Merge ff7ff2d008 into 66d044b560

The section headers used quotes as if the strings were some constants. But
AFAICT, those are just normal plain-text titles. Also lowercase them, because
this is almost like a table and it's easier to read without capitalization.

NEWS

@@ -186,7 +186,7 @@ CHANGES WITH 257 in spe:
 
         * The systemd.machine_id= kernel command line parameter interpreted by
           PID 1 now supports an additional special value: if "firmware" is
-          specified the machine ID is initialized from the SMBIOS/Devicetree
+          specified the machine ID is initialized from the SMBIOS/DeviceTree
           system UUID. (Previously this was already done in VM environments,
           this extends the concept to any system, but only on explicit request
           via this option.)
@@ -276,10 +276,10 @@ CHANGES WITH 257 in spe:
           show up as .device units in systemd.
 
         * The firmware_node/sun sysfs attribute will now be used (if available)
-          for naming slot-based network interfaces,
+          for naming slot-based network interfaces, i.e. ID_NET_NAME_SLOT.
-          i.e. ID_NET_NAME_SLOT. Moreover the interface aliases specified in
+          Moreover the interface aliases specified in DeviceTree are now
-          Devicetree are now searched for both on the interfaces parent device
+          searched for both on the interface's parent device (as before) and
-          (as before) and the device itself (new).
+          the device itself (new).
 
         * Various USB hardware wallets have are now recognized by udev via a
           .hwdb file, and get the ID_HARDWARE_WALLET= property set, which
@@ -384,6 +384,16 @@ CHANGES WITH 257 in spe:
           reset one, and so on – which only differ in kernel command line, but
           nothing else).
 
+        * New .dtbauto and .hwids sections are now documented and supported in
+          systemd-measure, ukify, systemd-stub, and systemd-boot. A single UKI
+          can contain multiple .dtbauto sections, and the 'compatible' string
+          therein will be compared with the equivalent field in the DTB
+          provided by the firmware, if present. If absent, SMBIOS will be used
+          to calculate hardware IDs and compare them with the content of
+          .hwids. This allows including multiple DTBs in a single UKI, with
+          the bootloader automatically selecting the correct one for the
+          current hardware.
+
         * ukify gained an --extend switch to import an existing UKI to
           be extended, and a --measure-base= switch to support measurement
           of multi-profile UKIs.
@@ -646,6 +656,9 @@ CHANGES WITH 257 in spe:
         * systemd-tmpfiles --purge switch now requires specification of at
           least one tmpfiles.d/ drop-in file.
 
+        * tmpfiles.d gained a new '?' specifier for the 'L' type to create a
+          symlink only if the source exists, and gracefully skip otherwise.
+
         * The new Linux mseal(), listmount(), statmount() syscalls have been
           added to relevant system call groups.
 
@@ -2012,7 +2025,7 @@ CHANGES WITH 255:
           respective SBAT sections, so that they can be revoked individually if
           needed.
 
-        * systemd-boot will no longer load unverified Devicetree blobs when UEFI
+        * systemd-boot will no longer load unverified DeviceTree blobs when UEFI
           SecureBoot is enabled. For more details see:
           https://github.com/systemd/systemd/security/advisories/GHSA-6m6p-rjcq-334c
 
@@ -2033,7 +2046,7 @@ CHANGES WITH 255:
           command-line addons before measuring them in TPM2 PCR 12, in a single
           measurement, instead of measuring them individually.
 
-        * systemd-stub will now measure and load Devicetree Blob addons, which
+        * systemd-stub will now measure and load DeviceTree Blob addons, which
           are searched and loaded following the same model as the existing
           kernel command-line addons.
 
@@ -2041,7 +2054,7 @@ CHANGES WITH 255:
           passed from systemd-boot when running inside Confidential VMs with UEFI
           SecureBoot enabled.
 
-        * systemd-stub will now load a Devicetree blob even if the firmware did
+        * systemd-stub will now load a DeviceTree blob even if the firmware did
           not load any beforehand (e.g.: for ACPI systems).
 
         * ukify is no longer considered experimental, and now ships in /usr/bin/.
@@ -2222,6 +2235,10 @@ CHANGES WITH 255:
           specific devices explicitly. NetworkManager will soon implement a
           similar logic.
 
+        * .network files gained a new MulticastIGMPVersion= setting in the
+          [Network] section, to control sysctl's
+          /proc/sys/net/ipv4/conf/INTERFACE/force_igmp_version setting.
+
         systemctl:
 
         * systemctl is-failed now checks the system state if no unit is
@@ -4355,7 +4372,7 @@ CHANGES WITH 252 🎃:
         * 'udevadm wait' will now listen to kernel uevents too when called with
           --initialized=no.
 
-        * When naming network devices udev will now consult the Devicetree
+        * When naming network devices udev will now consult the DeviceTree
           "alias" fields for the device.
 
         * systemd-udev will now create infiniband/by-path and

docs/TPM2_PCR_MEASUREMENTS.md

@@ -41,7 +41,7 @@ used for new, additional measurements.
 
 ## PCR Measurements Made by `systemd-boot` (UEFI)
 
-### PCS 5, `EV_EVENT_TAG`, "loader.conf"
+### PCS 5, `EV_EVENT_TAG`, `loader.conf`
 
 The content of `systemd-boot`'s configuration file, `loader/loader.conf`, is
 measured as a tagged event.
@@ -52,7 +52,7 @@ measured as a tagged event.
 
 → **Measured hash** covers the content of `loader.conf` as it is read from the ESP.
 
-### PCR 12, `EV_IPL`, "Kernel Command Line"
+### PCR 12, `EV_IPL`, kernel command line
 
 If the kernel command line was specified explicitly (by the user or in a Boot
 Loader Specification Type #1 file), the kernel command line passed to the
@@ -70,7 +70,7 @@ trailing NUL bytes).
 
 ## PCR Measurements Made by `systemd-stub` (UEFI)
 
-### PCR 11, `EV_IPL`, "PE Section Name"
+### PCR 11, `EV_IPL`, PE section name
 
 A measurement is made for each PE section of the UKI that is defined by the
 [UKI
@@ -87,7 +87,7 @@ both types of records appear interleaved in the event log.
 
 → **Measured hash** covers the PE section name in ASCII (*including* a trailing NUL byte!).
 
-### PCR 11, `EV_IPL`, "PE Section Data"
+### PCR 11, `EV_IPL`, PE section data
 
 Happens once for each UKI-defined PE section of the UKI, in the canonical UKI
 PE section order, as per the UKI specification, see above.
@@ -96,7 +96,7 @@ PE section order, as per the UKI specification, see above.
 
 → **Measured hash** covers the (binary) PE section contents.
 
-### PCR 12, `EV_IPL`, "Kernel Command Line"
+### PCR 12, `EV_IPL`, kernel command line
 
 Might happen up to three times, for kernel command lines from:
 
@@ -110,37 +110,37 @@ UTF-16.
 → **Measured hash** covers the literal kernel command line in UTF-16 (without any
 trailing NUL bytes).
 
-### PCR 12, `EV_EVENT_TAG`, "Devicetrees"
+### PCR 12, `EV_EVENT_TAG`, DeviceTrees
 
-Devicetree addons are measured individually as a tagged event.
+DeviceTree addons are measured individually as a tagged event.
 
 → **Event Tag** `0x6c46f751`
 
-→ **Description** the addon filename.
+→ **Description** is the addon filename.
 
-→ **Measured hash** covers the content of the Devicetree.
+→ **Measured hash** covers the content of the DeviceTree.
 
-### PCR 12, `EV_EVENT_TAG`, "Initrd addons"
+### PCR 12, `EV_EVENT_TAG`, initrd addons
 
 Initrd addons are measured individually as a tagged event.
 
 → **Event Tag** `0x49dffe0f`
 
-→ **Description** the addon filename.
+→ **Description** is the addon filename.
 
 → **Measured hash** covers the contents of the initrd.
 
-### PCR 12, `EV_EVENT_TAG`, "Ucode addons"
+### PCR 12, `EV_EVENT_TAG`, ucode addons
 
 Ucode addons are measured individually as a tagged event.
 
 → **Event Tag** `0xdac08e1a`
 
-→ **Description** the addon filename.
+→ **Description** is the addon filename.
 
 → **Measured hash** covers the contents of the ucode initrd.
 
-### PCR 12, `EV_IPL`, "Per-UKI Credentials initrd"
+### PCR 12, `EV_IPL`, per-uki credentials initrd
 
 → **Description** in the event log record is the constant string "Credentials
 initrd" in UTF-16.
@@ -148,7 +148,7 @@ initrd" in UTF-16.
 → **Measured hash** covers the per-UKI credentials cpio archive (which is generated
  on-the-fly by `systemd-stub`).
 
-### PCR 12, `EV_IPL`, "Global Credentials initrd"
+### PCR 12, `EV_IPL`, global credentials initrd
 
 → **Description** in the event log record is the constant string "Global
 credentials initrd" in UTF-16.
@@ -156,7 +156,7 @@ credentials initrd" in UTF-16.
 → **Measured hash** covers the global credentials cpio archive (which is generated
 on-the-fly by `systemd-stub`).
 
-### PCR 13, `EV_IPL`, "sysext initrd"
+### PCR 13, `EV_IPL`, sysext initrd
 
 → **Description** in the event log record is the constant string "System extension
 initrd" in UTF-16.
@@ -166,7 +166,7 @@ on-the-fly by `systemd-stub`).
 
 ## PCR Measurements Made by `systemd-pcrextend` (Userspace)
 
-### PCR 11, "Boot Phases"
+### PCR 11, boot phases
 
 The `systemd-pcrphase.service`, `systemd-pcrphase-initrd.service`,
 `systemd-pcrphase-sysinit.service` services will measure the boot phase reached
@@ -178,7 +178,7 @@ choose to define additional/different phases.)
 → **Measured hash** covers the phase string (in UTF-8, without trailing NUL
 bytes).
 
-### PCR 15, "Machine ID"
+### PCR 15, machine ID
 
 The `systemd-pcrmachine.service` service will measure the machine ID (as read
 from `/etc/machine-id`) during boot.
@@ -187,7 +187,7 @@ from `/etc/machine-id`) during boot.
 formatted in hexadecimal lowercase characters (in UTF-8, without trailing NUL
 bytes).
 
-### PCR 15, "File System"
+### PCR 15, file system
 
 The `systemd-pcrfs-root.service` and `systemd-pcrfs@.service` services will
 measure a string identifying a specific file system, typically covering the
@@ -200,7 +200,7 @@ without trailing NUL bytes).
 
 ## PCR Measurements Made by `systemd-cryptsetup` (Userspace)
 
-### PCR 15, "Volume Key"
+### PCR 15, volume key
 
 The `systemd-cryptsetup@.service` service will measure a key derived from the
 LUKS volume key of a specific encrypted volume, typically covering the backing

man/systemd-stub.xml

@@ -59,58 +59,66 @@
       <!-- Let's keep this in the canonical order we also measure the sections by, i.e. as in
            src/fundamental/uki.h's UnifiedSection enum -->
 
-      <listitem><para>A <literal>.linux</literal> section with the ELF Linux kernel
+      <listitem><para>A <literal>.linux</literal> section with the ELF Linux kernel image.
-      image. (Required)</para></listitem>
+      This section is required.</para></listitem>
 
-      <listitem><para>An <literal>.osrel</literal> section with OS release information, i.e. the contents of
+      <listitem><para>An optional <literal>.osrel</literal> section with OS release information, i.e. the
-      the <citerefentry><refentrytitle>os-release</refentrytitle><manvolnum>5</manvolnum></citerefentry> file
+      contents of the
-      of the OS the kernel belongs to.</para></listitem>
+      <citerefentry><refentrytitle>os-release</refentrytitle><manvolnum>5</manvolnum></citerefentry> file of
+      the OS the kernel belongs to.</para></listitem>
 
-      <listitem><para>A <literal>.cmdline</literal> section with the kernel command line to pass to the
+      <listitem><para>An optional <literal>.cmdline</literal> section with the kernel command line to pass to
-      invoked kernel.</para></listitem>
+      the invoked kernel.</para></listitem>
 
-      <listitem><para>An <literal>.initrd</literal> section with the initrd.</para></listitem>
+      <listitem><para>An optional <literal>.initrd</literal> section with the initrd.</para></listitem>
 
-      <listitem><para>A <literal>.ucode</literal> section with an initrd containing microcode, to be handed
+      <listitem><para>An optional <literal>.ucode</literal> section with an initrd containing microcode, to
-      to the kernel before any other initrd. This initrd must not be compressed.</para></listitem>
+      be handed to the kernel before any other initrd. This initrd must not be compressed.</para></listitem>
 
-      <listitem><para>A <literal>.splash</literal> section with an image (in the Windows
+      <listitem><para>An optional <literal>.splash</literal> section with an image (in the Windows
       <filename>.BMP</filename> format) to show on screen before invoking the kernel.</para></listitem>
 
-      <listitem><para>A <literal>.dtb</literal> section with a compiled binary DeviceTree.</para></listitem>
+      <listitem><para>An optional <literal>.dtb</literal> section with a compiled binary DeviceTree.
+      </para></listitem>
 
-      <listitem><para>Zero or more <literal>.dtbauto</literal> sections. Stub will always try to find first matching one.
+      <listitem><para>Zero or more <literal>.dtbauto</literal> sections. <filename>systemd-stub</filename>
-      Matching process extracts first <varname>compatible</varname> string from <literal>.dtbauto</literal>
+      will always use the first matching one. The match is performed by taking the first DeviceTree's
-      section and compares it with the first Devicetree's <varname>compatible</varname> string supplied by
+      <varname>compatible</varname> string supplied by the firmware in configuration tables and comparing it
-      the firmware in configuration tables. If firmware does not provide Devicetree, matching with
+      with the first <varname>compatible</varname> string from each of the <literal>.dtbauto</literal>
-      <varname>.hwids</varname>  section will be used instead. Stub will use SMBIOS data to calculate hardware
+      sections. If the firmware does not provide a DeviceTree, the match is done using the
-      IDs of the machine (as per <ulink url="https://learn.microsoft.com/en-us/windows-hardware/drivers/install/specifying-hardware-ids-for-a-computer">specification</ulink>),
+      <varname>.hwids</varname> section instead. After selecting a <literal>.hwids</literal> section (see the
-      then it will proceed to trying to find any of them in <literal>.hwids</literal> section and will use first
+      description below), the <varname>compatible</varname> string from that section will be used to perform
-      matching entry's <varname>compatible</varname>  as a search key among the <literal>.dtbauto</literal>
+      the same matching procedure. If a match is found, that <literal>.dtbauto</literal> section will be
-      entries, in a similar fashion as the use of <varname>compatible</varname> string read from the firmware
-      provided Devicetree was described before. First matching <literal>.dtbauto</literal> section will be
       loaded and will override <varname>.dtb</varname> if present.</para></listitem>
 
-      <listitem><para>A <literal>.hwids</literal> section with hardware IDs of the machines to match Devicetrees (refer to <literal>.dtbauto</literal> section description).</para></listitem>
+      <listitem><para>Zero or more <literal>.hwids</literal> sections with hardware IDs of the machines to
+      match DeviceTrees. <filename>systemd-stub</filename> will use the SMBIOS data to calculate hardware IDs
+      of the machine (as per <ulink
+      url="https://learn.microsoft.com/en-us/windows-hardware/drivers/install/specifying-hardware-ids-for-a-computer">specification</ulink>),
+      and then it will try to find any of them in each of the <literal>.hwids</literal> sections. The first
+      matching section will be used.</para></listitem>
 
-      <listitem><para>A <literal>.uname</literal> section with the kernel version information, i.e. the
+      <listitem><para>An optional <literal>.uname</literal> section with the kernel version information, i.e.
-      output of <command>uname -r</command> for the kernel included in the <literal>.linux</literal>
+      the output of <command>uname -r</command> for the kernel included in the <literal>.linux</literal>
       section.</para></listitem>
 
-      <listitem><para>An <literal>.sbat</literal> section with
+      <listitem><para>An optional <literal>.sbat</literal> section with
-      <ulink url="https://github.com/rhboot/shim/blob/main/SBAT.md">SBAT</ulink> revocation
+      <ulink url="https://github.com/rhboot/shim/blob/main/SBAT.md">SBAT</ulink> revocation metadata.
-      metadata.</para></listitem>
+      </para></listitem>
 
-      <listitem><para>A <literal>.pcrsig</literal> section with a set of cryptographic signatures for the
+      <listitem><para>An optional <literal>.pcrsig</literal> section with a set of cryptographic signatures
-      expected TPM2 PCR values after the kernel has been booted, in JSON format. This is useful for
+      for the expected TPM2 PCR values after the kernel has been booted, in JSON format. This is useful for
       implementing TPM2 policies that bind disk encryption and similar to kernels that are signed by a
       specific key.</para></listitem>
 
-      <listitem><para>A <literal>.pcrpkey</literal> section with a public key in the PEM format matching the
+      <listitem><para>An optional <literal>.pcrpkey</literal> section with a public key in the PEM format
-      signature data in the <literal>.pcrsig</literal> section.</para></listitem>
+      matching the signature data in the <literal>.pcrsig</literal> section.</para></listitem>
     </itemizedlist>
 
-    <para>In a basic UKI, the sections listed above appear at most once. In a multi-profile UKI,
+    <!-- FIXME: how does .dtauto/.hwids matching interact with profiles? -->
+
+    <para>In a basic UKI, the sections listed above appear at most once, with the exception of
+    <literal>.dtbauto</literal> and <literal>.hwids</literal> sections. In a multi-profile UKI,
     multiple sets of these sections are present in a single file and form "profiles",
     one of which can be selected at boot. For this, the PE section <literal>.profile</literal> is
     defined to be used as the separator between sets of sections. The
@@ -206,7 +214,7 @@
       <listitem><para>Similarly, files
       <filename><replaceable>foo</replaceable>.efi.extra.d/*.addon.efi</filename> are loaded and verified as
       PE binaries and specific sections are loaded from them. Addons are used to pass additional kernel
-      command line parameters (<literal>.cmdline</literal> section), or Devicetree blobs
+      command line parameters (<literal>.cmdline</literal> section), or DeviceTree blobs
       (<literal>.dtb</literal> section), additional initrds (<literal>.initrd</literal> section),
       and microcode updates (<literal>.ucode</literal> section). Addons allow those resources to be passed
       regardless of the kernel version being booted, for example allowing platform vendors to ship

man/systemd.net-naming-scheme.xml

@@ -123,7 +123,7 @@
 
                   <row>
                     <entry><replaceable>prefix</replaceable><constant>d</constant><replaceable>number</replaceable></entry>
-                    <entry>Devicetree alias index</entry>
+                    <entry>DeviceTree alias index</entry>
                   </row>
 
                 </tbody>

man/systemd.network.xml

@@ -1004,6 +1004,27 @@ DuplicateAddressDetection=none</programlisting></para>
         </listitem>
       </varlistentry>
 
+      <varlistentry>
+        <term><varname>MulticastIGMPVersion=</varname></term>
+        <listitem>
+          <para>Configures IPv4 Multicast IGMP Version to be used, and controls the value of
+          <filename>/proc/sys/net/ipv4/conf/<replaceable>INTERFACE</replaceable>/force_igmp_version</filename>.
+          Takes one of <literal>no</literal>,
+          <literal>v1</literal>, <literal>v2</literal>, or <literal>v3</literal>.
+          When <literal>no</literal>, no enforcement of an IGMP version will be applied, IGMPv1/v2 fallback are allowed, will back to
+          IGMPv3 mode again if all IGMPv1/v2 Querier Present timer expire.
+          When <literal>v1</literal>, use of IGMP version 1 will be enforced, and IGMPv1 report will be replied even if IGMPv2/v3
+          queries are received.
+          When <literal>v2</literal>, use of IGMP version 2 will be enforced, and IGMPv2 report will be replied if an IGMPv2/v3 query
+          is received, but fallback to IGMPv1 if an IGMPv1 query is received.
+          When <literal>v3</literal>, use of IGMP version 3 will be enforced, and the same reaction will be done as <literal>no</literal>.
+          Defaults to unset, and the sysctl value will be unchanged.
+          </para>
+
+          <xi:include href="version-info.xml" xpointer="v257"/>
+        </listitem>
+      </varlistentry>
+
       <varlistentry>
         <term><varname>IPv4AcceptLocal=</varname></term>
         <listitem>

src/boot/efi/UEFI_SECURITY.md

@@ -54,7 +54,7 @@ libraries (such as OpenSSL or gnu-efi) are linked, embedded, or used.
 
 ## Additional Resources
 BLS Type #1 entries allow the user to load two types of additional resources that can affect the system
-before `ExitBootServices()` has been called — kernel command line arguments and Devicetree blobs — that are
+before `ExitBootServices()` has been called — kernel command line arguments and DeviceTree blobs — that are
 not validated before use, as they do not carry signatures. For this reason, when SecureBoot is enabled,
 loading these resources is automatically disabled. There is no override for this security mechanism, neither
 at build time nor at runtime. Note that initrds are also not verified in BLS Type #1 configurations, for
@@ -62,7 +62,7 @@ compatibility with how SecureBoot has been traditionally handled on Linux-based
 only load them after `ExitBootServices()` has been called.
 
 Another mechanism is supported by `systemd-boot` and `systemd-stub` to add additional payloads to the boot
-process: "addons". Addons are PE signed binaries that can carry kernel command line arguments or Devicetree
+process: "addons". Addons are PE signed binaries that can carry kernel command line arguments or DeviceTree
 blobs (more payload types might be added in the future).
 In contrast to the user-specified additions in the Type #1 case
 described above, these addons are loaded through the UEFI image loading protocol, and thus are subject to

src/boot/efi/devicetree.c

@@ -178,8 +178,8 @@ bool firmware_devicetree_exists(void) {
         return !!find_configuration_table(MAKE_GUID_PTR(EFI_DTB_TABLE));
 }
 
-/* This function checks if the firmware provided Devicetree
+/* This function checks if the firmware provided DeviceTree
- * and a UKI provided Devicetree contain the same first entry
+ * and a UKI provided DeviceTree contain the same first entry
  * on their respective "compatible" fields (which usually defines
  * the actual device model). More specifically, given the FW/UKI
  * "compatible" property pair:

src/boot/measure.c

@@ -98,7 +98,7 @@ static int help(int argc, char *argv[], void *userdata) {
                "     --initrd=PATH       Path to initrd image file              %7$s .initrd\n"
                "     --ucode=PATH        Path to microcode image file           %7$s .ucode\n"
                "     --splash=PATH       Path to splash bitmap file             %7$s .splash\n"
-               "     --dtb=PATH          Path to Devicetree file                %7$s .dtb\n"
+               "     --dtb=PATH          Path to DeviceTree file                %7$s .dtb\n"
                "     --uname=PATH        Path to 'uname -r' file                %7$s .uname\n"
                "     --sbat=PATH         Path to SBAT file                      %7$s .sbat\n"
                "     --pcrpkey=PATH      Path to public key for PCR signatures  %7$s .pcrpkey\n"

src/fundamental/tpm2-pcr.h

@@ -47,7 +47,7 @@ enum {
 /* The tag used for EV_EVENT_TAG event log records covering the boot loader config */
 #define LOADER_CONF_EVENT_TAG_ID UINT32_C(0xf5bc582a)
 
-/* The tag used for EV_EVENT_TAG event log records covering Devicetree blobs */
+/* The tag used for EV_EVENT_TAG event log records covering DeviceTree blobs */
 #define DEVICETREE_ADDON_EVENT_TAG_ID UINT32_C(0x6c46f751)
 
 /* The tag used for EV_EVENT_TAG event log records covering initrd addons */

src/hostname/hostnamed.c

@@ -502,7 +502,7 @@ try_devicetree:
                 return NULL;
         }
 
-        /* Note that the Devicetree specification uses the very same vocabulary
+        /* Note that the DeviceTree specification uses the very same vocabulary
          * of chassis types as we do, hence we do not need to translate these types:
          *
          * https://github.com/devicetree-org/devicetree-specification/blob/master/source/chapter3-devicenodes.rst */

src/network/networkd-network-gperf.gperf

@@ -150,6 +150,7 @@ Network.IPv4ProxyARPPrivateVLAN,             config_parse_tristate,
 Network.ProxyARP,                            config_parse_tristate,                                    0,                             offsetof(Network, proxy_arp)
 Network.IPv6ProxyNDPAddress,                 config_parse_ipv6_proxy_ndp_address,                      0,                             0
 Network.IPv4ReversePathFilter,               config_parse_ip_reverse_path_filter,                      0,                             offsetof(Network, ipv4_rp_filter)
+Network.MulticastIGMPVersion,                config_parse_ipv4_force_igmp_version,                     0,                             offsetof(Network, ipv4_force_igmp_version)
 Network.BindCarrier,                         config_parse_strv,                                        0,                             offsetof(Network, bind_carrier)
 Network.ConfigureWithoutCarrier,             config_parse_bool,                                        0,                             offsetof(Network, configure_without_carrier)
 Network.IgnoreCarrierLoss,                   config_parse_ignore_carrier_loss,                         0,                             0

src/network/networkd-network.c

@@ -481,6 +481,7 @@ int network_load_one(Manager *manager, OrderedHashmap **networks, const char *fi
                 .proxy_arp = -1,
                 .proxy_arp_pvlan = -1,
                 .ipv4_rp_filter = _IP_REVERSE_PATH_FILTER_INVALID,
+                .ipv4_force_igmp_version = _IPV4_FORCE_IGMP_VERSION_INVALID,
 
                 .ndisc = -1,
                 .ndisc_use_redirect = true,

src/network/networkd-network.h

@@ -340,6 +340,7 @@ struct Network {
         uint32_t ipv6_mtu;
         IPv6PrivacyExtensions ipv6_privacy_extensions;
         IPReversePathFilter ipv4_rp_filter;
+        IPv4ForceIgmpVersion ipv4_force_igmp_version;
         int ipv6_proxy_ndp;
         Set *ipv6_proxy_ndp_addresses;
 

src/network/networkd-sysctl.c

@@ -408,6 +408,18 @@ static int link_set_ipv4_rp_filter(Link *link) {
         return sysctl_write_ip_property_int(AF_INET, link->ifname, "rp_filter", link->network->ipv4_rp_filter, manager_get_sysctl_shadow(link->manager));
 }
 
+static int link_set_ipv4_force_igmp_version(Link *link) {
+        assert(link);
+
+        if (!link_is_configured_for_family(link, AF_INET))
+                return 0;
+
+        if (link->network->ipv4_force_igmp_version < 0)
+                return 0;
+
+        return sysctl_write_ip_property_int(AF_INET, link->ifname, "force_igmp_version", link->network->ipv4_force_igmp_version, manager_get_sysctl_shadow(link->manager));
+}
+
 static int link_set_ipv6_privacy_extensions(Link *link) {
         IPv6PrivacyExtensions val;
 
@@ -723,6 +735,10 @@ int link_set_sysctl(Link *link) {
         if (r < 0)
                 log_link_warning_errno(link, r, "Cannot set IPv4 reverse path filtering for interface, ignoring: %m");
 
+        r = link_set_ipv4_force_igmp_version(link);
+        if (r < 0)
+                log_link_warning_errno(link, r, "Cannot set IPv4 force igmp version, ignoring: %m");
+
         r = link_set_ipv4_promote_secondaries(link);
         if (r < 0)
                 log_link_warning_errno(link, r, "Cannot enable promote_secondaries for interface, ignoring: %m");
@@ -770,3 +786,13 @@ int config_parse_ip_forward_deprecated(
                    "and the same settings in .network files for per-interface setting.");
         return 0;
 }
+
+static const char* const ipv4_force_igmp_version_table[_IPV4_FORCE_IGMP_VERSION_MAX] = {
+        [IPV4_FORCE_IGMP_VERSION_NO] = "no",
+        [IPV4_FORCE_IGMP_VERSION_1]  = "v1",
+        [IPV4_FORCE_IGMP_VERSION_2]  = "v2",
+        [IPV4_FORCE_IGMP_VERSION_3]  = "v3",
+};
+
+DEFINE_STRING_TABLE_LOOKUP(ipv4_force_igmp_version, IPv4ForceIgmpVersion);
+DEFINE_CONFIG_PARSE_ENUM(config_parse_ipv4_force_igmp_version, ipv4_force_igmp_version, IPv4ForceIgmpVersion);

src/network/networkd-sysctl.h

@@ -53,3 +53,18 @@ IPReversePathFilter ip_reverse_path_filter_from_string(const char *s) _pure_;
 CONFIG_PARSER_PROTOTYPE(config_parse_ipv6_privacy_extensions);
 CONFIG_PARSER_PROTOTYPE(config_parse_ip_reverse_path_filter);
 CONFIG_PARSER_PROTOTYPE(config_parse_ip_forward_deprecated);
+
+typedef enum IPv4ForceIgmpVersion {
+        /* These values map to the kernel's /proc/sys/net/ipv4/conf/INTERFACE/force_igmp_version values. Do not reorder! */
+        IPV4_FORCE_IGMP_VERSION_NO = 0,
+        IPV4_FORCE_IGMP_VERSION_1  = 1,
+        IPV4_FORCE_IGMP_VERSION_2  = 2,
+        IPV4_FORCE_IGMP_VERSION_3  = 3,
+        _IPV4_FORCE_IGMP_VERSION_MAX,
+        _IPV4_FORCE_IGMP_VERSION_INVALID = -EINVAL,
+} IPv4ForceIgmpVersion;
+
+const char* ipv4_force_igmp_version_to_string(IPv4ForceIgmpVersion i) _const_;
+IPv4ForceIgmpVersion ipv4_force_igmp_version_from_string(const char *s) _pure_;
+
+CONFIG_PARSER_PROTOTYPE(config_parse_ipv4_force_igmp_version);

src/resolve/resolved-manager.c

@@ -963,9 +963,9 @@ int manager_recv(Manager *m, int fd, DnsProtocol protocol, DnsPacket **ret) {
                         p->ifindex = manager_find_ifindex(m, p->family, &p->destination);
         }
 
-        log_debug("Received %s UDP packet of size %zu, ifindex=%i, ttl=%u, fragsize=%zu, sender=%s, destination=%s",
+        log_debug("Received %s UDP packet of size %zu, ifindex=%i, ttl=%u, fragsize=%zu, sender=%s, sender_port=%u, destination=%s",
                   dns_protocol_to_string(protocol), p->size, p->ifindex, p->ttl, p->fragsize,
-                  IN_ADDR_TO_STRING(p->family, &p->sender),
+                  IN_ADDR_TO_STRING(p->family, &p->sender), p->sender_port,
                   IN_ADDR_TO_STRING(p->family, &p->destination));
 
         *ret = TAKE_PTR(p);

src/resolve/resolved-mdns.c

@@ -385,10 +385,7 @@ static int on_mdns_packet(sd_event_source *s, int fd, uint32_t revents, void *us
         if (r <= 0)
                 return r;
 
-        /* Refuse traffic from the local host, to avoid query loops. However, allow legacy mDNS
+        if (manager_packet_from_local_address(m, p))
-         * unicast queries through anyway (we never send those ourselves, hence no risk).
-         * i.e. check for the source port nr. */
-        if (p->sender_port == MDNS_PORT && manager_packet_from_local_address(m, p))
                 return 0;
 
         scope = manager_find_scope(m, p);
@@ -400,6 +397,15 @@ static int on_mdns_packet(sd_event_source *s, int fd, uint32_t revents, void *us
         if (dns_packet_validate_reply(p) > 0) {
                 DnsResourceRecord *rr;
 
+                /* RFC 6762 section 6:
+                 * The source UDP port in all Multicast DNS responses MUST be 5353 (the well-known port
+                 * assigned to mDNS). Multicast DNS implementations MUST silently ignore any Multicast DNS
+                 * responses they receive where the source UDP port is not 5353. */
+                if (p->sender_port != MDNS_PORT) {
+                        log_debug("Received mDNS reply packet from port %u (not %i), ignoring.", p->sender_port, MDNS_PORT);
+                        return 0;
+                }
+
                 log_debug("Got mDNS reply packet");
 
                 /*

src/udev/udev-builtin-net_id.c

@@ -924,7 +924,7 @@ static int names_devicetree(sd_device *dev, const char *prefix, EventMode mode)
                 char str[ALTIFNAMSIZ];
                 if (snprintf_ok(str, sizeof str, "%sd%u", prefix, i))
                         udev_builtin_add_property(dev, mode, "ID_NET_NAME_ONBOARD", str);
-                log_device_debug(dev, "Devicetree identifier: alias_index=%u %s \"%s\"",
+                log_device_debug(dev, "DeviceTree identifier: alias_index=%u %s \"%s\"",
                                  i, special_glyph(SPECIAL_GLYPH_ARROW_RIGHT), str + strlen(prefix));
                 return 0;
         }

test/test-network/conf/25-sysctl.network

@@ -13,3 +13,4 @@ IPv6ProxyNDP=yes
 IPv6AcceptRA=no
 IPv4AcceptLocal=yes
 IPv4ReversePathFilter=no
+MulticastIGMPVersion=v1

test/test-network/systemd-networkd-tests.py

@@ -4381,6 +4381,7 @@ class NetworkdNetworkTests(unittest.TestCase, Utilities):
         self.check_ipv4_sysctl_attr('dummy98', 'proxy_arp_pvlan', '1')
         self.check_ipv4_sysctl_attr('dummy98', 'accept_local', '1')
         self.check_ipv4_sysctl_attr('dummy98', 'rp_filter', '0')
+        self.check_ipv4_sysctl_attr('dummy98', 'force_igmp_version', '1')
 
         copy_network_unit('25-sysctl.network.d/25-ipv6-privacy-extensions.conf')
         networkctl_reload()

test/units/TEST-75-RESOLVED.sh

@@ -996,6 +996,87 @@ testcase_12_resolvectl2() {
     restart_resolved
 }
 
+testcase_mdns() {
+    # For issue #32990 and #33806
+
+    # Cleanup
+    # shellcheck disable=SC2317
+    cleanup() {
+        rm -f /run/systemd/resolved.conf.d/enable-mdns.conf
+        rm -rf /run/systemd/dnssd
+        ip link del veth99 || :
+        ip netns del ns99 || :
+    }
+
+    trap cleanup RETURN
+
+    mkdir -p /run/systemd/resolved.conf.d
+    cat >/run/systemd/resolved.conf.d/enable-mdns.conf <<EOF
+[Resolve]
+MulticastDNS=yes
+EOF
+
+    mkdir -p /run/systemd/dnssd
+    cat >/run/systemd/dnssd/ssh.dnssd <<EOF
+[Service]
+Name=%H
+Type=_ssh._tcp
+Port=22
+TxtText=hogehogehoge
+Priority=42
+Weight=13
+EOF
+
+    ip netns add ns99
+    ip link add veth99 type veth peer name veth-peer
+    ip link set veth-peer netns ns99
+    ip link set veth99 up
+    ip netns exec ns99 ip link set veth-peer up
+    ip link set veth99 multicast on
+    ip address add 192.168.0.12/24 dev veth99
+    ip netns exec ns99 ip address add 192.168.0.10/24 dev veth-peer
+    assert_in '192.168.0.12/24' "$(ip address show dev veth99)"
+    assert_in '192.168.0.10/24' "$(ip netns exec ns99 ip address show dev veth-peer)"
+
+    # make sure networkd is not running.
+    systemctl stop systemd-networkd.socket
+    systemctl stop systemd-networkd.service
+
+    # restart resolved and enable mdns on interface veth99
+    restart_resolved
+    resolvectl mdns veth99 yes
+    resolvectl domain veth99 local
+    assert_in 'Global: yes' "$(resolvectl mdns)"
+    assert_in 'yes' "$(resolvectl mdns veth99)"
+    assert_in 'local' "$(resolvectl domain veth99)"
+
+    run ip netns exec ns99 dig -p 5353 "ns1.local" @192.168.0.12
+    grep -qE "ns1\.local\.\s+[0-9]+\s+IN\s+A\s+192\.168\.0\.12" "$RUN_OUT"
+
+    run ip netns exec ns99 dig -p 5353 -t SRV "ns1._ssh._tcp.local" @192.168.0.12
+    grep -qE "ns1\._ssh\._tcp\.local\.\s+[0-9]+\s+IN\s+SRV\s+42\s+13\s+22\s+ns1\.local\." "$RUN_OUT"
+
+    run ip netns exec ns99 dig -p 5353 -t TXT "ns1._ssh._tcp.local" @192.168.0.12
+    grep -qE "ns1\._ssh\._tcp\.local\.\s+[0-9]+\s+IN\s+TXT\s+\"hogehogehoge\"" "$RUN_OUT"
+
+    run resolvectl query "ns1.local" || :
+    grep -qE "ns1.local: " "$RUN_OUT"
+    grep -qE ".*192\.168\.0\.12\s+-- link: veth99" "$RUN_OUT"
+
+    run resolvectl query -t SRV "ns1._ssh._tcp.local" || :
+    grep -qE "ns1\._ssh\._tcp\.local IN SRV 42 13 22 ns1\.local\s+-- link: veth99" "$RUN_OUT"
+
+    run resolvectl query -t TXT "ns1._ssh._tcp.local" || :
+    grep -qE "ns1\._ssh\._tcp\.local IN TXT \"hogehogehoge\"\s+-- link: veth99" "$RUN_OUT"
+
+    run resolvectl service "ns1._ssh._tcp.local" || :
+    grep -qE "ns1\._ssh\._tcp\.local: ns1\.local:22 \[priority=42, weight=13\]" "$RUN_OUT"
+
+    # refuse queries from a local address. See issue #32990 and the comment:
+    # https://github.com/systemd/systemd/pull/34141#discussion_r1736318656
+    (! dig -p 5353 "ns1.local" @192.168.0.12)
+}
+
 # PRE-SETUP
 systemctl unmask systemd-resolved.service
 systemctl enable --now systemd-resolved.service