3 #include "ext/luawrapper/include/LuaContext.hpp"
9 #include <boost/circular_buffer.hpp>
10 #include <boost/variant.hpp>
15 #include "dnscrypt.hh"
16 #include "dnsdist-cache.hh"
18 #include "dnsdist-dynbpf.hh"
19 #include "bpf-filter.hh"
22 #include <boost/uuid/uuid.hpp>
23 #include <boost/uuid/uuid_generators.hpp>
26 void* carbonDumpThread();
27 uint64_t uptimeOfProcess(const std::string& str);
31 DynBlock& operator=(const DynBlock& rhs)
36 blocks.store(rhs.blocks);
41 struct timespec until;
43 mutable std::atomic<unsigned int> blocks;
46 extern GlobalStateHolder<NetmaskTree<DynBlock>> g_dynblockNMG;
48 extern vector<pair<struct timeval, std::string> > g_confDelta;
52 using stat_t=std::atomic<uint64_t>; // aww yiss ;-)
54 stat_t servfailResponses{0};
56 stat_t nonCompliantQueries{0};
57 stat_t nonCompliantResponses{0};
59 stat_t emptyQueries{0};
61 stat_t blockFilter{0};
64 stat_t ruleNXDomain{0};
65 stat_t selfAnswered{0};
66 stat_t downstreamTimeouts{0};
67 stat_t downstreamSendErrors{0};
71 stat_t cacheMisses{0};
72 stat_t latency0_1{0}, latency1_10{0}, latency10_50{0}, latency50_100{0}, latency100_1000{0}, latencySlow{0};
74 double latencyAvg100{0}, latencyAvg1000{0}, latencyAvg10000{0}, latencyAvg1000000{0};
75 typedef std::function<uint64_t(const std::string&)> statfunction_t;
76 typedef boost::variant<stat_t*, double*, statfunction_t> entry_t;
77 std::vector<std::pair<std::string, entry_t>> entries{
78 {"responses", &responses}, {"servfail-responses", &servfailResponses},
79 {"queries", &queries}, {"acl-drops", &aclDrops},
80 {"block-filter", &blockFilter}, {"rule-drop", &ruleDrop},
81 {"rule-nxdomain", &ruleNXDomain}, {"self-answered", &selfAnswered},
82 {"downstream-timeouts", &downstreamTimeouts}, {"downstream-send-errors", &downstreamSendErrors},
83 {"trunc-failures", &truncFail}, {"no-policy", &noPolicy},
84 {"latency0-1", &latency0_1}, {"latency1-10", &latency1_10},
85 {"latency10-50", &latency10_50}, {"latency50-100", &latency50_100},
86 {"latency100-1000", &latency100_1000}, {"latency-slow", &latencySlow},
87 {"latency-avg100", &latencyAvg100}, {"latency-avg1000", &latencyAvg1000},
88 {"latency-avg10000", &latencyAvg10000}, {"latency-avg1000000", &latencyAvg1000000},
89 {"uptime", uptimeOfProcess},
90 {"real-memory-usage", getRealMemoryUsage},
91 {"noncompliant-queries", &nonCompliantQueries},
92 {"noncompliant-responses", &nonCompliantResponses},
93 {"rdqueries", &rdQueries},
94 {"empty-queries", &emptyQueries},
95 {"cache-hits", &cacheHits},
96 {"cache-misses", &cacheMisses},
97 {"cpu-user-msec", getCPUTimeUser},
98 {"cpu-sys-msec", getCPUTimeSystem},
99 {"fd-usage", getOpenFileDescriptors}, {"dyn-blocked", &dynBlocked},
100 {"dyn-block-nmg-size", [](const std::string&) { return g_dynblockNMG.getLocal()->size(); }}
105 extern struct DNSDistStats g_stats;
110 StopWatch(bool realTime=false): d_needRealTime(realTime)
113 struct timespec d_start{0,0};
114 bool d_needRealTime{false};
117 if(gettime(&d_start, d_needRealTime) < 0)
118 unixDie("Getting timestamp");
122 double udiff() const {
124 if(gettime(&now, d_needRealTime) < 0)
125 unixDie("Getting timestamp");
127 return 1000000.0*(now.tv_sec - d_start.tv_sec) + (now.tv_nsec - d_start.tv_nsec)/1000.0;
130 double udiffAndSet() {
132 if(gettime(&now, d_needRealTime) < 0)
133 unixDie("Getting timestamp");
135 auto ret= 1000000.0*(now.tv_sec - d_start.tv_sec) + (now.tv_nsec - d_start.tv_nsec)/1000.0;
149 QPSLimiter(unsigned int rate, unsigned int burst) : d_rate(rate), d_burst(burst), d_tokens(burst)
155 unsigned int getRate() const
157 return d_passthrough? 0 : d_rate;
160 int getPassed() const
164 int getBlocked() const
169 bool check() const // this is not quite fair
173 auto delta = d_prev.udiffAndSet();
175 d_tokens += 1.0*d_rate * (delta/1000000.0);
177 if(d_tokens > d_burst)
181 if(d_tokens >= 1.0) { // we need this because burst=1 is weird otherwise
192 bool d_passthrough{true};
194 unsigned int d_burst;
195 mutable double d_tokens;
196 mutable StopWatch d_prev;
197 mutable unsigned int d_passed{0};
198 mutable unsigned int d_blocked{0};
203 IDState() : origFD(-1), sentTime(true), delayMsec(0) { origDest.sin4.sin_family = 0;}
204 IDState(const IDState& orig)
206 origFD = orig.origFD;
207 origID = orig.origID;
208 origRemote = orig.origRemote;
209 origDest = orig.origDest;
210 delayMsec = orig.delayMsec;
211 age.store(orig.age.load());
214 int origFD; // set to <0 to indicate this state is empty // 4
216 ComboAddress origRemote; // 28
217 ComboAddress origDest; // 28
218 StopWatch sentTime; // 16
221 std::shared_ptr<DnsCryptQuery> dnsCryptQuery{0};
224 boost::uuids::uuid uniqueId;
226 std::shared_ptr<DNSDistPacketCache> packetCache{nullptr};
227 uint32_t cacheKey; // 8
228 std::atomic<uint16_t> age; // 4
230 uint16_t qclass; // 2
231 uint16_t origID; // 2
232 uint16_t origFlags; // 2
234 bool ednsAdded{false};
235 bool ecsAdded{false};
236 bool skipCache{false};
242 queryRing.set_capacity(10000);
243 respRing.set_capacity(10000);
244 pthread_rwlock_init(&queryLock, 0);
248 struct timespec when;
249 ComboAddress requestor;
255 boost::circular_buffer<Query> queryRing;
258 struct timespec when;
259 ComboAddress requestor;
265 ComboAddress ds; // who handled it
267 boost::circular_buffer<Response> respRing;
268 std::mutex respMutex;
269 pthread_rwlock_t queryLock;
271 std::unordered_map<int, vector<boost::variant<string,double> > > getTopBandwidth(unsigned int numentries);
272 size_t numDistinctRequestors();
275 extern Rings g_rings;
281 DnsCryptContext* dnscryptCtx{0};
283 std::atomic<uint64_t> queries{0};
288 class TCPClientCollection {
289 std::vector<int> d_tcpclientthreads;
290 std::atomic<uint64_t> d_pos{0};
292 std::atomic<uint64_t> d_queued{0}, d_numthreads{0};
293 uint64_t d_maxthreads{0};
295 TCPClientCollection(size_t maxThreads)
297 d_maxthreads = maxThreads;
298 d_tcpclientthreads.reserve(maxThreads);
303 uint64_t pos = d_pos++;
305 return d_tcpclientthreads[pos % d_numthreads];
307 void addTCPClientThread();
310 extern std::shared_ptr<TCPClientCollection> g_tcpclientthreads;
312 struct DownstreamState
314 DownstreamState(const ComboAddress& remote_, const ComboAddress& sourceAddr_, unsigned int sourceItf);
315 DownstreamState(const ComboAddress& remote_): DownstreamState(remote_, ComboAddress(), 0) {}
326 vector<IDState> idStates;
327 ComboAddress sourceAddr;
328 DNSName checkName{"a.root-servers.net."};
329 QType checkType{QType::A};
330 std::atomic<uint64_t> idOffset{0};
331 std::atomic<uint64_t> sendErrors{0};
332 std::atomic<uint64_t> outstanding{0};
333 std::atomic<uint64_t> reuseds{0};
334 std::atomic<uint64_t> queries{0};
336 std::atomic<uint64_t> sendErrors{0};
337 std::atomic<uint64_t> reuseds{0};
338 std::atomic<uint64_t> queries{0};
341 double queryLoad{0.0};
342 double dropRate{0.0};
343 double latencyUsec{0.0};
346 int tcpRecvTimeout{30};
347 int tcpSendTimeout{30};
348 unsigned int sourceItf{0};
350 uint8_t currentCheckFailures{0};
351 uint8_t maxCheckFailures{1};
354 enum class Availability { Up, Down, Auto} availability{Availability::Auto};
355 bool mustResolve{false};
356 bool upStatus{false};
360 if(availability == Availability::Down)
362 if(availability == Availability::Up)
366 void setUp() { availability = Availability::Up; }
367 void setDown() { availability = Availability::Down; }
368 void setAuto() { availability = Availability::Auto; }
369 string getName() const {
371 return remote.toStringWithPort();
375 string getNameWithAddr() const {
377 return remote.toStringWithPort();
379 return name + " (" + remote.toStringWithPort()+ ")";
383 using servers_t =vector<std::shared_ptr<DownstreamState>>;
387 DNSQuestion(const DNSName* name, uint16_t type, uint16_t class_, const ComboAddress* lc, const ComboAddress* rem, struct dnsheader* header, size_t bufferSize, uint16_t queryLen, bool isTcp): qname(name), qtype(type), qclass(class_), local(lc), remote(rem), dh(header), size(bufferSize), len(queryLen), tcp(isTcp) { }
390 boost::uuids::uuid uniqueId;
392 const DNSName* qname;
393 const uint16_t qtype;
394 const uint16_t qclass;
395 const ComboAddress* local;
396 const ComboAddress* remote;
397 struct dnsheader* dh;
401 bool skipCache{false};
404 struct DNSResponse : DNSQuestion
406 DNSResponse(const DNSName* name, uint16_t type, uint16_t class_, const ComboAddress* lc, const ComboAddress* rem, struct dnsheader* header, size_t bufferSize, uint16_t queryLen, bool isTcp, const struct timespec* queryTime_): DNSQuestion(name, type, class_, lc, rem, header, bufferSize, queryLen, isTcp), queryTime(queryTime_) { }
408 const struct timespec* queryTime;
411 typedef std::function<bool(const DNSQuestion*)> blockfilter_t;
412 template <class T> using NumberedVector = std::vector<std::pair<unsigned int, T> >;
414 void* responderThread(std::shared_ptr<DownstreamState> state);
415 extern std::mutex g_luamutex;
416 extern LuaContext g_lua;
417 extern std::string g_outputBuffer; // locking for this is ok, as locked by g_luamutex
422 virtual bool matches(const DNSQuestion* dq) const =0;
423 virtual string toString() const = 0;
424 mutable std::atomic<uint64_t> d_matches{0};
427 /* so what could you do:
430 provide actual answer,
431 allow & and stop processing,
433 modify header: (servfail|refused|notimp), set TC=1,
439 enum class Action { Drop, Nxdomain, Spoof, Allow, HeaderModify, Pool, Delay, None};
440 virtual Action operator()(DNSQuestion*, string* ruleresult) const =0;
441 virtual string toString() const = 0;
442 virtual std::unordered_map<string, double> getStats() const
448 class DNSResponseAction
451 enum class Action { None };
452 virtual Action operator()(DNSResponse*, string* ruleresult) const =0;
453 virtual string toString() const = 0;
456 using NumberedServerVector = NumberedVector<shared_ptr<DownstreamState>>;
457 typedef std::function<shared_ptr<DownstreamState>(const NumberedServerVector& servers, const DNSQuestion*)> policyfunc_t;
467 const std::shared_ptr<DNSDistPacketCache> getCache() const { return packetCache; };
469 NumberedVector<shared_ptr<DownstreamState>> servers;
470 std::shared_ptr<DNSDistPacketCache> packetCache{nullptr};
472 using pools_t=map<std::string,std::shared_ptr<ServerPool>>;
473 void addServerToPool(pools_t& pools, const string& poolName, std::shared_ptr<DownstreamState> server);
474 void removeServerFromPool(pools_t& pools, const string& poolName, std::shared_ptr<DownstreamState> server);
480 unsigned int interval;
483 enum ednsHeaderFlags {
484 EDNS_HEADER_FLAG_NONE = 0,
485 EDNS_HEADER_FLAG_DO = 32768
488 /* Quest in life: serve as a rapid block list. If you add a DNSName to a root SuffixMatchNode,
489 anything part of that domain will return 'true' in check */
491 struct SuffixMatchTree
493 SuffixMatchTree(const std::string& name_="", bool endNode_=false) : name(name_), endNode(endNode_)
496 SuffixMatchTree(const SuffixMatchTree& rhs)
499 d_human = rhs.d_human;
500 children = rhs.children;
501 endNode = rhs.endNode;
502 d_value = rhs.d_value;
506 mutable std::set<SuffixMatchTree> children;
507 mutable bool endNode;
509 bool operator<(const SuffixMatchTree& rhs) const
511 return strcasecmp(name.c_str(), rhs.name.c_str()) < 0;
513 typedef SuffixMatchTree value_type;
516 void visit(const V& v) const {
517 for(const auto& c : children)
523 void add(const DNSName& name, const T& t)
525 add(name.getRawLabels(), t);
528 void add(std::vector<std::string> labels, const T& value) const
530 if(labels.empty()) { // this allows insertion of the root
534 else if(labels.size()==1) {
535 SuffixMatchTree newChild(*labels.begin(), true);
536 newChild.d_value=value;
537 children.insert(newChild);
540 SuffixMatchTree newnode(*labels.rbegin(), false);
541 auto res=children.insert(newnode);
543 children.erase(newnode);
544 res=children.insert(newnode);
547 res.first->add(labels, value);
551 T* lookup(const DNSName& name) const
553 if(children.empty()) { // speed up empty set
558 return lookup(name.getRawLabels());
561 T* lookup(std::vector<std::string> labels) const
563 if(labels.empty()) { // optimization
569 SuffixMatchTree smn(*labels.rbegin());
570 auto child = children.find(smn);
571 if(child == children.end()) {
577 return child->lookup(labels);
582 extern GlobalStateHolder<SuffixMatchTree<DynBlock>> g_dynblockSMT;
584 extern GlobalStateHolder<vector<CarbonConfig> > g_carbon;
585 extern GlobalStateHolder<ServerPolicy> g_policy;
586 extern GlobalStateHolder<servers_t> g_dstates;
587 extern GlobalStateHolder<pools_t> g_pools;
588 extern GlobalStateHolder<vector<pair<std::shared_ptr<DNSRule>, std::shared_ptr<DNSAction> > > > g_rulactions;
589 extern GlobalStateHolder<vector<pair<std::shared_ptr<DNSRule>, std::shared_ptr<DNSResponseAction> > > > g_resprulactions;
590 extern GlobalStateHolder<NetmaskGroup> g_ACL;
592 extern ComboAddress g_serverControl; // not changed during runtime
594 extern std::vector<std::tuple<ComboAddress, bool, bool, int>> g_locals; // not changed at runtime (we hope XXX)
595 extern vector<ClientState*> g_frontends;
596 extern std::string g_key; // in theory needs locking
597 extern bool g_truncateTC;
598 extern bool g_fixupCase;
599 extern int g_tcpRecvTimeout;
600 extern int g_tcpSendTimeout;
601 extern uint16_t g_maxOutstanding;
602 extern std::atomic<bool> g_configurationDone;
603 extern uint64_t g_maxTCPClientThreads;
604 extern uint64_t g_maxTCPQueuedConnections;
605 extern std::atomic<uint16_t> g_cacheCleaningDelay;
606 extern uint16_t g_ECSSourcePrefixV4;
607 extern uint16_t g_ECSSourcePrefixV6;
608 extern bool g_ECSOverride;
609 extern bool g_verboseHealthChecks;
610 extern uint32_t g_staleCacheEntriesTTL;
612 struct ConsoleKeyword {
615 std::string parameters;
616 std::string description;
617 std::string toString() const
619 std::string res(name);
621 res += "(" + parameters + ")";
628 extern const std::vector<ConsoleKeyword> g_consoleKeywords;
631 extern shared_ptr<BPFFilter> g_defaultBPFFilter;
632 #endif /* HAVE_EBPF */
636 void controlThread(int fd, ComboAddress local);
637 vector<std::function<void(void)>> setupLua(bool client, const std::string& config);
638 std::shared_ptr<ServerPool> getPool(const pools_t& pools, const std::string& poolName);
639 std::shared_ptr<ServerPool> createPoolIfNotExists(pools_t& pools, const string& poolName);
640 const NumberedServerVector& getDownstreamCandidates(const pools_t& pools, const std::string& poolName);
642 std::shared_ptr<DownstreamState> firstAvailable(const NumberedServerVector& servers, const DNSQuestion* dq);
644 std::shared_ptr<DownstreamState> leastOutstanding(const NumberedServerVector& servers, const DNSQuestion* dq);
645 std::shared_ptr<DownstreamState> wrandom(const NumberedServerVector& servers, const DNSQuestion* dq);
646 std::shared_ptr<DownstreamState> whashed(const NumberedServerVector& servers, const DNSQuestion* dq);
647 std::shared_ptr<DownstreamState> roundrobin(const NumberedServerVector& servers, const DNSQuestion* dq);
648 int getEDNSZ(const char* packet, unsigned int len);
649 void spoofResponseFromString(DNSQuestion& dq, const string& spoofContent);
650 uint16_t getEDNSOptionCode(const char * packet, size_t len);
651 void dnsdistWebserverThread(int sock, const ComboAddress& local, const string& password, const string& apiKey, const boost::optional<std::map<std::string, std::string> >&);
652 bool getMsgLen32(int fd, uint32_t* len);
653 bool putMsgLen32(int fd, uint32_t len);
654 void* tcpAcceptorThread(void* p);
656 void moreLua(bool client);
657 void doClient(ComboAddress server, const std::string& command);
659 void controlClientThread(int fd, ComboAddress client);
661 char** my_completion( const char * text , int start, int end);
663 void setLuaNoSideEffect(); // if nothing has been declared, set that there are no side effects
664 void setLuaSideEffect(); // set to report a side effect, cancelling all _no_ side effect calls
665 bool getLuaNoSideEffect(); // set if there were only explicit declarations of _no_ side effect
666 void resetLuaSideEffect(); // reset to indeterminate state
668 bool responseContentMatches(const char* response, const uint16_t responseLen, const DNSName& qname, const uint16_t qtype, const uint16_t qclass, const ComboAddress& remote);
669 bool processQuery(LocalStateHolder<NetmaskTree<DynBlock> >& localDynBlockNMG,
670 LocalStateHolder<SuffixMatchTree<DynBlock> >& localDynBlockSMT, LocalStateHolder<vector<pair<std::shared_ptr<DNSRule>, std::shared_ptr<DNSAction> > > >& localRulactions, blockfilter_t blockFilter, DNSQuestion& dq, string& poolname, int* delayMsec, const struct timespec& now);
671 bool processResponse(LocalStateHolder<vector<pair<std::shared_ptr<DNSRule>, std::shared_ptr<DNSResponseAction> > > >& localRespRulactions, DNSResponse& dr);
672 bool fixUpResponse(char** response, uint16_t* responseLen, size_t* responseSize, const DNSName& qname, uint16_t origFlags, bool ednsAdded, bool ecsAdded, std::vector<uint8_t>& rewrittenResponse, uint16_t addRoom);
673 void restoreFlags(struct dnsheader* dh, uint16_t origFlags);
676 extern std::vector<std::tuple<ComboAddress,DnsCryptContext,bool,int>> g_dnsCryptLocals;
678 int handleDnsCryptQuery(DnsCryptContext* ctx, char* packet, uint16_t len, std::shared_ptr<DnsCryptQuery>& query, uint16_t* decryptedQueryLen, bool tcp, std::vector<uint8_t>& reponse);
679 bool encryptResponse(char* response, uint16_t* responseLen, size_t responseSize, bool tcp, std::shared_ptr<DnsCryptQuery> dnsCryptQuery);