nrpt.hpp

Go to the documentation of this file.

//    OpenVPN -- An application to securely tunnel IP networks
//               over a single port, with support for SSL/TLS-based
//               session authentication and key exchange,
//               packet encryption, packet authentication, and
//               packet compression.
//
//    Copyright (C) 2012- OpenVPN Inc.
//
//    SPDX-License-Identifier: MPL-2.0 OR AGPL-3.0-only WITH openvpn3-openssl-exception
//
//
 
#pragma once
 
#include <string>
#include <sstream>
#include <vector>
#include <array>
#include <algorithm>
 
#include <openvpn/common/exception.hpp>
#include <openvpn/common/string.hpp>
#include <openvpn/common/wstring.hpp>
#include <openvpn/common/action.hpp>
#include <openvpn/win/reg.hpp>
#include <openvpn/win/netutil.hpp>
#include <openvpn/win/winerr.hpp>
 
namespace openvpn::TunWin {
 
template <typename REG, typename NETAPI>
class Nrpt
{
  public:
    OPENVPN_EXCEPTION(nrpt_error);
 
    static void create_rule(const std::string &rule_id,
                            const std::wstring &domains,
                            const std::wstring &servers,
                            bool dnssec)
    {
        LSTATUS status;
 
        // Open / create the key
        typename REG::Key nrpt = open_nrpt_base_key();
        if (!nrpt.defined())
        {
            throw nrpt_error("cannot open NRPT base key");
        }
        typename REG::Key rule_key(nrpt(), wstring::from_utf8(rule_id), true);
        if (!rule_key.defined())
        {
            throw nrpt_error("cannot create NRPT rule subkey");
        }
 
        // Name
        status = REG::set_multi_string(rule_key, L"Name", domains);
        check_reg_error<nrpt_error>(status, "Name");
 
        // GenericDNSServers
        status = REG::set_string(rule_key, L"GenericDNSServers", servers);
        check_reg_error<nrpt_error>(status, "GenericDNSServers");
 
        // DNSSEC
        if (dnssec)
        {
            status = REG::set_dword(rule_key, L"DNSSECValidationRequired", 1);
            check_reg_error<nrpt_error>(status, "DNSSECValidationRequired");
 
            status = REG::set_dword(rule_key, L"DNSSECQueryIPSECRequired", 0);
            check_reg_error<nrpt_error>(status, "DNSSECQueryIPSECRequired");
 
            status = REG::set_dword(rule_key, L"DNSSECQueryIPSECEncryption", 0);
            check_reg_error<nrpt_error>(status, "DNSSECQueryIPSECEncryption");
        }
 
        // ConfigOptions
        // 0x8: Only the Generic DNS server option is specified.
        // 0xA: The Generic DNS server option and the DNSSEC options are specified
        status = REG::set_dword(rule_key, L"ConfigOptions", dnssec ? 0xA : 0x8);
        check_reg_error<nrpt_error>(status, "ConfigOptions");
 
        // Version
        status = REG::set_dword(rule_key, L"Version", 2);
        check_reg_error<nrpt_error>(status, "Version");
    }
 
    static void create_exclude_rules(DWORD process_id, const std::vector<std::wstring> &search_domains)
    {
        std::uint32_t n = 0;
        const auto data = collect_exclude_rule_data(search_domains);
        for (const auto &exclude : data)
        {
            const auto id = exclude_rule_id(process_id, n++);
            create_rule(id, exclude.domains, string::join(exclude.addresses, L";"), false);
        }
    }
 
    static void delete_rules(DWORD process_id)
    {
        std::vector<std::wstring> del_subkeys;
        static constexpr std::array<PCWSTR, 2> nrpt_subkeys{
            REG::gpol_nrpt_subkey, REG::local_nrpt_subkey};
        // Only find rules to delete, so that the iterator stays valid
        for (const auto &nrpt_subkey : nrpt_subkeys)
        {
            const auto pid = L"-" + std::to_wstring(process_id);
            typename REG::Key nrpt_key(nrpt_subkey);
            typename REG::KeyEnumerator nrpt_rules(nrpt_key);
 
            for (const auto &nrpt_rule_id : nrpt_rules)
            {
                // remove only own policies
                if (nrpt_rule_id.find(wstring::from_utf8(id_prefix())) != 0)
                    continue;
                if (process_id && nrpt_rule_id.rfind(pid) != (nrpt_rule_id.size() - pid.size()))
                    continue;
 
                std::wostringstream rule_subkey;
                rule_subkey << nrpt_subkey << L"\\" << nrpt_rule_id;
                del_subkeys.push_back(rule_subkey.str());
            }
        }
        // Now delete the rules
        for (const auto &subkey : del_subkeys)
        {
            REG::delete_subkey(subkey);
        }
    }
 
  private:
    struct ExcludeRuleData
    {
        std::wstring domains;
        std::vector<std::wstring> addresses;
    };
 
    static std::vector<std::wstring> interface_ipv4_dns_servers(const std::wstring &itf_guid)
    {
        typename REG::Key itf_key(std::wstring(REG::subkey_ipv4_itfs) + L"\\" + itf_guid);
 
        auto [servers, error] = REG::get_string(itf_key, L"NameServer");
        if (!error && !servers.empty())
        {
            return string::split(servers, ',');
        }
 
        if (dhcp_enabled_on_itf<REG>(itf_key))
        {
            auto [servers, error] = REG::get_string(itf_key, L"DhcpNameServer");
            if (!error && !servers.empty())
            {
                return string::split(servers, ' ');
            }
        }
 
        return {};
    }
 
    static std::vector<std::wstring> interface_ipv6_dns_servers(const std::wstring &itf_guid)
    {
        typename REG::Key itf_key(std::wstring(REG::subkey_ipv6_itfs) + L"\\" + itf_guid);
 
        auto [servers, error] = REG::get_string(itf_key, L"NameServer");
        if (!error && !servers.empty())
        {
            return string::split(servers, ',');
        }
 
        if (dhcp_enabled_on_itf<REG>(itf_key))
        {
            auto [in6_addrs, error] = REG::get_binary(itf_key, L"Dhcpv6DNSServers");
            if (!error)
            {
                std::vector<std::wstring> addresses;
                size_t in6_addr_count = in6_addrs.size() / sizeof(IN6_ADDR);
                for (size_t i = 0; i < in6_addr_count; ++i)
                {
                    WCHAR ipv6[64];
                    IN6_ADDR *in6_addr = reinterpret_cast<IN6_ADDR *>(in6_addrs.data()) + i;
                    if (::InetNtopW(AF_INET6, in6_addr, ipv6, _countof(ipv6)))
                    {
                        addresses.emplace_back(ipv6);
                    }
                }
                return addresses;
            }
        }
 
        return {};
    }
 
    static std::vector<ExcludeRuleData> collect_exclude_rule_data(const std::vector<std::wstring> &sd)
    {
        std::vector<ExcludeRuleData> data;
        typename REG::Key itfs(REG::subkey_ipv4_itfs);
        typename REG::KeyEnumerator itf_guids(itfs);
        for (const auto &itf_guid : itf_guids)
        {
            // Ignore interfaces that are not connected or disabled
            if (!NETAPI::interface_connected(itf_guid))
            {
                continue;
            }
 
            std::wstring domain = interface_dns_domain<REG>(itf_guid);
            if (domain.empty() || std::find(sd.begin(), sd.end(), domain) != sd.end())
            {
                continue;
            }
 
            // Get the DNS server addresses for the interface domain
            auto addresses = interface_ipv4_dns_servers(itf_guid);
            const auto addr6 = interface_ipv6_dns_servers(itf_guid);
            addresses.insert(addresses.end(), addr6.begin(), addr6.end());
            if (addresses.empty())
            {
                continue;
            }
 
            // Add a leading '.' to the domain and convert it to MULTI_SZ
            domain.resize(domain.size() + 3);
            domain.insert(domain.begin(), L'.');
            domain.push_back(L'\0');
            domain.push_back(L'\0');
 
            data.push_back({domain, addresses});
        }
        return data;
    }
 
    static typename REG::Key open_nrpt_base_key()
    {
        typename REG::Key key(REG::gpol_nrpt_subkey);
        if (key.defined())
        {
            return key;
        }
        return typename REG::Key(REG::local_nrpt_subkey);
    }
 
    static const char *id_prefix()
    {
        static const char prefix[] = "OpenVPNDNSRouting";
        return prefix;
    }
 
    static std::string gen_rule_id(DWORD process_id, bool exclude_rule, std::uint32_t n)
    {
        std::ostringstream ss;
        ss << id_prefix();
        if (exclude_rule)
        {
            ss << "X-" << n;
        }
        ss << "-" << process_id;
        return ss.str();
    }
 
  public:
    static inline std::string rule_id(DWORD process_id)
    {
        return gen_rule_id(process_id, false, 0u);
    }
 
    static inline std::string exclude_rule_id(DWORD process_id, std::uint32_t n)
    {
        return gen_rule_id(process_id, true, n);
    }
    class ActionCreate : public Action
    {
      public:
        ActionCreate(DWORD process_id,
                     const std::vector<std::string> &split_domains,
                     const std::vector<std::string> &dns_servers,
                     const std::vector<std::wstring> &search_domains,
                     bool dnssec)
            : process_id_(process_id),
              split_domains_(split_domains),
              dns_servers_(dns_servers),
              search_domains_(search_domains),
              dnssec_(dnssec)
        {
        }
 
        void execute(std::ostream &log) override
        {
            // Convert domains into a wide MULTI_SZ string
            std::wstring domains;
            if (split_domains_.empty())
            {
                // --dns options did not specify any domains to resolve.
                domains = L".";
                domains.push_back(L'\0');
                domains.push_back(L'\0');
                create_exclude_rules(process_id_, search_domains_);
            }
            else
            {
                domains = wstring::pack_string_vector(split_domains_);
            }
 
            const std::string id = rule_id(process_id_);
            const std::wstring servers = wstring::from_utf8(string::join(dns_servers_, ";"));
            log << to_string() << " id=[" << id << "]" << std::endl;
            create_rule(id, domains, servers, dnssec_);
        }
 
        std::string to_string() const override
        {
            std::ostringstream os;
            os << "NRPT::ActionCreate"
               << " pid=[" << process_id_ << "]"
               << " domains=[" << string::join(split_domains_, ",") << "]"
               << " dns_servers=[" << string::join(dns_servers_, ",") << "]"
               << " dnssec=[" << dnssec_ << "]";
            return os.str();
        }
 
      private:
        DWORD process_id_;
        const std::vector<std::string> split_domains_;
        const std::vector<std::string> dns_servers_;
        const std::vector<std::wstring> search_domains_;
        const bool dnssec_;
    };
 
    class ActionDelete : public Action
    {
      public:
        ActionDelete(DWORD process_id)
            : process_id_(process_id)
        {
        }
 
        void execute(std::ostream &log) override
        {
            log << to_string() << std::endl;
            delete_rules(process_id_);
        }
 
        std::string to_string() const override
        {
            std::ostringstream ss;
            ss << "NRPT::ActionDelete pid=[" << process_id_ << "]";
            return ss.str();
        }
 
      protected:
        DWORD process_id_;
    };
};
 
using NRPT = Nrpt<Win::Reg, Win::NetApi>;
 
} // namespace openvpn::TunWin