-
Notifications
You must be signed in to change notification settings - Fork 245
/
bootstrap.go
executable file
·347 lines (296 loc) · 9.44 KB
/
bootstrap.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
package upstream
import (
"context"
"crypto/tls"
"crypto/x509"
"fmt"
"net"
"net/url"
"strings"
"sync"
"time"
"github.com/AdguardTeam/golibs/log"
"github.com/joomcode/errorx"
"github.com/miekg/dns"
)
// RootCAs is the CertPool that must be used by all upstreams
// Redefining RootCAs makes sense on iOS to overcome the 15MB memory limit of the NEPacketTunnelProvider
// nolint
var RootCAs *x509.CertPool
type bootstrapper struct {
address string // in form of "tls://one.one.one.one:853"
resolvers []*Resolver // list of Resolvers to use to resolve hostname, if necessary
timeout time.Duration // resolution duration (shared with the upstream) (0 == infinite timeout)
dialContext dialHandler // specifies the dial function for creating unencrypted TCP connections.
resolvedConfig *tls.Config
sync.RWMutex
}
// Resolver is wrapper for resolver and it's address
type Resolver struct {
resolver *net.Resolver // net.Resolver
resolverAddress string // Resolver's address
upstream Upstream
}
// toBootResolved creates a new bootstrapper that already contains resolved config.
// This can be done only in the case when we already know the resolver IP address.
// timeout is also used for establishing TCP connections
func toBootResolved(address string, serverIP net.IP, timeout time.Duration) (*bootstrapper, error) {
// get a host without port
host, port, err := getAddressHostPort(address)
if err != nil {
return nil, fmt.Errorf("bootstrapper requires port in address %s", address)
}
// Upgrade lock to protect n.resolved
resolverAddress := net.JoinHostPort(serverIP.String(), port)
return &bootstrapper{
address: address,
dialContext: createDialContext([]string{resolverAddress}, timeout),
resolvedConfig: createTLSConfig(host),
timeout: timeout,
}, nil
}
// toBoot initializes a new bootstrapper instance
// address -- original resolver address string (i.e. tls://one.one.one.one:853)
// bootstrapAddr -- a list of bootstrap DNS resolvers' addresses
// timeout -- DNS query timeout
func toBoot(address string, bootstrapAddr []string, timeout time.Duration) *bootstrapper {
resolvers := []*Resolver{}
if bootstrapAddr != nil && len(bootstrapAddr) != 0 {
for idx, adr := range bootstrapAddr {
_, _, err := net.SplitHostPort(adr)
if err != nil {
// Add the default port for bootstrap DNS address if no port is defined
adr = net.JoinHostPort(adr, "53")
bootstrapAddr[idx] = adr
}
}
// Create list of resolvers for parallel lookup
for _, boot := range bootstrapAddr {
r := NewResolver(boot, timeout)
resolvers = append(resolvers, r)
}
} else {
// nil resolver if the default one
resolvers = append(resolvers, NewResolver("", timeout))
}
return &bootstrapper{
address: address,
resolvers: resolvers,
timeout: timeout,
}
}
// NewResolver creates an instance of Resolver structure with defined net.Resolver and it's address
// resolverAddress is address of net.Resolver
// The host in the address parameter of Dial func will always be a literal IP address (from documentation)
func NewResolver(resolverAddress string, timeout time.Duration) *Resolver {
r := &Resolver{}
// set default net.Resolver as a resolver if resolverAddress is empty
if resolverAddress == "" {
r.resolver = &net.Resolver{}
return r
}
r.resolverAddress = resolverAddress
opts := Options{
Timeout: timeout,
}
var err error
r.upstream, err = AddressToUpstream(resolverAddress, opts)
if err != nil {
log.Error("AddressToUpstream: %s", err)
return r
}
if _, ok := r.upstream.(*plainDNS); !ok {
r.upstream = nil
log.Error("Not a plain DNS resolver: %s", resolverAddress)
return r
}
return r
}
type resultError struct {
resp *dns.Msg
err error
}
func (r *Resolver) resolve(host string, qtype uint16, ch chan *resultError) {
req := dns.Msg{}
req.Id = dns.Id()
req.RecursionDesired = true
req.Question = []dns.Question{
{
Name: host,
Qtype: qtype,
Qclass: dns.ClassINET,
},
}
resp, err := r.upstream.Exchange(&req)
ch <- &resultError{resp, err}
}
func setIPAddresses(ipAddrs *[]net.IPAddr, answers []dns.RR) {
for _, ans := range answers {
if a, ok := ans.(*dns.A); ok {
ip := net.IPAddr{IP: a.A}
*ipAddrs = append(*ipAddrs, ip)
} else if a, ok := ans.(*dns.AAAA); ok {
ip := net.IPAddr{IP: a.AAAA}
*ipAddrs = append(*ipAddrs, ip)
}
}
}
// LookupIPAddr returns result of LookupIPAddr method of Resolver's net.Resolver
func (r *Resolver) LookupIPAddr(ctx context.Context, host string) ([]net.IPAddr, error) {
if r.resolver != nil {
// use system resolver
return r.resolver.LookupIPAddr(ctx, host)
}
if r.upstream == nil || len(host) == 0 {
return []net.IPAddr{}, nil
}
if host[:1] != "." {
host += "."
}
ch := make(chan *resultError)
go r.resolve(host, dns.TypeA, ch)
go r.resolve(host, dns.TypeAAAA, ch)
var ipAddrs []net.IPAddr
var errs []error
n := 0
wait:
for {
var re *resultError
select {
case re = <-ch:
if re.err != nil {
errs = append(errs, re.err)
} else {
setIPAddresses(&ipAddrs, re.resp.Answer)
}
n++
if n == 2 {
break wait
}
}
}
if len(ipAddrs) == 0 && len(errs) != 0 {
return []net.IPAddr{}, errs[0]
}
return ipAddrs, nil
}
// dialHandler specifies the dial function for creating unencrypted TCP connections.
type dialHandler func(ctx context.Context, network, addr string) (net.Conn, error)
// will get usable IP address from Address field, and caches the result
func (n *bootstrapper) get() (*tls.Config, dialHandler, error) {
n.RLock()
if n.dialContext != nil && n.resolvedConfig != nil { // fast path
tlsConfig, dialContext := n.resolvedConfig, n.dialContext
n.RUnlock()
return tlsConfig, dialContext, nil
}
//
// Slow path: resolve the IP address of the n.address's host
//
// get a host without port
host, port, err := getAddressHostPort(n.address)
if err != nil {
addr := n.address
n.RUnlock()
return nil, nil, fmt.Errorf("bootstrapper requires port in address %s", addr)
}
// if n.address's host is an IP, just use it right away
ip := net.ParseIP(host)
if ip != nil {
n.RUnlock()
// Upgrade lock to protect n.resolved
resolverAddress := net.JoinHostPort(host, port)
n.Lock()
defer n.Unlock()
dialContext := createDialContext([]string{resolverAddress}, n.timeout)
n.dialContext = dialContext
config := createTLSConfig(host)
n.resolvedConfig = config
return config, n.dialContext, nil
}
// Don't lock anymore (we can launch multiple lookup requests at a time)
// Otherwise, it might mess with the timeout specified for the Upstream
// See here: https://github.com/AdguardTeam/dnsproxy/issues/15
n.RUnlock()
//
// if it's a hostname
//
var ctx context.Context
if n.timeout > 0 {
ctxWithTimeout, cancel := context.WithTimeout(context.TODO(), n.timeout)
defer cancel() // important to avoid a resource leak
ctx = ctxWithTimeout
} else {
ctx = context.Background()
}
addrs, err := LookupParallel(ctx, n.resolvers, host)
if err != nil {
return nil, nil, errorx.Decorate(err, "failed to lookup %s", host)
}
resolved := []string{}
for _, addr := range addrs {
if addr.IP.To4() == nil && addr.IP.To16() == nil {
continue
}
resolved = append(resolved, net.JoinHostPort(addr.String(), port))
}
if len(resolved) == 0 {
// couldn't find any suitable IP address
return nil, nil, fmt.Errorf("couldn't find any suitable IP address for host %s", host)
}
n.Lock()
defer n.Unlock()
dialContext := createDialContext(resolved, n.timeout)
n.dialContext = dialContext
n.resolvedConfig = createTLSConfig(host)
return n.resolvedConfig, n.dialContext, nil
}
// createDialContext returns dialContext function that tries to establish connection with all given addresses one by one
func createDialContext(addresses []string, timeout time.Duration) (dialContext dialHandler) {
dialer := &net.Dialer{
Timeout: timeout,
DualStack: true,
}
dialContext = func(ctx context.Context, network, addr string) (net.Conn, error) {
errs := []error{}
// Return first connection without error
// Note that we're using bootstrapped resolverAddress instead of what's passed to the function
for _, resolverAddress := range addresses {
log.Tracef("Dialing to %s", resolverAddress)
start := time.Now()
con, err := dialer.DialContext(ctx, network, resolverAddress)
elapsed := time.Since(start) / time.Millisecond
if err == nil {
log.Tracef("dialer has successfully initialized connection to %s in %d milliseconds", resolverAddress, elapsed)
return con, err
}
errs = append(errs, err)
log.Tracef("dialer failed to initialize connection to %s, in %d milliseconds, cause: %s", resolverAddress, elapsed, err)
}
return nil, errorx.DecorateMany("all dialers failed to initialize connection: ", errs...)
}
return
}
// createTLSConfig creates a client TLS config
func createTLSConfig(host string) *tls.Config {
return &tls.Config{
ServerName: host,
RootCAs: RootCAs,
MinVersion: tls.VersionTLS12,
}
}
// getAddressHostPort splits resolver address into host and port
// returns host, port
func getAddressHostPort(address string) (string, string, error) {
justHostPort := address
if strings.Contains(address, "://") {
parsedURL, err := url.Parse(address)
if err != nil {
return "", "", errorx.Decorate(err, "failed to parse %s", address)
}
justHostPort = parsedURL.Host
}
// convert host to IP if necessary, we know that it's scheme://hostname:port/
// get a host without port
return net.SplitHostPort(justHostPort)
}