Add DNS forwarder to veil-proxy.

Users currently have little flexibility in how their enclave uses DNS:
veil-daemon's -resolver flag is all there is. Users however may also
want to configure search domains, or have the enclave's DNS handled like
the EC2 host's.

To make all of that possible, this PR introduces a new command line flag
to veil-proxy: -dns-forwarder. When enabled, it instructs veil-proxy to
open both a UDP and TCP listener on port 53 on the tun interface. All
incoming payload (the forwarder has no understanding of DNS; it simply
shuffles around bytes) is then blindly forwarded to the EC2 host's
nameservers configured in /etc/resolv.conf.

To make use of this feature, start veil-proxy with the new flag:

    veil-proxy -dns-forwarder

Then, set veil-daemon's resolver to the host's IP address:

    veil-daemon -resolver 10.0.0.1

Fixes #61.

Author: NullHypothesis

cmd/veil-proxy/main.go

@@ -16,6 +16,7 @@ import (
 	"github.com/Amnesic-Systems/veil/internal/backoff"
 	"github.com/Amnesic-Systems/veil/internal/config"
 	"github.com/Amnesic-Systems/veil/internal/errs"
+	"github.com/Amnesic-Systems/veil/internal/net/dns"
 	"github.com/Amnesic-Systems/veil/internal/net/nat"
 	"github.com/Amnesic-Systems/veil/internal/net/proxy"
 	"github.com/Amnesic-Systems/veil/internal/net/tun"
@@ -24,30 +25,40 @@ import (
 	"github.com/mdlayher/vsock"
 )
 
+const hostResolvConf = "/etc/resolv.conf"
+
 func parseFlags(out io.Writer, args []string) (_ *config.VeilProxy, err error) {
 	defer errs.Wrap(&err, "failed to parse flags")
 
 	fs := flag.NewFlagSet("veil-proxy", flag.ContinueOnError)
 	fs.SetOutput(out)
 
+	dnsForwarder := fs.Bool(
+		"dns-forwarder",
+		false,
+		`Enable DNS forwarder on the tun interface. Have veil-daemon use this
+resolver by passing "-resolver 10.0.0.1". The resolver forwards queries
+to the nameservers configured in /etc/resolv.conf.`,
+	)
 	profile := fs.Bool(
 		"profile",
 		false,
-		"enable profiling",
+		"Enable profiling.",
 	)
 	vsockPort := fs.Uint(
 		"vsock-port",
 		tunnel.DefaultVSOCKPort,
-		"VSOCK listening port that veil connects to",
+		"VSOCK listening port that veil connects to.",
 	)
 	if err := fs.Parse(args); err != nil {
 		return nil, err
 	}
 
 	// Build and validate the configuration.
 	cfg := &config.VeilProxy{
-		Profile:   *profile,
-		VSOCKPort: uint32(*vsockPort),
+		DNSForwarder: *dnsForwarder,
+		Profile:      *profile,
+		VSOCKPort:    uint32(*vsockPort),
 	}
 	return cfg, validate.Object(cfg)
 }
@@ -62,7 +73,7 @@ func listenVSOCK(port uint32) (_ net.Listener, err error) {
 	return vsock.ListenContextID(cid, port, nil)
 }
 
-func acceptLoop(ctx context.Context, ln net.Listener) {
+func acceptLoop(ctx context.Context, ln net.Listener, cfg *config.VeilProxy) {
 	// Print errors that occur while forwarding packets.
 	ch := make(chan error)
 	defer close(ch)
@@ -93,6 +104,15 @@ func acceptLoop(ctx context.Context, ln net.Listener) {
 			defer func() { _ = tunDev.Close() }()
 			log.Print("Created tun device.")
 
+			dns, err := startDNSForwarder(ctx, cfg)
+			if err != nil {
+				return fmt.Errorf("failed to start DNS forwarder: %w", err)
+			}
+			if dns != nil {
+				defer func() { _ = dns.Close() }()
+				log.Printf("Started DNS forwarder at %s.", dns.UDPAddr())
+			}
+
 			var wg sync.WaitGroup
 			wg.Add(2)
 			go proxy.VSOCKToTun(vm, tunDev, ch, &wg)
@@ -112,6 +132,26 @@ func acceptLoop(ctx context.Context, ln net.Listener) {
 	}
 }
 
+func startDNSForwarder(
+	ctx context.Context,
+	cfg *config.VeilProxy,
+) (*dns.Forwarder, error) {
+	if !cfg.DNSForwarder {
+		return nil, nil
+	}
+
+	upstreams, err := dns.UpstreamsFromFile(hostResolvConf)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read DNS upstreams from %s: %w",
+			hostResolvConf, err)
+	}
+
+	return dns.Start(ctx, dns.Config{
+		ListenAddr: net.JoinHostPort(tun.ProxyIP, "53"),
+		Upstreams:  upstreams,
+	})
+}
+
 func run(ctx context.Context, out io.Writer, args []string) (origErr error) {
 	ctx, cancel := signal.NotifyContext(ctx, os.Interrupt)
 	defer cancel()
@@ -156,7 +196,7 @@ func run(ctx context.Context, out io.Writer, args []string) (origErr error) {
 
 	// Accept new connections from the VSOCK listener and begin forwarding
 	// packets.
-	acceptLoop(ctx, ln)
+	acceptLoop(ctx, ln, cfg)
 	return nil
 }
 

internal/config/veil_proxy.go

@@ -2,6 +2,10 @@ package config
 
 // VeilProxy represents veil-proxy's configuration.
 type VeilProxy struct {
+	// DNSForwarder enables a forwarding DNS resolver on the host side of
+	// veil's TUN interface.
+	DNSForwarder bool
+
 	// Profile can be set to true to enable profiling.
 	Profile bool