1 /* dnstap support for Unbound */ 2 3 /* 4 * Copyright (c) 2013-2014, Farsight Security, Inc. 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 14 * 2. Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in the 16 * documentation and/or other materials provided with the distribution. 17 * 18 * 3. Neither the name of the copyright holder nor the names of its 19 * contributors may be used to endorse or promote products derived from 20 * this software without specific prior written permission. 21 * 22 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 23 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 24 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 25 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR 26 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, 27 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, 28 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; 29 * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, 30 * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR 31 * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF 32 * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 33 */ 34 35 #include "dnstap/dnstap_config.h" 36 37 #ifdef USE_DNSTAP 38 39 #include "config.h" 40 #include <string.h> 41 #include <sys/time.h> 42 #ifdef HAVE_SYS_STAT_H 43 #include <sys/stat.h> 44 #endif 45 #include <errno.h> 46 #include "sldns/sbuffer.h" 47 #include "util/config_file.h" 48 #include "util/net_help.h" 49 #include "util/netevent.h" 50 #include "util/log.h" 51 52 #include <protobuf-c/protobuf-c.h> 53 54 #include "dnstap/dnstap.h" 55 #include "dnstap/dtstream.h" 56 #include "dnstap/dnstap.pb-c.h" 57 58 #define DNSTAP_INITIAL_BUF_SIZE 256 59 60 struct dt_msg { 61 void *buf; 62 size_t len_buf; 63 Dnstap__Dnstap d; 64 Dnstap__Message m; 65 }; 66 67 static int 68 dt_pack(const Dnstap__Dnstap *d, void **buf, size_t *sz) 69 { 70 ProtobufCBufferSimple sbuf; 71 72 memset(&sbuf, 0, sizeof(sbuf)); 73 sbuf.base.append = protobuf_c_buffer_simple_append; 74 sbuf.len = 0; 75 sbuf.alloced = DNSTAP_INITIAL_BUF_SIZE; 76 sbuf.data = malloc(sbuf.alloced); 77 if (sbuf.data == NULL) 78 return 0; 79 sbuf.must_free_data = 1; 80 81 *sz = dnstap__dnstap__pack_to_buffer(d, (ProtobufCBuffer *) &sbuf); 82 if (sbuf.data == NULL) 83 return 0; 84 *buf = sbuf.data; 85 86 return 1; 87 } 88 89 static void 90 dt_send(const struct dt_env *env, void *buf, size_t len_buf) 91 { 92 dt_msg_queue_submit(env->msgqueue, buf, len_buf); 93 } 94 95 static void 96 dt_msg_init(const struct dt_env *env, 97 struct dt_msg *dm, 98 Dnstap__Message__Type mtype) 99 { 100 memset(dm, 0, sizeof(*dm)); 101 dm->d.base.descriptor = &dnstap__dnstap__descriptor; 102 dm->m.base.descriptor = &dnstap__message__descriptor; 103 dm->d.type = DNSTAP__DNSTAP__TYPE__MESSAGE; 104 dm->d.message = &dm->m; 105 dm->m.type = mtype; 106 if (env->identity != NULL) { 107 dm->d.identity.data = (uint8_t *) env->identity; 108 dm->d.identity.len = (size_t) env->len_identity; 109 dm->d.has_identity = 1; 110 } 111 if (env->version != NULL) { 112 dm->d.version.data = (uint8_t *) env->version; 113 dm->d.version.len = (size_t) env->len_version; 114 dm->d.has_version = 1; 115 } 116 } 117 118 /* check that the socket file can be opened and exists, print error if not */ 119 static void 120 check_socket_file(const char* socket_path) 121 { 122 struct stat statbuf; 123 memset(&statbuf, 0, sizeof(statbuf)); 124 if(stat(socket_path, &statbuf) < 0) { 125 log_warn("could not open dnstap-socket-path: %s, %s", 126 socket_path, strerror(errno)); 127 } 128 } 129 130 struct dt_env * 131 dt_create(struct config_file* cfg) 132 { 133 struct dt_env *env; 134 135 if(cfg->dnstap && cfg->dnstap_socket_path && cfg->dnstap_socket_path[0] && 136 (cfg->dnstap_ip==NULL || cfg->dnstap_ip[0]==0)) { 137 char* p = cfg->dnstap_socket_path; 138 if(cfg->chrootdir && cfg->chrootdir[0] && strncmp(p, 139 cfg->chrootdir, strlen(cfg->chrootdir)) == 0) 140 p += strlen(cfg->chrootdir); 141 verbose(VERB_OPS, "attempting to connect to dnstap socket %s", 142 p); 143 check_socket_file(p); 144 } 145 146 env = (struct dt_env *) calloc(1, sizeof(struct dt_env)); 147 if (!env) 148 return NULL; 149 150 env->dtio = dt_io_thread_create(); 151 if(!env->dtio) { 152 log_err("malloc failure"); 153 free(env); 154 return NULL; 155 } 156 if(!dt_io_thread_apply_cfg(env->dtio, cfg)) { 157 dt_io_thread_delete(env->dtio); 158 free(env); 159 return NULL; 160 } 161 dt_apply_cfg(env, cfg); 162 return env; 163 } 164 165 static void 166 dt_apply_identity(struct dt_env *env, struct config_file *cfg) 167 { 168 char buf[MAXHOSTNAMELEN+1]; 169 if (!cfg->dnstap_send_identity) 170 return; 171 free(env->identity); 172 if (cfg->dnstap_identity == NULL || cfg->dnstap_identity[0] == 0) { 173 if (gethostname(buf, MAXHOSTNAMELEN) == 0) { 174 buf[MAXHOSTNAMELEN] = 0; 175 env->identity = strdup(buf); 176 } else { 177 fatal_exit("dt_apply_identity: gethostname() failed"); 178 } 179 } else { 180 env->identity = strdup(cfg->dnstap_identity); 181 } 182 if (env->identity == NULL) 183 fatal_exit("dt_apply_identity: strdup() failed"); 184 env->len_identity = (unsigned int)strlen(env->identity); 185 verbose(VERB_OPS, "dnstap identity field set to \"%s\"", 186 env->identity); 187 } 188 189 static void 190 dt_apply_version(struct dt_env *env, struct config_file *cfg) 191 { 192 if (!cfg->dnstap_send_version) 193 return; 194 free(env->version); 195 if (cfg->dnstap_version == NULL || cfg->dnstap_version[0] == 0) 196 env->version = strdup(PACKAGE_STRING); 197 else 198 env->version = strdup(cfg->dnstap_version); 199 if (env->version == NULL) 200 fatal_exit("dt_apply_version: strdup() failed"); 201 env->len_version = (unsigned int)strlen(env->version); 202 verbose(VERB_OPS, "dnstap version field set to \"%s\"", 203 env->version); 204 } 205 206 void 207 dt_apply_cfg(struct dt_env *env, struct config_file *cfg) 208 { 209 if (!cfg->dnstap) 210 return; 211 212 dt_apply_identity(env, cfg); 213 dt_apply_version(env, cfg); 214 if ((env->log_resolver_query_messages = (unsigned int) 215 cfg->dnstap_log_resolver_query_messages)) 216 { 217 verbose(VERB_OPS, "dnstap Message/RESOLVER_QUERY enabled"); 218 } 219 if ((env->log_resolver_response_messages = (unsigned int) 220 cfg->dnstap_log_resolver_response_messages)) 221 { 222 verbose(VERB_OPS, "dnstap Message/RESOLVER_RESPONSE enabled"); 223 } 224 if ((env->log_client_query_messages = (unsigned int) 225 cfg->dnstap_log_client_query_messages)) 226 { 227 verbose(VERB_OPS, "dnstap Message/CLIENT_QUERY enabled"); 228 } 229 if ((env->log_client_response_messages = (unsigned int) 230 cfg->dnstap_log_client_response_messages)) 231 { 232 verbose(VERB_OPS, "dnstap Message/CLIENT_RESPONSE enabled"); 233 } 234 if ((env->log_forwarder_query_messages = (unsigned int) 235 cfg->dnstap_log_forwarder_query_messages)) 236 { 237 verbose(VERB_OPS, "dnstap Message/FORWARDER_QUERY enabled"); 238 } 239 if ((env->log_forwarder_response_messages = (unsigned int) 240 cfg->dnstap_log_forwarder_response_messages)) 241 { 242 verbose(VERB_OPS, "dnstap Message/FORWARDER_RESPONSE enabled"); 243 } 244 } 245 246 int 247 dt_init(struct dt_env *env, struct comm_base* base) 248 { 249 env->msgqueue = dt_msg_queue_create(base); 250 if(!env->msgqueue) { 251 log_err("malloc failure"); 252 return 0; 253 } 254 if(!dt_io_thread_register_queue(env->dtio, env->msgqueue)) { 255 log_err("malloc failure"); 256 dt_msg_queue_delete(env->msgqueue); 257 env->msgqueue = NULL; 258 return 0; 259 } 260 return 1; 261 } 262 263 void 264 dt_deinit(struct dt_env* env) 265 { 266 dt_io_thread_unregister_queue(env->dtio, env->msgqueue); 267 dt_msg_queue_delete(env->msgqueue); 268 } 269 270 void 271 dt_delete(struct dt_env *env) 272 { 273 if (!env) 274 return; 275 dt_io_thread_delete(env->dtio); 276 free(env->identity); 277 free(env->version); 278 free(env); 279 } 280 281 static void 282 dt_fill_timeval(const struct timeval *tv, 283 uint64_t *time_sec, protobuf_c_boolean *has_time_sec, 284 uint32_t *time_nsec, protobuf_c_boolean *has_time_nsec) 285 { 286 #ifndef S_SPLINT_S 287 *time_sec = tv->tv_sec; 288 *time_nsec = tv->tv_usec * 1000; 289 #endif 290 *has_time_sec = 1; 291 *has_time_nsec = 1; 292 } 293 294 static void 295 dt_fill_buffer(sldns_buffer *b, ProtobufCBinaryData *p, protobuf_c_boolean *has) 296 { 297 log_assert(b != NULL); 298 p->len = sldns_buffer_limit(b); 299 p->data = sldns_buffer_begin(b); 300 *has = 1; 301 } 302 303 static void 304 dt_msg_fill_net(struct dt_msg *dm, 305 struct sockaddr_storage *qs, 306 struct sockaddr_storage *rs, 307 enum comm_point_type cptype, 308 ProtobufCBinaryData *qaddr, protobuf_c_boolean *has_qaddr, 309 uint32_t *qport, protobuf_c_boolean *has_qport, 310 ProtobufCBinaryData *raddr, protobuf_c_boolean *has_raddr, 311 uint32_t *rport, protobuf_c_boolean *has_rport) 312 { 313 log_assert(qs->ss_family == AF_INET6 || qs->ss_family == AF_INET); 314 if (qs->ss_family == AF_INET6) { 315 struct sockaddr_in6 *q = (struct sockaddr_in6 *) qs; 316 317 /* socket_family */ 318 dm->m.socket_family = DNSTAP__SOCKET_FAMILY__INET6; 319 dm->m.has_socket_family = 1; 320 321 /* addr: query_address or response_address */ 322 qaddr->data = q->sin6_addr.s6_addr; 323 qaddr->len = 16; /* IPv6 */ 324 *has_qaddr = 1; 325 326 /* port: query_port or response_port */ 327 *qport = ntohs(q->sin6_port); 328 *has_qport = 1; 329 } else if (qs->ss_family == AF_INET) { 330 struct sockaddr_in *q = (struct sockaddr_in *) qs; 331 332 /* socket_family */ 333 dm->m.socket_family = DNSTAP__SOCKET_FAMILY__INET; 334 dm->m.has_socket_family = 1; 335 336 /* addr: query_address or response_address */ 337 qaddr->data = (uint8_t *) &q->sin_addr.s_addr; 338 qaddr->len = 4; /* IPv4 */ 339 *has_qaddr = 1; 340 341 /* port: query_port or response_port */ 342 *qport = ntohs(q->sin_port); 343 *has_qport = 1; 344 } 345 346 /* 347 * This block is to fill second set of fields in DNSTAP-message defined as request_/response_ names. 348 * Additional responsive structure is: struct sockaddr_storage *rs 349 */ 350 if (rs && rs->ss_family == AF_INET6) { 351 struct sockaddr_in6 *r = (struct sockaddr_in6 *) rs; 352 353 /* addr: query_address or response_address */ 354 raddr->data = r->sin6_addr.s6_addr; 355 raddr->len = 16; /* IPv6 */ 356 *has_raddr = 1; 357 358 /* port: query_port or response_port */ 359 *rport = ntohs(r->sin6_port); 360 *has_rport = 1; 361 } else if (rs && rs->ss_family == AF_INET) { 362 struct sockaddr_in *r = (struct sockaddr_in *) rs; 363 364 /* addr: query_address or response_address */ 365 raddr->data = (uint8_t *) &r->sin_addr.s_addr; 366 raddr->len = 4; /* IPv4 */ 367 *has_raddr = 1; 368 369 /* port: query_port or response_port */ 370 *rport = ntohs(r->sin_port); 371 *has_rport = 1; 372 } 373 374 log_assert(cptype == comm_udp || cptype == comm_tcp); 375 if (cptype == comm_udp) { 376 /* socket_protocol */ 377 dm->m.socket_protocol = DNSTAP__SOCKET_PROTOCOL__UDP; 378 dm->m.has_socket_protocol = 1; 379 } else if (cptype == comm_tcp) { 380 /* socket_protocol */ 381 dm->m.socket_protocol = DNSTAP__SOCKET_PROTOCOL__TCP; 382 dm->m.has_socket_protocol = 1; 383 } 384 } 385 386 void 387 dt_msg_send_client_query(struct dt_env *env, 388 struct sockaddr_storage *qsock, 389 struct sockaddr_storage *rsock, 390 enum comm_point_type cptype, 391 sldns_buffer *qmsg) 392 { 393 struct dt_msg dm; 394 struct timeval qtime; 395 396 gettimeofday(&qtime, NULL); 397 398 /* type */ 399 dt_msg_init(env, &dm, DNSTAP__MESSAGE__TYPE__CLIENT_QUERY); 400 401 /* query_time */ 402 dt_fill_timeval(&qtime, 403 &dm.m.query_time_sec, &dm.m.has_query_time_sec, 404 &dm.m.query_time_nsec, &dm.m.has_query_time_nsec); 405 406 /* query_message */ 407 dt_fill_buffer(qmsg, &dm.m.query_message, &dm.m.has_query_message); 408 409 /* socket_family, socket_protocol, query_address, query_port, response_address, response_port */ 410 log_assert(cptype == comm_udp || cptype == comm_tcp); 411 dt_msg_fill_net(&dm, qsock, rsock, cptype, 412 &dm.m.query_address, &dm.m.has_query_address, 413 &dm.m.query_port, &dm.m.has_query_port, 414 &dm.m.response_address, &dm.m.has_response_address, 415 &dm.m.response_port, &dm.m.has_response_port); 416 417 418 if (dt_pack(&dm.d, &dm.buf, &dm.len_buf)) 419 dt_send(env, dm.buf, dm.len_buf); 420 } 421 422 void 423 dt_msg_send_client_response(struct dt_env *env, 424 struct sockaddr_storage *qsock, 425 struct sockaddr_storage *rsock, 426 enum comm_point_type cptype, 427 sldns_buffer *rmsg) 428 { 429 struct dt_msg dm; 430 struct timeval rtime; 431 432 gettimeofday(&rtime, NULL); 433 434 /* type */ 435 dt_msg_init(env, &dm, DNSTAP__MESSAGE__TYPE__CLIENT_RESPONSE); 436 437 /* response_time */ 438 dt_fill_timeval(&rtime, 439 &dm.m.response_time_sec, &dm.m.has_response_time_sec, 440 &dm.m.response_time_nsec, &dm.m.has_response_time_nsec); 441 442 /* response_message */ 443 dt_fill_buffer(rmsg, &dm.m.response_message, &dm.m.has_response_message); 444 445 /* socket_family, socket_protocol, query_address, query_port, response_address, response_port */ 446 log_assert(cptype == comm_udp || cptype == comm_tcp); 447 dt_msg_fill_net(&dm, qsock, rsock, cptype, 448 &dm.m.query_address, &dm.m.has_query_address, 449 &dm.m.query_port, &dm.m.has_query_port, 450 &dm.m.response_address, &dm.m.has_response_address, 451 &dm.m.response_port, &dm.m.has_response_port); 452 453 if (dt_pack(&dm.d, &dm.buf, &dm.len_buf)) 454 dt_send(env, dm.buf, dm.len_buf); 455 } 456 457 void 458 dt_msg_send_outside_query(struct dt_env *env, 459 struct sockaddr_storage *rsock, 460 struct sockaddr_storage *qsock, 461 enum comm_point_type cptype, 462 uint8_t *zone, size_t zone_len, 463 sldns_buffer *qmsg) 464 { 465 struct dt_msg dm; 466 struct timeval qtime; 467 uint16_t qflags; 468 469 gettimeofday(&qtime, NULL); 470 qflags = sldns_buffer_read_u16_at(qmsg, 2); 471 472 /* type */ 473 if (qflags & BIT_RD) { 474 if (!env->log_forwarder_query_messages) 475 return; 476 dt_msg_init(env, &dm, DNSTAP__MESSAGE__TYPE__FORWARDER_QUERY); 477 } else { 478 if (!env->log_resolver_query_messages) 479 return; 480 dt_msg_init(env, &dm, DNSTAP__MESSAGE__TYPE__RESOLVER_QUERY); 481 } 482 483 /* query_zone */ 484 dm.m.query_zone.data = zone; 485 dm.m.query_zone.len = zone_len; 486 dm.m.has_query_zone = 1; 487 488 /* query_time_sec, query_time_nsec */ 489 dt_fill_timeval(&qtime, 490 &dm.m.query_time_sec, &dm.m.has_query_time_sec, 491 &dm.m.query_time_nsec, &dm.m.has_query_time_nsec); 492 493 /* query_message */ 494 dt_fill_buffer(qmsg, &dm.m.query_message, &dm.m.has_query_message); 495 496 /* socket_family, socket_protocol, response_address, response_port, query_address, query_port */ 497 log_assert(cptype == comm_udp || cptype == comm_tcp); 498 dt_msg_fill_net(&dm, rsock, qsock, cptype, 499 &dm.m.response_address, &dm.m.has_response_address, 500 &dm.m.response_port, &dm.m.has_response_port, 501 &dm.m.query_address, &dm.m.has_query_address, 502 &dm.m.query_port, &dm.m.has_query_port); 503 504 if (dt_pack(&dm.d, &dm.buf, &dm.len_buf)) 505 dt_send(env, dm.buf, dm.len_buf); 506 } 507 508 void 509 dt_msg_send_outside_response(struct dt_env *env, 510 struct sockaddr_storage *rsock, 511 struct sockaddr_storage *qsock, 512 enum comm_point_type cptype, 513 uint8_t *zone, size_t zone_len, 514 uint8_t *qbuf, size_t qbuf_len, 515 const struct timeval *qtime, 516 const struct timeval *rtime, 517 sldns_buffer *rmsg) 518 { 519 struct dt_msg dm; 520 uint16_t qflags; 521 522 (void)qbuf_len; log_assert(qbuf_len >= sizeof(qflags)); 523 memcpy(&qflags, qbuf, sizeof(qflags)); 524 qflags = ntohs(qflags); 525 526 /* type */ 527 if (qflags & BIT_RD) { 528 if (!env->log_forwarder_response_messages) 529 return; 530 dt_msg_init(env, &dm, DNSTAP__MESSAGE__TYPE__FORWARDER_RESPONSE); 531 } else { 532 if (!env->log_resolver_response_messages) 533 return; 534 dt_msg_init(env, &dm, DNSTAP__MESSAGE__TYPE__RESOLVER_RESPONSE); 535 } 536 537 /* query_zone */ 538 dm.m.query_zone.data = zone; 539 dm.m.query_zone.len = zone_len; 540 dm.m.has_query_zone = 1; 541 542 /* query_time_sec, query_time_nsec */ 543 dt_fill_timeval(qtime, 544 &dm.m.query_time_sec, &dm.m.has_query_time_sec, 545 &dm.m.query_time_nsec, &dm.m.has_query_time_nsec); 546 547 /* response_time_sec, response_time_nsec */ 548 dt_fill_timeval(rtime, 549 &dm.m.response_time_sec, &dm.m.has_response_time_sec, 550 &dm.m.response_time_nsec, &dm.m.has_response_time_nsec); 551 552 /* response_message */ 553 dt_fill_buffer(rmsg, &dm.m.response_message, &dm.m.has_response_message); 554 555 /* socket_family, socket_protocol, response_address, response_port, query_address, query_port */ 556 log_assert(cptype == comm_udp || cptype == comm_tcp); 557 dt_msg_fill_net(&dm, rsock, qsock, cptype, 558 &dm.m.response_address, &dm.m.has_response_address, 559 &dm.m.response_port, &dm.m.has_response_port, 560 &dm.m.query_address, &dm.m.has_query_address, 561 &dm.m.query_port, &dm.m.has_query_port); 562 563 if (dt_pack(&dm.d, &dm.buf, &dm.len_buf)) 564 dt_send(env, dm.buf, dm.len_buf); 565 } 566 567 #endif /* USE_DNSTAP */ 568