pdns/doh.hh

   1 #pragma once
   2 #include "iputils.hh"
   3 #include "libssl.hh"
   4
   5 struct DOHServerConfig;
   6
   7 class DOHResponseMapEntry
   8 {
   9 public:
  10   DOHResponseMapEntry(const std::string& regex, uint16_t status, const std::string& content, const boost::optional<std::vector<std::pair<std::string, std::string>>>& headers): d_regex(regex), d_customHeaders(headers), d_content(content), d_status(status)
  11   {
  12   }
  13
  14   bool matches(const std::string& path) const
  15   {
  16     return d_regex.match(path);
  17   }
  18
  19   uint16_t getStatusCode() const
  20   {
  21     return d_status;
  22   }
  23
  24   const std::string& getContent() const
  25   {
  26     return d_content;
  27   }
  28
  29   const boost::optional<std::vector<std::pair<std::string, std::string>>>& getHeaders() const
  30   {
  31     return d_customHeaders;
  32   }
  33
  34 private:
  35   Regex d_regex;
  36   boost::optional<std::vector<std::pair<std::string, std::string>>> d_customHeaders;
  37   std::string d_content;
  38   uint16_t d_status;
  39 };
  40
  41 struct DOHFrontend
  42 {
  43   std::shared_ptr<DOHServerConfig> d_dsc{nullptr};
  44   std::vector<std::pair<std::string, std::string>> d_certKeyPairs;
  45   std::vector<std::string> d_ocspFiles;
  46   std::vector<std::shared_ptr<DOHResponseMapEntry>> d_responsesMap;
  47   std::string d_ciphers;
  48   std::string d_ciphers13;
  49   std::string d_serverTokens{"h2o/dnsdist"};
  50   LibsslTLSVersion d_minTLSVersion{LibsslTLSVersion::TLS10};
  51   std::vector<std::pair<std::string, std::string>> d_customResponseHeaders;
  52   ComboAddress d_local;
  53
  54   uint32_t d_idleTimeout{30};             // HTTP idle timeout in seconds
  55   std::vector<std::string> d_urls;
  56
  57   std::atomic<uint64_t> d_httpconnects;   // number of TCP/IP connections established
  58   std::atomic<uint64_t> d_tls10queries;   // valid DNS queries received via TLSv1.0
  59   std::atomic<uint64_t> d_tls11queries;   // valid DNS queries received via TLSv1.1
  60   std::atomic<uint64_t> d_tls12queries;   // valid DNS queries received via TLSv1.2
  61   std::atomic<uint64_t> d_tls13queries;   // valid DNS queries received via TLSv1.3
  62   std::atomic<uint64_t> d_tlsUnknownqueries;   // valid DNS queries received via unknown TLS version
  63
  64   std::atomic<uint64_t> d_getqueries;     // valid DNS queries received via GET
  65   std::atomic<uint64_t> d_postqueries;    // valid DNS queries received via POST
  66   std::atomic<uint64_t> d_badrequests;     // request could not be converted to dns query
  67   std::atomic<uint64_t> d_errorresponses; // dnsdist set 'error' on response
  68   std::atomic<uint64_t> d_redirectresponses; // dnsdist set 'redirect' on response
  69   std::atomic<uint64_t> d_validresponses; // valid responses sent out
  70
  71   struct HTTPVersionStats
  72   {
  73     std::atomic<uint64_t> d_nbQueries{0}; // valid DNS queries received
  74     std::atomic<uint64_t> d_nb200Responses{0};
  75     std::atomic<uint64_t> d_nb400Responses{0};
  76     std::atomic<uint64_t> d_nb403Responses{0};
  77     std::atomic<uint64_t> d_nb500Responses{0};
  78     std::atomic<uint64_t> d_nb502Responses{0};
  79     std::atomic<uint64_t> d_nbOtherResponses{0};
  80   };
  81
  82   HTTPVersionStats d_http1Stats;
  83   HTTPVersionStats d_http2Stats;
  84
  85 #ifndef HAVE_DNS_OVER_HTTPS
  86   void setup()
  87   {
  88   }
  89
  90   void reloadCertificates()
  91   {
  92   }
  93 #else
  94   void setup();
  95   void reloadCertificates();
  96 #endif /* HAVE_DNS_OVER_HTTPS */
  97 };
  98
  99 #ifndef HAVE_DNS_OVER_HTTPS
 100 struct DOHUnit
 101 {
 102 };
 103
 104 #else /* HAVE_DNS_OVER_HTTPS */
 105 #include <unordered_map>
 106
 107 struct st_h2o_req_t;
 108
 109 struct DOHUnit
 110 {
 111   std::string query;
 112   std::string response;
 113   ComboAddress remote;
 114   ComboAddress dest;
 115   st_h2o_req_t* req{nullptr};
 116   DOHUnit** self{nullptr};
 117   std::string contentType;
 118   int rsock;
 119   uint16_t qtype;
 120   /* the status_code is set from
 121      processDOHQuery() (which is executed in
 122      the DOH client thread) so that the correct
 123      response can be sent in on_dnsdist(),
 124      after the DOHUnit has been passed back to
 125      the main DoH thread.
 126   */
 127   uint16_t status_code{200};
 128   bool ednsAdded{false};
 129
 130   std::string getHTTPPath() const;
 131   std::string getHTTPHost() const;
 132   std::string getHTTPScheme() const;
 133   std::string getHTTPQueryString() const;
 134   std::unordered_map<std::string, std::string> getHTTPHeaders() const;
 135   void setHTTPResponse(uint16_t statusCode, const std::string& body, const std::string& contentType="");
 136 };
 137
 138 #endif /* HAVE_DNS_OVER_HTTPS  */
 139
 140 void handleDOHTimeout(DOHUnit* oldDU);