src/resolve/resolved-dns-stream.c

   1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
   2
   3 #include <netinet/tcp.h>
   4 #include <unistd.h>
   5
   6 #include "alloc-util.h"
   7 #include "fd-util.h"
   8 #include "io-util.h"
   9 #include "macro.h"
  10 #include "missing_network.h"
  11 #include "resolved-dns-stream.h"
  12 #include "resolved-manager.h"
  13
  14 #define DNS_STREAMS_MAX 128
  15
  16 #define DNS_QUERIES_PER_STREAM 32
  17
  18 static void dns_stream_stop(DnsStream *s) {
  19         assert(s);
  20
  21         s->io_event_source = sd_event_source_disable_unref(s->io_event_source);
  22         s->timeout_event_source = sd_event_source_disable_unref(s->timeout_event_source);
  23         s->fd = safe_close(s->fd);
  24
  25         /* Disconnect us from the server object if we are now not usable anymore */
  26         dns_stream_detach(s);
  27 }
  28
  29 static int dns_stream_update_io(DnsStream *s) {
  30         uint32_t f = 0;
  31
  32         assert(s);
  33
  34         if (s->write_packet && s->n_written < sizeof(s->write_size) + s->write_packet->size)
  35                 f |= EPOLLOUT;
  36         else if (!ordered_set_isempty(s->write_queue)) {
  37                 dns_packet_unref(s->write_packet);
  38                 s->write_packet = ordered_set_steal_first(s->write_queue);
  39                 s->write_size = htobe16(s->write_packet->size);
  40                 s->n_written = 0;
  41                 f |= EPOLLOUT;
  42         }
  43
  44         /* Let's read a packet if we haven't queued any yet. Except if we already hit a limit of parallel
  45          * queries for this connection. */
  46         if ((!s->read_packet || s->n_read < sizeof(s->read_size) + s->read_packet->size) &&
  47                 set_size(s->queries) < DNS_QUERIES_PER_STREAM)
  48                 f |= EPOLLIN;
  49
  50         s->requested_events = f;
  51
  52 #if ENABLE_DNS_OVER_TLS
  53         /* For handshake and clean closing purposes, TLS can override requested events */
  54         if (s->dnstls_events != 0)
  55                 f = s->dnstls_events;
  56 #endif
  57
  58         return sd_event_source_set_io_events(s->io_event_source, f);
  59 }
  60
  61 static int dns_stream_complete(DnsStream *s, int error) {
  62         _cleanup_(dns_stream_unrefp) _unused_ DnsStream *ref = dns_stream_ref(s); /* Protect stream while we process it */
  63
  64         assert(s);
  65         assert(error >= 0);
  66
  67         /* Error is > 0 when the connection failed for some reason in the network stack. It's == 0 if we sent
  68          * and received exactly one packet each (in the LLMNR client case). */
  69
  70 #if ENABLE_DNS_OVER_TLS
  71         if (s->encrypted) {
  72                 int r;
  73
  74                 r = dnstls_stream_shutdown(s, error);
  75                 if (r != -EAGAIN)
  76                         dns_stream_stop(s);
  77         } else
  78 #endif
  79                 dns_stream_stop(s);
  80
  81         dns_stream_detach(s);
  82
  83         if (s->complete)
  84                 s->complete(s, error);
  85         else /* the default action if no completion function is set is to close the stream */
  86                 dns_stream_unref(s);
  87
  88         return 0;
  89 }
  90
  91 static int dns_stream_identify(DnsStream *s) {
  92         CMSG_BUFFER_TYPE(CMSG_SPACE(MAXSIZE(struct in_pktinfo, struct in6_pktinfo))
  93                          + CMSG_SPACE(int) + /* for the TTL */
  94                          + EXTRA_CMSG_SPACE /* kernel appears to require extra space */) control;
  95         struct msghdr mh = {};
  96         struct cmsghdr *cmsg;
  97         socklen_t sl;
  98         int r;
  99
 100         assert(s);
 101
 102         if (s->identified)
 103                 return 0;
 104
 105         /* Query the local side */
 106         s->local_salen = sizeof(s->local);
 107         r = getsockname(s->fd, &s->local.sa, &s->local_salen);
 108         if (r < 0)
 109                 return -errno;
 110         if (s->local.sa.sa_family == AF_INET6 && s->ifindex <= 0)
 111                 s->ifindex = s->local.in6.sin6_scope_id;
 112
 113         /* Query the remote side */
 114         s->peer_salen = sizeof(s->peer);
 115         r = getpeername(s->fd, &s->peer.sa, &s->peer_salen);
 116         if (r < 0)
 117                 return -errno;
 118         if (s->peer.sa.sa_family == AF_INET6 && s->ifindex <= 0)
 119                 s->ifindex = s->peer.in6.sin6_scope_id;
 120
 121         /* Check consistency */
 122         assert(s->peer.sa.sa_family == s->local.sa.sa_family);
 123         assert(IN_SET(s->peer.sa.sa_family, AF_INET, AF_INET6));
 124
 125         /* Query connection meta information */
 126         sl = sizeof(control);
 127         if (s->peer.sa.sa_family == AF_INET) {
 128                 r = getsockopt(s->fd, IPPROTO_IP, IP_PKTOPTIONS, &control, &sl);
 129                 if (r < 0)
 130                         return -errno;
 131         } else if (s->peer.sa.sa_family == AF_INET6) {
 132
 133                 r = getsockopt(s->fd, IPPROTO_IPV6, IPV6_2292PKTOPTIONS, &control, &sl);
 134                 if (r < 0)
 135                         return -errno;
 136         } else
 137                 return -EAFNOSUPPORT;
 138
 139         mh.msg_control = &control;
 140         mh.msg_controllen = sl;
 141
 142         CMSG_FOREACH(cmsg, &mh) {
 143
 144                 if (cmsg->cmsg_level == IPPROTO_IPV6) {
 145                         assert(s->peer.sa.sa_family == AF_INET6);
 146
 147                         switch (cmsg->cmsg_type) {
 148
 149                         case IPV6_PKTINFO: {
 150                                 struct in6_pktinfo *i = (struct in6_pktinfo*) CMSG_DATA(cmsg);
 151
 152                                 if (s->ifindex <= 0)
 153                                         s->ifindex = i->ipi6_ifindex;
 154                                 break;
 155                         }
 156
 157                         case IPV6_HOPLIMIT:
 158                                 s->ttl = *(int *) CMSG_DATA(cmsg);
 159                                 break;
 160                         }
 161
 162                 } else if (cmsg->cmsg_level == IPPROTO_IP) {
 163                         assert(s->peer.sa.sa_family == AF_INET);
 164
 165                         switch (cmsg->cmsg_type) {
 166
 167                         case IP_PKTINFO: {
 168                                 struct in_pktinfo *i = (struct in_pktinfo*) CMSG_DATA(cmsg);
 169
 170                                 if (s->ifindex <= 0)
 171                                         s->ifindex = i->ipi_ifindex;
 172                                 break;
 173                         }
 174
 175                         case IP_TTL:
 176                                 s->ttl = *(int *) CMSG_DATA(cmsg);
 177                                 break;
 178                         }
 179                 }
 180         }
 181
 182         /* The Linux kernel sets the interface index to the loopback
 183          * device if the connection came from the local host since it
 184          * avoids the routing table in such a case. Let's unset the
 185          * interface index in such a case. */
 186         if (s->ifindex == LOOPBACK_IFINDEX)
 187                 s->ifindex = 0;
 188
 189         /* If we don't know the interface index still, we look for the
 190          * first local interface with a matching address. Yuck! */
 191         if (s->ifindex <= 0)
 192                 s->ifindex = manager_find_ifindex(s->manager, s->local.sa.sa_family, sockaddr_in_addr(&s->local.sa));
 193
 194         if (s->protocol == DNS_PROTOCOL_LLMNR && s->ifindex > 0) {
 195                 /* Make sure all packets for this connection are sent on the same interface */
 196                 r = socket_set_unicast_if(s->fd, s->local.sa.sa_family, s->ifindex);
 197                 if (r < 0)
 198                         log_debug_errno(errno, "Failed to invoke IP_UNICAST_IF/IPV6_UNICAST_IF: %m");
 199         }
 200
 201         s->identified = true;
 202
 203         return 0;
 204 }
 205
 206 ssize_t dns_stream_writev(DnsStream *s, const struct iovec *iov, size_t iovcnt, int flags) {
 207         ssize_t m;
 208
 209         assert(s);
 210         assert(iov);
 211
 212 #if ENABLE_DNS_OVER_TLS
 213         if (s->encrypted && !(flags & DNS_STREAM_WRITE_TLS_DATA))
 214                 return dnstls_stream_writev(s, iov, iovcnt);
 215 #endif
 216
 217         if (s->tfo_salen > 0) {
 218                 struct msghdr hdr = {
 219                         .msg_iov = (struct iovec*) iov,
 220                         .msg_iovlen = iovcnt,
 221                         .msg_name = &s->tfo_address.sa,
 222                         .msg_namelen = s->tfo_salen
 223                 };
 224
 225                 m = sendmsg(s->fd, &hdr, MSG_FASTOPEN);
 226                 if (m < 0) {
 227                         if (errno == EOPNOTSUPP) {
 228                                 s->tfo_salen = 0;
 229                                 if (connect(s->fd, &s->tfo_address.sa, s->tfo_salen) < 0)
 230                                         return -errno;
 231
 232                                 return -EAGAIN;
 233                         }
 234                         if (errno == EINPROGRESS)
 235                                 return -EAGAIN;
 236
 237                         return -errno;
 238                 } else
 239                         s->tfo_salen = 0; /* connection is made */
 240         } else {
 241                 m = writev(s->fd, iov, iovcnt);
 242                 if (m < 0)
 243                         return -errno;
 244         }
 245
 246         return m;
 247 }
 248
 249 static ssize_t dns_stream_read(DnsStream *s, void *buf, size_t count) {
 250         ssize_t ss;
 251
 252 #if ENABLE_DNS_OVER_TLS
 253         if (s->encrypted)
 254                 ss = dnstls_stream_read(s, buf, count);
 255         else
 256 #endif
 257         {
 258                 ss = read(s->fd, buf, count);
 259                 if (ss < 0)
 260                         return -errno;
 261         }
 262
 263         return ss;
 264 }
 265
 266 static int on_stream_timeout(sd_event_source *es, usec_t usec, void *userdata) {
 267         DnsStream *s = ASSERT_PTR(userdata);
 268
 269         return dns_stream_complete(s, ETIMEDOUT);
 270 }
 271
 272 static DnsPacket *dns_stream_take_read_packet(DnsStream *s) {
 273         assert(s);
 274
 275         /* Note, dns_stream_update() should be called after this is called. When this is called, the
 276          * stream may be already full and the EPOLLIN flag is dropped from the stream IO event source.
 277          * Even this makes a room to read in the stream, this does not call dns_stream_update(), hence
 278          * EPOLLIN flag is not set automatically. So, to read further packets from the stream,
 279          * dns_stream_update() must be called explicitly. Currently, this is only called from
 280          * on_stream_io(), and there dns_stream_update() is called. */
 281
 282         if (!s->read_packet)
 283                 return NULL;
 284
 285         if (s->n_read < sizeof(s->read_size))
 286                 return NULL;
 287
 288         if (s->n_read < sizeof(s->read_size) + be16toh(s->read_size))
 289                 return NULL;
 290
 291         s->n_read = 0;
 292         return TAKE_PTR(s->read_packet);
 293 }
 294
 295 static int on_stream_io(sd_event_source *es, int fd, uint32_t revents, void *userdata) {
 296         _cleanup_(dns_stream_unrefp) DnsStream *s = dns_stream_ref(userdata); /* Protect stream while we process it */
 297         bool progressed = false;
 298         int r;
 299
 300         assert(s);
 301
 302 #if ENABLE_DNS_OVER_TLS
 303         if (s->encrypted) {
 304                 r = dnstls_stream_on_io(s, revents);
 305                 if (r == DNSTLS_STREAM_CLOSED)
 306                         return 0;
 307                 if (r == -EAGAIN)
 308                         return dns_stream_update_io(s);
 309                 if (r < 0)
 310                         return dns_stream_complete(s, -r);
 311
 312                 r = dns_stream_update_io(s);
 313                 if (r < 0)
 314                         return r;
 315         }
 316 #endif
 317
 318         /* only identify after connecting */
 319         if (s->tfo_salen == 0) {
 320                 r = dns_stream_identify(s);
 321                 if (r < 0)
 322                         return dns_stream_complete(s, -r);
 323         }
 324
 325         if ((revents & EPOLLOUT) &&
 326             s->write_packet &&
 327             s->n_written < sizeof(s->write_size) + s->write_packet->size) {
 328
 329                 struct iovec iov[] = {
 330                         IOVEC_MAKE(&s->write_size, sizeof(s->write_size)),
 331                         IOVEC_MAKE(DNS_PACKET_DATA(s->write_packet), s->write_packet->size),
 332                 };
 333
 334                 IOVEC_INCREMENT(iov, ELEMENTSOF(iov), s->n_written);
 335
 336                 ssize_t ss = dns_stream_writev(s, iov, ELEMENTSOF(iov), 0);
 337                 if (ss < 0) {
 338                         if (!ERRNO_IS_TRANSIENT(ss))
 339                                 return dns_stream_complete(s, -ss);
 340                 } else {
 341                         progressed = true;
 342                         s->n_written += ss;
 343                 }
 344
 345                 /* Are we done? If so, disable the event source for EPOLLOUT */
 346                 if (s->n_written >= sizeof(s->write_size) + s->write_packet->size) {
 347                         r = dns_stream_update_io(s);
 348                         if (r < 0)
 349                                 return dns_stream_complete(s, -r);
 350                 }
 351         }
 352
 353         while ((revents & (EPOLLIN|EPOLLHUP|EPOLLRDHUP)) &&
 354                (!s->read_packet ||
 355                 s->n_read < sizeof(s->read_size) + s->read_packet->size)) {
 356
 357                 if (s->n_read < sizeof(s->read_size)) {
 358                         ssize_t ss;
 359
 360                         ss = dns_stream_read(s, (uint8_t*) &s->read_size + s->n_read, sizeof(s->read_size) - s->n_read);
 361                         if (ss < 0) {
 362                                 if (!ERRNO_IS_TRANSIENT(ss))
 363                                         return dns_stream_complete(s, -ss);
 364                                 break;
 365                         } else if (ss == 0)
 366                                 return dns_stream_complete(s, ECONNRESET);
 367                         else {
 368                                 progressed = true;
 369                                 s->n_read += ss;
 370                         }
 371                 }
 372
 373                 if (s->n_read >= sizeof(s->read_size)) {
 374
 375                         if (be16toh(s->read_size) < DNS_PACKET_HEADER_SIZE)
 376                                 return dns_stream_complete(s, EBADMSG);
 377
 378                         if (s->n_read < sizeof(s->read_size) + be16toh(s->read_size)) {
 379                                 ssize_t ss;
 380
 381                                 if (!s->read_packet) {
 382                                         r = dns_packet_new(&s->read_packet, s->protocol, be16toh(s->read_size), DNS_PACKET_SIZE_MAX);
 383                                         if (r < 0)
 384                                                 return dns_stream_complete(s, -r);
 385
 386                                         s->read_packet->size = be16toh(s->read_size);
 387                                         s->read_packet->ipproto = IPPROTO_TCP;
 388                                         s->read_packet->family = s->peer.sa.sa_family;
 389                                         s->read_packet->ttl = s->ttl;
 390                                         s->read_packet->ifindex = s->ifindex;
 391                                         s->read_packet->timestamp = now(CLOCK_BOOTTIME);
 392
 393                                         if (s->read_packet->family == AF_INET) {
 394                                                 s->read_packet->sender.in = s->peer.in.sin_addr;
 395                                                 s->read_packet->sender_port = be16toh(s->peer.in.sin_port);
 396                                                 s->read_packet->destination.in = s->local.in.sin_addr;
 397                                                 s->read_packet->destination_port = be16toh(s->local.in.sin_port);
 398                                         } else {
 399                                                 assert(s->read_packet->family == AF_INET6);
 400                                                 s->read_packet->sender.in6 = s->peer.in6.sin6_addr;
 401                                                 s->read_packet->sender_port = be16toh(s->peer.in6.sin6_port);
 402                                                 s->read_packet->destination.in6 = s->local.in6.sin6_addr;
 403                                                 s->read_packet->destination_port = be16toh(s->local.in6.sin6_port);
 404
 405                                                 if (s->read_packet->ifindex == 0)
 406                                                         s->read_packet->ifindex = s->peer.in6.sin6_scope_id;
 407                                                 if (s->read_packet->ifindex == 0)
 408                                                         s->read_packet->ifindex = s->local.in6.sin6_scope_id;
 409                                         }
 410                                 }
 411
 412                                 ss = dns_stream_read(s,
 413                                           (uint8_t*) DNS_PACKET_DATA(s->read_packet) + s->n_read - sizeof(s->read_size),
 414                                           sizeof(s->read_size) + be16toh(s->read_size) - s->n_read);
 415                                 if (ss < 0) {
 416                                         if (!ERRNO_IS_TRANSIENT(ss))
 417                                                 return dns_stream_complete(s, -ss);
 418                                         break;
 419                                 } else if (ss == 0)
 420                                         return dns_stream_complete(s, ECONNRESET);
 421                                 else
 422                                         s->n_read += ss;
 423                         }
 424
 425                         /* Are we done? If so, call the packet handler and re-enable EPOLLIN for the
 426                          * event source if necessary. */
 427                         _cleanup_(dns_packet_unrefp) DnsPacket *p = dns_stream_take_read_packet(s);
 428                         if (p) {
 429                                 assert(s->on_packet);
 430                                 r = s->on_packet(s, p);
 431                                 if (r < 0)
 432                                         return r;
 433
 434                                 r = dns_stream_update_io(s);
 435                                 if (r < 0)
 436                                         return dns_stream_complete(s, -r);
 437
 438                                 s->packet_received = true;
 439
 440                                 /* If we just disabled the read event, stop reading */
 441                                 if (!FLAGS_SET(s->requested_events, EPOLLIN))
 442                                         break;
 443                         }
 444                 }
 445         }
 446
 447         /* Complete the stream if finished reading and writing one packet, and there's nothing
 448          * else left to write. */
 449         if (s->type == DNS_STREAM_LLMNR_SEND && s->packet_received &&
 450             !FLAGS_SET(s->requested_events, EPOLLOUT))
 451                 return dns_stream_complete(s, 0);
 452
 453         /* If we did something, let's restart the timeout event source */
 454         if (progressed && s->timeout_event_source) {
 455                 r = sd_event_source_set_time_relative(s->timeout_event_source, DNS_STREAM_ESTABLISHED_TIMEOUT_USEC);
 456                 if (r < 0)
 457                         log_warning_errno(errno, "Couldn't restart TCP connection timeout, ignoring: %m");
 458         }
 459
 460         return 0;
 461 }
 462
 463 static DnsStream *dns_stream_free(DnsStream *s) {
 464         DnsPacket *p;
 465
 466         assert(s);
 467
 468         dns_stream_stop(s);
 469
 470         if (s->manager) {
 471                 LIST_REMOVE(streams, s->manager->dns_streams, s);
 472                 s->manager->n_dns_streams[s->type]--;
 473         }
 474
 475 #if ENABLE_DNS_OVER_TLS
 476         if (s->encrypted)
 477                 dnstls_stream_free(s);
 478 #endif
 479
 480         ORDERED_SET_FOREACH(p, s->write_queue)
 481                 dns_packet_unref(ordered_set_remove(s->write_queue, p));
 482
 483         dns_packet_unref(s->write_packet);
 484         dns_packet_unref(s->read_packet);
 485         dns_server_unref(s->server);
 486
 487         ordered_set_free(s->write_queue);
 488
 489         return mfree(s);
 490 }
 491
 492 DEFINE_TRIVIAL_REF_UNREF_FUNC(DnsStream, dns_stream, dns_stream_free);
 493
 494 int dns_stream_new(
 495                 Manager *m,
 496                 DnsStream **ret,
 497                 DnsStreamType type,
 498                 DnsProtocol protocol,
 499                 int fd,
 500                 const union sockaddr_union *tfo_address,
 501                 int (on_packet)(DnsStream*, DnsPacket*),
 502                 int (complete)(DnsStream*, int), /* optional */
 503                 usec_t connect_timeout_usec) {
 504
 505         _cleanup_(dns_stream_unrefp) DnsStream *s = NULL;
 506         int r;
 507
 508         assert(m);
 509         assert(ret);
 510         assert(type >= 0);
 511         assert(type < _DNS_STREAM_TYPE_MAX);
 512         assert(protocol >= 0);
 513         assert(protocol < _DNS_PROTOCOL_MAX);
 514         assert(fd >= 0);
 515         assert(on_packet);
 516
 517         if (m->n_dns_streams[type] > DNS_STREAMS_MAX)
 518                 return -EBUSY;
 519
 520         s = new(DnsStream, 1);
 521         if (!s)
 522                 return -ENOMEM;
 523
 524         *s = (DnsStream) {
 525                 .n_ref = 1,
 526                 .fd = -1,
 527                 .protocol = protocol,
 528                 .type = type,
 529         };
 530
 531         r = ordered_set_ensure_allocated(&s->write_queue, &dns_packet_hash_ops);
 532         if (r < 0)
 533                 return r;
 534
 535         r = sd_event_add_io(m->event, &s->io_event_source, fd, EPOLLIN, on_stream_io, s);
 536         if (r < 0)
 537                 return r;
 538
 539         (void) sd_event_source_set_description(s->io_event_source, "dns-stream-io");
 540
 541         r = sd_event_add_time_relative(
 542                         m->event,
 543                         &s->timeout_event_source,
 544                         CLOCK_BOOTTIME,
 545                         connect_timeout_usec, 0,
 546                         on_stream_timeout, s);
 547         if (r < 0)
 548                 return r;
 549
 550         (void) sd_event_source_set_description(s->timeout_event_source, "dns-stream-timeout");
 551
 552         LIST_PREPEND(streams, m->dns_streams, s);
 553         m->n_dns_streams[type]++;
 554         s->manager = m;
 555
 556         s->fd = fd;
 557         s->on_packet = on_packet;
 558         s->complete = complete;
 559
 560         if (tfo_address) {
 561                 s->tfo_address = *tfo_address;
 562                 s->tfo_salen = tfo_address->sa.sa_family == AF_INET6 ? sizeof(tfo_address->in6) : sizeof(tfo_address->in);
 563         }
 564
 565         *ret = TAKE_PTR(s);
 566
 567         return 0;
 568 }
 569
 570 int dns_stream_write_packet(DnsStream *s, DnsPacket *p) {
 571         int r;
 572
 573         assert(s);
 574         assert(p);
 575
 576         r = ordered_set_put(s->write_queue, p);
 577         if (r < 0)
 578                 return r;
 579
 580         dns_packet_ref(p);
 581
 582         return dns_stream_update_io(s);
 583 }
 584
 585 void dns_stream_detach(DnsStream *s) {
 586         assert(s);
 587
 588         if (!s->server)
 589                 return;
 590
 591         if (s->server->stream != s)
 592                 return;
 593
 594         dns_server_unref_stream(s->server);
 595 }