From 9330b01c28aebc865a3c0a51df8730196cb4152e Mon Sep 17 00:00:00 2001 From: Your Name Date: Sat, 23 May 2026 04:50:26 +0530 Subject: Phase 6a-6d: Consolidate and clean up 6a: Delete dead standalone tollgate_core/ (12 files, never compiled) 6b: Rewrite dns_server.c as thin shim to component's tollgate_core_dns - Fix component DNS to bind to AP IP instead of INADDR_ANY 6c: Rewrite stratum_proxy.c as thin shim with struct cast to component types 6d: Move sandbox logic into component's tollgate_core_firewall - Add tollgate_core_fw_set_sandbox_ports/set_sandbox_mint_access - Add is_sandbox_allowed() to component's ip4_canforward_filter - Clean main/firewall.c to delegate filter to component - Remove redundant DNS auth double-calls from main firewall Add ROADMAP.md with full extraction plan and checklists All 21 unit tests pass. ESP-IDF build passes. --- main/dns_server.c | 304 +----------------------------------------------------- 1 file changed, 5 insertions(+), 299 deletions(-) (limited to 'main/dns_server.c') diff --git a/main/dns_server.c b/main/dns_server.c index b84a4cf..5b1bdc3 100644 --- a/main/dns_server.c +++ b/main/dns_server.c @@ -1,316 +1,22 @@ #include "dns_server.h" -#include "esp_log.h" -#include "freertos/FreeRTOS.h" -#include "freertos/task.h" -#include "lwip/sockets.h" -#include "lwip/netdb.h" -#include -#include - -#define MAX_AUTH_IPS 10 -#define MAX_PENDING 50 -#define DNS_BUF_SIZE 512 -#define DNS_PORT 53 -#define DOT_PORT 853 -#define DNS_TASK_STACK 4096 -#define DOT_TASK_STACK 3072 -#define DNS_TASK_PRIO 5 -#define DOT_TASK_PRIO 5 -#define DNS_FORWARD_TIMEOUT_MS 2000 -#define NXDOMAIN_TTL 30 -#define HIJACK_TTL 10 - -static const char *TAG = "dns_server"; - -#pragma pack(push, 1) -typedef struct { - uint16_t id; - uint16_t flags; - uint16_t qdcount; - uint16_t ancount; - uint16_t nscount; - uint16_t arcount; -} dns_header_t; -#pragma pack(pop) - -#pragma pack(push, 1) -typedef struct { - uint16_t name; - uint16_t type; - uint16_t class; - uint32_t ttl; - uint16_t len; - uint32_t addr; -} dns_answer_t; -#pragma pack(pop) - -typedef struct { - uint32_t ip; -} auth_entry_t; - -static auth_entry_t s_auth_list[MAX_AUTH_IPS]; -static int s_auth_count = 0; -static TaskHandle_t s_dns_task = NULL; -static TaskHandle_t s_dot_task = NULL; -static volatile bool s_dns_running = false; -static esp_ip4_addr_t s_ap_ip; -static esp_ip4_addr_t s_upstream_dns; - -static bool is_authenticated(uint32_t ip) -{ - for (int i = 0; i < s_auth_count; i++) { - if (s_auth_list[i].ip == ip) return true; - } - return false; -} - -static void parse_dns_name(const uint8_t *buf, int buf_len, int offset, char *out, int out_len) -{ - int pos = offset; - int out_pos = 0; - int jumped = 0; - int jump_pos = 0; - while (pos < buf_len && out_pos < out_len - 1) { - uint8_t len = buf[pos]; - if (len == 0) break; - if ((len & 0xC0) == 0xC0) { - if (!jumped) jump_pos = pos + 2; - pos = ((len & 0x3F) << 8) | buf[pos + 1]; - jumped = 1; - continue; - } - if (out_pos > 0 && out_pos < out_len - 1) out[out_pos++] = '.'; - pos++; - for (int i = 0; i < len && pos < buf_len && out_pos < out_len - 1; i++) { - out[out_pos++] = buf[pos++]; - } - } - out[out_pos] = '\0'; -} - -static int build_nxdomain(uint8_t *response, int req_len) -{ - dns_header_t *hdr = (dns_header_t *)response; - hdr->flags = htons(0x8403); - hdr->ancount = 0; - hdr->nscount = 0; - hdr->arcount = 0; - return req_len; -} - -static int build_redirect_response(uint8_t *response, int req_len) -{ - memmove(response, response, req_len); - dns_header_t *hdr = (dns_header_t *)response; - hdr->flags = htons(0x8180); - hdr->ancount = htons(1); - hdr->nscount = 0; - hdr->arcount = 0; - int resp_len = req_len; - dns_answer_t ans; - ans.name = htons(0xC00C); - ans.type = htons(1); - ans.class = htons(1); - ans.ttl = htonl(HIJACK_TTL); - ans.len = htons(4); - ans.addr = s_ap_ip.addr; - memcpy(response + resp_len, &ans, sizeof(ans)); - resp_len += sizeof(ans); - return resp_len; -} - -static int forward_dns(const uint8_t *req, int req_len, uint8_t *resp, int resp_buf_len, - const struct sockaddr_in *client_addr, uint16_t txn_id) -{ - int upstream_sock = socket(AF_INET, SOCK_DGRAM, 0); - if (upstream_sock < 0) return -1; - - struct timeval tv = { .tv_sec = DNS_FORWARD_TIMEOUT_MS / 1000, .tv_usec = (DNS_FORWARD_TIMEOUT_MS % 1000) * 1000 }; - setsockopt(upstream_sock, SOL_SOCKET, SO_RCVTIMEO, &tv, sizeof(tv)); - - struct sockaddr_in upstream_addr = { - .sin_family = AF_INET, - .sin_port = htons(DNS_PORT), - .sin_addr.s_addr = s_upstream_dns.addr, - }; - - sendto(upstream_sock, req, req_len, 0, (struct sockaddr *)&upstream_addr, sizeof(upstream_addr)); - - int n = recvfrom(upstream_sock, resp, resp_buf_len, 0, NULL, NULL); - close(upstream_sock); - - if (n > 0) { - if (n >= sizeof(dns_header_t)) { - dns_header_t *hdr = (dns_header_t *)resp; - hdr->id = htons(txn_id); - } - } - return n; -} - -static void dns_server_task(void *arg) -{ - int sock = socket(AF_INET, SOCK_DGRAM, 0); - if (sock < 0) { - ESP_LOGE(TAG, "Failed to create DNS socket"); - s_dns_running = false; - vTaskDelete(NULL); - return; - } - - struct sockaddr_in bind_addr = { - .sin_family = AF_INET, - .sin_port = htons(DNS_PORT), - .sin_addr.s_addr = s_ap_ip.addr, - }; - if (bind(sock, (struct sockaddr *)&bind_addr, sizeof(bind_addr)) < 0) { - ESP_LOGE(TAG, "Failed to bind DNS socket"); - close(sock); - s_dns_running = false; - vTaskDelete(NULL); - return; - } - - ESP_LOGI(TAG, "DNS server started on port %d, AP IP=" IPSTR ", upstream DNS=" IPSTR, - DNS_PORT, IP2STR(&s_ap_ip), IP2STR(&s_upstream_dns)); - - uint8_t rx_buf[DNS_BUF_SIZE]; - uint8_t tx_buf[DNS_BUF_SIZE + sizeof(dns_answer_t)]; - - while (s_dns_running) { - struct sockaddr_in client_addr; - socklen_t client_len = sizeof(client_addr); - int n = recvfrom(sock, rx_buf, sizeof(rx_buf), 0, - (struct sockaddr *)&client_addr, &client_len); - if (n < (int)sizeof(dns_header_t)) continue; - - uint32_t client_ip = client_addr.sin_addr.s_addr; - dns_header_t *hdr = (dns_header_t *)rx_buf; - uint16_t txn_id = ntohs(hdr->id); - bool is_query = (ntohs(hdr->flags) & 0x8000) == 0; - uint16_t qdcount = ntohs(hdr->qdcount); - - if (!is_query || qdcount == 0) continue; - - int q_offset = sizeof(dns_header_t); - while (q_offset < n && rx_buf[q_offset] != 0) { - q_offset += rx_buf[q_offset] + 1; - } - if (q_offset + 5 > n) continue; - uint16_t qtype = (rx_buf[q_offset + 1] << 8) | rx_buf[q_offset + 2]; - int req_len = q_offset + 5; - - if (is_authenticated(client_ip)) { - int resp_len = forward_dns(rx_buf, req_len, tx_buf, sizeof(tx_buf), &client_addr, txn_id); - if (resp_len > 0) { - sendto(sock, tx_buf, resp_len, 0, (struct sockaddr *)&client_addr, client_len); - } - } else { - char qname[256] = {0}; - parse_dns_name(rx_buf, n, sizeof(dns_header_t), qname, sizeof(qname)); - ESP_LOGI(TAG, "Hijack DNS from " IPSTR ": %s (type=%d)", IP2STR(&(esp_ip4_addr_t){.addr=client_ip}), qname, qtype); - if (qtype == 1) { - int resp_len = build_redirect_response(rx_buf, req_len); - memcpy(tx_buf, rx_buf, resp_len); - dns_header_t *resp_hdr = (dns_header_t *)tx_buf; - resp_hdr->id = htons(txn_id); - sendto(sock, tx_buf, resp_len, 0, (struct sockaddr *)&client_addr, client_len); - } else { - int resp_len = build_nxdomain(rx_buf, req_len); - memcpy(tx_buf, rx_buf, resp_len); - dns_header_t *resp_hdr = (dns_header_t *)tx_buf; - resp_hdr->id = htons(txn_id); - sendto(sock, tx_buf, resp_len, 0, (struct sockaddr *)&client_addr, client_len); - } - } - } - - close(sock); - ESP_LOGI(TAG, "DNS server stopped"); - vTaskDelete(NULL); -} - -static void dot_reject_task(void *arg) -{ - int sock = socket(AF_INET, SOCK_STREAM, 0); - if (sock < 0) { - ESP_LOGE(TAG, "Failed to create DoT reject socket"); - vTaskDelete(NULL); - return; - } - - int opt = 1; - setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, &opt, sizeof(opt)); - - struct sockaddr_in bind_addr = { - .sin_family = AF_INET, - .sin_port = htons(DOT_PORT), - .sin_addr.s_addr = INADDR_ANY, - }; - if (bind(sock, (struct sockaddr *)&bind_addr, sizeof(bind_addr)) < 0) { - ESP_LOGE(TAG, "Failed to bind DoT reject socket on port %d", DOT_PORT); - close(sock); - vTaskDelete(NULL); - return; - } - - listen(sock, 1); - ESP_LOGI(TAG, "DoT reject server on port %d (forces DNS fallback to port 53)", DOT_PORT); - - while (s_dns_running) { - struct sockaddr_in client_addr; - socklen_t client_len = sizeof(client_addr); - int client_sock = accept(sock, (struct sockaddr *)&client_addr, &client_len); - if (client_sock >= 0) { - struct linger ling = { .l_onoff = 1, .l_linger = 0 }; - setsockopt(client_sock, SOL_SOCKET, SO_LINGER, &ling, sizeof(ling)); - close(client_sock); - } - } - - close(sock); - ESP_LOGI(TAG, "DoT reject server stopped"); - vTaskDelete(NULL); -} +#include "tollgate_core_dns.h" esp_err_t dns_server_start(esp_ip4_addr_t ap_ip, esp_ip4_addr_t upstream_dns) { - if (s_dns_running) return ESP_OK; - s_ap_ip = ap_ip; - s_upstream_dns = upstream_dns; - s_dns_running = true; - xTaskCreate(dns_server_task, "dns_server", DNS_TASK_STACK, NULL, DNS_TASK_PRIO, &s_dns_task); - xTaskCreate(dot_reject_task, "dot_reject", DOT_TASK_STACK, NULL, DOT_TASK_PRIO, &s_dot_task); - return ESP_OK; + return tollgate_core_dns_start_internal(ap_ip, upstream_dns); } void dns_server_stop(void) { - s_dns_running = false; - vTaskDelay(pdMS_TO_TICKS(200)); - s_dns_task = NULL; + tollgate_core_dns_stop(); } void dns_server_set_client_authenticated(uint32_t client_ip, bool authenticated) { - if (authenticated) { - if (is_authenticated(client_ip)) return; - if (s_auth_count < MAX_AUTH_IPS) { - s_auth_list[s_auth_count].ip = client_ip; - s_auth_count++; - } - } else { - for (int i = 0; i < s_auth_count; i++) { - if (s_auth_list[i].ip == client_ip) { - s_auth_list[i] = s_auth_list[s_auth_count - 1]; - s_auth_count--; - return; - } - } - } + tollgate_core_dns_set_authenticated(client_ip, authenticated); } bool dns_server_is_running(void) { - return s_dns_running; + return tollgate_core_dns_is_running(); } -- cgit v1.2.3