src/resolve/resolved-resolv-conf.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2 /***
   3   This file is part of systemd.
   4
   5   Copyright 2014 Tom Gundersen <teg@jklm.no>
   6  ***/
   7
   8 #include <resolv.h>
   9 #include <stdio_ext.h>
  10
  11 #include "alloc-util.h"
  12 #include "dns-domain.h"
  13 #include "fd-util.h"
  14 #include "fileio-label.h"
  15 #include "fileio.h"
  16 #include "ordered-set.h"
  17 #include "resolved-conf.h"
  18 #include "resolved-dns-server.h"
  19 #include "resolved-resolv-conf.h"
  20 #include "string-util.h"
  21 #include "strv.h"
  22
  23 /* A resolv.conf file containing the DNS server and domain data we learnt from uplink, i.e. the full uplink data */
  24 #define PRIVATE_UPLINK_RESOLV_CONF "/run/systemd/resolve/resolv.conf"
  25
  26 /* A resolv.conf file containing the domain data we learnt from uplink, but our own DNS server address. */
  27 #define PRIVATE_STUB_RESOLV_CONF "/run/systemd/resolve/stub-resolv.conf"
  28
  29 /* A static resolv.conf file containing no domains, but only our own DNS sever address */
  30 #define PRIVATE_STATIC_RESOLV_CONF ROOTLIBEXECDIR "/resolv.conf"
  31
  32 static bool file_is_our_own(const struct stat *st) {
  33         const char *path;
  34
  35         assert(st);
  36
  37         FOREACH_STRING(path,
  38                        PRIVATE_UPLINK_RESOLV_CONF,
  39                        PRIVATE_STUB_RESOLV_CONF,
  40                        PRIVATE_STATIC_RESOLV_CONF) {
  41
  42                 struct stat own;
  43
  44                 /* Is it symlinked to our own uplink file? */
  45                 if (stat(path, &own) >= 0 &&
  46                     st->st_dev == own.st_dev &&
  47                     st->st_ino == own.st_ino)
  48                         return true;
  49         }
  50
  51         return false;
  52 }
  53
  54 int manager_read_resolv_conf(Manager *m) {
  55         _cleanup_fclose_ FILE *f = NULL;
  56         struct stat st;
  57         char line[LINE_MAX];
  58         unsigned n = 0;
  59         int r;
  60
  61         assert(m);
  62
  63         /* Reads the system /etc/resolv.conf, if it exists and is not
  64          * symlinked to our own resolv.conf instance */
  65
  66         if (!m->read_resolv_conf)
  67                 return 0;
  68
  69         r = stat("/etc/resolv.conf", &st);
  70         if (r < 0) {
  71                 if (errno == ENOENT)
  72                         return 0;
  73
  74                 r = log_warning_errno(errno, "Failed to stat /etc/resolv.conf: %m");
  75                 goto clear;
  76         }
  77
  78         /* Have we already seen the file? */
  79         if (timespec_load(&st.st_mtim) == m->resolv_conf_mtime)
  80                 return 0;
  81
  82         if (file_is_our_own(&st))
  83                 return 0;
  84
  85         f = fopen("/etc/resolv.conf", "re");
  86         if (!f) {
  87                 if (errno == ENOENT)
  88                         return 0;
  89
  90                 r = log_warning_errno(errno, "Failed to open /etc/resolv.conf: %m");
  91                 goto clear;
  92         }
  93
  94         if (fstat(fileno(f), &st) < 0) {
  95                 r = log_error_errno(errno, "Failed to stat open file: %m");
  96                 goto clear;
  97         }
  98
  99         if (file_is_our_own(&st))
 100                 return 0;
 101
 102         dns_server_mark_all(m->dns_servers);
 103         dns_search_domain_mark_all(m->search_domains);
 104
 105         FOREACH_LINE(line, f, r = -errno; goto clear) {
 106                 const char *a;
 107                 char *l;
 108
 109                 n++;
 110
 111                 l = strstrip(line);
 112                 if (IN_SET(*l, '#', ';', 0))
 113                         continue;
 114
 115                 a = first_word(l, "nameserver");
 116                 if (a) {
 117                         r = manager_parse_dns_server_string_and_warn(m, DNS_SERVER_SYSTEM, a);
 118                         if (r < 0)
 119                                 log_warning_errno(r, "Failed to parse DNS server address '%s', ignoring.", a);
 120
 121                         continue;
 122                 }
 123
 124                 a = first_word(l, "domain");
 125                 if (!a) /* We treat "domain" lines, and "search" lines as equivalent, and add both to our list. */
 126                         a = first_word(l, "search");
 127                 if (a) {
 128                         r = manager_parse_search_domains_and_warn(m, a);
 129                         if (r < 0)
 130                                 log_warning_errno(r, "Failed to parse search domain string '%s', ignoring.", a);
 131                 }
 132
 133                 log_syntax(NULL, LOG_DEBUG, "/etc/resolv.conf", n, 0, "Ignoring resolv.conf line: %s", l);
 134         }
 135
 136         m->resolv_conf_mtime = timespec_load(&st.st_mtim);
 137
 138         /* Flush out all servers and search domains that are still
 139          * marked. Those are then ones that didn't appear in the new
 140          * /etc/resolv.conf */
 141         dns_server_unlink_marked(m->dns_servers);
 142         dns_search_domain_unlink_marked(m->search_domains);
 143
 144         /* Whenever /etc/resolv.conf changes, start using the first
 145          * DNS server of it. This is useful to deal with broken
 146          * network managing implementations (like NetworkManager),
 147          * that when connecting to a VPN place both the VPN DNS
 148          * servers and the local ones in /etc/resolv.conf. Without
 149          * resetting the DNS server to use back to the first entry we
 150          * will continue to use the local one thus being unable to
 151          * resolve VPN domains. */
 152         manager_set_dns_server(m, m->dns_servers);
 153
 154         /* Unconditionally flush the cache when /etc/resolv.conf is
 155          * modified, even if the data it contained was completely
 156          * identical to the previous version we used. We do this
 157          * because altering /etc/resolv.conf is typically done when
 158          * the network configuration changes, and that should be
 159          * enough to flush the global unicast DNS cache. */
 160         if (m->unicast_scope)
 161                 dns_cache_flush(&m->unicast_scope->cache);
 162
 163         /* If /etc/resolv.conf changed, make sure to forget everything we learned about the DNS servers. After all we
 164          * might now talk to a very different DNS server that just happens to have the same IP address as an old one
 165          * (think 192.168.1.1). */
 166         dns_server_reset_features_all(m->dns_servers);
 167
 168         return 0;
 169
 170 clear:
 171         dns_server_unlink_all(m->dns_servers);
 172         dns_search_domain_unlink_all(m->search_domains);
 173         return r;
 174 }
 175
 176 static void write_resolv_conf_server(DnsServer *s, FILE *f, unsigned *count) {
 177         assert(s);
 178         assert(f);
 179         assert(count);
 180
 181         if (!dns_server_string(s)) {
 182                 log_warning("Our of memory, or invalid DNS address. Ignoring server.");
 183                 return;
 184         }
 185
 186         /* Check if the DNS server is limited to particular domains;
 187          * resolv.conf does not have a syntax to express that, so it must not
 188          * appear as a global name server to avoid routing unrelated domains to
 189          * it (which is a privacy violation, will most probably fail anyway,
 190          * and adds unnecessary load) */
 191         if (dns_server_limited_domains(s)) {
 192                 log_debug("DNS server %s has route-only domains, not using as global name server", dns_server_string(s));
 193                 return;
 194         }
 195
 196         if (*count == MAXNS)
 197                 fputs("# Too many DNS servers configured, the following entries may be ignored.\n", f);
 198         (*count)++;
 199
 200         fprintf(f, "nameserver %s\n", dns_server_string(s));
 201 }
 202
 203 static void write_resolv_conf_search(
 204                 OrderedSet *domains,
 205                 FILE *f) {
 206         unsigned length = 0, count = 0;
 207         Iterator i;
 208         char *domain;
 209
 210         assert(domains);
 211         assert(f);
 212
 213         fputs("search", f);
 214
 215         ORDERED_SET_FOREACH(domain, domains, i) {
 216                 if (++count > MAXDNSRCH) {
 217                         fputs("\n# Too many search domains configured, remaining ones ignored.", f);
 218                         break;
 219                 }
 220                 length += strlen(domain) + 1;
 221                 if (length > 256) {
 222                         fputs("\n# Total length of all search domains is too long, remaining ones ignored.", f);
 223                         break;
 224                 }
 225                 fputc(' ', f);
 226                 fputs(domain, f);
 227         }
 228
 229         fputs("\n", f);
 230 }
 231
 232 static int write_uplink_resolv_conf_contents(FILE *f, OrderedSet *dns, OrderedSet *domains) {
 233         Iterator i;
 234
 235         fputs("# This file is managed by man:systemd-resolved(8). Do not edit.\n"
 236               "#\n"
 237               "# This is a dynamic resolv.conf file for connecting local clients directly to\n"
 238               "# all known uplink DNS servers. This file lists all configured search domains.\n"
 239               "#\n"
 240               "# Third party programs must not access this file directly, but only through the\n"
 241               "# symlink at /etc/resolv.conf. To manage man:resolv.conf(5) in a different way,\n"
 242               "# replace this symlink by a static file or a different symlink.\n"
 243               "#\n"
 244               "# See man:systemd-resolved.service(8) for details about the supported modes of\n"
 245               "# operation for /etc/resolv.conf.\n"
 246               "\n", f);
 247
 248         if (ordered_set_isempty(dns))
 249                 fputs("# No DNS servers known.\n", f);
 250         else {
 251                 unsigned count = 0;
 252                 DnsServer *s;
 253
 254                 ORDERED_SET_FOREACH(s, dns, i)
 255                         write_resolv_conf_server(s, f, &count);
 256         }
 257
 258         if (!ordered_set_isempty(domains))
 259                 write_resolv_conf_search(domains, f);
 260
 261         return fflush_and_check(f);
 262 }
 263
 264 static int write_stub_resolv_conf_contents(FILE *f, OrderedSet *dns, OrderedSet *domains) {
 265         fputs_unlocked("# This file is managed by man:systemd-resolved(8). Do not edit.\n"
 266                        "#\n"
 267                        "# This is a dynamic resolv.conf file for connecting local clients to the\n"
 268                        "# internal DNS stub resolver of systemd-resolved. This file lists all\n"
 269                        "# configured search domains.\n"
 270                        "#\n"
 271                        "# Run \"resolvectl status\" to see details about the uplink DNS servers\n"
 272                        "# currently in use.\n"
 273                        "#\n"
 274                        "# Third party programs must not access this file directly, but only through the\n"
 275                        "# symlink at /etc/resolv.conf. To manage man:resolv.conf(5) in a different way,\n"
 276                        "# replace this symlink by a static file or a different symlink.\n"
 277                        "#\n"
 278                        "# See man:systemd-resolved.service(8) for details about the supported modes of\n"
 279                        "# operation for /etc/resolv.conf.\n"
 280                        "\n"
 281                        "nameserver 127.0.0.53\n", f);
 282
 283         if (!ordered_set_isempty(domains))
 284                 write_resolv_conf_search(domains, f);
 285
 286         return fflush_and_check(f);
 287 }
 288
 289 int manager_write_resolv_conf(Manager *m) {
 290
 291         _cleanup_ordered_set_free_ OrderedSet *dns = NULL, *domains = NULL;
 292         _cleanup_free_ char *temp_path_uplink = NULL, *temp_path_stub = NULL;
 293         _cleanup_fclose_ FILE *f_uplink = NULL, *f_stub = NULL;
 294         int r;
 295
 296         assert(m);
 297
 298         /* Read the system /etc/resolv.conf first */
 299         (void) manager_read_resolv_conf(m);
 300
 301         /* Add the full list to a set, to filter out duplicates */
 302         r = manager_compile_dns_servers(m, &dns);
 303         if (r < 0)
 304                 return log_warning_errno(r, "Failed to compile list of DNS servers: %m");
 305
 306         r = manager_compile_search_domains(m, &domains, false);
 307         if (r < 0)
 308                 return log_warning_errno(r, "Failed to compile list of search domains: %m");
 309
 310         r = fopen_temporary_label(PRIVATE_UPLINK_RESOLV_CONF, PRIVATE_UPLINK_RESOLV_CONF, &f_uplink, &temp_path_uplink);
 311         if (r < 0)
 312                 return log_warning_errno(r, "Failed to open private resolv.conf file for writing: %m");
 313
 314         (void) __fsetlocking(f_uplink, FSETLOCKING_BYCALLER);
 315         (void) fchmod(fileno(f_uplink), 0644);
 316
 317         r = fopen_temporary_label(PRIVATE_STUB_RESOLV_CONF, PRIVATE_STUB_RESOLV_CONF, &f_stub, &temp_path_stub);
 318         if (r < 0)
 319                 return log_warning_errno(r, "Failed to open private stub-resolv.conf file for writing: %m");
 320
 321         (void) __fsetlocking(f_stub, FSETLOCKING_BYCALLER);
 322         (void) fchmod(fileno(f_stub), 0644);
 323
 324         r = write_uplink_resolv_conf_contents(f_uplink, dns, domains);
 325         if (r < 0) {
 326                 log_error_errno(r, "Failed to write private resolv.conf contents: %m");
 327                 goto fail;
 328         }
 329
 330         if (rename(temp_path_uplink, PRIVATE_UPLINK_RESOLV_CONF) < 0) {
 331                 r = log_error_errno(errno, "Failed to move private resolv.conf file into place: %m");
 332                 goto fail;
 333         }
 334
 335         r = write_stub_resolv_conf_contents(f_stub, dns, domains);
 336         if (r < 0) {
 337                 log_error_errno(r, "Failed to write private stub-resolv.conf contents: %m");
 338                 goto fail;
 339         }
 340
 341         if (rename(temp_path_stub, PRIVATE_STUB_RESOLV_CONF) < 0) {
 342                 r = log_error_errno(errno, "Failed to move private stub-resolv.conf file into place: %m");
 343                 goto fail;
 344         }
 345
 346         return 0;
 347
 348 fail:
 349         (void) unlink(PRIVATE_UPLINK_RESOLV_CONF);
 350         (void) unlink(temp_path_uplink);
 351         (void) unlink(PRIVATE_STUB_RESOLV_CONF);
 352         (void) unlink(temp_path_stub);
 353
 354         return r;
 355 }