contrib/unbound/services/rpz.c

   1 /*
   2  * services/rpz.c - rpz service
   3  *
   4  * Copyright (c) 2019, NLnet Labs. All rights reserved.
   5  *
   6  * This software is open source.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  *
  12  * Redistributions of source code must retain the above copyright notice,
  13  * this list of conditions and the following disclaimer.
  14  *
  15  * Redistributions in binary form must reproduce the above copyright notice,
  16  * this list of conditions and the following disclaimer in the documentation
  17  * and/or other materials provided with the distribution.
  18  *
  19  * Neither the name of the NLNET LABS nor the names of its contributors may
  20  * be used to endorse or promote products derived from this software without
  21  * specific prior written permission.
  22  *
  23  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  24  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  25  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  26  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  27  * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  28  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
  29  * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
  30  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
  31  * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
  32  * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
  33  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  34  */
  35
  36 /**
  37  * \file
  38  *
  39  * This file contains functions to enable RPZ service.
  40  */
  41
  42 #include "config.h"
  43 #include "services/rpz.h"
  44 #include "util/config_file.h"
  45 #include "sldns/wire2str.h"
  46 #include "sldns/str2wire.h"
  47 #include "util/data/dname.h"
  48 #include "util/net_help.h"
  49 #include "util/log.h"
  50 #include "util/data/dname.h"
  51 #include "util/locks.h"
  52 #include "util/regional.h"
  53
  54 /** string for RPZ action enum */
  55 const char*
  56 rpz_action_to_string(enum rpz_action a)
  57 {
  58         switch(a) {
  59         case RPZ_NXDOMAIN_ACTION:       return "nxdomain";
  60         case RPZ_NODATA_ACTION:         return "nodata";
  61         case RPZ_PASSTHRU_ACTION:       return "passthru";
  62         case RPZ_DROP_ACTION:           return "drop";
  63         case RPZ_TCP_ONLY_ACTION:       return "tcp_only";
  64         case RPZ_INVALID_ACTION:        return "invalid";
  65         case RPZ_LOCAL_DATA_ACTION:     return "local_data";
  66         case RPZ_DISABLED_ACTION:       return "disabled";
  67         case RPZ_CNAME_OVERRIDE_ACTION: return "cname_override";
  68         case RPZ_NO_OVERRIDE_ACTION:    return "no_override";
  69         }
  70         return "unknown";
  71 }
  72
  73 /** RPZ action enum for config string */
  74 static enum rpz_action
  75 rpz_config_to_action(char* a)
  76 {
  77         if(strcmp(a, "nxdomain") == 0)
  78                 return RPZ_NXDOMAIN_ACTION;
  79         else if(strcmp(a, "nodata") == 0)
  80                 return RPZ_NODATA_ACTION;
  81         else if(strcmp(a, "passthru") == 0)
  82                 return RPZ_PASSTHRU_ACTION;
  83         else if(strcmp(a, "drop") == 0)
  84                 return RPZ_DROP_ACTION;
  85         else if(strcmp(a, "tcp_only") == 0)
  86                 return RPZ_TCP_ONLY_ACTION;
  87         else if(strcmp(a, "cname") == 0)
  88                 return RPZ_CNAME_OVERRIDE_ACTION;
  89         else if(strcmp(a, "disabled") == 0)
  90                 return RPZ_DISABLED_ACTION;
  91         return RPZ_INVALID_ACTION;
  92 }
  93
  94 /** string for RPZ trigger enum */
  95 static const char*
  96 rpz_trigger_to_string(enum rpz_trigger r)
  97 {
  98         switch(r) {
  99         case RPZ_QNAME_TRIGGER:         return "qname";
 100         case RPZ_CLIENT_IP_TRIGGER:     return "client_ip";
 101         case RPZ_RESPONSE_IP_TRIGGER:   return "response_ip";
 102         case RPZ_NSDNAME_TRIGGER:       return "nsdname";
 103         case RPZ_NSIP_TRIGGER:          return "nsip";
 104         case RPZ_INVALID_TRIGGER:       return "invalid";
 105         }
 106         return "unknown";
 107 }
 108
 109 /**
 110  * Get the label that is just before the root label.
 111  * @param dname: dname to work on
 112  * @param maxdnamelen: maximum length of the dname
 113  * @return: pointer to TLD label, NULL if not found or invalid dname
 114  */
 115 static uint8_t*
 116 get_tld_label(uint8_t* dname, size_t maxdnamelen)
 117 {
 118         uint8_t* prevlab = dname;
 119         size_t dnamelen = 0;
 120
 121         /* one byte needed for label length */
 122         if(dnamelen+1 > maxdnamelen)
 123                 return NULL;
 124
 125         /* only root label */
 126         if(*dname == 0)
 127                 return NULL;
 128
 129         while(*dname) {
 130                 dnamelen += ((size_t)*dname)+1;
 131                 if(dnamelen+1 > maxdnamelen)
 132                         return NULL;
 133                 dname = dname+((size_t)*dname)+1;
 134                 if(*dname != 0)
 135                         prevlab = dname;
 136         }
 137         return prevlab;
 138 }
 139
 140 /**
 141  * Classify RPZ action for RR type/rdata
 142  * @param rr_type: the RR type
 143  * @param rdatawl: RDATA with 2 bytes length
 144  * @param rdatalen: the length of rdatawl (including its 2 bytes length)
 145  * @return: the RPZ action
 146  */
 147 static enum rpz_action
 148 rpz_rr_to_action(uint16_t rr_type, uint8_t* rdatawl, size_t rdatalen)
 149 {
 150         char* endptr;
 151         uint8_t* rdata;
 152         int rdatalabs;
 153         uint8_t* tldlab = NULL;
 154
 155         switch(rr_type) {
 156                 case LDNS_RR_TYPE_SOA:
 157                 case LDNS_RR_TYPE_NS:
 158                 case LDNS_RR_TYPE_DNAME:
 159                 /* all DNSSEC-related RRs must be ignored */
 160                 case LDNS_RR_TYPE_DNSKEY:
 161                 case LDNS_RR_TYPE_DS:
 162                 case LDNS_RR_TYPE_RRSIG:
 163                 case LDNS_RR_TYPE_NSEC:
 164                 case LDNS_RR_TYPE_NSEC3:
 165                         return RPZ_INVALID_ACTION;
 166                 case LDNS_RR_TYPE_CNAME:
 167                         break;
 168                 default:
 169                         return RPZ_LOCAL_DATA_ACTION;
 170         }
 171
 172         /* use CNAME target to determine RPZ action */
 173         log_assert(rr_type == LDNS_RR_TYPE_CNAME);
 174         if(rdatalen < 3)
 175                 return RPZ_INVALID_ACTION;
 176
 177         rdata = rdatawl + 2; /* 2 bytes of rdata length */
 178         if(dname_valid(rdata, rdatalen-2) != rdatalen-2)
 179                 return RPZ_INVALID_ACTION;
 180
 181         rdatalabs = dname_count_labels(rdata);
 182         if(rdatalabs == 1)
 183                 return RPZ_NXDOMAIN_ACTION;
 184         else if(rdatalabs == 2) {
 185                 if(dname_subdomain_c(rdata, (uint8_t*)&"\001*\000"))
 186                         return RPZ_NODATA_ACTION;
 187                 else if(dname_subdomain_c(rdata,
 188                         (uint8_t*)&"\014rpz-passthru\000"))
 189                         return RPZ_PASSTHRU_ACTION;
 190                 else if(dname_subdomain_c(rdata, (uint8_t*)&"\010rpz-drop\000"))
 191                         return RPZ_DROP_ACTION;
 192                 else if(dname_subdomain_c(rdata,
 193                         (uint8_t*)&"\014rpz-tcp-only\000"))
 194                         return RPZ_TCP_ONLY_ACTION;
 195         }
 196
 197         /* all other TLDs starting with "rpz-" are invalid */
 198         tldlab = get_tld_label(rdata, rdatalen-2);
 199         if(tldlab && dname_lab_startswith(tldlab, "rpz-", &endptr))
 200                 return RPZ_INVALID_ACTION;
 201
 202         /* no special label found */
 203         return RPZ_LOCAL_DATA_ACTION;
 204 }
 205
 206 static enum localzone_type
 207 rpz_action_to_localzone_type(enum rpz_action a)
 208 {
 209         switch(a) {
 210         case RPZ_NXDOMAIN_ACTION:       return local_zone_always_nxdomain;
 211         case RPZ_NODATA_ACTION:         return local_zone_always_nodata;
 212         case RPZ_DROP_ACTION:           return local_zone_always_deny;
 213         case RPZ_PASSTHRU_ACTION:       return local_zone_always_transparent;
 214         case RPZ_LOCAL_DATA_ACTION:     /* fallthrough */
 215         case RPZ_CNAME_OVERRIDE_ACTION: return local_zone_redirect;
 216         case RPZ_INVALID_ACTION:        /* fallthrough */
 217         case RPZ_TCP_ONLY_ACTION:       /* fallthrough */
 218         default:                        return local_zone_invalid;
 219         }
 220 }
 221
 222 enum respip_action
 223 rpz_action_to_respip_action(enum rpz_action a)
 224 {
 225         switch(a) {
 226         case RPZ_NXDOMAIN_ACTION:       return respip_always_nxdomain;
 227         case RPZ_NODATA_ACTION:         return respip_always_nodata;
 228         case RPZ_DROP_ACTION:           return respip_always_deny;
 229         case RPZ_PASSTHRU_ACTION:       return respip_always_transparent;
 230         case RPZ_LOCAL_DATA_ACTION:     /* fallthrough */
 231         case RPZ_CNAME_OVERRIDE_ACTION: return respip_redirect;
 232         case RPZ_INVALID_ACTION:        /* fallthrough */
 233         case RPZ_TCP_ONLY_ACTION:       /* fallthrough */
 234         default:                        return respip_invalid;
 235         }
 236 }
 237
 238 static enum rpz_action
 239 localzone_type_to_rpz_action(enum localzone_type lzt)
 240 {
 241         switch(lzt) {
 242         case local_zone_always_nxdomain:        return RPZ_NXDOMAIN_ACTION;
 243         case local_zone_always_nodata:          return RPZ_NODATA_ACTION;
 244         case local_zone_always_deny:            return RPZ_DROP_ACTION;
 245         case local_zone_always_transparent:     return RPZ_PASSTHRU_ACTION;
 246         case local_zone_redirect:               return RPZ_LOCAL_DATA_ACTION;
 247         case local_zone_invalid:
 248         default:
 249                 return RPZ_INVALID_ACTION;
 250         }
 251 }
 252
 253 enum rpz_action
 254 respip_action_to_rpz_action(enum respip_action a)
 255 {
 256         switch(a) {
 257         case respip_always_nxdomain:    return RPZ_NXDOMAIN_ACTION;
 258         case respip_always_nodata:      return RPZ_NODATA_ACTION;
 259         case respip_always_deny:        return RPZ_DROP_ACTION;
 260         case respip_always_transparent: return RPZ_PASSTHRU_ACTION;
 261         case respip_redirect:           return RPZ_LOCAL_DATA_ACTION;
 262         case respip_invalid:
 263         default:
 264                 return RPZ_INVALID_ACTION;
 265         }
 266 }
 267
 268 /**
 269  * Get RPZ trigger for dname
 270  * @param dname: dname containing RPZ trigger
 271  * @param dname_len: length of the dname
 272  * @return: RPZ trigger enum
 273  */
 274 static enum rpz_trigger
 275 rpz_dname_to_trigger(uint8_t* dname, size_t dname_len)
 276 {
 277         uint8_t* tldlab;
 278         char* endptr;
 279
 280         if(dname_valid(dname, dname_len) != dname_len)
 281                 return RPZ_INVALID_TRIGGER;
 282
 283         tldlab = get_tld_label(dname, dname_len);
 284         if(!tldlab || !dname_lab_startswith(tldlab, "rpz-", &endptr))
 285                 return RPZ_QNAME_TRIGGER;
 286
 287         if(dname_subdomain_c(tldlab,
 288                 (uint8_t*)&"\015rpz-client-ip\000"))
 289                 return RPZ_CLIENT_IP_TRIGGER;
 290         else if(dname_subdomain_c(tldlab, (uint8_t*)&"\006rpz-ip\000"))
 291                 return RPZ_RESPONSE_IP_TRIGGER;
 292         else if(dname_subdomain_c(tldlab, (uint8_t*)&"\013rpz-nsdname\000"))
 293                 return RPZ_NSDNAME_TRIGGER;
 294         else if(dname_subdomain_c(tldlab, (uint8_t*)&"\010rpz-nsip\000"))
 295                 return RPZ_NSIP_TRIGGER;
 296
 297         return RPZ_QNAME_TRIGGER;
 298 }
 299
 300 void rpz_delete(struct rpz* r)
 301 {
 302         if(!r)
 303                 return;
 304         local_zones_delete(r->local_zones);
 305         respip_set_delete(r->respip_set);
 306         regional_destroy(r->region);
 307         free(r->taglist);
 308         free(r->log_name);
 309         free(r);
 310 }
 311
 312 int
 313 rpz_clear(struct rpz* r)
 314 {
 315         /* must hold write lock on auth_zone */
 316         local_zones_delete(r->local_zones);
 317         respip_set_delete(r->respip_set);
 318         if(!(r->local_zones = local_zones_create())){
 319                 return 0;
 320         }
 321         if(!(r->respip_set = respip_set_create())) {
 322                 return 0;
 323         }
 324         return 1;
 325 }
 326
 327 void
 328 rpz_finish_config(struct rpz* r)
 329 {
 330         lock_rw_wrlock(&r->respip_set->lock);
 331         addr_tree_init_parents(&r->respip_set->ip_tree);
 332         lock_rw_unlock(&r->respip_set->lock);
 333 }
 334
 335 /** new rrset containing CNAME override, does not yet contain a dname */
 336 static struct ub_packed_rrset_key*
 337 new_cname_override(struct regional* region, uint8_t* ct, size_t ctlen)
 338 {
 339         struct ub_packed_rrset_key* rrset;
 340         struct packed_rrset_data* pd;
 341         uint16_t rdlength = htons(ctlen);
 342         rrset = (struct ub_packed_rrset_key*)regional_alloc_zero(region,
 343                 sizeof(*rrset));
 344         if(!rrset) {
 345                 log_err("out of memory");
 346                 return NULL;
 347         }
 348         rrset->entry.key = rrset;
 349         pd = (struct packed_rrset_data*)regional_alloc_zero(region, sizeof(*pd));
 350         if(!pd) {
 351                 log_err("out of memory");
 352                 return NULL;
 353         }
 354         pd->trust = rrset_trust_prim_noglue;
 355         pd->security = sec_status_insecure;
 356
 357         pd->count = 1;
 358         pd->rr_len = regional_alloc_zero(region, sizeof(*pd->rr_len));
 359         pd->rr_ttl = regional_alloc_zero(region, sizeof(*pd->rr_ttl));
 360         pd->rr_data = regional_alloc_zero(region, sizeof(*pd->rr_data));
 361         if(!pd->rr_len || !pd->rr_ttl || !pd->rr_data) {
 362                 log_err("out of memory");
 363                 return NULL;
 364         }
 365         pd->rr_len[0] = ctlen+2;
 366         pd->rr_ttl[0] = 3600;
 367         pd->rr_data[0] = regional_alloc_zero(region, 2 /* rdlength */ + ctlen);
 368         if(!pd->rr_data[0]) {
 369                 log_err("out of memory");
 370                 return NULL;
 371         }
 372         memmove(pd->rr_data[0], &rdlength, 2);
 373         memmove(pd->rr_data[0]+2, ct, ctlen);
 374
 375         rrset->entry.data = pd;
 376         rrset->rk.type = htons(LDNS_RR_TYPE_CNAME);
 377         rrset->rk.rrset_class = htons(LDNS_RR_CLASS_IN);
 378         return rrset;
 379 }
 380
 381 struct rpz*
 382 rpz_create(struct config_auth* p)
 383 {
 384         struct rpz* r = calloc(1, sizeof(*r));
 385         if(!r)
 386                 goto err;
 387
 388         r->region = regional_create_custom(sizeof(struct regional));
 389         if(!r->region) {
 390                 goto err;
 391         }
 392
 393         if(!(r->local_zones = local_zones_create())){
 394                 goto err;
 395         }
 396         if(!(r->respip_set = respip_set_create())) {
 397                 goto err;
 398         }
 399         r->taglistlen = p->rpz_taglistlen;
 400         r->taglist = memdup(p->rpz_taglist, r->taglistlen);
 401         if(p->rpz_action_override) {
 402                 r->action_override = rpz_config_to_action(p->rpz_action_override);
 403         }
 404         else
 405                 r->action_override = RPZ_NO_OVERRIDE_ACTION;
 406
 407         if(r->action_override == RPZ_CNAME_OVERRIDE_ACTION) {
 408                 uint8_t nm[LDNS_MAX_DOMAINLEN+1];
 409                 size_t nmlen = sizeof(nm);
 410
 411                 if(!p->rpz_cname) {
 412                         log_err("RPZ override with cname action found, but no "
 413                                 "rpz-cname-override configured");
 414                         goto err;
 415                 }
 416
 417                 if(sldns_str2wire_dname_buf(p->rpz_cname, nm, &nmlen) != 0) {
 418                         log_err("cannot parse RPZ cname override: %s",
 419                                 p->rpz_cname);
 420                         goto err;
 421                 }
 422                 r->cname_override = new_cname_override(r->region, nm, nmlen);
 423                 if(!r->cname_override) {
 424                         goto err;
 425                 }
 426         }
 427         r->log = p->rpz_log;
 428         if(p->rpz_log_name) {
 429                 if(!(r->log_name = strdup(p->rpz_log_name))) {
 430                         log_err("malloc failure on RPZ log_name strdup");
 431                         goto err;
 432                 }
 433         }
 434         return r;
 435 err:
 436         if(r) {
 437                 if(r->local_zones)
 438                         local_zones_delete(r->local_zones);
 439                 if(r->respip_set)
 440                         respip_set_delete(r->respip_set);
 441                 if(r->taglist)
 442                         free(r->taglist);
 443                 free(r);
 444         }
 445         return NULL;
 446 }
 447
 448 /**
 449  * Remove RPZ zone name from dname
 450  * Copy dname to newdname, without the originlen number of trailing bytes
 451  */
 452 static size_t
 453 strip_dname_origin(uint8_t* dname, size_t dnamelen, size_t originlen,
 454         uint8_t* newdname, size_t maxnewdnamelen)
 455 {
 456         size_t newdnamelen;
 457         if(dnamelen < originlen)
 458                 return 0;
 459         newdnamelen = dnamelen - originlen;
 460         if(newdnamelen+1 > maxnewdnamelen)
 461                 return 0;
 462         memmove(newdname, dname, newdnamelen);
 463         newdname[newdnamelen] = 0;
 464         return newdnamelen + 1; /* + 1 for root label */
 465 }
 466
 467 /** Insert RR into RPZ's local-zone */
 468 static void
 469 rpz_insert_qname_trigger(struct rpz* r, uint8_t* dname, size_t dnamelen,
 470         enum rpz_action a, uint16_t rrtype, uint16_t rrclass, uint32_t ttl,
 471         uint8_t* rdata, size_t rdata_len, uint8_t* rr, size_t rr_len)
 472 {
 473         struct local_zone* z;
 474         enum localzone_type tp = local_zone_always_transparent;
 475         int dnamelabs = dname_count_labels(dname);
 476         char* rrstr;
 477         int newzone = 0;
 478
 479         if(a == RPZ_TCP_ONLY_ACTION || a == RPZ_INVALID_ACTION) {
 480                 verbose(VERB_ALGO, "RPZ: skipping unsupported action: %s",
 481                         rpz_action_to_string(a));
 482                 free(dname);
 483                 return;
 484         }
 485
 486         lock_rw_wrlock(&r->local_zones->lock);
 487         /* exact match */
 488         z = local_zones_find(r->local_zones, dname, dnamelen, dnamelabs,
 489                 LDNS_RR_CLASS_IN);
 490         if(z && a != RPZ_LOCAL_DATA_ACTION) {
 491                 rrstr = sldns_wire2str_rr(rr, rr_len);
 492                 if(!rrstr) {
 493                         log_err("malloc error while inserting RPZ qname "
 494                                 "trigger");
 495                         free(dname);
 496                         lock_rw_unlock(&r->local_zones->lock);
 497                         return;
 498                 }
 499                 verbose(VERB_ALGO, "RPZ: skipping duplicate record: '%s'",
 500                         rrstr);
 501                 free(rrstr);
 502                 free(dname);
 503                 lock_rw_unlock(&r->local_zones->lock);
 504                 return;
 505         }
 506         if(!z) {
 507                 tp = rpz_action_to_localzone_type(a);
 508                 if(!(z = local_zones_add_zone(r->local_zones, dname, dnamelen,
 509                         dnamelabs, rrclass, tp))) {
 510                         log_warn("RPZ create failed");
 511                         lock_rw_unlock(&r->local_zones->lock);
 512                         /* dname will be free'd in failed local_zone_create() */
 513                         return;
 514                 }
 515                 newzone = 1;
 516         }
 517         if(a == RPZ_LOCAL_DATA_ACTION) {
 518                 rrstr = sldns_wire2str_rr(rr, rr_len);
 519                 if(!rrstr) {
 520                         log_err("malloc error while inserting RPZ qname "
 521                                 "trigger");
 522                         free(dname);
 523                         lock_rw_unlock(&r->local_zones->lock);
 524                         return;
 525                 }
 526                 lock_rw_wrlock(&z->lock);
 527                 local_zone_enter_rr(z, dname, dnamelen, dnamelabs,
 528                         rrtype, rrclass, ttl, rdata, rdata_len, rrstr);
 529                 lock_rw_unlock(&z->lock);
 530                 free(rrstr);
 531         }
 532         if(!newzone)
 533                 free(dname);
 534         lock_rw_unlock(&r->local_zones->lock);
 535         return;
 536 }
 537
 538 /** Insert RR into RPZ's respip_set */
 539 static int
 540 rpz_insert_response_ip_trigger(struct rpz* r, uint8_t* dname, size_t dnamelen,
 541         enum rpz_action a, uint16_t rrtype, uint16_t rrclass, uint32_t ttl,
 542         uint8_t* rdata, size_t rdata_len, uint8_t* rr, size_t rr_len)
 543 {
 544         struct resp_addr* node;
 545         struct sockaddr_storage addr;
 546         socklen_t addrlen;
 547         int net, af;
 548         char* rrstr;
 549         enum respip_action respa = rpz_action_to_respip_action(a);
 550
 551         if(a == RPZ_TCP_ONLY_ACTION || a == RPZ_INVALID_ACTION ||
 552                 respa == respip_invalid) {
 553                 verbose(VERB_ALGO, "RPZ: skipping unsupported action: %s",
 554                         rpz_action_to_string(a));
 555                 return 0;
 556         }
 557
 558         if(!netblockdnametoaddr(dname, dnamelen, &addr, &addrlen, &net, &af))
 559                 return 0;
 560
 561         lock_rw_wrlock(&r->respip_set->lock);
 562         rrstr = sldns_wire2str_rr(rr, rr_len);
 563         if(!rrstr) {
 564                 log_err("malloc error while inserting RPZ respip trigger");
 565                 lock_rw_unlock(&r->respip_set->lock);
 566                 return 0;
 567         }
 568         if(!(node=respip_sockaddr_find_or_create(r->respip_set, &addr, addrlen,
 569                 net, 1, rrstr))) {
 570                 lock_rw_unlock(&r->respip_set->lock);
 571                 free(rrstr);
 572                 return 0;
 573         }
 574
 575         lock_rw_wrlock(&node->lock);
 576         lock_rw_unlock(&r->respip_set->lock);
 577         node->action = respa;
 578
 579         if(a == RPZ_LOCAL_DATA_ACTION) {
 580                 respip_enter_rr(r->respip_set->region, node, rrtype,
 581                         rrclass, ttl, rdata, rdata_len, rrstr, "");
 582         }
 583         lock_rw_unlock(&node->lock);
 584         free(rrstr);
 585         return 1;
 586 }
 587
 588 int
 589 rpz_insert_rr(struct rpz* r, uint8_t* azname, size_t aznamelen, uint8_t* dname,
 590         size_t dnamelen, uint16_t rr_type, uint16_t rr_class, uint32_t rr_ttl,
 591         uint8_t* rdatawl, size_t rdatalen, uint8_t* rr, size_t rr_len)
 592 {
 593         size_t policydnamelen;
 594         /* name is free'd in local_zone delete */
 595         enum rpz_trigger t;
 596         enum rpz_action a;
 597         uint8_t* policydname;
 598
 599         if(!dname_subdomain_c(dname, azname)) {
 600                 char* dname_str = sldns_wire2str_dname(dname, dnamelen);
 601                 char* azname_str = sldns_wire2str_dname(azname, aznamelen);
 602                 if(dname_str && azname_str) {
 603                         log_err("RPZ: name of record (%s) to insert into RPZ is not a "
 604                                 "subdomain of the configured name of the RPZ zone (%s)",
 605                                 dname_str, azname_str);
 606                 } else {
 607                         log_err("RPZ: name of record to insert into RPZ is not a "
 608                                 "subdomain of the configured name of the RPZ zone");
 609                 }
 610                 free(dname_str);
 611                 free(azname_str);
 612                 return 0;
 613         }
 614
 615         log_assert(dnamelen >= aznamelen);
 616         if(!(policydname = calloc(1, (dnamelen-aznamelen)+1))) {
 617                 log_err("malloc error while inserting RPZ RR");
 618                 return 0;
 619         }
 620
 621         a = rpz_rr_to_action(rr_type, rdatawl, rdatalen);
 622         if(!(policydnamelen = strip_dname_origin(dname, dnamelen, aznamelen,
 623                 policydname, (dnamelen-aznamelen)+1))) {
 624                 free(policydname);
 625                 return 0;
 626         }
 627         t = rpz_dname_to_trigger(policydname, policydnamelen);
 628         if(t == RPZ_INVALID_TRIGGER) {
 629                 free(policydname);
 630                 verbose(VERB_ALGO, "RPZ: skipping invalid trigger");
 631                 return 1;
 632         }
 633         if(t == RPZ_QNAME_TRIGGER) {
 634                 rpz_insert_qname_trigger(r, policydname, policydnamelen,
 635                         a, rr_type, rr_class, rr_ttl, rdatawl, rdatalen, rr,
 636                         rr_len);
 637         }
 638         else if(t == RPZ_RESPONSE_IP_TRIGGER) {
 639                 rpz_insert_response_ip_trigger(r, policydname, policydnamelen,
 640                         a, rr_type, rr_class, rr_ttl, rdatawl, rdatalen, rr,
 641                         rr_len);
 642                 free(policydname);
 643         }
 644         else {
 645                 free(policydname);
 646                 verbose(VERB_ALGO, "RPZ: skipping unsupported trigger: %s",
 647                         rpz_trigger_to_string(t));
 648         }
 649         return 1;
 650 }
 651
 652 /**
 653  * Find RPZ local-zone by qname.
 654  * @param r: rpz containing local-zone tree
 655  * @param qname: qname
 656  * @param qname_len: length of qname
 657  * @param qclass: qclass
 658  * @param only_exact: if 1 only excact (non wildcard) matches are returned
 659  * @param wr: get write lock for local-zone if 1, read lock if 0
 660  * @param zones_keep_lock: if set do not release the r->local_zones lock, this
 661  *        makes the caller of this function responsible for releasing the lock.
 662  * @return: NULL or local-zone holding rd or wr lock
 663  */
 664 static struct local_zone*
 665 rpz_find_zone(struct rpz* r, uint8_t* qname, size_t qname_len, uint16_t qclass,
 666         int only_exact, int wr, int zones_keep_lock)
 667 {
 668         uint8_t* ce;
 669         size_t ce_len, ce_labs;
 670         uint8_t wc[LDNS_MAX_DOMAINLEN+1];
 671         int exact;
 672         struct local_zone* z = NULL;
 673         if(wr) {
 674                 lock_rw_wrlock(&r->local_zones->lock);
 675         } else {
 676                 lock_rw_rdlock(&r->local_zones->lock);
 677         }
 678         z = local_zones_find_le(r->local_zones, qname, qname_len,
 679                 dname_count_labels(qname),
 680                 LDNS_RR_CLASS_IN, &exact);
 681         if(!z || (only_exact && !exact)) {
 682                 lock_rw_unlock(&r->local_zones->lock);
 683                 return NULL;
 684         }
 685         if(wr) {
 686                 lock_rw_wrlock(&z->lock);
 687         } else {
 688                 lock_rw_rdlock(&z->lock);
 689         }
 690         if(!zones_keep_lock) {
 691                 lock_rw_unlock(&r->local_zones->lock);
 692         }
 693
 694         if(exact)
 695                 return z;
 696
 697         /* No exact match found, lookup wildcard. closest encloser must
 698          * be the shared parent between the qname and the best local
 699          * zone match, append '*' to that and do another lookup. */
 700
 701         ce = dname_get_shared_topdomain(z->name, qname);
 702         if(!ce /* should not happen */ || !*ce /* root */) {
 703                 lock_rw_unlock(&z->lock);
 704                 if(zones_keep_lock) {
 705                         lock_rw_unlock(&r->local_zones->lock);
 706                 }
 707                 return NULL;
 708         }
 709         ce_labs = dname_count_size_labels(ce, &ce_len);
 710         if(ce_len+2 > sizeof(wc)) {
 711                 lock_rw_unlock(&z->lock);
 712                 if(zones_keep_lock) {
 713                         lock_rw_unlock(&r->local_zones->lock);
 714                 }
 715                 return NULL;
 716         }
 717         wc[0] = 1; /* length of wildcard label */
 718         wc[1] = (uint8_t)'*'; /* wildcard label */
 719         memmove(wc+2, ce, ce_len);
 720         lock_rw_unlock(&z->lock);
 721
 722         if(!zones_keep_lock) {
 723                 if(wr) {
 724                         lock_rw_wrlock(&r->local_zones->lock);
 725                 } else {
 726                         lock_rw_rdlock(&r->local_zones->lock);
 727                 }
 728         }
 729         z = local_zones_find_le(r->local_zones, wc,
 730                 ce_len+2, ce_labs+1, qclass, &exact);
 731         if(!z || !exact) {
 732                 lock_rw_unlock(&r->local_zones->lock);
 733                 return NULL;
 734         }
 735         if(wr) {
 736                 lock_rw_wrlock(&z->lock);
 737         } else {
 738                 lock_rw_rdlock(&z->lock);
 739         }
 740         if(!zones_keep_lock) {
 741                 lock_rw_unlock(&r->local_zones->lock);
 742         }
 743         return z;
 744 }
 745
 746 /**
 747  * Remove RR from RPZ's local-data
 748  * @param z: local-zone for RPZ, holding write lock
 749  * @param policydname: dname of RR to remove
 750  * @param policydnamelen: lenth of policydname
 751  * @param rr_type: RR type of RR to remove
 752  * @param rdata: rdata of RR to remove
 753  * @param rdatalen: length of rdata
 754  * @return: 1 if zone must be removed after RR deletion
 755  */
 756 static int
 757 rpz_data_delete_rr(struct local_zone* z, uint8_t* policydname,
 758         size_t policydnamelen, uint16_t rr_type, uint8_t* rdata,
 759         size_t rdatalen)
 760 {
 761         struct local_data* ld;
 762         struct packed_rrset_data* d;
 763         size_t index;
 764         ld = local_zone_find_data(z, policydname, policydnamelen,
 765                 dname_count_labels(policydname));
 766         if(ld) {
 767                 struct local_rrset* prev=NULL, *p=ld->rrsets;
 768                 while(p && ntohs(p->rrset->rk.type) != rr_type) {
 769                         prev = p;
 770                         p = p->next;
 771                 }
 772                 if(!p)
 773                         return 0;
 774                 d = (struct packed_rrset_data*)p->rrset->entry.data;
 775                 if(packed_rrset_find_rr(d, rdata, rdatalen, &index)) {
 776                         if(d->count == 1) {
 777                                 /* no memory recycling for zone deletions ... */
 778                                 if(prev) prev->next = p->next;
 779                                 else ld->rrsets = p->next;
 780                         }
 781                         if(d->count > 1) {
 782                                 if(!local_rrset_remove_rr(d, index))
 783                                         return 0;
 784                         }
 785                 }
 786         }
 787         if(ld && ld->rrsets)
 788                 return 0;
 789         return 1;
 790 }
 791
 792 /**
 793  * Remove RR from RPZ's respip set
 794  * @param raddr: respip node
 795  * @param rr_type: RR type of RR to remove
 796  * @param rdata: rdata of RR to remove
 797  * @param rdatalen: length of rdata
 798  * @return: 1 if zone must be removed after RR deletion
 799  */
 800 static int
 801 rpz_rrset_delete_rr(struct resp_addr* raddr, uint16_t rr_type, uint8_t* rdata,
 802         size_t rdatalen)
 803 {
 804         size_t index;
 805         struct packed_rrset_data* d;
 806         if(!raddr->data)
 807                 return 1;
 808         d = raddr->data->entry.data;
 809         if(ntohs(raddr->data->rk.type) != rr_type) {
 810                 return 0;
 811         }
 812         if(packed_rrset_find_rr(d, rdata, rdatalen, &index)) {
 813                 if(d->count == 1) {
 814                         /* regional alloc'd */
 815                         raddr->data->entry.data = NULL;
 816                         raddr->data = NULL;
 817                         return 1;
 818                 }
 819                 if(d->count > 1) {
 820                         if(!local_rrset_remove_rr(d, index))
 821                                 return 0;
 822                 }
 823         }
 824         return 0;
 825
 826 }
 827
 828 /** Remove RR from RPZ's local-zone */
 829 static void
 830 rpz_remove_qname_trigger(struct rpz* r, uint8_t* dname, size_t dnamelen,
 831         enum rpz_action a, uint16_t rr_type, uint16_t rr_class,
 832         uint8_t* rdatawl, size_t rdatalen)
 833 {
 834         struct local_zone* z;
 835         int delete_zone = 1;
 836         z = rpz_find_zone(r, dname, dnamelen, rr_class,
 837                 1 /* only exact */, 1 /* wr lock */, 1 /* keep lock*/);
 838         if(!z) {
 839                 verbose(VERB_ALGO, "RPZ: cannot remove RR from IXFR, "
 840                         "RPZ domain not found");
 841                 return;
 842         }
 843         if(a == RPZ_LOCAL_DATA_ACTION)
 844                 delete_zone = rpz_data_delete_rr(z, dname,
 845                         dnamelen, rr_type, rdatawl, rdatalen);
 846         else if(a != localzone_type_to_rpz_action(z->type)) {
 847                 lock_rw_unlock(&z->lock);
 848                 lock_rw_unlock(&r->local_zones->lock);
 849                 return;
 850         }
 851         lock_rw_unlock(&z->lock);
 852         if(delete_zone) {
 853                 local_zones_del_zone(r->local_zones, z);
 854         }
 855         lock_rw_unlock(&r->local_zones->lock);
 856         return;
 857 }
 858
 859 static void
 860 rpz_remove_response_ip_trigger(struct rpz* r, uint8_t* dname, size_t dnamelen,
 861         enum rpz_action a, uint16_t rr_type, uint8_t* rdatawl, size_t rdatalen)
 862 {
 863         struct resp_addr* node;
 864         struct sockaddr_storage addr;
 865         socklen_t addrlen;
 866         int net, af;
 867         int delete_respip = 1;
 868
 869         if(!netblockdnametoaddr(dname, dnamelen, &addr, &addrlen, &net, &af))
 870                 return;
 871
 872         lock_rw_wrlock(&r->respip_set->lock);
 873         if(!(node = (struct resp_addr*)addr_tree_find(
 874                 &r->respip_set->ip_tree, &addr, addrlen, net))) {
 875                 verbose(VERB_ALGO, "RPZ: cannot remove RR from IXFR, "
 876                         "RPZ domain not found");
 877                 lock_rw_unlock(&r->respip_set->lock);
 878                 return;
 879         }
 880
 881         lock_rw_wrlock(&node->lock);
 882         if(a == RPZ_LOCAL_DATA_ACTION) {
 883                 /* remove RR, signal whether RR can be removed */
 884                 delete_respip = rpz_rrset_delete_rr(node, rr_type, rdatawl,
 885                         rdatalen);
 886         }
 887         lock_rw_unlock(&node->lock);
 888         if(delete_respip)
 889                 respip_sockaddr_delete(r->respip_set, node);
 890         lock_rw_unlock(&r->respip_set->lock);
 891 }
 892
 893 void
 894 rpz_remove_rr(struct rpz* r, size_t aznamelen, uint8_t* dname, size_t dnamelen,
 895         uint16_t rr_type, uint16_t rr_class, uint8_t* rdatawl, size_t rdatalen)
 896 {
 897         size_t policydnamelen;
 898         enum rpz_trigger t;
 899         enum rpz_action a;
 900         uint8_t* policydname;
 901
 902         if(!(policydname = calloc(1, LDNS_MAX_DOMAINLEN + 1)))
 903                 return;
 904
 905         a = rpz_rr_to_action(rr_type, rdatawl, rdatalen);
 906         if(a == RPZ_INVALID_ACTION) {
 907                 free(policydname);
 908                 return;
 909         }
 910         if(!(policydnamelen = strip_dname_origin(dname, dnamelen, aznamelen,
 911                 policydname, LDNS_MAX_DOMAINLEN + 1))) {
 912                 free(policydname);
 913                 return;
 914         }
 915         t = rpz_dname_to_trigger(policydname, policydnamelen);
 916         if(t == RPZ_QNAME_TRIGGER) {
 917                 rpz_remove_qname_trigger(r, policydname, policydnamelen, a,
 918                         rr_type, rr_class, rdatawl, rdatalen);
 919         } else if(t == RPZ_RESPONSE_IP_TRIGGER) {
 920                 rpz_remove_response_ip_trigger(r, policydname, policydnamelen,
 921                         a, rr_type, rdatawl, rdatalen);
 922         }
 923         free(policydname);
 924 }
 925
 926 /** print log information for an applied RPZ policy. Based on local-zone's
 927  * lz_inform_print().
 928  */
 929 static void
 930 log_rpz_apply(uint8_t* dname, enum rpz_action a, struct query_info* qinfo,
 931         struct comm_reply* repinfo, char* log_name)
 932 {
 933         char ip[128], txt[512];
 934         char dnamestr[LDNS_MAX_DOMAINLEN+1];
 935         uint16_t port = ntohs(((struct sockaddr_in*)&repinfo->addr)->sin_port);
 936         dname_str(dname, dnamestr);
 937         addr_to_str(&repinfo->addr, repinfo->addrlen, ip, sizeof(ip));
 938         if(log_name)
 939                 snprintf(txt, sizeof(txt), "RPZ applied [%s] %s %s %s@%u",
 940                         log_name, dnamestr, rpz_action_to_string(a), ip,
 941                         (unsigned)port);
 942         else
 943                 snprintf(txt, sizeof(txt), "RPZ applied %s %s %s@%u",
 944                         dnamestr, rpz_action_to_string(a), ip, (unsigned)port);
 945         log_nametypeclass(0, txt, qinfo->qname, qinfo->qtype, qinfo->qclass);
 946 }
 947
 948 int
 949 rpz_apply_qname_trigger(struct auth_zones* az, struct module_env* env,
 950         struct query_info* qinfo, struct edns_data* edns, sldns_buffer* buf,
 951         struct regional* temp, struct comm_reply* repinfo,
 952         uint8_t* taglist, size_t taglen, struct ub_server_stats* stats)
 953 {
 954         struct rpz* r = NULL;
 955         struct auth_zone* a;
 956         int ret;
 957         enum localzone_type lzt;
 958         struct local_zone* z = NULL;
 959         struct local_data* ld = NULL;
 960         lock_rw_rdlock(&az->rpz_lock);
 961         for(a = az->rpz_first; a; a = a->rpz_az_next) {
 962                 lock_rw_rdlock(&a->lock);
 963                 r = a->rpz;
 964                 if(!r->taglist || taglist_intersect(r->taglist,
 965                         r->taglistlen, taglist, taglen)) {
 966                         z = rpz_find_zone(r, qinfo->qname, qinfo->qname_len,
 967                                 qinfo->qclass, 0, 0, 0);
 968                         if(z && r->action_override == RPZ_DISABLED_ACTION) {
 969                                 if(r->log)
 970                                         log_rpz_apply(z->name,
 971                                                 r->action_override,
 972                                                 qinfo, repinfo, r->log_name);
 973                                 /* TODO only register stats when stats_extended?
 974                                  * */
 975                                 stats->rpz_action[r->action_override]++;
 976                                 lock_rw_unlock(&z->lock);
 977                                 z = NULL;
 978                         }
 979                         if(z)
 980                                 break;
 981                 }
 982                 lock_rw_unlock(&a->lock); /* not found in this auth_zone */
 983         }
 984         lock_rw_unlock(&az->rpz_lock);
 985         if(!z)
 986                 return 0; /* not holding auth_zone.lock anymore */
 987
 988         log_assert(r);
 989         if(r->action_override == RPZ_NO_OVERRIDE_ACTION)
 990                 lzt = z->type;
 991         else
 992                 lzt = rpz_action_to_localzone_type(r->action_override);
 993
 994         if(r->action_override == RPZ_CNAME_OVERRIDE_ACTION) {
 995                 qinfo->local_alias =
 996                         regional_alloc_zero(temp, sizeof(struct local_rrset));
 997                 if(!qinfo->local_alias) {
 998                         lock_rw_unlock(&z->lock);
 999                         lock_rw_unlock(&a->lock);
1000                         return 0; /* out of memory */
1001                 }
1002                 qinfo->local_alias->rrset =
1003                         regional_alloc_init(temp, r->cname_override,
1004                                 sizeof(*r->cname_override));
1005                 if(!qinfo->local_alias->rrset) {
1006                         lock_rw_unlock(&z->lock);
1007                         lock_rw_unlock(&a->lock);
1008                         return 0; /* out of memory */
1009                 }
1010                 qinfo->local_alias->rrset->rk.dname = qinfo->qname;
1011                 qinfo->local_alias->rrset->rk.dname_len = qinfo->qname_len;
1012                 if(r->log)
1013                         log_rpz_apply(z->name, RPZ_CNAME_OVERRIDE_ACTION,
1014                                 qinfo, repinfo, r->log_name);
1015                 stats->rpz_action[RPZ_CNAME_OVERRIDE_ACTION]++;
1016                 lock_rw_unlock(&z->lock);
1017                 lock_rw_unlock(&a->lock);
1018                 return 0;
1019         }
1020
1021         if(lzt == local_zone_redirect && local_data_answer(z, env, qinfo,
1022                 edns, repinfo, buf, temp, dname_count_labels(qinfo->qname),
1023                 &ld, lzt, -1, NULL, 0, NULL, 0)) {
1024                 if(r->log)
1025                         log_rpz_apply(z->name,
1026                                 localzone_type_to_rpz_action(lzt), qinfo,
1027                                 repinfo, r->log_name);
1028                 stats->rpz_action[localzone_type_to_rpz_action(lzt)]++;
1029                 lock_rw_unlock(&z->lock);
1030                 lock_rw_unlock(&a->lock);
1031                 return !qinfo->local_alias;
1032         }
1033
1034         ret = local_zones_zone_answer(z, env, qinfo, edns, repinfo, buf, temp,
1035                 0 /* no local data used */, lzt);
1036         if(r->log)
1037                 log_rpz_apply(z->name, localzone_type_to_rpz_action(lzt),
1038                         qinfo, repinfo, r->log_name);
1039         stats->rpz_action[localzone_type_to_rpz_action(lzt)]++;
1040         lock_rw_unlock(&z->lock);
1041         lock_rw_unlock(&a->lock);
1042
1043         return ret;
1044 }