dnsserv.c 14.2 KB
Newer Older
1
/* Copyright (c) 2007-2017, The Tor Project, Inc. */
2
3
4
/* See LICENSE for licensing information */

/**
5
 * \file dnsserv.c
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
 * \brief Implements client-side DNS proxy server code.
 *
 * When a user enables the DNSPort configuration option to have their local
 * Tor client handle DNS requests, this module handles it.  It functions as a
 * "DNS Server" on the client side, which client applications use.
 *
 * Inbound DNS requests are represented as entry_connection_t here (since
 * that's how Tor represents client-side streams), which are kept associated
 * with an evdns_server_request structure as exposed by Libevent's
 * evdns code.
 *
 * Upon receiving a DNS request, libevent calls our evdns_server_callback()
 * function here, which causes this module to create an entry_connection_t
 * request as appropriate.  Later, when that request is answered,
 * connection_edge.c calls dnsserv_resolved() so we can finish up and tell the
 * DNS client.
22
23
24
 **/

#include "or.h"
25
#include "dnsserv.h"
Sebastian Hahn's avatar
Sebastian Hahn committed
26
#include "config.h"
Sebastian Hahn's avatar
Sebastian Hahn committed
27
#include "connection.h"
Sebastian Hahn's avatar
Sebastian Hahn committed
28
#include "connection_edge.h"
Sebastian Hahn's avatar
Sebastian Hahn committed
29
#include "control.h"
Sebastian Hahn's avatar
Sebastian Hahn committed
30
#include "main.h"
Sebastian Hahn's avatar
Sebastian Hahn committed
31
#include "policies.h"
32
33
#include <event2/dns.h>
#include <event2/dns_compat.h>
34
/* XXXX this implies we want an improved evdns  */
35
#include <event2/dns_struct.h>
36

37
/** Helper function: called by evdns whenever the client sends a request to our
38
39
 * DNSPort.  We need to eventually answer the request <b>req</b>.
 */
40
static void
41
evdns_server_callback(struct evdns_server_request *req, void *data_)
42
{
43
  const listener_connection_t *listener = data_;
44
  entry_connection_t *entry_conn;
45
46
  edge_connection_t *conn;
  int i = 0;
47
  struct evdns_server_question *q = NULL, *supported_q = NULL;
48
49
50
  struct sockaddr_storage addr;
  struct sockaddr *sa;
  int addrlen;
51
52
  tor_addr_t tor_addr;
  uint16_t port;
53
  int err = DNS_ERR_NONE;
54
  char *q_name;
55
56

  tor_assert(req);
57

58
59
  log_info(LD_APP, "Got a new DNS request!");

60
61
  req->flags |= 0x80; /* set RA */

62
  /* First, check whether the requesting address matches our SOCKSPolicy. */
63
  if ((addrlen = evdns_server_request_get_requesting_addr(req,
64
                      (struct sockaddr*)&addr, (socklen_t)sizeof(addr))) < 0) {
65
66
67
68
    log_warn(LD_APP, "Couldn't get requesting address.");
    evdns_server_request_respond(req, DNS_ERR_SERVERFAILED);
    return;
  }
69
  (void) addrlen;
70
  sa = (struct sockaddr*) &addr;
71
  if (tor_addr_from_sockaddr(&tor_addr, sa, &port)<0) {
72
    log_warn(LD_APP, "Requesting address wasn't recognized.");
73
74
75
    evdns_server_request_respond(req, DNS_ERR_SERVERFAILED);
    return;
  }
76

77
  if (!socks_policy_permits_address(&tor_addr)) {
78
79
80
81
    log_warn(LD_APP, "Rejecting DNS request from disallowed IP.");
    evdns_server_request_respond(req, DNS_ERR_REFUSED);
    return;
  }
82
83
84
85
86

  /* Now, let's find the first actual question of a type we can answer in this
   * DNS request.  It makes us a little noncompliant to act like this; we
   * should fix that eventually if it turns out to make a difference for
   * anybody. */
87
88
89
90
91
92
93
94
95
96
  if (req->nquestions == 0) {
    log_info(LD_APP, "No questions in DNS request; sending back nil reply.");
    evdns_server_request_respond(req, 0);
    return;
  }
  if (req->nquestions > 1) {
    log_info(LD_APP, "Got a DNS request with more than one question; I only "
             "handle one question at a time for now.  Skipping the extras.");
  }
  for (i = 0; i < req->nquestions; ++i) {
97
    if (req->questions[i]->dns_question_class != EVDNS_CLASS_INET)
98
99
100
      continue;
    switch (req->questions[i]->type) {
      case EVDNS_TYPE_A:
101
      case EVDNS_TYPE_AAAA:
102
      case EVDNS_TYPE_PTR:
103
104
105
        /* We always pick the first one of these questions, if there is
           one. */
        if (! supported_q)
106
          supported_q = req->questions[i];
107
        break;
108
109
110
111
      default:
        break;
      }
  }
112
113
  if (supported_q)
    q = supported_q;
114
115
  if (!q) {
    log_info(LD_APP, "None of the questions we got were ones we're willing "
116
117
             "to support. Sending NOTIMPL.");
    evdns_server_request_respond(req, DNS_ERR_NOTIMPL);
118
119
    return;
  }
120
121

  /* Make sure the name isn't too long: This should be impossible, I think. */
122
123
124
  if (err == DNS_ERR_NONE && strlen(q->name) > MAX_SOCKS_ADDR_LEN-1)
    err = DNS_ERR_FORMAT;

125
126
127
  if (err != DNS_ERR_NONE || !supported_q) {
    /* We got an error?  There's no question we're willing to answer? Then
     * send back an answer immediately; we're done. */
128
129
130
131
    evdns_server_request_respond(req, err);
    return;
  }

132
  /* Make a new dummy AP connection, and attach the request to it. */
133
134
  entry_conn = entry_connection_new(CONN_TYPE_AP, AF_INET);
  conn = ENTRY_TO_EDGE_CONN(entry_conn);
135
  CONNECTION_AP_EXPECT_NONPENDING(entry_conn);
136
  TO_CONN(conn)->state = AP_CONN_STATE_RESOLVE_WAIT;
137
  conn->is_dns_request = 1;
138

139
140
  tor_addr_copy(&TO_CONN(conn)->addr, &tor_addr);
  TO_CONN(conn)->port = port;
141
  TO_CONN(conn)->address = tor_addr_to_str_dup(&tor_addr);
142

143
144
  if (q->type == EVDNS_TYPE_A || q->type == EVDNS_TYPE_AAAA ||
      q->type == EVDNS_QTYPE_ALL) {
145
    entry_conn->socks_request->command = SOCKS_COMMAND_RESOLVE;
146
147
  } else {
    tor_assert(q->type == EVDNS_TYPE_PTR);
148
    entry_conn->socks_request->command = SOCKS_COMMAND_RESOLVE_PTR;
149
  }
150

151
152
  /* This serves our DNS port so enable DNS request by default. */
  entry_conn->entry_cfg.dns_request = 1;
153
  if (q->type == EVDNS_TYPE_A || q->type == EVDNS_QTYPE_ALL) {
154
155
156
    entry_conn->entry_cfg.ipv4_traffic = 1;
    entry_conn->entry_cfg.ipv6_traffic = 0;
    entry_conn->entry_cfg.prefer_ipv6 = 0;
157
  } else if (q->type == EVDNS_TYPE_AAAA) {
158
159
160
    entry_conn->entry_cfg.ipv4_traffic = 0;
    entry_conn->entry_cfg.ipv6_traffic = 1;
    entry_conn->entry_cfg.prefer_ipv6 = 1;
161
162
  }

163
164
  strlcpy(entry_conn->socks_request->address, q->name,
          sizeof(entry_conn->socks_request->address));
165

166
  entry_conn->socks_request->listener_type = listener->base_.type;
167
  entry_conn->dns_server_request = req;
168
169
  entry_conn->entry_cfg.isolation_flags = listener->entry_cfg.isolation_flags;
  entry_conn->entry_cfg.session_group = listener->entry_cfg.session_group;
170
  entry_conn->nym_epoch = get_signewnym_epoch();
171

172
  if (connection_add(ENTRY_TO_CONN(entry_conn)) < 0) {
173
174
    log_warn(LD_APP, "Couldn't register dummy connection for DNS request");
    evdns_server_request_respond(req, DNS_ERR_SERVERFAILED);
175
    connection_free_(ENTRY_TO_CONN(entry_conn));
176
177
    return;
  }
178

179
  control_event_stream_status(entry_conn, STREAM_EVENT_NEW_RESOLVE, 0);
180

181
182
183
184
  /* Now, unless a controller asked us to leave streams unattached,
  * throw the connection over to get rewritten (which will
  * answer it immediately if it's in the cache, or completely bogus, or
  * automapped), and then attached to a circuit. */
185
  log_info(LD_APP, "Passing request for %s to rewrite_and_attach.",
186
           escaped_safe_str_client(q->name));
187
  q_name = tor_strdup(q->name); /* q could be freed in rewrite_and_attach */
188
  connection_ap_rewrite_and_attach_if_allowed(entry_conn, NULL, NULL);
189
  /* Now, the connection is marked if it was bad. */
190

191
  log_info(LD_APP, "Passed request for %s to rewrite_and_attach_if_allowed.",
192
           escaped_safe_str_client(q_name));
193
  tor_free(q_name);
194
195
}

196
/** Helper function: called whenever the client sends a resolve request to our
197
 * controller.  We need to eventually answer the request <b>req</b>.
198
199
 * Returns 0 if the controller will be getting (or has gotten) an event in
 * response; -1 if we couldn't launch the request.
200
 */
201
int
Nick Mathewson's avatar
Nick Mathewson committed
202
203
dnsserv_launch_request(const char *name, int reverse,
                       control_connection_t *control_conn)
204
{
205
  entry_connection_t *entry_conn;
206
207
208
209
  edge_connection_t *conn;
  char *q_name;

  /* Make a new dummy AP connection, and attach the request to it. */
210
211
  entry_conn = entry_connection_new(CONN_TYPE_AP, AF_INET);
  conn = ENTRY_TO_EDGE_CONN(entry_conn);
212
  CONNECTION_AP_EXPECT_NONPENDING(entry_conn);
213
  conn->base_.state = AP_CONN_STATE_RESOLVE_WAIT;
214

215
  tor_addr_copy(&TO_CONN(conn)->addr, &control_conn->base_.addr);
216
217
#ifdef AF_UNIX
  /*
218
   * The control connection can be AF_UNIX and if so tor_addr_to_str_dup will
219
220
221
222
223
224
225
226
   * unhelpfully say "<unknown address type>"; say "(Tor_internal)"
   * instead.
   */
  if (control_conn->base_.socket_family == AF_UNIX) {
    TO_CONN(conn)->port = 0;
    TO_CONN(conn)->address = tor_strdup("(Tor_internal)");
  } else {
    TO_CONN(conn)->port = control_conn->base_.port;
227
    TO_CONN(conn)->address = tor_addr_to_str_dup(&control_conn->base_.addr);
228
  }
229
#else /* !(defined(AF_UNIX)) */
230
  TO_CONN(conn)->port = control_conn->base_.port;
231
  TO_CONN(conn)->address = tor_addr_to_str_dup(&control_conn->base_.addr);
232
#endif /* defined(AF_UNIX) */
233

234
  if (reverse)
235
    entry_conn->socks_request->command = SOCKS_COMMAND_RESOLVE_PTR;
236
  else
237
    entry_conn->socks_request->command = SOCKS_COMMAND_RESOLVE;
238
239

  conn->is_dns_request = 1;
240

241
242
  strlcpy(entry_conn->socks_request->address, name,
          sizeof(entry_conn->socks_request->address));
243

244
  entry_conn->socks_request->listener_type = CONN_TYPE_CONTROL_LISTENER;
245
  entry_conn->original_dest_address = tor_strdup(name);
246
  entry_conn->entry_cfg.session_group = SESSION_GROUP_CONTROL_RESOLVE;
247
  entry_conn->nym_epoch = get_signewnym_epoch();
248
  entry_conn->entry_cfg.isolation_flags = ISO_DEFAULT;
249

250
251
  if (connection_add(TO_CONN(conn))<0) {
    log_warn(LD_APP, "Couldn't register dummy connection for RESOLVE request");
252
    connection_free_(TO_CONN(conn));
253
    return -1;
254
  }
255

256
257
  control_event_stream_status(entry_conn, STREAM_EVENT_NEW_RESOLVE, 0);

258
259
260
261
  /* Now, unless a controller asked us to leave streams unattached,
  * throw the connection over to get rewritten (which will
  * answer it immediately if it's in the cache, or completely bogus, or
  * automapped), and then attached to a circuit. */
262
  log_info(LD_APP, "Passing request for %s to rewrite_and_attach.",
263
           escaped_safe_str_client(name));
264
  q_name = tor_strdup(name); /* q could be freed in rewrite_and_attach */
265
  connection_ap_rewrite_and_attach_if_allowed(entry_conn, NULL, NULL);
266
267
  /* Now, the connection is marked if it was bad. */

268
  log_info(LD_APP, "Passed request for %s to rewrite_and_attach_if_allowed.",
269
           escaped_safe_str_client(q_name));
270
  tor_free(q_name);
271
  return 0;
272
273
}

274
275
/** If there is a pending request on <b>conn</b> that's waiting for an answer,
 * send back an error and free the request. */
276
void
277
dnsserv_reject_request(entry_connection_t *conn)
278
{
279
280
281
282
283
  if (conn->dns_server_request) {
    evdns_server_request_respond(conn->dns_server_request,
                                 DNS_ERR_SERVERFAILED);
    conn->dns_server_request = NULL;
  }
284
285
}

286
/** Look up the original name that corresponds to 'addr' in req.  We use this
287
 * to preserve case in order to facilitate clients using 0x20-hacks to avoid
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
 * DNS poisoning. */
static const char *
evdns_get_orig_address(const struct evdns_server_request *req,
                       int rtype, const char *addr)
{
  int i, type;

  switch (rtype) {
  case RESOLVED_TYPE_IPV4:
    type = EVDNS_TYPE_A;
    break;
  case RESOLVED_TYPE_HOSTNAME:
    type = EVDNS_TYPE_PTR;
    break;
  case RESOLVED_TYPE_IPV6:
    type = EVDNS_TYPE_AAAA;
    break;
305
306
307
308
  case RESOLVED_TYPE_ERROR:
  case RESOLVED_TYPE_ERROR_TRANSIENT:
     /* Addr doesn't matter, since we're not sending it back in the reply.*/
    return addr;
309
310
311
312
313
314
315
316
317
318
319
320
321
  default:
    tor_fragile_assert();
    return addr;
  }

  for (i = 0; i < req->nquestions; ++i) {
    const struct evdns_server_question *q = req->questions[i];
    if (q->type == type && !strcasecmp(q->name, addr))
      return q->name;
  }
  return addr;
}

322
323
324
325
/** Tell the dns request waiting for an answer on <b>conn</b> that we have an
 * answer of type <b>answer_type</b> (RESOLVE_TYPE_IPV4/IPV6/ERR), of length
 * <b>answer_len</b>, in <b>answer</b>, with TTL <b>ttl</b>.  Doesn't do
 * any caching; that's handled elsewhere. */
326
void
327
dnsserv_resolved(entry_connection_t *conn,
328
329
330
331
332
333
                 int answer_type,
                 size_t answer_len,
                 const char *answer,
                 int ttl)
{
  struct evdns_server_request *req = conn->dns_server_request;
334
  const char *name;
335
336
337
  int err = DNS_ERR_NONE;
  if (!req)
    return;
Nick Mathewson's avatar
Nick Mathewson committed
338
339
  name = evdns_get_orig_address(req, answer_type,
                                conn->socks_request->address);
340

341
  /* XXXX Re-do; this is dumb. */
342
343
344
  if (ttl < 60)
    ttl = 60;

345
346
347
  /* The evdns interface is: add a bunch of reply items (corresponding to one
   * or more of the questions in the request); then, call
   * evdns_server_request_respond. */
348
  if (answer_type == RESOLVED_TYPE_IPV6) {
349
350
351
    evdns_server_request_add_aaaa_reply(req,
                                        name,
                                        1, answer, ttl);
352
353
  } else if (answer_type == RESOLVED_TYPE_IPV4 && answer_len == 4 &&
             conn->socks_request->command == SOCKS_COMMAND_RESOLVE) {
354
    evdns_server_request_add_a_reply(req,
355
                                     name,
356
                                     1, answer, ttl);
357
  } else if (answer_type == RESOLVED_TYPE_HOSTNAME &&
358
             answer_len < 256 &&
359
             conn->socks_request->command == SOCKS_COMMAND_RESOLVE_PTR) {
360
361
    char *ans = tor_strndup(answer, answer_len);
    evdns_server_request_add_ptr_reply(req, NULL,
362
                                       name,
363
                                       ans, ttl);
364
    tor_free(ans);
365
  } else if (answer_type == RESOLVED_TYPE_ERROR) {
366
    err = DNS_ERR_NOTEXIST;
367
  } else { /* answer_type == RESOLVED_TYPE_ERROR_TRANSIENT */
368
    err = DNS_ERR_SERVERFAILED;
369
370
  }

371
  evdns_server_request_respond(req, err);
372

373
374
375
  conn->dns_server_request = NULL;
}

376
/** Set up the evdns server port for the UDP socket on <b>conn</b>, which
377
 * must be an AP_DNS_LISTENER */
378
379
380
void
dnsserv_configure_listener(connection_t *conn)
{
381
  listener_connection_t *listener_conn;
382
  tor_assert(conn);
383
  tor_assert(SOCKET_OK(conn->s));
384
  tor_assert(conn->type == CONN_TYPE_AP_DNS_LISTENER);
385

386
387
  listener_conn = TO_LISTENER_CONN(conn);
  listener_conn->dns_server_port =
388
389
    tor_evdns_add_server_port(conn->s, 0, evdns_server_callback,
                              listener_conn);
390
391
}

392
393
/** Free the evdns server port for <b>conn</b>, which must be an
 * AP_DNS_LISTENER. */
394
395
396
void
dnsserv_close_listener(connection_t *conn)
{
397
  listener_connection_t *listener_conn;
398
399
400
  tor_assert(conn);
  tor_assert(conn->type == CONN_TYPE_AP_DNS_LISTENER);

401
402
403
404
405
  listener_conn = TO_LISTENER_CONN(conn);

  if (listener_conn->dns_server_port) {
    evdns_close_server_port(listener_conn->dns_server_port);
    listener_conn->dns_server_port = NULL;
406
  }
407
408
}