Skip to content

Commit a934b87

Browse files
committed
small cleanup of logging and fortification of dnscrypt plugin
better debugging of dnscrypt plugin with a separate debug build and wrapping of all cmd_redis replies
1 parent 6a47595 commit a934b87

File tree

10 files changed

+115
-106
lines changed

10 files changed

+115
-106
lines changed

.travis.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -19,5 +19,5 @@ before_install:
1919
script:
2020
- make
2121
- sudo make install
22-
- cd src/dnscrypt-plugin && ./debug/runtests
22+
- cd src/dnscrypt-plugin && ./debug/build && ./debug/runtests
2323

daemons/dnscrypt-proxy

+2-1
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,8 @@ dnscrypt-proxy-conf() {
4848
rconf+="SET dns-lease-gateway ${wan}\n"
4949
# load the local hosts reverses
5050
rconf+="SET dns-reverse-${address}. ${hostname}.dowse.it\n"
51-
rconf+="SET dns-reverse-${wan}. gateway\n"
51+
[[ "$address" = "$gateway" ]] ||
52+
rconf+="SET dns-reverse-${wan}. gateway\n"
5253
print $rconf | redis dynamic
5354
}
5455

src/dnscrypt-plugin/debug/gdb

+7-6
Original file line numberDiff line numberDiff line change
@@ -3,32 +3,33 @@
33
R=`pwd`
44

55
[[ -r ../../zuper/zuper ]] || {
6-
print "usage: ./debug/valgrind (run from inside src/dnscrypt-plugin)"
6+
print "usage: ./debug/gdb (run from inside src/dnscrypt-plugin)"
77
return 1 }
88

99
source ../../zuper/zuper
1010

1111
source ../../zuper/zuper.init
1212

1313
[[ -r .libs/dnscrypt_dowse.so ]] || {
14-
error "dnscrypt_dowse.so not found in .libs (run make?)"
14+
error "dnscrypt_dowse.so not found in debug (run debug/build)"
1515
return 1 }
1616

17-
notice "GDB debug session"
17+
notice "GDB debug session, dnscrypt listening on port 55550"
1818
act "`date`"
1919

2020
DOWSE_DOMAINLIST=$R/../domain-list/data \
2121
DOWSE_LAN_ADDRESS_IP4=127.0.0.1 \
22+
DOWSE_LAN_NETMASK_IP4=255.255.255.0 \
2223
hostname=$hostname \
2324
domain=$lan \
2425
interface=lo \
25-
LD_PRELOAD=$R/.libs/dnscrypt_dowse.so \
26+
LD_PRELOAD=$R/debug/dnscrypt_dowse.so \
2627
gdb --args ../dnscrypt-proxy/src/proxy/dnscrypt-proxy \
27-
-a 127.0.0.1:53530 \
28+
-a 127.0.0.1:55550 \
2829
-l debug/valgrind.log \
2930
-L ../dnscrypt-proxy/dnscrypt-resolvers.csv \
3031
-R "ipredator" \
31-
-X $R/.libs/dnscrypt_dowse.so,cache,debug,$1 \
32+
-X $R/debug/dnscrypt_dowse.so,cache,debug,$1 \
3233
-m 7
3334
# log level informational (7 for debug)
3435

src/dnscrypt-plugin/debug/runtests

+6-4
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ R=`pwd`
44

55
source ../../dowse
66

7-
[[ -r .libs/dnscrypt_dowse.so ]] || {
7+
[[ -r debug/dnscrypt_dowse.so ]] || {
88
error "dnscrypt_dowse.so not found in .libs (run make?)"
99
return 1 }
1010

@@ -13,6 +13,9 @@ act "`date`"
1313

1414
start redis-server
1515

16+
act "hostname: $hostname"
17+
act "address: $address"
18+
act "wan: $wan"
1619

1720
cat <<EOF | redis dynamic
1821
SET dns-lease-testlease1 10.0.0.101
@@ -21,9 +24,8 @@ SET dns-lease-${hostname} ${address}
2124
SET dns-reverse-10.0.0.101. testlease1
2225
SET dns-reverse-10.0.0.102. testlease2
2326
SET dns-reverse-${address}. ${hostname}
24-
SET dns-reverse-${wan}. gateway
2527
EOF
26-
28+
# SET dns-reverse-${wan}. gateway
2729

2830
DOWSE_DOMAINLIST=`pwd`/../domain-list/data
2931
DOWSE_LAN_ADDRESS_IP4=$address
@@ -37,7 +39,7 @@ valgrind --leak-check=full \--track-origins=yes \
3739
-l debug/runtests.log \
3840
-L ../dnscrypt-proxy/dnscrypt-resolvers.csv \
3941
-R "ipredator" \
40-
-X `pwd`/.libs/dnscrypt_dowse.so,debug \
42+
-X `pwd`/debug/dnscrypt_dowse.so,debug \
4143
-m 7 -d
4244
# log level informational (7 for debug)
4345

src/dnscrypt-plugin/debug/valgrind

+8-8
Original file line numberDiff line numberDiff line change
@@ -10,27 +10,27 @@ source ../../zuper/zuper
1010

1111
source ../../zuper/zuper.init
1212

13-
[[ -r .libs/dnscrypt_dowse.so ]] || {
14-
error "dnscrypt_dowse.so not found in .libs (run make?)"
13+
[[ -r debug/dnscrypt_dowse.so ]] || {
14+
error "dnscrypt_dowse.so not found in debug (run debug/build)"
1515
return 1 }
1616

17-
notice "Valgrind debug session on Debugging"
17+
notice "Valgrind debug session, dnscrypt listening on port 53530"
1818
act "`date`"
1919

2020
DOWSE_DOMAINLIST=$R/../domain-list/data \
2121
DOWSE_LAN_ADDRESS_IP4=127.0.0.1 \
22+
DOWSE_LAN_NETMASK_IP4=255.255.255.0 \
2223
hostname=$hostname \
2324
domain=$lan \
2425
interface=lo \
25-
LD_PRELOAD=$R/.libs/dnscrypt_dowse.so \
26+
LD_PRELOAD=$R/debug/dnscrypt_dowse.so \
2627
valgrind --leak-check-heuristics=all --show-leak-kinds=all --track-origins=yes \
2728
--sigill-diagnostics=no --leak-check=full ../dnscrypt-proxy/src/proxy/dnscrypt-proxy \
2829
-a 127.0.0.1:53530 \
2930
-l debug/valgrind.log \
30-
-r "178.216.201.222:2053" \
31-
-k "25C4:E188:2915:4697:8F9C:2BBD:B6A7:AFA4:01ED:A051:0508:5D53:03E7:1928:C066:8F21" \
32-
-N "2.dnscrypt-cert.soltysiak.com" \
33-
-X $R/.libs/dnscrypt_dowse.so,cache,debug,$1 \
31+
-L ../dnscrypt-proxy/dnscrypt-resolvers.csv \
32+
-R "ipredator" \
33+
-X $R/debug/dnscrypt_dowse.so,cache,debug,$1 \
3434
-m 7
3535
# log level informational (7 for debug)
3636

src/dnscrypt-plugin/dnscrypt-dowse.c

+81-70
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,10 @@
4848
// 24 hours
4949
#define CACHE_EXPIRY 5
5050

51+
#ifndef DEBUG
52+
#define DEBUG 0
53+
#endif
54+
5155
DCPLUGIN_MAIN(__FILE__);
5256

5357
int publish_query(plugin_data_t *data);
@@ -84,13 +88,15 @@ int dcplugin_init(DCPlugin * const dcplugin, int argc, char *argv[]) {
8488

8589
data->cache = NULL;
8690
data->offline = 0;
87-
data->debug = 0;
91+
data->debug = DEBUG;
92+
if(data->debug) act("BUILD TIME DEBUG ON");
8893

8994
for(i=0; i<argc; i++) {
9095
func("%u arg: %s", i, argv[i]);
9196

9297
if( strncmp(argv[i], "debug", 5) == 0) {
9398
data->debug = 1;
99+
act("RUN TIME DEBUG ON");
94100
// TODO: check error
95101
}
96102

@@ -153,14 +159,14 @@ int dcplugin_init(DCPlugin * const dcplugin, int argc, char *argv[]) {
153159
data->redis_stor = connect_redis(REDIS_HOST, REDIS_PORT, db_storage);
154160
if(!data->redis_stor) return 1;
155161

156-
data->cache = connect_redis(REDIS_HOST, REDIS_PORT, db_runtime);
157-
if(!data->cache) return 1;
162+
// data->cache = connect_redis(REDIS_HOST, REDIS_PORT, db_runtime);
163+
// if(!data->cache) return 1;
158164

159165
// // save the cache connection to runtime db as logger
160166
// log_redis = data->cache;
161167

162168
dcplugin_set_user_data(dcplugin, data);
163-
169+
notice("Dowse plugin initialisation succesfull");
164170
return 0;
165171
}
166172

@@ -327,7 +333,7 @@ DCPluginSyncFilterResult dcplugin_sync_pre_filter(DCPlugin *dcplugin, DCPluginDN
327333

328334
// resolve locally leased hostnames with a O(1) operation on redis
329335
data->reply = cmd_redis(data->redis_stor,
330-
"GET dns-lease-%s",
336+
"GET dns-reverse-%s",
331337
reverse_str);
332338
if(data->reply)
333339
if(data->reply->len) { // it exists, return that
@@ -418,11 +424,9 @@ DCPluginSyncFilterResult dcplugin_sync_pre_filter(DCPlugin *dcplugin, DCPluginDN
418424
// retrieve mac_address of client and writes it into data->mac
419425
if ( ip4_derive_mac(data) != 0) {
420426

421-
// redirect to dowse if it can't resolve the macaddress
422-
data->reply = cmd_redis(data->redis, "GET dns-lease-dowse.it");
423427
warn("can't resolv mac address of IP: %s", data->ip4);
424428
func("redirect on captive portal due to ip2mac() internal error");
425-
snprintf(rr_to_redirect, 1024, "%s 0 IN A %s", data->query, data->reply->str);
429+
snprintf(rr_to_redirect, 1024, "%s 0 IN A %s", data->query, data->ownip4);
426430
freeReplyObject(data->reply);
427431

428432
// return a wire packet immediately
@@ -441,27 +445,27 @@ DCPluginSyncFilterResult dcplugin_sync_pre_filter(DCPlugin *dcplugin, DCPluginDN
441445

442446
// check if party_mode is on then no need to control authorization to browse
443447
data->reply = cmd_redis(data->redis_stor,"GET party_mode");
444-
if(data->reply->str)
445-
if( strncmp(data->reply->str,"yes",3) == 0)
446-
party_mode = 1;
447-
freeReplyObject(data->reply);
448+
if(data->reply) {
449+
if(data->reply->str)
450+
if( strncmp(data->reply->str,"yes",3) == 0)
451+
party_mode = 1;
452+
freeReplyObject(data->reply);
453+
}
448454

449455
if(!party_mode) {
450-
451456
// check if the mac address is authorized
452457
data->reply = cmd_redis(data->redis_stor, "HGET thing_%s enable_to_browse", data->mac);
453-
if(data->reply->str)
454-
if( strncmp(data->reply->str, "yes", 3) == 0)
455-
enable_to_browse = 1;
456-
freeReplyObject(data->reply);
458+
if(data->reply) {
459+
if(data->reply->str)
460+
if( strncmp(data->reply->str, "yes", 3) == 0)
461+
enable_to_browse = 1;
462+
freeReplyObject(data->reply);
463+
}
457464

458465
if(!enable_to_browse) {
459-
460466
// redirect to dowse if it is not authorized
461-
data->reply = cmd_redis(data->redis, "GET dns-lease-dowse.it");
462467
func("redirect on captive portal for ip %s mac %s", data->ip4, data->mac);
463-
snprintf(rr_to_redirect, 1024, "%s 0 IN A %s", data->query, data->reply->str);
464-
freeReplyObject(data->reply);
468+
snprintf(rr_to_redirect, 1024, "%s 0 IN A %s", data->query, data->ownip4);
465469

466470
// return a wire packet immediately
467471
outbuf = answer_to_question(packet_id, question_rr, rr_to_redirect, &answer_size);
@@ -482,55 +486,58 @@ DCPluginSyncFilterResult dcplugin_sync_pre_filter(DCPlugin *dcplugin, DCPluginDN
482486

483487
// DIRECT ENDPOINT
484488
// resolve locally leased hostnames with a O(1) operation on redis
485-
data->reply = cmd_redis(data->redis_stor, "GET dns-lease-%s", data->query);
486-
if(data->reply->len) { // it exists, return that
487-
size_t answer_size = 0;
488-
uint8_t *outbuf = NULL;
489-
char tmprr[1024];
489+
data->reply = cmd_redis(data->redis, "GET dns-lease-%s", data->query);
490+
if(data->reply) {
491+
if(data->reply->len) { // it exists, return that
492+
size_t answer_size = 0;
493+
uint8_t *outbuf = NULL;
494+
char tmprr[1024];
490495

491-
if(data->debug)
492-
func("local lease found: %s", data->reply->str);
496+
if(data->debug)
497+
func("local lease found: %s", data->reply->str);
493498

494-
snprintf(tmprr, 1024, "%s 0 IN A %s", data->query, data->reply->str);
495-
freeReplyObject(data->reply);
499+
snprintf(tmprr, 1024, "%s 0 IN A %s", data->query, data->reply->str);
500+
freeReplyObject(data->reply);
496501

497-
outbuf = answer_to_question(packet_id, question_rr,
498-
tmprr, &answer_size);
502+
outbuf = answer_to_question(packet_id, question_rr,
503+
tmprr, &answer_size);
499504

500-
if(!outbuf) {
501-
ldns_pkt_free(packet);
502-
return DCP_SYNC_FILTER_RESULT_KILL;
503-
}
505+
if(!outbuf) {
506+
ldns_pkt_free(packet);
507+
return DCP_SYNC_FILTER_RESULT_KILL;
508+
}
504509

505-
dcplugin_set_wire_data(dcp_packet, outbuf, answer_size);
510+
dcplugin_set_wire_data(dcp_packet, outbuf, answer_size);
506511

507-
if(outbuf) LDNS_FREE(outbuf);
508-
ldns_pkt_free(packet);
509-
return DCP_SYNC_FILTER_RESULT_DIRECT;
512+
if(outbuf) LDNS_FREE(outbuf);
513+
ldns_pkt_free(packet);
514+
return DCP_SYNC_FILTER_RESULT_DIRECT;
515+
}
516+
////////////////
517+
freeReplyObject(data->reply);
510518
}
511-
////////////////
512-
freeReplyObject(data->reply);
513519

514520
if(data->cache) {
515521
// check if the answer is cached (the key is the domain string)
516522
data->reply = cmd_redis(data->cache, "GET dns-cache-%s", data->query);
517-
if(data->reply->len) { // it exists in cache, return that
523+
if(data->reply)
524+
if(data->reply->len) { // it exists in cache, return that
518525

519-
if(data->debug)
520-
func("found in cache wire packet of %u bytes", data->reply->len);
526+
if(data->debug)
527+
func("found in cache wire packet of %u bytes", data->reply->len);
521528

522529

523-
// a bit dangerous, but veeery fast: working directly on the wire packet
524-
// copy message ID (first 16 bits)
525-
data->reply->str[0] = wire[0];
526-
data->reply->str[1] = wire[1];
530+
// a bit dangerous, but veeery fast: working directly on the wire packet
531+
// copy message ID (first 16 bits)
532+
data->reply->str[0] = wire[0];
533+
data->reply->str[1] = wire[1];
527534

528-
dcplugin_set_wire_data(dcp_packet, data->reply->str, data->reply->len);
529-
freeReplyObject(data->reply);
535+
dcplugin_set_wire_data(dcp_packet, data->reply->str, data->reply->len);
536+
freeReplyObject(data->reply);
530537

531-
ldns_pkt_free(packet);
532-
return DCP_SYNC_FILTER_RESULT_DIRECT;
533-
}
538+
ldns_pkt_free(packet);
539+
return DCP_SYNC_FILTER_RESULT_DIRECT;
540+
}
534541
}
535542

536543
// if(from_sa->ss_family == AF_PACKET) { // if contains mac address
@@ -729,30 +736,34 @@ int publish_query(plugin_data_t *data) {
729736
// domain hit count
730737
extracted = extract_domain(data);
731738
data->reply = cmd_redis(data->redis, "INCR dns-query-%s", extracted);
732-
val = data->reply->integer;
733-
freeReplyObject(data->reply);
739+
if(data->reply) {
740+
val = data->reply->integer;
741+
freeReplyObject(data->reply);
742+
}
734743

735744
data->reply = cmd_redis(data->redis, "EXPIRE dns-query-%s %u", extracted, DNS_HIT_EXPIRE); // DNS_HIT_EXPIRE
736-
freeReplyObject(data->reply);
745+
if(data->reply) freeReplyObject(data->reply);
737746

738747
// timestamp
739748
time(&epoch_t);
740749

741750
// retrieve thing's name from redis
742751
data->reply = cmd_redis(data->redis_stor, "HGET thing_%s name", data->mac);
743-
if(data->reply->str) { // we have the name
744-
// compose the path of the detected query
745-
snprintf(outnew, MAX_OUTPUT,
746-
"DNS,%s,%d,%lu,%s,%s",
747-
data->reply->str, val,
748-
epoch_t, extracted, data->tld);
749-
} else {
750-
snprintf(outnew, MAX_OUTPUT,
751-
"DNS,%s,%d,%lu,%s,%s",
752-
data->from, val,
753-
epoch_t, extracted, data->tld);
752+
if(data->reply) {
753+
if(data->reply->str) { // we have the name
754+
// compose the path of the detected query
755+
snprintf(outnew, MAX_OUTPUT,
756+
"DNS,%s,%d,%lu,%s,%s",
757+
data->reply->str, val,
758+
epoch_t, extracted, data->tld);
759+
} else {
760+
snprintf(outnew, MAX_OUTPUT,
761+
"DNS,%s,%d,%lu,%s,%s",
762+
data->from, val,
763+
epoch_t, extracted, data->tld);
764+
}
765+
freeReplyObject(data->reply);
754766
}
755-
freeReplyObject(data->reply);
756767

757768
// add domainlist group if found
758769
if(data->listpath) {
@@ -765,7 +776,7 @@ int publish_query(plugin_data_t *data) {
765776
}
766777

767778
data->reply = cmd_redis(data->redis, "PUBLISH dns-query-channel %s", outnew);
768-
freeReplyObject(data->reply);
779+
if(data->reply) freeReplyObject(data->reply);
769780

770781

771782

0 commit comments

Comments
 (0)