1 /* dnstap support for Unbound */ 2 3 /* 4 * Copyright (c) 2013-2014, Farsight Security, Inc. 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 11 * 1. Redistributions of source code must retain the above copyright 12 * notice, this list of conditions and the following disclaimer. 13 * 14 * 2. Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in the 16 * documentation and/or other materials provided with the distribution. 17 * 18 * 3. Neither the name of the copyright holder nor the names of its 19 * contributors may be used to endorse or promote products derived from 20 * this software without specific prior written permission. 21 * 22 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 23 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 24 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 25 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR 26 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, 27 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, 28 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; 29 * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, 30 * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR 31 * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF 32 * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 33 */ 34 35 #include "dnstap/dnstap_config.h" 36 37 #ifdef USE_DNSTAP 38 39 #include "config.h" 40 #include <string.h> 41 #include <sys/time.h> 42 #ifdef HAVE_SYS_STAT_H 43 #include <sys/stat.h> 44 #endif 45 #include <errno.h> 46 #include "sldns/sbuffer.h" 47 #include "util/config_file.h" 48 #include "util/net_help.h" 49 #include "util/netevent.h" 50 #include "util/log.h" 51 52 #include <protobuf-c/protobuf-c.h> 53 54 #include "dnstap/dnstap.h" 55 #include "dnstap/dtstream.h" 56 #include "dnstap/dnstap.pb-c.h" 57 58 #define DNSTAP_INITIAL_BUF_SIZE 256 59 60 struct dt_msg { 61 void *buf; 62 size_t len_buf; 63 Dnstap__Dnstap d; 64 Dnstap__Message m; 65 }; 66 67 static int 68 dt_pack(const Dnstap__Dnstap *d, void **buf, size_t *sz) 69 { 70 ProtobufCBufferSimple sbuf; 71 72 memset(&sbuf, 0, sizeof(sbuf)); 73 sbuf.base.append = protobuf_c_buffer_simple_append; 74 sbuf.len = 0; 75 sbuf.alloced = DNSTAP_INITIAL_BUF_SIZE; 76 sbuf.data = malloc(sbuf.alloced); 77 if (sbuf.data == NULL) 78 return 0; 79 sbuf.must_free_data = 1; 80 81 *sz = dnstap__dnstap__pack_to_buffer(d, (ProtobufCBuffer *) &sbuf); 82 if (sbuf.data == NULL) 83 return 0; 84 *buf = sbuf.data; 85 86 return 1; 87 } 88 89 static void 90 dt_send(const struct dt_env *env, void *buf, size_t len_buf) 91 { 92 dt_msg_queue_submit(env->msgqueue, buf, len_buf); 93 } 94 95 static void 96 dt_msg_init(const struct dt_env *env, 97 struct dt_msg *dm, 98 Dnstap__Message__Type mtype) 99 { 100 memset(dm, 0, sizeof(*dm)); 101 dm->d.base.descriptor = &dnstap__dnstap__descriptor; 102 dm->m.base.descriptor = &dnstap__message__descriptor; 103 dm->d.type = DNSTAP__DNSTAP__TYPE__MESSAGE; 104 dm->d.message = &dm->m; 105 dm->m.type = mtype; 106 if (env->identity != NULL) { 107 dm->d.identity.data = (uint8_t *) env->identity; 108 dm->d.identity.len = (size_t) env->len_identity; 109 dm->d.has_identity = 1; 110 } 111 if (env->version != NULL) { 112 dm->d.version.data = (uint8_t *) env->version; 113 dm->d.version.len = (size_t) env->len_version; 114 dm->d.has_version = 1; 115 } 116 } 117 118 /* check that the socket file can be opened and exists, print error if not */ 119 static void 120 check_socket_file(const char* socket_path) 121 { 122 struct stat statbuf; 123 memset(&statbuf, 0, sizeof(statbuf)); 124 if(stat(socket_path, &statbuf) < 0) { 125 log_warn("could not open dnstap-socket-path: %s, %s", 126 socket_path, strerror(errno)); 127 } 128 } 129 130 struct dt_env * 131 dt_create(struct config_file* cfg) 132 { 133 struct dt_env *env; 134 135 if(cfg->dnstap && cfg->dnstap_socket_path && cfg->dnstap_socket_path[0] && 136 (cfg->dnstap_ip==NULL || cfg->dnstap_ip[0]==0)) { 137 verbose(VERB_OPS, "attempting to connect to dnstap socket %s", 138 cfg->dnstap_socket_path); 139 check_socket_file(cfg->dnstap_socket_path); 140 } 141 142 env = (struct dt_env *) calloc(1, sizeof(struct dt_env)); 143 if (!env) 144 return NULL; 145 146 env->dtio = dt_io_thread_create(); 147 if(!env->dtio) { 148 log_err("malloc failure"); 149 free(env); 150 return NULL; 151 } 152 if(!dt_io_thread_apply_cfg(env->dtio, cfg)) { 153 dt_io_thread_delete(env->dtio); 154 free(env); 155 return NULL; 156 } 157 dt_apply_cfg(env, cfg); 158 return env; 159 } 160 161 static void 162 dt_apply_identity(struct dt_env *env, struct config_file *cfg) 163 { 164 char buf[MAXHOSTNAMELEN+1]; 165 if (!cfg->dnstap_send_identity) 166 return; 167 free(env->identity); 168 if (cfg->dnstap_identity == NULL || cfg->dnstap_identity[0] == 0) { 169 if (gethostname(buf, MAXHOSTNAMELEN) == 0) { 170 buf[MAXHOSTNAMELEN] = 0; 171 env->identity = strdup(buf); 172 } else { 173 fatal_exit("dt_apply_identity: gethostname() failed"); 174 } 175 } else { 176 env->identity = strdup(cfg->dnstap_identity); 177 } 178 if (env->identity == NULL) 179 fatal_exit("dt_apply_identity: strdup() failed"); 180 env->len_identity = (unsigned int)strlen(env->identity); 181 verbose(VERB_OPS, "dnstap identity field set to \"%s\"", 182 env->identity); 183 } 184 185 static void 186 dt_apply_version(struct dt_env *env, struct config_file *cfg) 187 { 188 if (!cfg->dnstap_send_version) 189 return; 190 free(env->version); 191 if (cfg->dnstap_version == NULL || cfg->dnstap_version[0] == 0) 192 env->version = strdup(PACKAGE_STRING); 193 else 194 env->version = strdup(cfg->dnstap_version); 195 if (env->version == NULL) 196 fatal_exit("dt_apply_version: strdup() failed"); 197 env->len_version = (unsigned int)strlen(env->version); 198 verbose(VERB_OPS, "dnstap version field set to \"%s\"", 199 env->version); 200 } 201 202 void 203 dt_apply_cfg(struct dt_env *env, struct config_file *cfg) 204 { 205 if (!cfg->dnstap) 206 return; 207 208 dt_apply_identity(env, cfg); 209 dt_apply_version(env, cfg); 210 if ((env->log_resolver_query_messages = (unsigned int) 211 cfg->dnstap_log_resolver_query_messages)) 212 { 213 verbose(VERB_OPS, "dnstap Message/RESOLVER_QUERY enabled"); 214 } 215 if ((env->log_resolver_response_messages = (unsigned int) 216 cfg->dnstap_log_resolver_response_messages)) 217 { 218 verbose(VERB_OPS, "dnstap Message/RESOLVER_RESPONSE enabled"); 219 } 220 if ((env->log_client_query_messages = (unsigned int) 221 cfg->dnstap_log_client_query_messages)) 222 { 223 verbose(VERB_OPS, "dnstap Message/CLIENT_QUERY enabled"); 224 } 225 if ((env->log_client_response_messages = (unsigned int) 226 cfg->dnstap_log_client_response_messages)) 227 { 228 verbose(VERB_OPS, "dnstap Message/CLIENT_RESPONSE enabled"); 229 } 230 if ((env->log_forwarder_query_messages = (unsigned int) 231 cfg->dnstap_log_forwarder_query_messages)) 232 { 233 verbose(VERB_OPS, "dnstap Message/FORWARDER_QUERY enabled"); 234 } 235 if ((env->log_forwarder_response_messages = (unsigned int) 236 cfg->dnstap_log_forwarder_response_messages)) 237 { 238 verbose(VERB_OPS, "dnstap Message/FORWARDER_RESPONSE enabled"); 239 } 240 } 241 242 int 243 dt_init(struct dt_env *env) 244 { 245 env->msgqueue = dt_msg_queue_create(); 246 if(!env->msgqueue) { 247 log_err("malloc failure"); 248 return 0; 249 } 250 if(!dt_io_thread_register_queue(env->dtio, env->msgqueue)) { 251 log_err("malloc failure"); 252 dt_msg_queue_delete(env->msgqueue); 253 env->msgqueue = NULL; 254 return 0; 255 } 256 return 1; 257 } 258 259 void 260 dt_deinit(struct dt_env* env) 261 { 262 dt_io_thread_unregister_queue(env->dtio, env->msgqueue); 263 dt_msg_queue_delete(env->msgqueue); 264 } 265 266 void 267 dt_delete(struct dt_env *env) 268 { 269 if (!env) 270 return; 271 dt_io_thread_delete(env->dtio); 272 free(env->identity); 273 free(env->version); 274 free(env); 275 } 276 277 static void 278 dt_fill_timeval(const struct timeval *tv, 279 uint64_t *time_sec, protobuf_c_boolean *has_time_sec, 280 uint32_t *time_nsec, protobuf_c_boolean *has_time_nsec) 281 { 282 #ifndef S_SPLINT_S 283 *time_sec = tv->tv_sec; 284 *time_nsec = tv->tv_usec * 1000; 285 #endif 286 *has_time_sec = 1; 287 *has_time_nsec = 1; 288 } 289 290 static void 291 dt_fill_buffer(sldns_buffer *b, ProtobufCBinaryData *p, protobuf_c_boolean *has) 292 { 293 log_assert(b != NULL); 294 p->len = sldns_buffer_limit(b); 295 p->data = sldns_buffer_begin(b); 296 *has = 1; 297 } 298 299 static void 300 dt_msg_fill_net(struct dt_msg *dm, 301 struct sockaddr_storage *ss, 302 enum comm_point_type cptype, 303 ProtobufCBinaryData *addr, protobuf_c_boolean *has_addr, 304 uint32_t *port, protobuf_c_boolean *has_port) 305 { 306 log_assert(ss->ss_family == AF_INET6 || ss->ss_family == AF_INET); 307 if (ss->ss_family == AF_INET6) { 308 struct sockaddr_in6 *s = (struct sockaddr_in6 *) ss; 309 310 /* socket_family */ 311 dm->m.socket_family = DNSTAP__SOCKET_FAMILY__INET6; 312 dm->m.has_socket_family = 1; 313 314 /* addr: query_address or response_address */ 315 addr->data = s->sin6_addr.s6_addr; 316 addr->len = 16; /* IPv6 */ 317 *has_addr = 1; 318 319 /* port: query_port or response_port */ 320 *port = ntohs(s->sin6_port); 321 *has_port = 1; 322 } else if (ss->ss_family == AF_INET) { 323 struct sockaddr_in *s = (struct sockaddr_in *) ss; 324 325 /* socket_family */ 326 dm->m.socket_family = DNSTAP__SOCKET_FAMILY__INET; 327 dm->m.has_socket_family = 1; 328 329 /* addr: query_address or response_address */ 330 addr->data = (uint8_t *) &s->sin_addr.s_addr; 331 addr->len = 4; /* IPv4 */ 332 *has_addr = 1; 333 334 /* port: query_port or response_port */ 335 *port = ntohs(s->sin_port); 336 *has_port = 1; 337 } 338 339 log_assert(cptype == comm_udp || cptype == comm_tcp); 340 if (cptype == comm_udp) { 341 /* socket_protocol */ 342 dm->m.socket_protocol = DNSTAP__SOCKET_PROTOCOL__UDP; 343 dm->m.has_socket_protocol = 1; 344 } else if (cptype == comm_tcp) { 345 /* socket_protocol */ 346 dm->m.socket_protocol = DNSTAP__SOCKET_PROTOCOL__TCP; 347 dm->m.has_socket_protocol = 1; 348 } 349 } 350 351 void 352 dt_msg_send_client_query(struct dt_env *env, 353 struct sockaddr_storage *qsock, 354 enum comm_point_type cptype, 355 sldns_buffer *qmsg) 356 { 357 struct dt_msg dm; 358 struct timeval qtime; 359 360 gettimeofday(&qtime, NULL); 361 362 /* type */ 363 dt_msg_init(env, &dm, DNSTAP__MESSAGE__TYPE__CLIENT_QUERY); 364 365 /* query_time */ 366 dt_fill_timeval(&qtime, 367 &dm.m.query_time_sec, &dm.m.has_query_time_sec, 368 &dm.m.query_time_nsec, &dm.m.has_query_time_nsec); 369 370 /* query_message */ 371 dt_fill_buffer(qmsg, &dm.m.query_message, &dm.m.has_query_message); 372 373 /* socket_family, socket_protocol, query_address, query_port */ 374 log_assert(cptype == comm_udp || cptype == comm_tcp); 375 dt_msg_fill_net(&dm, qsock, cptype, 376 &dm.m.query_address, &dm.m.has_query_address, 377 &dm.m.query_port, &dm.m.has_query_port); 378 379 if (dt_pack(&dm.d, &dm.buf, &dm.len_buf)) 380 dt_send(env, dm.buf, dm.len_buf); 381 } 382 383 void 384 dt_msg_send_client_response(struct dt_env *env, 385 struct sockaddr_storage *qsock, 386 enum comm_point_type cptype, 387 sldns_buffer *rmsg) 388 { 389 struct dt_msg dm; 390 struct timeval rtime; 391 392 gettimeofday(&rtime, NULL); 393 394 /* type */ 395 dt_msg_init(env, &dm, DNSTAP__MESSAGE__TYPE__CLIENT_RESPONSE); 396 397 /* response_time */ 398 dt_fill_timeval(&rtime, 399 &dm.m.response_time_sec, &dm.m.has_response_time_sec, 400 &dm.m.response_time_nsec, &dm.m.has_response_time_nsec); 401 402 /* response_message */ 403 dt_fill_buffer(rmsg, &dm.m.response_message, &dm.m.has_response_message); 404 405 /* socket_family, socket_protocol, query_address, query_port */ 406 log_assert(cptype == comm_udp || cptype == comm_tcp); 407 dt_msg_fill_net(&dm, qsock, cptype, 408 &dm.m.query_address, &dm.m.has_query_address, 409 &dm.m.query_port, &dm.m.has_query_port); 410 411 if (dt_pack(&dm.d, &dm.buf, &dm.len_buf)) 412 dt_send(env, dm.buf, dm.len_buf); 413 } 414 415 void 416 dt_msg_send_outside_query(struct dt_env *env, 417 struct sockaddr_storage *rsock, 418 enum comm_point_type cptype, 419 uint8_t *zone, size_t zone_len, 420 sldns_buffer *qmsg) 421 { 422 struct dt_msg dm; 423 struct timeval qtime; 424 uint16_t qflags; 425 426 gettimeofday(&qtime, NULL); 427 qflags = sldns_buffer_read_u16_at(qmsg, 2); 428 429 /* type */ 430 if (qflags & BIT_RD) { 431 if (!env->log_forwarder_query_messages) 432 return; 433 dt_msg_init(env, &dm, DNSTAP__MESSAGE__TYPE__FORWARDER_QUERY); 434 } else { 435 if (!env->log_resolver_query_messages) 436 return; 437 dt_msg_init(env, &dm, DNSTAP__MESSAGE__TYPE__RESOLVER_QUERY); 438 } 439 440 /* query_zone */ 441 dm.m.query_zone.data = zone; 442 dm.m.query_zone.len = zone_len; 443 dm.m.has_query_zone = 1; 444 445 /* query_time_sec, query_time_nsec */ 446 dt_fill_timeval(&qtime, 447 &dm.m.query_time_sec, &dm.m.has_query_time_sec, 448 &dm.m.query_time_nsec, &dm.m.has_query_time_nsec); 449 450 /* query_message */ 451 dt_fill_buffer(qmsg, &dm.m.query_message, &dm.m.has_query_message); 452 453 /* socket_family, socket_protocol, response_address, response_port */ 454 log_assert(cptype == comm_udp || cptype == comm_tcp); 455 dt_msg_fill_net(&dm, rsock, cptype, 456 &dm.m.response_address, &dm.m.has_response_address, 457 &dm.m.response_port, &dm.m.has_response_port); 458 459 if (dt_pack(&dm.d, &dm.buf, &dm.len_buf)) 460 dt_send(env, dm.buf, dm.len_buf); 461 } 462 463 void 464 dt_msg_send_outside_response(struct dt_env *env, 465 struct sockaddr_storage *rsock, 466 enum comm_point_type cptype, 467 uint8_t *zone, size_t zone_len, 468 uint8_t *qbuf, size_t qbuf_len, 469 const struct timeval *qtime, 470 const struct timeval *rtime, 471 sldns_buffer *rmsg) 472 { 473 struct dt_msg dm; 474 uint16_t qflags; 475 476 log_assert(qbuf_len >= sizeof(qflags)); 477 memcpy(&qflags, qbuf, sizeof(qflags)); 478 qflags = ntohs(qflags); 479 480 /* type */ 481 if (qflags & BIT_RD) { 482 if (!env->log_forwarder_response_messages) 483 return; 484 dt_msg_init(env, &dm, DNSTAP__MESSAGE__TYPE__FORWARDER_RESPONSE); 485 } else { 486 if (!env->log_resolver_response_messages) 487 return; 488 dt_msg_init(env, &dm, DNSTAP__MESSAGE__TYPE__RESOLVER_RESPONSE); 489 } 490 491 /* query_zone */ 492 dm.m.query_zone.data = zone; 493 dm.m.query_zone.len = zone_len; 494 dm.m.has_query_zone = 1; 495 496 /* query_time_sec, query_time_nsec */ 497 dt_fill_timeval(qtime, 498 &dm.m.query_time_sec, &dm.m.has_query_time_sec, 499 &dm.m.query_time_nsec, &dm.m.has_query_time_nsec); 500 501 /* response_time_sec, response_time_nsec */ 502 dt_fill_timeval(rtime, 503 &dm.m.response_time_sec, &dm.m.has_response_time_sec, 504 &dm.m.response_time_nsec, &dm.m.has_response_time_nsec); 505 506 /* response_message */ 507 dt_fill_buffer(rmsg, &dm.m.response_message, &dm.m.has_response_message); 508 509 /* socket_family, socket_protocol, response_address, response_port */ 510 log_assert(cptype == comm_udp || cptype == comm_tcp); 511 dt_msg_fill_net(&dm, rsock, cptype, 512 &dm.m.response_address, &dm.m.has_response_address, 513 &dm.m.response_port, &dm.m.has_response_port); 514 515 if (dt_pack(&dm.d, &dm.buf, &dm.len_buf)) 516 dt_send(env, dm.buf, dm.len_buf); 517 } 518 519 #endif /* USE_DNSTAP */ 520