[Dnsmasq-discuss] [PATCH] Support Cisco Umbrella/OpenDNS Device ID & Remote IP
Brian Hartvigsen
brian.andrew at brianandjenny.com
Wed Apr 7 02:45:17 UTC 2021
This is based on the information at https://docs.umbrella.com/umbrella-api/docs/identifying-dns-traffic and https://docs.umbrella.com/umbrella-api/docs/identifying-dns-traffic2 . Using --umbrella by itself will enable Remote IP reporting. This can not be used for any policy filtering in Cisco Umbrella/OpenDNS. Additional information can be supplied using specific option specifications, multiple can be separated by a comma:
--umbrella=orgid:1234,deviceid=0123456789abcdef
Specifies that you want to report organization 1234 using device 0123456789abcdef. For Cisco Umbrella Enterprise, see "Register (Create) a device" (https://docs.umbrella.com/umbrella-api/docs/create-a-device) for how to get a Device ID and "Organization ID endpoint" (https://docs.umbrella.com/umbrella-api/docs/organization-endpoint) to get organizations ID. For OpenDNS Home Users, there is no organization, see Registration API endpoint (https://docs.umbrella.com/umbrella-api/docs/registration-api-endpoint2) for how to get a Device ID. Asset ID should be ignored unless specifically instructed to use by support.
Signed-off-by: Brian Hartvigsen <brian.andrew at brianandjenny.com>
---
src/dns-protocol.h | 1 +
src/dnsmasq.h | 6 +++++-
src/edns0.c | 53 ++++++++++++++++++++++++++++++++++++++++++++++
src/option.c | 23 ++++++++++++++++++++
4 files changed, 82 insertions(+), 1 deletion(-)
diff --git a/src/dns-protocol.h b/src/dns-protocol.h
index 941bea6..8ad1964 100644
--- a/src/dns-protocol.h
+++ b/src/dns-protocol.h
@@ -82,6 +82,7 @@
#define EDNS0_OPTION_CLIENT_SUBNET 8 /* IANA */
#define EDNS0_OPTION_NOMDEVICEID 65073 /* Nominum temporary assignment */
#define EDNS0_OPTION_NOMCPEID 65074 /* Nominum temporary assignment */
+#define EDNS0_OPTION_UMBRELLA 20292 /* Cisco Umbrella temporary assignment */
struct dns_header {
u16 id;
diff --git a/src/dnsmasq.h b/src/dnsmasq.h
index 1e21005..d4da132 100644
--- a/src/dnsmasq.h
+++ b/src/dnsmasq.h
@@ -270,7 +270,8 @@ struct event_desc {
#define OPT_SINGLE_PORT 60
#define OPT_LEASE_RENEW 61
#define OPT_LOG_DEBUG 62
-#define OPT_LAST 63
+#define OPT_UMBRELLA 63
+#define OPT_LAST 64
#define OPTION_BITS (sizeof(unsigned int)*8)
#define OPTION_SIZE ( (OPT_LAST/OPTION_BITS)+((OPT_LAST%OPTION_BITS)!=0) )
@@ -1061,6 +1062,9 @@ extern struct daemon {
int port, query_port, min_port, max_port;
unsigned long local_ttl, neg_ttl, max_ttl, min_cache_ttl, max_cache_ttl, auth_ttl, dhcp_ttl, use_dhcp_ttl;
char *dns_client_id;
+ int umbrella_org;
+ int umbrella_asset;
+ char *umbrella_device;
struct hostsfile *addn_hosts;
struct dhcp_context *dhcp, *dhcp6;
struct ra_interface *ra_interfaces;
diff --git a/src/edns0.c b/src/edns0.c
index c85b318..81dd929 100644
--- a/src/edns0.c
+++ b/src/edns0.c
@@ -427,6 +427,56 @@ int check_source(struct dns_header *header, size_t plen, unsigned char *pseudohe
return 1;
}
+#define UMBRELLA_ASSET 0x04
+#define UMBRELLA_ORG 0x08
+#define UMBRELLA_IPV4 0x10
+#define UMBRELLA_IPV6 0x20
+#define UMBRELLA_DEVICE 0x40
+#define UMBRELLA_DEVICESZ 8
+
+static size_t add_umbrella_opt(struct dns_header *header, size_t plen, unsigned char *limit, union mysockaddr *source)
+{
+ /* https://docs.umbrella.com/umbrella-api/docs/identifying-dns-traffic2 */
+ int len;
+ unsigned char umbrella_data[512] = "ODNS";
+ unsigned char *u = &umbrella_data[4];
+ *u++ = 0; // version
+ *u++ = 0; // flags
+
+ if (daemon->umbrella_org) {
+ *u++ = UMBRELLA_ORG;
+ int org = htonl(daemon->umbrella_org);
+ memcpy(u, (char *)&org, sizeof(int));
+ u += sizeof(int);
+ }
+
+ int family = source->sa.sa_family;
+ int size = family == AF_INET ? INADDRSZ : IN6ADDRSZ;
+
+ *u++ = family == AF_INET ? UMBRELLA_IPV4 : UMBRELLA_IPV6;
+ memcpy(u, get_addrp(source, family), size);
+ u += size;
+
+ if (daemon->umbrella_device) {
+ *u++ = UMBRELLA_DEVICE;
+ char word[3];
+ for (int i = 0; i < UMBRELLA_DEVICESZ; i++) {
+ memcpy(word, &(daemon->umbrella_device[i * 2]), 2);
+ *u++ = strtoul(word, NULL, 16);
+ }
+ }
+
+ if (daemon->umbrella_asset) {
+ *u++ = UMBRELLA_ASSET;
+ int assest = htonl(daemon->umbrella_asset);
+ memcpy(u, (char *)&assest, sizeof(int));
+ u += sizeof(int);
+ }
+
+ len = u - umbrella_data; // for the header
+ return add_pseudoheader(header, plen, (unsigned char *)limit, PACKETSZ, EDNS0_OPTION_UMBRELLA, (unsigned char *)&umbrella_data, len, 0, 1);
+}
+
/* Set *check_subnet if we add a client subnet option, which needs to checked
in the reply. Set *cacheable to zero if we add an option which the answer
may depend on. */
@@ -445,6 +495,9 @@ size_t add_edns0_config(struct dns_header *header, size_t plen, unsigned char *l
if (daemon->dns_client_id)
plen = add_pseudoheader(header, plen, limit, PACKETSZ, EDNS0_OPTION_NOMCPEID,
(unsigned char *)daemon->dns_client_id, strlen(daemon->dns_client_id), 0, 1);
+
+ if (option_bool(OPT_UMBRELLA))
+ plen = add_umbrella_opt(header, plen, limit, source);
if (option_bool(OPT_CLIENT_SUBNET))
{
diff --git a/src/option.c b/src/option.c
index 6de5914..7f4613f 100644
--- a/src/option.c
+++ b/src/option.c
@@ -170,6 +170,7 @@ struct myoption {
#define LOPT_PXE_VENDOR 361
#define LOPT_DYNHOST 362
#define LOPT_LOG_DEBUG 363
+#define LOPT_UMBRELLA 364
#ifdef HAVE_GETOPT_LONG
static const struct option opts[] =
@@ -345,6 +346,7 @@ static const struct myoption opts[] =
{ "dhcp-ignore-clid", 0, 0, LOPT_IGNORE_CLID },
{ "dynamic-host", 1, 0, LOPT_DYNHOST },
{ "log-debug", 0, 0, LOPT_LOG_DEBUG },
+ { "umbrella", 2, 0, LOPT_UMBRELLA },
{ NULL, 0, 0, 0 }
};
@@ -527,6 +529,7 @@ static struct {
{ LOPT_DUMPFILE, ARG_ONE, "<path>", gettext_noop("Path to debug packet dump file"), NULL },
{ LOPT_DUMPMASK, ARG_ONE, "<hex>", gettext_noop("Mask which packets to dump"), NULL },
{ LOPT_SCRIPT_TIME, OPT_LEASE_RENEW, NULL, gettext_noop("Call dhcp-script when lease expiry changes."), NULL },
+ { LOPT_UMBRELLA, ARG_ONE, "[=<optspec>]", gettext_noop("Send Cisco Umbrella identifiers including remote IP."), NULL },
{ 0, 0, NULL, NULL, NULL }
};
@@ -2409,6 +2412,26 @@ static int one_opt(int option, char *arg, char *errstr, char *gen_err, int comma
daemon->dns_client_id = opt_string_alloc(arg);
break;
+ case LOPT_UMBRELLA: /* --umbrella */
+ set_option_bool(OPT_UMBRELLA);
+ while (arg) {
+ comma = split(arg);
+ if (strstr(arg, "deviceid:")) {
+ if (strlen(arg+9) != 16) ret_err(_("Invalid Umbrella device ID"));
+ daemon->umbrella_device = opt_string_alloc(arg+9);
+ }
+ else if (strstr(arg, "orgid:")) {
+ if (!atoi_check(arg+6, &daemon->umbrella_org))
+ ret_err(_("Invalid Umbrella organization ID"));
+ }
+ else if (strstr(arg, "assetid:")) {
+ if (!atoi_check(arg+8, &daemon->umbrella_asset))
+ ret_err(_("Invalid Umbrella asset ID"));
+ }
+ arg = comma;
+ }
+ break;
+
case LOPT_ADD_MAC: /* --add-mac */
if (!arg)
set_option_bool(OPT_ADD_MAC);
--
2.29.2
More information about the Dnsmasq-discuss
mailing list