src/resolve/resolved-dns-stream.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2
   3 #include <netinet/tcp.h>
   4
   5 #include "alloc-util.h"
   6 #include "fd-util.h"
   7 #include "io-util.h"
   8 #include "missing.h"
   9 #include "resolved-dns-stream.h"
  10
  11 #define DNS_STREAM_TIMEOUT_USEC (10 * USEC_PER_SEC)
  12 #define DNS_STREAMS_MAX 128
  13
  14 static void dns_stream_stop(DnsStream *s) {
  15         assert(s);
  16
  17         s->io_event_source = sd_event_source_unref(s->io_event_source);
  18         s->timeout_event_source = sd_event_source_unref(s->timeout_event_source);
  19         s->fd = safe_close(s->fd);
  20
  21         /* Disconnect us from the server object if we are now not usable anymore */
  22         dns_stream_detach(s);
  23 }
  24
  25 static int dns_stream_update_io(DnsStream *s) {
  26         int f = 0;
  27
  28         assert(s);
  29
  30         if (s->write_packet && s->n_written < sizeof(s->write_size) + s->write_packet->size)
  31                 f |= EPOLLOUT;
  32         else if (!ordered_set_isempty(s->write_queue)) {
  33                 dns_packet_unref(s->write_packet);
  34                 s->write_packet = ordered_set_steal_first(s->write_queue);
  35                 s->write_size = htobe16(s->write_packet->size);
  36                 s->n_written = 0;
  37                 f |= EPOLLOUT;
  38         }
  39         if (!s->read_packet || s->n_read < sizeof(s->read_size) + s->read_packet->size)
  40                 f |= EPOLLIN;
  41
  42 #if ENABLE_DNS_OVER_TLS
  43         /* For handshake and clean closing purposes, TLS can override requested events */
  44         if (s->dnstls_events)
  45                 f = s->dnstls_events;
  46 #endif
  47
  48         return sd_event_source_set_io_events(s->io_event_source, f);
  49 }
  50
  51 static int dns_stream_complete(DnsStream *s, int error) {
  52         _cleanup_(dns_stream_unrefp) _unused_ DnsStream *ref = dns_stream_ref(s); /* Protect stream while we process it */
  53
  54         assert(s);
  55
  56 #if ENABLE_DNS_OVER_TLS
  57         if (s->encrypted) {
  58                 int r;
  59
  60                 r = dnstls_stream_shutdown(s, error);
  61                 if (r != -EAGAIN)
  62                         dns_stream_stop(s);
  63         } else
  64 #endif
  65                 dns_stream_stop(s);
  66
  67         if (s->complete)
  68                 s->complete(s, error);
  69         else /* the default action if no completion function is set is to close the stream */
  70                 dns_stream_unref(s);
  71
  72         return 0;
  73 }
  74
  75 static int dns_stream_identify(DnsStream *s) {
  76         union {
  77                 struct cmsghdr header; /* For alignment */
  78                 uint8_t buffer[CMSG_SPACE(MAXSIZE(struct in_pktinfo, struct in6_pktinfo))
  79                                + EXTRA_CMSG_SPACE /* kernel appears to require extra space */];
  80         } control;
  81         struct msghdr mh = {};
  82         struct cmsghdr *cmsg;
  83         socklen_t sl;
  84         int r;
  85
  86         assert(s);
  87
  88         if (s->identified)
  89                 return 0;
  90
  91         /* Query the local side */
  92         s->local_salen = sizeof(s->local);
  93         r = getsockname(s->fd, &s->local.sa, &s->local_salen);
  94         if (r < 0)
  95                 return -errno;
  96         if (s->local.sa.sa_family == AF_INET6 && s->ifindex <= 0)
  97                 s->ifindex = s->local.in6.sin6_scope_id;
  98
  99         /* Query the remote side */
 100         s->peer_salen = sizeof(s->peer);
 101         r = getpeername(s->fd, &s->peer.sa, &s->peer_salen);
 102         if (r < 0)
 103                 return -errno;
 104         if (s->peer.sa.sa_family == AF_INET6 && s->ifindex <= 0)
 105                 s->ifindex = s->peer.in6.sin6_scope_id;
 106
 107         /* Check consistency */
 108         assert(s->peer.sa.sa_family == s->local.sa.sa_family);
 109         assert(IN_SET(s->peer.sa.sa_family, AF_INET, AF_INET6));
 110
 111         /* Query connection meta information */
 112         sl = sizeof(control);
 113         if (s->peer.sa.sa_family == AF_INET) {
 114                 r = getsockopt(s->fd, IPPROTO_IP, IP_PKTOPTIONS, &control, &sl);
 115                 if (r < 0)
 116                         return -errno;
 117         } else if (s->peer.sa.sa_family == AF_INET6) {
 118
 119                 r = getsockopt(s->fd, IPPROTO_IPV6, IPV6_2292PKTOPTIONS, &control, &sl);
 120                 if (r < 0)
 121                         return -errno;
 122         } else
 123                 return -EAFNOSUPPORT;
 124
 125         mh.msg_control = &control;
 126         mh.msg_controllen = sl;
 127
 128         CMSG_FOREACH(cmsg, &mh) {
 129
 130                 if (cmsg->cmsg_level == IPPROTO_IPV6) {
 131                         assert(s->peer.sa.sa_family == AF_INET6);
 132
 133                         switch (cmsg->cmsg_type) {
 134
 135                         case IPV6_PKTINFO: {
 136                                 struct in6_pktinfo *i = (struct in6_pktinfo*) CMSG_DATA(cmsg);
 137
 138                                 if (s->ifindex <= 0)
 139                                         s->ifindex = i->ipi6_ifindex;
 140                                 break;
 141                         }
 142
 143                         case IPV6_HOPLIMIT:
 144                                 s->ttl = *(int *) CMSG_DATA(cmsg);
 145                                 break;
 146                         }
 147
 148                 } else if (cmsg->cmsg_level == IPPROTO_IP) {
 149                         assert(s->peer.sa.sa_family == AF_INET);
 150
 151                         switch (cmsg->cmsg_type) {
 152
 153                         case IP_PKTINFO: {
 154                                 struct in_pktinfo *i = (struct in_pktinfo*) CMSG_DATA(cmsg);
 155
 156                                 if (s->ifindex <= 0)
 157                                         s->ifindex = i->ipi_ifindex;
 158                                 break;
 159                         }
 160
 161                         case IP_TTL:
 162                                 s->ttl = *(int *) CMSG_DATA(cmsg);
 163                                 break;
 164                         }
 165                 }
 166         }
 167
 168         /* The Linux kernel sets the interface index to the loopback
 169          * device if the connection came from the local host since it
 170          * avoids the routing table in such a case. Let's unset the
 171          * interface index in such a case. */
 172         if (s->ifindex == LOOPBACK_IFINDEX)
 173                 s->ifindex = 0;
 174
 175         /* If we don't know the interface index still, we look for the
 176          * first local interface with a matching address. Yuck! */
 177         if (s->ifindex <= 0)
 178                 s->ifindex = manager_find_ifindex(s->manager, s->local.sa.sa_family, s->local.sa.sa_family == AF_INET ? (union in_addr_union*) &s->local.in.sin_addr : (union in_addr_union*)  &s->local.in6.sin6_addr);
 179
 180         if (s->protocol == DNS_PROTOCOL_LLMNR && s->ifindex > 0) {
 181                 uint32_t ifindex = htobe32(s->ifindex);
 182
 183                 /* Make sure all packets for this connection are sent on the same interface */
 184                 if (s->local.sa.sa_family == AF_INET) {
 185                         r = setsockopt(s->fd, IPPROTO_IP, IP_UNICAST_IF, &ifindex, sizeof(ifindex));
 186                         if (r < 0)
 187                                 log_debug_errno(errno, "Failed to invoke IP_UNICAST_IF: %m");
 188                 } else if (s->local.sa.sa_family == AF_INET6) {
 189                         r = setsockopt(s->fd, IPPROTO_IPV6, IPV6_UNICAST_IF, &ifindex, sizeof(ifindex));
 190                         if (r < 0)
 191                                 log_debug_errno(errno, "Failed to invoke IPV6_UNICAST_IF: %m");
 192                 }
 193         }
 194
 195         s->identified = true;
 196
 197         return 0;
 198 }
 199
 200 ssize_t dns_stream_writev(DnsStream *s, const struct iovec *iov, size_t iovcnt, int flags) {
 201         ssize_t m;
 202
 203         assert(s);
 204         assert(iov);
 205
 206 #if ENABLE_DNS_OVER_TLS
 207         if (s->encrypted && !(flags & DNS_STREAM_WRITE_TLS_DATA)) {
 208                 ssize_t ss;
 209                 size_t i;
 210
 211                 m = 0;
 212                 for (i = 0; i < iovcnt; i++) {
 213                         ss = dnstls_stream_write(s, iov[i].iov_base, iov[i].iov_len);
 214                         if (ss < 0)
 215                                 return ss;
 216
 217                         m += ss;
 218                         if (ss != (ssize_t) iov[i].iov_len)
 219                                 continue;
 220                 }
 221         } else
 222 #endif
 223         if (s->tfo_salen > 0) {
 224                 struct msghdr hdr = {
 225                         .msg_iov = (struct iovec*) iov,
 226                         .msg_iovlen = iovcnt,
 227                         .msg_name = &s->tfo_address.sa,
 228                         .msg_namelen = s->tfo_salen
 229                 };
 230
 231                 m = sendmsg(s->fd, &hdr, MSG_FASTOPEN);
 232                 if (m < 0) {
 233                         if (errno == EOPNOTSUPP) {
 234                                 s->tfo_salen = 0;
 235                                 if (connect(s->fd, &s->tfo_address.sa, s->tfo_salen) < 0)
 236                                         return -errno;
 237
 238                                 return -EAGAIN;
 239                         }
 240                         if (errno == EINPROGRESS)
 241                                 return -EAGAIN;
 242
 243                         return -errno;
 244                 } else
 245                         s->tfo_salen = 0; /* connection is made */
 246         } else {
 247                 m = writev(s->fd, iov, iovcnt);
 248                 if (m < 0)
 249                         return -errno;
 250         }
 251
 252         return m;
 253 }
 254
 255 static ssize_t dns_stream_read(DnsStream *s, void *buf, size_t count) {
 256         ssize_t ss;
 257
 258 #if ENABLE_DNS_OVER_TLS
 259         if (s->encrypted)
 260                 ss = dnstls_stream_read(s, buf, count);
 261         else
 262 #endif
 263         {
 264                 ss = read(s->fd, buf, count);
 265                 if (ss < 0)
 266                         return -errno;
 267         }
 268
 269         return ss;
 270 }
 271
 272 static int on_stream_timeout(sd_event_source *es, usec_t usec, void *userdata) {
 273         DnsStream *s = userdata;
 274
 275         assert(s);
 276
 277         return dns_stream_complete(s, ETIMEDOUT);
 278 }
 279
 280 static int on_stream_io(sd_event_source *es, int fd, uint32_t revents, void *userdata) {
 281         _cleanup_(dns_stream_unrefp) DnsStream *s = dns_stream_ref(userdata); /* Protect stream while we process it */
 282         int r;
 283
 284         assert(s);
 285
 286 #if ENABLE_DNS_OVER_TLS
 287         if (s->encrypted) {
 288                 r = dnstls_stream_on_io(s, revents);
 289                 if (r == DNSTLS_STREAM_CLOSED)
 290                         return 0;
 291                 if (r == -EAGAIN)
 292                         return dns_stream_update_io(s);
 293                 if (r < 0)
 294                         return dns_stream_complete(s, -r);
 295
 296                 r = dns_stream_update_io(s);
 297                 if (r < 0)
 298                         return r;
 299         }
 300 #endif
 301
 302         /* only identify after connecting */
 303         if (s->tfo_salen == 0) {
 304                 r = dns_stream_identify(s);
 305                 if (r < 0)
 306                         return dns_stream_complete(s, -r);
 307         }
 308
 309         if ((revents & EPOLLOUT) &&
 310             s->write_packet &&
 311             s->n_written < sizeof(s->write_size) + s->write_packet->size) {
 312
 313                 struct iovec iov[2];
 314                 ssize_t ss;
 315
 316                 iov[0] = IOVEC_MAKE(&s->write_size, sizeof(s->write_size));
 317                 iov[1] = IOVEC_MAKE(DNS_PACKET_DATA(s->write_packet), s->write_packet->size);
 318
 319                 IOVEC_INCREMENT(iov, 2, s->n_written);
 320
 321                 ss = dns_stream_writev(s, iov, 2, 0);
 322                 if (ss < 0) {
 323                         if (!IN_SET(-ss, EINTR, EAGAIN))
 324                                 return dns_stream_complete(s, -ss);
 325                 } else
 326                         s->n_written += ss;
 327
 328                 /* Are we done? If so, disable the event source for EPOLLOUT */
 329                 if (s->n_written >= sizeof(s->write_size) + s->write_packet->size) {
 330                         r = dns_stream_update_io(s);
 331                         if (r < 0)
 332                                 return dns_stream_complete(s, -r);
 333                 }
 334         }
 335
 336         if ((revents & (EPOLLIN|EPOLLHUP|EPOLLRDHUP)) &&
 337             (!s->read_packet ||
 338              s->n_read < sizeof(s->read_size) + s->read_packet->size)) {
 339
 340                 if (s->n_read < sizeof(s->read_size)) {
 341                         ssize_t ss;
 342
 343                         ss = dns_stream_read(s, (uint8_t*) &s->read_size + s->n_read, sizeof(s->read_size) - s->n_read);
 344                         if (ss < 0) {
 345                                 if (!IN_SET(-ss, EINTR, EAGAIN))
 346                                         return dns_stream_complete(s, -ss);
 347                         } else if (ss == 0)
 348                                 return dns_stream_complete(s, ECONNRESET);
 349                         else
 350                                 s->n_read += ss;
 351                 }
 352
 353                 if (s->n_read >= sizeof(s->read_size)) {
 354
 355                         if (be16toh(s->read_size) < DNS_PACKET_HEADER_SIZE)
 356                                 return dns_stream_complete(s, EBADMSG);
 357
 358                         if (s->n_read < sizeof(s->read_size) + be16toh(s->read_size)) {
 359                                 ssize_t ss;
 360
 361                                 if (!s->read_packet) {
 362                                         r = dns_packet_new(&s->read_packet, s->protocol, be16toh(s->read_size), DNS_PACKET_SIZE_MAX);
 363                                         if (r < 0)
 364                                                 return dns_stream_complete(s, -r);
 365
 366                                         s->read_packet->size = be16toh(s->read_size);
 367                                         s->read_packet->ipproto = IPPROTO_TCP;
 368                                         s->read_packet->family = s->peer.sa.sa_family;
 369                                         s->read_packet->ttl = s->ttl;
 370                                         s->read_packet->ifindex = s->ifindex;
 371
 372                                         if (s->read_packet->family == AF_INET) {
 373                                                 s->read_packet->sender.in = s->peer.in.sin_addr;
 374                                                 s->read_packet->sender_port = be16toh(s->peer.in.sin_port);
 375                                                 s->read_packet->destination.in = s->local.in.sin_addr;
 376                                                 s->read_packet->destination_port = be16toh(s->local.in.sin_port);
 377                                         } else {
 378                                                 assert(s->read_packet->family == AF_INET6);
 379                                                 s->read_packet->sender.in6 = s->peer.in6.sin6_addr;
 380                                                 s->read_packet->sender_port = be16toh(s->peer.in6.sin6_port);
 381                                                 s->read_packet->destination.in6 = s->local.in6.sin6_addr;
 382                                                 s->read_packet->destination_port = be16toh(s->local.in6.sin6_port);
 383
 384                                                 if (s->read_packet->ifindex == 0)
 385                                                         s->read_packet->ifindex = s->peer.in6.sin6_scope_id;
 386                                                 if (s->read_packet->ifindex == 0)
 387                                                         s->read_packet->ifindex = s->local.in6.sin6_scope_id;
 388                                         }
 389                                 }
 390
 391                                 ss = dns_stream_read(s,
 392                                           (uint8_t*) DNS_PACKET_DATA(s->read_packet) + s->n_read - sizeof(s->read_size),
 393                                           sizeof(s->read_size) + be16toh(s->read_size) - s->n_read);
 394                                 if (ss < 0) {
 395                                         if (!IN_SET(-ss, EINTR, EAGAIN))
 396                                                 return dns_stream_complete(s, -ss);
 397                                 } else if (ss == 0)
 398                                         return dns_stream_complete(s, ECONNRESET);
 399                                 else
 400                                         s->n_read += ss;
 401                         }
 402
 403                         /* Are we done? If so, disable the event source for EPOLLIN */
 404                         if (s->n_read >= sizeof(s->read_size) + be16toh(s->read_size)) {
 405                                 /* If there's a packet handler
 406                                  * installed, call that. Note that
 407                                  * this is optional... */
 408                                 if (s->on_packet) {
 409                                         r = s->on_packet(s);
 410                                         if (r < 0)
 411                                                 return r;
 412                                 }
 413
 414                                 r = dns_stream_update_io(s);
 415                                 if (r < 0)
 416                                         return dns_stream_complete(s, -r);
 417                         }
 418                 }
 419         }
 420
 421         if ((s->write_packet && s->n_written >= sizeof(s->write_size) + s->write_packet->size) &&
 422             (s->read_packet && s->n_read >= sizeof(s->read_size) + s->read_packet->size))
 423                 return dns_stream_complete(s, 0);
 424
 425         return 0;
 426 }
 427
 428 static DnsStream *dns_stream_free(DnsStream *s) {
 429         DnsPacket *p;
 430         Iterator i;
 431
 432         assert(s);
 433
 434         dns_stream_stop(s);
 435
 436         if (s->manager) {
 437                 LIST_REMOVE(streams, s->manager->dns_streams, s);
 438                 s->manager->n_dns_streams--;
 439         }
 440
 441 #if ENABLE_DNS_OVER_TLS
 442         if (s->encrypted)
 443                 dnstls_stream_free(s);
 444 #endif
 445
 446         ORDERED_SET_FOREACH(p, s->write_queue, i)
 447                 dns_packet_unref(ordered_set_remove(s->write_queue, p));
 448
 449         dns_packet_unref(s->write_packet);
 450         dns_packet_unref(s->read_packet);
 451         dns_server_unref(s->server);
 452
 453         ordered_set_free(s->write_queue);
 454
 455         return mfree(s);
 456 }
 457
 458 DEFINE_TRIVIAL_REF_UNREF_FUNC(DnsStream, dns_stream, dns_stream_free);
 459
 460 int dns_stream_new(
 461                 Manager *m,
 462                 DnsStream **ret,
 463                 DnsProtocol protocol,
 464                 int fd,
 465                 const union sockaddr_union *tfo_address) {
 466
 467         _cleanup_(dns_stream_unrefp) DnsStream *s = NULL;
 468         int r;
 469
 470         assert(m);
 471         assert(ret);
 472         assert(fd >= 0);
 473
 474         if (m->n_dns_streams > DNS_STREAMS_MAX)
 475                 return -EBUSY;
 476
 477         s = new(DnsStream, 1);
 478         if (!s)
 479                 return -ENOMEM;
 480
 481         *s = (DnsStream) {
 482                 .n_ref = 1,
 483                 .fd = -1,
 484                 .protocol = protocol,
 485         };
 486
 487         r = ordered_set_ensure_allocated(&s->write_queue, &dns_packet_hash_ops);
 488         if (r < 0)
 489                 return r;
 490
 491         r = sd_event_add_io(m->event, &s->io_event_source, fd, EPOLLIN, on_stream_io, s);
 492         if (r < 0)
 493                 return r;
 494
 495         (void) sd_event_source_set_description(s->io_event_source, "dns-stream-io");
 496
 497         r = sd_event_add_time(
 498                         m->event,
 499                         &s->timeout_event_source,
 500                         clock_boottime_or_monotonic(),
 501                         now(clock_boottime_or_monotonic()) + DNS_STREAM_TIMEOUT_USEC, 0,
 502                         on_stream_timeout, s);
 503         if (r < 0)
 504                 return r;
 505
 506         (void) sd_event_source_set_description(s->timeout_event_source, "dns-stream-timeout");
 507
 508         LIST_PREPEND(streams, m->dns_streams, s);
 509         m->n_dns_streams++;
 510         s->manager = m;
 511
 512         s->fd = fd;
 513
 514         if (tfo_address) {
 515                 s->tfo_address = *tfo_address;
 516                 s->tfo_salen = tfo_address->sa.sa_family == AF_INET6 ? sizeof(tfo_address->in6) : sizeof(tfo_address->in);
 517         }
 518
 519         *ret = TAKE_PTR(s);
 520
 521         return 0;
 522 }
 523
 524 int dns_stream_write_packet(DnsStream *s, DnsPacket *p) {
 525         int r;
 526
 527         assert(s);
 528         assert(p);
 529
 530         r = ordered_set_put(s->write_queue, p);
 531         if (r < 0)
 532                 return r;
 533
 534         dns_packet_ref(p);
 535
 536         return dns_stream_update_io(s);
 537 }
 538
 539 DnsPacket *dns_stream_take_read_packet(DnsStream *s) {
 540         assert(s);
 541
 542         if (!s->read_packet)
 543                 return NULL;
 544
 545         if (s->n_read < sizeof(s->read_size))
 546                 return NULL;
 547
 548         if (s->n_read < sizeof(s->read_size) + be16toh(s->read_size))
 549                 return NULL;
 550
 551         s->n_read = 0;
 552         return TAKE_PTR(s->read_packet);
 553 }
 554
 555 void dns_stream_detach(DnsStream *s) {
 556         assert(s);
 557
 558         if (!s->server)
 559                 return;
 560
 561         if (s->server->stream != s)
 562                 return;
 563
 564         dns_server_unref_stream(s->server);
 565 }