resolver.go 12 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521
  1. package libnetwork
  2. import (
  3. "fmt"
  4. "math/rand"
  5. "net"
  6. "strings"
  7. "sync"
  8. "time"
  9. "github.com/Sirupsen/logrus"
  10. "github.com/docker/libnetwork/types"
  11. "github.com/miekg/dns"
  12. )
  13. // Resolver represents the embedded DNS server in Docker. It operates
  14. // by listening on container's loopback interface for DNS queries.
  15. type Resolver interface {
  16. // Start starts the name server for the container
  17. Start() error
  18. // Stop stops the name server for the container. Stopped resolver
  19. // can be reused after running the SetupFunc again.
  20. Stop()
  21. // SetupFunc() provides the setup function that should be run
  22. // in the container's network namespace.
  23. SetupFunc(int) func()
  24. // NameServer() returns the IP of the DNS resolver for the
  25. // containers.
  26. NameServer() string
  27. // SetExtServers configures the external nameservers the resolver
  28. // should use to forward queries
  29. SetExtServers([]extDNSEntry)
  30. // ResolverOptions returns resolv.conf options that should be set
  31. ResolverOptions() []string
  32. }
  33. // DNSBackend represents a backend DNS resolver used for DNS name
  34. // resolution. All the queries to the resolver are forwared to the
  35. // backend resolver.
  36. type DNSBackend interface {
  37. // ResolveName resolves a service name to an IPv4 or IPv6 address by searching
  38. // the networks the sandbox is connected to. For IPv6 queries, second return
  39. // value will be true if the name exists in docker domain but doesn't have an
  40. // IPv6 address. Such queries shouldn't be forwarded to external nameservers.
  41. ResolveName(name string, iplen int) ([]net.IP, bool)
  42. // ResolveIP returns the service name for the passed in IP. IP is in reverse dotted
  43. // notation; the format used for DNS PTR records
  44. ResolveIP(name string) string
  45. // ResolveService returns all the backend details about the containers or hosts
  46. // backing a service. Its purpose is to satisfy an SRV query
  47. ResolveService(name string) ([]*net.SRV, []net.IP)
  48. // ExecFunc allows a function to be executed in the context of the backend
  49. // on behalf of the resolver.
  50. ExecFunc(f func()) error
  51. //NdotsSet queries the backends ndots dns option settings
  52. NdotsSet() bool
  53. // HandleQueryResp passes the name & IP from a response to the backend. backend
  54. // can use it to maintain any required state about the resolution
  55. HandleQueryResp(name string, ip net.IP)
  56. }
  57. const (
  58. dnsPort = "53"
  59. ptrIPv4domain = ".in-addr.arpa."
  60. ptrIPv6domain = ".ip6.arpa."
  61. respTTL = 600
  62. maxExtDNS = 3 //max number of external servers to try
  63. extIOTimeout = 4 * time.Second
  64. defaultRespSize = 512
  65. maxConcurrent = 100
  66. logInterval = 2 * time.Second
  67. )
  68. type extDNSEntry struct {
  69. IPStr string
  70. HostLoopback bool
  71. }
  72. // resolver implements the Resolver interface
  73. type resolver struct {
  74. backend DNSBackend
  75. extDNSList [maxExtDNS]extDNSEntry
  76. server *dns.Server
  77. conn *net.UDPConn
  78. tcpServer *dns.Server
  79. tcpListen *net.TCPListener
  80. err error
  81. count int32
  82. tStamp time.Time
  83. queryLock sync.Mutex
  84. listenAddress string
  85. proxyDNS bool
  86. resolverKey string
  87. startCh chan struct{}
  88. }
  89. func init() {
  90. rand.Seed(time.Now().Unix())
  91. }
  92. // NewResolver creates a new instance of the Resolver
  93. func NewResolver(address string, proxyDNS bool, resolverKey string, backend DNSBackend) Resolver {
  94. return &resolver{
  95. backend: backend,
  96. proxyDNS: proxyDNS,
  97. listenAddress: address,
  98. resolverKey: resolverKey,
  99. err: fmt.Errorf("setup not done yet"),
  100. startCh: make(chan struct{}, 1),
  101. }
  102. }
  103. func (r *resolver) SetupFunc(port int) func() {
  104. return (func() {
  105. var err error
  106. // DNS operates primarily on UDP
  107. addr := &net.UDPAddr{
  108. IP: net.ParseIP(r.listenAddress),
  109. Port: port,
  110. }
  111. r.conn, err = net.ListenUDP("udp", addr)
  112. if err != nil {
  113. r.err = fmt.Errorf("error in opening name server socket %v", err)
  114. return
  115. }
  116. // Listen on a TCP as well
  117. tcpaddr := &net.TCPAddr{
  118. IP: net.ParseIP(r.listenAddress),
  119. Port: port,
  120. }
  121. r.tcpListen, err = net.ListenTCP("tcp", tcpaddr)
  122. if err != nil {
  123. r.err = fmt.Errorf("error in opening name TCP server socket %v", err)
  124. return
  125. }
  126. r.err = nil
  127. })
  128. }
  129. func (r *resolver) Start() error {
  130. r.startCh <- struct{}{}
  131. defer func() { <-r.startCh }()
  132. // make sure the resolver has been setup before starting
  133. if r.err != nil {
  134. return r.err
  135. }
  136. if err := r.setupIPTable(); err != nil {
  137. return fmt.Errorf("setting up IP table rules failed: %v", err)
  138. }
  139. s := &dns.Server{Handler: r, PacketConn: r.conn}
  140. r.server = s
  141. go func() {
  142. s.ActivateAndServe()
  143. }()
  144. tcpServer := &dns.Server{Handler: r, Listener: r.tcpListen}
  145. r.tcpServer = tcpServer
  146. go func() {
  147. tcpServer.ActivateAndServe()
  148. }()
  149. return nil
  150. }
  151. func (r *resolver) Stop() {
  152. r.startCh <- struct{}{}
  153. defer func() { <-r.startCh }()
  154. if r.server != nil {
  155. r.server.Shutdown()
  156. }
  157. if r.tcpServer != nil {
  158. r.tcpServer.Shutdown()
  159. }
  160. r.conn = nil
  161. r.tcpServer = nil
  162. r.err = fmt.Errorf("setup not done yet")
  163. r.tStamp = time.Time{}
  164. r.count = 0
  165. r.queryLock = sync.Mutex{}
  166. }
  167. func (r *resolver) SetExtServers(extDNS []extDNSEntry) {
  168. l := len(extDNS)
  169. if l > maxExtDNS {
  170. l = maxExtDNS
  171. }
  172. for i := 0; i < l; i++ {
  173. r.extDNSList[i] = extDNS[i]
  174. }
  175. }
  176. func (r *resolver) NameServer() string {
  177. return r.listenAddress
  178. }
  179. func (r *resolver) ResolverOptions() []string {
  180. return []string{"ndots:0"}
  181. }
  182. func setCommonFlags(msg *dns.Msg) {
  183. msg.RecursionAvailable = true
  184. }
  185. func shuffleAddr(addr []net.IP) []net.IP {
  186. for i := len(addr) - 1; i > 0; i-- {
  187. r := rand.Intn(i + 1)
  188. addr[i], addr[r] = addr[r], addr[i]
  189. }
  190. return addr
  191. }
  192. func createRespMsg(query *dns.Msg) *dns.Msg {
  193. resp := new(dns.Msg)
  194. resp.SetReply(query)
  195. setCommonFlags(resp)
  196. return resp
  197. }
  198. func (r *resolver) handleIPQuery(name string, query *dns.Msg, ipType int) (*dns.Msg, error) {
  199. var addr []net.IP
  200. var ipv6Miss bool
  201. addr, ipv6Miss = r.backend.ResolveName(name, ipType)
  202. if addr == nil && ipv6Miss {
  203. // Send a reply without any Answer sections
  204. logrus.Debugf("Lookup name %s present without IPv6 address", name)
  205. resp := createRespMsg(query)
  206. return resp, nil
  207. }
  208. if addr == nil {
  209. return nil, nil
  210. }
  211. logrus.Debugf("Lookup for %s: IP %v", name, addr)
  212. resp := createRespMsg(query)
  213. if len(addr) > 1 {
  214. addr = shuffleAddr(addr)
  215. }
  216. if ipType == types.IPv4 {
  217. for _, ip := range addr {
  218. rr := new(dns.A)
  219. rr.Hdr = dns.RR_Header{Name: name, Rrtype: dns.TypeA, Class: dns.ClassINET, Ttl: respTTL}
  220. rr.A = ip
  221. resp.Answer = append(resp.Answer, rr)
  222. }
  223. } else {
  224. for _, ip := range addr {
  225. rr := new(dns.AAAA)
  226. rr.Hdr = dns.RR_Header{Name: name, Rrtype: dns.TypeAAAA, Class: dns.ClassINET, Ttl: respTTL}
  227. rr.AAAA = ip
  228. resp.Answer = append(resp.Answer, rr)
  229. }
  230. }
  231. return resp, nil
  232. }
  233. func (r *resolver) handlePTRQuery(ptr string, query *dns.Msg) (*dns.Msg, error) {
  234. parts := []string{}
  235. if strings.HasSuffix(ptr, ptrIPv4domain) {
  236. parts = strings.Split(ptr, ptrIPv4domain)
  237. } else if strings.HasSuffix(ptr, ptrIPv6domain) {
  238. parts = strings.Split(ptr, ptrIPv6domain)
  239. } else {
  240. return nil, fmt.Errorf("invalid PTR query, %v", ptr)
  241. }
  242. host := r.backend.ResolveIP(parts[0])
  243. if len(host) == 0 {
  244. return nil, nil
  245. }
  246. logrus.Debugf("Lookup for IP %s: name %s", parts[0], host)
  247. fqdn := dns.Fqdn(host)
  248. resp := new(dns.Msg)
  249. resp.SetReply(query)
  250. setCommonFlags(resp)
  251. rr := new(dns.PTR)
  252. rr.Hdr = dns.RR_Header{Name: ptr, Rrtype: dns.TypePTR, Class: dns.ClassINET, Ttl: respTTL}
  253. rr.Ptr = fqdn
  254. resp.Answer = append(resp.Answer, rr)
  255. return resp, nil
  256. }
  257. func (r *resolver) handleSRVQuery(svc string, query *dns.Msg) (*dns.Msg, error) {
  258. srv, ip := r.backend.ResolveService(svc)
  259. if len(srv) == 0 {
  260. return nil, nil
  261. }
  262. if len(srv) != len(ip) {
  263. return nil, fmt.Errorf("invalid reply for SRV query %s", svc)
  264. }
  265. resp := createRespMsg(query)
  266. for i, r := range srv {
  267. rr := new(dns.SRV)
  268. rr.Hdr = dns.RR_Header{Name: svc, Rrtype: dns.TypePTR, Class: dns.ClassINET, Ttl: respTTL}
  269. rr.Port = r.Port
  270. rr.Target = r.Target
  271. resp.Answer = append(resp.Answer, rr)
  272. rr1 := new(dns.A)
  273. rr1.Hdr = dns.RR_Header{Name: r.Target, Rrtype: dns.TypeA, Class: dns.ClassINET, Ttl: respTTL}
  274. rr1.A = ip[i]
  275. resp.Extra = append(resp.Extra, rr1)
  276. }
  277. return resp, nil
  278. }
  279. func truncateResp(resp *dns.Msg, maxSize int, isTCP bool) {
  280. if !isTCP {
  281. resp.Truncated = true
  282. }
  283. srv := resp.Question[0].Qtype == dns.TypeSRV
  284. // trim the Answer RRs one by one till the whole message fits
  285. // within the reply size
  286. for resp.Len() > maxSize {
  287. resp.Answer = resp.Answer[:len(resp.Answer)-1]
  288. if srv && len(resp.Extra) > 0 {
  289. resp.Extra = resp.Extra[:len(resp.Extra)-1]
  290. }
  291. }
  292. }
  293. func (r *resolver) ServeDNS(w dns.ResponseWriter, query *dns.Msg) {
  294. var (
  295. extConn net.Conn
  296. resp *dns.Msg
  297. err error
  298. )
  299. if query == nil || len(query.Question) == 0 {
  300. return
  301. }
  302. name := query.Question[0].Name
  303. switch query.Question[0].Qtype {
  304. case dns.TypeA:
  305. resp, err = r.handleIPQuery(name, query, types.IPv4)
  306. case dns.TypeAAAA:
  307. resp, err = r.handleIPQuery(name, query, types.IPv6)
  308. case dns.TypePTR:
  309. resp, err = r.handlePTRQuery(name, query)
  310. case dns.TypeSRV:
  311. resp, err = r.handleSRVQuery(name, query)
  312. }
  313. if err != nil {
  314. logrus.Error(err)
  315. return
  316. }
  317. if resp == nil {
  318. // If the backend doesn't support proxying dns request
  319. // fail the response
  320. if !r.proxyDNS {
  321. resp = new(dns.Msg)
  322. resp.SetRcode(query, dns.RcodeServerFailure)
  323. w.WriteMsg(resp)
  324. return
  325. }
  326. // If the user sets ndots > 0 explicitly and the query is
  327. // in the root domain don't forward it out. We will return
  328. // failure and let the client retry with the search domain
  329. // attached
  330. switch query.Question[0].Qtype {
  331. case dns.TypeA:
  332. fallthrough
  333. case dns.TypeAAAA:
  334. if r.backend.NdotsSet() && !strings.Contains(strings.TrimSuffix(name, "."), ".") {
  335. resp = createRespMsg(query)
  336. }
  337. }
  338. }
  339. proto := w.LocalAddr().Network()
  340. maxSize := 0
  341. if proto == "tcp" {
  342. maxSize = dns.MaxMsgSize - 1
  343. } else if proto == "udp" {
  344. optRR := query.IsEdns0()
  345. if optRR != nil {
  346. maxSize = int(optRR.UDPSize())
  347. }
  348. if maxSize < defaultRespSize {
  349. maxSize = defaultRespSize
  350. }
  351. }
  352. if resp != nil {
  353. if resp.Len() > maxSize {
  354. truncateResp(resp, maxSize, proto == "tcp")
  355. }
  356. } else {
  357. for i := 0; i < maxExtDNS; i++ {
  358. extDNS := &r.extDNSList[i]
  359. if extDNS.IPStr == "" {
  360. break
  361. }
  362. extConnect := func() {
  363. addr := fmt.Sprintf("%s:%d", extDNS.IPStr, 53)
  364. extConn, err = net.DialTimeout(proto, addr, extIOTimeout)
  365. }
  366. if extDNS.HostLoopback {
  367. extConnect()
  368. } else {
  369. execErr := r.backend.ExecFunc(extConnect)
  370. if execErr != nil {
  371. logrus.Warn(execErr)
  372. continue
  373. }
  374. }
  375. if err != nil {
  376. logrus.Warnf("Connect failed: %s", err)
  377. continue
  378. }
  379. logrus.Debugf("Query %s[%d] from %s, forwarding to %s:%s", name, query.Question[0].Qtype,
  380. extConn.LocalAddr().String(), proto, extDNS.IPStr)
  381. // Timeout has to be set for every IO operation.
  382. extConn.SetDeadline(time.Now().Add(extIOTimeout))
  383. co := &dns.Conn{
  384. Conn: extConn,
  385. UDPSize: uint16(maxSize),
  386. }
  387. defer co.Close()
  388. // limits the number of outstanding concurrent queries.
  389. if r.forwardQueryStart() == false {
  390. old := r.tStamp
  391. r.tStamp = time.Now()
  392. if r.tStamp.Sub(old) > logInterval {
  393. logrus.Errorf("More than %v concurrent queries from %s", maxConcurrent, extConn.LocalAddr().String())
  394. }
  395. continue
  396. }
  397. err = co.WriteMsg(query)
  398. if err != nil {
  399. r.forwardQueryEnd()
  400. logrus.Debugf("Send to DNS server failed, %s", err)
  401. continue
  402. }
  403. resp, err = co.ReadMsg()
  404. // Truncated DNS replies should be sent to the client so that the
  405. // client can retry over TCP
  406. if err != nil && err != dns.ErrTruncated {
  407. r.forwardQueryEnd()
  408. logrus.Debugf("Read from DNS server failed, %s", err)
  409. continue
  410. }
  411. r.forwardQueryEnd()
  412. if resp != nil {
  413. for _, rr := range resp.Answer {
  414. h := rr.Header()
  415. switch h.Rrtype {
  416. case dns.TypeA:
  417. ip := rr.(*dns.A).A
  418. r.backend.HandleQueryResp(h.Name, ip)
  419. case dns.TypeAAAA:
  420. ip := rr.(*dns.AAAA).AAAA
  421. r.backend.HandleQueryResp(h.Name, ip)
  422. }
  423. }
  424. }
  425. resp.Compress = true
  426. break
  427. }
  428. if resp == nil {
  429. return
  430. }
  431. }
  432. if err = w.WriteMsg(resp); err != nil {
  433. logrus.Errorf("error writing resolver resp, %s", err)
  434. }
  435. }
  436. func (r *resolver) forwardQueryStart() bool {
  437. r.queryLock.Lock()
  438. defer r.queryLock.Unlock()
  439. if r.count == maxConcurrent {
  440. return false
  441. }
  442. r.count++
  443. return true
  444. }
  445. func (r *resolver) forwardQueryEnd() {
  446. r.queryLock.Lock()
  447. defer r.queryLock.Unlock()
  448. if r.count == 0 {
  449. logrus.Error("Invalid concurrent query count")
  450. } else {
  451. r.count--
  452. }
  453. }