Merge branch 'master' into master

1 files changed, 197 insertions, 172 deletions

diff --git a/src/Jellyfin.Networking/Manager/NetworkManager.cs b/src/Jellyfin.Networking/Manager/NetworkManager.cs
index dd01e9533..126d9f15c 100644
--- a/src/Jellyfin.Networking/Manager/NetworkManager.cs
+++ b/src/Jellyfin.Networking/Manager/NetworkManager.cs
@@ -7,6 +7,7 @@ using System.Net;
 using System.Net.NetworkInformation;
 using System.Net.Sockets;
 using System.Threading;
+using J2N.Collections.Generic.Extensions;
 using MediaBrowser.Common.Configuration;
 using MediaBrowser.Common.Net;
 using MediaBrowser.Model.Net;
@@ -50,11 +51,6 @@ public class NetworkManager : INetworkManager, IDisposable
     private bool _eventfire;
 
     /// <summary>
-    /// List of all interface MAC addresses.
-    /// </summary>
-    private IReadOnlyList<PhysicalAddress> _macAddresses;
-
-    /// <summary>
     /// Dictionary containing interface addresses and their subnets.
     /// </summary>
     private List<IPData> _interfaces;
@@ -91,7 +87,6 @@ public class NetworkManager : INetworkManager, IDisposable
         _startupConfig = startupConfig;
         _initLock = new();
         _interfaces = new List<IPData>();
-        _macAddresses = new List<PhysicalAddress>();
         _publishedServerUrls = new List<PublishedServerUriOverride>();
         _networkEventLock = new();
         _remoteAddressFilter = new List<IPNetwork>();
@@ -215,96 +210,97 @@ public class NetworkManager : INetworkManager, IDisposable
 
     /// <summary>
     /// Generate a list of all the interface ip addresses and submasks where that are in the active/unknown state.
-    /// Generate a list of all active mac addresses that aren't loopback addresses.
     /// </summary>
     private void InitializeInterfaces()
     {
         lock (_initLock)
         {
-            _logger.LogDebug("Refreshing interfaces.");
+            _interfaces = GetInterfacesCore(_logger, IsIPv4Enabled, IsIPv6Enabled).ToList();
+        }
+    }
 
-            var interfaces = new List<IPData>();
-            var macAddresses = new List<PhysicalAddress>();
+    /// <summary>
+    /// Generate a list of all the interface ip addresses and submasks where that are in the active/unknown state.
+    /// </summary>
+    /// <param name="logger">The logger.</param>
+    /// <param name="isIPv4Enabled">If true evaluates IPV4 type ip addresses.</param>
+    /// <param name="isIPv6Enabled">If true evaluates IPV6 type ip addresses.</param>
+    /// <returns>A list of all locally known up addresses and submasks that are to be considered usable.</returns>
+    public static IReadOnlyList<IPData> GetInterfacesCore(ILogger logger, bool isIPv4Enabled, bool isIPv6Enabled)
+    {
+        logger.LogDebug("Refreshing interfaces.");
 
-            try
-            {
-                var nics = NetworkInterface.GetAllNetworkInterfaces()
-                    .Where(i => i.OperationalStatus == OperationalStatus.Up);
+        var interfaces = new List<IPData>();
+
+        try
+        {
+            var nics = NetworkInterface.GetAllNetworkInterfaces()
+                .Where(i => i.OperationalStatus == OperationalStatus.Up);
 
-                foreach (NetworkInterface adapter in nics)
+            foreach (NetworkInterface adapter in nics)
+            {
+                try
                 {
-                    try
-                    {
-                        var ipProperties = adapter.GetIPProperties();
-                        var mac = adapter.GetPhysicalAddress();
+                    var ipProperties = adapter.GetIPProperties();
 
-                        // Populate MAC list
-                        if (adapter.NetworkInterfaceType != NetworkInterfaceType.Loopback && !PhysicalAddress.None.Equals(mac))
+                    // Populate interface list
+                    foreach (var info in ipProperties.UnicastAddresses)
+                    {
+                        if (isIPv4Enabled && info.Address.AddressFamily == AddressFamily.InterNetwork)
                         {
-                            macAddresses.Add(mac);
-                        }
+                            var interfaceObject = new IPData(info.Address, new IPNetwork(info.Address, info.PrefixLength), adapter.Name)
+                            {
+                                Index = ipProperties.GetIPv4Properties().Index,
+                                Name = adapter.Name,
+                                SupportsMulticast = adapter.SupportsMulticast
+                            };
 
-                        // Populate interface list
-                        foreach (var info in ipProperties.UnicastAddresses)
+                            interfaces.Add(interfaceObject);
+                        }
+                        else if (isIPv6Enabled && info.Address.AddressFamily == AddressFamily.InterNetworkV6)
                         {
-                            if (IsIPv4Enabled && info.Address.AddressFamily == AddressFamily.InterNetwork)
-                            {
-                                var interfaceObject = new IPData(info.Address, new IPNetwork(info.Address, info.PrefixLength), adapter.Name)
-                                {
-                                    Index = ipProperties.GetIPv4Properties().Index,
-                                    Name = adapter.Name,
-                                    SupportsMulticast = adapter.SupportsMulticast
-                                };
-
-                                interfaces.Add(interfaceObject);
-                            }
-                            else if (IsIPv6Enabled && info.Address.AddressFamily == AddressFamily.InterNetworkV6)
+                            var interfaceObject = new IPData(info.Address, new IPNetwork(info.Address, info.PrefixLength), adapter.Name)
                             {
-                                var interfaceObject = new IPData(info.Address, new IPNetwork(info.Address, info.PrefixLength), adapter.Name)
-                                {
-                                    Index = ipProperties.GetIPv6Properties().Index,
-                                    Name = adapter.Name,
-                                    SupportsMulticast = adapter.SupportsMulticast
-                                };
-
-                                interfaces.Add(interfaceObject);
-                            }
+                                Index = ipProperties.GetIPv6Properties().Index,
+                                Name = adapter.Name,
+                                SupportsMulticast = adapter.SupportsMulticast
+                            };
+
+                            interfaces.Add(interfaceObject);
                         }
                     }
-                    catch (Exception ex)
-                    {
-                        // Ignore error, and attempt to continue.
-                        _logger.LogError(ex, "Error encountered parsing interfaces.");
-                    }
+                }
+                catch (Exception ex)
+                {
+                    // Ignore error, and attempt to continue.
+                    logger.LogError(ex, "Error encountered parsing interfaces.");
                 }
             }
-            catch (Exception ex)
+        }
+        catch (Exception ex)
+        {
+            logger.LogError(ex, "Error obtaining interfaces.");
+        }
+
+        // If no interfaces are found, fallback to loopback interfaces.
+        if (interfaces.Count == 0)
+        {
+            logger.LogWarning("No interface information available. Using loopback interface(s).");
+
+            if (isIPv4Enabled)
             {
-                _logger.LogError(ex, "Error obtaining interfaces.");
+                interfaces.Add(new IPData(IPAddress.Loopback, NetworkConstants.IPv4RFC5735Loopback, "lo"));
             }
 
-            // If no interfaces are found, fallback to loopback interfaces.
-            if (interfaces.Count == 0)
+            if (isIPv6Enabled)
             {
-                _logger.LogWarning("No interface information available. Using loopback interface(s).");
-
-                if (IsIPv4Enabled)
-                {
-                    interfaces.Add(new IPData(IPAddress.Loopback, NetworkConstants.IPv4RFC5735Loopback, "lo"));
-                }
-
-                if (IsIPv6Enabled)
-                {
-                    interfaces.Add(new IPData(IPAddress.IPv6Loopback, NetworkConstants.IPv6RFC4291Loopback, "lo"));
-                }
+                interfaces.Add(new IPData(IPAddress.IPv6Loopback, NetworkConstants.IPv6RFC4291Loopback, "lo"));
             }
-
-            _logger.LogDebug("Discovered {NumberOfInterfaces} interfaces.", interfaces.Count);
-            _logger.LogDebug("Interfaces addresses: {Addresses}", interfaces.OrderByDescending(s => s.AddressFamily == AddressFamily.InterNetwork).Select(s => s.Address.ToString()));
-
-            _macAddresses = macAddresses;
-            _interfaces = interfaces;
         }
+
+        logger.LogDebug("Discovered {NumberOfInterfaces} interfaces.", interfaces.Count);
+        logger.LogDebug("Interfaces addresses: {Addresses}", interfaces.OrderByDescending(s => s.AddressFamily == AddressFamily.InterNetwork).Select(s => s.Address.ToString()));
+        return interfaces;
     }
 
     /// <summary>
@@ -361,64 +357,76 @@ public class NetworkManager : INetworkManager, IDisposable
     {
         lock (_initLock)
         {
-            // Respect explicit bind addresses
-            var interfaces = _interfaces.ToList();
-            var localNetworkAddresses = config.LocalNetworkAddresses;
-            if (localNetworkAddresses.Length > 0 && !string.IsNullOrWhiteSpace(localNetworkAddresses[0]))
-            {
-                var bindAddresses = localNetworkAddresses.Select(p => NetworkUtils.TryParseToSubnet(p, out var network)
-                        ? network.Prefix
-                        : (interfaces.Where(x => x.Name.Equals(p, StringComparison.OrdinalIgnoreCase))
-                            .Select(x => x.Address)
-                            .FirstOrDefault() ?? IPAddress.None))
-                    .Where(x => x != IPAddress.None)
-                    .ToHashSet();
-                interfaces = interfaces.Where(x => bindAddresses.Contains(x.Address)).ToList();
-
-                if (bindAddresses.Contains(IPAddress.Loopback) && !interfaces.Any(i => i.Address.Equals(IPAddress.Loopback)))
-                {
-                    interfaces.Add(new IPData(IPAddress.Loopback, NetworkConstants.IPv4RFC5735Loopback, "lo"));
-                }
-
-                if (bindAddresses.Contains(IPAddress.IPv6Loopback) && !interfaces.Any(i => i.Address.Equals(IPAddress.IPv6Loopback)))
-                {
-                    interfaces.Add(new IPData(IPAddress.IPv6Loopback, NetworkConstants.IPv6RFC4291Loopback, "lo"));
-                }
-            }
+           _interfaces = FilterBindSettings(config, _interfaces, IsIPv4Enabled, IsIPv6Enabled).ToList();
+        }
+    }
 
-            // Remove all interfaces matching any virtual machine interface prefix
-            if (config.IgnoreVirtualInterfaces)
+    /// <summary>
+    /// Filteres a list of bind addresses and exclusions on available interfaces.
+    /// </summary>
+    /// <param name="config">The network config to be filtered by.</param>
+    /// <param name="interfaces">A list of possible interfaces to be filtered.</param>
+    /// <param name="isIPv4Enabled">If true evaluates IPV4 type ip addresses.</param>
+    /// <param name="isIPv6Enabled">If true evaluates IPV6 type ip addresses.</param>
+    /// <returns>A list of all locally known up addresses and submasks that are to be considered usable.</returns>
+    public static IReadOnlyList<IPData> FilterBindSettings(NetworkConfiguration config, IList<IPData> interfaces, bool isIPv4Enabled, bool isIPv6Enabled)
+    {
+        // Respect explicit bind addresses
+        var localNetworkAddresses = config.LocalNetworkAddresses;
+        if (localNetworkAddresses.Length > 0 && !string.IsNullOrWhiteSpace(localNetworkAddresses[0]))
+        {
+            var bindAddresses = localNetworkAddresses.Select(p => NetworkUtils.TryParseToSubnet(p, out var network)
+                    ? network.Prefix
+                    : (interfaces.Where(x => x.Name.Equals(p, StringComparison.OrdinalIgnoreCase))
+                        .Select(x => x.Address)
+                        .FirstOrDefault() ?? IPAddress.None))
+                .Where(x => x != IPAddress.None)
+                .ToHashSet();
+            interfaces = interfaces.Where(x => bindAddresses.Contains(x.Address)).ToList();
+
+            if (bindAddresses.Contains(IPAddress.Loopback) && !interfaces.Any(i => i.Address.Equals(IPAddress.Loopback)))
             {
-                // Remove potentially existing * and split config string into prefixes
-                var virtualInterfacePrefixes = config.VirtualInterfaceNames
-                    .Select(i => i.Replace("*", string.Empty, StringComparison.OrdinalIgnoreCase));
-
-                // Check all interfaces for matches against the prefixes and remove them
-                if (_interfaces.Count > 0)
-                {
-                    foreach (var virtualInterfacePrefix in virtualInterfacePrefixes)
-                    {
-                        interfaces.RemoveAll(x => x.Name.StartsWith(virtualInterfacePrefix, StringComparison.OrdinalIgnoreCase));
-                    }
-                }
+                interfaces.Add(new IPData(IPAddress.Loopback, NetworkConstants.IPv4RFC5735Loopback, "lo"));
             }
 
-            // Remove all IPv4 interfaces if IPv4 is disabled
-            if (!IsIPv4Enabled)
+            if (bindAddresses.Contains(IPAddress.IPv6Loopback) && !interfaces.Any(i => i.Address.Equals(IPAddress.IPv6Loopback)))
             {
-                interfaces.RemoveAll(x => x.AddressFamily == AddressFamily.InterNetwork);
+                interfaces.Add(new IPData(IPAddress.IPv6Loopback, NetworkConstants.IPv6RFC4291Loopback, "lo"));
             }
+        }
 
-            // Remove all IPv6 interfaces if IPv6 is disabled
-            if (!IsIPv6Enabled)
+        // Remove all interfaces matching any virtual machine interface prefix
+        if (config.IgnoreVirtualInterfaces)
+        {
+            // Remove potentially existing * and split config string into prefixes
+            var virtualInterfacePrefixes = config.VirtualInterfaceNames
+                .Select(i => i.Replace("*", string.Empty, StringComparison.OrdinalIgnoreCase));
+
+            // Check all interfaces for matches against the prefixes and remove them
+            if (interfaces.Count > 0)
             {
-                interfaces.RemoveAll(x => x.AddressFamily == AddressFamily.InterNetworkV6);
+                foreach (var virtualInterfacePrefix in virtualInterfacePrefixes)
+                {
+                    interfaces.RemoveAll(x => x.Name.StartsWith(virtualInterfacePrefix, StringComparison.OrdinalIgnoreCase));
+                }
             }
+        }
 
-            // Users may have complex networking configuration that multiple interfaces sharing the same IP address
-            // Only return one IP for binding, and let the OS handle the rest
-            _interfaces = interfaces.DistinctBy(iface => iface.Address).ToList();
+        // Remove all IPv4 interfaces if IPv4 is disabled
+        if (!isIPv4Enabled)
+        {
+            interfaces.RemoveAll(x => x.AddressFamily == AddressFamily.InterNetwork);
         }
+
+        // Remove all IPv6 interfaces if IPv6 is disabled
+        if (!isIPv6Enabled)
+        {
+            interfaces.RemoveAll(x => x.AddressFamily == AddressFamily.InterNetworkV6);
+        }
+
+        // Users may have complex networking configuration that multiple interfaces sharing the same IP address
+        // Only return one IP for binding, and let the OS handle the rest
+        return interfaces.DistinctBy(iface => iface.Address).ToList();
     }
 
     /// <summary>
@@ -682,40 +690,42 @@ public class NetworkManager : INetworkManager, IDisposable
     }
 
     /// <inheritdoc/>
-    public bool HasRemoteAccess(IPAddress remoteIP)
+    public RemoteAccessPolicyResult ShouldAllowServerAccess(IPAddress remoteIP)
     {
         var config = _configurationManager.GetNetworkConfiguration();
-        if (config.EnableRemoteAccess)
+        if (IsInLocalNetwork(remoteIP))
         {
-            // Comma separated list of IP addresses or IP/netmask entries for networks that will be allowed to connect remotely.
-            // If left blank, all remote addresses will be allowed.
-            if (_remoteAddressFilter.Any() && !_lanSubnets.Any(x => x.Contains(remoteIP)))
-            {
-                // remoteAddressFilter is a whitelist or blacklist.
-                var matches = _remoteAddressFilter.Count(remoteNetwork => remoteNetwork.Contains(remoteIP));
-                if ((!config.IsRemoteIPFilterBlacklist && matches > 0)
-                    || (config.IsRemoteIPFilterBlacklist && matches == 0))
-                {
-                    return true;
-                }
-
-                return false;
-            }
+            return RemoteAccessPolicyResult.Allow;
         }
-        else if (!IsInLocalNetwork(remoteIP))
+
+        if (!config.EnableRemoteAccess)
         {
             // Remote not enabled. So everyone should be LAN.
-            return false;
+            return RemoteAccessPolicyResult.RejectDueToRemoteAccessDisabled;
         }
 
-        return true;
-    }
+        if (!_remoteAddressFilter.Any())
+        {
+            // No filter on remote addresses, allow any of them.
+            return RemoteAccessPolicyResult.Allow;
+        }
 
-    /// <inheritdoc/>
-    public IReadOnlyList<PhysicalAddress> GetMacAddresses()
-    {
-        // Populated in construction - so always has values.
-        return _macAddresses;
+        // Comma separated list of IP addresses or IP/netmask entries for networks that will be allowed to connect remotely.
+        // If left blank, all remote addresses will be allowed.
+
+        // remoteAddressFilter is a whitelist or blacklist.
+        var anyMatches = _remoteAddressFilter.Any(remoteNetwork => NetworkUtils.SubnetContainsAddress(remoteNetwork, remoteIP));
+        if (config.IsRemoteIPFilterBlacklist)
+        {
+            return anyMatches
+                ? RemoteAccessPolicyResult.RejectDueToIPBlocklist
+                : RemoteAccessPolicyResult.Allow;
+        }
+
+        // Allow-list
+        return anyMatches
+            ? RemoteAccessPolicyResult.Allow
+            : RemoteAccessPolicyResult.RejectDueToNotAllowlistedRemoteIP;
     }
 
     /// <inheritdoc/>
@@ -743,28 +753,47 @@ public class NetworkManager : INetworkManager, IDisposable
     /// <inheritdoc/>
     public IReadOnlyList<IPData> GetAllBindInterfaces(bool individualInterfaces = false)
     {
-        var config = _configurationManager.GetNetworkConfiguration();
+        return NetworkManager.GetAllBindInterfaces(individualInterfaces, _configurationManager, _interfaces, IsIPv4Enabled, IsIPv6Enabled);
+    }
+
+    /// <summary>
+    /// Reads the jellyfin configuration of the configuration manager and produces a list of interfaces that should be bound.
+    /// </summary>
+    /// <param name="individualInterfaces">Defines that only known interfaces should be used.</param>
+    /// <param name="configurationManager">The ConfigurationManager.</param>
+    /// <param name="knownInterfaces">The known interfaces that gets returned if possible or instructed.</param>
+    /// <param name="readIpv4">Include IPV4 type interfaces.</param>
+    /// <param name="readIpv6">Include IPV6 type interfaces.</param>
+    /// <returns>A list of ip address of which jellyfin should bind to.</returns>
+    public static IReadOnlyList<IPData> GetAllBindInterfaces(
+        bool individualInterfaces,
+        IConfigurationManager configurationManager,
+        IReadOnlyList<IPData> knownInterfaces,
+        bool readIpv4,
+        bool readIpv6)
+    {
+        var config = configurationManager.GetNetworkConfiguration();
         var localNetworkAddresses = config.LocalNetworkAddresses;
-        if ((localNetworkAddresses.Length > 0 && !string.IsNullOrWhiteSpace(localNetworkAddresses[0]) && _interfaces.Count > 0) || individualInterfaces)
+        if ((localNetworkAddresses.Length > 0 && !string.IsNullOrWhiteSpace(localNetworkAddresses[0]) && knownInterfaces.Count > 0) || individualInterfaces)
         {
-            return _interfaces;
+            return knownInterfaces;
         }
 
         // No bind address and no exclusions, so listen on all interfaces.
         var result = new List<IPData>();
-        if (IsIPv4Enabled && IsIPv6Enabled)
+        if (readIpv4 && readIpv6)
         {
             // Kestrel source code shows it uses Sockets.DualMode - so this also covers IPAddress.Any by default
             result.Add(new IPData(IPAddress.IPv6Any, NetworkConstants.IPv6Any));
         }
-        else if (IsIPv4Enabled)
+        else if (readIpv4)
         {
             result.Add(new IPData(IPAddress.Any, NetworkConstants.IPv4Any));
         }
-        else if (IsIPv6Enabled)
+        else if (readIpv6)
         {
             // Cannot use IPv6Any as Kestrel will bind to IPv4 addresses too.
-            foreach (var iface in _interfaces)
+            foreach (var iface in knownInterfaces)
             {
                 if (iface.AddressFamily == AddressFamily.InterNetworkV6)
                 {
@@ -816,7 +845,7 @@ public class NetworkManager : INetworkManager, IDisposable
                 _logger.LogWarning("IPv4 is disabled in Jellyfin, but enabled in the OS. This may affect how the interface is selected.");
             }
 
-            bool isExternal = !_lanSubnets.Any(network => network.Contains(source));
+            bool isExternal = !IsInLocalNetwork(source);
             _logger.LogDebug("Trying to get bind address for source {Source} - External: {IsExternal}", source, isExternal);
 
             if (!skipOverrides && MatchesPublishedServerUrl(source, isExternal, out result))
@@ -863,7 +892,7 @@ public class NetworkManager : INetworkManager, IDisposable
         // (For systems with multiple internal network cards, and multiple subnets)
         foreach (var intf in availableInterfaces)
         {
-            if (intf.Subnet.Contains(source))
+            if (NetworkUtils.SubnetContainsAddress(intf.Subnet, source))
             {
                 result = NetworkUtils.FormatIPString(intf.Address);
                 _logger.LogDebug("{Source}: Found interface with matching subnet, using it as bind address: {Result}", source, result);
@@ -891,21 +920,11 @@ public class NetworkManager : INetworkManager, IDisposable
     {
         if (NetworkUtils.TryParseToSubnet(address, out var subnet))
         {
-            return IPAddress.IsLoopback(subnet.Prefix) || (_lanSubnets.Any(x => x.Contains(subnet.Prefix)) && !_excludedSubnets.Any(x => x.Contains(subnet.Prefix)));
+            return IsInLocalNetwork(subnet.Prefix);
         }
 
-        if (NetworkUtils.TryParseHost(address, out var addresses, IsIPv4Enabled, IsIPv6Enabled))
-        {
-            foreach (var ept in addresses)
-            {
-                if (IPAddress.IsLoopback(ept) || (_lanSubnets.Any(x => x.Contains(ept)) && !_excludedSubnets.Any(x => x.Contains(ept))))
-                {
-                    return true;
-                }
-            }
-        }
-
-        return false;
+        return NetworkUtils.TryParseHost(address, out var addresses, IsIPv4Enabled, IsIPv6Enabled)
+               && addresses.Any(IsInLocalNetwork);
     }
 
     /// <summary>
@@ -940,6 +959,11 @@ public class NetworkManager : INetworkManager, IDisposable
         return CheckIfLanAndNotExcluded(address);
     }
 
+    /// <summary>
+    /// Check if the address is in the LAN and not excluded.
+    /// </summary>
+    /// <param name="address">The IP address to check. The caller should make sure this is not an IPv4MappedToIPv6 address.</param>
+    /// <returns>Boolean indicates whether the address is in LAN.</returns>
     private bool CheckIfLanAndNotExcluded(IPAddress address)
     {
         foreach (var lanSubnet in _lanSubnets)
@@ -979,7 +1003,7 @@ public class NetworkManager : INetworkManager, IDisposable
         {
             // Only use matching internal subnets
             // Prefer more specific (bigger subnet prefix) overrides
-            validPublishedServerUrls = _publishedServerUrls.Where(x => x.IsInternalOverride && x.Data.Subnet.Contains(source))
+            validPublishedServerUrls = _publishedServerUrls.Where(x => x.IsInternalOverride && NetworkUtils.SubnetContainsAddress(x.Data.Subnet, source))
                 .OrderByDescending(x => x.Data.Subnet.PrefixLength)
                 .ToList();
         }
@@ -987,7 +1011,7 @@ public class NetworkManager : INetworkManager, IDisposable
         {
             // Only use matching external subnets
             // Prefer more specific (bigger subnet prefix) overrides
-            validPublishedServerUrls = _publishedServerUrls.Where(x => x.IsExternalOverride && x.Data.Subnet.Contains(source))
+            validPublishedServerUrls = _publishedServerUrls.Where(x => x.IsExternalOverride && NetworkUtils.SubnetContainsAddress(x.Data.Subnet, source))
                 .OrderByDescending(x => x.Data.Subnet.PrefixLength)
                 .ToList();
         }
@@ -995,7 +1019,7 @@ public class NetworkManager : INetworkManager, IDisposable
         foreach (var data in validPublishedServerUrls)
         {
             // Get interface matching override subnet
-            var intf = _interfaces.OrderBy(x => x.Index).FirstOrDefault(x => data.Data.Subnet.Contains(x.Address));
+            var intf = _interfaces.OrderBy(x => x.Index).FirstOrDefault(x => NetworkUtils.SubnetContainsAddress(data.Data.Subnet, x.Address));
 
             if (intf?.Address is not null
                 || (data.Data.AddressFamily == AddressFamily.InterNetwork && data.Data.Address.Equals(IPAddress.Any))
@@ -1058,6 +1082,7 @@ public class NetworkManager : INetworkManager, IDisposable
         if (isInExternalSubnet)
         {
             var externalInterfaces = _interfaces.Where(x => !IsInLocalNetwork(x.Address))
+                .Where(x => !IsLinkLocalAddress(x.Address))
                 .OrderBy(x => x.Index)
                 .ToList();
             if (externalInterfaces.Count > 0)
@@ -1065,7 +1090,7 @@ public class NetworkManager : INetworkManager, IDisposable
                 // Check to see if any of the external bind interfaces are in the same subnet as the source.
                 // If none exists, this will select the first external interface if there is one.
                 bindAddress = externalInterfaces
-                    .OrderByDescending(x => x.Subnet.Contains(source))
+                    .OrderByDescending(x => NetworkUtils.SubnetContainsAddress(x.Subnet, source))
                     .ThenByDescending(x => x.Subnet.PrefixLength)
                     .ThenBy(x => x.Index)
                     .Select(x => x.Address)
@@ -1083,7 +1108,7 @@ public class NetworkManager : INetworkManager, IDisposable
             // Check to see if any of the internal bind interfaces are in the same subnet as the source.
             // If none exists, this will select the first internal interface if there is one.
             bindAddress = _interfaces.Where(x => IsInLocalNetwork(x.Address))
-                .OrderByDescending(x => x.Subnet.Contains(source))
+                .OrderByDescending(x => NetworkUtils.SubnetContainsAddress(x.Subnet, source))
                 .ThenByDescending(x => x.Subnet.PrefixLength)
                 .ThenBy(x => x.Index)
                 .Select(x => x.Address)
@@ -1127,7 +1152,7 @@ public class NetworkManager : INetworkManager, IDisposable
         // (For systems with multiple network cards and/or multiple subnets)
         foreach (var intf in extResult)
         {
-            if (intf.Subnet.Contains(source))
+            if (NetworkUtils.SubnetContainsAddress(intf.Subnet, source))
             {
                 result = NetworkUtils.FormatIPString(intf.Address);
                 _logger.LogDebug("{Source}: Found external interface with matching subnet, using it as bind address: {Result}", source, result);