resolved: don't allow adding of ANY class/type RRs to local zones

[elogind.git] / src / resolve / resolved-dns-scope.c

diff --git a/src/resolve/resolved-dns-scope.c b/src/resolve/resolved-dns-scope.c
index 9a636b179c82ee3d3ebcae2ebf4e9516375a9458..b17de0c88fdd3f6febf869b1c05496d1b77af3ca 100644 (file)
--- a/src/resolve/resolved-dns-scope.c
+++ b/src/resolve/resolved-dns-scope.c
@@ -254,7 +254,7 @@ int dns_scope_tcp_socket(DnsScope *s, int family, const union in_addr_union *add
         }
 
         if (s->protocol == DNS_PROTOCOL_LLMNR) {
-                /* RFC 4795, section 2.5 suggests the TTL to be set to 1 */
+                /* RFC 4795, section 2.5 requires the TTL to be set to 1 */
 
                 if (sa.sa.sa_family == AF_INET) {
                         r = setsockopt(fd, IPPROTO_IP, IP_TTL, &one, sizeof(one));
@@ -312,8 +312,8 @@ DnsScopeMatch dns_scope_good_domain(DnsScope *s, const char *domain) {
         }
 
         if (s->protocol == DNS_PROTOCOL_LLMNR) {
-                if (dns_name_endswith(domain, "254.169.in-addr.arpa") > 0 ||
-                    dns_name_endswith(domain, "0.8.e.f.ip6.arpa") > 0 ||
+                if (dns_name_endswith(domain, "in-addr.arpa") > 0 ||
+                    dns_name_endswith(domain, "ip6.arpa") > 0 ||
                     dns_name_single_label(domain) > 0)
                         return DNS_SCOPE_MAYBE;
 
@@ -404,7 +404,16 @@ static int dns_scope_make_reply_packet(DnsScope *s, uint16_t id, int rcode, DnsQ
                 return r;
 
         DNS_PACKET_HEADER(p)->id = id;
-        DNS_PACKET_HEADER(p)->flags = htobe16(DNS_PACKET_MAKE_FLAGS(1, 0, 0, 0, 0, 0, 0, 0, rcode));
+        DNS_PACKET_HEADER(p)->flags = htobe16(DNS_PACKET_MAKE_FLAGS(
+                                                              1 /* qr */,
+                                                              0 /* opcode */,
+                                                              0 /* c */,
+                                                              0 /* tc */,
+                                                              0 /* t */,
+                                                              0 /* (ra) */,
+                                                              0 /* (ad) */,
+                                                              0 /* (cd) */,
+                                                              rcode));
 
         if (q) {
                 for (i = 0; i < q->n_keys; i++) {
@@ -443,12 +452,29 @@ void dns_scope_process_query(DnsScope *s, DnsStream *stream, DnsPacket *p) {
         if (p->protocol != DNS_PROTOCOL_LLMNR)
                 return;
 
+        if (p->ipproto == IPPROTO_UDP) {
+                /* Don't accept UDP queries directed to anything but
+                 * the LLMNR multicast addresses. See RFC 4795,
+                 * section 2.5.*/
+
+                if (p->family == AF_INET && !in_addr_equal(AF_INET, &p->destination, (union in_addr_union*) &LLMNR_MULTICAST_IPV4_ADDRESS))
+                        return;
+
+                if (p->family == AF_INET6 && !in_addr_equal(AF_INET6, &p->destination, (union in_addr_union*) &LLMNR_MULTICAST_IPV6_ADDRESS))
+                        return;
+        }
+
         r = dns_packet_extract(p);
         if (r < 0) {
                 log_debug("Failed to extract resources from incoming packet: %s", strerror(-r));
                 return;
         }
 
+        if (DNS_PACKET_C(p)) {
+                /* FIXME: Somebody notified us about a likely conflict */
+                return;
+        }
+
         r = dns_zone_lookup(&s->zone, p->question, &answer);
         if (r < 0) {
                 log_debug("Failed to lookup key: %s", strerror(-r));
@@ -457,6 +483,8 @@ void dns_scope_process_query(DnsScope *s, DnsStream *stream, DnsPacket *p) {
         if (r == 0)
                 return;
 
+        dns_answer_order_by_scope(answer, in_addr_is_link_local(p->family, &p->sender) > 0);
+
         r = dns_scope_make_reply_packet(s, DNS_PACKET_ID(p), DNS_RCODE_SUCCESS, p->question, answer, &reply);
         if (r < 0) {
                 log_debug("Failed to build reply packet: %s", strerror(-r));