src/resolve/resolved-dns-stream.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2 /***
   3   This file is part of systemd.
   4
   5   Copyright 2014 Lennart Poettering
   6 ***/
   7
   8 #include <netinet/tcp.h>
   9
  10 #include "alloc-util.h"
  11 #include "fd-util.h"
  12 #include "io-util.h"
  13 #include "missing.h"
  14 #include "resolved-dns-stream.h"
  15
  16 #define DNS_STREAM_TIMEOUT_USEC (10 * USEC_PER_SEC)
  17 #define DNS_STREAMS_MAX 128
  18
  19 #define WRITE_TLS_DATA 1
  20
  21 static void dns_stream_stop(DnsStream *s) {
  22         assert(s);
  23
  24         s->io_event_source = sd_event_source_unref(s->io_event_source);
  25         s->timeout_event_source = sd_event_source_unref(s->timeout_event_source);
  26         s->fd = safe_close(s->fd);
  27 }
  28
  29 static int dns_stream_update_io(DnsStream *s) {
  30         int f = 0;
  31
  32         assert(s);
  33
  34         if (s->write_packet && s->n_written < sizeof(s->write_size) + s->write_packet->size)
  35                 f |= EPOLLOUT;
  36         else if (!ordered_set_isempty(s->write_queue)) {
  37                 dns_packet_unref(s->write_packet);
  38                 s->write_packet = ordered_set_steal_first(s->write_queue);
  39                 s->write_size = htobe16(s->write_packet->size);
  40                 s->n_written = 0;
  41                 f |= EPOLLOUT;
  42         }
  43         if (!s->read_packet || s->n_read < sizeof(s->read_size) + s->read_packet->size)
  44                 f |= EPOLLIN;
  45
  46         return sd_event_source_set_io_events(s->io_event_source, f);
  47 }
  48
  49 static int dns_stream_complete(DnsStream *s, int error) {
  50         assert(s);
  51
  52 #if HAVE_GNUTLS
  53         if (s->tls_session && IN_SET(error, ETIMEDOUT, 0)) {
  54                 int r;
  55
  56                 r = gnutls_bye(s->tls_session, GNUTLS_SHUT_RDWR);
  57                 if (r == GNUTLS_E_AGAIN && !s->tls_bye) {
  58                         dns_stream_ref(s); /* keep reference for closing TLS session */
  59                         s->tls_bye = true;
  60                 } else
  61                         dns_stream_stop(s);
  62         } else
  63 #endif
  64                 dns_stream_stop(s);
  65
  66         if (s->complete)
  67                 s->complete(s, error);
  68         else /* the default action if no completion function is set is to close the stream */
  69                 dns_stream_unref(s);
  70
  71         return 0;
  72 }
  73
  74 static int dns_stream_identify(DnsStream *s) {
  75         union {
  76                 struct cmsghdr header; /* For alignment */
  77                 uint8_t buffer[CMSG_SPACE(MAXSIZE(struct in_pktinfo, struct in6_pktinfo))
  78                                + EXTRA_CMSG_SPACE /* kernel appears to require extra space */];
  79         } control;
  80         struct msghdr mh = {};
  81         struct cmsghdr *cmsg;
  82         socklen_t sl;
  83         int r;
  84
  85         assert(s);
  86
  87         if (s->identified)
  88                 return 0;
  89
  90         /* Query the local side */
  91         s->local_salen = sizeof(s->local);
  92         r = getsockname(s->fd, &s->local.sa, &s->local_salen);
  93         if (r < 0)
  94                 return -errno;
  95         if (s->local.sa.sa_family == AF_INET6 && s->ifindex <= 0)
  96                 s->ifindex = s->local.in6.sin6_scope_id;
  97
  98         /* Query the remote side */
  99         s->peer_salen = sizeof(s->peer);
 100         r = getpeername(s->fd, &s->peer.sa, &s->peer_salen);
 101         if (r < 0)
 102                 return -errno;
 103         if (s->peer.sa.sa_family == AF_INET6 && s->ifindex <= 0)
 104                 s->ifindex = s->peer.in6.sin6_scope_id;
 105
 106         /* Check consistency */
 107         assert(s->peer.sa.sa_family == s->local.sa.sa_family);
 108         assert(IN_SET(s->peer.sa.sa_family, AF_INET, AF_INET6));
 109
 110         /* Query connection meta information */
 111         sl = sizeof(control);
 112         if (s->peer.sa.sa_family == AF_INET) {
 113                 r = getsockopt(s->fd, IPPROTO_IP, IP_PKTOPTIONS, &control, &sl);
 114                 if (r < 0)
 115                         return -errno;
 116         } else if (s->peer.sa.sa_family == AF_INET6) {
 117
 118                 r = getsockopt(s->fd, IPPROTO_IPV6, IPV6_2292PKTOPTIONS, &control, &sl);
 119                 if (r < 0)
 120                         return -errno;
 121         } else
 122                 return -EAFNOSUPPORT;
 123
 124         mh.msg_control = &control;
 125         mh.msg_controllen = sl;
 126
 127         CMSG_FOREACH(cmsg, &mh) {
 128
 129                 if (cmsg->cmsg_level == IPPROTO_IPV6) {
 130                         assert(s->peer.sa.sa_family == AF_INET6);
 131
 132                         switch (cmsg->cmsg_type) {
 133
 134                         case IPV6_PKTINFO: {
 135                                 struct in6_pktinfo *i = (struct in6_pktinfo*) CMSG_DATA(cmsg);
 136
 137                                 if (s->ifindex <= 0)
 138                                         s->ifindex = i->ipi6_ifindex;
 139                                 break;
 140                         }
 141
 142                         case IPV6_HOPLIMIT:
 143                                 s->ttl = *(int *) CMSG_DATA(cmsg);
 144                                 break;
 145                         }
 146
 147                 } else if (cmsg->cmsg_level == IPPROTO_IP) {
 148                         assert(s->peer.sa.sa_family == AF_INET);
 149
 150                         switch (cmsg->cmsg_type) {
 151
 152                         case IP_PKTINFO: {
 153                                 struct in_pktinfo *i = (struct in_pktinfo*) CMSG_DATA(cmsg);
 154
 155                                 if (s->ifindex <= 0)
 156                                         s->ifindex = i->ipi_ifindex;
 157                                 break;
 158                         }
 159
 160                         case IP_TTL:
 161                                 s->ttl = *(int *) CMSG_DATA(cmsg);
 162                                 break;
 163                         }
 164                 }
 165         }
 166
 167         /* The Linux kernel sets the interface index to the loopback
 168          * device if the connection came from the local host since it
 169          * avoids the routing table in such a case. Let's unset the
 170          * interface index in such a case. */
 171         if (s->ifindex == LOOPBACK_IFINDEX)
 172                 s->ifindex = 0;
 173
 174         /* If we don't know the interface index still, we look for the
 175          * first local interface with a matching address. Yuck! */
 176         if (s->ifindex <= 0)
 177                 s->ifindex = manager_find_ifindex(s->manager, s->local.sa.sa_family, s->local.sa.sa_family == AF_INET ? (union in_addr_union*) &s->local.in.sin_addr : (union in_addr_union*)  &s->local.in6.sin6_addr);
 178
 179         if (s->protocol == DNS_PROTOCOL_LLMNR && s->ifindex > 0) {
 180                 uint32_t ifindex = htobe32(s->ifindex);
 181
 182                 /* Make sure all packets for this connection are sent on the same interface */
 183                 if (s->local.sa.sa_family == AF_INET) {
 184                         r = setsockopt(s->fd, IPPROTO_IP, IP_UNICAST_IF, &ifindex, sizeof(ifindex));
 185                         if (r < 0)
 186                                 log_debug_errno(errno, "Failed to invoke IP_UNICAST_IF: %m");
 187                 } else if (s->local.sa.sa_family == AF_INET6) {
 188                         r = setsockopt(s->fd, IPPROTO_IPV6, IPV6_UNICAST_IF, &ifindex, sizeof(ifindex));
 189                         if (r < 0)
 190                                 log_debug_errno(errno, "Failed to invoke IPV6_UNICAST_IF: %m");
 191                 }
 192         }
 193
 194         s->identified = true;
 195
 196         return 0;
 197 }
 198
 199 static ssize_t dns_stream_writev(DnsStream *s, const struct iovec *iov, size_t iovcnt, int flags) {
 200         ssize_t r;
 201
 202         assert(s);
 203         assert(iov);
 204
 205 #if HAVE_GNUTLS
 206         if (s->tls_session && !(flags & WRITE_TLS_DATA)) {
 207                 ssize_t ss;
 208                 size_t i;
 209
 210                 r = 0;
 211                 for (i = 0; i < iovcnt; i++) {
 212                         ss = gnutls_record_send(s->tls_session, iov[i].iov_base, iov[i].iov_len);
 213                         if (ss < 0) {
 214                                 switch(ss) {
 215
 216                                 case GNUTLS_E_INTERRUPTED:
 217                                         return -EINTR;
 218                                 case GNUTLS_E_AGAIN:
 219                                         return -EAGAIN;
 220                                 default:
 221                                         log_debug("Failed to invoke gnutls_record_send: %s", gnutls_strerror(ss));
 222                                         return -EIO;
 223                                 }
 224                         }
 225
 226                         r += ss;
 227                         if (ss != (ssize_t) iov[i].iov_len)
 228                                 continue;
 229                 }
 230         } else
 231 #endif
 232         if (s->tfo_salen > 0) {
 233                 struct msghdr hdr = {
 234                         .msg_iov = (struct iovec*) iov,
 235                         .msg_iovlen = iovcnt,
 236                         .msg_name = &s->tfo_address.sa,
 237                         .msg_namelen = s->tfo_salen
 238                 };
 239
 240                 r = sendmsg(s->fd, &hdr, MSG_FASTOPEN);
 241                 if (r < 0) {
 242                         if (errno == EOPNOTSUPP) {
 243                                 s->tfo_salen = 0;
 244                                 r = connect(s->fd, &s->tfo_address.sa, s->tfo_salen);
 245                                 if (r < 0)
 246                                         return -errno;
 247
 248                                 r = -EAGAIN;
 249                         } else if (errno == EINPROGRESS)
 250                                 r = -EAGAIN;
 251                 } else
 252                         s->tfo_salen = 0; /* connection is made */
 253         } else
 254                 r = writev(s->fd, iov, iovcnt);
 255
 256         return r;
 257 }
 258
 259 static ssize_t dns_stream_read(DnsStream *s, void *buf, size_t count) {
 260         ssize_t ss;
 261
 262 #if HAVE_GNUTLS
 263         if (s->tls_session) {
 264                 ss = gnutls_record_recv(s->tls_session, buf, count);
 265                 if (ss < 0) {
 266                         switch(ss) {
 267
 268                         case GNUTLS_E_INTERRUPTED:
 269                                 return -EINTR;
 270                         case GNUTLS_E_AGAIN:
 271                                 return -EAGAIN;
 272                         default:
 273                                 log_debug("Failed to invoke gnutls_record_send: %s", gnutls_strerror(ss));
 274                                 return -EIO;
 275                         }
 276                 } else if (s->on_connection) {
 277                         int r;
 278
 279                         r = s->on_connection(s);
 280                         s->on_connection = NULL; /* only call once */
 281                         if (r < 0)
 282                                 return r;
 283                 }
 284         } else
 285 #endif
 286                 ss = read(s->fd, buf, count);
 287
 288         return ss;
 289 }
 290
 291 #if HAVE_GNUTLS
 292 static ssize_t dns_stream_tls_writev(gnutls_transport_ptr_t p, const giovec_t * iov, int iovcnt) {
 293         int r;
 294
 295         assert(p);
 296
 297         r = dns_stream_writev((DnsStream*) p, (struct iovec*) iov, iovcnt, WRITE_TLS_DATA);
 298         if (r < 0) {
 299                 errno = -r;
 300                 return -1;
 301         }
 302
 303         return r;
 304 }
 305 #endif
 306
 307 static int on_stream_timeout(sd_event_source *es, usec_t usec, void *userdata) {
 308         DnsStream *s = userdata;
 309
 310         assert(s);
 311
 312         return dns_stream_complete(s, ETIMEDOUT);
 313 }
 314
 315 static int on_stream_io(sd_event_source *es, int fd, uint32_t revents, void *userdata) {
 316         DnsStream *s = userdata;
 317         int r;
 318
 319         assert(s);
 320
 321 #if HAVE_GNUTLS
 322         if (s->tls_bye) {
 323                 assert(s->tls_session);
 324
 325                 r = gnutls_bye(s->tls_session, GNUTLS_SHUT_RDWR);
 326                 if (r != GNUTLS_E_AGAIN) {
 327                         s->tls_bye = false;
 328                         dns_stream_unref(s);
 329                 }
 330
 331                 return 0;
 332         }
 333
 334         if (s->tls_handshake < 0) {
 335                 assert(s->tls_session);
 336
 337                 s->tls_handshake = gnutls_handshake(s->tls_session);
 338                 if (s->tls_handshake >= 0) {
 339                         if (s->on_connection && !(gnutls_session_get_flags(s->tls_session) & GNUTLS_SFLAGS_FALSE_START)) {
 340                                 r = s->on_connection(s);
 341                                 s->on_connection = NULL; /* only call once */
 342                                 if (r < 0)
 343                                         return r;
 344                         }
 345                 } else {
 346                         if (gnutls_error_is_fatal(s->tls_handshake))
 347                                 return dns_stream_complete(s, ECONNREFUSED);
 348                         else
 349                                 return 0;
 350                 }
 351
 352         }
 353 #endif
 354
 355         /* only identify after connecting */
 356         if (s->tfo_salen == 0) {
 357                 r = dns_stream_identify(s);
 358                 if (r < 0)
 359                         return dns_stream_complete(s, -r);
 360         }
 361
 362         if ((revents & EPOLLOUT) &&
 363             s->write_packet &&
 364             s->n_written < sizeof(s->write_size) + s->write_packet->size) {
 365
 366                 struct iovec iov[2];
 367                 ssize_t ss;
 368
 369                 iov[0].iov_base = &s->write_size;
 370                 iov[0].iov_len = sizeof(s->write_size);
 371                 iov[1].iov_base = DNS_PACKET_DATA(s->write_packet);
 372                 iov[1].iov_len = s->write_packet->size;
 373
 374                 IOVEC_INCREMENT(iov, 2, s->n_written);
 375
 376                 ss = dns_stream_writev(s, iov, 2, 0);
 377                 if (ss < 0) {
 378                         if (!IN_SET(errno, EINTR, EAGAIN))
 379                                 return dns_stream_complete(s, errno);
 380                 } else
 381                         s->n_written += ss;
 382
 383                 /* Are we done? If so, disable the event source for EPOLLOUT */
 384                 if (s->n_written >= sizeof(s->write_size) + s->write_packet->size) {
 385                         r = dns_stream_update_io(s);
 386                         if (r < 0)
 387                                 return dns_stream_complete(s, -r);
 388                 }
 389         }
 390
 391         if ((revents & (EPOLLIN|EPOLLHUP|EPOLLRDHUP)) &&
 392             (!s->read_packet ||
 393              s->n_read < sizeof(s->read_size) + s->read_packet->size)) {
 394
 395                 if (s->n_read < sizeof(s->read_size)) {
 396                         ssize_t ss;
 397
 398                         ss = dns_stream_read(s, (uint8_t*) &s->read_size + s->n_read, sizeof(s->read_size) - s->n_read);
 399                         if (ss < 0) {
 400                                 if (!IN_SET(errno, EINTR, EAGAIN))
 401                                         return dns_stream_complete(s, errno);
 402                         } else if (ss == 0)
 403                                 return dns_stream_complete(s, ECONNRESET);
 404                         else
 405                                 s->n_read += ss;
 406                 }
 407
 408                 if (s->n_read >= sizeof(s->read_size)) {
 409
 410                         if (be16toh(s->read_size) < DNS_PACKET_HEADER_SIZE)
 411                                 return dns_stream_complete(s, EBADMSG);
 412
 413                         if (s->n_read < sizeof(s->read_size) + be16toh(s->read_size)) {
 414                                 ssize_t ss;
 415
 416                                 if (!s->read_packet) {
 417                                         r = dns_packet_new(&s->read_packet, s->protocol, be16toh(s->read_size), DNS_PACKET_SIZE_MAX);
 418                                         if (r < 0)
 419                                                 return dns_stream_complete(s, -r);
 420
 421                                         s->read_packet->size = be16toh(s->read_size);
 422                                         s->read_packet->ipproto = IPPROTO_TCP;
 423                                         s->read_packet->family = s->peer.sa.sa_family;
 424                                         s->read_packet->ttl = s->ttl;
 425                                         s->read_packet->ifindex = s->ifindex;
 426
 427                                         if (s->read_packet->family == AF_INET) {
 428                                                 s->read_packet->sender.in = s->peer.in.sin_addr;
 429                                                 s->read_packet->sender_port = be16toh(s->peer.in.sin_port);
 430                                                 s->read_packet->destination.in = s->local.in.sin_addr;
 431                                                 s->read_packet->destination_port = be16toh(s->local.in.sin_port);
 432                                         } else {
 433                                                 assert(s->read_packet->family == AF_INET6);
 434                                                 s->read_packet->sender.in6 = s->peer.in6.sin6_addr;
 435                                                 s->read_packet->sender_port = be16toh(s->peer.in6.sin6_port);
 436                                                 s->read_packet->destination.in6 = s->local.in6.sin6_addr;
 437                                                 s->read_packet->destination_port = be16toh(s->local.in6.sin6_port);
 438
 439                                                 if (s->read_packet->ifindex == 0)
 440                                                         s->read_packet->ifindex = s->peer.in6.sin6_scope_id;
 441                                                 if (s->read_packet->ifindex == 0)
 442                                                         s->read_packet->ifindex = s->local.in6.sin6_scope_id;
 443                                         }
 444                                 }
 445
 446                                 ss = dns_stream_read(s,
 447                                           (uint8_t*) DNS_PACKET_DATA(s->read_packet) + s->n_read - sizeof(s->read_size),
 448                                           sizeof(s->read_size) + be16toh(s->read_size) - s->n_read);
 449                                 if (ss < 0) {
 450                                         if (!IN_SET(errno, EINTR, EAGAIN))
 451                                                 return dns_stream_complete(s, errno);
 452                                 } else if (ss == 0)
 453                                         return dns_stream_complete(s, ECONNRESET);
 454                                 else
 455                                         s->n_read += ss;
 456                         }
 457
 458                         /* Are we done? If so, disable the event source for EPOLLIN */
 459                         if (s->n_read >= sizeof(s->read_size) + be16toh(s->read_size)) {
 460                                 /* If there's a packet handler
 461                                  * installed, call that. Note that
 462                                  * this is optional... */
 463                                 if (s->on_packet) {
 464                                         r = s->on_packet(s);
 465                                         if (r < 0)
 466                                                 return r;
 467                                 }
 468
 469                                 r = dns_stream_update_io(s);
 470                                 if (r < 0)
 471                                         return dns_stream_complete(s, -r);
 472                         }
 473                 }
 474         }
 475
 476         if ((s->write_packet && s->n_written >= sizeof(s->write_size) + s->write_packet->size) &&
 477             (s->read_packet && s->n_read >= sizeof(s->read_size) + s->read_packet->size))
 478                 return dns_stream_complete(s, 0);
 479
 480         return 0;
 481 }
 482
 483 DnsStream *dns_stream_unref(DnsStream *s) {
 484         DnsPacket *p;
 485         Iterator i;
 486
 487         if (!s)
 488                 return NULL;
 489
 490         assert(s->n_ref > 0);
 491         s->n_ref--;
 492
 493         if (s->n_ref > 0)
 494                 return NULL;
 495
 496         dns_stream_stop(s);
 497
 498         if (s->server && s->server->stream == s)
 499                 s->server->stream = NULL;
 500
 501         if (s->manager) {
 502                 LIST_REMOVE(streams, s->manager->dns_streams, s);
 503                 s->manager->n_dns_streams--;
 504         }
 505
 506 #if HAVE_GNUTLS
 507         if (s->tls_session)
 508                 gnutls_deinit(s->tls_session);
 509 #endif
 510
 511         ORDERED_SET_FOREACH(p, s->write_queue, i)
 512                 dns_packet_unref(ordered_set_remove(s->write_queue, p));
 513
 514         dns_packet_unref(s->write_packet);
 515         dns_packet_unref(s->read_packet);
 516         dns_server_unref(s->server);
 517
 518         ordered_set_free(s->write_queue);
 519
 520         return mfree(s);
 521 }
 522
 523 DnsStream *dns_stream_ref(DnsStream *s) {
 524         if (!s)
 525                 return NULL;
 526
 527         assert(s->n_ref > 0);
 528         s->n_ref++;
 529
 530         return s;
 531 }
 532
 533 int dns_stream_new(Manager *m, DnsStream **ret, DnsProtocol protocol, int fd, const union sockaddr_union *tfo_address) {
 534         _cleanup_(dns_stream_unrefp) DnsStream *s = NULL;
 535         int r;
 536
 537         assert(m);
 538         assert(fd >= 0);
 539
 540         if (m->n_dns_streams > DNS_STREAMS_MAX)
 541                 return -EBUSY;
 542
 543         s = new0(DnsStream, 1);
 544         if (!s)
 545                 return -ENOMEM;
 546
 547         r = ordered_set_ensure_allocated(&s->write_queue, &dns_packet_hash_ops);
 548         if (r < 0)
 549                 return r;
 550
 551         s->n_ref = 1;
 552         s->fd = -1;
 553         s->protocol = protocol;
 554
 555         r = sd_event_add_io(m->event, &s->io_event_source, fd, EPOLLIN, on_stream_io, s);
 556         if (r < 0)
 557                 return r;
 558
 559         (void) sd_event_source_set_description(s->io_event_source, "dns-stream-io");
 560
 561         r = sd_event_add_time(
 562                         m->event,
 563                         &s->timeout_event_source,
 564                         clock_boottime_or_monotonic(),
 565                         now(clock_boottime_or_monotonic()) + DNS_STREAM_TIMEOUT_USEC, 0,
 566                         on_stream_timeout, s);
 567         if (r < 0)
 568                 return r;
 569
 570         (void) sd_event_source_set_description(s->timeout_event_source, "dns-stream-timeout");
 571
 572         LIST_PREPEND(streams, m->dns_streams, s);
 573         s->manager = m;
 574         s->fd = fd;
 575         if (tfo_address) {
 576                 s->tfo_address = *tfo_address;
 577                 s->tfo_salen = tfo_address->sa.sa_family == AF_INET6 ? sizeof(tfo_address->in6) : sizeof(tfo_address->in);
 578         }
 579
 580         m->n_dns_streams++;
 581
 582         *ret = TAKE_PTR(s);
 583
 584         return 0;
 585 }
 586
 587 #if HAVE_GNUTLS
 588 int dns_stream_connect_tls(DnsStream *s, gnutls_session_t tls_session) {
 589         gnutls_transport_set_ptr2(tls_session, (gnutls_transport_ptr_t) (long) s->fd, s);
 590         gnutls_transport_set_vec_push_function(tls_session, &dns_stream_tls_writev);
 591
 592         s->encrypted = true;
 593         s->tls_session = tls_session;
 594         s->tls_handshake = gnutls_handshake(tls_session);
 595         if (s->tls_handshake < 0 && gnutls_error_is_fatal(s->tls_handshake))
 596                 return -ECONNREFUSED;
 597
 598         return 0;
 599 }
 600 #endif
 601
 602 int dns_stream_write_packet(DnsStream *s, DnsPacket *p) {
 603         int r;
 604
 605         assert(s);
 606
 607         r = ordered_set_put(s->write_queue, p);
 608         if (r < 0)
 609                 return r;
 610
 611         dns_packet_ref(p);
 612
 613         return dns_stream_update_io(s);
 614 }