src/resolve/resolved-mdns.c

   1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
   2
   3 #include <resolv.h>
   4 #include <netinet/in.h>
   5 #include <arpa/inet.h>
   6
   7 #include "alloc-util.h"
   8 #include "fd-util.h"
   9 #include "resolved-manager.h"
  10 #include "resolved-mdns.h"
  11 #include "sort-util.h"
  12
  13 #define CLEAR_CACHE_FLUSH(x) (~MDNS_RR_CACHE_FLUSH & (x))
  14
  15 void manager_mdns_stop(Manager *m) {
  16         assert(m);
  17
  18         m->mdns_ipv4_event_source = sd_event_source_disable_unref(m->mdns_ipv4_event_source);
  19         m->mdns_ipv4_fd = safe_close(m->mdns_ipv4_fd);
  20
  21         m->mdns_ipv6_event_source = sd_event_source_disable_unref(m->mdns_ipv6_event_source);
  22         m->mdns_ipv6_fd = safe_close(m->mdns_ipv6_fd);
  23 }
  24
  25 int manager_mdns_start(Manager *m) {
  26         int r;
  27
  28         assert(m);
  29
  30         if (m->mdns_support == RESOLVE_SUPPORT_NO)
  31                 return 0;
  32
  33         r = manager_mdns_ipv4_fd(m);
  34         if (r == -EADDRINUSE)
  35                 goto eaddrinuse;
  36         if (r < 0)
  37                 return r;
  38
  39         if (socket_ipv6_is_supported()) {
  40                 r = manager_mdns_ipv6_fd(m);
  41                 if (r == -EADDRINUSE)
  42                         goto eaddrinuse;
  43                 if (r < 0)
  44                         return r;
  45         }
  46
  47         return 0;
  48
  49 eaddrinuse:
  50         log_warning("Another mDNS responder prohibits binding the socket to the same port. Turning off mDNS support.");
  51         m->mdns_support = RESOLVE_SUPPORT_NO;
  52         manager_mdns_stop(m);
  53
  54         return 0;
  55 }
  56
  57 static int mdns_rr_compare(DnsResourceRecord * const *a, DnsResourceRecord * const *b) {
  58         DnsResourceRecord *x = *(DnsResourceRecord **) a, *y = *(DnsResourceRecord **) b;
  59         size_t m;
  60         int r;
  61
  62         assert(x);
  63         assert(y);
  64
  65         r = CMP(CLEAR_CACHE_FLUSH(x->key->class), CLEAR_CACHE_FLUSH(y->key->class));
  66         if (r != 0)
  67                 return r;
  68
  69         r = CMP(x->key->type, y->key->type);
  70         if (r != 0)
  71                 return r;
  72
  73         r = dns_resource_record_to_wire_format(x, false);
  74         if (r < 0) {
  75                 log_warning_errno(r, "Can't wire-format RR: %m");
  76                 return 0;
  77         }
  78
  79         r = dns_resource_record_to_wire_format(y, false);
  80         if (r < 0) {
  81                 log_warning_errno(r, "Can't wire-format RR: %m");
  82                 return 0;
  83         }
  84
  85         m = MIN(DNS_RESOURCE_RECORD_RDATA_SIZE(x), DNS_RESOURCE_RECORD_RDATA_SIZE(y));
  86
  87         r = memcmp(DNS_RESOURCE_RECORD_RDATA(x), DNS_RESOURCE_RECORD_RDATA(y), m);
  88         if (r != 0)
  89                 return r;
  90
  91         return CMP(DNS_RESOURCE_RECORD_RDATA_SIZE(x), DNS_RESOURCE_RECORD_RDATA_SIZE(y));
  92 }
  93
  94 static int proposed_rrs_cmp(DnsResourceRecord **x, unsigned x_size, DnsResourceRecord **y, unsigned y_size) {
  95         unsigned m;
  96         int r;
  97
  98         m = MIN(x_size, y_size);
  99         for (unsigned i = 0; i < m; i++) {
 100                 r = mdns_rr_compare(&x[i], &y[i]);
 101                 if (r != 0)
 102                         return r;
 103         }
 104
 105         return CMP(x_size, y_size);
 106 }
 107
 108 static int mdns_packet_extract_matching_rrs(DnsPacket *p, DnsResourceKey *key, DnsResourceRecord ***ret_rrs) {
 109         _cleanup_free_ DnsResourceRecord **list = NULL;
 110         unsigned n = 0, size = 0;
 111         int r;
 112
 113         assert(p);
 114         assert(key);
 115         assert(ret_rrs);
 116         assert_return(DNS_PACKET_NSCOUNT(p) > 0, -EINVAL);
 117
 118         for (size_t i = DNS_PACKET_ANCOUNT(p); i < (DNS_PACKET_ANCOUNT(p) + DNS_PACKET_NSCOUNT(p)); i++) {
 119                 r = dns_resource_key_match_rr(key, p->answer->items[i].rr, NULL);
 120                 if (r < 0)
 121                         return r;
 122                 if (r > 0)
 123                         size++;
 124         }
 125
 126         if (size == 0)
 127                 return 0;
 128
 129         list = new(DnsResourceRecord *, size);
 130         if (!list)
 131                 return -ENOMEM;
 132
 133         for (size_t i = DNS_PACKET_ANCOUNT(p); i < (DNS_PACKET_ANCOUNT(p) + DNS_PACKET_NSCOUNT(p)); i++) {
 134                 r = dns_resource_key_match_rr(key, p->answer->items[i].rr, NULL);
 135                 if (r < 0)
 136                         return r;
 137                 if (r > 0)
 138                         list[n++] = p->answer->items[i].rr;
 139         }
 140         assert(n == size);
 141         typesafe_qsort(list, size, mdns_rr_compare);
 142
 143         *ret_rrs = TAKE_PTR(list);
 144
 145         return size;
 146 }
 147
 148 static int mdns_do_tiebreak(DnsResourceKey *key, DnsAnswer *answer, DnsPacket *p) {
 149         _cleanup_free_ DnsResourceRecord **our = NULL, **remote = NULL;
 150         DnsResourceRecord *rr;
 151         size_t i = 0, size;
 152         int r;
 153
 154         size = dns_answer_size(answer);
 155         our = new(DnsResourceRecord *, size);
 156         if (!our)
 157                 return -ENOMEM;
 158
 159         DNS_ANSWER_FOREACH(rr, answer)
 160                 our[i++] = rr;
 161
 162         typesafe_qsort(our, size, mdns_rr_compare);
 163
 164         r = mdns_packet_extract_matching_rrs(p, key, &remote);
 165         if (r < 0)
 166                 return r;
 167
 168         assert(r > 0);
 169
 170         if (proposed_rrs_cmp(remote, r, our, size) > 0)
 171                 return 1;
 172
 173         return 0;
 174 }
 175
 176 static int mdns_scope_process_query(DnsScope *s, DnsPacket *p) {
 177         _cleanup_(dns_answer_unrefp) DnsAnswer *full_answer = NULL;
 178         _cleanup_(dns_packet_unrefp) DnsPacket *reply = NULL;
 179         DnsResourceKey *key = NULL;
 180         DnsResourceRecord *rr;
 181         bool tentative = false;
 182         int r;
 183
 184         assert(s);
 185         assert(p);
 186
 187         r = dns_packet_extract(p);
 188         if (r < 0)
 189                 return log_debug_errno(r, "Failed to extract resource records from incoming packet: %m");
 190
 191         assert_return((dns_question_size(p->question) > 0), -EINVAL);
 192
 193         DNS_QUESTION_FOREACH(key, p->question) {
 194                 _cleanup_(dns_answer_unrefp) DnsAnswer *answer = NULL, *soa = NULL;
 195
 196                 r = dns_zone_lookup(&s->zone, key, 0, &answer, &soa, &tentative);
 197                 if (r < 0)
 198                         return log_debug_errno(r, "Failed to look up key: %m");
 199
 200                 if (tentative && DNS_PACKET_NSCOUNT(p) > 0) {
 201                         /*
 202                          * A race condition detected with the probe packet from
 203                          * a remote host.
 204                          * Do simultaneous probe tiebreaking as described in
 205                          * RFC 6762, Section 8.2. In case we lost don't reply
 206                          * the question and withdraw conflicting RRs.
 207                          */
 208                         r = mdns_do_tiebreak(key, answer, p);
 209                         if (r < 0)
 210                                 return log_debug_errno(r, "Failed to do tiebreaking");
 211
 212                         if (r > 0) { /* we lost */
 213                                 DNS_ANSWER_FOREACH(rr, answer) {
 214                                         DnsZoneItem *i;
 215
 216                                         i = dns_zone_get(&s->zone, rr);
 217                                         if (i)
 218                                                 dns_zone_item_conflict(i);
 219                                 }
 220
 221                                 continue;
 222                         }
 223                 }
 224
 225                 r = dns_answer_extend(&full_answer, answer);
 226                 if (r < 0)
 227                         return log_debug_errno(r, "Failed to extend answer: %m");
 228         }
 229
 230         if (dns_answer_isempty(full_answer))
 231                 return 0;
 232
 233         r = dns_scope_make_reply_packet(s, DNS_PACKET_ID(p), DNS_RCODE_SUCCESS, NULL, full_answer, NULL, false, &reply);
 234         if (r < 0)
 235                 return log_debug_errno(r, "Failed to build reply packet: %m");
 236
 237         if (!ratelimit_below(&s->ratelimit))
 238                 return 0;
 239
 240         r = dns_scope_emit_udp(s, -1, AF_UNSPEC, reply);
 241         if (r < 0)
 242                 return log_debug_errno(r, "Failed to send reply packet: %m");
 243
 244         return 0;
 245 }
 246
 247 static int on_mdns_packet(sd_event_source *s, int fd, uint32_t revents, void *userdata) {
 248         _cleanup_(dns_packet_unrefp) DnsPacket *p = NULL;
 249         Manager *m = userdata;
 250         DnsScope *scope;
 251         int r;
 252
 253         r = manager_recv(m, fd, DNS_PROTOCOL_MDNS, &p);
 254         if (r <= 0)
 255                 return r;
 256
 257         if (manager_packet_from_local_address(m, p))
 258                 return 0;
 259
 260         scope = manager_find_scope(m, p);
 261         if (!scope) {
 262                 log_debug("Got mDNS UDP packet on unknown scope. Ignoring.");
 263                 return 0;
 264         }
 265
 266         if (dns_packet_validate_reply(p) > 0) {
 267                 DnsResourceRecord *rr;
 268
 269                 log_debug("Got mDNS reply packet");
 270
 271                 /*
 272                  * mDNS is different from regular DNS and LLMNR with regard to handling responses.
 273                  * While on other protocols, we can ignore every answer that doesn't match a question
 274                  * we broadcast earlier, RFC6762, section 18.1 recommends looking at and caching all
 275                  * incoming information, regardless of the DNS packet ID.
 276                  *
 277                  * Hence, extract the packet here, and try to find a transaction for answer the we got
 278                  * and complete it. Also store the new information in scope's cache.
 279                  */
 280                 r = dns_packet_extract(p);
 281                 if (r < 0) {
 282                         log_debug("mDNS packet extraction failed.");
 283                         return 0;
 284                 }
 285
 286                 dns_scope_check_conflicts(scope, p);
 287
 288                 DNS_ANSWER_FOREACH(rr, p->answer) {
 289                         const char *name = dns_resource_key_name(rr->key);
 290                         DnsTransaction *t;
 291
 292                         /* If the received reply packet contains ANY record that is not .local
 293                          * or .in-addr.arpa or .ip6.arpa, we assume someone's playing tricks on
 294                          * us and discard the packet completely. */
 295                         if (!(dns_name_endswith(name, "in-addr.arpa") > 0 ||
 296                               dns_name_endswith(name, "ip6.arpa") > 0 ||
 297                               dns_name_endswith(name, "local") > 0))
 298                                 return 0;
 299
 300                         if (rr->ttl == 0) {
 301                                 log_debug("Got a goodbye packet");
 302                                 /* See the section 10.1 of RFC6762 */
 303                                 rr->ttl = 1;
 304                         }
 305
 306                         t = dns_scope_find_transaction(scope, rr->key, SD_RESOLVED_NO_CACHE|SD_RESOLVED_NO_ZONE);
 307                         if (t)
 308                                 dns_transaction_process_reply(t, p, false);
 309
 310                         /* Also look for the various types of ANY transactions */
 311                         t = dns_scope_find_transaction(scope, &DNS_RESOURCE_KEY_CONST(rr->key->class, DNS_TYPE_ANY, dns_resource_key_name(rr->key)), SD_RESOLVED_NO_CACHE|SD_RESOLVED_NO_ZONE);
 312                         if (t)
 313                                 dns_transaction_process_reply(t, p, false);
 314
 315                         t = dns_scope_find_transaction(scope, &DNS_RESOURCE_KEY_CONST(DNS_CLASS_ANY, rr->key->type, dns_resource_key_name(rr->key)), SD_RESOLVED_NO_CACHE|SD_RESOLVED_NO_ZONE);
 316                         if (t)
 317                                 dns_transaction_process_reply(t, p, false);
 318
 319                         t = dns_scope_find_transaction(scope, &DNS_RESOURCE_KEY_CONST(DNS_CLASS_ANY, DNS_TYPE_ANY, dns_resource_key_name(rr->key)), SD_RESOLVED_NO_CACHE|SD_RESOLVED_NO_ZONE);
 320                         if (t)
 321                                 dns_transaction_process_reply(t, p, false);
 322                 }
 323
 324                 dns_cache_put(&scope->cache, scope->manager->enable_cache, NULL, DNS_PACKET_RCODE(p), p->answer, NULL, false, _DNSSEC_RESULT_INVALID, (uint32_t) -1, p->family, &p->sender);
 325
 326         } else if (dns_packet_validate_query(p) > 0)  {
 327                 log_debug("Got mDNS query packet for id %u", DNS_PACKET_ID(p));
 328
 329                 r = mdns_scope_process_query(scope, p);
 330                 if (r < 0) {
 331                         log_debug_errno(r, "mDNS query processing failed: %m");
 332                         return 0;
 333                 }
 334         } else
 335                 log_debug("Invalid mDNS UDP packet.");
 336
 337         return 0;
 338 }
 339
 340 int manager_mdns_ipv4_fd(Manager *m) {
 341         union sockaddr_union sa = {
 342                 .in.sin_family = AF_INET,
 343                 .in.sin_port = htobe16(MDNS_PORT),
 344         };
 345         _cleanup_close_ int s = -1;
 346         int r;
 347
 348         assert(m);
 349
 350         if (m->mdns_ipv4_fd >= 0)
 351                 return m->mdns_ipv4_fd;
 352
 353         s = socket(AF_INET, SOCK_DGRAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0);
 354         if (s < 0)
 355                 return log_error_errno(errno, "mDNS-IPv4: Failed to create socket: %m");
 356
 357         r = setsockopt_int(s, IPPROTO_IP, IP_TTL, 255);
 358         if (r < 0)
 359                 return log_error_errno(r, "mDNS-IPv4: Failed to set IP_TTL: %m");
 360
 361         r = setsockopt_int(s, IPPROTO_IP, IP_MULTICAST_TTL, 255);
 362         if (r < 0)
 363                 return log_error_errno(r, "mDNS-IPv4: Failed to set IP_MULTICAST_TTL: %m");
 364
 365         r = setsockopt_int(s, IPPROTO_IP, IP_MULTICAST_LOOP, true);
 366         if (r < 0)
 367                 return log_error_errno(r, "mDNS-IPv4: Failed to set IP_MULTICAST_LOOP: %m");
 368
 369         r = setsockopt_int(s, IPPROTO_IP, IP_PKTINFO, true);
 370         if (r < 0)
 371                 return log_error_errno(r, "mDNS-IPv4: Failed to set IP_PKTINFO: %m");
 372
 373         r = setsockopt_int(s, IPPROTO_IP, IP_RECVTTL, true);
 374         if (r < 0)
 375                 return log_error_errno(r, "mDNS-IPv4: Failed to set IP_RECVTTL: %m");
 376
 377         /* Disable Don't-Fragment bit in the IP header */
 378         r = setsockopt_int(s, IPPROTO_IP, IP_MTU_DISCOVER, IP_PMTUDISC_DONT);
 379         if (r < 0)
 380                 return log_error_errno(r, "mDNS-IPv4: Failed to set IP_MTU_DISCOVER: %m");
 381
 382         /* See the section 15.1 of RFC6762 */
 383         /* first try to bind without SO_REUSEADDR to detect another mDNS responder */
 384         r = bind(s, &sa.sa, sizeof(sa.in));
 385         if (r < 0) {
 386                 if (errno != EADDRINUSE)
 387                         return log_error_errno(errno, "mDNS-IPv4: Failed to bind socket: %m");
 388
 389                 log_warning("mDNS-IPv4: There appears to be another mDNS responder running, or previously systemd-resolved crashed with some outstanding transfers.");
 390
 391                 /* try again with SO_REUSEADDR */
 392                 r = setsockopt_int(s, SOL_SOCKET, SO_REUSEADDR, true);
 393                 if (r < 0)
 394                         return log_error_errno(r, "mDNS-IPv4: Failed to set SO_REUSEADDR: %m");
 395
 396                 r = bind(s, &sa.sa, sizeof(sa.in));
 397                 if (r < 0)
 398                         return log_error_errno(errno, "mDNS-IPv4: Failed to bind socket: %m");
 399         } else {
 400                 /* enable SO_REUSEADDR for the case that the user really wants multiple mDNS responders */
 401                 r = setsockopt_int(s, SOL_SOCKET, SO_REUSEADDR, true);
 402                 if (r < 0)
 403                         return log_error_errno(r, "mDNS-IPv4: Failed to set SO_REUSEADDR: %m");
 404         }
 405
 406         r = sd_event_add_io(m->event, &m->mdns_ipv4_event_source, s, EPOLLIN, on_mdns_packet, m);
 407         if (r < 0)
 408                 return log_error_errno(r, "mDNS-IPv4: Failed to create event source: %m");
 409
 410         return m->mdns_ipv4_fd = TAKE_FD(s);
 411 }
 412
 413 int manager_mdns_ipv6_fd(Manager *m) {
 414         union sockaddr_union sa = {
 415                 .in6.sin6_family = AF_INET6,
 416                 .in6.sin6_port = htobe16(MDNS_PORT),
 417         };
 418         _cleanup_close_ int s = -1;
 419         int r;
 420
 421         assert(m);
 422
 423         if (m->mdns_ipv6_fd >= 0)
 424                 return m->mdns_ipv6_fd;
 425
 426         s = socket(AF_INET6, SOCK_DGRAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0);
 427         if (s < 0)
 428                 return log_error_errno(errno, "mDNS-IPv6: Failed to create socket: %m");
 429
 430         r = setsockopt_int(s, IPPROTO_IPV6, IPV6_UNICAST_HOPS, 255);
 431         if (r < 0)
 432                 return log_error_errno(r, "mDNS-IPv6: Failed to set IPV6_UNICAST_HOPS: %m");
 433
 434         /* RFC 4795, section 2.5 recommends setting the TTL of UDP packets to 255. */
 435         r = setsockopt_int(s, IPPROTO_IPV6, IPV6_MULTICAST_HOPS, 255);
 436         if (r < 0)
 437                 return log_error_errno(r, "mDNS-IPv6: Failed to set IPV6_MULTICAST_HOPS: %m");
 438
 439         r = setsockopt_int(s, IPPROTO_IPV6, IPV6_MULTICAST_LOOP, true);
 440         if (r < 0)
 441                 return log_error_errno(r, "mDNS-IPv6: Failed to set IPV6_MULTICAST_LOOP: %m");
 442
 443         r = setsockopt_int(s, IPPROTO_IPV6, IPV6_V6ONLY, true);
 444         if (r < 0)
 445                 return log_error_errno(r, "mDNS-IPv6: Failed to set IPV6_V6ONLY: %m");
 446
 447         r = setsockopt_int(s, IPPROTO_IPV6, IPV6_RECVPKTINFO, true);
 448         if (r < 0)
 449                 return log_error_errno(r, "mDNS-IPv6: Failed to set IPV6_RECVPKTINFO: %m");
 450
 451         r = setsockopt_int(s, IPPROTO_IPV6, IPV6_RECVHOPLIMIT, true);
 452         if (r < 0)
 453                 return log_error_errno(r, "mDNS-IPv6: Failed to set IPV6_RECVHOPLIMIT: %m");
 454
 455         /* See the section 15.1 of RFC6762 */
 456         /* first try to bind without SO_REUSEADDR to detect another mDNS responder */
 457         r = bind(s, &sa.sa, sizeof(sa.in6));
 458         if (r < 0) {
 459                 if (errno != EADDRINUSE)
 460                         return log_error_errno(errno, "mDNS-IPv6: Failed to bind socket: %m");
 461
 462                 log_warning("mDNS-IPv6: There appears to be another mDNS responder running, or previously systemd-resolved crashed with some outstanding transfers.");
 463
 464                 /* try again with SO_REUSEADDR */
 465                 r = setsockopt_int(s, SOL_SOCKET, SO_REUSEADDR, true);
 466                 if (r < 0)
 467                         return log_error_errno(r, "mDNS-IPv6: Failed to set SO_REUSEADDR: %m");
 468
 469                 r = bind(s, &sa.sa, sizeof(sa.in6));
 470                 if (r < 0)
 471                         return log_error_errno(errno, "mDNS-IPv6: Failed to bind socket: %m");
 472         } else {
 473                 /* enable SO_REUSEADDR for the case that the user really wants multiple mDNS responders */
 474                 r = setsockopt_int(s, SOL_SOCKET, SO_REUSEADDR, true);
 475                 if (r < 0)
 476                         return log_error_errno(r, "mDNS-IPv6: Failed to set SO_REUSEADDR: %m");
 477         }
 478
 479         r = sd_event_add_io(m->event, &m->mdns_ipv6_event_source, s, EPOLLIN, on_mdns_packet, m);
 480         if (r < 0)
 481                 return log_error_errno(r, "mDNS-IPv6: Failed to create event source: %m");
 482
 483         return m->mdns_ipv6_fd = TAKE_FD(s);
 484 }