curvedns.c

Go to the documentation of this file.

/* cns_transmit_start returns DNS_COM */
 
#include <stdio.h>
#include "alloc.h"
#include "byte.h"
#include "uint_t.h"
#include "case.h" 
#include "log.h"
#include "base32.h"
#include "socket_if.h"
#include "ip.h"
#include "error.h"
#include "curvedns.h"
#include "serverok.h"
#include "log.h"
#include "dns.h"
#include "query.h"
 
int flagedserver;             // $FLAGEDSERVER
int flagusetxtformat = 0;         // $USETXTFORMAT 
unsigned int fallback = 0;        // $UZ5FALLBACK; typically 2
 
extern unsigned int flagedns0;    // $FLAGDNSOPTRR 1 or 2
extern unsigned int msgsize;      // DNS message size for UDP
 
char optrr[11] = { '\0',                   // root = 0
                   '\0','\51',             // DNS_T_OPT
                   '\5', '\0',             // max payload size (1280)
                   '\0', '\0', '\0', '\0', // without D0 flag
                   '\0', '\0' }; 
 
char optdo[11] = { '\0',                   // root = 0
                   '\0','\51',             // DNS_T_OPT
                   '\5', '\0',             // max payload size (1280)
                   '\0', '\0','\200','\0', // with D0 flag
                   '\0', '\0' }; 
 
unsigned int udp_msgsize(void) { return msgsize; }
 
void cns_nonce(char nonce[12])
{
  int i; 
 
  for (i = 0; i < 12; i++)
    nonce[i] = dns_random(256);
}
 
/* Generate standard DNS query message with EDNS(0) */
 
void dns_basequery(struct dns_transmit *d,char *query)
{
  unsigned int len;
 
  len = dns_domain_length(d->name);
 
  byte_copy(query,2,d->nonce + 8);           /* 2 byte Identification */
  /*                  Parameter Mapping:     1: Query;  1: #Queries; 1: #AddSec = 1*/
  if (d->flagedns) 
    byte_copy(query + 2,10,d->flagrecursive ? "\1\0\0\1\0\0\0\0\0\1" : \
                                              "\0\0\0\1\0\0\0\0\0\1");
  else
    byte_copy(query + 2,10,d->flagrecursive ? "\1\0\0\1\0\0\0\0\0\0" : \
                                              "\0\0\0\1\0\0\0\0\0\0");
  byte_copy(query + 12,len,d->name); 
  byte_copy(query + 12 + len,2,d->qtype);
  byte_copy(query + 14 + len,2,DNS_C_IN);
 
  /* EDNS(0) Pseudo RR: name(1) + type(2) + class(2) + ttl(4) + rdlen(2) => +11 octetts*/ 
 
  if (d->flagedns) {
    byte_copy(query + 16 + len,3,optrr);              // name = 0 + DNS_OPT header
    uint16_pack_big(query + 19 + len,udp_msgsize());  // msg size
    if (d->flagedns == 2) 
      byte_copy(query + 21 + len,6,optdo + 5);        // DO + rest 0
    else
      byte_copy(query + 21 + len,6,optrr + 5);        // rest 0
  }
}
 
/* Generate DNSCurve format query message */
 
void cns_query(struct dns_transmit *d)
{
  unsigned int len;
  char nonce[24];
  const char *key;
  unsigned int m;
  unsigned int suffixlen;
 
  cns_nonce(d->nonce);
 
  if (!d->keys) {
    byte_copy(d->query + 2,2,d->nonce + 8);
    return;
  }
 
  len = dns_domain_length(d->name);
 
  byte_copy(nonce,12,d->nonce);
  byte_zero(nonce + 12,12);
  key = d->keys + KEY_LEN * d->curserver;
 
  byte_zero(d->query,KEY_LEN);
  dns_basequery(d,d->query + KEY_LEN); // no EDNS(0) for DNSCurve
 
  crypto_box_afternm((unsigned char *) d->query,(const unsigned char *) d->query,len + 48, \
                     (const unsigned char *) nonce,(const unsigned char *) key);
 
  if (!d->suffix) {
    byte_copyr(d->query + 54,len + KEY_LEN,d->query + 16);
    uint16_pack_big(d->query,len + 84);
    byte_copy(d->query + 2,8,"Q6fnvWj8");
    byte_copy(d->query + 10,KEY_LEN,d->pubkey);
    byte_copy(d->query + 42,12,nonce);
    return;
  }
 
  byte_copyr(d->query + d->querylen - len - KEY_LEN,len + KEY_LEN,d->query + 16);
  byte_copy(d->query + d->querylen - len - 44,12,nonce);
 
  suffixlen = dns_domain_length(d->suffix);
  m = base32_bytessize(len + 44);
 
  uint16_pack_big(d->query,d->querylen - 2);
  d->query[2] = dns_random(256);
  d->query[3] = dns_random(256);
  byte_copy(d->query + 4,10,"\0\0\0\1\0\0\0\0\0\0");
  base32_encode(d->query + 14,d->query + d->querylen - len - 44,len + 44);
  base32_clientkey(d->query + 14 + m,d->pubkey);
  byte_copy(d->query + 69 + m,suffixlen,d->suffix);
  byte_copy(d->query + 69 + m + suffixlen,4,DNS_T_TXT DNS_C_IN);
}
 
int cns_uncurve(const struct dns_transmit *d,char *buf,unsigned int *lenp)
{
  const char *key;
  char nonce[24];
  unsigned int len;
  char out[16];
  unsigned int pos;
  uint16 datalen;
  unsigned int i;
  unsigned int j;
  char ch;
  unsigned int txtlen;
  unsigned int namelen;
 
  if (!d->keys) return 0;
 
  key = d->keys + KEY_LEN * d->curserver;
  len = *lenp;
 
  if (!d->suffix) {
    if (len < 48) return 1;
    if (byte_diff(buf,8,"R6fnvWJ8")) return 1;
    if (byte_diff(buf + 8,12,d->nonce)) return 1;
    byte_copy(nonce,24,buf + 8);
    byte_zero(buf + 16,16);
 
    if (crypto_box_open_afternm((uint8 *) buf + 16,(const uint8 *) buf + 16,len - 16, \
                                (const uint8 *) nonce,(const uint8 *) key)) return 1;
    byte_copy(buf,len - 48,buf + 48);
    *lenp = len - 48;
    return 0;
  }
 
  /* XXX: be more leniant? */
 
  pos = dns_packet_copy(buf,len,0,out,12); if (!pos) return 1;
  if (byte_diff(out,2,d->query + 2)) return 1;
  if (byte_diff(out + 2,10,"\204\0\0\1\0\1\0\0\0\0")) return 1;
 
  /* query name might be >255 bytes, so can't use dns_packet_getname */
  namelen = dns_domain_length(d->query + 14);
  pos += namelen;
 
  pos = dns_packet_copy(buf,len,pos,out,16); if (!pos) return 1;
  if (byte_diff(out,14,"\0\20\0\1\300\14\0\20\0\1\0\0\0\0")) return 1;
  uint16_unpack_big(out + 14,&datalen);
  if (datalen > len - pos) return 1;
 
  j = 4;
  txtlen = 0;
  for (i = 0; i < datalen; ++i) {
    ch = buf[pos + i];
    if (!txtlen)
     txtlen = (unsigned char) ch;
    else {
      --txtlen;
      buf[j++] = ch;
    }
  }
  if (txtlen) return 1;
 
  if (j < KEY_LEN) return 1;
  byte_copy(nonce,12,d->nonce);
  byte_copy(nonce + 12,12,buf + 4);
  byte_zero(buf,16);
 
  if (crypto_box_open_afternm((unsigned char *) buf,(const unsigned char *) buf,j, \
                              (const unsigned char *) nonce,(const unsigned char *) key)) return 1;
  byte_copy(buf,j - KEY_LEN,buf + KEY_LEN);
  *lenp = j - KEY_LEN;
 
  return 0;
}
 
int cns_pubkey(const char *dn,char *key)
{
  unsigned char c;
 
  while ((c = *dn++)) {
    if (c == 54)
      if (!case_diffb(dn,3,"uz5")) 
        if (base32_decode(key,dn + 3,51,1) == KEY_LEN)
          return 1;
    dn += (unsigned int) c;
  }
  return 0;
}
 
void cns_sortns(char *s,char *t,unsigned int n)
{
  unsigned int i;
  char tmp[KEY_LEN];
 
  /* s = ipaddress, t = pubkey, n = #NS */
 
  while (n > 1) {
    i = dns_random(n);
    --n;
    byte_copy(tmp,16,s + (i << 4));
    byte_copy(s + (i << 4),16,s + (n << 4));
    byte_copy(s + (n << 4),16,tmp);
    byte_copy(tmp,KEY_LEN,t + (i << 5));
    byte_copy(t + (i << 5),KEY_LEN,t + (n << 5));
    byte_copy(t + (n << 5),KEY_LEN,tmp);
  }
}
 
int cns_addns(struct query *z,const char *addr,int flagnskey,const char *key)
{
  int k, n;
  int flagns = 0;
  int flagcurvetxt = 0;
  int flagedns = flagedns0;
 
  if (flagusetxtformat) flagcurvetxt = 1;
 
  if (flagedserver) {
    flagns = serverok(addr);
    if (flagns ==  1) return 1; 
    if (flagns ==  2) flagedns = flagedns0 ? 0 : flagedns0;     /* toggle */
    if (flagns == -1) flagnskey = 0;
    if (flagns == -2) flagcurvetxt = flagusetxtformat ? 0 : 1; /* toggle */
 }
 
  if (z->flagnskeys[z->level - 1]) {
    if (!flagnskey) goto IPONLY;
  } else if (flagnskey) {
    byte_zero(z->servers[z->level - 1],QUERY_MAXIPLEN);
    byte_zero(z->keys[z->level - 1],QUERY_MAXNS * KEY_LEN);
    z->flagnskeys[z->level - 1] = 1;
  }
 
  IPONLY:
  for (k = 0, n = 0; k < QUERY_MAXIPLEN; k += 16, ++n) {
    z->ctx[z->level - 1][n] = 'd';                           /* std q */
    if (flagedns == 1) z->ctx[z->level - 1][n] = 'e';        /* edns0 q */
    if (flagedns == 2) z->ctx[z->level - 1][n] = 's';        /* edns0 +do q */
    if (flagnskey) z->ctx[z->level - 1][n] = 'c';            /* curve q */
    if (flagnskey && flagcurvetxt) z->ctx[z->level - 1][n] = 't'; /* alt c q */
 
    if (byte_equal(z->servers[z->level - 1] + k,16,addr)) return flagns;
 
    if (byte_equal(z->servers[z->level - 1] + k,16,V6localnet)) {
      byte_copy(z->servers[z->level - 1] + k,16,addr);         /* new ns */
      if (flagnskey) byte_copy(z->keys[z->level - 1] + 2 * k,KEY_LEN,key);
      break;
    }
  }
 
  return flagns;
}
 
int cns_transmit_start(struct dns_transmit *d,const char servers[QUERY_MAXIPLEN],\
                       char qflags[2],const char *q,const char qtype[2],const char localip[16],\
                       const char keys[QUERY_MAXNS * KEY_LEN],const char pubkey[KEY_LEN],const char *suffix)
{
  unsigned int len;
  unsigned int suffixlen;
  unsigned int m;
  int flagrecursive = qflags[0];
  int flagedns = qflags[1];
 
  dns_transmit_free(d);
  errno = EIO;
  len = dns_domain_length(q);
 
  if (!keys) {
    d->querylen = len + 18;
    if (flagedns) d->querylen += 11;  // +OPT-RR
  } else if (!suffix)
    d->querylen = len + 86;
  else {
    suffixlen = dns_domain_length(suffix);
    m = base32_bytessize(len + 44);
    d->querylen = m + suffixlen + 73;
  }
 
  d->query = alloc(d->querylen);
  if (!d->query) return DNS_MEM;
 
  d->name = q;
  byte_copy(d->qtype,2,qtype);
  d->servers = servers;
  byte_copy(d->localip,16,localip);
  d->flagrecursive = flagrecursive;
  d->flagedns = flagedns;
  d->keys = keys;
  d->pubkey = pubkey;
  d->suffix = suffix;
 
  if (!d->keys) {
    uint16_pack_big(d->query,len + 16); 
    dns_basequery(d,d->query + 2);
    d->name = d->query + 14; /* keeps dns_transmit_start backwards compatible */
  }
  d->udploop = flagrecursive ? 1 : 0;
 
  if (len > udp_msgsize() - 16) return firsttcp(d);
 
  return firstudp(d);
}