src/resolve/resolved-dns-scope.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2 /***
   3   This file is part of systemd.
   4
   5   Copyright 2014 Lennart Poettering
   6 ***/
   7
   8 #include <netinet/tcp.h>
   9
  10 #include "af-list.h"
  11 #include "alloc-util.h"
  12 #include "dns-domain.h"
  13 #include "fd-util.h"
  14 #include "hostname-util.h"
  15 #include "missing.h"
  16 #include "random-util.h"
  17 #include "resolved-dnssd.h"
  18 #include "resolved-dns-scope.h"
  19 #include "resolved-dns-zone.h"
  20 #include "resolved-llmnr.h"
  21 #include "resolved-mdns.h"
  22 #include "socket-util.h"
  23 #include "strv.h"
  24
  25 #define MULTICAST_RATELIMIT_INTERVAL_USEC (1*USEC_PER_SEC)
  26 #define MULTICAST_RATELIMIT_BURST 1000
  27
  28 /* After how much time to repeat LLMNR requests, see RFC 4795 Section 7 */
  29 #define MULTICAST_RESEND_TIMEOUT_MIN_USEC (100 * USEC_PER_MSEC)
  30 #define MULTICAST_RESEND_TIMEOUT_MAX_USEC (1 * USEC_PER_SEC)
  31
  32 int dns_scope_new(Manager *m, DnsScope **ret, Link *l, DnsProtocol protocol, int family) {
  33         DnsScope *s;
  34
  35         assert(m);
  36         assert(ret);
  37
  38         s = new0(DnsScope, 1);
  39         if (!s)
  40                 return -ENOMEM;
  41
  42         s->manager = m;
  43         s->link = l;
  44         s->protocol = protocol;
  45         s->family = family;
  46         s->resend_timeout = MULTICAST_RESEND_TIMEOUT_MIN_USEC;
  47
  48         if (protocol == DNS_PROTOCOL_DNS) {
  49                 /* Copy DNSSEC mode from the link if it is set there,
  50                  * otherwise take the manager's DNSSEC mode. Note that
  51                  * we copy this only at scope creation time, and do
  52                  * not update it from the on, even if the setting
  53                  * changes. */
  54
  55                 if (l) {
  56                         s->dnssec_mode = link_get_dnssec_mode(l);
  57                         s->private_dns_mode = link_get_private_dns_mode(l);
  58                 } else {
  59                         s->dnssec_mode = manager_get_dnssec_mode(m);
  60                         s->private_dns_mode = manager_get_private_dns_mode(m);
  61                 }
  62
  63         } else {
  64                 s->dnssec_mode = DNSSEC_NO;
  65                 s->private_dns_mode = PRIVATE_DNS_NO;
  66         }
  67
  68         LIST_PREPEND(scopes, m->dns_scopes, s);
  69
  70         dns_scope_llmnr_membership(s, true);
  71         dns_scope_mdns_membership(s, true);
  72
  73         log_debug("New scope on link %s, protocol %s, family %s", l ? l->name : "*", dns_protocol_to_string(protocol), family == AF_UNSPEC ? "*" : af_to_name(family));
  74
  75         /* Enforce ratelimiting for the multicast protocols */
  76         RATELIMIT_INIT(s->ratelimit, MULTICAST_RATELIMIT_INTERVAL_USEC, MULTICAST_RATELIMIT_BURST);
  77
  78         *ret = s;
  79         return 0;
  80 }
  81
  82 static void dns_scope_abort_transactions(DnsScope *s) {
  83         assert(s);
  84
  85         while (s->transactions) {
  86                 DnsTransaction *t = s->transactions;
  87
  88                 /* Abort the transaction, but make sure it is not
  89                  * freed while we still look at it */
  90
  91                 t->block_gc++;
  92                 if (DNS_TRANSACTION_IS_LIVE(t->state))
  93                         dns_transaction_complete(t, DNS_TRANSACTION_ABORTED);
  94                 t->block_gc--;
  95
  96                 dns_transaction_free(t);
  97         }
  98 }
  99
 100 DnsScope* dns_scope_free(DnsScope *s) {
 101         if (!s)
 102                 return NULL;
 103
 104         log_debug("Removing scope on link %s, protocol %s, family %s", s->link ? s->link->name : "*", dns_protocol_to_string(s->protocol), s->family == AF_UNSPEC ? "*" : af_to_name(s->family));
 105
 106         dns_scope_llmnr_membership(s, false);
 107         dns_scope_mdns_membership(s, false);
 108         dns_scope_abort_transactions(s);
 109
 110         while (s->query_candidates)
 111                 dns_query_candidate_free(s->query_candidates);
 112
 113         hashmap_free(s->transactions_by_key);
 114
 115         ordered_hashmap_free_with_destructor(s->conflict_queue, dns_resource_record_unref);
 116         sd_event_source_unref(s->conflict_event_source);
 117
 118         sd_event_source_unref(s->announce_event_source);
 119
 120         dns_cache_flush(&s->cache);
 121         dns_zone_flush(&s->zone);
 122
 123         LIST_REMOVE(scopes, s->manager->dns_scopes, s);
 124         return mfree(s);
 125 }
 126
 127 DnsServer *dns_scope_get_dns_server(DnsScope *s) {
 128         assert(s);
 129
 130         if (s->protocol != DNS_PROTOCOL_DNS)
 131                 return NULL;
 132
 133         if (s->link)
 134                 return link_get_dns_server(s->link);
 135         else
 136                 return manager_get_dns_server(s->manager);
 137 }
 138
 139 unsigned dns_scope_get_n_dns_servers(DnsScope *s) {
 140         unsigned n = 0;
 141         DnsServer *i;
 142
 143         assert(s);
 144
 145         if (s->protocol != DNS_PROTOCOL_DNS)
 146                 return 0;
 147
 148         if (s->link)
 149                 i = s->link->dns_servers;
 150         else
 151                 i = s->manager->dns_servers;
 152
 153         for (; i; i = i->servers_next)
 154                 n++;
 155
 156         return n;
 157 }
 158
 159 void dns_scope_next_dns_server(DnsScope *s) {
 160         assert(s);
 161
 162         if (s->protocol != DNS_PROTOCOL_DNS)
 163                 return;
 164
 165         if (s->link)
 166                 link_next_dns_server(s->link);
 167         else
 168                 manager_next_dns_server(s->manager);
 169 }
 170
 171 void dns_scope_packet_received(DnsScope *s, usec_t rtt) {
 172         assert(s);
 173
 174         if (rtt <= s->max_rtt)
 175                 return;
 176
 177         s->max_rtt = rtt;
 178         s->resend_timeout = MIN(MAX(MULTICAST_RESEND_TIMEOUT_MIN_USEC, s->max_rtt * 2), MULTICAST_RESEND_TIMEOUT_MAX_USEC);
 179 }
 180
 181 void dns_scope_packet_lost(DnsScope *s, usec_t usec) {
 182         assert(s);
 183
 184         if (s->resend_timeout <= usec)
 185                 s->resend_timeout = MIN(s->resend_timeout * 2, MULTICAST_RESEND_TIMEOUT_MAX_USEC);
 186 }
 187
 188 static int dns_scope_emit_one(DnsScope *s, int fd, DnsPacket *p) {
 189         union in_addr_union addr;
 190         int ifindex = 0, r;
 191         int family;
 192         uint32_t mtu;
 193
 194         assert(s);
 195         assert(p);
 196         assert(p->protocol == s->protocol);
 197
 198         if (s->link) {
 199                 mtu = s->link->mtu;
 200                 ifindex = s->link->ifindex;
 201         } else
 202                 mtu = manager_find_mtu(s->manager);
 203
 204         switch (s->protocol) {
 205
 206         case DNS_PROTOCOL_DNS:
 207                 assert(fd >= 0);
 208
 209                 if (DNS_PACKET_QDCOUNT(p) > 1)
 210                         return -EOPNOTSUPP;
 211
 212                 if (p->size > DNS_PACKET_UNICAST_SIZE_MAX)
 213                         return -EMSGSIZE;
 214
 215                 if (p->size + UDP_PACKET_HEADER_SIZE > mtu)
 216                         return -EMSGSIZE;
 217
 218                 r = manager_write(s->manager, fd, p);
 219                 if (r < 0)
 220                         return r;
 221
 222                 break;
 223
 224         case DNS_PROTOCOL_LLMNR:
 225                 assert(fd < 0);
 226
 227                 if (DNS_PACKET_QDCOUNT(p) > 1)
 228                         return -EOPNOTSUPP;
 229
 230                 if (!ratelimit_below(&s->ratelimit))
 231                         return -EBUSY;
 232
 233                 family = s->family;
 234
 235                 if (family == AF_INET) {
 236                         addr.in = LLMNR_MULTICAST_IPV4_ADDRESS;
 237                         fd = manager_llmnr_ipv4_udp_fd(s->manager);
 238                 } else if (family == AF_INET6) {
 239                         addr.in6 = LLMNR_MULTICAST_IPV6_ADDRESS;
 240                         fd = manager_llmnr_ipv6_udp_fd(s->manager);
 241                 } else
 242                         return -EAFNOSUPPORT;
 243                 if (fd < 0)
 244                         return fd;
 245
 246                 r = manager_send(s->manager, fd, ifindex, family, &addr, LLMNR_PORT, NULL, p);
 247                 if (r < 0)
 248                         return r;
 249
 250                 break;
 251
 252         case DNS_PROTOCOL_MDNS:
 253                 assert(fd < 0);
 254
 255                 if (!ratelimit_below(&s->ratelimit))
 256                         return -EBUSY;
 257
 258                 family = s->family;
 259
 260                 if (family == AF_INET) {
 261                         addr.in = MDNS_MULTICAST_IPV4_ADDRESS;
 262                         fd = manager_mdns_ipv4_fd(s->manager);
 263                 } else if (family == AF_INET6) {
 264                         addr.in6 = MDNS_MULTICAST_IPV6_ADDRESS;
 265                         fd = manager_mdns_ipv6_fd(s->manager);
 266                 } else
 267                         return -EAFNOSUPPORT;
 268                 if (fd < 0)
 269                         return fd;
 270
 271                 r = manager_send(s->manager, fd, ifindex, family, &addr, MDNS_PORT, NULL, p);
 272                 if (r < 0)
 273                         return r;
 274
 275                 break;
 276
 277         default:
 278                 return -EAFNOSUPPORT;
 279         }
 280
 281         return 1;
 282 }
 283
 284 int dns_scope_emit_udp(DnsScope *s, int fd, DnsPacket *p) {
 285         int r;
 286
 287         assert(s);
 288         assert(p);
 289         assert(p->protocol == s->protocol);
 290         assert((s->protocol == DNS_PROTOCOL_DNS) == (fd >= 0));
 291
 292         do {
 293                 /* If there are multiple linked packets, set the TC bit in all but the last of them */
 294                 if (p->more) {
 295                         assert(p->protocol == DNS_PROTOCOL_MDNS);
 296                         dns_packet_set_flags(p, true, true);
 297                 }
 298
 299                 r = dns_scope_emit_one(s, fd, p);
 300                 if (r < 0)
 301                         return r;
 302
 303                 p = p->more;
 304         } while (p);
 305
 306         return 0;
 307 }
 308
 309 static int dns_scope_socket(
 310                 DnsScope *s,
 311                 int type,
 312                 int family,
 313                 const union in_addr_union *address,
 314                 DnsServer *server,
 315                 uint16_t port,
 316                 union sockaddr_union *ret_socket_address) {
 317
 318         _cleanup_close_ int fd = -1;
 319         union sockaddr_union sa;
 320         socklen_t salen;
 321         static const int one = 1;
 322         int r, ifindex;
 323
 324         assert(s);
 325
 326         if (server) {
 327                 assert(family == AF_UNSPEC);
 328                 assert(!address);
 329
 330                 ifindex = dns_server_ifindex(server);
 331
 332                 sa.sa.sa_family = server->family;
 333                 if (server->family == AF_INET) {
 334                         sa.in.sin_port = htobe16(port);
 335                         sa.in.sin_addr = server->address.in;
 336                         salen = sizeof(sa.in);
 337                 } else if (server->family == AF_INET6) {
 338                         sa.in6.sin6_port = htobe16(port);
 339                         sa.in6.sin6_addr = server->address.in6;
 340                         sa.in6.sin6_scope_id = ifindex;
 341                         salen = sizeof(sa.in6);
 342                 } else
 343                         return -EAFNOSUPPORT;
 344         } else {
 345                 assert(family != AF_UNSPEC);
 346                 assert(address);
 347
 348                 sa.sa.sa_family = family;
 349                 ifindex = s->link ? s->link->ifindex : 0;
 350
 351                 if (family == AF_INET) {
 352                         sa.in.sin_port = htobe16(port);
 353                         sa.in.sin_addr = address->in;
 354                         salen = sizeof(sa.in);
 355                 } else if (family == AF_INET6) {
 356                         sa.in6.sin6_port = htobe16(port);
 357                         sa.in6.sin6_addr = address->in6;
 358                         sa.in6.sin6_scope_id = ifindex;
 359                         salen = sizeof(sa.in6);
 360                 } else
 361                         return -EAFNOSUPPORT;
 362         }
 363
 364         fd = socket(sa.sa.sa_family, type|SOCK_CLOEXEC|SOCK_NONBLOCK, 0);
 365         if (fd < 0)
 366                 return -errno;
 367
 368         if (type == SOCK_STREAM) {
 369                 r = setsockopt(fd, IPPROTO_TCP, TCP_NODELAY, &one, sizeof(one));
 370                 if (r < 0)
 371                         return -errno;
 372         }
 373
 374         if (s->link) {
 375                 be32_t ifindex_be = htobe32(ifindex);
 376
 377                 if (sa.sa.sa_family == AF_INET) {
 378                         r = setsockopt(fd, IPPROTO_IP, IP_UNICAST_IF, &ifindex_be, sizeof(ifindex_be));
 379                         if (r < 0)
 380                                 return -errno;
 381                 } else if (sa.sa.sa_family == AF_INET6) {
 382                         r = setsockopt(fd, IPPROTO_IPV6, IPV6_UNICAST_IF, &ifindex_be, sizeof(ifindex_be));
 383                         if (r < 0)
 384                                 return -errno;
 385                 }
 386         }
 387
 388         if (s->protocol == DNS_PROTOCOL_LLMNR) {
 389                 /* RFC 4795, section 2.5 requires the TTL to be set to 1 */
 390
 391                 if (sa.sa.sa_family == AF_INET) {
 392                         r = setsockopt(fd, IPPROTO_IP, IP_TTL, &one, sizeof(one));
 393                         if (r < 0)
 394                                 return -errno;
 395                 } else if (sa.sa.sa_family == AF_INET6) {
 396                         r = setsockopt(fd, IPPROTO_IPV6, IPV6_UNICAST_HOPS, &one, sizeof(one));
 397                         if (r < 0)
 398                                 return -errno;
 399                 }
 400         }
 401
 402         if (ret_socket_address)
 403                 *ret_socket_address = sa;
 404         else {
 405                 r = connect(fd, &sa.sa, salen);
 406                 if (r < 0 && errno != EINPROGRESS)
 407                         return -errno;
 408         }
 409
 410         return TAKE_FD(fd);
 411 }
 412
 413 int dns_scope_socket_udp(DnsScope *s, DnsServer *server, uint16_t port) {
 414         return dns_scope_socket(s, SOCK_DGRAM, AF_UNSPEC, NULL, server, port, NULL);
 415 }
 416
 417 int dns_scope_socket_tcp(DnsScope *s, int family, const union in_addr_union *address, DnsServer *server, uint16_t port, union sockaddr_union *ret_socket_address) {
 418         /* If ret_socket_address is not NULL, the caller is responisble
 419          * for calling connect() or sendmsg(). This is required by TCP
 420          * Fast Open, to be able to send the initial SYN packet along
 421          * with the first data packet. */
 422         return dns_scope_socket(s, SOCK_STREAM, family, address, server, port, ret_socket_address);
 423 }
 424
 425 DnsScopeMatch dns_scope_good_domain(DnsScope *s, int ifindex, uint64_t flags, const char *domain) {
 426         DnsSearchDomain *d;
 427
 428         assert(s);
 429         assert(domain);
 430
 431         /* Checks if the specified domain is something to look up on
 432          * this scope. Note that this accepts non-qualified hostnames,
 433          * i.e. those without any search path prefixed yet. */
 434
 435         if (ifindex != 0 && (!s->link || s->link->ifindex != ifindex))
 436                 return DNS_SCOPE_NO;
 437
 438         if ((SD_RESOLVED_FLAGS_MAKE(s->protocol, s->family, 0) & flags) == 0)
 439                 return DNS_SCOPE_NO;
 440
 441         /* Never resolve any loopback hostname or IP address via DNS,
 442          * LLMNR or mDNS. Instead, always rely on synthesized RRs for
 443          * these. */
 444         if (is_localhost(domain) ||
 445             dns_name_endswith(domain, "127.in-addr.arpa") > 0 ||
 446             dns_name_equal(domain, "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa") > 0)
 447                 return DNS_SCOPE_NO;
 448
 449         /* Never respond to some of the domains listed in RFC6303 */
 450         if (dns_name_endswith(domain, "0.in-addr.arpa") > 0 ||
 451             dns_name_equal(domain, "255.255.255.255.in-addr.arpa") > 0 ||
 452             dns_name_equal(domain, "0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa") > 0)
 453                 return DNS_SCOPE_NO;
 454
 455         /* Never respond to some of the domains listed in RFC6761 */
 456         if (dns_name_endswith(domain, "invalid") > 0)
 457                 return DNS_SCOPE_NO;
 458
 459         switch (s->protocol) {
 460
 461         case DNS_PROTOCOL_DNS: {
 462                 DnsServer *dns_server;
 463
 464                 /* Never route things to scopes that lack DNS servers */
 465                 dns_server = dns_scope_get_dns_server(s);
 466                 if (!dns_server)
 467                         return DNS_SCOPE_NO;
 468
 469                 /* Always honour search domains for routing queries, except if this scope lacks DNS servers. Note that
 470                  * we return DNS_SCOPE_YES here, rather than just DNS_SCOPE_MAYBE, which means other wildcard scopes
 471                  * won't be considered anymore. */
 472                 LIST_FOREACH(domains, d, dns_scope_get_search_domains(s))
 473                         if (dns_name_endswith(domain, d->name) > 0)
 474                                 return DNS_SCOPE_YES;
 475
 476                 /* If the DNS server has route-only domains, don't send other requests to it. This would be a privacy
 477                  * violation, will most probably fail anyway, and adds unnecessary load. */
 478                 if (dns_server_limited_domains(dns_server))
 479                         return DNS_SCOPE_NO;
 480
 481                 /* Exclude link-local IP ranges */
 482                 if (dns_name_endswith(domain, "254.169.in-addr.arpa") == 0 &&
 483                     dns_name_endswith(domain, "8.e.f.ip6.arpa") == 0 &&
 484                     dns_name_endswith(domain, "9.e.f.ip6.arpa") == 0 &&
 485                     dns_name_endswith(domain, "a.e.f.ip6.arpa") == 0 &&
 486                     dns_name_endswith(domain, "b.e.f.ip6.arpa") == 0 &&
 487                     /* If networks use .local in their private setups, they are supposed to also add .local to their search
 488                      * domains, which we already checked above. Otherwise, we consider .local specific to mDNS and won't
 489                      * send such queries ordinary DNS servers. */
 490                     dns_name_endswith(domain, "local") == 0)
 491                         return DNS_SCOPE_MAYBE;
 492
 493                 return DNS_SCOPE_NO;
 494         }
 495
 496         case DNS_PROTOCOL_MDNS:
 497                 if ((s->family == AF_INET && dns_name_endswith(domain, "in-addr.arpa") > 0) ||
 498                     (s->family == AF_INET6 && dns_name_endswith(domain, "ip6.arpa") > 0) ||
 499                     (dns_name_endswith(domain, "local") > 0 && /* only resolve names ending in .local via mDNS */
 500                      dns_name_equal(domain, "local") == 0 &&   /* but not the single-label "local" name itself */
 501                      manager_is_own_hostname(s->manager, domain) <= 0)) /* never resolve the local hostname via mDNS */
 502                         return DNS_SCOPE_MAYBE;
 503
 504                 return DNS_SCOPE_NO;
 505
 506         case DNS_PROTOCOL_LLMNR:
 507                 if ((s->family == AF_INET && dns_name_endswith(domain, "in-addr.arpa") > 0) ||
 508                     (s->family == AF_INET6 && dns_name_endswith(domain, "ip6.arpa") > 0) ||
 509                     (dns_name_is_single_label(domain) && /* only resolve single label names via LLMNR */
 510                      !is_gateway_hostname(domain) && /* don't resolve "gateway" with LLMNR, let nss-myhostname handle this */
 511                      manager_is_own_hostname(s->manager, domain) <= 0))  /* never resolve the local hostname via LLMNR */
 512                         return DNS_SCOPE_MAYBE;
 513
 514                 return DNS_SCOPE_NO;
 515
 516         default:
 517                 assert_not_reached("Unknown scope protocol");
 518         }
 519 }
 520
 521 bool dns_scope_good_key(DnsScope *s, const DnsResourceKey *key) {
 522         int key_family;
 523
 524         assert(s);
 525         assert(key);
 526
 527         /* Check if it makes sense to resolve the specified key on
 528          * this scope. Note that this call assumes as fully qualified
 529          * name, i.e. the search suffixes already appended. */
 530
 531         if (key->class != DNS_CLASS_IN)
 532                 return false;
 533
 534         if (s->protocol == DNS_PROTOCOL_DNS) {
 535
 536                 /* On classic DNS, looking up non-address RRs is always
 537                  * fine. (Specifically, we want to permit looking up
 538                  * DNSKEY and DS records on the root and top-level
 539                  * domains.) */
 540                 if (!dns_resource_key_is_address(key))
 541                         return true;
 542
 543                 /* However, we refuse to look up A and AAAA RRs on the
 544                  * root and single-label domains, under the assumption
 545                  * that those should be resolved via LLMNR or search
 546                  * path only, and should not be leaked onto the
 547                  * internet. */
 548                 return !(dns_name_is_single_label(dns_resource_key_name(key)) ||
 549                          dns_name_is_root(dns_resource_key_name(key)));
 550         }
 551
 552         /* On mDNS and LLMNR, send A and AAAA queries only on the
 553          * respective scopes */
 554
 555         key_family = dns_type_to_af(key->type);
 556         if (key_family < 0)
 557                 return true;
 558
 559         return key_family == s->family;
 560 }
 561
 562 static int dns_scope_multicast_membership(DnsScope *s, bool b, struct in_addr in, struct in6_addr in6) {
 563         int fd;
 564
 565         assert(s);
 566         assert(s->link);
 567
 568         if (s->family == AF_INET) {
 569                 struct ip_mreqn mreqn = {
 570                         .imr_multiaddr = in,
 571                         .imr_ifindex = s->link->ifindex,
 572                 };
 573
 574                 if (s->protocol == DNS_PROTOCOL_LLMNR)
 575                         fd = manager_llmnr_ipv4_udp_fd(s->manager);
 576                 else
 577                         fd = manager_mdns_ipv4_fd(s->manager);
 578
 579                 if (fd < 0)
 580                         return fd;
 581
 582                 /* Always first try to drop membership before we add
 583                  * one. This is necessary on some devices, such as
 584                  * veth. */
 585                 if (b)
 586                         (void) setsockopt(fd, IPPROTO_IP, IP_DROP_MEMBERSHIP, &mreqn, sizeof(mreqn));
 587
 588                 if (setsockopt(fd, IPPROTO_IP, b ? IP_ADD_MEMBERSHIP : IP_DROP_MEMBERSHIP, &mreqn, sizeof(mreqn)) < 0)
 589                         return -errno;
 590
 591         } else if (s->family == AF_INET6) {
 592                 struct ipv6_mreq mreq = {
 593                         .ipv6mr_multiaddr = in6,
 594                         .ipv6mr_interface = s->link->ifindex,
 595                 };
 596
 597                 if (s->protocol == DNS_PROTOCOL_LLMNR)
 598                         fd = manager_llmnr_ipv6_udp_fd(s->manager);
 599                 else
 600                         fd = manager_mdns_ipv6_fd(s->manager);
 601
 602                 if (fd < 0)
 603                         return fd;
 604
 605                 if (b)
 606                         (void) setsockopt(fd, IPPROTO_IPV6, IPV6_DROP_MEMBERSHIP, &mreq, sizeof(mreq));
 607
 608                 if (setsockopt(fd, IPPROTO_IPV6, b ? IPV6_ADD_MEMBERSHIP : IPV6_DROP_MEMBERSHIP, &mreq, sizeof(mreq)) < 0)
 609                         return -errno;
 610         } else
 611                 return -EAFNOSUPPORT;
 612
 613         return 0;
 614 }
 615
 616 int dns_scope_llmnr_membership(DnsScope *s, bool b) {
 617         assert(s);
 618
 619         if (s->protocol != DNS_PROTOCOL_LLMNR)
 620                 return 0;
 621
 622         return dns_scope_multicast_membership(s, b, LLMNR_MULTICAST_IPV4_ADDRESS, LLMNR_MULTICAST_IPV6_ADDRESS);
 623 }
 624
 625 int dns_scope_mdns_membership(DnsScope *s, bool b) {
 626         assert(s);
 627
 628         if (s->protocol != DNS_PROTOCOL_MDNS)
 629                 return 0;
 630
 631         return dns_scope_multicast_membership(s, b, MDNS_MULTICAST_IPV4_ADDRESS, MDNS_MULTICAST_IPV6_ADDRESS);
 632 }
 633
 634 int dns_scope_make_reply_packet(
 635                 DnsScope *s,
 636                 uint16_t id,
 637                 int rcode,
 638                 DnsQuestion *q,
 639                 DnsAnswer *answer,
 640                 DnsAnswer *soa,
 641                 bool tentative,
 642                 DnsPacket **ret) {
 643
 644         _cleanup_(dns_packet_unrefp) DnsPacket *p = NULL;
 645         int r;
 646
 647         assert(s);
 648         assert(ret);
 649
 650         if (dns_question_isempty(q) &&
 651             dns_answer_isempty(answer) &&
 652             dns_answer_isempty(soa))
 653                 return -EINVAL;
 654
 655         r = dns_packet_new(&p, s->protocol, 0, DNS_PACKET_SIZE_MAX);
 656         if (r < 0)
 657                 return r;
 658
 659         DNS_PACKET_HEADER(p)->id = id;
 660         DNS_PACKET_HEADER(p)->flags = htobe16(DNS_PACKET_MAKE_FLAGS(
 661                                                               1 /* qr */,
 662                                                               0 /* opcode */,
 663                                                               0 /* c */,
 664                                                               0 /* tc */,
 665                                                               tentative,
 666                                                               0 /* (ra) */,
 667                                                               0 /* (ad) */,
 668                                                               0 /* (cd) */,
 669                                                               rcode));
 670
 671         r = dns_packet_append_question(p, q);
 672         if (r < 0)
 673                 return r;
 674         DNS_PACKET_HEADER(p)->qdcount = htobe16(dns_question_size(q));
 675
 676         r = dns_packet_append_answer(p, answer);
 677         if (r < 0)
 678                 return r;
 679         DNS_PACKET_HEADER(p)->ancount = htobe16(dns_answer_size(answer));
 680
 681         r = dns_packet_append_answer(p, soa);
 682         if (r < 0)
 683                 return r;
 684         DNS_PACKET_HEADER(p)->arcount = htobe16(dns_answer_size(soa));
 685
 686         *ret = TAKE_PTR(p);
 687
 688         return 0;
 689 }
 690
 691 static void dns_scope_verify_conflicts(DnsScope *s, DnsPacket *p) {
 692         DnsResourceRecord *rr;
 693         DnsResourceKey *key;
 694
 695         assert(s);
 696         assert(p);
 697
 698         DNS_QUESTION_FOREACH(key, p->question)
 699                 dns_zone_verify_conflicts(&s->zone, key);
 700
 701         DNS_ANSWER_FOREACH(rr, p->answer)
 702                 dns_zone_verify_conflicts(&s->zone, rr->key);
 703 }
 704
 705 void dns_scope_process_query(DnsScope *s, DnsStream *stream, DnsPacket *p) {
 706         _cleanup_(dns_answer_unrefp) DnsAnswer *answer = NULL, *soa = NULL;
 707         _cleanup_(dns_packet_unrefp) DnsPacket *reply = NULL;
 708         DnsResourceKey *key = NULL;
 709         bool tentative = false;
 710         int r;
 711
 712         assert(s);
 713         assert(p);
 714
 715         if (p->protocol != DNS_PROTOCOL_LLMNR)
 716                 return;
 717
 718         if (p->ipproto == IPPROTO_UDP) {
 719                 /* Don't accept UDP queries directed to anything but
 720                  * the LLMNR multicast addresses. See RFC 4795,
 721                  * section 2.5. */
 722
 723                 if (p->family == AF_INET && !in_addr_equal(AF_INET, &p->destination, (union in_addr_union*) &LLMNR_MULTICAST_IPV4_ADDRESS))
 724                         return;
 725
 726                 if (p->family == AF_INET6 && !in_addr_equal(AF_INET6, &p->destination, (union in_addr_union*) &LLMNR_MULTICAST_IPV6_ADDRESS))
 727                         return;
 728         }
 729
 730         r = dns_packet_extract(p);
 731         if (r < 0) {
 732                 log_debug_errno(r, "Failed to extract resource records from incoming packet: %m");
 733                 return;
 734         }
 735
 736         if (DNS_PACKET_LLMNR_C(p)) {
 737                 /* Somebody notified us about a possible conflict */
 738                 dns_scope_verify_conflicts(s, p);
 739                 return;
 740         }
 741
 742         assert(dns_question_size(p->question) == 1);
 743         key = p->question->keys[0];
 744
 745         r = dns_zone_lookup(&s->zone, key, 0, &answer, &soa, &tentative);
 746         if (r < 0) {
 747                 log_debug_errno(r, "Failed to lookup key: %m");
 748                 return;
 749         }
 750         if (r == 0)
 751                 return;
 752
 753         if (answer)
 754                 dns_answer_order_by_scope(answer, in_addr_is_link_local(p->family, &p->sender) > 0);
 755
 756         r = dns_scope_make_reply_packet(s, DNS_PACKET_ID(p), DNS_RCODE_SUCCESS, p->question, answer, soa, tentative, &reply);
 757         if (r < 0) {
 758                 log_debug_errno(r, "Failed to build reply packet: %m");
 759                 return;
 760         }
 761
 762         if (stream) {
 763                 r = dns_stream_write_packet(stream, reply);
 764                 if (r < 0) {
 765                         log_debug_errno(r, "Failed to enqueue reply packet: %m");
 766                         return;
 767                 }
 768
 769                 /* Let's take an extra reference on this stream, so that it stays around after returning. The reference
 770                  * will be dangling until the stream is disconnected, and the default completion handler of the stream
 771                  * will then unref the stream and destroy it */
 772                 if (DNS_STREAM_QUEUED(stream))
 773                         dns_stream_ref(stream);
 774         } else {
 775                 int fd;
 776
 777                 if (!ratelimit_below(&s->ratelimit))
 778                         return;
 779
 780                 if (p->family == AF_INET)
 781                         fd = manager_llmnr_ipv4_udp_fd(s->manager);
 782                 else if (p->family == AF_INET6)
 783                         fd = manager_llmnr_ipv6_udp_fd(s->manager);
 784                 else {
 785                         log_debug("Unknown protocol");
 786                         return;
 787                 }
 788                 if (fd < 0) {
 789                         log_debug_errno(fd, "Failed to get reply socket: %m");
 790                         return;
 791                 }
 792
 793                 /* Note that we always immediately reply to all LLMNR
 794                  * requests, and do not wait any time, since we
 795                  * verified uniqueness for all records. Also see RFC
 796                  * 4795, Section 2.7 */
 797
 798                 r = manager_send(s->manager, fd, p->ifindex, p->family, &p->sender, p->sender_port, NULL, reply);
 799                 if (r < 0) {
 800                         log_debug_errno(r, "Failed to send reply packet: %m");
 801                         return;
 802                 }
 803         }
 804 }
 805
 806 DnsTransaction *dns_scope_find_transaction(DnsScope *scope, DnsResourceKey *key, bool cache_ok) {
 807         DnsTransaction *t;
 808
 809         assert(scope);
 810         assert(key);
 811
 812         /* Try to find an ongoing transaction that is a equal to the
 813          * specified question */
 814         t = hashmap_get(scope->transactions_by_key, key);
 815         if (!t)
 816                 return NULL;
 817
 818         /* Refuse reusing transactions that completed based on cached
 819          * data instead of a real packet, if that's requested. */
 820         if (!cache_ok &&
 821             IN_SET(t->state, DNS_TRANSACTION_SUCCESS, DNS_TRANSACTION_RCODE_FAILURE) &&
 822             t->answer_source != DNS_TRANSACTION_NETWORK)
 823                 return NULL;
 824
 825         return t;
 826 }
 827
 828 static int dns_scope_make_conflict_packet(
 829                 DnsScope *s,
 830                 DnsResourceRecord *rr,
 831                 DnsPacket **ret) {
 832
 833         _cleanup_(dns_packet_unrefp) DnsPacket *p = NULL;
 834         int r;
 835
 836         assert(s);
 837         assert(rr);
 838         assert(ret);
 839
 840         r = dns_packet_new(&p, s->protocol, 0, DNS_PACKET_SIZE_MAX);
 841         if (r < 0)
 842                 return r;
 843
 844         DNS_PACKET_HEADER(p)->flags = htobe16(DNS_PACKET_MAKE_FLAGS(
 845                                                               0 /* qr */,
 846                                                               0 /* opcode */,
 847                                                               1 /* conflict */,
 848                                                               0 /* tc */,
 849                                                               0 /* t */,
 850                                                               0 /* (ra) */,
 851                                                               0 /* (ad) */,
 852                                                               0 /* (cd) */,
 853                                                               0));
 854
 855         /* For mDNS, the transaction ID should always be 0 */
 856         if (s->protocol != DNS_PROTOCOL_MDNS)
 857                 random_bytes(&DNS_PACKET_HEADER(p)->id, sizeof(uint16_t));
 858
 859         DNS_PACKET_HEADER(p)->qdcount = htobe16(1);
 860         DNS_PACKET_HEADER(p)->arcount = htobe16(1);
 861
 862         r = dns_packet_append_key(p, rr->key, 0, NULL);
 863         if (r < 0)
 864                 return r;
 865
 866         r = dns_packet_append_rr(p, rr, 0, NULL, NULL);
 867         if (r < 0)
 868                 return r;
 869
 870         *ret = TAKE_PTR(p);
 871
 872         return 0;
 873 }
 874
 875 static int on_conflict_dispatch(sd_event_source *es, usec_t usec, void *userdata) {
 876         DnsScope *scope = userdata;
 877         int r;
 878
 879         assert(es);
 880         assert(scope);
 881
 882         scope->conflict_event_source = sd_event_source_unref(scope->conflict_event_source);
 883
 884         for (;;) {
 885                 _cleanup_(dns_resource_key_unrefp) DnsResourceKey *key = NULL;
 886                 _cleanup_(dns_resource_record_unrefp) DnsResourceRecord *rr = NULL;
 887                 _cleanup_(dns_packet_unrefp) DnsPacket *p = NULL;
 888
 889                 key = ordered_hashmap_first_key(scope->conflict_queue);
 890                 if (!key)
 891                         break;
 892
 893                 rr = ordered_hashmap_remove(scope->conflict_queue, key);
 894                 assert(rr);
 895
 896                 r = dns_scope_make_conflict_packet(scope, rr, &p);
 897                 if (r < 0) {
 898                         log_error_errno(r, "Failed to make conflict packet: %m");
 899                         return 0;
 900                 }
 901
 902                 r = dns_scope_emit_udp(scope, -1, p);
 903                 if (r < 0)
 904                         log_debug_errno(r, "Failed to send conflict packet: %m");
 905         }
 906
 907         return 0;
 908 }
 909
 910 int dns_scope_notify_conflict(DnsScope *scope, DnsResourceRecord *rr) {
 911         usec_t jitter;
 912         int r;
 913
 914         assert(scope);
 915         assert(rr);
 916
 917         /* We don't send these queries immediately. Instead, we queue
 918          * them, and send them after some jitter delay. */
 919         r = ordered_hashmap_ensure_allocated(&scope->conflict_queue, &dns_resource_key_hash_ops);
 920         if (r < 0) {
 921                 log_oom();
 922                 return r;
 923         }
 924
 925         /* We only place one RR per key in the conflict
 926          * messages, not all of them. That should be enough to
 927          * indicate where there might be a conflict */
 928         r = ordered_hashmap_put(scope->conflict_queue, rr->key, rr);
 929         if (IN_SET(r, 0, -EEXIST))
 930                 return 0;
 931         if (r < 0)
 932                 return log_debug_errno(r, "Failed to queue conflicting RR: %m");
 933
 934         dns_resource_key_ref(rr->key);
 935         dns_resource_record_ref(rr);
 936
 937         if (scope->conflict_event_source)
 938                 return 0;
 939
 940         random_bytes(&jitter, sizeof(jitter));
 941         jitter %= LLMNR_JITTER_INTERVAL_USEC;
 942
 943         r = sd_event_add_time(scope->manager->event,
 944                               &scope->conflict_event_source,
 945                               clock_boottime_or_monotonic(),
 946                               now(clock_boottime_or_monotonic()) + jitter,
 947                               LLMNR_JITTER_INTERVAL_USEC,
 948                               on_conflict_dispatch, scope);
 949         if (r < 0)
 950                 return log_debug_errno(r, "Failed to add conflict dispatch event: %m");
 951
 952         (void) sd_event_source_set_description(scope->conflict_event_source, "scope-conflict");
 953
 954         return 0;
 955 }
 956
 957 void dns_scope_check_conflicts(DnsScope *scope, DnsPacket *p) {
 958         DnsResourceRecord *rr;
 959         int r;
 960
 961         assert(scope);
 962         assert(p);
 963
 964         if (!IN_SET(p->protocol, DNS_PROTOCOL_LLMNR, DNS_PROTOCOL_MDNS))
 965                 return;
 966
 967         if (DNS_PACKET_RRCOUNT(p) <= 0)
 968                 return;
 969
 970         if (p->protocol == DNS_PROTOCOL_LLMNR) {
 971                 if (DNS_PACKET_LLMNR_C(p) != 0)
 972                         return;
 973
 974                 if (DNS_PACKET_LLMNR_T(p) != 0)
 975                         return;
 976         }
 977
 978         if (manager_our_packet(scope->manager, p))
 979                 return;
 980
 981         r = dns_packet_extract(p);
 982         if (r < 0) {
 983                 log_debug_errno(r, "Failed to extract packet: %m");
 984                 return;
 985         }
 986
 987         log_debug("Checking for conflicts...");
 988
 989         DNS_ANSWER_FOREACH(rr, p->answer) {
 990                 /* No conflict if it is DNS-SD RR used for service enumeration. */
 991                 if (dns_resource_key_is_dnssd_ptr(rr->key))
 992                         continue;
 993
 994                 /* Check for conflicts against the local zone. If we
 995                  * found one, we won't check any further */
 996                 r = dns_zone_check_conflicts(&scope->zone, rr);
 997                 if (r != 0)
 998                         continue;
 999
1000                 /* Check for conflicts against the local cache. If so,
1001                  * send out an advisory query, to inform everybody */
1002                 r = dns_cache_check_conflicts(&scope->cache, rr, p->family, &p->sender);
1003                 if (r <= 0)
1004                         continue;
1005
1006                 dns_scope_notify_conflict(scope, rr);
1007         }
1008 }
1009
1010 void dns_scope_dump(DnsScope *s, FILE *f) {
1011         assert(s);
1012
1013         if (!f)
1014                 f = stdout;
1015
1016         fputs("[Scope protocol=", f);
1017         fputs(dns_protocol_to_string(s->protocol), f);
1018
1019         if (s->link) {
1020                 fputs(" interface=", f);
1021                 fputs(s->link->name, f);
1022         }
1023
1024         if (s->family != AF_UNSPEC) {
1025                 fputs(" family=", f);
1026                 fputs(af_to_name(s->family), f);
1027         }
1028
1029         fputs("]\n", f);
1030
1031         if (!dns_zone_is_empty(&s->zone)) {
1032                 fputs("ZONE:\n", f);
1033                 dns_zone_dump(&s->zone, f);
1034         }
1035
1036         if (!dns_cache_is_empty(&s->cache)) {
1037                 fputs("CACHE:\n", f);
1038                 dns_cache_dump(&s->cache, f);
1039         }
1040 }
1041
1042 DnsSearchDomain *dns_scope_get_search_domains(DnsScope *s) {
1043         assert(s);
1044
1045         if (s->protocol != DNS_PROTOCOL_DNS)
1046                 return NULL;
1047
1048         if (s->link)
1049                 return s->link->search_domains;
1050
1051         return s->manager->search_domains;
1052 }
1053
1054 bool dns_scope_name_needs_search_domain(DnsScope *s, const char *name) {
1055         assert(s);
1056
1057         if (s->protocol != DNS_PROTOCOL_DNS)
1058                 return false;
1059
1060         return dns_name_is_single_label(name);
1061 }
1062
1063 bool dns_scope_network_good(DnsScope *s) {
1064         /* Checks whether the network is in good state for lookups on this scope. For mDNS/LLMNR/Classic DNS scopes
1065          * bound to links this is easy, as they don't even exist if the link isn't in a suitable state. For the global
1066          * DNS scope we check whether there are any links that are up and have an address. */
1067
1068         if (s->link)
1069                 return true;
1070
1071         return manager_routable(s->manager, AF_UNSPEC);
1072 }
1073
1074 int dns_scope_ifindex(DnsScope *s) {
1075         assert(s);
1076
1077         if (s->link)
1078                 return s->link->ifindex;
1079
1080         return 0;
1081 }
1082
1083 static int on_announcement_timeout(sd_event_source *s, usec_t usec, void *userdata) {
1084         DnsScope *scope = userdata;
1085
1086         assert(s);
1087
1088         scope->announce_event_source = sd_event_source_unref(scope->announce_event_source);
1089
1090         (void) dns_scope_announce(scope, false);
1091         return 0;
1092 }
1093
1094 int dns_scope_announce(DnsScope *scope, bool goodbye) {
1095         _cleanup_(dns_answer_unrefp) DnsAnswer *answer = NULL;
1096         _cleanup_(dns_packet_unrefp) DnsPacket *p = NULL;
1097         _cleanup_set_free_ Set *types = NULL;
1098         DnsTransaction *t;
1099         DnsZoneItem *z, *i;
1100         unsigned size = 0;
1101         Iterator iterator;
1102         char *service_type;
1103         int r;
1104
1105         if (!scope)
1106                 return 0;
1107
1108         if (scope->protocol != DNS_PROTOCOL_MDNS)
1109                 return 0;
1110
1111         /* Check if we're done with probing. */
1112         LIST_FOREACH(transactions_by_scope, t, scope->transactions)
1113                 if (DNS_TRANSACTION_IS_LIVE(t->state))
1114                         return 0;
1115
1116         /* Check if there're services pending conflict resolution. */
1117         if (manager_next_dnssd_names(scope->manager))
1118                 return 0; /* we reach this point only if changing hostname didn't help */
1119
1120         /* Calculate answer's size. */
1121         HASHMAP_FOREACH(z, scope->zone.by_key, iterator) {
1122                 if (z->state != DNS_ZONE_ITEM_ESTABLISHED)
1123                         continue;
1124
1125                 if (z->rr->key->type == DNS_TYPE_PTR &&
1126                     !dns_zone_contains_name(&scope->zone, z->rr->ptr.name)) {
1127                         char key_str[DNS_RESOURCE_KEY_STRING_MAX];
1128
1129                         log_debug("Skip PTR RR <%s> since its counterparts seem to be withdrawn", dns_resource_key_to_string(z->rr->key, key_str, sizeof key_str));
1130                         z->state = DNS_ZONE_ITEM_WITHDRAWN;
1131                         continue;
1132                 }
1133
1134                 /* Collect service types for _services._dns-sd._udp.local RRs in a set */
1135                 if (!scope->announced &&
1136                     dns_resource_key_is_dnssd_ptr(z->rr->key)) {
1137                         if (!set_contains(types, dns_resource_key_name(z->rr->key))) {
1138                                 r = set_ensure_allocated(&types, &dns_name_hash_ops);
1139                                 if (r < 0)
1140                                         return log_debug_errno(r, "Failed to allocate set: %m");
1141
1142                                 r = set_put(types, dns_resource_key_name(z->rr->key));
1143                                 if (r < 0)
1144                                         return log_debug_errno(r, "Failed to add item to set: %m");
1145                         }
1146                 }
1147
1148                 LIST_FOREACH(by_key, i, z)
1149                         size++;
1150         }
1151
1152         answer = dns_answer_new(size + set_size(types));
1153         if (!answer)
1154                 return log_oom();
1155
1156         /* Second iteration, actually add RRs to the answer. */
1157         HASHMAP_FOREACH(z, scope->zone.by_key, iterator)
1158                 LIST_FOREACH (by_key, i, z) {
1159                         DnsAnswerFlags flags;
1160
1161                         if (i->state != DNS_ZONE_ITEM_ESTABLISHED)
1162                                 continue;
1163
1164                         if (dns_resource_key_is_dnssd_ptr(i->rr->key))
1165                                 flags = goodbye ? DNS_ANSWER_GOODBYE : 0;
1166                         else
1167                                 flags = goodbye ? (DNS_ANSWER_GOODBYE|DNS_ANSWER_CACHE_FLUSH) : DNS_ANSWER_CACHE_FLUSH;
1168
1169                         r = dns_answer_add(answer, i->rr, 0 , flags);
1170                         if (r < 0)
1171                                 return log_debug_errno(r, "Failed to add RR to announce: %m");
1172                 }
1173
1174         /* Since all the active services are in the zone make them discoverable now. */
1175         SET_FOREACH(service_type, types, iterator) {
1176                 _cleanup_(dns_resource_record_unrefp) DnsResourceRecord *rr;
1177
1178                 rr = dns_resource_record_new_full(DNS_CLASS_IN, DNS_TYPE_PTR,
1179                                                   "_services._dns-sd._udp.local");
1180                 rr->ptr.name = strdup(service_type);
1181                 rr->ttl = MDNS_DEFAULT_TTL;
1182
1183                 r = dns_zone_put(&scope->zone, scope, rr, false);
1184                 if (r < 0)
1185                         log_warning_errno(r, "Failed to add DNS-SD PTR record to MDNS zone: %m");
1186
1187                 r = dns_answer_add(answer, rr, 0 , 0);
1188                 if (r < 0)
1189                         return log_debug_errno(r, "Failed to add RR to announce: %m");
1190         }
1191
1192         if (dns_answer_isempty(answer))
1193                 return 0;
1194
1195         r = dns_scope_make_reply_packet(scope, 0, DNS_RCODE_SUCCESS, NULL, answer, NULL, false, &p);
1196         if (r < 0)
1197                 return log_debug_errno(r, "Failed to build reply packet: %m");
1198
1199         r = dns_scope_emit_udp(scope, -1, p);
1200         if (r < 0)
1201                 return log_debug_errno(r, "Failed to send reply packet: %m");
1202
1203         /* In section 8.3 of RFC6762: "The Multicast DNS responder MUST send at least two unsolicited
1204          * responses, one second apart." */
1205         if (!scope->announced) {
1206                 usec_t ts;
1207
1208                 scope->announced = true;
1209
1210                 assert_se(sd_event_now(scope->manager->event, clock_boottime_or_monotonic(), &ts) >= 0);
1211                 ts += MDNS_ANNOUNCE_DELAY;
1212
1213                 r = sd_event_add_time(
1214                                 scope->manager->event,
1215                                 &scope->announce_event_source,
1216                                 clock_boottime_or_monotonic(),
1217                                 ts,
1218                                 MDNS_JITTER_RANGE_USEC,
1219                                 on_announcement_timeout, scope);
1220                 if (r < 0)
1221                         return log_debug_errno(r, "Failed to schedule second announcement: %m");
1222
1223                 (void) sd_event_source_set_description(scope->announce_event_source, "mdns-announce");
1224         }
1225
1226         return 0;
1227 }
1228
1229 int dns_scope_add_dnssd_services(DnsScope *scope) {
1230         Iterator i;
1231         DnssdService *service;
1232         DnssdTxtData *txt_data;
1233         int r;
1234
1235         assert(scope);
1236
1237         if (hashmap_size(scope->manager->dnssd_services) == 0)
1238                 return 0;
1239
1240         scope->announced = false;
1241
1242         HASHMAP_FOREACH(service, scope->manager->dnssd_services, i) {
1243                 service->withdrawn = false;
1244
1245                 r = dns_zone_put(&scope->zone, scope, service->ptr_rr, false);
1246                 if (r < 0)
1247                         log_warning_errno(r, "Failed to add PTR record to MDNS zone: %m");
1248
1249                 r = dns_zone_put(&scope->zone, scope, service->srv_rr, true);
1250                 if (r < 0)
1251                         log_warning_errno(r, "Failed to add SRV record to MDNS zone: %m");
1252
1253                 LIST_FOREACH(items, txt_data, service->txt_data_items) {
1254                         r = dns_zone_put(&scope->zone, scope, txt_data->rr, true);
1255                         if (r < 0)
1256                                 log_warning_errno(r, "Failed to add TXT record to MDNS zone: %m");
1257                 }
1258         }
1259
1260         return 0;
1261 }
1262
1263 int dns_scope_remove_dnssd_services(DnsScope *scope) {
1264         _cleanup_(dns_resource_key_unrefp) DnsResourceKey *key = NULL;
1265         Iterator i;
1266         DnssdService *service;
1267         DnssdTxtData *txt_data;
1268         int r;
1269
1270         assert(scope);
1271
1272         key = dns_resource_key_new(DNS_CLASS_IN, DNS_TYPE_PTR,
1273                                    "_services._dns-sd._udp.local");
1274         if (!key)
1275                 return log_oom();
1276
1277         r = dns_zone_remove_rrs_by_key(&scope->zone, key);
1278         if (r < 0)
1279                 return r;
1280
1281         HASHMAP_FOREACH(service, scope->manager->dnssd_services, i) {
1282                 dns_zone_remove_rr(&scope->zone, service->ptr_rr);
1283                 dns_zone_remove_rr(&scope->zone, service->srv_rr);
1284                 LIST_FOREACH(items, txt_data, service->txt_data_items)
1285                         dns_zone_remove_rr(&scope->zone, txt_data->rr);
1286         }
1287
1288         return 0;
1289 }