if (r == 0 && k == 0) /* No actual cname happened? */
return -ELOOP;
+ if (q->answer_protocol == DNS_PROTOCOL_DNS) {
+ /* Don't permit CNAME redirects from unicast DNS to LLMNR or MulticastDNS, so that global resources
+ * cannot invade the local namespace. The opposite way we permit: local names may redirect to global
+ * ones. */
+
+ q->flags &= ~(SD_RESOLVED_LLMNR|SD_RESOLVED_MDNS); /* mask away the local protocols */
+ }
+
+ /* Turn off searching for the new name */
+ q->flags |= SD_RESOLVED_NO_SEARCH;
+
dns_question_unref(q->question_idna);
q->question_idna = nq_idna;
nq_idna = NULL;
dns_query_free_candidates(q);
dns_query_reset_answer(q);
- q->state = DNS_TRANSACTION_NULL;
- /* Turn off searching for the new name */
- q->flags |= SD_RESOLVED_NO_SEARCH;
+ q->state = DNS_TRANSACTION_NULL;
return 0;
}