Commit graph

65 commits

Author SHA1 Message Date
Zbigniew Jędrzejewski-Szmek fd373593ba resolved: keep addresses mapped to ::0 in a separate set
We'd store every 0.0.0.0 and ::0 entry as a structure without any addresses
allocated. This is a somewhat common use case, let's optimize it a bit.

This gives some memory savings and a bit faster response time too:
'time build/test-resolved-etc-hosts hosts' goes from 7.7s to 5.6s, and
memory use as reported by valgrind for ~10000 hosts is reduced
==18097==   total heap usage: 29,902 allocs, 29,902 frees, 2,136,437 bytes allocated
==18240==   total heap usage: 19,955 allocs, 19,955 frees, 1,556,021 bytes allocated

Also rename 'suppress' to 'found' (with reverse meaning). I think this makes
the intent clearer.
2018-08-01 12:38:39 +02:00
Zbigniew Jędrzejewski-Szmek 37b7cc8d9a resolved: put /etc/hosts hashmaps in a structure and pass that around
This hides the details of juggling the two hashmaps from the callers a bit.
It also makes memory management a bit easier, because those two hashmaps share
some strings, so we can only free them together.

etc_hosts_parse() is made responsible to free the half-filled data structures
on error, which makes the caller a bit simpler.

No functional change. A refactoring to prepare for later changes.
2018-08-01 12:38:34 +02:00
Yu Watanabe 0351eb1148 resolve: use in_addr_data type for storing address 2018-07-31 15:46:28 +09:00
Yu Watanabe 8631708741 resolve: add option to toggle reading /etc/hosts
Workaround for #9718.
2018-07-28 21:46:00 +09:00
Yu Watanabe 4b0051b1b6 resolve: drop unused slot 2018-07-19 11:28:42 +02:00
Yu Watanabe afb76fdbff tree-wide: drop double newline 2018-06-29 11:02:17 +09:00
Zbigniew Jędrzejewski-Szmek d9b02e1697 tree-wide: drop copyright headers from frequent contributors
Fixes #9320.

for p in Shapovalov Chevalier Rozhkov Sievers Mack Herrmann Schmidt Rudenberg Sahani Landden Andersen Watanabe; do
  git grep -e 'Copyright.*'$p -l|xargs perl -i -0pe 's|/([*][*])?[*]\s+([*#]\s+)?Copyright[^\n]*'$p'[^\n]*\s*[*]([*][*])?/\n*|\n|gms; s|\s+([*#]\s+)?Copyright[^\n]*'$p'[^\n]*\n*|\n|gms'
done
2018-06-20 11:58:53 +02:00
Lennart Poettering 96b2fb93c5 tree-wide: beautify remaining copyright statements
Let's unify an beautify our remaining copyright statements, with a
unicode ©. This means our copyright statements are now always formatted
the same way. Yay.
2018-06-14 10:20:21 +02:00
Lennart Poettering 818bf54632 tree-wide: drop 'This file is part of systemd' blurb
This part of the copyright blurb stems from the GPL use recommendations:

https://www.gnu.org/licenses/gpl-howto.en.html

The concept appears to originate in times where version control was per
file, instead of per tree, and was a way to glue the files together.
Ultimately, we nowadays don't live in that world anymore, and this
information is entirely useless anyway, as people are very welcome to
copy these files into any projects they like, and they shouldn't have to
change bits that are part of our copyright header for that.

hence, let's just get rid of this old cruft, and shorten our codebase a
bit.
2018-06-14 10:20:20 +02:00
Iwan Timmer c9299be2f5 resolve: rename PrivateDNS to DNSOverTLS
PrivateDNS is not considered a good name for this option, so rename it to DNSOverTLS
2018-06-14 09:57:56 +02:00
Iwan Timmer 5d67a7ae74 resolved: support for DNS-over-TLS
Add support for DNS-over-TLS using GnuTLS. To reduce latency also TLS False Start and TLS session resumption is supported.
2018-06-11 21:35:58 +02:00
Yu Watanabe 79a4beb39f network,resolve: remove unused variables (#8738)
Follow-up for d7afd945b5.
2018-04-17 12:40:45 +02:00
Zbigniew Jędrzejewski-Szmek 11a1589223 tree-wide: drop license boilerplate
Files which are installed as-is (any .service and other unit files, .conf
files, .policy files, etc), are left as is. My assumption is that SPDX
identifiers are not yet that well known, so it's better to retain the
extended header to avoid any doubt.

I also kept any copyright lines. We can probably remove them, but it'd nice to
obtain explicit acks from all involved authors before doing that.
2018-04-06 18:58:55 +02:00
Dmitry Rozhkov 84b0f133e4 resolved: consult Polkit for privileges when manipulating DNS-SD 2017-12-08 14:29:27 +02:00
Dmitry Rozhkov e7c1b0e456 resolved: resolve possible conflicts for DNS-SD RRs
It might happen that a DNS-SD service doesn't include local host's
name in its RR keys and still conflicts with a remote service.

In this case try to resolve the conflict by changing name for
this particular service.
2017-12-08 14:29:27 +02:00
Dmitry Rozhkov 6501dd31a7 resolved: add enablers for DNS-SD
Introduce network services loaded from .dnssd files that
can be used for server-side DNS-SD implementation in systemd-resolved.
2017-12-08 14:29:27 +02:00
Zbigniew Jędrzejewski-Szmek 53e1b68390 Add SPDX license identifiers to source files under the LGPL
This follows what the kernel is doing, c.f.
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5fd54ace4721fc5ce2bb5aef6318fcf17f421460.
2017-11-19 19:08:15 +01:00
Lennart Poettering d55b0463b2 resolved: add support for explicitly forgetting everything we learnt about DNS server feature levels
This adds "systemd-resolve --reset-server-features" for explicitly
forgetting what we learnt. This might be useful for debugging
purposes, and to force systemd-resolved to restart its learning logic
for all DNS servers.
2017-10-05 16:56:50 +02:00
Lennart Poettering 59c0fd0e17 resolved: automatically forget all learnt DNS server information when the network configuration changes
When the network configuration changes we should relearn everything
there is to know about the configured DNS servers, because we might talk
to the same addresses, but there might be different servers behind them.
2017-10-05 16:22:22 +02:00
Zbigniew Jędrzejewski-Szmek 01c901e257 Merge pull request #4832 from rojkov/mdns 2017-02-12 15:38:51 -05:00
Lennart Poettering e96de0ce47 resolved: also synthesize records for the full local hostname
Previously, we'd only synthesize RRs for the LLMNR and mDNS versions of
the hostnames (i.e. the first label of the kernel hostname, as well as
the first label of the kernel hostname suffixed with .local). With this
change, we also synthesize an RR for the full hostname, which is
relevant in case it has more than one label.

Fixes: #5041
2017-02-09 16:13:07 +01:00
Dmitry Rozhkov 400cb36ec6 resolved: populate mDNS scopes' zones with RRs for the host
Signed-off-by: Dmitry Rozhkov <dmitry.rozhkov@linux.intel.com>
2017-01-19 11:51:21 +02:00
David Michael 1ae4329575 resolved: add an option to control the DNS stub listener 2016-10-07 12:14:38 -07:00
Martin Pitt ceeddf79b8 resolved: add option to disable caching (#3592)
In some cases, caching DNS results locally is not desirable, a it makes DNS
cache poisoning attacks a tad easier and also allows users on the system to
determine whether or not a particular domain got visited by another user. Thus
provide a new "Cache" resolved.conf option to disable it.
2016-06-24 07:54:28 +02:00
Lennart Poettering b30bf55d5c resolved: respond to local resolver requests on 127.0.0.53:53
In order to improve compatibility with local clients that speak DNS directly
(and do not use NSS or our bus API) listen locally on 127.0.0.53:53 and process
any queries made that way.

Note that resolved does not implement a full DNS server on this port, but
simply enough to allow normal, local clients to resolve RRs through resolved.
Specifically it does not implement queries without the RD bit set (these are
requests where recursive lookups are explicitly disabled), and neither queries
with DNSSEC DO set in combination with DNSSEC CD (i.e. DNSSEC lookups with
validation turned off). It also refuses zone transfers and obsolete RR types.
All lookups done this way will be rejected with a clean error code, so that the
client side can repeat the query with a reduced feature set.

The code will set the DNSSEC AD flag however, depending on whether the data
resolved has been validated (or comes from a local, trusted source).

Lookups made via this mechanisms are propagated to LLMNR and mDNS as necessary,
but this is only partially useful as DNS packets cannot carry IP scope data
(i.e. the ifindex), and hence link-local addresses returned cannot be used
properly (and given that LLMNR/mDNS are mostly about link-local communication
this is quite a limitation). Also, given that DNS tends to use IDNA for
non-ASCII names, while LLMNR/mDNS uses UTF-8 lookups cannot be mapped 1:1.

In general this should improve compatibility with clients bypassing NSS but
it is highly recommended for clients to instead use NSS or our native bus API.

This patch also beefs up the DnsStream logic, as it reuses the code for local
TCP listening. DnsStream now provides proper reference counting for its
objects.

In order to avoid feedback loops resolved will no silently ignore 127.0.0.53
specified as DNS server when reading configuration.

resolved listens on 127.0.0.53:53 instead of 127.0.0.1:53 in order to leave
the latter free for local, external DNS servers or forwarders.

This also changes the "etc.conf" tmpfiles snippet to create a symlink from
/etc/resolv.conf to /usr/lib/systemd/resolv.conf by default, thus making this
stub the default mode of operation if /etc is not populated.
2016-06-21 14:15:23 +02:00
Lennart Poettering 0a0fc27b80 resolved: drop unused permit_domain_search variable from Manager object 2016-06-21 13:20:48 +02:00
Lennart Poettering 943ef07ce0 resolved: make sure DNS configuration pushed in by the user stays around on restarts
Let's make sure that all settings pushed in stay around when systemd-resolved
is restarted.
2016-06-21 13:20:48 +02:00
Lennart Poettering 6f7da49d00 resolved: make sure that route-only domains are never added to /etc/resolv.conf
After all, /etc/resolv.conf doesn't know the concept of "route-only domains",
hence the domains should really not appear there.
2016-06-21 13:20:47 +02:00
Lennart Poettering ba35662fbd resolved: also add a way to flush all caches via the bus
And expose it in "resolve-tool --flush-caches".
2016-06-10 23:26:53 +02:00
Lennart Poettering bc81447ea5 resolved: flush all caches if SIGUSR2 is received 2016-06-10 23:26:53 +02:00
Daniel Mack b26fa1a2fb tree-wide: remove Emacs lines from all files
This should be handled fine now by .dir-locals.el, so need to carry that
stuff in every file.
2016-02-10 13:41:57 +01:00
Lennart Poettering 011696f762 resolved: rework what ResolveHostname() with family == AF_UNSPEC means
Previously, if a hostanem is resolved with AF_UNSPEC specified, this would be used as indication to resolve both an
AF_INET and an AF_INET6 address. With this change this logic is altered: an AF_INET address is only resolved if there's
actually a routable IPv4 address on the specific interface, and similar an AF_INET6 address is only resolved if there's
a routable IPv6 address. With this in place, it's ensured that the returned data is actually connectable by
applications. This logic mimics glibc's resolver behaviour.

Note that if the client asks explicitly for AF_INET or AF_INET6 it will get what it asked for.

This also simplifies the logic how it is determined whether a specific lookup shall take place on a scope.
Specifically, the checks with dns_scope_good_key() are now moved out of the transaction code and into the query code,
so that we don't even create a transaction object on a specific scope if we cannot execute the resolution on it anyway.
2016-02-01 22:18:15 +01:00
Lennart Poettering 3df9bec57c networkd: rework Domains= setting
Previously, .network files only knew a vaguely defined "Domains=" concept, for which the documentation declared it was
the "DNS domain" for the network connection, without specifying what that means.

With this the Domains setting is reworked, so that there are now "routing" domains and "search" domains. The former are
to be used by resolved to route DNS request to specific network interfaces, the latter is to be used for searching
single-label hostnames with (in addition to being used for routing). Both settings are configured in the "Domains="
setting. Normal domain names listed in it are now considered search domains (for compatibility with existing setups),
while those prefixed with "~" are considered routing domains only. To route all lookups to a specific interface the
routing domain "." may be used, referring to the root domain. An alternative syntax for this is the "*", as was already
implemented before using the "wildcard" domain concept.

This commit adds proper parsers for this new logic, and exposes this via the sd-network API. This information is not
used by resolved yet, this will be added in a later commit.
2016-01-26 14:42:03 +01:00
Lennart Poettering dd0bc0f141 resolved: synthesize RRs for data from /etc/hosts
This way the difference between lookups via NSS and our native bus API should become minimal.
2016-01-25 17:19:19 +01:00
Lennart Poettering 59c5b5974d resolved: log each time we increase the DNSSEC verdict counters
Also, don't consider RRs that aren't primary to the lookups we do as relevant to the lookups.
2016-01-25 17:19:19 +01:00
Lennart Poettering c69fa7e3c4 resolved: rework DNSSECSupported property
Not only report whether the server actually supports DNSSEC, but also first check whether DNSSEC is actually enabled
for it in our local configuration.

Also, export a per-link DNSSECSupported property in addition to the existing manager-wide property.
2016-01-19 21:56:54 +01:00
Lennart Poettering ad6c047561 resolved,networkd: add a per-interface DNSSEC setting
This adds a DNSSEC= setting to .network files, and makes resolved honour
them.
2016-01-05 20:10:31 +01:00
Lennart Poettering af49ca27ff resolved,networkd: unify ResolveSupport enum
networkd previously knew an enum "ResolveSupport" for configuring
per-interface LLMNR support, resolved had a similar enum just called
"Support", with the same value and similar pasers.

Unify this, call the enum ResolveSupport, and port both daemons to it.
2016-01-05 17:30:51 +01:00
Lennart Poettering a150ff5e4e resolved: gather statistics about resolved names
This collects statistical data about transactions, dnssec verifications
and the cache, and exposes it over the bus. The systemd-resolve-host
tool learns new options to query these statistics and reset them.
2015-12-26 19:09:10 +01:00
Daniel Mack bc7702b098 resolved: add infrastructure for mDNS related sockets
Just hook up mDNS listeners with an empty packet dispather function,
introduce a config directive, man page updates etc.
2015-12-08 16:37:40 +01:00
Lennart Poettering 0d2cd47617 resolved: add a simple trust anchor database as additional RR source
When doing DNSSEC lookups we need to know one or more DS or DNSKEY RRs
as trust anchors to validate lookups. With this change we add a
compiled-in trust anchor database, serving the root DS key as of today,
retrieved from:

https://data.iana.org/root-anchors/root-anchors.xml

The interface is kept generic, so that additional DS or DNSKEY RRs may
be served via the same interface, for example by provisioning them
locally in external files to support "islands" of security.

The trust anchor database becomes the fourth source of RRs we maintain,
besides, the network, the local cache, and the local zone.
2015-12-03 21:17:49 +01:00
Lennart Poettering 9176a57c10 resolved: split out calls to compile full list of dns servers and search domains
Let's split this out from the resolv.conf parser, so that this becomes
generically useful.
2015-11-25 21:58:38 +01:00
Lennart Poettering eed857b717 resolved: enforce a maximum limit on both dns servers and search domains 2015-11-25 21:58:38 +01:00
Lennart Poettering a51c10485a resolved: add a generic DnsSearchDomain concept
With this change, we add a new object to resolved, "DnsSearchDomain="
which wraps a search domain. This is then used to introduce a global
search domain list, in addition to the existing per-link search domain
list which is reword to make use of this new object too.

This is preparation for implement proper unicast DNS search domain
support.
2015-11-25 21:58:38 +01:00
Lennart Poettering 00fa60ae3b resolved: make sure FallbackDNS= overrides built-in servers, doesn't extend them
Closes #342.
2015-11-25 21:58:37 +01:00
Lennart Poettering f2f1dbe50f resolved: move dns server picking code from resolved-manager.c to resolved-dns-server.c 2015-11-25 21:58:37 +01:00
Lennart Poettering f8dc7e343d resolved: split out all code dealing with /etc/resolv.conf into its own .c file
No functional changes.
2015-11-25 21:58:37 +01:00
Lennart Poettering 636e813dc9 resolved: unify code for parsing dns server information
Let's use the same parser when parsing dns server information from
/etc/resolv.conf and our native configuration file.

Also, move all code that manages lists of dns servers to a single place.
resolved-dns-server.c
2015-11-25 21:58:37 +01:00
Thomas Hindoe Paaboel Andersen 71d35b6b55 tree-wide: sort includes in *.h
This is a continuation of the previous include sort patch, which
only sorted for .c files.
2015-11-18 23:09:02 +01:00
Lennart Poettering 4d506d6bb7 resolved: dump cache and zone contents to syslog on SIGUSR1 2015-08-26 09:41:45 +02:00