dnsserv.c (15216B)
1 /* Copyright (c) 2007-2021, The Tor Project, Inc. */ 2 /* See LICENSE for licensing information */ 3 4 /** 5 * \file dnsserv.c 6 * \brief Implements client-side DNS proxy server code. 7 * 8 * When a user enables the DNSPort configuration option to have their local 9 * Tor client handle DNS requests, this module handles it. It functions as a 10 * "DNS Server" on the client side, which client applications use. 11 * 12 * Inbound DNS requests are represented as entry_connection_t here (since 13 * that's how Tor represents client-side streams), which are kept associated 14 * with an evdns_server_request structure as exposed by Libevent's 15 * evdns code. 16 * 17 * Upon receiving a DNS request, libevent calls our evdns_server_callback() 18 * function here, which causes this module to create an entry_connection_t 19 * request as appropriate. Later, when that request is answered, 20 * connection_edge.c calls dnsserv_resolved() so we can finish up and tell the 21 * DNS client. 22 **/ 23 24 #include "core/or/or.h" 25 #include "feature/client/dnsserv.h" 26 #include "app/config/config.h" 27 #include "core/mainloop/connection.h" 28 #include "core/or/connection_edge.h" 29 #include "feature/control/control_events.h" 30 #include "core/mainloop/mainloop.h" 31 #include "core/mainloop/netstatus.h" 32 #include "core/or/policies.h" 33 34 #include "feature/control/control_connection_st.h" 35 #include "core/or/entry_connection_st.h" 36 #include "core/or/listener_connection_st.h" 37 #include "core/or/socks_request_st.h" 38 #include "lib/evloop/compat_libevent.h" 39 40 #include <event2/dns.h> 41 #include <event2/dns_compat.h> 42 /* XXXX this implies we want an improved evdns */ 43 #include <event2/dns_struct.h> 44 45 /** Helper function: called by evdns whenever the client sends a request to our 46 * DNSPort. We need to eventually answer the request <b>req</b>. 47 */ 48 static void 49 evdns_server_callback(struct evdns_server_request *req, void *data_) 50 { 51 const listener_connection_t *listener = data_; 52 entry_connection_t *entry_conn; 53 edge_connection_t *conn; 54 int i = 0; 55 struct evdns_server_question *q = NULL, *supported_q = NULL; 56 struct sockaddr_storage addr; 57 struct sockaddr *sa; 58 int addrlen; 59 tor_addr_t tor_addr; 60 uint16_t port; 61 int err = DNS_ERR_NONE; 62 char *q_name; 63 64 tor_assert(req); 65 66 log_info(LD_APP, "Got a new DNS request!"); 67 68 /* Receiving a request on the DNSPort counts as user activity. */ 69 note_user_activity(approx_time()); 70 71 req->flags |= 0x80; /* set RA */ 72 73 /* First, check whether the requesting address matches our SOCKSPolicy. */ 74 if ((addrlen = evdns_server_request_get_requesting_addr(req, 75 (struct sockaddr*)&addr, (socklen_t)sizeof(addr))) < 0) { 76 log_warn(LD_APP, "Couldn't get requesting address."); 77 evdns_server_request_respond(req, DNS_ERR_SERVERFAILED); 78 return; 79 } 80 (void) addrlen; 81 sa = (struct sockaddr*) &addr; 82 if (tor_addr_from_sockaddr(&tor_addr, sa, &port)<0) { 83 log_warn(LD_APP, "Requesting address wasn't recognized."); 84 evdns_server_request_respond(req, DNS_ERR_SERVERFAILED); 85 return; 86 } 87 88 if (!socks_policy_permits_address(&tor_addr)) { 89 log_warn(LD_APP, "Rejecting DNS request from disallowed IP."); 90 evdns_server_request_respond(req, DNS_ERR_REFUSED); 91 return; 92 } 93 94 /* Now, let's find the first actual question of a type we can answer in this 95 * DNS request. It makes us a little noncompliant to act like this; we 96 * should fix that eventually if it turns out to make a difference for 97 * anybody. */ 98 if (req->nquestions == 0) { 99 log_info(LD_APP, "No questions in DNS request; sending back nil reply."); 100 evdns_server_request_respond(req, 0); 101 return; 102 } 103 if (req->nquestions > 1) { 104 log_info(LD_APP, "Got a DNS request with more than one question; I only " 105 "handle one question at a time for now. Skipping the extras."); 106 } 107 for (i = 0; i < req->nquestions; ++i) { 108 if (req->questions[i]->dns_question_class != EVDNS_CLASS_INET) 109 continue; 110 switch (req->questions[i]->type) { 111 case EVDNS_TYPE_A: 112 case EVDNS_TYPE_AAAA: 113 case EVDNS_TYPE_PTR: 114 /* We always pick the first one of these questions, if there is 115 one. */ 116 if (! supported_q) 117 supported_q = req->questions[i]; 118 break; 119 default: 120 break; 121 } 122 } 123 if (supported_q) 124 q = supported_q; 125 if (!q) { 126 log_info(LD_APP, "None of the questions we got were ones we're willing " 127 "to support. Sending NOTIMPL."); 128 evdns_server_request_respond(req, DNS_ERR_NOTIMPL); 129 return; 130 } 131 132 /* Make sure the name isn't too long: This should be impossible, I think. */ 133 if (err == DNS_ERR_NONE && strlen(q->name) > MAX_SOCKS_ADDR_LEN-1) 134 err = DNS_ERR_FORMAT; 135 136 if (err != DNS_ERR_NONE || !supported_q) { 137 /* We got an error? There's no question we're willing to answer? Then 138 * send back an answer immediately; we're done. */ 139 evdns_server_request_respond(req, err); 140 return; 141 } 142 143 /* Make a new dummy AP connection, and attach the request to it. */ 144 entry_conn = entry_connection_new(CONN_TYPE_AP, AF_INET); 145 conn = ENTRY_TO_EDGE_CONN(entry_conn); 146 CONNECTION_AP_EXPECT_NONPENDING(entry_conn); 147 TO_CONN(conn)->state = AP_CONN_STATE_RESOLVE_WAIT; 148 conn->is_dns_request = 1; 149 150 tor_addr_copy(&TO_CONN(conn)->addr, &tor_addr); 151 TO_CONN(conn)->port = port; 152 TO_CONN(conn)->address = tor_addr_to_str_dup(&tor_addr); 153 154 if (q->type == EVDNS_TYPE_A || q->type == EVDNS_TYPE_AAAA || 155 q->type == EVDNS_QTYPE_ALL) { 156 entry_conn->socks_request->command = SOCKS_COMMAND_RESOLVE; 157 } else { 158 tor_assert(q->type == EVDNS_TYPE_PTR); 159 entry_conn->socks_request->command = SOCKS_COMMAND_RESOLVE_PTR; 160 } 161 162 /* This serves our DNS port so enable DNS request by default. */ 163 entry_conn->entry_cfg.dns_request = 1; 164 if (q->type == EVDNS_TYPE_A || q->type == EVDNS_QTYPE_ALL) { 165 entry_conn->entry_cfg.ipv4_traffic = 1; 166 entry_conn->entry_cfg.ipv6_traffic = 0; 167 entry_conn->entry_cfg.prefer_ipv6 = 0; 168 } else if (q->type == EVDNS_TYPE_AAAA) { 169 entry_conn->entry_cfg.ipv4_traffic = 0; 170 entry_conn->entry_cfg.ipv6_traffic = 1; 171 entry_conn->entry_cfg.prefer_ipv6 = 1; 172 } 173 174 strlcpy(entry_conn->socks_request->address, q->name, 175 sizeof(entry_conn->socks_request->address)); 176 177 entry_conn->socks_request->listener_type = listener->base_.type; 178 entry_conn->dns_server_request = req; 179 entry_conn->entry_cfg.isolation_flags = listener->entry_cfg.isolation_flags; 180 entry_conn->entry_cfg.session_group = listener->entry_cfg.session_group; 181 entry_conn->nym_epoch = get_signewnym_epoch(); 182 183 if (connection_add(ENTRY_TO_CONN(entry_conn)) < 0) { 184 log_warn(LD_APP, "Couldn't register dummy connection for DNS request"); 185 evdns_server_request_respond(req, DNS_ERR_SERVERFAILED); 186 connection_free_(ENTRY_TO_CONN(entry_conn)); 187 return; 188 } 189 190 control_event_stream_status(entry_conn, STREAM_EVENT_NEW_RESOLVE, 0); 191 192 /* Now, unless a controller asked us to leave streams unattached, 193 * throw the connection over to get rewritten (which will 194 * answer it immediately if it's in the cache, or completely bogus, or 195 * automapped), and then attached to a circuit. */ 196 log_info(LD_APP, "Passing request for %s to rewrite_and_attach.", 197 escaped_safe_str_client(q->name)); 198 q_name = tor_strdup(q->name); /* q could be freed in rewrite_and_attach */ 199 connection_ap_rewrite_and_attach_if_allowed(entry_conn, NULL, NULL); 200 /* Now, the connection is marked if it was bad. */ 201 202 log_info(LD_APP, "Passed request for %s to rewrite_and_attach_if_allowed.", 203 escaped_safe_str_client(q_name)); 204 tor_free(q_name); 205 } 206 207 /** Helper function: called whenever the client sends a resolve request to our 208 * controller. We need to eventually answer the request <b>req</b>. 209 * Returns 0 if the controller will be getting (or has gotten) an event in 210 * response; -1 if we couldn't launch the request. 211 */ 212 int 213 dnsserv_launch_request(const char *name, int reverse, 214 control_connection_t *control_conn) 215 { 216 entry_connection_t *entry_conn; 217 edge_connection_t *conn; 218 char *q_name; 219 220 /* Launching a request for a user counts as user activity. */ 221 note_user_activity(approx_time()); 222 223 /* Make a new dummy AP connection, and attach the request to it. */ 224 entry_conn = entry_connection_new(CONN_TYPE_AP, AF_INET); 225 entry_conn->entry_cfg.dns_request = 1; 226 conn = ENTRY_TO_EDGE_CONN(entry_conn); 227 CONNECTION_AP_EXPECT_NONPENDING(entry_conn); 228 conn->base_.state = AP_CONN_STATE_RESOLVE_WAIT; 229 230 tor_addr_copy(&TO_CONN(conn)->addr, &control_conn->base_.addr); 231 #ifdef AF_UNIX 232 /* 233 * The control connection can be AF_UNIX and if so tor_addr_to_str_dup will 234 * unhelpfully say "<unknown address type>"; say "(Tor_internal)" 235 * instead. 236 */ 237 if (control_conn->base_.socket_family == AF_UNIX) { 238 TO_CONN(conn)->port = 0; 239 TO_CONN(conn)->address = tor_strdup("(Tor_internal)"); 240 } else { 241 TO_CONN(conn)->port = control_conn->base_.port; 242 TO_CONN(conn)->address = tor_addr_to_str_dup(&control_conn->base_.addr); 243 } 244 #else /* !defined(AF_UNIX) */ 245 TO_CONN(conn)->port = control_conn->base_.port; 246 TO_CONN(conn)->address = tor_addr_to_str_dup(&control_conn->base_.addr); 247 #endif /* defined(AF_UNIX) */ 248 249 if (reverse) 250 entry_conn->socks_request->command = SOCKS_COMMAND_RESOLVE_PTR; 251 else 252 entry_conn->socks_request->command = SOCKS_COMMAND_RESOLVE; 253 254 conn->is_dns_request = 1; 255 256 strlcpy(entry_conn->socks_request->address, name, 257 sizeof(entry_conn->socks_request->address)); 258 259 entry_conn->socks_request->listener_type = CONN_TYPE_CONTROL_LISTENER; 260 entry_conn->original_dest_address = tor_strdup(name); 261 entry_conn->entry_cfg.session_group = SESSION_GROUP_CONTROL_RESOLVE; 262 entry_conn->nym_epoch = get_signewnym_epoch(); 263 entry_conn->entry_cfg.isolation_flags = ISO_DEFAULT; 264 265 if (connection_add(TO_CONN(conn))<0) { 266 log_warn(LD_APP, "Couldn't register dummy connection for RESOLVE request"); 267 connection_free_(TO_CONN(conn)); 268 return -1; 269 } 270 271 control_event_stream_status(entry_conn, STREAM_EVENT_NEW_RESOLVE, 0); 272 273 /* Now, unless a controller asked us to leave streams unattached, 274 * throw the connection over to get rewritten (which will 275 * answer it immediately if it's in the cache, or completely bogus, or 276 * automapped), and then attached to a circuit. */ 277 log_info(LD_APP, "Passing request for %s to rewrite_and_attach.", 278 escaped_safe_str_client(name)); 279 q_name = tor_strdup(name); /* q could be freed in rewrite_and_attach */ 280 connection_ap_rewrite_and_attach_if_allowed(entry_conn, NULL, NULL); 281 /* Now, the connection is marked if it was bad. */ 282 283 log_info(LD_APP, "Passed request for %s to rewrite_and_attach_if_allowed.", 284 escaped_safe_str_client(q_name)); 285 tor_free(q_name); 286 return 0; 287 } 288 289 /** If there is a pending request on <b>conn</b> that's waiting for an answer, 290 * send back an error and free the request. */ 291 void 292 dnsserv_reject_request(entry_connection_t *conn) 293 { 294 if (conn->dns_server_request) { 295 evdns_server_request_respond(conn->dns_server_request, 296 DNS_ERR_SERVERFAILED); 297 conn->dns_server_request = NULL; 298 } 299 } 300 301 /** Look up the original name that corresponds to 'addr' in req. We use this 302 * to preserve case in order to facilitate clients using 0x20-hacks to avoid 303 * DNS poisoning. */ 304 static const char * 305 evdns_get_orig_address(const struct evdns_server_request *req, 306 int rtype, const char *addr) 307 { 308 int i, type; 309 310 switch (rtype) { 311 case RESOLVED_TYPE_IPV4: 312 type = EVDNS_TYPE_A; 313 break; 314 case RESOLVED_TYPE_HOSTNAME: 315 type = EVDNS_TYPE_PTR; 316 break; 317 case RESOLVED_TYPE_IPV6: 318 type = EVDNS_TYPE_AAAA; 319 break; 320 case RESOLVED_TYPE_ERROR: 321 case RESOLVED_TYPE_ERROR_TRANSIENT: 322 case RESOLVED_TYPE_NOERROR: 323 /* Addr doesn't matter, since we're not sending it back in the reply.*/ 324 return addr; 325 default: 326 tor_fragile_assert(); 327 return addr; 328 } 329 330 for (i = 0; i < req->nquestions; ++i) { 331 const struct evdns_server_question *q = req->questions[i]; 332 if (q->type == type && !strcasecmp(q->name, addr)) 333 return q->name; 334 } 335 return addr; 336 } 337 338 /** Tell the dns request waiting for an answer on <b>conn</b> that we have an 339 * answer of type <b>answer_type</b> (RESOLVE_TYPE_IPV4/IPV6/ERR), of length 340 * <b>answer_len</b>, in <b>answer</b>, with TTL <b>ttl</b>. Doesn't do 341 * any caching; that's handled elsewhere. */ 342 void 343 dnsserv_resolved(entry_connection_t *conn, 344 int answer_type, 345 size_t answer_len, 346 const char *answer, 347 int ttl) 348 { 349 struct evdns_server_request *req = conn->dns_server_request; 350 const char *name; 351 int err = DNS_ERR_NONE; 352 if (!req) 353 return; 354 name = evdns_get_orig_address(req, answer_type, 355 conn->socks_request->address); 356 357 /* XXXX Re-do; this is dumb. */ 358 if (ttl < 60) 359 ttl = 60; 360 361 /* The evdns interface is: add a bunch of reply items (corresponding to one 362 * or more of the questions in the request); then, call 363 * evdns_server_request_respond. */ 364 if (answer_type == RESOLVED_TYPE_IPV6) { 365 evdns_server_request_add_aaaa_reply(req, 366 name, 367 1, answer, ttl); 368 } else if (answer_type == RESOLVED_TYPE_IPV4 && answer_len == 4 && 369 conn->socks_request->command == SOCKS_COMMAND_RESOLVE) { 370 evdns_server_request_add_a_reply(req, 371 name, 372 1, answer, ttl); 373 } else if (answer_type == RESOLVED_TYPE_HOSTNAME && 374 answer_len < 256 && 375 conn->socks_request->command == SOCKS_COMMAND_RESOLVE_PTR) { 376 char *ans = tor_strndup(answer, answer_len); 377 evdns_server_request_add_ptr_reply(req, NULL, 378 name, 379 ans, ttl); 380 tor_free(ans); 381 } else if (answer_type == RESOLVED_TYPE_ERROR) { 382 err = DNS_ERR_NOTEXIST; 383 } else if (answer_type == RESOLVED_TYPE_NOERROR) { 384 err = DNS_ERR_NONE; 385 } else { /* answer_type == RESOLVED_TYPE_ERROR_TRANSIENT */ 386 err = DNS_ERR_SERVERFAILED; 387 } 388 389 evdns_server_request_respond(req, err); 390 391 conn->dns_server_request = NULL; 392 } 393 394 /** Set up the evdns server port for the UDP socket on <b>conn</b>, which 395 * must be an AP_DNS_LISTENER */ 396 void 397 dnsserv_configure_listener(connection_t *conn) 398 { 399 listener_connection_t *listener_conn; 400 tor_assert(conn); 401 tor_assert(SOCKET_OK(conn->s)); 402 tor_assert(conn->type == CONN_TYPE_AP_DNS_LISTENER); 403 404 listener_conn = TO_LISTENER_CONN(conn); 405 listener_conn->dns_server_port = 406 tor_evdns_add_server_port(conn->s, 0, evdns_server_callback, 407 listener_conn); 408 } 409 410 /** Free the evdns server port for <b>conn</b>, which must be an 411 * AP_DNS_LISTENER. */ 412 void 413 dnsserv_close_listener(connection_t *conn) 414 { 415 listener_connection_t *listener_conn; 416 tor_assert(conn); 417 tor_assert(conn->type == CONN_TYPE_AP_DNS_LISTENER); 418 419 listener_conn = TO_LISTENER_CONN(conn); 420 421 if (listener_conn->dns_server_port) { 422 evdns_close_server_port(listener_conn->dns_server_port); 423 listener_conn->dns_server_port = NULL; 424 } 425 }