Add support for QUIC forwarding

Author: jedisct1

README.md

@@ -13,6 +13,7 @@ The proxy supports the following protocols:
 - [DNSCrypt v2, including post-quantum DNSCrypt (PQDNSCrypt)](https://github.com/DNSCrypt/dnscrypt-protocol/blob/master/DNSCRYPT-V2-PROTOCOL.txt)
 - [Anonymized DNSCrypt](https://github.com/DNSCrypt/dnscrypt-protocol/blob/master/ANONYMIZED-DNSCRYPT.txt)
 - DNS-over-HTTPS (DoH) forwarding
+- QUIC forwarding (e.g. to an HTTP/3 server), sharing the UDP port with DNSCrypt
 
 All of these can be served simultaneously, on the same port (usually port 443). The proxy automatically detects what protocol is being used by each client.
 

example-encrypted-dns.toml

@@ -185,6 +185,32 @@ key_cache_capacity = 10000
 
 
 
+###############################
+#        QUIC settings        #
+###############################
+
+[quic]
+
+## Where to proxy QUIC datagrams to (e.g. an HTTP/3 server), sharing
+## the UDP port with DNSCrypt. Incoming packets are only forwarded there
+## once every DNSCrypt interpretation has been ruled out.
+
+# upstream_addr = "127.0.0.1:4443"
+
+
+## How long a QUIC flow without any traffic in either direction is kept
+## around, in seconds.
+
+# idle_timeout = 30
+
+
+## Maximum number of simultaneous QUIC flows. When the limit is reached,
+## the flow that has been quiet the longest is dropped.
+
+# max_active_flows = 512
+
+
+
 #######################################
 #        Server-side filtering        #
 #######################################

src/anonymized_dns.rs

@@ -1,11 +1,10 @@
 use std::hash::Hasher;
-use std::net::{IpAddr, Ipv4Addr, Ipv6Addr, SocketAddr, SocketAddrV4, SocketAddrV6};
+use std::net::{IpAddr, Ipv6Addr, SocketAddr};
 use std::sync::Arc;
 
 use byteorder::{BigEndian, ByteOrder};
 use ipext::IpExt;
 use siphasher::sip128::Hasher128;
-use tokio::net::UdpSocket;
 
 use crate::errors::*;
 use crate::*;
@@ -15,6 +14,15 @@ pub const ANONYMIZED_DNSCRYPT_QUERY_MAGIC: [u8; 10] =
 
 pub const ANONYMIZED_DNSCRYPT_OVERHEAD: usize = 16 + 2;
 
+pub const ANONYMIZED_DNSCRYPT_UDP_QUERY_MAX_SIZE: usize = ANONYMIZED_DNSCRYPT_QUERY_MAGIC.len()
+    + ANONYMIZED_DNSCRYPT_OVERHEAD
+    + DNSCRYPT_UDP_QUERY_MAX_SIZE;
+
+pub fn starts_with_relay_magic(packet: &[u8]) -> bool {
+    packet.len() >= ANONYMIZED_DNSCRYPT_QUERY_MAGIC.len()
+        && packet[..ANONYMIZED_DNSCRYPT_QUERY_MAGIC.len()] == ANONYMIZED_DNSCRYPT_QUERY_MAGIC
+}
+
 pub const RELAYED_CERT_CACHE_SIZE: usize = 1000;
 pub const RELAYED_CERT_CACHE_TTL: u32 = 600;
 
@@ -74,29 +82,9 @@ pub async fn handle_anonymized_dns(
         "Protocol confusion with QUIC"
     );
     debug_assert!(DNSCRYPT_UDP_QUERY_MIN_SIZE > ANONYMIZED_DNSCRYPT_QUERY_MAGIC.len());
-    ensure!(
-        encrypted_packet[..ANONYMIZED_DNSCRYPT_QUERY_MAGIC.len()]
-            != ANONYMIZED_DNSCRYPT_QUERY_MAGIC,
-        "Loop detected"
-    );
-    let ext_socket = match globals.external_addr {
-        Some(x) => UdpSocket::bind(x).await?,
-        None => match upstream_address {
-            SocketAddr::V4(_) => {
-                UdpSocket::bind(SocketAddr::V4(SocketAddrV4::new(Ipv4Addr::UNSPECIFIED, 0))).await?
-            }
-            SocketAddr::V6(s) => {
-                UdpSocket::bind(SocketAddr::V6(SocketAddrV6::new(
-                    Ipv6Addr::UNSPECIFIED,
-                    0,
-                    s.flowinfo(),
-                    s.scope_id(),
-                )))
-                .await?
-            }
-        },
-    };
-    ext_socket.connect(&upstream_address).await?;
+    ensure!(!starts_with_relay_magic(encrypted_packet), "Loop detected");
+    let ext_socket =
+        crate::resolver::upstream_udp_socket(upstream_address, globals.external_addr).await?;
     ext_socket.send(encrypted_packet).await?;
     let mut response = vec![0u8; DNSCRYPT_UDP_RESPONSE_MAX_SIZE];
     let (response_len, is_certificate_response) = loop {

src/config.rs

@@ -54,6 +54,33 @@ pub struct TLSConfig {
     pub upstream_addr: Option<SocketAddr>,
 }
 
+fn quic_default_idle_timeout() -> u32 {
+    crate::quic_proxy::QUIC_PROXY_DEFAULT_IDLE_TIMEOUT_SECS
+}
+
+fn quic_default_max_active_flows() -> u32 {
+    crate::quic_proxy::QUIC_PROXY_DEFAULT_MAX_ACTIVE_FLOWS
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct QUICConfig {
+    pub upstream_addr: Option<SocketAddr>,
+    #[serde(default = "quic_default_idle_timeout")]
+    pub idle_timeout: u32,
+    #[serde(default = "quic_default_max_active_flows")]
+    pub max_active_flows: u32,
+}
+
+impl Default for QUICConfig {
+    fn default() -> Self {
+        QUICConfig {
+            upstream_addr: None,
+            idle_timeout: quic_default_idle_timeout(),
+            max_active_flows: quic_default_max_active_flows(),
+        }
+    }
+}
+
 #[derive(Serialize, Deserialize, Debug, Clone)]
 pub struct ListenAddrConfig {
     pub local: SocketAddr,
@@ -110,6 +137,8 @@ pub struct Config {
     pub filtering: FilteringConfig,
     pub dnscrypt: DNSCryptConfig,
     pub tls: TLSConfig,
+    #[serde(default)]
+    pub quic: QUICConfig,
     pub daemonize: bool,
     pub pid_file: Option<PathBuf>,
     pub log_file: Option<PathBuf>,

src/globals.rs

@@ -14,6 +14,7 @@ use crate::blacklist::*;
 use crate::cache::*;
 use crate::crypto::*;
 use crate::dnscrypt_certs::*;
+use crate::quic_proxy::QuicProxy;
 use crate::rate_limiter::*;
 #[cfg(feature = "metrics")]
 use crate::varz::*;
@@ -30,6 +31,8 @@ pub struct Globals {
     pub external_addr: Option<SocketAddr>,
     pub upstream_addrs: Vec<SocketAddr>,
     pub tls_upstream_addr: Option<SocketAddr>,
+    #[educe(Debug(ignore))]
+    pub quic_proxy: Option<Arc<QuicProxy>>,
     pub udp_timeout: Duration,
     pub tcp_timeout: Duration,
     pub udp_concurrent_connections: Arc<AtomicU32>,

src/main.rs

@@ -32,6 +32,7 @@ mod globals;
 mod pq;
 #[cfg(feature = "metrics")]
 mod metrics;
+mod quic_proxy;
 mod rate_limiter;
 mod resolver;
 #[cfg(feature = "metrics")]
@@ -64,6 +65,7 @@ use futures::prelude::*;
 use globals::*;
 use parking_lot::Mutex;
 use parking_lot::RwLock;
+use quic_proxy::*;
 #[cfg(target_family = "unix")]
 use privdrop::PrivDrop;
 use rand::prelude::*;
@@ -169,6 +171,30 @@ async fn encrypt_and_respond_to_query(
     respond_to_query(client_ctx, response).await
 }
 
+/// Hand the packet to the QUIC upstream, or return `None` when proxying
+/// doesn't apply: disabled, TCP client, or outside the RFC 9443 ranges.
+async fn maybe_relay_quic(
+    globals: &Arc<Globals>,
+    client_ctx: ClientCtx,
+    packet: &[u8],
+) -> Option<Result<(), Error>> {
+    if globals.quic_proxy.is_none() || !may_be_quic(packet) {
+        return None;
+    }
+    match client_ctx {
+        ClientCtx::Udp(udp_client_ctx) => Some(
+            quic_proxy::relay(
+                globals,
+                udp_client_ctx.net_udp_socket,
+                udp_client_ctx.client_addr,
+                packet,
+            )
+            .await,
+        ),
+        ClientCtx::Tcp(_) => None,
+    }
+}
+
 async fn handle_client_query(
     globals: Arc<Globals>,
     client_ctx: ClientCtx,
@@ -225,8 +251,22 @@ async fn handle_client_query(
                         )
                         .await
                     }
-                    Ok(None) => return Ok(()),
+                    Ok(None) => {
+                        // Random QUIC bytes can parse as a valid non-certificate DNS query.
+                        // Relaying one is harmless: a real stray DNS query gets no answer either way.
+                        if let Some(result) = maybe_relay_quic(&globals, client_ctx, &packet).await
+                        {
+                            return result;
+                        }
+                        return Ok(());
+                    }
                     Err(_) => {
+                        // Not encrypted for us and not a certificate query;
+                        // nothing DNSCrypt-shaped is left for this packet to be.
+                        if let Some(result) = maybe_relay_quic(&globals, client_ctx, &packet).await
+                        {
+                            return result;
+                        }
                         if may_be_quic(&packet) {
                             bail!("Likely a QUIC packet") // RFC 9443
                         }
@@ -428,13 +468,18 @@ async fn udp_acceptor(
     let timeout = globals.udp_timeout;
     let concurrent_connections = globals.udp_concurrent_connections.clone();
     let active_connections = globals.udp_active_connections.clone();
+    // Large enough that a proxied QUIC datagram is never truncated.
+    let mut recv_buffer = vec![0u8; QUIC_PROXY_BUFFER_SIZE];
     loop {
-        let mut packet = vec![0u8; DNSCRYPT_UDP_QUERY_MAX_SIZE];
-        let (packet_len, client_addr) = tokio_udp_socket.recv_from(&mut packet).await?;
+        let (packet_len, client_addr) = tokio_udp_socket.recv_from(&mut recv_buffer).await?;
         if packet_len < DNS_HEADER_SIZE {
             continue;
         }
 
+        if quic_proxy::try_forward_established(&globals, client_addr, &recv_buffer[..packet_len]) {
+            continue;
+        }
+
         if let Some(ref rate_limiter) = globals.rate_limiter {
             if !rate_limiter.is_allowed(client_addr.ip()) {
                 debug!("Rate limit exceeded for {}", client_addr.ip());
@@ -444,7 +489,29 @@ async fn udp_acceptor(
             }
         }
 
-        packet.truncate(packet_len);
+        let packet = recv_buffer[..packet_len].to_vec();
+
+        // Only relayed Anonymized DNSCrypt queries may exceed the DNSCrypt
+        // maximum, by the size of the relay header; anything else oversized
+        // never needs DNS processing.
+        let oversized_anonymized_dns = globals.anonymized_dns_enabled
+            && packet_len <= ANONYMIZED_DNSCRYPT_UDP_QUERY_MAX_SIZE
+            && starts_with_relay_magic(&packet);
+        if packet_len > DNSCRYPT_UDP_QUERY_MAX_SIZE && !oversized_anonymized_dns {
+            if globals.quic_proxy.is_some() && may_be_quic(&packet) {
+                if let Ok(net_udp_socket) = net_udp_socket.try_clone() {
+                    let globals = globals.clone();
+                    runtime_handle.spawn(async move {
+                        if let Err(e) =
+                            quic_proxy::relay(&globals, net_udp_socket, client_addr, &packet).await
+                        {
+                            debug!("QUIC relay error: {:?}", e);
+                        }
+                    });
+                }
+            }
+            continue;
+        }
 
         let active_count = concurrent_connections.load(Ordering::Relaxed);
         if active_count >= globals.udp_max_active_connections {
@@ -629,11 +696,16 @@ fn set_limits(_config: &Config) -> Result<(), Error> {
 #[cfg(target_family = "unix")]
 fn set_limits(config: &Config) -> Result<(), Error> {
     use rlimit::Resource;
+    let quic_max_active_flows = match config.quic.upstream_addr {
+        Some(_) => config.quic.max_active_flows,
+        None => 0,
+    };
     let nb_descriptors = 4u32
         .saturating_mul(
             config
                 .tcp_max_active_connections
                 .saturating_add(config.udp_max_active_connections)
+                .saturating_add(quic_max_active_flows)
                 .saturating_add(config.listen_addrs.len() as u32),
         )
         .saturating_add(16);
@@ -888,6 +960,39 @@ fn main() -> Result<(), Error> {
         }
         _ => None,
     };
+    let quic_proxy = match config.quic.upstream_addr {
+        None => None,
+        Some(quic_upstream_addr) => {
+            // Connecting to an unspecified address reaches the local host,
+            // which could loop back to one of our own listening ports.
+            if quic_upstream_addr.ip().is_unspecified() {
+                bail!(
+                    "quic.upstream_addr [{}] must be a specific address",
+                    quic_upstream_addr
+                );
+            }
+            // A packet forwarded to one of our own UDP ports would fail
+            // decryption there, look like QUIC again, and be forwarded again.
+            for listen_addr in &listen_addrs {
+                if listen_addr.port() == quic_upstream_addr.port()
+                    && (listen_addr.ip().is_unspecified()
+                        || listen_addr.ip() == quic_upstream_addr.ip())
+                {
+                    bail!(
+                        "quic.upstream_addr [{}] would loop back to a listening UDP port",
+                        quic_upstream_addr
+                    );
+                }
+            }
+            info!("QUIC proxying enabled, forwarding to [{}]", quic_upstream_addr);
+            Some(Arc::new(QuicProxy::new(
+                quic_upstream_addr,
+                external_addr,
+                config.quic.max_active_flows as usize,
+                config.quic.idle_timeout,
+            )))
+        }
+    };
     let runtime_handle = runtime.handle();
     let globals = Arc::new(Globals {
         runtime_handle: runtime_handle.clone(),
@@ -900,6 +1005,7 @@ fn main() -> Result<(), Error> {
         listen_addrs,
         upstream_addrs: config.upstream_addrs,
         tls_upstream_addr: config.tls.upstream_addr,
+        quic_proxy,
         external_addr,
         tcp_timeout: Duration::from_secs(u64::from(config.tcp_timeout)),
         udp_timeout: Duration::from_secs(u64::from(config.udp_timeout)),