summaryrefslogtreecommitdiff
path: root/src/shared/dns-domain.h
Commit message (Collapse)AuthorAgeFilesLines
* dns-domain: dns_name_is_empty() is redundantLennart Poettering2023-01-051-4/+0
| | | | | dns_name_is_empty() was added later, but does the same thing as the more accurately called dns_name_is_root(), hence drop the former.
* dns-domain: introduce dns_name_hash_ops_freeYu Watanabe2022-12-131-0/+1
| | | | Preparation for later commits.
* dns-domain: rename function argumentsYu Watanabe2022-06-111-1/+1
|
* dns-domain: use dns_name_concat()Yu Watanabe2022-06-101-2/+2
| | | | | | `dns_name_normalize()` is an alias of `dns_name_concat()`. For consistency with `dns_name_is_valid_ldh()`, let's use `dns_name_concat()`.
* resolved: maintain only a single list of "dont-resolve" domain namesLennart Poettering2022-02-031-0/+2
| | | | Follow-up for: 46b53e8035fb60c9a7f26dd32d6689ab3b7da97c
* resolve: refuse to resolve empty hostnameYu Watanabe2022-01-211-0/+4
| | | | | | | | | | | | | | Previously, varlink or dbus methods return io.systemd.Resolve.NoNameServers or BUS_ERROR_NO_NAME_SERVERS if an empty hostname is provided, and thus nss-resolve returns NSS_STATUS_TRYAGAIN. That causes getaddrinfo() returns 'Temporary failure in name resolution' instead of 'Name or service not known'. This makes calling varlink or dbus method with an empty hostname result -EINVAL, and hence nss-resolve returns NSS_STATUS_NOTFOUND. Fixes RHBZ#2039854 (https://bugzilla.redhat.com/show_bug.cgi?id=2039854).
* util: move several DNS related definitions to src/basic/dns-def.hYu Watanabe2021-01-191-15/+1
| | | | | | DNS_HOSTNAME_MAX is used by sd-resolve, but it was defined in src/shared/dns-domain.h. The library libsystemd should be independent of source files under src/shared.
* license: LGPL-2.1+ -> LGPL-2.1-or-laterYu Watanabe2020-11-091-1/+1
|
* dns-domain: add helper that checks whether domain is dot suffixedLennart Poettering2020-09-291-2/+5
|
* resolve: reject host names with leading or trailing dashes in /etc/hostsZbigniew Jędrzejewski-Szmek2018-12-101-6/+22
| | | | | | | | | | | | | | | | | | | | | | | | | | | https://tools.ietf.org/html/rfc1035#section-2.3.1 says (approximately) that only letters, numbers, and non-leading non-trailing dashes are allowed (for entries with A/AAAA records). We set no restrictions. hosts(5) says: > Host names may contain only alphanumeric characters, minus signs ("-"), and > periods ("."). They must begin with an alphabetic character and end with an > alphanumeric character. nss-files follows those rules, and will ignore names in /etc/hosts that do not follow this rule. Let's follow the documented rules for /etc/hosts. In particular, this makes us consitent with nss-files, reducing surprises for the user. I'm pretty sure we should apply stricter filtering to names received over DNS and LLMNR and MDNS, but it's a bigger project, because the rules differ depepending on which level the label appears (rules for top-level names are stricter), and this patch takes the minimalistic approach and only changes behaviour for /etc/hosts. Escape syntax is also disallowed in /etc/hosts, even if the resulting character would be allowed. Other tools that parse /etc/hosts do not support this, and there is no need to use it because no allowed characters benefit from escaping.
* tree-wide: make hash_ops typesafeYu Watanabe2018-12-021-2/+2
|
* tree-wide: drop double newlineYu Watanabe2018-06-291-1/+0
|
* tree-wide: drop empty commentsYu Watanabe2018-06-291-2/+0
|
* tree-wide: remove Lennart's copyright linesLennart Poettering2018-06-141-1/+0
| | | | | | | | | | | These lines are generally out-of-date, incomplete and unnecessary. With SPDX and git repository much more accurate and fine grained information about licensing and authorship is available, hence let's drop the per-file copyright notice. Of course, removing copyright lines of others is problematic, hence this commit only removes my own lines and leaves all others untouched. It might be nicer if sooner or later those could go away too, making git the only and accurate source of authorship information.
* tree-wide: drop 'This file is part of systemd' blurbLennart Poettering2018-06-141-2/+0
| | | | | | | | | | | | | | | | This part of the copyright blurb stems from the GPL use recommendations: https://www.gnu.org/licenses/gpl-howto.en.html The concept appears to originate in times where version control was per file, instead of per tree, and was a way to glue the files together. Ultimately, we nowadays don't live in that world anymore, and this information is entirely useless anyway, as people are very welcome to copy these files into any projects they like, and they shouldn't have to change bits that are part of our copyright header for that. hence, let's just get rid of this old cruft, and shorten our codebase a bit.
* resolved: fix typo in macro nameZbigniew Jędrzejewski-Szmek2018-06-081-1/+1
|
* tree-wide: drop license boilerplateZbigniew Jędrzejewski-Szmek2018-04-061-13/+0
| | | | | | | | | | Files which are installed as-is (any .service and other unit files, .conf files, .policy files, etc), are left as is. My assumption is that SPDX identifiers are not yet that well known, so it's better to retain the extended header to avoid any doubt. I also kept any copyright lines. We can probably remove them, but it'd nice to obtain explicit acks from all involved authors before doing that.
* shared: introduce dnssd_srv_type_is_valid() functionDmitry Rozhkov2017-12-081-0/+1
|
* Add SPDX license identifiers to source files under the LGPLZbigniew Jędrzejewski-Szmek2017-11-191-0/+1
| | | | | This follows what the kernel is doing, c.f. https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5fd54ace4721fc5ce2bb5aef6318fcf17f421460.
* build-sys: use #if Y instead of #ifdef Y everywhereZbigniew Jędrzejewski-Szmek2017-10-041-1/+1
| | | | | | | | | | | | | | | The advantage is that is the name is mispellt, cpp will warn us. $ git grep -Ee "conf.set\('(HAVE|ENABLE)_" -l|xargs sed -r -i "s/conf.set\('(HAVE|ENABLE)_/conf.set10('\1_/" $ git grep -Ee '#ifn?def (HAVE|ENABLE)' -l|xargs sed -r -i 's/#ifdef (HAVE|ENABLE)/#if \1/; s/#ifndef (HAVE|ENABLE)/#if ! \1/;' $ git grep -Ee 'if.*defined\(HAVE' -l|xargs sed -i -r 's/defined\((HAVE_[A-Z0-9_]*)\)/\1/g' $ git grep -Ee 'if.*defined\(ENABLE' -l|xargs sed -i -r 's/defined\((ENABLE_[A-Z0-9_]*)\)/\1/g' + manual changes to meson.build squash! build-sys: use #if Y instead of #ifdef Y everywhere v2: - fix incorrect setting of HAVE_LIBIDN2
* resolved: support libidn2 in addition to libidnZbigniew Jędrzejewski-Szmek2017-05-111-0/+2
| | | | | | | | | | | | | | | | | | | | | | | libidn2 2.0.0 supports IDNA2008, in contrast to libidn which supports IDNA2003. https://bugzilla.redhat.com/show_bug.cgi?id=1449145 From that bug report: Internationalized domain names exist for quite some time (IDNA2003), although the protocols describing them have evolved in an incompatible way (IDNA2008). These incompatibilities will prevent applications written for IDNA2003 to access certain problematic domain names defined with IDNA2008, e.g., faß.de is translated to domain xn--fa-hia.de with IDNA2008, while in IDNA2003 it is translated to fass.de domain. That not only causes incompatibility problems, but may be used as an attack vector to redirect users to different web sites. v2: - keep libidn support - require libidn2 >= 2.0.0 v3: - keep dns_name_apply_idna caller dumb, and keep the #ifdefs inside of the function. - use both ±IDN and ±IDN2 in the version string
* shared: add new API to validate a string as hostname or IP addressLennart Poettering2016-11-211-0/+2
|
* tree-wide: place #pragma once at the same place everywhereLennart Poettering2016-02-201-3/+2
| | | | | | Usually, we place the #pragma once before the copyright blurb in header files, but in a few cases we didn't. Move those around, so that we do the same thing everywhere.
* tree-wide: remove Emacs lines from all filesDaniel Mack2016-02-101-2/+0
| | | | | This should be handled fine now by .dir-locals.el, so need to carry that stuff in every file.
* resolved add dns_name_apply_idna() to convert a domain name into its IDNA ↵Lennart Poettering2016-01-181-0/+2
| | | | equivalent
* resolved: on negative NODATA replies, properly deal with empty non-terminalsLennart Poettering2016-01-171-0/+2
| | | | | | empty non-terminals generally lack NSEC RRs, which means we can deduce their existance only from the fact that there are other RRs that contain them in their suffix. Specifically, the NSEC proof for NODATA on ENTs works by sending the NSEC whose next name is a suffix of the queried name to the client. Use this information properly.
* resolved: when validating an RRset, store information about the synthesizing ↵Lennart Poettering2016-01-171-0/+1
| | | | | | | | | | | | source and zone in each RR Having this information available is useful when we need to check whether various RRs are suitable for proofs. This information is stored in the RRs as number of labels to skip from the beginning of the owner name to reach the synthesizing source/signer. Simple accessor calls are then added to retrieve the signer/source from the RR using this information. This also moves validation of a a number of RRSIG parameters into a new call dnssec_rrsig_prepare() that as side-effect initializes the two numeric values.
* shared: add new dns_name_startswith() callLennart Poettering2016-01-131-0/+1
| | | | dns_name_startswith() is to dns_name_endswith() as startswith() is to endswith().
* resolved: tighten search for NSEC3 RRs a bitLennart Poettering2015-12-261-0/+2
| | | | | | | Be stricter when searching suitable NSEC3 RRs for proof: generalize the check we use to find suitable NSEC3 RRs, in nsec3_is_good(), and add additional checks, such as checking whether all NSEC3 RRs use the same parameters, have the same suffix and so on.
* resolved: properly implement RRSIG validation of wildcarded RRsetsLennart Poettering2015-12-261-0/+6
| | | | | | Note that this is still not complete, one additional step is still missing: when we verified that a wildcard RRset is properly signed, we still need to do an NSEC/NSEC3 proof that no more specific RRset exists.
* shared: add dns_name_parent() call to determine parent domain of a domainLennart Poettering2015-12-181-0/+4
|
* shared: include what we useThomas Hindoe Paaboel Andersen2015-12-061-0/+5
| | | | | The next step of a general cleanup of our includes. This one mostly adds missing includes but there are a few removals as well.
* resolved: add basic DNSSEC supportLennart Poettering2015-12-021-0/+3
| | | | | | | | | | | | | | | | | This adds most basic operation for doing DNSSEC validation on the client side. However, it does not actually add the verification logic to the resolver. Specifically, this patch only includes: - Verifying DNSKEY RRs against a DS RRs - Verifying RRSets against a combination of RRSIG and DNSKEY RRs - Matching up RRSIG RRs and DNSKEY RRs - Matching up RR keys and RRSIG RRs - Calculating the DNSSEC key tag from a DNSKEY RR All currently used DNSSEC combinations of SHA and RSA are implemented. Support for MD5 hashing and DSA or EC cyphers are not. MD5 and DSA are probably obsolete, and shouldn't be added. EC should probably be added eventually, if it actually is deployed on the Internet.
* util-lib: update dns_name_to_wire_format() to optionally generate DNSSEC ↵Lennart Poettering2015-12-021-1/+1
| | | | | | | canonical names We'll need this later when putting together RR serializations to checksum.
* dns-domain: don't accept overly long hostnamesLennart Poettering2015-11-301-0/+3
| | | | | | Make sure dns_name_normalize(), dns_name_concat(), dns_name_is_valid() do not accept/generate invalidly long hostnames, i.e. longer than 253 characters.
* dns-domain: be more strict when encoding/decoding labelsLennart Poettering2015-11-301-0/+3
| | | | | | Labels of zero length are not OK, refuse them early on. The concept of a "zero-length label" doesn't exist, a zero-length full domain name however does (representing the root domain). See RFC 2181, Section 11.
* dns-domain: rework dns_label_escape() to not imply memory allocationLennart Poettering2015-11-251-2/+3
| | | | | | The new dns_label_escape() call now operates on a buffer passed in, similar to dns_label_unescape(). This should make decoding a bit faster, and nicer.
* dns-domain: change dns_srv_type_is_valid() return value to boolLennart Poettering2015-11-251-2/+1
| | | | | For similar reasons as dns_name_is_root() got changed in the previous commit.
* dns-domain: simplify dns_name_is_root() and dns_name_is_single_label()Lennart Poettering2015-11-251-2/+2
| | | | | | | | | | | | | | Let's change the return value to bool. If we encounter an error while parsing, return "false" instead of the actual parsing error, after all the specified hostname does not qualify for what the function is supposed to test. Dealing with the additional error codes was always cumbersome, and easily misused, like for example in the DHCP code. Let's also rename the functions from dns_name_root() to dns_name_is_root(), to indicate that this function checks something and returns a bool. Similar for dns_name_is_signal_label().
* dns-domain: remove prototype for function that doesn't existLennart Poettering2015-11-251-2/+0
|
* resolved: implement client-side DNAME resolutionLennart Poettering2015-11-241-0/+4
| | | | | | Most servers apparently always implicitly convert DNAME to CNAME, but some servers don't, hence implement this properly, as this is required by edns0.
* dns-domain: add calls to join/split SRV/DNS-SD service domainsLennart Poettering2015-11-231-0/+3
| | | | | | | | | | | This adds dns_service_join() and dns_service_split() which may be used to concatenate a DNS-SD service name, am SRV service type string, and a domain name into a full resolvable DNS domain name string. If the service name is specified as NULL, only the type and domain are appended, to implement classic, non-DNS-SD SRV lookups. The reverse is dns_service_split() which takes the full name, and split it into the three components again.
* dns-domain: add code for verifying validity of DNS-SD service names and typesLennart Poettering2015-11-231-0/+4
|
* dns-domain: add dns_name_to_wire_format()Beniamino Galvani2015-11-171-0/+2
| | | | | The function converts a domain name string to the wire format described in RFC 1035 Section 3.1.
* hashmap: refactor hash_funcTom Gundersen2015-10-051-1/+1
| | | | | | | | | | | | All our hash functions are based on siphash24(), factor out siphash_init() and siphash24_finalize() and pass the siphash state to the hash functions rather than the hash key. This simplifies the hash functions, and in particular makes composition simpler as calling siphash24_compress() repeatedly on separate chunks of input has the same effect as first concatenating the input and then calling siphash23_compress() on the result.
* dns-domain: add call for concatenating two domain namesLennart Poettering2015-08-211-1/+9
| | | | | This is specifically useful for appending the mDNS ".local" suffix to a single-label hostname in the most correct way. (used in later commit)
* shared: dns-name - add dns_name_between()Tom Gundersen2015-07-281-0/+1
| | | | | | | Given three DNS names this function indicates if the second argument lies strictly between the first and the third according to the canonical DNS name order. Note that the order is circular, so the last name is considered to be before the first.
* shared: dns-name - introduce dns_label_unescape_suffix()Tom Gundersen2015-07-281-0/+1
| | | | | | | | | | Intended to be called repeatedly, and returns then successive unescaped labels from the most to the least significant (left to right). This is slightly inefficient as it scans the string three times (two would be sufficient): once to find the end of the string, once to find the beginning of each label and lastly once to do the actual unescaping. The latter two could be done in one go, but that seemed unnecessarily convoluted.
* shared: add convenience function for validating dns namesNick Owens2015-06-101-0/+9
|
* resolve: move dns routines into sharedNick Owens2015-06-101-0/+50
View Lorry Controller Status