|
| 1 | +// SPDX-FileCopyrightText: Copyright The Lima Authors |
| 2 | +// SPDX-License-Identifier: Apache-2.0 |
| 3 | + |
| 4 | +package filter |
| 5 | + |
| 6 | +import ( |
| 7 | + "net" |
| 8 | + "strings" |
| 9 | + "sync" |
| 10 | + "time" |
| 11 | +) |
| 12 | + |
| 13 | +const ( |
| 14 | + // MaxDNSRecords is the maximum number of DNS records to track. |
| 15 | + // This prevents unbounded memory growth in long-running processes. |
| 16 | + MaxDNSRecords = 10000 |
| 17 | +) |
| 18 | + |
| 19 | +// DNSRecord represents a DNS query result with TTL. |
| 20 | +type DNSRecord struct { |
| 21 | + Domain string |
| 22 | + IPs []net.IP |
| 23 | + ExpireAt time.Time |
| 24 | +} |
| 25 | + |
| 26 | +// Tracker tracks domain to IP mappings from DNS queries. |
| 27 | +type Tracker struct { |
| 28 | + mu sync.RWMutex |
| 29 | + records map[string]*DNSRecord // domain -> record |
| 30 | +} |
| 31 | + |
| 32 | +// NewTracker creates a new DNS tracker. |
| 33 | +func NewTracker() *Tracker { |
| 34 | + return &Tracker{ |
| 35 | + records: make(map[string]*DNSRecord), |
| 36 | + } |
| 37 | +} |
| 38 | + |
| 39 | +// SeedLimaInternalDomains pre-populates the tracker with Lima internal domains |
| 40 | +// These are special domains that map to Lima network infrastructure: |
| 41 | +// - subnet.lima.internal -> the entire Lima subnet (e.g., 192.168.100.0/24) |
| 42 | +// - host.lima.internal -> the Lima gateway (e.g., 192.168.100.2) |
| 43 | +func (t *Tracker) SeedLimaInternalDomains(subnet, gatewayIP string) error { |
| 44 | + if subnet == "" { |
| 45 | + return nil |
| 46 | + } |
| 47 | + |
| 48 | + _, subnetNet, err := net.ParseCIDR(subnet) |
| 49 | + if err != nil { |
| 50 | + return err |
| 51 | + } |
| 52 | + |
| 53 | + // Get all IPs in the subnet for subnet.lima.internal |
| 54 | + var subnetIPs []net.IP |
| 55 | + // For now, just add the network address |
| 56 | + // We could enumerate all IPs but that's expensive for large subnets |
| 57 | + subnetIPs = append(subnetIPs, subnetNet.IP) |
| 58 | + |
| 59 | + // Add subnet.lima.internal -> subnet IPs |
| 60 | + // Use a very long TTL (24 hours) since these are static mappings |
| 61 | + t.AddRecord("subnet.lima.internal", subnetIPs, 24*time.Hour) |
| 62 | + |
| 63 | + // Add host.lima.internal -> Lima gateway |
| 64 | + // This must be seeded because gvisor's internal DNS server resolves *.lima.internal |
| 65 | + // domains internally, so the DNS snooper never sees the responses |
| 66 | + if gatewayIP != "" { |
| 67 | + gateway := net.ParseIP(gatewayIP) |
| 68 | + if gateway != nil { |
| 69 | + t.AddRecord("host.lima.internal", []net.IP{gateway}, 24*time.Hour) |
| 70 | + } |
| 71 | + } |
| 72 | + |
| 73 | + return nil |
| 74 | +} |
| 75 | + |
| 76 | +// AddRecord adds or updates a DNS record. |
| 77 | +func (t *Tracker) AddRecord(domain string, ips []net.IP, ttl time.Duration) { |
| 78 | + t.mu.Lock() |
| 79 | + defer t.mu.Unlock() |
| 80 | + |
| 81 | + domain = strings.ToLower(domain) |
| 82 | + |
| 83 | + // If at capacity and this is a new domain, clean up expired entries first |
| 84 | + if _, exists := t.records[domain]; !exists && len(t.records) >= MaxDNSRecords { |
| 85 | + t.cleanExpiredLocked() |
| 86 | + |
| 87 | + // If still at capacity after cleanup, remove oldest entry |
| 88 | + if len(t.records) >= MaxDNSRecords { |
| 89 | + t.removeOldestLocked() |
| 90 | + } |
| 91 | + } |
| 92 | + |
| 93 | + t.records[domain] = &DNSRecord{ |
| 94 | + Domain: domain, |
| 95 | + IPs: ips, |
| 96 | + ExpireAt: time.Now().Add(ttl), |
| 97 | + } |
| 98 | +} |
| 99 | + |
| 100 | +// GetIPs returns all IPs for a domain, or nil if not found/expired. |
| 101 | +func (t *Tracker) GetIPs(domain string) []net.IP { |
| 102 | + t.mu.RLock() |
| 103 | + defer t.mu.RUnlock() |
| 104 | + |
| 105 | + domain = strings.ToLower(domain) |
| 106 | + record, ok := t.records[domain] |
| 107 | + if !ok || time.Now().After(record.ExpireAt) { |
| 108 | + return nil |
| 109 | + } |
| 110 | + return record.IPs |
| 111 | +} |
| 112 | + |
| 113 | +// GetIPsForPattern returns all IPs matching a domain pattern (supports wildcards). |
| 114 | +// Example: "*.example.com" matches "api.example.com", "cdn.example.com". |
| 115 | +func (t *Tracker) GetIPsForPattern(pattern string) []net.IP { |
| 116 | + t.mu.RLock() |
| 117 | + defer t.mu.RUnlock() |
| 118 | + |
| 119 | + pattern = strings.ToLower(pattern) |
| 120 | + var allIPs []net.IP |
| 121 | + seenIPs := make(map[string]bool) |
| 122 | + |
| 123 | + for domain, record := range t.records { |
| 124 | + // Skip expired records |
| 125 | + if time.Now().After(record.ExpireAt) { |
| 126 | + continue |
| 127 | + } |
| 128 | + |
| 129 | + // Check if domain matches pattern |
| 130 | + if matchesPattern(domain, pattern) { |
| 131 | + for _, ip := range record.IPs { |
| 132 | + ipStr := ip.String() |
| 133 | + if !seenIPs[ipStr] { |
| 134 | + seenIPs[ipStr] = true |
| 135 | + allIPs = append(allIPs, ip) |
| 136 | + } |
| 137 | + } |
| 138 | + } |
| 139 | + } |
| 140 | + |
| 141 | + return allIPs |
| 142 | +} |
| 143 | + |
| 144 | +// GetDomainsForIP returns all domains that resolve to the given IP (reverse lookup). |
| 145 | +func (t *Tracker) GetDomainsForIP(ip net.IP) []string { |
| 146 | + t.mu.RLock() |
| 147 | + defer t.mu.RUnlock() |
| 148 | + |
| 149 | + var domains []string |
| 150 | + now := time.Now() |
| 151 | + |
| 152 | + for domain, record := range t.records { |
| 153 | + // Skip expired records |
| 154 | + if now.After(record.ExpireAt) { |
| 155 | + continue |
| 156 | + } |
| 157 | + |
| 158 | + // Check if this domain resolves to the given IP |
| 159 | + for _, recordIP := range record.IPs { |
| 160 | + if recordIP.Equal(ip) { |
| 161 | + domains = append(domains, domain) |
| 162 | + break |
| 163 | + } |
| 164 | + } |
| 165 | + } |
| 166 | + |
| 167 | + return domains |
| 168 | +} |
| 169 | + |
| 170 | +// CleanExpired removes expired DNS records. |
| 171 | +func (t *Tracker) CleanExpired() { |
| 172 | + t.mu.Lock() |
| 173 | + defer t.mu.Unlock() |
| 174 | + t.cleanExpiredLocked() |
| 175 | +} |
| 176 | + |
| 177 | +// cleanExpiredLocked removes expired DNS records (must hold lock). |
| 178 | +func (t *Tracker) cleanExpiredLocked() { |
| 179 | + now := time.Now() |
| 180 | + for domain, record := range t.records { |
| 181 | + if now.After(record.ExpireAt) { |
| 182 | + delete(t.records, domain) |
| 183 | + } |
| 184 | + } |
| 185 | +} |
| 186 | + |
| 187 | +// removeOldestLocked removes the record with the earliest expiration time (must hold lock). |
| 188 | +func (t *Tracker) removeOldestLocked() { |
| 189 | + if len(t.records) == 0 { |
| 190 | + return |
| 191 | + } |
| 192 | + |
| 193 | + var oldestDomain string |
| 194 | + var oldestExpireAt time.Time |
| 195 | + first := true |
| 196 | + |
| 197 | + for domain, record := range t.records { |
| 198 | + if first || record.ExpireAt.Before(oldestExpireAt) { |
| 199 | + oldestDomain = domain |
| 200 | + oldestExpireAt = record.ExpireAt |
| 201 | + first = false |
| 202 | + } |
| 203 | + } |
| 204 | + |
| 205 | + if oldestDomain != "" { |
| 206 | + delete(t.records, oldestDomain) |
| 207 | + } |
| 208 | +} |
| 209 | + |
| 210 | +// matchesPattern checks if a domain matches a pattern with wildcard support. |
| 211 | +// Pattern examples: |
| 212 | +// - "example.com" matches exactly "example.com" |
| 213 | +// - "*.example.com" matches "api.example.com", "cdn.example.com", but NOT "example.com" |
| 214 | +// - "*" matches everything |
| 215 | +func matchesPattern(domain, pattern string) bool { |
| 216 | + // Exact match |
| 217 | + if domain == pattern { |
| 218 | + return true |
| 219 | + } |
| 220 | + |
| 221 | + // Match all |
| 222 | + if pattern == "*" { |
| 223 | + return true |
| 224 | + } |
| 225 | + |
| 226 | + // Wildcard pattern |
| 227 | + if strings.HasPrefix(pattern, "*.") { |
| 228 | + suffix := pattern[2:] // Remove "*." |
| 229 | + // Domain must end with the suffix and have at least one more label |
| 230 | + if strings.HasSuffix(domain, "."+suffix) { |
| 231 | + return true |
| 232 | + } |
| 233 | + } |
| 234 | + |
| 235 | + return false |
| 236 | +} |
0 commit comments