monero/external/unbound/respip/respip.c
Erik de Castro Lopo a85b5759f3 Upgrade unbound library
These files were pulled from the 1.6.3 release tarball.

This new version builds against OpenSSL version 1.1 which will be
the default in the new Debian Stable which is due to be released
RealSoonNow (tm).
2017-06-17 23:04:00 +10:00

1180 lines
36 KiB
C

/*
* respip/respip.c - filtering response IP module
*/
/**
* \file
*
* This file contains a module that inspects a result of recursive resolution
* to see if any IP address record should trigger a special action.
* If applicable these actions can modify the original response.
*/
#include "config.h"
#include "services/localzone.h"
#include "services/cache/dns.h"
#include "sldns/str2wire.h"
#include "util/config_file.h"
#include "util/fptr_wlist.h"
#include "util/module.h"
#include "util/net_help.h"
#include "util/regional.h"
#include "util/data/msgreply.h"
#include "util/storage/dnstree.h"
#include "respip/respip.h"
#include "services/view.h"
#include "sldns/rrdef.h"
/**
* Conceptual set of IP addresses for response AAAA or A records that should
* trigger special actions.
*/
struct respip_set {
struct regional* region;
struct rbtree_type ip_tree;
char* const* tagname; /* shallow copy of tag names, for logging */
int num_tags; /* number of tagname entries */
};
/** An address span with response control information */
struct resp_addr {
/** node in address tree */
struct addr_tree_node node;
/** tag bitlist */
uint8_t* taglist;
/** length of the taglist (in bytes) */
size_t taglen;
/** action for this address span */
enum respip_action action;
/** "local data" for this node */
struct ub_packed_rrset_key* data;
};
/** Subset of resp_addr.node, used for inform-variant logging */
struct respip_addr_info {
struct sockaddr_storage addr;
socklen_t addrlen;
int net;
};
/** Query state regarding the response-ip module. */
enum respip_state {
/**
* The general state. Unless CNAME chasing takes place, all processing
* is completed in this state without any other asynchronous event.
*/
RESPIP_INIT = 0,
/**
* A subquery for CNAME chasing is completed.
*/
RESPIP_SUBQUERY_FINISHED
};
/** Per query state for the response-ip module. */
struct respip_qstate {
enum respip_state state;
};
struct respip_set*
respip_set_create(void)
{
struct respip_set* set = calloc(1, sizeof(*set));
if(!set)
return NULL;
set->region = regional_create();
if(!set->region) {
free(set);
return NULL;
}
addr_tree_init(&set->ip_tree);
return set;
}
void
respip_set_delete(struct respip_set* set)
{
if(!set)
return;
regional_destroy(set->region);
free(set);
}
struct rbtree_type*
respip_set_get_tree(struct respip_set* set)
{
if(!set)
return NULL;
return &set->ip_tree;
}
/** returns the node in the address tree for the specified netblock string;
* non-existent node will be created if 'create' is true */
static struct resp_addr*
respip_find_or_create(struct respip_set* set, const char* ipstr, int create)
{
struct resp_addr* node;
struct sockaddr_storage addr;
int net;
socklen_t addrlen;
if(!netblockstrtoaddr(ipstr, 0, &addr, &addrlen, &net)) {
log_err("cannot parse netblock: '%s'", ipstr);
return NULL;
}
node = (struct resp_addr*)addr_tree_find(&set->ip_tree, &addr, addrlen, net);
if(!node && create) {
node = regional_alloc_zero(set->region, sizeof(*node));
if(!node) {
log_err("out of memory");
return NULL;
}
node->action = respip_none;
if(!addr_tree_insert(&set->ip_tree, &node->node, &addr,
addrlen, net)) {
/* We know we didn't find it, so this should be
* impossible. */
log_warn("unexpected: duplicate address: %s", ipstr);
}
}
return node;
}
static int
respip_tag_cfg(struct respip_set* set, const char* ipstr,
const uint8_t* taglist, size_t taglen)
{
struct resp_addr* node;
if(!(node=respip_find_or_create(set, ipstr, 1)))
return 0;
if(node->taglist) {
log_warn("duplicate response-address-tag for '%s', overridden.",
ipstr);
}
node->taglist = regional_alloc_init(set->region, taglist, taglen);
if(!node->taglist) {
log_err("out of memory");
return 0;
}
node->taglen = taglen;
return 1;
}
/** set action for the node specified by the netblock string */
static int
respip_action_cfg(struct respip_set* set, const char* ipstr,
const char* actnstr)
{
struct resp_addr* node;
enum respip_action action;
if(!(node=respip_find_or_create(set, ipstr, 1)))
return 0;
if(node->action != respip_none) {
log_warn("duplicate response-ip action for '%s', overridden.",
ipstr);
}
if(strcmp(actnstr, "deny") == 0)
action = respip_deny;
else if(strcmp(actnstr, "redirect") == 0)
action = respip_redirect;
else if(strcmp(actnstr, "inform") == 0)
action = respip_inform;
else if(strcmp(actnstr, "inform_deny") == 0)
action = respip_inform_deny;
else if(strcmp(actnstr, "always_transparent") == 0)
action = respip_always_transparent;
else if(strcmp(actnstr, "always_refuse") == 0)
action = respip_always_refuse;
else if(strcmp(actnstr, "always_nxdomain") == 0)
action = respip_always_nxdomain;
else {
log_err("unknown response-ip action %s", actnstr);
return 0;
}
node->action = action;
return 1;
}
/** allocate and initialize an rrset structure; this function is based
* on new_local_rrset() from the localzone.c module */
static struct ub_packed_rrset_key*
new_rrset(struct regional* region, uint16_t rrtype, uint16_t rrclass)
{
struct packed_rrset_data* pd;
struct ub_packed_rrset_key* rrset = regional_alloc_zero(
region, sizeof(*rrset));
if(!rrset) {
log_err("out of memory");
return NULL;
}
rrset->entry.key = rrset;
pd = regional_alloc_zero(region, sizeof(*pd));
if(!pd) {
log_err("out of memory");
return NULL;
}
pd->trust = rrset_trust_prim_noglue;
pd->security = sec_status_insecure;
rrset->entry.data = pd;
rrset->rk.dname = regional_alloc_zero(region, 1);
if(!rrset->rk.dname) {
log_err("out of memory");
return NULL;
}
rrset->rk.dname_len = 1;
rrset->rk.type = htons(rrtype);
rrset->rk.rrset_class = htons(rrclass);
return rrset;
}
/** enter local data as resource records into a response-ip node */
static int
respip_enter_rr(struct regional* region, struct resp_addr* raddr,
const char* rrstr, const char* netblock)
{
uint8_t* nm;
uint16_t rrtype = 0, rrclass = 0;
time_t ttl = 0;
uint8_t rr[LDNS_RR_BUF_SIZE];
uint8_t* rdata = NULL;
size_t rdata_len = 0;
char buf[65536];
char bufshort[64];
struct packed_rrset_data* pd;
struct sockaddr* sa;
int ret;
if(raddr->action != respip_redirect) {
log_err("cannot parse response-ip-data %s: response-ip "
"action for %s is not redirect", rrstr, netblock);
return 0;
}
ret = snprintf(buf, sizeof(buf), ". %s", rrstr);
if(ret < 0 || ret >= (int)sizeof(buf)) {
strlcpy(bufshort, rrstr, sizeof(bufshort));
log_err("bad response-ip-data: %s...", bufshort);
return 0;
}
if(!rrstr_get_rr_content(buf, &nm, &rrtype, &rrclass, &ttl, rr, sizeof(rr),
&rdata, &rdata_len)) {
log_err("bad response-ip-data: %s", rrstr);
return 0;
}
sa = (struct sockaddr*)&raddr->node.addr;
if (rrtype == LDNS_RR_TYPE_CNAME && raddr->data) {
log_err("CNAME response-ip data (%s) can not co-exist with other "
"response-ip data for netblock %s", rrstr, netblock);
return 0;
} else if (raddr->data &&
raddr->data->rk.type == htons(LDNS_RR_TYPE_CNAME)) {
log_err("response-ip data (%s) can not be added; CNAME response-ip "
"data already in place for netblock %s", rrstr, netblock);
return 0;
} else if((rrtype != LDNS_RR_TYPE_CNAME) &&
((sa->sa_family == AF_INET && rrtype != LDNS_RR_TYPE_A) ||
(sa->sa_family == AF_INET6 && rrtype != LDNS_RR_TYPE_AAAA))) {
log_err("response-ip data %s record type does not correspond "
"to netblock %s address family", rrstr, netblock);
return 0;
}
if(!raddr->data) {
raddr->data = new_rrset(region, rrtype, rrclass);
if(!raddr->data)
return 0;
}
pd = raddr->data->entry.data;
return rrset_insert_rr(region, pd, rdata, rdata_len, ttl, rrstr);
}
static int
respip_data_cfg(struct respip_set* set, const char* ipstr, const char* rrstr)
{
struct resp_addr* node;
node=respip_find_or_create(set, ipstr, 0);
if(!node || node->action == respip_none) {
log_err("cannot parse response-ip-data %s: "
"response-ip node for %s not found", rrstr, ipstr);
return 0;
}
return respip_enter_rr(set->region, node, rrstr, ipstr);
}
static int
respip_set_apply_cfg(struct respip_set* set, char* const* tagname, int num_tags,
struct config_strbytelist* respip_tags,
struct config_str2list* respip_actions,
struct config_str2list* respip_data)
{
struct config_strbytelist* p;
struct config_str2list* pa;
struct config_str2list* pd;
set->tagname = tagname;
set->num_tags = num_tags;
p = respip_tags;
while(p) {
struct config_strbytelist* np = p->next;
log_assert(p->str && p->str2);
if(!respip_tag_cfg(set, p->str, p->str2, p->str2len)) {
config_del_strbytelist(p);
return 0;
}
free(p->str);
free(p->str2);
free(p);
p = np;
}
pa = respip_actions;
while(pa) {
struct config_str2list* np = pa->next;
log_assert(pa->str && pa->str2);
if(!respip_action_cfg(set, pa->str, pa->str2)) {
config_deldblstrlist(pa);
return 0;
}
free(pa->str);
free(pa->str2);
free(pa);
pa = np;
}
pd = respip_data;
while(pd) {
struct config_str2list* np = pd->next;
log_assert(pd->str && pd->str2);
if(!respip_data_cfg(set, pd->str, pd->str2)) {
config_deldblstrlist(pd);
return 0;
}
free(pd->str);
free(pd->str2);
free(pd);
pd = np;
}
return 1;
}
int
respip_global_apply_cfg(struct respip_set* set, struct config_file* cfg)
{
int ret = respip_set_apply_cfg(set, cfg->tagname, cfg->num_tags,
cfg->respip_tags, cfg->respip_actions, cfg->respip_data);
cfg->respip_data = NULL;
cfg->respip_actions = NULL;
cfg->respip_tags = NULL;
return ret;
}
/** Iterate through raw view data and apply the view-specific respip
* configuration; at this point we should have already seen all the views,
* so if any of the views that respip data refer to does not exist, that's
* an error. This additional iteration through view configuration data
* is expected to not have significant performance impact (or rather, its
* performance impact is not expected to be prohibitive in the configuration
* processing phase).
*/
int
respip_views_apply_cfg(struct views* vs, struct config_file* cfg,
int* have_view_respip_cfg)
{
struct config_view* cv;
struct view* v;
int ret;
for(cv = cfg->views; cv; cv = cv->next) {
/** if no respip config for this view then there's
* nothing to do; note that even though respip data must go
* with respip action, we're checking for both here because
* we want to catch the case where the respip action is missing
* while the data is present */
if(!cv->respip_actions && !cv->respip_data)
continue;
if(!(v = views_find_view(vs, cv->name, 1))) {
log_err("view '%s' unexpectedly missing", cv->name);
return 0;
}
if(!v->respip_set) {
v->respip_set = respip_set_create();
if(!v->respip_set) {
log_err("out of memory");
lock_rw_unlock(&v->lock);
return 0;
}
}
ret = respip_set_apply_cfg(v->respip_set, NULL, 0, NULL,
cv->respip_actions, cv->respip_data);
lock_rw_unlock(&v->lock);
if(!ret) {
log_err("Error while applying respip configuration "
"for view '%s'", cv->name);
return 0;
}
*have_view_respip_cfg = (*have_view_respip_cfg ||
v->respip_set->ip_tree.count);
cv->respip_actions = NULL;
cv->respip_data = NULL;
}
return 1;
}
/**
* make a deep copy of 'key' in 'region'.
* This is largely derived from packed_rrset_copy_region() and
* packed_rrset_ptr_fixup(), but differs in the following points:
*
* - It doesn't assume all data in 'key' are in a contiguous memory region.
* Although that would be the case in most cases, 'key' can be passed from
* a lower-level module and it might not build the rrset to meet the
* assumption. In fact, an rrset specified as response-ip-data or generated
* in local_data_find_tag_datas() breaks the assumption. So it would be
* safer not to naively rely on the assumption. On the other hand, this
* function ensures the copied rrset data are in a contiguous region so
* that it won't cause a disruption even if an upper layer module naively
* assumes the memory layout.
* - It doesn't copy RRSIGs (if any) in 'key'. The rrset will be used in
* a reply that was already faked, so it doesn't make much sense to provide
* partial sigs even if they are valid themselves.
* - It doesn't adjust TTLs as it basically has to be a verbatim copy of 'key'
* just allocated in 'region' (the assumption is necessary TTL adjustment
* has been already done in 'key').
*
* This function returns the copied rrset key on success, and NULL on memory
* allocation failure.
*/
struct ub_packed_rrset_key*
copy_rrset(const struct ub_packed_rrset_key* key, struct regional* region)
{
struct ub_packed_rrset_key* ck = regional_alloc(region,
sizeof(struct ub_packed_rrset_key));
struct packed_rrset_data* d;
struct packed_rrset_data* data = key->entry.data;
size_t dsize, i;
uint8_t* nextrdata;
/* derived from packed_rrset_copy_region(), but don't use
* packed_rrset_sizeof() and do exclude RRSIGs */
if(!ck)
return NULL;
ck->id = key->id;
memset(&ck->entry, 0, sizeof(ck->entry));
ck->entry.hash = key->entry.hash;
ck->entry.key = ck;
ck->rk = key->rk;
ck->rk.dname = regional_alloc_init(region, key->rk.dname,
key->rk.dname_len);
if(!ck->rk.dname)
return NULL;
dsize = sizeof(struct packed_rrset_data) + data->count *
(sizeof(size_t)+sizeof(uint8_t*)+sizeof(time_t));
for(i=0; i<data->count; i++)
dsize += data->rr_len[i];
d = regional_alloc(region, dsize);
if(!d)
return NULL;
*d = *data;
d->rrsig_count = 0;
ck->entry.data = d;
/* derived from packed_rrset_ptr_fixup() with copying the data */
d->rr_len = (size_t*)((uint8_t*)d + sizeof(struct packed_rrset_data));
d->rr_data = (uint8_t**)&(d->rr_len[d->count]);
d->rr_ttl = (time_t*)&(d->rr_data[d->count]);
nextrdata = (uint8_t*)&(d->rr_ttl[d->count]);
for(i=0; i<d->count; i++) {
d->rr_len[i] = data->rr_len[i];
d->rr_ttl[i] = data->rr_ttl[i];
d->rr_data[i] = nextrdata;
memcpy(d->rr_data[i], data->rr_data[i], data->rr_len[i]);
nextrdata += d->rr_len[i];
}
return ck;
}
int
respip_init(struct module_env* env, int id)
{
(void)env;
(void)id;
return 1;
}
void
respip_deinit(struct module_env* env, int id)
{
(void)env;
(void)id;
}
/** Convert a packed AAAA or A RRset to sockaddr. */
static int
rdata2sockaddr(const struct packed_rrset_data* rd, uint16_t rtype, size_t i,
struct sockaddr_storage* ss, socklen_t* addrlenp)
{
/* unbound can accept and cache odd-length AAAA/A records, so we have
* to validate the length. */
if(rtype == LDNS_RR_TYPE_A && rd->rr_len[i] == 6) {
struct sockaddr_in* sa4 = (struct sockaddr_in*)ss;
memset(sa4, 0, sizeof(*sa4));
sa4->sin_family = AF_INET;
memcpy(&sa4->sin_addr, rd->rr_data[i] + 2,
sizeof(sa4->sin_addr));
*addrlenp = sizeof(*sa4);
return 1;
} else if(rtype == LDNS_RR_TYPE_AAAA && rd->rr_len[i] == 18) {
struct sockaddr_in6* sa6 = (struct sockaddr_in6*)ss;
memset(sa6, 0, sizeof(*sa6));
sa6->sin6_family = AF_INET6;
memcpy(&sa6->sin6_addr, rd->rr_data[i] + 2,
sizeof(sa6->sin6_addr));
*addrlenp = sizeof(*sa6);
return 1;
}
return 0;
}
/**
* Search the given 'iptree' for response address information that matches
* any of the IP addresses in an AAAA or A in the answer section of the
* response (stored in 'rep'). If found, a pointer to the matched resp_addr
* structure will be returned, and '*rrset_id' is set to the index in
* rep->rrsets for the RRset that contains the matching IP address record
* (the index is normally 0, but can be larger than that if this is a CNAME
* chain or type-ANY response).
*/
static const struct resp_addr*
respip_addr_lookup(const struct reply_info *rep, struct rbtree_type* iptree,
size_t* rrset_id)
{
size_t i;
struct resp_addr* ra;
struct sockaddr_storage ss;
socklen_t addrlen;
for(i=0; i<rep->an_numrrsets; i++) {
size_t j;
const struct packed_rrset_data* rd;
uint16_t rtype = ntohs(rep->rrsets[i]->rk.type);
if(rtype != LDNS_RR_TYPE_A && rtype != LDNS_RR_TYPE_AAAA)
continue;
rd = rep->rrsets[i]->entry.data;
for(j = 0; j < rd->count; j++) {
if(!rdata2sockaddr(rd, rtype, j, &ss, &addrlen))
continue;
ra = (struct resp_addr*)addr_tree_lookup(iptree, &ss,
addrlen);
if(ra) {
*rrset_id = i;
return ra;
}
}
}
return NULL;
}
/*
* Create a new reply_info based on 'rep'. The new info is based on
* the passed 'rep', but ignores any rrsets except for the first 'an_numrrsets'
* RRsets in the answer section. These answer rrsets are copied to the
* new info, up to 'copy_rrsets' rrsets (which must not be larger than
* 'an_numrrsets'). If an_numrrsets > copy_rrsets, the remaining rrsets array
* entries will be kept empty so the caller can fill them later. When rrsets
* are copied, they are shallow copied. The caller must ensure that the
* copied rrsets are valid throughout its lifetime and must provide appropriate
* mutex if it can be shared by multiple threads.
*/
static struct reply_info *
make_new_reply_info(const struct reply_info* rep, struct regional* region,
size_t an_numrrsets, size_t copy_rrsets)
{
struct reply_info* new_rep;
size_t i;
/* create a base struct. we specify 'insecure' security status as
* the modified response won't be DNSSEC-valid. In our faked response
* the authority and additional sections will be empty (except possible
* EDNS0 OPT RR in the additional section appended on sending it out),
* so the total number of RRsets is an_numrrsets. */
new_rep = construct_reply_info_base(region, rep->flags,
rep->qdcount, rep->ttl, rep->prefetch_ttl, an_numrrsets,
0, 0, an_numrrsets, sec_status_insecure);
if(!new_rep)
return NULL;
if(!reply_info_alloc_rrset_keys(new_rep, NULL, region))
return NULL;
for(i=0; i<copy_rrsets; i++)
new_rep->rrsets[i] = rep->rrsets[i];
return new_rep;
}
/**
* See if response-ip or tag data should override the original answer rrset
* (which is rep->rrsets[rrset_id]) and if so override it.
* This is (mostly) equivalent to localzone.c:local_data_answer() but for
* response-ip actions.
* Note that this function distinguishes error conditions from "success but
* not overridden". This is because we want to avoid accidentally applying
* the "no data" action in case of error.
* @param raddr: address span that requires an action
* @param action: action to apply
* @param qtype: original query type
* @param rep: original reply message
* @param rrset_id: the rrset ID in 'rep' to which the action should apply
* @param new_repp: see respip_rewrite_reply
* @param tag: if >= 0 the tag ID used to determine the action and data
* @param tag_datas: data corresponding to 'tag'.
* @param tag_datas_size: size of 'tag_datas'
* @param tagname: array of tag names, used for logging
* @param num_tags: size of 'tagname', used for logging
* @param redirect_rrsetp: ptr to redirect record
* @param region: region for building new reply
* @return 1 if overridden, 0 if not overridden, -1 on error.
*/
static int
respip_data_answer(const struct resp_addr* raddr, enum respip_action action,
uint16_t qtype, const struct reply_info* rep,
size_t rrset_id, struct reply_info** new_repp, int tag,
struct config_strlist** tag_datas, size_t tag_datas_size,
char* const* tagname, int num_tags,
struct ub_packed_rrset_key** redirect_rrsetp, struct regional* region)
{
struct ub_packed_rrset_key* rp = raddr->data;
struct reply_info* new_rep;
*redirect_rrsetp = NULL;
if(action == respip_redirect && tag != -1 &&
(size_t)tag<tag_datas_size && tag_datas[tag]) {
struct query_info dataqinfo;
struct ub_packed_rrset_key r;
/* Extract parameters of the original answer rrset that can be
* rewritten below, in the form of query_info. Note that these
* can be different from the info of the original query if the
* rrset is a CNAME target.*/
memset(&dataqinfo, 0, sizeof(dataqinfo));
dataqinfo.qname = rep->rrsets[rrset_id]->rk.dname;
dataqinfo.qname_len = rep->rrsets[rrset_id]->rk.dname_len;
dataqinfo.qtype = ntohs(rep->rrsets[rrset_id]->rk.type);
dataqinfo.qclass = ntohs(rep->rrsets[rrset_id]->rk.rrset_class);
memset(&r, 0, sizeof(r));
if(local_data_find_tag_datas(&dataqinfo, tag_datas[tag], &r,
region)) {
verbose(VERB_ALGO,
"response-ip redirect with tag data [%d] %s",
tag, (tag<num_tags?tagname[tag]:"null"));
/* use copy_rrset() to 'normalize' memory layout */
rp = copy_rrset(&r, region);
if(!rp)
return -1;
}
}
if(!rp)
return 0;
/* If we are using response-ip-data, we need to make a copy of rrset
* to replace the rrset's dname. Note that, unlike local data, we
* rename the dname for other actions than redirect. This is because
* response-ip-data isn't associated to any specific name. */
if(rp == raddr->data) {
rp = copy_rrset(rp, region);
if(!rp)
return -1;
rp->rk.dname = rep->rrsets[rrset_id]->rk.dname;
rp->rk.dname_len = rep->rrsets[rrset_id]->rk.dname_len;
}
/* Build a new reply with redirect rrset. We keep any preceding CNAMEs
* and replace the address rrset that triggers the action. If it's
* type ANY query, however, no other answer records should be kept
* (note that it can't be a CNAME chain in this case due to
* sanitizing). */
if(qtype == LDNS_RR_TYPE_ANY)
rrset_id = 0;
new_rep = make_new_reply_info(rep, region, rrset_id + 1, rrset_id);
if(!new_rep)
return -1;
rp->rk.flags |= PACKED_RRSET_FIXEDTTL; /* avoid adjusting TTL */
new_rep->rrsets[rrset_id] = rp;
*redirect_rrsetp = rp;
*new_repp = new_rep;
return 1;
}
/**
* apply response ip action in case where no action data is provided.
* this is similar to localzone.c:lz_zone_answer() but simplified due to
* the characteristics of response ip:
* - 'deny' variants will be handled at the caller side
* - no specific processing for 'transparent' variants: unlike local zones,
* there is no such a case of 'no data but name existing'. so all variants
* just mean 'transparent if no data'.
* @param qtype: query type
* @param action: found action
* @param rep:
* @param new_repp
* @param rrset_id
* @param region: region for building new reply
* @return 1 on success, 0 on error.
*/
static int
respip_nodata_answer(uint16_t qtype, enum respip_action action,
const struct reply_info *rep, size_t rrset_id,
struct reply_info** new_repp, struct regional* region)
{
struct reply_info* new_rep;
if(action == respip_refuse || action == respip_always_refuse) {
new_rep = make_new_reply_info(rep, region, 0, 0);
if(!new_rep)
return 0;
FLAGS_SET_RCODE(new_rep->flags, LDNS_RCODE_REFUSED);
*new_repp = new_rep;
return 1;
} else if(action == respip_static || action == respip_redirect ||
action == respip_always_nxdomain) {
/* Since we don't know about other types of the owner name,
* we generally return NOERROR/NODATA unless an NXDOMAIN action
* is explicitly specified. */
int rcode = (action == respip_always_nxdomain)?
LDNS_RCODE_NXDOMAIN:LDNS_RCODE_NOERROR;
/* We should empty the answer section except for any preceding
* CNAMEs (in that case rrset_id > 0). Type-ANY case is
* special as noted in respip_data_answer(). */
if(qtype == LDNS_RR_TYPE_ANY)
rrset_id = 0;
new_rep = make_new_reply_info(rep, region, rrset_id, rrset_id);
if(!new_rep)
return 0;
FLAGS_SET_RCODE(new_rep->flags, rcode);
*new_repp = new_rep;
return 1;
}
return 1;
}
/** Populate action info structure with the results of response-ip action
* processing, iff as the result of response-ip processing we are actually
* taking some action. Only action is set if action_only is true.
* Returns true on success, false on failure.
*/
static int
populate_action_info(struct respip_action_info* actinfo,
enum respip_action action, const struct resp_addr* raddr,
const struct ub_packed_rrset_key* ATTR_UNUSED(rrset),
int ATTR_UNUSED(tag), const struct respip_set* ATTR_UNUSED(ipset),
int ATTR_UNUSED(action_only), struct regional* region)
{
if(action == respip_none || !raddr)
return 1;
actinfo->action = action;
/* for inform variants, make a copy of the matched address block for
* later logging. We make a copy to proactively avoid disruption if
* and when we allow a dynamic update to the respip tree. */
if(action == respip_inform || action == respip_inform_deny) {
struct respip_addr_info* a =
regional_alloc_zero(region, sizeof(*a));
if(!a) {
log_err("out of memory");
return 0;
}
a->addr = raddr->node.addr;
a->addrlen = raddr->node.addrlen;
a->net = raddr->node.net;
actinfo->addrinfo = a;
}
return 1;
}
int
respip_rewrite_reply(const struct query_info* qinfo,
const struct respip_client_info* cinfo, const struct reply_info* rep,
struct reply_info** new_repp, struct respip_action_info* actinfo,
struct ub_packed_rrset_key** alias_rrset, int search_only,
struct regional* region)
{
const uint8_t* ctaglist;
size_t ctaglen;
const uint8_t* tag_actions;
size_t tag_actions_size;
struct config_strlist** tag_datas;
size_t tag_datas_size;
struct view* view = NULL;
struct respip_set* ipset = NULL;
size_t rrset_id = 0;
enum respip_action action = respip_none;
int tag = -1;
const struct resp_addr* raddr = NULL;
int ret = 1;
struct ub_packed_rrset_key* redirect_rrset = NULL;
if(!cinfo)
goto done;
ctaglist = cinfo->taglist;
ctaglen = cinfo->taglen;
tag_actions = cinfo->tag_actions;
tag_actions_size = cinfo->tag_actions_size;
tag_datas = cinfo->tag_datas;
tag_datas_size = cinfo->tag_datas_size;
view = cinfo->view;
ipset = cinfo->respip_set;
/** Try to use response-ip config from the view first; use
* global response-ip config if we don't have the view or we don't
* have the matching per-view config (and the view allows the use
* of global data in this case).
* Note that we lock the view even if we only use view members that
* currently don't change after creation. This is for safety for
* future possible changes as the view documentation seems to expect
* any of its member can change in the view's lifetime.
* Note also that we assume 'view' is valid in this function, which
* should be safe (see unbound bug #1191) */
if(view) {
lock_rw_rdlock(&view->lock);
if(view->respip_set) {
if((raddr = respip_addr_lookup(rep,
&view->respip_set->ip_tree, &rrset_id))) {
/** for per-view respip directives the action
* can only be direct (i.e. not tag-based) */
action = raddr->action;
}
}
if(!raddr && !view->isfirst)
goto done;
}
if(!raddr && ipset && (raddr = respip_addr_lookup(rep, &ipset->ip_tree,
&rrset_id))) {
action = (enum respip_action)local_data_find_tag_action(
raddr->taglist, raddr->taglen, ctaglist, ctaglen,
tag_actions, tag_actions_size,
(enum localzone_type)raddr->action, &tag,
ipset->tagname, ipset->num_tags);
}
if(raddr && !search_only) {
int result = 0;
/* first, see if we have response-ip or tag action for the
* action except for 'always' variants. */
if(action != respip_always_refuse
&& action != respip_always_transparent
&& action != respip_always_nxdomain
&& (result = respip_data_answer(raddr, action,
qinfo->qtype, rep, rrset_id, new_repp, tag, tag_datas,
tag_datas_size, ipset->tagname, ipset->num_tags,
&redirect_rrset, region)) < 0) {
ret = 0;
goto done;
}
/* if no action data applied, take action specific to the
* action without data. */
if(!result && !respip_nodata_answer(qinfo->qtype, action, rep,
rrset_id, new_repp, region)) {
ret = 0;
goto done;
}
}
done:
if(view) {
lock_rw_unlock(&view->lock);
}
if(ret) {
/* If we're redirecting the original answer to a
* CNAME, record the CNAME rrset so the caller can take
* the appropriate action. Note that we don't check the
* action type; it should normally be 'redirect', but it
* can be of other type when a data-dependent tag action
* uses redirect response-ip data.
*/
if(redirect_rrset &&
redirect_rrset->rk.type == ntohs(LDNS_RR_TYPE_CNAME) &&
qinfo->qtype != LDNS_RR_TYPE_ANY)
*alias_rrset = redirect_rrset;
/* on success, populate respip result structure */
ret = populate_action_info(actinfo, action, raddr,
redirect_rrset, tag, ipset, search_only, region);
}
return ret;
}
static int
generate_cname_request(struct module_qstate* qstate,
struct ub_packed_rrset_key* alias_rrset)
{
struct module_qstate* subq = NULL;
struct query_info subqi;
memset(&subqi, 0, sizeof(subqi));
get_cname_target(alias_rrset, &subqi.qname, &subqi.qname_len);
if(!subqi.qname)
return 0; /* unexpected: not a valid CNAME RDATA */
subqi.qtype = qstate->qinfo.qtype;
subqi.qclass = qstate->qinfo.qclass;
fptr_ok(fptr_whitelist_modenv_attach_sub(qstate->env->attach_sub));
return (*qstate->env->attach_sub)(qstate, &subqi, BIT_RD, 0, 0, &subq);
}
void
respip_operate(struct module_qstate* qstate, enum module_ev event, int id,
struct outbound_entry* outbound)
{
struct respip_qstate* rq = (struct respip_qstate*)qstate->minfo[id];
log_query_info(VERB_QUERY, "respip operate: query", &qstate->qinfo);
(void)outbound;
if(event == module_event_new || event == module_event_pass) {
if(!rq) {
rq = regional_alloc_zero(qstate->region, sizeof(*rq));
if(!rq)
goto servfail;
rq->state = RESPIP_INIT;
qstate->minfo[id] = rq;
}
if(rq->state == RESPIP_SUBQUERY_FINISHED) {
qstate->ext_state[id] = module_finished;
return;
}
verbose(VERB_ALGO, "respip: pass to next module");
qstate->ext_state[id] = module_wait_module;
} else if(event == module_event_moddone) {
/* If the reply may be subject to response-ip rewriting
* according to the query type, check the actions. If a
* rewrite is necessary, we'll replace the reply in qstate
* with the new one. */
enum module_ext_state next_state = module_finished;
if((qstate->qinfo.qtype == LDNS_RR_TYPE_A ||
qstate->qinfo.qtype == LDNS_RR_TYPE_AAAA ||
qstate->qinfo.qtype == LDNS_RR_TYPE_ANY) &&
qstate->return_msg && qstate->return_msg->rep) {
struct respip_action_info actinfo = {respip_none, NULL};
struct reply_info* new_rep = qstate->return_msg->rep;
struct ub_packed_rrset_key* alias_rrset = NULL;
if(!respip_rewrite_reply(&qstate->qinfo,
qstate->client_info, qstate->return_msg->rep,
&new_rep, &actinfo, &alias_rrset, 0,
qstate->region)) {
goto servfail;
}
if(actinfo.action != respip_none) {
/* save action info for logging on a
* per-front-end-query basis */
if(!(qstate->respip_action_info =
regional_alloc_init(qstate->region,
&actinfo, sizeof(actinfo))))
{
log_err("out of memory");
goto servfail;
}
} else {
qstate->respip_action_info = NULL;
}
if (new_rep == qstate->return_msg->rep &&
(actinfo.action == respip_deny ||
actinfo.action == respip_inform_deny)) {
/* for deny-variant actions (unless response-ip
* data is applied), mark the query state so
* the response will be dropped for all
* clients. */
qstate->is_drop = 1;
} else if(alias_rrset) {
if(!generate_cname_request(qstate, alias_rrset))
goto servfail;
next_state = module_wait_subquery;
}
qstate->return_msg->rep = new_rep;
}
qstate->ext_state[id] = next_state;
} else
qstate->ext_state[id] = module_finished;
return;
servfail:
qstate->return_rcode = LDNS_RCODE_SERVFAIL;
qstate->return_msg = NULL;
}
int
respip_merge_cname(struct reply_info* base_rep,
const struct query_info* qinfo, const struct reply_info* tgt_rep,
const struct respip_client_info* cinfo, int must_validate,
struct reply_info** new_repp, struct regional* region)
{
struct reply_info* new_rep;
struct reply_info* tmp_rep = NULL; /* just a placeholder */
struct ub_packed_rrset_key* alias_rrset = NULL; /* ditto */
uint16_t tgt_rcode;
size_t i, j;
struct respip_action_info actinfo = {respip_none, NULL};
/* If the query for the CNAME target would result in an unusual rcode,
* we generally translate it as a failure for the base query
* (which would then be translated into SERVFAIL). The only exception
* is NXDOMAIN and YXDOMAIN, which are passed to the end client(s).
* The YXDOMAIN case would be rare but still possible (when
* DNSSEC-validated DNAME has been cached but synthesizing CNAME
* can't be generated due to length limitation) */
tgt_rcode = FLAGS_GET_RCODE(tgt_rep->flags);
if((tgt_rcode != LDNS_RCODE_NOERROR &&
tgt_rcode != LDNS_RCODE_NXDOMAIN &&
tgt_rcode != LDNS_RCODE_YXDOMAIN) ||
(must_validate && tgt_rep->security <= sec_status_bogus)) {
return 0;
}
/* see if the target reply would be subject to a response-ip action. */
if(!respip_rewrite_reply(qinfo, cinfo, tgt_rep, &tmp_rep, &actinfo,
&alias_rrset, 1, region))
return 0;
if(actinfo.action != respip_none) {
log_info("CNAME target of redirect response-ip action would "
"be subject to response-ip action, too; stripped");
*new_repp = base_rep;
return 1;
}
/* Append target reply to the base. Since we cannot assume
* tgt_rep->rrsets is valid throughout the lifetime of new_rep
* or it can be safely shared by multiple threads, we need to make a
* deep copy. */
new_rep = make_new_reply_info(base_rep, region,
base_rep->an_numrrsets + tgt_rep->an_numrrsets,
base_rep->an_numrrsets);
if(!new_rep)
return 0;
for(i=0,j=base_rep->an_numrrsets; i<tgt_rep->an_numrrsets; i++,j++) {
new_rep->rrsets[j] = copy_rrset(tgt_rep->rrsets[i], region);
if(!new_rep->rrsets[j])
return 0;
}
FLAGS_SET_RCODE(new_rep->flags, tgt_rcode);
*new_repp = new_rep;
return 1;
}
void
respip_inform_super(struct module_qstate* qstate, int id,
struct module_qstate* super)
{
struct respip_qstate* rq = (struct respip_qstate*)super->minfo[id];
struct reply_info* new_rep = NULL;
rq->state = RESPIP_SUBQUERY_FINISHED;
/* respip subquery should have always been created with a valid reply
* in super. */
log_assert(super->return_msg && super->return_msg->rep);
/* return_msg can be NULL when, e.g., the sub query resulted in
* SERVFAIL, in which case we regard it as a failure of the original
* query. Other checks are probably redundant, but we check them
* for safety. */
if(!qstate->return_msg || !qstate->return_msg->rep ||
qstate->return_rcode != LDNS_RCODE_NOERROR)
goto fail;
if(!respip_merge_cname(super->return_msg->rep, &qstate->qinfo,
qstate->return_msg->rep, super->client_info,
super->env->need_to_validate, &new_rep, super->region))
goto fail;
super->return_msg->rep = new_rep;
return;
fail:
super->return_rcode = LDNS_RCODE_SERVFAIL;
super->return_msg = NULL;
return;
}
void
respip_clear(struct module_qstate* qstate, int id)
{
qstate->minfo[id] = NULL;
}
size_t
respip_get_mem(struct module_env* env, int id)
{
(void)env;
(void)id;
return 0;
}
/**
* The response-ip function block
*/
static struct module_func_block respip_block = {
"respip",
&respip_init, &respip_deinit, &respip_operate, &respip_inform_super,
&respip_clear, &respip_get_mem
};
struct module_func_block*
respip_get_funcblock(void)
{
return &respip_block;
}
enum respip_action
resp_addr_get_action(const struct resp_addr* addr)
{
return addr ? addr->action : respip_none;
}
struct ub_packed_rrset_key*
resp_addr_get_rrset(struct resp_addr* addr)
{
return addr ? addr->data : NULL;
}
int
respip_set_is_empty(const struct respip_set* set)
{
return set ? set->ip_tree.count == 0 : 1;
}
void
respip_inform_print(struct respip_addr_info* respip_addr, uint8_t* qname,
uint16_t qtype, uint16_t qclass, struct local_rrset* local_alias,
struct comm_reply* repinfo)
{
char srcip[128], respip[128], txt[512];
unsigned port;
if(local_alias)
qname = local_alias->rrset->rk.dname;
port = (unsigned)((repinfo->addr.ss_family == AF_INET) ?
ntohs(((struct sockaddr_in*)&repinfo->addr)->sin_port) :
ntohs(((struct sockaddr_in6*)&repinfo->addr)->sin6_port));
addr_to_str(&repinfo->addr, repinfo->addrlen, srcip, sizeof(srcip));
addr_to_str(&respip_addr->addr, respip_addr->addrlen,
respip, sizeof(respip));
snprintf(txt, sizeof(txt), "%s/%d inform %s@%u", respip,
respip_addr->net, srcip, port);
log_nametypeclass(0, txt, qname, qtype, qclass);
}