]> git.ipfire.org Git - thirdparty/systemd.git/blob - src/resolve/resolved-dns-transaction.c
projects / thirdparty / systemd.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
resolved: don't read packet from DnsStream on on_stream_complete() of DnsTransaction
[thirdparty/systemd.git] / src / resolve / resolved-dns-transaction.c
1 /* SPDX-License-Identifier: LGPL-2.1+ */
2
3 #include "sd-messages.h"
4
5 #include "af-list.h"
6 #include "alloc-util.h"
7 #include "dns-domain.h"
8 #include "errno-list.h"
9 #include "fd-util.h"
10 #include "random-util.h"
11 #include "resolved-dns-cache.h"
12 #include "resolved-dns-transaction.h"
13 #include "resolved-llmnr.h"
14 #if ENABLE_DNS_OVER_TLS
15 #include "resolved-dnstls.h"
16 #endif
17 #include "string-table.h"
18
19 #define TRANSACTIONS_MAX 4096
20 #define TRANSACTION_TCP_TIMEOUT_USEC (10U*USEC_PER_SEC)
21
22 /* After how much time to repeat classic DNS requests */
23 #define DNS_TIMEOUT_USEC (SD_RESOLVED_QUERY_TIMEOUT_USEC / DNS_TRANSACTION_ATTEMPTS_MAX)
24
25 static void dns_transaction_reset_answer(DnsTransaction *t) {
26 assert(t);
27
28 t->received = dns_packet_unref(t->received);
29 t->answer = dns_answer_unref(t->answer);
30 t->answer_rcode = 0;
31 t->answer_dnssec_result = _DNSSEC_RESULT_INVALID;
32 t->answer_source = _DNS_TRANSACTION_SOURCE_INVALID;
33 t->answer_authenticated = false;
34 t->answer_nsec_ttl = (uint32_t) -1;
35 t->answer_errno = 0;
36 }
37
38 static void dns_transaction_flush_dnssec_transactions(DnsTransaction *t) {
39 DnsTransaction *z;
40
41 assert(t);
42
43 while ((z = set_steal_first(t->dnssec_transactions))) {
44 set_remove(z->notify_transactions, t);
45 set_remove(z->notify_transactions_done, t);
46 dns_transaction_gc(z);
47 }
48 }
49
50 static void dns_transaction_close_connection(DnsTransaction *t) {
51 assert(t);
52
53 if (t->stream) {
54 /* Let's detach the stream from our transaction, in case something else keeps a reference to it. */
55 LIST_REMOVE(transactions_by_stream, t->stream->transactions, t);
56
57 /* Remove packet in case it's still in the queue */
58 dns_packet_unref(ordered_set_remove(t->stream->write_queue, t->sent));
59
60 t->stream = dns_stream_unref(t->stream);
61 }
62
63 t->dns_udp_event_source = sd_event_source_unref(t->dns_udp_event_source);
64 t->dns_udp_fd = safe_close(t->dns_udp_fd);
65 }
66
67 static void dns_transaction_stop_timeout(DnsTransaction *t) {
68 assert(t);
69
70 t->timeout_event_source = sd_event_source_unref(t->timeout_event_source);
71 }
72
73 DnsTransaction* dns_transaction_free(DnsTransaction *t) {
74 DnsQueryCandidate *c;
75 DnsZoneItem *i;
76 DnsTransaction *z;
77
78 if (!t)
79 return NULL;
80
81 log_debug("Freeing transaction %" PRIu16 ".", t->id);
82
83 dns_transaction_close_connection(t);
84 dns_transaction_stop_timeout(t);
85
86 dns_packet_unref(t->sent);
87 dns_transaction_reset_answer(t);
88
89 dns_server_unref(t->server);
90
91 if (t->scope) {
92 hashmap_remove_value(t->scope->transactions_by_key, t->key, t);
93 LIST_REMOVE(transactions_by_scope, t->scope->transactions, t);
94
95 if (t->id != 0)
96 hashmap_remove(t->scope->manager->dns_transactions, UINT_TO_PTR(t->id));
97 }
98
99 while ((c = set_steal_first(t->notify_query_candidates)))
100 set_remove(c->transactions, t);
101 set_free(t->notify_query_candidates);
102
103 while ((c = set_steal_first(t->notify_query_candidates_done)))
104 set_remove(c->transactions, t);
105 set_free(t->notify_query_candidates_done);
106
107 while ((i = set_steal_first(t->notify_zone_items)))
108 i->probe_transaction = NULL;
109 set_free(t->notify_zone_items);
110
111 while ((i = set_steal_first(t->notify_zone_items_done)))
112 i->probe_transaction = NULL;
113 set_free(t->notify_zone_items_done);
114
115 while ((z = set_steal_first(t->notify_transactions)))
116 set_remove(z->dnssec_transactions, t);
117 set_free(t->notify_transactions);
118
119 while ((z = set_steal_first(t->notify_transactions_done)))
120 set_remove(z->dnssec_transactions, t);
121 set_free(t->notify_transactions_done);
122
123 dns_transaction_flush_dnssec_transactions(t);
124 set_free(t->dnssec_transactions);
125
126 dns_answer_unref(t->validated_keys);
127 dns_resource_key_unref(t->key);
128
129 return mfree(t);
130 }
131
132 DEFINE_TRIVIAL_CLEANUP_FUNC(DnsTransaction*, dns_transaction_free);
133
134 bool dns_transaction_gc(DnsTransaction *t) {
135 assert(t);
136
137 if (t->block_gc > 0)
138 return true;
139
140 if (set_isempty(t->notify_query_candidates) &&
141 set_isempty(t->notify_query_candidates_done) &&
142 set_isempty(t->notify_zone_items) &&
143 set_isempty(t->notify_zone_items_done) &&
144 set_isempty(t->notify_transactions) &&
145 set_isempty(t->notify_transactions_done)) {
146 dns_transaction_free(t);
147 return false;
148 }
149
150 return true;
151 }
152
153 static uint16_t pick_new_id(Manager *m) {
154 uint16_t new_id;
155
156 /* Find a fresh, unused transaction id. Note that this loop is bounded because there's a limit on the number of
157 * transactions, and it's much lower than the space of IDs. */
158
159 assert_cc(TRANSACTIONS_MAX < 0xFFFF);
160
161 do
162 random_bytes(&new_id, sizeof(new_id));
163 while (new_id == 0 ||
164 hashmap_get(m->dns_transactions, UINT_TO_PTR(new_id)));
165
166 return new_id;
167 }
168
169 int dns_transaction_new(DnsTransaction **ret, DnsScope *s, DnsResourceKey *key) {
170 _cleanup_(dns_transaction_freep) DnsTransaction *t = NULL;
171 int r;
172
173 assert(ret);
174 assert(s);
175 assert(key);
176
177 /* Don't allow looking up invalid or pseudo RRs */
178 if (!dns_type_is_valid_query(key->type))
179 return -EINVAL;
180 if (dns_type_is_obsolete(key->type))
181 return -EOPNOTSUPP;
182
183 /* We only support the IN class */
184 if (!IN_SET(key->class, DNS_CLASS_IN, DNS_CLASS_ANY))
185 return -EOPNOTSUPP;
186
187 if (hashmap_size(s->manager->dns_transactions) >= TRANSACTIONS_MAX)
188 return -EBUSY;
189
190 r = hashmap_ensure_allocated(&s->manager->dns_transactions, NULL);
191 if (r < 0)
192 return r;
193
194 r = hashmap_ensure_allocated(&s->transactions_by_key, &dns_resource_key_hash_ops);
195 if (r < 0)
196 return r;
197
198 t = new0(DnsTransaction, 1);
199 if (!t)
200 return -ENOMEM;
201
202 t->dns_udp_fd = -1;
203 t->answer_source = _DNS_TRANSACTION_SOURCE_INVALID;
204 t->answer_dnssec_result = _DNSSEC_RESULT_INVALID;
205 t->answer_nsec_ttl = (uint32_t) -1;
206 t->key = dns_resource_key_ref(key);
207 t->current_feature_level = _DNS_SERVER_FEATURE_LEVEL_INVALID;
208 t->clamp_feature_level = _DNS_SERVER_FEATURE_LEVEL_INVALID;
209
210 t->id = pick_new_id(s->manager);
211
212 r = hashmap_put(s->manager->dns_transactions, UINT_TO_PTR(t->id), t);
213 if (r < 0) {
214 t->id = 0;
215 return r;
216 }
217
218 r = hashmap_replace(s->transactions_by_key, t->key, t);
219 if (r < 0) {
220 hashmap_remove(s->manager->dns_transactions, UINT_TO_PTR(t->id));
221 return r;
222 }
223
224 LIST_PREPEND(transactions_by_scope, s->transactions, t);
225 t->scope = s;
226
227 s->manager->n_transactions_total++;
228
229 if (ret)
230 *ret = t;
231
232 t = NULL;
233
234 return 0;
235 }
236
237 static void dns_transaction_shuffle_id(DnsTransaction *t) {
238 uint16_t new_id;
239 assert(t);
240
241 /* Pick a new ID for this transaction. */
242
243 new_id = pick_new_id(t->scope->manager);
244 assert_se(hashmap_remove_and_put(t->scope->manager->dns_transactions, UINT_TO_PTR(t->id), UINT_TO_PTR(new_id), t) >= 0);
245
246 log_debug("Transaction %" PRIu16 " is now %" PRIu16 ".", t->id, new_id);
247 t->id = new_id;
248
249 /* Make sure we generate a new packet with the new ID */
250 t->sent = dns_packet_unref(t->sent);
251 }
252
253 static void dns_transaction_tentative(DnsTransaction *t, DnsPacket *p) {
254 _cleanup_free_ char *pretty = NULL;
255 char key_str[DNS_RESOURCE_KEY_STRING_MAX];
256 DnsZoneItem *z;
257
258 assert(t);
259 assert(p);
260
261 if (manager_our_packet(t->scope->manager, p) != 0)
262 return;
263
264 (void) in_addr_to_string(p->family, &p->sender, &pretty);
265
266 log_debug("Transaction %" PRIu16 " for <%s> on scope %s on %s/%s got tentative packet from %s.",
267 t->id,
268 dns_resource_key_to_string(t->key, key_str, sizeof key_str),
269 dns_protocol_to_string(t->scope->protocol),
270 t->scope->link ? t->scope->link->name : "*",
271 af_to_name_short(t->scope->family),
272 strnull(pretty));
273
274 /* RFC 4795, Section 4.1 says that the peer with the
275 * lexicographically smaller IP address loses */
276 if (memcmp(&p->sender, &p->destination, FAMILY_ADDRESS_SIZE(p->family)) >= 0) {
277 log_debug("Peer has lexicographically larger IP address and thus lost in the conflict.");
278 return;
279 }
280
281 log_debug("We have the lexicographically larger IP address and thus lost in the conflict.");
282
283 t->block_gc++;
284
285 while ((z = set_first(t->notify_zone_items))) {
286 /* First, make sure the zone item drops the reference
287 * to us */
288 dns_zone_item_probe_stop(z);
289
290 /* Secondly, report this as conflict, so that we might
291 * look for a different hostname */
292 dns_zone_item_conflict(z);
293 }
294 t->block_gc--;
295
296 dns_transaction_gc(t);
297 }
298
299 void dns_transaction_complete(DnsTransaction *t, DnsTransactionState state) {
300 DnsQueryCandidate *c;
301 DnsZoneItem *z;
302 DnsTransaction *d;
303 const char *st;
304 char key_str[DNS_RESOURCE_KEY_STRING_MAX];
305
306 assert(t);
307 assert(!DNS_TRANSACTION_IS_LIVE(state));
308
309 if (state == DNS_TRANSACTION_DNSSEC_FAILED) {
310 dns_resource_key_to_string(t->key, key_str, sizeof key_str);
311
312 log_struct(LOG_NOTICE,
313 "MESSAGE_ID=" SD_MESSAGE_DNSSEC_FAILURE_STR,
314 LOG_MESSAGE("DNSSEC validation failed for question %s: %s", key_str, dnssec_result_to_string(t->answer_dnssec_result)),
315 "DNS_TRANSACTION=%" PRIu16, t->id,
316 "DNS_QUESTION=%s", key_str,
317 "DNSSEC_RESULT=%s", dnssec_result_to_string(t->answer_dnssec_result),
318 "DNS_SERVER=%s", dns_server_string(t->server),
319 "DNS_SERVER_FEATURE_LEVEL=%s", dns_server_feature_level_to_string(t->server->possible_feature_level));
320 }
321
322 /* Note that this call might invalidate the query. Callers
323 * should hence not attempt to access the query or transaction
324 * after calling this function. */
325
326 if (state == DNS_TRANSACTION_ERRNO)
327 st = errno_to_name(t->answer_errno);
328 else
329 st = dns_transaction_state_to_string(state);
330
331 log_debug("Transaction %" PRIu16 " for <%s> on scope %s on %s/%s now complete with <%s> from %s (%s).",
332 t->id,
333 dns_resource_key_to_string(t->key, key_str, sizeof key_str),
334 dns_protocol_to_string(t->scope->protocol),
335 t->scope->link ? t->scope->link->name : "*",
336 af_to_name_short(t->scope->family),
337 st,
338 t->answer_source < 0 ? "none" : dns_transaction_source_to_string(t->answer_source),
339 t->answer_authenticated ? "authenticated" : "unsigned");
340
341 t->state = state;
342
343 dns_transaction_close_connection(t);
344 dns_transaction_stop_timeout(t);
345
346 /* Notify all queries that are interested, but make sure the
347 * transaction isn't freed while we are still looking at it */
348 t->block_gc++;
349
350 SET_FOREACH_MOVE(c, t->notify_query_candidates_done, t->notify_query_candidates)
351 dns_query_candidate_notify(c);
352 SWAP_TWO(t->notify_query_candidates, t->notify_query_candidates_done);
353
354 SET_FOREACH_MOVE(z, t->notify_zone_items_done, t->notify_zone_items)
355 dns_zone_item_notify(z);
356 SWAP_TWO(t->notify_zone_items, t->notify_zone_items_done);
357 if (t->probing && t->state == DNS_TRANSACTION_ATTEMPTS_MAX_REACHED)
358 (void) dns_scope_announce(t->scope, false);
359
360 SET_FOREACH_MOVE(d, t->notify_transactions_done, t->notify_transactions)
361 dns_transaction_notify(d, t);
362 SWAP_TWO(t->notify_transactions, t->notify_transactions_done);
363
364 t->block_gc--;
365 dns_transaction_gc(t);
366 }
367
368 static int dns_transaction_pick_server(DnsTransaction *t) {
369 DnsServer *server;
370
371 assert(t);
372 assert(t->scope->protocol == DNS_PROTOCOL_DNS);
373
374 /* Pick a DNS server and a feature level for it. */
375
376 server = dns_scope_get_dns_server(t->scope);
377 if (!server)
378 return -ESRCH;
379
380 /* If we changed the server invalidate the feature level clamping, as the new server might have completely
381 * different properties. */
382 if (server != t->server)
383 t->clamp_feature_level = _DNS_SERVER_FEATURE_LEVEL_INVALID;
384
385 t->current_feature_level = dns_server_possible_feature_level(server);
386
387 /* Clamp the feature level if that is requested. */
388 if (t->clamp_feature_level != _DNS_SERVER_FEATURE_LEVEL_INVALID &&
389 t->current_feature_level > t->clamp_feature_level)
390 t->current_feature_level = t->clamp_feature_level;
391
392 log_debug("Using feature level %s for transaction %u.", dns_server_feature_level_to_string(t->current_feature_level), t->id);
393
394 if (server == t->server)
395 return 0;
396
397 dns_server_unref(t->server);
398 t->server = dns_server_ref(server);
399
400 t->n_picked_servers ++;
401
402 log_debug("Using DNS server %s for transaction %u.", dns_server_string(t->server), t->id);
403
404 return 1;
405 }
406
407 static void dns_transaction_retry(DnsTransaction *t, bool next_server) {
408 int r;
409
410 assert(t);
411
412 log_debug("Retrying transaction %" PRIu16 ".", t->id);
413
414 /* Before we try again, switch to a new server. */
415 if (next_server)
416 dns_scope_next_dns_server(t->scope);
417
418 r = dns_transaction_go(t);
419 if (r < 0) {
420 t->answer_errno = -r;
421 dns_transaction_complete(t, DNS_TRANSACTION_ERRNO);
422 }
423 }
424
425 static int dns_transaction_maybe_restart(DnsTransaction *t) {
426 int r;
427
428 assert(t);
429
430 /* Returns > 0 if the transaction was restarted, 0 if not */
431
432 if (!t->server)
433 return 0;
434
435 if (t->current_feature_level <= dns_server_possible_feature_level(t->server))
436 return 0;
437
438 /* The server's current feature level is lower than when we sent the original query. We learnt something from
439 the response or possibly an auxiliary DNSSEC response that we didn't know before. We take that as reason to
440 restart the whole transaction. This is a good idea to deal with servers that respond rubbish if we include
441 OPT RR or DO bit. One of these cases is documented here, for example:
442 https://open.nlnetlabs.nl/pipermail/dnssec-trigger/2014-November/000376.html */
443
444 log_debug("Server feature level is now lower than when we began our transaction. Restarting with new ID.");
445 dns_transaction_shuffle_id(t);
446
447 r = dns_transaction_go(t);
448 if (r < 0)
449 return r;
450
451 return 1;
452 }
453
454 static void on_transaction_stream_error(DnsTransaction *t, int error) {
455 assert(t);
456
457 dns_transaction_close_connection(t);
458
459 if (ERRNO_IS_DISCONNECT(error)) {
460 if (t->scope->protocol == DNS_PROTOCOL_LLMNR) {
461 /* If the LLMNR/TCP connection failed, the host doesn't support LLMNR, and we cannot answer the
462 * question on this scope. */
463 dns_transaction_complete(t, DNS_TRANSACTION_NOT_FOUND);
464 return;
465 }
466
467 dns_transaction_retry(t, true);
468 return;
469 }
470 if (error != 0) {
471 t->answer_errno = error;
472 dns_transaction_complete(t, DNS_TRANSACTION_ERRNO);
473 }
474 }
475
476 static int dns_transaction_on_stream_packet(DnsTransaction *t, DnsPacket *p) {
477 assert(t);
478 assert(p);
479
480 dns_transaction_close_connection(t);
481
482 if (dns_packet_validate_reply(p) <= 0) {
483 log_debug("Invalid TCP reply packet.");
484 dns_transaction_complete(t, DNS_TRANSACTION_INVALID_REPLY);
485 return 0;
486 }
487
488 dns_scope_check_conflicts(t->scope, p);
489
490 t->block_gc++;
491 dns_transaction_process_reply(t, p);
492 t->block_gc--;
493
494 /* If the response wasn't useful, then complete the transition
495 * now. After all, we are the worst feature set now with TCP
496 * sockets, and there's really no point in retrying. */
497 if (t->state == DNS_TRANSACTION_PENDING)
498 dns_transaction_complete(t, DNS_TRANSACTION_INVALID_REPLY);
499 else
500 dns_transaction_gc(t);
501
502 return 0;
503 }
504
505 static int on_stream_complete(DnsStream *s, int error) {
506 _cleanup_(dns_stream_unrefp) DnsStream *p = NULL;
507
508 /* Do not let new transactions use this stream */
509 if (s->server && s->server->stream == s)
510 p = TAKE_PTR(s->server->stream);
511
512 if (ERRNO_IS_DISCONNECT(error) && s->protocol != DNS_PROTOCOL_LLMNR) {
513 log_debug_errno(error, "Connection failure for DNS TCP stream: %m");
514
515 if (s->transactions) {
516 DnsTransaction *t;
517
518 t = s->transactions;
519 dns_server_packet_lost(t->server, IPPROTO_TCP, t->current_feature_level);
520 }
521 }
522
523 if (error != 0) {
524 DnsTransaction *t, *n;
525
526 LIST_FOREACH_SAFE(transactions_by_stream, t, n, s->transactions)
527 on_transaction_stream_error(t, error);
528 }
529
530 return 0;
531 }
532
533 static int dns_stream_on_packet(DnsStream *s) {
534 _cleanup_(dns_packet_unrefp) DnsPacket *p = NULL;
535 DnsTransaction *t;
536
537 assert(s);
538
539 /* Take ownership of packet to be able to receive new packets */
540 p = dns_stream_take_read_packet(s);
541 assert(p);
542
543 t = hashmap_get(s->manager->dns_transactions, UINT_TO_PTR(DNS_PACKET_ID(p)));
544 if (t)
545 return dns_transaction_on_stream_packet(t, p);
546
547 /* Ignore incorrect transaction id as transaction can have been canceled */
548 if (dns_packet_validate_reply(p) <= 0) {
549 log_debug("Invalid TCP reply packet.");
550 on_stream_complete(s, 0);
551 }
552
553 return 0;
554 }
555
556 static int dns_transaction_emit_tcp(DnsTransaction *t) {
557 _cleanup_close_ int fd = -1;
558 _cleanup_(dns_stream_unrefp) DnsStream *s = NULL;
559 union sockaddr_union sa;
560 int r;
561
562 assert(t);
563
564 dns_transaction_close_connection(t);
565
566 switch (t->scope->protocol) {
567
568 case DNS_PROTOCOL_DNS:
569 r = dns_transaction_pick_server(t);
570 if (r < 0)
571 return r;
572
573 if (!dns_server_dnssec_supported(t->server) && dns_type_is_dnssec(t->key->type))
574 return -EOPNOTSUPP;
575
576 r = dns_server_adjust_opt(t->server, t->sent, t->current_feature_level);
577 if (r < 0)
578 return r;
579
580 if (t->server->stream && (DNS_SERVER_FEATURE_LEVEL_IS_TLS(t->current_feature_level) == t->server->stream->encrypted))
581 s = dns_stream_ref(t->server->stream);
582 else
583 fd = dns_scope_socket_tcp(t->scope, AF_UNSPEC, NULL, t->server, DNS_SERVER_FEATURE_LEVEL_IS_TLS(t->current_feature_level) ? 853 : 53, &sa);
584
585 break;
586
587 case DNS_PROTOCOL_LLMNR:
588 /* When we already received a reply to this (but it was truncated), send to its sender address */
589 if (t->received)
590 fd = dns_scope_socket_tcp(t->scope, t->received->family, &t->received->sender, NULL, t->received->sender_port, &sa);
591 else {
592 union in_addr_union address;
593 int family = AF_UNSPEC;
594
595 /* Otherwise, try to talk to the owner of a
596 * the IP address, in case this is a reverse
597 * PTR lookup */
598
599 r = dns_name_address(dns_resource_key_name(t->key), &family, &address);
600 if (r < 0)
601 return r;
602 if (r == 0)
603 return -EINVAL;
604 if (family != t->scope->family)
605 return -ESRCH;
606
607 fd = dns_scope_socket_tcp(t->scope, family, &address, NULL, LLMNR_PORT, &sa);
608 }
609
610 break;
611
612 default:
613 return -EAFNOSUPPORT;
614 }
615
616 if (!s) {
617 if (fd < 0)
618 return fd;
619
620 r = dns_stream_new(t->scope->manager, &s, t->scope->protocol, fd, &sa);
621 if (r < 0)
622 return r;
623
624 fd = -1;
625
626 #if ENABLE_DNS_OVER_TLS
627 if (DNS_SERVER_FEATURE_LEVEL_IS_TLS(t->current_feature_level)) {
628 assert(t->server);
629 r = dnstls_stream_connect_tls(s, t->server);
630 if (r < 0)
631 return r;
632 }
633 #endif
634
635 if (t->server) {
636 dns_stream_unref(t->server->stream);
637 t->server->stream = dns_stream_ref(s);
638 s->server = dns_server_ref(t->server);
639 }
640
641 s->complete = on_stream_complete;
642 s->on_packet = dns_stream_on_packet;
643
644 /* The interface index is difficult to determine if we are
645 * connecting to the local host, hence fill this in right away
646 * instead of determining it from the socket */
647 s->ifindex = dns_scope_ifindex(t->scope);
648 }
649
650 t->stream = TAKE_PTR(s);
651 LIST_PREPEND(transactions_by_stream, t->stream->transactions, t);
652
653 r = dns_stream_write_packet(t->stream, t->sent);
654 if (r < 0) {
655 dns_transaction_close_connection(t);
656 return r;
657 }
658
659 dns_transaction_reset_answer(t);
660
661 t->tried_stream = true;
662
663 return 0;
664 }
665
666 static void dns_transaction_cache_answer(DnsTransaction *t) {
667 assert(t);
668
669 /* For mDNS we cache whenever we get the packet, rather than
670 * in each transaction. */
671 if (!IN_SET(t->scope->protocol, DNS_PROTOCOL_DNS, DNS_PROTOCOL_LLMNR))
672 return;
673
674 /* Caching disabled? */
675 if (!t->scope->manager->enable_cache)
676 return;
677
678 /* We never cache if this packet is from the local host, under
679 * the assumption that a locally running DNS server would
680 * cache this anyway, and probably knows better when to flush
681 * the cache then we could. */
682 if (!DNS_PACKET_SHALL_CACHE(t->received))
683 return;
684
685 dns_cache_put(&t->scope->cache,
686 t->key,
687 t->answer_rcode,
688 t->answer,
689 t->answer_authenticated,
690 t->answer_nsec_ttl,
691 0,
692 t->received->family,
693 &t->received->sender);
694 }
695
696 static bool dns_transaction_dnssec_is_live(DnsTransaction *t) {
697 DnsTransaction *dt;
698 Iterator i;
699
700 assert(t);
701
702 SET_FOREACH(dt, t->dnssec_transactions, i)
703 if (DNS_TRANSACTION_IS_LIVE(dt->state))
704 return true;
705
706 return false;
707 }
708
709 static int dns_transaction_dnssec_ready(DnsTransaction *t) {
710 DnsTransaction *dt;
711 Iterator i;
712
713 assert(t);
714
715 /* Checks whether the auxiliary DNSSEC transactions of our transaction have completed, or are still
716 * ongoing. Returns 0, if we aren't ready for the DNSSEC validation, positive if we are. */
717
718 SET_FOREACH(dt, t->dnssec_transactions, i) {
719
720 switch (dt->state) {
721
722 case DNS_TRANSACTION_NULL:
723 case DNS_TRANSACTION_PENDING:
724 case DNS_TRANSACTION_VALIDATING:
725 /* Still ongoing */
726 return 0;
727
728 case DNS_TRANSACTION_RCODE_FAILURE:
729 if (!IN_SET(dt->answer_rcode, DNS_RCODE_NXDOMAIN, DNS_RCODE_SERVFAIL)) {
730 log_debug("Auxiliary DNSSEC RR query failed with rcode=%s.", dns_rcode_to_string(dt->answer_rcode));
731 goto fail;
732 }
733
734 /* Fall-through: NXDOMAIN/SERVFAIL is good enough for us. This is because some DNS servers
735 * erronously return NXDOMAIN/SERVFAIL for empty non-terminals (Akamai...) or missing DS
736 * records (Facebook), and we need to handle that nicely, when asking for parent SOA or similar
737 * RRs to make unsigned proofs. */
738
739 case DNS_TRANSACTION_SUCCESS:
740 /* All good. */
741 break;
742
743 case DNS_TRANSACTION_DNSSEC_FAILED:
744 /* We handle DNSSEC failures different from other errors, as we care about the DNSSEC
745 * validationr result */
746
747 log_debug("Auxiliary DNSSEC RR query failed validation: %s", dnssec_result_to_string(dt->answer_dnssec_result));
748 t->answer_dnssec_result = dt->answer_dnssec_result; /* Copy error code over */
749 dns_transaction_complete(t, DNS_TRANSACTION_DNSSEC_FAILED);
750 return 0;
751
752 default:
753 log_debug("Auxiliary DNSSEC RR query failed with %s", dns_transaction_state_to_string(dt->state));
754 goto fail;
755 }
756 }
757
758 /* All is ready, we can go and validate */
759 return 1;
760
761 fail:
762 t->answer_dnssec_result = DNSSEC_FAILED_AUXILIARY;
763 dns_transaction_complete(t, DNS_TRANSACTION_DNSSEC_FAILED);
764 return 0;
765 }
766
767 static void dns_transaction_process_dnssec(DnsTransaction *t) {
768 int r;
769
770 assert(t);
771
772 /* Are there ongoing DNSSEC transactions? If so, let's wait for them. */
773 r = dns_transaction_dnssec_ready(t);
774 if (r < 0)
775 goto fail;
776 if (r == 0) /* We aren't ready yet (or one of our auxiliary transactions failed, and we shouldn't validate now */
777 return;
778
779 /* See if we learnt things from the additional DNSSEC transactions, that we didn't know before, and better
780 * restart the lookup immediately. */
781 r = dns_transaction_maybe_restart(t);
782 if (r < 0)
783 goto fail;
784 if (r > 0) /* Transaction got restarted... */
785 return;
786
787 /* All our auxiliary DNSSEC transactions are complete now. Try
788 * to validate our RRset now. */
789 r = dns_transaction_validate_dnssec(t);
790 if (r == -EBADMSG) {
791 dns_transaction_complete(t, DNS_TRANSACTION_INVALID_REPLY);
792 return;
793 }
794 if (r < 0)
795 goto fail;
796
797 if (t->answer_dnssec_result == DNSSEC_INCOMPATIBLE_SERVER &&
798 t->scope->dnssec_mode == DNSSEC_YES) {
799
800 /* We are not in automatic downgrade mode, and the server is bad. Let's try a different server, maybe
801 * that works. */
802
803 if (t->n_picked_servers < dns_scope_get_n_dns_servers(t->scope)) {
804 /* We tried fewer servers on this transaction than we know, let's try another one then */
805 dns_transaction_retry(t, true);
806 return;
807 }
808
809 /* OK, let's give up, apparently all servers we tried didn't work. */
810 dns_transaction_complete(t, DNS_TRANSACTION_DNSSEC_FAILED);
811 return;
812 }
813
814 if (!IN_SET(t->answer_dnssec_result,
815 _DNSSEC_RESULT_INVALID, /* No DNSSEC validation enabled */
816 DNSSEC_VALIDATED, /* Answer is signed and validated successfully */
817 DNSSEC_UNSIGNED, /* Answer is right-fully unsigned */
818 DNSSEC_INCOMPATIBLE_SERVER)) { /* Server does not do DNSSEC (Yay, we are downgrade attack vulnerable!) */
819 dns_transaction_complete(t, DNS_TRANSACTION_DNSSEC_FAILED);
820 return;
821 }
822
823 if (t->answer_dnssec_result == DNSSEC_INCOMPATIBLE_SERVER)
824 dns_server_warn_downgrade(t->server);
825
826 dns_transaction_cache_answer(t);
827
828 if (t->answer_rcode == DNS_RCODE_SUCCESS)
829 dns_transaction_complete(t, DNS_TRANSACTION_SUCCESS);
830 else
831 dns_transaction_complete(t, DNS_TRANSACTION_RCODE_FAILURE);
832
833 return;
834
835 fail:
836 t->answer_errno = -r;
837 dns_transaction_complete(t, DNS_TRANSACTION_ERRNO);
838 }
839
840 static int dns_transaction_has_positive_answer(DnsTransaction *t, DnsAnswerFlags *flags) {
841 int r;
842
843 assert(t);
844
845 /* Checks whether the answer is positive, i.e. either a direct
846 * answer to the question, or a CNAME/DNAME for it */
847
848 r = dns_answer_match_key(t->answer, t->key, flags);
849 if (r != 0)
850 return r;
851
852 r = dns_answer_find_cname_or_dname(t->answer, t->key, NULL, flags);
853 if (r != 0)
854 return r;
855
856 return false;
857 }
858
859 static int dns_transaction_fix_rcode(DnsTransaction *t) {
860 int r;
861
862 assert(t);
863
864 /* Fix up the RCODE to SUCCESS if we get at least one matching RR in a response. Note that this contradicts the
865 * DNS RFCs a bit. Specifically, RFC 6604 Section 3 clarifies that the RCODE shall say something about a
866 * CNAME/DNAME chain element coming after the last chain element contained in the message, and not the first
867 * one included. However, it also indicates that not all DNS servers implement this correctly. Moreover, when
868 * using DNSSEC we usually only can prove the first element of a CNAME/DNAME chain anyway, hence let's settle
869 * on always processing the RCODE as referring to the immediate look-up we do, i.e. the first element of a
870 * CNAME/DNAME chain. This way, we uniformly handle CNAME/DNAME chains, regardless if the DNS server
871 * incorrectly implements RCODE, whether DNSSEC is in use, or whether the DNS server only supplied us with an
872 * incomplete CNAME/DNAME chain.
873 *
874 * Or in other words: if we get at least one positive reply in a message we patch NXDOMAIN to become SUCCESS,
875 * and then rely on the CNAME chasing logic to figure out that there's actually a CNAME error with a new
876 * lookup. */
877
878 if (t->answer_rcode != DNS_RCODE_NXDOMAIN)
879 return 0;
880
881 r = dns_transaction_has_positive_answer(t, NULL);
882 if (r <= 0)
883 return r;
884
885 t->answer_rcode = DNS_RCODE_SUCCESS;
886 return 0;
887 }
888
889 void dns_transaction_process_reply(DnsTransaction *t, DnsPacket *p) {
890 usec_t ts;
891 int r;
892
893 assert(t);
894 assert(p);
895 assert(t->scope);
896 assert(t->scope->manager);
897
898 if (t->state != DNS_TRANSACTION_PENDING)
899 return;
900
901 /* Note that this call might invalidate the query. Callers
902 * should hence not attempt to access the query or transaction
903 * after calling this function. */
904
905 log_debug("Processing incoming packet on transaction %" PRIu16" (rcode=%s).",
906 t->id, dns_rcode_to_string(DNS_PACKET_RCODE(p)));
907
908 switch (t->scope->protocol) {
909
910 case DNS_PROTOCOL_LLMNR:
911 /* For LLMNR we will not accept any packets from other interfaces */
912
913 if (p->ifindex != dns_scope_ifindex(t->scope))
914 return;
915
916 if (p->family != t->scope->family)
917 return;
918
919 /* Tentative packets are not full responses but still
920 * useful for identifying uniqueness conflicts during
921 * probing. */
922 if (DNS_PACKET_LLMNR_T(p)) {
923 dns_transaction_tentative(t, p);
924 return;
925 }
926
927 break;
928
929 case DNS_PROTOCOL_MDNS:
930 /* For mDNS we will not accept any packets from other interfaces */
931
932 if (p->ifindex != dns_scope_ifindex(t->scope))
933 return;
934
935 if (p->family != t->scope->family)
936 return;
937
938 break;
939
940 case DNS_PROTOCOL_DNS:
941 /* Note that we do not need to verify the
942 * addresses/port numbers of incoming traffic, as we
943 * invoked connect() on our UDP socket in which case
944 * the kernel already does the needed verification for
945 * us. */
946 break;
947
948 default:
949 assert_not_reached("Invalid DNS protocol.");
950 }
951
952 if (t->received != p) {
953 dns_packet_unref(t->received);
954 t->received = dns_packet_ref(p);
955 }
956
957 t->answer_source = DNS_TRANSACTION_NETWORK;
958
959 if (p->ipproto == IPPROTO_TCP) {
960 if (DNS_PACKET_TC(p)) {
961 /* Truncated via TCP? Somebody must be fucking with us */
962 dns_transaction_complete(t, DNS_TRANSACTION_INVALID_REPLY);
963 return;
964 }
965
966 if (DNS_PACKET_ID(p) != t->id) {
967 /* Not the reply to our query? Somebody must be fucking with us */
968 dns_transaction_complete(t, DNS_TRANSACTION_INVALID_REPLY);
969 return;
970 }
971 }
972
973 assert_se(sd_event_now(t->scope->manager->event, clock_boottime_or_monotonic(), &ts) >= 0);
974
975 switch (t->scope->protocol) {
976
977 case DNS_PROTOCOL_DNS:
978 assert(t->server);
979
980 if (IN_SET(DNS_PACKET_RCODE(p), DNS_RCODE_FORMERR, DNS_RCODE_SERVFAIL, DNS_RCODE_NOTIMP)) {
981
982 /* Request failed, immediately try again with reduced features */
983
984 if (t->current_feature_level <= DNS_SERVER_FEATURE_LEVEL_UDP) {
985
986 /* This was already at UDP feature level? If so, it doesn't make sense to downgrade
987 * this transaction anymore, but let's see if it might make sense to send the request
988 * to a different DNS server instead. If not let's process the response, and accept the
989 * rcode. Note that we don't retry on TCP, since that's a suitable way to mitigate
990 * packet loss, but is not going to give us better rcodes should we actually have
991 * managed to get them already at UDP level. */
992
993 if (t->n_picked_servers < dns_scope_get_n_dns_servers(t->scope)) {
994 /* We tried fewer servers on this transaction than we know, let's try another one then */
995 dns_transaction_retry(t, true);
996 return;
997 }
998
999 /* Give up, accept the rcode */
1000 log_debug("Server returned error: %s", dns_rcode_to_string(DNS_PACKET_RCODE(p)));
1001 break;
1002 }
1003
1004 /* Reduce this feature level by one and try again. */
1005 switch (t->current_feature_level) {
1006 case DNS_SERVER_FEATURE_LEVEL_TLS_DO:
1007 t->clamp_feature_level = DNS_SERVER_FEATURE_LEVEL_TLS_PLAIN;
1008 break;
1009 case DNS_SERVER_FEATURE_LEVEL_TLS_PLAIN + 1:
1010 /* Skip plain TLS when TLS is not supported */
1011 t->clamp_feature_level = DNS_SERVER_FEATURE_LEVEL_TLS_PLAIN - 1;
1012 break;
1013 default:
1014 t->clamp_feature_level = t->current_feature_level - 1;
1015 }
1016
1017 log_debug("Server returned error %s, retrying transaction with reduced feature level %s.",
1018 dns_rcode_to_string(DNS_PACKET_RCODE(p)),
1019 dns_server_feature_level_to_string(t->clamp_feature_level));
1020
1021 dns_transaction_retry(t, false /* use the same server */);
1022 return;
1023 }
1024
1025 if (DNS_PACKET_RCODE(p) == DNS_RCODE_REFUSED) {
1026 /* This server refused our request? If so, try again, use a different server */
1027 log_debug("Server returned REFUSED, switching servers, and retrying.");
1028 dns_transaction_retry(t, true /* pick a new server */);
1029 return;
1030 }
1031
1032 if (DNS_PACKET_TC(p))
1033 dns_server_packet_truncated(t->server, t->current_feature_level);
1034
1035 break;
1036
1037 case DNS_PROTOCOL_LLMNR:
1038 case DNS_PROTOCOL_MDNS:
1039 dns_scope_packet_received(t->scope, ts - t->start_usec);
1040 break;
1041
1042 default:
1043 assert_not_reached("Invalid DNS protocol.");
1044 }
1045
1046 if (DNS_PACKET_TC(p)) {
1047
1048 /* Truncated packets for mDNS are not allowed. Give up immediately. */
1049 if (t->scope->protocol == DNS_PROTOCOL_MDNS) {
1050 dns_transaction_complete(t, DNS_TRANSACTION_INVALID_REPLY);
1051 return;
1052 }
1053
1054 log_debug("Reply truncated, retrying via TCP.");
1055
1056 /* Response was truncated, let's try again with good old TCP */
1057 r = dns_transaction_emit_tcp(t);
1058 if (r == -ESRCH) {
1059 /* No servers found? Damn! */
1060 dns_transaction_complete(t, DNS_TRANSACTION_NO_SERVERS);
1061 return;
1062 }
1063 if (r == -EOPNOTSUPP) {
1064 /* Tried to ask for DNSSEC RRs, on a server that doesn't do DNSSEC */
1065 dns_transaction_complete(t, DNS_TRANSACTION_RR_TYPE_UNSUPPORTED);
1066 return;
1067 }
1068 if (r < 0) {
1069 /* On LLMNR, if we cannot connect to the host,
1070 * we immediately give up */
1071 if (t->scope->protocol != DNS_PROTOCOL_DNS)
1072 goto fail;
1073
1074 /* On DNS, couldn't send? Try immediately again, with a new server */
1075 dns_transaction_retry(t, true);
1076 }
1077
1078 return;
1079 }
1080
1081 /* After the superficial checks, actually parse the message. */
1082 r = dns_packet_extract(p);
1083 if (r < 0) {
1084 dns_transaction_complete(t, DNS_TRANSACTION_INVALID_REPLY);
1085 return;
1086 }
1087
1088 if (t->server) {
1089 /* Report that we successfully received a valid packet with a good rcode after we initially got a bad
1090 * rcode and subsequently downgraded the protocol */
1091
1092 if (IN_SET(DNS_PACKET_RCODE(p), DNS_RCODE_SUCCESS, DNS_RCODE_NXDOMAIN) &&
1093 t->clamp_feature_level != _DNS_SERVER_FEATURE_LEVEL_INVALID)
1094 dns_server_packet_rcode_downgrade(t->server, t->clamp_feature_level);
1095
1096 /* Report that the OPT RR was missing */
1097 if (!p->opt)
1098 dns_server_packet_bad_opt(t->server, t->current_feature_level);
1099
1100 /* Report that we successfully received a packet */
1101 dns_server_packet_received(t->server, p->ipproto, t->current_feature_level, p->size);
1102 }
1103
1104 /* See if we know things we didn't know before that indicate we better restart the lookup immediately. */
1105 r = dns_transaction_maybe_restart(t);
1106 if (r < 0)
1107 goto fail;
1108 if (r > 0) /* Transaction got restarted... */
1109 return;
1110
1111 if (IN_SET(t->scope->protocol, DNS_PROTOCOL_DNS, DNS_PROTOCOL_LLMNR, DNS_PROTOCOL_MDNS)) {
1112
1113 /* When dealing with protocols other than mDNS only consider responses with
1114 * equivalent query section to the request. For mDNS this check doesn't make
1115 * sense, because the section 6 of RFC6762 states that "Multicast DNS responses MUST NOT
1116 * contain any questions in the Question Section". */
1117 if (t->scope->protocol != DNS_PROTOCOL_MDNS) {
1118 r = dns_packet_is_reply_for(p, t->key);
1119 if (r < 0)
1120 goto fail;
1121 if (r == 0) {
1122 dns_transaction_complete(t, DNS_TRANSACTION_INVALID_REPLY);
1123 return;
1124 }
1125 }
1126
1127 /* Install the answer as answer to the transaction */
1128 dns_answer_unref(t->answer);
1129 t->answer = dns_answer_ref(p->answer);
1130 t->answer_rcode = DNS_PACKET_RCODE(p);
1131 t->answer_dnssec_result = _DNSSEC_RESULT_INVALID;
1132 t->answer_authenticated = false;
1133
1134 r = dns_transaction_fix_rcode(t);
1135 if (r < 0)
1136 goto fail;
1137
1138 /* Block GC while starting requests for additional DNSSEC RRs */
1139 t->block_gc++;
1140 r = dns_transaction_request_dnssec_keys(t);
1141 t->block_gc--;
1142
1143 /* Maybe the transaction is ready for GC'ing now? If so, free it and return. */
1144 if (!dns_transaction_gc(t))
1145 return;
1146
1147 /* Requesting additional keys might have resulted in
1148 * this transaction to fail, since the auxiliary
1149 * request failed for some reason. If so, we are not
1150 * in pending state anymore, and we should exit
1151 * quickly. */
1152 if (t->state != DNS_TRANSACTION_PENDING)
1153 return;
1154 if (r < 0)
1155 goto fail;
1156 if (r > 0) {
1157 /* There are DNSSEC transactions pending now. Update the state accordingly. */
1158 t->state = DNS_TRANSACTION_VALIDATING;
1159 dns_transaction_close_connection(t);
1160 dns_transaction_stop_timeout(t);
1161 return;
1162 }
1163 }
1164
1165 dns_transaction_process_dnssec(t);
1166 return;
1167
1168 fail:
1169 t->answer_errno = -r;
1170 dns_transaction_complete(t, DNS_TRANSACTION_ERRNO);
1171 }
1172
1173 static int on_dns_packet(sd_event_source *s, int fd, uint32_t revents, void *userdata) {
1174 _cleanup_(dns_packet_unrefp) DnsPacket *p = NULL;
1175 DnsTransaction *t = userdata;
1176 int r;
1177
1178 assert(t);
1179 assert(t->scope);
1180
1181 r = manager_recv(t->scope->manager, fd, DNS_PROTOCOL_DNS, &p);
1182 if (ERRNO_IS_DISCONNECT(-r)) {
1183 usec_t usec;
1184
1185 /* UDP connection failure get reported via ICMP and then are possible delivered to us on the next
1186 * recvmsg(). Treat this like a lost packet. */
1187
1188 log_debug_errno(r, "Connection failure for DNS UDP packet: %m");
1189 assert_se(sd_event_now(t->scope->manager->event, clock_boottime_or_monotonic(), &usec) >= 0);
1190 dns_server_packet_lost(t->server, IPPROTO_UDP, t->current_feature_level);
1191
1192 dns_transaction_retry(t, true);
1193 return 0;
1194 }
1195 if (r < 0) {
1196 dns_transaction_complete(t, DNS_TRANSACTION_ERRNO);
1197 t->answer_errno = -r;
1198 return 0;
1199 }
1200
1201 r = dns_packet_validate_reply(p);
1202 if (r < 0) {
1203 log_debug_errno(r, "Received invalid DNS packet as response, ignoring: %m");
1204 return 0;
1205 }
1206 if (r == 0) {
1207 log_debug("Received inappropriate DNS packet as response, ignoring.");
1208 return 0;
1209 }
1210
1211 if (DNS_PACKET_ID(p) != t->id) {
1212 log_debug("Received packet with incorrect transaction ID, ignoring.");
1213 return 0;
1214 }
1215
1216 dns_transaction_process_reply(t, p);
1217 return 0;
1218 }
1219
1220 static int dns_transaction_emit_udp(DnsTransaction *t) {
1221 int r;
1222
1223 assert(t);
1224
1225 if (t->scope->protocol == DNS_PROTOCOL_DNS) {
1226
1227 r = dns_transaction_pick_server(t);
1228 if (r < 0)
1229 return r;
1230
1231 if (t->current_feature_level < DNS_SERVER_FEATURE_LEVEL_UDP || DNS_SERVER_FEATURE_LEVEL_IS_TLS(t->current_feature_level))
1232 return -EAGAIN; /* Sorry, can't do UDP, try TCP! */
1233
1234 if (!dns_server_dnssec_supported(t->server) && dns_type_is_dnssec(t->key->type))
1235 return -EOPNOTSUPP;
1236
1237 if (r > 0 || t->dns_udp_fd < 0) { /* Server changed, or no connection yet. */
1238 int fd;
1239
1240 dns_transaction_close_connection(t);
1241
1242 fd = dns_scope_socket_udp(t->scope, t->server, 53);
1243 if (fd < 0)
1244 return fd;
1245
1246 r = sd_event_add_io(t->scope->manager->event, &t->dns_udp_event_source, fd, EPOLLIN, on_dns_packet, t);
1247 if (r < 0) {
1248 safe_close(fd);
1249 return r;
1250 }
1251
1252 (void) sd_event_source_set_description(t->dns_udp_event_source, "dns-transaction-udp");
1253 t->dns_udp_fd = fd;
1254 }
1255
1256 r = dns_server_adjust_opt(t->server, t->sent, t->current_feature_level);
1257 if (r < 0)
1258 return r;
1259 } else
1260 dns_transaction_close_connection(t);
1261
1262 r = dns_scope_emit_udp(t->scope, t->dns_udp_fd, t->sent);
1263 if (r < 0)
1264 return r;
1265
1266 dns_transaction_reset_answer(t);
1267
1268 return 0;
1269 }
1270
1271 static int on_transaction_timeout(sd_event_source *s, usec_t usec, void *userdata) {
1272 DnsTransaction *t = userdata;
1273
1274 assert(s);
1275 assert(t);
1276
1277 if (!t->initial_jitter_scheduled || t->initial_jitter_elapsed) {
1278 /* Timeout reached? Increase the timeout for the server used */
1279 switch (t->scope->protocol) {
1280
1281 case DNS_PROTOCOL_DNS:
1282 assert(t->server);
1283 dns_server_packet_lost(t->server, t->stream ? IPPROTO_TCP : IPPROTO_UDP, t->current_feature_level);
1284 break;
1285
1286 case DNS_PROTOCOL_LLMNR:
1287 case DNS_PROTOCOL_MDNS:
1288 dns_scope_packet_lost(t->scope, usec - t->start_usec);
1289 break;
1290
1291 default:
1292 assert_not_reached("Invalid DNS protocol.");
1293 }
1294
1295 if (t->initial_jitter_scheduled)
1296 t->initial_jitter_elapsed = true;
1297 }
1298
1299 log_debug("Timeout reached on transaction %" PRIu16 ".", t->id);
1300
1301 dns_transaction_retry(t, true);
1302 return 0;
1303 }
1304
1305 static usec_t transaction_get_resend_timeout(DnsTransaction *t) {
1306 assert(t);
1307 assert(t->scope);
1308
1309 switch (t->scope->protocol) {
1310
1311 case DNS_PROTOCOL_DNS:
1312
1313 /* When we do TCP, grant a much longer timeout, as in this case there's no need for us to quickly
1314 * resend, as the kernel does that anyway for us, and we really don't want to interrupt it in that
1315 * needlessly. */
1316 if (t->stream)
1317 return TRANSACTION_TCP_TIMEOUT_USEC;
1318
1319 return DNS_TIMEOUT_USEC;
1320
1321 case DNS_PROTOCOL_MDNS:
1322 assert(t->n_attempts > 0);
1323 if (t->probing)
1324 return MDNS_PROBING_INTERVAL_USEC;
1325 else
1326 return (1 << (t->n_attempts - 1)) * USEC_PER_SEC;
1327
1328 case DNS_PROTOCOL_LLMNR:
1329 return t->scope->resend_timeout;
1330
1331 default:
1332 assert_not_reached("Invalid DNS protocol.");
1333 }
1334 }
1335
1336 static int dns_transaction_prepare(DnsTransaction *t, usec_t ts) {
1337 int r;
1338
1339 assert(t);
1340
1341 dns_transaction_stop_timeout(t);
1342
1343 if (!dns_scope_network_good(t->scope)) {
1344 dns_transaction_complete(t, DNS_TRANSACTION_NETWORK_DOWN);
1345 return 0;
1346 }
1347
1348 if (t->n_attempts >= TRANSACTION_ATTEMPTS_MAX(t->scope->protocol)) {
1349 dns_transaction_complete(t, DNS_TRANSACTION_ATTEMPTS_MAX_REACHED);
1350 return 0;
1351 }
1352
1353 if (t->scope->protocol == DNS_PROTOCOL_LLMNR && t->tried_stream) {
1354 /* If we already tried via a stream, then we don't
1355 * retry on LLMNR. See RFC 4795, Section 2.7. */
1356 dns_transaction_complete(t, DNS_TRANSACTION_ATTEMPTS_MAX_REACHED);
1357 return 0;
1358 }
1359
1360 t->n_attempts++;
1361 t->start_usec = ts;
1362
1363 dns_transaction_reset_answer(t);
1364 dns_transaction_flush_dnssec_transactions(t);
1365
1366 /* Check the trust anchor. Do so only on classic DNS, since DNSSEC does not apply otherwise. */
1367 if (t->scope->protocol == DNS_PROTOCOL_DNS) {
1368 r = dns_trust_anchor_lookup_positive(&t->scope->manager->trust_anchor, t->key, &t->answer);
1369 if (r < 0)
1370 return r;
1371 if (r > 0) {
1372 t->answer_rcode = DNS_RCODE_SUCCESS;
1373 t->answer_source = DNS_TRANSACTION_TRUST_ANCHOR;
1374 t->answer_authenticated = true;
1375 dns_transaction_complete(t, DNS_TRANSACTION_SUCCESS);
1376 return 0;
1377 }
1378
1379 if (dns_name_is_root(dns_resource_key_name(t->key)) &&
1380 t->key->type == DNS_TYPE_DS) {
1381
1382 /* Hmm, this is a request for the root DS? A
1383 * DS RR doesn't exist in the root zone, and
1384 * if our trust anchor didn't know it either,
1385 * this means we cannot do any DNSSEC logic
1386 * anymore. */
1387
1388 if (t->scope->dnssec_mode == DNSSEC_ALLOW_DOWNGRADE) {
1389 /* We are in downgrade mode. In this
1390 * case, synthesize an unsigned empty
1391 * response, so that the any lookup
1392 * depending on this one can continue
1393 * assuming there was no DS, and hence
1394 * the root zone was unsigned. */
1395
1396 t->answer_rcode = DNS_RCODE_SUCCESS;
1397 t->answer_source = DNS_TRANSACTION_TRUST_ANCHOR;
1398 t->answer_authenticated = false;
1399 dns_transaction_complete(t, DNS_TRANSACTION_SUCCESS);
1400 } else
1401 /* If we are not in downgrade mode,
1402 * then fail the lookup, because we
1403 * cannot reasonably answer it. There
1404 * might be DS RRs, but we don't know
1405 * them, and the DNS server won't tell
1406 * them to us (and even if it would,
1407 * we couldn't validate and trust them. */
1408 dns_transaction_complete(t, DNS_TRANSACTION_NO_TRUST_ANCHOR);
1409
1410 return 0;
1411 }
1412 }
1413
1414 /* Check the zone, but only if this transaction is not used
1415 * for probing or verifying a zone item. */
1416 if (set_isempty(t->notify_zone_items)) {
1417
1418 r = dns_zone_lookup(&t->scope->zone, t->key, dns_scope_ifindex(t->scope), &t->answer, NULL, NULL);
1419 if (r < 0)
1420 return r;
1421 if (r > 0) {
1422 t->answer_rcode = DNS_RCODE_SUCCESS;
1423 t->answer_source = DNS_TRANSACTION_ZONE;
1424 t->answer_authenticated = true;
1425 dns_transaction_complete(t, DNS_TRANSACTION_SUCCESS);
1426 return 0;
1427 }
1428 }
1429
1430 /* Check the cache, but only if this transaction is not used
1431 * for probing or verifying a zone item. */
1432 if (set_isempty(t->notify_zone_items)) {
1433
1434 /* Before trying the cache, let's make sure we figured out a
1435 * server to use. Should this cause a change of server this
1436 * might flush the cache. */
1437 (void) dns_scope_get_dns_server(t->scope);
1438
1439 /* Let's then prune all outdated entries */
1440 dns_cache_prune(&t->scope->cache);
1441
1442 r = dns_cache_lookup(&t->scope->cache, t->key, t->clamp_ttl, &t->answer_rcode, &t->answer, &t->answer_authenticated);
1443 if (r < 0)
1444 return r;
1445 if (r > 0) {
1446 t->answer_source = DNS_TRANSACTION_CACHE;
1447 if (t->answer_rcode == DNS_RCODE_SUCCESS)
1448 dns_transaction_complete(t, DNS_TRANSACTION_SUCCESS);
1449 else
1450 dns_transaction_complete(t, DNS_TRANSACTION_RCODE_FAILURE);
1451 return 0;
1452 }
1453 }
1454
1455 return 1;
1456 }
1457
1458 static int dns_transaction_make_packet_mdns(DnsTransaction *t) {
1459
1460 _cleanup_(dns_packet_unrefp) DnsPacket *p = NULL;
1461 bool add_known_answers = false;
1462 DnsTransaction *other;
1463 Iterator i;
1464 DnsResourceKey *tkey;
1465 _cleanup_set_free_ Set *keys = NULL;
1466 unsigned qdcount;
1467 unsigned nscount = 0;
1468 usec_t ts;
1469 int r;
1470
1471 assert(t);
1472 assert(t->scope->protocol == DNS_PROTOCOL_MDNS);
1473
1474 /* Discard any previously prepared packet, so we can start over and coalesce again */
1475 t->sent = dns_packet_unref(t->sent);
1476
1477 r = dns_packet_new_query(&p, t->scope->protocol, 0, false);
1478 if (r < 0)
1479 return r;
1480
1481 r = dns_packet_append_key(p, t->key, 0, NULL);
1482 if (r < 0)
1483 return r;
1484
1485 qdcount = 1;
1486
1487 if (dns_key_is_shared(t->key))
1488 add_known_answers = true;
1489
1490 if (t->key->type == DNS_TYPE_ANY) {
1491 r = set_ensure_allocated(&keys, &dns_resource_key_hash_ops);
1492 if (r < 0)
1493 return r;
1494
1495 r = set_put(keys, t->key);
1496 if (r < 0)
1497 return r;
1498 }
1499
1500 /*
1501 * For mDNS, we want to coalesce as many open queries in pending transactions into one single
1502 * query packet on the wire as possible. To achieve that, we iterate through all pending transactions
1503 * in our current scope, and see whether their timing contraints allow them to be sent.
1504 */
1505
1506 assert_se(sd_event_now(t->scope->manager->event, clock_boottime_or_monotonic(), &ts) >= 0);
1507
1508 LIST_FOREACH(transactions_by_scope, other, t->scope->transactions) {
1509
1510 /* Skip ourselves */
1511 if (other == t)
1512 continue;
1513
1514 if (other->state != DNS_TRANSACTION_PENDING)
1515 continue;
1516
1517 if (other->next_attempt_after > ts)
1518 continue;
1519
1520 if (qdcount >= UINT16_MAX)
1521 break;
1522
1523 r = dns_packet_append_key(p, other->key, 0, NULL);
1524
1525 /*
1526 * If we can't stuff more questions into the packet, just give up.
1527 * One of the 'other' transactions will fire later and take care of the rest.
1528 */
1529 if (r == -EMSGSIZE)
1530 break;
1531
1532 if (r < 0)
1533 return r;
1534
1535 r = dns_transaction_prepare(other, ts);
1536 if (r <= 0)
1537 continue;
1538
1539 ts += transaction_get_resend_timeout(other);
1540
1541 r = sd_event_add_time(
1542 other->scope->manager->event,
1543 &other->timeout_event_source,
1544 clock_boottime_or_monotonic(),
1545 ts, 0,
1546 on_transaction_timeout, other);
1547 if (r < 0)
1548 return r;
1549
1550 (void) sd_event_source_set_description(other->timeout_event_source, "dns-transaction-timeout");
1551
1552 other->state = DNS_TRANSACTION_PENDING;
1553 other->next_attempt_after = ts;
1554
1555 qdcount++;
1556
1557 if (dns_key_is_shared(other->key))
1558 add_known_answers = true;
1559
1560 if (other->key->type == DNS_TYPE_ANY) {
1561 r = set_ensure_allocated(&keys, &dns_resource_key_hash_ops);
1562 if (r < 0)
1563 return r;
1564
1565 r = set_put(keys, other->key);
1566 if (r < 0)
1567 return r;
1568 }
1569 }
1570
1571 DNS_PACKET_HEADER(p)->qdcount = htobe16(qdcount);
1572
1573 /* Append known answer section if we're asking for any shared record */
1574 if (add_known_answers) {
1575 r = dns_cache_export_shared_to_packet(&t->scope->cache, p);
1576 if (r < 0)
1577 return r;
1578 }
1579
1580 SET_FOREACH(tkey, keys, i) {
1581 _cleanup_(dns_answer_unrefp) DnsAnswer *answer = NULL;
1582 bool tentative;
1583
1584 r = dns_zone_lookup(&t->scope->zone, tkey, t->scope->link->ifindex, &answer, NULL, &tentative);
1585 if (r < 0)
1586 return r;
1587
1588 r = dns_packet_append_answer(p, answer);
1589 if (r < 0)
1590 return r;
1591
1592 nscount += dns_answer_size(answer);
1593 }
1594 DNS_PACKET_HEADER(p)->nscount = htobe16(nscount);
1595
1596 t->sent = TAKE_PTR(p);
1597
1598 return 0;
1599 }
1600
1601 static int dns_transaction_make_packet(DnsTransaction *t) {
1602 _cleanup_(dns_packet_unrefp) DnsPacket *p = NULL;
1603 int r;
1604
1605 assert(t);
1606
1607 if (t->scope->protocol == DNS_PROTOCOL_MDNS)
1608 return dns_transaction_make_packet_mdns(t);
1609
1610 if (t->sent)
1611 return 0;
1612
1613 r = dns_packet_new_query(&p, t->scope->protocol, 0, t->scope->dnssec_mode != DNSSEC_NO);
1614 if (r < 0)
1615 return r;
1616
1617 r = dns_packet_append_key(p, t->key, 0, NULL);
1618 if (r < 0)
1619 return r;
1620
1621 DNS_PACKET_HEADER(p)->qdcount = htobe16(1);
1622 DNS_PACKET_HEADER(p)->id = t->id;
1623
1624 t->sent = TAKE_PTR(p);
1625
1626 return 0;
1627 }
1628
1629 int dns_transaction_go(DnsTransaction *t) {
1630 usec_t ts;
1631 int r;
1632 char key_str[DNS_RESOURCE_KEY_STRING_MAX];
1633
1634 assert(t);
1635
1636 /* Returns > 0 if the transaction is now pending, returns 0 if could be processed immediately and has finished
1637 * now. */
1638
1639 assert_se(sd_event_now(t->scope->manager->event, clock_boottime_or_monotonic(), &ts) >= 0);
1640
1641 r = dns_transaction_prepare(t, ts);
1642 if (r <= 0)
1643 return r;
1644
1645 log_debug("Transaction %" PRIu16 " for <%s> scope %s on %s/%s.",
1646 t->id,
1647 dns_resource_key_to_string(t->key, key_str, sizeof key_str),
1648 dns_protocol_to_string(t->scope->protocol),
1649 t->scope->link ? t->scope->link->name : "*",
1650 af_to_name_short(t->scope->family));
1651
1652 if (!t->initial_jitter_scheduled &&
1653 IN_SET(t->scope->protocol, DNS_PROTOCOL_LLMNR, DNS_PROTOCOL_MDNS)) {
1654 usec_t jitter, accuracy;
1655
1656 /* RFC 4795 Section 2.7 suggests all queries should be
1657 * delayed by a random time from 0 to JITTER_INTERVAL. */
1658
1659 t->initial_jitter_scheduled = true;
1660
1661 random_bytes(&jitter, sizeof(jitter));
1662
1663 switch (t->scope->protocol) {
1664
1665 case DNS_PROTOCOL_LLMNR:
1666 jitter %= LLMNR_JITTER_INTERVAL_USEC;
1667 accuracy = LLMNR_JITTER_INTERVAL_USEC;
1668 break;
1669
1670 case DNS_PROTOCOL_MDNS:
1671 jitter %= MDNS_JITTER_RANGE_USEC;
1672 jitter += MDNS_JITTER_MIN_USEC;
1673 accuracy = MDNS_JITTER_RANGE_USEC;
1674 break;
1675 default:
1676 assert_not_reached("bad protocol");
1677 }
1678
1679 r = sd_event_add_time(
1680 t->scope->manager->event,
1681 &t->timeout_event_source,
1682 clock_boottime_or_monotonic(),
1683 ts + jitter, accuracy,
1684 on_transaction_timeout, t);
1685 if (r < 0)
1686 return r;
1687
1688 (void) sd_event_source_set_description(t->timeout_event_source, "dns-transaction-timeout");
1689
1690 t->n_attempts = 0;
1691 t->next_attempt_after = ts;
1692 t->state = DNS_TRANSACTION_PENDING;
1693
1694 log_debug("Delaying %s transaction for " USEC_FMT "us.", dns_protocol_to_string(t->scope->protocol), jitter);
1695 return 0;
1696 }
1697
1698 /* Otherwise, we need to ask the network */
1699 r = dns_transaction_make_packet(t);
1700 if (r < 0)
1701 return r;
1702
1703 if (t->scope->protocol == DNS_PROTOCOL_LLMNR &&
1704 (dns_name_endswith(dns_resource_key_name(t->key), "in-addr.arpa") > 0 ||
1705 dns_name_endswith(dns_resource_key_name(t->key), "ip6.arpa") > 0)) {
1706
1707 /* RFC 4795, Section 2.4. says reverse lookups shall
1708 * always be made via TCP on LLMNR */
1709 r = dns_transaction_emit_tcp(t);
1710 } else {
1711 /* Try via UDP, and if that fails due to large size or lack of
1712 * support try via TCP */
1713 r = dns_transaction_emit_udp(t);
1714 if (r == -EMSGSIZE)
1715 log_debug("Sending query via TCP since it is too large.");
1716 else if (r == -EAGAIN)
1717 log_debug("Sending query via TCP since UDP isn't supported.");
1718 if (IN_SET(r, -EMSGSIZE, -EAGAIN))
1719 r = dns_transaction_emit_tcp(t);
1720 }
1721
1722 if (r == -ESRCH) {
1723 /* No servers to send this to? */
1724 dns_transaction_complete(t, DNS_TRANSACTION_NO_SERVERS);
1725 return 0;
1726 }
1727 if (r == -EOPNOTSUPP) {
1728 /* Tried to ask for DNSSEC RRs, on a server that doesn't do DNSSEC */
1729 dns_transaction_complete(t, DNS_TRANSACTION_RR_TYPE_UNSUPPORTED);
1730 return 0;
1731 }
1732 if (t->scope->protocol == DNS_PROTOCOL_LLMNR && ERRNO_IS_DISCONNECT(-r)) {
1733 /* On LLMNR, if we cannot connect to a host via TCP when doing reverse lookups. This means we cannot
1734 * answer this request with this protocol. */
1735 dns_transaction_complete(t, DNS_TRANSACTION_NOT_FOUND);
1736 return 0;
1737 }
1738 if (r < 0) {
1739 if (t->scope->protocol != DNS_PROTOCOL_DNS)
1740 return r;
1741
1742 /* Couldn't send? Try immediately again, with a new server */
1743 dns_scope_next_dns_server(t->scope);
1744
1745 return dns_transaction_go(t);
1746 }
1747
1748 ts += transaction_get_resend_timeout(t);
1749
1750 r = sd_event_add_time(
1751 t->scope->manager->event,
1752 &t->timeout_event_source,
1753 clock_boottime_or_monotonic(),
1754 ts, 0,
1755 on_transaction_timeout, t);
1756 if (r < 0)
1757 return r;
1758
1759 (void) sd_event_source_set_description(t->timeout_event_source, "dns-transaction-timeout");
1760
1761 t->state = DNS_TRANSACTION_PENDING;
1762 t->next_attempt_after = ts;
1763
1764 return 1;
1765 }
1766
1767 static int dns_transaction_find_cyclic(DnsTransaction *t, DnsTransaction *aux) {
1768 DnsTransaction *n;
1769 Iterator i;
1770 int r;
1771
1772 assert(t);
1773 assert(aux);
1774
1775 /* Try to find cyclic dependencies between transaction objects */
1776
1777 if (t == aux)
1778 return 1;
1779
1780 SET_FOREACH(n, aux->dnssec_transactions, i) {
1781 r = dns_transaction_find_cyclic(t, n);
1782 if (r != 0)
1783 return r;
1784 }
1785
1786 return 0;
1787 }
1788
1789 static int dns_transaction_add_dnssec_transaction(DnsTransaction *t, DnsResourceKey *key, DnsTransaction **ret) {
1790 DnsTransaction *aux;
1791 int r;
1792
1793 assert(t);
1794 assert(ret);
1795 assert(key);
1796
1797 aux = dns_scope_find_transaction(t->scope, key, true);
1798 if (!aux) {
1799 r = dns_transaction_new(&aux, t->scope, key);
1800 if (r < 0)
1801 return r;
1802 } else {
1803 if (set_contains(t->dnssec_transactions, aux)) {
1804 *ret = aux;
1805 return 0;
1806 }
1807
1808 r = dns_transaction_find_cyclic(t, aux);
1809 if (r < 0)
1810 return r;
1811 if (r > 0) {
1812 char s[DNS_RESOURCE_KEY_STRING_MAX], saux[DNS_RESOURCE_KEY_STRING_MAX];
1813
1814 return log_debug_errno(SYNTHETIC_ERRNO(ELOOP),
1815 "Potential cyclic dependency, refusing to add transaction %" PRIu16 " (%s) as dependency for %" PRIu16 " (%s).",
1816 aux->id,
1817 dns_resource_key_to_string(t->key, s, sizeof s),
1818 t->id,
1819 dns_resource_key_to_string(aux->key, saux, sizeof saux));
1820 }
1821 }
1822
1823 r = set_ensure_allocated(&t->dnssec_transactions, NULL);
1824 if (r < 0)
1825 goto gc;
1826
1827 r = set_ensure_allocated(&aux->notify_transactions, NULL);
1828 if (r < 0)
1829 goto gc;
1830
1831 r = set_ensure_allocated(&aux->notify_transactions_done, NULL);
1832 if (r < 0)
1833 goto gc;
1834
1835 r = set_put(t->dnssec_transactions, aux);
1836 if (r < 0)
1837 goto gc;
1838
1839 r = set_put(aux->notify_transactions, t);
1840 if (r < 0) {
1841 (void) set_remove(t->dnssec_transactions, aux);
1842 goto gc;
1843 }
1844
1845 *ret = aux;
1846 return 1;
1847
1848 gc:
1849 dns_transaction_gc(aux);
1850 return r;
1851 }
1852
1853 static int dns_transaction_request_dnssec_rr(DnsTransaction *t, DnsResourceKey *key) {
1854 _cleanup_(dns_answer_unrefp) DnsAnswer *a = NULL;
1855 DnsTransaction *aux;
1856 int r;
1857
1858 assert(t);
1859 assert(key);
1860
1861 /* Try to get the data from the trust anchor */
1862 r = dns_trust_anchor_lookup_positive(&t->scope->manager->trust_anchor, key, &a);
1863 if (r < 0)
1864 return r;
1865 if (r > 0) {
1866 r = dns_answer_extend(&t->validated_keys, a);
1867 if (r < 0)
1868 return r;
1869
1870 return 0;
1871 }
1872
1873 /* This didn't work, ask for it via the network/cache then. */
1874 r = dns_transaction_add_dnssec_transaction(t, key, &aux);
1875 if (r == -ELOOP) /* This would result in a cyclic dependency */
1876 return 0;
1877 if (r < 0)
1878 return r;
1879
1880 if (aux->state == DNS_TRANSACTION_NULL) {
1881 r = dns_transaction_go(aux);
1882 if (r < 0)
1883 return r;
1884 }
1885
1886 return 1;
1887 }
1888
1889 static int dns_transaction_negative_trust_anchor_lookup(DnsTransaction *t, const char *name) {
1890 int r;
1891
1892 assert(t);
1893
1894 /* Check whether the specified name is in the NTA
1895 * database, either in the global one, or the link-local
1896 * one. */
1897
1898 r = dns_trust_anchor_lookup_negative(&t->scope->manager->trust_anchor, name);
1899 if (r != 0)
1900 return r;
1901
1902 if (!t->scope->link)
1903 return 0;
1904
1905 return set_contains(t->scope->link->dnssec_negative_trust_anchors, name);
1906 }
1907
1908 static int dns_transaction_has_unsigned_negative_answer(DnsTransaction *t) {
1909 int r;
1910
1911 assert(t);
1912
1913 /* Checks whether the answer is negative, and lacks NSEC/NSEC3
1914 * RRs to prove it */
1915
1916 r = dns_transaction_has_positive_answer(t, NULL);
1917 if (r < 0)
1918 return r;
1919 if (r > 0)
1920 return false;
1921
1922 /* Is this key explicitly listed as a negative trust anchor?
1923 * If so, it's nothing we need to care about */
1924 r = dns_transaction_negative_trust_anchor_lookup(t, dns_resource_key_name(t->key));
1925 if (r < 0)
1926 return r;
1927 if (r > 0)
1928 return false;
1929
1930 /* The answer does not contain any RRs that match to the
1931 * question. If so, let's see if there are any NSEC/NSEC3 RRs
1932 * included. If not, the answer is unsigned. */
1933
1934 r = dns_answer_contains_nsec_or_nsec3(t->answer);
1935 if (r < 0)
1936 return r;
1937 if (r > 0)
1938 return false;
1939
1940 return true;
1941 }
1942
1943 static int dns_transaction_is_primary_response(DnsTransaction *t, DnsResourceRecord *rr) {
1944 int r;
1945
1946 assert(t);
1947 assert(rr);
1948
1949 /* Check if the specified RR is the "primary" response,
1950 * i.e. either matches the question precisely or is a
1951 * CNAME/DNAME for it. */
1952
1953 r = dns_resource_key_match_rr(t->key, rr, NULL);
1954 if (r != 0)
1955 return r;
1956
1957 return dns_resource_key_match_cname_or_dname(t->key, rr->key, NULL);
1958 }
1959
1960 static bool dns_transaction_dnssec_supported(DnsTransaction *t) {
1961 assert(t);
1962
1963 /* Checks whether our transaction's DNS server is assumed to be compatible with DNSSEC. Returns false as soon
1964 * as we changed our mind about a server, and now believe it is incompatible with DNSSEC. */
1965
1966 if (t->scope->protocol != DNS_PROTOCOL_DNS)
1967 return false;
1968
1969 /* If we have picked no server, then we are working from the cache or some other source, and DNSSEC might well
1970 * be supported, hence return true. */
1971 if (!t->server)
1972 return true;
1973
1974 /* Note that we do not check the feature level actually used for the transaction but instead the feature level
1975 * the server is known to support currently, as the transaction feature level might be lower than what the
1976 * server actually supports, since we might have downgraded this transaction's feature level because we got a
1977 * SERVFAIL earlier and wanted to check whether downgrading fixes it. */
1978
1979 return dns_server_dnssec_supported(t->server);
1980 }
1981
1982 static bool dns_transaction_dnssec_supported_full(DnsTransaction *t) {
1983 DnsTransaction *dt;
1984 Iterator i;
1985
1986 assert(t);
1987
1988 /* Checks whether our transaction our any of the auxiliary transactions couldn't do DNSSEC. */
1989
1990 if (!dns_transaction_dnssec_supported(t))
1991 return false;
1992
1993 SET_FOREACH(dt, t->dnssec_transactions, i)
1994 if (!dns_transaction_dnssec_supported(dt))
1995 return false;
1996
1997 return true;
1998 }
1999
2000 int dns_transaction_request_dnssec_keys(DnsTransaction *t) {
2001 DnsResourceRecord *rr;
2002
2003 int r;
2004
2005 assert(t);
2006
2007 /*
2008 * Retrieve all auxiliary RRs for the answer we got, so that
2009 * we can verify signatures or prove that RRs are rightfully
2010 * unsigned. Specifically:
2011 *
2012 * - For RRSIG we get the matching DNSKEY
2013 * - For DNSKEY we get the matching DS
2014 * - For unsigned SOA/NS we get the matching DS
2015 * - For unsigned CNAME/DNAME/DS we get the parent SOA RR
2016 * - For other unsigned RRs we get the matching SOA RR
2017 * - For SOA/NS queries with no matching response RR, and no NSEC/NSEC3, the DS RR
2018 * - For DS queries with no matching response RRs, and no NSEC/NSEC3, the parent's SOA RR
2019 * - For other queries with no matching response RRs, and no NSEC/NSEC3, the SOA RR
2020 */
2021
2022 if (t->scope->dnssec_mode == DNSSEC_NO)
2023 return 0;
2024 if (t->answer_source != DNS_TRANSACTION_NETWORK)
2025 return 0; /* We only need to validate stuff from the network */
2026 if (!dns_transaction_dnssec_supported(t))
2027 return 0; /* If we can't do DNSSEC anyway there's no point in geting the auxiliary RRs */
2028
2029 DNS_ANSWER_FOREACH(rr, t->answer) {
2030
2031 if (dns_type_is_pseudo(rr->key->type))
2032 continue;
2033
2034 /* If this RR is in the negative trust anchor, we don't need to validate it. */
2035 r = dns_transaction_negative_trust_anchor_lookup(t, dns_resource_key_name(rr->key));
2036 if (r < 0)
2037 return r;
2038 if (r > 0)
2039 continue;
2040
2041 switch (rr->key->type) {
2042
2043 case DNS_TYPE_RRSIG: {
2044 /* For each RRSIG we request the matching DNSKEY */
2045 _cleanup_(dns_resource_key_unrefp) DnsResourceKey *dnskey = NULL;
2046
2047 /* If this RRSIG is about a DNSKEY RR and the
2048 * signer is the same as the owner, then we
2049 * already have the DNSKEY, and we don't have
2050 * to look for more. */
2051 if (rr->rrsig.type_covered == DNS_TYPE_DNSKEY) {
2052 r = dns_name_equal(rr->rrsig.signer, dns_resource_key_name(rr->key));
2053 if (r < 0)
2054 return r;
2055 if (r > 0)
2056 continue;
2057 }
2058
2059 /* If the signer is not a parent of our
2060 * original query, then this is about an
2061 * auxiliary RRset, but not anything we asked
2062 * for. In this case we aren't interested,
2063 * because we don't want to request additional
2064 * RRs for stuff we didn't really ask for, and
2065 * also to avoid request loops, where
2066 * additional RRs from one transaction result
2067 * in another transaction whose additonal RRs
2068 * point back to the original transaction, and
2069 * we deadlock. */
2070 r = dns_name_endswith(dns_resource_key_name(t->key), rr->rrsig.signer);
2071 if (r < 0)
2072 return r;
2073 if (r == 0)
2074 continue;
2075
2076 dnskey = dns_resource_key_new(rr->key->class, DNS_TYPE_DNSKEY, rr->rrsig.signer);
2077 if (!dnskey)
2078 return -ENOMEM;
2079
2080 log_debug("Requesting DNSKEY to validate transaction %" PRIu16" (%s, RRSIG with key tag: %" PRIu16 ").",
2081 t->id, dns_resource_key_name(rr->key), rr->rrsig.key_tag);
2082 r = dns_transaction_request_dnssec_rr(t, dnskey);
2083 if (r < 0)
2084 return r;
2085 break;
2086 }
2087
2088 case DNS_TYPE_DNSKEY: {
2089 /* For each DNSKEY we request the matching DS */
2090 _cleanup_(dns_resource_key_unrefp) DnsResourceKey *ds = NULL;
2091
2092 /* If the DNSKEY we are looking at is not for
2093 * zone we are interested in, nor any of its
2094 * parents, we aren't interested, and don't
2095 * request it. After all, we don't want to end
2096 * up in request loops, and want to keep
2097 * additional traffic down. */
2098
2099 r = dns_name_endswith(dns_resource_key_name(t->key), dns_resource_key_name(rr->key));
2100 if (r < 0)
2101 return r;
2102 if (r == 0)
2103 continue;
2104
2105 ds = dns_resource_key_new(rr->key->class, DNS_TYPE_DS, dns_resource_key_name(rr->key));
2106 if (!ds)
2107 return -ENOMEM;
2108
2109 log_debug("Requesting DS to validate transaction %" PRIu16" (%s, DNSKEY with key tag: %" PRIu16 ").",
2110 t->id, dns_resource_key_name(rr->key), dnssec_keytag(rr, false));
2111 r = dns_transaction_request_dnssec_rr(t, ds);
2112 if (r < 0)
2113 return r;
2114
2115 break;
2116 }
2117
2118 case DNS_TYPE_SOA:
2119 case DNS_TYPE_NS: {
2120 _cleanup_(dns_resource_key_unrefp) DnsResourceKey *ds = NULL;
2121
2122 /* For an unsigned SOA or NS, try to acquire
2123 * the matching DS RR, as we are at a zone cut
2124 * then, and whether a DS exists tells us
2125 * whether the zone is signed. Do so only if
2126 * this RR matches our original question,
2127 * however. */
2128
2129 r = dns_resource_key_match_rr(t->key, rr, NULL);
2130 if (r < 0)
2131 return r;
2132 if (r == 0) {
2133 /* Hmm, so this SOA RR doesn't match our original question. In this case, maybe this is
2134 * a negative reply, and we need the a SOA RR's TTL in order to cache a negative entry?
2135 * If so, we need to validate it, too. */
2136
2137 r = dns_answer_match_key(t->answer, t->key, NULL);
2138 if (r < 0)
2139 return r;
2140 if (r > 0) /* positive reply, we won't need the SOA and hence don't need to validate
2141 * it. */
2142 continue;
2143 }
2144
2145 r = dnssec_has_rrsig(t->answer, rr->key);
2146 if (r < 0)
2147 return r;
2148 if (r > 0)
2149 continue;
2150
2151 ds = dns_resource_key_new(rr->key->class, DNS_TYPE_DS, dns_resource_key_name(rr->key));
2152 if (!ds)
2153 return -ENOMEM;
2154
2155 log_debug("Requesting DS to validate transaction %" PRIu16 " (%s, unsigned SOA/NS RRset).",
2156 t->id, dns_resource_key_name(rr->key));
2157 r = dns_transaction_request_dnssec_rr(t, ds);
2158 if (r < 0)
2159 return r;
2160
2161 break;
2162 }
2163
2164 case DNS_TYPE_DS:
2165 case DNS_TYPE_CNAME:
2166 case DNS_TYPE_DNAME: {
2167 _cleanup_(dns_resource_key_unrefp) DnsResourceKey *soa = NULL;
2168 const char *name;
2169
2170 /* CNAMEs and DNAMEs cannot be located at a
2171 * zone apex, hence ask for the parent SOA for
2172 * unsigned CNAME/DNAME RRs, maybe that's the
2173 * apex. But do all that only if this is
2174 * actually a response to our original
2175 * question.
2176 *
2177 * Similar for DS RRs, which are signed when
2178 * the parent SOA is signed. */
2179
2180 r = dns_transaction_is_primary_response(t, rr);
2181 if (r < 0)
2182 return r;
2183 if (r == 0)
2184 continue;
2185
2186 r = dnssec_has_rrsig(t->answer, rr->key);
2187 if (r < 0)
2188 return r;
2189 if (r > 0)
2190 continue;
2191
2192 r = dns_answer_has_dname_for_cname(t->answer, rr);
2193 if (r < 0)
2194 return r;
2195 if (r > 0)
2196 continue;
2197
2198 name = dns_resource_key_name(rr->key);
2199 r = dns_name_parent(&name);
2200 if (r < 0)
2201 return r;
2202 if (r == 0)
2203 continue;
2204
2205 soa = dns_resource_key_new(rr->key->class, DNS_TYPE_SOA, name);
2206 if (!soa)
2207 return -ENOMEM;
2208
2209 log_debug("Requesting parent SOA to validate transaction %" PRIu16 " (%s, unsigned CNAME/DNAME/DS RRset).",
2210 t->id, dns_resource_key_name(rr->key));
2211 r = dns_transaction_request_dnssec_rr(t, soa);
2212 if (r < 0)
2213 return r;
2214
2215 break;
2216 }
2217
2218 default: {
2219 _cleanup_(dns_resource_key_unrefp) DnsResourceKey *soa = NULL;
2220
2221 /* For other unsigned RRsets (including
2222 * NSEC/NSEC3!), look for proof the zone is
2223 * unsigned, by requesting the SOA RR of the
2224 * zone. However, do so only if they are
2225 * directly relevant to our original
2226 * question. */
2227
2228 r = dns_transaction_is_primary_response(t, rr);
2229 if (r < 0)
2230 return r;
2231 if (r == 0)
2232 continue;
2233
2234 r = dnssec_has_rrsig(t->answer, rr->key);
2235 if (r < 0)
2236 return r;
2237 if (r > 0)
2238 continue;
2239
2240 soa = dns_resource_key_new(rr->key->class, DNS_TYPE_SOA, dns_resource_key_name(rr->key));
2241 if (!soa)
2242 return -ENOMEM;
2243
2244 log_debug("Requesting SOA to validate transaction %" PRIu16 " (%s, unsigned non-SOA/NS RRset <%s>).",
2245 t->id, dns_resource_key_name(rr->key), dns_resource_record_to_string(rr));
2246 r = dns_transaction_request_dnssec_rr(t, soa);
2247 if (r < 0)
2248 return r;
2249 break;
2250 }}
2251 }
2252
2253 /* Above, we requested everything necessary to validate what
2254 * we got. Now, let's request what we need to validate what we
2255 * didn't get... */
2256
2257 r = dns_transaction_has_unsigned_negative_answer(t);
2258 if (r < 0)
2259 return r;
2260 if (r > 0) {
2261 const char *name;
2262 uint16_t type = 0;
2263
2264 name = dns_resource_key_name(t->key);
2265
2266 /* If this was a SOA or NS request, then check if there's a DS RR for the same domain. Note that this
2267 * could also be used as indication that we are not at a zone apex, but in real world setups there are
2268 * too many broken DNS servers (Hello, incapdns.net!) where non-terminal zones return NXDOMAIN even
2269 * though they have further children. If this was a DS request, then it's signed when the parent zone
2270 * is signed, hence ask the parent SOA in that case. If this was any other RR then ask for the SOA RR,
2271 * to see if that is signed. */
2272
2273 if (t->key->type == DNS_TYPE_DS) {
2274 r = dns_name_parent(&name);
2275 if (r > 0) {
2276 type = DNS_TYPE_SOA;
2277 log_debug("Requesting parent SOA to validate transaction %" PRIu16 " (%s, unsigned empty DS response).",
2278 t->id, dns_resource_key_name(t->key));
2279 } else
2280 name = NULL;
2281
2282 } else if (IN_SET(t->key->type, DNS_TYPE_SOA, DNS_TYPE_NS)) {
2283
2284 type = DNS_TYPE_DS;
2285 log_debug("Requesting DS to validate transaction %" PRIu16 " (%s, unsigned empty SOA/NS response).",
2286 t->id, dns_resource_key_name(t->key));
2287
2288 } else {
2289 type = DNS_TYPE_SOA;
2290 log_debug("Requesting SOA to validate transaction %" PRIu16 " (%s, unsigned empty non-SOA/NS/DS response).",
2291 t->id, dns_resource_key_name(t->key));
2292 }
2293
2294 if (name) {
2295 _cleanup_(dns_resource_key_unrefp) DnsResourceKey *soa = NULL;
2296
2297 soa = dns_resource_key_new(t->key->class, type, name);
2298 if (!soa)
2299 return -ENOMEM;
2300
2301 r = dns_transaction_request_dnssec_rr(t, soa);
2302 if (r < 0)
2303 return r;
2304 }
2305 }
2306
2307 return dns_transaction_dnssec_is_live(t);
2308 }
2309
2310 void dns_transaction_notify(DnsTransaction *t, DnsTransaction *source) {
2311 assert(t);
2312 assert(source);
2313
2314 /* Invoked whenever any of our auxiliary DNSSEC transactions completed its work. If the state is still PENDING,
2315 we are still in the loop that adds further DNSSEC transactions, hence don't check if we are ready yet. If
2316 the state is VALIDATING however, we should check if we are complete now. */
2317
2318 if (t->state == DNS_TRANSACTION_VALIDATING)
2319 dns_transaction_process_dnssec(t);
2320 }
2321
2322 static int dns_transaction_validate_dnskey_by_ds(DnsTransaction *t) {
2323 DnsResourceRecord *rr;
2324 int ifindex, r;
2325
2326 assert(t);
2327
2328 /* Add all DNSKEY RRs from the answer that are validated by DS
2329 * RRs from the list of validated keys to the list of
2330 * validated keys. */
2331
2332 DNS_ANSWER_FOREACH_IFINDEX(rr, ifindex, t->answer) {
2333
2334 r = dnssec_verify_dnskey_by_ds_search(rr, t->validated_keys);
2335 if (r < 0)
2336 return r;
2337 if (r == 0)
2338 continue;
2339
2340 /* If so, the DNSKEY is validated too. */
2341 r = dns_answer_add_extend(&t->validated_keys, rr, ifindex, DNS_ANSWER_AUTHENTICATED);
2342 if (r < 0)
2343 return r;
2344 }
2345
2346 return 0;
2347 }
2348
2349 static int dns_transaction_requires_rrsig(DnsTransaction *t, DnsResourceRecord *rr) {
2350 int r;
2351
2352 assert(t);
2353 assert(rr);
2354
2355 /* Checks if the RR we are looking for must be signed with an
2356 * RRSIG. This is used for positive responses. */
2357
2358 if (t->scope->dnssec_mode == DNSSEC_NO)
2359 return false;
2360
2361 if (dns_type_is_pseudo(rr->key->type))
2362 return -EINVAL;
2363
2364 r = dns_transaction_negative_trust_anchor_lookup(t, dns_resource_key_name(rr->key));
2365 if (r < 0)
2366 return r;
2367 if (r > 0)
2368 return false;
2369
2370 switch (rr->key->type) {
2371
2372 case DNS_TYPE_RRSIG:
2373 /* RRSIGs are the signatures themselves, they need no signing. */
2374 return false;
2375
2376 case DNS_TYPE_SOA:
2377 case DNS_TYPE_NS: {
2378 DnsTransaction *dt;
2379 Iterator i;
2380
2381 /* For SOA or NS RRs we look for a matching DS transaction */
2382
2383 SET_FOREACH(dt, t->dnssec_transactions, i) {
2384
2385 if (dt->key->class != rr->key->class)
2386 continue;
2387 if (dt->key->type != DNS_TYPE_DS)
2388 continue;
2389
2390 r = dns_name_equal(dns_resource_key_name(dt->key), dns_resource_key_name(rr->key));
2391 if (r < 0)
2392 return r;
2393 if (r == 0)
2394 continue;
2395
2396 /* We found a DS transactions for the SOA/NS
2397 * RRs we are looking at. If it discovered signed DS
2398 * RRs, then we need to be signed, too. */
2399
2400 if (!dt->answer_authenticated)
2401 return false;
2402
2403 return dns_answer_match_key(dt->answer, dt->key, NULL);
2404 }
2405
2406 /* We found nothing that proves this is safe to leave
2407 * this unauthenticated, hence ask inist on
2408 * authentication. */
2409 return true;
2410 }
2411
2412 case DNS_TYPE_DS:
2413 case DNS_TYPE_CNAME:
2414 case DNS_TYPE_DNAME: {
2415 const char *parent = NULL;
2416 DnsTransaction *dt;
2417 Iterator i;
2418
2419 /*
2420 * CNAME/DNAME RRs cannot be located at a zone apex, hence look directly for the parent SOA.
2421 *
2422 * DS RRs are signed if the parent is signed, hence also look at the parent SOA
2423 */
2424
2425 SET_FOREACH(dt, t->dnssec_transactions, i) {
2426
2427 if (dt->key->class != rr->key->class)
2428 continue;
2429 if (dt->key->type != DNS_TYPE_SOA)
2430 continue;
2431
2432 if (!parent) {
2433 parent = dns_resource_key_name(rr->key);
2434 r = dns_name_parent(&parent);
2435 if (r < 0)
2436 return r;
2437 if (r == 0) {
2438 if (rr->key->type == DNS_TYPE_DS)
2439 return true;
2440
2441 /* A CNAME/DNAME without a parent? That's sooo weird. */
2442 return log_debug_errno(SYNTHETIC_ERRNO(EBADMSG),
2443 "Transaction %" PRIu16 " claims CNAME/DNAME at root. Refusing.", t->id);
2444 }
2445 }
2446
2447 r = dns_name_equal(dns_resource_key_name(dt->key), parent);
2448 if (r < 0)
2449 return r;
2450 if (r == 0)
2451 continue;
2452
2453 return t->answer_authenticated;
2454 }
2455
2456 return true;
2457 }
2458
2459 default: {
2460 DnsTransaction *dt;
2461 Iterator i;
2462
2463 /* Any other kind of RR (including DNSKEY/NSEC/NSEC3). Let's see if our SOA lookup was authenticated */
2464
2465 SET_FOREACH(dt, t->dnssec_transactions, i) {
2466
2467 if (dt->key->class != rr->key->class)
2468 continue;
2469 if (dt->key->type != DNS_TYPE_SOA)
2470 continue;
2471
2472 r = dns_name_equal(dns_resource_key_name(dt->key), dns_resource_key_name(rr->key));
2473 if (r < 0)
2474 return r;
2475 if (r == 0)
2476 continue;
2477
2478 /* We found the transaction that was supposed to find
2479 * the SOA RR for us. It was successful, but found no
2480 * RR for us. This means we are not at a zone cut. In
2481 * this case, we require authentication if the SOA
2482 * lookup was authenticated too. */
2483 return t->answer_authenticated;
2484 }
2485
2486 return true;
2487 }}
2488 }
2489
2490 static int dns_transaction_in_private_tld(DnsTransaction *t, const DnsResourceKey *key) {
2491 DnsTransaction *dt;
2492 const char *tld;
2493 Iterator i;
2494 int r;
2495
2496 /* If DNSSEC downgrade mode is on, checks whether the
2497 * specified RR is one level below a TLD we have proven not to
2498 * exist. In such a case we assume that this is a private
2499 * domain, and permit it.
2500 *
2501 * This detects cases like the Fritz!Box router networks. Each
2502 * Fritz!Box router serves a private "fritz.box" zone, in the
2503 * non-existing TLD "box". Requests for the "fritz.box" domain
2504 * are served by the router itself, while requests for the
2505 * "box" domain will result in NXDOMAIN.
2506 *
2507 * Note that this logic is unable to detect cases where a
2508 * router serves a private DNS zone directly under
2509 * non-existing TLD. In such a case we cannot detect whether
2510 * the TLD is supposed to exist or not, as all requests we
2511 * make for it will be answered by the router's zone, and not
2512 * by the root zone. */
2513
2514 assert(t);
2515
2516 if (t->scope->dnssec_mode != DNSSEC_ALLOW_DOWNGRADE)
2517 return false; /* In strict DNSSEC mode what doesn't exist, doesn't exist */
2518
2519 tld = dns_resource_key_name(key);
2520 r = dns_name_parent(&tld);
2521 if (r < 0)
2522 return r;
2523 if (r == 0)
2524 return false; /* Already the root domain */
2525
2526 if (!dns_name_is_single_label(tld))
2527 return false;
2528
2529 SET_FOREACH(dt, t->dnssec_transactions, i) {
2530
2531 if (dt->key->class != key->class)
2532 continue;
2533
2534 r = dns_name_equal(dns_resource_key_name(dt->key), tld);
2535 if (r < 0)
2536 return r;
2537 if (r == 0)
2538 continue;
2539
2540 /* We found an auxiliary lookup we did for the TLD. If
2541 * that returned with NXDOMAIN, we know the TLD didn't
2542 * exist, and hence this might be a private zone. */
2543
2544 return dt->answer_rcode == DNS_RCODE_NXDOMAIN;
2545 }
2546
2547 return false;
2548 }
2549
2550 static int dns_transaction_requires_nsec(DnsTransaction *t) {
2551 char key_str[DNS_RESOURCE_KEY_STRING_MAX];
2552 DnsTransaction *dt;
2553 const char *name;
2554 uint16_t type = 0;
2555 Iterator i;
2556 int r;
2557
2558 assert(t);
2559
2560 /* Checks if we need to insist on NSEC/NSEC3 RRs for proving
2561 * this negative reply */
2562
2563 if (t->scope->dnssec_mode == DNSSEC_NO)
2564 return false;
2565
2566 if (dns_type_is_pseudo(t->key->type))
2567 return -EINVAL;
2568
2569 r = dns_transaction_negative_trust_anchor_lookup(t, dns_resource_key_name(t->key));
2570 if (r < 0)
2571 return r;
2572 if (r > 0)
2573 return false;
2574
2575 r = dns_transaction_in_private_tld(t, t->key);
2576 if (r < 0)
2577 return r;
2578 if (r > 0) {
2579 /* The lookup is from a TLD that is proven not to
2580 * exist, and we are in downgrade mode, hence ignore
2581 * that fact that we didn't get any NSEC RRs. */
2582
2583 log_info("Detected a negative query %s in a private DNS zone, permitting unsigned response.",
2584 dns_resource_key_to_string(t->key, key_str, sizeof key_str));
2585 return false;
2586 }
2587
2588 name = dns_resource_key_name(t->key);
2589
2590 if (t->key->type == DNS_TYPE_DS) {
2591
2592 /* We got a negative reply for this DS lookup? DS RRs are signed when their parent zone is signed,
2593 * hence check the parent SOA in this case. */
2594
2595 r = dns_name_parent(&name);
2596 if (r < 0)
2597 return r;
2598 if (r == 0)
2599 return true;
2600
2601 type = DNS_TYPE_SOA;
2602
2603 } else if (IN_SET(t->key->type, DNS_TYPE_SOA, DNS_TYPE_NS))
2604 /* We got a negative reply for this SOA/NS lookup? If so, check if there's a DS RR for this */
2605 type = DNS_TYPE_DS;
2606 else
2607 /* For all other negative replies, check for the SOA lookup */
2608 type = DNS_TYPE_SOA;
2609
2610 /* For all other RRs we check the SOA on the same level to see
2611 * if it's signed. */
2612
2613 SET_FOREACH(dt, t->dnssec_transactions, i) {
2614
2615 if (dt->key->class != t->key->class)
2616 continue;
2617 if (dt->key->type != type)
2618 continue;
2619
2620 r = dns_name_equal(dns_resource_key_name(dt->key), name);
2621 if (r < 0)
2622 return r;
2623 if (r == 0)
2624 continue;
2625
2626 return dt->answer_authenticated;
2627 }
2628
2629 /* If in doubt, require NSEC/NSEC3 */
2630 return true;
2631 }
2632
2633 static int dns_transaction_dnskey_authenticated(DnsTransaction *t, DnsResourceRecord *rr) {
2634 DnsResourceRecord *rrsig;
2635 bool found = false;
2636 int r;
2637
2638 /* Checks whether any of the DNSKEYs used for the RRSIGs for
2639 * the specified RRset is authenticated (i.e. has a matching
2640 * DS RR). */
2641
2642 r = dns_transaction_negative_trust_anchor_lookup(t, dns_resource_key_name(rr->key));
2643 if (r < 0)
2644 return r;
2645 if (r > 0)
2646 return false;
2647
2648 DNS_ANSWER_FOREACH(rrsig, t->answer) {
2649 DnsTransaction *dt;
2650 Iterator i;
2651
2652 r = dnssec_key_match_rrsig(rr->key, rrsig);
2653 if (r < 0)
2654 return r;
2655 if (r == 0)
2656 continue;
2657
2658 SET_FOREACH(dt, t->dnssec_transactions, i) {
2659
2660 if (dt->key->class != rr->key->class)
2661 continue;
2662
2663 if (dt->key->type == DNS_TYPE_DNSKEY) {
2664
2665 r = dns_name_equal(dns_resource_key_name(dt->key), rrsig->rrsig.signer);
2666 if (r < 0)
2667 return r;
2668 if (r == 0)
2669 continue;
2670
2671 /* OK, we found an auxiliary DNSKEY
2672 * lookup. If that lookup is
2673 * authenticated, report this. */
2674
2675 if (dt->answer_authenticated)
2676 return true;
2677
2678 found = true;
2679
2680 } else if (dt->key->type == DNS_TYPE_DS) {
2681
2682 r = dns_name_equal(dns_resource_key_name(dt->key), rrsig->rrsig.signer);
2683 if (r < 0)
2684 return r;
2685 if (r == 0)
2686 continue;
2687
2688 /* OK, we found an auxiliary DS
2689 * lookup. If that lookup is
2690 * authenticated and non-zero, we
2691 * won! */
2692
2693 if (!dt->answer_authenticated)
2694 return false;
2695
2696 return dns_answer_match_key(dt->answer, dt->key, NULL);
2697 }
2698 }
2699 }
2700
2701 return found ? false : -ENXIO;
2702 }
2703
2704 static int dns_transaction_known_signed(DnsTransaction *t, DnsResourceRecord *rr) {
2705 assert(t);
2706 assert(rr);
2707
2708 /* We know that the root domain is signed, hence if it appears
2709 * not to be signed, there's a problem with the DNS server */
2710
2711 return rr->key->class == DNS_CLASS_IN &&
2712 dns_name_is_root(dns_resource_key_name(rr->key));
2713 }
2714
2715 static int dns_transaction_check_revoked_trust_anchors(DnsTransaction *t) {
2716 DnsResourceRecord *rr;
2717 int r;
2718
2719 assert(t);
2720
2721 /* Maybe warn the user that we encountered a revoked DNSKEY
2722 * for a key from our trust anchor. Note that we don't care
2723 * whether the DNSKEY can be authenticated or not. It's
2724 * sufficient if it is self-signed. */
2725
2726 DNS_ANSWER_FOREACH(rr, t->answer) {
2727 r = dns_trust_anchor_check_revoked(&t->scope->manager->trust_anchor, rr, t->answer);
2728 if (r < 0)
2729 return r;
2730 }
2731
2732 return 0;
2733 }
2734
2735 static int dns_transaction_invalidate_revoked_keys(DnsTransaction *t) {
2736 bool changed;
2737 int r;
2738
2739 assert(t);
2740
2741 /* Removes all DNSKEY/DS objects from t->validated_keys that
2742 * our trust anchors database considers revoked. */
2743
2744 do {
2745 DnsResourceRecord *rr;
2746
2747 changed = false;
2748
2749 DNS_ANSWER_FOREACH(rr, t->validated_keys) {
2750 r = dns_trust_anchor_is_revoked(&t->scope->manager->trust_anchor, rr);
2751 if (r < 0)
2752 return r;
2753 if (r > 0) {
2754 r = dns_answer_remove_by_rr(&t->validated_keys, rr);
2755 if (r < 0)
2756 return r;
2757
2758 assert(r > 0);
2759 changed = true;
2760 break;
2761 }
2762 }
2763 } while (changed);
2764
2765 return 0;
2766 }
2767
2768 static int dns_transaction_copy_validated(DnsTransaction *t) {
2769 DnsTransaction *dt;
2770 Iterator i;
2771 int r;
2772
2773 assert(t);
2774
2775 /* Copy all validated RRs from the auxiliary DNSSEC transactions into our set of validated RRs */
2776
2777 SET_FOREACH(dt, t->dnssec_transactions, i) {
2778
2779 if (DNS_TRANSACTION_IS_LIVE(dt->state))
2780 continue;
2781
2782 if (!dt->answer_authenticated)
2783 continue;
2784
2785 r = dns_answer_extend(&t->validated_keys, dt->answer);
2786 if (r < 0)
2787 return r;
2788 }
2789
2790 return 0;
2791 }
2792
2793 typedef enum {
2794 DNSSEC_PHASE_DNSKEY, /* Phase #1, only validate DNSKEYs */
2795 DNSSEC_PHASE_NSEC, /* Phase #2, only validate NSEC+NSEC3 */
2796 DNSSEC_PHASE_ALL, /* Phase #3, validate everything else */
2797 } Phase;
2798
2799 static int dnssec_validate_records(
2800 DnsTransaction *t,
2801 Phase phase,
2802 bool *have_nsec,
2803 DnsAnswer **validated) {
2804
2805 DnsResourceRecord *rr;
2806 int r;
2807
2808 /* Returns negative on error, 0 if validation failed, 1 to restart validation, 2 when finished. */
2809
2810 DNS_ANSWER_FOREACH(rr, t->answer) {
2811 DnsResourceRecord *rrsig = NULL;
2812 DnssecResult result;
2813
2814 switch (rr->key->type) {
2815 case DNS_TYPE_RRSIG:
2816 continue;
2817
2818 case DNS_TYPE_DNSKEY:
2819 /* We validate DNSKEYs only in the DNSKEY and ALL phases */
2820 if (phase == DNSSEC_PHASE_NSEC)
2821 continue;
2822 break;
2823
2824 case DNS_TYPE_NSEC:
2825 case DNS_TYPE_NSEC3:
2826 *have_nsec = true;
2827
2828 /* We validate NSEC/NSEC3 only in the NSEC and ALL phases */
2829 if (phase == DNSSEC_PHASE_DNSKEY)
2830 continue;
2831 break;
2832
2833 default:
2834 /* We validate all other RRs only in the ALL phases */
2835 if (phase != DNSSEC_PHASE_ALL)
2836 continue;
2837 }
2838
2839 r = dnssec_verify_rrset_search(t->answer, rr->key, t->validated_keys, USEC_INFINITY, &result, &rrsig);
2840 if (r < 0)
2841 return r;
2842
2843 log_debug("Looking at %s: %s", strna(dns_resource_record_to_string(rr)), dnssec_result_to_string(result));
2844
2845 if (result == DNSSEC_VALIDATED) {
2846
2847 if (rr->key->type == DNS_TYPE_DNSKEY) {
2848 /* If we just validated a DNSKEY RRset, then let's add these keys to
2849 * the set of validated keys for this transaction. */
2850
2851 r = dns_answer_copy_by_key(&t->validated_keys, t->answer, rr->key, DNS_ANSWER_AUTHENTICATED);
2852 if (r < 0)
2853 return r;
2854
2855 /* Some of the DNSKEYs we just added might already have been revoked,
2856 * remove them again in that case. */
2857 r = dns_transaction_invalidate_revoked_keys(t);
2858 if (r < 0)
2859 return r;
2860 }
2861
2862 /* Add the validated RRset to the new list of validated
2863 * RRsets, and remove it from the unvalidated RRsets.
2864 * We mark the RRset as authenticated and cacheable. */
2865 r = dns_answer_move_by_key(validated, &t->answer, rr->key, DNS_ANSWER_AUTHENTICATED|DNS_ANSWER_CACHEABLE);
2866 if (r < 0)
2867 return r;
2868
2869 manager_dnssec_verdict(t->scope->manager, DNSSEC_SECURE, rr->key);
2870
2871 /* Exit the loop, we dropped something from the answer, start from the beginning */
2872 return 1;
2873 }
2874
2875 /* If we haven't read all DNSKEYs yet a negative result of the validation is irrelevant, as
2876 * there might be more DNSKEYs coming. Similar, if we haven't read all NSEC/NSEC3 RRs yet,
2877 * we cannot do positive wildcard proofs yet, as those require the NSEC/NSEC3 RRs. */
2878 if (phase != DNSSEC_PHASE_ALL)
2879 continue;
2880
2881 if (result == DNSSEC_VALIDATED_WILDCARD) {
2882 bool authenticated = false;
2883 const char *source;
2884
2885 /* This RRset validated, but as a wildcard. This means we need
2886 * to prove via NSEC/NSEC3 that no matching non-wildcard RR exists. */
2887
2888 /* First step, determine the source of synthesis */
2889 r = dns_resource_record_source(rrsig, &source);
2890 if (r < 0)
2891 return r;
2892
2893 r = dnssec_test_positive_wildcard(*validated,
2894 dns_resource_key_name(rr->key),
2895 source,
2896 rrsig->rrsig.signer,
2897 &authenticated);
2898
2899 /* Unless the NSEC proof showed that the key really doesn't exist something is off. */
2900 if (r == 0)
2901 result = DNSSEC_INVALID;
2902 else {
2903 r = dns_answer_move_by_key(validated, &t->answer, rr->key,
2904 authenticated ? (DNS_ANSWER_AUTHENTICATED|DNS_ANSWER_CACHEABLE) : 0);
2905 if (r < 0)
2906 return r;
2907
2908 manager_dnssec_verdict(t->scope->manager, authenticated ? DNSSEC_SECURE : DNSSEC_INSECURE, rr->key);
2909
2910 /* Exit the loop, we dropped something from the answer, start from the beginning */
2911 return 1;
2912 }
2913 }
2914
2915 if (result == DNSSEC_NO_SIGNATURE) {
2916 r = dns_transaction_requires_rrsig(t, rr);
2917 if (r < 0)
2918 return r;
2919 if (r == 0) {
2920 /* Data does not require signing. In that case, just copy it over,
2921 * but remember that this is by no means authenticated. */
2922 r = dns_answer_move_by_key(validated, &t->answer, rr->key, 0);
2923 if (r < 0)
2924 return r;
2925
2926 manager_dnssec_verdict(t->scope->manager, DNSSEC_INSECURE, rr->key);
2927 return 1;
2928 }
2929
2930 r = dns_transaction_known_signed(t, rr);
2931 if (r < 0)
2932 return r;
2933 if (r > 0) {
2934 /* This is an RR we know has to be signed. If it isn't this means
2935 * the server is not attaching RRSIGs, hence complain. */
2936
2937 dns_server_packet_rrsig_missing(t->server, t->current_feature_level);
2938
2939 if (t->scope->dnssec_mode == DNSSEC_ALLOW_DOWNGRADE) {
2940
2941 /* Downgrading is OK? If so, just consider the information unsigned */
2942
2943 r = dns_answer_move_by_key(validated, &t->answer, rr->key, 0);
2944 if (r < 0)
2945 return r;
2946
2947 manager_dnssec_verdict(t->scope->manager, DNSSEC_INSECURE, rr->key);
2948 return 1;
2949 }
2950
2951 /* Otherwise, fail */
2952 t->answer_dnssec_result = DNSSEC_INCOMPATIBLE_SERVER;
2953 return 0;
2954 }
2955
2956 r = dns_transaction_in_private_tld(t, rr->key);
2957 if (r < 0)
2958 return r;
2959 if (r > 0) {
2960 char s[DNS_RESOURCE_KEY_STRING_MAX];
2961
2962 /* The data is from a TLD that is proven not to exist, and we are in downgrade
2963 * mode, hence ignore the fact that this was not signed. */
2964
2965 log_info("Detected RRset %s is in a private DNS zone, permitting unsigned RRs.",
2966 dns_resource_key_to_string(rr->key, s, sizeof s));
2967
2968 r = dns_answer_move_by_key(validated, &t->answer, rr->key, 0);
2969 if (r < 0)
2970 return r;
2971
2972 manager_dnssec_verdict(t->scope->manager, DNSSEC_INSECURE, rr->key);
2973 return 1;
2974 }
2975 }
2976
2977 if (IN_SET(result,
2978 DNSSEC_MISSING_KEY,
2979 DNSSEC_SIGNATURE_EXPIRED,
2980 DNSSEC_UNSUPPORTED_ALGORITHM)) {
2981
2982 r = dns_transaction_dnskey_authenticated(t, rr);
2983 if (r < 0 && r != -ENXIO)
2984 return r;
2985 if (r == 0) {
2986 /* The DNSKEY transaction was not authenticated, this means there's
2987 * no DS for this, which means it's OK if no keys are found for this signature. */
2988
2989 r = dns_answer_move_by_key(validated, &t->answer, rr->key, 0);
2990 if (r < 0)
2991 return r;
2992
2993 manager_dnssec_verdict(t->scope->manager, DNSSEC_INSECURE, rr->key);
2994 return 1;
2995 }
2996 }
2997
2998 r = dns_transaction_is_primary_response(t, rr);
2999 if (r < 0)
3000 return r;
3001 if (r > 0) {
3002 /* Look for a matching DNAME for this CNAME */
3003 r = dns_answer_has_dname_for_cname(t->answer, rr);
3004 if (r < 0)
3005 return r;
3006 if (r == 0) {
3007 /* Also look among the stuff we already validated */
3008 r = dns_answer_has_dname_for_cname(*validated, rr);
3009 if (r < 0)
3010 return r;
3011 }
3012
3013 if (r == 0) {
3014 if (IN_SET(result,
3015 DNSSEC_INVALID,
3016 DNSSEC_SIGNATURE_EXPIRED,
3017 DNSSEC_NO_SIGNATURE))
3018 manager_dnssec_verdict(t->scope->manager, DNSSEC_BOGUS, rr->key);
3019 else /* DNSSEC_MISSING_KEY or DNSSEC_UNSUPPORTED_ALGORITHM */
3020 manager_dnssec_verdict(t->scope->manager, DNSSEC_INDETERMINATE, rr->key);
3021
3022 /* This is a primary response to our question, and it failed validation.
3023 * That's fatal. */
3024 t->answer_dnssec_result = result;
3025 return 0;
3026 }
3027
3028 /* This is a primary response, but we do have a DNAME RR
3029 * in the RR that can replay this CNAME, hence rely on
3030 * that, and we can remove the CNAME in favour of it. */
3031 }
3032
3033 /* This is just some auxiliary data. Just remove the RRset and continue. */
3034 r = dns_answer_remove_by_key(&t->answer, rr->key);
3035 if (r < 0)
3036 return r;
3037
3038 /* We dropped something from the answer, start from the beginning. */
3039 return 1;
3040 }
3041
3042 return 2; /* Finito. */
3043 }
3044
3045 int dns_transaction_validate_dnssec(DnsTransaction *t) {
3046 _cleanup_(dns_answer_unrefp) DnsAnswer *validated = NULL;
3047 Phase phase;
3048 DnsAnswerFlags flags;
3049 int r;
3050 char key_str[DNS_RESOURCE_KEY_STRING_MAX];
3051
3052 assert(t);
3053
3054 /* We have now collected all DS and DNSKEY RRs in
3055 * t->validated_keys, let's see which RRs we can now
3056 * authenticate with that. */
3057
3058 if (t->scope->dnssec_mode == DNSSEC_NO)
3059 return 0;
3060
3061 /* Already validated */
3062 if (t->answer_dnssec_result != _DNSSEC_RESULT_INVALID)
3063 return 0;
3064
3065 /* Our own stuff needs no validation */
3066 if (IN_SET(t->answer_source, DNS_TRANSACTION_ZONE, DNS_TRANSACTION_TRUST_ANCHOR)) {
3067 t->answer_dnssec_result = DNSSEC_VALIDATED;
3068 t->answer_authenticated = true;
3069 return 0;
3070 }
3071
3072 /* Cached stuff is not affected by validation. */
3073 if (t->answer_source != DNS_TRANSACTION_NETWORK)
3074 return 0;
3075
3076 if (!dns_transaction_dnssec_supported_full(t)) {
3077 /* The server does not support DNSSEC, or doesn't augment responses with RRSIGs. */
3078 t->answer_dnssec_result = DNSSEC_INCOMPATIBLE_SERVER;
3079 log_debug("Not validating response for %" PRIu16 ", used server feature level does not support DNSSEC.", t->id);
3080 return 0;
3081 }
3082
3083 log_debug("Validating response from transaction %" PRIu16 " (%s).",
3084 t->id,
3085 dns_resource_key_to_string(t->key, key_str, sizeof key_str));
3086
3087 /* First, see if this response contains any revoked trust
3088 * anchors we care about */
3089 r = dns_transaction_check_revoked_trust_anchors(t);
3090 if (r < 0)
3091 return r;
3092
3093 /* Third, copy all RRs we acquired successfully from auxiliary RRs over. */
3094 r = dns_transaction_copy_validated(t);
3095 if (r < 0)
3096 return r;
3097
3098 /* Second, see if there are DNSKEYs we already know a
3099 * validated DS for. */
3100 r = dns_transaction_validate_dnskey_by_ds(t);
3101 if (r < 0)
3102 return r;
3103
3104 /* Fourth, remove all DNSKEY and DS RRs again that our trust
3105 * anchor says are revoked. After all we might have marked
3106 * some keys revoked above, but they might still be lingering
3107 * in our validated_keys list. */
3108 r = dns_transaction_invalidate_revoked_keys(t);
3109 if (r < 0)
3110 return r;
3111
3112 phase = DNSSEC_PHASE_DNSKEY;
3113 for (;;) {
3114 bool have_nsec = false;
3115
3116 r = dnssec_validate_records(t, phase, &have_nsec, &validated);
3117 if (r <= 0)
3118 return r;
3119
3120 /* Try again as long as we managed to achieve something */
3121 if (r == 1)
3122 continue;
3123
3124 if (phase == DNSSEC_PHASE_DNSKEY && have_nsec) {
3125 /* OK, we processed all DNSKEYs, and there are NSEC/NSEC3 RRs, look at those now. */
3126 phase = DNSSEC_PHASE_NSEC;
3127 continue;
3128 }
3129
3130 if (phase != DNSSEC_PHASE_ALL) {
3131 /* OK, we processed all DNSKEYs and NSEC/NSEC3 RRs, look at all the rest now.
3132 * Note that in this third phase we start to remove RRs we couldn't validate. */
3133 phase = DNSSEC_PHASE_ALL;
3134 continue;
3135 }
3136
3137 /* We're done */
3138 break;
3139 }
3140
3141 dns_answer_unref(t->answer);
3142 t->answer = TAKE_PTR(validated);
3143
3144 /* At this point the answer only contains validated
3145 * RRsets. Now, let's see if it actually answers the question
3146 * we asked. If so, great! If it doesn't, then see if
3147 * NSEC/NSEC3 can prove this. */
3148 r = dns_transaction_has_positive_answer(t, &flags);
3149 if (r > 0) {
3150 /* Yes, it answers the question! */
3151
3152 if (flags & DNS_ANSWER_AUTHENTICATED) {
3153 /* The answer is fully authenticated, yay. */
3154 t->answer_dnssec_result = DNSSEC_VALIDATED;
3155 t->answer_rcode = DNS_RCODE_SUCCESS;
3156 t->answer_authenticated = true;
3157 } else {
3158 /* The answer is not fully authenticated. */
3159 t->answer_dnssec_result = DNSSEC_UNSIGNED;
3160 t->answer_authenticated = false;
3161 }
3162
3163 } else if (r == 0) {
3164 DnssecNsecResult nr;
3165 bool authenticated = false;
3166
3167 /* Bummer! Let's check NSEC/NSEC3 */
3168 r = dnssec_nsec_test(t->answer, t->key, &nr, &authenticated, &t->answer_nsec_ttl);
3169 if (r < 0)
3170 return r;
3171
3172 switch (nr) {
3173
3174 case DNSSEC_NSEC_NXDOMAIN:
3175 /* NSEC proves the domain doesn't exist. Very good. */
3176 log_debug("Proved NXDOMAIN via NSEC/NSEC3 for transaction %u (%s)", t->id, key_str);
3177 t->answer_dnssec_result = DNSSEC_VALIDATED;
3178 t->answer_rcode = DNS_RCODE_NXDOMAIN;
3179 t->answer_authenticated = authenticated;
3180
3181 manager_dnssec_verdict(t->scope->manager, authenticated ? DNSSEC_SECURE : DNSSEC_INSECURE, t->key);
3182 break;
3183
3184 case DNSSEC_NSEC_NODATA:
3185 /* NSEC proves that there's no data here, very good. */
3186 log_debug("Proved NODATA via NSEC/NSEC3 for transaction %u (%s)", t->id, key_str);
3187 t->answer_dnssec_result = DNSSEC_VALIDATED;
3188 t->answer_rcode = DNS_RCODE_SUCCESS;
3189 t->answer_authenticated = authenticated;
3190
3191 manager_dnssec_verdict(t->scope->manager, authenticated ? DNSSEC_SECURE : DNSSEC_INSECURE, t->key);
3192 break;
3193
3194 case DNSSEC_NSEC_OPTOUT:
3195 /* NSEC3 says the data might not be signed */
3196 log_debug("Data is NSEC3 opt-out via NSEC/NSEC3 for transaction %u (%s)", t->id, key_str);
3197 t->answer_dnssec_result = DNSSEC_UNSIGNED;
3198 t->answer_authenticated = false;
3199
3200 manager_dnssec_verdict(t->scope->manager, DNSSEC_INSECURE, t->key);
3201 break;
3202
3203 case DNSSEC_NSEC_NO_RR:
3204 /* No NSEC data? Bummer! */
3205
3206 r = dns_transaction_requires_nsec(t);
3207 if (r < 0)
3208 return r;
3209 if (r > 0) {
3210 t->answer_dnssec_result = DNSSEC_NO_SIGNATURE;
3211 manager_dnssec_verdict(t->scope->manager, DNSSEC_BOGUS, t->key);
3212 } else {
3213 t->answer_dnssec_result = DNSSEC_UNSIGNED;
3214 t->answer_authenticated = false;
3215 manager_dnssec_verdict(t->scope->manager, DNSSEC_INSECURE, t->key);
3216 }
3217
3218 break;
3219
3220 case DNSSEC_NSEC_UNSUPPORTED_ALGORITHM:
3221 /* We don't know the NSEC3 algorithm used? */
3222 t->answer_dnssec_result = DNSSEC_UNSUPPORTED_ALGORITHM;
3223 manager_dnssec_verdict(t->scope->manager, DNSSEC_INDETERMINATE, t->key);
3224 break;
3225
3226 case DNSSEC_NSEC_FOUND:
3227 case DNSSEC_NSEC_CNAME:
3228 /* NSEC says it needs to be there, but we couldn't find it? Bummer! */
3229 t->answer_dnssec_result = DNSSEC_NSEC_MISMATCH;
3230 manager_dnssec_verdict(t->scope->manager, DNSSEC_BOGUS, t->key);
3231 break;
3232
3233 default:
3234 assert_not_reached("Unexpected NSEC result.");
3235 }
3236 }
3237
3238 return 1;
3239 }
3240
3241 static const char* const dns_transaction_state_table[_DNS_TRANSACTION_STATE_MAX] = {
3242 [DNS_TRANSACTION_NULL] = "null",
3243 [DNS_TRANSACTION_PENDING] = "pending",
3244 [DNS_TRANSACTION_VALIDATING] = "validating",
3245 [DNS_TRANSACTION_RCODE_FAILURE] = "rcode-failure",
3246 [DNS_TRANSACTION_SUCCESS] = "success",
3247 [DNS_TRANSACTION_NO_SERVERS] = "no-servers",
3248 [DNS_TRANSACTION_TIMEOUT] = "timeout",
3249 [DNS_TRANSACTION_ATTEMPTS_MAX_REACHED] = "attempts-max-reached",
3250 [DNS_TRANSACTION_INVALID_REPLY] = "invalid-reply",
3251 [DNS_TRANSACTION_ERRNO] = "errno",
3252 [DNS_TRANSACTION_ABORTED] = "aborted",
3253 [DNS_TRANSACTION_DNSSEC_FAILED] = "dnssec-failed",
3254 [DNS_TRANSACTION_NO_TRUST_ANCHOR] = "no-trust-anchor",
3255 [DNS_TRANSACTION_RR_TYPE_UNSUPPORTED] = "rr-type-unsupported",
3256 [DNS_TRANSACTION_NETWORK_DOWN] = "network-down",
3257 [DNS_TRANSACTION_NOT_FOUND] = "not-found",
3258 };
3259 DEFINE_STRING_TABLE_LOOKUP(dns_transaction_state, DnsTransactionState);
3260
3261 static const char* const dns_transaction_source_table[_DNS_TRANSACTION_SOURCE_MAX] = {
3262 [DNS_TRANSACTION_NETWORK] = "network",
3263 [DNS_TRANSACTION_CACHE] = "cache",
3264 [DNS_TRANSACTION_ZONE] = "zone",
3265 [DNS_TRANSACTION_TRUST_ANCHOR] = "trust-anchor",
3266 };
3267 DEFINE_STRING_TABLE_LOOKUP(dns_transaction_source, DnsTransactionSource);
Unnamed repository; edit this file 'description' to name the repository.