src/resolve/resolved-link.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2
   3 #include <net/if.h>
   4 #include <linux/if.h>
   5 #include <unistd.h>
   6
   7 #include "sd-network.h"
   8
   9 #include "alloc-util.h"
  10 #include "env-file.h"
  11 #include "fd-util.h"
  12 #include "fileio.h"
  13 #include "mkdir.h"
  14 #include "parse-util.h"
  15 #include "resolved-link.h"
  16 #include "resolved-llmnr.h"
  17 #include "resolved-mdns.h"
  18 #include "string-util.h"
  19 #include "strv.h"
  20 #include "tmpfile-util.h"
  21
  22 int link_new(Manager *m, Link **ret, int ifindex) {
  23         _cleanup_(link_freep) Link *l = NULL;
  24         int r;
  25
  26         assert(m);
  27         assert(ifindex > 0);
  28
  29         r = hashmap_ensure_allocated(&m->links, NULL);
  30         if (r < 0)
  31                 return r;
  32
  33         l = new(Link, 1);
  34         if (!l)
  35                 return -ENOMEM;
  36
  37         *l = (Link) {
  38                 .ifindex = ifindex,
  39                 .default_route = -1,
  40                 .llmnr_support = RESOLVE_SUPPORT_YES,
  41                 .mdns_support = RESOLVE_SUPPORT_NO,
  42                 .dnssec_mode = _DNSSEC_MODE_INVALID,
  43                 .dns_over_tls_mode = _DNS_OVER_TLS_MODE_INVALID,
  44                 .operstate = IF_OPER_UNKNOWN,
  45         };
  46
  47         if (asprintf(&l->state_file, "/run/systemd/resolve/netif/%i", ifindex) < 0)
  48                 return -ENOMEM;
  49
  50         r = hashmap_put(m->links, INT_TO_PTR(ifindex), l);
  51         if (r < 0)
  52                 return r;
  53
  54         l->manager = m;
  55
  56         if (ret)
  57                 *ret = l;
  58         l = NULL;
  59
  60         return 0;
  61 }
  62
  63 void link_flush_settings(Link *l) {
  64         assert(l);
  65
  66         l->default_route = -1;
  67         l->llmnr_support = RESOLVE_SUPPORT_YES;
  68         l->mdns_support = RESOLVE_SUPPORT_NO;
  69         l->dnssec_mode = _DNSSEC_MODE_INVALID;
  70         l->dns_over_tls_mode = _DNS_OVER_TLS_MODE_INVALID;
  71
  72         dns_server_unlink_all(l->dns_servers);
  73         dns_search_domain_unlink_all(l->search_domains);
  74
  75         l->dnssec_negative_trust_anchors = set_free_free(l->dnssec_negative_trust_anchors);
  76 }
  77
  78 Link *link_free(Link *l) {
  79         if (!l)
  80                 return NULL;
  81
  82         /* Send goodbye messages. */
  83         dns_scope_announce(l->mdns_ipv4_scope, true);
  84         dns_scope_announce(l->mdns_ipv6_scope, true);
  85
  86         link_flush_settings(l);
  87
  88         while (l->addresses)
  89                 (void) link_address_free(l->addresses);
  90
  91         if (l->manager)
  92                 hashmap_remove(l->manager->links, INT_TO_PTR(l->ifindex));
  93
  94         dns_scope_free(l->unicast_scope);
  95         dns_scope_free(l->llmnr_ipv4_scope);
  96         dns_scope_free(l->llmnr_ipv6_scope);
  97         dns_scope_free(l->mdns_ipv4_scope);
  98         dns_scope_free(l->mdns_ipv6_scope);
  99
 100         free(l->state_file);
 101
 102         return mfree(l);
 103 }
 104
 105 void link_allocate_scopes(Link *l) {
 106         bool unicast_relevant;
 107         int r;
 108
 109         assert(l);
 110
 111         /* If a link that used to be relevant is no longer, or a link that did not use to be relevant now becomes
 112          * relevant, let's reinit the learnt global DNS server information, since we might talk to different servers
 113          * now, even if they have the same addresses as before. */
 114
 115         unicast_relevant = link_relevant(l, AF_UNSPEC, false);
 116         if (unicast_relevant != l->unicast_relevant) {
 117                 l->unicast_relevant = unicast_relevant;
 118
 119                 dns_server_reset_features_all(l->manager->fallback_dns_servers);
 120                 dns_server_reset_features_all(l->manager->dns_servers);
 121
 122                 /* Also, flush the global unicast scope, to deal with split horizon setups, where talking through one
 123                  * interface reveals different DNS zones than through others. */
 124                 if (l->manager->unicast_scope)
 125                         dns_cache_flush(&l->manager->unicast_scope->cache);
 126         }
 127
 128         /* And now, allocate all scopes that makes sense now if we didn't have them yet, and drop those which we don't
 129          * need anymore */
 130
 131         if (unicast_relevant && l->dns_servers) {
 132                 if (!l->unicast_scope) {
 133                         dns_server_reset_features_all(l->dns_servers);
 134
 135                         r = dns_scope_new(l->manager, &l->unicast_scope, l, DNS_PROTOCOL_DNS, AF_UNSPEC);
 136                         if (r < 0)
 137                                 log_warning_errno(r, "Failed to allocate DNS scope: %m");
 138                 }
 139         } else
 140                 l->unicast_scope = dns_scope_free(l->unicast_scope);
 141
 142         if (link_relevant(l, AF_INET, true) &&
 143             l->llmnr_support != RESOLVE_SUPPORT_NO &&
 144             l->manager->llmnr_support != RESOLVE_SUPPORT_NO) {
 145                 if (!l->llmnr_ipv4_scope) {
 146                         r = dns_scope_new(l->manager, &l->llmnr_ipv4_scope, l, DNS_PROTOCOL_LLMNR, AF_INET);
 147                         if (r < 0)
 148                                 log_warning_errno(r, "Failed to allocate LLMNR IPv4 scope: %m");
 149                 }
 150         } else
 151                 l->llmnr_ipv4_scope = dns_scope_free(l->llmnr_ipv4_scope);
 152
 153         if (link_relevant(l, AF_INET6, true) &&
 154             l->llmnr_support != RESOLVE_SUPPORT_NO &&
 155             l->manager->llmnr_support != RESOLVE_SUPPORT_NO &&
 156             socket_ipv6_is_supported()) {
 157                 if (!l->llmnr_ipv6_scope) {
 158                         r = dns_scope_new(l->manager, &l->llmnr_ipv6_scope, l, DNS_PROTOCOL_LLMNR, AF_INET6);
 159                         if (r < 0)
 160                                 log_warning_errno(r, "Failed to allocate LLMNR IPv6 scope: %m");
 161                 }
 162         } else
 163                 l->llmnr_ipv6_scope = dns_scope_free(l->llmnr_ipv6_scope);
 164
 165         if (link_relevant(l, AF_INET, true) &&
 166             l->mdns_support != RESOLVE_SUPPORT_NO &&
 167             l->manager->mdns_support != RESOLVE_SUPPORT_NO) {
 168                 if (!l->mdns_ipv4_scope) {
 169                         r = dns_scope_new(l->manager, &l->mdns_ipv4_scope, l, DNS_PROTOCOL_MDNS, AF_INET);
 170                         if (r < 0)
 171                                 log_warning_errno(r, "Failed to allocate mDNS IPv4 scope: %m");
 172                 }
 173         } else
 174                 l->mdns_ipv4_scope = dns_scope_free(l->mdns_ipv4_scope);
 175
 176         if (link_relevant(l, AF_INET6, true) &&
 177             l->mdns_support != RESOLVE_SUPPORT_NO &&
 178             l->manager->mdns_support != RESOLVE_SUPPORT_NO) {
 179                 if (!l->mdns_ipv6_scope) {
 180                         r = dns_scope_new(l->manager, &l->mdns_ipv6_scope, l, DNS_PROTOCOL_MDNS, AF_INET6);
 181                         if (r < 0)
 182                                 log_warning_errno(r, "Failed to allocate mDNS IPv6 scope: %m");
 183                 }
 184         } else
 185                 l->mdns_ipv6_scope = dns_scope_free(l->mdns_ipv6_scope);
 186 }
 187
 188 void link_add_rrs(Link *l, bool force_remove) {
 189         LinkAddress *a;
 190         int r;
 191
 192         LIST_FOREACH(addresses, a, l->addresses)
 193                 link_address_add_rrs(a, force_remove);
 194
 195         if (!force_remove &&
 196             l->mdns_support == RESOLVE_SUPPORT_YES &&
 197             l->manager->mdns_support == RESOLVE_SUPPORT_YES) {
 198
 199                 if (l->mdns_ipv4_scope) {
 200                         r = dns_scope_add_dnssd_services(l->mdns_ipv4_scope);
 201                         if (r < 0)
 202                                 log_warning_errno(r, "Failed to add IPv4 DNS-SD services: %m");
 203                 }
 204
 205                 if (l->mdns_ipv6_scope) {
 206                         r = dns_scope_add_dnssd_services(l->mdns_ipv6_scope);
 207                         if (r < 0)
 208                                 log_warning_errno(r, "Failed to add IPv6 DNS-SD services: %m");
 209                 }
 210
 211         } else {
 212
 213                 if (l->mdns_ipv4_scope) {
 214                         r = dns_scope_remove_dnssd_services(l->mdns_ipv4_scope);
 215                         if (r < 0)
 216                                 log_warning_errno(r, "Failed to remove IPv4 DNS-SD services: %m");
 217                 }
 218
 219                 if (l->mdns_ipv6_scope) {
 220                         r = dns_scope_remove_dnssd_services(l->mdns_ipv6_scope);
 221                         if (r < 0)
 222                                 log_warning_errno(r, "Failed to remove IPv6 DNS-SD services: %m");
 223                 }
 224         }
 225 }
 226
 227 int link_process_rtnl(Link *l, sd_netlink_message *m) {
 228         const char *n = NULL;
 229         int r;
 230
 231         assert(l);
 232         assert(m);
 233
 234         r = sd_rtnl_message_link_get_flags(m, &l->flags);
 235         if (r < 0)
 236                 return r;
 237
 238         (void) sd_netlink_message_read_u32(m, IFLA_MTU, &l->mtu);
 239         (void) sd_netlink_message_read_u8(m, IFLA_OPERSTATE, &l->operstate);
 240
 241         if (sd_netlink_message_read_string(m, IFLA_IFNAME, &n) >= 0) {
 242                 strncpy(l->name, n, sizeof(l->name)-1);
 243                 char_array_0(l->name);
 244         }
 245
 246         link_allocate_scopes(l);
 247         link_add_rrs(l, false);
 248
 249         return 0;
 250 }
 251
 252 static int link_update_dns_server_one(Link *l, const char *name) {
 253         union in_addr_union a;
 254         DnsServer *s;
 255         int family, r;
 256
 257         assert(l);
 258         assert(name);
 259
 260         r = in_addr_from_string_auto(name, &family, &a);
 261         if (r < 0)
 262                 return r;
 263
 264         s = dns_server_find(l->dns_servers, family, &a, 0);
 265         if (s) {
 266                 dns_server_move_back_and_unmark(s);
 267                 return 0;
 268         }
 269
 270         return dns_server_new(l->manager, NULL, DNS_SERVER_LINK, l, family, &a, 0);
 271 }
 272
 273 static int link_update_dns_servers(Link *l) {
 274         _cleanup_strv_free_ char **nameservers = NULL;
 275         char **nameserver;
 276         int r;
 277
 278         assert(l);
 279
 280         r = sd_network_link_get_dns(l->ifindex, &nameservers);
 281         if (r == -ENODATA) {
 282                 r = 0;
 283                 goto clear;
 284         }
 285         if (r < 0)
 286                 goto clear;
 287
 288         dns_server_mark_all(l->dns_servers);
 289
 290         STRV_FOREACH(nameserver, nameservers) {
 291                 r = link_update_dns_server_one(l, *nameserver);
 292                 if (r < 0)
 293                         goto clear;
 294         }
 295
 296         dns_server_unlink_marked(l->dns_servers);
 297         return 0;
 298
 299 clear:
 300         dns_server_unlink_all(l->dns_servers);
 301         return r;
 302 }
 303
 304 static int link_update_default_route(Link *l) {
 305         int r;
 306
 307         assert(l);
 308
 309         r = sd_network_link_get_dns_default_route(l->ifindex);
 310         if (r == -ENODATA) {
 311                 r = 0;
 312                 goto clear;
 313         }
 314         if (r < 0)
 315                 goto clear;
 316
 317         l->default_route = r > 0;
 318         return 0;
 319
 320 clear:
 321         l->default_route = -1;
 322         return r;
 323 }
 324
 325 static int link_update_llmnr_support(Link *l) {
 326         _cleanup_free_ char *b = NULL;
 327         int r;
 328
 329         assert(l);
 330
 331         r = sd_network_link_get_llmnr(l->ifindex, &b);
 332         if (r == -ENODATA) {
 333                 r = 0;
 334                 goto clear;
 335         }
 336         if (r < 0)
 337                 goto clear;
 338
 339         l->llmnr_support = resolve_support_from_string(b);
 340         if (l->llmnr_support < 0) {
 341                 r = -EINVAL;
 342                 goto clear;
 343         }
 344
 345         return 0;
 346
 347 clear:
 348         l->llmnr_support = RESOLVE_SUPPORT_YES;
 349         return r;
 350 }
 351
 352 static int link_update_mdns_support(Link *l) {
 353         _cleanup_free_ char *b = NULL;
 354         int r;
 355
 356         assert(l);
 357
 358         r = sd_network_link_get_mdns(l->ifindex, &b);
 359         if (r == -ENODATA) {
 360                 r = 0;
 361                 goto clear;
 362         }
 363         if (r < 0)
 364                 goto clear;
 365
 366         l->mdns_support = resolve_support_from_string(b);
 367         if (l->mdns_support < 0) {
 368                 r = -EINVAL;
 369                 goto clear;
 370         }
 371
 372         return 0;
 373
 374 clear:
 375         l->mdns_support = RESOLVE_SUPPORT_NO;
 376         return r;
 377 }
 378
 379 void link_set_dns_over_tls_mode(Link *l, DnsOverTlsMode mode) {
 380
 381         assert(l);
 382
 383 #if ! ENABLE_DNS_OVER_TLS
 384         if (mode != DNS_OVER_TLS_NO)
 385                 log_warning("DNS-over-TLS option for the link cannot be set to opportunistic when systemd-resolved is built without DNS-over-TLS support. Turning off DNS-over-TLS support.");
 386         return;
 387 #endif
 388
 389         l->dns_over_tls_mode = mode;
 390 }
 391
 392 static int link_update_dns_over_tls_mode(Link *l) {
 393         _cleanup_free_ char *b = NULL;
 394         int r;
 395
 396         assert(l);
 397
 398         r = sd_network_link_get_dns_over_tls(l->ifindex, &b);
 399         if (r == -ENODATA) {
 400                 r = 0;
 401                 goto clear;
 402         }
 403         if (r < 0)
 404                 goto clear;
 405
 406         l->dns_over_tls_mode = dns_over_tls_mode_from_string(b);
 407         if (l->dns_over_tls_mode < 0) {
 408                 r = -EINVAL;
 409                 goto clear;
 410         }
 411
 412         return 0;
 413
 414 clear:
 415         l->dns_over_tls_mode = _DNS_OVER_TLS_MODE_INVALID;
 416         return r;
 417 }
 418
 419 void link_set_dnssec_mode(Link *l, DnssecMode mode) {
 420
 421         assert(l);
 422
 423 #if ! HAVE_GCRYPT
 424         if (IN_SET(mode, DNSSEC_YES, DNSSEC_ALLOW_DOWNGRADE))
 425                 log_warning("DNSSEC option for the link cannot be enabled or set to allow-downgrade when systemd-resolved is built without gcrypt support. Turning off DNSSEC support.");
 426         return;
 427 #endif
 428
 429         if (l->dnssec_mode == mode)
 430                 return;
 431
 432         if ((l->dnssec_mode == _DNSSEC_MODE_INVALID) ||
 433             (l->dnssec_mode == DNSSEC_NO && mode != DNSSEC_NO) ||
 434             (l->dnssec_mode == DNSSEC_ALLOW_DOWNGRADE && mode == DNSSEC_YES)) {
 435
 436                 /* When switching from non-DNSSEC mode to DNSSEC mode, flush the cache. Also when switching from the
 437                  * allow-downgrade mode to full DNSSEC mode, flush it too. */
 438                 if (l->unicast_scope)
 439                         dns_cache_flush(&l->unicast_scope->cache);
 440         }
 441
 442         l->dnssec_mode = mode;
 443 }
 444
 445 static int link_update_dnssec_mode(Link *l) {
 446         _cleanup_free_ char *m = NULL;
 447         DnssecMode mode;
 448         int r;
 449
 450         assert(l);
 451
 452         r = sd_network_link_get_dnssec(l->ifindex, &m);
 453         if (r == -ENODATA) {
 454                 r = 0;
 455                 goto clear;
 456         }
 457         if (r < 0)
 458                 goto clear;
 459
 460         mode = dnssec_mode_from_string(m);
 461         if (mode < 0) {
 462                 r = -EINVAL;
 463                 goto clear;
 464         }
 465
 466         link_set_dnssec_mode(l, mode);
 467
 468         return 0;
 469
 470 clear:
 471         l->dnssec_mode = _DNSSEC_MODE_INVALID;
 472         return r;
 473 }
 474
 475 static int link_update_dnssec_negative_trust_anchors(Link *l) {
 476         _cleanup_strv_free_ char **ntas = NULL;
 477         _cleanup_set_free_free_ Set *ns = NULL;
 478         int r;
 479
 480         assert(l);
 481
 482         r = sd_network_link_get_dnssec_negative_trust_anchors(l->ifindex, &ntas);
 483         if (r == -ENODATA) {
 484                 r = 0;
 485                 goto clear;
 486         }
 487         if (r < 0)
 488                 goto clear;
 489
 490         ns = set_new(&dns_name_hash_ops);
 491         if (!ns)
 492                 return -ENOMEM;
 493
 494         r = set_put_strdupv(ns, ntas);
 495         if (r < 0)
 496                 return r;
 497
 498         set_free_free(l->dnssec_negative_trust_anchors);
 499         l->dnssec_negative_trust_anchors = TAKE_PTR(ns);
 500
 501         return 0;
 502
 503 clear:
 504         l->dnssec_negative_trust_anchors = set_free_free(l->dnssec_negative_trust_anchors);
 505         return r;
 506 }
 507
 508 static int link_update_search_domain_one(Link *l, const char *name, bool route_only) {
 509         DnsSearchDomain *d;
 510         int r;
 511
 512         assert(l);
 513         assert(name);
 514
 515         r = dns_search_domain_find(l->search_domains, name, &d);
 516         if (r < 0)
 517                 return r;
 518         if (r > 0)
 519                 dns_search_domain_move_back_and_unmark(d);
 520         else {
 521                 r = dns_search_domain_new(l->manager, &d, DNS_SEARCH_DOMAIN_LINK, l, name);
 522                 if (r < 0)
 523                         return r;
 524         }
 525
 526         d->route_only = route_only;
 527         return 0;
 528 }
 529
 530 static int link_update_search_domains(Link *l) {
 531         _cleanup_strv_free_ char **sdomains = NULL, **rdomains = NULL;
 532         char **i;
 533         int r, q;
 534
 535         assert(l);
 536
 537         r = sd_network_link_get_search_domains(l->ifindex, &sdomains);
 538         if (r < 0 && r != -ENODATA)
 539                 goto clear;
 540
 541         q = sd_network_link_get_route_domains(l->ifindex, &rdomains);
 542         if (q < 0 && q != -ENODATA) {
 543                 r = q;
 544                 goto clear;
 545         }
 546
 547         if (r == -ENODATA && q == -ENODATA) {
 548                 /* networkd knows nothing about this interface, and that's fine. */
 549                 r = 0;
 550                 goto clear;
 551         }
 552
 553         dns_search_domain_mark_all(l->search_domains);
 554
 555         STRV_FOREACH(i, sdomains) {
 556                 r = link_update_search_domain_one(l, *i, false);
 557                 if (r < 0)
 558                         goto clear;
 559         }
 560
 561         STRV_FOREACH(i, rdomains) {
 562                 r = link_update_search_domain_one(l, *i, true);
 563                 if (r < 0)
 564                         goto clear;
 565         }
 566
 567         dns_search_domain_unlink_marked(l->search_domains);
 568         return 0;
 569
 570 clear:
 571         dns_search_domain_unlink_all(l->search_domains);
 572         return r;
 573 }
 574
 575 static int link_is_managed(Link *l) {
 576         _cleanup_free_ char *state = NULL;
 577         int r;
 578
 579         assert(l);
 580
 581         r = sd_network_link_get_setup_state(l->ifindex, &state);
 582         if (r == -ENODATA)
 583                 return 0;
 584         if (r < 0)
 585                 return r;
 586
 587         return !STR_IN_SET(state, "pending", "unmanaged");
 588 }
 589
 590 static void link_read_settings(Link *l) {
 591         int r;
 592
 593         assert(l);
 594
 595         /* Read settings from networkd, except when networkd is not managing this interface. */
 596
 597         r = link_is_managed(l);
 598         if (r < 0) {
 599                 log_warning_errno(r, "Failed to determine whether interface %s is managed: %m", l->name);
 600                 return;
 601         }
 602         if (r == 0) {
 603
 604                 /* If this link used to be managed, but is now unmanaged, flush all our settings — but only once. */
 605                 if (l->is_managed)
 606                         link_flush_settings(l);
 607
 608                 l->is_managed = false;
 609                 return;
 610         }
 611
 612         l->is_managed = true;
 613
 614         r = link_update_dns_servers(l);
 615         if (r < 0)
 616                 log_warning_errno(r, "Failed to read DNS servers for interface %s, ignoring: %m", l->name);
 617
 618         r = link_update_llmnr_support(l);
 619         if (r < 0)
 620                 log_warning_errno(r, "Failed to read LLMNR support for interface %s, ignoring: %m", l->name);
 621
 622         r = link_update_mdns_support(l);
 623         if (r < 0)
 624                 log_warning_errno(r, "Failed to read mDNS support for interface %s, ignoring: %m", l->name);
 625
 626         r = link_update_dns_over_tls_mode(l);
 627         if (r < 0)
 628                 log_warning_errno(r, "Failed to read DNS-over-TLS mode for interface %s, ignoring: %m", l->name);
 629
 630         r = link_update_dnssec_mode(l);
 631         if (r < 0)
 632                 log_warning_errno(r, "Failed to read DNSSEC mode for interface %s, ignoring: %m", l->name);
 633
 634         r = link_update_dnssec_negative_trust_anchors(l);
 635         if (r < 0)
 636                 log_warning_errno(r, "Failed to read DNSSEC negative trust anchors for interface %s, ignoring: %m", l->name);
 637
 638         r = link_update_search_domains(l);
 639         if (r < 0)
 640                 log_warning_errno(r, "Failed to read search domains for interface %s, ignoring: %m", l->name);
 641
 642         r = link_update_default_route(l);
 643         if (r < 0)
 644                 log_warning_errno(r, "Failed to read default route setting for interface %s, proceeding anyway: %m", l->name);
 645 }
 646
 647 int link_update(Link *l) {
 648         int r;
 649
 650         assert(l);
 651
 652         link_read_settings(l);
 653         link_load_user(l);
 654
 655         if (l->llmnr_support != RESOLVE_SUPPORT_NO) {
 656                 r = manager_llmnr_start(l->manager);
 657                 if (r < 0)
 658                         return r;
 659         }
 660
 661         if (l->mdns_support != RESOLVE_SUPPORT_NO) {
 662                 r = manager_mdns_start(l->manager);
 663                 if (r < 0)
 664                         return r;
 665         }
 666
 667         link_allocate_scopes(l);
 668         link_add_rrs(l, false);
 669
 670         return 0;
 671 }
 672
 673 bool link_relevant(Link *l, int family, bool local_multicast) {
 674         _cleanup_free_ char *state = NULL;
 675         LinkAddress *a;
 676
 677         assert(l);
 678
 679         /* A link is relevant for local multicast traffic if it isn't a loopback device, has a link
 680          * beat, can do multicast and has at least one link-local (or better) IP address.
 681          *
 682          * A link is relevant for non-multicast traffic if it isn't a loopback device, has a link beat, and has at
 683          * least one routable address. */
 684
 685         if (l->flags & (IFF_LOOPBACK|IFF_DORMANT))
 686                 return false;
 687
 688         if ((l->flags & (IFF_UP|IFF_LOWER_UP)) != (IFF_UP|IFF_LOWER_UP))
 689                 return false;
 690
 691         if (local_multicast) {
 692                 if ((l->flags & IFF_MULTICAST) != IFF_MULTICAST)
 693                         return false;
 694         }
 695
 696         /* Check kernel operstate
 697          * https://www.kernel.org/doc/Documentation/networking/operstates.txt */
 698         if (!IN_SET(l->operstate, IF_OPER_UNKNOWN, IF_OPER_UP))
 699                 return false;
 700
 701         (void) sd_network_link_get_operational_state(l->ifindex, &state);
 702         if (state && !STR_IN_SET(state, "unknown", "degraded", "routable"))
 703                 return false;
 704
 705         LIST_FOREACH(addresses, a, l->addresses)
 706                 if ((family == AF_UNSPEC || a->family == family) && link_address_relevant(a, local_multicast))
 707                         return true;
 708
 709         return false;
 710 }
 711
 712 LinkAddress *link_find_address(Link *l, int family, const union in_addr_union *in_addr) {
 713         LinkAddress *a;
 714
 715         assert(l);
 716
 717         LIST_FOREACH(addresses, a, l->addresses)
 718                 if (a->family == family && in_addr_equal(family, &a->in_addr, in_addr))
 719                         return a;
 720
 721         return NULL;
 722 }
 723
 724 DnsServer* link_set_dns_server(Link *l, DnsServer *s) {
 725         assert(l);
 726
 727         if (l->current_dns_server == s)
 728                 return s;
 729
 730         if (s)
 731                 log_debug("Switching to DNS server %s for interface %s.", dns_server_string(s), l->name);
 732
 733         dns_server_unref(l->current_dns_server);
 734         l->current_dns_server = dns_server_ref(s);
 735
 736         if (l->unicast_scope)
 737                 dns_cache_flush(&l->unicast_scope->cache);
 738
 739         return s;
 740 }
 741
 742 DnsServer *link_get_dns_server(Link *l) {
 743         assert(l);
 744
 745         if (!l->current_dns_server)
 746                 link_set_dns_server(l, l->dns_servers);
 747
 748         return l->current_dns_server;
 749 }
 750
 751 void link_next_dns_server(Link *l) {
 752         assert(l);
 753
 754         if (!l->current_dns_server)
 755                 return;
 756
 757         /* Change to the next one, but make sure to follow the linked
 758          * list only if this server is actually still linked. */
 759         if (l->current_dns_server->linked && l->current_dns_server->servers_next) {
 760                 link_set_dns_server(l, l->current_dns_server->servers_next);
 761                 return;
 762         }
 763
 764         link_set_dns_server(l, l->dns_servers);
 765 }
 766
 767 DnsOverTlsMode link_get_dns_over_tls_mode(Link *l) {
 768         assert(l);
 769
 770         if (l->dns_over_tls_mode != _DNS_OVER_TLS_MODE_INVALID)
 771                 return l->dns_over_tls_mode;
 772
 773         return manager_get_dns_over_tls_mode(l->manager);
 774 }
 775
 776 DnssecMode link_get_dnssec_mode(Link *l) {
 777         assert(l);
 778
 779         if (l->dnssec_mode != _DNSSEC_MODE_INVALID)
 780                 return l->dnssec_mode;
 781
 782         return manager_get_dnssec_mode(l->manager);
 783 }
 784
 785 bool link_dnssec_supported(Link *l) {
 786         DnsServer *server;
 787
 788         assert(l);
 789
 790         if (link_get_dnssec_mode(l) == DNSSEC_NO)
 791                 return false;
 792
 793         server = link_get_dns_server(l);
 794         if (server)
 795                 return dns_server_dnssec_supported(server);
 796
 797         return true;
 798 }
 799
 800 int link_address_new(Link *l, LinkAddress **ret, int family, const union in_addr_union *in_addr) {
 801         LinkAddress *a;
 802
 803         assert(l);
 804         assert(in_addr);
 805
 806         a = new0(LinkAddress, 1);
 807         if (!a)
 808                 return -ENOMEM;
 809
 810         a->family = family;
 811         a->in_addr = *in_addr;
 812
 813         a->link = l;
 814         LIST_PREPEND(addresses, l->addresses, a);
 815         l->n_addresses++;
 816
 817         if (ret)
 818                 *ret = a;
 819
 820         return 0;
 821 }
 822
 823 LinkAddress *link_address_free(LinkAddress *a) {
 824         if (!a)
 825                 return NULL;
 826
 827         if (a->link) {
 828                 LIST_REMOVE(addresses, a->link->addresses, a);
 829
 830                 assert(a->link->n_addresses > 0);
 831                 a->link->n_addresses--;
 832
 833                 if (a->llmnr_address_rr) {
 834                         if (a->family == AF_INET && a->link->llmnr_ipv4_scope)
 835                                 dns_zone_remove_rr(&a->link->llmnr_ipv4_scope->zone, a->llmnr_address_rr);
 836                         else if (a->family == AF_INET6 && a->link->llmnr_ipv6_scope)
 837                                 dns_zone_remove_rr(&a->link->llmnr_ipv6_scope->zone, a->llmnr_address_rr);
 838                 }
 839
 840                 if (a->llmnr_ptr_rr) {
 841                         if (a->family == AF_INET && a->link->llmnr_ipv4_scope)
 842                                 dns_zone_remove_rr(&a->link->llmnr_ipv4_scope->zone, a->llmnr_ptr_rr);
 843                         else if (a->family == AF_INET6 && a->link->llmnr_ipv6_scope)
 844                                 dns_zone_remove_rr(&a->link->llmnr_ipv6_scope->zone, a->llmnr_ptr_rr);
 845                 }
 846
 847                 if (a->mdns_address_rr) {
 848                         if (a->family == AF_INET && a->link->mdns_ipv4_scope)
 849                                 dns_zone_remove_rr(&a->link->mdns_ipv4_scope->zone, a->mdns_address_rr);
 850                         else if (a->family == AF_INET6 && a->link->mdns_ipv6_scope)
 851                                 dns_zone_remove_rr(&a->link->mdns_ipv6_scope->zone, a->mdns_address_rr);
 852                 }
 853
 854                 if (a->mdns_ptr_rr) {
 855                         if (a->family == AF_INET && a->link->mdns_ipv4_scope)
 856                                 dns_zone_remove_rr(&a->link->mdns_ipv4_scope->zone, a->mdns_ptr_rr);
 857                         else if (a->family == AF_INET6 && a->link->mdns_ipv6_scope)
 858                                 dns_zone_remove_rr(&a->link->mdns_ipv6_scope->zone, a->mdns_ptr_rr);
 859                 }
 860         }
 861
 862         dns_resource_record_unref(a->llmnr_address_rr);
 863         dns_resource_record_unref(a->llmnr_ptr_rr);
 864         dns_resource_record_unref(a->mdns_address_rr);
 865         dns_resource_record_unref(a->mdns_ptr_rr);
 866
 867         return mfree(a);
 868 }
 869
 870 void link_address_add_rrs(LinkAddress *a, bool force_remove) {
 871         int r;
 872
 873         assert(a);
 874
 875         if (a->family == AF_INET) {
 876
 877                 if (!force_remove &&
 878                     link_address_relevant(a, true) &&
 879                     a->link->llmnr_ipv4_scope &&
 880                     a->link->llmnr_support == RESOLVE_SUPPORT_YES &&
 881                     a->link->manager->llmnr_support == RESOLVE_SUPPORT_YES) {
 882
 883                         if (!a->link->manager->llmnr_host_ipv4_key) {
 884                                 a->link->manager->llmnr_host_ipv4_key = dns_resource_key_new(DNS_CLASS_IN, DNS_TYPE_A, a->link->manager->llmnr_hostname);
 885                                 if (!a->link->manager->llmnr_host_ipv4_key) {
 886                                         r = -ENOMEM;
 887                                         goto fail;
 888                                 }
 889                         }
 890
 891                         if (!a->llmnr_address_rr) {
 892                                 a->llmnr_address_rr = dns_resource_record_new(a->link->manager->llmnr_host_ipv4_key);
 893                                 if (!a->llmnr_address_rr) {
 894                                         r = -ENOMEM;
 895                                         goto fail;
 896                                 }
 897
 898                                 a->llmnr_address_rr->a.in_addr = a->in_addr.in;
 899                                 a->llmnr_address_rr->ttl = LLMNR_DEFAULT_TTL;
 900                         }
 901
 902                         if (!a->llmnr_ptr_rr) {
 903                                 r = dns_resource_record_new_reverse(&a->llmnr_ptr_rr, a->family, &a->in_addr, a->link->manager->llmnr_hostname);
 904                                 if (r < 0)
 905                                         goto fail;
 906
 907                                 a->llmnr_ptr_rr->ttl = LLMNR_DEFAULT_TTL;
 908                         }
 909
 910                         r = dns_zone_put(&a->link->llmnr_ipv4_scope->zone, a->link->llmnr_ipv4_scope, a->llmnr_address_rr, true);
 911                         if (r < 0)
 912                                 log_warning_errno(r, "Failed to add A record to LLMNR zone: %m");
 913
 914                         r = dns_zone_put(&a->link->llmnr_ipv4_scope->zone, a->link->llmnr_ipv4_scope, a->llmnr_ptr_rr, false);
 915                         if (r < 0)
 916                                 log_warning_errno(r, "Failed to add IPv4 PTR record to LLMNR zone: %m");
 917                 } else {
 918                         if (a->llmnr_address_rr) {
 919                                 if (a->link->llmnr_ipv4_scope)
 920                                         dns_zone_remove_rr(&a->link->llmnr_ipv4_scope->zone, a->llmnr_address_rr);
 921                                 a->llmnr_address_rr = dns_resource_record_unref(a->llmnr_address_rr);
 922                         }
 923
 924                         if (a->llmnr_ptr_rr) {
 925                                 if (a->link->llmnr_ipv4_scope)
 926                                         dns_zone_remove_rr(&a->link->llmnr_ipv4_scope->zone, a->llmnr_ptr_rr);
 927                                 a->llmnr_ptr_rr = dns_resource_record_unref(a->llmnr_ptr_rr);
 928                         }
 929                 }
 930
 931                 if (!force_remove &&
 932                     link_address_relevant(a, true) &&
 933                     a->link->mdns_ipv4_scope &&
 934                     a->link->mdns_support == RESOLVE_SUPPORT_YES &&
 935                     a->link->manager->mdns_support == RESOLVE_SUPPORT_YES) {
 936                         if (!a->link->manager->mdns_host_ipv4_key) {
 937                                 a->link->manager->mdns_host_ipv4_key = dns_resource_key_new(DNS_CLASS_IN, DNS_TYPE_A, a->link->manager->mdns_hostname);
 938                                 if (!a->link->manager->mdns_host_ipv4_key) {
 939                                         r = -ENOMEM;
 940                                         goto fail;
 941                                 }
 942                         }
 943
 944                         if (!a->mdns_address_rr) {
 945                                 a->mdns_address_rr = dns_resource_record_new(a->link->manager->mdns_host_ipv4_key);
 946                                 if (!a->mdns_address_rr) {
 947                                         r = -ENOMEM;
 948                                         goto fail;
 949                                 }
 950
 951                                 a->mdns_address_rr->a.in_addr = a->in_addr.in;
 952                                 a->mdns_address_rr->ttl = MDNS_DEFAULT_TTL;
 953                         }
 954
 955                         if (!a->mdns_ptr_rr) {
 956                                 r = dns_resource_record_new_reverse(&a->mdns_ptr_rr, a->family, &a->in_addr, a->link->manager->mdns_hostname);
 957                                 if (r < 0)
 958                                         goto fail;
 959
 960                                 a->mdns_ptr_rr->ttl = MDNS_DEFAULT_TTL;
 961                         }
 962
 963                         r = dns_zone_put(&a->link->mdns_ipv4_scope->zone, a->link->mdns_ipv4_scope, a->mdns_address_rr, true);
 964                         if (r < 0)
 965                                 log_warning_errno(r, "Failed to add A record to MDNS zone: %m");
 966
 967                         r = dns_zone_put(&a->link->mdns_ipv4_scope->zone, a->link->mdns_ipv4_scope, a->mdns_ptr_rr, false);
 968                         if (r < 0)
 969                                 log_warning_errno(r, "Failed to add IPv4 PTR record to MDNS zone: %m");
 970                 } else {
 971                         if (a->mdns_address_rr) {
 972                                 if (a->link->mdns_ipv4_scope)
 973                                         dns_zone_remove_rr(&a->link->mdns_ipv4_scope->zone, a->mdns_address_rr);
 974                                 a->mdns_address_rr = dns_resource_record_unref(a->mdns_address_rr);
 975                         }
 976
 977                         if (a->mdns_ptr_rr) {
 978                                 if (a->link->mdns_ipv4_scope)
 979                                         dns_zone_remove_rr(&a->link->mdns_ipv4_scope->zone, a->mdns_ptr_rr);
 980                                 a->mdns_ptr_rr = dns_resource_record_unref(a->mdns_ptr_rr);
 981                         }
 982                 }
 983         }
 984
 985         if (a->family == AF_INET6) {
 986
 987                 if (!force_remove &&
 988                     link_address_relevant(a, true) &&
 989                     a->link->llmnr_ipv6_scope &&
 990                     a->link->llmnr_support == RESOLVE_SUPPORT_YES &&
 991                     a->link->manager->llmnr_support == RESOLVE_SUPPORT_YES) {
 992
 993                         if (!a->link->manager->llmnr_host_ipv6_key) {
 994                                 a->link->manager->llmnr_host_ipv6_key = dns_resource_key_new(DNS_CLASS_IN, DNS_TYPE_AAAA, a->link->manager->llmnr_hostname);
 995                                 if (!a->link->manager->llmnr_host_ipv6_key) {
 996                                         r = -ENOMEM;
 997                                         goto fail;
 998                                 }
 999                         }
1000
1001                         if (!a->llmnr_address_rr) {
1002                                 a->llmnr_address_rr = dns_resource_record_new(a->link->manager->llmnr_host_ipv6_key);
1003                                 if (!a->llmnr_address_rr) {
1004                                         r = -ENOMEM;
1005                                         goto fail;
1006                                 }
1007
1008                                 a->llmnr_address_rr->aaaa.in6_addr = a->in_addr.in6;
1009                                 a->llmnr_address_rr->ttl = LLMNR_DEFAULT_TTL;
1010                         }
1011
1012                         if (!a->llmnr_ptr_rr) {
1013                                 r = dns_resource_record_new_reverse(&a->llmnr_ptr_rr, a->family, &a->in_addr, a->link->manager->llmnr_hostname);
1014                                 if (r < 0)
1015                                         goto fail;
1016
1017                                 a->llmnr_ptr_rr->ttl = LLMNR_DEFAULT_TTL;
1018                         }
1019
1020                         r = dns_zone_put(&a->link->llmnr_ipv6_scope->zone, a->link->llmnr_ipv6_scope, a->llmnr_address_rr, true);
1021                         if (r < 0)
1022                                 log_warning_errno(r, "Failed to add AAAA record to LLMNR zone: %m");
1023
1024                         r = dns_zone_put(&a->link->llmnr_ipv6_scope->zone, a->link->llmnr_ipv6_scope, a->llmnr_ptr_rr, false);
1025                         if (r < 0)
1026                                 log_warning_errno(r, "Failed to add IPv6 PTR record to LLMNR zone: %m");
1027                 } else {
1028                         if (a->llmnr_address_rr) {
1029                                 if (a->link->llmnr_ipv6_scope)
1030                                         dns_zone_remove_rr(&a->link->llmnr_ipv6_scope->zone, a->llmnr_address_rr);
1031                                 a->llmnr_address_rr = dns_resource_record_unref(a->llmnr_address_rr);
1032                         }
1033
1034                         if (a->llmnr_ptr_rr) {
1035                                 if (a->link->llmnr_ipv6_scope)
1036                                         dns_zone_remove_rr(&a->link->llmnr_ipv6_scope->zone, a->llmnr_ptr_rr);
1037                                 a->llmnr_ptr_rr = dns_resource_record_unref(a->llmnr_ptr_rr);
1038                         }
1039                 }
1040
1041                 if (!force_remove &&
1042                     link_address_relevant(a, true) &&
1043                     a->link->mdns_ipv6_scope &&
1044                     a->link->mdns_support == RESOLVE_SUPPORT_YES &&
1045                     a->link->manager->mdns_support == RESOLVE_SUPPORT_YES) {
1046
1047                         if (!a->link->manager->mdns_host_ipv6_key) {
1048                                 a->link->manager->mdns_host_ipv6_key = dns_resource_key_new(DNS_CLASS_IN, DNS_TYPE_AAAA, a->link->manager->mdns_hostname);
1049                                 if (!a->link->manager->mdns_host_ipv6_key) {
1050                                         r = -ENOMEM;
1051                                         goto fail;
1052                                 }
1053                         }
1054
1055                         if (!a->mdns_address_rr) {
1056                                 a->mdns_address_rr = dns_resource_record_new(a->link->manager->mdns_host_ipv6_key);
1057                                 if (!a->mdns_address_rr) {
1058                                         r = -ENOMEM;
1059                                         goto fail;
1060                                 }
1061
1062                                 a->mdns_address_rr->aaaa.in6_addr = a->in_addr.in6;
1063                                 a->mdns_address_rr->ttl = MDNS_DEFAULT_TTL;
1064                         }
1065
1066                         if (!a->mdns_ptr_rr) {
1067                                 r = dns_resource_record_new_reverse(&a->mdns_ptr_rr, a->family, &a->in_addr, a->link->manager->mdns_hostname);
1068                                 if (r < 0)
1069                                         goto fail;
1070
1071                                 a->mdns_ptr_rr->ttl = MDNS_DEFAULT_TTL;
1072                         }
1073
1074                         r = dns_zone_put(&a->link->mdns_ipv6_scope->zone, a->link->mdns_ipv6_scope, a->mdns_address_rr, true);
1075                         if (r < 0)
1076                                 log_warning_errno(r, "Failed to add AAAA record to MDNS zone: %m");
1077
1078                         r = dns_zone_put(&a->link->mdns_ipv6_scope->zone, a->link->mdns_ipv6_scope, a->mdns_ptr_rr, false);
1079                         if (r < 0)
1080                                 log_warning_errno(r, "Failed to add IPv6 PTR record to MDNS zone: %m");
1081                 } else {
1082                         if (a->mdns_address_rr) {
1083                                 if (a->link->mdns_ipv6_scope)
1084                                         dns_zone_remove_rr(&a->link->mdns_ipv6_scope->zone, a->mdns_address_rr);
1085                                 a->mdns_address_rr = dns_resource_record_unref(a->mdns_address_rr);
1086                         }
1087
1088                         if (a->mdns_ptr_rr) {
1089                                 if (a->link->mdns_ipv6_scope)
1090                                         dns_zone_remove_rr(&a->link->mdns_ipv6_scope->zone, a->mdns_ptr_rr);
1091                                 a->mdns_ptr_rr = dns_resource_record_unref(a->mdns_ptr_rr);
1092                         }
1093                 }
1094         }
1095
1096         return;
1097
1098 fail:
1099         log_debug_errno(r, "Failed to update address RRs: %m");
1100 }
1101
1102 int link_address_update_rtnl(LinkAddress *a, sd_netlink_message *m) {
1103         int r;
1104         assert(a);
1105         assert(m);
1106
1107         r = sd_rtnl_message_addr_get_flags(m, &a->flags);
1108         if (r < 0)
1109                 return r;
1110
1111         sd_rtnl_message_addr_get_scope(m, &a->scope);
1112
1113         link_allocate_scopes(a->link);
1114         link_add_rrs(a->link, false);
1115
1116         return 0;
1117 }
1118
1119 bool link_address_relevant(LinkAddress *a, bool local_multicast) {
1120         assert(a);
1121
1122         if (a->flags & (IFA_F_DEPRECATED|IFA_F_TENTATIVE))
1123                 return false;
1124
1125         if (a->scope >= (local_multicast ? RT_SCOPE_HOST : RT_SCOPE_LINK))
1126                 return false;
1127
1128         return true;
1129 }
1130
1131 static bool link_needs_save(Link *l) {
1132         assert(l);
1133
1134         /* Returns true if any of the settings where set different from the default */
1135
1136         if (l->is_managed)
1137                 return false;
1138
1139         if (l->llmnr_support != RESOLVE_SUPPORT_YES ||
1140             l->mdns_support != RESOLVE_SUPPORT_NO ||
1141             l->dnssec_mode != _DNSSEC_MODE_INVALID ||
1142             l->dns_over_tls_mode != _DNS_OVER_TLS_MODE_INVALID)
1143                 return true;
1144
1145         if (l->dns_servers ||
1146             l->search_domains)
1147                 return true;
1148
1149         if (!set_isempty(l->dnssec_negative_trust_anchors))
1150                 return true;
1151
1152         if (l->default_route >= 0)
1153                 return true;
1154
1155         return false;
1156 }
1157
1158 int link_save_user(Link *l) {
1159         _cleanup_free_ char *temp_path = NULL;
1160         _cleanup_fclose_ FILE *f = NULL;
1161         const char *v;
1162         int r;
1163
1164         assert(l);
1165         assert(l->state_file);
1166
1167         if (!link_needs_save(l)) {
1168                 (void) unlink(l->state_file);
1169                 return 0;
1170         }
1171
1172         r = mkdir_parents(l->state_file, 0700);
1173         if (r < 0)
1174                 goto fail;
1175
1176         r = fopen_temporary(l->state_file, &f, &temp_path);
1177         if (r < 0)
1178                 goto fail;
1179
1180         (void) fchmod(fileno(f), 0644);
1181
1182         fputs("# This is private data. Do not parse.\n", f);
1183
1184         v = resolve_support_to_string(l->llmnr_support);
1185         if (v)
1186                 fprintf(f, "LLMNR=%s\n", v);
1187
1188         v = resolve_support_to_string(l->mdns_support);
1189         if (v)
1190                 fprintf(f, "MDNS=%s\n", v);
1191
1192         v = dnssec_mode_to_string(l->dnssec_mode);
1193         if (v)
1194                 fprintf(f, "DNSSEC=%s\n", v);
1195
1196         if (l->default_route >= 0)
1197                 fprintf(f, "DEFAULT_ROUTE=%s\n", yes_no(l->default_route));
1198
1199         if (l->dns_servers) {
1200                 DnsServer *server;
1201
1202                 fputs("SERVERS=", f);
1203                 LIST_FOREACH(servers, server, l->dns_servers) {
1204
1205                         if (server != l->dns_servers)
1206                                 fputc(' ', f);
1207
1208                         v = dns_server_string(server);
1209                         if (!v) {
1210                                 r = -ENOMEM;
1211                                 goto fail;
1212                         }
1213
1214                         fputs(v, f);
1215                 }
1216                 fputc('\n', f);
1217         }
1218
1219         if (l->search_domains) {
1220                 DnsSearchDomain *domain;
1221
1222                 fputs("DOMAINS=", f);
1223                 LIST_FOREACH(domains, domain, l->search_domains) {
1224
1225                         if (domain != l->search_domains)
1226                                 fputc(' ', f);
1227
1228                         if (domain->route_only)
1229                                 fputc('~', f);
1230
1231                         fputs(DNS_SEARCH_DOMAIN_NAME(domain), f);
1232                 }
1233                 fputc('\n', f);
1234         }
1235
1236         if (!set_isempty(l->dnssec_negative_trust_anchors)) {
1237                 bool space = false;
1238                 Iterator i;
1239                 char *nta;
1240
1241                 fputs("NTAS=", f);
1242                 SET_FOREACH(nta, l->dnssec_negative_trust_anchors, i) {
1243
1244                         if (space)
1245                                 fputc(' ', f);
1246
1247                         fputs(nta, f);
1248                         space = true;
1249                 }
1250                 fputc('\n', f);
1251         }
1252
1253         r = fflush_and_check(f);
1254         if (r < 0)
1255                 goto fail;
1256
1257         if (rename(temp_path, l->state_file) < 0) {
1258                 r = -errno;
1259                 goto fail;
1260         }
1261
1262         return 0;
1263
1264 fail:
1265         (void) unlink(l->state_file);
1266
1267         if (temp_path)
1268                 (void) unlink(temp_path);
1269
1270         return log_error_errno(r, "Failed to save link data %s: %m", l->state_file);
1271 }
1272
1273 int link_load_user(Link *l) {
1274         _cleanup_free_ char
1275                 *llmnr = NULL,
1276                 *mdns = NULL,
1277                 *dnssec = NULL,
1278                 *servers = NULL,
1279                 *domains = NULL,
1280                 *ntas = NULL,
1281                 *default_route = NULL;
1282
1283         ResolveSupport s;
1284         const char *p;
1285         int r;
1286
1287         assert(l);
1288         assert(l->state_file);
1289
1290         /* Try to load only a single time */
1291         if (l->loaded)
1292                 return 0;
1293         l->loaded = true;
1294
1295         if (l->is_managed)
1296                 return 0; /* if the device is managed, then networkd is our configuration source, not the bus API */
1297
1298         r = parse_env_file(NULL, l->state_file,
1299                            "LLMNR", &llmnr,
1300                            "MDNS", &mdns,
1301                            "DNSSEC", &dnssec,
1302                            "SERVERS", &servers,
1303                            "DOMAINS", &domains,
1304                            "NTAS", &ntas,
1305                            "DEFAULT_ROUTE", &default_route);
1306         if (r == -ENOENT)
1307                 return 0;
1308         if (r < 0)
1309                 goto fail;
1310
1311         link_flush_settings(l);
1312
1313         /* If we can't recognize the LLMNR or MDNS setting we don't override the default */
1314         s = resolve_support_from_string(llmnr);
1315         if (s >= 0)
1316                 l->llmnr_support = s;
1317
1318         s = resolve_support_from_string(mdns);
1319         if (s >= 0)
1320                 l->mdns_support = s;
1321
1322         r = parse_boolean(default_route);
1323         if (r >= 0)
1324                 l->default_route = r;
1325
1326         /* If we can't recognize the DNSSEC setting, then set it to invalid, so that the daemon default is used. */
1327         l->dnssec_mode = dnssec_mode_from_string(dnssec);
1328
1329         for (p = servers;;) {
1330                 _cleanup_free_ char *word = NULL;
1331
1332                 r = extract_first_word(&p, &word, NULL, 0);
1333                 if (r < 0)
1334                         goto fail;
1335                 if (r == 0)
1336                         break;
1337
1338                 r = link_update_dns_server_one(l, word);
1339                 if (r < 0) {
1340                         log_debug_errno(r, "Failed to load DNS server '%s', ignoring: %m", word);
1341                         continue;
1342                 }
1343         }
1344
1345         for (p = domains;;) {
1346                 _cleanup_free_ char *word = NULL;
1347                 const char *n;
1348                 bool is_route;
1349
1350                 r = extract_first_word(&p, &word, NULL, 0);
1351                 if (r < 0)
1352                         goto fail;
1353                 if (r == 0)
1354                         break;
1355
1356                 is_route = word[0] == '~';
1357                 n = is_route ? word + 1 : word;
1358
1359                 r = link_update_search_domain_one(l, n, is_route);
1360                 if (r < 0) {
1361                         log_debug_errno(r, "Failed to load search domain '%s', ignoring: %m", word);
1362                         continue;
1363                 }
1364         }
1365
1366         if (ntas) {
1367                 _cleanup_set_free_free_ Set *ns = NULL;
1368
1369                 ns = set_new(&dns_name_hash_ops);
1370                 if (!ns) {
1371                         r = -ENOMEM;
1372                         goto fail;
1373                 }
1374
1375                 r = set_put_strsplit(ns, ntas, NULL, 0);
1376                 if (r < 0)
1377                         goto fail;
1378
1379                 l->dnssec_negative_trust_anchors = TAKE_PTR(ns);
1380         }
1381
1382         return 0;
1383
1384 fail:
1385         return log_error_errno(r, "Failed to load link data %s: %m", l->state_file);
1386 }
1387
1388 void link_remove_user(Link *l) {
1389         assert(l);
1390         assert(l->state_file);
1391
1392         (void) unlink(l->state_file);
1393 }