diff options
Diffstat (limited to 'external/unbound/respip/respip.c')
| -rw-r--r-- | external/unbound/respip/respip.c | 1179 |
1 files changed, 1179 insertions, 0 deletions
diff --git a/external/unbound/respip/respip.c b/external/unbound/respip/respip.c new file mode 100644 index 000000000..d71325111 --- /dev/null +++ b/external/unbound/respip/respip.c @@ -0,0 +1,1179 @@ +/* + * respip/respip.c - filtering response IP module + */ + +/** + * \file + * + * This file contains a module that inspects a result of recursive resolution + * to see if any IP address record should trigger a special action. + * If applicable these actions can modify the original response. + */ +#include "config.h" + +#include "services/localzone.h" +#include "services/cache/dns.h" +#include "sldns/str2wire.h" +#include "util/config_file.h" +#include "util/fptr_wlist.h" +#include "util/module.h" +#include "util/net_help.h" +#include "util/regional.h" +#include "util/data/msgreply.h" +#include "util/storage/dnstree.h" +#include "respip/respip.h" +#include "services/view.h" +#include "sldns/rrdef.h" + +/** + * Conceptual set of IP addresses for response AAAA or A records that should + * trigger special actions. + */ +struct respip_set { + struct regional* region; + struct rbtree_type ip_tree; + char* const* tagname; /* shallow copy of tag names, for logging */ + int num_tags; /* number of tagname entries */ +}; + +/** An address span with response control information */ +struct resp_addr { + /** node in address tree */ + struct addr_tree_node node; + /** tag bitlist */ + uint8_t* taglist; + /** length of the taglist (in bytes) */ + size_t taglen; + /** action for this address span */ + enum respip_action action; + /** "local data" for this node */ + struct ub_packed_rrset_key* data; +}; + +/** Subset of resp_addr.node, used for inform-variant logging */ +struct respip_addr_info { + struct sockaddr_storage addr; + socklen_t addrlen; + int net; +}; + +/** Query state regarding the response-ip module. */ +enum respip_state { + /** + * The general state. Unless CNAME chasing takes place, all processing + * is completed in this state without any other asynchronous event. + */ + RESPIP_INIT = 0, + + /** + * A subquery for CNAME chasing is completed. + */ + RESPIP_SUBQUERY_FINISHED +}; + +/** Per query state for the response-ip module. */ +struct respip_qstate { + enum respip_state state; +}; + +struct respip_set* +respip_set_create(void) +{ + struct respip_set* set = calloc(1, sizeof(*set)); + if(!set) + return NULL; + set->region = regional_create(); + if(!set->region) { + free(set); + return NULL; + } + addr_tree_init(&set->ip_tree); + return set; +} + +void +respip_set_delete(struct respip_set* set) +{ + if(!set) + return; + regional_destroy(set->region); + free(set); +} + +struct rbtree_type* +respip_set_get_tree(struct respip_set* set) +{ + if(!set) + return NULL; + return &set->ip_tree; +} + +/** returns the node in the address tree for the specified netblock string; + * non-existent node will be created if 'create' is true */ +static struct resp_addr* +respip_find_or_create(struct respip_set* set, const char* ipstr, int create) +{ + struct resp_addr* node; + struct sockaddr_storage addr; + int net; + socklen_t addrlen; + + if(!netblockstrtoaddr(ipstr, 0, &addr, &addrlen, &net)) { + log_err("cannot parse netblock: '%s'", ipstr); + return NULL; + } + node = (struct resp_addr*)addr_tree_find(&set->ip_tree, &addr, addrlen, net); + if(!node && create) { + node = regional_alloc_zero(set->region, sizeof(*node)); + if(!node) { + log_err("out of memory"); + return NULL; + } + node->action = respip_none; + if(!addr_tree_insert(&set->ip_tree, &node->node, &addr, + addrlen, net)) { + /* We know we didn't find it, so this should be + * impossible. */ + log_warn("unexpected: duplicate address: %s", ipstr); + } + } + return node; +} + +static int +respip_tag_cfg(struct respip_set* set, const char* ipstr, + const uint8_t* taglist, size_t taglen) +{ + struct resp_addr* node; + + if(!(node=respip_find_or_create(set, ipstr, 1))) + return 0; + if(node->taglist) { + log_warn("duplicate response-address-tag for '%s', overridden.", + ipstr); + } + node->taglist = regional_alloc_init(set->region, taglist, taglen); + if(!node->taglist) { + log_err("out of memory"); + return 0; + } + node->taglen = taglen; + return 1; +} + +/** set action for the node specified by the netblock string */ +static int +respip_action_cfg(struct respip_set* set, const char* ipstr, + const char* actnstr) +{ + struct resp_addr* node; + enum respip_action action; + + if(!(node=respip_find_or_create(set, ipstr, 1))) + return 0; + if(node->action != respip_none) { + log_warn("duplicate response-ip action for '%s', overridden.", + ipstr); + } + if(strcmp(actnstr, "deny") == 0) + action = respip_deny; + else if(strcmp(actnstr, "redirect") == 0) + action = respip_redirect; + else if(strcmp(actnstr, "inform") == 0) + action = respip_inform; + else if(strcmp(actnstr, "inform_deny") == 0) + action = respip_inform_deny; + else if(strcmp(actnstr, "always_transparent") == 0) + action = respip_always_transparent; + else if(strcmp(actnstr, "always_refuse") == 0) + action = respip_always_refuse; + else if(strcmp(actnstr, "always_nxdomain") == 0) + action = respip_always_nxdomain; + else { + log_err("unknown response-ip action %s", actnstr); + return 0; + } + node->action = action; + return 1; +} + +/** allocate and initialize an rrset structure; this function is based + * on new_local_rrset() from the localzone.c module */ +static struct ub_packed_rrset_key* +new_rrset(struct regional* region, uint16_t rrtype, uint16_t rrclass) +{ + struct packed_rrset_data* pd; + struct ub_packed_rrset_key* rrset = regional_alloc_zero( + region, sizeof(*rrset)); + if(!rrset) { + log_err("out of memory"); + return NULL; + } + rrset->entry.key = rrset; + pd = regional_alloc_zero(region, sizeof(*pd)); + if(!pd) { + log_err("out of memory"); + return NULL; + } + pd->trust = rrset_trust_prim_noglue; + pd->security = sec_status_insecure; + rrset->entry.data = pd; + rrset->rk.dname = regional_alloc_zero(region, 1); + if(!rrset->rk.dname) { + log_err("out of memory"); + return NULL; + } + rrset->rk.dname_len = 1; + rrset->rk.type = htons(rrtype); + rrset->rk.rrset_class = htons(rrclass); + return rrset; +} + +/** enter local data as resource records into a response-ip node */ +static int +respip_enter_rr(struct regional* region, struct resp_addr* raddr, + const char* rrstr, const char* netblock) +{ + uint8_t* nm; + uint16_t rrtype = 0, rrclass = 0; + time_t ttl = 0; + uint8_t rr[LDNS_RR_BUF_SIZE]; + uint8_t* rdata = NULL; + size_t rdata_len = 0; + char buf[65536]; + char bufshort[64]; + struct packed_rrset_data* pd; + struct sockaddr* sa; + int ret; + if(raddr->action != respip_redirect) { + log_err("cannot parse response-ip-data %s: response-ip " + "action for %s is not redirect", rrstr, netblock); + return 0; + } + ret = snprintf(buf, sizeof(buf), ". %s", rrstr); + if(ret < 0 || ret >= (int)sizeof(buf)) { + strlcpy(bufshort, rrstr, sizeof(bufshort)); + log_err("bad response-ip-data: %s...", bufshort); + return 0; + } + if(!rrstr_get_rr_content(buf, &nm, &rrtype, &rrclass, &ttl, rr, sizeof(rr), + &rdata, &rdata_len)) { + log_err("bad response-ip-data: %s", rrstr); + return 0; + } + sa = (struct sockaddr*)&raddr->node.addr; + if (rrtype == LDNS_RR_TYPE_CNAME && raddr->data) { + log_err("CNAME response-ip data (%s) can not co-exist with other " + "response-ip data for netblock %s", rrstr, netblock); + return 0; + } else if (raddr->data && + raddr->data->rk.type == htons(LDNS_RR_TYPE_CNAME)) { + log_err("response-ip data (%s) can not be added; CNAME response-ip " + "data already in place for netblock %s", rrstr, netblock); + return 0; + } else if((rrtype != LDNS_RR_TYPE_CNAME) && + ((sa->sa_family == AF_INET && rrtype != LDNS_RR_TYPE_A) || + (sa->sa_family == AF_INET6 && rrtype != LDNS_RR_TYPE_AAAA))) { + log_err("response-ip data %s record type does not correspond " + "to netblock %s address family", rrstr, netblock); + return 0; + } + + if(!raddr->data) { + raddr->data = new_rrset(region, rrtype, rrclass); + if(!raddr->data) + return 0; + } + pd = raddr->data->entry.data; + return rrset_insert_rr(region, pd, rdata, rdata_len, ttl, rrstr); +} + +static int +respip_data_cfg(struct respip_set* set, const char* ipstr, const char* rrstr) +{ + struct resp_addr* node; + + node=respip_find_or_create(set, ipstr, 0); + if(!node || node->action == respip_none) { + log_err("cannot parse response-ip-data %s: " + "response-ip node for %s not found", rrstr, ipstr); + return 0; + } + return respip_enter_rr(set->region, node, rrstr, ipstr); +} + +static int +respip_set_apply_cfg(struct respip_set* set, char* const* tagname, int num_tags, + struct config_strbytelist* respip_tags, + struct config_str2list* respip_actions, + struct config_str2list* respip_data) +{ + struct config_strbytelist* p; + struct config_str2list* pa; + struct config_str2list* pd; + + set->tagname = tagname; + set->num_tags = num_tags; + + p = respip_tags; + while(p) { + struct config_strbytelist* np = p->next; + + log_assert(p->str && p->str2); + if(!respip_tag_cfg(set, p->str, p->str2, p->str2len)) { + config_del_strbytelist(p); + return 0; + } + free(p->str); + free(p->str2); + free(p); + p = np; + } + + pa = respip_actions; + while(pa) { + struct config_str2list* np = pa->next; + log_assert(pa->str && pa->str2); + if(!respip_action_cfg(set, pa->str, pa->str2)) { + config_deldblstrlist(pa); + return 0; + } + free(pa->str); + free(pa->str2); + free(pa); + pa = np; + } + + pd = respip_data; + while(pd) { + struct config_str2list* np = pd->next; + log_assert(pd->str && pd->str2); + if(!respip_data_cfg(set, pd->str, pd->str2)) { + config_deldblstrlist(pd); + return 0; + } + free(pd->str); + free(pd->str2); + free(pd); + pd = np; + } + + return 1; +} + +int +respip_global_apply_cfg(struct respip_set* set, struct config_file* cfg) +{ + int ret = respip_set_apply_cfg(set, cfg->tagname, cfg->num_tags, + cfg->respip_tags, cfg->respip_actions, cfg->respip_data); + cfg->respip_data = NULL; + cfg->respip_actions = NULL; + cfg->respip_tags = NULL; + return ret; +} + +/** Iterate through raw view data and apply the view-specific respip + * configuration; at this point we should have already seen all the views, + * so if any of the views that respip data refer to does not exist, that's + * an error. This additional iteration through view configuration data + * is expected to not have significant performance impact (or rather, its + * performance impact is not expected to be prohibitive in the configuration + * processing phase). + */ +int +respip_views_apply_cfg(struct views* vs, struct config_file* cfg, + int* have_view_respip_cfg) +{ + struct config_view* cv; + struct view* v; + int ret; + + for(cv = cfg->views; cv; cv = cv->next) { + + /** if no respip config for this view then there's + * nothing to do; note that even though respip data must go + * with respip action, we're checking for both here because + * we want to catch the case where the respip action is missing + * while the data is present */ + if(!cv->respip_actions && !cv->respip_data) + continue; + + if(!(v = views_find_view(vs, cv->name, 1))) { + log_err("view '%s' unexpectedly missing", cv->name); + return 0; + } + if(!v->respip_set) { + v->respip_set = respip_set_create(); + if(!v->respip_set) { + log_err("out of memory"); + lock_rw_unlock(&v->lock); + return 0; + } + } + ret = respip_set_apply_cfg(v->respip_set, NULL, 0, NULL, + cv->respip_actions, cv->respip_data); + lock_rw_unlock(&v->lock); + if(!ret) { + log_err("Error while applying respip configuration " + "for view '%s'", cv->name); + return 0; + } + *have_view_respip_cfg = (*have_view_respip_cfg || + v->respip_set->ip_tree.count); + cv->respip_actions = NULL; + cv->respip_data = NULL; + } + return 1; +} + +/** + * make a deep copy of 'key' in 'region'. + * This is largely derived from packed_rrset_copy_region() and + * packed_rrset_ptr_fixup(), but differs in the following points: + * + * - It doesn't assume all data in 'key' are in a contiguous memory region. + * Although that would be the case in most cases, 'key' can be passed from + * a lower-level module and it might not build the rrset to meet the + * assumption. In fact, an rrset specified as response-ip-data or generated + * in local_data_find_tag_datas() breaks the assumption. So it would be + * safer not to naively rely on the assumption. On the other hand, this + * function ensures the copied rrset data are in a contiguous region so + * that it won't cause a disruption even if an upper layer module naively + * assumes the memory layout. + * - It doesn't copy RRSIGs (if any) in 'key'. The rrset will be used in + * a reply that was already faked, so it doesn't make much sense to provide + * partial sigs even if they are valid themselves. + * - It doesn't adjust TTLs as it basically has to be a verbatim copy of 'key' + * just allocated in 'region' (the assumption is necessary TTL adjustment + * has been already done in 'key'). + * + * This function returns the copied rrset key on success, and NULL on memory + * allocation failure. + */ +struct ub_packed_rrset_key* +copy_rrset(const struct ub_packed_rrset_key* key, struct regional* region) +{ + struct ub_packed_rrset_key* ck = regional_alloc(region, + sizeof(struct ub_packed_rrset_key)); + struct packed_rrset_data* d; + struct packed_rrset_data* data = key->entry.data; + size_t dsize, i; + uint8_t* nextrdata; + + /* derived from packed_rrset_copy_region(), but don't use + * packed_rrset_sizeof() and do exclude RRSIGs */ + if(!ck) + return NULL; + ck->id = key->id; + memset(&ck->entry, 0, sizeof(ck->entry)); + ck->entry.hash = key->entry.hash; + ck->entry.key = ck; + ck->rk = key->rk; + ck->rk.dname = regional_alloc_init(region, key->rk.dname, + key->rk.dname_len); + if(!ck->rk.dname) + return NULL; + + dsize = sizeof(struct packed_rrset_data) + data->count * + (sizeof(size_t)+sizeof(uint8_t*)+sizeof(time_t)); + for(i=0; i<data->count; i++) + dsize += data->rr_len[i]; + d = regional_alloc(region, dsize); + if(!d) + return NULL; + *d = *data; + d->rrsig_count = 0; + ck->entry.data = d; + + /* derived from packed_rrset_ptr_fixup() with copying the data */ + d->rr_len = (size_t*)((uint8_t*)d + sizeof(struct packed_rrset_data)); + d->rr_data = (uint8_t**)&(d->rr_len[d->count]); + d->rr_ttl = (time_t*)&(d->rr_data[d->count]); + nextrdata = (uint8_t*)&(d->rr_ttl[d->count]); + for(i=0; i<d->count; i++) { + d->rr_len[i] = data->rr_len[i]; + d->rr_ttl[i] = data->rr_ttl[i]; + d->rr_data[i] = nextrdata; + memcpy(d->rr_data[i], data->rr_data[i], data->rr_len[i]); + nextrdata += d->rr_len[i]; + } + + return ck; +} + +int +respip_init(struct module_env* env, int id) +{ + (void)env; + (void)id; + return 1; +} + +void +respip_deinit(struct module_env* env, int id) +{ + (void)env; + (void)id; +} + +/** Convert a packed AAAA or A RRset to sockaddr. */ +static int +rdata2sockaddr(const struct packed_rrset_data* rd, uint16_t rtype, size_t i, + struct sockaddr_storage* ss, socklen_t* addrlenp) +{ + /* unbound can accept and cache odd-length AAAA/A records, so we have + * to validate the length. */ + if(rtype == LDNS_RR_TYPE_A && rd->rr_len[i] == 6) { + struct sockaddr_in* sa4 = (struct sockaddr_in*)ss; + + memset(sa4, 0, sizeof(*sa4)); + sa4->sin_family = AF_INET; + memcpy(&sa4->sin_addr, rd->rr_data[i] + 2, + sizeof(sa4->sin_addr)); + *addrlenp = sizeof(*sa4); + return 1; + } else if(rtype == LDNS_RR_TYPE_AAAA && rd->rr_len[i] == 18) { + struct sockaddr_in6* sa6 = (struct sockaddr_in6*)ss; + + memset(sa6, 0, sizeof(*sa6)); + sa6->sin6_family = AF_INET6; + memcpy(&sa6->sin6_addr, rd->rr_data[i] + 2, + sizeof(sa6->sin6_addr)); + *addrlenp = sizeof(*sa6); + return 1; + } + return 0; +} + +/** + * Search the given 'iptree' for response address information that matches + * any of the IP addresses in an AAAA or A in the answer section of the + * response (stored in 'rep'). If found, a pointer to the matched resp_addr + * structure will be returned, and '*rrset_id' is set to the index in + * rep->rrsets for the RRset that contains the matching IP address record + * (the index is normally 0, but can be larger than that if this is a CNAME + * chain or type-ANY response). + */ +static const struct resp_addr* +respip_addr_lookup(const struct reply_info *rep, struct rbtree_type* iptree, + size_t* rrset_id) +{ + size_t i; + struct resp_addr* ra; + struct sockaddr_storage ss; + socklen_t addrlen; + + for(i=0; i<rep->an_numrrsets; i++) { + size_t j; + const struct packed_rrset_data* rd; + uint16_t rtype = ntohs(rep->rrsets[i]->rk.type); + + if(rtype != LDNS_RR_TYPE_A && rtype != LDNS_RR_TYPE_AAAA) + continue; + rd = rep->rrsets[i]->entry.data; + for(j = 0; j < rd->count; j++) { + if(!rdata2sockaddr(rd, rtype, j, &ss, &addrlen)) + continue; + ra = (struct resp_addr*)addr_tree_lookup(iptree, &ss, + addrlen); + if(ra) { + *rrset_id = i; + return ra; + } + } + } + + return NULL; +} + +/* + * Create a new reply_info based on 'rep'. The new info is based on + * the passed 'rep', but ignores any rrsets except for the first 'an_numrrsets' + * RRsets in the answer section. These answer rrsets are copied to the + * new info, up to 'copy_rrsets' rrsets (which must not be larger than + * 'an_numrrsets'). If an_numrrsets > copy_rrsets, the remaining rrsets array + * entries will be kept empty so the caller can fill them later. When rrsets + * are copied, they are shallow copied. The caller must ensure that the + * copied rrsets are valid throughout its lifetime and must provide appropriate + * mutex if it can be shared by multiple threads. + */ +static struct reply_info * +make_new_reply_info(const struct reply_info* rep, struct regional* region, + size_t an_numrrsets, size_t copy_rrsets) +{ + struct reply_info* new_rep; + size_t i; + + /* create a base struct. we specify 'insecure' security status as + * the modified response won't be DNSSEC-valid. In our faked response + * the authority and additional sections will be empty (except possible + * EDNS0 OPT RR in the additional section appended on sending it out), + * so the total number of RRsets is an_numrrsets. */ + new_rep = construct_reply_info_base(region, rep->flags, + rep->qdcount, rep->ttl, rep->prefetch_ttl, an_numrrsets, + 0, 0, an_numrrsets, sec_status_insecure); + if(!new_rep) + return NULL; + if(!reply_info_alloc_rrset_keys(new_rep, NULL, region)) + return NULL; + for(i=0; i<copy_rrsets; i++) + new_rep->rrsets[i] = rep->rrsets[i]; + + return new_rep; +} + +/** + * See if response-ip or tag data should override the original answer rrset + * (which is rep->rrsets[rrset_id]) and if so override it. + * This is (mostly) equivalent to localzone.c:local_data_answer() but for + * response-ip actions. + * Note that this function distinguishes error conditions from "success but + * not overridden". This is because we want to avoid accidentally applying + * the "no data" action in case of error. + * @param raddr: address span that requires an action + * @param action: action to apply + * @param qtype: original query type + * @param rep: original reply message + * @param rrset_id: the rrset ID in 'rep' to which the action should apply + * @param new_repp: see respip_rewrite_reply + * @param tag: if >= 0 the tag ID used to determine the action and data + * @param tag_datas: data corresponding to 'tag'. + * @param tag_datas_size: size of 'tag_datas' + * @param tagname: array of tag names, used for logging + * @param num_tags: size of 'tagname', used for logging + * @param redirect_rrsetp: ptr to redirect record + * @param region: region for building new reply + * @return 1 if overridden, 0 if not overridden, -1 on error. + */ +static int +respip_data_answer(const struct resp_addr* raddr, enum respip_action action, + uint16_t qtype, const struct reply_info* rep, + size_t rrset_id, struct reply_info** new_repp, int tag, + struct config_strlist** tag_datas, size_t tag_datas_size, + char* const* tagname, int num_tags, + struct ub_packed_rrset_key** redirect_rrsetp, struct regional* region) +{ + struct ub_packed_rrset_key* rp = raddr->data; + struct reply_info* new_rep; + *redirect_rrsetp = NULL; + + if(action == respip_redirect && tag != -1 && + (size_t)tag<tag_datas_size && tag_datas[tag]) { + struct query_info dataqinfo; + struct ub_packed_rrset_key r; + + /* Extract parameters of the original answer rrset that can be + * rewritten below, in the form of query_info. Note that these + * can be different from the info of the original query if the + * rrset is a CNAME target.*/ + memset(&dataqinfo, 0, sizeof(dataqinfo)); + dataqinfo.qname = rep->rrsets[rrset_id]->rk.dname; + dataqinfo.qname_len = rep->rrsets[rrset_id]->rk.dname_len; + dataqinfo.qtype = ntohs(rep->rrsets[rrset_id]->rk.type); + dataqinfo.qclass = ntohs(rep->rrsets[rrset_id]->rk.rrset_class); + + memset(&r, 0, sizeof(r)); + if(local_data_find_tag_datas(&dataqinfo, tag_datas[tag], &r, + region)) { + verbose(VERB_ALGO, + "response-ip redirect with tag data [%d] %s", + tag, (tag<num_tags?tagname[tag]:"null")); + /* use copy_rrset() to 'normalize' memory layout */ + rp = copy_rrset(&r, region); + if(!rp) + return -1; + } + } + if(!rp) + return 0; + + /* If we are using response-ip-data, we need to make a copy of rrset + * to replace the rrset's dname. Note that, unlike local data, we + * rename the dname for other actions than redirect. This is because + * response-ip-data isn't associated to any specific name. */ + if(rp == raddr->data) { + rp = copy_rrset(rp, region); + if(!rp) + return -1; + rp->rk.dname = rep->rrsets[rrset_id]->rk.dname; + rp->rk.dname_len = rep->rrsets[rrset_id]->rk.dname_len; + } + + /* Build a new reply with redirect rrset. We keep any preceding CNAMEs + * and replace the address rrset that triggers the action. If it's + * type ANY query, however, no other answer records should be kept + * (note that it can't be a CNAME chain in this case due to + * sanitizing). */ + if(qtype == LDNS_RR_TYPE_ANY) + rrset_id = 0; + new_rep = make_new_reply_info(rep, region, rrset_id + 1, rrset_id); + if(!new_rep) + return -1; + rp->rk.flags |= PACKED_RRSET_FIXEDTTL; /* avoid adjusting TTL */ + new_rep->rrsets[rrset_id] = rp; + + *redirect_rrsetp = rp; + *new_repp = new_rep; + return 1; +} + +/** + * apply response ip action in case where no action data is provided. + * this is similar to localzone.c:lz_zone_answer() but simplified due to + * the characteristics of response ip: + * - 'deny' variants will be handled at the caller side + * - no specific processing for 'transparent' variants: unlike local zones, + * there is no such a case of 'no data but name existing'. so all variants + * just mean 'transparent if no data'. + * @param qtype: query type + * @param action: found action + * @param rep: + * @param new_repp + * @param rrset_id + * @param region: region for building new reply + * @return 1 on success, 0 on error. + */ +static int +respip_nodata_answer(uint16_t qtype, enum respip_action action, + const struct reply_info *rep, size_t rrset_id, + struct reply_info** new_repp, struct regional* region) +{ + struct reply_info* new_rep; + + if(action == respip_refuse || action == respip_always_refuse) { + new_rep = make_new_reply_info(rep, region, 0, 0); + if(!new_rep) + return 0; + FLAGS_SET_RCODE(new_rep->flags, LDNS_RCODE_REFUSED); + *new_repp = new_rep; + return 1; + } else if(action == respip_static || action == respip_redirect || + action == respip_always_nxdomain) { + /* Since we don't know about other types of the owner name, + * we generally return NOERROR/NODATA unless an NXDOMAIN action + * is explicitly specified. */ + int rcode = (action == respip_always_nxdomain)? + LDNS_RCODE_NXDOMAIN:LDNS_RCODE_NOERROR; + + /* We should empty the answer section except for any preceding + * CNAMEs (in that case rrset_id > 0). Type-ANY case is + * special as noted in respip_data_answer(). */ + if(qtype == LDNS_RR_TYPE_ANY) + rrset_id = 0; + new_rep = make_new_reply_info(rep, region, rrset_id, rrset_id); + if(!new_rep) + return 0; + FLAGS_SET_RCODE(new_rep->flags, rcode); + *new_repp = new_rep; + return 1; + } + + return 1; +} + +/** Populate action info structure with the results of response-ip action + * processing, iff as the result of response-ip processing we are actually + * taking some action. Only action is set if action_only is true. + * Returns true on success, false on failure. + */ +static int +populate_action_info(struct respip_action_info* actinfo, + enum respip_action action, const struct resp_addr* raddr, + const struct ub_packed_rrset_key* ATTR_UNUSED(rrset), + int ATTR_UNUSED(tag), const struct respip_set* ATTR_UNUSED(ipset), + int ATTR_UNUSED(action_only), struct regional* region) +{ + if(action == respip_none || !raddr) + return 1; + actinfo->action = action; + + /* for inform variants, make a copy of the matched address block for + * later logging. We make a copy to proactively avoid disruption if + * and when we allow a dynamic update to the respip tree. */ + if(action == respip_inform || action == respip_inform_deny) { + struct respip_addr_info* a = + regional_alloc_zero(region, sizeof(*a)); + if(!a) { + log_err("out of memory"); + return 0; + } + a->addr = raddr->node.addr; + a->addrlen = raddr->node.addrlen; + a->net = raddr->node.net; + actinfo->addrinfo = a; + } + + return 1; +} + +int +respip_rewrite_reply(const struct query_info* qinfo, + const struct respip_client_info* cinfo, const struct reply_info* rep, + struct reply_info** new_repp, struct respip_action_info* actinfo, + struct ub_packed_rrset_key** alias_rrset, int search_only, + struct regional* region) +{ + const uint8_t* ctaglist; + size_t ctaglen; + const uint8_t* tag_actions; + size_t tag_actions_size; + struct config_strlist** tag_datas; + size_t tag_datas_size; + struct view* view = NULL; + struct respip_set* ipset = NULL; + size_t rrset_id = 0; + enum respip_action action = respip_none; + int tag = -1; + const struct resp_addr* raddr = NULL; + int ret = 1; + struct ub_packed_rrset_key* redirect_rrset = NULL; + + if(!cinfo) + goto done; + ctaglist = cinfo->taglist; + ctaglen = cinfo->taglen; + tag_actions = cinfo->tag_actions; + tag_actions_size = cinfo->tag_actions_size; + tag_datas = cinfo->tag_datas; + tag_datas_size = cinfo->tag_datas_size; + view = cinfo->view; + ipset = cinfo->respip_set; + + /** Try to use response-ip config from the view first; use + * global response-ip config if we don't have the view or we don't + * have the matching per-view config (and the view allows the use + * of global data in this case). + * Note that we lock the view even if we only use view members that + * currently don't change after creation. This is for safety for + * future possible changes as the view documentation seems to expect + * any of its member can change in the view's lifetime. + * Note also that we assume 'view' is valid in this function, which + * should be safe (see unbound bug #1191) */ + if(view) { + lock_rw_rdlock(&view->lock); + if(view->respip_set) { + if((raddr = respip_addr_lookup(rep, + &view->respip_set->ip_tree, &rrset_id))) { + /** for per-view respip directives the action + * can only be direct (i.e. not tag-based) */ + action = raddr->action; + } + } + if(!raddr && !view->isfirst) + goto done; + } + if(!raddr && ipset && (raddr = respip_addr_lookup(rep, &ipset->ip_tree, + &rrset_id))) { + action = (enum respip_action)local_data_find_tag_action( + raddr->taglist, raddr->taglen, ctaglist, ctaglen, + tag_actions, tag_actions_size, + (enum localzone_type)raddr->action, &tag, + ipset->tagname, ipset->num_tags); + } + if(raddr && !search_only) { + int result = 0; + + /* first, see if we have response-ip or tag action for the + * action except for 'always' variants. */ + if(action != respip_always_refuse + && action != respip_always_transparent + && action != respip_always_nxdomain + && (result = respip_data_answer(raddr, action, + qinfo->qtype, rep, rrset_id, new_repp, tag, tag_datas, + tag_datas_size, ipset->tagname, ipset->num_tags, + &redirect_rrset, region)) < 0) { + ret = 0; + goto done; + } + + /* if no action data applied, take action specific to the + * action without data. */ + if(!result && !respip_nodata_answer(qinfo->qtype, action, rep, + rrset_id, new_repp, region)) { + ret = 0; + goto done; + } + } + done: + if(view) { + lock_rw_unlock(&view->lock); + } + if(ret) { + /* If we're redirecting the original answer to a + * CNAME, record the CNAME rrset so the caller can take + * the appropriate action. Note that we don't check the + * action type; it should normally be 'redirect', but it + * can be of other type when a data-dependent tag action + * uses redirect response-ip data. + */ + if(redirect_rrset && + redirect_rrset->rk.type == ntohs(LDNS_RR_TYPE_CNAME) && + qinfo->qtype != LDNS_RR_TYPE_ANY) + *alias_rrset = redirect_rrset; + /* on success, populate respip result structure */ + ret = populate_action_info(actinfo, action, raddr, + redirect_rrset, tag, ipset, search_only, region); + } + return ret; +} + +static int +generate_cname_request(struct module_qstate* qstate, + struct ub_packed_rrset_key* alias_rrset) +{ + struct module_qstate* subq = NULL; + struct query_info subqi; + + memset(&subqi, 0, sizeof(subqi)); + get_cname_target(alias_rrset, &subqi.qname, &subqi.qname_len); + if(!subqi.qname) + return 0; /* unexpected: not a valid CNAME RDATA */ + subqi.qtype = qstate->qinfo.qtype; + subqi.qclass = qstate->qinfo.qclass; + fptr_ok(fptr_whitelist_modenv_attach_sub(qstate->env->attach_sub)); + return (*qstate->env->attach_sub)(qstate, &subqi, BIT_RD, 0, 0, &subq); +} + +void +respip_operate(struct module_qstate* qstate, enum module_ev event, int id, + struct outbound_entry* outbound) +{ + struct respip_qstate* rq = (struct respip_qstate*)qstate->minfo[id]; + + log_query_info(VERB_QUERY, "respip operate: query", &qstate->qinfo); + (void)outbound; + + if(event == module_event_new || event == module_event_pass) { + if(!rq) { + rq = regional_alloc_zero(qstate->region, sizeof(*rq)); + if(!rq) + goto servfail; + rq->state = RESPIP_INIT; + qstate->minfo[id] = rq; + } + if(rq->state == RESPIP_SUBQUERY_FINISHED) { + qstate->ext_state[id] = module_finished; + return; + } + verbose(VERB_ALGO, "respip: pass to next module"); + qstate->ext_state[id] = module_wait_module; + } else if(event == module_event_moddone) { + /* If the reply may be subject to response-ip rewriting + * according to the query type, check the actions. If a + * rewrite is necessary, we'll replace the reply in qstate + * with the new one. */ + enum module_ext_state next_state = module_finished; + + if((qstate->qinfo.qtype == LDNS_RR_TYPE_A || + qstate->qinfo.qtype == LDNS_RR_TYPE_AAAA || + qstate->qinfo.qtype == LDNS_RR_TYPE_ANY) && + qstate->return_msg && qstate->return_msg->rep) { + struct respip_action_info actinfo = {respip_none, NULL}; + struct reply_info* new_rep = qstate->return_msg->rep; + struct ub_packed_rrset_key* alias_rrset = NULL; + + if(!respip_rewrite_reply(&qstate->qinfo, + qstate->client_info, qstate->return_msg->rep, + &new_rep, &actinfo, &alias_rrset, 0, + qstate->region)) { + goto servfail; + } + if(actinfo.action != respip_none) { + /* save action info for logging on a + * per-front-end-query basis */ + if(!(qstate->respip_action_info = + regional_alloc_init(qstate->region, + &actinfo, sizeof(actinfo)))) + { + log_err("out of memory"); + goto servfail; + } + } else { + qstate->respip_action_info = NULL; + } + if (new_rep == qstate->return_msg->rep && + (actinfo.action == respip_deny || + actinfo.action == respip_inform_deny)) { + /* for deny-variant actions (unless response-ip + * data is applied), mark the query state so + * the response will be dropped for all + * clients. */ + qstate->is_drop = 1; + } else if(alias_rrset) { + if(!generate_cname_request(qstate, alias_rrset)) + goto servfail; + next_state = module_wait_subquery; + } + qstate->return_msg->rep = new_rep; + } + qstate->ext_state[id] = next_state; + } else + qstate->ext_state[id] = module_finished; + + return; + + servfail: + qstate->return_rcode = LDNS_RCODE_SERVFAIL; + qstate->return_msg = NULL; +} + +int +respip_merge_cname(struct reply_info* base_rep, + const struct query_info* qinfo, const struct reply_info* tgt_rep, + const struct respip_client_info* cinfo, int must_validate, + struct reply_info** new_repp, struct regional* region) +{ + struct reply_info* new_rep; + struct reply_info* tmp_rep = NULL; /* just a placeholder */ + struct ub_packed_rrset_key* alias_rrset = NULL; /* ditto */ + uint16_t tgt_rcode; + size_t i, j; + struct respip_action_info actinfo = {respip_none, NULL}; + + /* If the query for the CNAME target would result in an unusual rcode, + * we generally translate it as a failure for the base query + * (which would then be translated into SERVFAIL). The only exception + * is NXDOMAIN and YXDOMAIN, which are passed to the end client(s). + * The YXDOMAIN case would be rare but still possible (when + * DNSSEC-validated DNAME has been cached but synthesizing CNAME + * can't be generated due to length limitation) */ + tgt_rcode = FLAGS_GET_RCODE(tgt_rep->flags); + if((tgt_rcode != LDNS_RCODE_NOERROR && + tgt_rcode != LDNS_RCODE_NXDOMAIN && + tgt_rcode != LDNS_RCODE_YXDOMAIN) || + (must_validate && tgt_rep->security <= sec_status_bogus)) { + return 0; + } + + /* see if the target reply would be subject to a response-ip action. */ + if(!respip_rewrite_reply(qinfo, cinfo, tgt_rep, &tmp_rep, &actinfo, + &alias_rrset, 1, region)) + return 0; + if(actinfo.action != respip_none) { + log_info("CNAME target of redirect response-ip action would " + "be subject to response-ip action, too; stripped"); + *new_repp = base_rep; + return 1; + } + + /* Append target reply to the base. Since we cannot assume + * tgt_rep->rrsets is valid throughout the lifetime of new_rep + * or it can be safely shared by multiple threads, we need to make a + * deep copy. */ + new_rep = make_new_reply_info(base_rep, region, + base_rep->an_numrrsets + tgt_rep->an_numrrsets, + base_rep->an_numrrsets); + if(!new_rep) + return 0; + for(i=0,j=base_rep->an_numrrsets; i<tgt_rep->an_numrrsets; i++,j++) { + new_rep->rrsets[j] = copy_rrset(tgt_rep->rrsets[i], region); + if(!new_rep->rrsets[j]) + return 0; + } + + FLAGS_SET_RCODE(new_rep->flags, tgt_rcode); + *new_repp = new_rep; + return 1; +} + +void +respip_inform_super(struct module_qstate* qstate, int id, + struct module_qstate* super) +{ + struct respip_qstate* rq = (struct respip_qstate*)super->minfo[id]; + struct reply_info* new_rep = NULL; + + rq->state = RESPIP_SUBQUERY_FINISHED; + + /* respip subquery should have always been created with a valid reply + * in super. */ + log_assert(super->return_msg && super->return_msg->rep); + + /* return_msg can be NULL when, e.g., the sub query resulted in + * SERVFAIL, in which case we regard it as a failure of the original + * query. Other checks are probably redundant, but we check them + * for safety. */ + if(!qstate->return_msg || !qstate->return_msg->rep || + qstate->return_rcode != LDNS_RCODE_NOERROR) + goto fail; + + if(!respip_merge_cname(super->return_msg->rep, &qstate->qinfo, + qstate->return_msg->rep, super->client_info, + super->env->need_to_validate, &new_rep, super->region)) + goto fail; + super->return_msg->rep = new_rep; + return; + + fail: + super->return_rcode = LDNS_RCODE_SERVFAIL; + super->return_msg = NULL; + return; +} + +void +respip_clear(struct module_qstate* qstate, int id) +{ + qstate->minfo[id] = NULL; +} + +size_t +respip_get_mem(struct module_env* env, int id) +{ + (void)env; + (void)id; + return 0; +} + +/** + * The response-ip function block + */ +static struct module_func_block respip_block = { + "respip", + &respip_init, &respip_deinit, &respip_operate, &respip_inform_super, + &respip_clear, &respip_get_mem +}; + +struct module_func_block* +respip_get_funcblock(void) +{ + return &respip_block; +} + +enum respip_action +resp_addr_get_action(const struct resp_addr* addr) +{ + return addr ? addr->action : respip_none; +} + +struct ub_packed_rrset_key* +resp_addr_get_rrset(struct resp_addr* addr) +{ + return addr ? addr->data : NULL; +} + +int +respip_set_is_empty(const struct respip_set* set) +{ + return set ? set->ip_tree.count == 0 : 1; +} + +void +respip_inform_print(struct respip_addr_info* respip_addr, uint8_t* qname, + uint16_t qtype, uint16_t qclass, struct local_rrset* local_alias, + struct comm_reply* repinfo) +{ + char srcip[128], respip[128], txt[512]; + unsigned port; + + if(local_alias) + qname = local_alias->rrset->rk.dname; + port = (unsigned)((repinfo->addr.ss_family == AF_INET) ? + ntohs(((struct sockaddr_in*)&repinfo->addr)->sin_port) : + ntohs(((struct sockaddr_in6*)&repinfo->addr)->sin6_port)); + addr_to_str(&repinfo->addr, repinfo->addrlen, srcip, sizeof(srcip)); + addr_to_str(&respip_addr->addr, respip_addr->addrlen, + respip, sizeof(respip)); + snprintf(txt, sizeof(txt), "%s/%d inform %s@%u", respip, + respip_addr->net, srcip, port); + log_nametypeclass(0, txt, qname, qtype, qclass); +} |