src/feature/client/dnsserv.c

   1 /* Copyright (c) 2007-2019, The Tor Project, Inc. */
   2 /* See LICENSE for licensing information */
   3
   4 /**
   5  * \file dnsserv.c
   6  * \brief Implements client-side DNS proxy server code.
   7  *
   8  * When a user enables the DNSPort configuration option to have their local
   9  * Tor client handle DNS requests, this module handles it.  It functions as a
  10  * "DNS Server" on the client side, which client applications use.
  11  *
  12  * Inbound DNS requests are represented as entry_connection_t here (since
  13  * that's how Tor represents client-side streams), which are kept associated
  14  * with an evdns_server_request structure as exposed by Libevent's
  15  * evdns code.
  16  *
  17  * Upon receiving a DNS request, libevent calls our evdns_server_callback()
  18  * function here, which causes this module to create an entry_connection_t
  19  * request as appropriate.  Later, when that request is answered,
  20  * connection_edge.c calls dnsserv_resolved() so we can finish up and tell the
  21  * DNS client.
  22  **/
  23
  24 #include "core/or/or.h"
  25 #include "feature/client/dnsserv.h"
  26 #include "app/config/config.h"
  27 #include "core/mainloop/connection.h"
  28 #include "core/or/connection_edge.h"
  29 #include "feature/control/control_events.h"
  30 #include "core/mainloop/mainloop.h"
  31 #include "core/mainloop/netstatus.h"
  32 #include "core/or/policies.h"
  33
  34 #include "feature/control/control_connection_st.h"
  35 #include "core/or/entry_connection_st.h"
  36 #include "core/or/listener_connection_st.h"
  37 #include "core/or/socks_request_st.h"
  38 #include "lib/evloop/compat_libevent.h"
  39
  40 #include <event2/dns.h>
  41 #include <event2/dns_compat.h>
  42 /* XXXX this implies we want an improved evdns  */
  43 #include <event2/dns_struct.h>
  44
  45 /** Helper function: called by evdns whenever the client sends a request to our
  46  * DNSPort.  We need to eventually answer the request <b>req</b>.
  47  */
  48 static void
  49 evdns_server_callback(struct evdns_server_request *req, void *data_)
  50 {
  51   const listener_connection_t *listener = data_;
  52   entry_connection_t *entry_conn;
  53   edge_connection_t *conn;
  54   int i = 0;
  55   struct evdns_server_question *q = NULL, *supported_q = NULL;
  56   struct sockaddr_storage addr;
  57   struct sockaddr *sa;
  58   int addrlen;
  59   tor_addr_t tor_addr;
  60   uint16_t port;
  61   int err = DNS_ERR_NONE;
  62   char *q_name;
  63
  64   tor_assert(req);
  65
  66   log_info(LD_APP, "Got a new DNS request!");
  67
  68   req->flags |= 0x80; /* set RA */
  69
  70   /* First, check whether the requesting address matches our SOCKSPolicy. */
  71   if ((addrlen = evdns_server_request_get_requesting_addr(req,
  72                       (struct sockaddr*)&addr, (socklen_t)sizeof(addr))) < 0) {
  73     log_warn(LD_APP, "Couldn't get requesting address.");
  74     evdns_server_request_respond(req, DNS_ERR_SERVERFAILED);
  75     return;
  76   }
  77   (void) addrlen;
  78   sa = (struct sockaddr*) &addr;
  79   if (tor_addr_from_sockaddr(&tor_addr, sa, &port)<0) {
  80     log_warn(LD_APP, "Requesting address wasn't recognized.");
  81     evdns_server_request_respond(req, DNS_ERR_SERVERFAILED);
  82     return;
  83   }
  84
  85   if (!socks_policy_permits_address(&tor_addr)) {
  86     log_warn(LD_APP, "Rejecting DNS request from disallowed IP.");
  87     evdns_server_request_respond(req, DNS_ERR_REFUSED);
  88     return;
  89   }
  90
  91   /* Now, let's find the first actual question of a type we can answer in this
  92    * DNS request.  It makes us a little noncompliant to act like this; we
  93    * should fix that eventually if it turns out to make a difference for
  94    * anybody. */
  95   if (req->nquestions == 0) {
  96     log_info(LD_APP, "No questions in DNS request; sending back nil reply.");
  97     evdns_server_request_respond(req, 0);
  98     return;
  99   }
 100   if (req->nquestions > 1) {
 101     log_info(LD_APP, "Got a DNS request with more than one question; I only "
 102              "handle one question at a time for now.  Skipping the extras.");
 103   }
 104   for (i = 0; i < req->nquestions; ++i) {
 105     if (req->questions[i]->dns_question_class != EVDNS_CLASS_INET)
 106       continue;
 107     switch (req->questions[i]->type) {
 108       case EVDNS_TYPE_A:
 109       case EVDNS_TYPE_AAAA:
 110       case EVDNS_TYPE_PTR:
 111         /* We always pick the first one of these questions, if there is
 112            one. */
 113         if (! supported_q)
 114           supported_q = req->questions[i];
 115         break;
 116       default:
 117         break;
 118       }
 119   }
 120   if (supported_q)
 121     q = supported_q;
 122   if (!q) {
 123     log_info(LD_APP, "None of the questions we got were ones we're willing "
 124              "to support. Sending NOTIMPL.");
 125     evdns_server_request_respond(req, DNS_ERR_NOTIMPL);
 126     return;
 127   }
 128
 129   /* Make sure the name isn't too long: This should be impossible, I think. */
 130   if (err == DNS_ERR_NONE && strlen(q->name) > MAX_SOCKS_ADDR_LEN-1)
 131     err = DNS_ERR_FORMAT;
 132
 133   if (err != DNS_ERR_NONE || !supported_q) {
 134     /* We got an error?  There's no question we're willing to answer? Then
 135      * send back an answer immediately; we're done. */
 136     evdns_server_request_respond(req, err);
 137     return;
 138   }
 139
 140   /* Make a new dummy AP connection, and attach the request to it. */
 141   entry_conn = entry_connection_new(CONN_TYPE_AP, AF_INET);
 142   conn = ENTRY_TO_EDGE_CONN(entry_conn);
 143   CONNECTION_AP_EXPECT_NONPENDING(entry_conn);
 144   TO_CONN(conn)->state = AP_CONN_STATE_RESOLVE_WAIT;
 145   conn->is_dns_request = 1;
 146
 147   tor_addr_copy(&TO_CONN(conn)->addr, &tor_addr);
 148   TO_CONN(conn)->port = port;
 149   TO_CONN(conn)->address = tor_addr_to_str_dup(&tor_addr);
 150
 151   if (q->type == EVDNS_TYPE_A || q->type == EVDNS_TYPE_AAAA ||
 152       q->type == EVDNS_QTYPE_ALL) {
 153     entry_conn->socks_request->command = SOCKS_COMMAND_RESOLVE;
 154   } else {
 155     tor_assert(q->type == EVDNS_TYPE_PTR);
 156     entry_conn->socks_request->command = SOCKS_COMMAND_RESOLVE_PTR;
 157   }
 158
 159   /* This serves our DNS port so enable DNS request by default. */
 160   entry_conn->entry_cfg.dns_request = 1;
 161   if (q->type == EVDNS_TYPE_A || q->type == EVDNS_QTYPE_ALL) {
 162     entry_conn->entry_cfg.ipv4_traffic = 1;
 163     entry_conn->entry_cfg.ipv6_traffic = 0;
 164     entry_conn->entry_cfg.prefer_ipv6 = 0;
 165   } else if (q->type == EVDNS_TYPE_AAAA) {
 166     entry_conn->entry_cfg.ipv4_traffic = 0;
 167     entry_conn->entry_cfg.ipv6_traffic = 1;
 168     entry_conn->entry_cfg.prefer_ipv6 = 1;
 169   }
 170
 171   strlcpy(entry_conn->socks_request->address, q->name,
 172           sizeof(entry_conn->socks_request->address));
 173
 174   entry_conn->socks_request->listener_type = listener->base_.type;
 175   entry_conn->dns_server_request = req;
 176   entry_conn->entry_cfg.isolation_flags = listener->entry_cfg.isolation_flags;
 177   entry_conn->entry_cfg.session_group = listener->entry_cfg.session_group;
 178   entry_conn->nym_epoch = get_signewnym_epoch();
 179
 180   if (connection_add(ENTRY_TO_CONN(entry_conn)) < 0) {
 181     log_warn(LD_APP, "Couldn't register dummy connection for DNS request");
 182     evdns_server_request_respond(req, DNS_ERR_SERVERFAILED);
 183     connection_free_(ENTRY_TO_CONN(entry_conn));
 184     return;
 185   }
 186
 187   control_event_stream_status(entry_conn, STREAM_EVENT_NEW_RESOLVE, 0);
 188
 189   /* Now, unless a controller asked us to leave streams unattached,
 190   * throw the connection over to get rewritten (which will
 191   * answer it immediately if it's in the cache, or completely bogus, or
 192   * automapped), and then attached to a circuit. */
 193   log_info(LD_APP, "Passing request for %s to rewrite_and_attach.",
 194            escaped_safe_str_client(q->name));
 195   q_name = tor_strdup(q->name); /* q could be freed in rewrite_and_attach */
 196   connection_ap_rewrite_and_attach_if_allowed(entry_conn, NULL, NULL);
 197   /* Now, the connection is marked if it was bad. */
 198
 199   log_info(LD_APP, "Passed request for %s to rewrite_and_attach_if_allowed.",
 200            escaped_safe_str_client(q_name));
 201   tor_free(q_name);
 202 }
 203
 204 /** Helper function: called whenever the client sends a resolve request to our
 205  * controller.  We need to eventually answer the request <b>req</b>.
 206  * Returns 0 if the controller will be getting (or has gotten) an event in
 207  * response; -1 if we couldn't launch the request.
 208  */
 209 int
 210 dnsserv_launch_request(const char *name, int reverse,
 211                        control_connection_t *control_conn)
 212 {
 213   entry_connection_t *entry_conn;
 214   edge_connection_t *conn;
 215   char *q_name;
 216
 217   /* Launching a request for a user counts as user activity. */
 218   note_user_activity(approx_time());
 219
 220   /* Make a new dummy AP connection, and attach the request to it. */
 221   entry_conn = entry_connection_new(CONN_TYPE_AP, AF_INET);
 222   entry_conn->entry_cfg.dns_request = 1;
 223   conn = ENTRY_TO_EDGE_CONN(entry_conn);
 224   CONNECTION_AP_EXPECT_NONPENDING(entry_conn);
 225   conn->base_.state = AP_CONN_STATE_RESOLVE_WAIT;
 226
 227   tor_addr_copy(&TO_CONN(conn)->addr, &control_conn->base_.addr);
 228 #ifdef AF_UNIX
 229   /*
 230    * The control connection can be AF_UNIX and if so tor_addr_to_str_dup will
 231    * unhelpfully say "<unknown address type>"; say "(Tor_internal)"
 232    * instead.
 233    */
 234   if (control_conn->base_.socket_family == AF_UNIX) {
 235     TO_CONN(conn)->port = 0;
 236     TO_CONN(conn)->address = tor_strdup("(Tor_internal)");
 237   } else {
 238     TO_CONN(conn)->port = control_conn->base_.port;
 239     TO_CONN(conn)->address = tor_addr_to_str_dup(&control_conn->base_.addr);
 240   }
 241 #else /* !(defined(AF_UNIX)) */
 242   TO_CONN(conn)->port = control_conn->base_.port;
 243   TO_CONN(conn)->address = tor_addr_to_str_dup(&control_conn->base_.addr);
 244 #endif /* defined(AF_UNIX) */
 245
 246   if (reverse)
 247     entry_conn->socks_request->command = SOCKS_COMMAND_RESOLVE_PTR;
 248   else
 249     entry_conn->socks_request->command = SOCKS_COMMAND_RESOLVE;
 250
 251   conn->is_dns_request = 1;
 252
 253   strlcpy(entry_conn->socks_request->address, name,
 254           sizeof(entry_conn->socks_request->address));
 255
 256   entry_conn->socks_request->listener_type = CONN_TYPE_CONTROL_LISTENER;
 257   entry_conn->original_dest_address = tor_strdup(name);
 258   entry_conn->entry_cfg.session_group = SESSION_GROUP_CONTROL_RESOLVE;
 259   entry_conn->nym_epoch = get_signewnym_epoch();
 260   entry_conn->entry_cfg.isolation_flags = ISO_DEFAULT;
 261
 262   if (connection_add(TO_CONN(conn))<0) {
 263     log_warn(LD_APP, "Couldn't register dummy connection for RESOLVE request");
 264     connection_free_(TO_CONN(conn));
 265     return -1;
 266   }
 267
 268   control_event_stream_status(entry_conn, STREAM_EVENT_NEW_RESOLVE, 0);
 269
 270   /* Now, unless a controller asked us to leave streams unattached,
 271   * throw the connection over to get rewritten (which will
 272   * answer it immediately if it's in the cache, or completely bogus, or
 273   * automapped), and then attached to a circuit. */
 274   log_info(LD_APP, "Passing request for %s to rewrite_and_attach.",
 275            escaped_safe_str_client(name));
 276   q_name = tor_strdup(name); /* q could be freed in rewrite_and_attach */
 277   connection_ap_rewrite_and_attach_if_allowed(entry_conn, NULL, NULL);
 278   /* Now, the connection is marked if it was bad. */
 279
 280   log_info(LD_APP, "Passed request for %s to rewrite_and_attach_if_allowed.",
 281            escaped_safe_str_client(q_name));
 282   tor_free(q_name);
 283   return 0;
 284 }
 285
 286 /** If there is a pending request on <b>conn</b> that's waiting for an answer,
 287  * send back an error and free the request. */
 288 void
 289 dnsserv_reject_request(entry_connection_t *conn)
 290 {
 291   if (conn->dns_server_request) {
 292     evdns_server_request_respond(conn->dns_server_request,
 293                                  DNS_ERR_SERVERFAILED);
 294     conn->dns_server_request = NULL;
 295   }
 296 }
 297
 298 /** Look up the original name that corresponds to 'addr' in req.  We use this
 299  * to preserve case in order to facilitate clients using 0x20-hacks to avoid
 300  * DNS poisoning. */
 301 static const char *
 302 evdns_get_orig_address(const struct evdns_server_request *req,
 303                        int rtype, const char *addr)
 304 {
 305   int i, type;
 306
 307   switch (rtype) {
 308   case RESOLVED_TYPE_IPV4:
 309     type = EVDNS_TYPE_A;
 310     break;
 311   case RESOLVED_TYPE_HOSTNAME:
 312     type = EVDNS_TYPE_PTR;
 313     break;
 314   case RESOLVED_TYPE_IPV6:
 315     type = EVDNS_TYPE_AAAA;
 316     break;
 317   case RESOLVED_TYPE_ERROR:
 318   case RESOLVED_TYPE_ERROR_TRANSIENT:
 319      /* Addr doesn't matter, since we're not sending it back in the reply.*/
 320     return addr;
 321   default:
 322     tor_fragile_assert();
 323     return addr;
 324   }
 325
 326   for (i = 0; i < req->nquestions; ++i) {
 327     const struct evdns_server_question *q = req->questions[i];
 328     if (q->type == type && !strcasecmp(q->name, addr))
 329       return q->name;
 330   }
 331   return addr;
 332 }
 333
 334 /** Tell the dns request waiting for an answer on <b>conn</b> that we have an
 335  * answer of type <b>answer_type</b> (RESOLVE_TYPE_IPV4/IPV6/ERR), of length
 336  * <b>answer_len</b>, in <b>answer</b>, with TTL <b>ttl</b>.  Doesn't do
 337  * any caching; that's handled elsewhere. */
 338 void
 339 dnsserv_resolved(entry_connection_t *conn,
 340                  int answer_type,
 341                  size_t answer_len,
 342                  const char *answer,
 343                  int ttl)
 344 {
 345   struct evdns_server_request *req = conn->dns_server_request;
 346   const char *name;
 347   int err = DNS_ERR_NONE;
 348   if (!req)
 349     return;
 350   name = evdns_get_orig_address(req, answer_type,
 351                                 conn->socks_request->address);
 352
 353   /* XXXX Re-do; this is dumb. */
 354   if (ttl < 60)
 355     ttl = 60;
 356
 357   /* The evdns interface is: add a bunch of reply items (corresponding to one
 358    * or more of the questions in the request); then, call
 359    * evdns_server_request_respond. */
 360   if (answer_type == RESOLVED_TYPE_IPV6) {
 361     evdns_server_request_add_aaaa_reply(req,
 362                                         name,
 363                                         1, answer, ttl);
 364   } else if (answer_type == RESOLVED_TYPE_IPV4 && answer_len == 4 &&
 365              conn->socks_request->command == SOCKS_COMMAND_RESOLVE) {
 366     evdns_server_request_add_a_reply(req,
 367                                      name,
 368                                      1, answer, ttl);
 369   } else if (answer_type == RESOLVED_TYPE_HOSTNAME &&
 370              answer_len < 256 &&
 371              conn->socks_request->command == SOCKS_COMMAND_RESOLVE_PTR) {
 372     char *ans = tor_strndup(answer, answer_len);
 373     evdns_server_request_add_ptr_reply(req, NULL,
 374                                        name,
 375                                        ans, ttl);
 376     tor_free(ans);
 377   } else if (answer_type == RESOLVED_TYPE_ERROR) {
 378     err = DNS_ERR_NOTEXIST;
 379   } else { /* answer_type == RESOLVED_TYPE_ERROR_TRANSIENT */
 380     err = DNS_ERR_SERVERFAILED;
 381   }
 382
 383   evdns_server_request_respond(req, err);
 384
 385   conn->dns_server_request = NULL;
 386 }
 387
 388 /** Set up the evdns server port for the UDP socket on <b>conn</b>, which
 389  * must be an AP_DNS_LISTENER */
 390 void
 391 dnsserv_configure_listener(connection_t *conn)
 392 {
 393   listener_connection_t *listener_conn;
 394   tor_assert(conn);
 395   tor_assert(SOCKET_OK(conn->s));
 396   tor_assert(conn->type == CONN_TYPE_AP_DNS_LISTENER);
 397
 398   listener_conn = TO_LISTENER_CONN(conn);
 399   listener_conn->dns_server_port =
 400     tor_evdns_add_server_port(conn->s, 0, evdns_server_callback,
 401                               listener_conn);
 402 }
 403
 404 /** Free the evdns server port for <b>conn</b>, which must be an
 405  * AP_DNS_LISTENER. */
 406 void
 407 dnsserv_close_listener(connection_t *conn)
 408 {
 409   listener_connection_t *listener_conn;
 410   tor_assert(conn);
 411   tor_assert(conn->type == CONN_TYPE_AP_DNS_LISTENER);
 412
 413   listener_conn = TO_LISTENER_CONN(conn);
 414
 415   if (listener_conn->dns_server_port) {
 416     evdns_close_server_port(listener_conn->dns_server_port);
 417     listener_conn->dns_server_port = NULL;
 418   }
 419 }