2020-05-08 15:39:37 +00:00
|
|
|
package dnsforward
|
|
|
|
|
|
|
|
import (
|
2020-08-18 09:36:52 +00:00
|
|
|
"net"
|
2020-06-23 09:13:13 +00:00
|
|
|
"strings"
|
2020-05-08 15:39:37 +00:00
|
|
|
"time"
|
|
|
|
|
2021-03-31 12:00:47 +00:00
|
|
|
"github.com/AdguardTeam/AdGuardHome/internal/aghnet"
|
2020-10-30 10:32:02 +00:00
|
|
|
"github.com/AdguardTeam/AdGuardHome/internal/dhcpd"
|
|
|
|
"github.com/AdguardTeam/AdGuardHome/internal/dnsfilter"
|
2020-05-08 15:39:37 +00:00
|
|
|
"github.com/AdguardTeam/dnsproxy/proxy"
|
|
|
|
"github.com/AdguardTeam/golibs/log"
|
|
|
|
"github.com/miekg/dns"
|
|
|
|
)
|
|
|
|
|
|
|
|
// To transfer information between modules
|
|
|
|
type dnsContext struct {
|
2021-03-25 13:00:27 +00:00
|
|
|
// TODO(a.garipov): Remove this and rewrite processors to be methods of
|
|
|
|
// *Server instead.
|
2021-01-27 15:32:13 +00:00
|
|
|
srv *Server
|
|
|
|
proxyCtx *proxy.DNSContext
|
|
|
|
// setts are the filtering settings for the client.
|
2021-03-25 17:30:30 +00:00
|
|
|
setts *dnsfilter.FilteringSettings
|
2021-01-27 15:32:13 +00:00
|
|
|
startTime time.Time
|
|
|
|
result *dnsfilter.Result
|
|
|
|
// origResp is the response received from upstream. It is set when the
|
|
|
|
// response is modified by filters.
|
|
|
|
origResp *dns.Msg
|
2021-03-31 12:00:47 +00:00
|
|
|
// unreversedReqIP stores an IP address obtained from PTR request if it
|
|
|
|
// was successfully parsed.
|
|
|
|
unreversedReqIP net.IP
|
2021-01-27 15:32:13 +00:00
|
|
|
// err is the error returned from a processing function.
|
|
|
|
err error
|
|
|
|
// clientID is the clientID from DOH, DOQ, or DOT, if provided.
|
|
|
|
clientID string
|
|
|
|
// origQuestion is the question received from the client. It is set
|
|
|
|
// when the request is modified by rewrites.
|
|
|
|
origQuestion dns.Question
|
|
|
|
// protectionEnabled shows if the filtering is enabled, and if the
|
|
|
|
// server's DNS filter is ready.
|
|
|
|
protectionEnabled bool
|
|
|
|
// responseFromUpstream shows if the response is received from the
|
|
|
|
// upstream servers.
|
|
|
|
responseFromUpstream bool
|
|
|
|
// origReqDNSSEC shows if the DNSSEC flag in the original request from
|
|
|
|
// the client is set.
|
|
|
|
origReqDNSSEC bool
|
2021-04-08 15:07:29 +00:00
|
|
|
// isLocalClient shows if client's IP address is from locally-served
|
|
|
|
// network.
|
|
|
|
isLocalClient bool
|
2020-05-08 15:39:37 +00:00
|
|
|
}
|
|
|
|
|
2021-01-27 15:32:13 +00:00
|
|
|
// resultCode is the result of a request processing function.
|
|
|
|
type resultCode int
|
|
|
|
|
2020-05-08 15:39:37 +00:00
|
|
|
const (
|
2021-01-27 15:32:13 +00:00
|
|
|
// resultCodeSuccess is returned when a handler performed successfully,
|
|
|
|
// and the next handler must be called.
|
|
|
|
resultCodeSuccess resultCode = iota
|
|
|
|
// resultCodeFinish is returned when a handler performed successfully,
|
|
|
|
// and the processing of the request must be stopped.
|
|
|
|
resultCodeFinish
|
|
|
|
// resultCodeError is returned when a handler failed, and the processing
|
|
|
|
// of the request must be stopped.
|
|
|
|
resultCodeError
|
2020-05-08 15:39:37 +00:00
|
|
|
)
|
|
|
|
|
|
|
|
// handleDNSRequest filters the incoming DNS requests and writes them to the query log
|
2020-05-13 17:31:43 +00:00
|
|
|
func (s *Server) handleDNSRequest(_ *proxy.Proxy, d *proxy.DNSContext) error {
|
2021-01-27 15:32:13 +00:00
|
|
|
ctx := &dnsContext{
|
|
|
|
srv: s,
|
|
|
|
proxyCtx: d,
|
|
|
|
result: &dnsfilter.Result{},
|
|
|
|
startTime: time.Now(),
|
|
|
|
}
|
2020-05-08 15:39:37 +00:00
|
|
|
|
2021-01-27 15:32:13 +00:00
|
|
|
type modProcessFunc func(ctx *dnsContext) (rc resultCode)
|
2020-12-28 16:26:37 +00:00
|
|
|
|
|
|
|
// Since (*dnsforward.Server).handleDNSRequest(...) is used as
|
|
|
|
// proxy.(Config).RequestHandler, there is no need for additional index
|
|
|
|
// out of range checking in any of the following functions, because the
|
|
|
|
// (*proxy.Proxy).handleDNSRequest method performs it before calling the
|
|
|
|
// appropriate handler.
|
2020-05-08 15:39:37 +00:00
|
|
|
mods := []modProcessFunc{
|
|
|
|
processInitial,
|
2021-04-08 15:07:29 +00:00
|
|
|
s.processDetermineLocal,
|
2021-03-25 13:00:27 +00:00
|
|
|
s.processInternalHosts,
|
2021-03-31 12:00:47 +00:00
|
|
|
s.processRestrictLocal,
|
|
|
|
s.processInternalIPAddrs,
|
2021-01-27 15:32:13 +00:00
|
|
|
processClientID,
|
2020-05-08 15:39:37 +00:00
|
|
|
processFilteringBeforeRequest,
|
2021-03-31 12:00:47 +00:00
|
|
|
s.processLocalPTR,
|
2020-05-08 15:39:37 +00:00
|
|
|
processUpstream,
|
|
|
|
processDNSSECAfterResponse,
|
|
|
|
processFilteringAfterResponse,
|
2020-09-02 11:13:45 +00:00
|
|
|
s.ipset.process,
|
2020-05-08 15:39:37 +00:00
|
|
|
processQueryLogsAndStats,
|
|
|
|
}
|
|
|
|
for _, process := range mods {
|
|
|
|
r := process(ctx)
|
|
|
|
switch r {
|
2021-01-27 15:32:13 +00:00
|
|
|
case resultCodeSuccess:
|
2020-05-08 15:39:37 +00:00
|
|
|
// continue: call the next filter
|
|
|
|
|
2021-01-27 15:32:13 +00:00
|
|
|
case resultCodeFinish:
|
2020-05-08 15:39:37 +00:00
|
|
|
return nil
|
|
|
|
|
2021-01-27 15:32:13 +00:00
|
|
|
case resultCodeError:
|
2020-05-08 15:39:37 +00:00
|
|
|
return ctx.err
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
if d.Res != nil {
|
|
|
|
d.Res.Compress = true // some devices require DNS message compression
|
|
|
|
}
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// Perform initial checks; process WHOIS & rDNS
|
2021-01-27 15:32:13 +00:00
|
|
|
func processInitial(ctx *dnsContext) (rc resultCode) {
|
2020-05-08 15:39:37 +00:00
|
|
|
s := ctx.srv
|
|
|
|
d := ctx.proxyCtx
|
|
|
|
if s.conf.AAAADisabled && d.Req.Question[0].Qtype == dns.TypeAAAA {
|
|
|
|
_ = proxy.CheckDisabledAAAARequest(d, true)
|
2021-01-27 15:32:13 +00:00
|
|
|
return resultCodeFinish
|
2020-05-08 15:39:37 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
if s.conf.OnDNSRequest != nil {
|
|
|
|
s.conf.OnDNSRequest(d)
|
|
|
|
}
|
|
|
|
|
|
|
|
// disable Mozilla DoH
|
2020-10-02 09:51:55 +00:00
|
|
|
// https://support.mozilla.org/en-US/kb/canary-domain-use-application-dnsnet
|
2020-05-08 15:39:37 +00:00
|
|
|
if (d.Req.Question[0].Qtype == dns.TypeA || d.Req.Question[0].Qtype == dns.TypeAAAA) &&
|
|
|
|
d.Req.Question[0].Name == "use-application-dns.net." {
|
2020-10-02 09:51:55 +00:00
|
|
|
d.Res = s.genNXDomain(d.Req)
|
2021-01-27 15:32:13 +00:00
|
|
|
return resultCodeFinish
|
2020-05-08 15:39:37 +00:00
|
|
|
}
|
|
|
|
|
2021-01-27 15:32:13 +00:00
|
|
|
return resultCodeSuccess
|
2020-05-08 15:39:37 +00:00
|
|
|
}
|
|
|
|
|
2020-08-18 14:40:36 +00:00
|
|
|
// Return TRUE if host names doesn't contain disallowed characters
|
|
|
|
func isHostnameOK(hostname string) bool {
|
|
|
|
for _, c := range hostname {
|
|
|
|
if !((c >= 'a' && c <= 'z') ||
|
|
|
|
(c >= 'A' && c <= 'Z') ||
|
|
|
|
(c >= '0' && c <= '9') ||
|
|
|
|
c == '.' || c == '-') {
|
2021-03-25 13:00:27 +00:00
|
|
|
log.Debug("dns: skipping invalid hostname %s from DHCP", hostname)
|
2020-08-18 14:40:36 +00:00
|
|
|
return false
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return true
|
|
|
|
}
|
|
|
|
|
2020-06-23 09:13:13 +00:00
|
|
|
func (s *Server) onDHCPLeaseChanged(flags int) {
|
|
|
|
switch flags {
|
|
|
|
case dhcpd.LeaseChangedAdded,
|
|
|
|
dhcpd.LeaseChangedAddedStatic,
|
|
|
|
dhcpd.LeaseChangedRemovedStatic:
|
|
|
|
//
|
|
|
|
default:
|
|
|
|
return
|
|
|
|
}
|
|
|
|
|
2020-08-18 09:36:52 +00:00
|
|
|
hostToIP := make(map[string]net.IP)
|
2020-06-23 09:13:13 +00:00
|
|
|
m := make(map[string]string)
|
2020-08-18 09:36:52 +00:00
|
|
|
|
2020-06-23 09:13:13 +00:00
|
|
|
ll := s.dhcpServer.Leases(dhcpd.LeasesAll)
|
2020-08-18 09:36:52 +00:00
|
|
|
|
2020-06-23 09:13:13 +00:00
|
|
|
for _, l := range ll {
|
2020-08-18 14:40:36 +00:00
|
|
|
if len(l.Hostname) == 0 || !isHostnameOK(l.Hostname) {
|
2020-06-23 09:13:13 +00:00
|
|
|
continue
|
|
|
|
}
|
2020-08-18 09:36:52 +00:00
|
|
|
|
2020-08-18 14:40:36 +00:00
|
|
|
lowhost := strings.ToLower(l.Hostname)
|
|
|
|
|
|
|
|
m[l.IP.String()] = lowhost
|
2020-08-18 09:36:52 +00:00
|
|
|
|
|
|
|
ip := make(net.IP, 4)
|
|
|
|
copy(ip, l.IP.To4())
|
2020-08-18 14:40:36 +00:00
|
|
|
hostToIP[lowhost] = ip
|
2020-06-23 09:13:13 +00:00
|
|
|
}
|
2020-08-18 09:36:52 +00:00
|
|
|
|
2021-03-25 13:00:27 +00:00
|
|
|
log.Debug("dns: added %d A/PTR entries from DHCP", len(m))
|
2020-08-18 09:36:52 +00:00
|
|
|
|
|
|
|
s.tableHostToIPLock.Lock()
|
|
|
|
s.tableHostToIP = hostToIP
|
|
|
|
s.tableHostToIPLock.Unlock()
|
|
|
|
|
2020-06-23 09:13:13 +00:00
|
|
|
s.tablePTRLock.Lock()
|
|
|
|
s.tablePTR = m
|
|
|
|
s.tablePTRLock.Unlock()
|
|
|
|
}
|
|
|
|
|
2021-04-08 15:07:29 +00:00
|
|
|
// processDetermineLocal determines if the client's IP address is from
|
|
|
|
// locally-served network and saves the result into the context.
|
|
|
|
func (s *Server) processDetermineLocal(dctx *dnsContext) (rc resultCode) {
|
|
|
|
rc = resultCodeSuccess
|
|
|
|
|
|
|
|
var ip net.IP
|
|
|
|
if ip = IPFromAddr(dctx.proxyCtx.Addr); ip == nil {
|
|
|
|
return rc
|
|
|
|
}
|
|
|
|
|
|
|
|
dctx.isLocalClient = s.subnetDetector.IsLocallyServedNetwork(ip)
|
|
|
|
|
|
|
|
return rc
|
|
|
|
}
|
|
|
|
|
2021-03-31 12:00:47 +00:00
|
|
|
// hostToIP tries to get an IP leased by DHCP and returns the copy of address
|
|
|
|
// since the data inside the internal table may be changed while request
|
|
|
|
// processing. It's safe for concurrent use.
|
|
|
|
func (s *Server) hostToIP(host string) (ip net.IP, ok bool) {
|
|
|
|
s.tableHostToIPLock.Lock()
|
|
|
|
defer s.tableHostToIPLock.Unlock()
|
|
|
|
|
|
|
|
if s.tableHostToIP == nil {
|
|
|
|
return nil, false
|
|
|
|
}
|
|
|
|
|
|
|
|
var ipFromTable net.IP
|
|
|
|
ipFromTable, ok = s.tableHostToIP[host]
|
|
|
|
if !ok {
|
|
|
|
return nil, false
|
|
|
|
}
|
|
|
|
|
|
|
|
ip = make(net.IP, len(ipFromTable))
|
|
|
|
copy(ip, ipFromTable)
|
|
|
|
|
|
|
|
return ip, true
|
|
|
|
}
|
|
|
|
|
2021-03-25 13:00:27 +00:00
|
|
|
// processInternalHosts respond to A requests if the target hostname is known to
|
|
|
|
// the server.
|
|
|
|
//
|
|
|
|
// TODO(a.garipov): Adapt to AAAA as well.
|
|
|
|
func (s *Server) processInternalHosts(dctx *dnsContext) (rc resultCode) {
|
|
|
|
req := dctx.proxyCtx.Req
|
|
|
|
q := req.Question[0]
|
2021-03-25 14:21:00 +00:00
|
|
|
|
|
|
|
// Go on processing the AAAA request despite the fact that we don't
|
|
|
|
// support it yet. The expected behavior here is to respond with an
|
|
|
|
// empty asnwer and not NXDOMAIN.
|
|
|
|
if q.Qtype != dns.TypeA && q.Qtype != dns.TypeAAAA {
|
2021-01-27 15:32:13 +00:00
|
|
|
return resultCodeSuccess
|
2020-08-18 09:36:52 +00:00
|
|
|
}
|
|
|
|
|
2021-03-25 13:00:27 +00:00
|
|
|
reqHost := strings.ToLower(q.Name)
|
|
|
|
host := strings.TrimSuffix(reqHost, s.autohostSuffix)
|
|
|
|
if host == reqHost {
|
2021-01-27 15:32:13 +00:00
|
|
|
return resultCodeSuccess
|
2020-08-18 09:36:52 +00:00
|
|
|
}
|
|
|
|
|
2021-04-08 15:07:29 +00:00
|
|
|
d := dctx.proxyCtx
|
|
|
|
if !dctx.isLocalClient {
|
|
|
|
log.Debug("dns: %q requests for internal host", d.Addr)
|
|
|
|
d.Res = s.genNXDomain(req)
|
|
|
|
|
|
|
|
// Do not even put into query log.
|
|
|
|
return resultCodeFinish
|
|
|
|
}
|
2021-03-31 12:00:47 +00:00
|
|
|
|
|
|
|
ip, ok := s.hostToIP(host)
|
2020-08-18 09:36:52 +00:00
|
|
|
if !ok {
|
2021-04-08 15:07:29 +00:00
|
|
|
// TODO(e.burkov): Inspect special cases when user want to apply
|
|
|
|
// some rules handled by other processors to the hosts with TLD.
|
|
|
|
d.Res = s.genNXDomain(req)
|
|
|
|
|
|
|
|
return resultCodeFinish
|
2020-08-18 09:36:52 +00:00
|
|
|
}
|
|
|
|
|
2021-03-25 13:00:27 +00:00
|
|
|
log.Debug("dns: internal record: %s -> %s", q.Name, ip)
|
2020-08-18 09:36:52 +00:00
|
|
|
|
|
|
|
resp := s.makeResponse(req)
|
2021-03-25 13:00:27 +00:00
|
|
|
if q.Qtype == dns.TypeA {
|
|
|
|
a := &dns.A{
|
|
|
|
Hdr: s.hdr(req, dns.TypeA),
|
2021-03-31 12:00:47 +00:00
|
|
|
A: ip,
|
2020-08-18 09:36:52 +00:00
|
|
|
}
|
|
|
|
resp.Answer = append(resp.Answer, a)
|
|
|
|
}
|
2021-03-25 13:00:27 +00:00
|
|
|
dctx.proxyCtx.Res = resp
|
|
|
|
|
2021-01-27 15:32:13 +00:00
|
|
|
return resultCodeSuccess
|
|
|
|
}
|
|
|
|
|
2021-04-08 15:07:29 +00:00
|
|
|
// processRestrictLocal responds with NXDOMAIN to PTR requests for IP addresses
|
|
|
|
// in locally-served network from external clients.
|
2021-03-31 12:00:47 +00:00
|
|
|
func (s *Server) processRestrictLocal(ctx *dnsContext) (rc resultCode) {
|
|
|
|
d := ctx.proxyCtx
|
|
|
|
req := d.Req
|
|
|
|
q := req.Question[0]
|
|
|
|
if q.Qtype != dns.TypePTR {
|
|
|
|
// No need for restriction.
|
2021-01-27 15:32:13 +00:00
|
|
|
return resultCodeSuccess
|
2020-06-23 09:13:13 +00:00
|
|
|
}
|
|
|
|
|
2021-03-31 12:00:47 +00:00
|
|
|
ip := aghnet.UnreverseAddr(q.Name)
|
2020-06-23 09:13:13 +00:00
|
|
|
if ip == nil {
|
2021-03-31 12:00:47 +00:00
|
|
|
// That's weird.
|
|
|
|
//
|
|
|
|
// TODO(e.burkov): Research the cases when it could happen.
|
2021-01-27 15:32:13 +00:00
|
|
|
return resultCodeSuccess
|
2020-06-23 09:13:13 +00:00
|
|
|
}
|
|
|
|
|
2021-03-31 12:00:47 +00:00
|
|
|
// Restrict an access to local addresses for external clients. We also
|
|
|
|
// assume that all the DHCP leases we give are locally-served or at
|
|
|
|
// least don't need to be unaccessable externally.
|
|
|
|
if s.subnetDetector.IsLocallyServedNetwork(ip) {
|
2021-04-08 15:07:29 +00:00
|
|
|
if !ctx.isLocalClient {
|
|
|
|
log.Debug("dns: %q requests for internal ip", d.Addr)
|
|
|
|
d.Res = s.genNXDomain(req)
|
2021-03-31 12:00:47 +00:00
|
|
|
|
|
|
|
// Do not even put into query log.
|
|
|
|
return resultCodeFinish
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// Do not perform unreversing ever again.
|
|
|
|
ctx.unreversedReqIP = ip
|
|
|
|
|
2021-04-07 17:16:06 +00:00
|
|
|
// Disable redundant filtering.
|
|
|
|
filterSetts := s.getClientRequestFilteringSettings(ctx)
|
|
|
|
filterSetts.ParentalEnabled = false
|
|
|
|
filterSetts.SafeBrowsingEnabled = false
|
|
|
|
filterSetts.SafeSearchEnabled = false
|
|
|
|
filterSetts.ServicesRules = nil
|
|
|
|
ctx.setts = filterSetts
|
|
|
|
|
2021-03-31 12:00:47 +00:00
|
|
|
// Nothing to restrict.
|
|
|
|
return resultCodeSuccess
|
|
|
|
}
|
|
|
|
|
|
|
|
// ipToHost tries to get a hostname leased by DHCP. It's safe for concurrent
|
|
|
|
// use.
|
|
|
|
func (s *Server) ipToHost(ip net.IP) (host string, ok bool) {
|
2020-06-23 09:13:13 +00:00
|
|
|
s.tablePTRLock.Lock()
|
2021-03-31 12:00:47 +00:00
|
|
|
defer s.tablePTRLock.Unlock()
|
|
|
|
|
2020-06-23 09:13:13 +00:00
|
|
|
if s.tablePTR == nil {
|
2021-03-31 12:00:47 +00:00
|
|
|
return "", false
|
|
|
|
}
|
|
|
|
|
|
|
|
host, ok = s.tablePTR[ip.String()]
|
|
|
|
|
|
|
|
return host, ok
|
|
|
|
}
|
|
|
|
|
|
|
|
// Respond to PTR requests if the target IP is leased by our DHCP server and the
|
|
|
|
// requestor is inside the local network.
|
|
|
|
func (s *Server) processInternalIPAddrs(ctx *dnsContext) (rc resultCode) {
|
|
|
|
d := ctx.proxyCtx
|
|
|
|
if d.Res != nil {
|
2021-01-27 15:32:13 +00:00
|
|
|
return resultCodeSuccess
|
2020-06-23 09:13:13 +00:00
|
|
|
}
|
2021-03-31 12:00:47 +00:00
|
|
|
|
|
|
|
ip := ctx.unreversedReqIP
|
|
|
|
if ip == nil {
|
|
|
|
return resultCodeSuccess
|
|
|
|
}
|
|
|
|
|
|
|
|
host, ok := s.ipToHost(ip)
|
2020-06-23 09:13:13 +00:00
|
|
|
if !ok {
|
2021-01-27 15:32:13 +00:00
|
|
|
return resultCodeSuccess
|
2020-06-23 09:13:13 +00:00
|
|
|
}
|
|
|
|
|
2021-03-31 12:00:47 +00:00
|
|
|
log.Debug("dns: reverse-lookup: %s -> %s", ip, host)
|
2020-06-23 09:13:13 +00:00
|
|
|
|
2021-03-31 12:00:47 +00:00
|
|
|
req := d.Req
|
2020-06-23 09:13:13 +00:00
|
|
|
resp := s.makeResponse(req)
|
2021-03-31 12:00:47 +00:00
|
|
|
ptr := &dns.PTR{
|
|
|
|
Hdr: dns.RR_Header{
|
|
|
|
Name: req.Question[0].Name,
|
|
|
|
Rrtype: dns.TypePTR,
|
|
|
|
Ttl: s.conf.BlockedResponseTTL,
|
|
|
|
Class: dns.ClassINET,
|
|
|
|
},
|
|
|
|
Ptr: dns.Fqdn(host),
|
2020-06-23 09:13:13 +00:00
|
|
|
}
|
|
|
|
resp.Answer = append(resp.Answer, ptr)
|
2021-03-31 12:00:47 +00:00
|
|
|
d.Res = resp
|
|
|
|
|
|
|
|
return resultCodeSuccess
|
|
|
|
}
|
|
|
|
|
|
|
|
// processLocalPTR responds to PTR requests if the target IP is detected to be
|
|
|
|
// inside the local network and the query was not answered from DHCP.
|
|
|
|
func (s *Server) processLocalPTR(ctx *dnsContext) (rc resultCode) {
|
|
|
|
d := ctx.proxyCtx
|
|
|
|
if d.Res != nil {
|
|
|
|
return resultCodeSuccess
|
|
|
|
}
|
|
|
|
|
|
|
|
ip := ctx.unreversedReqIP
|
|
|
|
if ip == nil {
|
|
|
|
return resultCodeSuccess
|
|
|
|
}
|
|
|
|
|
|
|
|
if !s.subnetDetector.IsLocallyServedNetwork(ip) {
|
|
|
|
return resultCodeSuccess
|
|
|
|
}
|
|
|
|
|
2021-04-09 18:01:21 +00:00
|
|
|
err := s.localResolvers.Resolve(d)
|
2021-03-31 12:00:47 +00:00
|
|
|
if err != nil {
|
|
|
|
ctx.err = err
|
|
|
|
|
|
|
|
return resultCodeError
|
|
|
|
}
|
|
|
|
|
2021-04-09 18:01:21 +00:00
|
|
|
if d.Res == nil {
|
|
|
|
d.Res = s.genNXDomain(d.Req)
|
|
|
|
|
|
|
|
return resultCodeFinish
|
|
|
|
}
|
2021-03-31 12:00:47 +00:00
|
|
|
|
2021-01-27 15:32:13 +00:00
|
|
|
return resultCodeSuccess
|
2020-06-23 09:13:13 +00:00
|
|
|
}
|
|
|
|
|
2020-05-08 15:39:37 +00:00
|
|
|
// Apply filtering logic
|
2021-01-27 15:32:13 +00:00
|
|
|
func processFilteringBeforeRequest(ctx *dnsContext) (rc resultCode) {
|
2020-05-08 15:39:37 +00:00
|
|
|
s := ctx.srv
|
|
|
|
d := ctx.proxyCtx
|
|
|
|
|
2020-06-23 09:13:13 +00:00
|
|
|
if d.Res != nil {
|
2021-01-27 15:32:13 +00:00
|
|
|
return resultCodeSuccess // response is already set - nothing to do
|
2020-06-23 09:13:13 +00:00
|
|
|
}
|
|
|
|
|
2020-05-08 15:39:37 +00:00
|
|
|
s.RLock()
|
|
|
|
// Synchronize access to s.dnsFilter so it won't be suddenly uninitialized while in use.
|
|
|
|
// This could happen after proxy server has been stopped, but its workers are not yet exited.
|
|
|
|
//
|
|
|
|
// A better approach is for proxy.Stop() to wait until all its workers exit,
|
|
|
|
// but this would require the Upstream interface to have Close() function
|
|
|
|
// (to prevent from hanging while waiting for unresponsive DNS server to respond).
|
|
|
|
|
|
|
|
var err error
|
|
|
|
ctx.protectionEnabled = s.conf.ProtectionEnabled && s.dnsFilter != nil
|
|
|
|
if ctx.protectionEnabled {
|
2021-04-07 17:16:06 +00:00
|
|
|
if ctx.setts == nil {
|
|
|
|
ctx.setts = s.getClientRequestFilteringSettings(ctx)
|
|
|
|
}
|
2020-05-08 15:39:37 +00:00
|
|
|
ctx.result, err = s.filterDNSRequest(ctx)
|
|
|
|
}
|
|
|
|
s.RUnlock()
|
|
|
|
|
|
|
|
if err != nil {
|
|
|
|
ctx.err = err
|
2021-04-07 17:16:06 +00:00
|
|
|
|
2021-01-27 15:32:13 +00:00
|
|
|
return resultCodeError
|
2020-05-08 15:39:37 +00:00
|
|
|
}
|
2021-04-07 17:16:06 +00:00
|
|
|
|
2021-01-27 15:32:13 +00:00
|
|
|
return resultCodeSuccess
|
2020-05-08 15:39:37 +00:00
|
|
|
}
|
|
|
|
|
2021-01-13 13:56:05 +00:00
|
|
|
// processUpstream passes request to upstream servers and handles the response.
|
2021-01-27 15:32:13 +00:00
|
|
|
func processUpstream(ctx *dnsContext) (rc resultCode) {
|
2020-05-08 15:39:37 +00:00
|
|
|
s := ctx.srv
|
|
|
|
d := ctx.proxyCtx
|
|
|
|
if d.Res != nil {
|
2021-01-27 15:32:13 +00:00
|
|
|
return resultCodeSuccess // response is already set - nothing to do
|
2020-05-08 15:39:37 +00:00
|
|
|
}
|
|
|
|
|
2020-05-13 17:31:43 +00:00
|
|
|
if d.Addr != nil && s.conf.GetCustomUpstreamByClient != nil {
|
2021-01-13 13:56:05 +00:00
|
|
|
clientIP := IPStringFromAddr(d.Addr)
|
2020-05-13 17:31:43 +00:00
|
|
|
upstreamsConf := s.conf.GetCustomUpstreamByClient(clientIP)
|
|
|
|
if upstreamsConf != nil {
|
2020-05-08 15:39:37 +00:00
|
|
|
log.Debug("Using custom upstreams for %s", clientIP)
|
2020-05-13 17:31:43 +00:00
|
|
|
d.CustomUpstreamConfig = upstreamsConf
|
2020-05-08 15:39:37 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
if s.conf.EnableDNSSEC {
|
|
|
|
opt := d.Req.IsEdns0()
|
|
|
|
if opt == nil {
|
2021-03-25 13:00:27 +00:00
|
|
|
log.Debug("dns: Adding OPT record with DNSSEC flag")
|
2020-05-08 15:39:37 +00:00
|
|
|
d.Req.SetEdns0(4096, true)
|
|
|
|
} else if !opt.Do() {
|
|
|
|
opt.SetDo(true)
|
|
|
|
} else {
|
|
|
|
ctx.origReqDNSSEC = true
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// request was not filtered so let it be processed further
|
|
|
|
err := s.dnsProxy.Resolve(d)
|
|
|
|
if err != nil {
|
|
|
|
ctx.err = err
|
2021-01-27 15:32:13 +00:00
|
|
|
return resultCodeError
|
2020-05-08 15:39:37 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
ctx.responseFromUpstream = true
|
2021-01-27 15:32:13 +00:00
|
|
|
return resultCodeSuccess
|
2020-05-08 15:39:37 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// Process DNSSEC after response from upstream server
|
2021-01-27 15:32:13 +00:00
|
|
|
func processDNSSECAfterResponse(ctx *dnsContext) (rc resultCode) {
|
2020-05-08 15:39:37 +00:00
|
|
|
d := ctx.proxyCtx
|
|
|
|
|
|
|
|
if !ctx.responseFromUpstream || // don't process response if it's not from upstream servers
|
|
|
|
!ctx.srv.conf.EnableDNSSEC {
|
2021-01-27 15:32:13 +00:00
|
|
|
return resultCodeSuccess
|
2020-05-08 15:39:37 +00:00
|
|
|
}
|
|
|
|
|
2020-05-14 15:08:47 +00:00
|
|
|
if !ctx.origReqDNSSEC {
|
|
|
|
optResp := d.Res.IsEdns0()
|
|
|
|
if optResp != nil && !optResp.Do() {
|
2021-01-27 15:32:13 +00:00
|
|
|
return resultCodeSuccess
|
2020-05-14 15:08:47 +00:00
|
|
|
}
|
2020-05-08 15:39:37 +00:00
|
|
|
|
2020-05-14 15:08:47 +00:00
|
|
|
// Remove RRSIG records from response
|
|
|
|
// because there is no DO flag in the original request from client,
|
|
|
|
// but we have EnableDNSSEC set, so we have set DO flag ourselves,
|
|
|
|
// and now we have to clean up the DNS records our client didn't ask for.
|
|
|
|
|
|
|
|
answers := []dns.RR{}
|
|
|
|
for _, a := range d.Res.Answer {
|
|
|
|
switch a.(type) {
|
|
|
|
case *dns.RRSIG:
|
|
|
|
log.Debug("Removing RRSIG record from response: %v", a)
|
|
|
|
default:
|
|
|
|
answers = append(answers, a)
|
|
|
|
}
|
2020-05-08 15:39:37 +00:00
|
|
|
}
|
2020-05-14 15:08:47 +00:00
|
|
|
d.Res.Answer = answers
|
|
|
|
|
|
|
|
answers = []dns.RR{}
|
|
|
|
for _, a := range d.Res.Ns {
|
|
|
|
switch a.(type) {
|
|
|
|
case *dns.RRSIG:
|
|
|
|
log.Debug("Removing RRSIG record from response: %v", a)
|
|
|
|
default:
|
|
|
|
answers = append(answers, a)
|
|
|
|
}
|
2020-05-08 15:39:37 +00:00
|
|
|
}
|
2020-05-14 15:08:47 +00:00
|
|
|
d.Res.Ns = answers
|
2020-05-08 15:39:37 +00:00
|
|
|
}
|
|
|
|
|
2021-01-27 15:32:13 +00:00
|
|
|
return resultCodeSuccess
|
2020-05-08 15:39:37 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// Apply filtering logic after we have received response from upstream servers
|
2021-01-27 15:32:13 +00:00
|
|
|
func processFilteringAfterResponse(ctx *dnsContext) (rc resultCode) {
|
2020-05-08 15:39:37 +00:00
|
|
|
s := ctx.srv
|
|
|
|
d := ctx.proxyCtx
|
|
|
|
res := ctx.result
|
|
|
|
var err error
|
|
|
|
|
|
|
|
switch res.Reason {
|
2020-12-28 15:41:50 +00:00
|
|
|
case dnsfilter.Rewritten,
|
|
|
|
dnsfilter.RewrittenRule:
|
2020-12-21 14:48:07 +00:00
|
|
|
|
2020-06-01 12:23:08 +00:00
|
|
|
if len(ctx.origQuestion.Name) == 0 {
|
|
|
|
// origQuestion is set in case we get only CNAME without IP from rewrites table
|
2020-05-08 15:39:37 +00:00
|
|
|
break
|
|
|
|
}
|
2020-06-01 12:23:08 +00:00
|
|
|
|
2020-05-08 15:39:37 +00:00
|
|
|
d.Req.Question[0] = ctx.origQuestion
|
|
|
|
d.Res.Question[0] = ctx.origQuestion
|
|
|
|
|
|
|
|
if len(d.Res.Answer) != 0 {
|
|
|
|
answer := []dns.RR{}
|
2020-12-23 09:35:07 +00:00
|
|
|
answer = append(answer, s.genAnswerCNAME(d.Req, res.CanonName))
|
2020-12-21 14:48:07 +00:00
|
|
|
answer = append(answer, d.Res.Answer...)
|
2020-05-08 15:39:37 +00:00
|
|
|
d.Res.Answer = answer
|
|
|
|
}
|
|
|
|
|
2020-12-21 14:48:07 +00:00
|
|
|
case dnsfilter.NotFilteredAllowList:
|
2020-05-08 15:39:37 +00:00
|
|
|
// nothing
|
|
|
|
|
|
|
|
default:
|
|
|
|
if !ctx.protectionEnabled || // filters are disabled: there's nothing to check for
|
|
|
|
!ctx.responseFromUpstream { // only check response if it's from an upstream server
|
|
|
|
break
|
|
|
|
}
|
|
|
|
origResp2 := d.Res
|
|
|
|
ctx.result, err = s.filterDNSResponse(ctx)
|
|
|
|
if err != nil {
|
|
|
|
ctx.err = err
|
2021-01-27 15:32:13 +00:00
|
|
|
return resultCodeError
|
2020-05-08 15:39:37 +00:00
|
|
|
}
|
|
|
|
if ctx.result != nil {
|
|
|
|
ctx.origResp = origResp2 // matched by response
|
|
|
|
} else {
|
|
|
|
ctx.result = &dnsfilter.Result{}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2021-01-27 15:32:13 +00:00
|
|
|
return resultCodeSuccess
|
2020-05-08 15:39:37 +00:00
|
|
|
}
|