Merge pull request #3502 from poettering/resolved-flush-cache

resolved: allow clients request cache flushes

8 files changed, 146 insertions, 22 deletions

diff --git a/man/systemd-resolve.xml b/man/systemd-resolve.xml
index 4b66f836a2..b917ac20a2 100644
--- a/man/systemd-resolve.xml
+++ b/man/systemd-resolve.xml
@@ -288,6 +288,12 @@
         <listitem><para>Resets the statistics counters shown in <option>--statistics</option> to zero.</para></listitem>
       </varlistentry>
 
+      <varlistentry>
+        <term><option>--flush-caches</option></term>
+
+        <listitem><para>Flushes all DNS resource record caches the service maintains locally.</para></listitem>
+      </varlistentry>
+
       <xi:include href="standard-options.xml" xpointer="help" />
       <xi:include href="standard-options.xml" xpointer="version" />
     </variablelist>
diff --git a/man/systemd-resolved.service.xml b/man/systemd-resolved.service.xml
index 829729ca09..485f3e9aee 100644
--- a/man/systemd-resolved.service.xml
+++ b/man/systemd-resolved.service.xml
@@ -146,6 +146,28 @@
   </refsect1>
 
   <refsect1>
+    <title>Signals</title>
+
+    <variablelist>
+      <varlistentry>
+        <term><constant>SIGUSR1</constant></term>
+
+        <listitem><para>Upon reception of the SIGUSR1 process signal <command>systemd-resolved</command> will dump the
+        contents of all DNS resource record caches it maintains into the system logs.</para></listitem>
+      </varlistentry>
+
+      <varlistentry>
+        <term><constant>SIGUSR2</constant></term>
+
+        <listitem><para>Upon reception of the SIGUSR2 process signal <command>systemd-resolved</command> will flush all
+        caches it maintains. Note that it should normally not be necessary to request this explicitly – except for
+        debugging purposes – as <command>systemd-resolved</command> flushes the caches automatically anyway any time
+        the host's network configuration changes.</para></listitem>
+      </varlistentry>
+    </variablelist>
+  </refsect1>
+
+  <refsect1>
     <title>See Also</title>
     <para>
       <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
diff --git a/src/resolve/resolve-tool.c b/src/resolve/resolve-tool.c
index 7e145c64c4..bc6dcf04a4 100644
--- a/src/resolve/resolve-tool.c
+++ b/src/resolve/resolve-tool.c
@@ -66,6 +66,7 @@ static enum {
         MODE_RESOLVE_TLSA,
         MODE_STATISTICS,
         MODE_RESET_STATISTICS,
+        MODE_FLUSH_CACHES,
 } arg_mode = MODE_RESOLVE_HOST;
 
 static ServiceFamily service_family_from_string(const char *s) {
@@ -1037,6 +1038,24 @@ static int reset_statistics(sd_bus *bus) {
         return 0;
 }
 
+static int flush_caches(sd_bus *bus) {
+        _cleanup_(sd_bus_error_free) sd_bus_error error = SD_BUS_ERROR_NULL;
+        int r;
+
+        r = sd_bus_call_method(bus,
+                               "org.freedesktop.resolve1",
+                               "/org/freedesktop/resolve1",
+                               "org.freedesktop.resolve1.Manager",
+                               "FlushCaches",
+                               &error,
+                               NULL,
+                               NULL);
+        if (r < 0)
+                return log_error_errno(r, "Failed to flush caches: %s", bus_error_message(&error, r));
+
+        return 0;
+}
+
 static void help_protocol_types(void) {
         if (arg_legend)
                 puts("Known protocol types:");
@@ -1097,6 +1116,7 @@ static void help(void) {
                "     --legend=BOOL          Print headers and additional info (default: yes)\n"
                "     --statistics           Show resolver statistics\n"
                "     --reset-statistics     Reset resolver statistics\n"
+               "     --flush-caches         Flush all local DNS caches\n"
                , program_invocation_short_name);
 }
 
@@ -1114,6 +1134,7 @@ static int parse_argv(int argc, char *argv[]) {
                 ARG_SEARCH,
                 ARG_STATISTICS,
                 ARG_RESET_STATISTICS,
+                ARG_FLUSH_CACHES,
         };
 
         static const struct option options[] = {
@@ -1134,6 +1155,7 @@ static int parse_argv(int argc, char *argv[]) {
                 { "search",           required_argument, NULL, ARG_SEARCH           },
                 { "statistics",       no_argument,       NULL, ARG_STATISTICS,      },
                 { "reset-statistics", no_argument,       NULL, ARG_RESET_STATISTICS },
+                { "flush-caches",     no_argument,       NULL, ARG_FLUSH_CACHES     },
                 {}
         };
 
@@ -1307,6 +1329,10 @@ static int parse_argv(int argc, char *argv[]) {
                         arg_mode = MODE_RESET_STATISTICS;
                         break;
 
+                case ARG_FLUSH_CACHES:
+                        arg_mode = MODE_FLUSH_CACHES;
+                        break;
+
                 case '?':
                         return -EINVAL;
 
@@ -1473,6 +1499,16 @@ int main(int argc, char **argv) {
 
                 r = reset_statistics(bus);
                 break;
+
+        case MODE_FLUSH_CACHES:
+                if (argc > optind) {
+                        log_error("Too many arguments.");
+                        r = -EINVAL;
+                        goto finish;
+                }
+
+                r = flush_caches(bus);
+                break;
         }
 
 finish:
diff --git a/src/resolve/resolved-bus.c b/src/resolve/resolved-bus.c
index 6d4e5746f7..6d86cbf123 100644
--- a/src/resolve/resolved-bus.c
+++ b/src/resolve/resolved-bus.c
@@ -1442,26 +1442,6 @@ static int get_any_link(Manager *m, int ifindex, Link **ret, sd_bus_error *error
         return 0;
 }
 
-static int get_unmanaged_link(Manager *m, int ifindex, Link **ret, sd_bus_error *error) {
-        Link *l;
-        int r;
-
-        assert(m);
-        assert(ret);
-
-        r = get_any_link(m, ifindex, &l, error);
-        if (r < 0)
-                return r;
-
-        if (l->flags & IFF_LOOPBACK)
-                return sd_bus_error_setf(error, BUS_ERROR_LINK_BUSY, "Link %s is loopback device.", l->name);
-        if (l->is_managed)
-                return sd_bus_error_setf(error, BUS_ERROR_LINK_BUSY, "Link %s is managed.", l->name);
-
-        *ret = l;
-        return 0;
-}
-
 static int call_link_method(Manager *m, sd_bus_message *message, sd_bus_message_handler_t handler, sd_bus_error *error) {
         int ifindex, r;
         Link *l;
@@ -1475,7 +1455,7 @@ static int call_link_method(Manager *m, sd_bus_message *message, sd_bus_message_
         if (r < 0)
                 return r;
 
-        r = get_unmanaged_link(m, ifindex, &l, error);
+        r = get_any_link(m, ifindex, &l, error);
         if (r < 0)
                 return r;
 
@@ -1535,6 +1515,17 @@ static int bus_method_get_link(sd_bus_message *message, void *userdata, sd_bus_e
         return sd_bus_reply_method_return(message, "o", p);
 }
 
+static int bus_method_flush_caches(sd_bus_message *message, void *userdata, sd_bus_error *error) {
+        Manager *m = userdata;
+
+        assert(message);
+        assert(m);
+
+        manager_flush_caches(m);
+
+        return sd_bus_reply_method_return(message, NULL);
+}
+
 static const sd_bus_vtable resolve_vtable[] = {
         SD_BUS_VTABLE_START(0),
         SD_BUS_PROPERTY("LLMNRHostname", "s", NULL, offsetof(Manager, llmnr_hostname), 0),
@@ -1550,6 +1541,7 @@ static const sd_bus_vtable resolve_vtable[] = {
         SD_BUS_METHOD("ResolveRecord", "isqqt", "a(iqqay)t", bus_method_resolve_record, SD_BUS_VTABLE_UNPRIVILEGED),
         SD_BUS_METHOD("ResolveService", "isssit", "a(qqqsa(iiay)s)aayssst", bus_method_resolve_service, SD_BUS_VTABLE_UNPRIVILEGED),
         SD_BUS_METHOD("ResetStatistics", NULL, NULL, bus_method_reset_statistics, 0),
+        SD_BUS_METHOD("FlushCaches", NULL, NULL, bus_method_flush_caches, 0),
         SD_BUS_METHOD("GetLink", "i", "o", bus_method_get_link, SD_BUS_VTABLE_UNPRIVILEGED),
         SD_BUS_METHOD("SetLinkDNS", "ia(iay)", NULL, bus_method_set_link_dns_servers, 0),
         SD_BUS_METHOD("SetLinkDomains", "ia(sb)", NULL, bus_method_set_link_domains, 0),
diff --git a/src/resolve/resolved-link-bus.c b/src/resolve/resolved-link-bus.c
index 6aff427192..bfb87d78e7 100644
--- a/src/resolve/resolved-link-bus.c
+++ b/src/resolve/resolved-link-bus.c
@@ -18,6 +18,7 @@
 ***/
 
 #include "alloc-util.h"
+#include "bus-common-errors.h"
 #include "bus-util.h"
 #include "parse-util.h"
 #include "resolve-util.h"
@@ -158,6 +159,17 @@ static int property_get_dnssec_supported(
         return sd_bus_message_append(reply, "b", link_dnssec_supported(l));
 }
 
+static int verify_unmanaged_link(Link *l, sd_bus_error *error) {
+        assert(l);
+
+        if (l->flags & IFF_LOOPBACK)
+                return sd_bus_error_setf(error, BUS_ERROR_LINK_BUSY, "Link %s is loopback device.", l->name);
+        if (l->is_managed)
+                return sd_bus_error_setf(error, BUS_ERROR_LINK_BUSY, "Link %s is managed.", l->name);
+
+        return 0;
+}
+
 int bus_link_method_set_dns_servers(sd_bus_message *message, void *userdata, sd_bus_error *error) {
         _cleanup_free_ struct in_addr_data *dns = NULL;
         size_t allocated = 0, n = 0;
@@ -168,6 +180,10 @@ int bus_link_method_set_dns_servers(sd_bus_message *message, void *userdata, sd_
         assert(message);
         assert(l);
 
+        r = verify_unmanaged_link(l, error);
+        if (r < 0)
+                return r;
+
         r = sd_bus_message_enter_container(message, 'a', "(iay)");
         if (r < 0)
                 return r;
@@ -249,6 +265,10 @@ int bus_link_method_set_domains(sd_bus_message *message, void *userdata, sd_bus_
         assert(message);
         assert(l);
 
+        r = verify_unmanaged_link(l, error);
+        if (r < 0)
+                return r;
+
         r = sd_bus_message_enter_container(message, 'a', "(sb)");
         if (r < 0)
                 return r;
@@ -328,6 +348,10 @@ int bus_link_method_set_llmnr(sd_bus_message *message, void *userdata, sd_bus_er
         assert(message);
         assert(l);
 
+        r = verify_unmanaged_link(l, error);
+        if (r < 0)
+                return r;
+
         r = sd_bus_message_read(message, "s", &llmnr);
         if (r < 0)
                 return r;
@@ -356,6 +380,10 @@ int bus_link_method_set_mdns(sd_bus_message *message, void *userdata, sd_bus_err
         assert(message);
         assert(l);
 
+        r = verify_unmanaged_link(l, error);
+        if (r < 0)
+                return r;
+
         r = sd_bus_message_read(message, "s", &mdns);
         if (r < 0)
                 return r;
@@ -384,6 +412,10 @@ int bus_link_method_set_dnssec(sd_bus_message *message, void *userdata, sd_bus_e
         assert(message);
         assert(l);
 
+        r = verify_unmanaged_link(l, error);
+        if (r < 0)
+                return r;
+
         r = sd_bus_message_read(message, "s", &dnssec);
         if (r < 0)
                 return r;
@@ -411,6 +443,10 @@ int bus_link_method_set_dnssec_negative_trust_anchors(sd_bus_message *message, v
         assert(message);
         assert(l);
 
+        r = verify_unmanaged_link(l, error);
+        if (r < 0)
+                return r;
+
         r = sd_bus_message_read_strv(message, &ntas);
         if (r < 0)
                 return r;
@@ -442,10 +478,15 @@ int bus_link_method_set_dnssec_negative_trust_anchors(sd_bus_message *message, v
 
 int bus_link_method_revert(sd_bus_message *message, void *userdata, sd_bus_error *error) {
         Link *l = userdata;
+        int r;
 
         assert(message);
         assert(l);
 
+        r = verify_unmanaged_link(l, error);
+        if (r < 0)
+                return r;
+
         link_flush_settings(l);
         link_allocate_scopes(l);
         link_add_rrs(l, false);
diff --git a/src/resolve/resolved-manager.c b/src/resolve/resolved-manager.c
index 8dc7891143..a46f13b92f 100644
--- a/src/resolve/resolved-manager.c
+++ b/src/resolve/resolved-manager.c
@@ -466,6 +466,19 @@ static int manager_sigusr1(sd_event_source *s, const struct signalfd_siginfo *si
         return 0;
 }
 
+static int manager_sigusr2(sd_event_source *s, const struct signalfd_siginfo *si, void *userdata) {
+        Manager *m = userdata;
+
+        assert(s);
+        assert(si);
+        assert(m);
+
+        manager_flush_caches(m);
+        log_info("Flushed all caches.");
+
+        return 0;
+}
+
 int manager_new(Manager **ret) {
         _cleanup_(manager_freep) Manager *m = NULL;
         int r;
@@ -526,6 +539,7 @@ int manager_new(Manager **ret) {
                 return r;
 
         (void) sd_event_add_signal(m->event, &m->sigusr1_event_source, SIGUSR1, manager_sigusr1, m);
+        (void) sd_event_add_signal(m->event, &m->sigusr2_event_source, SIGUSR2, manager_sigusr2, m);
 
         *ret = m;
         m = NULL;
@@ -584,6 +598,7 @@ Manager *manager_free(Manager *m) {
         sd_bus_unref(m->bus);
 
         sd_event_source_unref(m->sigusr1_event_source);
+        sd_event_source_unref(m->sigusr2_event_source);
 
         sd_event_unref(m->event);
 
@@ -1234,3 +1249,12 @@ bool manager_routable(Manager *m, int family) {
 
         return false;
 }
+
+void manager_flush_caches(Manager *m) {
+        DnsScope *scope;
+
+        assert(m);
+
+        LIST_FOREACH(scopes, scope, m->dns_scopes)
+                dns_cache_flush(&scope->cache);
+}
diff --git a/src/resolve/resolved-manager.h b/src/resolve/resolved-manager.h
index e82a824f29..ef71202ef9 100644
--- a/src/resolve/resolved-manager.h
+++ b/src/resolve/resolved-manager.h
@@ -120,6 +120,7 @@ struct Manager {
         sd_bus_slot *prepare_for_sleep_slot;
 
         sd_event_source *sigusr1_event_source;
+        sd_event_source *sigusr2_event_source;
 
         unsigned n_transactions_total;
         unsigned n_dnssec_verdict[_DNSSEC_VERDICT_MAX];
@@ -169,3 +170,5 @@ bool manager_dnssec_supported(Manager *m);
 void manager_dnssec_verdict(Manager *m, DnssecVerdict verdict, const DnsResourceKey *key);
 
 bool manager_routable(Manager *m, int family);
+
+void manager_flush_caches(Manager *m);
diff --git a/src/resolve/resolved.c b/src/resolve/resolved.c
index 6cef401870..3a47b82d8a 100644
--- a/src/resolve/resolved.c
+++ b/src/resolve/resolved.c
@@ -71,7 +71,7 @@ int main(int argc, char *argv[]) {
         if (r < 0)
                 goto finish;
 
-        assert_se(sigprocmask_many(SIG_BLOCK, NULL, SIGTERM, SIGINT, SIGUSR1, -1) >= 0);
+        assert_se(sigprocmask_many(SIG_BLOCK, NULL, SIGTERM, SIGINT, SIGUSR1, SIGUSR2, -1) >= 0);
 
         r = manager_new(&m);
         if (r < 0) {