[thirdparty/systemd.git] / src / resolve / resolved-mdns.c

/* SPDX-License-Identifier: LGPL-2.1-or-later */

#include <resolv.h>
#include <netinet/in.h>
#include <arpa/inet.h>

#include "alloc-util.h"
#include "fd-util.h"
#include "resolved-manager.h"
#include "resolved-mdns.h"
#include "sort-util.h"

#define CLEAR_CACHE_FLUSH(x) (~MDNS_RR_CACHE_FLUSH & (x))

void manager_mdns_stop(Manager *m) {
        assert(m);

        m->mdns_ipv4_event_source = sd_event_source_disable_unref(m->mdns_ipv4_event_source);
        m->mdns_ipv4_fd = safe_close(m->mdns_ipv4_fd);

        m->mdns_ipv6_event_source = sd_event_source_disable_unref(m->mdns_ipv6_event_source);
        m->mdns_ipv6_fd = safe_close(m->mdns_ipv6_fd);
}

int manager_mdns_start(Manager *m) {
        int r;

        assert(m);

        if (m->mdns_support == RESOLVE_SUPPORT_NO)
                return 0;

        r = manager_mdns_ipv4_fd(m);
        if (r == -EADDRINUSE)
                goto eaddrinuse;
        if (r < 0)
                return r;

        if (socket_ipv6_is_supported()) {
                r = manager_mdns_ipv6_fd(m);
                if (r == -EADDRINUSE)
                        goto eaddrinuse;
                if (r < 0)
                        return r;
        }

        return 0;

eaddrinuse:
        log_warning("Another mDNS responder prohibits binding the socket to the same port. Turning off mDNS support.");
        m->mdns_support = RESOLVE_SUPPORT_NO;
        manager_mdns_stop(m);

        return 0;
}

static int mdns_rr_compare(DnsResourceRecord * const *a, DnsResourceRecord * const *b) {
        DnsResourceRecord *x = *(DnsResourceRecord **) a, *y = *(DnsResourceRecord **) b;
        size_t m;
        int r;

        assert(x);
        assert(y);

        r = CMP(CLEAR_CACHE_FLUSH(x->key->class), CLEAR_CACHE_FLUSH(y->key->class));
        if (r != 0)
                return r;

        r = CMP(x->key->type, y->key->type);
        if (r != 0)
                return r;

        r = dns_resource_record_to_wire_format(x, false);
        if (r < 0) {
                log_warning_errno(r, "Can't wire-format RR: %m");
                return 0;
        }

        r = dns_resource_record_to_wire_format(y, false);
        if (r < 0) {
                log_warning_errno(r, "Can't wire-format RR: %m");
                return 0;
        }

        m = MIN(DNS_RESOURCE_RECORD_RDATA_SIZE(x), DNS_RESOURCE_RECORD_RDATA_SIZE(y));

        r = memcmp(DNS_RESOURCE_RECORD_RDATA(x), DNS_RESOURCE_RECORD_RDATA(y), m);
        if (r != 0)
                return r;

        return CMP(DNS_RESOURCE_RECORD_RDATA_SIZE(x), DNS_RESOURCE_RECORD_RDATA_SIZE(y));
}

static int proposed_rrs_cmp(DnsResourceRecord **x, unsigned x_size, DnsResourceRecord **y, unsigned y_size) {
        unsigned m;
        int r;

        m = MIN(x_size, y_size);
        for (unsigned i = 0; i < m; i++) {
                r = mdns_rr_compare(&x[i], &y[i]);
                if (r != 0)
                        return r;
        }

        return CMP(x_size, y_size);
}

static int mdns_packet_extract_matching_rrs(DnsPacket *p, DnsResourceKey *key, DnsResourceRecord ***ret_rrs) {
        _cleanup_free_ DnsResourceRecord **list = NULL;
        unsigned n = 0, size = 0;
        int r;

        assert(p);
        assert(key);
        assert(ret_rrs);
        assert_return(DNS_PACKET_NSCOUNT(p) > 0, -EINVAL);

        for (size_t i = DNS_PACKET_ANCOUNT(p); i < (DNS_PACKET_ANCOUNT(p) + DNS_PACKET_NSCOUNT(p)); i++) {
                r = dns_resource_key_match_rr(key, p->answer->items[i].rr, NULL);
                if (r < 0)
                        return r;
                if (r > 0)
                        size++;
        }

        if (size == 0)
                return 0;

        list = new(DnsResourceRecord *, size);
        if (!list)
                return -ENOMEM;

        for (size_t i = DNS_PACKET_ANCOUNT(p); i < (DNS_PACKET_ANCOUNT(p) + DNS_PACKET_NSCOUNT(p)); i++) {
                r = dns_resource_key_match_rr(key, p->answer->items[i].rr, NULL);
                if (r < 0)
                        return r;
                if (r > 0)
                        list[n++] = p->answer->items[i].rr;
        }
        assert(n == size);
        typesafe_qsort(list, size, mdns_rr_compare);

        *ret_rrs = TAKE_PTR(list);

        return size;
}

static int mdns_do_tiebreak(DnsResourceKey *key, DnsAnswer *answer, DnsPacket *p) {
        _cleanup_free_ DnsResourceRecord **our = NULL, **remote = NULL;
        DnsResourceRecord *rr;
        size_t i = 0, size;
        int r;

        size = dns_answer_size(answer);
        our = new(DnsResourceRecord *, size);
        if (!our)
                return -ENOMEM;

        DNS_ANSWER_FOREACH(rr, answer)
                our[i++] = rr;

        typesafe_qsort(our, size, mdns_rr_compare);

        r = mdns_packet_extract_matching_rrs(p, key, &remote);
        if (r < 0)
                return r;

        assert(r > 0);

        if (proposed_rrs_cmp(remote, r, our, size) > 0)
                return 1;

        return 0;
}

static int mdns_scope_process_query(DnsScope *s, DnsPacket *p) {
        _cleanup_(dns_answer_unrefp) DnsAnswer *full_answer = NULL;
        _cleanup_(dns_packet_unrefp) DnsPacket *reply = NULL;
        DnsResourceKey *key = NULL;
        DnsResourceRecord *rr;
        bool tentative = false;
        int r;

        assert(s);
        assert(p);

        r = dns_packet_extract(p);
        if (r < 0)
                return log_debug_errno(r, "Failed to extract resource records from incoming packet: %m");

        assert_return((dns_question_size(p->question) > 0), -EINVAL);

        DNS_QUESTION_FOREACH(key, p->question) {
                _cleanup_(dns_answer_unrefp) DnsAnswer *answer = NULL, *soa = NULL;

                r = dns_zone_lookup(&s->zone, key, 0, &answer, &soa, &tentative);
                if (r < 0)
                        return log_debug_errno(r, "Failed to look up key: %m");

                if (tentative && DNS_PACKET_NSCOUNT(p) > 0) {
                        /*
                         * A race condition detected with the probe packet from
                         * a remote host.
                         * Do simultaneous probe tiebreaking as described in
                         * RFC 6762, Section 8.2. In case we lost don't reply
                         * the question and withdraw conflicting RRs.
                         */
                        r = mdns_do_tiebreak(key, answer, p);
                        if (r < 0)
                                return log_debug_errno(r, "Failed to do tiebreaking");

                        if (r > 0) { /* we lost */
                                DNS_ANSWER_FOREACH(rr, answer) {
                                        DnsZoneItem *i;

                                        i = dns_zone_get(&s->zone, rr);
                                        if (i)
                                                dns_zone_item_conflict(i);
                                }

                                continue;
                        }
                }

                r = dns_answer_extend(&full_answer, answer);
                if (r < 0)
                        return log_debug_errno(r, "Failed to extend answer: %m");
        }

        if (dns_answer_isempty(full_answer))
                return 0;

        r = dns_scope_make_reply_packet(s, DNS_PACKET_ID(p), DNS_RCODE_SUCCESS, NULL, full_answer, NULL, false, &reply);
        if (r < 0)
                return log_debug_errno(r, "Failed to build reply packet: %m");

        if (!ratelimit_below(&s->ratelimit))
                return 0;

        r = dns_scope_emit_udp(s, -1, AF_UNSPEC, reply);
        if (r < 0)
                return log_debug_errno(r, "Failed to send reply packet: %m");

        return 0;
}

static int on_mdns_packet(sd_event_source *s, int fd, uint32_t revents, void *userdata) {
        _cleanup_(dns_packet_unrefp) DnsPacket *p = NULL;
        Manager *m = userdata;
        DnsScope *scope;
        int r;

        r = manager_recv(m, fd, DNS_PROTOCOL_MDNS, &p);
        if (r <= 0)
                return r;

        if (manager_packet_from_local_address(m, p))
                return 0;

        scope = manager_find_scope(m, p);
        if (!scope) {
                log_debug("Got mDNS UDP packet on unknown scope. Ignoring.");
                return 0;
        }

        if (dns_packet_validate_reply(p) > 0) {
                DnsResourceRecord *rr;

                log_debug("Got mDNS reply packet");

                /*
                 * mDNS is different from regular DNS and LLMNR with regard to handling responses.
                 * While on other protocols, we can ignore every answer that doesn't match a question
                 * we broadcast earlier, RFC6762, section 18.1 recommends looking at and caching all
                 * incoming information, regardless of the DNS packet ID.
                 *
                 * Hence, extract the packet here, and try to find a transaction for answer the we got
                 * and complete it. Also store the new information in scope's cache.
                 */
                r = dns_packet_extract(p);
                if (r < 0) {
                        log_debug("mDNS packet extraction failed.");
                        return 0;
                }

                dns_scope_check_conflicts(scope, p);

                DNS_ANSWER_FOREACH(rr, p->answer) {
                        const char *name = dns_resource_key_name(rr->key);
                        DnsTransaction *t;

                        /* If the received reply packet contains ANY record that is not .local
                         * or .in-addr.arpa or .ip6.arpa, we assume someone's playing tricks on
                         * us and discard the packet completely. */
                        if (!(dns_name_endswith(name, "in-addr.arpa") > 0 ||
                              dns_name_endswith(name, "ip6.arpa") > 0 ||
                              dns_name_endswith(name, "local") > 0))
                                return 0;

                        if (rr->ttl == 0) {
                                log_debug("Got a goodbye packet");
                                /* See the section 10.1 of RFC6762 */
                                rr->ttl = 1;
                        }

                        t = dns_scope_find_transaction(scope, rr->key, SD_RESOLVED_NO_CACHE|SD_RESOLVED_NO_ZONE);
                        if (t)
                                dns_transaction_process_reply(t, p, false);

                        /* Also look for the various types of ANY transactions */
                        t = dns_scope_find_transaction(scope, &DNS_RESOURCE_KEY_CONST(rr->key->class, DNS_TYPE_ANY, dns_resource_key_name(rr->key)), SD_RESOLVED_NO_CACHE|SD_RESOLVED_NO_ZONE);
                        if (t)
                                dns_transaction_process_reply(t, p, false);

                        t = dns_scope_find_transaction(scope, &DNS_RESOURCE_KEY_CONST(DNS_CLASS_ANY, rr->key->type, dns_resource_key_name(rr->key)), SD_RESOLVED_NO_CACHE|SD_RESOLVED_NO_ZONE);
                        if (t)
                                dns_transaction_process_reply(t, p, false);

                        t = dns_scope_find_transaction(scope, &DNS_RESOURCE_KEY_CONST(DNS_CLASS_ANY, DNS_TYPE_ANY, dns_resource_key_name(rr->key)), SD_RESOLVED_NO_CACHE|SD_RESOLVED_NO_ZONE);
                        if (t)
                                dns_transaction_process_reply(t, p, false);
                }

                dns_cache_put(&scope->cache, scope->manager->enable_cache, NULL, DNS_PACKET_RCODE(p), p->answer, NULL, false, _DNSSEC_RESULT_INVALID, UINT32_MAX, p->family, &p->sender);

        } else if (dns_packet_validate_query(p) > 0)  {
                log_debug("Got mDNS query packet for id %u", DNS_PACKET_ID(p));

                r = mdns_scope_process_query(scope, p);
                if (r < 0) {
                        log_debug_errno(r, "mDNS query processing failed: %m");
                        return 0;
                }
        } else
                log_debug("Invalid mDNS UDP packet.");

        return 0;
}

int manager_mdns_ipv4_fd(Manager *m) {
        union sockaddr_union sa = {
                .in.sin_family = AF_INET,
                .in.sin_port = htobe16(MDNS_PORT),
        };
        _cleanup_close_ int s = -1;
        int r;

        assert(m);

        if (m->mdns_ipv4_fd >= 0)
                return m->mdns_ipv4_fd;

        s = socket(AF_INET, SOCK_DGRAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0);
        if (s < 0)
                return log_error_errno(errno, "mDNS-IPv4: Failed to create socket: %m");

        r = setsockopt_int(s, IPPROTO_IP, IP_TTL, 255);
        if (r < 0)
                return log_error_errno(r, "mDNS-IPv4: Failed to set IP_TTL: %m");

        r = setsockopt_int(s, IPPROTO_IP, IP_MULTICAST_TTL, 255);
        if (r < 0)
                return log_error_errno(r, "mDNS-IPv4: Failed to set IP_MULTICAST_TTL: %m");

        r = setsockopt_int(s, IPPROTO_IP, IP_MULTICAST_LOOP, true);
        if (r < 0)
                return log_error_errno(r, "mDNS-IPv4: Failed to set IP_MULTICAST_LOOP: %m");

        r = setsockopt_int(s, IPPROTO_IP, IP_PKTINFO, true);
        if (r < 0)
                return log_error_errno(r, "mDNS-IPv4: Failed to set IP_PKTINFO: %m");

        r = setsockopt_int(s, IPPROTO_IP, IP_RECVTTL, true);
        if (r < 0)
                return log_error_errno(r, "mDNS-IPv4: Failed to set IP_RECVTTL: %m");

        /* Disable Don't-Fragment bit in the IP header */
        r = setsockopt_int(s, IPPROTO_IP, IP_MTU_DISCOVER, IP_PMTUDISC_DONT);
        if (r < 0)
                return log_error_errno(r, "mDNS-IPv4: Failed to set IP_MTU_DISCOVER: %m");

        /* See the section 15.1 of RFC6762 */
        /* first try to bind without SO_REUSEADDR to detect another mDNS responder */
        r = bind(s, &sa.sa, sizeof(sa.in));
        if (r < 0) {
                if (errno != EADDRINUSE)
                        return log_error_errno(errno, "mDNS-IPv4: Failed to bind socket: %m");

                log_warning("mDNS-IPv4: There appears to be another mDNS responder running, or previously systemd-resolved crashed with some outstanding transfers.");

                /* try again with SO_REUSEADDR */
                r = setsockopt_int(s, SOL_SOCKET, SO_REUSEADDR, true);
                if (r < 0)
                        return log_error_errno(r, "mDNS-IPv4: Failed to set SO_REUSEADDR: %m");

                r = bind(s, &sa.sa, sizeof(sa.in));
                if (r < 0)
                        return log_error_errno(errno, "mDNS-IPv4: Failed to bind socket: %m");
        } else {
                /* enable SO_REUSEADDR for the case that the user really wants multiple mDNS responders */
                r = setsockopt_int(s, SOL_SOCKET, SO_REUSEADDR, true);
                if (r < 0)
                        return log_error_errno(r, "mDNS-IPv4: Failed to set SO_REUSEADDR: %m");
        }

        r = sd_event_add_io(m->event, &m->mdns_ipv4_event_source, s, EPOLLIN, on_mdns_packet, m);
        if (r < 0)
                return log_error_errno(r, "mDNS-IPv4: Failed to create event source: %m");

        return m->mdns_ipv4_fd = TAKE_FD(s);
}

int manager_mdns_ipv6_fd(Manager *m) {
        union sockaddr_union sa = {
                .in6.sin6_family = AF_INET6,
                .in6.sin6_port = htobe16(MDNS_PORT),
        };
        _cleanup_close_ int s = -1;
        int r;

        assert(m);

        if (m->mdns_ipv6_fd >= 0)
                return m->mdns_ipv6_fd;

        s = socket(AF_INET6, SOCK_DGRAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0);
        if (s < 0)
                return log_error_errno(errno, "mDNS-IPv6: Failed to create socket: %m");

        r = setsockopt_int(s, IPPROTO_IPV6, IPV6_UNICAST_HOPS, 255);
        if (r < 0)
                return log_error_errno(r, "mDNS-IPv6: Failed to set IPV6_UNICAST_HOPS: %m");

        /* RFC 4795, section 2.5 recommends setting the TTL of UDP packets to 255. */
        r = setsockopt_int(s, IPPROTO_IPV6, IPV6_MULTICAST_HOPS, 255);
        if (r < 0)
                return log_error_errno(r, "mDNS-IPv6: Failed to set IPV6_MULTICAST_HOPS: %m");

        r = setsockopt_int(s, IPPROTO_IPV6, IPV6_MULTICAST_LOOP, true);
        if (r < 0)
                return log_error_errno(r, "mDNS-IPv6: Failed to set IPV6_MULTICAST_LOOP: %m");

        r = setsockopt_int(s, IPPROTO_IPV6, IPV6_V6ONLY, true);
        if (r < 0)
                return log_error_errno(r, "mDNS-IPv6: Failed to set IPV6_V6ONLY: %m");

        r = setsockopt_int(s, IPPROTO_IPV6, IPV6_RECVPKTINFO, true);
        if (r < 0)
                return log_error_errno(r, "mDNS-IPv6: Failed to set IPV6_RECVPKTINFO: %m");

        r = setsockopt_int(s, IPPROTO_IPV6, IPV6_RECVHOPLIMIT, true);
        if (r < 0)
                return log_error_errno(r, "mDNS-IPv6: Failed to set IPV6_RECVHOPLIMIT: %m");

        /* See the section 15.1 of RFC6762 */
        /* first try to bind without SO_REUSEADDR to detect another mDNS responder */
        r = bind(s, &sa.sa, sizeof(sa.in6));
        if (r < 0) {
                if (errno != EADDRINUSE)
                        return log_error_errno(errno, "mDNS-IPv6: Failed to bind socket: %m");

                log_warning("mDNS-IPv6: There appears to be another mDNS responder running, or previously systemd-resolved crashed with some outstanding transfers.");

                /* try again with SO_REUSEADDR */
                r = setsockopt_int(s, SOL_SOCKET, SO_REUSEADDR, true);
                if (r < 0)
                        return log_error_errno(r, "mDNS-IPv6: Failed to set SO_REUSEADDR: %m");

                r = bind(s, &sa.sa, sizeof(sa.in6));
                if (r < 0)
                        return log_error_errno(errno, "mDNS-IPv6: Failed to bind socket: %m");
        } else {
                /* enable SO_REUSEADDR for the case that the user really wants multiple mDNS responders */
                r = setsockopt_int(s, SOL_SOCKET, SO_REUSEADDR, true);
                if (r < 0)
                        return log_error_errno(r, "mDNS-IPv6: Failed to set SO_REUSEADDR: %m");
        }

        r = sd_event_add_io(m->event, &m->mdns_ipv6_event_source, s, EPOLLIN, on_mdns_packet, m);
        if (r < 0)
                return log_error_errno(r, "mDNS-IPv6: Failed to create event source: %m");

        return m->mdns_ipv6_fd = TAKE_FD(s);
}
Commit	Line	Data
db9ecf05	1	/* SPDX-License-Identifier: LGPL-2.1-or-later */
bc7702b0 DM	2
	3	#include <resolv.h>
	4	#include <netinet/in.h>
	5	#include <arpa/inet.h>
	6
8d67e72c	7	#include "alloc-util.h"
bc7702b0 DM	8	#include "fd-util.h"
	9	#include "resolved-manager.h"
	10	#include "resolved-mdns.h"
760877e9	11	#include "sort-util.h"
bc7702b0	12
8d67e72c DR	13	#define CLEAR_CACHE_FLUSH(x) (~MDNS_RR_CACHE_FLUSH & (x))
8d67e72c DR	14
bc7702b0 DM	15	void manager_mdns_stop(Manager *m) {
	16	assert(m);
	17
97935302	18	m->mdns_ipv4_event_source = sd_event_source_disable_unref(m->mdns_ipv4_event_source);
bc7702b0 DM	19	m->mdns_ipv4_fd = safe_close(m->mdns_ipv4_fd);
bc7702b0 DM	20
97935302	21	m->mdns_ipv6_event_source = sd_event_source_disable_unref(m->mdns_ipv6_event_source);
bc7702b0 DM	22	m->mdns_ipv6_fd = safe_close(m->mdns_ipv6_fd);
	23	}
	24
	25	int manager_mdns_start(Manager *m) {
	26	int r;
	27
	28	assert(m);
	29
af49ca27	30	if (m->mdns_support == RESOLVE_SUPPORT_NO)
bc7702b0 DM	31	return 0;
	32
	33	r = manager_mdns_ipv4_fd(m);
	34	if (r == -EADDRINUSE)
	35	goto eaddrinuse;
	36	if (r < 0)
	37	return r;
	38
	39	if (socket_ipv6_is_supported()) {
	40	r = manager_mdns_ipv6_fd(m);
	41	if (r == -EADDRINUSE)
	42	goto eaddrinuse;
	43	if (r < 0)
	44	return r;
	45	}
	46
	47	return 0;
	48
	49	eaddrinuse:
71a047d2	50	log_warning("Another mDNS responder prohibits binding the socket to the same port. Turning off mDNS support.");
af49ca27	51	m->mdns_support = RESOLVE_SUPPORT_NO;
bc7702b0 DM	52	manager_mdns_stop(m);
	53
	54	return 0;
	55	}
	56
93bab288 YW	57	static int mdns_rr_compare(DnsResourceRecord * const a, DnsResourceRecord const *b) {
93bab288 YW	58	DnsResourceRecord x = (DnsResourceRecord *) a, y = (DnsResourceRecord *) b;
8d67e72c DR	59	size_t m;
	60	int r;
	61
	62	assert(x);
8d67e72c	63	assert(y);
8d67e72c	64
93bab288 YW	65	r = CMP(CLEAR_CACHE_FLUSH(x->key->class), CLEAR_CACHE_FLUSH(y->key->class));
	66	if (r != 0)
	67	return r;
8d67e72c	68
93bab288 YW	69	r = CMP(x->key->type, y->key->type);
	70	if (r != 0)
	71	return r;
8d67e72c	72
93bab288	73	r = dns_resource_record_to_wire_format(x, false);
8d67e72c DR	74	if (r < 0) {
	75	log_warning_errno(r, "Can't wire-format RR: %m");
	76	return 0;
	77	}
	78
93bab288	79	r = dns_resource_record_to_wire_format(y, false);
8d67e72c DR	80	if (r < 0) {
	81	log_warning_errno(r, "Can't wire-format RR: %m");
	82	return 0;
	83	}
	84
93bab288	85	m = MIN(DNS_RESOURCE_RECORD_RDATA_SIZE(x), DNS_RESOURCE_RECORD_RDATA_SIZE(y));
8d67e72c	86
93bab288	87	r = memcmp(DNS_RESOURCE_RECORD_RDATA(x), DNS_RESOURCE_RECORD_RDATA(y), m);
8d67e72c DR	88	if (r != 0)
	89	return r;
	90
93bab288	91	return CMP(DNS_RESOURCE_RECORD_RDATA_SIZE(x), DNS_RESOURCE_RECORD_RDATA_SIZE(y));
8d67e72c DR	92	}
	93
	94	static int proposed_rrs_cmp(DnsResourceRecord x, unsigned x_size, DnsResourceRecord y, unsigned y_size) {
	95	unsigned m;
	96	int r;
	97
	98	m = MIN(x_size, y_size);
	99	for (unsigned i = 0; i < m; i++) {
	100	r = mdns_rr_compare(&x[i], &y[i]);
	101	if (r != 0)
	102	return r;
	103	}
	104
6dd91b36	105	return CMP(x_size, y_size);
8d67e72c DR	106	}
	107
	108	static int mdns_packet_extract_matching_rrs(DnsPacket p, DnsResourceKey key, DnsResourceRecord ***ret_rrs) {
	109	_cleanup_free_ DnsResourceRecord **list = NULL;
	110	unsigned n = 0, size = 0;
	111	int r;
	112
	113	assert(p);
	114	assert(key);
	115	assert(ret_rrs);
	116	assert_return(DNS_PACKET_NSCOUNT(p) > 0, -EINVAL);
	117
da6053d0	118	for (size_t i = DNS_PACKET_ANCOUNT(p); i < (DNS_PACKET_ANCOUNT(p) + DNS_PACKET_NSCOUNT(p)); i++) {
8d67e72c DR	119	r = dns_resource_key_match_rr(key, p->answer->items[i].rr, NULL);
	120	if (r < 0)
	121	return r;
	122	if (r > 0)
	123	size++;
	124	}
	125
	126	if (size == 0)
	127	return 0;
	128
	129	list = new(DnsResourceRecord *, size);
	130	if (!list)
	131	return -ENOMEM;
	132
da6053d0	133	for (size_t i = DNS_PACKET_ANCOUNT(p); i < (DNS_PACKET_ANCOUNT(p) + DNS_PACKET_NSCOUNT(p)); i++) {
8d67e72c DR	134	r = dns_resource_key_match_rr(key, p->answer->items[i].rr, NULL);
	135	if (r < 0)
	136	return r;
	137	if (r > 0)
	138	list[n++] = p->answer->items[i].rr;
	139	}
	140	assert(n == size);
93bab288	141	typesafe_qsort(list, size, mdns_rr_compare);
8d67e72c	142
1cc6c93a	143	*ret_rrs = TAKE_PTR(list);
8d67e72c DR	144
	145	return size;
	146	}
	147
	148	static int mdns_do_tiebreak(DnsResourceKey key, DnsAnswer answer, DnsPacket *p) {
	149	_cleanup_free_ DnsResourceRecord our = NULL, remote = NULL;
	150	DnsResourceRecord *rr;
da6053d0	151	size_t i = 0, size;
8d67e72c DR	152	int r;
	153
	154	size = dns_answer_size(answer);
	155	our = new(DnsResourceRecord *, size);
	156	if (!our)
	157	return -ENOMEM;
	158
	159	DNS_ANSWER_FOREACH(rr, answer)
	160	our[i++] = rr;
93bab288 YW	161
93bab288 YW	162	typesafe_qsort(our, size, mdns_rr_compare);
8d67e72c DR	163
	164	r = mdns_packet_extract_matching_rrs(p, key, &remote);
	165	if (r < 0)
	166	return r;
	167
	168	assert(r > 0);
	169
	170	if (proposed_rrs_cmp(remote, r, our, size) > 0)
	171	return 1;
	172
	173	return 0;
	174	}
	175
3b991089	176	static int mdns_scope_process_query(DnsScope s, DnsPacket p) {
9c5e7b73	177	_cleanup_(dns_answer_unrefp) DnsAnswer *full_answer = NULL;
3b991089 DR	178	_cleanup_(dns_packet_unrefp) DnsPacket *reply = NULL;
3b991089 DR	179	DnsResourceKey *key = NULL;
8d67e72c	180	DnsResourceRecord *rr;
3b991089 DR	181	bool tentative = false;
	182	int r;
	183
	184	assert(s);
	185	assert(p);
	186
	187	r = dns_packet_extract(p);
1a63fc54 LP	188	if (r < 0)
1a63fc54 LP	189	return log_debug_errno(r, "Failed to extract resource records from incoming packet: %m");
3b991089	190
3b991089	191	assert_return((dns_question_size(p->question) > 0), -EINVAL);
3b991089	192
9c5e7b73 DR	193	DNS_QUESTION_FOREACH(key, p->question) {
	194	_cleanup_(dns_answer_unrefp) DnsAnswer answer = NULL, soa = NULL;
	195
	196	r = dns_zone_lookup(&s->zone, key, 0, &answer, &soa, &tentative);
	197	if (r < 0)
105a1a36	198	return log_debug_errno(r, "Failed to look up key: %m");
9c5e7b73	199
8d67e72c DR	200	if (tentative && DNS_PACKET_NSCOUNT(p) > 0) {
	201	/*
	202	* A race condition detected with the probe packet from
	203	* a remote host.
	204	* Do simultaneous probe tiebreaking as described in
	205	* RFC 6762, Section 8.2. In case we lost don't reply
	206	* the question and withdraw conflicting RRs.
	207	*/
	208	r = mdns_do_tiebreak(key, answer, p);
	209	if (r < 0)
	210	return log_debug_errno(r, "Failed to do tiebreaking");
	211
	212	if (r > 0) { /* we lost */
	213	DNS_ANSWER_FOREACH(rr, answer) {
	214	DnsZoneItem *i;
	215
	216	i = dns_zone_get(&s->zone, rr);
	217	if (i)
	218	dns_zone_item_conflict(i);
	219	}
	220
	221	continue;
	222	}
	223	}
	224
9c5e7b73 DR	225	r = dns_answer_extend(&full_answer, answer);
	226	if (r < 0)
	227	return log_debug_errno(r, "Failed to extend answer: %m");
	228	}
	229
	230	if (dns_answer_isempty(full_answer))
3b991089 DR	231	return 0;
3b991089 DR	232
9c5e7b73	233	r = dns_scope_make_reply_packet(s, DNS_PACKET_ID(p), DNS_RCODE_SUCCESS, NULL, full_answer, NULL, false, &reply);
9886b6b1 LP	234	if (r < 0)
9886b6b1 LP	235	return log_debug_errno(r, "Failed to build reply packet: %m");
3b991089	236
7994ac1d	237	if (!ratelimit_below(&s->ratelimit))
3b991089 DR	238	return 0;
3b991089 DR	239
d79677ab	240	r = dns_scope_emit_udp(s, -1, AF_UNSPEC, reply);
9886b6b1 LP	241	if (r < 0)
9886b6b1 LP	242	return log_debug_errno(r, "Failed to send reply packet: %m");
3b991089 DR	243
	244	return 0;
	245	}
	246
bc7702b0	247	static int on_mdns_packet(sd_event_source s, int fd, uint32_t revents, void userdata) {
124602ae DM	248	_cleanup_(dns_packet_unrefp) DnsPacket *p = NULL;
	249	Manager *m = userdata;
	250	DnsScope *scope;
	251	int r;
	252
	253	r = manager_recv(m, fd, DNS_PROTOCOL_MDNS, &p);
	254	if (r <= 0)
	255	return r;
	256
94378145	257	if (manager_packet_from_local_address(m, p))
cfb17f45 DR	258	return 0;
cfb17f45 DR	259
124602ae DM	260	scope = manager_find_scope(m, p);
124602ae DM	261	if (!scope) {
f1b1a5c4	262	log_debug("Got mDNS UDP packet on unknown scope. Ignoring.");
124602ae DM	263	return 0;
	264	}
	265
	266	if (dns_packet_validate_reply(p) > 0) {
40fa4728	267	DnsResourceRecord *rr;
124602ae DM	268
	269	log_debug("Got mDNS reply packet");
	270
	271	/*
	272	* mDNS is different from regular DNS and LLMNR with regard to handling responses.
	273	* While on other protocols, we can ignore every answer that doesn't match a question
	274	* we broadcast earlier, RFC6762, section 18.1 recommends looking at and caching all
	275	* incoming information, regardless of the DNS packet ID.
	276	*
	277	* Hence, extract the packet here, and try to find a transaction for answer the we got
	278	* and complete it. Also store the new information in scope's cache.
	279	*/
	280	r = dns_packet_extract(p);
	281	if (r < 0) {
	282	log_debug("mDNS packet extraction failed.");
	283	return 0;
	284	}
	285
	286	dns_scope_check_conflicts(scope, p);
	287
40fa4728	288	DNS_ANSWER_FOREACH(rr, p->answer) {
1c02e7ba	289	const char *name = dns_resource_key_name(rr->key);
124602ae DM	290	DnsTransaction *t;
124602ae DM	291
76755015 SB	292	/* If the received reply packet contains ANY record that is not .local
	293	* or .in-addr.arpa or .ip6.arpa, we assume someone's playing tricks on
	294	* us and discard the packet completely. */
40fa4728	295	if (!(dns_name_endswith(name, "in-addr.arpa") > 0 \|\|
76755015	296	dns_name_endswith(name, "ip6.arpa") > 0 \|\|
40fa4728 DM	297	dns_name_endswith(name, "local") > 0))
40fa4728 DM	298	return 0;
124602ae	299
3755027c DR	300	if (rr->ttl == 0) {
	301	log_debug("Got a goodbye packet");
	302	/* See the section 10.1 of RFC6762 */
	303	rr->ttl = 1;
	304	}
	305
775ae354	306	t = dns_scope_find_transaction(scope, rr->key, SD_RESOLVED_NO_CACHE\|SD_RESOLVED_NO_ZONE);
124602ae	307	if (t)
43fc4baa	308	dns_transaction_process_reply(t, p, false);
48413582 LP	309
48413582 LP	310	/* Also look for the various types of ANY transactions */
775ae354	311	t = dns_scope_find_transaction(scope, &DNS_RESOURCE_KEY_CONST(rr->key->class, DNS_TYPE_ANY, dns_resource_key_name(rr->key)), SD_RESOLVED_NO_CACHE\|SD_RESOLVED_NO_ZONE);
48413582	312	if (t)
43fc4baa	313	dns_transaction_process_reply(t, p, false);
48413582	314
775ae354	315	t = dns_scope_find_transaction(scope, &DNS_RESOURCE_KEY_CONST(DNS_CLASS_ANY, rr->key->type, dns_resource_key_name(rr->key)), SD_RESOLVED_NO_CACHE\|SD_RESOLVED_NO_ZONE);
48413582	316	if (t)
43fc4baa	317	dns_transaction_process_reply(t, p, false);
48413582	318
775ae354	319	t = dns_scope_find_transaction(scope, &DNS_RESOURCE_KEY_CONST(DNS_CLASS_ANY, DNS_TYPE_ANY, dns_resource_key_name(rr->key)), SD_RESOLVED_NO_CACHE\|SD_RESOLVED_NO_ZONE);
48413582	320	if (t)
43fc4baa	321	dns_transaction_process_reply(t, p, false);
124602ae DM	322	}
124602ae DM	323
f5fbe71d	324	dns_cache_put(&scope->cache, scope->manager->enable_cache, NULL, DNS_PACKET_RCODE(p), p->answer, NULL, false, _DNSSEC_RESULT_INVALID, UINT32_MAX, p->family, &p->sender);
124602ae DM	325
	326	} else if (dns_packet_validate_query(p) > 0) {
	327	log_debug("Got mDNS query packet for id %u", DNS_PACKET_ID(p));
	328
3b991089 DR	329	r = mdns_scope_process_query(scope, p);
3b991089 DR	330	if (r < 0) {
1a63fc54	331	log_debug_errno(r, "mDNS query processing failed: %m");
3b991089 DR	332	return 0;
3b991089 DR	333	}
124602ae DM	334	} else
	335	log_debug("Invalid mDNS UDP packet.");
	336
bc7702b0 DM	337	return 0;
	338	}
	339
	340	int manager_mdns_ipv4_fd(Manager *m) {
	341	union sockaddr_union sa = {
	342	.in.sin_family = AF_INET,
	343	.in.sin_port = htobe16(MDNS_PORT),
	344	};
73c76767	345	_cleanup_close_ int s = -1;
bc7702b0 DM	346	int r;
	347
	348	assert(m);
	349
	350	if (m->mdns_ipv4_fd >= 0)
	351	return m->mdns_ipv4_fd;
	352
73c76767 YW	353	s = socket(AF_INET, SOCK_DGRAM\|SOCK_CLOEXEC\|SOCK_NONBLOCK, 0);
73c76767 YW	354	if (s < 0)
71a047d2	355	return log_error_errno(errno, "mDNS-IPv4: Failed to create socket: %m");
bc7702b0	356
73c76767 YW	357	r = setsockopt_int(s, IPPROTO_IP, IP_TTL, 255);
	358	if (r < 0)
	359	return log_error_errno(r, "mDNS-IPv4: Failed to set IP_TTL: %m");
bc7702b0	360
73c76767 YW	361	r = setsockopt_int(s, IPPROTO_IP, IP_MULTICAST_TTL, 255);
	362	if (r < 0)
	363	return log_error_errno(r, "mDNS-IPv4: Failed to set IP_MULTICAST_TTL: %m");
bc7702b0	364
73c76767 YW	365	r = setsockopt_int(s, IPPROTO_IP, IP_MULTICAST_LOOP, true);
	366	if (r < 0)
	367	return log_error_errno(r, "mDNS-IPv4: Failed to set IP_MULTICAST_LOOP: %m");
bc7702b0	368
73c76767 YW	369	r = setsockopt_int(s, IPPROTO_IP, IP_PKTINFO, true);
	370	if (r < 0)
	371	return log_error_errno(r, "mDNS-IPv4: Failed to set IP_PKTINFO: %m");
bc7702b0	372
73c76767 YW	373	r = setsockopt_int(s, IPPROTO_IP, IP_RECVTTL, true);
	374	if (r < 0)
	375	return log_error_errno(r, "mDNS-IPv4: Failed to set IP_RECVTTL: %m");
bc7702b0 DM	376
bc7702b0 DM	377	/* Disable Don't-Fragment bit in the IP header */
73c76767 YW	378	r = setsockopt_int(s, IPPROTO_IP, IP_MTU_DISCOVER, IP_PMTUDISC_DONT);
	379	if (r < 0)
	380	return log_error_errno(r, "mDNS-IPv4: Failed to set IP_MTU_DISCOVER: %m");
bc7702b0	381
71a047d2 YW	382	/* See the section 15.1 of RFC6762 */
71a047d2 YW	383	/* first try to bind without SO_REUSEADDR to detect another mDNS responder */
73c76767	384	r = bind(s, &sa.sa, sizeof(sa.in));
bc7702b0	385	if (r < 0) {
73c76767 YW	386	if (errno != EADDRINUSE)
73c76767 YW	387	return log_error_errno(errno, "mDNS-IPv4: Failed to bind socket: %m");
71a047d2 YW	388
	389	log_warning("mDNS-IPv4: There appears to be another mDNS responder running, or previously systemd-resolved crashed with some outstanding transfers.");
	390
	391	/* try again with SO_REUSEADDR */
73c76767 YW	392	r = setsockopt_int(s, SOL_SOCKET, SO_REUSEADDR, true);
	393	if (r < 0)
	394	return log_error_errno(r, "mDNS-IPv4: Failed to set SO_REUSEADDR: %m");
71a047d2	395
73c76767 YW	396	r = bind(s, &sa.sa, sizeof(sa.in));
	397	if (r < 0)
	398	return log_error_errno(errno, "mDNS-IPv4: Failed to bind socket: %m");
71a047d2 YW	399	} else {
71a047d2 YW	400	/* enable SO_REUSEADDR for the case that the user really wants multiple mDNS responders */
73c76767 YW	401	r = setsockopt_int(s, SOL_SOCKET, SO_REUSEADDR, true);
	402	if (r < 0)
	403	return log_error_errno(r, "mDNS-IPv4: Failed to set SO_REUSEADDR: %m");
bc7702b0 DM	404	}
bc7702b0 DM	405
73c76767	406	r = sd_event_add_io(m->event, &m->mdns_ipv4_event_source, s, EPOLLIN, on_mdns_packet, m);
bc7702b0	407	if (r < 0)
73c76767	408	return log_error_errno(r, "mDNS-IPv4: Failed to create event source: %m");
bc7702b0	409
73c76767	410	return m->mdns_ipv4_fd = TAKE_FD(s);
bc7702b0 DM	411	}
	412
	413	int manager_mdns_ipv6_fd(Manager *m) {
	414	union sockaddr_union sa = {
	415	.in6.sin6_family = AF_INET6,
	416	.in6.sin6_port = htobe16(MDNS_PORT),
	417	};
73c76767	418	_cleanup_close_ int s = -1;
bc7702b0 DM	419	int r;
	420
	421	assert(m);
	422
	423	if (m->mdns_ipv6_fd >= 0)
	424	return m->mdns_ipv6_fd;
	425
73c76767 YW	426	s = socket(AF_INET6, SOCK_DGRAM\|SOCK_CLOEXEC\|SOCK_NONBLOCK, 0);
73c76767 YW	427	if (s < 0)
71a047d2	428	return log_error_errno(errno, "mDNS-IPv6: Failed to create socket: %m");
bc7702b0	429
73c76767 YW	430	r = setsockopt_int(s, IPPROTO_IPV6, IPV6_UNICAST_HOPS, 255);
	431	if (r < 0)
	432	return log_error_errno(r, "mDNS-IPv6: Failed to set IPV6_UNICAST_HOPS: %m");
bc7702b0 DM	433
bc7702b0 DM	434	/* RFC 4795, section 2.5 recommends setting the TTL of UDP packets to 255. */
73c76767 YW	435	r = setsockopt_int(s, IPPROTO_IPV6, IPV6_MULTICAST_HOPS, 255);
	436	if (r < 0)
	437	return log_error_errno(r, "mDNS-IPv6: Failed to set IPV6_MULTICAST_HOPS: %m");
bc7702b0	438
73c76767 YW	439	r = setsockopt_int(s, IPPROTO_IPV6, IPV6_MULTICAST_LOOP, true);
	440	if (r < 0)
	441	return log_error_errno(r, "mDNS-IPv6: Failed to set IPV6_MULTICAST_LOOP: %m");
bc7702b0	442
73c76767 YW	443	r = setsockopt_int(s, IPPROTO_IPV6, IPV6_V6ONLY, true);
	444	if (r < 0)
	445	return log_error_errno(r, "mDNS-IPv6: Failed to set IPV6_V6ONLY: %m");
bc7702b0	446
73c76767 YW	447	r = setsockopt_int(s, IPPROTO_IPV6, IPV6_RECVPKTINFO, true);
	448	if (r < 0)
	449	return log_error_errno(r, "mDNS-IPv6: Failed to set IPV6_RECVPKTINFO: %m");
bc7702b0	450
73c76767 YW	451	r = setsockopt_int(s, IPPROTO_IPV6, IPV6_RECVHOPLIMIT, true);
	452	if (r < 0)
	453	return log_error_errno(r, "mDNS-IPv6: Failed to set IPV6_RECVHOPLIMIT: %m");
bc7702b0	454
71a047d2 YW	455	/* See the section 15.1 of RFC6762 */
71a047d2 YW	456	/* first try to bind without SO_REUSEADDR to detect another mDNS responder */
73c76767	457	r = bind(s, &sa.sa, sizeof(sa.in6));
bc7702b0	458	if (r < 0) {
73c76767 YW	459	if (errno != EADDRINUSE)
73c76767 YW	460	return log_error_errno(errno, "mDNS-IPv6: Failed to bind socket: %m");
71a047d2 YW	461
	462	log_warning("mDNS-IPv6: There appears to be another mDNS responder running, or previously systemd-resolved crashed with some outstanding transfers.");
	463
	464	/* try again with SO_REUSEADDR */
73c76767 YW	465	r = setsockopt_int(s, SOL_SOCKET, SO_REUSEADDR, true);
	466	if (r < 0)
	467	return log_error_errno(r, "mDNS-IPv6: Failed to set SO_REUSEADDR: %m");
71a047d2	468
73c76767 YW	469	r = bind(s, &sa.sa, sizeof(sa.in6));
	470	if (r < 0)
	471	return log_error_errno(errno, "mDNS-IPv6: Failed to bind socket: %m");
71a047d2 YW	472	} else {
71a047d2 YW	473	/* enable SO_REUSEADDR for the case that the user really wants multiple mDNS responders */
73c76767 YW	474	r = setsockopt_int(s, SOL_SOCKET, SO_REUSEADDR, true);
	475	if (r < 0)
	476	return log_error_errno(r, "mDNS-IPv6: Failed to set SO_REUSEADDR: %m");
bc7702b0 DM	477	}
bc7702b0 DM	478
73c76767	479	r = sd_event_add_io(m->event, &m->mdns_ipv6_event_source, s, EPOLLIN, on_mdns_packet, m);
ee8d9305	480	if (r < 0)
73c76767	481	return log_error_errno(r, "mDNS-IPv6: Failed to create event source: %m");
bc7702b0	482
73c76767	483	return m->mdns_ipv6_fd = TAKE_FD(s);
bc7702b0	484	}