#include "sd-messages.h"

#include "af-list.h"

#include "alloc-util.h"

#include "dns-domain.h"

#include "errno-list.h"

#include "errno-util.h"

#include "fd-util.h"

#include "random-util.h"

#include "resolved-dns-cache.h"

#include "resolved-dns-transaction.h"

#include "resolved-dnstls.h"

#include "resolved-llmnr.h"

#include "string-table.h"

#define TRANSACTIONS_MAX 4096

#define TRANSACTION_TCP_TIMEOUT_USEC (10U*USEC_PER_SEC)

#define DNS_TIMEOUT_USEC (SD_RESOLVED_QUERY_TIMEOUT_USEC / DNS_TRANSACTION_ATTEMPTS_MAX)

static void dns_transaction_reset_answer(DnsTransaction *t) {

assert(t);

t->received = dns_packet_unref(t->received);

t->answer = dns_answer_unref(t->answer);

t->answer_rcode = 0;

t->answer_dnssec_result = _DNSSEC_RESULT_INVALID;

t->answer_source = _DNS_TRANSACTION_SOURCE_INVALID;

t->answer_query_flags = 0;

t->answer_nsec_ttl = UINT32_MAX;

t->answer_errno = 0;

}

static void dns_transaction_flush_dnssec_transactions(DnsTransaction *t) {

DnsTransaction *z;

assert(t);

while ((z = set_steal_first(t->dnssec_transactions))) {

set_remove(z->notify_transactions, t);

set_remove(z->notify_transactions_done, t);

dns_transaction_gc(z);

}

}

static void dns_transaction_close_connection(

DnsTransaction *t,

bool use_graveyard) { /* Set use_graveyard = false when you know the connection is already

int r;

assert(t);

if (t->stream) {

/* Let's detach the stream from our transaction, in case something else keeps a reference to it. */

LIST_REMOVE(transactions_by_stream, t->stream->transactions, t);

/* Remove packet in case it's still in the queue */

dns_packet_unref(ordered_set_remove(t->stream->write_queue, t->sent));

t->stream = dns_stream_unref(t->stream);

}

t->dns_udp_event_source = sd_event_source_disable_unref(t->dns_udp_event_source);

/* If we have an UDP socket where we sent a packet, but never received one, then add it to the socket

if (use_graveyard && t->dns_udp_fd >= 0 && t->sent && !t->received) {

r = manager_add_socket_to_graveyard(t->scope->manager, t->dns_udp_fd);

if (r < 0)

log_debug_errno(r, "Failed to add UDP socket to graveyard, closing immediately: %m");

else

TAKE_FD(t->dns_udp_fd);

}

t->dns_udp_fd = safe_close(t->dns_udp_fd);

}

static void dns_transaction_stop_timeout(DnsTransaction *t) {

assert(t);

t->timeout_event_source = sd_event_source_disable_unref(t->timeout_event_source);

}

DnsTransaction* dns_transaction_free(DnsTransaction *t) {

DnsQueryCandidate *c;

DnsZoneItem *i;

DnsTransaction *z;

if (!t)

return NULL;

log_debug("Freeing transaction %" PRIu16 ".", t->id);

dns_transaction_close_connection(t, true);

dns_transaction_stop_timeout(t);

dns_packet_unref(t->sent);

dns_transaction_reset_answer(t);

dns_server_unref(t->server);

if (t->scope) {

if (t->key) {

DnsTransaction *first;

first = hashmap_get(t->scope->transactions_by_key, t->key);

LIST_REMOVE(transactions_by_key, first, t);

if (first)

hashmap_replace(t->scope->transactions_by_key, first->key, first);

else

hashmap_remove(t->scope->transactions_by_key, t->key);

}

LIST_REMOVE(transactions_by_scope, t->scope->transactions, t);

if (t->id != 0)

hashmap_remove(t->scope->manager->dns_transactions, UINT_TO_PTR(t->id));

}

while ((c = set_steal_first(t->notify_query_candidates)))

set_remove(c->transactions, t);

set_free(t->notify_query_candidates);

while ((c = set_steal_first(t->notify_query_candidates_done)))

set_remove(c->transactions, t);

set_free(t->notify_query_candidates_done);

while ((i = set_steal_first(t->notify_zone_items)))

i->probe_transaction = NULL;

set_free(t->notify_zone_items);

while ((i = set_steal_first(t->notify_zone_items_done)))

i->probe_transaction = NULL;

set_free(t->notify_zone_items_done);

while ((z = set_steal_first(t->notify_transactions)))

set_remove(z->dnssec_transactions, t);

set_free(t->notify_transactions);

while ((z = set_steal_first(t->notify_transactions_done)))

set_remove(z->dnssec_transactions, t);

set_free(t->notify_transactions_done);

dns_transaction_flush_dnssec_transactions(t);

set_free(t->dnssec_transactions);

dns_answer_unref(t->validated_keys);

dns_resource_key_unref(t->key);

dns_packet_unref(t->bypass);

return mfree(t);

}

DEFINE_TRIVIAL_CLEANUP_FUNC(DnsTransaction*, dns_transaction_free);

DnsTransaction* dns_transaction_gc(DnsTransaction *t) {

assert(t);

/* Returns !NULL if we can't gc yet. */

if (t->block_gc > 0)

return t;

if (set_isempty(t->notify_query_candidates) &&

set_isempty(t->notify_query_candidates_done) &&

set_isempty(t->notify_zone_items) &&

set_isempty(t->notify_zone_items_done) &&

set_isempty(t->notify_transactions) &&

set_isempty(t->notify_transactions_done))

return dns_transaction_free(t);

return t;

}

static uint16_t pick_new_id(Manager *m) {

uint16_t new_id;

/* Find a fresh, unused transaction id. Note that this loop is bounded because there's a limit on the

assert_cc(TRANSACTIONS_MAX < 0xFFFF);

do

random_bytes(&new_id, sizeof(new_id));

while (new_id == 0 ||

hashmap_get(m->dns_transactions, UINT_TO_PTR(new_id)));

return new_id;

}

static int key_ok(

DnsScope *scope,

DnsResourceKey *key) {

/* Don't allow looking up invalid or pseudo RRs */

if (!dns_type_is_valid_query(key->type))

return -EINVAL;

if (dns_type_is_obsolete(key->type))

return -EOPNOTSUPP;

/* We only support the IN class */

if (!IN_SET(key->class, DNS_CLASS_IN, DNS_CLASS_ANY))

return -EOPNOTSUPP;

/* Don't allows DNSSEC RRs to be looked up via LLMNR/mDNS. They don't really make sense

if (scope->protocol != DNS_PROTOCOL_DNS &&

dns_type_is_dnssec(key->type))

return -EOPNOTSUPP;

return 0;

}

int dns_transaction_new(

uint64_t query_flags) {

_cleanup_(dns_transaction_freep) DnsTransaction *t = NULL;

int r;

assert(ret);

assert(s);

if (key) {

assert(!bypass);

r = key_ok(s, key);

if (r < 0)

return r;

} else {

DnsResourceKey *qk;

assert(bypass);

r = dns_packet_validate_query(bypass);

if (r < 0)

return r;

DNS_QUESTION_FOREACH(qk, bypass->question) {

r = key_ok(s, qk);

if (r < 0)

return r;

}

}

if (hashmap_size(s->manager->dns_transactions) >= TRANSACTIONS_MAX)

return -EBUSY;

r = hashmap_ensure_allocated(&s->manager->dns_transactions, NULL);

if (r < 0)

return r;

if (key) {

r = hashmap_ensure_allocated(&s->transactions_by_key, &dns_resource_key_hash_ops);

if (r < 0)

return r;

}

t = new(DnsTransaction, 1);

if (!t)

return -ENOMEM;

*t = (DnsTransaction) {

.dns_udp_fd = -1,

.answer_source = _DNS_TRANSACTION_SOURCE_INVALID,

.answer_dnssec_result = _DNSSEC_RESULT_INVALID,

.answer_nsec_ttl = UINT32_MAX,

.key = dns_resource_key_ref(key),

.query_flags = query_flags,

.bypass = dns_packet_ref(bypass),

.current_feature_level = _DNS_SERVER_FEATURE_LEVEL_INVALID,

.clamp_feature_level_servfail = _DNS_SERVER_FEATURE_LEVEL_INVALID,

.clamp_feature_level_nxdomain = _DNS_SERVER_FEATURE_LEVEL_INVALID,

.id = pick_new_id(s->manager),

};

r = hashmap_put(s->manager->dns_transactions, UINT_TO_PTR(t->id), t);

if (r < 0) {

t->id = 0;

return r;

}

if (t->key) {

DnsTransaction *first;

first = hashmap_get(s->transactions_by_key, t->key);

LIST_PREPEND(transactions_by_key, first, t);

r = hashmap_replace(s->transactions_by_key, first->key, first);

if (r < 0) {

LIST_REMOVE(transactions_by_key, first, t);

return r;

}

}

LIST_PREPEND(transactions_by_scope, s->transactions, t);

t->scope = s;

s->manager->n_transactions_total++;

if (ret)

*ret = t;

TAKE_PTR(t);

return 0;

}

static void dns_transaction_shuffle_id(DnsTransaction *t) {

uint16_t new_id;

assert(t);

/* Pick a new ID for this transaction. */

new_id = pick_new_id(t->scope->manager);

assert_se(hashmap_remove_and_put(t->scope->manager->dns_transactions, UINT_TO_PTR(t->id), UINT_TO_PTR(new_id), t) >= 0);

log_debug("Transaction %" PRIu16 " is now %" PRIu16 ".", t->id, new_id);

t->id = new_id;

/* Make sure we generate a new packet with the new ID */

t->sent = dns_packet_unref(t->sent);

}

static void dns_transaction_tentative(DnsTransaction *t, DnsPacket *p) {

_cleanup_free_ char *pretty = NULL;

char key_str[DNS_RESOURCE_KEY_STRING_MAX];

DnsZoneItem *z;

assert(t);

assert(p);

assert(t->scope->protocol == DNS_PROTOCOL_LLMNR);

if (manager_packet_from_local_address(t->scope->manager, p) != 0)

return;

(void) in_addr_to_string(p->family, &p->sender, &pretty);

log_debug("Transaction %" PRIu16 " for <%s> on scope %s on %s/%s got tentative packet from %s.",

t->id,

dns_resource_key_to_string(dns_transaction_key(t), key_str, sizeof key_str),

dns_protocol_to_string(t->scope->protocol),

t->scope->link ? t->scope->link->ifname : "*",

af_to_name_short(t->scope->family),

strnull(pretty));

/* RFC 4795, Section 4.1 says that the peer with the

if (memcmp(&p->sender, &p->destination, FAMILY_ADDRESS_SIZE(p->family)) >= 0) {

log_debug("Peer has lexicographically larger IP address and thus lost in the conflict.");

return;

}

log_debug("We have the lexicographically larger IP address and thus lost in the conflict.");

t->block_gc++;

while ((z = set_first(t->notify_zone_items))) {

/* First, make sure the zone item drops the reference

dns_zone_item_probe_stop(z);

/* Secondly, report this as conflict, so that we might

dns_zone_item_conflict(z);

}

t->block_gc--;

dns_transaction_gc(t);

}

void dns_transaction_complete(DnsTransaction *t, DnsTransactionState state) {

DnsQueryCandidate *c;

DnsZoneItem *z;

DnsTransaction *d;

const char *st;

char key_str[DNS_RESOURCE_KEY_STRING_MAX];

assert(t);

assert(!DNS_TRANSACTION_IS_LIVE(state));

if (state == DNS_TRANSACTION_DNSSEC_FAILED) {

dns_resource_key_to_string(dns_transaction_key(t), key_str, sizeof key_str);

log_struct(LOG_NOTICE,

"MESSAGE_ID=" SD_MESSAGE_DNSSEC_FAILURE_STR,

LOG_MESSAGE("DNSSEC validation failed for question %s: %s", key_str, dnssec_result_to_string(t->answer_dnssec_result)),

"DNS_TRANSACTION=%" PRIu16, t->id,

"DNS_QUESTION=%s", key_str,

"DNSSEC_RESULT=%s", dnssec_result_to_string(t->answer_dnssec_result),

"DNS_SERVER=%s", strna(dns_server_string_full(t->server)),

"DNS_SERVER_FEATURE_LEVEL=%s", dns_server_feature_level_to_string(t->server->possible_feature_level));

}

/* Note that this call might invalidate the query. Callers

if (state == DNS_TRANSACTION_ERRNO)

st = errno_to_name(t->answer_errno);

else

st = dns_transaction_state_to_string(state);

log_debug("%s transaction %" PRIu16 " for <%s> on scope %s on %s/%s now complete with <%s> from %s (%s; %s).",

t->bypass ? "Bypass" : "Regular",

t->id,

dns_resource_key_to_string(dns_transaction_key(t), key_str, sizeof key_str),

dns_protocol_to_string(t->scope->protocol),

t->scope->link ? t->scope->link->ifname : "*",

af_to_name_short(t->scope->family),

st,

t->answer_source < 0 ? "none" : dns_transaction_source_to_string(t->answer_source),

FLAGS_SET(t->query_flags, SD_RESOLVED_NO_VALIDATE) ? "not validated" :

(FLAGS_SET(t->answer_query_flags, SD_RESOLVED_AUTHENTICATED) ? "authenticated" : "unsigned"),

FLAGS_SET(t->answer_query_flags, SD_RESOLVED_CONFIDENTIAL) ? "confidential" : "non-confidential");

t->state = state;

dns_transaction_close_connection(t, true);

dns_transaction_stop_timeout(t);

/* Notify all queries that are interested, but make sure the

t->block_gc++;

SET_FOREACH_MOVE(c, t->notify_query_candidates_done, t->notify_query_candidates)

dns_query_candidate_notify(c);

SWAP_TWO(t->notify_query_candidates, t->notify_query_candidates_done);

SET_FOREACH_MOVE(z, t->notify_zone_items_done, t->notify_zone_items)

dns_zone_item_notify(z);

SWAP_TWO(t->notify_zone_items, t->notify_zone_items_done);

if (t->probing && t->state == DNS_TRANSACTION_ATTEMPTS_MAX_REACHED)

(void) dns_scope_announce(t->scope, false);

SET_FOREACH_MOVE(d, t->notify_transactions_done, t->notify_transactions)

dns_transaction_notify(d, t);

SWAP_TWO(t->notify_transactions, t->notify_transactions_done);

t->block_gc--;

dns_transaction_gc(t);

}

static void dns_transaction_complete_errno(DnsTransaction *t, int error) {

assert(t);

assert(error != 0);

t->answer_errno = abs(error);

dns_transaction_complete(t, DNS_TRANSACTION_ERRNO);

}

static int dns_transaction_pick_server(DnsTransaction *t) {

DnsServer *server;

assert(t);

assert(t->scope->protocol == DNS_PROTOCOL_DNS);

/* Pick a DNS server and a feature level for it. */

server = dns_scope_get_dns_server(t->scope);

if (!server)

return -ESRCH;

/* If we changed the server invalidate the feature level clamping, as the new server might have completely

if (server != t->server) {

t->clamp_feature_level_servfail = _DNS_SERVER_FEATURE_LEVEL_INVALID;

t->clamp_feature_level_nxdomain = _DNS_SERVER_FEATURE_LEVEL_INVALID;

}

t->current_feature_level = dns_server_possible_feature_level(server);

/* Clamp the feature level if that is requested. */

if (t->clamp_feature_level_servfail != _DNS_SERVER_FEATURE_LEVEL_INVALID &&

t->current_feature_level > t->clamp_feature_level_servfail)

t->current_feature_level = t->clamp_feature_level_servfail;

if (t->clamp_feature_level_nxdomain != _DNS_SERVER_FEATURE_LEVEL_INVALID &&

t->current_feature_level > t->clamp_feature_level_nxdomain)

t->current_feature_level = t->clamp_feature_level_nxdomain;

log_debug("Using feature level %s for transaction %u.", dns_server_feature_level_to_string(t->current_feature_level), t->id);

if (server == t->server)

return 0;

dns_server_unref(t->server);

t->server = dns_server_ref(server);

t->n_picked_servers ++;

log_debug("Using DNS server %s for transaction %u.", strna(dns_server_string_full(t->server)), t->id);

return 1;

}

static void dns_transaction_retry(DnsTransaction *t, bool next_server) {

int r;

assert(t);

/* Retries the transaction as it is, possibly on a different server */

if (next_server && t->scope->protocol == DNS_PROTOCOL_DNS)

log_debug("Retrying transaction %" PRIu16 ", after switching servers.", t->id);

else

log_debug("Retrying transaction %" PRIu16 ".", t->id);

/* Before we try again, switch to a new server. */

if (next_server)

dns_scope_next_dns_server(t->scope, t->server);

r = dns_transaction_go(t);

if (r < 0)

dns_transaction_complete_errno(t, r);

}

static bool dns_transaction_limited_retry(DnsTransaction *t) {

assert(t);

/* If we haven't tried all different servers yet, let's try again with a different server */

if (t->n_picked_servers >= dns_scope_get_n_dns_servers(t->scope))

return false;

dns_transaction_retry(t, /* next_server= */ true);

return true;

}

static int dns_transaction_maybe_restart(DnsTransaction *t) {

int r;

assert(t);

/* Restarts the transaction, under a new ID if the feature level of the server changed since we first

if (!t->server)

return 0;

if (t->current_feature_level <= dns_server_possible_feature_level(t->server))

return 0;

/* The server's current feature level is lower than when we sent the original query. We learnt something from

log_debug("Server feature level is now lower than when we began our transaction. Restarting with new ID.");

dns_transaction_shuffle_id(t);

r = dns_transaction_go(t);

if (r < 0)

return r;

return 1;

}

static void on_transaction_stream_error(DnsTransaction *t, int error) {

assert(t);

dns_transaction_close_connection(t, true);

if (ERRNO_IS_DISCONNECT(error)) {

if (t->scope->protocol == DNS_PROTOCOL_LLMNR) {

/* If the LLMNR/TCP connection failed, the host doesn't support LLMNR, and we cannot answer the

dns_transaction_complete(t, DNS_TRANSACTION_NOT_FOUND);

return;

}

dns_transaction_retry(t, true);

return;

}

if (error != 0)

dns_transaction_complete_errno(t, error);

}

static int dns_transaction_on_stream_packet(DnsTransaction *t, DnsStream *s, DnsPacket *p) {

bool encrypted;

assert(t);

assert(s);

assert(p);

encrypted = s->encrypted;

dns_transaction_close_connection(t, true);

if (dns_packet_validate_reply(p) <= 0) {

log_debug("Invalid TCP reply packet.");

dns_transaction_complete(t, DNS_TRANSACTION_INVALID_REPLY);

return 0;

}

dns_scope_check_conflicts(t->scope, p);

t->block_gc++;

dns_transaction_process_reply(t, p, encrypted);

t->block_gc--;

/* If the response wasn't useful, then complete the transition

if (t->state == DNS_TRANSACTION_PENDING)

dns_transaction_complete(t, DNS_TRANSACTION_INVALID_REPLY);

else

dns_transaction_gc(t);

return 0;

}

static int on_stream_complete(DnsStream *s, int error) {

assert(s);

if (ERRNO_IS_DISCONNECT(error) && s->protocol != DNS_PROTOCOL_LLMNR) {

log_debug_errno(error, "Connection failure for DNS TCP stream: %m");

if (s->transactions) {

DnsTransaction *t;

t = s->transactions;

dns_server_packet_lost(t->server, IPPROTO_TCP, t->current_feature_level);

}

}

if (error != 0)

LIST_FOREACH(transactions_by_stream, t, s->transactions)

on_transaction_stream_error(t, error);

return 0;

}

static int on_stream_packet(DnsStream *s, DnsPacket *p) {

DnsTransaction *t;

assert(s);

assert(s->manager);

assert(p);

t = hashmap_get(s->manager->dns_transactions, UINT_TO_PTR(DNS_PACKET_ID(p)));

if (t && t->stream == s) /* Validate that the stream we got this on actually is the stream the

return dns_transaction_on_stream_packet(t, s, p);

/* Ignore incorrect transaction id as an old transaction can have been canceled. */

log_debug("Received unexpected TCP reply packet with id %" PRIu16 ", ignoring.", DNS_PACKET_ID(p));

return 0;

}

static uint16_t dns_transaction_port(DnsTransaction *t) {

assert(t);

if (t->server->port > 0)

return t->server->port;

return DNS_SERVER_FEATURE_LEVEL_IS_TLS(t->current_feature_level) ? 853 : 53;

}

static int dns_transaction_emit_tcp(DnsTransaction *t) {

usec_t stream_timeout_usec = DNS_STREAM_DEFAULT_TIMEOUT_USEC;

_cleanup_(dns_stream_unrefp) DnsStream *s = NULL;

_cleanup_close_ int fd = -1;

union sockaddr_union sa;

DnsStreamType type;

int r;

assert(t);

assert(t->sent);

dns_transaction_close_connection(t, true);

switch (t->scope->protocol) {

case DNS_PROTOCOL_DNS:

r = dns_transaction_pick_server(t);

if (r < 0)

return r;

if (manager_server_is_stub(t->scope->manager, t->server))

return -ELOOP;

if (!t->bypass) {

if (!dns_server_dnssec_supported(t->server) && dns_type_is_dnssec(dns_transaction_key(t)->type))

return -EOPNOTSUPP;

r = dns_server_adjust_opt(t->server, t->sent, t->current_feature_level);

if (r < 0)

return r;

}

if (t->server->stream && (DNS_SERVER_FEATURE_LEVEL_IS_TLS(t->current_feature_level) == t->server->stream->encrypted))

s = dns_stream_ref(t->server->stream);

else

fd = dns_scope_socket_tcp(t->scope, AF_UNSPEC, NULL, t->server, dns_transaction_port(t), &sa);

/* Lower timeout in DNS-over-TLS opportunistic mode. In environments where DoT is blocked

if (DNS_SERVER_FEATURE_LEVEL_IS_TLS(t->current_feature_level) &&

dns_server_get_dns_over_tls_mode(t->server) == DNS_OVER_TLS_OPPORTUNISTIC)

stream_timeout_usec = DNS_STREAM_OPPORTUNISTIC_TLS_TIMEOUT_USEC;

type = DNS_STREAM_LOOKUP;

break;

case DNS_PROTOCOL_LLMNR:

/* When we already received a reply to this (but it was truncated), send to its sender address */

if (t->received)

fd = dns_scope_socket_tcp(t->scope, t->received->family, &t->received->sender, NULL, t->received->sender_port, &sa);

else {

union in_addr_union address;

int family = AF_UNSPEC;

/* Otherwise, try to talk to the owner of a

r = dns_name_address(dns_resource_key_name(dns_transaction_key(t)), &family, &address);

if (r < 0)

return r;

if (r == 0)

return -EINVAL;

if (family != t->scope->family)

return -ESRCH;

fd = dns_scope_socket_tcp(t->scope, family, &address, NULL, LLMNR_PORT, &sa);

}

type = DNS_STREAM_LLMNR_SEND;

break;

default:

return -EAFNOSUPPORT;

}

if (!s) {

if (fd < 0)

return fd;

r = dns_stream_new(t->scope->manager, &s, type, t->scope->protocol, fd, &sa,

on_stream_packet, on_stream_complete, stream_timeout_usec);

if (r < 0)

return r;

fd = -1;

#if ENABLE_DNS_OVER_TLS

if (t->scope->protocol == DNS_PROTOCOL_DNS &&

DNS_SERVER_FEATURE_LEVEL_IS_TLS(t->current_feature_level)) {

assert(t->server);

r = dnstls_stream_connect_tls(s, t->server);

if (r < 0)

return r;

}

if (t->server) {

dns_server_unref_stream(t->server);

s->server = dns_server_ref(t->server);

t->server->stream = dns_stream_ref(s);

}

/* The interface index is difficult to determine if we are

s->ifindex = dns_scope_ifindex(t->scope);

}

t->stream = TAKE_PTR(s);

LIST_PREPEND(transactions_by_stream, t->stream->transactions, t);

r = dns_stream_write_packet(t->stream, t->sent);

if (r < 0) {

dns_transaction_close_connection(t, /* use_graveyard= */ false);

return r;

}

dns_transaction_reset_answer(t);

t->tried_stream = true;

return 0;

}

static void dns_transaction_cache_answer(DnsTransaction *t) {

assert(t);

/* For mDNS we cache whenever we get the packet, rather than

if (!IN_SET(t->scope->protocol, DNS_PROTOCOL_DNS, DNS_PROTOCOL_LLMNR))

return;

/* Caching disabled? */

if (t->scope->manager->enable_cache == DNS_CACHE_MODE_NO)

return;

/* If validation is turned off for this transaction, but DNSSEC is on, then let's not cache this */

if (FLAGS_SET(t->query_flags, SD_RESOLVED_NO_VALIDATE) && t->scope->dnssec_mode != DNSSEC_NO)

return;

/* Packet from localhost? */

if (!t->scope->manager->cache_from_localhost &&

in_addr_is_localhost(t->received->family, &t->received->sender) != 0)

return;

dns_cache_put(&t->scope->cache,

t->scope->manager->enable_cache,

dns_transaction_key(t),

t->answer_rcode,

t->answer,

DNS_PACKET_CD(t->received) ? t->received : NULL, /* only cache full packets with CD on,

t->answer_query_flags,

t->answer_dnssec_result,

t->answer_nsec_ttl,

t->received->family,

&t->received->sender);

}

static bool dns_transaction_dnssec_is_live(DnsTransaction *t) {

DnsTransaction *dt;

assert(t);

SET_FOREACH(dt, t->dnssec_transactions)

if (DNS_TRANSACTION_IS_LIVE(dt->state))

return true;

return false;

}

static int dns_transaction_dnssec_ready(DnsTransaction *t) {

DnsTransaction *dt;

int r;

assert(t);

/* Checks whether the auxiliary DNSSEC transactions of our transaction have completed, or are still

SET_FOREACH(dt, t->dnssec_transactions) {

switch (dt->state) {

case DNS_TRANSACTION_NULL:

case DNS_TRANSACTION_PENDING:

case DNS_TRANSACTION_VALIDATING:

/* Still ongoing */

return 0;

case DNS_TRANSACTION_RCODE_FAILURE:

if (!IN_SET(dt->answer_rcode, DNS_RCODE_NXDOMAIN, DNS_RCODE_SERVFAIL)) {

log_debug("Auxiliary DNSSEC RR query failed with rcode=%s.", dns_rcode_to_string(dt->answer_rcode));

goto fail;

}

/* Fall-through: NXDOMAIN/SERVFAIL is good enough for us. This is because some DNS servers

case DNS_TRANSACTION_SUCCESS:

/* All good. */

break;

case DNS_TRANSACTION_DNSSEC_FAILED:

/* We handle DNSSEC failures different from other errors, as we care about the DNSSEC

log_debug("Auxiliary DNSSEC RR query failed validation: %s", dnssec_result_to_string(dt->answer_dnssec_result));

t->answer_dnssec_result = dt->answer_dnssec_result; /* Copy error code over */

dns_transaction_complete(t, DNS_TRANSACTION_DNSSEC_FAILED);

return 0;

default:

log_debug("Auxiliary DNSSEC RR query failed with %s", dns_transaction_state_to_string(dt->state));

goto fail;

}

}

/* All is ready, we can go and validate */

return 1;

fail:

/* Some auxiliary DNSSEC transaction failed for some reason. Maybe we learned something about the

r = dns_transaction_maybe_restart(t);

if (r < 0)

return r;

if (r > 0)

return 0; /* don't validate just yet, we restarted things */

t->answer_dnssec_result = DNSSEC_FAILED_AUXILIARY;

dns_transaction_complete(t, DNS_TRANSACTION_DNSSEC_FAILED);

return 0;

}

static void dns_transaction_process_dnssec(DnsTransaction *t) {

int r;

assert(t);

/* Are there ongoing DNSSEC transactions? If so, let's wait for them. */

r = dns_transaction_dnssec_ready(t);

if (r < 0)

goto fail;

if (r == 0) /* We aren't ready yet (or one of our auxiliary transactions failed, and we shouldn't validate now */

return;

/* See if we learnt things from the additional DNSSEC transactions, that we didn't know before, and better

r = dns_transaction_maybe_restart(t);

if (r < 0)

goto fail;

if (r > 0) /* Transaction got restarted... */

return;

/* All our auxiliary DNSSEC transactions are complete now. Try

r = dns_transaction_validate_dnssec(t);

if (r == -EBADMSG) {

dns_transaction_complete(t, DNS_TRANSACTION_INVALID_REPLY);

return;

}

if (r < 0)

goto fail;

if (t->answer_dnssec_result == DNSSEC_INCOMPATIBLE_SERVER &&

t->scope->dnssec_mode == DNSSEC_YES) {

/* We are not in automatic downgrade mode, and the server is bad. Let's try a different server, maybe

if (dns_transaction_limited_retry(t))

return;

/* OK, let's give up, apparently all servers we tried didn't work. */

dns_transaction_complete(t, DNS_TRANSACTION_DNSSEC_FAILED);

return;

}

if (!IN_SET(t->answer_dnssec_result,

_DNSSEC_RESULT_INVALID, /* No DNSSEC validation enabled */

DNSSEC_VALIDATED, /* Answer is signed and validated successfully */

DNSSEC_UNSIGNED, /* Answer is right-fully unsigned */

DNSSEC_INCOMPATIBLE_SERVER)) { /* Server does not do DNSSEC (Yay, we are downgrade attack vulnerable!) */

dns_transaction_complete(t, DNS_TRANSACTION_DNSSEC_FAILED);

return;

}

if (t->answer_dnssec_result == DNSSEC_INCOMPATIBLE_SERVER)

dns_server_warn_downgrade(t->server);

dns_transaction_cache_answer(t);

if (t->answer_rcode == DNS_RCODE_SUCCESS)

dns_transaction_complete(t, DNS_TRANSACTION_SUCCESS);

else

dns_transaction_complete(t, DNS_TRANSACTION_RCODE_FAILURE);

return;

fail:

dns_transaction_complete_errno(t, r);

}

static int dns_transaction_has_positive_answer(DnsTransaction *t, DnsAnswerFlags *flags) {

int r;

assert(t);

/* Checks whether the answer is positive, i.e. either a direct

r = dns_answer_match_key(t->answer, dns_transaction_key(t), flags);

if (r != 0)

return r;

r = dns_answer_find_cname_or_dname(t->answer, dns_transaction_key(t), NULL, flags);

if (r != 0)

return r;