[thirdparty/systemd.git] / src / resolve / resolved-mdns.c

/* SPDX-License-Identifier: LGPL-2.1-or-later */

#include <resolv.h>
#include <netinet/in.h>
#include <arpa/inet.h>

#include "alloc-util.h"
#include "fd-util.h"
#include "resolved-manager.h"
#include "resolved-mdns.h"
#include "sort-util.h"

#define CLEAR_CACHE_FLUSH(x) (~MDNS_RR_CACHE_FLUSH & (x))

void manager_mdns_stop(Manager *m) {
        assert(m);

        m->mdns_ipv4_event_source = sd_event_source_unref(m->mdns_ipv4_event_source);
        m->mdns_ipv4_fd = safe_close(m->mdns_ipv4_fd);

        m->mdns_ipv6_event_source = sd_event_source_unref(m->mdns_ipv6_event_source);
        m->mdns_ipv6_fd = safe_close(m->mdns_ipv6_fd);
}

int manager_mdns_start(Manager *m) {
        int r;

        assert(m);

        if (m->mdns_support == RESOLVE_SUPPORT_NO)
                return 0;

        r = manager_mdns_ipv4_fd(m);
        if (r == -EADDRINUSE)
                goto eaddrinuse;
        if (r < 0)
                return r;

        if (socket_ipv6_is_supported()) {
                r = manager_mdns_ipv6_fd(m);
                if (r == -EADDRINUSE)
                        goto eaddrinuse;
                if (r < 0)
                        return r;
        }

        return 0;

eaddrinuse:
        log_warning("Another mDNS responder prohibits binding the socket to the same port. Turning off mDNS support.");
        m->mdns_support = RESOLVE_SUPPORT_NO;
        manager_mdns_stop(m);

        return 0;
}

static int mdns_rr_compare(DnsResourceRecord * const *a, DnsResourceRecord * const *b) {
        DnsResourceRecord *x = *(DnsResourceRecord **) a, *y = *(DnsResourceRecord **) b;
        size_t m;
        int r;

        assert(x);
        assert(y);

        r = CMP(CLEAR_CACHE_FLUSH(x->key->class), CLEAR_CACHE_FLUSH(y->key->class));
        if (r != 0)
                return r;

        r = CMP(x->key->type, y->key->type);
        if (r != 0)
                return r;

        r = dns_resource_record_to_wire_format(x, false);
        if (r < 0) {
                log_warning_errno(r, "Can't wire-format RR: %m");
                return 0;
        }

        r = dns_resource_record_to_wire_format(y, false);
        if (r < 0) {
                log_warning_errno(r, "Can't wire-format RR: %m");
                return 0;
        }

        m = MIN(DNS_RESOURCE_RECORD_RDATA_SIZE(x), DNS_RESOURCE_RECORD_RDATA_SIZE(y));

        r = memcmp(DNS_RESOURCE_RECORD_RDATA(x), DNS_RESOURCE_RECORD_RDATA(y), m);
        if (r != 0)
                return r;

        return CMP(DNS_RESOURCE_RECORD_RDATA_SIZE(x), DNS_RESOURCE_RECORD_RDATA_SIZE(y));
}

static int proposed_rrs_cmp(DnsResourceRecord **x, unsigned x_size, DnsResourceRecord **y, unsigned y_size) {
        unsigned m;
        int r;

        m = MIN(x_size, y_size);
        for (unsigned i = 0; i < m; i++) {
                r = mdns_rr_compare(&x[i], &y[i]);
                if (r != 0)
                        return r;
        }

        return CMP(x_size, y_size);
}

static int mdns_packet_extract_matching_rrs(DnsPacket *p, DnsResourceKey *key, DnsResourceRecord ***ret_rrs) {
        _cleanup_free_ DnsResourceRecord **list = NULL;
        unsigned n = 0, size = 0;
        int r;

        assert(p);
        assert(key);
        assert(ret_rrs);
        assert_return(DNS_PACKET_NSCOUNT(p) > 0, -EINVAL);

        for (size_t i = DNS_PACKET_ANCOUNT(p); i < (DNS_PACKET_ANCOUNT(p) + DNS_PACKET_NSCOUNT(p)); i++) {
                r = dns_resource_key_match_rr(key, p->answer->items[i].rr, NULL);
                if (r < 0)
                        return r;
                if (r > 0)
                        size++;
        }

        if (size == 0)
                return 0;

        list = new(DnsResourceRecord *, size);
        if (!list)
                return -ENOMEM;

        for (size_t i = DNS_PACKET_ANCOUNT(p); i < (DNS_PACKET_ANCOUNT(p) + DNS_PACKET_NSCOUNT(p)); i++) {
                r = dns_resource_key_match_rr(key, p->answer->items[i].rr, NULL);
                if (r < 0)
                        return r;
                if (r > 0)
                        list[n++] = p->answer->items[i].rr;
        }
        assert(n == size);
        typesafe_qsort(list, size, mdns_rr_compare);

        *ret_rrs = TAKE_PTR(list);

        return size;
}

static int mdns_do_tiebreak(DnsResourceKey *key, DnsAnswer *answer, DnsPacket *p) {
        _cleanup_free_ DnsResourceRecord **our = NULL, **remote = NULL;
        DnsResourceRecord *rr;
        size_t i = 0, size;
        int r;

        size = dns_answer_size(answer);
        our = new(DnsResourceRecord *, size);
        if (!our)
                return -ENOMEM;

        DNS_ANSWER_FOREACH(rr, answer)
                our[i++] = rr;

        typesafe_qsort(our, size, mdns_rr_compare);

        r = mdns_packet_extract_matching_rrs(p, key, &remote);
        if (r < 0)
                return r;

        assert(r > 0);

        if (proposed_rrs_cmp(remote, r, our, size) > 0)
                return 1;

        return 0;
}

static int mdns_scope_process_query(DnsScope *s, DnsPacket *p) {
        _cleanup_(dns_answer_unrefp) DnsAnswer *full_answer = NULL;
        _cleanup_(dns_packet_unrefp) DnsPacket *reply = NULL;
        DnsResourceKey *key = NULL;
        DnsResourceRecord *rr;
        bool tentative = false;
        int r;

        assert(s);
        assert(p);

        r = dns_packet_extract(p);
        if (r < 0)
                return log_debug_errno(r, "Failed to extract resource records from incoming packet: %m");

        assert_return((dns_question_size(p->question) > 0), -EINVAL);

        DNS_QUESTION_FOREACH(key, p->question) {
                _cleanup_(dns_answer_unrefp) DnsAnswer *answer = NULL, *soa = NULL;

                r = dns_zone_lookup(&s->zone, key, 0, &answer, &soa, &tentative);
                if (r < 0)
                        return log_debug_errno(r, "Failed to look up key: %m");

                if (tentative && DNS_PACKET_NSCOUNT(p) > 0) {
                        /*
                         * A race condition detected with the probe packet from
                         * a remote host.
                         * Do simultaneous probe tiebreaking as described in
                         * RFC 6762, Section 8.2. In case we lost don't reply
                         * the question and withdraw conflicting RRs.
                         */
                        r = mdns_do_tiebreak(key, answer, p);
                        if (r < 0)
                                return log_debug_errno(r, "Failed to do tiebreaking");

                        if (r > 0) { /* we lost */
                                DNS_ANSWER_FOREACH(rr, answer) {
                                        DnsZoneItem *i;

                                        i = dns_zone_get(&s->zone, rr);
                                        if (i)
                                                dns_zone_item_conflict(i);
                                }

                                continue;
                        }
                }

                r = dns_answer_extend(&full_answer, answer);
                if (r < 0)
                        return log_debug_errno(r, "Failed to extend answer: %m");
        }

        if (dns_answer_isempty(full_answer))
                return 0;

        r = dns_scope_make_reply_packet(s, DNS_PACKET_ID(p), DNS_RCODE_SUCCESS, NULL, full_answer, NULL, false, &reply);
        if (r < 0)
                return log_debug_errno(r, "Failed to build reply packet: %m");

        if (!ratelimit_below(&s->ratelimit))
                return 0;

        r = dns_scope_emit_udp(s, -1, reply);
        if (r < 0)
                return log_debug_errno(r, "Failed to send reply packet: %m");

        return 0;
}

static int on_mdns_packet(sd_event_source *s, int fd, uint32_t revents, void *userdata) {
        _cleanup_(dns_packet_unrefp) DnsPacket *p = NULL;
        Manager *m = userdata;
        DnsScope *scope;
        int r;

        r = manager_recv(m, fd, DNS_PROTOCOL_MDNS, &p);
        if (r <= 0)
                return r;

        if (manager_packet_from_local_address(m, p))
                return 0;

        scope = manager_find_scope(m, p);
        if (!scope) {
                log_debug("Got mDNS UDP packet on unknown scope. Ignoring.");
                return 0;
        }

        if (dns_packet_validate_reply(p) > 0) {
                DnsResourceRecord *rr;

                log_debug("Got mDNS reply packet");

                /*
                 * mDNS is different from regular DNS and LLMNR with regard to handling responses.
                 * While on other protocols, we can ignore every answer that doesn't match a question
                 * we broadcast earlier, RFC6762, section 18.1 recommends looking at and caching all
                 * incoming information, regardless of the DNS packet ID.
                 *
                 * Hence, extract the packet here, and try to find a transaction for answer the we got
                 * and complete it. Also store the new information in scope's cache.
                 */
                r = dns_packet_extract(p);
                if (r < 0) {
                        log_debug("mDNS packet extraction failed.");
                        return 0;
                }

                dns_scope_check_conflicts(scope, p);

                DNS_ANSWER_FOREACH(rr, p->answer) {
                        const char *name = dns_resource_key_name(rr->key);
                        DnsTransaction *t;

                        /* If the received reply packet contains ANY record that is not .local or .in-addr.arpa,
                         * we assume someone's playing tricks on us and discard the packet completely. */
                        if (!(dns_name_endswith(name, "in-addr.arpa") > 0 ||
                              dns_name_endswith(name, "local") > 0))
                                return 0;

                        if (rr->ttl == 0) {
                                log_debug("Got a goodbye packet");
                                /* See the section 10.1 of RFC6762 */
                                rr->ttl = 1;
                        }

                        t = dns_scope_find_transaction(scope, rr->key, SD_RESOLVED_NO_CACHE|SD_RESOLVED_NO_ZONE);
                        if (t)
                                dns_transaction_process_reply(t, p);

                        /* Also look for the various types of ANY transactions */
                        t = dns_scope_find_transaction(scope, &DNS_RESOURCE_KEY_CONST(rr->key->class, DNS_TYPE_ANY, dns_resource_key_name(rr->key)), SD_RESOLVED_NO_CACHE|SD_RESOLVED_NO_ZONE);
                        if (t)
                                dns_transaction_process_reply(t, p);

                        t = dns_scope_find_transaction(scope, &DNS_RESOURCE_KEY_CONST(DNS_CLASS_ANY, rr->key->type, dns_resource_key_name(rr->key)), SD_RESOLVED_NO_CACHE|SD_RESOLVED_NO_ZONE);
                        if (t)
                                dns_transaction_process_reply(t, p);

                        t = dns_scope_find_transaction(scope, &DNS_RESOURCE_KEY_CONST(DNS_CLASS_ANY, DNS_TYPE_ANY, dns_resource_key_name(rr->key)), SD_RESOLVED_NO_CACHE|SD_RESOLVED_NO_ZONE);
                        if (t)
                                dns_transaction_process_reply(t, p);
                }

                dns_cache_put(&scope->cache, scope->manager->enable_cache, NULL, DNS_PACKET_RCODE(p), p->answer, NULL, false, _DNSSEC_RESULT_INVALID, (uint32_t) -1, p->family, &p->sender);

        } else if (dns_packet_validate_query(p) > 0)  {
                log_debug("Got mDNS query packet for id %u", DNS_PACKET_ID(p));

                r = mdns_scope_process_query(scope, p);
                if (r < 0) {
                        log_debug_errno(r, "mDNS query processing failed: %m");
                        return 0;
                }
        } else
                log_debug("Invalid mDNS UDP packet.");

        return 0;
}

int manager_mdns_ipv4_fd(Manager *m) {
        union sockaddr_union sa = {
                .in.sin_family = AF_INET,
                .in.sin_port = htobe16(MDNS_PORT),
        };
        _cleanup_close_ int s = -1;
        int r;

        assert(m);

        if (m->mdns_ipv4_fd >= 0)
                return m->mdns_ipv4_fd;

        s = socket(AF_INET, SOCK_DGRAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0);
        if (s < 0)
                return log_error_errno(errno, "mDNS-IPv4: Failed to create socket: %m");

        r = setsockopt_int(s, IPPROTO_IP, IP_TTL, 255);
        if (r < 0)
                return log_error_errno(r, "mDNS-IPv4: Failed to set IP_TTL: %m");

        r = setsockopt_int(s, IPPROTO_IP, IP_MULTICAST_TTL, 255);
        if (r < 0)
                return log_error_errno(r, "mDNS-IPv4: Failed to set IP_MULTICAST_TTL: %m");

        r = setsockopt_int(s, IPPROTO_IP, IP_MULTICAST_LOOP, true);
        if (r < 0)
                return log_error_errno(r, "mDNS-IPv4: Failed to set IP_MULTICAST_LOOP: %m");

        r = setsockopt_int(s, IPPROTO_IP, IP_PKTINFO, true);
        if (r < 0)
                return log_error_errno(r, "mDNS-IPv4: Failed to set IP_PKTINFO: %m");

        r = setsockopt_int(s, IPPROTO_IP, IP_RECVTTL, true);
        if (r < 0)
                return log_error_errno(r, "mDNS-IPv4: Failed to set IP_RECVTTL: %m");

        /* Disable Don't-Fragment bit in the IP header */
        r = setsockopt_int(s, IPPROTO_IP, IP_MTU_DISCOVER, IP_PMTUDISC_DONT);
        if (r < 0)
                return log_error_errno(r, "mDNS-IPv4: Failed to set IP_MTU_DISCOVER: %m");

        /* See the section 15.1 of RFC6762 */
        /* first try to bind without SO_REUSEADDR to detect another mDNS responder */
        r = bind(s, &sa.sa, sizeof(sa.in));
        if (r < 0) {
                if (errno != EADDRINUSE)
                        return log_error_errno(errno, "mDNS-IPv4: Failed to bind socket: %m");

                log_warning("mDNS-IPv4: There appears to be another mDNS responder running, or previously systemd-resolved crashed with some outstanding transfers.");

                /* try again with SO_REUSEADDR */
                r = setsockopt_int(s, SOL_SOCKET, SO_REUSEADDR, true);
                if (r < 0)
                        return log_error_errno(r, "mDNS-IPv4: Failed to set SO_REUSEADDR: %m");

                r = bind(s, &sa.sa, sizeof(sa.in));
                if (r < 0)
                        return log_error_errno(errno, "mDNS-IPv4: Failed to bind socket: %m");
        } else {
                /* enable SO_REUSEADDR for the case that the user really wants multiple mDNS responders */
                r = setsockopt_int(s, SOL_SOCKET, SO_REUSEADDR, true);
                if (r < 0)
                        return log_error_errno(r, "mDNS-IPv4: Failed to set SO_REUSEADDR: %m");
        }

        r = sd_event_add_io(m->event, &m->mdns_ipv4_event_source, s, EPOLLIN, on_mdns_packet, m);
        if (r < 0)
                return log_error_errno(r, "mDNS-IPv4: Failed to create event source: %m");

        return m->mdns_ipv4_fd = TAKE_FD(s);
}

int manager_mdns_ipv6_fd(Manager *m) {
        union sockaddr_union sa = {
                .in6.sin6_family = AF_INET6,
                .in6.sin6_port = htobe16(MDNS_PORT),
        };
        _cleanup_close_ int s = -1;
        int r;

        assert(m);

        if (m->mdns_ipv6_fd >= 0)
                return m->mdns_ipv6_fd;

        s = socket(AF_INET6, SOCK_DGRAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0);
        if (s < 0)
                return log_error_errno(errno, "mDNS-IPv6: Failed to create socket: %m");

        r = setsockopt_int(s, IPPROTO_IPV6, IPV6_UNICAST_HOPS, 255);
        if (r < 0)
                return log_error_errno(r, "mDNS-IPv6: Failed to set IPV6_UNICAST_HOPS: %m");

        /* RFC 4795, section 2.5 recommends setting the TTL of UDP packets to 255. */
        r = setsockopt_int(s, IPPROTO_IPV6, IPV6_MULTICAST_HOPS, 255);
        if (r < 0)
                return log_error_errno(r, "mDNS-IPv6: Failed to set IPV6_MULTICAST_HOPS: %m");

        r = setsockopt_int(s, IPPROTO_IPV6, IPV6_MULTICAST_LOOP, true);
        if (r < 0)
                return log_error_errno(r, "mDNS-IPv6: Failed to set IPV6_MULTICAST_LOOP: %m");

        r = setsockopt_int(s, IPPROTO_IPV6, IPV6_V6ONLY, true);
        if (r < 0)
                return log_error_errno(r, "mDNS-IPv6: Failed to set IPV6_V6ONLY: %m");

        r = setsockopt_int(s, IPPROTO_IPV6, IPV6_RECVPKTINFO, true);
        if (r < 0)
                return log_error_errno(r, "mDNS-IPv6: Failed to set IPV6_RECVPKTINFO: %m");

        r = setsockopt_int(s, IPPROTO_IPV6, IPV6_RECVHOPLIMIT, true);
        if (r < 0)
                return log_error_errno(r, "mDNS-IPv6: Failed to set IPV6_RECVHOPLIMIT: %m");

        /* See the section 15.1 of RFC6762 */
        /* first try to bind without SO_REUSEADDR to detect another mDNS responder */
        r = bind(s, &sa.sa, sizeof(sa.in6));
        if (r < 0) {
                if (errno != EADDRINUSE)
                        return log_error_errno(errno, "mDNS-IPv6: Failed to bind socket: %m");

                log_warning("mDNS-IPv6: There appears to be another mDNS responder running, or previously systemd-resolved crashed with some outstanding transfers.");

                /* try again with SO_REUSEADDR */
                r = setsockopt_int(s, SOL_SOCKET, SO_REUSEADDR, true);
                if (r < 0)
                        return log_error_errno(r, "mDNS-IPv6: Failed to set SO_REUSEADDR: %m");

                r = bind(s, &sa.sa, sizeof(sa.in6));
                if (r < 0)
                        return log_error_errno(errno, "mDNS-IPv6: Failed to bind socket: %m");
        } else {
                /* enable SO_REUSEADDR for the case that the user really wants multiple mDNS responders */
                r = setsockopt_int(s, SOL_SOCKET, SO_REUSEADDR, true);
                if (r < 0)
                        return log_error_errno(r, "mDNS-IPv6: Failed to set SO_REUSEADDR: %m");
        }

        r = sd_event_add_io(m->event, &m->mdns_ipv6_event_source, s, EPOLLIN, on_mdns_packet, m);
        if (r < 0)
                return log_error_errno(r, "mDNS-IPv6: Failed to create event source: %m");

        return m->mdns_ipv6_fd = TAKE_FD(s);
}
Commit	Line	Data
db9ecf05	1	/* SPDX-License-Identifier: LGPL-2.1-or-later */
bc7702b0 DM	2
	3	#include <resolv.h>
	4	#include <netinet/in.h>
	5	#include <arpa/inet.h>
	6
8d67e72c	7	#include "alloc-util.h"
bc7702b0 DM	8	#include "fd-util.h"
	9	#include "resolved-manager.h"
	10	#include "resolved-mdns.h"
760877e9	11	#include "sort-util.h"
bc7702b0	12
8d67e72c DR	13	#define CLEAR_CACHE_FLUSH(x) (~MDNS_RR_CACHE_FLUSH & (x))
8d67e72c DR	14
bc7702b0 DM	15	void manager_mdns_stop(Manager *m) {
	16	assert(m);
	17
	18	m->mdns_ipv4_event_source = sd_event_source_unref(m->mdns_ipv4_event_source);
	19	m->mdns_ipv4_fd = safe_close(m->mdns_ipv4_fd);
	20
	21	m->mdns_ipv6_event_source = sd_event_source_unref(m->mdns_ipv6_event_source);
	22	m->mdns_ipv6_fd = safe_close(m->mdns_ipv6_fd);
	23	}
	24
	25	int manager_mdns_start(Manager *m) {
	26	int r;
	27
	28	assert(m);
	29
af49ca27	30	if (m->mdns_support == RESOLVE_SUPPORT_NO)
bc7702b0 DM	31	return 0;
	32
	33	r = manager_mdns_ipv4_fd(m);
	34	if (r == -EADDRINUSE)
	35	goto eaddrinuse;
	36	if (r < 0)
	37	return r;
	38
	39	if (socket_ipv6_is_supported()) {
	40	r = manager_mdns_ipv6_fd(m);
	41	if (r == -EADDRINUSE)
	42	goto eaddrinuse;
	43	if (r < 0)
	44	return r;
	45	}
	46
	47	return 0;
	48
	49	eaddrinuse:
71a047d2	50	log_warning("Another mDNS responder prohibits binding the socket to the same port. Turning off mDNS support.");
af49ca27	51	m->mdns_support = RESOLVE_SUPPORT_NO;
bc7702b0 DM	52	manager_mdns_stop(m);
	53
	54	return 0;
	55	}
	56
93bab288 YW	57	static int mdns_rr_compare(DnsResourceRecord * const a, DnsResourceRecord const *b) {
93bab288 YW	58	DnsResourceRecord x = (DnsResourceRecord *) a, y = (DnsResourceRecord *) b;
8d67e72c DR	59	size_t m;
	60	int r;
	61
	62	assert(x);
8d67e72c	63	assert(y);
8d67e72c	64
93bab288 YW	65	r = CMP(CLEAR_CACHE_FLUSH(x->key->class), CLEAR_CACHE_FLUSH(y->key->class));
	66	if (r != 0)
	67	return r;
8d67e72c	68
93bab288 YW	69	r = CMP(x->key->type, y->key->type);
	70	if (r != 0)
	71	return r;
8d67e72c	72
93bab288	73	r = dns_resource_record_to_wire_format(x, false);
8d67e72c DR	74	if (r < 0) {
	75	log_warning_errno(r, "Can't wire-format RR: %m");
	76	return 0;
	77	}
	78
93bab288	79	r = dns_resource_record_to_wire_format(y, false);
8d67e72c DR	80	if (r < 0) {
	81	log_warning_errno(r, "Can't wire-format RR: %m");
	82	return 0;
	83	}
	84
93bab288	85	m = MIN(DNS_RESOURCE_RECORD_RDATA_SIZE(x), DNS_RESOURCE_RECORD_RDATA_SIZE(y));
8d67e72c	86
93bab288	87	r = memcmp(DNS_RESOURCE_RECORD_RDATA(x), DNS_RESOURCE_RECORD_RDATA(y), m);
8d67e72c DR	88	if (r != 0)
	89	return r;
	90
93bab288	91	return CMP(DNS_RESOURCE_RECORD_RDATA_SIZE(x), DNS_RESOURCE_RECORD_RDATA_SIZE(y));
8d67e72c DR	92	}
	93
	94	static int proposed_rrs_cmp(DnsResourceRecord x, unsigned x_size, DnsResourceRecord y, unsigned y_size) {
	95	unsigned m;
	96	int r;
	97
	98	m = MIN(x_size, y_size);
	99	for (unsigned i = 0; i < m; i++) {
	100	r = mdns_rr_compare(&x[i], &y[i]);
	101	if (r != 0)
	102	return r;
	103	}
	104
6dd91b36	105	return CMP(x_size, y_size);
8d67e72c DR	106	}
	107
	108	static int mdns_packet_extract_matching_rrs(DnsPacket p, DnsResourceKey key, DnsResourceRecord ***ret_rrs) {
	109	_cleanup_free_ DnsResourceRecord **list = NULL;
	110	unsigned n = 0, size = 0;
	111	int r;
	112
	113	assert(p);
	114	assert(key);
	115	assert(ret_rrs);
	116	assert_return(DNS_PACKET_NSCOUNT(p) > 0, -EINVAL);
	117
da6053d0	118	for (size_t i = DNS_PACKET_ANCOUNT(p); i < (DNS_PACKET_ANCOUNT(p) + DNS_PACKET_NSCOUNT(p)); i++) {
8d67e72c DR	119	r = dns_resource_key_match_rr(key, p->answer->items[i].rr, NULL);
	120	if (r < 0)
	121	return r;
	122	if (r > 0)
	123	size++;
	124	}
	125
	126	if (size == 0)
	127	return 0;
	128
	129	list = new(DnsResourceRecord *, size);
	130	if (!list)
	131	return -ENOMEM;
	132
da6053d0	133	for (size_t i = DNS_PACKET_ANCOUNT(p); i < (DNS_PACKET_ANCOUNT(p) + DNS_PACKET_NSCOUNT(p)); i++) {
8d67e72c DR	134	r = dns_resource_key_match_rr(key, p->answer->items[i].rr, NULL);
	135	if (r < 0)
	136	return r;
	137	if (r > 0)
	138	list[n++] = p->answer->items[i].rr;
	139	}
	140	assert(n == size);
93bab288	141	typesafe_qsort(list, size, mdns_rr_compare);
8d67e72c	142
1cc6c93a	143	*ret_rrs = TAKE_PTR(list);
8d67e72c DR	144
	145	return size;
	146	}
	147
	148	static int mdns_do_tiebreak(DnsResourceKey key, DnsAnswer answer, DnsPacket *p) {
	149	_cleanup_free_ DnsResourceRecord our = NULL, remote = NULL;
	150	DnsResourceRecord *rr;
da6053d0	151	size_t i = 0, size;
8d67e72c DR	152	int r;
	153
	154	size = dns_answer_size(answer);
	155	our = new(DnsResourceRecord *, size);
	156	if (!our)
	157	return -ENOMEM;
	158
	159	DNS_ANSWER_FOREACH(rr, answer)
	160	our[i++] = rr;
93bab288 YW	161
93bab288 YW	162	typesafe_qsort(our, size, mdns_rr_compare);
8d67e72c DR	163
	164	r = mdns_packet_extract_matching_rrs(p, key, &remote);
	165	if (r < 0)
	166	return r;
	167
	168	assert(r > 0);
	169
	170	if (proposed_rrs_cmp(remote, r, our, size) > 0)
	171	return 1;
	172
	173	return 0;
	174	}
	175
3b991089	176	static int mdns_scope_process_query(DnsScope s, DnsPacket p) {
9c5e7b73	177	_cleanup_(dns_answer_unrefp) DnsAnswer *full_answer = NULL;
3b991089 DR	178	_cleanup_(dns_packet_unrefp) DnsPacket *reply = NULL;
3b991089 DR	179	DnsResourceKey *key = NULL;
8d67e72c	180	DnsResourceRecord *rr;
3b991089 DR	181	bool tentative = false;
	182	int r;
	183
	184	assert(s);
	185	assert(p);
	186
	187	r = dns_packet_extract(p);
1a63fc54 LP	188	if (r < 0)
1a63fc54 LP	189	return log_debug_errno(r, "Failed to extract resource records from incoming packet: %m");
3b991089	190
3b991089	191	assert_return((dns_question_size(p->question) > 0), -EINVAL);
3b991089	192
9c5e7b73 DR	193	DNS_QUESTION_FOREACH(key, p->question) {
	194	_cleanup_(dns_answer_unrefp) DnsAnswer answer = NULL, soa = NULL;
	195
	196	r = dns_zone_lookup(&s->zone, key, 0, &answer, &soa, &tentative);
	197	if (r < 0)
105a1a36	198	return log_debug_errno(r, "Failed to look up key: %m");
9c5e7b73	199
8d67e72c DR	200	if (tentative && DNS_PACKET_NSCOUNT(p) > 0) {
	201	/*
	202	* A race condition detected with the probe packet from
	203	* a remote host.
	204	* Do simultaneous probe tiebreaking as described in
	205	* RFC 6762, Section 8.2. In case we lost don't reply
	206	* the question and withdraw conflicting RRs.
	207	*/
	208	r = mdns_do_tiebreak(key, answer, p);
	209	if (r < 0)
	210	return log_debug_errno(r, "Failed to do tiebreaking");
	211
	212	if (r > 0) { /* we lost */
	213	DNS_ANSWER_FOREACH(rr, answer) {
	214	DnsZoneItem *i;
	215
	216	i = dns_zone_get(&s->zone, rr);
	217	if (i)
	218	dns_zone_item_conflict(i);
	219	}
	220
	221	continue;
	222	}
	223	}
	224
9c5e7b73 DR	225	r = dns_answer_extend(&full_answer, answer);
	226	if (r < 0)
	227	return log_debug_errno(r, "Failed to extend answer: %m");
	228	}
	229
	230	if (dns_answer_isempty(full_answer))
3b991089 DR	231	return 0;
3b991089 DR	232
9c5e7b73	233	r = dns_scope_make_reply_packet(s, DNS_PACKET_ID(p), DNS_RCODE_SUCCESS, NULL, full_answer, NULL, false, &reply);
9886b6b1 LP	234	if (r < 0)
9886b6b1 LP	235	return log_debug_errno(r, "Failed to build reply packet: %m");
3b991089	236
7994ac1d	237	if (!ratelimit_below(&s->ratelimit))
3b991089 DR	238	return 0;
	239
	240	r = dns_scope_emit_udp(s, -1, reply);
9886b6b1 LP	241	if (r < 0)
9886b6b1 LP	242	return log_debug_errno(r, "Failed to send reply packet: %m");
3b991089 DR	243
	244	return 0;
	245	}
	246
bc7702b0	247	static int on_mdns_packet(sd_event_source s, int fd, uint32_t revents, void userdata) {
124602ae DM	248	_cleanup_(dns_packet_unrefp) DnsPacket *p = NULL;
	249	Manager *m = userdata;
	250	DnsScope *scope;
	251	int r;
	252
	253	r = manager_recv(m, fd, DNS_PROTOCOL_MDNS, &p);
	254	if (r <= 0)
	255	return r;
	256
94378145	257	if (manager_packet_from_local_address(m, p))
cfb17f45 DR	258	return 0;
cfb17f45 DR	259
124602ae DM	260	scope = manager_find_scope(m, p);
124602ae DM	261	if (!scope) {
f1b1a5c4	262	log_debug("Got mDNS UDP packet on unknown scope. Ignoring.");
124602ae DM	263	return 0;
	264	}
	265
	266	if (dns_packet_validate_reply(p) > 0) {
40fa4728	267	DnsResourceRecord *rr;
124602ae DM	268
	269	log_debug("Got mDNS reply packet");
	270
	271	/*
	272	* mDNS is different from regular DNS and LLMNR with regard to handling responses.
	273	* While on other protocols, we can ignore every answer that doesn't match a question
	274	* we broadcast earlier, RFC6762, section 18.1 recommends looking at and caching all
	275	* incoming information, regardless of the DNS packet ID.
	276	*
	277	* Hence, extract the packet here, and try to find a transaction for answer the we got
	278	* and complete it. Also store the new information in scope's cache.
	279	*/
	280	r = dns_packet_extract(p);
	281	if (r < 0) {
	282	log_debug("mDNS packet extraction failed.");
	283	return 0;
	284	}
	285
	286	dns_scope_check_conflicts(scope, p);
	287
40fa4728	288	DNS_ANSWER_FOREACH(rr, p->answer) {
1c02e7ba	289	const char *name = dns_resource_key_name(rr->key);
124602ae DM	290	DnsTransaction *t;
124602ae DM	291
40fa4728 DM	292	/* If the received reply packet contains ANY record that is not .local or .in-addr.arpa,
	293	* we assume someone's playing tricks on us and discard the packet completely. */
	294	if (!(dns_name_endswith(name, "in-addr.arpa") > 0 \|\|
	295	dns_name_endswith(name, "local") > 0))
	296	return 0;
124602ae	297
3755027c DR	298	if (rr->ttl == 0) {
	299	log_debug("Got a goodbye packet");
	300	/* See the section 10.1 of RFC6762 */
	301	rr->ttl = 1;
	302	}
	303
775ae354	304	t = dns_scope_find_transaction(scope, rr->key, SD_RESOLVED_NO_CACHE\|SD_RESOLVED_NO_ZONE);
124602ae	305	if (t)
48413582 LP	306	dns_transaction_process_reply(t, p);
	307
	308	/* Also look for the various types of ANY transactions */
775ae354	309	t = dns_scope_find_transaction(scope, &DNS_RESOURCE_KEY_CONST(rr->key->class, DNS_TYPE_ANY, dns_resource_key_name(rr->key)), SD_RESOLVED_NO_CACHE\|SD_RESOLVED_NO_ZONE);
48413582 LP	310	if (t)
	311	dns_transaction_process_reply(t, p);
	312
775ae354	313	t = dns_scope_find_transaction(scope, &DNS_RESOURCE_KEY_CONST(DNS_CLASS_ANY, rr->key->type, dns_resource_key_name(rr->key)), SD_RESOLVED_NO_CACHE\|SD_RESOLVED_NO_ZONE);
48413582 LP	314	if (t)
	315	dns_transaction_process_reply(t, p);
	316
775ae354	317	t = dns_scope_find_transaction(scope, &DNS_RESOURCE_KEY_CONST(DNS_CLASS_ANY, DNS_TYPE_ANY, dns_resource_key_name(rr->key)), SD_RESOLVED_NO_CACHE\|SD_RESOLVED_NO_ZONE);
48413582	318	if (t)
124602ae DM	319	dns_transaction_process_reply(t, p);
	320	}
	321
43475909	322	dns_cache_put(&scope->cache, scope->manager->enable_cache, NULL, DNS_PACKET_RCODE(p), p->answer, NULL, false, _DNSSEC_RESULT_INVALID, (uint32_t) -1, p->family, &p->sender);
124602ae DM	323
	324	} else if (dns_packet_validate_query(p) > 0) {
	325	log_debug("Got mDNS query packet for id %u", DNS_PACKET_ID(p));
	326
3b991089 DR	327	r = mdns_scope_process_query(scope, p);
3b991089 DR	328	if (r < 0) {
1a63fc54	329	log_debug_errno(r, "mDNS query processing failed: %m");
3b991089 DR	330	return 0;
3b991089 DR	331	}
124602ae DM	332	} else
	333	log_debug("Invalid mDNS UDP packet.");
	334
bc7702b0 DM	335	return 0;
	336	}
	337
	338	int manager_mdns_ipv4_fd(Manager *m) {
	339	union sockaddr_union sa = {
	340	.in.sin_family = AF_INET,
	341	.in.sin_port = htobe16(MDNS_PORT),
	342	};
73c76767	343	_cleanup_close_ int s = -1;
bc7702b0 DM	344	int r;
	345
	346	assert(m);
	347
	348	if (m->mdns_ipv4_fd >= 0)
	349	return m->mdns_ipv4_fd;
	350
73c76767 YW	351	s = socket(AF_INET, SOCK_DGRAM\|SOCK_CLOEXEC\|SOCK_NONBLOCK, 0);
73c76767 YW	352	if (s < 0)
71a047d2	353	return log_error_errno(errno, "mDNS-IPv4: Failed to create socket: %m");
bc7702b0	354
73c76767 YW	355	r = setsockopt_int(s, IPPROTO_IP, IP_TTL, 255);
	356	if (r < 0)
	357	return log_error_errno(r, "mDNS-IPv4: Failed to set IP_TTL: %m");
bc7702b0	358
73c76767 YW	359	r = setsockopt_int(s, IPPROTO_IP, IP_MULTICAST_TTL, 255);
	360	if (r < 0)
	361	return log_error_errno(r, "mDNS-IPv4: Failed to set IP_MULTICAST_TTL: %m");
bc7702b0	362
73c76767 YW	363	r = setsockopt_int(s, IPPROTO_IP, IP_MULTICAST_LOOP, true);
	364	if (r < 0)
	365	return log_error_errno(r, "mDNS-IPv4: Failed to set IP_MULTICAST_LOOP: %m");
bc7702b0	366
73c76767 YW	367	r = setsockopt_int(s, IPPROTO_IP, IP_PKTINFO, true);
	368	if (r < 0)
	369	return log_error_errno(r, "mDNS-IPv4: Failed to set IP_PKTINFO: %m");
bc7702b0	370
73c76767 YW	371	r = setsockopt_int(s, IPPROTO_IP, IP_RECVTTL, true);
	372	if (r < 0)
	373	return log_error_errno(r, "mDNS-IPv4: Failed to set IP_RECVTTL: %m");
bc7702b0 DM	374
bc7702b0 DM	375	/* Disable Don't-Fragment bit in the IP header */
73c76767 YW	376	r = setsockopt_int(s, IPPROTO_IP, IP_MTU_DISCOVER, IP_PMTUDISC_DONT);
	377	if (r < 0)
	378	return log_error_errno(r, "mDNS-IPv4: Failed to set IP_MTU_DISCOVER: %m");
bc7702b0	379
71a047d2 YW	380	/* See the section 15.1 of RFC6762 */
71a047d2 YW	381	/* first try to bind without SO_REUSEADDR to detect another mDNS responder */
73c76767	382	r = bind(s, &sa.sa, sizeof(sa.in));
bc7702b0	383	if (r < 0) {
73c76767 YW	384	if (errno != EADDRINUSE)
73c76767 YW	385	return log_error_errno(errno, "mDNS-IPv4: Failed to bind socket: %m");
71a047d2 YW	386
	387	log_warning("mDNS-IPv4: There appears to be another mDNS responder running, or previously systemd-resolved crashed with some outstanding transfers.");
	388
	389	/* try again with SO_REUSEADDR */
73c76767 YW	390	r = setsockopt_int(s, SOL_SOCKET, SO_REUSEADDR, true);
	391	if (r < 0)
	392	return log_error_errno(r, "mDNS-IPv4: Failed to set SO_REUSEADDR: %m");
71a047d2	393
73c76767 YW	394	r = bind(s, &sa.sa, sizeof(sa.in));
	395	if (r < 0)
	396	return log_error_errno(errno, "mDNS-IPv4: Failed to bind socket: %m");
71a047d2 YW	397	} else {
71a047d2 YW	398	/* enable SO_REUSEADDR for the case that the user really wants multiple mDNS responders */
73c76767 YW	399	r = setsockopt_int(s, SOL_SOCKET, SO_REUSEADDR, true);
	400	if (r < 0)
	401	return log_error_errno(r, "mDNS-IPv4: Failed to set SO_REUSEADDR: %m");
bc7702b0 DM	402	}
bc7702b0 DM	403
73c76767	404	r = sd_event_add_io(m->event, &m->mdns_ipv4_event_source, s, EPOLLIN, on_mdns_packet, m);
bc7702b0	405	if (r < 0)
73c76767	406	return log_error_errno(r, "mDNS-IPv4: Failed to create event source: %m");
bc7702b0	407
73c76767	408	return m->mdns_ipv4_fd = TAKE_FD(s);
bc7702b0 DM	409	}
	410
	411	int manager_mdns_ipv6_fd(Manager *m) {
	412	union sockaddr_union sa = {
	413	.in6.sin6_family = AF_INET6,
	414	.in6.sin6_port = htobe16(MDNS_PORT),
	415	};
73c76767	416	_cleanup_close_ int s = -1;
bc7702b0 DM	417	int r;
	418
	419	assert(m);
	420
	421	if (m->mdns_ipv6_fd >= 0)
	422	return m->mdns_ipv6_fd;
	423
73c76767 YW	424	s = socket(AF_INET6, SOCK_DGRAM\|SOCK_CLOEXEC\|SOCK_NONBLOCK, 0);
73c76767 YW	425	if (s < 0)
71a047d2	426	return log_error_errno(errno, "mDNS-IPv6: Failed to create socket: %m");
bc7702b0	427
73c76767 YW	428	r = setsockopt_int(s, IPPROTO_IPV6, IPV6_UNICAST_HOPS, 255);
	429	if (r < 0)
	430	return log_error_errno(r, "mDNS-IPv6: Failed to set IPV6_UNICAST_HOPS: %m");
bc7702b0 DM	431
bc7702b0 DM	432	/* RFC 4795, section 2.5 recommends setting the TTL of UDP packets to 255. */
73c76767 YW	433	r = setsockopt_int(s, IPPROTO_IPV6, IPV6_MULTICAST_HOPS, 255);
	434	if (r < 0)
	435	return log_error_errno(r, "mDNS-IPv6: Failed to set IPV6_MULTICAST_HOPS: %m");
bc7702b0	436
73c76767 YW	437	r = setsockopt_int(s, IPPROTO_IPV6, IPV6_MULTICAST_LOOP, true);
	438	if (r < 0)
	439	return log_error_errno(r, "mDNS-IPv6: Failed to set IPV6_MULTICAST_LOOP: %m");
bc7702b0	440
73c76767 YW	441	r = setsockopt_int(s, IPPROTO_IPV6, IPV6_V6ONLY, true);
	442	if (r < 0)
	443	return log_error_errno(r, "mDNS-IPv6: Failed to set IPV6_V6ONLY: %m");
bc7702b0	444
73c76767 YW	445	r = setsockopt_int(s, IPPROTO_IPV6, IPV6_RECVPKTINFO, true);
	446	if (r < 0)
	447	return log_error_errno(r, "mDNS-IPv6: Failed to set IPV6_RECVPKTINFO: %m");
bc7702b0	448
73c76767 YW	449	r = setsockopt_int(s, IPPROTO_IPV6, IPV6_RECVHOPLIMIT, true);
	450	if (r < 0)
	451	return log_error_errno(r, "mDNS-IPv6: Failed to set IPV6_RECVHOPLIMIT: %m");
bc7702b0	452
71a047d2 YW	453	/* See the section 15.1 of RFC6762 */
71a047d2 YW	454	/* first try to bind without SO_REUSEADDR to detect another mDNS responder */
73c76767	455	r = bind(s, &sa.sa, sizeof(sa.in6));
bc7702b0	456	if (r < 0) {
73c76767 YW	457	if (errno != EADDRINUSE)
73c76767 YW	458	return log_error_errno(errno, "mDNS-IPv6: Failed to bind socket: %m");
71a047d2 YW	459
	460	log_warning("mDNS-IPv6: There appears to be another mDNS responder running, or previously systemd-resolved crashed with some outstanding transfers.");
	461
	462	/* try again with SO_REUSEADDR */
73c76767 YW	463	r = setsockopt_int(s, SOL_SOCKET, SO_REUSEADDR, true);
	464	if (r < 0)
	465	return log_error_errno(r, "mDNS-IPv6: Failed to set SO_REUSEADDR: %m");
71a047d2	466
73c76767 YW	467	r = bind(s, &sa.sa, sizeof(sa.in6));
	468	if (r < 0)
	469	return log_error_errno(errno, "mDNS-IPv6: Failed to bind socket: %m");
71a047d2 YW	470	} else {
71a047d2 YW	471	/* enable SO_REUSEADDR for the case that the user really wants multiple mDNS responders */
73c76767 YW	472	r = setsockopt_int(s, SOL_SOCKET, SO_REUSEADDR, true);
	473	if (r < 0)
	474	return log_error_errno(r, "mDNS-IPv6: Failed to set SO_REUSEADDR: %m");
bc7702b0 DM	475	}
bc7702b0 DM	476
73c76767	477	r = sd_event_add_io(m->event, &m->mdns_ipv6_event_source, s, EPOLLIN, on_mdns_packet, m);
ee8d9305	478	if (r < 0)
73c76767	479	return log_error_errno(r, "mDNS-IPv6: Failed to create event source: %m");
bc7702b0	480
73c76767	481	return m->mdns_ipv6_fd = TAKE_FD(s);
bc7702b0	482	}