summaryrefslogtreecommitdiffstats
path: root/src/resolve/resolved-dns-scope.h (follow)
Commit message (Collapse)AuthorAgeFilesLines
* resolved: decrease mdns/llmnr priority for the reverse mapping domainsRonan Pigott2024-03-061-0/+1
| | | | | | | | | | | | Previously all queries to the reverse mapping domains (in-addr.arpa and ip6.arpa) were considered to be in-scope for mdns and llmnr at the same priority as DNS. This caused sd-resolved to ignore NXDOMAIN responses from dns in favor of lengthy timeouts. This narrows the scope of mdns and llmnr so they are not invariably considered as fallbacks for these domains. Now, mdns/llmnr on a link will only be used as a fallback when there is no suitable DNS scope, and when that link is DefaultRoute.
* Merge pull request #31621 from poettering/resolved-proxy-doLuca Boccassi2024-03-061-1/+4
|\ | | | | resolved: proxy upstream local requests to our stub with DO bit set
| * resolved: do DNS RR type based routingLennart Poettering2024-03-051-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | So far we only looked at the domain name when routing requests to specific scopes. With this we'll also take the DNS RR type into account. This takes benefit of the fact that lookups for RRs such as SOA or NS or the various DNSSEC RR types never really make sense to be routed to LLMNR or mDNS, since they don't have concepts there. This hence refuses to route requests for those RR types to the LLMNR/mDNS scopes, which hence means they'll likely be routed to classic DNS instead. This should improve behaviour of tools that assumes it speaks to classic DNS only via 127.0.0.53, since it will now usually do that.
| * resolved: add new SD_RESOLVED_RELAX_SINGLE_LABEL resolver flagLennart Poettering2024-03-051-1/+1
| | | | | | | | | | | | This new flag allows resolving single label names via public DNS. By default this is turned off, and this option allows excepting a lookup for this.
* | resolved: remove entry from cache when goodbye packet receivedVishal Chillara Srinivas2024-03-051-0/+2
|/ | | | | | | | | | RFC6762 10.1 says that queriers receiving a Multicast DNS response with a TTL of zero SHOULD record a TTL of 1 and then delete the record one second later. Added a timer event to trigger a callback to clean-up the cache one second after a goodbye packet is received. The callback also checks for any cache entries expiring within the next one second and schedules follow-up cleanup callbacks accordingly.
* resolved: add DumpCache varlink call for acquiring a complete dump of all of ↵Lennart Poettering2023-06-121-0/+2
| | | | | | | | | | | | resolved's RR caches This adds a simple varlink call io.systemd.Resolve.Monitor.DumpCache to the existing io.systemd.Resolve.Monitor service. It compiles a JSON object containing the per-scope cache entries and returns it. Replaces: #20053 #19104 Fixes: #14796
* resolve: make dns_scope_good_domain() take DnsQuery*Yu Watanabe2022-02-221-2/+2
|
* resolved: drop pointless bitfield on a lone boolZbigniew Jędrzejewski-Szmek2021-05-141-1/+2
|
* resolved: tweak how we calculate MTU for sending packetsLennart Poettering2021-02-181-1/+1
| | | | | | Let's take all MTU info we possibly have into account, i.e. the one reported via netlink, as before and the one the socket might now (from PMTUD and such), clamped by our own ideas.
* resolved: don't redundantly switch DNS servers because of transaction failuresLennart Poettering2021-02-151-1/+1
| | | | | | | | | | | | When a transaction fails and we decide to switch DNS servers, don#t do so unconditionally. Check if the current DNS server is still the same as when the transaction was initiated. And if not, do not do anything. That should reduce the number of redundant DNS server switches if many parallel transactions fail simultaneously (which is pretty likely if DNSSEC is on). Fixes: #17040
* Merge pull request #17823 from poettering/resolved-just-bypassZbigniew Jędrzejewski-Szmek2021-02-111-9/+7
|\ | | | | resolved: just the dnssec bypass logic
| * resolved: add support for answering DNSSEC questions on the stubLennart Poettering2021-02-091-9/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This substantially beefs up the local DNS stub feature set in order to allow local clients to do DNSSEC validation through the stub. Previously we'd return NOTIMP if we'd get a DO or DO+CD lookup. With this change we'll instead: 1. If we get DO+CD requests (i.e. DNSSEC with no local checking) we'll proxy DNS queries and response mostly unmodified to/from upstream DNS servers if possible (this is called "bypass" mode). We will patch in new request IDs, (and patch them back out on reply), so that we can sanely keep track of things. We'll also maintain a minimal local cache for such lookups, always keeping the whole DNS packets in it (if we reply from cache we'll patch the TTLs of all included RRs). 2. If we get DO requests without CD (i.e. DNSSEC with local checking) we'll resolve and validate locally. In this mode we will not proxy packets, but generate our own. We will however cache the combination of answer RRs (along with their packet section assignments) we got back in the cache, and use this information to generate reply packets from the DNS stub. In both cases: if we determine a lookup is to be answered from LLMNR or mDNS we'll always revert to non-DNSSEC, non-proxy operation as before. Answers will lack the DO bit then, since the data cannot be validated via DNSSEC by the clients. To make this logic more debuggable, this also adds query flags for turning off RR sources. i.e. cache/network/zone/trust anchor/local synthesis may now be disabled individually for each lookup. The cache is substantially updated to make all this work: in addition to caching simple RRs for lookup RR keys, we'll now cache the whole packets and the whole combination of RRs, so that we can answer DO and DO+CD replies sensibly according to the rules described above. This sounds wasteful, but given that the DnsResourceRecord/DnsResourceKey/DnsAnswer/DnsPacket objects are all ref-counted and we try to merge references the actual additional memory used should be limited (but this might be something to optimize further later on). To implement classic RR key lookups and new-style packet proxy lookups (i.e. the ones necessary for DO+CD packet proxying, as described above) DnsTransaction and DnsQuery objects now always maintain either a DnsResourceKey/DnsQuestion as lookup key or a DnsPacket for "bypass" mode. Fixes: #4621 #17218
* | tree-wide: use -EINVAL for enum invalid valuesZbigniew Jędrzejewski-Szmek2021-02-101-1/+1
|/ | | | | | | | | As suggested in https://github.com/systemd/systemd/pull/11484#issuecomment-775288617. This does not touch anything exposed in src/systemd. Changing the defines there would be a compatibility break. Note that tests are broken after this commit. They will be fixed in the next one.
* license: LGPL-2.1+ -> LGPL-2.1-or-laterYu Watanabe2020-11-091-1/+1
|
* resolve: support port specifier in DNS= settingYu Watanabe2020-07-201-1/+1
|
* resolved: optionally allow single-label A/AAAA queriesZbigniew Jędrzejewski-Szmek2020-06-181-1/+1
|
* resolved: Break include cyclesDaan De Meyer2020-05-071-2/+3
|
* resolved: add an explicit way to configure whether a link is useful as ↵Lennart Poettering2018-12-211-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | default route Previously, we'd use a link as "default" route depending on whether there are route-only domains defined on it or not. (If there are, it would not be used as default route, if there aren't it would.) Let's make this explicit and add a link variable controlling this. The variable is not changeable from the outside yet, but subsequent commits are supposed to add that. Note that making this configurable adds a certain amount of redundancy, as there are now two ways to ensure a link does not receive "default" lookup (i.e. DNS queries matching no configured route): 1. By ensuring that at least one other link configures a route on it (for example by add "." to its search list) 2. By setting this new boolean to false. But this is exactly what is intended with this patch: that there is an explicit way to configure on the link itself whether it receives 'default' traffic, rather than require this to be configured on other links. The variable added is a tri-state: if true, the link is suitable for recieving "default" traffic. If false, the link is not suitable for it. If unset (i.e. negative) the original logic of "has this route-only routes" is used, to ensure compatibility with the status quo ante.
* resolved: rework dns_server_limited_domains(), replace by ↵Lennart Poettering2018-12-211-1/+2
| | | | | | | | | | | | | | dns_scope_has_route_only_domains() The function dns_server_limited_domains() was very strange as it enumerate the domains associated with a DnsScope object to determine whether any "route-only" domains, but did so as a function associated with a DnsServer object. Let's clear this up, and replace it by a function associated with a DnsScope instead. This makes more sense philosphically and allows us to reduce the loops through which we need to jump to determine whether a scope is suitable for default routing a bit.
* resolved: rework how we determine which scope to send a query toLennart Poettering2018-12-211-1/+2
| | | | Fixes: #10830 #9825 #9472
* resolved: add comment, explaining when Scope variables are copied from LinkLennart Poettering2018-12-211-0/+2
|
* resolved: rename_DNS_SCOPE_INVALID → _DNS_SCOPE_MATCH_INVALIDLennart Poettering2018-12-211-1/+1
| | | | | The _INVALID and _MAX enum fields should always use the full name of thenum.
* tree-wide: remove Lennart's copyright linesLennart Poettering2018-06-141-4/+0
| | | | | | | | | | | These lines are generally out-of-date, incomplete and unnecessary. With SPDX and git repository much more accurate and fine grained information about licensing and authorship is available, hence let's drop the per-file copyright notice. Of course, removing copyright lines of others is problematic, hence this commit only removes my own lines and leaves all others untouched. It might be nicer if sooner or later those could go away too, making git the only and accurate source of authorship information.
* tree-wide: drop 'This file is part of systemd' blurbLennart Poettering2018-06-141-2/+0
| | | | | | | | | | | | | | | | This part of the copyright blurb stems from the GPL use recommendations: https://www.gnu.org/licenses/gpl-howto.en.html The concept appears to originate in times where version control was per file, instead of per tree, and was a way to glue the files together. Ultimately, we nowadays don't live in that world anymore, and this information is entirely useless anyway, as people are very welcome to copy these files into any projects they like, and they shouldn't have to change bits that are part of our copyright header for that. hence, let's just get rid of this old cruft, and shorten our codebase a bit.
* resolve: rename PrivateDNS to DNSOverTLSIwan Timmer2018-06-141-1/+1
| | | PrivateDNS is not considered a good name for this option, so rename it to DNSOverTLS
* resolved: support for DNS-over-TLSIwan Timmer2018-06-111-0/+1
| | | | Add support for DNS-over-TLS using GnuTLS. To reduce latency also TLS False Start and TLS session resumption is supported.
* resolved: TCP fast open connectionsIwan Timmer2018-06-111-1/+1
| | | | Add suport for TCP fast open connection to reduce latency for successive DNS request over TCP
* tree-wide: drop license boilerplateZbigniew Jędrzejewski-Szmek2018-04-061-13/+0
| | | | | | | | | | Files which are installed as-is (any .service and other unit files, .conf files, .policy files, etc), are left as is. My assumption is that SPDX identifiers are not yet that well known, so it's better to retain the extended header to avoid any doubt. I also kept any copyright lines. We can probably remove them, but it'd nice to obtain explicit acks from all involved authors before doing that.
* resolved: when a server consistently returns SERVFAIL, try another oneLennart Poettering2017-12-121-0/+1
| | | | | | | | | Currently, we accept SERVFAIL after downgrading fully, cache it and move on. Let's extend this a bit: after downgrading fully, if the SERVFAIL logic continues to be an issue, then use a different DNS server if there are any. Fixes: #7147
* resolved: put DNS-SD records to mDNS-enabled zones.Dmitry Rozhkov2017-12-081-0/+4
|
* Add SPDX license identifiers to source files under the LGPLZbigniew Jędrzejewski-Szmek2017-11-191-0/+1
| | | | | This follows what the kernel is doing, c.f. https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5fd54ace4721fc5ce2bb5aef6318fcf17f421460.
* resolved: let's propagate errors from dns_scope_announce() and elsewhereLennart Poettering2017-02-131-1/+1
| | | | | | | | We don't actually make use of the return value for now, but it matches our coding style elsewhere, and it actually shortens our code quite a bit. Also, add a missing OOM check after dns_answer_new().
* resolved: implement sending goodbye mDNS packetDmitry Rozhkov2017-01-191-1/+1
| | | | | | resolved: remove unneeded braces Signed-off-by: Dmitry Rozhkov <dmitry.rozhkov@linux.intel.com>
* resolved: implement mDNS probing and announcementDmitry Rozhkov2017-01-191-0/+5
| | | | Signed-off-by: Dmitry Rozhkov <dmitry.rozhkov@linux.intel.com>
* resolved: process mDNS queriesDmitry Rozhkov2017-01-191-0/+1
| | | | | | | This way other hosts can resolve our hostname to its address using mDNS. Signed-off-by: Dmitry Rozhkov <dmitry.rozhkov@linux.intel.com>
* resolved: directly include some required headers instead of inheritingDavid Michael2016-09-011-0/+3
|
* resolved: make sure we initialize the ifindex of direct zone answers properlyLennart Poettering2016-06-141-0/+2
| | | | | Previously, after checking the local zone for a reply and finding one we'd not initialize the answer ifindex from that. Let's fix that.
* tree-wide: remove Emacs lines from all filesDaniel Mack2016-02-101-2/+0
| | | | | This should be handled fine now by .dir-locals.el, so need to carry that stuff in every file.
* resolved: rework what ResolveHostname() with family == AF_UNSPEC meansLennart Poettering2016-02-011-1/+1
| | | | | | | | | | | | | | Previously, if a hostanem is resolved with AF_UNSPEC specified, this would be used as indication to resolve both an AF_INET and an AF_INET6 address. With this change this logic is altered: an AF_INET address is only resolved if there's actually a routable IPv4 address on the specific interface, and similar an AF_INET6 address is only resolved if there's a routable IPv6 address. With this in place, it's ensured that the returned data is actually connectable by applications. This logic mimics glibc's resolver behaviour. Note that if the client asks explicitly for AF_INET or AF_INET6 it will get what it asked for. This also simplifies the logic how it is determined whether a specific lookup shall take place on a scope. Specifically, the checks with dns_scope_good_key() are now moved out of the transaction code and into the query code, so that we don't even create a transaction object on a specific scope if we cannot execute the resolution on it anyway.
* resolve: generate a nice clean error when clients try to resolve a name when ↵Lennart Poettering2016-01-251-0/+2
| | | | the network is down
* resolved: rework OPT RR generation logicLennart Poettering2015-12-271-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | This moves management of the OPT RR out of the scope management and into the server and packet management. There are now explicit calls for appending and truncating the OPT RR from a packet (dns_packet_append_opt() and dns_packet_truncate_opt()) as well as a call to do the right thing depending on a DnsServer's feature level (dns_server_adjust_opt()). This also unifies the code to pick a server between the TCP and UDP code paths, and makes sure the feature level used for the transaction is selected at the time the server is picked, and not changed until the next time we pick a server. The server selction code is now unified in dns_transaction_pick_server(). This all fixes problems when changing between UDP and TCP communication for the same server, and makes sure the UDP and TCP codepaths are more alike. It also makes sure we never keep the UDP port open when switchung to TCP, so that we don't have to handle incoming datagrams on the latter we don't expect. As the new code picks the DNS server at the time we make a connection, we don't need to invalidate the DNS server anymore when changing to the next one, thus dns_transaction_next_dns_server() has been removed.
* resolved: name TCP and UDP socket calls uniformlyLennart Poettering2015-12-261-3/+3
| | | | | | | | Previously the calls for emitting DNS UDP packets were just called dns_{transacion|scope}_emit(), but the one to establish a DNS TCP connection was called dns_transaction_open_tcp(). Clean this up, and rename them dns_{transaction|scope}_emit_udp() and dns_transaction_open_tcp().
* resolved: add code to join/leave mDNS multicast groupsDaniel Mack2015-12-081-0/+1
| | | | | Per link, join the mDNS multicast groups when the scope is created, and leave it again when the scope goes away.
* resolved: introduce a dnssec_mode setting per scopeLennart Poettering2015-12-031-0/+2
| | | | | | | | | The setting controls which kind of DNSSEC validation is done: none at all, trusting the AD bit, or client-side validation. For now, no validation is implemented, hence the setting doesn't do much yet, except of toggling the CD bit in the generated messages if full client-side validation is requested.
* resolved: rework how we allow allow queries to be dispatched to scopesLennart Poettering2015-12-031-1/+0
| | | | | | | | | | | | | | Previously, we'd never do any single-label or root domain lookups via DNS, thus leaving single-label lookups to LLMNR and the search path logic in order that single-label names don't leak too easily onto the internet. With this change we open things up a bit, and only prohibit A/AAAA lookups of single-label/root domains, but allow all other lookups. This should provide similar protection, but allow us to resolve DNSKEY+DS RRs for the top-level and root domains. (This also simplifies handling of the search domain detection, and gets rid of dns_scope_has_search_domains() in favour of dns_scope_get_search_domains()).
* resolved: implement minimal EDNS0 supportTom Gundersen2015-11-271-1/+1
| | | | | | | | | | | | | | | This is a minimal implementation of RFC6891. Only default values are used, so in reality this will be a noop. EDNS0 support is dependent on the current server's feature level, so appending the OPT pseudo RR is done when the packet is emitted, rather than when it is assembled. To handle different feature levels on retransmission, we strip off the OPT RR again after sending the packet. Similarly, to how we fall back to TCP if UDP fails, we fall back to plain UDP if EDNS0 fails (but if EDNS0 ever succeeded we never fall back again, and after a timeout we will retry EDNS0).
* resolved: handle properly if there are multiple transactions for the same ↵Lennart Poettering2015-11-271-1/+11
| | | | | | | | | | | | | | | | | key per scope When the zone probing code looks for a transaction to reuse it will refuse to look at transactions that have been answered from cache or the zone itself, but insist on the network. This has the effect that there might be multiple transactions around for the same key on the same scope. Previously we'd track all transactions in a hashmap, indexed by the key, which implied that there would be only one transaction per key, per scope. With this change the hashmap will only store the most recent transaction per key, and a linked list will be used to track all transactions per scope, allowing multiple per-key per-scope. Note that the linked list fields for this actually already existed in the DnsTransaction structure, but were previously unused.
* dns-domain: simplify dns_name_is_root() and dns_name_is_single_label()Lennart Poettering2015-11-251-1/+1
| | | | | | | | | | | | | | Let's change the return value to bool. If we encounter an error while parsing, return "false" instead of the actual parsing error, after all the specified hostname does not qualify for what the function is supposed to test. Dealing with the additional error codes was always cumbersome, and easily misused, like for example in the DHCP code. Let's also rename the functions from dns_name_root() to dns_name_is_root(), to indicate that this function checks something and returns a bool. Similar for dns_name_is_signal_label().
* resolved: fully support DNS search domainsLennart Poettering2015-11-251-0/+4
| | | | | | | | | | | | | | | | | This adds support for searching single-label hostnames in a set of configured search domains. A new object DnsQueryCandidate is added that links queries to scopes. It keeps track of the search domain last used for a query on a specific link. Whenever a host name was unsuccessfuly resolved on a scope all its transactions are flushed out and replaced by a new set, with the next search domain appended. This also adds a new flag SD_RESOLVED_NO_SEARCH to disable search domain behaviour. The "systemd-resolve-host" tool is updated to make this configurable via --search=. Fixes #1697
* resolved: add a generic DnsSearchDomain conceptLennart Poettering2015-11-251-2/+2
| | | | | | | | | | With this change, we add a new object to resolved, "DnsSearchDomain=" which wraps a search domain. This is then used to introduce a global search domain list, in addition to the existing per-link search domain list which is reword to make use of this new object too. This is preparation for implement proper unicast DNS search domain support.
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-03 11:42:08 +0100