From 73f50a76aac20a9c2fda67c5eba25661e2ebb119 Mon Sep 17 00:00:00 2001 From: Stefano Brivio Date: Wed, 2 Nov 2022 23:52:38 +0100 Subject: conf: Split the notions of read DNS addresses and offered ones With --dns-forward, if the host has a loopback address configured as DNS server, we should actually use it to forward queries, but, if --no-map-gw is passed, we shouldn't offer the same address via DHCP, NDP and DHCPv6, because it's not going to be reachable. Problematic configuration: * systemd-resolved configuring the usual 127.0.0.53 on the host: we read that from /etc/resolv.conf * --dns-forward specified with an unrelated address, for example 198.51.100.1 We still want to forward queries to 127.0.0.53, if we receive one directed to 198.51.100.1, so we can't drop 127.0.0.53 from our list: we want to use it for forwarding. At the same time, we shouldn't offer 127.0.0.53 to the guest or container either. With this change, I'm only covering the case of automatically configured DNS servers from /etc/resolv.conf. We could extend this to addresses configured with command-line options, but I don't really see a likely use case at this point. Signed-off-by: Stefano Brivio --- conf.c | 49 +++++++++++++++++++++++++++++++++++-------------- 1 file changed, 35 insertions(+), 14 deletions(-) (limited to 'conf.c') diff --git a/conf.c b/conf.c index b51effc..bfecdff 100644 --- a/conf.c +++ b/conf.c @@ -355,10 +355,12 @@ overlap: */ static void get_dns(struct ctx *c) { + struct in6_addr *dns6_send = &c->ip6.dns_send[0]; + struct in_addr *dns4_send = &c->ip4.dns_send[0]; int dns4_set, dns6_set, dnss_set, dns_set, fd; struct in6_addr *dns6 = &c->ip6.dns[0]; - struct fqdn *s = c->dns_search; struct in_addr *dns4 = &c->ip4.dns[0]; + struct fqdn *s = c->dns_search; struct lineread resolvconf; int line_len; char *line, *p, *end; @@ -388,31 +390,47 @@ static void get_dns(struct ctx *c) if (!dns4_set && dns4 - &c->ip4.dns[0] < ARRAY_SIZE(c->ip4.dns) - 1 && inet_pton(AF_INET, p + 1, dns4)) { - /* We can only access local addresses via the gw redirect */ + /* Guest or container can only access local + * addresses via local redirect + */ if (IN4_IS_ADDR_LOOPBACK(dns4)) { - if (c->no_map_gw) { - dns4->s_addr = htonl(INADDR_ANY); - continue; + if (!c->no_map_gw) { + *dns4_send = c->ip4.gw; + dns4_send++; } - *dns4 = c->ip4.gw; + } else { + *dns4_send = *dns4; + dns4_send++; } + dns4++; + dns4->s_addr = htonl(INADDR_ANY); + dns4_send->s_addr = htonl(INADDR_ANY); } if (!dns6_set && dns6 - &c->ip6.dns[0] < ARRAY_SIZE(c->ip6.dns) - 1 && inet_pton(AF_INET6, p + 1, dns6)) { - /* We can only access local addresses via the gw redirect */ + /* Guest or container can only access local + * addresses via local redirect + */ if (IN6_IS_ADDR_LOOPBACK(dns6)) { - if (c->no_map_gw) { - memset(dns6, 0, sizeof(*dns6)); - continue; + if (!c->no_map_gw) { + memcpy(dns6_send, &c->ip6.gw, + sizeof(*dns6_send)); + dns6_send++; } - memcpy(dns6, &c->ip6.gw, sizeof(*dns6)); + } else { + memcpy(dns6_send, dns6, + sizeof(*dns6_send)); + dns6_send++; } + dns6++; + memset(dns6, 0, sizeof(*dns6)); + memset(dns6_send, 0, sizeof(*dns6_send)); } } else if (!dnss_set && strstr(line, "search ") == line && s == c->dns_search) { @@ -876,10 +894,12 @@ static void conf_print(const struct ctx *c) inet_ntop(AF_INET, &c->ip4.gw, buf4, sizeof(buf4))); } - for (i = 0; !IN4_IS_ADDR_UNSPECIFIED(&c->ip4.dns[i]); i++) { + for (i = 0; !IN4_IS_ADDR_UNSPECIFIED(&c->ip4.dns_send[i]); + i++) { if (!i) info("DNS:"); - inet_ntop(AF_INET, &c->ip4.dns[i], buf4, sizeof(buf4)); + inet_ntop(AF_INET, &c->ip4.dns_send[i], buf4, + sizeof(buf4)); info(" %s", buf4); } @@ -910,7 +930,8 @@ static void conf_print(const struct ctx *c) inet_ntop(AF_INET6, &c->ip6.addr_ll, buf6, sizeof(buf6))); dns6: - for (i = 0; !IN6_IS_ADDR_UNSPECIFIED(&c->ip6.dns[i]); i++) { + for (i = 0; !IN6_IS_ADDR_UNSPECIFIED(&c->ip6.dns_send[i]); + i++) { if (!i) info("DNS:"); inet_ntop(AF_INET6, &c->ip6.dns[i], buf6, sizeof(buf6)); -- cgit v1.2.3