src/resolve/resolved-resolv-conf.c

   1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
   2
   3 #include <resolv.h>
   4 #include <sys/stat.h>
   5
   6 #include "alloc-util.h"
   7 #include "fd-util.h"
   8 #include "fileio.h"
   9 #include "fs-util.h"
  10 #include "label-util.h"
  11 #include "log.h"
  12 #include "ordered-set.h"
  13 #include "path-util.h"
  14 #include "resolved-dns-cache.h"
  15 #include "resolved-dns-scope.h"
  16 #include "resolved-dns-search-domain.h"
  17 #include "resolved-dns-server.h"
  18 #include "resolved-dns-stub.h"
  19 #include "resolved-manager.h"
  20 #include "resolved-resolv-conf.h"
  21 #include "stat-util.h"
  22 #include "string-table.h"
  23 #include "string-util.h"
  24 #include "strv.h"
  25 #include "tmpfile-util-label.h"
  26
  27 int manager_check_resolv_conf(const Manager *m) {
  28         struct stat st, own;
  29
  30         assert(m);
  31
  32         /* This warns only when our stub listener is disabled and /etc/resolv.conf is a symlink to
  33          * PRIVATE_STATIC_RESOLV_CONF. */
  34
  35         if (m->dns_stub_listener_mode != DNS_STUB_LISTENER_NO)
  36                 return 0;
  37
  38         if (stat("/etc/resolv.conf", &st) < 0) {
  39                 if (errno == ENOENT)
  40                         return 0;
  41
  42                 return log_warning_errno(errno, "Failed to stat /etc/resolv.conf: %m");
  43         }
  44
  45         /* Is it symlinked to our own uplink file? */
  46         if (stat(PRIVATE_STATIC_RESOLV_CONF, &own) >= 0 &&
  47             stat_inode_same(&st, &own))
  48                 return log_warning_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
  49                                          "DNSStubListener= is disabled, but /etc/resolv.conf is a symlink to "
  50                                          PRIVATE_STATIC_RESOLV_CONF " which expects DNSStubListener= to be enabled.");
  51
  52         return 0;
  53 }
  54
  55 static bool file_is_our_own(const struct stat *st) {
  56         assert(st);
  57
  58         FOREACH_STRING(path,
  59                        PRIVATE_UPLINK_RESOLV_CONF,
  60                        PRIVATE_STUB_RESOLV_CONF,
  61                        PRIVATE_STATIC_RESOLV_CONF) {
  62
  63                 struct stat own;
  64
  65                 /* Is it symlinked to our own uplink file? */
  66                 if (stat(path, &own) >= 0 &&
  67                     stat_inode_same(st, &own))
  68                         return true;
  69         }
  70
  71         return false;
  72 }
  73
  74 int manager_read_resolv_conf(Manager *m) {
  75         _cleanup_fclose_ FILE *f = NULL;
  76         struct stat st;
  77         unsigned n = 0;
  78         int r;
  79
  80         assert(m);
  81
  82         /* Reads the system /etc/resolv.conf, if it exists and is not
  83          * symlinked to our own resolv.conf instance */
  84
  85         if (!m->read_resolv_conf)
  86                 return 0;
  87
  88         r = stat("/etc/resolv.conf", &st);
  89         if (r < 0) {
  90                 if (errno == ENOENT)
  91                         return 0;
  92
  93                 r = log_warning_errno(errno, "Failed to stat /etc/resolv.conf: %m");
  94                 goto clear;
  95         }
  96
  97         /* Have we already seen the file? */
  98         if (stat_inode_unmodified(&st, &m->resolv_conf_stat))
  99                 return 0;
 100
 101         if (file_is_our_own(&st))
 102                 return 0;
 103
 104         f = fopen("/etc/resolv.conf", "re");
 105         if (!f) {
 106                 if (errno == ENOENT)
 107                         return 0;
 108
 109                 r = log_warning_errno(errno, "Failed to open %s: %m", "/etc/resolv.conf");
 110                 goto clear;
 111         }
 112
 113         if (fstat(fileno(f), &st) < 0) {
 114                 r = log_error_errno(errno, "Failed to stat open file: %m");
 115                 goto clear;
 116         }
 117
 118         if (file_is_our_own(&st))
 119                 return 0;
 120
 121         dns_server_mark_all(m->dns_servers);
 122         dns_search_domain_mark_all(m->search_domains);
 123
 124         for (;;) {
 125                 _cleanup_free_ char *line = NULL;
 126                 const char *a;
 127
 128                 r = read_stripped_line(f, LONG_LINE_MAX, &line);
 129                 if (r < 0) {
 130                         log_error_errno(r, "Failed to read /etc/resolv.conf: %m");
 131                         goto clear;
 132                 }
 133                 if (r == 0)
 134                         break;
 135
 136                 n++;
 137
 138                 if (IN_SET(*line, '#', ';', 0))
 139                         continue;
 140
 141                 a = first_word(line, "nameserver");
 142                 if (a) {
 143                         r = manager_parse_dns_server_string_and_warn(m, DNS_SERVER_SYSTEM, a);
 144                         if (r < 0)
 145                                 log_warning_errno(r, "Failed to parse DNS server address '%s', ignoring.", a);
 146
 147                         continue;
 148                 }
 149
 150                 a = first_word(line, "domain");
 151                 if (!a) /* We treat "domain" lines, and "search" lines as equivalent, and add both to our list. */
 152                         a = first_word(line, "search");
 153                 if (a) {
 154                         r = manager_parse_search_domains_and_warn(m, a);
 155                         if (r < 0)
 156                                 log_warning_errno(r, "Failed to parse search domain string '%s', ignoring.", a);
 157
 158                         continue;
 159                 }
 160
 161                 log_syntax(NULL, LOG_DEBUG, "/etc/resolv.conf", n, 0, "Ignoring resolv.conf line: %s", line);
 162         }
 163
 164         m->resolv_conf_stat = st;
 165
 166         /* Flush out all servers and search domains that are still
 167          * marked. Those are then ones that didn't appear in the new
 168          * /etc/resolv.conf */
 169         dns_server_unlink_marked(m->dns_servers);
 170         dns_search_domain_unlink_marked(m->search_domains);
 171
 172         /* Whenever /etc/resolv.conf changes, start using the first
 173          * DNS server of it. This is useful to deal with broken
 174          * network managing implementations (like NetworkManager),
 175          * that when connecting to a VPN place both the VPN DNS
 176          * servers and the local ones in /etc/resolv.conf. Without
 177          * resetting the DNS server to use back to the first entry we
 178          * will continue to use the local one thus being unable to
 179          * resolve VPN domains. */
 180         manager_set_dns_server(m, m->dns_servers);
 181
 182         /* Unconditionally flush the cache when /etc/resolv.conf is
 183          * modified, even if the data it contained was completely
 184          * identical to the previous version we used. We do this
 185          * because altering /etc/resolv.conf is typically done when
 186          * the network configuration changes, and that should be
 187          * enough to flush the global unicast DNS cache. */
 188         if (m->unicast_scope)
 189                 dns_cache_flush(&m->unicast_scope->cache);
 190
 191         /* If /etc/resolv.conf changed, make sure to forget everything we learned about the DNS servers. After all we
 192          * might now talk to a very different DNS server that just happens to have the same IP address as an old one
 193          * (think 192.168.1.1). */
 194         dns_server_reset_features_all(m->dns_servers);
 195
 196         return 0;
 197
 198 clear:
 199         dns_server_unlink_all(m->dns_servers);
 200         dns_search_domain_unlink_all(m->search_domains);
 201         return r;
 202 }
 203
 204 static void write_resolv_conf_server(DnsServer *s, FILE *f, unsigned *count) {
 205         DnsScope *scope;
 206
 207         assert(s);
 208         assert(f);
 209         assert(count);
 210
 211         if (!dns_server_string(s)) {
 212                 log_warning("Out of memory, or invalid DNS address. Ignoring server.");
 213                 return;
 214         }
 215
 216         /* resolv.conf simply doesn't support any other ports than 53, hence there's nothing much we can
 217          * do — we have to suppress these entries */
 218         if (dns_server_port(s) != 53) {
 219                 log_debug("DNS server %s with non-standard UDP port number, suppressing from generated resolv.conf.", dns_server_string(s));
 220                 return;
 221         }
 222
 223         /* Check if the scope this DNS server belongs to is suitable as 'default' route for lookups; resolv.conf does
 224          * not have a syntax to express that, so it must not appear as a global name server to avoid routing unrelated
 225          * domains to it (which is a privacy violation, will most probably fail anyway, and adds unnecessary load) */
 226         scope = dns_server_scope(s);
 227         if (scope && !dns_scope_is_default_route(scope)) {
 228                 log_debug("Scope of DNS server %s has only route-only domains, not using as global name server", dns_server_string(s));
 229                 return;
 230         }
 231
 232         if (*count == MAXNS)
 233                 fputs("# Too many DNS servers configured, the following entries may be ignored.\n", f);
 234         (*count)++;
 235
 236         fprintf(f, "nameserver %s\n", dns_server_string(s));
 237 }
 238
 239 static void write_resolv_conf_search(
 240                 OrderedSet *domains,
 241                 FILE *f) {
 242         char *domain;
 243
 244         assert(domains);
 245         assert(f);
 246
 247         fputs("search", f);
 248
 249         ORDERED_SET_FOREACH(domain, domains) {
 250                 fputc(' ', f);
 251                 fputs(domain, f);
 252         }
 253
 254         fputs("\n", f);
 255 }
 256
 257 static int write_uplink_resolv_conf_contents(FILE *f, OrderedSet *dns, OrderedSet *domains) {
 258
 259         fputs("# This is "PRIVATE_UPLINK_RESOLV_CONF" managed by man:systemd-resolved(8).\n"
 260               "# Do not edit.\n"
 261               "#\n"
 262               "# This file might be symlinked as /etc/resolv.conf. If you're looking at\n"
 263               "# /etc/resolv.conf and seeing this text, you have followed the symlink.\n"
 264               "#\n"
 265               "# This is a dynamic resolv.conf file for connecting local clients directly to\n"
 266               "# all known uplink DNS servers. This file lists all configured search domains.\n"
 267               "#\n"
 268               "# Third party programs should typically not access this file directly, but only\n"
 269               "# through the symlink at /etc/resolv.conf. To manage man:resolv.conf(5) in a\n"
 270               "# different way, replace this symlink by a static file or a different symlink.\n"
 271               "#\n"
 272               "# See man:systemd-resolved.service(8) for details about the supported modes of\n"
 273               "# operation for /etc/resolv.conf.\n"
 274               "\n", f);
 275
 276         if (ordered_set_isempty(dns))
 277                 fputs("# No DNS servers known.\n", f);
 278         else {
 279                 unsigned count = 0;
 280                 DnsServer *s;
 281
 282                 ORDERED_SET_FOREACH(s, dns)
 283                         write_resolv_conf_server(s, f, &count);
 284         }
 285
 286         if (ordered_set_isempty(domains))
 287                 fputs("search .\n", f); /* Make sure that if the local hostname is chosen as fqdn this does not
 288                                          * imply a search domain */
 289         else
 290                 write_resolv_conf_search(domains, f);
 291
 292         return fflush_and_check(f);
 293 }
 294
 295 static int write_stub_resolv_conf_contents(FILE *f, OrderedSet *dns, OrderedSet *domains) {
 296         fputs("# This is "PRIVATE_STUB_RESOLV_CONF" managed by man:systemd-resolved(8).\n"
 297               "# Do not edit.\n"
 298               "#\n"
 299               "# This file might be symlinked as /etc/resolv.conf. If you're looking at\n"
 300               "# /etc/resolv.conf and seeing this text, you have followed the symlink.\n"
 301               "#\n"
 302               "# This is a dynamic resolv.conf file for connecting local clients to the\n"
 303               "# internal DNS stub resolver of systemd-resolved. This file lists all\n"
 304               "# configured search domains.\n"
 305               "#\n"
 306               "# Run \"resolvectl status\" to see details about the uplink DNS servers\n"
 307               "# currently in use.\n"
 308               "#\n"
 309               "# Third party programs should typically not access this file directly, but only\n"
 310               "# through the symlink at /etc/resolv.conf. To manage man:resolv.conf(5) in a\n"
 311               "# different way, replace this symlink by a static file or a different symlink.\n"
 312               "#\n"
 313               "# See man:systemd-resolved.service(8) for details about the supported modes of\n"
 314               "# operation for /etc/resolv.conf.\n"
 315               "\n"
 316               "nameserver 127.0.0.53\n"
 317               "options edns0 trust-ad\n", f);
 318
 319         if (ordered_set_isempty(domains))
 320                 fputs("search .\n", f); /* Make sure that if the local hostname is chosen as fqdn this does not
 321                                          * imply a search domain */
 322         else
 323                 write_resolv_conf_search(domains, f);
 324
 325         return fflush_and_check(f);
 326 }
 327
 328 int manager_write_resolv_conf(Manager *m) {
 329         _cleanup_ordered_set_free_ OrderedSet *dns = NULL, *domains = NULL;
 330         _cleanup_(unlink_and_freep) char *temp_path_uplink = NULL, *temp_path_stub = NULL;
 331         _cleanup_fclose_ FILE *f_uplink = NULL, *f_stub = NULL;
 332         int r;
 333
 334         assert(m);
 335
 336         /* Read the system /etc/resolv.conf first */
 337         (void) manager_read_resolv_conf(m);
 338
 339         /* Add the full list to a set, to filter out duplicates */
 340         r = manager_compile_dns_servers(m, &dns);
 341         if (r < 0)
 342                 return log_warning_errno(r, "Failed to compile list of DNS servers, ignoring: %m");
 343
 344         r = manager_compile_search_domains(m, &domains, false);
 345         if (r < 0)
 346                 return log_warning_errno(r, "Failed to compile list of search domains, ignoring: %m");
 347
 348         r = fopen_temporary_label(PRIVATE_UPLINK_RESOLV_CONF, PRIVATE_UPLINK_RESOLV_CONF, &f_uplink, &temp_path_uplink);
 349         if (r < 0)
 350                 return log_warning_errno(r, "Failed to open new %s for writing, ignoring: %m", PRIVATE_UPLINK_RESOLV_CONF);
 351
 352         (void) fchmod(fileno(f_uplink), 0644);
 353
 354         r = write_uplink_resolv_conf_contents(f_uplink, dns, domains);
 355         if (r < 0)
 356                 return log_warning_errno(r, "Failed to write new %s, ignoring: %m", PRIVATE_UPLINK_RESOLV_CONF);
 357
 358         if (m->dns_stub_listener_mode != DNS_STUB_LISTENER_NO) {
 359                 r = fopen_temporary_label(PRIVATE_STUB_RESOLV_CONF, PRIVATE_STUB_RESOLV_CONF, &f_stub, &temp_path_stub);
 360                 if (r < 0)
 361                         return log_warning_errno(r, "Failed to open new %s for writing, ignoring: %m", PRIVATE_STUB_RESOLV_CONF);
 362
 363                 (void) fchmod(fileno(f_stub), 0644);
 364
 365                 r = write_stub_resolv_conf_contents(f_stub, dns, domains);
 366                 if (r < 0)
 367                         return log_warning_errno(r, "Failed to write new %s, ignoring: %m", PRIVATE_STUB_RESOLV_CONF);
 368
 369                 r = conservative_rename(temp_path_stub, PRIVATE_STUB_RESOLV_CONF);
 370                 if (r < 0)
 371                         log_warning_errno(r, "Failed to move new %s into place, ignoring: %m", PRIVATE_STUB_RESOLV_CONF);
 372
 373                 temp_path_stub = mfree(temp_path_stub); /* free the string explicitly, so that we don't unlink anymore */
 374         } else {
 375                 _cleanup_free_ char *fname = NULL;
 376                 r = path_extract_filename(PRIVATE_UPLINK_RESOLV_CONF, &fname);
 377                 if (r < 0)
 378                         return log_warning_errno(r, "Failed to extract filename from path '" PRIVATE_UPLINK_RESOLV_CONF "', ignoring: %m");
 379
 380                 r = symlinkat_atomic_full(fname, AT_FDCWD, PRIVATE_STUB_RESOLV_CONF, SYMLINK_LABEL);
 381                 if (r < 0)
 382                         log_warning_errno(r, "Failed to symlink %s, ignoring: %m", PRIVATE_STUB_RESOLV_CONF);
 383         }
 384
 385         r = conservative_rename(temp_path_uplink, PRIVATE_UPLINK_RESOLV_CONF);
 386         if (r < 0)
 387                 log_warning_errno(r, "Failed to move new %s into place: %m", PRIVATE_UPLINK_RESOLV_CONF);
 388
 389         temp_path_uplink = mfree(temp_path_uplink); /* free the string explicitly, so that we don't unlink anymore */
 390         return r;
 391 }
 392
 393 int resolv_conf_mode(void) {
 394         static const char * const table[_RESOLV_CONF_MODE_MAX] = {
 395                 [RESOLV_CONF_UPLINK] = PRIVATE_UPLINK_RESOLV_CONF,
 396                 [RESOLV_CONF_STUB] = PRIVATE_STUB_RESOLV_CONF,
 397                 [RESOLV_CONF_STATIC] = PRIVATE_STATIC_RESOLV_CONF,
 398         };
 399
 400         struct stat system_st;
 401
 402         if (stat("/etc/resolv.conf", &system_st) < 0) {
 403                 if (errno == ENOENT)
 404                         return RESOLV_CONF_MISSING;
 405
 406                 return -errno;
 407         }
 408
 409         for (ResolvConfMode m = 0; m < _RESOLV_CONF_MODE_MAX; m++) {
 410                 struct stat our_st;
 411
 412                 if (!table[m])
 413                         continue;
 414
 415                 if (stat(table[m], &our_st) < 0) {
 416                         if (errno != ENOENT)
 417                                 log_debug_errno(errno, "Failed to stat() %s, ignoring: %m", table[m]);
 418
 419                         continue;
 420                 }
 421
 422                 if (stat_inode_same(&system_st, &our_st))
 423                         return m;
 424         }
 425
 426         return RESOLV_CONF_FOREIGN;
 427 }
 428
 429 static const char* const resolv_conf_mode_table[_RESOLV_CONF_MODE_MAX] = {
 430         [RESOLV_CONF_UPLINK] = "uplink",
 431         [RESOLV_CONF_STUB] = "stub",
 432         [RESOLV_CONF_STATIC] = "static",
 433         [RESOLV_CONF_MISSING] = "missing",
 434         [RESOLV_CONF_FOREIGN] = "foreign",
 435 };
 436 DEFINE_STRING_TABLE_LOOKUP(resolv_conf_mode, ResolvConfMode);