Force resolvers to reconnect after connecting to SPN

resolver/main.go

@@ -57,6 +57,19 @@ func start() error {
 		return err
 	}
 
+	// Force resolvers to reconnect when SPN has connected.
+	if err := module.RegisterEventHook(
+		"captain",
+		"spn connect", // Defined by captain.SPNConnectedEvent
+		"force resolver reconnect",
+		func(ctx context.Context, _ any) error {
+			ForceResolverReconnect(ctx)
+			return nil
+		},
+	); err != nil {
+		return err
+	}
+
 	// reload after config change
 	prevNameservers := strings.Join(configuredNameServers(), " ")
 	err = module.RegisterEventHook(

resolver/resolver-env.go

@@ -150,6 +150,8 @@ func (er *envResolverConn) IsFailing() bool {
 
 func (er *envResolverConn) ResetFailure() {}
 
+func (er *envResolverConn) ForceReconnect(_ context.Context) {}
+
 // QueryPortmasterEnv queries the environment resolver directly.
 func QueryPortmasterEnv(ctx context.Context, q *Query) (*RRCache, error) {
 	return envResolver.Conn.Query(ctx, q)

resolver/resolver-https.go

@@ -8,15 +8,18 @@ import (
 	"io"
 	"net/http"
 	"net/url"
+	"sync"
 	"time"
 
 	"github.com/miekg/dns"
+	"github.com/safing/portbase/log"
 )
 
 // HTTPSResolver is a resolver using just a single tcp connection with pipelining.
 type HTTPSResolver struct {
 	BasicResolverConn
-	Client *http.Client
+	client     *http.Client
+	clientLock sync.RWMutex
 }
 
 // HTTPSQuery holds the query information for a hTTPSResolverConn.
@@ -40,23 +43,13 @@ func (tq *HTTPSQuery) MakeCacheRecord(reply *dns.Msg, resolverInfo *ResolverInfo
 
 // NewHTTPSResolver returns a new HTTPSResolver.
 func NewHTTPSResolver(resolver *Resolver) *HTTPSResolver {
-	tr := &http.Transport{
-		TLSClientConfig: &tls.Config{
-			MinVersion: tls.VersionTLS12,
-			ServerName: resolver.Info.Domain,
-			// TODO: use portbase rng
-		},
-		IdleConnTimeout: 3 * time.Minute,
-	}
-
-	client := &http.Client{Transport: tr}
 	newResolver := &HTTPSResolver{
 		BasicResolverConn: BasicResolverConn{
 			resolver: resolver,
 		},
-		Client: client,
 	}
 	newResolver.BasicResolverConn.init()
+	newResolver.refreshClient()
 	return newResolver
 }
 
@@ -86,7 +79,13 @@ func (hr *HTTPSResolver) Query(ctx context.Context, q *Query) (*RRCache, error)
 		return nil, err
 	}
 
-	resp, err := hr.Client.Do(request)
+	// Lock client for usage.
+	hr.clientLock.RLock()
+	defer hr.clientLock.RUnlock()
+
+	// TODO: Check age of client and force a refresh similar to the TCP resolver.
+
+	resp, err := hr.client.Do(request)
 	if err != nil {
 		return nil, err
 	}
@@ -124,3 +123,35 @@ func (hr *HTTPSResolver) Query(ctx context.Context, q *Query) (*RRCache, error)
 	// TODO: check if reply.Answer is valid
 	return newRecord, nil
 }
+
+// ForceReconnect forces the resolver to re-establish the connection to the server.
+func (hr *HTTPSResolver) ForceReconnect(ctx context.Context) {
+	hr.refreshClient()
+	log.Tracer(ctx).Tracef("resolver: created new HTTP client for %s", hr.resolver)
+}
+
+func (hr *HTTPSResolver) refreshClient() {
+	// Lock client for changing.
+	hr.clientLock.Lock()
+	defer hr.clientLock.Unlock()
+
+	// Attempt to close connection of previous client.
+	if hr.client != nil {
+		hr.client.CloseIdleConnections()
+	}
+
+	// Create new client.
+	tr := &http.Transport{
+		TLSClientConfig: &tls.Config{
+			MinVersion: tls.VersionTLS12,
+			ServerName: hr.resolver.Info.Domain,
+			// TODO: use portbase rng
+		},
+		IdleConnTimeout:     1 * time.Minute,
+		TLSHandshakeTimeout: defaultConnectTimeout,
+	}
+	hr.client = &http.Client{
+		Transport: tr,
+		Timeout:   maxRequestTimeout,
+	}
+}

resolver/resolver-mdns.go

@@ -56,6 +56,8 @@ func (mrc *mDNSResolverConn) IsFailing() bool {
 
 func (mrc *mDNSResolverConn) ResetFailure() {}
 
+func (mrc *mDNSResolverConn) ForceReconnect(_ context.Context) {}
+
 type savedQuestion struct {
 	question dns.Question
 	expires  time.Time

resolver/resolver-plain.go

@@ -96,3 +96,7 @@ func (pr *PlainResolver) Query(ctx context.Context, q *Query) (*RRCache, error)
 	// TODO: check if reply.Answer is valid
 	return newRecord, nil
 }
+
+// ForceReconnect forces the resolver to re-establish the connection to the server.
+// Does nothing for PlainResolver, as every request uses its own connection.
+func (pr *PlainResolver) ForceReconnect(_ context.Context) {}

resolver/resolver-tcp.go

@@ -236,11 +236,29 @@ func (tr *TCPResolver) Query(ctx context.Context, q *Query) (*RRCache, error) {
 	return tq.MakeCacheRecord(reply, tr.resolver.Info), nil
 }
 
+// ForceReconnect forces the resolver to re-establish the connection to the server.
+func (tr *TCPResolver) ForceReconnect(ctx context.Context) {
+	tr.Lock()
+	defer tr.Unlock()
+
+	// Do nothing if no connection is available.
+	if tr.resolverConn == nil {
+		return
+	}
+
+	// Set the abandoned to force a new connection on next request.
+	// This will leave the previous connection and handler running until all requests are handled.
+	tr.resolverConn.abandoned.Set()
+
+	log.Tracer(ctx).Tracef("resolver: marked %s for reconnecting", tr.resolver)
+}
+
+// shutdown cleanly shuts down the resolver connection.
+// Must only be called once.
 func (trc *tcpResolverConn) shutdown() {
 	// Set abandoned status and close connection to the DNS server.
-	if trc.abandoned.SetToIf(false, true) {
+	trc.abandoned.Set()
 	_ = trc.conn.Close()
-	}
 
 	// Close all response channels for in-flight queries.
 	for _, tq := range trc.inFlightQueries {
@@ -320,7 +338,7 @@ func (trc *tcpResolverConn) handler(workerCtx context.Context) error {
 
 			// If we are ready to recycle and we have no in-flight queries, we can
 			// shutdown the connection and create a new one for the next query.
-			if readyToRecycle {
+			if readyToRecycle || trc.abandoned.IsSet() {
 				if len(trc.inFlightQueries) == 0 {
 					log.Debugf("resolver: recycling connection to %s", trc.resolverInfo.DescriptiveName())
 					return nil

resolver/resolver.go

@@ -212,6 +212,7 @@ type ResolverConn interface { //nolint:golint // TODO
 	ReportFailure()
 	IsFailing() bool
 	ResetFailure()
+	ForceReconnect(ctx context.Context)
 }
 
 // BasicResolverConn implements ResolverConn for standard dns clients.

resolver/resolvers.go

@@ -570,3 +570,18 @@ func IsResolverAddress(ip net.IP, port uint16) bool {
 
 	return false
 }
+
+// ForceResolverReconnect forces all resolvers to reconnect.
+func ForceResolverReconnect(ctx context.Context) {
+	resolversLock.RLock()
+	defer resolversLock.RUnlock()
+
+	ctx, tracer := log.AddTracer(ctx)
+	defer tracer.Submit()
+
+	tracer.Trace("resolver: forcing all active resolvers to reconnect")
+	for _, r := range globalResolvers {
+		r.Conn.ForceReconnect(ctx)
+	}
+	tracer.Info("resolver: all active resolvers were forced to reconnect")
+}