2021-09-28 12:42:01 +02:00
|
|
|
package netxlite
|
2021-02-02 12:05:47 +01:00
|
|
|
|
2022-01-03 13:53:23 +01:00
|
|
|
import (
|
2022-05-14 19:38:46 +02:00
|
|
|
"errors"
|
|
|
|
|
2022-01-03 13:53:23 +01:00
|
|
|
"github.com/miekg/dns"
|
|
|
|
"github.com/ooni/probe-cli/v3/internal/model"
|
|
|
|
)
|
2021-02-02 12:05:47 +01:00
|
|
|
|
2021-09-28 10:47:59 +02:00
|
|
|
// DNSDecoderMiekg uses github.com/miekg/dns to implement the Decoder.
|
|
|
|
type DNSDecoderMiekg struct{}
|
2021-02-02 12:05:47 +01:00
|
|
|
|
2022-05-14 19:38:46 +02:00
|
|
|
// ErrDNSReplyWithWrongQueryID indicates we have got a DNS reply with the wrong queryID.
|
|
|
|
var ErrDNSReplyWithWrongQueryID = errors.New(FailureDNSReplyWithWrongQueryID)
|
|
|
|
|
|
|
|
// DecodeReply implements model.DNSDecoder.DecodeReply
|
|
|
|
func (d *DNSDecoderMiekg) DecodeReply(data []byte) (*dns.Msg, error) {
|
2021-02-02 12:05:47 +01:00
|
|
|
reply := new(dns.Msg)
|
|
|
|
if err := reply.Unpack(data); err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
2022-05-14 19:38:46 +02:00
|
|
|
return reply, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
func (d *DNSDecoderMiekg) parseReply(data []byte, queryID uint16) (*dns.Msg, error) {
|
|
|
|
reply, err := d.DecodeReply(data)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
if reply.Id != queryID {
|
|
|
|
return nil, ErrDNSReplyWithWrongQueryID
|
|
|
|
}
|
2021-02-02 12:05:47 +01:00
|
|
|
// TODO(bassosimone): map more errors to net.DNSError names
|
2021-09-27 16:48:46 +02:00
|
|
|
// TODO(bassosimone): add support for lame referral.
|
2021-02-02 12:05:47 +01:00
|
|
|
switch reply.Rcode {
|
|
|
|
case dns.RcodeSuccess:
|
2021-09-27 16:48:46 +02:00
|
|
|
return reply, nil
|
2021-02-02 12:05:47 +01:00
|
|
|
case dns.RcodeNameError:
|
2021-09-28 12:42:01 +02:00
|
|
|
return nil, ErrOODNSNoSuchHost
|
2021-09-27 16:48:46 +02:00
|
|
|
case dns.RcodeRefused:
|
2021-09-28 12:42:01 +02:00
|
|
|
return nil, ErrOODNSRefused
|
2022-05-13 19:25:22 +02:00
|
|
|
case dns.RcodeServerFailure:
|
|
|
|
return nil, ErrOODNSServfail
|
2021-02-02 12:05:47 +01:00
|
|
|
default:
|
2021-09-28 12:42:01 +02:00
|
|
|
return nil, ErrOODNSMisbehaving
|
2021-09-27 16:48:46 +02:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2022-05-14 19:38:46 +02:00
|
|
|
func (d *DNSDecoderMiekg) DecodeHTTPS(data []byte, queryID uint16) (*model.HTTPSSvc, error) {
|
|
|
|
reply, err := d.parseReply(data, queryID)
|
2021-09-27 23:09:41 +02:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
fix(netxlite): HTTPSSvc: better no_answer checks (#727)
I've seen some measurements returning some IP addresses for HTTPSSvc
queries but not returning any ALPN value.
For example:
```
% d4
decoding DNS round trip 0:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 57768
;; flags: rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;psiphon.ca. IN HTTPS
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 57768
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;psiphon.ca. IN HTTPS
;; ANSWER SECTION:
psiphon.ca. 121 IN A 31.13.85.53
```
Now, the response is clearly bogus. At the time of this writing that
IP address belongs to Facebook. This measurement has been collected in
China, so it's expected for the GFW to behave like this.
Yet, I don't feel like it's accurate to report this measurement as a
"no answer" response. Rather, this response is a valid one containing
a clearly invalid IP address and should be flagged as such.
Originally: https://github.com/bassosimone/websteps-illustrated/commit/57a023bcf4ebb1dd9dbdac83c18dc53a165011f8
See https://github.com/ooni/probe/issues/2096
2022-05-13 19:00:51 +02:00
|
|
|
out := &model.HTTPSSvc{
|
|
|
|
ALPN: []string{}, // ensure it's not nil
|
|
|
|
IPv4: []string{}, // ensure it's not nil
|
|
|
|
IPv6: []string{}, // ensure it's not nil
|
|
|
|
}
|
2021-09-27 23:09:41 +02:00
|
|
|
for _, answer := range reply.Answer {
|
|
|
|
switch avalue := answer.(type) {
|
|
|
|
case *dns.HTTPS:
|
|
|
|
for _, v := range avalue.Value {
|
|
|
|
switch extv := v.(type) {
|
|
|
|
case *dns.SVCBAlpn:
|
|
|
|
out.ALPN = extv.Alpn
|
|
|
|
case *dns.SVCBIPv4Hint:
|
|
|
|
for _, ip := range extv.Hint {
|
|
|
|
out.IPv4 = append(out.IPv4, ip.String())
|
|
|
|
}
|
|
|
|
case *dns.SVCBIPv6Hint:
|
|
|
|
for _, ip := range extv.Hint {
|
|
|
|
out.IPv6 = append(out.IPv6, ip.String())
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
fix(netxlite): HTTPSSvc: better no_answer checks (#727)
I've seen some measurements returning some IP addresses for HTTPSSvc
queries but not returning any ALPN value.
For example:
```
% d4
decoding DNS round trip 0:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 57768
;; flags: rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;psiphon.ca. IN HTTPS
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 57768
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;psiphon.ca. IN HTTPS
;; ANSWER SECTION:
psiphon.ca. 121 IN A 31.13.85.53
```
Now, the response is clearly bogus. At the time of this writing that
IP address belongs to Facebook. This measurement has been collected in
China, so it's expected for the GFW to behave like this.
Yet, I don't feel like it's accurate to report this measurement as a
"no answer" response. Rather, this response is a valid one containing
a clearly invalid IP address and should be flagged as such.
Originally: https://github.com/bassosimone/websteps-illustrated/commit/57a023bcf4ebb1dd9dbdac83c18dc53a165011f8
See https://github.com/ooni/probe/issues/2096
2022-05-13 19:00:51 +02:00
|
|
|
if len(out.IPv4) <= 0 && len(out.IPv6) <= 0 {
|
2021-09-28 12:42:01 +02:00
|
|
|
return nil, ErrOODNSNoAnswer
|
2021-09-27 23:09:41 +02:00
|
|
|
}
|
|
|
|
return out, nil
|
|
|
|
}
|
|
|
|
|
2022-05-14 19:38:46 +02:00
|
|
|
func (d *DNSDecoderMiekg) DecodeLookupHost(qtype uint16, data []byte, queryID uint16) ([]string, error) {
|
|
|
|
reply, err := d.parseReply(data, queryID)
|
2021-09-27 16:48:46 +02:00
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
2021-02-02 12:05:47 +01:00
|
|
|
}
|
|
|
|
var addrs []string
|
|
|
|
for _, answer := range reply.Answer {
|
|
|
|
switch qtype {
|
|
|
|
case dns.TypeA:
|
|
|
|
if rra, ok := answer.(*dns.A); ok {
|
|
|
|
ip := rra.A
|
|
|
|
addrs = append(addrs, ip.String())
|
|
|
|
}
|
|
|
|
case dns.TypeAAAA:
|
|
|
|
if rra, ok := answer.(*dns.AAAA); ok {
|
|
|
|
ip := rra.AAAA
|
|
|
|
addrs = append(addrs, ip.String())
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if len(addrs) <= 0 {
|
2021-09-28 12:42:01 +02:00
|
|
|
return nil, ErrOODNSNoAnswer
|
2021-02-02 12:05:47 +01:00
|
|
|
}
|
|
|
|
return addrs, nil
|
|
|
|
}
|
|
|
|
|
2022-01-03 13:53:23 +01:00
|
|
|
var _ model.DNSDecoder = &DNSDecoderMiekg{}
|