AdGuardHome/dnsforward/dnsforward.go

407 lines
11 KiB
Go
Raw Normal View History

2018-11-28 12:40:56 +00:00
package dnsforward
import (
2018-12-24 13:58:48 +00:00
"errors"
2018-11-28 12:40:56 +00:00
"fmt"
"net"
"strings"
2018-11-28 12:40:56 +00:00
"sync"
"time"
2018-11-28 12:40:56 +00:00
"github.com/AdguardTeam/AdGuardHome/dnsfilter"
2018-12-24 13:58:48 +00:00
"github.com/AdguardTeam/dnsproxy/proxy"
"github.com/AdguardTeam/dnsproxy/upstream"
"github.com/hmage/golibs/log"
2018-11-28 12:40:56 +00:00
"github.com/joomcode/errorx"
"github.com/miekg/dns"
2018-12-24 12:19:52 +00:00
)
// DefaultTimeout is the default upstream timeout
const DefaultTimeout = 10 * time.Second
2018-12-24 12:19:52 +00:00
const (
safeBrowsingBlockHost = "standard-block.dns.adguard.com"
parentalBlockHost = "family-block.dns.adguard.com"
2018-11-28 12:40:56 +00:00
)
2018-12-05 09:52:23 +00:00
// Server is the main way to start a DNS server.
//
2018-11-28 12:40:56 +00:00
// Example:
2018-12-05 09:52:23 +00:00
// s := dnsforward.Server{}
// err := s.Start(nil) // will start a DNS server listening on default port 53, in a goroutine
// err := s.Reconfigure(ServerConfig{UDPListenAddr: &net.UDPAddr{Port: 53535}}) // will reconfigure running DNS server to listen on UDP port 53535
// err := s.Stop() // will stop listening on port 53535 and cancel all goroutines
// err := s.Start(nil) // will start listening again, on port 53535, in a goroutine
2018-11-28 12:40:56 +00:00
//
// The zero Server is empty and ready for use.
type Server struct {
2018-12-24 12:19:52 +00:00
dnsProxy *proxy.Proxy // DNS proxy instance
2018-11-28 12:40:56 +00:00
2018-12-24 12:19:52 +00:00
dnsFilter *dnsfilter.Dnsfilter // DNS filter instance
2018-11-28 12:40:56 +00:00
sync.RWMutex
ServerConfig
}
2018-12-24 12:19:52 +00:00
// FilteringConfig represents the DNS filtering configuration of AdGuard Home
type FilteringConfig struct {
2018-12-24 12:19:52 +00:00
ProtectionEnabled bool `yaml:"protection_enabled"` // whether or not use any of dnsfilter features
FilteringEnabled bool `yaml:"filtering_enabled"` // whether or not use filter lists
BlockedResponseTTL uint32 `yaml:"blocked_response_ttl"` // if 0, then default is used (3600)
QueryLogEnabled bool `yaml:"querylog_enabled"`
Ratelimit int `yaml:"ratelimit"`
RatelimitWhitelist []string `yaml:"ratelimit_whitelist"`
RefuseAny bool `yaml:"refuse_any"`
BootstrapDNS string `yaml:"bootstrap_dns"`
dnsfilter.Config `yaml:",inline"`
}
2018-12-24 12:19:52 +00:00
// ServerConfig represents server configuration.
2018-11-28 12:40:56 +00:00
// The zero ServerConfig is empty and ready for use.
type ServerConfig struct {
2018-12-24 12:19:52 +00:00
UDPListenAddr *net.UDPAddr // UDP listen address
2019-01-05 19:15:20 +00:00
TCPListenAddr *net.TCPAddr // TCP listen address
2018-12-24 12:19:52 +00:00
Upstreams []upstream.Upstream // Configured upstreams
Filters []dnsfilter.Filter // A list of filters to use
FilteringConfig
2018-11-28 12:40:56 +00:00
}
// if any of ServerConfig values are zero, then default values from below are used
2018-11-28 12:40:56 +00:00
var defaultValues = ServerConfig{
UDPListenAddr: &net.UDPAddr{Port: 53},
2019-01-05 19:15:20 +00:00
TCPListenAddr: &net.TCPAddr{Port: 53},
FilteringConfig: FilteringConfig{BlockedResponseTTL: 3600},
2018-11-28 12:40:56 +00:00
}
2018-12-24 12:19:52 +00:00
func init() {
defaultDNS := []string{"8.8.8.8:53", "8.8.4.4:53"}
defaultUpstreams := make([]upstream.Upstream, 0)
for _, addr := range defaultDNS {
u, err := upstream.AddressToUpstream(addr, "", DefaultTimeout)
2018-12-24 12:19:52 +00:00
if err == nil {
defaultUpstreams = append(defaultUpstreams, u)
2018-11-28 12:40:56 +00:00
}
}
2018-12-24 12:19:52 +00:00
defaultValues.Upstreams = defaultUpstreams
2018-11-28 12:40:56 +00:00
}
2018-12-24 12:19:52 +00:00
// Start starts the DNS server
2018-11-28 12:40:56 +00:00
func (s *Server) Start(config *ServerConfig) error {
s.Lock()
defer s.Unlock()
2018-12-24 12:19:52 +00:00
return s.startInternal(config)
}
// startInternal starts without locking
func (s *Server) startInternal(config *ServerConfig) error {
2018-11-28 12:40:56 +00:00
if config != nil {
s.ServerConfig = *config
}
2018-12-24 12:27:14 +00:00
if s.dnsFilter != nil || s.dnsProxy != nil {
return errors.New("DNS server is already started")
2018-11-28 12:40:56 +00:00
}
2018-12-24 12:27:14 +00:00
err := s.initDNSFilter()
if err != nil {
return err
}
2018-12-24 12:27:14 +00:00
log.Printf("Loading stats from querylog")
err = fillStatsFromQueryLog()
if err != nil {
return errorx.Decorate(err, "failed to load stats from querylog")
}
once.Do(func() {
go periodicQueryLogRotate()
go periodicHourlyTopRotate()
go statsRotator()
})
2018-12-24 12:19:52 +00:00
proxyConfig := proxy.Config{
UDPListenAddr: s.UDPListenAddr,
2019-01-05 19:15:20 +00:00
TCPListenAddr: s.TCPListenAddr,
2018-12-24 12:19:52 +00:00
Ratelimit: s.Ratelimit,
RatelimitWhitelist: s.RatelimitWhitelist,
RefuseAny: s.RefuseAny,
CacheEnabled: true,
Upstreams: s.Upstreams,
2018-12-24 15:47:33 +00:00
Handler: s.handleDNSRequest,
2018-12-24 12:19:52 +00:00
}
2018-11-28 12:40:56 +00:00
2018-12-24 12:19:52 +00:00
if proxyConfig.UDPListenAddr == nil {
proxyConfig.UDPListenAddr = defaultValues.UDPListenAddr
}
2019-01-05 19:15:20 +00:00
if proxyConfig.TCPListenAddr == nil {
proxyConfig.TCPListenAddr = defaultValues.TCPListenAddr
}
2018-12-24 12:19:52 +00:00
if len(proxyConfig.Upstreams) == 0 {
proxyConfig.Upstreams = defaultValues.Upstreams
}
2018-12-24 12:27:14 +00:00
// Initialize and start the DNS proxy
2018-12-24 12:19:52 +00:00
s.dnsProxy = &proxy.Proxy{Config: proxyConfig}
2018-12-24 12:27:14 +00:00
return s.dnsProxy.Start()
}
2018-12-24 12:19:52 +00:00
2018-12-24 12:27:14 +00:00
// Initializes the DNS filter
func (s *Server) initDNSFilter() error {
log.Printf("Creating dnsfilter")
s.dnsFilter = dnsfilter.New(&s.Config)
// add rules only if they are enabled
if s.FilteringEnabled {
err := s.dnsFilter.AddRules(s.Filters)
if err != nil {
return errorx.Decorate(err, "could not initialize dnsfilter")
}
}
return nil
2018-11-28 12:40:56 +00:00
}
2018-12-24 12:19:52 +00:00
// Stop stops the DNS server
2018-11-28 12:40:56 +00:00
func (s *Server) Stop() error {
s.Lock()
defer s.Unlock()
2018-12-24 12:19:52 +00:00
return s.stopInternal()
}
// stopInternal stops without locking
func (s *Server) stopInternal() error {
if s.dnsProxy != nil {
err := s.dnsProxy.Stop()
s.dnsProxy = nil
2018-11-28 12:40:56 +00:00
if err != nil {
2018-12-24 12:19:52 +00:00
return errorx.Decorate(err, "could not stop the DNS server properly")
2018-11-28 12:40:56 +00:00
}
}
2018-12-24 12:19:52 +00:00
if s.dnsFilter != nil {
s.dnsFilter.Destroy()
s.dnsFilter = nil
}
// flush remainder to file
logBufferLock.Lock()
flushBuffer := logBuffer
logBuffer = nil
logBufferLock.Unlock()
err := flushToFile(flushBuffer)
if err != nil {
log.Printf("Saving querylog to file failed: %s", err)
return err
}
2018-11-28 12:40:56 +00:00
return nil
}
2018-12-24 12:19:52 +00:00
// IsRunning returns true if the DNS server is running
func (s *Server) IsRunning() bool {
s.RLock()
isRunning := true
2018-12-24 12:19:52 +00:00
if s.dnsProxy == nil {
isRunning = false
}
s.RUnlock()
return isRunning
}
2018-12-24 12:19:52 +00:00
// Reconfigure applies the new configuration to the DNS server
func (s *Server) Reconfigure(config *ServerConfig) error {
s.Lock()
defer s.Unlock()
2018-11-28 12:40:56 +00:00
2018-12-24 12:19:52 +00:00
log.Print("Start reconfiguring the server")
err := s.stopInternal()
if err != nil {
return errorx.Decorate(err, "could not reconfigure the server")
2018-11-28 12:40:56 +00:00
}
2018-12-24 12:19:52 +00:00
err = s.startInternal(config)
if err != nil {
return errorx.Decorate(err, "could not reconfigure the server")
2018-11-28 12:40:56 +00:00
}
return nil
}
2018-12-24 15:47:33 +00:00
// handleDNSRequest filters the incoming DNS requests and writes them to the query log
func (s *Server) handleDNSRequest(p *proxy.Proxy, d *proxy.DNSContext) error {
2018-12-24 12:19:52 +00:00
start := time.Now()
2018-11-28 12:40:56 +00:00
2018-12-24 12:19:52 +00:00
// use dnsfilter before cache -- changed settings or filters would require cache invalidation otherwise
res, err := s.filterDNSRequest(d)
if err != nil {
return err
2018-11-28 12:40:56 +00:00
}
2018-12-24 12:19:52 +00:00
if d.Res == nil {
// request was not filtered so let it be processed further
2018-12-24 15:47:33 +00:00
err = p.Resolve(d)
2018-12-24 12:19:52 +00:00
if err != nil {
return err
}
}
2018-12-24 12:19:52 +00:00
shouldLog := true
msg := d.Req
2018-12-24 12:19:52 +00:00
// don't log ANY request if refuseAny is enabled
if len(msg.Question) >= 1 && msg.Question[0].Qtype == dns.TypeANY && s.RefuseAny {
shouldLog = false
2018-11-28 12:40:56 +00:00
}
2018-12-24 12:19:52 +00:00
if s.QueryLogEnabled && shouldLog {
elapsed := time.Since(start)
upstreamAddr := ""
if d.Upstream != nil {
upstreamAddr = d.Upstream.Address()
}
2018-12-24 20:06:36 +00:00
logRequest(msg, d.Res, res, elapsed, d.Addr, upstreamAddr)
2018-11-28 12:40:56 +00:00
}
return nil
}
2018-12-24 12:19:52 +00:00
// filterDNSRequest applies the dnsFilter and sets d.Res if the request was filtered
func (s *Server) filterDNSRequest(d *proxy.DNSContext) (*dnsfilter.Result, error) {
msg := d.Req
host := strings.TrimSuffix(msg.Question[0].Name, ".")
2018-11-28 12:40:56 +00:00
2018-12-24 12:19:52 +00:00
s.RLock()
protectionEnabled := s.ProtectionEnabled
dnsFilter := s.dnsFilter
s.RUnlock()
2018-11-28 12:40:56 +00:00
2018-12-24 12:19:52 +00:00
if !protectionEnabled {
return nil, nil
}
var res dnsfilter.Result
var err error
2018-11-28 12:40:56 +00:00
2018-12-24 12:19:52 +00:00
res, err = dnsFilter.CheckHost(host)
2018-11-28 12:40:56 +00:00
if err != nil {
2018-12-24 12:19:52 +00:00
// Return immediately if there's an error
return nil, errorx.Decorate(err, "dnsfilter failed to check host '%s'", host)
} else if res.IsFiltered {
// log.Tracef("Host %s is filtered, reason - '%s', matched rule: '%s'", host, res.Reason, res.Rule)
2018-12-24 12:19:52 +00:00
d.Res = s.genDNSFilterMessage(d, &res)
2018-11-28 12:40:56 +00:00
}
2018-12-24 12:19:52 +00:00
return &res, err
}
2018-12-24 12:19:52 +00:00
// genDNSFilterMessage generates a DNS message corresponding to the filtering result
func (s *Server) genDNSFilterMessage(d *proxy.DNSContext, result *dnsfilter.Result) *dns.Msg {
m := d.Req
2018-12-24 12:19:52 +00:00
if m.Question[0].Qtype != dns.TypeA {
return s.genNXDomain(m)
}
2018-12-24 12:19:52 +00:00
switch result.Reason {
case dnsfilter.FilteredSafeBrowsing:
return s.genBlockedHost(m, safeBrowsingBlockHost, d.Upstream)
case dnsfilter.FilteredParental:
return s.genBlockedHost(m, parentalBlockHost, d.Upstream)
default:
2019-01-24 17:11:01 +00:00
if result.IP != nil {
return s.genARecord(m, result.IP)
}
2018-12-24 12:19:52 +00:00
return s.genNXDomain(m)
}
2018-11-28 12:40:56 +00:00
}
func (s *Server) genServerFailure(request *dns.Msg) *dns.Msg {
2018-11-28 12:40:56 +00:00
resp := dns.Msg{}
resp.SetRcode(request, dns.RcodeServerFailure)
resp.RecursionAvailable = true
return &resp
}
2018-12-24 12:19:52 +00:00
func (s *Server) genARecord(request *dns.Msg, ip net.IP) *dns.Msg {
resp := dns.Msg{}
2018-12-24 12:19:52 +00:00
resp.SetReply(request)
answer, err := dns.NewRR(fmt.Sprintf("%s %d A %s", request.Question[0].Name, s.BlockedResponseTTL, ip.String()))
if err != nil {
log.Printf("Couldn't generate A record for replacement host '%s': %s", ip.String(), err)
2018-12-24 12:19:52 +00:00
return s.genServerFailure(request)
}
resp.Answer = append(resp.Answer, answer)
return &resp
2018-11-28 12:40:56 +00:00
}
2018-12-24 12:19:52 +00:00
func (s *Server) genBlockedHost(request *dns.Msg, newAddr string, upstream upstream.Upstream) *dns.Msg {
// look up the hostname, TODO: cache
replReq := dns.Msg{}
replReq.SetQuestion(dns.Fqdn(newAddr), request.Question[0].Qtype)
replReq.RecursionDesired = true
reply, err := upstream.Exchange(&replReq)
if err != nil {
log.Printf("Couldn't look up replacement host '%s' on upstream %s: %s", newAddr, upstream.Address(), err)
return s.genServerFailure(request)
}
resp := dns.Msg{}
resp.SetReply(request)
resp.Authoritative, resp.RecursionAvailable = true, true
if reply != nil {
for _, answer := range reply.Answer {
answer.Header().Name = request.Question[0].Name
resp.Answer = append(resp.Answer, answer)
}
}
return &resp
}
func (s *Server) genNXDomain(request *dns.Msg) *dns.Msg {
2018-11-28 12:40:56 +00:00
resp := dns.Msg{}
resp.SetRcode(request, dns.RcodeNameError)
resp.RecursionAvailable = true
2018-11-28 12:40:56 +00:00
resp.Ns = s.genSOA(request)
return &resp
2018-11-28 12:40:56 +00:00
}
func (s *Server) genSOA(request *dns.Msg) []dns.RR {
zone := ""
if len(request.Question) > 0 {
zone = request.Question[0].Name
}
soa := dns.SOA{
// values copied from verisign's nonexistent .com domain
// their exact values are not important in our use case because they are used for domain transfers between primary/secondary DNS servers
Refresh: 1800,
Retry: 900,
Expire: 604800,
Minttl: 86400,
// copied from AdGuard DNS
Ns: "fake-for-negative-caching.adguard.com.",
Serial: 100500,
// rest is request-specific
Hdr: dns.RR_Header{
Name: zone,
Rrtype: dns.TypeSOA,
Ttl: s.BlockedResponseTTL,
2018-11-28 12:40:56 +00:00
Class: dns.ClassINET,
},
Mbox: "hostmaster.", // zone will be appended later if it's not empty or "."
}
if soa.Hdr.Ttl == 0 {
soa.Hdr.Ttl = defaultValues.BlockedResponseTTL
2018-11-28 12:40:56 +00:00
}
if len(zone) > 0 && zone[0] != '.' {
soa.Mbox += zone
}
return []dns.RR{&soa}
}
var once sync.Once