-
Notifications
You must be signed in to change notification settings - Fork 245
/
upstream_dnscrypt.go
151 lines (125 loc) · 4.09 KB
/
upstream_dnscrypt.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
package upstream
import (
"fmt"
"io"
"net/url"
"os"
"sync"
"time"
"github.com/AdguardTeam/golibs/errors"
"github.com/AdguardTeam/golibs/log"
"github.com/ameshkov/dnscrypt/v2"
"github.com/miekg/dns"
)
// dnsCrypt implements the [Upstream] interface for the DNSCrypt protocol.
type dnsCrypt struct {
// mu protects client and serverInfo.
mu *sync.RWMutex
// client stores the DNSCrypt client properties.
client *dnscrypt.Client
// resolverInfo stores the DNSCrypt server properties.
resolverInfo *dnscrypt.ResolverInfo
// addr is the DNSCrypt server URL.
addr *url.URL
// verifyCert is a callback that verifies the resolver's certificate.
verifyCert func(cert *dnscrypt.Cert) (err error)
// timeout is the timeout for the DNS requests.
timeout time.Duration
}
// newDNSCrypt returns a new DNSCrypt Upstream.
func newDNSCrypt(addr *url.URL, opts *Options) (u *dnsCrypt, err error) {
return &dnsCrypt{
mu: &sync.RWMutex{},
addr: addr,
verifyCert: opts.VerifyDNSCryptCertificate,
timeout: opts.Timeout,
}, nil
}
// type check
var _ Upstream = (*dnsCrypt)(nil)
// Address implements the [Upstream] interface for *dnsCrypt.
func (p *dnsCrypt) Address() string { return p.addr.String() }
// Exchange implements the [Upstream] interface for *dnsCrypt.
func (p *dnsCrypt) Exchange(m *dns.Msg) (resp *dns.Msg, err error) {
resp, err = p.exchangeDNSCrypt(m)
if errors.Is(err, os.ErrDeadlineExceeded) || errors.Is(err, io.EOF) {
// If request times out, it is possible that the server configuration
// has been changed. It is safe to assume that the key was rotated, see
// https://dnscrypt.pl/2017/02/26/how-key-rotation-is-automated.
// Re-fetch the server certificate info for new requests to not fail.
_, _, err = p.resetClient()
if err != nil {
return nil, err
}
return p.exchangeDNSCrypt(m)
}
return resp, err
}
// Close implements the [Upstream] interface for *dnsCrypt.
func (p *dnsCrypt) Close() (err error) {
return nil
}
// exchangeDNSCrypt attempts to send the DNS query and returns the response.
func (p *dnsCrypt) exchangeDNSCrypt(m *dns.Msg) (resp *dns.Msg, err error) {
var client *dnscrypt.Client
var resolverInfo *dnscrypt.ResolverInfo
func() {
p.mu.RLock()
defer p.mu.RUnlock()
client, resolverInfo = p.client, p.resolverInfo
}()
// Check the client and server info are set and the certificate is not
// expired, since any of these cases require a client reset.
//
// TODO(ameshkov): Consider using [time.Time] for [dnscrypt.Cert.NotAfter].
switch {
case
client == nil,
resolverInfo == nil,
resolverInfo.ResolverCert.NotAfter < uint32(time.Now().Unix()):
client, resolverInfo, err = p.resetClient()
if err != nil {
// Don't wrap the error, because it's informative enough as is.
return nil, err
}
default:
// Go on.
}
resp, err = client.Exchange(m, resolverInfo)
if resp != nil && resp.Truncated {
q := &m.Question[0]
log.Debug("dnscrypt %s: received truncated, falling back to tcp with %s", p.addr, q)
tcpClient := &dnscrypt.Client{Timeout: p.timeout, Net: networkTCP}
resp, err = tcpClient.Exchange(m, resolverInfo)
}
if err == nil && resp != nil && resp.Id != m.Id {
err = dns.ErrId
}
return resp, err
}
// resetClient renews the DNSCrypt client and server properties and also sets
// those to nil on fail.
func (p *dnsCrypt) resetClient() (client *dnscrypt.Client, ri *dnscrypt.ResolverInfo, err error) {
addr := p.Address()
defer func() {
p.mu.Lock()
defer p.mu.Unlock()
p.client, p.resolverInfo = client, ri
}()
// Use UDP for DNSCrypt upstreams by default.
client = &dnscrypt.Client{Timeout: p.timeout, Net: networkUDP}
ri, err = client.Dial(addr)
if err != nil {
// Trigger client and server info renewal on the next request.
client, ri = nil, nil
err = fmt.Errorf("fetching certificate info from %s: %w", addr, err)
} else if p.verifyCert != nil {
err = p.verifyCert(ri.ResolverCert)
if err != nil {
// Trigger client and server info renewal on the next request.
client, ri = nil, nil
err = fmt.Errorf("verifying certificate info from %s: %w", addr, err)
}
}
return client, ri, err
}