src/resolve/resolved-dns-stub.c

   1 /***
   2   This file is part of systemd.
   3
   4   Copyright 2016 Lennart Poettering
   5
   6   systemd is free software; you can redistribute it and/or modify it
   7   under the terms of the GNU Lesser General Public License as published by
   8   the Free Software Foundation; either version 2.1 of the License, or
   9   (at your option) any later version.
  10
  11   systemd is distributed in the hope that it will be useful, but
  12   WITHOUT ANY WARRANTY; without even the implied warranty of
  13   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  14   Lesser General Public License for more details.
  15
  16   You should have received a copy of the GNU Lesser General Public License
  17   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  18 ***/
  19
  20 #include "fd-util.h"
  21 #include "resolved-dns-stub.h"
  22 #include "socket-util.h"
  23
  24 /* The MTU of the loopback device is 64K on Linux, advertise that as maximum datagram size, but subtract the Ethernet,
  25  * IP and UDP header sizes */
  26 #define ADVERTISE_DATAGRAM_SIZE_MAX (65536U-14U-20U-8U)
  27
  28 static int manager_dns_stub_udp_fd(Manager *m);
  29 static int manager_dns_stub_tcp_fd(Manager *m);
  30
  31 static int dns_stub_make_reply_packet(
  32                 DnsPacket **p,
  33                 size_t max_size,
  34                 DnsQuestion *q,
  35                 DnsAnswer *answer,
  36                 bool *ret_truncated) {
  37
  38         bool truncated = false;
  39         DnsResourceRecord *rr;
  40         unsigned c = 0;
  41         int r;
  42
  43         assert(p);
  44
  45         /* Note that we don't bother with any additional RRs, as this is stub is for local lookups only, and hence
  46          * roundtrips aren't expensive. */
  47
  48         if (!*p) {
  49                 r = dns_packet_new(p, DNS_PROTOCOL_DNS, 0, max_size);
  50                 if (r < 0)
  51                         return r;
  52
  53                 r = dns_packet_append_question(*p, q);
  54                 if (r < 0)
  55                         return r;
  56
  57                 DNS_PACKET_HEADER(*p)->qdcount = htobe16(dns_question_size(q));
  58         }
  59
  60         DNS_ANSWER_FOREACH(rr, answer) {
  61
  62                 r = dns_question_matches_rr(q, rr, NULL);
  63                 if (r < 0)
  64                         return r;
  65                 if (r > 0)
  66                         goto add;
  67
  68                 r = dns_question_matches_cname_or_dname(q, rr, NULL);
  69                 if (r < 0)
  70                         return r;
  71                 if (r > 0)
  72                         goto add;
  73
  74                 continue;
  75         add:
  76                 r = dns_packet_append_rr(*p, rr, 0, NULL, NULL);
  77                 if (r == -EMSGSIZE) {
  78                         truncated = true;
  79                         break;
  80                 }
  81                 if (r < 0)
  82                         return r;
  83
  84                 c++;
  85         }
  86
  87         if (ret_truncated)
  88                 *ret_truncated = truncated;
  89         else if (truncated)
  90                 return -EMSGSIZE;
  91
  92         DNS_PACKET_HEADER(*p)->ancount = htobe16(be16toh(DNS_PACKET_HEADER(*p)->ancount) + c);
  93
  94         return 0;
  95 }
  96
  97 static int dns_stub_finish_reply_packet(
  98                 DnsPacket *p,
  99                 uint16_t id,
 100                 int rcode,
 101                 bool tc,        /* set the Truncated bit? */
 102                 bool add_opt,   /* add an OPT RR to this packet? */
 103                 bool edns0_do,  /* set the EDNS0 DNSSEC OK bit? */
 104                 bool ad) {      /* set the DNSSEC authenticated data bit? */
 105
 106         int r;
 107
 108         assert(p);
 109
 110         if (!add_opt) {
 111                 /* If the client can't to EDNS0, don't do DO either */
 112                 edns0_do = false;
 113
 114                 /* If the client didn't do EDNS, clamp the rcode to 4 bit */
 115                 if (rcode > 0xF)
 116                         rcode = DNS_RCODE_SERVFAIL;
 117         }
 118
 119         /* Don't set the AD bit unless DO is on, too */
 120         if (!edns0_do)
 121                 ad = false;
 122
 123         DNS_PACKET_HEADER(p)->id = id;
 124
 125         DNS_PACKET_HEADER(p)->flags = htobe16(DNS_PACKET_MAKE_FLAGS(
 126                                                               1  /* qr */,
 127                                                               0  /* opcode */,
 128                                                               0  /* aa */,
 129                                                               tc /* tc */,
 130                                                               1  /* rd */,
 131                                                               1  /* ra */,
 132                                                               ad /* ad */,
 133                                                               0  /* cd */,
 134                                                               rcode));
 135
 136         if (add_opt) {
 137                 r = dns_packet_append_opt(p, ADVERTISE_DATAGRAM_SIZE_MAX, edns0_do, rcode, NULL);
 138                 if (r < 0)
 139                         return r;
 140         }
 141
 142         return 0;
 143 }
 144
 145 static void dns_stub_detach_stream(DnsStream *s) {
 146         assert(s);
 147
 148         s->complete = NULL;
 149         s->on_packet = NULL;
 150         s->query = NULL;
 151 }
 152
 153 static int dns_stub_send(Manager *m, DnsStream *s, DnsPacket *p, DnsPacket *reply) {
 154         int r;
 155
 156         assert(m);
 157         assert(p);
 158         assert(reply);
 159
 160         if (s)
 161                 r = dns_stream_write_packet(s, reply);
 162         else {
 163                 int fd;
 164
 165                 fd = manager_dns_stub_udp_fd(m);
 166                 if (fd < 0)
 167                         return log_debug_errno(fd, "Failed to get reply socket: %m");
 168
 169                 /* Note that it is essential here that we explicitly choose the source IP address for this packet. This
 170                  * is because otherwise the kernel will choose it automatically based on the routing table and will
 171                  * thus pick 127.0.0.1 rather than 127.0.0.53. */
 172
 173                 r = manager_send(m, fd, LOOPBACK_IFINDEX, p->family, &p->sender, p->sender_port, &p->destination, reply);
 174         }
 175         if (r < 0)
 176                 return log_debug_errno(r, "Failed to send reply packet: %m");
 177
 178         return 0;
 179 }
 180
 181 static int dns_stub_send_failure(Manager *m, DnsStream *s, DnsPacket *p, int rcode, bool authenticated) {
 182         _cleanup_(dns_packet_unrefp) DnsPacket *reply = NULL;
 183         int r;
 184
 185         assert(m);
 186         assert(p);
 187
 188         r = dns_stub_make_reply_packet(&reply, DNS_PACKET_PAYLOAD_SIZE_MAX(p), p->question, NULL, NULL);
 189         if (r < 0)
 190                 return log_debug_errno(r, "Failed to make failure packet: %m");
 191
 192         r = dns_stub_finish_reply_packet(reply, DNS_PACKET_ID(p), rcode, false, !!p->opt, DNS_PACKET_DO(p), authenticated);
 193         if (r < 0)
 194                 return log_debug_errno(r, "Failed to build failure packet: %m");
 195
 196         return dns_stub_send(m, s, p, reply);
 197 }
 198
 199 static void dns_stub_query_complete(DnsQuery *q) {
 200         int r;
 201
 202         assert(q);
 203         assert(q->request_dns_packet);
 204
 205         switch (q->state) {
 206
 207         case DNS_TRANSACTION_SUCCESS: {
 208                 bool truncated;
 209
 210                 r = dns_stub_make_reply_packet(&q->reply_dns_packet, DNS_PACKET_PAYLOAD_SIZE_MAX(q->request_dns_packet), q->question_idna, q->answer, &truncated);
 211                 if (r < 0) {
 212                         log_debug_errno(r, "Failed to build reply packet: %m");
 213                         break;
 214                 }
 215
 216                 r = dns_query_process_cname(q);
 217                 if (r == -ELOOP) {
 218                         (void) dns_stub_send_failure(q->manager, q->request_dns_stream, q->request_dns_packet, DNS_RCODE_SERVFAIL, false);
 219                         break;
 220                 }
 221                 if (r < 0) {
 222                         log_debug_errno(r, "Failed to process CNAME: %m");
 223                         break;
 224                 }
 225                 if (r == DNS_QUERY_RESTARTED)
 226                         return;
 227
 228                 r = dns_stub_finish_reply_packet(
 229                                 q->reply_dns_packet,
 230                                 DNS_PACKET_ID(q->request_dns_packet),
 231                                 q->answer_rcode,
 232                                 truncated,
 233                                 !!q->request_dns_packet->opt,
 234                                 DNS_PACKET_DO(q->request_dns_packet),
 235                                 dns_query_fully_authenticated(q));
 236                 if (r < 0) {
 237                         log_debug_errno(r, "Failed to finish reply packet: %m");
 238                         break;
 239                 }
 240
 241                 (void) dns_stub_send(q->manager, q->request_dns_stream, q->request_dns_packet, q->reply_dns_packet);
 242                 break;
 243         }
 244
 245         case DNS_TRANSACTION_RCODE_FAILURE:
 246                 (void) dns_stub_send_failure(q->manager, q->request_dns_stream, q->request_dns_packet, q->answer_rcode, dns_query_fully_authenticated(q));
 247                 break;
 248
 249         case DNS_TRANSACTION_NOT_FOUND:
 250                 (void) dns_stub_send_failure(q->manager, q->request_dns_stream, q->request_dns_packet, DNS_RCODE_NXDOMAIN, dns_query_fully_authenticated(q));
 251                 break;
 252
 253         case DNS_TRANSACTION_TIMEOUT:
 254         case DNS_TRANSACTION_ATTEMPTS_MAX_REACHED:
 255                 /* Propagate a timeout as a no packet, i.e. that the client also gets a timeout */
 256                 break;
 257
 258         case DNS_TRANSACTION_NO_SERVERS:
 259         case DNS_TRANSACTION_INVALID_REPLY:
 260         case DNS_TRANSACTION_ERRNO:
 261         case DNS_TRANSACTION_ABORTED:
 262         case DNS_TRANSACTION_DNSSEC_FAILED:
 263         case DNS_TRANSACTION_NO_TRUST_ANCHOR:
 264         case DNS_TRANSACTION_RR_TYPE_UNSUPPORTED:
 265         case DNS_TRANSACTION_NETWORK_DOWN:
 266                 (void) dns_stub_send_failure(q->manager, q->request_dns_stream, q->request_dns_packet, DNS_RCODE_SERVFAIL, false);
 267                 break;
 268
 269         case DNS_TRANSACTION_NULL:
 270         case DNS_TRANSACTION_PENDING:
 271         case DNS_TRANSACTION_VALIDATING:
 272         default:
 273                 assert_not_reached("Impossible state");
 274         }
 275
 276         /* If there's a packet to write set, let's leave the stream around */
 277         if (q->request_dns_stream && DNS_STREAM_QUEUED(q->request_dns_stream)) {
 278
 279                 /* Detach the stream from our query (make it an orphan), but do not drop the reference to it. The
 280                  * default completion action of the stream will drop the reference. */
 281
 282                 dns_stub_detach_stream(q->request_dns_stream);
 283                 q->request_dns_stream = NULL;
 284         }
 285
 286         dns_query_free(q);
 287 }
 288
 289 static int dns_stub_stream_complete(DnsStream *s, int error) {
 290         assert(s);
 291
 292         log_debug_errno(error, "DNS TCP connection terminated, destroying query: %m");
 293
 294         assert(s->query);
 295         dns_query_free(s->query);
 296
 297         return 0;
 298 }
 299
 300 static void dns_stub_process_query(Manager *m, DnsStream *s, DnsPacket *p) {
 301         DnsQuery *q = NULL;
 302         int r;
 303
 304         assert(m);
 305         assert(p);
 306         assert(p->protocol == DNS_PROTOCOL_DNS);
 307
 308         /* Takes ownership of the *s stream object */
 309
 310         if (in_addr_is_localhost(p->family, &p->sender) <= 0 ||
 311             in_addr_is_localhost(p->family, &p->destination) <= 0) {
 312                 log_error("Got packet on unexpected IP range, refusing.");
 313                 dns_stub_send_failure(m, s, p, DNS_RCODE_SERVFAIL, false);
 314                 goto fail;
 315         }
 316
 317         r = dns_packet_extract(p);
 318         if (r < 0) {
 319                 log_debug_errno(r, "Failed to extract resources from incoming packet, ignoring packet: %m");
 320                 dns_stub_send_failure(m, s, p, DNS_RCODE_FORMERR, false);
 321                 goto fail;
 322         }
 323
 324         if (!DNS_PACKET_VERSION_SUPPORTED(p)) {
 325                 log_debug("Got EDNS OPT field with unsupported version number.");
 326                 dns_stub_send_failure(m, s, p, DNS_RCODE_BADVERS, false);
 327                 goto fail;
 328         }
 329
 330         if (dns_type_is_obsolete(p->question->keys[0]->type)) {
 331                 log_debug("Got message with obsolete key type, refusing.");
 332                 dns_stub_send_failure(m, s, p, DNS_RCODE_NOTIMP, false);
 333                 goto fail;
 334         }
 335
 336         if (dns_type_is_zone_transer(p->question->keys[0]->type)) {
 337                 log_debug("Got request for zone transfer, refusing.");
 338                 dns_stub_send_failure(m, s, p, DNS_RCODE_NOTIMP, false);
 339                 goto fail;
 340         }
 341
 342         if (!DNS_PACKET_RD(p))  {
 343                 /* If the "rd" bit is off (i.e. recursion was not requested), then refuse operation */
 344                 log_debug("Got request with recursion disabled, refusing.");
 345                 dns_stub_send_failure(m, s, p, DNS_RCODE_REFUSED, false);
 346                 goto fail;
 347         }
 348
 349         if (DNS_PACKET_DO(p) && DNS_PACKET_CD(p)) {
 350                 log_debug("Got request with DNSSEC CD bit set, refusing.");
 351                 dns_stub_send_failure(m, s, p, DNS_RCODE_NOTIMP, false);
 352                 goto fail;
 353         }
 354
 355         r = dns_query_new(m, &q, p->question, p->question, 0, SD_RESOLVED_PROTOCOLS_ALL|SD_RESOLVED_NO_SEARCH);
 356         if (r < 0) {
 357                 log_error_errno(r, "Failed to generate query object: %m");
 358                 dns_stub_send_failure(m, s, p, DNS_RCODE_SERVFAIL, false);
 359                 goto fail;
 360         }
 361
 362         /* Request that the TTL is corrected by the cached time for this lookup, so that we return vaguely useful TTLs */
 363         q->clamp_ttl = true;
 364
 365         q->request_dns_packet = dns_packet_ref(p);
 366         q->request_dns_stream = dns_stream_ref(s); /* make sure the stream stays around until we can send a reply through it */
 367         q->complete = dns_stub_query_complete;
 368
 369         if (s) {
 370                 s->on_packet = NULL;
 371                 s->complete = dns_stub_stream_complete;
 372                 s->query = q;
 373         }
 374
 375         r = dns_query_go(q);
 376         if (r < 0) {
 377                 log_error_errno(r, "Failed to start query: %m");
 378                 dns_stub_send_failure(m, s, p, DNS_RCODE_SERVFAIL, false);
 379                 goto fail;
 380         }
 381
 382         log_debug("Processing query...");
 383         return;
 384
 385 fail:
 386         if (s && DNS_STREAM_QUEUED(s))
 387                 dns_stub_detach_stream(s);
 388
 389         dns_query_free(q);
 390 }
 391
 392 static int on_dns_stub_packet(sd_event_source *s, int fd, uint32_t revents, void *userdata) {
 393         _cleanup_(dns_packet_unrefp) DnsPacket *p = NULL;
 394         Manager *m = userdata;
 395         int r;
 396
 397         r = manager_recv(m, fd, DNS_PROTOCOL_DNS, &p);
 398         if (r <= 0)
 399                 return r;
 400
 401         if (dns_packet_validate_query(p) > 0) {
 402                 log_debug("Got DNS stub UDP query packet for id %u", DNS_PACKET_ID(p));
 403
 404                 dns_stub_process_query(m, NULL, p);
 405         } else
 406                 log_debug("Invalid DNS stub UDP packet, ignoring.");
 407
 408         return 0;
 409 }
 410
 411 static int manager_dns_stub_udp_fd(Manager *m) {
 412         static const int one = 1;
 413         union sockaddr_union sa = {
 414                 .in.sin_family = AF_INET,
 415                 .in.sin_port = htobe16(53),
 416                 .in.sin_addr.s_addr = htobe32(INADDR_DNS_STUB),
 417         };
 418         _cleanup_close_ int fd = -1;
 419         int r;
 420
 421         if (m->dns_stub_udp_fd >= 0)
 422                 return m->dns_stub_udp_fd;
 423
 424         fd = socket(AF_INET, SOCK_DGRAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0);
 425         if (fd < 0)
 426                 return -errno;
 427
 428         if (setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &one, sizeof one) < 0)
 429                 return -errno;
 430
 431         if (setsockopt(fd, IPPROTO_IP, IP_PKTINFO, &one, sizeof one) < 0)
 432                 return -errno;
 433
 434         if (setsockopt(fd, IPPROTO_IP, IP_RECVTTL, &one, sizeof one) < 0)
 435                 return -errno;
 436
 437         /* Make sure no traffic from outside the local host can leak to onto this socket */
 438         if (setsockopt(fd, SOL_SOCKET, SO_BINDTODEVICE, "lo", 3) < 0)
 439                 return -errno;
 440
 441         if (bind(fd, &sa.sa, sizeof(sa.in)) < 0)
 442                 return -errno;
 443
 444         r = sd_event_add_io(m->event, &m->dns_stub_udp_event_source, fd, EPOLLIN, on_dns_stub_packet, m);
 445         if (r < 0)
 446                 return r;
 447
 448         (void) sd_event_source_set_description(m->dns_stub_udp_event_source, "dns-stub-udp");
 449         m->dns_stub_udp_fd = fd;
 450         fd = -1;
 451
 452         return m->dns_stub_udp_fd;
 453 }
 454
 455 static int on_dns_stub_stream_packet(DnsStream *s) {
 456         assert(s);
 457         assert(s->read_packet);
 458
 459         if (dns_packet_validate_query(s->read_packet) > 0) {
 460                 log_debug("Got DNS stub TCP query packet for id %u", DNS_PACKET_ID(s->read_packet));
 461
 462                 dns_stub_process_query(s->manager, s, s->read_packet);
 463         } else
 464                 log_debug("Invalid DNS stub TCP packet, ignoring.");
 465
 466         /* Drop the reference to the stream. Either a query was created and added its own reference to the stream now,
 467          * or that didn't happen in which case we want to free the stream */
 468         dns_stream_unref(s);
 469
 470         return 0;
 471 }
 472
 473 static int on_dns_stub_stream(sd_event_source *s, int fd, uint32_t revents, void *userdata) {
 474         DnsStream *stream;
 475         Manager *m = userdata;
 476         int cfd, r;
 477
 478         cfd = accept4(fd, NULL, NULL, SOCK_NONBLOCK|SOCK_CLOEXEC);
 479         if (cfd < 0) {
 480                 if (IN_SET(errno, EAGAIN, EINTR))
 481                         return 0;
 482
 483                 return -errno;
 484         }
 485
 486         r = dns_stream_new(m, &stream, DNS_PROTOCOL_DNS, cfd);
 487         if (r < 0) {
 488                 safe_close(cfd);
 489                 return r;
 490         }
 491
 492         stream->on_packet = on_dns_stub_stream_packet;
 493
 494         /* We let the reference to the stream dangling here, it will either be dropped by the default "complete" action
 495          * of the stream, or by our packet callback, or when the manager is shut down. */
 496
 497         return 0;
 498 }
 499
 500 static int manager_dns_stub_tcp_fd(Manager *m) {
 501         static const int one = 1;
 502         union sockaddr_union sa = {
 503                 .in.sin_family = AF_INET,
 504                 .in.sin_addr.s_addr = htobe32(INADDR_DNS_STUB),
 505                 .in.sin_port = htobe16(53),
 506         };
 507         _cleanup_close_ int fd = -1;
 508         int r;
 509
 510         if (m->dns_stub_tcp_fd >= 0)
 511                 return m->dns_stub_tcp_fd;
 512
 513         fd = socket(AF_INET, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0);
 514         if (fd < 0)
 515                 return -errno;
 516
 517         if (setsockopt(fd, IPPROTO_IP, IP_TTL, &one, sizeof one) < 0)
 518                 return -errno;
 519
 520         if (setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &one, sizeof one) < 0)
 521                 return -errno;
 522
 523         if (setsockopt(fd, IPPROTO_IP, IP_PKTINFO, &one, sizeof one) < 0)
 524                 return -errno;
 525
 526         if (setsockopt(fd, IPPROTO_IP, IP_RECVTTL, &one, sizeof one) < 0)
 527                 return -errno;
 528
 529         /* Make sure no traffic from outside the local host can leak to onto this socket */
 530         if (setsockopt(fd, SOL_SOCKET, SO_BINDTODEVICE, "lo", 3) < 0)
 531                 return -errno;
 532
 533         if (bind(fd, &sa.sa, sizeof(sa.in)) < 0)
 534                 return -errno;
 535
 536         if (listen(fd, SOMAXCONN) < 0)
 537                 return -errno;
 538
 539         r = sd_event_add_io(m->event, &m->dns_stub_tcp_event_source, fd, EPOLLIN, on_dns_stub_stream, m);
 540         if (r < 0)
 541                 return r;
 542
 543         (void) sd_event_source_set_description(m->dns_stub_tcp_event_source, "dns-stub-tcp");
 544         m->dns_stub_tcp_fd = fd;
 545         fd = -1;
 546
 547         return m->dns_stub_tcp_fd;
 548 }
 549
 550 int manager_dns_stub_start(Manager *m) {
 551         const char *t = "UDP";
 552         int r = 0;
 553
 554         assert(m);
 555
 556         if (m->dns_stub_listener_mode == DNS_STUB_LISTENER_NO)
 557                 log_debug("Not creating stub listener.");
 558         else
 559                 log_debug("Creating stub listener using %s.",
 560                           m->dns_stub_listener_mode == DNS_STUB_LISTENER_UDP ? "UDP" :
 561                           m->dns_stub_listener_mode == DNS_STUB_LISTENER_TCP ? "TCP" :
 562                           "UDP/TCP");
 563
 564         if (IN_SET(m->dns_stub_listener_mode, DNS_STUB_LISTENER_YES, DNS_STUB_LISTENER_UDP))
 565                 r = manager_dns_stub_udp_fd(m);
 566
 567         if (r >= 0 &&
 568             IN_SET(m->dns_stub_listener_mode, DNS_STUB_LISTENER_YES, DNS_STUB_LISTENER_TCP)) {
 569                 t = "TCP";
 570                 r = manager_dns_stub_tcp_fd(m);
 571         }
 572
 573         if (IN_SET(r, -EADDRINUSE, -EPERM)) {
 574                 if (r == -EADDRINUSE)
 575                         log_warning_errno(r,
 576                                           "Another process is already listening on %s socket 127.0.0.53:53.\n"
 577                                           "Turning off local DNS stub support.", t);
 578                 else
 579                         log_warning_errno(r,
 580                                           "Failed to listen on %s socket 127.0.0.53:53: %m.\n"
 581                                           "Turning off local DNS stub support.", t);
 582                 manager_dns_stub_stop(m);
 583         } else if (r < 0)
 584                 return log_error_errno(r, "Failed to listen on %s socket 127.0.0.53:53: %m", t);
 585
 586         return 0;
 587 }
 588
 589 void manager_dns_stub_stop(Manager *m) {
 590         assert(m);
 591
 592         m->dns_stub_udp_event_source = sd_event_source_unref(m->dns_stub_udp_event_source);
 593         m->dns_stub_tcp_event_source = sd_event_source_unref(m->dns_stub_tcp_event_source);
 594
 595         m->dns_stub_udp_fd = safe_close(m->dns_stub_udp_fd);
 596         m->dns_stub_tcp_fd = safe_close(m->dns_stub_tcp_fd);
 597 }