diff options
Diffstat (limited to 'dnsdist.hh')
| -rw-r--r-- | dnsdist.hh | 1271 |
1 files changed, 1271 insertions, 0 deletions
diff --git a/dnsdist.hh b/dnsdist.hh new file mode 100644 index 0000000..1f7b4e8 --- /dev/null +++ b/dnsdist.hh @@ -0,0 +1,1271 @@ +/* + * This file is part of PowerDNS or dnsdist. + * Copyright -- PowerDNS.COM B.V. and its contributors + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of version 2 of the GNU General Public License as + * published by the Free Software Foundation. + * + * In addition, for the avoidance of any doubt, permission is granted to + * link this program with OpenSSL and to (re)distribute the binaries + * produced as the result of such linking. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + */ +#pragma once +#include "config.h" +#include "ext/luawrapper/include/LuaContext.hpp" + +#include <condition_variable> +#include <memory> +#include <mutex> +#include <string> +#include <thread> +#include <time.h> +#include <unistd.h> +#include <unordered_map> + +#include <boost/variant.hpp> + +#include "circular_buffer.hh" +#include "dnscrypt.hh" +#include "dnsdist-cache.hh" +#include "dnsdist-dynbpf.hh" +#include "dnsdist-idstate.hh" +#include "dnsdist-lbpolicies.hh" +#include "dnsdist-protocols.hh" +#include "dnsname.hh" +#include "doh.hh" +#include "ednsoptions.hh" +#include "iputils.hh" +#include "misc.hh" +#include "mplexer.hh" +#include "noinitvector.hh" +#include "sholder.hh" +#include "tcpiohandler.hh" +#include "uuid-utils.hh" +#include "proxy-protocol.hh" +#include "stat_t.hh" + +uint64_t uptimeOfProcess(const std::string& str); + +extern uint16_t g_ECSSourcePrefixV4; +extern uint16_t g_ECSSourcePrefixV6; +extern bool g_ECSOverride; + +using QTag = std::unordered_map<string, string>; + +class IncomingTCPConnectionState; + +struct ClientState; + +struct DNSQuestion +{ + DNSQuestion(InternalQueryState& ids_, PacketBuffer& data_): + data(data_), ids(ids_), ecsPrefixLength(ids.origRemote.sin4.sin_family == AF_INET ? g_ECSSourcePrefixV4 : g_ECSSourcePrefixV6), ecsOverride(g_ECSOverride) { + } + DNSQuestion(const DNSQuestion&) = delete; + DNSQuestion& operator=(const DNSQuestion&) = delete; + DNSQuestion(DNSQuestion&&) = default; + virtual ~DNSQuestion() = default; + + std::string getTrailingData() const; + bool setTrailingData(const std::string&); + const PacketBuffer& getData() const + { + return data; + } + PacketBuffer& getMutableData() + { + return data; + } + + dnsheader* getHeader() + { + if (data.size() < sizeof(dnsheader)) { + throw std::runtime_error("Trying to access the dnsheader of a too small (" + std::to_string(data.size()) + ") DNSQuestion buffer"); + } + return reinterpret_cast<dnsheader*>(&data.at(0)); + } + + const dnsheader* getHeader() const + { + if (data.size() < sizeof(dnsheader)) { + throw std::runtime_error("Trying to access the dnsheader of a too small (" + std::to_string(data.size()) + ") DNSQuestion buffer"); + } + return reinterpret_cast<const dnsheader*>(&data.at(0)); + } + + bool hasRoomFor(size_t more) const + { + return data.size() <= getMaximumSize() && (getMaximumSize() - data.size()) >= more; + } + + size_t getMaximumSize() const + { + if (overTCP()) { + return std::numeric_limits<uint16_t>::max(); + } + return 4096; + } + + dnsdist::Protocol getProtocol() const + { + return ids.protocol; + } + + bool overTCP() const + { + return !(ids.protocol == dnsdist::Protocol::DoUDP || ids.protocol == dnsdist::Protocol::DNSCryptUDP); + } + + void setTag(std::string&& key, std::string&& value) { + if (!ids.qTag) { + ids.qTag = std::make_unique<QTag>(); + } + ids.qTag->insert_or_assign(std::move(key), std::move(value)); + } + + void setTag(const std::string& key, const std::string& value) { + if (!ids.qTag) { + ids.qTag = std::make_unique<QTag>(); + } + ids.qTag->insert_or_assign(key, value); + } + + const struct timespec& getQueryRealTime() const + { + return ids.queryRealTime.d_start; + } + + bool isAsynchronous() const + { + return asynchronous; + } + + std::shared_ptr<IncomingTCPConnectionState> getIncomingTCPState() const + { + return d_incomingTCPState; + } + + ClientState* getFrontend() const + { + return ids.cs; + } + +protected: + PacketBuffer& data; + +public: + InternalQueryState& ids; + std::unique_ptr<Netmask> ecs{nullptr}; + std::string sni; /* Server Name Indication, if any (DoT or DoH) */ + mutable std::unique_ptr<EDNSOptionViewMap> ednsOptions; /* this needs to be mutable because it is parsed just in time, when DNSQuestion is read-only */ + std::shared_ptr<IncomingTCPConnectionState> d_incomingTCPState{nullptr}; + std::unique_ptr<std::vector<ProxyProtocolValue>> proxyProtocolValues{nullptr}; + uint16_t ecsPrefixLength; + uint8_t ednsRCode{0}; + bool ecsOverride; + bool useECS{true}; + bool addXPF{true}; + bool asynchronous{false}; +}; + +struct DownstreamState; + +struct DNSResponse : DNSQuestion +{ + DNSResponse(InternalQueryState& ids_, PacketBuffer& data_, const std::shared_ptr<DownstreamState>& downstream): + DNSQuestion(ids_, data_), d_downstream(downstream) { } + DNSResponse(const DNSResponse&) = delete; + DNSResponse& operator=(const DNSResponse&) = delete; + DNSResponse(DNSResponse&&) = default; + + const std::shared_ptr<DownstreamState>& d_downstream; +}; + +/* so what could you do: + drop, + fake up nxdomain, + provide actual answer, + allow & and stop processing, + continue processing, + modify header: (servfail|refused|notimp), set TC=1, + send to pool */ + +class DNSAction +{ +public: + enum class Action : uint8_t { Drop, Nxdomain, Refused, Spoof, Allow, HeaderModify, Pool, Delay, Truncate, ServFail, None, NoOp, NoRecurse, SpoofRaw, SpoofPacket }; + static std::string typeToString(const Action& action) + { + switch(action) { + case Action::Drop: + return "Drop"; + case Action::Nxdomain: + return "Send NXDomain"; + case Action::Refused: + return "Send Refused"; + case Action::Spoof: + return "Spoof an answer"; + case Action::SpoofPacket: + return "Spoof a raw answer from bytes"; + case Action::SpoofRaw: + return "Spoof an answer from raw bytes"; + case Action::Allow: + return "Allow"; + case Action::HeaderModify: + return "Modify the header"; + case Action::Pool: + return "Route to a pool"; + case Action::Delay: + return "Delay"; + case Action::Truncate: + return "Truncate over UDP"; + case Action::ServFail: + return "Send ServFail"; + case Action::None: + case Action::NoOp: + return "Do nothing"; + case Action::NoRecurse: + return "Set rd=0"; + } + + return "Unknown"; + } + + virtual Action operator()(DNSQuestion*, string* ruleresult) const =0; + virtual ~DNSAction() + { + } + virtual string toString() const = 0; + virtual std::map<string, double> getStats() const + { + return {{}}; + } + virtual void reload() + { + } +}; + +class DNSResponseAction +{ +public: + enum class Action : uint8_t { Allow, Delay, Drop, HeaderModify, ServFail, None }; + virtual Action operator()(DNSResponse*, string* ruleresult) const =0; + virtual ~DNSResponseAction() + { + } + virtual string toString() const = 0; + virtual void reload() + { + } +}; + +struct DynBlock +{ + DynBlock(): action(DNSAction::Action::None), warning(false) + { + until.tv_sec = 0; + until.tv_nsec = 0; + } + + DynBlock(const std::string& reason_, const struct timespec& until_, const DNSName& domain_, DNSAction::Action action_): reason(reason_), domain(domain_), until(until_), action(action_), warning(false) + { + } + + DynBlock(const DynBlock& rhs): reason(rhs.reason), domain(rhs.domain), until(rhs.until), action(rhs.action), warning(rhs.warning), bpf(rhs.bpf) + { + blocks.store(rhs.blocks); + } + + DynBlock(DynBlock&& rhs): reason(std::move(rhs.reason)), domain(std::move(rhs.domain)), until(rhs.until), action(rhs.action), warning(rhs.warning), bpf(rhs.bpf) + { + blocks.store(rhs.blocks); + } + + DynBlock& operator=(const DynBlock& rhs) + { + reason = rhs.reason; + until = rhs.until; + domain = rhs.domain; + action = rhs.action; + blocks.store(rhs.blocks); + warning = rhs.warning; + bpf = rhs.bpf; + return *this; + } + + DynBlock& operator=(DynBlock&& rhs) + { + reason = std::move(rhs.reason); + until = rhs.until; + domain = std::move(rhs.domain); + action = rhs.action; + blocks.store(rhs.blocks); + warning = rhs.warning; + bpf = rhs.bpf; + return *this; + } + + string reason; + DNSName domain; + struct timespec until; + mutable std::atomic<unsigned int> blocks; + DNSAction::Action action{DNSAction::Action::None}; + bool warning{false}; + bool bpf{false}; +}; + +extern GlobalStateHolder<NetmaskTree<DynBlock, AddressAndPortRange>> g_dynblockNMG; + +extern vector<pair<struct timeval, std::string> > g_confDelta; + +using pdns::stat_t; + +struct DNSDistStats +{ + stat_t responses{0}; + stat_t servfailResponses{0}; + stat_t queries{0}; + stat_t frontendNXDomain{0}; + stat_t frontendServFail{0}; + stat_t frontendNoError{0}; + stat_t nonCompliantQueries{0}; + stat_t nonCompliantResponses{0}; + stat_t rdQueries{0}; + stat_t emptyQueries{0}; + stat_t aclDrops{0}; + stat_t dynBlocked{0}; + stat_t ruleDrop{0}; + stat_t ruleNXDomain{0}; + stat_t ruleRefused{0}; + stat_t ruleServFail{0}; + stat_t ruleTruncated{0}; + stat_t selfAnswered{0}; + stat_t downstreamTimeouts{0}; + stat_t downstreamSendErrors{0}; + stat_t truncFail{0}; + stat_t noPolicy{0}; + stat_t cacheHits{0}; + stat_t cacheMisses{0}; + stat_t latency0_1{0}, latency1_10{0}, latency10_50{0}, latency50_100{0}, latency100_1000{0}, latencySlow{0}, latencySum{0}, latencyCount{0}; + stat_t securityStatus{0}; + stat_t dohQueryPipeFull{0}; + stat_t dohResponsePipeFull{0}; + stat_t outgoingDoHQueryPipeFull{0}; + stat_t proxyProtocolInvalid{0}; + stat_t tcpQueryPipeFull{0}; + stat_t tcpCrossProtocolQueryPipeFull{0}; + stat_t tcpCrossProtocolResponsePipeFull{0}; + double latencyAvg100{0}, latencyAvg1000{0}, latencyAvg10000{0}, latencyAvg1000000{0}; + double latencyTCPAvg100{0}, latencyTCPAvg1000{0}, latencyTCPAvg10000{0}, latencyTCPAvg1000000{0}; + double latencyDoTAvg100{0}, latencyDoTAvg1000{0}, latencyDoTAvg10000{0}, latencyDoTAvg1000000{0}; + double latencyDoHAvg100{0}, latencyDoHAvg1000{0}, latencyDoHAvg10000{0}, latencyDoHAvg1000000{0}; + using statfunction_t = std::function<uint64_t(const std::string&)>; + using entry_t = boost::variant<stat_t*, pdns::stat_t_trait<double>*, double*, statfunction_t>; + struct EntryPair + { + std::string d_name; + entry_t d_value; + }; + + SharedLockGuarded<std::vector<EntryPair>> entries{std::vector<EntryPair>{ + {"responses", &responses}, + {"servfail-responses", &servfailResponses}, + {"queries", &queries}, + {"frontend-nxdomain", &frontendNXDomain}, + {"frontend-servfail", &frontendServFail}, + {"frontend-noerror", &frontendNoError}, + {"acl-drops", &aclDrops}, + {"rule-drop", &ruleDrop}, + {"rule-nxdomain", &ruleNXDomain}, + {"rule-refused", &ruleRefused}, + {"rule-servfail", &ruleServFail}, + {"rule-truncated", &ruleTruncated}, + {"self-answered", &selfAnswered}, + {"downstream-timeouts", &downstreamTimeouts}, + {"downstream-send-errors", &downstreamSendErrors}, + {"trunc-failures", &truncFail}, + {"no-policy", &noPolicy}, + {"latency0-1", &latency0_1}, + {"latency1-10", &latency1_10}, + {"latency10-50", &latency10_50}, + {"latency50-100", &latency50_100}, + {"latency100-1000", &latency100_1000}, + {"latency-slow", &latencySlow}, + {"latency-avg100", &latencyAvg100}, + {"latency-avg1000", &latencyAvg1000}, + {"latency-avg10000", &latencyAvg10000}, + {"latency-avg1000000", &latencyAvg1000000}, + {"latency-tcp-avg100", &latencyTCPAvg100}, + {"latency-tcp-avg1000", &latencyTCPAvg1000}, + {"latency-tcp-avg10000", &latencyTCPAvg10000}, + {"latency-tcp-avg1000000", &latencyTCPAvg1000000}, + {"latency-dot-avg100", &latencyDoTAvg100}, + {"latency-dot-avg1000", &latencyDoTAvg1000}, + {"latency-dot-avg10000", &latencyDoTAvg10000}, + {"latency-dot-avg1000000", &latencyDoTAvg1000000}, + {"latency-doh-avg100", &latencyDoHAvg100}, + {"latency-doh-avg1000", &latencyDoHAvg1000}, + {"latency-doh-avg10000", &latencyDoHAvg10000}, + {"latency-doh-avg1000000", &latencyDoHAvg1000000}, + {"uptime", uptimeOfProcess}, + {"real-memory-usage", getRealMemoryUsage}, + {"special-memory-usage", getSpecialMemoryUsage}, + {"udp-in-errors", std::bind(udpErrorStats, "udp-in-errors")}, + {"udp-noport-errors", std::bind(udpErrorStats, "udp-noport-errors")}, + {"udp-recvbuf-errors", std::bind(udpErrorStats, "udp-recvbuf-errors")}, + {"udp-sndbuf-errors", std::bind(udpErrorStats, "udp-sndbuf-errors")}, + {"udp-in-csum-errors", std::bind(udpErrorStats, "udp-in-csum-errors")}, + {"udp6-in-errors", std::bind(udp6ErrorStats, "udp6-in-errors")}, + {"udp6-recvbuf-errors", std::bind(udp6ErrorStats, "udp6-recvbuf-errors")}, + {"udp6-sndbuf-errors", std::bind(udp6ErrorStats, "udp6-sndbuf-errors")}, + {"udp6-noport-errors", std::bind(udp6ErrorStats, "udp6-noport-errors")}, + {"udp6-in-csum-errors", std::bind(udp6ErrorStats, "udp6-in-csum-errors")}, + {"tcp-listen-overflows", std::bind(tcpErrorStats, "ListenOverflows")}, + {"noncompliant-queries", &nonCompliantQueries}, + {"noncompliant-responses", &nonCompliantResponses}, + {"proxy-protocol-invalid", &proxyProtocolInvalid}, + {"rdqueries", &rdQueries}, + {"empty-queries", &emptyQueries}, + {"cache-hits", &cacheHits}, + {"cache-misses", &cacheMisses}, + {"cpu-iowait", getCPUIOWait}, + {"cpu-steal", getCPUSteal}, + {"cpu-sys-msec", getCPUTimeSystem}, + {"cpu-user-msec", getCPUTimeUser}, + {"fd-usage", getOpenFileDescriptors}, + {"dyn-blocked", &dynBlocked}, + {"dyn-block-nmg-size", [](const std::string&) { return g_dynblockNMG.getLocal()->size(); }}, + {"security-status", &securityStatus}, + {"doh-query-pipe-full", &dohQueryPipeFull}, + {"doh-response-pipe-full", &dohResponsePipeFull}, + {"outgoing-doh-query-pipe-full", &outgoingDoHQueryPipeFull}, + {"tcp-query-pipe-full", &tcpQueryPipeFull}, + {"tcp-cross-protocol-query-pipe-full", &tcpCrossProtocolQueryPipeFull}, + {"tcp-cross-protocol-response-pipe-full", &tcpCrossProtocolResponsePipeFull}, + // Latency histogram + {"latency-sum", &latencySum}, + {"latency-count", &latencyCount}, + }}; + struct MutableCounter + { + MutableCounter() = default; + MutableCounter(MutableCounter&& rhs): d_value(rhs.d_value.load()) + { + } + + mutable stat_t d_value{0}; + }; + struct MutableGauge + { + MutableGauge() = default; + MutableGauge(MutableGauge&& rhs): d_value(rhs.d_value.load()) + { + } + + mutable pdns::stat_t_trait<double> d_value{0}; + }; + SharedLockGuarded<std::map<std::string, MutableCounter, std::less<>>> customCounters; + SharedLockGuarded<std::map<std::string, MutableGauge, std::less<>>> customGauges; +}; + +extern struct DNSDistStats g_stats; + +class BasicQPSLimiter +{ +public: + BasicQPSLimiter() + { + } + + BasicQPSLimiter(unsigned int burst): d_tokens(burst) + { + d_prev.start(); + } + + virtual ~BasicQPSLimiter() + { + } + + bool check(unsigned int rate, unsigned int burst) const // this is not quite fair + { + if (checkOnly(rate, burst)) { + addHit(); + return true; + } + + return false; + } + + bool checkOnly(unsigned int rate, unsigned int burst) const // this is not quite fair + { + auto delta = d_prev.udiffAndSet(); + + if (delta > 0.0) { // time, frequently, does go backwards.. + d_tokens += 1.0 * rate * (delta/1000000.0); + } + + if (d_tokens > burst) { + d_tokens = burst; + } + + bool ret = false; + if (d_tokens >= 1.0) { // we need this because burst=1 is weird otherwise + ret = true; + } + + return ret; + } + + virtual void addHit() const + { + --d_tokens; + } + + bool seenSince(const struct timespec& cutOff) const + { + return cutOff < d_prev.d_start; + } + +protected: + mutable StopWatch d_prev; + mutable double d_tokens{0.0}; +}; + +class QPSLimiter : public BasicQPSLimiter +{ +public: + QPSLimiter(): BasicQPSLimiter() + { + } + + QPSLimiter(unsigned int rate, unsigned int burst): BasicQPSLimiter(burst), d_rate(rate), d_burst(burst), d_passthrough(false) + { + d_prev.start(); + } + + unsigned int getRate() const + { + return d_passthrough ? 0 : d_rate; + } + + bool check() const // this is not quite fair + { + if (d_passthrough) { + return true; + } + + return BasicQPSLimiter::check(d_rate, d_burst); + } + + bool checkOnly() const + { + if (d_passthrough) { + return true; + } + + return BasicQPSLimiter::checkOnly(d_rate, d_burst); + } + + void addHit() const override + { + if (!d_passthrough) { + --d_tokens; + } + } + +private: + unsigned int d_rate{0}; + unsigned int d_burst{0}; + bool d_passthrough{true}; +}; + +typedef std::unordered_map<string, unsigned int> QueryCountRecords; +typedef std::function<std::tuple<bool, string>(const DNSQuestion* dq)> QueryCountFilter; +struct QueryCount { + QueryCount() + { + } + ~QueryCount() + { + } + SharedLockGuarded<QueryCountRecords> records; + QueryCountFilter filter; + bool enabled{false}; +}; + +extern QueryCount g_qcount; + +struct ClientState +{ + ClientState(const ComboAddress& local_, bool isTCP_, bool doReusePort, int fastOpenQueue, const std::string& itfName, const std::set<int>& cpus_): cpus(cpus_), interface(itfName), local(local_), fastOpenQueueSize(fastOpenQueue), tcp(isTCP_), reuseport(doReusePort) + { + } + + stat_t queries{0}; + stat_t nonCompliantQueries{0}; + mutable stat_t responses{0}; + mutable stat_t tcpDiedReadingQuery{0}; + mutable stat_t tcpDiedSendingResponse{0}; + mutable stat_t tcpGaveUp{0}; + mutable stat_t tcpClientTimeouts{0}; + mutable stat_t tcpDownstreamTimeouts{0}; + /* current number of connections to this frontend */ + mutable stat_t tcpCurrentConnections{0}; + /* maximum number of concurrent connections to this frontend reached */ + mutable stat_t tcpMaxConcurrentConnections{0}; + stat_t tlsNewSessions{0}; // A new TLS session has been negotiated, no resumption + stat_t tlsResumptions{0}; // A TLS session has been resumed, either via session id or via a TLS ticket + stat_t tlsUnknownTicketKey{0}; // A TLS ticket has been presented but we don't have the associated key (might have expired) + stat_t tlsInactiveTicketKey{0}; // A TLS ticket has been successfully resumed but the key is no longer active, we should issue a new one + stat_t tls10queries{0}; // valid DNS queries received via TLSv1.0 + stat_t tls11queries{0}; // valid DNS queries received via TLSv1.1 + stat_t tls12queries{0}; // valid DNS queries received via TLSv1.2 + stat_t tls13queries{0}; // valid DNS queries received via TLSv1.3 + stat_t tlsUnknownqueries{0}; // valid DNS queries received via unknown TLS version + pdns::stat_t_trait<double> tcpAvgQueriesPerConnection{0.0}; + /* in ms */ + pdns::stat_t_trait<double> tcpAvgConnectionDuration{0.0}; + std::set<int> cpus; + std::string interface; + ComboAddress local; + std::vector<std::pair<ComboAddress, int>> d_additionalAddresses; + std::shared_ptr<DNSCryptContext> dnscryptCtx{nullptr}; + std::shared_ptr<TLSFrontend> tlsFrontend{nullptr}; + std::shared_ptr<DOHFrontend> dohFrontend{nullptr}; + std::shared_ptr<BPFFilter> d_filter{nullptr}; + size_t d_maxInFlightQueriesPerConn{1}; + size_t d_tcpConcurrentConnectionsLimit{0}; + int udpFD{-1}; + int tcpFD{-1}; + int tcpListenQueueSize{SOMAXCONN}; + int fastOpenQueueSize{0}; + bool muted{false}; + bool tcp; + bool reuseport; + bool ready{false}; + + int getSocket() const + { + return udpFD != -1 ? udpFD : tcpFD; + } + + bool isUDP() const + { + return udpFD != -1; + } + + bool isTCP() const + { + return udpFD == -1; + } + + bool isDoH() const + { + return dohFrontend != nullptr; + } + + bool hasTLS() const + { + return tlsFrontend != nullptr || (dohFrontend != nullptr && dohFrontend->isHTTPS()); + } + + dnsdist::Protocol getProtocol() const + { + if (dnscryptCtx) { + if (udpFD != -1) { + return dnsdist::Protocol::DNSCryptUDP; + } + return dnsdist::Protocol::DNSCryptTCP; + } + if (isDoH()) { + return dnsdist::Protocol::DoH; + } + else if (hasTLS()) { + return dnsdist::Protocol::DoT; + } + else if (udpFD != -1) { + return dnsdist::Protocol::DoUDP; + } + else { + return dnsdist::Protocol::DoTCP; + } + } + + std::string getType() const + { + std::string result = udpFD != -1 ? "UDP" : "TCP"; + + if (dohFrontend) { + if (dohFrontend->isHTTPS()) { + result += " (DNS over HTTPS)"; + } + else { + result += " (DNS over HTTP)"; + } + } + else if (tlsFrontend) { + result += " (DNS over TLS)"; + } + else if (dnscryptCtx) { + result += " (DNSCrypt)"; + } + + return result; + } + + void detachFilter(int socket) + { + if (d_filter) { + d_filter->removeSocket(socket); + d_filter = nullptr; + } + } + + void attachFilter(shared_ptr<BPFFilter> bpf, int socket) + { + detachFilter(socket); + + bpf->addSocket(socket); + d_filter = bpf; + } + + void detachFilter() + { + if (d_filter) { + detachFilter(getSocket()); + for (const auto& [addr, socket] : d_additionalAddresses) { + (void) addr; + if (socket != -1) { + detachFilter(socket); + } + } + + d_filter = nullptr; + } + } + + void attachFilter(shared_ptr<BPFFilter> bpf) + { + detachFilter(); + + bpf->addSocket(getSocket()); + for (const auto& [addr, socket] : d_additionalAddresses) { + (void) addr; + if (socket != -1) { + bpf->addSocket(socket); + } + } + d_filter = bpf; + } + + void updateTCPMetrics(size_t nbQueries, uint64_t durationMs) + { + tcpAvgQueriesPerConnection = (99.0 * tcpAvgQueriesPerConnection / 100.0) + (nbQueries / 100.0); + tcpAvgConnectionDuration = (99.0 * tcpAvgConnectionDuration / 100.0) + (durationMs / 100.0); + } +}; + +struct CrossProtocolQuery; + +struct DownstreamState: public std::enable_shared_from_this<DownstreamState> +{ + DownstreamState(const DownstreamState&) = delete; + DownstreamState(DownstreamState&&) = delete; + DownstreamState& operator=(const DownstreamState&) = delete; + DownstreamState& operator=(DownstreamState&&) = delete; + + typedef std::function<std::tuple<DNSName, uint16_t, uint16_t>(const DNSName&, uint16_t, uint16_t, dnsheader*)> checkfunc_t; + enum class Availability : uint8_t { Up, Down, Auto, Lazy }; + enum class LazyHealthCheckMode : uint8_t { TimeoutOnly, TimeoutOrServFail }; + + struct Config + { + Config() + { + } + Config(const ComboAddress& remote_): remote(remote_) + { + } + + TLSContextParameters d_tlsParams; + set<string> pools; + std::set<int> d_cpus; + checkfunc_t checkFunction; + std::optional<boost::uuids::uuid> id; + DNSName checkName{"a.root-servers.net."}; + ComboAddress remote; + ComboAddress sourceAddr; + std::string sourceItfName; + std::string d_tlsSubjectName; + std::string d_dohPath; + std::string name; + std::string nameWithAddr; + size_t d_numberOfSockets{1}; + size_t d_maxInFlightQueriesPerConn{1}; + size_t d_tcpConcurrentConnectionsLimit{0}; + int order{1}; + int d_weight{1}; + int tcpConnectTimeout{5}; + int tcpRecvTimeout{30}; + int tcpSendTimeout{30}; + int d_qpsLimit{0}; + unsigned int checkInterval{1}; + unsigned int sourceItf{0}; + QType checkType{QType::A}; + uint16_t checkClass{QClass::IN}; + uint16_t d_retries{5}; + uint16_t xpfRRCode{0}; + uint16_t checkTimeout{1000}; /* in milliseconds */ + uint16_t d_lazyHealthCheckSampleSize{100}; + uint16_t d_lazyHealthCheckMinSampleCount{1}; + uint16_t d_lazyHealthCheckFailedInterval{30}; + uint16_t d_lazyHealthCheckMaxBackOff{3600}; + uint8_t d_lazyHealthCheckThreshold{20}; + LazyHealthCheckMode d_lazyHealthCheckMode{LazyHealthCheckMode::TimeoutOrServFail}; + uint8_t maxCheckFailures{1}; + uint8_t minRiseSuccesses{1}; + Availability availability{Availability::Auto}; + bool d_tlsSubjectIsAddr{false}; + bool mustResolve{false}; + bool useECS{false}; + bool useProxyProtocol{false}; + bool setCD{false}; + bool disableZeroScope{false}; + bool tcpFastOpen{false}; + bool ipBindAddrNoPort{true}; + bool reconnectOnUp{false}; + bool d_tcpCheck{false}; + bool d_tcpOnly{false}; + bool d_addXForwardedHeaders{false}; // for DoH backends + bool d_lazyHealthCheckUseExponentialBackOff{false}; + bool d_upgradeToLazyHealthChecks{false}; + }; + + DownstreamState(DownstreamState::Config&& config, std::shared_ptr<TLSCtx> tlsCtx, bool connect); + DownstreamState(const ComboAddress& remote): DownstreamState(DownstreamState::Config(remote), nullptr, false) + { + } + + ~DownstreamState(); + + Config d_config; + stat_t sendErrors{0}; + stat_t outstanding{0}; + stat_t reuseds{0}; + stat_t queries{0}; + stat_t responses{0}; + stat_t nonCompliantResponses{0}; + struct { + stat_t sendErrors{0}; + stat_t reuseds{0}; + stat_t queries{0}; + } prev; + stat_t tcpDiedSendingQuery{0}; + stat_t tcpDiedReadingResponse{0}; + stat_t tcpGaveUp{0}; + stat_t tcpReadTimeouts{0}; + stat_t tcpWriteTimeouts{0}; + stat_t tcpConnectTimeouts{0}; + /* current number of connections to this backend */ + stat_t tcpCurrentConnections{0}; + /* maximum number of concurrent connections to this backend reached */ + stat_t tcpMaxConcurrentConnections{0}; + /* number of times we had to enforce the maximum concurrent connections limit */ + stat_t tcpTooManyConcurrentConnections{0}; + stat_t tcpReusedConnections{0}; + stat_t tcpNewConnections{0}; + stat_t tlsResumptions{0}; + pdns::stat_t_trait<double> tcpAvgQueriesPerConnection{0.0}; + /* in ms */ + pdns::stat_t_trait<double> tcpAvgConnectionDuration{0.0}; + pdns::stat_t_trait<double> queryLoad{0.0}; + pdns::stat_t_trait<double> dropRate{0.0}; + + SharedLockGuarded<std::vector<unsigned int>> hashes; + LockGuarded<std::unique_ptr<FDMultiplexer>> mplexer{nullptr}; +private: + LockGuarded<std::map<uint16_t, IDState>> d_idStatesMap; + vector<IDState> idStates; + + struct LazyHealthCheckStats + { + boost::circular_buffer<bool> d_lastResults; + time_t d_nextCheck{0}; + enum class LazyStatus: uint8_t { Healthy = 0, PotentialFailure, Failed }; + LazyStatus d_status{LazyStatus::Healthy}; + }; + LockGuarded<LazyHealthCheckStats> d_lazyHealthCheckStats; + +public: + std::shared_ptr<TLSCtx> d_tlsCtx{nullptr}; + std::vector<int> sockets; + StopWatch sw; + QPSLimiter qps; + std::atomic<uint64_t> idOffset{0}; + size_t socketsOffset{0}; + double latencyUsec{0.0}; + double latencyUsecTCP{0.0}; + unsigned int d_nextCheck{0}; + uint16_t currentCheckFailures{0}; + uint8_t consecutiveSuccessfulChecks{0}; + std::atomic<bool> hashesComputed{false}; + std::atomic<bool> connected{false}; + bool upStatus{false}; + +private: + void connectUDPSockets(); + + std::thread tid; + std::mutex connectLock; + std::condition_variable d_connectedWait; + std::atomic_flag threadStarted; + bool d_stopped{false}; +public: + + void start(); + + bool isUp() const + { + if (d_config.availability == Availability::Down) { + return false; + } + else if (d_config.availability == Availability::Up) { + return true; + } + return upStatus; + } + + void setUp() { + d_config.availability = Availability::Up; + } + + void setUpStatus(bool newStatus) + { + upStatus = newStatus; + if (!upStatus) { + latencyUsec = 0.0; + latencyUsecTCP = 0.0; + } + } + void setDown() + { + d_config.availability = Availability::Down; + latencyUsec = 0.0; + latencyUsecTCP = 0.0; + } + void setAuto() { + d_config.availability = Availability::Auto; + } + void setLazyAuto() { + d_config.availability = Availability::Lazy; + d_lazyHealthCheckStats.lock()->d_lastResults.set_capacity(d_config.d_lazyHealthCheckSampleSize); + } + bool healthCheckRequired(std::optional<time_t> currentTime = std::nullopt); + + const string& getName() const { + return d_config.name; + } + const string& getNameWithAddr() const { + return d_config.nameWithAddr; + } + void setName(const std::string& newName) + { + d_config.name = newName; + d_config.nameWithAddr = newName.empty() ? d_config.remote.toStringWithPort() : (d_config.name + " (" + d_config.remote.toStringWithPort()+ ")"); + } + + string getStatus() const + { + string status; + if (d_config.availability == DownstreamState::Availability::Up) { + status = "UP"; + } + else if (d_config.availability == DownstreamState::Availability::Down) { + status = "DOWN"; + } + else { + status = (upStatus ? "up" : "down"); + } + return status; + } + + bool reconnect(bool initialAttempt = false); + void waitUntilConnected(); + void hash(); + void setId(const boost::uuids::uuid& newId); + void setWeight(int newWeight); + void stop(); + bool isStopped() const + { + return d_stopped; + } + const boost::uuids::uuid& getID() const + { + return *d_config.id; + } + + void updateTCPMetrics(size_t nbQueries, uint64_t durationMs) + { + tcpAvgQueriesPerConnection = (99.0 * tcpAvgQueriesPerConnection / 100.0) + (nbQueries / 100.0); + tcpAvgConnectionDuration = (99.0 * tcpAvgConnectionDuration / 100.0) + (durationMs / 100.0); + } + + void updateTCPLatency(double udiff) + { + latencyUsecTCP = (127.0 * latencyUsecTCP / 128.0) + udiff / 128.0; + } + + void incQueriesCount() + { + ++queries; + qps.addHit(); + } + + void incCurrentConnectionsCount(); + + bool doHealthcheckOverTCP() const + { + return d_config.d_tcpOnly || d_config.d_tcpCheck || d_tlsCtx != nullptr; + } + + bool isTCPOnly() const + { + return d_config.d_tcpOnly || d_tlsCtx != nullptr; + } + + bool isDoH() const + { + return !d_config.d_dohPath.empty(); + } + + bool passCrossProtocolQuery(std::unique_ptr<CrossProtocolQuery>&& cpq); + int pickSocketForSending(); + void pickSocketsReadyForReceiving(std::vector<int>& ready); + void handleUDPTimeouts(); + void reportTimeoutOrError(); + void reportResponse(uint8_t rcode); + void submitHealthCheckResult(bool initial, bool newState); + time_t getNextLazyHealthCheck(); + uint16_t saveState(InternalQueryState&&); + void restoreState(uint16_t id, InternalQueryState&&); + std::optional<InternalQueryState> getState(uint16_t id); + + dnsdist::Protocol getProtocol() const + { + if (isDoH()) { + return dnsdist::Protocol::DoH; + } + if (d_tlsCtx != nullptr) { + return dnsdist::Protocol::DoT; + } + if (isTCPOnly()) { + return dnsdist::Protocol::DoTCP; + } + return dnsdist::Protocol::DoUDP; + } + + double getRelevantLatencyUsec() const + { + if (isTCPOnly()) { + return latencyUsecTCP; + } + return latencyUsec; + } + + static int s_udpTimeout; + static bool s_randomizeSockets; + static bool s_randomizeIDs; +private: + void handleUDPTimeout(IDState& ids); + void updateNextLazyHealthCheck(LazyHealthCheckStats& stats, bool checkScheduled, std::optional<time_t> currentTime = std::nullopt); +}; +using servers_t = vector<std::shared_ptr<DownstreamState>>; + +void responderThread(std::shared_ptr<DownstreamState> state); +extern LockGuarded<LuaContext> g_lua; +extern std::string g_outputBuffer; // locking for this is ok, as locked by g_luamutex + +class DNSRule +{ +public: + virtual ~DNSRule () + { + } + virtual bool matches(const DNSQuestion* dq) const =0; + virtual string toString() const = 0; + mutable stat_t d_matches{0}; +}; + +struct ServerPool +{ + ServerPool(): d_servers(std::make_shared<const ServerPolicy::NumberedServerVector>()) + { + } + + ~ServerPool() + { + } + + const std::shared_ptr<DNSDistPacketCache> getCache() const { return packetCache; }; + + bool getECS() const + { + return d_useECS; + } + + void setECS(bool useECS) + { + d_useECS = useECS; + } + + std::shared_ptr<DNSDistPacketCache> packetCache{nullptr}; + std::shared_ptr<ServerPolicy> policy{nullptr}; + + size_t poolLoad(); + size_t countServers(bool upOnly); + const std::shared_ptr<const ServerPolicy::NumberedServerVector> getServers(); + void addServer(shared_ptr<DownstreamState>& server); + void removeServer(shared_ptr<DownstreamState>& server); + +private: + SharedLockGuarded<std::shared_ptr<const ServerPolicy::NumberedServerVector>> d_servers; + bool d_useECS{false}; +}; + +enum ednsHeaderFlags { + EDNS_HEADER_FLAG_NONE = 0, + EDNS_HEADER_FLAG_DO = 32768 +}; + +struct DNSDistRuleAction +{ + std::shared_ptr<DNSRule> d_rule; + std::shared_ptr<DNSAction> d_action; + std::string d_name; + boost::uuids::uuid d_id; + uint64_t d_creationOrder; +}; + +struct DNSDistResponseRuleAction +{ + std::shared_ptr<DNSRule> d_rule; + std::shared_ptr<DNSResponseAction> d_action; + std::string d_name; + boost::uuids::uuid d_id; + uint64_t d_creationOrder; +}; + +extern GlobalStateHolder<SuffixMatchTree<DynBlock>> g_dynblockSMT; +extern DNSAction::Action g_dynBlockAction; + +extern GlobalStateHolder<ServerPolicy> g_policy; +extern GlobalStateHolder<servers_t> g_dstates; +extern GlobalStateHolder<pools_t> g_pools; +extern GlobalStateHolder<vector<DNSDistRuleAction> > g_ruleactions; +extern GlobalStateHolder<vector<DNSDistResponseRuleAction> > g_respruleactions; +extern GlobalStateHolder<vector<DNSDistResponseRuleAction> > g_cachehitrespruleactions; +extern GlobalStateHolder<vector<DNSDistResponseRuleAction> > g_selfansweredrespruleactions; +extern GlobalStateHolder<vector<DNSDistResponseRuleAction> > g_cacheInsertedRespRuleActions; +extern GlobalStateHolder<NetmaskGroup> g_ACL; + +extern ComboAddress g_serverControl; // not changed during runtime + +extern std::vector<shared_ptr<TLSFrontend>> g_tlslocals; +extern std::vector<shared_ptr<DOHFrontend>> g_dohlocals; +extern std::vector<std::unique_ptr<ClientState>> g_frontends; +extern bool g_truncateTC; +extern bool g_fixupCase; +extern int g_tcpRecvTimeout; +extern int g_tcpSendTimeout; +extern uint16_t g_maxOutstanding; +extern std::atomic<bool> g_configurationDone; +extern boost::optional<uint64_t> g_maxTCPClientThreads; +extern uint64_t g_maxTCPQueuedConnections; +extern size_t g_maxTCPQueriesPerConn; +extern size_t g_maxTCPConnectionDuration; +extern size_t g_tcpInternalPipeBufferSize; +extern pdns::stat16_t g_cacheCleaningDelay; +extern pdns::stat16_t g_cacheCleaningPercentage; +extern uint32_t g_staleCacheEntriesTTL; +extern bool g_apiReadWrite; +extern std::string g_apiConfigDirectory; +extern bool g_servFailOnNoPolicy; +extern size_t g_udpVectorSize; +extern bool g_allowEmptyResponse; +extern uint32_t g_socketUDPSendBuffer; +extern uint32_t g_socketUDPRecvBuffer; + +extern shared_ptr<BPFFilter> g_defaultBPFFilter; +extern std::vector<std::shared_ptr<DynBPFFilter> > g_dynBPFFilters; + +struct LocalHolders +{ + LocalHolders(): acl(g_ACL.getLocal()), policy(g_policy.getLocal()), ruleactions(g_ruleactions.getLocal()), cacheHitRespRuleactions(g_cachehitrespruleactions.getLocal()), cacheInsertedRespRuleActions(g_cacheInsertedRespRuleActions.getLocal()), selfAnsweredRespRuleactions(g_selfansweredrespruleactions.getLocal()), servers(g_dstates.getLocal()), dynNMGBlock(g_dynblockNMG.getLocal()), dynSMTBlock(g_dynblockSMT.getLocal()), pools(g_pools.getLocal()) + { + } + + LocalStateHolder<NetmaskGroup> acl; + LocalStateHolder<ServerPolicy> policy; + LocalStateHolder<vector<DNSDistRuleAction> > ruleactions; + LocalStateHolder<vector<DNSDistResponseRuleAction> > cacheHitRespRuleactions; + LocalStateHolder<vector<DNSDistResponseRuleAction> > cacheInsertedRespRuleActions; + LocalStateHolder<vector<DNSDistResponseRuleAction> > selfAnsweredRespRuleactions; + LocalStateHolder<servers_t> servers; + LocalStateHolder<NetmaskTree<DynBlock, AddressAndPortRange> > dynNMGBlock; + LocalStateHolder<SuffixMatchTree<DynBlock> > dynSMTBlock; + LocalStateHolder<pools_t> pools; +}; + +void tcpAcceptorThread(std::vector<ClientState*> states); + +#ifdef HAVE_DNS_OVER_HTTPS +void dohThread(ClientState* cs); +#endif /* HAVE_DNS_OVER_HTTPS */ + +void setLuaNoSideEffect(); // if nothing has been declared, set that there are no side effects +void setLuaSideEffect(); // set to report a side effect, cancelling all _no_ side effect calls +bool getLuaNoSideEffect(); // set if there were only explicit declarations of _no_ side effect +void resetLuaSideEffect(); // reset to indeterminate state + +bool responseContentMatches(const PacketBuffer& response, const DNSName& qname, const uint16_t qtype, const uint16_t qclass, const std::shared_ptr<DownstreamState>& remote, unsigned int& qnameWireLength); + +bool checkQueryHeaders(const struct dnsheader* dh, ClientState& cs); + +extern std::vector<std::shared_ptr<DNSCryptContext>> g_dnsCryptLocals; +int handleDNSCryptQuery(PacketBuffer& packet, DNSCryptQuery& query, bool tcp, time_t now, PacketBuffer& response); +bool checkDNSCryptQuery(const ClientState& cs, PacketBuffer& query, std::unique_ptr<DNSCryptQuery>& dnsCryptQuery, time_t now, bool tcp); + +#include "dnsdist-snmp.hh" + +extern bool g_snmpEnabled; +extern bool g_snmpTrapsEnabled; +extern DNSDistSNMPAgent* g_snmpAgent; +extern bool g_addEDNSToSelfGeneratedResponses; + +extern std::set<std::string> g_capabilitiesToRetain; +static const uint16_t s_udpIncomingBufferSize{1500}; // don't accept UDP queries larger than this value +static const size_t s_maxPacketCacheEntrySize{4096}; // don't cache responses larger than this value + +enum class ProcessQueryResult : uint8_t { Drop, SendAnswer, PassToBackend, Asynchronous }; +ProcessQueryResult processQuery(DNSQuestion& dq, LocalHolders& holders, std::shared_ptr<DownstreamState>& selectedBackend); +ProcessQueryResult processQueryAfterRules(DNSQuestion& dq, LocalHolders& holders, std::shared_ptr<DownstreamState>& selectedBackend); +bool processResponse(PacketBuffer& response, const std::vector<DNSDistResponseRuleAction>& respRuleActions, const std::vector<DNSDistResponseRuleAction>& insertedRespRuleActions, DNSResponse& dr, bool muted); +bool processRulesResult(const DNSAction::Action& action, DNSQuestion& dq, std::string& ruleresult, bool& drop); +bool processResponseAfterRules(PacketBuffer& response, const std::vector<DNSDistResponseRuleAction>& cacheInsertedRespRuleActions, DNSResponse& dr, bool muted); + +bool assignOutgoingUDPQueryToBackend(std::shared_ptr<DownstreamState>& ds, uint16_t queryID, DNSQuestion& dq, PacketBuffer& query, ComboAddress& dest); + +ssize_t udpClientSendRequestToBackend(const std::shared_ptr<DownstreamState>& ss, const int sd, const PacketBuffer& request, bool healthCheck = false); +bool sendUDPResponse(int origFD, const PacketBuffer& response, const int delayMsec, const ComboAddress& origDest, const ComboAddress& origRemote); +void handleResponseSent(const DNSName& qname, const QType& qtype, double udiff, const ComboAddress& client, const ComboAddress& backend, unsigned int size, const dnsheader& cleartextDH, dnsdist::Protocol outgoingProtocol, dnsdist::Protocol incomingProtocol, bool fromBackend); +void handleResponseSent(const InternalQueryState& ids, double udiff, const ComboAddress& client, const ComboAddress& backend, unsigned int size, const dnsheader& cleartextDH, dnsdist::Protocol outgoingProtocol, bool fromBackend); |