dnssd.c: Enable service registration on loopback only #346

zdohnal · 2024-02-29T09:36:57Z

In case users would like to prevent sharing services from printer
applications to local network, restrict it to localhost and let CUPS
do the sharing.

This can be done by setting listen-hostname in PAPPL API - this prevents accessing the public addresses, but the service is still published on those public addresses. This can be prevented if the machine hostname is changed to localhost, but that's not desired on machines IIUC.

The PR does the following:

introduced new pappl system member reghost, which is used for saving listen-hostname,
new public accessors for that member, papplSystemSetRegHostName() and papplSystemGetRegHostName() - user can set the member to localhost or to the current hostname
dnssd functions will check this member, and if it is localhost, it will use loopback index
in case of Avahi it passes NULL as hostname to let Avahi decide what hostname to use (in case of hostname conflicts - and Avahi forbids using localhost if it is not FQDN)

The result is that if reghost is set to localhost, the service is published on .local address, but resolved to loopback because CUPS uses DNS-SD names in URIs.

PAPPL 2.x version requires CUPS PR OpenPrinting/cups#902 to have it working.

michaelrsweet

I'm not comfortable separating the "registration hostname" from the "listen hostname".

I support changing things to correctly advertise for the loopback interface but not for separating the hostname configurations.

zdohnal · 2024-03-06T06:51:23Z

@michaelrsweet

I'm not comfortable separating the "registration hostname" from the "listen hostname".

Hmm... I meant registration hostname to be exactly the listen hostname - and we have to save the 'listen hostname' somewhere to have a way how to decide which net interface to use for advertising, because papplSystemAddListeners() saves only ports and socket fds, and system->hostname serves different purpose (setting machine's hostname).

With your feedback, I guess you mean I can save the listen hostname into system struct in papplSystemAddListeners() instead of having public functions for setting them - if there is no public functions to access them, it prevents possible separation.

I support changing things to correctly advertise for the loopback interface but not for separating the hostname configurations.

It currently requires changing machine's hostname to change the scope where the service will be advertised (which is IMHO undesired) - IMO we have to separate server hostname and listen hostname configurations (if you meant them) and have a way where to save listen hostname, or remove the server hostname functionality to change machine's hostname (keep the hostname only internally and do not change /etc/hostname).

WDYT?

zdohnal · 2024-03-06T08:14:37Z

I've removed public accessors and renamed reghost to listen_hostname - it is set only when papplSystemAddListeners() is called.

I set the PR to [WIP], until it is clear how I should change it.

zdohnal · 2024-03-06T08:18:11Z

@michaelrsweet ad saving listen-hostname - Or did you mean to save listen-hostname into system->hostname in papplSystemAddListeners()? That's another way how I imagine to keep the hostnames in sync, but I'm not sure if it is a right call (yeah, if I assign the pointer directly without calling accessor papplSystemSetHostName(), the machine's hostname is not changed, so it could work, but I'm not sure if it is correct thing to do there).

zdohnal · 2024-03-13T15:47:27Z

Ignore the review request for now, I rewrite it to use system->hostname. Once it is ready, I remove the [WIP].

zdohnal · 2024-03-14T08:17:31Z

Ready for review.

In case users would like to prevent sharing services from printer applications to local network, restrict it to localhost and let CUPS do the sharing. This can be done by setting system hostname in PAPPL API - this prevents accessing the public addresses, but the service is still published on those public addresses. The PR does the following: - set/reset system hostname in `papplSystemAddListeners()` directly, not via API. It prevents changing machine' hostname. - dnssd function will check the hostname and if it is localhost or matching IP address, it will use loopback index, - in case of Avahi it passes NULL as hostname to let Avahi decide what hostname to use (in case of hostname conflicts - and Avahi forbids using localhost if it is not FQDN). The result is that if system hostname is set to localhost internally, the service is published on .local address, but resolved to loopback because CUPS uses DNS-SD names in URIs. PAPPL 2.x version requires CUPS PR OpenPrinting/cups#902 to have it working.

zdohnal · 2024-07-17T07:39:18Z

@michaelrsweet ping

michaelrsweet

Needs work.

michaelrsweet · 2024-07-17T22:53:28Z

pappl/dnssd.c

@@ -51,12 +51,12 @@ _papplPrinterRegisterDNSSDNoLock(
  const char		*papermax;	// PaperMax string value (legacy)


-  if (!printer->dns_sd_name || !printer->system->is_running || (printer->system->options & PAPPL_SOPTIONS_NO_DNS_SD))
+  if (!printer->dns_sd_name || !printer->system->is_running || (printer->system->options & PAPPL_SOPTIONS_NO_DNS_SD) || !system->hostname)


system->hostname cannot be NULL.

michaelrsweet · 2024-07-18T01:30:04Z

pappl/dnssd.c

+//
+
+bool
+_papplDNSSDIsLoopback(const char *name)


I'm still not clear why we need a function for this...

michaelrsweet · 2024-07-18T01:31:00Z

pappl/system-accessors.c

@@ -141,6 +141,13 @@ papplSystemAddListeners(
      if (ret)
        system->port = port;
    }
+


This isn't where I'd save the hostname... You can have multiple listeners.

michaelrsweet · 2024-07-18T01:31:47Z

pappl/dnssd.c

    return (false);

  papplLogPrinter(printer, PAPPL_LOGLEVEL_DEBUG, "Registering DNS-SD name '%s' on '%s'", printer->dns_sd_name, printer->system->hostname);

-  if_index = !strcmp(system->hostname, "localhost") ? CUPS_DNSSD_IF_INDEX_LOCAL : CUPS_DNSSD_IF_INDEX_ANY;
+  if_index = _papplDNSSDIsLoopback(system->hostname) ? CUPS_DNSSD_IF_INDEX_LOCAL : CUPS_DNSSD_IF_INDEX_ANY;


I'm thinking we should examine the listeners or keep a boolean to track whether we are listening on an externally accessible address.

michaelrsweet · 2024-07-18T01:32:21Z

pappl/system.c

@@ -677,7 +677,7 @@ papplSystemRun(pappl_system_t *system)	// I - System
      bool		force_dns_sd = system->dns_sd_host_changes != dns_sd_host_changes;
 					// Force re-registration?

-      if (force_dns_sd)
+      if (!_papplDNSSDIsLoopback(system->hostname) && force_dns_sd)


It isn't about being on the loopback interface since we still need to advertise on localhost.

zdohnal force-pushed the mdns-registration-avahi-master branch 4 times, most recently from 47f6e5d to ab81728 Compare March 1, 2024 09:46

michaelrsweet requested changes Mar 1, 2024

View reviewed changes

michaelrsweet self-assigned this Mar 1, 2024

michaelrsweet added bug Something isn't working priority-medium platform issue Issue is specific to an OS or desktop labels Mar 1, 2024

michaelrsweet added this to the v2.0 milestone Mar 1, 2024

zdohnal changed the title ~~dnssd.c: Enable service registration on loopback only~~ [WIP] dnssd.c: Enable service registration on loopback only Mar 6, 2024

zdohnal force-pushed the mdns-registration-avahi-master branch from 8e03879 to ccaa1de Compare March 6, 2024 08:09

zdohnal force-pushed the mdns-registration-avahi-master branch from e86401c to 78c654e Compare March 6, 2024 08:40

zdohnal requested a review from michaelrsweet March 13, 2024 14:35

zdohnal force-pushed the mdns-registration-avahi-master branch 3 times, most recently from a2224e9 to f39ba2c Compare March 14, 2024 08:15

zdohnal changed the title ~~[WIP] dnssd.c: Enable service registration on loopback only~~ dnssd.c: Enable service registration on loopback only Mar 14, 2024

zdohnal force-pushed the mdns-registration-avahi-master branch from a58282b to b1d529e Compare March 15, 2024 08:56

michaelrsweet requested changes Jul 18, 2024

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

dnssd.c: Enable service registration on loopback only #346

dnssd.c: Enable service registration on loopback only #346

zdohnal commented Feb 29, 2024

michaelrsweet left a comment

zdohnal commented Mar 6, 2024 •

edited

Loading

zdohnal commented Mar 6, 2024

zdohnal commented Mar 6, 2024

zdohnal commented Mar 13, 2024

zdohnal commented Mar 14, 2024

zdohnal commented Jul 17, 2024

michaelrsweet left a comment

michaelrsweet Jul 17, 2024

michaelrsweet Jul 18, 2024

michaelrsweet Jul 18, 2024

michaelrsweet Jul 18, 2024

michaelrsweet Jul 18, 2024

dnssd.c: Enable service registration on loopback only #346

Are you sure you want to change the base?

dnssd.c: Enable service registration on loopback only #346

Conversation

zdohnal commented Feb 29, 2024

michaelrsweet left a comment

Choose a reason for hiding this comment

zdohnal commented Mar 6, 2024 • edited Loading

zdohnal commented Mar 6, 2024

zdohnal commented Mar 6, 2024

zdohnal commented Mar 13, 2024

zdohnal commented Mar 14, 2024

zdohnal commented Jul 17, 2024

michaelrsweet left a comment

Choose a reason for hiding this comment

michaelrsweet Jul 17, 2024

Choose a reason for hiding this comment

michaelrsweet Jul 18, 2024

Choose a reason for hiding this comment

michaelrsweet Jul 18, 2024

Choose a reason for hiding this comment

michaelrsweet Jul 18, 2024

Choose a reason for hiding this comment

michaelrsweet Jul 18, 2024

Choose a reason for hiding this comment

zdohnal commented Mar 6, 2024 •

edited

Loading