src/resolve/resolved-dns-transaction.h

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2 #pragma once
   3
   4 /***
   5   This file is part of systemd.
   6
   7   Copyright 2014 Lennart Poettering
   8
   9   systemd is free software; you can redistribute it and/or modify it
  10   under the terms of the GNU Lesser General Public License as published by
  11   the Free Software Foundation; either version 2.1 of the License, or
  12   (at your option) any later version.
  13
  14   systemd is distributed in the hope that it will be useful, but
  15   WITHOUT ANY WARRANTY; without even the implied warranty of
  16   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  17   Lesser General Public License for more details.
  18
  19   You should have received a copy of the GNU Lesser General Public License
  20   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  21 ***/
  22
  23 typedef struct DnsTransaction DnsTransaction;
  24 typedef enum DnsTransactionState DnsTransactionState;
  25 typedef enum DnsTransactionSource DnsTransactionSource;
  26
  27 enum DnsTransactionState {
  28         DNS_TRANSACTION_NULL,
  29         DNS_TRANSACTION_PENDING,
  30         DNS_TRANSACTION_VALIDATING,
  31         DNS_TRANSACTION_RCODE_FAILURE,
  32         DNS_TRANSACTION_SUCCESS,
  33         DNS_TRANSACTION_NO_SERVERS,
  34         DNS_TRANSACTION_TIMEOUT,
  35         DNS_TRANSACTION_ATTEMPTS_MAX_REACHED,
  36         DNS_TRANSACTION_INVALID_REPLY,
  37         DNS_TRANSACTION_ERRNO,
  38         DNS_TRANSACTION_ABORTED,
  39         DNS_TRANSACTION_DNSSEC_FAILED,
  40         DNS_TRANSACTION_NO_TRUST_ANCHOR,
  41         DNS_TRANSACTION_RR_TYPE_UNSUPPORTED,
  42         DNS_TRANSACTION_NETWORK_DOWN,
  43         DNS_TRANSACTION_NOT_FOUND, /* like NXDOMAIN, but when LLMNR/TCP connections fail */
  44         _DNS_TRANSACTION_STATE_MAX,
  45         _DNS_TRANSACTION_STATE_INVALID = -1
  46 };
  47
  48 #define DNS_TRANSACTION_IS_LIVE(state) IN_SET((state), DNS_TRANSACTION_NULL, DNS_TRANSACTION_PENDING, DNS_TRANSACTION_VALIDATING)
  49
  50 enum DnsTransactionSource {
  51         DNS_TRANSACTION_NETWORK,
  52         DNS_TRANSACTION_CACHE,
  53         DNS_TRANSACTION_ZONE,
  54         DNS_TRANSACTION_TRUST_ANCHOR,
  55         _DNS_TRANSACTION_SOURCE_MAX,
  56         _DNS_TRANSACTION_SOURCE_INVALID = -1
  57 };
  58
  59 #include "resolved-dns-answer.h"
  60 #include "resolved-dns-packet.h"
  61 #include "resolved-dns-question.h"
  62 #include "resolved-dns-scope.h"
  63 #include "resolved-dns-server.h"
  64 #include "resolved-dns-stream.h"
  65
  66 struct DnsTransaction {
  67         DnsScope *scope;
  68
  69         DnsResourceKey *key;
  70
  71         DnsTransactionState state;
  72
  73         uint16_t id;
  74
  75         bool tried_stream:1;
  76
  77         bool initial_jitter_scheduled:1;
  78         bool initial_jitter_elapsed:1;
  79
  80         bool clamp_ttl:1;
  81
  82         bool probing:1;
  83
  84         DnsPacket *sent, *received;
  85
  86         DnsAnswer *answer;
  87         int answer_rcode;
  88         DnssecResult answer_dnssec_result;
  89         DnsTransactionSource answer_source;
  90         uint32_t answer_nsec_ttl;
  91         int answer_errno; /* if state is DNS_TRANSACTION_ERRNO */
  92
  93         /* Indicates whether the primary answer is authenticated,
  94          * i.e. whether the RRs from answer which directly match the
  95          * question are authenticated, or, if there are none, whether
  96          * the NODATA or NXDOMAIN case is. It says nothing about
  97          * additional RRs listed in the answer, however they have
  98          * their own DNS_ANSWER_AUTHORIZED FLAGS. Note that this bit
  99          * is defined different than the AD bit in DNS packets, as
 100          * that covers more than just the actual primary answer. */
 101         bool answer_authenticated;
 102
 103         /* Contains DNSKEY, DS, SOA RRs we already verified and need
 104          * to authenticate this reply */
 105         DnsAnswer *validated_keys;
 106
 107         usec_t start_usec;
 108         usec_t next_attempt_after;
 109         sd_event_source *timeout_event_source;
 110         unsigned n_attempts;
 111
 112         unsigned n_picked_servers;
 113
 114         /* UDP connection logic, if we need it */
 115         int dns_udp_fd;
 116         sd_event_source *dns_udp_event_source;
 117
 118         /* TCP connection logic, if we need it */
 119         DnsStream *stream;
 120
 121         /* The active server */
 122         DnsServer *server;
 123
 124         /* The features of the DNS server at time of transaction start */
 125         DnsServerFeatureLevel current_feature_level;
 126
 127         /* If we got SERVFAIL back, we retry the lookup, using a lower feature level than we used before. */
 128         DnsServerFeatureLevel clamp_feature_level;
 129
 130         /* Query candidates this transaction is referenced by and that
 131          * shall be notified about this specific transaction
 132          * completing. */
 133         Set *notify_query_candidates, *notify_query_candidates_done;
 134
 135         /* Zone items this transaction is referenced by and that shall
 136          * be notified about completion. */
 137         Set *notify_zone_items, *notify_zone_items_done;
 138
 139         /* Other transactions that this transactions is referenced by
 140          * and that shall be notified about completion. This is used
 141          * when transactions want to validate their RRsets, but need
 142          * another DNSKEY or DS RR to do so. */
 143         Set *notify_transactions, *notify_transactions_done;
 144
 145         /* The opposite direction: the transactions this transaction
 146          * created in order to request DNSKEY or DS RRs. */
 147         Set *dnssec_transactions;
 148
 149         unsigned block_gc;
 150
 151         LIST_FIELDS(DnsTransaction, transactions_by_scope);
 152 };
 153
 154 int dns_transaction_new(DnsTransaction **ret, DnsScope *s, DnsResourceKey *key);
 155 DnsTransaction* dns_transaction_free(DnsTransaction *t);
 156
 157 bool dns_transaction_gc(DnsTransaction *t);
 158 int dns_transaction_go(DnsTransaction *t);
 159
 160 void dns_transaction_process_reply(DnsTransaction *t, DnsPacket *p);
 161 void dns_transaction_complete(DnsTransaction *t, DnsTransactionState state);
 162
 163 void dns_transaction_notify(DnsTransaction *t, DnsTransaction *source);
 164 int dns_transaction_validate_dnssec(DnsTransaction *t);
 165 int dns_transaction_request_dnssec_keys(DnsTransaction *t);
 166
 167 const char* dns_transaction_state_to_string(DnsTransactionState p) _const_;
 168 DnsTransactionState dns_transaction_state_from_string(const char *s) _pure_;
 169
 170 const char* dns_transaction_source_to_string(DnsTransactionSource p) _const_;
 171 DnsTransactionSource dns_transaction_source_from_string(const char *s) _pure_;
 172
 173 /* LLMNR Jitter interval, see RFC 4795 Section 7 */
 174 #define LLMNR_JITTER_INTERVAL_USEC (100 * USEC_PER_MSEC)
 175
 176 /* mDNS Jitter interval, see RFC 6762 Section 5.2 */
 177 #define MDNS_JITTER_MIN_USEC   (20 * USEC_PER_MSEC)
 178 #define MDNS_JITTER_RANGE_USEC (100 * USEC_PER_MSEC)
 179
 180 /* mDNS probing interval, see RFC 6762 Section 8.1 */
 181 #define MDNS_PROBING_INTERVAL_USEC (250 * USEC_PER_MSEC)
 182
 183 /* Maximum attempts to send DNS requests, across all DNS servers */
 184 #define DNS_TRANSACTION_ATTEMPTS_MAX 24
 185
 186 /* Maximum attempts to send LLMNR requests, see RFC 4795 Section 2.7 */
 187 #define LLMNR_TRANSACTION_ATTEMPTS_MAX 3
 188
 189 /* Maximum attempts to send MDNS requests, see RFC 6762 Section 8.1 */
 190 #define MDNS_TRANSACTION_ATTEMPTS_MAX 3
 191
 192 #define TRANSACTION_ATTEMPTS_MAX(p) (((p) == DNS_PROTOCOL_LLMNR) ? \
 193                                          LLMNR_TRANSACTION_ATTEMPTS_MAX : \
 194                                          (((p) == DNS_PROTOCOL_MDNS) ? \
 195                                              MDNS_TRANSACTION_ATTEMPTS_MAX : \
 196                                              DNS_TRANSACTION_ATTEMPTS_MAX))