mir/bind
2
0
Fork 0
mirror of https://gitlab.isc.org/isc-projects/bind9 synced 2025-09-04 08:35:31 +00:00
Code Issues Releases Wiki Activity

keep track of non-listening interfaces

Browse Source 
previously, if "listen-on-v6" was set to "none", then every
time a scan saw an IPv6 address it would appear to be a new
one.  this commit retains all known interfaces in a list
and sets a flag in the ones that are listening, so that
configured interfaces that have been seen before will be
recognized as such.

as an incidental fix, the ns__interfacemgr_getif() and _nextif()
functions have been removed since they were never used.
This commit is contained in:
Evan Hunt
2021-12-14 16:51:02 -08:00
parent fb4e1ed5b2
commit 6df5cf1ee6
2 changed files with 82 additions and 99 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
lib/ns/include/ns/interfacemgr.h
View File

@@ -59,7 +59,8 @@
#define IFACE_MAGIC ISC_MAGIC('I', ':', '-', ')') #define IFACE_MAGIC ISC_MAGIC('I', ':', '-', ')')
#define NS_INTERFACE_VALID(t) ISC_MAGIC_VALID(t, IFACE_MAGIC) #define NS_INTERFACE_VALID(t) ISC_MAGIC_VALID(t, IFACE_MAGIC)
#define NS_INTERFACEFLAG_ANYADDR 0x01U /*%< bound to "any" address */ #define NS_INTERFACEFLAG_ANYADDR 0x01U /*%< bound to "any" address */
#define NS_INTERFACEFLAG_LISTENING 0x02U /*%< listening */
#define MAX_UDP_DISPATCH \ #define MAX_UDP_DISPATCH \
128 /*%< Maximum number of UDP dispatchers \ 128 /*%< Maximum number of UDP dispatchers \
* to start per interface */ * to start per interface */
@@ -194,12 +195,3 @@ ns_interfacemgr_getclientmgr(ns_interfacemgr_t *mgr);
* Returns the client manager for the current worker thread. * Returns the client manager for the current worker thread.
* (This cannot be run from outside a network manager thread.) * (This cannot be run from outside a network manager thread.)
*/ */
ns_interface_t *
ns__interfacemgr_getif(ns_interfacemgr_t *mgr);
ns_interface_t *
ns__interfacemgr_nextif(ns_interface_t *ifp);
/*%<
* Functions to allow external callers to walk the interfaces list.
* (Not intended for use outside this module and associated tests.)
*/

169
lib/ns/interfacemgr.c
View File

@@ -50,6 +50,8 @@
#endif /* if defined(HAVE_LINUX_NETLINK_H) && defined(HAVE_LINUX_RTNETLINK_H) \ #endif /* if defined(HAVE_LINUX_NETLINK_H) && defined(HAVE_LINUX_RTNETLINK_H) \
*/ */
#define LISTENING(ifp) (((ifp)->flags & NS_INTERFACEFLAG_LISTENING) != 0)
#ifdef TUNE_LARGE #ifdef TUNE_LARGE
#define UDPBUFFERS 32768 #define UDPBUFFERS 32768
#else /* ifdef TUNE_LARGE */ #else /* ifdef TUNE_LARGE */
@@ -131,11 +133,13 @@ need_rescan(ns_interfacemgr_t *mgr, struct MSGHDR *rtm, size_t len) {
*/ */
if (rth->rta_type == IFA_ADDRESS && if (rth->rta_type == IFA_ADDRESS &&
ifa->ifa_family == AF_INET6) { ifa->ifa_family == AF_INET6) {
bool existed = false;
bool was_listening = false; bool was_listening = false;
isc_netaddr_t addr = { 0 }; isc_netaddr_t addr = { 0 };
ns_interface_t *ifp = NULL; ns_interface_t *ifp = NULL;
isc_netaddr_fromin6(&addr, RTA_DATA(rth)); isc_netaddr_fromin6(&addr, RTA_DATA(rth));
INSIST(isc_netaddr_getzone(&addr) == 0);
/* /*
* Check whether we were listening on the * Check whether we were listening on the
@@ -153,8 +157,21 @@ need_rescan(ns_interfacemgr_t *mgr, struct MSGHDR *rtm, size_t len) {
isc_netaddr_t tmp = { 0 }; isc_netaddr_t tmp = { 0 };
isc_netaddr_fromsockaddr(&tmp, isc_netaddr_fromsockaddr(&tmp,
&ifp->addr); &ifp->addr);
if (tmp.family != AF_INET6) {
continue;
}
/*
* We have to nullify the zone (IPv6
* scope ID) because we haven't got one
* from the kernel. Otherwise match
* could fail even for an existing
* address.
*/
isc_netaddr_setzone(&tmp, 0);
if (isc_netaddr_equal(&tmp, &addr)) { if (isc_netaddr_equal(&tmp, &addr)) {
was_listening = true; was_listening = LISTENING(ifp);
existed = true;
break; break;
} }
} }
@@ -164,9 +181,8 @@ need_rescan(ns_interfacemgr_t *mgr, struct MSGHDR *rtm, size_t len) {
* Do rescan if the state of the interface * Do rescan if the state of the interface
* has changed. * has changed.
*/ */
if ((!was_listening && if ((!existed && rtm->MSGTYPE == RTM_NEWADDR) ||
rtm->MSGTYPE == RTM_NEWADDR) || (existed && was_listening &&
(was_listening &&
rtm->MSGTYPE == RTM_DELADDR)) rtm->MSGTYPE == RTM_DELADDR))
{ {
return (true); return (true);
@@ -457,9 +473,9 @@ ns_interfacemgr_shutdown(ns_interfacemgr_t *mgr) {
} }
} }
static isc_result_t static void
ns_interface_create(ns_interfacemgr_t *mgr, isc_sockaddr_t *addr, interface_create(ns_interfacemgr_t *mgr, isc_sockaddr_t *addr, const char *name,
const char *name, ns_interface_t **ifpret) { ns_interface_t **ifpret) {
ns_interface_t *ifp = NULL; ns_interface_t *ifp = NULL;
REQUIRE(NS_INTERFACEMGR_VALID(mgr)); REQUIRE(NS_INTERFACEMGR_VALID(mgr));
@@ -473,12 +489,6 @@ ns_interface_create(ns_interfacemgr_t *mgr, isc_sockaddr_t *addr,
isc_mutex_init(&ifp->lock); isc_mutex_init(&ifp->lock);
/*
* Create a single TCP client object. It will replace itself
* with a new one as soon as it gets a connection, so the actual
* connections will be handled in parallel even though there is
* only one client initially.
*/
isc_refcount_init(&ifp->ntcpaccepting, 0); isc_refcount_init(&ifp->ntcpaccepting, 0);
isc_refcount_init(&ifp->ntcpactive, 0); isc_refcount_init(&ifp->ntcpactive, 0);
@@ -492,13 +502,7 @@ ns_interface_create(ns_interfacemgr_t *mgr, isc_sockaddr_t *addr,
isc_refcount_init(&ifp->references, 1); isc_refcount_init(&ifp->references, 1);
ifp->magic = IFACE_MAGIC; ifp->magic = IFACE_MAGIC;
ifp->tcplistensocket = NULL;
ifp->http_listensocket = NULL;
ifp->http_secure_listensocket = NULL;
*ifpret = ifp; *ifpret = ifp;
return (ISC_R_SUCCESS);
} }
static isc_result_t static isc_result_t
@@ -654,20 +658,25 @@ ns_interface_listenhttp(ns_interface_t *ifp, isc_tlsctx_t *sslctx, char **eps,
} }
static isc_result_t static isc_result_t
ns_interface_setup(ns_interfacemgr_t *mgr, isc_sockaddr_t *addr, interface_setup(ns_interfacemgr_t *mgr, isc_sockaddr_t *addr, const char *name,
const char *name, ns_interface_t **ifpret, ns_interface_t **ifpret, ns_listenelt_t *elt,
ns_listenelt_t *elt, bool *addr_in_use) { bool *addr_in_use) {
isc_result_t result; isc_result_t result;
ns_interface_t *ifp = NULL; ns_interface_t *ifp = NULL;
REQUIRE(ifpret != NULL && *ifpret == NULL);
REQUIRE(ifpret != NULL);
REQUIRE(addr_in_use == NULL || !*addr_in_use); REQUIRE(addr_in_use == NULL || !*addr_in_use);
result = ns_interface_create(mgr, addr, name, &ifp); ifp = *ifpret;
if (result != ISC_R_SUCCESS) {
return (result); if (ifp == NULL) {
interface_create(mgr, addr, name, &ifp);
} else {
REQUIRE(!LISTENING(ifp));
} }
ifp->dscp = elt->dscp; ifp->dscp = elt->dscp;
ifp->flags |= NS_INTERFACEFLAG_LISTENING;
if (elt->is_http) { if (elt->is_http) {
result = ns_interface_listenhttp( result = ns_interface_listenhttp(
@@ -719,16 +728,14 @@ ns_interface_setup(ns_interfacemgr_t *mgr, isc_sockaddr_t *addr,
return (result); return (result);
cleanup_interface: cleanup_interface:
LOCK(&ifp->mgr->lock);
ISC_LIST_UNLINK(ifp->mgr->interfaces, ifp, link);
UNLOCK(&ifp->mgr->lock);
ns_interface_shutdown(ifp); ns_interface_shutdown(ifp);
ns_interface_detach(&ifp);
return (result); return (result);
} }
void void
ns_interface_shutdown(ns_interface_t *ifp) { ns_interface_shutdown(ns_interface_t *ifp) {
ifp->flags &= ~NS_INTERFACEFLAG_LISTENING;
if (ifp->udplistensocket != NULL) { if (ifp->udplistensocket != NULL) {
isc_nm_stoplistening(ifp->udplistensocket); isc_nm_stoplistening(ifp->udplistensocket);
isc_nmsocket_close(&ifp->udplistensocket); isc_nmsocket_close(&ifp->udplistensocket);
@@ -748,23 +755,26 @@ ns_interface_shutdown(ns_interface_t *ifp) {
} }
static void static void
ns_interface_destroy(ns_interface_t *ifp) { interface_destroy(ns_interface_t *ifp) {
ns_interfacemgr_t *mgr;
REQUIRE(NS_INTERFACE_VALID(ifp)); REQUIRE(NS_INTERFACE_VALID(ifp));
isc_mem_t *mctx = ifp->mgr->mctx; mgr = ifp->mgr;
ns_interface_shutdown(ifp); ns_interface_shutdown(ifp);
if (ISC_LINK_LINKED(ifp, link)) {
ISC_LIST_UNLINK(mgr->interfaces, ifp, link);
}
ifp->magic = 0;
isc_mutex_destroy(&ifp->lock); isc_mutex_destroy(&ifp->lock);
ns_interfacemgr_detach(&ifp->mgr); ns_interfacemgr_detach(&ifp->mgr);
isc_refcount_destroy(&ifp->ntcpactive); isc_refcount_destroy(&ifp->ntcpactive);
isc_refcount_destroy(&ifp->ntcpaccepting); isc_refcount_destroy(&ifp->ntcpaccepting);
ifp->magic = 0; isc_mem_put(mgr->mctx, ifp, sizeof(*ifp));
isc_mem_put(mctx, ifp, sizeof(*ifp));
} }
void void
@@ -781,7 +791,7 @@ ns_interface_detach(ns_interface_t **targetp) {
REQUIRE(target != NULL); REQUIRE(target != NULL);
REQUIRE(NS_INTERFACE_VALID(target)); REQUIRE(NS_INTERFACE_VALID(target));
if (isc_refcount_decrement(&target->references) == 1) { if (isc_refcount_decrement(&target->references) == 1) {
ns_interface_destroy(target); interface_destroy(target);
} }
} }
@@ -817,10 +827,14 @@ purge_old_interfaces(ns_interfacemgr_t *mgr) {
if (ifp->generation != mgr->generation) { if (ifp->generation != mgr->generation) {
char sabuf[256]; char sabuf[256];
ISC_LIST_UNLINK(ifp->mgr->interfaces, ifp, link); ISC_LIST_UNLINK(ifp->mgr->interfaces, ifp, link);
isc_sockaddr_format(&ifp->addr, sabuf, sizeof(sabuf)); if (LISTENING(ifp)) {
isc_log_write(IFMGR_COMMON_LOGARGS, ISC_LOG_INFO, isc_sockaddr_format(&ifp->addr, sabuf,
"no longer listening on %s", sabuf); sizeof(sabuf));
ns_interface_shutdown(ifp); isc_log_write(
IFMGR_COMMON_LOGARGS, ISC_LOG_INFO,
"no longer listening on %s", sabuf);
ns_interface_shutdown(ifp);
}
ns_interface_detach(&ifp); ns_interface_detach(&ifp);
} }
} }
@@ -949,7 +963,7 @@ do_scan(ns_interfacemgr_t *mgr, bool verbose, bool config) {
isc_netaddr_t zero_address, zero_address6; isc_netaddr_t zero_address, zero_address6;
ns_listenelt_t *le; ns_listenelt_t *le;
isc_sockaddr_t listen_addr; isc_sockaddr_t listen_addr;
ns_interface_t *ifp; ns_interface_t *ifp = NULL;
bool log_explicit = false; bool log_explicit = false;
bool dolistenon; bool dolistenon;
char sabuf[ISC_SOCKADDR_FORMATSIZE]; char sabuf[ISC_SOCKADDR_FORMATSIZE];
@@ -1010,7 +1024,8 @@ do_scan(ns_interfacemgr_t *mgr, bool verbose, bool config) {
* during reconfiguration because the * during reconfiguration because the
* certificates could have been changed. * certificates could have been changed.
*/ */
if (config && le->sslctx != NULL) { if (config && LISTENING(ifp) &&
le->sslctx != NULL) {
INSIST(NS_INTERFACE_VALID(ifp)); INSIST(NS_INTERFACE_VALID(ifp));
LOCK(&mgr->lock); LOCK(&mgr->lock);
ISC_LIST_UNLINK(ifp->mgr->interfaces, ISC_LIST_UNLINK(ifp->mgr->interfaces,
@@ -1040,7 +1055,9 @@ do_scan(ns_interfacemgr_t *mgr, bool verbose, bool config) {
"values, using %d", "values, using %d",
sabuf, ifp->dscp); sabuf, ifp->dscp);
} }
continue; if (LISTENING(ifp)) {
continue;
}
} }
} }
@@ -1048,8 +1065,8 @@ do_scan(ns_interfacemgr_t *mgr, bool verbose, bool config) {
"listening on IPv6 " "listening on IPv6 "
"interfaces, port %u", "interfaces, port %u",
le->port); le->port);
result = ns_interface_setup(mgr, &listen_addr, "<any>", result = interface_setup(mgr, &listen_addr, "<any>",
&ifp, le, NULL); &ifp, le, NULL);
if (result == ISC_R_SUCCESS) { if (result == ISC_R_SUCCESS) {
ifp->flags |= NS_INTERFACEFLAG_ANYADDR; ifp->flags |= NS_INTERFACEFLAG_ANYADDR;
} else { } else {
@@ -1144,33 +1161,23 @@ do_scan(ns_interfacemgr_t *mgr, bool verbose, bool config) {
int match; int match;
bool addr_in_use = false; bool addr_in_use = false;
bool ipv6_wildcard = false; bool ipv6_wildcard = false;
isc_netaddr_t listen_netaddr;
isc_sockaddr_t listen_sockaddr; isc_sockaddr_t listen_sockaddr;
/*
* Construct a socket address for this IP/port
* combination.
*/
if (family == AF_INET) {
isc_netaddr_fromin(&listen_netaddr,
&interface.address.type.in);
} else {
isc_netaddr_fromin6(
&listen_netaddr,
&interface.address.type.in6);
isc_netaddr_setzone(&listen_netaddr,
interface.address.zone);
}
isc_sockaddr_fromnetaddr(&listen_sockaddr, isc_sockaddr_fromnetaddr(&listen_sockaddr,
&listen_netaddr, le->port); &interface.address, le->port);
/* /*
* See if the address matches the listen-on statement; * See if the address matches the listen-on statement;
* if not, ignore the interface. * if not, ignore the interface, but store it in
* the interface table so we know we've seen it
* before.
*/ */
(void)dns_acl_match(&listen_netaddr, NULL, le->acl, (void)dns_acl_match(&interface.address, NULL, le->acl,
mgr->aclenv, &match, NULL); mgr->aclenv, &match, NULL);
if (match <= 0) { if (match <= 0) {
ns_interface_t *new = NULL;
interface_create(mgr, &listen_sockaddr,
interface.name, &new);
continue; continue;
} }
@@ -1195,7 +1202,8 @@ do_scan(ns_interfacemgr_t *mgr, bool verbose, bool config) {
* during a reconfiguration because the * during a reconfiguration because the
* certificates could have been changed. * certificates could have been changed.
*/ */
if (config && le->sslctx != NULL) { if (config && LISTENING(ifp) &&
le->sslctx != NULL) {
INSIST(NS_INTERFACE_VALID(ifp)); INSIST(NS_INTERFACE_VALID(ifp));
LOCK(&mgr->lock); LOCK(&mgr->lock);
ISC_LIST_UNLINK(ifp->mgr->interfaces, ISC_LIST_UNLINK(ifp->mgr->interfaces,
@@ -1225,7 +1233,9 @@ do_scan(ns_interfacemgr_t *mgr, bool verbose, bool config) {
"values, using %d", "values, using %d",
sabuf, ifp->dscp); sabuf, ifp->dscp);
} }
continue; if (LISTENING(ifp)) {
continue;
}
} }
} }
@@ -1252,9 +1262,9 @@ do_scan(ns_interfacemgr_t *mgr, bool verbose, bool config) {
(family == AF_INET) ? "IPv4" : "IPv6", (family == AF_INET) ? "IPv4" : "IPv6",
interface.name, sabuf); interface.name, sabuf);
result = ns_interface_setup(mgr, &listen_sockaddr, result = interface_setup(mgr, &listen_sockaddr,
interface.name, &ifp, le, interface.name, &ifp, le,
&addr_in_use); &addr_in_use);
tried_listening = true; tried_listening = true;
if (!addr_in_use) { if (!addr_in_use) {
@@ -1426,25 +1436,6 @@ ns_interfacemgr_getserver(ns_interfacemgr_t *mgr) {
return (mgr->sctx); return (mgr->sctx);
} }
ns_interface_t *
ns__interfacemgr_getif(ns_interfacemgr_t *mgr) {
ns_interface_t *head;
REQUIRE(NS_INTERFACEMGR_VALID(mgr));
LOCK(&mgr->lock);
head = ISC_LIST_HEAD(mgr->interfaces);
UNLOCK(&mgr->lock);
return (head);
}
ns_interface_t *
ns__interfacemgr_nextif(ns_interface_t *ifp) {
ns_interface_t *next;
LOCK(&ifp->lock);
next = ISC_LIST_NEXT(ifp, link);
UNLOCK(&ifp->lock);
return (next);
}
ns_clientmgr_t * ns_clientmgr_t *
ns_interfacemgr_getclientmgr(ns_interfacemgr_t *mgr) { ns_interfacemgr_getclientmgr(ns_interfacemgr_t *mgr) {
int tid = isc_nm_tid(); int tid = isc_nm_tid();