1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
2
3 #include <netinet/tcp.h>
4
5 #include "af-list.h"
6 #include "alloc-util.h"
7 #include "dns-domain.h"
8 #include "errno-util.h"
9 #include "fd-util.h"
10 #include "hostname-util.h"
11 #include "missing_network.h"
12 #include "random-util.h"
13 #include "resolved-dnssd.h"
14 #include "resolved-dns-scope.h"
15 #include "resolved-dns-zone.h"
16 #include "resolved-llmnr.h"
17 #include "resolved-mdns.h"
18 #include "socket-util.h"
19 #include "strv.h"
20
21 #define MULTICAST_RATELIMIT_INTERVAL_USEC (1*USEC_PER_SEC)
22 #define MULTICAST_RATELIMIT_BURST 1000
23
24 /* After how much time to repeat LLMNR requests, see RFC 4795 Section 7 */
25 #define MULTICAST_RESEND_TIMEOUT_MIN_USEC (100 * USEC_PER_MSEC)
26 #define MULTICAST_RESEND_TIMEOUT_MAX_USEC (1 * USEC_PER_SEC)
27
dns_scope_new(Manager * m,DnsScope ** ret,Link * l,DnsProtocol protocol,int family)28 int dns_scope_new(Manager *m, DnsScope **ret, Link *l, DnsProtocol protocol, int family) {
29 DnsScope *s;
30
31 assert(m);
32 assert(ret);
33
34 s = new(DnsScope, 1);
35 if (!s)
36 return -ENOMEM;
37
38 *s = (DnsScope) {
39 .manager = m,
40 .link = l,
41 .protocol = protocol,
42 .family = family,
43 .resend_timeout = MULTICAST_RESEND_TIMEOUT_MIN_USEC,
44 };
45
46 if (protocol == DNS_PROTOCOL_DNS) {
47 /* Copy DNSSEC mode from the link if it is set there,
48 * otherwise take the manager's DNSSEC mode. Note that
49 * we copy this only at scope creation time, and do
50 * not update it from the on, even if the setting
51 * changes. */
52
53 if (l) {
54 s->dnssec_mode = link_get_dnssec_mode(l);
55 s->dns_over_tls_mode = link_get_dns_over_tls_mode(l);
56 } else {
57 s->dnssec_mode = manager_get_dnssec_mode(m);
58 s->dns_over_tls_mode = manager_get_dns_over_tls_mode(m);
59 }
60
61 } else {
62 s->dnssec_mode = DNSSEC_NO;
63 s->dns_over_tls_mode = DNS_OVER_TLS_NO;
64 }
65
66 LIST_PREPEND(scopes, m->dns_scopes, s);
67
68 dns_scope_llmnr_membership(s, true);
69 dns_scope_mdns_membership(s, true);
70
71 log_debug("New scope on link %s, protocol %s, family %s", l ? l->ifname : "*", dns_protocol_to_string(protocol), family == AF_UNSPEC ? "*" : af_to_name(family));
72
73 /* Enforce ratelimiting for the multicast protocols */
74 s->ratelimit = (RateLimit) { MULTICAST_RATELIMIT_INTERVAL_USEC, MULTICAST_RATELIMIT_BURST };
75
76 *ret = s;
77 return 0;
78 }
79
dns_scope_abort_transactions(DnsScope * s)80 static void dns_scope_abort_transactions(DnsScope *s) {
81 assert(s);
82
83 while (s->transactions) {
84 DnsTransaction *t = s->transactions;
85
86 /* Abort the transaction, but make sure it is not
87 * freed while we still look at it */
88
89 t->block_gc++;
90 if (DNS_TRANSACTION_IS_LIVE(t->state))
91 dns_transaction_complete(t, DNS_TRANSACTION_ABORTED);
92 t->block_gc--;
93
94 dns_transaction_free(t);
95 }
96 }
97
dns_scope_free(DnsScope * s)98 DnsScope* dns_scope_free(DnsScope *s) {
99 if (!s)
100 return NULL;
101
102 log_debug("Removing scope on link %s, protocol %s, family %s", s->link ? s->link->ifname : "*", dns_protocol_to_string(s->protocol), s->family == AF_UNSPEC ? "*" : af_to_name(s->family));
103
104 dns_scope_llmnr_membership(s, false);
105 dns_scope_mdns_membership(s, false);
106 dns_scope_abort_transactions(s);
107
108 while (s->query_candidates)
109 dns_query_candidate_unref(s->query_candidates);
110
111 hashmap_free(s->transactions_by_key);
112
113 ordered_hashmap_free_with_destructor(s->conflict_queue, dns_resource_record_unref);
114 sd_event_source_disable_unref(s->conflict_event_source);
115
116 sd_event_source_disable_unref(s->announce_event_source);
117
118 dns_cache_flush(&s->cache);
119 dns_zone_flush(&s->zone);
120
121 LIST_REMOVE(scopes, s->manager->dns_scopes, s);
122 return mfree(s);
123 }
124
dns_scope_get_dns_server(DnsScope * s)125 DnsServer *dns_scope_get_dns_server(DnsScope *s) {
126 assert(s);
127
128 if (s->protocol != DNS_PROTOCOL_DNS)
129 return NULL;
130
131 if (s->link)
132 return link_get_dns_server(s->link);
133 else
134 return manager_get_dns_server(s->manager);
135 }
136
dns_scope_get_n_dns_servers(DnsScope * s)137 unsigned dns_scope_get_n_dns_servers(DnsScope *s) {
138 unsigned n = 0;
139 DnsServer *i;
140
141 assert(s);
142
143 if (s->protocol != DNS_PROTOCOL_DNS)
144 return 0;
145
146 if (s->link)
147 i = s->link->dns_servers;
148 else
149 i = s->manager->dns_servers;
150
151 for (; i; i = i->servers_next)
152 n++;
153
154 return n;
155 }
156
dns_scope_next_dns_server(DnsScope * s,DnsServer * if_current)157 void dns_scope_next_dns_server(DnsScope *s, DnsServer *if_current) {
158 assert(s);
159
160 if (s->protocol != DNS_PROTOCOL_DNS)
161 return;
162
163 /* Changes to the next DNS server in the list. If 'if_current' is passed will do so only if the
164 * current DNS server still matches it. */
165
166 if (s->link)
167 link_next_dns_server(s->link, if_current);
168 else
169 manager_next_dns_server(s->manager, if_current);
170 }
171
dns_scope_packet_received(DnsScope * s,usec_t rtt)172 void dns_scope_packet_received(DnsScope *s, usec_t rtt) {
173 assert(s);
174
175 if (rtt <= s->max_rtt)
176 return;
177
178 s->max_rtt = rtt;
179 s->resend_timeout = MIN(MAX(MULTICAST_RESEND_TIMEOUT_MIN_USEC, s->max_rtt * 2), MULTICAST_RESEND_TIMEOUT_MAX_USEC);
180 }
181
dns_scope_packet_lost(DnsScope * s,usec_t usec)182 void dns_scope_packet_lost(DnsScope *s, usec_t usec) {
183 assert(s);
184
185 if (s->resend_timeout <= usec)
186 s->resend_timeout = MIN(s->resend_timeout * 2, MULTICAST_RESEND_TIMEOUT_MAX_USEC);
187 }
188
dns_scope_emit_one(DnsScope * s,int fd,int family,DnsPacket * p)189 static int dns_scope_emit_one(DnsScope *s, int fd, int family, DnsPacket *p) {
190 int r;
191
192 assert(s);
193 assert(p);
194 assert(p->protocol == s->protocol);
195
196 if (family == AF_UNSPEC) {
197 if (s->family == AF_UNSPEC)
198 return -EAFNOSUPPORT;
199
200 family = s->family;
201 }
202
203 switch (s->protocol) {
204
205 case DNS_PROTOCOL_DNS: {
206 size_t mtu, udp_size, min_mtu, socket_mtu = 0;
207
208 assert(fd >= 0);
209
210 if (DNS_PACKET_QDCOUNT(p) > 1) /* Classic DNS only allows one question per packet */
211 return -EOPNOTSUPP;
212
213 if (p->size > DNS_PACKET_UNICAST_SIZE_MAX)
214 return -EMSGSIZE;
215
216 /* Determine the local most accurate MTU */
217 if (s->link)
218 mtu = s->link->mtu;
219 else
220 mtu = manager_find_mtu(s->manager);
221
222 /* Acquire the socket's PMDU MTU */
223 r = socket_get_mtu(fd, family, &socket_mtu);
224 if (r < 0 && !ERRNO_IS_DISCONNECT(r)) /* Will return ENOTCONN if no information is available yet */
225 return log_debug_errno(r, "Failed to read socket MTU: %m");
226
227 /* Determine the appropriate UDP header size */
228 udp_size = udp_header_size(family);
229 min_mtu = udp_size + DNS_PACKET_HEADER_SIZE;
230
231 log_debug("Emitting UDP, link MTU is %zu, socket MTU is %zu, minimal MTU is %zu",
232 mtu, socket_mtu, min_mtu);
233
234 /* Clamp by the kernel's idea of the (path) MTU */
235 if (socket_mtu != 0 && socket_mtu < mtu)
236 mtu = socket_mtu;
237
238 /* Put a lower limit, in case all MTU data we acquired was rubbish */
239 if (mtu < min_mtu)
240 mtu = min_mtu;
241
242 /* Now check our packet size against the MTU we determined */
243 if (udp_size + p->size > mtu)
244 return -EMSGSIZE; /* This means: try TCP instead */
245
246 r = manager_write(s->manager, fd, p);
247 if (r < 0)
248 return r;
249
250 break;
251 }
252
253 case DNS_PROTOCOL_LLMNR: {
254 union in_addr_union addr;
255
256 assert(fd < 0);
257
258 if (DNS_PACKET_QDCOUNT(p) > 1)
259 return -EOPNOTSUPP;
260
261 if (!ratelimit_below(&s->ratelimit))
262 return -EBUSY;
263
264 if (family == AF_INET) {
265 addr.in = LLMNR_MULTICAST_IPV4_ADDRESS;
266 fd = manager_llmnr_ipv4_udp_fd(s->manager);
267 } else if (family == AF_INET6) {
268 addr.in6 = LLMNR_MULTICAST_IPV6_ADDRESS;
269 fd = manager_llmnr_ipv6_udp_fd(s->manager);
270 } else
271 return -EAFNOSUPPORT;
272 if (fd < 0)
273 return fd;
274
275 r = manager_send(s->manager, fd, s->link->ifindex, family, &addr, LLMNR_PORT, NULL, p);
276 if (r < 0)
277 return r;
278
279 break;
280 }
281
282 case DNS_PROTOCOL_MDNS: {
283 union in_addr_union addr;
284 assert(fd < 0);
285
286 if (!ratelimit_below(&s->ratelimit))
287 return -EBUSY;
288
289 if (family == AF_INET) {
290 if (in4_addr_is_null(&p->destination.in))
291 addr.in = MDNS_MULTICAST_IPV4_ADDRESS;
292 else
293 addr = p->destination;
294 fd = manager_mdns_ipv4_fd(s->manager);
295 } else if (family == AF_INET6) {
296 if (in6_addr_is_null(&p->destination.in6))
297 addr.in6 = MDNS_MULTICAST_IPV6_ADDRESS;
298 else
299 addr = p->destination;
300 fd = manager_mdns_ipv6_fd(s->manager);
301 } else
302 return -EAFNOSUPPORT;
303 if (fd < 0)
304 return fd;
305
306 r = manager_send(s->manager, fd, s->link->ifindex, family, &addr, p->destination_port ?: MDNS_PORT, NULL, p);
307 if (r < 0)
308 return r;
309
310 break;
311 }
312
313 default:
314 return -EAFNOSUPPORT;
315 }
316
317 return 1;
318 }
319
dns_scope_emit_udp(DnsScope * s,int fd,int af,DnsPacket * p)320 int dns_scope_emit_udp(DnsScope *s, int fd, int af, DnsPacket *p) {
321 int r;
322
323 assert(s);
324 assert(p);
325 assert(p->protocol == s->protocol);
326 assert((s->protocol == DNS_PROTOCOL_DNS) == (fd >= 0));
327
328 do {
329 /* If there are multiple linked packets, set the TC bit in all but the last of them */
330 if (p->more) {
331 assert(p->protocol == DNS_PROTOCOL_MDNS);
332 dns_packet_set_flags(p, true, true);
333 }
334
335 r = dns_scope_emit_one(s, fd, af, p);
336 if (r < 0)
337 return r;
338
339 p = p->more;
340 } while (p);
341
342 return 0;
343 }
344
dns_scope_socket(DnsScope * s,int type,int family,const union in_addr_union * address,DnsServer * server,uint16_t port,union sockaddr_union * ret_socket_address)345 static int dns_scope_socket(
346 DnsScope *s,
347 int type,
348 int family,
349 const union in_addr_union *address,
350 DnsServer *server,
351 uint16_t port,
352 union sockaddr_union *ret_socket_address) {
353
354 _cleanup_close_ int fd = -1;
355 union sockaddr_union sa;
356 socklen_t salen;
357 int r, ifindex;
358
359 assert(s);
360
361 if (server) {
362 assert(family == AF_UNSPEC);
363 assert(!address);
364
365 ifindex = dns_server_ifindex(server);
366
367 switch (server->family) {
368 case AF_INET:
369 sa = (union sockaddr_union) {
370 .in.sin_family = server->family,
371 .in.sin_port = htobe16(port),
372 .in.sin_addr = server->address.in,
373 };
374 salen = sizeof(sa.in);
375 break;
376 case AF_INET6:
377 sa = (union sockaddr_union) {
378 .in6.sin6_family = server->family,
379 .in6.sin6_port = htobe16(port),
380 .in6.sin6_addr = server->address.in6,
381 .in6.sin6_scope_id = ifindex,
382 };
383 salen = sizeof(sa.in6);
384 break;
385 default:
386 return -EAFNOSUPPORT;
387 }
388 } else {
389 assert(family != AF_UNSPEC);
390 assert(address);
391
392 ifindex = s->link ? s->link->ifindex : 0;
393
394 switch (family) {
395 case AF_INET:
396 sa = (union sockaddr_union) {
397 .in.sin_family = family,
398 .in.sin_port = htobe16(port),
399 .in.sin_addr = address->in,
400 };
401 salen = sizeof(sa.in);
402 break;
403 case AF_INET6:
404 sa = (union sockaddr_union) {
405 .in6.sin6_family = family,
406 .in6.sin6_port = htobe16(port),
407 .in6.sin6_addr = address->in6,
408 .in6.sin6_scope_id = ifindex,
409 };
410 salen = sizeof(sa.in6);
411 break;
412 default:
413 return -EAFNOSUPPORT;
414 }
415 }
416
417 fd = socket(sa.sa.sa_family, type|SOCK_CLOEXEC|SOCK_NONBLOCK, 0);
418 if (fd < 0)
419 return -errno;
420
421 if (type == SOCK_STREAM) {
422 r = setsockopt_int(fd, IPPROTO_TCP, TCP_NODELAY, true);
423 if (r < 0)
424 return r;
425 }
426
427 if (s->link) {
428 r = socket_set_unicast_if(fd, sa.sa.sa_family, ifindex);
429 if (r < 0)
430 return r;
431 }
432
433 if (s->protocol == DNS_PROTOCOL_LLMNR) {
434 /* RFC 4795, section 2.5 requires the TTL to be set to 1 */
435 r = socket_set_ttl(fd, sa.sa.sa_family, 1);
436 if (r < 0)
437 return r;
438 }
439
440 if (type == SOCK_DGRAM) {
441 /* Set IP_RECVERR or IPV6_RECVERR to get ICMP error feedback. See discussion in #10345. */
442 r = socket_set_recverr(fd, sa.sa.sa_family, true);
443 if (r < 0)
444 return r;
445
446 r = socket_set_recvpktinfo(fd, sa.sa.sa_family, true);
447 if (r < 0)
448 return r;
449
450 /* Turn of path MTU discovery for security reasons */
451 r = socket_disable_pmtud(fd, sa.sa.sa_family);
452 if (r < 0)
453 log_debug_errno(r, "Failed to disable UDP PMTUD, ignoring: %m");
454
455 /* Learn about fragmentation taking place */
456 r = socket_set_recvfragsize(fd, sa.sa.sa_family, true);
457 if (r < 0)
458 log_debug_errno(r, "Failed to enable fragment size reception, ignoring: %m");
459 }
460
461 if (ret_socket_address)
462 *ret_socket_address = sa;
463 else {
464 bool bound = false;
465
466 /* Let's temporarily bind the socket to the specified ifindex. The kernel currently takes
467 * only the SO_BINDTODEVICE/SO_BINDTOINDEX ifindex into account when making routing decisions
468 * in connect() — and not IP_UNICAST_IF. We don't really want any of the other semantics of
469 * SO_BINDTODEVICE/SO_BINDTOINDEX, hence we immediately unbind the socket after the fact
470 * again.
471 *
472 * As a special exception we don't do this if we notice that the specified IP address is on
473 * the local host. SO_BINDTODEVICE in combination with destination addresses on the local
474 * host result in EHOSTUNREACH, since Linux won't send the packets out of the specified
475 * interface, but delivers them directly to the local socket. */
476 if (s->link &&
477 !manager_find_link_address(s->manager, sa.sa.sa_family, sockaddr_in_addr(&sa.sa))) {
478 r = socket_bind_to_ifindex(fd, ifindex);
479 if (r < 0)
480 return r;
481
482 bound = true;
483 }
484
485 r = connect(fd, &sa.sa, salen);
486 if (r < 0 && errno != EINPROGRESS)
487 return -errno;
488
489 if (bound) {
490 r = socket_bind_to_ifindex(fd, 0);
491 if (r < 0)
492 return r;
493 }
494 }
495
496 return TAKE_FD(fd);
497 }
498
dns_scope_socket_udp(DnsScope * s,DnsServer * server)499 int dns_scope_socket_udp(DnsScope *s, DnsServer *server) {
500 return dns_scope_socket(s, SOCK_DGRAM, AF_UNSPEC, NULL, server, dns_server_port(server), NULL);
501 }
502
dns_scope_socket_tcp(DnsScope * s,int family,const union in_addr_union * address,DnsServer * server,uint16_t port,union sockaddr_union * ret_socket_address)503 int dns_scope_socket_tcp(DnsScope *s, int family, const union in_addr_union *address, DnsServer *server, uint16_t port, union sockaddr_union *ret_socket_address) {
504 /* If ret_socket_address is not NULL, the caller is responsible
505 * for calling connect() or sendmsg(). This is required by TCP
506 * Fast Open, to be able to send the initial SYN packet along
507 * with the first data packet. */
508 return dns_scope_socket(s, SOCK_STREAM, family, address, server, port, ret_socket_address);
509 }
510
match_link_local_reverse_lookups(const char * domain)511 static DnsScopeMatch match_link_local_reverse_lookups(const char *domain) {
512 assert(domain);
513
514 if (dns_name_endswith(domain, "254.169.in-addr.arpa") > 0)
515 return DNS_SCOPE_YES_BASE + 4; /* 4 labels match */
516
517 if (dns_name_endswith(domain, "8.e.f.ip6.arpa") > 0 ||
518 dns_name_endswith(domain, "9.e.f.ip6.arpa") > 0 ||
519 dns_name_endswith(domain, "a.e.f.ip6.arpa") > 0 ||
520 dns_name_endswith(domain, "b.e.f.ip6.arpa") > 0)
521 return DNS_SCOPE_YES_BASE + 5; /* 5 labels match */
522
523 return _DNS_SCOPE_MATCH_INVALID;
524 }
525
match_subnet_reverse_lookups(DnsScope * s,const char * domain,bool exclude_own)526 static DnsScopeMatch match_subnet_reverse_lookups(
527 DnsScope *s,
528 const char *domain,
529 bool exclude_own) {
530
531 union in_addr_union ia;
532 int f, r;
533
534 assert(s);
535 assert(domain);
536
537 /* Checks whether the specified domain is a reverse address domain (i.e. in the .in-addr.arpa or
538 * .ip6.arpa area), and if so, whether the address matches any of the local subnets of the link the
539 * scope is associated with. If so, our scope should consider itself relevant for any lookup in the
540 * domain, since it apparently refers to hosts on this link's subnet.
541 *
542 * If 'exclude_own' is true this will return DNS_SCOPE_NO for any IP addresses assigned locally. This
543 * is useful for LLMNR/mDNS as we never want to look up our own hostname on LLMNR/mDNS but always use
544 * the locally synthesized one. */
545
546 if (!s->link)
547 return _DNS_SCOPE_MATCH_INVALID; /* No link, hence no local addresses to check */
548
549 r = dns_name_address(domain, &f, &ia);
550 if (r < 0)
551 log_debug_errno(r, "Failed to determine whether '%s' is an address domain: %m", domain);
552 if (r <= 0)
553 return _DNS_SCOPE_MATCH_INVALID;
554
555 if (s->family != AF_UNSPEC && f != s->family)
556 return _DNS_SCOPE_MATCH_INVALID; /* Don't look for IPv4 addresses on LLMNR/mDNS over IPv6 and vice versa */
557
558 LIST_FOREACH(addresses, a, s->link->addresses) {
559
560 if (a->family != f)
561 continue;
562
563 /* Equals our own address? nah, let's not use this scope. The local synthesizer will pick it up for us. */
564 if (exclude_own &&
565 in_addr_equal(f, &a->in_addr, &ia) > 0)
566 return DNS_SCOPE_NO;
567
568 if (a->prefixlen == UCHAR_MAX) /* don't know subnet mask */
569 continue;
570
571 /* Check if the address is in the local subnet */
572 r = in_addr_prefix_covers(f, &a->in_addr, a->prefixlen, &ia);
573 if (r < 0)
574 log_debug_errno(r, "Failed to determine whether link address covers lookup address '%s': %m", domain);
575 if (r > 0)
576 /* Note that we only claim zero labels match. This is so that this is at the same
577 * priority a DNS scope with "." as routing domain is. */
578 return DNS_SCOPE_YES_BASE + 0;
579 }
580
581 return _DNS_SCOPE_MATCH_INVALID;
582 }
583
dns_scope_good_domain(DnsScope * s,DnsQuery * q)584 DnsScopeMatch dns_scope_good_domain(
585 DnsScope *s,
586 DnsQuery *q) {
587
588 DnsQuestion *question;
589 const char *domain;
590 uint64_t flags;
591 int ifindex;
592
593 /* This returns the following return values:
594 *
595 * DNS_SCOPE_NO → This scope is not suitable for lookups of this domain, at all
596 * DNS_SCOPE_MAYBE → This scope is suitable, but only if nothing else wants it
597 * DNS_SCOPE_YES_BASE+n → This scope is suitable, and 'n' suffix labels match
598 *
599 * (The idea is that the caller will only use the scopes with the longest 'n' returned. If no scopes return
600 * DNS_SCOPE_YES_BASE+n, then it should use those which returned DNS_SCOPE_MAYBE. It should never use those
601 * which returned DNS_SCOPE_NO.)
602 */
603
604 assert(s);
605 assert(q);
606
607 question = dns_query_question_for_protocol(q, s->protocol);
608 if (!question)
609 return DNS_SCOPE_NO;
610
611 domain = dns_question_first_name(question);
612 if (!domain)
613 return DNS_SCOPE_NO;
614
615 ifindex = q->ifindex;
616 flags = q->flags;
617
618 /* Checks if the specified domain is something to look up on this scope. Note that this accepts
619 * non-qualified hostnames, i.e. those without any search path suffixed. */
620
621 if (ifindex != 0 && (!s->link || s->link->ifindex != ifindex))
622 return DNS_SCOPE_NO;
623
624 if ((SD_RESOLVED_FLAGS_MAKE(s->protocol, s->family, false, false) & flags) == 0)
625 return DNS_SCOPE_NO;
626
627 /* Never resolve any loopback hostname or IP address via DNS, LLMNR or mDNS. Instead, always rely on
628 * synthesized RRs for these. */
629 if (is_localhost(domain) ||
630 dns_name_endswith(domain, "127.in-addr.arpa") > 0 ||
631 dns_name_equal(domain, "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa") > 0)
632 return DNS_SCOPE_NO;
633
634 /* Never respond to some of the domains listed in RFC6303 + RFC6761 */
635 if (dns_name_dont_resolve(domain))
636 return DNS_SCOPE_NO;
637
638 /* Never go to network for the _gateway or _outbound domain — they're something special, synthesized locally. */
639 if (is_gateway_hostname(domain) || is_outbound_hostname(domain))
640 return DNS_SCOPE_NO;
641
642 switch (s->protocol) {
643
644 case DNS_PROTOCOL_DNS: {
645 bool has_search_domains = false;
646 DnsScopeMatch m;
647 int n_best = -1;
648
649 if (dns_name_is_empty(domain)) {
650 DnsResourceKey *t;
651 bool found = false;
652
653 /* Refuse empty name if only A and/or AAAA records are requested. */
654
655 DNS_QUESTION_FOREACH(t, question)
656 if (!IN_SET(t->type, DNS_TYPE_A, DNS_TYPE_AAAA)) {
657 found = true;
658 break;
659 }
660
661 if (!found)
662 return DNS_SCOPE_NO;
663 }
664
665 /* Never route things to scopes that lack DNS servers */
666 if (!dns_scope_get_dns_server(s))
667 return DNS_SCOPE_NO;
668
669 /* Always honour search domains for routing queries, except if this scope lacks DNS servers. Note that
670 * we return DNS_SCOPE_YES here, rather than just DNS_SCOPE_MAYBE, which means other wildcard scopes
671 * won't be considered anymore. */
672 LIST_FOREACH(domains, d, dns_scope_get_search_domains(s)) {
673
674 if (!d->route_only && !dns_name_is_root(d->name))
675 has_search_domains = true;
676
677 if (dns_name_endswith(domain, d->name) > 0) {
678 int c;
679
680 c = dns_name_count_labels(d->name);
681 if (c < 0)
682 continue;
683
684 if (c > n_best)
685 n_best = c;
686 }
687 }
688
689 /* If there's a true search domain defined for this scope, and the query is single-label,
690 * then let's resolve things here, prefereably. Note that LLMNR considers itself
691 * authoritative for single-label names too, at the same preference, see below. */
692 if (has_search_domains && dns_name_is_single_label(domain))
693 return DNS_SCOPE_YES_BASE + 1;
694
695 /* Let's return the number of labels in the best matching result */
696 if (n_best >= 0) {
697 assert(n_best <= DNS_SCOPE_YES_END - DNS_SCOPE_YES_BASE);
698 return DNS_SCOPE_YES_BASE + n_best;
699 }
700
701 /* Exclude link-local IP ranges */
702 if (match_link_local_reverse_lookups(domain) >= DNS_SCOPE_YES_BASE ||
703 /* If networks use .local in their private setups, they are supposed to also add .local
704 * to their search domains, which we already checked above. Otherwise, we consider .local
705 * specific to mDNS and won't send such queries ordinary DNS servers. */
706 dns_name_endswith(domain, "local") > 0)
707 return DNS_SCOPE_NO;
708
709 /* If the IP address to look up matches the local subnet, then implicitly synthesizes
710 * DNS_SCOPE_YES_BASE + 0 on this interface, i.e. preferably resolve IP addresses via the DNS
711 * server belonging to this interface. */
712 m = match_subnet_reverse_lookups(s, domain, false);
713 if (m >= 0)
714 return m;
715
716 /* If there was no match at all, then see if this scope is suitable as default route. */
717 if (!dns_scope_is_default_route(s))
718 return DNS_SCOPE_NO;
719
720 return DNS_SCOPE_MAYBE;
721 }
722
723 case DNS_PROTOCOL_MDNS: {
724 DnsScopeMatch m;
725
726 m = match_link_local_reverse_lookups(domain);
727 if (m >= 0)
728 return m;
729
730 m = match_subnet_reverse_lookups(s, domain, true);
731 if (m >= 0)
732 return m;
733
734 if ((s->family == AF_INET && dns_name_endswith(domain, "in-addr.arpa") > 0) ||
735 (s->family == AF_INET6 && dns_name_endswith(domain, "ip6.arpa") > 0))
736 return DNS_SCOPE_MAYBE;
737
738 if ((dns_name_endswith(domain, "local") > 0 && /* only resolve names ending in .local via mDNS */
739 dns_name_equal(domain, "local") == 0 && /* but not the single-label "local" name itself */
740 manager_is_own_hostname(s->manager, domain) <= 0)) /* never resolve the local hostname via mDNS */
741 return DNS_SCOPE_YES_BASE + 1; /* Return +1, as the top-level .local domain matches, i.e. one label */
742
743 return DNS_SCOPE_NO;
744 }
745
746 case DNS_PROTOCOL_LLMNR: {
747 DnsScopeMatch m;
748
749 m = match_link_local_reverse_lookups(domain);
750 if (m >= 0)
751 return m;
752
753 m = match_subnet_reverse_lookups(s, domain, true);
754 if (m >= 0)
755 return m;
756
757 if ((s->family == AF_INET && dns_name_endswith(domain, "in-addr.arpa") > 0) ||
758 (s->family == AF_INET6 && dns_name_endswith(domain, "ip6.arpa") > 0))
759 return DNS_SCOPE_MAYBE;
760
761 if ((dns_name_is_single_label(domain) && /* only resolve single label names via LLMNR */
762 !is_gateway_hostname(domain) && /* don't resolve "_gateway" with LLMNR, let local synthesizing logic handle that */
763 !is_outbound_hostname(domain) && /* similar for "_outbound" */
764 dns_name_equal(domain, "local") == 0 && /* don't resolve "local" with LLMNR, it's the top-level domain of mDNS after all, see above */
765 manager_is_own_hostname(s->manager, domain) <= 0)) /* never resolve the local hostname via LLMNR */
766 return DNS_SCOPE_YES_BASE + 1; /* Return +1, as we consider ourselves authoritative
767 * for single-label names, i.e. one label. This is
768 * particularly relevant as it means a "." route on some
769 * other scope won't pull all traffic away from
770 * us. (If people actually want to pull traffic away
771 * from us they should turn off LLMNR on the
772 * link). Note that unicast DNS scopes with search
773 * domains also consider themselves authoritative for
774 * single-label domains, at the same preference (see
775 * above). */
776
777 return DNS_SCOPE_NO;
778 }
779
780 default:
781 assert_not_reached();
782 }
783 }
784
dns_scope_good_key(DnsScope * s,const DnsResourceKey * key)785 bool dns_scope_good_key(DnsScope *s, const DnsResourceKey *key) {
786 int key_family;
787
788 assert(s);
789 assert(key);
790
791 /* Check if it makes sense to resolve the specified key on this scope. Note that this call assumes a
792 * fully qualified name, i.e. the search suffixes already appended. */
793
794 if (!IN_SET(key->class, DNS_CLASS_IN, DNS_CLASS_ANY))
795 return false;
796
797 if (s->protocol == DNS_PROTOCOL_DNS) {
798
799 /* On classic DNS, looking up non-address RRs is always fine. (Specifically, we want to
800 * permit looking up DNSKEY and DS records on the root and top-level domains.) */
801 if (!dns_resource_key_is_address(key))
802 return true;
803
804 /* Unless explicitly overridden, we refuse to look up A and AAAA RRs on the root and
805 * single-label domains, under the assumption that those should be resolved via LLMNR or
806 * search path only, and should not be leaked onto the internet. */
807 const char* name = dns_resource_key_name(key);
808
809 if (!s->manager->resolve_unicast_single_label &&
810 dns_name_is_single_label(name))
811 return false;
812
813 return !dns_name_is_root(name);
814 }
815
816 /* Never route DNSSEC RR queries to LLMNR/mDNS scopes */
817 if (dns_type_is_dnssec(key->type))
818 return false;
819
820 /* On mDNS and LLMNR, send A and AAAA queries only on the respective scopes */
821
822 key_family = dns_type_to_af(key->type);
823 if (key_family < 0)
824 return true;
825
826 return key_family == s->family;
827 }
828
dns_scope_multicast_membership(DnsScope * s,bool b,struct in_addr in,struct in6_addr in6)829 static int dns_scope_multicast_membership(DnsScope *s, bool b, struct in_addr in, struct in6_addr in6) {
830 int fd;
831
832 assert(s);
833 assert(s->link);
834
835 if (s->family == AF_INET) {
836 struct ip_mreqn mreqn = {
837 .imr_multiaddr = in,
838 .imr_ifindex = s->link->ifindex,
839 };
840
841 if (s->protocol == DNS_PROTOCOL_LLMNR)
842 fd = manager_llmnr_ipv4_udp_fd(s->manager);
843 else
844 fd = manager_mdns_ipv4_fd(s->manager);
845
846 if (fd < 0)
847 return fd;
848
849 /* Always first try to drop membership before we add
850 * one. This is necessary on some devices, such as
851 * veth. */
852 if (b)
853 (void) setsockopt(fd, IPPROTO_IP, IP_DROP_MEMBERSHIP, &mreqn, sizeof(mreqn));
854
855 if (setsockopt(fd, IPPROTO_IP, b ? IP_ADD_MEMBERSHIP : IP_DROP_MEMBERSHIP, &mreqn, sizeof(mreqn)) < 0)
856 return -errno;
857
858 } else if (s->family == AF_INET6) {
859 struct ipv6_mreq mreq = {
860 .ipv6mr_multiaddr = in6,
861 .ipv6mr_interface = s->link->ifindex,
862 };
863
864 if (s->protocol == DNS_PROTOCOL_LLMNR)
865 fd = manager_llmnr_ipv6_udp_fd(s->manager);
866 else
867 fd = manager_mdns_ipv6_fd(s->manager);
868
869 if (fd < 0)
870 return fd;
871
872 if (b)
873 (void) setsockopt(fd, IPPROTO_IPV6, IPV6_DROP_MEMBERSHIP, &mreq, sizeof(mreq));
874
875 if (setsockopt(fd, IPPROTO_IPV6, b ? IPV6_ADD_MEMBERSHIP : IPV6_DROP_MEMBERSHIP, &mreq, sizeof(mreq)) < 0)
876 return -errno;
877 } else
878 return -EAFNOSUPPORT;
879
880 return 0;
881 }
882
dns_scope_llmnr_membership(DnsScope * s,bool b)883 int dns_scope_llmnr_membership(DnsScope *s, bool b) {
884 assert(s);
885
886 if (s->protocol != DNS_PROTOCOL_LLMNR)
887 return 0;
888
889 return dns_scope_multicast_membership(s, b, LLMNR_MULTICAST_IPV4_ADDRESS, LLMNR_MULTICAST_IPV6_ADDRESS);
890 }
891
dns_scope_mdns_membership(DnsScope * s,bool b)892 int dns_scope_mdns_membership(DnsScope *s, bool b) {
893 assert(s);
894
895 if (s->protocol != DNS_PROTOCOL_MDNS)
896 return 0;
897
898 return dns_scope_multicast_membership(s, b, MDNS_MULTICAST_IPV4_ADDRESS, MDNS_MULTICAST_IPV6_ADDRESS);
899 }
900
dns_scope_make_reply_packet(DnsScope * s,uint16_t id,int rcode,DnsQuestion * q,DnsAnswer * answer,DnsAnswer * soa,bool tentative,DnsPacket ** ret)901 int dns_scope_make_reply_packet(
902 DnsScope *s,
903 uint16_t id,
904 int rcode,
905 DnsQuestion *q,
906 DnsAnswer *answer,
907 DnsAnswer *soa,
908 bool tentative,
909 DnsPacket **ret) {
910
911 _cleanup_(dns_packet_unrefp) DnsPacket *p = NULL;
912 unsigned n_answer = 0, n_soa = 0;
913 int r;
914 bool c_or_aa;
915
916 assert(s);
917 assert(ret);
918
919 if (dns_question_isempty(q) &&
920 dns_answer_isempty(answer) &&
921 dns_answer_isempty(soa))
922 return -EINVAL;
923
924 r = dns_packet_new(&p, s->protocol, 0, DNS_PACKET_SIZE_MAX);
925 if (r < 0)
926 return r;
927
928 /* mDNS answers must have the Authoritative Answer bit set, see RFC 6762, section 18.4. */
929 c_or_aa = s->protocol == DNS_PROTOCOL_MDNS;
930
931 DNS_PACKET_HEADER(p)->id = id;
932 DNS_PACKET_HEADER(p)->flags = htobe16(DNS_PACKET_MAKE_FLAGS(
933 1 /* qr */,
934 0 /* opcode */,
935 c_or_aa,
936 0 /* tc */,
937 tentative,
938 0 /* (ra) */,
939 0 /* (ad) */,
940 0 /* (cd) */,
941 rcode));
942
943 r = dns_packet_append_question(p, q);
944 if (r < 0)
945 return r;
946 DNS_PACKET_HEADER(p)->qdcount = htobe16(dns_question_size(q));
947
948 r = dns_packet_append_answer(p, answer, &n_answer);
949 if (r < 0)
950 return r;
951 DNS_PACKET_HEADER(p)->ancount = htobe16(n_answer);
952
953 r = dns_packet_append_answer(p, soa, &n_soa);
954 if (r < 0)
955 return r;
956 DNS_PACKET_HEADER(p)->arcount = htobe16(n_soa);
957
958 *ret = TAKE_PTR(p);
959
960 return 0;
961 }
962
dns_scope_verify_conflicts(DnsScope * s,DnsPacket * p)963 static void dns_scope_verify_conflicts(DnsScope *s, DnsPacket *p) {
964 DnsResourceRecord *rr;
965 DnsResourceKey *key;
966
967 assert(s);
968 assert(p);
969
970 DNS_QUESTION_FOREACH(key, p->question)
971 dns_zone_verify_conflicts(&s->zone, key);
972
973 DNS_ANSWER_FOREACH(rr, p->answer)
974 dns_zone_verify_conflicts(&s->zone, rr->key);
975 }
976
dns_scope_process_query(DnsScope * s,DnsStream * stream,DnsPacket * p)977 void dns_scope_process_query(DnsScope *s, DnsStream *stream, DnsPacket *p) {
978 _cleanup_(dns_answer_unrefp) DnsAnswer *answer = NULL, *soa = NULL;
979 _cleanup_(dns_packet_unrefp) DnsPacket *reply = NULL;
980 DnsResourceKey *key = NULL;
981 bool tentative = false;
982 int r;
983
984 assert(s);
985 assert(p);
986
987 if (p->protocol != DNS_PROTOCOL_LLMNR)
988 return;
989
990 if (p->ipproto == IPPROTO_UDP) {
991 /* Don't accept UDP queries directed to anything but
992 * the LLMNR multicast addresses. See RFC 4795,
993 * section 2.5. */
994
995 if (p->family == AF_INET && !in4_addr_equal(&p->destination.in, &LLMNR_MULTICAST_IPV4_ADDRESS))
996 return;
997
998 if (p->family == AF_INET6 && !in6_addr_equal(&p->destination.in6, &LLMNR_MULTICAST_IPV6_ADDRESS))
999 return;
1000 }
1001
1002 r = dns_packet_extract(p);
1003 if (r < 0) {
1004 log_debug_errno(r, "Failed to extract resource records from incoming packet: %m");
1005 return;
1006 }
1007
1008 if (DNS_PACKET_LLMNR_C(p)) {
1009 /* Somebody notified us about a possible conflict */
1010 dns_scope_verify_conflicts(s, p);
1011 return;
1012 }
1013
1014 assert(dns_question_size(p->question) == 1);
1015 key = dns_question_first_key(p->question);
1016
1017 r = dns_zone_lookup(&s->zone, key, 0, &answer, &soa, &tentative);
1018 if (r < 0) {
1019 log_debug_errno(r, "Failed to look up key: %m");
1020 return;
1021 }
1022 if (r == 0)
1023 return;
1024
1025 if (answer)
1026 dns_answer_order_by_scope(answer, in_addr_is_link_local(p->family, &p->sender) > 0);
1027
1028 r = dns_scope_make_reply_packet(s, DNS_PACKET_ID(p), DNS_RCODE_SUCCESS, p->question, answer, soa, tentative, &reply);
1029 if (r < 0) {
1030 log_debug_errno(r, "Failed to build reply packet: %m");
1031 return;
1032 }
1033
1034 if (stream) {
1035 r = dns_stream_write_packet(stream, reply);
1036 if (r < 0) {
1037 log_debug_errno(r, "Failed to enqueue reply packet: %m");
1038 return;
1039 }
1040
1041 /* Let's take an extra reference on this stream, so that it stays around after returning. The reference
1042 * will be dangling until the stream is disconnected, and the default completion handler of the stream
1043 * will then unref the stream and destroy it */
1044 if (DNS_STREAM_QUEUED(stream))
1045 dns_stream_ref(stream);
1046 } else {
1047 int fd;
1048
1049 if (!ratelimit_below(&s->ratelimit))
1050 return;
1051
1052 if (p->family == AF_INET)
1053 fd = manager_llmnr_ipv4_udp_fd(s->manager);
1054 else if (p->family == AF_INET6)
1055 fd = manager_llmnr_ipv6_udp_fd(s->manager);
1056 else {
1057 log_debug("Unknown protocol");
1058 return;
1059 }
1060 if (fd < 0) {
1061 log_debug_errno(fd, "Failed to get reply socket: %m");
1062 return;
1063 }
1064
1065 /* Note that we always immediately reply to all LLMNR
1066 * requests, and do not wait any time, since we
1067 * verified uniqueness for all records. Also see RFC
1068 * 4795, Section 2.7 */
1069
1070 r = manager_send(s->manager, fd, p->ifindex, p->family, &p->sender, p->sender_port, NULL, reply);
1071 if (r < 0) {
1072 log_debug_errno(r, "Failed to send reply packet: %m");
1073 return;
1074 }
1075 }
1076 }
1077
dns_scope_find_transaction(DnsScope * scope,DnsResourceKey * key,uint64_t query_flags)1078 DnsTransaction *dns_scope_find_transaction(
1079 DnsScope *scope,
1080 DnsResourceKey *key,
1081 uint64_t query_flags) {
1082
1083 DnsTransaction *first;
1084
1085 assert(scope);
1086 assert(key);
1087
1088 /* Iterate through the list of transactions with a matching key */
1089 first = hashmap_get(scope->transactions_by_key, key);
1090 LIST_FOREACH(transactions_by_key, t, first) {
1091
1092 /* These four flags must match exactly: we cannot use a validated response for a
1093 * non-validating client, and we cannot use a non-validated response for a validating
1094 * client. Similar, if the sources don't match things aren't usable either. */
1095 if (((query_flags ^ t->query_flags) &
1096 (SD_RESOLVED_NO_VALIDATE|
1097 SD_RESOLVED_NO_ZONE|
1098 SD_RESOLVED_NO_TRUST_ANCHOR|
1099 SD_RESOLVED_NO_NETWORK)) != 0)
1100 continue;
1101
1102 /* We can reuse a primary query if a regular one is requested, but not vice versa */
1103 if ((query_flags & SD_RESOLVED_REQUIRE_PRIMARY) &&
1104 !(t->query_flags & SD_RESOLVED_REQUIRE_PRIMARY))
1105 continue;
1106
1107 /* Don't reuse a transaction that allowed caching when we got told not to use it */
1108 if ((query_flags & SD_RESOLVED_NO_CACHE) &&
1109 !(t->query_flags & SD_RESOLVED_NO_CACHE))
1110 continue;
1111
1112 /* If we are asked to clamp ttls an the existing transaction doesn't do it, we can't
1113 * reuse */
1114 if ((query_flags & SD_RESOLVED_CLAMP_TTL) &&
1115 !(t->query_flags & SD_RESOLVED_CLAMP_TTL))
1116 continue;
1117
1118 return t;
1119 }
1120
1121 return NULL;
1122 }
1123
dns_scope_make_conflict_packet(DnsScope * s,DnsResourceRecord * rr,DnsPacket ** ret)1124 static int dns_scope_make_conflict_packet(
1125 DnsScope *s,
1126 DnsResourceRecord *rr,
1127 DnsPacket **ret) {
1128
1129 _cleanup_(dns_packet_unrefp) DnsPacket *p = NULL;
1130 int r;
1131
1132 assert(s);
1133 assert(rr);
1134 assert(ret);
1135
1136 r = dns_packet_new(&p, s->protocol, 0, DNS_PACKET_SIZE_MAX);
1137 if (r < 0)
1138 return r;
1139
1140 DNS_PACKET_HEADER(p)->flags = htobe16(DNS_PACKET_MAKE_FLAGS(
1141 0 /* qr */,
1142 0 /* opcode */,
1143 1 /* conflict */,
1144 0 /* tc */,
1145 0 /* t */,
1146 0 /* (ra) */,
1147 0 /* (ad) */,
1148 0 /* (cd) */,
1149 0));
1150
1151 /* For mDNS, the transaction ID should always be 0 */
1152 if (s->protocol != DNS_PROTOCOL_MDNS)
1153 random_bytes(&DNS_PACKET_HEADER(p)->id, sizeof(uint16_t));
1154
1155 DNS_PACKET_HEADER(p)->qdcount = htobe16(1);
1156 DNS_PACKET_HEADER(p)->arcount = htobe16(1);
1157
1158 r = dns_packet_append_key(p, rr->key, 0, NULL);
1159 if (r < 0)
1160 return r;
1161
1162 r = dns_packet_append_rr(p, rr, 0, NULL, NULL);
1163 if (r < 0)
1164 return r;
1165
1166 *ret = TAKE_PTR(p);
1167
1168 return 0;
1169 }
1170
on_conflict_dispatch(sd_event_source * es,usec_t usec,void * userdata)1171 static int on_conflict_dispatch(sd_event_source *es, usec_t usec, void *userdata) {
1172 DnsScope *scope = userdata;
1173 int r;
1174
1175 assert(es);
1176 assert(scope);
1177
1178 scope->conflict_event_source = sd_event_source_disable_unref(scope->conflict_event_source);
1179
1180 for (;;) {
1181 _cleanup_(dns_resource_key_unrefp) DnsResourceKey *key = NULL;
1182 _cleanup_(dns_resource_record_unrefp) DnsResourceRecord *rr = NULL;
1183 _cleanup_(dns_packet_unrefp) DnsPacket *p = NULL;
1184
1185 key = ordered_hashmap_first_key(scope->conflict_queue);
1186 if (!key)
1187 break;
1188
1189 rr = ordered_hashmap_remove(scope->conflict_queue, key);
1190 assert(rr);
1191
1192 r = dns_scope_make_conflict_packet(scope, rr, &p);
1193 if (r < 0) {
1194 log_error_errno(r, "Failed to make conflict packet: %m");
1195 return 0;
1196 }
1197
1198 r = dns_scope_emit_udp(scope, -1, AF_UNSPEC, p);
1199 if (r < 0)
1200 log_debug_errno(r, "Failed to send conflict packet: %m");
1201 }
1202
1203 return 0;
1204 }
1205
dns_scope_notify_conflict(DnsScope * scope,DnsResourceRecord * rr)1206 int dns_scope_notify_conflict(DnsScope *scope, DnsResourceRecord *rr) {
1207 usec_t jitter;
1208 int r;
1209
1210 assert(scope);
1211 assert(rr);
1212
1213 /* We don't send these queries immediately. Instead, we queue
1214 * them, and send them after some jitter delay. */
1215 r = ordered_hashmap_ensure_allocated(&scope->conflict_queue, &dns_resource_key_hash_ops);
1216 if (r < 0) {
1217 log_oom();
1218 return r;
1219 }
1220
1221 /* We only place one RR per key in the conflict
1222 * messages, not all of them. That should be enough to
1223 * indicate where there might be a conflict */
1224 r = ordered_hashmap_put(scope->conflict_queue, rr->key, rr);
1225 if (IN_SET(r, 0, -EEXIST))
1226 return 0;
1227 if (r < 0)
1228 return log_debug_errno(r, "Failed to queue conflicting RR: %m");
1229
1230 dns_resource_key_ref(rr->key);
1231 dns_resource_record_ref(rr);
1232
1233 if (scope->conflict_event_source)
1234 return 0;
1235
1236 random_bytes(&jitter, sizeof(jitter));
1237 jitter %= LLMNR_JITTER_INTERVAL_USEC;
1238
1239 r = sd_event_add_time_relative(
1240 scope->manager->event,
1241 &scope->conflict_event_source,
1242 CLOCK_BOOTTIME,
1243 jitter,
1244 LLMNR_JITTER_INTERVAL_USEC,
1245 on_conflict_dispatch, scope);
1246 if (r < 0)
1247 return log_debug_errno(r, "Failed to add conflict dispatch event: %m");
1248
1249 (void) sd_event_source_set_description(scope->conflict_event_source, "scope-conflict");
1250
1251 return 0;
1252 }
1253
dns_scope_check_conflicts(DnsScope * scope,DnsPacket * p)1254 void dns_scope_check_conflicts(DnsScope *scope, DnsPacket *p) {
1255 DnsResourceRecord *rr;
1256 int r;
1257
1258 assert(scope);
1259 assert(p);
1260
1261 if (!IN_SET(p->protocol, DNS_PROTOCOL_LLMNR, DNS_PROTOCOL_MDNS))
1262 return;
1263
1264 if (DNS_PACKET_RRCOUNT(p) <= 0)
1265 return;
1266
1267 if (p->protocol == DNS_PROTOCOL_LLMNR) {
1268 if (DNS_PACKET_LLMNR_C(p) != 0)
1269 return;
1270
1271 if (DNS_PACKET_LLMNR_T(p) != 0)
1272 return;
1273 }
1274
1275 if (manager_packet_from_local_address(scope->manager, p))
1276 return;
1277
1278 r = dns_packet_extract(p);
1279 if (r < 0) {
1280 log_debug_errno(r, "Failed to extract packet: %m");
1281 return;
1282 }
1283
1284 log_debug("Checking for conflicts...");
1285
1286 DNS_ANSWER_FOREACH(rr, p->answer) {
1287 /* No conflict if it is DNS-SD RR used for service enumeration. */
1288 if (dns_resource_key_is_dnssd_ptr(rr->key))
1289 continue;
1290
1291 /* Check for conflicts against the local zone. If we
1292 * found one, we won't check any further */
1293 r = dns_zone_check_conflicts(&scope->zone, rr);
1294 if (r != 0)
1295 continue;
1296
1297 /* Check for conflicts against the local cache. If so,
1298 * send out an advisory query, to inform everybody */
1299 r = dns_cache_check_conflicts(&scope->cache, rr, p->family, &p->sender);
1300 if (r <= 0)
1301 continue;
1302
1303 dns_scope_notify_conflict(scope, rr);
1304 }
1305 }
1306
dns_scope_dump(DnsScope * s,FILE * f)1307 void dns_scope_dump(DnsScope *s, FILE *f) {
1308 assert(s);
1309
1310 if (!f)
1311 f = stdout;
1312
1313 fputs("[Scope protocol=", f);
1314 fputs(dns_protocol_to_string(s->protocol), f);
1315
1316 if (s->link) {
1317 fputs(" interface=", f);
1318 fputs(s->link->ifname, f);
1319 }
1320
1321 if (s->family != AF_UNSPEC) {
1322 fputs(" family=", f);
1323 fputs(af_to_name(s->family), f);
1324 }
1325
1326 fputs("]\n", f);
1327
1328 if (!dns_zone_is_empty(&s->zone)) {
1329 fputs("ZONE:\n", f);
1330 dns_zone_dump(&s->zone, f);
1331 }
1332
1333 if (!dns_cache_is_empty(&s->cache)) {
1334 fputs("CACHE:\n", f);
1335 dns_cache_dump(&s->cache, f);
1336 }
1337 }
1338
dns_scope_get_search_domains(DnsScope * s)1339 DnsSearchDomain *dns_scope_get_search_domains(DnsScope *s) {
1340 assert(s);
1341
1342 if (s->protocol != DNS_PROTOCOL_DNS)
1343 return NULL;
1344
1345 if (s->link)
1346 return s->link->search_domains;
1347
1348 return s->manager->search_domains;
1349 }
1350
dns_scope_name_wants_search_domain(DnsScope * s,const char * name)1351 bool dns_scope_name_wants_search_domain(DnsScope *s, const char *name) {
1352 assert(s);
1353
1354 if (s->protocol != DNS_PROTOCOL_DNS)
1355 return false;
1356
1357 return dns_name_is_single_label(name);
1358 }
1359
dns_scope_network_good(DnsScope * s)1360 bool dns_scope_network_good(DnsScope *s) {
1361 /* Checks whether the network is in good state for lookups on this scope. For mDNS/LLMNR/Classic DNS scopes
1362 * bound to links this is easy, as they don't even exist if the link isn't in a suitable state. For the global
1363 * DNS scope we check whether there are any links that are up and have an address.
1364 *
1365 * Note that Linux routing is complex and even systems that superficially have no IPv4 address might
1366 * be able to route IPv4 (and similar for IPv6), hence let's make a check here independent of address
1367 * family. */
1368
1369 if (s->link)
1370 return true;
1371
1372 return manager_routable(s->manager);
1373 }
1374
dns_scope_ifindex(DnsScope * s)1375 int dns_scope_ifindex(DnsScope *s) {
1376 assert(s);
1377
1378 if (s->link)
1379 return s->link->ifindex;
1380
1381 return 0;
1382 }
1383
on_announcement_timeout(sd_event_source * s,usec_t usec,void * userdata)1384 static int on_announcement_timeout(sd_event_source *s, usec_t usec, void *userdata) {
1385 DnsScope *scope = userdata;
1386
1387 assert(s);
1388
1389 scope->announce_event_source = sd_event_source_disable_unref(scope->announce_event_source);
1390
1391 (void) dns_scope_announce(scope, false);
1392 return 0;
1393 }
1394
dns_scope_announce(DnsScope * scope,bool goodbye)1395 int dns_scope_announce(DnsScope *scope, bool goodbye) {
1396 _cleanup_(dns_answer_unrefp) DnsAnswer *answer = NULL;
1397 _cleanup_(dns_packet_unrefp) DnsPacket *p = NULL;
1398 _cleanup_set_free_ Set *types = NULL;
1399 DnsZoneItem *z;
1400 unsigned size = 0;
1401 char *service_type;
1402 int r;
1403
1404 if (!scope)
1405 return 0;
1406
1407 if (scope->protocol != DNS_PROTOCOL_MDNS)
1408 return 0;
1409
1410 /* Check if we're done with probing. */
1411 LIST_FOREACH(transactions_by_scope, t, scope->transactions)
1412 if (DNS_TRANSACTION_IS_LIVE(t->state))
1413 return 0;
1414
1415 /* Check if there're services pending conflict resolution. */
1416 if (manager_next_dnssd_names(scope->manager))
1417 return 0; /* we reach this point only if changing hostname didn't help */
1418
1419 /* Calculate answer's size. */
1420 HASHMAP_FOREACH(z, scope->zone.by_key) {
1421 if (z->state != DNS_ZONE_ITEM_ESTABLISHED)
1422 continue;
1423
1424 if (z->rr->key->type == DNS_TYPE_PTR &&
1425 !dns_zone_contains_name(&scope->zone, z->rr->ptr.name)) {
1426 char key_str[DNS_RESOURCE_KEY_STRING_MAX];
1427
1428 log_debug("Skip PTR RR <%s> since its counterparts seem to be withdrawn", dns_resource_key_to_string(z->rr->key, key_str, sizeof key_str));
1429 z->state = DNS_ZONE_ITEM_WITHDRAWN;
1430 continue;
1431 }
1432
1433 /* Collect service types for _services._dns-sd._udp.local RRs in a set */
1434 if (!scope->announced &&
1435 dns_resource_key_is_dnssd_ptr(z->rr->key)) {
1436 if (!set_contains(types, dns_resource_key_name(z->rr->key))) {
1437 r = set_ensure_put(&types, &dns_name_hash_ops, dns_resource_key_name(z->rr->key));
1438 if (r < 0)
1439 return log_debug_errno(r, "Failed to add item to set: %m");
1440 }
1441 }
1442
1443 LIST_FOREACH(by_key, i, z)
1444 size++;
1445 }
1446
1447 answer = dns_answer_new(size + set_size(types));
1448 if (!answer)
1449 return log_oom();
1450
1451 /* Second iteration, actually add RRs to the answer. */
1452 HASHMAP_FOREACH(z, scope->zone.by_key)
1453 LIST_FOREACH (by_key, i, z) {
1454 DnsAnswerFlags flags;
1455
1456 if (i->state != DNS_ZONE_ITEM_ESTABLISHED)
1457 continue;
1458
1459 if (dns_resource_key_is_dnssd_ptr(i->rr->key))
1460 flags = goodbye ? DNS_ANSWER_GOODBYE : 0;
1461 else
1462 flags = goodbye ? (DNS_ANSWER_GOODBYE|DNS_ANSWER_CACHE_FLUSH) : DNS_ANSWER_CACHE_FLUSH;
1463
1464 r = dns_answer_add(answer, i->rr, 0, flags, NULL);
1465 if (r < 0)
1466 return log_debug_errno(r, "Failed to add RR to announce: %m");
1467 }
1468
1469 /* Since all the active services are in the zone make them discoverable now. */
1470 SET_FOREACH(service_type, types) {
1471 _cleanup_(dns_resource_record_unrefp) DnsResourceRecord *rr = NULL;
1472
1473 rr = dns_resource_record_new_full(DNS_CLASS_IN, DNS_TYPE_PTR,
1474 "_services._dns-sd._udp.local");
1475 if (!rr)
1476 return log_oom();
1477
1478 rr->ptr.name = strdup(service_type);
1479 if (!rr->ptr.name)
1480 return log_oom();
1481
1482 rr->ttl = MDNS_DEFAULT_TTL;
1483
1484 r = dns_zone_put(&scope->zone, scope, rr, false);
1485 if (r < 0)
1486 log_warning_errno(r, "Failed to add DNS-SD PTR record to MDNS zone, ignoring: %m");
1487
1488 r = dns_answer_add(answer, rr, 0, 0, NULL);
1489 if (r < 0)
1490 return log_debug_errno(r, "Failed to add RR to announce: %m");
1491 }
1492
1493 if (dns_answer_isempty(answer))
1494 return 0;
1495
1496 r = dns_scope_make_reply_packet(scope, 0, DNS_RCODE_SUCCESS, NULL, answer, NULL, false, &p);
1497 if (r < 0)
1498 return log_debug_errno(r, "Failed to build reply packet: %m");
1499
1500 r = dns_scope_emit_udp(scope, -1, AF_UNSPEC, p);
1501 if (r < 0)
1502 return log_debug_errno(r, "Failed to send reply packet: %m");
1503
1504 /* In section 8.3 of RFC6762: "The Multicast DNS responder MUST send at least two unsolicited
1505 * responses, one second apart." */
1506 if (!scope->announced) {
1507 scope->announced = true;
1508
1509 r = sd_event_add_time_relative(
1510 scope->manager->event,
1511 &scope->announce_event_source,
1512 CLOCK_BOOTTIME,
1513 MDNS_ANNOUNCE_DELAY,
1514 MDNS_JITTER_RANGE_USEC,
1515 on_announcement_timeout, scope);
1516 if (r < 0)
1517 return log_debug_errno(r, "Failed to schedule second announcement: %m");
1518
1519 (void) sd_event_source_set_description(scope->announce_event_source, "mdns-announce");
1520 }
1521
1522 return 0;
1523 }
1524
dns_scope_add_dnssd_services(DnsScope * scope)1525 int dns_scope_add_dnssd_services(DnsScope *scope) {
1526 DnssdService *service;
1527 int r;
1528
1529 assert(scope);
1530
1531 if (hashmap_size(scope->manager->dnssd_services) == 0)
1532 return 0;
1533
1534 scope->announced = false;
1535
1536 HASHMAP_FOREACH(service, scope->manager->dnssd_services) {
1537 service->withdrawn = false;
1538
1539 r = dns_zone_put(&scope->zone, scope, service->ptr_rr, false);
1540 if (r < 0)
1541 log_warning_errno(r, "Failed to add PTR record to MDNS zone: %m");
1542
1543 r = dns_zone_put(&scope->zone, scope, service->srv_rr, true);
1544 if (r < 0)
1545 log_warning_errno(r, "Failed to add SRV record to MDNS zone: %m");
1546
1547 LIST_FOREACH(items, txt_data, service->txt_data_items) {
1548 r = dns_zone_put(&scope->zone, scope, txt_data->rr, true);
1549 if (r < 0)
1550 log_warning_errno(r, "Failed to add TXT record to MDNS zone: %m");
1551 }
1552 }
1553
1554 return 0;
1555 }
1556
dns_scope_remove_dnssd_services(DnsScope * scope)1557 int dns_scope_remove_dnssd_services(DnsScope *scope) {
1558 _cleanup_(dns_resource_key_unrefp) DnsResourceKey *key = NULL;
1559 DnssdService *service;
1560 int r;
1561
1562 assert(scope);
1563
1564 key = dns_resource_key_new(DNS_CLASS_IN, DNS_TYPE_PTR,
1565 "_services._dns-sd._udp.local");
1566 if (!key)
1567 return log_oom();
1568
1569 r = dns_zone_remove_rrs_by_key(&scope->zone, key);
1570 if (r < 0)
1571 return r;
1572
1573 HASHMAP_FOREACH(service, scope->manager->dnssd_services) {
1574 dns_zone_remove_rr(&scope->zone, service->ptr_rr);
1575 dns_zone_remove_rr(&scope->zone, service->srv_rr);
1576 LIST_FOREACH(items, txt_data, service->txt_data_items)
1577 dns_zone_remove_rr(&scope->zone, txt_data->rr);
1578 }
1579
1580 return 0;
1581 }
1582
dns_scope_has_route_only_domains(DnsScope * scope)1583 static bool dns_scope_has_route_only_domains(DnsScope *scope) {
1584 DnsSearchDomain *first;
1585 bool route_only = false;
1586
1587 assert(scope);
1588 assert(scope->protocol == DNS_PROTOCOL_DNS);
1589
1590 /* Returns 'true' if this scope is suitable for queries to specific domains only. For that we check
1591 * if there are any route-only domains on this interface, as a heuristic to discern VPN-style links
1592 * from non-VPN-style links. Returns 'false' for all other cases, i.e. if the scope is intended to
1593 * take queries to arbitrary domains, i.e. has no routing domains set. */
1594
1595 if (scope->link)
1596 first = scope->link->search_domains;
1597 else
1598 first = scope->manager->search_domains;
1599
1600 LIST_FOREACH(domains, domain, first) {
1601 /* "." means "any domain", thus the interface takes any kind of traffic. Thus, we exit early
1602 * here, as it doesn't really matter whether this link has any route-only domains or not,
1603 * "~." really trumps everything and clearly indicates that this interface shall receive all
1604 * traffic it can get. */
1605 if (dns_name_is_root(DNS_SEARCH_DOMAIN_NAME(domain)))
1606 return false;
1607
1608 if (domain->route_only)
1609 route_only = true;
1610 }
1611
1612 return route_only;
1613 }
1614
dns_scope_is_default_route(DnsScope * scope)1615 bool dns_scope_is_default_route(DnsScope *scope) {
1616 assert(scope);
1617
1618 /* Only use DNS scopes as default routes */
1619 if (scope->protocol != DNS_PROTOCOL_DNS)
1620 return false;
1621
1622 /* The global DNS scope is always suitable as default route */
1623 if (!scope->link)
1624 return true;
1625
1626 /* Honour whatever is explicitly configured. This is really the best approach, and trumps any
1627 * automatic logic. */
1628 if (scope->link->default_route >= 0)
1629 return scope->link->default_route;
1630
1631 /* Otherwise check if we have any route-only domains, as a sensible heuristic: if so, let's not
1632 * volunteer as default route. */
1633 return !dns_scope_has_route_only_domains(scope);
1634 }
1635