mirror of
https://github.com/AdguardTeam/AdGuardHome.git
synced 2025-03-18 00:18:24 +03:00
Merge in DNS/adguard-home from AGDNS-2686-client-upstream-manager to master Squashed commit of the following: commit 563cb583f01c26434fa04d0e37dcbe2ba15c0912 Merge:f4b0caf5c
61fe269cb
Author: Stanislav Chzhen <s.chzhen@adguard.com> Date: Mon Mar 3 19:07:35 2025 +0300 Merge branch 'master' into AGDNS-2686-client-upstream-manager commitf4b0caf5c8
Author: Stanislav Chzhen <s.chzhen@adguard.com> Date: Thu Feb 27 21:52:51 2025 +0300 client: imp docs commite7d74931b1
Author: Stanislav Chzhen <s.chzhen@adguard.com> Date: Wed Feb 26 21:44:04 2025 +0300 client: imp code commit1cba38c1bc
Author: Stanislav Chzhen <s.chzhen@adguard.com> Date: Wed Feb 26 18:06:17 2025 +0300 client: fix typo commit65b6b1e8c0
Author: Stanislav Chzhen <s.chzhen@adguard.com> Date: Wed Feb 26 17:52:02 2025 +0300 all: imp code, docs commited158ef09f
Author: Stanislav Chzhen <s.chzhen@adguard.com> Date: Wed Feb 26 14:34:50 2025 +0300 client: imp code commitab897f64c8
Author: Stanislav Chzhen <s.chzhen@adguard.com> Date: Tue Feb 25 18:26:16 2025 +0300 all: upd chlog commita2c30e3ede
Merge:bdb08ee0e
d8ce5b453
Author: Stanislav Chzhen <s.chzhen@adguard.com> Date: Tue Feb 25 17:40:32 2025 +0300 Merge branch 'master' into AGDNS-2686-client-upstream-manager commitbdb08ee0e6
Author: Stanislav Chzhen <s.chzhen@adguard.com> Date: Tue Feb 25 17:16:31 2025 +0300 all: imp tests commit00f0eb6047
Author: Stanislav Chzhen <s.chzhen@adguard.com> Date: Thu Feb 20 21:37:58 2025 +0300 all: imp code, docs commit1393417663
Author: Stanislav Chzhen <s.chzhen@adguard.com> Date: Wed Feb 19 15:58:11 2025 +0300 all: client upstream manager
172 lines
4.4 KiB
Go
172 lines
4.4 KiB
Go
package dnsforward
|
|
|
|
import (
|
|
"crypto/tls"
|
|
"fmt"
|
|
"net/http"
|
|
"path"
|
|
"strings"
|
|
|
|
"github.com/AdguardTeam/dnsproxy/proxy"
|
|
"github.com/AdguardTeam/golibs/errors"
|
|
"github.com/AdguardTeam/golibs/log"
|
|
"github.com/AdguardTeam/golibs/netutil"
|
|
"github.com/quic-go/quic-go"
|
|
)
|
|
|
|
// ValidateClientID returns an error if id is not a valid ClientID.
|
|
//
|
|
// Keep in sync with [client.ValidateClientID].
|
|
func ValidateClientID(id string) (err error) {
|
|
err = netutil.ValidateHostnameLabel(id)
|
|
if err != nil {
|
|
// Replace the domain name label wrapper with our own.
|
|
return fmt.Errorf("invalid clientid %q: %w", id, errors.Unwrap(err))
|
|
}
|
|
|
|
return nil
|
|
}
|
|
|
|
// clientIDFromClientServerName extracts and validates a ClientID. hostSrvName
|
|
// is the server name of the host. cliSrvName is the server name as sent by the
|
|
// client. When strict is true, and client and host server name don't match,
|
|
// clientIDFromClientServerName will return an error.
|
|
func clientIDFromClientServerName(
|
|
hostSrvName string,
|
|
cliSrvName string,
|
|
strict bool,
|
|
) (clientID string, err error) {
|
|
if hostSrvName == cliSrvName {
|
|
return "", nil
|
|
}
|
|
|
|
if !netutil.IsImmediateSubdomain(cliSrvName, hostSrvName) {
|
|
if !strict {
|
|
return "", nil
|
|
}
|
|
|
|
return "", fmt.Errorf(
|
|
"client server name %q doesn't match host server name %q",
|
|
cliSrvName,
|
|
hostSrvName,
|
|
)
|
|
}
|
|
|
|
clientID = cliSrvName[:len(cliSrvName)-len(hostSrvName)-1]
|
|
err = ValidateClientID(clientID)
|
|
if err != nil {
|
|
// Don't wrap the error, because it's informative enough as is.
|
|
return "", err
|
|
}
|
|
|
|
return strings.ToLower(clientID), nil
|
|
}
|
|
|
|
// clientIDFromDNSContextHTTPS extracts the ClientID from the path of the
|
|
// client's DNS-over-HTTPS request.
|
|
func clientIDFromDNSContextHTTPS(pctx *proxy.DNSContext) (clientID string, err error) {
|
|
r := pctx.HTTPRequest
|
|
if r == nil {
|
|
return "", fmt.Errorf(
|
|
"proxy ctx http request of proto %s is nil",
|
|
pctx.Proto,
|
|
)
|
|
}
|
|
|
|
origPath := r.URL.Path
|
|
parts := strings.Split(path.Clean(origPath), "/")
|
|
if parts[0] == "" {
|
|
parts = parts[1:]
|
|
}
|
|
|
|
if len(parts) == 0 || parts[0] != "dns-query" {
|
|
return "", fmt.Errorf("clientid check: invalid path %q", origPath)
|
|
}
|
|
|
|
switch len(parts) {
|
|
case 1:
|
|
// Just /dns-query, no ClientID.
|
|
return "", nil
|
|
case 2:
|
|
clientID = parts[1]
|
|
default:
|
|
return "", fmt.Errorf("clientid check: invalid path %q: extra parts", origPath)
|
|
}
|
|
|
|
err = ValidateClientID(clientID)
|
|
if err != nil {
|
|
return "", fmt.Errorf("clientid check: %w", err)
|
|
}
|
|
|
|
return strings.ToLower(clientID), nil
|
|
}
|
|
|
|
// tlsConn is a narrow interface for *tls.Conn to simplify testing.
|
|
type tlsConn interface {
|
|
ConnectionState() (cs tls.ConnectionState)
|
|
}
|
|
|
|
// quicConnection is a narrow interface for quic.Connection to simplify testing.
|
|
type quicConnection interface {
|
|
ConnectionState() (cs quic.ConnectionState)
|
|
}
|
|
|
|
// clientServerName returns the TLS server name based on the protocol. For
|
|
// DNS-over-HTTPS requests, it will return the hostname part of the Host header
|
|
// if there is one.
|
|
func clientServerName(pctx *proxy.DNSContext, proto proxy.Proto) (srvName string, err error) {
|
|
from := "tls conn"
|
|
|
|
switch proto {
|
|
case proxy.ProtoHTTPS:
|
|
var fromHost bool
|
|
srvName, fromHost, err = clientServerNameFromHTTP(pctx.HTTPRequest)
|
|
if err != nil {
|
|
return "", fmt.Errorf("from http: %w", err)
|
|
}
|
|
|
|
if fromHost {
|
|
from = "host header"
|
|
}
|
|
case proxy.ProtoQUIC:
|
|
qConn := pctx.QUICConnection
|
|
conn, ok := qConn.(quicConnection)
|
|
if !ok {
|
|
return "", fmt.Errorf("pctx conn of proto %s is %T, want quic.Connection", proto, qConn)
|
|
}
|
|
|
|
srvName = conn.ConnectionState().TLS.ServerName
|
|
case proxy.ProtoTLS:
|
|
conn := pctx.Conn
|
|
tc, ok := conn.(tlsConn)
|
|
if !ok {
|
|
return "", fmt.Errorf("pctx conn of proto %s is %T, want *tls.Conn", proto, conn)
|
|
}
|
|
|
|
srvName = tc.ConnectionState().ServerName
|
|
}
|
|
|
|
log.Debug("dnsforward: got client server name %q from %s", srvName, from)
|
|
|
|
return srvName, nil
|
|
}
|
|
|
|
// clientServerNameFromHTTP returns the TLS server name or the value of the host
|
|
// header depending on the protocol. fromHost is true if srvName comes from the
|
|
// "Host" HTTP header.
|
|
func clientServerNameFromHTTP(r *http.Request) (srvName string, fromHost bool, err error) {
|
|
if connState := r.TLS; connState != nil {
|
|
return connState.ServerName, false, nil
|
|
}
|
|
|
|
if r.Host == "" {
|
|
return "", false, nil
|
|
}
|
|
|
|
srvName, err = netutil.SplitHost(r.Host)
|
|
if err != nil {
|
|
return "", false, fmt.Errorf("parsing host: %w", err)
|
|
}
|
|
|
|
return srvName, true, nil
|
|
}
|