src/or/dnsserv.c

   1 /* Copyright (c) 2007-2011, The Tor Project, Inc. */
   2 /* See LICENSE for licensing information */
   3
   4 /**
   5  * \file dnsserv.c \brief Implements client-side DNS proxy server code.  Note:
   6  * this is the DNS Server code, not the Server DNS code.  Confused?  This code
   7  * runs on client-side, and acts as a DNS server.  The code in dns.c, on the
   8  * other hand, runs on Tor servers, and acts as a DNS client.
   9  **/
  10
  11 #include "or.h"
  12 #include "dnsserv.h"
  13 #include "config.h"
  14 #include "connection.h"
  15 #include "connection_edge.h"
  16 #include "control.h"
  17 #include "main.h"
  18 #include "policies.h"
  19 #ifdef HAVE_EVENT2_DNS_H
  20 #include <event2/dns.h>
  21 #include <event2/dns_compat.h>
  22 /* XXXX023 this implies we want an improved evdns  */
  23 #include <event2/dns_struct.h>
  24 #else
  25 #include "eventdns.h"
  26 #endif
  27
  28 /** Helper function: called by evdns whenever the client sends a request to our
  29  * DNSPort.  We need to eventually answer the request <b>req</b>.
  30  */
  31 static void
  32 evdns_server_callback(struct evdns_server_request *req, void *_data)
  33 {
  34   edge_connection_t *conn;
  35   int i = 0;
  36   struct evdns_server_question *q = NULL;
  37   struct sockaddr_storage addr;
  38   struct sockaddr *sa;
  39   int addrlen;
  40   tor_addr_t tor_addr;
  41   uint16_t port;
  42   int err = DNS_ERR_NONE;
  43   char *q_name;
  44
  45   tor_assert(req);
  46   tor_assert(_data == NULL);
  47   log_info(LD_APP, "Got a new DNS request!");
  48
  49   req->flags |= 0x80; /* set RA */
  50
  51   /* First, check whether the requesting address matches our SOCKSPolicy. */
  52   if ((addrlen = evdns_server_request_get_requesting_addr(req,
  53                       (struct sockaddr*)&addr, (socklen_t)sizeof(addr))) < 0) {
  54     log_warn(LD_APP, "Couldn't get requesting address.");
  55     evdns_server_request_respond(req, DNS_ERR_SERVERFAILED);
  56     return;
  57   }
  58   (void) addrlen;
  59   sa = (struct sockaddr*) &addr;
  60   if (tor_addr_from_sockaddr(&tor_addr, sa, &port)<0) {
  61     log_warn(LD_APP, "Requesting address wasn't recognized.");
  62     evdns_server_request_respond(req, DNS_ERR_SERVERFAILED);
  63     return;
  64   }
  65
  66   if (!socks_policy_permits_address(&tor_addr)) {
  67     log_warn(LD_APP, "Rejecting DNS request from disallowed IP.");
  68     evdns_server_request_respond(req, DNS_ERR_REFUSED);
  69     return;
  70   }
  71
  72   /* Now, let's find the first actual question of a type we can answer in this
  73    * DNS request.  It makes us a little noncompliant to act like this; we
  74    * should fix that eventually if it turns out to make a difference for
  75    * anybody. */
  76   if (req->nquestions == 0) {
  77     log_info(LD_APP, "No questions in DNS request; sending back nil reply.");
  78     evdns_server_request_respond(req, 0);
  79     return;
  80   }
  81   if (req->nquestions > 1) {
  82     log_info(LD_APP, "Got a DNS request with more than one question; I only "
  83              "handle one question at a time for now.  Skipping the extras.");
  84   }
  85   for (i = 0; i < req->nquestions; ++i) {
  86     if (req->questions[i]->dns_question_class != EVDNS_CLASS_INET)
  87       continue;
  88     switch (req->questions[i]->type) {
  89       case EVDNS_TYPE_A:
  90       case EVDNS_TYPE_PTR:
  91         q = req->questions[i];
  92       default:
  93         break;
  94       }
  95   }
  96   if (!q) {
  97     log_info(LD_APP, "None of the questions we got were ones we're willing "
  98              "to support. Sending NODATA.");
  99     evdns_server_request_respond(req, DNS_ERR_NONE);
 100     return;
 101   }
 102   if (q->type != EVDNS_TYPE_A) {
 103     tor_assert(q->type == EVDNS_TYPE_PTR);
 104   }
 105
 106   /* Make sure the name isn't too long: This should be impossible, I think. */
 107   if (err == DNS_ERR_NONE && strlen(q->name) > MAX_SOCKS_ADDR_LEN-1)
 108     err = DNS_ERR_FORMAT;
 109
 110   if (err != DNS_ERR_NONE) {
 111     /* We got an error?  Then send back an answer immediately; we're done. */
 112     evdns_server_request_respond(req, err);
 113     return;
 114   }
 115
 116   /* Make a new dummy AP connection, and attach the request to it. */
 117   conn = edge_connection_new(CONN_TYPE_AP, AF_INET);
 118   conn->_base.state = AP_CONN_STATE_RESOLVE_WAIT;
 119   conn->is_dns_request = 1;
 120
 121   tor_addr_copy(&TO_CONN(conn)->addr, &tor_addr);
 122   TO_CONN(conn)->port = port;
 123   TO_CONN(conn)->address = tor_dup_addr(&tor_addr);
 124
 125   if (q->type == EVDNS_TYPE_A)
 126     conn->socks_request->command = SOCKS_COMMAND_RESOLVE;
 127   else
 128     conn->socks_request->command = SOCKS_COMMAND_RESOLVE_PTR;
 129
 130   strlcpy(conn->socks_request->address, q->name,
 131           sizeof(conn->socks_request->address));
 132
 133   conn->dns_server_request = req;
 134
 135   if (connection_add(TO_CONN(conn)) < 0) {
 136     log_warn(LD_APP, "Couldn't register dummy connection for DNS request");
 137     evdns_server_request_respond(req, DNS_ERR_SERVERFAILED);
 138     connection_free(TO_CONN(conn));
 139     return;
 140   }
 141
 142   control_event_stream_status(conn, STREAM_EVENT_NEW, 0);
 143
 144   /* Now, unless a controller asked us to leave streams unattached,
 145   * throw the connection over to get rewritten (which will
 146   * answer it immediately if it's in the cache, or completely bogus, or
 147   * automapped), and then attached to a circuit. */
 148   log_info(LD_APP, "Passing request for %s to rewrite_and_attach.",
 149            escaped_safe_str_client(q->name));
 150   q_name = tor_strdup(q->name); /* q could be freed in rewrite_and_attach */
 151   connection_ap_rewrite_and_attach_if_allowed(conn, NULL, NULL);
 152   /* Now, the connection is marked if it was bad. */
 153
 154   log_info(LD_APP, "Passed request for %s to rewrite_and_attach_if_allowed.",
 155            escaped_safe_str_client(q_name));
 156   tor_free(q_name);
 157 }
 158
 159 /** Helper function: called whenever the client sends a resolve request to our
 160  * controller.  We need to eventually answer the request <b>req</b>.
 161  * Returns 0 if the controller will be getting (or has gotten) an event in
 162  * response; -1 if we couldn't launch the request.
 163  */
 164 int
 165 dnsserv_launch_request(const char *name, int reverse)
 166 {
 167   edge_connection_t *conn;
 168   char *q_name;
 169
 170   /* Make a new dummy AP connection, and attach the request to it. */
 171   conn = edge_connection_new(CONN_TYPE_AP, AF_INET);
 172   conn->_base.state = AP_CONN_STATE_RESOLVE_WAIT;
 173
 174   if (reverse)
 175     conn->socks_request->command = SOCKS_COMMAND_RESOLVE_PTR;
 176   else
 177     conn->socks_request->command = SOCKS_COMMAND_RESOLVE;
 178
 179   conn->is_dns_request = 1;
 180
 181   strlcpy(conn->socks_request->address, name,
 182           sizeof(conn->socks_request->address));
 183
 184   if (connection_add(TO_CONN(conn))<0) {
 185     log_warn(LD_APP, "Couldn't register dummy connection for RESOLVE request");
 186     connection_free(TO_CONN(conn));
 187     return -1;
 188   }
 189
 190   /* Now, unless a controller asked us to leave streams unattached,
 191   * throw the connection over to get rewritten (which will
 192   * answer it immediately if it's in the cache, or completely bogus, or
 193   * automapped), and then attached to a circuit. */
 194   log_info(LD_APP, "Passing request for %s to rewrite_and_attach.",
 195            escaped_safe_str_client(name));
 196   q_name = tor_strdup(name); /* q could be freed in rewrite_and_attach */
 197   connection_ap_rewrite_and_attach_if_allowed(conn, NULL, NULL);
 198   /* Now, the connection is marked if it was bad. */
 199
 200   log_info(LD_APP, "Passed request for %s to rewrite_and_attach_if_allowed.",
 201            escaped_safe_str_client(q_name));
 202   tor_free(q_name);
 203   return 0;
 204 }
 205
 206 /** If there is a pending request on <b>conn</b> that's waiting for an answer,
 207  * send back an error and free the request. */
 208 void
 209 dnsserv_reject_request(edge_connection_t *conn)
 210 {
 211   if (conn->dns_server_request) {
 212     evdns_server_request_respond(conn->dns_server_request,
 213                                  DNS_ERR_SERVERFAILED);
 214     conn->dns_server_request = NULL;
 215   }
 216 }
 217
 218 /** Look up the original name that corresponds to 'addr' in req.  We use this
 219  * to preserve case in order to facilitate people using 0x20-hacks to avoid
 220  * DNS poisoning. */
 221 static const char *
 222 evdns_get_orig_address(const struct evdns_server_request *req,
 223                        int rtype, const char *addr)
 224 {
 225   int i, type;
 226
 227   switch (rtype) {
 228   case RESOLVED_TYPE_IPV4:
 229     type = EVDNS_TYPE_A;
 230     break;
 231   case RESOLVED_TYPE_HOSTNAME:
 232     type = EVDNS_TYPE_PTR;
 233     break;
 234   case RESOLVED_TYPE_IPV6:
 235     type = EVDNS_TYPE_AAAA;
 236     break;
 237   default:
 238     tor_fragile_assert();
 239     return addr;
 240   }
 241
 242   for (i = 0; i < req->nquestions; ++i) {
 243     const struct evdns_server_question *q = req->questions[i];
 244     if (q->type == type && !strcasecmp(q->name, addr))
 245       return q->name;
 246   }
 247   return addr;
 248 }
 249
 250 /** Tell the dns request waiting for an answer on <b>conn</b> that we have an
 251  * answer of type <b>answer_type</b> (RESOLVE_TYPE_IPV4/IPV6/ERR), of length
 252  * <b>answer_len</b>, in <b>answer</b>, with TTL <b>ttl</b>.  Doesn't do
 253  * any caching; that's handled elsewhere. */
 254 void
 255 dnsserv_resolved(edge_connection_t *conn,
 256                  int answer_type,
 257                  size_t answer_len,
 258                  const char *answer,
 259                  int ttl)
 260 {
 261   struct evdns_server_request *req = conn->dns_server_request;
 262   const char *name;
 263   int err = DNS_ERR_NONE;
 264   if (!req)
 265     return;
 266   name = evdns_get_orig_address(req, answer_type,
 267                                 conn->socks_request->address);
 268
 269   /* XXXX Re-do; this is dumb. */
 270   if (ttl < 60)
 271     ttl = 60;
 272
 273   /* The evdns interface is: add a bunch of reply items (corresponding to one
 274    * or more of the questions in the request); then, call
 275    * evdns_server_request_respond. */
 276   if (answer_type == RESOLVED_TYPE_IPV6) {
 277     log_info(LD_APP, "Got an IPv6 answer; that's not implemented.");
 278     err = DNS_ERR_NOTIMPL;
 279   } else if (answer_type == RESOLVED_TYPE_IPV4 && answer_len == 4 &&
 280              conn->socks_request->command == SOCKS_COMMAND_RESOLVE) {
 281     evdns_server_request_add_a_reply(req,
 282                                      name,
 283                                      1, answer, ttl);
 284   } else if (answer_type == RESOLVED_TYPE_HOSTNAME &&
 285              answer_len < 256 &&
 286              conn->socks_request->command == SOCKS_COMMAND_RESOLVE_PTR) {
 287     char *ans = tor_strndup(answer, answer_len);
 288     evdns_server_request_add_ptr_reply(req, NULL,
 289                                        name,
 290                                        ans, ttl);
 291     tor_free(ans);
 292   } else if (answer_type == RESOLVED_TYPE_ERROR) {
 293     err = DNS_ERR_NOTEXIST;
 294   } else { /* answer_type == RESOLVED_TYPE_ERROR_TRANSIENT */
 295     err = DNS_ERR_SERVERFAILED;
 296   }
 297
 298   evdns_server_request_respond(req, err);
 299
 300   conn->dns_server_request = NULL;
 301 }
 302
 303 /** Set up the evdns server port for the UDP socket on <b>conn</b>, which
 304  * must be an AP_DNS_LISTENER */
 305 void
 306 dnsserv_configure_listener(connection_t *conn)
 307 {
 308   tor_assert(conn);
 309   tor_assert(SOCKET_OK(conn->s));
 310   tor_assert(conn->type == CONN_TYPE_AP_DNS_LISTENER);
 311
 312   conn->dns_server_port =
 313     tor_evdns_add_server_port(conn->s, 0, evdns_server_callback, NULL);
 314 }
 315
 316 /** Free the evdns server port for <b>conn</b>, which must be an
 317  * AP_DNS_LISTENER. */
 318 void
 319 dnsserv_close_listener(connection_t *conn)
 320 {
 321   tor_assert(conn);
 322   tor_assert(conn->type == CONN_TYPE_AP_DNS_LISTENER);
 323
 324   if (conn->dns_server_port) {
 325     evdns_close_server_port(conn->dns_server_port);
 326     conn->dns_server_port = NULL;
 327   }
 328 }
 329