src/resolve/resolved-dns-server.c

	resolved-dns-server.c revision 571370c1555d2aa697733479a50957aff024bbcb
74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering/*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/
74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering
74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering/***
74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering  This file is part of systemd.
74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering
74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering  Copyright 2014 Lennart Poettering
74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering
74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering  systemd is free software; you can redistribute it and/or modify it
74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering  under the terms of the GNU Lesser General Public License as published by
74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering  the Free Software Foundation; either version 2.1 of the License, or
74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering  (at your option) any later version.
74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering
74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering  systemd is distributed in the hope that it will be useful, but
74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering  WITHOUT ANY WARRANTY; without even the implied warranty of
74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering  Lesser General Public License for more details.
74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering
74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering  You should have received a copy of the GNU Lesser General Public License
74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering  along with systemd; If not, see <http://www.gnu.org/licenses/>.
74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering***/
74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering
87f5a19343acf8ba697acc5a62bdb1a2b8c9eda3Lennart Poettering#include "alloc-util.h"
87f5a19343acf8ba697acc5a62bdb1a2b8c9eda3Lennart Poettering#include "resolved-dns-server.h"
74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering#include "resolved-resolv-conf.h"
74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering#include "siphash24.h"
9df3ba6c6cb65eecec06f39dfe85a3596cedac4eTom Gundersen#include "string-table.h"
9df3ba6c6cb65eecec06f39dfe85a3596cedac4eTom Gundersen#include "string-util.h"
9df3ba6c6cb65eecec06f39dfe85a3596cedac4eTom Gundersen
9df3ba6c6cb65eecec06f39dfe85a3596cedac4eTom Gundersen/* After how much time to repeat classic DNS requests */
74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering#define DNS_TIMEOUT_MIN_USEC (500 * USEC_PER_MSEC)
74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering#define DNS_TIMEOUT_MAX_USEC (5 * USEC_PER_SEC)
74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering
4e945a6f7971fd7d1f6b2c62ee3afdaff3c95ce4Lennart Poettering/* The amount of time to wait before retrying with a full feature set */
74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering#define DNS_SERVER_FEATURE_GRACE_PERIOD_MAX_USEC (6 * USEC_PER_HOUR)
0dd25fb9f005d8ab7ac4bc10a609d00569f8c56aLennart Poettering#define DNS_SERVER_FEATURE_GRACE_PERIOD_MIN_USEC (5 * USEC_PER_MINUTE)
3c0cf502796be355431d4a64d738e75f543aa51dLennart Poettering
74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering/* The number of times we will attempt a certain feature set before degrading */
74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering#define DNS_SERVER_FEATURE_RETRY_ATTEMPTS 3
74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering
74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poetteringint dns_server_new(
4e945a6f7971fd7d1f6b2c62ee3afdaff3c95ce4Lennart Poettering                Manager *m,
74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering                DnsServer **ret,
74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering                DnsServerType type,
74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering                Link *l,
74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering                int family,
74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering                const union in_addr_union *in_addr) {
74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering
91b14d6ff362b938a72db17b095ee9903d07381bTom Gundersen        DnsServer *s;
4e945a6f7971fd7d1f6b2c62ee3afdaff3c95ce4Lennart Poettering
74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering        assert(m);
74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering        assert((type == DNS_SERVER_LINK) == !!l);
9df3ba6c6cb65eecec06f39dfe85a3596cedac4eTom Gundersen        assert(in_addr);
74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering
4e945a6f7971fd7d1f6b2c62ee3afdaff3c95ce4Lennart Poettering        if (!IN_SET(family, AF_INET, AF_INET6))
6073b6f26ab9fc6bf335faa7073ec443eef093fdTom Gundersen                return -EAFNOSUPPORT;
6073b6f26ab9fc6bf335faa7073ec443eef093fdTom Gundersen
74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering        if (l) {
4e945a6f7971fd7d1f6b2c62ee3afdaff3c95ce4Lennart Poettering                if (l->n_dns_servers >= LINK_DNS_SERVERS_MAX)
74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering                        return -E2BIG;
74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering        } else {
4e945a6f7971fd7d1f6b2c62ee3afdaff3c95ce4Lennart Poettering                if (m->n_dns_servers >= MANAGER_DNS_SERVERS_MAX)
4e945a6f7971fd7d1f6b2c62ee3afdaff3c95ce4Lennart Poettering                        return -E2BIG;
4e945a6f7971fd7d1f6b2c62ee3afdaff3c95ce4Lennart Poettering        }
4e945a6f7971fd7d1f6b2c62ee3afdaff3c95ce4Lennart Poettering
4e945a6f7971fd7d1f6b2c62ee3afdaff3c95ce4Lennart Poettering        s = new0(DnsServer, 1);
74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering        if (!s)
74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering                return -ENOMEM;
74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering
4e945a6f7971fd7d1f6b2c62ee3afdaff3c95ce4Lennart Poettering        s->n_ref = 1;
4e945a6f7971fd7d1f6b2c62ee3afdaff3c95ce4Lennart Poettering        s->manager = m;
4e945a6f7971fd7d1f6b2c62ee3afdaff3c95ce4Lennart Poettering        s->verified_feature_level = _DNS_SERVER_FEATURE_LEVEL_INVALID;
4e945a6f7971fd7d1f6b2c62ee3afdaff3c95ce4Lennart Poettering        s->possible_feature_level = DNS_SERVER_FEATURE_LEVEL_BEST;
3e684349c2cead2e6fd2f816c34eb17daba23a49Lennart Poettering        s->features_grace_period_usec = DNS_SERVER_FEATURE_GRACE_PERIOD_MIN_USEC;
3e684349c2cead2e6fd2f816c34eb17daba23a49Lennart Poettering        s->received_udp_packet_max = DNS_PACKET_UNICAST_SIZE_MAX;
3e684349c2cead2e6fd2f816c34eb17daba23a49Lennart Poettering        s->type = type;
4e945a6f7971fd7d1f6b2c62ee3afdaff3c95ce4Lennart Poettering        s->family = family;
74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering        s->address = *in_addr;
74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering        s->resend_timeout = DNS_TIMEOUT_MIN_USEC;
74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering
74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering        switch (type) {
74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering
74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering        case DNS_SERVER_LINK:
91b14d6ff362b938a72db17b095ee9903d07381bTom Gundersen                s->link = l;
74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering                LIST_APPEND(servers, l->dns_servers, s);
74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering                l->n_dns_servers++;
74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering                break;
91b14d6ff362b938a72db17b095ee9903d07381bTom Gundersen
cab5b05903096e1c9cf5575ccc73f89d15c8db69Lennart Poettering        case DNS_SERVER_SYSTEM:
91b14d6ff362b938a72db17b095ee9903d07381bTom Gundersen                LIST_APPEND(servers, m->dns_servers, s);
cab5b05903096e1c9cf5575ccc73f89d15c8db69Lennart Poettering                m->n_dns_servers++;
91b14d6ff362b938a72db17b095ee9903d07381bTom Gundersen                break;
91b14d6ff362b938a72db17b095ee9903d07381bTom Gundersen
91b14d6ff362b938a72db17b095ee9903d07381bTom Gundersen        case DNS_SERVER_FALLBACK:
91b14d6ff362b938a72db17b095ee9903d07381bTom Gundersen                LIST_APPEND(servers, m->fallback_dns_servers, s);
91b14d6ff362b938a72db17b095ee9903d07381bTom Gundersen                m->n_dns_servers++;
91b14d6ff362b938a72db17b095ee9903d07381bTom Gundersen                break;
3e684349c2cead2e6fd2f816c34eb17daba23a49Lennart Poettering
91b14d6ff362b938a72db17b095ee9903d07381bTom Gundersen        default:
91b14d6ff362b938a72db17b095ee9903d07381bTom Gundersen                assert_not_reached("Unknown server type");
91b14d6ff362b938a72db17b095ee9903d07381bTom Gundersen        }
91b14d6ff362b938a72db17b095ee9903d07381bTom Gundersen
91b14d6ff362b938a72db17b095ee9903d07381bTom Gundersen        s->linked = true;
74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering
74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering        /* A new DNS server that isn't fallback is added and the one
74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering         * we used so far was a fallback one? Then let's try to pick
74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering         * the new one */
74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering        if (type != DNS_SERVER_FALLBACK &&
87f5a19343acf8ba697acc5a62bdb1a2b8c9eda3Lennart Poettering            m->current_dns_server &&
91b14d6ff362b938a72db17b095ee9903d07381bTom Gundersen            m->current_dns_server->type == DNS_SERVER_FALLBACK)
91b14d6ff362b938a72db17b095ee9903d07381bTom Gundersen                manager_set_dns_server(m, NULL);
91b14d6ff362b938a72db17b095ee9903d07381bTom Gundersen
91b14d6ff362b938a72db17b095ee9903d07381bTom Gundersen        if (ret)
91b14d6ff362b938a72db17b095ee9903d07381bTom Gundersen                *ret = s;
91b14d6ff362b938a72db17b095ee9903d07381bTom Gundersen
91b14d6ff362b938a72db17b095ee9903d07381bTom Gundersen        return 0;
91b14d6ff362b938a72db17b095ee9903d07381bTom Gundersen}
91b14d6ff362b938a72db17b095ee9903d07381bTom Gundersen
91b14d6ff362b938a72db17b095ee9903d07381bTom GundersenDnsServer* dns_server_ref(DnsServer *s)  {
91b14d6ff362b938a72db17b095ee9903d07381bTom Gundersen        if (!s)
91b14d6ff362b938a72db17b095ee9903d07381bTom Gundersen                return NULL;
91b14d6ff362b938a72db17b095ee9903d07381bTom Gundersen
91b14d6ff362b938a72db17b095ee9903d07381bTom Gundersen        assert(s->n_ref > 0);
9df3ba6c6cb65eecec06f39dfe85a3596cedac4eTom Gundersen        s->n_ref ++;
9df3ba6c6cb65eecec06f39dfe85a3596cedac4eTom Gundersen
9df3ba6c6cb65eecec06f39dfe85a3596cedac4eTom Gundersen        return s;
9df3ba6c6cb65eecec06f39dfe85a3596cedac4eTom Gundersen}
9df3ba6c6cb65eecec06f39dfe85a3596cedac4eTom Gundersen
9df3ba6c6cb65eecec06f39dfe85a3596cedac4eTom GundersenDnsServer* dns_server_unref(DnsServer *s)  {
9df3ba6c6cb65eecec06f39dfe85a3596cedac4eTom Gundersen        if (!s)
9df3ba6c6cb65eecec06f39dfe85a3596cedac4eTom Gundersen                return NULL;
9df3ba6c6cb65eecec06f39dfe85a3596cedac4eTom Gundersen
9df3ba6c6cb65eecec06f39dfe85a3596cedac4eTom Gundersen        assert(s->n_ref > 0);
9df3ba6c6cb65eecec06f39dfe85a3596cedac4eTom Gundersen        s->n_ref --;
9df3ba6c6cb65eecec06f39dfe85a3596cedac4eTom Gundersen
9df3ba6c6cb65eecec06f39dfe85a3596cedac4eTom Gundersen        if (s->n_ref > 0)
9df3ba6c6cb65eecec06f39dfe85a3596cedac4eTom Gundersen                return NULL;
9df3ba6c6cb65eecec06f39dfe85a3596cedac4eTom Gundersen
9df3ba6c6cb65eecec06f39dfe85a3596cedac4eTom Gundersen        free(s);
9df3ba6c6cb65eecec06f39dfe85a3596cedac4eTom Gundersen        return NULL;
d5099efc47d4e6ac60816b5381a5f607ab03f06eMichal Schmidt}
87f5a19343acf8ba697acc5a62bdb1a2b8c9eda3Lennart Poettering
87f5a19343acf8ba697acc5a62bdb1a2b8c9eda3Lennart Poetteringvoid dns_server_unlink(DnsServer *s) {
87f5a19343acf8ba697acc5a62bdb1a2b8c9eda3Lennart Poettering        assert(s);
87f5a19343acf8ba697acc5a62bdb1a2b8c9eda3Lennart Poettering        assert(s->manager);
87f5a19343acf8ba697acc5a62bdb1a2b8c9eda3Lennart Poettering
87f5a19343acf8ba697acc5a62bdb1a2b8c9eda3Lennart Poettering        /* This removes the specified server from the linked list of
87f5a19343acf8ba697acc5a62bdb1a2b8c9eda3Lennart Poettering         * servers, but any server might still stay around if it has
87f5a19343acf8ba697acc5a62bdb1a2b8c9eda3Lennart Poettering         * refs, for example from an ongoing transaction. */
87f5a19343acf8ba697acc5a62bdb1a2b8c9eda3Lennart Poettering
d5099efc47d4e6ac60816b5381a5f607ab03f06eMichal Schmidt        if (!s->linked)
87f5a19343acf8ba697acc5a62bdb1a2b8c9eda3Lennart Poettering                return;
87f5a19343acf8ba697acc5a62bdb1a2b8c9eda3Lennart Poettering
87f5a19343acf8ba697acc5a62bdb1a2b8c9eda3Lennart Poettering        switch (s->type) {
87f5a19343acf8ba697acc5a62bdb1a2b8c9eda3Lennart Poettering
87f5a19343acf8ba697acc5a62bdb1a2b8c9eda3Lennart Poettering        case DNS_SERVER_LINK:
87f5a19343acf8ba697acc5a62bdb1a2b8c9eda3Lennart Poettering                assert(s->link);
87f5a19343acf8ba697acc5a62bdb1a2b8c9eda3Lennart Poettering                assert(s->link->n_dns_servers > 0);
87f5a19343acf8ba697acc5a62bdb1a2b8c9eda3Lennart Poettering                LIST_REMOVE(servers, s->link->dns_servers, s);
87f5a19343acf8ba697acc5a62bdb1a2b8c9eda3Lennart Poettering                break;
d5099efc47d4e6ac60816b5381a5f607ab03f06eMichal Schmidt
d5099efc47d4e6ac60816b5381a5f607ab03f06eMichal Schmidt        case DNS_SERVER_SYSTEM:
d5099efc47d4e6ac60816b5381a5f607ab03f06eMichal Schmidt                assert(s->manager->n_dns_servers > 0);
d5099efc47d4e6ac60816b5381a5f607ab03f06eMichal Schmidt                LIST_REMOVE(servers, s->manager->dns_servers, s);
d5099efc47d4e6ac60816b5381a5f607ab03f06eMichal Schmidt                s->manager->n_dns_servers--;
                break;

        case DNS_SERVER_FALLBACK:
                assert(s->manager->n_dns_servers > 0);
                LIST_REMOVE(servers, s->manager->fallback_dns_servers, s);
                s->manager->n_dns_servers--;
                break;
        }

        s->linked = false;

        if (s->link && s->link->current_dns_server == s)
                link_set_dns_server(s->link, NULL);

        if (s->manager->current_dns_server == s)
                manager_set_dns_server(s->manager, NULL);

        dns_server_unref(s);
}

void dns_server_move_back_and_unmark(DnsServer *s) {
        DnsServer *tail;

        assert(s);

        if (!s->marked)
                return;

        s->marked = false;

        if (!s->linked || !s->servers_next)
                return;

        /* Move us to the end of the list, so that the order is
         * strictly kept, if we are not at the end anyway. */

        switch (s->type) {

        case DNS_SERVER_LINK:
                assert(s->link);
                LIST_FIND_TAIL(servers, s, tail);
                LIST_REMOVE(servers, s->link->dns_servers, s);
                LIST_INSERT_AFTER(servers, s->link->dns_servers, tail, s);
                break;

        case DNS_SERVER_SYSTEM:
                LIST_FIND_TAIL(servers, s, tail);
                LIST_REMOVE(servers, s->manager->dns_servers, s);
                LIST_INSERT_AFTER(servers, s->manager->dns_servers, tail, s);
                break;

        case DNS_SERVER_FALLBACK:
                LIST_FIND_TAIL(servers, s, tail);
                LIST_REMOVE(servers, s->manager->fallback_dns_servers, s);
                LIST_INSERT_AFTER(servers, s->manager->fallback_dns_servers, tail, s);
                break;

        default:
                assert_not_reached("Unknown server type");
        }
}

void dns_server_packet_received(DnsServer *s, DnsServerFeatureLevel level, usec_t rtt, size_t size) {
        assert(s);

        if (level == DNS_SERVER_FEATURE_LEVEL_LARGE) {
                /* Even if we successfully receive a reply to a
                   request announcing support for large packets, that
                   does not mean we can necessarily receive large
                   packets. */

                if (s->verified_feature_level < DNS_SERVER_FEATURE_LEVEL_LARGE - 1) {
                        s->verified_feature_level = DNS_SERVER_FEATURE_LEVEL_LARGE - 1;
                        assert_se(sd_event_now(s->manager->event, clock_boottime_or_monotonic(), &s->verified_usec) >= 0);
                }
        } else if (s->verified_feature_level < level) {
                s->verified_feature_level = level;
                assert_se(sd_event_now(s->manager->event, clock_boottime_or_monotonic(), &s->verified_usec) >= 0);
        }

        if (s->possible_feature_level == level)
                s->n_failed_attempts = 0;

        /* Remember the size of the largest UDP packet we received from a server,
           we know that we can always announce support for packets with at least
           this size. */
        if (s->received_udp_packet_max < size)
                s->received_udp_packet_max = size;

        if (s->max_rtt < rtt) {
                s->max_rtt = rtt;
                s->resend_timeout = CLAMP(s->max_rtt * 2, DNS_TIMEOUT_MIN_USEC, DNS_TIMEOUT_MAX_USEC);
        }
}

void dns_server_packet_lost(DnsServer *s, DnsServerFeatureLevel level, usec_t usec) {
        assert(s);
        assert(s->manager);

        if (s->possible_feature_level == level)
                s->n_failed_attempts ++;

        if (s->resend_timeout > usec)
                return;

        s->resend_timeout = MIN(s->resend_timeout * 2, DNS_TIMEOUT_MAX_USEC);
}

void dns_server_packet_failed(DnsServer *s, DnsServerFeatureLevel level) {
        assert(s);
        assert(s->manager);

        if (s->possible_feature_level != level)
                return;

        /* Invoked whenever we get a FORMERR, SERVFAIL or NOTIMP rcode from a server. This is an immediate trigger for
         * us to go one feature level down. Except when we are already at TCP or UDP level, in which case there's no
         * point in changing, under the assumption that packet failures are caused by packet contents, not by used
         * transport. */

        if (s->possible_feature_level <= DNS_SERVER_FEATURE_LEVEL_UDP)
                return;

        s->n_failed_attempts  = (unsigned) -1;
}

void dns_server_packet_rrsig_missing(DnsServer *s) {
        _cleanup_free_ char *ip = NULL;
        assert(s);
        assert(s->manager);

        in_addr_to_string(s->family, &s->address, &ip);
        log_warning("DNS server %s does not augment replies with RRSIG records, DNSSEC not available.", strna(ip));

        s->rrsig_missing = true;
}

static bool dns_server_grace_period_expired(DnsServer *s) {
        usec_t ts;

        assert(s);
        assert(s->manager);

        if (s->verified_usec == 0)
                return false;

        assert_se(sd_event_now(s->manager->event, clock_boottime_or_monotonic(), &ts) >= 0);

        if (s->verified_usec + s->features_grace_period_usec > ts)
                return false;

        s->features_grace_period_usec = MIN(s->features_grace_period_usec * 2, DNS_SERVER_FEATURE_GRACE_PERIOD_MAX_USEC);

        return true;
}

DnsServerFeatureLevel dns_server_possible_feature_level(DnsServer *s) {
        assert(s);

        if (s->possible_feature_level != DNS_SERVER_FEATURE_LEVEL_BEST &&
            dns_server_grace_period_expired(s)) {
                _cleanup_free_ char *ip = NULL;

                s->possible_feature_level = DNS_SERVER_FEATURE_LEVEL_BEST;
                s->n_failed_attempts = 0;
                s->verified_usec = 0;
                s->rrsig_missing = false;

                in_addr_to_string(s->family, &s->address, &ip);
                log_info("Grace period over, resuming full feature set for DNS server %s", strna(ip));
        } else if (s->possible_feature_level <= s->verified_feature_level)
                s->possible_feature_level = s->verified_feature_level;
        else if (s->n_failed_attempts >= DNS_SERVER_FEATURE_RETRY_ATTEMPTS) {
                _cleanup_free_ char *ip = NULL;

                /* Switch one feature level down. Except when we are at TCP already, in which case we try UDP
                 * again. Thus, if a DNS server is not responding we'll keep toggling between UDP and TCP until it
                 * responds on one of them. Note that we generally prefer UDP over TCP (which is why it is at a higher
                 * feature level), but many DNS servers support lack TCP support. */

                if (s->possible_feature_level == DNS_SERVER_FEATURE_LEVEL_TCP)
                        s->possible_feature_level = DNS_SERVER_FEATURE_LEVEL_UDP;
                else {
                        assert(s->possible_feature_level > DNS_SERVER_FEATURE_LEVEL_WORST);
                        s->possible_feature_level --;
                }

                s->n_failed_attempts = 0;
                s->verified_usec = 0;

                in_addr_to_string(s->family, &s->address, &ip);
                log_warning("Using degraded feature set (%s) for DNS server %s",
                            dns_server_feature_level_to_string(s->possible_feature_level), strna(ip));
        }

        return s->possible_feature_level;
}

int dns_server_adjust_opt(DnsServer *server, DnsPacket *packet, DnsServerFeatureLevel level) {
        size_t packet_size;
        bool edns_do;
        int r;

        assert(server);
        assert(packet);
        assert(packet->protocol == DNS_PROTOCOL_DNS);

        /* Fix the OPT field in the packet to match our current feature level. */

        r = dns_packet_truncate_opt(packet);
        if (r < 0)
                return r;

        if (level < DNS_SERVER_FEATURE_LEVEL_EDNS0)
                return 0;

        edns_do = level >= DNS_SERVER_FEATURE_LEVEL_DO;

        if (level >= DNS_SERVER_FEATURE_LEVEL_LARGE)
                packet_size = DNS_PACKET_UNICAST_SIZE_LARGE_MAX;
        else
                packet_size = server->received_udp_packet_max;

        return dns_packet_append_opt(packet, packet_size, edns_do, NULL);
}

static void dns_server_hash_func(const void *p, struct siphash *state) {
        const DnsServer *s = p;

        assert(s);

        siphash24_compress(&s->family, sizeof(s->family), state);
        siphash24_compress(&s->address, FAMILY_ADDRESS_SIZE(s->family), state);
}

static int dns_server_compare_func(const void *a, const void *b) {
        const DnsServer *x = a, *y = b;

        if (x->family < y->family)
                return -1;
        if (x->family > y->family)
                return 1;

        return memcmp(&x->address, &y->address, FAMILY_ADDRESS_SIZE(x->family));
}

const struct hash_ops dns_server_hash_ops = {
        .hash = dns_server_hash_func,
        .compare = dns_server_compare_func
};

void dns_server_unlink_all(DnsServer *first) {
        DnsServer *next;

        if (!first)
                return;

        next = first->servers_next;
        dns_server_unlink(first);

        dns_server_unlink_all(next);
}

void dns_server_unlink_marked(DnsServer *first) {
        DnsServer *next;

        if (!first)
                return;

        next = first->servers_next;

        if (first->marked)
                dns_server_unlink(first);

        dns_server_unlink_marked(next);
}

void dns_server_mark_all(DnsServer *first) {
        if (!first)
                return;

        first->marked = true;
        dns_server_mark_all(first->servers_next);
}

DnsServer *dns_server_find(DnsServer *first, int family, const union in_addr_union *in_addr) {
        DnsServer *s;

        LIST_FOREACH(servers, s, first)
                if (s->family == family && in_addr_equal(family, &s->address, in_addr) > 0)
                        return s;

        return NULL;
}

DnsServer *manager_get_first_dns_server(Manager *m, DnsServerType t) {
        assert(m);

        switch (t) {

        case DNS_SERVER_SYSTEM:
                return m->dns_servers;

        case DNS_SERVER_FALLBACK:
                return m->fallback_dns_servers;

        default:
                return NULL;
        }
}

DnsServer *manager_set_dns_server(Manager *m, DnsServer *s) {
        assert(m);

        if (m->current_dns_server == s)
                return s;

        if (s) {
                _cleanup_free_ char *ip = NULL;

                in_addr_to_string(s->family, &s->address, &ip);
                log_info("Switching to system DNS server %s.", strna(ip));
        }

        dns_server_unref(m->current_dns_server);
        m->current_dns_server = dns_server_ref(s);

        if (m->unicast_scope)
                dns_cache_flush(&m->unicast_scope->cache);

        return s;
}

DnsServer *manager_get_dns_server(Manager *m) {
        Link *l;
        assert(m);

        /* Try to read updates resolv.conf */
        manager_read_resolv_conf(m);

        /* If no DNS server was chose so far, pick the first one */
        if (!m->current_dns_server)
                manager_set_dns_server(m, m->dns_servers);

        if (!m->current_dns_server) {
                bool found = false;
                Iterator i;

                /* No DNS servers configured, let's see if there are
                 * any on any links. If not, we use the fallback
                 * servers */

                HASHMAP_FOREACH(l, m->links, i)
                        if (l->dns_servers) {
                                found = true;
                                break;
                        }

                if (!found)
                        manager_set_dns_server(m, m->fallback_dns_servers);
        }

        return m->current_dns_server;
}

void manager_next_dns_server(Manager *m) {
        assert(m);

        /* If there's currently no DNS server set, then the next
         * manager_get_dns_server() will find one */
        if (!m->current_dns_server)
                return;

        /* Change to the next one, but make sure to follow the linked
         * list only if the server is still linked. */
        if (m->current_dns_server->linked && m->current_dns_server->servers_next) {
                manager_set_dns_server(m, m->current_dns_server->servers_next);
                return;
        }

        /* If there was no next one, then start from the beginning of
         * the list */
        if (m->current_dns_server->type == DNS_SERVER_FALLBACK)
                manager_set_dns_server(m, m->fallback_dns_servers);
        else
                manager_set_dns_server(m, m->dns_servers);
}

static const char* const dns_server_feature_level_table[_DNS_SERVER_FEATURE_LEVEL_MAX] = {
        [DNS_SERVER_FEATURE_LEVEL_TCP] = "TCP",
        [DNS_SERVER_FEATURE_LEVEL_UDP] = "UDP",
        [DNS_SERVER_FEATURE_LEVEL_EDNS0] = "UDP+EDNS0",
        [DNS_SERVER_FEATURE_LEVEL_DO] = "UDP+EDNS0+DO",
        [DNS_SERVER_FEATURE_LEVEL_LARGE] = "UDP+EDNS0+DO+LARGE",
};
DEFINE_STRING_TABLE_LOOKUP(dns_server_feature_level, DnsServerFeatureLevel);