| #!/usr/bin/env python |
| # Copyright 2010 Google Inc. All Rights Reserved. |
| # |
| # Licensed under the Apache License, Version 2.0 (the "License"); |
| # you may not use this file except in compliance with the License. |
| # You may obtain a copy of the License at |
| # |
| # http://www.apache.org/licenses/LICENSE-2.0 |
| # |
| # Unless required by applicable law or agreed to in writing, software |
| # distributed under the License is distributed on an "AS IS" BASIS, |
| # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| # See the License for the specific language governing permissions and |
| # limitations under the License. |
| |
| import daemonserver |
| import errno |
| import logging |
| import socket |
| import SocketServer |
| import threading |
| import time |
| |
| from third_party.dns import flags |
| from third_party.dns import message |
| from third_party.dns import rcode |
| from third_party.dns import resolver |
| from third_party.dns import rdatatype |
| from third_party import ipaddr |
| |
| |
| |
| class DnsProxyException(Exception): |
| pass |
| |
| |
| class RealDnsLookup(object): |
| def __init__(self, name_servers): |
| if '127.0.0.1' in name_servers: |
| raise DnsProxyException( |
| 'Invalid nameserver: 127.0.0.1 (causes an infinte loop)') |
| self.resolver = resolver.get_default_resolver() |
| self.resolver.nameservers = name_servers |
| self.dns_cache_lock = threading.Lock() |
| self.dns_cache = {} |
| |
| @staticmethod |
| def _IsIPAddress(hostname): |
| try: |
| socket.inet_aton(hostname) |
| return True |
| except socket.error: |
| return False |
| |
| def __call__(self, hostname, rdtype=rdatatype.A): |
| """Return real IP for a host. |
| |
| Args: |
| host: a hostname ending with a period (e.g. "www.google.com.") |
| rdtype: the query type (1 for 'A', 28 for 'AAAA') |
| Returns: |
| the IP address as a string (e.g. "192.168.25.2") |
| """ |
| if self._IsIPAddress(hostname): |
| return hostname |
| self.dns_cache_lock.acquire() |
| ip = self.dns_cache.get(hostname) |
| self.dns_cache_lock.release() |
| if ip: |
| return ip |
| try: |
| answers = self.resolver.query(hostname, rdtype) |
| except resolver.NXDOMAIN: |
| return None |
| except resolver.NoNameservers: |
| logging.debug('_real_dns_lookup(%s) -> No nameserver.', |
| hostname) |
| return None |
| except (resolver.NoAnswer, resolver.Timeout) as ex: |
| logging.debug('_real_dns_lookup(%s) -> None (%s)', |
| hostname, ex.__class__.__name__) |
| return None |
| if answers: |
| ip = str(answers[0]) |
| self.dns_cache_lock.acquire() |
| self.dns_cache[hostname] = ip |
| self.dns_cache_lock.release() |
| return ip |
| |
| def ClearCache(self): |
| """Clear the dns cache.""" |
| self.dns_cache_lock.acquire() |
| self.dns_cache.clear() |
| self.dns_cache_lock.release() |
| |
| |
| class ReplayDnsLookup(object): |
| """Resolve DNS requests to replay host.""" |
| def __init__(self, replay_ip, filters=None): |
| self.replay_ip = replay_ip |
| self.filters = filters or [] |
| |
| def __call__(self, hostname): |
| ip = self.replay_ip |
| for f in self.filters: |
| ip = f(hostname, default_ip=ip) |
| return ip |
| |
| |
| class PrivateIpFilter(object): |
| """Resolve private hosts to their real IPs and others to the Web proxy IP. |
| |
| Hosts in the given http_archive will resolve to the Web proxy IP without |
| checking the real IP. |
| |
| This only supports IPv4 lookups. |
| """ |
| def __init__(self, real_dns_lookup, http_archive): |
| """Initialize PrivateIpDnsLookup. |
| |
| Args: |
| real_dns_lookup: a function that resolves a host to an IP. |
| http_archive: an instance of a HttpArchive |
| Hosts is in the archive will always resolve to the web_proxy_ip |
| """ |
| self.real_dns_lookup = real_dns_lookup |
| self.http_archive = http_archive |
| self.InitializeArchiveHosts() |
| |
| def __call__(self, host, default_ip): |
| """Return real IPv4 for private hosts and Web proxy IP otherwise. |
| |
| Args: |
| host: a hostname ending with a period (e.g. "www.google.com.") |
| Returns: |
| IP address as a string or None (if lookup fails) |
| """ |
| ip = default_ip |
| if host not in self.archive_hosts: |
| real_ip = self.real_dns_lookup(host) |
| if real_ip: |
| if ipaddr.IPAddress(real_ip).is_private: |
| ip = real_ip |
| else: |
| ip = None |
| return ip |
| |
| def InitializeArchiveHosts(self): |
| """Recompute the archive_hosts from the http_archive.""" |
| self.archive_hosts = set('%s.' % req.host.split(':')[0] |
| for req in self.http_archive) |
| |
| |
| class DelayFilter(object): |
| """Add a delay to replayed lookups.""" |
| |
| def __init__(self, is_record_mode, delay_ms): |
| self.is_record_mode = is_record_mode |
| self.delay_ms = int(delay_ms) |
| |
| def __call__(self, host, default_ip): |
| if not self.is_record_mode: |
| time.sleep(self.delay_ms * 1000.0) |
| return default_ip |
| |
| def SetRecordMode(self): |
| self.is_record_mode = True |
| |
| def SetReplayMode(self): |
| self.is_record_mode = False |
| |
| |
| class UdpDnsHandler(SocketServer.DatagramRequestHandler): |
| """Resolve DNS queries to localhost. |
| |
| Possible alternative implementation: |
| http://howl.play-bow.org/pipermail/dnspython-users/2010-February/000119.html |
| """ |
| |
| STANDARD_QUERY_OPERATION_CODE = 0 |
| |
| def handle(self): |
| """Handle a DNS query. |
| |
| IPv6 requests (with rdtype AAAA) receive mismatched IPv4 responses |
| (with rdtype A). To properly support IPv6, the http proxy would |
| need both types of addresses. By default, Windows XP does not |
| support IPv6. |
| """ |
| self.data = self.rfile.read() |
| self.transaction_id = self.data[0] |
| self.flags = self.data[1] |
| self.qa_counts = self.data[4:6] |
| self.domain = '' |
| operation_code = (ord(self.data[2]) >> 3) & 15 |
| if operation_code == self.STANDARD_QUERY_OPERATION_CODE: |
| self.wire_domain = self.data[12:] |
| self.domain = self._domain(self.wire_domain) |
| else: |
| logging.debug("DNS request with non-zero operation code: %s", |
| operation_code) |
| ip = self.server.dns_lookup(self.domain) |
| if ip is None: |
| logging.debug('dnsproxy: %s -> NXDOMAIN', self.domain) |
| response = self.get_dns_no_such_name_response() |
| else: |
| if ip == self.server.server_address[0]: |
| logging.debug('dnsproxy: %s -> %s (replay web proxy)', self.domain, ip) |
| else: |
| logging.debug('dnsproxy: %s -> %s', self.domain, ip) |
| response = self.get_dns_response(ip) |
| self.wfile.write(response) |
| |
| @classmethod |
| def _domain(cls, wire_domain): |
| domain = '' |
| index = 0 |
| length = ord(wire_domain[index]) |
| while length: |
| domain += wire_domain[index + 1:index + length + 1] + '.' |
| index += length + 1 |
| length = ord(wire_domain[index]) |
| return domain |
| |
| def get_dns_response(self, ip): |
| packet = '' |
| if self.domain: |
| packet = ( |
| self.transaction_id + |
| self.flags + |
| '\x81\x80' + # standard query response, no error |
| self.qa_counts * 2 + '\x00\x00\x00\x00' + # Q&A counts |
| self.wire_domain + |
| '\xc0\x0c' # pointer to domain name |
| '\x00\x01' # resource record type ("A" host address) |
| '\x00\x01' # class of the data |
| '\x00\x00\x00\x3c' # ttl (seconds) |
| '\x00\x04' + # resource data length (4 bytes for ip) |
| socket.inet_aton(ip) |
| ) |
| return packet |
| |
| def get_dns_no_such_name_response(self): |
| query_message = message.from_wire(self.data) |
| response_message = message.make_response(query_message) |
| response_message.flags |= flags.AA | flags.RA |
| response_message.set_rcode(rcode.NXDOMAIN) |
| return response_message.to_wire() |
| |
| |
| class DnsProxyServer(SocketServer.ThreadingUDPServer, |
| daemonserver.DaemonServer): |
| # Increase the request queue size. The default value, 5, is set in |
| # SocketServer.TCPServer (the parent of BaseHTTPServer.HTTPServer). |
| # Since we're intercepting many domains through this single server, |
| # it is quite possible to get more than 5 concurrent requests. |
| request_queue_size = 256 |
| |
| # Allow sockets to be reused. See |
| # http://svn.python.org/projects/python/trunk/Lib/SocketServer.py for more |
| # details. |
| allow_reuse_address = True |
| |
| # Don't prevent python from exiting when there is thread activity. |
| daemon_threads = True |
| |
| def __init__(self, host='', port=53, dns_lookup=None): |
| """Initialize DnsProxyServer. |
| |
| Args: |
| host: a host string (name or IP) to bind the dns proxy and to which |
| DNS requests will be resolved. |
| port: an integer port on which to bind the proxy. |
| dns_lookup: a list of filters to apply to lookup. |
| """ |
| try: |
| SocketServer.ThreadingUDPServer.__init__( |
| self, (host, port), UdpDnsHandler) |
| except socket.error, (error_number, msg): |
| if error_number == errno.EACCES: |
| raise DnsProxyException( |
| 'Unable to bind DNS server on (%s:%s)' % (host, port)) |
| raise |
| self.dns_lookup = dns_lookup or (lambda host: self.server_address[0]) |
| self.server_port = self.server_address[1] |
| logging.warning('DNS server started on %s:%d', self.server_address[0], |
| self.server_address[1]) |
| |
| def cleanup(self): |
| try: |
| self.shutdown() |
| self.server_close() |
| except KeyboardInterrupt, e: |
| pass |
| logging.info('Stopped DNS server') |
