daxi20/AdGuardHome
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Pull request 2018: 6231 filter local addrs

Browse Source 
Merge in DNS/adguard-home from 6231-filter-local-addrs to master

Updates #6231.

Squashed commit of the following:

commit 9a60d4e33f25c7dd7eaa4366d8397389196156ac
Author: Eugene Burkov <E.Burkov@AdGuard.COM>
Date:   Thu Sep 28 18:59:51 2023 +0300

    dnsforward: imp code

commit f0c3452525c227b0ee6e761c4a6b68543900d5b5
Author: Eugene Burkov <E.Burkov@AdGuard.COM>
Date:   Wed Sep 27 18:12:47 2023 +0300

    all: don't match nets

commit 572dc0f24e74560adaa4d89ddc921dfd7e1fed02
Author: Eugene Burkov <E.Burkov@AdGuard.COM>
Date:   Wed Sep 27 13:37:48 2023 +0300

    dnsforward: move some code, rm dups

commit 3af627ce9c7f6f4d2aa695a7660b8a0027fa241c
Author: Eugene Burkov <E.Burkov@AdGuard.COM>
Date:   Mon Sep 25 19:21:05 2023 +0300

    dnsforward: imp naming

commit cad1e4e71662836d1dfc79bc2979599b7a29fea1
Author: Eugene Burkov <E.Burkov@AdGuard.COM>
Date:   Mon Sep 25 19:17:53 2023 +0300

    dnsforward: imp code

commit 23d69700789d5652bd25cc089f16afb8b38e51f8
Author: Eugene Burkov <E.Burkov@AdGuard.COM>
Date:   Mon Sep 25 19:08:48 2023 +0300

    dnsforward: add upstream matcher

commit 5819c594a2a8d8bf2cd42883133e21ca7ed2681a
Author: Eugene Burkov <E.Burkov@AdGuard.COM>
Date:   Fri Sep 22 18:31:37 2023 +0300

    all: imp code, docs

commit d07ea96bb568161e029e22d69329a368d9eeb729
Author: Eugene Burkov <E.Burkov@AdGuard.COM>
Date:   Fri Sep 22 18:09:09 2023 +0300

    all: imp code

commit 38a912a62c63247c4c5bb61b67ccc9bfd255feff
Author: Eugene Burkov <E.Burkov@AdGuard.COM>
Date:   Fri Sep 22 15:48:25 2023 +0300

    all: imp code

commit 811212fa16bc231a8da990c075d7231c471c7e3b
Author: Eugene Burkov <E.Burkov@AdGuard.COM>
Date:   Thu Sep 21 19:05:07 2023 +0300

    all: imp addrs detection
This commit is contained in:
Eugene Burkov
2023-09-28 19:11:11 +03:00
parent 93ab0fde23
commit c3f141a0a8
9 changed files with 284 additions and 75 deletions
Download Patch File Download Diff File Expand all files Collapse all files

120
internal/dnsforward/config.go
View File

@@ -12,10 +12,12 @@ import (
"github.com/AdguardTeam/AdGuardHome/internal/aghalg"
"github.com/AdguardTeam/AdGuardHome/internal/aghhttp"
"github.com/AdguardTeam/AdGuardHome/internal/aghnet"
"github.com/AdguardTeam/AdGuardHome/internal/aghtls"
"github.com/AdguardTeam/AdGuardHome/internal/client"
"github.com/AdguardTeam/AdGuardHome/internal/filtering"
"github.com/AdguardTeam/dnsproxy/proxy"
"github.com/AdguardTeam/dnsproxy/upstream"
"github.com/AdguardTeam/golibs/errors"
"github.com/AdguardTeam/golibs/log"
"github.com/AdguardTeam/golibs/netutil"
@@ -392,6 +394,124 @@ func (s *Server) prepareIpsetListSettings() (err error) {
return s.ipset.init(ipsets)
}
// collectListenAddr adds addrPort to addrs. It also adds its port to
// unspecPorts if its address is unspecified.
func collectListenAddr(
addrPort netip.AddrPort,
addrs map[netip.AddrPort]unit,
unspecPorts map[uint16]unit,
) {
if addrPort == (netip.AddrPort{}) {
return
}
addrs[addrPort] = unit{}
if addrPort.Addr().IsUnspecified() {
unspecPorts[addrPort.Port()] = unit{}
}
}
// collectDNSAddrs returns configured set of listening addresses. It also
// returns a set of ports of each unspecified listening address.
func (conf *ServerConfig) collectDNSAddrs() (
addrs map[netip.AddrPort]unit,
unspecPorts map[uint16]unit,
) {
// TODO(e.burkov): Perhaps, we shouldn't allocate as much memory, since the
// TCP and UDP listening addresses are currently the same.
addrs = make(map[netip.AddrPort]unit, len(conf.TCPListenAddrs)+len(conf.UDPListenAddrs))
unspecPorts = map[uint16]unit{}
for _, laddr := range conf.TCPListenAddrs {
collectListenAddr(laddr.AddrPort(), addrs, unspecPorts)
}
for _, laddr := range conf.UDPListenAddrs {
collectListenAddr(laddr.AddrPort(), addrs, unspecPorts)
}
return addrs, unspecPorts
}
// defaultPlainDNSPort is the default port for plain DNS.
const defaultPlainDNSPort uint16 = 53
// upstreamMatcher is a function that matches address of an upstream.
type upstreamMatcher func(addr netip.AddrPort) (ok bool)
// filterOut filters out all the upstreams that match um. It returns all the
// closing errors joined.
func (um upstreamMatcher) filterOut(upsConf *proxy.UpstreamConfig) (err error) {
var errs []error
delFunc := func(u upstream.Upstream) (ok bool) {
// TODO(e.burkov): We should probably consider the protocol of u to
// only filter out the listening addresses of the same protocol.
addr, parseErr := aghnet.ParseAddrPort(u.Address(), defaultPlainDNSPort)
if parseErr != nil || !um(addr) {
// Don't filter out the upstream if it either cannot be parsed, or
// does not match um.
return false
}
errs = append(errs, u.Close())
return true
}
upsConf.Upstreams = slices.DeleteFunc(upsConf.Upstreams, delFunc)
for d, ups := range upsConf.DomainReservedUpstreams {
upsConf.DomainReservedUpstreams[d] = slices.DeleteFunc(ups, delFunc)
}
for d, ups := range upsConf.SpecifiedDomainUpstreams {
upsConf.SpecifiedDomainUpstreams[d] = slices.DeleteFunc(ups, delFunc)
}
return errors.Join(errs...)
}
// filterOurAddrs filters out all the upstreams that pointing to the local
// listening addresses to avoid recursive queries. upsConf may appear empty
// after the filtering. All the filtered upstreams are closed and these
// closings errors are joined.
func (conf *ServerConfig) filterOurAddrs(upsConf *proxy.UpstreamConfig) (err error) {
addrs, unspecPorts := conf.collectDNSAddrs()
if len(addrs) == 0 {
log.Debug("dnsforward: no listen addresses")
return nil
}
var matcher upstreamMatcher
if len(unspecPorts) == 0 {
log.Debug("dnsforward: filtering out addresses %s", addrs)
matcher = func(a netip.AddrPort) (ok bool) {
_, ok = addrs[a]
return ok
}
} else {
var ifaceAddrs []netip.Addr
ifaceAddrs, err = aghnet.CollectAllIfacesAddrs()
if err != nil {
// Don't wrap the error since it's informative enough as is.
return err
}
log.Debug("dnsforward: filtering out addresses %s on ports %d", ifaceAddrs, unspecPorts)
matcher = func(a netip.AddrPort) (ok bool) {
if _, ok = unspecPorts[a.Port()]; ok {
return slices.Contains(ifaceAddrs, a.Addr())
}
return false
}
}
return matcher.filterOut(upsConf)
}
// prepareTLS - prepares TLS configuration for the DNS proxy
func (s *Server) prepareTLS(proxyConfig *proxy.Config) (err error) {
if len(s.conf.CertificateChainData) == 0 || len(s.conf.PrivateKeyData) == 0 {

59
internal/dnsforward/dnsforward.go
View File

@@ -439,57 +439,6 @@ func (s *Server) startLocked() error {
// faster than ordinary upstreams.
const defaultLocalTimeout = 1 * time.Second
// collectDNSIPAddrs returns IP addresses the server is listening on without
// port numbers. For internal use only.
func (s *Server) collectDNSIPAddrs() (addrs []string, err error) {
addrs = make([]string, len(s.conf.TCPListenAddrs)+len(s.conf.UDPListenAddrs))
var i int
var ip net.IP
for _, addr := range s.conf.TCPListenAddrs {
if addr == nil {
continue
}
if ip = addr.IP; ip.IsUnspecified() {
return aghnet.CollectAllIfacesAddrs()
}
addrs[i] = ip.String()
i++
}
for _, addr := range s.conf.UDPListenAddrs {
if addr == nil {
continue
}
if ip = addr.IP; ip.IsUnspecified() {
return aghnet.CollectAllIfacesAddrs()
}
addrs[i] = ip.String()
i++
}
return addrs[:i], nil
}
func (s *Server) filterOurDNSAddrs(addrs []string) (filtered []string, err error) {
var ourAddrs []string
ourAddrs, err = s.collectDNSIPAddrs()
if err != nil {
return nil, err
}
ourAddrsSet := stringutil.NewSet(ourAddrs...)
log.Debug("dnsforward: filtering out %s", ourAddrsSet.String())
// TODO(e.burkov): The approach of subtracting sets of strings is not
// really applicable here since in case of listening on all network
// interfaces we should check the whole interface's network to cut off
// all the loopback addresses as well.
return stringutil.FilterOut(addrs, ourAddrsSet.Has), nil
}
// setupLocalResolvers initializes the resolvers for local addresses. For
// internal use only.
func (s *Server) setupLocalResolvers() (err error) {
@@ -503,18 +452,12 @@ func (s *Server) setupLocalResolvers() (err error) {
resolvers = stringutil.FilterOut(resolvers, IsCommentOrEmpty)
}
resolvers, err = s.filterOurDNSAddrs(resolvers)
if err != nil {
return err
}
log.Debug("dnsforward: upstreams to resolve ptr for local addresses: %v", resolvers)
uc, err := s.prepareUpstreamConfig(resolvers, nil, &upstream.Options{
uc, err := s.prepareLocalUpstreamConfig(resolvers, nil, &upstream.Options{
Bootstrap: bootstraps,
Timeout: defaultLocalTimeout,
// TODO(e.burkov): Should we verify server's certificates?
PreferIPv6: s.conf.BootstrapPreferIPv6,
})
if err != nil {

25
internal/dnsforward/http.go
View File

@@ -142,9 +142,9 @@ func (s *Server) getDNSConfig() (c *jsonDNSConfig) {
upstreamMode = "parallel"
}
defLocalPTRUps, err := s.filterOurDNSAddrs(s.sysResolvers.Get())
defPTRUps, err := s.defaultLocalPTRUpstreams()
if err != nil {
log.Debug("getting dns configuration: %s", err)
log.Error("dnsforward: %s", err)
}
return &jsonDNSConfig{
@@ -171,11 +171,30 @@ func (s *Server) getDNSConfig() (c *jsonDNSConfig) {
ResolveClients: &resolveClients,
UsePrivateRDNS: &usePrivateRDNS,
LocalPTRUpstreams: &localPTRUpstreams,
DefaultLocalPTRUpstreams: defLocalPTRUps,
DefaultLocalPTRUpstreams: defPTRUps,
DisabledUntil: protectionDisabledUntil,
}
}
// defaultLocalPTRUpstreams returns the list of default local PTR resolvers
// filtered of AdGuard Home's own DNS server addresses. It may appear empty.
func (s *Server) defaultLocalPTRUpstreams() (ups []string, err error) {
s.serverLock.RLock()
defer s.serverLock.RUnlock()
uc, err := s.prepareLocalUpstreamConfig(s.sysResolvers.Get(), nil, nil)
if err != nil {
return nil, fmt.Errorf("getting system upstream config: %w", err)
}
defer func() { err = errors.Join(err, uc.Close()) }()
for _, u := range uc.Upstreams {
ups = append(ups, u.Address())
}
return ups, nil
}
// handleGetConfig handles requests to the GET /control/dns_info endpoint.
func (s *Server) handleGetConfig(w http.ResponseWriter, r *http.Request) {
resp := s.getDNSConfig()

25
internal/dnsforward/upstreams.go
View File

@@ -69,8 +69,8 @@ func (s *Server) prepareUpstreamSettings() (err error) {
return nil
}
// prepareUpstreamConfig sets upstream configuration based on upstreams and
// configuration of s.
// prepareUpstreamConfig returns the upstream configuration based on upstreams
// and configuration of s.
func (s *Server) prepareUpstreamConfig(
upstreams []string,
defaultUpstreams []string,
@@ -103,6 +103,27 @@ func (s *Server) prepareUpstreamConfig(
return uc, nil
}
// prepareLocalUpstreamConfig returns the upstream configuration for private
// upstreams based on upstreams and configuration of s. It also filters out
// the own listening addresses from the upstreams, so it may appear empty.
func (s *Server) prepareLocalUpstreamConfig(
upstreams []string,
defaultUpstreams []string,
opts *upstream.Options,
) (uc *proxy.UpstreamConfig, err error) {
uc, err = s.prepareUpstreamConfig(upstreams, defaultUpstreams, opts)
if err != nil {
return nil, fmt.Errorf("preparing private upstreams: %w", err)
}
err = s.conf.filterOurAddrs(uc)
if err != nil {
return nil, fmt.Errorf("filtering private upstreams: %w", err)
}
return uc, nil
}
// replaceUpstreamsWithHosts replaces unique upstreams with their resolved
// versions based on the system hosts file.
//