DNS.cpp

   1 #include "DNS.hpp"
   2
   3 #include "DNS-iostream.hpp"
   4 #include "IP4.hpp"
   5 #include "IP6.hpp"
   6 #include "Sock.hpp"
   7
   8 #include <atomic>
   9 #include <limits>
  10 #include <memory>
  11 #include <tuple>
  12
  13 #include <arpa/nameser.h>
  14
  15 #include <glog/logging.h>
  16
  17 #include "osutil.hpp"
  18
  19 DEFINE_bool(log_dns_data, false, "log all DNS TCP protocol data");
  20 DEFINE_bool(random_dns_servers, false, "Pick starting DNS server at random");
  21
  22 namespace Config {
  23 // The default timeout in glibc is 5 seconds.  My setup with unbound
  24 // in front of stubby with DNSSEC checking and all that seems to work
  25 // better with just a little more time.
  26
  27 auto constexpr read_timeout{std::chrono::seconds(11)};
  28 auto constexpr write_timeout{std::chrono::seconds(1)};
  29
  30 enum class sock_type : bool { stream, dgram };
  31
  32 struct nameserver {
  33   char const* host; // name used to match cert
  34   char const* addr;
  35   char const* port;
  36   sock_type   typ;
  37 };
  38
  39 constexpr nameserver nameservers[]{
  40     {
  41         "localhost",
  42         "127.0.0.1",
  43         "domain",
  44         sock_type::stream,
  45     },
  46     /*
  47     {
  48         "one.one.one.one",
  49         "1.1.1.1",
  50         "domain-s",
  51         sock_type::stream,
  52     },
  53     {
  54         "one.one.one.one",
  55         "1.1.1.1",
  56         "domain",
  57         sock_type::dgram,
  58     },
  59     {
  60         "dns.google",
  61         "8.8.8.8",
  62         "domain",
  63         sock_type::dgram,
  64     },
  65     {
  66         "dns.google",
  67         "8.8.4.4",
  68         "domain",
  69         sock_type::dgram,
  70     },
  71
  72     {
  73         "dns.google",
  74         "2001:4860:4860::8888",
  75         "domain",
  76         sock_type::dgram,
  77     },
  78     {
  79         "dns.google",
  80         "2001:4860:4860::8844",
  81         "domain",
  82         sock_type::dgram,
  83     },
  84     {
  85         "1dot1dot1dot1.cloudflare-dns.com",
  86         "1.0.0.1",
  87         "domain-s",
  88         sock_type::stream,
  89     },
  90     {
  91         "1dot1dot1dot1.cloudflare-dns.com",
  92         "2606:4700:4700::1111",
  93         "domain-s",
  94         sock_type::stream,
  95     },
  96     {
  97         "1dot1dot1dot1.cloudflare-dns.com",
  98         "2606:4700:4700::1001",
  99         "domain-s",
 100         sock_type::stream,
 101     },
 102     {
 103         "dns9.quad9.net",
 104         "9.9.9.9",
 105         "domain-s",
 106         sock_type::stream,
 107     },
 108     {
 109         "dns10.quad9.net",
 110         "9.9.9.10",
 111         "domain-s",
 112         sock_type::stream,
 113     },
 114     {
 115         "dns10.quad9.net",
 116         "149.112.112.10",
 117         "domain-s",
 118         sock_type::stream,
 119     },
 120     {
 121         "dns10.quad9.net",
 122         "2620:fe::10",
 123         "domain-s",
 124         sock_type::stream,
 125     },
 126     */
 127 };
 128 } // namespace Config
 129
 130 template <typename T, std::size_t N>
 131 constexpr std::size_t countof(T const (&)[N]) noexcept
 132 {
 133   return N;
 134 }
 135
 136 namespace DNS {
 137
 138 Resolver::Resolver(fs::path config_path)
 139 {
 140   auto tries = countof(Config::nameservers);
 141
 142   if (FLAGS_random_dns_servers) {
 143     std::uniform_int_distribution<int> uniform_dist(
 144         0, countof(Config::nameservers) - 1);
 145     ns_ = uniform_dist(rng_);
 146   }
 147   else {
 148     ns_ = static_cast<int>(countof(Config::nameservers) - 1);
 149   }
 150
 151   while (tries--) {
 152
 153     // try the next one, with wrap
 154     if (++ns_ == countof(Config::nameservers))
 155       ns_ = 0;
 156
 157     auto const& nameserver = Config::nameservers[ns_];
 158     auto typ = (nameserver.typ == Config::sock_type::stream) ? SOCK_STREAM
 159                                                              : SOCK_DGRAM;
 160
 161     uint16_t port =
 162         osutil::get_port(nameserver.port, (typ == SOCK_STREAM) ? "tcp" : "udp");
 163     ns_fd_ = -1;
 164
 165     if (IP4::is_address(nameserver.addr)) {
 166       ns_fd_ = socket(AF_INET, typ, 0);
 167       PCHECK(ns_fd_ >= 0) << "socket() failed";
 168
 169       auto in4{sockaddr_in{}};
 170       in4.sin_family = AF_INET;
 171       in4.sin_port   = htons(port);
 172       CHECK_EQ(inet_pton(AF_INET, nameserver.addr,
 173                          reinterpret_cast<void*>(&in4.sin_addr)),
 174                1);
 175       if (connect(ns_fd_, reinterpret_cast<const sockaddr*>(&in4),
 176                   sizeof(in4))) {
 177         PLOG(INFO) << "connect failed " << nameserver.host << '['
 178                    << nameserver.addr << "]:" << nameserver.port;
 179         close(ns_fd_);
 180         ns_fd_ = -1;
 181         continue;
 182       }
 183     }
 184     else if (IP6::is_address(nameserver.addr)) {
 185       ns_fd_ = socket(AF_INET6, typ, 0);
 186       PCHECK(ns_fd_ >= 0) << "socket() failed";
 187
 188       auto in6{sockaddr_in6{}};
 189       in6.sin6_family = AF_INET6;
 190       in6.sin6_port   = htons(port);
 191       CHECK_EQ(inet_pton(AF_INET6, nameserver.addr,
 192                          reinterpret_cast<void*>(&in6.sin6_addr)),
 193                1);
 194       if (connect(ns_fd_, reinterpret_cast<const sockaddr*>(&in6),
 195                   sizeof(in6))) {
 196         PLOG(INFO) << "connect failed " << nameserver.host << '['
 197                    << nameserver.addr << "]:" << nameserver.port;
 198         close(ns_fd_);
 199         ns_fd_ = -1;
 200         continue;
 201       }
 202     }
 203
 204     POSIX::set_nonblocking(ns_fd_);
 205
 206     if (nameserver.typ == Config::sock_type::stream) {
 207       ns_sock_ = std::make_unique<Sock>(ns_fd_, ns_fd_);
 208       if (FLAGS_log_dns_data) {
 209         ns_sock_->log_data_on();
 210       }
 211       else {
 212         ns_sock_->log_data_off();
 213       }
 214
 215       if (port != 53) {
 216         DNS::RR_collection tlsa_rrs; // empty FIXME!
 217         ns_sock_->starttls_client(config_path, nullptr, nameserver.host,
 218                                   tlsa_rrs, false);
 219         if (ns_sock_->verified()) {
 220           ns_fd_ = -1;
 221           return;
 222         }
 223         close(ns_fd_);
 224         ns_fd_ = -1;
 225         continue;
 226       }
 227       ns_fd_ = -1;
 228     }
 229
 230     return;
 231   }
 232
 233   LOG(FATAL) << "no nameservers left to try";
 234 }
 235
 236 message Resolver::xchg(message const& q)
 237 {
 238   if (Config::nameservers[ns_].typ == Config::sock_type::stream) {
 239     CHECK_EQ(ns_fd_, -1);
 240
 241     auto const sp = static_cast<std::span<DNS::message::octet const>>(q);
 242
 243     uint16_t sz = sp.size();
 244
 245     sz = htons(sz);
 246     ns_sock_->out().write(reinterpret_cast<char const*>(&sz), sizeof sz);
 247     ns_sock_->out().write(reinterpret_cast<char const*>(sp.data()), sp.size());
 248     ns_sock_->out().flush();
 249
 250     sz = 0;
 251     ns_sock_->in().read(reinterpret_cast<char*>(&sz), sizeof sz);
 252     sz = ntohs(sz);
 253
 254     DNS::message::container_t bfr(sz);
 255     ns_sock_->in().read(reinterpret_cast<char*>(bfr.data()), sz);
 256     CHECK_EQ(ns_sock_->in().gcount(), std::streamsize(sz));
 257
 258     if (!ns_sock_->in()) {
 259       LOG(WARNING) << "Resolver::xchg was able to read only "
 260                    << ns_sock_->in().gcount() << " octets";
 261     }
 262
 263     return message{std::move(bfr)};
 264   }
 265
 266   CHECK(Config::nameservers[ns_].typ == Config::sock_type::dgram);
 267   CHECK_GE(ns_fd_, 0);
 268
 269   auto t_o{false};
 270
 271   auto const sp = static_cast<std::span<DNS::message::octet const>>(q);
 272
 273   auto const wrlen =
 274       POSIX::write(ns_fd_, reinterpret_cast<char const*>(sp.data()), sp.size(),
 275                    Config::write_timeout, t_o);
 276   if (wrlen != std::streamsize(sp.size())) {
 277     LOG(WARNING) << "DNS write failed";
 278     return message{0};
 279   }
 280   if (t_o) {
 281     LOG(WARNING) << "DNS write timed out";
 282     return message{0};
 283   }
 284
 285   DNS::message::container_t bfr(Config::max_udp_sz);
 286
 287   auto constexpr hook{[]() {}};
 288   auto const a_rdlen = POSIX::read(ns_fd_, reinterpret_cast<char*>(bfr.data()),
 289                                    bfr.size(), hook, Config::read_timeout, t_o);
 290   if (a_rdlen < 0) {
 291     LOG(WARNING) << "DNS read failed";
 292     return message{0};
 293   }
 294   if (t_o) {
 295     LOG(WARNING) << "DNS read timed out";
 296     return message{0};
 297   }
 298
 299   bfr.resize(a_rdlen); // down from max_udp_sz
 300   bfr.shrink_to_fit();
 301
 302   return message{std::move(bfr)};
 303 }
 304
 305 RR_collection Resolver::get_records(RR_type typ, char const* name)
 306 {
 307   Query q(*this, typ, name);
 308   return q.get_records();
 309 }
 310
 311 std::vector<std::string> Resolver::get_strings(RR_type typ, char const* name)
 312 {
 313   Query q(*this, typ, name);
 314   return q.get_strings();
 315 }
 316
 317 bool Query::xchg_(Resolver& res, uint16_t id)
 318 {
 319   auto tries = 3;
 320
 321   while (tries) {
 322
 323     a_ = res.xchg(q_);
 324
 325     auto const a_sp = static_cast<std::span<DNS::message::octet const>>(a_);
 326
 327     if (!a_sp.size()) {
 328       bogus_or_indeterminate_ = true;
 329       LOG(WARNING) << "no reply from nameserver";
 330       return false;
 331     }
 332
 333     if (a_sp.size() < message::min_sz()) {
 334       bogus_or_indeterminate_ = true;
 335       LOG(WARNING) << "packet too small";
 336       return false;
 337     }
 338
 339     if (a_.id() == id)
 340       break;
 341
 342     LOG(WARNING) << "packet out of order; ids don't match, got " << a_.id()
 343                  << " expecting " << id;
 344     --tries;
 345   }
 346
 347   if (tries)
 348     return true;
 349
 350   bogus_or_indeterminate_ = true;
 351   LOG(WARNING) << "no tries left, giving up";
 352
 353   return false;
 354 }
 355
 356 Query::Query(Resolver& res, RR_type type, char const* name)
 357   : type_(type)
 358 {
 359   uint16_t id  = res.rnd_id();
 360   uint16_t cls = ns_c_in;
 361
 362   q_ = create_question(name, type, cls, id);
 363
 364   if (!xchg_(res, id))
 365     return;
 366
 367   auto const a_sp = static_cast<std::span<DNS::message::octet const>>(a_);
 368
 369   if (a_sp.size() < message::min_sz()) {
 370     bogus_or_indeterminate_ = true;
 371     LOG(INFO) << "bad (or no) reply for " << name << '/' << type;
 372     return;
 373   }
 374
 375   check_answer(nx_domain_, bogus_or_indeterminate_, rcode_, extended_rcode_,
 376                truncation_, authentic_data_, has_record_, q_, a_, type, name);
 377
 378   if (truncation_) {
 379     // if UDP, retry with TCP
 380     bogus_or_indeterminate_ = true;
 381     LOG(INFO) << "truncated answer for " << name << '/' << type;
 382   }
 383 }
 384
 385 RR_collection Query::get_records()
 386 {
 387   if (bogus_or_indeterminate_)
 388     return RR_collection{};
 389
 390   return DNS::get_records(a_, bogus_or_indeterminate_);
 391 }
 392
 393 std::vector<std::string> Query::get_strings()
 394 {
 395   std::vector<std::string> ret;
 396
 397   auto const rr_set = get_records();
 398
 399   for (auto rr : rr_set) {
 400     std::visit(
 401         [&ret, type = type_](auto const& r) {
 402           if (type == r.rr_type()) {
 403             auto const s = r.as_str();
 404             if (s)
 405               ret.push_back(*s);
 406           }
 407         },
 408         rr);
 409   }
 410
 411   return ret;
 412 }
 413
 414 } // namespace DNS