xref: /freebsd/contrib/unbound/dnstap/dnstap.c (revision 2f513db72b034fd5ef7f080b11be5c711c15186a)
1 /* dnstap support for Unbound */
2 
3 /*
4  * Copyright (c) 2013-2014, Farsight Security, Inc.
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  *
11  * 1. Redistributions of source code must retain the above copyright
12  * notice, this list of conditions and the following disclaimer.
13  *
14  * 2. Redistributions in binary form must reproduce the above copyright
15  * notice, this list of conditions and the following disclaimer in the
16  * documentation and/or other materials provided with the distribution.
17  *
18  * 3. Neither the name of the copyright holder nor the names of its
19  * contributors may be used to endorse or promote products derived from
20  * this software without specific prior written permission.
21  *
22  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
23  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
24  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
25  * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR
26  * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
27  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
28  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
29  * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
30  * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
31  * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
32  * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
33  */
34 
35 #include "dnstap/dnstap_config.h"
36 
37 #ifdef USE_DNSTAP
38 
39 #include "config.h"
40 #include <string.h>
41 #include <sys/time.h>
42 #ifdef HAVE_SYS_STAT_H
43 #include <sys/stat.h>
44 #endif
45 #include <errno.h>
46 #include "sldns/sbuffer.h"
47 #include "util/config_file.h"
48 #include "util/net_help.h"
49 #include "util/netevent.h"
50 #include "util/log.h"
51 
52 #include <fstrm.h>
53 #include <protobuf-c/protobuf-c.h>
54 
55 #include "dnstap/dnstap.h"
56 #include "dnstap/dnstap.pb-c.h"
57 
58 #define DNSTAP_CONTENT_TYPE		"protobuf:dnstap.Dnstap"
59 #define DNSTAP_INITIAL_BUF_SIZE		256
60 
61 struct dt_msg {
62 	void		*buf;
63 	size_t		len_buf;
64 	Dnstap__Dnstap	d;
65 	Dnstap__Message	m;
66 };
67 
68 static int
69 dt_pack(const Dnstap__Dnstap *d, void **buf, size_t *sz)
70 {
71 	ProtobufCBufferSimple sbuf;
72 
73 	memset(&sbuf, 0, sizeof(sbuf));
74 	sbuf.base.append = protobuf_c_buffer_simple_append;
75 	sbuf.len = 0;
76 	sbuf.alloced = DNSTAP_INITIAL_BUF_SIZE;
77 	sbuf.data = malloc(sbuf.alloced);
78 	if (sbuf.data == NULL)
79 		return 0;
80 	sbuf.must_free_data = 1;
81 
82 	*sz = dnstap__dnstap__pack_to_buffer(d, (ProtobufCBuffer *) &sbuf);
83 	if (sbuf.data == NULL)
84 		return 0;
85 	*buf = sbuf.data;
86 
87 	return 1;
88 }
89 
90 static void
91 dt_send(const struct dt_env *env, void *buf, size_t len_buf)
92 {
93 	fstrm_res res;
94 	if (!buf)
95 		return;
96 	res = fstrm_iothr_submit(env->iothr, env->ioq, buf, len_buf,
97 				 fstrm_free_wrapper, NULL);
98 	if (res != fstrm_res_success)
99 		free(buf);
100 }
101 
102 static void
103 dt_msg_init(const struct dt_env *env,
104 	    struct dt_msg *dm,
105 	    Dnstap__Message__Type mtype)
106 {
107 	memset(dm, 0, sizeof(*dm));
108 	dm->d.base.descriptor = &dnstap__dnstap__descriptor;
109 	dm->m.base.descriptor = &dnstap__message__descriptor;
110 	dm->d.type = DNSTAP__DNSTAP__TYPE__MESSAGE;
111 	dm->d.message = &dm->m;
112 	dm->m.type = mtype;
113 	if (env->identity != NULL) {
114 		dm->d.identity.data = (uint8_t *) env->identity;
115 		dm->d.identity.len = (size_t) env->len_identity;
116 		dm->d.has_identity = 1;
117 	}
118 	if (env->version != NULL) {
119 		dm->d.version.data = (uint8_t *) env->version;
120 		dm->d.version.len = (size_t) env->len_version;
121 		dm->d.has_version = 1;
122 	}
123 }
124 
125 /* check that the socket file can be opened and exists, print error if not */
126 static void
127 check_socket_file(const char* socket_path)
128 {
129 	struct stat statbuf;
130 	memset(&statbuf, 0, sizeof(statbuf));
131 	if(stat(socket_path, &statbuf) < 0) {
132 		log_warn("could not open dnstap-socket-path: %s, %s",
133 			socket_path, strerror(errno));
134 	}
135 }
136 
137 struct dt_env *
138 dt_create(const char *socket_path, unsigned num_workers)
139 {
140 #ifdef UNBOUND_DEBUG
141 	fstrm_res res;
142 #endif
143 	struct dt_env *env;
144 	struct fstrm_iothr_options *fopt;
145 	struct fstrm_unix_writer_options *fuwopt;
146 	struct fstrm_writer *fw;
147 	struct fstrm_writer_options *fwopt;
148 
149 	verbose(VERB_OPS, "attempting to connect to dnstap socket %s",
150 		socket_path);
151 	log_assert(socket_path != NULL);
152 	log_assert(num_workers > 0);
153 	check_socket_file(socket_path);
154 
155 	env = (struct dt_env *) calloc(1, sizeof(struct dt_env));
156 	if (!env)
157 		return NULL;
158 
159 	fwopt = fstrm_writer_options_init();
160 #ifdef UNBOUND_DEBUG
161 	res =
162 #else
163 	(void)
164 #endif
165 	    fstrm_writer_options_add_content_type(fwopt,
166 		DNSTAP_CONTENT_TYPE, sizeof(DNSTAP_CONTENT_TYPE) - 1);
167 	log_assert(res == fstrm_res_success);
168 
169 	fuwopt = fstrm_unix_writer_options_init();
170 	fstrm_unix_writer_options_set_socket_path(fuwopt, socket_path);
171 
172 	fw = fstrm_unix_writer_init(fuwopt, fwopt);
173 	log_assert(fw != NULL);
174 
175 	fopt = fstrm_iothr_options_init();
176 	fstrm_iothr_options_set_num_input_queues(fopt, num_workers);
177 	env->iothr = fstrm_iothr_init(fopt, &fw);
178 	if (env->iothr == NULL) {
179 		verbose(VERB_DETAIL, "dt_create: fstrm_iothr_init() failed");
180 		fstrm_writer_destroy(&fw);
181 		free(env);
182 		env = NULL;
183 	}
184 	fstrm_iothr_options_destroy(&fopt);
185 	fstrm_unix_writer_options_destroy(&fuwopt);
186 	fstrm_writer_options_destroy(&fwopt);
187 
188 	return env;
189 }
190 
191 static void
192 dt_apply_identity(struct dt_env *env, struct config_file *cfg)
193 {
194 	char buf[MAXHOSTNAMELEN+1];
195 	if (!cfg->dnstap_send_identity)
196 		return;
197 	free(env->identity);
198 	if (cfg->dnstap_identity == NULL || cfg->dnstap_identity[0] == 0) {
199 		if (gethostname(buf, MAXHOSTNAMELEN) == 0) {
200 			buf[MAXHOSTNAMELEN] = 0;
201 			env->identity = strdup(buf);
202 		} else {
203 			fatal_exit("dt_apply_identity: gethostname() failed");
204 		}
205 	} else {
206 		env->identity = strdup(cfg->dnstap_identity);
207 	}
208 	if (env->identity == NULL)
209 		fatal_exit("dt_apply_identity: strdup() failed");
210 	env->len_identity = (unsigned int)strlen(env->identity);
211 	verbose(VERB_OPS, "dnstap identity field set to \"%s\"",
212 		env->identity);
213 }
214 
215 static void
216 dt_apply_version(struct dt_env *env, struct config_file *cfg)
217 {
218 	if (!cfg->dnstap_send_version)
219 		return;
220 	free(env->version);
221 	if (cfg->dnstap_version == NULL || cfg->dnstap_version[0] == 0)
222 		env->version = strdup(PACKAGE_STRING);
223 	else
224 		env->version = strdup(cfg->dnstap_version);
225 	if (env->version == NULL)
226 		fatal_exit("dt_apply_version: strdup() failed");
227 	env->len_version = (unsigned int)strlen(env->version);
228 	verbose(VERB_OPS, "dnstap version field set to \"%s\"",
229 		env->version);
230 }
231 
232 void
233 dt_apply_cfg(struct dt_env *env, struct config_file *cfg)
234 {
235 	if (!cfg->dnstap)
236 		return;
237 
238 	dt_apply_identity(env, cfg);
239 	dt_apply_version(env, cfg);
240 	if ((env->log_resolver_query_messages = (unsigned int)
241 	     cfg->dnstap_log_resolver_query_messages))
242 	{
243 		verbose(VERB_OPS, "dnstap Message/RESOLVER_QUERY enabled");
244 	}
245 	if ((env->log_resolver_response_messages = (unsigned int)
246 	     cfg->dnstap_log_resolver_response_messages))
247 	{
248 		verbose(VERB_OPS, "dnstap Message/RESOLVER_RESPONSE enabled");
249 	}
250 	if ((env->log_client_query_messages = (unsigned int)
251 	     cfg->dnstap_log_client_query_messages))
252 	{
253 		verbose(VERB_OPS, "dnstap Message/CLIENT_QUERY enabled");
254 	}
255 	if ((env->log_client_response_messages = (unsigned int)
256 	     cfg->dnstap_log_client_response_messages))
257 	{
258 		verbose(VERB_OPS, "dnstap Message/CLIENT_RESPONSE enabled");
259 	}
260 	if ((env->log_forwarder_query_messages = (unsigned int)
261 	     cfg->dnstap_log_forwarder_query_messages))
262 	{
263 		verbose(VERB_OPS, "dnstap Message/FORWARDER_QUERY enabled");
264 	}
265 	if ((env->log_forwarder_response_messages = (unsigned int)
266 	     cfg->dnstap_log_forwarder_response_messages))
267 	{
268 		verbose(VERB_OPS, "dnstap Message/FORWARDER_RESPONSE enabled");
269 	}
270 }
271 
272 int
273 dt_init(struct dt_env *env)
274 {
275 	env->ioq = fstrm_iothr_get_input_queue(env->iothr);
276 	if (env->ioq == NULL)
277 		return 0;
278 	return 1;
279 }
280 
281 void
282 dt_delete(struct dt_env *env)
283 {
284 	if (!env)
285 		return;
286 	verbose(VERB_OPS, "closing dnstap socket");
287 	fstrm_iothr_destroy(&env->iothr);
288 	free(env->identity);
289 	free(env->version);
290 	free(env);
291 }
292 
293 static void
294 dt_fill_timeval(const struct timeval *tv,
295 		uint64_t *time_sec, protobuf_c_boolean *has_time_sec,
296 		uint32_t *time_nsec, protobuf_c_boolean *has_time_nsec)
297 {
298 #ifndef S_SPLINT_S
299 	*time_sec = tv->tv_sec;
300 	*time_nsec = tv->tv_usec * 1000;
301 #endif
302 	*has_time_sec = 1;
303 	*has_time_nsec = 1;
304 }
305 
306 static void
307 dt_fill_buffer(sldns_buffer *b, ProtobufCBinaryData *p, protobuf_c_boolean *has)
308 {
309 	log_assert(b != NULL);
310 	p->len = sldns_buffer_limit(b);
311 	p->data = sldns_buffer_begin(b);
312 	*has = 1;
313 }
314 
315 static void
316 dt_msg_fill_net(struct dt_msg *dm,
317 		struct sockaddr_storage *ss,
318 		enum comm_point_type cptype,
319 		ProtobufCBinaryData *addr, protobuf_c_boolean *has_addr,
320 		uint32_t *port, protobuf_c_boolean *has_port)
321 {
322 	log_assert(ss->ss_family == AF_INET6 || ss->ss_family == AF_INET);
323 	if (ss->ss_family == AF_INET6) {
324 		struct sockaddr_in6 *s = (struct sockaddr_in6 *) ss;
325 
326 		/* socket_family */
327 		dm->m.socket_family = DNSTAP__SOCKET_FAMILY__INET6;
328 		dm->m.has_socket_family = 1;
329 
330 		/* addr: query_address or response_address */
331 		addr->data = s->sin6_addr.s6_addr;
332 		addr->len = 16; /* IPv6 */
333 		*has_addr = 1;
334 
335 		/* port: query_port or response_port */
336 		*port = ntohs(s->sin6_port);
337 		*has_port = 1;
338 	} else if (ss->ss_family == AF_INET) {
339 		struct sockaddr_in *s = (struct sockaddr_in *) ss;
340 
341 		/* socket_family */
342 		dm->m.socket_family = DNSTAP__SOCKET_FAMILY__INET;
343 		dm->m.has_socket_family = 1;
344 
345 		/* addr: query_address or response_address */
346 		addr->data = (uint8_t *) &s->sin_addr.s_addr;
347 		addr->len = 4; /* IPv4 */
348 		*has_addr = 1;
349 
350 		/* port: query_port or response_port */
351 		*port = ntohs(s->sin_port);
352 		*has_port = 1;
353 	}
354 
355 	log_assert(cptype == comm_udp || cptype == comm_tcp);
356 	if (cptype == comm_udp) {
357 		/* socket_protocol */
358 		dm->m.socket_protocol = DNSTAP__SOCKET_PROTOCOL__UDP;
359 		dm->m.has_socket_protocol = 1;
360 	} else if (cptype == comm_tcp) {
361 		/* socket_protocol */
362 		dm->m.socket_protocol = DNSTAP__SOCKET_PROTOCOL__TCP;
363 		dm->m.has_socket_protocol = 1;
364 	}
365 }
366 
367 void
368 dt_msg_send_client_query(struct dt_env *env,
369 			 struct sockaddr_storage *qsock,
370 			 enum comm_point_type cptype,
371 			 sldns_buffer *qmsg)
372 {
373 	struct dt_msg dm;
374 	struct timeval qtime;
375 
376 	gettimeofday(&qtime, NULL);
377 
378 	/* type */
379 	dt_msg_init(env, &dm, DNSTAP__MESSAGE__TYPE__CLIENT_QUERY);
380 
381 	/* query_time */
382 	dt_fill_timeval(&qtime,
383 			&dm.m.query_time_sec, &dm.m.has_query_time_sec,
384 			&dm.m.query_time_nsec, &dm.m.has_query_time_nsec);
385 
386 	/* query_message */
387 	dt_fill_buffer(qmsg, &dm.m.query_message, &dm.m.has_query_message);
388 
389 	/* socket_family, socket_protocol, query_address, query_port */
390 	log_assert(cptype == comm_udp || cptype == comm_tcp);
391 	dt_msg_fill_net(&dm, qsock, cptype,
392 			&dm.m.query_address, &dm.m.has_query_address,
393 			&dm.m.query_port, &dm.m.has_query_port);
394 
395 	if (dt_pack(&dm.d, &dm.buf, &dm.len_buf))
396 		dt_send(env, dm.buf, dm.len_buf);
397 }
398 
399 void
400 dt_msg_send_client_response(struct dt_env *env,
401 			    struct sockaddr_storage *qsock,
402 			    enum comm_point_type cptype,
403 			    sldns_buffer *rmsg)
404 {
405 	struct dt_msg dm;
406 	struct timeval rtime;
407 
408 	gettimeofday(&rtime, NULL);
409 
410 	/* type */
411 	dt_msg_init(env, &dm, DNSTAP__MESSAGE__TYPE__CLIENT_RESPONSE);
412 
413 	/* response_time */
414 	dt_fill_timeval(&rtime,
415 			&dm.m.response_time_sec, &dm.m.has_response_time_sec,
416 			&dm.m.response_time_nsec, &dm.m.has_response_time_nsec);
417 
418 	/* response_message */
419 	dt_fill_buffer(rmsg, &dm.m.response_message, &dm.m.has_response_message);
420 
421 	/* socket_family, socket_protocol, query_address, query_port */
422 	log_assert(cptype == comm_udp || cptype == comm_tcp);
423 	dt_msg_fill_net(&dm, qsock, cptype,
424 			&dm.m.query_address, &dm.m.has_query_address,
425 			&dm.m.query_port, &dm.m.has_query_port);
426 
427 	if (dt_pack(&dm.d, &dm.buf, &dm.len_buf))
428 		dt_send(env, dm.buf, dm.len_buf);
429 }
430 
431 void
432 dt_msg_send_outside_query(struct dt_env *env,
433 			  struct sockaddr_storage *rsock,
434 			  enum comm_point_type cptype,
435 			  uint8_t *zone, size_t zone_len,
436 			  sldns_buffer *qmsg)
437 {
438 	struct dt_msg dm;
439 	struct timeval qtime;
440 	uint16_t qflags;
441 
442 	gettimeofday(&qtime, NULL);
443 	qflags = sldns_buffer_read_u16_at(qmsg, 2);
444 
445 	/* type */
446 	if (qflags & BIT_RD) {
447 		if (!env->log_forwarder_query_messages)
448 			return;
449 		dt_msg_init(env, &dm, DNSTAP__MESSAGE__TYPE__FORWARDER_QUERY);
450 	} else {
451 		if (!env->log_resolver_query_messages)
452 			return;
453 		dt_msg_init(env, &dm, DNSTAP__MESSAGE__TYPE__RESOLVER_QUERY);
454 	}
455 
456 	/* query_zone */
457 	dm.m.query_zone.data = zone;
458 	dm.m.query_zone.len = zone_len;
459 	dm.m.has_query_zone = 1;
460 
461 	/* query_time_sec, query_time_nsec */
462 	dt_fill_timeval(&qtime,
463 			&dm.m.query_time_sec, &dm.m.has_query_time_sec,
464 			&dm.m.query_time_nsec, &dm.m.has_query_time_nsec);
465 
466 	/* query_message */
467 	dt_fill_buffer(qmsg, &dm.m.query_message, &dm.m.has_query_message);
468 
469 	/* socket_family, socket_protocol, response_address, response_port */
470 	log_assert(cptype == comm_udp || cptype == comm_tcp);
471 	dt_msg_fill_net(&dm, rsock, cptype,
472 			&dm.m.response_address, &dm.m.has_response_address,
473 			&dm.m.response_port, &dm.m.has_response_port);
474 
475 	if (dt_pack(&dm.d, &dm.buf, &dm.len_buf))
476 		dt_send(env, dm.buf, dm.len_buf);
477 }
478 
479 void
480 dt_msg_send_outside_response(struct dt_env *env,
481 			     struct sockaddr_storage *rsock,
482 			     enum comm_point_type cptype,
483 			     uint8_t *zone, size_t zone_len,
484 			     uint8_t *qbuf, size_t qbuf_len,
485 			     const struct timeval *qtime,
486 			     const struct timeval *rtime,
487 			     sldns_buffer *rmsg)
488 {
489 	struct dt_msg dm;
490 	uint16_t qflags;
491 
492 	log_assert(qbuf_len >= sizeof(qflags));
493 	memcpy(&qflags, qbuf, sizeof(qflags));
494 	qflags = ntohs(qflags);
495 
496 	/* type */
497 	if (qflags & BIT_RD) {
498 		if (!env->log_forwarder_response_messages)
499 			return;
500 		dt_msg_init(env, &dm, DNSTAP__MESSAGE__TYPE__FORWARDER_RESPONSE);
501 	} else {
502 		if (!env->log_resolver_response_messages)
503 			return;
504 		dt_msg_init(env, &dm, DNSTAP__MESSAGE__TYPE__RESOLVER_RESPONSE);
505 	}
506 
507 	/* query_zone */
508 	dm.m.query_zone.data = zone;
509 	dm.m.query_zone.len = zone_len;
510 	dm.m.has_query_zone = 1;
511 
512 	/* query_time_sec, query_time_nsec */
513 	dt_fill_timeval(qtime,
514 			&dm.m.query_time_sec, &dm.m.has_query_time_sec,
515 			&dm.m.query_time_nsec, &dm.m.has_query_time_nsec);
516 
517 	/* response_time_sec, response_time_nsec */
518 	dt_fill_timeval(rtime,
519 			&dm.m.response_time_sec, &dm.m.has_response_time_sec,
520 			&dm.m.response_time_nsec, &dm.m.has_response_time_nsec);
521 
522 	/* response_message */
523 	dt_fill_buffer(rmsg, &dm.m.response_message, &dm.m.has_response_message);
524 
525 	/* socket_family, socket_protocol, response_address, response_port */
526 	log_assert(cptype == comm_udp || cptype == comm_tcp);
527 	dt_msg_fill_net(&dm, rsock, cptype,
528 			&dm.m.response_address, &dm.m.has_response_address,
529 			&dm.m.response_port, &dm.m.has_response_port);
530 
531 	if (dt_pack(&dm.d, &dm.buf, &dm.len_buf))
532 		dt_send(env, dm.buf, dm.len_buf);
533 }
534 
535 #endif /* USE_DNSTAP */
536