src/resolve/resolved-dns-stream.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2
   3 #include <netinet/tcp.h>
   4
   5 #include "alloc-util.h"
   6 #include "fd-util.h"
   7 #include "io-util.h"
   8 #include "missing.h"
   9 #include "resolved-dns-stream.h"
  10
  11 #define DNS_STREAM_TIMEOUT_USEC (10 * USEC_PER_SEC)
  12 #define DNS_STREAMS_MAX 128
  13
  14 static void dns_stream_stop(DnsStream *s) {
  15         assert(s);
  16
  17         s->io_event_source = sd_event_source_unref(s->io_event_source);
  18         s->timeout_event_source = sd_event_source_unref(s->timeout_event_source);
  19         s->fd = safe_close(s->fd);
  20
  21         /* Disconnect us from the server object if we are now not usable anymore */
  22         dns_stream_detach(s);
  23 }
  24
  25 static int dns_stream_update_io(DnsStream *s) {
  26         int f = 0;
  27
  28         assert(s);
  29
  30         if (s->write_packet && s->n_written < sizeof(s->write_size) + s->write_packet->size)
  31                 f |= EPOLLOUT;
  32         else if (!ordered_set_isempty(s->write_queue)) {
  33                 dns_packet_unref(s->write_packet);
  34                 s->write_packet = ordered_set_steal_first(s->write_queue);
  35                 s->write_size = htobe16(s->write_packet->size);
  36                 s->n_written = 0;
  37                 f |= EPOLLOUT;
  38         }
  39         if (!s->read_packet || s->n_read < sizeof(s->read_size) + s->read_packet->size)
  40                 f |= EPOLLIN;
  41
  42 #if ENABLE_DNS_OVER_TLS
  43         /* For handshake and clean closing purposes, TLS can override requested events */
  44         if (s->dnstls_events)
  45                 f = s->dnstls_events;
  46 #endif
  47
  48         return sd_event_source_set_io_events(s->io_event_source, f);
  49 }
  50
  51 static int dns_stream_complete(DnsStream *s, int error) {
  52         _cleanup_(dns_stream_unrefp) _unused_ DnsStream *ref = dns_stream_ref(s); /* Protect stream while we process it */
  53
  54         assert(s);
  55
  56 #if ENABLE_DNS_OVER_TLS
  57         if (s->encrypted) {
  58                 int r;
  59
  60                 r = dnstls_stream_shutdown(s, error);
  61                 if (r != -EAGAIN)
  62                         dns_stream_stop(s);
  63         } else
  64 #endif
  65                 dns_stream_stop(s);
  66
  67         dns_stream_detach(s);
  68
  69         if (s->complete)
  70                 s->complete(s, error);
  71         else /* the default action if no completion function is set is to close the stream */
  72                 dns_stream_unref(s);
  73
  74         return 0;
  75 }
  76
  77 static int dns_stream_identify(DnsStream *s) {
  78         union {
  79                 struct cmsghdr header; /* For alignment */
  80                 uint8_t buffer[CMSG_SPACE(MAXSIZE(struct in_pktinfo, struct in6_pktinfo))
  81                                + EXTRA_CMSG_SPACE /* kernel appears to require extra space */];
  82         } control;
  83         struct msghdr mh = {};
  84         struct cmsghdr *cmsg;
  85         socklen_t sl;
  86         int r;
  87
  88         assert(s);
  89
  90         if (s->identified)
  91                 return 0;
  92
  93         /* Query the local side */
  94         s->local_salen = sizeof(s->local);
  95         r = getsockname(s->fd, &s->local.sa, &s->local_salen);
  96         if (r < 0)
  97                 return -errno;
  98         if (s->local.sa.sa_family == AF_INET6 && s->ifindex <= 0)
  99                 s->ifindex = s->local.in6.sin6_scope_id;
 100
 101         /* Query the remote side */
 102         s->peer_salen = sizeof(s->peer);
 103         r = getpeername(s->fd, &s->peer.sa, &s->peer_salen);
 104         if (r < 0)
 105                 return -errno;
 106         if (s->peer.sa.sa_family == AF_INET6 && s->ifindex <= 0)
 107                 s->ifindex = s->peer.in6.sin6_scope_id;
 108
 109         /* Check consistency */
 110         assert(s->peer.sa.sa_family == s->local.sa.sa_family);
 111         assert(IN_SET(s->peer.sa.sa_family, AF_INET, AF_INET6));
 112
 113         /* Query connection meta information */
 114         sl = sizeof(control);
 115         if (s->peer.sa.sa_family == AF_INET) {
 116                 r = getsockopt(s->fd, IPPROTO_IP, IP_PKTOPTIONS, &control, &sl);
 117                 if (r < 0)
 118                         return -errno;
 119         } else if (s->peer.sa.sa_family == AF_INET6) {
 120
 121                 r = getsockopt(s->fd, IPPROTO_IPV6, IPV6_2292PKTOPTIONS, &control, &sl);
 122                 if (r < 0)
 123                         return -errno;
 124         } else
 125                 return -EAFNOSUPPORT;
 126
 127         mh.msg_control = &control;
 128         mh.msg_controllen = sl;
 129
 130         CMSG_FOREACH(cmsg, &mh) {
 131
 132                 if (cmsg->cmsg_level == IPPROTO_IPV6) {
 133                         assert(s->peer.sa.sa_family == AF_INET6);
 134
 135                         switch (cmsg->cmsg_type) {
 136
 137                         case IPV6_PKTINFO: {
 138                                 struct in6_pktinfo *i = (struct in6_pktinfo*) CMSG_DATA(cmsg);
 139
 140                                 if (s->ifindex <= 0)
 141                                         s->ifindex = i->ipi6_ifindex;
 142                                 break;
 143                         }
 144
 145                         case IPV6_HOPLIMIT:
 146                                 s->ttl = *(int *) CMSG_DATA(cmsg);
 147                                 break;
 148                         }
 149
 150                 } else if (cmsg->cmsg_level == IPPROTO_IP) {
 151                         assert(s->peer.sa.sa_family == AF_INET);
 152
 153                         switch (cmsg->cmsg_type) {
 154
 155                         case IP_PKTINFO: {
 156                                 struct in_pktinfo *i = (struct in_pktinfo*) CMSG_DATA(cmsg);
 157
 158                                 if (s->ifindex <= 0)
 159                                         s->ifindex = i->ipi_ifindex;
 160                                 break;
 161                         }
 162
 163                         case IP_TTL:
 164                                 s->ttl = *(int *) CMSG_DATA(cmsg);
 165                                 break;
 166                         }
 167                 }
 168         }
 169
 170         /* The Linux kernel sets the interface index to the loopback
 171          * device if the connection came from the local host since it
 172          * avoids the routing table in such a case. Let's unset the
 173          * interface index in such a case. */
 174         if (s->ifindex == LOOPBACK_IFINDEX)
 175                 s->ifindex = 0;
 176
 177         /* If we don't know the interface index still, we look for the
 178          * first local interface with a matching address. Yuck! */
 179         if (s->ifindex <= 0)
 180                 s->ifindex = manager_find_ifindex(s->manager, s->local.sa.sa_family, s->local.sa.sa_family == AF_INET ? (union in_addr_union*) &s->local.in.sin_addr : (union in_addr_union*)  &s->local.in6.sin6_addr);
 181
 182         if (s->protocol == DNS_PROTOCOL_LLMNR && s->ifindex > 0) {
 183                 uint32_t ifindex = htobe32(s->ifindex);
 184
 185                 /* Make sure all packets for this connection are sent on the same interface */
 186                 if (s->local.sa.sa_family == AF_INET) {
 187                         r = setsockopt(s->fd, IPPROTO_IP, IP_UNICAST_IF, &ifindex, sizeof(ifindex));
 188                         if (r < 0)
 189                                 log_debug_errno(errno, "Failed to invoke IP_UNICAST_IF: %m");
 190                 } else if (s->local.sa.sa_family == AF_INET6) {
 191                         r = setsockopt(s->fd, IPPROTO_IPV6, IPV6_UNICAST_IF, &ifindex, sizeof(ifindex));
 192                         if (r < 0)
 193                                 log_debug_errno(errno, "Failed to invoke IPV6_UNICAST_IF: %m");
 194                 }
 195         }
 196
 197         s->identified = true;
 198
 199         return 0;
 200 }
 201
 202 ssize_t dns_stream_writev(DnsStream *s, const struct iovec *iov, size_t iovcnt, int flags) {
 203         ssize_t m;
 204
 205         assert(s);
 206         assert(iov);
 207
 208 #if ENABLE_DNS_OVER_TLS
 209         if (s->encrypted && !(flags & DNS_STREAM_WRITE_TLS_DATA)) {
 210                 ssize_t ss;
 211                 size_t i;
 212
 213                 m = 0;
 214                 for (i = 0; i < iovcnt; i++) {
 215                         ss = dnstls_stream_write(s, iov[i].iov_base, iov[i].iov_len);
 216                         if (ss < 0)
 217                                 return ss;
 218
 219                         m += ss;
 220                         if (ss != (ssize_t) iov[i].iov_len)
 221                                 continue;
 222                 }
 223         } else
 224 #endif
 225         if (s->tfo_salen > 0) {
 226                 struct msghdr hdr = {
 227                         .msg_iov = (struct iovec*) iov,
 228                         .msg_iovlen = iovcnt,
 229                         .msg_name = &s->tfo_address.sa,
 230                         .msg_namelen = s->tfo_salen
 231                 };
 232
 233                 m = sendmsg(s->fd, &hdr, MSG_FASTOPEN);
 234                 if (m < 0) {
 235                         if (errno == EOPNOTSUPP) {
 236                                 s->tfo_salen = 0;
 237                                 if (connect(s->fd, &s->tfo_address.sa, s->tfo_salen) < 0)
 238                                         return -errno;
 239
 240                                 return -EAGAIN;
 241                         }
 242                         if (errno == EINPROGRESS)
 243                                 return -EAGAIN;
 244
 245                         return -errno;
 246                 } else
 247                         s->tfo_salen = 0; /* connection is made */
 248         } else {
 249                 m = writev(s->fd, iov, iovcnt);
 250                 if (m < 0)
 251                         return -errno;
 252         }
 253
 254         return m;
 255 }
 256
 257 static ssize_t dns_stream_read(DnsStream *s, void *buf, size_t count) {
 258         ssize_t ss;
 259
 260 #if ENABLE_DNS_OVER_TLS
 261         if (s->encrypted)
 262                 ss = dnstls_stream_read(s, buf, count);
 263         else
 264 #endif
 265         {
 266                 ss = read(s->fd, buf, count);
 267                 if (ss < 0)
 268                         return -errno;
 269         }
 270
 271         return ss;
 272 }
 273
 274 static int on_stream_timeout(sd_event_source *es, usec_t usec, void *userdata) {
 275         DnsStream *s = userdata;
 276
 277         assert(s);
 278
 279         return dns_stream_complete(s, ETIMEDOUT);
 280 }
 281
 282 static int on_stream_io(sd_event_source *es, int fd, uint32_t revents, void *userdata) {
 283         _cleanup_(dns_stream_unrefp) DnsStream *s = dns_stream_ref(userdata); /* Protect stream while we process it */
 284         int r;
 285
 286         assert(s);
 287
 288 #if ENABLE_DNS_OVER_TLS
 289         if (s->encrypted) {
 290                 r = dnstls_stream_on_io(s, revents);
 291                 if (r == DNSTLS_STREAM_CLOSED)
 292                         return 0;
 293                 if (r == -EAGAIN)
 294                         return dns_stream_update_io(s);
 295                 if (r < 0)
 296                         return dns_stream_complete(s, -r);
 297
 298                 r = dns_stream_update_io(s);
 299                 if (r < 0)
 300                         return r;
 301         }
 302 #endif
 303
 304         /* only identify after connecting */
 305         if (s->tfo_salen == 0) {
 306                 r = dns_stream_identify(s);
 307                 if (r < 0)
 308                         return dns_stream_complete(s, -r);
 309         }
 310
 311         if ((revents & EPOLLOUT) &&
 312             s->write_packet &&
 313             s->n_written < sizeof(s->write_size) + s->write_packet->size) {
 314
 315                 struct iovec iov[2];
 316                 ssize_t ss;
 317
 318                 iov[0] = IOVEC_MAKE(&s->write_size, sizeof(s->write_size));
 319                 iov[1] = IOVEC_MAKE(DNS_PACKET_DATA(s->write_packet), s->write_packet->size);
 320
 321                 IOVEC_INCREMENT(iov, 2, s->n_written);
 322
 323                 ss = dns_stream_writev(s, iov, 2, 0);
 324                 if (ss < 0) {
 325                         if (!IN_SET(-ss, EINTR, EAGAIN))
 326                                 return dns_stream_complete(s, -ss);
 327                 } else
 328                         s->n_written += ss;
 329
 330                 /* Are we done? If so, disable the event source for EPOLLOUT */
 331                 if (s->n_written >= sizeof(s->write_size) + s->write_packet->size) {
 332                         r = dns_stream_update_io(s);
 333                         if (r < 0)
 334                                 return dns_stream_complete(s, -r);
 335                 }
 336         }
 337
 338         if ((revents & (EPOLLIN|EPOLLHUP|EPOLLRDHUP)) &&
 339             (!s->read_packet ||
 340              s->n_read < sizeof(s->read_size) + s->read_packet->size)) {
 341
 342                 if (s->n_read < sizeof(s->read_size)) {
 343                         ssize_t ss;
 344
 345                         ss = dns_stream_read(s, (uint8_t*) &s->read_size + s->n_read, sizeof(s->read_size) - s->n_read);
 346                         if (ss < 0) {
 347                                 if (!IN_SET(-ss, EINTR, EAGAIN))
 348                                         return dns_stream_complete(s, -ss);
 349                         } else if (ss == 0)
 350                                 return dns_stream_complete(s, ECONNRESET);
 351                         else
 352                                 s->n_read += ss;
 353                 }
 354
 355                 if (s->n_read >= sizeof(s->read_size)) {
 356
 357                         if (be16toh(s->read_size) < DNS_PACKET_HEADER_SIZE)
 358                                 return dns_stream_complete(s, EBADMSG);
 359
 360                         if (s->n_read < sizeof(s->read_size) + be16toh(s->read_size)) {
 361                                 ssize_t ss;
 362
 363                                 if (!s->read_packet) {
 364                                         r = dns_packet_new(&s->read_packet, s->protocol, be16toh(s->read_size), DNS_PACKET_SIZE_MAX);
 365                                         if (r < 0)
 366                                                 return dns_stream_complete(s, -r);
 367
 368                                         s->read_packet->size = be16toh(s->read_size);
 369                                         s->read_packet->ipproto = IPPROTO_TCP;
 370                                         s->read_packet->family = s->peer.sa.sa_family;
 371                                         s->read_packet->ttl = s->ttl;
 372                                         s->read_packet->ifindex = s->ifindex;
 373
 374                                         if (s->read_packet->family == AF_INET) {
 375                                                 s->read_packet->sender.in = s->peer.in.sin_addr;
 376                                                 s->read_packet->sender_port = be16toh(s->peer.in.sin_port);
 377                                                 s->read_packet->destination.in = s->local.in.sin_addr;
 378                                                 s->read_packet->destination_port = be16toh(s->local.in.sin_port);
 379                                         } else {
 380                                                 assert(s->read_packet->family == AF_INET6);
 381                                                 s->read_packet->sender.in6 = s->peer.in6.sin6_addr;
 382                                                 s->read_packet->sender_port = be16toh(s->peer.in6.sin6_port);
 383                                                 s->read_packet->destination.in6 = s->local.in6.sin6_addr;
 384                                                 s->read_packet->destination_port = be16toh(s->local.in6.sin6_port);
 385
 386                                                 if (s->read_packet->ifindex == 0)
 387                                                         s->read_packet->ifindex = s->peer.in6.sin6_scope_id;
 388                                                 if (s->read_packet->ifindex == 0)
 389                                                         s->read_packet->ifindex = s->local.in6.sin6_scope_id;
 390                                         }
 391                                 }
 392
 393                                 ss = dns_stream_read(s,
 394                                           (uint8_t*) DNS_PACKET_DATA(s->read_packet) + s->n_read - sizeof(s->read_size),
 395                                           sizeof(s->read_size) + be16toh(s->read_size) - s->n_read);
 396                                 if (ss < 0) {
 397                                         if (!IN_SET(-ss, EINTR, EAGAIN))
 398                                                 return dns_stream_complete(s, -ss);
 399                                 } else if (ss == 0)
 400                                         return dns_stream_complete(s, ECONNRESET);
 401                                 else
 402                                         s->n_read += ss;
 403                         }
 404
 405                         /* Are we done? If so, disable the event source for EPOLLIN */
 406                         if (s->n_read >= sizeof(s->read_size) + be16toh(s->read_size)) {
 407                                 /* If there's a packet handler
 408                                  * installed, call that. Note that
 409                                  * this is optional... */
 410                                 if (s->on_packet) {
 411                                         r = s->on_packet(s);
 412                                         if (r < 0)
 413                                                 return r;
 414                                 }
 415
 416                                 r = dns_stream_update_io(s);
 417                                 if (r < 0)
 418                                         return dns_stream_complete(s, -r);
 419                         }
 420                 }
 421         }
 422
 423         if ((s->write_packet && s->n_written >= sizeof(s->write_size) + s->write_packet->size) &&
 424             (s->read_packet && s->n_read >= sizeof(s->read_size) + s->read_packet->size))
 425                 return dns_stream_complete(s, 0);
 426
 427         return 0;
 428 }
 429
 430 static DnsStream *dns_stream_free(DnsStream *s) {
 431         DnsPacket *p;
 432         Iterator i;
 433
 434         assert(s);
 435
 436         dns_stream_stop(s);
 437
 438         if (s->manager) {
 439                 LIST_REMOVE(streams, s->manager->dns_streams, s);
 440                 s->manager->n_dns_streams--;
 441         }
 442
 443 #if ENABLE_DNS_OVER_TLS
 444         if (s->encrypted)
 445                 dnstls_stream_free(s);
 446 #endif
 447
 448         ORDERED_SET_FOREACH(p, s->write_queue, i)
 449                 dns_packet_unref(ordered_set_remove(s->write_queue, p));
 450
 451         dns_packet_unref(s->write_packet);
 452         dns_packet_unref(s->read_packet);
 453         dns_server_unref(s->server);
 454
 455         ordered_set_free(s->write_queue);
 456
 457         return mfree(s);
 458 }
 459
 460 DEFINE_TRIVIAL_REF_UNREF_FUNC(DnsStream, dns_stream, dns_stream_free);
 461
 462 int dns_stream_new(
 463                 Manager *m,
 464                 DnsStream **ret,
 465                 DnsProtocol protocol,
 466                 int fd,
 467                 const union sockaddr_union *tfo_address) {
 468
 469         _cleanup_(dns_stream_unrefp) DnsStream *s = NULL;
 470         int r;
 471
 472         assert(m);
 473         assert(ret);
 474         assert(fd >= 0);
 475
 476         if (m->n_dns_streams > DNS_STREAMS_MAX)
 477                 return -EBUSY;
 478
 479         s = new(DnsStream, 1);
 480         if (!s)
 481                 return -ENOMEM;
 482
 483         *s = (DnsStream) {
 484                 .n_ref = 1,
 485                 .fd = -1,
 486                 .protocol = protocol,
 487         };
 488
 489         r = ordered_set_ensure_allocated(&s->write_queue, &dns_packet_hash_ops);
 490         if (r < 0)
 491                 return r;
 492
 493         r = sd_event_add_io(m->event, &s->io_event_source, fd, EPOLLIN, on_stream_io, s);
 494         if (r < 0)
 495                 return r;
 496
 497         (void) sd_event_source_set_description(s->io_event_source, "dns-stream-io");
 498
 499         r = sd_event_add_time(
 500                         m->event,
 501                         &s->timeout_event_source,
 502                         clock_boottime_or_monotonic(),
 503                         now(clock_boottime_or_monotonic()) + DNS_STREAM_TIMEOUT_USEC, 0,
 504                         on_stream_timeout, s);
 505         if (r < 0)
 506                 return r;
 507
 508         (void) sd_event_source_set_description(s->timeout_event_source, "dns-stream-timeout");
 509
 510         LIST_PREPEND(streams, m->dns_streams, s);
 511         m->n_dns_streams++;
 512         s->manager = m;
 513
 514         s->fd = fd;
 515
 516         if (tfo_address) {
 517                 s->tfo_address = *tfo_address;
 518                 s->tfo_salen = tfo_address->sa.sa_family == AF_INET6 ? sizeof(tfo_address->in6) : sizeof(tfo_address->in);
 519         }
 520
 521         *ret = TAKE_PTR(s);
 522
 523         return 0;
 524 }
 525
 526 int dns_stream_write_packet(DnsStream *s, DnsPacket *p) {
 527         int r;
 528
 529         assert(s);
 530         assert(p);
 531
 532         r = ordered_set_put(s->write_queue, p);
 533         if (r < 0)
 534                 return r;
 535
 536         dns_packet_ref(p);
 537
 538         return dns_stream_update_io(s);
 539 }
 540
 541 DnsPacket *dns_stream_take_read_packet(DnsStream *s) {
 542         assert(s);
 543
 544         if (!s->read_packet)
 545                 return NULL;
 546
 547         if (s->n_read < sizeof(s->read_size))
 548                 return NULL;
 549
 550         if (s->n_read < sizeof(s->read_size) + be16toh(s->read_size))
 551                 return NULL;
 552
 553         s->n_read = 0;
 554         return TAKE_PTR(s->read_packet);
 555 }
 556
 557 void dns_stream_detach(DnsStream *s) {
 558         assert(s);
 559
 560         if (!s->server)
 561                 return;
 562
 563         if (s->server->stream != s)
 564                 return;
 565
 566         dns_server_unref_stream(s->server);
 567 }