src/or/dnsserv.c

   1 /* Copyright (c) 2007-2016, The Tor Project, Inc. */
   2 /* See LICENSE for licensing information */
   3
   4 /**
   5  * \file dnsserv.c
   6  * \brief Implements client-side DNS proxy server code.  Note:
   7  * this is the DNS Server code, not the Server DNS code.  Confused?  This code
   8  * runs on client-side, and acts as a DNS server.  The code in dns.c, on the
   9  * other hand, runs on Tor servers, and acts as a DNS client.
  10  **/
  11
  12 #include "or.h"
  13 #include "dnsserv.h"
  14 #include "config.h"
  15 #include "connection.h"
  16 #include "connection_edge.h"
  17 #include "control.h"
  18 #include "main.h"
  19 #include "policies.h"
  20 #ifdef HAVE_EVENT2_DNS_H
  21 #include <event2/dns.h>
  22 #include <event2/dns_compat.h>
  23 /* XXXX this implies we want an improved evdns  */
  24 #include <event2/dns_struct.h>
  25 #else
  26 #include "eventdns.h"
  27 #endif
  28
  29 /** Helper function: called by evdns whenever the client sends a request to our
  30  * DNSPort.  We need to eventually answer the request <b>req</b>.
  31  */
  32 static void
  33 evdns_server_callback(struct evdns_server_request *req, void *data_)
  34 {
  35   const listener_connection_t *listener = data_;
  36   entry_connection_t *entry_conn;
  37   edge_connection_t *conn;
  38   int i = 0;
  39   struct evdns_server_question *q = NULL, *supported_q = NULL;
  40   struct sockaddr_storage addr;
  41   struct sockaddr *sa;
  42   int addrlen;
  43   tor_addr_t tor_addr;
  44   uint16_t port;
  45   int err = DNS_ERR_NONE;
  46   char *q_name;
  47
  48   tor_assert(req);
  49
  50   log_info(LD_APP, "Got a new DNS request!");
  51
  52   req->flags |= 0x80; /* set RA */
  53
  54   /* First, check whether the requesting address matches our SOCKSPolicy. */
  55   if ((addrlen = evdns_server_request_get_requesting_addr(req,
  56                       (struct sockaddr*)&addr, (socklen_t)sizeof(addr))) < 0) {
  57     log_warn(LD_APP, "Couldn't get requesting address.");
  58     evdns_server_request_respond(req, DNS_ERR_SERVERFAILED);
  59     return;
  60   }
  61   (void) addrlen;
  62   sa = (struct sockaddr*) &addr;
  63   if (tor_addr_from_sockaddr(&tor_addr, sa, &port)<0) {
  64     log_warn(LD_APP, "Requesting address wasn't recognized.");
  65     evdns_server_request_respond(req, DNS_ERR_SERVERFAILED);
  66     return;
  67   }
  68
  69   if (!socks_policy_permits_address(&tor_addr)) {
  70     log_warn(LD_APP, "Rejecting DNS request from disallowed IP.");
  71     evdns_server_request_respond(req, DNS_ERR_REFUSED);
  72     return;
  73   }
  74
  75   /* Now, let's find the first actual question of a type we can answer in this
  76    * DNS request.  It makes us a little noncompliant to act like this; we
  77    * should fix that eventually if it turns out to make a difference for
  78    * anybody. */
  79   if (req->nquestions == 0) {
  80     log_info(LD_APP, "No questions in DNS request; sending back nil reply.");
  81     evdns_server_request_respond(req, 0);
  82     return;
  83   }
  84   if (req->nquestions > 1) {
  85     log_info(LD_APP, "Got a DNS request with more than one question; I only "
  86              "handle one question at a time for now.  Skipping the extras.");
  87   }
  88   for (i = 0; i < req->nquestions; ++i) {
  89     if (req->questions[i]->dns_question_class != EVDNS_CLASS_INET)
  90       continue;
  91     switch (req->questions[i]->type) {
  92       case EVDNS_TYPE_A:
  93       case EVDNS_TYPE_AAAA:
  94       case EVDNS_TYPE_PTR:
  95         /* We always pick the first one of these questions, if there is
  96            one. */
  97         if (! supported_q)
  98           supported_q = req->questions[i];
  99         break;
 100       default:
 101         break;
 102       }
 103   }
 104   if (supported_q)
 105     q = supported_q;
 106   if (!q) {
 107     log_info(LD_APP, "None of the questions we got were ones we're willing "
 108              "to support. Sending NOTIMPL.");
 109     evdns_server_request_respond(req, DNS_ERR_NOTIMPL);
 110     return;
 111   }
 112
 113   /* Make sure the name isn't too long: This should be impossible, I think. */
 114   if (err == DNS_ERR_NONE && strlen(q->name) > MAX_SOCKS_ADDR_LEN-1)
 115     err = DNS_ERR_FORMAT;
 116
 117   if (err != DNS_ERR_NONE || !supported_q) {
 118     /* We got an error?  There's no question we're willing to answer? Then
 119      * send back an answer immediately; we're done. */
 120     evdns_server_request_respond(req, err);
 121     return;
 122   }
 123
 124   /* Make a new dummy AP connection, and attach the request to it. */
 125   entry_conn = entry_connection_new(CONN_TYPE_AP, AF_INET);
 126   conn = ENTRY_TO_EDGE_CONN(entry_conn);
 127   CONNECTION_AP_EXPECT_NONPENDING(entry_conn);
 128   TO_CONN(conn)->state = AP_CONN_STATE_RESOLVE_WAIT;
 129   conn->is_dns_request = 1;
 130
 131   tor_addr_copy(&TO_CONN(conn)->addr, &tor_addr);
 132   TO_CONN(conn)->port = port;
 133   TO_CONN(conn)->address = tor_addr_to_str_dup(&tor_addr);
 134
 135   if (q->type == EVDNS_TYPE_A || q->type == EVDNS_TYPE_AAAA ||
 136       q->type == EVDNS_QTYPE_ALL) {
 137     entry_conn->socks_request->command = SOCKS_COMMAND_RESOLVE;
 138   } else {
 139     tor_assert(q->type == EVDNS_TYPE_PTR);
 140     entry_conn->socks_request->command = SOCKS_COMMAND_RESOLVE_PTR;
 141   }
 142
 143   if (q->type == EVDNS_TYPE_A || q->type == EVDNS_QTYPE_ALL) {
 144     entry_conn->entry_cfg.ipv4_traffic = 1;
 145     entry_conn->entry_cfg.ipv6_traffic = 0;
 146     entry_conn->entry_cfg.prefer_ipv6 = 0;
 147   } else if (q->type == EVDNS_TYPE_AAAA) {
 148     entry_conn->entry_cfg.ipv4_traffic = 0;
 149     entry_conn->entry_cfg.ipv6_traffic = 1;
 150     entry_conn->entry_cfg.prefer_ipv6 = 1;
 151   }
 152
 153   strlcpy(entry_conn->socks_request->address, q->name,
 154           sizeof(entry_conn->socks_request->address));
 155
 156   entry_conn->socks_request->listener_type = listener->base_.type;
 157   entry_conn->dns_server_request = req;
 158   entry_conn->entry_cfg.isolation_flags = listener->entry_cfg.isolation_flags;
 159   entry_conn->entry_cfg.session_group = listener->entry_cfg.session_group;
 160   entry_conn->nym_epoch = get_signewnym_epoch();
 161
 162   if (connection_add(ENTRY_TO_CONN(entry_conn)) < 0) {
 163     log_warn(LD_APP, "Couldn't register dummy connection for DNS request");
 164     evdns_server_request_respond(req, DNS_ERR_SERVERFAILED);
 165     connection_free(ENTRY_TO_CONN(entry_conn));
 166     return;
 167   }
 168
 169   control_event_stream_status(entry_conn, STREAM_EVENT_NEW_RESOLVE, 0);
 170
 171   /* Now, unless a controller asked us to leave streams unattached,
 172   * throw the connection over to get rewritten (which will
 173   * answer it immediately if it's in the cache, or completely bogus, or
 174   * automapped), and then attached to a circuit. */
 175   log_info(LD_APP, "Passing request for %s to rewrite_and_attach.",
 176            escaped_safe_str_client(q->name));
 177   q_name = tor_strdup(q->name); /* q could be freed in rewrite_and_attach */
 178   connection_ap_rewrite_and_attach_if_allowed(entry_conn, NULL, NULL);
 179   /* Now, the connection is marked if it was bad. */
 180
 181   log_info(LD_APP, "Passed request for %s to rewrite_and_attach_if_allowed.",
 182            escaped_safe_str_client(q_name));
 183   tor_free(q_name);
 184 }
 185
 186 /** Helper function: called whenever the client sends a resolve request to our
 187  * controller.  We need to eventually answer the request <b>req</b>.
 188  * Returns 0 if the controller will be getting (or has gotten) an event in
 189  * response; -1 if we couldn't launch the request.
 190  */
 191 int
 192 dnsserv_launch_request(const char *name, int reverse,
 193                        control_connection_t *control_conn)
 194 {
 195   entry_connection_t *entry_conn;
 196   edge_connection_t *conn;
 197   char *q_name;
 198
 199   /* Make a new dummy AP connection, and attach the request to it. */
 200   entry_conn = entry_connection_new(CONN_TYPE_AP, AF_INET);
 201   conn = ENTRY_TO_EDGE_CONN(entry_conn);
 202   CONNECTION_AP_EXPECT_NONPENDING(entry_conn);
 203   conn->base_.state = AP_CONN_STATE_RESOLVE_WAIT;
 204
 205   tor_addr_copy(&TO_CONN(conn)->addr, &control_conn->base_.addr);
 206 #ifdef AF_UNIX
 207   /*
 208    * The control connection can be AF_UNIX and if so tor_addr_to_str_dup will
 209    * unhelpfully say "<unknown address type>"; say "(Tor_internal)"
 210    * instead.
 211    */
 212   if (control_conn->base_.socket_family == AF_UNIX) {
 213     TO_CONN(conn)->port = 0;
 214     TO_CONN(conn)->address = tor_strdup("(Tor_internal)");
 215   } else {
 216     TO_CONN(conn)->port = control_conn->base_.port;
 217     TO_CONN(conn)->address = tor_addr_to_str_dup(&control_conn->base_.addr);
 218   }
 219 #else
 220   TO_CONN(conn)->port = control_conn->base_.port;
 221   TO_CONN(conn)->address = tor_addr_to_str_dup(&control_conn->base_.addr);
 222 #endif
 223
 224   if (reverse)
 225     entry_conn->socks_request->command = SOCKS_COMMAND_RESOLVE_PTR;
 226   else
 227     entry_conn->socks_request->command = SOCKS_COMMAND_RESOLVE;
 228
 229   conn->is_dns_request = 1;
 230
 231   strlcpy(entry_conn->socks_request->address, name,
 232           sizeof(entry_conn->socks_request->address));
 233
 234   entry_conn->socks_request->listener_type = CONN_TYPE_CONTROL_LISTENER;
 235   entry_conn->original_dest_address = tor_strdup(name);
 236   entry_conn->entry_cfg.session_group = SESSION_GROUP_CONTROL_RESOLVE;
 237   entry_conn->nym_epoch = get_signewnym_epoch();
 238   entry_conn->entry_cfg.isolation_flags = ISO_DEFAULT;
 239
 240   if (connection_add(TO_CONN(conn))<0) {
 241     log_warn(LD_APP, "Couldn't register dummy connection for RESOLVE request");
 242     connection_free(TO_CONN(conn));
 243     return -1;
 244   }
 245
 246   control_event_stream_status(entry_conn, STREAM_EVENT_NEW_RESOLVE, 0);
 247
 248   /* Now, unless a controller asked us to leave streams unattached,
 249   * throw the connection over to get rewritten (which will
 250   * answer it immediately if it's in the cache, or completely bogus, or
 251   * automapped), and then attached to a circuit. */
 252   log_info(LD_APP, "Passing request for %s to rewrite_and_attach.",
 253            escaped_safe_str_client(name));
 254   q_name = tor_strdup(name); /* q could be freed in rewrite_and_attach */
 255   connection_ap_rewrite_and_attach_if_allowed(entry_conn, NULL, NULL);
 256   /* Now, the connection is marked if it was bad. */
 257
 258   log_info(LD_APP, "Passed request for %s to rewrite_and_attach_if_allowed.",
 259            escaped_safe_str_client(q_name));
 260   tor_free(q_name);
 261   return 0;
 262 }
 263
 264 /** If there is a pending request on <b>conn</b> that's waiting for an answer,
 265  * send back an error and free the request. */
 266 void
 267 dnsserv_reject_request(entry_connection_t *conn)
 268 {
 269   if (conn->dns_server_request) {
 270     evdns_server_request_respond(conn->dns_server_request,
 271                                  DNS_ERR_SERVERFAILED);
 272     conn->dns_server_request = NULL;
 273   }
 274 }
 275
 276 /** Look up the original name that corresponds to 'addr' in req.  We use this
 277  * to preserve case in order to facilitate people using 0x20-hacks to avoid
 278  * DNS poisoning. */
 279 static const char *
 280 evdns_get_orig_address(const struct evdns_server_request *req,
 281                        int rtype, const char *addr)
 282 {
 283   int i, type;
 284
 285   switch (rtype) {
 286   case RESOLVED_TYPE_IPV4:
 287     type = EVDNS_TYPE_A;
 288     break;
 289   case RESOLVED_TYPE_HOSTNAME:
 290     type = EVDNS_TYPE_PTR;
 291     break;
 292   case RESOLVED_TYPE_IPV6:
 293     type = EVDNS_TYPE_AAAA;
 294     break;
 295   default:
 296     tor_fragile_assert();
 297     return addr;
 298   }
 299
 300   for (i = 0; i < req->nquestions; ++i) {
 301     const struct evdns_server_question *q = req->questions[i];
 302     if (q->type == type && !strcasecmp(q->name, addr))
 303       return q->name;
 304   }
 305   return addr;
 306 }
 307
 308 /** Tell the dns request waiting for an answer on <b>conn</b> that we have an
 309  * answer of type <b>answer_type</b> (RESOLVE_TYPE_IPV4/IPV6/ERR), of length
 310  * <b>answer_len</b>, in <b>answer</b>, with TTL <b>ttl</b>.  Doesn't do
 311  * any caching; that's handled elsewhere. */
 312 void
 313 dnsserv_resolved(entry_connection_t *conn,
 314                  int answer_type,
 315                  size_t answer_len,
 316                  const char *answer,
 317                  int ttl)
 318 {
 319   struct evdns_server_request *req = conn->dns_server_request;
 320   const char *name;
 321   int err = DNS_ERR_NONE;
 322   if (!req)
 323     return;
 324   name = evdns_get_orig_address(req, answer_type,
 325                                 conn->socks_request->address);
 326
 327   /* XXXX Re-do; this is dumb. */
 328   if (ttl < 60)
 329     ttl = 60;
 330
 331   /* The evdns interface is: add a bunch of reply items (corresponding to one
 332    * or more of the questions in the request); then, call
 333    * evdns_server_request_respond. */
 334   if (answer_type == RESOLVED_TYPE_IPV6) {
 335     evdns_server_request_add_aaaa_reply(req,
 336                                         name,
 337                                         1, answer, ttl);
 338   } else if (answer_type == RESOLVED_TYPE_IPV4 && answer_len == 4 &&
 339              conn->socks_request->command == SOCKS_COMMAND_RESOLVE) {
 340     evdns_server_request_add_a_reply(req,
 341                                      name,
 342                                      1, answer, ttl);
 343   } else if (answer_type == RESOLVED_TYPE_HOSTNAME &&
 344              answer_len < 256 &&
 345              conn->socks_request->command == SOCKS_COMMAND_RESOLVE_PTR) {
 346     char *ans = tor_strndup(answer, answer_len);
 347     evdns_server_request_add_ptr_reply(req, NULL,
 348                                        name,
 349                                        ans, ttl);
 350     tor_free(ans);
 351   } else if (answer_type == RESOLVED_TYPE_ERROR) {
 352     err = DNS_ERR_NOTEXIST;
 353   } else { /* answer_type == RESOLVED_TYPE_ERROR_TRANSIENT */
 354     err = DNS_ERR_SERVERFAILED;
 355   }
 356
 357   evdns_server_request_respond(req, err);
 358
 359   conn->dns_server_request = NULL;
 360 }
 361
 362 /** Set up the evdns server port for the UDP socket on <b>conn</b>, which
 363  * must be an AP_DNS_LISTENER */
 364 void
 365 dnsserv_configure_listener(connection_t *conn)
 366 {
 367   listener_connection_t *listener_conn;
 368   tor_assert(conn);
 369   tor_assert(SOCKET_OK(conn->s));
 370   tor_assert(conn->type == CONN_TYPE_AP_DNS_LISTENER);
 371
 372   listener_conn = TO_LISTENER_CONN(conn);
 373   listener_conn->dns_server_port =
 374     tor_evdns_add_server_port(conn->s, 0, evdns_server_callback,
 375                               listener_conn);
 376 }
 377
 378 /** Free the evdns server port for <b>conn</b>, which must be an
 379  * AP_DNS_LISTENER. */
 380 void
 381 dnsserv_close_listener(connection_t *conn)
 382 {
 383   listener_connection_t *listener_conn;
 384   tor_assert(conn);
 385   tor_assert(conn->type == CONN_TYPE_AP_DNS_LISTENER);
 386
 387   listener_conn = TO_LISTENER_CONN(conn);
 388
 389   if (listener_conn->dns_server_port) {
 390     evdns_close_server_port(listener_conn->dns_server_port);
 391     listener_conn->dns_server_port = NULL;
 392   }
 393 }
 394