Rename intel to resolver
This commit is contained in:
Daniel
357
resolver/resolvers.go
Normal file
357
resolver/resolvers.go
Normal file
@@ -0,0 +1,357 @@
|
||||
package resolver
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"fmt"
|
||||
"net"
|
||||
"sort"
|
||||
"strconv"
|
||||
"strings"
|
||||
"sync"
|
||||
|
||||
"golang.org/x/net/publicsuffix"
|
||||
|
||||
"github.com/miekg/dns"
|
||||
"github.com/safing/portbase/log"
|
||||
"github.com/safing/portmaster/network/environment"
|
||||
"github.com/safing/portmaster/network/netutils"
|
||||
)
|
||||
|
||||
// Scope defines a domain scope and which resolvers can resolve it.
|
||||
type Scope struct {
|
||||
Domain string
|
||||
Resolvers []*Resolver
|
||||
}
|
||||
|
||||
var (
|
||||
globalResolvers []*Resolver // all (global) resolvers
|
||||
localResolvers []*Resolver // all resolvers that are in site-local or link-local IP ranges
|
||||
localScopes []*Scope // list of scopes with a list of local resolvers that can resolve the scope
|
||||
allResolvers map[string]*Resolver // lookup map of all resolvers
|
||||
resolversLock sync.RWMutex
|
||||
|
||||
dupReqMap = make(map[string]*sync.WaitGroup)
|
||||
dupReqLock sync.Mutex
|
||||
)
|
||||
|
||||
func indexOfResolver(server string, list []*Resolver) int {
|
||||
for k, v := range list {
|
||||
if v.Server == server {
|
||||
return k
|
||||
}
|
||||
}
|
||||
return -1
|
||||
}
|
||||
|
||||
func indexOfScope(domain string, list []*Scope) int {
|
||||
for k, v := range list {
|
||||
if v.Domain == domain {
|
||||
return k
|
||||
}
|
||||
}
|
||||
return -1
|
||||
}
|
||||
|
||||
func getResolverByIDWithLocking(server string) *Resolver {
|
||||
resolversLock.Lock()
|
||||
defer resolversLock.Unlock()
|
||||
|
||||
resolver, ok := allResolvers[server]
|
||||
if ok {
|
||||
return resolver
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func parseAddress(server string) (net.IP, uint16, error) {
|
||||
delimiter := strings.LastIndex(server, ":")
|
||||
if delimiter < 0 {
|
||||
return nil, 0, errors.New("port missing")
|
||||
}
|
||||
ip := net.ParseIP(strings.Trim(server[:delimiter], "[]"))
|
||||
if ip == nil {
|
||||
return nil, 0, errors.New("invalid IP address")
|
||||
}
|
||||
port, err := strconv.Atoi(server[delimiter+1:])
|
||||
if err != nil || port < 1 || port > 65536 {
|
||||
return nil, 0, errors.New("invalid port")
|
||||
}
|
||||
return ip, uint16(port), nil
|
||||
}
|
||||
|
||||
func urlFormatAddress(ip net.IP, port uint16) string {
|
||||
var address string
|
||||
if ipv4 := ip.To4(); ipv4 != nil {
|
||||
address = fmt.Sprintf("%s:%d", ipv4.String(), port)
|
||||
} else {
|
||||
address = fmt.Sprintf("[%s]:%d", ip.String(), port)
|
||||
}
|
||||
return address
|
||||
}
|
||||
|
||||
//nolint:gocyclo,gocognit
|
||||
func loadResolvers() {
|
||||
// TODO: what happens when a lot of processes want to reload at once? we do not need to run this multiple times in a short time frame.
|
||||
resolversLock.Lock()
|
||||
defer resolversLock.Unlock()
|
||||
|
||||
var newResolvers []*Resolver
|
||||
|
||||
configuredServersLoop:
|
||||
for _, server := range configuredNameServers() {
|
||||
key := indexOfResolver(server, newResolvers)
|
||||
if key >= 0 {
|
||||
continue configuredServersLoop
|
||||
}
|
||||
key = indexOfResolver(server, globalResolvers)
|
||||
if key == -1 {
|
||||
|
||||
parts := strings.Split(server, "|")
|
||||
if len(parts) < 2 {
|
||||
log.Warningf("intel: nameserver format invalid: %s", server)
|
||||
continue configuredServersLoop
|
||||
}
|
||||
|
||||
var ipScope int8
|
||||
ip, port, err := parseAddress(parts[1])
|
||||
if err == nil {
|
||||
ipScope = netutils.ClassifyIP(ip)
|
||||
if ipScope == netutils.HostLocal {
|
||||
log.Warningf(`intel: cannot use configured localhost nameserver "%s"`, server)
|
||||
continue configuredServersLoop
|
||||
}
|
||||
} else {
|
||||
if strings.ToLower(parts[0]) == "doh" {
|
||||
ipScope = netutils.Global
|
||||
} else {
|
||||
log.Warningf("intel: nameserver (%s) address invalid: %s", server, err)
|
||||
continue configuredServersLoop
|
||||
}
|
||||
}
|
||||
|
||||
// create new structs
|
||||
newConn := &BasicResolverConn{}
|
||||
new := &Resolver{
|
||||
Server: server,
|
||||
ServerType: strings.ToLower(parts[0]),
|
||||
ServerAddress: parts[1],
|
||||
ServerIP: ip,
|
||||
ServerIPScope: ipScope,
|
||||
ServerPort: port,
|
||||
Source: "config",
|
||||
Conn: newConn,
|
||||
}
|
||||
|
||||
// refer back
|
||||
newConn.resolver = new
|
||||
|
||||
switch new.ServerType {
|
||||
case "dns":
|
||||
newConn.clientManager = newDNSClientManager(new)
|
||||
case "tcp":
|
||||
newConn.clientManager = newTCPClientManager(new)
|
||||
case "dot":
|
||||
if len(parts) < 3 {
|
||||
log.Warningf("intel: nameserver missing verification domain as third parameter: %s", server)
|
||||
continue configuredServersLoop
|
||||
}
|
||||
new.VerifyDomain = parts[2]
|
||||
newConn.clientManager = newTLSClientManager(new)
|
||||
case "doh":
|
||||
new.SkipFQDN = dns.Fqdn(strings.Split(parts[1], ":")[0])
|
||||
if len(parts) > 2 {
|
||||
new.VerifyDomain = parts[2]
|
||||
}
|
||||
newConn.clientManager = newHTTPSClientManager(new)
|
||||
default:
|
||||
log.Warningf("intel: nameserver (%s) type invalid: %s", server, parts[0])
|
||||
continue configuredServersLoop
|
||||
}
|
||||
newResolvers = append(newResolvers, new)
|
||||
} else {
|
||||
newResolvers = append(newResolvers, globalResolvers[key])
|
||||
}
|
||||
}
|
||||
|
||||
// add local resolvers
|
||||
assignedNameservers := environment.Nameservers()
|
||||
assignedServersLoop:
|
||||
for _, nameserver := range assignedNameservers {
|
||||
server := fmt.Sprintf("dns|%s", urlFormatAddress(nameserver.IP, 53))
|
||||
key := indexOfResolver(server, newResolvers)
|
||||
if key >= 0 {
|
||||
continue assignedServersLoop
|
||||
}
|
||||
key = indexOfResolver(server, globalResolvers)
|
||||
if key == -1 {
|
||||
|
||||
ipScope := netutils.ClassifyIP(nameserver.IP)
|
||||
if ipScope == netutils.HostLocal {
|
||||
log.Infof(`intel: cannot use assigned localhost nameserver at %s`, nameserver.IP)
|
||||
continue assignedServersLoop
|
||||
}
|
||||
|
||||
// create new structs
|
||||
newConn := &BasicResolverConn{}
|
||||
new := &Resolver{
|
||||
Server: server,
|
||||
ServerType: "dns",
|
||||
ServerAddress: urlFormatAddress(nameserver.IP, 53),
|
||||
ServerIP: nameserver.IP,
|
||||
ServerIPScope: ipScope,
|
||||
ServerPort: 53,
|
||||
Source: "dhcp",
|
||||
Conn: newConn,
|
||||
}
|
||||
|
||||
// refer back
|
||||
newConn.resolver = new
|
||||
|
||||
// add client manager
|
||||
newConn.clientManager = newDNSClientManager(new)
|
||||
|
||||
if netutils.IPIsLAN(nameserver.IP) && len(nameserver.Search) > 0 {
|
||||
// only allow searches for local resolvers
|
||||
for _, value := range nameserver.Search {
|
||||
trimmedDomain := strings.Trim(value, ".")
|
||||
if checkSearchScope(trimmedDomain) {
|
||||
new.Search = append(new.Search, fmt.Sprintf(".%s.", strings.Trim(value, ".")))
|
||||
}
|
||||
}
|
||||
// cap to mitigate exploitation via malicious local resolver
|
||||
if len(new.Search) > 100 {
|
||||
new.Search = new.Search[:100]
|
||||
}
|
||||
}
|
||||
newResolvers = append(newResolvers, new)
|
||||
} else {
|
||||
newResolvers = append(newResolvers, globalResolvers[key])
|
||||
}
|
||||
}
|
||||
|
||||
// save resolvers
|
||||
globalResolvers = newResolvers
|
||||
if len(globalResolvers) == 0 {
|
||||
log.Criticalf("intel: no (valid) dns servers found in configuration and system")
|
||||
}
|
||||
|
||||
// make list with local resolvers
|
||||
localResolvers = make([]*Resolver, 0)
|
||||
for _, resolver := range globalResolvers {
|
||||
if resolver.ServerIP != nil && netutils.IPIsLAN(resolver.ServerIP) {
|
||||
localResolvers = append(localResolvers, resolver)
|
||||
}
|
||||
}
|
||||
|
||||
// add resolvers to every scope the cover
|
||||
localScopes = make([]*Scope, 0)
|
||||
for _, resolver := range globalResolvers {
|
||||
|
||||
if resolver.Search != nil {
|
||||
// add resolver to custom searches
|
||||
for _, search := range resolver.Search {
|
||||
if search == "." {
|
||||
continue
|
||||
}
|
||||
key := indexOfScope(search, localScopes)
|
||||
if key == -1 {
|
||||
localScopes = append(localScopes, &Scope{
|
||||
Domain: search,
|
||||
Resolvers: []*Resolver{resolver},
|
||||
})
|
||||
} else {
|
||||
localScopes[key].Resolvers = append(localScopes[key].Resolvers, resolver)
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
// sort scopes by length
|
||||
sort.Slice(localScopes,
|
||||
func(i, j int) bool {
|
||||
return len(localScopes[i].Domain) > len(localScopes[j].Domain)
|
||||
},
|
||||
)
|
||||
|
||||
// log global resolvers
|
||||
if len(globalResolvers) > 0 {
|
||||
log.Trace("intel: loaded global resolvers:")
|
||||
for _, resolver := range globalResolvers {
|
||||
log.Tracef("intel: %s", resolver.Server)
|
||||
}
|
||||
} else {
|
||||
log.Warning("intel: no global resolvers loaded")
|
||||
}
|
||||
|
||||
// log local resolvers
|
||||
if len(localResolvers) > 0 {
|
||||
log.Trace("intel: loaded local resolvers:")
|
||||
for _, resolver := range localResolvers {
|
||||
log.Tracef("intel: %s", resolver.Server)
|
||||
}
|
||||
} else {
|
||||
log.Info("intel: no local resolvers loaded")
|
||||
}
|
||||
|
||||
// log scopes
|
||||
if len(localScopes) > 0 {
|
||||
log.Trace("intel: loaded scopes:")
|
||||
for _, scope := range localScopes {
|
||||
var scopeServers []string
|
||||
for _, resolver := range scope.Resolvers {
|
||||
scopeServers = append(scopeServers, resolver.Server)
|
||||
}
|
||||
log.Tracef("intel: %s: %s", scope.Domain, strings.Join(scopeServers, ", "))
|
||||
}
|
||||
} else {
|
||||
log.Info("intel: no scopes loaded")
|
||||
}
|
||||
|
||||
// alert if no resolvers are loaded
|
||||
if len(globalResolvers) == 0 && len(localResolvers) == 0 {
|
||||
log.Critical("intel: no resolvers loaded!")
|
||||
}
|
||||
}
|
||||
|
||||
func checkSearchScope(searchDomain string) (ok bool) {
|
||||
// sanity check
|
||||
if len(searchDomain) == 0 ||
|
||||
searchDomain[0] == '.' ||
|
||||
searchDomain[len(searchDomain)-1] == '.' {
|
||||
return false
|
||||
}
|
||||
|
||||
// add more subdomains to use official publicsuffix package for our cause
|
||||
searchDomain = "*.*.*.*.*." + searchDomain
|
||||
|
||||
// get suffix
|
||||
suffix, icann := publicsuffix.PublicSuffix(searchDomain)
|
||||
// sanity check
|
||||
if len(suffix) == 0 {
|
||||
return false
|
||||
}
|
||||
// inexistent (custom) tlds are okay
|
||||
// this will include special service domains! (.onion, .bit, ...)
|
||||
if !icann && !strings.Contains(suffix, ".") {
|
||||
return true
|
||||
}
|
||||
|
||||
// check if suffix is a special service domain (may be handled fully by local nameserver)
|
||||
if domainInScope("."+suffix+".", specialServiceScopes) {
|
||||
return true
|
||||
}
|
||||
|
||||
// build eTLD+1
|
||||
split := len(searchDomain) - len(suffix) - 1
|
||||
eTLDplus1 := searchDomain[1+strings.LastIndex(searchDomain[:split], "."):]
|
||||
|
||||
// scope check
|
||||
//nolint:gosimple // want comment
|
||||
if strings.Contains(eTLDplus1, "*") {
|
||||
// oops, search domain is too high up the hierarchy
|
||||
return false
|
||||
}
|
||||
|
||||
return true
|
||||
}
|
||||
Reference in New Issue
Block a user