package dnsforward import ( "fmt" "log" "net" "reflect" "strings" "sync" "time" "github.com/AdguardTeam/AdGuardHome/dnsfilter" "github.com/joomcode/errorx" "github.com/miekg/dns" gocache "github.com/patrickmn/go-cache" ) // Server is the main way to start a DNS server. // // Example: // s := dnsforward.Server{} // err := s.Start(nil) // will start a DNS server listening on default port 53, in a goroutine // err := s.Reconfigure(ServerConfig{UDPListenAddr: &net.UDPAddr{Port: 53535}}) // will reconfigure running DNS server to listen on UDP port 53535 // err := s.Stop() // will stop listening on port 53535 and cancel all goroutines // err := s.Start(nil) // will start listening again, on port 53535, in a goroutine // // The zero Server is empty and ready for use. type Server struct { udpListen *net.UDPConn dnsFilter *dnsfilter.Dnsfilter cache cache ratelimitBuckets *gocache.Cache // where the ratelimiters are stored, per IP sync.RWMutex ServerConfig } const ( safeBrowsingBlockHost = "standard-block.dns.adguard.com" parentalBlockHost = "family-block.dns.adguard.com" ) // uncomment this block to have tracing of locks /* func (s *Server) Lock() { pc := make([]uintptr, 10) // at least 1 entry needed runtime.Callers(2, pc) f := runtime.FuncForPC(pc[0]) file, line := f.FileLine(pc[0]) fmt.Fprintf(os.Stderr, "%s:%d %s() -> Lock() -> in progress\n", path.Base(file), line, path.Base(f.Name())) s.RWMutex.Lock() fmt.Fprintf(os.Stderr, "%s:%d %s() -> Lock() -> done\n", path.Base(file), line, path.Base(f.Name())) } func (s *Server) RLock() { pc := make([]uintptr, 10) // at least 1 entry needed runtime.Callers(2, pc) f := runtime.FuncForPC(pc[0]) file, line := f.FileLine(pc[0]) fmt.Fprintf(os.Stderr, "%s:%d %s() -> RLock() -> in progress\n", path.Base(file), line, path.Base(f.Name())) s.RWMutex.RLock() fmt.Fprintf(os.Stderr, "%s:%d %s() -> RLock() -> done\n", path.Base(file), line, path.Base(f.Name())) } func (s *Server) Unlock() { pc := make([]uintptr, 10) // at least 1 entry needed runtime.Callers(2, pc) f := runtime.FuncForPC(pc[0]) file, line := f.FileLine(pc[0]) fmt.Fprintf(os.Stderr, "%s:%d %s() -> Unlock() -> in progress\n", path.Base(file), line, path.Base(f.Name())) s.RWMutex.Unlock() fmt.Fprintf(os.Stderr, "%s:%d %s() -> Unlock() -> done\n", path.Base(file), line, path.Base(f.Name())) } func (s *Server) RUnlock() { pc := make([]uintptr, 10) // at least 1 entry needed runtime.Callers(2, pc) f := runtime.FuncForPC(pc[0]) file, line := f.FileLine(pc[0]) fmt.Fprintf(os.Stderr, "%s:%d %s() -> RUnlock() -> in progress\n", path.Base(file), line, path.Base(f.Name())) s.RWMutex.RUnlock() fmt.Fprintf(os.Stderr, "%s:%d %s() -> RUnlock() -> done\n", path.Base(file), line, path.Base(f.Name())) } */ type FilteringConfig struct { ProtectionEnabled bool `yaml:"protection_enabled"` FilteringEnabled bool `yaml:"filtering_enabled"` BlockedResponseTTL uint32 `yaml:"blocked_response_ttl"` // if 0, then default is used (3600) QueryLogEnabled bool `yaml:"querylog_enabled"` Ratelimit int `yaml:"ratelimit"` RatelimitWhitelist []string `yaml:"ratelimit_whitelist"` RefuseAny bool `yaml:"refuse_any"` BootstrapDNS string `yaml:"bootstrap_dns"` dnsfilter.Config `yaml:",inline"` } // The zero ServerConfig is empty and ready for use. type ServerConfig struct { UDPListenAddr *net.UDPAddr // if nil, then default is is used (port 53 on *) Upstreams []Upstream Filters []dnsfilter.Filter FilteringConfig } // if any of ServerConfig values are zero, then default values from below are used var defaultValues = ServerConfig{ UDPListenAddr: &net.UDPAddr{Port: 53}, FilteringConfig: FilteringConfig{BlockedResponseTTL: 3600}, Upstreams: []Upstream{ //// dns over HTTPS // &dnsOverHTTPS{boot: toBoot("https://1.1.1.1/dns-query", "")}, // &dnsOverHTTPS{boot: toBoot("https://dns.google.com/experimental", "")}, // &dnsOverHTTPS{boot: toBoot("https://doh.cleanbrowsing.org/doh/security-filter/", "")}, // &dnsOverHTTPS{boot: toBoot("https://dns10.quad9.net/dns-query", "")}, // &dnsOverHTTPS{boot: toBoot("https://doh.powerdns.org", "")}, // &dnsOverHTTPS{boot: toBoot("https://doh.securedns.eu/dns-query", "")}, //// dns over TLS // &dnsOverTLS{boot: toBoot("tls://8.8.8.8:853", "")}, // &dnsOverTLS{boot: toBoot("tls://8.8.4.4:853", "")}, // &dnsOverTLS{boot: toBoot("tls://1.1.1.1:853", "")}, // &dnsOverTLS{boot: toBoot("tls://1.0.0.1:853", "")}, //// plainDNS &plainDNS{boot: toBoot("8.8.8.8:53", "")}, &plainDNS{boot: toBoot("8.8.4.4:53", "")}, &plainDNS{boot: toBoot("1.1.1.1:53", "")}, &plainDNS{boot: toBoot("1.0.0.1:53", "")}, }, } // // packet loop // func (s *Server) packetLoop() { log.Printf("Entering packet handle loop") b := make([]byte, dns.MaxMsgSize) for { s.RLock() conn := s.udpListen s.RUnlock() if conn == nil { log.Printf("udp socket has disappeared, exiting loop") break } n, addr, err := conn.ReadFrom(b) // documentation says to handle the packet even if err occurs, so do that first if n > 0 { // make a copy of all bytes because ReadFrom() will overwrite contents of b on next call // we need the contents to survive the call because we're handling them in goroutine p := make([]byte, n) copy(p, b) go s.handlePacket(p, addr, conn) // ignore errors } if err != nil { if isConnClosed(err) { log.Printf("ReadFrom() returned because we're reading from a closed connection, exiting loop") // don't try to nullify s.udpListen here, because s.udpListen could be already re-bound to listen break } log.Printf("Got error when reading from udp listen: %s", err) } } } // // Control functions // func (s *Server) Start(config *ServerConfig) error { s.Lock() defer s.Unlock() if config != nil { s.ServerConfig = *config } // TODO: handle being called Start() second time after Stop() if s.udpListen == nil { log.Printf("Creating UDP socket") var err error addr := s.UDPListenAddr if addr == nil { addr = defaultValues.UDPListenAddr } s.udpListen, err = net.ListenUDP("udp", addr) if err != nil { s.udpListen = nil return errorx.Decorate(err, "Couldn't listen to UDP socket") } log.Println(s.udpListen.LocalAddr(), s.UDPListenAddr) } if s.dnsFilter == nil { log.Printf("Creating dnsfilter") s.dnsFilter = dnsfilter.New(&s.Config) // add rules only if they are enabled if s.FilteringEnabled { s.dnsFilter.AddRules(s.Filters) } } log.Printf("Loading stats from querylog") err := fillStatsFromQueryLog() if err != nil { log.Printf("Failed to load stats from querylog: %s", err) return err } once.Do(func() { go periodicQueryLogRotate() go periodicHourlyTopRotate() go statsRotator() }) go s.packetLoop() return nil } func (s *Server) Stop() error { s.Lock() defer s.Unlock() if s.udpListen != nil { err := s.udpListen.Close() s.udpListen = nil if err != nil { return errorx.Decorate(err, "Couldn't close UDP listening socket") } } // flush remainder to file logBufferLock.Lock() flushBuffer := logBuffer logBuffer = nil logBufferLock.Unlock() err := flushToFile(flushBuffer) if err != nil { log.Printf("Saving querylog to file failed: %s", err) return err } return nil } func (s *Server) IsRunning() bool { s.RLock() isRunning := true if s.udpListen == nil { isRunning = false } s.RUnlock() return isRunning } // // Server reconfigure // func (s *Server) reconfigureListenAddr(new ServerConfig) error { oldAddr := s.UDPListenAddr if oldAddr == nil { oldAddr = defaultValues.UDPListenAddr } newAddr := new.UDPListenAddr if newAddr == nil { newAddr = defaultValues.UDPListenAddr } if newAddr.Port == 0 { return errorx.IllegalArgument.New("new port cannot be 0") } if reflect.DeepEqual(oldAddr, newAddr) { // do nothing, the addresses are exactly the same log.Printf("Not going to rebind because addresses are same: %v -> %v", oldAddr, newAddr) return nil } // rebind, using a strategy: // * if ports are different, bind new first, then close old // * if ports are same, close old first, then bind new var newListen *net.UDPConn var err error if oldAddr.Port != newAddr.Port { log.Printf("Rebinding -- ports are different so bind first then close") newListen, err = net.ListenUDP("udp", newAddr) if err != nil { return errorx.Decorate(err, "Couldn't bind to %v", newAddr) } s.Lock() if s.udpListen != nil { err = s.udpListen.Close() s.udpListen = nil } s.Unlock() if err != nil { return errorx.Decorate(err, "Couldn't close UDP listening socket") } } else { log.Printf("Rebinding -- ports are same so close first then bind") s.Lock() if s.udpListen != nil { err = s.udpListen.Close() s.udpListen = nil } s.Unlock() if err != nil { return errorx.Decorate(err, "Couldn't close UDP listening socket") } newListen, err = net.ListenUDP("udp", newAddr) if err != nil { return errorx.Decorate(err, "Couldn't bind to %v", newAddr) } } s.Lock() s.udpListen = newListen s.UDPListenAddr = new.UDPListenAddr s.Unlock() log.Println(s.udpListen.LocalAddr(), s.UDPListenAddr) go s.packetLoop() // the old one has quit, use new one return nil } func (s *Server) reconfigureBlockedResponseTTL(new ServerConfig) { newVal := new.BlockedResponseTTL if newVal == 0 { newVal = defaultValues.BlockedResponseTTL } oldVal := s.BlockedResponseTTL if oldVal == 0 { oldVal = defaultValues.BlockedResponseTTL } if newVal != oldVal { s.BlockedResponseTTL = new.BlockedResponseTTL } } func (s *Server) reconfigureUpstreams(new ServerConfig) { newVal := new.Upstreams if len(newVal) == 0 { newVal = defaultValues.Upstreams } oldVal := s.Upstreams if len(oldVal) == 0 { oldVal = defaultValues.Upstreams } if reflect.DeepEqual(newVal, oldVal) { // they're exactly the same, do nothing return } s.Upstreams = new.Upstreams } func (s *Server) reconfigureFiltering(new ServerConfig) { newFilters := new.Filters if len(newFilters) == 0 { newFilters = defaultValues.Filters } oldFilters := s.Filters if len(oldFilters) == 0 { oldFilters = defaultValues.Filters } needUpdate := false if !reflect.DeepEqual(newFilters, oldFilters) { needUpdate = true } if !reflect.DeepEqual(new.FilteringConfig, s.FilteringConfig) { needUpdate = true } if !needUpdate { // nothing to do, everything is same return } // TODO: instead of creating new dnsfilter, change existing one's settings and filters dnsFilter := dnsfilter.New(&new.Config) // sets safebrowsing, safesearch and parental // add rules only if they are enabled if new.FilteringEnabled { dnsFilter.AddRules(newFilters) } s.Lock() oldDNSFilter := s.dnsFilter s.dnsFilter = dnsFilter s.FilteringConfig = new.FilteringConfig s.Unlock() oldDNSFilter.Destroy() } func (s *Server) Reconfigure(new ServerConfig) error { s.reconfigureBlockedResponseTTL(new) s.reconfigureUpstreams(new) s.reconfigureFiltering(new) err := s.reconfigureListenAddr(new) if err != nil { return errorx.Decorate(err, "Couldn't reconfigure to new listening address %+v", new.UDPListenAddr) } return nil } // // packet handling functions // // handlePacketInternal processes the incoming packet bytes and returns with an optional response packet. // // If an empty dns.Msg is returned, do not try to send anything back to client, otherwise send contents of dns.Msg. // // If an error is returned, log it, don't try to generate data based on that error. func (s *Server) handlePacketInternal(msg *dns.Msg, addr net.Addr, conn *net.UDPConn) (*dns.Msg, *dnsfilter.Result, Upstream, error) { // log.Printf("Got packet %d bytes from %s: %v", len(p), addr, p) // // DNS packet byte format is valid // // any errors below here require a response to client // log.Printf("Unpacked: %v", msg.String()) if len(msg.Question) != 1 { log.Printf("Got invalid number of questions: %v", len(msg.Question)) return s.genServerFailure(msg), nil, nil, nil } if msg.Question[0].Qtype == dns.TypeANY && s.RefuseAny { return s.genNotImpl(msg), nil, nil, nil } // we need upstream to resolve A records upstream := s.chooseUpstream() host := strings.TrimSuffix(msg.Question[0].Name, ".") // use dnsfilter before cache -- changed settings or filters would require cache invalidation otherwise var res dnsfilter.Result var err error if s.ProtectionEnabled { res, err = s.dnsFilter.CheckHost(host) if err != nil { log.Printf("dnsfilter failed to check host '%s': %s", host, err) return s.genServerFailure(msg), &res, nil, err } else if res.IsFiltered { log.Printf("Host %s is filtered, reason - '%s', matched rule: '%s'", host, res.Reason, res.Rule) switch res.Reason { case dnsfilter.FilteredSafeBrowsing: return s.genArecord(msg, safeBrowsingBlockHost, upstream), &res, nil, nil case dnsfilter.FilteredParental: return s.genArecord(msg, parentalBlockHost, upstream), &res, nil, nil } return s.genNXDomain(msg), &res, nil, nil } } { val, ok := s.cache.Get(msg) if ok && val != nil { return val, &res, nil, nil } } // TODO: replace with single-socket implementation reply, err := upstream.Exchange(msg) if err != nil { log.Printf("talking to upstream failed for host '%s': %s", host, err) return s.genServerFailure(msg), &res, upstream, err } if reply == nil { log.Printf("SHOULD NOT HAPPEN upstream returned empty message for host '%s'. Request is %v", host, msg.String()) return s.genServerFailure(msg), &res, upstream, nil } s.cache.Set(reply) return reply, &res, upstream, nil } func (s *Server) handlePacket(p []byte, addr net.Addr, conn *net.UDPConn) { start := time.Now() ip, _, err := net.SplitHostPort(addr.String()) if err != nil { log.Printf("Failed to split %v into host/port: %s", addr, err) // not a fatal error, move on } // ratelimit based on IP only, protects CPU cycles and outbound connections if s.isRatelimited(ip) { // log.Printf("Ratelimiting %s based on IP only", ip) return // do nothing, don't reply, we got ratelimited } msg := &dns.Msg{} err = msg.Unpack(p) if err != nil { log.Printf("got invalid DNS packet: %s", err) return // do nothing } reply, result, upstream, err := s.handlePacketInternal(msg, addr, conn) if reply != nil { // ratelimit based on reply size now replysize := reply.Len() if s.isRatelimitedForReply(ip, replysize) { log.Printf("Ratelimiting %s based on IP and size %d", ip, replysize) return // do nothing, don't reply, we got ratelimited } // we're good to respond rerr := s.respond(reply, addr, conn) if rerr != nil { log.Printf("Couldn't respond to UDP packet: %s", err) } } // // query logging and stats counters // shouldLog := true // don't log ANY request if refuseAny is enabled if len(msg.Question) >= 1 && msg.Question[0].Qtype == dns.TypeANY && s.RefuseAny { shouldLog = false } if s.QueryLogEnabled && shouldLog { elapsed := time.Since(start) upstreamAddr := "" if upstream != nil { upstreamAddr = upstream.Address() } logRequest(msg, reply, result, elapsed, ip, upstreamAddr) } } // // packet sending functions // func (s *Server) respond(resp *dns.Msg, addr net.Addr, conn *net.UDPConn) error { // log.Printf("Replying to %s with %s", addr, resp) resp.Compress = true bytes, err := resp.Pack() if err != nil { return errorx.Decorate(err, "Couldn't convert message into wire format") } n, err := conn.WriteTo(bytes, addr) if n == 0 && isConnClosed(err) { return err } if n != len(bytes) { return fmt.Errorf("WriteTo() returned with %d != %d", n, len(bytes)) } if err != nil { return errorx.Decorate(err, "WriteTo() returned error") } return nil } func (s *Server) genServerFailure(request *dns.Msg) *dns.Msg { resp := dns.Msg{} resp.SetRcode(request, dns.RcodeServerFailure) resp.RecursionAvailable = true return &resp } func (s *Server) genNotImpl(request *dns.Msg) *dns.Msg { resp := dns.Msg{} resp.SetRcode(request, dns.RcodeNotImplemented) resp.RecursionAvailable = true resp.SetEdns0(1452, false) // NOTIMPL without EDNS is treated as 'we don't support EDNS', so explicitly set it return &resp } func (s *Server) genArecord(request *dns.Msg, newAddr string, upstream Upstream) *dns.Msg { addr := net.ParseIP(newAddr) if addr != nil { // this is an IP address, return it resp := dns.Msg{} resp.SetReply(request) answer, err := dns.NewRR(fmt.Sprintf("%s %d A %s", request.Question[0].Name, s.BlockedResponseTTL, newAddr)) if err != nil { log.Printf("Couldn't generate A record for up replacement host '%s': %s", newAddr, err) return s.genServerFailure(request) } resp.Answer = append(resp.Answer, answer) return &resp } // look up the hostname, TODO: cache replReq := dns.Msg{} replReq.SetQuestion(dns.Fqdn(newAddr), request.Question[0].Qtype) replReq.RecursionDesired = true reply, err := upstream.Exchange(&replReq) if err != nil { log.Printf("Couldn't look up replacement host '%s' on upstream %s: %s", newAddr, upstream.Address(), err) return s.genServerFailure(request) } resp := dns.Msg{} resp.SetReply(request) resp.Authoritative, resp.RecursionAvailable = true, true if reply != nil { for _, answer := range reply.Answer { answer.Header().Name = request.Question[0].Name resp.Answer = append(resp.Answer, answer) } } return &resp } func (s *Server) genNXDomain(request *dns.Msg) *dns.Msg { resp := dns.Msg{} resp.SetRcode(request, dns.RcodeNameError) resp.RecursionAvailable = true resp.Ns = s.genSOA(request) return &resp } func (s *Server) genSOA(request *dns.Msg) []dns.RR { zone := "" if len(request.Question) > 0 { zone = request.Question[0].Name } soa := dns.SOA{ // values copied from verisign's nonexistent .com domain // their exact values are not important in our use case because they are used for domain transfers between primary/secondary DNS servers Refresh: 1800, Retry: 900, Expire: 604800, Minttl: 86400, // copied from AdGuard DNS Ns: "fake-for-negative-caching.adguard.com.", Serial: 100500, // rest is request-specific Hdr: dns.RR_Header{ Name: zone, Rrtype: dns.TypeSOA, Ttl: s.BlockedResponseTTL, Class: dns.ClassINET, }, Mbox: "hostmaster.", // zone will be appended later if it's not empty or "." } if soa.Hdr.Ttl == 0 { soa.Hdr.Ttl = defaultValues.BlockedResponseTTL } if len(zone) > 0 && zone[0] != '.' { soa.Mbox += zone } return []dns.RR{&soa} } var once sync.Once