pdns/dnsdist-console.cc

   1 /*
   2  * This file is part of PowerDNS or dnsdist.
   3  * Copyright -- PowerDNS.COM B.V. and its contributors
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of version 2 of the GNU General Public License as
   7  * published by the Free Software Foundation.
   8  *
   9  * In addition, for the avoidance of any doubt, permission is granted to
  10  * link this program with OpenSSL and to (re)distribute the binaries
  11  * produced as the result of such linking.
  12  *
  13  * This program is distributed in the hope that it will be useful,
  14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16  * GNU General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU General Public License
  19  * along with this program; if not, write to the Free Software
  20  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  21  */
  22
  23 #include <fstream>
  24 #include <pwd.h>
  25 #include <thread>
  26
  27 #if defined (__OpenBSD__) || defined(__NetBSD__)
  28 #include <readline/readline.h>
  29 #include <readline/history.h>
  30 #else
  31 #include <editline/readline.h>
  32 #endif
  33
  34 #include "ext/json11/json11.hpp"
  35
  36 #include "dolog.hh"
  37 #include "dnsdist.hh"
  38 #include "dnsdist-console.hh"
  39 #include "sodcrypto.hh"
  40 #include "threadname.hh"
  41
  42 GlobalStateHolder<NetmaskGroup> g_consoleACL;
  43 vector<pair<struct timeval, string> > g_confDelta;
  44 std::string g_consoleKey;
  45 bool g_logConsoleConnections{true};
  46 bool g_consoleEnabled{false};
  47 uint32_t g_consoleOutputMsgMaxSize{10000000};
  48
  49 // MUST BE CALLED UNDER A LOCK - right now the LuaLock
  50 static void feedConfigDelta(const std::string& line)
  51 {
  52   if(line.empty())
  53     return;
  54   struct timeval now;
  55   gettimeofday(&now, 0);
  56   g_confDelta.push_back({now,line});
  57 }
  58
  59 static string historyFile(const bool &ignoreHOME = false)
  60 {
  61   string ret;
  62
  63   struct passwd pwd;
  64   struct passwd *result;
  65   char buf[16384];
  66   getpwuid_r(geteuid(), &pwd, buf, sizeof(buf), &result);
  67
  68   const char *homedir = getenv("HOME");
  69   if (result)
  70     ret = string(pwd.pw_dir);
  71   if (homedir && !ignoreHOME) // $HOME overrides what the OS tells us
  72     ret = string(homedir);
  73   if (ret.empty())
  74     ret = "."; // CWD if nothing works..
  75   ret.append("/.dnsdist_history");
  76   return ret;
  77 }
  78
  79 static bool sendMessageToServer(int fd, const std::string& line, SodiumNonce& readingNonce, SodiumNonce& writingNonce, const bool outputEmptyLine)
  80 {
  81   string msg = sodEncryptSym(line, g_consoleKey, writingNonce);
  82   const auto msgLen = msg.length();
  83   if (msgLen > std::numeric_limits<uint32_t>::max()) {
  84     cout << "Encrypted message is too long to be sent to the server, "<< std::to_string(msgLen) << " > " << std::numeric_limits<uint32_t>::max() << endl;
  85     return true;
  86   }
  87
  88   putMsgLen32(fd, static_cast<uint32_t>(msgLen));
  89
  90   if (!msg.empty()) {
  91     writen2(fd, msg);
  92   }
  93
  94   uint32_t len;
  95   if(!getMsgLen32(fd, &len)) {
  96     cout << "Connection closed by the server." << endl;
  97     return false;
  98   }
  99
 100   if (len == 0) {
 101     if (outputEmptyLine) {
 102       cout << endl;
 103     }
 104
 105     return true;
 106   }
 107
 108   boost::scoped_array<char> resp(new char[len]);
 109   readn2(fd, resp.get(), len);
 110   msg.assign(resp.get(), len);
 111   msg = sodDecryptSym(msg, g_consoleKey, readingNonce);
 112   cout << msg;
 113   cout.flush();
 114
 115   return true;
 116 }
 117
 118 void doClient(ComboAddress server, const std::string& command)
 119 {
 120   if (!sodIsValidKey(g_consoleKey)) {
 121     cerr << "The currently configured console key is not valid, please configure a valid key using the setKey() directive" << endl;
 122     return;
 123   }
 124
 125   if(g_verbose) {
 126     cout<<"Connecting to "<<server.toStringWithPort()<<endl;
 127   }
 128
 129   int fd=socket(server.sin4.sin_family, SOCK_STREAM, 0);
 130   if (fd < 0) {
 131     cerr<<"Unable to connect to "<<server.toStringWithPort()<<endl;
 132     return;
 133   }
 134   SConnect(fd, server);
 135   setTCPNoDelay(fd);
 136   SodiumNonce theirs, ours, readingNonce, writingNonce;
 137   ours.init();
 138
 139   writen2(fd, (const char*)ours.value, sizeof(ours.value));
 140   readn2(fd, (char*)theirs.value, sizeof(theirs.value));
 141   readingNonce.merge(ours, theirs);
 142   writingNonce.merge(theirs, ours);
 143
 144   /* try sending an empty message, the server should send an empty
 145      one back. If it closes the connection instead, we are probably
 146      having a key mismatch issue. */
 147   if (!sendMessageToServer(fd, "", readingNonce, writingNonce, false)) {
 148     cerr<<"The server closed the connection right away, likely indicating a key mismatch. Please check your setKey() directive."<<endl;
 149     close(fd);
 150     return;
 151   }
 152
 153   if (!command.empty()) {
 154     sendMessageToServer(fd, command, readingNonce, writingNonce, false);
 155
 156     close(fd);
 157     return;
 158   }
 159
 160   string histfile = historyFile();
 161   set<string> dupper;
 162   {
 163     ifstream history(histfile);
 164     string line;
 165     while(getline(history, line))
 166       add_history(line.c_str());
 167   }
 168   ofstream history(histfile, std::ios_base::app);
 169   string lastline;
 170   for(;;) {
 171     char* sline = readline("> ");
 172     rl_bind_key('\t',rl_complete);
 173     if(!sline)
 174       break;
 175
 176     string line(sline);
 177     if(!line.empty() && line != lastline) {
 178       add_history(sline);
 179       history << sline <<endl;
 180       history.flush();
 181     }
 182     lastline=line;
 183     free(sline);
 184
 185     if(line=="quit")
 186       break;
 187     if(line=="help" || line=="?")
 188       line="help()";
 189
 190     /* no need to send an empty line to the server */
 191     if(line.empty())
 192       continue;
 193
 194     if (!sendMessageToServer(fd, line, readingNonce, writingNonce, true)) {
 195       break;
 196     }
 197   }
 198   close(fd);
 199 }
 200
 201 void doConsole()
 202 {
 203   string histfile = historyFile(true);
 204   set<string> dupper;
 205   {
 206     ifstream history(histfile);
 207     string line;
 208     while(getline(history, line))
 209       add_history(line.c_str());
 210   }
 211   ofstream history(histfile, std::ios_base::app);
 212   string lastline;
 213   for(;;) {
 214     char* sline = readline("> ");
 215     rl_bind_key('\t',rl_complete);
 216     if(!sline)
 217       break;
 218
 219     string line(sline);
 220     if(!line.empty() && line != lastline) {
 221       add_history(sline);
 222       history << sline <<endl;
 223       history.flush();
 224     }
 225     lastline=line;
 226     free(sline);
 227
 228     if(line=="quit")
 229       break;
 230     if(line=="help" || line=="?")
 231       line="help()";
 232
 233     string response;
 234     try {
 235       bool withReturn=true;
 236     retry:;
 237       try {
 238         std::lock_guard<std::mutex> lock(g_luamutex);
 239         g_outputBuffer.clear();
 240         resetLuaSideEffect();
 241         auto ret=g_lua.executeCode<
 242           boost::optional<
 243             boost::variant<
 244               string,
 245               shared_ptr<DownstreamState>,
 246               ClientState*,
 247               std::unordered_map<string, double>
 248               >
 249             >
 250           >(withReturn ? ("return "+line) : line);
 251         if(ret) {
 252           if (const auto dsValue = boost::get<shared_ptr<DownstreamState>>(&*ret)) {
 253             if (*dsValue) {
 254               cout<<(*dsValue)->getName()<<endl;
 255             }
 256           }
 257           else if (const auto csValue = boost::get<ClientState*>(&*ret)) {
 258             if (*csValue) {
 259               cout<<(*csValue)->local.toStringWithPort()<<endl;
 260             }
 261           }
 262           else if (const auto strValue = boost::get<string>(&*ret)) {
 263             cout<<*strValue<<endl;
 264           }
 265           else if(const auto um = boost::get<std::unordered_map<string, double> >(&*ret)) {
 266             using namespace json11;
 267             Json::object o;
 268             for(const auto& v : *um)
 269               o[v.first]=v.second;
 270             Json out = o;
 271             cout<<out.dump()<<endl;
 272           }
 273         }
 274         else
 275           cout << g_outputBuffer;
 276         if(!getLuaNoSideEffect())
 277           feedConfigDelta(line);
 278       }
 279       catch(const LuaContext::SyntaxErrorException&) {
 280         if(withReturn) {
 281           withReturn=false;
 282           goto retry;
 283         }
 284         throw;
 285       }
 286     }
 287     catch(const LuaContext::WrongTypeException& e) {
 288       std::cerr<<"Command returned an object we can't print: "<<std::string(e.what())<<std::endl;
 289       // tried to return something we don't understand
 290     }
 291     catch(const LuaContext::ExecutionErrorException& e) {
 292       if(!strcmp(e.what(),"invalid key to 'next'"))
 293         std::cerr<<"Error parsing parameters, did you forget parameter name?";
 294       else
 295         std::cerr << e.what();
 296       try {
 297         std::rethrow_if_nested(e);
 298
 299         std::cerr << std::endl;
 300       } catch(const std::exception& ne) {
 301         // ne is the exception that was thrown from inside the lambda
 302         std::cerr << ": " << ne.what() << std::endl;
 303       }
 304       catch(const PDNSException& ne) {
 305         // ne is the exception that was thrown from inside the lambda
 306         std::cerr << ": " << ne.reason << std::endl;
 307       }
 308     }
 309     catch(const std::exception& e) {
 310       std::cerr << e.what() << std::endl;
 311     }
 312   }
 313 }
 314 /**** CARGO CULT CODE AHEAD ****/
 315 const std::vector<ConsoleKeyword> g_consoleKeywords{
 316   /* keyword, function, parameters, description */
 317   { "addACL", true, "netmask", "add to the ACL set who can use this server" },
 318   { "addAction", true, "DNS rule, DNS action [, {uuid=\"UUID\"}]", "add a rule" },
 319   { "addConsoleACL", true, "netmask", "add a netmask to the console ACL" },
 320   { "addDNSCryptBind", true, "\"127.0.0.1:8443\", \"provider name\", \"/path/to/resolver.cert\", \"/path/to/resolver.key\", {reusePort=false, tcpFastOpenSize=0, interface=\"\", cpus={}}", "listen to incoming DNSCrypt queries on 127.0.0.1 port 8443, with a provider name of `provider name`, using a resolver certificate and associated key stored respectively in the `resolver.cert` and `resolver.key` files. The fifth optional parameter is a table of parameters" },
 321   { "addDynBlocks", true, "addresses, message[, seconds[, action]]", "block the set of addresses with message `msg`, for `seconds` seconds (10 by default), applying `action` (default to the one set with `setDynBlocksAction()`)" },
 322   { "addLocal", true, "addr [, {doTCP=true, reusePort=false, tcpFastOpenSize=0, interface=\"\", cpus={}}]", "add `addr` to the list of addresses we listen on" },
 323   { "addLuaAction", true, "x, func [, {uuid=\"UUID\"}]", "where 'x' is all the combinations from `addAction`, and func is a function with the parameter `dq`, which returns an action to be taken on this packet. Good for rare packets but where you want to do a lot of processing" },
 324   { "addLuaResponseAction", true, "x, func [, {uuid=\"UUID\"}]", "where 'x' is all the combinations from `addAction`, and func is a function with the parameter `dr`, which returns an action to be taken on this response packet. Good for rare packets but where you want to do a lot of processing" },
 325   { "addCacheHitResponseAction", true, "DNS rule, DNS response action [, {uuid=\"UUID\"}]", "add a cache hit response rule" },
 326   { "addResponseAction", true, "DNS rule, DNS response action [, {uuid=\"UUID\"}]", "add a response rule" },
 327   { "addSelfAnsweredResponseAction", true, "DNS rule, DNS response action [, {uuid=\"UUID\"}]", "add a self-answered response rule" },
 328   { "addTLSLocal", true, "addr, certFile(s), keyFile(s) [,params]", "listen to incoming DNS over TLS queries on the specified address using the specified certificate (or list of) and key (or list of). The last parameter is a table" },
 329   { "AllowAction", true, "", "let these packets go through" },
 330   { "AllowResponseAction", true, "", "let these packets go through" },
 331   { "AllRule", true, "", "matches all traffic" },
 332   { "AndRule", true, "list of DNS rules", "matches if all sub-rules matches" },
 333   { "benchRule", true, "DNS Rule [, iterations [, suffix]]", "bench the specified DNS rule" },
 334   { "carbonServer", true, "serverIP, [ourname], [interval]", "report statistics to serverIP using our hostname, or 'ourname' if provided, every 'interval' seconds" },
 335   { "controlSocket", true, "addr", "open a control socket on this address / connect to this address in client mode" },
 336   { "clearDynBlocks", true, "", "clear all dynamic blocks" },
 337   { "clearQueryCounters", true, "", "clears the query counter buffer" },
 338   { "clearRules", true, "", "remove all current rules" },
 339   { "DelayAction", true, "milliseconds", "delay the response by the specified amount of milliseconds (UDP-only)" },
 340   { "DelayResponseAction", true, "milliseconds", "delay the response by the specified amount of milliseconds (UDP-only)" },
 341   { "delta", true, "", "shows all commands entered that changed the configuration" },
 342   { "DisableValidationAction", true, "", "set the CD bit in the question, let it go through" },
 343   { "DnstapLogAction", true, "identity, FrameStreamLogger [, alterFunction]", "send the contents of this query to a FrameStreamLogger or RemoteLogger as dnstap. `alterFunction` is a callback, receiving a DNSQuestion and a DnstapMessage, that can be used to modify the dnstap message" },
 344   { "DnstapLogResponseAction", true, "identity, FrameStreamLogger [, alterFunction]", "send the contents of this response to a remote or FrameStreamLogger or RemoteLogger as dnstap. `alterFunction` is a callback, receiving a DNSResponse and a DnstapMessage, that can be used to modify the dnstap message" },
 345   { "DropAction", true, "", "drop these packets" },
 346   { "DropResponseAction", true, "", "drop these packets" },
 347   { "DSTPortRule", true, "port", "matches questions received to the destination port specified" },
 348   { "dumpStats", true, "", "print all statistics we gather" },
 349   { "dynBlockRulesGroup", true, "", "return a new DynBlockRulesGroup object" },
 350   { "EDNSOptionRule", true, "optcode", "matches queries with the specified EDNS0 option present" },
 351   { "ERCodeRule", true, "rcode", "matches responses with the specified extended rcode (EDNS0)" },
 352   { "exceedNXDOMAINs", true, "rate, seconds", "get set of addresses that exceed `rate` NXDOMAIN/s over `seconds` seconds" },
 353   { "exceedQRate", true, "rate, seconds", "get set of address that exceed `rate` queries/s over `seconds` seconds" },
 354   { "exceedQTypeRate", true, "type, rate, seconds", "get set of address that exceed `rate` queries/s for queries of type `type` over `seconds` seconds" },
 355   { "exceedRespByterate", true, "rate, seconds", "get set of addresses that exceeded `rate` bytes/s answers over `seconds` seconds" },
 356   { "exceedServFails", true, "rate, seconds", "get set of addresses that exceed `rate` servfails/s over `seconds` seconds" },
 357   { "firstAvailable", false, "", "picks the server with the lowest `order` that has not exceeded its QPS limit" },
 358   { "fixupCase", true, "bool", "if set (default to no), rewrite the first qname of the question part of the answer to match the one from the query. It is only useful when you have a downstream server that messes up the case of the question qname in the answer" },
 359   { "generateDNSCryptCertificate", true, "\"/path/to/providerPrivate.key\", \"/path/to/resolver.cert\", \"/path/to/resolver.key\", serial, validFrom, validUntil", "generate a new resolver private key and related certificate, valid from the `validFrom` timestamp until the `validUntil` one, signed with the provider private key" },
 360   { "generateDNSCryptProviderKeys", true, "\"/path/to/providerPublic.key\", \"/path/to/providerPrivate.key\"", "generate a new provider keypair" },
 361   { "getBind", true, "n", "returns the listener at index n" },
 362   { "getDNSCryptBind", true, "n", "return the `DNSCryptContext` object corresponding to the bind `n`" },
 363   { "getPool", true, "name", "return the pool named `name`, or \"\" for the default pool" },
 364   { "getPoolServers", true, "pool", "return servers part of this pool" },
 365   { "getQueryCounters", true, "[max=10]", "show current buffer of query counters, limited by 'max' if provided" },
 366   { "getResponseRing", true, "", "return the current content of the response ring" },
 367   { "getServer", true, "n", "returns server with index n" },
 368   { "getServers", true, "", "returns a table with all defined servers" },
 369   { "getTLSContext", true, "n", "returns the TLS context with index n" },
 370   { "getTLSFrontend", true, "n", "returns the TLS frontend with index n" },
 371   { "inClientStartup", true, "", "returns true during console client parsing of configuration" },
 372   { "grepq", true, "Netmask|DNS Name|100ms|{\"::1\", \"powerdns.com\", \"100ms\"} [, n]", "shows the last n queries and responses matching the specified client address or range (Netmask), or the specified DNS Name, or slower than 100ms" },
 373   { "leastOutstanding", false, "", "Send traffic to downstream server with least outstanding queries, with the lowest 'order', and within that the lowest recent latency"},
 374   { "LogAction", true, "[filename], [binary], [append], [buffered]", "Log a line for each query, to the specified file if any, to the console (require verbose) otherwise. When logging to a file, the `binary` optional parameter specifies whether we log in binary form (default) or in textual form, the `append` optional parameter specifies whether we open the file for appending or truncate each time (default), and the `buffered` optional parameter specifies whether writes to the file are buffered (default) or not." },
 375   { "makeKey", true, "", "generate a new server access key, emit configuration line ready for pasting" },
 376   { "MaxQPSIPRule", true, "qps, [v4Mask=32 [, v6Mask=64 [, burst=qps [, expiration=300 [, cleanupDelay=60]]]]]", "matches traffic exceeding the qps limit per subnet" },
 377   { "MaxQPSRule", true, "qps", "matches traffic **not** exceeding this qps limit" },
 378   { "mvCacheHitResponseRule", true, "from, to", "move cache hit response rule 'from' to a position where it is in front of 'to'. 'to' can be one larger than the largest rule" },
 379   { "mvResponseRule", true, "from, to", "move response rule 'from' to a position where it is in front of 'to'. 'to' can be one larger than the largest rule" },
 380   { "mvRule", true, "from, to", "move rule 'from' to a position where it is in front of 'to'. 'to' can be one larger than the largest rule, in which case the rule will be moved to the last position" },
 381   { "mvSelfAnsweredResponseRule", true, "from, to", "move self-answered response rule 'from' to a position where it is in front of 'to'. 'to' can be one larger than the largest rule" },
 382   { "newDNSName", true, "name", "make a DNSName based on this .-terminated name" },
 383   { "newFrameStreamTcpLogger", true, "addr", "create a FrameStream logger object writing to a TCP address (addr should be ip:port), to use with `DnstapLogAction()` and `DnstapLogResponseAction()`" },
 384   { "newFrameStreamUnixLogger", true, "socket", "create a FrameStream logger object writing to a local unix socket, to use with `DnstapLogAction()` and `DnstapLogResponseAction()`" },
 385   { "newPacketCache", true, "maxEntries[, maxTTL=86400, minTTL=0, temporaryFailureTTL=60, staleTTL=60, dontAge=false, numberOfShards=1, deferrableInsertLock=true]", "return a new Packet Cache" },
 386   { "newQPSLimiter", true, "rate, burst", "configure a QPS limiter with that rate and that burst capacity" },
 387   { "newRemoteLogger", true, "address:port [, timeout=2, maxQueuedEntries=100, reconnectWaitTime=1]", "create a Remote Logger object, to use with `RemoteLogAction()` and `RemoteLogResponseAction()`" },
 388   { "newRuleAction", true, "DNS rule, DNS action [, {uuid=\"UUID\"}]", "return a pair of DNS Rule and DNS Action, to be used with `setRules()`" },
 389   { "newServer", true, "{address=\"ip:port\", qps=1000, order=1, weight=10, pool=\"abuse\", retries=5, tcpConnectTimeout=5, tcpSendTimeout=30, tcpRecvTimeout=30, checkName=\"a.root-servers.net.\", checkType=\"A\", maxCheckFailures=1, mustResolve=false, useClientSubnet=true, source=\"address|interface name|address@interface\", sockets=1}", "instantiate a server" },
 390   { "newServerPolicy", true, "name, function", "create a policy object from a Lua function" },
 391   { "newSuffixMatchNode", true, "", "returns a new SuffixMatchNode" },
 392   { "NoRecurseAction", true, "", "strip RD bit from the question, let it go through" },
 393   { "PoolAction", true, "poolname", "set the packet into the specified pool" },
 394   { "printDNSCryptProviderFingerprint", true, "\"/path/to/providerPublic.key\"", "display the fingerprint of the provided resolver public key" },
 395   { "QNameLabelsCountRule", true, "min, max", "matches if the qname has less than `min` or more than `max` labels" },
 396   { "QNameRule", true, "qname", "matches queries with the specified qname" },
 397   { "QNameWireLengthRule", true, "min, max", "matches if the qname's length on the wire is less than `min` or more than `max` bytes" },
 398   { "QTypeRule", true, "qtype", "matches queries with the specified qtype" },
 399   { "RCodeRule", true, "rcode", "matches responses with the specified rcode" },
 400   { "RegexRule", true, "regex", "matches the query name against the supplied regex" },
 401   { "registerDynBPFFilter", true, "DynBPFFilter", "register this dynamic BPF filter into the web interface so that its counters are displayed" },
 402   { "RemoteLogAction", true, "RemoteLogger [, alterFunction [, serverID]]", "send the content of this query to a remote logger via Protocol Buffer. `alterFunction` is a callback, receiving a DNSQuestion and a DNSDistProtoBufMessage, that can be used to modify the Protocol Buffer content, for example for anonymization purposes. `serverID` is the server identifier." },
 403   { "RemoteLogResponseAction", true, "RemoteLogger [,alterFunction [,includeCNAME [, serverID]]]", "send the content of this response to a remote logger via Protocol Buffer. `alterFunction` is the same callback than the one in `RemoteLogAction` and `includeCNAME` indicates whether CNAME records inside the response should be parsed and exported. The default is to only exports A and AAAA records. `serverID` is the server identifier." },
 404   { "rmCacheHitResponseRule", true, "id", "remove cache hit response rule in position 'id', or whose uuid matches if 'id' is an UUID string" },
 405   { "rmResponseRule", true, "id", "remove response rule in position 'id', or whose uuid matches if 'id' is an UUID string" },
 406   { "rmRule", true, "id", "remove rule in position 'id', or whose uuid matches if 'id' is an UUID string" },
 407   { "rmSelfAnsweredResponseRule", true, "id", "remove self-answered response rule in position 'id', or whose uuid matches if 'id' is an UUID string" },
 408   { "rmServer", true, "n", "remove server with index n" },
 409   { "roundrobin", false, "", "Simple round robin over available servers" },
 410   { "sendCustomTrap", true, "str", "send a custom `SNMP` trap from Lua, containing the `str` string"},
 411   { "setACL", true, "{netmask, netmask}", "replace the ACL set with these netmasks. Use `setACL({})` to reset the list, meaning no one can use us" },
 412   { "setAddEDNSToSelfGeneratedResponses", true, "add", "set whether to add EDNS to self-generated responses, provided that the initial query had EDNS" },
 413   { "setAPIWritable", true, "bool, dir", "allow modifications via the API. if `dir` is set, it must be a valid directory where the configuration files will be written by the API" },
 414   { "setConsoleACL", true, "{netmask, netmask}", "replace the console ACL set with these netmasks" },
 415   { "setConsoleConnectionsLogging", true, "enabled", "whether to log the opening and closing of console connections" },
 416   { "setConsoleOutputMaxMsgSize", true, "messageSize", "set console message maximum size in bytes, default is 10 MB" },
 417   { "setDNSSECPool", true, "pool name", "move queries requesting DNSSEC processing to this pool" },
 418   { "setDynBlocksAction", true, "action", "set which action is performed when a query is blocked. Only DNSAction.Drop (the default) and DNSAction.Refused are supported" },
 419   { "setECSOverride", true, "bool", "whether to override an existing EDNS Client Subnet value in the query" },
 420   { "setECSSourcePrefixV4", true, "prefix-length", "the EDNS Client Subnet prefix-length used for IPv4 queries" },
 421   { "setECSSourcePrefixV6", true, "prefix-length", "the EDNS Client Subnet prefix-length used for IPv6 queries" },
 422   { "setKey", true, "key", "set access key to that key" },
 423   { "setLocal", true, "addr [, {doTCP=true, reusePort=false, tcpFastOpenSize=0, interface=\"\", cpus={}}]", "reset the list of addresses we listen on to this address" },
 424   { "setMaxTCPClientThreads", true, "n", "set the maximum of TCP client threads, handling TCP connections" },
 425   { "setMaxTCPConnectionDuration", true, "n", "set the maximum duration of an incoming TCP connection, in seconds. 0 means unlimited" },
 426   { "setMaxTCPConnectionsPerClient", true, "n", "set the maximum number of TCP connections per client. 0 means unlimited" },
 427   { "setMaxTCPQueriesPerConnection", true, "n", "set the maximum number of queries in an incoming TCP connection. 0 means unlimited" },
 428   { "setMaxTCPQueuedConnections", true, "n", "set the maximum number of TCP connections queued (waiting to be picked up by a client thread)" },
 429   { "setMaxUDPOutstanding", true, "n", "set the maximum number of outstanding UDP queries to a given backend server. This can only be set at configuration time and defaults to 10240" },
 430   { "setPayloadSizeOnSelfGeneratedAnswers", true, "payloadSize", "set the UDP payload size advertised via EDNS on self-generated responses" },
 431   { "setPoolServerPolicy", true, "policy, pool", "set the server selection policy for this pool to that policy" },
 432   { "setPoolServerPolicy", true, "name, func, pool", "set the server selection policy for this pool to one named 'name' and provided by 'function'" },
 433   { "setPreserveTrailingData", true, "bool", "set whether trailing data should be preserved while adding ECS or XPF records to incoming queries" },
 434   { "setQueryCount", true, "bool", "set whether queries should be counted" },
 435   { "setQueryCountFilter", true, "func", "filter queries that would be counted, where `func` is a function with parameter `dq` which decides whether a query should and how it should be counted" },
 436   { "setRingBuffersLockRetries", true, "n", "set the number of attempts to get a non-blocking lock to a ringbuffer shard before blocking" },
 437   { "setRingBuffersSize", true, "n [, numberOfShards]", "set the capacity of the ringbuffers used for live traffic inspection to `n`, and optionally the number of shards to use to `numberOfShards`" },
 438   { "setRules", true, "list of rules", "replace the current rules with the supplied list of pairs of DNS Rules and DNS Actions (see `newRuleAction()`)" },
 439   { "setSecurityPollInterval", true, "n", "set the security polling interval to `n` seconds" },
 440   { "setSecurityPollSuffix", true, "suffix", "set the security polling suffix to the specified value" },
 441   { "setServerPolicy", true, "policy", "set server selection policy to that policy" },
 442   { "setServerPolicyLua", true, "name, function", "set server selection policy to one named 'name' and provided by 'function'" },
 443   { "setServFailWhenNoServer", true, "bool", "if set, return a ServFail when no servers are available, instead of the default behaviour of dropping the query" },
 444   { "setStaleCacheEntriesTTL", true, "n", "allows using cache entries expired for at most n seconds when there is no backend available to answer for a query" },
 445   { "setTCPDownstreamCleanupInterval", true, "interval", "minimum interval in seconds between two cleanups of the idle TCP downstream connections" },
 446   { "setTCPUseSinglePipe", true, "bool", "whether the incoming TCP connections should be put into a single queue instead of using per-thread queues. Defaults to false" },
 447   { "setTCPRecvTimeout", true, "n", "set the read timeout on TCP connections from the client, in seconds" },
 448   { "setTCPSendTimeout", true, "n", "set the write timeout on TCP connections from the client, in seconds" },
 449   { "setUDPMultipleMessagesVectorSize", true, "n", "set the size of the vector passed to recvmmsg() to receive UDP messages. Default to 1 which means that the feature is disabled and recvmsg() is used instead" },
 450   { "setUDPTimeout", true, "n", "set the maximum time dnsdist will wait for a response from a backend over UDP, in seconds" },
 451   { "setVerboseHealthChecks", true, "bool", "set whether health check errors will be logged" },
 452   { "setWebserverConfig", true, "[{password=string, apiKey=string, customHeaders}]", "Updates webserver configuration" },
 453   { "show", true, "string", "outputs `string`" },
 454   { "showACL", true, "", "show our ACL set" },
 455   { "showBinds", true, "", "show listening addresses (frontends)" },
 456   { "showCacheHitResponseRules", true, "[{showUUIDs=false, truncateRuleWidth=-1}]", "show all defined cache hit response rules, optionally with their UUIDs and optionally truncated to a given width" },
 457   { "showConsoleACL", true, "", "show our current console ACL set" },
 458   { "showDNSCryptBinds", true, "", "display the currently configured DNSCrypt binds" },
 459   { "showDynBlocks", true, "", "show dynamic blocks in force" },
 460   { "showPools", true, "", "show the available pools" },
 461   { "showPoolServerPolicy", true, "pool", "show server selection policy for this pool" },
 462   { "showResponseLatency", true, "", "show a plot of the response time latency distribution" },
 463   { "showResponseRules", true, "[{showUUIDs=false, truncateRuleWidth=-1}]", "show all defined response rules, optionally with their UUIDs and optionally truncated to a given width" },
 464   { "showRules", true, "[{showUUIDs=false, truncateRuleWidth=-1}]", "show all defined rules, optionally with their UUIDs and optionally truncated to a given width" },
 465   { "showSelfAnsweredResponseRules", true, "[{showUUIDs=false, truncateRuleWidth=-1}]", "show all defined self-answered response rules, optionally with their UUIDs and optionally truncated to a given width" },
 466   { "showServerPolicy", true, "", "show name of currently operational server selection policy" },
 467   { "showServers", true, "", "output all servers" },
 468   { "showTCPStats", true, "", "show some statistics regarding TCP" },
 469   { "showTLSContexts", true, "", "list all the available TLS contexts" },
 470   { "showVersion", true, "", "show the current version" },
 471   { "shutdown", true, "", "shut down `dnsdist`" },
 472   { "snmpAgent", true, "enableTraps [, masterSocket]", "enable `SNMP` support. `enableTraps` is a boolean indicating whether traps should be sent and `masterSocket` an optional string specifying how to connect to the master agent"},
 473   { "SNMPTrapAction", true, "[reason]", "send an SNMP trap, adding the optional `reason` string as the query description"},
 474   { "SNMPTrapResponseAction", true, "[reason]", "send an SNMP trap, adding the optional `reason` string as the response description"},
 475   { "SpoofAction", true, "{ip, ...} ", "forge a response with the specified IPv4 (for an A query) or IPv6 (for an AAAA). If you specify multiple addresses, all that match the query type (A, AAAA or ANY) will get spoofed in" },
 476   { "TagAction", true, "name, value", "set the tag named 'name' to the given value" },
 477   { "TagResponseAction", true, "name, value", "set the tag named 'name' to the given value" },
 478   { "TagRule", true, "name [, value]", "matches if the tag named 'name' is present, with the given 'value' matching if any" },
 479   { "TCAction", true, "", "create answer to query with TC and RD bits set, to move to TCP" },
 480   { "TeeAction", true, "remote [, addECS]", "send copy of query to remote, optionally adding ECS info" },
 481   { "TempFailureCacheTTLAction", true, "ttl", "set packetcache TTL for temporary failure replies" },
 482   { "testCrypto", true, "", "test of the crypto all works" },
 483   { "TimedIPSetRule", true, "", "Create a rule which matches a set of IP addresses which expire"},
 484   { "topBandwidth", true, "top", "show top-`top` clients that consume the most bandwidth over length of ringbuffer" },
 485   { "topCacheHitResponseRule", true, "", "move the last cache hit response rule to the first position" },
 486   { "topClients", true, "n", "show top-`n` clients sending the most queries over length of ringbuffer" },
 487   { "topQueries", true, "n[, labels]", "show top 'n' queries, as grouped when optionally cut down to 'labels' labels" },
 488   { "topResponses", true, "n, kind[, labels]", "show top 'n' responses with RCODE=kind (0=NO Error, 2=ServFail, 3=ServFail), as grouped when optionally cut down to 'labels' labels" },
 489   { "topCacheHitResponseRule", true, "", "move the last cache hit response rule to the first position" },
 490   { "topResponseRule", true, "", "move the last response rule to the first position" },
 491   { "topRule", true, "", "move the last rule to the first position" },
 492   { "topSelfAnsweredResponseRule", true, "", "move the last self-answered response rule to the first position" },
 493   { "topSlow", true, "[top][, limit][, labels]", "show `top` queries slower than `limit` milliseconds, grouped by last `labels` labels" },
 494   { "truncateTC", true, "bool", "if set (defaults to no starting with dnsdist 1.2.0) truncate TC=1 answers so they are actually empty. Fixes an issue for PowerDNS Authoritative Server 2.9.22. Note: turning this on breaks compatibility with RFC 6891." },
 495   { "unregisterDynBPFFilter", true, "DynBPFFilter", "unregister this dynamic BPF filter" },
 496   { "webserver", true, "address:port, password [, apiKey [, customHeaders ]])", "launch a webserver with stats on that address with that password" },
 497   { "whashed", false, "", "Weighted hashed ('sticky') distribution over available servers, based on the server 'weight' parameter" },
 498   { "chashed", false, "", "Consistent hashed ('sticky') distribution over available servers, also based on the server 'weight' parameter" },
 499   { "wrandom", false, "", "Weighted random over available servers, based on the server 'weight' parameter" },
 500 };
 501
 502 extern "C" {
 503 char* my_generator(const char* text, int state)
 504 {
 505   string t(text);
 506   /* to keep it readable, we try to keep only 4 keywords per line
 507      and to start a new line when the first letter changes */
 508   static int s_counter=0;
 509   int counter=0;
 510   if(!state)
 511     s_counter=0;
 512
 513   for(const auto& keyword : g_consoleKeywords) {
 514     if(boost::starts_with(keyword.name, t) && counter++ == s_counter)  {
 515       std::string value(keyword.name);
 516       s_counter++;
 517       if (keyword.function) {
 518         value += "(";
 519         if (keyword.parameters.empty()) {
 520           value += ")";
 521         }
 522       }
 523       return strdup(value.c_str());
 524     }
 525   }
 526   return 0;
 527 }
 528
 529 char** my_completion( const char * text , int start,  int end)
 530 {
 531   char **matches=0;
 532   if (start == 0)
 533     matches = rl_completion_matches ((char*)text, &my_generator);
 534
 535   // skip default filename completion.
 536   rl_attempted_completion_over = 1;
 537
 538   return matches;
 539 }
 540 }
 541
 542 static void controlClientThread(int fd, ComboAddress client)
 543 try
 544 {
 545   setThreadName("dnsdist/conscli");
 546   setTCPNoDelay(fd);
 547   SodiumNonce theirs, ours, readingNonce, writingNonce;
 548   ours.init();
 549   readn2(fd, (char*)theirs.value, sizeof(theirs.value));
 550   writen2(fd, (char*)ours.value, sizeof(ours.value));
 551   readingNonce.merge(ours, theirs);
 552   writingNonce.merge(theirs, ours);
 553
 554   for(;;) {
 555     uint32_t len;
 556     if(!getMsgLen32(fd, &len))
 557       break;
 558
 559     if (len == 0) {
 560       /* just ACK an empty message
 561          with an empty response */
 562       putMsgLen32(fd, 0);
 563       continue;
 564     }
 565
 566     boost::scoped_array<char> msg(new char[len]);
 567     readn2(fd, msg.get(), len);
 568
 569     string line(msg.get(), len);
 570
 571     line = sodDecryptSym(line, g_consoleKey, readingNonce);
 572     //    cerr<<"Have decrypted line: "<<line<<endl;
 573     string response;
 574     try {
 575       bool withReturn=true;
 576     retry:;
 577       try {
 578         std::lock_guard<std::mutex> lock(g_luamutex);
 579
 580         g_outputBuffer.clear();
 581         resetLuaSideEffect();
 582         auto ret=g_lua.executeCode<
 583           boost::optional<
 584             boost::variant<
 585               string,
 586               shared_ptr<DownstreamState>,
 587               ClientState*,
 588               std::unordered_map<string, double>
 589               >
 590             >
 591           >(withReturn ? ("return "+line) : line);
 592
 593       if(ret) {
 594         if (const auto dsValue = boost::get<shared_ptr<DownstreamState>>(&*ret)) {
 595           if (*dsValue) {
 596             response=(*dsValue)->getName()+"\n";
 597           } else {
 598             response="";
 599           }
 600         }
 601         else if (const auto csValue = boost::get<ClientState*>(&*ret)) {
 602           if (*csValue) {
 603             response=(*csValue)->local.toStringWithPort()+"\n";
 604           } else {
 605             response="";
 606           }
 607         }
 608         else if (const auto strValue = boost::get<string>(&*ret)) {
 609           response=*strValue+"\n";
 610         }
 611         else if(const auto um = boost::get<std::unordered_map<string, double> >(&*ret)) {
 612           using namespace json11;
 613           Json::object o;
 614           for(const auto& v : *um)
 615             o[v.first]=v.second;
 616           Json out = o;
 617           response=out.dump()+"\n";
 618         }
 619       }
 620       else
 621         response=g_outputBuffer;
 622       if(!getLuaNoSideEffect())
 623         feedConfigDelta(line);
 624       }
 625       catch(const LuaContext::SyntaxErrorException&) {
 626         if(withReturn) {
 627           withReturn=false;
 628           goto retry;
 629         }
 630         throw;
 631       }
 632     }
 633     catch(const LuaContext::WrongTypeException& e) {
 634       response = "Command returned an object we can't print: " +std::string(e.what()) + "\n";
 635       // tried to return something we don't understand
 636     }
 637     catch(const LuaContext::ExecutionErrorException& e) {
 638       if(!strcmp(e.what(),"invalid key to 'next'"))
 639         response = "Error: Parsing function parameters, did you forget parameter name?";
 640       else
 641         response = "Error: " + string(e.what());
 642       try {
 643         std::rethrow_if_nested(e);
 644       } catch(const std::exception& ne) {
 645         // ne is the exception that was thrown from inside the lambda
 646         response+= ": " + string(ne.what());
 647       }
 648       catch(const PDNSException& ne) {
 649         // ne is the exception that was thrown from inside the lambda
 650         response += ": " + string(ne.reason);
 651       }
 652     }
 653     catch(const LuaContext::SyntaxErrorException& e) {
 654       response = "Error: " + string(e.what()) + ": ";
 655     }
 656     response = sodEncryptSym(response, g_consoleKey, writingNonce);
 657     putMsgLen32(fd, response.length());
 658     writen2(fd, response.c_str(), response.length());
 659   }
 660   if (g_logConsoleConnections) {
 661     infolog("Closed control connection from %s", client.toStringWithPort());
 662   }
 663   close(fd);
 664   fd=-1;
 665 }
 666 catch(std::exception& e)
 667 {
 668   errlog("Got an exception in client connection from %s: %s", client.toStringWithPort(), e.what());
 669   if(fd >= 0)
 670     close(fd);
 671 }
 672
 673 void controlThread(int fd, ComboAddress local)
 674 try
 675 {
 676   setThreadName("dnsdist/control");
 677   ComboAddress client;
 678   int sock;
 679   auto localACL = g_consoleACL.getLocal();
 680   infolog("Accepting control connections on %s", local.toStringWithPort());
 681
 682   while ((sock = SAccept(fd, client)) >= 0) {
 683
 684     if (!sodIsValidKey(g_consoleKey)) {
 685       vinfolog("Control connection from %s dropped because we don't have a valid key configured, please configure one using setKey()", client.toStringWithPort());
 686       close(sock);
 687       continue;
 688     }
 689
 690     if (!localACL->match(client)) {
 691       vinfolog("Control connection from %s dropped because of ACL", client.toStringWithPort());
 692       close(sock);
 693       continue;
 694     }
 695
 696     if (g_logConsoleConnections) {
 697       warnlog("Got control connection from %s", client.toStringWithPort());
 698     }
 699
 700     std::thread t(controlClientThread, sock, client);
 701     t.detach();
 702   }
 703 }
 704 catch(const std::exception& e)
 705 {
 706   close(fd);
 707   errlog("Control connection died: %s", e.what());
 708 }
 709
 710 bool getMsgLen32(int fd, uint32_t* len)
 711 try
 712 {
 713   uint32_t raw;
 714   size_t ret = readn2(fd, &raw, sizeof raw);
 715   if(ret != sizeof raw)
 716     return false;
 717   *len = ntohl(raw);
 718   if(*len > g_consoleOutputMsgMaxSize)
 719     return false;
 720   return true;
 721 }
 722 catch(...) {
 723    return false;
 724 }
 725
 726 bool putMsgLen32(int fd, uint32_t len)
 727 try
 728 {
 729   uint32_t raw = htonl(len);
 730   size_t ret = writen2(fd, &raw, sizeof raw);
 731   return ret==sizeof raw;
 732 }
 733 catch(...) {
 734   return false;
 735 }