src/shared/dns-domain.c

   1 /***
   2   This file is part of systemd.
   3
   4   Copyright 2014 Lennart Poettering
   5
   6   systemd is free software; you can redistribute it and/or modify it
   7   under the terms of the GNU Lesser General Public License as published by
   8   the Free Software Foundation; either version 2.1 of the License, or
   9   (at your option) any later version.
  10
  11   systemd is distributed in the hope that it will be useful, but
  12   WITHOUT ANY WARRANTY; without even the implied warranty of
  13   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  14   Lesser General Public License for more details.
  15
  16   You should have received a copy of the GNU Lesser General Public License
  17   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  18  ***/
  19
  20 #ifdef HAVE_LIBIDN
  21 #include <idna.h>
  22 #include <stringprep.h>
  23 #endif
  24
  25 #include <endian.h>
  26 #include <netinet/in.h>
  27 #include <stdio.h>
  28 #include <string.h>
  29 #include <sys/socket.h>
  30
  31 #include "alloc-util.h"
  32 #include "dns-domain.h"
  33 #include "hashmap.h"
  34 #include "hexdecoct.h"
  35 #include "in-addr-util.h"
  36 #include "macro.h"
  37 #include "parse-util.h"
  38 #include "string-util.h"
  39 #include "strv.h"
  40 #include "utf8.h"
  41
  42 int dns_label_unescape(const char **name, char *dest, size_t sz) {
  43         const char *n;
  44         char *d;
  45         int r = 0;
  46
  47         assert(name);
  48         assert(*name);
  49
  50         n = *name;
  51         d = dest;
  52
  53         for (;;) {
  54                 if (*n == '.') {
  55                         n++;
  56                         break;
  57                 }
  58
  59                 if (*n == 0)
  60                         break;
  61
  62                 if (r >= DNS_LABEL_MAX)
  63                         return -EINVAL;
  64
  65                 if (sz <= 0)
  66                         return -ENOBUFS;
  67
  68                 if (*n == '\\') {
  69                         /* Escaped character */
  70
  71                         n++;
  72
  73                         if (*n == 0)
  74                                 /* Ending NUL */
  75                                 return -EINVAL;
  76
  77                         else if (*n == '\\' || *n == '.') {
  78                                 /* Escaped backslash or dot */
  79
  80                                 if (d)
  81                                         *(d++) = *n;
  82                                 sz--;
  83                                 r++;
  84                                 n++;
  85
  86                         } else if (n[0] >= '0' && n[0] <= '9') {
  87                                 unsigned k;
  88
  89                                 /* Escaped literal ASCII character */
  90
  91                                 if (!(n[1] >= '0' && n[1] <= '9') ||
  92                                     !(n[2] >= '0' && n[2] <= '9'))
  93                                         return -EINVAL;
  94
  95                                 k = ((unsigned) (n[0] - '0') * 100) +
  96                                         ((unsigned) (n[1] - '0') * 10) +
  97                                         ((unsigned) (n[2] - '0'));
  98
  99                                 /* Don't allow anything that doesn't
 100                                  * fit in 8bit. Note that we do allow
 101                                  * control characters, as some servers
 102                                  * (e.g. cloudflare) are happy to
 103                                  * generate labels with them
 104                                  * inside. */
 105                                 if (k > 255)
 106                                         return -EINVAL;
 107
 108                                 if (d)
 109                                         *(d++) = (char) k;
 110                                 sz--;
 111                                 r++;
 112
 113                                 n += 3;
 114                         } else
 115                                 return -EINVAL;
 116
 117                 } else if ((uint8_t) *n >= (uint8_t) ' ' && *n != 127) {
 118
 119                         /* Normal character */
 120
 121                         if (d)
 122                                 *(d++) = *n;
 123                         sz--;
 124                         r++;
 125                         n++;
 126                 } else
 127                         return -EINVAL;
 128         }
 129
 130         /* Empty label that is not at the end? */
 131         if (r == 0 && *n)
 132                 return -EINVAL;
 133
 134         /* More than one trailing dot? */
 135         if (*n == '.')
 136                 return -EINVAL;
 137
 138         if (sz >= 1 && d)
 139                 *d = 0;
 140
 141         *name = n;
 142         return r;
 143 }
 144
 145 /* @label_terminal: terminal character of a label, updated to point to the terminal character of
 146  *                  the previous label (always skipping one dot) or to NULL if there are no more
 147  *                  labels. */
 148 int dns_label_unescape_suffix(const char *name, const char **label_terminal, char *dest, size_t sz) {
 149         const char *terminal;
 150         int r;
 151
 152         assert(name);
 153         assert(label_terminal);
 154         assert(dest);
 155
 156         /* no more labels */
 157         if (!*label_terminal) {
 158                 if (sz >= 1)
 159                         *dest = 0;
 160
 161                 return 0;
 162         }
 163
 164         terminal = *label_terminal;
 165         assert(*terminal == '.' || *terminal == 0);
 166
 167         /* Skip current terminal character (and accept domain names ending it ".") */
 168         if (*terminal == 0)
 169                 terminal--;
 170         if (terminal >= name && *terminal == '.')
 171                 terminal--;
 172
 173         /* Point name to the last label, and terminal to the preceding terminal symbol (or make it a NULL pointer) */
 174         for (;;) {
 175                 if (terminal < name) {
 176                         /* Reached the first label, so indicate that there are no more */
 177                         terminal = NULL;
 178                         break;
 179                 }
 180
 181                 /* Find the start of the last label */
 182                 if (*terminal == '.') {
 183                         const char *y;
 184                         unsigned slashes = 0;
 185
 186                         for (y = terminal - 1; y >= name && *y == '\\'; y--)
 187                                 slashes++;
 188
 189                         if (slashes % 2 == 0) {
 190                                 /* The '.' was not escaped */
 191                                 name = terminal + 1;
 192                                 break;
 193                         } else {
 194                                 terminal = y;
 195                                 continue;
 196                         }
 197                 }
 198
 199                 terminal--;
 200         }
 201
 202         r = dns_label_unescape(&name, dest, sz);
 203         if (r < 0)
 204                 return r;
 205
 206         *label_terminal = terminal;
 207
 208         return r;
 209 }
 210
 211 int dns_label_escape(const char *p, size_t l, char *dest, size_t sz) {
 212         char *q;
 213
 214         /* DNS labels must be between 1 and 63 characters long. A
 215          * zero-length label does not exist. See RFC 2182, Section
 216          * 11. */
 217
 218         if (l <= 0 || l > DNS_LABEL_MAX)
 219                 return -EINVAL;
 220         if (sz < 1)
 221                 return -ENOBUFS;
 222
 223         assert(p);
 224         assert(dest);
 225
 226         q = dest;
 227         while (l > 0) {
 228
 229                 if (*p == '.' || *p == '\\') {
 230
 231                         /* Dot or backslash */
 232
 233                         if (sz < 3)
 234                                 return -ENOBUFS;
 235
 236                         *(q++) = '\\';
 237                         *(q++) = *p;
 238
 239                         sz -= 2;
 240
 241                 } else if (*p == '_' ||
 242                            *p == '-' ||
 243                            (*p >= '0' && *p <= '9') ||
 244                            (*p >= 'a' && *p <= 'z') ||
 245                            (*p >= 'A' && *p <= 'Z')) {
 246
 247                         /* Proper character */
 248
 249                         if (sz < 2)
 250                                 return -ENOBUFS;
 251
 252                         *(q++) = *p;
 253                         sz -= 1;
 254
 255                 } else {
 256
 257                         /* Everything else */
 258
 259                         if (sz < 5)
 260                                 return -ENOBUFS;
 261
 262                         *(q++) = '\\';
 263                         *(q++) = '0' + (char) ((uint8_t) *p / 100);
 264                         *(q++) = '0' + (char) (((uint8_t) *p / 10) % 10);
 265                         *(q++) = '0' + (char) ((uint8_t) *p % 10);
 266
 267                         sz -= 4;
 268                 }
 269
 270                 p++;
 271                 l--;
 272         }
 273
 274         *q = 0;
 275         return (int) (q - dest);
 276 }
 277
 278 int dns_label_escape_new(const char *p, size_t l, char **ret) {
 279         _cleanup_free_ char *s = NULL;
 280         int r;
 281
 282         assert(p);
 283         assert(ret);
 284
 285         if (l <= 0 || l > DNS_LABEL_MAX)
 286                 return -EINVAL;
 287
 288         s = new(char, DNS_LABEL_ESCAPED_MAX);
 289         if (!s)
 290                 return -ENOMEM;
 291
 292         r = dns_label_escape(p, l, s, DNS_LABEL_ESCAPED_MAX);
 293         if (r < 0)
 294                 return r;
 295
 296         *ret = s;
 297         s = NULL;
 298
 299         return r;
 300 }
 301
 302 int dns_label_apply_idna(const char *encoded, size_t encoded_size, char *decoded, size_t decoded_max) {
 303 #ifdef HAVE_LIBIDN
 304         _cleanup_free_ uint32_t *input = NULL;
 305         size_t input_size, l;
 306         const char *p;
 307         bool contains_8bit = false;
 308         char buffer[DNS_LABEL_MAX+1];
 309
 310         assert(encoded);
 311         assert(decoded);
 312
 313         /* Converts an U-label into an A-label */
 314
 315         if (encoded_size <= 0)
 316                 return -EINVAL;
 317
 318         for (p = encoded; p < encoded + encoded_size; p++)
 319                 if ((uint8_t) *p > 127)
 320                         contains_8bit = true;
 321
 322         if (!contains_8bit) {
 323                 if (encoded_size > DNS_LABEL_MAX)
 324                         return -EINVAL;
 325
 326                 return 0;
 327         }
 328
 329         input = stringprep_utf8_to_ucs4(encoded, encoded_size, &input_size);
 330         if (!input)
 331                 return -ENOMEM;
 332
 333         if (idna_to_ascii_4i(input, input_size, buffer, 0) != 0)
 334                 return -EINVAL;
 335
 336         l = strlen(buffer);
 337
 338         /* Verify that the result is not longer than one DNS label. */
 339         if (l <= 0 || l > DNS_LABEL_MAX)
 340                 return -EINVAL;
 341         if (l > decoded_max)
 342                 return -ENOBUFS;
 343
 344         memcpy(decoded, buffer, l);
 345
 346         /* If there's room, append a trailing NUL byte, but only then */
 347         if (decoded_max > l)
 348                 decoded[l] = 0;
 349
 350         return (int) l;
 351 #else
 352         return 0;
 353 #endif
 354 }
 355
 356 int dns_label_undo_idna(const char *encoded, size_t encoded_size, char *decoded, size_t decoded_max) {
 357 #ifdef HAVE_LIBIDN
 358         size_t input_size, output_size;
 359         _cleanup_free_ uint32_t *input = NULL;
 360         _cleanup_free_ char *result = NULL;
 361         uint32_t *output = NULL;
 362         size_t w;
 363
 364         /* To be invoked after unescaping. Converts an A-label into an U-label. */
 365
 366         assert(encoded);
 367         assert(decoded);
 368
 369         if (encoded_size <= 0 || encoded_size > DNS_LABEL_MAX)
 370                 return -EINVAL;
 371
 372         if (encoded_size < sizeof(IDNA_ACE_PREFIX)-1)
 373                 return 0;
 374
 375         if (memcmp(encoded, IDNA_ACE_PREFIX, sizeof(IDNA_ACE_PREFIX) -1) != 0)
 376                 return 0;
 377
 378         input = stringprep_utf8_to_ucs4(encoded, encoded_size, &input_size);
 379         if (!input)
 380                 return -ENOMEM;
 381
 382         output_size = input_size;
 383         output = newa(uint32_t, output_size);
 384
 385         idna_to_unicode_44i(input, input_size, output, &output_size, 0);
 386
 387         result = stringprep_ucs4_to_utf8(output, output_size, NULL, &w);
 388         if (!result)
 389                 return -ENOMEM;
 390         if (w <= 0)
 391                 return -EINVAL;
 392         if (w > decoded_max)
 393                 return -ENOBUFS;
 394
 395         memcpy(decoded, result, w);
 396
 397         /* Append trailing NUL byte if there's space, but only then. */
 398         if (decoded_max > w)
 399                 decoded[w] = 0;
 400
 401         return w;
 402 #else
 403         return 0;
 404 #endif
 405 }
 406
 407 int dns_name_concat(const char *a, const char *b, char **_ret) {
 408         _cleanup_free_ char *ret = NULL;
 409         size_t n = 0, allocated = 0;
 410         const char *p;
 411         bool first = true;
 412         int r;
 413
 414         if (a)
 415                 p = a;
 416         else if (b) {
 417                 p = b;
 418                 b = NULL;
 419         } else
 420                 goto finish;
 421
 422         for (;;) {
 423                 char label[DNS_LABEL_MAX];
 424
 425                 r = dns_label_unescape(&p, label, sizeof(label));
 426                 if (r < 0)
 427                         return r;
 428                 if (r == 0) {
 429                         if (*p != 0)
 430                                 return -EINVAL;
 431
 432                         if (b) {
 433                                 /* Now continue with the second string, if there is one */
 434                                 p = b;
 435                                 b = NULL;
 436                                 continue;
 437                         }
 438
 439                         break;
 440                 }
 441
 442                 if (_ret) {
 443                         if (!GREEDY_REALLOC(ret, allocated, n + !first + DNS_LABEL_ESCAPED_MAX))
 444                                 return -ENOMEM;
 445
 446                         r = dns_label_escape(label, r, ret + n + !first, DNS_LABEL_ESCAPED_MAX);
 447                         if (r < 0)
 448                                 return r;
 449
 450                         if (!first)
 451                                 ret[n] = '.';
 452                 } else {
 453                         char escaped[DNS_LABEL_ESCAPED_MAX];
 454
 455                         r = dns_label_escape(label, r, escaped, sizeof(escaped));
 456                         if (r < 0)
 457                                 return r;
 458                 }
 459
 460                 if (!first)
 461                         n++;
 462                 else
 463                         first = false;
 464
 465                 n += r;
 466         }
 467
 468 finish:
 469         if (n > DNS_HOSTNAME_MAX)
 470                 return -EINVAL;
 471
 472         if (_ret) {
 473                 if (n == 0) {
 474                         /* Nothing appended? If so, generate at least a single dot, to indicate the DNS root domain */
 475                         if (!GREEDY_REALLOC(ret, allocated, 2))
 476                                 return -ENOMEM;
 477
 478                         ret[n++] = '.';
 479                 } else {
 480                         if (!GREEDY_REALLOC(ret, allocated, n + 1))
 481                                 return -ENOMEM;
 482                 }
 483
 484                 ret[n] = 0;
 485                 *_ret = ret;
 486                 ret = NULL;
 487         }
 488
 489         return 0;
 490 }
 491
 492 void dns_name_hash_func(const void *s, struct siphash *state) {
 493         const char *p = s;
 494         int r;
 495
 496         assert(p);
 497
 498         for (;;) {
 499                 char label[DNS_LABEL_MAX+1];
 500
 501                 r = dns_label_unescape(&p, label, sizeof(label));
 502                 if (r < 0)
 503                         break;
 504                 if (r == 0)
 505                         break;
 506
 507                 ascii_strlower_n(label, r);
 508                 siphash24_compress(label, r, state);
 509                 siphash24_compress_byte(0, state); /* make sure foobar and foo.bar result in different hashes */
 510         }
 511
 512         /* enforce that all names are terminated by the empty label */
 513         string_hash_func("", state);
 514 }
 515
 516 int dns_name_compare_func(const void *a, const void *b) {
 517         const char *x, *y;
 518         int r, q;
 519
 520         assert(a);
 521         assert(b);
 522
 523         x = (const char *) a + strlen(a);
 524         y = (const char *) b + strlen(b);
 525
 526         for (;;) {
 527                 char la[DNS_LABEL_MAX], lb[DNS_LABEL_MAX];
 528
 529                 if (x == NULL && y == NULL)
 530                         return 0;
 531
 532                 r = dns_label_unescape_suffix(a, &x, la, sizeof(la));
 533                 q = dns_label_unescape_suffix(b, &y, lb, sizeof(lb));
 534                 if (r < 0 || q < 0)
 535                         return r - q;
 536
 537                 r = ascii_strcasecmp_nn(la, r, lb, q);
 538                 if (r != 0)
 539                         return r;
 540         }
 541 }
 542
 543 const struct hash_ops dns_name_hash_ops = {
 544         .hash = dns_name_hash_func,
 545         .compare = dns_name_compare_func
 546 };
 547
 548 int dns_name_equal(const char *x, const char *y) {
 549         int r, q;
 550
 551         assert(x);
 552         assert(y);
 553
 554         for (;;) {
 555                 char la[DNS_LABEL_MAX], lb[DNS_LABEL_MAX];
 556
 557                 r = dns_label_unescape(&x, la, sizeof(la));
 558                 if (r < 0)
 559                         return r;
 560
 561                 q = dns_label_unescape(&y, lb, sizeof(lb));
 562                 if (q < 0)
 563                         return q;
 564
 565                 if (r != q)
 566                         return false;
 567                 if (r == 0)
 568                         return true;
 569
 570                 if (ascii_strcasecmp_n(la, lb, r) != 0)
 571                         return false;
 572         }
 573 }
 574
 575 int dns_name_endswith(const char *name, const char *suffix) {
 576         const char *n, *s, *saved_n = NULL;
 577         int r, q;
 578
 579         assert(name);
 580         assert(suffix);
 581
 582         n = name;
 583         s = suffix;
 584
 585         for (;;) {
 586                 char ln[DNS_LABEL_MAX], ls[DNS_LABEL_MAX];
 587
 588                 r = dns_label_unescape(&n, ln, sizeof(ln));
 589                 if (r < 0)
 590                         return r;
 591
 592                 if (!saved_n)
 593                         saved_n = n;
 594
 595                 q = dns_label_unescape(&s, ls, sizeof(ls));
 596                 if (q < 0)
 597                         return q;
 598
 599                 if (r == 0 && q == 0)
 600                         return true;
 601                 if (r == 0 && saved_n == n)
 602                         return false;
 603
 604                 if (r != q || ascii_strcasecmp_n(ln, ls, r) != 0) {
 605
 606                         /* Not the same, let's jump back, and try with the next label again */
 607                         s = suffix;
 608                         n = saved_n;
 609                         saved_n = NULL;
 610                 }
 611         }
 612 }
 613
 614 int dns_name_startswith(const char *name, const char *prefix) {
 615         const char *n, *p;
 616         int r, q;
 617
 618         assert(name);
 619         assert(prefix);
 620
 621         n = name;
 622         p = prefix;
 623
 624         for (;;) {
 625                 char ln[DNS_LABEL_MAX], lp[DNS_LABEL_MAX];
 626
 627                 r = dns_label_unescape(&p, lp, sizeof(lp));
 628                 if (r < 0)
 629                         return r;
 630                 if (r == 0)
 631                         return true;
 632
 633                 q = dns_label_unescape(&n, ln, sizeof(ln));
 634                 if (q < 0)
 635                         return q;
 636
 637                 if (r != q)
 638                         return false;
 639                 if (ascii_strcasecmp_n(ln, lp, r) != 0)
 640                         return false;
 641         }
 642 }
 643
 644 int dns_name_change_suffix(const char *name, const char *old_suffix, const char *new_suffix, char **ret) {
 645         const char *n, *s, *saved_before = NULL, *saved_after = NULL, *prefix;
 646         int r, q;
 647
 648         assert(name);
 649         assert(old_suffix);
 650         assert(new_suffix);
 651         assert(ret);
 652
 653         n = name;
 654         s = old_suffix;
 655
 656         for (;;) {
 657                 char ln[DNS_LABEL_MAX], ls[DNS_LABEL_MAX];
 658
 659                 if (!saved_before)
 660                         saved_before = n;
 661
 662                 r = dns_label_unescape(&n, ln, sizeof(ln));
 663                 if (r < 0)
 664                         return r;
 665
 666                 if (!saved_after)
 667                         saved_after = n;
 668
 669                 q = dns_label_unescape(&s, ls, sizeof(ls));
 670                 if (q < 0)
 671                         return q;
 672
 673                 if (r == 0 && q == 0)
 674                         break;
 675                 if (r == 0 && saved_after == n) {
 676                         *ret = NULL; /* doesn't match */
 677                         return 0;
 678                 }
 679
 680                 if (r != q || ascii_strcasecmp_n(ln, ls, r) != 0) {
 681
 682                         /* Not the same, let's jump back, and try with the next label again */
 683                         s = old_suffix;
 684                         n = saved_after;
 685                         saved_after = saved_before = NULL;
 686                 }
 687         }
 688
 689         /* Found it! Now generate the new name */
 690         prefix = strndupa(name, saved_before - name);
 691
 692         r = dns_name_concat(prefix, new_suffix, ret);
 693         if (r < 0)
 694                 return r;
 695
 696         return 1;
 697 }
 698
 699 int dns_name_between(const char *a, const char *b, const char *c) {
 700         int n;
 701
 702         /* Determine if b is strictly greater than a and strictly smaller than c.
 703            We consider the order of names to be circular, so that if a is
 704            strictly greater than c, we consider b to be between them if it is
 705            either greater than a or smaller than c. This is how the canonical
 706            DNS name order used in NSEC records work. */
 707
 708         n = dns_name_compare_func(a, c);
 709         if (n == 0)
 710                 return -EINVAL;
 711         else if (n < 0)
 712                 /*       a<---b--->c       */
 713                 return dns_name_compare_func(a, b) < 0 &&
 714                        dns_name_compare_func(b, c) < 0;
 715         else
 716                 /* <--b--c         a--b--> */
 717                 return dns_name_compare_func(b, c) < 0 ||
 718                        dns_name_compare_func(a, b) < 0;
 719 }
 720
 721 int dns_name_reverse(int family, const union in_addr_union *a, char **ret) {
 722         const uint8_t *p;
 723         int r;
 724
 725         assert(a);
 726         assert(ret);
 727
 728         p = (const uint8_t*) a;
 729
 730         if (family == AF_INET)
 731                 r = asprintf(ret, "%u.%u.%u.%u.in-addr.arpa", p[3], p[2], p[1], p[0]);
 732         else if (family == AF_INET6)
 733                 r = asprintf(ret, "%c.%c.%c.%c.%c.%c.%c.%c.%c.%c.%c.%c.%c.%c.%c.%c.%c.%c.%c.%c.%c.%c.%c.%c.%c.%c.%c.%c.%c.%c.%c.%c.ip6.arpa",
 734                              hexchar(p[15] & 0xF), hexchar(p[15] >> 4), hexchar(p[14] & 0xF), hexchar(p[14] >> 4),
 735                              hexchar(p[13] & 0xF), hexchar(p[13] >> 4), hexchar(p[12] & 0xF), hexchar(p[12] >> 4),
 736                              hexchar(p[11] & 0xF), hexchar(p[11] >> 4), hexchar(p[10] & 0xF), hexchar(p[10] >> 4),
 737                              hexchar(p[ 9] & 0xF), hexchar(p[ 9] >> 4), hexchar(p[ 8] & 0xF), hexchar(p[ 8] >> 4),
 738                              hexchar(p[ 7] & 0xF), hexchar(p[ 7] >> 4), hexchar(p[ 6] & 0xF), hexchar(p[ 6] >> 4),
 739                              hexchar(p[ 5] & 0xF), hexchar(p[ 5] >> 4), hexchar(p[ 4] & 0xF), hexchar(p[ 4] >> 4),
 740                              hexchar(p[ 3] & 0xF), hexchar(p[ 3] >> 4), hexchar(p[ 2] & 0xF), hexchar(p[ 2] >> 4),
 741                              hexchar(p[ 1] & 0xF), hexchar(p[ 1] >> 4), hexchar(p[ 0] & 0xF), hexchar(p[ 0] >> 4));
 742         else
 743                 return -EAFNOSUPPORT;
 744         if (r < 0)
 745                 return -ENOMEM;
 746
 747         return 0;
 748 }
 749
 750 int dns_name_address(const char *p, int *family, union in_addr_union *address) {
 751         int r;
 752
 753         assert(p);
 754         assert(family);
 755         assert(address);
 756
 757         r = dns_name_endswith(p, "in-addr.arpa");
 758         if (r < 0)
 759                 return r;
 760         if (r > 0) {
 761                 uint8_t a[4];
 762                 unsigned i;
 763
 764                 for (i = 0; i < ELEMENTSOF(a); i++) {
 765                         char label[DNS_LABEL_MAX+1];
 766
 767                         r = dns_label_unescape(&p, label, sizeof(label));
 768                         if (r < 0)
 769                                 return r;
 770                         if (r == 0)
 771                                 return -EINVAL;
 772                         if (r > 3)
 773                                 return -EINVAL;
 774
 775                         r = safe_atou8(label, &a[i]);
 776                         if (r < 0)
 777                                 return r;
 778                 }
 779
 780                 r = dns_name_equal(p, "in-addr.arpa");
 781                 if (r <= 0)
 782                         return r;
 783
 784                 *family = AF_INET;
 785                 address->in.s_addr = htobe32(((uint32_t) a[3] << 24) |
 786                                              ((uint32_t) a[2] << 16) |
 787                                              ((uint32_t) a[1] << 8) |
 788                                               (uint32_t) a[0]);
 789
 790                 return 1;
 791         }
 792
 793         r = dns_name_endswith(p, "ip6.arpa");
 794         if (r < 0)
 795                 return r;
 796         if (r > 0) {
 797                 struct in6_addr a;
 798                 unsigned i;
 799
 800                 for (i = 0; i < ELEMENTSOF(a.s6_addr); i++) {
 801                         char label[DNS_LABEL_MAX+1];
 802                         int x, y;
 803
 804                         r = dns_label_unescape(&p, label, sizeof(label));
 805                         if (r <= 0)
 806                                 return r;
 807                         if (r != 1)
 808                                 return -EINVAL;
 809                         x = unhexchar(label[0]);
 810                         if (x < 0)
 811                                 return -EINVAL;
 812
 813                         r = dns_label_unescape(&p, label, sizeof(label));
 814                         if (r <= 0)
 815                                 return r;
 816                         if (r != 1)
 817                                 return -EINVAL;
 818                         y = unhexchar(label[0]);
 819                         if (y < 0)
 820                                 return -EINVAL;
 821
 822                         a.s6_addr[ELEMENTSOF(a.s6_addr) - i - 1] = (uint8_t) y << 4 | (uint8_t) x;
 823                 }
 824
 825                 r = dns_name_equal(p, "ip6.arpa");
 826                 if (r <= 0)
 827                         return r;
 828
 829                 *family = AF_INET6;
 830                 address->in6 = a;
 831                 return 1;
 832         }
 833
 834         return 0;
 835 }
 836
 837 bool dns_name_is_root(const char *name) {
 838
 839         assert(name);
 840
 841         /* There are exactly two ways to encode the root domain name:
 842          * as empty string, or with a single dot. */
 843
 844         return STR_IN_SET(name, "", ".");
 845 }
 846
 847 bool dns_name_is_single_label(const char *name) {
 848         int r;
 849
 850         assert(name);
 851
 852         r = dns_name_parent(&name);
 853         if (r <= 0)
 854                 return false;
 855
 856         return dns_name_is_root(name);
 857 }
 858
 859 /* Encode a domain name according to RFC 1035 Section 3.1, without compression */
 860 int dns_name_to_wire_format(const char *domain, uint8_t *buffer, size_t len, bool canonical) {
 861         uint8_t *label_length, *out;
 862         int r;
 863
 864         assert(domain);
 865         assert(buffer);
 866
 867         out = buffer;
 868
 869         do {
 870                 /* Reserve a byte for label length */
 871                 if (len <= 0)
 872                         return -ENOBUFS;
 873                 len--;
 874                 label_length = out;
 875                 out++;
 876
 877                 /* Convert and copy a single label. Note that
 878                  * dns_label_unescape() returns 0 when it hits the end
 879                  * of the domain name, which we rely on here to encode
 880                  * the trailing NUL byte. */
 881                 r = dns_label_unescape(&domain, (char *) out, len);
 882                 if (r < 0)
 883                         return r;
 884
 885                 /* Optionally, output the name in DNSSEC canonical
 886                  * format, as described in RFC 4034, section 6.2. Or
 887                  * in other words: in lower-case. */
 888                 if (canonical)
 889                         ascii_strlower_n((char*) out, (size_t) r);
 890
 891                 /* Fill label length, move forward */
 892                 *label_length = r;
 893                 out += r;
 894                 len -= r;
 895
 896         } while (r != 0);
 897
 898         /* Verify the maximum size of the encoded name. The trailing
 899          * dot + NUL byte account are included this time, hence
 900          * compare against DNS_HOSTNAME_MAX + 2 (which is 255) this
 901          * time. */
 902         if (out - buffer > DNS_HOSTNAME_MAX + 2)
 903                 return -EINVAL;
 904
 905         return out - buffer;
 906 }
 907
 908 static bool srv_type_label_is_valid(const char *label, size_t n) {
 909         size_t k;
 910
 911         assert(label);
 912
 913         if (n < 2) /* Label needs to be at least 2 chars long */
 914                 return false;
 915
 916         if (label[0] != '_') /* First label char needs to be underscore */
 917                 return false;
 918
 919         /* Second char must be a letter */
 920         if (!(label[1] >= 'A' && label[1] <= 'Z') &&
 921             !(label[1] >= 'a' && label[1] <= 'z'))
 922                 return false;
 923
 924         /* Third and further chars must be alphanumeric or a hyphen */
 925         for (k = 2; k < n; k++) {
 926                 if (!(label[k] >= 'A' && label[k] <= 'Z') &&
 927                     !(label[k] >= 'a' && label[k] <= 'z') &&
 928                     !(label[k] >= '0' && label[k] <= '9') &&
 929                     label[k] != '-')
 930                         return false;
 931         }
 932
 933         return true;
 934 }
 935
 936 bool dns_srv_type_is_valid(const char *name) {
 937         unsigned c = 0;
 938         int r;
 939
 940         if (!name)
 941                 return false;
 942
 943         for (;;) {
 944                 char label[DNS_LABEL_MAX];
 945
 946                 /* This more or less implements RFC 6335, Section 5.1 */
 947
 948                 r = dns_label_unescape(&name, label, sizeof(label));
 949                 if (r < 0)
 950                         return false;
 951                 if (r == 0)
 952                         break;
 953
 954                 if (c >= 2)
 955                         return false;
 956
 957                 if (!srv_type_label_is_valid(label, r))
 958                         return false;
 959
 960                 c++;
 961         }
 962
 963         return c == 2; /* exactly two labels */
 964 }
 965
 966 bool dns_service_name_is_valid(const char *name) {
 967         size_t l;
 968
 969         /* This more or less implements RFC 6763, Section 4.1.1 */
 970
 971         if (!name)
 972                 return false;
 973
 974         if (!utf8_is_valid(name))
 975                 return false;
 976
 977         if (string_has_cc(name, NULL))
 978                 return false;
 979
 980         l = strlen(name);
 981         if (l <= 0)
 982                 return false;
 983         if (l > 63)
 984                 return false;
 985
 986         return true;
 987 }
 988
 989 int dns_service_join(const char *name, const char *type, const char *domain, char **ret) {
 990         char escaped[DNS_LABEL_ESCAPED_MAX];
 991         _cleanup_free_ char *n = NULL;
 992         int r;
 993
 994         assert(type);
 995         assert(domain);
 996         assert(ret);
 997
 998         if (!dns_srv_type_is_valid(type))
 999                 return -EINVAL;
1000
1001         if (!name)
1002                 return dns_name_concat(type, domain, ret);
1003
1004         if (!dns_service_name_is_valid(name))
1005                 return -EINVAL;
1006
1007         r = dns_label_escape(name, strlen(name), escaped, sizeof(escaped));
1008         if (r < 0)
1009                 return r;
1010
1011         r = dns_name_concat(type, domain, &n);
1012         if (r < 0)
1013                 return r;
1014
1015         return dns_name_concat(escaped, n, ret);
1016 }
1017
1018 static bool dns_service_name_label_is_valid(const char *label, size_t n) {
1019         char *s;
1020
1021         assert(label);
1022
1023         if (memchr(label, 0, n))
1024                 return false;
1025
1026         s = strndupa(label, n);
1027         return dns_service_name_is_valid(s);
1028 }
1029
1030 int dns_service_split(const char *joined, char **_name, char **_type, char **_domain) {
1031         _cleanup_free_ char *name = NULL, *type = NULL, *domain = NULL;
1032         const char *p = joined, *q = NULL, *d = NULL;
1033         char a[DNS_LABEL_MAX], b[DNS_LABEL_MAX], c[DNS_LABEL_MAX];
1034         int an, bn, cn, r;
1035         unsigned x = 0;
1036
1037         assert(joined);
1038
1039         /* Get first label from the full name */
1040         an = dns_label_unescape(&p, a, sizeof(a));
1041         if (an < 0)
1042                 return an;
1043
1044         if (an > 0) {
1045                 x++;
1046
1047                 /* If there was a first label, try to get the second one */
1048                 bn = dns_label_unescape(&p, b, sizeof(b));
1049                 if (bn < 0)
1050                         return bn;
1051
1052                 if (bn > 0) {
1053                         x++;
1054
1055                         /* If there was a second label, try to get the third one */
1056                         q = p;
1057                         cn = dns_label_unescape(&p, c, sizeof(c));
1058                         if (cn < 0)
1059                                 return cn;
1060
1061                         if (cn > 0)
1062                                 x++;
1063                 } else
1064                         cn = 0;
1065         } else
1066                 an = 0;
1067
1068         if (x >= 2 && srv_type_label_is_valid(b, bn)) {
1069
1070                 if (x >= 3 && srv_type_label_is_valid(c, cn)) {
1071
1072                         if (dns_service_name_label_is_valid(a, an)) {
1073                                 /* OK, got <name> . <type> . <type2> . <domain> */
1074
1075                                 name = strndup(a, an);
1076                                 if (!name)
1077                                         return -ENOMEM;
1078
1079                                 type = strjoin(b, ".", c, NULL);
1080                                 if (!type)
1081                                         return -ENOMEM;
1082
1083                                 d = p;
1084                                 goto finish;
1085                         }
1086
1087                 } else if (srv_type_label_is_valid(a, an)) {
1088
1089                         /* OK, got <type> . <type2> . <domain> */
1090
1091                         name = NULL;
1092
1093                         type = strjoin(a, ".", b, NULL);
1094                         if (!type)
1095                                 return -ENOMEM;
1096
1097                         d = q;
1098                         goto finish;
1099                 }
1100         }
1101
1102         name = NULL;
1103         type = NULL;
1104         d = joined;
1105
1106 finish:
1107         r = dns_name_normalize(d, &domain);
1108         if (r < 0)
1109                 return r;
1110
1111         if (_domain) {
1112                 *_domain = domain;
1113                 domain = NULL;
1114         }
1115
1116         if (_type) {
1117                 *_type = type;
1118                 type = NULL;
1119         }
1120
1121         if (_name) {
1122                 *_name = name;
1123                 name = NULL;
1124         }
1125
1126         return 0;
1127 }
1128
1129 static int dns_name_build_suffix_table(const char *name, const char*table[]) {
1130         const char *p;
1131         unsigned n = 0;
1132         int r;
1133
1134         assert(name);
1135         assert(table);
1136
1137         p = name;
1138         for (;;) {
1139                 if (n > DNS_N_LABELS_MAX)
1140                         return -EINVAL;
1141
1142                 table[n] = p;
1143                 r = dns_name_parent(&p);
1144                 if (r < 0)
1145                         return r;
1146                 if (r == 0)
1147                         break;
1148
1149                 n++;
1150         }
1151
1152         return (int) n;
1153 }
1154
1155 int dns_name_suffix(const char *name, unsigned n_labels, const char **ret) {
1156         const char* labels[DNS_N_LABELS_MAX+1];
1157         int n;
1158
1159         assert(name);
1160         assert(ret);
1161
1162         n = dns_name_build_suffix_table(name, labels);
1163         if (n < 0)
1164                 return n;
1165
1166         if ((unsigned) n < n_labels)
1167                 return -EINVAL;
1168
1169         *ret = labels[n - n_labels];
1170         return (int) (n - n_labels);
1171 }
1172
1173 int dns_name_skip(const char *a, unsigned n_labels, const char **ret) {
1174         int r;
1175
1176         assert(a);
1177         assert(ret);
1178
1179         for (; n_labels > 0; n_labels--) {
1180                 r = dns_name_parent(&a);
1181                 if (r < 0)
1182                         return r;
1183                 if (r == 0) {
1184                         *ret = "";
1185                         return 0;
1186                 }
1187         }
1188
1189         *ret = a;
1190         return 1;
1191 }
1192
1193 int dns_name_count_labels(const char *name) {
1194         unsigned n = 0;
1195         const char *p;
1196         int r;
1197
1198         assert(name);
1199
1200         p = name;
1201         for (;;) {
1202                 r = dns_name_parent(&p);
1203                 if (r < 0)
1204                         return r;
1205                 if (r == 0)
1206                         break;
1207
1208                 if (n >= DNS_N_LABELS_MAX)
1209                         return -EINVAL;
1210
1211                 n++;
1212         }
1213
1214         return (int) n;
1215 }
1216
1217 int dns_name_equal_skip(const char *a, unsigned n_labels, const char *b) {
1218         int r;
1219
1220         assert(a);
1221         assert(b);
1222
1223         r = dns_name_skip(a, n_labels, &a);
1224         if (r <= 0)
1225                 return r;
1226
1227         return dns_name_equal(a, b);
1228 }
1229
1230 int dns_name_common_suffix(const char *a, const char *b, const char **ret) {
1231         const char *a_labels[DNS_N_LABELS_MAX+1], *b_labels[DNS_N_LABELS_MAX+1];
1232         int n = 0, m = 0, k = 0, r, q;
1233
1234         assert(a);
1235         assert(b);
1236         assert(ret);
1237
1238         /* Determines the common suffix of domain names a and b */
1239
1240         n = dns_name_build_suffix_table(a, a_labels);
1241         if (n < 0)
1242                 return n;
1243
1244         m = dns_name_build_suffix_table(b, b_labels);
1245         if (m < 0)
1246                 return m;
1247
1248         for (;;) {
1249                 char la[DNS_LABEL_MAX], lb[DNS_LABEL_MAX];
1250                 const char *x, *y;
1251
1252                 if (k >= n || k >= m) {
1253                         *ret = a_labels[n - k];
1254                         return 0;
1255                 }
1256
1257                 x = a_labels[n - 1 - k];
1258                 r = dns_label_unescape(&x, la, sizeof(la));
1259                 if (r < 0)
1260                         return r;
1261
1262                 y = b_labels[m - 1 - k];
1263                 q = dns_label_unescape(&y, lb, sizeof(lb));
1264                 if (q < 0)
1265                         return q;
1266
1267                 if (r != q || ascii_strcasecmp_n(la, lb, r) != 0) {
1268                         *ret = a_labels[n - k];
1269                         return 0;
1270                 }
1271
1272                 k++;
1273         }
1274 }
1275
1276 int dns_name_apply_idna(const char *name, char **ret) {
1277         _cleanup_free_ char *buf = NULL;
1278         size_t n = 0, allocated = 0;
1279         bool first = true;
1280         int r, q;
1281
1282         assert(name);
1283         assert(ret);
1284
1285         for (;;) {
1286                 char label[DNS_LABEL_MAX];
1287
1288                 r = dns_label_unescape(&name, label, sizeof(label));
1289                 if (r < 0)
1290                         return r;
1291                 if (r == 0)
1292                         break;
1293
1294                 q = dns_label_apply_idna(label, r, label, sizeof(label));
1295                 if (q < 0)
1296                         return q;
1297                 if (q > 0)
1298                         r = q;
1299
1300                 if (!GREEDY_REALLOC(buf, allocated, n + !first + DNS_LABEL_ESCAPED_MAX))
1301                         return -ENOMEM;
1302
1303                 r = dns_label_escape(label, r, buf + n + !first, DNS_LABEL_ESCAPED_MAX);
1304                 if (r < 0)
1305                         return r;
1306
1307                 if (first)
1308                         first = false;
1309                 else
1310                         buf[n++] = '.';
1311
1312                 n +=r;
1313         }
1314
1315         if (n > DNS_HOSTNAME_MAX)
1316                 return -EINVAL;
1317
1318         if (!GREEDY_REALLOC(buf, allocated, n + 1))
1319                 return -ENOMEM;
1320
1321         buf[n] = 0;
1322         *ret = buf;
1323         buf = NULL;
1324
1325         return (int) n;
1326 }