1 /* Copyright (c) 2007-2016, The Tor Project, Inc. */
2 /* See LICENSE for licensing information */
6 * \brief Implements client-side DNS proxy server code. Note:
7 * this is the DNS Server code, not the Server DNS code. Confused? This code
8 * runs on client-side, and acts as a DNS server. The code in dns.c, on the
9 * other hand, runs on Tor servers, and acts as a DNS client.
15 #include "connection.h"
16 #include "connection_edge.h"
20 #ifdef HAVE_EVENT2_DNS_H
21 #include <event2/dns.h>
22 #include <event2/dns_compat.h>
23 /* XXXX this implies we want an improved evdns */
24 #include <event2/dns_struct.h>
29 /** Helper function: called by evdns whenever the client sends a request to our
30 * DNSPort. We need to eventually answer the request <b>req</b>.
33 evdns_server_callback(struct evdns_server_request
*req
, void *data_
)
35 const listener_connection_t
*listener
= data_
;
36 entry_connection_t
*entry_conn
;
37 edge_connection_t
*conn
;
39 struct evdns_server_question
*q
= NULL
, *supported_q
= NULL
;
40 struct sockaddr_storage addr
;
45 int err
= DNS_ERR_NONE
;
50 log_info(LD_APP
, "Got a new DNS request!");
52 req
->flags
|= 0x80; /* set RA */
54 /* First, check whether the requesting address matches our SOCKSPolicy. */
55 if ((addrlen
= evdns_server_request_get_requesting_addr(req
,
56 (struct sockaddr
*)&addr
, (socklen_t
)sizeof(addr
))) < 0) {
57 log_warn(LD_APP
, "Couldn't get requesting address.");
58 evdns_server_request_respond(req
, DNS_ERR_SERVERFAILED
);
62 sa
= (struct sockaddr
*) &addr
;
63 if (tor_addr_from_sockaddr(&tor_addr
, sa
, &port
)<0) {
64 log_warn(LD_APP
, "Requesting address wasn't recognized.");
65 evdns_server_request_respond(req
, DNS_ERR_SERVERFAILED
);
69 if (!socks_policy_permits_address(&tor_addr
)) {
70 log_warn(LD_APP
, "Rejecting DNS request from disallowed IP.");
71 evdns_server_request_respond(req
, DNS_ERR_REFUSED
);
75 /* Now, let's find the first actual question of a type we can answer in this
76 * DNS request. It makes us a little noncompliant to act like this; we
77 * should fix that eventually if it turns out to make a difference for
79 if (req
->nquestions
== 0) {
80 log_info(LD_APP
, "No questions in DNS request; sending back nil reply.");
81 evdns_server_request_respond(req
, 0);
84 if (req
->nquestions
> 1) {
85 log_info(LD_APP
, "Got a DNS request with more than one question; I only "
86 "handle one question at a time for now. Skipping the extras.");
88 for (i
= 0; i
< req
->nquestions
; ++i
) {
89 if (req
->questions
[i
]->dns_question_class
!= EVDNS_CLASS_INET
)
91 switch (req
->questions
[i
]->type
) {
95 /* We always pick the first one of these questions, if there is
98 supported_q
= req
->questions
[i
];
107 log_info(LD_APP
, "None of the questions we got were ones we're willing "
108 "to support. Sending NOTIMPL.");
109 evdns_server_request_respond(req
, DNS_ERR_NOTIMPL
);
113 /* Make sure the name isn't too long: This should be impossible, I think. */
114 if (err
== DNS_ERR_NONE
&& strlen(q
->name
) > MAX_SOCKS_ADDR_LEN
-1)
115 err
= DNS_ERR_FORMAT
;
117 if (err
!= DNS_ERR_NONE
|| !supported_q
) {
118 /* We got an error? There's no question we're willing to answer? Then
119 * send back an answer immediately; we're done. */
120 evdns_server_request_respond(req
, err
);
124 /* Make a new dummy AP connection, and attach the request to it. */
125 entry_conn
= entry_connection_new(CONN_TYPE_AP
, AF_INET
);
126 conn
= ENTRY_TO_EDGE_CONN(entry_conn
);
127 CONNECTION_AP_EXPECT_NONPENDING(entry_conn
);
128 TO_CONN(conn
)->state
= AP_CONN_STATE_RESOLVE_WAIT
;
129 conn
->is_dns_request
= 1;
131 tor_addr_copy(&TO_CONN(conn
)->addr
, &tor_addr
);
132 TO_CONN(conn
)->port
= port
;
133 TO_CONN(conn
)->address
= tor_addr_to_str_dup(&tor_addr
);
135 if (q
->type
== EVDNS_TYPE_A
|| q
->type
== EVDNS_TYPE_AAAA
||
136 q
->type
== EVDNS_QTYPE_ALL
) {
137 entry_conn
->socks_request
->command
= SOCKS_COMMAND_RESOLVE
;
139 tor_assert(q
->type
== EVDNS_TYPE_PTR
);
140 entry_conn
->socks_request
->command
= SOCKS_COMMAND_RESOLVE_PTR
;
143 if (q
->type
== EVDNS_TYPE_A
|| q
->type
== EVDNS_QTYPE_ALL
) {
144 entry_conn
->entry_cfg
.ipv4_traffic
= 1;
145 entry_conn
->entry_cfg
.ipv6_traffic
= 0;
146 entry_conn
->entry_cfg
.prefer_ipv6
= 0;
147 } else if (q
->type
== EVDNS_TYPE_AAAA
) {
148 entry_conn
->entry_cfg
.ipv4_traffic
= 0;
149 entry_conn
->entry_cfg
.ipv6_traffic
= 1;
150 entry_conn
->entry_cfg
.prefer_ipv6
= 1;
153 strlcpy(entry_conn
->socks_request
->address
, q
->name
,
154 sizeof(entry_conn
->socks_request
->address
));
156 entry_conn
->socks_request
->listener_type
= listener
->base_
.type
;
157 entry_conn
->dns_server_request
= req
;
158 entry_conn
->entry_cfg
.isolation_flags
= listener
->entry_cfg
.isolation_flags
;
159 entry_conn
->entry_cfg
.session_group
= listener
->entry_cfg
.session_group
;
160 entry_conn
->nym_epoch
= get_signewnym_epoch();
162 if (connection_add(ENTRY_TO_CONN(entry_conn
)) < 0) {
163 log_warn(LD_APP
, "Couldn't register dummy connection for DNS request");
164 evdns_server_request_respond(req
, DNS_ERR_SERVERFAILED
);
165 connection_free(ENTRY_TO_CONN(entry_conn
));
169 control_event_stream_status(entry_conn
, STREAM_EVENT_NEW_RESOLVE
, 0);
171 /* Now, unless a controller asked us to leave streams unattached,
172 * throw the connection over to get rewritten (which will
173 * answer it immediately if it's in the cache, or completely bogus, or
174 * automapped), and then attached to a circuit. */
175 log_info(LD_APP
, "Passing request for %s to rewrite_and_attach.",
176 escaped_safe_str_client(q
->name
));
177 q_name
= tor_strdup(q
->name
); /* q could be freed in rewrite_and_attach */
178 connection_ap_rewrite_and_attach_if_allowed(entry_conn
, NULL
, NULL
);
179 /* Now, the connection is marked if it was bad. */
181 log_info(LD_APP
, "Passed request for %s to rewrite_and_attach_if_allowed.",
182 escaped_safe_str_client(q_name
));
186 /** Helper function: called whenever the client sends a resolve request to our
187 * controller. We need to eventually answer the request <b>req</b>.
188 * Returns 0 if the controller will be getting (or has gotten) an event in
189 * response; -1 if we couldn't launch the request.
192 dnsserv_launch_request(const char *name
, int reverse
,
193 control_connection_t
*control_conn
)
195 entry_connection_t
*entry_conn
;
196 edge_connection_t
*conn
;
199 /* Make a new dummy AP connection, and attach the request to it. */
200 entry_conn
= entry_connection_new(CONN_TYPE_AP
, AF_INET
);
201 conn
= ENTRY_TO_EDGE_CONN(entry_conn
);
202 CONNECTION_AP_EXPECT_NONPENDING(entry_conn
);
203 conn
->base_
.state
= AP_CONN_STATE_RESOLVE_WAIT
;
205 tor_addr_copy(&TO_CONN(conn
)->addr
, &control_conn
->base_
.addr
);
208 * The control connection can be AF_UNIX and if so tor_addr_to_str_dup will
209 * unhelpfully say "<unknown address type>"; say "(Tor_internal)"
212 if (control_conn
->base_
.socket_family
== AF_UNIX
) {
213 TO_CONN(conn
)->port
= 0;
214 TO_CONN(conn
)->address
= tor_strdup("(Tor_internal)");
216 TO_CONN(conn
)->port
= control_conn
->base_
.port
;
217 TO_CONN(conn
)->address
= tor_addr_to_str_dup(&control_conn
->base_
.addr
);
220 TO_CONN(conn
)->port
= control_conn
->base_
.port
;
221 TO_CONN(conn
)->address
= tor_addr_to_str_dup(&control_conn
->base_
.addr
);
225 entry_conn
->socks_request
->command
= SOCKS_COMMAND_RESOLVE_PTR
;
227 entry_conn
->socks_request
->command
= SOCKS_COMMAND_RESOLVE
;
229 conn
->is_dns_request
= 1;
231 strlcpy(entry_conn
->socks_request
->address
, name
,
232 sizeof(entry_conn
->socks_request
->address
));
234 entry_conn
->socks_request
->listener_type
= CONN_TYPE_CONTROL_LISTENER
;
235 entry_conn
->original_dest_address
= tor_strdup(name
);
236 entry_conn
->entry_cfg
.session_group
= SESSION_GROUP_CONTROL_RESOLVE
;
237 entry_conn
->nym_epoch
= get_signewnym_epoch();
238 entry_conn
->entry_cfg
.isolation_flags
= ISO_DEFAULT
;
240 if (connection_add(TO_CONN(conn
))<0) {
241 log_warn(LD_APP
, "Couldn't register dummy connection for RESOLVE request");
242 connection_free(TO_CONN(conn
));
246 control_event_stream_status(entry_conn
, STREAM_EVENT_NEW_RESOLVE
, 0);
248 /* Now, unless a controller asked us to leave streams unattached,
249 * throw the connection over to get rewritten (which will
250 * answer it immediately if it's in the cache, or completely bogus, or
251 * automapped), and then attached to a circuit. */
252 log_info(LD_APP
, "Passing request for %s to rewrite_and_attach.",
253 escaped_safe_str_client(name
));
254 q_name
= tor_strdup(name
); /* q could be freed in rewrite_and_attach */
255 connection_ap_rewrite_and_attach_if_allowed(entry_conn
, NULL
, NULL
);
256 /* Now, the connection is marked if it was bad. */
258 log_info(LD_APP
, "Passed request for %s to rewrite_and_attach_if_allowed.",
259 escaped_safe_str_client(q_name
));
264 /** If there is a pending request on <b>conn</b> that's waiting for an answer,
265 * send back an error and free the request. */
267 dnsserv_reject_request(entry_connection_t
*conn
)
269 if (conn
->dns_server_request
) {
270 evdns_server_request_respond(conn
->dns_server_request
,
271 DNS_ERR_SERVERFAILED
);
272 conn
->dns_server_request
= NULL
;
276 /** Look up the original name that corresponds to 'addr' in req. We use this
277 * to preserve case in order to facilitate people using 0x20-hacks to avoid
280 evdns_get_orig_address(const struct evdns_server_request
*req
,
281 int rtype
, const char *addr
)
286 case RESOLVED_TYPE_IPV4
:
289 case RESOLVED_TYPE_HOSTNAME
:
290 type
= EVDNS_TYPE_PTR
;
292 case RESOLVED_TYPE_IPV6
:
293 type
= EVDNS_TYPE_AAAA
;
296 tor_fragile_assert();
300 for (i
= 0; i
< req
->nquestions
; ++i
) {
301 const struct evdns_server_question
*q
= req
->questions
[i
];
302 if (q
->type
== type
&& !strcasecmp(q
->name
, addr
))
308 /** Tell the dns request waiting for an answer on <b>conn</b> that we have an
309 * answer of type <b>answer_type</b> (RESOLVE_TYPE_IPV4/IPV6/ERR), of length
310 * <b>answer_len</b>, in <b>answer</b>, with TTL <b>ttl</b>. Doesn't do
311 * any caching; that's handled elsewhere. */
313 dnsserv_resolved(entry_connection_t
*conn
,
319 struct evdns_server_request
*req
= conn
->dns_server_request
;
321 int err
= DNS_ERR_NONE
;
324 name
= evdns_get_orig_address(req
, answer_type
,
325 conn
->socks_request
->address
);
327 /* XXXX Re-do; this is dumb. */
331 /* The evdns interface is: add a bunch of reply items (corresponding to one
332 * or more of the questions in the request); then, call
333 * evdns_server_request_respond. */
334 if (answer_type
== RESOLVED_TYPE_IPV6
) {
335 evdns_server_request_add_aaaa_reply(req
,
338 } else if (answer_type
== RESOLVED_TYPE_IPV4
&& answer_len
== 4 &&
339 conn
->socks_request
->command
== SOCKS_COMMAND_RESOLVE
) {
340 evdns_server_request_add_a_reply(req
,
343 } else if (answer_type
== RESOLVED_TYPE_HOSTNAME
&&
345 conn
->socks_request
->command
== SOCKS_COMMAND_RESOLVE_PTR
) {
346 char *ans
= tor_strndup(answer
, answer_len
);
347 evdns_server_request_add_ptr_reply(req
, NULL
,
351 } else if (answer_type
== RESOLVED_TYPE_ERROR
) {
352 err
= DNS_ERR_NOTEXIST
;
353 } else { /* answer_type == RESOLVED_TYPE_ERROR_TRANSIENT */
354 err
= DNS_ERR_SERVERFAILED
;
357 evdns_server_request_respond(req
, err
);
359 conn
->dns_server_request
= NULL
;
362 /** Set up the evdns server port for the UDP socket on <b>conn</b>, which
363 * must be an AP_DNS_LISTENER */
365 dnsserv_configure_listener(connection_t
*conn
)
367 listener_connection_t
*listener_conn
;
369 tor_assert(SOCKET_OK(conn
->s
));
370 tor_assert(conn
->type
== CONN_TYPE_AP_DNS_LISTENER
);
372 listener_conn
= TO_LISTENER_CONN(conn
);
373 listener_conn
->dns_server_port
=
374 tor_evdns_add_server_port(conn
->s
, 0, evdns_server_callback
,
378 /** Free the evdns server port for <b>conn</b>, which must be an
379 * AP_DNS_LISTENER. */
381 dnsserv_close_listener(connection_t
*conn
)
383 listener_connection_t
*listener_conn
;
385 tor_assert(conn
->type
== CONN_TYPE_AP_DNS_LISTENER
);
387 listener_conn
= TO_LISTENER_CONN(conn
);
389 if (listener_conn
->dns_server_port
) {
390 evdns_close_server_port(listener_conn
->dns_server_port
);
391 listener_conn
->dns_server_port
= NULL
;