home: add IPv6 support for encrypted listeners

Preserve the configured address family of the web bind address:  an
explicitly configured unspecified IPv4 address now produces an IPv4-only
listener, while the unspecified IPv6 address enables dual-stack
listening.

Close the packet connection owned by the HTTP/3 serving helper when the
server is shut down, since http3.Server.Serve does not close connections
provided by the caller, and an unclosed connection would make rebinding
the same address fail with EADDRINUSE on a TLS reconfiguration.

Author: waffen29

internal/home/config.go

@@ -465,7 +465,7 @@ var config = &configuration{
 	AuthAttempts: 5,
 	AuthBlockMin: 15,
 	HTTPConfig: httpConfig{
-		Address:    netip.AddrPortFrom(netip.IPv4Unspecified(), 3000),
+		Address:    netip.AddrPortFrom(netip.IPv6Unspecified(), 3000),
 		SessionTTL: timeutil.Duration(30 * timeutil.Day),
 		Pprof: &httpPprofConfig{
 			Enabled: false,

internal/home/config_internal_test.go

@@ -1,10 +1,13 @@
 package home
 
 import (
+	"net/netip"
 	"os"
 	"path/filepath"
 	"testing"
 
+	"github.com/AdguardTeam/AdGuardHome/internal/aghtest"
+	"github.com/AdguardTeam/golibs/netutil"
 	"github.com/AdguardTeam/golibs/testutil"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -89,3 +92,73 @@ func TestConfigFilePath(t *testing.T) {
 		})
 	}
 }
+
+func TestNewServerConfig_DefaultHosts(t *testing.T) {
+	dnsConf := &dnsConfig{
+		BindHosts: nil,
+		Port:      53,
+		PendingRequests: &pendingRequests{
+			Enabled: false,
+		},
+	}
+	tlsConf := &tlsConfigSettings{}
+	dohConf := &doHConfig{}
+
+	conf, err := newServerConfig(
+		dnsConf,
+		&clientSourcesConfig{},
+		tlsConf,
+		dohConf,
+		&tlsManager{},
+		&aghtest.Registrar{},
+		nil, // clientsContainer
+		&aghtest.ConfigModifier{},
+	)
+	require.NoError(t, err)
+	require.Len(t, conf.UDPListenAddrs, 2)
+
+	assert.Equal(t, netutil.IPv4Localhost().String(), conf.UDPListenAddrs[0].IP.String())
+	assert.Equal(t, netutil.IPv6Localhost().String(), conf.UDPListenAddrs[1].IP.String())
+}
+
+func TestNewServerConfig_Issue8363BindHosts(t *testing.T) {
+	bindHosts := []netip.Addr{
+		netip.IPv4Unspecified(),
+		netip.IPv6Unspecified(),
+		netutil.IPv4Localhost(),
+		netutil.IPv6Localhost(),
+	}
+	dnsConf := &dnsConfig{
+		BindHosts: bindHosts,
+		Port:      53,
+		PendingRequests: &pendingRequests{
+			Enabled: false,
+		},
+	}
+	tlsConf := &tlsConfigSettings{
+		Enabled:              true,
+		PortDNSOverTLS:       853,
+		PortDNSOverQUIC:      853,
+		CertificateChainData: requireReadFile(t, testCertificatePath),
+		PrivateKeyData:       requireReadFile(t, testPrivateKeyPath),
+	}
+
+	conf, err := newServerConfig(
+		dnsConf,
+		&clientSourcesConfig{},
+		tlsConf,
+		&doHConfig{},
+		&tlsManager{},
+		&aghtest.Registrar{},
+		nil, // clientsContainer
+		&aghtest.ConfigModifier{},
+	)
+	require.NoError(t, err)
+	require.Len(t, conf.TLSConf.TLSListenAddrs, len(bindHosts))
+	require.Len(t, conf.TLSConf.QUICListenAddrs, len(bindHosts))
+
+	for i, host := range bindHosts {
+		assert.Equal(t, host.String(), conf.TLSConf.TLSListenAddrs[i].IP.String())
+		assert.Equal(t, host.String(), conf.TLSConf.QUICListenAddrs[i].IP.String())
+	}
+}

internal/home/control.go

@@ -71,7 +71,7 @@ func appendDNSAddrsWithIfaces(dst []string, src []netip.Addr) (res []string, err
 // tlsMgr must not be nil.
 func collectDNSAddresses(tlsMgr *tlsManager) (addrs []string, err error) {
 	if hosts := config.DNS.BindHosts; len(hosts) == 0 {
-		addrs = appendDNSAddrs(addrs, netutil.IPv4Localhost())
+		addrs = appendDNSAddrs(addrs, netutil.IPv4Localhost(), netutil.IPv6Localhost())
 	} else {
 		addrs, err = appendDNSAddrsWithIfaces(addrs, hosts)
 		if err != nil {

internal/home/dns.go

@@ -264,7 +264,10 @@ func newServerConfig(
 	clientsContainer dnsforward.ClientsContainer,
 	confModifier agh.ConfigModifier,
 ) (newConf *dnsforward.ServerConfig, err error) {
-	hosts := aghalg.CoalesceSlice(dnsConf.BindHosts, []netip.Addr{netutil.IPv4Localhost()})
+	hosts := aghalg.CoalesceSlice(dnsConf.BindHosts, []netip.Addr{
+		netutil.IPv4Localhost(),
+		netutil.IPv6Localhost(),
+	})
 
 	fwdConf := dnsConf.Config
 	fwdConf.ClientsContainer = clientsContainer

internal/home/web.go

@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"io/fs"
 	"log/slog"
+	"net"
 	"net/http"
 	"net/netip"
 	"runtime"
@@ -345,6 +346,24 @@ func (web *webAPI) tlsConfigChanged(ctx context.Context, tlsConf *tlsConfigSetti
 // loggerKeyServer is the key used by [webAPI] to identify servers.
 const loggerKeyServer = "server"
 
+// getBindAddr returns the network and address strings to use when creating a
+// listener on addr and port.  network must be either "tcp" or "udp".  The
+// address family of addr is preserved:  for the unspecified IPv4 address the
+// IPv4-only network is returned, since Go's wildcard listeners otherwise
+// accept connections of both address families on platforms that support
+// IPv4-mapped IPv6 addresses.  For the unspecified IPv6 address the returned
+// address is in the ":port" form, which enables dual-stack listening.
+func getBindAddr(network string, addr netip.Addr, port uint16) (listenNetwork, addrStr string) {
+	switch {
+	case !addr.IsUnspecified():
+		return network, netip.AddrPortFrom(addr, port).String()
+	case addr.Is4():
+		return network + "4", netip.AddrPortFrom(addr, port).String()
+	default:
+		return network, netutil.JoinHostPort("", port)
+	}
+}
+
 // start starts serving HTTP requests.
 func (web *webAPI) start(ctx context.Context) {
 	defer slogutil.RecoverAndExit(ctx, web.logger, osutil.ExitCodeFailure)
@@ -367,9 +386,11 @@ func (web *webAPI) start(ctx context.Context) {
 		protocols.SetUnencryptedHTTP2(true)
 		protocols.SetHTTP1(true)
 
+		network, addrStr := getBindAddr("tcp", web.conf.BindAddr.Addr(), web.conf.BindAddr.Port())
+
 		// Create a new instance, because the Web is not usable after Shutdown.
 		web.httpServer = &http.Server{
-			Addr:              web.conf.BindAddr.String(),
+			Addr:              addrStr,
 			Handler:           hdlr,
 			ReadTimeout:       web.conf.ReadTimeout,
 			ReadHeaderTimeout: web.conf.ReadHeaderTimeout,
@@ -380,9 +401,16 @@ func (web *webAPI) start(ctx context.Context) {
 		go func() {
 			defer slogutil.RecoverAndLog(ctx, logger)
 
-			logger.InfoContext(ctx, "starting plain server", "addr", web.httpServer.Addr)
+			logger.InfoContext(ctx, "starting plain server", "addr", addrStr)
+
+			ln, lErr := net.Listen(network, addrStr)
+			if lErr != nil {
+				errs <- lErr
+
+				return
+			}
 
-			errs <- web.httpServer.ListenAndServe()
+			errs <- web.httpServer.Serve(ln)
 		}()
 
 		err := <-errs
@@ -463,13 +491,13 @@ func (web *webAPI) serveTLS(ctx context.Context) (next bool) {
 		portHTTPS = config.TLS.PortHTTPS
 	}()
 
-	addr := netip.AddrPortFrom(web.conf.BindAddr.Addr(), portHTTPS).String()
+	network, addrStr := getBindAddr("tcp", web.conf.BindAddr.Addr(), portHTTPS)
 	logger := web.baseLogger.With(loggerKeyServer, "https")
 
 	hdlr := web.wrapMux(logger)
 
 	web.httpsServer.server = &http.Server{
-		Addr:    addr,
+		Addr:    addrStr,
 		Handler: hdlr,
 		// TODO(m.kazantsev):  Do not create TLS config manually, but use
 		// [aghtls.TLSConfigProvider].
@@ -488,11 +516,15 @@ func (web *webAPI) serveTLS(ctx context.Context) (next bool) {
 	printHTTPAddresses(ctx, web.logger, urlutil.SchemeHTTPS, web.tlsManager)
 
 	if web.conf.serveHTTP3 {
-		go web.mustStartHTTP3(ctx, addr)
+		go web.mustStartHTTP3(ctx, portHTTPS)
 	}
 
 	logger.InfoContext(ctx, "starting https server")
-	err := web.httpsServer.server.ListenAndServeTLS("", "")
+	ln, err := net.Listen(network, addrStr)
+	if err == nil {
+		err = web.httpsServer.server.ServeTLS(ln, "", "")
+	}
+
 	if !errors.Is(err, http.ErrServerClosed) {
 		cleanupAlways(ctx, logger, web.pidFilePath)
 
@@ -502,17 +534,20 @@ func (web *webAPI) serveTLS(ctx context.Context) (next bool) {
 	return true
 }
 
-// mustStartHTTP3 initializes and starts HTTP3 server.
-func (web *webAPI) mustStartHTTP3(ctx context.Context, address string) {
+// mustStartHTTP3 initializes and starts HTTP3 server on the configured bind
+// address with the given port.
+func (web *webAPI) mustStartHTTP3(ctx context.Context, port uint16) {
 	defer slogutil.RecoverAndExit(ctx, web.logger, osutil.ExitCodeFailure)
 
 	logger := web.baseLogger.With(loggerKeyServer, "http3")
 	hdlr := web.wrapMux(logger)
 
+	network, addrStr := getBindAddr("udp", web.conf.BindAddr.Addr(), port)
+
 	web.httpsServer.server3 = &http3.Server{
 		// TODO(a.garipov): See if there is a way to use the error log as
 		// well as timeouts here.
-		Addr: address,
+		Addr: addrStr,
 		// TODO(m.kazantsev):  Do not create TLS config manually, but use
 		// [aghtls.TLSConfigProvider].
 		TLSConfig: &tls.Config{
@@ -525,18 +560,38 @@ func (web *webAPI) mustStartHTTP3(ctx context.Context, address string) {
 	}
 
 	web.logger.DebugContext(ctx, "starting http/3 server")
-	err := web.httpsServer.server3.ListenAndServe()
+	err := serveHTTP3(ctx, logger, web.httpsServer.server3, network, addrStr)
 	if !errors.Is(err, http.ErrServerClosed) {
 		cleanupAlways(ctx, logger, web.pidFilePath)
 
 		panic(fmt.Errorf("http3: %w", err))
 	}
 }
 
-// startPprof launches the debug and profiling server on the provided port.
-func startPprof(baseLogger *slog.Logger, port uint16) {
-	addr := netip.AddrPortFrom(netutil.IPv4Localhost(), port)
+// serveHTTP3 listens for UDP packets on the given network and address, and
+// serves HTTP/3 requests on srv until it is closed.  The created packet
+// connection is closed before returning, since [http3.Server.Serve] does not
+// close connections provided by the caller.  logger and srv must not be nil.
+func serveHTTP3(
+	ctx context.Context,
+	logger *slog.Logger,
+	srv *http3.Server,
+	network string,
+	addrStr string,
+) (err error) {
+	conn, err := net.ListenPacket(network, addrStr)
+	if err != nil {
+		// Don't wrap the error because it's informative enough as is.
+		return err
+	}
+	defer slogutil.CloseAndLog(ctx, logger, conn, slog.LevelDebug)
 
+	return srv.Serve(conn)
+}
+
+// startPprof launches the debug and profiling server on the provided port on
+// both IPv4 and IPv6 loopback addresses.
+func startPprof(baseLogger *slog.Logger, port uint16) {
 	runtime.SetBlockProfileRate(1)
 	runtime.SetMutexProfileFraction(1)
 
@@ -546,15 +601,26 @@ func startPprof(baseLogger *slog.Logger, port uint16) {
 	ctx := context.Background()
 	logger := baseLogger.With(slogutil.KeyPrefix, "pprof")
 
-	go func() {
-		defer slogutil.RecoverAndLog(ctx, logger)
+	go servePprof(ctx, logger, mux, netutil.IPv4Localhost(), port)
+	go servePprof(ctx, logger, mux, netutil.IPv6Localhost(), port)
+}
 
-		logger.InfoContext(ctx, "listening", "addr", addr)
-		err := http.ListenAndServe(addr.String(), mux)
-		if !errors.Is(err, http.ErrServerClosed) {
-			logger.ErrorContext(ctx, "shutting down", slogutil.KeyError, err)
-		}
-	}()
+// servePprof serves the pprof HTTP endpoints on the given host and port.
+func servePprof(
+	ctx context.Context,
+	logger *slog.Logger,
+	mux *http.ServeMux,
+	host netip.Addr,
+	port uint16,
+) {
+	defer slogutil.RecoverAndLog(ctx, logger)
+
+	addrStr := netip.AddrPortFrom(host, port).String()
+	logger.InfoContext(ctx, "listening", "addr", addrStr)
+	err := http.ListenAndServe(addrStr, mux)
+	if !errors.Is(err, http.ErrServerClosed) {
+		logger.ErrorContext(ctx, "shutting down", slogutil.KeyError, err)
+	}
 }
 
 // handleTLSStatus is the handler for the GET /control/tls/status HTTP API.