#include "alloc-util.h"

#include "dns-domain.h"

#include "list.h"

#include "resolved-dns-packet.h"

#include "resolved-dns-zone.h"

#include "resolved-dnssd.h"

#include "resolved-manager.h"

#include "string-util.h"

#define ZONE_MAX 1024

void dns_zone_item_probe_stop(DnsZoneItem *i) {

DnsTransaction *t;

assert(i);

if (!i->probe_transaction)

return;

t = TAKE_PTR(i->probe_transaction);

set_remove(t->notify_zone_items, i);

set_remove(t->notify_zone_items_done, i);

dns_transaction_gc(t);

}

static DnsZoneItem* dns_zone_item_free(DnsZoneItem *i) {

if (!i)

return NULL;

dns_zone_item_probe_stop(i);

dns_resource_record_unref(i->rr);

return mfree(i);

}

DEFINE_TRIVIAL_CLEANUP_FUNC(DnsZoneItem*, dns_zone_item_free);

static void dns_zone_item_remove_and_free(DnsZone *z, DnsZoneItem *i) {

DnsZoneItem *first;

assert(z);

if (!i)

return;

first = hashmap_get(z->by_key, i->rr->key);

LIST_REMOVE(by_key, first, i);

if (first)

assert_se(hashmap_replace(z->by_key, first->rr->key, first) >= 0);

else

hashmap_remove(z->by_key, i->rr->key);

first = hashmap_get(z->by_name, dns_resource_key_name(i->rr->key));

LIST_REMOVE(by_name, first, i);

if (first)

assert_se(hashmap_replace(z->by_name, dns_resource_key_name(first->rr->key), first) >= 0);

else

hashmap_remove(z->by_name, dns_resource_key_name(i->rr->key));

dns_zone_item_free(i);

}

void dns_zone_flush(DnsZone *z) {

DnsZoneItem *i;

assert(z);

while ((i = hashmap_first(z->by_key)))

dns_zone_item_remove_and_free(z, i);

assert(hashmap_size(z->by_key) == 0);

assert(hashmap_size(z->by_name) == 0);

z->by_key = hashmap_free(z->by_key);

z->by_name = hashmap_free(z->by_name);

}

DnsZoneItem* dns_zone_get(DnsZone *z, DnsResourceRecord *rr) {

assert(z);

assert(rr);

LIST_FOREACH(by_key, i, (DnsZoneItem*) hashmap_get(z->by_key, rr->key))

if (dns_resource_record_equal(i->rr, rr) > 0)

return i;

return NULL;

}

void dns_zone_remove_rr(DnsZone *z, DnsResourceRecord *rr) {

DnsZoneItem *i;

assert(z);

if (!rr)

return;

i = dns_zone_get(z, rr);

if (i)

dns_zone_item_remove_and_free(z, i);

}

int dns_zone_remove_rrs_by_key(DnsZone *z, DnsResourceKey *key) {

_cleanup_(dns_answer_unrefp) DnsAnswer *answer = NULL, *soa = NULL;

DnsResourceRecord *rr;

bool tentative;

int r;

r = dns_zone_lookup(z, key, 0, &answer, &soa, &tentative);

if (r < 0)

return r;

DNS_ANSWER_FOREACH(rr, answer)

dns_zone_remove_rr(z, rr);

return 0;

}

static int dns_zone_init(DnsZone *z) {

int r;

assert(z);

r = hashmap_ensure_allocated(&z->by_key, &dns_resource_key_hash_ops);

if (r < 0)

return r;

r = hashmap_ensure_allocated(&z->by_name, &dns_name_hash_ops);

if (r < 0)

return r;

return 0;

}

static int dns_zone_link_item(DnsZone *z, DnsZoneItem *i) {

DnsZoneItem *first;

int r;

first = hashmap_get(z->by_key, i->rr->key);

if (first) {

LIST_PREPEND(by_key, first, i);

assert_se(hashmap_replace(z->by_key, first->rr->key, first) >= 0);

} else {

r = hashmap_put(z->by_key, i->rr->key, i);

if (r < 0)

return r;

}

first = hashmap_get(z->by_name, dns_resource_key_name(i->rr->key));

if (first) {

LIST_PREPEND(by_name, first, i);

assert_se(hashmap_replace(z->by_name, dns_resource_key_name(first->rr->key), first) >= 0);

} else {

r = hashmap_put(z->by_name, dns_resource_key_name(i->rr->key), i);

if (r < 0)

return r;

}

return 0;

}

static int dns_zone_item_probe_start(DnsZoneItem *i) {

_cleanup_(dns_transaction_gcp) DnsTransaction *t = NULL;

int r;

assert(i);

if (i->probe_transaction)

return 0;

t = dns_scope_find_transaction(

i->scope,

&DNS_RESOURCE_KEY_CONST(i->rr->key->class, DNS_TYPE_ANY, dns_resource_key_name(i->rr->key)),

SD_RESOLVED_NO_CACHE|SD_RESOLVED_NO_ZONE);

if (!t) {

_cleanup_(dns_resource_key_unrefp) DnsResourceKey *key = NULL;

key = dns_resource_key_new(i->rr->key->class, DNS_TYPE_ANY, dns_resource_key_name(i->rr->key));

if (!key)

return -ENOMEM;

r = dns_transaction_new(&t, i->scope, key, NULL, SD_RESOLVED_NO_CACHE|SD_RESOLVED_NO_ZONE);

if (r < 0)

return r;

}

r = set_ensure_allocated(&t->notify_zone_items_done, NULL);

if (r < 0)

return r;

r = set_ensure_put(&t->notify_zone_items, NULL, i);

if (r < 0)

return r;

t->probing = true;

i->probe_transaction = TAKE_PTR(t);

if (i->probe_transaction->state == DNS_TRANSACTION_NULL) {

i->block_ready++;

r = dns_transaction_go(i->probe_transaction);

i->block_ready--;

if (r < 0) {

dns_zone_item_probe_stop(i);

return r;

}

}

dns_zone_item_notify(i);

return 0;

}

int dns_zone_put(DnsZone *z, DnsScope *s, DnsResourceRecord *rr, bool probe) {

_cleanup_(dns_zone_item_freep) DnsZoneItem *i = NULL;

DnsZoneItem *existing;

int r;

assert(z);

assert(s);

assert(rr);

if (dns_class_is_pseudo(rr->key->class))

return -EINVAL;

if (dns_type_is_pseudo(rr->key->type))

return -EINVAL;

existing = dns_zone_get(z, rr);

if (existing)

return 0;

r = dns_zone_init(z);

if (r < 0)

return r;

i = new(DnsZoneItem, 1);

if (!i)

return -ENOMEM;

*i = (DnsZoneItem) {

.scope = s,

.rr = dns_resource_record_ref(rr),

.probing_enabled = probe,

};

r = dns_zone_link_item(z, i);

if (r < 0)

return r;

if (probe) {

bool established = false;

/* Check if there's already an RR with the same name

LIST_FOREACH_OTHERS(by_name, j, i)

if (j->state == DNS_ZONE_ITEM_ESTABLISHED)

established = true;

if (established)

i->state = DNS_ZONE_ITEM_ESTABLISHED;

else {

i->state = DNS_ZONE_ITEM_PROBING;

r = dns_zone_item_probe_start(i);

if (r < 0) {

dns_zone_item_remove_and_free(z, i);

i = NULL;

return r;

}

}

} else

i->state = DNS_ZONE_ITEM_ESTABLISHED;

i = NULL;

return 0;

}

static int dns_zone_add_authenticated_answer(DnsAnswer *a, DnsZoneItem *i, int ifindex) {

DnsAnswerFlags flags;

/* From RFC 6762, Section 10.2

if (i->scope->protocol == DNS_PROTOCOL_MDNS &&

!dns_resource_key_is_dnssd_ptr(i->rr->key))

flags = DNS_ANSWER_AUTHENTICATED|DNS_ANSWER_CACHE_FLUSH;

else

flags = DNS_ANSWER_AUTHENTICATED;

return dns_answer_add(a, i->rr, ifindex, flags, NULL);

}

int dns_zone_lookup(DnsZone *z, DnsResourceKey *key, int ifindex, DnsAnswer **ret_answer, DnsAnswer **ret_soa, bool *ret_tentative) {

_cleanup_(dns_answer_unrefp) DnsAnswer *answer = NULL, *soa = NULL;

unsigned n_answer = 0;

DnsZoneItem *first;

bool tentative = true, need_soa = false;

int r;

/* Note that we don't actually need the ifindex for anything. However when it is passed we'll initialize the

assert(z);

assert(key);

assert(ret_answer);

/* First iteration, count what we have */

if (key->type == DNS_TYPE_ANY || key->class == DNS_CLASS_ANY) {

bool found = false, added = false;

int k;

/* If this is a generic match, then we have to

first = hashmap_get(z->by_name, dns_resource_key_name(key));

LIST_FOREACH(by_name, j, first) {

if (!IN_SET(j->state, DNS_ZONE_ITEM_PROBING, DNS_ZONE_ITEM_ESTABLISHED, DNS_ZONE_ITEM_VERIFYING))

continue;

found = true;

k = dns_resource_key_match_rr(key, j->rr, NULL);

if (k < 0)

return k;

if (k > 0) {

n_answer++;

added = true;

}

}

if (found && !added)

need_soa = true;

} else {

bool found = false;

/* If this is a specific match, then look for

first = hashmap_get(z->by_key, key);

LIST_FOREACH(by_key, j, first) {

if (!IN_SET(j->state, DNS_ZONE_ITEM_PROBING, DNS_ZONE_ITEM_ESTABLISHED, DNS_ZONE_ITEM_VERIFYING))

continue;

found = true;

n_answer++;

}

if (!found) {

first = hashmap_get(z->by_name, dns_resource_key_name(key));

LIST_FOREACH(by_name, j, first) {

if (!IN_SET(j->state, DNS_ZONE_ITEM_PROBING, DNS_ZONE_ITEM_ESTABLISHED, DNS_ZONE_ITEM_VERIFYING))

continue;

need_soa = true;

break;

}

}

}

if (n_answer <= 0 && !need_soa)

goto return_empty;

if (n_answer > 0) {

answer = dns_answer_new(n_answer);

if (!answer)

return -ENOMEM;

}

if (need_soa) {

soa = dns_answer_new(1);

if (!soa)

return -ENOMEM;

}

/* Second iteration, actually add the RRs to the answers */

if (key->type == DNS_TYPE_ANY || key->class == DNS_CLASS_ANY) {

bool found = false, added = false;

int k;

first = hashmap_get(z->by_name, dns_resource_key_name(key));

LIST_FOREACH(by_name, j, first) {

if (!IN_SET(j->state, DNS_ZONE_ITEM_PROBING, DNS_ZONE_ITEM_ESTABLISHED, DNS_ZONE_ITEM_VERIFYING))

continue;

found = true;

if (j->state != DNS_ZONE_ITEM_PROBING)

tentative = false;

k = dns_resource_key_match_rr(key, j->rr, NULL);

if (k < 0)

return k;

if (k > 0) {

r = dns_zone_add_authenticated_answer(answer, j, ifindex);

if (r < 0)

return r;

added = true;

}

}

if (found && !added) {

r = dns_answer_add_soa(soa, dns_resource_key_name(key), LLMNR_DEFAULT_TTL, ifindex);

if (r < 0)

return r;

}

} else {

bool found = false;

first = hashmap_get(z->by_key, key);

LIST_FOREACH(by_key, j, first) {

if (!IN_SET(j->state, DNS_ZONE_ITEM_PROBING, DNS_ZONE_ITEM_ESTABLISHED, DNS_ZONE_ITEM_VERIFYING))

continue;

found = true;

if (j->state != DNS_ZONE_ITEM_PROBING)

tentative = false;

r = dns_zone_add_authenticated_answer(answer, j, ifindex);

if (r < 0)

return r;

}

if (!found) {

bool add_soa = false;

first = hashmap_get(z->by_name, dns_resource_key_name(key));

LIST_FOREACH(by_name, j, first) {

if (!IN_SET(j->state, DNS_ZONE_ITEM_PROBING, DNS_ZONE_ITEM_ESTABLISHED, DNS_ZONE_ITEM_VERIFYING))

continue;

if (j->state != DNS_ZONE_ITEM_PROBING)

tentative = false;

add_soa = true;

}

if (add_soa) {

r = dns_answer_add_soa(soa, dns_resource_key_name(key), LLMNR_DEFAULT_TTL, ifindex);

if (r < 0)

return r;

}

}

}

/* If the caller sets ret_tentative to NULL, then use this as

if (!ret_tentative && tentative)

goto return_empty;

*ret_answer = TAKE_PTR(answer);

if (ret_soa)

*ret_soa = TAKE_PTR(soa);

if (ret_tentative)

*ret_tentative = tentative;

return 1;

return_empty:

*ret_answer = NULL;

if (ret_soa)

*ret_soa = NULL;

if (ret_tentative)

*ret_tentative = false;

return 0;

}

void dns_zone_item_conflict(DnsZoneItem *i) {

assert(i);

if (!IN_SET(i->state, DNS_ZONE_ITEM_PROBING, DNS_ZONE_ITEM_VERIFYING, DNS_ZONE_ITEM_ESTABLISHED))

return;

log_info("Detected conflict on %s", strna(dns_resource_record_to_string(i->rr)));

dns_zone_item_probe_stop(i);

/* Withdraw the conflict item */

i->state = DNS_ZONE_ITEM_WITHDRAWN;

(void) dnssd_signal_conflict(i->scope->manager, dns_resource_key_name(i->rr->key));

/* Maybe change the hostname */

if (manager_is_own_hostname(i->scope->manager, dns_resource_key_name(i->rr->key)) > 0)

manager_next_hostname(i->scope->manager);

}

void dns_zone_item_notify(DnsZoneItem *i) {

assert(i);

assert(i->probe_transaction);

if (i->block_ready > 0)

return;

if (IN_SET(i->probe_transaction->state, DNS_TRANSACTION_NULL, DNS_TRANSACTION_PENDING, DNS_TRANSACTION_VALIDATING))

return;

if (i->probe_transaction->state == DNS_TRANSACTION_SUCCESS) {

bool we_lost = false;

/* The probe got a successful reply. If we so far

if (!IN_SET(i->state, DNS_ZONE_ITEM_ESTABLISHED, DNS_ZONE_ITEM_VERIFYING)) {

log_debug("Got a successful probe for not yet established RR, we lost.");

we_lost = true;

} else if (i->probe_transaction->scope->protocol == DNS_PROTOCOL_LLMNR) {

assert(i->probe_transaction->received);

we_lost = memcmp(&i->probe_transaction->received->sender, &i->probe_transaction->received->destination, FAMILY_ADDRESS_SIZE(i->probe_transaction->received->family)) < 0;

if (we_lost)

log_debug("Got a successful probe reply for an established RR, and we have a lexicographically larger IP address and thus lost.");

}

if (we_lost) {

dns_zone_item_conflict(i);

return;

}

log_debug("Got a successful probe reply, but peer has lexicographically lower IP address and thus lost.");

}

log_debug("Record %s successfully probed.", strna(dns_resource_record_to_string(i->rr)));

dns_zone_item_probe_stop(i);

i->state = DNS_ZONE_ITEM_ESTABLISHED;

}

static int dns_zone_item_verify(DnsZoneItem *i) {

int r;

assert(i);

if (i->state != DNS_ZONE_ITEM_ESTABLISHED)

return 0;

log_debug("Verifying RR %s", strna(dns_resource_record_to_string(i->rr)));

i->state = DNS_ZONE_ITEM_VERIFYING;

r = dns_zone_item_probe_start(i);

if (r < 0) {

log_error_errno(r, "Failed to start probing for verifying RR: %m");

i->state = DNS_ZONE_ITEM_ESTABLISHED;

return r;

}

return 0;

}

int dns_zone_check_conflicts(DnsZone *zone, DnsResourceRecord *rr) {

DnsZoneItem *first;

int c = 0;

assert(zone);

assert(rr);

/* This checks whether a response RR we received from somebody

/* No conflict if we don't have the name at all. */

first = hashmap_get(zone->by_name, dns_resource_key_name(rr->key));

if (!first)

return 0;

/* No conflict if we have the exact same RR */

if (dns_zone_get(zone, rr))

return 0;

/* No conflict if it is DNS-SD RR used for service enumeration. */

if (dns_resource_key_is_dnssd_ptr(rr->key))

return 0;

/* OK, somebody else has RRs for the same name. Yuck! Let's

LIST_FOREACH(by_name, i, first) {

if (dns_resource_record_equal(i->rr, rr))

continue;

dns_zone_item_verify(i);

c++;

}

return c;

}

int dns_zone_verify_conflicts(DnsZone *zone, DnsResourceKey *key) {

DnsZoneItem *first;

int c = 0;

assert(zone);

/* Somebody else notified us about a possible conflict. Let's

first = hashmap_get(zone->by_name, dns_resource_key_name(key));

if (!first)

return 0;

LIST_FOREACH(by_name, i, first) {

dns_zone_item_verify(i);

c++;

}

return c;

}

void dns_zone_verify_all(DnsZone *zone) {

DnsZoneItem *i;

assert(zone);

HASHMAP_FOREACH(i, zone->by_key)

LIST_FOREACH(by_key, j, i)

dns_zone_item_verify(j);

}

void dns_zone_dump(DnsZone *zone, FILE *f) {

DnsZoneItem *i;

if (!zone)

return;

if (!f)

f = stdout;

HASHMAP_FOREACH(i, zone->by_key)

LIST_FOREACH(by_key, j, i) {

const char *t;

t = dns_resource_record_to_string(j->rr);

if (!t) {

log_oom();

continue;

}

fputc('\t', f);

fputs(t, f);

fputc('\n', f);

}

}

bool dns_zone_is_empty(DnsZone *zone) {

if (!zone)

return true;

return hashmap_isempty(zone->by_key);

}

bool dns_zone_contains_name(DnsZone *z, const char *name) {

DnsZoneItem *first;

first = hashmap_get(z->by_name, name);

if (!first)

return false;

LIST_FOREACH(by_name, i, first) {

if (!IN_SET(i->state, DNS_ZONE_ITEM_PROBING, DNS_ZONE_ITEM_ESTABLISHED, DNS_ZONE_ITEM_VERIFYING))

continue;

return true;

}

return false;

}