#include <net/if_arp.h>

#include <netinet/tcp.h>

#include "errno-util.h"

#include "fd-util.h"

#include "missing_network.h"

#include "missing_socket.h"

#include "resolved-dns-stub.h"

#include "socket-netlink.h"

#include "socket-util.h"

#include "stdio-util.h"

#include "string-table.h"

#define ADVERTISE_DATAGRAM_SIZE_MAX (65536U-14U-20U-8U)

#define ADVERTISE_EXTRA_DATAGRAM_SIZE_MAX DNS_PACKET_UNICAST_SIZE_LARGE_MAX

static int manager_dns_stub_fd_extra(Manager *m, DnsStubListenerExtra *l, int type);

static int manager_dns_stub_fd(Manager *m, int family, const union in_addr_union *listen_address, int type);

static void dns_stub_listener_extra_hash_func(const DnsStubListenerExtra *a, struct siphash *state) {

assert(a);

siphash24_compress(&a->mode, sizeof(a->mode), state);

siphash24_compress(&a->family, sizeof(a->family), state);

siphash24_compress(&a->address, FAMILY_ADDRESS_SIZE(a->family), state);

siphash24_compress(&a->port, sizeof(a->port), state);

}

static int dns_stub_listener_extra_compare_func(const DnsStubListenerExtra *a, const DnsStubListenerExtra *b) {

int r;

assert(a);

assert(b);

r = CMP(a->mode, b->mode);

if (r != 0)

return r;

r = CMP(a->family, b->family);

if (r != 0)

return r;

r = memcmp(&a->address, &b->address, FAMILY_ADDRESS_SIZE(a->family));

if (r != 0)

return r;

return CMP(a->port, b->port);

}

DEFINE_HASH_OPS_WITH_KEY_DESTRUCTOR(

dns_stub_listener_extra_hash_ops,

DnsStubListenerExtra,

dns_stub_listener_extra_hash_func,

dns_stub_listener_extra_compare_func,

dns_stub_listener_extra_free);

int dns_stub_listener_extra_new(

Manager *m,

DnsStubListenerExtra **ret) {

DnsStubListenerExtra *l;

l = new(DnsStubListenerExtra, 1);

if (!l)

return -ENOMEM;

*l = (DnsStubListenerExtra) {

.manager = m,

};

*ret = TAKE_PTR(l);

return 0;

}

DnsStubListenerExtra *dns_stub_listener_extra_free(DnsStubListenerExtra *p) {

if (!p)

return NULL;

p->udp_event_source = sd_event_source_disable_unref(p->udp_event_source);

p->tcp_event_source = sd_event_source_disable_unref(p->tcp_event_source);

hashmap_free(p->queries_by_packet);

return mfree(p);

}

static void stub_packet_hash_func(const DnsPacket *p, struct siphash *state) {

assert(p);

siphash24_compress(&p->protocol, sizeof(p->protocol), state);

siphash24_compress(&p->family, sizeof(p->family), state);

siphash24_compress(&p->sender, sizeof(p->sender), state);

siphash24_compress(&p->ipproto, sizeof(p->ipproto), state);

siphash24_compress(&p->sender_port, sizeof(p->sender_port), state);

siphash24_compress(DNS_PACKET_HEADER(p), sizeof(DnsPacketHeader), state);

/* We don't bother hashing the full packet here, just the header */

}

static int stub_packet_compare_func(const DnsPacket *x, const DnsPacket *y) {

int r;

r = CMP(x->protocol, y->protocol);

if (r != 0)

return r;

r = CMP(x->family, y->family);

if (r != 0)

return r;

r = memcmp(&x->sender, &y->sender, sizeof(x->sender));

if (r != 0)

return r;

r = CMP(x->ipproto, y->ipproto);

if (r != 0)

return r;

r = CMP(x->sender_port, y->sender_port);

if (r != 0)

return r;

return memcmp(DNS_PACKET_HEADER(x), DNS_PACKET_HEADER(y), sizeof(DnsPacketHeader));

}

DEFINE_HASH_OPS(stub_packet_hash_ops, DnsPacket, stub_packet_hash_func, stub_packet_compare_func);

static int reply_add_with_rrsig(

bool with_rrsig) {

int r;

assert(reply);

assert(rr);

r = dns_answer_add_extend(reply, rr, ifindex, flags, rrsig);

if (r < 0)

return r;

if (with_rrsig && rrsig) {

r = dns_answer_add_extend(reply, rrsig, ifindex, flags, NULL);

if (r < 0)

return r;

}

return 0;

}

static int dns_stub_collect_answer_by_question(

bool with_rrsig) { /* Add RRSIG RR matching each RR */

DnsAnswerItem *item;

int r;

assert(reply);

/* Copies all RRs from 'answer' into 'reply', if they match 'question'. */

DNS_ANSWER_FOREACH_ITEM(item, answer) {

/* We have a question, let's see if this RR matches it */

r = dns_question_matches_rr(question, item->rr, NULL);

if (r < 0)

return r;

if (!r) {

/* Maybe there's a CNAME/DNAME in here? If so, that's an answer too */

r = dns_question_matches_cname_or_dname(question, item->rr, NULL);

if (r < 0)

return r;

if (!r)

continue;

}

/* Mask the section info, we want the primary answers to always go without section

r = reply_add_with_rrsig(

reply,

item->rr,

item->ifindex,

item->flags & ~DNS_ANSWER_MASK_SECTIONS,

item->rrsig,

with_rrsig);

if (r < 0)

return r;

}

return 0;

}

static int dns_stub_collect_answer_by_section(

bool with_dnssec) { /* Include DNSSEC RRs. RRSIG, NSEC, … */

DnsAnswerItem *item;

int r;

assert(reply);

/* Copies all RRs from 'answer' into 'reply', if they originate from the specified section. Also,

DNS_ANSWER_FOREACH_ITEM(item, answer) {

if (dns_answer_contains(exclude1, item->rr) ||

dns_answer_contains(exclude2, item->rr))

continue;

if (!with_dnssec &&

dns_type_is_dnssec(item->rr->key->type))

continue;

if (((item->flags ^ section) & DNS_ANSWER_MASK_SECTIONS) != 0)

continue;

r = reply_add_with_rrsig(

reply,

item->rr,

item->ifindex,

item->flags,

item->rrsig,

with_dnssec);

if (r < 0)

return r;

}

return 0;

}

static int dns_stub_assign_sections(

DnsQuery *q,

DnsQuestion *question,

bool edns0_do) {

int r;

assert(q);

assert(question);

/* Let's assign the 'answer' RRs we collected to their respective sections in the reply datagram. We

/* Include all RRs that directly answer the question in the answer section */

r = dns_stub_collect_answer_by_question(

&q->reply_answer,

q->answer,

question,

edns0_do);

if (r < 0)

return r;

/* Include all RRs that originate from the authority sections, and aren't already listed in the

r = dns_stub_collect_answer_by_section(

&q->reply_authoritative,

q->answer,

DNS_ANSWER_SECTION_AUTHORITY,

q->reply_answer, NULL,

edns0_do);

if (r < 0)

return r;

/* Include all RRs that originate from the answer or additional sections in the additional section

r = dns_stub_collect_answer_by_section(

&q->reply_additional,

q->answer,

DNS_ANSWER_SECTION_ANSWER,

q->reply_answer, q->reply_authoritative,

edns0_do);

if (r < 0)

return r;

r = dns_stub_collect_answer_by_section(

&q->reply_additional,

q->answer,

DNS_ANSWER_SECTION_ADDITIONAL,

q->reply_answer, q->reply_authoritative,

edns0_do);

if (r < 0)

return r;

r = dns_stub_collect_answer_by_section(

&q->reply_additional,

q->answer,

0,

q->reply_answer, q->reply_authoritative,

edns0_do);

if (r < 0)

return r;

return 0;

}

static int dns_stub_make_reply_packet(

bool *ret_truncated) {

_cleanup_(dns_packet_unrefp) DnsPacket *p = NULL;

bool tc = false;

int r;

assert(ret);

r = dns_packet_new(&p, DNS_PROTOCOL_DNS, 0, max_size);

if (r < 0)

return r;

r = dns_packet_append_question(p, q);

if (r == -EMSGSIZE)

tc = true;

else if (r < 0)

return r;

if (ret_truncated)

*ret_truncated = tc;

else if (tc)

return -EMSGSIZE;

DNS_PACKET_HEADER(p)->qdcount = htobe16(dns_question_size(q));

*ret = TAKE_PTR(p);

return 0;

}

static int dns_stub_add_reply_packet_body(

bool *truncated) {

unsigned n_answer = 0, n_authoritative = 0, n_additional = 0;

bool tc = false;

int r;

assert(p);

/* Add the three sections to the packet. If the answer section doesn't fit we'll signal that as

r = dns_packet_append_answer(p, answer, &n_answer);

if (r == -EMSGSIZE)

tc = true;

else if (r < 0)

return r;

else {

r = dns_packet_append_answer(p, authoritative, &n_authoritative);

if (r == -EMSGSIZE) {

if (edns0_do)

tc = true;

} else if (r < 0)

return r;

else {

r = dns_packet_append_answer(p, additional, &n_additional);

if (r < 0 && r != -EMSGSIZE)

return r;

}

}

if (tc) {

if (!truncated)

return -EMSGSIZE;

*truncated = true;

}

DNS_PACKET_HEADER(p)->ancount = htobe16(n_answer);

DNS_PACKET_HEADER(p)->nscount = htobe16(n_authoritative);

DNS_PACKET_HEADER(p)->arcount = htobe16(n_additional);

return 0;

}

static const char *nsid_string(void) {

static char buffer[SD_ID128_STRING_MAX + STRLEN(".resolved.systemd.io")] = "";

sd_id128_t id;

int r;

/* Let's generate a string that we can use as RFC5001 NSID identifier. The string shall identify us

if (!isempty(buffer))

return buffer;

r = sd_id128_get_machine_app_specific(

SD_ID128_MAKE(ed,d3,12,5d,16,b9,41,f9,a1,49,5f,ab,15,62,ab,27),

&id);

if (r < 0) {

log_debug_errno(r, "Failed to determine machine ID, ignoring: %m");

return NULL;

}

xsprintf(buffer, SD_ID128_FORMAT_STR ".resolved.systemd.io", SD_ID128_FORMAT_VAL(id));

return buffer;

}

static int dns_stub_finish_reply_packet(

bool nsid) { /* whether to add NSID */

int r;

assert(p);

if (add_opt) {

r = dns_packet_append_opt(p, max_udp_size, edns0_do, /* include_rfc6975 = */ false, nsid ? nsid_string() : NULL, rcode, NULL);

if (r == -EMSGSIZE) /* Hit the size limit? then indicate truncation */

tc = true;

else if (r < 0)

return r;

} else {

/* If the client can't to EDNS0, don't do DO either */

edns0_do = false;

/* If we don't do EDNS, clamp the rcode to 4 bit */

if (rcode > 0xF)

rcode = DNS_RCODE_SERVFAIL;

}

/* Don't set the CD bit unless DO is on, too */

if (!edns0_do)

cd = false;

/* Note that we allow the AD bit to be set even if client didn't signal DO, as per RFC 6840, section

DNS_PACKET_HEADER(p)->id = id;

DNS_PACKET_HEADER(p)->flags = htobe16(DNS_PACKET_MAKE_FLAGS(

1 /* qr */,

0 /* opcode */,

aa /* aa */,

tc /* tc */,

rd /* rd */,

1 /* ra */,

ad /* ad */,

cd /* cd */,

rcode));

return 0;

}

static bool address_is_proxy(int family, const union in_addr_union *a) {

assert(a);

/* Returns true if the specified address is the DNS "proxy" stub, i.e. where we unconditionally enable bypass mode */

if (family != AF_INET)

return false;

return be32toh(a->in.s_addr) == INADDR_DNS_PROXY_STUB;

}

static int find_socket_fd(

int type) {

assert(m);

/* Finds the right socket to use for sending. If we know the extra listener, otherwise go via the

if (l)

return manager_dns_stub_fd_extra(m, l, type);

return manager_dns_stub_fd(m, family, listen_address, type);

}

static int dns_stub_send(

DnsPacket *reply) {

int r;

assert(m);

assert(p);

assert(reply);

if (s)

r = dns_stream_write_packet(s, reply);

else {

int fd;

fd = find_socket_fd(m, l, p->family, &p->sender, SOCK_DGRAM);

if (fd < 0)

return fd;

/* Note that it is essential here that we explicitly choose the source IP address for this

r = manager_send(m,

fd,

l || address_is_proxy(p->family, &p->destination) ? p->ifindex : LOOPBACK_IFINDEX, /* force loopback iface if this is the main listener stub */

p->family, &p->sender, p->sender_port, &p->destination,

reply);

}

if (r < 0)

return log_debug_errno(r, "Failed to send reply packet: %m");

return 0;

}

static int dns_stub_reply_with_edns0_do(DnsQuery *q) {

assert(q);

/* Reply with DNSSEC DO set? Only if client supports it; and we did any DNSSEC verification

return DNS_PACKET_DO(q->request_packet) &&

(q->answer_dnssec_result >= 0 || /* we did proper DNSSEC validation … */

dns_query_fully_authenticated(q) || /* … or we considered it authentic otherwise … */

DNS_PACKET_CD(q->request_packet)); /* … or client set CD */

}

static void dns_stub_suppress_duplicate_section_rrs(DnsQuery *q) {

/* If we follow a CNAME/DNAME chain we might end up populating our sections with redundant RRs

dns_answer_remove_by_answer_keys(&q->reply_authoritative, q->reply_answer);

dns_answer_remove_by_answer_keys(&q->reply_additional, q->reply_answer);

dns_answer_remove_by_answer_keys(&q->reply_additional, q->reply_authoritative);

}

static int dns_stub_send_reply(

DnsQuery *q,

int rcode) {

_cleanup_(dns_packet_unrefp) DnsPacket *reply = NULL;

bool truncated, edns0_do;

int r;

assert(q);

edns0_do = dns_stub_reply_with_edns0_do(q); /* let's check if we shall reply with EDNS0 DO? */

r = dns_stub_make_reply_packet(

&reply,

DNS_PACKET_PAYLOAD_SIZE_MAX(q->request_packet),

q->request_packet->question,

&truncated);

if (r < 0)

return log_debug_errno(r, "Failed to build reply packet: %m");

dns_stub_suppress_duplicate_section_rrs(q);

r = dns_stub_add_reply_packet_body(

reply,

q->reply_answer,

q->reply_authoritative,

q->reply_additional,

edns0_do,

&truncated);

if (r < 0)

return log_debug_errno(r, "Failed to append reply packet body: %m");

r = dns_stub_finish_reply_packet(

reply,

DNS_PACKET_ID(q->request_packet),

rcode,

truncated,

dns_query_fully_authoritative(q),

DNS_PACKET_RD(q->request_packet),

!!q->request_packet->opt,

edns0_do,

(DNS_PACKET_AD(q->request_packet) || DNS_PACKET_DO(q->request_packet)) && dns_query_fully_authenticated(q),

DNS_PACKET_CD(q->request_packet),

q->stub_listener_extra ? ADVERTISE_EXTRA_DATAGRAM_SIZE_MAX : ADVERTISE_DATAGRAM_SIZE_MAX,

dns_packet_has_nsid_request(q->request_packet) > 0 && !q->stub_listener_extra);

if (r < 0)

return log_debug_errno(r, "Failed to build failure packet: %m");

return dns_stub_send(q->manager, q->stub_listener_extra, q->request_stream, q->request_packet, reply);

}

static int dns_stub_send_failure(

bool authenticated) {

_cleanup_(dns_packet_unrefp) DnsPacket *reply = NULL;

bool truncated;

int r;

assert(m);

assert(p);

r = dns_stub_make_reply_packet(

&reply,

DNS_PACKET_PAYLOAD_SIZE_MAX(p),

p->question,

&truncated);

if (r < 0)

return log_debug_errno(r, "Failed to make failure packet: %m");

r = dns_stub_finish_reply_packet(

reply,

DNS_PACKET_ID(p),

rcode,

truncated,

false,

DNS_PACKET_RD(p),

!!p->opt,

DNS_PACKET_DO(p),

(DNS_PACKET_AD(p) || DNS_PACKET_DO(p)) && authenticated,

DNS_PACKET_CD(p),

l ? ADVERTISE_EXTRA_DATAGRAM_SIZE_MAX : ADVERTISE_DATAGRAM_SIZE_MAX,

dns_packet_has_nsid_request(p) > 0 && !l);

if (r < 0)

return log_debug_errno(r, "Failed to build failure packet: %m");

return dns_stub_send(m, l, s, p, reply);

}

static int dns_stub_patch_bypass_reply_packet(

DnsPacket **ret, /* Where to place the patched packet */

DnsPacket *original, /* The packet to patch */

DnsPacket *request) { /* The packet the patched packet shall look like a reply to */

_cleanup_(dns_packet_unrefp) DnsPacket *c = NULL;

int r;

assert(ret);

assert(original);

assert(request);

r = dns_packet_dup(&c, original);

if (r < 0)

return r;

/* Extract the packet, so that we know where the OPT field is */

r = dns_packet_extract(c);

if (r < 0)

return r;

/* Copy over the original client request ID, so that we can make the upstream query look like our own reply. */

DNS_PACKET_HEADER(c)->id = DNS_PACKET_HEADER(request)->id;

/* Patch in our own maximum datagram size, if EDNS0 was on */

r = dns_packet_patch_max_udp_size(c, ADVERTISE_DATAGRAM_SIZE_MAX);

if (r < 0)

return r;

/* Lower all TTLs by the time passed since we received the datagram. */

if (timestamp_is_set(original->timestamp)) {

r = dns_packet_patch_ttls(c, original->timestamp);

if (r < 0)

return r;

}

/* Our upstream connection might have supported larger DNS requests than our downstream one, hence

if (c->size > DNS_PACKET_PAYLOAD_SIZE_MAX(request)) {

log_debug("Artificially truncating stub response, as advertised size of client is smaller than upstream one.");

dns_packet_truncate(c, DNS_PACKET_PAYLOAD_SIZE_MAX(request));

DNS_PACKET_HEADER(c)->flags = htobe16(be16toh(DNS_PACKET_HEADER(c)->flags) | DNS_PACKET_FLAG_TC);

}

*ret = TAKE_PTR(c);

return 0;

}

static void dns_stub_query_complete(DnsQuery *query) {

_cleanup_(dns_query_freep) DnsQuery *q = query;

int r;

assert(q);

assert(q->request_packet);

if (q->question_bypass) {

/* This is a bypass reply. If so, let's propagate the upstream packet, if we have it and it

if (q->answer_full_packet &&

q->answer_full_packet->protocol == DNS_PROTOCOL_DNS) {

_cleanup_(dns_packet_unrefp) DnsPacket *reply = NULL;

r = dns_stub_patch_bypass_reply_packet(&reply, q->answer_full_packet, q->request_packet);

if (r < 0)

log_debug_errno(r, "Failed to patch bypass reply packet: %m");

else

(void) dns_stub_send(q->manager, q->stub_listener_extra, q->request_stream, q->request_packet, reply);

return;

}

}

/* Take all data from the current reply, and merge it into the three reply sections we are building

r = dns_stub_assign_sections(

q,

dns_query_question_for_protocol(q, DNS_PROTOCOL_DNS),

dns_stub_reply_with_edns0_do(q));

if (r < 0)

return (void) log_debug_errno(r, "Failed to assign sections: %m");

switch (q->state) {

case DNS_TRANSACTION_SUCCESS: {

bool first = true;

for (;;) {

int cname_result;

cname_result = dns_query_process_cname_one(q);

if (cname_result == -ELOOP) { /* CNAME loop, let's send what we already have */

log_debug_errno(r, "Detected CNAME loop, returning what we already have.");

(void) dns_stub_send_reply(q, q->answer_rcode);

break;

}

if (cname_result < 0) {

log_debug_errno(cname_result, "Failed to process CNAME: %m");

break;

}

if (cname_result == DNS_QUERY_NOMATCH) {

/* This answer doesn't contain any RR that would answer our question

if (first) /* We never followed a CNAME and the answer doesn't match our

break;

/* Otherwise, we already followed a CNAME once within this packet, and the

r = dns_query_go(q);

if (r < 0)

return (void) log_debug_errno(r, "Failed to restart query: %m");

TAKE_PTR(q);

return;

}

r = dns_stub_assign_sections(

q,

dns_query_question_for_protocol(q, DNS_PROTOCOL_DNS),

dns_stub_reply_with_edns0_do(q));

if (r < 0)

return (void) log_debug_errno(r, "Failed to assign sections: %m");

if (cname_result == DNS_QUERY_MATCH) /* A match? Then we are done, let's return what we got */

break;

/* We followed a CNAME. and collected the RRs that answer the redirected question

assert(cname_result == DNS_QUERY_CNAME);

first = false;

}

_fallthrough_;

}

case DNS_TRANSACTION_RCODE_FAILURE:

(void) dns_stub_send_reply(q, q->answer_rcode);

break;

case DNS_TRANSACTION_NOT_FOUND:

(void) dns_stub_send_reply(q, DNS_RCODE_NXDOMAIN);

break;

case DNS_TRANSACTION_TIMEOUT:

case DNS_TRANSACTION_ATTEMPTS_MAX_REACHED:

/* Propagate a timeout as a no packet, i.e. that the client also gets a timeout */

break;

case DNS_TRANSACTION_NO_SERVERS:

case DNS_TRANSACTION_INVALID_REPLY:

case DNS_TRANSACTION_ERRNO:

case DNS_TRANSACTION_ABORTED:

case DNS_TRANSACTION_DNSSEC_FAILED:

case DNS_TRANSACTION_NO_TRUST_ANCHOR:

case DNS_TRANSACTION_RR_TYPE_UNSUPPORTED:

case DNS_TRANSACTION_NETWORK_DOWN:

case DNS_TRANSACTION_NO_SOURCE:

case DNS_TRANSACTION_STUB_LOOP:

(void) dns_stub_send_reply(q, DNS_RCODE_SERVFAIL);

break;

case DNS_TRANSACTION_NULL:

case DNS_TRANSACTION_PENDING:

case DNS_TRANSACTION_VALIDATING:

default:

assert_not_reached();

}

}

static int dns_stub_stream_complete(DnsStream *s, int error) {

assert(s);

log_debug_errno(error, "DNS TCP connection terminated, destroying queries: %m");

for (;;) {

DnsQuery *q;

q = set_first(s->queries);

if (!q)

break;

dns_query_free(q);

}

/* This drops the implicit ref we keep around since it was allocated, as incoming stub connections

dns_stream_unref(s);

return 0;

}

static void dns_stub_process_query(Manager *m, DnsStubListenerExtra *l, DnsStream *s, DnsPacket *p) {

uint64_t protocol_flags = SD_RESOLVED_PROTOCOLS_ALL;

_cleanup_(dns_query_freep) DnsQuery *q = NULL;

Hashmap **queries_by_packet;

DnsQuery *existing;

bool bypass = false;

int r;

assert(m);

assert(p);

assert(p->protocol == DNS_PROTOCOL_DNS);

if (!l && /* l == NULL if this is the main stub */

!address_is_proxy(p->family, &p->destination) && /* don't restrict needlessly for 127.0.0.54 */

(in_addr_is_localhost(p->family, &p->sender) <= 0 ||

in_addr_is_localhost(p->family, &p->destination) <= 0)) {

log_warning("Got packet on unexpected (i.e. non-localhost) IP range, ignoring.");

return;

}

if (manager_packet_from_our_transaction(m, p)) {

log_debug("Got our own packet looped back, ignoring.");

return;

}

queries_by_packet = l ? &l->queries_by_packet : &m->stub_queries_by_packet;

existing = hashmap_get(*queries_by_packet, p);

if (existing && dns_packet_equal(existing->request_packet, p)) {

log_debug("Got repeat packet from client, ignoring.");

return;

}

r = dns_packet_extract(p);

if (r < 0) {

log_debug_errno(r, "Failed to extract resources from incoming packet, ignoring packet: %m");

dns_stub_send_failure(m, l, s, p, DNS_RCODE_FORMERR, false);

return;

}

if (!DNS_PACKET_VERSION_SUPPORTED(p)) {

log_debug("Got EDNS OPT field with unsupported version number.");

dns_stub_send_failure(m, l, s, p, DNS_RCODE_BADVERS, false);

return;

}

if (dns_type_is_obsolete(dns_question_first_key(p->question)->type)) {

log_debug("Got message with obsolete key type, refusing.");

dns_stub_send_failure(m, l, s, p, DNS_RCODE_REFUSED, false);

return;

}

if (dns_type_is_zone_transer(dns_question_first_key(p->question)->type)) {

log_debug("Got request for zone transfer, refusing.");

dns_stub_send_failure(m, l, s, p, DNS_RCODE_REFUSED, false);

return;

}

if (!DNS_PACKET_RD(p)) {

/* If the "rd" bit is off (i.e. recursion was not requested), then refuse operation */

log_debug("Got request with recursion disabled, refusing.");

dns_stub_send_failure(m, l, s, p, DNS_RCODE_REFUSED, false);

return;

}

r = hashmap_ensure_allocated(queries_by_packet, &stub_packet_hash_ops);

if (r < 0) {

log_oom();

return;

}

if (address_is_proxy(p->family, &p->destination)) {

_cleanup_free_ char *dipa = NULL;

r = in_addr_to_string(p->family, &p->destination, &dipa);

if (r < 0)

return (void) log_error_errno(r, "Failed to format destination address: %m");

log_debug("Got request to DNS proxy address 127.0.0.54, enabling bypass logic.");

bypass = true;

protocol_flags = SD_RESOLVED_DNS|SD_RESOLVED_NO_ZONE; /* Turn off mDNS/LLMNR for proxy stub. */

} else if ((DNS_PACKET_DO(p) && DNS_PACKET_CD(p))) {

log_debug("Got request with DNSSEC checking disabled, enabling bypass logic.");

bypass = true;

}

if (bypass)

r = dns_query_new(m, &q, NULL, NULL, p, 0,

protocol_flags|

SD_RESOLVED_NO_CNAME|

SD_RESOLVED_NO_SEARCH|

SD_RESOLVED_NO_VALIDATE|

SD_RESOLVED_REQUIRE_PRIMARY|

SD_RESOLVED_CLAMP_TTL);

else

r = dns_query_new(m, &q, p->question, p->question, NULL, 0,

protocol_flags|

SD_RESOLVED_NO_SEARCH|

(DNS_PACKET_DO(p) ? SD_RESOLVED_REQUIRE_PRIMARY : 0)|

SD_RESOLVED_CLAMP_TTL);

if (r < 0) {

log_error_errno(r, "Failed to generate query object: %m");

dns_stub_send_failure(m, l, s, p, DNS_RCODE_SERVFAIL, false);

return;

}

q->request_packet = dns_packet_ref(p);

q->request_stream = dns_stream_ref(s); /* make sure the stream stays around until we can send a reply through it */

q->stub_listener_extra = l;

q->complete = dns_stub_query_complete;

if (s) {

/* Remember which queries belong to this stream, so that we can cancel them when the stream

r = set_ensure_put(&s->queries, NULL, q);

if (r < 0) {

log_oom();

return;

}

assert(r > 0);

}

/* Add the query to the hash table we use to determine repeat packets now. We don't care about

(void) hashmap_put(*queries_by_packet, q->request_packet, q);

r = dns_query_go(q);

if (r < 0) {