src/resolve/resolved-manager.c

   1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
   2
   3 #include <fcntl.h>
   4 #include <netinet/in.h>
   5 #include <poll.h>
   6 #include <sys/ioctl.h>
   7 #include <sys/stat.h>
   8 #include <sys/types.h>
   9 #include <unistd.h>
  10
  11 #include "af-list.h"
  12 #include "alloc-util.h"
  13 #include "bus-polkit.h"
  14 #include "dirent-util.h"
  15 #include "dns-domain.h"
  16 #include "event-util.h"
  17 #include "fd-util.h"
  18 #include "fileio.h"
  19 #include "hostname-util.h"
  20 #include "idn-util.h"
  21 #include "io-util.h"
  22 #include "missing_network.h"
  23 #include "missing_socket.h"
  24 #include "netlink-util.h"
  25 #include "ordered-set.h"
  26 #include "parse-util.h"
  27 #include "random-util.h"
  28 #include "resolved-bus.h"
  29 #include "resolved-conf.h"
  30 #include "resolved-dns-stub.h"
  31 #include "resolved-dnssd.h"
  32 #include "resolved-etc-hosts.h"
  33 #include "resolved-llmnr.h"
  34 #include "resolved-manager.h"
  35 #include "resolved-mdns.h"
  36 #include "resolved-resolv-conf.h"
  37 #include "resolved-util.h"
  38 #include "resolved-varlink.h"
  39 #include "socket-util.h"
  40 #include "string-table.h"
  41 #include "string-util.h"
  42 #include "utf8.h"
  43
  44 #define SEND_TIMEOUT_USEC (200 * USEC_PER_MSEC)
  45
  46 static int manager_process_link(sd_netlink *rtnl, sd_netlink_message *mm, void *userdata) {
  47         Manager *m = ASSERT_PTR(userdata);
  48         uint16_t type;
  49         Link *l;
  50         int ifindex, r;
  51
  52         assert(rtnl);
  53         assert(mm);
  54
  55         r = sd_netlink_message_get_type(mm, &type);
  56         if (r < 0)
  57                 goto fail;
  58
  59         r = sd_rtnl_message_link_get_ifindex(mm, &ifindex);
  60         if (r < 0)
  61                 goto fail;
  62
  63         l = hashmap_get(m->links, INT_TO_PTR(ifindex));
  64
  65         switch (type) {
  66
  67         case RTM_NEWLINK:{
  68                 bool is_new = !l;
  69
  70                 if (!l) {
  71                         r = link_new(m, &l, ifindex);
  72                         if (r < 0)
  73                                 goto fail;
  74                 }
  75
  76                 r = link_process_rtnl(l, mm);
  77                 if (r < 0)
  78                         goto fail;
  79
  80                 r = link_update(l);
  81                 if (r < 0)
  82                         goto fail;
  83
  84                 if (is_new)
  85                         log_debug("Found new link %i/%s", ifindex, l->ifname);
  86
  87                 break;
  88         }
  89
  90         case RTM_DELLINK:
  91                 if (l) {
  92                         log_debug("Removing link %i/%s", l->ifindex, l->ifname);
  93                         link_remove_user(l);
  94                         link_free(l);
  95                 }
  96
  97                 break;
  98         }
  99
 100         return 0;
 101
 102 fail:
 103         log_warning_errno(r, "Failed to process RTNL link message: %m");
 104         return 0;
 105 }
 106
 107 static int manager_process_address(sd_netlink *rtnl, sd_netlink_message *mm, void *userdata) {
 108         Manager *m = ASSERT_PTR(userdata);
 109         union in_addr_union address;
 110         uint16_t type;
 111         int r, ifindex, family;
 112         LinkAddress *a;
 113         Link *l;
 114
 115         assert(rtnl);
 116         assert(mm);
 117
 118         r = sd_netlink_message_get_type(mm, &type);
 119         if (r < 0)
 120                 goto fail;
 121
 122         r = sd_rtnl_message_addr_get_ifindex(mm, &ifindex);
 123         if (r < 0)
 124                 goto fail;
 125
 126         l = hashmap_get(m->links, INT_TO_PTR(ifindex));
 127         if (!l)
 128                 return 0;
 129
 130         r = sd_rtnl_message_addr_get_family(mm, &family);
 131         if (r < 0)
 132                 goto fail;
 133
 134         switch (family) {
 135
 136         case AF_INET:
 137                 r = sd_netlink_message_read_in_addr(mm, IFA_LOCAL, &address.in);
 138                 if (r < 0) {
 139                         r = sd_netlink_message_read_in_addr(mm, IFA_ADDRESS, &address.in);
 140                         if (r < 0)
 141                                 goto fail;
 142                 }
 143
 144                 break;
 145
 146         case AF_INET6:
 147                 r = sd_netlink_message_read_in6_addr(mm, IFA_LOCAL, &address.in6);
 148                 if (r < 0) {
 149                         r = sd_netlink_message_read_in6_addr(mm, IFA_ADDRESS, &address.in6);
 150                         if (r < 0)
 151                                 goto fail;
 152                 }
 153
 154                 break;
 155
 156         default:
 157                 return 0;
 158         }
 159
 160         a = link_find_address(l, family, &address);
 161
 162         switch (type) {
 163
 164         case RTM_NEWADDR:
 165
 166                 if (!a) {
 167                         r = link_address_new(l, &a, family, &address);
 168                         if (r < 0)
 169                                 return r;
 170                 }
 171
 172                 r = link_address_update_rtnl(a, mm);
 173                 if (r < 0)
 174                         return r;
 175
 176                 break;
 177
 178         case RTM_DELADDR:
 179                 link_address_free(a);
 180                 break;
 181         }
 182
 183         return 0;
 184
 185 fail:
 186         log_warning_errno(r, "Failed to process RTNL address message: %m");
 187         return 0;
 188 }
 189
 190 static int manager_rtnl_listen(Manager *m) {
 191         _cleanup_(sd_netlink_message_unrefp) sd_netlink_message *req = NULL, *reply = NULL;
 192         sd_netlink_message *i;
 193         int r;
 194
 195         assert(m);
 196
 197         /* First, subscribe to interfaces coming and going */
 198         r = sd_netlink_open(&m->rtnl);
 199         if (r < 0)
 200                 return r;
 201
 202         r = sd_netlink_attach_event(m->rtnl, m->event, SD_EVENT_PRIORITY_IMPORTANT);
 203         if (r < 0)
 204                 return r;
 205
 206         r = sd_netlink_add_match(m->rtnl, NULL, RTM_NEWLINK, manager_process_link, NULL, m, "resolve-NEWLINK");
 207         if (r < 0)
 208                 return r;
 209
 210         r = sd_netlink_add_match(m->rtnl, NULL, RTM_DELLINK, manager_process_link, NULL, m, "resolve-DELLINK");
 211         if (r < 0)
 212                 return r;
 213
 214         r = sd_netlink_add_match(m->rtnl, NULL, RTM_NEWADDR, manager_process_address, NULL, m, "resolve-NEWADDR");
 215         if (r < 0)
 216                 return r;
 217
 218         r = sd_netlink_add_match(m->rtnl, NULL, RTM_DELADDR, manager_process_address, NULL, m, "resolve-DELADDR");
 219         if (r < 0)
 220                 return r;
 221
 222         /* Then, enumerate all links */
 223         r = sd_rtnl_message_new_link(m->rtnl, &req, RTM_GETLINK, 0);
 224         if (r < 0)
 225                 return r;
 226
 227         r = sd_netlink_message_set_request_dump(req, true);
 228         if (r < 0)
 229                 return r;
 230
 231         r = sd_netlink_call(m->rtnl, req, 0, &reply);
 232         if (r < 0)
 233                 return r;
 234
 235         for (i = reply; i; i = sd_netlink_message_next(i)) {
 236                 r = manager_process_link(m->rtnl, i, m);
 237                 if (r < 0)
 238                         return r;
 239         }
 240
 241         req = sd_netlink_message_unref(req);
 242         reply = sd_netlink_message_unref(reply);
 243
 244         /* Finally, enumerate all addresses, too */
 245         r = sd_rtnl_message_new_addr(m->rtnl, &req, RTM_GETADDR, 0, AF_UNSPEC);
 246         if (r < 0)
 247                 return r;
 248
 249         r = sd_netlink_message_set_request_dump(req, true);
 250         if (r < 0)
 251                 return r;
 252
 253         r = sd_netlink_call(m->rtnl, req, 0, &reply);
 254         if (r < 0)
 255                 return r;
 256
 257         for (i = reply; i; i = sd_netlink_message_next(i)) {
 258                 r = manager_process_address(m->rtnl, i, m);
 259                 if (r < 0)
 260                         return r;
 261         }
 262
 263         return r;
 264 }
 265
 266 static int on_network_event(sd_event_source *s, int fd, uint32_t revents, void *userdata) {
 267         Manager *m = ASSERT_PTR(userdata);
 268         Link *l;
 269         int r;
 270
 271         sd_network_monitor_flush(m->network_monitor);
 272
 273         HASHMAP_FOREACH(l, m->links) {
 274                 r = link_update(l);
 275                 if (r < 0)
 276                         log_warning_errno(r, "Failed to update monitor information for %i: %m", l->ifindex);
 277         }
 278
 279         (void) manager_write_resolv_conf(m);
 280         (void) manager_send_changed(m, "DNS");
 281
 282         return 0;
 283 }
 284
 285 static int manager_network_monitor_listen(Manager *m) {
 286         int r, fd, events;
 287
 288         assert(m);
 289
 290         r = sd_network_monitor_new(&m->network_monitor, NULL);
 291         if (r < 0)
 292                 return r;
 293
 294         fd = sd_network_monitor_get_fd(m->network_monitor);
 295         if (fd < 0)
 296                 return fd;
 297
 298         events = sd_network_monitor_get_events(m->network_monitor);
 299         if (events < 0)
 300                 return events;
 301
 302         r = sd_event_add_io(m->event, &m->network_event_source, fd, events, &on_network_event, m);
 303         if (r < 0)
 304                 return r;
 305
 306         r = sd_event_source_set_priority(m->network_event_source, SD_EVENT_PRIORITY_IMPORTANT+5);
 307         if (r < 0)
 308                 return r;
 309
 310         (void) sd_event_source_set_description(m->network_event_source, "network-monitor");
 311
 312         return 0;
 313 }
 314
 315 static int manager_clock_change_listen(Manager *m);
 316
 317 static int on_clock_change(sd_event_source *source, int fd, uint32_t revents, void *userdata) {
 318         Manager *m = ASSERT_PTR(userdata);
 319
 320         /* The clock has changed, let's flush all caches. Why that? That's because DNSSEC validation takes
 321          * the system clock into consideration, and if the clock changes the old validations might have been
 322          * wrong. Let's redo all validation with the new, correct time.
 323          *
 324          * (Also, this is triggered after system suspend, which is also a good reason to drop caches, since
 325          * we might be connected to a different network now without this being visible in a dropped link
 326          * carrier or so.) */
 327
 328         log_info("Clock change detected. Flushing caches.");
 329         manager_flush_caches(m, LOG_DEBUG /* downgrade the functions own log message, since we already logged here at LOG_INFO level */);
 330
 331         /* The clock change timerfd is unusable after it triggered once, create a new one. */
 332         return manager_clock_change_listen(m);
 333 }
 334
 335 static int manager_clock_change_listen(Manager *m) {
 336         int r;
 337
 338         assert(m);
 339
 340         m->clock_change_event_source = sd_event_source_disable_unref(m->clock_change_event_source);
 341
 342         r = event_add_time_change(m->event, &m->clock_change_event_source, on_clock_change, m);
 343         if (r < 0)
 344                 return log_error_errno(r, "Failed to create clock change event source: %m");
 345
 346         return 0;
 347 }
 348
 349 static int determine_hostnames(char **full_hostname, char **llmnr_hostname, char **mdns_hostname) {
 350         _cleanup_free_ char *h = NULL, *n = NULL;
 351         int r;
 352
 353         assert(full_hostname);
 354         assert(llmnr_hostname);
 355         assert(mdns_hostname);
 356
 357         r = resolve_system_hostname(&h, &n);
 358         if (r < 0)
 359                 return r;
 360
 361         r = dns_name_concat(n, "local", 0, mdns_hostname);
 362         if (r < 0)
 363                 return log_error_errno(r, "Failed to determine mDNS hostname: %m");
 364
 365         *llmnr_hostname = TAKE_PTR(n);
 366         *full_hostname = TAKE_PTR(h);
 367
 368         return 0;
 369 }
 370
 371 static char* fallback_hostname(void) {
 372
 373         /* Determine the fall back hostname. For exposing this system to the outside world, we cannot have it
 374          * to be "localhost" even if that's the default hostname. In this case, let's revert to "linux"
 375          * instead. */
 376
 377         _cleanup_free_ char *n = get_default_hostname();
 378         if (!n)
 379                 return NULL;
 380
 381         if (is_localhost(n))
 382                 return strdup("linux");
 383
 384         return TAKE_PTR(n);
 385 }
 386
 387 static int make_fallback_hostnames(char **full_hostname, char **llmnr_hostname, char **mdns_hostname) {
 388         _cleanup_free_ char *h = NULL, *n = NULL, *m = NULL;
 389         char label[DNS_LABEL_MAX];
 390         const char *p;
 391         int r;
 392
 393         assert(full_hostname);
 394         assert(llmnr_hostname);
 395         assert(mdns_hostname);
 396
 397         p = h = fallback_hostname();
 398         if (!h)
 399                 return log_oom();
 400
 401         r = dns_label_unescape(&p, label, sizeof label, 0);
 402         if (r < 0)
 403                 return log_error_errno(r, "Failed to unescape fallback hostname: %m");
 404
 405         assert(r > 0); /* The fallback hostname must have at least one label */
 406
 407         r = dns_label_escape_new(label, r, &n);
 408         if (r < 0)
 409                 return log_error_errno(r, "Failed to escape fallback hostname: %m");
 410
 411         r = dns_name_concat(n, "local", 0, &m);
 412         if (r < 0)
 413                 return log_error_errno(r, "Failed to concatenate mDNS hostname: %m");
 414
 415         *llmnr_hostname = TAKE_PTR(n);
 416         *mdns_hostname = TAKE_PTR(m);
 417         *full_hostname = TAKE_PTR(h);
 418
 419         return 0;
 420 }
 421
 422 static int on_hostname_change(sd_event_source *es, int fd, uint32_t revents, void *userdata) {
 423         _cleanup_free_ char *full_hostname = NULL, *llmnr_hostname = NULL, *mdns_hostname = NULL;
 424         Manager *m = ASSERT_PTR(userdata);
 425         bool llmnr_hostname_changed;
 426         int r;
 427
 428         r = determine_hostnames(&full_hostname, &llmnr_hostname, &mdns_hostname);
 429         if (r < 0) {
 430                 log_warning_errno(r, "Failed to determine the local hostname and LLMNR/mDNS names, ignoring: %m");
 431                 return 0; /* ignore invalid hostnames */
 432         }
 433
 434         llmnr_hostname_changed = !streq(llmnr_hostname, m->llmnr_hostname);
 435         if (streq(full_hostname, m->full_hostname) &&
 436             !llmnr_hostname_changed &&
 437             streq(mdns_hostname, m->mdns_hostname))
 438                 return 0;
 439
 440         log_info("System hostname changed to '%s'.", full_hostname);
 441
 442         free_and_replace(m->full_hostname, full_hostname);
 443         free_and_replace(m->llmnr_hostname, llmnr_hostname);
 444         free_and_replace(m->mdns_hostname, mdns_hostname);
 445
 446         manager_refresh_rrs(m);
 447         (void) manager_send_changed(m, "LLMNRHostname");
 448
 449         return 0;
 450 }
 451
 452 static int manager_watch_hostname(Manager *m) {
 453         int r;
 454
 455         assert(m);
 456
 457         m->hostname_fd = open("/proc/sys/kernel/hostname",
 458                               O_RDONLY|O_CLOEXEC|O_NONBLOCK|O_NOCTTY);
 459         if (m->hostname_fd < 0) {
 460                 log_warning_errno(errno, "Failed to watch hostname: %m");
 461                 return 0;
 462         }
 463
 464         r = sd_event_add_io(m->event, &m->hostname_event_source, m->hostname_fd, 0, on_hostname_change, m);
 465         if (r < 0) {
 466                 if (r == -EPERM)
 467                         /* kernels prior to 3.2 don't support polling this file. Ignore the failure. */
 468                         m->hostname_fd = safe_close(m->hostname_fd);
 469                 else
 470                         return log_error_errno(r, "Failed to add hostname event source: %m");
 471         }
 472
 473         (void) sd_event_source_set_description(m->hostname_event_source, "hostname");
 474
 475         r = determine_hostnames(&m->full_hostname, &m->llmnr_hostname, &m->mdns_hostname);
 476         if (r < 0) {
 477                 _cleanup_free_ char *d = NULL;
 478
 479                 d = fallback_hostname();
 480                 if (!d)
 481                         return log_oom();
 482
 483                 log_info("Defaulting to hostname '%s'.", d);
 484
 485                 r = make_fallback_hostnames(&m->full_hostname, &m->llmnr_hostname, &m->mdns_hostname);
 486                 if (r < 0)
 487                         return r;
 488         } else
 489                 log_info("Using system hostname '%s'.", m->full_hostname);
 490
 491         return 0;
 492 }
 493
 494 static int manager_sigusr1(sd_event_source *s, const struct signalfd_siginfo *si, void *userdata) {
 495         _cleanup_free_ char *buffer = NULL;
 496         _cleanup_fclose_ FILE *f = NULL;
 497         Manager *m = ASSERT_PTR(userdata);
 498         size_t size = 0;
 499         Link *l;
 500
 501         assert(s);
 502         assert(si);
 503
 504         f = open_memstream_unlocked(&buffer, &size);
 505         if (!f)
 506                 return log_oom();
 507
 508         LIST_FOREACH(scopes, scope, m->dns_scopes)
 509                 dns_scope_dump(scope, f);
 510
 511         LIST_FOREACH(servers, server, m->dns_servers)
 512                 dns_server_dump(server, f);
 513         LIST_FOREACH(servers, server, m->fallback_dns_servers)
 514                 dns_server_dump(server, f);
 515         HASHMAP_FOREACH(l, m->links)
 516                 LIST_FOREACH(servers, server, l->dns_servers)
 517                         dns_server_dump(server, f);
 518
 519         if (fflush_and_check(f) < 0)
 520                 return log_oom();
 521
 522         log_dump(LOG_INFO, buffer);
 523         return 0;
 524 }
 525
 526 static int manager_sigusr2(sd_event_source *s, const struct signalfd_siginfo *si, void *userdata) {
 527         Manager *m = ASSERT_PTR(userdata);
 528
 529         assert(s);
 530         assert(si);
 531
 532         manager_flush_caches(m, LOG_INFO);
 533
 534         return 0;
 535 }
 536
 537 static int manager_sigrtmin1(sd_event_source *s, const struct signalfd_siginfo *si, void *userdata) {
 538         Manager *m = ASSERT_PTR(userdata);
 539
 540         assert(s);
 541         assert(si);
 542
 543         manager_reset_server_features(m);
 544         return 0;
 545 }
 546
 547 int manager_new(Manager **ret) {
 548         _cleanup_(manager_freep) Manager *m = NULL;
 549         int r;
 550
 551         assert(ret);
 552
 553         m = new(Manager, 1);
 554         if (!m)
 555                 return -ENOMEM;
 556
 557         *m = (Manager) {
 558                 .llmnr_ipv4_udp_fd = -1,
 559                 .llmnr_ipv6_udp_fd = -1,
 560                 .llmnr_ipv4_tcp_fd = -1,
 561                 .llmnr_ipv6_tcp_fd = -1,
 562                 .mdns_ipv4_fd = -1,
 563                 .mdns_ipv6_fd = -1,
 564                 .hostname_fd = -1,
 565
 566                 .llmnr_support = DEFAULT_LLMNR_MODE,
 567                 .mdns_support = DEFAULT_MDNS_MODE,
 568                 .dnssec_mode = DEFAULT_DNSSEC_MODE,
 569                 .dns_over_tls_mode = DEFAULT_DNS_OVER_TLS_MODE,
 570                 .enable_cache = DNS_CACHE_MODE_YES,
 571                 .dns_stub_listener_mode = DNS_STUB_LISTENER_YES,
 572                 .read_resolv_conf = true,
 573                 .need_builtin_fallbacks = true,
 574                 .etc_hosts_last = USEC_INFINITY,
 575                 .read_etc_hosts = true,
 576         };
 577
 578         r = dns_trust_anchor_load(&m->trust_anchor);
 579         if (r < 0)
 580                 return r;
 581
 582         r = manager_parse_config_file(m);
 583         if (r < 0)
 584                 log_warning_errno(r, "Failed to parse configuration file: %m");
 585
 586 #if ENABLE_DNS_OVER_TLS
 587         r = dnstls_manager_init(m);
 588         if (r < 0)
 589                 return r;
 590 #endif
 591
 592         r = sd_event_default(&m->event);
 593         if (r < 0)
 594                 return r;
 595
 596         (void) sd_event_add_signal(m->event, NULL, SIGTERM, NULL,  NULL);
 597         (void) sd_event_add_signal(m->event, NULL, SIGINT, NULL, NULL);
 598
 599         (void) sd_event_set_watchdog(m->event, true);
 600
 601         r = manager_watch_hostname(m);
 602         if (r < 0)
 603                 return r;
 604
 605         r = dnssd_load(m);
 606         if (r < 0)
 607                 log_warning_errno(r, "Failed to load DNS-SD configuration files: %m");
 608
 609         r = dns_scope_new(m, &m->unicast_scope, NULL, DNS_PROTOCOL_DNS, AF_UNSPEC);
 610         if (r < 0)
 611                 return r;
 612
 613         r = manager_network_monitor_listen(m);
 614         if (r < 0)
 615                 return r;
 616
 617         r = manager_rtnl_listen(m);
 618         if (r < 0)
 619                 return r;
 620
 621         r = manager_clock_change_listen(m);
 622         if (r < 0)
 623                 return r;
 624
 625         r = manager_connect_bus(m);
 626         if (r < 0)
 627                 return r;
 628
 629         (void) sd_event_add_signal(m->event, &m->sigusr1_event_source, SIGUSR1, manager_sigusr1, m);
 630         (void) sd_event_add_signal(m->event, &m->sigusr2_event_source, SIGUSR2, manager_sigusr2, m);
 631         (void) sd_event_add_signal(m->event, &m->sigrtmin1_event_source, SIGRTMIN+1, manager_sigrtmin1, m);
 632
 633         manager_cleanup_saved_user(m);
 634
 635         *ret = TAKE_PTR(m);
 636
 637         return 0;
 638 }
 639
 640 int manager_start(Manager *m) {
 641         int r;
 642
 643         assert(m);
 644
 645         r = manager_dns_stub_start(m);
 646         if (r < 0)
 647                 return r;
 648
 649         r = manager_varlink_init(m);
 650         if (r < 0)
 651                 return r;
 652
 653         return 0;
 654 }
 655
 656 Manager *manager_free(Manager *m) {
 657         Link *l;
 658         DnssdService *s;
 659
 660         if (!m)
 661                 return NULL;
 662
 663         dns_server_unlink_all(m->dns_servers);
 664         dns_server_unlink_all(m->fallback_dns_servers);
 665         dns_search_domain_unlink_all(m->search_domains);
 666
 667         while ((l = hashmap_first(m->links)))
 668                link_free(l);
 669
 670         while (m->dns_queries)
 671                 dns_query_free(m->dns_queries);
 672
 673         m->stub_queries_by_packet = hashmap_free(m->stub_queries_by_packet);
 674
 675         dns_scope_free(m->unicast_scope);
 676
 677         /* At this point only orphaned streams should remain. All others should have been freed already by their
 678          * owners */
 679         while (m->dns_streams)
 680                 dns_stream_unref(m->dns_streams);
 681
 682 #if ENABLE_DNS_OVER_TLS
 683         dnstls_manager_free(m);
 684 #endif
 685
 686         hashmap_free(m->links);
 687         hashmap_free(m->dns_transactions);
 688
 689         sd_event_source_unref(m->network_event_source);
 690         sd_network_monitor_unref(m->network_monitor);
 691
 692         sd_netlink_unref(m->rtnl);
 693         sd_event_source_unref(m->rtnl_event_source);
 694         sd_event_source_unref(m->clock_change_event_source);
 695
 696         manager_llmnr_stop(m);
 697         manager_mdns_stop(m);
 698         manager_dns_stub_stop(m);
 699         manager_varlink_done(m);
 700
 701         manager_socket_graveyard_clear(m);
 702
 703         ordered_set_free(m->dns_extra_stub_listeners);
 704
 705         bus_verify_polkit_async_registry_free(m->polkit_registry);
 706
 707         sd_bus_flush_close_unref(m->bus);
 708
 709         sd_event_source_unref(m->sigusr1_event_source);
 710         sd_event_source_unref(m->sigusr2_event_source);
 711         sd_event_source_unref(m->sigrtmin1_event_source);
 712
 713         dns_resource_key_unref(m->llmnr_host_ipv4_key);
 714         dns_resource_key_unref(m->llmnr_host_ipv6_key);
 715         dns_resource_key_unref(m->mdns_host_ipv4_key);
 716         dns_resource_key_unref(m->mdns_host_ipv6_key);
 717
 718         sd_event_source_unref(m->hostname_event_source);
 719         safe_close(m->hostname_fd);
 720
 721         sd_event_unref(m->event);
 722
 723         free(m->full_hostname);
 724         free(m->llmnr_hostname);
 725         free(m->mdns_hostname);
 726
 727         while ((s = hashmap_first(m->dnssd_services)))
 728                dnssd_service_free(s);
 729         hashmap_free(m->dnssd_services);
 730
 731         dns_trust_anchor_flush(&m->trust_anchor);
 732         manager_etc_hosts_flush(m);
 733
 734         return mfree(m);
 735 }
 736
 737 int manager_recv(Manager *m, int fd, DnsProtocol protocol, DnsPacket **ret) {
 738         _cleanup_(dns_packet_unrefp) DnsPacket *p = NULL;
 739         CMSG_BUFFER_TYPE(CMSG_SPACE(MAXSIZE(struct in_pktinfo, struct in6_pktinfo))
 740                          + CMSG_SPACE(int) /* ttl/hoplimit */
 741                          + EXTRA_CMSG_SPACE /* kernel appears to require extra buffer space */) control;
 742         union sockaddr_union sa;
 743         struct iovec iov;
 744         struct msghdr mh = {
 745                 .msg_name = &sa.sa,
 746                 .msg_namelen = sizeof(sa),
 747                 .msg_iov = &iov,
 748                 .msg_iovlen = 1,
 749                 .msg_control = &control,
 750                 .msg_controllen = sizeof(control),
 751         };
 752         struct cmsghdr *cmsg;
 753         ssize_t ms, l;
 754         int r;
 755
 756         assert(m);
 757         assert(fd >= 0);
 758         assert(ret);
 759
 760         ms = next_datagram_size_fd(fd);
 761         if (ms < 0)
 762                 return ms;
 763
 764         r = dns_packet_new(&p, protocol, ms, DNS_PACKET_SIZE_MAX);
 765         if (r < 0)
 766                 return r;
 767
 768         iov = IOVEC_MAKE(DNS_PACKET_DATA(p), p->allocated);
 769
 770         l = recvmsg_safe(fd, &mh, 0);
 771         if (l < 0) {
 772                 if (ERRNO_IS_TRANSIENT(l))
 773                         return 0;
 774                 return l;
 775         }
 776         if (l == 0)
 777                 return 0;
 778
 779         assert(!(mh.msg_flags & MSG_TRUNC));
 780
 781         p->size = (size_t) l;
 782
 783         p->family = sa.sa.sa_family;
 784         p->ipproto = IPPROTO_UDP;
 785         if (p->family == AF_INET) {
 786                 p->sender.in = sa.in.sin_addr;
 787                 p->sender_port = be16toh(sa.in.sin_port);
 788         } else if (p->family == AF_INET6) {
 789                 p->sender.in6 = sa.in6.sin6_addr;
 790                 p->sender_port = be16toh(sa.in6.sin6_port);
 791                 p->ifindex = sa.in6.sin6_scope_id;
 792         } else
 793                 return -EAFNOSUPPORT;
 794
 795         p->timestamp = now(CLOCK_BOOTTIME);
 796
 797         CMSG_FOREACH(cmsg, &mh) {
 798
 799                 if (cmsg->cmsg_level == IPPROTO_IPV6) {
 800                         assert(p->family == AF_INET6);
 801
 802                         switch (cmsg->cmsg_type) {
 803
 804                         case IPV6_PKTINFO: {
 805                                 struct in6_pktinfo *i = (struct in6_pktinfo*) CMSG_DATA(cmsg);
 806
 807                                 if (p->ifindex <= 0)
 808                                         p->ifindex = i->ipi6_ifindex;
 809
 810                                 p->destination.in6 = i->ipi6_addr;
 811                                 break;
 812                         }
 813
 814                         case IPV6_HOPLIMIT:
 815                                 p->ttl = *(int *) CMSG_DATA(cmsg);
 816                                 break;
 817
 818                         case IPV6_RECVFRAGSIZE:
 819                                 p->fragsize = *(int *) CMSG_DATA(cmsg);
 820                                 break;
 821                         }
 822                 } else if (cmsg->cmsg_level == IPPROTO_IP) {
 823                         assert(p->family == AF_INET);
 824
 825                         switch (cmsg->cmsg_type) {
 826
 827                         case IP_PKTINFO: {
 828                                 struct in_pktinfo *i = (struct in_pktinfo*) CMSG_DATA(cmsg);
 829
 830                                 if (p->ifindex <= 0)
 831                                         p->ifindex = i->ipi_ifindex;
 832
 833                                 p->destination.in = i->ipi_addr;
 834                                 break;
 835                         }
 836
 837                         case IP_TTL:
 838                                 p->ttl = *(int *) CMSG_DATA(cmsg);
 839                                 break;
 840
 841                         case IP_RECVFRAGSIZE:
 842                                 p->fragsize = *(int *) CMSG_DATA(cmsg);
 843                                 break;
 844                         }
 845                 }
 846         }
 847
 848         /* The Linux kernel sets the interface index to the loopback
 849          * device if the packet came from the local host since it
 850          * avoids the routing table in such a case. Let's unset the
 851          * interface index in such a case. */
 852         if (p->ifindex == LOOPBACK_IFINDEX)
 853                 p->ifindex = 0;
 854
 855         if (protocol != DNS_PROTOCOL_DNS) {
 856                 /* If we don't know the interface index still, we look for the
 857                  * first local interface with a matching address. Yuck! */
 858                 if (p->ifindex <= 0)
 859                         p->ifindex = manager_find_ifindex(m, p->family, &p->destination);
 860         }
 861
 862         log_debug("Received %s UDP packet of size %zu, ifindex=%i, ttl=%u, fragsize=%zu, sender=%s, destination=%s",
 863                   dns_protocol_to_string(protocol), p->size, p->ifindex, p->ttl, p->fragsize,
 864                   IN_ADDR_TO_STRING(p->family, &p->sender),
 865                   IN_ADDR_TO_STRING(p->family, &p->destination));
 866
 867         *ret = TAKE_PTR(p);
 868         return 1;
 869 }
 870
 871 static int sendmsg_loop(int fd, struct msghdr *mh, int flags) {
 872         int r;
 873
 874         assert(fd >= 0);
 875         assert(mh);
 876
 877         for (;;) {
 878                 if (sendmsg(fd, mh, flags) >= 0)
 879                         return 0;
 880
 881                 if (errno == EINTR)
 882                         continue;
 883
 884                 if (errno != EAGAIN)
 885                         return -errno;
 886
 887                 r = fd_wait_for_event(fd, POLLOUT, SEND_TIMEOUT_USEC);
 888                 if (r < 0)
 889                         return r;
 890                 if (r == 0)
 891                         return -ETIMEDOUT;
 892         }
 893 }
 894
 895 static int write_loop(int fd, void *message, size_t length) {
 896         int r;
 897
 898         assert(fd >= 0);
 899         assert(message);
 900
 901         for (;;) {
 902                 if (write(fd, message, length) >= 0)
 903                         return 0;
 904
 905                 if (errno == EINTR)
 906                         continue;
 907
 908                 if (errno != EAGAIN)
 909                         return -errno;
 910
 911                 r = fd_wait_for_event(fd, POLLOUT, SEND_TIMEOUT_USEC);
 912                 if (r < 0)
 913                         return r;
 914                 if (r == 0)
 915                         return -ETIMEDOUT;
 916         }
 917 }
 918
 919 int manager_write(Manager *m, int fd, DnsPacket *p) {
 920         int r;
 921
 922         log_debug("Sending %s%s packet with id %" PRIu16 " of size %zu.",
 923                   DNS_PACKET_TC(p) ? "truncated (!) " : "",
 924                   DNS_PACKET_QR(p) ? "response" : "query",
 925                   DNS_PACKET_ID(p),
 926                   p->size);
 927
 928         r = write_loop(fd, DNS_PACKET_DATA(p), p->size);
 929         if (r < 0)
 930                 return r;
 931
 932         return 0;
 933 }
 934
 935 static int manager_ipv4_send(
 936                 Manager *m,
 937                 int fd,
 938                 int ifindex,
 939                 const struct in_addr *destination,
 940                 uint16_t port,
 941                 const struct in_addr *source,
 942                 DnsPacket *p) {
 943
 944         CMSG_BUFFER_TYPE(CMSG_SPACE(sizeof(struct in_pktinfo))) control = {};
 945         union sockaddr_union sa;
 946         struct iovec iov;
 947         struct msghdr mh = {
 948                 .msg_iov = &iov,
 949                 .msg_iovlen = 1,
 950                 .msg_name = &sa.sa,
 951                 .msg_namelen = sizeof(sa.in),
 952         };
 953
 954         assert(m);
 955         assert(fd >= 0);
 956         assert(destination);
 957         assert(port > 0);
 958         assert(p);
 959
 960         iov = IOVEC_MAKE(DNS_PACKET_DATA(p), p->size);
 961
 962         sa = (union sockaddr_union) {
 963                 .in.sin_family = AF_INET,
 964                 .in.sin_addr = *destination,
 965                 .in.sin_port = htobe16(port),
 966         };
 967
 968         if (ifindex > 0) {
 969                 struct cmsghdr *cmsg;
 970                 struct in_pktinfo *pi;
 971
 972                 mh.msg_control = &control;
 973                 mh.msg_controllen = sizeof(control);
 974
 975                 cmsg = CMSG_FIRSTHDR(&mh);
 976                 cmsg->cmsg_len = CMSG_LEN(sizeof(struct in_pktinfo));
 977                 cmsg->cmsg_level = IPPROTO_IP;
 978                 cmsg->cmsg_type = IP_PKTINFO;
 979
 980                 pi = (struct in_pktinfo*) CMSG_DATA(cmsg);
 981                 pi->ipi_ifindex = ifindex;
 982
 983                 if (source)
 984                         pi->ipi_spec_dst = *source;
 985         }
 986
 987         return sendmsg_loop(fd, &mh, 0);
 988 }
 989
 990 static int manager_ipv6_send(
 991                 Manager *m,
 992                 int fd,
 993                 int ifindex,
 994                 const struct in6_addr *destination,
 995                 uint16_t port,
 996                 const struct in6_addr *source,
 997                 DnsPacket *p) {
 998
 999         CMSG_BUFFER_TYPE(CMSG_SPACE(sizeof(struct in6_pktinfo))) control = {};
1000         union sockaddr_union sa;
1001         struct iovec iov;
1002         struct msghdr mh = {
1003                 .msg_iov = &iov,
1004                 .msg_iovlen = 1,
1005                 .msg_name = &sa.sa,
1006                 .msg_namelen = sizeof(sa.in6),
1007         };
1008
1009         assert(m);
1010         assert(fd >= 0);
1011         assert(destination);
1012         assert(port > 0);
1013         assert(p);
1014
1015         iov = IOVEC_MAKE(DNS_PACKET_DATA(p), p->size);
1016
1017         sa = (union sockaddr_union) {
1018                 .in6.sin6_family = AF_INET6,
1019                 .in6.sin6_addr = *destination,
1020                 .in6.sin6_port = htobe16(port),
1021                 .in6.sin6_scope_id = ifindex,
1022         };
1023
1024         if (ifindex > 0) {
1025                 struct cmsghdr *cmsg;
1026                 struct in6_pktinfo *pi;
1027
1028                 mh.msg_control = &control;
1029                 mh.msg_controllen = sizeof(control);
1030
1031                 cmsg = CMSG_FIRSTHDR(&mh);
1032                 cmsg->cmsg_len = CMSG_LEN(sizeof(struct in6_pktinfo));
1033                 cmsg->cmsg_level = IPPROTO_IPV6;
1034                 cmsg->cmsg_type = IPV6_PKTINFO;
1035
1036                 pi = (struct in6_pktinfo*) CMSG_DATA(cmsg);
1037                 pi->ipi6_ifindex = ifindex;
1038
1039                 if (source)
1040                         pi->ipi6_addr = *source;
1041         }
1042
1043         return sendmsg_loop(fd, &mh, 0);
1044 }
1045
1046 int send_dns_notification(Manager *m, DnsAnswer *answer, const char *query_name) {
1047         _cleanup_free_ char *normalized = NULL;
1048         DnsResourceRecord *rr;
1049         int ifindex, r;
1050         _cleanup_(json_variant_unrefp) JsonVariant *array = NULL;
1051         Varlink *connection;
1052
1053         assert(m);
1054
1055         if (set_isempty(m->varlink_subscription))
1056                 return 0;
1057
1058         DNS_ANSWER_FOREACH_IFINDEX(rr, ifindex, answer) {
1059                 _cleanup_(json_variant_unrefp) JsonVariant *entry = NULL;
1060
1061                 if (rr->key->type == DNS_TYPE_A) {
1062                         struct in_addr *addr = &rr->a.in_addr;
1063                         r = json_build(&entry,
1064                                 JSON_BUILD_OBJECT(JSON_BUILD_PAIR_CONDITION(ifindex > 0, "ifindex", JSON_BUILD_INTEGER(ifindex)),
1065                                                   JSON_BUILD_PAIR_INTEGER("family", AF_INET),
1066                                                   JSON_BUILD_PAIR_IN4_ADDR("address", addr),
1067                                                   JSON_BUILD_PAIR_STRING("type", "A")));
1068                 } else if (rr->key->type == DNS_TYPE_AAAA) {
1069                         struct in6_addr *addr6 = &rr->aaaa.in6_addr;
1070                         r = json_build(&entry,
1071                                 JSON_BUILD_OBJECT(JSON_BUILD_PAIR_CONDITION(ifindex > 0, "ifindex", JSON_BUILD_INTEGER(ifindex)),
1072                                                   JSON_BUILD_PAIR_INTEGER("family", AF_INET6),
1073                                                   JSON_BUILD_PAIR_IN6_ADDR("address", addr6),
1074                                                   JSON_BUILD_PAIR_STRING("type", "AAAA")));
1075                 } else
1076                         continue;
1077                 if (r < 0) {
1078                         log_debug_errno(r, "Failed to build json object: %m");
1079                         continue;
1080                 }
1081
1082                 r = json_variant_append_array(&array, entry);
1083                 if (r < 0)
1084                         return log_debug_errno(r, "Failed to append notification entry to array: %m");
1085         }
1086
1087         if (json_variant_is_blank_object(array))
1088                 return 0;
1089
1090         r = dns_name_normalize(query_name, 0, &normalized);
1091         if (r < 0)
1092                 return log_debug_errno(r, "Failed to normalize query name: %m");
1093
1094         SET_FOREACH(connection, m->varlink_subscription) {
1095                 r = varlink_notifyb(connection,
1096                                     JSON_BUILD_OBJECT(JSON_BUILD_PAIR("addresses",
1097                                                       JSON_BUILD_VARIANT(array)),
1098                                                       JSON_BUILD_PAIR("name", JSON_BUILD_STRING(normalized))));
1099                 if (r < 0)
1100                         log_debug_errno(r, "Failed to send notification, ignoring: %m");
1101         }
1102         return 0;
1103 }
1104
1105 int manager_send(
1106                 Manager *m,
1107                 int fd,
1108                 int ifindex,
1109                 int family,
1110                 const union in_addr_union *destination,
1111                 uint16_t port,
1112                 const union in_addr_union *source,
1113                 DnsPacket *p) {
1114
1115         assert(m);
1116         assert(fd >= 0);
1117         assert(destination);
1118         assert(port > 0);
1119         assert(p);
1120
1121         log_debug("Sending %s%s packet with id %" PRIu16 " on interface %i/%s of size %zu.",
1122                   DNS_PACKET_TC(p) ? "truncated (!) " : "",
1123                   DNS_PACKET_QR(p) ? "response" : "query",
1124                   DNS_PACKET_ID(p),
1125                   ifindex, af_to_name(family),
1126                   p->size);
1127
1128         if (family == AF_INET)
1129                 return manager_ipv4_send(m, fd, ifindex, &destination->in, port, source ? &source->in : NULL, p);
1130         if (family == AF_INET6)
1131                 return manager_ipv6_send(m, fd, ifindex, &destination->in6, port, source ? &source->in6 : NULL, p);
1132
1133         return -EAFNOSUPPORT;
1134 }
1135
1136 uint32_t manager_find_mtu(Manager *m) {
1137         uint32_t mtu = 0;
1138         Link *l;
1139
1140         /* If we don't know on which link a DNS packet would be delivered, let's find the largest MTU that
1141          * works on all interfaces we know of that have an IP address associated */
1142
1143         HASHMAP_FOREACH(l, m->links) {
1144                 /* Let's filter out links without IP addresses (e.g. AF_CAN links and suchlike) */
1145                 if (!l->addresses)
1146                         continue;
1147
1148                 /* Safety check: MTU shorter than what we need for the absolutely shortest DNS request? Then
1149                  * let's ignore this link. */
1150                 if (l->mtu < MIN(UDP4_PACKET_HEADER_SIZE + DNS_PACKET_HEADER_SIZE,
1151                                  UDP6_PACKET_HEADER_SIZE + DNS_PACKET_HEADER_SIZE))
1152                         continue;
1153
1154                 if (mtu <= 0 || l->mtu < mtu)
1155                         mtu = l->mtu;
1156         }
1157
1158         if (mtu == 0) /* found nothing? then let's assume the typical Ethernet MTU for lack of anything more precise */
1159                 return 1500;
1160
1161         return mtu;
1162 }
1163
1164 int manager_find_ifindex(Manager *m, int family, const union in_addr_union *in_addr) {
1165         LinkAddress *a;
1166
1167         assert(m);
1168
1169         if (!IN_SET(family, AF_INET, AF_INET6))
1170                 return 0;
1171
1172         if (!in_addr)
1173                 return 0;
1174
1175         a = manager_find_link_address(m, family, in_addr);
1176         if (a)
1177                 return a->link->ifindex;
1178
1179         return 0;
1180 }
1181
1182 void manager_refresh_rrs(Manager *m) {
1183         Link *l;
1184         DnssdService *s;
1185
1186         assert(m);
1187
1188         m->llmnr_host_ipv4_key = dns_resource_key_unref(m->llmnr_host_ipv4_key);
1189         m->llmnr_host_ipv6_key = dns_resource_key_unref(m->llmnr_host_ipv6_key);
1190         m->mdns_host_ipv4_key = dns_resource_key_unref(m->mdns_host_ipv4_key);
1191         m->mdns_host_ipv6_key = dns_resource_key_unref(m->mdns_host_ipv6_key);
1192
1193         HASHMAP_FOREACH(l, m->links)
1194                 link_add_rrs(l, true);
1195
1196         if (m->mdns_support == RESOLVE_SUPPORT_YES)
1197                 HASHMAP_FOREACH(s, m->dnssd_services)
1198                         if (dnssd_update_rrs(s) < 0)
1199                                 log_warning("Failed to refresh DNS-SD service '%s'", s->name);
1200
1201         HASHMAP_FOREACH(l, m->links)
1202                 link_add_rrs(l, false);
1203 }
1204
1205 static int manager_next_random_name(const char *old, char **ret_new) {
1206         const char *p;
1207         uint64_t u, a;
1208         char *n;
1209
1210         p = strchr(old, 0);
1211         assert(p);
1212
1213         while (p > old) {
1214                 if (!ascii_isdigit(p[-1]))
1215                         break;
1216
1217                 p--;
1218         }
1219
1220         if (*p == 0 || safe_atou64(p, &u) < 0 || u <= 0)
1221                 u = 1;
1222
1223         /* Add a random number to the old value. This way we can avoid
1224          * that two hosts pick the same hostname, win on IPv4 and lose
1225          * on IPv6 (or vice versa), and pick the same hostname
1226          * replacement hostname, ad infinitum. We still want the
1227          * numbers to go up monotonically, hence we just add a random
1228          * value 1..10 */
1229
1230         random_bytes(&a, sizeof(a));
1231         u += 1 + a % 10;
1232
1233         if (asprintf(&n, "%.*s%" PRIu64, (int) (p - old), old, u) < 0)
1234                 return -ENOMEM;
1235
1236         *ret_new = n;
1237
1238         return 0;
1239 }
1240
1241 int manager_next_hostname(Manager *m) {
1242         _cleanup_free_ char *h = NULL, *k = NULL;
1243         int r;
1244
1245         assert(m);
1246
1247         r = manager_next_random_name(m->llmnr_hostname, &h);
1248         if (r < 0)
1249                 return r;
1250
1251         r = dns_name_concat(h, "local", 0, &k);
1252         if (r < 0)
1253                 return r;
1254
1255         log_info("Hostname conflict, changing published hostname from '%s' to '%s'.", m->llmnr_hostname, h);
1256
1257         free_and_replace(m->llmnr_hostname, h);
1258         free_and_replace(m->mdns_hostname, k);
1259
1260         manager_refresh_rrs(m);
1261         (void) manager_send_changed(m, "LLMNRHostname");
1262
1263         return 0;
1264 }
1265
1266 LinkAddress* manager_find_link_address(Manager *m, int family, const union in_addr_union *in_addr) {
1267         Link *l;
1268
1269         assert(m);
1270
1271         if (!IN_SET(family, AF_INET, AF_INET6))
1272                 return NULL;
1273
1274         if (!in_addr)
1275                 return NULL;
1276
1277         HASHMAP_FOREACH(l, m->links) {
1278                 LinkAddress *a;
1279
1280                 a = link_find_address(l, family, in_addr);
1281                 if (a)
1282                         return a;
1283         }
1284
1285         return NULL;
1286 }
1287
1288 bool manager_packet_from_local_address(Manager *m, DnsPacket *p) {
1289         assert(m);
1290         assert(p);
1291
1292         /* Let's see if this packet comes from an IP address we have on any local interface */
1293
1294         return !!manager_find_link_address(m, p->family, &p->sender);
1295 }
1296
1297 bool manager_packet_from_our_transaction(Manager *m, DnsPacket *p) {
1298         DnsTransaction *t;
1299
1300         assert(m);
1301         assert(p);
1302
1303         /* Let's see if we have a transaction with a query message with the exact same binary contents as the
1304          * one we just got. If so, it's almost definitely a packet loop of some kind. */
1305
1306         t = hashmap_get(m->dns_transactions, UINT_TO_PTR(DNS_PACKET_ID(p)));
1307         if (!t)
1308                 return false;
1309
1310         return t->sent && dns_packet_equal(t->sent, p);
1311 }
1312
1313 DnsScope* manager_find_scope(Manager *m, DnsPacket *p) {
1314         Link *l;
1315
1316         assert(m);
1317         assert(p);
1318
1319         l = hashmap_get(m->links, INT_TO_PTR(p->ifindex));
1320         if (!l)
1321                 return NULL;
1322
1323         switch (p->protocol) {
1324         case DNS_PROTOCOL_LLMNR:
1325                 if (p->family == AF_INET)
1326                         return l->llmnr_ipv4_scope;
1327                 else if (p->family == AF_INET6)
1328                         return l->llmnr_ipv6_scope;
1329
1330                 break;
1331
1332         case DNS_PROTOCOL_MDNS:
1333                 if (p->family == AF_INET)
1334                         return l->mdns_ipv4_scope;
1335                 else if (p->family == AF_INET6)
1336                         return l->mdns_ipv6_scope;
1337
1338                 break;
1339
1340         default:
1341                 break;
1342         }
1343
1344         return NULL;
1345 }
1346
1347 void manager_verify_all(Manager *m) {
1348         assert(m);
1349
1350         LIST_FOREACH(scopes, s, m->dns_scopes)
1351                 dns_zone_verify_all(&s->zone);
1352 }
1353
1354 int manager_is_own_hostname(Manager *m, const char *name) {
1355         int r;
1356
1357         assert(m);
1358         assert(name);
1359
1360         if (m->llmnr_hostname) {
1361                 r = dns_name_equal(name, m->llmnr_hostname);
1362                 if (r != 0)
1363                         return r;
1364         }
1365
1366         if (m->mdns_hostname) {
1367                 r = dns_name_equal(name, m->mdns_hostname);
1368                 if (r != 0)
1369                         return r;
1370         }
1371
1372         if (m->full_hostname)
1373                 return dns_name_equal(name, m->full_hostname);
1374
1375         return 0;
1376 }
1377
1378 int manager_compile_dns_servers(Manager *m, OrderedSet **dns) {
1379         Link *l;
1380         int r;
1381
1382         assert(m);
1383         assert(dns);
1384
1385         r = ordered_set_ensure_allocated(dns, &dns_server_hash_ops);
1386         if (r < 0)
1387                 return r;
1388
1389         /* First add the system-wide servers and domains */
1390         LIST_FOREACH(servers, s, m->dns_servers) {
1391                 r = ordered_set_put(*dns, s);
1392                 if (r == -EEXIST)
1393                         continue;
1394                 if (r < 0)
1395                         return r;
1396         }
1397
1398         /* Then, add the per-link servers */
1399         HASHMAP_FOREACH(l, m->links) {
1400                 LIST_FOREACH(servers, s, l->dns_servers) {
1401                         r = ordered_set_put(*dns, s);
1402                         if (r == -EEXIST)
1403                                 continue;
1404                         if (r < 0)
1405                                 return r;
1406                 }
1407         }
1408
1409         /* If we found nothing, add the fallback servers */
1410         if (ordered_set_isempty(*dns)) {
1411                 LIST_FOREACH(servers, s, m->fallback_dns_servers) {
1412                         r = ordered_set_put(*dns, s);
1413                         if (r == -EEXIST)
1414                                 continue;
1415                         if (r < 0)
1416                                 return r;
1417                 }
1418         }
1419
1420         return 0;
1421 }
1422
1423 /* filter_route is a tri-state:
1424  *   < 0: no filtering
1425  *   = 0 or false: return only domains which should be used for searching
1426  *   > 0 or true: return only domains which are for routing only
1427  */
1428 int manager_compile_search_domains(Manager *m, OrderedSet **domains, int filter_route) {
1429         Link *l;
1430         int r;
1431
1432         assert(m);
1433         assert(domains);
1434
1435         r = ordered_set_ensure_allocated(domains, &dns_name_hash_ops);
1436         if (r < 0)
1437                 return r;
1438
1439         LIST_FOREACH(domains, d, m->search_domains) {
1440
1441                 if (filter_route >= 0 &&
1442                     d->route_only != !!filter_route)
1443                         continue;
1444
1445                 r = ordered_set_put(*domains, d->name);
1446                 if (r == -EEXIST)
1447                         continue;
1448                 if (r < 0)
1449                         return r;
1450         }
1451
1452         HASHMAP_FOREACH(l, m->links) {
1453
1454                 LIST_FOREACH(domains, d, l->search_domains) {
1455
1456                         if (filter_route >= 0 &&
1457                             d->route_only != !!filter_route)
1458                                 continue;
1459
1460                         r = ordered_set_put(*domains, d->name);
1461                         if (r == -EEXIST)
1462                                 continue;
1463                         if (r < 0)
1464                                 return r;
1465                 }
1466         }
1467
1468         return 0;
1469 }
1470
1471 DnssecMode manager_get_dnssec_mode(Manager *m) {
1472         assert(m);
1473
1474         if (m->dnssec_mode != _DNSSEC_MODE_INVALID)
1475                 return m->dnssec_mode;
1476
1477         return DNSSEC_NO;
1478 }
1479
1480 bool manager_dnssec_supported(Manager *m) {
1481         DnsServer *server;
1482         Link *l;
1483
1484         assert(m);
1485
1486         if (manager_get_dnssec_mode(m) == DNSSEC_NO)
1487                 return false;
1488
1489         server = manager_get_dns_server(m);
1490         if (server && !dns_server_dnssec_supported(server))
1491                 return false;
1492
1493         HASHMAP_FOREACH(l, m->links)
1494                 if (!link_dnssec_supported(l))
1495                         return false;
1496
1497         return true;
1498 }
1499
1500 DnsOverTlsMode manager_get_dns_over_tls_mode(Manager *m) {
1501         assert(m);
1502
1503         if (m->dns_over_tls_mode != _DNS_OVER_TLS_MODE_INVALID)
1504                 return m->dns_over_tls_mode;
1505
1506         return DNS_OVER_TLS_NO;
1507 }
1508
1509 void manager_dnssec_verdict(Manager *m, DnssecVerdict verdict, const DnsResourceKey *key) {
1510
1511         assert(verdict >= 0);
1512         assert(verdict < _DNSSEC_VERDICT_MAX);
1513
1514         if (DEBUG_LOGGING) {
1515                 char s[DNS_RESOURCE_KEY_STRING_MAX];
1516
1517                 log_debug("Found verdict for lookup %s: %s",
1518                           dns_resource_key_to_string(key, s, sizeof s),
1519                           dnssec_verdict_to_string(verdict));
1520         }
1521
1522         m->n_dnssec_verdict[verdict]++;
1523 }
1524
1525 bool manager_routable(Manager *m) {
1526         Link *l;
1527
1528         assert(m);
1529
1530         /* Returns true if the host has at least one interface with a routable address (regardless if IPv4 or IPv6) */
1531
1532         HASHMAP_FOREACH(l, m->links)
1533                 if (link_relevant(l, AF_UNSPEC, false))
1534                         return true;
1535
1536         return false;
1537 }
1538
1539 void manager_flush_caches(Manager *m, int log_level) {
1540         assert(m);
1541
1542         LIST_FOREACH(scopes, scope, m->dns_scopes)
1543                 dns_cache_flush(&scope->cache);
1544
1545         log_full(log_level, "Flushed all caches.");
1546 }
1547
1548 void manager_reset_server_features(Manager *m) {
1549         Link *l;
1550
1551         dns_server_reset_features_all(m->dns_servers);
1552         dns_server_reset_features_all(m->fallback_dns_servers);
1553
1554         HASHMAP_FOREACH(l, m->links)
1555                 dns_server_reset_features_all(l->dns_servers);
1556
1557         log_info("Resetting learnt feature levels on all servers.");
1558 }
1559
1560 void manager_cleanup_saved_user(Manager *m) {
1561         _cleanup_closedir_ DIR *d = NULL;
1562
1563         assert(m);
1564
1565         /* Clean up all saved per-link files in /run/systemd/resolve/netif/ that don't have a matching interface
1566          * anymore. These files are created to persist settings pushed in by the user via the bus, so that resolved can
1567          * be restarted without losing this data. */
1568
1569         d = opendir("/run/systemd/resolve/netif/");
1570         if (!d) {
1571                 if (errno == ENOENT)
1572                         return;
1573
1574                 log_warning_errno(errno, "Failed to open interface directory: %m");
1575                 return;
1576         }
1577
1578         FOREACH_DIRENT_ALL(de, d, log_error_errno(errno, "Failed to read interface directory: %m")) {
1579                 _cleanup_free_ char *p = NULL;
1580                 int ifindex;
1581                 Link *l;
1582
1583                 if (!IN_SET(de->d_type, DT_UNKNOWN, DT_REG))
1584                         continue;
1585
1586                 if (dot_or_dot_dot(de->d_name))
1587                         continue;
1588
1589                 ifindex = parse_ifindex(de->d_name);
1590                 if (ifindex < 0) /* Probably some temporary file from a previous run. Delete it */
1591                         goto rm;
1592
1593                 l = hashmap_get(m->links, INT_TO_PTR(ifindex));
1594                 if (!l) /* link vanished */
1595                         goto rm;
1596
1597                 if (l->is_managed) /* now managed by networkd, hence the bus settings are useless */
1598                         goto rm;
1599
1600                 continue;
1601
1602         rm:
1603                 p = path_join("/run/systemd/resolve/netif", de->d_name);
1604                 if (!p) {
1605                         log_oom();
1606                         return;
1607                 }
1608
1609                 (void) unlink(p);
1610         }
1611 }
1612
1613 bool manager_next_dnssd_names(Manager *m) {
1614         DnssdService *s;
1615         bool tried = false;
1616         int r;
1617
1618         assert(m);
1619
1620         HASHMAP_FOREACH(s, m->dnssd_services) {
1621                 _cleanup_free_ char * new_name = NULL;
1622
1623                 if (!s->withdrawn)
1624                         continue;
1625
1626                 r = manager_next_random_name(s->name_template, &new_name);
1627                 if (r < 0) {
1628                         log_warning_errno(r, "Failed to get new name for service '%s': %m", s->name);
1629                         continue;
1630                 }
1631
1632                 free_and_replace(s->name_template, new_name);
1633
1634                 s->withdrawn = false;
1635
1636                 tried = true;
1637         }
1638
1639         if (tried)
1640                 manager_refresh_rrs(m);
1641
1642         return tried;
1643 }
1644
1645 bool manager_server_is_stub(Manager *m, DnsServer *s) {
1646         DnsStubListenerExtra *l;
1647
1648         assert(m);
1649         assert(s);
1650
1651         /* Safety check: we generally already skip the main stub when parsing configuration. But let's be
1652          * extra careful, and check here again */
1653         if (s->family == AF_INET &&
1654             s->address.in.s_addr == htobe32(INADDR_DNS_STUB) &&
1655             dns_server_port(s) == 53)
1656                 return true;
1657
1658         /* Main reason to call this is to check server data against the extra listeners, and filter things
1659          * out. */
1660         ORDERED_SET_FOREACH(l, m->dns_extra_stub_listeners)
1661                 if (s->family == l->family &&
1662                     in_addr_equal(s->family, &s->address, &l->address) &&
1663                     dns_server_port(s) == dns_stub_listener_extra_port(l))
1664                         return true;
1665
1666         return false;
1667 }
1668
1669 int socket_disable_pmtud(int fd, int af) {
1670         int r;
1671
1672         assert(fd >= 0);
1673
1674         if (af == AF_UNSPEC) {
1675                 r = socket_get_family(fd, &af);
1676                 if (r < 0)
1677                         return r;
1678         }
1679
1680         switch (af) {
1681
1682         case AF_INET: {
1683                 /* Turn off path MTU discovery, let's rather fragment on the way than to open us up against
1684                  * PMTU forgery vulnerabilities.
1685                  *
1686                  * There appears to be no documentation about IP_PMTUDISC_OMIT, but it has the effect that
1687                  * the "Don't Fragment" bit in the IPv4 header is turned off, thus enforcing fragmentation if
1688                  * our datagram size exceeds the MTU of a router in the path, and turning off path MTU
1689                  * discovery.
1690                  *
1691                  * This helps mitigating the PMTUD vulnerability described here:
1692                  *
1693                  * https://blog.apnic.net/2019/07/12/its-time-to-consider-avoiding-ip-fragmentation-in-the-dns/
1694                  *
1695                  * Similar logic is in place in most DNS servers.
1696                  *
1697                  * There are multiple conflicting goals: we want to allow the largest datagrams possible (for
1698                  * efficiency reasons), but not have fragmentation (for security reasons), nor use PMTUD (for
1699                  * security reasons, too). Our strategy to deal with this is: use large packets, turn off
1700                  * PMTUD, but watch fragmentation taking place, and then size our packets to the max of the
1701                  * fragments seen — and if we need larger packets always go to TCP.
1702                  */
1703
1704                 r = setsockopt_int(fd, IPPROTO_IP, IP_MTU_DISCOVER, IP_PMTUDISC_OMIT);
1705                 if (r < 0)
1706                         return r;
1707
1708                 return 0;
1709         }
1710
1711         case AF_INET6: {
1712                 /* On IPv6 fragmentation only is done by the sender — never by routers on the path. PMTUD is
1713                  * mandatory. If we want to turn off PMTUD, the only way is by sending with minimal MTU only,
1714                  * so that we apply maximum fragmentation locally already, and thus PMTUD doesn't happen
1715                  * because there's nothing that could be fragmented further anymore. */
1716
1717                 r = setsockopt_int(fd, IPPROTO_IPV6, IPV6_MTU, IPV6_MIN_MTU);
1718                 if (r < 0)
1719                         return r;
1720
1721                 return 0;
1722         }
1723
1724         default:
1725                 return -EAFNOSUPPORT;
1726         }
1727 }