| // Package resolvconf provides utility code to query and update DNS configuration in /etc/resolv.conf |
| package resolvconf |
| |
| import ( |
| "bytes" |
| "os" |
| "regexp" |
| "strings" |
| "sync" |
| |
| "github.com/sirupsen/logrus" |
| ) |
| |
| const ( |
| // defaultPath is the default path to the resolv.conf that contains information to resolve DNS. See Path(). |
| defaultPath = "/etc/resolv.conf" |
| // alternatePath is a path different from defaultPath, that may be used to resolve DNS. See Path(). |
| alternatePath = "/run/systemd/resolve/resolv.conf" |
| ) |
| |
| // constants for the IP address type |
| const ( |
| IP = iota // IPv4 and IPv6 |
| IPv4 |
| IPv6 |
| ) |
| |
| var ( |
| detectSystemdResolvConfOnce sync.Once |
| pathAfterSystemdDetection = defaultPath |
| ) |
| |
| // Path returns the path to the resolv.conf file that libnetwork should use. |
| // |
| // When /etc/resolv.conf contains 127.0.0.53 as the only nameserver, then |
| // it is assumed systemd-resolved manages DNS. Because inside the container 127.0.0.53 |
| // is not a valid DNS server, Path() returns /run/systemd/resolve/resolv.conf |
| // which is the resolv.conf that systemd-resolved generates and manages. |
| // Otherwise Path() returns /etc/resolv.conf. |
| // |
| // Errors are silenced as they will inevitably resurface at future open/read calls. |
| // |
| // More information at https://www.freedesktop.org/software/systemd/man/systemd-resolved.service.html#/etc/resolv.conf |
| func Path() string { |
| detectSystemdResolvConfOnce.Do(func() { |
| candidateResolvConf, err := os.ReadFile(defaultPath) |
| if err != nil { |
| // silencing error as it will resurface at next calls trying to read defaultPath |
| return |
| } |
| ns := GetNameservers(candidateResolvConf, IP) |
| if len(ns) == 1 && ns[0] == "127.0.0.53" { |
| pathAfterSystemdDetection = alternatePath |
| logrus.Infof("detected 127.0.0.53 nameserver, assuming systemd-resolved, so using resolv.conf: %s", alternatePath) |
| } |
| }) |
| return pathAfterSystemdDetection |
| } |
| |
| const ( |
| // ipLocalhost is a regex pattern for IPv4 or IPv6 loopback range. |
| ipLocalhost = `((127\.([0-9]{1,3}\.){2}[0-9]{1,3})|(::1)$)` |
| ipv4NumBlock = `(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)` |
| ipv4Address = `(` + ipv4NumBlock + `\.){3}` + ipv4NumBlock |
| |
| // This is not an IPv6 address verifier as it will accept a super-set of IPv6, and also |
| // will *not match* IPv4-Embedded IPv6 Addresses (RFC6052), but that and other variants |
| // -- e.g. other link-local types -- either won't work in containers or are unnecessary. |
| // For readability and sufficiency for Docker purposes this seemed more reasonable than a |
| // 1000+ character regexp with exact and complete IPv6 validation |
| ipv6Address = `([0-9A-Fa-f]{0,4}:){2,7}([0-9A-Fa-f]{0,4})(%\w+)?` |
| ) |
| |
| var ( |
| // Note: the default IPv4 & IPv6 resolvers are set to Google's Public DNS |
| defaultIPv4Dns = []string{"nameserver 8.8.8.8", "nameserver 8.8.4.4"} |
| defaultIPv6Dns = []string{"nameserver 2001:4860:4860::8888", "nameserver 2001:4860:4860::8844"} |
| |
| localhostNSRegexp = regexp.MustCompile(`(?m)^nameserver\s+` + ipLocalhost + `\s*\n*`) |
| nsIPv6Regexp = regexp.MustCompile(`(?m)^nameserver\s+` + ipv6Address + `\s*\n*`) |
| nsRegexp = regexp.MustCompile(`^\s*nameserver\s*((` + ipv4Address + `)|(` + ipv6Address + `))\s*$`) |
| nsIPv6Regexpmatch = regexp.MustCompile(`^\s*nameserver\s*((` + ipv6Address + `))\s*$`) |
| nsIPv4Regexpmatch = regexp.MustCompile(`^\s*nameserver\s*((` + ipv4Address + `))\s*$`) |
| searchRegexp = regexp.MustCompile(`^\s*search\s*(([^\s]+\s*)*)$`) |
| optionsRegexp = regexp.MustCompile(`^\s*options\s*(([^\s]+\s*)*)$`) |
| ) |
| |
| // File contains the resolv.conf content and its hash |
| type File struct { |
| Content []byte |
| Hash []byte |
| } |
| |
| // Get returns the contents of /etc/resolv.conf and its hash |
| func Get() (*File, error) { |
| return GetSpecific(Path()) |
| } |
| |
| // GetSpecific returns the contents of the user specified resolv.conf file and its hash |
| func GetSpecific(path string) (*File, error) { |
| resolv, err := os.ReadFile(path) |
| if err != nil { |
| return nil, err |
| } |
| return &File{Content: resolv, Hash: hashData(resolv)}, nil |
| } |
| |
| // FilterResolvDNS cleans up the config in resolvConf. It has two main jobs: |
| // 1. It looks for localhost (127.*|::1) entries in the provided |
| // resolv.conf, removing local nameserver entries, and, if the resulting |
| // cleaned config has no defined nameservers left, adds default DNS entries |
| // 2. Given the caller provides the enable/disable state of IPv6, the filter |
| // code will remove all IPv6 nameservers if it is not enabled for containers |
| func FilterResolvDNS(resolvConf []byte, ipv6Enabled bool) (*File, error) { |
| cleanedResolvConf := localhostNSRegexp.ReplaceAll(resolvConf, []byte{}) |
| // if IPv6 is not enabled, also clean out any IPv6 address nameserver |
| if !ipv6Enabled { |
| cleanedResolvConf = nsIPv6Regexp.ReplaceAll(cleanedResolvConf, []byte{}) |
| } |
| // if the resulting resolvConf has no more nameservers defined, add appropriate |
| // default DNS servers for IPv4 and (optionally) IPv6 |
| if len(GetNameservers(cleanedResolvConf, IP)) == 0 { |
| logrus.Infof("No non-localhost DNS nameservers are left in resolv.conf. Using default external servers: %v", defaultIPv4Dns) |
| dns := defaultIPv4Dns |
| if ipv6Enabled { |
| logrus.Infof("IPv6 enabled; Adding default IPv6 external servers: %v", defaultIPv6Dns) |
| dns = append(dns, defaultIPv6Dns...) |
| } |
| cleanedResolvConf = append(cleanedResolvConf, []byte("\n"+strings.Join(dns, "\n"))...) |
| } |
| return &File{Content: cleanedResolvConf, Hash: hashData(cleanedResolvConf)}, nil |
| } |
| |
| // getLines parses input into lines and strips away comments. |
| func getLines(input []byte, commentMarker []byte) [][]byte { |
| lines := bytes.Split(input, []byte("\n")) |
| var output [][]byte |
| for _, currentLine := range lines { |
| var commentIndex = bytes.Index(currentLine, commentMarker) |
| if commentIndex == -1 { |
| output = append(output, currentLine) |
| } else { |
| output = append(output, currentLine[:commentIndex]) |
| } |
| } |
| return output |
| } |
| |
| // GetNameservers returns nameservers (if any) listed in /etc/resolv.conf |
| func GetNameservers(resolvConf []byte, kind int) []string { |
| var nameservers []string |
| for _, line := range getLines(resolvConf, []byte("#")) { |
| var ns [][]byte |
| if kind == IP { |
| ns = nsRegexp.FindSubmatch(line) |
| } else if kind == IPv4 { |
| ns = nsIPv4Regexpmatch.FindSubmatch(line) |
| } else if kind == IPv6 { |
| ns = nsIPv6Regexpmatch.FindSubmatch(line) |
| } |
| if len(ns) > 0 { |
| nameservers = append(nameservers, string(ns[1])) |
| } |
| } |
| return nameservers |
| } |
| |
| // GetNameserversAsCIDR returns nameservers (if any) listed in |
| // /etc/resolv.conf as CIDR blocks (e.g., "1.2.3.4/32") |
| // This function's output is intended for net.ParseCIDR |
| func GetNameserversAsCIDR(resolvConf []byte) []string { |
| var nameservers []string |
| for _, nameserver := range GetNameservers(resolvConf, IP) { |
| var address string |
| // If IPv6, strip zone if present |
| if strings.Contains(nameserver, ":") { |
| address = strings.Split(nameserver, "%")[0] + "/128" |
| } else { |
| address = nameserver + "/32" |
| } |
| nameservers = append(nameservers, address) |
| } |
| return nameservers |
| } |
| |
| // GetSearchDomains returns search domains (if any) listed in /etc/resolv.conf |
| // If more than one search line is encountered, only the contents of the last |
| // one is returned. |
| func GetSearchDomains(resolvConf []byte) []string { |
| var domains []string |
| for _, line := range getLines(resolvConf, []byte("#")) { |
| match := searchRegexp.FindSubmatch(line) |
| if match == nil { |
| continue |
| } |
| domains = strings.Fields(string(match[1])) |
| } |
| return domains |
| } |
| |
| // GetOptions returns options (if any) listed in /etc/resolv.conf |
| // If more than one options line is encountered, only the contents of the last |
| // one is returned. |
| func GetOptions(resolvConf []byte) []string { |
| var options []string |
| for _, line := range getLines(resolvConf, []byte("#")) { |
| match := optionsRegexp.FindSubmatch(line) |
| if match == nil { |
| continue |
| } |
| options = strings.Fields(string(match[1])) |
| } |
| return options |
| } |
| |
| // Build generates and writes a configuration file to path containing a nameserver |
| // entry for every element in nameservers, a "search" entry for every element in |
| // dnsSearch, and an "options" entry for every element in dnsOptions. It returns |
| // a File containing the generated content and its (sha256) hash. |
| func Build(path string, nameservers, dnsSearch, dnsOptions []string) (*File, error) { |
| content := bytes.NewBuffer(nil) |
| if len(dnsSearch) > 0 { |
| if searchString := strings.Join(dnsSearch, " "); strings.Trim(searchString, " ") != "." { |
| if _, err := content.WriteString("search " + searchString + "\n"); err != nil { |
| return nil, err |
| } |
| } |
| } |
| for _, dns := range nameservers { |
| if _, err := content.WriteString("nameserver " + dns + "\n"); err != nil { |
| return nil, err |
| } |
| } |
| if len(dnsOptions) > 0 { |
| if optsString := strings.Join(dnsOptions, " "); strings.Trim(optsString, " ") != "" { |
| if _, err := content.WriteString("options " + optsString + "\n"); err != nil { |
| return nil, err |
| } |
| } |
| } |
| |
| if err := os.WriteFile(path, content.Bytes(), 0o644); err != nil { |
| return nil, err |
| } |
| |
| return &File{Content: content.Bytes(), Hash: hashData(content.Bytes())}, nil |
| } |