contrib/unbound/dnstap/dnstap.c

   1 /* dnstap support for Unbound */
   2
   3 /*
   4  * Copyright (c) 2013-2014, Farsight Security, Inc.
   5  * All rights reserved.
   6  *
   7  * Redistribution and use in source and binary forms, with or without
   8  * modification, are permitted provided that the following conditions
   9  * are met:
  10  *
  11  * 1. Redistributions of source code must retain the above copyright
  12  * notice, this list of conditions and the following disclaimer.
  13  *
  14  * 2. Redistributions in binary form must reproduce the above copyright
  15  * notice, this list of conditions and the following disclaimer in the
  16  * documentation and/or other materials provided with the distribution.
  17  *
  18  * 3. Neither the name of the copyright holder nor the names of its
  19  * contributors may be used to endorse or promote products derived from
  20  * this software without specific prior written permission.
  21  *
  22  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  23  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
  24  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  25  * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR
  26  * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
  27  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
  28  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
  29  * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
  30  * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
  31  * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
  32  * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  33  */
  34
  35 #include "dnstap/dnstap_config.h"
  36
  37 #ifdef USE_DNSTAP
  38
  39 #include "config.h"
  40 #include <string.h>
  41 #include <sys/time.h>
  42 #ifdef HAVE_SYS_STAT_H
  43 #include <sys/stat.h>
  44 #endif
  45 #include <errno.h>
  46 #include "sldns/sbuffer.h"
  47 #include "util/config_file.h"
  48 #include "util/net_help.h"
  49 #include "util/netevent.h"
  50 #include "util/log.h"
  51
  52 #include <fstrm.h>
  53 #include <protobuf-c/protobuf-c.h>
  54
  55 #include "dnstap/dnstap.h"
  56 #include "dnstap/dnstap.pb-c.h"
  57
  58 #define DNSTAP_CONTENT_TYPE             "protobuf:dnstap.Dnstap"
  59 #define DNSTAP_INITIAL_BUF_SIZE         256
  60
  61 struct dt_msg {
  62         void            *buf;
  63         size_t          len_buf;
  64         Dnstap__Dnstap  d;
  65         Dnstap__Message m;
  66 };
  67
  68 static int
  69 dt_pack(const Dnstap__Dnstap *d, void **buf, size_t *sz)
  70 {
  71         ProtobufCBufferSimple sbuf;
  72
  73         memset(&sbuf, 0, sizeof(sbuf));
  74         sbuf.base.append = protobuf_c_buffer_simple_append;
  75         sbuf.len = 0;
  76         sbuf.alloced = DNSTAP_INITIAL_BUF_SIZE;
  77         sbuf.data = malloc(sbuf.alloced);
  78         if (sbuf.data == NULL)
  79                 return 0;
  80         sbuf.must_free_data = 1;
  81
  82         *sz = dnstap__dnstap__pack_to_buffer(d, (ProtobufCBuffer *) &sbuf);
  83         if (sbuf.data == NULL)
  84                 return 0;
  85         *buf = sbuf.data;
  86
  87         return 1;
  88 }
  89
  90 static void
  91 dt_send(const struct dt_env *env, void *buf, size_t len_buf)
  92 {
  93         fstrm_res res;
  94         if (!buf)
  95                 return;
  96         res = fstrm_iothr_submit(env->iothr, env->ioq, buf, len_buf,
  97                                  fstrm_free_wrapper, NULL);
  98         if (res != fstrm_res_success)
  99                 free(buf);
 100 }
 101
 102 static void
 103 dt_msg_init(const struct dt_env *env,
 104             struct dt_msg *dm,
 105             Dnstap__Message__Type mtype)
 106 {
 107         memset(dm, 0, sizeof(*dm));
 108         dm->d.base.descriptor = &dnstap__dnstap__descriptor;
 109         dm->m.base.descriptor = &dnstap__message__descriptor;
 110         dm->d.type = DNSTAP__DNSTAP__TYPE__MESSAGE;
 111         dm->d.message = &dm->m;
 112         dm->m.type = mtype;
 113         if (env->identity != NULL) {
 114                 dm->d.identity.data = (uint8_t *) env->identity;
 115                 dm->d.identity.len = (size_t) env->len_identity;
 116                 dm->d.has_identity = 1;
 117         }
 118         if (env->version != NULL) {
 119                 dm->d.version.data = (uint8_t *) env->version;
 120                 dm->d.version.len = (size_t) env->len_version;
 121                 dm->d.has_version = 1;
 122         }
 123 }
 124
 125 /* check that the socket file can be opened and exists, print error if not */
 126 static void
 127 check_socket_file(const char* socket_path)
 128 {
 129         struct stat statbuf;
 130         memset(&statbuf, 0, sizeof(statbuf));
 131         if(stat(socket_path, &statbuf) < 0) {
 132                 log_warn("could not open dnstap-socket-path: %s, %s",
 133                         socket_path, strerror(errno));
 134         }
 135 }
 136
 137 struct dt_env *
 138 dt_create(const char *socket_path, unsigned num_workers)
 139 {
 140 #ifdef UNBOUND_DEBUG
 141         fstrm_res res;
 142 #endif
 143         struct dt_env *env;
 144         struct fstrm_iothr_options *fopt;
 145         struct fstrm_unix_writer_options *fuwopt;
 146         struct fstrm_writer *fw;
 147         struct fstrm_writer_options *fwopt;
 148
 149         verbose(VERB_OPS, "attempting to connect to dnstap socket %s",
 150                 socket_path);
 151         log_assert(socket_path != NULL);
 152         log_assert(num_workers > 0);
 153         check_socket_file(socket_path);
 154
 155         env = (struct dt_env *) calloc(1, sizeof(struct dt_env));
 156         if (!env)
 157                 return NULL;
 158
 159         fwopt = fstrm_writer_options_init();
 160 #ifdef UNBOUND_DEBUG
 161         res =
 162 #else
 163         (void)
 164 #endif
 165             fstrm_writer_options_add_content_type(fwopt,
 166                 DNSTAP_CONTENT_TYPE, sizeof(DNSTAP_CONTENT_TYPE) - 1);
 167         log_assert(res == fstrm_res_success);
 168
 169         fuwopt = fstrm_unix_writer_options_init();
 170         fstrm_unix_writer_options_set_socket_path(fuwopt, socket_path);
 171
 172         fw = fstrm_unix_writer_init(fuwopt, fwopt);
 173         log_assert(fw != NULL);
 174
 175         fopt = fstrm_iothr_options_init();
 176         fstrm_iothr_options_set_num_input_queues(fopt, num_workers);
 177         env->iothr = fstrm_iothr_init(fopt, &fw);
 178         if (env->iothr == NULL) {
 179                 verbose(VERB_DETAIL, "dt_create: fstrm_iothr_init() failed");
 180                 fstrm_writer_destroy(&fw);
 181                 free(env);
 182                 env = NULL;
 183         }
 184         fstrm_iothr_options_destroy(&fopt);
 185         fstrm_unix_writer_options_destroy(&fuwopt);
 186         fstrm_writer_options_destroy(&fwopt);
 187
 188         return env;
 189 }
 190
 191 static void
 192 dt_apply_identity(struct dt_env *env, struct config_file *cfg)
 193 {
 194         char buf[MAXHOSTNAMELEN+1];
 195         if (!cfg->dnstap_send_identity)
 196                 return;
 197         free(env->identity);
 198         if (cfg->dnstap_identity == NULL || cfg->dnstap_identity[0] == 0) {
 199                 if (gethostname(buf, MAXHOSTNAMELEN) == 0) {
 200                         buf[MAXHOSTNAMELEN] = 0;
 201                         env->identity = strdup(buf);
 202                 } else {
 203                         fatal_exit("dt_apply_identity: gethostname() failed");
 204                 }
 205         } else {
 206                 env->identity = strdup(cfg->dnstap_identity);
 207         }
 208         if (env->identity == NULL)
 209                 fatal_exit("dt_apply_identity: strdup() failed");
 210         env->len_identity = (unsigned int)strlen(env->identity);
 211         verbose(VERB_OPS, "dnstap identity field set to \"%s\"",
 212                 env->identity);
 213 }
 214
 215 static void
 216 dt_apply_version(struct dt_env *env, struct config_file *cfg)
 217 {
 218         if (!cfg->dnstap_send_version)
 219                 return;
 220         free(env->version);
 221         if (cfg->dnstap_version == NULL || cfg->dnstap_version[0] == 0)
 222                 env->version = strdup(PACKAGE_STRING);
 223         else
 224                 env->version = strdup(cfg->dnstap_version);
 225         if (env->version == NULL)
 226                 fatal_exit("dt_apply_version: strdup() failed");
 227         env->len_version = (unsigned int)strlen(env->version);
 228         verbose(VERB_OPS, "dnstap version field set to \"%s\"",
 229                 env->version);
 230 }
 231
 232 void
 233 dt_apply_cfg(struct dt_env *env, struct config_file *cfg)
 234 {
 235         if (!cfg->dnstap)
 236                 return;
 237
 238         dt_apply_identity(env, cfg);
 239         dt_apply_version(env, cfg);
 240         if ((env->log_resolver_query_messages = (unsigned int)
 241              cfg->dnstap_log_resolver_query_messages))
 242         {
 243                 verbose(VERB_OPS, "dnstap Message/RESOLVER_QUERY enabled");
 244         }
 245         if ((env->log_resolver_response_messages = (unsigned int)
 246              cfg->dnstap_log_resolver_response_messages))
 247         {
 248                 verbose(VERB_OPS, "dnstap Message/RESOLVER_RESPONSE enabled");
 249         }
 250         if ((env->log_client_query_messages = (unsigned int)
 251              cfg->dnstap_log_client_query_messages))
 252         {
 253                 verbose(VERB_OPS, "dnstap Message/CLIENT_QUERY enabled");
 254         }
 255         if ((env->log_client_response_messages = (unsigned int)
 256              cfg->dnstap_log_client_response_messages))
 257         {
 258                 verbose(VERB_OPS, "dnstap Message/CLIENT_RESPONSE enabled");
 259         }
 260         if ((env->log_forwarder_query_messages = (unsigned int)
 261              cfg->dnstap_log_forwarder_query_messages))
 262         {
 263                 verbose(VERB_OPS, "dnstap Message/FORWARDER_QUERY enabled");
 264         }
 265         if ((env->log_forwarder_response_messages = (unsigned int)
 266              cfg->dnstap_log_forwarder_response_messages))
 267         {
 268                 verbose(VERB_OPS, "dnstap Message/FORWARDER_RESPONSE enabled");
 269         }
 270 }
 271
 272 int
 273 dt_init(struct dt_env *env)
 274 {
 275         env->ioq = fstrm_iothr_get_input_queue(env->iothr);
 276         if (env->ioq == NULL)
 277                 return 0;
 278         return 1;
 279 }
 280
 281 void
 282 dt_delete(struct dt_env *env)
 283 {
 284         if (!env)
 285                 return;
 286         verbose(VERB_OPS, "closing dnstap socket");
 287         fstrm_iothr_destroy(&env->iothr);
 288         free(env->identity);
 289         free(env->version);
 290         free(env);
 291 }
 292
 293 static void
 294 dt_fill_timeval(const struct timeval *tv,
 295                 uint64_t *time_sec, protobuf_c_boolean *has_time_sec,
 296                 uint32_t *time_nsec, protobuf_c_boolean *has_time_nsec)
 297 {
 298 #ifndef S_SPLINT_S
 299         *time_sec = tv->tv_sec;
 300         *time_nsec = tv->tv_usec * 1000;
 301 #endif
 302         *has_time_sec = 1;
 303         *has_time_nsec = 1;
 304 }
 305
 306 static void
 307 dt_fill_buffer(sldns_buffer *b, ProtobufCBinaryData *p, protobuf_c_boolean *has)
 308 {
 309         log_assert(b != NULL);
 310         p->len = sldns_buffer_limit(b);
 311         p->data = sldns_buffer_begin(b);
 312         *has = 1;
 313 }
 314
 315 static void
 316 dt_msg_fill_net(struct dt_msg *dm,
 317                 struct sockaddr_storage *ss,
 318                 enum comm_point_type cptype,
 319                 ProtobufCBinaryData *addr, protobuf_c_boolean *has_addr,
 320                 uint32_t *port, protobuf_c_boolean *has_port)
 321 {
 322         log_assert(ss->ss_family == AF_INET6 || ss->ss_family == AF_INET);
 323         if (ss->ss_family == AF_INET6) {
 324                 struct sockaddr_in6 *s = (struct sockaddr_in6 *) ss;
 325
 326                 /* socket_family */
 327                 dm->m.socket_family = DNSTAP__SOCKET_FAMILY__INET6;
 328                 dm->m.has_socket_family = 1;
 329
 330                 /* addr: query_address or response_address */
 331                 addr->data = s->sin6_addr.s6_addr;
 332                 addr->len = 16; /* IPv6 */
 333                 *has_addr = 1;
 334
 335                 /* port: query_port or response_port */
 336                 *port = ntohs(s->sin6_port);
 337                 *has_port = 1;
 338         } else if (ss->ss_family == AF_INET) {
 339                 struct sockaddr_in *s = (struct sockaddr_in *) ss;
 340
 341                 /* socket_family */
 342                 dm->m.socket_family = DNSTAP__SOCKET_FAMILY__INET;
 343                 dm->m.has_socket_family = 1;
 344
 345                 /* addr: query_address or response_address */
 346                 addr->data = (uint8_t *) &s->sin_addr.s_addr;
 347                 addr->len = 4; /* IPv4 */
 348                 *has_addr = 1;
 349
 350                 /* port: query_port or response_port */
 351                 *port = ntohs(s->sin_port);
 352                 *has_port = 1;
 353         }
 354
 355         log_assert(cptype == comm_udp || cptype == comm_tcp);
 356         if (cptype == comm_udp) {
 357                 /* socket_protocol */
 358                 dm->m.socket_protocol = DNSTAP__SOCKET_PROTOCOL__UDP;
 359                 dm->m.has_socket_protocol = 1;
 360         } else if (cptype == comm_tcp) {
 361                 /* socket_protocol */
 362                 dm->m.socket_protocol = DNSTAP__SOCKET_PROTOCOL__TCP;
 363                 dm->m.has_socket_protocol = 1;
 364         }
 365 }
 366
 367 void
 368 dt_msg_send_client_query(struct dt_env *env,
 369                          struct sockaddr_storage *qsock,
 370                          enum comm_point_type cptype,
 371                          sldns_buffer *qmsg)
 372 {
 373         struct dt_msg dm;
 374         struct timeval qtime;
 375
 376         gettimeofday(&qtime, NULL);
 377
 378         /* type */
 379         dt_msg_init(env, &dm, DNSTAP__MESSAGE__TYPE__CLIENT_QUERY);
 380
 381         /* query_time */
 382         dt_fill_timeval(&qtime,
 383                         &dm.m.query_time_sec, &dm.m.has_query_time_sec,
 384                         &dm.m.query_time_nsec, &dm.m.has_query_time_nsec);
 385
 386         /* query_message */
 387         dt_fill_buffer(qmsg, &dm.m.query_message, &dm.m.has_query_message);
 388
 389         /* socket_family, socket_protocol, query_address, query_port */
 390         log_assert(cptype == comm_udp || cptype == comm_tcp);
 391         dt_msg_fill_net(&dm, qsock, cptype,
 392                         &dm.m.query_address, &dm.m.has_query_address,
 393                         &dm.m.query_port, &dm.m.has_query_port);
 394
 395         if (dt_pack(&dm.d, &dm.buf, &dm.len_buf))
 396                 dt_send(env, dm.buf, dm.len_buf);
 397 }
 398
 399 void
 400 dt_msg_send_client_response(struct dt_env *env,
 401                             struct sockaddr_storage *qsock,
 402                             enum comm_point_type cptype,
 403                             sldns_buffer *rmsg)
 404 {
 405         struct dt_msg dm;
 406         struct timeval rtime;
 407
 408         gettimeofday(&rtime, NULL);
 409
 410         /* type */
 411         dt_msg_init(env, &dm, DNSTAP__MESSAGE__TYPE__CLIENT_RESPONSE);
 412
 413         /* response_time */
 414         dt_fill_timeval(&rtime,
 415                         &dm.m.response_time_sec, &dm.m.has_response_time_sec,
 416                         &dm.m.response_time_nsec, &dm.m.has_response_time_nsec);
 417
 418         /* response_message */
 419         dt_fill_buffer(rmsg, &dm.m.response_message, &dm.m.has_response_message);
 420
 421         /* socket_family, socket_protocol, query_address, query_port */
 422         log_assert(cptype == comm_udp || cptype == comm_tcp);
 423         dt_msg_fill_net(&dm, qsock, cptype,
 424                         &dm.m.query_address, &dm.m.has_query_address,
 425                         &dm.m.query_port, &dm.m.has_query_port);
 426
 427         if (dt_pack(&dm.d, &dm.buf, &dm.len_buf))
 428                 dt_send(env, dm.buf, dm.len_buf);
 429 }
 430
 431 void
 432 dt_msg_send_outside_query(struct dt_env *env,
 433                           struct sockaddr_storage *rsock,
 434                           enum comm_point_type cptype,
 435                           uint8_t *zone, size_t zone_len,
 436                           sldns_buffer *qmsg)
 437 {
 438         struct dt_msg dm;
 439         struct timeval qtime;
 440         uint16_t qflags;
 441
 442         gettimeofday(&qtime, NULL);
 443         qflags = sldns_buffer_read_u16_at(qmsg, 2);
 444
 445         /* type */
 446         if (qflags & BIT_RD) {
 447                 if (!env->log_forwarder_query_messages)
 448                         return;
 449                 dt_msg_init(env, &dm, DNSTAP__MESSAGE__TYPE__FORWARDER_QUERY);
 450         } else {
 451                 if (!env->log_resolver_query_messages)
 452                         return;
 453                 dt_msg_init(env, &dm, DNSTAP__MESSAGE__TYPE__RESOLVER_QUERY);
 454         }
 455
 456         /* query_zone */
 457         dm.m.query_zone.data = zone;
 458         dm.m.query_zone.len = zone_len;
 459         dm.m.has_query_zone = 1;
 460
 461         /* query_time_sec, query_time_nsec */
 462         dt_fill_timeval(&qtime,
 463                         &dm.m.query_time_sec, &dm.m.has_query_time_sec,
 464                         &dm.m.query_time_nsec, &dm.m.has_query_time_nsec);
 465
 466         /* query_message */
 467         dt_fill_buffer(qmsg, &dm.m.query_message, &dm.m.has_query_message);
 468
 469         /* socket_family, socket_protocol, response_address, response_port */
 470         log_assert(cptype == comm_udp || cptype == comm_tcp);
 471         dt_msg_fill_net(&dm, rsock, cptype,
 472                         &dm.m.response_address, &dm.m.has_response_address,
 473                         &dm.m.response_port, &dm.m.has_response_port);
 474
 475         if (dt_pack(&dm.d, &dm.buf, &dm.len_buf))
 476                 dt_send(env, dm.buf, dm.len_buf);
 477 }
 478
 479 void
 480 dt_msg_send_outside_response(struct dt_env *env,
 481                              struct sockaddr_storage *rsock,
 482                              enum comm_point_type cptype,
 483                              uint8_t *zone, size_t zone_len,
 484                              uint8_t *qbuf, size_t qbuf_len,
 485                              const struct timeval *qtime,
 486                              const struct timeval *rtime,
 487                              sldns_buffer *rmsg)
 488 {
 489         struct dt_msg dm;
 490         uint16_t qflags;
 491
 492         log_assert(qbuf_len >= sizeof(qflags));
 493         memcpy(&qflags, qbuf, sizeof(qflags));
 494         qflags = ntohs(qflags);
 495
 496         /* type */
 497         if (qflags & BIT_RD) {
 498                 if (!env->log_forwarder_response_messages)
 499                         return;
 500                 dt_msg_init(env, &dm, DNSTAP__MESSAGE__TYPE__FORWARDER_RESPONSE);
 501         } else {
 502                 if (!env->log_resolver_response_messages)
 503                         return;
 504                 dt_msg_init(env, &dm, DNSTAP__MESSAGE__TYPE__RESOLVER_RESPONSE);
 505         }
 506
 507         /* query_zone */
 508         dm.m.query_zone.data = zone;
 509         dm.m.query_zone.len = zone_len;
 510         dm.m.has_query_zone = 1;
 511
 512         /* query_time_sec, query_time_nsec */
 513         dt_fill_timeval(qtime,
 514                         &dm.m.query_time_sec, &dm.m.has_query_time_sec,
 515                         &dm.m.query_time_nsec, &dm.m.has_query_time_nsec);
 516
 517         /* response_time_sec, response_time_nsec */
 518         dt_fill_timeval(rtime,
 519                         &dm.m.response_time_sec, &dm.m.has_response_time_sec,
 520                         &dm.m.response_time_nsec, &dm.m.has_response_time_nsec);
 521
 522         /* response_message */
 523         dt_fill_buffer(rmsg, &dm.m.response_message, &dm.m.has_response_message);
 524
 525         /* socket_family, socket_protocol, response_address, response_port */
 526         log_assert(cptype == comm_udp || cptype == comm_tcp);
 527         dt_msg_fill_net(&dm, rsock, cptype,
 528                         &dm.m.response_address, &dm.m.has_response_address,
 529                         &dm.m.response_port, &dm.m.has_response_port);
 530
 531         if (dt_pack(&dm.d, &dm.buf, &dm.len_buf))
 532                 dt_send(env, dm.buf, dm.len_buf);
 533 }
 534
 535 #endif /* USE_DNSTAP */