tree-wide: remove Emacs lines from all files This should be handled fine now by .dir-locals.el, so need to carry that stuff in every file.

resolve: work around clang limitation clang is apparently not smart enough to detect when a switch statement contains case statements for all possible values of the used type. Work around that. (And while we are at it, normalize indentation a bit) Fixes: #2504

resolve-host: allow specifying type as TYPEnn This mirrors the behaviour of host and makes the conversion to and from string symmetrical.

resolved: convert TLSA fields to string Example output: _443._tcp.fedoraproject.org IN TLSA 0 0 1 GUAL5bejH7czkXcAeJ0vCiRxwMnVBsDlBMBsFtfLF8A= -- Cert. usage: CA constraint -- Selector: Full Certificate -- Matching type: SHA-256

resolved: move dns_type_to_af() to dns-type.c

resolved: some RR types may appear only or not at all in a zone apex Add extra checks when validating with RRSIGs. This follows recommendations from: http://www.george-barwood.pwp.blueyonder.co.uk/DnsServer/NotesOnDNSSSEC.htm

resolved: refuse validating wildcard RRs for SOA, NSEC3, DNAME

resolved: don#t allow explicit queries for RRSIG RRs We wouldn't know how to validate them, since they are the signatures, and hence have no signatures.

resolved: refuse doing queries for known-obsolete RR types Given how fragile DNS servers are with some DNS types, and given that we really should avoid confusing them with known-weird lookups, refuse doing lookups for known-obsolete RR types.

resolved: don't attempt to send queries for DNSSEC RR types to servers not supporting them If we already degraded the feature level below DO don't bother with sending requests for DS, DNSKEY, RRSIG, NSEC, NSEC3 or NSEC3PARAM RRs. After all, we cannot do DNSSEC validation then anyway, and we better not press a legacy server like this with such modern concepts. This also has the benefit that when we try to validate a response we received using DNSSEC, and we detect a limited server support level while doing so, all further auxiliary DNSSEC queries will fail right-away.

resolved: split out a new dns_type_may_redirect() call Let's abstract which RRs shall honour CNAMEs, and which ones should not.

resolved: move DNS class utilities to dns-type.c and add more helpers Let's make DNS class helpers more like DNS type helpers, let's move them from resolved-dns-rr.[ch] into dns-type.[ch]. This also adds two new calls dns_class_is_pseudo() and dns_class_is_valid_rr() which operate similar to dns_type_is_pseudo() and dns_type_is_valid_rr() but for classes instead of types. This should hopefully make handling of DNS classes and DNS types more alike.

resolved: generalize DNS RR type validity checks Check the validity of RR types as we parse or receive data from IPC clients, and use the same code for all of them.

resolved: refuse to cache ANY kind of pseudo-RR-type

resolved: extend list of pseudo RR types Also, explain the situation with a longer comment.

resolved: fix parameter type of dns_type_is_pseudo() DNS RR types are uint16_t after all, treat them as such.

treewide: fix typos

resolved: rr - ignore pseudo types in NSEC(3) bitmaps

resolve-host: make arg_type an int We are using it also to store _DNS_TYPE_INVALID, so it should be signed.

resolve: add more record types and convert to gperf table We are unlikely to evert support most of them, but we can at least display the types properly. The list is taken from the IANA list. The table of number->name mappings is converted to a switch statement. gcc does a nice job of optimizing lookup (when optimization is enabled). systemd-resolve-host -t is now case insensitive.