xref: /freebsd/contrib/unbound/dnstap/dnstap.c (revision fe815331bb40604ba31312acf7e4619674631777)
1 /* dnstap support for Unbound */
2 
3 /*
4  * Copyright (c) 2013-2014, Farsight Security, Inc.
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  *
11  * 1. Redistributions of source code must retain the above copyright
12  * notice, this list of conditions and the following disclaimer.
13  *
14  * 2. Redistributions in binary form must reproduce the above copyright
15  * notice, this list of conditions and the following disclaimer in the
16  * documentation and/or other materials provided with the distribution.
17  *
18  * 3. Neither the name of the copyright holder nor the names of its
19  * contributors may be used to endorse or promote products derived from
20  * this software without specific prior written permission.
21  *
22  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
23  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
24  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
25  * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR
26  * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
27  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
28  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
29  * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
30  * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
31  * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
32  * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
33  */
34 
35 #include "dnstap/dnstap_config.h"
36 
37 #ifdef USE_DNSTAP
38 
39 #include "config.h"
40 #include <string.h>
41 #include <sys/time.h>
42 #ifdef HAVE_SYS_STAT_H
43 #include <sys/stat.h>
44 #endif
45 #include <errno.h>
46 #include "sldns/sbuffer.h"
47 #include "util/config_file.h"
48 #include "util/net_help.h"
49 #include "util/netevent.h"
50 #include "util/log.h"
51 
52 #include <protobuf-c/protobuf-c.h>
53 
54 #include "dnstap/dnstap.h"
55 #include "dnstap/dtstream.h"
56 #include "dnstap/dnstap.pb-c.h"
57 
58 #define DNSTAP_INITIAL_BUF_SIZE		256
59 
60 struct dt_msg {
61 	void		*buf;
62 	size_t		len_buf;
63 	Dnstap__Dnstap	d;
64 	Dnstap__Message	m;
65 };
66 
67 static int
68 dt_pack(const Dnstap__Dnstap *d, void **buf, size_t *sz)
69 {
70 	ProtobufCBufferSimple sbuf;
71 
72 	memset(&sbuf, 0, sizeof(sbuf));
73 	sbuf.base.append = protobuf_c_buffer_simple_append;
74 	sbuf.len = 0;
75 	sbuf.alloced = DNSTAP_INITIAL_BUF_SIZE;
76 	sbuf.data = malloc(sbuf.alloced);
77 	if (sbuf.data == NULL)
78 		return 0;
79 	sbuf.must_free_data = 1;
80 
81 	*sz = dnstap__dnstap__pack_to_buffer(d, (ProtobufCBuffer *) &sbuf);
82 	if (sbuf.data == NULL)
83 		return 0;
84 	*buf = sbuf.data;
85 
86 	return 1;
87 }
88 
89 static void
90 dt_send(const struct dt_env *env, void *buf, size_t len_buf)
91 {
92 	dt_msg_queue_submit(env->msgqueue, buf, len_buf);
93 }
94 
95 static void
96 dt_msg_init(const struct dt_env *env,
97 	    struct dt_msg *dm,
98 	    Dnstap__Message__Type mtype)
99 {
100 	memset(dm, 0, sizeof(*dm));
101 	dm->d.base.descriptor = &dnstap__dnstap__descriptor;
102 	dm->m.base.descriptor = &dnstap__message__descriptor;
103 	dm->d.type = DNSTAP__DNSTAP__TYPE__MESSAGE;
104 	dm->d.message = &dm->m;
105 	dm->m.type = mtype;
106 	if (env->identity != NULL) {
107 		dm->d.identity.data = (uint8_t *) env->identity;
108 		dm->d.identity.len = (size_t) env->len_identity;
109 		dm->d.has_identity = 1;
110 	}
111 	if (env->version != NULL) {
112 		dm->d.version.data = (uint8_t *) env->version;
113 		dm->d.version.len = (size_t) env->len_version;
114 		dm->d.has_version = 1;
115 	}
116 }
117 
118 /* check that the socket file can be opened and exists, print error if not */
119 static void
120 check_socket_file(const char* socket_path)
121 {
122 	struct stat statbuf;
123 	memset(&statbuf, 0, sizeof(statbuf));
124 	if(stat(socket_path, &statbuf) < 0) {
125 		log_warn("could not open dnstap-socket-path: %s, %s",
126 			socket_path, strerror(errno));
127 	}
128 }
129 
130 struct dt_env *
131 dt_create(struct config_file* cfg)
132 {
133 	struct dt_env *env;
134 
135 	if(cfg->dnstap && cfg->dnstap_socket_path && cfg->dnstap_socket_path[0] &&
136 		(cfg->dnstap_ip==NULL || cfg->dnstap_ip[0]==0)) {
137 		verbose(VERB_OPS, "attempting to connect to dnstap socket %s",
138 			cfg->dnstap_socket_path);
139 		check_socket_file(cfg->dnstap_socket_path);
140 	}
141 
142 	env = (struct dt_env *) calloc(1, sizeof(struct dt_env));
143 	if (!env)
144 		return NULL;
145 
146 	env->dtio = dt_io_thread_create();
147 	if(!env->dtio) {
148 		log_err("malloc failure");
149 		free(env);
150 		return NULL;
151 	}
152 	if(!dt_io_thread_apply_cfg(env->dtio, cfg)) {
153 		dt_io_thread_delete(env->dtio);
154 		free(env);
155 		return NULL;
156 	}
157 	dt_apply_cfg(env, cfg);
158 	return env;
159 }
160 
161 static void
162 dt_apply_identity(struct dt_env *env, struct config_file *cfg)
163 {
164 	char buf[MAXHOSTNAMELEN+1];
165 	if (!cfg->dnstap_send_identity)
166 		return;
167 	free(env->identity);
168 	if (cfg->dnstap_identity == NULL || cfg->dnstap_identity[0] == 0) {
169 		if (gethostname(buf, MAXHOSTNAMELEN) == 0) {
170 			buf[MAXHOSTNAMELEN] = 0;
171 			env->identity = strdup(buf);
172 		} else {
173 			fatal_exit("dt_apply_identity: gethostname() failed");
174 		}
175 	} else {
176 		env->identity = strdup(cfg->dnstap_identity);
177 	}
178 	if (env->identity == NULL)
179 		fatal_exit("dt_apply_identity: strdup() failed");
180 	env->len_identity = (unsigned int)strlen(env->identity);
181 	verbose(VERB_OPS, "dnstap identity field set to \"%s\"",
182 		env->identity);
183 }
184 
185 static void
186 dt_apply_version(struct dt_env *env, struct config_file *cfg)
187 {
188 	if (!cfg->dnstap_send_version)
189 		return;
190 	free(env->version);
191 	if (cfg->dnstap_version == NULL || cfg->dnstap_version[0] == 0)
192 		env->version = strdup(PACKAGE_STRING);
193 	else
194 		env->version = strdup(cfg->dnstap_version);
195 	if (env->version == NULL)
196 		fatal_exit("dt_apply_version: strdup() failed");
197 	env->len_version = (unsigned int)strlen(env->version);
198 	verbose(VERB_OPS, "dnstap version field set to \"%s\"",
199 		env->version);
200 }
201 
202 void
203 dt_apply_cfg(struct dt_env *env, struct config_file *cfg)
204 {
205 	if (!cfg->dnstap)
206 		return;
207 
208 	dt_apply_identity(env, cfg);
209 	dt_apply_version(env, cfg);
210 	if ((env->log_resolver_query_messages = (unsigned int)
211 	     cfg->dnstap_log_resolver_query_messages))
212 	{
213 		verbose(VERB_OPS, "dnstap Message/RESOLVER_QUERY enabled");
214 	}
215 	if ((env->log_resolver_response_messages = (unsigned int)
216 	     cfg->dnstap_log_resolver_response_messages))
217 	{
218 		verbose(VERB_OPS, "dnstap Message/RESOLVER_RESPONSE enabled");
219 	}
220 	if ((env->log_client_query_messages = (unsigned int)
221 	     cfg->dnstap_log_client_query_messages))
222 	{
223 		verbose(VERB_OPS, "dnstap Message/CLIENT_QUERY enabled");
224 	}
225 	if ((env->log_client_response_messages = (unsigned int)
226 	     cfg->dnstap_log_client_response_messages))
227 	{
228 		verbose(VERB_OPS, "dnstap Message/CLIENT_RESPONSE enabled");
229 	}
230 	if ((env->log_forwarder_query_messages = (unsigned int)
231 	     cfg->dnstap_log_forwarder_query_messages))
232 	{
233 		verbose(VERB_OPS, "dnstap Message/FORWARDER_QUERY enabled");
234 	}
235 	if ((env->log_forwarder_response_messages = (unsigned int)
236 	     cfg->dnstap_log_forwarder_response_messages))
237 	{
238 		verbose(VERB_OPS, "dnstap Message/FORWARDER_RESPONSE enabled");
239 	}
240 }
241 
242 int
243 dt_init(struct dt_env *env)
244 {
245 	env->msgqueue = dt_msg_queue_create();
246 	if(!env->msgqueue) {
247 		log_err("malloc failure");
248 		return 0;
249 	}
250 	if(!dt_io_thread_register_queue(env->dtio, env->msgqueue)) {
251 		log_err("malloc failure");
252 		dt_msg_queue_delete(env->msgqueue);
253 		env->msgqueue = NULL;
254 		return 0;
255 	}
256 	return 1;
257 }
258 
259 void
260 dt_deinit(struct dt_env* env)
261 {
262 	dt_io_thread_unregister_queue(env->dtio, env->msgqueue);
263 	dt_msg_queue_delete(env->msgqueue);
264 }
265 
266 void
267 dt_delete(struct dt_env *env)
268 {
269 	if (!env)
270 		return;
271 	dt_io_thread_delete(env->dtio);
272 	free(env->identity);
273 	free(env->version);
274 	free(env);
275 }
276 
277 static void
278 dt_fill_timeval(const struct timeval *tv,
279 		uint64_t *time_sec, protobuf_c_boolean *has_time_sec,
280 		uint32_t *time_nsec, protobuf_c_boolean *has_time_nsec)
281 {
282 #ifndef S_SPLINT_S
283 	*time_sec = tv->tv_sec;
284 	*time_nsec = tv->tv_usec * 1000;
285 #endif
286 	*has_time_sec = 1;
287 	*has_time_nsec = 1;
288 }
289 
290 static void
291 dt_fill_buffer(sldns_buffer *b, ProtobufCBinaryData *p, protobuf_c_boolean *has)
292 {
293 	log_assert(b != NULL);
294 	p->len = sldns_buffer_limit(b);
295 	p->data = sldns_buffer_begin(b);
296 	*has = 1;
297 }
298 
299 static void
300 dt_msg_fill_net(struct dt_msg *dm,
301 		struct sockaddr_storage *ss,
302 		enum comm_point_type cptype,
303 		ProtobufCBinaryData *addr, protobuf_c_boolean *has_addr,
304 		uint32_t *port, protobuf_c_boolean *has_port)
305 {
306 	log_assert(ss->ss_family == AF_INET6 || ss->ss_family == AF_INET);
307 	if (ss->ss_family == AF_INET6) {
308 		struct sockaddr_in6 *s = (struct sockaddr_in6 *) ss;
309 
310 		/* socket_family */
311 		dm->m.socket_family = DNSTAP__SOCKET_FAMILY__INET6;
312 		dm->m.has_socket_family = 1;
313 
314 		/* addr: query_address or response_address */
315 		addr->data = s->sin6_addr.s6_addr;
316 		addr->len = 16; /* IPv6 */
317 		*has_addr = 1;
318 
319 		/* port: query_port or response_port */
320 		*port = ntohs(s->sin6_port);
321 		*has_port = 1;
322 	} else if (ss->ss_family == AF_INET) {
323 		struct sockaddr_in *s = (struct sockaddr_in *) ss;
324 
325 		/* socket_family */
326 		dm->m.socket_family = DNSTAP__SOCKET_FAMILY__INET;
327 		dm->m.has_socket_family = 1;
328 
329 		/* addr: query_address or response_address */
330 		addr->data = (uint8_t *) &s->sin_addr.s_addr;
331 		addr->len = 4; /* IPv4 */
332 		*has_addr = 1;
333 
334 		/* port: query_port or response_port */
335 		*port = ntohs(s->sin_port);
336 		*has_port = 1;
337 	}
338 
339 	log_assert(cptype == comm_udp || cptype == comm_tcp);
340 	if (cptype == comm_udp) {
341 		/* socket_protocol */
342 		dm->m.socket_protocol = DNSTAP__SOCKET_PROTOCOL__UDP;
343 		dm->m.has_socket_protocol = 1;
344 	} else if (cptype == comm_tcp) {
345 		/* socket_protocol */
346 		dm->m.socket_protocol = DNSTAP__SOCKET_PROTOCOL__TCP;
347 		dm->m.has_socket_protocol = 1;
348 	}
349 }
350 
351 void
352 dt_msg_send_client_query(struct dt_env *env,
353 			 struct sockaddr_storage *qsock,
354 			 enum comm_point_type cptype,
355 			 sldns_buffer *qmsg)
356 {
357 	struct dt_msg dm;
358 	struct timeval qtime;
359 
360 	gettimeofday(&qtime, NULL);
361 
362 	/* type */
363 	dt_msg_init(env, &dm, DNSTAP__MESSAGE__TYPE__CLIENT_QUERY);
364 
365 	/* query_time */
366 	dt_fill_timeval(&qtime,
367 			&dm.m.query_time_sec, &dm.m.has_query_time_sec,
368 			&dm.m.query_time_nsec, &dm.m.has_query_time_nsec);
369 
370 	/* query_message */
371 	dt_fill_buffer(qmsg, &dm.m.query_message, &dm.m.has_query_message);
372 
373 	/* socket_family, socket_protocol, query_address, query_port */
374 	log_assert(cptype == comm_udp || cptype == comm_tcp);
375 	dt_msg_fill_net(&dm, qsock, cptype,
376 			&dm.m.query_address, &dm.m.has_query_address,
377 			&dm.m.query_port, &dm.m.has_query_port);
378 
379 	if (dt_pack(&dm.d, &dm.buf, &dm.len_buf))
380 		dt_send(env, dm.buf, dm.len_buf);
381 }
382 
383 void
384 dt_msg_send_client_response(struct dt_env *env,
385 			    struct sockaddr_storage *qsock,
386 			    enum comm_point_type cptype,
387 			    sldns_buffer *rmsg)
388 {
389 	struct dt_msg dm;
390 	struct timeval rtime;
391 
392 	gettimeofday(&rtime, NULL);
393 
394 	/* type */
395 	dt_msg_init(env, &dm, DNSTAP__MESSAGE__TYPE__CLIENT_RESPONSE);
396 
397 	/* response_time */
398 	dt_fill_timeval(&rtime,
399 			&dm.m.response_time_sec, &dm.m.has_response_time_sec,
400 			&dm.m.response_time_nsec, &dm.m.has_response_time_nsec);
401 
402 	/* response_message */
403 	dt_fill_buffer(rmsg, &dm.m.response_message, &dm.m.has_response_message);
404 
405 	/* socket_family, socket_protocol, query_address, query_port */
406 	log_assert(cptype == comm_udp || cptype == comm_tcp);
407 	dt_msg_fill_net(&dm, qsock, cptype,
408 			&dm.m.query_address, &dm.m.has_query_address,
409 			&dm.m.query_port, &dm.m.has_query_port);
410 
411 	if (dt_pack(&dm.d, &dm.buf, &dm.len_buf))
412 		dt_send(env, dm.buf, dm.len_buf);
413 }
414 
415 void
416 dt_msg_send_outside_query(struct dt_env *env,
417 			  struct sockaddr_storage *rsock,
418 			  enum comm_point_type cptype,
419 			  uint8_t *zone, size_t zone_len,
420 			  sldns_buffer *qmsg)
421 {
422 	struct dt_msg dm;
423 	struct timeval qtime;
424 	uint16_t qflags;
425 
426 	gettimeofday(&qtime, NULL);
427 	qflags = sldns_buffer_read_u16_at(qmsg, 2);
428 
429 	/* type */
430 	if (qflags & BIT_RD) {
431 		if (!env->log_forwarder_query_messages)
432 			return;
433 		dt_msg_init(env, &dm, DNSTAP__MESSAGE__TYPE__FORWARDER_QUERY);
434 	} else {
435 		if (!env->log_resolver_query_messages)
436 			return;
437 		dt_msg_init(env, &dm, DNSTAP__MESSAGE__TYPE__RESOLVER_QUERY);
438 	}
439 
440 	/* query_zone */
441 	dm.m.query_zone.data = zone;
442 	dm.m.query_zone.len = zone_len;
443 	dm.m.has_query_zone = 1;
444 
445 	/* query_time_sec, query_time_nsec */
446 	dt_fill_timeval(&qtime,
447 			&dm.m.query_time_sec, &dm.m.has_query_time_sec,
448 			&dm.m.query_time_nsec, &dm.m.has_query_time_nsec);
449 
450 	/* query_message */
451 	dt_fill_buffer(qmsg, &dm.m.query_message, &dm.m.has_query_message);
452 
453 	/* socket_family, socket_protocol, response_address, response_port */
454 	log_assert(cptype == comm_udp || cptype == comm_tcp);
455 	dt_msg_fill_net(&dm, rsock, cptype,
456 			&dm.m.response_address, &dm.m.has_response_address,
457 			&dm.m.response_port, &dm.m.has_response_port);
458 
459 	if (dt_pack(&dm.d, &dm.buf, &dm.len_buf))
460 		dt_send(env, dm.buf, dm.len_buf);
461 }
462 
463 void
464 dt_msg_send_outside_response(struct dt_env *env,
465 			     struct sockaddr_storage *rsock,
466 			     enum comm_point_type cptype,
467 			     uint8_t *zone, size_t zone_len,
468 			     uint8_t *qbuf, size_t qbuf_len,
469 			     const struct timeval *qtime,
470 			     const struct timeval *rtime,
471 			     sldns_buffer *rmsg)
472 {
473 	struct dt_msg dm;
474 	uint16_t qflags;
475 
476 	log_assert(qbuf_len >= sizeof(qflags));
477 	memcpy(&qflags, qbuf, sizeof(qflags));
478 	qflags = ntohs(qflags);
479 
480 	/* type */
481 	if (qflags & BIT_RD) {
482 		if (!env->log_forwarder_response_messages)
483 			return;
484 		dt_msg_init(env, &dm, DNSTAP__MESSAGE__TYPE__FORWARDER_RESPONSE);
485 	} else {
486 		if (!env->log_resolver_response_messages)
487 			return;
488 		dt_msg_init(env, &dm, DNSTAP__MESSAGE__TYPE__RESOLVER_RESPONSE);
489 	}
490 
491 	/* query_zone */
492 	dm.m.query_zone.data = zone;
493 	dm.m.query_zone.len = zone_len;
494 	dm.m.has_query_zone = 1;
495 
496 	/* query_time_sec, query_time_nsec */
497 	dt_fill_timeval(qtime,
498 			&dm.m.query_time_sec, &dm.m.has_query_time_sec,
499 			&dm.m.query_time_nsec, &dm.m.has_query_time_nsec);
500 
501 	/* response_time_sec, response_time_nsec */
502 	dt_fill_timeval(rtime,
503 			&dm.m.response_time_sec, &dm.m.has_response_time_sec,
504 			&dm.m.response_time_nsec, &dm.m.has_response_time_nsec);
505 
506 	/* response_message */
507 	dt_fill_buffer(rmsg, &dm.m.response_message, &dm.m.has_response_message);
508 
509 	/* socket_family, socket_protocol, response_address, response_port */
510 	log_assert(cptype == comm_udp || cptype == comm_tcp);
511 	dt_msg_fill_net(&dm, rsock, cptype,
512 			&dm.m.response_address, &dm.m.has_response_address,
513 			&dm.m.response_port, &dm.m.has_response_port);
514 
515 	if (dt_pack(&dm.d, &dm.buf, &dm.len_buf))
516 		dt_send(env, dm.buf, dm.len_buf);
517 }
518 
519 #endif /* USE_DNSTAP */
520