1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
2 #pragma once
3
4 #include <netinet/ip.h>
5 #include <netinet/ip6.h>
6 #include <netinet/udp.h>
7
8 #include "hashmap.h"
9 #include "in-addr-util.h"
10 #include "macro.h"
11 #include "sparse-endian.h"
12
13 typedef struct DnsPacketHeader DnsPacketHeader;
14 typedef struct DnsPacket DnsPacket;
15
16 #include "resolved-def.h"
17 #include "resolved-dns-answer.h"
18 #include "resolved-dns-question.h"
19 #include "resolved-dns-rr.h"
20
21 typedef enum DnsProtocol {
22 DNS_PROTOCOL_DNS,
23 DNS_PROTOCOL_MDNS,
24 DNS_PROTOCOL_LLMNR,
25 _DNS_PROTOCOL_MAX,
26 _DNS_PROTOCOL_INVALID = -EINVAL,
27 } DnsProtocol;
28
29 struct DnsPacketHeader {
30 uint16_t id;
31 be16_t flags;
32 be16_t qdcount;
33 be16_t ancount;
34 be16_t nscount;
35 be16_t arcount;
36 } _packed_;
37
38 #define DNS_PACKET_HEADER_SIZE sizeof(DnsPacketHeader)
39 #define UDP4_PACKET_HEADER_SIZE (sizeof(struct iphdr) + sizeof(struct udphdr))
40 #define UDP6_PACKET_HEADER_SIZE (sizeof(struct ip6_hdr) + sizeof(struct udphdr))
41
42 assert_cc(sizeof(struct ip6_hdr) == 40);
43 assert_cc(sizeof(struct iphdr) == 20);
44 assert_cc(sizeof(struct udphdr) == 8);
45 assert_cc(sizeof(DnsPacketHeader) == 12);
46
47 /* The various DNS protocols deviate in how large a packet can grow, but the TCP transport has a 16bit size
48 * field, hence that appears to be the absolute maximum. */
49 #define DNS_PACKET_SIZE_MAX 0xFFFFu
50
51 /* The default size to use for allocation when we don't know how large
52 * the packet will turn out to be. */
53 #define DNS_PACKET_SIZE_START 512u
54
55 /* RFC 1035 say 512 is the maximum, for classic unicast DNS */
56 #define DNS_PACKET_UNICAST_SIZE_MAX 512u
57
58 /* With EDNS0 we can use larger packets, default to 4096, which is what is commonly used */
59 #define DNS_PACKET_UNICAST_SIZE_LARGE_MAX 4096u
60
61 struct DnsPacket {
62 unsigned n_ref;
63 DnsProtocol protocol;
64 size_t size, allocated, rindex, max_size, fragsize;
65 void *_data; /* don't access directly, use DNS_PACKET_DATA()! */
66 Hashmap *names; /* For name compression */
67 size_t opt_start, opt_size;
68
69 /* Parsed data */
70 DnsQuestion *question;
71 DnsAnswer *answer;
72 DnsResourceRecord *opt;
73
74 /* For support of truncated packets */
75 DnsPacket *more;
76
77 /* Packet reception metadata */
78 usec_t timestamp; /* CLOCK_BOOTTIME (or CLOCK_MONOTONIC if the former doesn't exist) */
79 int ifindex;
80 int family, ipproto;
81 union in_addr_union sender, destination;
82 uint16_t sender_port, destination_port;
83 uint32_t ttl;
84
85 bool on_stack;
86 bool extracted;
87 bool refuse_compression;
88 bool canonical_form;
89
90 /* Note: fields should be ordered to minimize alignment gaps. Use pahole! */
91 };
92
DNS_PACKET_DATA(const DnsPacket * p)93 static inline uint8_t* DNS_PACKET_DATA(const DnsPacket *p) {
94 if (_unlikely_(!p))
95 return NULL;
96
97 if (p->_data)
98 return p->_data;
99
100 return ((uint8_t*) p) + ALIGN(sizeof(DnsPacket));
101 }
102
103 #define DNS_PACKET_HEADER(p) ((DnsPacketHeader*) DNS_PACKET_DATA(p))
104 #define DNS_PACKET_ID(p) DNS_PACKET_HEADER(p)->id
105 #define DNS_PACKET_QR(p) ((be16toh(DNS_PACKET_HEADER(p)->flags) >> 15) & 1)
106 #define DNS_PACKET_OPCODE(p) ((be16toh(DNS_PACKET_HEADER(p)->flags) >> 11) & 15)
107 #define DNS_PACKET_AA(p) ((be16toh(DNS_PACKET_HEADER(p)->flags) >> 10) & 1)
108 #define DNS_PACKET_TC(p) ((be16toh(DNS_PACKET_HEADER(p)->flags) >> 9) & 1)
109 #define DNS_PACKET_RD(p) ((be16toh(DNS_PACKET_HEADER(p)->flags) >> 8) & 1)
110 #define DNS_PACKET_RA(p) ((be16toh(DNS_PACKET_HEADER(p)->flags) >> 7) & 1)
111 #define DNS_PACKET_AD(p) ((be16toh(DNS_PACKET_HEADER(p)->flags) >> 5) & 1)
112 #define DNS_PACKET_CD(p) ((be16toh(DNS_PACKET_HEADER(p)->flags) >> 4) & 1)
113
114 #define DNS_PACKET_FLAG_TC (UINT16_C(1) << 9)
115
DNS_PACKET_RCODE(DnsPacket * p)116 static inline uint16_t DNS_PACKET_RCODE(DnsPacket *p) {
117 uint16_t rcode;
118
119 if (p->opt)
120 rcode = (uint16_t) (p->opt->ttl >> 24);
121 else
122 rcode = 0;
123
124 return rcode | (be16toh(DNS_PACKET_HEADER(p)->flags) & 0xF);
125 }
126
DNS_PACKET_PAYLOAD_SIZE_MAX(DnsPacket * p)127 static inline uint16_t DNS_PACKET_PAYLOAD_SIZE_MAX(DnsPacket *p) {
128
129 /* Returns the advertised maximum size for replies, or the DNS default if there's nothing defined. */
130
131 if (p->ipproto == IPPROTO_TCP) /* we ignore EDNS(0) size data on TCP, like everybody else */
132 return DNS_PACKET_SIZE_MAX;
133
134 if (p->opt)
135 return MAX(DNS_PACKET_UNICAST_SIZE_MAX, p->opt->key->class);
136
137 return DNS_PACKET_UNICAST_SIZE_MAX;
138 }
139
DNS_PACKET_DO(DnsPacket * p)140 static inline bool DNS_PACKET_DO(DnsPacket *p) {
141 if (!p->opt)
142 return false;
143
144 return !!(p->opt->ttl & (1U << 15));
145 }
146
DNS_PACKET_VERSION_SUPPORTED(DnsPacket * p)147 static inline bool DNS_PACKET_VERSION_SUPPORTED(DnsPacket *p) {
148 /* Returns true if this packet is in a version we support. Which means either non-EDNS or EDNS(0), but not EDNS
149 * of any newer versions */
150
151 if (!p->opt)
152 return true;
153
154 return DNS_RESOURCE_RECORD_OPT_VERSION_SUPPORTED(p->opt);
155 }
156
DNS_PACKET_IS_FRAGMENTED(DnsPacket * p)157 static inline bool DNS_PACKET_IS_FRAGMENTED(DnsPacket *p) {
158 assert(p);
159
160 /* For ingress packets: was this packet fragmented according to our knowledge? */
161
162 return p->fragsize != 0;
163 }
164
165 /* LLMNR defines some bits differently */
166 #define DNS_PACKET_LLMNR_C(p) DNS_PACKET_AA(p)
167 #define DNS_PACKET_LLMNR_T(p) DNS_PACKET_RD(p)
168
169 #define DNS_PACKET_QDCOUNT(p) be16toh(DNS_PACKET_HEADER(p)->qdcount)
170 #define DNS_PACKET_ANCOUNT(p) be16toh(DNS_PACKET_HEADER(p)->ancount)
171 #define DNS_PACKET_NSCOUNT(p) be16toh(DNS_PACKET_HEADER(p)->nscount)
172 #define DNS_PACKET_ARCOUNT(p) be16toh(DNS_PACKET_HEADER(p)->arcount)
173
174 #define DNS_PACKET_MAKE_FLAGS(qr, opcode, aa, tc, rd, ra, ad, cd, rcode) \
175 (((uint16_t) !!(qr) << 15) | \
176 ((uint16_t) ((opcode) & 15) << 11) | \
177 ((uint16_t) !!(aa) << 10) | /* on LLMNR: c */ \
178 ((uint16_t) !!(tc) << 9) | \
179 ((uint16_t) !!(rd) << 8) | /* on LLMNR: t */ \
180 ((uint16_t) !!(ra) << 7) | \
181 ((uint16_t) !!(ad) << 5) | \
182 ((uint16_t) !!(cd) << 4) | \
183 ((uint16_t) ((rcode) & 15)))
184
DNS_PACKET_RRCOUNT(DnsPacket * p)185 static inline unsigned DNS_PACKET_RRCOUNT(DnsPacket *p) {
186 return
187 (unsigned) DNS_PACKET_ANCOUNT(p) +
188 (unsigned) DNS_PACKET_NSCOUNT(p) +
189 (unsigned) DNS_PACKET_ARCOUNT(p);
190 }
191
192 int dns_packet_new(DnsPacket **p, DnsProtocol protocol, size_t min_alloc_dsize, size_t max_size);
193 int dns_packet_new_query(DnsPacket **p, DnsProtocol protocol, size_t min_alloc_dsize, bool dnssec_checking_disabled);
194
195 int dns_packet_dup(DnsPacket **ret, DnsPacket *p);
196
197 void dns_packet_set_flags(DnsPacket *p, bool dnssec_checking_disabled, bool truncated);
198
199 DnsPacket *dns_packet_ref(DnsPacket *p);
200 DnsPacket *dns_packet_unref(DnsPacket *p);
201
202 DEFINE_TRIVIAL_CLEANUP_FUNC(DnsPacket*, dns_packet_unref);
203
204 #define DNS_PACKET_REPLACE(a, b) \
205 do { \
206 typeof(a)* _a = &(a); \
207 typeof(b) _b = (b); \
208 dns_packet_unref(*_a); \
209 *_a = _b; \
210 } while(0)
211
212 int dns_packet_validate(DnsPacket *p);
213 int dns_packet_validate_reply(DnsPacket *p);
214 int dns_packet_validate_query(DnsPacket *p);
215
216 int dns_packet_is_reply_for(DnsPacket *p, const DnsResourceKey *key);
217
218 int dns_packet_append_blob(DnsPacket *p, const void *d, size_t sz, size_t *start);
219 int dns_packet_append_uint8(DnsPacket *p, uint8_t v, size_t *start);
220 int dns_packet_append_uint16(DnsPacket *p, uint16_t v, size_t *start);
221 int dns_packet_append_uint32(DnsPacket *p, uint32_t v, size_t *start);
222 int dns_packet_append_string(DnsPacket *p, const char *s, size_t *start);
223 int dns_packet_append_raw_string(DnsPacket *p, const void *s, size_t size, size_t *start);
224 int dns_packet_append_label(DnsPacket *p, const char *s, size_t l, bool canonical_candidate, size_t *start);
225 int dns_packet_append_name(DnsPacket *p, const char *name, bool allow_compression, bool canonical_candidate, size_t *start);
226 int dns_packet_append_key(DnsPacket *p, const DnsResourceKey *key, const DnsAnswerFlags flags, size_t *start);
227 int dns_packet_append_rr(DnsPacket *p, const DnsResourceRecord *rr, const DnsAnswerFlags flags, size_t *start, size_t *rdata_start);
228 int dns_packet_append_opt(DnsPacket *p, uint16_t max_udp_size, bool edns0_do, bool include_rfc6975, const char *nsid, int rcode, size_t *ret_start);
229 int dns_packet_append_question(DnsPacket *p, DnsQuestion *q);
230 int dns_packet_append_answer(DnsPacket *p, DnsAnswer *a, unsigned *completed);
231
232 int dns_packet_patch_max_udp_size(DnsPacket *p, uint16_t max_udp_size);
233 int dns_packet_patch_ttls(DnsPacket *p, usec_t timestamp);
234
235 void dns_packet_truncate(DnsPacket *p, size_t sz);
236 int dns_packet_truncate_opt(DnsPacket *p);
237
238 int dns_packet_read(DnsPacket *p, size_t sz, const void **ret, size_t *start);
239 int dns_packet_read_blob(DnsPacket *p, void *d, size_t sz, size_t *start);
240 int dns_packet_read_uint8(DnsPacket *p, uint8_t *ret, size_t *start);
241 int dns_packet_read_uint16(DnsPacket *p, uint16_t *ret, size_t *start);
242 int dns_packet_read_uint32(DnsPacket *p, uint32_t *ret, size_t *start);
243 int dns_packet_read_string(DnsPacket *p, char **ret, size_t *start);
244 int dns_packet_read_raw_string(DnsPacket *p, const void **ret, size_t *size, size_t *start);
245 int dns_packet_read_name(DnsPacket *p, char **ret, bool allow_compression, size_t *start);
246 int dns_packet_read_key(DnsPacket *p, DnsResourceKey **ret, bool *ret_cache_flush_or_qu, size_t *start);
247 int dns_packet_read_rr(DnsPacket *p, DnsResourceRecord **ret, bool *ret_cache_flush, size_t *start);
248
249 void dns_packet_rewind(DnsPacket *p, size_t idx);
250
251 int dns_packet_skip_question(DnsPacket *p);
252 int dns_packet_extract(DnsPacket *p);
253
254 bool dns_packet_equal(const DnsPacket *a, const DnsPacket *b);
255
256 int dns_packet_has_nsid_request(DnsPacket *p);
257
258 /* https://www.iana.org/assignments/dns-parameters/dns-parameters.xhtml#dns-parameters-6 */
259 enum {
260 DNS_RCODE_SUCCESS = 0,
261 DNS_RCODE_FORMERR = 1,
262 DNS_RCODE_SERVFAIL = 2,
263 DNS_RCODE_NXDOMAIN = 3,
264 DNS_RCODE_NOTIMP = 4,
265 DNS_RCODE_REFUSED = 5,
266 DNS_RCODE_YXDOMAIN = 6,
267 DNS_RCODE_YXRRSET = 7,
268 DNS_RCODE_NXRRSET = 8,
269 DNS_RCODE_NOTAUTH = 9,
270 DNS_RCODE_NOTZONE = 10,
271 DNS_RCODE_BADVERS = 16,
272 DNS_RCODE_BADSIG = 16, /* duplicate value! */
273 DNS_RCODE_BADKEY = 17,
274 DNS_RCODE_BADTIME = 18,
275 DNS_RCODE_BADMODE = 19,
276 DNS_RCODE_BADNAME = 20,
277 DNS_RCODE_BADALG = 21,
278 DNS_RCODE_BADTRUNC = 22,
279 DNS_RCODE_BADCOOKIE = 23,
280 _DNS_RCODE_MAX_DEFINED,
281 _DNS_RCODE_MAX = 4095 /* 4 bit rcode in the header plus 8 bit rcode in OPT, makes 12 bit */
282 };
283
284 const char* dns_rcode_to_string(int i) _const_;
285 int dns_rcode_from_string(const char *s) _pure_;
286
287 const char* dns_protocol_to_string(DnsProtocol p) _const_;
288 DnsProtocol dns_protocol_from_string(const char *s) _pure_;
289
290 #define LLMNR_MULTICAST_IPV4_ADDRESS ((struct in_addr) { .s_addr = htobe32(224U << 24 | 252U) })
291 #define LLMNR_MULTICAST_IPV6_ADDRESS ((struct in6_addr) { .s6_addr = { 0xFF, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x03 } })
292
293 #define MDNS_MULTICAST_IPV4_ADDRESS ((struct in_addr) { .s_addr = htobe32(224U << 24 | 251U) })
294 #define MDNS_MULTICAST_IPV6_ADDRESS ((struct in6_addr) { .s6_addr = { 0xFF, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xfb } })
295
296 extern const struct hash_ops dns_packet_hash_ops;
297
SD_RESOLVED_FLAGS_MAKE(DnsProtocol protocol,int family,bool authenticated,bool confidential)298 static inline uint64_t SD_RESOLVED_FLAGS_MAKE(
299 DnsProtocol protocol,
300 int family,
301 bool authenticated,
302 bool confidential) {
303 uint64_t f;
304
305 /* Converts a protocol + family into a flags field as used in queries and responses */
306
307 f = (authenticated ? SD_RESOLVED_AUTHENTICATED : 0) |
308 (confidential ? SD_RESOLVED_CONFIDENTIAL : 0);
309
310 switch (protocol) {
311 case DNS_PROTOCOL_DNS:
312 return f|SD_RESOLVED_DNS;
313
314 case DNS_PROTOCOL_LLMNR:
315 return f|(family == AF_INET6 ? SD_RESOLVED_LLMNR_IPV6 : SD_RESOLVED_LLMNR_IPV4);
316
317 case DNS_PROTOCOL_MDNS:
318 return f|(family == AF_INET6 ? SD_RESOLVED_MDNS_IPV6 : SD_RESOLVED_MDNS_IPV4);
319
320 default:
321 return f;
322 }
323 }
324
dns_packet_size_max(DnsPacket * p)325 static inline size_t dns_packet_size_max(DnsPacket *p) {
326 assert(p);
327
328 /* Why not insist on a fully initialized max_size during DnsPacket construction? Well, this way it's easy to
329 * allocate a transient, throw-away DnsPacket on the stack by simple zero initialization, without having to
330 * deal with explicit field initialization. */
331
332 return p->max_size != 0 ? p->max_size : DNS_PACKET_SIZE_MAX;
333 }
334
udp_header_size(int af)335 static inline size_t udp_header_size(int af) {
336
337 switch (af) {
338 case AF_INET:
339 return UDP4_PACKET_HEADER_SIZE;
340 case AF_INET6:
341 return UDP6_PACKET_HEADER_SIZE;
342 default:
343 assert_not_reached();
344 }
345 }
346
347 size_t dns_packet_size_unfragmented(DnsPacket *p);
348