 if (DNS_TRANSACTION_IS_LIVE(dt->state))
643 return true;
644
645 return false;
646 }
647
648 static int dns_transaction_dnssec_ready(DnsTransaction *t) {
649 DnsTransaction *dt;
650 Iterator i;
651
652 assert(t);
653
654 /* Checks whether the auxiliary DNSSEC transactions of our transaction have completed, or are still
655 * ongoing. Returns 0, if we aren't ready for the DNSSEC validation, positive if we are. */
656
657 SET_FOREACH(dt, t->dnssec_transactions, i) {
658
659 switch (dt->state) {
660
661 case DNS_TRANSACTION_NULL:
662 case DNS_TRANSACTION_PENDING:
663 case DNS_TRANSACTION_VALIDATING:
664 /* Still ongoing */
665 return 0;
666
667 case DNS_TRANSACTION_RCODE_FAILURE:
668 if (!IN_SET(dt->answer_rcode, DNS_RCODE_NXDOMAIN, DNS_RCODE_SERVFAIL)) {
669 log_debug("Auxiliary DNSSEC RR query failed with rcode=%s.", dns_rcode_to_string(dt->answer_rcode));
670 goto fail;
671 }
672
673 /* Fall-through: NXDOMAIN/SERVFAIL is good enough for us. This is because some DNS servers
674 * erronously return NXDOMAIN/SERVFAIL for empty non-terminals (Akamai...) or missing DS
675 * records (Facebook), and we need to handle that nicely, when asking for parent SOA or similar
676 * RRs to make unsigned proofs. */
677
678 case DNS_TRANSACTION_SUCCESS:
679 /* All good. */
680 break;
681
682 case DNS_TRANSACTION_DNSSEC_FAILED:
683 /* We handle DNSSEC failures different from other errors, as we care about the DNSSEC
684 * validationr result */
685
686 log_debug("Auxiliary DNSSEC RR query failed validation: %s", dnssec_result_to_string(dt->answer_dnssec_result));
687 t->answer_dnssec_result = dt->answer_dnssec_result; /* Copy error code over */
688 dns_transaction_complete(t, DNS_TRANSACTION_DNSSEC_FAILED);
689 return 0;
690
691
692 default:
693 log_debug("Auxiliary DNSSEC RR query failed with %s", dns_transaction_state_to_string(dt->state));
694 goto fail;
695 }
696 }
697
698 /* All is ready, we can go and validate */
699 return 1;
700
701 fail:
702 t->answer_dnssec_result = DNSSEC_FAILED_AUXILIARY;
703 dns_transaction_complete(t, DNS_TRANSACTION_DNSSEC_FAILED);
704 return 0;
705 }
706
707 static void dns_transaction_process_dnssec(DnsTransaction *t) {
708 int r;
709
710 assert(t);
711
712 /* Are there ongoing DNSSEC transactions? If so, let's wait for them. */
713 r = dns_transaction_dnssec_ready(t);
714 if (r < 0)
715 goto fail;
716 if (r == 0) /* We aren't ready yet (or one of our auxiliary transactions failed, and we shouldn't validate now */
717 return;
718
719 /* See if we learnt things from the additional DNSSEC transactions, that we didn't know before, and better
720 * restart the lookup immediately. */
721 r = dns_transaction_maybe_restart(t);
722 if (r < 0)
723 goto fail;
724 if (r > 0) /* Transaction got restarted... */
725 return;
726
727 /* All our auxiliary DNSSEC transactions are complete now. Try
728 * to validate our RRset now. */
729 r = dns_transaction_validate_dnssec(t);
730 if (r == -EBADMSG) {
731 dns_transaction_complete(t, DNS_TRANSACTION_INVALID_REPLY);
732 return;
733 }
734 if (r < 0)
735 goto fail;
736
737 if (t->answer_dnssec_result == DNSSEC_INCOMPATIBLE_SERVER &&
738 t->scope->dnssec_mode == DNSSEC_YES) {
739 /* We are not in automatic downgrade mode, and the
740 * server is bad, refuse operation. */
741 dns_transaction_complete(t, DNS_TRANSACTION_DNSSEC_FAILED);
742 return;
743 }
744
745 if (!IN_SET(t->answer_dnssec_result,
746 _DNSSEC_RESULT_INVALID, /* No DNSSEC validation enabled */
747 DNSSEC_VALIDATED, /* Answer is signed and validated successfully */
748 DNSSEC_UNSIGNED, /* Answer is right-fully unsigned */
749 DNSSEC_INCOMPATIBLE_SERVER)) { /* Server does not do DNSSEC (Yay, we are downgrade attack vulnerable!) */
750 dns_transaction_complete(t, DNS_TRANSACTION_DNSSEC_FAILED);
751 return;
752 }
753
754 if (t->answer_dnssec_result == DNSSEC_INCOMPATIBLE_SERVER)
755 dns_server_warn_downgrade(t->server);
756
757 dns_transaction_cache_answer(t);
758
759 if (t->answer_rcode == DNS_RCODE_SUCCESS)
760 dns_transaction_complete(t, DNS_TRANSACTION_SUCCESS);
761 else
762 dns_transaction_complete(t, DNS_TRANSACTION_RCODE_FAILURE);
763
764 return;
765
766 fail:
767 t->answer_errno = -r;
768 dns_transaction_complete(t, DNS_TRANSACTION_ERRNO);
769 }
770
771 static int dns_transaction_has_positive_answer(DnsTransaction *t, DnsAnswerFlags *flags) {
772 int r;
773
774 assert(t);
775
776 /* Checks whether the answer is positive, i.e. either a direct
777 * answer to the question, or a CNAME/DNAME for it */
778
779 r = dns_answer_match_key(t->answer, t->key, flags);
780 if (r != 0)
781 return r;
782
783 r = dns_answer_find_cname_or_dname(t->answer, t->key, NULL, flags);
784 if (r != 0)
785 return r;
786
787 return false;
788 }
789
790 static int dns_transaction_fix_rcode(DnsTransaction *t) {
791 int r;
792
793 assert(t);
794
795 /* Fix up the RCODE to SUCCESS if we get at least one matching RR in a response. Note that this contradicts the
796 * DNS RFCs a bit. Specifically, RFC 6604 Section 3 clarifies that the RCODE shall say something about a
797 * CNAME/DNAME chain element coming after the last chain element contained in the message, and not the first
798 * one included. However, it also indicates that not all DNS servers implement this correctly. Moreover, when
799 * using DNSSEC we usually only can prove the first element of a CNAME/DNAME chain anyway, hence let's settle
800 * on always processing the RCODE as referring to the immediate look-up we do, i.e. the first element of a
801 * CNAME/DNAME chain. This way, we uniformly handle CNAME/DNAME chains, regardless if the DNS server
802 * incorrectly implements RCODE, whether DNSSEC is in use, or whether the DNS server only supplied us with an
803 * incomplete CNAME/DNAME chain.
804 *
805 * Or in other words: if we get at least one positive reply in a message we patch NXDOMAIN to become SUCCESS,
806 * and then rely on the CNAME chasing logic to figure out that there's actually a CNAME error with a new
807 * lookup. */
808
809 if (t->answer_rcode != DNS_RCODE_NXDOMAIN)
810 return 0;
811
812 r = dns_transaction_has_positive_answer(t, NULL);
813 if (r <= 0)
814 return r;
815
816 t->answer_rcode = DNS_RCODE_SUCCESS;
817 return 0;
818 }
819
820 void dns_transaction_process_reply(DnsTransaction *t, DnsPacket *p) {
821 usec_t ts;
822 int r;
823
824 assert(t);
825 assert(p);
826 assert(t->scope);
827 assert(t->scope->manager);
828
829 if (t->state != DNS_TRANSACTION_PENDING)
830 return;
831
832 /* Note that this call might invalidate the query. Callers
833 * should hence not attempt to access the query or transaction
834 * after calling this function. */
835
836 log_debug("Processing incoming packet on transaction %" PRIu16".", t->id);
837
838 switch (t->scope->protocol) {
839
840 case DNS_PROTOCOL_LLMNR:
841 /* For LLMNR we will not accept any packets from other interfaces */
842
843 if (p->ifindex != dns_scope_ifindex(t->scope))
844 return;
845
846 if (p->family != t->scope->family)
847 return;
848
849 /* Tentative packets are not full responses but still
850 * useful for identifying uniqueness conflicts during
851 * probing. */
852 if (DNS_PACKET_LLMNR_T(p)) {
853 dns_transaction_tentative(t, p);
854 return;
855 }
856
857 break;
858
859 case DNS_PROTOCOL_MDNS:
860 /* For mDNS we will not accept any packets from other interfaces */
861
862 if (p->ifindex != dns_scope_ifindex(t->scope))
863 return;
864
865 if (p->family != t->scope->family)
866 return;
867
868 break;
869
870 case DNS_PROTOCOL_DNS:
871 /* Note that we do not need to verify the
872 * addresses/port numbers of incoming traffic, as we
873 * invoked connect() on our UDP socket in which case
874 * the kernel already does the needed verification for
875 * us. */
876 break;
877
878 default:
879 assert_not_reached("Invalid DNS protocol.");
880 }
881
882 if (t->received != p) {
883 dns_packet_unref(t->received);
884 t->received = dns_packet_ref(p);
885 }
886
887 t->answer_source = DNS_TRANSACTION_NETWORK;
888
889 if (p->ipproto == IPPROTO_TCP) {
890 if (DNS_PACKET_TC(p)) {
891 /* Truncated via TCP? Somebody must be fucking with us */
892 dns_transaction_complete(t, DNS_TRANSACTION_INVALID_REPLY);
893 return;
894 }
895
896 if (DNS_PACKET_ID(p) != t->id) {
897 /* Not the reply to our query? Somebody must be fucking with us */
898 dns_transaction_complete(t, DNS_TRANSACTION_INVALID_REPLY);
899 return;
900 }
901 }
902
903 assert_se(sd_event_now(t->scope->manager->event, clock_boottime_or_monotonic(), &ts) >= 0);
904
905 switch (t->scope->protocol) {
906
907 case DNS_PROTOCOL_DNS:
908 assert(t->server);
909
910 if (IN_SET(DNS_PACKET_RCODE(p), DNS_RCODE_FORMERR, DNS_RCODE_SERVFAIL, DNS_RCODE_NOTIMP)) {
911
912 /* Request failed, immediately try again with reduced features */
913
914 if (t->current_feature_level <= DNS_SERVER_FEATURE_LEVEL_WORST) {
915 /* This was already at the lowest possible feature level? If so, we can't downgrade
916 * this transaction anymore, hence let's process the response, and accept the rcode. */
917 log_debug("Server returned error: %s", dns_rcode_to_string(DNS_PACKET_RCODE(p)));
918 break;
919 }
920
921 /* Reduce this feature level by one and try again. */
922 t->clamp_feature_level = t->current_feature_level - 1;
923
924 log_debug("Server returned error %s, retrying transaction with reduced feature level %s.",
925 dns_rcode_to_string(DNS_PACKET_RCODE(p)),
926 dns_server_feature_level_to_string(t->clamp_feature_level));
927
928 dns_transaction_retry(t, false /* use the same server */);
929 return;
930 } else if (DNS_PACKET_TC(p))
931 dns_server_packet_truncated(t->server, t->current_feature_level);
932
933 break;
934
935 case DNS_PROTOCOL_LLMNR:
936 case DNS_PROTOCOL_MDNS:
937 dns_scope_packet_received(t->scope, ts - t->start_usec);
938 break;
939
940 default:
941 assert_not_reached("Invalid DNS protocol.");
942 }
943
944 if (DNS_PACKET_TC(p)) {
945
946 /* Truncated packets for mDNS are not allowed. Give up immediately. */
947 if (t->scope->protocol == DNS_PROTOCOL_MDNS) {
948 dns_transaction_complete(t, DNS_TRANSACTION_INVALID_REPLY);
949 return;
950 }
951
952 log_debug("Reply truncated, retrying via TCP.");
953
954 /* Response was truncated, let's try again with good old TCP */
955 r = dns_transaction_open_tcp(t);
956 if (r == -ESRCH) {
957 /* No servers found? Damn! */
958 dns_transaction_complete(t, DNS_TRANSACTION_NO_SERVERS);
959 return;
960 }
961 if (r == -EOPNOTSUPP) {
962 /* Tried to ask for DNSSEC RRs, on a server that doesn't do DNSSEC */
963 dns_transaction_complete(t, DNS_TRANSACTION_RR_TYPE_UNSUPPORTED);
964 return;
965 }
966 if (r < 0) {
967 /* On LLMNR, if we cannot connect to the host,
968 * we immediately give up */
969 if (t->scope->protocol != DNS_PROTOCOL_DNS)
970 goto fail;
971
972 /* On DNS, couldn't send? Try immediately again, with a new server */
973 dns_transaction_retry(t, true);
974 }
975
976 return;
977 }
978
979 /* After the superficial checks, actually parse the message. */
980 r = dns_packet_extract(p);
981 if (r < 0) {
982 dns_transaction_complete(t, DNS_TRANSACTION_INVALID_REPLY);
983 return;
984 }
985
986 if (t->server) {
987 /* Report that we successfully received a valid packet with a good rcode after we initially got a bad
988 * rcode and subsequently downgraded the protocol */
989
990 if (IN_SET(DNS_PACKET_RCODE(p), DNS_RCODE_SUCCESS, DNS_RCODE_NXDOMAIN) &&
991 t->clamp_feature_level != _DNS_SERVER_FEATURE_LEVEL_INVALID)
992 dns_server_packet_rcode_downgrade(t->server, t->clamp_feature_level);
993
994 /* Report that the OPT RR was missing */
995 if (!p->opt)
996 dns_server_packet_bad_opt(t->server, t->current_feature_level);
997
998 /* Report that we successfully received a packet */
999 dns_server_packet_received(t->server, p->ipproto, t->current_feature_level, ts - t->start_usec, p->size);
1000 }
1001
1002 /* See if we know things we didn't know before that indicate we better restart the lookup immediately. */
1003 r = dns_transaction_maybe_restart(t);
1004 if (r < 0)
1005 goto fail;
1006 if (r > 0) /* Transaction got restarted... */
1007 return;
1008
1009 if (IN_SET(t->scope->protocol, DNS_PROTOCOL_DNS, DNS_PROTOCOL_LLMNR, DNS_PROTOCOL_MDNS)) {
1010
1011 /* When dealing with protocols other than mDNS only consider responses with
1012 * equivalent query section to the request. For mDNS this check doesn't make
1013 * sense, because the section 6 of RFC6762 states that "Multicast DNS responses MUST NOT
1014 * contain any questions in the Question Section". */
1015 if (t->scope->protocol != DNS_PROTOCOL_MDNS) {
1016 r = dns_packet_is_reply_for(p, t->key);
1017 if (r < 0)
1018 goto fail;
1019 if (r == 0) {
1020 dns_transaction_complete(t, DNS_TRANSACTION_INVALID_REPLY);
1021 return;
1022 }
1023 }
1024
1025 /* Install the answer as answer to the transaction */
1026 dns_answer_unref(t->answer);
1027 t->answer = dns_answer_ref(p->answer);
1028 t->answer_rcode = DNS_PACKET_RCODE(p);
1029 t->answer_dnssec_result = _DNSSEC_RESULT_INVALID;
1030 t->answer_authenticated = false;
1031
1032 r = dns_transaction_fix_rcode(t);
1033 if (r < 0)
1034 goto fail;
1035
1036 /* Block GC while starting requests for additional DNSSEC RRs */
1037 t->block_gc++;
1038 r = dns_transaction_request_dnssec_keys(t);
1039 t->block_gc--;
1040
1041 /* Maybe the transaction is ready for GC'ing now? If so, free it and return. */
1042 if (!dns_transaction_gc(t))
1043 return;
1044
1045 /* Requesting additional keys might have resulted in
1046 * this transaction to fail, since the auxiliary
1047 * request failed for some reason. If so, we are not
1048 * in pending state anymore, and we should exit
1049 * quickly. */
1050 if (t->state != DNS_TRANSACTION_PENDING)
1051 return;
1052 if (r < 0)
1053 goto fail;
1054 if (r > 0) {
1055 /* There are DNSSEC transactions pending now. Update the state accordingly. */
1056 t->state = DNS_TRANSACTION_VALIDATING;
1057 dns_transaction_close_connection(t);
1058 dns_transaction_stop_timeout(t);
1059 return;
1060 }
1061 }
1062
1063 dns_transaction_process_dnssec(t);
1064 return;
1065
1066 fail:
1067 t->answer_errno = -r;
1068 dns_transaction_complete(t, DNS_TRANSACTION_ERRNO);
1069 }
1070
1071 static int on_dns_packet(sd_event_source *s, int fd, uint32_t revents, void *userdata) {
1072 _cleanup_(dns_packet_unrefp) DnsPacket *p = NULL;
1073 DnsTransaction *t = userdata;
1074 int r;
1075
1076 assert(t);
1077 assert(t->scope);
1078
1079 r = manager_recv(t->scope->manager, fd, DNS_PROTOCOL_DNS, &p);
1080 if (ERRNO_IS_DISCONNECT(-r)) {
1081 usec_t usec;
1082
1083 /* UDP connection failure get reported via ICMP and then are possible delivered to us on the next
1084 * recvmsg(). Treat this like a lost packet. */
1085
1086 log_debug_errno(r, "Connection failure for DNS UDP packet: %m");
1087 assert_se(sd_event_now(t->scope->manager->event, clock_boottime_or_monotonic(), &usec) >= 0);
1088 dns_server_packet_lost(t->server, IPPROTO_UDP, t->current_feature_level, usec - t->start_usec);
1089
1090 dns_transaction_retry(t, true);
1091 return 0;
1092 }
1093 if (r < 0) {
1094 dns_transaction_complete(t, DNS_TRANSACTION_ERRNO);
1095 t->answer_errno = -r;
1096 return 0;
1097 }
1098
1099 r = dns_packet_validate_reply(p);
1100 if (r < 0) {
1101 log_debug_errno(r, "Received invalid DNS packet as response, ignoring: %m");
1102 return 0;
1103 }
1104 if (r == 0) {
1105 log_debug("Received inappropriate DNS packet as response, ignoring.");
1106 return 0;
1107 }
1108
1109 if (DNS_PACKET_ID(p) != t->id) {
1110 log_debug("Received packet with incorrect transaction ID, ignoring.");
1111 return 0;
1112 }
1113
1114 dns_transaction_process_reply(t, p);
1115 return 0;
1116 }
1117
1118 static int dns_transaction_emit_udp(DnsTransaction *t) {
1119 int r;
1120
1121 assert(t);
1122
1123 if (t->scope->protocol == DNS_PROTOCOL_DNS) {
1124
1125 r = dns_transaction_pick_server(t);
1126 if (r < 0)
1127 return r;
1128
1129 if (t->current_feature_level < DNS_SERVER_FEATURE_LEVEL_UDP)
1130 return -EAGAIN;
1131
1132 if (!dns_server_dnssec_supported(t->server) && dns_type_is_dnssec(t->key->type))
1133 return -EOPNOTSUPP;
1134
1135 if (r > 0 || t->dns_udp_fd < 0) { /* Server changed, or no connection yet. */
1136 int fd;
1137
1138 dns_transaction_close_connection(t);
1139
1140 fd = dns_scope_socket_udp(t->scope, t->server, 53);
1141 if (fd < 0)
1142 return fd;
1143
1144 r = sd_event_add_io(t->scope->manager->event, &t->dns_udp_event_source, fd, EPOLLIN, on_dns_packet, t);
1145 if (r < 0) {
1146 safe_close(fd);
1147 return r;
1148 }
1149
1150 (void) sd_event_source_set_description(t->dns_udp_event_source, "dns-transaction-udp");
1151 t->dns_udp_fd = fd;
1152 }
1153
1154 r = dns_server_adjust_opt(t->server, t->sent, t->current_feature_level);
1155 if (r < 0)
1156 return r;
1157 } else
1158 dns_transaction_close_connection(t);
1159
1160 r = dns_scope_emit_udp(t->scope, t->dns_udp_fd, t->sent);
1161 if (r < 0)
1162 return r;
1163
1164 dns_transaction_reset_answer(t);
1165
1166 return 0;
1167 }
1168
1169 static int on_transaction_timeout(sd_event_source *s, usec_t usec, void *userdata) {
1170 DnsTransaction *t = userdata;
1171
1172 assert(s);
1173 assert(t);
1174
1175 if (!t->initial_jitter_scheduled || t->initial_jitter_elapsed) {
1176 /* Timeout reached? Increase the timeout for the server used */
1177 switch (t->scope->protocol) {
1178
1179 case DNS_PROTOCOL_DNS:
1180 assert(t->server);
1181 dns_server_packet_lost(t->server, t->stream ? IPPROTO_TCP : IPPROTO_UDP, t->current_feature_level, usec - t->start_usec);
1182 break;
1183
1184 case DNS_PROTOCOL_LLMNR:
1185 case DNS_PROTOCOL_MDNS:
1186 dns_scope_packet_lost(t->scope, usec - t->start_usec);
1187 break;
1188
1189 default:
1190 assert_not_reached("Invalid DNS protocol.");
1191 }
1192
1193 if (t->initial_jitter_scheduled)
1194 t->initial_jitter_elapsed = true;
1195 }
1196
1197 log_debug("Timeout reached on transaction %" PRIu16 ".", t->id);
1198
1199 dns_transaction_retry(t, true);
1200 return 0;
1201 }
1202
1203 static usec_t transaction_get_resend_timeout(DnsTransaction *t) {
1204 assert(t);
1205 assert(t->scope);
1206
1207 switch (t->scope->protocol) {
1208
1209 case DNS_PROTOCOL_DNS:
1210 assert(t->server);
1211 return t->server->resend_timeout;
1212
1213 case DNS_PROTOCOL_MDNS:
1214 assert(t->n_attempts > 0);
1215 if (t->probing)
1216 return MDNS_PROBING_INTERVAL_USEC;
1217 else
1218 return (1 << (t->n_attempts - 1)) * USEC_PER_SEC;
1219
1220 case DNS_PROTOCOL_LLMNR:
1221 return t->scope->resend_timeout;
1222
1223 default:
1224 assert_not_reached("Invalid DNS protocol.");
1225 }
1226 }
1227
1228 static int dns_transaction_prepare(DnsTransaction *t, usec_t ts) {
1229 int r;
1230
1231 assert(t);
1232
1233 dns_transaction_stop_timeout(t);
1234
1235 r = dns_scope_network_good(t->scope);
1236 if (r < 0)
1237 return r;
1238 if (r == 0) {
1239 dns_transaction_complete(t, DNS_TRANSACTION_NETWORK_DOWN);
1240 return 0;
1241 }
1242
1243 if (t->n_attempts >= TRANSACTION_ATTEMPTS_MAX(t->scope->protocol)) {
1244 dns_transaction_complete(t, DNS_TRANSACTION_ATTEMPTS_MAX_REACHED);
1245 return 0;
1246 }
1247
1248 if (t->scope->protocol == DNS_PROTOCOL_LLMNR && t->tried_stream) {
1249 /* If we already tried via a stream, then we don't
1250 * retry on LLMNR. See RFC 4795, Section 2.7. */
1251 dns_transaction_complete(t, DNS_TRANSACTION_ATTEMPTS_MAX_REACHED);
1252 return 0;
1253 }
1254
1255 t->n_attempts++;
1256 t->start_usec = ts;
1257
1258 dns_transaction_reset_answer(t);
1259 dns_transaction_flush_dnssec_transactions(t);
1260
1261 /* Check the trust anchor. Do so only on classic DNS, since DNSSEC does not apply otherwise. */
1262 if (t->scope->protocol == DNS_PROTOCOL_DNS) {
1263 r = dns_trust_anchor_lookup_positive(&t->scope->manager->trust_anchor, t->key, &t->answer);
1264 if (r < 0)
1265 return r;
1266 if (r > 0) {
1267 t->answer_rcode = DNS_RCODE_SUCCESS;
1268 t->answer_source = DNS_TRANSACTION_TRUST_ANCHOR;
1269 t->answer_authenticated = true;
1270 dns_transaction_complete(t, DNS_TRANSACTION_SUCCESS);
1271 return 0;
1272 }
1273
1274 if (dns_name_is_root(dns_resource_key_name(t->key)) &&
1275 t->key->type == DNS_TYPE_DS) {
1276
1277 /* Hmm, this is a request for the root DS? A
1278 * DS RR doesn't exist in the root zone, and
1279 * if our trust anchor didn't know it either,
1280 * this means we cannot do any DNSSEC logic
1281 * anymore. */
1282
1283 if (t->scope->dnssec_mode == DNSSEC_ALLOW_DOWNGRADE) {
1284 /* We are in downgrade mode. In this
1285 * case, synthesize an unsigned empty
1286 * response, so that the any lookup
1287 * depending on this one can continue
1288 * assuming there was no DS, and hence
1289 * the root zone was unsigned. */
1290
1291 t->answer_rcode = DNS_RCODE_SUCCESS;
1292 t->answer_source = DNS_TRANSACTION_TRUST_ANCHOR;
1293 t->answer_authenticated = false;
1294 dns_transaction_complete(t, DNS_TRANSACTION_SUCCESS);
1295 } else
1296 /* If we are not in downgrade mode,
1297 * then fail the lookup, because we
1298 * cannot reasonably answer it. There
1299 * might be DS RRs, but we don't know
1300 * them, and the DNS server won't tell
1301 * them to us (and even if it would,
1302 * we couldn't validate and trust them. */
1303 dns_transaction_complete(t, DNS_TRANSACTION_NO_TRUST_ANCHOR);
1304
1305 return 0;
1306 }
1307 }
1308
1309 /* Check the zone, but only if this transaction is not used
1310 * for probing or verifying a zone item. */
1311 if (set_isempty(t->notify_zone_items)) {
1312
1313 r = dns_zone_lookup(&t->scope->zone, t->key, dns_scope_ifindex(t->scope), &t->answer, NULL, NULL);
1314 if (r < 0)
1315 return r;
1316 if (r > 0) {
1317 t->answer_rcode = DNS_RCODE_SUCCESS;
1318 t->answer_source = DNS_TRANSACTION_ZONE;
1319 t->answer_authenticated = true;
1320 dns_transaction_complete(t, DNS_TRANSACTION_SUCCESS);
1321 return 0;
1322 }
1323 }
1324
1325 /* Check the cache, but only if this transaction is not used
1326 * for probing or verifying a zone item. */
1327 if (set_isempty(t->notify_zone_items)) {
1328
1329 /* Before trying the cache, let's make sure we figured out a
1330 * server to use. Should this cause a change of server this
1331 * might flush the cache. */
1332 dns_scope_get_dns_server(t->scope);
1333
1334 /* Let's then prune all outdated entries */
1335 dns_cache_prune(&t->scope->cache);
1336
1337 r = dns_cache_lookup(&t->scope->cache, t->key, t->clamp_ttl, &t->answer_rcode, &t->answer, &t->answer_authenticated);
1338 if (r < 0)
1339 return r;
1340 if (r > 0) {
1341 t->answer_source = DNS_TRANSACTION_CACHE;
1342 if (t->answer_rcode == DNS_RCODE_SUCCESS)
1343 dns_transaction_complete(t, DNS_TRANSACTION_SUCCESS);
1344 else
1345 dns_transaction_complete(t, DNS_TRANSACTION_RCODE_FAILURE);
1346 return 0;
1347 }
1348 }
1349
1350 return 1;
1351 }
1352
1353 static int dns_transaction_make_packet_mdns(DnsTransaction *t) {
1354
1355 _cleanup_(dns_packet_unrefp) DnsPacket *p = NULL;
1356 bool add_known_answers = false;
1357 DnsTransaction *other;
1358 unsigned qdcount;
1359 usec_t ts;
1360 int r;
1361
1362 assert(t);
1363 assert(t->scope->protocol == DNS_PROTOCOL_MDNS);
1364
1365 /* Discard any previously prepared packet, so we can start over and coalesce again */
1366 t->sent = dns_packet_unref(t->sent);
1367
1368 r = dns_packet_new_query(&p, t->scope->protocol, 0, false);
1369 if (r < 0)
1370 return r;
1371
1372 r = dns_packet_append_key(p, t->key, NULL);
1373 if (r < 0)
1374 return r;
1375
1376 qdcount = 1;
1377
1378 if (dns_key_is_shared(t->key))
1379 add_known_answers = true;
1380
1381 /*
1382 * For mDNS, we want to coalesce as many open queries in pending transactions into one single
1383 * query packet on the wire as possible. To achieve that, we iterate through all pending transactions
1384 * in our current scope, and see whether their timing contraints allow them to be sent.
1385 */
1386
1387 assert_se(sd_event_now(t->scope->manager->event, clock_boottime_or_monotonic(), &ts) >= 0);
1388
1389 LIST_FOREACH(transactions_by_scope, other, t->scope->transactions) {
1390
1391 /* Skip ourselves */
1392 if (other == t)
1393 continue;
1394
1395 if (other->state != DNS_TRANSACTION_PENDING)
1396 continue;
1397
1398 if (other->next_attempt_after > ts)
1399 continue;
1400
1401 if (qdcount >= UINT16_MAX)
1402 break;
1403
1404 r = dns_packet_append_key(p, other->key, NULL);
1405
1406 /*
1407 * If we can't stuff more questions into the packet, just give up.
1408 * One of the 'other' transactions will fire later and take care of the rest.
1409 */
1410 if (r == -EMSGSIZE)
1411 break;
1412
1413 if (r < 0)
1414 return r;
1415
1416 r = dns_transaction_prepare(other, ts);
1417 if (r <= 0)
1418 continue;
1419
1420 ts += transaction_get_resend_timeout(other);
1421
1422 r = sd_event_add_time(
1423 other->scope->manager->event,
1424 &other->timeout_event_source,
1425 clock_boottime_or_monotonic(),
1426 ts, 0,
1427 on_transaction_timeout, other);
1428 if (r < 0)
1429 return r;
1430
1431 (void) sd_event_source_set_description(other->timeout_event_source, "dns-transaction-timeout");
1432
1433 other->state = DNS_TRANSACTION_PENDING;
1434 other->next_attempt_after = ts;
1435
1436 qdcount++;
1437
1438 if (dns_key_is_shared(other->key))
1439 add_known_answers = true;
1440 }
1441
1442 DNS_PACKET_HEADER(p)->qdcount = htobe16(qdcount);
1443
1444 /* Append known answer section if we're asking for any shared record */
1445 if (add_known_answers) {
1446 r = dns_cache_export_shared_to_packet(&t->scope->cache, p);
1447 if (r < 0)
1448 return r;
1449 }
1450
1451 t->sent = p;
1452 p = NULL;
1453
1454 return 0;
1455 }
1456
1457 static int dns_transaction_make_packet(DnsTransaction *t) {
1458 _cleanup_(dns_packet_unrefp) DnsPacket *p = NULL;
1459 int r;
1460
1461 assert(t);
1462
1463 if (t->scope->protocol == DNS_PROTOCOL_MDNS)
1464 return dns_transaction_make_packet_mdns(t);
1465
1466 if (t->sent)
1467 return 0;
1468
1469 r = dns_packet_new_query(&p, t->scope->protocol, 0, t->scope->dnssec_mode != DNSSEC_NO);
1470 if (r < 0)
1471 return r;
1472
1473 r = dns_packet_append_key(p, t->key, NULL);
1474 if (r < 0)
1475 return r;
1476
1477 DNS_PACKET_HEADER(p)->qdcount = htobe16(1);
1478 DNS_PACKET_HEADER(p)->id = t->id;
1479
1480 t->sent = p;
1481 p = NULL;
1482
1483 return 0;
1484 }
1485
1486 int dns_transaction_go(DnsTransaction *t) {
1487 usec_t ts;
1488 int r;
1489 char key_str[DNS_RESOURCE_KEY_STRING_MAX];
1490
1491 assert(t);
1492
1493 /* Returns > 0 if the transaction is now pending, returns 0 if could be processed immediately and has finished
1494 * now. */
1495
1496 assert_se(sd_event_now(t->scope->manager->event, clock_boottime_or_monotonic(), &ts) >= 0);
1497
1498 r = dns_transaction_prepare(t, ts);
1499 if (r <= 0)
1500 return r;
1501
1502 log_debug("Transaction %" PRIu16 " for <%s> scope %s on %s/%s.",
1503 t->id,
1504 dns_resource_key_to_string(t->key, key_str, sizeof key_str),
1505 dns_protocol_to_string(t->scope->protocol),
1506 t->scope->link ? t->scope->link->name : "*",
1507 af_to_name_short(t->scope->family));
1508
1509 if (!t->initial_jitter_scheduled &&
1510 (t->scope->protocol == DNS_PROTOCOL_LLMNR ||
1511 t->scope->protocol == DNS_PROTOCOL_MDNS)) {
1512 usec_t jitter, accuracy;
1513
1514 /* RFC 4795 Section 2.7 suggests all queries should be
1515 * delayed by a random time from 0 to JITTER_INTERVAL. */
1516
1517 t->initial_jitter_scheduled = true;
1518
1519 random_bytes(&jitter, sizeof(jitter));
1520
1521 switch (t->scope->protocol) {
1522
1523 case DNS_PROTOCOL_LLMNR:
1524 jitter %= LLMNR_JITTER_INTERVAL_USEC;
1525 accuracy = LLMNR_JITTER_INTERVAL_USEC;
1526 break;
1527
1528 case DNS_PROTOCOL_MDNS:
1529 jitter %= MDNS_JITTER_RANGE_USEC;
1530 jitter += MDNS_JITTER_MIN_USEC;
1531 accuracy = MDNS_JITTER_RANGE_USEC;
1532 break;
1533 default:
1534 assert_not_reached("bad protocol");
1535 }
1536
1537 r = sd_event_add_time(
1538 t->scope->manager->event,
1539 &t->timeout_event_source,
1540 clock_boottime_or_monotonic(),
1541 ts + jitter, accuracy,
1542 on_transaction_timeout, t);
1543 if (r < 0)
1544 return r;
1545
1546 (void) sd_event_source_set_description(t->timeout_event_source, "dns-transaction-timeout");
1547
1548 t->n_attempts = 0;
1549 t->next_attempt_after = ts;
1550 t->state = DNS_TRANSACTION_PENDING;
1551
1552 log_debug("Delaying %s transaction for " USEC_FMT "us.", dns_protocol_to_string(t->scope->protocol), jitter);
1553 return 0;
1554 }
1555
1556 /* Otherwise, we need to ask the network */
1557 r = dns_transaction_make_packet(t);
1558 if (r < 0)
1559 return r;
1560
1561 if (t->scope->protocol == DNS_PROTOCOL_LLMNR &&
1562 (dns_name_endswith(dns_resource_key_name(t->key), "in-addr.arpa") > 0 ||
1563 dns_name_endswith(dns_resource_key_name(t->key), "ip6.arpa") > 0)) {
1564
1565 /* RFC 4795, Section 2.4. says reverse lookups shall
1566 * always be made via TCP on LLMNR */
1567 r = dns_transaction_open_tcp(t);
1568 } else {
1569 /* Try via UDP, and if that fails due to large size or lack of
1570 * support try via TCP */
1571 r = dns_transaction_emit_udp(t);
1572 if (r == -EMSGSIZE)
1573 log_debug("Sending query via TCP since it is too large.");
1574 if (r == -EAGAIN)
1575 log_debug("Sending query via TCP since server doesn't support UDP.");
1576 if (r == -EMSGSIZE || r == -EAGAIN)
1577 r = dns_transaction_open_tcp(t);
1578 }
1579
1580 if (r == -ESRCH) {
1581 /* No servers to send this to? */
1582 dns_transaction_complete(t, DNS_TRANSACTION_NO_SERVERS);
1583 return 0;
1584 }
1585 if (r == -EOPNOTSUPP) {
1586 /* Tried to ask for DNSSEC RRs, on a server that doesn't do DNSSEC */
1587 dns_transaction_complete(t, DNS_TRANSACTION_RR_TYPE_UNSUPPORTED);
1588 return 0;
1589 }
1590 if (t->scope->protocol == DNS_PROTOCOL_LLMNR && ERRNO_IS_DISCONNECT(-r)) {
1591 /* On LLMNR, if we cannot connect to a host via TCP when doing reverse lookups. This means we cannot
1592 * answer this request with this protocol. */
1593 dns_transaction_complete(t, DNS_TRANSACTION_NOT_FOUND);
1594 return 0;
1595 }
1596 if (r < 0) {
1597 if (t->scope->protocol != DNS_PROTOCOL_DNS)
1598 return r;
1599
1600 /* Couldn't send? Try immediately again, with a new server */
1601 dns_scope_next_dns_server(t->scope);
1602
1603 return dns_transaction_go(t);
1604 }
1605
1606 ts += transaction_get_resend_timeout(t);
1607
1608 r = sd_event_add_time(
1609 t->scope->manager->event,
1610 &t->timeout_event_source,
1611 clock_boottime_or_monotonic(),
1612 ts, 0,
1613 on_transaction_timeout, t);
1614 if (r < 0)
1615 return r;
1616
1617 (void) sd_event_source_set_description(t->timeout_event_source, "dns-transaction-timeout");
1618
1619 t->state = DNS_TRANSACTION_PENDING;
1620 t->next_attempt_after = ts;
1621
1622 return 1;
1623 }
1624
1625 static int dns_transaction_find_cyclic(DnsTransaction *t, DnsTransaction *aux) {
1626 DnsTransaction *n;
1627 Iterator i;
1628 int r;
1629
1630 assert(t);
1631 assert(aux);
1632
1633 /* Try to find cyclic dependencies between transaction objects */
1634
1635 if (t == aux)
1636 return 1;
1637
1638 SET_FOREACH(n, aux->dnssec_transactions, i) {
1639 r = dns_transaction_find_cyclic(t, n);
1640 if (r != 0)
1641 return r;
1642 }
1643
1644 return 0;
1645 }
1646
1647 static int dns_transaction_add_dnssec_transaction(DnsTransaction *t, DnsResourceKey *key, DnsTransaction **ret) {
1648 DnsTransaction *aux;
1649 int r;
1650
1651 assert(t);
1652 assert(ret);
1653 assert(key);
1654
1655 aux = dns_scope_find_transaction(t->scope, key, true);
1656 if (!aux) {
1657 r = dns_transaction_new(&aux, t->scope, key);
1658 if (r < 0)
1659 return r;
1660 } else {
1661 if (set_contains(t->dnssec_transactions, aux)) {
1662 *ret = aux;
1663 return 0;
1664 }
1665
1666 r = dns_transaction_find_cyclic(t, aux);
1667 if (r < 0)
1668 return r;
1669 if (r > 0) {
1670 char s[DNS_RESOURCE_KEY_STRING_MAX], saux[DNS_RESOURCE_KEY_STRING_MAX];
1671
1672 log_debug("Potential cyclic dependency, refusing to add transaction %" PRIu16 " (%s) as dependency for %" PRIu16 " (%s).",
1673 aux->id,
1674 dns_resource_key_to_string(t->key, s, sizeof s),
1675 t->id,
1676 dns_resource_key_to_string(aux->key, saux, sizeof saux));
1677
1678 return -ELOOP;
1679 }
1680 }
1681
1682 r = set_ensure_allocated(&t->dnssec_transactions, NULL);
1683 if (r < 0)
1684 goto gc;
1685
1686 r = set_ensure_allocated(&aux->notify_transactions, NULL);
1687 if (r < 0)
1688 goto gc;
1689
1690 r = set_ensure_allocated(&aux->notify_transactions_done, NULL);
1691 if (r < 0)
1692 goto gc;
1693
1694 r = set_put(t->dnssec_transactions, aux);
1695 if (r < 0)
1696 goto gc;
1697
1698 r = set_put(aux->notify_transactions, t);
1699 if (r < 0) {
1700 (void) set_remove(t->dnssec_transactions, aux);
1701 goto gc;
1702 }
1703
1704 *ret = aux;
1705 return 1;
1706
1707 gc:
1708 dns_transaction_gc(aux);
1709 return r;
1710 }
1711
1712 static int dns_transaction_request_dnssec_rr(DnsTransaction *t, DnsResourceKey *key) {
1713 _cleanup_(dns_answer_unrefp) DnsAnswer *a = NULL;
1714 DnsTransaction *aux;
1715 int r;
1716
1717 assert(t);
1718 assert(key);
1719
1720 /* Try to get the data from the trust anchor */
1721 r = dns_trust_anchor_lookup_positive(&t->scope->manager->trust_anchor, key, &a);
1722 if (r < 0)
1723 return r;
1724 if (r > 0) {
1725 r = dns_answer_extend(&t->validated_keys, a);
1726 if (r < 0)
1727 return r;
1728
1729 return 0;
1730 }
1731
1732 /* This didn't work, ask for it via the network/cache then. */
1733 r = dns_transaction_add_dnssec_transaction(t, key, &aux);
1734 if (r == -ELOOP) /* This would result in a cyclic dependency */
1735 return 0;
1736 if (r < 0)
1737 return r;
1738
1739 if (aux->state == DNS_TRANSACTION_NULL) {
1740 r = dns_transaction_go(aux);
1741 if (r < 0)
1742 return r;
1743 }
1744
1745 return 1;
1746 }
1747
1748 static int dns_transaction_negative_trust_anchor_lookup(DnsTransaction *t, const char *name) {
1749 int r;
1750
1751 assert(t);
1752
1753 /* Check whether the specified name is in the NTA
1754 * database, either in the global one, or the link-local
1755 * one. */
1756
1757 r = dns_trust_anchor_lookup_negative(&t->scope->manager->trust_anchor, name);
1758 if (r != 0)
1759 return r;
1760
1761 if (!t->scope->link)
1762 return 0;
1763
1764 return set_contains(t->scope->link->dnssec_negative_trust_anchors, name);
1765 }
1766
1767 static int dns_transaction_has_unsigned_negative_answer(DnsTransaction *t) {
1768 int r;
1769
1770 assert(t);
1771
1772 /* Checks whether the answer is negative, and lacks NSEC/NSEC3
1773 * RRs to prove it */
1774
1775 r = dns_transaction_has_positive_answer(t, NULL);
1776 if (r < 0)
1777 return r;
1778 if (r > 0)
1779 return false;
1780
1781 /* Is this key explicitly listed as a negative trust anchor?
1782 * If so, it's nothing we need to care about */
1783 r = dns_transaction_negative_trust_anchor_lookup(t, dns_resource_key_name(t->key));
1784 if (r < 0)
1785 return r;
1786 if (r > 0)
1787 return false;
1788
1789 /* The answer does not contain any RRs that match to the
1790 * question. If so, let's see if there are any NSEC/NSEC3 RRs
1791 * included. If not, the answer is unsigned. */
1792
1793 r = dns_answer_contains_nsec_or_nsec3(t->answer);
1794 if (r < 0)
1795 return r;
1796 if (r > 0)
1797 return false;
1798
1799 return true;
1800 }
1801
1802 static int dns_transaction_is_primary_response(DnsTransaction *t, DnsResourceRecord *rr) {
1803 int r;
1804
1805 assert(t);
1806 assert(rr);
1807
1808 /* Check if the specified RR is the "primary" response,
1809 * i.e. either matches the question precisely or is a
1810 * CNAME/DNAME for it. */
1811
1812 r = dns_resource_key_match_rr(t->key, rr, NULL);
1813 if (r != 0)
1814 return r;
1815
1816 return dns_resource_key_match_cname_or_dname(t->key, rr->key, NULL);
1817 }
1818
1819 static bool dns_transaction_dnssec_supported(DnsTransaction *t) {
1820 assert(t);
1821
1822 /* Checks whether our transaction's DNS server is assumed to be compatible with DNSSEC. Returns false as soon
1823 * as we changed our mind about a server, and now believe it is incompatible with DNSSEC. */
1824
1825 if (t->scope->protocol != DNS_PROTOCOL_DNS)
1826 return false;
1827
1828 /* If we have picked no server, then we are working from the cache or some other source, and DNSSEC might well
1829 * be supported, hence return true. */
1830 if (!t->server)
1831 return true;
1832
1833 /* Note that we do not check the feature level actually used for the transaction but instead the feature level
1834 * the server is known to support currently, as the transaction feature level might be lower than what the
1835 * server actually supports, since we might have downgraded this transaction's feature level because we got a
1836 * SERVFAIL earlier and wanted to check whether downgrading fixes it. */
1837
1838 return dns_server_dnssec_supported(t->server);
1839 }
1840
1841 static bool dns_transaction_dnssec_supported_full(DnsTransaction *t) {
1842 DnsTransaction *dt;
1843 Iterator i;
1844
1845 assert(t);
1846
1847 /* Checks whether our transaction our any of the auxiliary transactions couldn't do DNSSEC. */
1848
1849 if (!dns_transaction_dnssec_supported(t))
1850 return false;
1851
1852 SET_FOREACH(dt, t->dnssec_transactions, i)
1853 if (!dns_transaction_dnssec_supported(dt))
1854 return false;
1855
1856 return true;
1857 }
1858
1859 int dns_transaction_request_dnssec_keys(DnsTransaction *t) {
1860 DnsResourceRecord *rr;
1861
1862 int r;
1863
1864 assert(t);
1865
1866 /*
1867 * Retrieve all auxiliary RRs for the answer we got, so that
1868 * we can verify signatures or prove that RRs are rightfully
1869 * unsigned. Specifically:
1870 *
1871 * - For RRSIG we get the matching DNSKEY
1872 * - For DNSKEY we get the matching DS
1873 * - For unsigned SOA/NS we get the matching DS
1874 * - For unsigned CNAME/DNAME/DS we get the parent SOA RR
1875 * - For other unsigned RRs we get the matching SOA RR
1876 * - For SOA/NS queries with no matching response RR, and no NSEC/NSEC3, the DS RR
1877 * - For DS queries with no matching response RRs, and no NSEC/NSEC3, the parent's SOA RR
1878 * - For other queries with no matching response RRs, and no NSEC/NSEC3, the SOA RR
1879 */
1880
1881 if (t->scope->dnssec_mode == DNSSEC_NO)
1882 return 0;
1883 if (t->answer_source != DNS_TRANSACTION_NETWORK)
1884 return 0; /* We only need to validate stuff from the network */
1885 if (!dns_transaction_dnssec_supported(t))
1886 return 0; /* If we can't do DNSSEC anyway there's no point in geting the auxiliary RRs */
1887
1888 DNS_ANSWER_FOREACH(rr, t->answer) {
1889
1890 if (dns_type_is_pseudo(rr->key->type))
1891 continue;
1892
1893 /* If this RR is in the negative trust anchor, we don't need to validate it. */
1894 r = dns_transaction_negative_trust_anchor_lookup(t, dns_resource_key_name(rr->key));
1895 if (r < 0)
1896 return r;
1897 if (r > 0)
1898 continue;
1899
1900 switch (rr->key->type) {
1901
1902 case DNS_TYPE_RRSIG: {
1903 /* For each RRSIG we request the matching DNSKEY */
1904 _cleanup_(dns_resource_key_unrefp) DnsResourceKey *dnskey = NULL;
1905
1906 /* If this RRSIG is about a DNSKEY RR and the
1907 * signer is the same as the owner, then we
1908 * already have the DNSKEY, and we don't have
1909 * to look for more. */
1910 if (rr->rrsig.type_covered == DNS_TYPE_DNSKEY) {
1911 r = dns_name_equal(rr->rrsig.signer, dns_resource_key_name(rr->key));
1912 if (r < 0)
1913 return r;
1914 if (r > 0)
1915 continue;
1916 }
1917
1918 /* If the signer is not a parent of our
1919 * original query, then this is about an
1920 * auxiliary RRset, but not anything we asked
1921 * for. In this case we aren't interested,
1922 * because we don't want to request additional
1923 * RRs for stuff we didn't really ask for, and
1924 * also to avoid request loops, where
1925 * additional RRs from one transaction result
1926 * in another transaction whose additonal RRs
1927 * point back to the original transaction, and
1928 * we deadlock. */
1929 r = dns_name_endswith(dns_resource_key_name(t->key), rr->rrsig.signer);
1930 if (r < 0)
1931 return r;
1932 if (r == 0)
1933 continue;
1934
1935 dnskey = dns_resource_key_new(rr->key->class, DNS_TYPE_DNSKEY, rr->rrsig.signer);
1936 if (!dnskey)
1937 return -ENOMEM;
1938
1939 log_debug("Requesting DNSKEY to validate transaction %" PRIu16" (%s, RRSIG with key tag: %" PRIu16 ").",
1940 t->id, dns_resource_key_name(rr->key), rr->rrsig.key_tag);
1941 r = dns_transaction_request_dnssec_rr(t, dnskey);
1942 if (r < 0)
1943 return r;
1944 break;
1945 }
1946
1947 case DNS_TYPE_DNSKEY: {
1948 /* For each DNSKEY we request the matching DS */
1949 _cleanup_(dns_resource_key_unrefp) DnsResourceKey *ds = NULL;
1950
1951 /* If the DNSKEY we are looking at is not for
1952 * zone we are interested in, nor any of its
1953 * parents, we aren't interested, and don't
1954 * request it. After all, we don't want to end
1955 * up in request loops, and want to keep
1956 * additional traffic down. */
1957
1958 r = dns_name_endswith(dns_resource_key_name(t->key), dns_resource_key_name(rr->key));
1959 if (r < 0)
1960 return r;
1961 if (r == 0)
1962 continue;
1963
1964 ds = dns_resource_key_new(rr->key->class, DNS_TYPE_DS, dns_resource_key_name(rr->key));
1965 if (!ds)
1966 return -ENOMEM;
1967
1968 log_debug("Requesting DS to validate transaction %" PRIu16" (%s, DNSKEY with key tag: %" PRIu16 ").",
1969 t->id, dns_resource_key_name(rr->key), dnssec_keytag(rr, false));
1970 r = dns_transaction_request_dnssec_rr(t, ds);
1971 if (r < 0)
1972 return r;
1973
1974 break;
1975 }
1976
1977 case DNS_TYPE_SOA:
1978 case DNS_TYPE_NS: {
1979 _cleanup_(dns_resource_key_unrefp) DnsResourceKey *ds = NULL;
1980
1981 /* For an unsigned SOA or NS, try to acquire
1982 * the matching DS RR, as we are at a zone cut
1983 * then, and whether a DS exists tells us
1984 * whether the zone is signed. Do so only if
1985 * this RR matches our original question,
1986 * however. */
1987
1988 r = dns_resource_key_match_rr(t->key, rr, NULL);
1989 if (r < 0)
1990 return r;
1991 if (r == 0)
1992 continue;
1993
1994 r = dnssec_has_rrsig(t->answer, rr->key);
1995 if (r < 0)
1996 return r;
1997 if (r > 0)
1998 continue;
1999
2000 ds = dns_resource_key_new(rr->key->class, DNS_TYPE_DS, dns_resource_key_name(rr->key));
2001 if (!ds)
2002 return -ENOMEM;
2003
2004 log_debug("Requesting DS to validate transaction %" PRIu16 " (%s, unsigned SOA/NS RRset).",
2005 t->id, dns_resource_key_name(rr->key));
2006 r = dns_transaction_request_dnssec_rr(t, ds);
2007 if (r < 0)
2008 return r;
2009
2010 break;
2011 }
2012
2013 case DNS_TYPE_DS:
2014 case DNS_TYPE_CNAME:
2015 case DNS_TYPE_DNAME: {
2016 _cleanup_(dns_resource_key_unrefp) DnsResourceKey *soa = NULL;
2017 const char *name;
2018
2019 /* CNAMEs and DNAMEs cannot be located at a
2020 * zone apex, hence ask for the parent SOA for
2021 * unsigned CNAME/DNAME RRs, maybe that's the
2022 * apex. But do all that only if this is
2023 * actually a response to our original
2024 * question.
2025 *
2026 * Similar for DS RRs, which are signed when
2027 * the parent SOA is signed. */
2028
2029 r = dns_transaction_is_primary_response(t, rr);
2030 if (r < 0)
2031 return r;
2032 if (r == 0)
2033 continue;
2034
2035 r = dnssec_has_rrsig(t->answer, rr->key);
2036 if (r < 0)
2037 return r;
2038 if (r > 0)
2039 continue;
2040
2041 r = dns_answer_has_dname_for_cname(t->answer, rr);
2042 if (r < 0)
2043 return r;
2044 if (r > 0)
2045 continue;
2046
2047 name = dns_resource_key_name(rr->key);
2048 r = dns_name_parent(&name);
2049 if (r < 0)
2050 return r;
2051 if (r == 0)
2052 continue;
2053
2054 soa = dns_resource_key_new(rr->key->class, DNS_TYPE_SOA, name);
2055 if (!soa)
2056 return -ENOMEM;
2057
2058 log_debug("Requesting parent SOA to validate transaction %" PRIu16 " (%s, unsigned CNAME/DNAME/DS RRset).",
2059 t->id, dns_resource_key_name(rr->key));
2060 r = dns_transaction_request_dnssec_rr(t, soa);
2061 if (r < 0)
2062 return r;
2063
2064 break;
2065 }
2066
2067 default: {
2068 _cleanup_(dns_resource_key_unrefp) DnsResourceKey *soa = NULL;
2069
2070 /* For other unsigned RRsets (including
2071 * NSEC/NSEC3!), look for proof the zone is
2072 * unsigned, by requesting the SOA RR of the
2073 * zone. However, do so only if they are
2074 * directly relevant to our original
2075 * question. */
2076
2077 r = dns_transaction_is_primary_response(t, rr);
2078 if (r < 0)
2079 return r;
2080 if (r == 0)
2081 continue;
2082
2083 r = dnssec_has_rrsig(t->answer, rr->key);
2084 if (r < 0)
2085 return r;
2086 if (r > 0)
2087 continue;
2088
2089 soa = dns_resource_key_new(rr->key->class, DNS_TYPE_SOA, dns_resource_key_name(rr->key));
2090 if (!soa)
2091 return -ENOMEM;
2092
2093 log_debug("Requesting SOA to validate transaction %" PRIu16 " (%s, unsigned non-SOA/NS RRset <%s>).",
2094 t->id, dns_resource_key_name(rr->key), dns_resource_record_to_string(rr));
2095 r = dns_transaction_request_dnssec_rr(t, soa);
2096 if (r < 0)
2097 return r;
2098 break;
2099 }}
2100 }
2101
2102 /* Above, we requested everything necessary to validate what
2103 * we got. Now, let's request what we need to validate what we
2104 * didn't get... */
2105
2106 r = dns_transaction_has_unsigned_negative_answer(t);
2107 if (r < 0)
2108 return r;
2109 if (r > 0) {
2110 const char *name;
2111 uint16_t type = 0;
2112
2113 name = dns_resource_key_name(t->key);
2114
2115 /* If this was a SOA or NS request, then check if there's a DS RR for the same domain. Note that this
2116 * could also be used as indication that we are not at a zone apex, but in real world setups there are
2117 * too many broken DNS servers (Hello, incapdns.net!) where non-terminal zones return NXDOMAIN even
2118 * though they have further children. If this was a DS request, then it's signed when the parent zone
2119 * is signed, hence ask the parent SOA in that case. If this was any other RR then ask for the SOA RR,
2120 * to see if that is signed. */
2121
2122 if (t->key->type == DNS_TYPE_DS) {
2123 r = dns_name_parent(&name);
2124 if (r > 0) {
2125 type = DNS_TYPE_SOA;
2126 log_debug("Requesting parent SOA to validate transaction %" PRIu16 " (%s, unsigned empty DS response).",
2127 t->id, dns_resource_key_name(t->key));
2128 } else
2129 name = NULL;
2130
2131 } else if (IN_SET(t->key->type, DNS_TYPE_SOA, DNS_TYPE_NS)) {
2132
2133 type = DNS_TYPE_DS;
2134 log_debug("Requesting DS to validate transaction %" PRIu16 " (%s, unsigned empty SOA/NS response).",
2135 t->id, dns_resource_key_name(t->key));
2136
2137 } else {
2138 type = DNS_TYPE_SOA;
2139 log_debug("Requesting SOA to validate transaction %" PRIu16 " (%s, unsigned empty non-SOA/NS/DS response).",
2140 t->id, dns_resource_key_name(t->key));
2141 }
2142
2143 if (name) {
2144 _cleanup_(dns_resource_key_unrefp) DnsResourceKey *soa = NULL;
2145
2146 soa = dns_resource_key_new(t->key->class, type, name);
2147 if (!soa)
2148 return -ENOMEM;
2149
2150 r = dns_transaction_request_dnssec_rr(t, soa);
2151 if (r < 0)
2152 return r;
2153 }
2154 }
2155
2156 return dns_transaction_dnssec_is_live(t);
2157 }
2158
2159 void dns_transaction_notify(DnsTransaction *t, DnsTransaction *source) {
2160 assert(t);
2161 assert(source);
2162
2163 /* Invoked whenever any of our auxiliary DNSSEC transactions completed its work. If the state is still PENDING,
2164 we are still in the loop that adds further DNSSEC transactions, hence don't check if we are ready yet. If
2165 the state is VALIDATING however, we should check if we are complete now. */
2166
2167 if (t->state == DNS_TRANSACTION_VALIDATING)
2168 dns_transaction_process_dnssec(t);
2169 }
2170
2171 static int dns_transaction_validate_dnskey_by_ds(DnsTransaction *t) {
2172 DnsResourceRecord *rr;
2173 int ifindex, r;
2174
2175 assert(t);
2176
2177 /* Add all DNSKEY RRs from the answer that are validated by DS
2178 * RRs from the list of validated keys to the list of
2179 * validated keys. */
2180
2181 DNS_ANSWER_FOREACH_IFINDEX(rr, ifindex, t->answer) {
2182
2183 r = dnssec_verify_dnskey_by_ds_search(rr, t->validated_keys);
2184 if (r < 0)
2185 return r;
2186 if (r == 0)
2187 continue;
2188
2189 /* If so, the DNSKEY is validated too. */
2190 r = dns_answer_add_extend(&t->validated_keys, rr, ifindex, DNS_ANSWER_AUTHENTICATED);
2191 if (r < 0)
2192 return r;
2193 }
2194
2195 return 0;
2196 }
2197
2198 static int dns_transaction_requires_rrsig(DnsTransaction *t, DnsResourceRecord *rr) {
2199 int r;
2200
2201 assert(t);
2202 assert(rr);
2203
2204 /* Checks if the RR we are looking for must be signed with an
2205 * RRSIG. This is used for positive responses. */
2206
2207 if (t->scope->dnssec_mode == DNSSEC_NO)
2208 return false;
2209
2210 if (dns_type_is_pseudo(rr->key->type))
2211 return -EINVAL;
2212
2213 r = dns_transaction_negative_trust_anchor_lookup(t, dns_resource_key_name(rr->key));
2214 if (r < 0)
2215 return r;
2216 if (r > 0)
2217 return false;
2218
2219 switch (rr->key->type) {
2220
2221 case DNS_TYPE_RRSIG:
2222 /* RRSIGs are the signatures themselves, they need no signing. */
2223 return false;
2224
2225 case DNS_TYPE_SOA:
2226 case DNS_TYPE_NS: {
2227 DnsTransaction *dt;
2228 Iterator i;
2229
2230 /* For SOA or NS RRs we look for a matching DS transaction */
2231
2232 SET_FOREACH(dt, t->dnssec_transactions, i) {
2233
2234 if (dt->key->class != rr->key->class)
2235 continue;
2236 if (dt->key->type != DNS_TYPE_DS)
2237 continue;
2238
2239 r = dns_name_equal(dns_resource_key_name(dt->key), dns_resource_key_name(rr->key));
2240 if (r < 0)
2241 return r;
2242 if (r == 0)
2243 continue;
2244
2245 /* We found a DS transactions for the SOA/NS
2246 * RRs we are looking at. If it discovered signed DS
2247 * RRs, then we need to be signed, too. */
2248
2249 if (!dt->answer_authenticated)
2250 return false;
2251
2252 return dns_answer_match_key(dt->answer, dt->key, NULL);
2253 }
2254
2255 /* We found nothing that proves this is safe to leave
2256 * this unauthenticated, hence ask inist on
2257 * authentication. */
2258 return true;
2259 }
2260
2261 case DNS_TYPE_DS:
2262 case DNS_TYPE_CNAME:
2263 case DNS_TYPE_DNAME: {
2264 const char *parent = NULL;
2265 DnsTransaction *dt;
2266 Iterator i;
2267
2268 /*
2269 * CNAME/DNAME RRs cannot be located at a zone apex, hence look directly for the parent SOA.
2270 *
2271 * DS RRs are signed if the parent is signed, hence also look at the parent SOA
2272 */
2273
2274 SET_FOREACH(dt, t->dnssec_transactions, i) {
2275
2276 if (dt->key->class != rr->key->class)
2277 continue;
2278 if (dt->key->type != DNS_TYPE_SOA)
2279 continue;
2280
2281 if (!parent) {
2282 parent = dns_resource_key_name(rr->key);
2283 r = dns_name_parent(&parent);
2284 if (r < 0)
2285 return r;
2286 if (r == 0) {
2287 if (rr->key->type == DNS_TYPE_DS)
2288 return true;
2289
2290 /* A CNAME/DNAME without a parent? That's sooo weird. */
2291 log_debug("Transaction %" PRIu16 " claims CNAME/DNAME at root. Refusing.", t->id);
2292 return -EBADMSG;
2293 }
2294 }
2295
2296 r = dns_name_equal(dns_resource_key_name(dt->key), parent);
2297 if (r < 0)
2298 return r;
2299 if (r == 0)
2300 continue;
2301
2302 return t->answer_authenticated;
2303 }
2304
2305 return true;
2306 }
2307
2308 default: {
2309 DnsTransaction *dt;
2310 Iterator i;
2311
2312 /* Any other kind of RR (including DNSKEY/NSEC/NSEC3). Let's see if our SOA lookup was authenticated */
2313
2314 SET_FOREACH(dt, t->dnssec_transactions, i) {
2315
2316 if (dt->key->class != rr->key->class)
2317 continue;
2318 if (dt->key->type != DNS_TYPE_SOA)
2319 continue;
2320
2321 r = dns_name_equal(dns_resource_key_name(dt->key), dns_resource_key_name(rr->key));
2322 if (r < 0)
2323 return r;
2324 if (r == 0)
2325 continue;
2326
2327 /* We found the transaction that was supposed to find
2328 * the SOA RR for us. It was successful, but found no
2329 * RR for us. This means we are not at a zone cut. In
2330 * this case, we require authentication if the SOA
2331 * lookup was authenticated too. */
2332 return t->answer_authenticated;
2333 }
2334
2335 return true;
2336 }}
2337 }
2338
2339 static int dns_transaction_in_private_tld(DnsTransaction *t, const DnsResourceKey *key) {
2340 DnsTransaction *dt;
2341 const char *tld;
2342 Iterator i;
2343 int r;
2344
2345 /* If DNSSEC downgrade mode is on, checks whether the
2346 * specified RR is one level below a TLD we have proven not to
2347 * exist. In such a case we assume that this is a private
2348 * domain, and permit it.
2349 *
2350 * This detects cases like the Fritz!Box router networks. Each
2351 * Fritz!Box router serves a private "fritz.box" zone, in the
2352 * non-existing TLD "box". Requests for the "fritz.box" domain
2353 * are served by the router itself, while requests for the
2354 * "box" domain will result in NXDOMAIN.
2355 *
2356 * Note that this logic is unable to detect cases where a
2357 * router serves a private DNS zone directly under
2358 * non-existing TLD. In such a case we cannot detect whether
2359 * the TLD is supposed to exist or not, as all requests we
2360 * make for it will be answered by the router's zone, and not
2361 * by the root zone. */
2362
2363 assert(t);
2364
2365 if (t->scope->dnssec_mode != DNSSEC_ALLOW_DOWNGRADE)
2366 return false; /* In strict DNSSEC mode what doesn't exist, doesn't exist */
2367
2368 tld = dns_resource_key_name(key);
2369 r = dns_name_parent(&tld);
2370 if (r < 0)
2371 return r;
2372 if (r == 0)
2373 return false; /* Already the root domain */
2374
2375 if (!dns_name_is_single_label(tld))
2376 return false;
2377
2378 SET_FOREACH(dt, t->dnssec_transactions, i) {
2379
2380 if (dt->key->class != key->class)
2381 continue;
2382
2383 r = dns_name_equal(dns_resource_key_name(dt->key), tld);
2384 if (r < 0)
2385 return r;
2386 if (r == 0)
2387 continue;
2388
2389 /* We found an auxiliary lookup we did for the TLD. If
2390 * that returned with NXDOMAIN, we know the TLD didn't
2391 * exist, and hence this might be a private zone. */
2392
2393 return dt->answer_rcode == DNS_RCODE_NXDOMAIN;
2394 }
2395
2396 return false;
2397 }
2398
2399 static int dns_transaction_requires_nsec(DnsTransaction *t) {
2400 char key_str[DNS_RESOURCE_KEY_STRING_MAX];
2401 DnsTransaction *dt;
2402 const char *name;
2403 uint16_t type = 0;
2404 Iterator i;
2405 int r;
2406
2407 assert(t);
2408
2409 /* Checks if we need to insist on NSEC/NSEC3 RRs for proving
2410 * this negative reply */
2411
2412 if (t->scope->dnssec_mode == DNSSEC_NO)
2413 return false;
2414
2415 if (dns_type_is_pseudo(t->key->type))
2416 return -EINVAL;
2417
2418 r = dns_transaction_negative_trust_anchor_lookup(t, dns_resource_key_name(t->key));
2419 if (r < 0)
2420 return r;
2421 if (r > 0)
2422 return false;
2423
2424 r = dns_transaction_in_private_tld(t, t->key);
2425 if (r < 0)
2426 return r;
2427 if (r > 0) {
2428 /* The lookup is from a TLD that is proven not to
2429 * exist, and we are in downgrade mode, hence ignore
2430 * that fact that we didn't get any NSEC RRs.*/
2431
2432 log_info("Detected a negative query %s in a private DNS zone, permitting unsigned response.",
2433 dns_resource_key_to_string(t->key, key_str, sizeof key_str));
2434 return false;
2435 }
2436
2437 name = dns_resource_key_name(t->key);
2438
2439 if (t->key->type == DNS_TYPE_DS) {
2440
2441 /* We got a negative reply for this DS lookup? DS RRs are signed when their parent zone is signed,
2442 * hence check the parent SOA in this case. */
2443
2444 r = dns_name_parent(&name);
2445 if (r < 0)
2446 return r;
2447 if (r == 0)
2448 return true;
2449
2450 type = DNS_TYPE_SOA;
2451
2452 } else if (IN_SET(t->key->type, DNS_TYPE_SOA, DNS_TYPE_NS))
2453 /* We got a negative reply for this SOA/NS lookup? If so, check if there's a DS RR for this */
2454 type = DNS_TYPE_DS;
2455 else
2456 /* For all other negative replies, check for the SOA lookup */
2457 type = DNS_TYPE_SOA;
2458
2459 /* For all other RRs we check the SOA on the same level to see
2460 * if it's signed. */
2461
2462 SET_FOREACH(dt, t->dnssec_transactions, i) {
2463
2464 if (dt->key->class != t->key->class)
2465 continue;
2466 if (dt->key->type != type)
2467 continue;
2468
2469 r = dns_name_equal(dns_resource_key_name(dt->key), name);
2470 if (r < 0)
2471 return r;
2472 if (r == 0)
2473 continue;
2474
2475 return dt->answer_authenticated;
2476 }
2477
2478 /* If in doubt, require NSEC/NSEC3 */
2479 return true;
2480 }
2481
2482 static int dns_transaction_dnskey_authenticated(DnsTransaction *t, DnsResourceRecord *rr) {
2483 DnsResourceRecord *rrsig;
2484 bool found = false;
2485 int r;
2486
2487 /* Checks whether any of the DNSKEYs used for the RRSIGs for
2488 * the specified RRset is authenticated (i.e. has a matching
2489 * DS RR). */
2490
2491 r = dns_transaction_negative_trust_anchor_lookup(t, dns_resource_key_name(rr->key));
2492 if (r < 0)
2493 return r;
2494 if (r > 0)
2495 return false;
2496
2497 DNS_ANSWER_FOREACH(rrsig, t->answer) {
2498 DnsTransaction *dt;
2499 Iterator i;
2500
2501 r = dnssec_key_match_rrsig(rr->key, rrsig);
2502 if (r < 0)
2503 return r;
2504 if (r == 0)
2505 continue;
2506
2507 SET_FOREACH(dt, t->dnssec_transactions, i) {
2508
2509 if (dt->key->class != rr->key->class)
2510 continue;
2511
2512 if (dt->key->type == DNS_TYPE_DNSKEY) {
2513
2514 r = dns_name_equal(dns_resource_key_name(dt->key), rrsig->rrsig.signer);
2515 if (r < 0)
2516 return r;
2517 if (r == 0)
2518 continue;
2519
2520 /* OK, we found an auxiliary DNSKEY
2521 * lookup. If that lookup is
2522 * authenticated, report this. */
2523
2524 if (dt->answer_authenticated)
2525 return true;
2526
2527 found = true;
2528
2529 } else if (dt->key->type == DNS_TYPE_DS) {
2530
2531 r = dns_name_equal(dns_resource_key_name(dt->key), rrsig->rrsig.signer);
2532 if (r < 0)
2533 return r;
2534 if (r == 0)
2535 continue;
2536
2537 /* OK, we found an auxiliary DS
2538 * lookup. If that lookup is
2539 * authenticated and non-zero, we
2540 * won! */
2541
2542 if (!dt->answer_authenticated)
2543 return false;
2544
2545 return dns_answer_match_key(dt->answer, dt->key, NULL);
2546 }
2547 }
2548 }
2549
2550 return found ? false : -ENXIO;
2551 }
2552
2553 static int dns_transaction_known_signed(DnsTransaction *t, DnsResourceRecord *rr) {
2554 assert(t);
2555 assert(rr);
2556
2557 /* We know that the root domain is signed, hence if it appears
2558 * not to be signed, there's a problem with the DNS server */
2559
2560 return rr->key->class == DNS_CLASS_IN &&
2561 dns_name_is_root(dns_resource_key_name(rr->key));
2562 }
2563
2564 static int dns_transaction_check_revoked_trust_anchors(DnsTransaction *t) {
2565 DnsResourceRecord *rr;
2566 int r;
2567
2568 assert(t);
2569
2570 /* Maybe warn the user that we encountered a revoked DNSKEY
2571 * for a key from our trust anchor. Note that we don't care
2572 * whether the DNSKEY can be authenticated or not. It's
2573 * sufficient if it is self-signed. */
2574
2575 DNS_ANSWER_FOREACH(rr, t->answer) {
2576 r = dns_trust_anchor_check_revoked(&t->scope->manager->trust_anchor, rr, t->answer);
2577 if (r < 0)
2578 return r;
2579 }
2580
2581 return 0;
2582 }
2583
2584 static int dns_transaction_invalidate_revoked_keys(DnsTransaction *t) {
2585 bool changed;
2586 int r;
2587
2588 assert(t);
2589
2590 /* Removes all DNSKEY/DS objects from t->validated_keys that
2591 * our trust anchors database considers revoked. */
2592
2593 do {
2594 DnsResourceRecord *rr;
2595
2596 changed = false;
2597
2598 DNS_ANSWER_FOREACH(rr, t->validated_keys) {
2599 r = dns_trust_anchor_is_revoked(&t->scope->manager->trust_anchor, rr);
2600 if (r < 0)
2601 return r;
2602 if (r > 0) {
2603 r = dns_answer_remove_by_rr(&t->validated_keys, rr);
2604 if (r < 0)
2605 return r;
2606
2607 assert(r > 0);
2608 changed = true;
2609 break;
2610 }
2611 }
2612 } while (changed);
2613
2614 return 0;
2615 }
2616
2617 static int dns_transaction_copy_validated(DnsTransaction *t) {
2618 DnsTransaction *dt;
2619 Iterator i;
2620 int r;
2621
2622 assert(t);
2623
2624 /* Copy all validated RRs from the auxiliary DNSSEC transactions into our set of validated RRs */
2625
2626 SET_FOREACH(dt, t->dnssec_transactions, i) {
2627
2628 if (DNS_TRANSACTION_IS_LIVE(dt->state))
2629 continue;
2630
2631 if (!dt->answer_authenticated)
2632 continue;
2633
2634 r = dns_answer_extend(&t->validated_keys, dt->answer);
2635 if (r < 0)
2636 return r;
2637 }
2638
2639 return 0;
2640 }
2641
2642 typedef enum {
2643 DNSSEC_PHASE_DNSKEY, /* Phase #1, only validate DNSKEYs */
2644 DNSSEC_PHASE_NSEC, /* Phase #2, only validate NSEC+NSEC3 */
2645 DNSSEC_PHASE_ALL, /* Phase #3, validate everything else */
2646 } Phase;
2647
2648 static int dnssec_validate_records(
2649 DnsTransaction *t,
2650 Phase phase,
2651 bool *have_nsec,
2652 DnsAnswer **validated) {
2653
2654 DnsResourceRecord *rr;
2655 int r;
2656
2657 /* Returns negative on error, 0 if validation failed, 1 to restart validation, 2 when finished. */
2658
2659 DNS_ANSWER_FOREACH(rr, t->answer) {
2660 DnsResourceRecord *rrsig = NULL;
2661 DnssecResult result;
2662
2663 switch (rr->key->type) {
2664 case DNS_TYPE_RRSIG:
2665 continue;
2666
2667 case DNS_TYPE_DNSKEY:
2668 /* We validate DNSKEYs only in the DNSKEY and ALL phases */
2669 if (phase == DNSSEC_PHASE_NSEC)
2670 continue;
2671 break;
2672
2673 case DNS_TYPE_NSEC:
2674 case DNS_TYPE_NSEC3:
2675 *have_nsec = true;
2676
2677 /* We validate NSEC/NSEC3 only in the NSEC and ALL phases */
2678 if (phase == DNSSEC_PHASE_DNSKEY)
2679 continue;
2680 break;
2681
2682 default:
2683 /* We validate all other RRs only in the ALL phases */
2684 if (phase != DNSSEC_PHASE_ALL)
2685 continue;
2686 }
2687
2688 r = dnssec_verify_rrset_search(t->answer, rr->key, t->validated_keys, USEC_INFINITY, &result, &rrsig);
2689 if (r < 0)
2690 return r;
2691
2692 log_debug("Looking at %s: %s", strna(dns_resource_record_to_string(rr)), dnssec_result_to_string(result));
2693
2694 if (result == DNSSEC_VALIDATED) {
2695
2696 if (rr->key->type == DNS_TYPE_DNSKEY) {
2697 /* If we just validated a DNSKEY RRset, then let's add these keys to
2698 * the set of validated keys for this transaction. */
2699
2700 r = dns_answer_copy_by_key(&t->validated_keys, t->answer, rr->key, DNS_ANSWER_AUTHENTICATED);
2701 if (r < 0)
2702 return r;
2703
2704 /* Some of the DNSKEYs we just added might already have been revoked,
2705 * remove them again in that case. */
2706 r = dns_transaction_invalidate_revoked_keys(t);
2707 if (r < 0)
2708 return r;
2709 }
2710
2711 /* Add the validated RRset to the new list of validated
2712 * RRsets, and remove it from the unvalidated RRsets.
2713 * We mark the RRset as authenticated and cacheable. */
2714 r = dns_answer_move_by_key(validated, &t->answer, rr->key, DNS_ANSWER_AUTHENTICATED|DNS_ANSWER_CACHEABLE);
2715 if (r < 0)
2716 return r;
2717
2718 manager_dnssec_verdict(t->scope->manager, DNSSEC_SECURE, rr->key);
2719
2720 /* Exit the loop, we dropped something from the answer, start from the beginning */
2721 return 1;
2722 }
2723
2724 /* If we haven't read all DNSKEYs yet a negative result of the validation is irrelevant, as
2725 * there might be more DNSKEYs coming. Similar, if we haven't read all NSEC/NSEC3 RRs yet,
2726 * we cannot do positive wildcard proofs yet, as those require the NSEC/NSEC3 RRs. */
2727 if (phase != DNSSEC_PHASE_ALL)
2728 continue;
2729
2730 if (result == DNSSEC_VALIDATED_WILDCARD) {
2731 bool authenticated = false;
2732 const char *source;
2733
2734 /* This RRset validated, but as a wildcard. This means we need
2735 * to prove via NSEC/NSEC3 that no matching non-wildcard RR exists.*/
2736
2737 /* First step, determine the source of synthesis */
2738 r = dns_resource_record_source(rrsig, &source);
2739 if (r < 0)
2740 return r;
2741
2742 r = dnssec_test_positive_wildcard(*validated,
2743 dns_resource_key_name(rr->key),
2744 source,
2745 rrsig->rrsig.signer,
2746 &authenticated);
2747
2748 /* Unless the NSEC proof showed that the key really doesn't exist something is off. */
2749 if (r == 0)
2750 result = DNSSEC_INVALID;
2751 else {
2752 r = dns_answer_move_by_key(validated, &t->answer, rr->key,
2753 authenticated ? (DNS_ANSWER_AUTHENTICATED|DNS_ANSWER_CACHEABLE) : 0);
2754 if (r < 0)
2755 return r;
2756
2757 manager_dnssec_verdict(t->scope->manager, authenticated ? DNSSEC_SECURE : DNSSEC_INSECURE, rr->key);
2758
2759 /* Exit the loop, we dropped something from the answer, start from the beginning */
2760 return 1;
2761 }
2762 }
2763
2764 if (result == DNSSEC_NO_SIGNATURE) {
2765 r = dns_transaction_requires_rrsig(t, rr);
2766 if (r < 0)
2767 return r;
2768 if (r == 0) {
2769 /* Data does not require signing. In that case, just copy it over,
2770 * but remember that this is by no means authenticated.*/
2771 r = dns_answer_move_by_key(validated, &t->answer, rr->key, 0);
2772 if (r < 0)
2773 return r;
2774
2775 manager_dnssec_verdict(t->scope->manager, DNSSEC_INSECURE, rr->key);
2776 return 1;
2777 }
2778
2779 r = dns_transaction_known_signed(t, rr);
2780 if (r < 0)
2781 return r;
2782 if (r > 0) {
2783 /* This is an RR we know has to be signed. If it isn't this means
2784 * the server is not attaching RRSIGs, hence complain. */
2785
2786 dns_server_packet_rrsig_missing(t->server, t->current_feature_level);
2787
2788 if (t->scope->dnssec_mode == DNSSEC_ALLOW_DOWNGRADE) {
2789
2790 /* Downgrading is OK? If so, just consider the information unsigned */
2791
2792 r = dns_answer_move_by_key(validated, &t->answer, rr->key, 0);
2793 if (r < 0)
2794 return r;
2795
2796 manager_dnssec_verdict(t->scope->manager, DNSSEC_INSECURE, rr->key);
2797 return 1;
2798 }
2799
2800 /* Otherwise, fail */
2801 t->answer_dnssec_result = DNSSEC_INCOMPATIBLE_SERVER;
2802 return 0;
2803 }
2804
2805 r = dns_transaction_in_private_tld(t, rr->key);
2806 if (r < 0)
2807 return r;
2808 if (r > 0) {
2809 char s[DNS_RESOURCE_KEY_STRING_MAX];
2810
2811 /* The data is from a TLD that is proven not to exist, and we are in downgrade
2812 * mode, hence ignore the fact that this was not signed. */
2813
2814 log_info("Detected RRset %s is in a private DNS zone, permitting unsigned RRs.",
2815 dns_resource_key_to_string(rr->key, s, sizeof s));
2816
2817 r = dns_answer_move_by_key(validated, &t->answer, rr->key, 0);
2818 if (r < 0)
2819 return r;
2820
2821 manager_dnssec_verdict(t->scope->manager, DNSSEC_INSECURE, rr->key);
2822 return 1;
2823 }
2824 }
2825
2826 if (IN_SET(result,
2827 DNSSEC_MISSING_KEY,
2828 DNSSEC_SIGNATURE_EXPIRED,
2829 DNSSEC_UNSUPPORTED_ALGORITHM)) {
2830
2831 r = dns_transaction_dnskey_authenticated(t, rr);
2832 if (r < 0 && r != -ENXIO)
2833 return r;
2834 if (r == 0) {
2835 /* The DNSKEY transaction was not authenticated, this means there's
2836 * no DS for this, which means it's OK if no keys are found for this signature. */
2837
2838 r = dns_answer_move_by_key(validated, &t->answer, rr->key, 0);
2839 if (r < 0)
2840 return r;
2841
2842 manager_dnssec_verdict(t->scope->manager, DNSSEC_INSECURE, rr->key);
2843 return 1;
2844 }
2845 }
2846
2847 r = dns_transaction_is_primary_response(t, rr);
2848 if (r < 0)
2849 return r;
2850 if (r > 0) {
2851 /* Look for a matching DNAME for this CNAME */
2852 r = dns_answer_has_dname_for_cname(t->answer, rr);
2853 if (r < 0)
2854 return r;
2855 if (r == 0) {
2856 /* Also look among the stuff we already validated */
2857 r = dns_answer_has_dname_for_cname(*validated, rr);
2858 if (r < 0)
2859 return r;
2860 }
2861
2862 if (r == 0) {
2863 if (IN_SET(result,
2864 DNSSEC_INVALID,
2865 DNSSEC_SIGNATURE_EXPIRED,
2866 DNSSEC_NO_SIGNATURE))
2867 manager_dnssec_verdict(t->scope->manager, DNSSEC_BOGUS, rr->key);
2868 else /* DNSSEC_MISSING_KEY or DNSSEC_UNSUPPORTED_ALGORITHM */
2869 manager_dnssec_verdict(t->scope->manager, DNSSEC_INDETERMINATE, rr->key);
2870
2871 /* This is a primary response to our question, and it failed validation.
2872 * That's fatal. */
2873 t->answer_dnssec_result = result;
2874 return 0;
2875 }
2876
2877 /* This is a primary response, but we do have a DNAME RR
2878 * in the RR that can replay this CNAME, hence rely on
2879 * that, and we can remove the CNAME in favour of it. */
2880 }
2881
2882 /* This is just some auxiliary data. Just remove the RRset and continue. */
2883 r = dns_answer_remove_by_key(&t->answer, rr->key);
2884 if (r < 0)
2885 return r;
2886
2887 /* We dropped something from the answer, start from the beginning. */
2888 return 1;
2889 }
2890
2891 return 2; /* Finito. */
2892 }
2893
2894 int dns_transaction_validate_dnssec(DnsTransaction *t) {
2895 _cleanup_(dns_answer_unrefp) DnsAnswer *validated = NULL;
2896 Phase phase;
2897 DnsAnswerFlags flags;
2898 int r;
2899 char key_str[DNS_RESOURCE_KEY_STRING_MAX];
2900
2901 assert(t);
2902
2903 /* We have now collected all DS and DNSKEY RRs in
2904 * t->validated_keys, let's see which RRs we can now
2905 * authenticate with that. */
2906
2907 if (t->scope->dnssec_mode == DNSSEC_NO)
2908 return 0;
2909
2910 /* Already validated */
2911 if (t->answer_dnssec_result != _DNSSEC_RESULT_INVALID)
2912 return 0;
2913
2914 /* Our own stuff needs no validation */
2915 if (IN_SET(t->answer_source, DNS_TRANSACTION_ZONE, DNS_TRANSACTION_TRUST_ANCHOR)) {
2916 t->answer_dnssec_result = DNSSEC_VALIDATED;
2917 t->answer_authenticated = true;
2918 return 0;
2919 }
2920
2921 /* Cached stuff is not affected by validation. */
2922 if (t->answer_source != DNS_TRANSACTION_NETWORK)
2923 return 0;
2924
2925 if (!dns_transaction_dnssec_supported_full(t)) {
2926 /* The server does not support DNSSEC, or doesn't augment responses with RRSIGs. */
2927 t->answer_dnssec_result = DNSSEC_INCOMPATIBLE_SERVER;
2928 log_debug("Not validating response for %" PRIu16 ", used server feature level does not support DNSSEC.", t->id);
2929 return 0;
2930 }
2931
2932 log_debug("Validating response from transaction %" PRIu16 " (%s).",
2933 t->id,
2934 dns_resource_key_to_string(t->key, key_str, sizeof key_str));
2935
2936 /* First, see if this response contains any revoked trust
2937 * anchors we care about */
2938 r = dns_transaction_check_revoked_trust_anchors(t);
2939 if (r < 0)
2940 return r;
2941
2942 /* Third, copy all RRs we acquired successfully from auxiliary RRs over. */
2943 r = dns_transaction_copy_validated(t);
2944 if (r < 0)
2945 return r;
2946
2947 /* Second, see if there are DNSKEYs we already know a
2948 * validated DS for. */
2949 r = dns_transaction_validate_dnskey_by_ds(t);
2950 if (r < 0)
2951 return r;
2952
2953 /* Fourth, remove all DNSKEY and DS RRs again that our trust
2954 * anchor says are revoked. After all we might have marked
2955 * some keys revoked above, but they might still be lingering
2956 * in our validated_keys list. */
2957 r = dns_transaction_invalidate_revoked_keys(t);
2958 if (r < 0)
2959 return r;
2960
2961 phase = DNSSEC_PHASE_DNSKEY;
2962 for (;;) {
2963 bool have_nsec = false;
2964
2965 r = dnssec_validate_records(t, phase, &have_nsec, &validated);
2966 if (r <= 0)
2967 return r;
2968
2969 /* Try again as long as we managed to achieve something */
2970 if (r == 1)
2971 continue;
2972
2973 if (phase == DNSSEC_PHASE_DNSKEY && have_nsec) {
2974 /* OK, we processed all DNSKEYs, and there are NSEC/NSEC3 RRs, look at those now. */
2975 phase = DNSSEC_PHASE_NSEC;
2976 continue;
2977 }
2978
2979 if (phase != DNSSEC_PHASE_ALL) {
2980 /* OK, we processed all DNSKEYs and NSEC/NSEC3 RRs, look at all the rest now.
2981 * Note that in this third phase we start to remove RRs we couldn't validate. */
2982 phase = DNSSEC_PHASE_ALL;
2983 continue;
2984 }
2985
2986 /* We're done */
2987 break;
2988 }
2989
2990 dns_answer_unref(t->answer);
2991 t->answer = validated;
2992 validated = NULL;
2993
2994 /* At this point the answer only contains validated
2995 * RRsets. Now, let's see if it actually answers the question
2996 * we asked. If so, great! If it doesn't, then see if
2997 * NSEC/NSEC3 can prove this. */
2998 r = dns_transaction_has_positive_answer(t, &flags);
2999 if (r > 0) {
3000 /* Yes, it answers the question! */
3001
3002 if (flags & DNS_ANSWER_AUTHENTICATED) {
3003 /* The answer is fully authenticated, yay. */
3004 t->answer_dnssec_result = DNSSEC_VALIDATED;
3005 t->answer_rcode = DNS_RCODE_SUCCESS;
3006 t->answer_authenticated = true;
3007 } else {
3008 /* The answer is not fully authenticated. */
3009 t->answer_dnssec_result = DNSSEC_UNSIGNED;
3010 t->answer_authenticated = false;
3011 }
3012
3013 } else if (r == 0) {
3014 DnssecNsecResult nr;
3015 bool authenticated = false;
3016
3017 /* Bummer! Let's check NSEC/NSEC3 */
3018 r = dnssec_nsec_test(t->answer, t->key, &nr, &authenticated, &t->answer_nsec_ttl);
3019 if (r < 0)
3020 return r;
3021
3022 switch (nr) {
3023
3024 case DNSSEC_NSEC_NXDOMAIN:
3025 /* NSEC proves the domain doesn't exist. Very good. */
3026 log_debug("Proved NXDOMAIN via NSEC/NSEC3 for transaction %u (%s)", t->id, key_str);
3027 t->answer_dnssec_result = DNSSEC_VALIDATED;
3028 t->answer_rcode = DNS_RCODE_NXDOMAIN;
3029 t->answer_authenticated = authenticated;
3030
3031 manager_dnssec_verdict(t->scope->manager, authenticated ? DNSSEC_SECURE : DNSSEC_INSECURE, t->key);
3032 break;
3033
3034 case DNSSEC_NSEC_NODATA:
3035 /* NSEC proves that there's no data here, very good. */
3036 log_debug("Proved NODATA via NSEC/NSEC3 for transaction %u (%s)", t->id, key_str);
3037 t->answer_dnssec_result = DNSSEC_VALIDATED;
3038 t->answer_rcode = DNS_RCODE_SUCCESS;
3039 t->answer_authenticated = authenticated;
3040
3041 manager_dnssec_verdict(t->scope->manager, authenticated ? DNSSEC_SECURE : DNSSEC_INSECURE, t->key);
3042 break;
3043
3044 case DNSSEC_NSEC_OPTOUT:
3045 /* NSEC3 says the data might not be signed */
3046 log_debug("Data is NSEC3 opt-out via NSEC/NSEC3 for transaction %u (%s)", t->id, key_str);
3047 t->answer_dnssec_result = DNSSEC_UNSIGNED;
3048 t->answer_authenticated = false;
3049
3050 manager_dnssec_verdict(t->scope->manager, DNSSEC_INSECURE, t->key);
3051 break;
3052
3053 case DNSSEC_NSEC_NO_RR:
3054 /* No NSEC data? Bummer! */
3055
3056 r = dns_transaction_requires_nsec(t);
3057 if (r < 0)
3058 return r;
3059 if (r > 0) {
3060 t->answer_dnssec_result = DNSSEC_NO_SIGNATURE;
3061 manager_dnssec_verdict(t->scope->manager, DNSSEC_BOGUS, t->key);
3062 } else {
3063 t->answer_dnssec_result = DNSSEC_UNSIGNED;
3064 t->answer_authenticated = false;
3065 manager_dnssec_verdict(t->scope->manager, DNSSEC_INSECURE, t->key);
3066 }
3067
3068 break;
3069
3070 case DNSSEC_NSEC_UNSUPPORTED_ALGORITHM:
3071 /* We don't know the NSEC3 algorithm used? */
3072 t->answer_dnssec_result = DNSSEC_UNSUPPORTED_ALGORITHM;
3073 manager_dnssec_verdict(t->scope->manager, DNSSEC_INDETERMINATE, t->key);
3074 break;
3075
3076 case DNSSEC_NSEC_FOUND:
3077 case DNSSEC_NSEC_CNAME:
3078 /* NSEC says it needs to be there, but we couldn't find it? Bummer! */
3079 t->answer_dnssec_result = DNSSEC_NSEC_MISMATCH;
3080 manager_dnssec_verdict(t->scope->manager, DNSSEC_BOGUS, t->key);
3081 break;
3082
3083 default:
3084 assert_not_reached("Unexpected NSEC result.");
3085 }
3086 }
3087
3088 return 1;
3089 }
3090
3091 static const char* const dns_transaction_state_table[_DNS_TRANSACTION_STATE_MAX] = {
3092 [DNS_TRANSACTION_NULL] = "null",
3093 [DNS_TRANSACTION_PENDING] = "pending",
3094 [DNS_TRANSACTION_VALIDATING] = "validating",
3095 [DNS_TRANSACTION_RCODE_FAILURE] = "rcode-failure",
3096 [DNS_TRANSACTION_SUCCESS] = "success",
3097 [DNS_TRANSACTION_NO_SERVERS] = "no-servers",
3098 [DNS_TRANSACTION_TIMEOUT] = "timeout",
3099 [DNS_TRANSACTION_ATTEMPTS_MAX_REACHED] = "attempts-max-reached",
3100 [DNS_TRANSACTION_INVALID_REPLY] = "invalid-reply",
3101 [DNS_TRANSACTION_ERRNO] = "errno",
3102 [DNS_TRANSACTION_ABORTED] = "aborted",
3103 [DNS_TRANSACTION_DNSSEC_FAILED] = "dnssec-failed",
3104 [DNS_TRANSACTION_NO_TRUST_ANCHOR] = "no-trust-anchor",
3105 [DNS_TRANSACTION_RR_TYPE_UNSUPPORTED] = "rr-type-unsupported",
3106 [DNS_TRANSACTION_NETWORK_DOWN] = "network-down",
3107 [DNS_TRANSACTION_NOT_FOUND] = "not-found",
3108 };
3109 DEFINE_STRING_TABLE_LOOKUP(dns_transaction_state, DnsTransactionState);
3110
3111 static const char* const dns_transaction_source_table[_DNS_TRANSACTION_SOURCE_MAX] = {
3112 [DNS_TRANSACTION_NETWORK] = "network",
3113 [DNS_TRANSACTION_CACHE] = "cache",
3114 [DNS_TRANSACTION_ZONE] = "zone",
3115 [DNS_TRANSACTION_TRUST_ANCHOR] = "trust-anchor",
3116 };
3117 DEFINE_STRING_TABLE_LOOKUP(dns_transaction_source, DnsTransactionSource);
Unnamed repository; edit this file 'description' to name the repository.