1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
3 #include <netinet/tcp.h>
6 #include "alloc-util.h"
8 #include "iovec-util.h"
10 #include "missing_network.h"
11 #include "resolved-dns-stream.h"
12 #include "resolved-manager.h"
14 #define DNS_STREAMS_MAX 128
16 #define DNS_QUERIES_PER_STREAM 32
18 static void dns_stream_stop(DnsStream
*s
) {
21 s
->io_event_source
= sd_event_source_disable_unref(s
->io_event_source
);
22 s
->timeout_event_source
= sd_event_source_disable_unref(s
->timeout_event_source
);
23 s
->fd
= safe_close(s
->fd
);
25 /* Disconnect us from the server object if we are now not usable anymore */
29 static int dns_stream_update_io(DnsStream
*s
) {
34 if (s
->write_packet
&& s
->n_written
< sizeof(s
->write_size
) + s
->write_packet
->size
)
36 else if (!ordered_set_isempty(s
->write_queue
)) {
37 dns_packet_unref(s
->write_packet
);
38 s
->write_packet
= ordered_set_steal_first(s
->write_queue
);
39 s
->write_size
= htobe16(s
->write_packet
->size
);
44 /* Let's read a packet if we haven't queued any yet. Except if we already hit a limit of parallel
45 * queries for this connection. */
46 if ((!s
->read_packet
|| s
->n_read
< sizeof(s
->read_size
) + s
->read_packet
->size
) &&
47 set_size(s
->queries
) < DNS_QUERIES_PER_STREAM
)
50 s
->requested_events
= f
;
52 #if ENABLE_DNS_OVER_TLS
53 /* For handshake and clean closing purposes, TLS can override requested events */
54 if (s
->dnstls_events
!= 0)
58 return sd_event_source_set_io_events(s
->io_event_source
, f
);
61 static int dns_stream_complete(DnsStream
*s
, int error
) {
62 _cleanup_(dns_stream_unrefp
) _unused_ DnsStream
*ref
= dns_stream_ref(s
); /* Protect stream while we process it */
67 /* Error is > 0 when the connection failed for some reason in the network stack. It's == 0 if we sent
68 * and received exactly one packet each (in the LLMNR client case). */
70 #if ENABLE_DNS_OVER_TLS
74 r
= dnstls_stream_shutdown(s
, error
);
84 s
->complete(s
, error
);
85 else /* the default action if no completion function is set is to close the stream */
91 static int dns_stream_identify(DnsStream
*s
) {
92 CMSG_BUFFER_TYPE(CMSG_SPACE(MAXSIZE(struct in_pktinfo
, struct in6_pktinfo
))
93 + CMSG_SPACE(int) + /* for the TTL */
94 + EXTRA_CMSG_SPACE
/* kernel appears to require extra space */) control
;
95 struct msghdr mh
= {};
105 /* Query the local side */
106 s
->local_salen
= sizeof(s
->local
);
107 r
= getsockname(s
->fd
, &s
->local
.sa
, &s
->local_salen
);
110 if (s
->local
.sa
.sa_family
== AF_INET6
&& s
->ifindex
<= 0)
111 s
->ifindex
= s
->local
.in6
.sin6_scope_id
;
113 /* Query the remote side */
114 s
->peer_salen
= sizeof(s
->peer
);
115 r
= getpeername(s
->fd
, &s
->peer
.sa
, &s
->peer_salen
);
118 if (s
->peer
.sa
.sa_family
== AF_INET6
&& s
->ifindex
<= 0)
119 s
->ifindex
= s
->peer
.in6
.sin6_scope_id
;
121 /* Check consistency */
122 assert(s
->peer
.sa
.sa_family
== s
->local
.sa
.sa_family
);
123 assert(IN_SET(s
->peer
.sa
.sa_family
, AF_INET
, AF_INET6
));
125 /* Query connection meta information */
126 sl
= sizeof(control
);
127 if (s
->peer
.sa
.sa_family
== AF_INET
) {
128 r
= getsockopt(s
->fd
, IPPROTO_IP
, IP_PKTOPTIONS
, &control
, &sl
);
131 } else if (s
->peer
.sa
.sa_family
== AF_INET6
) {
133 r
= getsockopt(s
->fd
, IPPROTO_IPV6
, IPV6_2292PKTOPTIONS
, &control
, &sl
);
137 return -EAFNOSUPPORT
;
139 mh
.msg_control
= &control
;
140 mh
.msg_controllen
= sl
;
142 CMSG_FOREACH(cmsg
, &mh
) {
144 if (cmsg
->cmsg_level
== IPPROTO_IPV6
) {
145 assert(s
->peer
.sa
.sa_family
== AF_INET6
);
147 switch (cmsg
->cmsg_type
) {
150 struct in6_pktinfo
*i
= CMSG_TYPED_DATA(cmsg
, struct in6_pktinfo
);
153 s
->ifindex
= i
->ipi6_ifindex
;
158 s
->ttl
= *CMSG_TYPED_DATA(cmsg
, int);
162 } else if (cmsg
->cmsg_level
== IPPROTO_IP
) {
163 assert(s
->peer
.sa
.sa_family
== AF_INET
);
165 switch (cmsg
->cmsg_type
) {
168 struct in_pktinfo
*i
= CMSG_TYPED_DATA(cmsg
, struct in_pktinfo
);
171 s
->ifindex
= i
->ipi_ifindex
;
176 s
->ttl
= *CMSG_TYPED_DATA(cmsg
, int);
182 /* The Linux kernel sets the interface index to the loopback
183 * device if the connection came from the local host since it
184 * avoids the routing table in such a case. Let's unset the
185 * interface index in such a case. */
186 if (s
->ifindex
== LOOPBACK_IFINDEX
)
189 /* If we don't know the interface index still, we look for the
190 * first local interface with a matching address. Yuck! */
192 s
->ifindex
= manager_find_ifindex(s
->manager
, s
->local
.sa
.sa_family
, sockaddr_in_addr(&s
->local
.sa
));
194 if (s
->protocol
== DNS_PROTOCOL_LLMNR
&& s
->ifindex
> 0) {
195 /* Make sure all packets for this connection are sent on the same interface */
196 r
= socket_set_unicast_if(s
->fd
, s
->local
.sa
.sa_family
, s
->ifindex
);
198 log_debug_errno(errno
, "Failed to invoke IP_UNICAST_IF/IPV6_UNICAST_IF: %m");
201 s
->identified
= true;
206 ssize_t
dns_stream_writev(DnsStream
*s
, const struct iovec
*iov
, size_t iovcnt
, int flags
) {
212 #if ENABLE_DNS_OVER_TLS
213 if (s
->encrypted
&& !(flags
& DNS_STREAM_WRITE_TLS_DATA
))
214 return dnstls_stream_writev(s
, iov
, iovcnt
);
217 if (s
->tfo_salen
> 0) {
218 struct msghdr hdr
= {
219 .msg_iov
= (struct iovec
*) iov
,
220 .msg_iovlen
= iovcnt
,
221 .msg_name
= &s
->tfo_address
.sa
,
222 .msg_namelen
= s
->tfo_salen
225 m
= sendmsg(s
->fd
, &hdr
, MSG_FASTOPEN
);
227 if (errno
== EOPNOTSUPP
) {
229 if (connect(s
->fd
, &s
->tfo_address
.sa
, s
->tfo_salen
) < 0)
234 if (errno
== EINPROGRESS
)
239 s
->tfo_salen
= 0; /* connection is made */
241 m
= writev(s
->fd
, iov
, iovcnt
);
249 static ssize_t
dns_stream_read(DnsStream
*s
, void *buf
, size_t count
) {
252 #if ENABLE_DNS_OVER_TLS
254 ss
= dnstls_stream_read(s
, buf
, count
);
258 ss
= read(s
->fd
, buf
, count
);
266 static int on_stream_timeout(sd_event_source
*es
, usec_t usec
, void *userdata
) {
267 DnsStream
*s
= ASSERT_PTR(userdata
);
269 return dns_stream_complete(s
, ETIMEDOUT
);
272 static DnsPacket
*dns_stream_take_read_packet(DnsStream
*s
) {
275 /* Note, dns_stream_update() should be called after this is called. When this is called, the
276 * stream may be already full and the EPOLLIN flag is dropped from the stream IO event source.
277 * Even this makes a room to read in the stream, this does not call dns_stream_update(), hence
278 * EPOLLIN flag is not set automatically. So, to read further packets from the stream,
279 * dns_stream_update() must be called explicitly. Currently, this is only called from
280 * on_stream_io(), and there dns_stream_update() is called. */
285 if (s
->n_read
< sizeof(s
->read_size
))
288 if (s
->n_read
< sizeof(s
->read_size
) + be16toh(s
->read_size
))
292 return TAKE_PTR(s
->read_packet
);
295 static int on_stream_io(sd_event_source
*es
, int fd
, uint32_t revents
, void *userdata
) {
296 _cleanup_(dns_stream_unrefp
) DnsStream
*s
= dns_stream_ref(userdata
); /* Protect stream while we process it */
297 bool progressed
= false;
302 #if ENABLE_DNS_OVER_TLS
304 r
= dnstls_stream_on_io(s
, revents
);
305 if (r
== DNSTLS_STREAM_CLOSED
)
308 return dns_stream_update_io(s
);
310 return dns_stream_complete(s
, -r
);
312 r
= dns_stream_update_io(s
);
318 /* only identify after connecting */
319 if (s
->tfo_salen
== 0) {
320 r
= dns_stream_identify(s
);
322 return dns_stream_complete(s
, -r
);
325 if ((revents
& EPOLLOUT
) &&
327 s
->n_written
< sizeof(s
->write_size
) + s
->write_packet
->size
) {
329 struct iovec iov
[] = {
330 IOVEC_MAKE(&s
->write_size
, sizeof(s
->write_size
)),
331 IOVEC_MAKE(DNS_PACKET_DATA(s
->write_packet
), s
->write_packet
->size
),
334 iovec_increment(iov
, ELEMENTSOF(iov
), s
->n_written
);
336 ssize_t ss
= dns_stream_writev(s
, iov
, ELEMENTSOF(iov
), 0);
338 if (!ERRNO_IS_TRANSIENT(ss
))
339 return dns_stream_complete(s
, -ss
);
345 /* Are we done? If so, disable the event source for EPOLLOUT */
346 if (s
->n_written
>= sizeof(s
->write_size
) + s
->write_packet
->size
) {
347 r
= dns_stream_update_io(s
);
349 return dns_stream_complete(s
, -r
);
353 while ((revents
& (EPOLLIN
|EPOLLHUP
|EPOLLRDHUP
)) &&
355 s
->n_read
< sizeof(s
->read_size
) + s
->read_packet
->size
)) {
357 if (s
->n_read
< sizeof(s
->read_size
)) {
360 ss
= dns_stream_read(s
, (uint8_t*) &s
->read_size
+ s
->n_read
, sizeof(s
->read_size
) - s
->n_read
);
362 if (!ERRNO_IS_TRANSIENT(ss
))
363 return dns_stream_complete(s
, -ss
);
366 return dns_stream_complete(s
, ECONNRESET
);
373 if (s
->n_read
>= sizeof(s
->read_size
)) {
375 if (be16toh(s
->read_size
) < DNS_PACKET_HEADER_SIZE
)
376 return dns_stream_complete(s
, EBADMSG
);
378 if (s
->n_read
< sizeof(s
->read_size
) + be16toh(s
->read_size
)) {
381 if (!s
->read_packet
) {
382 r
= dns_packet_new(&s
->read_packet
, s
->protocol
, be16toh(s
->read_size
), DNS_PACKET_SIZE_MAX
);
384 return dns_stream_complete(s
, -r
);
386 s
->read_packet
->size
= be16toh(s
->read_size
);
387 s
->read_packet
->ipproto
= IPPROTO_TCP
;
388 s
->read_packet
->family
= s
->peer
.sa
.sa_family
;
389 s
->read_packet
->ttl
= s
->ttl
;
390 s
->read_packet
->ifindex
= s
->ifindex
;
391 s
->read_packet
->timestamp
= now(CLOCK_BOOTTIME
);
393 if (s
->read_packet
->family
== AF_INET
) {
394 s
->read_packet
->sender
.in
= s
->peer
.in
.sin_addr
;
395 s
->read_packet
->sender_port
= be16toh(s
->peer
.in
.sin_port
);
396 s
->read_packet
->destination
.in
= s
->local
.in
.sin_addr
;
397 s
->read_packet
->destination_port
= be16toh(s
->local
.in
.sin_port
);
399 assert(s
->read_packet
->family
== AF_INET6
);
400 s
->read_packet
->sender
.in6
= s
->peer
.in6
.sin6_addr
;
401 s
->read_packet
->sender_port
= be16toh(s
->peer
.in6
.sin6_port
);
402 s
->read_packet
->destination
.in6
= s
->local
.in6
.sin6_addr
;
403 s
->read_packet
->destination_port
= be16toh(s
->local
.in6
.sin6_port
);
405 if (s
->read_packet
->ifindex
== 0)
406 s
->read_packet
->ifindex
= s
->peer
.in6
.sin6_scope_id
;
407 if (s
->read_packet
->ifindex
== 0)
408 s
->read_packet
->ifindex
= s
->local
.in6
.sin6_scope_id
;
412 ss
= dns_stream_read(s
,
413 (uint8_t*) DNS_PACKET_DATA(s
->read_packet
) + s
->n_read
- sizeof(s
->read_size
),
414 sizeof(s
->read_size
) + be16toh(s
->read_size
) - s
->n_read
);
416 if (!ERRNO_IS_TRANSIENT(ss
))
417 return dns_stream_complete(s
, -ss
);
420 return dns_stream_complete(s
, ECONNRESET
);
425 /* Are we done? If so, call the packet handler and re-enable EPOLLIN for the
426 * event source if necessary. */
427 _cleanup_(dns_packet_unrefp
) DnsPacket
*p
= dns_stream_take_read_packet(s
);
429 assert(s
->on_packet
);
430 r
= s
->on_packet(s
, p
);
434 r
= dns_stream_update_io(s
);
436 return dns_stream_complete(s
, -r
);
438 s
->packet_received
= true;
440 /* If we just disabled the read event, stop reading */
441 if (!FLAGS_SET(s
->requested_events
, EPOLLIN
))
447 /* Complete the stream if finished reading and writing one packet, and there's nothing
448 * else left to write. */
449 if (s
->type
== DNS_STREAM_LLMNR_SEND
&& s
->packet_received
&&
450 !FLAGS_SET(s
->requested_events
, EPOLLOUT
))
451 return dns_stream_complete(s
, 0);
453 /* If we did something, let's restart the timeout event source */
454 if (progressed
&& s
->timeout_event_source
) {
455 r
= sd_event_source_set_time_relative(s
->timeout_event_source
, DNS_STREAM_ESTABLISHED_TIMEOUT_USEC
);
457 log_warning_errno(errno
, "Couldn't restart TCP connection timeout, ignoring: %m");
463 static DnsStream
*dns_stream_free(DnsStream
*s
) {
471 LIST_REMOVE(streams
, s
->manager
->dns_streams
, s
);
472 s
->manager
->n_dns_streams
[s
->type
]--;
475 #if ENABLE_DNS_OVER_TLS
477 dnstls_stream_free(s
);
480 ORDERED_SET_FOREACH(p
, s
->write_queue
)
481 dns_packet_unref(ordered_set_remove(s
->write_queue
, p
));
483 dns_packet_unref(s
->write_packet
);
484 dns_packet_unref(s
->read_packet
);
485 dns_server_unref(s
->server
);
487 ordered_set_free(s
->write_queue
);
492 DEFINE_TRIVIAL_REF_UNREF_FUNC(DnsStream
, dns_stream
, dns_stream_free
);
498 DnsProtocol protocol
,
500 const union sockaddr_union
*tfo_address
,
501 int (on_packet
)(DnsStream
*, DnsPacket
*),
502 int (complete
)(DnsStream
*, int), /* optional */
503 usec_t connect_timeout_usec
) {
505 _cleanup_(dns_stream_unrefp
) DnsStream
*s
= NULL
;
511 assert(type
< _DNS_STREAM_TYPE_MAX
);
512 assert(protocol
>= 0);
513 assert(protocol
< _DNS_PROTOCOL_MAX
);
517 if (m
->n_dns_streams
[type
] > DNS_STREAMS_MAX
)
520 s
= new(DnsStream
, 1);
527 .protocol
= protocol
,
531 r
= ordered_set_ensure_allocated(&s
->write_queue
, &dns_packet_hash_ops
);
535 r
= sd_event_add_io(m
->event
, &s
->io_event_source
, fd
, EPOLLIN
, on_stream_io
, s
);
539 (void) sd_event_source_set_description(s
->io_event_source
, "dns-stream-io");
541 r
= sd_event_add_time_relative(
543 &s
->timeout_event_source
,
545 connect_timeout_usec
, 0,
546 on_stream_timeout
, s
);
550 (void) sd_event_source_set_description(s
->timeout_event_source
, "dns-stream-timeout");
552 LIST_PREPEND(streams
, m
->dns_streams
, s
);
553 m
->n_dns_streams
[type
]++;
557 s
->on_packet
= on_packet
;
558 s
->complete
= complete
;
561 s
->tfo_address
= *tfo_address
;
562 s
->tfo_salen
= tfo_address
->sa
.sa_family
== AF_INET6
? sizeof(tfo_address
->in6
) : sizeof(tfo_address
->in
);
570 int dns_stream_write_packet(DnsStream
*s
, DnsPacket
*p
) {
576 r
= ordered_set_put(s
->write_queue
, p
);
582 return dns_stream_update_io(s
);
585 void dns_stream_detach(DnsStream
*s
) {
591 if (s
->server
->stream
!= s
)
594 dns_server_unref_stream(s
->server
);
597 DEFINE_PRIVATE_HASH_OPS_WITH_KEY_DESTRUCTOR(
601 trivial_compare_func
,
604 int dns_stream_disconnect_all(Manager
*m
) {
605 _cleanup_(set_freep
) Set
*closed
= NULL
;
610 /* Terminates all TCP connections (called after system suspend for example, to speed up recovery) */
612 log_info("Closing all remaining TCP connections.");
618 LIST_FOREACH(streams
, s
, m
->dns_streams
) {
619 r
= set_ensure_put(&closed
, &dns_stream_hash_ops
, s
);
623 /* Haven't seen this one before. Close it. */
625 (void) dns_stream_complete(s
, ECONNRESET
);
627 /* This might have a ripple effect, let's hence no look at the list further,
628 * but scan from the beginning again */