Line data Source code
1 : /* Copyright (c) 2007-2021, The Tor Project, Inc. */
2 : /* See LICENSE for licensing information */
3 :
4 : /**
5 : * \file dnsserv.c
6 : * \brief Implements client-side DNS proxy server code.
7 : *
8 : * When a user enables the DNSPort configuration option to have their local
9 : * Tor client handle DNS requests, this module handles it. It functions as a
10 : * "DNS Server" on the client side, which client applications use.
11 : *
12 : * Inbound DNS requests are represented as entry_connection_t here (since
13 : * that's how Tor represents client-side streams), which are kept associated
14 : * with an evdns_server_request structure as exposed by Libevent's
15 : * evdns code.
16 : *
17 : * Upon receiving a DNS request, libevent calls our evdns_server_callback()
18 : * function here, which causes this module to create an entry_connection_t
19 : * request as appropriate. Later, when that request is answered,
20 : * connection_edge.c calls dnsserv_resolved() so we can finish up and tell the
21 : * DNS client.
22 : **/
23 :
24 : #include "core/or/or.h"
25 : #include "feature/client/dnsserv.h"
26 : #include "app/config/config.h"
27 : #include "core/mainloop/connection.h"
28 : #include "core/or/connection_edge.h"
29 : #include "feature/control/control_events.h"
30 : #include "core/mainloop/mainloop.h"
31 : #include "core/mainloop/netstatus.h"
32 : #include "core/or/policies.h"
33 :
34 : #include "feature/control/control_connection_st.h"
35 : #include "core/or/entry_connection_st.h"
36 : #include "core/or/listener_connection_st.h"
37 : #include "core/or/socks_request_st.h"
38 : #include "lib/evloop/compat_libevent.h"
39 :
40 : #include <event2/dns.h>
41 : #include <event2/dns_compat.h>
42 : /* XXXX this implies we want an improved evdns */
43 : #include <event2/dns_struct.h>
44 :
45 : /** Helper function: called by evdns whenever the client sends a request to our
46 : * DNSPort. We need to eventually answer the request <b>req</b>.
47 : */
48 : static void
49 0 : evdns_server_callback(struct evdns_server_request *req, void *data_)
50 : {
51 0 : const listener_connection_t *listener = data_;
52 0 : entry_connection_t *entry_conn;
53 0 : edge_connection_t *conn;
54 0 : int i = 0;
55 0 : struct evdns_server_question *q = NULL, *supported_q = NULL;
56 0 : struct sockaddr_storage addr;
57 0 : struct sockaddr *sa;
58 0 : int addrlen;
59 0 : tor_addr_t tor_addr;
60 0 : uint16_t port;
61 0 : int err = DNS_ERR_NONE;
62 0 : char *q_name;
63 :
64 0 : tor_assert(req);
65 :
66 0 : log_info(LD_APP, "Got a new DNS request!");
67 :
68 0 : req->flags |= 0x80; /* set RA */
69 :
70 : /* First, check whether the requesting address matches our SOCKSPolicy. */
71 0 : if ((addrlen = evdns_server_request_get_requesting_addr(req,
72 : (struct sockaddr*)&addr, (socklen_t)sizeof(addr))) < 0) {
73 0 : log_warn(LD_APP, "Couldn't get requesting address.");
74 0 : evdns_server_request_respond(req, DNS_ERR_SERVERFAILED);
75 0 : return;
76 : }
77 0 : (void) addrlen;
78 0 : sa = (struct sockaddr*) &addr;
79 0 : if (tor_addr_from_sockaddr(&tor_addr, sa, &port)<0) {
80 0 : log_warn(LD_APP, "Requesting address wasn't recognized.");
81 0 : evdns_server_request_respond(req, DNS_ERR_SERVERFAILED);
82 0 : return;
83 : }
84 :
85 0 : if (!socks_policy_permits_address(&tor_addr)) {
86 0 : log_warn(LD_APP, "Rejecting DNS request from disallowed IP.");
87 0 : evdns_server_request_respond(req, DNS_ERR_REFUSED);
88 0 : return;
89 : }
90 :
91 : /* Now, let's find the first actual question of a type we can answer in this
92 : * DNS request. It makes us a little noncompliant to act like this; we
93 : * should fix that eventually if it turns out to make a difference for
94 : * anybody. */
95 0 : if (req->nquestions == 0) {
96 0 : log_info(LD_APP, "No questions in DNS request; sending back nil reply.");
97 0 : evdns_server_request_respond(req, 0);
98 0 : return;
99 : }
100 0 : if (req->nquestions > 1) {
101 0 : log_info(LD_APP, "Got a DNS request with more than one question; I only "
102 : "handle one question at a time for now. Skipping the extras.");
103 : }
104 0 : for (i = 0; i < req->nquestions; ++i) {
105 0 : if (req->questions[i]->dns_question_class != EVDNS_CLASS_INET)
106 0 : continue;
107 0 : switch (req->questions[i]->type) {
108 0 : case EVDNS_TYPE_A:
109 : case EVDNS_TYPE_AAAA:
110 : case EVDNS_TYPE_PTR:
111 : /* We always pick the first one of these questions, if there is
112 : one. */
113 0 : if (! supported_q)
114 0 : supported_q = req->questions[i];
115 : break;
116 : default:
117 : break;
118 : }
119 : }
120 0 : if (supported_q)
121 0 : q = supported_q;
122 0 : if (!q) {
123 0 : log_info(LD_APP, "None of the questions we got were ones we're willing "
124 : "to support. Sending NOTIMPL.");
125 0 : evdns_server_request_respond(req, DNS_ERR_NOTIMPL);
126 0 : return;
127 : }
128 :
129 : /* Make sure the name isn't too long: This should be impossible, I think. */
130 0 : if (err == DNS_ERR_NONE && strlen(q->name) > MAX_SOCKS_ADDR_LEN-1)
131 0 : err = DNS_ERR_FORMAT;
132 :
133 0 : if (err != DNS_ERR_NONE || !supported_q) {
134 : /* We got an error? There's no question we're willing to answer? Then
135 : * send back an answer immediately; we're done. */
136 0 : evdns_server_request_respond(req, err);
137 0 : return;
138 : }
139 :
140 : /* Make a new dummy AP connection, and attach the request to it. */
141 0 : entry_conn = entry_connection_new(CONN_TYPE_AP, AF_INET);
142 0 : conn = ENTRY_TO_EDGE_CONN(entry_conn);
143 0 : CONNECTION_AP_EXPECT_NONPENDING(entry_conn);
144 0 : TO_CONN(conn)->state = AP_CONN_STATE_RESOLVE_WAIT;
145 0 : conn->is_dns_request = 1;
146 :
147 0 : tor_addr_copy(&TO_CONN(conn)->addr, &tor_addr);
148 0 : TO_CONN(conn)->port = port;
149 0 : TO_CONN(conn)->address = tor_addr_to_str_dup(&tor_addr);
150 :
151 0 : if (q->type == EVDNS_TYPE_A || q->type == EVDNS_TYPE_AAAA ||
152 : q->type == EVDNS_QTYPE_ALL) {
153 0 : entry_conn->socks_request->command = SOCKS_COMMAND_RESOLVE;
154 : } else {
155 0 : tor_assert(q->type == EVDNS_TYPE_PTR);
156 0 : entry_conn->socks_request->command = SOCKS_COMMAND_RESOLVE_PTR;
157 : }
158 :
159 : /* This serves our DNS port so enable DNS request by default. */
160 0 : entry_conn->entry_cfg.dns_request = 1;
161 0 : if (q->type == EVDNS_TYPE_A || q->type == EVDNS_QTYPE_ALL) {
162 0 : entry_conn->entry_cfg.ipv4_traffic = 1;
163 0 : entry_conn->entry_cfg.ipv6_traffic = 0;
164 0 : entry_conn->entry_cfg.prefer_ipv6 = 0;
165 0 : } else if (q->type == EVDNS_TYPE_AAAA) {
166 0 : entry_conn->entry_cfg.ipv4_traffic = 0;
167 0 : entry_conn->entry_cfg.ipv6_traffic = 1;
168 0 : entry_conn->entry_cfg.prefer_ipv6 = 1;
169 : }
170 :
171 0 : strlcpy(entry_conn->socks_request->address, q->name,
172 : sizeof(entry_conn->socks_request->address));
173 :
174 0 : entry_conn->socks_request->listener_type = listener->base_.type;
175 0 : entry_conn->dns_server_request = req;
176 0 : entry_conn->entry_cfg.isolation_flags = listener->entry_cfg.isolation_flags;
177 0 : entry_conn->entry_cfg.session_group = listener->entry_cfg.session_group;
178 0 : entry_conn->nym_epoch = get_signewnym_epoch();
179 :
180 0 : if (connection_add(ENTRY_TO_CONN(entry_conn)) < 0) {
181 0 : log_warn(LD_APP, "Couldn't register dummy connection for DNS request");
182 0 : evdns_server_request_respond(req, DNS_ERR_SERVERFAILED);
183 0 : connection_free_(ENTRY_TO_CONN(entry_conn));
184 0 : return;
185 : }
186 :
187 0 : control_event_stream_status(entry_conn, STREAM_EVENT_NEW_RESOLVE, 0);
188 :
189 : /* Now, unless a controller asked us to leave streams unattached,
190 : * throw the connection over to get rewritten (which will
191 : * answer it immediately if it's in the cache, or completely bogus, or
192 : * automapped), and then attached to a circuit. */
193 0 : log_info(LD_APP, "Passing request for %s to rewrite_and_attach.",
194 : escaped_safe_str_client(q->name));
195 0 : q_name = tor_strdup(q->name); /* q could be freed in rewrite_and_attach */
196 0 : connection_ap_rewrite_and_attach_if_allowed(entry_conn, NULL, NULL);
197 : /* Now, the connection is marked if it was bad. */
198 :
199 0 : log_info(LD_APP, "Passed request for %s to rewrite_and_attach_if_allowed.",
200 : escaped_safe_str_client(q_name));
201 0 : tor_free(q_name);
202 : }
203 :
204 : /** Helper function: called whenever the client sends a resolve request to our
205 : * controller. We need to eventually answer the request <b>req</b>.
206 : * Returns 0 if the controller will be getting (or has gotten) an event in
207 : * response; -1 if we couldn't launch the request.
208 : */
209 : int
210 0 : dnsserv_launch_request(const char *name, int reverse,
211 : control_connection_t *control_conn)
212 : {
213 0 : entry_connection_t *entry_conn;
214 0 : edge_connection_t *conn;
215 0 : char *q_name;
216 :
217 : /* Launching a request for a user counts as user activity. */
218 0 : note_user_activity(approx_time());
219 :
220 : /* Make a new dummy AP connection, and attach the request to it. */
221 0 : entry_conn = entry_connection_new(CONN_TYPE_AP, AF_INET);
222 0 : entry_conn->entry_cfg.dns_request = 1;
223 0 : conn = ENTRY_TO_EDGE_CONN(entry_conn);
224 0 : CONNECTION_AP_EXPECT_NONPENDING(entry_conn);
225 0 : conn->base_.state = AP_CONN_STATE_RESOLVE_WAIT;
226 :
227 0 : tor_addr_copy(&TO_CONN(conn)->addr, &control_conn->base_.addr);
228 : #ifdef AF_UNIX
229 : /*
230 : * The control connection can be AF_UNIX and if so tor_addr_to_str_dup will
231 : * unhelpfully say "<unknown address type>"; say "(Tor_internal)"
232 : * instead.
233 : */
234 0 : if (control_conn->base_.socket_family == AF_UNIX) {
235 0 : TO_CONN(conn)->port = 0;
236 0 : TO_CONN(conn)->address = tor_strdup("(Tor_internal)");
237 : } else {
238 0 : TO_CONN(conn)->port = control_conn->base_.port;
239 0 : TO_CONN(conn)->address = tor_addr_to_str_dup(&control_conn->base_.addr);
240 : }
241 : #else /* !defined(AF_UNIX) */
242 : TO_CONN(conn)->port = control_conn->base_.port;
243 : TO_CONN(conn)->address = tor_addr_to_str_dup(&control_conn->base_.addr);
244 : #endif /* defined(AF_UNIX) */
245 :
246 0 : if (reverse)
247 0 : entry_conn->socks_request->command = SOCKS_COMMAND_RESOLVE_PTR;
248 : else
249 0 : entry_conn->socks_request->command = SOCKS_COMMAND_RESOLVE;
250 :
251 0 : conn->is_dns_request = 1;
252 :
253 0 : strlcpy(entry_conn->socks_request->address, name,
254 : sizeof(entry_conn->socks_request->address));
255 :
256 0 : entry_conn->socks_request->listener_type = CONN_TYPE_CONTROL_LISTENER;
257 0 : entry_conn->original_dest_address = tor_strdup(name);
258 0 : entry_conn->entry_cfg.session_group = SESSION_GROUP_CONTROL_RESOLVE;
259 0 : entry_conn->nym_epoch = get_signewnym_epoch();
260 0 : entry_conn->entry_cfg.isolation_flags = ISO_DEFAULT;
261 :
262 0 : if (connection_add(TO_CONN(conn))<0) {
263 0 : log_warn(LD_APP, "Couldn't register dummy connection for RESOLVE request");
264 0 : connection_free_(TO_CONN(conn));
265 0 : return -1;
266 : }
267 :
268 0 : control_event_stream_status(entry_conn, STREAM_EVENT_NEW_RESOLVE, 0);
269 :
270 : /* Now, unless a controller asked us to leave streams unattached,
271 : * throw the connection over to get rewritten (which will
272 : * answer it immediately if it's in the cache, or completely bogus, or
273 : * automapped), and then attached to a circuit. */
274 0 : log_info(LD_APP, "Passing request for %s to rewrite_and_attach.",
275 : escaped_safe_str_client(name));
276 0 : q_name = tor_strdup(name); /* q could be freed in rewrite_and_attach */
277 0 : connection_ap_rewrite_and_attach_if_allowed(entry_conn, NULL, NULL);
278 : /* Now, the connection is marked if it was bad. */
279 :
280 0 : log_info(LD_APP, "Passed request for %s to rewrite_and_attach_if_allowed.",
281 : escaped_safe_str_client(q_name));
282 0 : tor_free(q_name);
283 0 : return 0;
284 : }
285 :
286 : /** If there is a pending request on <b>conn</b> that's waiting for an answer,
287 : * send back an error and free the request. */
288 : void
289 0 : dnsserv_reject_request(entry_connection_t *conn)
290 : {
291 0 : if (conn->dns_server_request) {
292 0 : evdns_server_request_respond(conn->dns_server_request,
293 : DNS_ERR_SERVERFAILED);
294 0 : conn->dns_server_request = NULL;
295 : }
296 0 : }
297 :
298 : /** Look up the original name that corresponds to 'addr' in req. We use this
299 : * to preserve case in order to facilitate clients using 0x20-hacks to avoid
300 : * DNS poisoning. */
301 : static const char *
302 0 : evdns_get_orig_address(const struct evdns_server_request *req,
303 : int rtype, const char *addr)
304 : {
305 0 : int i, type;
306 :
307 0 : switch (rtype) {
308 : case RESOLVED_TYPE_IPV4:
309 : type = EVDNS_TYPE_A;
310 : break;
311 0 : case RESOLVED_TYPE_HOSTNAME:
312 0 : type = EVDNS_TYPE_PTR;
313 0 : break;
314 0 : case RESOLVED_TYPE_IPV6:
315 0 : type = EVDNS_TYPE_AAAA;
316 0 : break;
317 : case RESOLVED_TYPE_ERROR:
318 : case RESOLVED_TYPE_ERROR_TRANSIENT:
319 : /* Addr doesn't matter, since we're not sending it back in the reply.*/
320 : return addr;
321 0 : default:
322 0 : tor_fragile_assert();
323 : return addr;
324 : }
325 :
326 0 : for (i = 0; i < req->nquestions; ++i) {
327 0 : const struct evdns_server_question *q = req->questions[i];
328 0 : if (q->type == type && !strcasecmp(q->name, addr))
329 0 : return q->name;
330 : }
331 : return addr;
332 : }
333 :
334 : /** Tell the dns request waiting for an answer on <b>conn</b> that we have an
335 : * answer of type <b>answer_type</b> (RESOLVE_TYPE_IPV4/IPV6/ERR), of length
336 : * <b>answer_len</b>, in <b>answer</b>, with TTL <b>ttl</b>. Doesn't do
337 : * any caching; that's handled elsewhere. */
338 : void
339 0 : dnsserv_resolved(entry_connection_t *conn,
340 : int answer_type,
341 : size_t answer_len,
342 : const char *answer,
343 : int ttl)
344 : {
345 0 : struct evdns_server_request *req = conn->dns_server_request;
346 0 : const char *name;
347 0 : int err = DNS_ERR_NONE;
348 0 : if (!req)
349 : return;
350 0 : name = evdns_get_orig_address(req, answer_type,
351 0 : conn->socks_request->address);
352 :
353 : /* XXXX Re-do; this is dumb. */
354 0 : if (ttl < 60)
355 : ttl = 60;
356 :
357 : /* The evdns interface is: add a bunch of reply items (corresponding to one
358 : * or more of the questions in the request); then, call
359 : * evdns_server_request_respond. */
360 0 : if (answer_type == RESOLVED_TYPE_IPV6) {
361 0 : evdns_server_request_add_aaaa_reply(req,
362 : name,
363 : 1, answer, ttl);
364 0 : } else if (answer_type == RESOLVED_TYPE_IPV4 && answer_len == 4 &&
365 0 : conn->socks_request->command == SOCKS_COMMAND_RESOLVE) {
366 0 : evdns_server_request_add_a_reply(req,
367 : name,
368 : 1, answer, ttl);
369 0 : } else if (answer_type == RESOLVED_TYPE_HOSTNAME &&
370 0 : answer_len < 256 &&
371 0 : conn->socks_request->command == SOCKS_COMMAND_RESOLVE_PTR) {
372 0 : char *ans = tor_strndup(answer, answer_len);
373 0 : evdns_server_request_add_ptr_reply(req, NULL,
374 : name,
375 : ans, ttl);
376 0 : tor_free(ans);
377 0 : } else if (answer_type == RESOLVED_TYPE_ERROR) {
378 : err = DNS_ERR_NOTEXIST;
379 : } else { /* answer_type == RESOLVED_TYPE_ERROR_TRANSIENT */
380 0 : err = DNS_ERR_SERVERFAILED;
381 : }
382 :
383 0 : evdns_server_request_respond(req, err);
384 :
385 0 : conn->dns_server_request = NULL;
386 : }
387 :
388 : /** Set up the evdns server port for the UDP socket on <b>conn</b>, which
389 : * must be an AP_DNS_LISTENER */
390 : void
391 0 : dnsserv_configure_listener(connection_t *conn)
392 : {
393 0 : listener_connection_t *listener_conn;
394 0 : tor_assert(conn);
395 0 : tor_assert(SOCKET_OK(conn->s));
396 0 : tor_assert(conn->type == CONN_TYPE_AP_DNS_LISTENER);
397 :
398 0 : listener_conn = TO_LISTENER_CONN(conn);
399 0 : listener_conn->dns_server_port =
400 0 : tor_evdns_add_server_port(conn->s, 0, evdns_server_callback,
401 0 : listener_conn);
402 0 : }
403 :
404 : /** Free the evdns server port for <b>conn</b>, which must be an
405 : * AP_DNS_LISTENER. */
406 : void
407 0 : dnsserv_close_listener(connection_t *conn)
408 : {
409 0 : listener_connection_t *listener_conn;
410 0 : tor_assert(conn);
411 0 : tor_assert(conn->type == CONN_TYPE_AP_DNS_LISTENER);
412 :
413 0 : listener_conn = TO_LISTENER_CONN(conn);
414 :
415 0 : if (listener_conn->dns_server_port) {
416 0 : evdns_close_server_port(listener_conn->dns_server_port);
417 0 : listener_conn->dns_server_port = NULL;
418 : }
419 0 : }
|
