open-consul/command/agent/dns.go

572 lines
14 KiB
Go
Raw Normal View History

2014-01-02 21:12:05 +00:00
package agent
import (
"fmt"
2014-01-03 01:58:58 +00:00
"github.com/hashicorp/consul/consul/structs"
2014-01-02 21:12:05 +00:00
"github.com/miekg/dns"
"io"
"log"
"math/rand"
2014-01-03 01:58:58 +00:00
"net"
"strings"
2014-01-02 21:12:05 +00:00
"time"
)
2014-01-03 01:58:58 +00:00
const (
testQuery = "_test.consul."
consulDomain = "consul."
maxServiceResponses = 3 // For UDP only
2014-02-26 01:41:48 +00:00
maxRecurseRecords = 3
2014-01-03 01:58:58 +00:00
)
2014-01-02 21:12:05 +00:00
// DNSServer is used to wrap an Agent and expose various
// service discovery endpoints using a DNS interface.
type DNSServer struct {
2014-01-03 23:43:35 +00:00
agent *Agent
dnsHandler *dns.ServeMux
dnsServer *dns.Server
dnsServerTCP *dns.Server
domain string
recursor string
logger *log.Logger
2014-01-02 21:12:05 +00:00
}
// NewDNSServer starts a new DNS server to provide an agent interface
2014-01-03 23:43:35 +00:00
func NewDNSServer(agent *Agent, logOutput io.Writer, domain, bind, recursor string) (*DNSServer, error) {
2014-01-03 01:58:58 +00:00
// Make sure domain is FQDN
domain = dns.Fqdn(domain)
2014-01-02 21:12:05 +00:00
// Construct the DNS components
mux := dns.NewServeMux()
2014-01-03 23:43:35 +00:00
// Setup the servers
2014-01-02 21:12:05 +00:00
server := &dns.Server{
Addr: bind,
Net: "udp",
Handler: mux,
UDPSize: 65535,
}
2014-01-03 23:43:35 +00:00
serverTCP := &dns.Server{
Addr: bind,
Net: "tcp",
Handler: mux,
}
2014-01-02 21:12:05 +00:00
// Create the server
srv := &DNSServer{
2014-01-03 23:43:35 +00:00
agent: agent,
dnsHandler: mux,
dnsServer: server,
dnsServerTCP: serverTCP,
domain: domain,
recursor: recursor,
logger: log.New(logOutput, "", log.LstdFlags),
2014-01-02 21:12:05 +00:00
}
2014-01-03 01:58:58 +00:00
// Register mux handlers, always handle "consul."
mux.HandleFunc(domain, srv.handleQuery)
if domain != consulDomain {
mux.HandleFunc(consulDomain, srv.handleTest)
}
2014-01-03 23:43:35 +00:00
if recursor != "" {
recursor, err := recursorAddr(recursor)
if err != nil {
return nil, fmt.Errorf("Invalid recursor address: %v", err)
}
srv.recursor = recursor
2014-01-03 23:43:35 +00:00
mux.HandleFunc(".", srv.handleRecurse)
}
2014-01-02 21:12:05 +00:00
2014-01-03 23:43:35 +00:00
// Async start the DNS Servers, handle a potential error
2014-01-02 21:12:05 +00:00
errCh := make(chan error, 1)
go func() {
err := server.ListenAndServe()
2014-01-03 23:43:35 +00:00
srv.logger.Printf("[ERR] dns: error starting udp server: %v", err)
2014-01-02 21:12:05 +00:00
errCh <- err
}()
2014-01-03 23:43:35 +00:00
errChTCP := make(chan error, 1)
go func() {
err := serverTCP.ListenAndServe()
srv.logger.Printf("[ERR] dns: error starting tcp server: %v", err)
errChTCP <- err
}()
2014-01-02 21:12:05 +00:00
// Check the server is running, do a test lookup
checkCh := make(chan error, 1)
go func() {
// This is jank, but we have no way to edge trigger on
// the start of our server, so we just wait and hope it is up.
time.Sleep(50 * time.Millisecond)
m := new(dns.Msg)
2014-01-03 01:58:58 +00:00
m.SetQuestion(testQuery, dns.TypeANY)
2014-01-02 21:12:05 +00:00
c := new(dns.Client)
in, _, err := c.Exchange(m, bind)
if err != nil {
checkCh <- err
return
}
if len(in.Answer) == 0 {
checkCh <- fmt.Errorf("no response to test message")
return
}
close(checkCh)
}()
// Wait for either the check, listen error, or timeout
select {
case e := <-errCh:
return srv, e
2014-01-03 23:43:35 +00:00
case e := <-errChTCP:
return srv, e
2014-01-02 21:12:05 +00:00
case e := <-checkCh:
return srv, e
case <-time.After(time.Second):
return srv, fmt.Errorf("timeout setting up DNS server")
}
return srv, nil
}
// recursorAddr is used to add a port to the recursor if omitted.
func recursorAddr(recursor string) (string, error) {
// Add the port if none
START:
_, _, err := net.SplitHostPort(recursor)
if ae, ok := err.(*net.AddrError); ok && ae.Err == "missing port in address" {
recursor = fmt.Sprintf("%s:%d", recursor, 53)
goto START
}
if err != nil {
return "", err
}
// Get the address
addr, err := net.ResolveTCPAddr("tcp", recursor)
if err != nil {
return "", err
}
// Return string
return addr.String(), nil
}
2014-01-03 01:58:58 +00:00
// handleQUery is used to handle DNS queries in the configured domain
func (d *DNSServer) handleQuery(resp dns.ResponseWriter, req *dns.Msg) {
q := req.Question[0]
defer func(s time.Time) {
d.logger.Printf("[DEBUG] dns: request for %v (%v)", q, time.Now().Sub(s))
}(time.Now())
// Check if this is potentially a test query
if q.Name == testQuery {
d.handleTest(resp, req)
return
}
// Switch to TCP if the client is
network := "udp"
if _, ok := resp.RemoteAddr().(*net.TCPAddr); ok {
network = "tcp"
}
2014-01-03 01:58:58 +00:00
// Setup the message response
m := new(dns.Msg)
m.SetReply(req)
m.Authoritative = true
2014-02-26 01:41:48 +00:00
m.RecursionAvailable = (d.recursor != "")
// Only add the SOA if requested
if req.Question[0].Qtype == dns.TypeSOA {
d.addSOA(d.domain, m)
}
2014-01-03 01:58:58 +00:00
// Dispatch the correct handler
d.dispatch(network, req, m)
2014-01-03 23:43:35 +00:00
// Write out the complete response
if err := resp.WriteMsg(m); err != nil {
d.logger.Printf("[WARN] dns: failed to respond: %v", err)
}
2014-01-03 01:58:58 +00:00
}
// handleTest is used to handle DNS queries in the ".consul." domain
func (d *DNSServer) handleTest(resp dns.ResponseWriter, req *dns.Msg) {
2014-01-02 21:12:05 +00:00
q := req.Question[0]
2014-01-03 01:58:58 +00:00
defer func(s time.Time) {
d.logger.Printf("[DEBUG] dns: request for %v (%v)", q, time.Now().Sub(s))
}(time.Now())
2014-01-02 21:12:05 +00:00
2014-01-03 01:58:58 +00:00
if !(q.Qtype == dns.TypeANY || q.Qtype == dns.TypeTXT) {
return
}
if q.Name != testQuery {
2014-01-02 21:12:05 +00:00
return
}
// Always respond with TXT "ok"
m := new(dns.Msg)
m.SetReply(req)
m.Authoritative = true
m.RecursionAvailable = true
2014-01-02 21:12:05 +00:00
header := dns.RR_Header{Name: q.Name, Rrtype: dns.TypeTXT, Class: dns.ClassINET, Ttl: 0}
txt := &dns.TXT{header, []string{"ok"}}
m.Answer = append(m.Answer, txt)
2014-01-03 01:58:58 +00:00
d.addSOA(consulDomain, m)
2014-01-03 23:43:35 +00:00
if err := resp.WriteMsg(m); err != nil {
d.logger.Printf("[WARN] dns: failed to respond: %v", err)
}
2014-01-02 21:12:05 +00:00
}
// addSOA is used to add an SOA record to a message for the given domain
func (d *DNSServer) addSOA(domain string, msg *dns.Msg) {
soa := &dns.SOA{
Hdr: dns.RR_Header{
Name: domain,
Rrtype: dns.TypeSOA,
Class: dns.ClassINET,
Ttl: 0,
},
Ns: "ns." + domain,
Mbox: "postmaster." + domain,
Serial: uint32(time.Now().Unix()),
Refresh: 3600,
Retry: 600,
Expire: 86400,
Minttl: 0,
}
msg.Ns = append(msg.Ns, soa)
}
2014-01-03 01:58:58 +00:00
// dispatch is used to parse a request and invoke the correct handler
func (d *DNSServer) dispatch(network string, req, resp *dns.Msg) {
2014-01-03 01:58:58 +00:00
// By default the query is in the default datacenter
datacenter := d.agent.config.Datacenter
// Get the QName without the domain suffix
qName := dns.Fqdn(req.Question[0].Name)
qName = strings.TrimSuffix(qName, d.domain)
// Split into the label parts
labels := dns.SplitDomainName(qName)
// The last label is either "node", "service" or a datacenter name
PARSE:
if len(labels) == 0 {
goto INVALID
}
switch labels[len(labels)-1] {
case "service":
// Handle lookup with and without tag
switch len(labels) {
case 2:
d.serviceLookup(network, datacenter, labels[0], "", req, resp)
2014-01-03 01:58:58 +00:00
case 3:
d.serviceLookup(network, datacenter, labels[1], labels[0], req, resp)
2014-01-03 01:58:58 +00:00
default:
goto INVALID
}
case "node":
if len(labels) != 2 {
goto INVALID
}
d.nodeLookup(network, datacenter, labels[0], req, resp)
2014-01-03 01:58:58 +00:00
default:
// Store the DC, and re-parse
datacenter = labels[len(labels)-1]
labels = labels[:len(labels)-1]
goto PARSE
}
return
INVALID:
d.logger.Printf("[WARN] dns: QName invalid: %s", qName)
resp.SetRcode(req, dns.RcodeNameError)
}
// nodeLookup is used to handle a node query
func (d *DNSServer) nodeLookup(network, datacenter, node string, req, resp *dns.Msg) {
2014-01-03 01:58:58 +00:00
// Only handle ANY and A type requests
qType := req.Question[0].Qtype
if qType != dns.TypeANY && qType != dns.TypeA {
return
}
// Make an RPC request
2014-01-08 23:13:27 +00:00
args := structs.NodeSpecificRequest{
2014-01-03 01:58:58 +00:00
Datacenter: datacenter,
Node: node,
}
var out structs.IndexedNodeServices
2014-01-03 01:58:58 +00:00
if err := d.agent.RPC("Catalog.NodeServices", &args, &out); err != nil {
d.logger.Printf("[ERR] dns: rpc error: %v", err)
resp.SetRcode(req, dns.RcodeServerFailure)
return
}
// If we have no address, return not found!
2014-03-05 23:03:23 +00:00
if out.NodeServices == nil {
2014-01-03 01:58:58 +00:00
resp.SetRcode(req, dns.RcodeNameError)
return
}
// Add the node record
2014-02-26 01:41:48 +00:00
records := d.formatNodeRecord(&out.NodeServices.Node, req.Question[0].Name, qType)
if records != nil {
resp.Answer = append(resp.Answer, records...)
2014-01-03 01:58:58 +00:00
}
}
2014-01-03 01:58:58 +00:00
// formatNodeRecord takes a Node and returns an A, AAAA, or CNAME record
2014-02-26 01:41:48 +00:00
func (d *DNSServer) formatNodeRecord(node *structs.Node, qName string, qType uint16) (records []dns.RR) {
// Parse the IP
ip := net.ParseIP(node.Address)
var ipv4 net.IP
if ip != nil {
ipv4 = ip.To4()
}
switch {
case ipv4 != nil && (qType == dns.TypeANY || qType == dns.TypeA):
2014-02-26 01:41:48 +00:00
return []dns.RR{&dns.A{
Hdr: dns.RR_Header{
Name: qName,
Rrtype: dns.TypeA,
Class: dns.ClassINET,
Ttl: 0,
},
A: ip,
2014-02-26 01:41:48 +00:00
}}
case ip != nil && ipv4 == nil && (qType == dns.TypeANY || qType == dns.TypeAAAA):
2014-02-26 01:41:48 +00:00
return []dns.RR{&dns.AAAA{
Hdr: dns.RR_Header{
Name: qName,
Rrtype: dns.TypeAAAA,
Class: dns.ClassINET,
Ttl: 0,
},
AAAA: ip,
2014-02-26 01:41:48 +00:00
}}
2014-01-03 01:58:58 +00:00
2014-02-26 01:41:48 +00:00
case ip == nil && (qType == dns.TypeANY || qType == dns.TypeCNAME ||
qType == dns.TypeA || qType == dns.TypeAAAA):
// Get the CNAME
cnRec := &dns.CNAME{
Hdr: dns.RR_Header{
Name: qName,
Rrtype: dns.TypeCNAME,
Class: dns.ClassINET,
Ttl: 0,
},
Target: dns.Fqdn(node.Address),
}
2014-02-26 01:41:48 +00:00
records = append(records, cnRec)
// Recurse
more := d.resolveCNAME(cnRec.Target)
extra := 0
MORE_REC:
for _, rr := range more {
switch rr.Header().Rrtype {
case dns.TypeA:
fallthrough
case dns.TypeAAAA:
records = append(records, rr)
extra++
if extra == maxRecurseRecords {
break MORE_REC
}
}
}
}
2014-02-26 01:41:48 +00:00
return records
2014-01-03 01:58:58 +00:00
}
// serviceLookup is used to handle a service query
func (d *DNSServer) serviceLookup(network, datacenter, service, tag string, req, resp *dns.Msg) {
2014-01-03 21:00:03 +00:00
// Make an RPC request
2014-01-08 23:13:27 +00:00
args := structs.ServiceSpecificRequest{
2014-01-03 21:00:03 +00:00
Datacenter: datacenter,
ServiceName: service,
ServiceTag: tag,
TagFilter: tag != "",
}
var out structs.IndexedCheckServiceNodes
2014-01-15 21:20:01 +00:00
if err := d.agent.RPC("Health.ServiceNodes", &args, &out); err != nil {
2014-01-03 21:00:03 +00:00
d.logger.Printf("[ERR] dns: rpc error: %v", err)
resp.SetRcode(req, dns.RcodeServerFailure)
return
}
// If we have no nodes, return not found!
if len(out.Nodes) == 0 {
2014-01-03 21:00:03 +00:00
resp.SetRcode(req, dns.RcodeNameError)
return
}
// Filter out any service nodes due to health checks
out.Nodes = d.filterServiceNodes(out.Nodes)
// Perform a random shuffle
shuffleServiceNodes(out.Nodes)
// If the network is not TCP, restrict the number of responses
if network != "tcp" && len(out.Nodes) > maxServiceResponses {
out.Nodes = out.Nodes[:maxServiceResponses]
}
2014-01-03 21:00:03 +00:00
// Add various responses depending on the request
qType := req.Question[0].Qtype
d.serviceNodeRecords(out.Nodes, req, resp)
2014-02-26 01:41:48 +00:00
if qType == dns.TypeSRV {
d.serviceSRVRecords(datacenter, out.Nodes, req, resp)
2014-01-03 21:00:03 +00:00
}
}
// filterServiceNodes is used to filter out nodes that are failing
// health checks to prevent routing to unhealthy nodes
func (d *DNSServer) filterServiceNodes(nodes structs.CheckServiceNodes) structs.CheckServiceNodes {
n := len(nodes)
for i := 0; i < n; i++ {
node := nodes[i]
for _, check := range node.Checks {
if check.Status == structs.HealthCritical {
d.logger.Printf("[WARN] dns: node '%s' failing health check '%s: %s', dropping from service '%s'",
node.Node.Node, check.CheckID, check.Name, node.Service.Service)
nodes[i], nodes[n-1] = nodes[n-1], structs.CheckServiceNode{}
n--
i--
}
}
}
return nodes[:n]
}
// shuffleServiceNodes does an in-place random shuffle using the Fisher-Yates algorithm
func shuffleServiceNodes(nodes structs.CheckServiceNodes) {
for i := len(nodes) - 1; i > 0; i-- {
j := rand.Int31() % int32(i+1)
nodes[i], nodes[j] = nodes[j], nodes[i]
}
}
// serviceNodeRecords is used to add the node records for a service lookup
func (d *DNSServer) serviceNodeRecords(nodes structs.CheckServiceNodes, req, resp *dns.Msg) {
qName := req.Question[0].Name
qType := req.Question[0].Qtype
handled := make(map[string]struct{})
2014-01-03 21:00:03 +00:00
for _, node := range nodes {
// Avoid duplicate entries, possible if a node has
// the same service on multiple ports, etc.
2014-01-15 21:20:01 +00:00
addr := node.Node.Address
if _, ok := handled[addr]; ok {
continue
}
2014-01-15 21:20:01 +00:00
handled[addr] = struct{}{}
// Add the node record
2014-02-26 01:41:48 +00:00
records := d.formatNodeRecord(&node.Node, qName, qType)
if records != nil {
resp.Answer = append(resp.Answer, records...)
2014-01-03 21:00:03 +00:00
}
}
}
// serviceARecords is used to add the SRV records for a service lookup
2014-01-15 21:20:01 +00:00
func (d *DNSServer) serviceSRVRecords(dc string, nodes structs.CheckServiceNodes, req, resp *dns.Msg) {
handled := make(map[string]struct{})
2014-01-03 21:00:03 +00:00
for _, node := range nodes {
// Avoid duplicate entries, possible if a node has
// the same service the same port, etc.
2014-01-15 21:20:01 +00:00
tuple := fmt.Sprintf("%s:%d", node.Node.Node, node.Service.Port)
if _, ok := handled[tuple]; ok {
continue
}
handled[tuple] = struct{}{}
// Add the SRV record
2014-01-03 21:00:03 +00:00
srvRec := &dns.SRV{
Hdr: dns.RR_Header{
Name: req.Question[0].Name,
Rrtype: dns.TypeSRV,
Class: dns.ClassINET,
Ttl: 0,
},
Priority: 1,
Weight: 1,
2014-01-15 21:20:01 +00:00
Port: uint16(node.Service.Port),
Target: fmt.Sprintf("%s.node.%s.%s", node.Node.Node, dc, d.domain),
2014-01-03 21:00:03 +00:00
}
resp.Answer = append(resp.Answer, srvRec)
// Add the extra record
2014-02-26 01:41:48 +00:00
records := d.formatNodeRecord(&node.Node, srvRec.Target, dns.TypeANY)
if records != nil {
resp.Extra = append(resp.Extra, records...)
2014-01-03 21:00:03 +00:00
}
}
2014-01-03 01:58:58 +00:00
}
2014-01-03 23:43:35 +00:00
// handleRecurse is used to handle recursive DNS queries
func (d *DNSServer) handleRecurse(resp dns.ResponseWriter, req *dns.Msg) {
q := req.Question[0]
network := "udp"
defer func(s time.Time) {
d.logger.Printf("[DEBUG] dns: request for %v (%s) (%v)", q, network, time.Now().Sub(s))
}(time.Now())
// Switch to TCP if the client is
if _, ok := resp.RemoteAddr().(*net.TCPAddr); ok {
network = "tcp"
}
// Recursively resolve
c := &dns.Client{Net: network}
r, rtt, err := c.Exchange(req, d.recursor)
// On failure, return a SERVFAIL message
if err != nil {
d.logger.Printf("[ERR] dns: recurse failed: %v", err)
m := &dns.Msg{}
m.SetReply(req)
m.RecursionAvailable = true
2014-01-03 23:43:35 +00:00
m.SetRcode(req, dns.RcodeServerFailure)
resp.WriteMsg(m)
return
}
d.logger.Printf("[DEBUG] dns: recurse RTT for %v (%v)", q, rtt)
// Forward the response
if err := resp.WriteMsg(r); err != nil {
d.logger.Printf("[WARN] dns: failed to respond: %v", err)
}
}
// resolveCNAME is used to recursively resolve CNAME records
func (d *DNSServer) resolveCNAME(name string) []dns.RR {
// Do nothing if we don't have a recursor
if d.recursor == "" {
return nil
}
// Ask for any A records
m := new(dns.Msg)
m.SetQuestion(name, dns.TypeA)
// Make a DNS lookup request
c := &dns.Client{Net: "udp"}
r, rtt, err := c.Exchange(m, d.recursor)
if err != nil {
d.logger.Printf("[ERR] dns: cname recurse failed: %v", err)
return nil
}
d.logger.Printf("[DEBUG] dns: cname recurse RTT for %v (%v)", name, rtt)
// Return all the answers
return r.Answer
}