/*
* InspIRCd -- Internet Relay Chat Daemon
*
- * Copyright (C) 2013 Adam <Adam@anope.org>
- * Copyright (C) 2003-2013 Anope Team <team@anope.org>
+ * Copyright (C) 2019 Robby <robby@chatbelgie.be>
+ * Copyright (C) 2015, 2017-2021 Sadie Powell <sadie@witchery.services>
+ * Copyright (C) 2013-2016 Attila Molnar <attilamolnar@hush.com>
+ * Copyright (C) 2013, 2015-2016 Adam <Adam@anope.org>
*
* This file is part of InspIRCd. InspIRCd is free software: you can
* redistribute it and/or modify it under the terms of the GNU General Public
#pragma comment(lib, "Iphlpapi.lib")
#endif
+namespace DNS
+{
+ /** Maximum value of a dns request id, 16 bits wide, 0xFFFF.
+ */
+ const unsigned int MAX_REQUEST_ID = 0xFFFF;
+}
+
using namespace DNS;
-/** A full packet sent or recieved to/from the nameserver
+/** A full packet sent or received to/from the nameserver
*/
class Packet : public Query
{
Question UnpackQuestion(const unsigned char* input, unsigned short input_size, unsigned short& pos)
{
- Question question;
+ Question q;
- question.name = this->UnpackName(input, input_size, pos);
+ q.name = this->UnpackName(input, input_size, pos);
if (pos + 4 > input_size)
throw Exception("Unable to unpack question");
- question.type = static_cast<QueryType>(input[pos] << 8 | input[pos + 1]);
+ q.type = static_cast<QueryType>(input[pos] << 8 | input[pos + 1]);
pos += 2;
- question.qclass = input[pos] << 8 | input[pos + 1];
+ // Skip over query class code
pos += 2;
- return question;
+ return q;
}
ResourceRecord UnpackResourceRecord(const unsigned char* input, unsigned short input_size, unsigned short& pos)
record.ttl = (input[pos] << 24) | (input[pos + 1] << 16) | (input[pos + 2] << 8) | input[pos + 3];
pos += 4;
- //record.rdlength = input[pos] << 8 | input[pos + 1];
+ uint16_t rdlength = input[pos] << 8 | input[pos + 1];
pos += 2;
switch (record.type)
case QUERY_PTR:
{
record.rdata = this->UnpackName(input, input_size, pos);
+ if (!InspIRCd::IsHost(record.rdata))
+ throw Exception("Invalid name"); // XXX: Causes the request to time out
+
+ break;
+ }
+ case QUERY_TXT:
+ {
+ if (pos + rdlength > input_size)
+ throw Exception("Unable to unpack txt resource record");
+
+ record.rdata = std::string(reinterpret_cast<const char *>(input + pos), rdlength);
+ pos += rdlength;
+
+ if (record.rdata.find_first_of("\r\n\0", 0, 3) != std::string::npos)
+ throw Exception("Invalid character in txt record");
+
break;
}
default:
static const int HEADER_LENGTH = 12;
/* ID for this packet */
- unsigned short id;
+ RequestId id;
/* Flags on the packet */
unsigned short flags;
this->id = (input[packet_pos] << 8) | input[packet_pos + 1];
packet_pos += 2;
- if (this->id >= MAX_REQUEST_ID)
- throw Exception("Query ID too large?");
-
this->flags = (input[packet_pos] << 8) | input[packet_pos + 1];
packet_pos += 2;
ServerInstance->Logs->Log(MODNAME, LOG_DEBUG, "qdcount: " + ConvToStr(qdcount) + " ancount: " + ConvToStr(ancount) + " nscount: " + ConvToStr(nscount) + " arcount: " + ConvToStr(arcount));
- for (unsigned i = 0; i < qdcount; ++i)
- this->questions.push_back(this->UnpackQuestion(input, len, packet_pos));
+ if (qdcount != 1)
+ throw Exception("Question count != 1 in incoming packet");
+
+ this->question = this->UnpackQuestion(input, len, packet_pos);
for (unsigned i = 0; i < ancount; ++i)
this->answers.push_back(this->UnpackResourceRecord(input, len, packet_pos));
output[pos++] = this->id & 0xFF;
output[pos++] = this->flags >> 8;
output[pos++] = this->flags & 0xFF;
- output[pos++] = this->questions.size() >> 8;
- output[pos++] = this->questions.size() & 0xFF;
- output[pos++] = this->answers.size() >> 8;
- output[pos++] = this->answers.size() & 0xFF;
+ output[pos++] = 0; // Question count, high byte
+ output[pos++] = 1; // Question count, low byte
+ output[pos++] = 0; // Answer count, high byte
+ output[pos++] = 0; // Answer count, low byte
output[pos++] = 0;
output[pos++] = 0;
output[pos++] = 0;
output[pos++] = 0;
- for (unsigned i = 0; i < this->questions.size(); ++i)
{
- Question& q = this->questions[i];
+ Question& q = this->question;
if (q.type == QUERY_PTR)
{
memcpy(&output[pos], &s, 2);
pos += 2;
- s = htons(q.qclass);
- memcpy(&output[pos], &s, 2);
- pos += 2;
- }
-
- for (unsigned int i = 0; i < answers.size(); i++)
- {
- ResourceRecord& rr = answers[i];
-
- this->PackName(output, output_size, pos, rr.name);
-
- if (pos + 8 >= output_size)
- throw Exception("Unable to pack packet");
-
- short s = htons(rr.type);
- memcpy(&output[pos], &s, 2);
- pos += 2;
-
- s = htons(rr.qclass);
- memcpy(&output[pos], &s, 2);
- pos += 2;
-
- long l = htonl(rr.ttl);
- memcpy(&output[pos], &l, 4);
- pos += 4;
-
- switch (rr.type)
- {
- case QUERY_A:
- {
- if (pos + 6 > output_size)
- throw Exception("Unable to pack packet");
-
- irc::sockets::sockaddrs a;
- irc::sockets::aptosa(rr.rdata, 0, a);
-
- s = htons(4);
- memcpy(&output[pos], &s, 2);
- pos += 2;
-
- memcpy(&output[pos], &a.in4.sin_addr, 4);
- pos += 4;
- break;
- }
- case QUERY_AAAA:
- {
- if (pos + 18 > output_size)
- throw Exception("Unable to pack packet");
-
- irc::sockets::sockaddrs a;
- irc::sockets::aptosa(rr.rdata, 0, a);
-
- s = htons(16);
- memcpy(&output[pos], &s, 2);
- pos += 2;
-
- memcpy(&output[pos], &a.in6.sin6_addr, 16);
- pos += 16;
- break;
- }
- case QUERY_CNAME:
- case QUERY_PTR:
- {
- if (pos + 2 >= output_size)
- throw Exception("Unable to pack packet");
-
- unsigned short packet_pos_save = pos;
- pos += 2;
-
- this->PackName(output, output_size, pos, rr.rdata);
-
- s = htons(pos - packet_pos_save - 2);
- memcpy(&output[packet_pos_save], &s, 2);
- break;
- }
- default:
- break;
- }
+ // Query class, always IN
+ output[pos++] = 0;
+ output[pos++] = 1;
}
return pos;
cache_map cache;
irc::sockets::sockaddrs myserver;
+ bool unloading;
+
+ /** Maximum number of entries in cache
+ */
+ static const unsigned int MAX_CACHE_SIZE = 1000;
static bool IsExpired(const Query& record, time_t now = ServerInstance->Time())
{
*/
void AddCache(Query& r)
{
- const ResourceRecord& rr = r.answers[0];
+ if (cache.size() >= MAX_CACHE_SIZE)
+ cache.clear();
+
+ // Determine the lowest TTL value and use that as the TTL of the cache entry
+ unsigned int cachettl = UINT_MAX;
+ for (std::vector<ResourceRecord>::const_iterator i = r.answers.begin(); i != r.answers.end(); ++i)
+ {
+ const ResourceRecord& rr = *i;
+ if (rr.ttl < cachettl)
+ cachettl = rr.ttl;
+ }
+
+ cachettl = std::min(cachettl, (unsigned int)5*60);
+ ResourceRecord& rr = r.answers.front();
+ // Set TTL to what we've determined to be the lowest
+ rr.ttl = cachettl;
ServerInstance->Logs->Log(MODNAME, LOG_DEBUG, "cache: added cache for " + rr.name + " -> " + rr.rdata + " ttl: " + ConvToStr(rr.ttl));
- this->cache[r.questions[0]] = r;
+ this->cache[r.question] = r;
}
public:
- DNS::Request* requests[MAX_REQUEST_ID];
+ DNS::Request* requests[MAX_REQUEST_ID+1];
- MyManager(Module* c) : Manager(c), Timer(3600, true)
+ MyManager(Module* c) : Manager(c), Timer(5*60, true)
+ , unloading(false)
{
- for (int i = 0; i < MAX_REQUEST_ID; ++i)
+ for (unsigned int i = 0; i <= MAX_REQUEST_ID; ++i)
requests[i] = NULL;
ServerInstance->Timers.AddTimer(this);
}
~MyManager()
{
- for (int i = 0; i < MAX_REQUEST_ID; ++i)
+ // Ensure Process() will fail for new requests
+ Close();
+ unloading = true;
+
+ for (unsigned int i = 0; i <= MAX_REQUEST_ID; ++i)
{
DNS::Request* request = requests[i];
if (!request)
continue;
- Query rr(*request);
+ Query rr(request->question);
rr.error = ERROR_UNKNOWN;
request->OnError(&rr);
}
}
- void Process(DNS::Request* req)
+ void Close()
+ {
+ // Shutdown the socket if it exists.
+ if (HasFd())
+ {
+ SocketEngine::Shutdown(this, 2);
+ SocketEngine::Close(this);
+ }
+
+ // Remove all entries from the cache.
+ cache.clear();
+ }
+
+ void Process(DNS::Request* req) CXX11_OVERRIDE
{
- ServerInstance->Logs->Log(MODNAME, LOG_DEBUG, "Processing request to lookup " + req->name + " of type " + ConvToStr(req->type) + " to " + this->myserver.addr());
+ if ((unloading) || (req->creator->dying))
+ throw Exception("Module is being unloaded");
+
+ if (!HasFd())
+ {
+ Query rr(req->question);
+ rr.error = ERROR_DISABLED;
+ req->OnError(&rr);
+ return;
+ }
+
+ ServerInstance->Logs->Log(MODNAME, LOG_DEBUG, "Processing request to lookup " + req->question.name + " of type " + ConvToStr(req->question.type) + " to " + this->myserver.addr());
/* Create an id */
unsigned int tries = 0;
+ int id;
do
{
- req->id = ServerInstance->GenRandomInt(DNS::MAX_REQUEST_ID);
+ id = ServerInstance->GenRandomInt(DNS::MAX_REQUEST_ID+1);
if (++tries == DNS::MAX_REQUEST_ID*5)
{
// If we couldn't find an empty slot this many times, do a sequential scan as a last
// resort. If an empty slot is found that way, go on, otherwise throw an exception
- req->id = 0;
- for (int i = 1; i < DNS::MAX_REQUEST_ID; i++)
+ id = -1;
+ for (unsigned int i = 0; i <= DNS::MAX_REQUEST_ID; i++)
{
if (!this->requests[i])
{
- req->id = i;
+ id = i;
break;
}
}
- if (req->id == 0)
+ if (id == -1)
throw Exception("DNS: All ids are in use");
break;
}
}
- while (!req->id || this->requests[req->id]);
+ while (this->requests[id]);
+ req->id = id;
this->requests[req->id] = req;
Packet p;
p.flags = QUERYFLAGS_RD;
p.id = req->id;
- p.questions.push_back(*req);
+ p.question = req->question;
unsigned char buffer[524];
unsigned short len = p.Pack(buffer, sizeof(buffer));
- /* Note that calling Pack() above can actually change the contents of p.questions[0].name, if the query is a PTR,
+ /* Note that calling Pack() above can actually change the contents of p.question.name, if the query is a PTR,
* to contain the value that would be in the DNS cache, which is why this is here.
*/
- if (req->use_cache && this->CheckCache(req, p.questions[0]))
+ if (req->use_cache && this->CheckCache(req, p.question))
{
ServerInstance->Logs->Log(MODNAME, LOG_DEBUG, "Using cached result");
delete req;
return;
}
- if (SocketEngine::SendTo(this, buffer, len, 0, &this->myserver.sa, this->myserver.sa_size()) != len)
+ // Update name in the original request so question checking works for PTR queries
+ req->question.name = p.question.name;
+
+ if (SocketEngine::SendTo(this, buffer, len, 0, this->myserver) != len)
throw Exception("DNS: Unable to send query");
+
+ // Add timer for timeout
+ ServerInstance->Timers.AddTimer(req);
}
- void RemoveRequest(DNS::Request* req)
+ void RemoveRequest(DNS::Request* req) CXX11_OVERRIDE
{
- this->requests[req->id] = NULL;
+ if (requests[req->id] == req)
+ requests[req->id] = NULL;
}
- std::string GetErrorStr(Error e)
+ std::string GetErrorStr(Error e) CXX11_OVERRIDE
{
switch (e)
{
case ERROR_NOT_AN_ANSWER:
case ERROR_NONSTANDARD_QUERY:
case ERROR_FORMAT_ERROR:
+ case ERROR_MALFORMED:
return "Malformed answer";
case ERROR_SERVER_FAILURE:
case ERROR_NOT_IMPLEMENTED:
case ERROR_DOMAIN_NOT_FOUND:
case ERROR_NO_RECORDS:
return "Domain not found";
+ case ERROR_DISABLED:
+ return "DNS lookups are disabled";
case ERROR_NONE:
case ERROR_UNKNOWN:
default:
}
}
+ std::string GetTypeStr(QueryType qt) CXX11_OVERRIDE
+ {
+ switch (qt)
+ {
+ case QUERY_A:
+ return "A";
+ case QUERY_AAAA:
+ return "AAAA";
+ case QUERY_CNAME:
+ return "CNAME";
+ case QUERY_PTR:
+ return "PTR";
+ case QUERY_TXT:
+ return "TXT";
+ default:
+ return "UNKNOWN";
+ }
+ }
+
void OnEventHandlerError(int errcode) CXX11_OVERRIDE
{
ServerInstance->Logs->Log(MODNAME, LOG_DEBUG, "UDP socket got an error event");
if (length < Packet::HEADER_LENGTH)
return;
+ if (myserver != from)
+ {
+ std::string server1 = from.str();
+ std::string server2 = myserver.str();
+ ServerInstance->Logs->Log(MODNAME, LOG_DEBUG, "Got a result from the wrong server! Bad NAT or DNS forging attempt? '%s' != '%s'",
+ server1.c_str(), server2.c_str());
+ return;
+ }
+
Packet recv_packet;
+ bool valid = false;
try
{
recv_packet.Fill(buffer, length);
+ valid = true;
}
catch (Exception& ex)
{
ServerInstance->Logs->Log(MODNAME, LOG_DEBUG, ex.GetReason());
- return;
}
- if (myserver != from)
+ // recv_packet.id must be filled in here
+ DNS::Request* request = this->requests[recv_packet.id];
+ if (request == NULL)
{
- std::string server1 = from.str();
- std::string server2 = myserver.str();
- ServerInstance->Logs->Log(MODNAME, LOG_DEBUG, "Got a result from the wrong server! Bad NAT or DNS forging attempt? '%s' != '%s'",
- server1.c_str(), server2.c_str());
+ ServerInstance->Logs->Log(MODNAME, LOG_DEBUG, "Received an answer for something we didn't request");
return;
}
- DNS::Request* request = this->requests[recv_packet.id];
- if (request == NULL)
+ if (request->question != recv_packet.question)
{
- ServerInstance->Logs->Log(MODNAME, LOG_DEBUG, "Received an answer for something we didn't request");
+ // This can happen under high latency, drop it silently, do not fail the request
+ ServerInstance->Logs->Log(MODNAME, LOG_DEBUG, "Received an answer that isn't for a question we asked");
return;
}
- if (recv_packet.flags & QUERYFLAGS_OPCODE)
+ if (!valid)
+ {
+ ServerInstance->stats.DnsBad++;
+ recv_packet.error = ERROR_MALFORMED;
+ request->OnError(&recv_packet);
+ }
+ else if (recv_packet.flags & QUERYFLAGS_OPCODE)
{
ServerInstance->Logs->Log(MODNAME, LOG_DEBUG, "Received a nonstandard query");
ServerInstance->stats.DnsBad++;
recv_packet.error = ERROR_NONSTANDARD_QUERY;
request->OnError(&recv_packet);
}
- else if (recv_packet.flags & QUERYFLAGS_RCODE)
+ else if (!(recv_packet.flags & QUERYFLAGS_QR) || (recv_packet.flags & QUERYFLAGS_RCODE))
{
Error error = ERROR_UNKNOWN;
recv_packet.error = error;
request->OnError(&recv_packet);
}
- else if (recv_packet.questions.empty() || recv_packet.answers.empty())
+ else if (recv_packet.answers.empty())
{
ServerInstance->Logs->Log(MODNAME, LOG_DEBUG, "No resource records returned");
ServerInstance->stats.DnsBad++;
}
else
{
- ServerInstance->Logs->Log(MODNAME, LOG_DEBUG, "Lookup complete for " + request->name);
+ ServerInstance->Logs->Log(MODNAME, LOG_DEBUG, "Lookup complete for " + request->question.name);
ServerInstance->stats.DnsGood++;
request->OnLookupComplete(&recv_packet);
this->AddCache(recv_packet);
delete request;
}
- bool Tick(time_t now)
+ bool Tick(time_t now) CXX11_OVERRIDE
{
- ServerInstance->Logs->Log(MODNAME, LOG_DEBUG, "cache: purging DNS cache");
-
+ unsigned long expired = 0;
for (cache_map::iterator it = this->cache.begin(); it != this->cache.end(); )
{
const Query& query = it->second;
if (IsExpired(query, now))
+ {
+ expired++;
this->cache.erase(it++);
+ }
else
++it;
}
+
+ if (expired)
+ ServerInstance->Logs->Log(MODNAME, LOG_DEBUG, "cache: purged %lu expired DNS entries", expired);
+
return true;
}
- void Rehash(const std::string& dnsserver)
+ void Rehash(const std::string& dnsserver, std::string sourceaddr, unsigned int sourceport)
{
- if (this->GetFd() > -1)
- {
- SocketEngine::Shutdown(this, 2);
- SocketEngine::Close(this);
-
- /* Remove expired entries from the cache */
- this->Tick(ServerInstance->Time());
- }
-
irc::sockets::aptosa(dnsserver, DNS::PORT, myserver);
/* Initialize mastersocket */
- int s = socket(myserver.sa.sa_family, SOCK_DGRAM, 0);
+ Close();
+ int s = socket(myserver.family(), SOCK_DGRAM, 0);
this->SetFd(s);
/* Have we got a socket? */
- if (this->GetFd() != -1)
+ if (this->HasFd())
{
SocketEngine::SetReuse(s);
SocketEngine::NonBlocking(s);
irc::sockets::sockaddrs bindto;
- memset(&bindto, 0, sizeof(bindto));
- bindto.sa.sa_family = myserver.sa.sa_family;
+ if (sourceaddr.empty())
+ {
+ // set a sourceaddr for irc::sockets::aptosa() based on the servers af type
+ if (myserver.family() == AF_INET)
+ sourceaddr = "0.0.0.0";
+ else if (myserver.family() == AF_INET6)
+ sourceaddr = "::";
+ }
+ irc::sockets::aptosa(sourceaddr, sourceport, bindto);
if (SocketEngine::Bind(this->GetFd(), bindto) < 0)
{
SocketEngine::Close(this->GetFd());
this->SetFd(-1);
}
+
+ if (bindto.family() != myserver.family())
+ ServerInstance->Logs->Log(MODNAME, LOG_SPARSE, "Nameserver address family differs from source address family - hostnames might not resolve");
}
else
{
{
MyManager manager;
std::string DNSServer;
+ std::string SourceIP;
+ unsigned int SourcePort;
void FindDNSServer()
{
#ifdef _WIN32
// attempt to look up their nameserver from the system
- ServerInstance->Logs->Log("CONFIG", LOG_DEFAULT, "WARNING: <dns:server> not defined, attempting to find a working server in the system settings...");
+ ServerInstance->Logs->Log(MODNAME, LOG_DEFAULT, "WARNING: <dns:server> not defined, attempting to find a working server in the system settings...");
PFIXED_INFO pFixedInfo;
DWORD dwBufferSize = sizeof(FIXED_INFO);
if (!DNSServer.empty())
{
- ServerInstance->Logs->Log("CONFIG", LOG_DEFAULT, "<dns:server> set to '%s' as first active resolver in the system settings.", DNSServer.c_str());
+ ServerInstance->Logs->Log(MODNAME, LOG_DEFAULT, "<dns:server> set to '%s' as first active resolver in the system settings.", DNSServer.c_str());
return;
}
}
- ServerInstance->Logs->Log("CONFIG", LOG_DEFAULT, "No viable nameserver found! Defaulting to nameserver '127.0.0.1'!");
+ ServerInstance->Logs->Log(MODNAME, LOG_DEFAULT, "No viable nameserver found! Defaulting to nameserver '127.0.0.1'!");
#else
// attempt to look up their nameserver from /etc/resolv.conf
- ServerInstance->Logs->Log("CONFIG", LOG_DEFAULT, "WARNING: <dns:server> not defined, attempting to find working server in /etc/resolv.conf...");
+ ServerInstance->Logs->Log(MODNAME, LOG_DEFAULT, "WARNING: <dns:server> not defined, attempting to find working server in /etc/resolv.conf...");
std::ifstream resolv("/etc/resolv.conf");
if (DNSServer == "nameserver")
{
resolv >> DNSServer;
- if (DNSServer.find_first_not_of("0123456789.") == std::string::npos)
+ if (DNSServer.find_first_not_of("0123456789.") == std::string::npos || DNSServer.find_first_not_of("0123456789ABCDEFabcdef:") == std::string::npos)
{
- ServerInstance->Logs->Log("CONFIG", LOG_DEFAULT, "<dns:server> set to '%s' as first resolver in /etc/resolv.conf.",DNSServer.c_str());
+ ServerInstance->Logs->Log(MODNAME, LOG_DEFAULT, "<dns:server> set to '%s' as first resolver in /etc/resolv.conf.",DNSServer.c_str());
return;
}
}
}
- ServerInstance->Logs->Log("CONFIG", LOG_DEFAULT, "/etc/resolv.conf contains no viable nameserver entries! Defaulting to nameserver '127.0.0.1'!");
+ ServerInstance->Logs->Log(MODNAME, LOG_DEFAULT, "/etc/resolv.conf contains no viable nameserver entries! Defaulting to nameserver '127.0.0.1'!");
#endif
DNSServer = "127.0.0.1";
}
public:
- ModuleDNS() : manager(this)
+ ModuleDNS() : manager(this)
+ , SourcePort(0)
{
}
void ReadConfig(ConfigStatus& status) CXX11_OVERRIDE
{
- std::string oldserver = DNSServer;
- DNSServer = ServerInstance->Config->ConfValue("dns")->getString("server");
+ ConfigTag* tag = ServerInstance->Config->ConfValue("dns");
+ if (!tag->getBool("enabled", true))
+ {
+ // Clear these so they get reset if DNS is enabled again.
+ DNSServer.clear();
+ SourceIP.clear();
+ SourcePort = 0;
+
+ this->manager.Close();
+ return;
+ }
+
+ const std::string oldserver = DNSServer;
+ DNSServer = tag->getString("server");
+
+ const std::string oldip = SourceIP;
+ SourceIP = tag->getString("sourceip");
+
+ const unsigned int oldport = SourcePort;
+ SourcePort = tag->getUInt("sourceport", 0, 0, UINT16_MAX);
+
if (DNSServer.empty())
FindDNSServer();
- if (oldserver != DNSServer)
- this->manager.Rehash(DNSServer);
+ if (oldserver != DNSServer || oldip != SourceIP || oldport != SourcePort)
+ this->manager.Rehash(DNSServer, SourceIP, SourcePort);
}
- void OnUnloadModule(Module* mod)
+ void OnUnloadModule(Module* mod) CXX11_OVERRIDE
{
- for (int i = 0; i < MAX_REQUEST_ID; ++i)
+ for (unsigned int i = 0; i <= MAX_REQUEST_ID; ++i)
{
DNS::Request* req = this->manager.requests[i];
if (!req)
if (req->creator == mod)
{
- Query rr(*req);
+ Query rr(req->question);
rr.error = ERROR_UNLOADED;
req->OnError(&rr);
}
}
- Version GetVersion()
+ Version GetVersion() CXX11_OVERRIDE
{
- return Version("DNS support", VF_CORE|VF_VENDOR);
+ return Version("Provides support for DNS lookups", VF_CORE|VF_VENDOR);
}
};
projects / user / henk / code / inspircd.git / blobdiff