afonsofrancof/sdns-proxy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: add logging

Browse Source
This commit is contained in:
Afonso Franco
2025-09-08 19:06:21 +01:00
parent 234b1dcc86
commit c6e2b19a84
22 changed files with 429 additions and 1093 deletions
Download Patch File Download Diff File Expand all files Collapse all files

42
common/dnssec/authchain.go
View File

@@ -20,9 +20,9 @@ package dnssec
import (
"fmt"
"log"
"strings"
"github.com/afonsofrancof/sdns-proxy/common/logger"
"github.com/miekg/dns"
)
@@ -57,13 +57,13 @@ func (ac *AuthenticationChain) Populate(domainName string, queryFunc func(string
zones = append(zones, zone)
}
log.Printf("Building DNSSEC chain for zones: %v", zones)
logger.Debug("Building DNSSEC chain for zones: %v", zones)
ac.DelegationChain = make([]SignedZone, 0, len(zones))
// Query each zone from root down
for i, zoneName := range zones {
log.Printf("Querying zone: %s", zoneName)
logger.Debug("Querying zone: %s", zoneName)
delegation, err := ac.queryDelegation(zoneName, queryFunc)
if err != nil {
@@ -91,13 +91,13 @@ func (ac *AuthenticationChain) queryDelegation(domainName string, queryFunc func
}
signedZone.DNSKey = dnskeyRRset
log.Printf("Found %d DNSKEY records for %s", len(dnskeyRRset.RRs), domainName)
logger.Debug("Found %d DNSKEY records for %s", len(dnskeyRRset.RRs), domainName)
// Populate public key lookup
for _, rr := range signedZone.DNSKey.RRs {
if dnskey, ok := rr.(*dns.DNSKEY); ok {
signedZone.AddPubKey(dnskey)
log.Printf("Added DNSKEY for %s: keytag=%d, flags=%d, algorithm=%d", domainName, dnskey.KeyTag(), dnskey.Flags, dnskey.Algorithm)
logger.Debug("Added DNSKEY for %s: keytag=%d, flags=%d, algorithm=%d", domainName, dnskey.KeyTag(), dnskey.Flags, dnskey.Algorithm)
}
}
@@ -106,17 +106,17 @@ func (ac *AuthenticationChain) queryDelegation(domainName string, queryFunc func
dsRRset, _ := ac.queryRRset(domainName, dns.TypeDS, queryFunc)
signedZone.DS = dsRRset
if dsRRset != nil && len(dsRRset.RRs) > 0 {
log.Printf("Found %d DS records for %s", len(dsRRset.RRs), domainName)
logger.Debug("Found %d DS records for %s", len(dsRRset.RRs), domainName)
for _, rr := range dsRRset.RRs {
if ds, ok := rr.(*dns.DS); ok {
log.Printf("DS record for %s: keytag=%d", domainName, ds.KeyTag)
logger.Debug("DS record for %s: keytag=%d", domainName, ds.KeyTag)
}
}
}
} else {
// Root zone has no DS records - trusted by default
signedZone.DS = NewRRSet()
log.Printf("Root zone - no DS records, trusted by default")
logger.Debug("Root zone - no DS records, trusted by default")
}
return signedZone, nil
@@ -125,12 +125,12 @@ func (ac *AuthenticationChain) queryDelegation(domainName string, queryFunc func
func (ac *AuthenticationChain) queryRRset(qname string, qtype uint16, queryFunc func(string, uint16) (*dns.Msg, error)) (*RRSet, error) {
r, err := queryFunc(qname, qtype)
if err != nil {
log.Printf("cannot lookup %v", err)
logger.Debug("cannot lookup %v", err)
return NewRRSet(), nil // Return empty RRSet instead of nil
}
if r.Rcode == dns.RcodeNameError {
log.Printf("no such domain %s", qname)
logger.Debug("no such domain %s", qname)
return NewRRSet(), nil // Return empty RRSet instead of nil
}
@@ -167,60 +167,60 @@ func (ac *AuthenticationChain) Verify(answerRRset *RRSet) error {
// Verify the answer RRset against target zone's keys
err := targetZone.VerifyRRSIG(answerRRset)
if err != nil {
log.Printf("Answer RRSIG verification failed: %v", err)
logger.Debug("Answer RRSIG verification failed: %v", err)
return ErrInvalidRRsig
}
// Validate the chain from root down
for _, zone := range ac.DelegationChain {
log.Printf("Validating zone: %s", zone.Zone)
logger.Debug("Validating zone: %s", zone.Zone)
// Verify DNSKEY RRset signature
if !zone.HasDNSKeys() {
log.Printf("No DNSKEYs for zone %s", zone.Zone)
logger.Debug("No DNSKEYs for zone %s", zone.Zone)
return ErrDnskeyNotAvailable
}
err := zone.VerifyRRSIG(zone.DNSKey)
if err != nil {
log.Printf("DNSKEY validation failed for %s: %v", zone.Zone, err)
logger.Debug("DNSKEY validation failed for %s: %v", zone.Zone, err)
return ErrRrsigValidationError
}
// Skip ALL validation for root - just trust it
if zone.Zone == "." {
log.Printf("Root zone - trusted by default, no validation performed")
logger.Debug("Root zone - trusted by default, no validation performed")
continue
}
// For non-root zones, validate DS records against parent zone
if zone.ParentZone == nil {
log.Printf("Non-root zone %s has no parent", zone.Zone)
logger.Debug("Non-root zone %s has no parent", zone.Zone)
return fmt.Errorf("non-root zone %s has no parent", zone.Zone)
}
if zone.DS == nil || zone.DS.IsEmpty() {
log.Printf("No DS records for zone %s", zone.Zone)
logger.Debug("No DS records for zone %s", zone.Zone)
return ErrDsNotAvailable
}
// Verify DS signature using parent's key
err = zone.ParentZone.VerifyRRSIG(zone.DS)
if err != nil {
log.Printf("DS signature validation failed for %s: %v", zone.Zone, err)
logger.Debug("DS signature validation failed for %s: %v", zone.Zone, err)
return ErrRrsigValidationError
}
// Verify DS matches this zone's DNSKEY
err = zone.VerifyDS(zone.DS.RRs)
if err != nil {
log.Printf("DS-DNSKEY validation failed for %s: %v", zone.Zone, err)
logger.Debug("DS-DNSKEY validation failed for %s: %v", zone.Zone, err)
return ErrDsInvalid
}
log.Printf("Zone %s validated successfully", zone.Zone)
logger.Debug("Zone %s validated successfully", zone.Zone)
}
log.Printf("DNSSEC validation successful for entire chain!")
logger.Debug("DNSSEC validation successful for entire chain!")
return nil
}

47
common/dnssec/authoritative.go
View File

@@ -2,11 +2,11 @@ package dnssec
import (
"fmt"
"log"
"net"
"strings"
"time"
"github.com/afonsofrancof/sdns-proxy/common/logger"
"github.com/miekg/dns"
)
@@ -28,13 +28,13 @@ func NewAuthoritativeQuerier() *AuthoritativeQuerier {
}
func (aq *AuthoritativeQuerier) QueryAuthoritative(qname string, qtype uint16) (*dns.Msg, error) {
log.Printf("Querying authoritative servers for %s type %d", qname, qtype)
logger.Debug("Querying authoritative servers for %s type %d", qname, qtype)
var zone string
if qtype == dns.TypeDS {
zone = aq.getParentZone(qname)
if zone == "" {
log.Printf("No parent zone for %s - returning NXDOMAIN for DS query", qname)
logger.Debug("No parent zone for %s - returning NXDOMAIN for DS query", qname)
msg := &dns.Msg{}
msg.SetRcode(&dns.Msg{}, dns.RcodeNameError)
return msg, nil
@@ -43,7 +43,7 @@ func (aq *AuthoritativeQuerier) QueryAuthoritative(qname string, qtype uint16) (
zone = aq.findZone(qname)
}
log.Printf("Determined zone: %s for query %s type %d", zone, qname, qtype)
logger.Debug("Determined zone: %s for query %s type %d", zone, qname, qtype)
// Get NS names (not IPs yet)
nsNames, err := aq.findAuthoritativeNSNames(zone)
@@ -59,15 +59,15 @@ func (aq *AuthoritativeQuerier) QueryAuthoritative(qname string, qtype uint16) (
continue
}
log.Printf("Trying server: %s (%s)", server, nsName)
logger.Debug("Trying server: %s (%s)", server, nsName)
msg, err := aq.queryServer(server, qname, qtype)
if err != nil {
log.Printf("Server %s failed: %v", server, err)
logger.Debug("Server %s failed: %v", server, err)
lastErr = err
continue
}
log.Printf("Server %s responded, authoritative: %v, rcode: %d, answers: %d", server, msg.Authoritative, msg.Rcode, len(msg.Answer))
logger.Debug("Server %s responded, authoritative: %v, rcode: %d, answers: %d", server, msg.Authoritative, msg.Rcode, len(msg.Answer))
if (msg.Rcode == dns.RcodeSuccess && len(msg.Answer) > 0) || msg.Rcode == dns.RcodeNameError {
return msg, nil
}
@@ -82,11 +82,11 @@ func (aq *AuthoritativeQuerier) QueryAuthoritative(qname string, qtype uint16) (
func (aq *AuthoritativeQuerier) findAuthoritativeNSNames(zone string) ([]string, error) {
if nsNames, exists := aq.nsCache[zone]; exists {
log.Printf("Using cached NS names for %s: %v", zone, nsNames)
logger.Debug("Using cached NS names for %s: %v", zone, nsNames)
return nsNames, nil
}
log.Printf("Looking for NS records for zone: %s", zone)
logger.Debug("Looking for NS records for zone: %s", zone)
// Use a public resolver to find the NS records
resolver := &dns.Client{Timeout: 5 * time.Second}
@@ -125,35 +125,35 @@ func (aq *AuthoritativeQuerier) findAuthoritativeNSNames(zone string) ([]string,
return nil, fmt.Errorf("no NS servers found for %s", zone)
}
log.Printf("Found NS names for %s: %v", zone, nsNames)
logger.Debug("Found NS names for %s: %v", zone, nsNames)
aq.nsCache[zone] = nsNames
log.Printf("Cached NS names for %s: %v", zone, nsNames)
logger.Debug("Cached NS names for %s: %v", zone, nsNames)
return nsNames, nil
}
func (aq *AuthoritativeQuerier) getParentZone(qname string) string {
log.Printf("Getting parent zone for: %s", qname)
logger.Debug("Getting parent zone for: %s", qname)
// Clean the qname
qname = strings.TrimSuffix(qname, ".")
// Root zone has no parent
if qname == "" || qname == "." {
log.Printf("Root zone has no parent")
logger.Debug("Root zone has no parent")
return ""
}
labels := dns.SplitDomainName(qname)
log.Printf("Labels for %s: %v", qname, labels)
logger.Debug("Labels for %s: %v", qname, labels)
if len(labels) <= 1 {
log.Printf("Parent of TLD %s is root", qname)
logger.Debug("Parent of TLD %s is root", qname)
return "." // Parent of TLD is root
}
parentLabels := labels[1:]
parent := dns.Fqdn(strings.Join(parentLabels, "."))
log.Printf("Parent zone of %s is %s", qname, parent)
logger.Debug("Parent zone of %s is %s", qname, parent)
return parent
}
@@ -167,27 +167,26 @@ func (aq *AuthoritativeQuerier) findZone(qname string) string {
return qname
}
func (aq *AuthoritativeQuerier) resolveNSToIP(nsName string) string {
if ip, exists := aq.ipCache[nsName]; exists {
log.Printf("Using cached IP for %s: %s", nsName, ip)
logger.Debug("Using cached IP for %s: %s", nsName, ip)
return ip
}
nsName = strings.TrimSuffix(nsName, ".")
log.Printf("Resolving NS %s to IP", nsName)
logger.Debug("Resolving NS %s to IP", nsName)
ips, err := net.LookupIP(nsName)
if err != nil {
log.Printf("Failed to resolve %s: %v", nsName, err)
logger.Debug("Failed to resolve %s: %v", nsName, err)
return ""
}
for _, ip := range ips {
if ip.To4() != nil { // Prefer IPv4
result := ip.String() + ":53"
log.Printf("Resolved %s to %s", nsName, result)
logger.Debug("Resolved %s to %s", nsName, result)
// Cache the result before returning
aq.ipCache[nsName] = result
return result
@@ -202,12 +201,12 @@ func (aq *AuthoritativeQuerier) queryServer(server, qname string, qtype uint16)
m.SetQuestion(dns.Fqdn(qname), qtype)
m.SetEdns0(4096, true) // Enable DNSSEC
log.Printf("Querying %s for %s type %d", server, qname, qtype)
logger.Debug("Querying %s for %s type %d", server, qname, qtype)
msg, _, err := aq.client.Exchange(m, server)
if err != nil {
return nil, err
}
log.Printf("Response from %s: rcode=%d, answers=%d", server, msg.Rcode, len(msg.Answer))
logger.Debug("Response from %s: rcode=%d, answers=%d", server, msg.Rcode, len(msg.Answer))
return msg, err
}

4
common/dnssec/rrset.go
View File

@@ -19,9 +19,9 @@ package dnssec
// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
import (
"log"
"time"
"github.com/afonsofrancof/sdns-proxy/common/logger"
"github.com/miekg/dns"
)
@@ -65,7 +65,7 @@ func (r *RRSet) ValidateSignature(key *dns.DNSKEY) error {
err := r.RRSig.Verify(key, r.RRs)
if err != nil {
log.Printf("RRSIG verification failed: %v", err)
logger.Debug("RRSIG verification failed: %v", err)
return ErrRrsigValidationError
}

20
common/dnssec/signedzone.go
View File

@@ -19,9 +19,9 @@ package dnssec
// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
import (
"log"
"strings"
"github.com/afonsofrancof/sdns-proxy/common/logger"
"github.com/miekg/dns"
)
@@ -61,7 +61,7 @@ func (z *SignedZone) VerifyRRSIG(signedRRset *RRSet) error {
key := z.LookupPubKey(signedRRset.RRSig.KeyTag)
if key == nil {
log.Printf("DNSKEY keytag %d not found in zone %s", signedRRset.RRSig.KeyTag, z.Zone)
logger.Debug("DNSKEY keytag %d not found in zone %s", signedRRset.RRSig.KeyTag, z.Zone)
return ErrDnskeyNotAvailable
}
@@ -69,36 +69,36 @@ func (z *SignedZone) VerifyRRSIG(signedRRset *RRSet) error {
}
func (z *SignedZone) VerifyDS(dsRRset []dns.RR) error {
log.Printf("Verifying DS for zone %s with %d DS records", z.Zone, len(dsRRset))
logger.Debug("Verifying DS for zone %s with %d DS records", z.Zone, len(dsRRset))
for _, rr := range dsRRset {
ds, ok := rr.(*dns.DS)
if !ok {
continue
}
log.Printf("Checking DS keytag %d, digestType %d", ds.KeyTag, ds.DigestType)
logger.Debug("Checking DS keytag %d, digestType %d", ds.KeyTag, ds.DigestType)
if ds.DigestType != dns.SHA256 {
log.Printf("Unknown digest type (%d) on DS RR", ds.DigestType)
logger.Debug("Unknown digest type (%d) on DS RR", ds.DigestType)
continue
}
parentDsDigest := strings.ToUpper(ds.Digest)
key := z.LookupPubKey(ds.KeyTag)
if key == nil {
log.Printf("DNSKEY keytag %d not found in zone %s", ds.KeyTag, z.Zone)
logger.Debug("DNSKEY keytag %d not found in zone %s", ds.KeyTag, z.Zone)
return ErrDnskeyNotAvailable
}
dsDigest := strings.ToUpper(key.ToDS(ds.DigestType).Digest)
log.Printf("Parent DS digest: %s, Computed digest: %s", parentDsDigest, dsDigest)
logger.Debug("Parent DS digest: %s, Computed digest: %s", parentDsDigest, dsDigest)
if parentDsDigest == dsDigest {
log.Printf("DS validation successful for keytag %d", ds.KeyTag)
logger.Debug("DS validation successful for keytag %d", ds.KeyTag)
return nil
}
log.Printf("DS does not match DNSKEY for keytag %d", ds.KeyTag)
logger.Debug("DS does not match DNSKEY for keytag %d", ds.KeyTag)
}
log.Printf("No matching DS found")
logger.Debug("No matching DS found")
return ErrDsInvalid
}

18
common/dnssec/validator.go
View File

@@ -17,10 +17,10 @@ package dnssec
// WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
// ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
// OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
// ./common/dnssec/validator.go
import (
"log"
"github.com/afonsofrancof/sdns-proxy/common/logger"
"github.com/miekg/dns"
)
@@ -35,7 +35,10 @@ func NewValidator(queryFunc func(string, uint16) (*dns.Msg, error)) *Validator {
}
func (v *Validator) ValidateResponse(msg *dns.Msg, qname string, qtype uint16) error {
logger.Debug("Starting DNSSEC validation for %s %s", qname, dns.TypeToString[qtype])
if msg == nil || len(msg.Answer) == 0 {
logger.Debug("No result for %s %s", qname, dns.TypeToString[qtype])
return ErrNoResult
}
@@ -46,41 +49,48 @@ func (v *Validator) ValidateResponse(msg *dns.Msg, qname string, qtype uint16) e
case *dns.RRSIG:
if t.TypeCovered == qtype {
rrset.RRSig = t
logger.Debug("Found RRSIG for %s %s (keytag: %d)", qname, dns.TypeToString[qtype], t.KeyTag)
}
default:
if rr.Header().Rrtype == qtype {
rrset.RRs = append(rrset.RRs, rr)
logger.Debug("Found RR for %s %s: %s", qname, dns.TypeToString[qtype], rr.String())
}
}
}
if rrset.IsEmpty() {
logger.Debug("Empty RRSet for %s %s", qname, dns.TypeToString[qtype])
return ErrNoResult
}
if !rrset.IsSigned() {
logger.Debug("RRSet for %s %s is not signed", qname, dns.TypeToString[qtype])
return ErrResourceNotSigned
}
// Check header integrity
if err := rrset.CheckHeaderIntegrity(qname); err != nil {
logger.Debug("Header integrity check failed for %s %s: %v", qname, dns.TypeToString[qtype], err)
return err
}
// Build and verify authentication chain
signerName := rrset.SignerName()
logger.Debug("Building authentication chain for signer: %s", signerName)
authChain := NewAuthenticationChain()
if err := authChain.Populate(signerName, v.queryFunc); err != nil {
log.Printf("Cannot populate authentication chain: %s", err)
logger.Debug("Cannot populate authentication chain for %s: %v", signerName, err)
return err
}
if err := authChain.Verify(rrset); err != nil {
log.Printf("DNSSEC validation failed: %s", err)
logger.Debug("DNSSEC validation failed for %s %s: %v", qname, dns.TypeToString[qtype], err)
return err
}
logger.Debug("DNSSEC validation successful for %s %s", qname, dns.TypeToString[qtype])
return nil
}

41
common/logger/logger.go Normal file
View File

@@ -0,0 +1,41 @@
package logger
import (
"log"
"os"
)
var (
debugEnabled bool
infoLogger *log.Logger
debugLogger *log.Logger
errorLogger *log.Logger
)
func init() {
infoLogger = log.New(os.Stderr, "[INFO] ", log.Ltime|log.Lshortfile)
debugLogger = log.New(os.Stderr, "[DEBUG] ", log.Ltime|log.Lshortfile)
errorLogger = log.New(os.Stderr, "[ERROR] ", log.Ltime|log.Lshortfile)
}
func SetDebug(enabled bool) {
debugEnabled = enabled
}
func IsDebugEnabled() bool {
return debugEnabled
}
func Info(format string, args ...any) {
infoLogger.Printf(format, args...)
}
func Debug(format string, args ...any) {
if debugEnabled {
debugLogger.Printf(format, args...)
}
}
func Error(format string, args ...any) {
errorLogger.Printf(format, args...)
}

33
common/protocols/do53/do53.go
View File

@@ -5,6 +5,7 @@ import (
"net"
"time"
"github.com/afonsofrancof/sdns-proxy/common/logger"
"github.com/miekg/dns"
)
@@ -21,7 +22,10 @@ type Client struct {
}
func New(config Config) (*Client, error) {
logger.Debug("Creating DO53 client: %s", config.HostAndPort)
if config.HostAndPort == "" {
logger.Error("DO53 client creation failed: empty HostAndPort")
return nil, fmt.Errorf("do53: HostAndPort cannot be empty")
}
if config.WriteTimeout <= 0 {
@@ -31,6 +35,8 @@ func New(config Config) (*Client, error) {
config.ReadTimeout = 5 * time.Second
}
logger.Debug("DO53 client created: %s (DNSSEC: %v)", config.HostAndPort, config.DNSSEC)
return &Client{
hostAndPort: config.HostAndPort,
config: config,
@@ -38,18 +44,32 @@ func New(config Config) (*Client, error) {
}
func (c *Client) Close() {
logger.Debug("Closing DO53 client")
}
func (c *Client) createConnection() (*net.UDPConn, error) {
udpAddr, err := net.ResolveUDPAddr("udp", c.hostAndPort)
if err != nil {
logger.Error("DO53 failed to resolve address %s: %v", c.hostAndPort, err)
return nil, fmt.Errorf("failed to resolve UDP address: %w", err)
}
return net.DialUDP("udp", nil, udpAddr)
conn, err := net.DialUDP("udp", nil, udpAddr)
if err != nil {
logger.Error("DO53 failed to connect to %s: %v", c.hostAndPort, err)
return nil, err
}
logger.Debug("DO53 connection established to %s", c.hostAndPort)
return conn, nil
}
func (c *Client) Query(msg *dns.Msg) (*dns.Msg, error) {
if len(msg.Question) > 0 {
question := msg.Question[0]
logger.Debug("DO53 query: %s %s to %s", question.Name, dns.TypeToString[question.Qtype], c.hostAndPort)
}
// Create connection for this query
conn, err := c.createConnection()
if err != nil {
@@ -62,36 +82,45 @@ func (c *Client) Query(msg *dns.Msg) (*dns.Msg, error) {
}
packedMsg, err := msg.Pack()
if err != nil {
logger.Error("DO53 failed to pack message: %v", err)
return nil, fmt.Errorf("do53: failed to pack DNS message: %w", err)
}
// Send query
if err := conn.SetWriteDeadline(time.Now().Add(c.config.WriteTimeout)); err != nil {
logger.Error("DO53 failed to set write deadline: %v", err)
return nil, fmt.Errorf("do53: failed to set write deadline: %w", err)
}
if _, err := conn.Write(packedMsg); err != nil {
logger.Error("DO53 failed to send query to %s: %v", c.hostAndPort, err)
return nil, fmt.Errorf("do53: failed to send DNS query: %w", err)
}
// Read response
if err := conn.SetReadDeadline(time.Now().Add(c.config.ReadTimeout)); err != nil {
logger.Error("DO53 failed to set read deadline: %v", err)
return nil, fmt.Errorf("do53: failed to set read deadline: %w", err)
}
buffer := make([]byte, dns.MaxMsgSize)
n, err := conn.Read(buffer)
if err != nil {
logger.Error("DO53 failed to read response from %s: %v", c.hostAndPort, err)
return nil, fmt.Errorf("do53: failed to read DNS response: %w", err)
}
// Parse response
response := new(dns.Msg)
if err := response.Unpack(buffer[:n]); err != nil {
logger.Error("DO53 failed to unpack response from %s: %v", c.hostAndPort, err)
return nil, fmt.Errorf("do53: failed to unpack DNS response: %w", err)
}
if len(response.Answer) > 0 {
logger.Debug("DO53 response from %s: %d answers", c.hostAndPort, len(response.Answer))
}
return response, nil
}

36
common/protocols/doh/doh.go
View File

@@ -12,6 +12,7 @@ import (
"strings"
"time"
"github.com/afonsofrancof/sdns-proxy/common/logger"
"github.com/miekg/dns"
"github.com/quic-go/quic-go"
"github.com/quic-go/quic-go/http3"
@@ -36,8 +37,10 @@ type Client struct {
}
func New(config Config) (*Client, error) {
logger.Debug("Creating DoH client: %s:%s%s", config.Host, config.Port, config.Path)
if config.Host == "" || config.Port == "" || config.Path == "" {
fmt.Printf("%v,%v,%v", config.Host, config.Port, config.Path)
logger.Error("DoH client creation failed: missing required fields")
return nil, errors.New("doh: host, port, and path must not be empty")
}
@@ -48,6 +51,7 @@ func New(config Config) (*Client, error) {
parsedURL, err := url.Parse(rawURL)
if err != nil {
logger.Error("Failed to parse DoH URL %s: %v", rawURL, err)
return nil, fmt.Errorf("doh: failed to parse constructed URL %q: %w", rawURL, err)
}
@@ -67,21 +71,26 @@ func New(config Config) (*Client, error) {
Transport: transport,
}
var transportType string
if config.HTTP2 {
httpClient.Transport = &http2.Transport{
TLSClientConfig: tlsConfig,
AllowHTTP: true,
}
}
if config.HTTP3 {
transportType = "HTTP/2"
} else if config.HTTP3 {
quicTlsConfig := http3.ConfigureTLSConfig(tlsConfig)
httpClient.Transport = &http3.Transport{
TLSClientConfig: quicTlsConfig,
QUICConfig: quicConfig,
}
transportType = "HTTP/3"
} else {
transportType = "HTTP/1.1"
}
logger.Debug("DoH client created: %s (%s, DNSSEC: %v)", rawURL, transportType, config.DNSSEC)
return &Client{
httpClient: httpClient,
upstreamURL: parsedURL,
@@ -90,6 +99,7 @@ func New(config Config) (*Client, error) {
}
func (c *Client) Close() {
logger.Debug("Closing DoH client")
if t, ok := c.httpClient.Transport.(*http.Transport); ok {
t.CloseIdleConnections()
} else if t3, ok := c.httpClient.Transport.(*http3.Transport); ok {
@@ -98,16 +108,24 @@ func (c *Client) Close() {
}
func (c *Client) Query(msg *dns.Msg) (*dns.Msg, error) {
if len(msg.Question) > 0 {
question := msg.Question[0]
logger.Debug("DoH query: %s %s to %s", question.Name, dns.TypeToString[question.Qtype], c.upstreamURL.Host)
}
if c.config.DNSSEC {
msg.SetEdns0(4096, true)
}
packedMsg, err := msg.Pack()
if err != nil {
logger.Error("DoH failed to pack DNS message: %v", err)
return nil, fmt.Errorf("doh: failed to pack DNS message: %w", err)
}
httpReq, err := http.NewRequest(http.MethodPost, c.upstreamURL.String(), bytes.NewReader(packedMsg))
if err != nil {
logger.Error("DoH failed to create HTTP request: %v", err)
return nil, fmt.Errorf("doh: failed to create HTTP request object: %w", err)
}
@@ -117,29 +135,37 @@ func (c *Client) Query(msg *dns.Msg) (*dns.Msg, error) {
httpResp, err := c.httpClient.Do(httpReq)
if err != nil {
logger.Error("DoH request failed to %s: %v", c.upstreamURL.Host, err)
return nil, fmt.Errorf("doh: failed executing HTTP request to %s: %w", c.upstreamURL.Host, err)
}
defer httpResp.Body.Close()
if httpResp.StatusCode != http.StatusOK {
logger.Error("DoH received non-200 status from %s: %s", c.upstreamURL.Host, httpResp.Status)
return nil, fmt.Errorf("doh: received non-200 HTTP status from %s: %s", c.upstreamURL.Host, httpResp.Status)
}
if ct := httpResp.Header.Get("Content-Type"); ct != dnsMessageContentType {
logger.Error("DoH unexpected Content-Type from %s: %s", c.upstreamURL.Host, ct)
return nil, fmt.Errorf("doh: unexpected Content-Type from %s: got %q, want %q", c.upstreamURL.Host, ct, dnsMessageContentType)
}
responseBody, err := io.ReadAll(httpResp.Body)
if err != nil {
logger.Error("DoH failed reading response from %s: %v", c.upstreamURL.Host, err)
return nil, fmt.Errorf("doh: failed reading response body from %s: %w", c.upstreamURL.Host, err)
}
// Unpack the DNS message
recvMsg := new(dns.Msg)
err = recvMsg.Unpack(responseBody)
if err != nil {
logger.Error("DoH failed to unpack response from %s: %v", c.upstreamURL.Host, err)
return nil, fmt.Errorf("doh: failed to unpack DNS response from %s: %w", c.upstreamURL.Host, err)
}
if len(recvMsg.Answer) > 0 {
logger.Debug("DoH response from %s: %d answers", c.upstreamURL.Host, len(recvMsg.Answer))
}
return recvMsg, nil
}

30
common/protocols/doq/doq.go
View File

@@ -10,6 +10,7 @@ import (
"net"
"time"
"github.com/afonsofrancof/sdns-proxy/common/logger"
"github.com/miekg/dns"
"github.com/quic-go/quic-go"
)
@@ -32,6 +33,7 @@ type Client struct {
}
func New(config Config) (*Client, error) {
logger.Debug("Creating DoQ client: %s:%s", config.Host, config.Port)
tlsConfig := &tls.Config{
ServerName: config.Host,
@@ -42,10 +44,13 @@ func New(config Config) (*Client, error) {
targetAddr, err := net.ResolveUDPAddr("udp", net.JoinHostPort(config.Host, config.Port))
if err != nil {
logger.Error("DoQ failed to resolve address %s:%s: %v", config.Host, config.Port, err)
return nil, err
}
udpConn, err := net.ListenUDP("udp", nil)
if err != nil {
logger.Error("DoQ failed to create UDP connection: %v", err)
return nil, fmt.Errorf("failed to connect to target address: %w", err)
}
@@ -57,6 +62,8 @@ func New(config Config) (*Client, error) {
MaxIdleTimeout: 30 * time.Second,
}
logger.Debug("DoQ client created: %s:%s (DNSSEC: %v)", config.Host, config.Port, config.DNSSEC)
return &Client{
targetAddr: targetAddr,
tlsConfig: tlsConfig,
@@ -69,22 +76,30 @@ func New(config Config) (*Client, error) {
}
func (c *Client) Close() {
logger.Debug("Closing DoQ client")
if c.udpConn != nil {
c.udpConn.Close()
}
}
func (c *Client) OpenConnection() error {
logger.Debug("Opening DoQ connection to %s", c.targetAddr)
quicConn, err := c.quicTransport.DialEarly(context.Background(), c.targetAddr, c.tlsConfig, c.quicConfig)
if err != nil {
logger.Error("DoQ connection failed to %s: %v", c.targetAddr, err)
return err
}
c.quicConn = quicConn
logger.Debug("DoQ connection established to %s", c.targetAddr)
return nil
}
func (c *Client) Query(msg *dns.Msg) (*dns.Msg, error) {
if len(msg.Question) > 0 {
question := msg.Question[0]
logger.Debug("DoQ query: %s %s to %s", question.Name, dns.TypeToString[question.Qtype], c.targetAddr)
}
if c.quicConn == nil {
err := c.OpenConnection()
@@ -100,18 +115,21 @@ func (c *Client) Query(msg *dns.Msg) (*dns.Msg, error) {
}
packed, err := msg.Pack()
if err != nil {
logger.Error("DoQ failed to pack message: %v", err)
return nil, fmt.Errorf("doq: failed to pack message: %w", err)
}
var quicStream quic.Stream
quicStream, err = c.quicConn.OpenStream()
if err != nil {
logger.Debug("DoQ stream failed, reconnecting: %v", err)
err = c.OpenConnection()
if err != nil {
return nil, err
}
quicStream, err = c.quicConn.OpenStream()
if err != nil {
logger.Error("DoQ failed to open stream after reconnect: %v", err)
return nil, err
}
}
@@ -119,42 +137,52 @@ func (c *Client) Query(msg *dns.Msg) (*dns.Msg, error) {
var lengthPrefixedMessage bytes.Buffer
err = binary.Write(&lengthPrefixedMessage, binary.BigEndian, uint16(len(packed)))
if err != nil {
logger.Error("DoQ failed to write message length: %v", err)
return nil, fmt.Errorf("failed to write message length: %w", err)
}
_, err = lengthPrefixedMessage.Write(packed)
if err != nil {
logger.Error("DoQ failed to write DNS message: %v", err)
return nil, fmt.Errorf("failed to write DNS message: %w", err)
}
_, err = quicStream.Write(lengthPrefixedMessage.Bytes())
if err != nil {
logger.Error("DoQ failed to write to stream: %v", err)
return nil, fmt.Errorf("failed writing to QUIC stream: %w", err)
}
// Indicate that no further data will be written from this side
quicStream.Close()
lengthBuf := make([]byte, 2)
_, err = io.ReadFull(quicStream, lengthBuf)
if err != nil {
logger.Error("DoQ failed to read response length: %v", err)
return nil, fmt.Errorf("failed reading response length: %w", err)
}
messageLength := binary.BigEndian.Uint16(lengthBuf)
if messageLength == 0 {
logger.Error("DoQ received zero-length message")
return nil, fmt.Errorf("received zero-length message")
}
responseBuf := make([]byte, messageLength)
_, err = io.ReadFull(quicStream, responseBuf)
if err != nil {
logger.Error("DoQ failed to read response data: %v", err)
return nil, fmt.Errorf("failed reading response data: %w", err)
}
recvMsg := new(dns.Msg)
err = recvMsg.Unpack(responseBuf)
if err != nil {
logger.Error("DoQ failed to parse response: %v", err)
return nil, fmt.Errorf("failed to parse DNS response: %w", err)
}
if len(recvMsg.Answer) > 0 {
logger.Debug("DoQ response from %s: %d answers", c.targetAddr, len(recvMsg.Answer))
}
return recvMsg, nil
}

34
common/protocols/dot/dot.go
View File

@@ -8,6 +8,7 @@ import (
"net"
"time"
"github.com/afonsofrancof/sdns-proxy/common/logger"
"github.com/miekg/dns"
)
@@ -27,7 +28,10 @@ type Client struct {
}
func New(config Config) (*Client, error) {
logger.Debug("Creating DoT client: %s:%s", config.Host, config.Port)
if config.Host == "" {
logger.Error("DoT client creation failed: empty host")
return nil, fmt.Errorf("dot: Host cannot be empty")
}
if config.WriteTimeout <= 0 {
@@ -43,6 +47,8 @@ func New(config Config) (*Client, error) {
ServerName: config.Host,
}
logger.Debug("DoT client created: %s (DNSSEC: %v)", hostAndPort, config.DNSSEC)
return &Client{
hostAndPort: hostAndPort,
tlsConfig: tlsConfig,
@@ -51,6 +57,7 @@ func New(config Config) (*Client, error) {
}
func (c *Client) Close() {
logger.Debug("Closing DoT client")
}
func (c *Client) createConnection() (*tls.Conn, error) {
@@ -58,10 +65,23 @@ func (c *Client) createConnection() (*tls.Conn, error) {
Timeout: c.config.WriteTimeout,
}
return tls.DialWithDialer(dialer, "tcp", c.hostAndPort, c.tlsConfig)
logger.Debug("Establishing DoT connection to %s", c.hostAndPort)
conn, err := tls.DialWithDialer(dialer, "tcp", c.hostAndPort, c.tlsConfig)
if err != nil {
logger.Error("DoT connection failed to %s: %v", c.hostAndPort, err)
return nil, err
}
logger.Debug("DoT connection established to %s", c.hostAndPort)
return conn, nil
}
func (c *Client) Query(msg *dns.Msg) (*dns.Msg, error) {
if len(msg.Question) > 0 {
question := msg.Question[0]
logger.Debug("DoT query: %s %s to %s", question.Name, dns.TypeToString[question.Qtype], c.hostAndPort)
}
// Create connection for this query
conn, err := c.createConnection()
if err != nil {
@@ -75,6 +95,7 @@ func (c *Client) Query(msg *dns.Msg) (*dns.Msg, error) {
}
packed, err := msg.Pack()
if err != nil {
logger.Error("DoT failed to pack message: %v", err)
return nil, fmt.Errorf("dot: failed to pack message: %w", err)
}
@@ -85,40 +106,51 @@ func (c *Client) Query(msg *dns.Msg) (*dns.Msg, error) {
// Write query
if err := conn.SetWriteDeadline(time.Now().Add(c.config.WriteTimeout)); err != nil {
logger.Error("DoT failed to set write deadline: %v", err)
return nil, fmt.Errorf("dot: failed to set write deadline: %w", err)
}
if _, err := conn.Write(data); err != nil {
logger.Error("DoT failed to write message to %s: %v", c.hostAndPort, err)
return nil, fmt.Errorf("dot: failed to write message: %w", err)
}
// Read response
if err := conn.SetReadDeadline(time.Now().Add(c.config.ReadTimeout)); err != nil {
logger.Error("DoT failed to set read deadline: %v", err)
return nil, fmt.Errorf("dot: failed to set read deadline: %w", err)
}
// Read message length
lengthBuf := make([]byte, 2)
if _, err := io.ReadFull(conn, lengthBuf); err != nil {
logger.Error("DoT failed to read response length from %s: %v", c.hostAndPort, err)
return nil, fmt.Errorf("dot: failed to read response length: %w", err)
}
msgLen := binary.BigEndian.Uint16(lengthBuf)
if msgLen > dns.MaxMsgSize {
logger.Error("DoT response too large from %s: %d bytes", c.hostAndPort, msgLen)
return nil, fmt.Errorf("dot: response message too large: %d", msgLen)
}
// Read message body
buffer := make([]byte, msgLen)
if _, err := io.ReadFull(conn, buffer); err != nil {
logger.Error("DoT failed to read response from %s: %v", c.hostAndPort, err)
return nil, fmt.Errorf("dot: failed to read response: %w", err)
}
// Parse response
response := new(dns.Msg)
if err := response.Unpack(buffer); err != nil {
logger.Error("DoT failed to unpack response from %s: %v", c.hostAndPort, err)
return nil, fmt.Errorf("dot: failed to unpack response: %w", err)
}
if len(response.Answer) > 0 {
logger.Debug("DoT response from %s: %d answers", c.hostAndPort, len(response.Answer))
}
return response, nil
}