[thirdparty/systemd.git] / src / resolve / resolved-conf.c

/* SPDX-License-Identifier: LGPL-2.1-or-later */

#include "alloc-util.h"
#include "conf-parser.h"
#include "creds-util.h"
#include "dns-type.h"
#include "extract-word.h"
#include "ordered-set.h"
#include "proc-cmdline.h"
#include "resolved-conf.h"
#include "resolved-dns-search-domain.h"
#include "resolved-dns-server.h"
#include "resolved-dns-stub.h"
#include "resolved-manager.h"
#include "set.h"
#include "socket-netlink.h"
#include "string-util.h"

DEFINE_CONFIG_PARSE_ENUM(config_parse_dns_stub_listener_mode, dns_stub_listener_mode, DnsStubListenerMode);

int config_parse_dns_servers(
                const char *unit,
                const char *filename,
                unsigned line,
                const char *section,
                unsigned section_line,
                const char *lvalue,
                int ltype,
                const char *rvalue,
                void *data,
                void *userdata) {

        Manager *m = ASSERT_PTR(userdata);
        int r;

        assert(filename);
        assert(lvalue);
        assert(rvalue);

        if (isempty(rvalue))
                /* Empty assignment means clear the list */
                dns_server_unlink_all(manager_get_first_dns_server(m, ltype));
        else {
                /* Otherwise, add to the list */
                r = manager_parse_dns_server_string_and_warn(m, ltype, rvalue);
                if (r < 0) {
                        log_syntax(unit, LOG_WARNING, filename, line, r,
                                   "Failed to parse DNS server string '%s', ignoring.", rvalue);
                        return 0;
                }
        }

        /* If we have a manual setting, then we stop reading
         * /etc/resolv.conf */
        if (ltype == DNS_SERVER_SYSTEM)
                m->read_resolv_conf = false;
        if (ltype == DNS_SERVER_FALLBACK)
                m->need_builtin_fallbacks = false;

        return 0;
}

int config_parse_search_domains(
                const char *unit,
                const char *filename,
                unsigned line,
                const char *section,
                unsigned section_line,
                const char *lvalue,
                int ltype,
                const char *rvalue,
                void *data,
                void *userdata) {

        Manager *m = ASSERT_PTR(userdata);
        int r;

        assert(filename);
        assert(lvalue);
        assert(rvalue);

        if (isempty(rvalue))
                /* Empty assignment means clear the list */
                dns_search_domain_unlink_all(m->search_domains);
        else {
                /* Otherwise, add to the list */
                r = manager_parse_search_domains_and_warn(m, rvalue);
                if (r < 0) {
                        log_syntax(unit, LOG_WARNING, filename, line, r,
                                   "Failed to parse search domains string '%s', ignoring.", rvalue);
                        return 0;
                }
        }

        /* If we have a manual setting, then we stop reading
         * /etc/resolv.conf */
        m->read_resolv_conf = false;

        return 0;
}

int config_parse_dns_stub_listener_extra(
                const char *unit,
                const char *filename,
                unsigned line,
                const char *section,
                unsigned section_line,
                const char *lvalue,
                int ltype,
                const char *rvalue,
                void *data,
                void *userdata) {

        _cleanup_free_ DnsStubListenerExtra *stub = NULL;
        Manager *m = userdata;
        const char *p;
        int r;

        assert(filename);
        assert(lvalue);
        assert(rvalue);
        assert(data);

        if (isempty(rvalue)) {
                m->dns_extra_stub_listeners = ordered_set_free(m->dns_extra_stub_listeners);
                return 0;
        }

        r = dns_stub_listener_extra_new(m, &stub);
        if (r < 0)
                return log_oom();

        p = startswith(rvalue, "udp:");
        if (p)
                stub->mode = DNS_STUB_LISTENER_UDP;
        else {
                p = startswith(rvalue, "tcp:");
                if (p)
                        stub->mode = DNS_STUB_LISTENER_TCP;
                else {
                        stub->mode = DNS_STUB_LISTENER_YES;
                        p = rvalue;
                }
        }

        r = in_addr_port_ifindex_name_from_string_auto(p, &stub->family, &stub->address, &stub->port, NULL, NULL);
        if (r < 0) {
                log_syntax(unit, LOG_WARNING, filename, line, r,
                           "Failed to parse address in %s=%s, ignoring assignment: %m",
                           lvalue, rvalue);
                return 0;
        }

        r = ordered_set_ensure_put(&m->dns_extra_stub_listeners, &dns_stub_listener_extra_hash_ops, stub);
        if (r == -ENOMEM)
                return log_oom();
        if (r < 0) {
                log_syntax(unit, LOG_WARNING, filename, line, r,
                           "Failed to store %s=%s, ignoring assignment: %m", lvalue, rvalue);
                return 0;
        }

        TAKE_PTR(stub);

        return 0;
}

static void read_credentials(Manager *m) {
        _cleanup_free_ char *dns = NULL, *domains = NULL;
        int r;

        assert(m);

        /* Hmm, if we aren't supposed to read /etc/resolv.conf because the DNS settings were already
         * configured explicitly in our config file, we don't want to honour credentials either */
        if (!m->read_resolv_conf)
                return;

        r = read_credential_strings_many("network.dns", &dns,
                                         "network.search_domains", &domains);
        if (r < 0)
                log_warning_errno(r, "Failed to read credentials, ignoring: %m");

        if (dns) {
                r = manager_parse_dns_server_string_and_warn(m, DNS_SERVER_SYSTEM, dns);
                if (r < 0)
                        log_warning_errno(r, "Failed to parse credential network.dns '%s', ignoring.", dns);

                m->read_resolv_conf = false;
        }

        if (domains) {
                r = manager_parse_search_domains_and_warn(m, domains);
                if (r < 0)
                        log_warning_errno(r, "Failed to parse credential network.search_domains '%s', ignoring.", domains);

                m->read_resolv_conf = false;
        }
}

struct ProcCmdlineInfo {
        Manager *manager;

        /* If there's a setting configured via /proc/cmdline we want to reset the configured lists, but only
         * once, so that multiple nameserver= or domain= settings can be specified on the kernel command line
         * and will be combined. These booleans will be set once we erase the list once. */
        bool dns_server_unlinked;
        bool search_domain_unlinked;
};

static int proc_cmdline_callback(const char *key, const char *value, void *data) {
        struct ProcCmdlineInfo *info = ASSERT_PTR(data);
        int r;

        assert(key);
        assert(info->manager);

        /* The kernel command line option names are chosen to be compatible with what various tools already
         * interpret, for example dracut and SUSE Linux. */

        if (streq(key, "nameserver")) {

                if (proc_cmdline_value_missing(key, value))
                        return 0;

                if (!info->dns_server_unlinked) {
                        /* The kernel command line overrides any prior configuration */
                        dns_server_unlink_all(manager_get_first_dns_server(info->manager, DNS_SERVER_SYSTEM));
                        info->dns_server_unlinked = true;
                }

                r = manager_parse_dns_server_string_and_warn(info->manager, DNS_SERVER_SYSTEM, value);
                if (r < 0)
                        log_warning_errno(r, "Failed to parse DNS server string '%s', ignoring.", value);

                info->manager->read_resolv_conf = false;

        } else if (streq(key, "domain")) {

                if (proc_cmdline_value_missing(key, value))
                        return 0;

                if (!info->search_domain_unlinked) {
                        dns_search_domain_unlink_all(info->manager->search_domains);
                        info->search_domain_unlinked = true;
                }

                r = manager_parse_search_domains_and_warn(info->manager, value);
                if (r < 0)
                        log_warning_errno(r, "Failed to parse credential provided search domain string '%s', ignoring.", value);

                info->manager->read_resolv_conf = false;
        }

        return 0;
}

static void read_proc_cmdline(Manager *m) {
        int r;

        assert(m);

        r = proc_cmdline_parse(proc_cmdline_callback, &(struct ProcCmdlineInfo) { .manager = m }, 0);
        if (r < 0)
                log_warning_errno(r, "Failed to read kernel command line, ignoring: %m");
}

int manager_parse_config_file(Manager *m) {
        int r;

        assert(m);

        r = config_parse_standard_file_with_dropins(
                        "systemd/resolved.conf",
                        "Resolve\0",
                        config_item_perf_lookup, resolved_gperf_lookup,
                        CONFIG_PARSE_WARN,
                        /* userdata= */ m);
        if (r < 0)
                return r;

        read_credentials(m);   /* credentials are only used when nothing is explicitly configured … */
        read_proc_cmdline(m);  /* … but kernel command line overrides local configuration. */

        if (m->need_builtin_fallbacks) {
                r = manager_parse_dns_server_string_and_warn(m, DNS_SERVER_FALLBACK, DNS_SERVERS);
                if (r < 0)
                        return r;
        }

#if !HAVE_OPENSSL
        if (m->dnssec_mode != DNSSEC_NO) {
                log_warning("DNSSEC option cannot be enabled or set to allow-downgrade when systemd-resolved is built without openssl. Turning off DNSSEC support.");
                m->dnssec_mode = DNSSEC_NO;
        }
#endif

#if !ENABLE_DNS_OVER_TLS
        if (m->dns_over_tls_mode != DNS_OVER_TLS_NO) {
                log_warning("DNS-over-TLS option cannot be enabled or set to opportunistic when systemd-resolved is built without DNS-over-TLS support. Turning off DNS-over-TLS support.");
                m->dns_over_tls_mode = DNS_OVER_TLS_NO;
        }
#endif
        return 0;
}

int config_parse_record_types(
                const char *unit,
                const char *filename,
                unsigned line,
                const char *section,
                unsigned section_line,
                const char *lvalue,
                int ltype,
                const char *rvalue,
                void *data,
                void *userdata) {

        Set **types = ASSERT_PTR(data);
        int r;

        if (isempty(rvalue)) {
                *types = set_free(*types);
                return 1;
        }

        for (const char *p = rvalue;;) {
                _cleanup_free_ char *word = NULL;
                r = extract_first_word(&p, &word, NULL, 0);
                if (r < 0)
                        return log_syntax_parse_error(unit, filename, line, r, lvalue, rvalue);
                if (r == 0)
                        return 1;

                r = dns_type_from_string(word);
                if (r < 0) {
                        log_syntax(unit, LOG_WARNING, filename, line, r, "Invalid DNS record type, ignoring: %s", word);
                        continue;
                }

                r = set_ensure_put(types, NULL, INT_TO_PTR(r));
                if (r < 0)
                        return log_oom();
        }
}
Commit	Line	Data
	1	/* SPDX-License-Identifier: LGPL-2.1-or-later */
	2
	3	#include "alloc-util.h"
	4	#include "conf-parser.h"
	5	#include "creds-util.h"
	6	#include "dns-type.h"
	7	#include "extract-word.h"
	8	#include "ordered-set.h"
	9	#include "proc-cmdline.h"
	10	#include "resolved-conf.h"
	11	#include "resolved-dns-search-domain.h"
	12	#include "resolved-dns-server.h"
	13	#include "resolved-dns-stub.h"
	14	#include "resolved-manager.h"
	15	#include "set.h"
	16	#include "socket-netlink.h"
	17	#include "string-util.h"
	18
	19	DEFINE_CONFIG_PARSE_ENUM(config_parse_dns_stub_listener_mode, dns_stub_listener_mode, DnsStubListenerMode);
	20
	21	int config_parse_dns_servers(
	22	const char *unit,
	23	const char *filename,
	24	unsigned line,
	25	const char *section,
	26	unsigned section_line,
	27	const char *lvalue,
	28	int ltype,
	29	const char *rvalue,
	30	void *data,
	31	void *userdata) {
	32
	33	Manager *m = ASSERT_PTR(userdata);
	34	int r;
	35
	36	assert(filename);
	37	assert(lvalue);
	38	assert(rvalue);
	39
	40	if (isempty(rvalue))
	41	/* Empty assignment means clear the list */
	42	dns_server_unlink_all(manager_get_first_dns_server(m, ltype));
	43	else {
	44	/* Otherwise, add to the list */
	45	r = manager_parse_dns_server_string_and_warn(m, ltype, rvalue);
	46	if (r < 0) {
	47	log_syntax(unit, LOG_WARNING, filename, line, r,
	48	"Failed to parse DNS server string '%s', ignoring.", rvalue);
	49	return 0;
	50	}
	51	}
	52
	53	/* If we have a manual setting, then we stop reading
	54	* /etc/resolv.conf */
	55	if (ltype == DNS_SERVER_SYSTEM)
	56	m->read_resolv_conf = false;
	57	if (ltype == DNS_SERVER_FALLBACK)
	58	m->need_builtin_fallbacks = false;
	59
	60	return 0;
	61	}
	62
	63	int config_parse_search_domains(
	64	const char *unit,
	65	const char *filename,
	66	unsigned line,
	67	const char *section,
	68	unsigned section_line,
	69	const char *lvalue,
	70	int ltype,
	71	const char *rvalue,
	72	void *data,
	73	void *userdata) {
	74
	75	Manager *m = ASSERT_PTR(userdata);
	76	int r;
	77
	78	assert(filename);
	79	assert(lvalue);
	80	assert(rvalue);
	81
	82	if (isempty(rvalue))
	83	/* Empty assignment means clear the list */
	84	dns_search_domain_unlink_all(m->search_domains);
	85	else {
	86	/* Otherwise, add to the list */
	87	r = manager_parse_search_domains_and_warn(m, rvalue);
	88	if (r < 0) {
	89	log_syntax(unit, LOG_WARNING, filename, line, r,
	90	"Failed to parse search domains string '%s', ignoring.", rvalue);
	91	return 0;
	92	}
	93	}
	94
	95	/* If we have a manual setting, then we stop reading
	96	* /etc/resolv.conf */
	97	m->read_resolv_conf = false;
	98
	99	return 0;
	100	}
	101
	102	int config_parse_dns_stub_listener_extra(
	103	const char *unit,
	104	const char *filename,
	105	unsigned line,
	106	const char *section,
	107	unsigned section_line,
	108	const char *lvalue,
	109	int ltype,
	110	const char *rvalue,
	111	void *data,
	112	void *userdata) {
	113
	114	_cleanup_free_ DnsStubListenerExtra *stub = NULL;
	115	Manager *m = userdata;
	116	const char *p;
	117	int r;
	118
	119	assert(filename);
	120	assert(lvalue);
	121	assert(rvalue);
	122	assert(data);
	123
	124	if (isempty(rvalue)) {
	125	m->dns_extra_stub_listeners = ordered_set_free(m->dns_extra_stub_listeners);
	126	return 0;
	127	}
	128
	129	r = dns_stub_listener_extra_new(m, &stub);
	130	if (r < 0)
	131	return log_oom();
	132
	133	p = startswith(rvalue, "udp:");
	134	if (p)
	135	stub->mode = DNS_STUB_LISTENER_UDP;
	136	else {
	137	p = startswith(rvalue, "tcp:");
	138	if (p)
	139	stub->mode = DNS_STUB_LISTENER_TCP;
	140	else {
	141	stub->mode = DNS_STUB_LISTENER_YES;
	142	p = rvalue;
	143	}
	144	}
	145
	146	r = in_addr_port_ifindex_name_from_string_auto(p, &stub->family, &stub->address, &stub->port, NULL, NULL);
	147	if (r < 0) {
	148	log_syntax(unit, LOG_WARNING, filename, line, r,
	149	"Failed to parse address in %s=%s, ignoring assignment: %m",
	150	lvalue, rvalue);
	151	return 0;
	152	}
	153
	154	r = ordered_set_ensure_put(&m->dns_extra_stub_listeners, &dns_stub_listener_extra_hash_ops, stub);
	155	if (r == -ENOMEM)
	156	return log_oom();
	157	if (r < 0) {
	158	log_syntax(unit, LOG_WARNING, filename, line, r,
	159	"Failed to store %s=%s, ignoring assignment: %m", lvalue, rvalue);
	160	return 0;
	161	}
	162
	163	TAKE_PTR(stub);
	164
	165	return 0;
	166	}
	167
	168	static void read_credentials(Manager *m) {
	169	_cleanup_free_ char dns = NULL, domains = NULL;
	170	int r;
	171
	172	assert(m);
	173
	174	/* Hmm, if we aren't supposed to read /etc/resolv.conf because the DNS settings were already
	175	* configured explicitly in our config file, we don't want to honour credentials either */
	176	if (!m->read_resolv_conf)
	177	return;
	178
	179	r = read_credential_strings_many("network.dns", &dns,
	180	"network.search_domains", &domains);
	181	if (r < 0)
	182	log_warning_errno(r, "Failed to read credentials, ignoring: %m");
	183
	184	if (dns) {
	185	r = manager_parse_dns_server_string_and_warn(m, DNS_SERVER_SYSTEM, dns);
	186	if (r < 0)
	187	log_warning_errno(r, "Failed to parse credential network.dns '%s', ignoring.", dns);
	188
	189	m->read_resolv_conf = false;
	190	}
	191
	192	if (domains) {
	193	r = manager_parse_search_domains_and_warn(m, domains);
	194	if (r < 0)
	195	log_warning_errno(r, "Failed to parse credential network.search_domains '%s', ignoring.", domains);
	196
	197	m->read_resolv_conf = false;
	198	}
	199	}
	200
	201	struct ProcCmdlineInfo {
	202	Manager *manager;
	203
	204	/* If there's a setting configured via /proc/cmdline we want to reset the configured lists, but only
	205	* once, so that multiple nameserver= or domain= settings can be specified on the kernel command line
	206	* and will be combined. These booleans will be set once we erase the list once. */
	207	bool dns_server_unlinked;
	208	bool search_domain_unlinked;
	209	};
	210
	211	static int proc_cmdline_callback(const char key, const char value, void *data) {
	212	struct ProcCmdlineInfo *info = ASSERT_PTR(data);
	213	int r;
	214
	215	assert(key);
	216	assert(info->manager);
	217
	218	/* The kernel command line option names are chosen to be compatible with what various tools already
	219	* interpret, for example dracut and SUSE Linux. */
	220
	221	if (streq(key, "nameserver")) {
	222
	223	if (proc_cmdline_value_missing(key, value))
	224	return 0;
	225
	226	if (!info->dns_server_unlinked) {
	227	/* The kernel command line overrides any prior configuration */
	228	dns_server_unlink_all(manager_get_first_dns_server(info->manager, DNS_SERVER_SYSTEM));
	229	info->dns_server_unlinked = true;
	230	}
	231
	232	r = manager_parse_dns_server_string_and_warn(info->manager, DNS_SERVER_SYSTEM, value);
	233	if (r < 0)
	234	log_warning_errno(r, "Failed to parse DNS server string '%s', ignoring.", value);
	235
	236	info->manager->read_resolv_conf = false;
	237
	238	} else if (streq(key, "domain")) {
	239
	240	if (proc_cmdline_value_missing(key, value))
	241	return 0;
	242
	243	if (!info->search_domain_unlinked) {
	244	dns_search_domain_unlink_all(info->manager->search_domains);
	245	info->search_domain_unlinked = true;
	246	}
	247
	248	r = manager_parse_search_domains_and_warn(info->manager, value);
	249	if (r < 0)
	250	log_warning_errno(r, "Failed to parse credential provided search domain string '%s', ignoring.", value);
	251
	252	info->manager->read_resolv_conf = false;
	253	}
	254
	255	return 0;
	256	}
	257
	258	static void read_proc_cmdline(Manager *m) {
	259	int r;
	260
	261	assert(m);
	262
	263	r = proc_cmdline_parse(proc_cmdline_callback, &(struct ProcCmdlineInfo) { .manager = m }, 0);
	264	if (r < 0)
	265	log_warning_errno(r, "Failed to read kernel command line, ignoring: %m");
	266	}
	267
	268	int manager_parse_config_file(Manager *m) {
	269	int r;
	270
	271	assert(m);
	272
	273	r = config_parse_standard_file_with_dropins(
	274	"systemd/resolved.conf",
	275	"Resolve\0",
	276	config_item_perf_lookup, resolved_gperf_lookup,
	277	CONFIG_PARSE_WARN,
	278	/* userdata= */ m);
	279	if (r < 0)
	280	return r;
	281
	282	read_credentials(m); /* credentials are only used when nothing is explicitly configured … */
	283	read_proc_cmdline(m); /* … but kernel command line overrides local configuration. */
	284
	285	if (m->need_builtin_fallbacks) {
	286	r = manager_parse_dns_server_string_and_warn(m, DNS_SERVER_FALLBACK, DNS_SERVERS);
	287	if (r < 0)
	288	return r;
	289	}
	290
	291	#if !HAVE_OPENSSL
	292	if (m->dnssec_mode != DNSSEC_NO) {
	293	log_warning("DNSSEC option cannot be enabled or set to allow-downgrade when systemd-resolved is built without openssl. Turning off DNSSEC support.");
	294	m->dnssec_mode = DNSSEC_NO;
	295	}
	296	#endif
	297
	298	#if !ENABLE_DNS_OVER_TLS
	299	if (m->dns_over_tls_mode != DNS_OVER_TLS_NO) {
	300	log_warning("DNS-over-TLS option cannot be enabled or set to opportunistic when systemd-resolved is built without DNS-over-TLS support. Turning off DNS-over-TLS support.");
	301	m->dns_over_tls_mode = DNS_OVER_TLS_NO;
	302	}
	303	#endif
	304	return 0;
	305	}
	306
	307	int config_parse_record_types(
	308	const char *unit,
	309	const char *filename,
	310	unsigned line,
	311	const char *section,
	312	unsigned section_line,
	313	const char *lvalue,
	314	int ltype,
	315	const char *rvalue,
	316	void *data,
	317	void *userdata) {
	318
	319	Set **types = ASSERT_PTR(data);
	320	int r;
	321
	322	if (isempty(rvalue)) {
	323	types = set_free(types);
	324	return 1;
	325	}
	326
	327	for (const char *p = rvalue;;) {
	328	_cleanup_free_ char *word = NULL;
	329	r = extract_first_word(&p, &word, NULL, 0);
	330	if (r < 0)
	331	return log_syntax_parse_error(unit, filename, line, r, lvalue, rvalue);
	332	if (r == 0)
	333	return 1;
	334
	335	r = dns_type_from_string(word);
	336	if (r < 0) {
	337	log_syntax(unit, LOG_WARNING, filename, line, r, "Invalid DNS record type, ignoring: %s", word);
	338	continue;
	339	}
	340
	341	r = set_ensure_put(types, NULL, INT_TO_PTR(r));
	342	if (r < 0)
	343	return log_oom();
	344	}
	345	}