#include <netinet/tcp.h>

#include "af-list.h"

#include "alloc-util.h"

#include "dns-domain.h"

#include "errno-util.h"

#include "fd-util.h"

#include "hostname-util.h"

#include "missing_network.h"

#include "random-util.h"

#include "resolved-dnssd.h"

#include "resolved-dns-scope.h"

#include "resolved-dns-zone.h"

#include "resolved-llmnr.h"

#include "resolved-mdns.h"

#include "socket-util.h"

#include "strv.h"

#define MULTICAST_RATELIMIT_INTERVAL_USEC (1*USEC_PER_SEC)

#define MULTICAST_RATELIMIT_BURST 1000

#define MULTICAST_RESEND_TIMEOUT_MIN_USEC (100 * USEC_PER_MSEC)

#define MULTICAST_RESEND_TIMEOUT_MAX_USEC (1 * USEC_PER_SEC)

int dns_scope_new(Manager *m, DnsScope **ret, Link *l, DnsProtocol protocol, int family) {

DnsScope *s;

assert(m);

assert(ret);

s = new(DnsScope, 1);

if (!s)

return -ENOMEM;

*s = (DnsScope) {

.manager = m,

.link = l,

.protocol = protocol,

.family = family,

.resend_timeout = MULTICAST_RESEND_TIMEOUT_MIN_USEC,

};

if (protocol == DNS_PROTOCOL_DNS) {

/* Copy DNSSEC mode from the link if it is set there,

if (l) {

s->dnssec_mode = link_get_dnssec_mode(l);

s->dns_over_tls_mode = link_get_dns_over_tls_mode(l);

} else {

s->dnssec_mode = manager_get_dnssec_mode(m);

s->dns_over_tls_mode = manager_get_dns_over_tls_mode(m);

}

} else {

s->dnssec_mode = DNSSEC_NO;

s->dns_over_tls_mode = DNS_OVER_TLS_NO;

}

LIST_PREPEND(scopes, m->dns_scopes, s);

dns_scope_llmnr_membership(s, true);

dns_scope_mdns_membership(s, true);

log_debug("New scope on link %s, protocol %s, family %s", l ? l->ifname : "*", dns_protocol_to_string(protocol), family == AF_UNSPEC ? "*" : af_to_name(family));

/* Enforce ratelimiting for the multicast protocols */

s->ratelimit = (RateLimit) { MULTICAST_RATELIMIT_INTERVAL_USEC, MULTICAST_RATELIMIT_BURST };

*ret = s;

return 0;

}

static void dns_scope_abort_transactions(DnsScope *s) {

assert(s);

while (s->transactions) {

DnsTransaction *t = s->transactions;

/* Abort the transaction, but make sure it is not

t->block_gc++;

if (DNS_TRANSACTION_IS_LIVE(t->state))

dns_transaction_complete(t, DNS_TRANSACTION_ABORTED);

t->block_gc--;

dns_transaction_free(t);

}

}

DnsScope* dns_scope_free(DnsScope *s) {

if (!s)

return NULL;

log_debug("Removing scope on link %s, protocol %s, family %s", s->link ? s->link->ifname : "*", dns_protocol_to_string(s->protocol), s->family == AF_UNSPEC ? "*" : af_to_name(s->family));

dns_scope_llmnr_membership(s, false);

dns_scope_mdns_membership(s, false);

dns_scope_abort_transactions(s);

while (s->query_candidates)

dns_query_candidate_unref(s->query_candidates);

hashmap_free(s->transactions_by_key);

ordered_hashmap_free_with_destructor(s->conflict_queue, dns_resource_record_unref);

sd_event_source_disable_unref(s->conflict_event_source);

sd_event_source_disable_unref(s->announce_event_source);

dns_cache_flush(&s->cache);

dns_zone_flush(&s->zone);

LIST_REMOVE(scopes, s->manager->dns_scopes, s);

return mfree(s);

}

DnsServer *dns_scope_get_dns_server(DnsScope *s) {

assert(s);

if (s->protocol != DNS_PROTOCOL_DNS)

return NULL;

if (s->link)

return link_get_dns_server(s->link);

else

return manager_get_dns_server(s->manager);

}

unsigned dns_scope_get_n_dns_servers(DnsScope *s) {

unsigned n = 0;

DnsServer *i;

assert(s);

if (s->protocol != DNS_PROTOCOL_DNS)

return 0;

if (s->link)

i = s->link->dns_servers;

else

i = s->manager->dns_servers;

for (; i; i = i->servers_next)

n++;

return n;

}

void dns_scope_next_dns_server(DnsScope *s, DnsServer *if_current) {

assert(s);

if (s->protocol != DNS_PROTOCOL_DNS)

return;

/* Changes to the next DNS server in the list. If 'if_current' is passed will do so only if the

if (s->link)

link_next_dns_server(s->link, if_current);

else

manager_next_dns_server(s->manager, if_current);

}

void dns_scope_packet_received(DnsScope *s, usec_t rtt) {

assert(s);

if (rtt <= s->max_rtt)

return;

s->max_rtt = rtt;

s->resend_timeout = MIN(MAX(MULTICAST_RESEND_TIMEOUT_MIN_USEC, s->max_rtt * 2), MULTICAST_RESEND_TIMEOUT_MAX_USEC);

}

void dns_scope_packet_lost(DnsScope *s, usec_t usec) {

assert(s);

if (s->resend_timeout <= usec)

s->resend_timeout = MIN(s->resend_timeout * 2, MULTICAST_RESEND_TIMEOUT_MAX_USEC);

}

static int dns_scope_emit_one(DnsScope *s, int fd, int family, DnsPacket *p) {

int r;

assert(s);

assert(p);

assert(p->protocol == s->protocol);

if (family == AF_UNSPEC) {

if (s->family == AF_UNSPEC)

return -EAFNOSUPPORT;

family = s->family;

}

switch (s->protocol) {

case DNS_PROTOCOL_DNS: {

size_t mtu, udp_size, min_mtu, socket_mtu = 0;

assert(fd >= 0);

if (DNS_PACKET_QDCOUNT(p) > 1) /* Classic DNS only allows one question per packet */

return -EOPNOTSUPP;

if (p->size > DNS_PACKET_UNICAST_SIZE_MAX)

return -EMSGSIZE;

/* Determine the local most accurate MTU */

if (s->link)

mtu = s->link->mtu;

else

mtu = manager_find_mtu(s->manager);

/* Acquire the socket's PMDU MTU */

r = socket_get_mtu(fd, family, &socket_mtu);

if (r < 0 && !ERRNO_IS_DISCONNECT(r)) /* Will return ENOTCONN if no information is available yet */

return log_debug_errno(r, "Failed to read socket MTU: %m");

/* Determine the appropriate UDP header size */

udp_size = udp_header_size(family);

min_mtu = udp_size + DNS_PACKET_HEADER_SIZE;

log_debug("Emitting UDP, link MTU is %zu, socket MTU is %zu, minimal MTU is %zu",

mtu, socket_mtu, min_mtu);

/* Clamp by the kernel's idea of the (path) MTU */

if (socket_mtu != 0 && socket_mtu < mtu)

mtu = socket_mtu;

/* Put a lower limit, in case all MTU data we acquired was rubbish */

if (mtu < min_mtu)

mtu = min_mtu;

/* Now check our packet size against the MTU we determined */

if (udp_size + p->size > mtu)

return -EMSGSIZE; /* This means: try TCP instead */

r = manager_write(s->manager, fd, p);

if (r < 0)

return r;

break;

}

case DNS_PROTOCOL_LLMNR: {

union in_addr_union addr;

assert(fd < 0);

if (DNS_PACKET_QDCOUNT(p) > 1)

return -EOPNOTSUPP;

if (!ratelimit_below(&s->ratelimit))

return -EBUSY;

if (family == AF_INET) {

addr.in = LLMNR_MULTICAST_IPV4_ADDRESS;

fd = manager_llmnr_ipv4_udp_fd(s->manager);

} else if (family == AF_INET6) {

addr.in6 = LLMNR_MULTICAST_IPV6_ADDRESS;

fd = manager_llmnr_ipv6_udp_fd(s->manager);

} else

return -EAFNOSUPPORT;

if (fd < 0)

return fd;

r = manager_send(s->manager, fd, s->link->ifindex, family, &addr, LLMNR_PORT, NULL, p);

if (r < 0)

return r;

break;

}

case DNS_PROTOCOL_MDNS: {

union in_addr_union addr;

assert(fd < 0);

if (!ratelimit_below(&s->ratelimit))

return -EBUSY;

if (family == AF_INET) {

if (in4_addr_is_null(&p->destination.in))

addr.in = MDNS_MULTICAST_IPV4_ADDRESS;

else

addr = p->destination;

fd = manager_mdns_ipv4_fd(s->manager);

} else if (family == AF_INET6) {

if (in6_addr_is_null(&p->destination.in6))

addr.in6 = MDNS_MULTICAST_IPV6_ADDRESS;

else

addr = p->destination;

fd = manager_mdns_ipv6_fd(s->manager);

} else

return -EAFNOSUPPORT;

if (fd < 0)

return fd;

r = manager_send(s->manager, fd, s->link->ifindex, family, &addr, p->destination_port ?: MDNS_PORT, NULL, p);

if (r < 0)

return r;

break;

}

default:

return -EAFNOSUPPORT;

}

return 1;

}

int dns_scope_emit_udp(DnsScope *s, int fd, int af, DnsPacket *p) {

int r;

assert(s);

assert(p);

assert(p->protocol == s->protocol);

assert((s->protocol == DNS_PROTOCOL_DNS) == (fd >= 0));

do {

/* If there are multiple linked packets, set the TC bit in all but the last of them */

if (p->more) {

assert(p->protocol == DNS_PROTOCOL_MDNS);

dns_packet_set_flags(p, true, true);

}

r = dns_scope_emit_one(s, fd, af, p);

if (r < 0)

return r;

p = p->more;

} while (p);

return 0;

}

static int dns_scope_socket(

union sockaddr_union *ret_socket_address) {

_cleanup_close_ int fd = -1;

union sockaddr_union sa;

socklen_t salen;

int r, ifindex;

assert(s);

if (server) {

assert(family == AF_UNSPEC);

assert(!address);

ifindex = dns_server_ifindex(server);

switch (server->family) {

case AF_INET:

sa = (union sockaddr_union) {

.in.sin_family = server->family,

.in.sin_port = htobe16(port),

.in.sin_addr = server->address.in,

};

salen = sizeof(sa.in);

break;

case AF_INET6:

sa = (union sockaddr_union) {

.in6.sin6_family = server->family,

.in6.sin6_port = htobe16(port),

.in6.sin6_addr = server->address.in6,

.in6.sin6_scope_id = ifindex,

};

salen = sizeof(sa.in6);

break;

default:

return -EAFNOSUPPORT;

}

} else {

assert(family != AF_UNSPEC);

assert(address);

ifindex = s->link ? s->link->ifindex : 0;

switch (family) {

case AF_INET:

sa = (union sockaddr_union) {

.in.sin_family = family,

.in.sin_port = htobe16(port),

.in.sin_addr = address->in,

};

salen = sizeof(sa.in);

break;

case AF_INET6:

sa = (union sockaddr_union) {

.in6.sin6_family = family,

.in6.sin6_port = htobe16(port),

.in6.sin6_addr = address->in6,

.in6.sin6_scope_id = ifindex,

};

salen = sizeof(sa.in6);

break;

default:

return -EAFNOSUPPORT;

}

}

fd = socket(sa.sa.sa_family, type|SOCK_CLOEXEC|SOCK_NONBLOCK, 0);

if (fd < 0)

return -errno;

if (type == SOCK_STREAM) {

r = setsockopt_int(fd, IPPROTO_TCP, TCP_NODELAY, true);

if (r < 0)

return r;

}

if (s->link) {

r = socket_set_unicast_if(fd, sa.sa.sa_family, ifindex);

if (r < 0)

return r;

}

if (s->protocol == DNS_PROTOCOL_LLMNR) {

/* RFC 4795, section 2.5 requires the TTL to be set to 1 */

r = socket_set_ttl(fd, sa.sa.sa_family, 1);

if (r < 0)

return r;

}

if (type == SOCK_DGRAM) {

/* Set IP_RECVERR or IPV6_RECVERR to get ICMP error feedback. See discussion in #10345. */

r = socket_set_recverr(fd, sa.sa.sa_family, true);

if (r < 0)

return r;

r = socket_set_recvpktinfo(fd, sa.sa.sa_family, true);

if (r < 0)

return r;

/* Turn of path MTU discovery for security reasons */

r = socket_disable_pmtud(fd, sa.sa.sa_family);

if (r < 0)

log_debug_errno(r, "Failed to disable UDP PMTUD, ignoring: %m");

/* Learn about fragmentation taking place */

r = socket_set_recvfragsize(fd, sa.sa.sa_family, true);

if (r < 0)

log_debug_errno(r, "Failed to enable fragment size reception, ignoring: %m");

}

if (ret_socket_address)

*ret_socket_address = sa;

else {

bool bound = false;

/* Let's temporarily bind the socket to the specified ifindex. The kernel currently takes

if (s->link &&

!manager_find_link_address(s->manager, sa.sa.sa_family, sockaddr_in_addr(&sa.sa))) {

r = socket_bind_to_ifindex(fd, ifindex);

if (r < 0)

return r;

bound = true;

}

r = connect(fd, &sa.sa, salen);

if (r < 0 && errno != EINPROGRESS)

return -errno;

if (bound) {

r = socket_bind_to_ifindex(fd, 0);

if (r < 0)

return r;

}

}

return TAKE_FD(fd);

}

int dns_scope_socket_udp(DnsScope *s, DnsServer *server) {

return dns_scope_socket(s, SOCK_DGRAM, AF_UNSPEC, NULL, server, dns_server_port(server), NULL);

}

int dns_scope_socket_tcp(DnsScope *s, int family, const union in_addr_union *address, DnsServer *server, uint16_t port, union sockaddr_union *ret_socket_address) {

/* If ret_socket_address is not NULL, the caller is responsible

return dns_scope_socket(s, SOCK_STREAM, family, address, server, port, ret_socket_address);

}

static DnsScopeMatch match_link_local_reverse_lookups(const char *domain) {

assert(domain);

if (dns_name_endswith(domain, "254.169.in-addr.arpa") > 0)

return DNS_SCOPE_YES_BASE + 4; /* 4 labels match */

if (dns_name_endswith(domain, "8.e.f.ip6.arpa") > 0 ||

dns_name_endswith(domain, "9.e.f.ip6.arpa") > 0 ||

dns_name_endswith(domain, "a.e.f.ip6.arpa") > 0 ||

dns_name_endswith(domain, "b.e.f.ip6.arpa") > 0)

return DNS_SCOPE_YES_BASE + 5; /* 5 labels match */

return _DNS_SCOPE_MATCH_INVALID;

}

static DnsScopeMatch match_subnet_reverse_lookups(

DnsScope *s,

const char *domain,

bool exclude_own) {

union in_addr_union ia;

int f, r;

assert(s);

assert(domain);

/* Checks whether the specified domain is a reverse address domain (i.e. in the .in-addr.arpa or

if (!s->link)

return _DNS_SCOPE_MATCH_INVALID; /* No link, hence no local addresses to check */

r = dns_name_address(domain, &f, &ia);

if (r < 0)

log_debug_errno(r, "Failed to determine whether '%s' is an address domain: %m", domain);

if (r <= 0)

return _DNS_SCOPE_MATCH_INVALID;

if (s->family != AF_UNSPEC && f != s->family)

return _DNS_SCOPE_MATCH_INVALID; /* Don't look for IPv4 addresses on LLMNR/mDNS over IPv6 and vice versa */

LIST_FOREACH(addresses, a, s->link->addresses) {

if (a->family != f)

continue;

/* Equals our own address? nah, let's not use this scope. The local synthesizer will pick it up for us. */

if (exclude_own &&

in_addr_equal(f, &a->in_addr, &ia) > 0)

return DNS_SCOPE_NO;

if (a->prefixlen == UCHAR_MAX) /* don't know subnet mask */

continue;

/* Check if the address is in the local subnet */

r = in_addr_prefix_covers(f, &a->in_addr, a->prefixlen, &ia);

if (r < 0)

log_debug_errno(r, "Failed to determine whether link address covers lookup address '%s': %m", domain);

if (r > 0)

/* Note that we only claim zero labels match. This is so that this is at the same

return DNS_SCOPE_YES_BASE + 0;

}

return _DNS_SCOPE_MATCH_INVALID;

}

DnsScopeMatch dns_scope_good_domain(

DnsScope *s,

DnsQuery *q) {

DnsQuestion *question;

const char *domain;

uint64_t flags;

int ifindex;

/* This returns the following return values:

assert(s);

assert(q);

question = dns_query_question_for_protocol(q, s->protocol);

if (!question)

return DNS_SCOPE_NO;

domain = dns_question_first_name(question);

if (!domain)

return DNS_SCOPE_NO;

ifindex = q->ifindex;

flags = q->flags;

/* Checks if the specified domain is something to look up on this scope. Note that this accepts

if (ifindex != 0 && (!s->link || s->link->ifindex != ifindex))

return DNS_SCOPE_NO;

if ((SD_RESOLVED_FLAGS_MAKE(s->protocol, s->family, false, false) & flags) == 0)

return DNS_SCOPE_NO;

/* Never resolve any loopback hostname or IP address via DNS, LLMNR or mDNS. Instead, always rely on

if (is_localhost(domain) ||

dns_name_endswith(domain, "127.in-addr.arpa") > 0 ||

dns_name_equal(domain, "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa") > 0)

return DNS_SCOPE_NO;

/* Never respond to some of the domains listed in RFC6303 + RFC6761 */

if (dns_name_dont_resolve(domain))

return DNS_SCOPE_NO;

/* Never go to network for the _gateway or _outbound domain — they're something special, synthesized locally. */

if (is_gateway_hostname(domain) || is_outbound_hostname(domain))

return DNS_SCOPE_NO;

switch (s->protocol) {

case DNS_PROTOCOL_DNS: {

bool has_search_domains = false;

DnsScopeMatch m;

int n_best = -1;

if (dns_name_is_empty(domain)) {

DnsResourceKey *t;

bool found = false;

/* Refuse empty name if only A and/or AAAA records are requested. */

DNS_QUESTION_FOREACH(t, question)

if (!IN_SET(t->type, DNS_TYPE_A, DNS_TYPE_AAAA)) {

found = true;

break;

}

if (!found)

return DNS_SCOPE_NO;

}

/* Never route things to scopes that lack DNS servers */

if (!dns_scope_get_dns_server(s))

return DNS_SCOPE_NO;

/* Always honour search domains for routing queries, except if this scope lacks DNS servers. Note that

LIST_FOREACH(domains, d, dns_scope_get_search_domains(s)) {

if (!d->route_only && !dns_name_is_root(d->name))

has_search_domains = true;

if (dns_name_endswith(domain, d->name) > 0) {

int c;

c = dns_name_count_labels(d->name);

if (c < 0)

continue;

if (c > n_best)

n_best = c;

}

}

/* If there's a true search domain defined for this scope, and the query is single-label,

if (has_search_domains && dns_name_is_single_label(domain))

return DNS_SCOPE_YES_BASE + 1;

/* Let's return the number of labels in the best matching result */

if (n_best >= 0) {

assert(n_best <= DNS_SCOPE_YES_END - DNS_SCOPE_YES_BASE);

return DNS_SCOPE_YES_BASE + n_best;

}

/* Exclude link-local IP ranges */

if (match_link_local_reverse_lookups(domain) >= DNS_SCOPE_YES_BASE ||

/* If networks use .local in their private setups, they are supposed to also add .local

dns_name_endswith(domain, "local") > 0)

return DNS_SCOPE_NO;

/* If the IP address to look up matches the local subnet, then implicitly synthesizes

m = match_subnet_reverse_lookups(s, domain, false);

if (m >= 0)

return m;

/* If there was no match at all, then see if this scope is suitable as default route. */

if (!dns_scope_is_default_route(s))

return DNS_SCOPE_NO;

return DNS_SCOPE_MAYBE;

}

case DNS_PROTOCOL_MDNS: {

DnsScopeMatch m;

m = match_link_local_reverse_lookups(domain);

if (m >= 0)

return m;

m = match_subnet_reverse_lookups(s, domain, true);

if (m >= 0)

return m;

if ((s->family == AF_INET && dns_name_endswith(domain, "in-addr.arpa") > 0) ||

(s->family == AF_INET6 && dns_name_endswith(domain, "ip6.arpa") > 0))

return DNS_SCOPE_MAYBE;

if ((dns_name_endswith(domain, "local") > 0 && /* only resolve names ending in .local via mDNS */

dns_name_equal(domain, "local") == 0 && /* but not the single-label "local" name itself */

manager_is_own_hostname(s->manager, domain) <= 0)) /* never resolve the local hostname via mDNS */

return DNS_SCOPE_YES_BASE + 1; /* Return +1, as the top-level .local domain matches, i.e. one label */

return DNS_SCOPE_NO;

}

case DNS_PROTOCOL_LLMNR: {

DnsScopeMatch m;

m = match_link_local_reverse_lookups(domain);

if (m >= 0)

return m;

m = match_subnet_reverse_lookups(s, domain, true);

if (m >= 0)

return m;

if ((s->family == AF_INET && dns_name_endswith(domain, "in-addr.arpa") > 0) ||

(s->family == AF_INET6 && dns_name_endswith(domain, "ip6.arpa") > 0))

return DNS_SCOPE_MAYBE;

if ((dns_name_is_single_label(domain) && /* only resolve single label names via LLMNR */

!is_gateway_hostname(domain) && /* don't resolve "_gateway" with LLMNR, let local synthesizing logic handle that */

!is_outbound_hostname(domain) && /* similar for "_outbound" */

dns_name_equal(domain, "local") == 0 && /* don't resolve "local" with LLMNR, it's the top-level domain of mDNS after all, see above */

manager_is_own_hostname(s->manager, domain) <= 0)) /* never resolve the local hostname via LLMNR */

return DNS_SCOPE_YES_BASE + 1; /* Return +1, as we consider ourselves authoritative

return DNS_SCOPE_NO;

}

default:

assert_not_reached();

}

}

bool dns_scope_good_key(DnsScope *s, const DnsResourceKey *key) {

int key_family;

assert(s);

assert(key);

/* Check if it makes sense to resolve the specified key on this scope. Note that this call assumes a

if (!IN_SET(key->class, DNS_CLASS_IN, DNS_CLASS_ANY))

return false;

if (s->protocol == DNS_PROTOCOL_DNS) {

/* On classic DNS, looking up non-address RRs is always fine. (Specifically, we want to

if (!dns_resource_key_is_address(key))

return true;

/* Unless explicitly overridden, we refuse to look up A and AAAA RRs on the root and

const char* name = dns_resource_key_name(key);

if (!s->manager->resolve_unicast_single_label &&

dns_name_is_single_label(name))

return false;

return !dns_name_is_root(name);

}

/* Never route DNSSEC RR queries to LLMNR/mDNS scopes */

if (dns_type_is_dnssec(key->type))

return false;

/* On mDNS and LLMNR, send A and AAAA queries only on the respective scopes */

key_family = dns_type_to_af(key->type);

if (key_family < 0)

return true;

return key_family == s->family;

}

static int dns_scope_multicast_membership(DnsScope *s, bool b, struct in_addr in, struct in6_addr in6) {

int fd;

assert(s);

assert(s->link);

if (s->family == AF_INET) {

struct ip_mreqn mreqn = {

.imr_multiaddr = in,

.imr_ifindex = s->link->ifindex,

};

if (s->protocol == DNS_PROTOCOL_LLMNR)

fd = manager_llmnr_ipv4_udp_fd(s->manager);

else

fd = manager_mdns_ipv4_fd(s->manager);

if (fd < 0)

return fd;

/* Always first try to drop membership before we add

if (b)

(void) setsockopt(fd, IPPROTO_IP, IP_DROP_MEMBERSHIP, &mreqn, sizeof(mreqn));

if (setsockopt(fd, IPPROTO_IP, b ? IP_ADD_MEMBERSHIP : IP_DROP_MEMBERSHIP, &mreqn, sizeof(mreqn)) < 0)

return -errno;

} else if (s->family == AF_INET6) {

struct ipv6_mreq mreq = {

.ipv6mr_multiaddr = in6,

.ipv6mr_interface = s->link->ifindex,

};

if (s->protocol == DNS_PROTOCOL_LLMNR)

fd = manager_llmnr_ipv6_udp_fd(s->manager);

else

fd = manager_mdns_ipv6_fd(s->manager);

if (fd < 0)

return fd;

if (b)

(void) setsockopt(fd, IPPROTO_IPV6, IPV6_DROP_MEMBERSHIP, &mreq, sizeof(mreq));

if (setsockopt(fd, IPPROTO_IPV6, b ? IPV6_ADD_MEMBERSHIP : IPV6_DROP_MEMBERSHIP, &mreq, sizeof(mreq)) < 0)

return -errno;

} else

return -EAFNOSUPPORT;

return 0;

}

int dns_scope_llmnr_membership(DnsScope *s, bool b) {

assert(s);

if (s->protocol != DNS_PROTOCOL_LLMNR)

return 0;

return dns_scope_multicast_membership(s, b, LLMNR_MULTICAST_IPV4_ADDRESS, LLMNR_MULTICAST_IPV6_ADDRESS);

}

int dns_scope_mdns_membership(DnsScope *s, bool b) {

assert(s);

if (s->protocol != DNS_PROTOCOL_MDNS)

return 0;

return dns_scope_multicast_membership(s, b, MDNS_MULTICAST_IPV4_ADDRESS, MDNS_MULTICAST_IPV6_ADDRESS);

}

int dns_scope_make_reply_packet(

DnsPacket **ret) {

_cleanup_(dns_packet_unrefp) DnsPacket *p = NULL;

unsigned n_answer = 0, n_soa = 0;

int r;

bool c_or_aa;

assert(s);

assert(ret);

if (dns_question_isempty(q) &&

dns_answer_isempty(answer) &&

dns_answer_isempty(soa))

return -EINVAL;

r = dns_packet_new(&p, s->protocol, 0, DNS_PACKET_SIZE_MAX);

if (r < 0)

return r;

/* mDNS answers must have the Authoritative Answer bit set, see RFC 6762, section 18.4. */

c_or_aa = s->protocol == DNS_PROTOCOL_MDNS;

DNS_PACKET_HEADER(p)->id = id;

DNS_PACKET_HEADER(p)->flags = htobe16(DNS_PACKET_MAKE_FLAGS(

1 /* qr */,

0 /* opcode */,

c_or_aa,

0 /* tc */,

tentative,

0 /* (ra) */,

0 /* (ad) */,

0 /* (cd) */,

rcode));

r = dns_packet_append_question(p, q);

if (r < 0)

return r;

DNS_PACKET_HEADER(p)->qdcount = htobe16(dns_question_size(q));

r = dns_packet_append_answer(p, answer, &n_answer);

if (r < 0)

return r;

DNS_PACKET_HEADER(p)->ancount = htobe16(n_answer);

r = dns_packet_append_answer(p, soa, &n_soa);

if (r < 0)

return r;

DNS_PACKET_HEADER(p)->arcount = htobe16(n_soa);

*ret = TAKE_PTR(p);

return 0;

}

static void dns_scope_verify_conflicts(DnsScope *s, DnsPacket *p) {

DnsResourceRecord *rr;

DnsResourceKey *key;

assert(s);

assert(p);

DNS_QUESTION_FOREACH(key, p->question)

dns_zone_verify_conflicts(&s->zone, key);

DNS_ANSWER_FOREACH(rr, p->answer)

dns_zone_verify_conflicts(&s->zone, rr->key);

}

void dns_scope_process_query(DnsScope *s, DnsStream *stream, DnsPacket *p) {

_cleanup_(dns_answer_unrefp) DnsAnswer *answer = NULL, *soa = NULL;

_cleanup_(dns_packet_unrefp) DnsPacket *reply = NULL;

DnsResourceKey *key = NULL;

bool tentative = false;

int r;

assert(s);

assert(p);

if (p->protocol != DNS_PROTOCOL_LLMNR)

return;

if (p->ipproto == IPPROTO_UDP) {

/* Don't accept UDP queries directed to anything but

if (p->family == AF_INET && !in4_addr_equal(&p->destination.in, &LLMNR_MULTICAST_IPV4_ADDRESS))

return;

if (p->family == AF_INET6 && !in6_addr_equal(&p->destination.in6, &LLMNR_MULTICAST_IPV6_ADDRESS))

return;

}