1 /* dnstap support for Unbound */ 2 3 /* 4 * Copyright (c) 2013-2014, Farsight Security, Inc. 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 14 * 2. Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in the 16 * documentation and/or other materials provided with the distribution. 17 * 18 * 3. Neither the name of the copyright holder nor the names of its 19 * contributors may be used to endorse or promote products derived from 20 * this software without specific prior written permission. 21 * 22 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 23 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 24 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 25 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR 26 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, 27 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, 28 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; 29 * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, 30 * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR 31 * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF 32 * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 33 */ 34 35 #include "dnstap/dnstap_config.h" 36 37 #ifdef USE_DNSTAP 38 39 #include "config.h" 40 #include <string.h> 41 #include <sys/time.h> 42 #ifdef HAVE_SYS_STAT_H 43 #include <sys/stat.h> 44 #endif 45 #include <errno.h> 46 #include "sldns/sbuffer.h" 47 #include "util/config_file.h" 48 #include "util/net_help.h" 49 #include "util/netevent.h" 50 #include "util/log.h" 51 52 #include <fstrm.h> 53 #include <protobuf-c/protobuf-c.h> 54 55 #include "dnstap/dnstap.h" 56 #include "dnstap/dnstap.pb-c.h" 57 58 #define DNSTAP_CONTENT_TYPE "protobuf:dnstap.Dnstap" 59 #define DNSTAP_INITIAL_BUF_SIZE 256 60 61 struct dt_msg { 62 void *buf; 63 size_t len_buf; 64 Dnstap__Dnstap d; 65 Dnstap__Message m; 66 }; 67 68 static int 69 dt_pack(const Dnstap__Dnstap *d, void **buf, size_t *sz) 70 { 71 ProtobufCBufferSimple sbuf; 72 73 memset(&sbuf, 0, sizeof(sbuf)); 74 sbuf.base.append = protobuf_c_buffer_simple_append; 75 sbuf.len = 0; 76 sbuf.alloced = DNSTAP_INITIAL_BUF_SIZE; 77 sbuf.data = malloc(sbuf.alloced); 78 if (sbuf.data == NULL) 79 return 0; 80 sbuf.must_free_data = 1; 81 82 *sz = dnstap__dnstap__pack_to_buffer(d, (ProtobufCBuffer *) &sbuf); 83 if (sbuf.data == NULL) 84 return 0; 85 *buf = sbuf.data; 86 87 return 1; 88 } 89 90 static void 91 dt_send(const struct dt_env *env, void *buf, size_t len_buf) 92 { 93 fstrm_res res; 94 if (!buf) 95 return; 96 res = fstrm_iothr_submit(env->iothr, env->ioq, buf, len_buf, 97 fstrm_free_wrapper, NULL); 98 if (res != fstrm_res_success) 99 free(buf); 100 } 101 102 static void 103 dt_msg_init(const struct dt_env *env, 104 struct dt_msg *dm, 105 Dnstap__Message__Type mtype) 106 { 107 memset(dm, 0, sizeof(*dm)); 108 dm->d.base.descriptor = &dnstap__dnstap__descriptor; 109 dm->m.base.descriptor = &dnstap__message__descriptor; 110 dm->d.type = DNSTAP__DNSTAP__TYPE__MESSAGE; 111 dm->d.message = &dm->m; 112 dm->m.type = mtype; 113 if (env->identity != NULL) { 114 dm->d.identity.data = (uint8_t *) env->identity; 115 dm->d.identity.len = (size_t) env->len_identity; 116 dm->d.has_identity = 1; 117 } 118 if (env->version != NULL) { 119 dm->d.version.data = (uint8_t *) env->version; 120 dm->d.version.len = (size_t) env->len_version; 121 dm->d.has_version = 1; 122 } 123 } 124 125 /* check that the socket file can be opened and exists, print error if not */ 126 static void 127 check_socket_file(const char* socket_path) 128 { 129 struct stat statbuf; 130 memset(&statbuf, 0, sizeof(statbuf)); 131 if(stat(socket_path, &statbuf) < 0) { 132 log_warn("could not open dnstap-socket-path: %s, %s", 133 socket_path, strerror(errno)); 134 } 135 } 136 137 struct dt_env * 138 dt_create(const char *socket_path, unsigned num_workers) 139 { 140 #ifdef UNBOUND_DEBUG 141 fstrm_res res; 142 #endif 143 struct dt_env *env; 144 struct fstrm_iothr_options *fopt; 145 struct fstrm_unix_writer_options *fuwopt; 146 struct fstrm_writer *fw; 147 struct fstrm_writer_options *fwopt; 148 149 verbose(VERB_OPS, "attempting to connect to dnstap socket %s", 150 socket_path); 151 log_assert(socket_path != NULL); 152 log_assert(num_workers > 0); 153 check_socket_file(socket_path); 154 155 env = (struct dt_env *) calloc(1, sizeof(struct dt_env)); 156 if (!env) 157 return NULL; 158 159 fwopt = fstrm_writer_options_init(); 160 #ifdef UNBOUND_DEBUG 161 res = 162 #else 163 (void) 164 #endif 165 fstrm_writer_options_add_content_type(fwopt, 166 DNSTAP_CONTENT_TYPE, sizeof(DNSTAP_CONTENT_TYPE) - 1); 167 log_assert(res == fstrm_res_success); 168 169 fuwopt = fstrm_unix_writer_options_init(); 170 fstrm_unix_writer_options_set_socket_path(fuwopt, socket_path); 171 172 fw = fstrm_unix_writer_init(fuwopt, fwopt); 173 log_assert(fw != NULL); 174 175 fopt = fstrm_iothr_options_init(); 176 fstrm_iothr_options_set_num_input_queues(fopt, num_workers); 177 env->iothr = fstrm_iothr_init(fopt, &fw); 178 if (env->iothr == NULL) { 179 verbose(VERB_DETAIL, "dt_create: fstrm_iothr_init() failed"); 180 fstrm_writer_destroy(&fw); 181 free(env); 182 env = NULL; 183 } 184 fstrm_iothr_options_destroy(&fopt); 185 fstrm_unix_writer_options_destroy(&fuwopt); 186 fstrm_writer_options_destroy(&fwopt); 187 188 return env; 189 } 190 191 static void 192 dt_apply_identity(struct dt_env *env, struct config_file *cfg) 193 { 194 char buf[MAXHOSTNAMELEN+1]; 195 if (!cfg->dnstap_send_identity) 196 return; 197 free(env->identity); 198 if (cfg->dnstap_identity == NULL || cfg->dnstap_identity[0] == 0) { 199 if (gethostname(buf, MAXHOSTNAMELEN) == 0) { 200 buf[MAXHOSTNAMELEN] = 0; 201 env->identity = strdup(buf); 202 } else { 203 fatal_exit("dt_apply_identity: gethostname() failed"); 204 } 205 } else { 206 env->identity = strdup(cfg->dnstap_identity); 207 } 208 if (env->identity == NULL) 209 fatal_exit("dt_apply_identity: strdup() failed"); 210 env->len_identity = (unsigned int)strlen(env->identity); 211 verbose(VERB_OPS, "dnstap identity field set to \"%s\"", 212 env->identity); 213 } 214 215 static void 216 dt_apply_version(struct dt_env *env, struct config_file *cfg) 217 { 218 if (!cfg->dnstap_send_version) 219 return; 220 free(env->version); 221 if (cfg->dnstap_version == NULL || cfg->dnstap_version[0] == 0) 222 env->version = strdup(PACKAGE_STRING); 223 else 224 env->version = strdup(cfg->dnstap_version); 225 if (env->version == NULL) 226 fatal_exit("dt_apply_version: strdup() failed"); 227 env->len_version = (unsigned int)strlen(env->version); 228 verbose(VERB_OPS, "dnstap version field set to \"%s\"", 229 env->version); 230 } 231 232 void 233 dt_apply_cfg(struct dt_env *env, struct config_file *cfg) 234 { 235 if (!cfg->dnstap) 236 return; 237 238 dt_apply_identity(env, cfg); 239 dt_apply_version(env, cfg); 240 if ((env->log_resolver_query_messages = (unsigned int) 241 cfg->dnstap_log_resolver_query_messages)) 242 { 243 verbose(VERB_OPS, "dnstap Message/RESOLVER_QUERY enabled"); 244 } 245 if ((env->log_resolver_response_messages = (unsigned int) 246 cfg->dnstap_log_resolver_response_messages)) 247 { 248 verbose(VERB_OPS, "dnstap Message/RESOLVER_RESPONSE enabled"); 249 } 250 if ((env->log_client_query_messages = (unsigned int) 251 cfg->dnstap_log_client_query_messages)) 252 { 253 verbose(VERB_OPS, "dnstap Message/CLIENT_QUERY enabled"); 254 } 255 if ((env->log_client_response_messages = (unsigned int) 256 cfg->dnstap_log_client_response_messages)) 257 { 258 verbose(VERB_OPS, "dnstap Message/CLIENT_RESPONSE enabled"); 259 } 260 if ((env->log_forwarder_query_messages = (unsigned int) 261 cfg->dnstap_log_forwarder_query_messages)) 262 { 263 verbose(VERB_OPS, "dnstap Message/FORWARDER_QUERY enabled"); 264 } 265 if ((env->log_forwarder_response_messages = (unsigned int) 266 cfg->dnstap_log_forwarder_response_messages)) 267 { 268 verbose(VERB_OPS, "dnstap Message/FORWARDER_RESPONSE enabled"); 269 } 270 } 271 272 int 273 dt_init(struct dt_env *env) 274 { 275 env->ioq = fstrm_iothr_get_input_queue(env->iothr); 276 if (env->ioq == NULL) 277 return 0; 278 return 1; 279 } 280 281 void 282 dt_delete(struct dt_env *env) 283 { 284 if (!env) 285 return; 286 verbose(VERB_OPS, "closing dnstap socket"); 287 fstrm_iothr_destroy(&env->iothr); 288 free(env->identity); 289 free(env->version); 290 free(env); 291 } 292 293 static void 294 dt_fill_timeval(const struct timeval *tv, 295 uint64_t *time_sec, protobuf_c_boolean *has_time_sec, 296 uint32_t *time_nsec, protobuf_c_boolean *has_time_nsec) 297 { 298 #ifndef S_SPLINT_S 299 *time_sec = tv->tv_sec; 300 *time_nsec = tv->tv_usec * 1000; 301 #endif 302 *has_time_sec = 1; 303 *has_time_nsec = 1; 304 } 305 306 static void 307 dt_fill_buffer(sldns_buffer *b, ProtobufCBinaryData *p, protobuf_c_boolean *has) 308 { 309 log_assert(b != NULL); 310 p->len = sldns_buffer_limit(b); 311 p->data = sldns_buffer_begin(b); 312 *has = 1; 313 } 314 315 static void 316 dt_msg_fill_net(struct dt_msg *dm, 317 struct sockaddr_storage *ss, 318 enum comm_point_type cptype, 319 ProtobufCBinaryData *addr, protobuf_c_boolean *has_addr, 320 uint32_t *port, protobuf_c_boolean *has_port) 321 { 322 log_assert(ss->ss_family == AF_INET6 || ss->ss_family == AF_INET); 323 if (ss->ss_family == AF_INET6) { 324 struct sockaddr_in6 *s = (struct sockaddr_in6 *) ss; 325 326 /* socket_family */ 327 dm->m.socket_family = DNSTAP__SOCKET_FAMILY__INET6; 328 dm->m.has_socket_family = 1; 329 330 /* addr: query_address or response_address */ 331 addr->data = s->sin6_addr.s6_addr; 332 addr->len = 16; /* IPv6 */ 333 *has_addr = 1; 334 335 /* port: query_port or response_port */ 336 *port = ntohs(s->sin6_port); 337 *has_port = 1; 338 } else if (ss->ss_family == AF_INET) { 339 struct sockaddr_in *s = (struct sockaddr_in *) ss; 340 341 /* socket_family */ 342 dm->m.socket_family = DNSTAP__SOCKET_FAMILY__INET; 343 dm->m.has_socket_family = 1; 344 345 /* addr: query_address or response_address */ 346 addr->data = (uint8_t *) &s->sin_addr.s_addr; 347 addr->len = 4; /* IPv4 */ 348 *has_addr = 1; 349 350 /* port: query_port or response_port */ 351 *port = ntohs(s->sin_port); 352 *has_port = 1; 353 } 354 355 log_assert(cptype == comm_udp || cptype == comm_tcp); 356 if (cptype == comm_udp) { 357 /* socket_protocol */ 358 dm->m.socket_protocol = DNSTAP__SOCKET_PROTOCOL__UDP; 359 dm->m.has_socket_protocol = 1; 360 } else if (cptype == comm_tcp) { 361 /* socket_protocol */ 362 dm->m.socket_protocol = DNSTAP__SOCKET_PROTOCOL__TCP; 363 dm->m.has_socket_protocol = 1; 364 } 365 } 366 367 void 368 dt_msg_send_client_query(struct dt_env *env, 369 struct sockaddr_storage *qsock, 370 enum comm_point_type cptype, 371 sldns_buffer *qmsg) 372 { 373 struct dt_msg dm; 374 struct timeval qtime; 375 376 gettimeofday(&qtime, NULL); 377 378 /* type */ 379 dt_msg_init(env, &dm, DNSTAP__MESSAGE__TYPE__CLIENT_QUERY); 380 381 /* query_time */ 382 dt_fill_timeval(&qtime, 383 &dm.m.query_time_sec, &dm.m.has_query_time_sec, 384 &dm.m.query_time_nsec, &dm.m.has_query_time_nsec); 385 386 /* query_message */ 387 dt_fill_buffer(qmsg, &dm.m.query_message, &dm.m.has_query_message); 388 389 /* socket_family, socket_protocol, query_address, query_port */ 390 log_assert(cptype == comm_udp || cptype == comm_tcp); 391 dt_msg_fill_net(&dm, qsock, cptype, 392 &dm.m.query_address, &dm.m.has_query_address, 393 &dm.m.query_port, &dm.m.has_query_port); 394 395 if (dt_pack(&dm.d, &dm.buf, &dm.len_buf)) 396 dt_send(env, dm.buf, dm.len_buf); 397 } 398 399 void 400 dt_msg_send_client_response(struct dt_env *env, 401 struct sockaddr_storage *qsock, 402 enum comm_point_type cptype, 403 sldns_buffer *rmsg) 404 { 405 struct dt_msg dm; 406 struct timeval rtime; 407 408 gettimeofday(&rtime, NULL); 409 410 /* type */ 411 dt_msg_init(env, &dm, DNSTAP__MESSAGE__TYPE__CLIENT_RESPONSE); 412 413 /* response_time */ 414 dt_fill_timeval(&rtime, 415 &dm.m.response_time_sec, &dm.m.has_response_time_sec, 416 &dm.m.response_time_nsec, &dm.m.has_response_time_nsec); 417 418 /* response_message */ 419 dt_fill_buffer(rmsg, &dm.m.response_message, &dm.m.has_response_message); 420 421 /* socket_family, socket_protocol, query_address, query_port */ 422 log_assert(cptype == comm_udp || cptype == comm_tcp); 423 dt_msg_fill_net(&dm, qsock, cptype, 424 &dm.m.query_address, &dm.m.has_query_address, 425 &dm.m.query_port, &dm.m.has_query_port); 426 427 if (dt_pack(&dm.d, &dm.buf, &dm.len_buf)) 428 dt_send(env, dm.buf, dm.len_buf); 429 } 430 431 void 432 dt_msg_send_outside_query(struct dt_env *env, 433 struct sockaddr_storage *rsock, 434 enum comm_point_type cptype, 435 uint8_t *zone, size_t zone_len, 436 sldns_buffer *qmsg) 437 { 438 struct dt_msg dm; 439 struct timeval qtime; 440 uint16_t qflags; 441 442 gettimeofday(&qtime, NULL); 443 qflags = sldns_buffer_read_u16_at(qmsg, 2); 444 445 /* type */ 446 if (qflags & BIT_RD) { 447 if (!env->log_forwarder_query_messages) 448 return; 449 dt_msg_init(env, &dm, DNSTAP__MESSAGE__TYPE__FORWARDER_QUERY); 450 } else { 451 if (!env->log_resolver_query_messages) 452 return; 453 dt_msg_init(env, &dm, DNSTAP__MESSAGE__TYPE__RESOLVER_QUERY); 454 } 455 456 /* query_zone */ 457 dm.m.query_zone.data = zone; 458 dm.m.query_zone.len = zone_len; 459 dm.m.has_query_zone = 1; 460 461 /* query_time_sec, query_time_nsec */ 462 dt_fill_timeval(&qtime, 463 &dm.m.query_time_sec, &dm.m.has_query_time_sec, 464 &dm.m.query_time_nsec, &dm.m.has_query_time_nsec); 465 466 /* query_message */ 467 dt_fill_buffer(qmsg, &dm.m.query_message, &dm.m.has_query_message); 468 469 /* socket_family, socket_protocol, response_address, response_port */ 470 log_assert(cptype == comm_udp || cptype == comm_tcp); 471 dt_msg_fill_net(&dm, rsock, cptype, 472 &dm.m.response_address, &dm.m.has_response_address, 473 &dm.m.response_port, &dm.m.has_response_port); 474 475 if (dt_pack(&dm.d, &dm.buf, &dm.len_buf)) 476 dt_send(env, dm.buf, dm.len_buf); 477 } 478 479 void 480 dt_msg_send_outside_response(struct dt_env *env, 481 struct sockaddr_storage *rsock, 482 enum comm_point_type cptype, 483 uint8_t *zone, size_t zone_len, 484 uint8_t *qbuf, size_t qbuf_len, 485 const struct timeval *qtime, 486 const struct timeval *rtime, 487 sldns_buffer *rmsg) 488 { 489 struct dt_msg dm; 490 uint16_t qflags; 491 492 log_assert(qbuf_len >= sizeof(qflags)); 493 memcpy(&qflags, qbuf, sizeof(qflags)); 494 qflags = ntohs(qflags); 495 496 /* type */ 497 if (qflags & BIT_RD) { 498 if (!env->log_forwarder_response_messages) 499 return; 500 dt_msg_init(env, &dm, DNSTAP__MESSAGE__TYPE__FORWARDER_RESPONSE); 501 } else { 502 if (!env->log_resolver_response_messages) 503 return; 504 dt_msg_init(env, &dm, DNSTAP__MESSAGE__TYPE__RESOLVER_RESPONSE); 505 } 506 507 /* query_zone */ 508 dm.m.query_zone.data = zone; 509 dm.m.query_zone.len = zone_len; 510 dm.m.has_query_zone = 1; 511 512 /* query_time_sec, query_time_nsec */ 513 dt_fill_timeval(qtime, 514 &dm.m.query_time_sec, &dm.m.has_query_time_sec, 515 &dm.m.query_time_nsec, &dm.m.has_query_time_nsec); 516 517 /* response_time_sec, response_time_nsec */ 518 dt_fill_timeval(rtime, 519 &dm.m.response_time_sec, &dm.m.has_response_time_sec, 520 &dm.m.response_time_nsec, &dm.m.has_response_time_nsec); 521 522 /* response_message */ 523 dt_fill_buffer(rmsg, &dm.m.response_message, &dm.m.has_response_message); 524 525 /* socket_family, socket_protocol, response_address, response_port */ 526 log_assert(cptype == comm_udp || cptype == comm_tcp); 527 dt_msg_fill_net(&dm, rsock, cptype, 528 &dm.m.response_address, &dm.m.has_response_address, 529 &dm.m.response_port, &dm.m.has_response_port); 530 531 if (dt_pack(&dm.d, &dm.buf, &dm.len_buf)) 532 dt_send(env, dm.buf, dm.len_buf); 533 } 534 535 #endif /* USE_DNSTAP */ 536