net/adns.lua
author Jonas Schäfer <jonas@wielicki.name>
Mon, 10 Jan 2022 18:23:54 +0100
branch0.11
changeset 12185 783056b4e448
parent 11270 2115496e8251
child 11271 97077089f3c2
permissions -rw-r--r--
util.xml: Do not allow doctypes, comments or processing instructions Yes. This is as bad as it sounds. CVE pending. In Prosody itself, this only affects mod_websocket, which uses util.xml to parse the <open/> frame, thus allowing unauthenticated remote DoS using Billion Laughs. However, third-party modules using util.xml may also be affected by this. This commit installs handlers which disallow the use of doctype declarations and processing instructions without any escape hatch. It, by default, also introduces such a handler for comments, however, there is a way to enable comments nontheless. This is because util.xml is used to parse human-facing data, where comments are generally a desirable feature, and also because comments are generally harmless.
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
1522
569d58d21612 Add copyright header to those files missing one
Matthew Wild <mwild1@gmail.com>
parents: 1208
diff changeset
     1
-- Prosody IM
2923
b7049746bd29 Update copyright headers for 2010
Matthew Wild <mwild1@gmail.com>
parents: 2710
diff changeset
     2
-- Copyright (C) 2008-2010 Matthew Wild
b7049746bd29 Update copyright headers for 2010
Matthew Wild <mwild1@gmail.com>
parents: 2710
diff changeset
     3
-- Copyright (C) 2008-2010 Waqas Hussain
5776
bd0ff8ae98a8 Remove all trailing whitespace
Florian Zeitz <florob@babelmonkeys.de>
parents: 5730
diff changeset
     4
--
1522
569d58d21612 Add copyright header to those files missing one
Matthew Wild <mwild1@gmail.com>
parents: 1208
diff changeset
     5
-- This project is MIT/X11 licensed. Please see the
569d58d21612 Add copyright header to those files missing one
Matthew Wild <mwild1@gmail.com>
parents: 1208
diff changeset
     6
-- COPYING file in the source package for more information.
569d58d21612 Add copyright header to those files missing one
Matthew Wild <mwild1@gmail.com>
parents: 1208
diff changeset
     7
--
569d58d21612 Add copyright header to those files missing one
Matthew Wild <mwild1@gmail.com>
parents: 1208
diff changeset
     8
870
4fd5d8f1657c net.adns: Add helper module for performing non-blocking DNS lookups
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
     9
local server = require "net.server";
8269
9a97dd174ec9 net.adns: Restructure to allow creating separate resolver objects, like net.dns
Matthew Wild <mwild1@gmail.com>
parents: 7478
diff changeset
    10
local new_resolver = require "net.dns".resolver;
870
4fd5d8f1657c net.adns: Add helper module for performing non-blocking DNS lookups
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    11
4fd5d8f1657c net.adns: Add helper module for performing non-blocking DNS lookups
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    12
local log = require "util.logger".init("adns");
4fd5d8f1657c net.adns: Add helper module for performing non-blocking DNS lookups
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    13
973
b091a1a7273b net.adns: Catch errors in DNS response callbacks
Matthew Wild <mwild1@gmail.com>
parents: 886
diff changeset
    14
local coroutine, tostring, pcall = coroutine, tostring, pcall;
8283
9ca0e3128b62 net.adns: Import setmetatable into a local (fixes traceback on Lua 5.2)
Kim Alvefur <zash@zash.se>
parents: 8269
diff changeset
    15
local setmetatable = setmetatable;
870
4fd5d8f1657c net.adns: Add helper module for performing non-blocking DNS lookups
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    16
2558
0a65fc0c7bee net.adns: Use different flavour of voodoo to make UDP sockets work smoothly with libevent (no packet merging)
Matthew Wild <mwild1@gmail.com>
parents: 2556
diff changeset
    17
local function dummy_send(sock, data, i, j) return (j-i)+1; end
0a65fc0c7bee net.adns: Use different flavour of voodoo to make UDP sockets work smoothly with libevent (no packet merging)
Matthew Wild <mwild1@gmail.com>
parents: 2556
diff changeset
    18
6783
647adfd8f738 net.*: Remove use of module() function
Kim Alvefur <zash@zash.se>
parents: 6513
diff changeset
    19
local _ENV = nil;
8558
4f0f5b49bb03 vairious: Add annotation when an empty environment is set [luacheck]
Kim Alvefur <zash@zash.se>
parents: 8283
diff changeset
    20
-- luacheck: std none
870
4fd5d8f1657c net.adns: Add helper module for performing non-blocking DNS lookups
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    21
8269
9a97dd174ec9 net.adns: Restructure to allow creating separate resolver objects, like net.dns
Matthew Wild <mwild1@gmail.com>
parents: 7478
diff changeset
    22
local async_resolver_methods = {};
9a97dd174ec9 net.adns: Restructure to allow creating separate resolver objects, like net.dns
Matthew Wild <mwild1@gmail.com>
parents: 7478
diff changeset
    23
local async_resolver_mt = { __index = async_resolver_methods };
870
4fd5d8f1657c net.adns: Add helper module for performing non-blocking DNS lookups
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    24
8269
9a97dd174ec9 net.adns: Restructure to allow creating separate resolver objects, like net.dns
Matthew Wild <mwild1@gmail.com>
parents: 7478
diff changeset
    25
local query_methods = {};
9a97dd174ec9 net.adns: Restructure to allow creating separate resolver objects, like net.dns
Matthew Wild <mwild1@gmail.com>
parents: 7478
diff changeset
    26
local query_mt = { __index = query_methods };
1203
23725bfdeed5 net.adns: Add support for cancelling a non-blocking lookup, optionally calling the handler
Matthew Wild <mwild1@gmail.com>
parents: 1005
diff changeset
    27
6783
647adfd8f738 net.*: Remove use of module() function
Kim Alvefur <zash@zash.se>
parents: 6513
diff changeset
    28
local function new_async_socket(sock, resolver)
2232
aa8db84ae69d net.adns: Some cleanup, happens to also make it compatible with libevent
Matthew Wild <mwild1@gmail.com>
parents: 2128
diff changeset
    29
	local peername = "<unknown>";
870
4fd5d8f1657c net.adns: Add helper module for performing non-blocking DNS lookups
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    30
	local listener = {};
2232
aa8db84ae69d net.adns: Some cleanup, happens to also make it compatible with libevent
Matthew Wild <mwild1@gmail.com>
parents: 2128
diff changeset
    31
	local handler = {};
6287
a380b09649e6 net.adns: Add missing local declaration
Kim Alvefur <zash@zash.se>
parents: 5730
diff changeset
    32
	local err;
2128
f107f0205793 net.adns: Update for new net.server API (doesn't work with libevent yet)
Matthew Wild <mwild1@gmail.com>
parents: 1901
diff changeset
    33
	function listener.onincoming(conn, data)
2652
cbc58fc170ad net.adns: Fix potential traceback on DNS responses with libevent enabled (thanks Flo)
Matthew Wild <mwild1@gmail.com>
parents: 2578
diff changeset
    34
		if data then
8269
9a97dd174ec9 net.adns: Restructure to allow creating separate resolver objects, like net.dns
Matthew Wild <mwild1@gmail.com>
parents: 7478
diff changeset
    35
			resolver:feed(handler, data);
2652
cbc58fc170ad net.adns: Fix potential traceback on DNS responses with libevent enabled (thanks Flo)
Matthew Wild <mwild1@gmail.com>
parents: 2578
diff changeset
    36
		end
870
4fd5d8f1657c net.adns: Add helper module for performing non-blocking DNS lookups
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    37
	end
2128
f107f0205793 net.adns: Update for new net.server API (doesn't work with libevent yet)
Matthew Wild <mwild1@gmail.com>
parents: 1901
diff changeset
    38
	function listener.ondisconnect(conn, err)
2661
be4b1e796bd2 net.adns: Don't treat locally-initiated disconnects as fatal with libevent backend in use (thanks Flo)
Matthew Wild <mwild1@gmail.com>
parents: 2652
diff changeset
    39
		if err then
be4b1e796bd2 net.adns: Don't treat locally-initiated disconnects as fatal with libevent backend in use (thanks Flo)
Matthew Wild <mwild1@gmail.com>
parents: 2652
diff changeset
    40
			log("warn", "DNS socket for %s disconnected: %s", peername, err);
be4b1e796bd2 net.adns: Don't treat locally-initiated disconnects as fatal with libevent backend in use (thanks Flo)
Matthew Wild <mwild1@gmail.com>
parents: 2652
diff changeset
    41
			local servers = resolver.server;
be4b1e796bd2 net.adns: Don't treat locally-initiated disconnects as fatal with libevent backend in use (thanks Flo)
Matthew Wild <mwild1@gmail.com>
parents: 2652
diff changeset
    42
			if resolver.socketset[conn] == resolver.best_server and resolver.best_server == #servers then
be4b1e796bd2 net.adns: Don't treat locally-initiated disconnects as fatal with libevent backend in use (thanks Flo)
Matthew Wild <mwild1@gmail.com>
parents: 2652
diff changeset
    43
				log("error", "Exhausted all %d configured DNS servers, next lookup will try %s again", #servers, servers[1]);
be4b1e796bd2 net.adns: Don't treat locally-initiated disconnects as fatal with libevent backend in use (thanks Flo)
Matthew Wild <mwild1@gmail.com>
parents: 2652
diff changeset
    44
			end
5776
bd0ff8ae98a8 Remove all trailing whitespace
Florian Zeitz <florob@babelmonkeys.de>
parents: 5730
diff changeset
    45
2661
be4b1e796bd2 net.adns: Don't treat locally-initiated disconnects as fatal with libevent backend in use (thanks Flo)
Matthew Wild <mwild1@gmail.com>
parents: 2652
diff changeset
    46
			resolver:servfail(conn); -- Let the magic commence
1787
c4dff34f3d32 net.adns: Utilise new net.dns API to handle DNS network errors
Matthew Wild <mwild1@gmail.com>
parents: 1522
diff changeset
    47
		end
870
4fd5d8f1657c net.adns: Add helper module for performing non-blocking DNS lookups
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    48
	end
5730
411e9e7d8035 net.dns, net.adns: Make sure errors from net.server are propagated (thanks asterix)
Kim Alvefur <zash@zash.se>
parents: 4103
diff changeset
    49
	handler, err = server.wrapclient(sock, "dns", 53, listener);
2232
aa8db84ae69d net.adns: Some cleanup, happens to also make it compatible with libevent
Matthew Wild <mwild1@gmail.com>
parents: 2128
diff changeset
    50
	if not handler then
5730
411e9e7d8035 net.dns, net.adns: Make sure errors from net.server are propagated (thanks asterix)
Kim Alvefur <zash@zash.se>
parents: 4103
diff changeset
    51
		return nil, err;
1787
c4dff34f3d32 net.adns: Utilise new net.dns API to handle DNS network errors
Matthew Wild <mwild1@gmail.com>
parents: 1522
diff changeset
    52
	end
11270
2115496e8251 net.adns: Prevent empty packets from being sent on "connect" (fix #1619)
Kim Alvefur <zash@zash.se>
parents: 8558
diff changeset
    53
	if handler.set then
2115496e8251 net.adns: Prevent empty packets from being sent on "connect" (fix #1619)
Kim Alvefur <zash@zash.se>
parents: 8558
diff changeset
    54
		-- server_epoll: only watch for incoming data
2115496e8251 net.adns: Prevent empty packets from being sent on "connect" (fix #1619)
Kim Alvefur <zash@zash.se>
parents: 8558
diff changeset
    55
		-- avoids sending empty packet on first 'onwritable' event
2115496e8251 net.adns: Prevent empty packets from being sent on "connect" (fix #1619)
Kim Alvefur <zash@zash.se>
parents: 8558
diff changeset
    56
		handler:set(true, false);
2115496e8251 net.adns: Prevent empty packets from being sent on "connect" (fix #1619)
Kim Alvefur <zash@zash.se>
parents: 8558
diff changeset
    57
	end
5776
bd0ff8ae98a8 Remove all trailing whitespace
Florian Zeitz <florob@babelmonkeys.de>
parents: 5730
diff changeset
    58
2232
aa8db84ae69d net.adns: Some cleanup, happens to also make it compatible with libevent
Matthew Wild <mwild1@gmail.com>
parents: 2128
diff changeset
    59
	handler.settimeout = function () end
aa8db84ae69d net.adns: Some cleanup, happens to also make it compatible with libevent
Matthew Wild <mwild1@gmail.com>
parents: 2128
diff changeset
    60
	handler.setsockname = function (_, ...) return sock:setsockname(...); end
6509
f869eec511c8 net.adns: Preserve error from setpeername
Kim Alvefur <zash@zash.se>
parents: 6287
diff changeset
    61
	handler.setpeername = function (_, ...) peername = (...); local ret, err = sock:setpeername(...); _:set_send(dummy_send); return ret, err; end
2556
50d1ba86a959 net.adns: Trailing whitespace
Matthew Wild <mwild1@gmail.com>
parents: 2232
diff changeset
    62
	handler.connect = function (_, ...) return sock:connect(...) end
2558
0a65fc0c7bee net.adns: Use different flavour of voodoo to make UDP sockets work smoothly with libevent (no packet merging)
Matthew Wild <mwild1@gmail.com>
parents: 2556
diff changeset
    63
	--handler.send = function (_, data) _:write(data);  return _.sendbuffer and _.sendbuffer(); end
3990
764922062c38 net.adns: Log the DNS server that a query is sent to
Matthew Wild <mwild1@gmail.com>
parents: 3956
diff changeset
    64
	handler.send = function (_, data)
6510
84ca02c6a47e net.adns: Log peername recorded from wrapped setpeername instead of calling sock:getpeername, it exists and throws an error on unconnected sockets (thanks wirehack7)
Kim Alvefur <zash@zash.se>
parents: 6509
diff changeset
    65
		log("debug", "Sending DNS query to %s", peername);
3990
764922062c38 net.adns: Log the DNS server that a query is sent to
Matthew Wild <mwild1@gmail.com>
parents: 3956
diff changeset
    66
		return sock:send(data);
764922062c38 net.adns: Log the DNS server that a query is sent to
Matthew Wild <mwild1@gmail.com>
parents: 3956
diff changeset
    67
	end
2232
aa8db84ae69d net.adns: Some cleanup, happens to also make it compatible with libevent
Matthew Wild <mwild1@gmail.com>
parents: 2128
diff changeset
    68
	return handler;
870
4fd5d8f1657c net.adns: Add helper module for performing non-blocking DNS lookups
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    69
end
4fd5d8f1657c net.adns: Add helper module for performing non-blocking DNS lookups
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
    70
8269
9a97dd174ec9 net.adns: Restructure to allow creating separate resolver objects, like net.dns
Matthew Wild <mwild1@gmail.com>
parents: 7478
diff changeset
    71
function async_resolver_methods:lookup(handler, qname, qtype, qclass)
9a97dd174ec9 net.adns: Restructure to allow creating separate resolver objects, like net.dns
Matthew Wild <mwild1@gmail.com>
parents: 7478
diff changeset
    72
	local resolver = self._resolver;
9a97dd174ec9 net.adns: Restructure to allow creating separate resolver objects, like net.dns
Matthew Wild <mwild1@gmail.com>
parents: 7478
diff changeset
    73
	return coroutine.wrap(function (peek)
9a97dd174ec9 net.adns: Restructure to allow creating separate resolver objects, like net.dns
Matthew Wild <mwild1@gmail.com>
parents: 7478
diff changeset
    74
				if peek then
9a97dd174ec9 net.adns: Restructure to allow creating separate resolver objects, like net.dns
Matthew Wild <mwild1@gmail.com>
parents: 7478
diff changeset
    75
					log("debug", "Records for %s already cached, using those...", qname);
9a97dd174ec9 net.adns: Restructure to allow creating separate resolver objects, like net.dns
Matthew Wild <mwild1@gmail.com>
parents: 7478
diff changeset
    76
					handler(peek);
9a97dd174ec9 net.adns: Restructure to allow creating separate resolver objects, like net.dns
Matthew Wild <mwild1@gmail.com>
parents: 7478
diff changeset
    77
					return;
9a97dd174ec9 net.adns: Restructure to allow creating separate resolver objects, like net.dns
Matthew Wild <mwild1@gmail.com>
parents: 7478
diff changeset
    78
				end
9a97dd174ec9 net.adns: Restructure to allow creating separate resolver objects, like net.dns
Matthew Wild <mwild1@gmail.com>
parents: 7478
diff changeset
    79
				log("debug", "Records for %s not in cache, sending query (%s)...", qname, tostring(coroutine.running()));
9a97dd174ec9 net.adns: Restructure to allow creating separate resolver objects, like net.dns
Matthew Wild <mwild1@gmail.com>
parents: 7478
diff changeset
    80
				local ok, err = resolver:query(qname, qtype, qclass);
9a97dd174ec9 net.adns: Restructure to allow creating separate resolver objects, like net.dns
Matthew Wild <mwild1@gmail.com>
parents: 7478
diff changeset
    81
				if ok then
9a97dd174ec9 net.adns: Restructure to allow creating separate resolver objects, like net.dns
Matthew Wild <mwild1@gmail.com>
parents: 7478
diff changeset
    82
					coroutine.yield(setmetatable({ resolver, qclass or "IN", qtype or "A", qname, coroutine.running()}, query_mt)); -- Wait for reply
9a97dd174ec9 net.adns: Restructure to allow creating separate resolver objects, like net.dns
Matthew Wild <mwild1@gmail.com>
parents: 7478
diff changeset
    83
					log("debug", "Reply for %s (%s)", qname, tostring(coroutine.running()));
9a97dd174ec9 net.adns: Restructure to allow creating separate resolver objects, like net.dns
Matthew Wild <mwild1@gmail.com>
parents: 7478
diff changeset
    84
				end
9a97dd174ec9 net.adns: Restructure to allow creating separate resolver objects, like net.dns
Matthew Wild <mwild1@gmail.com>
parents: 7478
diff changeset
    85
				if ok then
9a97dd174ec9 net.adns: Restructure to allow creating separate resolver objects, like net.dns
Matthew Wild <mwild1@gmail.com>
parents: 7478
diff changeset
    86
					ok, err = pcall(handler, resolver:peek(qname, qtype, qclass));
9a97dd174ec9 net.adns: Restructure to allow creating separate resolver objects, like net.dns
Matthew Wild <mwild1@gmail.com>
parents: 7478
diff changeset
    87
				else
9a97dd174ec9 net.adns: Restructure to allow creating separate resolver objects, like net.dns
Matthew Wild <mwild1@gmail.com>
parents: 7478
diff changeset
    88
					log("error", "Error sending DNS query: %s", err);
9a97dd174ec9 net.adns: Restructure to allow creating separate resolver objects, like net.dns
Matthew Wild <mwild1@gmail.com>
parents: 7478
diff changeset
    89
					ok, err = pcall(handler, nil, err);
9a97dd174ec9 net.adns: Restructure to allow creating separate resolver objects, like net.dns
Matthew Wild <mwild1@gmail.com>
parents: 7478
diff changeset
    90
				end
9a97dd174ec9 net.adns: Restructure to allow creating separate resolver objects, like net.dns
Matthew Wild <mwild1@gmail.com>
parents: 7478
diff changeset
    91
				if not ok then
9a97dd174ec9 net.adns: Restructure to allow creating separate resolver objects, like net.dns
Matthew Wild <mwild1@gmail.com>
parents: 7478
diff changeset
    92
					log("error", "Error in DNS response handler: %s", tostring(err));
9a97dd174ec9 net.adns: Restructure to allow creating separate resolver objects, like net.dns
Matthew Wild <mwild1@gmail.com>
parents: 7478
diff changeset
    93
				end
9a97dd174ec9 net.adns: Restructure to allow creating separate resolver objects, like net.dns
Matthew Wild <mwild1@gmail.com>
parents: 7478
diff changeset
    94
			end)(resolver:peek(qname, qtype, qclass));
9a97dd174ec9 net.adns: Restructure to allow creating separate resolver objects, like net.dns
Matthew Wild <mwild1@gmail.com>
parents: 7478
diff changeset
    95
end
9a97dd174ec9 net.adns: Restructure to allow creating separate resolver objects, like net.dns
Matthew Wild <mwild1@gmail.com>
parents: 7478
diff changeset
    96
9a97dd174ec9 net.adns: Restructure to allow creating separate resolver objects, like net.dns
Matthew Wild <mwild1@gmail.com>
parents: 7478
diff changeset
    97
function query_methods:cancel(call_handler, reason)
9a97dd174ec9 net.adns: Restructure to allow creating separate resolver objects, like net.dns
Matthew Wild <mwild1@gmail.com>
parents: 7478
diff changeset
    98
	log("warn", "Cancelling DNS lookup for %s", tostring(self[4]));
9a97dd174ec9 net.adns: Restructure to allow creating separate resolver objects, like net.dns
Matthew Wild <mwild1@gmail.com>
parents: 7478
diff changeset
    99
	self[1].cancel(self[2], self[3], self[4], self[5], call_handler);
9a97dd174ec9 net.adns: Restructure to allow creating separate resolver objects, like net.dns
Matthew Wild <mwild1@gmail.com>
parents: 7478
diff changeset
   100
end
9a97dd174ec9 net.adns: Restructure to allow creating separate resolver objects, like net.dns
Matthew Wild <mwild1@gmail.com>
parents: 7478
diff changeset
   101
9a97dd174ec9 net.adns: Restructure to allow creating separate resolver objects, like net.dns
Matthew Wild <mwild1@gmail.com>
parents: 7478
diff changeset
   102
local function new_async_resolver()
9a97dd174ec9 net.adns: Restructure to allow creating separate resolver objects, like net.dns
Matthew Wild <mwild1@gmail.com>
parents: 7478
diff changeset
   103
	local resolver = new_resolver();
9a97dd174ec9 net.adns: Restructure to allow creating separate resolver objects, like net.dns
Matthew Wild <mwild1@gmail.com>
parents: 7478
diff changeset
   104
	resolver:socket_wrapper_set(new_async_socket);
9a97dd174ec9 net.adns: Restructure to allow creating separate resolver objects, like net.dns
Matthew Wild <mwild1@gmail.com>
parents: 7478
diff changeset
   105
	return setmetatable({ _resolver = resolver}, async_resolver_mt);
9a97dd174ec9 net.adns: Restructure to allow creating separate resolver objects, like net.dns
Matthew Wild <mwild1@gmail.com>
parents: 7478
diff changeset
   106
end
872
24018ba2f7c0 net.adns: Return _M
Matthew Wild <mwild1@gmail.com>
parents: 871
diff changeset
   107
6783
647adfd8f738 net.*: Remove use of module() function
Kim Alvefur <zash@zash.se>
parents: 6513
diff changeset
   108
return {
8269
9a97dd174ec9 net.adns: Restructure to allow creating separate resolver objects, like net.dns
Matthew Wild <mwild1@gmail.com>
parents: 7478
diff changeset
   109
	lookup = function (...)
9a97dd174ec9 net.adns: Restructure to allow creating separate resolver objects, like net.dns
Matthew Wild <mwild1@gmail.com>
parents: 7478
diff changeset
   110
		return new_async_resolver():lookup(...);
9a97dd174ec9 net.adns: Restructure to allow creating separate resolver objects, like net.dns
Matthew Wild <mwild1@gmail.com>
parents: 7478
diff changeset
   111
	end;
9a97dd174ec9 net.adns: Restructure to allow creating separate resolver objects, like net.dns
Matthew Wild <mwild1@gmail.com>
parents: 7478
diff changeset
   112
	resolver = new_async_resolver;
6783
647adfd8f738 net.*: Remove use of module() function
Kim Alvefur <zash@zash.se>
parents: 6513
diff changeset
   113
	new_async_socket = new_async_socket;
647adfd8f738 net.*: Remove use of module() function
Kim Alvefur <zash@zash.se>
parents: 6513
diff changeset
   114
};