1 /* dnstap support for Unbound */
4 * Copyright (c) 2013-2014, Farsight Security, Inc.
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
11 * 1. Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
14 * 2. Redistributions in binary form must reproduce the above copyright
15 * notice, this list of conditions and the following disclaimer in the
16 * documentation and/or other materials provided with the distribution.
18 * 3. Neither the name of the copyright holder nor the names of its
19 * contributors may be used to endorse or promote products derived from
20 * this software without specific prior written permission.
22 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
23 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
24 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
25 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR
26 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
27 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
28 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
29 * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
30 * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
31 * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
32 * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
35 #include "dnstap/dnstap_config.h"
42 #ifdef HAVE_SYS_STAT_H
46 #include "sldns/sbuffer.h"
47 #include "util/config_file.h"
48 #include "util/net_help.h"
49 #include "util/netevent.h"
52 #include <protobuf-c/protobuf-c.h>
54 #include "dnstap/dnstap.h"
55 #include "dnstap/dtstream.h"
56 #include "dnstap/dnstap.pb-c.h"
58 #define DNSTAP_INITIAL_BUF_SIZE 256
68 dt_pack(const Dnstap__Dnstap *d, void **buf, size_t *sz)
70 ProtobufCBufferSimple sbuf;
72 memset(&sbuf, 0, sizeof(sbuf));
73 sbuf.base.append = protobuf_c_buffer_simple_append;
75 sbuf.alloced = DNSTAP_INITIAL_BUF_SIZE;
76 sbuf.data = malloc(sbuf.alloced);
77 if (sbuf.data == NULL)
79 sbuf.must_free_data = 1;
81 *sz = dnstap__dnstap__pack_to_buffer(d, (ProtobufCBuffer *) &sbuf);
82 if (sbuf.data == NULL)
90 dt_send(const struct dt_env *env, void *buf, size_t len_buf)
92 dt_msg_queue_submit(env->msgqueue, buf, len_buf);
96 dt_msg_init(const struct dt_env *env,
98 Dnstap__Message__Type mtype)
100 memset(dm, 0, sizeof(*dm));
101 dm->d.base.descriptor = &dnstap__dnstap__descriptor;
102 dm->m.base.descriptor = &dnstap__message__descriptor;
103 dm->d.type = DNSTAP__DNSTAP__TYPE__MESSAGE;
104 dm->d.message = &dm->m;
106 if (env->identity != NULL) {
107 dm->d.identity.data = (uint8_t *) env->identity;
108 dm->d.identity.len = (size_t) env->len_identity;
109 dm->d.has_identity = 1;
111 if (env->version != NULL) {
112 dm->d.version.data = (uint8_t *) env->version;
113 dm->d.version.len = (size_t) env->len_version;
114 dm->d.has_version = 1;
118 /* check that the socket file can be opened and exists, print error if not */
120 check_socket_file(const char* socket_path)
123 memset(&statbuf, 0, sizeof(statbuf));
124 if(stat(socket_path, &statbuf) < 0) {
125 log_warn("could not open dnstap-socket-path: %s, %s",
126 socket_path, strerror(errno));
131 dt_create(struct config_file* cfg)
135 if(cfg->dnstap && cfg->dnstap_socket_path && cfg->dnstap_socket_path[0] &&
136 (cfg->dnstap_ip==NULL || cfg->dnstap_ip[0]==0)) {
137 char* p = cfg->dnstap_socket_path;
138 if(cfg->chrootdir && cfg->chrootdir[0] && strncmp(p,
139 cfg->chrootdir, strlen(cfg->chrootdir)) == 0)
140 p += strlen(cfg->chrootdir);
141 verbose(VERB_OPS, "attempting to connect to dnstap socket %s",
143 check_socket_file(p);
146 env = (struct dt_env *) calloc(1, sizeof(struct dt_env));
150 env->dtio = dt_io_thread_create();
152 log_err("malloc failure");
156 if(!dt_io_thread_apply_cfg(env->dtio, cfg)) {
157 dt_io_thread_delete(env->dtio);
161 dt_apply_cfg(env, cfg);
166 dt_apply_identity(struct dt_env *env, struct config_file *cfg)
168 char buf[MAXHOSTNAMELEN+1];
169 if (!cfg->dnstap_send_identity)
172 if (cfg->dnstap_identity == NULL || cfg->dnstap_identity[0] == 0) {
173 if (gethostname(buf, MAXHOSTNAMELEN) == 0) {
174 buf[MAXHOSTNAMELEN] = 0;
175 env->identity = strdup(buf);
177 fatal_exit("dt_apply_identity: gethostname() failed");
180 env->identity = strdup(cfg->dnstap_identity);
182 if (env->identity == NULL)
183 fatal_exit("dt_apply_identity: strdup() failed");
184 env->len_identity = (unsigned int)strlen(env->identity);
185 verbose(VERB_OPS, "dnstap identity field set to \"%s\"",
190 dt_apply_version(struct dt_env *env, struct config_file *cfg)
192 if (!cfg->dnstap_send_version)
195 if (cfg->dnstap_version == NULL || cfg->dnstap_version[0] == 0)
196 env->version = strdup(PACKAGE_STRING);
198 env->version = strdup(cfg->dnstap_version);
199 if (env->version == NULL)
200 fatal_exit("dt_apply_version: strdup() failed");
201 env->len_version = (unsigned int)strlen(env->version);
202 verbose(VERB_OPS, "dnstap version field set to \"%s\"",
207 dt_apply_cfg(struct dt_env *env, struct config_file *cfg)
212 dt_apply_identity(env, cfg);
213 dt_apply_version(env, cfg);
214 if ((env->log_resolver_query_messages = (unsigned int)
215 cfg->dnstap_log_resolver_query_messages))
217 verbose(VERB_OPS, "dnstap Message/RESOLVER_QUERY enabled");
219 if ((env->log_resolver_response_messages = (unsigned int)
220 cfg->dnstap_log_resolver_response_messages))
222 verbose(VERB_OPS, "dnstap Message/RESOLVER_RESPONSE enabled");
224 if ((env->log_client_query_messages = (unsigned int)
225 cfg->dnstap_log_client_query_messages))
227 verbose(VERB_OPS, "dnstap Message/CLIENT_QUERY enabled");
229 if ((env->log_client_response_messages = (unsigned int)
230 cfg->dnstap_log_client_response_messages))
232 verbose(VERB_OPS, "dnstap Message/CLIENT_RESPONSE enabled");
234 if ((env->log_forwarder_query_messages = (unsigned int)
235 cfg->dnstap_log_forwarder_query_messages))
237 verbose(VERB_OPS, "dnstap Message/FORWARDER_QUERY enabled");
239 if ((env->log_forwarder_response_messages = (unsigned int)
240 cfg->dnstap_log_forwarder_response_messages))
242 verbose(VERB_OPS, "dnstap Message/FORWARDER_RESPONSE enabled");
247 dt_init(struct dt_env *env, struct comm_base* base)
249 env->msgqueue = dt_msg_queue_create(base);
251 log_err("malloc failure");
254 if(!dt_io_thread_register_queue(env->dtio, env->msgqueue)) {
255 log_err("malloc failure");
256 dt_msg_queue_delete(env->msgqueue);
257 env->msgqueue = NULL;
264 dt_deinit(struct dt_env* env)
266 dt_io_thread_unregister_queue(env->dtio, env->msgqueue);
267 dt_msg_queue_delete(env->msgqueue);
271 dt_delete(struct dt_env *env)
275 dt_io_thread_delete(env->dtio);
282 dt_fill_timeval(const struct timeval *tv,
283 uint64_t *time_sec, protobuf_c_boolean *has_time_sec,
284 uint32_t *time_nsec, protobuf_c_boolean *has_time_nsec)
287 *time_sec = tv->tv_sec;
288 *time_nsec = tv->tv_usec * 1000;
295 dt_fill_buffer(sldns_buffer *b, ProtobufCBinaryData *p, protobuf_c_boolean *has)
297 log_assert(b != NULL);
298 p->len = sldns_buffer_limit(b);
299 p->data = sldns_buffer_begin(b);
304 dt_msg_fill_net(struct dt_msg *dm,
305 struct sockaddr_storage *ss,
306 enum comm_point_type cptype,
307 ProtobufCBinaryData *addr, protobuf_c_boolean *has_addr,
308 uint32_t *port, protobuf_c_boolean *has_port)
310 log_assert(ss->ss_family == AF_INET6 || ss->ss_family == AF_INET);
311 if (ss->ss_family == AF_INET6) {
312 struct sockaddr_in6 *s = (struct sockaddr_in6 *) ss;
315 dm->m.socket_family = DNSTAP__SOCKET_FAMILY__INET6;
316 dm->m.has_socket_family = 1;
318 /* addr: query_address or response_address */
319 addr->data = s->sin6_addr.s6_addr;
320 addr->len = 16; /* IPv6 */
323 /* port: query_port or response_port */
324 *port = ntohs(s->sin6_port);
326 } else if (ss->ss_family == AF_INET) {
327 struct sockaddr_in *s = (struct sockaddr_in *) ss;
330 dm->m.socket_family = DNSTAP__SOCKET_FAMILY__INET;
331 dm->m.has_socket_family = 1;
333 /* addr: query_address or response_address */
334 addr->data = (uint8_t *) &s->sin_addr.s_addr;
335 addr->len = 4; /* IPv4 */
338 /* port: query_port or response_port */
339 *port = ntohs(s->sin_port);
343 log_assert(cptype == comm_udp || cptype == comm_tcp);
344 if (cptype == comm_udp) {
345 /* socket_protocol */
346 dm->m.socket_protocol = DNSTAP__SOCKET_PROTOCOL__UDP;
347 dm->m.has_socket_protocol = 1;
348 } else if (cptype == comm_tcp) {
349 /* socket_protocol */
350 dm->m.socket_protocol = DNSTAP__SOCKET_PROTOCOL__TCP;
351 dm->m.has_socket_protocol = 1;
356 dt_msg_send_client_query(struct dt_env *env,
357 struct sockaddr_storage *qsock,
358 enum comm_point_type cptype,
362 struct timeval qtime;
364 gettimeofday(&qtime, NULL);
367 dt_msg_init(env, &dm, DNSTAP__MESSAGE__TYPE__CLIENT_QUERY);
370 dt_fill_timeval(&qtime,
371 &dm.m.query_time_sec, &dm.m.has_query_time_sec,
372 &dm.m.query_time_nsec, &dm.m.has_query_time_nsec);
375 dt_fill_buffer(qmsg, &dm.m.query_message, &dm.m.has_query_message);
377 /* socket_family, socket_protocol, query_address, query_port */
378 log_assert(cptype == comm_udp || cptype == comm_tcp);
379 dt_msg_fill_net(&dm, qsock, cptype,
380 &dm.m.query_address, &dm.m.has_query_address,
381 &dm.m.query_port, &dm.m.has_query_port);
383 if (dt_pack(&dm.d, &dm.buf, &dm.len_buf))
384 dt_send(env, dm.buf, dm.len_buf);
388 dt_msg_send_client_response(struct dt_env *env,
389 struct sockaddr_storage *qsock,
390 enum comm_point_type cptype,
394 struct timeval rtime;
396 gettimeofday(&rtime, NULL);
399 dt_msg_init(env, &dm, DNSTAP__MESSAGE__TYPE__CLIENT_RESPONSE);
402 dt_fill_timeval(&rtime,
403 &dm.m.response_time_sec, &dm.m.has_response_time_sec,
404 &dm.m.response_time_nsec, &dm.m.has_response_time_nsec);
406 /* response_message */
407 dt_fill_buffer(rmsg, &dm.m.response_message, &dm.m.has_response_message);
409 /* socket_family, socket_protocol, query_address, query_port */
410 log_assert(cptype == comm_udp || cptype == comm_tcp);
411 dt_msg_fill_net(&dm, qsock, cptype,
412 &dm.m.query_address, &dm.m.has_query_address,
413 &dm.m.query_port, &dm.m.has_query_port);
415 if (dt_pack(&dm.d, &dm.buf, &dm.len_buf))
416 dt_send(env, dm.buf, dm.len_buf);
420 dt_msg_send_outside_query(struct dt_env *env,
421 struct sockaddr_storage *rsock,
422 enum comm_point_type cptype,
423 uint8_t *zone, size_t zone_len,
427 struct timeval qtime;
430 gettimeofday(&qtime, NULL);
431 qflags = sldns_buffer_read_u16_at(qmsg, 2);
434 if (qflags & BIT_RD) {
435 if (!env->log_forwarder_query_messages)
437 dt_msg_init(env, &dm, DNSTAP__MESSAGE__TYPE__FORWARDER_QUERY);
439 if (!env->log_resolver_query_messages)
441 dt_msg_init(env, &dm, DNSTAP__MESSAGE__TYPE__RESOLVER_QUERY);
445 dm.m.query_zone.data = zone;
446 dm.m.query_zone.len = zone_len;
447 dm.m.has_query_zone = 1;
449 /* query_time_sec, query_time_nsec */
450 dt_fill_timeval(&qtime,
451 &dm.m.query_time_sec, &dm.m.has_query_time_sec,
452 &dm.m.query_time_nsec, &dm.m.has_query_time_nsec);
455 dt_fill_buffer(qmsg, &dm.m.query_message, &dm.m.has_query_message);
457 /* socket_family, socket_protocol, response_address, response_port */
458 log_assert(cptype == comm_udp || cptype == comm_tcp);
459 dt_msg_fill_net(&dm, rsock, cptype,
460 &dm.m.response_address, &dm.m.has_response_address,
461 &dm.m.response_port, &dm.m.has_response_port);
463 if (dt_pack(&dm.d, &dm.buf, &dm.len_buf))
464 dt_send(env, dm.buf, dm.len_buf);
468 dt_msg_send_outside_response(struct dt_env *env,
469 struct sockaddr_storage *rsock,
470 enum comm_point_type cptype,
471 uint8_t *zone, size_t zone_len,
472 uint8_t *qbuf, size_t qbuf_len,
473 const struct timeval *qtime,
474 const struct timeval *rtime,
480 log_assert(qbuf_len >= sizeof(qflags));
481 memcpy(&qflags, qbuf, sizeof(qflags));
482 qflags = ntohs(qflags);
485 if (qflags & BIT_RD) {
486 if (!env->log_forwarder_response_messages)
488 dt_msg_init(env, &dm, DNSTAP__MESSAGE__TYPE__FORWARDER_RESPONSE);
490 if (!env->log_resolver_response_messages)
492 dt_msg_init(env, &dm, DNSTAP__MESSAGE__TYPE__RESOLVER_RESPONSE);
496 dm.m.query_zone.data = zone;
497 dm.m.query_zone.len = zone_len;
498 dm.m.has_query_zone = 1;
500 /* query_time_sec, query_time_nsec */
501 dt_fill_timeval(qtime,
502 &dm.m.query_time_sec, &dm.m.has_query_time_sec,
503 &dm.m.query_time_nsec, &dm.m.has_query_time_nsec);
505 /* response_time_sec, response_time_nsec */
506 dt_fill_timeval(rtime,
507 &dm.m.response_time_sec, &dm.m.has_response_time_sec,
508 &dm.m.response_time_nsec, &dm.m.has_response_time_nsec);
510 /* response_message */
511 dt_fill_buffer(rmsg, &dm.m.response_message, &dm.m.has_response_message);
513 /* socket_family, socket_protocol, response_address, response_port */
514 log_assert(cptype == comm_udp || cptype == comm_tcp);
515 dt_msg_fill_net(&dm, rsock, cptype,
516 &dm.m.response_address, &dm.m.has_response_address,
517 &dm.m.response_port, &dm.m.has_response_port);
519 if (dt_pack(&dm.d, &dm.buf, &dm.len_buf))
520 dt_send(env, dm.buf, dm.len_buf);
523 #endif /* USE_DNSTAP */