src/resolve/resolved-resolv-conf.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2 /***
   3   Copyright © 2014 Tom Gundersen <teg@jklm.no>
   4  ***/
   5
   6 #include <resolv.h>
   7 #include <stdio_ext.h>
   8
   9 #include "alloc-util.h"
  10 #include "dns-domain.h"
  11 #include "fd-util.h"
  12 #include "fileio-label.h"
  13 #include "fileio.h"
  14 #include "ordered-set.h"
  15 #include "resolved-conf.h"
  16 #include "resolved-dns-server.h"
  17 #include "resolved-resolv-conf.h"
  18 #include "string-util.h"
  19 #include "strv.h"
  20
  21 /* A resolv.conf file containing the DNS server and domain data we learnt from uplink, i.e. the full uplink data */
  22 #define PRIVATE_UPLINK_RESOLV_CONF "/run/systemd/resolve/resolv.conf"
  23
  24 /* A resolv.conf file containing the domain data we learnt from uplink, but our own DNS server address. */
  25 #define PRIVATE_STUB_RESOLV_CONF "/run/systemd/resolve/stub-resolv.conf"
  26
  27 /* A static resolv.conf file containing no domains, but only our own DNS sever address */
  28 #define PRIVATE_STATIC_RESOLV_CONF ROOTLIBEXECDIR "/resolv.conf"
  29
  30 static bool file_is_our_own(const struct stat *st) {
  31         const char *path;
  32
  33         assert(st);
  34
  35         FOREACH_STRING(path,
  36                        PRIVATE_UPLINK_RESOLV_CONF,
  37                        PRIVATE_STUB_RESOLV_CONF,
  38                        PRIVATE_STATIC_RESOLV_CONF) {
  39
  40                 struct stat own;
  41
  42                 /* Is it symlinked to our own uplink file? */
  43                 if (stat(path, &own) >= 0 &&
  44                     st->st_dev == own.st_dev &&
  45                     st->st_ino == own.st_ino)
  46                         return true;
  47         }
  48
  49         return false;
  50 }
  51
  52 int manager_read_resolv_conf(Manager *m) {
  53         _cleanup_fclose_ FILE *f = NULL;
  54         struct stat st;
  55         char line[LINE_MAX];
  56         unsigned n = 0;
  57         int r;
  58
  59         assert(m);
  60
  61         /* Reads the system /etc/resolv.conf, if it exists and is not
  62          * symlinked to our own resolv.conf instance */
  63
  64         if (!m->read_resolv_conf)
  65                 return 0;
  66
  67         r = stat("/etc/resolv.conf", &st);
  68         if (r < 0) {
  69                 if (errno == ENOENT)
  70                         return 0;
  71
  72                 r = log_warning_errno(errno, "Failed to stat /etc/resolv.conf: %m");
  73                 goto clear;
  74         }
  75
  76         /* Have we already seen the file? */
  77         if (timespec_load(&st.st_mtim) == m->resolv_conf_mtime)
  78                 return 0;
  79
  80         if (file_is_our_own(&st))
  81                 return 0;
  82
  83         f = fopen("/etc/resolv.conf", "re");
  84         if (!f) {
  85                 if (errno == ENOENT)
  86                         return 0;
  87
  88                 r = log_warning_errno(errno, "Failed to open /etc/resolv.conf: %m");
  89                 goto clear;
  90         }
  91
  92         if (fstat(fileno(f), &st) < 0) {
  93                 r = log_error_errno(errno, "Failed to stat open file: %m");
  94                 goto clear;
  95         }
  96
  97         if (file_is_our_own(&st))
  98                 return 0;
  99
 100         dns_server_mark_all(m->dns_servers);
 101         dns_search_domain_mark_all(m->search_domains);
 102
 103         FOREACH_LINE(line, f, r = -errno; goto clear) {
 104                 const char *a;
 105                 char *l;
 106
 107                 n++;
 108
 109                 l = strstrip(line);
 110                 if (IN_SET(*l, '#', ';', 0))
 111                         continue;
 112
 113                 a = first_word(l, "nameserver");
 114                 if (a) {
 115                         r = manager_parse_dns_server_string_and_warn(m, DNS_SERVER_SYSTEM, a);
 116                         if (r < 0)
 117                                 log_warning_errno(r, "Failed to parse DNS server address '%s', ignoring.", a);
 118
 119                         continue;
 120                 }
 121
 122                 a = first_word(l, "domain");
 123                 if (!a) /* We treat "domain" lines, and "search" lines as equivalent, and add both to our list. */
 124                         a = first_word(l, "search");
 125                 if (a) {
 126                         r = manager_parse_search_domains_and_warn(m, a);
 127                         if (r < 0)
 128                                 log_warning_errno(r, "Failed to parse search domain string '%s', ignoring.", a);
 129                 }
 130
 131                 log_syntax(NULL, LOG_DEBUG, "/etc/resolv.conf", n, 0, "Ignoring resolv.conf line: %s", l);
 132         }
 133
 134         m->resolv_conf_mtime = timespec_load(&st.st_mtim);
 135
 136         /* Flush out all servers and search domains that are still
 137          * marked. Those are then ones that didn't appear in the new
 138          * /etc/resolv.conf */
 139         dns_server_unlink_marked(m->dns_servers);
 140         dns_search_domain_unlink_marked(m->search_domains);
 141
 142         /* Whenever /etc/resolv.conf changes, start using the first
 143          * DNS server of it. This is useful to deal with broken
 144          * network managing implementations (like NetworkManager),
 145          * that when connecting to a VPN place both the VPN DNS
 146          * servers and the local ones in /etc/resolv.conf. Without
 147          * resetting the DNS server to use back to the first entry we
 148          * will continue to use the local one thus being unable to
 149          * resolve VPN domains. */
 150         manager_set_dns_server(m, m->dns_servers);
 151
 152         /* Unconditionally flush the cache when /etc/resolv.conf is
 153          * modified, even if the data it contained was completely
 154          * identical to the previous version we used. We do this
 155          * because altering /etc/resolv.conf is typically done when
 156          * the network configuration changes, and that should be
 157          * enough to flush the global unicast DNS cache. */
 158         if (m->unicast_scope)
 159                 dns_cache_flush(&m->unicast_scope->cache);
 160
 161         /* If /etc/resolv.conf changed, make sure to forget everything we learned about the DNS servers. After all we
 162          * might now talk to a very different DNS server that just happens to have the same IP address as an old one
 163          * (think 192.168.1.1). */
 164         dns_server_reset_features_all(m->dns_servers);
 165
 166         return 0;
 167
 168 clear:
 169         dns_server_unlink_all(m->dns_servers);
 170         dns_search_domain_unlink_all(m->search_domains);
 171         return r;
 172 }
 173
 174 static void write_resolv_conf_server(DnsServer *s, FILE *f, unsigned *count) {
 175         assert(s);
 176         assert(f);
 177         assert(count);
 178
 179         if (!dns_server_string(s)) {
 180                 log_warning("Out of memory, or invalid DNS address. Ignoring server.");
 181                 return;
 182         }
 183
 184         /* Check if the DNS server is limited to particular domains;
 185          * resolv.conf does not have a syntax to express that, so it must not
 186          * appear as a global name server to avoid routing unrelated domains to
 187          * it (which is a privacy violation, will most probably fail anyway,
 188          * and adds unnecessary load) */
 189         if (dns_server_limited_domains(s)) {
 190                 log_debug("DNS server %s has route-only domains, not using as global name server", dns_server_string(s));
 191                 return;
 192         }
 193
 194         if (*count == MAXNS)
 195                 fputs("# Too many DNS servers configured, the following entries may be ignored.\n", f);
 196         (*count)++;
 197
 198         fprintf(f, "nameserver %s\n", dns_server_string(s));
 199 }
 200
 201 static void write_resolv_conf_search(
 202                 OrderedSet *domains,
 203                 FILE *f) {
 204         unsigned length = 0, count = 0;
 205         Iterator i;
 206         char *domain;
 207
 208         assert(domains);
 209         assert(f);
 210
 211         fputs("search", f);
 212
 213         ORDERED_SET_FOREACH(domain, domains, i) {
 214                 if (++count > MAXDNSRCH) {
 215                         fputs("\n# Too many search domains configured, remaining ones ignored.", f);
 216                         break;
 217                 }
 218                 length += strlen(domain) + 1;
 219                 if (length > 256) {
 220                         fputs("\n# Total length of all search domains is too long, remaining ones ignored.", f);
 221                         break;
 222                 }
 223                 fputc(' ', f);
 224                 fputs(domain, f);
 225         }
 226
 227         fputs("\n", f);
 228 }
 229
 230 static int write_uplink_resolv_conf_contents(FILE *f, OrderedSet *dns, OrderedSet *domains) {
 231         Iterator i;
 232
 233         fputs("# This file is managed by man:systemd-resolved(8). Do not edit.\n"
 234               "#\n"
 235               "# This is a dynamic resolv.conf file for connecting local clients directly to\n"
 236               "# all known uplink DNS servers. This file lists all configured search domains.\n"
 237               "#\n"
 238               "# Third party programs must not access this file directly, but only through the\n"
 239               "# symlink at /etc/resolv.conf. To manage man:resolv.conf(5) in a different way,\n"
 240               "# replace this symlink by a static file or a different symlink.\n"
 241               "#\n"
 242               "# See man:systemd-resolved.service(8) for details about the supported modes of\n"
 243               "# operation for /etc/resolv.conf.\n"
 244               "\n", f);
 245
 246         if (ordered_set_isempty(dns))
 247                 fputs("# No DNS servers known.\n", f);
 248         else {
 249                 unsigned count = 0;
 250                 DnsServer *s;
 251
 252                 ORDERED_SET_FOREACH(s, dns, i)
 253                         write_resolv_conf_server(s, f, &count);
 254         }
 255
 256         if (!ordered_set_isempty(domains))
 257                 write_resolv_conf_search(domains, f);
 258
 259         return fflush_and_check(f);
 260 }
 261
 262 static int write_stub_resolv_conf_contents(FILE *f, OrderedSet *dns, OrderedSet *domains) {
 263         fputs_unlocked("# This file is managed by man:systemd-resolved(8). Do not edit.\n"
 264                        "#\n"
 265                        "# This is a dynamic resolv.conf file for connecting local clients to the\n"
 266                        "# internal DNS stub resolver of systemd-resolved. This file lists all\n"
 267                        "# configured search domains.\n"
 268                        "#\n"
 269                        "# Run \"resolvectl status\" to see details about the uplink DNS servers\n"
 270                        "# currently in use.\n"
 271                        "#\n"
 272                        "# Third party programs must not access this file directly, but only through the\n"
 273                        "# symlink at /etc/resolv.conf. To manage man:resolv.conf(5) in a different way,\n"
 274                        "# replace this symlink by a static file or a different symlink.\n"
 275                        "#\n"
 276                        "# See man:systemd-resolved.service(8) for details about the supported modes of\n"
 277                        "# operation for /etc/resolv.conf.\n"
 278                        "\n"
 279                        "nameserver 127.0.0.53\n", f);
 280
 281         if (!ordered_set_isempty(domains))
 282                 write_resolv_conf_search(domains, f);
 283
 284         return fflush_and_check(f);
 285 }
 286
 287 int manager_write_resolv_conf(Manager *m) {
 288
 289         _cleanup_ordered_set_free_ OrderedSet *dns = NULL, *domains = NULL;
 290         _cleanup_free_ char *temp_path_uplink = NULL, *temp_path_stub = NULL;
 291         _cleanup_fclose_ FILE *f_uplink = NULL, *f_stub = NULL;
 292         int r;
 293
 294         assert(m);
 295
 296         /* Read the system /etc/resolv.conf first */
 297         (void) manager_read_resolv_conf(m);
 298
 299         /* Add the full list to a set, to filter out duplicates */
 300         r = manager_compile_dns_servers(m, &dns);
 301         if (r < 0)
 302                 return log_warning_errno(r, "Failed to compile list of DNS servers: %m");
 303
 304         r = manager_compile_search_domains(m, &domains, false);
 305         if (r < 0)
 306                 return log_warning_errno(r, "Failed to compile list of search domains: %m");
 307
 308         r = fopen_temporary_label(PRIVATE_UPLINK_RESOLV_CONF, PRIVATE_UPLINK_RESOLV_CONF, &f_uplink, &temp_path_uplink);
 309         if (r < 0)
 310                 return log_warning_errno(r, "Failed to open private resolv.conf file for writing: %m");
 311
 312         (void) __fsetlocking(f_uplink, FSETLOCKING_BYCALLER);
 313         (void) fchmod(fileno(f_uplink), 0644);
 314
 315         r = fopen_temporary_label(PRIVATE_STUB_RESOLV_CONF, PRIVATE_STUB_RESOLV_CONF, &f_stub, &temp_path_stub);
 316         if (r < 0)
 317                 return log_warning_errno(r, "Failed to open private stub-resolv.conf file for writing: %m");
 318
 319         (void) __fsetlocking(f_stub, FSETLOCKING_BYCALLER);
 320         (void) fchmod(fileno(f_stub), 0644);
 321
 322         r = write_uplink_resolv_conf_contents(f_uplink, dns, domains);
 323         if (r < 0) {
 324                 log_error_errno(r, "Failed to write private resolv.conf contents: %m");
 325                 goto fail;
 326         }
 327
 328         if (rename(temp_path_uplink, PRIVATE_UPLINK_RESOLV_CONF) < 0) {
 329                 r = log_error_errno(errno, "Failed to move private resolv.conf file into place: %m");
 330                 goto fail;
 331         }
 332
 333         r = write_stub_resolv_conf_contents(f_stub, dns, domains);
 334         if (r < 0) {
 335                 log_error_errno(r, "Failed to write private stub-resolv.conf contents: %m");
 336                 goto fail;
 337         }
 338
 339         if (rename(temp_path_stub, PRIVATE_STUB_RESOLV_CONF) < 0) {
 340                 r = log_error_errno(errno, "Failed to move private stub-resolv.conf file into place: %m");
 341                 goto fail;
 342         }
 343
 344         return 0;
 345
 346 fail:
 347         (void) unlink(PRIVATE_UPLINK_RESOLV_CONF);
 348         (void) unlink(temp_path_uplink);
 349         (void) unlink(PRIVATE_STUB_RESOLV_CONF);
 350         (void) unlink(temp_path_stub);
 351
 352         return r;
 353 }