1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16 package io.netty.resolver.dns;
17
18 import io.netty.buffer.ByteBuf;
19 import io.netty.handler.codec.dns.DefaultDnsQuestion;
20 import io.netty.handler.codec.dns.DnsOptCookieRecord;
21 import io.netty.handler.codec.dns.DnsQuestion;
22 import io.netty.handler.codec.dns.DnsRawRecord;
23 import io.netty.handler.codec.dns.DnsRecord;
24 import io.netty.handler.codec.dns.DnsRecordType;
25 import io.netty.handler.codec.dns.DnsResponse;
26 import io.netty.handler.codec.dns.DnsSection;
27
28 import java.net.InetSocketAddress;
29 import java.security.SecureRandom;
30 import java.util.Collections;
31 import java.util.Set;
32 import java.util.concurrent.ConcurrentHashMap;
33
34
35
36
37
38
39
40
41
42
43
44
45 final class DnsQueryProtection {
46
47
48
49
50
51 private static final int MAX_COOKIE_SERVERS = 1024;
52
53 private static final String ACE_PREFIX = "xn--";
54
55
56
57
58 enum CookieStatus {
59
60
61
62 ABSENT,
63
64
65
66 VALID,
67
68
69
70 INVALID
71 }
72
73 private final SecureRandom random = new SecureRandom();
74 private final boolean caseRandomization;
75
76 private final Set<InetSocketAddress> cookieServers;
77
78 DnsQueryProtection(boolean caseRandomization, boolean cookies) {
79 this.caseRandomization = caseRandomization;
80 this.cookieServers = cookies ?
81 Collections.newSetFromMap(new ConcurrentHashMap<InetSocketAddress, Boolean>()) : null;
82 }
83
84 boolean isCaseRandomizationEnabled() {
85 return caseRandomization;
86 }
87
88 boolean isCookiesEnabled() {
89 return cookieServers != null;
90 }
91
92
93
94
95 DnsQuestion randomizeCase(DnsQuestion question) {
96 final String name = question.name();
97 final int length = name.length();
98 final char[] chars = name.toCharArray();
99 final byte[] bits = new byte[(length + 7) >>> 3];
100 random.nextBytes(bits);
101
102 int labelStart = 0;
103 while (labelStart < length) {
104 int labelEnd = name.indexOf('.', labelStart);
105 if (labelEnd == -1) {
106 labelEnd = length;
107 }
108
109 if (!name.regionMatches(true, labelStart, ACE_PREFIX, 0, ACE_PREFIX.length())) {
110 for (int i = labelStart; i < labelEnd; i++) {
111 char c = chars[i];
112 if (((c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z')) && (bits[i >>> 3] >>> (i & 7) & 1) != 0) {
113
114 chars[i] = (char) (c ^ 0x20);
115 }
116 }
117 }
118 labelStart = labelEnd + 1;
119 }
120 return new DefaultDnsQuestion(new String(chars), question.type(), question.dnsClass());
121 }
122
123 byte[] newClientCookie() {
124 byte[] cookie = new byte[DnsOptCookieRecord.CLIENT_COOKIE_LENGTH];
125 random.nextBytes(cookie);
126 return cookie;
127 }
128
129
130
131
132
133 boolean isCookieExpected(InetSocketAddress nameServerAddr) {
134 return cookieServers != null && cookieServers.contains(nameServerAddr);
135 }
136
137 void cookieReceived(InetSocketAddress nameServerAddr) {
138 if (cookieServers != null && cookieServers.size() < MAX_COOKIE_SERVERS) {
139 cookieServers.add(nameServerAddr);
140 }
141 }
142
143
144
145
146 static CookieStatus checkCookie(DnsResponse response, byte[] clientCookie) {
147 final int count = response.count(DnsSection.ADDITIONAL);
148 for (int i = 0; i < count; i++) {
149 DnsRecord record = response.recordAt(DnsSection.ADDITIONAL, i);
150 if (record.type() == DnsRecordType.OPT) {
151
152 if (!(record instanceof DnsRawRecord)) {
153 return CookieStatus.INVALID;
154 }
155 return checkCookie(((DnsRawRecord) record).content(), clientCookie);
156 }
157 }
158 return CookieStatus.ABSENT;
159 }
160
161 private static CookieStatus checkCookie(ByteBuf rdata, byte[] clientCookie) {
162
163 int index = rdata.readerIndex();
164 final int end = rdata.writerIndex();
165 CookieStatus status = CookieStatus.ABSENT;
166 while (index < end) {
167 if (end - index < 4) {
168 return CookieStatus.INVALID;
169 }
170 final int code = rdata.getUnsignedShort(index);
171 final int length = rdata.getUnsignedShort(index + 2);
172 index += 4;
173 if (end - index < length) {
174 return CookieStatus.INVALID;
175 }
176 if (code == DnsOptCookieRecord.OPTION_CODE) {
177 if (status != CookieStatus.ABSENT) {
178
179 return CookieStatus.INVALID;
180 }
181
182 if (length != clientCookie.length && (length < clientCookie.length + 8 ||
183 length > clientCookie.length + 32)) {
184 return CookieStatus.INVALID;
185 }
186 status = CookieStatus.VALID;
187
188 int diff = 0;
189 for (int i = 0; i < clientCookie.length; i++) {
190 diff |= rdata.getByte(index + i) ^ clientCookie[i];
191 }
192 if (diff != 0) {
193 return CookieStatus.INVALID;
194 }
195 }
196 index += length;
197 }
198 return status;
199 }
200 }