2019-06-10 09:33:19 +01:00
|
|
|
package home
|
2018-10-11 18:52:23 +01:00
|
|
|
|
|
|
|
import (
|
2023-03-15 11:31:07 +00:00
|
|
|
"context"
|
2018-10-11 18:52:23 +01:00
|
|
|
"fmt"
|
2018-11-28 13:45:30 +00:00
|
|
|
"net"
|
2022-10-14 13:29:44 +01:00
|
|
|
"net/netip"
|
2021-01-27 15:32:13 +00:00
|
|
|
"net/url"
|
2020-12-07 14:58:33 +00:00
|
|
|
"os"
|
2019-09-06 13:42:21 +01:00
|
|
|
"path/filepath"
|
2018-10-11 18:52:23 +01:00
|
|
|
|
2022-11-09 11:37:07 +00:00
|
|
|
"github.com/AdguardTeam/AdGuardHome/internal/aghalg"
|
2023-01-09 10:38:31 +00:00
|
|
|
"github.com/AdguardTeam/AdGuardHome/internal/aghhttp"
|
2021-12-06 14:26:43 +00:00
|
|
|
"github.com/AdguardTeam/AdGuardHome/internal/aghnet"
|
2023-01-09 10:38:31 +00:00
|
|
|
"github.com/AdguardTeam/AdGuardHome/internal/dhcpd"
|
2020-10-30 10:32:02 +00:00
|
|
|
"github.com/AdguardTeam/AdGuardHome/internal/dnsforward"
|
2021-05-21 14:15:47 +01:00
|
|
|
"github.com/AdguardTeam/AdGuardHome/internal/filtering"
|
2020-10-30 10:32:02 +00:00
|
|
|
"github.com/AdguardTeam/AdGuardHome/internal/querylog"
|
|
|
|
"github.com/AdguardTeam/AdGuardHome/internal/stats"
|
2019-03-20 11:24:33 +00:00
|
|
|
"github.com/AdguardTeam/dnsproxy/proxy"
|
2021-05-24 15:28:11 +01:00
|
|
|
"github.com/AdguardTeam/golibs/errors"
|
2019-02-25 13:44:22 +00:00
|
|
|
"github.com/AdguardTeam/golibs/log"
|
2021-08-09 14:03:37 +01:00
|
|
|
"github.com/AdguardTeam/golibs/netutil"
|
2020-12-07 14:58:33 +00:00
|
|
|
"github.com/ameshkov/dnscrypt/v2"
|
2022-08-08 13:50:54 +01:00
|
|
|
yaml "gopkg.in/yaml.v3"
|
2018-10-11 18:52:23 +01:00
|
|
|
)
|
|
|
|
|
2021-09-17 16:31:07 +01:00
|
|
|
// Default ports.
|
|
|
|
const (
|
|
|
|
defaultPortDNS = 53
|
|
|
|
defaultPortHTTP = 80
|
|
|
|
defaultPortHTTPS = 443
|
2022-03-23 13:00:32 +00:00
|
|
|
defaultPortQUIC = 853
|
2021-09-17 16:31:07 +01:00
|
|
|
defaultPortTLS = 853
|
|
|
|
)
|
|
|
|
|
2019-09-25 13:36:09 +01:00
|
|
|
// Called by other modules when configuration is changed
|
|
|
|
func onConfigModified() {
|
2022-09-23 11:23:35 +01:00
|
|
|
err := config.write()
|
|
|
|
if err != nil {
|
|
|
|
log.Error("writing config: %s", err)
|
|
|
|
}
|
2019-09-25 13:36:09 +01:00
|
|
|
}
|
|
|
|
|
2023-01-09 10:38:31 +00:00
|
|
|
// initDNS updates all the fields of the [Context] needed to initialize the DNS
|
|
|
|
// server and initializes it at last. It also must not be called unless
|
|
|
|
// [config] and [Context] are initialized.
|
|
|
|
func initDNS() (err error) {
|
2020-02-13 15:42:07 +00:00
|
|
|
baseDir := Context.getDataDir()
|
2019-10-02 14:53:23 +01:00
|
|
|
|
2023-01-09 10:38:31 +00:00
|
|
|
anonymizer := config.anonymizer()
|
2021-12-06 14:26:43 +00:00
|
|
|
|
2019-09-16 14:14:52 +01:00
|
|
|
statsConf := stats.Config{
|
2021-12-06 14:26:43 +00:00
|
|
|
Filename: filepath.Join(baseDir, "stats.db"),
|
2023-03-23 10:46:57 +00:00
|
|
|
Limit: config.Stats.Interval.Duration,
|
2021-12-06 14:26:43 +00:00
|
|
|
ConfigModified: onConfigModified,
|
|
|
|
HTTPRegister: httpRegister,
|
2023-02-13 15:15:33 +00:00
|
|
|
Enabled: config.Stats.Enabled,
|
2019-09-16 14:14:52 +01:00
|
|
|
}
|
2023-02-13 15:15:33 +00:00
|
|
|
|
2023-03-23 10:46:57 +00:00
|
|
|
set, err := aghnet.NewDomainNameSet(config.Stats.Ignored)
|
2023-02-13 15:15:33 +00:00
|
|
|
if err != nil {
|
|
|
|
return fmt.Errorf("statistics: ignored list: %w", err)
|
|
|
|
}
|
|
|
|
|
|
|
|
statsConf.Ignored = set
|
2019-12-11 09:38:58 +00:00
|
|
|
Context.stats, err = stats.New(statsConf)
|
2019-09-06 13:42:21 +01:00
|
|
|
if err != nil {
|
2022-01-20 14:19:09 +00:00
|
|
|
return fmt.Errorf("init stats: %w", err)
|
2019-08-22 14:34:58 +01:00
|
|
|
}
|
2021-04-02 15:30:39 +01:00
|
|
|
|
2019-08-26 09:54:38 +01:00
|
|
|
conf := querylog.Config{
|
2022-05-25 16:00:50 +01:00
|
|
|
Anonymizer: anonymizer,
|
2021-04-02 15:30:39 +01:00
|
|
|
ConfigModified: onConfigModified,
|
|
|
|
HTTPRegister: httpRegister,
|
|
|
|
FindClient: Context.clients.findMultiple,
|
2020-03-03 17:21:53 +00:00
|
|
|
BaseDir: baseDir,
|
|
|
|
AnonymizeClientIP: config.DNS.AnonymizeClientIP,
|
2023-02-07 14:50:39 +00:00
|
|
|
RotationIvl: config.QueryLog.Interval.Duration,
|
|
|
|
MemSize: config.QueryLog.MemSize,
|
|
|
|
Enabled: config.QueryLog.Enabled,
|
|
|
|
FileEnabled: config.QueryLog.FileEnabled,
|
|
|
|
}
|
|
|
|
|
2023-03-23 10:46:57 +00:00
|
|
|
set, err = aghnet.NewDomainNameSet(config.QueryLog.Ignored)
|
2023-02-13 15:15:33 +00:00
|
|
|
if err != nil {
|
|
|
|
return fmt.Errorf("querylog: ignored list: %w", err)
|
2019-08-26 09:54:38 +01:00
|
|
|
}
|
2023-02-13 15:15:33 +00:00
|
|
|
|
|
|
|
conf.Ignored = set
|
2023-03-23 10:46:57 +00:00
|
|
|
Context.queryLog, err = querylog.New(conf)
|
|
|
|
if err != nil {
|
|
|
|
return fmt.Errorf("init querylog: %w", err)
|
|
|
|
}
|
2019-10-09 17:51:26 +01:00
|
|
|
|
2022-09-23 11:23:35 +01:00
|
|
|
Context.filters, err = filtering.New(config.DNS.DnsfilterConf, nil)
|
|
|
|
if err != nil {
|
|
|
|
// Don't wrap the error, since it's informative enough as is.
|
|
|
|
return err
|
|
|
|
}
|
2019-10-09 17:51:26 +01:00
|
|
|
|
2023-01-09 10:38:31 +00:00
|
|
|
tlsConf := &tlsConfigSettings{}
|
|
|
|
Context.tls.WriteDiskConfig(tlsConf)
|
|
|
|
|
|
|
|
return initDNSServer(
|
|
|
|
Context.filters,
|
|
|
|
Context.stats,
|
|
|
|
Context.queryLog,
|
|
|
|
Context.dhcpServer,
|
|
|
|
anonymizer,
|
|
|
|
httpRegister,
|
|
|
|
tlsConf,
|
|
|
|
)
|
|
|
|
}
|
2022-03-18 10:37:27 +00:00
|
|
|
|
2023-01-09 10:38:31 +00:00
|
|
|
// initDNSServer initializes the [context.dnsServer]. To only use the internal
|
|
|
|
// proxy, none of the arguments are required, but tlsConf still must not be nil,
|
|
|
|
// in other cases all the arguments also must not be nil. It also must not be
|
|
|
|
// called unless [config] and [Context] are initialized.
|
|
|
|
func initDNSServer(
|
|
|
|
filters *filtering.DNSFilter,
|
|
|
|
sts stats.Interface,
|
|
|
|
qlog querylog.QueryLog,
|
|
|
|
dhcpSrv dhcpd.Interface,
|
|
|
|
anonymizer *aghnet.IPMut,
|
|
|
|
httpReg aghhttp.RegisterFunc,
|
|
|
|
tlsConf *tlsConfigSettings,
|
|
|
|
) (err error) {
|
|
|
|
privateNets, err := parseSubnetSet(config.DNS.PrivateNets)
|
|
|
|
if err != nil {
|
|
|
|
return fmt.Errorf("preparing set of private subnets: %w", err)
|
2022-03-18 10:37:27 +00:00
|
|
|
}
|
|
|
|
|
2020-06-23 10:13:13 +01:00
|
|
|
p := dnsforward.DNSCreateParams{
|
2023-01-09 10:38:31 +00:00
|
|
|
DNSFilter: filters,
|
|
|
|
Stats: sts,
|
|
|
|
QueryLog: qlog,
|
2022-03-18 10:37:27 +00:00
|
|
|
PrivateNets: privateNets,
|
|
|
|
Anonymizer: anonymizer,
|
|
|
|
LocalDomain: config.DHCP.LocalDomainName,
|
2023-01-09 10:38:31 +00:00
|
|
|
DHCPServer: dhcpSrv,
|
2020-06-23 10:13:13 +01:00
|
|
|
}
|
2021-03-25 13:00:27 +00:00
|
|
|
|
|
|
|
Context.dnsServer, err = dnsforward.NewServer(p)
|
|
|
|
if err != nil {
|
|
|
|
closeDNSServer()
|
|
|
|
|
|
|
|
return fmt.Errorf("dnsforward.NewServer: %w", err)
|
|
|
|
}
|
|
|
|
|
2020-09-08 11:56:45 +01:00
|
|
|
Context.clients.dnsServer = Context.dnsServer
|
2023-01-09 10:38:31 +00:00
|
|
|
|
|
|
|
dnsConf, err := generateServerConfig(tlsConf, httpReg)
|
2020-12-07 14:58:33 +00:00
|
|
|
if err != nil {
|
|
|
|
closeDNSServer()
|
2021-03-25 13:00:27 +00:00
|
|
|
|
2020-12-07 14:58:33 +00:00
|
|
|
return fmt.Errorf("generateServerConfig: %w", err)
|
|
|
|
}
|
|
|
|
|
2023-01-09 10:38:31 +00:00
|
|
|
err = Context.dnsServer.Prepare(&dnsConf)
|
2019-12-11 09:38:58 +00:00
|
|
|
if err != nil {
|
2020-01-16 11:25:40 +00:00
|
|
|
closeDNSServer()
|
2021-12-06 14:26:43 +00:00
|
|
|
|
2020-11-05 12:20:57 +00:00
|
|
|
return fmt.Errorf("dnsServer.Prepare: %w", err)
|
2019-12-11 09:38:58 +00:00
|
|
|
}
|
2019-05-21 12:53:13 +01:00
|
|
|
|
2022-04-26 13:21:45 +01:00
|
|
|
if config.Clients.Sources.RDNS {
|
|
|
|
Context.rdns = NewRDNS(Context.dnsServer, &Context.clients, config.DNS.UsePrivateRDNS)
|
|
|
|
}
|
2022-04-26 11:04:16 +01:00
|
|
|
|
2022-04-26 13:21:45 +01:00
|
|
|
if config.Clients.Sources.WHOIS {
|
2022-04-26 11:04:16 +01:00
|
|
|
Context.whois = initWHOIS(&Context.clients)
|
|
|
|
}
|
2019-10-07 13:57:34 +01:00
|
|
|
|
2019-12-11 09:38:58 +00:00
|
|
|
return nil
|
2019-02-10 17:47:43 +00:00
|
|
|
}
|
2018-10-11 18:52:23 +01:00
|
|
|
|
2023-01-09 10:38:31 +00:00
|
|
|
// parseSubnetSet parses a slice of subnets. If the slice is empty, it returns
|
|
|
|
// a subnet set that matches all locally served networks, see
|
|
|
|
// [netutil.IsLocallyServed].
|
|
|
|
func parseSubnetSet(nets []string) (s netutil.SubnetSet, err error) {
|
|
|
|
switch len(nets) {
|
|
|
|
case 0:
|
|
|
|
// Use an optimized function-based matcher.
|
|
|
|
return netutil.SubnetSetFunc(netutil.IsLocallyServed), nil
|
|
|
|
case 1:
|
|
|
|
s, err = netutil.ParseSubnet(nets[0])
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
|
|
|
return s, nil
|
|
|
|
default:
|
|
|
|
var nets []*net.IPNet
|
|
|
|
nets, err = netutil.ParseSubnets(config.DNS.PrivateNets...)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
|
|
|
return netutil.SliceSubnetSet(nets), nil
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2018-10-11 18:52:23 +01:00
|
|
|
func isRunning() bool {
|
2019-12-11 09:38:58 +00:00
|
|
|
return Context.dnsServer != nil && Context.dnsServer.IsRunning()
|
2018-10-11 18:52:23 +01:00
|
|
|
}
|
|
|
|
|
2021-06-29 13:53:28 +01:00
|
|
|
func onDNSRequest(pctx *proxy.DNSContext) {
|
2022-11-09 11:37:07 +00:00
|
|
|
ip := netutil.NetAddrToAddrPort(pctx.Addr).Addr()
|
|
|
|
if ip == (netip.Addr{}) {
|
2021-03-31 13:00:47 +01:00
|
|
|
// This would be quite weird if we get here.
|
2019-06-04 18:38:53 +01:00
|
|
|
return
|
|
|
|
}
|
|
|
|
|
2022-04-26 11:04:16 +01:00
|
|
|
srcs := config.Clients.Sources
|
|
|
|
if srcs.RDNS && !ip.IsLoopback() {
|
2019-12-11 09:38:58 +00:00
|
|
|
Context.rdns.Begin(ip)
|
2019-06-25 14:14:52 +01:00
|
|
|
}
|
2022-11-09 11:37:07 +00:00
|
|
|
|
|
|
|
if srcs.WHOIS && !netutil.IsSpecialPurposeAddr(ip) {
|
2019-12-11 09:38:58 +00:00
|
|
|
Context.whois.Begin(ip)
|
2019-06-25 14:14:52 +01:00
|
|
|
}
|
2019-05-21 12:53:13 +01:00
|
|
|
}
|
|
|
|
|
2022-10-14 13:29:44 +01:00
|
|
|
func ipsToTCPAddrs(ips []netip.Addr, port int) (tcpAddrs []*net.TCPAddr) {
|
2021-03-23 09:32:07 +00:00
|
|
|
if ips == nil {
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2022-10-14 13:29:44 +01:00
|
|
|
tcpAddrs = make([]*net.TCPAddr, 0, len(ips))
|
|
|
|
for _, ip := range ips {
|
|
|
|
tcpAddrs = append(tcpAddrs, net.TCPAddrFromAddrPort(netip.AddrPortFrom(ip, uint16(port))))
|
2021-03-23 09:32:07 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
return tcpAddrs
|
|
|
|
}
|
|
|
|
|
2022-10-14 13:29:44 +01:00
|
|
|
func ipsToUDPAddrs(ips []netip.Addr, port int) (udpAddrs []*net.UDPAddr) {
|
2021-03-23 09:32:07 +00:00
|
|
|
if ips == nil {
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2022-10-14 13:29:44 +01:00
|
|
|
udpAddrs = make([]*net.UDPAddr, 0, len(ips))
|
|
|
|
for _, ip := range ips {
|
|
|
|
udpAddrs = append(udpAddrs, net.UDPAddrFromAddrPort(netip.AddrPortFrom(ip, uint16(port))))
|
2021-03-23 09:32:07 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
return udpAddrs
|
|
|
|
}
|
|
|
|
|
2023-01-09 10:38:31 +00:00
|
|
|
func generateServerConfig(
|
|
|
|
tlsConf *tlsConfigSettings,
|
|
|
|
httpReg aghhttp.RegisterFunc,
|
|
|
|
) (newConf dnsforward.ServerConfig, err error) {
|
2021-03-23 09:32:07 +00:00
|
|
|
dnsConf := config.DNS
|
2022-11-09 11:37:07 +00:00
|
|
|
hosts := aghalg.CoalesceSlice(dnsConf.BindHosts, []netip.Addr{netutil.IPv4Localhost()})
|
2021-03-23 09:32:07 +00:00
|
|
|
newConf = dnsforward.ServerConfig{
|
|
|
|
UDPListenAddrs: ipsToUDPAddrs(hosts, dnsConf.Port),
|
|
|
|
TCPListenAddrs: ipsToTCPAddrs(hosts, dnsConf.Port),
|
|
|
|
FilteringConfig: dnsConf.FilteringConfig,
|
2019-10-30 08:52:58 +00:00
|
|
|
ConfigModified: onConfigModified,
|
2023-01-09 10:38:31 +00:00
|
|
|
HTTPRegister: httpReg,
|
2019-10-30 08:52:58 +00:00
|
|
|
OnDNSRequest: onDNSRequest,
|
2023-01-23 16:10:56 +00:00
|
|
|
UseDNS64: config.DNS.UseDNS64,
|
|
|
|
DNS64Prefixes: config.DNS.DNS64Prefixes,
|
2018-11-28 13:45:30 +00:00
|
|
|
}
|
|
|
|
|
2020-02-19 12:28:06 +00:00
|
|
|
if tlsConf.Enabled {
|
2021-03-23 09:32:07 +00:00
|
|
|
newConf.TLSConfig = tlsConf.TLSConfig
|
|
|
|
newConf.TLSConfig.ServerName = tlsConf.ServerName
|
2020-08-27 13:03:07 +01:00
|
|
|
|
2022-05-31 15:28:50 +01:00
|
|
|
if tlsConf.PortHTTPS != 0 {
|
|
|
|
newConf.HTTPSListenAddrs = ipsToTCPAddrs(hosts, tlsConf.PortHTTPS)
|
|
|
|
}
|
|
|
|
|
2020-02-19 12:28:06 +00:00
|
|
|
if tlsConf.PortDNSOverTLS != 0 {
|
2021-03-23 09:32:07 +00:00
|
|
|
newConf.TLSListenAddrs = ipsToTCPAddrs(hosts, tlsConf.PortDNSOverTLS)
|
2019-02-14 15:00:23 +00:00
|
|
|
}
|
2020-08-27 13:03:07 +01:00
|
|
|
|
|
|
|
if tlsConf.PortDNSOverQUIC != 0 {
|
2021-03-23 09:32:07 +00:00
|
|
|
newConf.QUICListenAddrs = ipsToUDPAddrs(hosts, tlsConf.PortDNSOverQUIC)
|
2020-08-27 13:03:07 +01:00
|
|
|
}
|
2020-12-07 14:58:33 +00:00
|
|
|
|
|
|
|
if tlsConf.PortDNSCrypt != 0 {
|
2023-01-09 10:38:31 +00:00
|
|
|
newConf.DNSCryptConfig, err = newDNSCrypt(hosts, *tlsConf)
|
2020-12-07 14:58:33 +00:00
|
|
|
if err != nil {
|
|
|
|
// Don't wrap the error, because it's already
|
|
|
|
// wrapped by newDNSCrypt.
|
|
|
|
return dnsforward.ServerConfig{}, err
|
|
|
|
}
|
|
|
|
}
|
2019-02-12 14:23:38 +00:00
|
|
|
}
|
2020-12-07 14:58:33 +00:00
|
|
|
|
2021-03-23 09:32:07 +00:00
|
|
|
newConf.TLSv12Roots = Context.tlsRoots
|
2021-06-18 16:13:36 +01:00
|
|
|
newConf.TLSAllowUnencryptedDoH = tlsConf.AllowUnencryptedDoH
|
2019-02-12 14:23:38 +00:00
|
|
|
|
2021-03-23 09:32:07 +00:00
|
|
|
newConf.FilterHandler = applyAdditionalFiltering
|
2021-05-28 11:02:59 +01:00
|
|
|
newConf.GetCustomUpstreamByClient = Context.clients.findUpstreams
|
2020-12-07 14:58:33 +00:00
|
|
|
|
2021-04-07 18:16:06 +01:00
|
|
|
newConf.LocalPTRResolvers = dnsConf.LocalPTRResolvers
|
2021-06-15 15:36:49 +01:00
|
|
|
newConf.UpstreamTimeout = dnsConf.UpstreamTimeout.Duration
|
2021-04-07 18:16:06 +01:00
|
|
|
|
2022-10-03 16:08:05 +01:00
|
|
|
newConf.ResolveClients = config.Clients.Sources.RDNS
|
|
|
|
newConf.UsePrivateRDNS = dnsConf.UsePrivateRDNS
|
|
|
|
newConf.ServeHTTP3 = dnsConf.ServeHTTP3
|
|
|
|
newConf.UseHTTP3Upstreams = dnsConf.UseHTTP3Upstreams
|
|
|
|
|
2021-03-23 09:32:07 +00:00
|
|
|
return newConf, nil
|
2020-12-07 14:58:33 +00:00
|
|
|
}
|
|
|
|
|
2022-10-14 13:29:44 +01:00
|
|
|
func newDNSCrypt(hosts []netip.Addr, tlsConf tlsConfigSettings) (dnscc dnsforward.DNSCryptConfig, err error) {
|
2020-12-07 14:58:33 +00:00
|
|
|
if tlsConf.DNSCryptConfigFile == "" {
|
2021-05-24 15:28:11 +01:00
|
|
|
return dnscc, errors.Error("no dnscrypt_config_file")
|
2020-12-07 14:58:33 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
f, err := os.Open(tlsConf.DNSCryptConfigFile)
|
|
|
|
if err != nil {
|
|
|
|
return dnscc, fmt.Errorf("opening dnscrypt config: %w", err)
|
|
|
|
}
|
2021-05-24 15:28:11 +01:00
|
|
|
defer func() { err = errors.WithDeferred(err, f.Close()) }()
|
2020-12-07 14:58:33 +00:00
|
|
|
|
|
|
|
rc := &dnscrypt.ResolverConfig{}
|
|
|
|
err = yaml.NewDecoder(f).Decode(rc)
|
|
|
|
if err != nil {
|
|
|
|
return dnscc, fmt.Errorf("decoding dnscrypt config: %w", err)
|
|
|
|
}
|
|
|
|
|
|
|
|
cert, err := rc.CreateCert()
|
|
|
|
if err != nil {
|
|
|
|
return dnscc, fmt.Errorf("creating dnscrypt cert: %w", err)
|
|
|
|
}
|
|
|
|
|
|
|
|
return dnsforward.DNSCryptConfig{
|
2021-03-23 09:32:07 +00:00
|
|
|
ResolverCert: cert,
|
|
|
|
ProviderName: rc.ProviderName,
|
2022-08-29 13:54:41 +01:00
|
|
|
UDPListenAddrs: ipsToUDPAddrs(hosts, tlsConf.PortDNSCrypt),
|
|
|
|
TCPListenAddrs: ipsToTCPAddrs(hosts, tlsConf.PortDNSCrypt),
|
2021-03-23 09:32:07 +00:00
|
|
|
Enabled: true,
|
2020-12-07 14:58:33 +00:00
|
|
|
}, nil
|
2018-11-28 15:57:20 +00:00
|
|
|
}
|
|
|
|
|
2020-12-07 13:04:53 +00:00
|
|
|
type dnsEncryption struct {
|
2020-10-08 09:34:36 +01:00
|
|
|
https string
|
|
|
|
tls string
|
|
|
|
quic string
|
|
|
|
}
|
2020-02-27 08:48:59 +00:00
|
|
|
|
2021-01-27 15:32:13 +00:00
|
|
|
func getDNSEncryption() (de dnsEncryption) {
|
2020-02-27 08:48:59 +00:00
|
|
|
tlsConf := tlsConfigSettings{}
|
2020-10-08 09:34:36 +01:00
|
|
|
|
2020-02-27 08:48:59 +00:00
|
|
|
Context.tls.WriteDiskConfig(&tlsConf)
|
2020-10-08 09:34:36 +01:00
|
|
|
|
2020-02-27 08:48:59 +00:00
|
|
|
if tlsConf.Enabled && len(tlsConf.ServerName) != 0 {
|
2021-01-27 15:32:13 +00:00
|
|
|
hostname := tlsConf.ServerName
|
2020-02-27 08:48:59 +00:00
|
|
|
if tlsConf.PortHTTPS != 0 {
|
2021-01-27 15:32:13 +00:00
|
|
|
addr := hostname
|
2021-09-17 16:31:07 +01:00
|
|
|
if tlsConf.PortHTTPS != defaultPortHTTPS {
|
2021-08-09 14:03:37 +01:00
|
|
|
addr = netutil.JoinHostPort(addr, tlsConf.PortHTTPS)
|
2020-02-27 08:48:59 +00:00
|
|
|
}
|
2021-01-27 15:32:13 +00:00
|
|
|
|
|
|
|
de.https = (&url.URL{
|
|
|
|
Scheme: "https",
|
|
|
|
Host: addr,
|
|
|
|
Path: "/dns-query",
|
|
|
|
}).String()
|
2020-02-27 08:48:59 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
if tlsConf.PortDNSOverTLS != 0 {
|
2021-01-27 15:32:13 +00:00
|
|
|
de.tls = (&url.URL{
|
|
|
|
Scheme: "tls",
|
2021-08-09 14:03:37 +01:00
|
|
|
Host: netutil.JoinHostPort(hostname, tlsConf.PortDNSOverTLS),
|
2021-01-27 15:32:13 +00:00
|
|
|
}).String()
|
2020-02-27 08:48:59 +00:00
|
|
|
}
|
2020-08-27 13:03:07 +01:00
|
|
|
|
|
|
|
if tlsConf.PortDNSOverQUIC != 0 {
|
2021-01-27 15:32:13 +00:00
|
|
|
de.quic = (&url.URL{
|
|
|
|
Scheme: "quic",
|
2021-08-09 14:03:37 +01:00
|
|
|
Host: netutil.JoinHostPort(hostname, tlsConf.PortDNSOverQUIC),
|
2021-01-27 15:32:13 +00:00
|
|
|
}).String()
|
2020-08-27 13:03:07 +01:00
|
|
|
}
|
2020-02-27 08:48:59 +00:00
|
|
|
}
|
|
|
|
|
2021-01-27 15:32:13 +00:00
|
|
|
return de
|
2020-10-08 09:34:36 +01:00
|
|
|
}
|
|
|
|
|
2021-01-27 15:32:13 +00:00
|
|
|
// applyAdditionalFiltering adds additional client information and settings if
|
|
|
|
// the client has them.
|
2022-04-27 12:06:10 +01:00
|
|
|
func applyAdditionalFiltering(clientIP net.IP, clientID string, setts *filtering.Settings) {
|
2022-09-23 11:23:35 +01:00
|
|
|
// pref is a prefix for logging messages around the scope.
|
|
|
|
const pref = "applying filters"
|
2019-07-23 10:21:37 +01:00
|
|
|
|
2022-10-03 15:30:03 +01:00
|
|
|
Context.filters.ApplyBlockedServices(setts, nil)
|
|
|
|
|
2022-09-23 11:23:35 +01:00
|
|
|
log.Debug("%s: looking for client with ip %s and clientid %q", pref, clientIP, clientID)
|
2022-04-27 12:06:10 +01:00
|
|
|
|
|
|
|
if clientIP == nil {
|
2019-07-23 10:21:37 +01:00
|
|
|
return
|
|
|
|
}
|
2021-01-27 15:32:13 +00:00
|
|
|
|
2022-04-27 12:06:10 +01:00
|
|
|
setts.ClientIP = clientIP
|
2019-07-23 10:21:37 +01:00
|
|
|
|
2021-01-27 15:32:13 +00:00
|
|
|
c, ok := Context.clients.Find(clientID)
|
2019-07-23 10:21:37 +01:00
|
|
|
if !ok {
|
2022-04-27 12:06:10 +01:00
|
|
|
c, ok = Context.clients.Find(clientIP.String())
|
2021-01-27 15:32:13 +00:00
|
|
|
if !ok {
|
2022-09-23 11:23:35 +01:00
|
|
|
log.Debug("%s: no clients with ip %s and clientid %q", pref, clientIP, clientID)
|
2022-04-27 12:06:10 +01:00
|
|
|
|
2021-01-27 15:32:13 +00:00
|
|
|
return
|
|
|
|
}
|
2019-04-26 14:07:12 +01:00
|
|
|
}
|
|
|
|
|
2022-09-23 11:23:35 +01:00
|
|
|
log.Debug("%s: using settings for client %q (%s; %q)", pref, c.Name, clientIP, clientID)
|
2019-07-23 10:21:37 +01:00
|
|
|
|
|
|
|
if c.UseOwnBlockedServices {
|
2022-10-03 15:30:03 +01:00
|
|
|
// TODO(e.burkov): Get rid of this crutch.
|
|
|
|
svcs := c.BlockedServices
|
|
|
|
if svcs == nil {
|
|
|
|
svcs = []string{}
|
|
|
|
}
|
|
|
|
Context.filters.ApplyBlockedServices(setts, svcs)
|
2022-10-03 15:48:11 +01:00
|
|
|
log.Debug("%s: services for client %q set: %s", pref, c.Name, svcs)
|
2019-07-23 10:21:37 +01:00
|
|
|
}
|
|
|
|
|
2020-06-23 12:36:26 +01:00
|
|
|
setts.ClientName = c.Name
|
2020-01-28 11:06:52 +00:00
|
|
|
setts.ClientTags = c.Tags
|
2019-07-23 10:21:37 +01:00
|
|
|
if !c.UseOwnSettings {
|
|
|
|
return
|
|
|
|
}
|
|
|
|
|
2019-06-06 19:04:17 +01:00
|
|
|
setts.FilteringEnabled = c.FilteringEnabled
|
2023-03-15 11:31:07 +00:00
|
|
|
setts.SafeSearchEnabled = c.safeSearchConf.Enabled
|
|
|
|
setts.ClientSafeSearch = c.SafeSearch
|
2019-06-06 19:04:17 +01:00
|
|
|
setts.SafeBrowsingEnabled = c.SafeBrowsingEnabled
|
2019-06-06 20:42:17 +01:00
|
|
|
setts.ParentalEnabled = c.ParentalEnabled
|
2019-04-26 14:07:12 +01:00
|
|
|
}
|
|
|
|
|
2018-11-28 15:57:20 +00:00
|
|
|
func startDNSServer() error {
|
2021-05-24 12:48:42 +01:00
|
|
|
config.RLock()
|
|
|
|
defer config.RUnlock()
|
2021-05-17 14:50:02 +01:00
|
|
|
|
2018-11-28 15:57:20 +00:00
|
|
|
if isRunning() {
|
2019-01-25 13:01:27 +00:00
|
|
|
return fmt.Errorf("unable to start forwarding DNS server: Already running")
|
2018-11-28 15:57:20 +00:00
|
|
|
}
|
2018-10-17 18:43:26 +01:00
|
|
|
|
2022-09-23 11:23:35 +01:00
|
|
|
Context.filters.EnableFilters(false)
|
2019-10-09 17:51:26 +01:00
|
|
|
|
2020-02-18 16:27:09 +00:00
|
|
|
Context.clients.Start()
|
|
|
|
|
2019-12-11 09:38:58 +00:00
|
|
|
err := Context.dnsServer.Start()
|
2018-10-11 18:52:23 +01:00
|
|
|
if err != nil {
|
2020-11-05 12:20:57 +00:00
|
|
|
return fmt.Errorf("couldn't start forwarding DNS server: %w", err)
|
2018-10-11 18:52:23 +01:00
|
|
|
}
|
|
|
|
|
2020-03-17 12:00:40 +00:00
|
|
|
Context.filters.Start()
|
2020-01-16 11:25:40 +00:00
|
|
|
Context.stats.Start()
|
|
|
|
Context.queryLog.Start()
|
2019-10-17 12:33:38 +01:00
|
|
|
|
2019-10-10 11:54:26 +01:00
|
|
|
const topClientsNumber = 100 // the number of clients to get
|
2022-08-17 12:09:13 +01:00
|
|
|
for _, ip := range Context.stats.TopClientsIP(topClientsNumber) {
|
2022-04-26 11:04:16 +01:00
|
|
|
srcs := config.Clients.Sources
|
|
|
|
if srcs.RDNS && !ip.IsLoopback() {
|
2019-12-11 09:38:58 +00:00
|
|
|
Context.rdns.Begin(ip)
|
2019-10-10 11:54:26 +01:00
|
|
|
}
|
2022-11-09 11:37:07 +00:00
|
|
|
|
|
|
|
if srcs.WHOIS && !netutil.IsSpecialPurposeAddr(ip) {
|
2019-12-11 09:38:58 +00:00
|
|
|
Context.whois.Begin(ip)
|
2019-10-10 11:54:26 +01:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2018-10-11 18:52:23 +01:00
|
|
|
return nil
|
|
|
|
}
|
2018-11-28 15:57:20 +00:00
|
|
|
|
2020-12-07 14:58:33 +00:00
|
|
|
func reconfigureDNSServer() (err error) {
|
2021-03-23 09:32:07 +00:00
|
|
|
var newConf dnsforward.ServerConfig
|
2023-01-09 10:38:31 +00:00
|
|
|
|
|
|
|
tlsConf := &tlsConfigSettings{}
|
|
|
|
Context.tls.WriteDiskConfig(tlsConf)
|
|
|
|
|
|
|
|
newConf, err = generateServerConfig(tlsConf, httpRegister)
|
2018-11-28 15:57:20 +00:00
|
|
|
if err != nil {
|
2020-12-07 14:58:33 +00:00
|
|
|
return fmt.Errorf("generating forwarding dns server config: %w", err)
|
|
|
|
}
|
|
|
|
|
2021-03-23 09:32:07 +00:00
|
|
|
err = Context.dnsServer.Reconfigure(&newConf)
|
2020-12-07 14:58:33 +00:00
|
|
|
if err != nil {
|
|
|
|
return fmt.Errorf("starting forwarding dns server: %w", err)
|
2018-11-28 15:57:20 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
return nil
|
|
|
|
}
|
2018-12-05 12:36:18 +00:00
|
|
|
|
2022-10-19 14:13:05 +01:00
|
|
|
func stopDNSServer() (err error) {
|
2019-12-16 14:04:30 +00:00
|
|
|
if !isRunning() {
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2022-10-19 14:13:05 +01:00
|
|
|
err = Context.dnsServer.Stop()
|
2018-12-05 12:36:18 +00:00
|
|
|
if err != nil {
|
2022-10-19 14:13:05 +01:00
|
|
|
return fmt.Errorf("stopping forwarding dns server: %w", err)
|
|
|
|
}
|
|
|
|
|
2022-10-21 18:14:43 +01:00
|
|
|
err = Context.clients.close()
|
2022-10-19 14:13:05 +01:00
|
|
|
if err != nil {
|
|
|
|
return fmt.Errorf("closing clients container: %w", err)
|
2018-12-05 12:36:18 +00:00
|
|
|
}
|
|
|
|
|
2020-01-16 11:25:40 +00:00
|
|
|
closeDNSServer()
|
2022-10-19 14:13:05 +01:00
|
|
|
|
2020-01-16 11:25:40 +00:00
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
func closeDNSServer() {
|
2019-09-16 13:54:41 +01:00
|
|
|
// DNS forward module must be closed BEFORE stats or queryLog because it depends on them
|
2020-01-16 11:25:40 +00:00
|
|
|
if Context.dnsServer != nil {
|
|
|
|
Context.dnsServer.Close()
|
|
|
|
Context.dnsServer = nil
|
|
|
|
}
|
|
|
|
|
2022-09-23 11:23:35 +01:00
|
|
|
Context.filters.Close()
|
2019-09-16 13:54:41 +01:00
|
|
|
|
2020-01-16 11:25:40 +00:00
|
|
|
if Context.stats != nil {
|
2022-08-17 12:09:13 +01:00
|
|
|
err := Context.stats.Close()
|
|
|
|
if err != nil {
|
|
|
|
log.Debug("closing stats: %s", err)
|
|
|
|
}
|
|
|
|
|
|
|
|
// TODO(e.burkov): Find out if it's safe.
|
2020-01-16 11:25:40 +00:00
|
|
|
Context.stats = nil
|
|
|
|
}
|
2019-10-09 17:51:26 +01:00
|
|
|
|
2020-01-16 11:25:40 +00:00
|
|
|
if Context.queryLog != nil {
|
|
|
|
Context.queryLog.Close()
|
|
|
|
Context.queryLog = nil
|
|
|
|
}
|
2019-09-16 13:54:41 +01:00
|
|
|
|
2022-09-23 11:23:35 +01:00
|
|
|
log.Debug("all dns modules are closed")
|
2018-12-05 12:36:18 +00:00
|
|
|
}
|
2023-02-13 15:15:33 +00:00
|
|
|
|
2023-03-15 11:31:07 +00:00
|
|
|
// safeSearchResolver is a [filtering.Resolver] implementation used for safe
|
|
|
|
// search.
|
|
|
|
type safeSearchResolver struct{}
|
|
|
|
|
|
|
|
// type check
|
|
|
|
var _ filtering.Resolver = safeSearchResolver{}
|
|
|
|
|
|
|
|
// LookupIP implements [filtering.Resolver] interface for safeSearchResolver.
|
|
|
|
// It returns the slice of net.IP with IPv4 and IPv6 instances.
|
|
|
|
func (r safeSearchResolver) LookupIP(_ context.Context, _, host string) (ips []net.IP, err error) {
|
|
|
|
addrs, err := Context.dnsServer.Resolve(host)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
|
|
|
|
if len(addrs) == 0 {
|
|
|
|
return nil, fmt.Errorf("couldn't lookup host: %s", host)
|
|
|
|
}
|
|
|
|
|
|
|
|
for _, a := range addrs {
|
|
|
|
ips = append(ips, a.IP)
|
|
|
|
}
|
|
|
|
|
|
|
|
return ips, nil
|
|
|
|
}
|