contrib/unbound/services/rpz.c

   1 /*
   2  * services/rpz.c - rpz service
   3  *
   4  * Copyright (c) 2019, NLnet Labs. All rights reserved.
   5  *
   6  * This software is open source.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  *
  12  * Redistributions of source code must retain the above copyright notice,
  13  * this list of conditions and the following disclaimer.
  14  *
  15  * Redistributions in binary form must reproduce the above copyright notice,
  16  * this list of conditions and the following disclaimer in the documentation
  17  * and/or other materials provided with the distribution.
  18  *
  19  * Neither the name of the NLNET LABS nor the names of its contributors may
  20  * be used to endorse or promote products derived from this software without
  21  * specific prior written permission.
  22  *
  23  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  24  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  25  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  26  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  27  * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  28  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
  29  * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
  30  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
  31  * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
  32  * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
  33  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  34  */
  35
  36 /**
  37  * \file
  38  *
  39  * This file contains functions to enable RPZ service.
  40  */
  41
  42 #include "config.h"
  43 #include "services/rpz.h"
  44 #include "util/config_file.h"
  45 #include "sldns/wire2str.h"
  46 #include "sldns/str2wire.h"
  47 #include "util/data/dname.h"
  48 #include "util/net_help.h"
  49 #include "util/log.h"
  50 #include "util/data/dname.h"
  51 #include "util/locks.h"
  52 #include "util/regional.h"
  53
  54 /** string for RPZ action enum */
  55 const char*
  56 rpz_action_to_string(enum rpz_action a)
  57 {
  58         switch(a) {
  59         case RPZ_NXDOMAIN_ACTION:       return "nxdomain";
  60         case RPZ_NODATA_ACTION:         return "nodata";
  61         case RPZ_PASSTHRU_ACTION:       return "passthru";
  62         case RPZ_DROP_ACTION:           return "drop";
  63         case RPZ_TCP_ONLY_ACTION:       return "tcp_only";
  64         case RPZ_INVALID_ACTION:        return "invalid";
  65         case RPZ_LOCAL_DATA_ACTION:     return "local_data";
  66         case RPZ_DISABLED_ACTION:       return "disabled";
  67         case RPZ_CNAME_OVERRIDE_ACTION: return "cname_override";
  68         case RPZ_NO_OVERRIDE_ACTION:    return "no_override";
  69         }
  70         return "unknown";
  71 }
  72
  73 /** RPZ action enum for config string */
  74 static enum rpz_action
  75 rpz_config_to_action(char* a)
  76 {
  77         if(strcmp(a, "nxdomain") == 0)
  78                 return RPZ_NXDOMAIN_ACTION;
  79         else if(strcmp(a, "nodata") == 0)
  80                 return RPZ_NODATA_ACTION;
  81         else if(strcmp(a, "passthru") == 0)
  82                 return RPZ_PASSTHRU_ACTION;
  83         else if(strcmp(a, "drop") == 0)
  84                 return RPZ_DROP_ACTION;
  85         else if(strcmp(a, "tcp_only") == 0)
  86                 return RPZ_TCP_ONLY_ACTION;
  87         else if(strcmp(a, "cname") == 0)
  88                 return RPZ_CNAME_OVERRIDE_ACTION;
  89         else if(strcmp(a, "disabled") == 0)
  90                 return RPZ_DISABLED_ACTION;
  91         return RPZ_INVALID_ACTION;
  92 }
  93
  94 /** string for RPZ trigger enum */
  95 static const char*
  96 rpz_trigger_to_string(enum rpz_trigger r)
  97 {
  98         switch(r) {
  99         case RPZ_QNAME_TRIGGER:         return "qname";
 100         case RPZ_CLIENT_IP_TRIGGER:     return "client_ip";
 101         case RPZ_RESPONSE_IP_TRIGGER:   return "response_ip";
 102         case RPZ_NSDNAME_TRIGGER:       return "nsdname";
 103         case RPZ_NSIP_TRIGGER:          return "nsip";
 104         case RPZ_INVALID_TRIGGER:       return "invalid";
 105         }
 106         return "unknown";
 107 }
 108
 109 /**
 110  * Get the label that is just before the root label.
 111  * @param dname: dname to work on
 112  * @param maxdnamelen: maximum length of the dname
 113  * @return: pointer to TLD label, NULL if not found or invalid dname
 114  */
 115 static uint8_t*
 116 get_tld_label(uint8_t* dname, size_t maxdnamelen)
 117 {
 118         uint8_t* prevlab = dname;
 119         size_t dnamelen = 0;
 120
 121         /* one byte needed for label length */
 122         if(dnamelen+1 > maxdnamelen)
 123                 return NULL;
 124
 125         /* only root label */
 126         if(*dname == 0)
 127                 return NULL;
 128
 129         while(*dname) {
 130                 dnamelen += ((size_t)*dname)+1;
 131                 if(dnamelen+1 > maxdnamelen)
 132                         return NULL;
 133                 dname = dname+((size_t)*dname)+1;
 134                 if(*dname != 0)
 135                         prevlab = dname;
 136         }
 137         return prevlab;
 138 }
 139
 140 /**
 141  * Classify RPZ action for RR type/rdata
 142  * @param rr_type: the RR type
 143  * @param rdatawl: RDATA with 2 bytes length
 144  * @param rdatalen: the length of rdatawl (including its 2 bytes length)
 145  * @return: the RPZ action
 146  */
 147 static enum rpz_action
 148 rpz_rr_to_action(uint16_t rr_type, uint8_t* rdatawl, size_t rdatalen)
 149 {
 150         char* endptr;
 151         uint8_t* rdata;
 152         int rdatalabs;
 153         uint8_t* tldlab = NULL;
 154
 155         switch(rr_type) {
 156                 case LDNS_RR_TYPE_SOA:
 157                 case LDNS_RR_TYPE_NS:
 158                 case LDNS_RR_TYPE_DNAME:
 159                 /* all DNSSEC-related RRs must be ignored */
 160                 case LDNS_RR_TYPE_DNSKEY:
 161                 case LDNS_RR_TYPE_DS:
 162                 case LDNS_RR_TYPE_RRSIG:
 163                 case LDNS_RR_TYPE_NSEC:
 164                 case LDNS_RR_TYPE_NSEC3:
 165                         return RPZ_INVALID_ACTION;
 166                 case LDNS_RR_TYPE_CNAME:
 167                         break;
 168                 default:
 169                         return RPZ_LOCAL_DATA_ACTION;
 170         }
 171
 172         /* use CNAME target to determine RPZ action */
 173         log_assert(rr_type == LDNS_RR_TYPE_CNAME);
 174         if(rdatalen < 3)
 175                 return RPZ_INVALID_ACTION;
 176
 177         rdata = rdatawl + 2; /* 2 bytes of rdata length */
 178         if(dname_valid(rdata, rdatalen-2) != rdatalen-2)
 179                 return RPZ_INVALID_ACTION;
 180
 181         rdatalabs = dname_count_labels(rdata);
 182         if(rdatalabs == 1)
 183                 return RPZ_NXDOMAIN_ACTION;
 184         else if(rdatalabs == 2) {
 185                 if(dname_subdomain_c(rdata, (uint8_t*)&"\001*\000"))
 186                         return RPZ_NODATA_ACTION;
 187                 else if(dname_subdomain_c(rdata,
 188                         (uint8_t*)&"\014rpz-passthru\000"))
 189                         return RPZ_PASSTHRU_ACTION;
 190                 else if(dname_subdomain_c(rdata, (uint8_t*)&"\010rpz-drop\000"))
 191                         return RPZ_DROP_ACTION;
 192                 else if(dname_subdomain_c(rdata,
 193                         (uint8_t*)&"\014rpz-tcp-only\000"))
 194                         return RPZ_TCP_ONLY_ACTION;
 195         }
 196
 197         /* all other TLDs starting with "rpz-" are invalid */
 198         tldlab = get_tld_label(rdata, rdatalen-2);
 199         if(tldlab && dname_lab_startswith(tldlab, "rpz-", &endptr))
 200                 return RPZ_INVALID_ACTION;
 201
 202         /* no special label found */
 203         return RPZ_LOCAL_DATA_ACTION;
 204 }
 205
 206 static enum localzone_type
 207 rpz_action_to_localzone_type(enum rpz_action a)
 208 {
 209         switch(a) {
 210         case RPZ_NXDOMAIN_ACTION:       return local_zone_always_nxdomain;
 211         case RPZ_NODATA_ACTION:         return local_zone_always_nodata;
 212         case RPZ_DROP_ACTION:           return local_zone_always_deny;
 213         case RPZ_PASSTHRU_ACTION:       return local_zone_always_transparent;
 214         case RPZ_LOCAL_DATA_ACTION:     /* fallthrough */
 215         case RPZ_CNAME_OVERRIDE_ACTION: return local_zone_redirect;
 216         case RPZ_INVALID_ACTION:        /* fallthrough */
 217         case RPZ_TCP_ONLY_ACTION:       /* fallthrough */
 218         default:                        return local_zone_invalid;
 219         }
 220 }
 221
 222 enum respip_action
 223 rpz_action_to_respip_action(enum rpz_action a)
 224 {
 225         switch(a) {
 226         case RPZ_NXDOMAIN_ACTION:       return respip_always_nxdomain;
 227         case RPZ_NODATA_ACTION:         return respip_always_nodata;
 228         case RPZ_DROP_ACTION:           return respip_always_deny;
 229         case RPZ_PASSTHRU_ACTION:       return respip_always_transparent;
 230         case RPZ_LOCAL_DATA_ACTION:     /* fallthrough */
 231         case RPZ_CNAME_OVERRIDE_ACTION: return respip_redirect;
 232         case RPZ_INVALID_ACTION:        /* fallthrough */
 233         case RPZ_TCP_ONLY_ACTION:       /* fallthrough */
 234         default:                        return respip_invalid;
 235         }
 236 }
 237
 238 static enum rpz_action
 239 localzone_type_to_rpz_action(enum localzone_type lzt)
 240 {
 241         switch(lzt) {
 242         case local_zone_always_nxdomain:        return RPZ_NXDOMAIN_ACTION;
 243         case local_zone_always_nodata:          return RPZ_NODATA_ACTION;
 244         case local_zone_always_deny:            return RPZ_DROP_ACTION;
 245         case local_zone_always_transparent:     return RPZ_PASSTHRU_ACTION;
 246         case local_zone_redirect:               return RPZ_LOCAL_DATA_ACTION;
 247         case local_zone_invalid:
 248         default:
 249                 return RPZ_INVALID_ACTION;
 250         }
 251 }
 252
 253 enum rpz_action
 254 respip_action_to_rpz_action(enum respip_action a)
 255 {
 256         switch(a) {
 257         case respip_always_nxdomain:    return RPZ_NXDOMAIN_ACTION;
 258         case respip_always_nodata:      return RPZ_NODATA_ACTION;
 259         case respip_always_deny:        return RPZ_DROP_ACTION;
 260         case respip_always_transparent: return RPZ_PASSTHRU_ACTION;
 261         case respip_redirect:           return RPZ_LOCAL_DATA_ACTION;
 262         case respip_invalid:
 263         default:
 264                 return RPZ_INVALID_ACTION;
 265         }
 266 }
 267
 268 /**
 269  * Get RPZ trigger for dname
 270  * @param dname: dname containing RPZ trigger
 271  * @param dname_len: length of the dname
 272  * @return: RPZ trigger enum
 273  */
 274 static enum rpz_trigger
 275 rpz_dname_to_trigger(uint8_t* dname, size_t dname_len)
 276 {
 277         uint8_t* tldlab;
 278         char* endptr;
 279
 280         if(dname_valid(dname, dname_len) != dname_len)
 281                 return RPZ_INVALID_TRIGGER;
 282
 283         tldlab = get_tld_label(dname, dname_len);
 284         if(!tldlab || !dname_lab_startswith(tldlab, "rpz-", &endptr))
 285                 return RPZ_QNAME_TRIGGER;
 286
 287         if(dname_subdomain_c(tldlab,
 288                 (uint8_t*)&"\015rpz-client-ip\000"))
 289                 return RPZ_CLIENT_IP_TRIGGER;
 290         else if(dname_subdomain_c(tldlab, (uint8_t*)&"\006rpz-ip\000"))
 291                 return RPZ_RESPONSE_IP_TRIGGER;
 292         else if(dname_subdomain_c(tldlab, (uint8_t*)&"\013rpz-nsdname\000"))
 293                 return RPZ_NSDNAME_TRIGGER;
 294         else if(dname_subdomain_c(tldlab, (uint8_t*)&"\010rpz-nsip\000"))
 295                 return RPZ_NSIP_TRIGGER;
 296
 297         return RPZ_QNAME_TRIGGER;
 298 }
 299
 300 void rpz_delete(struct rpz* r)
 301 {
 302         if(!r)
 303                 return;
 304         local_zones_delete(r->local_zones);
 305         respip_set_delete(r->respip_set);
 306         regional_destroy(r->region);
 307         free(r->taglist);
 308         free(r->log_name);
 309         free(r);
 310 }
 311
 312 int
 313 rpz_clear(struct rpz* r)
 314 {
 315         /* must hold write lock on auth_zone */
 316         local_zones_delete(r->local_zones);
 317         respip_set_delete(r->respip_set);
 318         if(!(r->local_zones = local_zones_create())){
 319                 return 0;
 320         }
 321         if(!(r->respip_set = respip_set_create())) {
 322                 return 0;
 323         }
 324         return 1;
 325 }
 326
 327 void
 328 rpz_finish_config(struct rpz* r)
 329 {
 330         lock_rw_wrlock(&r->respip_set->lock);
 331         addr_tree_init_parents(&r->respip_set->ip_tree);
 332         lock_rw_unlock(&r->respip_set->lock);
 333 }
 334
 335 /** new rrset containing CNAME override, does not yet contain a dname */
 336 static struct ub_packed_rrset_key*
 337 new_cname_override(struct regional* region, uint8_t* ct, size_t ctlen)
 338 {
 339         struct ub_packed_rrset_key* rrset;
 340         struct packed_rrset_data* pd;
 341         uint16_t rdlength = htons(ctlen);
 342         rrset = (struct ub_packed_rrset_key*)regional_alloc_zero(region,
 343                 sizeof(*rrset));
 344         if(!rrset) {
 345                 log_err("out of memory");
 346                 return NULL;
 347         }
 348         rrset->entry.key = rrset;
 349         pd = (struct packed_rrset_data*)regional_alloc_zero(region, sizeof(*pd));
 350         if(!pd) {
 351                 log_err("out of memory");
 352                 return NULL;
 353         }
 354         pd->trust = rrset_trust_prim_noglue;
 355         pd->security = sec_status_insecure;
 356
 357         pd->count = 1;
 358         pd->rr_len = regional_alloc_zero(region, sizeof(*pd->rr_len));
 359         pd->rr_ttl = regional_alloc_zero(region, sizeof(*pd->rr_ttl));
 360         pd->rr_data = regional_alloc_zero(region, sizeof(*pd->rr_data));
 361         if(!pd->rr_len || !pd->rr_ttl || !pd->rr_data) {
 362                 log_err("out of memory");
 363                 return NULL;
 364         }
 365         pd->rr_len[0] = ctlen+2;
 366         pd->rr_ttl[0] = 3600;
 367         pd->rr_data[0] = regional_alloc_zero(region, 2 /* rdlength */ + ctlen);
 368         if(!pd->rr_data[0]) {
 369                 log_err("out of memory");
 370                 return NULL;
 371         }
 372         memmove(pd->rr_data[0], &rdlength, 2);
 373         memmove(pd->rr_data[0]+2, ct, ctlen);
 374
 375         rrset->entry.data = pd;
 376         rrset->rk.type = htons(LDNS_RR_TYPE_CNAME);
 377         rrset->rk.rrset_class = htons(LDNS_RR_CLASS_IN);
 378         return rrset;
 379 }
 380
 381 struct rpz*
 382 rpz_create(struct config_auth* p)
 383 {
 384         struct rpz* r = calloc(1, sizeof(*r));
 385         if(!r)
 386                 goto err;
 387
 388         r->region = regional_create_custom(sizeof(struct regional));
 389         if(!r->region) {
 390                 goto err;
 391         }
 392
 393         if(!(r->local_zones = local_zones_create())){
 394                 goto err;
 395         }
 396         if(!(r->respip_set = respip_set_create())) {
 397                 goto err;
 398         }
 399         r->taglistlen = p->rpz_taglistlen;
 400         r->taglist = memdup(p->rpz_taglist, r->taglistlen);
 401         if(p->rpz_action_override) {
 402                 r->action_override = rpz_config_to_action(p->rpz_action_override);
 403         }
 404         else
 405                 r->action_override = RPZ_NO_OVERRIDE_ACTION;
 406
 407         if(r->action_override == RPZ_CNAME_OVERRIDE_ACTION) {
 408                 uint8_t nm[LDNS_MAX_DOMAINLEN+1];
 409                 size_t nmlen = sizeof(nm);
 410
 411                 if(!p->rpz_cname) {
 412                         log_err("RPZ override with cname action found, but no "
 413                                 "rpz-cname-override configured");
 414                         goto err;
 415                 }
 416
 417                 if(sldns_str2wire_dname_buf(p->rpz_cname, nm, &nmlen) != 0) {
 418                         log_err("cannot parse RPZ cname override: %s",
 419                                 p->rpz_cname);
 420                         goto err;
 421                 }
 422                 r->cname_override = new_cname_override(r->region, nm, nmlen);
 423                 if(!r->cname_override) {
 424                         goto err;
 425                 }
 426         }
 427         r->log = p->rpz_log;
 428         if(p->rpz_log_name) {
 429                 if(!(r->log_name = strdup(p->rpz_log_name))) {
 430                         log_err("malloc failure on RPZ log_name strdup");
 431                         goto err;
 432                 }
 433         }
 434         return r;
 435 err:
 436         if(r) {
 437                 if(r->local_zones)
 438                         local_zones_delete(r->local_zones);
 439                 if(r->respip_set)
 440                         respip_set_delete(r->respip_set);
 441                 if(r->taglist)
 442                         free(r->taglist);
 443                 free(r);
 444         }
 445         return NULL;
 446 }
 447
 448 /**
 449  * Remove RPZ zone name from dname
 450  * Copy dname to newdname, without the originlen number of trailing bytes
 451  */
 452 static size_t
 453 strip_dname_origin(uint8_t* dname, size_t dnamelen, size_t originlen,
 454         uint8_t* newdname, size_t maxnewdnamelen)
 455 {
 456         size_t newdnamelen;
 457         if(dnamelen < originlen)
 458                 return 0;
 459         newdnamelen = dnamelen - originlen;
 460         if(newdnamelen+1 > maxnewdnamelen)
 461                 return 0;
 462         memmove(newdname, dname, newdnamelen);
 463         newdname[newdnamelen] = 0;
 464         return newdnamelen + 1; /* + 1 for root label */
 465 }
 466
 467 /** Insert RR into RPZ's local-zone */
 468 static void
 469 rpz_insert_qname_trigger(struct rpz* r, uint8_t* dname, size_t dnamelen,
 470         enum rpz_action a, uint16_t rrtype, uint16_t rrclass, uint32_t ttl,
 471         uint8_t* rdata, size_t rdata_len, uint8_t* rr, size_t rr_len)
 472 {
 473         struct local_zone* z;
 474         enum localzone_type tp = local_zone_always_transparent;
 475         int dnamelabs = dname_count_labels(dname);
 476         char* rrstr;
 477         int newzone = 0;
 478
 479         if(a == RPZ_TCP_ONLY_ACTION || a == RPZ_INVALID_ACTION) {
 480                 verbose(VERB_ALGO, "RPZ: skipping unsupported action: %s",
 481                         rpz_action_to_string(a));
 482                 free(dname);
 483                 return;
 484         }
 485
 486         lock_rw_wrlock(&r->local_zones->lock);
 487         /* exact match */
 488         z = local_zones_find(r->local_zones, dname, dnamelen, dnamelabs,
 489                 LDNS_RR_CLASS_IN);
 490         if(z && a != RPZ_LOCAL_DATA_ACTION) {
 491                 rrstr = sldns_wire2str_rr(rr, rr_len);
 492                 if(!rrstr) {
 493                         log_err("malloc error while inserting RPZ qname "
 494                                 "trigger");
 495                         free(dname);
 496                         lock_rw_unlock(&r->local_zones->lock);
 497                         return;
 498                 }
 499                 verbose(VERB_ALGO, "RPZ: skipping duplicate record: '%s'",
 500                         rrstr);
 501                 free(rrstr);
 502                 free(dname);
 503                 lock_rw_unlock(&r->local_zones->lock);
 504                 return;
 505         }
 506         if(!z) {
 507                 tp = rpz_action_to_localzone_type(a);
 508                 if(!(z = local_zones_add_zone(r->local_zones, dname, dnamelen,
 509                         dnamelabs, rrclass, tp))) {
 510                         log_warn("RPZ create failed");
 511                         lock_rw_unlock(&r->local_zones->lock);
 512                         /* dname will be free'd in failed local_zone_create() */
 513                         return;
 514                 }
 515                 newzone = 1;
 516         }
 517         if(a == RPZ_LOCAL_DATA_ACTION) {
 518                 rrstr = sldns_wire2str_rr(rr, rr_len);
 519                 if(!rrstr) {
 520                         log_err("malloc error while inserting RPZ qname "
 521                                 "trigger");
 522                         free(dname);
 523                         lock_rw_unlock(&r->local_zones->lock);
 524                         return;
 525                 }
 526                 lock_rw_wrlock(&z->lock);
 527                 local_zone_enter_rr(z, dname, dnamelen, dnamelabs,
 528                         rrtype, rrclass, ttl, rdata, rdata_len, rrstr);
 529                 lock_rw_unlock(&z->lock);
 530                 free(rrstr);
 531         }
 532         if(!newzone)
 533                 free(dname);
 534         lock_rw_unlock(&r->local_zones->lock);
 535         return;
 536 }
 537
 538 /** Insert RR into RPZ's respip_set */
 539 static int
 540 rpz_insert_response_ip_trigger(struct rpz* r, uint8_t* dname, size_t dnamelen,
 541         enum rpz_action a, uint16_t rrtype, uint16_t rrclass, uint32_t ttl,
 542         uint8_t* rdata, size_t rdata_len, uint8_t* rr, size_t rr_len)
 543 {
 544         struct resp_addr* node;
 545         struct sockaddr_storage addr;
 546         socklen_t addrlen;
 547         int net, af;
 548         char* rrstr;
 549         enum respip_action respa = rpz_action_to_respip_action(a);
 550
 551         if(a == RPZ_TCP_ONLY_ACTION || a == RPZ_INVALID_ACTION ||
 552                 respa == respip_invalid) {
 553                 verbose(VERB_ALGO, "RPZ: skipping unsupported action: %s",
 554                         rpz_action_to_string(a));
 555                 return 0;
 556         }
 557
 558         if(!netblockdnametoaddr(dname, dnamelen, &addr, &addrlen, &net, &af))
 559                 return 0;
 560
 561         lock_rw_wrlock(&r->respip_set->lock);
 562         rrstr = sldns_wire2str_rr(rr, rr_len);
 563         if(!rrstr) {
 564                 log_err("malloc error while inserting RPZ respip trigger");
 565                 lock_rw_unlock(&r->respip_set->lock);
 566                 return 0;
 567         }
 568         if(!(node=respip_sockaddr_find_or_create(r->respip_set, &addr, addrlen,
 569                 net, 1, rrstr))) {
 570                 lock_rw_unlock(&r->respip_set->lock);
 571                 free(rrstr);
 572                 return 0;
 573         }
 574
 575         lock_rw_wrlock(&node->lock);
 576         lock_rw_unlock(&r->respip_set->lock);
 577         node->action = respa;
 578
 579         if(a == RPZ_LOCAL_DATA_ACTION) {
 580                 respip_enter_rr(r->respip_set->region, node, rrtype,
 581                         rrclass, ttl, rdata, rdata_len, rrstr, "");
 582         }
 583         lock_rw_unlock(&node->lock);
 584         free(rrstr);
 585         return 1;
 586 }
 587
 588 int
 589 rpz_insert_rr(struct rpz* r, uint8_t* azname, size_t aznamelen, uint8_t* dname,
 590         size_t dnamelen, uint16_t rr_type, uint16_t rr_class, uint32_t rr_ttl,
 591         uint8_t* rdatawl, size_t rdatalen, uint8_t* rr, size_t rr_len)
 592 {
 593         size_t policydnamelen;
 594         /* name is free'd in local_zone delete */
 595         enum rpz_trigger t;
 596         enum rpz_action a;
 597         uint8_t* policydname;
 598
 599         if(!dname_subdomain_c(dname, azname)) {
 600                 log_err("RPZ: name of record to insert into RPZ is not a "
 601                         "subdomain of the configured name of the RPZ zone");
 602                 return 0;
 603         }
 604
 605         log_assert(dnamelen >= aznamelen);
 606         if(!(policydname = calloc(1, (dnamelen-aznamelen)+1))) {
 607                 log_err("malloc error while inserting RPZ RR");
 608                 return 0;
 609         }
 610
 611         a = rpz_rr_to_action(rr_type, rdatawl, rdatalen);
 612         if(!(policydnamelen = strip_dname_origin(dname, dnamelen, aznamelen,
 613                 policydname, (dnamelen-aznamelen)+1))) {
 614                 free(policydname);
 615                 return 0;
 616         }
 617         t = rpz_dname_to_trigger(policydname, policydnamelen);
 618         if(t == RPZ_INVALID_TRIGGER) {
 619                 free(policydname);
 620                 verbose(VERB_ALGO, "RPZ: skipping invalid trigger");
 621                 return 1;
 622         }
 623         if(t == RPZ_QNAME_TRIGGER) {
 624                 rpz_insert_qname_trigger(r, policydname, policydnamelen,
 625                         a, rr_type, rr_class, rr_ttl, rdatawl, rdatalen, rr,
 626                         rr_len);
 627         }
 628         else if(t == RPZ_RESPONSE_IP_TRIGGER) {
 629                 rpz_insert_response_ip_trigger(r, policydname, policydnamelen,
 630                         a, rr_type, rr_class, rr_ttl, rdatawl, rdatalen, rr,
 631                         rr_len);
 632                 free(policydname);
 633         }
 634         else {
 635                 free(policydname);
 636                 verbose(VERB_ALGO, "RPZ: skipping unsupported trigger: %s",
 637                         rpz_trigger_to_string(t));
 638         }
 639         return 1;
 640 }
 641
 642 /**
 643  * Find RPZ local-zone by qname.
 644  * @param r: rpz containing local-zone tree
 645  * @param qname: qname
 646  * @param qname_len: length of qname
 647  * @param qclass: qclass
 648  * @param only_exact: if 1 only excact (non wildcard) matches are returned
 649  * @param wr: get write lock for local-zone if 1, read lock if 0
 650  * @param zones_keep_lock: if set do not release the r->local_zones lock, this
 651  *        makes the caller of this function responsible for releasing the lock.
 652  * @return: NULL or local-zone holding rd or wr lock
 653  */
 654 static struct local_zone*
 655 rpz_find_zone(struct rpz* r, uint8_t* qname, size_t qname_len, uint16_t qclass,
 656         int only_exact, int wr, int zones_keep_lock)
 657 {
 658         uint8_t* ce;
 659         size_t ce_len, ce_labs;
 660         uint8_t wc[LDNS_MAX_DOMAINLEN+1];
 661         int exact;
 662         struct local_zone* z = NULL;
 663         if(wr) {
 664                 lock_rw_wrlock(&r->local_zones->lock);
 665         } else {
 666                 lock_rw_rdlock(&r->local_zones->lock);
 667         }
 668         z = local_zones_find_le(r->local_zones, qname, qname_len,
 669                 dname_count_labels(qname),
 670                 LDNS_RR_CLASS_IN, &exact);
 671         if(!z || (only_exact && !exact)) {
 672                 lock_rw_unlock(&r->local_zones->lock);
 673                 return NULL;
 674         }
 675         if(wr) {
 676                 lock_rw_wrlock(&z->lock);
 677         } else {
 678                 lock_rw_rdlock(&z->lock);
 679         }
 680         if(!zones_keep_lock) {
 681                 lock_rw_unlock(&r->local_zones->lock);
 682         }
 683
 684         if(exact)
 685                 return z;
 686
 687         /* No exact match found, lookup wildcard. closest encloser must
 688          * be the shared parent between the qname and the best local
 689          * zone match, append '*' to that and do another lookup. */
 690
 691         ce = dname_get_shared_topdomain(z->name, qname);
 692         if(!ce /* should not happen */ || !*ce /* root */) {
 693                 lock_rw_unlock(&z->lock);
 694                 if(zones_keep_lock) {
 695                         lock_rw_unlock(&r->local_zones->lock);
 696                 }
 697                 return NULL;
 698         }
 699         ce_labs = dname_count_size_labels(ce, &ce_len);
 700         if(ce_len+2 > sizeof(wc)) {
 701                 lock_rw_unlock(&z->lock);
 702                 if(zones_keep_lock) {
 703                         lock_rw_unlock(&r->local_zones->lock);
 704                 }
 705                 return NULL;
 706         }
 707         wc[0] = 1; /* length of wildcard label */
 708         wc[1] = (uint8_t)'*'; /* wildcard label */
 709         memmove(wc+2, ce, ce_len);
 710         lock_rw_unlock(&z->lock);
 711
 712         if(!zones_keep_lock) {
 713                 if(wr) {
 714                         lock_rw_wrlock(&r->local_zones->lock);
 715                 } else {
 716                         lock_rw_rdlock(&r->local_zones->lock);
 717                 }
 718         }
 719         z = local_zones_find_le(r->local_zones, wc,
 720                 ce_len+2, ce_labs+1, qclass, &exact);
 721         if(!z || !exact) {
 722                 lock_rw_unlock(&r->local_zones->lock);
 723                 return NULL;
 724         }
 725         if(wr) {
 726                 lock_rw_wrlock(&z->lock);
 727         } else {
 728                 lock_rw_rdlock(&z->lock);
 729         }
 730         if(!zones_keep_lock) {
 731                 lock_rw_unlock(&r->local_zones->lock);
 732         }
 733         return z;
 734 }
 735
 736 /**
 737  * Remove RR from RPZ's local-data
 738  * @param z: local-zone for RPZ, holding write lock
 739  * @param policydname: dname of RR to remove
 740  * @param policydnamelen: lenth of policydname
 741  * @param rr_type: RR type of RR to remove
 742  * @param rdata: rdata of RR to remove
 743  * @param rdatalen: length of rdata
 744  * @return: 1 if zone must be removed after RR deletion
 745  */
 746 static int
 747 rpz_data_delete_rr(struct local_zone* z, uint8_t* policydname,
 748         size_t policydnamelen, uint16_t rr_type, uint8_t* rdata,
 749         size_t rdatalen)
 750 {
 751         struct local_data* ld;
 752         struct packed_rrset_data* d;
 753         size_t index;
 754         ld = local_zone_find_data(z, policydname, policydnamelen,
 755                 dname_count_labels(policydname));
 756         if(ld) {
 757                 struct local_rrset* prev=NULL, *p=ld->rrsets;
 758                 while(p && ntohs(p->rrset->rk.type) != rr_type) {
 759                         prev = p;
 760                         p = p->next;
 761                 }
 762                 if(!p)
 763                         return 0;
 764                 d = (struct packed_rrset_data*)p->rrset->entry.data;
 765                 if(packed_rrset_find_rr(d, rdata, rdatalen, &index)) {
 766                         if(d->count == 1) {
 767                                 /* no memory recycling for zone deletions ... */
 768                                 if(prev) prev->next = p->next;
 769                                 else ld->rrsets = p->next;
 770                         }
 771                         if(d->count > 1) {
 772                                 if(!local_rrset_remove_rr(d, index))
 773                                         return 0;
 774                         }
 775                 }
 776         }
 777         if(ld && ld->rrsets)
 778                 return 0;
 779         return 1;
 780 }
 781
 782 /**
 783  * Remove RR from RPZ's respip set
 784  * @param raddr: respip node
 785  * @param rr_type: RR type of RR to remove
 786  * @param rdata: rdata of RR to remove
 787  * @param rdatalen: length of rdata
 788  * @return: 1 if zone must be removed after RR deletion
 789  */
 790 static int
 791 rpz_rrset_delete_rr(struct resp_addr* raddr, uint16_t rr_type, uint8_t* rdata,
 792         size_t rdatalen)
 793 {
 794         size_t index;
 795         struct packed_rrset_data* d;
 796         if(!raddr->data)
 797                 return 1;
 798         d = raddr->data->entry.data;
 799         if(ntohs(raddr->data->rk.type) != rr_type) {
 800                 return 0;
 801         }
 802         if(packed_rrset_find_rr(d, rdata, rdatalen, &index)) {
 803                 if(d->count == 1) {
 804                         /* regional alloc'd */
 805                         raddr->data->entry.data = NULL;
 806                         raddr->data = NULL;
 807                         return 1;
 808                 }
 809                 if(d->count > 1) {
 810                         if(!local_rrset_remove_rr(d, index))
 811                                 return 0;
 812                 }
 813         }
 814         return 0;
 815
 816 }
 817
 818 /** Remove RR from RPZ's local-zone */
 819 static void
 820 rpz_remove_qname_trigger(struct rpz* r, uint8_t* dname, size_t dnamelen,
 821         enum rpz_action a, uint16_t rr_type, uint16_t rr_class,
 822         uint8_t* rdatawl, size_t rdatalen)
 823 {
 824         struct local_zone* z;
 825         int delete_zone = 1;
 826         z = rpz_find_zone(r, dname, dnamelen, rr_class,
 827                 1 /* only exact */, 1 /* wr lock */, 1 /* keep lock*/);
 828         if(!z) {
 829                 verbose(VERB_ALGO, "RPZ: cannot remove RR from IXFR, "
 830                         "RPZ domain not found");
 831                 return;
 832         }
 833         if(a == RPZ_LOCAL_DATA_ACTION)
 834                 delete_zone = rpz_data_delete_rr(z, dname,
 835                         dnamelen, rr_type, rdatawl, rdatalen);
 836         else if(a != localzone_type_to_rpz_action(z->type)) {
 837                 lock_rw_unlock(&z->lock);
 838                 lock_rw_unlock(&r->local_zones->lock);
 839                 return;
 840         }
 841         lock_rw_unlock(&z->lock);
 842         if(delete_zone) {
 843                 local_zones_del_zone(r->local_zones, z);
 844         }
 845         lock_rw_unlock(&r->local_zones->lock);
 846         return;
 847 }
 848
 849 static void
 850 rpz_remove_response_ip_trigger(struct rpz* r, uint8_t* dname, size_t dnamelen,
 851         enum rpz_action a, uint16_t rr_type, uint8_t* rdatawl, size_t rdatalen)
 852 {
 853         struct resp_addr* node;
 854         struct sockaddr_storage addr;
 855         socklen_t addrlen;
 856         int net, af;
 857         int delete_respip = 1;
 858
 859         if(!netblockdnametoaddr(dname, dnamelen, &addr, &addrlen, &net, &af))
 860                 return;
 861
 862         lock_rw_wrlock(&r->respip_set->lock);
 863         if(!(node = (struct resp_addr*)addr_tree_find(
 864                 &r->respip_set->ip_tree, &addr, addrlen, net))) {
 865                 verbose(VERB_ALGO, "RPZ: cannot remove RR from IXFR, "
 866                         "RPZ domain not found");
 867                 lock_rw_unlock(&r->respip_set->lock);
 868                 return;
 869         }
 870
 871         lock_rw_wrlock(&node->lock);
 872         if(a == RPZ_LOCAL_DATA_ACTION) {
 873                 /* remove RR, signal whether RR can be removed */
 874                 delete_respip = rpz_rrset_delete_rr(node, rr_type, rdatawl,
 875                         rdatalen);
 876         }
 877         lock_rw_unlock(&node->lock);
 878         if(delete_respip)
 879                 respip_sockaddr_delete(r->respip_set, node);
 880         lock_rw_unlock(&r->respip_set->lock);
 881 }
 882
 883 void
 884 rpz_remove_rr(struct rpz* r, size_t aznamelen, uint8_t* dname, size_t dnamelen,
 885         uint16_t rr_type, uint16_t rr_class, uint8_t* rdatawl, size_t rdatalen)
 886 {
 887         size_t policydnamelen;
 888         enum rpz_trigger t;
 889         enum rpz_action a;
 890         uint8_t* policydname;
 891
 892         if(!(policydname = calloc(1, LDNS_MAX_DOMAINLEN + 1)))
 893                 return;
 894
 895         a = rpz_rr_to_action(rr_type, rdatawl, rdatalen);
 896         if(a == RPZ_INVALID_ACTION) {
 897                 free(policydname);
 898                 return;
 899         }
 900         if(!(policydnamelen = strip_dname_origin(dname, dnamelen, aznamelen,
 901                 policydname, LDNS_MAX_DOMAINLEN + 1))) {
 902                 free(policydname);
 903                 return;
 904         }
 905         t = rpz_dname_to_trigger(policydname, policydnamelen);
 906         if(t == RPZ_QNAME_TRIGGER) {
 907                 rpz_remove_qname_trigger(r, policydname, policydnamelen, a,
 908                         rr_type, rr_class, rdatawl, rdatalen);
 909         } else if(t == RPZ_RESPONSE_IP_TRIGGER) {
 910                 rpz_remove_response_ip_trigger(r, policydname, policydnamelen,
 911                         a, rr_type, rdatawl, rdatalen);
 912         }
 913         free(policydname);
 914 }
 915
 916 /** print log information for an applied RPZ policy. Based on local-zone's
 917  * lz_inform_print().
 918  */
 919 static void
 920 log_rpz_apply(uint8_t* dname, enum rpz_action a, struct query_info* qinfo,
 921         struct comm_reply* repinfo, char* log_name)
 922 {
 923         char ip[128], txt[512];
 924         char dnamestr[LDNS_MAX_DOMAINLEN+1];
 925         uint16_t port = ntohs(((struct sockaddr_in*)&repinfo->addr)->sin_port);
 926         dname_str(dname, dnamestr);
 927         addr_to_str(&repinfo->addr, repinfo->addrlen, ip, sizeof(ip));
 928         if(log_name)
 929                 snprintf(txt, sizeof(txt), "RPZ applied [%s] %s %s %s@%u",
 930                         log_name, dnamestr, rpz_action_to_string(a), ip,
 931                         (unsigned)port);
 932         else
 933                 snprintf(txt, sizeof(txt), "RPZ applied %s %s %s@%u",
 934                         dnamestr, rpz_action_to_string(a), ip, (unsigned)port);
 935         log_nametypeclass(0, txt, qinfo->qname, qinfo->qtype, qinfo->qclass);
 936 }
 937
 938 int
 939 rpz_apply_qname_trigger(struct auth_zones* az, struct module_env* env,
 940         struct query_info* qinfo, struct edns_data* edns, sldns_buffer* buf,
 941         struct regional* temp, struct comm_reply* repinfo,
 942         uint8_t* taglist, size_t taglen, struct ub_server_stats* stats)
 943 {
 944         struct rpz* r = NULL;
 945         struct auth_zone* a;
 946         int ret;
 947         enum localzone_type lzt;
 948         struct local_zone* z = NULL;
 949         struct local_data* ld = NULL;
 950         lock_rw_rdlock(&az->rpz_lock);
 951         for(a = az->rpz_first; a; a = a->rpz_az_next) {
 952                 lock_rw_rdlock(&a->lock);
 953                 r = a->rpz;
 954                 if(!r->taglist || taglist_intersect(r->taglist,
 955                         r->taglistlen, taglist, taglen)) {
 956                         z = rpz_find_zone(r, qinfo->qname, qinfo->qname_len,
 957                                 qinfo->qclass, 0, 0, 0);
 958                         if(z && r->action_override == RPZ_DISABLED_ACTION) {
 959                                 if(r->log)
 960                                         log_rpz_apply(z->name,
 961                                                 r->action_override,
 962                                                 qinfo, repinfo, r->log_name);
 963                                 /* TODO only register stats when stats_extended?
 964                                  * */
 965                                 stats->rpz_action[r->action_override]++;
 966                                 lock_rw_unlock(&z->lock);
 967                                 z = NULL;
 968                         }
 969                         if(z)
 970                                 break;
 971                 }
 972                 lock_rw_unlock(&a->lock); /* not found in this auth_zone */
 973         }
 974         lock_rw_unlock(&az->rpz_lock);
 975         if(!z)
 976                 return 0; /* not holding auth_zone.lock anymore */
 977
 978         log_assert(r);
 979         if(r->action_override == RPZ_NO_OVERRIDE_ACTION)
 980                 lzt = z->type;
 981         else
 982                 lzt = rpz_action_to_localzone_type(r->action_override);
 983
 984         if(r->action_override == RPZ_CNAME_OVERRIDE_ACTION) {
 985                 qinfo->local_alias =
 986                         regional_alloc_zero(temp, sizeof(struct local_rrset));
 987                 if(!qinfo->local_alias) {
 988                         lock_rw_unlock(&z->lock);
 989                         lock_rw_unlock(&a->lock);
 990                         return 0; /* out of memory */
 991                 }
 992                 qinfo->local_alias->rrset =
 993                         regional_alloc_init(temp, r->cname_override,
 994                                 sizeof(*r->cname_override));
 995                 if(!qinfo->local_alias->rrset) {
 996                         lock_rw_unlock(&z->lock);
 997                         lock_rw_unlock(&a->lock);
 998                         return 0; /* out of memory */
 999                 }
1000                 qinfo->local_alias->rrset->rk.dname = qinfo->qname;
1001                 qinfo->local_alias->rrset->rk.dname_len = qinfo->qname_len;
1002                 if(r->log)
1003                         log_rpz_apply(z->name, RPZ_CNAME_OVERRIDE_ACTION,
1004                                 qinfo, repinfo, r->log_name);
1005                 stats->rpz_action[RPZ_CNAME_OVERRIDE_ACTION]++;
1006                 lock_rw_unlock(&z->lock);
1007                 lock_rw_unlock(&a->lock);
1008                 return 0;
1009         }
1010
1011         if(lzt == local_zone_redirect && local_data_answer(z, env, qinfo,
1012                 edns, repinfo, buf, temp, dname_count_labels(qinfo->qname),
1013                 &ld, lzt, -1, NULL, 0, NULL, 0)) {
1014                 if(r->log)
1015                         log_rpz_apply(z->name,
1016                                 localzone_type_to_rpz_action(lzt), qinfo,
1017                                 repinfo, r->log_name);
1018                 stats->rpz_action[localzone_type_to_rpz_action(lzt)]++;
1019                 lock_rw_unlock(&z->lock);
1020                 lock_rw_unlock(&a->lock);
1021                 return !qinfo->local_alias;
1022         }
1023
1024         ret = local_zones_zone_answer(z, env, qinfo, edns, repinfo, buf, temp,
1025                 0 /* no local data used */, lzt);
1026         if(r->log)
1027                 log_rpz_apply(z->name, localzone_type_to_rpz_action(lzt),
1028                         qinfo, repinfo, r->log_name);
1029         stats->rpz_action[localzone_type_to_rpz_action(lzt)]++;
1030         lock_rw_unlock(&z->lock);
1031         lock_rw_unlock(&a->lock);
1032
1033         return ret;
1034 }