summaryrefslogtreecommitdiff
path: root/src/resolve/resolved-dns-rr.c
AgeCommit message (Collapse)Author
2015-12-03resolved: rework how we allow allow queries to be dispatched to scopesLennart Poettering
Previously, we'd never do any single-label or root domain lookups via DNS, thus leaving single-label lookups to LLMNR and the search path logic in order that single-label names don't leak too easily onto the internet. With this change we open things up a bit, and only prohibit A/AAAA lookups of single-label/root domains, but allow all other lookups. This should provide similar protection, but allow us to resolve DNSKEY+DS RRs for the top-level and root domains. (This also simplifies handling of the search domain detection, and gets rid of dns_scope_has_search_domains() in favour of dns_scope_get_search_domains()).
2015-12-03resolved: optionally, allocate DnsResourceKey objects on the stackLennart Poettering
Sometimes when looking up entries in hashmaps indexed by a DnsResourceKey it is helpful not having to allocate a full DnsResourceKey dynamically just to use it as search key. Instead, optionally allow allocation of a DnsResourceKey on the stack. Resource keys allocated like that of course are subject to other lifetime cycles than the usual Resource keys, hence initialize the reference counter to to (unsigned) -1. While we are at it, remove the prototype for dns_resource_key_new_dname() which was never implemented.
2015-12-03resolved: move algorithm/digest definitions into resolved-dns-rr.hLennart Poettering
After all, they are for flags and parameters of RRs and already relevant when dealing with RRs outside of the serialization concept.
2015-12-02resolved: add code to generate the wire format for a single RRLennart Poettering
This adds dns_resource_record_to_wire_format() that generates the raw wire-format of a single DnsResourceRecord object, and caches it in the object, optionally in DNSSEC canonical form. This call is used later to generate the RR serialization of RRs to verify. This adds four new fields to DnsResourceRecord objects: - wire_format points to the buffer with the wire-format version of the RR - wire_format_size stores the size of that buffer - wire_format_rdata_offset specifies the index into the buffer where the RDATA of the RR begins (i.e. the size of the key part of the RR). - wire_format_canonical is a boolean that stores whether the cached wire format is in DNSSEC canonical form or not. Note that this patch adds a mode where a DnsPacket is allocated on the stack (instead of on the heap), so that it is cheaper to reuse the DnsPacket object for generating this wire format. After all we reuse the DnsPacket object for this, since it comes with all the dynamic memory management, and serialization calls we need anyway.
2015-12-02resolved: store DNSKEY fields flags+protocol as-isLennart Poettering
When verifying signatures we need to be able to verify the original data we got for an RR set, and that means we cannot simply drop flags bits or consider RRs invalid too eagerly. Hence, instead of parsing the DNSKEY flags store them as-is. Similar, accept the protocol field as it is, and don't consider it a parsing error if it is not 3. Of course, this means that the DNSKEY handling code later on needs to check explicit for protocol != 3.
2015-11-25dns-domain: simplify dns_name_is_root() and dns_name_is_single_label()Lennart Poettering
Let's change the return value to bool. If we encounter an error while parsing, return "false" instead of the actual parsing error, after all the specified hostname does not qualify for what the function is supposed to test. Dealing with the additional error codes was always cumbersome, and easily misused, like for example in the DHCP code. Let's also rename the functions from dns_name_root() to dns_name_is_root(), to indicate that this function checks something and returns a bool. Similar for dns_name_is_signal_label().
2015-11-25resolved: fully support DNS search domainsLennart Poettering
This adds support for searching single-label hostnames in a set of configured search domains. A new object DnsQueryCandidate is added that links queries to scopes. It keeps track of the search domain last used for a query on a specific link. Whenever a host name was unsuccessfuly resolved on a scope all its transactions are flushed out and replaced by a new set, with the next search domain appended. This also adds a new flag SD_RESOLVED_NO_SEARCH to disable search domain behaviour. The "systemd-resolve-host" tool is updated to make this configurable via --search=. Fixes #1697
2015-11-24resolved: implement client-side DNAME resolutionLennart Poettering
Most servers apparently always implicitly convert DNAME to CNAME, but some servers don't, hence implement this properly, as this is required by edns0.
2015-11-23resolved: accept TXT records with non-UTF8 stringsLennart Poettering
RFC 6763 is very clear that TXT RRs should allow arbitrary binary content, hence let's actually accept that. This also means accepting NUL bytes in the middle of strings.
2015-10-27util-lib: split out allocation calls into alloc-util.[ch]Lennart Poettering
2015-10-27util-lib: split out hex/dec/oct encoding/decoding into its own fileLennart Poettering
2015-10-24util-lib: split our string related calls from util.[ch] into its own file ↵Lennart Poettering
string-util.[ch] There are more than enough calls doing string manipulations to deserve its own files, hence do something about it. This patch also sorts the #include blocks of all files that needed to be updated, according to the sorting suggestions from CODING_STYLE. Since pretty much every file needs our string manipulation functions this effectively means that most files have sorted #include blocks now. Also touches a few unrelated include files.
2015-10-05hashmap: refactor hash_funcTom Gundersen
All our hash functions are based on siphash24(), factor out siphash_init() and siphash24_finalize() and pass the siphash state to the hash functions rather than the hash key. This simplifies the hash functions, and in particular makes composition simpler as calling siphash24_compress() repeatedly on separate chunks of input has the same effect as first concatenating the input and then calling siphash23_compress() on the result.
2015-09-16resolved: rr - introduce dns_resource_key_new_redirect()Tom Gundersen
Takes a key and CNAME RR and returns the canonical RR of the right type. Make use of this in dns_question_redirect().
2015-09-16resolved: rr - introduce dns_resource_key_new_cname()Tom Gundersen
Creates a new CNAME RR key with the same class and name as an existing key.
2015-08-21resolved: rework synthesizing logicLennart Poettering
With this change we'll now also generate synthesized RRs for the local LLMNR hostname (first label of system hostname), the local mDNS hostname (first label of system hostname suffixed with .local), the "gateway" hostname and all the reverse PTRs. This hence takes over part of what nss-myhostname already implemented. Local hostnames resolve to the set of local IP addresses. Since the addresses are possibly on different interfaces it is necessary to change the internal DnsAnswer object to track per-RR interface indexes, and to change the bus API to always return the interface per-address rather than per-reply. This change also patches the existing clients for resolved accordingly (nss-resolve + systemd-resolve-host). This also changes the routing logic for queries slightly: we now ensure that the local hostname is never resolved via LLMNR, thus making it trustable on the local system.
2015-07-24resolved: fix DNS_TYPE_ANY vs DNS_CLASS_ANY confusionDaniel Mack
Assigning a TPYE enum value to a class variable is certainly wrong. However, they both have the same value, so the result was correct nevertheless.
2015-07-23resolved: rr - SSHFP contains the fingerprint, not the keyTom Gundersen
Rename the field to make this clearer.
2015-07-23Merge pull request #669 from poettering/dns-rr-memdupTom Gundersen
resolve: unify memdup() code when parsing RRs
2015-07-23resolve: unify memdup() code when parsing RRsLennart Poettering
Let's make dns_packet_read_public_key() more generic by renaming it to dns_packet_read_memdup() (which more accurately describes what it does...). Then, patch all cases where we memdup() RR data to use this new call. This specifically checks for zero-length objects, and handles them gracefully. It will set zero length payload fields as a result. Special care should be taken to ensure that any code using this call can handle the returned allocated field to be NULL if the size is specified as 0!
2015-07-23resolve: fix two minor memory leaksLennart Poettering
strv_extend() already strdup()s internally, no need to to this twice. (Also, was missing OOM check...). Use strv_consume() when we already have a string allocated whose ownership we want to pass to the strv. This fixes 50f1e641a93cacfc693b0c3d300bee5df0c8c460.
2015-07-16bitmap: use external iteratorTom Gundersen
Reuse the Iterator object from hashmap.h and expose a similar API. This allows us to do { Iterator i; unsigned n; BITMAP_FOREACH(n, b, i) { Iterator j; unsigned m; BITMAP_FOREACH(m, b, j) { ... } } } without getting confused. Requested by David.
2015-07-14resolved: rr - add NSEC3 supportTom Gundersen
Needed for DNSSEC.
2015-07-14resolved: rr - add NSEC supportTom Gundersen
Needed for DNSSEC.
2015-07-14resolved: improve printing of unknown RRsTom Gundersen
This implements the recommendations from RFC3597.
2015-07-14resolved: rr - add DS supportTom Gundersen
Needed for DNSSEC.
2015-07-14resolved: rr - print formated timestamps in RRSIGTom Gundersen
2015-07-14resolved: rr - print DNSKEY and RRSIG in base64Tom Gundersen
As mandated by RFC4034.
2015-06-10resolve: move dns routines into sharedNick Owens
2014-11-27resolve: fix NULL deref on strv comparisonDavid Herrmann
A strv might be NULL if it is empty. The txt.strings comparison doesn't take that into account. Introduce strv_equal() to provide a proper helper for this and fix resolve to use it. Thanks to Stanisław Pitucha <viraptor@gmail.com> for reporting this!
2014-09-15hashmap: introduce hash_ops to make struct Hashmap smallerMichal Schmidt
It is redundant to store 'hash' and 'compare' function pointers in struct Hashmap separately. The functions always comprise a pair. Store a single pointer to struct hash_ops instead. systemd keeps hundreds of hashmaps, so this saves a little bit of memory.
2014-08-20resolved-dns-rr: fix typoLukas Nykryn
a->rrsig.type_covered != a->rrsig.type_covered" is always false regardless of the values of its operands because those operands are identical.
2014-08-03resolved: RRSIG recordsZbigniew Jędrzejewski-Szmek
2014-08-03resolved: add identifiers for dnssec algorithmsZbigniew Jędrzejewski-Szmek
2014-08-03resolved: DNSKEY recordsZbigniew Jędrzejewski-Szmek
2014-08-03resolve: add more record types and convert to gperf tableZbigniew Jędrzejewski-Szmek
We are unlikely to evert support most of them, but we can at least display the types properly. The list is taken from the IANA list. The table of number->name mappings is converted to a switch statement. gcc does a nice job of optimizing lookup (when optimization is enabled). systemd-resolve-host -t is now case insensitive.
2014-08-03resolved: align last rr columnZbigniew Jędrzejewski-Szmek
2014-07-31resolved: properly compare RRs we cannot parseLennart Poettering
2014-07-31resolved: properly process SSHFP RRsLennart Poettering
2014-07-31resolved: properly process SRV recordsLennart Poettering
2014-07-31resolved: properly process DNAME RRsLennart Poettering
2014-07-31resolved: LOC recordsZbigniew Jędrzejewski-Szmek
LOC records have a version field. So far only version 0 has been published, but if a record with a different version was encountered, our only recourse is to treat it as an unknown type. This is implemented with the 'unparseable' flag, which causes the serialization/deserialization and printing function to cause the record as a blob. The flag can be used if other packet types cannot be parsed for whatever reason.
2014-07-31resolved: SPF recordsZbigniew Jędrzejewski-Szmek
2014-07-31resolved: TXT recordsZbigniew Jędrzejewski-Szmek
2014-07-31resolved: MX recordsZbigniew Jędrzejewski-Szmek
2014-07-30resolved: add API for resolving specific RRsLennart Poettering
2014-07-30resolved: include SOA records in LLMNR replies for non-existing RRs to allow ↵Lennart Poettering
negative caching
2014-07-29resolve: add llmnr responder side for UDP and TCPLennart Poettering
Name defending is still missing.
2014-07-23resolved: implement negative cachingLennart Poettering
2014-07-23resolved: rework logic so that we can share transactions between queries of ↵Lennart Poettering
different clients