Fix typo: DNS_TYPE_DNSKEY should be used instead of DNS_TYPE_KEY.
- DNS_TYPE_KEY is deprecated
- Source code at resolved-dns-trust-anchor.c#L313 handles
DNS_TYPE_DNSKEY records, but not DNS_TYPE_KEY
So DNS_TYPE_KEY is not referenced anywhere
Avahi provides AVAHI_IF_UNSPEC (-1) to browse mDNS services on all
interfaces simultaneously. Currently, systemd-resolved's BrowseServices
varlink API requires a specific interface index and lacks the ability to browse on
all available interfaces.
This change adds support for ifindex = 0 to mean \"browse on all mDNS-enabled
interfaces\" to match the Avahi API.
When ifindex = 0 is specified the browser will now iterate all mDNS scopes
instead of a single interface.
This enables applications to discover services on any network interface
without needing to know the specific interface index in advance.
Assisted-by: Claude Opus 4.6 (Eclipse Theia IDE AI)
The interface where each service was discovered needs to be remembered
so it can be correctly reported when the service is later removed.
Previously, service removal would use sb->ifindex, losing the actual
interface information from the original discovery.
This change:
- Adds an ifindex field to DnssdDiscoveredService struct
- Stores the discovered interface index when adding new services,
preferring the per-item ifindex from DnsAnswerItem over the service
browser's ifindex
- Uses the stored ifindex when reporting service removal events
This ensures that service removal notifications include the correct
interface index where the service was originally discovered, matching
the behavior of the corresponding service addition notifications.
Assisted-by: Claude Opus 4.6 (Eclipse Theia IDE AI)
This makes it possible to have DNS requests for certain domains routed
differently than normal requests, which is for instance useful when
using policy routing to route traffic over a VPN but DNS requests for
the VPN endpoint itself, should be routed differently.
It doesn't make much sense to configure a firewall mark at the level of
a network interface, but at the level of a DNS delegate it can be very
useful.
If the IDL declares the method requires 'more' yet the call doesn't
have it set, varlink_idl_validate_method_call() should have rejected
it and the callback shouldn't be reached.
Historically, resolvectl status has not included the interface
specification for DNS servers with an IPv6 link-local address, since it
is technically somewhat redundant. But, adding this extra bit of
information makes it easier to copy-and-paste to use elsewhere, etc.
For example, the previous output:
Link 2 (enp34s0)
Current Scopes: DNS LLMNR/IPv4 LLMNR/IPv6
Protocols: +DefaultRoute LLMNR=resolve -mDNS -DNSOverTLS DNSSEC=no/unsupported
Current DNS Server: fe80::861e:a3ff:feb1:f8e7
DNS Servers: 192.168.1.12 192.168.1.13 fe80::861e:a3ff:feb1:f8e7
DNS Domain: lan
now becomes:
Link 2 (enp34s0)
Current Scopes: DNS LLMNR/IPv4 LLMNR/IPv6
Protocols: +DefaultRoute LLMNR=resolve -mDNS -DNSOverTLS DNSSEC=no/unsupported
Current DNS Server: fe80::861e:a3ff:feb1:f8e7%2
DNS Servers: 192.168.1.12 192.168.1.13 fe80::861e:a3ff:feb1:f8e7%2
DNS Domain: lan
There is a lot of duplication across the functions for printing global,
link, and delegate output. Since these all use a common DNSConfiguration
type now, the logic can be consolidated.
Adapt printing and format helper functions to accept a DNSConfiguration
parameter to appropriately format output. Then, add print_configuration(),
a single function that prints the appropriate status output based on the
contents of DNSConfiguration.
Now that varlink is always used for status output, consolidate the JSON
and regular status code paths. Add status_full(), which is the single
point that calls DumpDNSConfiguration, filters based on link names and
mode if needed, and prints the output in the appropriate format.
This simplifies status_ifindex(), and removes the need for a separate
status_json().
This is an incremental commit to replacing dbus usage with varlink for
all status output.
Re-implement regular delegate status output using the DumpDNSConfiguration
varlink method. And, remove the DelegateInfo type and associated functions
which were used to map dbus properties.
Since this is the last type of status output to be switched to varlink,
lots of other code becomes dead with these changes, e.g.
read_dns_server_one(), map_dns_servers_internal(), etc., so remove those
too. Finally, status_all() no longer needs sd_bus, so drop that
parameter.
This is an incremental commit to replacing dbus usage with varlink for
all status output.
Re-implement regular link status output using the DumpDNSConfiguration
varlink method. And, remove the LinkInfo type and associated functions
which were used to map dbus properties.
This is an incremental commit to replacing dbus usage with varlink for
all status output.
Re-implement regular global status output using the DumpDNSConfiguration
varlink method. And, remove the GlobalInfo type and associated functions
which were used to map dbus properties.
The varlink API is currently missing the "DNSSEC supported" field, which
is required for to re-implement the existing resolvectl status output
with varlink instead of dbus.
Add this field to DNSConfiguration.
Let's make sure we can safely load configuration files based on a root
fd, including XAT_FDROOT.
(While we are at it, always pass path to root fs before fd to root fs,
following our recently updated CODING_STYLE)
The current_dns_server_json object in dns_configuration_json_append() is
always NULL, because the logic to dump the current DNS server to JSON
was removed by mistake in a re-factoring commit. Add that logic back.
Fixes c6b6ac63ea ("resolve: drop unnecessary preparation of empty arrays").
The current tree doesn't even compile with libidn(1) after
2c7bdaf9f1, which included
a non-existent call to check_dlopen_blocked() somehow.
Hence, it feels safe to just nuke legacy support from
our repo.
All major distributions have switched to OpenSSL version 3.x.
Let's drop support of OpenSSL version 1.x.
Note, OpenSSL 3.0 was released on 2021-09-07 (and will be EOL on 2026-09-07).
See also #38608.
Let's introduce these for the following two reasons:
- Using them makes sure the parameter names match between declaration
and definition (if both use the corresponding macros).
- They make sure developers can't forget the _const_ and _pure_
attributes for the declarations.
This commit also includes some include sorting fixes
When systemd-resolved is used in resolv.conf foreign mode, reloading the
systemd-resolved daemon does not read resolv.conf when not touched since
the last time resolved read the file. Since the DNS servers list is
flushed during a reload, resolved forgets about the servers
in /etc/resolv.conf
When reloading the daemon it is expected that all configuration is
reloaded regardless of the disk timestamps.
Quite often we need to specify include_directories('.'). Normally, meson
does this automatically, but we specify implicit_include_directories : false,
see 30d20907bd for an explanation.
Passing the include_directories argument through the template layers was rather
cumbersome. Let's simplify things by always including the directory of the
first source file. This makes the definitions simpler, at the cost of having an
unnecessary include directory in the list in some cases.
(Tests are excluded from this change, because they happen to not need this, but
also because some tests have source[0] which is a custom target, and we'd need
newer meson to support that.)
In all cases, everything that we list in 'extract', we also list in
'sources'. We can simplify things by automatically appending the first
list to the second.
In the listings, move 'extract' key right below 'sources', since now
they are both "sources", just with slightly different meanings.
This introduces /run/systemd/resolve.hook/ as a new directory that local
(privileged) programs can bind a Varlink socket into. If they do they'll
get a method call for each attempted resolved lookup, which they can
then either process themselves (and generate new records for, or return
errors to block stuff) or let pass so that the regular resolution is
done.
Usecase for this is primarily two things:
1. in machined we can add local resolution of machine names to their IP
addresses, similar in fashion to nss-mymachines, but working also if
the non-NSS interfaces to name resolution are used, i.e. the local
DNS responder. In fact, I think we should eventually remove
nss-mymachines from our tree, as soon as this code in resolved is
setlled.
2. in networkd we can add local resolution of names specified in DHCP
leases we hand out.
But beyond that there should be many other uses, for example people
could write "dns firewalls" with this if they like where they
dynamically block certain names from resolution.
Fixes: #8518
Frantisek Sumsal
Mike Yuan
Yu Watanabe
Anton Tiurin
Christian Glombek
r-vdp
Carlos Peón Costa
Zbigniew Jędrzejewski-Szmek
Daan De Meyer
Nick Rosbrook
Lennart Poettering
Daan De Meyer
Fletcher Woodruff
Pasquale van Heumen
Jelle van der Waa
Luca Boccassi