]> git.ipfire.org Git - thirdparty/systemd.git/blob - src/resolve/resolved-dns-transaction.c
projects / thirdparty / systemd.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Merge pull request #9863 from evverx/issues-found-by-journald-fuzzer
[thirdparty/systemd.git] / src / resolve / resolved-dns-transaction.c
1 /* SPDX-License-Identifier: LGPL-2.1+ */
2
3 #include "sd-messages.h"
4
5 #include "af-list.h"
6 #include "alloc-util.h"
7 #include "dns-domain.h"
8 #include "errno-list.h"
9 #include "fd-util.h"
10 #include "random-util.h"
11 #include "resolved-dns-cache.h"
12 #include "resolved-dns-transaction.h"
13 #include "resolved-llmnr.h"
14 #if ENABLE_DNS_OVER_TLS
15 #include "resolved-dnstls.h"
16 #endif
17 #include "string-table.h"
18
19 #define TRANSACTIONS_MAX 4096
20 #define TRANSACTION_TCP_TIMEOUT_USEC (10U*USEC_PER_SEC)
21
22 /* After how much time to repeat classic DNS requests */
23 #define DNS_TIMEOUT_USEC (SD_RESOLVED_QUERY_TIMEOUT_USEC / DNS_TRANSACTION_ATTEMPTS_MAX)
24
25 static void dns_transaction_reset_answer(DnsTransaction *t) {
26 assert(t);
27
28 t->received = dns_packet_unref(t->received);
29 t->answer = dns_answer_unref(t->answer);
30 t->answer_rcode = 0;
31 t->answer_dnssec_result = _DNSSEC_RESULT_INVALID;
32 t->answer_source = _DNS_TRANSACTION_SOURCE_INVALID;
33 t->answer_authenticated = false;
34 t->answer_nsec_ttl = (uint32_t) -1;
35 t->answer_errno = 0;
36 }
37
38 static void dns_transaction_flush_dnssec_transactions(DnsTransaction *t) {
39 DnsTransaction *z;
40
41 assert(t);
42
43 while ((z = set_steal_first(t->dnssec_transactions))) {
44 set_remove(z->notify_transactions, t);
45 set_remove(z->notify_transactions_done, t);
46 dns_transaction_gc(z);
47 }
48 }
49
50 static void dns_transaction_close_connection(DnsTransaction *t) {
51 assert(t);
52
53 if (t->stream) {
54 /* Let's detach the stream from our transaction, in case something else keeps a reference to it. */
55 LIST_REMOVE(transactions_by_stream, t->stream->transactions, t);
56
57 /* Remove packet in case it's still in the queue */
58 dns_packet_unref(ordered_set_remove(t->stream->write_queue, t->sent));
59
60 t->stream = dns_stream_unref(t->stream);
61 }
62
63 t->dns_udp_event_source = sd_event_source_unref(t->dns_udp_event_source);
64 t->dns_udp_fd = safe_close(t->dns_udp_fd);
65 }
66
67 static void dns_transaction_stop_timeout(DnsTransaction *t) {
68 assert(t);
69
70 t->timeout_event_source = sd_event_source_unref(t->timeout_event_source);
71 }
72
73 DnsTransaction* dns_transaction_free(DnsTransaction *t) {
74 DnsQueryCandidate *c;
75 DnsZoneItem *i;
76 DnsTransaction *z;
77
78 if (!t)
79 return NULL;
80
81 log_debug("Freeing transaction %" PRIu16 ".", t->id);
82
83 dns_transaction_close_connection(t);
84 dns_transaction_stop_timeout(t);
85
86 dns_packet_unref(t->sent);
87 dns_transaction_reset_answer(t);
88
89 dns_server_unref(t->server);
90
91 if (t->scope) {
92 hashmap_remove_value(t->scope->transactions_by_key, t->key, t);
93 LIST_REMOVE(transactions_by_scope, t->scope->transactions, t);
94
95 if (t->id != 0)
96 hashmap_remove(t->scope->manager->dns_transactions, UINT_TO_PTR(t->id));
97 }
98
99 while ((c = set_steal_first(t->notify_query_candidates)))
100 set_remove(c->transactions, t);
101 set_free(t->notify_query_candidates);
102
103 while ((c = set_steal_first(t->notify_query_candidates_done)))
104 set_remove(c->transactions, t);
105 set_free(t->notify_query_candidates_done);
106
107 while ((i = set_steal_first(t->notify_zone_items)))
108 i->probe_transaction = NULL;
109 set_free(t->notify_zone_items);
110
111 while ((i = set_steal_first(t->notify_zone_items_done)))
112 i->probe_transaction = NULL;
113 set_free(t->notify_zone_items_done);
114
115 while ((z = set_steal_first(t->notify_transactions)))
116 set_remove(z->dnssec_transactions, t);
117 set_free(t->notify_transactions);
118
119 while ((z = set_steal_first(t->notify_transactions_done)))
120 set_remove(z->dnssec_transactions, t);
121 set_free(t->notify_transactions_done);
122
123 dns_transaction_flush_dnssec_transactions(t);
124 set_free(t->dnssec_transactions);
125
126 dns_answer_unref(t->validated_keys);
127 dns_resource_key_unref(t->key);
128
129 return mfree(t);
130 }
131
132 DEFINE_TRIVIAL_CLEANUP_FUNC(DnsTransaction*, dns_transaction_free);
133
134 bool dns_transaction_gc(DnsTransaction *t) {
135 assert(t);
136
137 if (t->block_gc > 0)
138 return true;
139
140 if (set_isempty(t->notify_query_candidates) &&
141 set_isempty(t->notify_query_candidates_done) &&
142 set_isempty(t->notify_zone_items) &&
143 set_isempty(t->notify_zone_items_done) &&
144 set_isempty(t->notify_transactions) &&
145 set_isempty(t->notify_transactions_done)) {
146 dns_transaction_free(t);
147 return false;
148 }
149
150 return true;
151 }
152
153 static uint16_t pick_new_id(Manager *m) {
154 uint16_t new_id;
155
156 /* Find a fresh, unused transaction id. Note that this loop is bounded because there's a limit on the number of
157 * transactions, and it's much lower than the space of IDs. */
158
159 assert_cc(TRANSACTIONS_MAX < 0xFFFF);
160
161 do
162 random_bytes(&new_id, sizeof(new_id));
163 while (new_id == 0 ||
164 hashmap_get(m->dns_transactions, UINT_TO_PTR(new_id)));
165
166 return new_id;
167 }
168
169 int dns_transaction_new(DnsTransaction **ret, DnsScope *s, DnsResourceKey *key) {
170 _cleanup_(dns_transaction_freep) DnsTransaction *t = NULL;
171 int r;
172
173 assert(ret);
174 assert(s);
175 assert(key);
176
177 /* Don't allow looking up invalid or pseudo RRs */
178 if (!dns_type_is_valid_query(key->type))
179 return -EINVAL;
180 if (dns_type_is_obsolete(key->type))
181 return -EOPNOTSUPP;
182
183 /* We only support the IN class */
184 if (!IN_SET(key->class, DNS_CLASS_IN, DNS_CLASS_ANY))
185 return -EOPNOTSUPP;
186
187 if (hashmap_size(s->manager->dns_transactions) >= TRANSACTIONS_MAX)
188 return -EBUSY;
189
190 r = hashmap_ensure_allocated(&s->manager->dns_transactions, NULL);
191 if (r < 0)
192 return r;
193
194 r = hashmap_ensure_allocated(&s->transactions_by_key, &dns_resource_key_hash_ops);
195 if (r < 0)
196 return r;
197
198 t = new0(DnsTransaction, 1);
199 if (!t)
200 return -ENOMEM;
201
202 t->dns_udp_fd = -1;
203 t->answer_source = _DNS_TRANSACTION_SOURCE_INVALID;
204 t->answer_dnssec_result = _DNSSEC_RESULT_INVALID;
205 t->answer_nsec_ttl = (uint32_t) -1;
206 t->key = dns_resource_key_ref(key);
207 t->current_feature_level = _DNS_SERVER_FEATURE_LEVEL_INVALID;
208 t->clamp_feature_level = _DNS_SERVER_FEATURE_LEVEL_INVALID;
209
210 t->id = pick_new_id(s->manager);
211
212 r = hashmap_put(s->manager->dns_transactions, UINT_TO_PTR(t->id), t);
213 if (r < 0) {
214 t->id = 0;
215 return r;
216 }
217
218 r = hashmap_replace(s->transactions_by_key, t->key, t);
219 if (r < 0) {
220 hashmap_remove(s->manager->dns_transactions, UINT_TO_PTR(t->id));
221 return r;
222 }
223
224 LIST_PREPEND(transactions_by_scope, s->transactions, t);
225 t->scope = s;
226
227 s->manager->n_transactions_total++;
228
229 if (ret)
230 *ret = t;
231
232 t = NULL;
233
234 return 0;
235 }
236
237 static void dns_transaction_shuffle_id(DnsTransaction *t) {
238 uint16_t new_id;
239 assert(t);
240
241 /* Pick a new ID for this transaction. */
242
243 new_id = pick_new_id(t->scope->manager);
244 assert_se(hashmap_remove_and_put(t->scope->manager->dns_transactions, UINT_TO_PTR(t->id), UINT_TO_PTR(new_id), t) >= 0);
245
246 log_debug("Transaction %" PRIu16 " is now %" PRIu16 ".", t->id, new_id);
247 t->id = new_id;
248
249 /* Make sure we generate a new packet with the new ID */
250 t->sent = dns_packet_unref(t->sent);
251 }
252
253 static void dns_transaction_tentative(DnsTransaction *t, DnsPacket *p) {
254 _cleanup_free_ char *pretty = NULL;
255 char key_str[DNS_RESOURCE_KEY_STRING_MAX];
256 DnsZoneItem *z;
257
258 assert(t);
259 assert(p);
260
261 if (manager_our_packet(t->scope->manager, p) != 0)
262 return;
263
264 (void) in_addr_to_string(p->family, &p->sender, &pretty);
265
266 log_debug("Transaction %" PRIu16 " for <%s> on scope %s on %s/%s got tentative packet from %s.",
267 t->id,
268 dns_resource_key_to_string(t->key, key_str, sizeof key_str),
269 dns_protocol_to_string(t->scope->protocol),
270 t->scope->link ? t->scope->link->name : "*",
271 af_to_name_short(t->scope->family),
272 strnull(pretty));
273
274 /* RFC 4795, Section 4.1 says that the peer with the
275 * lexicographically smaller IP address loses */
276 if (memcmp(&p->sender, &p->destination, FAMILY_ADDRESS_SIZE(p->family)) >= 0) {
277 log_debug("Peer has lexicographically larger IP address and thus lost in the conflict.");
278 return;
279 }
280
281 log_debug("We have the lexicographically larger IP address and thus lost in the conflict.");
282
283 t->block_gc++;
284
285 while ((z = set_first(t->notify_zone_items))) {
286 /* First, make sure the zone item drops the reference
287 * to us */
288 dns_zone_item_probe_stop(z);
289
290 /* Secondly, report this as conflict, so that we might
291 * look for a different hostname */
292 dns_zone_item_conflict(z);
293 }
294 t->block_gc--;
295
296 dns_transaction_gc(t);
297 }
298
299 void dns_transaction_complete(DnsTransaction *t, DnsTransactionState state) {
300 DnsQueryCandidate *c;
301 DnsZoneItem *z;
302 DnsTransaction *d;
303 const char *st;
304 char key_str[DNS_RESOURCE_KEY_STRING_MAX];
305
306 assert(t);
307 assert(!DNS_TRANSACTION_IS_LIVE(state));
308
309 if (state == DNS_TRANSACTION_DNSSEC_FAILED) {
310 dns_resource_key_to_string(t->key, key_str, sizeof key_str);
311
312 log_struct(LOG_NOTICE,
313 "MESSAGE_ID=" SD_MESSAGE_DNSSEC_FAILURE_STR,
314 LOG_MESSAGE("DNSSEC validation failed for question %s: %s", key_str, dnssec_result_to_string(t->answer_dnssec_result)),
315 "DNS_TRANSACTION=%" PRIu16, t->id,
316 "DNS_QUESTION=%s", key_str,
317 "DNSSEC_RESULT=%s", dnssec_result_to_string(t->answer_dnssec_result),
318 "DNS_SERVER=%s", dns_server_string(t->server),
319 "DNS_SERVER_FEATURE_LEVEL=%s", dns_server_feature_level_to_string(t->server->possible_feature_level));
320 }
321
322 /* Note that this call might invalidate the query. Callers
323 * should hence not attempt to access the query or transaction
324 * after calling this function. */
325
326 if (state == DNS_TRANSACTION_ERRNO)
327 st = errno_to_name(t->answer_errno);
328 else
329 st = dns_transaction_state_to_string(state);
330
331 log_debug("Transaction %" PRIu16 " for <%s> on scope %s on %s/%s now complete with <%s> from %s (%s).",
332 t->id,
333 dns_resource_key_to_string(t->key, key_str, sizeof key_str),
334 dns_protocol_to_string(t->scope->protocol),
335 t->scope->link ? t->scope->link->name : "*",
336 af_to_name_short(t->scope->family),
337 st,
338 t->answer_source < 0 ? "none" : dns_transaction_source_to_string(t->answer_source),
339 t->answer_authenticated ? "authenticated" : "unsigned");
340
341 t->state = state;
342
343 dns_transaction_close_connection(t);
344 dns_transaction_stop_timeout(t);
345
346 /* Notify all queries that are interested, but make sure the
347 * transaction isn't freed while we are still looking at it */
348 t->block_gc++;
349
350 SET_FOREACH_MOVE(c, t->notify_query_candidates_done, t->notify_query_candidates)
351 dns_query_candidate_notify(c);
352 SWAP_TWO(t->notify_query_candidates, t->notify_query_candidates_done);
353
354 SET_FOREACH_MOVE(z, t->notify_zone_items_done, t->notify_zone_items)
355 dns_zone_item_notify(z);
356 SWAP_TWO(t->notify_zone_items, t->notify_zone_items_done);
357 if (t->probing && t->state == DNS_TRANSACTION_ATTEMPTS_MAX_REACHED)
358 (void) dns_scope_announce(t->scope, false);
359
360 SET_FOREACH_MOVE(d, t->notify_transactions_done, t->notify_transactions)
361 dns_transaction_notify(d, t);
362 SWAP_TWO(t->notify_transactions, t->notify_transactions_done);
363
364 t->block_gc--;
365 dns_transaction_gc(t);
366 }
367
368 static int dns_transaction_pick_server(DnsTransaction *t) {
369 DnsServer *server;
370
371 assert(t);
372 assert(t->scope->protocol == DNS_PROTOCOL_DNS);
373
374 /* Pick a DNS server and a feature level for it. */
375
376 server = dns_scope_get_dns_server(t->scope);
377 if (!server)
378 return -ESRCH;
379
380 /* If we changed the server invalidate the feature level clamping, as the new server might have completely
381 * different properties. */
382 if (server != t->server)
383 t->clamp_feature_level = _DNS_SERVER_FEATURE_LEVEL_INVALID;
384
385 t->current_feature_level = dns_server_possible_feature_level(server);
386
387 /* Clamp the feature level if that is requested. */
388 if (t->clamp_feature_level != _DNS_SERVER_FEATURE_LEVEL_INVALID &&
389 t->current_feature_level > t->clamp_feature_level)
390 t->current_feature_level = t->clamp_feature_level;
391
392 log_debug("Using feature level %s for transaction %u.", dns_server_feature_level_to_string(t->current_feature_level), t->id);
393
394 if (server == t->server)
395 return 0;
396
397 dns_server_unref(t->server);
398 t->server = dns_server_ref(server);
399
400 t->n_picked_servers ++;
401
402 log_debug("Using DNS server %s for transaction %u.", dns_server_string(t->server), t->id);
403
404 return 1;
405 }
406
407 static void dns_transaction_retry(DnsTransaction *t, bool next_server) {
408 int r;
409
410 assert(t);
411
412 log_debug("Retrying transaction %" PRIu16 ".", t->id);
413
414 /* Before we try again, switch to a new server. */
415 if (next_server)
416 dns_scope_next_dns_server(t->scope);
417
418 r = dns_transaction_go(t);
419 if (r < 0) {
420 t->answer_errno = -r;
421 dns_transaction_complete(t, DNS_TRANSACTION_ERRNO);
422 }
423 }
424
425 static int dns_transaction_maybe_restart(DnsTransaction *t) {
426 int r;
427
428 assert(t);
429
430 /* Returns > 0 if the transaction was restarted, 0 if not */
431
432 if (!t->server)
433 return 0;
434
435 if (t->current_feature_level <= dns_server_possible_feature_level(t->server))
436 return 0;
437
438 /* The server's current feature level is lower than when we sent the original query. We learnt something from
439 the response or possibly an auxiliary DNSSEC response that we didn't know before. We take that as reason to
440 restart the whole transaction. This is a good idea to deal with servers that respond rubbish if we include
441 OPT RR or DO bit. One of these cases is documented here, for example:
442 https://open.nlnetlabs.nl/pipermail/dnssec-trigger/2014-November/000376.html */
443
444 log_debug("Server feature level is now lower than when we began our transaction. Restarting with new ID.");
445 dns_transaction_shuffle_id(t);
446
447 r = dns_transaction_go(t);
448 if (r < 0)
449 return r;
450
451 return 1;
452 }
453
454 static void on_transaction_stream_error(DnsTransaction *t, int error) {
455 assert(t);
456
457 dns_transaction_close_connection(t);
458
459 if (ERRNO_IS_DISCONNECT(error)) {
460 if (t->scope->protocol == DNS_PROTOCOL_LLMNR) {
461 /* If the LLMNR/TCP connection failed, the host doesn't support LLMNR, and we cannot answer the
462 * question on this scope. */
463 dns_transaction_complete(t, DNS_TRANSACTION_NOT_FOUND);
464 return;
465 }
466
467 dns_transaction_retry(t, true);
468 return;
469 }
470 if (error != 0) {
471 t->answer_errno = error;
472 dns_transaction_complete(t, DNS_TRANSACTION_ERRNO);
473 }
474 }
475
476 static int dns_transaction_on_stream_packet(DnsTransaction *t, DnsPacket *p) {
477 assert(t);
478 assert(p);
479
480 dns_transaction_close_connection(t);
481
482 if (dns_packet_validate_reply(p) <= 0) {
483 log_debug("Invalid TCP reply packet.");
484 dns_transaction_complete(t, DNS_TRANSACTION_INVALID_REPLY);
485 return 0;
486 }
487
488 dns_scope_check_conflicts(t->scope, p);
489
490 t->block_gc++;
491 dns_transaction_process_reply(t, p);
492 t->block_gc--;
493
494 /* If the response wasn't useful, then complete the transition
495 * now. After all, we are the worst feature set now with TCP
496 * sockets, and there's really no point in retrying. */
497 if (t->state == DNS_TRANSACTION_PENDING)
498 dns_transaction_complete(t, DNS_TRANSACTION_INVALID_REPLY);
499 else
500 dns_transaction_gc(t);
501
502 return 0;
503 }
504
505 static int on_stream_complete(DnsStream *s, int error) {
506 _cleanup_(dns_stream_unrefp) DnsStream *p = NULL;
507 DnsTransaction *t, *n;
508 int r = 0;
509
510 /* Do not let new transactions use this stream */
511 if (s->server && s->server->stream == s)
512 p = TAKE_PTR(s->server->stream);
513
514 if (ERRNO_IS_DISCONNECT(error) && s->protocol != DNS_PROTOCOL_LLMNR) {
515 usec_t usec;
516
517 log_debug_errno(error, "Connection failure for DNS TCP stream: %m");
518
519 if (s->transactions) {
520 t = s->transactions;
521 assert_se(sd_event_now(t->scope->manager->event, clock_boottime_or_monotonic(), &usec) >= 0);
522 dns_server_packet_lost(t->server, IPPROTO_TCP, t->current_feature_level);
523 }
524 }
525
526 LIST_FOREACH_SAFE(transactions_by_stream, t, n, s->transactions)
527 if (error != 0)
528 on_transaction_stream_error(t, error);
529 else if (DNS_PACKET_ID(s->read_packet) == t->id)
530 /* As each transaction have a unique id the return code is only set once */
531 r = dns_transaction_on_stream_packet(t, s->read_packet);
532
533 return r;
534 }
535
536 static int dns_stream_on_packet(DnsStream *s) {
537 _cleanup_(dns_packet_unrefp) DnsPacket *p = NULL;
538 int r = 0;
539 DnsTransaction *t;
540
541 /* Take ownership of packet to be able to receive new packets */
542 p = TAKE_PTR(s->read_packet);
543 s->n_read = 0;
544
545 t = hashmap_get(s->manager->dns_transactions, UINT_TO_PTR(DNS_PACKET_ID(p)));
546
547 /* Ignore incorrect transaction id as transaction can have been canceled */
548 if (t)
549 r = dns_transaction_on_stream_packet(t, p);
550 else {
551 if (dns_packet_validate_reply(p) <= 0) {
552 log_debug("Invalid TCP reply packet.");
553 on_stream_complete(s, 0);
554 }
555 return 0;
556 }
557
558 return r;
559 }
560
561 static int dns_transaction_emit_tcp(DnsTransaction *t) {
562 _cleanup_close_ int fd = -1;
563 _cleanup_(dns_stream_unrefp) DnsStream *s = NULL;
564 union sockaddr_union sa;
565 int r;
566
567 assert(t);
568
569 dns_transaction_close_connection(t);
570
571 switch (t->scope->protocol) {
572
573 case DNS_PROTOCOL_DNS:
574 r = dns_transaction_pick_server(t);
575 if (r < 0)
576 return r;
577
578 if (!dns_server_dnssec_supported(t->server) && dns_type_is_dnssec(t->key->type))
579 return -EOPNOTSUPP;
580
581 r = dns_server_adjust_opt(t->server, t->sent, t->current_feature_level);
582 if (r < 0)
583 return r;
584
585 if (t->server->stream && (DNS_SERVER_FEATURE_LEVEL_IS_TLS(t->current_feature_level) == t->server->stream->encrypted))
586 s = dns_stream_ref(t->server->stream);
587 else
588 fd = dns_scope_socket_tcp(t->scope, AF_UNSPEC, NULL, t->server, DNS_SERVER_FEATURE_LEVEL_IS_TLS(t->current_feature_level) ? 853 : 53, &sa);
589
590 break;
591
592 case DNS_PROTOCOL_LLMNR:
593 /* When we already received a reply to this (but it was truncated), send to its sender address */
594 if (t->received)
595 fd = dns_scope_socket_tcp(t->scope, t->received->family, &t->received->sender, NULL, t->received->sender_port, &sa);
596 else {
597 union in_addr_union address;
598 int family = AF_UNSPEC;
599
600 /* Otherwise, try to talk to the owner of a
601 * the IP address, in case this is a reverse
602 * PTR lookup */
603
604 r = dns_name_address(dns_resource_key_name(t->key), &family, &address);
605 if (r < 0)
606 return r;
607 if (r == 0)
608 return -EINVAL;
609 if (family != t->scope->family)
610 return -ESRCH;
611
612 fd = dns_scope_socket_tcp(t->scope, family, &address, NULL, LLMNR_PORT, &sa);
613 }
614
615 break;
616
617 default:
618 return -EAFNOSUPPORT;
619 }
620
621 if (!s) {
622 if (fd < 0)
623 return fd;
624
625 r = dns_stream_new(t->scope->manager, &s, t->scope->protocol, fd, &sa);
626 if (r < 0)
627 return r;
628
629 fd = -1;
630
631 #if ENABLE_DNS_OVER_TLS
632 if (DNS_SERVER_FEATURE_LEVEL_IS_TLS(t->current_feature_level)) {
633 assert(t->server);
634 r = dnstls_stream_connect_tls(s, t->server);
635 if (r < 0)
636 return r;
637 }
638 #endif
639
640 if (t->server) {
641 dns_stream_unref(t->server->stream);
642 t->server->stream = dns_stream_ref(s);
643 s->server = dns_server_ref(t->server);
644 }
645
646 s->complete = on_stream_complete;
647 s->on_packet = dns_stream_on_packet;
648
649 /* The interface index is difficult to determine if we are
650 * connecting to the local host, hence fill this in right away
651 * instead of determining it from the socket */
652 s->ifindex = dns_scope_ifindex(t->scope);
653 }
654
655 t->stream = TAKE_PTR(s);
656 LIST_PREPEND(transactions_by_stream, t->stream->transactions, t);
657
658 r = dns_stream_write_packet(t->stream, t->sent);
659 if (r < 0) {
660 dns_transaction_close_connection(t);
661 return r;
662 }
663
664 dns_transaction_reset_answer(t);
665
666 t->tried_stream = true;
667
668 return 0;
669 }
670
671 static void dns_transaction_cache_answer(DnsTransaction *t) {
672 assert(t);
673
674 /* For mDNS we cache whenever we get the packet, rather than
675 * in each transaction. */
676 if (!IN_SET(t->scope->protocol, DNS_PROTOCOL_DNS, DNS_PROTOCOL_LLMNR))
677 return;
678
679 /* Caching disabled? */
680 if (!t->scope->manager->enable_cache)
681 return;
682
683 /* We never cache if this packet is from the local host, under
684 * the assumption that a locally running DNS server would
685 * cache this anyway, and probably knows better when to flush
686 * the cache then we could. */
687 if (!DNS_PACKET_SHALL_CACHE(t->received))
688 return;
689
690 dns_cache_put(&t->scope->cache,
691 t->key,
692 t->answer_rcode,
693 t->answer,
694 t->answer_authenticated,
695 t->answer_nsec_ttl,
696 0,
697 t->received->family,
698 &t->received->sender);
699 }
700
701 static bool dns_transaction_dnssec_is_live(DnsTransaction *t) {
702 DnsTransaction *dt;
703 Iterator i;
704
705 assert(t);
706
707 SET_FOREACH(dt, t->dnssec_transactions, i)
708 if (DNS_TRANSACTION_IS_LIVE(dt->state))
709 return true;
710
711 return false;
712 }
713
714 static int dns_transaction_dnssec_ready(DnsTransaction *t) {
715 DnsTransaction *dt;
716 Iterator i;
717
718 assert(t);
719
720 /* Checks whether the auxiliary DNSSEC transactions of our transaction have completed, or are still
721 * ongoing. Returns 0, if we aren't ready for the DNSSEC validation, positive if we are. */
722
723 SET_FOREACH(dt, t->dnssec_transactions, i) {
724
725 switch (dt->state) {
726
727 case DNS_TRANSACTION_NULL:
728 case DNS_TRANSACTION_PENDING:
729 case DNS_TRANSACTION_VALIDATING:
730 /* Still ongoing */
731 return 0;
732
733 case DNS_TRANSACTION_RCODE_FAILURE:
734 if (!IN_SET(dt->answer_rcode, DNS_RCODE_NXDOMAIN, DNS_RCODE_SERVFAIL)) {
735 log_debug("Auxiliary DNSSEC RR query failed with rcode=%s.", dns_rcode_to_string(dt->answer_rcode));
736 goto fail;
737 }
738
739 /* Fall-through: NXDOMAIN/SERVFAIL is good enough for us. This is because some DNS servers
740 * erronously return NXDOMAIN/SERVFAIL for empty non-terminals (Akamai...) or missing DS
741 * records (Facebook), and we need to handle that nicely, when asking for parent SOA or similar
742 * RRs to make unsigned proofs. */
743
744 case DNS_TRANSACTION_SUCCESS:
745 /* All good. */
746 break;
747
748 case DNS_TRANSACTION_DNSSEC_FAILED:
749 /* We handle DNSSEC failures different from other errors, as we care about the DNSSEC
750 * validationr result */
751
752 log_debug("Auxiliary DNSSEC RR query failed validation: %s", dnssec_result_to_string(dt->answer_dnssec_result));
753 t->answer_dnssec_result = dt->answer_dnssec_result; /* Copy error code over */
754 dns_transaction_complete(t, DNS_TRANSACTION_DNSSEC_FAILED);
755 return 0;
756
757 default:
758 log_debug("Auxiliary DNSSEC RR query failed with %s", dns_transaction_state_to_string(dt->state));
759 goto fail;
760 }
761 }
762
763 /* All is ready, we can go and validate */
764 return 1;
765
766 fail:
767 t->answer_dnssec_result = DNSSEC_FAILED_AUXILIARY;
768 dns_transaction_complete(t, DNS_TRANSACTION_DNSSEC_FAILED);
769 return 0;
770 }
771
772 static void dns_transaction_process_dnssec(DnsTransaction *t) {
773 int r;
774
775 assert(t);
776
777 /* Are there ongoing DNSSEC transactions? If so, let's wait for them. */
778 r = dns_transaction_dnssec_ready(t);
779 if (r < 0)
780 goto fail;
781 if (r == 0) /* We aren't ready yet (or one of our auxiliary transactions failed, and we shouldn't validate now */
782 return;
783
784 /* See if we learnt things from the additional DNSSEC transactions, that we didn't know before, and better
785 * restart the lookup immediately. */
786 r = dns_transaction_maybe_restart(t);
787 if (r < 0)
788 goto fail;
789 if (r > 0) /* Transaction got restarted... */
790 return;
791
792 /* All our auxiliary DNSSEC transactions are complete now. Try
793 * to validate our RRset now. */
794 r = dns_transaction_validate_dnssec(t);
795 if (r == -EBADMSG) {
796 dns_transaction_complete(t, DNS_TRANSACTION_INVALID_REPLY);
797 return;
798 }
799 if (r < 0)
800 goto fail;
801
802 if (t->answer_dnssec_result == DNSSEC_INCOMPATIBLE_SERVER &&
803 t->scope->dnssec_mode == DNSSEC_YES) {
804
805 /* We are not in automatic downgrade mode, and the server is bad. Let's try a different server, maybe
806 * that works. */
807
808 if (t->n_picked_servers < dns_scope_get_n_dns_servers(t->scope)) {
809 /* We tried fewer servers on this transaction than we know, let's try another one then */
810 dns_transaction_retry(t, true);
811 return;
812 }
813
814 /* OK, let's give up, apparently all servers we tried didn't work. */
815 dns_transaction_complete(t, DNS_TRANSACTION_DNSSEC_FAILED);
816 return;
817 }
818
819 if (!IN_SET(t->answer_dnssec_result,
820 _DNSSEC_RESULT_INVALID, /* No DNSSEC validation enabled */
821 DNSSEC_VALIDATED, /* Answer is signed and validated successfully */
822 DNSSEC_UNSIGNED, /* Answer is right-fully unsigned */
823 DNSSEC_INCOMPATIBLE_SERVER)) { /* Server does not do DNSSEC (Yay, we are downgrade attack vulnerable!) */
824 dns_transaction_complete(t, DNS_TRANSACTION_DNSSEC_FAILED);
825 return;
826 }
827
828 if (t->answer_dnssec_result == DNSSEC_INCOMPATIBLE_SERVER)
829 dns_server_warn_downgrade(t->server);
830
831 dns_transaction_cache_answer(t);
832
833 if (t->answer_rcode == DNS_RCODE_SUCCESS)
834 dns_transaction_complete(t, DNS_TRANSACTION_SUCCESS);
835 else
836 dns_transaction_complete(t, DNS_TRANSACTION_RCODE_FAILURE);
837
838 return;
839
840 fail:
841 t->answer_errno = -r;
842 dns_transaction_complete(t, DNS_TRANSACTION_ERRNO);
843 }
844
845 static int dns_transaction_has_positive_answer(DnsTransaction *t, DnsAnswerFlags *flags) {
846 int r;
847
848 assert(t);
849
850 /* Checks whether the answer is positive, i.e. either a direct
851 * answer to the question, or a CNAME/DNAME for it */
852
853 r = dns_answer_match_key(t->answer, t->key, flags);
854 if (r != 0)
855 return r;
856
857 r = dns_answer_find_cname_or_dname(t->answer, t->key, NULL, flags);
858 if (r != 0)
859 return r;
860
861 return false;
862 }
863
864 static int dns_transaction_fix_rcode(DnsTransaction *t) {
865 int r;
866
867 assert(t);
868
869 /* Fix up the RCODE to SUCCESS if we get at least one matching RR in a response. Note that this contradicts the
870 * DNS RFCs a bit. Specifically, RFC 6604 Section 3 clarifies that the RCODE shall say something about a
871 * CNAME/DNAME chain element coming after the last chain element contained in the message, and not the first
872 * one included. However, it also indicates that not all DNS servers implement this correctly. Moreover, when
873 * using DNSSEC we usually only can prove the first element of a CNAME/DNAME chain anyway, hence let's settle
874 * on always processing the RCODE as referring to the immediate look-up we do, i.e. the first element of a
875 * CNAME/DNAME chain. This way, we uniformly handle CNAME/DNAME chains, regardless if the DNS server
876 * incorrectly implements RCODE, whether DNSSEC is in use, or whether the DNS server only supplied us with an
877 * incomplete CNAME/DNAME chain.
878 *
879 * Or in other words: if we get at least one positive reply in a message we patch NXDOMAIN to become SUCCESS,
880 * and then rely on the CNAME chasing logic to figure out that there's actually a CNAME error with a new
881 * lookup. */
882
883 if (t->answer_rcode != DNS_RCODE_NXDOMAIN)
884 return 0;
885
886 r = dns_transaction_has_positive_answer(t, NULL);
887 if (r <= 0)
888 return r;
889
890 t->answer_rcode = DNS_RCODE_SUCCESS;
891 return 0;
892 }
893
894 void dns_transaction_process_reply(DnsTransaction *t, DnsPacket *p) {
895 usec_t ts;
896 int r;
897
898 assert(t);
899 assert(p);
900 assert(t->scope);
901 assert(t->scope->manager);
902
903 if (t->state != DNS_TRANSACTION_PENDING)
904 return;
905
906 /* Note that this call might invalidate the query. Callers
907 * should hence not attempt to access the query or transaction
908 * after calling this function. */
909
910 log_debug("Processing incoming packet on transaction %" PRIu16" (rcode=%s).",
911 t->id, dns_rcode_to_string(DNS_PACKET_RCODE(p)));
912
913 switch (t->scope->protocol) {
914
915 case DNS_PROTOCOL_LLMNR:
916 /* For LLMNR we will not accept any packets from other interfaces */
917
918 if (p->ifindex != dns_scope_ifindex(t->scope))
919 return;
920
921 if (p->family != t->scope->family)
922 return;
923
924 /* Tentative packets are not full responses but still
925 * useful for identifying uniqueness conflicts during
926 * probing. */
927 if (DNS_PACKET_LLMNR_T(p)) {
928 dns_transaction_tentative(t, p);
929 return;
930 }
931
932 break;
933
934 case DNS_PROTOCOL_MDNS:
935 /* For mDNS we will not accept any packets from other interfaces */
936
937 if (p->ifindex != dns_scope_ifindex(t->scope))
938 return;
939
940 if (p->family != t->scope->family)
941 return;
942
943 break;
944
945 case DNS_PROTOCOL_DNS:
946 /* Note that we do not need to verify the
947 * addresses/port numbers of incoming traffic, as we
948 * invoked connect() on our UDP socket in which case
949 * the kernel already does the needed verification for
950 * us. */
951 break;
952
953 default:
954 assert_not_reached("Invalid DNS protocol.");
955 }
956
957 if (t->received != p) {
958 dns_packet_unref(t->received);
959 t->received = dns_packet_ref(p);
960 }
961
962 t->answer_source = DNS_TRANSACTION_NETWORK;
963
964 if (p->ipproto == IPPROTO_TCP) {
965 if (DNS_PACKET_TC(p)) {
966 /* Truncated via TCP? Somebody must be fucking with us */
967 dns_transaction_complete(t, DNS_TRANSACTION_INVALID_REPLY);
968 return;
969 }
970
971 if (DNS_PACKET_ID(p) != t->id) {
972 /* Not the reply to our query? Somebody must be fucking with us */
973 dns_transaction_complete(t, DNS_TRANSACTION_INVALID_REPLY);
974 return;
975 }
976 }
977
978 assert_se(sd_event_now(t->scope->manager->event, clock_boottime_or_monotonic(), &ts) >= 0);
979
980 switch (t->scope->protocol) {
981
982 case DNS_PROTOCOL_DNS:
983 assert(t->server);
984
985 if (IN_SET(DNS_PACKET_RCODE(p), DNS_RCODE_FORMERR, DNS_RCODE_SERVFAIL, DNS_RCODE_NOTIMP)) {
986
987 /* Request failed, immediately try again with reduced features */
988
989 if (t->current_feature_level <= DNS_SERVER_FEATURE_LEVEL_UDP) {
990
991 /* This was already at UDP feature level? If so, it doesn't make sense to downgrade
992 * this transaction anymore, but let's see if it might make sense to send the request
993 * to a different DNS server instead. If not let's process the response, and accept the
994 * rcode. Note that we don't retry on TCP, since that's a suitable way to mitigate
995 * packet loss, but is not going to give us better rcodes should we actually have
996 * managed to get them already at UDP level. */
997
998 if (t->n_picked_servers < dns_scope_get_n_dns_servers(t->scope)) {
999 /* We tried fewer servers on this transaction than we know, let's try another one then */
1000 dns_transaction_retry(t, true);
1001 return;
1002 }
1003
1004 /* Give up, accept the rcode */
1005 log_debug("Server returned error: %s", dns_rcode_to_string(DNS_PACKET_RCODE(p)));
1006 break;
1007 }
1008
1009 /* Reduce this feature level by one and try again. */
1010 switch (t->current_feature_level) {
1011 case DNS_SERVER_FEATURE_LEVEL_TLS_DO:
1012 t->clamp_feature_level = DNS_SERVER_FEATURE_LEVEL_TLS_PLAIN;
1013 break;
1014 case DNS_SERVER_FEATURE_LEVEL_TLS_PLAIN + 1:
1015 /* Skip plain TLS when TLS is not supported */
1016 t->clamp_feature_level = DNS_SERVER_FEATURE_LEVEL_TLS_PLAIN - 1;
1017 break;
1018 default:
1019 t->clamp_feature_level = t->current_feature_level - 1;
1020 }
1021
1022 log_debug("Server returned error %s, retrying transaction with reduced feature level %s.",
1023 dns_rcode_to_string(DNS_PACKET_RCODE(p)),
1024 dns_server_feature_level_to_string(t->clamp_feature_level));
1025
1026 dns_transaction_retry(t, false /* use the same server */);
1027 return;
1028 }
1029
1030 if (DNS_PACKET_RCODE(p) == DNS_RCODE_REFUSED) {
1031 /* This server refused our request? If so, try again, use a different server */
1032 log_debug("Server returned REFUSED, switching servers, and retrying.");
1033 dns_transaction_retry(t, true /* pick a new server */);
1034 return;
1035 }
1036
1037 if (DNS_PACKET_TC(p))
1038 dns_server_packet_truncated(t->server, t->current_feature_level);
1039
1040 break;
1041
1042 case DNS_PROTOCOL_LLMNR:
1043 case DNS_PROTOCOL_MDNS:
1044 dns_scope_packet_received(t->scope, ts - t->start_usec);
1045 break;
1046
1047 default:
1048 assert_not_reached("Invalid DNS protocol.");
1049 }
1050
1051 if (DNS_PACKET_TC(p)) {
1052
1053 /* Truncated packets for mDNS are not allowed. Give up immediately. */
1054 if (t->scope->protocol == DNS_PROTOCOL_MDNS) {
1055 dns_transaction_complete(t, DNS_TRANSACTION_INVALID_REPLY);
1056 return;
1057 }
1058
1059 log_debug("Reply truncated, retrying via TCP.");
1060
1061 /* Response was truncated, let's try again with good old TCP */
1062 r = dns_transaction_emit_tcp(t);
1063 if (r == -ESRCH) {
1064 /* No servers found? Damn! */
1065 dns_transaction_complete(t, DNS_TRANSACTION_NO_SERVERS);
1066 return;
1067 }
1068 if (r == -EOPNOTSUPP) {
1069 /* Tried to ask for DNSSEC RRs, on a server that doesn't do DNSSEC */
1070 dns_transaction_complete(t, DNS_TRANSACTION_RR_TYPE_UNSUPPORTED);
1071 return;
1072 }
1073 if (r < 0) {
1074 /* On LLMNR, if we cannot connect to the host,
1075 * we immediately give up */
1076 if (t->scope->protocol != DNS_PROTOCOL_DNS)
1077 goto fail;
1078
1079 /* On DNS, couldn't send? Try immediately again, with a new server */
1080 dns_transaction_retry(t, true);
1081 }
1082
1083 return;
1084 }
1085
1086 /* After the superficial checks, actually parse the message. */
1087 r = dns_packet_extract(p);
1088 if (r < 0) {
1089 dns_transaction_complete(t, DNS_TRANSACTION_INVALID_REPLY);
1090 return;
1091 }
1092
1093 if (t->server) {
1094 /* Report that we successfully received a valid packet with a good rcode after we initially got a bad
1095 * rcode and subsequently downgraded the protocol */
1096
1097 if (IN_SET(DNS_PACKET_RCODE(p), DNS_RCODE_SUCCESS, DNS_RCODE_NXDOMAIN) &&
1098 t->clamp_feature_level != _DNS_SERVER_FEATURE_LEVEL_INVALID)
1099 dns_server_packet_rcode_downgrade(t->server, t->clamp_feature_level);
1100
1101 /* Report that the OPT RR was missing */
1102 if (!p->opt)
1103 dns_server_packet_bad_opt(t->server, t->current_feature_level);
1104
1105 /* Report that we successfully received a packet */
1106 dns_server_packet_received(t->server, p->ipproto, t->current_feature_level, p->size);
1107 }
1108
1109 /* See if we know things we didn't know before that indicate we better restart the lookup immediately. */
1110 r = dns_transaction_maybe_restart(t);
1111 if (r < 0)
1112 goto fail;
1113 if (r > 0) /* Transaction got restarted... */
1114 return;
1115
1116 if (IN_SET(t->scope->protocol, DNS_PROTOCOL_DNS, DNS_PROTOCOL_LLMNR, DNS_PROTOCOL_MDNS)) {
1117
1118 /* When dealing with protocols other than mDNS only consider responses with
1119 * equivalent query section to the request. For mDNS this check doesn't make
1120 * sense, because the section 6 of RFC6762 states that "Multicast DNS responses MUST NOT
1121 * contain any questions in the Question Section". */
1122 if (t->scope->protocol != DNS_PROTOCOL_MDNS) {
1123 r = dns_packet_is_reply_for(p, t->key);
1124 if (r < 0)
1125 goto fail;
1126 if (r == 0) {
1127 dns_transaction_complete(t, DNS_TRANSACTION_INVALID_REPLY);
1128 return;
1129 }
1130 }
1131
1132 /* Install the answer as answer to the transaction */
1133 dns_answer_unref(t->answer);
1134 t->answer = dns_answer_ref(p->answer);
1135 t->answer_rcode = DNS_PACKET_RCODE(p);
1136 t->answer_dnssec_result = _DNSSEC_RESULT_INVALID;
1137 t->answer_authenticated = false;
1138
1139 r = dns_transaction_fix_rcode(t);
1140 if (r < 0)
1141 goto fail;
1142
1143 /* Block GC while starting requests for additional DNSSEC RRs */
1144 t->block_gc++;
1145 r = dns_transaction_request_dnssec_keys(t);
1146 t->block_gc--;
1147
1148 /* Maybe the transaction is ready for GC'ing now? If so, free it and return. */
1149 if (!dns_transaction_gc(t))
1150 return;
1151
1152 /* Requesting additional keys might have resulted in
1153 * this transaction to fail, since the auxiliary
1154 * request failed for some reason. If so, we are not
1155 * in pending state anymore, and we should exit
1156 * quickly. */
1157 if (t->state != DNS_TRANSACTION_PENDING)
1158 return;
1159 if (r < 0)
1160 goto fail;
1161 if (r > 0) {
1162 /* There are DNSSEC transactions pending now. Update the state accordingly. */
1163 t->state = DNS_TRANSACTION_VALIDATING;
1164 dns_transaction_close_connection(t);
1165 dns_transaction_stop_timeout(t);
1166 return;
1167 }
1168 }
1169
1170 dns_transaction_process_dnssec(t);
1171 return;
1172
1173 fail:
1174 t->answer_errno = -r;
1175 dns_transaction_complete(t, DNS_TRANSACTION_ERRNO);
1176 }
1177
1178 static int on_dns_packet(sd_event_source *s, int fd, uint32_t revents, void *userdata) {
1179 _cleanup_(dns_packet_unrefp) DnsPacket *p = NULL;
1180 DnsTransaction *t = userdata;
1181 int r;
1182
1183 assert(t);
1184 assert(t->scope);
1185
1186 r = manager_recv(t->scope->manager, fd, DNS_PROTOCOL_DNS, &p);
1187 if (ERRNO_IS_DISCONNECT(-r)) {
1188 usec_t usec;
1189
1190 /* UDP connection failure get reported via ICMP and then are possible delivered to us on the next
1191 * recvmsg(). Treat this like a lost packet. */
1192
1193 log_debug_errno(r, "Connection failure for DNS UDP packet: %m");
1194 assert_se(sd_event_now(t->scope->manager->event, clock_boottime_or_monotonic(), &usec) >= 0);
1195 dns_server_packet_lost(t->server, IPPROTO_UDP, t->current_feature_level);
1196
1197 dns_transaction_retry(t, true);
1198 return 0;
1199 }
1200 if (r < 0) {
1201 dns_transaction_complete(t, DNS_TRANSACTION_ERRNO);
1202 t->answer_errno = -r;
1203 return 0;
1204 }
1205
1206 r = dns_packet_validate_reply(p);
1207 if (r < 0) {
1208 log_debug_errno(r, "Received invalid DNS packet as response, ignoring: %m");
1209 return 0;
1210 }
1211 if (r == 0) {
1212 log_debug("Received inappropriate DNS packet as response, ignoring.");
1213 return 0;
1214 }
1215
1216 if (DNS_PACKET_ID(p) != t->id) {
1217 log_debug("Received packet with incorrect transaction ID, ignoring.");
1218 return 0;
1219 }
1220
1221 dns_transaction_process_reply(t, p);
1222 return 0;
1223 }
1224
1225 static int dns_transaction_emit_udp(DnsTransaction *t) {
1226 int r;
1227
1228 assert(t);
1229
1230 if (t->scope->protocol == DNS_PROTOCOL_DNS) {
1231
1232 r = dns_transaction_pick_server(t);
1233 if (r < 0)
1234 return r;
1235
1236 if (t->current_feature_level < DNS_SERVER_FEATURE_LEVEL_UDP || DNS_SERVER_FEATURE_LEVEL_IS_TLS(t->current_feature_level))
1237 return -EAGAIN; /* Sorry, can't do UDP, try TCP! */
1238
1239 if (!dns_server_dnssec_supported(t->server) && dns_type_is_dnssec(t->key->type))
1240 return -EOPNOTSUPP;
1241
1242 if (r > 0 || t->dns_udp_fd < 0) { /* Server changed, or no connection yet. */
1243 int fd;
1244
1245 dns_transaction_close_connection(t);
1246
1247 fd = dns_scope_socket_udp(t->scope, t->server, 53);
1248 if (fd < 0)
1249 return fd;
1250
1251 r = sd_event_add_io(t->scope->manager->event, &t->dns_udp_event_source, fd, EPOLLIN, on_dns_packet, t);
1252 if (r < 0) {
1253 safe_close(fd);
1254 return r;
1255 }
1256
1257 (void) sd_event_source_set_description(t->dns_udp_event_source, "dns-transaction-udp");
1258 t->dns_udp_fd = fd;
1259 }
1260
1261 r = dns_server_adjust_opt(t->server, t->sent, t->current_feature_level);
1262 if (r < 0)
1263 return r;
1264 } else
1265 dns_transaction_close_connection(t);
1266
1267 r = dns_scope_emit_udp(t->scope, t->dns_udp_fd, t->sent);
1268 if (r < 0)
1269 return r;
1270
1271 dns_transaction_reset_answer(t);
1272
1273 return 0;
1274 }
1275
1276 static int on_transaction_timeout(sd_event_source *s, usec_t usec, void *userdata) {
1277 DnsTransaction *t = userdata;
1278
1279 assert(s);
1280 assert(t);
1281
1282 if (!t->initial_jitter_scheduled || t->initial_jitter_elapsed) {
1283 /* Timeout reached? Increase the timeout for the server used */
1284 switch (t->scope->protocol) {
1285
1286 case DNS_PROTOCOL_DNS:
1287 assert(t->server);
1288 dns_server_packet_lost(t->server, t->stream ? IPPROTO_TCP : IPPROTO_UDP, t->current_feature_level);
1289 break;
1290
1291 case DNS_PROTOCOL_LLMNR:
1292 case DNS_PROTOCOL_MDNS:
1293 dns_scope_packet_lost(t->scope, usec - t->start_usec);
1294 break;
1295
1296 default:
1297 assert_not_reached("Invalid DNS protocol.");
1298 }
1299
1300 if (t->initial_jitter_scheduled)
1301 t->initial_jitter_elapsed = true;
1302 }
1303
1304 log_debug("Timeout reached on transaction %" PRIu16 ".", t->id);
1305
1306 dns_transaction_retry(t, true);
1307 return 0;
1308 }
1309
1310 static usec_t transaction_get_resend_timeout(DnsTransaction *t) {
1311 assert(t);
1312 assert(t->scope);
1313
1314 switch (t->scope->protocol) {
1315
1316 case DNS_PROTOCOL_DNS:
1317
1318 /* When we do TCP, grant a much longer timeout, as in this case there's no need for us to quickly
1319 * resend, as the kernel does that anyway for us, and we really don't want to interrupt it in that
1320 * needlessly. */
1321 if (t->stream)
1322 return TRANSACTION_TCP_TIMEOUT_USEC;
1323
1324 return DNS_TIMEOUT_USEC;
1325
1326 case DNS_PROTOCOL_MDNS:
1327 assert(t->n_attempts > 0);
1328 if (t->probing)
1329 return MDNS_PROBING_INTERVAL_USEC;
1330 else
1331 return (1 << (t->n_attempts - 1)) * USEC_PER_SEC;
1332
1333 case DNS_PROTOCOL_LLMNR:
1334 return t->scope->resend_timeout;
1335
1336 default:
1337 assert_not_reached("Invalid DNS protocol.");
1338 }
1339 }
1340
1341 static int dns_transaction_prepare(DnsTransaction *t, usec_t ts) {
1342 int r;
1343
1344 assert(t);
1345
1346 dns_transaction_stop_timeout(t);
1347
1348 if (!dns_scope_network_good(t->scope)) {
1349 dns_transaction_complete(t, DNS_TRANSACTION_NETWORK_DOWN);
1350 return 0;
1351 }
1352
1353 if (t->n_attempts >= TRANSACTION_ATTEMPTS_MAX(t->scope->protocol)) {
1354 dns_transaction_complete(t, DNS_TRANSACTION_ATTEMPTS_MAX_REACHED);
1355 return 0;
1356 }
1357
1358 if (t->scope->protocol == DNS_PROTOCOL_LLMNR && t->tried_stream) {
1359 /* If we already tried via a stream, then we don't
1360 * retry on LLMNR. See RFC 4795, Section 2.7. */
1361 dns_transaction_complete(t, DNS_TRANSACTION_ATTEMPTS_MAX_REACHED);
1362 return 0;
1363 }
1364
1365 t->n_attempts++;
1366 t->start_usec = ts;
1367
1368 dns_transaction_reset_answer(t);
1369 dns_transaction_flush_dnssec_transactions(t);
1370
1371 /* Check the trust anchor. Do so only on classic DNS, since DNSSEC does not apply otherwise. */
1372 if (t->scope->protocol == DNS_PROTOCOL_DNS) {
1373 r = dns_trust_anchor_lookup_positive(&t->scope->manager->trust_anchor, t->key, &t->answer);
1374 if (r < 0)
1375 return r;
1376 if (r > 0) {
1377 t->answer_rcode = DNS_RCODE_SUCCESS;
1378 t->answer_source = DNS_TRANSACTION_TRUST_ANCHOR;
1379 t->answer_authenticated = true;
1380 dns_transaction_complete(t, DNS_TRANSACTION_SUCCESS);
1381 return 0;
1382 }
1383
1384 if (dns_name_is_root(dns_resource_key_name(t->key)) &&
1385 t->key->type == DNS_TYPE_DS) {
1386
1387 /* Hmm, this is a request for the root DS? A
1388 * DS RR doesn't exist in the root zone, and
1389 * if our trust anchor didn't know it either,
1390 * this means we cannot do any DNSSEC logic
1391 * anymore. */
1392
1393 if (t->scope->dnssec_mode == DNSSEC_ALLOW_DOWNGRADE) {
1394 /* We are in downgrade mode. In this
1395 * case, synthesize an unsigned empty
1396 * response, so that the any lookup
1397 * depending on this one can continue
1398 * assuming there was no DS, and hence
1399 * the root zone was unsigned. */
1400
1401 t->answer_rcode = DNS_RCODE_SUCCESS;
1402 t->answer_source = DNS_TRANSACTION_TRUST_ANCHOR;
1403 t->answer_authenticated = false;
1404 dns_transaction_complete(t, DNS_TRANSACTION_SUCCESS);
1405 } else
1406 /* If we are not in downgrade mode,
1407 * then fail the lookup, because we
1408 * cannot reasonably answer it. There
1409 * might be DS RRs, but we don't know
1410 * them, and the DNS server won't tell
1411 * them to us (and even if it would,
1412 * we couldn't validate and trust them. */
1413 dns_transaction_complete(t, DNS_TRANSACTION_NO_TRUST_ANCHOR);
1414
1415 return 0;
1416 }
1417 }
1418
1419 /* Check the zone, but only if this transaction is not used
1420 * for probing or verifying a zone item. */
1421 if (set_isempty(t->notify_zone_items)) {
1422
1423 r = dns_zone_lookup(&t->scope->zone, t->key, dns_scope_ifindex(t->scope), &t->answer, NULL, NULL);
1424 if (r < 0)
1425 return r;
1426 if (r > 0) {
1427 t->answer_rcode = DNS_RCODE_SUCCESS;
1428 t->answer_source = DNS_TRANSACTION_ZONE;
1429 t->answer_authenticated = true;
1430 dns_transaction_complete(t, DNS_TRANSACTION_SUCCESS);
1431 return 0;
1432 }
1433 }
1434
1435 /* Check the cache, but only if this transaction is not used
1436 * for probing or verifying a zone item. */
1437 if (set_isempty(t->notify_zone_items)) {
1438
1439 /* Before trying the cache, let's make sure we figured out a
1440 * server to use. Should this cause a change of server this
1441 * might flush the cache. */
1442 (void) dns_scope_get_dns_server(t->scope);
1443
1444 /* Let's then prune all outdated entries */
1445 dns_cache_prune(&t->scope->cache);
1446
1447 r = dns_cache_lookup(&t->scope->cache, t->key, t->clamp_ttl, &t->answer_rcode, &t->answer, &t->answer_authenticated);
1448 if (r < 0)
1449 return r;
1450 if (r > 0) {
1451 t->answer_source = DNS_TRANSACTION_CACHE;
1452 if (t->answer_rcode == DNS_RCODE_SUCCESS)
1453 dns_transaction_complete(t, DNS_TRANSACTION_SUCCESS);
1454 else
1455 dns_transaction_complete(t, DNS_TRANSACTION_RCODE_FAILURE);
1456 return 0;
1457 }
1458 }
1459
1460 return 1;
1461 }
1462
1463 static int dns_transaction_make_packet_mdns(DnsTransaction *t) {
1464
1465 _cleanup_(dns_packet_unrefp) DnsPacket *p = NULL;
1466 bool add_known_answers = false;
1467 DnsTransaction *other;
1468 Iterator i;
1469 DnsResourceKey *tkey;
1470 _cleanup_set_free_ Set *keys = NULL;
1471 unsigned qdcount;
1472 unsigned nscount = 0;
1473 usec_t ts;
1474 int r;
1475
1476 assert(t);
1477 assert(t->scope->protocol == DNS_PROTOCOL_MDNS);
1478
1479 /* Discard any previously prepared packet, so we can start over and coalesce again */
1480 t->sent = dns_packet_unref(t->sent);
1481
1482 r = dns_packet_new_query(&p, t->scope->protocol, 0, false);
1483 if (r < 0)
1484 return r;
1485
1486 r = dns_packet_append_key(p, t->key, 0, NULL);
1487 if (r < 0)
1488 return r;
1489
1490 qdcount = 1;
1491
1492 if (dns_key_is_shared(t->key))
1493 add_known_answers = true;
1494
1495 if (t->key->type == DNS_TYPE_ANY) {
1496 r = set_ensure_allocated(&keys, &dns_resource_key_hash_ops);
1497 if (r < 0)
1498 return r;
1499
1500 r = set_put(keys, t->key);
1501 if (r < 0)
1502 return r;
1503 }
1504
1505 /*
1506 * For mDNS, we want to coalesce as many open queries in pending transactions into one single
1507 * query packet on the wire as possible. To achieve that, we iterate through all pending transactions
1508 * in our current scope, and see whether their timing contraints allow them to be sent.
1509 */
1510
1511 assert_se(sd_event_now(t->scope->manager->event, clock_boottime_or_monotonic(), &ts) >= 0);
1512
1513 LIST_FOREACH(transactions_by_scope, other, t->scope->transactions) {
1514
1515 /* Skip ourselves */
1516 if (other == t)
1517 continue;
1518
1519 if (other->state != DNS_TRANSACTION_PENDING)
1520 continue;
1521
1522 if (other->next_attempt_after > ts)
1523 continue;
1524
1525 if (qdcount >= UINT16_MAX)
1526 break;
1527
1528 r = dns_packet_append_key(p, other->key, 0, NULL);
1529
1530 /*
1531 * If we can't stuff more questions into the packet, just give up.
1532 * One of the 'other' transactions will fire later and take care of the rest.
1533 */
1534 if (r == -EMSGSIZE)
1535 break;
1536
1537 if (r < 0)
1538 return r;
1539
1540 r = dns_transaction_prepare(other, ts);
1541 if (r <= 0)
1542 continue;
1543
1544 ts += transaction_get_resend_timeout(other);
1545
1546 r = sd_event_add_time(
1547 other->scope->manager->event,
1548 &other->timeout_event_source,
1549 clock_boottime_or_monotonic(),
1550 ts, 0,
1551 on_transaction_timeout, other);
1552 if (r < 0)
1553 return r;
1554
1555 (void) sd_event_source_set_description(other->timeout_event_source, "dns-transaction-timeout");
1556
1557 other->state = DNS_TRANSACTION_PENDING;
1558 other->next_attempt_after = ts;
1559
1560 qdcount++;
1561
1562 if (dns_key_is_shared(other->key))
1563 add_known_answers = true;
1564
1565 if (other->key->type == DNS_TYPE_ANY) {
1566 r = set_ensure_allocated(&keys, &dns_resource_key_hash_ops);
1567 if (r < 0)
1568 return r;
1569
1570 r = set_put(keys, other->key);
1571 if (r < 0)
1572 return r;
1573 }
1574 }
1575
1576 DNS_PACKET_HEADER(p)->qdcount = htobe16(qdcount);
1577
1578 /* Append known answer section if we're asking for any shared record */
1579 if (add_known_answers) {
1580 r = dns_cache_export_shared_to_packet(&t->scope->cache, p);
1581 if (r < 0)
1582 return r;
1583 }
1584
1585 SET_FOREACH(tkey, keys, i) {
1586 _cleanup_(dns_answer_unrefp) DnsAnswer *answer = NULL;
1587 bool tentative;
1588
1589 r = dns_zone_lookup(&t->scope->zone, tkey, t->scope->link->ifindex, &answer, NULL, &tentative);
1590 if (r < 0)
1591 return r;
1592
1593 r = dns_packet_append_answer(p, answer);
1594 if (r < 0)
1595 return r;
1596
1597 nscount += dns_answer_size(answer);
1598 }
1599 DNS_PACKET_HEADER(p)->nscount = htobe16(nscount);
1600
1601 t->sent = TAKE_PTR(p);
1602
1603 return 0;
1604 }
1605
1606 static int dns_transaction_make_packet(DnsTransaction *t) {
1607 _cleanup_(dns_packet_unrefp) DnsPacket *p = NULL;
1608 int r;
1609
1610 assert(t);
1611
1612 if (t->scope->protocol == DNS_PROTOCOL_MDNS)
1613 return dns_transaction_make_packet_mdns(t);
1614
1615 if (t->sent)
1616 return 0;
1617
1618 r = dns_packet_new_query(&p, t->scope->protocol, 0, t->scope->dnssec_mode != DNSSEC_NO);
1619 if (r < 0)
1620 return r;
1621
1622 r = dns_packet_append_key(p, t->key, 0, NULL);
1623 if (r < 0)
1624 return r;
1625
1626 DNS_PACKET_HEADER(p)->qdcount = htobe16(1);
1627 DNS_PACKET_HEADER(p)->id = t->id;
1628
1629 t->sent = TAKE_PTR(p);
1630
1631 return 0;
1632 }
1633
1634 int dns_transaction_go(DnsTransaction *t) {
1635 usec_t ts;
1636 int r;
1637 char key_str[DNS_RESOURCE_KEY_STRING_MAX];
1638
1639 assert(t);
1640
1641 /* Returns > 0 if the transaction is now pending, returns 0 if could be processed immediately and has finished
1642 * now. */
1643
1644 assert_se(sd_event_now(t->scope->manager->event, clock_boottime_or_monotonic(), &ts) >= 0);
1645
1646 r = dns_transaction_prepare(t, ts);
1647 if (r <= 0)
1648 return r;
1649
1650 log_debug("Transaction %" PRIu16 " for <%s> scope %s on %s/%s.",
1651 t->id,
1652 dns_resource_key_to_string(t->key, key_str, sizeof key_str),
1653 dns_protocol_to_string(t->scope->protocol),
1654 t->scope->link ? t->scope->link->name : "*",
1655 af_to_name_short(t->scope->family));
1656
1657 if (!t->initial_jitter_scheduled &&
1658 IN_SET(t->scope->protocol, DNS_PROTOCOL_LLMNR, DNS_PROTOCOL_MDNS)) {
1659 usec_t jitter, accuracy;
1660
1661 /* RFC 4795 Section 2.7 suggests all queries should be
1662 * delayed by a random time from 0 to JITTER_INTERVAL. */
1663
1664 t->initial_jitter_scheduled = true;
1665
1666 random_bytes(&jitter, sizeof(jitter));
1667
1668 switch (t->scope->protocol) {
1669
1670 case DNS_PROTOCOL_LLMNR:
1671 jitter %= LLMNR_JITTER_INTERVAL_USEC;
1672 accuracy = LLMNR_JITTER_INTERVAL_USEC;
1673 break;
1674
1675 case DNS_PROTOCOL_MDNS:
1676 jitter %= MDNS_JITTER_RANGE_USEC;
1677 jitter += MDNS_JITTER_MIN_USEC;
1678 accuracy = MDNS_JITTER_RANGE_USEC;
1679 break;
1680 default:
1681 assert_not_reached("bad protocol");
1682 }
1683
1684 r = sd_event_add_time(
1685 t->scope->manager->event,
1686 &t->timeout_event_source,
1687 clock_boottime_or_monotonic(),
1688 ts + jitter, accuracy,
1689 on_transaction_timeout, t);
1690 if (r < 0)
1691 return r;
1692
1693 (void) sd_event_source_set_description(t->timeout_event_source, "dns-transaction-timeout");
1694
1695 t->n_attempts = 0;
1696 t->next_attempt_after = ts;
1697 t->state = DNS_TRANSACTION_PENDING;
1698
1699 log_debug("Delaying %s transaction for " USEC_FMT "us.", dns_protocol_to_string(t->scope->protocol), jitter);
1700 return 0;
1701 }
1702
1703 /* Otherwise, we need to ask the network */
1704 r = dns_transaction_make_packet(t);
1705 if (r < 0)
1706 return r;
1707
1708 if (t->scope->protocol == DNS_PROTOCOL_LLMNR &&
1709 (dns_name_endswith(dns_resource_key_name(t->key), "in-addr.arpa") > 0 ||
1710 dns_name_endswith(dns_resource_key_name(t->key), "ip6.arpa") > 0)) {
1711
1712 /* RFC 4795, Section 2.4. says reverse lookups shall
1713 * always be made via TCP on LLMNR */
1714 r = dns_transaction_emit_tcp(t);
1715 } else {
1716 /* Try via UDP, and if that fails due to large size or lack of
1717 * support try via TCP */
1718 r = dns_transaction_emit_udp(t);
1719 if (r == -EMSGSIZE)
1720 log_debug("Sending query via TCP since it is too large.");
1721 else if (r == -EAGAIN)
1722 log_debug("Sending query via TCP since UDP isn't supported.");
1723 if (IN_SET(r, -EMSGSIZE, -EAGAIN))
1724 r = dns_transaction_emit_tcp(t);
1725 }
1726
1727 if (r == -ESRCH) {
1728 /* No servers to send this to? */
1729 dns_transaction_complete(t, DNS_TRANSACTION_NO_SERVERS);
1730 return 0;
1731 }
1732 if (r == -EOPNOTSUPP) {
1733 /* Tried to ask for DNSSEC RRs, on a server that doesn't do DNSSEC */
1734 dns_transaction_complete(t, DNS_TRANSACTION_RR_TYPE_UNSUPPORTED);
1735 return 0;
1736 }
1737 if (t->scope->protocol == DNS_PROTOCOL_LLMNR && ERRNO_IS_DISCONNECT(-r)) {
1738 /* On LLMNR, if we cannot connect to a host via TCP when doing reverse lookups. This means we cannot
1739 * answer this request with this protocol. */
1740 dns_transaction_complete(t, DNS_TRANSACTION_NOT_FOUND);
1741 return 0;
1742 }
1743 if (r < 0) {
1744 if (t->scope->protocol != DNS_PROTOCOL_DNS)
1745 return r;
1746
1747 /* Couldn't send? Try immediately again, with a new server */
1748 dns_scope_next_dns_server(t->scope);
1749
1750 return dns_transaction_go(t);
1751 }
1752
1753 ts += transaction_get_resend_timeout(t);
1754
1755 r = sd_event_add_time(
1756 t->scope->manager->event,
1757 &t->timeout_event_source,
1758 clock_boottime_or_monotonic(),
1759 ts, 0,
1760 on_transaction_timeout, t);
1761 if (r < 0)
1762 return r;
1763
1764 (void) sd_event_source_set_description(t->timeout_event_source, "dns-transaction-timeout");
1765
1766 t->state = DNS_TRANSACTION_PENDING;
1767 t->next_attempt_after = ts;
1768
1769 return 1;
1770 }
1771
1772 static int dns_transaction_find_cyclic(DnsTransaction *t, DnsTransaction *aux) {
1773 DnsTransaction *n;
1774 Iterator i;
1775 int r;
1776
1777 assert(t);
1778 assert(aux);
1779
1780 /* Try to find cyclic dependencies between transaction objects */
1781
1782 if (t == aux)
1783 return 1;
1784
1785 SET_FOREACH(n, aux->dnssec_transactions, i) {
1786 r = dns_transaction_find_cyclic(t, n);
1787 if (r != 0)
1788 return r;
1789 }
1790
1791 return 0;
1792 }
1793
1794 static int dns_transaction_add_dnssec_transaction(DnsTransaction *t, DnsResourceKey *key, DnsTransaction **ret) {
1795 DnsTransaction *aux;
1796 int r;
1797
1798 assert(t);
1799 assert(ret);
1800 assert(key);
1801
1802 aux = dns_scope_find_transaction(t->scope, key, true);
1803 if (!aux) {
1804 r = dns_transaction_new(&aux, t->scope, key);
1805 if (r < 0)
1806 return r;
1807 } else {
1808 if (set_contains(t->dnssec_transactions, aux)) {
1809 *ret = aux;
1810 return 0;
1811 }
1812
1813 r = dns_transaction_find_cyclic(t, aux);
1814 if (r < 0)
1815 return r;
1816 if (r > 0) {
1817 char s[DNS_RESOURCE_KEY_STRING_MAX], saux[DNS_RESOURCE_KEY_STRING_MAX];
1818
1819 log_debug("Potential cyclic dependency, refusing to add transaction %" PRIu16 " (%s) as dependency for %" PRIu16 " (%s).",
1820 aux->id,
1821 dns_resource_key_to_string(t->key, s, sizeof s),
1822 t->id,
1823 dns_resource_key_to_string(aux->key, saux, sizeof saux));
1824
1825 return -ELOOP;
1826 }
1827 }
1828
1829 r = set_ensure_allocated(&t->dnssec_transactions, NULL);
1830 if (r < 0)
1831 goto gc;
1832
1833 r = set_ensure_allocated(&aux->notify_transactions, NULL);
1834 if (r < 0)
1835 goto gc;
1836
1837 r = set_ensure_allocated(&aux->notify_transactions_done, NULL);
1838 if (r < 0)
1839 goto gc;
1840
1841 r = set_put(t->dnssec_transactions, aux);
1842 if (r < 0)
1843 goto gc;
1844
1845 r = set_put(aux->notify_transactions, t);
1846 if (r < 0) {
1847 (void) set_remove(t->dnssec_transactions, aux);
1848 goto gc;
1849 }
1850
1851 *ret = aux;
1852 return 1;
1853
1854 gc:
1855 dns_transaction_gc(aux);
1856 return r;
1857 }
1858
1859 static int dns_transaction_request_dnssec_rr(DnsTransaction *t, DnsResourceKey *key) {
1860 _cleanup_(dns_answer_unrefp) DnsAnswer *a = NULL;
1861 DnsTransaction *aux;
1862 int r;
1863
1864 assert(t);
1865 assert(key);
1866
1867 /* Try to get the data from the trust anchor */
1868 r = dns_trust_anchor_lookup_positive(&t->scope->manager->trust_anchor, key, &a);
1869 if (r < 0)
1870 return r;
1871 if (r > 0) {
1872 r = dns_answer_extend(&t->validated_keys, a);
1873 if (r < 0)
1874 return r;
1875
1876 return 0;
1877 }
1878
1879 /* This didn't work, ask for it via the network/cache then. */
1880 r = dns_transaction_add_dnssec_transaction(t, key, &aux);
1881 if (r == -ELOOP) /* This would result in a cyclic dependency */
1882 return 0;
1883 if (r < 0)
1884 return r;
1885
1886 if (aux->state == DNS_TRANSACTION_NULL) {
1887 r = dns_transaction_go(aux);
1888 if (r < 0)
1889 return r;
1890 }
1891
1892 return 1;
1893 }
1894
1895 static int dns_transaction_negative_trust_anchor_lookup(DnsTransaction *t, const char *name) {
1896 int r;
1897
1898 assert(t);
1899
1900 /* Check whether the specified name is in the NTA
1901 * database, either in the global one, or the link-local
1902 * one. */
1903
1904 r = dns_trust_anchor_lookup_negative(&t->scope->manager->trust_anchor, name);
1905 if (r != 0)
1906 return r;
1907
1908 if (!t->scope->link)
1909 return 0;
1910
1911 return set_contains(t->scope->link->dnssec_negative_trust_anchors, name);
1912 }
1913
1914 static int dns_transaction_has_unsigned_negative_answer(DnsTransaction *t) {
1915 int r;
1916
1917 assert(t);
1918
1919 /* Checks whether the answer is negative, and lacks NSEC/NSEC3
1920 * RRs to prove it */
1921
1922 r = dns_transaction_has_positive_answer(t, NULL);
1923 if (r < 0)
1924 return r;
1925 if (r > 0)
1926 return false;
1927
1928 /* Is this key explicitly listed as a negative trust anchor?
1929 * If so, it's nothing we need to care about */
1930 r = dns_transaction_negative_trust_anchor_lookup(t, dns_resource_key_name(t->key));
1931 if (r < 0)
1932 return r;
1933 if (r > 0)
1934 return false;
1935
1936 /* The answer does not contain any RRs that match to the
1937 * question. If so, let's see if there are any NSEC/NSEC3 RRs
1938 * included. If not, the answer is unsigned. */
1939
1940 r = dns_answer_contains_nsec_or_nsec3(t->answer);
1941 if (r < 0)
1942 return r;
1943 if (r > 0)
1944 return false;
1945
1946 return true;
1947 }
1948
1949 static int dns_transaction_is_primary_response(DnsTransaction *t, DnsResourceRecord *rr) {
1950 int r;
1951
1952 assert(t);
1953 assert(rr);
1954
1955 /* Check if the specified RR is the "primary" response,
1956 * i.e. either matches the question precisely or is a
1957 * CNAME/DNAME for it. */
1958
1959 r = dns_resource_key_match_rr(t->key, rr, NULL);
1960 if (r != 0)
1961 return r;
1962
1963 return dns_resource_key_match_cname_or_dname(t->key, rr->key, NULL);
1964 }
1965
1966 static bool dns_transaction_dnssec_supported(DnsTransaction *t) {
1967 assert(t);
1968
1969 /* Checks whether our transaction's DNS server is assumed to be compatible with DNSSEC. Returns false as soon
1970 * as we changed our mind about a server, and now believe it is incompatible with DNSSEC. */
1971
1972 if (t->scope->protocol != DNS_PROTOCOL_DNS)
1973 return false;
1974
1975 /* If we have picked no server, then we are working from the cache or some other source, and DNSSEC might well
1976 * be supported, hence return true. */
1977 if (!t->server)
1978 return true;
1979
1980 /* Note that we do not check the feature level actually used for the transaction but instead the feature level
1981 * the server is known to support currently, as the transaction feature level might be lower than what the
1982 * server actually supports, since we might have downgraded this transaction's feature level because we got a
1983 * SERVFAIL earlier and wanted to check whether downgrading fixes it. */
1984
1985 return dns_server_dnssec_supported(t->server);
1986 }
1987
1988 static bool dns_transaction_dnssec_supported_full(DnsTransaction *t) {
1989 DnsTransaction *dt;
1990 Iterator i;
1991
1992 assert(t);
1993
1994 /* Checks whether our transaction our any of the auxiliary transactions couldn't do DNSSEC. */
1995
1996 if (!dns_transaction_dnssec_supported(t))
1997 return false;
1998
1999 SET_FOREACH(dt, t->dnssec_transactions, i)
2000 if (!dns_transaction_dnssec_supported(dt))
2001 return false;
2002
2003 return true;
2004 }
2005
2006 int dns_transaction_request_dnssec_keys(DnsTransaction *t) {
2007 DnsResourceRecord *rr;
2008
2009 int r;
2010
2011 assert(t);
2012
2013 /*
2014 * Retrieve all auxiliary RRs for the answer we got, so that
2015 * we can verify signatures or prove that RRs are rightfully
2016 * unsigned. Specifically:
2017 *
2018 * - For RRSIG we get the matching DNSKEY
2019 * - For DNSKEY we get the matching DS
2020 * - For unsigned SOA/NS we get the matching DS
2021 * - For unsigned CNAME/DNAME/DS we get the parent SOA RR
2022 * - For other unsigned RRs we get the matching SOA RR
2023 * - For SOA/NS queries with no matching response RR, and no NSEC/NSEC3, the DS RR
2024 * - For DS queries with no matching response RRs, and no NSEC/NSEC3, the parent's SOA RR
2025 * - For other queries with no matching response RRs, and no NSEC/NSEC3, the SOA RR
2026 */
2027
2028 if (t->scope->dnssec_mode == DNSSEC_NO)
2029 return 0;
2030 if (t->answer_source != DNS_TRANSACTION_NETWORK)
2031 return 0; /* We only need to validate stuff from the network */
2032 if (!dns_transaction_dnssec_supported(t))
2033 return 0; /* If we can't do DNSSEC anyway there's no point in geting the auxiliary RRs */
2034
2035 DNS_ANSWER_FOREACH(rr, t->answer) {
2036
2037 if (dns_type_is_pseudo(rr->key->type))
2038 continue;
2039
2040 /* If this RR is in the negative trust anchor, we don't need to validate it. */
2041 r = dns_transaction_negative_trust_anchor_lookup(t, dns_resource_key_name(rr->key));
2042 if (r < 0)
2043 return r;
2044 if (r > 0)
2045 continue;
2046
2047 switch (rr->key->type) {
2048
2049 case DNS_TYPE_RRSIG: {
2050 /* For each RRSIG we request the matching DNSKEY */
2051 _cleanup_(dns_resource_key_unrefp) DnsResourceKey *dnskey = NULL;
2052
2053 /* If this RRSIG is about a DNSKEY RR and the
2054 * signer is the same as the owner, then we
2055 * already have the DNSKEY, and we don't have
2056 * to look for more. */
2057 if (rr->rrsig.type_covered == DNS_TYPE_DNSKEY) {
2058 r = dns_name_equal(rr->rrsig.signer, dns_resource_key_name(rr->key));
2059 if (r < 0)
2060 return r;
2061 if (r > 0)
2062 continue;
2063 }
2064
2065 /* If the signer is not a parent of our
2066 * original query, then this is about an
2067 * auxiliary RRset, but not anything we asked
2068 * for. In this case we aren't interested,
2069 * because we don't want to request additional
2070 * RRs for stuff we didn't really ask for, and
2071 * also to avoid request loops, where
2072 * additional RRs from one transaction result
2073 * in another transaction whose additonal RRs
2074 * point back to the original transaction, and
2075 * we deadlock. */
2076 r = dns_name_endswith(dns_resource_key_name(t->key), rr->rrsig.signer);
2077 if (r < 0)
2078 return r;
2079 if (r == 0)
2080 continue;
2081
2082 dnskey = dns_resource_key_new(rr->key->class, DNS_TYPE_DNSKEY, rr->rrsig.signer);
2083 if (!dnskey)
2084 return -ENOMEM;
2085
2086 log_debug("Requesting DNSKEY to validate transaction %" PRIu16" (%s, RRSIG with key tag: %" PRIu16 ").",
2087 t->id, dns_resource_key_name(rr->key), rr->rrsig.key_tag);
2088 r = dns_transaction_request_dnssec_rr(t, dnskey);
2089 if (r < 0)
2090 return r;
2091 break;
2092 }
2093
2094 case DNS_TYPE_DNSKEY: {
2095 /* For each DNSKEY we request the matching DS */
2096 _cleanup_(dns_resource_key_unrefp) DnsResourceKey *ds = NULL;
2097
2098 /* If the DNSKEY we are looking at is not for
2099 * zone we are interested in, nor any of its
2100 * parents, we aren't interested, and don't
2101 * request it. After all, we don't want to end
2102 * up in request loops, and want to keep
2103 * additional traffic down. */
2104
2105 r = dns_name_endswith(dns_resource_key_name(t->key), dns_resource_key_name(rr->key));
2106 if (r < 0)
2107 return r;
2108 if (r == 0)
2109 continue;
2110
2111 ds = dns_resource_key_new(rr->key->class, DNS_TYPE_DS, dns_resource_key_name(rr->key));
2112 if (!ds)
2113 return -ENOMEM;
2114
2115 log_debug("Requesting DS to validate transaction %" PRIu16" (%s, DNSKEY with key tag: %" PRIu16 ").",
2116 t->id, dns_resource_key_name(rr->key), dnssec_keytag(rr, false));
2117 r = dns_transaction_request_dnssec_rr(t, ds);
2118 if (r < 0)
2119 return r;
2120
2121 break;
2122 }
2123
2124 case DNS_TYPE_SOA:
2125 case DNS_TYPE_NS: {
2126 _cleanup_(dns_resource_key_unrefp) DnsResourceKey *ds = NULL;
2127
2128 /* For an unsigned SOA or NS, try to acquire
2129 * the matching DS RR, as we are at a zone cut
2130 * then, and whether a DS exists tells us
2131 * whether the zone is signed. Do so only if
2132 * this RR matches our original question,
2133 * however. */
2134
2135 r = dns_resource_key_match_rr(t->key, rr, NULL);
2136 if (r < 0)
2137 return r;
2138 if (r == 0) {
2139 /* Hmm, so this SOA RR doesn't match our original question. In this case, maybe this is
2140 * a negative reply, and we need the a SOA RR's TTL in order to cache a negative entry?
2141 * If so, we need to validate it, too. */
2142
2143 r = dns_answer_match_key(t->answer, t->key, NULL);
2144 if (r < 0)
2145 return r;
2146 if (r > 0) /* positive reply, we won't need the SOA and hence don't need to validate
2147 * it. */
2148 continue;
2149 }
2150
2151 r = dnssec_has_rrsig(t->answer, rr->key);
2152 if (r < 0)
2153 return r;
2154 if (r > 0)
2155 continue;
2156
2157 ds = dns_resource_key_new(rr->key->class, DNS_TYPE_DS, dns_resource_key_name(rr->key));
2158 if (!ds)
2159 return -ENOMEM;
2160
2161 log_debug("Requesting DS to validate transaction %" PRIu16 " (%s, unsigned SOA/NS RRset).",
2162 t->id, dns_resource_key_name(rr->key));
2163 r = dns_transaction_request_dnssec_rr(t, ds);
2164 if (r < 0)
2165 return r;
2166
2167 break;
2168 }
2169
2170 case DNS_TYPE_DS:
2171 case DNS_TYPE_CNAME:
2172 case DNS_TYPE_DNAME: {
2173 _cleanup_(dns_resource_key_unrefp) DnsResourceKey *soa = NULL;
2174 const char *name;
2175
2176 /* CNAMEs and DNAMEs cannot be located at a
2177 * zone apex, hence ask for the parent SOA for
2178 * unsigned CNAME/DNAME RRs, maybe that's the
2179 * apex. But do all that only if this is
2180 * actually a response to our original
2181 * question.
2182 *
2183 * Similar for DS RRs, which are signed when
2184 * the parent SOA is signed. */
2185
2186 r = dns_transaction_is_primary_response(t, rr);
2187 if (r < 0)
2188 return r;
2189 if (r == 0)
2190 continue;
2191
2192 r = dnssec_has_rrsig(t->answer, rr->key);
2193 if (r < 0)
2194 return r;
2195 if (r > 0)
2196 continue;
2197
2198 r = dns_answer_has_dname_for_cname(t->answer, rr);
2199 if (r < 0)
2200 return r;
2201 if (r > 0)
2202 continue;
2203
2204 name = dns_resource_key_name(rr->key);
2205 r = dns_name_parent(&name);
2206 if (r < 0)
2207 return r;
2208 if (r == 0)
2209 continue;
2210
2211 soa = dns_resource_key_new(rr->key->class, DNS_TYPE_SOA, name);
2212 if (!soa)
2213 return -ENOMEM;
2214
2215 log_debug("Requesting parent SOA to validate transaction %" PRIu16 " (%s, unsigned CNAME/DNAME/DS RRset).",
2216 t->id, dns_resource_key_name(rr->key));
2217 r = dns_transaction_request_dnssec_rr(t, soa);
2218 if (r < 0)
2219 return r;
2220
2221 break;
2222 }
2223
2224 default: {
2225 _cleanup_(dns_resource_key_unrefp) DnsResourceKey *soa = NULL;
2226
2227 /* For other unsigned RRsets (including
2228 * NSEC/NSEC3!), look for proof the zone is
2229 * unsigned, by requesting the SOA RR of the
2230 * zone. However, do so only if they are
2231 * directly relevant to our original
2232 * question. */
2233
2234 r = dns_transaction_is_primary_response(t, rr);
2235 if (r < 0)
2236 return r;
2237 if (r == 0)
2238 continue;
2239
2240 r = dnssec_has_rrsig(t->answer, rr->key);
2241 if (r < 0)
2242 return r;
2243 if (r > 0)
2244 continue;
2245
2246 soa = dns_resource_key_new(rr->key->class, DNS_TYPE_SOA, dns_resource_key_name(rr->key));
2247 if (!soa)
2248 return -ENOMEM;
2249
2250 log_debug("Requesting SOA to validate transaction %" PRIu16 " (%s, unsigned non-SOA/NS RRset <%s>).",
2251 t->id, dns_resource_key_name(rr->key), dns_resource_record_to_string(rr));
2252 r = dns_transaction_request_dnssec_rr(t, soa);
2253 if (r < 0)
2254 return r;
2255 break;
2256 }}
2257 }
2258
2259 /* Above, we requested everything necessary to validate what
2260 * we got. Now, let's request what we need to validate what we
2261 * didn't get... */
2262
2263 r = dns_transaction_has_unsigned_negative_answer(t);
2264 if (r < 0)
2265 return r;
2266 if (r > 0) {
2267 const char *name;
2268 uint16_t type = 0;
2269
2270 name = dns_resource_key_name(t->key);
2271
2272 /* If this was a SOA or NS request, then check if there's a DS RR for the same domain. Note that this
2273 * could also be used as indication that we are not at a zone apex, but in real world setups there are
2274 * too many broken DNS servers (Hello, incapdns.net!) where non-terminal zones return NXDOMAIN even
2275 * though they have further children. If this was a DS request, then it's signed when the parent zone
2276 * is signed, hence ask the parent SOA in that case. If this was any other RR then ask for the SOA RR,
2277 * to see if that is signed. */
2278
2279 if (t->key->type == DNS_TYPE_DS) {
2280 r = dns_name_parent(&name);
2281 if (r > 0) {
2282 type = DNS_TYPE_SOA;
2283 log_debug("Requesting parent SOA to validate transaction %" PRIu16 " (%s, unsigned empty DS response).",
2284 t->id, dns_resource_key_name(t->key));
2285 } else
2286 name = NULL;
2287
2288 } else if (IN_SET(t->key->type, DNS_TYPE_SOA, DNS_TYPE_NS)) {
2289
2290 type = DNS_TYPE_DS;
2291 log_debug("Requesting DS to validate transaction %" PRIu16 " (%s, unsigned empty SOA/NS response).",
2292 t->id, dns_resource_key_name(t->key));
2293
2294 } else {
2295 type = DNS_TYPE_SOA;
2296 log_debug("Requesting SOA to validate transaction %" PRIu16 " (%s, unsigned empty non-SOA/NS/DS response).",
2297 t->id, dns_resource_key_name(t->key));
2298 }
2299
2300 if (name) {
2301 _cleanup_(dns_resource_key_unrefp) DnsResourceKey *soa = NULL;
2302
2303 soa = dns_resource_key_new(t->key->class, type, name);
2304 if (!soa)
2305 return -ENOMEM;
2306
2307 r = dns_transaction_request_dnssec_rr(t, soa);
2308 if (r < 0)
2309 return r;
2310 }
2311 }
2312
2313 return dns_transaction_dnssec_is_live(t);
2314 }
2315
2316 void dns_transaction_notify(DnsTransaction *t, DnsTransaction *source) {
2317 assert(t);
2318 assert(source);
2319
2320 /* Invoked whenever any of our auxiliary DNSSEC transactions completed its work. If the state is still PENDING,
2321 we are still in the loop that adds further DNSSEC transactions, hence don't check if we are ready yet. If
2322 the state is VALIDATING however, we should check if we are complete now. */
2323
2324 if (t->state == DNS_TRANSACTION_VALIDATING)
2325 dns_transaction_process_dnssec(t);
2326 }
2327
2328 static int dns_transaction_validate_dnskey_by_ds(DnsTransaction *t) {
2329 DnsResourceRecord *rr;
2330 int ifindex, r;
2331
2332 assert(t);
2333
2334 /* Add all DNSKEY RRs from the answer that are validated by DS
2335 * RRs from the list of validated keys to the list of
2336 * validated keys. */
2337
2338 DNS_ANSWER_FOREACH_IFINDEX(rr, ifindex, t->answer) {
2339
2340 r = dnssec_verify_dnskey_by_ds_search(rr, t->validated_keys);
2341 if (r < 0)
2342 return r;
2343 if (r == 0)
2344 continue;
2345
2346 /* If so, the DNSKEY is validated too. */
2347 r = dns_answer_add_extend(&t->validated_keys, rr, ifindex, DNS_ANSWER_AUTHENTICATED);
2348 if (r < 0)
2349 return r;
2350 }
2351
2352 return 0;
2353 }
2354
2355 static int dns_transaction_requires_rrsig(DnsTransaction *t, DnsResourceRecord *rr) {
2356 int r;
2357
2358 assert(t);
2359 assert(rr);
2360
2361 /* Checks if the RR we are looking for must be signed with an
2362 * RRSIG. This is used for positive responses. */
2363
2364 if (t->scope->dnssec_mode == DNSSEC_NO)
2365 return false;
2366
2367 if (dns_type_is_pseudo(rr->key->type))
2368 return -EINVAL;
2369
2370 r = dns_transaction_negative_trust_anchor_lookup(t, dns_resource_key_name(rr->key));
2371 if (r < 0)
2372 return r;
2373 if (r > 0)
2374 return false;
2375
2376 switch (rr->key->type) {
2377
2378 case DNS_TYPE_RRSIG:
2379 /* RRSIGs are the signatures themselves, they need no signing. */
2380 return false;
2381
2382 case DNS_TYPE_SOA:
2383 case DNS_TYPE_NS: {
2384 DnsTransaction *dt;
2385 Iterator i;
2386
2387 /* For SOA or NS RRs we look for a matching DS transaction */
2388
2389 SET_FOREACH(dt, t->dnssec_transactions, i) {
2390
2391 if (dt->key->class != rr->key->class)
2392 continue;
2393 if (dt->key->type != DNS_TYPE_DS)
2394 continue;
2395
2396 r = dns_name_equal(dns_resource_key_name(dt->key), dns_resource_key_name(rr->key));
2397 if (r < 0)
2398 return r;
2399 if (r == 0)
2400 continue;
2401
2402 /* We found a DS transactions for the SOA/NS
2403 * RRs we are looking at. If it discovered signed DS
2404 * RRs, then we need to be signed, too. */
2405
2406 if (!dt->answer_authenticated)
2407 return false;
2408
2409 return dns_answer_match_key(dt->answer, dt->key, NULL);
2410 }
2411
2412 /* We found nothing that proves this is safe to leave
2413 * this unauthenticated, hence ask inist on
2414 * authentication. */
2415 return true;
2416 }
2417
2418 case DNS_TYPE_DS:
2419 case DNS_TYPE_CNAME:
2420 case DNS_TYPE_DNAME: {
2421 const char *parent = NULL;
2422 DnsTransaction *dt;
2423 Iterator i;
2424
2425 /*
2426 * CNAME/DNAME RRs cannot be located at a zone apex, hence look directly for the parent SOA.
2427 *
2428 * DS RRs are signed if the parent is signed, hence also look at the parent SOA
2429 */
2430
2431 SET_FOREACH(dt, t->dnssec_transactions, i) {
2432
2433 if (dt->key->class != rr->key->class)
2434 continue;
2435 if (dt->key->type != DNS_TYPE_SOA)
2436 continue;
2437
2438 if (!parent) {
2439 parent = dns_resource_key_name(rr->key);
2440 r = dns_name_parent(&parent);
2441 if (r < 0)
2442 return r;
2443 if (r == 0) {
2444 if (rr->key->type == DNS_TYPE_DS)
2445 return true;
2446
2447 /* A CNAME/DNAME without a parent? That's sooo weird. */
2448 log_debug("Transaction %" PRIu16 " claims CNAME/DNAME at root. Refusing.", t->id);
2449 return -EBADMSG;
2450 }
2451 }
2452
2453 r = dns_name_equal(dns_resource_key_name(dt->key), parent);
2454 if (r < 0)
2455 return r;
2456 if (r == 0)
2457 continue;
2458
2459 return t->answer_authenticated;
2460 }
2461
2462 return true;
2463 }
2464
2465 default: {
2466 DnsTransaction *dt;
2467 Iterator i;
2468
2469 /* Any other kind of RR (including DNSKEY/NSEC/NSEC3). Let's see if our SOA lookup was authenticated */
2470
2471 SET_FOREACH(dt, t->dnssec_transactions, i) {
2472
2473 if (dt->key->class != rr->key->class)
2474 continue;
2475 if (dt->key->type != DNS_TYPE_SOA)
2476 continue;
2477
2478 r = dns_name_equal(dns_resource_key_name(dt->key), dns_resource_key_name(rr->key));
2479 if (r < 0)
2480 return r;
2481 if (r == 0)
2482 continue;
2483
2484 /* We found the transaction that was supposed to find
2485 * the SOA RR for us. It was successful, but found no
2486 * RR for us. This means we are not at a zone cut. In
2487 * this case, we require authentication if the SOA
2488 * lookup was authenticated too. */
2489 return t->answer_authenticated;
2490 }
2491
2492 return true;
2493 }}
2494 }
2495
2496 static int dns_transaction_in_private_tld(DnsTransaction *t, const DnsResourceKey *key) {
2497 DnsTransaction *dt;
2498 const char *tld;
2499 Iterator i;
2500 int r;
2501
2502 /* If DNSSEC downgrade mode is on, checks whether the
2503 * specified RR is one level below a TLD we have proven not to
2504 * exist. In such a case we assume that this is a private
2505 * domain, and permit it.
2506 *
2507 * This detects cases like the Fritz!Box router networks. Each
2508 * Fritz!Box router serves a private "fritz.box" zone, in the
2509 * non-existing TLD "box". Requests for the "fritz.box" domain
2510 * are served by the router itself, while requests for the
2511 * "box" domain will result in NXDOMAIN.
2512 *
2513 * Note that this logic is unable to detect cases where a
2514 * router serves a private DNS zone directly under
2515 * non-existing TLD. In such a case we cannot detect whether
2516 * the TLD is supposed to exist or not, as all requests we
2517 * make for it will be answered by the router's zone, and not
2518 * by the root zone. */
2519
2520 assert(t);
2521
2522 if (t->scope->dnssec_mode != DNSSEC_ALLOW_DOWNGRADE)
2523 return false; /* In strict DNSSEC mode what doesn't exist, doesn't exist */
2524
2525 tld = dns_resource_key_name(key);
2526 r = dns_name_parent(&tld);
2527 if (r < 0)
2528 return r;
2529 if (r == 0)
2530 return false; /* Already the root domain */
2531
2532 if (!dns_name_is_single_label(tld))
2533 return false;
2534
2535 SET_FOREACH(dt, t->dnssec_transactions, i) {
2536
2537 if (dt->key->class != key->class)
2538 continue;
2539
2540 r = dns_name_equal(dns_resource_key_name(dt->key), tld);
2541 if (r < 0)
2542 return r;
2543 if (r == 0)
2544 continue;
2545
2546 /* We found an auxiliary lookup we did for the TLD. If
2547 * that returned with NXDOMAIN, we know the TLD didn't
2548 * exist, and hence this might be a private zone. */
2549
2550 return dt->answer_rcode == DNS_RCODE_NXDOMAIN;
2551 }
2552
2553 return false;
2554 }
2555
2556 static int dns_transaction_requires_nsec(DnsTransaction *t) {
2557 char key_str[DNS_RESOURCE_KEY_STRING_MAX];
2558 DnsTransaction *dt;
2559 const char *name;
2560 uint16_t type = 0;
2561 Iterator i;
2562 int r;
2563
2564 assert(t);
2565
2566 /* Checks if we need to insist on NSEC/NSEC3 RRs for proving
2567 * this negative reply */
2568
2569 if (t->scope->dnssec_mode == DNSSEC_NO)
2570 return false;
2571
2572 if (dns_type_is_pseudo(t->key->type))
2573 return -EINVAL;
2574
2575 r = dns_transaction_negative_trust_anchor_lookup(t, dns_resource_key_name(t->key));
2576 if (r < 0)
2577 return r;
2578 if (r > 0)
2579 return false;
2580
2581 r = dns_transaction_in_private_tld(t, t->key);
2582 if (r < 0)
2583 return r;
2584 if (r > 0) {
2585 /* The lookup is from a TLD that is proven not to
2586 * exist, and we are in downgrade mode, hence ignore
2587 * that fact that we didn't get any NSEC RRs. */
2588
2589 log_info("Detected a negative query %s in a private DNS zone, permitting unsigned response.",
2590 dns_resource_key_to_string(t->key, key_str, sizeof key_str));
2591 return false;
2592 }
2593
2594 name = dns_resource_key_name(t->key);
2595
2596 if (t->key->type == DNS_TYPE_DS) {
2597
2598 /* We got a negative reply for this DS lookup? DS RRs are signed when their parent zone is signed,
2599 * hence check the parent SOA in this case. */
2600
2601 r = dns_name_parent(&name);
2602 if (r < 0)
2603 return r;
2604 if (r == 0)
2605 return true;
2606
2607 type = DNS_TYPE_SOA;
2608
2609 } else if (IN_SET(t->key->type, DNS_TYPE_SOA, DNS_TYPE_NS))
2610 /* We got a negative reply for this SOA/NS lookup? If so, check if there's a DS RR for this */
2611 type = DNS_TYPE_DS;
2612 else
2613 /* For all other negative replies, check for the SOA lookup */
2614 type = DNS_TYPE_SOA;
2615
2616 /* For all other RRs we check the SOA on the same level to see
2617 * if it's signed. */
2618
2619 SET_FOREACH(dt, t->dnssec_transactions, i) {
2620
2621 if (dt->key->class != t->key->class)
2622 continue;
2623 if (dt->key->type != type)
2624 continue;
2625
2626 r = dns_name_equal(dns_resource_key_name(dt->key), name);
2627 if (r < 0)
2628 return r;
2629 if (r == 0)
2630 continue;
2631
2632 return dt->answer_authenticated;
2633 }
2634
2635 /* If in doubt, require NSEC/NSEC3 */
2636 return true;
2637 }
2638
2639 static int dns_transaction_dnskey_authenticated(DnsTransaction *t, DnsResourceRecord *rr) {
2640 DnsResourceRecord *rrsig;
2641 bool found = false;
2642 int r;
2643
2644 /* Checks whether any of the DNSKEYs used for the RRSIGs for
2645 * the specified RRset is authenticated (i.e. has a matching
2646 * DS RR). */
2647
2648 r = dns_transaction_negative_trust_anchor_lookup(t, dns_resource_key_name(rr->key));
2649 if (r < 0)
2650 return r;
2651 if (r > 0)
2652 return false;
2653
2654 DNS_ANSWER_FOREACH(rrsig, t->answer) {
2655 DnsTransaction *dt;
2656 Iterator i;
2657
2658 r = dnssec_key_match_rrsig(rr->key, rrsig);
2659 if (r < 0)
2660 return r;
2661 if (r == 0)
2662 continue;
2663
2664 SET_FOREACH(dt, t->dnssec_transactions, i) {
2665
2666 if (dt->key->class != rr->key->class)
2667 continue;
2668
2669 if (dt->key->type == DNS_TYPE_DNSKEY) {
2670
2671 r = dns_name_equal(dns_resource_key_name(dt->key), rrsig->rrsig.signer);
2672 if (r < 0)
2673 return r;
2674 if (r == 0)
2675 continue;
2676
2677 /* OK, we found an auxiliary DNSKEY
2678 * lookup. If that lookup is
2679 * authenticated, report this. */
2680
2681 if (dt->answer_authenticated)
2682 return true;
2683
2684 found = true;
2685
2686 } else if (dt->key->type == DNS_TYPE_DS) {
2687
2688 r = dns_name_equal(dns_resource_key_name(dt->key), rrsig->rrsig.signer);
2689 if (r < 0)
2690 return r;
2691 if (r == 0)
2692 continue;
2693
2694 /* OK, we found an auxiliary DS
2695 * lookup. If that lookup is
2696 * authenticated and non-zero, we
2697 * won! */
2698
2699 if (!dt->answer_authenticated)
2700 return false;
2701
2702 return dns_answer_match_key(dt->answer, dt->key, NULL);
2703 }
2704 }
2705 }
2706
2707 return found ? false : -ENXIO;
2708 }
2709
2710 static int dns_transaction_known_signed(DnsTransaction *t, DnsResourceRecord *rr) {
2711 assert(t);
2712 assert(rr);
2713
2714 /* We know that the root domain is signed, hence if it appears
2715 * not to be signed, there's a problem with the DNS server */
2716
2717 return rr->key->class == DNS_CLASS_IN &&
2718 dns_name_is_root(dns_resource_key_name(rr->key));
2719 }
2720
2721 static int dns_transaction_check_revoked_trust_anchors(DnsTransaction *t) {
2722 DnsResourceRecord *rr;
2723 int r;
2724
2725 assert(t);
2726
2727 /* Maybe warn the user that we encountered a revoked DNSKEY
2728 * for a key from our trust anchor. Note that we don't care
2729 * whether the DNSKEY can be authenticated or not. It's
2730 * sufficient if it is self-signed. */
2731
2732 DNS_ANSWER_FOREACH(rr, t->answer) {
2733 r = dns_trust_anchor_check_revoked(&t->scope->manager->trust_anchor, rr, t->answer);
2734 if (r < 0)
2735 return r;
2736 }
2737
2738 return 0;
2739 }
2740
2741 static int dns_transaction_invalidate_revoked_keys(DnsTransaction *t) {
2742 bool changed;
2743 int r;
2744
2745 assert(t);
2746
2747 /* Removes all DNSKEY/DS objects from t->validated_keys that
2748 * our trust anchors database considers revoked. */
2749
2750 do {
2751 DnsResourceRecord *rr;
2752
2753 changed = false;
2754
2755 DNS_ANSWER_FOREACH(rr, t->validated_keys) {
2756 r = dns_trust_anchor_is_revoked(&t->scope->manager->trust_anchor, rr);
2757 if (r < 0)
2758 return r;
2759 if (r > 0) {
2760 r = dns_answer_remove_by_rr(&t->validated_keys, rr);
2761 if (r < 0)
2762 return r;
2763
2764 assert(r > 0);
2765 changed = true;
2766 break;
2767 }
2768 }
2769 } while (changed);
2770
2771 return 0;
2772 }
2773
2774 static int dns_transaction_copy_validated(DnsTransaction *t) {
2775 DnsTransaction *dt;
2776 Iterator i;
2777 int r;
2778
2779 assert(t);
2780
2781 /* Copy all validated RRs from the auxiliary DNSSEC transactions into our set of validated RRs */
2782
2783 SET_FOREACH(dt, t->dnssec_transactions, i) {
2784
2785 if (DNS_TRANSACTION_IS_LIVE(dt->state))
2786 continue;
2787
2788 if (!dt->answer_authenticated)
2789 continue;
2790
2791 r = dns_answer_extend(&t->validated_keys, dt->answer);
2792 if (r < 0)
2793 return r;
2794 }
2795
2796 return 0;
2797 }
2798
2799 typedef enum {
2800 DNSSEC_PHASE_DNSKEY, /* Phase #1, only validate DNSKEYs */
2801 DNSSEC_PHASE_NSEC, /* Phase #2, only validate NSEC+NSEC3 */
2802 DNSSEC_PHASE_ALL, /* Phase #3, validate everything else */
2803 } Phase;
2804
2805 static int dnssec_validate_records(
2806 DnsTransaction *t,
2807 Phase phase,
2808 bool *have_nsec,
2809 DnsAnswer **validated) {
2810
2811 DnsResourceRecord *rr;
2812 int r;
2813
2814 /* Returns negative on error, 0 if validation failed, 1 to restart validation, 2 when finished. */
2815
2816 DNS_ANSWER_FOREACH(rr, t->answer) {
2817 DnsResourceRecord *rrsig = NULL;
2818 DnssecResult result;
2819
2820 switch (rr->key->type) {
2821 case DNS_TYPE_RRSIG:
2822 continue;
2823
2824 case DNS_TYPE_DNSKEY:
2825 /* We validate DNSKEYs only in the DNSKEY and ALL phases */
2826 if (phase == DNSSEC_PHASE_NSEC)
2827 continue;
2828 break;
2829
2830 case DNS_TYPE_NSEC:
2831 case DNS_TYPE_NSEC3:
2832 *have_nsec = true;
2833
2834 /* We validate NSEC/NSEC3 only in the NSEC and ALL phases */
2835 if (phase == DNSSEC_PHASE_DNSKEY)
2836 continue;
2837 break;
2838
2839 default:
2840 /* We validate all other RRs only in the ALL phases */
2841 if (phase != DNSSEC_PHASE_ALL)
2842 continue;
2843 }
2844
2845 r = dnssec_verify_rrset_search(t->answer, rr->key, t->validated_keys, USEC_INFINITY, &result, &rrsig);
2846 if (r < 0)
2847 return r;
2848
2849 log_debug("Looking at %s: %s", strna(dns_resource_record_to_string(rr)), dnssec_result_to_string(result));
2850
2851 if (result == DNSSEC_VALIDATED) {
2852
2853 if (rr->key->type == DNS_TYPE_DNSKEY) {
2854 /* If we just validated a DNSKEY RRset, then let's add these keys to
2855 * the set of validated keys for this transaction. */
2856
2857 r = dns_answer_copy_by_key(&t->validated_keys, t->answer, rr->key, DNS_ANSWER_AUTHENTICATED);
2858 if (r < 0)
2859 return r;
2860
2861 /* Some of the DNSKEYs we just added might already have been revoked,
2862 * remove them again in that case. */
2863 r = dns_transaction_invalidate_revoked_keys(t);
2864 if (r < 0)
2865 return r;
2866 }
2867
2868 /* Add the validated RRset to the new list of validated
2869 * RRsets, and remove it from the unvalidated RRsets.
2870 * We mark the RRset as authenticated and cacheable. */
2871 r = dns_answer_move_by_key(validated, &t->answer, rr->key, DNS_ANSWER_AUTHENTICATED|DNS_ANSWER_CACHEABLE);
2872 if (r < 0)
2873 return r;
2874
2875 manager_dnssec_verdict(t->scope->manager, DNSSEC_SECURE, rr->key);
2876
2877 /* Exit the loop, we dropped something from the answer, start from the beginning */
2878 return 1;
2879 }
2880
2881 /* If we haven't read all DNSKEYs yet a negative result of the validation is irrelevant, as
2882 * there might be more DNSKEYs coming. Similar, if we haven't read all NSEC/NSEC3 RRs yet,
2883 * we cannot do positive wildcard proofs yet, as those require the NSEC/NSEC3 RRs. */
2884 if (phase != DNSSEC_PHASE_ALL)
2885 continue;
2886
2887 if (result == DNSSEC_VALIDATED_WILDCARD) {
2888 bool authenticated = false;
2889 const char *source;
2890
2891 /* This RRset validated, but as a wildcard. This means we need
2892 * to prove via NSEC/NSEC3 that no matching non-wildcard RR exists. */
2893
2894 /* First step, determine the source of synthesis */
2895 r = dns_resource_record_source(rrsig, &source);
2896 if (r < 0)
2897 return r;
2898
2899 r = dnssec_test_positive_wildcard(*validated,
2900 dns_resource_key_name(rr->key),
2901 source,
2902 rrsig->rrsig.signer,
2903 &authenticated);
2904
2905 /* Unless the NSEC proof showed that the key really doesn't exist something is off. */
2906 if (r == 0)
2907 result = DNSSEC_INVALID;
2908 else {
2909 r = dns_answer_move_by_key(validated, &t->answer, rr->key,
2910 authenticated ? (DNS_ANSWER_AUTHENTICATED|DNS_ANSWER_CACHEABLE) : 0);
2911 if (r < 0)
2912 return r;
2913
2914 manager_dnssec_verdict(t->scope->manager, authenticated ? DNSSEC_SECURE : DNSSEC_INSECURE, rr->key);
2915
2916 /* Exit the loop, we dropped something from the answer, start from the beginning */
2917 return 1;
2918 }
2919 }
2920
2921 if (result == DNSSEC_NO_SIGNATURE) {
2922 r = dns_transaction_requires_rrsig(t, rr);
2923 if (r < 0)
2924 return r;
2925 if (r == 0) {
2926 /* Data does not require signing. In that case, just copy it over,
2927 * but remember that this is by no means authenticated. */
2928 r = dns_answer_move_by_key(validated, &t->answer, rr->key, 0);
2929 if (r < 0)
2930 return r;
2931
2932 manager_dnssec_verdict(t->scope->manager, DNSSEC_INSECURE, rr->key);
2933 return 1;
2934 }
2935
2936 r = dns_transaction_known_signed(t, rr);
2937 if (r < 0)
2938 return r;
2939 if (r > 0) {
2940 /* This is an RR we know has to be signed. If it isn't this means
2941 * the server is not attaching RRSIGs, hence complain. */
2942
2943 dns_server_packet_rrsig_missing(t->server, t->current_feature_level);
2944
2945 if (t->scope->dnssec_mode == DNSSEC_ALLOW_DOWNGRADE) {
2946
2947 /* Downgrading is OK? If so, just consider the information unsigned */
2948
2949 r = dns_answer_move_by_key(validated, &t->answer, rr->key, 0);
2950 if (r < 0)
2951 return r;
2952
2953 manager_dnssec_verdict(t->scope->manager, DNSSEC_INSECURE, rr->key);
2954 return 1;
2955 }
2956
2957 /* Otherwise, fail */
2958 t->answer_dnssec_result = DNSSEC_INCOMPATIBLE_SERVER;
2959 return 0;
2960 }
2961
2962 r = dns_transaction_in_private_tld(t, rr->key);
2963 if (r < 0)
2964 return r;
2965 if (r > 0) {
2966 char s[DNS_RESOURCE_KEY_STRING_MAX];
2967
2968 /* The data is from a TLD that is proven not to exist, and we are in downgrade
2969 * mode, hence ignore the fact that this was not signed. */
2970
2971 log_info("Detected RRset %s is in a private DNS zone, permitting unsigned RRs.",
2972 dns_resource_key_to_string(rr->key, s, sizeof s));
2973
2974 r = dns_answer_move_by_key(validated, &t->answer, rr->key, 0);
2975 if (r < 0)
2976 return r;
2977
2978 manager_dnssec_verdict(t->scope->manager, DNSSEC_INSECURE, rr->key);
2979 return 1;
2980 }
2981 }
2982
2983 if (IN_SET(result,
2984 DNSSEC_MISSING_KEY,
2985 DNSSEC_SIGNATURE_EXPIRED,
2986 DNSSEC_UNSUPPORTED_ALGORITHM)) {
2987
2988 r = dns_transaction_dnskey_authenticated(t, rr);
2989 if (r < 0 && r != -ENXIO)
2990 return r;
2991 if (r == 0) {
2992 /* The DNSKEY transaction was not authenticated, this means there's
2993 * no DS for this, which means it's OK if no keys are found for this signature. */
2994
2995 r = dns_answer_move_by_key(validated, &t->answer, rr->key, 0);
2996 if (r < 0)
2997 return r;
2998
2999 manager_dnssec_verdict(t->scope->manager, DNSSEC_INSECURE, rr->key);
3000 return 1;
3001 }
3002 }
3003
3004 r = dns_transaction_is_primary_response(t, rr);
3005 if (r < 0)
3006 return r;
3007 if (r > 0) {
3008 /* Look for a matching DNAME for this CNAME */
3009 r = dns_answer_has_dname_for_cname(t->answer, rr);
3010 if (r < 0)
3011 return r;
3012 if (r == 0) {
3013 /* Also look among the stuff we already validated */
3014 r = dns_answer_has_dname_for_cname(*validated, rr);
3015 if (r < 0)
3016 return r;
3017 }
3018
3019 if (r == 0) {
3020 if (IN_SET(result,
3021 DNSSEC_INVALID,
3022 DNSSEC_SIGNATURE_EXPIRED,
3023 DNSSEC_NO_SIGNATURE))
3024 manager_dnssec_verdict(t->scope->manager, DNSSEC_BOGUS, rr->key);
3025 else /* DNSSEC_MISSING_KEY or DNSSEC_UNSUPPORTED_ALGORITHM */
3026 manager_dnssec_verdict(t->scope->manager, DNSSEC_INDETERMINATE, rr->key);
3027
3028 /* This is a primary response to our question, and it failed validation.
3029 * That's fatal. */
3030 t->answer_dnssec_result = result;
3031 return 0;
3032 }
3033
3034 /* This is a primary response, but we do have a DNAME RR
3035 * in the RR that can replay this CNAME, hence rely on
3036 * that, and we can remove the CNAME in favour of it. */
3037 }
3038
3039 /* This is just some auxiliary data. Just remove the RRset and continue. */
3040 r = dns_answer_remove_by_key(&t->answer, rr->key);
3041 if (r < 0)
3042 return r;
3043
3044 /* We dropped something from the answer, start from the beginning. */
3045 return 1;
3046 }
3047
3048 return 2; /* Finito. */
3049 }
3050
3051 int dns_transaction_validate_dnssec(DnsTransaction *t) {
3052 _cleanup_(dns_answer_unrefp) DnsAnswer *validated = NULL;
3053 Phase phase;
3054 DnsAnswerFlags flags;
3055 int r;
3056 char key_str[DNS_RESOURCE_KEY_STRING_MAX];
3057
3058 assert(t);
3059
3060 /* We have now collected all DS and DNSKEY RRs in
3061 * t->validated_keys, let's see which RRs we can now
3062 * authenticate with that. */
3063
3064 if (t->scope->dnssec_mode == DNSSEC_NO)
3065 return 0;
3066
3067 /* Already validated */
3068 if (t->answer_dnssec_result != _DNSSEC_RESULT_INVALID)
3069 return 0;
3070
3071 /* Our own stuff needs no validation */
3072 if (IN_SET(t->answer_source, DNS_TRANSACTION_ZONE, DNS_TRANSACTION_TRUST_ANCHOR)) {
3073 t->answer_dnssec_result = DNSSEC_VALIDATED;
3074 t->answer_authenticated = true;
3075 return 0;
3076 }
3077
3078 /* Cached stuff is not affected by validation. */
3079 if (t->answer_source != DNS_TRANSACTION_NETWORK)
3080 return 0;
3081
3082 if (!dns_transaction_dnssec_supported_full(t)) {
3083 /* The server does not support DNSSEC, or doesn't augment responses with RRSIGs. */
3084 t->answer_dnssec_result = DNSSEC_INCOMPATIBLE_SERVER;
3085 log_debug("Not validating response for %" PRIu16 ", used server feature level does not support DNSSEC.", t->id);
3086 return 0;
3087 }
3088
3089 log_debug("Validating response from transaction %" PRIu16 " (%s).",
3090 t->id,
3091 dns_resource_key_to_string(t->key, key_str, sizeof key_str));
3092
3093 /* First, see if this response contains any revoked trust
3094 * anchors we care about */
3095 r = dns_transaction_check_revoked_trust_anchors(t);
3096 if (r < 0)
3097 return r;
3098
3099 /* Third, copy all RRs we acquired successfully from auxiliary RRs over. */
3100 r = dns_transaction_copy_validated(t);
3101 if (r < 0)
3102 return r;
3103
3104 /* Second, see if there are DNSKEYs we already know a
3105 * validated DS for. */
3106 r = dns_transaction_validate_dnskey_by_ds(t);
3107 if (r < 0)
3108 return r;
3109
3110 /* Fourth, remove all DNSKEY and DS RRs again that our trust
3111 * anchor says are revoked. After all we might have marked
3112 * some keys revoked above, but they might still be lingering
3113 * in our validated_keys list. */
3114 r = dns_transaction_invalidate_revoked_keys(t);
3115 if (r < 0)
3116 return r;
3117
3118 phase = DNSSEC_PHASE_DNSKEY;
3119 for (;;) {
3120 bool have_nsec = false;
3121
3122 r = dnssec_validate_records(t, phase, &have_nsec, &validated);
3123 if (r <= 0)
3124 return r;
3125
3126 /* Try again as long as we managed to achieve something */
3127 if (r == 1)
3128 continue;
3129
3130 if (phase == DNSSEC_PHASE_DNSKEY && have_nsec) {
3131 /* OK, we processed all DNSKEYs, and there are NSEC/NSEC3 RRs, look at those now. */
3132 phase = DNSSEC_PHASE_NSEC;
3133 continue;
3134 }
3135
3136 if (phase != DNSSEC_PHASE_ALL) {
3137 /* OK, we processed all DNSKEYs and NSEC/NSEC3 RRs, look at all the rest now.
3138 * Note that in this third phase we start to remove RRs we couldn't validate. */
3139 phase = DNSSEC_PHASE_ALL;
3140 continue;
3141 }
3142
3143 /* We're done */
3144 break;
3145 }
3146
3147 dns_answer_unref(t->answer);
3148 t->answer = TAKE_PTR(validated);
3149
3150 /* At this point the answer only contains validated
3151 * RRsets. Now, let's see if it actually answers the question
3152 * we asked. If so, great! If it doesn't, then see if
3153 * NSEC/NSEC3 can prove this. */
3154 r = dns_transaction_has_positive_answer(t, &flags);
3155 if (r > 0) {
3156 /* Yes, it answers the question! */
3157
3158 if (flags & DNS_ANSWER_AUTHENTICATED) {
3159 /* The answer is fully authenticated, yay. */
3160 t->answer_dnssec_result = DNSSEC_VALIDATED;
3161 t->answer_rcode = DNS_RCODE_SUCCESS;
3162 t->answer_authenticated = true;
3163 } else {
3164 /* The answer is not fully authenticated. */
3165 t->answer_dnssec_result = DNSSEC_UNSIGNED;
3166 t->answer_authenticated = false;
3167 }
3168
3169 } else if (r == 0) {
3170 DnssecNsecResult nr;
3171 bool authenticated = false;
3172
3173 /* Bummer! Let's check NSEC/NSEC3 */
3174 r = dnssec_nsec_test(t->answer, t->key, &nr, &authenticated, &t->answer_nsec_ttl);
3175 if (r < 0)
3176 return r;
3177
3178 switch (nr) {
3179
3180 case DNSSEC_NSEC_NXDOMAIN:
3181 /* NSEC proves the domain doesn't exist. Very good. */
3182 log_debug("Proved NXDOMAIN via NSEC/NSEC3 for transaction %u (%s)", t->id, key_str);
3183 t->answer_dnssec_result = DNSSEC_VALIDATED;
3184 t->answer_rcode = DNS_RCODE_NXDOMAIN;
3185 t->answer_authenticated = authenticated;
3186
3187 manager_dnssec_verdict(t->scope->manager, authenticated ? DNSSEC_SECURE : DNSSEC_INSECURE, t->key);
3188 break;
3189
3190 case DNSSEC_NSEC_NODATA:
3191 /* NSEC proves that there's no data here, very good. */
3192 log_debug("Proved NODATA via NSEC/NSEC3 for transaction %u (%s)", t->id, key_str);
3193 t->answer_dnssec_result = DNSSEC_VALIDATED;
3194 t->answer_rcode = DNS_RCODE_SUCCESS;
3195 t->answer_authenticated = authenticated;
3196
3197 manager_dnssec_verdict(t->scope->manager, authenticated ? DNSSEC_SECURE : DNSSEC_INSECURE, t->key);
3198 break;
3199
3200 case DNSSEC_NSEC_OPTOUT:
3201 /* NSEC3 says the data might not be signed */
3202 log_debug("Data is NSEC3 opt-out via NSEC/NSEC3 for transaction %u (%s)", t->id, key_str);
3203 t->answer_dnssec_result = DNSSEC_UNSIGNED;
3204 t->answer_authenticated = false;
3205
3206 manager_dnssec_verdict(t->scope->manager, DNSSEC_INSECURE, t->key);
3207 break;
3208
3209 case DNSSEC_NSEC_NO_RR:
3210 /* No NSEC data? Bummer! */
3211
3212 r = dns_transaction_requires_nsec(t);
3213 if (r < 0)
3214 return r;
3215 if (r > 0) {
3216 t->answer_dnssec_result = DNSSEC_NO_SIGNATURE;
3217 manager_dnssec_verdict(t->scope->manager, DNSSEC_BOGUS, t->key);
3218 } else {
3219 t->answer_dnssec_result = DNSSEC_UNSIGNED;
3220 t->answer_authenticated = false;
3221 manager_dnssec_verdict(t->scope->manager, DNSSEC_INSECURE, t->key);
3222 }
3223
3224 break;
3225
3226 case DNSSEC_NSEC_UNSUPPORTED_ALGORITHM:
3227 /* We don't know the NSEC3 algorithm used? */
3228 t->answer_dnssec_result = DNSSEC_UNSUPPORTED_ALGORITHM;
3229 manager_dnssec_verdict(t->scope->manager, DNSSEC_INDETERMINATE, t->key);
3230 break;
3231
3232 case DNSSEC_NSEC_FOUND:
3233 case DNSSEC_NSEC_CNAME:
3234 /* NSEC says it needs to be there, but we couldn't find it? Bummer! */
3235 t->answer_dnssec_result = DNSSEC_NSEC_MISMATCH;
3236 manager_dnssec_verdict(t->scope->manager, DNSSEC_BOGUS, t->key);
3237 break;
3238
3239 default:
3240 assert_not_reached("Unexpected NSEC result.");
3241 }
3242 }
3243
3244 return 1;
3245 }
3246
3247 static const char* const dns_transaction_state_table[_DNS_TRANSACTION_STATE_MAX] = {
3248 [DNS_TRANSACTION_NULL] = "null",
3249 [DNS_TRANSACTION_PENDING] = "pending",
3250 [DNS_TRANSACTION_VALIDATING] = "validating",
3251 [DNS_TRANSACTION_RCODE_FAILURE] = "rcode-failure",
3252 [DNS_TRANSACTION_SUCCESS] = "success",
3253 [DNS_TRANSACTION_NO_SERVERS] = "no-servers",
3254 [DNS_TRANSACTION_TIMEOUT] = "timeout",
3255 [DNS_TRANSACTION_ATTEMPTS_MAX_REACHED] = "attempts-max-reached",
3256 [DNS_TRANSACTION_INVALID_REPLY] = "invalid-reply",
3257 [DNS_TRANSACTION_ERRNO] = "errno",
3258 [DNS_TRANSACTION_ABORTED] = "aborted",
3259 [DNS_TRANSACTION_DNSSEC_FAILED] = "dnssec-failed",
3260 [DNS_TRANSACTION_NO_TRUST_ANCHOR] = "no-trust-anchor",
3261 [DNS_TRANSACTION_RR_TYPE_UNSUPPORTED] = "rr-type-unsupported",
3262 [DNS_TRANSACTION_NETWORK_DOWN] = "network-down",
3263 [DNS_TRANSACTION_NOT_FOUND] = "not-found",
3264 };
3265 DEFINE_STRING_TABLE_LOOKUP(dns_transaction_state, DnsTransactionState);
3266
3267 static const char* const dns_transaction_source_table[_DNS_TRANSACTION_SOURCE_MAX] = {
3268 [DNS_TRANSACTION_NETWORK] = "network",
3269 [DNS_TRANSACTION_CACHE] = "cache",
3270 [DNS_TRANSACTION_ZONE] = "zone",
3271 [DNS_TRANSACTION_TRUST_ANCHOR] = "trust-anchor",
3272 };
3273 DEFINE_STRING_TABLE_LOOKUP(dns_transaction_source, DnsTransactionSource);
Unnamed repository; edit this file 'description' to name the repository.