}
if (s->protocol == DNS_PROTOCOL_LLMNR) {
- /* RFC 4795, section 2.5 suggests the TTL to be set to 1 */
+ /* RFC 4795, section 2.5 requires the TTL to be set to 1 */
if (sa.sa.sa_family == AF_INET) {
r = setsockopt(fd, IPPROTO_IP, IP_TTL, &one, sizeof(one));
if (p->protocol != DNS_PROTOCOL_LLMNR)
return;
+ if (p->ipproto == IPPROTO_UDP) {
+ /* Don't accept UDP queries directed to anything but
+ * the LLMNR multicast addresses. See RFC 4795,
+ * section 2.5.*/
+
+ if (p->family == AF_INET && !in_addr_equal(AF_INET, &p->destination, (union in_addr_union*) &LLMNR_MULTICAST_IPV4_ADDRESS))
+ return;
+
+ if (p->family == AF_INET6 && !in_addr_equal(AF_INET6, &p->destination, (union in_addr_union*) &LLMNR_MULTICAST_IPV6_ADDRESS))
+ return;
+ }
+
r = dns_packet_extract(p);
if (r < 0) {
log_debug("Failed to extract resources from incoming packet: %s", strerror(-r));
if (r == 0)
return;
+ dns_answer_order_by_scope(answer, in_addr_is_link_local(p->family, &p->sender) > 0);
+
r = dns_scope_make_reply_packet(s, DNS_PACKET_ID(p), DNS_RCODE_SUCCESS, p->question, answer, &reply);
if (r < 0) {
log_debug("Failed to build reply packet: %s", strerror(-r));