wgengine/router: dns: unify on *BSD, multimode on Linux, Magic DNS (#536)

Signed-off-by: Dmytro Shynkevych <dmytro@tailscale.com>

wgengine/router/router_linux.go

@@ -5,19 +5,14 @@
 package router
 
 import (
-	"bytes"
 	"fmt"
-	"io/ioutil"
-	"os"
 	"os/exec"
-	"path/filepath"
 	"strings"
 
 	"github.com/coreos/go-iptables/iptables"
 	"github.com/tailscale/wireguard-go/device"
 	"github.com/tailscale/wireguard-go/tun"
 	"inet.af/netaddr"
-	"tailscale.com/atomicfile"
 	"tailscale.com/net/tsaddr"
 	"tailscale.com/types/logger"
 )
@@ -73,6 +68,9 @@ type linuxRouter struct {
 	snatSubnetRoutes bool
 	netfilterMode    NetfilterMode
 
+	dnsMode   dnsMode
+	dnsConfig DNSConfig
+
 	ipt4 netfilterRunner
 	cmd  commandRunner
 }
@@ -119,10 +117,27 @@ func (r *linuxRouter) Up() error {
 		return err
 	}
 
+	switch {
+	// TODO(dmytro): enable resolved when per-domain resolvers are desired.
+	case resolvedIsActive():
+		r.dnsMode = dnsDirect
+	//	r.dnsMode = dnsResolved
+	case nmIsActive():
+		r.dnsMode = dnsNetworkManager
+	case resolvconfIsActive():
+		r.dnsMode = dnsResolvconf
+	default:
+		r.dnsMode = dnsDirect
+	}
+	r.logf("dns mode: %v", r.dnsMode)
+
 	return nil
 }
 
-func (r *linuxRouter) down() error {
+func (r *linuxRouter) Close() error {
+	if err := r.downDNS(); err != nil {
+		return err
+	}
 	if err := r.downInterface(); err != nil {
 		return err
 	}
@@ -139,20 +154,6 @@ func (r *linuxRouter) down() error {
 	return nil
 }
 
-func (r *linuxRouter) Close() error {
-	var ret error
-	if ret = r.restoreResolvConf(); ret != nil {
-		r.logf("failed to restore system resolv.conf: %v", ret)
-	}
-	if err := r.down(); err != nil {
-		if ret == nil {
-			ret = err
-		}
-	}
-
-	return ret
-}
-
 // Set implements the Router interface.
 func (r *linuxRouter) Set(cfg *Config) error {
 	if cfg == nil {
@@ -189,12 +190,14 @@ func (r *linuxRouter) Set(cfg *Config) error {
 	}
 	r.snatSubnetRoutes = cfg.SNATSubnetRoutes
 
-	// TODO: this:
-	if false {
-		if err := r.replaceResolvConf(cfg.DNS, cfg.DNSDomains); err != nil {
-			return fmt.Errorf("replacing resolv.conf failed: %w", err)
+	if !r.dnsConfig.EquivalentTo(cfg.DNSConfig) {
+		if err := r.upDNS(cfg.DNSConfig); err != nil {
+			r.logf("dns up: %v", err)
+		} else {
+			r.dnsConfig = cfg.DNSConfig
 		}
 	}
+
 	return nil
 }
 
@@ -315,102 +318,6 @@ func (r *linuxRouter) setNetfilterMode(mode NetfilterMode) error {
 	return nil
 }
 
-const (
-	tsConf     = "/etc/resolv.tailscale.conf"
-	backupConf = "/etc/resolv.pre-tailscale-backup.conf"
-	resolvConf = "/etc/resolv.conf"
-)
-
-func (r *linuxRouter) replaceResolvConf(servers []netaddr.IP, domains []string) error {
-	if len(servers) == 0 {
-		return r.restoreResolvConf()
-	}
-
-	// First write the tsConf file.
-	buf := new(bytes.Buffer)
-	fmt.Fprintf(buf, "# resolv.conf(5) file generated by tailscale\n")
-	fmt.Fprintf(buf, "#     DO NOT EDIT THIS FILE BY HAND -- CHANGES WILL BE OVERWRITTEN\n\n")
-	for _, ns := range servers {
-		fmt.Fprintf(buf, "nameserver %s\n", ns)
-	}
-	if len(domains) > 0 {
-		fmt.Fprintf(buf, "search "+strings.Join(domains, " ")+"\n")
-	}
-	f, err := ioutil.TempFile(filepath.Dir(tsConf), filepath.Base(tsConf)+".*")
-	if err != nil {
-		return err
-	}
-	f.Close()
-	if err := atomicfile.WriteFile(f.Name(), buf.Bytes(), 0644); err != nil {
-		return err
-	}
-	os.Chmod(f.Name(), 0644) // ioutil.TempFile creates the file with 0600
-	if err := os.Rename(f.Name(), tsConf); err != nil {
-		return err
-	}
-
-	if linkPath, err := os.Readlink(resolvConf); err != nil {
-		// Remove any old backup that may exist.
-		os.Remove(backupConf)
-
-		// Backup the existing /etc/resolv.conf file.
-		contents, err := ioutil.ReadFile(resolvConf)
-		if os.IsNotExist(err) {
-			// No existing /etc/resolv.conf file to backup.
-			// Nothing to do.
-			return nil
-		} else if err != nil {
-			return err
-		}
-		if err := atomicfile.WriteFile(backupConf, contents, 0644); err != nil {
-			return err
-		}
-	} else if linkPath != tsConf {
-		// Backup the existing symlink.
-		os.Remove(backupConf)
-		if err := os.Symlink(linkPath, backupConf); err != nil {
-			return err
-		}
-	} else {
-		// Nothing to do, resolvConf already points to tsConf.
-		return nil
-	}
-
-	os.Remove(resolvConf)
-	if err := os.Symlink(tsConf, resolvConf); err != nil {
-		return nil
-	}
-
-	out, _ := exec.Command("service", "systemd-resolved", "restart").CombinedOutput()
-	if len(out) > 0 {
-		r.logf("service systemd-resolved restart: %s", out)
-	}
-	return nil
-}
-
-func (r *linuxRouter) restoreResolvConf() error {
-	if _, err := os.Stat(backupConf); err != nil {
-		if os.IsNotExist(err) {
-			return nil // no backup resolv.conf to restore
-		}
-		return err
-	}
-	if ln, err := os.Readlink(resolvConf); err != nil {
-		return err
-	} else if ln != tsConf {
-		return fmt.Errorf("resolv.conf is not a symlink to %s", tsConf)
-	}
-	if err := os.Rename(backupConf, resolvConf); err != nil {
-		return err
-	}
-	os.Remove(tsConf) // best effort removal of tsConf file
-	out, _ := exec.Command("service", "systemd-resolved", "restart").CombinedOutput()
-	if len(out) > 0 {
-		r.logf("service systemd-resolved restart: %s", out)
-	}
-	return nil
-}
-
 // addAddress adds an IP/mask to the tunnel interface. Fails if the
 // address is already assigned to the interface, or if the addition
 // fails.
@@ -932,3 +839,69 @@ func normalizeCIDR(cidr netaddr.IPPrefix) string {
 	nip := ncidr.IP.Mask(ncidr.Mask)
 	return fmt.Sprintf("%s/%d", nip, cidr.Bits)
 }
+
+// upDNS updates the system DNS configuration to the given one.
+func (r *linuxRouter) upDNS(config DNSConfig) error {
+	if len(config.Nameservers) == 0 {
+		return r.downDNS()
+	}
+
+	switch r.dnsMode {
+	case dnsResolved:
+		if err := dnsResolvedUp(config); err != nil {
+			return fmt.Errorf("resolved: %w", err)
+		}
+	case dnsResolvconf:
+		if err := dnsResolvconfUp(config, r.tunname); err != nil {
+			return fmt.Errorf("resolvconf: %w", err)
+		}
+	case dnsNetworkManager:
+		if err := dnsNetworkManagerUp(config, r.tunname); err != nil {
+			return fmt.Errorf("network manager: %w", err)
+		}
+	case dnsDirect:
+		if err := dnsDirectUp(config); err != nil {
+			return fmt.Errorf("direct: %w", err)
+		}
+	}
+	return nil
+}
+
+// downDNS restores system DNS configuration to its state before upDNS.
+// It is idempotent (in particular, it does nothing if upDNS was never run).
+func (r *linuxRouter) downDNS() error {
+	switch r.dnsMode {
+	case dnsResolved:
+		if err := dnsResolvedDown(); err != nil {
+			return fmt.Errorf("resolved: %w", err)
+		}
+	case dnsResolvconf:
+		if err := dnsResolvconfDown(r.tunname); err != nil {
+			return fmt.Errorf("resolvconf: %w", err)
+		}
+	case dnsNetworkManager:
+		if err := dnsNetworkManagerDown(r.tunname); err != nil {
+			return fmt.Errorf("network manager: %w", err)
+		}
+	case dnsDirect:
+		if err := dnsDirectDown(); err != nil {
+			return fmt.Errorf("direct: %w", err)
+		}
+	}
+	return nil
+}
+
+func cleanup(logf logger.Logf, interfaceName string) {
+	// Note: we need not do anything for dnsResolved,
+	// as its settings are interface-bound and get cleaned up for us.
+	switch {
+	case resolvconfIsActive():
+		if err := dnsResolvconfDown(interfaceName); err != nil {
+			logf("down down: resolvconf: %v", err)
+		}
+	default:
+		if err := dnsDirectDown(); err != nil {
+			logf("dns down: direct: %v", err)
+		}
+	}
+}