1 /* dnstap support for Unbound */ 2 3 /* 4 * Copyright (c) 2013-2014, Farsight Security, Inc. 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 14 * 2. Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in the 16 * documentation and/or other materials provided with the distribution. 17 * 18 * 3. Neither the name of the copyright holder nor the names of its 19 * contributors may be used to endorse or promote products derived from 20 * this software without specific prior written permission. 21 * 22 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 23 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 24 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 25 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR 26 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, 27 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, 28 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; 29 * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, 30 * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR 31 * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF 32 * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 33 */ 34 35 #include "dnstap/dnstap_config.h" 36 37 #ifdef USE_DNSTAP 38 39 #include "config.h" 40 #include <string.h> 41 #include <sys/time.h> 42 #ifdef HAVE_SYS_STAT_H 43 #include <sys/stat.h> 44 #endif 45 #include <errno.h> 46 #include "sldns/sbuffer.h" 47 #include "util/config_file.h" 48 #include "util/net_help.h" 49 #include "util/netevent.h" 50 #include "util/log.h" 51 52 #include <protobuf-c/protobuf-c.h> 53 54 #include "dnstap/dnstap.h" 55 #include "dnstap/dtstream.h" 56 #include "dnstap/dnstap.pb-c.h" 57 58 #define DNSTAP_INITIAL_BUF_SIZE 256 59 60 struct dt_msg { 61 void *buf; 62 size_t len_buf; 63 Dnstap__Dnstap d; 64 Dnstap__Message m; 65 }; 66 67 static int 68 dt_pack(const Dnstap__Dnstap *d, void **buf, size_t *sz) 69 { 70 ProtobufCBufferSimple sbuf; 71 72 memset(&sbuf, 0, sizeof(sbuf)); 73 sbuf.base.append = protobuf_c_buffer_simple_append; 74 sbuf.len = 0; 75 sbuf.alloced = DNSTAP_INITIAL_BUF_SIZE; 76 sbuf.data = malloc(sbuf.alloced); 77 if (sbuf.data == NULL) 78 return 0; 79 sbuf.must_free_data = 1; 80 81 *sz = dnstap__dnstap__pack_to_buffer(d, (ProtobufCBuffer *) &sbuf); 82 if (sbuf.data == NULL) 83 return 0; 84 *buf = sbuf.data; 85 86 return 1; 87 } 88 89 static void 90 dt_send(const struct dt_env *env, void *buf, size_t len_buf) 91 { 92 dt_msg_queue_submit(env->msgqueue, buf, len_buf); 93 } 94 95 static void 96 dt_msg_init(const struct dt_env *env, 97 struct dt_msg *dm, 98 Dnstap__Message__Type mtype) 99 { 100 memset(dm, 0, sizeof(*dm)); 101 dm->d.base.descriptor = &dnstap__dnstap__descriptor; 102 dm->m.base.descriptor = &dnstap__message__descriptor; 103 dm->d.type = DNSTAP__DNSTAP__TYPE__MESSAGE; 104 dm->d.message = &dm->m; 105 dm->m.type = mtype; 106 if (env->identity != NULL) { 107 dm->d.identity.data = (uint8_t *) env->identity; 108 dm->d.identity.len = (size_t) env->len_identity; 109 dm->d.has_identity = 1; 110 } 111 if (env->version != NULL) { 112 dm->d.version.data = (uint8_t *) env->version; 113 dm->d.version.len = (size_t) env->len_version; 114 dm->d.has_version = 1; 115 } 116 } 117 118 /* check that the socket file can be opened and exists, print error if not */ 119 static void 120 check_socket_file(const char* socket_path) 121 { 122 struct stat statbuf; 123 memset(&statbuf, 0, sizeof(statbuf)); 124 if(stat(socket_path, &statbuf) < 0) { 125 log_warn("could not open dnstap-socket-path: %s, %s", 126 socket_path, strerror(errno)); 127 } 128 } 129 130 struct dt_env * 131 dt_create(struct config_file* cfg) 132 { 133 struct dt_env *env; 134 135 if(cfg->dnstap && cfg->dnstap_socket_path && cfg->dnstap_socket_path[0] && 136 (cfg->dnstap_ip==NULL || cfg->dnstap_ip[0]==0)) { 137 char* p = cfg->dnstap_socket_path; 138 if(cfg->chrootdir && cfg->chrootdir[0] && strncmp(p, 139 cfg->chrootdir, strlen(cfg->chrootdir)) == 0) 140 p += strlen(cfg->chrootdir); 141 verbose(VERB_OPS, "attempting to connect to dnstap socket %s", 142 p); 143 check_socket_file(p); 144 } 145 146 env = (struct dt_env *) calloc(1, sizeof(struct dt_env)); 147 if (!env) 148 return NULL; 149 150 env->dtio = dt_io_thread_create(); 151 if(!env->dtio) { 152 log_err("malloc failure"); 153 free(env); 154 return NULL; 155 } 156 if(!dt_io_thread_apply_cfg(env->dtio, cfg)) { 157 dt_io_thread_delete(env->dtio); 158 free(env); 159 return NULL; 160 } 161 dt_apply_cfg(env, cfg); 162 return env; 163 } 164 165 static void 166 dt_apply_identity(struct dt_env *env, struct config_file *cfg) 167 { 168 char buf[MAXHOSTNAMELEN+1]; 169 if (!cfg->dnstap_send_identity) 170 return; 171 free(env->identity); 172 if (cfg->dnstap_identity == NULL || cfg->dnstap_identity[0] == 0) { 173 if (gethostname(buf, MAXHOSTNAMELEN) == 0) { 174 buf[MAXHOSTNAMELEN] = 0; 175 env->identity = strdup(buf); 176 } else { 177 fatal_exit("dt_apply_identity: gethostname() failed"); 178 } 179 } else { 180 env->identity = strdup(cfg->dnstap_identity); 181 } 182 if (env->identity == NULL) 183 fatal_exit("dt_apply_identity: strdup() failed"); 184 env->len_identity = (unsigned int)strlen(env->identity); 185 verbose(VERB_OPS, "dnstap identity field set to \"%s\"", 186 env->identity); 187 } 188 189 static void 190 dt_apply_version(struct dt_env *env, struct config_file *cfg) 191 { 192 if (!cfg->dnstap_send_version) 193 return; 194 free(env->version); 195 if (cfg->dnstap_version == NULL || cfg->dnstap_version[0] == 0) 196 env->version = strdup(PACKAGE_STRING); 197 else 198 env->version = strdup(cfg->dnstap_version); 199 if (env->version == NULL) 200 fatal_exit("dt_apply_version: strdup() failed"); 201 env->len_version = (unsigned int)strlen(env->version); 202 verbose(VERB_OPS, "dnstap version field set to \"%s\"", 203 env->version); 204 } 205 206 void 207 dt_apply_cfg(struct dt_env *env, struct config_file *cfg) 208 { 209 if (!cfg->dnstap) 210 return; 211 212 dt_apply_identity(env, cfg); 213 dt_apply_version(env, cfg); 214 if ((env->log_resolver_query_messages = (unsigned int) 215 cfg->dnstap_log_resolver_query_messages)) 216 { 217 verbose(VERB_OPS, "dnstap Message/RESOLVER_QUERY enabled"); 218 } 219 if ((env->log_resolver_response_messages = (unsigned int) 220 cfg->dnstap_log_resolver_response_messages)) 221 { 222 verbose(VERB_OPS, "dnstap Message/RESOLVER_RESPONSE enabled"); 223 } 224 if ((env->log_client_query_messages = (unsigned int) 225 cfg->dnstap_log_client_query_messages)) 226 { 227 verbose(VERB_OPS, "dnstap Message/CLIENT_QUERY enabled"); 228 } 229 if ((env->log_client_response_messages = (unsigned int) 230 cfg->dnstap_log_client_response_messages)) 231 { 232 verbose(VERB_OPS, "dnstap Message/CLIENT_RESPONSE enabled"); 233 } 234 if ((env->log_forwarder_query_messages = (unsigned int) 235 cfg->dnstap_log_forwarder_query_messages)) 236 { 237 verbose(VERB_OPS, "dnstap Message/FORWARDER_QUERY enabled"); 238 } 239 if ((env->log_forwarder_response_messages = (unsigned int) 240 cfg->dnstap_log_forwarder_response_messages)) 241 { 242 verbose(VERB_OPS, "dnstap Message/FORWARDER_RESPONSE enabled"); 243 } 244 } 245 246 int 247 dt_init(struct dt_env *env, struct comm_base* base) 248 { 249 env->msgqueue = dt_msg_queue_create(base); 250 if(!env->msgqueue) { 251 log_err("malloc failure"); 252 return 0; 253 } 254 if(!dt_io_thread_register_queue(env->dtio, env->msgqueue)) { 255 log_err("malloc failure"); 256 dt_msg_queue_delete(env->msgqueue); 257 env->msgqueue = NULL; 258 return 0; 259 } 260 return 1; 261 } 262 263 void 264 dt_deinit(struct dt_env* env) 265 { 266 dt_io_thread_unregister_queue(env->dtio, env->msgqueue); 267 dt_msg_queue_delete(env->msgqueue); 268 } 269 270 void 271 dt_delete(struct dt_env *env) 272 { 273 if (!env) 274 return; 275 dt_io_thread_delete(env->dtio); 276 free(env->identity); 277 free(env->version); 278 free(env); 279 } 280 281 static void 282 dt_fill_timeval(const struct timeval *tv, 283 uint64_t *time_sec, protobuf_c_boolean *has_time_sec, 284 uint32_t *time_nsec, protobuf_c_boolean *has_time_nsec) 285 { 286 #ifndef S_SPLINT_S 287 *time_sec = tv->tv_sec; 288 *time_nsec = tv->tv_usec * 1000; 289 #endif 290 *has_time_sec = 1; 291 *has_time_nsec = 1; 292 } 293 294 static void 295 dt_fill_buffer(sldns_buffer *b, ProtobufCBinaryData *p, protobuf_c_boolean *has) 296 { 297 log_assert(b != NULL); 298 p->len = sldns_buffer_limit(b); 299 p->data = sldns_buffer_begin(b); 300 *has = 1; 301 } 302 303 static void 304 dt_msg_fill_net(struct dt_msg *dm, 305 struct sockaddr_storage *qs, 306 struct sockaddr_storage *rs, 307 enum comm_point_type cptype, 308 ProtobufCBinaryData *qaddr, protobuf_c_boolean *has_qaddr, 309 uint32_t *qport, protobuf_c_boolean *has_qport, 310 ProtobufCBinaryData *raddr, protobuf_c_boolean *has_raddr, 311 uint32_t *rport, protobuf_c_boolean *has_rport) 312 { 313 log_assert(qs->ss_family == AF_INET6 || qs->ss_family == AF_INET); 314 if (qs->ss_family == AF_INET6) { 315 struct sockaddr_in6 *q = (struct sockaddr_in6 *) qs; 316 317 /* socket_family */ 318 dm->m.socket_family = DNSTAP__SOCKET_FAMILY__INET6; 319 dm->m.has_socket_family = 1; 320 321 /* addr: query_address or response_address */ 322 qaddr->data = q->sin6_addr.s6_addr; 323 qaddr->len = 16; /* IPv6 */ 324 *has_qaddr = 1; 325 326 /* port: query_port or response_port */ 327 *qport = ntohs(q->sin6_port); 328 *has_qport = 1; 329 } else if (qs->ss_family == AF_INET) { 330 struct sockaddr_in *q = (struct sockaddr_in *) qs; 331 332 /* socket_family */ 333 dm->m.socket_family = DNSTAP__SOCKET_FAMILY__INET; 334 dm->m.has_socket_family = 1; 335 336 /* addr: query_address or response_address */ 337 qaddr->data = (uint8_t *) &q->sin_addr.s_addr; 338 qaddr->len = 4; /* IPv4 */ 339 *has_qaddr = 1; 340 341 /* port: query_port or response_port */ 342 *qport = ntohs(q->sin_port); 343 *has_qport = 1; 344 } 345 346 /* 347 * This block is to fill second set of fields in DNSTAP-message defined as request_/response_ names. 348 * Additional responsive structure is: struct sockaddr_storage *rs 349 */ 350 if (rs && rs->ss_family == AF_INET6) { 351 struct sockaddr_in6 *r = (struct sockaddr_in6 *) rs; 352 353 /* addr: query_address or response_address */ 354 raddr->data = r->sin6_addr.s6_addr; 355 raddr->len = 16; /* IPv6 */ 356 *has_raddr = 1; 357 358 /* port: query_port or response_port */ 359 *rport = ntohs(r->sin6_port); 360 *has_rport = 1; 361 } else if (rs && rs->ss_family == AF_INET) { 362 struct sockaddr_in *r = (struct sockaddr_in *) rs; 363 364 /* addr: query_address or response_address */ 365 raddr->data = (uint8_t *) &r->sin_addr.s_addr; 366 raddr->len = 4; /* IPv4 */ 367 *has_raddr = 1; 368 369 /* port: query_port or response_port */ 370 *rport = ntohs(r->sin_port); 371 *has_rport = 1; 372 } 373 374 log_assert(cptype == comm_udp || cptype == comm_tcp); 375 if (cptype == comm_udp) { 376 /* socket_protocol */ 377 dm->m.socket_protocol = DNSTAP__SOCKET_PROTOCOL__UDP; 378 dm->m.has_socket_protocol = 1; 379 } else if (cptype == comm_tcp) { 380 /* socket_protocol */ 381 dm->m.socket_protocol = DNSTAP__SOCKET_PROTOCOL__TCP; 382 dm->m.has_socket_protocol = 1; 383 } 384 } 385 386 void 387 dt_msg_send_client_query(struct dt_env *env, 388 struct sockaddr_storage *qsock, 389 struct sockaddr_storage *rsock, 390 enum comm_point_type cptype, 391 sldns_buffer *qmsg, 392 struct timeval* tstamp) 393 { 394 struct dt_msg dm; 395 struct timeval qtime; 396 397 if(tstamp) 398 memcpy(&qtime, tstamp, sizeof(qtime)); 399 else gettimeofday(&qtime, NULL); 400 401 /* type */ 402 dt_msg_init(env, &dm, DNSTAP__MESSAGE__TYPE__CLIENT_QUERY); 403 404 /* query_time */ 405 dt_fill_timeval(&qtime, 406 &dm.m.query_time_sec, &dm.m.has_query_time_sec, 407 &dm.m.query_time_nsec, &dm.m.has_query_time_nsec); 408 409 /* query_message */ 410 dt_fill_buffer(qmsg, &dm.m.query_message, &dm.m.has_query_message); 411 412 /* socket_family, socket_protocol, query_address, query_port, response_address, response_port */ 413 log_assert(cptype == comm_udp || cptype == comm_tcp); 414 dt_msg_fill_net(&dm, qsock, rsock, cptype, 415 &dm.m.query_address, &dm.m.has_query_address, 416 &dm.m.query_port, &dm.m.has_query_port, 417 &dm.m.response_address, &dm.m.has_response_address, 418 &dm.m.response_port, &dm.m.has_response_port); 419 420 421 if (dt_pack(&dm.d, &dm.buf, &dm.len_buf)) 422 dt_send(env, dm.buf, dm.len_buf); 423 } 424 425 void 426 dt_msg_send_client_response(struct dt_env *env, 427 struct sockaddr_storage *qsock, 428 struct sockaddr_storage *rsock, 429 enum comm_point_type cptype, 430 sldns_buffer *rmsg) 431 { 432 struct dt_msg dm; 433 struct timeval rtime; 434 435 gettimeofday(&rtime, NULL); 436 437 /* type */ 438 dt_msg_init(env, &dm, DNSTAP__MESSAGE__TYPE__CLIENT_RESPONSE); 439 440 /* response_time */ 441 dt_fill_timeval(&rtime, 442 &dm.m.response_time_sec, &dm.m.has_response_time_sec, 443 &dm.m.response_time_nsec, &dm.m.has_response_time_nsec); 444 445 /* response_message */ 446 dt_fill_buffer(rmsg, &dm.m.response_message, &dm.m.has_response_message); 447 448 /* socket_family, socket_protocol, query_address, query_port, response_address, response_port */ 449 log_assert(cptype == comm_udp || cptype == comm_tcp); 450 dt_msg_fill_net(&dm, qsock, rsock, cptype, 451 &dm.m.query_address, &dm.m.has_query_address, 452 &dm.m.query_port, &dm.m.has_query_port, 453 &dm.m.response_address, &dm.m.has_response_address, 454 &dm.m.response_port, &dm.m.has_response_port); 455 456 if (dt_pack(&dm.d, &dm.buf, &dm.len_buf)) 457 dt_send(env, dm.buf, dm.len_buf); 458 } 459 460 void 461 dt_msg_send_outside_query(struct dt_env *env, 462 struct sockaddr_storage *rsock, 463 struct sockaddr_storage *qsock, 464 enum comm_point_type cptype, 465 uint8_t *zone, size_t zone_len, 466 sldns_buffer *qmsg) 467 { 468 struct dt_msg dm; 469 struct timeval qtime; 470 uint16_t qflags; 471 472 gettimeofday(&qtime, NULL); 473 qflags = sldns_buffer_read_u16_at(qmsg, 2); 474 475 /* type */ 476 if (qflags & BIT_RD) { 477 if (!env->log_forwarder_query_messages) 478 return; 479 dt_msg_init(env, &dm, DNSTAP__MESSAGE__TYPE__FORWARDER_QUERY); 480 } else { 481 if (!env->log_resolver_query_messages) 482 return; 483 dt_msg_init(env, &dm, DNSTAP__MESSAGE__TYPE__RESOLVER_QUERY); 484 } 485 486 /* query_zone */ 487 dm.m.query_zone.data = zone; 488 dm.m.query_zone.len = zone_len; 489 dm.m.has_query_zone = 1; 490 491 /* query_time_sec, query_time_nsec */ 492 dt_fill_timeval(&qtime, 493 &dm.m.query_time_sec, &dm.m.has_query_time_sec, 494 &dm.m.query_time_nsec, &dm.m.has_query_time_nsec); 495 496 /* query_message */ 497 dt_fill_buffer(qmsg, &dm.m.query_message, &dm.m.has_query_message); 498 499 /* socket_family, socket_protocol, response_address, response_port, query_address, query_port */ 500 log_assert(cptype == comm_udp || cptype == comm_tcp); 501 dt_msg_fill_net(&dm, rsock, qsock, cptype, 502 &dm.m.response_address, &dm.m.has_response_address, 503 &dm.m.response_port, &dm.m.has_response_port, 504 &dm.m.query_address, &dm.m.has_query_address, 505 &dm.m.query_port, &dm.m.has_query_port); 506 507 if (dt_pack(&dm.d, &dm.buf, &dm.len_buf)) 508 dt_send(env, dm.buf, dm.len_buf); 509 } 510 511 void 512 dt_msg_send_outside_response(struct dt_env *env, 513 struct sockaddr_storage *rsock, 514 struct sockaddr_storage *qsock, 515 enum comm_point_type cptype, 516 uint8_t *zone, size_t zone_len, 517 uint8_t *qbuf, size_t qbuf_len, 518 const struct timeval *qtime, 519 const struct timeval *rtime, 520 sldns_buffer *rmsg) 521 { 522 struct dt_msg dm; 523 uint16_t qflags; 524 525 (void)qbuf_len; log_assert(qbuf_len >= sizeof(qflags)); 526 memcpy(&qflags, qbuf, sizeof(qflags)); 527 qflags = ntohs(qflags); 528 529 /* type */ 530 if (qflags & BIT_RD) { 531 if (!env->log_forwarder_response_messages) 532 return; 533 dt_msg_init(env, &dm, DNSTAP__MESSAGE__TYPE__FORWARDER_RESPONSE); 534 } else { 535 if (!env->log_resolver_response_messages) 536 return; 537 dt_msg_init(env, &dm, DNSTAP__MESSAGE__TYPE__RESOLVER_RESPONSE); 538 } 539 540 /* query_zone */ 541 dm.m.query_zone.data = zone; 542 dm.m.query_zone.len = zone_len; 543 dm.m.has_query_zone = 1; 544 545 /* query_time_sec, query_time_nsec */ 546 dt_fill_timeval(qtime, 547 &dm.m.query_time_sec, &dm.m.has_query_time_sec, 548 &dm.m.query_time_nsec, &dm.m.has_query_time_nsec); 549 550 /* response_time_sec, response_time_nsec */ 551 dt_fill_timeval(rtime, 552 &dm.m.response_time_sec, &dm.m.has_response_time_sec, 553 &dm.m.response_time_nsec, &dm.m.has_response_time_nsec); 554 555 /* response_message */ 556 dt_fill_buffer(rmsg, &dm.m.response_message, &dm.m.has_response_message); 557 558 /* socket_family, socket_protocol, response_address, response_port, query_address, query_port */ 559 log_assert(cptype == comm_udp || cptype == comm_tcp); 560 dt_msg_fill_net(&dm, rsock, qsock, cptype, 561 &dm.m.response_address, &dm.m.has_response_address, 562 &dm.m.response_port, &dm.m.has_response_port, 563 &dm.m.query_address, &dm.m.has_query_address, 564 &dm.m.query_port, &dm.m.has_query_port); 565 566 if (dt_pack(&dm.d, &dm.buf, &dm.len_buf)) 567 dt_send(env, dm.buf, dm.len_buf); 568 } 569 570 #endif /* USE_DNSTAP */ 571