src/resolve/resolved-conf.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2
   3 #include "alloc-util.h"
   4 #include "conf-parser.h"
   5 #include "def.h"
   6 #include "extract-word.h"
   7 #include "hexdecoct.h"
   8 #include "parse-util.h"
   9 #include "resolved-conf.h"
  10 #include "resolved-dnssd.h"
  11 #include "resolved-manager.h"
  12 #include "resolved-dns-search-domain.h"
  13 #include "resolved-dns-stub.h"
  14 #include "dns-domain.h"
  15 #include "socket-netlink.h"
  16 #include "specifier.h"
  17 #include "string-table.h"
  18 #include "string-util.h"
  19 #include "strv.h"
  20 #include "utf8.h"
  21
  22 DEFINE_CONFIG_PARSE_ENUM(config_parse_dns_stub_listener_mode, dns_stub_listener_mode, DnsStubListenerMode, "Failed to parse DNS stub listener mode setting");
  23
  24 static int manager_add_dns_server_by_string(Manager *m, DnsServerType type, const char *word) {
  25         _cleanup_free_ char *server_name = NULL;
  26         union in_addr_union address;
  27         int family, r, ifindex = 0;
  28         uint16_t port;
  29         DnsServer *s;
  30
  31         assert(m);
  32         assert(word);
  33
  34         r = in_addr_port_ifindex_name_from_string_auto(word, &family, &address, &port, &ifindex, &server_name);
  35         if (r < 0)
  36                 return r;
  37
  38         if (IN_SET(port, 53, 853))
  39                 port = 0;
  40
  41         /* Silently filter out 0.0.0.0 and 127.0.0.53 (our own stub DNS listener) */
  42         if (!dns_server_address_valid(family, &address))
  43                 return 0;
  44
  45         /* By default, the port number is determined with the transaction feature level.
  46          * See dns_transaction_port() and dns_server_port(). */
  47         if (IN_SET(port, 53, 853))
  48                 port = 0;
  49
  50         /* Filter out duplicates */
  51         s = dns_server_find(manager_get_first_dns_server(m, type), family, &address, port, ifindex, server_name);
  52         if (s) {
  53                 /*
  54                  * Drop the marker. This is used to find the servers
  55                  * that ceased to exist, see
  56                  * manager_mark_dns_servers() and
  57                  * manager_flush_marked_dns_servers().
  58                  */
  59                 dns_server_move_back_and_unmark(s);
  60                 return 0;
  61         }
  62
  63         return dns_server_new(m, NULL, type, NULL, family, &address, port, ifindex, server_name);
  64 }
  65
  66 int manager_parse_dns_server_string_and_warn(Manager *m, DnsServerType type, const char *string) {
  67         int r;
  68
  69         assert(m);
  70         assert(string);
  71
  72         for (;;) {
  73                 _cleanup_free_ char *word = NULL;
  74
  75                 r = extract_first_word(&string, &word, NULL, 0);
  76                 if (r < 0)
  77                         return r;
  78                 if (r == 0)
  79                         break;
  80
  81                 r = manager_add_dns_server_by_string(m, type, word);
  82                 if (r < 0)
  83                         log_warning_errno(r, "Failed to add DNS server address '%s', ignoring: %m", word);
  84         }
  85
  86         return 0;
  87 }
  88
  89 static int manager_add_search_domain_by_string(Manager *m, const char *domain) {
  90         DnsSearchDomain *d;
  91         bool route_only;
  92         int r;
  93
  94         assert(m);
  95         assert(domain);
  96
  97         route_only = *domain == '~';
  98         if (route_only)
  99                 domain++;
 100
 101         if (dns_name_is_root(domain) || streq(domain, "*")) {
 102                 route_only = true;
 103                 domain = ".";
 104         }
 105
 106         r = dns_search_domain_find(m->search_domains, domain, &d);
 107         if (r < 0)
 108                 return r;
 109         if (r > 0)
 110                 dns_search_domain_move_back_and_unmark(d);
 111         else {
 112                 r = dns_search_domain_new(m, &d, DNS_SEARCH_DOMAIN_SYSTEM, NULL, domain);
 113                 if (r < 0)
 114                         return r;
 115         }
 116
 117         d->route_only = route_only;
 118         return 0;
 119 }
 120
 121 int manager_parse_search_domains_and_warn(Manager *m, const char *string) {
 122         int r;
 123
 124         assert(m);
 125         assert(string);
 126
 127         for (;;) {
 128                 _cleanup_free_ char *word = NULL;
 129
 130                 r = extract_first_word(&string, &word, NULL, EXTRACT_UNQUOTE);
 131                 if (r < 0)
 132                         return r;
 133                 if (r == 0)
 134                         break;
 135
 136                 r = manager_add_search_domain_by_string(m, word);
 137                 if (r < 0)
 138                         log_warning_errno(r, "Failed to add search domain '%s', ignoring: %m", word);
 139         }
 140
 141         return 0;
 142 }
 143
 144 int config_parse_dns_servers(
 145                 const char *unit,
 146                 const char *filename,
 147                 unsigned line,
 148                 const char *section,
 149                 unsigned section_line,
 150                 const char *lvalue,
 151                 int ltype,
 152                 const char *rvalue,
 153                 void *data,
 154                 void *userdata) {
 155
 156         Manager *m = userdata;
 157         int r;
 158
 159         assert(filename);
 160         assert(lvalue);
 161         assert(rvalue);
 162         assert(m);
 163
 164         if (isempty(rvalue))
 165                 /* Empty assignment means clear the list */
 166                 dns_server_unlink_all(manager_get_first_dns_server(m, ltype));
 167         else {
 168                 /* Otherwise, add to the list */
 169                 r = manager_parse_dns_server_string_and_warn(m, ltype, rvalue);
 170                 if (r < 0) {
 171                         log_syntax(unit, LOG_ERR, filename, line, r, "Failed to parse DNS server string '%s'. Ignoring.", rvalue);
 172                         return 0;
 173                 }
 174         }
 175
 176         /* If we have a manual setting, then we stop reading
 177          * /etc/resolv.conf */
 178         if (ltype == DNS_SERVER_SYSTEM)
 179                 m->read_resolv_conf = false;
 180         if (ltype == DNS_SERVER_FALLBACK)
 181                 m->need_builtin_fallbacks = false;
 182
 183         return 0;
 184 }
 185
 186 int config_parse_search_domains(
 187                 const char *unit,
 188                 const char *filename,
 189                 unsigned line,
 190                 const char *section,
 191                 unsigned section_line,
 192                 const char *lvalue,
 193                 int ltype,
 194                 const char *rvalue,
 195                 void *data,
 196                 void *userdata) {
 197
 198         Manager *m = userdata;
 199         int r;
 200
 201         assert(filename);
 202         assert(lvalue);
 203         assert(rvalue);
 204         assert(m);
 205
 206         if (isempty(rvalue))
 207                 /* Empty assignment means clear the list */
 208                 dns_search_domain_unlink_all(m->search_domains);
 209         else {
 210                 /* Otherwise, add to the list */
 211                 r = manager_parse_search_domains_and_warn(m, rvalue);
 212                 if (r < 0) {
 213                         log_syntax(unit, LOG_ERR, filename, line, r, "Failed to parse search domains string '%s'. Ignoring.", rvalue);
 214                         return 0;
 215                 }
 216         }
 217
 218         /* If we have a manual setting, then we stop reading
 219          * /etc/resolv.conf */
 220         m->read_resolv_conf = false;
 221
 222         return 0;
 223 }
 224
 225 int config_parse_dnssd_service_name(const char *unit, const char *filename, unsigned line, const char *section, unsigned section_line, const char *lvalue, int ltype, const char *rvalue, void *data, void *userdata) {
 226         static const Specifier specifier_table[] = {
 227                 { 'm', specifier_machine_id,      NULL },
 228                 { 'b', specifier_boot_id,         NULL },
 229                 { 'H', specifier_host_name,       NULL },
 230                 { 'v', specifier_kernel_release,  NULL },
 231                 { 'a', specifier_architecture,    NULL },
 232                 { 'o', specifier_os_id,           NULL },
 233                 { 'w', specifier_os_version_id,   NULL },
 234                 { 'B', specifier_os_build_id,     NULL },
 235                 { 'W', specifier_os_variant_id,   NULL },
 236                 {}
 237         };
 238         DnssdService *s = userdata;
 239         _cleanup_free_ char *name = NULL;
 240         int r;
 241
 242         assert(filename);
 243         assert(lvalue);
 244         assert(rvalue);
 245         assert(s);
 246
 247         if (isempty(rvalue)) {
 248                 log_syntax(unit, LOG_ERR, filename, line, 0, "Service instance name can't be empty. Ignoring.");
 249                 return -EINVAL;
 250         }
 251
 252         r = free_and_strdup(&s->name_template, rvalue);
 253         if (r < 0)
 254                 return log_oom();
 255
 256         r = specifier_printf(s->name_template, specifier_table, NULL, &name);
 257         if (r < 0)
 258                 return log_debug_errno(r, "Failed to replace specifiers: %m");
 259
 260         if (!dns_service_name_is_valid(name)) {
 261                 log_syntax(unit, LOG_ERR, filename, line, 0, "Service instance name template renders to invalid name '%s'. Ignoring.", name);
 262                 return -EINVAL;
 263         }
 264
 265         return 0;
 266 }
 267
 268 int config_parse_dnssd_service_type(const char *unit, const char *filename, unsigned line, const char *section, unsigned section_line, const char *lvalue, int ltype, const char *rvalue, void *data, void *userdata) {
 269         DnssdService *s = userdata;
 270         int r;
 271
 272         assert(filename);
 273         assert(lvalue);
 274         assert(rvalue);
 275         assert(s);
 276
 277         if (isempty(rvalue)) {
 278                 log_syntax(unit, LOG_ERR, filename, line, 0, "Service type can't be empty. Ignoring.");
 279                 return -EINVAL;
 280         }
 281
 282         if (!dnssd_srv_type_is_valid(rvalue)) {
 283                 log_syntax(unit, LOG_ERR, filename, line, 0, "Service type is invalid. Ignoring.");
 284                 return -EINVAL;
 285         }
 286
 287         r = free_and_strdup(&s->type, rvalue);
 288         if (r < 0)
 289                 return log_oom();
 290
 291         return 0;
 292 }
 293
 294 int config_parse_dnssd_txt(const char *unit, const char *filename, unsigned line, const char *section, unsigned section_line, const char *lvalue, int ltype, const char *rvalue, void *data, void *userdata) {
 295         _cleanup_(dnssd_txtdata_freep) DnssdTxtData *txt_data = NULL;
 296         DnssdService *s = userdata;
 297         DnsTxtItem *last = NULL;
 298
 299         assert(filename);
 300         assert(lvalue);
 301         assert(rvalue);
 302         assert(s);
 303
 304         if (isempty(rvalue)) {
 305                 /* Flush out collected items */
 306                 s->txt_data_items = dnssd_txtdata_free_all(s->txt_data_items);
 307                 return 0;
 308         }
 309
 310         txt_data = new0(DnssdTxtData, 1);
 311         if (!txt_data)
 312                 return log_oom();
 313
 314         for (;;) {
 315                 _cleanup_free_ char *word = NULL;
 316                 _cleanup_free_ char *key = NULL;
 317                 _cleanup_free_ char *value = NULL;
 318                 _cleanup_free_ void *decoded = NULL;
 319                 size_t length = 0;
 320                 DnsTxtItem *i;
 321                 int r;
 322
 323                 r = extract_first_word(&rvalue, &word, NULL,
 324                                        EXTRACT_UNQUOTE|EXTRACT_CUNESCAPE|EXTRACT_CUNESCAPE_RELAX);
 325                 if (r == 0)
 326                         break;
 327                 if (r == -ENOMEM)
 328                         return log_oom();
 329                 if (r < 0)
 330                         return log_syntax(unit, LOG_ERR, filename, line, r, "Invalid syntax, ignoring: %s", rvalue);
 331
 332                 r = split_pair(word, "=", &key, &value);
 333                 if (r == -ENOMEM)
 334                         return log_oom();
 335                 if (r == -EINVAL)
 336                         key = TAKE_PTR(word);
 337
 338                 if (!ascii_is_valid(key)) {
 339                         log_syntax(unit, LOG_ERR, filename, line, 0, "Invalid syntax, ignoring: %s", key);
 340                         return -EINVAL;
 341                 }
 342
 343                 switch (ltype) {
 344
 345                 case DNS_TXT_ITEM_DATA:
 346                         if (value) {
 347                                 r = unbase64mem(value, strlen(value), &decoded, &length);
 348                                 if (r == -ENOMEM)
 349                                         return log_oom();
 350                                 if (r < 0)
 351                                         return log_syntax(unit, LOG_ERR, filename, line, r,
 352                                                           "Invalid base64 encoding, ignoring: %s", value);
 353                         }
 354
 355                         r = dnssd_txt_item_new_from_data(key, decoded, length, &i);
 356                         if (r < 0)
 357                                 return log_oom();
 358                         break;
 359
 360                 case DNS_TXT_ITEM_TEXT:
 361                         r = dnssd_txt_item_new_from_string(key, value, &i);
 362                         if (r < 0)
 363                                 return log_oom();
 364                         break;
 365
 366                 default:
 367                         assert_not_reached("Unknown type of Txt config");
 368                 }
 369
 370                 LIST_INSERT_AFTER(items, txt_data->txt, last, i);
 371                 last = i;
 372         }
 373
 374         if (!LIST_IS_EMPTY(txt_data->txt)) {
 375                 LIST_PREPEND(items, s->txt_data_items, txt_data);
 376                 txt_data = NULL;
 377         }
 378
 379         return 0;
 380 }
 381
 382 int config_parse_dns_stub_listener_extra(
 383                 const char *unit,
 384                 const char *filename,
 385                 unsigned line,
 386                 const char *section,
 387                 unsigned section_line,
 388                 const char *lvalue,
 389                 int ltype,
 390                 const char *rvalue,
 391                 void *data,
 392                 void *userdata) {
 393
 394         _cleanup_free_ DnsStubListenerExtra *stub = NULL;
 395         Manager *m = userdata;
 396         const char *p;
 397         int r;
 398
 399         assert(filename);
 400         assert(lvalue);
 401         assert(rvalue);
 402         assert(data);
 403
 404         if (isempty(rvalue)) {
 405                 m->dns_extra_stub_listeners = ordered_set_free(m->dns_extra_stub_listeners);
 406                 return 0;
 407         }
 408
 409         r = dns_stub_listener_extra_new(m, &stub);
 410         if (r < 0)
 411                 return log_oom();
 412
 413         p = startswith(rvalue, "udp:");
 414         if (p)
 415                 stub->mode = DNS_STUB_LISTENER_UDP;
 416         else {
 417                 p = startswith(rvalue, "tcp:");
 418                 if (p)
 419                         stub->mode = DNS_STUB_LISTENER_TCP;
 420                 else {
 421                         stub->mode = DNS_STUB_LISTENER_YES;
 422                         p = rvalue;
 423                 }
 424         }
 425
 426         r = in_addr_port_from_string_auto(p, &stub->family, &stub->address, &stub->port);
 427         if (r < 0) {
 428                 log_syntax(unit, LOG_WARNING, filename, line, r,
 429                            "Failed to parse address in %s=%s, ignoring assignment: %m",
 430                            lvalue, rvalue);
 431                 return 0;
 432         }
 433
 434         r = ordered_set_ensure_put(&m->dns_extra_stub_listeners, &dns_stub_listener_extra_hash_ops, stub);
 435         if (r == -ENOMEM)
 436                 return log_oom();
 437         if (r < 0) {
 438                 log_syntax(unit, LOG_WARNING, filename, line, r,
 439                            "Failed to store %s=%s, ignoring assignment: %m", lvalue, rvalue);
 440                 return 0;
 441         }
 442
 443         TAKE_PTR(stub);
 444
 445         return 0;
 446 }
 447
 448 int manager_parse_config_file(Manager *m) {
 449         int r;
 450
 451         assert(m);
 452
 453         r = config_parse_many_nulstr(
 454                         PKGSYSCONFDIR "/resolved.conf",
 455                         CONF_PATHS_NULSTR("systemd/resolved.conf.d"),
 456                         "Resolve\0",
 457                         config_item_perf_lookup, resolved_gperf_lookup,
 458                         CONFIG_PARSE_WARN,
 459                         m,
 460                         NULL);
 461         if (r < 0)
 462                 return r;
 463
 464         if (m->need_builtin_fallbacks) {
 465                 r = manager_parse_dns_server_string_and_warn(m, DNS_SERVER_FALLBACK, DNS_SERVERS);
 466                 if (r < 0)
 467                         return r;
 468         }
 469
 470 #if ! HAVE_GCRYPT
 471         if (m->dnssec_mode != DNSSEC_NO) {
 472                 log_warning("DNSSEC option cannot be enabled or set to allow-downgrade when systemd-resolved is built without gcrypt support. Turning off DNSSEC support.");
 473                 m->dnssec_mode = DNSSEC_NO;
 474         }
 475 #endif
 476
 477 #if ! ENABLE_DNS_OVER_TLS
 478         if (m->dns_over_tls_mode != DNS_OVER_TLS_NO) {
 479                 log_warning("DNS-over-TLS option cannot be enabled or set to opportunistic when systemd-resolved is built without DNS-over-TLS support. Turning off DNS-over-TLS support.");
 480                 m->dns_over_tls_mode = DNS_OVER_TLS_NO;
 481         }
 482 #endif
 483         return 0;
 484
 485 }