src/resolve/resolved-link.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2
   3 #include <net/if.h>
   4 #include <linux/if.h>
   5 #include <stdio_ext.h>
   6 #include <unistd.h>
   7
   8 #include "sd-network.h"
   9
  10 #include "alloc-util.h"
  11 #include "env-file.h"
  12 #include "fd-util.h"
  13 #include "fileio.h"
  14 #include "mkdir.h"
  15 #include "parse-util.h"
  16 #include "resolved-link.h"
  17 #include "resolved-llmnr.h"
  18 #include "resolved-mdns.h"
  19 #include "string-util.h"
  20 #include "strv.h"
  21 #include "tmpfile-util.h"
  22
  23 int link_new(Manager *m, Link **ret, int ifindex) {
  24         _cleanup_(link_freep) Link *l = NULL;
  25         int r;
  26
  27         assert(m);
  28         assert(ifindex > 0);
  29
  30         r = hashmap_ensure_allocated(&m->links, NULL);
  31         if (r < 0)
  32                 return r;
  33
  34         l = new(Link, 1);
  35         if (!l)
  36                 return -ENOMEM;
  37
  38         *l = (Link) {
  39                 .ifindex = ifindex,
  40                 .default_route = -1,
  41                 .llmnr_support = RESOLVE_SUPPORT_YES,
  42                 .mdns_support = RESOLVE_SUPPORT_NO,
  43                 .dnssec_mode = _DNSSEC_MODE_INVALID,
  44                 .dns_over_tls_mode = _DNS_OVER_TLS_MODE_INVALID,
  45                 .operstate = IF_OPER_UNKNOWN,
  46         };
  47
  48         if (asprintf(&l->state_file, "/run/systemd/resolve/netif/%i", ifindex) < 0)
  49                 return -ENOMEM;
  50
  51         r = hashmap_put(m->links, INT_TO_PTR(ifindex), l);
  52         if (r < 0)
  53                 return r;
  54
  55         l->manager = m;
  56
  57         if (ret)
  58                 *ret = l;
  59         l = NULL;
  60
  61         return 0;
  62 }
  63
  64 void link_flush_settings(Link *l) {
  65         assert(l);
  66
  67         l->default_route = -1;
  68         l->llmnr_support = RESOLVE_SUPPORT_YES;
  69         l->mdns_support = RESOLVE_SUPPORT_NO;
  70         l->dnssec_mode = _DNSSEC_MODE_INVALID;
  71         l->dns_over_tls_mode = _DNS_OVER_TLS_MODE_INVALID;
  72
  73         dns_server_unlink_all(l->dns_servers);
  74         dns_search_domain_unlink_all(l->search_domains);
  75
  76         l->dnssec_negative_trust_anchors = set_free_free(l->dnssec_negative_trust_anchors);
  77 }
  78
  79 Link *link_free(Link *l) {
  80         if (!l)
  81                 return NULL;
  82
  83         /* Send goodbye messages. */
  84         dns_scope_announce(l->mdns_ipv4_scope, true);
  85         dns_scope_announce(l->mdns_ipv6_scope, true);
  86
  87         link_flush_settings(l);
  88
  89         while (l->addresses)
  90                 (void) link_address_free(l->addresses);
  91
  92         if (l->manager)
  93                 hashmap_remove(l->manager->links, INT_TO_PTR(l->ifindex));
  94
  95         dns_scope_free(l->unicast_scope);
  96         dns_scope_free(l->llmnr_ipv4_scope);
  97         dns_scope_free(l->llmnr_ipv6_scope);
  98         dns_scope_free(l->mdns_ipv4_scope);
  99         dns_scope_free(l->mdns_ipv6_scope);
 100
 101         free(l->state_file);
 102
 103         return mfree(l);
 104 }
 105
 106 void link_allocate_scopes(Link *l) {
 107         bool unicast_relevant;
 108         int r;
 109
 110         assert(l);
 111
 112         /* If a link that used to be relevant is no longer, or a link that did not use to be relevant now becomes
 113          * relevant, let's reinit the learnt global DNS server information, since we might talk to different servers
 114          * now, even if they have the same addresses as before. */
 115
 116         unicast_relevant = link_relevant(l, AF_UNSPEC, false);
 117         if (unicast_relevant != l->unicast_relevant) {
 118                 l->unicast_relevant = unicast_relevant;
 119
 120                 dns_server_reset_features_all(l->manager->fallback_dns_servers);
 121                 dns_server_reset_features_all(l->manager->dns_servers);
 122
 123                 /* Also, flush the global unicast scope, to deal with split horizon setups, where talking through one
 124                  * interface reveals different DNS zones than through others. */
 125                 if (l->manager->unicast_scope)
 126                         dns_cache_flush(&l->manager->unicast_scope->cache);
 127         }
 128
 129         /* And now, allocate all scopes that makes sense now if we didn't have them yet, and drop those which we don't
 130          * need anymore */
 131
 132         if (unicast_relevant && l->dns_servers) {
 133                 if (!l->unicast_scope) {
 134                         dns_server_reset_features_all(l->dns_servers);
 135
 136                         r = dns_scope_new(l->manager, &l->unicast_scope, l, DNS_PROTOCOL_DNS, AF_UNSPEC);
 137                         if (r < 0)
 138                                 log_warning_errno(r, "Failed to allocate DNS scope: %m");
 139                 }
 140         } else
 141                 l->unicast_scope = dns_scope_free(l->unicast_scope);
 142
 143         if (link_relevant(l, AF_INET, true) &&
 144             l->llmnr_support != RESOLVE_SUPPORT_NO &&
 145             l->manager->llmnr_support != RESOLVE_SUPPORT_NO) {
 146                 if (!l->llmnr_ipv4_scope) {
 147                         r = dns_scope_new(l->manager, &l->llmnr_ipv4_scope, l, DNS_PROTOCOL_LLMNR, AF_INET);
 148                         if (r < 0)
 149                                 log_warning_errno(r, "Failed to allocate LLMNR IPv4 scope: %m");
 150                 }
 151         } else
 152                 l->llmnr_ipv4_scope = dns_scope_free(l->llmnr_ipv4_scope);
 153
 154         if (link_relevant(l, AF_INET6, true) &&
 155             l->llmnr_support != RESOLVE_SUPPORT_NO &&
 156             l->manager->llmnr_support != RESOLVE_SUPPORT_NO &&
 157             socket_ipv6_is_supported()) {
 158                 if (!l->llmnr_ipv6_scope) {
 159                         r = dns_scope_new(l->manager, &l->llmnr_ipv6_scope, l, DNS_PROTOCOL_LLMNR, AF_INET6);
 160                         if (r < 0)
 161                                 log_warning_errno(r, "Failed to allocate LLMNR IPv6 scope: %m");
 162                 }
 163         } else
 164                 l->llmnr_ipv6_scope = dns_scope_free(l->llmnr_ipv6_scope);
 165
 166         if (link_relevant(l, AF_INET, true) &&
 167             l->mdns_support != RESOLVE_SUPPORT_NO &&
 168             l->manager->mdns_support != RESOLVE_SUPPORT_NO) {
 169                 if (!l->mdns_ipv4_scope) {
 170                         r = dns_scope_new(l->manager, &l->mdns_ipv4_scope, l, DNS_PROTOCOL_MDNS, AF_INET);
 171                         if (r < 0)
 172                                 log_warning_errno(r, "Failed to allocate mDNS IPv4 scope: %m");
 173                 }
 174         } else
 175                 l->mdns_ipv4_scope = dns_scope_free(l->mdns_ipv4_scope);
 176
 177         if (link_relevant(l, AF_INET6, true) &&
 178             l->mdns_support != RESOLVE_SUPPORT_NO &&
 179             l->manager->mdns_support != RESOLVE_SUPPORT_NO) {
 180                 if (!l->mdns_ipv6_scope) {
 181                         r = dns_scope_new(l->manager, &l->mdns_ipv6_scope, l, DNS_PROTOCOL_MDNS, AF_INET6);
 182                         if (r < 0)
 183                                 log_warning_errno(r, "Failed to allocate mDNS IPv6 scope: %m");
 184                 }
 185         } else
 186                 l->mdns_ipv6_scope = dns_scope_free(l->mdns_ipv6_scope);
 187 }
 188
 189 void link_add_rrs(Link *l, bool force_remove) {
 190         LinkAddress *a;
 191         int r;
 192
 193         LIST_FOREACH(addresses, a, l->addresses)
 194                 link_address_add_rrs(a, force_remove);
 195
 196         if (!force_remove &&
 197             l->mdns_support == RESOLVE_SUPPORT_YES &&
 198             l->manager->mdns_support == RESOLVE_SUPPORT_YES) {
 199
 200                 if (l->mdns_ipv4_scope) {
 201                         r = dns_scope_add_dnssd_services(l->mdns_ipv4_scope);
 202                         if (r < 0)
 203                                 log_warning_errno(r, "Failed to add IPv4 DNS-SD services: %m");
 204                 }
 205
 206                 if (l->mdns_ipv6_scope) {
 207                         r = dns_scope_add_dnssd_services(l->mdns_ipv6_scope);
 208                         if (r < 0)
 209                                 log_warning_errno(r, "Failed to add IPv6 DNS-SD services: %m");
 210                 }
 211
 212         } else {
 213
 214                 if (l->mdns_ipv4_scope) {
 215                         r = dns_scope_remove_dnssd_services(l->mdns_ipv4_scope);
 216                         if (r < 0)
 217                                 log_warning_errno(r, "Failed to remove IPv4 DNS-SD services: %m");
 218                 }
 219
 220                 if (l->mdns_ipv6_scope) {
 221                         r = dns_scope_remove_dnssd_services(l->mdns_ipv6_scope);
 222                         if (r < 0)
 223                                 log_warning_errno(r, "Failed to remove IPv6 DNS-SD services: %m");
 224                 }
 225         }
 226 }
 227
 228 int link_process_rtnl(Link *l, sd_netlink_message *m) {
 229         const char *n = NULL;
 230         int r;
 231
 232         assert(l);
 233         assert(m);
 234
 235         r = sd_rtnl_message_link_get_flags(m, &l->flags);
 236         if (r < 0)
 237                 return r;
 238
 239         (void) sd_netlink_message_read_u32(m, IFLA_MTU, &l->mtu);
 240         (void) sd_netlink_message_read_u8(m, IFLA_OPERSTATE, &l->operstate);
 241
 242         if (sd_netlink_message_read_string(m, IFLA_IFNAME, &n) >= 0) {
 243                 strncpy(l->name, n, sizeof(l->name)-1);
 244                 char_array_0(l->name);
 245         }
 246
 247         link_allocate_scopes(l);
 248         link_add_rrs(l, false);
 249
 250         return 0;
 251 }
 252
 253 static int link_update_dns_server_one(Link *l, const char *name) {
 254         union in_addr_union a;
 255         DnsServer *s;
 256         int family, r;
 257
 258         assert(l);
 259         assert(name);
 260
 261         r = in_addr_from_string_auto(name, &family, &a);
 262         if (r < 0)
 263                 return r;
 264
 265         s = dns_server_find(l->dns_servers, family, &a, 0);
 266         if (s) {
 267                 dns_server_move_back_and_unmark(s);
 268                 return 0;
 269         }
 270
 271         return dns_server_new(l->manager, NULL, DNS_SERVER_LINK, l, family, &a, 0);
 272 }
 273
 274 static int link_update_dns_servers(Link *l) {
 275         _cleanup_strv_free_ char **nameservers = NULL;
 276         char **nameserver;
 277         int r;
 278
 279         assert(l);
 280
 281         r = sd_network_link_get_dns(l->ifindex, &nameservers);
 282         if (r == -ENODATA) {
 283                 r = 0;
 284                 goto clear;
 285         }
 286         if (r < 0)
 287                 goto clear;
 288
 289         dns_server_mark_all(l->dns_servers);
 290
 291         STRV_FOREACH(nameserver, nameservers) {
 292                 r = link_update_dns_server_one(l, *nameserver);
 293                 if (r < 0)
 294                         goto clear;
 295         }
 296
 297         dns_server_unlink_marked(l->dns_servers);
 298         return 0;
 299
 300 clear:
 301         dns_server_unlink_all(l->dns_servers);
 302         return r;
 303 }
 304
 305 static int link_update_default_route(Link *l) {
 306         int r;
 307
 308         assert(l);
 309
 310         r = sd_network_link_get_dns_default_route(l->ifindex);
 311         if (r == -ENODATA) {
 312                 r = 0;
 313                 goto clear;
 314         }
 315         if (r < 0)
 316                 goto clear;
 317
 318         l->default_route = r > 0;
 319         return 0;
 320
 321 clear:
 322         l->default_route = -1;
 323         return r;
 324 }
 325
 326 static int link_update_llmnr_support(Link *l) {
 327         _cleanup_free_ char *b = NULL;
 328         int r;
 329
 330         assert(l);
 331
 332         r = sd_network_link_get_llmnr(l->ifindex, &b);
 333         if (r == -ENODATA) {
 334                 r = 0;
 335                 goto clear;
 336         }
 337         if (r < 0)
 338                 goto clear;
 339
 340         l->llmnr_support = resolve_support_from_string(b);
 341         if (l->llmnr_support < 0) {
 342                 r = -EINVAL;
 343                 goto clear;
 344         }
 345
 346         return 0;
 347
 348 clear:
 349         l->llmnr_support = RESOLVE_SUPPORT_YES;
 350         return r;
 351 }
 352
 353 static int link_update_mdns_support(Link *l) {
 354         _cleanup_free_ char *b = NULL;
 355         int r;
 356
 357         assert(l);
 358
 359         r = sd_network_link_get_mdns(l->ifindex, &b);
 360         if (r == -ENODATA) {
 361                 r = 0;
 362                 goto clear;
 363         }
 364         if (r < 0)
 365                 goto clear;
 366
 367         l->mdns_support = resolve_support_from_string(b);
 368         if (l->mdns_support < 0) {
 369                 r = -EINVAL;
 370                 goto clear;
 371         }
 372
 373         return 0;
 374
 375 clear:
 376         l->mdns_support = RESOLVE_SUPPORT_NO;
 377         return r;
 378 }
 379
 380 void link_set_dns_over_tls_mode(Link *l, DnsOverTlsMode mode) {
 381
 382         assert(l);
 383
 384 #if ! ENABLE_DNS_OVER_TLS
 385         if (mode != DNS_OVER_TLS_NO)
 386                 log_warning("DNS-over-TLS option for the link cannot be set to opportunistic when systemd-resolved is built without DNS-over-TLS support. Turning off DNS-over-TLS support.");
 387         return;
 388 #endif
 389
 390         l->dns_over_tls_mode = mode;
 391 }
 392
 393 static int link_update_dns_over_tls_mode(Link *l) {
 394         _cleanup_free_ char *b = NULL;
 395         int r;
 396
 397         assert(l);
 398
 399         r = sd_network_link_get_dns_over_tls(l->ifindex, &b);
 400         if (r == -ENODATA) {
 401                 r = 0;
 402                 goto clear;
 403         }
 404         if (r < 0)
 405                 goto clear;
 406
 407         l->dns_over_tls_mode = dns_over_tls_mode_from_string(b);
 408         if (l->dns_over_tls_mode < 0) {
 409                 r = -EINVAL;
 410                 goto clear;
 411         }
 412
 413         return 0;
 414
 415 clear:
 416         l->dns_over_tls_mode = _DNS_OVER_TLS_MODE_INVALID;
 417         return r;
 418 }
 419
 420 void link_set_dnssec_mode(Link *l, DnssecMode mode) {
 421
 422         assert(l);
 423
 424 #if ! HAVE_GCRYPT
 425         if (IN_SET(mode, DNSSEC_YES, DNSSEC_ALLOW_DOWNGRADE))
 426                 log_warning("DNSSEC option for the link cannot be enabled or set to allow-downgrade when systemd-resolved is built without gcrypt support. Turning off DNSSEC support.");
 427         return;
 428 #endif
 429
 430         if (l->dnssec_mode == mode)
 431                 return;
 432
 433         if ((l->dnssec_mode == _DNSSEC_MODE_INVALID) ||
 434             (l->dnssec_mode == DNSSEC_NO && mode != DNSSEC_NO) ||
 435             (l->dnssec_mode == DNSSEC_ALLOW_DOWNGRADE && mode == DNSSEC_YES)) {
 436
 437                 /* When switching from non-DNSSEC mode to DNSSEC mode, flush the cache. Also when switching from the
 438                  * allow-downgrade mode to full DNSSEC mode, flush it too. */
 439                 if (l->unicast_scope)
 440                         dns_cache_flush(&l->unicast_scope->cache);
 441         }
 442
 443         l->dnssec_mode = mode;
 444 }
 445
 446 static int link_update_dnssec_mode(Link *l) {
 447         _cleanup_free_ char *m = NULL;
 448         DnssecMode mode;
 449         int r;
 450
 451         assert(l);
 452
 453         r = sd_network_link_get_dnssec(l->ifindex, &m);
 454         if (r == -ENODATA) {
 455                 r = 0;
 456                 goto clear;
 457         }
 458         if (r < 0)
 459                 goto clear;
 460
 461         mode = dnssec_mode_from_string(m);
 462         if (mode < 0) {
 463                 r = -EINVAL;
 464                 goto clear;
 465         }
 466
 467         link_set_dnssec_mode(l, mode);
 468
 469         return 0;
 470
 471 clear:
 472         l->dnssec_mode = _DNSSEC_MODE_INVALID;
 473         return r;
 474 }
 475
 476 static int link_update_dnssec_negative_trust_anchors(Link *l) {
 477         _cleanup_strv_free_ char **ntas = NULL;
 478         _cleanup_set_free_free_ Set *ns = NULL;
 479         int r;
 480
 481         assert(l);
 482
 483         r = sd_network_link_get_dnssec_negative_trust_anchors(l->ifindex, &ntas);
 484         if (r == -ENODATA) {
 485                 r = 0;
 486                 goto clear;
 487         }
 488         if (r < 0)
 489                 goto clear;
 490
 491         ns = set_new(&dns_name_hash_ops);
 492         if (!ns)
 493                 return -ENOMEM;
 494
 495         r = set_put_strdupv(ns, ntas);
 496         if (r < 0)
 497                 return r;
 498
 499         set_free_free(l->dnssec_negative_trust_anchors);
 500         l->dnssec_negative_trust_anchors = TAKE_PTR(ns);
 501
 502         return 0;
 503
 504 clear:
 505         l->dnssec_negative_trust_anchors = set_free_free(l->dnssec_negative_trust_anchors);
 506         return r;
 507 }
 508
 509 static int link_update_search_domain_one(Link *l, const char *name, bool route_only) {
 510         DnsSearchDomain *d;
 511         int r;
 512
 513         assert(l);
 514         assert(name);
 515
 516         r = dns_search_domain_find(l->search_domains, name, &d);
 517         if (r < 0)
 518                 return r;
 519         if (r > 0)
 520                 dns_search_domain_move_back_and_unmark(d);
 521         else {
 522                 r = dns_search_domain_new(l->manager, &d, DNS_SEARCH_DOMAIN_LINK, l, name);
 523                 if (r < 0)
 524                         return r;
 525         }
 526
 527         d->route_only = route_only;
 528         return 0;
 529 }
 530
 531 static int link_update_search_domains(Link *l) {
 532         _cleanup_strv_free_ char **sdomains = NULL, **rdomains = NULL;
 533         char **i;
 534         int r, q;
 535
 536         assert(l);
 537
 538         r = sd_network_link_get_search_domains(l->ifindex, &sdomains);
 539         if (r < 0 && r != -ENODATA)
 540                 goto clear;
 541
 542         q = sd_network_link_get_route_domains(l->ifindex, &rdomains);
 543         if (q < 0 && q != -ENODATA) {
 544                 r = q;
 545                 goto clear;
 546         }
 547
 548         if (r == -ENODATA && q == -ENODATA) {
 549                 /* networkd knows nothing about this interface, and that's fine. */
 550                 r = 0;
 551                 goto clear;
 552         }
 553
 554         dns_search_domain_mark_all(l->search_domains);
 555
 556         STRV_FOREACH(i, sdomains) {
 557                 r = link_update_search_domain_one(l, *i, false);
 558                 if (r < 0)
 559                         goto clear;
 560         }
 561
 562         STRV_FOREACH(i, rdomains) {
 563                 r = link_update_search_domain_one(l, *i, true);
 564                 if (r < 0)
 565                         goto clear;
 566         }
 567
 568         dns_search_domain_unlink_marked(l->search_domains);
 569         return 0;
 570
 571 clear:
 572         dns_search_domain_unlink_all(l->search_domains);
 573         return r;
 574 }
 575
 576 static int link_is_managed(Link *l) {
 577         _cleanup_free_ char *state = NULL;
 578         int r;
 579
 580         assert(l);
 581
 582         r = sd_network_link_get_setup_state(l->ifindex, &state);
 583         if (r == -ENODATA)
 584                 return 0;
 585         if (r < 0)
 586                 return r;
 587
 588         return !STR_IN_SET(state, "pending", "unmanaged");
 589 }
 590
 591 static void link_read_settings(Link *l) {
 592         int r;
 593
 594         assert(l);
 595
 596         /* Read settings from networkd, except when networkd is not managing this interface. */
 597
 598         r = link_is_managed(l);
 599         if (r < 0) {
 600                 log_warning_errno(r, "Failed to determine whether interface %s is managed: %m", l->name);
 601                 return;
 602         }
 603         if (r == 0) {
 604
 605                 /* If this link used to be managed, but is now unmanaged, flush all our settings — but only once. */
 606                 if (l->is_managed)
 607                         link_flush_settings(l);
 608
 609                 l->is_managed = false;
 610                 return;
 611         }
 612
 613         l->is_managed = true;
 614
 615         r = link_update_dns_servers(l);
 616         if (r < 0)
 617                 log_warning_errno(r, "Failed to read DNS servers for interface %s, ignoring: %m", l->name);
 618
 619         r = link_update_llmnr_support(l);
 620         if (r < 0)
 621                 log_warning_errno(r, "Failed to read LLMNR support for interface %s, ignoring: %m", l->name);
 622
 623         r = link_update_mdns_support(l);
 624         if (r < 0)
 625                 log_warning_errno(r, "Failed to read mDNS support for interface %s, ignoring: %m", l->name);
 626
 627         r = link_update_dns_over_tls_mode(l);
 628         if (r < 0)
 629                 log_warning_errno(r, "Failed to read DNS-over-TLS mode for interface %s, ignoring: %m", l->name);
 630
 631         r = link_update_dnssec_mode(l);
 632         if (r < 0)
 633                 log_warning_errno(r, "Failed to read DNSSEC mode for interface %s, ignoring: %m", l->name);
 634
 635         r = link_update_dnssec_negative_trust_anchors(l);
 636         if (r < 0)
 637                 log_warning_errno(r, "Failed to read DNSSEC negative trust anchors for interface %s, ignoring: %m", l->name);
 638
 639         r = link_update_search_domains(l);
 640         if (r < 0)
 641                 log_warning_errno(r, "Failed to read search domains for interface %s, ignoring: %m", l->name);
 642
 643         r = link_update_default_route(l);
 644         if (r < 0)
 645                 log_warning_errno(r, "Failed to read default route setting for interface %s, proceeding anyway: %m", l->name);
 646 }
 647
 648 int link_update(Link *l) {
 649         int r;
 650
 651         assert(l);
 652
 653         link_read_settings(l);
 654         link_load_user(l);
 655
 656         if (l->llmnr_support != RESOLVE_SUPPORT_NO) {
 657                 r = manager_llmnr_start(l->manager);
 658                 if (r < 0)
 659                         return r;
 660         }
 661
 662         if (l->mdns_support != RESOLVE_SUPPORT_NO) {
 663                 r = manager_mdns_start(l->manager);
 664                 if (r < 0)
 665                         return r;
 666         }
 667
 668         link_allocate_scopes(l);
 669         link_add_rrs(l, false);
 670
 671         return 0;
 672 }
 673
 674 bool link_relevant(Link *l, int family, bool local_multicast) {
 675         _cleanup_free_ char *state = NULL;
 676         LinkAddress *a;
 677
 678         assert(l);
 679
 680         /* A link is relevant for local multicast traffic if it isn't a loopback device, has a link
 681          * beat, can do multicast and has at least one link-local (or better) IP address.
 682          *
 683          * A link is relevant for non-multicast traffic if it isn't a loopback device, has a link beat, and has at
 684          * least one routable address. */
 685
 686         if (l->flags & (IFF_LOOPBACK|IFF_DORMANT))
 687                 return false;
 688
 689         if ((l->flags & (IFF_UP|IFF_LOWER_UP)) != (IFF_UP|IFF_LOWER_UP))
 690                 return false;
 691
 692         if (local_multicast) {
 693                 if ((l->flags & IFF_MULTICAST) != IFF_MULTICAST)
 694                         return false;
 695         }
 696
 697         /* Check kernel operstate
 698          * https://www.kernel.org/doc/Documentation/networking/operstates.txt */
 699         if (!IN_SET(l->operstate, IF_OPER_UNKNOWN, IF_OPER_UP))
 700                 return false;
 701
 702         (void) sd_network_link_get_operational_state(l->ifindex, &state);
 703         if (state && !STR_IN_SET(state, "unknown", "degraded", "routable"))
 704                 return false;
 705
 706         LIST_FOREACH(addresses, a, l->addresses)
 707                 if ((family == AF_UNSPEC || a->family == family) && link_address_relevant(a, local_multicast))
 708                         return true;
 709
 710         return false;
 711 }
 712
 713 LinkAddress *link_find_address(Link *l, int family, const union in_addr_union *in_addr) {
 714         LinkAddress *a;
 715
 716         assert(l);
 717
 718         LIST_FOREACH(addresses, a, l->addresses)
 719                 if (a->family == family && in_addr_equal(family, &a->in_addr, in_addr))
 720                         return a;
 721
 722         return NULL;
 723 }
 724
 725 DnsServer* link_set_dns_server(Link *l, DnsServer *s) {
 726         assert(l);
 727
 728         if (l->current_dns_server == s)
 729                 return s;
 730
 731         if (s)
 732                 log_debug("Switching to DNS server %s for interface %s.", dns_server_string(s), l->name);
 733
 734         dns_server_unref(l->current_dns_server);
 735         l->current_dns_server = dns_server_ref(s);
 736
 737         if (l->unicast_scope)
 738                 dns_cache_flush(&l->unicast_scope->cache);
 739
 740         return s;
 741 }
 742
 743 DnsServer *link_get_dns_server(Link *l) {
 744         assert(l);
 745
 746         if (!l->current_dns_server)
 747                 link_set_dns_server(l, l->dns_servers);
 748
 749         return l->current_dns_server;
 750 }
 751
 752 void link_next_dns_server(Link *l) {
 753         assert(l);
 754
 755         if (!l->current_dns_server)
 756                 return;
 757
 758         /* Change to the next one, but make sure to follow the linked
 759          * list only if this server is actually still linked. */
 760         if (l->current_dns_server->linked && l->current_dns_server->servers_next) {
 761                 link_set_dns_server(l, l->current_dns_server->servers_next);
 762                 return;
 763         }
 764
 765         link_set_dns_server(l, l->dns_servers);
 766 }
 767
 768 DnsOverTlsMode link_get_dns_over_tls_mode(Link *l) {
 769         assert(l);
 770
 771         if (l->dns_over_tls_mode != _DNS_OVER_TLS_MODE_INVALID)
 772                 return l->dns_over_tls_mode;
 773
 774         return manager_get_dns_over_tls_mode(l->manager);
 775 }
 776
 777 DnssecMode link_get_dnssec_mode(Link *l) {
 778         assert(l);
 779
 780         if (l->dnssec_mode != _DNSSEC_MODE_INVALID)
 781                 return l->dnssec_mode;
 782
 783         return manager_get_dnssec_mode(l->manager);
 784 }
 785
 786 bool link_dnssec_supported(Link *l) {
 787         DnsServer *server;
 788
 789         assert(l);
 790
 791         if (link_get_dnssec_mode(l) == DNSSEC_NO)
 792                 return false;
 793
 794         server = link_get_dns_server(l);
 795         if (server)
 796                 return dns_server_dnssec_supported(server);
 797
 798         return true;
 799 }
 800
 801 int link_address_new(Link *l, LinkAddress **ret, int family, const union in_addr_union *in_addr) {
 802         LinkAddress *a;
 803
 804         assert(l);
 805         assert(in_addr);
 806
 807         a = new0(LinkAddress, 1);
 808         if (!a)
 809                 return -ENOMEM;
 810
 811         a->family = family;
 812         a->in_addr = *in_addr;
 813
 814         a->link = l;
 815         LIST_PREPEND(addresses, l->addresses, a);
 816         l->n_addresses++;
 817
 818         if (ret)
 819                 *ret = a;
 820
 821         return 0;
 822 }
 823
 824 LinkAddress *link_address_free(LinkAddress *a) {
 825         if (!a)
 826                 return NULL;
 827
 828         if (a->link) {
 829                 LIST_REMOVE(addresses, a->link->addresses, a);
 830
 831                 assert(a->link->n_addresses > 0);
 832                 a->link->n_addresses--;
 833
 834                 if (a->llmnr_address_rr) {
 835                         if (a->family == AF_INET && a->link->llmnr_ipv4_scope)
 836                                 dns_zone_remove_rr(&a->link->llmnr_ipv4_scope->zone, a->llmnr_address_rr);
 837                         else if (a->family == AF_INET6 && a->link->llmnr_ipv6_scope)
 838                                 dns_zone_remove_rr(&a->link->llmnr_ipv6_scope->zone, a->llmnr_address_rr);
 839                 }
 840
 841                 if (a->llmnr_ptr_rr) {
 842                         if (a->family == AF_INET && a->link->llmnr_ipv4_scope)
 843                                 dns_zone_remove_rr(&a->link->llmnr_ipv4_scope->zone, a->llmnr_ptr_rr);
 844                         else if (a->family == AF_INET6 && a->link->llmnr_ipv6_scope)
 845                                 dns_zone_remove_rr(&a->link->llmnr_ipv6_scope->zone, a->llmnr_ptr_rr);
 846                 }
 847
 848                 if (a->mdns_address_rr) {
 849                         if (a->family == AF_INET && a->link->mdns_ipv4_scope)
 850                                 dns_zone_remove_rr(&a->link->mdns_ipv4_scope->zone, a->mdns_address_rr);
 851                         else if (a->family == AF_INET6 && a->link->mdns_ipv6_scope)
 852                                 dns_zone_remove_rr(&a->link->mdns_ipv6_scope->zone, a->mdns_address_rr);
 853                 }
 854
 855                 if (a->mdns_ptr_rr) {
 856                         if (a->family == AF_INET && a->link->mdns_ipv4_scope)
 857                                 dns_zone_remove_rr(&a->link->mdns_ipv4_scope->zone, a->mdns_ptr_rr);
 858                         else if (a->family == AF_INET6 && a->link->mdns_ipv6_scope)
 859                                 dns_zone_remove_rr(&a->link->mdns_ipv6_scope->zone, a->mdns_ptr_rr);
 860                 }
 861         }
 862
 863         dns_resource_record_unref(a->llmnr_address_rr);
 864         dns_resource_record_unref(a->llmnr_ptr_rr);
 865         dns_resource_record_unref(a->mdns_address_rr);
 866         dns_resource_record_unref(a->mdns_ptr_rr);
 867
 868         return mfree(a);
 869 }
 870
 871 void link_address_add_rrs(LinkAddress *a, bool force_remove) {
 872         int r;
 873
 874         assert(a);
 875
 876         if (a->family == AF_INET) {
 877
 878                 if (!force_remove &&
 879                     link_address_relevant(a, true) &&
 880                     a->link->llmnr_ipv4_scope &&
 881                     a->link->llmnr_support == RESOLVE_SUPPORT_YES &&
 882                     a->link->manager->llmnr_support == RESOLVE_SUPPORT_YES) {
 883
 884                         if (!a->link->manager->llmnr_host_ipv4_key) {
 885                                 a->link->manager->llmnr_host_ipv4_key = dns_resource_key_new(DNS_CLASS_IN, DNS_TYPE_A, a->link->manager->llmnr_hostname);
 886                                 if (!a->link->manager->llmnr_host_ipv4_key) {
 887                                         r = -ENOMEM;
 888                                         goto fail;
 889                                 }
 890                         }
 891
 892                         if (!a->llmnr_address_rr) {
 893                                 a->llmnr_address_rr = dns_resource_record_new(a->link->manager->llmnr_host_ipv4_key);
 894                                 if (!a->llmnr_address_rr) {
 895                                         r = -ENOMEM;
 896                                         goto fail;
 897                                 }
 898
 899                                 a->llmnr_address_rr->a.in_addr = a->in_addr.in;
 900                                 a->llmnr_address_rr->ttl = LLMNR_DEFAULT_TTL;
 901                         }
 902
 903                         if (!a->llmnr_ptr_rr) {
 904                                 r = dns_resource_record_new_reverse(&a->llmnr_ptr_rr, a->family, &a->in_addr, a->link->manager->llmnr_hostname);
 905                                 if (r < 0)
 906                                         goto fail;
 907
 908                                 a->llmnr_ptr_rr->ttl = LLMNR_DEFAULT_TTL;
 909                         }
 910
 911                         r = dns_zone_put(&a->link->llmnr_ipv4_scope->zone, a->link->llmnr_ipv4_scope, a->llmnr_address_rr, true);
 912                         if (r < 0)
 913                                 log_warning_errno(r, "Failed to add A record to LLMNR zone: %m");
 914
 915                         r = dns_zone_put(&a->link->llmnr_ipv4_scope->zone, a->link->llmnr_ipv4_scope, a->llmnr_ptr_rr, false);
 916                         if (r < 0)
 917                                 log_warning_errno(r, "Failed to add IPv4 PTR record to LLMNR zone: %m");
 918                 } else {
 919                         if (a->llmnr_address_rr) {
 920                                 if (a->link->llmnr_ipv4_scope)
 921                                         dns_zone_remove_rr(&a->link->llmnr_ipv4_scope->zone, a->llmnr_address_rr);
 922                                 a->llmnr_address_rr = dns_resource_record_unref(a->llmnr_address_rr);
 923                         }
 924
 925                         if (a->llmnr_ptr_rr) {
 926                                 if (a->link->llmnr_ipv4_scope)
 927                                         dns_zone_remove_rr(&a->link->llmnr_ipv4_scope->zone, a->llmnr_ptr_rr);
 928                                 a->llmnr_ptr_rr = dns_resource_record_unref(a->llmnr_ptr_rr);
 929                         }
 930                 }
 931
 932                 if (!force_remove &&
 933                     link_address_relevant(a, true) &&
 934                     a->link->mdns_ipv4_scope &&
 935                     a->link->mdns_support == RESOLVE_SUPPORT_YES &&
 936                     a->link->manager->mdns_support == RESOLVE_SUPPORT_YES) {
 937                         if (!a->link->manager->mdns_host_ipv4_key) {
 938                                 a->link->manager->mdns_host_ipv4_key = dns_resource_key_new(DNS_CLASS_IN, DNS_TYPE_A, a->link->manager->mdns_hostname);
 939                                 if (!a->link->manager->mdns_host_ipv4_key) {
 940                                         r = -ENOMEM;
 941                                         goto fail;
 942                                 }
 943                         }
 944
 945                         if (!a->mdns_address_rr) {
 946                                 a->mdns_address_rr = dns_resource_record_new(a->link->manager->mdns_host_ipv4_key);
 947                                 if (!a->mdns_address_rr) {
 948                                         r = -ENOMEM;
 949                                         goto fail;
 950                                 }
 951
 952                                 a->mdns_address_rr->a.in_addr = a->in_addr.in;
 953                                 a->mdns_address_rr->ttl = MDNS_DEFAULT_TTL;
 954                         }
 955
 956                         if (!a->mdns_ptr_rr) {
 957                                 r = dns_resource_record_new_reverse(&a->mdns_ptr_rr, a->family, &a->in_addr, a->link->manager->mdns_hostname);
 958                                 if (r < 0)
 959                                         goto fail;
 960
 961                                 a->mdns_ptr_rr->ttl = MDNS_DEFAULT_TTL;
 962                         }
 963
 964                         r = dns_zone_put(&a->link->mdns_ipv4_scope->zone, a->link->mdns_ipv4_scope, a->mdns_address_rr, true);
 965                         if (r < 0)
 966                                 log_warning_errno(r, "Failed to add A record to MDNS zone: %m");
 967
 968                         r = dns_zone_put(&a->link->mdns_ipv4_scope->zone, a->link->mdns_ipv4_scope, a->mdns_ptr_rr, false);
 969                         if (r < 0)
 970                                 log_warning_errno(r, "Failed to add IPv4 PTR record to MDNS zone: %m");
 971                 } else {
 972                         if (a->mdns_address_rr) {
 973                                 if (a->link->mdns_ipv4_scope)
 974                                         dns_zone_remove_rr(&a->link->mdns_ipv4_scope->zone, a->mdns_address_rr);
 975                                 a->mdns_address_rr = dns_resource_record_unref(a->mdns_address_rr);
 976                         }
 977
 978                         if (a->mdns_ptr_rr) {
 979                                 if (a->link->mdns_ipv4_scope)
 980                                         dns_zone_remove_rr(&a->link->mdns_ipv4_scope->zone, a->mdns_ptr_rr);
 981                                 a->mdns_ptr_rr = dns_resource_record_unref(a->mdns_ptr_rr);
 982                         }
 983                 }
 984         }
 985
 986         if (a->family == AF_INET6) {
 987
 988                 if (!force_remove &&
 989                     link_address_relevant(a, true) &&
 990                     a->link->llmnr_ipv6_scope &&
 991                     a->link->llmnr_support == RESOLVE_SUPPORT_YES &&
 992                     a->link->manager->llmnr_support == RESOLVE_SUPPORT_YES) {
 993
 994                         if (!a->link->manager->llmnr_host_ipv6_key) {
 995                                 a->link->manager->llmnr_host_ipv6_key = dns_resource_key_new(DNS_CLASS_IN, DNS_TYPE_AAAA, a->link->manager->llmnr_hostname);
 996                                 if (!a->link->manager->llmnr_host_ipv6_key) {
 997                                         r = -ENOMEM;
 998                                         goto fail;
 999                                 }
1000                         }
1001
1002                         if (!a->llmnr_address_rr) {
1003                                 a->llmnr_address_rr = dns_resource_record_new(a->link->manager->llmnr_host_ipv6_key);
1004                                 if (!a->llmnr_address_rr) {
1005                                         r = -ENOMEM;
1006                                         goto fail;
1007                                 }
1008
1009                                 a->llmnr_address_rr->aaaa.in6_addr = a->in_addr.in6;
1010                                 a->llmnr_address_rr->ttl = LLMNR_DEFAULT_TTL;
1011                         }
1012
1013                         if (!a->llmnr_ptr_rr) {
1014                                 r = dns_resource_record_new_reverse(&a->llmnr_ptr_rr, a->family, &a->in_addr, a->link->manager->llmnr_hostname);
1015                                 if (r < 0)
1016                                         goto fail;
1017
1018                                 a->llmnr_ptr_rr->ttl = LLMNR_DEFAULT_TTL;
1019                         }
1020
1021                         r = dns_zone_put(&a->link->llmnr_ipv6_scope->zone, a->link->llmnr_ipv6_scope, a->llmnr_address_rr, true);
1022                         if (r < 0)
1023                                 log_warning_errno(r, "Failed to add AAAA record to LLMNR zone: %m");
1024
1025                         r = dns_zone_put(&a->link->llmnr_ipv6_scope->zone, a->link->llmnr_ipv6_scope, a->llmnr_ptr_rr, false);
1026                         if (r < 0)
1027                                 log_warning_errno(r, "Failed to add IPv6 PTR record to LLMNR zone: %m");
1028                 } else {
1029                         if (a->llmnr_address_rr) {
1030                                 if (a->link->llmnr_ipv6_scope)
1031                                         dns_zone_remove_rr(&a->link->llmnr_ipv6_scope->zone, a->llmnr_address_rr);
1032                                 a->llmnr_address_rr = dns_resource_record_unref(a->llmnr_address_rr);
1033                         }
1034
1035                         if (a->llmnr_ptr_rr) {
1036                                 if (a->link->llmnr_ipv6_scope)
1037                                         dns_zone_remove_rr(&a->link->llmnr_ipv6_scope->zone, a->llmnr_ptr_rr);
1038                                 a->llmnr_ptr_rr = dns_resource_record_unref(a->llmnr_ptr_rr);
1039                         }
1040                 }
1041
1042                 if (!force_remove &&
1043                     link_address_relevant(a, true) &&
1044                     a->link->mdns_ipv6_scope &&
1045                     a->link->mdns_support == RESOLVE_SUPPORT_YES &&
1046                     a->link->manager->mdns_support == RESOLVE_SUPPORT_YES) {
1047
1048                         if (!a->link->manager->mdns_host_ipv6_key) {
1049                                 a->link->manager->mdns_host_ipv6_key = dns_resource_key_new(DNS_CLASS_IN, DNS_TYPE_AAAA, a->link->manager->mdns_hostname);
1050                                 if (!a->link->manager->mdns_host_ipv6_key) {
1051                                         r = -ENOMEM;
1052                                         goto fail;
1053                                 }
1054                         }
1055
1056                         if (!a->mdns_address_rr) {
1057                                 a->mdns_address_rr = dns_resource_record_new(a->link->manager->mdns_host_ipv6_key);
1058                                 if (!a->mdns_address_rr) {
1059                                         r = -ENOMEM;
1060                                         goto fail;
1061                                 }
1062
1063                                 a->mdns_address_rr->aaaa.in6_addr = a->in_addr.in6;
1064                                 a->mdns_address_rr->ttl = MDNS_DEFAULT_TTL;
1065                         }
1066
1067                         if (!a->mdns_ptr_rr) {
1068                                 r = dns_resource_record_new_reverse(&a->mdns_ptr_rr, a->family, &a->in_addr, a->link->manager->mdns_hostname);
1069                                 if (r < 0)
1070                                         goto fail;
1071
1072                                 a->mdns_ptr_rr->ttl = MDNS_DEFAULT_TTL;
1073                         }
1074
1075                         r = dns_zone_put(&a->link->mdns_ipv6_scope->zone, a->link->mdns_ipv6_scope, a->mdns_address_rr, true);
1076                         if (r < 0)
1077                                 log_warning_errno(r, "Failed to add AAAA record to MDNS zone: %m");
1078
1079                         r = dns_zone_put(&a->link->mdns_ipv6_scope->zone, a->link->mdns_ipv6_scope, a->mdns_ptr_rr, false);
1080                         if (r < 0)
1081                                 log_warning_errno(r, "Failed to add IPv6 PTR record to MDNS zone: %m");
1082                 } else {
1083                         if (a->mdns_address_rr) {
1084                                 if (a->link->mdns_ipv6_scope)
1085                                         dns_zone_remove_rr(&a->link->mdns_ipv6_scope->zone, a->mdns_address_rr);
1086                                 a->mdns_address_rr = dns_resource_record_unref(a->mdns_address_rr);
1087                         }
1088
1089                         if (a->mdns_ptr_rr) {
1090                                 if (a->link->mdns_ipv6_scope)
1091                                         dns_zone_remove_rr(&a->link->mdns_ipv6_scope->zone, a->mdns_ptr_rr);
1092                                 a->mdns_ptr_rr = dns_resource_record_unref(a->mdns_ptr_rr);
1093                         }
1094                 }
1095         }
1096
1097         return;
1098
1099 fail:
1100         log_debug_errno(r, "Failed to update address RRs: %m");
1101 }
1102
1103 int link_address_update_rtnl(LinkAddress *a, sd_netlink_message *m) {
1104         int r;
1105         assert(a);
1106         assert(m);
1107
1108         r = sd_rtnl_message_addr_get_flags(m, &a->flags);
1109         if (r < 0)
1110                 return r;
1111
1112         sd_rtnl_message_addr_get_scope(m, &a->scope);
1113
1114         link_allocate_scopes(a->link);
1115         link_add_rrs(a->link, false);
1116
1117         return 0;
1118 }
1119
1120 bool link_address_relevant(LinkAddress *a, bool local_multicast) {
1121         assert(a);
1122
1123         if (a->flags & (IFA_F_DEPRECATED|IFA_F_TENTATIVE))
1124                 return false;
1125
1126         if (a->scope >= (local_multicast ? RT_SCOPE_HOST : RT_SCOPE_LINK))
1127                 return false;
1128
1129         return true;
1130 }
1131
1132 static bool link_needs_save(Link *l) {
1133         assert(l);
1134
1135         /* Returns true if any of the settings where set different from the default */
1136
1137         if (l->is_managed)
1138                 return false;
1139
1140         if (l->llmnr_support != RESOLVE_SUPPORT_YES ||
1141             l->mdns_support != RESOLVE_SUPPORT_NO ||
1142             l->dnssec_mode != _DNSSEC_MODE_INVALID ||
1143             l->dns_over_tls_mode != _DNS_OVER_TLS_MODE_INVALID)
1144                 return true;
1145
1146         if (l->dns_servers ||
1147             l->search_domains)
1148                 return true;
1149
1150         if (!set_isempty(l->dnssec_negative_trust_anchors))
1151                 return true;
1152
1153         if (l->default_route >= 0)
1154                 return true;
1155
1156         return false;
1157 }
1158
1159 int link_save_user(Link *l) {
1160         _cleanup_free_ char *temp_path = NULL;
1161         _cleanup_fclose_ FILE *f = NULL;
1162         const char *v;
1163         int r;
1164
1165         assert(l);
1166         assert(l->state_file);
1167
1168         if (!link_needs_save(l)) {
1169                 (void) unlink(l->state_file);
1170                 return 0;
1171         }
1172
1173         r = mkdir_parents(l->state_file, 0700);
1174         if (r < 0)
1175                 goto fail;
1176
1177         r = fopen_temporary(l->state_file, &f, &temp_path);
1178         if (r < 0)
1179                 goto fail;
1180
1181         (void) __fsetlocking(f, FSETLOCKING_BYCALLER);
1182         (void) fchmod(fileno(f), 0644);
1183
1184         fputs("# This is private data. Do not parse.\n", f);
1185
1186         v = resolve_support_to_string(l->llmnr_support);
1187         if (v)
1188                 fprintf(f, "LLMNR=%s\n", v);
1189
1190         v = resolve_support_to_string(l->mdns_support);
1191         if (v)
1192                 fprintf(f, "MDNS=%s\n", v);
1193
1194         v = dnssec_mode_to_string(l->dnssec_mode);
1195         if (v)
1196                 fprintf(f, "DNSSEC=%s\n", v);
1197
1198         if (l->default_route >= 0)
1199                 fprintf(f, "DEFAULT_ROUTE=%s\n", yes_no(l->default_route));
1200
1201         if (l->dns_servers) {
1202                 DnsServer *server;
1203
1204                 fputs("SERVERS=", f);
1205                 LIST_FOREACH(servers, server, l->dns_servers) {
1206
1207                         if (server != l->dns_servers)
1208                                 fputc(' ', f);
1209
1210                         v = dns_server_string(server);
1211                         if (!v) {
1212                                 r = -ENOMEM;
1213                                 goto fail;
1214                         }
1215
1216                         fputs(v, f);
1217                 }
1218                 fputc('\n', f);
1219         }
1220
1221         if (l->search_domains) {
1222                 DnsSearchDomain *domain;
1223
1224                 fputs("DOMAINS=", f);
1225                 LIST_FOREACH(domains, domain, l->search_domains) {
1226
1227                         if (domain != l->search_domains)
1228                                 fputc(' ', f);
1229
1230                         if (domain->route_only)
1231                                 fputc('~', f);
1232
1233                         fputs(DNS_SEARCH_DOMAIN_NAME(domain), f);
1234                 }
1235                 fputc('\n', f);
1236         }
1237
1238         if (!set_isempty(l->dnssec_negative_trust_anchors)) {
1239                 bool space = false;
1240                 Iterator i;
1241                 char *nta;
1242
1243                 fputs("NTAS=", f);
1244                 SET_FOREACH(nta, l->dnssec_negative_trust_anchors, i) {
1245
1246                         if (space)
1247                                 fputc(' ', f);
1248
1249                         fputs(nta, f);
1250                         space = true;
1251                 }
1252                 fputc('\n', f);
1253         }
1254
1255         r = fflush_and_check(f);
1256         if (r < 0)
1257                 goto fail;
1258
1259         if (rename(temp_path, l->state_file) < 0) {
1260                 r = -errno;
1261                 goto fail;
1262         }
1263
1264         return 0;
1265
1266 fail:
1267         (void) unlink(l->state_file);
1268
1269         if (temp_path)
1270                 (void) unlink(temp_path);
1271
1272         return log_error_errno(r, "Failed to save link data %s: %m", l->state_file);
1273 }
1274
1275 int link_load_user(Link *l) {
1276         _cleanup_free_ char
1277                 *llmnr = NULL,
1278                 *mdns = NULL,
1279                 *dnssec = NULL,
1280                 *servers = NULL,
1281                 *domains = NULL,
1282                 *ntas = NULL,
1283                 *default_route = NULL;
1284
1285         ResolveSupport s;
1286         const char *p;
1287         int r;
1288
1289         assert(l);
1290         assert(l->state_file);
1291
1292         /* Try to load only a single time */
1293         if (l->loaded)
1294                 return 0;
1295         l->loaded = true;
1296
1297         if (l->is_managed)
1298                 return 0; /* if the device is managed, then networkd is our configuration source, not the bus API */
1299
1300         r = parse_env_file(NULL, l->state_file,
1301                            "LLMNR", &llmnr,
1302                            "MDNS", &mdns,
1303                            "DNSSEC", &dnssec,
1304                            "SERVERS", &servers,
1305                            "DOMAINS", &domains,
1306                            "NTAS", &ntas,
1307                            "DEFAULT_ROUTE", &default_route);
1308         if (r == -ENOENT)
1309                 return 0;
1310         if (r < 0)
1311                 goto fail;
1312
1313         link_flush_settings(l);
1314
1315         /* If we can't recognize the LLMNR or MDNS setting we don't override the default */
1316         s = resolve_support_from_string(llmnr);
1317         if (s >= 0)
1318                 l->llmnr_support = s;
1319
1320         s = resolve_support_from_string(mdns);
1321         if (s >= 0)
1322                 l->mdns_support = s;
1323
1324         r = parse_boolean(default_route);
1325         if (r >= 0)
1326                 l->default_route = r;
1327
1328         /* If we can't recognize the DNSSEC setting, then set it to invalid, so that the daemon default is used. */
1329         l->dnssec_mode = dnssec_mode_from_string(dnssec);
1330
1331         for (p = servers;;) {
1332                 _cleanup_free_ char *word = NULL;
1333
1334                 r = extract_first_word(&p, &word, NULL, 0);
1335                 if (r < 0)
1336                         goto fail;
1337                 if (r == 0)
1338                         break;
1339
1340                 r = link_update_dns_server_one(l, word);
1341                 if (r < 0) {
1342                         log_debug_errno(r, "Failed to load DNS server '%s', ignoring: %m", word);
1343                         continue;
1344                 }
1345         }
1346
1347         for (p = domains;;) {
1348                 _cleanup_free_ char *word = NULL;
1349                 const char *n;
1350                 bool is_route;
1351
1352                 r = extract_first_word(&p, &word, NULL, 0);
1353                 if (r < 0)
1354                         goto fail;
1355                 if (r == 0)
1356                         break;
1357
1358                 is_route = word[0] == '~';
1359                 n = is_route ? word + 1 : word;
1360
1361                 r = link_update_search_domain_one(l, n, is_route);
1362                 if (r < 0) {
1363                         log_debug_errno(r, "Failed to load search domain '%s', ignoring: %m", word);
1364                         continue;
1365                 }
1366         }
1367
1368         if (ntas) {
1369                 _cleanup_set_free_free_ Set *ns = NULL;
1370
1371                 ns = set_new(&dns_name_hash_ops);
1372                 if (!ns) {
1373                         r = -ENOMEM;
1374                         goto fail;
1375                 }
1376
1377                 r = set_put_strsplit(ns, ntas, NULL, 0);
1378                 if (r < 0)
1379                         goto fail;
1380
1381                 l->dnssec_negative_trust_anchors = TAKE_PTR(ns);
1382         }
1383
1384         return 0;
1385
1386 fail:
1387         return log_error_errno(r, "Failed to load link data %s: %m", l->state_file);
1388 }
1389
1390 void link_remove_user(Link *l) {
1391         assert(l);
1392         assert(l->state_file);
1393
1394         (void) unlink(l->state_file);
1395 }