]> git.ipfire.org Git - thirdparty/systemd.git/blob - src/resolve/resolved-dns-transaction.c
projects / thirdparty / systemd.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
resolve: dns_scope_network_good() does not returns negative errno
[thirdparty/systemd.git] / src / resolve / resolved-dns-transaction.c
1 /* SPDX-License-Identifier: LGPL-2.1+ */
2
3 #include "sd-messages.h"
4
5 #include "af-list.h"
6 #include "alloc-util.h"
7 #include "dns-domain.h"
8 #include "errno-list.h"
9 #include "fd-util.h"
10 #include "random-util.h"
11 #include "resolved-dns-cache.h"
12 #include "resolved-dns-transaction.h"
13 #include "resolved-llmnr.h"
14 #include "string-table.h"
15
16 #if ENABLE_DNS_OVER_TLS
17 #include <gnutls/socket.h>
18 #endif
19
20 #define TRANSACTIONS_MAX 4096
21 #define TRANSACTION_TCP_TIMEOUT_USEC (10U*USEC_PER_SEC)
22
23 /* After how much time to repeat classic DNS requests */
24 #define DNS_TIMEOUT_USEC (SD_RESOLVED_QUERY_TIMEOUT_USEC / DNS_TRANSACTION_ATTEMPTS_MAX)
25
26 static void dns_transaction_reset_answer(DnsTransaction *t) {
27 assert(t);
28
29 t->received = dns_packet_unref(t->received);
30 t->answer = dns_answer_unref(t->answer);
31 t->answer_rcode = 0;
32 t->answer_dnssec_result = _DNSSEC_RESULT_INVALID;
33 t->answer_source = _DNS_TRANSACTION_SOURCE_INVALID;
34 t->answer_authenticated = false;
35 t->answer_nsec_ttl = (uint32_t) -1;
36 t->answer_errno = 0;
37 }
38
39 static void dns_transaction_flush_dnssec_transactions(DnsTransaction *t) {
40 DnsTransaction *z;
41
42 assert(t);
43
44 while ((z = set_steal_first(t->dnssec_transactions))) {
45 set_remove(z->notify_transactions, t);
46 set_remove(z->notify_transactions_done, t);
47 dns_transaction_gc(z);
48 }
49 }
50
51 static void dns_transaction_close_connection(DnsTransaction *t) {
52 assert(t);
53
54 if (t->stream) {
55 /* Let's detach the stream from our transaction, in case something else keeps a reference to it. */
56 LIST_REMOVE(transactions_by_stream, t->stream->transactions, t);
57
58 /* Remove packet in case it's still in the queue */
59 dns_packet_unref(ordered_set_remove(t->stream->write_queue, t->sent));
60
61 t->stream = dns_stream_unref(t->stream);
62 }
63
64 t->dns_udp_event_source = sd_event_source_unref(t->dns_udp_event_source);
65 t->dns_udp_fd = safe_close(t->dns_udp_fd);
66 }
67
68 static void dns_transaction_stop_timeout(DnsTransaction *t) {
69 assert(t);
70
71 t->timeout_event_source = sd_event_source_unref(t->timeout_event_source);
72 }
73
74 DnsTransaction* dns_transaction_free(DnsTransaction *t) {
75 DnsQueryCandidate *c;
76 DnsZoneItem *i;
77 DnsTransaction *z;
78
79 if (!t)
80 return NULL;
81
82 log_debug("Freeing transaction %" PRIu16 ".", t->id);
83
84 dns_transaction_close_connection(t);
85 dns_transaction_stop_timeout(t);
86
87 dns_packet_unref(t->sent);
88 dns_transaction_reset_answer(t);
89
90 dns_server_unref(t->server);
91
92 if (t->scope) {
93 hashmap_remove_value(t->scope->transactions_by_key, t->key, t);
94 LIST_REMOVE(transactions_by_scope, t->scope->transactions, t);
95
96 if (t->id != 0)
97 hashmap_remove(t->scope->manager->dns_transactions, UINT_TO_PTR(t->id));
98 }
99
100 while ((c = set_steal_first(t->notify_query_candidates)))
101 set_remove(c->transactions, t);
102 set_free(t->notify_query_candidates);
103
104 while ((c = set_steal_first(t->notify_query_candidates_done)))
105 set_remove(c->transactions, t);
106 set_free(t->notify_query_candidates_done);
107
108 while ((i = set_steal_first(t->notify_zone_items)))
109 i->probe_transaction = NULL;
110 set_free(t->notify_zone_items);
111
112 while ((i = set_steal_first(t->notify_zone_items_done)))
113 i->probe_transaction = NULL;
114 set_free(t->notify_zone_items_done);
115
116 while ((z = set_steal_first(t->notify_transactions)))
117 set_remove(z->dnssec_transactions, t);
118 set_free(t->notify_transactions);
119
120 while ((z = set_steal_first(t->notify_transactions_done)))
121 set_remove(z->dnssec_transactions, t);
122 set_free(t->notify_transactions_done);
123
124 dns_transaction_flush_dnssec_transactions(t);
125 set_free(t->dnssec_transactions);
126
127 dns_answer_unref(t->validated_keys);
128 dns_resource_key_unref(t->key);
129
130 return mfree(t);
131 }
132
133 DEFINE_TRIVIAL_CLEANUP_FUNC(DnsTransaction*, dns_transaction_free);
134
135 bool dns_transaction_gc(DnsTransaction *t) {
136 assert(t);
137
138 if (t->block_gc > 0)
139 return true;
140
141 if (set_isempty(t->notify_query_candidates) &&
142 set_isempty(t->notify_query_candidates_done) &&
143 set_isempty(t->notify_zone_items) &&
144 set_isempty(t->notify_zone_items_done) &&
145 set_isempty(t->notify_transactions) &&
146 set_isempty(t->notify_transactions_done)) {
147 dns_transaction_free(t);
148 return false;
149 }
150
151 return true;
152 }
153
154 static uint16_t pick_new_id(Manager *m) {
155 uint16_t new_id;
156
157 /* Find a fresh, unused transaction id. Note that this loop is bounded because there's a limit on the number of
158 * transactions, and it's much lower than the space of IDs. */
159
160 assert_cc(TRANSACTIONS_MAX < 0xFFFF);
161
162 do
163 random_bytes(&new_id, sizeof(new_id));
164 while (new_id == 0 ||
165 hashmap_get(m->dns_transactions, UINT_TO_PTR(new_id)));
166
167 return new_id;
168 }
169
170 int dns_transaction_new(DnsTransaction **ret, DnsScope *s, DnsResourceKey *key) {
171 _cleanup_(dns_transaction_freep) DnsTransaction *t = NULL;
172 int r;
173
174 assert(ret);
175 assert(s);
176 assert(key);
177
178 /* Don't allow looking up invalid or pseudo RRs */
179 if (!dns_type_is_valid_query(key->type))
180 return -EINVAL;
181 if (dns_type_is_obsolete(key->type))
182 return -EOPNOTSUPP;
183
184 /* We only support the IN class */
185 if (!IN_SET(key->class, DNS_CLASS_IN, DNS_CLASS_ANY))
186 return -EOPNOTSUPP;
187
188 if (hashmap_size(s->manager->dns_transactions) >= TRANSACTIONS_MAX)
189 return -EBUSY;
190
191 r = hashmap_ensure_allocated(&s->manager->dns_transactions, NULL);
192 if (r < 0)
193 return r;
194
195 r = hashmap_ensure_allocated(&s->transactions_by_key, &dns_resource_key_hash_ops);
196 if (r < 0)
197 return r;
198
199 t = new0(DnsTransaction, 1);
200 if (!t)
201 return -ENOMEM;
202
203 t->dns_udp_fd = -1;
204 t->answer_source = _DNS_TRANSACTION_SOURCE_INVALID;
205 t->answer_dnssec_result = _DNSSEC_RESULT_INVALID;
206 t->answer_nsec_ttl = (uint32_t) -1;
207 t->key = dns_resource_key_ref(key);
208 t->current_feature_level = _DNS_SERVER_FEATURE_LEVEL_INVALID;
209 t->clamp_feature_level = _DNS_SERVER_FEATURE_LEVEL_INVALID;
210
211 t->id = pick_new_id(s->manager);
212
213 r = hashmap_put(s->manager->dns_transactions, UINT_TO_PTR(t->id), t);
214 if (r < 0) {
215 t->id = 0;
216 return r;
217 }
218
219 r = hashmap_replace(s->transactions_by_key, t->key, t);
220 if (r < 0) {
221 hashmap_remove(s->manager->dns_transactions, UINT_TO_PTR(t->id));
222 return r;
223 }
224
225 LIST_PREPEND(transactions_by_scope, s->transactions, t);
226 t->scope = s;
227
228 s->manager->n_transactions_total++;
229
230 if (ret)
231 *ret = t;
232
233 t = NULL;
234
235 return 0;
236 }
237
238 static void dns_transaction_shuffle_id(DnsTransaction *t) {
239 uint16_t new_id;
240 assert(t);
241
242 /* Pick a new ID for this transaction. */
243
244 new_id = pick_new_id(t->scope->manager);
245 assert_se(hashmap_remove_and_put(t->scope->manager->dns_transactions, UINT_TO_PTR(t->id), UINT_TO_PTR(new_id), t) >= 0);
246
247 log_debug("Transaction %" PRIu16 " is now %" PRIu16 ".", t->id, new_id);
248 t->id = new_id;
249
250 /* Make sure we generate a new packet with the new ID */
251 t->sent = dns_packet_unref(t->sent);
252 }
253
254 static void dns_transaction_tentative(DnsTransaction *t, DnsPacket *p) {
255 _cleanup_free_ char *pretty = NULL;
256 char key_str[DNS_RESOURCE_KEY_STRING_MAX];
257 DnsZoneItem *z;
258
259 assert(t);
260 assert(p);
261
262 if (manager_our_packet(t->scope->manager, p) != 0)
263 return;
264
265 (void) in_addr_to_string(p->family, &p->sender, &pretty);
266
267 log_debug("Transaction %" PRIu16 " for <%s> on scope %s on %s/%s got tentative packet from %s.",
268 t->id,
269 dns_resource_key_to_string(t->key, key_str, sizeof key_str),
270 dns_protocol_to_string(t->scope->protocol),
271 t->scope->link ? t->scope->link->name : "*",
272 af_to_name_short(t->scope->family),
273 strnull(pretty));
274
275 /* RFC 4795, Section 4.1 says that the peer with the
276 * lexicographically smaller IP address loses */
277 if (memcmp(&p->sender, &p->destination, FAMILY_ADDRESS_SIZE(p->family)) >= 0) {
278 log_debug("Peer has lexicographically larger IP address and thus lost in the conflict.");
279 return;
280 }
281
282 log_debug("We have the lexicographically larger IP address and thus lost in the conflict.");
283
284 t->block_gc++;
285
286 while ((z = set_first(t->notify_zone_items))) {
287 /* First, make sure the zone item drops the reference
288 * to us */
289 dns_zone_item_probe_stop(z);
290
291 /* Secondly, report this as conflict, so that we might
292 * look for a different hostname */
293 dns_zone_item_conflict(z);
294 }
295 t->block_gc--;
296
297 dns_transaction_gc(t);
298 }
299
300 void dns_transaction_complete(DnsTransaction *t, DnsTransactionState state) {
301 DnsQueryCandidate *c;
302 DnsZoneItem *z;
303 DnsTransaction *d;
304 const char *st;
305 char key_str[DNS_RESOURCE_KEY_STRING_MAX];
306
307 assert(t);
308 assert(!DNS_TRANSACTION_IS_LIVE(state));
309
310 if (state == DNS_TRANSACTION_DNSSEC_FAILED) {
311 dns_resource_key_to_string(t->key, key_str, sizeof key_str);
312
313 log_struct(LOG_NOTICE,
314 "MESSAGE_ID=" SD_MESSAGE_DNSSEC_FAILURE_STR,
315 LOG_MESSAGE("DNSSEC validation failed for question %s: %s", key_str, dnssec_result_to_string(t->answer_dnssec_result)),
316 "DNS_TRANSACTION=%" PRIu16, t->id,
317 "DNS_QUESTION=%s", key_str,
318 "DNSSEC_RESULT=%s", dnssec_result_to_string(t->answer_dnssec_result),
319 "DNS_SERVER=%s", dns_server_string(t->server),
320 "DNS_SERVER_FEATURE_LEVEL=%s", dns_server_feature_level_to_string(t->server->possible_feature_level));
321 }
322
323 /* Note that this call might invalidate the query. Callers
324 * should hence not attempt to access the query or transaction
325 * after calling this function. */
326
327 if (state == DNS_TRANSACTION_ERRNO)
328 st = errno_to_name(t->answer_errno);
329 else
330 st = dns_transaction_state_to_string(state);
331
332 log_debug("Transaction %" PRIu16 " for <%s> on scope %s on %s/%s now complete with <%s> from %s (%s).",
333 t->id,
334 dns_resource_key_to_string(t->key, key_str, sizeof key_str),
335 dns_protocol_to_string(t->scope->protocol),
336 t->scope->link ? t->scope->link->name : "*",
337 af_to_name_short(t->scope->family),
338 st,
339 t->answer_source < 0 ? "none" : dns_transaction_source_to_string(t->answer_source),
340 t->answer_authenticated ? "authenticated" : "unsigned");
341
342 t->state = state;
343
344 dns_transaction_close_connection(t);
345 dns_transaction_stop_timeout(t);
346
347 /* Notify all queries that are interested, but make sure the
348 * transaction isn't freed while we are still looking at it */
349 t->block_gc++;
350
351 SET_FOREACH_MOVE(c, t->notify_query_candidates_done, t->notify_query_candidates)
352 dns_query_candidate_notify(c);
353 SWAP_TWO(t->notify_query_candidates, t->notify_query_candidates_done);
354
355 SET_FOREACH_MOVE(z, t->notify_zone_items_done, t->notify_zone_items)
356 dns_zone_item_notify(z);
357 SWAP_TWO(t->notify_zone_items, t->notify_zone_items_done);
358 if (t->probing && t->state == DNS_TRANSACTION_ATTEMPTS_MAX_REACHED)
359 (void) dns_scope_announce(t->scope, false);
360
361 SET_FOREACH_MOVE(d, t->notify_transactions_done, t->notify_transactions)
362 dns_transaction_notify(d, t);
363 SWAP_TWO(t->notify_transactions, t->notify_transactions_done);
364
365 t->block_gc--;
366 dns_transaction_gc(t);
367 }
368
369 static int dns_transaction_pick_server(DnsTransaction *t) {
370 DnsServer *server;
371
372 assert(t);
373 assert(t->scope->protocol == DNS_PROTOCOL_DNS);
374
375 /* Pick a DNS server and a feature level for it. */
376
377 server = dns_scope_get_dns_server(t->scope);
378 if (!server)
379 return -ESRCH;
380
381 /* If we changed the server invalidate the feature level clamping, as the new server might have completely
382 * different properties. */
383 if (server != t->server)
384 t->clamp_feature_level = _DNS_SERVER_FEATURE_LEVEL_INVALID;
385
386 t->current_feature_level = dns_server_possible_feature_level(server);
387
388 /* Clamp the feature level if that is requested. */
389 if (t->clamp_feature_level != _DNS_SERVER_FEATURE_LEVEL_INVALID &&
390 t->current_feature_level > t->clamp_feature_level)
391 t->current_feature_level = t->clamp_feature_level;
392
393 log_debug("Using feature level %s for transaction %u.", dns_server_feature_level_to_string(t->current_feature_level), t->id);
394
395 if (server == t->server)
396 return 0;
397
398 dns_server_unref(t->server);
399 t->server = dns_server_ref(server);
400
401 t->n_picked_servers ++;
402
403 log_debug("Using DNS server %s for transaction %u.", dns_server_string(t->server), t->id);
404
405 return 1;
406 }
407
408 static void dns_transaction_retry(DnsTransaction *t, bool next_server) {
409 int r;
410
411 assert(t);
412
413 log_debug("Retrying transaction %" PRIu16 ".", t->id);
414
415 /* Before we try again, switch to a new server. */
416 if (next_server)
417 dns_scope_next_dns_server(t->scope);
418
419 r = dns_transaction_go(t);
420 if (r < 0) {
421 t->answer_errno = -r;
422 dns_transaction_complete(t, DNS_TRANSACTION_ERRNO);
423 }
424 }
425
426 static int dns_transaction_maybe_restart(DnsTransaction *t) {
427 int r;
428
429 assert(t);
430
431 /* Returns > 0 if the transaction was restarted, 0 if not */
432
433 if (!t->server)
434 return 0;
435
436 if (t->current_feature_level <= dns_server_possible_feature_level(t->server))
437 return 0;
438
439 /* The server's current feature level is lower than when we sent the original query. We learnt something from
440 the response or possibly an auxiliary DNSSEC response that we didn't know before. We take that as reason to
441 restart the whole transaction. This is a good idea to deal with servers that respond rubbish if we include
442 OPT RR or DO bit. One of these cases is documented here, for example:
443 https://open.nlnetlabs.nl/pipermail/dnssec-trigger/2014-November/000376.html */
444
445 log_debug("Server feature level is now lower than when we began our transaction. Restarting with new ID.");
446 dns_transaction_shuffle_id(t);
447
448 r = dns_transaction_go(t);
449 if (r < 0)
450 return r;
451
452 return 1;
453 }
454
455 static void on_transaction_stream_error(DnsTransaction *t, int error) {
456 assert(t);
457
458 dns_transaction_close_connection(t);
459
460 if (ERRNO_IS_DISCONNECT(error)) {
461 if (t->scope->protocol == DNS_PROTOCOL_LLMNR) {
462 /* If the LLMNR/TCP connection failed, the host doesn't support LLMNR, and we cannot answer the
463 * question on this scope. */
464 dns_transaction_complete(t, DNS_TRANSACTION_NOT_FOUND);
465 return;
466 }
467
468 dns_transaction_retry(t, true);
469 return;
470 }
471 if (error != 0) {
472 t->answer_errno = error;
473 dns_transaction_complete(t, DNS_TRANSACTION_ERRNO);
474 }
475 }
476
477 static int dns_transaction_on_stream_packet(DnsTransaction *t, DnsPacket *p) {
478 assert(t);
479 assert(p);
480
481 dns_transaction_close_connection(t);
482
483 if (dns_packet_validate_reply(p) <= 0) {
484 log_debug("Invalid TCP reply packet.");
485 dns_transaction_complete(t, DNS_TRANSACTION_INVALID_REPLY);
486 return 0;
487 }
488
489 dns_scope_check_conflicts(t->scope, p);
490
491 t->block_gc++;
492 dns_transaction_process_reply(t, p);
493 t->block_gc--;
494
495 /* If the response wasn't useful, then complete the transition
496 * now. After all, we are the worst feature set now with TCP
497 * sockets, and there's really no point in retrying. */
498 if (t->state == DNS_TRANSACTION_PENDING)
499 dns_transaction_complete(t, DNS_TRANSACTION_INVALID_REPLY);
500 else
501 dns_transaction_gc(t);
502
503 return 0;
504 }
505
506 static int on_stream_connection(DnsStream *s) {
507 #if ENABLE_DNS_OVER_TLS
508 /* Store TLS Ticket for faster succesive TLS handshakes */
509 if (s->tls_session && s->server) {
510 if (s->server->tls_session_data.data)
511 gnutls_free(s->server->tls_session_data.data);
512
513 gnutls_session_get_data2(s->tls_session, &s->server->tls_session_data);
514 }
515 #endif
516
517 return 0;
518 }
519
520 static int on_stream_complete(DnsStream *s, int error) {
521 DnsTransaction *t, *n;
522 int r = 0;
523
524 /* Do not let new transactions use this stream */
525 if (s->server && s->server->stream == s)
526 s->server->stream = dns_stream_unref(s->server->stream);
527
528 if (ERRNO_IS_DISCONNECT(error) && s->protocol != DNS_PROTOCOL_LLMNR) {
529 usec_t usec;
530
531 log_debug_errno(error, "Connection failure for DNS TCP stream: %m");
532
533 if (s->transactions) {
534 t = s->transactions;
535 assert_se(sd_event_now(t->scope->manager->event, clock_boottime_or_monotonic(), &usec) >= 0);
536 dns_server_packet_lost(t->server, IPPROTO_TCP, t->current_feature_level);
537 }
538 }
539
540 LIST_FOREACH_SAFE(transactions_by_stream, t, n, s->transactions)
541 if (error != 0)
542 on_transaction_stream_error(t, error);
543 else if (DNS_PACKET_ID(s->read_packet) == t->id)
544 /* As each transaction have a unique id the return code is only set once */
545 r = dns_transaction_on_stream_packet(t, s->read_packet);
546
547 return r;
548 }
549
550 static int dns_stream_on_packet(DnsStream *s) {
551 _cleanup_(dns_packet_unrefp) DnsPacket *p = NULL;
552 int r = 0;
553 DnsTransaction *t;
554
555 /* Take ownership of packet to be able to receive new packets */
556 p = TAKE_PTR(s->read_packet);
557 s->n_read = 0;
558
559 t = hashmap_get(s->manager->dns_transactions, UINT_TO_PTR(DNS_PACKET_ID(p)));
560
561 /* Ignore incorrect transaction id as transaction can have been canceled */
562 if (t)
563 r = dns_transaction_on_stream_packet(t, p);
564 else {
565 if (dns_packet_validate_reply(p) <= 0) {
566 log_debug("Invalid TCP reply packet.");
567 on_stream_complete(s, 0);
568 }
569 return 0;
570 }
571
572 return r;
573 }
574
575 static int dns_transaction_emit_tcp(DnsTransaction *t) {
576 _cleanup_close_ int fd = -1;
577 _cleanup_(dns_stream_unrefp) DnsStream *s = NULL;
578 union sockaddr_union sa;
579 int r;
580 #if ENABLE_DNS_OVER_TLS
581 gnutls_session_t gs;
582 #endif
583
584 assert(t);
585
586 dns_transaction_close_connection(t);
587
588 switch (t->scope->protocol) {
589
590 case DNS_PROTOCOL_DNS:
591 r = dns_transaction_pick_server(t);
592 if (r < 0)
593 return r;
594
595 if (!dns_server_dnssec_supported(t->server) && dns_type_is_dnssec(t->key->type))
596 return -EOPNOTSUPP;
597
598 r = dns_server_adjust_opt(t->server, t->sent, t->current_feature_level);
599 if (r < 0)
600 return r;
601
602 if (t->server->stream && (DNS_SERVER_FEATURE_LEVEL_IS_TLS(t->current_feature_level) == t->server->stream->encrypted))
603 s = dns_stream_ref(t->server->stream);
604 else
605 fd = dns_scope_socket_tcp(t->scope, AF_UNSPEC, NULL, t->server, DNS_SERVER_FEATURE_LEVEL_IS_TLS(t->current_feature_level) ? 853 : 53, &sa);
606
607 break;
608
609 case DNS_PROTOCOL_LLMNR:
610 /* When we already received a reply to this (but it was truncated), send to its sender address */
611 if (t->received)
612 fd = dns_scope_socket_tcp(t->scope, t->received->family, &t->received->sender, NULL, t->received->sender_port, &sa);
613 else {
614 union in_addr_union address;
615 int family = AF_UNSPEC;
616
617 /* Otherwise, try to talk to the owner of a
618 * the IP address, in case this is a reverse
619 * PTR lookup */
620
621 r = dns_name_address(dns_resource_key_name(t->key), &family, &address);
622 if (r < 0)
623 return r;
624 if (r == 0)
625 return -EINVAL;
626 if (family != t->scope->family)
627 return -ESRCH;
628
629 fd = dns_scope_socket_tcp(t->scope, family, &address, NULL, LLMNR_PORT, &sa);
630 }
631
632 break;
633
634 default:
635 return -EAFNOSUPPORT;
636 }
637
638 if (!s) {
639 if (fd < 0)
640 return fd;
641
642 r = dns_stream_new(t->scope->manager, &s, t->scope->protocol, fd, &sa);
643 if (r < 0)
644 return r;
645
646 fd = -1;
647
648 if (t->server) {
649 dns_stream_unref(t->server->stream);
650 t->server->stream = dns_stream_ref(s);
651 s->server = dns_server_ref(t->server);
652 }
653
654 #if ENABLE_DNS_OVER_TLS
655 if (DNS_SERVER_FEATURE_LEVEL_IS_TLS(t->current_feature_level)) {
656 r = gnutls_init(&gs, GNUTLS_CLIENT | GNUTLS_ENABLE_FALSE_START | GNUTLS_NONBLOCK);
657 if (r < 0)
658 return r;
659
660 /* As DNS-over-TLS is a recent protocol, older TLS versions can be disabled */
661 r = gnutls_priority_set_direct(gs, "NORMAL:-VERS-ALL:+VERS-TLS1.2", NULL);
662 if (r < 0)
663 return r;
664
665 r = gnutls_credentials_set(gs, GNUTLS_CRD_CERTIFICATE, t->server->tls_cert_cred);
666 if (r < 0)
667 return r;
668
669 if (t->server && t->server->tls_session_data.size > 0)
670 gnutls_session_set_data(gs, t->server->tls_session_data.data, t->server->tls_session_data.size);
671
672 gnutls_handshake_set_timeout(gs, GNUTLS_DEFAULT_HANDSHAKE_TIMEOUT);
673
674 r = dns_stream_connect_tls(s, gs);
675 if (r < 0)
676 return r;
677 }
678 #endif
679
680 s->on_connection = on_stream_connection;
681 s->complete = on_stream_complete;
682 s->on_packet = dns_stream_on_packet;
683
684 /* The interface index is difficult to determine if we are
685 * connecting to the local host, hence fill this in right away
686 * instead of determining it from the socket */
687 s->ifindex = dns_scope_ifindex(t->scope);
688 }
689
690 t->stream = TAKE_PTR(s);
691 LIST_PREPEND(transactions_by_stream, t->stream->transactions, t);
692
693 r = dns_stream_write_packet(t->stream, t->sent);
694 if (r < 0) {
695 dns_transaction_close_connection(t);
696 return r;
697 }
698
699 dns_transaction_reset_answer(t);
700
701 t->tried_stream = true;
702
703 return 0;
704 }
705
706 static void dns_transaction_cache_answer(DnsTransaction *t) {
707 assert(t);
708
709 /* For mDNS we cache whenever we get the packet, rather than
710 * in each transaction. */
711 if (!IN_SET(t->scope->protocol, DNS_PROTOCOL_DNS, DNS_PROTOCOL_LLMNR))
712 return;
713
714 /* Caching disabled? */
715 if (!t->scope->manager->enable_cache)
716 return;
717
718 /* We never cache if this packet is from the local host, under
719 * the assumption that a locally running DNS server would
720 * cache this anyway, and probably knows better when to flush
721 * the cache then we could. */
722 if (!DNS_PACKET_SHALL_CACHE(t->received))
723 return;
724
725 dns_cache_put(&t->scope->cache,
726 t->key,
727 t->answer_rcode,
728 t->answer,
729 t->answer_authenticated,
730 t->answer_nsec_ttl,
731 0,
732 t->received->family,
733 &t->received->sender);
734 }
735
736 static bool dns_transaction_dnssec_is_live(DnsTransaction *t) {
737 DnsTransaction *dt;
738 Iterator i;
739
740 assert(t);
741
742 SET_FOREACH(dt, t->dnssec_transactions, i)
743 if (DNS_TRANSACTION_IS_LIVE(dt->state))
744 return true;
745
746 return false;
747 }
748
749 static int dns_transaction_dnssec_ready(DnsTransaction *t) {
750 DnsTransaction *dt;
751 Iterator i;
752
753 assert(t);
754
755 /* Checks whether the auxiliary DNSSEC transactions of our transaction have completed, or are still
756 * ongoing. Returns 0, if we aren't ready for the DNSSEC validation, positive if we are. */
757
758 SET_FOREACH(dt, t->dnssec_transactions, i) {
759
760 switch (dt->state) {
761
762 case DNS_TRANSACTION_NULL:
763 case DNS_TRANSACTION_PENDING:
764 case DNS_TRANSACTION_VALIDATING:
765 /* Still ongoing */
766 return 0;
767
768 case DNS_TRANSACTION_RCODE_FAILURE:
769 if (!IN_SET(dt->answer_rcode, DNS_RCODE_NXDOMAIN, DNS_RCODE_SERVFAIL)) {
770 log_debug("Auxiliary DNSSEC RR query failed with rcode=%s.", dns_rcode_to_string(dt->answer_rcode));
771 goto fail;
772 }
773
774 /* Fall-through: NXDOMAIN/SERVFAIL is good enough for us. This is because some DNS servers
775 * erronously return NXDOMAIN/SERVFAIL for empty non-terminals (Akamai...) or missing DS
776 * records (Facebook), and we need to handle that nicely, when asking for parent SOA or similar
777 * RRs to make unsigned proofs. */
778
779 case DNS_TRANSACTION_SUCCESS:
780 /* All good. */
781 break;
782
783 case DNS_TRANSACTION_DNSSEC_FAILED:
784 /* We handle DNSSEC failures different from other errors, as we care about the DNSSEC
785 * validationr result */
786
787 log_debug("Auxiliary DNSSEC RR query failed validation: %s", dnssec_result_to_string(dt->answer_dnssec_result));
788 t->answer_dnssec_result = dt->answer_dnssec_result; /* Copy error code over */
789 dns_transaction_complete(t, DNS_TRANSACTION_DNSSEC_FAILED);
790 return 0;
791
792 default:
793 log_debug("Auxiliary DNSSEC RR query failed with %s", dns_transaction_state_to_string(dt->state));
794 goto fail;
795 }
796 }
797
798 /* All is ready, we can go and validate */
799 return 1;
800
801 fail:
802 t->answer_dnssec_result = DNSSEC_FAILED_AUXILIARY;
803 dns_transaction_complete(t, DNS_TRANSACTION_DNSSEC_FAILED);
804 return 0;
805 }
806
807 static void dns_transaction_process_dnssec(DnsTransaction *t) {
808 int r;
809
810 assert(t);
811
812 /* Are there ongoing DNSSEC transactions? If so, let's wait for them. */
813 r = dns_transaction_dnssec_ready(t);
814 if (r < 0)
815 goto fail;
816 if (r == 0) /* We aren't ready yet (or one of our auxiliary transactions failed, and we shouldn't validate now */
817 return;
818
819 /* See if we learnt things from the additional DNSSEC transactions, that we didn't know before, and better
820 * restart the lookup immediately. */
821 r = dns_transaction_maybe_restart(t);
822 if (r < 0)
823 goto fail;
824 if (r > 0) /* Transaction got restarted... */
825 return;
826
827 /* All our auxiliary DNSSEC transactions are complete now. Try
828 * to validate our RRset now. */
829 r = dns_transaction_validate_dnssec(t);
830 if (r == -EBADMSG) {
831 dns_transaction_complete(t, DNS_TRANSACTION_INVALID_REPLY);
832 return;
833 }
834 if (r < 0)
835 goto fail;
836
837 if (t->answer_dnssec_result == DNSSEC_INCOMPATIBLE_SERVER &&
838 t->scope->dnssec_mode == DNSSEC_YES) {
839
840 /* We are not in automatic downgrade mode, and the server is bad. Let's try a different server, maybe
841 * that works. */
842
843 if (t->n_picked_servers < dns_scope_get_n_dns_servers(t->scope)) {
844 /* We tried fewer servers on this transaction than we know, let's try another one then */
845 dns_transaction_retry(t, true);
846 return;
847 }
848
849 /* OK, let's give up, apparently all servers we tried didn't work. */
850 dns_transaction_complete(t, DNS_TRANSACTION_DNSSEC_FAILED);
851 return;
852 }
853
854 if (!IN_SET(t->answer_dnssec_result,
855 _DNSSEC_RESULT_INVALID, /* No DNSSEC validation enabled */
856 DNSSEC_VALIDATED, /* Answer is signed and validated successfully */
857 DNSSEC_UNSIGNED, /* Answer is right-fully unsigned */
858 DNSSEC_INCOMPATIBLE_SERVER)) { /* Server does not do DNSSEC (Yay, we are downgrade attack vulnerable!) */
859 dns_transaction_complete(t, DNS_TRANSACTION_DNSSEC_FAILED);
860 return;
861 }
862
863 if (t->answer_dnssec_result == DNSSEC_INCOMPATIBLE_SERVER)
864 dns_server_warn_downgrade(t->server);
865
866 dns_transaction_cache_answer(t);
867
868 if (t->answer_rcode == DNS_RCODE_SUCCESS)
869 dns_transaction_complete(t, DNS_TRANSACTION_SUCCESS);
870 else
871 dns_transaction_complete(t, DNS_TRANSACTION_RCODE_FAILURE);
872
873 return;
874
875 fail:
876 t->answer_errno = -r;
877 dns_transaction_complete(t, DNS_TRANSACTION_ERRNO);
878 }
879
880 static int dns_transaction_has_positive_answer(DnsTransaction *t, DnsAnswerFlags *flags) {
881 int r;
882
883 assert(t);
884
885 /* Checks whether the answer is positive, i.e. either a direct
886 * answer to the question, or a CNAME/DNAME for it */
887
888 r = dns_answer_match_key(t->answer, t->key, flags);
889 if (r != 0)
890 return r;
891
892 r = dns_answer_find_cname_or_dname(t->answer, t->key, NULL, flags);
893 if (r != 0)
894 return r;
895
896 return false;
897 }
898
899 static int dns_transaction_fix_rcode(DnsTransaction *t) {
900 int r;
901
902 assert(t);
903
904 /* Fix up the RCODE to SUCCESS if we get at least one matching RR in a response. Note that this contradicts the
905 * DNS RFCs a bit. Specifically, RFC 6604 Section 3 clarifies that the RCODE shall say something about a
906 * CNAME/DNAME chain element coming after the last chain element contained in the message, and not the first
907 * one included. However, it also indicates that not all DNS servers implement this correctly. Moreover, when
908 * using DNSSEC we usually only can prove the first element of a CNAME/DNAME chain anyway, hence let's settle
909 * on always processing the RCODE as referring to the immediate look-up we do, i.e. the first element of a
910 * CNAME/DNAME chain. This way, we uniformly handle CNAME/DNAME chains, regardless if the DNS server
911 * incorrectly implements RCODE, whether DNSSEC is in use, or whether the DNS server only supplied us with an
912 * incomplete CNAME/DNAME chain.
913 *
914 * Or in other words: if we get at least one positive reply in a message we patch NXDOMAIN to become SUCCESS,
915 * and then rely on the CNAME chasing logic to figure out that there's actually a CNAME error with a new
916 * lookup. */
917
918 if (t->answer_rcode != DNS_RCODE_NXDOMAIN)
919 return 0;
920
921 r = dns_transaction_has_positive_answer(t, NULL);
922 if (r <= 0)
923 return r;
924
925 t->answer_rcode = DNS_RCODE_SUCCESS;
926 return 0;
927 }
928
929 void dns_transaction_process_reply(DnsTransaction *t, DnsPacket *p) {
930 usec_t ts;
931 int r;
932
933 assert(t);
934 assert(p);
935 assert(t->scope);
936 assert(t->scope->manager);
937
938 if (t->state != DNS_TRANSACTION_PENDING)
939 return;
940
941 /* Note that this call might invalidate the query. Callers
942 * should hence not attempt to access the query or transaction
943 * after calling this function. */
944
945 log_debug("Processing incoming packet on transaction %" PRIu16" (rcode=%s).",
946 t->id, dns_rcode_to_string(DNS_PACKET_RCODE(p)));
947
948 switch (t->scope->protocol) {
949
950 case DNS_PROTOCOL_LLMNR:
951 /* For LLMNR we will not accept any packets from other interfaces */
952
953 if (p->ifindex != dns_scope_ifindex(t->scope))
954 return;
955
956 if (p->family != t->scope->family)
957 return;
958
959 /* Tentative packets are not full responses but still
960 * useful for identifying uniqueness conflicts during
961 * probing. */
962 if (DNS_PACKET_LLMNR_T(p)) {
963 dns_transaction_tentative(t, p);
964 return;
965 }
966
967 break;
968
969 case DNS_PROTOCOL_MDNS:
970 /* For mDNS we will not accept any packets from other interfaces */
971
972 if (p->ifindex != dns_scope_ifindex(t->scope))
973 return;
974
975 if (p->family != t->scope->family)
976 return;
977
978 break;
979
980 case DNS_PROTOCOL_DNS:
981 /* Note that we do not need to verify the
982 * addresses/port numbers of incoming traffic, as we
983 * invoked connect() on our UDP socket in which case
984 * the kernel already does the needed verification for
985 * us. */
986 break;
987
988 default:
989 assert_not_reached("Invalid DNS protocol.");
990 }
991
992 if (t->received != p) {
993 dns_packet_unref(t->received);
994 t->received = dns_packet_ref(p);
995 }
996
997 t->answer_source = DNS_TRANSACTION_NETWORK;
998
999 if (p->ipproto == IPPROTO_TCP) {
1000 if (DNS_PACKET_TC(p)) {
1001 /* Truncated via TCP? Somebody must be fucking with us */
1002 dns_transaction_complete(t, DNS_TRANSACTION_INVALID_REPLY);
1003 return;
1004 }
1005
1006 if (DNS_PACKET_ID(p) != t->id) {
1007 /* Not the reply to our query? Somebody must be fucking with us */
1008 dns_transaction_complete(t, DNS_TRANSACTION_INVALID_REPLY);
1009 return;
1010 }
1011 }
1012
1013 assert_se(sd_event_now(t->scope->manager->event, clock_boottime_or_monotonic(), &ts) >= 0);
1014
1015 switch (t->scope->protocol) {
1016
1017 case DNS_PROTOCOL_DNS:
1018 assert(t->server);
1019
1020 if (IN_SET(DNS_PACKET_RCODE(p), DNS_RCODE_FORMERR, DNS_RCODE_SERVFAIL, DNS_RCODE_NOTIMP)) {
1021
1022 /* Request failed, immediately try again with reduced features */
1023
1024 if (t->current_feature_level <= DNS_SERVER_FEATURE_LEVEL_UDP) {
1025
1026 /* This was already at UDP feature level? If so, it doesn't make sense to downgrade
1027 * this transaction anymore, but let's see if it might make sense to send the request
1028 * to a different DNS server instead. If not let's process the response, and accept the
1029 * rcode. Note that we don't retry on TCP, since that's a suitable way to mitigate
1030 * packet loss, but is not going to give us better rcodes should we actually have
1031 * managed to get them already at UDP level. */
1032
1033 if (t->n_picked_servers < dns_scope_get_n_dns_servers(t->scope)) {
1034 /* We tried fewer servers on this transaction than we know, let's try another one then */
1035 dns_transaction_retry(t, true);
1036 return;
1037 }
1038
1039 /* Give up, accept the rcode */
1040 log_debug("Server returned error: %s", dns_rcode_to_string(DNS_PACKET_RCODE(p)));
1041 break;
1042 }
1043
1044 /* Reduce this feature level by one and try again. */
1045 switch (t->current_feature_level) {
1046 case DNS_SERVER_FEATURE_LEVEL_TLS_DO:
1047 t->clamp_feature_level = DNS_SERVER_FEATURE_LEVEL_TLS_PLAIN;
1048 break;
1049 case DNS_SERVER_FEATURE_LEVEL_TLS_PLAIN + 1:
1050 /* Skip plain TLS when TLS is not supported */
1051 t->clamp_feature_level = DNS_SERVER_FEATURE_LEVEL_TLS_PLAIN - 1;
1052 break;
1053 default:
1054 t->clamp_feature_level = t->current_feature_level - 1;
1055 }
1056
1057 log_debug("Server returned error %s, retrying transaction with reduced feature level %s.",
1058 dns_rcode_to_string(DNS_PACKET_RCODE(p)),
1059 dns_server_feature_level_to_string(t->clamp_feature_level));
1060
1061 dns_transaction_retry(t, false /* use the same server */);
1062 return;
1063 }
1064
1065 if (DNS_PACKET_RCODE(p) == DNS_RCODE_REFUSED) {
1066 /* This server refused our request? If so, try again, use a different server */
1067 log_debug("Server returned REFUSED, switching servers, and retrying.");
1068 dns_transaction_retry(t, true /* pick a new server */);
1069 return;
1070 }
1071
1072 if (DNS_PACKET_TC(p))
1073 dns_server_packet_truncated(t->server, t->current_feature_level);
1074
1075 break;
1076
1077 case DNS_PROTOCOL_LLMNR:
1078 case DNS_PROTOCOL_MDNS:
1079 dns_scope_packet_received(t->scope, ts - t->start_usec);
1080 break;
1081
1082 default:
1083 assert_not_reached("Invalid DNS protocol.");
1084 }
1085
1086 if (DNS_PACKET_TC(p)) {
1087
1088 /* Truncated packets for mDNS are not allowed. Give up immediately. */
1089 if (t->scope->protocol == DNS_PROTOCOL_MDNS) {
1090 dns_transaction_complete(t, DNS_TRANSACTION_INVALID_REPLY);
1091 return;
1092 }
1093
1094 log_debug("Reply truncated, retrying via TCP.");
1095
1096 /* Response was truncated, let's try again with good old TCP */
1097 r = dns_transaction_emit_tcp(t);
1098 if (r == -ESRCH) {
1099 /* No servers found? Damn! */
1100 dns_transaction_complete(t, DNS_TRANSACTION_NO_SERVERS);
1101 return;
1102 }
1103 if (r == -EOPNOTSUPP) {
1104 /* Tried to ask for DNSSEC RRs, on a server that doesn't do DNSSEC */
1105 dns_transaction_complete(t, DNS_TRANSACTION_RR_TYPE_UNSUPPORTED);
1106 return;
1107 }
1108 if (r < 0) {
1109 /* On LLMNR, if we cannot connect to the host,
1110 * we immediately give up */
1111 if (t->scope->protocol != DNS_PROTOCOL_DNS)
1112 goto fail;
1113
1114 /* On DNS, couldn't send? Try immediately again, with a new server */
1115 dns_transaction_retry(t, true);
1116 }
1117
1118 return;
1119 }
1120
1121 /* After the superficial checks, actually parse the message. */
1122 r = dns_packet_extract(p);
1123 if (r < 0) {
1124 dns_transaction_complete(t, DNS_TRANSACTION_INVALID_REPLY);
1125 return;
1126 }
1127
1128 if (t->server) {
1129 /* Report that we successfully received a valid packet with a good rcode after we initially got a bad
1130 * rcode and subsequently downgraded the protocol */
1131
1132 if (IN_SET(DNS_PACKET_RCODE(p), DNS_RCODE_SUCCESS, DNS_RCODE_NXDOMAIN) &&
1133 t->clamp_feature_level != _DNS_SERVER_FEATURE_LEVEL_INVALID)
1134 dns_server_packet_rcode_downgrade(t->server, t->clamp_feature_level);
1135
1136 /* Report that the OPT RR was missing */
1137 if (!p->opt)
1138 dns_server_packet_bad_opt(t->server, t->current_feature_level);
1139
1140 /* Report that we successfully received a packet */
1141 dns_server_packet_received(t->server, p->ipproto, t->current_feature_level, p->size);
1142 }
1143
1144 /* See if we know things we didn't know before that indicate we better restart the lookup immediately. */
1145 r = dns_transaction_maybe_restart(t);
1146 if (r < 0)
1147 goto fail;
1148 if (r > 0) /* Transaction got restarted... */
1149 return;
1150
1151 if (IN_SET(t->scope->protocol, DNS_PROTOCOL_DNS, DNS_PROTOCOL_LLMNR, DNS_PROTOCOL_MDNS)) {
1152
1153 /* When dealing with protocols other than mDNS only consider responses with
1154 * equivalent query section to the request. For mDNS this check doesn't make
1155 * sense, because the section 6 of RFC6762 states that "Multicast DNS responses MUST NOT
1156 * contain any questions in the Question Section". */
1157 if (t->scope->protocol != DNS_PROTOCOL_MDNS) {
1158 r = dns_packet_is_reply_for(p, t->key);
1159 if (r < 0)
1160 goto fail;
1161 if (r == 0) {
1162 dns_transaction_complete(t, DNS_TRANSACTION_INVALID_REPLY);
1163 return;
1164 }
1165 }
1166
1167 /* Install the answer as answer to the transaction */
1168 dns_answer_unref(t->answer);
1169 t->answer = dns_answer_ref(p->answer);
1170 t->answer_rcode = DNS_PACKET_RCODE(p);
1171 t->answer_dnssec_result = _DNSSEC_RESULT_INVALID;
1172 t->answer_authenticated = false;
1173
1174 r = dns_transaction_fix_rcode(t);
1175 if (r < 0)
1176 goto fail;
1177
1178 /* Block GC while starting requests for additional DNSSEC RRs */
1179 t->block_gc++;
1180 r = dns_transaction_request_dnssec_keys(t);
1181 t->block_gc--;
1182
1183 /* Maybe the transaction is ready for GC'ing now? If so, free it and return. */
1184 if (!dns_transaction_gc(t))
1185 return;
1186
1187 /* Requesting additional keys might have resulted in
1188 * this transaction to fail, since the auxiliary
1189 * request failed for some reason. If so, we are not
1190 * in pending state anymore, and we should exit
1191 * quickly. */
1192 if (t->state != DNS_TRANSACTION_PENDING)
1193 return;
1194 if (r < 0)
1195 goto fail;
1196 if (r > 0) {
1197 /* There are DNSSEC transactions pending now. Update the state accordingly. */
1198 t->state = DNS_TRANSACTION_VALIDATING;
1199 dns_transaction_close_connection(t);
1200 dns_transaction_stop_timeout(t);
1201 return;
1202 }
1203 }
1204
1205 dns_transaction_process_dnssec(t);
1206 return;
1207
1208 fail:
1209 t->answer_errno = -r;
1210 dns_transaction_complete(t, DNS_TRANSACTION_ERRNO);
1211 }
1212
1213 static int on_dns_packet(sd_event_source *s, int fd, uint32_t revents, void *userdata) {
1214 _cleanup_(dns_packet_unrefp) DnsPacket *p = NULL;
1215 DnsTransaction *t = userdata;
1216 int r;
1217
1218 assert(t);
1219 assert(t->scope);
1220
1221 r = manager_recv(t->scope->manager, fd, DNS_PROTOCOL_DNS, &p);
1222 if (ERRNO_IS_DISCONNECT(-r)) {
1223 usec_t usec;
1224
1225 /* UDP connection failure get reported via ICMP and then are possible delivered to us on the next
1226 * recvmsg(). Treat this like a lost packet. */
1227
1228 log_debug_errno(r, "Connection failure for DNS UDP packet: %m");
1229 assert_se(sd_event_now(t->scope->manager->event, clock_boottime_or_monotonic(), &usec) >= 0);
1230 dns_server_packet_lost(t->server, IPPROTO_UDP, t->current_feature_level);
1231
1232 dns_transaction_retry(t, true);
1233 return 0;
1234 }
1235 if (r < 0) {
1236 dns_transaction_complete(t, DNS_TRANSACTION_ERRNO);
1237 t->answer_errno = -r;
1238 return 0;
1239 }
1240
1241 r = dns_packet_validate_reply(p);
1242 if (r < 0) {
1243 log_debug_errno(r, "Received invalid DNS packet as response, ignoring: %m");
1244 return 0;
1245 }
1246 if (r == 0) {
1247 log_debug("Received inappropriate DNS packet as response, ignoring.");
1248 return 0;
1249 }
1250
1251 if (DNS_PACKET_ID(p) != t->id) {
1252 log_debug("Received packet with incorrect transaction ID, ignoring.");
1253 return 0;
1254 }
1255
1256 dns_transaction_process_reply(t, p);
1257 return 0;
1258 }
1259
1260 static int dns_transaction_emit_udp(DnsTransaction *t) {
1261 int r;
1262
1263 assert(t);
1264
1265 if (t->scope->protocol == DNS_PROTOCOL_DNS) {
1266
1267 r = dns_transaction_pick_server(t);
1268 if (r < 0)
1269 return r;
1270
1271 if (t->current_feature_level < DNS_SERVER_FEATURE_LEVEL_UDP || DNS_SERVER_FEATURE_LEVEL_IS_TLS(t->current_feature_level))
1272 return -EAGAIN; /* Sorry, can't do UDP, try TCP! */
1273
1274 if (!dns_server_dnssec_supported(t->server) && dns_type_is_dnssec(t->key->type))
1275 return -EOPNOTSUPP;
1276
1277 if (r > 0 || t->dns_udp_fd < 0) { /* Server changed, or no connection yet. */
1278 int fd;
1279
1280 dns_transaction_close_connection(t);
1281
1282 fd = dns_scope_socket_udp(t->scope, t->server, 53);
1283 if (fd < 0)
1284 return fd;
1285
1286 r = sd_event_add_io(t->scope->manager->event, &t->dns_udp_event_source, fd, EPOLLIN, on_dns_packet, t);
1287 if (r < 0) {
1288 safe_close(fd);
1289 return r;
1290 }
1291
1292 (void) sd_event_source_set_description(t->dns_udp_event_source, "dns-transaction-udp");
1293 t->dns_udp_fd = fd;
1294 }
1295
1296 r = dns_server_adjust_opt(t->server, t->sent, t->current_feature_level);
1297 if (r < 0)
1298 return r;
1299 } else
1300 dns_transaction_close_connection(t);
1301
1302 r = dns_scope_emit_udp(t->scope, t->dns_udp_fd, t->sent);
1303 if (r < 0)
1304 return r;
1305
1306 dns_transaction_reset_answer(t);
1307
1308 return 0;
1309 }
1310
1311 static int on_transaction_timeout(sd_event_source *s, usec_t usec, void *userdata) {
1312 DnsTransaction *t = userdata;
1313
1314 assert(s);
1315 assert(t);
1316
1317 if (!t->initial_jitter_scheduled || t->initial_jitter_elapsed) {
1318 /* Timeout reached? Increase the timeout for the server used */
1319 switch (t->scope->protocol) {
1320
1321 case DNS_PROTOCOL_DNS:
1322 assert(t->server);
1323 dns_server_packet_lost(t->server, t->stream ? IPPROTO_TCP : IPPROTO_UDP, t->current_feature_level);
1324 break;
1325
1326 case DNS_PROTOCOL_LLMNR:
1327 case DNS_PROTOCOL_MDNS:
1328 dns_scope_packet_lost(t->scope, usec - t->start_usec);
1329 break;
1330
1331 default:
1332 assert_not_reached("Invalid DNS protocol.");
1333 }
1334
1335 if (t->initial_jitter_scheduled)
1336 t->initial_jitter_elapsed = true;
1337 }
1338
1339 log_debug("Timeout reached on transaction %" PRIu16 ".", t->id);
1340
1341 dns_transaction_retry(t, true);
1342 return 0;
1343 }
1344
1345 static usec_t transaction_get_resend_timeout(DnsTransaction *t) {
1346 assert(t);
1347 assert(t->scope);
1348
1349 switch (t->scope->protocol) {
1350
1351 case DNS_PROTOCOL_DNS:
1352
1353 /* When we do TCP, grant a much longer timeout, as in this case there's no need for us to quickly
1354 * resend, as the kernel does that anyway for us, and we really don't want to interrupt it in that
1355 * needlessly. */
1356 if (t->stream)
1357 return TRANSACTION_TCP_TIMEOUT_USEC;
1358
1359 return DNS_TIMEOUT_USEC;
1360
1361 case DNS_PROTOCOL_MDNS:
1362 assert(t->n_attempts > 0);
1363 if (t->probing)
1364 return MDNS_PROBING_INTERVAL_USEC;
1365 else
1366 return (1 << (t->n_attempts - 1)) * USEC_PER_SEC;
1367
1368 case DNS_PROTOCOL_LLMNR:
1369 return t->scope->resend_timeout;
1370
1371 default:
1372 assert_not_reached("Invalid DNS protocol.");
1373 }
1374 }
1375
1376 static int dns_transaction_prepare(DnsTransaction *t, usec_t ts) {
1377 int r;
1378
1379 assert(t);
1380
1381 dns_transaction_stop_timeout(t);
1382
1383 if (!dns_scope_network_good(t->scope)) {
1384 dns_transaction_complete(t, DNS_TRANSACTION_NETWORK_DOWN);
1385 return 0;
1386 }
1387
1388 if (t->n_attempts >= TRANSACTION_ATTEMPTS_MAX(t->scope->protocol)) {
1389 dns_transaction_complete(t, DNS_TRANSACTION_ATTEMPTS_MAX_REACHED);
1390 return 0;
1391 }
1392
1393 if (t->scope->protocol == DNS_PROTOCOL_LLMNR && t->tried_stream) {
1394 /* If we already tried via a stream, then we don't
1395 * retry on LLMNR. See RFC 4795, Section 2.7. */
1396 dns_transaction_complete(t, DNS_TRANSACTION_ATTEMPTS_MAX_REACHED);
1397 return 0;
1398 }
1399
1400 t->n_attempts++;
1401 t->start_usec = ts;
1402
1403 dns_transaction_reset_answer(t);
1404 dns_transaction_flush_dnssec_transactions(t);
1405
1406 /* Check the trust anchor. Do so only on classic DNS, since DNSSEC does not apply otherwise. */
1407 if (t->scope->protocol == DNS_PROTOCOL_DNS) {
1408 r = dns_trust_anchor_lookup_positive(&t->scope->manager->trust_anchor, t->key, &t->answer);
1409 if (r < 0)
1410 return r;
1411 if (r > 0) {
1412 t->answer_rcode = DNS_RCODE_SUCCESS;
1413 t->answer_source = DNS_TRANSACTION_TRUST_ANCHOR;
1414 t->answer_authenticated = true;
1415 dns_transaction_complete(t, DNS_TRANSACTION_SUCCESS);
1416 return 0;
1417 }
1418
1419 if (dns_name_is_root(dns_resource_key_name(t->key)) &&
1420 t->key->type == DNS_TYPE_DS) {
1421
1422 /* Hmm, this is a request for the root DS? A
1423 * DS RR doesn't exist in the root zone, and
1424 * if our trust anchor didn't know it either,
1425 * this means we cannot do any DNSSEC logic
1426 * anymore. */
1427
1428 if (t->scope->dnssec_mode == DNSSEC_ALLOW_DOWNGRADE) {
1429 /* We are in downgrade mode. In this
1430 * case, synthesize an unsigned empty
1431 * response, so that the any lookup
1432 * depending on this one can continue
1433 * assuming there was no DS, and hence
1434 * the root zone was unsigned. */
1435
1436 t->answer_rcode = DNS_RCODE_SUCCESS;
1437 t->answer_source = DNS_TRANSACTION_TRUST_ANCHOR;
1438 t->answer_authenticated = false;
1439 dns_transaction_complete(t, DNS_TRANSACTION_SUCCESS);
1440 } else
1441 /* If we are not in downgrade mode,
1442 * then fail the lookup, because we
1443 * cannot reasonably answer it. There
1444 * might be DS RRs, but we don't know
1445 * them, and the DNS server won't tell
1446 * them to us (and even if it would,
1447 * we couldn't validate and trust them. */
1448 dns_transaction_complete(t, DNS_TRANSACTION_NO_TRUST_ANCHOR);
1449
1450 return 0;
1451 }
1452 }
1453
1454 /* Check the zone, but only if this transaction is not used
1455 * for probing or verifying a zone item. */
1456 if (set_isempty(t->notify_zone_items)) {
1457
1458 r = dns_zone_lookup(&t->scope->zone, t->key, dns_scope_ifindex(t->scope), &t->answer, NULL, NULL);
1459 if (r < 0)
1460 return r;
1461 if (r > 0) {
1462 t->answer_rcode = DNS_RCODE_SUCCESS;
1463 t->answer_source = DNS_TRANSACTION_ZONE;
1464 t->answer_authenticated = true;
1465 dns_transaction_complete(t, DNS_TRANSACTION_SUCCESS);
1466 return 0;
1467 }
1468 }
1469
1470 /* Check the cache, but only if this transaction is not used
1471 * for probing or verifying a zone item. */
1472 if (set_isempty(t->notify_zone_items)) {
1473
1474 /* Before trying the cache, let's make sure we figured out a
1475 * server to use. Should this cause a change of server this
1476 * might flush the cache. */
1477 (void) dns_scope_get_dns_server(t->scope);
1478
1479 /* Let's then prune all outdated entries */
1480 dns_cache_prune(&t->scope->cache);
1481
1482 r = dns_cache_lookup(&t->scope->cache, t->key, t->clamp_ttl, &t->answer_rcode, &t->answer, &t->answer_authenticated);
1483 if (r < 0)
1484 return r;
1485 if (r > 0) {
1486 t->answer_source = DNS_TRANSACTION_CACHE;
1487 if (t->answer_rcode == DNS_RCODE_SUCCESS)
1488 dns_transaction_complete(t, DNS_TRANSACTION_SUCCESS);
1489 else
1490 dns_transaction_complete(t, DNS_TRANSACTION_RCODE_FAILURE);
1491 return 0;
1492 }
1493 }
1494
1495 return 1;
1496 }
1497
1498 static int dns_transaction_make_packet_mdns(DnsTransaction *t) {
1499
1500 _cleanup_(dns_packet_unrefp) DnsPacket *p = NULL;
1501 bool add_known_answers = false;
1502 DnsTransaction *other;
1503 Iterator i;
1504 DnsResourceKey *tkey;
1505 _cleanup_set_free_ Set *keys = NULL;
1506 unsigned qdcount;
1507 unsigned nscount = 0;
1508 usec_t ts;
1509 int r;
1510
1511 assert(t);
1512 assert(t->scope->protocol == DNS_PROTOCOL_MDNS);
1513
1514 /* Discard any previously prepared packet, so we can start over and coalesce again */
1515 t->sent = dns_packet_unref(t->sent);
1516
1517 r = dns_packet_new_query(&p, t->scope->protocol, 0, false);
1518 if (r < 0)
1519 return r;
1520
1521 r = dns_packet_append_key(p, t->key, 0, NULL);
1522 if (r < 0)
1523 return r;
1524
1525 qdcount = 1;
1526
1527 if (dns_key_is_shared(t->key))
1528 add_known_answers = true;
1529
1530 if (t->key->type == DNS_TYPE_ANY) {
1531 r = set_ensure_allocated(&keys, &dns_resource_key_hash_ops);
1532 if (r < 0)
1533 return r;
1534
1535 r = set_put(keys, t->key);
1536 if (r < 0)
1537 return r;
1538 }
1539
1540 /*
1541 * For mDNS, we want to coalesce as many open queries in pending transactions into one single
1542 * query packet on the wire as possible. To achieve that, we iterate through all pending transactions
1543 * in our current scope, and see whether their timing contraints allow them to be sent.
1544 */
1545
1546 assert_se(sd_event_now(t->scope->manager->event, clock_boottime_or_monotonic(), &ts) >= 0);
1547
1548 LIST_FOREACH(transactions_by_scope, other, t->scope->transactions) {
1549
1550 /* Skip ourselves */
1551 if (other == t)
1552 continue;
1553
1554 if (other->state != DNS_TRANSACTION_PENDING)
1555 continue;
1556
1557 if (other->next_attempt_after > ts)
1558 continue;
1559
1560 if (qdcount >= UINT16_MAX)
1561 break;
1562
1563 r = dns_packet_append_key(p, other->key, 0, NULL);
1564
1565 /*
1566 * If we can't stuff more questions into the packet, just give up.
1567 * One of the 'other' transactions will fire later and take care of the rest.
1568 */
1569 if (r == -EMSGSIZE)
1570 break;
1571
1572 if (r < 0)
1573 return r;
1574
1575 r = dns_transaction_prepare(other, ts);
1576 if (r <= 0)
1577 continue;
1578
1579 ts += transaction_get_resend_timeout(other);
1580
1581 r = sd_event_add_time(
1582 other->scope->manager->event,
1583 &other->timeout_event_source,
1584 clock_boottime_or_monotonic(),
1585 ts, 0,
1586 on_transaction_timeout, other);
1587 if (r < 0)
1588 return r;
1589
1590 (void) sd_event_source_set_description(other->timeout_event_source, "dns-transaction-timeout");
1591
1592 other->state = DNS_TRANSACTION_PENDING;
1593 other->next_attempt_after = ts;
1594
1595 qdcount++;
1596
1597 if (dns_key_is_shared(other->key))
1598 add_known_answers = true;
1599
1600 if (other->key->type == DNS_TYPE_ANY) {
1601 r = set_ensure_allocated(&keys, &dns_resource_key_hash_ops);
1602 if (r < 0)
1603 return r;
1604
1605 r = set_put(keys, other->key);
1606 if (r < 0)
1607 return r;
1608 }
1609 }
1610
1611 DNS_PACKET_HEADER(p)->qdcount = htobe16(qdcount);
1612
1613 /* Append known answer section if we're asking for any shared record */
1614 if (add_known_answers) {
1615 r = dns_cache_export_shared_to_packet(&t->scope->cache, p);
1616 if (r < 0)
1617 return r;
1618 }
1619
1620 SET_FOREACH(tkey, keys, i) {
1621 _cleanup_(dns_answer_unrefp) DnsAnswer *answer = NULL;
1622 bool tentative;
1623
1624 r = dns_zone_lookup(&t->scope->zone, tkey, t->scope->link->ifindex, &answer, NULL, &tentative);
1625 if (r < 0)
1626 return r;
1627
1628 r = dns_packet_append_answer(p, answer);
1629 if (r < 0)
1630 return r;
1631
1632 nscount += dns_answer_size(answer);
1633 }
1634 DNS_PACKET_HEADER(p)->nscount = htobe16(nscount);
1635
1636 t->sent = TAKE_PTR(p);
1637
1638 return 0;
1639 }
1640
1641 static int dns_transaction_make_packet(DnsTransaction *t) {
1642 _cleanup_(dns_packet_unrefp) DnsPacket *p = NULL;
1643 int r;
1644
1645 assert(t);
1646
1647 if (t->scope->protocol == DNS_PROTOCOL_MDNS)
1648 return dns_transaction_make_packet_mdns(t);
1649
1650 if (t->sent)
1651 return 0;
1652
1653 r = dns_packet_new_query(&p, t->scope->protocol, 0, t->scope->dnssec_mode != DNSSEC_NO);
1654 if (r < 0)
1655 return r;
1656
1657 r = dns_packet_append_key(p, t->key, 0, NULL);
1658 if (r < 0)
1659 return r;
1660
1661 DNS_PACKET_HEADER(p)->qdcount = htobe16(1);
1662 DNS_PACKET_HEADER(p)->id = t->id;
1663
1664 t->sent = TAKE_PTR(p);
1665
1666 return 0;
1667 }
1668
1669 int dns_transaction_go(DnsTransaction *t) {
1670 usec_t ts;
1671 int r;
1672 char key_str[DNS_RESOURCE_KEY_STRING_MAX];
1673
1674 assert(t);
1675
1676 /* Returns > 0 if the transaction is now pending, returns 0 if could be processed immediately and has finished
1677 * now. */
1678
1679 assert_se(sd_event_now(t->scope->manager->event, clock_boottime_or_monotonic(), &ts) >= 0);
1680
1681 r = dns_transaction_prepare(t, ts);
1682 if (r <= 0)
1683 return r;
1684
1685 log_debug("Transaction %" PRIu16 " for <%s> scope %s on %s/%s.",
1686 t->id,
1687 dns_resource_key_to_string(t->key, key_str, sizeof key_str),
1688 dns_protocol_to_string(t->scope->protocol),
1689 t->scope->link ? t->scope->link->name : "*",
1690 af_to_name_short(t->scope->family));
1691
1692 if (!t->initial_jitter_scheduled &&
1693 IN_SET(t->scope->protocol, DNS_PROTOCOL_LLMNR, DNS_PROTOCOL_MDNS)) {
1694 usec_t jitter, accuracy;
1695
1696 /* RFC 4795 Section 2.7 suggests all queries should be
1697 * delayed by a random time from 0 to JITTER_INTERVAL. */
1698
1699 t->initial_jitter_scheduled = true;
1700
1701 random_bytes(&jitter, sizeof(jitter));
1702
1703 switch (t->scope->protocol) {
1704
1705 case DNS_PROTOCOL_LLMNR:
1706 jitter %= LLMNR_JITTER_INTERVAL_USEC;
1707 accuracy = LLMNR_JITTER_INTERVAL_USEC;
1708 break;
1709
1710 case DNS_PROTOCOL_MDNS:
1711 jitter %= MDNS_JITTER_RANGE_USEC;
1712 jitter += MDNS_JITTER_MIN_USEC;
1713 accuracy = MDNS_JITTER_RANGE_USEC;
1714 break;
1715 default:
1716 assert_not_reached("bad protocol");
1717 }
1718
1719 r = sd_event_add_time(
1720 t->scope->manager->event,
1721 &t->timeout_event_source,
1722 clock_boottime_or_monotonic(),
1723 ts + jitter, accuracy,
1724 on_transaction_timeout, t);
1725 if (r < 0)
1726 return r;
1727
1728 (void) sd_event_source_set_description(t->timeout_event_source, "dns-transaction-timeout");
1729
1730 t->n_attempts = 0;
1731 t->next_attempt_after = ts;
1732 t->state = DNS_TRANSACTION_PENDING;
1733
1734 log_debug("Delaying %s transaction for " USEC_FMT "us.", dns_protocol_to_string(t->scope->protocol), jitter);
1735 return 0;
1736 }
1737
1738 /* Otherwise, we need to ask the network */
1739 r = dns_transaction_make_packet(t);
1740 if (r < 0)
1741 return r;
1742
1743 if (t->scope->protocol == DNS_PROTOCOL_LLMNR &&
1744 (dns_name_endswith(dns_resource_key_name(t->key), "in-addr.arpa") > 0 ||
1745 dns_name_endswith(dns_resource_key_name(t->key), "ip6.arpa") > 0)) {
1746
1747 /* RFC 4795, Section 2.4. says reverse lookups shall
1748 * always be made via TCP on LLMNR */
1749 r = dns_transaction_emit_tcp(t);
1750 } else {
1751 /* Try via UDP, and if that fails due to large size or lack of
1752 * support try via TCP */
1753 r = dns_transaction_emit_udp(t);
1754 if (r == -EMSGSIZE)
1755 log_debug("Sending query via TCP since it is too large.");
1756 else if (r == -EAGAIN)
1757 log_debug("Sending query via TCP since UDP isn't supported.");
1758 if (IN_SET(r, -EMSGSIZE, -EAGAIN))
1759 r = dns_transaction_emit_tcp(t);
1760 }
1761
1762 if (r == -ESRCH) {
1763 /* No servers to send this to? */
1764 dns_transaction_complete(t, DNS_TRANSACTION_NO_SERVERS);
1765 return 0;
1766 }
1767 if (r == -EOPNOTSUPP) {
1768 /* Tried to ask for DNSSEC RRs, on a server that doesn't do DNSSEC */
1769 dns_transaction_complete(t, DNS_TRANSACTION_RR_TYPE_UNSUPPORTED);
1770 return 0;
1771 }
1772 if (t->scope->protocol == DNS_PROTOCOL_LLMNR && ERRNO_IS_DISCONNECT(-r)) {
1773 /* On LLMNR, if we cannot connect to a host via TCP when doing reverse lookups. This means we cannot
1774 * answer this request with this protocol. */
1775 dns_transaction_complete(t, DNS_TRANSACTION_NOT_FOUND);
1776 return 0;
1777 }
1778 if (r < 0) {
1779 if (t->scope->protocol != DNS_PROTOCOL_DNS)
1780 return r;
1781
1782 /* Couldn't send? Try immediately again, with a new server */
1783 dns_scope_next_dns_server(t->scope);
1784
1785 return dns_transaction_go(t);
1786 }
1787
1788 ts += transaction_get_resend_timeout(t);
1789
1790 r = sd_event_add_time(
1791 t->scope->manager->event,
1792 &t->timeout_event_source,
1793 clock_boottime_or_monotonic(),
1794 ts, 0,
1795 on_transaction_timeout, t);
1796 if (r < 0)
1797 return r;
1798
1799 (void) sd_event_source_set_description(t->timeout_event_source, "dns-transaction-timeout");
1800
1801 t->state = DNS_TRANSACTION_PENDING;
1802 t->next_attempt_after = ts;
1803
1804 return 1;
1805 }
1806
1807 static int dns_transaction_find_cyclic(DnsTransaction *t, DnsTransaction *aux) {
1808 DnsTransaction *n;
1809 Iterator i;
1810 int r;
1811
1812 assert(t);
1813 assert(aux);
1814
1815 /* Try to find cyclic dependencies between transaction objects */
1816
1817 if (t == aux)
1818 return 1;
1819
1820 SET_FOREACH(n, aux->dnssec_transactions, i) {
1821 r = dns_transaction_find_cyclic(t, n);
1822 if (r != 0)
1823 return r;
1824 }
1825
1826 return 0;
1827 }
1828
1829 static int dns_transaction_add_dnssec_transaction(DnsTransaction *t, DnsResourceKey *key, DnsTransaction **ret) {
1830 DnsTransaction *aux;
1831 int r;
1832
1833 assert(t);
1834 assert(ret);
1835 assert(key);
1836
1837 aux = dns_scope_find_transaction(t->scope, key, true);
1838 if (!aux) {
1839 r = dns_transaction_new(&aux, t->scope, key);
1840 if (r < 0)
1841 return r;
1842 } else {
1843 if (set_contains(t->dnssec_transactions, aux)) {
1844 *ret = aux;
1845 return 0;
1846 }
1847
1848 r = dns_transaction_find_cyclic(t, aux);
1849 if (r < 0)
1850 return r;
1851 if (r > 0) {
1852 char s[DNS_RESOURCE_KEY_STRING_MAX], saux[DNS_RESOURCE_KEY_STRING_MAX];
1853
1854 log_debug("Potential cyclic dependency, refusing to add transaction %" PRIu16 " (%s) as dependency for %" PRIu16 " (%s).",
1855 aux->id,
1856 dns_resource_key_to_string(t->key, s, sizeof s),
1857 t->id,
1858 dns_resource_key_to_string(aux->key, saux, sizeof saux));
1859
1860 return -ELOOP;
1861 }
1862 }
1863
1864 r = set_ensure_allocated(&t->dnssec_transactions, NULL);
1865 if (r < 0)
1866 goto gc;
1867
1868 r = set_ensure_allocated(&aux->notify_transactions, NULL);
1869 if (r < 0)
1870 goto gc;
1871
1872 r = set_ensure_allocated(&aux->notify_transactions_done, NULL);
1873 if (r < 0)
1874 goto gc;
1875
1876 r = set_put(t->dnssec_transactions, aux);
1877 if (r < 0)
1878 goto gc;
1879
1880 r = set_put(aux->notify_transactions, t);
1881 if (r < 0) {
1882 (void) set_remove(t->dnssec_transactions, aux);
1883 goto gc;
1884 }
1885
1886 *ret = aux;
1887 return 1;
1888
1889 gc:
1890 dns_transaction_gc(aux);
1891 return r;
1892 }
1893
1894 static int dns_transaction_request_dnssec_rr(DnsTransaction *t, DnsResourceKey *key) {
1895 _cleanup_(dns_answer_unrefp) DnsAnswer *a = NULL;
1896 DnsTransaction *aux;
1897 int r;
1898
1899 assert(t);
1900 assert(key);
1901
1902 /* Try to get the data from the trust anchor */
1903 r = dns_trust_anchor_lookup_positive(&t->scope->manager->trust_anchor, key, &a);
1904 if (r < 0)
1905 return r;
1906 if (r > 0) {
1907 r = dns_answer_extend(&t->validated_keys, a);
1908 if (r < 0)
1909 return r;
1910
1911 return 0;
1912 }
1913
1914 /* This didn't work, ask for it via the network/cache then. */
1915 r = dns_transaction_add_dnssec_transaction(t, key, &aux);
1916 if (r == -ELOOP) /* This would result in a cyclic dependency */
1917 return 0;
1918 if (r < 0)
1919 return r;
1920
1921 if (aux->state == DNS_TRANSACTION_NULL) {
1922 r = dns_transaction_go(aux);
1923 if (r < 0)
1924 return r;
1925 }
1926
1927 return 1;
1928 }
1929
1930 static int dns_transaction_negative_trust_anchor_lookup(DnsTransaction *t, const char *name) {
1931 int r;
1932
1933 assert(t);
1934
1935 /* Check whether the specified name is in the NTA
1936 * database, either in the global one, or the link-local
1937 * one. */
1938
1939 r = dns_trust_anchor_lookup_negative(&t->scope->manager->trust_anchor, name);
1940 if (r != 0)
1941 return r;
1942
1943 if (!t->scope->link)
1944 return 0;
1945
1946 return set_contains(t->scope->link->dnssec_negative_trust_anchors, name);
1947 }
1948
1949 static int dns_transaction_has_unsigned_negative_answer(DnsTransaction *t) {
1950 int r;
1951
1952 assert(t);
1953
1954 /* Checks whether the answer is negative, and lacks NSEC/NSEC3
1955 * RRs to prove it */
1956
1957 r = dns_transaction_has_positive_answer(t, NULL);
1958 if (r < 0)
1959 return r;
1960 if (r > 0)
1961 return false;
1962
1963 /* Is this key explicitly listed as a negative trust anchor?
1964 * If so, it's nothing we need to care about */
1965 r = dns_transaction_negative_trust_anchor_lookup(t, dns_resource_key_name(t->key));
1966 if (r < 0)
1967 return r;
1968 if (r > 0)
1969 return false;
1970
1971 /* The answer does not contain any RRs that match to the
1972 * question. If so, let's see if there are any NSEC/NSEC3 RRs
1973 * included. If not, the answer is unsigned. */
1974
1975 r = dns_answer_contains_nsec_or_nsec3(t->answer);
1976 if (r < 0)
1977 return r;
1978 if (r > 0)
1979 return false;
1980
1981 return true;
1982 }
1983
1984 static int dns_transaction_is_primary_response(DnsTransaction *t, DnsResourceRecord *rr) {
1985 int r;
1986
1987 assert(t);
1988 assert(rr);
1989
1990 /* Check if the specified RR is the "primary" response,
1991 * i.e. either matches the question precisely or is a
1992 * CNAME/DNAME for it. */
1993
1994 r = dns_resource_key_match_rr(t->key, rr, NULL);
1995 if (r != 0)
1996 return r;
1997
1998 return dns_resource_key_match_cname_or_dname(t->key, rr->key, NULL);
1999 }
2000
2001 static bool dns_transaction_dnssec_supported(DnsTransaction *t) {
2002 assert(t);
2003
2004 /* Checks whether our transaction's DNS server is assumed to be compatible with DNSSEC. Returns false as soon
2005 * as we changed our mind about a server, and now believe it is incompatible with DNSSEC. */
2006
2007 if (t->scope->protocol != DNS_PROTOCOL_DNS)
2008 return false;
2009
2010 /* If we have picked no server, then we are working from the cache or some other source, and DNSSEC might well
2011 * be supported, hence return true. */
2012 if (!t->server)
2013 return true;
2014
2015 /* Note that we do not check the feature level actually used for the transaction but instead the feature level
2016 * the server is known to support currently, as the transaction feature level might be lower than what the
2017 * server actually supports, since we might have downgraded this transaction's feature level because we got a
2018 * SERVFAIL earlier and wanted to check whether downgrading fixes it. */
2019
2020 return dns_server_dnssec_supported(t->server);
2021 }
2022
2023 static bool dns_transaction_dnssec_supported_full(DnsTransaction *t) {
2024 DnsTransaction *dt;
2025 Iterator i;
2026
2027 assert(t);
2028
2029 /* Checks whether our transaction our any of the auxiliary transactions couldn't do DNSSEC. */
2030
2031 if (!dns_transaction_dnssec_supported(t))
2032 return false;
2033
2034 SET_FOREACH(dt, t->dnssec_transactions, i)
2035 if (!dns_transaction_dnssec_supported(dt))
2036 return false;
2037
2038 return true;
2039 }
2040
2041 int dns_transaction_request_dnssec_keys(DnsTransaction *t) {
2042 DnsResourceRecord *rr;
2043
2044 int r;
2045
2046 assert(t);
2047
2048 /*
2049 * Retrieve all auxiliary RRs for the answer we got, so that
2050 * we can verify signatures or prove that RRs are rightfully
2051 * unsigned. Specifically:
2052 *
2053 * - For RRSIG we get the matching DNSKEY
2054 * - For DNSKEY we get the matching DS
2055 * - For unsigned SOA/NS we get the matching DS
2056 * - For unsigned CNAME/DNAME/DS we get the parent SOA RR
2057 * - For other unsigned RRs we get the matching SOA RR
2058 * - For SOA/NS queries with no matching response RR, and no NSEC/NSEC3, the DS RR
2059 * - For DS queries with no matching response RRs, and no NSEC/NSEC3, the parent's SOA RR
2060 * - For other queries with no matching response RRs, and no NSEC/NSEC3, the SOA RR
2061 */
2062
2063 if (t->scope->dnssec_mode == DNSSEC_NO)
2064 return 0;
2065 if (t->answer_source != DNS_TRANSACTION_NETWORK)
2066 return 0; /* We only need to validate stuff from the network */
2067 if (!dns_transaction_dnssec_supported(t))
2068 return 0; /* If we can't do DNSSEC anyway there's no point in geting the auxiliary RRs */
2069
2070 DNS_ANSWER_FOREACH(rr, t->answer) {
2071
2072 if (dns_type_is_pseudo(rr->key->type))
2073 continue;
2074
2075 /* If this RR is in the negative trust anchor, we don't need to validate it. */
2076 r = dns_transaction_negative_trust_anchor_lookup(t, dns_resource_key_name(rr->key));
2077 if (r < 0)
2078 return r;
2079 if (r > 0)
2080 continue;
2081
2082 switch (rr->key->type) {
2083
2084 case DNS_TYPE_RRSIG: {
2085 /* For each RRSIG we request the matching DNSKEY */
2086 _cleanup_(dns_resource_key_unrefp) DnsResourceKey *dnskey = NULL;
2087
2088 /* If this RRSIG is about a DNSKEY RR and the
2089 * signer is the same as the owner, then we
2090 * already have the DNSKEY, and we don't have
2091 * to look for more. */
2092 if (rr->rrsig.type_covered == DNS_TYPE_DNSKEY) {
2093 r = dns_name_equal(rr->rrsig.signer, dns_resource_key_name(rr->key));
2094 if (r < 0)
2095 return r;
2096 if (r > 0)
2097 continue;
2098 }
2099
2100 /* If the signer is not a parent of our
2101 * original query, then this is about an
2102 * auxiliary RRset, but not anything we asked
2103 * for. In this case we aren't interested,
2104 * because we don't want to request additional
2105 * RRs for stuff we didn't really ask for, and
2106 * also to avoid request loops, where
2107 * additional RRs from one transaction result
2108 * in another transaction whose additonal RRs
2109 * point back to the original transaction, and
2110 * we deadlock. */
2111 r = dns_name_endswith(dns_resource_key_name(t->key), rr->rrsig.signer);
2112 if (r < 0)
2113 return r;
2114 if (r == 0)
2115 continue;
2116
2117 dnskey = dns_resource_key_new(rr->key->class, DNS_TYPE_DNSKEY, rr->rrsig.signer);
2118 if (!dnskey)
2119 return -ENOMEM;
2120
2121 log_debug("Requesting DNSKEY to validate transaction %" PRIu16" (%s, RRSIG with key tag: %" PRIu16 ").",
2122 t->id, dns_resource_key_name(rr->key), rr->rrsig.key_tag);
2123 r = dns_transaction_request_dnssec_rr(t, dnskey);
2124 if (r < 0)
2125 return r;
2126 break;
2127 }
2128
2129 case DNS_TYPE_DNSKEY: {
2130 /* For each DNSKEY we request the matching DS */
2131 _cleanup_(dns_resource_key_unrefp) DnsResourceKey *ds = NULL;
2132
2133 /* If the DNSKEY we are looking at is not for
2134 * zone we are interested in, nor any of its
2135 * parents, we aren't interested, and don't
2136 * request it. After all, we don't want to end
2137 * up in request loops, and want to keep
2138 * additional traffic down. */
2139
2140 r = dns_name_endswith(dns_resource_key_name(t->key), dns_resource_key_name(rr->key));
2141 if (r < 0)
2142 return r;
2143 if (r == 0)
2144 continue;
2145
2146 ds = dns_resource_key_new(rr->key->class, DNS_TYPE_DS, dns_resource_key_name(rr->key));
2147 if (!ds)
2148 return -ENOMEM;
2149
2150 log_debug("Requesting DS to validate transaction %" PRIu16" (%s, DNSKEY with key tag: %" PRIu16 ").",
2151 t->id, dns_resource_key_name(rr->key), dnssec_keytag(rr, false));
2152 r = dns_transaction_request_dnssec_rr(t, ds);
2153 if (r < 0)
2154 return r;
2155
2156 break;
2157 }
2158
2159 case DNS_TYPE_SOA:
2160 case DNS_TYPE_NS: {
2161 _cleanup_(dns_resource_key_unrefp) DnsResourceKey *ds = NULL;
2162
2163 /* For an unsigned SOA or NS, try to acquire
2164 * the matching DS RR, as we are at a zone cut
2165 * then, and whether a DS exists tells us
2166 * whether the zone is signed. Do so only if
2167 * this RR matches our original question,
2168 * however. */
2169
2170 r = dns_resource_key_match_rr(t->key, rr, NULL);
2171 if (r < 0)
2172 return r;
2173 if (r == 0) {
2174 /* Hmm, so this SOA RR doesn't match our original question. In this case, maybe this is
2175 * a negative reply, and we need the a SOA RR's TTL in order to cache a negative entry?
2176 * If so, we need to validate it, too. */
2177
2178 r = dns_answer_match_key(t->answer, t->key, NULL);
2179 if (r < 0)
2180 return r;
2181 if (r > 0) /* positive reply, we won't need the SOA and hence don't need to validate
2182 * it. */
2183 continue;
2184 }
2185
2186 r = dnssec_has_rrsig(t->answer, rr->key);
2187 if (r < 0)
2188 return r;
2189 if (r > 0)
2190 continue;
2191
2192 ds = dns_resource_key_new(rr->key->class, DNS_TYPE_DS, dns_resource_key_name(rr->key));
2193 if (!ds)
2194 return -ENOMEM;
2195
2196 log_debug("Requesting DS to validate transaction %" PRIu16 " (%s, unsigned SOA/NS RRset).",
2197 t->id, dns_resource_key_name(rr->key));
2198 r = dns_transaction_request_dnssec_rr(t, ds);
2199 if (r < 0)
2200 return r;
2201
2202 break;
2203 }
2204
2205 case DNS_TYPE_DS:
2206 case DNS_TYPE_CNAME:
2207 case DNS_TYPE_DNAME: {
2208 _cleanup_(dns_resource_key_unrefp) DnsResourceKey *soa = NULL;
2209 const char *name;
2210
2211 /* CNAMEs and DNAMEs cannot be located at a
2212 * zone apex, hence ask for the parent SOA for
2213 * unsigned CNAME/DNAME RRs, maybe that's the
2214 * apex. But do all that only if this is
2215 * actually a response to our original
2216 * question.
2217 *
2218 * Similar for DS RRs, which are signed when
2219 * the parent SOA is signed. */
2220
2221 r = dns_transaction_is_primary_response(t, rr);
2222 if (r < 0)
2223 return r;
2224 if (r == 0)
2225 continue;
2226
2227 r = dnssec_has_rrsig(t->answer, rr->key);
2228 if (r < 0)
2229 return r;
2230 if (r > 0)
2231 continue;
2232
2233 r = dns_answer_has_dname_for_cname(t->answer, rr);
2234 if (r < 0)
2235 return r;
2236 if (r > 0)
2237 continue;
2238
2239 name = dns_resource_key_name(rr->key);
2240 r = dns_name_parent(&name);
2241 if (r < 0)
2242 return r;
2243 if (r == 0)
2244 continue;
2245
2246 soa = dns_resource_key_new(rr->key->class, DNS_TYPE_SOA, name);
2247 if (!soa)
2248 return -ENOMEM;
2249
2250 log_debug("Requesting parent SOA to validate transaction %" PRIu16 " (%s, unsigned CNAME/DNAME/DS RRset).",
2251 t->id, dns_resource_key_name(rr->key));
2252 r = dns_transaction_request_dnssec_rr(t, soa);
2253 if (r < 0)
2254 return r;
2255
2256 break;
2257 }
2258
2259 default: {
2260 _cleanup_(dns_resource_key_unrefp) DnsResourceKey *soa = NULL;
2261
2262 /* For other unsigned RRsets (including
2263 * NSEC/NSEC3!), look for proof the zone is
2264 * unsigned, by requesting the SOA RR of the
2265 * zone. However, do so only if they are
2266 * directly relevant to our original
2267 * question. */
2268
2269 r = dns_transaction_is_primary_response(t, rr);
2270 if (r < 0)
2271 return r;
2272 if (r == 0)
2273 continue;
2274
2275 r = dnssec_has_rrsig(t->answer, rr->key);
2276 if (r < 0)
2277 return r;
2278 if (r > 0)
2279 continue;
2280
2281 soa = dns_resource_key_new(rr->key->class, DNS_TYPE_SOA, dns_resource_key_name(rr->key));
2282 if (!soa)
2283 return -ENOMEM;
2284
2285 log_debug("Requesting SOA to validate transaction %" PRIu16 " (%s, unsigned non-SOA/NS RRset <%s>).",
2286 t->id, dns_resource_key_name(rr->key), dns_resource_record_to_string(rr));
2287 r = dns_transaction_request_dnssec_rr(t, soa);
2288 if (r < 0)
2289 return r;
2290 break;
2291 }}
2292 }
2293
2294 /* Above, we requested everything necessary to validate what
2295 * we got. Now, let's request what we need to validate what we
2296 * didn't get... */
2297
2298 r = dns_transaction_has_unsigned_negative_answer(t);
2299 if (r < 0)
2300 return r;
2301 if (r > 0) {
2302 const char *name;
2303 uint16_t type = 0;
2304
2305 name = dns_resource_key_name(t->key);
2306
2307 /* If this was a SOA or NS request, then check if there's a DS RR for the same domain. Note that this
2308 * could also be used as indication that we are not at a zone apex, but in real world setups there are
2309 * too many broken DNS servers (Hello, incapdns.net!) where non-terminal zones return NXDOMAIN even
2310 * though they have further children. If this was a DS request, then it's signed when the parent zone
2311 * is signed, hence ask the parent SOA in that case. If this was any other RR then ask for the SOA RR,
2312 * to see if that is signed. */
2313
2314 if (t->key->type == DNS_TYPE_DS) {
2315 r = dns_name_parent(&name);
2316 if (r > 0) {
2317 type = DNS_TYPE_SOA;
2318 log_debug("Requesting parent SOA to validate transaction %" PRIu16 " (%s, unsigned empty DS response).",
2319 t->id, dns_resource_key_name(t->key));
2320 } else
2321 name = NULL;
2322
2323 } else if (IN_SET(t->key->type, DNS_TYPE_SOA, DNS_TYPE_NS)) {
2324
2325 type = DNS_TYPE_DS;
2326 log_debug("Requesting DS to validate transaction %" PRIu16 " (%s, unsigned empty SOA/NS response).",
2327 t->id, dns_resource_key_name(t->key));
2328
2329 } else {
2330 type = DNS_TYPE_SOA;
2331 log_debug("Requesting SOA to validate transaction %" PRIu16 " (%s, unsigned empty non-SOA/NS/DS response).",
2332 t->id, dns_resource_key_name(t->key));
2333 }
2334
2335 if (name) {
2336 _cleanup_(dns_resource_key_unrefp) DnsResourceKey *soa = NULL;
2337
2338 soa = dns_resource_key_new(t->key->class, type, name);
2339 if (!soa)
2340 return -ENOMEM;
2341
2342 r = dns_transaction_request_dnssec_rr(t, soa);
2343 if (r < 0)
2344 return r;
2345 }
2346 }
2347
2348 return dns_transaction_dnssec_is_live(t);
2349 }
2350
2351 void dns_transaction_notify(DnsTransaction *t, DnsTransaction *source) {
2352 assert(t);
2353 assert(source);
2354
2355 /* Invoked whenever any of our auxiliary DNSSEC transactions completed its work. If the state is still PENDING,
2356 we are still in the loop that adds further DNSSEC transactions, hence don't check if we are ready yet. If
2357 the state is VALIDATING however, we should check if we are complete now. */
2358
2359 if (t->state == DNS_TRANSACTION_VALIDATING)
2360 dns_transaction_process_dnssec(t);
2361 }
2362
2363 static int dns_transaction_validate_dnskey_by_ds(DnsTransaction *t) {
2364 DnsResourceRecord *rr;
2365 int ifindex, r;
2366
2367 assert(t);
2368
2369 /* Add all DNSKEY RRs from the answer that are validated by DS
2370 * RRs from the list of validated keys to the list of
2371 * validated keys. */
2372
2373 DNS_ANSWER_FOREACH_IFINDEX(rr, ifindex, t->answer) {
2374
2375 r = dnssec_verify_dnskey_by_ds_search(rr, t->validated_keys);
2376 if (r < 0)
2377 return r;
2378 if (r == 0)
2379 continue;
2380
2381 /* If so, the DNSKEY is validated too. */
2382 r = dns_answer_add_extend(&t->validated_keys, rr, ifindex, DNS_ANSWER_AUTHENTICATED);
2383 if (r < 0)
2384 return r;
2385 }
2386
2387 return 0;
2388 }
2389
2390 static int dns_transaction_requires_rrsig(DnsTransaction *t, DnsResourceRecord *rr) {
2391 int r;
2392
2393 assert(t);
2394 assert(rr);
2395
2396 /* Checks if the RR we are looking for must be signed with an
2397 * RRSIG. This is used for positive responses. */
2398
2399 if (t->scope->dnssec_mode == DNSSEC_NO)
2400 return false;
2401
2402 if (dns_type_is_pseudo(rr->key->type))
2403 return -EINVAL;
2404
2405 r = dns_transaction_negative_trust_anchor_lookup(t, dns_resource_key_name(rr->key));
2406 if (r < 0)
2407 return r;
2408 if (r > 0)
2409 return false;
2410
2411 switch (rr->key->type) {
2412
2413 case DNS_TYPE_RRSIG:
2414 /* RRSIGs are the signatures themselves, they need no signing. */
2415 return false;
2416
2417 case DNS_TYPE_SOA:
2418 case DNS_TYPE_NS: {
2419 DnsTransaction *dt;
2420 Iterator i;
2421
2422 /* For SOA or NS RRs we look for a matching DS transaction */
2423
2424 SET_FOREACH(dt, t->dnssec_transactions, i) {
2425
2426 if (dt->key->class != rr->key->class)
2427 continue;
2428 if (dt->key->type != DNS_TYPE_DS)
2429 continue;
2430
2431 r = dns_name_equal(dns_resource_key_name(dt->key), dns_resource_key_name(rr->key));
2432 if (r < 0)
2433 return r;
2434 if (r == 0)
2435 continue;
2436
2437 /* We found a DS transactions for the SOA/NS
2438 * RRs we are looking at. If it discovered signed DS
2439 * RRs, then we need to be signed, too. */
2440
2441 if (!dt->answer_authenticated)
2442 return false;
2443
2444 return dns_answer_match_key(dt->answer, dt->key, NULL);
2445 }
2446
2447 /* We found nothing that proves this is safe to leave
2448 * this unauthenticated, hence ask inist on
2449 * authentication. */
2450 return true;
2451 }
2452
2453 case DNS_TYPE_DS:
2454 case DNS_TYPE_CNAME:
2455 case DNS_TYPE_DNAME: {
2456 const char *parent = NULL;
2457 DnsTransaction *dt;
2458 Iterator i;
2459
2460 /*
2461 * CNAME/DNAME RRs cannot be located at a zone apex, hence look directly for the parent SOA.
2462 *
2463 * DS RRs are signed if the parent is signed, hence also look at the parent SOA
2464 */
2465
2466 SET_FOREACH(dt, t->dnssec_transactions, i) {
2467
2468 if (dt->key->class != rr->key->class)
2469 continue;
2470 if (dt->key->type != DNS_TYPE_SOA)
2471 continue;
2472
2473 if (!parent) {
2474 parent = dns_resource_key_name(rr->key);
2475 r = dns_name_parent(&parent);
2476 if (r < 0)
2477 return r;
2478 if (r == 0) {
2479 if (rr->key->type == DNS_TYPE_DS)
2480 return true;
2481
2482 /* A CNAME/DNAME without a parent? That's sooo weird. */
2483 log_debug("Transaction %" PRIu16 " claims CNAME/DNAME at root. Refusing.", t->id);
2484 return -EBADMSG;
2485 }
2486 }
2487
2488 r = dns_name_equal(dns_resource_key_name(dt->key), parent);
2489 if (r < 0)
2490 return r;
2491 if (r == 0)
2492 continue;
2493
2494 return t->answer_authenticated;
2495 }
2496
2497 return true;
2498 }
2499
2500 default: {
2501 DnsTransaction *dt;
2502 Iterator i;
2503
2504 /* Any other kind of RR (including DNSKEY/NSEC/NSEC3). Let's see if our SOA lookup was authenticated */
2505
2506 SET_FOREACH(dt, t->dnssec_transactions, i) {
2507
2508 if (dt->key->class != rr->key->class)
2509 continue;
2510 if (dt->key->type != DNS_TYPE_SOA)
2511 continue;
2512
2513 r = dns_name_equal(dns_resource_key_name(dt->key), dns_resource_key_name(rr->key));
2514 if (r < 0)
2515 return r;
2516 if (r == 0)
2517 continue;
2518
2519 /* We found the transaction that was supposed to find
2520 * the SOA RR for us. It was successful, but found no
2521 * RR for us. This means we are not at a zone cut. In
2522 * this case, we require authentication if the SOA
2523 * lookup was authenticated too. */
2524 return t->answer_authenticated;
2525 }
2526
2527 return true;
2528 }}
2529 }
2530
2531 static int dns_transaction_in_private_tld(DnsTransaction *t, const DnsResourceKey *key) {
2532 DnsTransaction *dt;
2533 const char *tld;
2534 Iterator i;
2535 int r;
2536
2537 /* If DNSSEC downgrade mode is on, checks whether the
2538 * specified RR is one level below a TLD we have proven not to
2539 * exist. In such a case we assume that this is a private
2540 * domain, and permit it.
2541 *
2542 * This detects cases like the Fritz!Box router networks. Each
2543 * Fritz!Box router serves a private "fritz.box" zone, in the
2544 * non-existing TLD "box". Requests for the "fritz.box" domain
2545 * are served by the router itself, while requests for the
2546 * "box" domain will result in NXDOMAIN.
2547 *
2548 * Note that this logic is unable to detect cases where a
2549 * router serves a private DNS zone directly under
2550 * non-existing TLD. In such a case we cannot detect whether
2551 * the TLD is supposed to exist or not, as all requests we
2552 * make for it will be answered by the router's zone, and not
2553 * by the root zone. */
2554
2555 assert(t);
2556
2557 if (t->scope->dnssec_mode != DNSSEC_ALLOW_DOWNGRADE)
2558 return false; /* In strict DNSSEC mode what doesn't exist, doesn't exist */
2559
2560 tld = dns_resource_key_name(key);
2561 r = dns_name_parent(&tld);
2562 if (r < 0)
2563 return r;
2564 if (r == 0)
2565 return false; /* Already the root domain */
2566
2567 if (!dns_name_is_single_label(tld))
2568 return false;
2569
2570 SET_FOREACH(dt, t->dnssec_transactions, i) {
2571
2572 if (dt->key->class != key->class)
2573 continue;
2574
2575 r = dns_name_equal(dns_resource_key_name(dt->key), tld);
2576 if (r < 0)
2577 return r;
2578 if (r == 0)
2579 continue;
2580
2581 /* We found an auxiliary lookup we did for the TLD. If
2582 * that returned with NXDOMAIN, we know the TLD didn't
2583 * exist, and hence this might be a private zone. */
2584
2585 return dt->answer_rcode == DNS_RCODE_NXDOMAIN;
2586 }
2587
2588 return false;
2589 }
2590
2591 static int dns_transaction_requires_nsec(DnsTransaction *t) {
2592 char key_str[DNS_RESOURCE_KEY_STRING_MAX];
2593 DnsTransaction *dt;
2594 const char *name;
2595 uint16_t type = 0;
2596 Iterator i;
2597 int r;
2598
2599 assert(t);
2600
2601 /* Checks if we need to insist on NSEC/NSEC3 RRs for proving
2602 * this negative reply */
2603
2604 if (t->scope->dnssec_mode == DNSSEC_NO)
2605 return false;
2606
2607 if (dns_type_is_pseudo(t->key->type))
2608 return -EINVAL;
2609
2610 r = dns_transaction_negative_trust_anchor_lookup(t, dns_resource_key_name(t->key));
2611 if (r < 0)
2612 return r;
2613 if (r > 0)
2614 return false;
2615
2616 r = dns_transaction_in_private_tld(t, t->key);
2617 if (r < 0)
2618 return r;
2619 if (r > 0) {
2620 /* The lookup is from a TLD that is proven not to
2621 * exist, and we are in downgrade mode, hence ignore
2622 * that fact that we didn't get any NSEC RRs. */
2623
2624 log_info("Detected a negative query %s in a private DNS zone, permitting unsigned response.",
2625 dns_resource_key_to_string(t->key, key_str, sizeof key_str));
2626 return false;
2627 }
2628
2629 name = dns_resource_key_name(t->key);
2630
2631 if (t->key->type == DNS_TYPE_DS) {
2632
2633 /* We got a negative reply for this DS lookup? DS RRs are signed when their parent zone is signed,
2634 * hence check the parent SOA in this case. */
2635
2636 r = dns_name_parent(&name);
2637 if (r < 0)
2638 return r;
2639 if (r == 0)
2640 return true;
2641
2642 type = DNS_TYPE_SOA;
2643
2644 } else if (IN_SET(t->key->type, DNS_TYPE_SOA, DNS_TYPE_NS))
2645 /* We got a negative reply for this SOA/NS lookup? If so, check if there's a DS RR for this */
2646 type = DNS_TYPE_DS;
2647 else
2648 /* For all other negative replies, check for the SOA lookup */
2649 type = DNS_TYPE_SOA;
2650
2651 /* For all other RRs we check the SOA on the same level to see
2652 * if it's signed. */
2653
2654 SET_FOREACH(dt, t->dnssec_transactions, i) {
2655
2656 if (dt->key->class != t->key->class)
2657 continue;
2658 if (dt->key->type != type)
2659 continue;
2660
2661 r = dns_name_equal(dns_resource_key_name(dt->key), name);
2662 if (r < 0)
2663 return r;
2664 if (r == 0)
2665 continue;
2666
2667 return dt->answer_authenticated;
2668 }
2669
2670 /* If in doubt, require NSEC/NSEC3 */
2671 return true;
2672 }
2673
2674 static int dns_transaction_dnskey_authenticated(DnsTransaction *t, DnsResourceRecord *rr) {
2675 DnsResourceRecord *rrsig;
2676 bool found = false;
2677 int r;
2678
2679 /* Checks whether any of the DNSKEYs used for the RRSIGs for
2680 * the specified RRset is authenticated (i.e. has a matching
2681 * DS RR). */
2682
2683 r = dns_transaction_negative_trust_anchor_lookup(t, dns_resource_key_name(rr->key));
2684 if (r < 0)
2685 return r;
2686 if (r > 0)
2687 return false;
2688
2689 DNS_ANSWER_FOREACH(rrsig, t->answer) {
2690 DnsTransaction *dt;
2691 Iterator i;
2692
2693 r = dnssec_key_match_rrsig(rr->key, rrsig);
2694 if (r < 0)
2695 return r;
2696 if (r == 0)
2697 continue;
2698
2699 SET_FOREACH(dt, t->dnssec_transactions, i) {
2700
2701 if (dt->key->class != rr->key->class)
2702 continue;
2703
2704 if (dt->key->type == DNS_TYPE_DNSKEY) {
2705
2706 r = dns_name_equal(dns_resource_key_name(dt->key), rrsig->rrsig.signer);
2707 if (r < 0)
2708 return r;
2709 if (r == 0)
2710 continue;
2711
2712 /* OK, we found an auxiliary DNSKEY
2713 * lookup. If that lookup is
2714 * authenticated, report this. */
2715
2716 if (dt->answer_authenticated)
2717 return true;
2718
2719 found = true;
2720
2721 } else if (dt->key->type == DNS_TYPE_DS) {
2722
2723 r = dns_name_equal(dns_resource_key_name(dt->key), rrsig->rrsig.signer);
2724 if (r < 0)
2725 return r;
2726 if (r == 0)
2727 continue;
2728
2729 /* OK, we found an auxiliary DS
2730 * lookup. If that lookup is
2731 * authenticated and non-zero, we
2732 * won! */
2733
2734 if (!dt->answer_authenticated)
2735 return false;
2736
2737 return dns_answer_match_key(dt->answer, dt->key, NULL);
2738 }
2739 }
2740 }
2741
2742 return found ? false : -ENXIO;
2743 }
2744
2745 static int dns_transaction_known_signed(DnsTransaction *t, DnsResourceRecord *rr) {
2746 assert(t);
2747 assert(rr);
2748
2749 /* We know that the root domain is signed, hence if it appears
2750 * not to be signed, there's a problem with the DNS server */
2751
2752 return rr->key->class == DNS_CLASS_IN &&
2753 dns_name_is_root(dns_resource_key_name(rr->key));
2754 }
2755
2756 static int dns_transaction_check_revoked_trust_anchors(DnsTransaction *t) {
2757 DnsResourceRecord *rr;
2758 int r;
2759
2760 assert(t);
2761
2762 /* Maybe warn the user that we encountered a revoked DNSKEY
2763 * for a key from our trust anchor. Note that we don't care
2764 * whether the DNSKEY can be authenticated or not. It's
2765 * sufficient if it is self-signed. */
2766
2767 DNS_ANSWER_FOREACH(rr, t->answer) {
2768 r = dns_trust_anchor_check_revoked(&t->scope->manager->trust_anchor, rr, t->answer);
2769 if (r < 0)
2770 return r;
2771 }
2772
2773 return 0;
2774 }
2775
2776 static int dns_transaction_invalidate_revoked_keys(DnsTransaction *t) {
2777 bool changed;
2778 int r;
2779
2780 assert(t);
2781
2782 /* Removes all DNSKEY/DS objects from t->validated_keys that
2783 * our trust anchors database considers revoked. */
2784
2785 do {
2786 DnsResourceRecord *rr;
2787
2788 changed = false;
2789
2790 DNS_ANSWER_FOREACH(rr, t->validated_keys) {
2791 r = dns_trust_anchor_is_revoked(&t->scope->manager->trust_anchor, rr);
2792 if (r < 0)
2793 return r;
2794 if (r > 0) {
2795 r = dns_answer_remove_by_rr(&t->validated_keys, rr);
2796 if (r < 0)
2797 return r;
2798
2799 assert(r > 0);
2800 changed = true;
2801 break;
2802 }
2803 }
2804 } while (changed);
2805
2806 return 0;
2807 }
2808
2809 static int dns_transaction_copy_validated(DnsTransaction *t) {
2810 DnsTransaction *dt;
2811 Iterator i;
2812 int r;
2813
2814 assert(t);
2815
2816 /* Copy all validated RRs from the auxiliary DNSSEC transactions into our set of validated RRs */
2817
2818 SET_FOREACH(dt, t->dnssec_transactions, i) {
2819
2820 if (DNS_TRANSACTION_IS_LIVE(dt->state))
2821 continue;
2822
2823 if (!dt->answer_authenticated)
2824 continue;
2825
2826 r = dns_answer_extend(&t->validated_keys, dt->answer);
2827 if (r < 0)
2828 return r;
2829 }
2830
2831 return 0;
2832 }
2833
2834 typedef enum {
2835 DNSSEC_PHASE_DNSKEY, /* Phase #1, only validate DNSKEYs */
2836 DNSSEC_PHASE_NSEC, /* Phase #2, only validate NSEC+NSEC3 */
2837 DNSSEC_PHASE_ALL, /* Phase #3, validate everything else */
2838 } Phase;
2839
2840 static int dnssec_validate_records(
2841 DnsTransaction *t,
2842 Phase phase,
2843 bool *have_nsec,
2844 DnsAnswer **validated) {
2845
2846 DnsResourceRecord *rr;
2847 int r;
2848
2849 /* Returns negative on error, 0 if validation failed, 1 to restart validation, 2 when finished. */
2850
2851 DNS_ANSWER_FOREACH(rr, t->answer) {
2852 DnsResourceRecord *rrsig = NULL;
2853 DnssecResult result;
2854
2855 switch (rr->key->type) {
2856 case DNS_TYPE_RRSIG:
2857 continue;
2858
2859 case DNS_TYPE_DNSKEY:
2860 /* We validate DNSKEYs only in the DNSKEY and ALL phases */
2861 if (phase == DNSSEC_PHASE_NSEC)
2862 continue;
2863 break;
2864
2865 case DNS_TYPE_NSEC:
2866 case DNS_TYPE_NSEC3:
2867 *have_nsec = true;
2868
2869 /* We validate NSEC/NSEC3 only in the NSEC and ALL phases */
2870 if (phase == DNSSEC_PHASE_DNSKEY)
2871 continue;
2872 break;
2873
2874 default:
2875 /* We validate all other RRs only in the ALL phases */
2876 if (phase != DNSSEC_PHASE_ALL)
2877 continue;
2878 }
2879
2880 r = dnssec_verify_rrset_search(t->answer, rr->key, t->validated_keys, USEC_INFINITY, &result, &rrsig);
2881 if (r < 0)
2882 return r;
2883
2884 log_debug("Looking at %s: %s", strna(dns_resource_record_to_string(rr)), dnssec_result_to_string(result));
2885
2886 if (result == DNSSEC_VALIDATED) {
2887
2888 if (rr->key->type == DNS_TYPE_DNSKEY) {
2889 /* If we just validated a DNSKEY RRset, then let's add these keys to
2890 * the set of validated keys for this transaction. */
2891
2892 r = dns_answer_copy_by_key(&t->validated_keys, t->answer, rr->key, DNS_ANSWER_AUTHENTICATED);
2893 if (r < 0)
2894 return r;
2895
2896 /* Some of the DNSKEYs we just added might already have been revoked,
2897 * remove them again in that case. */
2898 r = dns_transaction_invalidate_revoked_keys(t);
2899 if (r < 0)
2900 return r;
2901 }
2902
2903 /* Add the validated RRset to the new list of validated
2904 * RRsets, and remove it from the unvalidated RRsets.
2905 * We mark the RRset as authenticated and cacheable. */
2906 r = dns_answer_move_by_key(validated, &t->answer, rr->key, DNS_ANSWER_AUTHENTICATED|DNS_ANSWER_CACHEABLE);
2907 if (r < 0)
2908 return r;
2909
2910 manager_dnssec_verdict(t->scope->manager, DNSSEC_SECURE, rr->key);
2911
2912 /* Exit the loop, we dropped something from the answer, start from the beginning */
2913 return 1;
2914 }
2915
2916 /* If we haven't read all DNSKEYs yet a negative result of the validation is irrelevant, as
2917 * there might be more DNSKEYs coming. Similar, if we haven't read all NSEC/NSEC3 RRs yet,
2918 * we cannot do positive wildcard proofs yet, as those require the NSEC/NSEC3 RRs. */
2919 if (phase != DNSSEC_PHASE_ALL)
2920 continue;
2921
2922 if (result == DNSSEC_VALIDATED_WILDCARD) {
2923 bool authenticated = false;
2924 const char *source;
2925
2926 /* This RRset validated, but as a wildcard. This means we need
2927 * to prove via NSEC/NSEC3 that no matching non-wildcard RR exists. */
2928
2929 /* First step, determine the source of synthesis */
2930 r = dns_resource_record_source(rrsig, &source);
2931 if (r < 0)
2932 return r;
2933
2934 r = dnssec_test_positive_wildcard(*validated,
2935 dns_resource_key_name(rr->key),
2936 source,
2937 rrsig->rrsig.signer,
2938 &authenticated);
2939
2940 /* Unless the NSEC proof showed that the key really doesn't exist something is off. */
2941 if (r == 0)
2942 result = DNSSEC_INVALID;
2943 else {
2944 r = dns_answer_move_by_key(validated, &t->answer, rr->key,
2945 authenticated ? (DNS_ANSWER_AUTHENTICATED|DNS_ANSWER_CACHEABLE) : 0);
2946 if (r < 0)
2947 return r;
2948
2949 manager_dnssec_verdict(t->scope->manager, authenticated ? DNSSEC_SECURE : DNSSEC_INSECURE, rr->key);
2950
2951 /* Exit the loop, we dropped something from the answer, start from the beginning */
2952 return 1;
2953 }
2954 }
2955
2956 if (result == DNSSEC_NO_SIGNATURE) {
2957 r = dns_transaction_requires_rrsig(t, rr);
2958 if (r < 0)
2959 return r;
2960 if (r == 0) {
2961 /* Data does not require signing. In that case, just copy it over,
2962 * but remember that this is by no means authenticated. */
2963 r = dns_answer_move_by_key(validated, &t->answer, rr->key, 0);
2964 if (r < 0)
2965 return r;
2966
2967 manager_dnssec_verdict(t->scope->manager, DNSSEC_INSECURE, rr->key);
2968 return 1;
2969 }
2970
2971 r = dns_transaction_known_signed(t, rr);
2972 if (r < 0)
2973 return r;
2974 if (r > 0) {
2975 /* This is an RR we know has to be signed. If it isn't this means
2976 * the server is not attaching RRSIGs, hence complain. */
2977
2978 dns_server_packet_rrsig_missing(t->server, t->current_feature_level);
2979
2980 if (t->scope->dnssec_mode == DNSSEC_ALLOW_DOWNGRADE) {
2981
2982 /* Downgrading is OK? If so, just consider the information unsigned */
2983
2984 r = dns_answer_move_by_key(validated, &t->answer, rr->key, 0);
2985 if (r < 0)
2986 return r;
2987
2988 manager_dnssec_verdict(t->scope->manager, DNSSEC_INSECURE, rr->key);
2989 return 1;
2990 }
2991
2992 /* Otherwise, fail */
2993 t->answer_dnssec_result = DNSSEC_INCOMPATIBLE_SERVER;
2994 return 0;
2995 }
2996
2997 r = dns_transaction_in_private_tld(t, rr->key);
2998 if (r < 0)
2999 return r;
3000 if (r > 0) {
3001 char s[DNS_RESOURCE_KEY_STRING_MAX];
3002
3003 /* The data is from a TLD that is proven not to exist, and we are in downgrade
3004 * mode, hence ignore the fact that this was not signed. */
3005
3006 log_info("Detected RRset %s is in a private DNS zone, permitting unsigned RRs.",
3007 dns_resource_key_to_string(rr->key, s, sizeof s));
3008
3009 r = dns_answer_move_by_key(validated, &t->answer, rr->key, 0);
3010 if (r < 0)
3011 return r;
3012
3013 manager_dnssec_verdict(t->scope->manager, DNSSEC_INSECURE, rr->key);
3014 return 1;
3015 }
3016 }
3017
3018 if (IN_SET(result,
3019 DNSSEC_MISSING_KEY,
3020 DNSSEC_SIGNATURE_EXPIRED,
3021 DNSSEC_UNSUPPORTED_ALGORITHM)) {
3022
3023 r = dns_transaction_dnskey_authenticated(t, rr);
3024 if (r < 0 && r != -ENXIO)
3025 return r;
3026 if (r == 0) {
3027 /* The DNSKEY transaction was not authenticated, this means there's
3028 * no DS for this, which means it's OK if no keys are found for this signature. */
3029
3030 r = dns_answer_move_by_key(validated, &t->answer, rr->key, 0);
3031 if (r < 0)
3032 return r;
3033
3034 manager_dnssec_verdict(t->scope->manager, DNSSEC_INSECURE, rr->key);
3035 return 1;
3036 }
3037 }
3038
3039 r = dns_transaction_is_primary_response(t, rr);
3040 if (r < 0)
3041 return r;
3042 if (r > 0) {
3043 /* Look for a matching DNAME for this CNAME */
3044 r = dns_answer_has_dname_for_cname(t->answer, rr);
3045 if (r < 0)
3046 return r;
3047 if (r == 0) {
3048 /* Also look among the stuff we already validated */
3049 r = dns_answer_has_dname_for_cname(*validated, rr);
3050 if (r < 0)
3051 return r;
3052 }
3053
3054 if (r == 0) {
3055 if (IN_SET(result,
3056 DNSSEC_INVALID,
3057 DNSSEC_SIGNATURE_EXPIRED,
3058 DNSSEC_NO_SIGNATURE))
3059 manager_dnssec_verdict(t->scope->manager, DNSSEC_BOGUS, rr->key);
3060 else /* DNSSEC_MISSING_KEY or DNSSEC_UNSUPPORTED_ALGORITHM */
3061 manager_dnssec_verdict(t->scope->manager, DNSSEC_INDETERMINATE, rr->key);
3062
3063 /* This is a primary response to our question, and it failed validation.
3064 * That's fatal. */
3065 t->answer_dnssec_result = result;
3066 return 0;
3067 }
3068
3069 /* This is a primary response, but we do have a DNAME RR
3070 * in the RR that can replay this CNAME, hence rely on
3071 * that, and we can remove the CNAME in favour of it. */
3072 }
3073
3074 /* This is just some auxiliary data. Just remove the RRset and continue. */
3075 r = dns_answer_remove_by_key(&t->answer, rr->key);
3076 if (r < 0)
3077 return r;
3078
3079 /* We dropped something from the answer, start from the beginning. */
3080 return 1;
3081 }
3082
3083 return 2; /* Finito. */
3084 }
3085
3086 int dns_transaction_validate_dnssec(DnsTransaction *t) {
3087 _cleanup_(dns_answer_unrefp) DnsAnswer *validated = NULL;
3088 Phase phase;
3089 DnsAnswerFlags flags;
3090 int r;
3091 char key_str[DNS_RESOURCE_KEY_STRING_MAX];
3092
3093 assert(t);
3094
3095 /* We have now collected all DS and DNSKEY RRs in
3096 * t->validated_keys, let's see which RRs we can now
3097 * authenticate with that. */
3098
3099 if (t->scope->dnssec_mode == DNSSEC_NO)
3100 return 0;
3101
3102 /* Already validated */
3103 if (t->answer_dnssec_result != _DNSSEC_RESULT_INVALID)
3104 return 0;
3105
3106 /* Our own stuff needs no validation */
3107 if (IN_SET(t->answer_source, DNS_TRANSACTION_ZONE, DNS_TRANSACTION_TRUST_ANCHOR)) {
3108 t->answer_dnssec_result = DNSSEC_VALIDATED;
3109 t->answer_authenticated = true;
3110 return 0;
3111 }
3112
3113 /* Cached stuff is not affected by validation. */
3114 if (t->answer_source != DNS_TRANSACTION_NETWORK)
3115 return 0;
3116
3117 if (!dns_transaction_dnssec_supported_full(t)) {
3118 /* The server does not support DNSSEC, or doesn't augment responses with RRSIGs. */
3119 t->answer_dnssec_result = DNSSEC_INCOMPATIBLE_SERVER;
3120 log_debug("Not validating response for %" PRIu16 ", used server feature level does not support DNSSEC.", t->id);
3121 return 0;
3122 }
3123
3124 log_debug("Validating response from transaction %" PRIu16 " (%s).",
3125 t->id,
3126 dns_resource_key_to_string(t->key, key_str, sizeof key_str));
3127
3128 /* First, see if this response contains any revoked trust
3129 * anchors we care about */
3130 r = dns_transaction_check_revoked_trust_anchors(t);
3131 if (r < 0)
3132 return r;
3133
3134 /* Third, copy all RRs we acquired successfully from auxiliary RRs over. */
3135 r = dns_transaction_copy_validated(t);
3136 if (r < 0)
3137 return r;
3138
3139 /* Second, see if there are DNSKEYs we already know a
3140 * validated DS for. */
3141 r = dns_transaction_validate_dnskey_by_ds(t);
3142 if (r < 0)
3143 return r;
3144
3145 /* Fourth, remove all DNSKEY and DS RRs again that our trust
3146 * anchor says are revoked. After all we might have marked
3147 * some keys revoked above, but they might still be lingering
3148 * in our validated_keys list. */
3149 r = dns_transaction_invalidate_revoked_keys(t);
3150 if (r < 0)
3151 return r;
3152
3153 phase = DNSSEC_PHASE_DNSKEY;
3154 for (;;) {
3155 bool have_nsec = false;
3156
3157 r = dnssec_validate_records(t, phase, &have_nsec, &validated);
3158 if (r <= 0)
3159 return r;
3160
3161 /* Try again as long as we managed to achieve something */
3162 if (r == 1)
3163 continue;
3164
3165 if (phase == DNSSEC_PHASE_DNSKEY && have_nsec) {
3166 /* OK, we processed all DNSKEYs, and there are NSEC/NSEC3 RRs, look at those now. */
3167 phase = DNSSEC_PHASE_NSEC;
3168 continue;
3169 }
3170
3171 if (phase != DNSSEC_PHASE_ALL) {
3172 /* OK, we processed all DNSKEYs and NSEC/NSEC3 RRs, look at all the rest now.
3173 * Note that in this third phase we start to remove RRs we couldn't validate. */
3174 phase = DNSSEC_PHASE_ALL;
3175 continue;
3176 }
3177
3178 /* We're done */
3179 break;
3180 }
3181
3182 dns_answer_unref(t->answer);
3183 t->answer = TAKE_PTR(validated);
3184
3185 /* At this point the answer only contains validated
3186 * RRsets. Now, let's see if it actually answers the question
3187 * we asked. If so, great! If it doesn't, then see if
3188 * NSEC/NSEC3 can prove this. */
3189 r = dns_transaction_has_positive_answer(t, &flags);
3190 if (r > 0) {
3191 /* Yes, it answers the question! */
3192
3193 if (flags & DNS_ANSWER_AUTHENTICATED) {
3194 /* The answer is fully authenticated, yay. */
3195 t->answer_dnssec_result = DNSSEC_VALIDATED;
3196 t->answer_rcode = DNS_RCODE_SUCCESS;
3197 t->answer_authenticated = true;
3198 } else {
3199 /* The answer is not fully authenticated. */
3200 t->answer_dnssec_result = DNSSEC_UNSIGNED;
3201 t->answer_authenticated = false;
3202 }
3203
3204 } else if (r == 0) {
3205 DnssecNsecResult nr;
3206 bool authenticated = false;
3207
3208 /* Bummer! Let's check NSEC/NSEC3 */
3209 r = dnssec_nsec_test(t->answer, t->key, &nr, &authenticated, &t->answer_nsec_ttl);
3210 if (r < 0)
3211 return r;
3212
3213 switch (nr) {
3214
3215 case DNSSEC_NSEC_NXDOMAIN:
3216 /* NSEC proves the domain doesn't exist. Very good. */
3217 log_debug("Proved NXDOMAIN via NSEC/NSEC3 for transaction %u (%s)", t->id, key_str);
3218 t->answer_dnssec_result = DNSSEC_VALIDATED;
3219 t->answer_rcode = DNS_RCODE_NXDOMAIN;
3220 t->answer_authenticated = authenticated;
3221
3222 manager_dnssec_verdict(t->scope->manager, authenticated ? DNSSEC_SECURE : DNSSEC_INSECURE, t->key);
3223 break;
3224
3225 case DNSSEC_NSEC_NODATA:
3226 /* NSEC proves that there's no data here, very good. */
3227 log_debug("Proved NODATA via NSEC/NSEC3 for transaction %u (%s)", t->id, key_str);
3228 t->answer_dnssec_result = DNSSEC_VALIDATED;
3229 t->answer_rcode = DNS_RCODE_SUCCESS;
3230 t->answer_authenticated = authenticated;
3231
3232 manager_dnssec_verdict(t->scope->manager, authenticated ? DNSSEC_SECURE : DNSSEC_INSECURE, t->key);
3233 break;
3234
3235 case DNSSEC_NSEC_OPTOUT:
3236 /* NSEC3 says the data might not be signed */
3237 log_debug("Data is NSEC3 opt-out via NSEC/NSEC3 for transaction %u (%s)", t->id, key_str);
3238 t->answer_dnssec_result = DNSSEC_UNSIGNED;
3239 t->answer_authenticated = false;
3240
3241 manager_dnssec_verdict(t->scope->manager, DNSSEC_INSECURE, t->key);
3242 break;
3243
3244 case DNSSEC_NSEC_NO_RR:
3245 /* No NSEC data? Bummer! */
3246
3247 r = dns_transaction_requires_nsec(t);
3248 if (r < 0)
3249 return r;
3250 if (r > 0) {
3251 t->answer_dnssec_result = DNSSEC_NO_SIGNATURE;
3252 manager_dnssec_verdict(t->scope->manager, DNSSEC_BOGUS, t->key);
3253 } else {
3254 t->answer_dnssec_result = DNSSEC_UNSIGNED;
3255 t->answer_authenticated = false;
3256 manager_dnssec_verdict(t->scope->manager, DNSSEC_INSECURE, t->key);
3257 }
3258
3259 break;
3260
3261 case DNSSEC_NSEC_UNSUPPORTED_ALGORITHM:
3262 /* We don't know the NSEC3 algorithm used? */
3263 t->answer_dnssec_result = DNSSEC_UNSUPPORTED_ALGORITHM;
3264 manager_dnssec_verdict(t->scope->manager, DNSSEC_INDETERMINATE, t->key);
3265 break;
3266
3267 case DNSSEC_NSEC_FOUND:
3268 case DNSSEC_NSEC_CNAME:
3269 /* NSEC says it needs to be there, but we couldn't find it? Bummer! */
3270 t->answer_dnssec_result = DNSSEC_NSEC_MISMATCH;
3271 manager_dnssec_verdict(t->scope->manager, DNSSEC_BOGUS, t->key);
3272 break;
3273
3274 default:
3275 assert_not_reached("Unexpected NSEC result.");
3276 }
3277 }
3278
3279 return 1;
3280 }
3281
3282 static const char* const dns_transaction_state_table[_DNS_TRANSACTION_STATE_MAX] = {
3283 [DNS_TRANSACTION_NULL] = "null",
3284 [DNS_TRANSACTION_PENDING] = "pending",
3285 [DNS_TRANSACTION_VALIDATING] = "validating",
3286 [DNS_TRANSACTION_RCODE_FAILURE] = "rcode-failure",
3287 [DNS_TRANSACTION_SUCCESS] = "success",
3288 [DNS_TRANSACTION_NO_SERVERS] = "no-servers",
3289 [DNS_TRANSACTION_TIMEOUT] = "timeout",
3290 [DNS_TRANSACTION_ATTEMPTS_MAX_REACHED] = "attempts-max-reached",
3291 [DNS_TRANSACTION_INVALID_REPLY] = "invalid-reply",
3292 [DNS_TRANSACTION_ERRNO] = "errno",
3293 [DNS_TRANSACTION_ABORTED] = "aborted",
3294 [DNS_TRANSACTION_DNSSEC_FAILED] = "dnssec-failed",
3295 [DNS_TRANSACTION_NO_TRUST_ANCHOR] = "no-trust-anchor",
3296 [DNS_TRANSACTION_RR_TYPE_UNSUPPORTED] = "rr-type-unsupported",
3297 [DNS_TRANSACTION_NETWORK_DOWN] = "network-down",
3298 [DNS_TRANSACTION_NOT_FOUND] = "not-found",
3299 };
3300 DEFINE_STRING_TABLE_LOOKUP(dns_transaction_state, DnsTransactionState);
3301
3302 static const char* const dns_transaction_source_table[_DNS_TRANSACTION_SOURCE_MAX] = {
3303 [DNS_TRANSACTION_NETWORK] = "network",
3304 [DNS_TRANSACTION_CACHE] = "cache",
3305 [DNS_TRANSACTION_ZONE] = "zone",
3306 [DNS_TRANSACTION_TRUST_ANCHOR] = "trust-anchor",
3307 };
3308 DEFINE_STRING_TABLE_LOOKUP(dns_transaction_source, DnsTransactionSource);
Unnamed repository; edit this file 'description' to name the repository.