[thirdparty/systemd.git] / src / resolve / resolved-dns-stream.c

/* SPDX-License-Identifier: LGPL-2.1+ */

#include <netinet/tcp.h>

#include "alloc-util.h"
#include "fd-util.h"
#include "io-util.h"
#include "missing.h"
#include "resolved-dns-stream.h"

#define DNS_STREAM_TIMEOUT_USEC (10 * USEC_PER_SEC)
#define DNS_STREAMS_MAX 128

static void dns_stream_stop(DnsStream *s) {
        assert(s);

        s->io_event_source = sd_event_source_unref(s->io_event_source);
        s->timeout_event_source = sd_event_source_unref(s->timeout_event_source);
        s->fd = safe_close(s->fd);
}

static int dns_stream_update_io(DnsStream *s) {
        int f = 0;

        assert(s);

        if (s->write_packet && s->n_written < sizeof(s->write_size) + s->write_packet->size)
                f |= EPOLLOUT;
        else if (!ordered_set_isempty(s->write_queue)) {
                dns_packet_unref(s->write_packet);
                s->write_packet = ordered_set_steal_first(s->write_queue);
                s->write_size = htobe16(s->write_packet->size);
                s->n_written = 0;
                f |= EPOLLOUT;
        }
        if (!s->read_packet || s->n_read < sizeof(s->read_size) + s->read_packet->size)
                f |= EPOLLIN;

        return sd_event_source_set_io_events(s->io_event_source, f);
}

static int dns_stream_complete(DnsStream *s, int error) {
        assert(s);

#if ENABLE_DNS_OVER_TLS
        if (s->encrypted) {
                int r;

                r = dnstls_stream_shutdown(s, error);
                if (r != -EAGAIN)
                        dns_stream_stop(s);
        } else
#endif
                dns_stream_stop(s);

        if (s->complete)
                s->complete(s, error);
        else /* the default action if no completion function is set is to close the stream */
                dns_stream_unref(s);

        return 0;
}

static int dns_stream_identify(DnsStream *s) {
        union {
                struct cmsghdr header; /* For alignment */
                uint8_t buffer[CMSG_SPACE(MAXSIZE(struct in_pktinfo, struct in6_pktinfo))
                               + EXTRA_CMSG_SPACE /* kernel appears to require extra space */];
        } control;
        struct msghdr mh = {};
        struct cmsghdr *cmsg;
        socklen_t sl;
        int r;

        assert(s);

        if (s->identified)
                return 0;

        /* Query the local side */
        s->local_salen = sizeof(s->local);
        r = getsockname(s->fd, &s->local.sa, &s->local_salen);
        if (r < 0)
                return -errno;
        if (s->local.sa.sa_family == AF_INET6 && s->ifindex <= 0)
                s->ifindex = s->local.in6.sin6_scope_id;

        /* Query the remote side */
        s->peer_salen = sizeof(s->peer);
        r = getpeername(s->fd, &s->peer.sa, &s->peer_salen);
        if (r < 0)
                return -errno;
        if (s->peer.sa.sa_family == AF_INET6 && s->ifindex <= 0)
                s->ifindex = s->peer.in6.sin6_scope_id;

        /* Check consistency */
        assert(s->peer.sa.sa_family == s->local.sa.sa_family);
        assert(IN_SET(s->peer.sa.sa_family, AF_INET, AF_INET6));

        /* Query connection meta information */
        sl = sizeof(control);
        if (s->peer.sa.sa_family == AF_INET) {
                r = getsockopt(s->fd, IPPROTO_IP, IP_PKTOPTIONS, &control, &sl);
                if (r < 0)
                        return -errno;
        } else if (s->peer.sa.sa_family == AF_INET6) {

                r = getsockopt(s->fd, IPPROTO_IPV6, IPV6_2292PKTOPTIONS, &control, &sl);
                if (r < 0)
                        return -errno;
        } else
                return -EAFNOSUPPORT;

        mh.msg_control = &control;
        mh.msg_controllen = sl;

        CMSG_FOREACH(cmsg, &mh) {

                if (cmsg->cmsg_level == IPPROTO_IPV6) {
                        assert(s->peer.sa.sa_family == AF_INET6);

                        switch (cmsg->cmsg_type) {

                        case IPV6_PKTINFO: {
                                struct in6_pktinfo *i = (struct in6_pktinfo*) CMSG_DATA(cmsg);

                                if (s->ifindex <= 0)
                                        s->ifindex = i->ipi6_ifindex;
                                break;
                        }

                        case IPV6_HOPLIMIT:
                                s->ttl = *(int *) CMSG_DATA(cmsg);
                                break;
                        }

                } else if (cmsg->cmsg_level == IPPROTO_IP) {
                        assert(s->peer.sa.sa_family == AF_INET);

                        switch (cmsg->cmsg_type) {

                        case IP_PKTINFO: {
                                struct in_pktinfo *i = (struct in_pktinfo*) CMSG_DATA(cmsg);

                                if (s->ifindex <= 0)
                                        s->ifindex = i->ipi_ifindex;
                                break;
                        }

                        case IP_TTL:
                                s->ttl = *(int *) CMSG_DATA(cmsg);
                                break;
                        }
                }
        }

        /* The Linux kernel sets the interface index to the loopback
         * device if the connection came from the local host since it
         * avoids the routing table in such a case. Let's unset the
         * interface index in such a case. */
        if (s->ifindex == LOOPBACK_IFINDEX)
                s->ifindex = 0;

        /* If we don't know the interface index still, we look for the
         * first local interface with a matching address. Yuck! */
        if (s->ifindex <= 0)
                s->ifindex = manager_find_ifindex(s->manager, s->local.sa.sa_family, s->local.sa.sa_family == AF_INET ? (union in_addr_union*) &s->local.in.sin_addr : (union in_addr_union*)  &s->local.in6.sin6_addr);

        if (s->protocol == DNS_PROTOCOL_LLMNR && s->ifindex > 0) {
                uint32_t ifindex = htobe32(s->ifindex);

                /* Make sure all packets for this connection are sent on the same interface */
                if (s->local.sa.sa_family == AF_INET) {
                        r = setsockopt(s->fd, IPPROTO_IP, IP_UNICAST_IF, &ifindex, sizeof(ifindex));
                        if (r < 0)
                                log_debug_errno(errno, "Failed to invoke IP_UNICAST_IF: %m");
                } else if (s->local.sa.sa_family == AF_INET6) {
                        r = setsockopt(s->fd, IPPROTO_IPV6, IPV6_UNICAST_IF, &ifindex, sizeof(ifindex));
                        if (r < 0)
                                log_debug_errno(errno, "Failed to invoke IPV6_UNICAST_IF: %m");
                }
        }

        s->identified = true;

        return 0;
}

ssize_t dns_stream_writev(DnsStream *s, const struct iovec *iov, size_t iovcnt, int flags) {
        ssize_t r;

        assert(s);
        assert(iov);

#if ENABLE_DNS_OVER_TLS
        if (s->encrypted && !(flags & DNS_STREAM_WRITE_TLS_DATA)) {
                ssize_t ss;
                size_t i;

                r = 0;
                for (i = 0; i < iovcnt; i++) {
                        ss = dnstls_stream_write(s, iov[i].iov_base, iov[i].iov_len);
                        if (ss < 0)
                                return ss;

                        r += ss;
                        if (ss != (ssize_t) iov[i].iov_len)
                                continue;
                }
        } else
#endif
        if (s->tfo_salen > 0) {
                struct msghdr hdr = {
                        .msg_iov = (struct iovec*) iov,
                        .msg_iovlen = iovcnt,
                        .msg_name = &s->tfo_address.sa,
                        .msg_namelen = s->tfo_salen
                };

                r = sendmsg(s->fd, &hdr, MSG_FASTOPEN);
                if (r < 0) {
                        if (errno == EOPNOTSUPP) {
                                s->tfo_salen = 0;
                                r = connect(s->fd, &s->tfo_address.sa, s->tfo_salen);
                                if (r < 0)
                                        return -errno;

                                r = -EAGAIN;
                        } else if (errno == EINPROGRESS)
                                r = -EAGAIN;
                } else
                        s->tfo_salen = 0; /* connection is made */
        } else {
                r = writev(s->fd, iov, iovcnt);
                if (r < 0)
                        r = -errno;
        }

        return r;
}

static ssize_t dns_stream_read(DnsStream *s, void *buf, size_t count) {
        ssize_t ss;

#if ENABLE_DNS_OVER_TLS
        if (s->encrypted)
                ss = dnstls_stream_read(s, buf, count);
        else
#endif
        {
                ss = read(s->fd, buf, count);
                if (ss < 0)
                        ss = -errno;
        }

        return ss;
}

static int on_stream_timeout(sd_event_source *es, usec_t usec, void *userdata) {
        DnsStream *s = userdata;

        assert(s);

        return dns_stream_complete(s, ETIMEDOUT);
}

static int on_stream_io(sd_event_source *es, int fd, uint32_t revents, void *userdata) {
        DnsStream *s = userdata;
        int r;

        assert(s);

#if ENABLE_DNS_OVER_TLS
        if (s->encrypted) {
                r = dnstls_stream_on_io(s);

                if (r == DNSTLS_STREAM_CLOSED || r == -EAGAIN)
                        return 0;
                else if (r < 0)
                        return dns_stream_complete(s, -r);
        }
#endif

        /* only identify after connecting */
        if (s->tfo_salen == 0) {
                r = dns_stream_identify(s);
                if (r < 0)
                        return dns_stream_complete(s, -r);
        }

        if ((revents & EPOLLOUT) &&
            s->write_packet &&
            s->n_written < sizeof(s->write_size) + s->write_packet->size) {

                struct iovec iov[2];
                ssize_t ss;

                iov[0].iov_base = &s->write_size;
                iov[0].iov_len = sizeof(s->write_size);
                iov[1].iov_base = DNS_PACKET_DATA(s->write_packet);
                iov[1].iov_len = s->write_packet->size;

                IOVEC_INCREMENT(iov, 2, s->n_written);

                ss = dns_stream_writev(s, iov, 2, 0);
                if (ss < 0) {
                        if (!IN_SET(-ss, EINTR, EAGAIN))
                                return dns_stream_complete(s, -ss);
                } else
                        s->n_written += ss;

                /* Are we done? If so, disable the event source for EPOLLOUT */
                if (s->n_written >= sizeof(s->write_size) + s->write_packet->size) {
                        r = dns_stream_update_io(s);
                        if (r < 0)
                                return dns_stream_complete(s, -r);
                }
        }

        if ((revents & (EPOLLIN|EPOLLHUP|EPOLLRDHUP)) &&
            (!s->read_packet ||
             s->n_read < sizeof(s->read_size) + s->read_packet->size)) {

                if (s->n_read < sizeof(s->read_size)) {
                        ssize_t ss;

                        ss = dns_stream_read(s, (uint8_t*) &s->read_size + s->n_read, sizeof(s->read_size) - s->n_read);
                        if (ss < 0) {
                                if (!IN_SET(-ss, EINTR, EAGAIN))
                                        return dns_stream_complete(s, -ss);
                        } else if (ss == 0)
                                return dns_stream_complete(s, ECONNRESET);
                        else
                                s->n_read += ss;
                }

                if (s->n_read >= sizeof(s->read_size)) {

                        if (be16toh(s->read_size) < DNS_PACKET_HEADER_SIZE)
                                return dns_stream_complete(s, EBADMSG);

                        if (s->n_read < sizeof(s->read_size) + be16toh(s->read_size)) {
                                ssize_t ss;

                                if (!s->read_packet) {
                                        r = dns_packet_new(&s->read_packet, s->protocol, be16toh(s->read_size), DNS_PACKET_SIZE_MAX);
                                        if (r < 0)
                                                return dns_stream_complete(s, -r);

                                        s->read_packet->size = be16toh(s->read_size);
                                        s->read_packet->ipproto = IPPROTO_TCP;
                                        s->read_packet->family = s->peer.sa.sa_family;
                                        s->read_packet->ttl = s->ttl;
                                        s->read_packet->ifindex = s->ifindex;

                                        if (s->read_packet->family == AF_INET) {
                                                s->read_packet->sender.in = s->peer.in.sin_addr;
                                                s->read_packet->sender_port = be16toh(s->peer.in.sin_port);
                                                s->read_packet->destination.in = s->local.in.sin_addr;
                                                s->read_packet->destination_port = be16toh(s->local.in.sin_port);
                                        } else {
                                                assert(s->read_packet->family == AF_INET6);
                                                s->read_packet->sender.in6 = s->peer.in6.sin6_addr;
                                                s->read_packet->sender_port = be16toh(s->peer.in6.sin6_port);
                                                s->read_packet->destination.in6 = s->local.in6.sin6_addr;
                                                s->read_packet->destination_port = be16toh(s->local.in6.sin6_port);

                                                if (s->read_packet->ifindex == 0)
                                                        s->read_packet->ifindex = s->peer.in6.sin6_scope_id;
                                                if (s->read_packet->ifindex == 0)
                                                        s->read_packet->ifindex = s->local.in6.sin6_scope_id;
                                        }
                                }

                                ss = dns_stream_read(s,
                                          (uint8_t*) DNS_PACKET_DATA(s->read_packet) + s->n_read - sizeof(s->read_size),
                                          sizeof(s->read_size) + be16toh(s->read_size) - s->n_read);
                                if (ss < 0) {
                                        if (!IN_SET(errno, EINTR, EAGAIN))
                                                return dns_stream_complete(s, errno);
                                } else if (ss == 0)
                                        return dns_stream_complete(s, ECONNRESET);
                                else
                                        s->n_read += ss;
                        }

                        /* Are we done? If so, disable the event source for EPOLLIN */
                        if (s->n_read >= sizeof(s->read_size) + be16toh(s->read_size)) {
                                /* If there's a packet handler
                                 * installed, call that. Note that
                                 * this is optional... */
                                if (s->on_packet) {
                                        r = s->on_packet(s);
                                        if (r < 0)
                                                return r;
                                }

                                r = dns_stream_update_io(s);
                                if (r < 0)
                                        return dns_stream_complete(s, -r);
                        }
                }
        }

        if ((s->write_packet && s->n_written >= sizeof(s->write_size) + s->write_packet->size) &&
            (s->read_packet && s->n_read >= sizeof(s->read_size) + s->read_packet->size))
                return dns_stream_complete(s, 0);

        return 0;
}

DnsStream *dns_stream_unref(DnsStream *s) {
        DnsPacket *p;
        Iterator i;

        if (!s)
                return NULL;

        assert(s->n_ref > 0);
        s->n_ref--;

        if (s->n_ref > 0)
                return NULL;

        dns_stream_stop(s);

        if (s->server && s->server->stream == s)
                s->server->stream = NULL;

        if (s->manager) {
                LIST_REMOVE(streams, s->manager->dns_streams, s);
                s->manager->n_dns_streams--;
        }

#if ENABLE_DNS_OVER_TLS
        if (s->encrypted)
                dnstls_stream_free(s);
#endif

        ORDERED_SET_FOREACH(p, s->write_queue, i)
                dns_packet_unref(ordered_set_remove(s->write_queue, p));

        dns_packet_unref(s->write_packet);
        dns_packet_unref(s->read_packet);
        dns_server_unref(s->server);

        ordered_set_free(s->write_queue);

        return mfree(s);
}

DnsStream *dns_stream_ref(DnsStream *s) {
        if (!s)
                return NULL;

        assert(s->n_ref > 0);
        s->n_ref++;

        return s;
}

int dns_stream_new(Manager *m, DnsStream **ret, DnsProtocol protocol, int fd, const union sockaddr_union *tfo_address) {
        _cleanup_(dns_stream_unrefp) DnsStream *s = NULL;
        int r;

        assert(m);
        assert(fd >= 0);

        if (m->n_dns_streams > DNS_STREAMS_MAX)
                return -EBUSY;

        s = new0(DnsStream, 1);
        if (!s)
                return -ENOMEM;

        r = ordered_set_ensure_allocated(&s->write_queue, &dns_packet_hash_ops);
        if (r < 0)
                return r;

        s->n_ref = 1;
        s->fd = -1;
        s->protocol = protocol;

        r = sd_event_add_io(m->event, &s->io_event_source, fd, EPOLLIN, on_stream_io, s);
        if (r < 0)
                return r;

        (void) sd_event_source_set_description(s->io_event_source, "dns-stream-io");

        r = sd_event_add_time(
                        m->event,
                        &s->timeout_event_source,
                        clock_boottime_or_monotonic(),
                        now(clock_boottime_or_monotonic()) + DNS_STREAM_TIMEOUT_USEC, 0,
                        on_stream_timeout, s);
        if (r < 0)
                return r;

        (void) sd_event_source_set_description(s->timeout_event_source, "dns-stream-timeout");

        LIST_PREPEND(streams, m->dns_streams, s);
        s->manager = m;
        s->fd = fd;
        if (tfo_address) {
                s->tfo_address = *tfo_address;
                s->tfo_salen = tfo_address->sa.sa_family == AF_INET6 ? sizeof(tfo_address->in6) : sizeof(tfo_address->in);
        }

        m->n_dns_streams++;

        *ret = TAKE_PTR(s);

        return 0;
}

int dns_stream_write_packet(DnsStream *s, DnsPacket *p) {
        int r;

        assert(s);

        r = ordered_set_put(s->write_queue, p);
        if (r < 0)
                return r;

        dns_packet_ref(p);

        return dns_stream_update_io(s);
}
Commit	Line	Data
53e1b683	1	/* SPDX-License-Identifier: LGPL-2.1+ */
623a4c97 LP	2
	3	#include <netinet/tcp.h>
	4
b5efdb8a	5	#include "alloc-util.h"
3ffd4af2	6	#include "fd-util.h"
afc5dbf3	7	#include "io-util.h"
623a4c97 LP	8	#include "missing.h"
	9	#include "resolved-dns-stream.h"
	10
	11	#define DNS_STREAM_TIMEOUT_USEC (10 * USEC_PER_SEC)
	12	#define DNS_STREAMS_MAX 128
	13
	14	static void dns_stream_stop(DnsStream *s) {
	15	assert(s);
	16
	17	s->io_event_source = sd_event_source_unref(s->io_event_source);
	18	s->timeout_event_source = sd_event_source_unref(s->timeout_event_source);
	19	s->fd = safe_close(s->fd);
	20	}
	21
	22	static int dns_stream_update_io(DnsStream *s) {
	23	int f = 0;
	24
	25	assert(s);
	26
	27	if (s->write_packet && s->n_written < sizeof(s->write_size) + s->write_packet->size)
	28	f \|= EPOLLOUT;
98767d75 IT	29	else if (!ordered_set_isempty(s->write_queue)) {
	30	dns_packet_unref(s->write_packet);
	31	s->write_packet = ordered_set_steal_first(s->write_queue);
	32	s->write_size = htobe16(s->write_packet->size);
	33	s->n_written = 0;
	34	f \|= EPOLLOUT;
	35	}
623a4c97 LP	36	if (!s->read_packet \|\| s->n_read < sizeof(s->read_size) + s->read_packet->size)
	37	f \|= EPOLLIN;
	38
	39	return sd_event_source_set_io_events(s->io_event_source, f);
	40	}
	41
b914e211	42	static int dns_stream_complete(DnsStream *s, int error) {
623a4c97 LP	43	assert(s);
623a4c97 LP	44
56ddbf10	45	#if ENABLE_DNS_OVER_TLS
6016fcb0	46	if (s->encrypted) {
5d67a7ae IT	47	int r;
5d67a7ae IT	48
6016fcb0 IT	49	r = dnstls_stream_shutdown(s, error);
6016fcb0 IT	50	if (r != -EAGAIN)
5d67a7ae IT	51	dns_stream_stop(s);
	52	} else
	53	#endif
	54	dns_stream_stop(s);
623a4c97 LP	55
	56	if (s->complete)
	57	s->complete(s, error);
b30bf55d LP	58	else /* the default action if no completion function is set is to close the stream */
b30bf55d LP	59	dns_stream_unref(s);
623a4c97 LP	60
	61	return 0;
	62	}
	63
b914e211 LP	64	static int dns_stream_identify(DnsStream *s) {
	65	union {
	66	struct cmsghdr header; /* For alignment */
40a1eebd	67	uint8_t buffer[CMSG_SPACE(MAXSIZE(struct in_pktinfo, struct in6_pktinfo))
b914e211 LP	68	+ EXTRA_CMSG_SPACE /* kernel appears to require extra space */];
	69	} control;
	70	struct msghdr mh = {};
	71	struct cmsghdr *cmsg;
	72	socklen_t sl;
	73	int r;
	74
	75	assert(s);
	76
	77	if (s->identified)
	78	return 0;
	79
	80	/* Query the local side */
	81	s->local_salen = sizeof(s->local);
	82	r = getsockname(s->fd, &s->local.sa, &s->local_salen);
	83	if (r < 0)
	84	return -errno;
	85	if (s->local.sa.sa_family == AF_INET6 && s->ifindex <= 0)
	86	s->ifindex = s->local.in6.sin6_scope_id;
	87
	88	/* Query the remote side */
	89	s->peer_salen = sizeof(s->peer);
	90	r = getpeername(s->fd, &s->peer.sa, &s->peer_salen);
	91	if (r < 0)
	92	return -errno;
	93	if (s->peer.sa.sa_family == AF_INET6 && s->ifindex <= 0)
	94	s->ifindex = s->peer.in6.sin6_scope_id;
	95
	96	/* Check consistency */
	97	assert(s->peer.sa.sa_family == s->local.sa.sa_family);
	98	assert(IN_SET(s->peer.sa.sa_family, AF_INET, AF_INET6));
	99
	100	/* Query connection meta information */
	101	sl = sizeof(control);
	102	if (s->peer.sa.sa_family == AF_INET) {
	103	r = getsockopt(s->fd, IPPROTO_IP, IP_PKTOPTIONS, &control, &sl);
	104	if (r < 0)
	105	return -errno;
	106	} else if (s->peer.sa.sa_family == AF_INET6) {
	107
	108	r = getsockopt(s->fd, IPPROTO_IPV6, IPV6_2292PKTOPTIONS, &control, &sl);
	109	if (r < 0)
	110	return -errno;
	111	} else
	112	return -EAFNOSUPPORT;
	113
	114	mh.msg_control = &control;
	115	mh.msg_controllen = sl;
2a1288ff LP	116
2a1288ff LP	117	CMSG_FOREACH(cmsg, &mh) {
b914e211 LP	118
	119	if (cmsg->cmsg_level == IPPROTO_IPV6) {
	120	assert(s->peer.sa.sa_family == AF_INET6);
	121
	122	switch (cmsg->cmsg_type) {
	123
	124	case IPV6_PKTINFO: {
	125	struct in6_pktinfo i = (struct in6_pktinfo) CMSG_DATA(cmsg);
	126
	127	if (s->ifindex <= 0)
	128	s->ifindex = i->ipi6_ifindex;
	129	break;
	130	}
	131
	132	case IPV6_HOPLIMIT:
	133	s->ttl = (int ) CMSG_DATA(cmsg);
	134	break;
	135	}
	136
	137	} else if (cmsg->cmsg_level == IPPROTO_IP) {
	138	assert(s->peer.sa.sa_family == AF_INET);
	139
	140	switch (cmsg->cmsg_type) {
	141
	142	case IP_PKTINFO: {
	143	struct in_pktinfo i = (struct in_pktinfo) CMSG_DATA(cmsg);
	144
	145	if (s->ifindex <= 0)
	146	s->ifindex = i->ipi_ifindex;
	147	break;
	148	}
	149
	150	case IP_TTL:
	151	s->ttl = (int ) CMSG_DATA(cmsg);
	152	break;
	153	}
	154	}
	155	}
	156
	157	/* The Linux kernel sets the interface index to the loopback
	158	* device if the connection came from the local host since it
	159	* avoids the routing table in such a case. Let's unset the
	160	* interface index in such a case. */
a5f03596	161	if (s->ifindex == LOOPBACK_IFINDEX)
b914e211 LP	162	s->ifindex = 0;
	163
	164	/* If we don't know the interface index still, we look for the
	165	* first local interface with a matching address. Yuck! */
	166	if (s->ifindex <= 0)
	167	s->ifindex = manager_find_ifindex(s->manager, s->local.sa.sa_family, s->local.sa.sa_family == AF_INET ? (union in_addr_union) &s->local.in.sin_addr : (union in_addr_union) &s->local.in6.sin6_addr);
	168
	169	if (s->protocol == DNS_PROTOCOL_LLMNR && s->ifindex > 0) {
	170	uint32_t ifindex = htobe32(s->ifindex);
	171
	172	/* Make sure all packets for this connection are sent on the same interface */
	173	if (s->local.sa.sa_family == AF_INET) {
	174	r = setsockopt(s->fd, IPPROTO_IP, IP_UNICAST_IF, &ifindex, sizeof(ifindex));
	175	if (r < 0)
56f64d95	176	log_debug_errno(errno, "Failed to invoke IP_UNICAST_IF: %m");
b914e211 LP	177	} else if (s->local.sa.sa_family == AF_INET6) {
	178	r = setsockopt(s->fd, IPPROTO_IPV6, IPV6_UNICAST_IF, &ifindex, sizeof(ifindex));
	179	if (r < 0)
56f64d95	180	log_debug_errno(errno, "Failed to invoke IPV6_UNICAST_IF: %m");
b914e211 LP	181	}
	182	}
	183
	184	s->identified = true;
	185
	186	return 0;
	187	}
	188
6016fcb0	189	ssize_t dns_stream_writev(DnsStream s, const struct iovec iov, size_t iovcnt, int flags) {
91ccab1e IT	190	ssize_t r;
	191
	192	assert(s);
	193	assert(iov);
	194
56ddbf10	195	#if ENABLE_DNS_OVER_TLS
6016fcb0	196	if (s->encrypted && !(flags & DNS_STREAM_WRITE_TLS_DATA)) {
5d67a7ae IT	197	ssize_t ss;
	198	size_t i;
	199
	200	r = 0;
	201	for (i = 0; i < iovcnt; i++) {
6016fcb0 IT	202	ss = dnstls_stream_write(s, iov[i].iov_base, iov[i].iov_len);
	203	if (ss < 0)
	204	return ss;
5d67a7ae IT	205
	206	r += ss;
	207	if (ss != (ssize_t) iov[i].iov_len)
	208	continue;
	209	}
	210	} else
	211	#endif
91ccab1e IT	212	if (s->tfo_salen > 0) {
	213	struct msghdr hdr = {
	214	.msg_iov = (struct iovec*) iov,
	215	.msg_iovlen = iovcnt,
	216	.msg_name = &s->tfo_address.sa,
	217	.msg_namelen = s->tfo_salen
	218	};
	219
	220	r = sendmsg(s->fd, &hdr, MSG_FASTOPEN);
	221	if (r < 0) {
	222	if (errno == EOPNOTSUPP) {
	223	s->tfo_salen = 0;
	224	r = connect(s->fd, &s->tfo_address.sa, s->tfo_salen);
	225	if (r < 0)
	226	return -errno;
	227
	228	r = -EAGAIN;
	229	} else if (errno == EINPROGRESS)
	230	r = -EAGAIN;
	231	} else
	232	s->tfo_salen = 0; /* connection is made */
f6c9c5f8	233	} else {
91ccab1e	234	r = writev(s->fd, iov, iovcnt);
f6c9c5f8 IT	235	if (r < 0)
	236	r = -errno;
	237	}
91ccab1e IT	238
	239	return r;
	240	}
	241
5d67a7ae IT	242	static ssize_t dns_stream_read(DnsStream s, void buf, size_t count) {
	243	ssize_t ss;
	244
56ddbf10	245	#if ENABLE_DNS_OVER_TLS
6016fcb0 IT	246	if (s->encrypted)
	247	ss = dnstls_stream_read(s, buf, count);
	248	else
5d67a7ae	249	#endif
f6c9c5f8	250	{
5d67a7ae	251	ss = read(s->fd, buf, count);
f6c9c5f8 IT	252	if (ss < 0)
	253	ss = -errno;
	254	}
5d67a7ae IT	255
	256	return ss;
	257	}
	258
623a4c97 LP	259	static int on_stream_timeout(sd_event_source es, usec_t usec, void userdata) {
	260	DnsStream *s = userdata;
	261
	262	assert(s);
	263
b914e211	264	return dns_stream_complete(s, ETIMEDOUT);
623a4c97 LP	265	}
	266
	267	static int on_stream_io(sd_event_source es, int fd, uint32_t revents, void userdata) {
	268	DnsStream *s = userdata;
	269	int r;
	270
	271	assert(s);
	272
56ddbf10	273	#if ENABLE_DNS_OVER_TLS
6016fcb0 IT	274	if (s->encrypted) {
6016fcb0 IT	275	r = dnstls_stream_on_io(s);
5d67a7ae	276
6016fcb0 IT	277	if (r == DNSTLS_STREAM_CLOSED \|\| r == -EAGAIN)
	278	return 0;
	279	else if (r < 0)
	280	return dns_stream_complete(s, -r);
5d67a7ae IT	281	}
	282	#endif
	283
91ccab1e IT	284	/* only identify after connecting */
	285	if (s->tfo_salen == 0) {
	286	r = dns_stream_identify(s);
	287	if (r < 0)
	288	return dns_stream_complete(s, -r);
	289	}
b914e211	290
623a4c97 LP	291	if ((revents & EPOLLOUT) &&
	292	s->write_packet &&
	293	s->n_written < sizeof(s->write_size) + s->write_packet->size) {
	294
	295	struct iovec iov[2];
	296	ssize_t ss;
	297
	298	iov[0].iov_base = &s->write_size;
	299	iov[0].iov_len = sizeof(s->write_size);
	300	iov[1].iov_base = DNS_PACKET_DATA(s->write_packet);
	301	iov[1].iov_len = s->write_packet->size;
	302
	303	IOVEC_INCREMENT(iov, 2, s->n_written);
	304
5d67a7ae	305	ss = dns_stream_writev(s, iov, 2, 0);
623a4c97	306	if (ss < 0) {
f6c9c5f8 IT	307	if (!IN_SET(-ss, EINTR, EAGAIN))
f6c9c5f8 IT	308	return dns_stream_complete(s, -ss);
623a4c97 LP	309	} else
	310	s->n_written += ss;
	311
	312	/* Are we done? If so, disable the event source for EPOLLOUT */
	313	if (s->n_written >= sizeof(s->write_size) + s->write_packet->size) {
	314	r = dns_stream_update_io(s);
	315	if (r < 0)
b914e211	316	return dns_stream_complete(s, -r);
623a4c97 LP	317	}
	318	}
	319
	320	if ((revents & (EPOLLIN\|EPOLLHUP\|EPOLLRDHUP)) &&
	321	(!s->read_packet \|\|
	322	s->n_read < sizeof(s->read_size) + s->read_packet->size)) {
	323
	324	if (s->n_read < sizeof(s->read_size)) {
	325	ssize_t ss;
	326
5d67a7ae	327	ss = dns_stream_read(s, (uint8_t*) &s->read_size + s->n_read, sizeof(s->read_size) - s->n_read);
623a4c97	328	if (ss < 0) {
f6c9c5f8 IT	329	if (!IN_SET(-ss, EINTR, EAGAIN))
f6c9c5f8 IT	330	return dns_stream_complete(s, -ss);
623a4c97	331	} else if (ss == 0)
b914e211	332	return dns_stream_complete(s, ECONNRESET);
623a4c97 LP	333	else
	334	s->n_read += ss;
	335	}
	336
	337	if (s->n_read >= sizeof(s->read_size)) {
	338
	339	if (be16toh(s->read_size) < DNS_PACKET_HEADER_SIZE)
b914e211	340	return dns_stream_complete(s, EBADMSG);
623a4c97 LP	341
	342	if (s->n_read < sizeof(s->read_size) + be16toh(s->read_size)) {
	343	ssize_t ss;
	344
	345	if (!s->read_packet) {
51027656	346	r = dns_packet_new(&s->read_packet, s->protocol, be16toh(s->read_size), DNS_PACKET_SIZE_MAX);
623a4c97	347	if (r < 0)
b914e211	348	return dns_stream_complete(s, -r);
623a4c97 LP	349
	350	s->read_packet->size = be16toh(s->read_size);
	351	s->read_packet->ipproto = IPPROTO_TCP;
	352	s->read_packet->family = s->peer.sa.sa_family;
	353	s->read_packet->ttl = s->ttl;
	354	s->read_packet->ifindex = s->ifindex;
	355
	356	if (s->read_packet->family == AF_INET) {
	357	s->read_packet->sender.in = s->peer.in.sin_addr;
	358	s->read_packet->sender_port = be16toh(s->peer.in.sin_port);
	359	s->read_packet->destination.in = s->local.in.sin_addr;
	360	s->read_packet->destination_port = be16toh(s->local.in.sin_port);
	361	} else {
	362	assert(s->read_packet->family == AF_INET6);
	363	s->read_packet->sender.in6 = s->peer.in6.sin6_addr;
	364	s->read_packet->sender_port = be16toh(s->peer.in6.sin6_port);
	365	s->read_packet->destination.in6 = s->local.in6.sin6_addr;
	366	s->read_packet->destination_port = be16toh(s->local.in6.sin6_port);
	367
	368	if (s->read_packet->ifindex == 0)
	369	s->read_packet->ifindex = s->peer.in6.sin6_scope_id;
	370	if (s->read_packet->ifindex == 0)
	371	s->read_packet->ifindex = s->local.in6.sin6_scope_id;
	372	}
	373	}
	374
5d67a7ae	375	ss = dns_stream_read(s,
623a4c97 LP	376	(uint8_t*) DNS_PACKET_DATA(s->read_packet) + s->n_read - sizeof(s->read_size),
	377	sizeof(s->read_size) + be16toh(s->read_size) - s->n_read);
	378	if (ss < 0) {
ec2ce0c5	379	if (!IN_SET(errno, EINTR, EAGAIN))
b914e211	380	return dns_stream_complete(s, errno);
623a4c97	381	} else if (ss == 0)
b914e211	382	return dns_stream_complete(s, ECONNRESET);
623a4c97 LP	383	else
	384	s->n_read += ss;
	385	}
	386
	387	/* Are we done? If so, disable the event source for EPOLLIN */
	388	if (s->n_read >= sizeof(s->read_size) + be16toh(s->read_size)) {
623a4c97 LP	389	/* If there's a packet handler
	390	* installed, call that. Note that
	391	* this is optional... */
98767d75 IT	392	if (s->on_packet) {
	393	r = s->on_packet(s);
	394	if (r < 0)
	395	return r;
	396	}
	397
	398	r = dns_stream_update_io(s);
	399	if (r < 0)
	400	return dns_stream_complete(s, -r);
623a4c97 LP	401	}
	402	}
	403	}
	404
	405	if ((s->write_packet && s->n_written >= sizeof(s->write_size) + s->write_packet->size) &&
	406	(s->read_packet && s->n_read >= sizeof(s->read_size) + s->read_packet->size))
b914e211	407	return dns_stream_complete(s, 0);
623a4c97 LP	408
	409	return 0;
	410	}
	411
b30bf55d	412	DnsStream dns_stream_unref(DnsStream s) {
98767d75 IT	413	DnsPacket *p;
	414	Iterator i;
	415
623a4c97 LP	416	if (!s)
	417	return NULL;
	418
b30bf55d LP	419	assert(s->n_ref > 0);
	420	s->n_ref--;
	421
	422	if (s->n_ref > 0)
	423	return NULL;
	424
623a4c97 LP	425	dns_stream_stop(s);
623a4c97 LP	426
98767d75 IT	427	if (s->server && s->server->stream == s)
	428	s->server->stream = NULL;
	429
623a4c97 LP	430	if (s->manager) {
	431	LIST_REMOVE(streams, s->manager->dns_streams, s);
	432	s->manager->n_dns_streams--;
	433	}
	434
56ddbf10	435	#if ENABLE_DNS_OVER_TLS
6016fcb0 IT	436	if (s->encrypted)
6016fcb0 IT	437	dnstls_stream_free(s);
5d67a7ae IT	438	#endif
5d67a7ae IT	439
98767d75 IT	440	ORDERED_SET_FOREACH(p, s->write_queue, i)
	441	dns_packet_unref(ordered_set_remove(s->write_queue, p));
	442
623a4c97 LP	443	dns_packet_unref(s->write_packet);
623a4c97 LP	444	dns_packet_unref(s->read_packet);
98767d75 IT	445	dns_server_unref(s->server);
	446
	447	ordered_set_free(s->write_queue);
623a4c97	448
6b430fdb	449	return mfree(s);
623a4c97 LP	450	}
623a4c97 LP	451
b30bf55d LP	452	DnsStream dns_stream_ref(DnsStream s) {
	453	if (!s)
	454	return NULL;
	455
	456	assert(s->n_ref > 0);
	457	s->n_ref++;
	458
	459	return s;
	460	}
623a4c97	461
91ccab1e	462	int dns_stream_new(Manager m, DnsStream ret, DnsProtocol protocol, int fd, const union sockaddr_union tfo_address) {
b30bf55d	463	_cleanup_(dns_stream_unrefp) DnsStream *s = NULL;
623a4c97 LP	464	int r;
	465
	466	assert(m);
	467	assert(fd >= 0);
	468
	469	if (m->n_dns_streams > DNS_STREAMS_MAX)
	470	return -EBUSY;
	471
	472	s = new0(DnsStream, 1);
	473	if (!s)
	474	return -ENOMEM;
	475
98767d75 IT	476	r = ordered_set_ensure_allocated(&s->write_queue, &dns_packet_hash_ops);
	477	if (r < 0)
	478	return r;
	479
b30bf55d	480	s->n_ref = 1;
623a4c97 LP	481	s->fd = -1;
	482	s->protocol = protocol;
	483
623a4c97 LP	484	r = sd_event_add_io(m->event, &s->io_event_source, fd, EPOLLIN, on_stream_io, s);
	485	if (r < 0)
	486	return r;
	487
aa4a9deb LP	488	(void) sd_event_source_set_description(s->io_event_source, "dns-stream-io");
aa4a9deb LP	489
9a015429 LP	490	r = sd_event_add_time(
	491	m->event,
	492	&s->timeout_event_source,
	493	clock_boottime_or_monotonic(),
	494	now(clock_boottime_or_monotonic()) + DNS_STREAM_TIMEOUT_USEC, 0,
	495	on_stream_timeout, s);
623a4c97 LP	496	if (r < 0)
	497	return r;
	498
aa4a9deb LP	499	(void) sd_event_source_set_description(s->timeout_event_source, "dns-stream-timeout");
aa4a9deb LP	500
623a4c97 LP	501	LIST_PREPEND(streams, m->dns_streams, s);
	502	s->manager = m;
	503	s->fd = fd;
91ccab1e IT	504	if (tfo_address) {
	505	s->tfo_address = *tfo_address;
	506	s->tfo_salen = tfo_address->sa.sa_family == AF_INET6 ? sizeof(tfo_address->in6) : sizeof(tfo_address->in);
	507	}
	508
623a4c97 LP	509	m->n_dns_streams++;
623a4c97 LP	510
1cc6c93a	511	*ret = TAKE_PTR(s);
623a4c97 LP	512
	513	return 0;
	514	}
	515
	516	int dns_stream_write_packet(DnsStream s, DnsPacket p) {
98767d75 IT	517	int r;
98767d75 IT	518
623a4c97 LP	519	assert(s);
623a4c97 LP	520
98767d75 IT	521	r = ordered_set_put(s->write_queue, p);
	522	if (r < 0)
	523	return r;
623a4c97	524
98767d75	525	dns_packet_ref(p);
623a4c97 LP	526
	527	return dns_stream_update_io(s);
	528	}