6548113283

Committed 17 Oct 2023 01:44PM UTC coverage: 57.482% (+0.01%) from 57.471%

Build # 6548113283

Build Type

Pull #13372

github

Committed by

web-flow

Commit Message

Merge 7a863d5ed into 8314f12e9

Pull Request Pull Request #13372: dnsdist: Prevent dnsheader alignment issues

Run Details

31193 of 84886 branches covered (0.0%)

Branch coverage included in aggregate %.

318 of 380 new or added lines in 22 files covered. (83.68%)

32 existing lines in 8 files now uncovered.

105348 of 152651 relevant lines covered (69.01%)

3134803.42 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

0.0

/pdns/dnsdistdist/dnsdist-secpoll.cc

/*
 * This file is part of PowerDNS or dnsdist.
 * Copyright -- PowerDNS.COM B.V. and its contributors
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of version 2 of the GNU General Public License as
 * published by the Free Software Foundation.
 *
 * In addition, for the avoidance of any doubt, permission is granted to
 * link this program with OpenSSL and to (re)distribute the binaries
 * produced as the result of such linking.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
 */

#include "dnsdist-secpoll.hh"
#ifndef DISABLE_SECPOLL

#include <vector>

#ifdef HAVE_LIBSODIUM
#include <sodium.h>
#endif /* HAVE_LIBSODIUM */

#include "dnsparser.hh"
#include "dolog.hh"
#include "iputils.hh"
#include "misc.hh"
#include "sstuff.hh"

#include "dnsdist.hh"
#include "dnsdist-metrics.hh"
#include "dnsdist-random.hh"

#ifndef PACKAGEVERSION
#define PACKAGEVERSION PACKAGE_VERSION
#endif

static std::string getFirstTXTAnswer(const std::string& answer)
{
  if (answer.size() <= sizeof(struct dnsheader)) {
    throw std::runtime_error("Looking for a TXT record in an answer smaller than the DNS header");
  }

  const dnsheader_aligned dh(answer.data());
  PacketReader pr(answer);
  uint16_t qdcount = ntohs(dh->qdcount);
  uint16_t ancount = ntohs(dh->ancount);

  DNSName rrname;
  uint16_t rrtype;
  uint16_t rrclass;

  size_t idx = 0;
  /* consume qd */
  for(; idx < qdcount; idx++) {
    rrname = pr.getName();
    rrtype = pr.get16BitInt();
    rrclass = pr.get16BitInt();
    (void) rrtype;
    (void) rrclass;
  }

  /* parse AN */
  for (idx = 0; idx < ancount; idx++) {
    string blob;
    struct dnsrecordheader ah;
    rrname = pr.getName();
    pr.getDnsrecordheader(ah);

    if (ah.d_type == QType::TXT) {
      string txt;
      pr.xfrText(txt);

      return txt;
    }
    else {
      pr.xfrBlob(blob);
    }
  }

  throw std::runtime_error("No TXT record in answer");
}

static std::string getSecPollStatus(const std::string& queriedName, int timeout=2)
{
  const DNSName sentName(queriedName);
  std::vector<uint8_t> packet;
  DNSPacketWriter pw(packet, sentName, QType::TXT);
  pw.getHeader()->id = dnsdist::getRandomDNSID();
  pw.getHeader()->rd = 1;

  const auto& resolversForStub = getResolvers("/etc/resolv.conf");

  for(const auto& dest : resolversForStub) {
    Socket sock(dest.sin4.sin_family, SOCK_DGRAM);
    sock.setNonBlocking();
    sock.connect(dest);
    sock.send(string(packet.begin(), packet.end()));

    string reply;
    int ret = waitForData(sock.getHandle(), timeout, 0);
    if (ret < 0) {
      if (g_verbose) {
        warnlog("Error while waiting for the secpoll response from stub resolver %s: %d", dest.toString(), ret);
      }
      continue;
    }
    else if (ret == 0) {
      if (g_verbose) {
        warnlog("Timeout while waiting for the secpoll response from stub resolver %s", dest.toString());
      }
      continue;
    }

    try {
      sock.read(reply);
    }
    catch(const std::exception& e) {
      if (g_verbose) {
        warnlog("Error while reading for the secpoll response from stub resolver %s: %s", dest.toString(), e.what());
      }
      continue;
    }

    if (reply.size() <= sizeof(struct dnsheader)) {
      if (g_verbose) {
        warnlog("Too short answer of size %d received from the secpoll stub resolver %s", reply.size(), dest.toString());
      }
      continue;
    }

    struct dnsheader d;
    memcpy(&d, reply.c_str(), sizeof(d));
    if (d.id != pw.getHeader()->id) {
      if (g_verbose) {
        warnlog("Invalid ID (%d / %d) received from the secpoll stub resolver %s", d.id, pw.getHeader()->id, dest.toString());
      }
      continue;
    }

    if (d.rcode != RCode::NoError) {
      if (g_verbose) {
        warnlog("Response code '%s' received from the secpoll stub resolver %s for '%s'", RCode::to_s(d.rcode), dest.toString(), queriedName);
      }

      /* no need to try another resolver if the domain does not exist */
      if (d.rcode == RCode::NXDomain) {
        throw std::runtime_error("Unable to get a valid Security Status update");
      }
      continue;
    }

    if (ntohs(d.qdcount) != 1 || ntohs(d.ancount) != 1) {
      if (g_verbose) {
        warnlog("Invalid answer (qdcount %d / ancount %d) received from the secpoll stub resolver %s", ntohs(d.qdcount), ntohs(d.ancount), dest.toString());
      }
      continue;
    }

    uint16_t receivedType;
    uint16_t receivedClass;
    DNSName receivedName(reply.c_str(), reply.size(), sizeof(dnsheader), false, &receivedType, &receivedClass);

    if (receivedName != sentName || receivedType != QType::TXT || receivedClass != QClass::IN) {
      if (g_verbose) {
        warnlog("Invalid answer, either the qname (%s / %s), qtype (%s / %s) or qclass (%s / %s) does not match, received from the secpoll stub resolver %s", receivedName, sentName, QType(receivedType).toString(), QType(QType::TXT).toString(), QClass(receivedClass).toString(), QClass::IN.toString(), dest.toString());
      }
      continue;
    }

    return getFirstTXTAnswer(reply);
  }

  throw std::runtime_error("Unable to get a valid Security Status update");
}

static bool g_secPollDone{false};
std::string g_secPollSuffix{"secpoll.powerdns.com."};
time_t g_secPollInterval{3600};

void doSecPoll(const std::string& suffix)
{
  if (suffix.empty()) {
    return;
  }

  const std::string pkgv(PACKAGEVERSION);
  bool releaseVersion = std::count(pkgv.begin(), pkgv.end(), '.') == 2;
  const std::string version = "dnsdist-" + pkgv;
  std::string queriedName = version.substr(0, 63) + ".security-status." + suffix;

  if (*queriedName.rbegin() != '.') {
    queriedName += '.';
  }

  boost::replace_all(queriedName, "+", "_");
  boost::replace_all(queriedName, "~", "_");

  try {
    std::string status = getSecPollStatus(queriedName);
    pair<string, string> split = splitField(unquotify(status), ' ');

    int securityStatus = std::stoi(split.first);
    std::string securityMessage = split.second;

    if (securityStatus == 1 && !g_secPollDone) {
      infolog("Polled security status of version %s at startup, no known issues reported: %s", std::string(VERSION), securityMessage);
    }
    if (securityStatus == 2) {
      errlog("PowerDNS DNSDist Security Update Recommended: %s", securityMessage);
    }
    else if(securityStatus == 3) {
      errlog("PowerDNS DNSDist Security Update Mandatory: %s", securityMessage);
    }

    dnsdist::metrics::g_stats.securityStatus = securityStatus;
    g_secPollDone = true;
    return;
  }
  catch (const std::exception& e) {
    if (releaseVersion) {
      warnlog("Error while retrieving the security update for version %s: %s", version, e.what());
    }
    else if (!g_secPollDone) {
      infolog("Error while retrieving the security update for version %s: %s", version, e.what());
    }
  }

  if (releaseVersion) {
    warnlog("Failed to retrieve security status update for '%s' on %s", pkgv, queriedName);
  }
  else if (!g_secPollDone) {
    infolog("Not validating response for security status update, this is a non-release version.");

    /* for non-released versions, there is no use sending the same message several times,
       let's just accept that there will be no security polling for this exact version */
    g_secPollDone = true;
  }
}

#endif /* DISABLE_SECPOLL */

1	/*
2	* This file is part of PowerDNS or dnsdist.
3	* Copyright -- PowerDNS.COM B.V. and its contributors
4	*
5	* This program is free software; you can redistribute it and/or modify
6	* it under the terms of version 2 of the GNU General Public License as
7	* published by the Free Software Foundation.
8	*
9	* In addition, for the avoidance of any doubt, permission is granted to
10	* link this program with OpenSSL and to (re)distribute the binaries
11	* produced as the result of such linking.
12	*
13	* This program is distributed in the hope that it will be useful,
14	* but WITHOUT ANY WARRANTY; without even the implied warranty of
15	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16	* GNU General Public License for more details.
17	*
18	* You should have received a copy of the GNU General Public License
19	* along with this program; if not, write to the Free Software
20	* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
21	*/
22
23	#include "dnsdist-secpoll.hh"
24	#ifndef DISABLE_SECPOLL
25
26	#include <vector>
27
28	#ifdef HAVE_LIBSODIUM
29	#include <sodium.h>
30	#endif /* HAVE_LIBSODIUM */
31
32	#include "dnsparser.hh"
33	#include "dolog.hh"
34	#include "iputils.hh"
35	#include "misc.hh"
36	#include "sstuff.hh"
37
38	#include "dnsdist.hh"
39	#include "dnsdist-metrics.hh"
40	#include "dnsdist-random.hh"
41
42	#ifndef PACKAGEVERSION
43	#define PACKAGEVERSION PACKAGE_VERSION	×
44	#endif
45
46	static std::string getFirstTXTAnswer(const std::string& answer)
47	{	×
48	if (answer.size() <= sizeof(struct dnsheader)) {	×
49	throw std::runtime_error("Looking for a TXT record in an answer smaller than the DNS header");	×
50	}	×
51
NEW 52	const dnsheader_aligned dh(answer.data());	×
53	PacketReader pr(answer);	×
54	uint16_t qdcount = ntohs(dh->qdcount);	×
55	uint16_t ancount = ntohs(dh->ancount);	×
56
57	DNSName rrname;	×
58	uint16_t rrtype;	×
59	uint16_t rrclass;	×
60
61	size_t idx = 0;	×
62	/* consume qd */
63	for(; idx < qdcount; idx++) {	×
64	rrname = pr.getName();	×
65	rrtype = pr.get16BitInt();	×
66	rrclass = pr.get16BitInt();	×
67	(void) rrtype;	×
68	(void) rrclass;	×
69	}	×
70
71	/* parse AN */
72	for (idx = 0; idx < ancount; idx++) {	×
73	string blob;	×
74	struct dnsrecordheader ah;	×
75	rrname = pr.getName();	×
76	pr.getDnsrecordheader(ah);	×
77
78	if (ah.d_type == QType::TXT) {	×
79	string txt;	×
80	pr.xfrText(txt);	×
81
82	return txt;	×
83	}	×
84	else {	×
85	pr.xfrBlob(blob);	×
86	}	×
87	}	×
88
89	throw std::runtime_error("No TXT record in answer");	×
90	}	×
91
92	static std::string getSecPollStatus(const std::string& queriedName, int timeout=2)
93	{	×
94	const DNSName sentName(queriedName);	×
95	std::vector<uint8_t> packet;	×
96	DNSPacketWriter pw(packet, sentName, QType::TXT);	×
97	pw.getHeader()->id = dnsdist::getRandomDNSID();	×
98	pw.getHeader()->rd = 1;	×
99
100	const auto& resolversForStub = getResolvers("/etc/resolv.conf");	×
101
102	for(const auto& dest : resolversForStub) {	×
103	Socket sock(dest.sin4.sin_family, SOCK_DGRAM);	×
104	sock.setNonBlocking();	×
105	sock.connect(dest);	×
106	sock.send(string(packet.begin(), packet.end()));	×
107
108	string reply;	×
109	int ret = waitForData(sock.getHandle(), timeout, 0);	×
110	if (ret < 0) {	×
111	if (g_verbose) {	×
112	warnlog("Error while waiting for the secpoll response from stub resolver %s: %d", dest.toString(), ret);	×
113	}	×
114	continue;	×
115	}	×
116	else if (ret == 0) {	×
117	if (g_verbose) {	×
118	warnlog("Timeout while waiting for the secpoll response from stub resolver %s", dest.toString());	×
119	}	×
120	continue;	×
121	}	×
122
123	try {	×
124	sock.read(reply);	×
125	}	×
126	catch(const std::exception& e) {	×
127	if (g_verbose) {	×
128	warnlog("Error while reading for the secpoll response from stub resolver %s: %s", dest.toString(), e.what());	×
129	}	×
130	continue;	×
131	}	×
132
133	if (reply.size() <= sizeof(struct dnsheader)) {	×
134	if (g_verbose) {	×
135	warnlog("Too short answer of size %d received from the secpoll stub resolver %s", reply.size(), dest.toString());	×
136	}	×
137	continue;	×
138	}	×
139
140	struct dnsheader d;	×
141	memcpy(&d, reply.c_str(), sizeof(d));	×
142	if (d.id != pw.getHeader()->id) {	×
143	if (g_verbose) {	×
144	warnlog("Invalid ID (%d / %d) received from the secpoll stub resolver %s", d.id, pw.getHeader()->id, dest.toString());	×
145	}	×
146	continue;	×
147	}	×
148
149	if (d.rcode != RCode::NoError) {	×
150	if (g_verbose) {	×
151	warnlog("Response code '%s' received from the secpoll stub resolver %s for '%s'", RCode::to_s(d.rcode), dest.toString(), queriedName);	×
152	}	×
153
154	/* no need to try another resolver if the domain does not exist */
155	if (d.rcode == RCode::NXDomain) {	×
156	throw std::runtime_error("Unable to get a valid Security Status update");	×
157	}	×
158	continue;	×
159	}	×
160
161	if (ntohs(d.qdcount) != 1 \|\| ntohs(d.ancount) != 1) {	×
162	if (g_verbose) {	×
163	warnlog("Invalid answer (qdcount %d / ancount %d) received from the secpoll stub resolver %s", ntohs(d.qdcount), ntohs(d.ancount), dest.toString());	×
164	}	×
165	continue;	×
166	}	×
167
168	uint16_t receivedType;	×
169	uint16_t receivedClass;	×
170	DNSName receivedName(reply.c_str(), reply.size(), sizeof(dnsheader), false, &receivedType, &receivedClass);	×
171
172	if (receivedName != sentName \|\| receivedType != QType::TXT \|\| receivedClass != QClass::IN) {	×
173	if (g_verbose) {	×
174	warnlog("Invalid answer, either the qname (%s / %s), qtype (%s / %s) or qclass (%s / %s) does not match, received from the secpoll stub resolver %s", receivedName, sentName, QType(receivedType).toString(), QType(QType::TXT).toString(), QClass(receivedClass).toString(), QClass::IN.toString(), dest.toString());	×
175	}	×
176	continue;	×
177	}	×
178
179	return getFirstTXTAnswer(reply);	×
180	}	×
181
182	throw std::runtime_error("Unable to get a valid Security Status update");	×
183	}	×
184
185	static bool g_secPollDone{false};
186	std::string g_secPollSuffix{"secpoll.powerdns.com."};
187	time_t g_secPollInterval{3600};
188
189	void doSecPoll(const std::string& suffix)
190	{	×
191	if (suffix.empty()) {	×
192	return;	×
193	}	×
194
195	const std::string pkgv(PACKAGEVERSION);	×
196	bool releaseVersion = std::count(pkgv.begin(), pkgv.end(), '.') == 2;	×
197	const std::string version = "dnsdist-" + pkgv;	×
198	std::string queriedName = version.substr(0, 63) + ".security-status." + suffix;	×
199
200	if (*queriedName.rbegin() != '.') {	×
201	queriedName += '.';	×
202	}	×
203
204	boost::replace_all(queriedName, "+", "_");	×
205	boost::replace_all(queriedName, "~", "_");	×
206
207	try {	×
208	std::string status = getSecPollStatus(queriedName);	×
209	pair<string, string> split = splitField(unquotify(status), ' ');	×
210
211	int securityStatus = std::stoi(split.first);	×
212	std::string securityMessage = split.second;	×
213
214	if (securityStatus == 1 && !g_secPollDone) {	×
215	infolog("Polled security status of version %s at startup, no known issues reported: %s", std::string(VERSION), securityMessage);	×
216	}	×
217	if (securityStatus == 2) {	×
218	errlog("PowerDNS DNSDist Security Update Recommended: %s", securityMessage);	×
219	}	×
220	else if(securityStatus == 3) {	×
221	errlog("PowerDNS DNSDist Security Update Mandatory: %s", securityMessage);	×
222	}	×
223
224	dnsdist::metrics::g_stats.securityStatus = securityStatus;	×
225	g_secPollDone = true;	×
226	return;	×
227	}	×
228	catch (const std::exception& e) {	×
229	if (releaseVersion) {	×
230	warnlog("Error while retrieving the security update for version %s: %s", version, e.what());	×
231	}	×
232	else if (!g_secPollDone) {	×
233	infolog("Error while retrieving the security update for version %s: %s", version, e.what());	×
234	}	×
235	}	×
236
237	if (releaseVersion) {	×
238	warnlog("Failed to retrieve security status update for '%s' on %s", pkgv, queriedName);	×
239	}	×
240	else if (!g_secPollDone) {	×
241	infolog("Not validating response for security status update, this is a non-release version.");	×
242
243	/* for non-released versions, there is no use sending the same message several times,
244	let's just accept that there will be no security polling for this exact version */
245	g_secPollDone = true;	×
246	}	×
247	}	×
248
249	#endif /* DISABLE_SECPOLL */

PowerDNS / pdns / 6548113283

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous