]>
Commit | Line | Data |
---|---|---|
12471842 PL |
1 | /* |
2 | * This file is part of PowerDNS or dnsdist. | |
3 | * Copyright -- PowerDNS.COM B.V. and its contributors | |
4 | * | |
5 | * This program is free software; you can redistribute it and/or modify | |
6 | * it under the terms of version 2 of the GNU General Public License as | |
7 | * published by the Free Software Foundation. | |
8 | * | |
9 | * In addition, for the avoidance of any doubt, permission is granted to | |
10 | * link this program with OpenSSL and to (re)distribute the binaries | |
11 | * produced as the result of such linking. | |
12 | * | |
13 | * This program is distributed in the hope that it will be useful, | |
14 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | |
15 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | |
16 | * GNU General Public License for more details. | |
17 | * | |
18 | * You should have received a copy of the GNU General Public License | |
19 | * along with this program; if not, write to the Free Software | |
20 | * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. | |
21 | */ | |
870a0fe4 AT |
22 | #ifdef HAVE_CONFIG_H |
23 | #include "config.h" | |
24 | #endif | |
0efda032 BH |
25 | #include <bitset> |
26 | #include "dnsparser.hh" | |
27 | #include "iputils.hh" | |
28 | #undef L | |
29 | #include <boost/program_options.hpp> | |
30 | ||
31 | #include <boost/format.hpp> | |
32 | #include <boost/utility.hpp> | |
33 | #include <boost/multi_index_container.hpp> | |
34 | #include <boost/multi_index/ordered_index.hpp> | |
35 | #include <boost/multi_index/key_extractors.hpp> | |
8472da1b BH |
36 | #include <boost/algorithm/string.hpp> |
37 | #include <sys/types.h> | |
38 | #include <sys/stat.h> | |
39 | #include <fcntl.h> | |
2d21c5cd | 40 | #include <grp.h> |
df62aa1d | 41 | #include "dnsrecords.hh" |
0efda032 | 42 | #include "mplexer.hh" |
8bc03e7e | 43 | #include "statbag.hh" |
0efda032 | 44 | |
61b26744 | 45 | #include "namespaces.hh" |
0efda032 | 46 | using namespace ::boost::multi_index; |
10f4eea8 | 47 | #include "namespaces.hh" |
0efda032 BH |
48 | |
49 | namespace po = boost::program_options; | |
50 | po::variables_map g_vm; | |
51 | ||
8bc03e7e BH |
52 | StatBag S; |
53 | ||
0efda032 BH |
54 | SelectFDMultiplexer g_fdm; |
55 | int g_pdnssocket; | |
8472da1b | 56 | bool g_verbose; |
0efda032 BH |
57 | |
58 | struct NotificationInFlight | |
59 | { | |
60 | ComboAddress source; | |
33ecb315 | 61 | time_t resentTime; |
5ab019ac | 62 | DNSName domain; |
33ecb315 BH |
63 | uint16_t origID, resentID; |
64 | int origSocket; | |
0efda032 BH |
65 | }; |
66 | ||
8472da1b BH |
67 | typedef map<uint16_t, NotificationInFlight> nifs_t; |
68 | nifs_t g_nifs; | |
33ecb315 | 69 | |
c37f5e15 BH |
70 | void syslogFmt(const boost::format& fmt) |
71 | { | |
72 | cerr<<"nproxy: "<<fmt<<endl; | |
73 | syslog(LOG_WARNING, "%s", str(fmt).c_str()); | |
74 | } | |
75 | ||
0efda032 BH |
76 | void handleOutsideUDPPacket(int fd, boost::any&) |
77 | try | |
78 | { | |
79 | char buffer[1500]; | |
80 | struct NotificationInFlight nif; | |
d7c676a5 RG |
81 | /* make sure we report enough room for IPv6 */ |
82 | nif.source.sin4.sin_family = AF_INET6; | |
33ecb315 | 83 | nif.origSocket = fd; |
0efda032 | 84 | |
d7c676a5 | 85 | socklen_t socklen=nif.source.getSocklen(); |
0efda032 BH |
86 | |
87 | int res=recvfrom(fd, buffer, sizeof(buffer), 0, (struct sockaddr*)&nif.source, &socklen); | |
88 | if(!res) | |
89 | return; | |
90 | ||
91 | if(res < 0) | |
92 | throw runtime_error("reading packet from remote: "+stringerror()); | |
93 | ||
94 | string packet(buffer, res); | |
27c0050c | 95 | MOADNSParser mdp(true, packet); |
33ecb315 BH |
96 | nif.domain = mdp.d_qname; |
97 | nif.origID = mdp.d_header.id; | |
0efda032 | 98 | |
c37f5e15 | 99 | |
5ab019ac | 100 | if(mdp.d_header.opcode == Opcode::Query && !mdp.d_header.qr && mdp.d_answers.empty() && mdp.d_qname.toString() == "pdns.nproxy." && |
8825be6b | 101 | (mdp.d_qtype == QType::TXT || mdp.d_qtype ==QType::A)) { |
df62aa1d BH |
102 | vector<uint8_t> packet; |
103 | DNSPacketWriter pw(packet, mdp.d_qname, mdp.d_qtype); | |
104 | pw.getHeader()->id = mdp.d_header.id; | |
105 | pw.getHeader()->rd = mdp.d_header.rd; | |
106 | pw.getHeader()->qr = 1; | |
107 | ||
8825be6b BH |
108 | pw.startRecord(mdp.d_qname, mdp.d_qtype); |
109 | if(mdp.d_qtype == QType::TXT) { | |
110 | TXTRecordContent trc("\"OK\""); | |
111 | trc.toPacket(pw); | |
112 | } | |
113 | else if(mdp.d_qtype == QType::A) { | |
114 | ARecordContent arc("1.2.3.4"); | |
115 | arc.toPacket(pw); | |
116 | } | |
df62aa1d | 117 | pw.commit(); |
0d502f42 BH |
118 | |
119 | if(sendto(fd, &packet[0], packet.size(), 0, (struct sockaddr*)&nif.source, socklen) < 0) { | |
120 | syslogFmt(boost::format("Unable to send health check response to external nameserver %s - %s") % nif.source.toStringWithPort() % stringerror()); | |
121 | } | |
df62aa1d BH |
122 | return; |
123 | } | |
0efda032 BH |
124 | |
125 | if(mdp.d_header.opcode != Opcode::Notify || mdp.d_qtype != QType::SOA) { | |
5ab019ac | 126 | syslogFmt(boost::format("Received non-notification packet for domain '%s' from external nameserver %s") % nif.domain.toString() % nif.source.toStringWithPort()); |
0efda032 BH |
127 | return; |
128 | } | |
5ab019ac | 129 | syslogFmt(boost::format("External notification received for domain '%s' from %s") % nif.domain.toString() % nif.source.toStringWithPort()); |
0efda032 BH |
130 | vector<uint8_t> outpacket; |
131 | DNSPacketWriter pw(outpacket, mdp.d_qname, mdp.d_qtype, 1, Opcode::Notify); | |
33ecb315 BH |
132 | |
133 | static uint16_t s_idpool; | |
134 | pw.getHeader()->id = nif.resentID = s_idpool++; | |
135 | ||
136 | if(send(g_pdnssocket, &outpacket[0], outpacket.size(), 0) < 0) { | |
137 | throw runtime_error("Unable to send notify to PowerDNS: "+stringerror()); | |
138 | } | |
139 | nif.resentTime=time(0); | |
140 | g_nifs[nif.resentID] = nif; | |
141 | ||
142 | } | |
adc10f99 | 143 | catch(std::exception &e) |
33ecb315 | 144 | { |
c37f5e15 | 145 | syslogFmt(boost::format("Error parsing packet from external nameserver: %s") % e.what()); |
33ecb315 BH |
146 | } |
147 | ||
148 | ||
149 | void handleInsideUDPPacket(int fd, boost::any&) | |
150 | try | |
151 | { | |
152 | char buffer[1500]; | |
153 | struct NotificationInFlight nif; | |
d7c676a5 RG |
154 | /* make sure we report enough room for IPv6 */ |
155 | nif.source.sin4.sin_family = AF_INET6; | |
33ecb315 | 156 | |
d7c676a5 | 157 | socklen_t socklen=nif.source.getSocklen(); |
33ecb315 | 158 | |
8472da1b BH |
159 | int len=recvfrom(fd, buffer, sizeof(buffer), 0, (struct sockaddr*)&nif.source, &socklen); |
160 | if(!len) | |
33ecb315 BH |
161 | return; |
162 | ||
8472da1b | 163 | if(len < 0) |
33ecb315 BH |
164 | throw runtime_error("reading packet from remote: "+stringerror()); |
165 | ||
8472da1b | 166 | string packet(buffer, len); |
27c0050c | 167 | MOADNSParser mdp(false, packet); |
33ecb315 | 168 | |
c37f5e15 | 169 | // cerr<<"Inside notification response for: "<<mdp.d_qname<<endl; |
33ecb315 BH |
170 | |
171 | if(!g_nifs.count(mdp.d_header.id)) { | |
73367b2e | 172 | syslogFmt(boost::format("Response from inner PowerDNS with unknown ID %1%") % (uint16_t)mdp.d_header.id); |
33ecb315 BH |
173 | return; |
174 | } | |
175 | ||
176 | nif=g_nifs[mdp.d_header.id]; | |
177 | ||
5ab019ac PL |
178 | if(nif.domain != mdp.d_qname) { |
179 | syslogFmt(boost::format("Response from inner nameserver for different domain '%s' than original notification '%s'") % mdp.d_qname.toString() % nif.domain.toString()); | |
8472da1b | 180 | } else { |
8472da1b | 181 | if(sendto(nif.origSocket, buffer, len, 0, (sockaddr*) &nif.source, nif.source.getSocklen()) < 0) { |
c37f5e15 | 182 | syslogFmt(boost::format("Unable to send notification response to external nameserver %s - %s") % nif.source.toStringWithPort() % stringerror()); |
8472da1b | 183 | } |
c37f5e15 | 184 | else |
5ab019ac | 185 | syslogFmt(boost::format("Sent notification response to external nameserver %s for domain '%s'") % nif.source.toStringWithPort() % nif.domain.toString()); |
0efda032 | 186 | } |
8472da1b | 187 | g_nifs.erase(mdp.d_header.id); |
0efda032 BH |
188 | |
189 | } | |
adc10f99 | 190 | catch(std::exception &e) |
0efda032 | 191 | { |
c37f5e15 | 192 | syslogFmt(boost::format("Error parsing packet from internal nameserver: %s") % e.what()); |
0efda032 BH |
193 | } |
194 | ||
8472da1b BH |
195 | void expireOldNotifications() |
196 | { | |
197 | time_t limit = time(0) - 10; | |
198 | for(nifs_t::iterator iter = g_nifs.begin(); iter != g_nifs.end(); ) { | |
199 | if(iter->second.resentTime < limit) { | |
5ab019ac | 200 | syslogFmt(boost::format("Notification for domain '%s' was sent to inner nameserver, but no response within 10 seconds") % iter->second.domain.toString()); |
8472da1b BH |
201 | g_nifs.erase(iter++); |
202 | } | |
203 | else | |
204 | ++iter; | |
205 | } | |
206 | } | |
33ecb315 | 207 | |
4c89ccef | 208 | void daemonize(int null_fd); |
33ecb315 | 209 | |
f5df3c78 PL |
210 | void usage(po::options_description &desc) { |
211 | cerr<<"nproxy"<<endl; | |
212 | cerr<<desc<<endl; | |
213 | } | |
214 | ||
0efda032 BH |
215 | int main(int argc, char** argv) |
216 | try | |
217 | { | |
df62aa1d | 218 | reportAllTypes(); |
c37f5e15 BH |
219 | openlog("nproxy", LOG_NDELAY | LOG_PID, LOG_DAEMON); |
220 | ||
0efda032 BH |
221 | po::options_description desc("Allowed options"); |
222 | desc.add_options() | |
223 | ("help,h", "produce help message") | |
f5df3c78 | 224 | ("version", "print the version") |
8472da1b | 225 | ("powerdns-address", po::value<string>(), "IP address of PowerDNS server") |
c37f5e15 BH |
226 | ("chroot", po::value<string>(), "chroot to this directory for additional security") |
227 | ("setuid", po::value<int>(), "setuid to this numerical user id") | |
228 | ("setgid", po::value<int>(), "setgid to this numerical user id") | |
8472da1b BH |
229 | ("origin-address", po::value<string>()->default_value("::"), "Source address for notifications to PowerDNS") |
230 | ("listen-address", po::value<vector<string> >(), "IP addresses to listen on") | |
b4e82077 | 231 | ("listen-port", po::value<int>()->default_value(53), "Source port to listen on") |
8472da1b BH |
232 | ("daemon,d", po::value<bool>()->default_value(true), "operate in the background") |
233 | ("verbose,v", "be verbose"); | |
0efda032 BH |
234 | |
235 | po::store(po::command_line_parser(argc, argv).options(desc).run(), g_vm); | |
236 | po::notify(g_vm); | |
237 | ||
238 | if (g_vm.count("help")) { | |
f5df3c78 PL |
239 | usage(desc); |
240 | return EXIT_SUCCESS; | |
241 | } | |
242 | ||
243 | if (g_vm.count("version")) { | |
244 | cerr << "nproxy " << VERSION << endl; | |
0efda032 BH |
245 | return EXIT_SUCCESS; |
246 | } | |
247 | ||
8472da1b | 248 | if(!g_vm.count("powerdns-address")) { |
f5df3c78 PL |
249 | cerr<<"Mandatory setting 'powerdns-address' unset:\n"<<endl; |
250 | usage(desc); | |
0efda032 BH |
251 | return EXIT_FAILURE; |
252 | } | |
8472da1b BH |
253 | |
254 | if(!g_vm.count("verbose")) { | |
255 | g_verbose=true; | |
256 | } | |
0efda032 BH |
257 | |
258 | vector<string> addresses; | |
8472da1b BH |
259 | if(g_vm.count("listen-address")) |
260 | addresses=g_vm["listen-address"].as<vector<string> >(); | |
0efda032 BH |
261 | else |
262 | addresses.push_back("::"); | |
263 | ||
264 | // create sockets to listen on | |
265 | ||
c37f5e15 | 266 | syslogFmt(boost::format("Starting up")); |
0efda032 | 267 | for(vector<string>::const_iterator address = addresses.begin(); address != addresses.end(); ++address) { |
b4e82077 | 268 | ComboAddress local(*address, g_vm["listen-port"].as<int>()); |
0efda032 BH |
269 | int sock = socket(local.sin4.sin_family, SOCK_DGRAM, 0); |
270 | if(sock < 0) | |
271 | throw runtime_error("Creating socket for incoming packets: "+stringerror()); | |
272 | ||
273 | if(::bind(sock,(sockaddr*) &local, local.getSocklen()) < 0) | |
8472da1b | 274 | throw runtime_error("Binding socket for incoming packets to '"+ local.toStringWithPort()+"': "+stringerror()); |
0efda032 | 275 | |
33ecb315 | 276 | g_fdm.addReadFD(sock, handleOutsideUDPPacket); // add to fdmultiplexer for each socket |
c37f5e15 | 277 | syslogFmt(boost::format("Listening for external notifications on address %s") % local.toStringWithPort()); |
0efda032 BH |
278 | } |
279 | ||
33ecb315 | 280 | // create socket that talks to inner PowerDNS |
b4e82077 BH |
281 | ComboAddress originAddress(g_vm["origin-address"].as<string>(), 0); |
282 | g_pdnssocket=socket(originAddress.sin4.sin_family, SOCK_DGRAM, 0); | |
0efda032 BH |
283 | if(g_pdnssocket < 0) |
284 | throw runtime_error("Creating socket for packets to PowerDNS: "+stringerror()); | |
285 | ||
b4e82077 | 286 | |
8472da1b BH |
287 | if(::bind(g_pdnssocket,(sockaddr*) &originAddress, originAddress.getSocklen()) < 0) |
288 | throw runtime_error("Binding local address of inward socket to '"+ originAddress.toStringWithPort()+"': "+stringerror()); | |
289 | ||
290 | ||
291 | ComboAddress pdns(g_vm["powerdns-address"].as<string>(), 53); | |
0efda032 | 292 | if(connect(g_pdnssocket, (struct sockaddr*) &pdns, pdns.getSocklen()) < 0) |
c37f5e15 BH |
293 | throw runtime_error("Failed to connect PowerDNS socket to address "+pdns.toStringWithPort()+": "+stringerror()); |
294 | ||
f7fb7022 | 295 | syslogFmt(boost::format("Sending notifications from %s to internal address %s") % originAddress.toString() % pdns.toStringWithPort()); |
0efda032 | 296 | |
33ecb315 BH |
297 | g_fdm.addReadFD(g_pdnssocket, handleInsideUDPPacket); |
298 | ||
4c89ccef CH |
299 | int null_fd=open("/dev/null",O_RDWR); /* open stdin */ |
300 | if(null_fd < 0) | |
301 | throw runtime_error("Unable to open /dev/null: "+stringerror()); | |
302 | ||
0efda032 | 303 | if(g_vm.count("chroot")) { |
4c89ccef | 304 | if(chroot(g_vm["chroot"].as<string>().c_str()) < 0 || chdir("/") < 0) |
0efda032 | 305 | throw runtime_error("while chrooting to "+g_vm["chroot"].as<string>()); |
c37f5e15 BH |
306 | syslogFmt(boost::format("Changed root to directory '%s'") % g_vm["chroot"].as<string>()); |
307 | } | |
308 | ||
fe97f596 PD |
309 | if(g_vm.count("setgid")) { |
310 | if(setgid(g_vm["setgid"].as<int>()) < 0) | |
335da0ba | 311 | throw runtime_error("while changing gid to "+std::to_string(g_vm["setgid"].as<int>())); |
fe97f596 PD |
312 | syslogFmt(boost::format("Changed gid to %d") % g_vm["setgid"].as<int>()); |
313 | if(setgroups(0, NULL) < 0) | |
314 | throw runtime_error("while dropping supplementary groups"); | |
315 | } | |
316 | ||
c37f5e15 BH |
317 | if(g_vm.count("setuid")) { |
318 | if(setuid(g_vm["setuid"].as<int>()) < 0) | |
335da0ba | 319 | throw runtime_error("while changing uid to "+std::to_string(g_vm["setuid"].as<int>())); |
c37f5e15 BH |
320 | syslogFmt(boost::format("Changed uid to %d") % g_vm["setuid"].as<int>()); |
321 | } | |
322 | ||
8472da1b | 323 | if(g_vm["daemon"].as<bool>()) { |
c37f5e15 | 324 | syslogFmt(boost::format("Daemonizing")); |
4c89ccef | 325 | daemonize(null_fd); |
8472da1b | 326 | } |
4c89ccef | 327 | close(null_fd); |
c37f5e15 | 328 | syslogFmt(boost::format("Program operational")); |
8472da1b BH |
329 | |
330 | ||
0efda032 BH |
331 | // start loop |
332 | struct timeval now; | |
333 | for(;;) { | |
334 | gettimeofday(&now, 0); | |
335 | g_fdm.run(&now); | |
336 | // check for notifications that have been outstanding for more than 10 seconds | |
8472da1b | 337 | expireOldNotifications(); |
0efda032 | 338 | } |
0efda032 | 339 | } |
c37f5e15 BH |
340 | catch(boost::program_options::error& e) |
341 | { | |
342 | syslogFmt(boost::format("Error parsing command line options: %s") % e.what()); | |
343 | } | |
adc10f99 | 344 | catch(std::exception& e) |
0efda032 | 345 | { |
c37f5e15 | 346 | syslogFmt(boost::format("Fatal: %s") % e.what()); |
0efda032 | 347 | } |
3f81d239 | 348 | catch(PDNSException& e) |
8472da1b | 349 | { |
c37f5e15 | 350 | syslogFmt(boost::format("Fatal: %s") % e.reason); |
8472da1b | 351 | } |
0efda032 | 352 | |
4c89ccef | 353 | void daemonize(int null_fd) |
8472da1b BH |
354 | { |
355 | if(fork()) | |
356 | exit(0); // bye bye | |
4c89ccef CH |
357 | |
358 | setsid(); | |
359 | ||
360 | dup2(null_fd,0); /* stdin */ | |
361 | dup2(null_fd,1); /* stderr */ | |
362 | dup2(null_fd,2); /* stderr */ | |
8472da1b | 363 | } |