From 7c36f101a21376a0eb59f9bbda85278ea597dd3a Mon Sep 17 00:00:00 2001 From: Otto Date: Tue, 25 May 2021 14:16:35 +0200 Subject: [PATCH] Very basic config: enable/disbale forcing of DoT for target port 853 --- pdns/lwres.cc | 2 +- pdns/pdns_recursor.cc | 10 ++++++++-- pdns/rec_channel_rec.cc | 5 +++-- pdns/syncres.cc | 18 +++++++++++++----- pdns/syncres.hh | 5 ++++- 5 files changed, 29 insertions(+), 11 deletions(-) diff --git a/pdns/lwres.cc b/pdns/lwres.cc index 1d5f0f7ccb..3af1421dc3 100644 --- a/pdns/lwres.cc +++ b/pdns/lwres.cc @@ -349,7 +349,7 @@ LWResult::Result asyncresolve(const ComboAddress& ip, const DNSName& domain, int s.bind(localip); std::shared_ptr tlsCtx{nullptr}; - if (ip.getPort() == 853) { + if (SyncRes::s_dot_to_port_853 && ip.getPort() == 853) { TLSContextParameters tlsParams; tlsParams.d_provider = "openssl"; tlsParams.d_validateCertificates = false; diff --git a/pdns/pdns_recursor.cc b/pdns/pdns_recursor.cc index 9de909a47c..3ea85cf725 100644 --- a/pdns/pdns_recursor.cc +++ b/pdns/pdns_recursor.cc @@ -2257,7 +2257,7 @@ static void startDoResolve(void *p) g_log<getTid()<<"/"<numProcesses()<<"] answer to "<<(dc->d_mdp.d_header.rd?"":"non-rd ")<<"question '"<d_mdp.d_qname<<"|"<d_mdp.d_qtype); g_log<<"': "<ancount)<<" answers, "<arcount)<<" additional, took "<(pleaseGetConcurrentQueries)<<" queries running, "<(pleaseGetPacketCacheSize); @@ -4768,6 +4768,10 @@ static int serviceMain(int argc, char*argv[]) SyncRes::s_tcp_fast_open = ::arg().asNum("tcp-fast-open"); SyncRes::s_tcp_fast_open_connect = ::arg().mustDo("tcp-fast-open-connect"); +#ifdef HAVE_DNS_OVER_TLS + SyncRes::s_dot_to_port_853 = ::arg().mustDo("dot-to-port-853"); +#endif + if (SyncRes::s_tcp_fast_open_connect) { checkFastOpenSysctl(true); checkTFOconnect(); @@ -5707,6 +5711,8 @@ int main(int argc, char **argv) ::arg().set("edns-padding-mode", "Whether to add EDNS padding to all responses ('always') or only to responses for queries containing the EDNS padding option ('padded-queries-only', the default). In both modes, padding will only be added to responses for queries coming from `edns-padding-from`_ sources")="padded-queries-only"; ::arg().set("edns-padding-tag", "Packetcache tag associated to responses sent with EDNS padding, to prevent sending these to clients for which padding is not enabled.")="7830"; + ::arg().set("dot-to-port-853", "Force DoT connection to target port 853 if DoT compiled in")="yes"; + ::arg().setCmd("help","Provide a helpful message"); ::arg().setCmd("version","Print version string"); ::arg().setCmd("config","Output blank configuration"); diff --git a/pdns/rec_channel_rec.cc b/pdns/rec_channel_rec.cc index ef0b7bc844..1c432c3198 100644 --- a/pdns/rec_channel_rec.cc +++ b/pdns/rec_channel_rec.cc @@ -1143,7 +1143,7 @@ static void registerAllStats1() addGetStat("ignored-packets", &g_stats.ignoredCount); addGetStat("empty-queries", &g_stats.emptyQueriesCount); addGetStat("max-mthread-stack", &g_stats.maxMThreadStackUsage); - + addGetStat("negcache-entries", getNegCacheSize); addGetStat("throttle-entries", getThrottleSize); @@ -1157,6 +1157,7 @@ static void registerAllStats1() addGetStat("outgoing6-timeouts", &SyncRes::s_outgoing6timeouts); addGetStat("auth-zone-queries", &SyncRes::s_authzonequeries); addGetStat("tcp-outqueries", &SyncRes::s_tcpoutqueries); + addGetStat("dot-outqueries", &SyncRes::s_dotoutqueries); addGetStat("all-outqueries", &SyncRes::s_outqueries); addGetStat("ipv6-outqueries", &g_stats.ipv6queries); addGetStat("throttled-outqueries", &SyncRes::s_throttledqueries); @@ -1288,7 +1289,7 @@ static void registerAllStats1() addGetStat("taskqueue-pushed", []() { return getTaskPushes(); }); addGetStat("taskqueue-expired", []() { return getTaskExpired(); }); addGetStat("taskqueue-size", []() { return getTaskSize(); }); - + /* make sure that the ECS stats are properly initialized */ SyncRes::clearECSStats(); for (size_t idx = 0; idx < SyncRes::s_ecsResponsesBySubnetSize4.size(); idx++) { diff --git a/pdns/syncres.cc b/pdns/syncres.cc index 086630bc75..dc1eb2894f 100644 --- a/pdns/syncres.cc +++ b/pdns/syncres.cc @@ -72,6 +72,7 @@ std::atomic SyncRes::s_outgoing4timeouts; std::atomic SyncRes::s_outgoing6timeouts; std::atomic SyncRes::s_outqueries; std::atomic SyncRes::s_tcpoutqueries; +std::atomic SyncRes::s_dotoutqueries; std::atomic SyncRes::s_throttledqueries; std::atomic SyncRes::s_dontqueries; std::atomic SyncRes::s_qnameminfallbacksuccess; @@ -98,6 +99,7 @@ SyncRes::HardenNXD SyncRes::s_hardenNXD; unsigned int SyncRes::s_refresh_ttlperc; int SyncRes::s_tcp_fast_open; bool SyncRes::s_tcp_fast_open_connect; +bool SyncRes::s_dot_to_port_853; #define LOG(x) if(d_lm == Log) { g_log <getPort() == 853; + bool forceTCP = SyncRes::s_dot_to_port_853 && remoteIP->getPort() == 853; if (!forceTCP) { gotAnswer = doResolveAtThisIP(prefix, qname, qtype, lwr, ednsmask, auth, sendRDQuery, wasForwarded, diff --git a/pdns/syncres.hh b/pdns/syncres.hh index 19c7706133..a9bf06b960 100644 --- a/pdns/syncres.hh +++ b/pdns/syncres.hh @@ -743,6 +743,7 @@ public: static std::atomic s_authzonequeries; static std::atomic s_outqueries; static std::atomic s_tcpoutqueries; + static std::atomic s_dotoutqueries; static std::atomic s_unreachables; static std::atomic s_ecsqueries; static std::atomic s_ecsresponses; @@ -785,7 +786,8 @@ public: static unsigned int s_refresh_ttlperc; static int s_tcp_fast_open; static bool s_tcp_fast_open_connect; - + static bool s_dot_to_port_853; + std::unordered_map d_discardedPolicies; DNSFilterEngine::Policy d_appliedPolicy; std::unordered_set d_policyTags; @@ -794,6 +796,7 @@ public: unsigned int d_authzonequeries; unsigned int d_outqueries; unsigned int d_tcpoutqueries; + unsigned int d_dotoutqueries; unsigned int d_throttledqueries; unsigned int d_timeouts; unsigned int d_unreachables; -- 2.47.2