mirror of
https://github.com/systemd/systemd.git
synced 2026-07-16 20:40:56 +00:00
a8d0906344
This beefs up the DNS stub logic to listen on two IP addresses: 127.0.0.53 (as before) + 127.0.0.54 (new). When the latter is contact our stub will operate in "bypass" mode only, i.e we'll try to pass DNS requests as unmodified upstream as we can (and not do mDNS/LLMNR and such, also no DNSSEC validation – but we'll still do DNS-over-TLS wrapping). This is supposed to be useful for container environments or tethering: this stub could be exposed (via NAT redirect) to clients of this system and we'll try to stay out of the way with doing too much DNS magic ourselves, but still expose whatever the current DNS server is from upstream under a stable address/port. How to use this: # iptables -t nat -I PREROUTING -p udp -i <interface> --dport 53 -j DNAT --to 127.0.0.54:53 # echo 1 > /proc/sys/net/ipv4/conf/<interface>/route_localnet
53 lines
2.1 KiB
C
53 lines
2.1 KiB
C
/* SPDX-License-Identifier: LGPL-2.1-or-later */
|
|
|
|
#include "conf-parser.h"
|
|
#include "resolve-util.h"
|
|
#include "string-table.h"
|
|
|
|
DEFINE_CONFIG_PARSE_ENUM(config_parse_resolve_support, resolve_support, ResolveSupport, "Failed to parse resolve support setting");
|
|
DEFINE_CONFIG_PARSE_ENUM(config_parse_dnssec_mode, dnssec_mode, DnssecMode, "Failed to parse DNSSEC mode setting");
|
|
DEFINE_CONFIG_PARSE_ENUM(config_parse_dns_over_tls_mode, dns_over_tls_mode, DnsOverTlsMode, "Failed to parse DNS-over-TLS mode setting");
|
|
|
|
static const char* const resolve_support_table[_RESOLVE_SUPPORT_MAX] = {
|
|
[RESOLVE_SUPPORT_NO] = "no",
|
|
[RESOLVE_SUPPORT_YES] = "yes",
|
|
[RESOLVE_SUPPORT_RESOLVE] = "resolve",
|
|
};
|
|
DEFINE_STRING_TABLE_LOOKUP_WITH_BOOLEAN(resolve_support, ResolveSupport, RESOLVE_SUPPORT_YES);
|
|
|
|
static const char* const dnssec_mode_table[_DNSSEC_MODE_MAX] = {
|
|
[DNSSEC_NO] = "no",
|
|
[DNSSEC_ALLOW_DOWNGRADE] = "allow-downgrade",
|
|
[DNSSEC_YES] = "yes",
|
|
};
|
|
DEFINE_STRING_TABLE_LOOKUP_WITH_BOOLEAN(dnssec_mode, DnssecMode, DNSSEC_YES);
|
|
|
|
static const char* const dns_over_tls_mode_table[_DNS_OVER_TLS_MODE_MAX] = {
|
|
[DNS_OVER_TLS_NO] = "no",
|
|
[DNS_OVER_TLS_OPPORTUNISTIC] = "opportunistic",
|
|
[DNS_OVER_TLS_YES] = "yes",
|
|
};
|
|
DEFINE_STRING_TABLE_LOOKUP_WITH_BOOLEAN(dns_over_tls_mode, DnsOverTlsMode, DNS_OVER_TLS_YES);
|
|
|
|
bool dns_server_address_valid(int family, const union in_addr_union *sa) {
|
|
|
|
/* Refuses the 0 IP addresses as well as 127.0.0.53/127.0.0.54 (which is our own DNS stub) */
|
|
|
|
if (!in_addr_is_set(family, sa))
|
|
return false;
|
|
|
|
if (family == AF_INET && IN_SET(be32toh(sa->in.s_addr), INADDR_DNS_STUB, INADDR_DNS_PROXY_STUB))
|
|
return false;
|
|
|
|
return true;
|
|
}
|
|
|
|
DEFINE_CONFIG_PARSE_ENUM(config_parse_dns_cache_mode, dns_cache_mode, DnsCacheMode, "Failed to parse DNS cache mode setting")
|
|
|
|
static const char* const dns_cache_mode_table[_DNS_CACHE_MODE_MAX] = {
|
|
[DNS_CACHE_MODE_YES] = "yes",
|
|
[DNS_CACHE_MODE_NO] = "no",
|
|
[DNS_CACHE_MODE_NO_NEGATIVE] = "no-negative",
|
|
};
|
|
DEFINE_STRING_TABLE_LOOKUP_WITH_BOOLEAN(dns_cache_mode, DnsCacheMode, DNS_CACHE_MODE_YES);
|