dns: NSS module implementation

accounts-service/com.endlessm.ParentalControls.Dns.xml

@@ -0,0 +1,41 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE node PUBLIC "-//freedesktop//DTD D-BUS Object Introspection 1.0//EN"
+ "http://www.freedesktop.org/standards/dbus/1.0/introspect.dtd">
+<node>
+  <interface name="com.endlessm.ParentalControls.Dns">
+    <annotation name="org.freedesktop.Accounts.VendorExtension" value="true"/>
+
+    <annotation name="org.freedesktop.Accounts.Authentication.ChangeOwn"
+      value="com.endlessm.ParentalControls.SessionLimits.ChangeOwn"/>
+    <annotation name="org.freedesktop.Accounts.Authentication.ReadOwn"
+      value="com.endlessm.ParentalControls.SessionLimits.ReadOwn"/>
+    <annotation name="org.freedesktop.Accounts.Authentication.ChangeAny"
+      value="com.endlessm.ParentalControls.SessionLimits.ChangeAny"/>
+    <annotation name="org.freedesktop.Accounts.Authentication.ReadAny"
+      value="com.endlessm.ParentalControls.SessionLimits.ReadAny"/>
+
+    <!--
+      Dns:
+
+      A list of DNS server IP addresses to use for this user, in order of preference.
+
+      Each can be optionally qualified by a hashtag and the corresponding
+      hostname (if a TLS version is supported).
+
+      For instance: using "dns0.eu Kids" (https://www.dns0.eu/kids),
+      which offers a good number of blocked domains, would entail:
+
+        - `193.110.81.1#kids.dns0.eu`
+        - `2a0f:fc80::1#kids.dns0.eu`
+        - `185.253.5.1#kids.dns0.eu`
+        - `2a0f:fc81::1#kids.dns0.eu`
+
+      If the array is left empty, the globally-set system resolver
+      is used instead.
+    -->
+    <property name="Dns" type="as" access="readwrite">
+      <annotation name="org.freedesktop.Accounts.DefaultValue" value=""/>
+    </property>
+
+  </interface>
+</node>

accounts-service/com.endlessm.ParentalControls.policy.in

@@ -40,6 +40,46 @@
     </defaults>
   </action>
 
+  <action id="com.endlessm.ParentalControls.Dns.ChangeOwn">
+    <description>Change your own DNS servers</description>
+    <message>Authentication is required to change your DNS servers.</message>
+    <defaults>
+      <allow_any>auth_admin_keep</allow_any>
+      <allow_inactive>auth_admin_keep</allow_inactive>
+      <allow_active>auth_admin_keep</allow_active>
+    </defaults>
+  </action>
+
+  <action id="com.endlessm.ParentalControls.Dns.ReadOwn">
+    <description>Read your own DNS servers</description>
+    <message>Authentication is required to read your DNS servers.</message>
+    <defaults>
+      <allow_any>yes</allow_any>
+      <allow_inactive>yes</allow_inactive>
+      <allow_active>yes</allow_active>
+    </defaults>
+  </action>
+
+  <action id="com.endlessm.ParentalControls.Dns.ChangeAny">
+    <description>Change another user’s DNS servers</description>
+    <message>Authentication is required to change another user’s DNS servers.</message>
+    <defaults>
+      <allow_any>auth_admin_keep</allow_any>
+      <allow_inactive>auth_admin_keep</allow_inactive>
+      <allow_active>auth_admin_keep</allow_active>
+    </defaults>
+  </action>
+
+  <action id="com.endlessm.ParentalControls.Dns.ReadAny">
+    <description>Read another user’s DNS servers</description>
+    <message>Authentication is required to read another user’s DNS servers.</message>
+    <defaults>
+      <allow_any>auth_admin_keep</allow_any>
+      <allow_inactive>auth_admin_keep</allow_inactive>
+      <allow_active>auth_admin_keep</allow_active>
+    </defaults>
+  </action>
+
   <action id="com.endlessm.ParentalControls.SessionLimits.ChangeOwn">
     <description>Change your own session limits</description>
     <message>Authentication is required to change your session limits.</message>

accounts-service/com.endlessm.ParentalControls.rules.in

@@ -24,6 +24,8 @@ polkit.addRule(function(action, subject) {
      * needing an additional polkit authorisation dialogue. */
     if ((action.id == "com.endlessm.ParentalControls.AppFilter.ReadOwn" ||
          action.id == "com.endlessm.ParentalControls.AppFilter.ReadAny" ||
+         action.id == "com.endlessm.ParentalControls.Dns.ReadOwn" ||
+         action.id == "com.endlessm.ParentalControls.Dns.ReadAny" ||
          action.id == "com.endlessm.ParentalControls.SessionLimits.ReadOwn" ||
          action.id == "com.endlessm.ParentalControls.SessionLimits.ReadAny") &&
         subject.active && subject.local &&

accounts-service/meson.build

@@ -9,6 +9,7 @@ i18n.merge_file(
 dbus_interfaces = [
   'com.endlessm.ParentalControls.AccountInfo',
   'com.endlessm.ParentalControls.AppFilter',
+  'com.endlessm.ParentalControls.Dns',
   'com.endlessm.ParentalControls.SessionLimits',
 ]
 

meson.build

@@ -1,6 +1,6 @@
 project('malcontent', 'c',
   version : '0.12.0',
-  meson_version : '>= 0.59.0',
+  meson_version : '>= 0.60.0',
   license: ['LGPL-2.1-or-later', 'GPL-2.0-or-later'],
   default_options : [
     'buildtype=debugoptimized',
@@ -154,3 +154,7 @@ if get_option('ui').enabled()
 endif
 subdir('pam')
 subdir('po')
+
+if get_option('dns').enabled()
+  subdir('nss')
+endif

meson_options.txt

@@ -9,6 +9,12 @@ option(
   type: 'string',
   description: 'directory for PAM modules'
 )
+option(
+  'dns',
+  type: 'feature',
+  value: 'enabled',
+  description: 'enable NSS module support (for parental DNS controls)'
+)
 option(
   'ui',
   type: 'feature',

nss/.gitignore

@@ -0,0 +1,10 @@
+# SPDX-FileCopyrightText: Matteo Settenvini <matteo.settenvini@montecristosoftware.eu>
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+*.orig
+*~
+
+.gdbinit
+.lldbinit
+
+/target

nss/.vscode/launch.json

@@ -0,0 +1,30 @@
+{
+    // Use IntelliSense to learn about possible attributes.
+    // Hover to view descriptions of existing attributes.
+    // For more information, visit: https://go.microsoft.com/fwlink/?linkid=830387
+    "version": "0.2.0",
+    "configurations": [
+        {
+            "type": "lldb",
+            "request": "launch",
+            "name": "Cargo integration_test",
+            "cargo": {
+                "args": [
+                    "test",
+                    "--no-run",
+                    "--test=integration_test"
+                ]
+            },
+            "args": [],
+            "cwd": "${workspaceFolder}",
+            "env": {
+                "RUST_BACKTRACE": "full",
+                "NSS_MALCONTENT_LOG": "trace",
+            },
+            "preRunCommands": [
+                "settings set target.process.follow-fork-mode child",
+                "settings set target.process.stop-on-exec false"
+            ]
+        },
+    ]
+}

nss/Cargo.lock.license

@@ -0,0 +1,2 @@
+SPDX-FileCopyrightText: Matteo Settenvini <matteo.settenvini@montecristosoftware.eu>
+SPDX-License-Identifier: CC0-1.0

nss/Cargo.toml

@@ -0,0 +1,54 @@
+# SPDX-FileCopyrightText: 2022 Matteo Settenvini <matteo.settenvini@montecristosoftware.eu>
+# SPDX-License-Identifier: CC0-1.0
+
+[package]
+name = "malcontent-nss"
+version = "0.1.0"
+edition = "2021"
+authors = ["Matteo Settenvini <matteo.settenvini@montecristosoftware.eu"]
+license = "GPL-3.0-or-later"
+
+[profile.release]
+strip = true
+lto = true
+codegen-units = 1
+panic = "unwind"  # We rely on this
+
+[features]
+integration_test = ["dep:zbus_names"]
+
+[lib]
+crate-type = ["cdylib"]
+name = "nss_malcontent"
+
+[dependencies]
+anyhow = "1.0"
+gethostname = "0.4"
+libc = "0.2"
+once_cell = "1.13"
+ld_preload = "0.1"
+log = "0.4"
+nix = { version = "0.27", features = ["socket", "user", "net", "sched"] }
+serde = "1.0"
+syslog = "6.1"
+tokio = { version = "1", features = ["rt"] }
+hickory-resolver = { version = "0.24", features = ["dns-over-native-tls"] }
+hickory-proto = "0.24"
+zbus = { version = "3.0", default-features = false, features = ["tokio"] }
+zvariant = "3.6"
+zbus_names = { version = "2.2", optional = true }
+
+[dev-dependencies]
+elf = "0.7"
+malcontent-nss = { path = ".", features = ["integration_test"] }
+env_logger = "0.10"
+event-listener = "4.0"
+rusty-fork = "*"
+futures-util = "0.3"
+static_init = "1.0"
+test-cdylib = "1.1"
+tokio = { version = "1", features = ["rt", "sync", "macros", "net", "time"] }
+tokio-util = { version = "0.7" }
+
+[build-dependencies]
+bindgen = "0.69"

nss/README.md

@@ -0,0 +1,15 @@
+# Malcontent NSS Module
+
+This is a NSS module allowing to perform parental controls
+when querying the system interfaces for hostname resolution (DNS).
+
+A system administrator would install the module and then add it to the
+`hosts` entry in `/etc/nsswitch.conf`. For instance:
+
+```
+hosts: files myhostname malcontent resolve [!UNAVAIL=return] dns
+```
+
+Note how `malcontent` precedes both systemd's `resolve` and the libc `dns` modules.
+
+Parental control configuration would happen through the Malcontent client or GUI.

nss/README.md.license

@@ -0,0 +1,2 @@
+SPDX-FileCopyrightText: Matteo Settenvini <matteo.settenvini@montecristosoftware.eu>
+SPDX-License-Identifier: CC-BY-SA-4.0

nss/build.rs

@@ -0,0 +1,58 @@
+// SPDX-FileCopyrightText: Matteo Settenvini <matteo.settenvini@montecristosoftware.eu>
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+use {std::env, std::io::Error, std::io::ErrorKind, std::path::PathBuf};
+
+fn main() {
+    println!("cargo:rerun-if-changed=build.rs");
+    println!("cargo:rerun-if-changed=wrapper.hpp");
+
+    // Required by NSS 2
+    println!("cargo:rustc-cdylib-link-arg=-Wl,-soname,libnss_malcontent.so.2");
+
+    // Pass down the path to the output folder to the integration test binary
+    let cdylib_dir = get_cargo_target_dir().unwrap();
+    println!("cargo:rustc-env=CDYLIB_OUT_DIR={}", cdylib_dir.display());
+    // Set the DT_RPATH of the test binary to search in its own folder first
+    println!("cargo:rustc-link-arg-tests=-Wl,--disable-new-dtags");
+    println!("cargo:rustc-link-arg-tests=-Wl,--rpath=$ORIGIN");
+
+    let bindings = bindgen::Builder::default()
+        .header("wrapper.hpp")
+        .parse_callbacks(Box::new(bindgen::CargoCallbacks::new()))
+        .newtype_enum("nss_status")
+        .allowlist_type("nss_status")
+        .newtype_enum("HErrno")
+        .allowlist_type("HErrno")
+        .newtype_enum("EaiRetcode")
+        .allowlist_type("EaiRetcode")
+        .allowlist_type("gaih_addrtuple")
+        .allowlist_function("__nss_configure_lookup")
+        .generate()
+        .expect("Unable to generate bindings");
+
+    let out_path = PathBuf::from(env::var("OUT_DIR").unwrap());
+    bindings
+        .write_to_file(out_path.join("bindings.rs"))
+        .expect("Couldn't write bindings!");
+}
+
+fn get_cargo_target_dir() -> Result<PathBuf, Box<dyn std::error::Error>> {
+    let out_dir = PathBuf::from(env::var("OUT_DIR")?);
+    let profile = std::env::var("PROFILE")?;
+
+    let mut path = out_dir.as_path();
+    loop {
+        if let Some(parent) = path.parent() {
+            path = parent;
+            if parent.ends_with(&profile) {
+                return Ok(path.to_path_buf());
+            }
+        } else {
+            return Err(Box::new(Error::new(
+                ErrorKind::NotFound,
+                "Unable to determine cargo build target directory",
+            )));
+        }
+    }
+}

nss/meson.build

@@ -0,0 +1,59 @@
+# SPDX-FileCopyrightText: Matteo Settenvini <matteo.settenvini@montecristosoftware.eu>
+# SPDX-License-Identifier: GPL-3.0-or-later
+
+if get_option('buildtype') == 'debug'
+    profile = 'dev'
+    target_subdir = 'debug'
+else
+    profile = 'release'
+    target_subdir = 'release'
+endif
+
+dbus_iface_file = meson.project_source_root() / 'accounts-service/com.endlessm.ParentalControls.Dns.xml'
+env = environment({
+    'DBUS_IFACE': dbus_iface_file,
+})
+
+cargo = find_program('cargo')
+cargo_common_opts = [
+    '--manifest-path', meson.current_source_dir() / 'Cargo.toml',
+    '--workspace',
+    '--profile', profile,
+    '--target-dir', meson.current_build_dir() / 'target',
+]
+
+library = 'libnss_malcontent.so'
+
+build_library = custom_target('cargo-nss_malcontent',
+    output: 'target' / target_subdir / library,
+    build_always_stale: true,
+    command: [cargo, 'build'] + cargo_common_opts,
+    console: true,
+    env: env,
+)
+
+custom_target('libnss_malcontent',
+    input: build_library,
+    output: library + '.2', # Required by NSS 3
+    build_by_default: true,
+    command: ['ln', '-f', '@INPUT@', '@OUTPUT@'],
+    env: env,
+    install: true,
+    install_dir: get_option('libdir'),
+)
+
+build_tests = custom_target('nss_malcontent-tests',
+    output: 'something-something-something',
+    build_always_stale: true,
+    build_by_default: true,
+    command: [cargo, 'test'] + cargo_common_opts + '--no-run',
+    console: true,
+    env: env
+)
+
+test('dns', cargo,
+    args: ['test'] + cargo_common_opts + ['--no-fail-fast', '--message-format', 'json'],
+    env: env,
+    depends: [build_tests],
+    protocol: 'rust',
+)

nss/src/gethostbyaddr.rs

@@ -0,0 +1,33 @@
+// SPDX-FileCopyrightText: Matteo Settenvini <matteo.settenvini@montecristosoftware.eu>
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+use {
+    crate::nss_bindings::{nss_status, HErrno},
+    libc::{hostent, size_t, socklen_t},
+    nix::errno::Errno,
+    std::os::raw::{c_char, c_int, c_void},
+};
+
+pub async unsafe fn with(
+    _addr: *const c_void,
+    _len: socklen_t,
+    _af: c_int,
+    _host: *mut hostent,
+    _buffer: *mut c_char,
+    _buflen: size_t,
+    _errnop: *mut Errno,
+    _h_errnop: *mut HErrno,
+    _ttlp: *mut i32,
+) -> nss_status {
+    // At the moment, we are not handling this function
+    // in our module.
+    //
+    // We assume it is fine to go to the next module
+    // in the nsswitch.conf list to get an authoritative
+    // answer.
+    //
+    // The use case for reverse IP lookup
+    // should not impact parental controls.
+
+    nss_status::NSS_STATUS_UNAVAIL
+}

nss/src/gethostbyname.rs

@@ -0,0 +1,337 @@
+// SPDX-FileCopyrightText: Matteo Settenvini <matteo.settenvini@montecristosoftware.eu>
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+use hickory_resolver::error::ResolveErrorKind;
+
+use {
+    crate::helpers::{set_if_valid, write_record_name_to_buf, write_vector_to_buf},
+    crate::nss_bindings::{gaih_addrtuple, nss_status, HErrno},
+    crate::policy_checker::POLICY_CHECKER,
+    hickory_proto::rr::record_type::RecordType,
+    hickory_proto::rr::{RData, Record},
+    hickory_resolver::TokioAsyncResolver,
+    hickory_resolver::{lookup::Lookup, lookup_ip::LookupIp},
+    libc::{c_char, c_int, hostent, size_t, AF_INET, AF_INET6},
+    nix::errno,
+    nix::errno::Errno,
+    std::ffi::CStr,
+    std::mem::{align_of, discriminant, size_of},
+    std::sync::Arc,
+};
+
+// See https://support.mozilla.org/en-US/kb/configuring-networks-disable-dns-over-https
+const CANARY_HOSTNAME: &str = "use-application-dns.net";
+
+#[derive(Debug)]
+pub struct Args {
+    pub name: *const c_char,
+    pub family: c_int,
+    pub buffer: *mut c_char,
+    pub buflen: size_t,
+    pub errnop: *mut Errno,
+    pub h_errnop: *mut HErrno,
+    pub ttlp: *mut i32,
+    pub result: Result,
+}
+
+#[derive(Debug)]
+pub enum Result {
+    V3(*mut hostent),
+    V4(*mut *mut gaih_addrtuple),
+}
+
+pub enum DnsResult {
+    NxDomain,
+    Found,
+}
+
+pub async unsafe fn with(args: &mut Args) -> nss_status {
+    set_if_valid(args.errnop, errno::from_i32(0));
+    set_if_valid(args.h_errnop, HErrno::Success);
+
+    match POLICY_CHECKER.resolver().await {
+        Ok(None) => {
+            // no restrictions for user, the next NSS module will decide
+            nss_status::NSS_STATUS_NOTFOUND
+        }
+        Ok(Some(resolver)) => resolve_hostname_through(resolver, args).await,
+        Err(err) => {
+            log::error!("{}", err);
+            nss_status::NSS_STATUS_UNAVAIL
+        }
+    }
+}
+
+async unsafe fn resolve_hostname_through(
+    resolver: Arc<TokioAsyncResolver>,
+    args: &mut Args,
+) -> nss_status {
+    let name = match CStr::from_ptr(args.name).to_str() {
+        Ok(name) => name,
+        Err(_) => {
+            set_if_valid(args.errnop, Errno::EINVAL);
+            set_if_valid(args.h_errnop, HErrno::Internal);
+            return nss_status::NSS_STATUS_TRYAGAIN;
+        }
+    };
+
+    // Disable DoH in Firefox unless user forced it manually
+    if name == CANARY_HOSTNAME {
+        set_if_valid(args.h_errnop, HErrno::HostNotFound);
+        return nss_status::NSS_STATUS_SUCCESS;
+    }
+
+    let lookup: std::result::Result<Lookup, _> = match args.family {
+        libc::AF_UNSPEC => resolver.lookup_ip(name).await.map(LookupIp::into),
+        libc::AF_INET => resolver.lookup(name, RecordType::A).await,
+        libc::AF_INET6 => resolver.lookup(name, RecordType::AAAA).await,
+        _ => return nss_status::NSS_STATUS_NOTFOUND,
+    };
+
+    match lookup {
+        Ok(result) => {
+            log::trace!("lookup: {} => {:?}", name, result);
+            prepare_response(args, result)
+        }
+        Err(err) => match err.kind() {
+            ResolveErrorKind::NoRecordsFound {
+                query: _,
+                soa: _,
+                negative_ttl: _,
+                response_code: _,
+                trusted: _,
+            } => {
+                log::trace!("lookup: {} => NXDOMAIN", name);
+                set_if_valid(args.h_errnop, HErrno::HostNotFound);
+                nss_status::NSS_STATUS_SUCCESS
+            }
+            _ => {
+                log::warn!("{}", err);
+                nss_status::NSS_STATUS_UNAVAIL
+            }
+        },
+    }
+}
+
+unsafe fn prepare_response(
+    args: &mut Args,
+    lookup: hickory_resolver::lookup::Lookup,
+) -> nss_status {
+    if lookup.iter().peekable().peek().is_none() {
+        set_if_valid(args.h_errnop, HErrno::HostNotFound);
+        return nss_status::NSS_STATUS_SUCCESS;
+    }
+
+    let ttl = lookup
+        .valid_until()
+        .duration_since(std::time::Instant::now())
+        .as_secs();
+    set_if_valid(
+        args.ttlp,
+        if ttl < (i32::MAX as u64) {
+            ttl as i32
+        } else {
+            i32::MAX
+        },
+    );
+
+    let buf = std::slice::from_raw_parts_mut(args.buffer as *mut u8, args.buflen);
+    let ret = match &mut args.result {
+        Result::V3(hostent) => {
+            if hostent.is_null() {
+                set_if_valid(args.errnop, Errno::EINVAL);
+                set_if_valid(args.h_errnop, HErrno::Internal);
+                return nss_status::NSS_STATUS_TRYAGAIN;
+            }
+
+            match records_to_hostent(lookup.into(), &mut **hostent, buf) {
+                Ok(DnsResult::Found) => nss_status::NSS_STATUS_SUCCESS,
+                Ok(DnsResult::NxDomain) => {
+                    set_if_valid(args.h_errnop, HErrno::HostNotFound);
+                    nss_status::NSS_STATUS_SUCCESS
+                }
+                Err(err) => {
+                    set_if_valid(
+                        args.errnop,
+                        err.raw_os_error()
+                            .map(Errno::from_i32)
+                            .unwrap_or(Errno::EAGAIN),
+                    );
+                    set_if_valid(args.h_errnop, HErrno::Internal);
+                    nss_status::NSS_STATUS_TRYAGAIN
+                }
+            }
+        }
+        Result::V4(pat) => {
+            if pat.is_null() {
+                set_if_valid(args.errnop, Errno::EINVAL);
+                set_if_valid(args.h_errnop, HErrno::Internal);
+                return nss_status::NSS_STATUS_TRYAGAIN;
+            }
+
+            match records_to_gaih_addr(lookup.into(), buf) {
+                Ok(addrs) => {
+                    // DEBUG: eprintln!("{:?} => {:?}", addrs, *addrs);
+                    **pat = addrs;
+                    nss_status::NSS_STATUS_SUCCESS
+                }
+                Err(err) => {
+                    set_if_valid(
+                        args.errnop,
+                        err.raw_os_error()
+                            .map(Errno::from_i32)
+                            .unwrap_or(Errno::EAGAIN),
+                    );
+                    set_if_valid(args.h_errnop, HErrno::Internal);
+                    nss_status::NSS_STATUS_TRYAGAIN
+                }
+            }
+        }
+    };
+
+    ret
+}
+
+// TODO: refactor to be less ugly
+pub unsafe fn records_to_hostent(
+    lookup: Lookup,
+    host: &mut hostent,
+    buf: &mut [u8],
+) -> std::io::Result<DnsResult> {
+    // In C struct hostent:
+    //
+    // - for the type of queries we perform, we can assume h_aliases
+    //   is an empty array.
+    // - hostent is limited to just one address type for all addresses
+    //   in the list. We pick the type of first result, and only
+    //   append addresses of the same type.
+
+    let first_record = match lookup.record_iter().peekable().peek() {
+        Some(record) => *record,
+        None => return Ok(DnsResult::NxDomain),
+    };
+
+    let first_rdata = match first_record.data() {
+        Some(rdata) => rdata,
+        None => return Err(Errno::ENODATA.into()),
+    };
+
+    // First put the name in the buffer
+    let (buf, name_dest) = write_record_name_to_buf(first_record, buf)?;
+
+    // Then the empty aliases array (just a null pointer)
+    let (mut buf, aliases_ptr) = write_vector_to_buf(buf, vec![std::ptr::null_mut()])?;
+
+    // Then the address list
+    let offset = buf.as_ptr().align_offset(align_of::<*mut c_char>());
+    buf = &mut buf[offset..];
+
+    let records = lookup
+        .record_iter()
+        .flat_map(Record::data)
+        .filter(|r| discriminant(*r) == discriminant(first_rdata));
+
+    let mut addresses = vec![];
+    for record in records {
+        let offset = buf.as_ptr().align_offset(align_of::<*mut c_char>());
+        buf = &mut buf[offset..];
+        addresses.push(buf.as_mut_ptr());
+
+        let l = match record {
+            RData::A(addr) => {
+                let octets = addr.octets();
+                let l = octets.len();
+                if buf.len() < l {
+                    return Err(Errno::ERANGE.into());
+                }
+                buf[..l].copy_from_slice(&octets);
+                l
+            }
+            RData::AAAA(addr) => {
+                let octets = addr.octets();
+                let l = octets.len();
+                if buf.len() < l {
+                    return Err(Errno::ERANGE.into());
+                }
+                buf[..l].copy_from_slice(&octets);
+                l
+            }
+            _ => unreachable!(),
+        };
+
+        buf = &mut buf[l..];
+    }
+
+    addresses.push(std::ptr::null_mut());
+    let (_, addr_list) = write_vector_to_buf(buf, addresses)?;
+
+    // Finally, populate the hostent structure
+    host.h_name = name_dest;
+    host.h_aliases = aliases_ptr;
+    host.h_addr_list = addr_list as *mut *mut c_char;
+    match first_rdata {
+        RData::A(_) => {
+            host.h_addrtype = AF_INET;
+            host.h_length = 4;
+        }
+        RData::AAAA(_) => {
+            host.h_addrtype = AF_INET6;
+            host.h_length = 16;
+        }
+        _ => return Err(Errno::EBADMSG.into()),
+    }
+
+    Ok(DnsResult::Found)
+}
+
+// TODO: error handling codes chosen a bit sloppily
+pub unsafe fn records_to_gaih_addr(
+    lookup: Lookup,
+    mut buf: &mut [u8],
+) -> std::io::Result<*mut gaih_addrtuple> {
+    const GAIH_ADDRTUPLE_SZ: usize = size_of::<gaih_addrtuple>();
+
+    let mut ret = std::ptr::null_mut();
+    let mut prev_link: *mut *mut gaih_addrtuple = std::ptr::null_mut();
+
+    let mut name_dest;
+    for record in lookup.record_iter() {
+        // First add the name to the buffer
+        (buf, name_dest) = write_record_name_to_buf(record, buf)?;
+
+        // Then add the tuple with the address
+        let offset = buf.as_ptr().align_offset(align_of::<gaih_addrtuple>());
+        let l = GAIH_ADDRTUPLE_SZ;
+        if buf.len() < offset + l {
+            return Err(Errno::ERANGE.into());
+        }
+
+        let tuple = &mut *(buf.as_mut_ptr().add(offset) as *mut gaih_addrtuple);
+        tuple.next = std::ptr::null_mut();
+        tuple.name = name_dest;
+        tuple.scopeid = 0; // how to set tuple.scopeid correctly??? Use a custom trust_dns_resolver::ConnectionProvider?
+        set_if_valid(prev_link, &mut *tuple); // link from previous tuple to this tuple
+        prev_link = &mut (*tuple).next;
+
+        match record.data() {
+            Some(RData::A(addr)) => {
+                tuple.family = AF_INET;
+                tuple.addr[0] = std::mem::transmute_copy(&addr.octets());
+            }
+            Some(RData::AAAA(addr)) => {
+                tuple.family = AF_INET6;
+                tuple.addr = std::mem::transmute_copy(&addr.octets());
+            }
+            Some(_) => return Err(Errno::EBADMSG.into()),
+            None => return Err(Errno::ENODATA.into()),
+        }
+
+        if ret == std::ptr::null_mut() {
+            ret = tuple;
+        }
+
+        buf = &mut buf[(offset + l)..];
+    }
+
+    Ok(ret)
+}

nss/src/helpers.rs

@@ -0,0 +1,81 @@
+// SPDX-FileCopyrightText: Matteo Settenvini <matteo.settenvini@montecristosoftware.eu>
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+use {
+    hickory_proto::rr::resource::Record,
+    libc::c_char,
+    nix::errno::Errno,
+    once_cell::sync::Lazy,
+    std::ffi::CString,
+    std::mem::{align_of, size_of},
+};
+
+static RUNTIME: Lazy<std::io::Result<tokio::runtime::Runtime>> = Lazy::new(|| {
+    // The runtime should remain single-threaded, some
+    // programs depend on it (e.g. programs calling unshare())
+    let rt = tokio::runtime::Builder::new_current_thread()
+        .enable_time()
+        .enable_io()
+        .build()?;
+    Ok(rt)
+});
+
+pub fn write_record_name_to_buf<'a>(
+    record: &Record,
+    buf: &'a mut [u8],
+) -> std::io::Result<(&'a mut [u8], *mut c_char)> {
+    use std::io::{Error, ErrorKind};
+    let name = CString::new(record.name().to_utf8())
+        .map_err(|e| Error::new(ErrorKind::InvalidData, e.to_string()))?;
+
+    let offset = buf.as_ptr().align_offset(align_of::<libc::c_char>());
+    let name_src = name.as_bytes_with_nul();
+    let l = name_src.len();
+    if buf.len() < offset + l {
+        return Err(Errno::ERANGE.into());
+    }
+
+    let name_dest = unsafe { buf.as_mut_ptr().add(offset) };
+    unsafe {
+        std::ptr::copy_nonoverlapping(name_src.as_ptr(), name_dest, l);
+    }
+    Ok((&mut buf[(offset + l)..], name_dest as *mut c_char))
+}
+
+pub fn write_vector_to_buf<'a, T>(
+    buf: &'a mut [u8],
+    v: Vec<T>,
+) -> std::io::Result<(&'a mut [u8], *mut T)> {
+    let offset = buf.as_ptr().align_offset(align_of::<*mut T>());
+    let l = size_of::<*mut c_char>() * v.len();
+    if buf.len() < offset + l {
+        return Err(Errno::ERANGE.into());
+    }
+
+    let buf = &mut buf[offset..];
+    let dest = buf.as_mut_ptr().cast::<T>();
+    unsafe {
+        std::ptr::copy_nonoverlapping(v.as_ptr() as *const T, dest, l);
+    }
+    Ok((&mut buf[l..], dest))
+}
+
+pub fn set_if_valid<T>(ptr: *mut T, val: T) {
+    if !ptr.is_null() {
+        unsafe { *ptr = val };
+    }
+}
+
+pub fn block_on<F>(f: F) -> anyhow::Result<F::Output>
+where
+    F: std::future::Future,
+{
+    // TODO: use std::panic::catch_unwind() to be resilient
+    // to OOM problems
+
+    use std::ops::Deref;
+    match RUNTIME.deref() {
+        Ok(rt) => Ok(rt.block_on(async { f.await })),
+        Err(e) => anyhow::bail!("Unable to start tokio runtime: {}", e),
+    }
+}

nss/src/lib.rs

@@ -0,0 +1,46 @@
+// SPDX-FileCopyrightText: Matteo Settenvini <matteo.settenvini@montecristosoftware.eu>
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+#![allow(non_upper_case_globals)]
+#![allow(non_camel_case_types)]
+#![allow(non_snake_case)]
+
+mod gethostbyaddr;
+mod gethostbyname;
+mod helpers;
+pub mod nss_api;
+mod nss_bindings;
+mod policy_checker;
+
+use std::str::FromStr;
+
+struct LevelFilter(log::LevelFilter);
+
+impl FromStr for LevelFilter {
+    type Err = ();
+
+    fn from_str(s: &str) -> Result<Self, Self::Err> {
+        let lv = match s.to_lowercase().as_str() {
+            "off" => log::LevelFilter::Off,
+            "error" => log::LevelFilter::Error,
+            "warn" => log::LevelFilter::Warn,
+            "info" => log::LevelFilter::Info,
+            "debug" => log::LevelFilter::Debug,
+            "trace" => log::LevelFilter::Trace,
+            _ => return Err(()),
+        };
+        Ok(Self(lv))
+    }
+}
+
+ld_preload::ld_preload_init! {
+    {
+        let level = std::env::var("NSS_MALCONTENT_LOG")
+            .ok()
+            .and_then(|level| { LevelFilter::from_str(&level).ok() })
+            .map(|x| x.0)
+            .unwrap_or(log::LevelFilter::Warn);
+
+        let _ = syslog::init(syslog::Facility::LOG_AUTHPRIV, level, Some("nss_malcontent"));
+    }
+}

nss/src/nss_api.rs

@@ -0,0 +1,193 @@
+// SPDX-FileCopyrightText: Matteo Settenvini <matteo.settenvini@montecristosoftware.eu>
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+use {
+    crate::helpers::{block_on, set_if_valid},
+    crate::nss_bindings::{gaih_addrtuple, nss_status, HErrno},
+    crate::{gethostbyaddr, gethostbyname},
+    libc::{hostent, size_t, socklen_t, AF_INET},
+    nix::errno::Errno,
+    std::os::raw::{c_char, c_int, c_void},
+    std::ptr,
+};
+
+// -------------- by host ---------------
+
+#[no_mangle]
+pub unsafe extern "C" fn _nss_malcontent_gethostbyname4_r(
+    name: *const c_char,
+    pat: *mut *mut gaih_addrtuple,
+    buffer: *mut c_char,
+    buflen: size_t,
+    errnop: *mut Errno,
+    h_errnop: *mut HErrno,
+    ttlp: *mut i32,
+) -> nss_status {
+    log::trace!("--------------- _nss_malcontent_gethostbyname4_r ---------------------");
+
+    let mut args = gethostbyname::Args {
+        name,
+        family: 0,
+        result: gethostbyname::Result::V4(pat),
+        buffer,
+        buflen,
+        errnop,
+        h_errnop,
+        ttlp,
+    };
+
+    match block_on(async { gethostbyname::with(&mut args).await }) {
+        Ok(status) => status,
+        Err(runtime_error) => {
+            log::error!("gethostbyname4_r: {}", runtime_error);
+            set_if_valid(args.h_errnop, HErrno::Internal);
+            nss_status::NSS_STATUS_TRYAGAIN
+        }
+    }
+}
+
+#[no_mangle]
+pub unsafe extern "C" fn _nss_malcontent_gethostbyname3_r(
+    name: *const c_char,
+    af: c_int,
+    host: *mut hostent,
+    buffer: *mut c_char,
+    buflen: size_t,
+    errnop: *mut Errno,
+    h_errnop: *mut HErrno,
+    ttlp: *mut i32,
+    canonp: *mut *mut char,
+) -> nss_status {
+    log::trace!("--------------- _nss_malcontent_gethostbyname3_r ---------------------");
+
+    let mut args = gethostbyname::Args {
+        name,
+        family: af,
+        result: gethostbyname::Result::V3(host),
+        buffer,
+        buflen,
+        errnop,
+        h_errnop,
+        ttlp,
+    };
+
+    match block_on(async { gethostbyname::with(&mut args).await }) {
+        Ok(status) => {
+            if !host.is_null() {
+                set_if_valid(canonp, (*host).h_name as *mut char);
+            }
+            status
+        }
+        Err(runtime_error) => {
+            log::error!("gethostbyname3_r: {}", runtime_error);
+            set_if_valid(h_errnop, HErrno::Internal);
+            nss_status::NSS_STATUS_TRYAGAIN
+        }
+    }
+}
+
+#[no_mangle]
+pub unsafe extern "C" fn _nss_malcontent_gethostbyname2_r(
+    name: *const c_char,
+    af: c_int,
+    host: *mut hostent,
+    buffer: *mut c_char,
+    buflen: size_t,
+    errnop: *mut Errno,
+    h_errnop: *mut HErrno,
+) -> nss_status {
+    log::trace!("--------------- _nss_malcontent_gethostbyname2_r ---------------------");
+
+    _nss_malcontent_gethostbyname3_r(
+        name,
+        af,
+        host,
+        buffer,
+        buflen,
+        errnop,
+        h_errnop,
+        ptr::null_mut(),
+        ptr::null_mut(),
+    )
+}
+
+#[no_mangle]
+pub unsafe extern "C" fn _nss_malcontent_gethostbyname_r(
+    name: *const c_char,
+    host: *mut hostent,
+    buffer: *mut c_char,
+    buflen: size_t,
+    errnop: *mut Errno,
+    h_errnop: *mut HErrno,
+) -> nss_status {
+    log::trace!("--------------- _nss_malcontent_gethostbyname_r ---------------------");
+
+    _nss_malcontent_gethostbyname3_r(
+        name,
+        AF_INET,
+        host,
+        buffer,
+        buflen,
+        errnop,
+        h_errnop,
+        ptr::null_mut(),
+        ptr::null_mut(),
+    )
+}
+
+// ----------------- by addr -----------------
+
+#[no_mangle]
+pub unsafe extern "C" fn _nss_malcontent_gethostbyaddr2_r(
+    addr: *const c_void,
+    len: socklen_t,
+    af: c_int,
+    host: *mut hostent,
+    buffer: *mut c_char,
+    buflen: size_t,
+    errnop: *mut Errno,
+    h_errnop: *mut HErrno,
+    ttlp: *mut i32,
+) -> nss_status {
+    log::trace!("--------------- _nss_malcontent_gethostbyaddr2_r ---------------------");
+
+    set_if_valid(errnop, nix::errno::from_i32(0));
+    set_if_valid(h_errnop, HErrno::Success);
+
+    match block_on(async {
+        gethostbyaddr::with(addr, len, af, host, buffer, buflen, errnop, h_errnop, ttlp).await
+    }) {
+        Ok(status) => status,
+        Err(runtime_error) => {
+            log::error!("gethostbyaddr2_r: {}", runtime_error);
+            set_if_valid(h_errnop, HErrno::Internal);
+            nss_status::NSS_STATUS_TRYAGAIN
+        }
+    }
+}
+
+#[no_mangle]
+pub unsafe extern "C" fn _nss_malcontent_gethostbyaddr_r(
+    addr: *const c_void,
+    len: socklen_t,
+    af: c_int,
+    host: *mut hostent,
+    buffer: *mut c_char,
+    buflen: size_t,
+    errnop: *mut Errno,
+    h_errnop: *mut HErrno,
+) -> nss_status {
+    log::trace!("--------------- _nss_malcontent_gethostbyaddr_r ---------------------");
+
+    _nss_malcontent_gethostbyaddr2_r(
+        addr,
+        len,
+        af,
+        host,
+        buffer,
+        buflen,
+        errnop,
+        h_errnop,
+        ptr::null_mut(),
+    )
+}

nss/src/nss_bindings.rs

@@ -0,0 +1,5 @@
+// SPDX-FileCopyrightText: Matteo Settenvini <matteo.settenvini@montecristosoftware.eu>
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+#![allow(dead_code)]
+include!(concat!(env!("OUT_DIR"), "/bindings.rs"));

nss/src/policy_checker/dbus.rs

@@ -0,0 +1,66 @@
+// SPDX-FileCopyrightText: Matteo Settenvini <matteo.settenvini@montecristosoftware.eu>
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+use {
+    serde::{Deserialize, Serialize},
+    std::net::IpAddr,
+    zbus::{dbus_proxy, Result},
+};
+
+#[dbus_proxy(
+    default_service = "com.endlessm.ParentalControls",
+    interface = "com.endlessm.ParentalControls.Dns",
+    default_path = "/com/endlessm/ParentalControls/Dns",
+    gen_blocking = false
+)]
+trait MalcontentDns {
+    fn get_dns(&self) -> Result<Restrictions>;
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, zvariant::Type)]
+pub struct Restriction {
+    pub ip: IpAddr,
+    pub hostname: String,
+}
+
+pub type Restrictions = Vec<Restriction>;
+
+pub async fn restrictions() -> anyhow::Result<Vec<Restriction>, anyhow::Error> {
+    #[cfg(not(feature = "integration_test"))]
+    let connection = {
+        // This is the normal behavior
+        zbus::Connection::session().await?
+    };
+
+    #[cfg(feature = "integration_test")]
+    let connection = {
+        use tokio::net::TcpStream;
+
+        // During integration testing, we want to connect to a private
+        // bus name to avoid clashes with existing system services.
+        let socketaddr = std::env::var("TEST_DBUS_SOCKET")
+            .expect("The test has not set the TEST_DBUS_SOCKET environment variable");
+
+        let socket = loop {
+            match TcpStream::connect(&socketaddr).await {
+                Ok(stream) => break stream,
+                Err(e) if e.kind() == std::io::ErrorKind::ConnectionRefused => {
+                    tokio::task::yield_now().await;
+                    continue;
+                }
+                Err(e) => anyhow::bail!(e),
+            }
+        };
+
+        log::trace!("connecting to DBus on {}", socket.local_addr()?);
+        zbus::ConnectionBuilder::tcp_stream(socket)
+            .p2p()
+            .build()
+            .await?
+    };
+
+    let proxy = MalcontentDnsProxy::builder(&connection).build().await?;
+    let restrictions = proxy.get_dns().await;
+    log::trace!("malcontent-nss: user restrictions are {:?}", &restrictions);
+    Ok(restrictions?)
+}

nss/src/policy_checker/mod.rs

@@ -0,0 +1,115 @@
+// SPDX-FileCopyrightText: Matteo Settenvini <matteo.settenvini@montecristosoftware.eu>
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+mod dbus;
+
+use {
+    anyhow::Result,
+    hickory_proto::rr::domain::Name as DomainName,
+    hickory_resolver::config as dns_config,
+    hickory_resolver::TokioAsyncResolver,
+    nix::unistd::{getuid, Uid},
+    once_cell::sync::Lazy,
+    std::collections::HashMap,
+    std::net::{SocketAddr, TcpStream},
+    std::sync::{Arc, RwLock},
+    std::time::Duration,
+};
+
+pub use self::dbus::{Restriction, Restrictions};
+
+const DNS_UDP_PORT: u16 = 53;
+const DNS_TLS_PORT: u16 = 853;
+
+pub static POLICY_CHECKER: Lazy<PolicyChecker> = Lazy::new(|| PolicyChecker::new());
+
+// TODO: accept notifications about config changes
+pub struct PolicyChecker {
+    resolvers: RwLock<HashMap<Uid, Option<Arc<TokioAsyncResolver>>>>,
+}
+
+impl PolicyChecker {
+    pub fn new() -> Self {
+        Self {
+            resolvers: RwLock::new(HashMap::new()),
+        }
+    }
+
+    async fn restrictions(&self, user: Uid) -> Result<Restrictions> {
+        if user.is_root() {
+            return Ok(vec![]);
+        };
+
+        dbus::restrictions().await
+    }
+
+    pub async fn resolver(&self) -> Result<Option<Arc<TokioAsyncResolver>>> {
+        let user = getuid(); // account for processes changing user during execution
+
+        log::trace!("querying PolicyChecker::resolver() for user {}", user);
+        // Check if already cached
+        {
+            let ro_resolvers = self.resolvers.read().unwrap();
+            if let Some(resolver) = ro_resolvers.get(&user) {
+                return Ok(resolver.clone());
+            }
+        }
+
+        // Else, initialize and cache it
+        {
+            let mut rw_resolvers = self.resolvers.write().unwrap();
+            if let Some(resolver) = rw_resolvers.get(&user) {
+                return Ok(resolver.clone());
+            }
+
+            // try first to prime resolver with DoT implementation,
+            // fallback to unencrypted only if not available.
+            let restrictions = self.restrictions(user).await?;
+            let resolver = if !restrictions.is_empty() {
+                let resolver = TokioAsyncResolver::tokio(
+                    resolver_config_for(restrictions),
+                    dns_config::ResolverOpts::default(),
+                );
+                Some(Arc::new(resolver))
+            } else {
+                None
+            };
+
+            rw_resolvers.insert(user, resolver.clone());
+            Ok(resolver)
+        }
+    }
+}
+
+fn resolver_config_for(restrictions: Vec<Restriction>) -> dns_config::ResolverConfig {
+    use dns_config::NameServerConfigGroup as NsConfig;
+
+    let resolver_config_group =
+        restrictions
+            .into_iter()
+            .fold(NsConfig::new(), |mut config, restr| {
+                let supports_tls = TcpStream::connect_timeout(
+                    &SocketAddr::new(restr.ip, DNS_TLS_PORT),
+                    Duration::from_secs(1),
+                )
+                .is_ok();
+
+                let new_config = if supports_tls {
+                    NsConfig::from_ips_tls(&[restr.ip], DNS_TLS_PORT, restr.hostname, true)
+                } else {
+                    NsConfig::from_ips_clear(&[restr.ip], DNS_UDP_PORT, true)
+                };
+
+                config.merge(new_config);
+                config
+            });
+
+    let basename = gethostname::gethostname()
+        .as_os_str()
+        .to_str()
+        .map(|hn| DomainName::from_labels(hn.split('.')).ok())
+        .flatten()
+        .map(|hn| hn.base_name());
+
+    dns_config::ResolverConfig::from_parts(basename, vec![], resolver_config_group)
+}

nss/tests/common/dbus.rs

@@ -0,0 +1,142 @@
+// SPDX-FileCopyrightText: Matteo Settenvini <matteo.settenvini@montecristosoftware.eu>
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+include!(concat!(
+    env!("CARGO_MANIFEST_DIR"),
+    "/src/policy_checker/dbus.rs"
+));
+
+use {
+    std::sync::atomic::{AtomicUsize, Ordering},
+    tokio_util::sync::CancellationToken,
+    zbus::dbus_interface,
+};
+
+#[derive(Debug)]
+pub struct MalcontentDBusMock {
+    responses: Vec<Restrictions>,
+    invocations_left: AtomicUsize,
+}
+
+#[dbus_interface(name = "com.endlessm.ParentalControls.Dns")]
+impl MalcontentDBusMock {
+    fn get_dns(&mut self) -> Restrictions {
+        let restrictions = self
+            .responses
+            .pop()
+            .expect("MockError: DBus mock is saturated");
+        self.invocations_left.fetch_sub(1, Ordering::SeqCst);
+        restrictions
+    }
+}
+
+impl MalcontentDBusMock {
+    pub fn new(mut responses: Vec<Restrictions>) -> Self {
+        responses.reverse(); // We pop responses from the back, so...
+        Self {
+            invocations_left: AtomicUsize::new(responses.len()),
+            responses,
+        }
+    }
+}
+
+impl Drop for MalcontentDBusMock {
+    fn drop(&mut self) {
+        let invocations_left = self.invocations_left.load(Ordering::Acquire);
+        assert_eq!(
+            invocations_left, 0,
+            "MockError: During teardown, {} invocations are still left on the mock object",
+            invocations_left
+        );
+    }
+}
+
+pub struct DBusMockServer {
+    handle: std::thread::JoinHandle<Result<()>>,
+    cancellation: CancellationToken,
+}
+
+impl DBusMockServer {
+    pub fn new(responses: Vec<Restrictions>) -> Result<Self> {
+        let token = CancellationToken::new();
+        let cloned_token = token.clone();
+
+        let listener = std::net::TcpListener::bind("127.0.0.1:0")?;
+        std::env::set_var("TEST_DBUS_SOCKET", format!("{}", listener.local_addr()?));
+
+        let handle = std::thread::spawn(move || {
+            tokio::runtime::Builder::new_current_thread()
+                .enable_all()
+                .build()
+                .unwrap()
+                .block_on(Self::spawn_async(responses, listener, cloned_token))
+        });
+
+        Ok(Self {
+            handle: handle,
+            cancellation: token,
+        })
+    }
+
+    pub fn stop(self) -> Result<()> {
+        self.cancellation.cancel();
+        self.handle.join().unwrap()
+    }
+
+    async fn spawn_async(
+        responses: Vec<Restrictions>,
+        listener: std::net::TcpListener,
+        cancellation_token: CancellationToken,
+    ) -> Result<()> {
+        listener.set_nonblocking(true)?;
+        let listener = tokio::net::TcpListener::from_std(listener)?;
+
+        let guid = zbus::Guid::generate();
+        let mock = MalcontentDBusMock::new(responses);
+        let (stream, _) = listener
+            .accept()
+            .await
+            .expect("Server socket closed unexpectedly");
+
+        log::trace!("dbus mock server accepted client connection");
+        let _connection = zbus::ConnectionBuilder::tcp_stream(stream)
+            .server(&guid)
+            .p2p()
+            .auth_mechanisms(&[zbus::AuthMechanism::Anonymous])
+            .name("com.endlessm.ParentalControls")
+            .expect("Unable to serve given dbus name")
+            .serve_at("/com/endlessm/ParentalControls/Dns", mock)
+            .expect("Unable to server malcontent dbus mock object")
+            .build()
+            .await?;
+
+        tokio::select! {
+            _ = cancellation_token.cancelled() => {
+                Ok(())
+            }
+            _ = std::future::pending::<()>() => { unreachable!() }
+        }
+    }
+}
+
+pub struct DBusMockServerGuard {
+    mock: Option<DBusMockServer>,
+}
+
+impl DBusMockServerGuard {
+    pub fn new(responses: Vec<Restrictions>) -> Result<Self> {
+        Ok(Self {
+            mock: Some(DBusMockServer::new(responses)?),
+        })
+    }
+}
+
+impl Drop for DBusMockServerGuard {
+    fn drop(&mut self) {
+        self.mock
+            .take()
+            .unwrap()
+            .stop()
+            .expect("cannot stop dbus server mock");
+    }
+}

nss/tests/common/mod.rs

@@ -0,0 +1,148 @@
+// SPDX-FileCopyrightText: Matteo Settenvini <matteo.settenvini@montecristosoftware.eu>
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+#![allow(non_upper_case_globals)]
+#![allow(non_camel_case_types)]
+#![allow(non_snake_case)]
+#![allow(dead_code)]
+
+include!(concat!(env!("OUT_DIR"), "/bindings.rs"));
+
+mod dbus;
+
+use {
+    anyhow::{anyhow, bail, ensure, Result},
+    libc::{freeaddrinfo, gai_strerror, getaddrinfo},
+    nix::sys::socket::{SockaddrLike as _, SockaddrStorage},
+    std::env,
+    std::ffi::{CStr, CString},
+    std::net::{IpAddr, Ipv4Addr, Ipv6Addr},
+    std::path::PathBuf,
+    std::process::Command,
+    std::str::FromStr,
+};
+
+pub use self::dbus::{DBusMockServerGuard, Restriction, Restrictions};
+
+pub type Eai = EaiRetcode;
+
+#[static_init::dynamic]
+static GLOBAL_SETUP: () = {
+    let cdylib_path = test_cdylib::build_current_project();
+    let file_name = cdylib_path.file_name().unwrap();
+
+    let mut versioned_file_name = file_name.to_owned();
+    versioned_file_name.push(".2"); // required for NSS 3 modules
+
+    let dest = PathBuf::from(std::env::current_exe().unwrap()).with_file_name(versioned_file_name);
+    let _ = std::fs::remove_file(&dest);
+    std::fs::hard_link(&cdylib_path, &dest).expect(&format!(
+        "Cannot hard link {} to {}",
+        cdylib_path.display(),
+        dest.display()
+    ));
+};
+
+/// Note that this should be called once per process; this implies that
+/// each test calling this function is in a separate process too.
+pub fn setup() -> Result<()> {
+    let _ = env_logger::builder()
+        .is_test(true)
+        .filter_level(log::LevelFilter::max())
+        .try_init();
+
+    std::env::set_var("NSS_MALCONTENT_LOG", "trace");
+
+    // setup NSS to load our cdylib, now versioned
+    let db = CString::new("hosts").unwrap();
+    let resolvers = CString::new("malcontent dns").unwrap();
+    let nss_config_status = unsafe { __nss_configure_lookup(db.as_ptr(), resolvers.as_ptr()) };
+
+    if nss_config_status != 0 {
+        panic!(
+            "Unable to configure NSS to load module: __nss_configure_lookup() returned {}",
+            nss_config_status
+        );
+    }
+
+    Ok(())
+}
+
+pub fn resolve_with_system(family: libc::c_int, host: &str) -> Result<IpAddr> {
+    let process = Command::new("getent")
+        .arg(match family {
+            libc::AF_INET => "ahostsv4",
+            libc::AF_INET6 => "ahostsv6",
+            _ => panic!("INET family must be either IPv4 or IPv6"),
+        })
+        .arg(host)
+        .output()?;
+    ensure!(
+        process.status.success(),
+        "Failed to run getent to check host IP"
+    );
+    let output = String::from_utf8(process.stdout)?;
+    log::trace!("system getent reports: {}", &output);
+    let addr_string = output
+        .as_str()
+        .split(' ')
+        .next()
+        .ok_or(anyhow!("Unparseable output from getent"))?;
+    Ok(IpAddr::from_str(&addr_string)?)
+}
+
+pub fn resolve_with_module(family: libc::c_int, hostname: &str) -> Result<Vec<IpAddr>> {
+    let c_hostname = CString::new(hostname).unwrap();
+    unsafe {
+        let mut addr = std::ptr::null_mut();
+        let hints = libc::addrinfo {
+            ai_family: family,
+            ai_flags: 0,
+            ai_socktype: 0,
+            ai_protocol: 0,
+            ai_addrlen: 0,
+            ai_addr: std::ptr::null_mut(),
+            ai_canonname: std::ptr::null_mut(),
+            ai_next: std::ptr::null_mut(),
+        };
+        let getaddrinfo_status =
+            getaddrinfo(c_hostname.as_ptr(), std::ptr::null(), &hints, &mut addr);
+
+        let error = CStr::from_ptr(gai_strerror(getaddrinfo_status));
+        assert_eq!(
+            getaddrinfo_status,
+            Eai::Success.0,
+            "Should have gotten hostname for {}, instead got {}",
+            hostname,
+            error.to_str().unwrap()
+        );
+
+        let ips = convert_addrinfo(addr)?;
+        freeaddrinfo(addr);
+        Ok(ips)
+    }
+}
+
+unsafe fn convert_addrinfo(addrs: *const libc::addrinfo) -> Result<Vec<IpAddr>> {
+    let mut ips = vec![];
+
+    let mut addr = addrs;
+    while addr != std::ptr::null() {
+        let addr_storage = SockaddrStorage::from_raw((*addr).ai_addr, Some((*addr).ai_addrlen))
+            .ok_or(anyhow!("Garbled addrinfo from getaddrinfo()"))?;
+
+        if let Some(addr) = addr_storage.as_sockaddr_in() {
+            ips.push(IpAddr::V4(Ipv4Addr::from(addr.ip())));
+        } else if let Some(addr) = addr_storage.as_sockaddr_in6() {
+            ips.push(IpAddr::V6(Ipv6Addr::from(addr.ip())));
+        } else {
+            bail!("addrinfo is not either an IPv4 or IPv6 address")
+        }
+
+        addr = (*addr).ai_next;
+    }
+
+    ips.sort();
+    ips.dedup();
+    Ok(ips)
+}

nss/tests/integration_test.rs

@@ -0,0 +1,243 @@
+// SPDX-FileCopyrightText: Matteo Settenvini <matteo.settenvini@montecristosoftware.eu>
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+mod common;
+
+use {
+    crate::common::{Eai, Restriction, Restrictions},
+    anyhow::Result,
+    elf::ElfStream,
+    libc::{freeaddrinfo, gai_strerror, getaddrinfo},
+    once_cell::sync::Lazy,
+    rusty_fork::rusty_fork_test,
+    std::net::{IpAddr, Ipv4Addr, Ipv6Addr},
+    std::os::unix::fs::FileExt,
+    std::path::PathBuf,
+};
+
+static DNS0_PARENTALCONTROL_ADDRS: Lazy<Restrictions> = Lazy::new(|| {
+    vec![
+        Restriction {
+            ip: IpAddr::V4(Ipv4Addr::new(193, 110, 81, 1)),
+            hostname: "kids.dns0.eu".into(),
+        },
+        Restriction {
+            ip: IpAddr::V4(Ipv4Addr::new(185, 253, 5, 1)),
+            hostname: "kids.dns0.eu".into(),
+        },
+        Restriction {
+            ip: IpAddr::V6(Ipv6Addr::new(0x2a0f, 0xfc80, 0, 0, 0, 0, 0, 0x1)),
+            hostname: "kids.dns0.eu".into(),
+        },
+        Restriction {
+            ip: IpAddr::V6(Ipv6Addr::new(0x2a0f, 0xfc81, 0, 0, 0, 0, 0, 0x1)),
+            hostname: "kids.dns0.eu".into(),
+        },
+    ]
+});
+
+static CLOUDFLARE_PARENTALCONTROL_ADDRS: Lazy<Restrictions> = Lazy::new(|| {
+    vec![
+        Restriction {
+            ip: IpAddr::V4(Ipv4Addr::new(1, 1, 1, 3)),
+            hostname: "family.cloudflare-dns.com".into(),
+        },
+        Restriction {
+            ip: IpAddr::V4(Ipv4Addr::new(1, 0, 0, 3)),
+            hostname: "family.cloudflare-dns.com".into(),
+        },
+        Restriction {
+            ip: IpAddr::V6(Ipv6Addr::new(0x2606, 0x4700, 0x4700, 0, 0, 0, 0, 0x1113)),
+            hostname: "family.cloudflare-dns.com".into(),
+        },
+        Restriction {
+            ip: IpAddr::V6(Ipv6Addr::new(0x2606, 0x4700, 0x4700, 0, 0, 0, 0, 0x1003)),
+            hostname: "family.cloudflare-dns.com".into(),
+        },
+    ]
+});
+
+static NO_RESTRICTIONS: Lazy<Restrictions> = Lazy::new(|| vec![]);
+
+#[test]
+fn sanity_check() -> Result<()> {
+    let current_exe = PathBuf::from(std::env::current_exe().unwrap());
+    let myself = std::fs::File::open(&current_exe)?;
+    let mut elf_stream: ElfStream<elf::endian::AnyEndian, _> =
+        elf::ElfStream::open_stream(&myself)?;
+    let dynamic_section = elf_stream.dynamic()?.expect("No dynamic table");
+    let rpath_off = dynamic_section
+        .iter()
+        .find(|x| x.d_tag == elf::abi::DT_RPATH)
+        .map(|x| x.d_val())
+        .expect("No DT_RPATH found in test executable ELF dyn section");
+    let strtable = dynamic_section
+        .into_iter()
+        .find(|x| x.d_tag == elf::abi::DT_STRTAB)
+        .map(|x| x.d_ptr())
+        .expect("No DT_STRTAB found in test executable ELF dyn section");
+
+    let mut buf = [0u8; 1024];
+    let _ = myself.read_at(buf.as_mut_slice(), strtable + rpath_off)?;
+    let end = buf
+        .iter()
+        .position(|c| *c == 0u8)
+        .expect(&format!("RPATH is bigger than {} bytes", buf.len()));
+    let rpath = std::str::from_utf8(&buf[..end])?;
+    assert_eq!(rpath, "$ORIGIN");
+
+    common::setup()?;
+    let lib = current_exe.parent().unwrap().join("libnss_malcontent.so.2");
+    assert!(lib.exists());
+
+    Ok(())
+}
+
+rusty_fork_test! {
+    #[test]
+    fn application_dns_is_nodata() {
+        common::setup().unwrap();
+
+        let _dbus = common::DBusMockServerGuard::new(vec![CLOUDFLARE_PARENTALCONTROL_ADDRS.clone()]).unwrap();
+
+        let hostname = std::ffi::CString::new("use-application-dns.net").unwrap();
+        unsafe {
+            let mut addr = std::ptr::null_mut();
+            let getaddrinfo_status = getaddrinfo(
+                hostname.as_ptr(),
+                std::ptr::null(),
+                std::ptr::null(),
+                &mut addr,
+            );
+
+            let error = std::ffi::CStr::from_ptr(gai_strerror(getaddrinfo_status));
+            assert_eq!(
+                getaddrinfo_status,
+                Eai::NoData.0,
+                "Should have gotten no data (NODATA), instead got {}",
+                error.to_str().unwrap()
+            );
+            freeaddrinfo(addr);
+        };
+    }
+
+    #[test]
+    fn getaddrinfo_resolution() {
+        common::setup().unwrap();
+
+        const HOSTNAME: &str = "gnome.org";
+
+        let _dbus = common::DBusMockServerGuard::new(vec![CLOUDFLARE_PARENTALCONTROL_ADDRS.clone()]).unwrap();
+
+        unsafe {
+            let mut addr = std::ptr::null_mut();
+            let hostname = std::ffi::CString::new(HOSTNAME).unwrap();
+            let getaddrinfo_status = getaddrinfo(
+                hostname.as_ptr(),
+                std::ptr::null(),
+                std::ptr::null(),
+                &mut addr,
+            );
+
+            let error = std::ffi::CStr::from_ptr(gai_strerror(getaddrinfo_status));
+            assert_eq!(
+                getaddrinfo_status,
+                Eai::Success.0,
+                "Should have gotten an hostname, instead got {}",
+                error.to_str().unwrap()
+            );
+            freeaddrinfo(addr);
+        };
+    }
+
+    #[test]
+    fn wikipedia_is_unrestricted() {
+        common::setup().unwrap();
+
+        const HOSTNAME: &str = "wikipedia.org";
+
+        let _dbus = common::DBusMockServerGuard::new(vec![CLOUDFLARE_PARENTALCONTROL_ADDRS.clone()]).unwrap();
+
+        for family in [libc::AF_INET, libc::AF_INET6] {
+            let system_addr = common::resolve_with_system(family, HOSTNAME).unwrap();
+            let our_addrs = common::resolve_with_module(family, HOSTNAME).unwrap();
+            assert!(our_addrs.contains(&system_addr));
+        }
+    }
+
+    #[test]
+    fn dns0_adultsites_are_restricted() {
+        common::setup().unwrap();
+
+        const HOSTNAME: &str = "pornhub.com";
+
+        let _dbus = common::DBusMockServerGuard::new(vec![DNS0_PARENTALCONTROL_ADDRS.clone()]).unwrap();
+
+        let our_addrs_ipv4 = common::resolve_with_module(libc::AF_INET, HOSTNAME).unwrap();
+        let our_addrs_ipv6 = common::resolve_with_module(libc::AF_INET, HOSTNAME).unwrap();
+        assert!(
+            our_addrs_ipv4.is_empty(),
+            "Resolver answered with {:?}, should be empty",
+            our_addrs_ipv4
+        );
+        assert!(
+            our_addrs_ipv6.is_empty(),
+            "Resolver answered with {:?}, should be empty",
+            our_addrs_ipv6
+        );
+    }
+
+    #[test]
+    fn cloudflare_adultsite_is_restricted_ipv4() {
+        common::setup().unwrap();
+
+        const HOSTNAME: &str = "nudity.testcategory.com";
+
+        let _dbus = common::DBusMockServerGuard::new(vec![CLOUDFLARE_PARENTALCONTROL_ADDRS.clone()]).unwrap();
+
+        let system_addr = common::resolve_with_system(libc::AF_INET, HOSTNAME).unwrap();
+        let our_addrs = common::resolve_with_module(libc::AF_INET, HOSTNAME).unwrap();
+        assert!(
+            !our_addrs.contains(&system_addr),
+            "Resolver answered with {:?}, should not contain {}",
+            our_addrs,
+            system_addr
+        );
+        assert_eq!(our_addrs, [IpAddr::V4(Ipv4Addr::UNSPECIFIED)]);
+    }
+
+    #[test]
+    fn cloudflare_adultsite_is_restricted_ipv6() {
+        common::setup().unwrap();
+
+        const HOSTNAME: &str = "nudity.testcategory.com";
+
+        let _dbus = common::DBusMockServerGuard::new(vec![CLOUDFLARE_PARENTALCONTROL_ADDRS.clone()]).unwrap();
+
+        let system_addr = common::resolve_with_system(libc::AF_INET6, HOSTNAME).unwrap();
+        let our_addrs = common::resolve_with_module(libc::AF_INET6, HOSTNAME).unwrap();
+        assert!(
+            !our_addrs.contains(&system_addr),
+            "Resolver answered with {:?}, should not contain {}",
+            our_addrs,
+            system_addr
+        );
+        assert_eq!(our_addrs, [IpAddr::V6(Ipv6Addr::UNSPECIFIED)]);
+    }
+
+    #[test]
+    fn privileged_user_bypasses_restrictions() {
+        common::setup().unwrap();
+
+        const HOSTNAME: &str = "malware.testcategory.com";
+
+        let _dbus = common::DBusMockServerGuard::new(vec![NO_RESTRICTIONS.clone()]).unwrap();
+
+        for family in [libc::AF_INET, libc::AF_INET6] {
+            let system_addr = common::resolve_with_system(family, HOSTNAME).unwrap();
+            let our_addrs = common::resolve_with_module(family, HOSTNAME).unwrap();
+            assert!(our_addrs.contains(&system_addr));
+        }
+    }
+
+}

nss/wrapper.hpp

@@ -0,0 +1,43 @@
+/*
+// SPDX-FileCopyrightText: Matteo Settenvini <matteo.settenvini@montecristosoftware.eu>
+// SPDX-License-Identifier: GPL-3.0-or-later
+ */
+
+#include <nss.h>
+#include <netdb.h>
+
+// Work around enums in netdb.h defined as macros instead :-p
+
+enum class HErrno : int {
+    Success = 0,
+    HostNotFound = HOST_NOT_FOUND,
+    TryAgain = TRY_AGAIN,
+    NoRecovery = NO_RECOVERY,
+    NoData = NO_DATA,
+    #ifdef __USE_MISC
+    Internal = NETDB_INTERNAL,
+    #endif
+};
+
+enum class EaiRetcode : int {
+    Success = 0,
+    BadFlags = EAI_BADFLAGS,
+    NoName = EAI_NONAME,
+    Fail = EAI_FAIL,
+    Family = EAI_FAMILY,
+    SockType = EAI_SOCKTYPE,
+    Service = EAI_SERVICE,
+    Memory = EAI_MEMORY,
+    System = EAI_SYSTEM,
+    Overflow = EAI_OVERFLOW,
+    #ifdef __USE_GNU
+    NoData = EAI_NODATA,
+    AddrFamily = EAI_ADDRFAMILY,
+    InProgress = EAI_INPROGRESS,
+    Canceled = EAI_CANCELED,
+    NotCanceled = EAI_NOTCANCELED,
+    AllDone = EAI_ALLDONE,
+    Interrupted = EAI_INTR,
+    IdnEncode = EAI_IDN_ENCODE,
+    #endif /* __USE_GNU */
+};