From 0d40de48c2da9cd24fa656500034f64baf87fd89 Mon Sep 17 00:00:00 2001 From: warptangent Date: Tue, 15 Dec 2015 09:23:17 -0800 Subject: [PATCH 1/2] Optionally restrict DNS queries to TCP Sample use: DNS_PUBLIC=tcp torsocks bin/bitmonerod --p2p-bind-ip 127.0.0.1 Test: Run above with --log-level 4 with and without DNS_PUBLIC environment variable set. DNS debugging info should show successful DNS lookups only when DNS_PUBLIC is set to "tcp": DNS lookup for seeds.moneroseeds.se: 17 results DNS lookup for seeds.moneroseeds.ae.org: 17 results DNS lookup for seeds.moneroseeds.ch: 12 results DNS lookup for seeds.moneroseeds.li: 12 results --- src/common/dns_utils.cpp | 27 ++++++++++++++++++++++++--- 1 file changed, 24 insertions(+), 3 deletions(-) diff --git a/src/common/dns_utils.cpp b/src/common/dns_utils.cpp index 2ae5d9624..41cce68d8 100644 --- a/src/common/dns_utils.cpp +++ b/src/common/dns_utils.cpp @@ -183,12 +183,33 @@ struct DNSResolverData DNSResolver::DNSResolver() : m_data(new DNSResolverData()) { + int use_dns_public = 0; + const char* dns_public_addr = "8.8.4.4"; + if (auto res = getenv("DNS_PUBLIC")) + { + std::string dns_public(res); + // TODO: could allow parsing of IP and protocol: e.g. DNS_PUBLIC=tcp:8.8.8.8 + if (dns_public == "tcp") + { + LOG_PRINT_L0("Using public DNS server: " << dns_public_addr << " (TCP)"); + use_dns_public = 1; + } + } + // init libunbound context m_data->m_ub_context = ub_ctx_create(); - // look for "/etc/resolv.conf" and "/etc/hosts" or platform equivalent - ub_ctx_resolvconf(m_data->m_ub_context, NULL); - ub_ctx_hosts(m_data->m_ub_context, NULL); + if (use_dns_public) + { + ub_ctx_set_fwd(m_data->m_ub_context, dns_public_addr); + ub_ctx_set_option(m_data->m_ub_context, "do-udp:", "no"); + ub_ctx_set_option(m_data->m_ub_context, "do-tcp:", "yes"); + } + else { + // look for "/etc/resolv.conf" and "/etc/hosts" or platform equivalent + ub_ctx_resolvconf(m_data->m_ub_context, NULL); + ub_ctx_hosts(m_data->m_ub_context, NULL); + } #ifdef DEVELOPER_LIBUNBOUND_OLD #pragma message "Using the work around for old libunbound" From 5131b263ed3c45fbf90b5bf88f67690615dfca7a Mon Sep 17 00:00:00 2001 From: warptangent Date: Tue, 15 Dec 2015 09:28:52 -0800 Subject: [PATCH 2/2] Replace tabs and remove trailing whitespace --- src/common/dns_utils.cpp | 48 ++++++++++++++++++++-------------------- 1 file changed, 24 insertions(+), 24 deletions(-) diff --git a/src/common/dns_utils.cpp b/src/common/dns_utils.cpp index 41cce68d8..5bb64d4e5 100644 --- a/src/common/dns_utils.cpp +++ b/src/common/dns_utils.cpp @@ -1,21 +1,21 @@ // Copyright (c) 2014-2015, The Monero Project -// +// // All rights reserved. -// +// // Redistribution and use in source and binary forms, with or without modification, are // permitted provided that the following conditions are met: -// +// // 1. Redistributions of source code must retain the above copyright notice, this list of // conditions and the following disclaimer. -// +// // 2. Redistributions in binary form must reproduce the above copyright notice, this list // of conditions and the following disclaimer in the documentation and/or other // materials provided with the distribution. -// +// // 3. Neither the name of the copyright holder nor the names of its contributors may be // used to endorse or promote products derived from this software without specific // prior written permission. -// +// // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY // EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF // MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL @@ -86,7 +86,7 @@ get_builtin_cert(void) static const char* get_builtin_ds(void) { - return + return ". IN DS 19036 8 2 49AAC11D7B6F6446702E54A1607371607A1A41855200FD2CE1CDDE32F24E8FB5\n"; } @@ -211,23 +211,23 @@ DNSResolver::DNSResolver() : m_data(new DNSResolverData()) ub_ctx_hosts(m_data->m_ub_context, NULL); } - #ifdef DEVELOPER_LIBUNBOUND_OLD - #pragma message "Using the work around for old libunbound" - { // work around for bug https://www.nlnetlabs.nl/bugs-script/show_bug.cgi?id=515 needed for it to compile on e.g. Debian 7 - char * ds_copy = NULL; // this will be the writable copy of string that bugged version of libunbound requires - try { - char * ds_copy = strdup( ::get_builtin_ds() ); - ub_ctx_add_ta(m_data->m_ub_context, ds_copy); - } catch(...) { // probably not needed but to work correctly in every case... - if (ds_copy) { free(ds_copy); ds_copy=NULL; } // for the strdup - throw ; - } - if (ds_copy) { free(ds_copy); ds_copy=NULL; } // for the strdup - } - #else - // normal version for fixed libunbound - ub_ctx_add_ta(m_data->m_ub_context, ::get_builtin_ds() ); - #endif + #ifdef DEVELOPER_LIBUNBOUND_OLD + #pragma message "Using the work around for old libunbound" + { // work around for bug https://www.nlnetlabs.nl/bugs-script/show_bug.cgi?id=515 needed for it to compile on e.g. Debian 7 + char * ds_copy = NULL; // this will be the writable copy of string that bugged version of libunbound requires + try { + char * ds_copy = strdup( ::get_builtin_ds() ); + ub_ctx_add_ta(m_data->m_ub_context, ds_copy); + } catch(...) { // probably not needed but to work correctly in every case... + if (ds_copy) { free(ds_copy); ds_copy=NULL; } // for the strdup + throw ; + } + if (ds_copy) { free(ds_copy); ds_copy=NULL; } // for the strdup + } + #else + // normal version for fixed libunbound + ub_ctx_add_ta(m_data->m_ub_context, ::get_builtin_ds() ); + #endif }