home: add IPv6 support for encrypted listeners

Author: waffen29

internal/home/config.go

@@ -465,7 +465,7 @@ var config = &configuration{
 	AuthAttempts: 5,
 	AuthBlockMin: 15,
 	HTTPConfig: httpConfig{
-		Address:    netip.AddrPortFrom(netip.IPv4Unspecified(), 3000),
+		Address:    netip.AddrPortFrom(netip.IPv6Unspecified(), 3000),
 		SessionTTL: timeutil.Duration(30 * timeutil.Day),
 		Pprof: &httpPprofConfig{
 			Enabled: false,
@@ -482,7 +482,7 @@ var config = &configuration{
 		},
 	},
 	DNS: dnsConfig{
-		BindHosts: []netip.Addr{netip.IPv4Unspecified()},
+		BindHosts: []netip.Addr{netip.IPv4Unspecified(), netip.IPv6Unspecified()},
 		Port:      defaultPortDNS,
 		Config: dnsforward.Config{
 			Ratelimit:              20,

internal/home/config_internal_test.go

@@ -1,10 +1,13 @@
 package home
 
 import (
+	"net/netip"
 	"os"
 	"path/filepath"
 	"testing"
 
+	"github.com/AdguardTeam/AdGuardHome/internal/aghtest"
+	"github.com/AdguardTeam/golibs/netutil"
 	"github.com/AdguardTeam/golibs/testutil"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -89,3 +92,73 @@ func TestConfigFilePath(t *testing.T) {
 		})
 	}
 }
+
+func TestNewServerConfig_DefaultHosts(t *testing.T) {
+	dnsConf := &dnsConfig{
+		BindHosts: nil,
+		Port:      53,
+		PendingRequests: &pendingRequests{
+			Enabled: false,
+		},
+	}
+	tlsConf := &tlsConfigSettings{}
+	dohConf := &doHConfig{}
+
+	conf, err := newServerConfig(
+		dnsConf,
+		&clientSourcesConfig{},
+		tlsConf,
+		dohConf,
+		&tlsManager{},
+		&aghtest.Registrar{},
+		nil, // clientsContainer
+		&aghtest.ConfigModifier{},
+	)
+	require.NoError(t, err)
+	require.Len(t, conf.UDPListenAddrs, 2)
+
+	assert.Equal(t, netutil.IPv4Localhost().String(), conf.UDPListenAddrs[0].IP.String())
+	assert.Equal(t, netutil.IPv6Localhost().String(), conf.UDPListenAddrs[1].IP.String())
+}
+
+func TestNewServerConfig_Issue8363BindHosts(t *testing.T) {
+	bindHosts := []netip.Addr{
+		netip.IPv4Unspecified(),
+		netip.IPv6Unspecified(),
+		netutil.IPv4Localhost(),
+		netutil.IPv6Localhost(),
+	}
+	dnsConf := &dnsConfig{
+		BindHosts: bindHosts,
+		Port:      53,
+		PendingRequests: &pendingRequests{
+			Enabled: false,
+		},
+	}
+	tlsConf := &tlsConfigSettings{
+		Enabled:              true,
+		PortDNSOverTLS:       853,
+		PortDNSOverQUIC:      853,
+		CertificateChainData: requireReadFile(t, testCertificatePath),
+		PrivateKeyData:       requireReadFile(t, testPrivateKeyPath),
+	}
+
+	conf, err := newServerConfig(
+		dnsConf,
+		&clientSourcesConfig{},
+		tlsConf,
+		&doHConfig{},
+		&tlsManager{},
+		&aghtest.Registrar{},
+		nil, // clientsContainer
+		&aghtest.ConfigModifier{},
+	)
+	require.NoError(t, err)
+	require.Len(t, conf.TLSConf.TLSListenAddrs, len(bindHosts))
+	require.Len(t, conf.TLSConf.QUICListenAddrs, len(bindHosts))
+
+	for i, host := range bindHosts {
+		assert.Equal(t, host.String(), conf.TLSConf.TLSListenAddrs[i].IP.String())
+		assert.Equal(t, host.String(), conf.TLSConf.QUICListenAddrs[i].IP.String())
+	}
+}

internal/home/control.go

@@ -71,7 +71,7 @@ func appendDNSAddrsWithIfaces(dst []string, src []netip.Addr) (res []string, err
 // tlsMgr must not be nil.
 func collectDNSAddresses(tlsMgr *tlsManager) (addrs []string, err error) {
 	if hosts := config.DNS.BindHosts; len(hosts) == 0 {
-		addrs = appendDNSAddrs(addrs, netutil.IPv4Localhost())
+		addrs = appendDNSAddrs(addrs, netutil.IPv4Localhost(), netutil.IPv6Localhost())
 	} else {
 		addrs, err = appendDNSAddrsWithIfaces(addrs, hosts)
 		if err != nil {

internal/home/dns.go

@@ -270,7 +270,10 @@ func newServerConfig(
 	clientsContainer dnsforward.ClientsContainer,
 	confModifier agh.ConfigModifier,
 ) (newConf *dnsforward.ServerConfig, err error) {
-	hosts := aghalg.CoalesceSlice(dnsConf.BindHosts, []netip.Addr{netutil.IPv4Localhost()})
+	hosts := aghalg.CoalesceSlice(dnsConf.BindHosts, []netip.Addr{
+		netutil.IPv4Localhost(),
+		netutil.IPv6Localhost(),
+	})
 
 	fwdConf := dnsConf.Config
 	fwdConf.ClientsContainer = clientsContainer

internal/home/web.go

@@ -339,6 +339,17 @@ func (web *webAPI) tlsConfigChanged(ctx context.Context, tlsConf *tlsConfigSetti
 // loggerKeyServer is the key used by [webAPI] to identify servers.
 const loggerKeyServer = "server"
 
+// getBindAddr returns the address string for the server to listen on.  If the
+// address is unspecified, it returns the ":port" format to enable dual-stack
+// listening.
+func (web *webAPI) getBindAddr(addr netip.Addr, port uint16) (addrStr string) {
+	if addr.IsUnspecified() {
+		return netutil.JoinHostPort("", port)
+	}
+
+	return netip.AddrPortFrom(addr, port).String()
+}
+
 // start starts serving HTTP requests.
 func (web *webAPI) start(ctx context.Context) {
 	defer slogutil.RecoverAndExit(ctx, web.logger, osutil.ExitCodeFailure)
@@ -363,7 +374,7 @@ func (web *webAPI) start(ctx context.Context) {
 
 		// Create a new instance, because the Web is not usable after Shutdown.
 		web.httpServer = &http.Server{
-			Addr:              web.conf.BindAddr.String(),
+			Addr:              web.getBindAddr(web.conf.BindAddr.Addr(), web.conf.BindAddr.Port()),
 			Handler:           hdlr,
 			ReadTimeout:       web.conf.ReadTimeout,
 			ReadHeaderTimeout: web.conf.ReadHeaderTimeout,
@@ -457,13 +468,13 @@ func (web *webAPI) serveTLS(ctx context.Context) (next bool) {
 		portHTTPS = config.TLS.PortHTTPS
 	}()
 
-	addr := netip.AddrPortFrom(web.conf.BindAddr.Addr(), portHTTPS).String()
+	addrStr := web.getBindAddr(web.conf.BindAddr.Addr(), portHTTPS)
 	logger := web.baseLogger.With(loggerKeyServer, "https")
 
 	hdlr := web.wrapMux(logger)
 
 	web.httpsServer.server = &http.Server{
-		Addr:    addr,
+		Addr:    addrStr,
 		Handler: hdlr,
 		TLSConfig: &tls.Config{
 			Certificates: []tls.Certificate{web.httpsServer.certificate()},
@@ -480,7 +491,7 @@ func (web *webAPI) serveTLS(ctx context.Context) (next bool) {
 	printHTTPAddresses(ctx, web.logger, urlutil.SchemeHTTPS, web.tlsManager)
 
 	if web.conf.serveHTTP3 {
-		go web.mustStartHTTP3(ctx, addr)
+		go web.mustStartHTTP3(ctx, addrStr)
 	}
 
 	logger.InfoContext(ctx, "starting https server")
@@ -523,10 +534,9 @@ func (web *webAPI) mustStartHTTP3(ctx context.Context, address string) {
 	}
 }
 
-// startPprof launches the debug and profiling server on the provided port.
+// startPprof launches the debug and profiling server on the provided port on
+// both IPv4 and IPv6 loopback addresses.
 func startPprof(baseLogger *slog.Logger, port uint16) {
-	addr := netip.AddrPortFrom(netutil.IPv4Localhost(), port)
-
 	runtime.SetBlockProfileRate(1)
 	runtime.SetMutexProfileFraction(1)
 
@@ -536,15 +546,26 @@ func startPprof(baseLogger *slog.Logger, port uint16) {
 	ctx := context.Background()
 	logger := baseLogger.With(slogutil.KeyPrefix, "pprof")
 
-	go func() {
-		defer slogutil.RecoverAndLog(ctx, logger)
+	go servePprof(ctx, logger, mux, netutil.IPv4Localhost(), port)
+	go servePprof(ctx, logger, mux, netutil.IPv6Localhost(), port)
+}
 
-		logger.InfoContext(ctx, "listening", "addr", addr)
-		err := http.ListenAndServe(addr.String(), mux)
-		if !errors.Is(err, http.ErrServerClosed) {
-			logger.ErrorContext(ctx, "shutting down", slogutil.KeyError, err)
-		}
-	}()
+// servePprof serves the pprof HTTP endpoints on the given host and port.
+func servePprof(
+	ctx context.Context,
+	logger *slog.Logger,
+	mux *http.ServeMux,
+	host netip.Addr,
+	port uint16,
+) {
+	defer slogutil.RecoverAndLog(ctx, logger)
+
+	addrStr := netip.AddrPortFrom(host, port).String()
+	logger.InfoContext(ctx, "listening", "addr", addrStr)
+	err := http.ListenAndServe(addrStr, mux)
+	if !errors.Is(err, http.ErrServerClosed) {
+		logger.ErrorContext(ctx, "shutting down", slogutil.KeyError, err)
+	}
 }
 
 // registerTLSHandlers registers HTTP handlers for TLS configuration.

internal/home/web_internal_test.go

@@ -26,6 +26,37 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
+func TestWebAPI_getBindAddr(t *testing.T) {
+	web := &webAPI{}
+	testCases := []struct {
+		name string
+		addr netip.Addr
+		want string
+	}{{
+		name: "ipv4_unspecified",
+		addr: netip.IPv4Unspecified(),
+		want: ":443",
+	}, {
+		name: "ipv6_unspecified",
+		addr: netip.IPv6Unspecified(),
+		want: ":443",
+	}, {
+		name: "ipv4",
+		addr: netutil.IPv4Localhost(),
+		want: "127.0.0.1:443",
+	}, {
+		name: "ipv6",
+		addr: netutil.IPv6Localhost(),
+		want: "[::1]:443",
+	}}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			assert.Equal(t, tc.want, web.getBindAddr(tc.addr, 443))
+		})
+	}
+}
+
 func TestWebAPI_HandleTLSConfigure(t *testing.T) {
 	// Store the global state before making any changes.
 	storeGlobals(t)