From ae0004f591d816f1b6e78c57c3d9530098f123b0 Mon Sep 17 00:00:00 2001 From: Stefano Brivio Date: Thu, 23 Feb 2023 16:41:47 +0000 Subject: [PATCH 03/20] conf, udp: Allow any loopback address to be used as resolver Andrea reports that with a Fedora 37 guest running on a Fedora 37 host, both using systemd-resolved, with passt connecting them, running with default options, DNS queries don't work. systemd-resolved on the host is reachable only at the loopback address 127.0.0.53. We advertise the default gateway address to the guest as resolver, because our local address is of course unreachable from there, which means we see DNS queries directed to the default gateway, and we redirect them to 127.0.0.1. However, systemd-resolved doesn't answer on 127.0.0.1. To fix this, set @dns_match to the address of the default gateway, unless a different resolver address is explicitly configured, so that we know we explicitly have to map DNS queries, in this case, to the address of the local resolver. This means that in udp_tap_handler() we need to check, first, if the destination address of packets matches @dns_match: even if it's the address of the local gateway, we want to map that to a specific address, which isn't necessarily 127.0.0.1. Do the same for IPv6 for consistency, even though IPv6 defines a single loopback address. Reported-by: Andrea Bolognani Signed-off-by: Stefano Brivio Tested-by: Andrea Bolognani Reviewed-by: David Gibson (cherry picked from commit bad252687271c0255f6a077f19cbc19aa0427f8d) --- conf.c | 6 ++++++ udp.c | 20 ++++++++++---------- 2 files changed, 16 insertions(+), 10 deletions(-) diff --git a/conf.c b/conf.c index ed25e35..37f25d6 100644 --- a/conf.c +++ b/conf.c @@ -395,6 +395,9 @@ static void add_dns4(struct ctx *c, struct in_addr *addr, struct in_addr **conf) if (!c->no_map_gw) { **conf = c->ip4.gw; (*conf)++; + + if (IN4_IS_ADDR_UNSPECIFIED(&c->ip4.dns_match)) + c->ip4.dns_match = c->ip4.gw; } } else { **conf = *addr; @@ -419,6 +422,9 @@ static void add_dns6(struct ctx *c, if (!c->no_map_gw) { memcpy(*conf, &c->ip6.gw, sizeof(**conf)); (*conf)++; + + if (IN6_IS_ADDR_UNSPECIFIED(&c->ip6.dns_match)) + memcpy(&c->ip6.dns_match, addr, sizeof(*addr)); } } else { memcpy(*conf, addr, sizeof(**conf)); diff --git a/udp.c b/udp.c index 1d65559..20a9ea0 100644 --- a/udp.c +++ b/udp.c @@ -857,17 +857,16 @@ int udp_tap_handler(struct ctx *c, int af, const void *addr, udp_tap_map[V4][src].ts = now->tv_sec; - if (IN4_ARE_ADDR_EQUAL(&s_in.sin_addr, &c->ip4.gw) && - !c->no_map_gw) { + if (IN4_ARE_ADDR_EQUAL(&s_in.sin_addr, &c->ip4.dns_match) && + ntohs(s_in.sin_port) == 53) { + s_in.sin_addr = c->ip4.dns_host; + } else if (IN4_ARE_ADDR_EQUAL(&s_in.sin_addr, &c->ip4.gw) && + !c->no_map_gw) { if (!(udp_tap_map[V4][dst].flags & PORT_LOCAL) || (udp_tap_map[V4][dst].flags & PORT_LOOPBACK)) s_in.sin_addr.s_addr = htonl(INADDR_LOOPBACK); else s_in.sin_addr = c->ip4.addr_seen; - } else if (IN4_ARE_ADDR_EQUAL(&s_in.sin_addr, - &c->ip4.dns_match) && - ntohs(s_in.sin_port) == 53) { - s_in.sin_addr = c->ip4.dns_host; } } else { s_in6 = (struct sockaddr_in6) { @@ -880,7 +879,11 @@ int udp_tap_handler(struct ctx *c, int af, const void *addr, sa = (struct sockaddr *)&s_in6; sl = sizeof(s_in6); - if (IN6_ARE_ADDR_EQUAL(addr, &c->ip6.gw) && !c->no_map_gw) { + if (IN6_ARE_ADDR_EQUAL(addr, &c->ip6.dns_match) && + ntohs(s_in6.sin6_port) == 53) { + s_in6.sin6_addr = c->ip6.dns_host; + } else if (IN6_ARE_ADDR_EQUAL(addr, &c->ip6.gw) && + !c->no_map_gw) { if (!(udp_tap_map[V6][dst].flags & PORT_LOCAL) || (udp_tap_map[V6][dst].flags & PORT_LOOPBACK)) s_in6.sin6_addr = in6addr_loopback; @@ -888,9 +891,6 @@ int udp_tap_handler(struct ctx *c, int af, const void *addr, s_in6.sin6_addr = c->ip6.addr; else s_in6.sin6_addr = c->ip6.addr_seen; - } else if (IN6_ARE_ADDR_EQUAL(addr, &c->ip6.dns_match) && - ntohs(s_in6.sin6_port) == 53) { - s_in6.sin6_addr = c->ip6.dns_host; } else if (IN6_IS_ADDR_LINKLOCAL(&s_in6.sin6_addr)) { bind_addr = &c->ip6.addr_ll; } -- 2.39.2