2020-05-08 16:39:37 +01:00
|
|
|
package dnsforward
|
|
|
|
|
|
|
|
import (
|
2021-12-03 14:56:07 +00:00
|
|
|
"encoding/binary"
|
2020-08-18 10:36:52 +01:00
|
|
|
"net"
|
2022-10-26 19:12:51 +01:00
|
|
|
"net/netip"
|
2023-03-17 14:10:33 +00:00
|
|
|
"strconv"
|
2020-06-23 10:13:13 +01:00
|
|
|
"strings"
|
2020-05-08 16:39:37 +01:00
|
|
|
"time"
|
|
|
|
|
2020-10-30 10:32:02 +00:00
|
|
|
"github.com/AdguardTeam/AdGuardHome/internal/dhcpd"
|
2021-05-21 14:15:47 +01:00
|
|
|
"github.com/AdguardTeam/AdGuardHome/internal/filtering"
|
2020-05-08 16:39:37 +01:00
|
|
|
"github.com/AdguardTeam/dnsproxy/proxy"
|
2023-02-06 14:17:51 +00:00
|
|
|
"github.com/AdguardTeam/dnsproxy/upstream"
|
|
|
|
"github.com/AdguardTeam/golibs/errors"
|
2020-05-08 16:39:37 +01:00
|
|
|
"github.com/AdguardTeam/golibs/log"
|
2021-08-09 14:03:37 +01:00
|
|
|
"github.com/AdguardTeam/golibs/netutil"
|
2021-07-29 15:40:31 +01:00
|
|
|
"github.com/AdguardTeam/golibs/stringutil"
|
2020-05-08 16:39:37 +01:00
|
|
|
"github.com/miekg/dns"
|
|
|
|
)
|
|
|
|
|
|
|
|
// To transfer information between modules
|
2023-02-07 14:50:39 +00:00
|
|
|
//
|
|
|
|
// TODO(s.chzhen): Add lowercased, non-FQDN version of the hostname from the
|
2023-04-07 11:17:40 +01:00
|
|
|
// question of the request. Add persistent client.
|
2020-05-08 16:39:37 +01:00
|
|
|
type dnsContext struct {
|
2021-01-27 15:32:13 +00:00
|
|
|
proxyCtx *proxy.DNSContext
|
2021-12-13 15:06:01 +00:00
|
|
|
|
2021-01-27 15:32:13 +00:00
|
|
|
// setts are the filtering settings for the client.
|
2021-12-13 15:06:01 +00:00
|
|
|
setts *filtering.Settings
|
|
|
|
|
|
|
|
result *filtering.Result
|
2021-01-27 15:32:13 +00:00
|
|
|
// origResp is the response received from upstream. It is set when the
|
|
|
|
// response is modified by filters.
|
|
|
|
origResp *dns.Msg
|
2021-12-13 15:06:01 +00:00
|
|
|
|
2023-01-23 16:10:56 +00:00
|
|
|
// unreversedReqIP stores an IP address obtained from a PTR request if it
|
|
|
|
// was parsed successfully and belongs to one of the locally served IP
|
|
|
|
// ranges. It is also filled with unmapped version of the address if it's
|
|
|
|
// within DNS64 prefixes.
|
2023-03-17 14:10:33 +00:00
|
|
|
//
|
|
|
|
// TODO(e.burkov): Use netip.Addr when we switch to netip more fully.
|
2021-03-31 13:00:47 +01:00
|
|
|
unreversedReqIP net.IP
|
2021-12-13 15:06:01 +00:00
|
|
|
|
2021-01-27 15:32:13 +00:00
|
|
|
// err is the error returned from a processing function.
|
|
|
|
err error
|
2021-12-13 15:06:01 +00:00
|
|
|
|
2022-02-10 12:42:59 +00:00
|
|
|
// clientID is the ClientID from DoH, DoQ, or DoT, if provided.
|
2021-01-27 15:32:13 +00:00
|
|
|
clientID string
|
2021-12-13 15:06:01 +00:00
|
|
|
|
2021-01-27 15:32:13 +00:00
|
|
|
// origQuestion is the question received from the client. It is set
|
|
|
|
// when the request is modified by rewrites.
|
|
|
|
origQuestion dns.Question
|
2021-12-13 15:06:01 +00:00
|
|
|
|
|
|
|
// startTime is the time at which the processing of the request has started.
|
|
|
|
startTime time.Time
|
|
|
|
|
2021-01-27 15:32:13 +00:00
|
|
|
// protectionEnabled shows if the filtering is enabled, and if the
|
|
|
|
// server's DNS filter is ready.
|
|
|
|
protectionEnabled bool
|
2021-12-13 15:06:01 +00:00
|
|
|
|
2021-01-27 15:32:13 +00:00
|
|
|
// responseFromUpstream shows if the response is received from the
|
|
|
|
// upstream servers.
|
|
|
|
responseFromUpstream bool
|
2021-12-13 15:06:01 +00:00
|
|
|
|
|
|
|
// responseAD shows if the response had the AD bit set.
|
|
|
|
responseAD bool
|
|
|
|
|
2023-01-23 16:10:56 +00:00
|
|
|
// isLocalClient shows if client's IP address is from locally served
|
2021-04-08 16:07:29 +01:00
|
|
|
// network.
|
|
|
|
isLocalClient bool
|
2020-05-08 16:39:37 +01:00
|
|
|
}
|
|
|
|
|
2021-01-27 15:32:13 +00:00
|
|
|
// resultCode is the result of a request processing function.
|
|
|
|
type resultCode int
|
|
|
|
|
2020-05-08 16:39:37 +01:00
|
|
|
const (
|
2021-01-27 15:32:13 +00:00
|
|
|
// resultCodeSuccess is returned when a handler performed successfully,
|
|
|
|
// and the next handler must be called.
|
|
|
|
resultCodeSuccess resultCode = iota
|
|
|
|
// resultCodeFinish is returned when a handler performed successfully,
|
|
|
|
// and the processing of the request must be stopped.
|
|
|
|
resultCodeFinish
|
|
|
|
// resultCodeError is returned when a handler failed, and the processing
|
|
|
|
// of the request must be stopped.
|
|
|
|
resultCodeError
|
2020-05-08 16:39:37 +01:00
|
|
|
)
|
|
|
|
|
2022-04-27 09:39:48 +01:00
|
|
|
// ddrHostFQDN is the FQDN used in Discovery of Designated Resolvers (DDR) requests.
|
|
|
|
// See https://www.ietf.org/archive/id/draft-ietf-add-ddr-06.html.
|
|
|
|
const ddrHostFQDN = "_dns.resolver.arpa."
|
|
|
|
|
2020-05-08 16:39:37 +01:00
|
|
|
// handleDNSRequest filters the incoming DNS requests and writes them to the query log
|
2022-09-02 12:52:19 +01:00
|
|
|
func (s *Server) handleDNSRequest(_ *proxy.Proxy, pctx *proxy.DNSContext) error {
|
|
|
|
dctx := &dnsContext{
|
|
|
|
proxyCtx: pctx,
|
2021-05-21 14:15:47 +01:00
|
|
|
result: &filtering.Result{},
|
2021-01-27 15:32:13 +00:00
|
|
|
startTime: time.Now(),
|
|
|
|
}
|
2020-05-08 16:39:37 +01:00
|
|
|
|
2021-01-27 15:32:13 +00:00
|
|
|
type modProcessFunc func(ctx *dnsContext) (rc resultCode)
|
2020-12-28 16:26:37 +00:00
|
|
|
|
|
|
|
// Since (*dnsforward.Server).handleDNSRequest(...) is used as
|
|
|
|
// proxy.(Config).RequestHandler, there is no need for additional index
|
|
|
|
// out of range checking in any of the following functions, because the
|
|
|
|
// (*proxy.Proxy).handleDNSRequest method performs it before calling the
|
|
|
|
// appropriate handler.
|
2020-05-08 16:39:37 +01:00
|
|
|
mods := []modProcessFunc{
|
2021-05-27 17:19:19 +01:00
|
|
|
s.processRecursion,
|
2021-11-15 14:42:10 +00:00
|
|
|
s.processInitial,
|
2022-04-27 09:39:48 +01:00
|
|
|
s.processDDRQuery,
|
2021-04-08 16:07:29 +01:00
|
|
|
s.processDetermineLocal,
|
2022-06-28 17:09:26 +01:00
|
|
|
s.processDHCPHosts,
|
2021-03-31 13:00:47 +01:00
|
|
|
s.processRestrictLocal,
|
2022-06-28 17:09:26 +01:00
|
|
|
s.processDHCPAddrs,
|
2021-10-20 17:52:13 +01:00
|
|
|
s.processFilteringBeforeRequest,
|
2021-03-31 13:00:47 +01:00
|
|
|
s.processLocalPTR,
|
2021-05-27 17:19:19 +01:00
|
|
|
s.processUpstream,
|
2021-11-15 14:42:10 +00:00
|
|
|
s.processFilteringAfterResponse,
|
2020-09-02 12:13:45 +01:00
|
|
|
s.ipset.process,
|
2021-11-15 14:42:10 +00:00
|
|
|
s.processQueryLogsAndStats,
|
2020-05-08 16:39:37 +01:00
|
|
|
}
|
|
|
|
for _, process := range mods {
|
2022-09-02 12:52:19 +01:00
|
|
|
r := process(dctx)
|
2020-05-08 16:39:37 +01:00
|
|
|
switch r {
|
2021-01-27 15:32:13 +00:00
|
|
|
case resultCodeSuccess:
|
2020-05-08 16:39:37 +01:00
|
|
|
// continue: call the next filter
|
|
|
|
|
2021-01-27 15:32:13 +00:00
|
|
|
case resultCodeFinish:
|
2020-05-08 16:39:37 +01:00
|
|
|
return nil
|
|
|
|
|
2021-01-27 15:32:13 +00:00
|
|
|
case resultCodeError:
|
2022-09-02 12:52:19 +01:00
|
|
|
return dctx.err
|
2020-05-08 16:39:37 +01:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2022-09-02 12:52:19 +01:00
|
|
|
if pctx.Res != nil {
|
|
|
|
// Some devices require DNS message compression.
|
|
|
|
pctx.Res.Compress = true
|
2020-05-08 16:39:37 +01:00
|
|
|
}
|
2022-09-02 12:52:19 +01:00
|
|
|
|
2020-05-08 16:39:37 +01:00
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2023-01-23 16:10:56 +00:00
|
|
|
// processRecursion checks the incoming request and halts its handling by
|
|
|
|
// answering NXDOMAIN if s has tried to resolve it recently.
|
2021-05-27 17:19:19 +01:00
|
|
|
func (s *Server) processRecursion(dctx *dnsContext) (rc resultCode) {
|
|
|
|
pctx := dctx.proxyCtx
|
|
|
|
|
|
|
|
if msg := pctx.Req; msg != nil && s.recDetector.check(*msg) {
|
|
|
|
log.Debug("recursion detected resolving %q", msg.Question[0].Name)
|
|
|
|
pctx.Res = s.genNXDomain(pctx.Req)
|
|
|
|
|
|
|
|
return resultCodeFinish
|
|
|
|
}
|
|
|
|
|
|
|
|
return resultCodeSuccess
|
|
|
|
}
|
|
|
|
|
2021-12-03 14:56:07 +00:00
|
|
|
// processInitial terminates the following processing for some requests if
|
|
|
|
// needed and enriches the ctx with some client-specific information.
|
|
|
|
//
|
|
|
|
// TODO(e.burkov): Decompose into less general processors.
|
2022-09-02 12:52:19 +01:00
|
|
|
func (s *Server) processInitial(dctx *dnsContext) (rc resultCode) {
|
|
|
|
pctx := dctx.proxyCtx
|
|
|
|
q := pctx.Req.Question[0]
|
|
|
|
qt := q.Qtype
|
|
|
|
if s.conf.AAAADisabled && qt == dns.TypeAAAA {
|
|
|
|
_ = proxy.CheckDisabledAAAARequest(pctx, true)
|
|
|
|
|
2021-01-27 15:32:13 +00:00
|
|
|
return resultCodeFinish
|
2020-05-08 16:39:37 +01:00
|
|
|
}
|
|
|
|
|
|
|
|
if s.conf.OnDNSRequest != nil {
|
2022-09-02 12:52:19 +01:00
|
|
|
s.conf.OnDNSRequest(pctx)
|
2020-05-08 16:39:37 +01:00
|
|
|
}
|
|
|
|
|
2022-09-02 12:52:19 +01:00
|
|
|
// Disable Mozilla DoH.
|
|
|
|
//
|
|
|
|
// See https://support.mozilla.org/en-US/kb/canary-domain-use-application-dnsnet.
|
|
|
|
if (qt == dns.TypeA || qt == dns.TypeAAAA) && q.Name == "use-application-dns.net." {
|
|
|
|
pctx.Res = s.genNXDomain(pctx.Req)
|
|
|
|
|
2021-01-27 15:32:13 +00:00
|
|
|
return resultCodeFinish
|
2020-05-08 16:39:37 +01:00
|
|
|
}
|
|
|
|
|
2023-03-26 21:12:24 +01:00
|
|
|
// Handle a reserved domain healthcheck.adguardhome.test.
|
|
|
|
//
|
|
|
|
// [Section 6.2 of RFC 6761] states that DNS Registries/Registrars must not
|
|
|
|
// grant requests to register test names in the normal way to any person or
|
|
|
|
// entity, making domain names under test. TLD free to use in internal
|
|
|
|
// purposes.
|
|
|
|
//
|
|
|
|
// [Section 6.2 of RFC 6761]: https://www.rfc-editor.org/rfc/rfc6761.html#section-6.2
|
|
|
|
if q.Name == "healthcheck.adguardhome.test." {
|
|
|
|
// Generate a NODATA negative response to make nslookup exit with 0.
|
|
|
|
pctx.Res = s.makeResponse(pctx.Req)
|
|
|
|
|
|
|
|
return resultCodeFinish
|
|
|
|
}
|
|
|
|
|
2022-09-02 12:52:19 +01:00
|
|
|
// Get the ClientID, if any, before getting client-specific filtering
|
|
|
|
// settings.
|
2021-12-03 14:56:07 +00:00
|
|
|
var key [8]byte
|
2022-09-02 12:52:19 +01:00
|
|
|
binary.BigEndian.PutUint64(key[:], pctx.RequestID)
|
|
|
|
dctx.clientID = string(s.clientIDCache.Get(key[:]))
|
2021-12-03 14:56:07 +00:00
|
|
|
|
|
|
|
// Get the client-specific filtering settings.
|
2023-04-11 13:02:29 +01:00
|
|
|
dctx.protectionEnabled, _ = s.UpdatedProtectionStatus()
|
2022-09-02 12:52:19 +01:00
|
|
|
dctx.setts = s.getClientRequestFilteringSettings(dctx)
|
2021-11-15 14:42:10 +00:00
|
|
|
|
2021-01-27 15:32:13 +00:00
|
|
|
return resultCodeSuccess
|
2020-05-08 16:39:37 +01:00
|
|
|
}
|
|
|
|
|
2021-04-15 15:52:53 +01:00
|
|
|
func (s *Server) setTableHostToIP(t hostToIPTable) {
|
|
|
|
s.tableHostToIPLock.Lock()
|
|
|
|
defer s.tableHostToIPLock.Unlock()
|
|
|
|
|
|
|
|
s.tableHostToIP = t
|
|
|
|
}
|
|
|
|
|
2022-10-26 19:12:51 +01:00
|
|
|
func (s *Server) setTableIPToHost(t ipToHostTable) {
|
2021-04-15 15:52:53 +01:00
|
|
|
s.tableIPToHostLock.Lock()
|
|
|
|
defer s.tableIPToHostLock.Unlock()
|
|
|
|
|
|
|
|
s.tableIPToHost = t
|
|
|
|
}
|
|
|
|
|
2020-06-23 10:13:13 +01:00
|
|
|
func (s *Server) onDHCPLeaseChanged(flags int) {
|
|
|
|
switch flags {
|
|
|
|
case dhcpd.LeaseChangedAdded,
|
|
|
|
dhcpd.LeaseChangedAddedStatic,
|
|
|
|
dhcpd.LeaseChangedRemovedStatic:
|
2021-04-15 15:52:53 +01:00
|
|
|
// Go on.
|
|
|
|
case dhcpd.LeaseChangedRemovedAll:
|
2022-10-26 19:12:51 +01:00
|
|
|
s.setTableHostToIP(nil)
|
|
|
|
s.setTableIPToHost(nil)
|
|
|
|
|
|
|
|
return
|
2020-06-23 10:13:13 +01:00
|
|
|
default:
|
|
|
|
return
|
|
|
|
}
|
|
|
|
|
2022-10-26 19:12:51 +01:00
|
|
|
ll := s.dhcpServer.Leases(dhcpd.LeasesAll)
|
|
|
|
hostToIP := make(hostToIPTable, len(ll))
|
|
|
|
ipToHost := make(ipToHostTable, len(ll))
|
|
|
|
|
|
|
|
for _, l := range ll {
|
|
|
|
// TODO(a.garipov): Remove this after we're finished with the client
|
|
|
|
// hostname validations in the DHCP server code.
|
2023-02-21 13:52:33 +00:00
|
|
|
err := netutil.ValidateHostname(l.Hostname)
|
2022-10-26 19:12:51 +01:00
|
|
|
if err != nil {
|
|
|
|
log.Debug("dnsforward: skipping invalid hostname %q from dhcp: %s", l.Hostname, err)
|
2020-08-18 10:36:52 +01:00
|
|
|
|
2022-10-26 19:12:51 +01:00
|
|
|
continue
|
|
|
|
}
|
2021-06-29 13:53:28 +01:00
|
|
|
|
2022-10-26 19:12:51 +01:00
|
|
|
lowhost := strings.ToLower(l.Hostname + "." + s.localDomainSuffix)
|
2020-08-18 15:40:36 +01:00
|
|
|
|
2022-10-26 19:12:51 +01:00
|
|
|
// Assume that we only process IPv4 now.
|
2023-03-23 13:52:01 +00:00
|
|
|
if !l.IP.Is4() {
|
|
|
|
log.Debug("dnsforward: skipping invalid ip from dhcp: bad ipv4 net.IP %v", l.IP)
|
2020-08-18 10:36:52 +01:00
|
|
|
|
2022-10-26 19:12:51 +01:00
|
|
|
continue
|
2021-04-15 15:52:53 +01:00
|
|
|
}
|
2020-08-18 10:36:52 +01:00
|
|
|
|
2023-03-23 13:52:01 +00:00
|
|
|
leaseIP := l.IP
|
|
|
|
|
|
|
|
ipToHost[leaseIP] = lowhost
|
|
|
|
hostToIP[lowhost] = leaseIP
|
2021-04-15 15:52:53 +01:00
|
|
|
}
|
2020-08-18 10:36:52 +01:00
|
|
|
|
2021-04-15 15:52:53 +01:00
|
|
|
s.setTableHostToIP(hostToIP)
|
|
|
|
s.setTableIPToHost(ipToHost)
|
2022-10-26 19:12:51 +01:00
|
|
|
|
|
|
|
log.Debug("dnsforward: added %d a and ptr entries from dhcp", len(ipToHost))
|
2020-06-23 10:13:13 +01:00
|
|
|
}
|
|
|
|
|
2022-09-02 14:56:59 +01:00
|
|
|
// processDDRQuery responds to Discovery of Designated Resolvers (DDR) SVCB
|
|
|
|
// queries. The response contains different types of encryption supported by
|
|
|
|
// current user configuration.
|
2022-04-27 09:39:48 +01:00
|
|
|
//
|
2022-09-02 14:56:59 +01:00
|
|
|
// See https://www.ietf.org/archive/id/draft-ietf-add-ddr-10.html.
|
2022-09-02 12:52:19 +01:00
|
|
|
func (s *Server) processDDRQuery(dctx *dnsContext) (rc resultCode) {
|
2022-04-27 09:39:48 +01:00
|
|
|
if !s.conf.HandleDDR {
|
|
|
|
return resultCodeSuccess
|
|
|
|
}
|
|
|
|
|
2022-11-02 11:37:41 +00:00
|
|
|
pctx := dctx.proxyCtx
|
|
|
|
q := pctx.Req.Question[0]
|
2022-09-02 12:52:19 +01:00
|
|
|
if q.Name == ddrHostFQDN {
|
|
|
|
pctx.Res = s.makeDDRResponse(pctx.Req)
|
2022-04-27 09:39:48 +01:00
|
|
|
|
|
|
|
return resultCodeFinish
|
|
|
|
}
|
|
|
|
|
|
|
|
return resultCodeSuccess
|
|
|
|
}
|
|
|
|
|
2022-09-02 14:56:59 +01:00
|
|
|
// makeDDRResponse creates a DDR answer based on the server configuration. The
|
|
|
|
// constructed SVCB resource records have the priority of 1 for each entry,
|
|
|
|
// similar to examples provided by the [draft standard].
|
2022-06-20 15:48:56 +01:00
|
|
|
//
|
|
|
|
// TODO(a.meshkov): Consider setting the priority values based on the protocol.
|
2022-09-02 14:56:59 +01:00
|
|
|
//
|
|
|
|
// [draft standard]: https://www.ietf.org/archive/id/draft-ietf-add-ddr-10.html.
|
2022-04-27 09:39:48 +01:00
|
|
|
func (s *Server) makeDDRResponse(req *dns.Msg) (resp *dns.Msg) {
|
|
|
|
resp = s.makeResponse(req)
|
2022-11-02 11:37:41 +00:00
|
|
|
if req.Question[0].Qtype != dns.TypeSVCB {
|
|
|
|
return resp
|
|
|
|
}
|
|
|
|
|
2022-05-31 15:28:50 +01:00
|
|
|
// TODO(e.burkov): Think about storing the FQDN version of the server's
|
2022-05-30 14:04:28 +01:00
|
|
|
// name somewhere.
|
|
|
|
domainName := dns.Fqdn(s.conf.ServerName)
|
2022-04-27 09:39:48 +01:00
|
|
|
|
2022-05-31 15:28:50 +01:00
|
|
|
for _, addr := range s.conf.HTTPSListenAddrs {
|
2022-04-27 09:39:48 +01:00
|
|
|
values := []dns.SVCBKeyValue{
|
|
|
|
&dns.SVCBAlpn{Alpn: []string{"h2"}},
|
|
|
|
&dns.SVCBPort{Port: uint16(addr.Port)},
|
2022-09-20 13:26:10 +01:00
|
|
|
&dns.SVCBDoHPath{Template: "/dns-query{?dns}"},
|
2022-04-27 09:39:48 +01:00
|
|
|
}
|
|
|
|
|
|
|
|
ans := &dns.SVCB{
|
|
|
|
Hdr: s.hdr(req, dns.TypeSVCB),
|
|
|
|
Priority: 1,
|
|
|
|
Target: domainName,
|
|
|
|
Value: values,
|
|
|
|
}
|
|
|
|
|
|
|
|
resp.Answer = append(resp.Answer, ans)
|
|
|
|
}
|
|
|
|
|
2022-11-02 11:37:41 +00:00
|
|
|
if s.conf.hasIPAddrs {
|
|
|
|
// Only add DNS-over-TLS resolvers in case the certificate contains IP
|
|
|
|
// addresses.
|
|
|
|
//
|
|
|
|
// See https://github.com/AdguardTeam/AdGuardHome/issues/4927.
|
|
|
|
for _, addr := range s.dnsProxy.TLSListenAddr {
|
|
|
|
values := []dns.SVCBKeyValue{
|
|
|
|
&dns.SVCBAlpn{Alpn: []string{"dot"}},
|
|
|
|
&dns.SVCBPort{Port: uint16(addr.Port)},
|
|
|
|
}
|
|
|
|
|
|
|
|
ans := &dns.SVCB{
|
|
|
|
Hdr: s.hdr(req, dns.TypeSVCB),
|
|
|
|
Priority: 1,
|
|
|
|
Target: domainName,
|
|
|
|
Value: values,
|
|
|
|
}
|
|
|
|
|
|
|
|
resp.Answer = append(resp.Answer, ans)
|
2022-04-27 09:39:48 +01:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2022-05-26 15:53:11 +01:00
|
|
|
for _, addr := range s.dnsProxy.QUICListenAddr {
|
|
|
|
values := []dns.SVCBKeyValue{
|
|
|
|
&dns.SVCBAlpn{Alpn: []string{"doq"}},
|
|
|
|
&dns.SVCBPort{Port: uint16(addr.Port)},
|
|
|
|
}
|
|
|
|
|
|
|
|
ans := &dns.SVCB{
|
|
|
|
Hdr: s.hdr(req, dns.TypeSVCB),
|
2022-06-20 15:48:56 +01:00
|
|
|
Priority: 1,
|
2022-05-26 15:53:11 +01:00
|
|
|
Target: domainName,
|
|
|
|
Value: values,
|
|
|
|
}
|
|
|
|
|
|
|
|
resp.Answer = append(resp.Answer, ans)
|
|
|
|
}
|
|
|
|
|
2022-04-27 09:39:48 +01:00
|
|
|
return resp
|
|
|
|
}
|
|
|
|
|
2023-01-23 16:10:56 +00:00
|
|
|
// processDetermineLocal determines if the client's IP address is from locally
|
|
|
|
// served network and saves the result into the context.
|
2021-04-08 16:07:29 +01:00
|
|
|
func (s *Server) processDetermineLocal(dctx *dnsContext) (rc resultCode) {
|
|
|
|
rc = resultCodeSuccess
|
|
|
|
|
|
|
|
var ip net.IP
|
2021-08-09 14:03:37 +01:00
|
|
|
if ip, _ = netutil.IPAndPortFromAddr(dctx.proxyCtx.Addr); ip == nil {
|
2021-04-08 16:07:29 +01:00
|
|
|
return rc
|
|
|
|
}
|
|
|
|
|
2022-03-18 10:37:27 +00:00
|
|
|
dctx.isLocalClient = s.privateNets.Contains(ip)
|
2021-04-08 16:07:29 +01:00
|
|
|
|
|
|
|
return rc
|
|
|
|
}
|
|
|
|
|
2022-09-02 14:56:59 +01:00
|
|
|
// dhcpHostToIP tries to get an IP leased by DHCP and returns the copy of
|
|
|
|
// address since the data inside the internal table may be changed while request
|
2021-03-31 13:00:47 +01:00
|
|
|
// processing. It's safe for concurrent use.
|
2022-10-26 19:12:51 +01:00
|
|
|
func (s *Server) dhcpHostToIP(host string) (ip netip.Addr, ok bool) {
|
2021-03-31 13:00:47 +01:00
|
|
|
s.tableHostToIPLock.Lock()
|
|
|
|
defer s.tableHostToIPLock.Unlock()
|
|
|
|
|
2022-10-26 19:12:51 +01:00
|
|
|
ip, ok = s.tableHostToIP[host]
|
2021-03-31 13:00:47 +01:00
|
|
|
|
2022-10-26 19:12:51 +01:00
|
|
|
return ip, ok
|
2021-03-31 13:00:47 +01:00
|
|
|
}
|
|
|
|
|
2022-06-28 17:09:26 +01:00
|
|
|
// processDHCPHosts respond to A requests if the target hostname is known to
|
2023-01-23 16:10:56 +00:00
|
|
|
// the server. It responds with a mapped IP address if the DNS64 is enabled and
|
|
|
|
// the request is for AAAA.
|
2021-03-25 13:00:27 +00:00
|
|
|
//
|
|
|
|
// TODO(a.garipov): Adapt to AAAA as well.
|
2022-06-28 17:09:26 +01:00
|
|
|
func (s *Server) processDHCPHosts(dctx *dnsContext) (rc resultCode) {
|
2022-09-02 14:56:59 +01:00
|
|
|
pctx := dctx.proxyCtx
|
|
|
|
req := pctx.Req
|
2021-03-25 13:00:27 +00:00
|
|
|
q := req.Question[0]
|
2022-09-02 14:56:59 +01:00
|
|
|
reqHost, ok := s.isDHCPClientHostQ(q)
|
|
|
|
if !ok {
|
2021-01-27 15:32:13 +00:00
|
|
|
return resultCodeSuccess
|
2020-08-18 10:36:52 +01:00
|
|
|
}
|
|
|
|
|
2021-04-08 16:07:29 +01:00
|
|
|
if !dctx.isLocalClient {
|
2022-10-26 19:12:51 +01:00
|
|
|
log.Debug("dnsforward: %q requests for dhcp host %q", pctx.Addr, reqHost)
|
2022-09-02 12:52:19 +01:00
|
|
|
pctx.Res = s.genNXDomain(req)
|
2021-04-08 16:07:29 +01:00
|
|
|
|
|
|
|
// Do not even put into query log.
|
|
|
|
return resultCodeFinish
|
|
|
|
}
|
2021-03-31 13:00:47 +01:00
|
|
|
|
2022-09-02 14:56:59 +01:00
|
|
|
ip, ok := s.dhcpHostToIP(reqHost)
|
2020-08-18 10:36:52 +01:00
|
|
|
if !ok {
|
2022-09-02 14:56:59 +01:00
|
|
|
// Go on and process them with filters, including dnsrewrite ones, and
|
|
|
|
// possibly route them to a domain-specific upstream.
|
2022-10-26 19:12:51 +01:00
|
|
|
log.Debug("dnsforward: no dhcp record for %q", reqHost)
|
2021-04-08 16:07:29 +01:00
|
|
|
|
2022-09-02 14:56:59 +01:00
|
|
|
return resultCodeSuccess
|
2020-08-18 10:36:52 +01:00
|
|
|
}
|
|
|
|
|
2022-10-26 19:12:51 +01:00
|
|
|
log.Debug("dnsforward: dhcp record for %q is %s", reqHost, ip)
|
2020-08-18 10:36:52 +01:00
|
|
|
|
|
|
|
resp := s.makeResponse(req)
|
2023-01-23 16:10:56 +00:00
|
|
|
switch q.Qtype {
|
|
|
|
case dns.TypeA:
|
2021-03-25 13:00:27 +00:00
|
|
|
a := &dns.A{
|
|
|
|
Hdr: s.hdr(req, dns.TypeA),
|
2022-10-26 19:12:51 +01:00
|
|
|
A: ip.AsSlice(),
|
2020-08-18 10:36:52 +01:00
|
|
|
}
|
|
|
|
resp.Answer = append(resp.Answer, a)
|
2023-01-23 16:10:56 +00:00
|
|
|
case dns.TypeAAAA:
|
2023-02-06 14:17:51 +00:00
|
|
|
if s.dns64Pref != (netip.Prefix{}) {
|
2023-01-23 16:10:56 +00:00
|
|
|
// Respond with DNS64-mapped address for IPv4 host if DNS64 is
|
|
|
|
// enabled.
|
|
|
|
aaaa := &dns.AAAA{
|
|
|
|
Hdr: s.hdr(req, dns.TypeAAAA),
|
|
|
|
AAAA: s.mapDNS64(ip),
|
|
|
|
}
|
|
|
|
resp.Answer = append(resp.Answer, aaaa)
|
|
|
|
}
|
|
|
|
default:
|
|
|
|
// Go on.
|
2020-08-18 10:36:52 +01:00
|
|
|
}
|
2023-01-23 16:10:56 +00:00
|
|
|
|
2021-03-25 13:00:27 +00:00
|
|
|
dctx.proxyCtx.Res = resp
|
|
|
|
|
2021-01-27 15:32:13 +00:00
|
|
|
return resultCodeSuccess
|
|
|
|
}
|
|
|
|
|
2023-03-17 14:10:33 +00:00
|
|
|
// indexFirstV4Label returns the index at which the reversed IPv4 address
|
2023-04-11 13:02:29 +01:00
|
|
|
// starts, assuming the domain is pre-validated ARPA domain having in-addr and
|
2023-03-17 14:10:33 +00:00
|
|
|
// arpa labels removed.
|
|
|
|
func indexFirstV4Label(domain string) (idx int) {
|
|
|
|
idx = len(domain)
|
|
|
|
for labelsNum := 0; labelsNum < net.IPv4len && idx > 0; labelsNum++ {
|
|
|
|
curIdx := strings.LastIndexByte(domain[:idx-1], '.') + 1
|
|
|
|
_, parseErr := strconv.ParseUint(domain[curIdx:idx-1], 10, 8)
|
|
|
|
if parseErr != nil {
|
|
|
|
return idx
|
|
|
|
}
|
|
|
|
|
|
|
|
idx = curIdx
|
|
|
|
}
|
|
|
|
|
|
|
|
return idx
|
|
|
|
}
|
|
|
|
|
|
|
|
// indexFirstV6Label returns the index at which the reversed IPv6 address
|
2023-04-11 13:02:29 +01:00
|
|
|
// starts, assuming the domain is pre-validated ARPA domain having ip6 and arpa
|
2023-03-17 14:10:33 +00:00
|
|
|
// labels removed.
|
|
|
|
func indexFirstV6Label(domain string) (idx int) {
|
|
|
|
idx = len(domain)
|
|
|
|
for labelsNum := 0; labelsNum < net.IPv6len*2 && idx > 0; labelsNum++ {
|
|
|
|
curIdx := idx - len("a.")
|
|
|
|
if curIdx > 1 && domain[curIdx-1] != '.' {
|
|
|
|
return idx
|
|
|
|
}
|
|
|
|
|
|
|
|
nibble := domain[curIdx]
|
|
|
|
if (nibble < '0' || nibble > '9') && (nibble < 'a' || nibble > 'f') {
|
|
|
|
return idx
|
|
|
|
}
|
|
|
|
|
|
|
|
idx = curIdx
|
|
|
|
}
|
|
|
|
|
|
|
|
return idx
|
|
|
|
}
|
|
|
|
|
|
|
|
// extractARPASubnet tries to convert a reversed ARPA address being a part of
|
|
|
|
// domain to an IP network. domain must be an FQDN.
|
|
|
|
//
|
|
|
|
// TODO(e.burkov): Move to golibs.
|
|
|
|
func extractARPASubnet(domain string) (pref netip.Prefix, err error) {
|
|
|
|
err = netutil.ValidateDomainName(strings.TrimSuffix(domain, "."))
|
|
|
|
if err != nil {
|
|
|
|
// Don't wrap the error since it's informative enough as is.
|
|
|
|
return netip.Prefix{}, err
|
|
|
|
}
|
|
|
|
|
|
|
|
const (
|
|
|
|
v4Suffix = "in-addr.arpa."
|
|
|
|
v6Suffix = "ip6.arpa."
|
|
|
|
)
|
|
|
|
|
|
|
|
domain = strings.ToLower(domain)
|
|
|
|
|
|
|
|
var idx int
|
|
|
|
switch {
|
|
|
|
case strings.HasSuffix(domain, v4Suffix):
|
|
|
|
idx = indexFirstV4Label(domain[:len(domain)-len(v4Suffix)])
|
|
|
|
case strings.HasSuffix(domain, v6Suffix):
|
|
|
|
idx = indexFirstV6Label(domain[:len(domain)-len(v6Suffix)])
|
|
|
|
default:
|
|
|
|
return netip.Prefix{}, &netutil.AddrError{
|
|
|
|
Err: netutil.ErrNotAReversedSubnet,
|
|
|
|
Kind: netutil.AddrKindARPA,
|
|
|
|
Addr: domain,
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
var subnet *net.IPNet
|
|
|
|
subnet, err = netutil.SubnetFromReversedAddr(domain[idx:])
|
|
|
|
if err != nil {
|
|
|
|
// Don't wrap the error since it's informative enough as is.
|
|
|
|
return netip.Prefix{}, err
|
|
|
|
}
|
|
|
|
|
|
|
|
return netutil.IPNetToPrefixNoMapped(subnet)
|
|
|
|
}
|
|
|
|
|
2021-04-08 16:07:29 +01:00
|
|
|
// processRestrictLocal responds with NXDOMAIN to PTR requests for IP addresses
|
2023-01-23 16:10:56 +00:00
|
|
|
// in locally served network from external clients.
|
2022-09-02 12:52:19 +01:00
|
|
|
func (s *Server) processRestrictLocal(dctx *dnsContext) (rc resultCode) {
|
|
|
|
pctx := dctx.proxyCtx
|
|
|
|
req := pctx.Req
|
2021-03-31 13:00:47 +01:00
|
|
|
q := req.Question[0]
|
|
|
|
if q.Qtype != dns.TypePTR {
|
|
|
|
// No need for restriction.
|
2021-01-27 15:32:13 +00:00
|
|
|
return resultCodeSuccess
|
2020-06-23 10:13:13 +01:00
|
|
|
}
|
|
|
|
|
2023-03-17 14:10:33 +00:00
|
|
|
subnet, err := extractARPASubnet(q.Name)
|
2021-08-09 14:03:37 +01:00
|
|
|
if err != nil {
|
2023-03-17 14:10:33 +00:00
|
|
|
if errors.Is(err, netutil.ErrNotAReversedSubnet) {
|
|
|
|
log.Debug("dnsforward: request is not for arpa domain")
|
2022-01-18 11:20:25 +00:00
|
|
|
|
2023-03-17 14:10:33 +00:00
|
|
|
return resultCodeSuccess
|
2022-01-18 11:20:25 +00:00
|
|
|
}
|
|
|
|
|
2023-03-17 14:10:33 +00:00
|
|
|
log.Debug("dnsforward: parsing reversed addr: %s", err)
|
2022-01-18 11:20:25 +00:00
|
|
|
|
2023-03-17 14:10:33 +00:00
|
|
|
return resultCodeError
|
2020-06-23 10:13:13 +01:00
|
|
|
}
|
|
|
|
|
2021-03-31 13:00:47 +01:00
|
|
|
// Restrict an access to local addresses for external clients. We also
|
2023-01-23 16:10:56 +00:00
|
|
|
// assume that all the DHCP leases we give are locally served or at least
|
|
|
|
// shouldn't be accessible externally.
|
2023-03-17 14:10:33 +00:00
|
|
|
subnetAddr := subnet.Addr()
|
|
|
|
addrData := subnetAddr.AsSlice()
|
|
|
|
if !s.privateNets.Contains(addrData) {
|
2021-11-15 14:42:10 +00:00
|
|
|
return resultCodeSuccess
|
|
|
|
}
|
|
|
|
|
2023-03-17 14:10:33 +00:00
|
|
|
log.Debug("dnsforward: addr %s is from locally served network", subnetAddr)
|
2023-01-23 16:10:56 +00:00
|
|
|
|
2022-09-02 12:52:19 +01:00
|
|
|
if !dctx.isLocalClient {
|
2022-10-26 19:12:51 +01:00
|
|
|
log.Debug("dnsforward: %q requests an internal ip", pctx.Addr)
|
2022-09-02 12:52:19 +01:00
|
|
|
pctx.Res = s.genNXDomain(req)
|
2021-03-31 13:00:47 +01:00
|
|
|
|
2021-11-11 13:19:33 +00:00
|
|
|
// Do not even put into query log.
|
|
|
|
return resultCodeFinish
|
2021-03-31 13:00:47 +01:00
|
|
|
}
|
|
|
|
|
|
|
|
// Do not perform unreversing ever again.
|
2023-03-17 14:10:33 +00:00
|
|
|
dctx.unreversedReqIP = addrData
|
2021-03-31 13:00:47 +01:00
|
|
|
|
2021-11-15 14:42:10 +00:00
|
|
|
// There is no need to filter request from external addresses since this
|
2023-01-23 16:10:56 +00:00
|
|
|
// code is only executed when the request is for locally served ARPA
|
2021-11-15 14:42:10 +00:00
|
|
|
// hostname so disable redundant filters.
|
2022-09-02 12:52:19 +01:00
|
|
|
dctx.setts.ParentalEnabled = false
|
|
|
|
dctx.setts.SafeBrowsingEnabled = false
|
|
|
|
dctx.setts.SafeSearchEnabled = false
|
|
|
|
dctx.setts.ServicesRules = nil
|
2021-04-07 18:16:06 +01:00
|
|
|
|
2021-03-31 13:00:47 +01:00
|
|
|
// Nothing to restrict.
|
|
|
|
return resultCodeSuccess
|
|
|
|
}
|
|
|
|
|
2022-09-02 14:56:59 +01:00
|
|
|
// ipToDHCPHost tries to get a hostname leased by DHCP. It's safe for
|
|
|
|
// concurrent use.
|
2022-10-26 19:12:51 +01:00
|
|
|
func (s *Server) ipToDHCPHost(ip netip.Addr) (host string, ok bool) {
|
2021-04-15 15:52:53 +01:00
|
|
|
s.tableIPToHostLock.Lock()
|
|
|
|
defer s.tableIPToHostLock.Unlock()
|
2021-03-31 13:00:47 +01:00
|
|
|
|
2022-10-26 19:12:51 +01:00
|
|
|
host, ok = s.tableIPToHost[ip]
|
2021-03-31 13:00:47 +01:00
|
|
|
|
2022-10-26 19:12:51 +01:00
|
|
|
return host, ok
|
2021-03-31 13:00:47 +01:00
|
|
|
}
|
|
|
|
|
2022-09-02 14:56:59 +01:00
|
|
|
// processDHCPAddrs responds to PTR requests if the target IP is leased by the
|
|
|
|
// DHCP server.
|
2022-09-02 12:52:19 +01:00
|
|
|
func (s *Server) processDHCPAddrs(dctx *dnsContext) (rc resultCode) {
|
|
|
|
pctx := dctx.proxyCtx
|
|
|
|
if pctx.Res != nil {
|
2021-01-27 15:32:13 +00:00
|
|
|
return resultCodeSuccess
|
2020-06-23 10:13:13 +01:00
|
|
|
}
|
2021-03-31 13:00:47 +01:00
|
|
|
|
2022-09-02 12:52:19 +01:00
|
|
|
ip := dctx.unreversedReqIP
|
2021-03-31 13:00:47 +01:00
|
|
|
if ip == nil {
|
|
|
|
return resultCodeSuccess
|
|
|
|
}
|
|
|
|
|
2023-01-23 16:10:56 +00:00
|
|
|
// TODO(a.garipov): Remove once we switch to [netip.Addr] more fully.
|
2022-10-26 19:12:51 +01:00
|
|
|
ipAddr, err := netutil.IPToAddrNoMapped(ip)
|
|
|
|
if err != nil {
|
|
|
|
log.Debug("dnsforward: bad reverse ip %v from dhcp: %s", ip, err)
|
|
|
|
|
|
|
|
return resultCodeSuccess
|
|
|
|
}
|
|
|
|
|
|
|
|
host, ok := s.ipToDHCPHost(ipAddr)
|
2020-06-23 10:13:13 +01:00
|
|
|
if !ok {
|
2021-01-27 15:32:13 +00:00
|
|
|
return resultCodeSuccess
|
2020-06-23 10:13:13 +01:00
|
|
|
}
|
|
|
|
|
2022-10-26 19:12:51 +01:00
|
|
|
log.Debug("dnsforward: dhcp reverse record for %s is %q", ip, host)
|
2020-06-23 10:13:13 +01:00
|
|
|
|
2022-09-02 12:52:19 +01:00
|
|
|
req := pctx.Req
|
2020-06-23 10:13:13 +01:00
|
|
|
resp := s.makeResponse(req)
|
2021-03-31 13:00:47 +01:00
|
|
|
ptr := &dns.PTR{
|
|
|
|
Hdr: dns.RR_Header{
|
|
|
|
Name: req.Question[0].Name,
|
|
|
|
Rrtype: dns.TypePTR,
|
|
|
|
Ttl: s.conf.BlockedResponseTTL,
|
|
|
|
Class: dns.ClassINET,
|
|
|
|
},
|
|
|
|
Ptr: dns.Fqdn(host),
|
2020-06-23 10:13:13 +01:00
|
|
|
}
|
|
|
|
resp.Answer = append(resp.Answer, ptr)
|
2022-09-02 12:52:19 +01:00
|
|
|
pctx.Res = resp
|
2021-03-31 13:00:47 +01:00
|
|
|
|
|
|
|
return resultCodeSuccess
|
|
|
|
}
|
|
|
|
|
|
|
|
// processLocalPTR responds to PTR requests if the target IP is detected to be
|
|
|
|
// inside the local network and the query was not answered from DHCP.
|
2022-09-02 12:52:19 +01:00
|
|
|
func (s *Server) processLocalPTR(dctx *dnsContext) (rc resultCode) {
|
|
|
|
pctx := dctx.proxyCtx
|
|
|
|
if pctx.Res != nil {
|
2021-03-31 13:00:47 +01:00
|
|
|
return resultCodeSuccess
|
|
|
|
}
|
|
|
|
|
2022-09-02 12:52:19 +01:00
|
|
|
ip := dctx.unreversedReqIP
|
2021-03-31 13:00:47 +01:00
|
|
|
if ip == nil {
|
|
|
|
return resultCodeSuccess
|
|
|
|
}
|
|
|
|
|
2021-05-26 15:55:19 +01:00
|
|
|
s.serverLock.RLock()
|
|
|
|
defer s.serverLock.RUnlock()
|
|
|
|
|
|
|
|
if s.conf.UsePrivateRDNS {
|
2022-09-02 12:52:19 +01:00
|
|
|
s.recDetector.add(*pctx.Req)
|
|
|
|
if err := s.localResolvers.Resolve(pctx); err != nil {
|
|
|
|
dctx.err = err
|
2021-03-31 13:00:47 +01:00
|
|
|
|
2021-05-26 15:55:19 +01:00
|
|
|
return resultCodeError
|
|
|
|
}
|
2021-03-31 13:00:47 +01:00
|
|
|
}
|
|
|
|
|
2022-09-02 12:52:19 +01:00
|
|
|
if pctx.Res == nil {
|
|
|
|
pctx.Res = s.genNXDomain(pctx.Req)
|
2021-04-09 19:01:21 +01:00
|
|
|
|
2021-05-26 15:55:19 +01:00
|
|
|
// Do not even put into query log.
|
2021-04-09 19:01:21 +01:00
|
|
|
return resultCodeFinish
|
|
|
|
}
|
2021-03-31 13:00:47 +01:00
|
|
|
|
2021-01-27 15:32:13 +00:00
|
|
|
return resultCodeSuccess
|
2020-06-23 10:13:13 +01:00
|
|
|
}
|
|
|
|
|
2020-05-08 16:39:37 +01:00
|
|
|
// Apply filtering logic
|
2021-10-20 17:52:13 +01:00
|
|
|
func (s *Server) processFilteringBeforeRequest(ctx *dnsContext) (rc resultCode) {
|
|
|
|
if ctx.proxyCtx.Res != nil {
|
|
|
|
// Go on since the response is already set.
|
|
|
|
return resultCodeSuccess
|
2020-06-23 10:13:13 +01:00
|
|
|
}
|
|
|
|
|
2021-05-26 15:55:19 +01:00
|
|
|
s.serverLock.RLock()
|
|
|
|
defer s.serverLock.RUnlock()
|
2020-05-08 16:39:37 +01:00
|
|
|
|
2021-10-20 17:52:13 +01:00
|
|
|
if s.dnsFilter == nil {
|
2021-05-26 15:55:19 +01:00
|
|
|
return resultCodeSuccess
|
2020-05-08 16:39:37 +01:00
|
|
|
}
|
|
|
|
|
2021-05-26 15:55:19 +01:00
|
|
|
var err error
|
2021-10-20 17:52:13 +01:00
|
|
|
if ctx.result, err = s.filterDNSRequest(ctx); err != nil {
|
2020-05-08 16:39:37 +01:00
|
|
|
ctx.err = err
|
2021-04-07 18:16:06 +01:00
|
|
|
|
2021-01-27 15:32:13 +00:00
|
|
|
return resultCodeError
|
2020-05-08 16:39:37 +01:00
|
|
|
}
|
2021-04-07 18:16:06 +01:00
|
|
|
|
2021-01-27 15:32:13 +00:00
|
|
|
return resultCodeSuccess
|
2020-05-08 16:39:37 +01:00
|
|
|
}
|
|
|
|
|
2021-05-28 11:02:59 +01:00
|
|
|
// ipStringFromAddr extracts an IP address string from net.Addr.
|
|
|
|
func ipStringFromAddr(addr net.Addr) (ipStr string) {
|
2021-08-09 14:03:37 +01:00
|
|
|
if ip, _ := netutil.IPAndPortFromAddr(addr); ip != nil {
|
2021-05-28 11:02:59 +01:00
|
|
|
return ip.String()
|
|
|
|
}
|
|
|
|
|
|
|
|
return ""
|
|
|
|
}
|
|
|
|
|
2021-01-13 13:56:05 +00:00
|
|
|
// processUpstream passes request to upstream servers and handles the response.
|
2021-12-13 15:06:01 +00:00
|
|
|
func (s *Server) processUpstream(dctx *dnsContext) (rc resultCode) {
|
|
|
|
pctx := dctx.proxyCtx
|
2022-09-02 14:56:59 +01:00
|
|
|
req := pctx.Req
|
|
|
|
q := req.Question[0]
|
2021-12-13 15:06:01 +00:00
|
|
|
if pctx.Res != nil {
|
|
|
|
// The response has already been set.
|
|
|
|
return resultCodeSuccess
|
2022-09-02 14:56:59 +01:00
|
|
|
} else if reqHost, ok := s.isDHCPClientHostQ(q); ok {
|
|
|
|
// A DHCP client hostname query that hasn't been handled or filtered.
|
|
|
|
// Respond with an NXDOMAIN.
|
|
|
|
//
|
|
|
|
// TODO(a.garipov): Route such queries to a custom upstream for the
|
|
|
|
// local domain name if there is one.
|
2022-10-26 19:12:51 +01:00
|
|
|
log.Debug("dnsforward: dhcp client hostname %q was not filtered", reqHost)
|
2022-09-02 14:56:59 +01:00
|
|
|
pctx.Res = s.genNXDomain(req)
|
|
|
|
|
|
|
|
return resultCodeFinish
|
2020-05-08 16:39:37 +01:00
|
|
|
}
|
|
|
|
|
2022-09-02 12:52:19 +01:00
|
|
|
s.setCustomUpstream(pctx, dctx.clientID)
|
2020-05-08 16:39:37 +01:00
|
|
|
|
2023-02-13 16:07:10 +00:00
|
|
|
reqWantsDNSSEC := s.setReqAD(req)
|
2020-05-08 16:39:37 +01:00
|
|
|
|
2021-10-06 11:14:41 +01:00
|
|
|
// Process the request further since it wasn't filtered.
|
|
|
|
prx := s.proxy()
|
|
|
|
if prx == nil {
|
2021-12-13 15:06:01 +00:00
|
|
|
dctx.err = srvClosedErr
|
2021-10-06 11:14:41 +01:00
|
|
|
|
|
|
|
return resultCodeError
|
|
|
|
}
|
|
|
|
|
2023-02-06 14:17:51 +00:00
|
|
|
if err := prx.Resolve(pctx); err != nil {
|
|
|
|
if errors.Is(err, upstream.ErrNoUpstreams) {
|
|
|
|
// Do not even put into querylog. Currently this happens either
|
|
|
|
// when the private resolvers enabled and the request is DNS64 PTR,
|
|
|
|
// or when the client isn't considered local by prx.
|
|
|
|
//
|
|
|
|
// TODO(e.burkov): Make proxy detect local client the same way as
|
|
|
|
// AGH does.
|
|
|
|
pctx.Res = s.genNXDomain(req)
|
|
|
|
|
|
|
|
return resultCodeFinish
|
|
|
|
}
|
|
|
|
|
|
|
|
dctx.err = err
|
2020-05-08 16:39:37 +01:00
|
|
|
|
2023-01-23 16:10:56 +00:00
|
|
|
return resultCodeError
|
|
|
|
}
|
|
|
|
|
2021-12-13 15:06:01 +00:00
|
|
|
dctx.responseFromUpstream = true
|
|
|
|
dctx.responseAD = pctx.Res.AuthenticatedData
|
2020-05-08 16:39:37 +01:00
|
|
|
|
2023-02-13 16:07:10 +00:00
|
|
|
s.setRespAD(pctx, reqWantsDNSSEC)
|
|
|
|
|
|
|
|
return resultCodeSuccess
|
|
|
|
}
|
|
|
|
|
|
|
|
// setReqAD changes the request based on the server settings. wantsDNSSEC is
|
|
|
|
// false if the response should be cleared of the AD bit.
|
|
|
|
//
|
|
|
|
// TODO(a.garipov, e.burkov): This should probably be done in module dnsproxy.
|
|
|
|
func (s *Server) setReqAD(req *dns.Msg) (wantsDNSSEC bool) {
|
|
|
|
if !s.conf.EnableDNSSEC {
|
|
|
|
return false
|
|
|
|
}
|
|
|
|
|
|
|
|
origReqAD := req.AuthenticatedData
|
|
|
|
req.AuthenticatedData = true
|
|
|
|
|
|
|
|
// Per [RFC 6840] says, validating resolvers should only set the AD bit when
|
|
|
|
// the response has the AD bit set and the request contained either a set DO
|
|
|
|
// bit or a set AD bit. So, if neither of these is true, clear the AD bits
|
|
|
|
// in [Server.setRespAD].
|
|
|
|
//
|
|
|
|
// [RFC 6840]: https://datatracker.ietf.org/doc/html/rfc6840#section-5.8
|
|
|
|
return origReqAD || hasDO(req)
|
|
|
|
}
|
|
|
|
|
|
|
|
// hasDO returns true if msg has EDNS(0) options and the DNSSEC OK flag is set
|
|
|
|
// in there.
|
|
|
|
//
|
|
|
|
// TODO(a.garipov): Move to golibs/dnsmsg when it's there.
|
|
|
|
func hasDO(msg *dns.Msg) (do bool) {
|
|
|
|
o := msg.IsEdns0()
|
|
|
|
if o == nil {
|
|
|
|
return false
|
|
|
|
}
|
|
|
|
|
|
|
|
return o.Do()
|
|
|
|
}
|
|
|
|
|
|
|
|
// setRespAD changes the request and response based on the server settings and
|
|
|
|
// the original request data.
|
|
|
|
func (s *Server) setRespAD(pctx *proxy.DNSContext, reqWantsDNSSEC bool) {
|
|
|
|
if s.conf.EnableDNSSEC && !reqWantsDNSSEC {
|
2021-12-13 15:06:01 +00:00
|
|
|
pctx.Req.AuthenticatedData = false
|
|
|
|
pctx.Res.AuthenticatedData = false
|
2020-05-08 16:39:37 +01:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2022-09-02 14:56:59 +01:00
|
|
|
// isDHCPClientHostQ returns true if q is from a request for a DHCP client
|
|
|
|
// hostname. If ok is true, reqHost contains the requested hostname.
|
|
|
|
func (s *Server) isDHCPClientHostQ(q dns.Question) (reqHost string, ok bool) {
|
|
|
|
if !s.dhcpServer.Enabled() {
|
|
|
|
return "", false
|
|
|
|
}
|
|
|
|
|
|
|
|
// Include AAAA here, because despite the fact that we don't support it yet,
|
|
|
|
// the expected behavior here is to respond with an empty answer and not
|
|
|
|
// NXDOMAIN.
|
|
|
|
if qt := q.Qtype; qt != dns.TypeA && qt != dns.TypeAAAA {
|
|
|
|
return "", false
|
|
|
|
}
|
|
|
|
|
|
|
|
reqHost = strings.ToLower(q.Name[:len(q.Name)-1])
|
|
|
|
if strings.HasSuffix(reqHost, s.localDomainSuffix) {
|
|
|
|
return reqHost, true
|
|
|
|
}
|
|
|
|
|
|
|
|
return "", false
|
|
|
|
}
|
|
|
|
|
2022-09-02 12:52:19 +01:00
|
|
|
// setCustomUpstream sets custom upstream settings in pctx, if necessary.
|
|
|
|
func (s *Server) setCustomUpstream(pctx *proxy.DNSContext, clientID string) {
|
|
|
|
customUpsByClient := s.conf.GetCustomUpstreamByClient
|
|
|
|
if pctx.Addr == nil || customUpsByClient == nil {
|
|
|
|
return
|
|
|
|
}
|
|
|
|
|
|
|
|
// Use the ClientID first, since it has a higher priority.
|
|
|
|
id := stringutil.Coalesce(clientID, ipStringFromAddr(pctx.Addr))
|
|
|
|
upsConf, err := customUpsByClient(id)
|
|
|
|
if err != nil {
|
2022-10-26 19:12:51 +01:00
|
|
|
log.Error("dnsforward: getting custom upstreams for client %s: %s", id, err)
|
2020-05-08 16:39:37 +01:00
|
|
|
|
2022-09-02 12:52:19 +01:00
|
|
|
return
|
|
|
|
}
|
|
|
|
|
|
|
|
if upsConf != nil {
|
2022-10-26 19:12:51 +01:00
|
|
|
log.Debug("dnsforward: using custom upstreams for client %s", id)
|
2022-09-02 12:52:19 +01:00
|
|
|
}
|
|
|
|
|
|
|
|
pctx.CustomUpstreamConfig = upsConf
|
|
|
|
}
|
|
|
|
|
|
|
|
// Apply filtering logic after we have received response from upstream servers
|
|
|
|
func (s *Server) processFilteringAfterResponse(dctx *dnsContext) (rc resultCode) {
|
|
|
|
pctx := dctx.proxyCtx
|
|
|
|
switch res := dctx.result; res.Reason {
|
2021-10-20 17:52:13 +01:00
|
|
|
case filtering.NotFilteredAllowList:
|
2022-09-02 12:52:19 +01:00
|
|
|
return resultCodeSuccess
|
2021-10-20 17:52:13 +01:00
|
|
|
case
|
|
|
|
filtering.Rewritten,
|
2021-05-21 14:15:47 +01:00
|
|
|
filtering.RewrittenRule:
|
2020-12-21 14:48:07 +00:00
|
|
|
|
2022-09-02 12:52:19 +01:00
|
|
|
if dctx.origQuestion.Name == "" {
|
2021-10-20 17:52:13 +01:00
|
|
|
// origQuestion is set in case we get only CNAME without IP from
|
|
|
|
// rewrites table.
|
2022-09-02 12:52:19 +01:00
|
|
|
return resultCodeSuccess
|
2020-05-08 16:39:37 +01:00
|
|
|
}
|
2020-06-01 13:23:08 +01:00
|
|
|
|
2022-09-02 12:52:19 +01:00
|
|
|
pctx.Req.Question[0], pctx.Res.Question[0] = dctx.origQuestion, dctx.origQuestion
|
|
|
|
if len(pctx.Res.Answer) > 0 {
|
|
|
|
rr := s.genAnswerCNAME(pctx.Req, res.CanonName)
|
|
|
|
answer := append([]dns.RR{rr}, pctx.Res.Answer...)
|
|
|
|
pctx.Res.Answer = answer
|
2020-05-08 16:39:37 +01:00
|
|
|
}
|
2022-09-02 12:52:19 +01:00
|
|
|
|
|
|
|
return resultCodeSuccess
|
2020-05-08 16:39:37 +01:00
|
|
|
default:
|
2022-09-02 12:52:19 +01:00
|
|
|
return s.filterAfterResponse(dctx, pctx)
|
|
|
|
}
|
|
|
|
}
|
2021-10-20 17:52:13 +01:00
|
|
|
|
2022-09-02 12:52:19 +01:00
|
|
|
// filterAfterResponse returns the result of filtering the response that wasn't
|
|
|
|
// explicitly allowed or rewritten.
|
|
|
|
func (s *Server) filterAfterResponse(dctx *dnsContext, pctx *proxy.DNSContext) (res resultCode) {
|
|
|
|
// Check the response only if it's from an upstream. Don't check the
|
|
|
|
// response if the protection is disabled since dnsrewrite rules aren't
|
|
|
|
// applied to it anyway.
|
|
|
|
if !dctx.protectionEnabled || !dctx.responseFromUpstream || s.dnsFilter == nil {
|
|
|
|
return resultCodeSuccess
|
|
|
|
}
|
2021-10-20 17:52:13 +01:00
|
|
|
|
2022-09-02 12:52:19 +01:00
|
|
|
result, err := s.filterDNSResponse(pctx, dctx.setts)
|
|
|
|
if err != nil {
|
|
|
|
dctx.err = err
|
2021-10-20 17:52:13 +01:00
|
|
|
|
2022-09-02 12:52:19 +01:00
|
|
|
return resultCodeError
|
2020-05-08 16:39:37 +01:00
|
|
|
}
|
|
|
|
|
2022-09-02 12:52:19 +01:00
|
|
|
if result != nil {
|
|
|
|
dctx.result = result
|
|
|
|
dctx.origResp = pctx.Res
|
2021-10-20 17:52:13 +01:00
|
|
|
}
|
|
|
|
|
2021-01-27 15:32:13 +00:00
|
|
|
return resultCodeSuccess
|
2020-05-08 16:39:37 +01:00
|
|
|
}
|