mirrors/passt
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

conf, udp: Drop mostly duplicated dns_send arrays, rename related fields

Browse source 
Given that we use just the first valid DNS resolver address
configured, or read from resolv.conf(5) on the host, to forward DNS
queries to, in case --dns-forward is used, we don't need to duplicate
dns[] to dns_send[]:

- rename dns_send[] back to dns[]: those are the resolvers we
  advertise to the guest/container

- for forwarding purposes, instead of dns[], use a single field (for
  each protocol version): dns_host

- and rename dns_fwd to dns_match, so that it's clear this is the
  address we are matching DNS queries against, to decide if they need
  to be forwarded

Suggested-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
This commit is contained in:
Stefano Brivio 2022-11-10 20:30:03 +01:00
parent 4129764eca
commit 3a2afde87d
6 changed files with 62 additions and 71 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

76
conf.c
View file

@ -355,11 +355,9 @@ overlap:
*/ */
static void get_dns(struct ctx *c) static void get_dns(struct ctx *c)
{ {
struct in6_addr *dns6_send = &c->ip6.dns_send[0]; struct in6_addr *dns6 = &c->ip6.dns[0], dns6_tmp;
struct in_addr *dns4_send = &c->ip4.dns_send[0]; struct in_addr *dns4 = &c->ip4.dns[0], dns4_tmp;
int dns4_set, dns6_set, dnss_set, dns_set, fd; int dns4_set, dns6_set, dnss_set, dns_set, fd;
struct in6_addr *dns6 = &c->ip6.dns[0];
struct in_addr *dns4 = &c->ip4.dns[0];
struct fqdn *s = c->dns_search; struct fqdn *s = c->dns_search;
struct lineread resolvconf; struct lineread resolvconf;
int line_len; int line_len;
@ -388,49 +386,44 @@ static void get_dns(struct ctx *c)
*end = 0; *end = 0;
if (!dns4_set && if (!dns4_set &&
dns4 - &c->ip4.dns[0] < ARRAY_SIZE(c->ip4.dns) - 1 && dns4 - &c->ip4.dns[0] < ARRAY_SIZE(c->ip4.dns) - 1
inet_pton(AF_INET, p + 1, dns4)) { && inet_pton(AF_INET, p + 1, &dns4_tmp)) {
/* Guest or container can only access local /* Guest or container can only access local
* addresses via local redirect * addresses via local redirect
*/ */
if (IN4_IS_ADDR_LOOPBACK(dns4)) { if (IN4_IS_ADDR_LOOPBACK(&dns4_tmp)) {
if (!c->no_map_gw) { if (!c->no_map_gw) {
*dns4_send = c->ip4.gw; *dns4 = c->ip4.gw;
dns4_send++; dns4++;
} }
} else { } else {
*dns4_send = *dns4; *dns4 = dns4_tmp;
dns4_send++; dns4++;
} }
dns4++; if (IN4_IS_ADDR_UNSPECIFIED(&c->ip4.dns_host))
c->ip4.dns_host = dns4_tmp;
dns4->s_addr = htonl(INADDR_ANY);
dns4_send->s_addr = htonl(INADDR_ANY);
} }
if (!dns6_set && if (!dns6_set &&
dns6 - &c->ip6.dns[0] < ARRAY_SIZE(c->ip6.dns) - 1 && dns6 - &c->ip6.dns[0] < ARRAY_SIZE(c->ip6.dns) - 1
inet_pton(AF_INET6, p + 1, dns6)) { && inet_pton(AF_INET6, p + 1, &dns6_tmp)) {
/* Guest or container can only access local /* Guest or container can only access local
* addresses via local redirect * addresses via local redirect
*/ */
if (IN6_IS_ADDR_LOOPBACK(dns6)) { if (IN6_IS_ADDR_LOOPBACK(&dns6_tmp)) {
if (!c->no_map_gw) { if (!c->no_map_gw) {
memcpy(dns6_send, &c->ip6.gw, memcpy(dns6, &c->ip6.gw,
sizeof(*dns6_send)); sizeof(*dns6));
dns6_send++; dns6++;
} }
} else { } else {
memcpy(dns6_send, dns6, memcpy(dns6, &dns6_tmp, sizeof(*dns6));
sizeof(*dns6_send)); dns6++;
dns6_send++;
} }
dns6++; if (IN6_IS_ADDR_UNSPECIFIED(&c->ip6.dns_host))
c->ip6.dns_host = dns6_tmp;
memset(dns6, 0, sizeof(*dns6));
memset(dns6_send, 0, sizeof(*dns6_send));
} }
} else if (!dnss_set && strstr(line, "search ") == line && } else if (!dnss_set && strstr(line, "search ") == line &&
s == c->dns_search) { s == c->dns_search) {
@ -897,12 +890,10 @@ static void conf_print(const struct ctx *c)
inet_ntop(AF_INET, &c->ip4.gw, buf4, sizeof(buf4))); inet_ntop(AF_INET, &c->ip4.gw, buf4, sizeof(buf4)));
} }
for (i = 0; !IN4_IS_ADDR_UNSPECIFIED(&c->ip4.dns_send[i]); for (i = 0; !IN4_IS_ADDR_UNSPECIFIED(&c->ip4.dns[i]); i++) {
i++) {
if (!i) if (!i)
info("DNS:"); info("DNS:");
inet_ntop(AF_INET, &c->ip4.dns_send[i], buf4, inet_ntop(AF_INET, &c->ip4.dns[i], buf4, sizeof(buf4));
sizeof(buf4));
info(" %s", buf4); info(" %s", buf4);
} }
@ -933,8 +924,7 @@ static void conf_print(const struct ctx *c)
inet_ntop(AF_INET6, &c->ip6.addr_ll, buf6, sizeof(buf6))); inet_ntop(AF_INET6, &c->ip6.addr_ll, buf6, sizeof(buf6)));
dns6: dns6:
for (i = 0; !IN6_IS_ADDR_UNSPECIFIED(&c->ip6.dns_send[i]); for (i = 0; !IN6_IS_ADDR_UNSPECIFIED(&c->ip6.dns[i]); i++) {
i++) {
if (!i) if (!i)
info("DNS:"); info("DNS:");
inet_ntop(AF_INET6, &c->ip6.dns[i], buf6, sizeof(buf6)); inet_ntop(AF_INET6, &c->ip6.dns[i], buf6, sizeof(buf6));
@ -1230,17 +1220,17 @@ void conf(struct ctx *c, int argc, char **argv)
c->no_dhcp_dns_search = 1; c->no_dhcp_dns_search = 1;
break; break;
case 9: case 9:
if (IN6_IS_ADDR_UNSPECIFIED(&c->ip6.dns_fwd) && if (IN6_IS_ADDR_UNSPECIFIED(&c->ip6.dns_match) &&
inet_pton(AF_INET6, optarg, &c->ip6.dns_fwd) && inet_pton(AF_INET6, optarg, &c->ip6.dns_match) &&
!IN6_IS_ADDR_UNSPECIFIED(&c->ip6.dns_fwd) && !IN6_IS_ADDR_UNSPECIFIED(&c->ip6.dns_match) &&
!IN6_IS_ADDR_LOOPBACK(&c->ip6.dns_fwd)) !IN6_IS_ADDR_LOOPBACK(&c->ip6.dns_match))
break; break;
if (IN4_IS_ADDR_UNSPECIFIED(&c->ip4.dns_fwd) && if (IN4_IS_ADDR_UNSPECIFIED(&c->ip4.dns_match) &&
inet_pton(AF_INET, optarg, &c->ip4.dns_fwd) && inet_pton(AF_INET, optarg, &c->ip4.dns_match) &&
!IN4_IS_ADDR_UNSPECIFIED(&c->ip4.dns_fwd) && !IN4_IS_ADDR_UNSPECIFIED(&c->ip4.dns_match) &&
!IN4_IS_ADDR_BROADCAST(&c->ip4.dns_fwd) && !IN4_IS_ADDR_BROADCAST(&c->ip4.dns_match) &&
!IN4_IS_ADDR_LOOPBACK(&c->ip4.dns_fwd)) !IN4_IS_ADDR_LOOPBACK(&c->ip4.dns_match))
break; break;
err("Invalid DNS forwarding address: %s", optarg); err("Invalid DNS forwarding address: %s", optarg);

5
dhcp.c
View file

@ -359,9 +359,8 @@ int dhcp(const struct ctx *c, const struct pool *p)
} }
for (i = 0, opts[6].slen = 0; for (i = 0, opts[6].slen = 0;
!c->no_dhcp_dns && !IN4_IS_ADDR_UNSPECIFIED(&c->ip4.dns_send[i]); !c->no_dhcp_dns && !IN4_IS_ADDR_UNSPECIFIED(&c->ip4.dns[i]); i++) {
i++) { ((struct in_addr *)opts[6].s)[i] = c->ip4.dns[i];
((struct in_addr *)opts[6].s)[i] = c->ip4.dns_send[i];
opts[6].slen += sizeof(uint32_t); opts[6].slen += sizeof(uint32_t);
} }

5
dhcpv6.c
View file

@ -379,7 +379,7 @@ static size_t dhcpv6_dns_fill(const struct ctx *c, char *buf, int offset)
if (c->no_dhcp_dns) if (c->no_dhcp_dns)
goto search; goto search;
for (i = 0; !IN6_IS_ADDR_UNSPECIFIED(&c->ip6.dns_send[i]); i++) { for (i = 0; !IN6_IS_ADDR_UNSPECIFIED(&c->ip6.dns[i]); i++) {
if (!i) { if (!i) {
srv = (struct opt_dns_servers *)(buf + offset); srv = (struct opt_dns_servers *)(buf + offset);
offset += sizeof(struct opt_hdr); offset += sizeof(struct opt_hdr);
@ -387,8 +387,7 @@ static size_t dhcpv6_dns_fill(const struct ctx *c, char *buf, int offset)
srv->hdr.l = 0; srv->hdr.l = 0;
} }
memcpy(&srv->addr[i], &c->ip6.dns_send[i], memcpy(&srv->addr[i], &c->ip6.dns[i], sizeof(srv->addr[i]));
sizeof(srv->addr[i]));
srv->hdr.l += sizeof(srv->addr[i]); srv->hdr.l += sizeof(srv->addr[i]);
offset += sizeof(srv->addr[i]); offset += sizeof(srv->addr[i]);
} }

6
ndp.c
View file

@ -121,7 +121,7 @@ int ndp(struct ctx *c, const struct icmp6hdr *ih, const struct in6_addr *saddr)
if (c->no_dhcp_dns) if (c->no_dhcp_dns)
goto dns_done; goto dns_done;
for (n = 0; !IN6_IS_ADDR_UNSPECIFIED(&c->ip6.dns_send[n]); n++); for (n = 0; !IN6_IS_ADDR_UNSPECIFIED(&c->ip6.dns[n]); n++);
if (n) { if (n) {
*p++ = 25; /* RDNSS */ *p++ = 25; /* RDNSS */
*p++ = 1 + 2 * n; /* length */ *p++ = 1 + 2 * n; /* length */
@ -130,8 +130,8 @@ int ndp(struct ctx *c, const struct icmp6hdr *ih, const struct in6_addr *saddr)
p += 4; p += 4;
for (i = 0; i < n; i++) { for (i = 0; i < n; i++) {
memcpy(p, &c->ip6.dns_send[i], 16); memcpy(p, &c->ip6.dns[i], 16); /* address */
p += 16; /* address */ p += 16;
} }
for (n = 0; *c->dns_search[n].n; n++) for (n = 0; *c->dns_search[n].n; n++)

20
passt.h
View file

@ -101,9 +101,9 @@ enum passt_modes {
* @addr_seen: Latest IPv4 address seen as source from tap * @addr_seen: Latest IPv4 address seen as source from tap
* @prefixlen: IPv4 prefix length (netmask) * @prefixlen: IPv4 prefix length (netmask)
* @gw: Default IPv4 gateway, network order * @gw: Default IPv4 gateway, network order
* @dns: Host IPv4 DNS addresses, zero-terminated, network order * @dns: DNS addresses for DHCP, zero-terminated, network order
* @dns_send: Offered IPv4 DNS, zero-terminated, network order * @dns_match: Forward DNS query if sent to this address, network order
* @dns_fwd: Address forwarded (UDP) to first IPv4 DNS, network order * @dns_host: Use this DNS on the host for forwarding, network order
*/ */
struct ip4_ctx { struct ip4_ctx {
struct in_addr addr; struct in_addr addr;
@ -111,8 +111,8 @@ struct ip4_ctx {
int prefix_len; int prefix_len;
struct in_addr gw; struct in_addr gw;
struct in_addr dns[MAXNS + 1]; struct in_addr dns[MAXNS + 1];
struct in_addr dns_send[MAXNS + 1]; struct in_addr dns_match;
struct in_addr dns_fwd; struct in_addr dns_host;
}; };
/** /**
@ -122,9 +122,9 @@ struct ip4_ctx {
* @addr_seen: Latest IPv6 global/site address seen as source from tap * @addr_seen: Latest IPv6 global/site address seen as source from tap
* @addr_ll_seen: Latest IPv6 link-local address seen as source from tap * @addr_ll_seen: Latest IPv6 link-local address seen as source from tap
* @gw: Default IPv6 gateway * @gw: Default IPv6 gateway
* @dns: Host IPv6 DNS addresses, zero-terminated * @dns: DNS addresses for DHCPv6 and NDP, zero-terminated
* @dns_send: Offered IPv6 DNS addresses, zero-terminated * @dns_match: Forward DNS query if sent to this address
* @dns_fwd: Address forwarded (UDP) to first IPv6 DNS, network order * @dns_host: Use this DNS on the host for forwarding
*/ */
struct ip6_ctx { struct ip6_ctx {
struct in6_addr addr; struct in6_addr addr;
@ -133,8 +133,8 @@ struct ip6_ctx {
struct in6_addr addr_ll_seen; struct in6_addr addr_ll_seen;
struct in6_addr gw; struct in6_addr gw;
struct in6_addr dns[MAXNS + 1]; struct in6_addr dns[MAXNS + 1];
struct in6_addr dns_send[MAXNS + 1]; struct in6_addr dns_match;
struct in6_addr dns_fwd; struct in6_addr dns_host;
}; };
#include <netinet/if_ether.h> #include <netinet/if_ether.h>

21
udp.c
View file

@ -678,10 +678,10 @@ static void udp_sock_fill_data_v4(const struct ctx *c, int n,
src_port = ntohs(b->s_in.sin_port); src_port = ntohs(b->s_in.sin_port);
if (!IN4_IS_ADDR_UNSPECIFIED(&c->ip4.dns_fwd) && if (!IN4_IS_ADDR_UNSPECIFIED(&c->ip4.dns_match) &&
IN4_ARE_ADDR_EQUAL(&b->s_in.sin_addr, &c->ip4.dns[0]) && IN4_ARE_ADDR_EQUAL(&b->s_in.sin_addr, &c->ip4.dns_host) &&
src_port == 53) { src_port == 53) {
b->iph.saddr = c->ip4.dns_fwd.s_addr; b->iph.saddr = c->ip4.dns_match.s_addr;
} else if (IN4_IS_ADDR_LOOPBACK(&b->s_in.sin_addr) || } else if (IN4_IS_ADDR_LOOPBACK(&b->s_in.sin_addr) ||
IN4_IS_ADDR_UNSPECIFIED(&b->s_in.sin_addr)|| IN4_IS_ADDR_UNSPECIFIED(&b->s_in.sin_addr)||
IN4_ARE_ADDR_EQUAL(&b->s_in.sin_addr, &c->ip4.addr_seen)) { IN4_ARE_ADDR_EQUAL(&b->s_in.sin_addr, &c->ip4.addr_seen)) {
@ -770,10 +770,11 @@ static void udp_sock_fill_data_v6(const struct ctx *c, int n,
if (IN6_IS_ADDR_LINKLOCAL(src)) { if (IN6_IS_ADDR_LINKLOCAL(src)) {
b->ip6h.daddr = c->ip6.addr_ll_seen; b->ip6h.daddr = c->ip6.addr_ll_seen;
b->ip6h.saddr = b->s_in6.sin6_addr; b->ip6h.saddr = b->s_in6.sin6_addr;
} else if (!IN6_IS_ADDR_UNSPECIFIED(&c->ip6.dns_fwd) && } else if (!IN6_IS_ADDR_UNSPECIFIED(&c->ip6.dns_match) &&
IN6_ARE_ADDR_EQUAL(src, &c->ip6.dns[0]) && src_port == 53) { IN6_ARE_ADDR_EQUAL(src, &c->ip6.dns_host) &&
src_port == 53) {
b->ip6h.daddr = c->ip6.addr_seen; b->ip6h.daddr = c->ip6.addr_seen;
b->ip6h.saddr = c->ip6.dns_fwd; b->ip6h.saddr = c->ip6.dns_match;
} else if (IN6_IS_ADDR_LOOPBACK(src) || } else if (IN6_IS_ADDR_LOOPBACK(src) ||
IN6_ARE_ADDR_EQUAL(src, &c->ip6.addr_seen) || IN6_ARE_ADDR_EQUAL(src, &c->ip6.addr_seen) ||
IN6_ARE_ADDR_EQUAL(src, &c->ip6.addr)) { IN6_ARE_ADDR_EQUAL(src, &c->ip6.addr)) {
@ -1016,13 +1017,15 @@ int udp_tap_handler(struct ctx *c, int af, const void *addr,
udp_tap_map[V4][src].ts = now->tv_sec; udp_tap_map[V4][src].ts = now->tv_sec;
if (IN4_ARE_ADDR_EQUAL(&s_in.sin_addr, &c->ip4.gw) && !c->no_map_gw) { if (IN4_ARE_ADDR_EQUAL(&s_in.sin_addr, &c->ip4.gw) &&
!c->no_map_gw) {
if (!(udp_tap_map[V4][dst].flags & PORT_LOCAL) || if (!(udp_tap_map[V4][dst].flags & PORT_LOCAL) ||
(udp_tap_map[V4][dst].flags & PORT_LOOPBACK)) (udp_tap_map[V4][dst].flags & PORT_LOOPBACK))
s_in.sin_addr.s_addr = htonl(INADDR_LOOPBACK); s_in.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
else else
s_in.sin_addr = c->ip4.addr_seen; s_in.sin_addr = c->ip4.addr_seen;
} else if (IN4_ARE_ADDR_EQUAL(&s_in.sin_addr, &c->ip4.dns_fwd) && } else if (IN4_ARE_ADDR_EQUAL(&s_in.sin_addr,
&c->ip4.dns_match) &&
ntohs(s_in.sin_port) == 53) { ntohs(s_in.sin_port) == 53) {
s_in.sin_addr = c->ip4.dns[0]; s_in.sin_addr = c->ip4.dns[0];
} }
@ -1045,7 +1048,7 @@ int udp_tap_handler(struct ctx *c, int af, const void *addr,
s_in6.sin6_addr = c->ip6.addr; s_in6.sin6_addr = c->ip6.addr;
else else
s_in6.sin6_addr = c->ip6.addr_seen; s_in6.sin6_addr = c->ip6.addr_seen;
} else if (IN6_ARE_ADDR_EQUAL(addr, &c->ip6.dns_fwd) && } else if (IN6_ARE_ADDR_EQUAL(addr, &c->ip6.dns_match) &&
ntohs(s_in6.sin6_port) == 53) { ntohs(s_in6.sin6_port) == 53) {
s_in6.sin6_addr = c->ip6.dns[0]; s_in6.sin6_addr = c->ip6.dns[0];
} else if (IN6_IS_ADDR_LINKLOCAL(&s_in6.sin6_addr)) { } else if (IN6_IS_ADDR_LINKLOCAL(&s_in6.sin6_addr)) {