dns_options.hpp

Go to the documentation of this file.

//    OpenVPN -- An application to securely tunnel IP networks
//               over a single port, with support for SSL/TLS-based
//               session authentication and key exchange,
//               packet encryption, packet authentication, and
//               packet compression.
//
//    Copyright (C) 2022- OpenVPN Inc.
//
//    SPDX-License-Identifier: MPL-2.0 OR AGPL-3.0-only WITH openvpn3-openssl-exception
//
 
 
#pragma once
 
#include <map>
#include <vector>
#include <algorithm>
#include <sstream>
 
#include <openvpn/common/number.hpp>
#include <openvpn/common/option_error.hpp>
#include <openvpn/common/jsonlib.hpp>
#include <openvpn/common/hostport.hpp>
#include <openvpn/addr/ip.hpp>
 
#ifdef HAVE_JSON
#ifndef OPENVPN_JSON
#include <json/json.h>
#endif
#include <openvpn/common/jsonhelper.hpp>
#endif
 
namespace openvpn {
 
struct DnsAddress
{
    DnsAddress() = default;
    virtual ~DnsAddress() noexcept = default;
 
    explicit DnsAddress(const std::string &address_input)
    {
        IP::Addr addr;
        std::string addr_str = address_input;
        port = 0;
 
        bool ipv6_bracket_encaps = address_input.length() > 2
                                   && address_input[0] == '['
                                   && address_input.rfind(']') != std::string::npos;
 
        auto first_colon_pos = address_input.find(':');
        auto last_colon_pos = address_input.rfind(':');
        const bool v6_port_found = ipv6_bracket_encaps
                                   && last_colon_pos > address_input.rfind(']');
 
        const bool v4_port_found = first_colon_pos != std::string::npos
                                   && first_colon_pos == addr_str.rfind(':');
 
        if (v6_port_found || v4_port_found)
        {
            std::string port_str;
            if (!HostPort::split_host_port(address_input, addr_str, port_str, "", false, &port))
            {
                OPENVPN_THROW_EXCEPTION("Invalid address:port format '" << address_input << "'");
            }
 
            // If it was an IPv6 address, the bracket encapsulation has been removed
            // by HostPort::split_host_port()
            ipv6_bracket_encaps = false;
        }
 
        try
        {
            if (ipv6_bracket_encaps)
            {
                addr_str = addr_str.substr(1, addr_str.length() - 2);
            }
            addr = IP::Addr(addr_str, "dns-ip-address");
        }
        catch (const IP::ip_exception &)
        {
            OPENVPN_THROW_EXCEPTION("Invalid address '" << addr_str << "'");
        }
        address = addr.to_string();
    }
 
 
    std::string to_string() const
    {
        std::ostringstream os;
 
        const IP::Addr addr(address);
        os << (addr.is_ipv6() && port ? "[" : "")
           << address
           << (addr.is_ipv6() && port ? "]" : "");
 
        if (port)
        {
            os << ":" << port;
        }
        return os.str();
    }
 
    void validate(const std::string &title) const
    {
        IP::Addr::validate(address, title);
    }
 
#ifdef HAVE_JSON
    Json::Value to_json() const
    {
        Json::Value root(Json::objectValue);
        root["address"] = Json::Value(address);
        if (port)
        {
            root["port"] = Json::Value(port);
        }
        return root;
    }
 
    void from_json(const Json::Value &root, const std::string &title)
    {
        json::assert_dict(root, title);
        json::to_uint_optional(root, port, "port", 0U, title);
 
        std::string addr_str;
        json::to_string(root, addr_str, "address", title);
        address = IP::Addr::from_string(addr_str).to_string();
    }
#endif
 
    bool operator==(const DnsAddress &) const = default;
 
    std::string address;
    unsigned int port = 0;
};
 
struct DnsDomain
{
    DnsDomain() = default;
    virtual ~DnsDomain() noexcept = default;
 
    explicit DnsDomain(const std::string &domain_)
    {
        domain = domain_;
    }
 
    std::string to_string() const
    {
        return domain;
    }
 
    void validate(const std::string &title) const
    {
        HostPort::validate_host(domain, title);
    }
 
#ifdef HAVE_JSON
    Json::Value to_json() const
    {
        return Json::Value(domain);
    }
 
    void from_json(const Json::Value &value, const std::string &title)
    {
        if (!value.isString())
        {
            throw json::json_parse("string " + title + " is of incorrect type");
        }
        domain = value.asString();
    }
#endif
 
    std::string domain;
 
    bool operator==(const DnsDomain &) const = default;
};
 
struct DnsServer
{
    enum class Security
    {
        Unset,   
        No,      
        Yes,     
        Optional 
    };
 
    static std::string dnssec_string(const Security dnssec)
    {
        switch (dnssec)
        {
        case Security::No:
            return "No";
        case Security::Yes:
            return "Yes";
        case Security::Optional:
            return "Optional";
        default:
            return "Unset";
        }
    }
 
 
    std::string dnssec_string() const
    {
        return dnssec_string(dnssec);
    }
 
 
    void parse_dnssec_value(const std::string &dnssec_value)
    {
        if (dnssec_value == "yes")
        {
            dnssec = DnsServer::Security::Yes;
        }
        else if (dnssec_value == "no")
        {
            dnssec = DnsServer::Security::No;
        }
        else if (dnssec_value == "optional")
        {
            dnssec = DnsServer::Security::Optional;
        }
        else
        {
            OPENVPN_THROW_EXCEPTION("Invalid DNSSEC value '" << dnssec_value << "'");
        }
    }
 
    enum class Transport
    {
        Unset, 
        Plain, 
        HTTPS, 
        TLS    
    };
 
    static std::string transport_string(const Transport transport)
    {
        switch (transport)
        {
        case Transport::Plain:
            return "Plain";
        case Transport::HTTPS:
            return "HTTPS";
        case Transport::TLS:
            return "TLS";
        default:
            return "Unset";
        }
    }
 
    std::string transport_string() const
    {
        return transport_string(transport);
    }
 
    void parse_transport_value(const std::string &transport_value)
    {
        if (transport_value == "plain")
        {
            transport = DnsServer::Transport::Plain;
        }
        else if (transport_value == "DoH")
        {
            transport = DnsServer::Transport::HTTPS;
        }
        else if (transport_value == "DoT")
        {
            transport = DnsServer::Transport::TLS;
        }
        else
        {
            OPENVPN_THROW_EXCEPTION("Invalid transport value '" << transport_value << "'");
        }
    }
 
    DnsServer() = default;
    virtual ~DnsServer() noexcept = default;
 
#ifdef HAVE_JSON
    explicit DnsServer(const Json::Value &root, const std::string &title = "")
    {
        from_json(root, title);
    }
#endif
 
    std::string to_string(const char *prefix = "") const
    {
        std::ostringstream os;
        os << prefix << "Addresses:\n";
        for (const auto &address : addresses)
        {
            os << prefix << "  " << address.to_string() << '\n';
        }
        if (!domains.empty())
        {
            os << prefix << "Domains:\n";
            for (const auto &domain : domains)
            {
                os << prefix << "  " << domain.to_string() << '\n';
            }
        }
        if (dnssec != Security::Unset)
        {
            os << prefix << "DNSSEC: " << dnssec_string(dnssec) << '\n';
        }
        if (transport != Transport::Unset)
        {
            os << prefix << "Transport: " << transport_string(transport) << '\n';
        }
        if (!sni.empty())
        {
            os << prefix << "SNI: " << sni << '\n';
        }
        return os.str();
    }
 
#ifdef HAVE_JSON
    Json::Value to_json() const
    {
        Json::Value server(Json::objectValue);
        json::from_vector(server, addresses, "addresses");
        if (!domains.empty())
        {
            json::from_vector(server, domains, "domains");
        }
        if (dnssec != Security::Unset)
        {
            server["dnssec"] = Json::Value(dnssec_string(dnssec));
        }
        if (transport != Transport::Unset)
        {
            server["transport"] = Json::Value(transport_string(transport));
        }
        if (!sni.empty())
        {
            server["sni"] = Json::Value(sni);
        }
        return server;
    }
 
    void from_json(const Json::Value &root, const std::string &title)
    {
        json::assert_dict(root, title);
        json::to_vector(root, addresses, "addresses", title);
        if (json::exists(root, "domains"))
        {
            json::to_vector(root, domains, "domains", title);
        }
        if (json::exists(root, "dnssec"))
        {
            std::string dnssec_str;
            json::to_string(root, dnssec_str, "dnssec", title);
            if (dnssec_str == "Optional")
            {
                dnssec = Security::Optional;
            }
            else if (dnssec_str == "Yes")
            {
                dnssec = Security::Yes;
            }
            else if (dnssec_str == "No")
            {
                dnssec = Security::No;
            }
            else
            {
                throw json::json_parse("dnssec value " + dnssec_str + "is unknown");
            }
        }
        if (json::exists(root, "transport"))
        {
            std::string transport_str;
            json::to_string(root, transport_str, "transport", title);
            if (transport_str == "Plain")
            {
                transport = Transport::Plain;
            }
            else if (transport_str == "HTTPS")
            {
                transport = Transport::HTTPS;
            }
            else if (transport_str == "TLS")
            {
                transport = Transport::TLS;
            }
            else
            {
                throw json::json_parse("transport value " + transport_str + "is unknown");
            }
        }
        json::to_string_optional(root, sni, "sni", "", title);
    }
#endif
 
    bool operator==(const DnsServer &at) const = default;
 
    std::vector<DnsAddress> addresses;
 
    std::vector<DnsDomain> domains;
 
    Security dnssec = Security::Unset;
 
    Transport transport = Transport::Unset;
 
    std::string sni;
};
 
struct DnsOptions
{
    DnsOptions() = default;
    ~DnsOptions() noexcept = default;
 
#ifdef HAVE_JSON
    explicit DnsOptions(const Json::Value &root, const std::string &title = "")
    {
        from_json(root, title);
    }
#endif
 
    std::string to_string() const
    {
        std::ostringstream os;
        if (!servers.empty())
        {
            os << "DNS Servers:\n";
            for (const auto &[priority, server] : servers)
            {
                os << "  Priority: " << priority << '\n';
                os << server.to_string("  ");
            }
        }
        if (!search_domains.empty())
        {
            os << "DNS Search Domains:\n";
            for (const auto &domain : search_domains)
            {
                os << "  " << domain.to_string() << '\n';
            }
        }
        os << "Values from dhcp-options: " << (from_dhcp_options ? "true" : "false") << '\n';
        return os.str();
    }
 
#ifdef HAVE_JSON
    Json::Value to_json() const
    {
        Json::Value root(Json::objectValue);
        Json::Value servers_json(Json::objectValue);
        for (const auto &[prio, server] : servers)
        {
            servers_json[std::to_string(prio)] = server.to_json();
        }
        root["servers"] = std::move(servers_json);
        json::from_vector(root, search_domains, "search_domains");
        root["from_dhcp_options"] = Json::Value(from_dhcp_options);
        return root;
    }
 
    void from_json(const Json::Value &root, const std::string &title)
    {
        json::assert_dict(root, title);
        json::assert_dict(root["servers"], title);
        for (const auto &prio : root["servers"].getMemberNames())
        {
            DnsServer server(root["servers"][prio], title);
            servers[std::stoi(prio)] = std::move(server);
        }
        json::to_vector(root, search_domains, "search_domains", title);
        json::to_bool(root, from_dhcp_options, "from_dhcp_options", title);
    }
#endif
 
    bool operator==(const DnsOptions &at) const = default;
 
    bool from_dhcp_options = false;        
    std::vector<DnsDomain> search_domains; 
    std::map<int, DnsServer> servers;      
 
  protected:
    DnsServer &get_server(const int priority)
    {
        auto it = servers.insert(std::make_pair(priority, DnsServer())).first;
        return (*it).second;
    }
};
 
} // namespace openvpn