dnsserv.c 14 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408
  1. /* Copyright (c) 2007-2017, The Tor Project, Inc. */
  2. /* See LICENSE for licensing information */
  3. /**
  4. * \file dnsserv.c
  5. * \brief Implements client-side DNS proxy server code.
  6. *
  7. * When a user enables the DNSPort configuration option to have their local
  8. * Tor client handle DNS requests, this module handles it. It functions as a
  9. * "DNS Server" on the client side, which client applications use.
  10. *
  11. * Inbound DNS requests are represented as entry_connection_t here (since
  12. * that's how Tor represents client-side streams), which are kept associated
  13. * with an evdns_server_request structure as exposed by Libevent's
  14. * evdns code.
  15. *
  16. * Upon receiving a DNS request, libevent calls our evdns_server_callback()
  17. * function here, which causes this module to create an entry_connection_t
  18. * request as appropriate. Later, when that request is answered,
  19. * connection_edge.c calls dnsserv_resolved() so we can finish up and tell the
  20. * DNS client.
  21. **/
  22. #include "or.h"
  23. #include "dnsserv.h"
  24. #include "config.h"
  25. #include "connection.h"
  26. #include "connection_edge.h"
  27. #include "control.h"
  28. #include "main.h"
  29. #include "policies.h"
  30. #include <event2/dns.h>
  31. #include <event2/dns_compat.h>
  32. /* XXXX this implies we want an improved evdns */
  33. #include <event2/dns_struct.h>
  34. /** Helper function: called by evdns whenever the client sends a request to our
  35. * DNSPort. We need to eventually answer the request <b>req</b>.
  36. */
  37. static void
  38. evdns_server_callback(struct evdns_server_request *req, void *data_)
  39. {
  40. const listener_connection_t *listener = data_;
  41. entry_connection_t *entry_conn;
  42. edge_connection_t *conn;
  43. int i = 0;
  44. struct evdns_server_question *q = NULL, *supported_q = NULL;
  45. struct sockaddr_storage addr;
  46. struct sockaddr *sa;
  47. int addrlen;
  48. tor_addr_t tor_addr;
  49. uint16_t port;
  50. int err = DNS_ERR_NONE;
  51. char *q_name;
  52. tor_assert(req);
  53. log_info(LD_APP, "Got a new DNS request!");
  54. req->flags |= 0x80; /* set RA */
  55. /* First, check whether the requesting address matches our SOCKSPolicy. */
  56. if ((addrlen = evdns_server_request_get_requesting_addr(req,
  57. (struct sockaddr*)&addr, (socklen_t)sizeof(addr))) < 0) {
  58. log_warn(LD_APP, "Couldn't get requesting address.");
  59. evdns_server_request_respond(req, DNS_ERR_SERVERFAILED);
  60. return;
  61. }
  62. (void) addrlen;
  63. sa = (struct sockaddr*) &addr;
  64. if (tor_addr_from_sockaddr(&tor_addr, sa, &port)<0) {
  65. log_warn(LD_APP, "Requesting address wasn't recognized.");
  66. evdns_server_request_respond(req, DNS_ERR_SERVERFAILED);
  67. return;
  68. }
  69. if (!socks_policy_permits_address(&tor_addr)) {
  70. log_warn(LD_APP, "Rejecting DNS request from disallowed IP.");
  71. evdns_server_request_respond(req, DNS_ERR_REFUSED);
  72. return;
  73. }
  74. /* Now, let's find the first actual question of a type we can answer in this
  75. * DNS request. It makes us a little noncompliant to act like this; we
  76. * should fix that eventually if it turns out to make a difference for
  77. * anybody. */
  78. if (req->nquestions == 0) {
  79. log_info(LD_APP, "No questions in DNS request; sending back nil reply.");
  80. evdns_server_request_respond(req, 0);
  81. return;
  82. }
  83. if (req->nquestions > 1) {
  84. log_info(LD_APP, "Got a DNS request with more than one question; I only "
  85. "handle one question at a time for now. Skipping the extras.");
  86. }
  87. for (i = 0; i < req->nquestions; ++i) {
  88. if (req->questions[i]->dns_question_class != EVDNS_CLASS_INET)
  89. continue;
  90. switch (req->questions[i]->type) {
  91. case EVDNS_TYPE_A:
  92. case EVDNS_TYPE_AAAA:
  93. case EVDNS_TYPE_PTR:
  94. /* We always pick the first one of these questions, if there is
  95. one. */
  96. if (! supported_q)
  97. supported_q = req->questions[i];
  98. break;
  99. default:
  100. break;
  101. }
  102. }
  103. if (supported_q)
  104. q = supported_q;
  105. if (!q) {
  106. log_info(LD_APP, "None of the questions we got were ones we're willing "
  107. "to support. Sending NOTIMPL.");
  108. evdns_server_request_respond(req, DNS_ERR_NOTIMPL);
  109. return;
  110. }
  111. /* Make sure the name isn't too long: This should be impossible, I think. */
  112. if (err == DNS_ERR_NONE && strlen(q->name) > MAX_SOCKS_ADDR_LEN-1)
  113. err = DNS_ERR_FORMAT;
  114. if (err != DNS_ERR_NONE || !supported_q) {
  115. /* We got an error? There's no question we're willing to answer? Then
  116. * send back an answer immediately; we're done. */
  117. evdns_server_request_respond(req, err);
  118. return;
  119. }
  120. /* Make a new dummy AP connection, and attach the request to it. */
  121. entry_conn = entry_connection_new(CONN_TYPE_AP, AF_INET);
  122. conn = ENTRY_TO_EDGE_CONN(entry_conn);
  123. CONNECTION_AP_EXPECT_NONPENDING(entry_conn);
  124. TO_CONN(conn)->state = AP_CONN_STATE_RESOLVE_WAIT;
  125. conn->is_dns_request = 1;
  126. tor_addr_copy(&TO_CONN(conn)->addr, &tor_addr);
  127. TO_CONN(conn)->port = port;
  128. TO_CONN(conn)->address = tor_addr_to_str_dup(&tor_addr);
  129. if (q->type == EVDNS_TYPE_A || q->type == EVDNS_TYPE_AAAA ||
  130. q->type == EVDNS_QTYPE_ALL) {
  131. entry_conn->socks_request->command = SOCKS_COMMAND_RESOLVE;
  132. } else {
  133. tor_assert(q->type == EVDNS_TYPE_PTR);
  134. entry_conn->socks_request->command = SOCKS_COMMAND_RESOLVE_PTR;
  135. }
  136. /* This serves our DNS port so enable DNS request by default. */
  137. entry_conn->entry_cfg.dns_request = 1;
  138. if (q->type == EVDNS_TYPE_A || q->type == EVDNS_QTYPE_ALL) {
  139. entry_conn->entry_cfg.ipv4_traffic = 1;
  140. entry_conn->entry_cfg.ipv6_traffic = 0;
  141. entry_conn->entry_cfg.prefer_ipv6 = 0;
  142. } else if (q->type == EVDNS_TYPE_AAAA) {
  143. entry_conn->entry_cfg.ipv4_traffic = 0;
  144. entry_conn->entry_cfg.ipv6_traffic = 1;
  145. entry_conn->entry_cfg.prefer_ipv6 = 1;
  146. }
  147. strlcpy(entry_conn->socks_request->address, q->name,
  148. sizeof(entry_conn->socks_request->address));
  149. entry_conn->socks_request->listener_type = listener->base_.type;
  150. entry_conn->dns_server_request = req;
  151. entry_conn->entry_cfg.isolation_flags = listener->entry_cfg.isolation_flags;
  152. entry_conn->entry_cfg.session_group = listener->entry_cfg.session_group;
  153. entry_conn->nym_epoch = get_signewnym_epoch();
  154. if (connection_add(ENTRY_TO_CONN(entry_conn)) < 0) {
  155. log_warn(LD_APP, "Couldn't register dummy connection for DNS request");
  156. evdns_server_request_respond(req, DNS_ERR_SERVERFAILED);
  157. connection_free_(ENTRY_TO_CONN(entry_conn));
  158. return;
  159. }
  160. control_event_stream_status(entry_conn, STREAM_EVENT_NEW_RESOLVE, 0);
  161. /* Now, unless a controller asked us to leave streams unattached,
  162. * throw the connection over to get rewritten (which will
  163. * answer it immediately if it's in the cache, or completely bogus, or
  164. * automapped), and then attached to a circuit. */
  165. log_info(LD_APP, "Passing request for %s to rewrite_and_attach.",
  166. escaped_safe_str_client(q->name));
  167. q_name = tor_strdup(q->name); /* q could be freed in rewrite_and_attach */
  168. connection_ap_rewrite_and_attach_if_allowed(entry_conn, NULL, NULL);
  169. /* Now, the connection is marked if it was bad. */
  170. log_info(LD_APP, "Passed request for %s to rewrite_and_attach_if_allowed.",
  171. escaped_safe_str_client(q_name));
  172. tor_free(q_name);
  173. }
  174. /** Helper function: called whenever the client sends a resolve request to our
  175. * controller. We need to eventually answer the request <b>req</b>.
  176. * Returns 0 if the controller will be getting (or has gotten) an event in
  177. * response; -1 if we couldn't launch the request.
  178. */
  179. int
  180. dnsserv_launch_request(const char *name, int reverse,
  181. control_connection_t *control_conn)
  182. {
  183. entry_connection_t *entry_conn;
  184. edge_connection_t *conn;
  185. char *q_name;
  186. /* Make a new dummy AP connection, and attach the request to it. */
  187. entry_conn = entry_connection_new(CONN_TYPE_AP, AF_INET);
  188. conn = ENTRY_TO_EDGE_CONN(entry_conn);
  189. CONNECTION_AP_EXPECT_NONPENDING(entry_conn);
  190. conn->base_.state = AP_CONN_STATE_RESOLVE_WAIT;
  191. tor_addr_copy(&TO_CONN(conn)->addr, &control_conn->base_.addr);
  192. #ifdef AF_UNIX
  193. /*
  194. * The control connection can be AF_UNIX and if so tor_addr_to_str_dup will
  195. * unhelpfully say "<unknown address type>"; say "(Tor_internal)"
  196. * instead.
  197. */
  198. if (control_conn->base_.socket_family == AF_UNIX) {
  199. TO_CONN(conn)->port = 0;
  200. TO_CONN(conn)->address = tor_strdup("(Tor_internal)");
  201. } else {
  202. TO_CONN(conn)->port = control_conn->base_.port;
  203. TO_CONN(conn)->address = tor_addr_to_str_dup(&control_conn->base_.addr);
  204. }
  205. #else /* !(defined(AF_UNIX)) */
  206. TO_CONN(conn)->port = control_conn->base_.port;
  207. TO_CONN(conn)->address = tor_addr_to_str_dup(&control_conn->base_.addr);
  208. #endif /* defined(AF_UNIX) */
  209. if (reverse)
  210. entry_conn->socks_request->command = SOCKS_COMMAND_RESOLVE_PTR;
  211. else
  212. entry_conn->socks_request->command = SOCKS_COMMAND_RESOLVE;
  213. conn->is_dns_request = 1;
  214. strlcpy(entry_conn->socks_request->address, name,
  215. sizeof(entry_conn->socks_request->address));
  216. entry_conn->socks_request->listener_type = CONN_TYPE_CONTROL_LISTENER;
  217. entry_conn->original_dest_address = tor_strdup(name);
  218. entry_conn->entry_cfg.session_group = SESSION_GROUP_CONTROL_RESOLVE;
  219. entry_conn->nym_epoch = get_signewnym_epoch();
  220. entry_conn->entry_cfg.isolation_flags = ISO_DEFAULT;
  221. if (connection_add(TO_CONN(conn))<0) {
  222. log_warn(LD_APP, "Couldn't register dummy connection for RESOLVE request");
  223. connection_free_(TO_CONN(conn));
  224. return -1;
  225. }
  226. control_event_stream_status(entry_conn, STREAM_EVENT_NEW_RESOLVE, 0);
  227. /* Now, unless a controller asked us to leave streams unattached,
  228. * throw the connection over to get rewritten (which will
  229. * answer it immediately if it's in the cache, or completely bogus, or
  230. * automapped), and then attached to a circuit. */
  231. log_info(LD_APP, "Passing request for %s to rewrite_and_attach.",
  232. escaped_safe_str_client(name));
  233. q_name = tor_strdup(name); /* q could be freed in rewrite_and_attach */
  234. connection_ap_rewrite_and_attach_if_allowed(entry_conn, NULL, NULL);
  235. /* Now, the connection is marked if it was bad. */
  236. log_info(LD_APP, "Passed request for %s to rewrite_and_attach_if_allowed.",
  237. escaped_safe_str_client(q_name));
  238. tor_free(q_name);
  239. return 0;
  240. }
  241. /** If there is a pending request on <b>conn</b> that's waiting for an answer,
  242. * send back an error and free the request. */
  243. void
  244. dnsserv_reject_request(entry_connection_t *conn)
  245. {
  246. if (conn->dns_server_request) {
  247. evdns_server_request_respond(conn->dns_server_request,
  248. DNS_ERR_SERVERFAILED);
  249. conn->dns_server_request = NULL;
  250. }
  251. }
  252. /** Look up the original name that corresponds to 'addr' in req. We use this
  253. * to preserve case in order to facilitate clients using 0x20-hacks to avoid
  254. * DNS poisoning. */
  255. static const char *
  256. evdns_get_orig_address(const struct evdns_server_request *req,
  257. int rtype, const char *addr)
  258. {
  259. int i, type;
  260. switch (rtype) {
  261. case RESOLVED_TYPE_IPV4:
  262. type = EVDNS_TYPE_A;
  263. break;
  264. case RESOLVED_TYPE_HOSTNAME:
  265. type = EVDNS_TYPE_PTR;
  266. break;
  267. case RESOLVED_TYPE_IPV6:
  268. type = EVDNS_TYPE_AAAA;
  269. break;
  270. case RESOLVED_TYPE_ERROR:
  271. case RESOLVED_TYPE_ERROR_TRANSIENT:
  272. /* Addr doesn't matter, since we're not sending it back in the reply.*/
  273. return addr;
  274. default:
  275. tor_fragile_assert();
  276. return addr;
  277. }
  278. for (i = 0; i < req->nquestions; ++i) {
  279. const struct evdns_server_question *q = req->questions[i];
  280. if (q->type == type && !strcasecmp(q->name, addr))
  281. return q->name;
  282. }
  283. return addr;
  284. }
  285. /** Tell the dns request waiting for an answer on <b>conn</b> that we have an
  286. * answer of type <b>answer_type</b> (RESOLVE_TYPE_IPV4/IPV6/ERR), of length
  287. * <b>answer_len</b>, in <b>answer</b>, with TTL <b>ttl</b>. Doesn't do
  288. * any caching; that's handled elsewhere. */
  289. void
  290. dnsserv_resolved(entry_connection_t *conn,
  291. int answer_type,
  292. size_t answer_len,
  293. const char *answer,
  294. int ttl)
  295. {
  296. struct evdns_server_request *req = conn->dns_server_request;
  297. const char *name;
  298. int err = DNS_ERR_NONE;
  299. if (!req)
  300. return;
  301. name = evdns_get_orig_address(req, answer_type,
  302. conn->socks_request->address);
  303. /* XXXX Re-do; this is dumb. */
  304. if (ttl < 60)
  305. ttl = 60;
  306. /* The evdns interface is: add a bunch of reply items (corresponding to one
  307. * or more of the questions in the request); then, call
  308. * evdns_server_request_respond. */
  309. if (answer_type == RESOLVED_TYPE_IPV6) {
  310. evdns_server_request_add_aaaa_reply(req,
  311. name,
  312. 1, answer, ttl);
  313. } else if (answer_type == RESOLVED_TYPE_IPV4 && answer_len == 4 &&
  314. conn->socks_request->command == SOCKS_COMMAND_RESOLVE) {
  315. evdns_server_request_add_a_reply(req,
  316. name,
  317. 1, answer, ttl);
  318. } else if (answer_type == RESOLVED_TYPE_HOSTNAME &&
  319. answer_len < 256 &&
  320. conn->socks_request->command == SOCKS_COMMAND_RESOLVE_PTR) {
  321. char *ans = tor_strndup(answer, answer_len);
  322. evdns_server_request_add_ptr_reply(req, NULL,
  323. name,
  324. ans, ttl);
  325. tor_free(ans);
  326. } else if (answer_type == RESOLVED_TYPE_ERROR) {
  327. err = DNS_ERR_NOTEXIST;
  328. } else { /* answer_type == RESOLVED_TYPE_ERROR_TRANSIENT */
  329. err = DNS_ERR_SERVERFAILED;
  330. }
  331. evdns_server_request_respond(req, err);
  332. conn->dns_server_request = NULL;
  333. }
  334. /** Set up the evdns server port for the UDP socket on <b>conn</b>, which
  335. * must be an AP_DNS_LISTENER */
  336. void
  337. dnsserv_configure_listener(connection_t *conn)
  338. {
  339. listener_connection_t *listener_conn;
  340. tor_assert(conn);
  341. tor_assert(SOCKET_OK(conn->s));
  342. tor_assert(conn->type == CONN_TYPE_AP_DNS_LISTENER);
  343. listener_conn = TO_LISTENER_CONN(conn);
  344. listener_conn->dns_server_port =
  345. tor_evdns_add_server_port(conn->s, 0, evdns_server_callback,
  346. listener_conn);
  347. }
  348. /** Free the evdns server port for <b>conn</b>, which must be an
  349. * AP_DNS_LISTENER. */
  350. void
  351. dnsserv_close_listener(connection_t *conn)
  352. {
  353. listener_connection_t *listener_conn;
  354. tor_assert(conn);
  355. tor_assert(conn->type == CONN_TYPE_AP_DNS_LISTENER);
  356. listener_conn = TO_LISTENER_CONN(conn);
  357. if (listener_conn->dns_server_port) {
  358. evdns_close_server_port(listener_conn->dns_server_port);
  359. listener_conn->dns_server_port = NULL;
  360. }
  361. }