|
| 1 | +// Copyright 2026 Alibaba Group Holding Ltd. |
| 2 | +// |
| 3 | +// Licensed under the Apache License, Version 2.0 (the "License"); |
| 4 | +// you may not use this file except in compliance with the License. |
| 5 | +// You may obtain a copy of the License at |
| 6 | +// |
| 7 | +// http://www.apache.org/licenses/LICENSE-2.0 |
| 8 | +// |
| 9 | +// Unless required by applicable law or agreed to in writing, software |
| 10 | +// distributed under the License is distributed on an "AS IS" BASIS, |
| 11 | +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 12 | +// See the License for the specific language governing permissions and |
| 13 | +// limitations under the License. |
| 14 | + |
| 15 | +package dnsproxy |
| 16 | + |
| 17 | +import ( |
| 18 | + "context" |
| 19 | + "fmt" |
| 20 | + "log" |
| 21 | + "net" |
| 22 | + "os" |
| 23 | + "time" |
| 24 | + |
| 25 | + "github.com/miekg/dns" |
| 26 | + |
| 27 | + "github.com/alibaba/opensandbox/egress/pkg/policy" |
| 28 | +) |
| 29 | + |
| 30 | +const defaultListenAddr = "127.0.0.1:15353" |
| 31 | + |
| 32 | +type Proxy struct { |
| 33 | + policy *policy.NetworkPolicy |
| 34 | + listenAddr string |
| 35 | + upstream string // single upstream for MVP |
| 36 | + servers []*dns.Server |
| 37 | +} |
| 38 | + |
| 39 | +// New builds a proxy with resolved upstream; listenAddr can be empty for default. |
| 40 | +func New(p *policy.NetworkPolicy, listenAddr string) (*Proxy, error) { |
| 41 | + if listenAddr == "" { |
| 42 | + listenAddr = defaultListenAddr |
| 43 | + } |
| 44 | + upstream, err := discoverUpstream() |
| 45 | + if err != nil { |
| 46 | + return nil, err |
| 47 | + } |
| 48 | + return &Proxy{ |
| 49 | + policy: p, |
| 50 | + listenAddr: listenAddr, |
| 51 | + upstream: upstream, |
| 52 | + }, nil |
| 53 | +} |
| 54 | + |
| 55 | +func (p *Proxy) Start(ctx context.Context) error { |
| 56 | + handler := dns.HandlerFunc(p.serveDNS) |
| 57 | + |
| 58 | + udpServer := &dns.Server{Addr: p.listenAddr, Net: "udp", Handler: handler} |
| 59 | + tcpServer := &dns.Server{Addr: p.listenAddr, Net: "tcp", Handler: handler} |
| 60 | + p.servers = []*dns.Server{udpServer, tcpServer} |
| 61 | + |
| 62 | + errCh := make(chan error, len(p.servers)) |
| 63 | + for _, srv := range p.servers { |
| 64 | + s := srv |
| 65 | + go func() { |
| 66 | + if err := s.ListenAndServe(); err != nil { |
| 67 | + errCh <- err |
| 68 | + } |
| 69 | + }() |
| 70 | + } |
| 71 | + |
| 72 | + // Shutdown on context done |
| 73 | + go func() { |
| 74 | + <-ctx.Done() |
| 75 | + for _, srv := range p.servers { |
| 76 | + _ = srv.Shutdown() |
| 77 | + } |
| 78 | + }() |
| 79 | + |
| 80 | + select { |
| 81 | + case err := <-errCh: |
| 82 | + return fmt.Errorf("dns proxy failed: %w", err) |
| 83 | + case <-time.After(200 * time.Millisecond): |
| 84 | + // small grace window; running fine |
| 85 | + return nil |
| 86 | + } |
| 87 | +} |
| 88 | + |
| 89 | +func (p *Proxy) serveDNS(w dns.ResponseWriter, r *dns.Msg) { |
| 90 | + if len(r.Question) == 0 { |
| 91 | + _ = w.WriteMsg(new(dns.Msg)) // empty response |
| 92 | + return |
| 93 | + } |
| 94 | + q := r.Question[0] |
| 95 | + domain := q.Name |
| 96 | + |
| 97 | + if p.policy != nil && p.policy.Evaluate(domain) == policy.ActionDeny { |
| 98 | + resp := new(dns.Msg) |
| 99 | + resp.SetRcode(r, dns.RcodeNameError) |
| 100 | + _ = w.WriteMsg(resp) |
| 101 | + return |
| 102 | + } |
| 103 | + |
| 104 | + resp, err := p.forward(r) |
| 105 | + if err != nil { |
| 106 | + log.Printf("[dns] forward error for %s: %v", domain, err) |
| 107 | + fail := new(dns.Msg) |
| 108 | + fail.SetRcode(r, dns.RcodeServerFailure) |
| 109 | + _ = w.WriteMsg(fail) |
| 110 | + return |
| 111 | + } |
| 112 | + _ = w.WriteMsg(resp) |
| 113 | +} |
| 114 | + |
| 115 | +func (p *Proxy) forward(r *dns.Msg) (*dns.Msg, error) { |
| 116 | + c := &dns.Client{ |
| 117 | + Timeout: 5 * time.Second, |
| 118 | + Dialer: p.dialerWithMark(), |
| 119 | + } |
| 120 | + resp, _, err := c.Exchange(r, p.upstream) |
| 121 | + return resp, err |
| 122 | +} |
| 123 | + |
| 124 | +// UpstreamHost returns the host part of the upstream resolver, empty on parse error. |
| 125 | +func (p *Proxy) UpstreamHost() string { |
| 126 | + host, _, err := net.SplitHostPort(p.upstream) |
| 127 | + if err != nil { |
| 128 | + return "" |
| 129 | + } |
| 130 | + return host |
| 131 | +} |
| 132 | + |
| 133 | +func discoverUpstream() (string, error) { |
| 134 | + cfg, err := dns.ClientConfigFromFile("/etc/resolv.conf") |
| 135 | + if err == nil && len(cfg.Servers) > 0 { |
| 136 | + return net.JoinHostPort(cfg.Servers[0], cfg.Port), nil |
| 137 | + } |
| 138 | + // fallback to public resolver; comment to explain deterministic behavior |
| 139 | + log.Printf("[dns] fallback upstream resolver due to error: %v", err) |
| 140 | + return "8.8.8.8:53", nil |
| 141 | +} |
| 142 | + |
| 143 | +// LoadPolicyFromEnv reads OPENSANDBOX_NETWORK_POLICY and parses it. |
| 144 | +func LoadPolicyFromEnv() (*policy.NetworkPolicy, error) { |
| 145 | + raw := os.Getenv("OPENSANDBOX_NETWORK_POLICY") |
| 146 | + if raw == "" { |
| 147 | + return nil, nil |
| 148 | + } |
| 149 | + return policy.ParsePolicy(raw) |
| 150 | +} |
0 commit comments