chiark / gitweb /
resolved: add identifiers for dnssec algorithms
[elogind.git] / src / resolve / resolved-dns-packet.c
index 499683ac1d01989bdfc7700b1d2d91afc14732fd..626b904d98054dadf39b9d29be02196266f651aa 100644 (file)
 
 #include "utf8.h"
 #include "util.h"
+#include "strv.h"
 #include "resolved-dns-domain.h"
 #include "resolved-dns-packet.h"
 
-int dns_packet_new(DnsPacket **ret, size_t mtu) {
+int dns_packet_new(DnsPacket **ret, DnsProtocol protocol, size_t mtu) {
         DnsPacket *p;
         size_t a;
 
@@ -51,6 +52,7 @@ int dns_packet_new(DnsPacket **ret, size_t mtu) {
 
         p->size = p->rindex = DNS_PACKET_HEADER_SIZE;
         p->allocated = a;
+        p->protocol = protocol;
         p->n_ref = 1;
 
         *ret = p;
@@ -58,19 +60,39 @@ int dns_packet_new(DnsPacket **ret, size_t mtu) {
         return 0;
 }
 
-int dns_packet_new_query(DnsPacket **ret, size_t mtu) {
+int dns_packet_new_query(DnsPacket **ret, DnsProtocol protocol, size_t mtu) {
         DnsPacket *p;
         DnsPacketHeader *h;
         int r;
 
         assert(ret);
 
-        r = dns_packet_new(&p, mtu);
+        r = dns_packet_new(&p, protocol, mtu);
         if (r < 0)
                 return r;
 
         h = DNS_PACKET_HEADER(p);
-        h->flags = htobe16(DNS_PACKET_MAKE_FLAGS(0, 0, 0, 0, 1, 0, 0, 0, 0));
+
+        if (protocol == DNS_PROTOCOL_LLMNR)
+                h->flags = htobe16(DNS_PACKET_MAKE_FLAGS(0 /* qr */,
+                                                         0 /* opcode */,
+                                                         0 /* c */,
+                                                         0 /* tc */,
+                                                         0 /* t */,
+                                                         0 /* ra */,
+                                                         0 /* ad */,
+                                                         0 /* cd */,
+                                                         0 /* rcode */));
+        else
+                h->flags = htobe16(DNS_PACKET_MAKE_FLAGS(0 /* qr */,
+                                                         0 /* opcode */,
+                                                         0 /* aa */,
+                                                         0 /* tc */,
+                                                         1 /* rd (ask for recursion) */,
+                                                         0 /* ra */,
+                                                         0 /* ad */,
+                                                         0 /* cd */,
+                                                         0 /* rcode */));
 
         *ret = p;
         return 0;
@@ -91,14 +113,14 @@ static void dns_packet_free(DnsPacket *p) {
 
         assert(p);
 
-        if (p->rrs)
-                dns_resource_record_freev(p->rrs, DNS_PACKET_RRCOUNT(p));
+        dns_question_unref(p->question);
+        dns_answer_unref(p->answer);
 
         while ((s = hashmap_steal_first_key(p->names)))
                 free(s);
         hashmap_free(p->names);
 
-        free(p->data);
+        free(p->_data);
         free(p);
 }
 
@@ -125,7 +147,7 @@ int dns_packet_validate(DnsPacket *p) {
         if (p->size > DNS_PACKET_SIZE_MAX)
                 return -EBADMSG;
 
-        return 0;
+        return 1;
 }
 
 int dns_packet_validate_reply(DnsPacket *p) {
@@ -137,13 +159,52 @@ int dns_packet_validate_reply(DnsPacket *p) {
         if (r < 0)
                 return r;
 
-        if (DNS_PACKET_QR(p) == 0)
+        if (DNS_PACKET_QR(p) != 1)
+                return 0;
+
+        if (DNS_PACKET_OPCODE(p) != 0)
+                return -EBADMSG;
+
+        /* RFC 4795, Section 2.1.1. says to discard all replies with QDCOUNT != 1 */
+        if (p->protocol == DNS_PROTOCOL_LLMNR &&
+            DNS_PACKET_QDCOUNT(p) != 1)
                 return -EBADMSG;
 
+        return 1;
+}
+
+int dns_packet_validate_query(DnsPacket *p) {
+        int r;
+
+        assert(p);
+
+        r = dns_packet_validate(p);
+        if (r < 0)
+                return r;
+
+        if (DNS_PACKET_QR(p) != 0)
+                return 0;
+
         if (DNS_PACKET_OPCODE(p) != 0)
                 return -EBADMSG;
 
-        return 0;
+        if (DNS_PACKET_TC(p))
+                return -EBADMSG;
+
+        /* RFC 4795, Section 2.1.1. says to discard all queries with QDCOUNT != 1 */
+        if (p->protocol == DNS_PROTOCOL_LLMNR &&
+            DNS_PACKET_QDCOUNT(p) != 1)
+                return -EBADMSG;
+
+        /* RFC 4795, Section 2.1.1. says to discard all queries with ANCOUNT != 0 */
+        if (DNS_PACKET_ANCOUNT(p) > 0)
+                return -EBADMSG;
+
+        /* RFC 4795, Section 2.1.1. says to discard all queries with NSCOUNT != 0 */
+        if (DNS_PACKET_NSCOUNT(p) > 0)
+                return -EBADMSG;
+
+        return 1;
 }
 
 static int dns_packet_extend(DnsPacket *p, size_t add, void **ret, size_t *start) {
@@ -159,21 +220,21 @@ static int dns_packet_extend(DnsPacket *p, size_t add, void **ret, size_t *start
                 if (p->size + add > a)
                         return -EMSGSIZE;
 
-                if (p->data) {
+                if (p->_data) {
                         void *d;
 
-                        d = realloc(p->data, a);
+                        d = realloc(p->_data, a);
                         if (!d)
                                 return -ENOMEM;
 
-                        p->data = d;
+                        p->_data = d;
                 } else {
-                        p->data = malloc(a);
-                        if (!p->data)
+                        p->_data = malloc(a);
+                        if (!p->_data)
                                 return -ENOMEM;
 
-                        memcpy(p->data, (uint8_t*) p + ALIGN(sizeof(DnsPacket)), p->size);
-                        memzero((uint8_t*) p->data + p->size, a - p->size);
+                        memcpy(p->_data, (uint8_t*) p + ALIGN(sizeof(DnsPacket)), p->size);
+                        memzero((uint8_t*) p->_data + p->size, a - p->size);
                 }
 
                 p->allocated = a;
@@ -211,6 +272,20 @@ static void dns_packet_truncate(DnsPacket *p, size_t sz) {
         p->size = sz;
 }
 
+int dns_packet_append_blob(DnsPacket *p, const void *d, size_t l, size_t *start) {
+        void *q;
+        int r;
+
+        assert(p);
+
+        r = dns_packet_extend(p, l, &q, start);
+        if (r < 0)
+                return r;
+
+        memcpy(q, d, l);
+        return 0;
+}
+
 int dns_packet_append_uint8(DnsPacket *p, uint8_t v, size_t *start) {
         void *d;
         int r;
@@ -237,7 +312,25 @@ int dns_packet_append_uint16(DnsPacket *p, uint16_t v, size_t *start) {
                 return r;
 
         ((uint8_t*) d)[0] = (uint8_t) (v >> 8);
-        ((uint8_t*) d)[1] = (uint8_t) (v & 255);
+        ((uint8_t*) d)[1] = (uint8_t) v;
+
+        return 0;
+}
+
+int dns_packet_append_uint32(DnsPacket *p, uint32_t v, size_t *start) {
+        void *d;
+        int r;
+
+        assert(p);
+
+        r = dns_packet_extend(p, sizeof(uint32_t), &d, start);
+        if (r < 0)
+                return r;
+
+        ((uint8_t*) d)[0] = (uint8_t) (v >> 24);
+        ((uint8_t*) d)[1] = (uint8_t) (v >> 16);
+        ((uint8_t*) d)[2] = (uint8_t) (v >> 8);
+        ((uint8_t*) d)[3] = (uint8_t) v;
 
         return 0;
 }
@@ -297,6 +390,7 @@ int dns_packet_append_name(DnsPacket *p, const char *name, size_t *start) {
                 _cleanup_free_ char *s = NULL;
                 char label[DNS_LABEL_MAX];
                 size_t n;
+                int k;
 
                 n = PTR_TO_SIZE(hashmap_get(p->names, name));
                 if (n > 0) {
@@ -321,6 +415,17 @@ int dns_packet_append_name(DnsPacket *p, const char *name, size_t *start) {
                 if (r < 0)
                         goto fail;
 
+                if (p->protocol == DNS_PROTOCOL_DNS)
+                        k = dns_label_apply_idna(label, r, label, sizeof(label));
+                else
+                        k = dns_label_undo_idna(label, r, label, sizeof(label));
+                if (k < 0) {
+                        r = k;
+                        goto fail;
+                }
+                if (k > 0)
+                        r = k;
+
                 r = dns_packet_append_label(p, label, r, &n);
                 if (r < 0)
                         goto fail;
@@ -360,7 +465,7 @@ int dns_packet_append_key(DnsPacket *p, const DnsResourceKey *k, size_t *start)
 
         saved_size = p->size;
 
-        r = dns_packet_append_name(p, k->name, NULL);
+        r = dns_packet_append_name(p, DNS_RESOURCE_KEY_NAME(k), NULL);
         if (r < 0)
                 goto fail;
 
@@ -382,6 +487,209 @@ fail:
         return r;
 }
 
+int dns_packet_append_rr(DnsPacket *p, const DnsResourceRecord *rr, size_t *start) {
+        size_t saved_size, rdlength_offset, end, rdlength;
+        int r;
+
+        assert(p);
+        assert(rr);
+
+        saved_size = p->size;
+
+        r = dns_packet_append_key(p, rr->key, NULL);
+        if (r < 0)
+                goto fail;
+
+        r = dns_packet_append_uint32(p, rr->ttl, NULL);
+        if (r < 0)
+                goto fail;
+
+        /* Initially we write 0 here */
+        r = dns_packet_append_uint16(p, 0, &rdlength_offset);
+        if (r < 0)
+                goto fail;
+
+        switch (rr->unparseable ? _DNS_TYPE_INVALID : rr->key->type) {
+
+        case DNS_TYPE_SRV:
+                r = dns_packet_append_uint16(p, rr->srv.priority, NULL);
+                if (r < 0)
+                        goto fail;
+
+                r = dns_packet_append_uint16(p, rr->srv.weight, NULL);
+                if (r < 0)
+                        goto fail;
+
+                r = dns_packet_append_uint16(p, rr->srv.port, NULL);
+                if (r < 0)
+                        goto fail;
+
+                r = dns_packet_append_name(p, rr->srv.name, NULL);
+                break;
+
+        case DNS_TYPE_PTR:
+        case DNS_TYPE_NS:
+        case DNS_TYPE_CNAME:
+        case DNS_TYPE_DNAME:
+                r = dns_packet_append_name(p, rr->ptr.name, NULL);
+                break;
+
+        case DNS_TYPE_HINFO:
+                r = dns_packet_append_string(p, rr->hinfo.cpu, NULL);
+                if (r < 0)
+                        goto fail;
+
+                r = dns_packet_append_string(p, rr->hinfo.os, NULL);
+                break;
+
+        case DNS_TYPE_SPF: /* exactly the same as TXT */
+        case DNS_TYPE_TXT: {
+                char **s;
+
+                STRV_FOREACH(s, rr->txt.strings) {
+                        r = dns_packet_append_string(p, *s, NULL);
+                        if (r < 0)
+                                goto fail;
+                }
+
+                r = 0;
+                break;
+        }
+
+        case DNS_TYPE_A:
+                r = dns_packet_append_blob(p, &rr->a.in_addr, sizeof(struct in_addr), NULL);
+                break;
+
+        case DNS_TYPE_AAAA:
+                r = dns_packet_append_blob(p, &rr->aaaa.in6_addr, sizeof(struct in6_addr), NULL);
+                break;
+
+        case DNS_TYPE_SOA:
+                r = dns_packet_append_name(p, rr->soa.mname, NULL);
+                if (r < 0)
+                        goto fail;
+
+                r = dns_packet_append_name(p, rr->soa.rname, NULL);
+                if (r < 0)
+                        goto fail;
+
+                r = dns_packet_append_uint32(p, rr->soa.serial, NULL);
+                if (r < 0)
+                        goto fail;
+
+                r = dns_packet_append_uint32(p, rr->soa.refresh, NULL);
+                if (r < 0)
+                        goto fail;
+
+                r = dns_packet_append_uint32(p, rr->soa.retry, NULL);
+                if (r < 0)
+                        goto fail;
+
+                r = dns_packet_append_uint32(p, rr->soa.expire, NULL);
+                if (r < 0)
+                        goto fail;
+
+                r = dns_packet_append_uint32(p, rr->soa.minimum, NULL);
+                break;
+
+        case DNS_TYPE_MX:
+                r = dns_packet_append_uint16(p, rr->mx.priority, NULL);
+                if (r < 0)
+                        goto fail;
+
+                r = dns_packet_append_name(p, rr->mx.exchange, NULL);
+                break;
+
+        case DNS_TYPE_LOC:
+                r = dns_packet_append_uint8(p, rr->loc.version, NULL);
+                if (r < 0)
+                        goto fail;
+
+                r = dns_packet_append_uint8(p, rr->loc.size, NULL);
+                if (r < 0)
+                        goto fail;
+
+                r = dns_packet_append_uint8(p, rr->loc.horiz_pre, NULL);
+                if (r < 0)
+                        goto fail;
+
+                r = dns_packet_append_uint8(p, rr->loc.vert_pre, NULL);
+                if (r < 0)
+                        goto fail;
+
+                r = dns_packet_append_uint32(p, rr->loc.latitude, NULL);
+                if (r < 0)
+                        goto fail;
+
+                r = dns_packet_append_uint32(p, rr->loc.longitude, NULL);
+                if (r < 0)
+                        goto fail;
+
+                r = dns_packet_append_uint32(p, rr->loc.altitude, NULL);
+                break;
+
+        case DNS_TYPE_SSHFP:
+                r = dns_packet_append_uint8(p, rr->sshfp.algorithm, NULL);
+                if (r < 0)
+                        goto fail;
+
+                r = dns_packet_append_uint8(p, rr->sshfp.fptype, NULL);
+                if (r < 0)
+                        goto fail;
+
+                r = dns_packet_append_blob(p, rr->sshfp.key, rr->sshfp.key_size, NULL);
+                break;
+
+        case DNS_TYPE_DNSKEY:
+                r = dns_packet_append_uint16(p, dnskey_to_flags(rr), NULL);
+                if (r < 0)
+                        goto fail;
+
+                r = dns_packet_append_uint8(p, 3u, NULL);
+                if (r < 0)
+                        goto fail;
+
+                r = dns_packet_append_uint8(p, rr->dnskey.algorithm, NULL);
+                if (r < 0)
+                        goto fail;
+
+                r = dns_packet_append_blob(p, rr->dnskey.key, rr->dnskey.key_size, NULL);
+                break;
+
+        case _DNS_TYPE_INVALID: /* unparseable */
+        default:
+
+                r = dns_packet_append_blob(p, rr->generic.data, rr->generic.size, NULL);
+                break;
+        }
+        if (r < 0)
+                goto fail;
+
+        /* Let's calculate the actual data size and update the field */
+        rdlength = p->size - rdlength_offset - sizeof(uint16_t);
+        if (rdlength > 0xFFFF) {
+                r = ENOSPC;
+                goto fail;
+        }
+
+        end = p->size;
+        p->size = rdlength_offset;
+        r = dns_packet_append_uint16(p, rdlength, NULL);
+        if (r < 0)
+                goto fail;
+        p->size = end;
+
+        if (start)
+                *start = saved_size;
+
+        return 0;
+
+fail:
+        dns_packet_truncate(p, saved_size);
+        return r;
+}
+
+
 int dns_packet_read(DnsPacket *p, size_t sz, const void **ret, size_t *start) {
         assert(p);
 
@@ -406,6 +714,21 @@ void dns_packet_rewind(DnsPacket *p, size_t idx) {
         p->rindex = idx;
 }
 
+int dns_packet_read_blob(DnsPacket *p, void *d, size_t sz, size_t *start) {
+        const void *q;
+        int r;
+
+        assert(p);
+        assert(d);
+
+        r = dns_packet_read(p, sz, &q, start);
+        if (r < 0)
+                return r;
+
+        memcpy(d, q, sz);
+        return 0;
+}
+
 int dns_packet_read_uint8(DnsPacket *p, uint8_t *ret, size_t *start) {
         const void *d;
         int r;
@@ -546,7 +869,7 @@ int dns_packet_read_name(DnsPacket *p, char **_ret, size_t *start) {
                         else
                                 first = false;
 
-                        memcpy(ret + n, t, c);
+                        memcpy(ret + n, t, r);
                         n += r;
                         continue;
                 } else if ((c & 0xc0) == 0xc0) {
@@ -594,8 +917,10 @@ fail:
         return r;
 }
 
-int dns_packet_read_key(DnsPacket *p, DnsResourceKey *ret, size_t *start) {
-        _cleanup_(dns_resource_key_free) DnsResourceKey k = {};
+int dns_packet_read_key(DnsPacket *p, DnsResourceKey **ret, size_t *start) {
+        _cleanup_free_ char *name = NULL;
+        uint16_t class, type;
+        DnsResourceKey *key;
         size_t saved_rindex;
         int r;
 
@@ -604,20 +929,26 @@ int dns_packet_read_key(DnsPacket *p, DnsResourceKey *ret, size_t *start) {
 
         saved_rindex = p->rindex;
 
-        r = dns_packet_read_name(p, &k.name, NULL);
+        r = dns_packet_read_name(p, &name, NULL);
         if (r < 0)
                 goto fail;
 
-        r = dns_packet_read_uint16(p, &k.type, NULL);
+        r = dns_packet_read_uint16(p, &type, NULL);
         if (r < 0)
                 goto fail;
 
-        r = dns_packet_read_uint16(p, &k.class, NULL);
+        r = dns_packet_read_uint16(p, &class, NULL);
         if (r < 0)
                 goto fail;
 
-        *ret = k;
-        zero(k);
+        key = dns_resource_key_new_consume(class, type, name);
+        if (!key) {
+                r = -ENOMEM;
+                goto fail;
+        }
+
+        name = NULL;
+        *ret = key;
 
         if (start)
                 *start = saved_rindex;
@@ -628,8 +959,44 @@ fail:
         return r;
 }
 
+static int dns_packet_read_public_key(DnsPacket *p, size_t length,
+                                      void **dp, size_t *lengthp,
+                                      size_t *start) {
+        int r;
+        const void *d;
+        void *d2;
+
+        r = dns_packet_read(p, length, &d, NULL);
+        if (r < 0)
+                return r;
+
+        d2 = memdup(d, length);
+        if (!d2)
+                return -ENOMEM;
+
+        *dp = d2;
+        *lengthp = length;
+        return 0;
+}
+
+static bool loc_size_ok(uint8_t size) {
+        uint8_t m = size >> 4, e = size & 0xF;
+
+        return m <= 9 && e <= 9 && (m > 0 || e == 0);
+}
+
+static int dnskey_parse_flags(DnsResourceRecord *rr, uint16_t flags) {
+        if (flags & ~(DNSKEY_FLAG_SEP | DNSKEY_FLAG_ZONE_KEY))
+                return -EBADMSG;
+
+        rr->dnskey.zone_key_flag = flags & DNSKEY_FLAG_ZONE_KEY;
+        rr->dnskey.sep_flag = flags & DNSKEY_FLAG_SEP;
+        return 0;
+}
+
 int dns_packet_read_rr(DnsPacket *p, DnsResourceRecord **ret, size_t *start) {
-        _cleanup_(dns_resource_record_unrefp) DnsResourceRecord *rr;
+        _cleanup_(dns_resource_record_unrefp) DnsResourceRecord *rr = NULL;
+        _cleanup_(dns_resource_key_unrefp) DnsResourceKey *key = NULL;
         size_t saved_rindex, offset;
         uint16_t rdlength;
         const void *d;
@@ -638,16 +1005,24 @@ int dns_packet_read_rr(DnsPacket *p, DnsResourceRecord **ret, size_t *start) {
         assert(p);
         assert(ret);
 
-        rr = dns_resource_record_new();
-        if (!rr)
-                return -ENOMEM;
-
         saved_rindex = p->rindex;
 
-        r = dns_packet_read_key(p, &rr->key, NULL);
+        r = dns_packet_read_key(p, &key, NULL);
         if (r < 0)
                 goto fail;
 
+        if (key->class == DNS_CLASS_ANY ||
+            key->type == DNS_TYPE_ANY) {
+                r = -EBADMSG;
+                goto fail;
+        }
+
+        rr = dns_resource_record_new(key);
+        if (!rr) {
+                r = -ENOMEM;
+                goto fail;
+        }
+
         r = dns_packet_read_uint32(p, &rr->ttl, NULL);
         if (r < 0)
                 goto fail;
@@ -663,11 +1038,25 @@ int dns_packet_read_rr(DnsPacket *p, DnsResourceRecord **ret, size_t *start) {
 
         offset = p->rindex;
 
-        switch (rr->key.type) {
+        switch (rr->key->type) {
+
+        case DNS_TYPE_SRV:
+                r = dns_packet_read_uint16(p, &rr->srv.priority, NULL);
+                if (r < 0)
+                        goto fail;
+                r = dns_packet_read_uint16(p, &rr->srv.weight, NULL);
+                if (r < 0)
+                        goto fail;
+                r = dns_packet_read_uint16(p, &rr->srv.port, NULL);
+                if (r < 0)
+                        goto fail;
+                r = dns_packet_read_name(p, &rr->srv.name, NULL);
+                break;
 
         case DNS_TYPE_PTR:
         case DNS_TYPE_NS:
         case DNS_TYPE_CNAME:
+        case DNS_TYPE_DNAME:
                 r = dns_packet_read_name(p, &rr->ptr.name, NULL);
                 break;
 
@@ -679,23 +1068,174 @@ int dns_packet_read_rr(DnsPacket *p, DnsResourceRecord **ret, size_t *start) {
                 r = dns_packet_read_string(p, &rr->hinfo.os, NULL);
                 break;
 
+        case DNS_TYPE_SPF: /* exactly the same as TXT */
+        case DNS_TYPE_TXT: {
+                char *s;
+
+                while (p->rindex < offset + rdlength) {
+                        r = dns_packet_read_string(p, &s, NULL);
+                        if (r < 0)
+                                goto fail;
+
+                        r = strv_consume(&rr->txt.strings, s);
+                        if (r < 0)
+                                goto fail;
+                }
+
+                r = 0;
+                break;
+        }
+
         case DNS_TYPE_A:
-                r = dns_packet_read(p, sizeof(struct in_addr), &d, NULL);
+                r = dns_packet_read_blob(p, &rr->a.in_addr, sizeof(struct in_addr), NULL);
+                break;
+
+        case DNS_TYPE_AAAA:
+                r = dns_packet_read_blob(p, &rr->aaaa.in6_addr, sizeof(struct in6_addr), NULL);
+                break;
+
+        case DNS_TYPE_SOA:
+                r = dns_packet_read_name(p, &rr->soa.mname, NULL);
                 if (r < 0)
                         goto fail;
 
-                memcpy(&rr->a.in_addr, d, sizeof(struct in_addr));
+                r = dns_packet_read_name(p, &rr->soa.rname, NULL);
+                if (r < 0)
+                        goto fail;
+
+                r = dns_packet_read_uint32(p, &rr->soa.serial, NULL);
+                if (r < 0)
+                        goto fail;
+
+                r = dns_packet_read_uint32(p, &rr->soa.refresh, NULL);
+                if (r < 0)
+                        goto fail;
+
+                r = dns_packet_read_uint32(p, &rr->soa.retry, NULL);
+                if (r < 0)
+                        goto fail;
+
+                r = dns_packet_read_uint32(p, &rr->soa.expire, NULL);
+                if (r < 0)
+                        goto fail;
+
+                r = dns_packet_read_uint32(p, &rr->soa.minimum, NULL);
                 break;
 
-        case DNS_TYPE_AAAA:
-                r = dns_packet_read(p, sizeof(struct in6_addr), &d, NULL);
+        case DNS_TYPE_MX:
+                r = dns_packet_read_uint16(p, &rr->mx.priority, NULL);
+                if (r < 0)
+                        goto fail;
+
+                r = dns_packet_read_name(p, &rr->mx.exchange, NULL);
+                break;
+
+        case DNS_TYPE_LOC: {
+                uint8_t t;
+                size_t pos;
+
+                r = dns_packet_read_uint8(p, &t, &pos);
+                if (r < 0)
+                        goto fail;
+
+                if (t == 0) {
+                        rr->loc.version = t;
+
+                        r = dns_packet_read_uint8(p, &rr->loc.size, NULL);
+                        if (r < 0)
+                                goto fail;
+
+                        if (!loc_size_ok(rr->loc.size)) {
+                                r = -EBADMSG;
+                                goto fail;
+                        }
+
+                        r = dns_packet_read_uint8(p, &rr->loc.horiz_pre, NULL);
+                        if (r < 0)
+                                goto fail;
+
+                        if (!loc_size_ok(rr->loc.horiz_pre)) {
+                                r = -EBADMSG;
+                                goto fail;
+                        }
+
+                        r = dns_packet_read_uint8(p, &rr->loc.vert_pre, NULL);
+                        if (r < 0)
+                                goto fail;
+
+                        if (!loc_size_ok(rr->loc.vert_pre)) {
+                                r = -EBADMSG;
+                                goto fail;
+                        }
+
+                        r = dns_packet_read_uint32(p, &rr->loc.latitude, NULL);
+                        if (r < 0)
+                                goto fail;
+
+                        r = dns_packet_read_uint32(p, &rr->loc.longitude, NULL);
+                        if (r < 0)
+                                goto fail;
+
+                        r = dns_packet_read_uint32(p, &rr->loc.altitude, NULL);
+                        if (r < 0)
+                                goto fail;
+
+                        break;
+                } else {
+                        dns_packet_rewind(p, pos);
+                        rr->unparseable = true;
+                        goto unparseable;
+                }
+        }
+
+        case DNS_TYPE_SSHFP:
+                r = dns_packet_read_uint8(p, &rr->sshfp.algorithm, NULL);
+                if (r < 0)
+                        goto fail;
+
+                r = dns_packet_read_uint8(p, &rr->sshfp.fptype, NULL);
                 if (r < 0)
                         goto fail;
 
-                memcpy(&rr->aaaa.in6_addr, d, sizeof(struct in6_addr));
+                r = dns_packet_read_public_key(p, rdlength - 2,
+                                               &rr->sshfp.key, &rr->sshfp.key_size,
+                                               NULL);
                 break;
 
+        case DNS_TYPE_DNSKEY: {
+                uint16_t flags;
+                uint8_t proto;
+
+                r = dns_packet_read_uint16(p, &flags, NULL);
+                if (r < 0)
+                        goto fail;
+
+                r = dnskey_parse_flags(rr, flags);
+                if (r < 0)
+                        goto fail;
+
+                r = dns_packet_read_uint8(p, &proto, NULL);
+                if (r < 0)
+                        goto fail;
+
+                /* protocol is required to be always 3 */
+                if (proto != 3) {
+                        r = -EBADMSG;
+                        goto fail;
+                }
+
+                r = dns_packet_read_uint8(p, &rr->dnskey.algorithm, NULL);
+                if (r < 0)
+                        goto fail;
+
+                r = dns_packet_read_public_key(p, rdlength - 4,
+                                               &rr->dnskey.key, &rr->dnskey.key_size,
+                                               NULL);
+                break;
+        }
+
         default:
+        unparseable:
                 r = dns_packet_read(p, rdlength, &d, NULL);
                 if (r < 0)
                         goto fail;
@@ -728,63 +1268,65 @@ fail:
         return r;
 }
 
-int dns_packet_skip_question(DnsPacket *p) {
-        unsigned i, n;
+int dns_packet_extract(DnsPacket *p) {
+        _cleanup_(dns_question_unrefp) DnsQuestion *question = NULL;
+        _cleanup_(dns_answer_unrefp) DnsAnswer *answer = NULL;
+        size_t saved_rindex;
+        unsigned n, i;
         int r;
 
-        assert(p);
-
+        saved_rindex = p->rindex;
         dns_packet_rewind(p, DNS_PACKET_HEADER_SIZE);
 
         n = DNS_PACKET_QDCOUNT(p);
-        for (i = 0; i < n; i++) {
-                _cleanup_(dns_resource_key_free) DnsResourceKey key = {};
+        if (n > 0) {
+                question = dns_question_new(n);
+                if (!question) {
+                        r = -ENOMEM;
+                        goto finish;
+                }
 
-                r = dns_packet_read_key(p, &key, NULL);
-                if (r < 0)
-                        return r;
-        }
+                for (i = 0; i < n; i++) {
+                        _cleanup_(dns_resource_key_unrefp) DnsResourceKey *key = NULL;
 
-        return 0;
-}
+                        r = dns_packet_read_key(p, &key, NULL);
+                        if (r < 0)
+                                goto finish;
 
-int dns_packet_extract_rrs(DnsPacket *p) {
-        DnsResourceRecord **rrs = NULL;
-        size_t saved_rindex;
-        unsigned n, added = 0;
-        int r;
+                        r = dns_question_add(question, key);
+                        if (r < 0)
+                                goto finish;
+                }
+        }
 
-        if (p->rrs)
-                return (int) DNS_PACKET_RRCOUNT(p);
+        n = DNS_PACKET_RRCOUNT(p);
+        if (n > 0) {
+                answer = dns_answer_new(n);
+                if (!answer) {
+                        r = -ENOMEM;
+                        goto finish;
+                }
 
-        saved_rindex = p->rindex;
+                for (i = 0; i < n; i++) {
+                        _cleanup_(dns_resource_record_unrefp) DnsResourceRecord *rr = NULL;
 
-        r = dns_packet_skip_question(p);
-        if (r < 0)
-                goto finish;
+                        r = dns_packet_read_rr(p, &rr, NULL);
+                        if (r < 0)
+                                goto finish;
 
-        n = DNS_PACKET_RRCOUNT(p);
-        if (n <= 0) {
-                r = 0;
-                goto finish;
+                        r = dns_answer_add(answer, rr);
+                        if (r < 0)
+                                goto finish;
+                }
         }
 
-        rrs = new0(DnsResourceRecord*, n);
-        if (!rrs) {
-                r = -ENOMEM;
-                goto finish;
-        }
+        p->question = question;
+        question = NULL;
 
-        for (added = 0; added < n; added++) {
-                r = dns_packet_read_rr(p, &rrs[added], NULL);
-                if (r < 0) {
-                        dns_resource_record_freev(rrs, added);
-                        goto finish;
-                }
-        }
+        p->answer = answer;
+        answer = NULL;
 
-        p->rrs = rrs;
-        r = (int) n;
+        r = 0;
 
 finish:
         p->rindex = saved_rindex;
@@ -812,3 +1354,22 @@ static const char* const dns_rcode_table[_DNS_RCODE_MAX_DEFINED] = {
         [DNS_RCODE_BADTRUNC] = "BADTRUNC",
 };
 DEFINE_STRING_TABLE_LOOKUP(dns_rcode, int);
+
+static const char* const dns_protocol_table[_DNS_PROTOCOL_MAX] = {
+        [DNS_PROTOCOL_DNS] = "dns",
+        [DNS_PROTOCOL_MDNS] = "mdns",
+        [DNS_PROTOCOL_LLMNR] = "llmnr",
+};
+DEFINE_STRING_TABLE_LOOKUP(dns_protocol, DnsProtocol);
+
+static const char* const dnssec_algorithm_table[_DNSSEC_ALGORITHM_MAX_DEFINED] = {
+        [DNSSEC_ALGORITHM_RSAMD5]     = "RSAMD5",
+        [DNSSEC_ALGORITHM_DH]         = "DH",
+        [DNSSEC_ALGORITHM_DSA]        = "DSA",
+        [DNSSEC_ALGORITHM_ECC]        = "ECC",
+        [DNSSEC_ALGORITHM_RSASHA1]    = "RSASHA1",
+        [DNSSEC_ALGORITHM_INDIRECT]   = "INDIRECT",
+        [DNSSEC_ALGORITHM_PRIVATEDNS] = "PRIVATEDNS",
+        [DNSSEC_ALGORITHM_PRIVATEOID] = "PRIVATEOID",
+};
+DEFINE_STRING_TABLE_LOOKUP(dnssec_algorithm, int);