Addressed copilot comments + added -4/-6 switch to proxy

Author: danielinux

proxy/dohproxyd.c

@@ -1067,8 +1067,10 @@ static void accept_client(int fd, short revents, void *arg)
 static void usage(const char *name)
 {
     fprintf(stderr, "%s, ODoH proxy with legacy RFC8484 forwarding.\n", name);
-    fprintf(stderr, "Usage: %s -c cert -k key [-p port] [-u user] [-A cafile] [--target-url https://host/path]... [--targets-file file] [--target-cert cert --target-key key] [-F] [-v] [-V] [-h]\n", name);
+    fprintf(stderr, "Usage: %s -c cert -k key [-p port] [-4|-6] [-u user] [-A cafile] [--target-url https://host/path]... [--targets-file file] [--target-cert cert --target-key key] [-F] [-v] [-V] [-h]\n", name);
     fprintf(stderr, "  cert/key: TLS server certificate and key\n");
+    fprintf(stderr, "  -4: force IPv4 only\n");
+    fprintf(stderr, "  -6: force IPv6 only (default: dual-stack)\n");
     fprintf(stderr, "  -A/--ca-file: CA bundle for verifying upstream target TLS certs\n");
     fprintf(stderr, "  --target-url: repeatable legacy RFC8484 target URL\n");
     fprintf(stderr, "  --targets-file: file with target URLs (one per line)\n");
@@ -1083,11 +1085,13 @@ int main(int argc, char *argv[])
     char *targets_file = NULL;
     char *upstream_cafile = NULL;
     uint16_t port = PROXY_PORT;
+    int ip_version = 0;  /* 0 = dual-stack, 4 = IPv4 only, 6 = IPv6 only */
     int foreground = 0;
     int loglvl = DOH_WARN;
     int c, option_idx = 0;
     int yes = 1;
-    struct sockaddr_in6 addr;
+    struct sockaddr_in6 addr6;
+    struct sockaddr_in addr4;
     struct option long_options[] = {
         {"help", 0, 0, 'h'},
         {"version", 0, 0, 'V'},
@@ -1102,11 +1106,13 @@ int main(int argc, char *argv[])
         {"target-key", 1, 0, 'y'},
         {"target-url", 1, 0, 't'},
         {"targets-file", 1, 0, 'T'},
+        {"ipv4", 0, 0, '4'},
+        {"ipv6", 0, 0, '6'},
         {NULL, 0, 0, 0}
     };
 
     while (1) {
-        c = getopt_long(argc, argv, "hVc:k:p:u:A:vFx:y:t:T:", long_options, &option_idx);
+        c = getopt_long(argc, argv, "46hVc:k:p:u:A:vFx:y:t:T:", long_options, &option_idx);
         if (c < 0)
             break;
 
@@ -1122,6 +1128,8 @@ int main(int argc, char *argv[])
             case 'F': foreground = 1; break;
             case 'x': target_client_cert = strdup(optarg); break;
             case 'y': target_client_key = strdup(optarg); break;
+            case '4': ip_version = 4; break;
+            case '6': ip_version = 6; break;
             case 't':
                 if (add_target_url(optarg) != 0)
                     return 2;
@@ -1181,19 +1189,50 @@ int main(int argc, char *argv[])
     if (wolfSSL_CTX_use_PrivateKey_file(srv_ctx, key, SSL_FILETYPE_PEM) != SSL_SUCCESS)
         return 1;
 
-    lfd = socket(AF_INET6, SOCK_STREAM, 0);
-    if (lfd < 0)
-        return 1;
+    /* Create listening socket based on IP version preference */
+    if (ip_version == 4) {
+        /* IPv4 only */
+        lfd = socket(AF_INET, SOCK_STREAM, 0);
+        if (lfd < 0)
+            return 1;
+        setsockopt(lfd, SOL_SOCKET, SO_REUSEADDR, (char *)&yes, sizeof(yes));
+        setsockopt(lfd, SOL_SOCKET, SO_REUSEPORT, (char *)&yes, sizeof(yes));
 
-    setsockopt(lfd, SOL_SOCKET, SO_REUSEADDR, (char *)&yes, sizeof(yes));
-    setsockopt(lfd, SOL_SOCKET, SO_REUSEPORT, (char *)&yes, sizeof(yes));
+        memset(&addr4, 0, sizeof(addr4));
+        addr4.sin_family = AF_INET;
+        addr4.sin_addr.s_addr = INADDR_ANY;
+        addr4.sin_port = htons(port);
 
-    memset(&addr, 0, sizeof(addr));
-    addr.sin6_family = AF_INET6;
-    addr.sin6_port = htons(port);
+        if (bind(lfd, (struct sockaddr *)&addr4, sizeof(addr4)) != 0)
+            return 1;
+        dohprint(DOH_NOTICE, "dohproxyd listening on 0.0.0.0:%u (IPv4 only)", port);
+    } else {
+        /* IPv6 (with or without dual-stack) */
+        lfd = socket(AF_INET6, SOCK_STREAM, 0);
+        if (lfd < 0)
+            return 1;
+        setsockopt(lfd, SOL_SOCKET, SO_REUSEADDR, (char *)&yes, sizeof(yes));
+        setsockopt(lfd, SOL_SOCKET, SO_REUSEPORT, (char *)&yes, sizeof(yes));
 
-    if (bind(lfd, (struct sockaddr *)&addr, sizeof(addr)) != 0)
-        return 1;
+        if (ip_version == 6) {
+            /* IPv6 only - disable dual-stack */
+            int ipv6only = 1;
+            setsockopt(lfd, IPPROTO_IPV6, IPV6_V6ONLY, &ipv6only, sizeof(ipv6only));
+        }
+
+        memset(&addr6, 0, sizeof(addr6));
+        addr6.sin6_family = AF_INET6;
+        addr6.sin6_addr = in6addr_any;
+        addr6.sin6_port = htons(port);
+
+        if (bind(lfd, (struct sockaddr *)&addr6, sizeof(addr6)) != 0)
+            return 1;
+
+        if (ip_version == 6)
+            dohprint(DOH_NOTICE, "dohproxyd listening on [::]:%u (IPv6 only)", port);
+        else
+            dohprint(DOH_NOTICE, "dohproxyd listening on [::]:%u (dual-stack)", port);
+    }
 
     if (listen(lfd, 32) != 0)
         return 1;
@@ -1207,7 +1246,6 @@ int main(int argc, char *argv[])
     }
 
     evquick_addevent(lfd, EVQUICK_EV_READ, accept_client, NULL, NULL);
-    dohprint(DOH_NOTICE, "dohproxyd listening on [::]:%u", port);
 
     while (run)
         evquick_loop();

src/dohd.c

@@ -680,6 +680,14 @@ static int dns_send_request_h2(struct req_slot *req)
     }
     req->ev_dns = evquick_addevent(req->dns_sd, EVQUICK_EV_READ, dohd_reply,
             NULL, req);
+    if (!req->ev_dns) {
+        /* Event registration failed - destroy request immediately */
+        dohprint(DOH_ERR, "Failed to register DNS socket event");
+        DOH_Stats.socket_errors++;
+        check_stats();
+        dohd_destroy_request(req);
+        return -1;
+    }
     ret = sendto(req->dns_sd, req->h2_request_buffer, req->h2_request_len, 0,
             (struct sockaddr *)req->resolver, req->resolver_sz);
     if (ret < 0) {
@@ -1070,9 +1078,16 @@ static int h2_cb_on_frame_recv(nghttp2_session *session,
                     };
                     nghttp2_submit_response(session, frame->hd.stream_id, nva, 2, NULL);
                     dohd_destroy_request(req);
-                } else if (req->h2_request_len > 0)
-                    dns_send_request_h2(req);
-                else
+                } else if (req->h2_request_len > 0) {
+                    if (dns_send_request_h2(req) < 0) {
+                        /* Request already destroyed by dns_send_request_h2, send error */
+                        nghttp2_nv nva[] = {
+                            MAKE_NV(":status", "500"),
+                            MAKE_NV("server", "dohd"),
+                        };
+                        nghttp2_submit_response(session, frame->hd.stream_id, nva, 2, NULL);
+                    }
+                } else
                     dohd_destroy_request(req);
             }
             break;

src/libevquick.c

@@ -348,28 +348,31 @@ CTX evquick_init(void)
     if (!ctx)
         return NULL;
     ctx->giveup = 0;
+    ctx->epfd = -1;
+    ctx->time_machine[0] = -1;
+    ctx->time_machine[1] = -1;
+
     ctx->timers = heap_init();
     if (!ctx->timers)
-        return NULL;
+        goto fail;
     if(pipe(ctx->time_machine) < 0)
-        return NULL;
+        goto fail;
     (void)yes;
     fcntl(ctx->time_machine[1], F_SETFL, O_NONBLOCK);
 
     /* Create epoll instance */
     ctx->epfd = epoll_create1(0);
     if (ctx->epfd < 0) {
         perror("epoll_create1");
-        return NULL;
+        goto fail;
     }
 
     /* Add time_machine pipe to epoll for timer wakeups */
     ev.events = EPOLLIN;
     ev.data.ptr = NULL;  /* NULL ptr indicates time_machine */
     if (epoll_ctl(ctx->epfd, EPOLL_CTL_ADD, ctx->time_machine[0], &ev) < 0) {
         perror("epoll_ctl time_machine");
-        close(ctx->epfd);
-        return NULL;
+        goto fail;
     }
 
     ctx->n_events = 1;
@@ -378,11 +381,23 @@ CTX evquick_init(void)
     act.sa_flags = SA_NODEFER;
     if (sigaction(SIGALRM, &act, NULL) < 0) {
         perror("Setting alarm signal");
-        return NULL;
+        goto fail;
     }
     ctx_add(ctx);
     timer_new(ctx);
     return ctx;
+
+fail:
+    if (ctx->epfd >= 0)
+        close(ctx->epfd);
+    if (ctx->time_machine[0] >= 0)
+        close(ctx->time_machine[0]);
+    if (ctx->time_machine[1] >= 0)
+        close(ctx->time_machine[1]);
+    if (ctx->timers)
+        heap_destroy(ctx->timers);
+    free(ctx);
+    return NULL;
 }
 
 

test/stress_test.sh

@@ -115,6 +115,8 @@ worker() {
         result=$(curl -s -k --http2 -4 \
             --connect-timeout 2 \
             --max-time 5 \
+            -H "Accept: application/dns-message" \
+            -H "Content-Type: application/dns-message" \
             -o /dev/null \
             -w "%{http_code}" \
             "https://127.0.0.1:$PORT/?dns=$dns_q" 2>&1)
@@ -177,7 +179,7 @@ fi
 # Verify responding
 echo "Verifying dohd is responsive..."
 for i in {1..5}; do
-    if timeout 5 curl -s -k --http2 -4 "https://127.0.0.1:$PORT/?dns=${DNS_QUERIES[0]}" -o /dev/null 2>&1; then
+    if timeout 5 curl -s -k --http2 -4 -H "Accept: application/dns-message" -H "Content-Type: application/dns-message" "https://127.0.0.1:$PORT/?dns=${DNS_QUERIES[0]}" -o /dev/null 2>&1; then
         echo "dohd is responding"
         break
     fi
@@ -218,7 +220,7 @@ while [ $(date +%s) -lt $END_TIME ]; do
     fi
 
     # Health check
-    if ! timeout 5 curl -s -k --http2 -4 "https://127.0.0.1:$PORT/?dns=${DNS_QUERIES[0]}" -o /dev/null 2>&1; then
+    if ! timeout 5 curl -s -k --http2 -4 -H "Accept: application/dns-message" -H "Content-Type: application/dns-message" "https://127.0.0.1:$PORT/?dns=${DNS_QUERIES[0]}" -o /dev/null 2>&1; then
         echo "WARNING: Health check failed at $(date +%H:%M:%S)"
     fi
 

tools/Makefile

@@ -11,8 +11,8 @@ all: odoh-keygen
 debug: CFLAGS+= -ggdb -O0
 debug: odoh-keygen
 
-asan: CFLAGS+=-fsanitize=address
-asan: LDFLAGS+=-fsanitize=address
+asan: CFLAGS+= -fsanitize=address
+asan: LDFLAGS+= -fsanitize=address
 asan: odoh-keygen
 
 odoh-keygen: odoh-keygen.o

tools/odoh-keygen.c

@@ -79,15 +79,19 @@ static int write_odoh_config(const char *path, const uint8_t *pub, size_t pub_le
     {
         int fd = open(path, O_WRONLY | O_APPEND, 0644);
         ssize_t w;
+        size_t off = 0;
         if (fd < 0) {
             fprintf(stderr, "Cannot append to %s: %s\n", path, strerror(errno));
             return -1;
         }
-        w = write(fd, pub, pub_len);
-        if (w != (ssize_t)pub_len) {
-            close(fd);
-            fprintf(stderr, "Cannot append public key to %s\n", path);
-            return -1;
+        while (off < pub_len) {
+            w = write(fd, pub + off, pub_len - off);
+            if (w <= 0) {
+                close(fd);
+                fprintf(stderr, "Cannot append public key to %s: %s\n", path, strerror(errno));
+                return -1;
+            }
+            off += (size_t)w;
         }
         if (close(fd) != 0) {
             fprintf(stderr, "Cannot close %s: %s\n", path, strerror(errno));