SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

resolved: define source address for proxy-only stub replies

Browse Source 
DnsPacket.ifindex=1 (loopback) is normalized to 0 whenever a message is
received on the loopback iface, so for both listeners, 127.0.0.53 and
127.0.0.54, the ifindex will be set to 0 by manager_recv() for queries
that have a local origin.

Replies to such local messages need to set a proper ifindex in any
case, as the supplied source-address would otherwise be ignored in
manager_ipv4_send() (CMSG generation is skipped due to ifindex > 0 check).

Note that this change only forces `ifindex` to loopback if it was actually
normalized to `0` before (due to a loopback detection) in order to keep the
nat-to-127.0.0.54-from-another-interface usecase that was described in
a8d0906344 intact.
Also note that nat is not supported for the main stub 127.0.0.53 which is
why forcing LOOPBACK_IFINDEX was/is fine for that case.

Fixes #23495
This commit is contained in:
Benjamin Franzke
2022-05-31 22:38:47 +02:00
parent 1c1cb8ec6f
commit dfa14e2859
1 changed files with 11 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/resolve/resolved-dns-stub.c
+11 -3
View File
@@ -528,18 +528,26 @@ static int dns_stub_send(
if (s)
r = dns_stream_write_packet(s, reply);
else {
int fd;
int fd, ifindex;
fd = find_socket_fd(m, l, p->family, &p->sender, SOCK_DGRAM);
if (fd < 0)
return fd;
if (address_is_proxy(p->family, &p->destination))
/* Force loopback iface if this is the loopback proxy stub
* and ifindex was normalized to 0 by manager_recv(). */
ifindex = p->ifindex ?: LOOPBACK_IFINDEX;
else
/* Force loopback iface if this is the main listener stub. */
ifindex = l ? p->ifindex : LOOPBACK_IFINDEX;
/* Note that it is essential here that we explicitly choose the source IP address for this
* packet. This is because otherwise the kernel will choose it automatically based on the
* routing table and will thus pick 127.0.0.1 rather than 127.0.0.53. */
* routing table and will thus pick 127.0.0.1 rather than 127.0.0.53/54. */
r = manager_send(m,
fd,
l || address_is_proxy(p->family, &p->destination) ? p->ifindex : LOOPBACK_IFINDEX, /* force loopback iface if this is the main listener stub */
ifindex,
p->family, &p->sender, p->sender_port, &p->destination,
reply);
}