2020-05-08 16:39:37 +01:00
|
|
|
package dnsforward
|
|
|
|
|
|
|
|
import (
|
|
|
|
"crypto/tls"
|
|
|
|
"crypto/x509"
|
|
|
|
"fmt"
|
|
|
|
"net"
|
2021-05-21 12:55:42 +01:00
|
|
|
"os"
|
2020-05-08 16:39:37 +01:00
|
|
|
"sort"
|
2021-05-28 11:02:59 +01:00
|
|
|
"strings"
|
2021-06-15 15:36:49 +01:00
|
|
|
"time"
|
2020-05-08 16:39:37 +01:00
|
|
|
|
2022-09-06 15:09:54 +01:00
|
|
|
"github.com/AdguardTeam/AdGuardHome/internal/aghalg"
|
2022-08-04 17:05:28 +01:00
|
|
|
"github.com/AdguardTeam/AdGuardHome/internal/aghhttp"
|
2022-01-26 11:39:34 +00:00
|
|
|
"github.com/AdguardTeam/AdGuardHome/internal/aghtls"
|
2021-05-21 14:15:47 +01:00
|
|
|
"github.com/AdguardTeam/AdGuardHome/internal/filtering"
|
2020-05-08 16:39:37 +01:00
|
|
|
"github.com/AdguardTeam/dnsproxy/proxy"
|
|
|
|
"github.com/AdguardTeam/dnsproxy/upstream"
|
2021-05-24 15:28:11 +01:00
|
|
|
"github.com/AdguardTeam/golibs/errors"
|
2020-09-08 15:28:01 +01:00
|
|
|
"github.com/AdguardTeam/golibs/log"
|
2021-08-09 14:03:37 +01:00
|
|
|
"github.com/AdguardTeam/golibs/netutil"
|
2021-07-29 15:40:31 +01:00
|
|
|
"github.com/AdguardTeam/golibs/stringutil"
|
2021-09-30 19:17:54 +01:00
|
|
|
"github.com/AdguardTeam/golibs/timeutil"
|
2020-12-07 14:58:33 +00:00
|
|
|
"github.com/ameshkov/dnscrypt/v2"
|
2020-05-08 16:39:37 +01:00
|
|
|
)
|
|
|
|
|
2021-06-17 12:09:16 +01:00
|
|
|
// BlockingMode is an enum of all allowed blocking modes.
|
|
|
|
type BlockingMode string
|
|
|
|
|
|
|
|
// Allowed blocking modes.
|
|
|
|
const (
|
|
|
|
// BlockingModeCustomIP means respond with a custom IP address.
|
|
|
|
BlockingModeCustomIP BlockingMode = "custom_ip"
|
|
|
|
|
|
|
|
// BlockingModeDefault is the same as BlockingModeNullIP for
|
|
|
|
// Adblock-style rules, but responds with the IP address specified in
|
|
|
|
// the rule when blocked by an `/etc/hosts`-style rule.
|
|
|
|
BlockingModeDefault BlockingMode = "default"
|
|
|
|
|
|
|
|
// BlockingModeNullIP means respond with a zero IP address: "0.0.0.0"
|
|
|
|
// for A requests and "::" for AAAA ones.
|
|
|
|
BlockingModeNullIP BlockingMode = "null_ip"
|
|
|
|
|
|
|
|
// BlockingModeNXDOMAIN means respond with the NXDOMAIN code.
|
|
|
|
BlockingModeNXDOMAIN BlockingMode = "nxdomain"
|
|
|
|
|
|
|
|
// BlockingModeREFUSED means respond with the REFUSED code.
|
|
|
|
BlockingModeREFUSED BlockingMode = "refused"
|
|
|
|
)
|
|
|
|
|
2020-05-08 16:39:37 +01:00
|
|
|
// FilteringConfig represents the DNS filtering configuration of AdGuard Home
|
|
|
|
// The zero FilteringConfig is empty and ready for use.
|
|
|
|
type FilteringConfig struct {
|
|
|
|
// Callbacks for other modules
|
|
|
|
// --
|
|
|
|
|
2021-01-27 15:32:13 +00:00
|
|
|
// FilterHandler is an optional additional filtering callback.
|
2021-05-21 14:15:47 +01:00
|
|
|
FilterHandler func(clientAddr net.IP, clientID string, settings *filtering.Settings) `yaml:"-"`
|
2020-05-08 16:39:37 +01:00
|
|
|
|
2021-05-28 11:02:59 +01:00
|
|
|
// GetCustomUpstreamByClient is a callback that returns upstreams
|
|
|
|
// configuration based on the client IP address or ClientID. It returns
|
|
|
|
// nil if there are no custom upstreams for the client.
|
|
|
|
GetCustomUpstreamByClient func(id string) (conf *proxy.UpstreamConfig, err error) `yaml:"-"`
|
2020-05-08 16:39:37 +01:00
|
|
|
|
|
|
|
// Protection configuration
|
|
|
|
// --
|
|
|
|
|
2021-06-17 12:09:16 +01:00
|
|
|
ProtectionEnabled bool `yaml:"protection_enabled"` // whether or not use any of filtering features
|
|
|
|
BlockingMode BlockingMode `yaml:"blocking_mode"` // mode how to answer filtered requests
|
|
|
|
BlockingIPv4 net.IP `yaml:"blocking_ipv4"` // IP address to be returned for a blocked A request
|
|
|
|
BlockingIPv6 net.IP `yaml:"blocking_ipv6"` // IP address to be returned for a blocked AAAA request
|
|
|
|
BlockedResponseTTL uint32 `yaml:"blocked_response_ttl"` // if 0, then default is used (3600)
|
2020-05-08 16:39:37 +01:00
|
|
|
|
|
|
|
// IP (or domain name) which is used to respond to DNS requests blocked by parental control or safe-browsing
|
|
|
|
ParentalBlockHost string `yaml:"parental_block_host"`
|
|
|
|
SafeBrowsingBlockHost string `yaml:"safebrowsing_block_host"`
|
|
|
|
|
|
|
|
// Anti-DNS amplification
|
|
|
|
// --
|
|
|
|
|
|
|
|
Ratelimit uint32 `yaml:"ratelimit"` // max number of requests per second from a given IP (0 to disable)
|
|
|
|
RatelimitWhitelist []string `yaml:"ratelimit_whitelist"` // a list of whitelisted client IP addresses
|
|
|
|
RefuseAny bool `yaml:"refuse_any"` // if true, refuse ANY requests
|
|
|
|
|
|
|
|
// Upstream DNS servers configuration
|
|
|
|
// --
|
|
|
|
|
2020-09-01 12:33:35 +01:00
|
|
|
UpstreamDNS []string `yaml:"upstream_dns"`
|
|
|
|
UpstreamDNSFileName string `yaml:"upstream_dns_file"`
|
|
|
|
BootstrapDNS []string `yaml:"bootstrap_dns"` // a list of bootstrap DNS for DoH and DoT (plain DNS only)
|
|
|
|
AllServers bool `yaml:"all_servers"` // if true, parallel queries to all configured upstream servers are enabled
|
|
|
|
FastestAddr bool `yaml:"fastest_addr"` // use Fastest Address algorithm
|
2021-08-27 18:16:07 +01:00
|
|
|
// FastestTimeout replaces the default timeout for dialing IP addresses
|
|
|
|
// when FastestAddr is true.
|
2021-09-30 19:17:54 +01:00
|
|
|
FastestTimeout timeutil.Duration `yaml:"fastest_timeout"`
|
2020-05-08 16:39:37 +01:00
|
|
|
|
|
|
|
// Access settings
|
|
|
|
// --
|
|
|
|
|
|
|
|
AllowedClients []string `yaml:"allowed_clients"` // IP addresses of whitelist clients
|
|
|
|
DisallowedClients []string `yaml:"disallowed_clients"` // IP addresses of clients that should be blocked
|
|
|
|
BlockedHosts []string `yaml:"blocked_hosts"` // hosts that should be blocked
|
2021-12-22 18:27:36 +00:00
|
|
|
// TrustedProxies is the list of IP addresses and CIDR networks to detect
|
|
|
|
// proxy servers addresses the DoH requests from which should be handled.
|
|
|
|
// The value of nil or an empty slice for this field makes Proxy not trust
|
|
|
|
// any address.
|
2021-07-26 17:30:35 +01:00
|
|
|
TrustedProxies []string `yaml:"trusted_proxies"`
|
2020-05-08 16:39:37 +01:00
|
|
|
|
|
|
|
// DNS cache settings
|
|
|
|
// --
|
|
|
|
|
|
|
|
CacheSize uint32 `yaml:"cache_size"` // DNS cache size (in bytes)
|
|
|
|
CacheMinTTL uint32 `yaml:"cache_ttl_min"` // override TTL value (minimum) received from upstream server
|
|
|
|
CacheMaxTTL uint32 `yaml:"cache_ttl_max"` // override TTL value (maximum) received from upstream server
|
2021-07-14 19:03:56 +01:00
|
|
|
// CacheOptimistic defines if optimistic cache mechanism should be used.
|
|
|
|
CacheOptimistic bool `yaml:"cache_optimistic"`
|
2020-05-08 16:39:37 +01:00
|
|
|
|
|
|
|
// Other settings
|
|
|
|
// --
|
|
|
|
|
2020-05-08 17:02:16 +01:00
|
|
|
BogusNXDomain []string `yaml:"bogus_nxdomain"` // transform responses with these IP addresses to NXDOMAIN
|
|
|
|
AAAADisabled bool `yaml:"aaaa_disabled"` // Respond with an empty answer to all AAAA requests
|
2021-12-13 15:06:01 +00:00
|
|
|
EnableDNSSEC bool `yaml:"enable_dnssec"` // Set AD flag in outcoming DNS request
|
2020-05-08 17:02:16 +01:00
|
|
|
EnableEDNSClientSubnet bool `yaml:"edns_client_subnet"` // Enable EDNS Client Subnet option
|
2020-08-14 17:27:36 +01:00
|
|
|
MaxGoroutines uint32 `yaml:"max_goroutines"` // Max. number of parallel goroutines for processing incoming requests
|
2022-04-27 09:39:48 +01:00
|
|
|
HandleDDR bool `yaml:"handle_ddr"` // Handle DDR requests
|
2020-09-02 12:13:45 +01:00
|
|
|
|
2021-06-18 15:55:01 +01:00
|
|
|
// IpsetList is the ipset configuration that allows AdGuard Home to add
|
|
|
|
// IP addresses of the specified domain names to an ipset list. Syntax:
|
|
|
|
//
|
2022-09-12 14:11:32 +01:00
|
|
|
// DOMAIN[,DOMAIN].../IPSET_NAME
|
2021-06-18 15:55:01 +01:00
|
|
|
//
|
2022-09-12 14:11:32 +01:00
|
|
|
// This field is ignored if [IpsetListFileName] is set.
|
2021-06-18 15:55:01 +01:00
|
|
|
IpsetList []string `yaml:"ipset"`
|
2022-09-09 12:51:10 +01:00
|
|
|
|
|
|
|
// IpsetListFileName, if set, points to the file with ipset configuration.
|
2022-09-12 14:11:32 +01:00
|
|
|
// The format is the same as in [IpsetList].
|
2022-09-09 12:51:10 +01:00
|
|
|
IpsetListFileName string `yaml:"ipset_file"`
|
2020-05-08 16:39:37 +01:00
|
|
|
}
|
|
|
|
|
|
|
|
// TLSConfig is the TLS configuration for HTTPS, DNS-over-HTTPS, and DNS-over-TLS
|
|
|
|
type TLSConfig struct {
|
2022-05-31 15:28:50 +01:00
|
|
|
TLSListenAddrs []*net.TCPAddr `yaml:"-" json:"-"`
|
|
|
|
QUICListenAddrs []*net.UDPAddr `yaml:"-" json:"-"`
|
|
|
|
HTTPSListenAddrs []*net.TCPAddr `yaml:"-" json:"-"`
|
2020-05-16 00:02:50 +01:00
|
|
|
|
2020-11-20 14:32:41 +00:00
|
|
|
// Reject connection if the client uses server name (in SNI) that doesn't match the certificate
|
|
|
|
StrictSNICheck bool `yaml:"strict_sni_check" json:"-"`
|
2020-05-08 16:39:37 +01:00
|
|
|
|
2020-11-20 14:32:41 +00:00
|
|
|
// PEM-encoded certificates chain
|
|
|
|
CertificateChain string `yaml:"certificate_chain" json:"certificate_chain"`
|
|
|
|
// PEM-encoded private key
|
|
|
|
PrivateKey string `yaml:"private_key" json:"private_key"`
|
|
|
|
|
|
|
|
CertificatePath string `yaml:"certificate_path" json:"certificate_path"`
|
|
|
|
PrivateKeyPath string `yaml:"private_key_path" json:"private_key_path"`
|
2020-05-08 16:39:37 +01:00
|
|
|
|
|
|
|
CertificateChainData []byte `yaml:"-" json:"-"`
|
|
|
|
PrivateKeyData []byte `yaml:"-" json:"-"`
|
|
|
|
|
2022-02-10 12:42:59 +00:00
|
|
|
// ServerName is the hostname of the server. Currently, it is only being
|
2022-04-27 09:39:48 +01:00
|
|
|
// used for ClientID checking and Discovery of Designated Resolvers (DDR).
|
2021-01-27 15:32:13 +00:00
|
|
|
ServerName string `yaml:"-" json:"-"`
|
|
|
|
|
2020-11-20 14:32:41 +00:00
|
|
|
cert tls.Certificate
|
|
|
|
// DNS names from certificate (SAN) or CN value from Subject
|
|
|
|
dnsNames []string
|
2020-05-08 16:39:37 +01:00
|
|
|
}
|
|
|
|
|
2020-12-07 14:58:33 +00:00
|
|
|
// DNSCryptConfig is the DNSCrypt server configuration struct.
|
|
|
|
type DNSCryptConfig struct {
|
2022-08-29 13:54:41 +01:00
|
|
|
ResolverCert *dnscrypt.Cert
|
|
|
|
ProviderName string
|
2021-03-23 09:32:07 +00:00
|
|
|
UDPListenAddrs []*net.UDPAddr
|
|
|
|
TCPListenAddrs []*net.TCPAddr
|
|
|
|
Enabled bool
|
2020-12-07 14:58:33 +00:00
|
|
|
}
|
|
|
|
|
2020-05-08 16:39:37 +01:00
|
|
|
// ServerConfig represents server configuration.
|
|
|
|
// The zero ServerConfig is empty and ready for use.
|
|
|
|
type ServerConfig struct {
|
2021-03-23 09:32:07 +00:00
|
|
|
UDPListenAddrs []*net.UDPAddr // UDP listen address
|
|
|
|
TCPListenAddrs []*net.TCPAddr // TCP listen address
|
2020-05-13 18:31:43 +01:00
|
|
|
UpstreamConfig *proxy.UpstreamConfig // Upstream DNS servers config
|
|
|
|
OnDNSRequest func(d *proxy.DNSContext)
|
2020-05-08 16:39:37 +01:00
|
|
|
|
|
|
|
FilteringConfig
|
|
|
|
TLSConfig
|
2020-12-07 14:58:33 +00:00
|
|
|
DNSCryptConfig
|
2021-06-18 16:13:36 +01:00
|
|
|
TLSAllowUnencryptedDoH bool
|
2020-05-08 16:39:37 +01:00
|
|
|
|
2021-06-15 15:36:49 +01:00
|
|
|
// UpstreamTimeout is the timeout for querying upstream servers.
|
|
|
|
UpstreamTimeout time.Duration
|
|
|
|
|
2020-05-08 16:39:37 +01:00
|
|
|
TLSv12Roots *x509.CertPool // list of root CAs for TLSv1.2
|
|
|
|
TLSCiphers []uint16 // list of TLS ciphers to use
|
|
|
|
|
|
|
|
// Called when the configuration is changed by HTTP request
|
|
|
|
ConfigModified func()
|
|
|
|
|
|
|
|
// Register an HTTP handler
|
2022-08-04 17:05:28 +01:00
|
|
|
HTTPRegister aghhttp.RegisterFunc
|
2021-04-07 18:16:06 +01:00
|
|
|
|
|
|
|
// ResolveClients signals if the RDNS should resolve clients' addresses.
|
|
|
|
ResolveClients bool
|
|
|
|
|
2021-05-26 15:55:19 +01:00
|
|
|
// UsePrivateRDNS defines if the PTR requests for unknown addresses from
|
|
|
|
// locally-served networks should be resolved via private PTR resolvers.
|
|
|
|
UsePrivateRDNS bool
|
|
|
|
|
2021-04-07 18:16:06 +01:00
|
|
|
// LocalPTRResolvers is a slice of addresses to be used as upstreams for
|
|
|
|
// resolving PTR queries for local addresses.
|
|
|
|
LocalPTRResolvers []string
|
2020-05-08 16:39:37 +01:00
|
|
|
}
|
|
|
|
|
|
|
|
// if any of ServerConfig values are zero, then default values from below are used
|
|
|
|
var defaultValues = ServerConfig{
|
2021-03-23 09:32:07 +00:00
|
|
|
UDPListenAddrs: []*net.UDPAddr{{Port: 53}},
|
|
|
|
TCPListenAddrs: []*net.TCPAddr{{Port: 53}},
|
2020-05-08 16:39:37 +01:00
|
|
|
FilteringConfig: FilteringConfig{BlockedResponseTTL: 3600},
|
|
|
|
}
|
|
|
|
|
2022-08-29 13:54:41 +01:00
|
|
|
// createProxyConfig creates and validates configuration for the main proxy.
|
|
|
|
func (s *Server) createProxyConfig() (conf proxy.Config, err error) {
|
|
|
|
srvConf := s.conf
|
|
|
|
conf = proxy.Config{
|
|
|
|
UDPListenAddr: srvConf.UDPListenAddrs,
|
|
|
|
TCPListenAddr: srvConf.TCPListenAddrs,
|
|
|
|
Ratelimit: int(srvConf.Ratelimit),
|
|
|
|
RatelimitWhitelist: srvConf.RatelimitWhitelist,
|
|
|
|
RefuseAny: srvConf.RefuseAny,
|
|
|
|
TrustedProxies: srvConf.TrustedProxies,
|
|
|
|
CacheMinTTL: srvConf.CacheMinTTL,
|
|
|
|
CacheMaxTTL: srvConf.CacheMaxTTL,
|
|
|
|
CacheOptimistic: srvConf.CacheOptimistic,
|
|
|
|
UpstreamConfig: srvConf.UpstreamConfig,
|
2020-05-13 18:31:43 +01:00
|
|
|
BeforeRequestHandler: s.beforeRequestHandler,
|
|
|
|
RequestHandler: s.handleDNSRequest,
|
2022-08-29 13:54:41 +01:00
|
|
|
EnableEDNSClientSubnet: srvConf.EnableEDNSClientSubnet,
|
|
|
|
MaxGoroutines: int(srvConf.MaxGoroutines),
|
2020-06-10 13:33:23 +01:00
|
|
|
}
|
|
|
|
|
2022-08-29 13:54:41 +01:00
|
|
|
if srvConf.CacheSize != 0 {
|
|
|
|
conf.CacheEnabled = true
|
|
|
|
conf.CacheSizeBytes = int(srvConf.CacheSize)
|
2020-06-16 13:13:38 +01:00
|
|
|
}
|
|
|
|
|
2022-08-29 13:54:41 +01:00
|
|
|
setProxyUpstreamMode(
|
|
|
|
&conf,
|
|
|
|
srvConf.AllServers,
|
|
|
|
srvConf.FastestAddr,
|
|
|
|
srvConf.FastestTimeout.Duration,
|
|
|
|
)
|
2020-05-08 16:39:37 +01:00
|
|
|
|
2022-08-29 13:54:41 +01:00
|
|
|
for i, s := range srvConf.BogusNXDomain {
|
|
|
|
var subnet *net.IPNet
|
|
|
|
subnet, err = netutil.ParseSubnet(s)
|
2022-01-25 15:54:37 +00:00
|
|
|
if err != nil {
|
|
|
|
log.Error("subnet at index %d: %s", i, err)
|
|
|
|
|
|
|
|
continue
|
2020-05-08 16:39:37 +01:00
|
|
|
}
|
2022-01-25 15:54:37 +00:00
|
|
|
|
2022-08-29 13:54:41 +01:00
|
|
|
conf.BogusNXDomain = append(conf.BogusNXDomain, subnet)
|
2020-05-08 16:39:37 +01:00
|
|
|
}
|
|
|
|
|
2022-08-29 13:54:41 +01:00
|
|
|
err = s.prepareTLS(&conf)
|
2020-05-08 16:39:37 +01:00
|
|
|
if err != nil {
|
2022-08-29 13:54:41 +01:00
|
|
|
return conf, fmt.Errorf("validating tls: %w", err)
|
2020-05-08 16:39:37 +01:00
|
|
|
}
|
|
|
|
|
2022-08-29 13:54:41 +01:00
|
|
|
if c := srvConf.DNSCryptConfig; c.Enabled {
|
|
|
|
conf.DNSCryptUDPListenAddr = c.UDPListenAddrs
|
|
|
|
conf.DNSCryptTCPListenAddr = c.TCPListenAddrs
|
|
|
|
conf.DNSCryptProviderName = c.ProviderName
|
|
|
|
conf.DNSCryptResolverCert = c.ResolverCert
|
2020-12-07 14:58:33 +00:00
|
|
|
}
|
|
|
|
|
2022-08-29 13:54:41 +01:00
|
|
|
if conf.UpstreamConfig == nil || len(conf.UpstreamConfig.Upstreams) == 0 {
|
|
|
|
return conf, errors.Error("no default upstream servers configured")
|
2020-05-08 16:39:37 +01:00
|
|
|
}
|
|
|
|
|
2022-08-29 13:54:41 +01:00
|
|
|
return conf, nil
|
2020-05-08 16:39:37 +01:00
|
|
|
}
|
|
|
|
|
2022-07-28 18:18:07 +01:00
|
|
|
const (
|
|
|
|
defaultSafeBrowsingBlockHost = "standard-block.dns.adguard.com"
|
|
|
|
defaultParentalBlockHost = "family-block.dns.adguard.com"
|
|
|
|
)
|
|
|
|
|
2020-05-08 16:39:37 +01:00
|
|
|
// initDefaultSettings initializes default settings if nothing
|
|
|
|
// is configured
|
|
|
|
func (s *Server) initDefaultSettings() {
|
|
|
|
if len(s.conf.UpstreamDNS) == 0 {
|
|
|
|
s.conf.UpstreamDNS = defaultDNS
|
|
|
|
}
|
2021-03-23 09:32:07 +00:00
|
|
|
|
2020-05-08 16:39:37 +01:00
|
|
|
if len(s.conf.BootstrapDNS) == 0 {
|
|
|
|
s.conf.BootstrapDNS = defaultBootstrap
|
|
|
|
}
|
2021-03-23 09:32:07 +00:00
|
|
|
|
2022-07-28 18:18:07 +01:00
|
|
|
if s.conf.ParentalBlockHost == "" {
|
|
|
|
s.conf.ParentalBlockHost = defaultParentalBlockHost
|
2020-05-08 16:39:37 +01:00
|
|
|
}
|
2021-03-23 09:32:07 +00:00
|
|
|
|
2022-07-28 18:18:07 +01:00
|
|
|
if s.conf.SafeBrowsingBlockHost == "" {
|
|
|
|
s.conf.SafeBrowsingBlockHost = defaultSafeBrowsingBlockHost
|
2020-05-08 16:39:37 +01:00
|
|
|
}
|
2021-03-23 09:32:07 +00:00
|
|
|
|
|
|
|
if s.conf.UDPListenAddrs == nil {
|
|
|
|
s.conf.UDPListenAddrs = defaultValues.UDPListenAddrs
|
2020-05-08 16:39:37 +01:00
|
|
|
}
|
2021-03-23 09:32:07 +00:00
|
|
|
|
|
|
|
if s.conf.TCPListenAddrs == nil {
|
|
|
|
s.conf.TCPListenAddrs = defaultValues.TCPListenAddrs
|
2020-05-08 16:39:37 +01:00
|
|
|
}
|
2021-03-23 09:32:07 +00:00
|
|
|
|
2020-09-10 10:32:36 +01:00
|
|
|
if len(s.conf.BlockedHosts) == 0 {
|
|
|
|
s.conf.BlockedHosts = defaultBlockedHosts
|
|
|
|
}
|
2021-06-15 15:36:49 +01:00
|
|
|
|
|
|
|
if s.conf.UpstreamTimeout == 0 {
|
|
|
|
s.conf.UpstreamTimeout = DefaultTimeout
|
|
|
|
}
|
2020-05-08 16:39:37 +01:00
|
|
|
}
|
|
|
|
|
|
|
|
// prepareUpstreamSettings - prepares upstream DNS server settings
|
|
|
|
func (s *Server) prepareUpstreamSettings() error {
|
2020-09-08 15:28:01 +01:00
|
|
|
// We're setting a customized set of RootCAs
|
|
|
|
// The reason is that Go default mechanism of loading TLS roots
|
|
|
|
// does not always work properly on some routers so we're
|
|
|
|
// loading roots manually and pass it here.
|
|
|
|
// See "util.LoadSystemRootCAs"
|
|
|
|
upstream.RootCAs = s.conf.TLSv12Roots
|
|
|
|
|
|
|
|
// See util.InitTLSCiphers -- removed unsafe ciphers
|
|
|
|
if len(s.conf.TLSCiphers) > 0 {
|
|
|
|
upstream.CipherSuites = s.conf.TLSCiphers
|
|
|
|
}
|
|
|
|
|
2020-09-09 12:35:11 +01:00
|
|
|
// Load upstreams either from the file, or from the settings
|
2020-09-01 12:33:35 +01:00
|
|
|
var upstreams []string
|
|
|
|
if s.conf.UpstreamDNSFileName != "" {
|
2021-05-21 12:55:42 +01:00
|
|
|
data, err := os.ReadFile(s.conf.UpstreamDNSFileName)
|
2020-09-01 12:33:35 +01:00
|
|
|
if err != nil {
|
2022-09-06 15:09:54 +01:00
|
|
|
return fmt.Errorf("reading upstream from file: %w", err)
|
2020-09-01 12:33:35 +01:00
|
|
|
}
|
2021-07-29 15:40:31 +01:00
|
|
|
|
|
|
|
upstreams = stringutil.SplitTrimmed(string(data), "\n")
|
|
|
|
|
2021-03-25 13:00:27 +00:00
|
|
|
log.Debug("dns: using %d upstream servers from file %s", len(upstreams), s.conf.UpstreamDNSFileName)
|
2020-09-01 12:33:35 +01:00
|
|
|
} else {
|
|
|
|
upstreams = s.conf.UpstreamDNS
|
|
|
|
}
|
2021-03-11 09:17:54 +00:00
|
|
|
|
2021-07-29 15:40:31 +01:00
|
|
|
upstreams = stringutil.FilterOut(upstreams, IsCommentOrEmpty)
|
2021-03-11 09:17:54 +00:00
|
|
|
upstreamConfig, err := proxy.ParseUpstreamsConfig(
|
|
|
|
upstreams,
|
2021-06-29 13:53:28 +01:00
|
|
|
&upstream.Options{
|
2021-03-03 12:27:25 +00:00
|
|
|
Bootstrap: s.conf.BootstrapDNS,
|
2021-06-15 15:36:49 +01:00
|
|
|
Timeout: s.conf.UpstreamTimeout,
|
2021-03-03 12:27:25 +00:00
|
|
|
},
|
|
|
|
)
|
2020-05-08 16:39:37 +01:00
|
|
|
if err != nil {
|
2022-09-06 15:09:54 +01:00
|
|
|
return fmt.Errorf("parsing upstream config: %w", err)
|
2020-05-08 16:39:37 +01:00
|
|
|
}
|
2020-09-09 16:12:11 +01:00
|
|
|
|
|
|
|
if len(upstreamConfig.Upstreams) == 0 {
|
2021-02-16 15:46:49 +00:00
|
|
|
log.Info("warning: no default upstream servers specified, using %v", defaultDNS)
|
2021-06-29 13:53:28 +01:00
|
|
|
var uc *proxy.UpstreamConfig
|
2021-03-11 18:30:52 +00:00
|
|
|
uc, err = proxy.ParseUpstreamsConfig(
|
2021-03-11 09:17:54 +00:00
|
|
|
defaultDNS,
|
2021-06-29 13:53:28 +01:00
|
|
|
&upstream.Options{
|
2021-03-03 12:27:25 +00:00
|
|
|
Bootstrap: s.conf.BootstrapDNS,
|
2021-06-15 15:36:49 +01:00
|
|
|
Timeout: s.conf.UpstreamTimeout,
|
2021-03-03 12:27:25 +00:00
|
|
|
},
|
|
|
|
)
|
2020-09-09 16:12:11 +01:00
|
|
|
if err != nil {
|
2022-09-06 15:09:54 +01:00
|
|
|
return fmt.Errorf("parsing default upstreams: %w", err)
|
2020-09-09 16:12:11 +01:00
|
|
|
}
|
2022-09-06 15:09:54 +01:00
|
|
|
|
2020-09-09 16:12:11 +01:00
|
|
|
upstreamConfig.Upstreams = uc.Upstreams
|
|
|
|
}
|
|
|
|
|
2021-06-29 13:53:28 +01:00
|
|
|
s.conf.UpstreamConfig = upstreamConfig
|
|
|
|
|
2020-05-08 16:39:37 +01:00
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2022-08-29 13:54:41 +01:00
|
|
|
// setProxyUpstreamMode sets the upstream mode and related settings in conf
|
|
|
|
// based on provided parameters.
|
|
|
|
func setProxyUpstreamMode(
|
|
|
|
conf *proxy.Config,
|
|
|
|
allServers bool,
|
|
|
|
fastestAddr bool,
|
|
|
|
fastestTimeout time.Duration,
|
|
|
|
) {
|
|
|
|
if allServers {
|
|
|
|
conf.UpstreamMode = proxy.UModeParallel
|
|
|
|
} else if fastestAddr {
|
|
|
|
conf.UpstreamMode = proxy.UModeFastestAddr
|
|
|
|
conf.FastestPingTimeout = fastestTimeout
|
|
|
|
} else {
|
|
|
|
conf.UpstreamMode = proxy.UModeLoadBalance
|
|
|
|
}
|
2020-05-08 16:39:37 +01:00
|
|
|
}
|
|
|
|
|
2022-09-12 14:11:32 +01:00
|
|
|
// prepareIpsetListSettings reads and prepares the ipset configuration either
|
|
|
|
// from a file or from the data in the configuration file.
|
|
|
|
func (s *Server) prepareIpsetListSettings() (err error) {
|
|
|
|
fn := s.conf.IpsetListFileName
|
|
|
|
if fn == "" {
|
|
|
|
return s.ipset.init(s.conf.IpsetList)
|
|
|
|
}
|
|
|
|
|
|
|
|
data, err := os.ReadFile(fn)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
ipsets := stringutil.SplitTrimmed(string(data), "\n")
|
|
|
|
|
|
|
|
log.Debug("dns: using %d ipset rules from file %q", len(ipsets), fn)
|
|
|
|
|
|
|
|
return s.ipset.init(ipsets)
|
|
|
|
}
|
|
|
|
|
2020-05-08 16:39:37 +01:00
|
|
|
// prepareTLS - prepares TLS configuration for the DNS proxy
|
|
|
|
func (s *Server) prepareTLS(proxyConfig *proxy.Config) error {
|
2020-09-08 15:20:24 +01:00
|
|
|
if len(s.conf.CertificateChainData) == 0 || len(s.conf.PrivateKeyData) == 0 {
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2021-03-23 09:32:07 +00:00
|
|
|
if s.conf.TLSListenAddrs == nil && s.conf.QUICListenAddrs == nil {
|
2020-09-08 15:20:24 +01:00
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2022-09-06 15:09:54 +01:00
|
|
|
proxyConfig.TLSListenAddr = aghalg.CoalesceSlice(
|
|
|
|
s.conf.TLSListenAddrs,
|
|
|
|
proxyConfig.TLSListenAddr,
|
|
|
|
)
|
2020-09-08 15:20:24 +01:00
|
|
|
|
2022-09-06 15:09:54 +01:00
|
|
|
proxyConfig.QUICListenAddr = aghalg.CoalesceSlice(
|
|
|
|
s.conf.QUICListenAddrs,
|
|
|
|
proxyConfig.QUICListenAddr,
|
|
|
|
)
|
2020-09-08 15:20:24 +01:00
|
|
|
|
|
|
|
var err error
|
|
|
|
s.conf.cert, err = tls.X509KeyPair(s.conf.CertificateChainData, s.conf.PrivateKeyData)
|
|
|
|
if err != nil {
|
2020-11-05 12:20:57 +00:00
|
|
|
return fmt.Errorf("failed to parse TLS keypair: %w", err)
|
2020-09-08 15:20:24 +01:00
|
|
|
}
|
|
|
|
|
|
|
|
if s.conf.StrictSNICheck {
|
2021-03-11 18:30:52 +00:00
|
|
|
var x *x509.Certificate
|
|
|
|
x, err = x509.ParseCertificate(s.conf.cert.Certificate[0])
|
2020-05-08 16:39:37 +01:00
|
|
|
if err != nil {
|
2020-11-05 12:20:57 +00:00
|
|
|
return fmt.Errorf("x509.ParseCertificate(): %w", err)
|
2020-05-08 16:39:37 +01:00
|
|
|
}
|
2020-09-08 15:20:24 +01:00
|
|
|
if len(x.DNSNames) != 0 {
|
|
|
|
s.conf.dnsNames = x.DNSNames
|
2021-03-25 13:00:27 +00:00
|
|
|
log.Debug("dns: using DNS names from certificate's SAN: %v", x.DNSNames)
|
2020-09-08 15:20:24 +01:00
|
|
|
sort.Strings(s.conf.dnsNames)
|
|
|
|
} else {
|
|
|
|
s.conf.dnsNames = append(s.conf.dnsNames, x.Subject.CommonName)
|
2021-03-25 13:00:27 +00:00
|
|
|
log.Debug("dns: using DNS name from certificate's CN: %s", x.Subject.CommonName)
|
2020-05-08 16:39:37 +01:00
|
|
|
}
|
2020-09-08 15:20:24 +01:00
|
|
|
}
|
2020-05-08 16:39:37 +01:00
|
|
|
|
2020-09-08 15:20:24 +01:00
|
|
|
proxyConfig.TLSConfig = &tls.Config{
|
|
|
|
GetCertificate: s.onGetCertificate,
|
2022-01-26 11:39:34 +00:00
|
|
|
CipherSuites: aghtls.SaferCipherSuites(),
|
2020-09-08 15:20:24 +01:00
|
|
|
MinVersion: tls.VersionTLS12,
|
2020-05-08 16:39:37 +01:00
|
|
|
}
|
2020-09-08 15:20:24 +01:00
|
|
|
|
2020-05-08 16:39:37 +01:00
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2021-05-28 11:02:59 +01:00
|
|
|
// isInSorted returns true if s is in the sorted slice strs.
|
|
|
|
func isInSorted(strs []string, s string) (ok bool) {
|
|
|
|
i := sort.SearchStrings(strs, s)
|
|
|
|
if i == len(strs) || strs[i] != s {
|
|
|
|
return false
|
|
|
|
}
|
|
|
|
|
|
|
|
return true
|
|
|
|
}
|
|
|
|
|
|
|
|
// isWildcard returns true if host is a wildcard hostname.
|
|
|
|
func isWildcard(host string) (ok bool) {
|
|
|
|
return len(host) >= 2 && host[0] == '*' && host[1] == '.'
|
|
|
|
}
|
|
|
|
|
|
|
|
// matchesDomainWildcard returns true if host matches the domain wildcard
|
|
|
|
// pattern pat.
|
|
|
|
func matchesDomainWildcard(host, pat string) (ok bool) {
|
|
|
|
return isWildcard(pat) && strings.HasSuffix(host, pat[1:])
|
|
|
|
}
|
|
|
|
|
|
|
|
// anyNameMatches returns true if sni, the client's SNI value, matches any of
|
|
|
|
// the DNS names and patterns from certificate. dnsNames must be sorted.
|
|
|
|
func anyNameMatches(dnsNames []string, sni string) (ok bool) {
|
2021-08-09 14:03:37 +01:00
|
|
|
if netutil.ValidateDomainName(sni) != nil {
|
2021-05-28 11:02:59 +01:00
|
|
|
return false
|
|
|
|
}
|
|
|
|
|
|
|
|
if isInSorted(dnsNames, sni) {
|
|
|
|
return true
|
|
|
|
}
|
|
|
|
|
|
|
|
for _, dn := range dnsNames {
|
|
|
|
if matchesDomainWildcard(sni, dn) {
|
|
|
|
return true
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return false
|
|
|
|
}
|
|
|
|
|
2020-05-08 16:39:37 +01:00
|
|
|
// Called by 'tls' package when Client Hello is received
|
|
|
|
// If the server name (from SNI) supplied by client is incorrect - we terminate the ongoing TLS handshake.
|
|
|
|
func (s *Server) onGetCertificate(ch *tls.ClientHelloInfo) (*tls.Certificate, error) {
|
2021-05-28 11:02:59 +01:00
|
|
|
if s.conf.StrictSNICheck && !anyNameMatches(s.conf.dnsNames, ch.ServerName) {
|
2021-03-25 13:00:27 +00:00
|
|
|
log.Info("dns: tls: unknown SNI in Client Hello: %s", ch.ServerName)
|
2020-05-08 16:39:37 +01:00
|
|
|
return nil, fmt.Errorf("invalid SNI")
|
|
|
|
}
|
|
|
|
return &s.conf.cert, nil
|
|
|
|
}
|