1/* dnstap support for Unbound */
2
3/*
4 * Copyright (c) 2013-2014, Farsight Security, Inc.
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 *
11 * 1. Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
13 *
14 * 2. Redistributions in binary form must reproduce the above copyright
15 * notice, this list of conditions and the following disclaimer in the
16 * documentation and/or other materials provided with the distribution.
17 *
18 * 3. Neither the name of the copyright holder nor the names of its
19 * contributors may be used to endorse or promote products derived from
20 * this software without specific prior written permission.
21 *
22 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
23 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
24 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
25 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR
26 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
27 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
28 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
29 * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
30 * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
31 * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
32 * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
33 */
34
35#include "dnstap/dnstap_config.h"
36
37#ifdef USE_DNSTAP
38
39#include "config.h"
40#include <string.h>
41#include <sys/time.h>
42#ifdef HAVE_SYS_STAT_H
43#include <sys/stat.h>
44#endif
45#include <errno.h>
46#include "sldns/sbuffer.h"
47#include "util/config_file.h"
48#include "util/net_help.h"
49#include "util/netevent.h"
50#include "util/log.h"
51
52#include <protobuf-c/protobuf-c.h>
53
54#include "dnstap/dnstap.h"
55#include "dnstap/dtstream.h"
56#include "dnstap/dnstap.pb-c.h"
57
58#define DNSTAP_INITIAL_BUF_SIZE		256
59
60struct dt_msg {
61	void		*buf;
62	size_t		len_buf;
63	Dnstap__Dnstap	d;
64	Dnstap__Message	m;
65};
66
67static int
68dt_pack(const Dnstap__Dnstap *d, void **buf, size_t *sz)
69{
70	ProtobufCBufferSimple sbuf;
71
72	memset(&sbuf, 0, sizeof(sbuf));
73	sbuf.base.append = protobuf_c_buffer_simple_append;
74	sbuf.len = 0;
75	sbuf.alloced = DNSTAP_INITIAL_BUF_SIZE;
76	sbuf.data = malloc(sbuf.alloced);
77	if (sbuf.data == NULL)
78		return 0;
79	sbuf.must_free_data = 1;
80
81	*sz = dnstap__dnstap__pack_to_buffer(d, (ProtobufCBuffer *) &sbuf);
82	if (sbuf.data == NULL)
83		return 0;
84	*buf = sbuf.data;
85
86	return 1;
87}
88
89static void
90dt_send(const struct dt_env *env, void *buf, size_t len_buf)
91{
92	dt_msg_queue_submit(env->msgqueue, buf, len_buf);
93}
94
95static void
96dt_msg_init(const struct dt_env *env,
97	    struct dt_msg *dm,
98	    Dnstap__Message__Type mtype)
99{
100	memset(dm, 0, sizeof(*dm));
101	dm->d.base.descriptor = &dnstap__dnstap__descriptor;
102	dm->m.base.descriptor = &dnstap__message__descriptor;
103	dm->d.type = DNSTAP__DNSTAP__TYPE__MESSAGE;
104	dm->d.message = &dm->m;
105	dm->m.type = mtype;
106	if (env->identity != NULL) {
107		dm->d.identity.data = (uint8_t *) env->identity;
108		dm->d.identity.len = (size_t) env->len_identity;
109		dm->d.has_identity = 1;
110	}
111	if (env->version != NULL) {
112		dm->d.version.data = (uint8_t *) env->version;
113		dm->d.version.len = (size_t) env->len_version;
114		dm->d.has_version = 1;
115	}
116}
117
118/* check that the socket file can be opened and exists, print error if not */
119static void
120check_socket_file(const char* socket_path)
121{
122	struct stat statbuf;
123	memset(&statbuf, 0, sizeof(statbuf));
124	if(stat(socket_path, &statbuf) < 0) {
125		log_warn("could not open dnstap-socket-path: %s, %s",
126			socket_path, strerror(errno));
127	}
128}
129
130struct dt_env *
131dt_create(struct config_file* cfg)
132{
133	struct dt_env *env;
134
135	if(cfg->dnstap && cfg->dnstap_socket_path && cfg->dnstap_socket_path[0] &&
136		(cfg->dnstap_ip==NULL || cfg->dnstap_ip[0]==0)) {
137		char* p = cfg->dnstap_socket_path;
138		if(cfg->chrootdir && cfg->chrootdir[0] && strncmp(p,
139			cfg->chrootdir, strlen(cfg->chrootdir)) == 0)
140			p += strlen(cfg->chrootdir);
141		verbose(VERB_OPS, "attempting to connect to dnstap socket %s",
142			p);
143		check_socket_file(p);
144	}
145
146	env = (struct dt_env *) calloc(1, sizeof(struct dt_env));
147	if (!env)
148		return NULL;
149
150	env->dtio = dt_io_thread_create();
151	if(!env->dtio) {
152		log_err("malloc failure");
153		free(env);
154		return NULL;
155	}
156	if(!dt_io_thread_apply_cfg(env->dtio, cfg)) {
157		dt_io_thread_delete(env->dtio);
158		free(env);
159		return NULL;
160	}
161	dt_apply_cfg(env, cfg);
162	return env;
163}
164
165static void
166dt_apply_identity(struct dt_env *env, struct config_file *cfg)
167{
168	char buf[MAXHOSTNAMELEN+1];
169	if (!cfg->dnstap_send_identity)
170		return;
171	free(env->identity);
172	if (cfg->dnstap_identity == NULL || cfg->dnstap_identity[0] == 0) {
173		if (gethostname(buf, MAXHOSTNAMELEN) == 0) {
174			buf[MAXHOSTNAMELEN] = 0;
175			env->identity = strdup(buf);
176		} else {
177			fatal_exit("dt_apply_identity: gethostname() failed");
178		}
179	} else {
180		env->identity = strdup(cfg->dnstap_identity);
181	}
182	if (env->identity == NULL)
183		fatal_exit("dt_apply_identity: strdup() failed");
184	env->len_identity = (unsigned int)strlen(env->identity);
185	verbose(VERB_OPS, "dnstap identity field set to \"%s\"",
186		env->identity);
187}
188
189static void
190dt_apply_version(struct dt_env *env, struct config_file *cfg)
191{
192	if (!cfg->dnstap_send_version)
193		return;
194	free(env->version);
195	if (cfg->dnstap_version == NULL || cfg->dnstap_version[0] == 0)
196		env->version = strdup(PACKAGE_STRING);
197	else
198		env->version = strdup(cfg->dnstap_version);
199	if (env->version == NULL)
200		fatal_exit("dt_apply_version: strdup() failed");
201	env->len_version = (unsigned int)strlen(env->version);
202	verbose(VERB_OPS, "dnstap version field set to \"%s\"",
203		env->version);
204}
205
206void
207dt_apply_cfg(struct dt_env *env, struct config_file *cfg)
208{
209	if (!cfg->dnstap)
210		return;
211
212	dt_apply_identity(env, cfg);
213	dt_apply_version(env, cfg);
214	if ((env->log_resolver_query_messages = (unsigned int)
215	     cfg->dnstap_log_resolver_query_messages))
216	{
217		verbose(VERB_OPS, "dnstap Message/RESOLVER_QUERY enabled");
218	}
219	if ((env->log_resolver_response_messages = (unsigned int)
220	     cfg->dnstap_log_resolver_response_messages))
221	{
222		verbose(VERB_OPS, "dnstap Message/RESOLVER_RESPONSE enabled");
223	}
224	if ((env->log_client_query_messages = (unsigned int)
225	     cfg->dnstap_log_client_query_messages))
226	{
227		verbose(VERB_OPS, "dnstap Message/CLIENT_QUERY enabled");
228	}
229	if ((env->log_client_response_messages = (unsigned int)
230	     cfg->dnstap_log_client_response_messages))
231	{
232		verbose(VERB_OPS, "dnstap Message/CLIENT_RESPONSE enabled");
233	}
234	if ((env->log_forwarder_query_messages = (unsigned int)
235	     cfg->dnstap_log_forwarder_query_messages))
236	{
237		verbose(VERB_OPS, "dnstap Message/FORWARDER_QUERY enabled");
238	}
239	if ((env->log_forwarder_response_messages = (unsigned int)
240	     cfg->dnstap_log_forwarder_response_messages))
241	{
242		verbose(VERB_OPS, "dnstap Message/FORWARDER_RESPONSE enabled");
243	}
244}
245
246int
247dt_init(struct dt_env *env, struct comm_base* base)
248{
249	env->msgqueue = dt_msg_queue_create(base);
250	if(!env->msgqueue) {
251		log_err("malloc failure");
252		return 0;
253	}
254	if(!dt_io_thread_register_queue(env->dtio, env->msgqueue)) {
255		log_err("malloc failure");
256		dt_msg_queue_delete(env->msgqueue);
257		env->msgqueue = NULL;
258		return 0;
259	}
260	return 1;
261}
262
263void
264dt_deinit(struct dt_env* env)
265{
266	dt_io_thread_unregister_queue(env->dtio, env->msgqueue);
267	dt_msg_queue_delete(env->msgqueue);
268}
269
270void
271dt_delete(struct dt_env *env)
272{
273	if (!env)
274		return;
275	dt_io_thread_delete(env->dtio);
276	free(env->identity);
277	free(env->version);
278	free(env);
279}
280
281static void
282dt_fill_timeval(const struct timeval *tv,
283		uint64_t *time_sec, protobuf_c_boolean *has_time_sec,
284		uint32_t *time_nsec, protobuf_c_boolean *has_time_nsec)
285{
286#ifndef S_SPLINT_S
287	*time_sec = tv->tv_sec;
288	*time_nsec = tv->tv_usec * 1000;
289#endif
290	*has_time_sec = 1;
291	*has_time_nsec = 1;
292}
293
294static void
295dt_fill_buffer(sldns_buffer *b, ProtobufCBinaryData *p, protobuf_c_boolean *has)
296{
297	log_assert(b != NULL);
298	p->len = sldns_buffer_limit(b);
299	p->data = sldns_buffer_begin(b);
300	*has = 1;
301}
302
303static void
304dt_msg_fill_net(struct dt_msg *dm,
305		struct sockaddr_storage *ss,
306		enum comm_point_type cptype,
307		ProtobufCBinaryData *addr, protobuf_c_boolean *has_addr,
308		uint32_t *port, protobuf_c_boolean *has_port)
309{
310	log_assert(ss->ss_family == AF_INET6 || ss->ss_family == AF_INET);
311	if (ss->ss_family == AF_INET6) {
312		struct sockaddr_in6 *s = (struct sockaddr_in6 *) ss;
313
314		/* socket_family */
315		dm->m.socket_family = DNSTAP__SOCKET_FAMILY__INET6;
316		dm->m.has_socket_family = 1;
317
318		/* addr: query_address or response_address */
319		addr->data = s->sin6_addr.s6_addr;
320		addr->len = 16; /* IPv6 */
321		*has_addr = 1;
322
323		/* port: query_port or response_port */
324		*port = ntohs(s->sin6_port);
325		*has_port = 1;
326	} else if (ss->ss_family == AF_INET) {
327		struct sockaddr_in *s = (struct sockaddr_in *) ss;
328
329		/* socket_family */
330		dm->m.socket_family = DNSTAP__SOCKET_FAMILY__INET;
331		dm->m.has_socket_family = 1;
332
333		/* addr: query_address or response_address */
334		addr->data = (uint8_t *) &s->sin_addr.s_addr;
335		addr->len = 4; /* IPv4 */
336		*has_addr = 1;
337
338		/* port: query_port or response_port */
339		*port = ntohs(s->sin_port);
340		*has_port = 1;
341	}
342
343	log_assert(cptype == comm_udp || cptype == comm_tcp);
344	if (cptype == comm_udp) {
345		/* socket_protocol */
346		dm->m.socket_protocol = DNSTAP__SOCKET_PROTOCOL__UDP;
347		dm->m.has_socket_protocol = 1;
348	} else if (cptype == comm_tcp) {
349		/* socket_protocol */
350		dm->m.socket_protocol = DNSTAP__SOCKET_PROTOCOL__TCP;
351		dm->m.has_socket_protocol = 1;
352	}
353}
354
355void
356dt_msg_send_client_query(struct dt_env *env,
357			 struct sockaddr_storage *qsock,
358			 enum comm_point_type cptype,
359			 sldns_buffer *qmsg)
360{
361	struct dt_msg dm;
362	struct timeval qtime;
363
364	gettimeofday(&qtime, NULL);
365
366	/* type */
367	dt_msg_init(env, &dm, DNSTAP__MESSAGE__TYPE__CLIENT_QUERY);
368
369	/* query_time */
370	dt_fill_timeval(&qtime,
371			&dm.m.query_time_sec, &dm.m.has_query_time_sec,
372			&dm.m.query_time_nsec, &dm.m.has_query_time_nsec);
373
374	/* query_message */
375	dt_fill_buffer(qmsg, &dm.m.query_message, &dm.m.has_query_message);
376
377	/* socket_family, socket_protocol, query_address, query_port */
378	log_assert(cptype == comm_udp || cptype == comm_tcp);
379	dt_msg_fill_net(&dm, qsock, cptype,
380			&dm.m.query_address, &dm.m.has_query_address,
381			&dm.m.query_port, &dm.m.has_query_port);
382
383	if (dt_pack(&dm.d, &dm.buf, &dm.len_buf))
384		dt_send(env, dm.buf, dm.len_buf);
385}
386
387void
388dt_msg_send_client_response(struct dt_env *env,
389			    struct sockaddr_storage *qsock,
390			    enum comm_point_type cptype,
391			    sldns_buffer *rmsg)
392{
393	struct dt_msg dm;
394	struct timeval rtime;
395
396	gettimeofday(&rtime, NULL);
397
398	/* type */
399	dt_msg_init(env, &dm, DNSTAP__MESSAGE__TYPE__CLIENT_RESPONSE);
400
401	/* response_time */
402	dt_fill_timeval(&rtime,
403			&dm.m.response_time_sec, &dm.m.has_response_time_sec,
404			&dm.m.response_time_nsec, &dm.m.has_response_time_nsec);
405
406	/* response_message */
407	dt_fill_buffer(rmsg, &dm.m.response_message, &dm.m.has_response_message);
408
409	/* socket_family, socket_protocol, query_address, query_port */
410	log_assert(cptype == comm_udp || cptype == comm_tcp);
411	dt_msg_fill_net(&dm, qsock, cptype,
412			&dm.m.query_address, &dm.m.has_query_address,
413			&dm.m.query_port, &dm.m.has_query_port);
414
415	if (dt_pack(&dm.d, &dm.buf, &dm.len_buf))
416		dt_send(env, dm.buf, dm.len_buf);
417}
418
419void
420dt_msg_send_outside_query(struct dt_env *env,
421			  struct sockaddr_storage *rsock,
422			  enum comm_point_type cptype,
423			  uint8_t *zone, size_t zone_len,
424			  sldns_buffer *qmsg)
425{
426	struct dt_msg dm;
427	struct timeval qtime;
428	uint16_t qflags;
429
430	gettimeofday(&qtime, NULL);
431	qflags = sldns_buffer_read_u16_at(qmsg, 2);
432
433	/* type */
434	if (qflags & BIT_RD) {
435		if (!env->log_forwarder_query_messages)
436			return;
437		dt_msg_init(env, &dm, DNSTAP__MESSAGE__TYPE__FORWARDER_QUERY);
438	} else {
439		if (!env->log_resolver_query_messages)
440			return;
441		dt_msg_init(env, &dm, DNSTAP__MESSAGE__TYPE__RESOLVER_QUERY);
442	}
443
444	/* query_zone */
445	dm.m.query_zone.data = zone;
446	dm.m.query_zone.len = zone_len;
447	dm.m.has_query_zone = 1;
448
449	/* query_time_sec, query_time_nsec */
450	dt_fill_timeval(&qtime,
451			&dm.m.query_time_sec, &dm.m.has_query_time_sec,
452			&dm.m.query_time_nsec, &dm.m.has_query_time_nsec);
453
454	/* query_message */
455	dt_fill_buffer(qmsg, &dm.m.query_message, &dm.m.has_query_message);
456
457	/* socket_family, socket_protocol, response_address, response_port */
458	log_assert(cptype == comm_udp || cptype == comm_tcp);
459	dt_msg_fill_net(&dm, rsock, cptype,
460			&dm.m.response_address, &dm.m.has_response_address,
461			&dm.m.response_port, &dm.m.has_response_port);
462
463	if (dt_pack(&dm.d, &dm.buf, &dm.len_buf))
464		dt_send(env, dm.buf, dm.len_buf);
465}
466
467void
468dt_msg_send_outside_response(struct dt_env *env,
469			     struct sockaddr_storage *rsock,
470			     enum comm_point_type cptype,
471			     uint8_t *zone, size_t zone_len,
472			     uint8_t *qbuf, size_t qbuf_len,
473			     const struct timeval *qtime,
474			     const struct timeval *rtime,
475			     sldns_buffer *rmsg)
476{
477	struct dt_msg dm;
478	uint16_t qflags;
479
480	log_assert(qbuf_len >= sizeof(qflags));
481	memcpy(&qflags, qbuf, sizeof(qflags));
482	qflags = ntohs(qflags);
483
484	/* type */
485	if (qflags & BIT_RD) {
486		if (!env->log_forwarder_response_messages)
487			return;
488		dt_msg_init(env, &dm, DNSTAP__MESSAGE__TYPE__FORWARDER_RESPONSE);
489	} else {
490		if (!env->log_resolver_response_messages)
491			return;
492		dt_msg_init(env, &dm, DNSTAP__MESSAGE__TYPE__RESOLVER_RESPONSE);
493	}
494
495	/* query_zone */
496	dm.m.query_zone.data = zone;
497	dm.m.query_zone.len = zone_len;
498	dm.m.has_query_zone = 1;
499
500	/* query_time_sec, query_time_nsec */
501	dt_fill_timeval(qtime,
502			&dm.m.query_time_sec, &dm.m.has_query_time_sec,
503			&dm.m.query_time_nsec, &dm.m.has_query_time_nsec);
504
505	/* response_time_sec, response_time_nsec */
506	dt_fill_timeval(rtime,
507			&dm.m.response_time_sec, &dm.m.has_response_time_sec,
508			&dm.m.response_time_nsec, &dm.m.has_response_time_nsec);
509
510	/* response_message */
511	dt_fill_buffer(rmsg, &dm.m.response_message, &dm.m.has_response_message);
512
513	/* socket_family, socket_protocol, response_address, response_port */
514	log_assert(cptype == comm_udp || cptype == comm_tcp);
515	dt_msg_fill_net(&dm, rsock, cptype,
516			&dm.m.response_address, &dm.m.has_response_address,
517			&dm.m.response_port, &dm.m.has_response_port);
518
519	if (dt_pack(&dm.d, &dm.buf, &dm.len_buf))
520		dt_send(env, dm.buf, dm.len_buf);
521}
522
523#endif /* USE_DNSTAP */
524