74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering

74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering

87f5a19343acf8ba697acc5a62bdb1a2b8c9eda3Lennart Poettering#include "alloc-util.h"

87f5a19343acf8ba697acc5a62bdb1a2b8c9eda3Lennart Poettering#include "resolved-dns-server.h"

74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering#include "resolved-resolv-conf.h"

74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering#include "siphash24.h"

74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering#include "string-table.h"

74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering#include "string-util.h"

74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering

74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering#define DNS_TIMEOUT_MIN_USEC (500 * USEC_PER_MSEC)

0dd25fb9f005d8ab7ac4bc10a609d00569f8c56aLennart Poettering#define DNS_TIMEOUT_MAX_USEC (5 * USEC_PER_SEC)

3c0cf502796be355431d4a64d738e75f543aa51dLennart Poettering

74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering#define DNS_SERVER_FEATURE_GRACE_PERIOD_MAX_USEC (6 * USEC_PER_HOUR)

74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering#define DNS_SERVER_FEATURE_GRACE_PERIOD_MIN_USEC (5 * USEC_PER_MINUTE)

74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering

74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering#define DNS_SERVER_FEATURE_RETRY_ATTEMPTS 3

74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering

74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poetteringint dns_server_new(

74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering Manager *m,

74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering DnsServer **ret,

74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering DnsServerType type,

4e945a6f7971fd7d1f6b2c62ee3afdaff3c95ce4Lennart Poettering Link *l,

74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering int family,

74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering const union in_addr_union *in_addr) {

74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering

4e945a6f7971fd7d1f6b2c62ee3afdaff3c95ce4Lennart Poettering DnsServer *s;

6073b6f26ab9fc6bf335faa7073ec443eef093fdTom Gundersen

6073b6f26ab9fc6bf335faa7073ec443eef093fdTom Gundersen assert(m);

74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering assert((type == DNS_SERVER_LINK) == !!l);

4e945a6f7971fd7d1f6b2c62ee3afdaff3c95ce4Lennart Poettering assert(in_addr);

74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering

74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering if (!IN_SET(family, AF_INET, AF_INET6))

4e945a6f7971fd7d1f6b2c62ee3afdaff3c95ce4Lennart Poettering return -EAFNOSUPPORT;

4e945a6f7971fd7d1f6b2c62ee3afdaff3c95ce4Lennart Poettering

4e945a6f7971fd7d1f6b2c62ee3afdaff3c95ce4Lennart Poettering if (l) {

4e945a6f7971fd7d1f6b2c62ee3afdaff3c95ce4Lennart Poettering if (l->n_dns_servers >= LINK_DNS_SERVERS_MAX)

4e945a6f7971fd7d1f6b2c62ee3afdaff3c95ce4Lennart Poettering return -E2BIG;

74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering } else {

74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering if (m->n_dns_servers >= MANAGER_DNS_SERVERS_MAX)

74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering return -E2BIG;

4e945a6f7971fd7d1f6b2c62ee3afdaff3c95ce4Lennart Poettering }

4e945a6f7971fd7d1f6b2c62ee3afdaff3c95ce4Lennart Poettering

4e945a6f7971fd7d1f6b2c62ee3afdaff3c95ce4Lennart Poettering s = new0(DnsServer, 1);

4e945a6f7971fd7d1f6b2c62ee3afdaff3c95ce4Lennart Poettering if (!s)

3e684349c2cead2e6fd2f816c34eb17daba23a49Lennart Poettering return -ENOMEM;

3e684349c2cead2e6fd2f816c34eb17daba23a49Lennart Poettering

3e684349c2cead2e6fd2f816c34eb17daba23a49Lennart Poettering s->n_ref = 1;

4e945a6f7971fd7d1f6b2c62ee3afdaff3c95ce4Lennart Poettering s->manager = m;

74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering s->verified_feature_level = _DNS_SERVER_FEATURE_LEVEL_INVALID;

74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering s->possible_feature_level = DNS_SERVER_FEATURE_LEVEL_BEST;

74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering s->features_grace_period_usec = DNS_SERVER_FEATURE_GRACE_PERIOD_MIN_USEC;

74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering s->received_udp_packet_max = DNS_PACKET_UNICAST_SIZE_MAX;

74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering s->type = type;

74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering s->family = family;

74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering s->address = *in_addr;

74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering s->resend_timeout = DNS_TIMEOUT_MIN_USEC;

74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering

74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering switch (type) {

cab5b05903096e1c9cf5575ccc73f89d15c8db69Lennart Poettering

4e945a6f7971fd7d1f6b2c62ee3afdaff3c95ce4Lennart Poettering case DNS_SERVER_LINK:

6073b6f26ab9fc6bf335faa7073ec443eef093fdTom Gundersen s->link = l;

cab5b05903096e1c9cf5575ccc73f89d15c8db69Lennart Poettering LIST_APPEND(servers, l->dns_servers, s);

cab5b05903096e1c9cf5575ccc73f89d15c8db69Lennart Poettering l->n_dns_servers++;

cab5b05903096e1c9cf5575ccc73f89d15c8db69Lennart Poettering break;

cab5b05903096e1c9cf5575ccc73f89d15c8db69Lennart Poettering

cab5b05903096e1c9cf5575ccc73f89d15c8db69Lennart Poettering case DNS_SERVER_SYSTEM:

cab5b05903096e1c9cf5575ccc73f89d15c8db69Lennart Poettering LIST_APPEND(servers, m->dns_servers, s);

cab5b05903096e1c9cf5575ccc73f89d15c8db69Lennart Poettering m->n_dns_servers++;

74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering break;

4e945a6f7971fd7d1f6b2c62ee3afdaff3c95ce4Lennart Poettering

4e945a6f7971fd7d1f6b2c62ee3afdaff3c95ce4Lennart Poettering case DNS_SERVER_FALLBACK:

3e684349c2cead2e6fd2f816c34eb17daba23a49Lennart Poettering LIST_APPEND(servers, m->fallback_dns_servers, s);

3e684349c2cead2e6fd2f816c34eb17daba23a49Lennart Poettering m->n_dns_servers++;

3e684349c2cead2e6fd2f816c34eb17daba23a49Lennart Poettering break;

74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering

74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering default:

74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering assert_not_reached("Unknown server type");

74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering }

74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering

74b2466e14a1961bf3ac0e8a60cfaceec705bd59Lennart Poettering s->linked = true;

87f5a19343acf8ba697acc5a62bdb1a2b8c9eda3Lennart Poettering

d5099efc47d4e6ac60816b5381a5f607ab03f06eMichal Schmidt /* A new DNS server that isn't fallback is added and the one

87f5a19343acf8ba697acc5a62bdb1a2b8c9eda3Lennart Poettering if (type != DNS_SERVER_FALLBACK &&

87f5a19343acf8ba697acc5a62bdb1a2b8c9eda3Lennart Poettering m->current_dns_server &&

87f5a19343acf8ba697acc5a62bdb1a2b8c9eda3Lennart Poettering m->current_dns_server->type == DNS_SERVER_FALLBACK)

87f5a19343acf8ba697acc5a62bdb1a2b8c9eda3Lennart Poettering manager_set_dns_server(m, NULL);

87f5a19343acf8ba697acc5a62bdb1a2b8c9eda3Lennart Poettering

87f5a19343acf8ba697acc5a62bdb1a2b8c9eda3Lennart Poettering if (ret)

87f5a19343acf8ba697acc5a62bdb1a2b8c9eda3Lennart Poettering *ret = s;

d5099efc47d4e6ac60816b5381a5f607ab03f06eMichal Schmidt

87f5a19343acf8ba697acc5a62bdb1a2b8c9eda3Lennart Poettering return 0;

87f5a19343acf8ba697acc5a62bdb1a2b8c9eda3Lennart Poettering}

87f5a19343acf8ba697acc5a62bdb1a2b8c9eda3Lennart Poettering

87f5a19343acf8ba697acc5a62bdb1a2b8c9eda3Lennart PoetteringDnsServer* dns_server_ref(DnsServer *s) {

87f5a19343acf8ba697acc5a62bdb1a2b8c9eda3Lennart Poettering if (!s)

87f5a19343acf8ba697acc5a62bdb1a2b8c9eda3Lennart Poettering return NULL;

87f5a19343acf8ba697acc5a62bdb1a2b8c9eda3Lennart Poettering

87f5a19343acf8ba697acc5a62bdb1a2b8c9eda3Lennart Poettering assert(s->n_ref > 0);

87f5a19343acf8ba697acc5a62bdb1a2b8c9eda3Lennart Poettering s->n_ref ++;

d5099efc47d4e6ac60816b5381a5f607ab03f06eMichal Schmidt

d5099efc47d4e6ac60816b5381a5f607ab03f06eMichal Schmidt return s;

d5099efc47d4e6ac60816b5381a5f607ab03f06eMichal Schmidt}

d5099efc47d4e6ac60816b5381a5f607ab03f06eMichal Schmidt

d5099efc47d4e6ac60816b5381a5f607ab03f06eMichal SchmidtDnsServer* dns_server_unref(DnsServer *s) {

if (!s)

return NULL;

assert(s->n_ref > 0);

s->n_ref --;

if (s->n_ref > 0)

return NULL;

free(s);

return NULL;

}

void dns_server_unlink(DnsServer *s) {

assert(s);

assert(s->manager);

/* This removes the specified server from the linked list of

if (!s->linked)

return;

switch (s->type) {

case DNS_SERVER_LINK:

assert(s->link);

assert(s->link->n_dns_servers > 0);

LIST_REMOVE(servers, s->link->dns_servers, s);

break;

case DNS_SERVER_SYSTEM:

assert(s->manager->n_dns_servers > 0);

LIST_REMOVE(servers, s->manager->dns_servers, s);

s->manager->n_dns_servers--;

break;

case DNS_SERVER_FALLBACK:

assert(s->manager->n_dns_servers > 0);

LIST_REMOVE(servers, s->manager->fallback_dns_servers, s);

s->manager->n_dns_servers--;

break;

}

s->linked = false;

if (s->link && s->link->current_dns_server == s)

link_set_dns_server(s->link, NULL);

if (s->manager->current_dns_server == s)

manager_set_dns_server(s->manager, NULL);

dns_server_unref(s);

}

void dns_server_move_back_and_unmark(DnsServer *s) {

DnsServer *tail;

assert(s);

if (!s->marked)

return;

s->marked = false;

if (!s->linked || !s->servers_next)

return;

/* Move us to the end of the list, so that the order is

switch (s->type) {

case DNS_SERVER_LINK:

assert(s->link);

LIST_FIND_TAIL(servers, s, tail);

LIST_REMOVE(servers, s->link->dns_servers, s);

LIST_INSERT_AFTER(servers, s->link->dns_servers, tail, s);

break;

case DNS_SERVER_SYSTEM:

LIST_FIND_TAIL(servers, s, tail);

LIST_REMOVE(servers, s->manager->dns_servers, s);

LIST_INSERT_AFTER(servers, s->manager->dns_servers, tail, s);

break;

case DNS_SERVER_FALLBACK:

LIST_FIND_TAIL(servers, s, tail);

LIST_REMOVE(servers, s->manager->fallback_dns_servers, s);

LIST_INSERT_AFTER(servers, s->manager->fallback_dns_servers, tail, s);

break;

default:

assert_not_reached("Unknown server type");

}

}

void dns_server_packet_received(DnsServer *s, DnsServerFeatureLevel level, usec_t rtt, size_t size) {

assert(s);

if (level == DNS_SERVER_FEATURE_LEVEL_LARGE) {

/* Even if we successfully receive a reply to a

if (s->verified_feature_level < DNS_SERVER_FEATURE_LEVEL_LARGE - 1) {

s->verified_feature_level = DNS_SERVER_FEATURE_LEVEL_LARGE - 1;

assert_se(sd_event_now(s->manager->event, clock_boottime_or_monotonic(), &s->verified_usec) >= 0);

}

} else if (s->verified_feature_level < level) {

s->verified_feature_level = level;

assert_se(sd_event_now(s->manager->event, clock_boottime_or_monotonic(), &s->verified_usec) >= 0);

}

if (s->possible_feature_level == level)

s->n_failed_attempts = 0;

/* Remember the size of the largest UDP packet we received from a server,

if (s->received_udp_packet_max < size)

s->received_udp_packet_max = size;

if (s->max_rtt < rtt) {

s->max_rtt = rtt;

s->resend_timeout = CLAMP(s->max_rtt * 2, DNS_TIMEOUT_MIN_USEC, DNS_TIMEOUT_MAX_USEC);

}

}

void dns_server_packet_lost(DnsServer *s, DnsServerFeatureLevel level, usec_t usec) {

assert(s);

assert(s->manager);

if (s->possible_feature_level == level)

s->n_failed_attempts ++;

if (s->resend_timeout > usec)

return;

s->resend_timeout = MIN(s->resend_timeout * 2, DNS_TIMEOUT_MAX_USEC);

}

void dns_server_packet_failed(DnsServer *s, DnsServerFeatureLevel level) {

assert(s);

assert(s->manager);

if (s->possible_feature_level != level)

return;

s->n_failed_attempts = (unsigned) -1;

}

void dns_server_packet_rrsig_missing(DnsServer *s) {

_cleanup_free_ char *ip = NULL;

assert(s);

assert(s->manager);

in_addr_to_string(s->family, &s->address, &ip);

log_warning("DNS server %s does not augment replies with RRSIG records, DNSSEC not available.", strna(ip));

s->rrsig_missing = true;

}

static bool dns_server_grace_period_expired(DnsServer *s) {

usec_t ts;

assert(s);

assert(s->manager);

if (s->verified_usec == 0)

return false;

assert_se(sd_event_now(s->manager->event, clock_boottime_or_monotonic(), &ts) >= 0);

if (s->verified_usec + s->features_grace_period_usec > ts)

return false;

s->features_grace_period_usec = MIN(s->features_grace_period_usec * 2, DNS_SERVER_FEATURE_GRACE_PERIOD_MAX_USEC);

return true;

}

DnsServerFeatureLevel dns_server_possible_feature_level(DnsServer *s) {

assert(s);

if (s->possible_feature_level != DNS_SERVER_FEATURE_LEVEL_BEST &&

dns_server_grace_period_expired(s)) {

_cleanup_free_ char *ip = NULL;

s->possible_feature_level = DNS_SERVER_FEATURE_LEVEL_BEST;

s->n_failed_attempts = 0;

s->verified_usec = 0;

s->rrsig_missing = false;

in_addr_to_string(s->family, &s->address, &ip);

log_info("Grace period over, resuming full feature set for DNS server %s", strna(ip));

} else if (s->possible_feature_level <= s->verified_feature_level)

s->possible_feature_level = s->verified_feature_level;

else if (s->n_failed_attempts >= DNS_SERVER_FEATURE_RETRY_ATTEMPTS) {

_cleanup_free_ char *ip = NULL;

/* Switch one feature level down. Except when we are at TCP already, in which case we try UDP

if (s->possible_feature_level == DNS_SERVER_FEATURE_LEVEL_TCP)

s->possible_feature_level = DNS_SERVER_FEATURE_LEVEL_UDP;

else {

assert(s->possible_feature_level > DNS_SERVER_FEATURE_LEVEL_WORST);

s->possible_feature_level --;

}

s->n_failed_attempts = 0;

s->verified_usec = 0;

in_addr_to_string(s->family, &s->address, &ip);

log_warning("Using degraded feature set (%s) for DNS server %s",

dns_server_feature_level_to_string(s->possible_feature_level), strna(ip));

}

return s->possible_feature_level;

}

int dns_server_adjust_opt(DnsServer *server, DnsPacket *packet, DnsServerFeatureLevel level) {

size_t packet_size;

bool edns_do;

int r;

assert(server);

assert(packet);

assert(packet->protocol == DNS_PROTOCOL_DNS);

/* Fix the OPT field in the packet to match our current feature level. */

r = dns_packet_truncate_opt(packet);

if (r < 0)

return r;

if (level < DNS_SERVER_FEATURE_LEVEL_EDNS0)

return 0;

edns_do = level >= DNS_SERVER_FEATURE_LEVEL_DO;

if (level >= DNS_SERVER_FEATURE_LEVEL_LARGE)

packet_size = DNS_PACKET_UNICAST_SIZE_LARGE_MAX;

else

packet_size = server->received_udp_packet_max;

return dns_packet_append_opt(packet, packet_size, edns_do, NULL);

}

static void dns_server_hash_func(const void *p, struct siphash *state) {

const DnsServer *s = p;

assert(s);

siphash24_compress(&s->family, sizeof(s->family), state);

siphash24_compress(&s->address, FAMILY_ADDRESS_SIZE(s->family), state);

}

static int dns_server_compare_func(const void *a, const void *b) {

const DnsServer *x = a, *y = b;

if (x->family < y->family)

return -1;

if (x->family > y->family)

return 1;

return memcmp(&x->address, &y->address, FAMILY_ADDRESS_SIZE(x->family));

}

const struct hash_ops dns_server_hash_ops = {

.hash = dns_server_hash_func,

.compare = dns_server_compare_func

};

void dns_server_unlink_all(DnsServer *first) {

DnsServer *next;

if (!first)

return;

next = first->servers_next;

dns_server_unlink(first);

dns_server_unlink_all(next);

}

void dns_server_unlink_marked(DnsServer *first) {

DnsServer *next;

if (!first)

return;

next = first->servers_next;

if (first->marked)

dns_server_unlink(first);

dns_server_unlink_marked(next);

}

void dns_server_mark_all(DnsServer *first) {

if (!first)

return;

first->marked = true;

dns_server_mark_all(first->servers_next);

}

DnsServer *dns_server_find(DnsServer *first, int family, const union in_addr_union *in_addr) {

DnsServer *s;

LIST_FOREACH(servers, s, first)

if (s->family == family && in_addr_equal(family, &s->address, in_addr) > 0)

return s;

return NULL;

}

DnsServer *manager_get_first_dns_server(Manager *m, DnsServerType t) {

assert(m);

switch (t) {

case DNS_SERVER_SYSTEM:

return m->dns_servers;

case DNS_SERVER_FALLBACK:

return m->fallback_dns_servers;

default:

return NULL;

}

}

DnsServer *manager_set_dns_server(Manager *m, DnsServer *s) {

assert(m);

if (m->current_dns_server == s)

return s;

if (s) {

_cleanup_free_ char *ip = NULL;

in_addr_to_string(s->family, &s->address, &ip);

log_info("Switching to system DNS server %s.", strna(ip));

}

dns_server_unref(m->current_dns_server);

m->current_dns_server = dns_server_ref(s);

if (m->unicast_scope)

dns_cache_flush(&m->unicast_scope->cache);

return s;

}

DnsServer *manager_get_dns_server(Manager *m) {

Link *l;

assert(m);

/* Try to read updates resolv.conf */

manager_read_resolv_conf(m);

/* If no DNS server was chose so far, pick the first one */

if (!m->current_dns_server)

manager_set_dns_server(m, m->dns_servers);

if (!m->current_dns_server) {

bool found = false;

Iterator i;

/* No DNS servers configured, let's see if there are

HASHMAP_FOREACH(l, m->links, i)

if (l->dns_servers) {

found = true;

break;

}

if (!found)

manager_set_dns_server(m, m->fallback_dns_servers);

}

return m->current_dns_server;

}

void manager_next_dns_server(Manager *m) {

assert(m);

/* If there's currently no DNS server set, then the next

if (!m->current_dns_server)

return;

/* Change to the next one, but make sure to follow the linked

if (m->current_dns_server->linked && m->current_dns_server->servers_next) {

manager_set_dns_server(m, m->current_dns_server->servers_next);

return;

}

/* If there was no next one, then start from the beginning of

if (m->current_dns_server->type == DNS_SERVER_FALLBACK)

manager_set_dns_server(m, m->fallback_dns_servers);

else

manager_set_dns_server(m, m->dns_servers);

}

static const char* const dns_server_feature_level_table[_DNS_SERVER_FEATURE_LEVEL_MAX] = {

[DNS_SERVER_FEATURE_LEVEL_TCP] = "TCP",

[DNS_SERVER_FEATURE_LEVEL_UDP] = "UDP",

[DNS_SERVER_FEATURE_LEVEL_EDNS0] = "UDP+EDNS0",

[DNS_SERVER_FEATURE_LEVEL_DO] = "UDP+EDNS0+DO",

[DNS_SERVER_FEATURE_LEVEL_LARGE] = "UDP+EDNS0+DO+LARGE",

};

DEFINE_STRING_TABLE_LOOKUP(dns_server_feature_level, DnsServerFeatureLevel);