2020-05-08 16:39:37 +01:00
|
|
|
package dnsforward
|
|
|
|
|
|
|
|
import (
|
|
|
|
"net"
|
|
|
|
"time"
|
|
|
|
|
2021-05-21 14:15:47 +01:00
|
|
|
"github.com/AdguardTeam/AdGuardHome/internal/filtering"
|
2020-05-08 16:39:37 +01:00
|
|
|
"github.com/AdguardTeam/dnsproxy/proxy"
|
2020-12-07 12:38:05 +00:00
|
|
|
"github.com/AdguardTeam/golibs/log"
|
2020-12-23 09:35:07 +00:00
|
|
|
"github.com/AdguardTeam/urlfilter/rules"
|
2020-05-08 16:39:37 +01:00
|
|
|
"github.com/miekg/dns"
|
|
|
|
)
|
|
|
|
|
2020-12-28 16:26:37 +00:00
|
|
|
// makeResponse creates a DNS response by req and sets necessary flags. It also
|
|
|
|
// guarantees that req.Question will be not empty.
|
2020-12-21 14:48:07 +00:00
|
|
|
func (s *Server) makeResponse(req *dns.Msg) (resp *dns.Msg) {
|
|
|
|
resp = &dns.Msg{
|
|
|
|
MsgHdr: dns.MsgHdr{
|
|
|
|
RecursionAvailable: true,
|
|
|
|
},
|
|
|
|
Compress: true,
|
|
|
|
}
|
|
|
|
|
2020-05-08 16:39:37 +01:00
|
|
|
resp.SetReply(req)
|
2020-12-21 14:48:07 +00:00
|
|
|
|
|
|
|
return resp
|
2020-05-08 16:39:37 +01:00
|
|
|
}
|
|
|
|
|
2021-06-17 12:09:16 +01:00
|
|
|
// ipsFromRules extracts non-IP addresses from the filtering result rules.
|
|
|
|
func ipsFromRules(resRules []*filtering.ResultRule) (ips []net.IP) {
|
|
|
|
for _, r := range resRules {
|
|
|
|
if r.IP != nil {
|
|
|
|
ips = append(ips, r.IP)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return ips
|
|
|
|
}
|
|
|
|
|
2020-05-08 16:39:37 +01:00
|
|
|
// genDNSFilterMessage generates a DNS message corresponding to the filtering result
|
2021-05-21 14:15:47 +01:00
|
|
|
func (s *Server) genDNSFilterMessage(d *proxy.DNSContext, result *filtering.Result) *dns.Msg {
|
2020-05-08 16:39:37 +01:00
|
|
|
m := d.Req
|
|
|
|
|
|
|
|
if m.Question[0].Qtype != dns.TypeA && m.Question[0].Qtype != dns.TypeAAAA {
|
2021-06-17 12:09:16 +01:00
|
|
|
if s.conf.BlockingMode == BlockingModeNullIP {
|
2020-10-02 10:51:55 +01:00
|
|
|
return s.makeResponse(m)
|
|
|
|
}
|
|
|
|
return s.genNXDomain(m)
|
2020-05-08 16:39:37 +01:00
|
|
|
}
|
|
|
|
|
2021-06-17 12:09:16 +01:00
|
|
|
ips := ipsFromRules(result.Rules)
|
2020-05-08 16:39:37 +01:00
|
|
|
switch result.Reason {
|
2021-05-21 14:15:47 +01:00
|
|
|
case filtering.FilteredSafeBrowsing:
|
2020-05-08 16:39:37 +01:00
|
|
|
return s.genBlockedHost(m, s.conf.SafeBrowsingBlockHost, d)
|
2021-05-21 14:15:47 +01:00
|
|
|
case filtering.FilteredParental:
|
2020-05-08 16:39:37 +01:00
|
|
|
return s.genBlockedHost(m, s.conf.ParentalBlockHost, d)
|
|
|
|
default:
|
2021-05-21 14:15:47 +01:00
|
|
|
// If the query was filtered by "Safe search", filtering also must return
|
2020-05-08 16:39:37 +01:00
|
|
|
// the IP address that must be used in response.
|
|
|
|
// In this case regardless of the filtering method, we should return it
|
2021-06-17 12:09:16 +01:00
|
|
|
if result.Reason == filtering.FilteredSafeSearch && len(ips) > 0 {
|
|
|
|
return s.genResponseWithIPs(m, ips)
|
2020-05-08 16:39:37 +01:00
|
|
|
}
|
|
|
|
|
2021-06-17 12:09:16 +01:00
|
|
|
switch s.conf.BlockingMode {
|
|
|
|
case BlockingModeCustomIP:
|
2020-05-08 16:39:37 +01:00
|
|
|
switch m.Question[0].Qtype {
|
|
|
|
case dns.TypeA:
|
2021-01-13 13:56:05 +00:00
|
|
|
return s.genARecord(m, s.conf.BlockingIPv4)
|
2020-05-08 16:39:37 +01:00
|
|
|
case dns.TypeAAAA:
|
2021-01-13 13:56:05 +00:00
|
|
|
return s.genAAAARecord(m, s.conf.BlockingIPv6)
|
2021-06-17 12:09:16 +01:00
|
|
|
default:
|
|
|
|
// Generally shouldn't happen, since the types
|
|
|
|
// are checked above.
|
|
|
|
log.Error(
|
|
|
|
"dns: invalid msg type %d for blocking mode %s",
|
|
|
|
m.Question[0].Qtype,
|
|
|
|
s.conf.BlockingMode,
|
|
|
|
)
|
|
|
|
|
|
|
|
return s.makeResponse(m)
|
|
|
|
}
|
|
|
|
case BlockingModeDefault:
|
|
|
|
if len(ips) > 0 {
|
|
|
|
return s.genResponseWithIPs(m, ips)
|
2020-05-08 16:39:37 +01:00
|
|
|
}
|
|
|
|
|
2021-06-17 12:09:16 +01:00
|
|
|
return s.makeResponseNullIP(m)
|
|
|
|
case BlockingModeNullIP:
|
|
|
|
return s.makeResponseNullIP(m)
|
|
|
|
case BlockingModeNXDOMAIN:
|
2020-05-08 16:39:37 +01:00
|
|
|
return s.genNXDomain(m)
|
2021-06-17 12:09:16 +01:00
|
|
|
case BlockingModeREFUSED:
|
2020-08-19 12:13:16 +01:00
|
|
|
return s.makeResponseREFUSED(m)
|
2021-06-17 12:09:16 +01:00
|
|
|
default:
|
|
|
|
log.Error("dns: invalid blocking mode %q", s.conf.BlockingMode)
|
2020-05-08 16:39:37 +01:00
|
|
|
|
2021-06-17 12:09:16 +01:00
|
|
|
return s.makeResponse(m)
|
2020-05-08 16:39:37 +01:00
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
func (s *Server) genServerFailure(request *dns.Msg) *dns.Msg {
|
|
|
|
resp := dns.Msg{}
|
|
|
|
resp.SetRcode(request, dns.RcodeServerFailure)
|
|
|
|
resp.RecursionAvailable = true
|
|
|
|
return &resp
|
|
|
|
}
|
|
|
|
|
|
|
|
func (s *Server) genARecord(request *dns.Msg, ip net.IP) *dns.Msg {
|
|
|
|
resp := s.makeResponse(request)
|
2020-12-23 09:35:07 +00:00
|
|
|
resp.Answer = append(resp.Answer, s.genAnswerA(request, ip))
|
2020-05-08 16:39:37 +01:00
|
|
|
return resp
|
|
|
|
}
|
|
|
|
|
|
|
|
func (s *Server) genAAAARecord(request *dns.Msg, ip net.IP) *dns.Msg {
|
|
|
|
resp := s.makeResponse(request)
|
2020-12-23 09:35:07 +00:00
|
|
|
resp.Answer = append(resp.Answer, s.genAnswerAAAA(request, ip))
|
2020-05-08 16:39:37 +01:00
|
|
|
return resp
|
|
|
|
}
|
|
|
|
|
2020-12-23 09:35:07 +00:00
|
|
|
func (s *Server) hdr(req *dns.Msg, rrType rules.RRType) (h dns.RR_Header) {
|
|
|
|
return dns.RR_Header{
|
2020-05-08 16:39:37 +01:00
|
|
|
Name: req.Question[0].Name,
|
2020-12-23 09:35:07 +00:00
|
|
|
Rrtype: rrType,
|
2020-05-08 16:39:37 +01:00
|
|
|
Ttl: s.conf.BlockedResponseTTL,
|
|
|
|
Class: dns.ClassINET,
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2020-12-23 09:35:07 +00:00
|
|
|
func (s *Server) genAnswerA(req *dns.Msg, ip net.IP) (ans *dns.A) {
|
|
|
|
return &dns.A{
|
|
|
|
Hdr: s.hdr(req, dns.TypeA),
|
|
|
|
A: ip,
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
func (s *Server) genAnswerAAAA(req *dns.Msg, ip net.IP) (ans *dns.AAAA) {
|
|
|
|
return &dns.AAAA{
|
|
|
|
Hdr: s.hdr(req, dns.TypeAAAA),
|
|
|
|
AAAA: ip,
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
func (s *Server) genAnswerCNAME(req *dns.Msg, cname string) (ans *dns.CNAME) {
|
|
|
|
return &dns.CNAME{
|
|
|
|
Hdr: s.hdr(req, dns.TypeCNAME),
|
|
|
|
Target: dns.Fqdn(cname),
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
func (s *Server) genAnswerMX(req *dns.Msg, mx *rules.DNSMX) (ans *dns.MX) {
|
|
|
|
return &dns.MX{
|
2021-03-15 10:08:13 +00:00
|
|
|
Hdr: s.hdr(req, dns.TypeMX),
|
2020-12-23 09:35:07 +00:00
|
|
|
Preference: mx.Preference,
|
2021-03-15 14:17:16 +00:00
|
|
|
Mx: dns.Fqdn(mx.Exchange),
|
2020-12-23 09:35:07 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
func (s *Server) genAnswerPTR(req *dns.Msg, ptr string) (ans *dns.PTR) {
|
|
|
|
return &dns.PTR{
|
|
|
|
Hdr: s.hdr(req, dns.TypePTR),
|
2021-03-15 14:17:16 +00:00
|
|
|
Ptr: dns.Fqdn(ptr),
|
2020-05-08 16:39:37 +01:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2021-03-15 10:08:13 +00:00
|
|
|
func (s *Server) genAnswerSRV(req *dns.Msg, srv *rules.DNSSRV) (ans *dns.SRV) {
|
|
|
|
return &dns.SRV{
|
|
|
|
Hdr: s.hdr(req, dns.TypeSRV),
|
|
|
|
Priority: srv.Priority,
|
|
|
|
Weight: srv.Weight,
|
|
|
|
Port: srv.Port,
|
2021-03-15 14:17:16 +00:00
|
|
|
Target: dns.Fqdn(srv.Target),
|
2021-03-15 10:08:13 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2020-12-23 09:35:07 +00:00
|
|
|
func (s *Server) genAnswerTXT(req *dns.Msg, strs []string) (ans *dns.TXT) {
|
2020-12-21 14:48:07 +00:00
|
|
|
return &dns.TXT{
|
2020-12-23 09:35:07 +00:00
|
|
|
Hdr: s.hdr(req, dns.TypeTXT),
|
2020-12-21 14:48:07 +00:00
|
|
|
Txt: strs,
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2021-06-17 12:09:16 +01:00
|
|
|
// genResponseWithIPs generates a DNS response message with the provided IP
|
|
|
|
// addresses and an appropriate resource record type. If any of the IPs cannot
|
|
|
|
// be converted to the correct protocol, genResponseWithIPs returns an empty
|
|
|
|
// response.
|
|
|
|
func (s *Server) genResponseWithIPs(req *dns.Msg, ips []net.IP) (resp *dns.Msg) {
|
|
|
|
var ans []dns.RR
|
|
|
|
switch req.Question[0].Qtype {
|
|
|
|
case dns.TypeA:
|
|
|
|
for _, ip := range ips {
|
|
|
|
if ip4 := ip.To4(); ip4 == nil {
|
|
|
|
ans = nil
|
|
|
|
|
|
|
|
break
|
|
|
|
}
|
|
|
|
|
|
|
|
ans = append(ans, s.genAnswerA(req, ip))
|
|
|
|
}
|
|
|
|
case dns.TypeAAAA:
|
|
|
|
for _, ip := range ips {
|
|
|
|
ans = append(ans, s.genAnswerAAAA(req, ip.To16()))
|
|
|
|
}
|
|
|
|
default:
|
|
|
|
// Go on and return an empty response.
|
2020-05-08 16:39:37 +01:00
|
|
|
}
|
|
|
|
|
2021-06-17 12:09:16 +01:00
|
|
|
resp = s.makeResponse(req)
|
|
|
|
resp.Answer = ans
|
|
|
|
|
2020-05-08 16:39:37 +01:00
|
|
|
return resp
|
|
|
|
}
|
|
|
|
|
2021-06-17 12:09:16 +01:00
|
|
|
// makeResponseNullIP creates a response with 0.0.0.0 for A requests, :: for
|
|
|
|
// AAAA requests, and an empty response for other types.
|
|
|
|
func (s *Server) makeResponseNullIP(req *dns.Msg) (resp *dns.Msg) {
|
|
|
|
// Respond with the corresponding zero IP type as opposed to simply
|
|
|
|
// using one or the other in both cases, because the IPv4 zero IP is
|
|
|
|
// converted to a IPV6-mapped IPv4 address, while the IPv6 zero IP is
|
|
|
|
// converted into an empty slice instead of the zero IPv4.
|
|
|
|
switch req.Question[0].Qtype {
|
|
|
|
case dns.TypeA:
|
|
|
|
resp = s.genResponseWithIPs(req, []net.IP{{0, 0, 0, 0}})
|
|
|
|
case dns.TypeAAAA:
|
|
|
|
resp = s.genResponseWithIPs(req, []net.IP{net.IPv6zero})
|
|
|
|
default:
|
|
|
|
resp = s.makeResponse(req)
|
2020-10-02 10:51:55 +01:00
|
|
|
}
|
|
|
|
|
2021-06-17 12:09:16 +01:00
|
|
|
return resp
|
2020-10-02 10:51:55 +01:00
|
|
|
}
|
|
|
|
|
2020-05-08 16:39:37 +01:00
|
|
|
func (s *Server) genBlockedHost(request *dns.Msg, newAddr string, d *proxy.DNSContext) *dns.Msg {
|
|
|
|
ip := net.ParseIP(newAddr)
|
|
|
|
if ip != nil {
|
2021-06-17 12:09:16 +01:00
|
|
|
return s.genResponseWithIPs(request, []net.IP{ip})
|
2020-05-08 16:39:37 +01:00
|
|
|
}
|
|
|
|
|
|
|
|
// look up the hostname, TODO: cache
|
|
|
|
replReq := dns.Msg{}
|
|
|
|
replReq.SetQuestion(dns.Fqdn(newAddr), request.Question[0].Qtype)
|
|
|
|
replReq.RecursionDesired = true
|
|
|
|
|
|
|
|
newContext := &proxy.DNSContext{
|
|
|
|
Proto: d.Proto,
|
|
|
|
Addr: d.Addr,
|
|
|
|
StartTime: time.Now(),
|
|
|
|
Req: &replReq,
|
|
|
|
}
|
|
|
|
|
2021-10-06 11:14:41 +01:00
|
|
|
prx := s.proxy()
|
|
|
|
if prx == nil {
|
|
|
|
log.Debug("dns: %s", srvClosedErr)
|
|
|
|
|
|
|
|
return s.genServerFailure(request)
|
|
|
|
}
|
|
|
|
|
|
|
|
err := prx.Resolve(newContext)
|
2020-05-08 16:39:37 +01:00
|
|
|
if err != nil {
|
2021-10-06 11:14:41 +01:00
|
|
|
log.Printf("couldn't look up replacement host %q: %s", newAddr, err)
|
|
|
|
|
2020-05-08 16:39:37 +01:00
|
|
|
return s.genServerFailure(request)
|
|
|
|
}
|
|
|
|
|
|
|
|
resp := s.makeResponse(request)
|
|
|
|
if newContext.Res != nil {
|
|
|
|
for _, answer := range newContext.Res.Answer {
|
|
|
|
answer.Header().Name = request.Question[0].Name
|
|
|
|
resp.Answer = append(resp.Answer, answer)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return resp
|
|
|
|
}
|
|
|
|
|
2021-07-20 12:45:08 +01:00
|
|
|
// preBlockedResponse returns a protocol-appropriate response for a request that
|
|
|
|
// was blocked by access settings.
|
|
|
|
func (s *Server) preBlockedResponse(pctx *proxy.DNSContext) (reply bool, err error) {
|
|
|
|
if pctx.Proto == proxy.ProtoUDP || pctx.Proto == proxy.ProtoDNSCrypt {
|
|
|
|
// Return nil so that dnsproxy drops the connection and thus
|
|
|
|
// prevent DNS amplification attacks.
|
|
|
|
return false, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
pctx.Res = s.makeResponseREFUSED(pctx.Req)
|
|
|
|
|
|
|
|
return true, nil
|
|
|
|
}
|
|
|
|
|
2020-08-18 12:26:01 +01:00
|
|
|
// Create REFUSED DNS response
|
|
|
|
func (s *Server) makeResponseREFUSED(request *dns.Msg) *dns.Msg {
|
|
|
|
resp := dns.Msg{}
|
|
|
|
resp.SetRcode(request, dns.RcodeRefused)
|
|
|
|
resp.RecursionAvailable = true
|
|
|
|
return &resp
|
|
|
|
}
|
|
|
|
|
2020-05-08 16:39:37 +01:00
|
|
|
func (s *Server) genNXDomain(request *dns.Msg) *dns.Msg {
|
|
|
|
resp := dns.Msg{}
|
|
|
|
resp.SetRcode(request, dns.RcodeNameError)
|
|
|
|
resp.RecursionAvailable = true
|
|
|
|
resp.Ns = s.genSOA(request)
|
|
|
|
return &resp
|
|
|
|
}
|
|
|
|
|
|
|
|
func (s *Server) genSOA(request *dns.Msg) []dns.RR {
|
|
|
|
zone := ""
|
|
|
|
if len(request.Question) > 0 {
|
|
|
|
zone = request.Question[0].Name
|
|
|
|
}
|
|
|
|
|
|
|
|
soa := dns.SOA{
|
|
|
|
// values copied from verisign's nonexistent .com domain
|
|
|
|
// their exact values are not important in our use case because they are used for domain transfers between primary/secondary DNS servers
|
|
|
|
Refresh: 1800,
|
|
|
|
Retry: 900,
|
|
|
|
Expire: 604800,
|
|
|
|
Minttl: 86400,
|
|
|
|
// copied from AdGuard DNS
|
|
|
|
Ns: "fake-for-negative-caching.adguard.com.",
|
|
|
|
Serial: 100500,
|
|
|
|
// rest is request-specific
|
|
|
|
Hdr: dns.RR_Header{
|
|
|
|
Name: zone,
|
|
|
|
Rrtype: dns.TypeSOA,
|
|
|
|
Ttl: s.conf.BlockedResponseTTL,
|
|
|
|
Class: dns.ClassINET,
|
|
|
|
},
|
|
|
|
Mbox: "hostmaster.", // zone will be appended later if it's not empty or "."
|
|
|
|
}
|
|
|
|
if soa.Hdr.Ttl == 0 {
|
|
|
|
soa.Hdr.Ttl = defaultValues.BlockedResponseTTL
|
|
|
|
}
|
|
|
|
if len(zone) > 0 && zone[0] != '.' {
|
|
|
|
soa.Mbox += zone
|
|
|
|
}
|
|
|
|
return []dns.RR{&soa}
|
|
|
|
}
|