src/resolve/resolved-dns-stream.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2
   3 #include <netinet/tcp.h>
   4
   5 #include "alloc-util.h"
   6 #include "fd-util.h"
   7 #include "io-util.h"
   8 #include "missing.h"
   9 #include "resolved-dns-stream.h"
  10
  11 #define DNS_STREAM_TIMEOUT_USEC (10 * USEC_PER_SEC)
  12 #define DNS_STREAMS_MAX 128
  13
  14 #define WRITE_TLS_DATA 1
  15
  16 static void dns_stream_stop(DnsStream *s) {
  17         assert(s);
  18
  19         s->io_event_source = sd_event_source_unref(s->io_event_source);
  20         s->timeout_event_source = sd_event_source_unref(s->timeout_event_source);
  21         s->fd = safe_close(s->fd);
  22 }
  23
  24 static int dns_stream_update_io(DnsStream *s) {
  25         int f = 0;
  26
  27         assert(s);
  28
  29         if (s->write_packet && s->n_written < sizeof(s->write_size) + s->write_packet->size)
  30                 f |= EPOLLOUT;
  31         else if (!ordered_set_isempty(s->write_queue)) {
  32                 dns_packet_unref(s->write_packet);
  33                 s->write_packet = ordered_set_steal_first(s->write_queue);
  34                 s->write_size = htobe16(s->write_packet->size);
  35                 s->n_written = 0;
  36                 f |= EPOLLOUT;
  37         }
  38         if (!s->read_packet || s->n_read < sizeof(s->read_size) + s->read_packet->size)
  39                 f |= EPOLLIN;
  40
  41         return sd_event_source_set_io_events(s->io_event_source, f);
  42 }
  43
  44 static int dns_stream_complete(DnsStream *s, int error) {
  45         assert(s);
  46
  47 #if ENABLE_DNS_OVER_TLS
  48         if (s->tls_session && IN_SET(error, ETIMEDOUT, 0)) {
  49                 int r;
  50
  51                 r = gnutls_bye(s->tls_session, GNUTLS_SHUT_RDWR);
  52                 if (r == GNUTLS_E_AGAIN && !s->tls_bye) {
  53                         dns_stream_ref(s); /* keep reference for closing TLS session */
  54                         s->tls_bye = true;
  55                 } else
  56                         dns_stream_stop(s);
  57         } else
  58 #endif
  59                 dns_stream_stop(s);
  60
  61         if (s->complete)
  62                 s->complete(s, error);
  63         else /* the default action if no completion function is set is to close the stream */
  64                 dns_stream_unref(s);
  65
  66         return 0;
  67 }
  68
  69 static int dns_stream_identify(DnsStream *s) {
  70         union {
  71                 struct cmsghdr header; /* For alignment */
  72                 uint8_t buffer[CMSG_SPACE(MAXSIZE(struct in_pktinfo, struct in6_pktinfo))
  73                                + EXTRA_CMSG_SPACE /* kernel appears to require extra space */];
  74         } control;
  75         struct msghdr mh = {};
  76         struct cmsghdr *cmsg;
  77         socklen_t sl;
  78         int r;
  79
  80         assert(s);
  81
  82         if (s->identified)
  83                 return 0;
  84
  85         /* Query the local side */
  86         s->local_salen = sizeof(s->local);
  87         r = getsockname(s->fd, &s->local.sa, &s->local_salen);
  88         if (r < 0)
  89                 return -errno;
  90         if (s->local.sa.sa_family == AF_INET6 && s->ifindex <= 0)
  91                 s->ifindex = s->local.in6.sin6_scope_id;
  92
  93         /* Query the remote side */
  94         s->peer_salen = sizeof(s->peer);
  95         r = getpeername(s->fd, &s->peer.sa, &s->peer_salen);
  96         if (r < 0)
  97                 return -errno;
  98         if (s->peer.sa.sa_family == AF_INET6 && s->ifindex <= 0)
  99                 s->ifindex = s->peer.in6.sin6_scope_id;
 100
 101         /* Check consistency */
 102         assert(s->peer.sa.sa_family == s->local.sa.sa_family);
 103         assert(IN_SET(s->peer.sa.sa_family, AF_INET, AF_INET6));
 104
 105         /* Query connection meta information */
 106         sl = sizeof(control);
 107         if (s->peer.sa.sa_family == AF_INET) {
 108                 r = getsockopt(s->fd, IPPROTO_IP, IP_PKTOPTIONS, &control, &sl);
 109                 if (r < 0)
 110                         return -errno;
 111         } else if (s->peer.sa.sa_family == AF_INET6) {
 112
 113                 r = getsockopt(s->fd, IPPROTO_IPV6, IPV6_2292PKTOPTIONS, &control, &sl);
 114                 if (r < 0)
 115                         return -errno;
 116         } else
 117                 return -EAFNOSUPPORT;
 118
 119         mh.msg_control = &control;
 120         mh.msg_controllen = sl;
 121
 122         CMSG_FOREACH(cmsg, &mh) {
 123
 124                 if (cmsg->cmsg_level == IPPROTO_IPV6) {
 125                         assert(s->peer.sa.sa_family == AF_INET6);
 126
 127                         switch (cmsg->cmsg_type) {
 128
 129                         case IPV6_PKTINFO: {
 130                                 struct in6_pktinfo *i = (struct in6_pktinfo*) CMSG_DATA(cmsg);
 131
 132                                 if (s->ifindex <= 0)
 133                                         s->ifindex = i->ipi6_ifindex;
 134                                 break;
 135                         }
 136
 137                         case IPV6_HOPLIMIT:
 138                                 s->ttl = *(int *) CMSG_DATA(cmsg);
 139                                 break;
 140                         }
 141
 142                 } else if (cmsg->cmsg_level == IPPROTO_IP) {
 143                         assert(s->peer.sa.sa_family == AF_INET);
 144
 145                         switch (cmsg->cmsg_type) {
 146
 147                         case IP_PKTINFO: {
 148                                 struct in_pktinfo *i = (struct in_pktinfo*) CMSG_DATA(cmsg);
 149
 150                                 if (s->ifindex <= 0)
 151                                         s->ifindex = i->ipi_ifindex;
 152                                 break;
 153                         }
 154
 155                         case IP_TTL:
 156                                 s->ttl = *(int *) CMSG_DATA(cmsg);
 157                                 break;
 158                         }
 159                 }
 160         }
 161
 162         /* The Linux kernel sets the interface index to the loopback
 163          * device if the connection came from the local host since it
 164          * avoids the routing table in such a case. Let's unset the
 165          * interface index in such a case. */
 166         if (s->ifindex == LOOPBACK_IFINDEX)
 167                 s->ifindex = 0;
 168
 169         /* If we don't know the interface index still, we look for the
 170          * first local interface with a matching address. Yuck! */
 171         if (s->ifindex <= 0)
 172                 s->ifindex = manager_find_ifindex(s->manager, s->local.sa.sa_family, s->local.sa.sa_family == AF_INET ? (union in_addr_union*) &s->local.in.sin_addr : (union in_addr_union*)  &s->local.in6.sin6_addr);
 173
 174         if (s->protocol == DNS_PROTOCOL_LLMNR && s->ifindex > 0) {
 175                 uint32_t ifindex = htobe32(s->ifindex);
 176
 177                 /* Make sure all packets for this connection are sent on the same interface */
 178                 if (s->local.sa.sa_family == AF_INET) {
 179                         r = setsockopt(s->fd, IPPROTO_IP, IP_UNICAST_IF, &ifindex, sizeof(ifindex));
 180                         if (r < 0)
 181                                 log_debug_errno(errno, "Failed to invoke IP_UNICAST_IF: %m");
 182                 } else if (s->local.sa.sa_family == AF_INET6) {
 183                         r = setsockopt(s->fd, IPPROTO_IPV6, IPV6_UNICAST_IF, &ifindex, sizeof(ifindex));
 184                         if (r < 0)
 185                                 log_debug_errno(errno, "Failed to invoke IPV6_UNICAST_IF: %m");
 186                 }
 187         }
 188
 189         s->identified = true;
 190
 191         return 0;
 192 }
 193
 194 static ssize_t dns_stream_writev(DnsStream *s, const struct iovec *iov, size_t iovcnt, int flags) {
 195         ssize_t r;
 196
 197         assert(s);
 198         assert(iov);
 199
 200 #if ENABLE_DNS_OVER_TLS
 201         if (s->tls_session && !(flags & WRITE_TLS_DATA)) {
 202                 ssize_t ss;
 203                 size_t i;
 204
 205                 r = 0;
 206                 for (i = 0; i < iovcnt; i++) {
 207                         ss = gnutls_record_send(s->tls_session, iov[i].iov_base, iov[i].iov_len);
 208                         if (ss < 0) {
 209                                 switch(ss) {
 210
 211                                 case GNUTLS_E_INTERRUPTED:
 212                                         return -EINTR;
 213                                 case GNUTLS_E_AGAIN:
 214                                         return -EAGAIN;
 215                                 default:
 216                                         log_debug("Failed to invoke gnutls_record_send: %s", gnutls_strerror(ss));
 217                                         return -EIO;
 218                                 }
 219                         }
 220
 221                         r += ss;
 222                         if (ss != (ssize_t) iov[i].iov_len)
 223                                 continue;
 224                 }
 225         } else
 226 #endif
 227         if (s->tfo_salen > 0) {
 228                 struct msghdr hdr = {
 229                         .msg_iov = (struct iovec*) iov,
 230                         .msg_iovlen = iovcnt,
 231                         .msg_name = &s->tfo_address.sa,
 232                         .msg_namelen = s->tfo_salen
 233                 };
 234
 235                 r = sendmsg(s->fd, &hdr, MSG_FASTOPEN);
 236                 if (r < 0) {
 237                         if (errno == EOPNOTSUPP) {
 238                                 s->tfo_salen = 0;
 239                                 r = connect(s->fd, &s->tfo_address.sa, s->tfo_salen);
 240                                 if (r < 0)
 241                                         return -errno;
 242
 243                                 r = -EAGAIN;
 244                         } else if (errno == EINPROGRESS)
 245                                 r = -EAGAIN;
 246                 } else
 247                         s->tfo_salen = 0; /* connection is made */
 248         } else {
 249                 r = writev(s->fd, iov, iovcnt);
 250                 if (r < 0)
 251                         r = -errno;
 252         }
 253
 254         return r;
 255 }
 256
 257 static ssize_t dns_stream_read(DnsStream *s, void *buf, size_t count) {
 258         ssize_t ss;
 259
 260 #if ENABLE_DNS_OVER_TLS
 261         if (s->tls_session) {
 262                 ss = gnutls_record_recv(s->tls_session, buf, count);
 263                 if (ss < 0) {
 264                         switch(ss) {
 265
 266                         case GNUTLS_E_INTERRUPTED:
 267                                 return -EINTR;
 268                         case GNUTLS_E_AGAIN:
 269                                 return -EAGAIN;
 270                         default:
 271                                 log_debug("Failed to invoke gnutls_record_send: %s", gnutls_strerror(ss));
 272                                 return -EIO;
 273                         }
 274                 } else if (s->on_connection) {
 275                         int r;
 276
 277                         r = s->on_connection(s);
 278                         s->on_connection = NULL; /* only call once */
 279                         if (r < 0)
 280                                 return r;
 281                 }
 282         } else
 283 #endif
 284         {
 285                 ss = read(s->fd, buf, count);
 286                 if (ss < 0)
 287                         ss = -errno;
 288         }
 289
 290         return ss;
 291 }
 292
 293 #if ENABLE_DNS_OVER_TLS
 294 static ssize_t dns_stream_tls_writev(gnutls_transport_ptr_t p, const giovec_t * iov, int iovcnt) {
 295         int r;
 296
 297         assert(p);
 298
 299         r = dns_stream_writev((DnsStream*) p, (struct iovec*) iov, iovcnt, WRITE_TLS_DATA);
 300         if (r < 0) {
 301                 errno = -r;
 302                 return -1;
 303         }
 304
 305         return r;
 306 }
 307 #endif
 308
 309 static int on_stream_timeout(sd_event_source *es, usec_t usec, void *userdata) {
 310         DnsStream *s = userdata;
 311
 312         assert(s);
 313
 314         return dns_stream_complete(s, ETIMEDOUT);
 315 }
 316
 317 static int on_stream_io(sd_event_source *es, int fd, uint32_t revents, void *userdata) {
 318         DnsStream *s = userdata;
 319         int r;
 320
 321         assert(s);
 322
 323 #if ENABLE_DNS_OVER_TLS
 324         if (s->tls_bye) {
 325                 assert(s->tls_session);
 326
 327                 r = gnutls_bye(s->tls_session, GNUTLS_SHUT_RDWR);
 328                 if (r != GNUTLS_E_AGAIN) {
 329                         s->tls_bye = false;
 330                         dns_stream_unref(s);
 331                 }
 332
 333                 return 0;
 334         }
 335
 336         if (s->tls_handshake < 0) {
 337                 assert(s->tls_session);
 338
 339                 s->tls_handshake = gnutls_handshake(s->tls_session);
 340                 if (s->tls_handshake >= 0) {
 341                         if (s->on_connection && !(gnutls_session_get_flags(s->tls_session) & GNUTLS_SFLAGS_FALSE_START)) {
 342                                 r = s->on_connection(s);
 343                                 s->on_connection = NULL; /* only call once */
 344                                 if (r < 0)
 345                                         return r;
 346                         }
 347                 } else {
 348                         if (gnutls_error_is_fatal(s->tls_handshake))
 349                                 return dns_stream_complete(s, ECONNREFUSED);
 350                         else
 351                                 return 0;
 352                 }
 353
 354         }
 355 #endif
 356
 357         /* only identify after connecting */
 358         if (s->tfo_salen == 0) {
 359                 r = dns_stream_identify(s);
 360                 if (r < 0)
 361                         return dns_stream_complete(s, -r);
 362         }
 363
 364         if ((revents & EPOLLOUT) &&
 365             s->write_packet &&
 366             s->n_written < sizeof(s->write_size) + s->write_packet->size) {
 367
 368                 struct iovec iov[2];
 369                 ssize_t ss;
 370
 371                 iov[0].iov_base = &s->write_size;
 372                 iov[0].iov_len = sizeof(s->write_size);
 373                 iov[1].iov_base = DNS_PACKET_DATA(s->write_packet);
 374                 iov[1].iov_len = s->write_packet->size;
 375
 376                 IOVEC_INCREMENT(iov, 2, s->n_written);
 377
 378                 ss = dns_stream_writev(s, iov, 2, 0);
 379                 if (ss < 0) {
 380                         if (!IN_SET(-ss, EINTR, EAGAIN))
 381                                 return dns_stream_complete(s, -ss);
 382                 } else
 383                         s->n_written += ss;
 384
 385                 /* Are we done? If so, disable the event source for EPOLLOUT */
 386                 if (s->n_written >= sizeof(s->write_size) + s->write_packet->size) {
 387                         r = dns_stream_update_io(s);
 388                         if (r < 0)
 389                                 return dns_stream_complete(s, -r);
 390                 }
 391         }
 392
 393         if ((revents & (EPOLLIN|EPOLLHUP|EPOLLRDHUP)) &&
 394             (!s->read_packet ||
 395              s->n_read < sizeof(s->read_size) + s->read_packet->size)) {
 396
 397                 if (s->n_read < sizeof(s->read_size)) {
 398                         ssize_t ss;
 399
 400                         ss = dns_stream_read(s, (uint8_t*) &s->read_size + s->n_read, sizeof(s->read_size) - s->n_read);
 401                         if (ss < 0) {
 402                                 if (!IN_SET(-ss, EINTR, EAGAIN))
 403                                         return dns_stream_complete(s, -ss);
 404                         } else if (ss == 0)
 405                                 return dns_stream_complete(s, ECONNRESET);
 406                         else
 407                                 s->n_read += ss;
 408                 }
 409
 410                 if (s->n_read >= sizeof(s->read_size)) {
 411
 412                         if (be16toh(s->read_size) < DNS_PACKET_HEADER_SIZE)
 413                                 return dns_stream_complete(s, EBADMSG);
 414
 415                         if (s->n_read < sizeof(s->read_size) + be16toh(s->read_size)) {
 416                                 ssize_t ss;
 417
 418                                 if (!s->read_packet) {
 419                                         r = dns_packet_new(&s->read_packet, s->protocol, be16toh(s->read_size), DNS_PACKET_SIZE_MAX);
 420                                         if (r < 0)
 421                                                 return dns_stream_complete(s, -r);
 422
 423                                         s->read_packet->size = be16toh(s->read_size);
 424                                         s->read_packet->ipproto = IPPROTO_TCP;
 425                                         s->read_packet->family = s->peer.sa.sa_family;
 426                                         s->read_packet->ttl = s->ttl;
 427                                         s->read_packet->ifindex = s->ifindex;
 428
 429                                         if (s->read_packet->family == AF_INET) {
 430                                                 s->read_packet->sender.in = s->peer.in.sin_addr;
 431                                                 s->read_packet->sender_port = be16toh(s->peer.in.sin_port);
 432                                                 s->read_packet->destination.in = s->local.in.sin_addr;
 433                                                 s->read_packet->destination_port = be16toh(s->local.in.sin_port);
 434                                         } else {
 435                                                 assert(s->read_packet->family == AF_INET6);
 436                                                 s->read_packet->sender.in6 = s->peer.in6.sin6_addr;
 437                                                 s->read_packet->sender_port = be16toh(s->peer.in6.sin6_port);
 438                                                 s->read_packet->destination.in6 = s->local.in6.sin6_addr;
 439                                                 s->read_packet->destination_port = be16toh(s->local.in6.sin6_port);
 440
 441                                                 if (s->read_packet->ifindex == 0)
 442                                                         s->read_packet->ifindex = s->peer.in6.sin6_scope_id;
 443                                                 if (s->read_packet->ifindex == 0)
 444                                                         s->read_packet->ifindex = s->local.in6.sin6_scope_id;
 445                                         }
 446                                 }
 447
 448                                 ss = dns_stream_read(s,
 449                                           (uint8_t*) DNS_PACKET_DATA(s->read_packet) + s->n_read - sizeof(s->read_size),
 450                                           sizeof(s->read_size) + be16toh(s->read_size) - s->n_read);
 451                                 if (ss < 0) {
 452                                         if (!IN_SET(errno, EINTR, EAGAIN))
 453                                                 return dns_stream_complete(s, errno);
 454                                 } else if (ss == 0)
 455                                         return dns_stream_complete(s, ECONNRESET);
 456                                 else
 457                                         s->n_read += ss;
 458                         }
 459
 460                         /* Are we done? If so, disable the event source for EPOLLIN */
 461                         if (s->n_read >= sizeof(s->read_size) + be16toh(s->read_size)) {
 462                                 /* If there's a packet handler
 463                                  * installed, call that. Note that
 464                                  * this is optional... */
 465                                 if (s->on_packet) {
 466                                         r = s->on_packet(s);
 467                                         if (r < 0)
 468                                                 return r;
 469                                 }
 470
 471                                 r = dns_stream_update_io(s);
 472                                 if (r < 0)
 473                                         return dns_stream_complete(s, -r);
 474                         }
 475                 }
 476         }
 477
 478         if ((s->write_packet && s->n_written >= sizeof(s->write_size) + s->write_packet->size) &&
 479             (s->read_packet && s->n_read >= sizeof(s->read_size) + s->read_packet->size))
 480                 return dns_stream_complete(s, 0);
 481
 482         return 0;
 483 }
 484
 485 DnsStream *dns_stream_unref(DnsStream *s) {
 486         DnsPacket *p;
 487         Iterator i;
 488
 489         if (!s)
 490                 return NULL;
 491
 492         assert(s->n_ref > 0);
 493         s->n_ref--;
 494
 495         if (s->n_ref > 0)
 496                 return NULL;
 497
 498         dns_stream_stop(s);
 499
 500         if (s->server && s->server->stream == s)
 501                 s->server->stream = NULL;
 502
 503         if (s->manager) {
 504                 LIST_REMOVE(streams, s->manager->dns_streams, s);
 505                 s->manager->n_dns_streams--;
 506         }
 507
 508 #if ENABLE_DNS_OVER_TLS
 509         if (s->tls_session)
 510                 gnutls_deinit(s->tls_session);
 511 #endif
 512
 513         ORDERED_SET_FOREACH(p, s->write_queue, i)
 514                 dns_packet_unref(ordered_set_remove(s->write_queue, p));
 515
 516         dns_packet_unref(s->write_packet);
 517         dns_packet_unref(s->read_packet);
 518         dns_server_unref(s->server);
 519
 520         ordered_set_free(s->write_queue);
 521
 522         return mfree(s);
 523 }
 524
 525 DnsStream *dns_stream_ref(DnsStream *s) {
 526         if (!s)
 527                 return NULL;
 528
 529         assert(s->n_ref > 0);
 530         s->n_ref++;
 531
 532         return s;
 533 }
 534
 535 int dns_stream_new(Manager *m, DnsStream **ret, DnsProtocol protocol, int fd, const union sockaddr_union *tfo_address) {
 536         _cleanup_(dns_stream_unrefp) DnsStream *s = NULL;
 537         int r;
 538
 539         assert(m);
 540         assert(fd >= 0);
 541
 542         if (m->n_dns_streams > DNS_STREAMS_MAX)
 543                 return -EBUSY;
 544
 545         s = new0(DnsStream, 1);
 546         if (!s)
 547                 return -ENOMEM;
 548
 549         r = ordered_set_ensure_allocated(&s->write_queue, &dns_packet_hash_ops);
 550         if (r < 0)
 551                 return r;
 552
 553         s->n_ref = 1;
 554         s->fd = -1;
 555         s->protocol = protocol;
 556
 557         r = sd_event_add_io(m->event, &s->io_event_source, fd, EPOLLIN, on_stream_io, s);
 558         if (r < 0)
 559                 return r;
 560
 561         (void) sd_event_source_set_description(s->io_event_source, "dns-stream-io");
 562
 563         r = sd_event_add_time(
 564                         m->event,
 565                         &s->timeout_event_source,
 566                         clock_boottime_or_monotonic(),
 567                         now(clock_boottime_or_monotonic()) + DNS_STREAM_TIMEOUT_USEC, 0,
 568                         on_stream_timeout, s);
 569         if (r < 0)
 570                 return r;
 571
 572         (void) sd_event_source_set_description(s->timeout_event_source, "dns-stream-timeout");
 573
 574         LIST_PREPEND(streams, m->dns_streams, s);
 575         s->manager = m;
 576         s->fd = fd;
 577         if (tfo_address) {
 578                 s->tfo_address = *tfo_address;
 579                 s->tfo_salen = tfo_address->sa.sa_family == AF_INET6 ? sizeof(tfo_address->in6) : sizeof(tfo_address->in);
 580         }
 581
 582         m->n_dns_streams++;
 583
 584         *ret = TAKE_PTR(s);
 585
 586         return 0;
 587 }
 588
 589 #if ENABLE_DNS_OVER_TLS
 590 int dns_stream_connect_tls(DnsStream *s, gnutls_session_t tls_session) {
 591         gnutls_transport_set_ptr2(tls_session, (gnutls_transport_ptr_t) (long) s->fd, s);
 592         gnutls_transport_set_vec_push_function(tls_session, &dns_stream_tls_writev);
 593
 594         s->encrypted = true;
 595         s->tls_session = tls_session;
 596         s->tls_handshake = gnutls_handshake(tls_session);
 597         if (s->tls_handshake < 0 && gnutls_error_is_fatal(s->tls_handshake))
 598                 return -ECONNREFUSED;
 599
 600         return 0;
 601 }
 602 #endif
 603
 604 int dns_stream_write_packet(DnsStream *s, DnsPacket *p) {
 605         int r;
 606
 607         assert(s);
 608
 609         r = ordered_set_put(s->write_queue, p);
 610         if (r < 0)
 611                 return r;
 612
 613         dns_packet_ref(p);
 614
 615         return dns_stream_update_io(s);
 616 }