diff --git a/common/http-api-client/Cargo.toml b/common/http-api-client/Cargo.toml index 411f9ad846..e748e37888 100644 --- a/common/http-api-client/Cargo.toml +++ b/common/http-api-client/Cargo.toml @@ -33,7 +33,6 @@ tracing = { workspace = true } itertools = { workspace = true } inventory = { workspace = true } tokio = { workspace = true, features = ["rt", "macros", "time"] } - # used for decoding text responses (they were already implicitly included) bytes = { workspace = true } encoding_rs = { workspace = true } diff --git a/common/http-api-client/src/dns.rs b/common/http-api-client/src/dns.rs index 016f4383f7..158a867f4e 100644 --- a/common/http-api-client/src/dns.rs +++ b/common/http-api-client/src/dns.rs @@ -30,7 +30,9 @@ use crate::ClientBuilder; use std::{ - net::SocketAddr, + collections::HashMap, + net::{IpAddr, SocketAddr}, + str::FromStr, sync::{Arc, LazyLock}, time::Duration, }; @@ -38,12 +40,16 @@ use std::{ use hickory_resolver::{ TokioResolver, config::{LookupIpStrategy, NameServerConfigGroup, ResolverConfig, ServerOrderingStrategy}, - lookup_ip::{LookupIp, LookupIpIntoIter}, + lookup_ip::LookupIpIntoIter, name_server::TokioConnectionProvider, }; use once_cell::sync::OnceCell; use reqwest::dns::{Addrs, Name, Resolve, Resolving}; -use tracing::{info, warn}; +use tracing::*; + +mod constants; +mod static_resolver; +pub use static_resolver::*; impl ClientBuilder { /// Override the DNS resolver implementation used by the underlying http client. @@ -60,10 +66,6 @@ impl ClientBuilder { } } -struct SocketAddrs { - iter: LookupIpIntoIter, -} - // n.b. static items do not call [`Drop`] on program termination, so this won't be deallocated. // this is fine, as the OS can deallocate the terminated program faster than we can free memory // but tools like valgrind might report "memory leaks" as it isn't obvious this is intentional. @@ -76,10 +78,14 @@ static SHARED_RESOLVER: LazyLock = LazyLock::new(|| { #[allow(missing_docs)] /// Error occurring while resolving a hostname into an IP address. pub enum ResolveError { + #[error("invalid name: {0}")] + InvalidNameError(String), #[error("hickory-dns resolver error: {0}")] - HickoryDnsError(#[from] hickory_resolver::ResolveError), + ResolveError(#[from] hickory_resolver::ResolveError), #[error("high level lookup timed out")] Timeout, + #[error("hostname not found in static lookup table")] + StaticLookupMiss, } /// Wrapper around an `AsyncResolver`, which implements the `Resolve` trait. @@ -97,6 +103,7 @@ pub struct HickoryDnsResolver { // construction of the resolver. state: Arc>, fallback: Option>>, + static_base: Option>>, dont_use_shared: bool, /// Overall timeout for dns lookup associated with any individual host resolution. For example, /// use of retries, server_ordering_strategy, etc. ends absolutely if this timeout is reached. @@ -108,6 +115,7 @@ impl Default for HickoryDnsResolver { Self { state: Default::default(), fallback: Default::default(), + static_base: Default::default(), dont_use_shared: Default::default(), overall_dns_timeout: Duration::from_secs(10), } @@ -118,60 +126,86 @@ impl Resolve for HickoryDnsResolver { fn resolve(&self, name: Name) -> Resolving { let resolver = self.state.clone(); let maybe_fallback = self.fallback.clone(); + let maybe_static = self.static_base.clone(); let independent = self.dont_use_shared; let overall_dns_timeout = self.overall_dns_timeout; Box::pin(async move { - let resolver = resolver.get_or_try_init(|| { - // using a closure here is slightly gross, but this makes sure that if the - // lazy-init returns an error it can be handled by the client - if independent { - new_resolver() - } else { - Ok(SHARED_RESOLVER.state.get_or_try_init(new_resolver)?.clone()) - } - })?; + resolve( + name, + resolver, + maybe_fallback, + maybe_static, + independent, + overall_dns_timeout, + ) + .await + .map_err(|e| Box::new(e) as Box) + }) + } +} - let resolve_fut = - tokio::time::timeout(overall_dns_timeout, resolver.lookup_ip(name.as_str())); - - // try the primary DNS resolver that we set up (DoH or DoT or whatever) - let lookup = match resolve_fut.await { - Ok(Ok(res)) => res, - Err(_) => return Err(ResolveError::Timeout.into()), - Ok(Err(e)) => { - if let Some(ref fallback) = maybe_fallback { - // on failure use the fall back system configured DNS resolver - if !e.is_no_records_found() { - warn!("primary DNS failed w/ error {e}: using system fallback"); - } - let resolver = fallback.get_or_try_init(|| { - // using a closure here is slightly gross, but this makes sure that if the - // lazy-init returns an error it can be handled by the client - if independent { - new_resolver_system() - } else { - Ok(SHARED_RESOLVER - .fallback - .as_ref() - .ok_or(e)? // if the shared resolver has no fallback return the original error - .get_or_try_init(new_resolver_system)? - .clone()) - } - })?; - - resolver.lookup_ip(name.as_str()).await? - } else { - return Err(e.into()); - } - } - }; +async fn resolve( + name: Name, + resolver: Arc>, + maybe_fallback: Option>>, + maybe_static: Option>>, + independent: bool, + overall_dns_timeout: Duration, +) -> Result { + let resolver = resolver.get_or_try_init(|| HickoryDnsResolver::new_resolver(independent))?; + // Attempt a lookup using the primary resolver + let resolve_fut = tokio::time::timeout(overall_dns_timeout, resolver.lookup_ip(name.as_str())); + let primary_err = match resolve_fut.await { + Err(_) => ResolveError::Timeout, + Ok(Ok(lookup)) => { let addrs: Addrs = Box::new(SocketAddrs { iter: lookup.into_iter(), }); - Ok(addrs) - }) + return Ok(addrs); + } + Ok(Err(e)) => { + // on failure use the fall back system configured DNS resolver + if !e.is_no_records_found() { + warn!("primary DNS failed w/ error: {e}"); + } + e.into() + } + }; + + // If the primary resolver encountered an error, attempt a lookup using the fallback + // resolver if one is configured. + if let Some(ref fallback) = maybe_fallback { + let resolver = + fallback.get_or_try_init(|| HickoryDnsResolver::new_resolver_system(independent))?; + + let resolve_fut = + tokio::time::timeout(overall_dns_timeout, resolver.lookup_ip(name.as_str())); + if let Ok(Ok(lookup)) = resolve_fut.await { + let addrs: Addrs = Box::new(SocketAddrs { + iter: lookup.into_iter(), + }); + return Ok(addrs); + } } + + // If no record has been found and a static map of fallback addresses is configured + // check the table for our entry + if let Some(ref static_resolver) = maybe_static { + debug!("checking static"); + let resolver = + static_resolver.get_or_init(|| HickoryDnsResolver::new_static_fallback(independent)); + + if let Ok(addrs) = resolver.resolve(name).await { + return Ok(addrs); + } + } + + Err(primary_err) +} + +struct SocketAddrs { + iter: LookupIpIntoIter, } impl Iterator for SocketAddrs { @@ -184,30 +218,18 @@ impl Iterator for SocketAddrs { impl HickoryDnsResolver { /// Attempt to resolve a domain name to a set of ['IpAddr']s - pub async fn resolve_str(&self, name: &str) -> Result { - let resolver = self.state.get_or_try_init(|| self.new_resolver())?; - let resolve_fut = tokio::time::timeout(self.overall_dns_timeout, resolver.lookup_ip(name)); - - // try the primary DNS resolver that we set up (DoH or DoT or whatever) - let lookup = match resolve_fut.await { - Ok(Ok(res)) => res, - Err(_) => return Err(ResolveError::Timeout), - Ok(Err(e)) => { - if let Some(ref fallback) = self.fallback { - // on failure use the fall back system configured DNS resolver - if !e.is_no_records_found() { - warn!("primary DNS failed w/ error {e}: using system fallback"); - } - - let resolver = fallback.get_or_try_init(|| self.new_resolver_system())?; - resolver.lookup_ip(name).await? - } else { - return Err(e.into()); - } - } - }; - - Ok(lookup) + pub async fn resolve_str(&self, name: &str) -> Result { + let n = + Name::from_str(name).map_err(|_| ResolveError::InvalidNameError(name.to_string()))?; + resolve( + n, + self.state.clone(), + self.fallback.clone(), + self.static_base.clone(), + self.dont_use_shared, + self.overall_dns_timeout, + ) + .await } /// Create a (lazy-initialized) resolver that is not shared across threads. @@ -218,16 +240,20 @@ impl HickoryDnsResolver { } } - fn new_resolver(&self) -> Result { - if self.dont_use_shared { + fn new_resolver(dont_use_shared: bool) -> Result { + // using a closure here is slightly gross, but this makes sure that if the + // lazy-init returns an error it can be handled by the client + if dont_use_shared { new_resolver() } else { Ok(SHARED_RESOLVER.state.get_or_try_init(new_resolver)?.clone()) } } - fn new_resolver_system(&self) -> Result { - if self.dont_use_shared || SHARED_RESOLVER.fallback.is_none() { + fn new_resolver_system(dont_use_shared: bool) -> Result { + // using a closure here is slightly gross, but this makes sure that if the + // lazy-init returns an error it can be handled by the client + if dont_use_shared || SHARED_RESOLVER.fallback.is_none() { new_resolver_system() } else { Ok(SHARED_RESOLVER @@ -239,6 +265,16 @@ impl HickoryDnsResolver { } } + fn new_static_fallback(dont_use_shared: bool) -> StaticResolver { + if !dont_use_shared && let Some(ref shared_resolver) = SHARED_RESOLVER.static_base { + shared_resolver + .get_or_init(new_default_static_fallback) + .clone() + } else { + new_default_static_fallback() + } + } + /// Enable fallback to the system default resolver if the primary (DoX) resolver fails pub fn enable_system_fallback(&mut self) -> Result<(), ResolveError> { self.fallback = Some(Default::default()); @@ -255,6 +291,20 @@ impl HickoryDnsResolver { pub fn disable_system_fallback(&mut self) { self.fallback = None; } + + /// Get the current map of hostname to address in use by the fallback static lookup if one + /// exists. + pub fn get_static_fallbacks(&self) -> Option>> { + Some(self.static_base.as_ref()?.get()?.get_addrs()) + } + + /// Set (or overwrite) the map of addresses used in the fallback static hostname lookup + pub fn set_static_fallbacks(&mut self, addrs: HashMap>) { + let cell = OnceCell::new(); + cell.set(StaticResolver::new(addrs)) + .expect("infallible assign"); + self.static_base = Some(Arc::new(cell)); + } } /// Create a new resolver with a custom DoT based configuration. The options are overridden to look @@ -301,9 +351,15 @@ fn new_resolver_system() -> Result { Ok(resolver_builder.build()) } +fn new_default_static_fallback() -> StaticResolver { + StaticResolver::new(constants::default_static_addrs()) +} + #[cfg(test)] mod test { use super::*; + use itertools::Itertools; + use std::collections::HashMap; #[tokio::test] async fn reqwest_with_custom_dns() { @@ -337,6 +393,31 @@ mod test { Ok(()) } + + #[tokio::test] + async fn static_resolver_as_fallback() -> Result<(), ResolveError> { + let example_domain = "non-existent.nymvpn.com"; + let mut resolver = HickoryDnsResolver { + ..Default::default() + }; + + let result = resolver.resolve_str(example_domain).await; + assert!(result.is_err()); // should be NXDomain + + resolver.static_base = Some(Default::default()); + + let mut addr_map = HashMap::new(); + let example_ip4: IpAddr = "10.10.10.10".parse().unwrap(); + let example_ip6: IpAddr = "dead::beef".parse().unwrap(); + addr_map.insert(example_domain.to_string(), vec![example_ip4, example_ip6]); + + resolver.set_static_fallbacks(addr_map); + + let mut addrs = resolver.resolve_str(example_domain).await?; + assert!(addrs.contains(&SocketAddr::new(example_ip4, 0))); + assert!(addrs.contains(&SocketAddr::new(example_ip6, 0))); + Ok(()) + } } #[cfg(test)] @@ -388,6 +469,7 @@ mod failure_test { let resolver = HickoryDnsResolver { dont_use_shared: true, state: Arc::new(r), + overall_dns_timeout: Duration::from_secs(5), ..Default::default() }; build_broken_resolver()?; @@ -400,4 +482,35 @@ mod failure_test { Ok(()) } + + #[tokio::test] + async fn fallback_to_static() -> Result<(), ResolveError> { + let r = OnceCell::new(); + r.set(build_broken_resolver().expect("failed to build resolver")) + .expect("broken resolver init error"); + + // create a new resolver that won't mess with the shared resolver used by other tests + let resolver = HickoryDnsResolver { + dont_use_shared: true, + state: Arc::new(r), + static_base: Some(Default::default()), + overall_dns_timeout: Duration::from_secs(5), + ..Default::default() + }; + build_broken_resolver()?; + + // successful lookup using fallback to static resolver + let domain = "nymvpn.com"; + let _ = resolver + .resolve_str(domain) + .await + .expect("failed to resolve address in static lookup"); + + // unsuccessful lookup - primary times out, and not in + let domain = "non-existent.nymtech.net"; + let result = resolver.resolve_str(domain).await; + assert!(result.is_err_and(|e| matches!(e, ResolveError::Timeout))); + + Ok(()) + } } diff --git a/common/http-api-client/src/dns/constants.rs b/common/http-api-client/src/dns/constants.rs new file mode 100644 index 0000000000..0672188f9b --- /dev/null +++ b/common/http-api-client/src/dns/constants.rs @@ -0,0 +1,73 @@ +#![allow(missing_docs)] + +use std::collections::HashMap; +use std::net::{IpAddr, Ipv4Addr}; + +pub const NYM_API_DOMAIN: &str = "validator.nymtech.net"; +pub const NYM_API_IPS: &[IpAddr] = &[IpAddr::V4(Ipv4Addr::new(212, 71, 233, 232))]; + +pub const NYM_VPN_API_DOMAIN: &str = "nymvpn.com"; +pub const NYM_VPN_API_IPS: &[IpAddr] = &[IpAddr::V4(Ipv4Addr::new(76, 76, 21, 21))]; + +pub const NYM_FRONTDOOR_VERCEL_DOMAIN: &str = "nym-frontdoor.vercel.app"; +pub const NYM_FRONTDOOR_VERCEL_IPS: &[IpAddr] = &[ + IpAddr::V4(Ipv4Addr::new(64, 29, 17, 195)), + IpAddr::V4(Ipv4Addr::new(216, 198, 79, 195)), +]; + +pub const NYM_FRONTDOOR_FASTLY_DOMAIN: &str = "nym-frontdoor.global.ssl.fastly.net"; +pub const NYM_FRONTDOOR_FASTLY_IPS: &[IpAddr] = &[ + IpAddr::V4(Ipv4Addr::new(151, 101, 193, 194)), + IpAddr::V4(Ipv4Addr::new(151, 101, 129, 194)), + IpAddr::V4(Ipv4Addr::new(151, 101, 1, 194)), + IpAddr::V4(Ipv4Addr::new(151, 101, 65, 194)), +]; + +pub const NYMVPN_FRONTDOOR_FASTLY_DOMAIN: &str = "nymvpn-frontdoor.global.ssl.fastly.net"; +pub const NYMVPN_FRONTDOOR_FASTLY_IPS: &[IpAddr] = &[ + IpAddr::V4(Ipv4Addr::new(151, 101, 193, 194)), + IpAddr::V4(Ipv4Addr::new(151, 101, 129, 194)), + IpAddr::V4(Ipv4Addr::new(151, 101, 1, 194)), + IpAddr::V4(Ipv4Addr::new(151, 101, 65, 194)), +]; + +pub const VERCEL_APP_DOMAIN: &str = "vercel.app"; +pub const VERCEL_APP_IPS: &[IpAddr] = &[ + IpAddr::V4(Ipv4Addr::new(64, 29, 17, 195)), + IpAddr::V4(Ipv4Addr::new(216, 198, 79, 195)), +]; + +pub const VERCEL_COM_DOMAIN: &str = "vercel.com"; +pub const VERCEL_COM_IPS: &[IpAddr] = &[ + IpAddr::V4(Ipv4Addr::new(198, 169, 2, 129)), + IpAddr::V4(Ipv4Addr::new(198, 169, 1, 193)), +]; + +pub const NYM_COM_DOMAIN: &str = "nym.com"; +pub const NYM_COM_IPS: &[IpAddr] = &[IpAddr::V4(Ipv4Addr::new(76, 76, 21, 22))]; + +pub const NYM_STATS_API_DOMAIN: &str = "nym-statistics-api.nymtech.cc"; +pub const NYM_STATS_API_IPS: &[IpAddr] = &[IpAddr::V4(Ipv4Addr::new(91, 92, 153, 96))]; + +pub fn default_static_addrs() -> HashMap> { + let mut m = HashMap::new(); + m.insert(NYM_API_DOMAIN.to_string(), NYM_API_IPS.to_vec()); + m.insert(NYM_VPN_API_DOMAIN.to_string(), NYM_VPN_API_IPS.to_vec()); + m.insert( + NYM_FRONTDOOR_VERCEL_DOMAIN.to_string(), + NYM_FRONTDOOR_VERCEL_IPS.to_vec(), + ); + m.insert( + NYM_FRONTDOOR_FASTLY_DOMAIN.to_string(), + NYM_FRONTDOOR_FASTLY_IPS.to_vec(), + ); + m.insert( + NYMVPN_FRONTDOOR_FASTLY_DOMAIN.to_string(), + NYMVPN_FRONTDOOR_FASTLY_IPS.to_vec(), + ); + m.insert(VERCEL_APP_DOMAIN.to_string(), VERCEL_APP_IPS.to_vec()); + m.insert(VERCEL_COM_DOMAIN.to_string(), VERCEL_COM_IPS.to_vec()); + m.insert(NYM_COM_DOMAIN.to_string(), NYM_COM_IPS.to_vec()); + m.insert(NYM_STATS_API_DOMAIN.to_string(), NYM_STATS_API_IPS.to_vec()); + m +} diff --git a/common/http-api-client/src/dns/static_resolver.rs b/common/http-api-client/src/dns/static_resolver.rs new file mode 100644 index 0000000000..030ae4419d --- /dev/null +++ b/common/http-api-client/src/dns/static_resolver.rs @@ -0,0 +1,89 @@ +use crate::dns::ResolveError; + +use std::{ + collections::HashMap, + net::{IpAddr, SocketAddr}, + sync::{Arc, Mutex}, +}; + +use reqwest::dns::{Addrs, Name, Resolve, Resolving}; +use tracing::*; + +#[derive(Debug, Default, Clone)] +pub struct StaticResolver { + static_addr_map: Arc>>>, +} + +impl StaticResolver { + pub fn new(static_entries: HashMap>) -> StaticResolver { + debug!("building static resolver"); + Self { + static_addr_map: Arc::new(Mutex::new(static_entries)), + } + } + + pub fn get_addrs(&self) -> HashMap> { + self.static_addr_map.lock().unwrap().clone() + } +} + +impl Resolve for StaticResolver { + fn resolve(&self, name: Name) -> Resolving { + debug!("looking up {name:?} in static resolver"); + let addr_map = self.static_addr_map.clone(); + Box::pin(async move { + let addr_map = addr_map.lock().unwrap(); + let lookup = match addr_map.get(name.as_str()) { + None => return Err(ResolveError::StaticLookupMiss.into()), + Some(addrs) => addrs, + }; + let addrs: Addrs = Box::new( + lookup + .clone() + .into_iter() + .map(|ip_addr| SocketAddr::new(ip_addr, 0)), + ); + + Ok(addrs) + }) + } +} + +#[cfg(test)] +mod test { + use itertools::Itertools; + + use super::*; + use std::error::Error as StdError; + use std::str::FromStr; + + #[tokio::test] + async fn lookup_using_static_resolver() -> Result<(), Box> { + let example_domain = String::from("static.nymvpn.com"); + + // lookup for domain for which there is no entry + let resolver = StaticResolver::new(HashMap::new()); + + let url = reqwest::dns::Name::from_str(&example_domain).unwrap(); + let result = resolver.resolve(url).await; + assert!(result.is_err()); + match result { + Ok(_) => panic!("lookup with empty map should fail"), + Err(e) => assert_eq!(e.to_string(), ResolveError::StaticLookupMiss.to_string()), + } + + // Successful lookup + let mut addr_map = HashMap::new(); + let example_ip4: IpAddr = "10.10.10.10".parse().unwrap(); + let example_ip6: IpAddr = "dead::beef".parse().unwrap(); + addr_map.insert(example_domain.clone(), vec![example_ip4, example_ip6]); + + let url = reqwest::dns::Name::from_str(&example_domain).unwrap(); + let resolver = StaticResolver::new(addr_map); + let mut addrs = resolver.resolve(url).await?; + assert!(addrs.contains(&SocketAddr::new(example_ip4, 0))); + assert!(addrs.contains(&SocketAddr::new(example_ip6, 0))); + + Ok(()) + } +}