contrib/unbound/services/rpz.c

   1 /*
   2  * services/rpz.c - rpz service
   3  *
   4  * Copyright (c) 2019, NLnet Labs. All rights reserved.
   5  *
   6  * This software is open source.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  *
  12  * Redistributions of source code must retain the above copyright notice,
  13  * this list of conditions and the following disclaimer.
  14  *
  15  * Redistributions in binary form must reproduce the above copyright notice,
  16  * this list of conditions and the following disclaimer in the documentation
  17  * and/or other materials provided with the distribution.
  18  *
  19  * Neither the name of the NLNET LABS nor the names of its contributors may
  20  * be used to endorse or promote products derived from this software without
  21  * specific prior written permission.
  22  *
  23  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  24  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  25  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  26  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  27  * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  28  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
  29  * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
  30  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
  31  * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
  32  * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
  33  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  34  */
  35
  36 /**
  37  * \file
  38  *
  39  * This file contains functions to enable RPZ service.
  40  */
  41
  42 #include "config.h"
  43 #include "services/rpz.h"
  44 #include "util/config_file.h"
  45 #include "sldns/wire2str.h"
  46 #include "sldns/str2wire.h"
  47 #include "util/data/dname.h"
  48 #include "util/net_help.h"
  49 #include "util/log.h"
  50 #include "util/data/dname.h"
  51 #include "util/locks.h"
  52 #include "util/regional.h"
  53
  54 /** string for RPZ action enum */
  55 const char*
  56 rpz_action_to_string(enum rpz_action a)
  57 {
  58         switch(a) {
  59         case RPZ_NXDOMAIN_ACTION:       return "nxdomain";
  60         case RPZ_NODATA_ACTION:         return "nodata";
  61         case RPZ_PASSTHRU_ACTION:       return "passthru";
  62         case RPZ_DROP_ACTION:           return "drop";
  63         case RPZ_TCP_ONLY_ACTION:       return "tcp_only";
  64         case RPZ_INVALID_ACTION:        return "invalid";
  65         case RPZ_LOCAL_DATA_ACTION:     return "local_data";
  66         case RPZ_DISABLED_ACTION:       return "disabled";
  67         case RPZ_CNAME_OVERRIDE_ACTION: return "cname_override";
  68         case RPZ_NO_OVERRIDE_ACTION:    return "no_override";
  69         }
  70         return "unknown";
  71 }
  72
  73 /** RPZ action enum for config string */
  74 static enum rpz_action
  75 rpz_config_to_action(char* a)
  76 {
  77         if(strcmp(a, "nxdomain") == 0)
  78                 return RPZ_NXDOMAIN_ACTION;
  79         else if(strcmp(a, "nodata") == 0)
  80                 return RPZ_NODATA_ACTION;
  81         else if(strcmp(a, "passthru") == 0)
  82                 return RPZ_PASSTHRU_ACTION;
  83         else if(strcmp(a, "drop") == 0)
  84                 return RPZ_DROP_ACTION;
  85         else if(strcmp(a, "tcp_only") == 0)
  86                 return RPZ_TCP_ONLY_ACTION;
  87         else if(strcmp(a, "cname") == 0)
  88                 return RPZ_CNAME_OVERRIDE_ACTION;
  89         else if(strcmp(a, "disabled") == 0)
  90                 return RPZ_DISABLED_ACTION;
  91         return RPZ_INVALID_ACTION;
  92 }
  93
  94 /** string for RPZ trigger enum */
  95 static const char*
  96 rpz_trigger_to_string(enum rpz_trigger r)
  97 {
  98         switch(r) {
  99         case RPZ_QNAME_TRIGGER:         return "qname";
 100         case RPZ_CLIENT_IP_TRIGGER:     return "client_ip";
 101         case RPZ_RESPONSE_IP_TRIGGER:   return "response_ip";
 102         case RPZ_NSDNAME_TRIGGER:       return "nsdname";
 103         case RPZ_NSIP_TRIGGER:          return "nsip";
 104         case RPZ_INVALID_TRIGGER:       return "invalid";
 105         }
 106         return "unknown";
 107 }
 108
 109 /**
 110  * Get the label that is just before the root label.
 111  * @param dname: dname to work on
 112  * @param maxdnamelen: maximum length of the dname
 113  * @return: pointer to TLD label, NULL if not found or invalid dname
 114  */
 115 static uint8_t*
 116 get_tld_label(uint8_t* dname, size_t maxdnamelen)
 117 {
 118         uint8_t* prevlab = dname;
 119         size_t dnamelen = 0;
 120
 121         /* one byte needed for label length */
 122         if(dnamelen+1 > maxdnamelen)
 123                 return NULL;
 124
 125         /* only root label */
 126         if(*dname == 0)
 127                 return NULL;
 128
 129         while(*dname) {
 130                 dnamelen += ((size_t)*dname)+1;
 131                 if(dnamelen+1 > maxdnamelen)
 132                         return NULL;
 133                 dname = dname+((size_t)*dname)+1;
 134                 if(*dname != 0)
 135                         prevlab = dname;
 136         }
 137         return prevlab;
 138 }
 139
 140 /**
 141  * Classify RPZ action for RR type/rdata
 142  * @param rr_type: the RR type
 143  * @param rdatawl: RDATA with 2 bytes length
 144  * @param rdatalen: the length of rdatawl (including its 2 bytes length)
 145  * @return: the RPZ action
 146  */
 147 static enum rpz_action
 148 rpz_rr_to_action(uint16_t rr_type, uint8_t* rdatawl, size_t rdatalen)
 149 {
 150         char* endptr;
 151         uint8_t* rdata;
 152         int rdatalabs;
 153         uint8_t* tldlab = NULL;
 154
 155         switch(rr_type) {
 156                 case LDNS_RR_TYPE_SOA:
 157                 case LDNS_RR_TYPE_NS:
 158                 case LDNS_RR_TYPE_DNAME:
 159                 /* all DNSSEC-related RRs must be ignored */
 160                 case LDNS_RR_TYPE_DNSKEY:
 161                 case LDNS_RR_TYPE_DS:
 162                 case LDNS_RR_TYPE_RRSIG:
 163                 case LDNS_RR_TYPE_NSEC:
 164                 case LDNS_RR_TYPE_NSEC3:
 165                         return RPZ_INVALID_ACTION;
 166                 case LDNS_RR_TYPE_CNAME:
 167                         break;
 168                 default:
 169                         return RPZ_LOCAL_DATA_ACTION;
 170         }
 171
 172         /* use CNAME target to determine RPZ action */
 173         log_assert(rr_type == LDNS_RR_TYPE_CNAME);
 174         if(rdatalen < 3)
 175                 return RPZ_INVALID_ACTION;
 176
 177         rdata = rdatawl + 2; /* 2 bytes of rdata length */
 178         if(dname_valid(rdata, rdatalen-2) != rdatalen-2)
 179                 return RPZ_INVALID_ACTION;
 180
 181         rdatalabs = dname_count_labels(rdata);
 182         if(rdatalabs == 1)
 183                 return RPZ_NXDOMAIN_ACTION;
 184         else if(rdatalabs == 2) {
 185                 if(dname_subdomain_c(rdata, (uint8_t*)&"\001*\000"))
 186                         return RPZ_NODATA_ACTION;
 187                 else if(dname_subdomain_c(rdata,
 188                         (uint8_t*)&"\014rpz-passthru\000"))
 189                         return RPZ_PASSTHRU_ACTION;
 190                 else if(dname_subdomain_c(rdata, (uint8_t*)&"\010rpz-drop\000"))
 191                         return RPZ_DROP_ACTION;
 192                 else if(dname_subdomain_c(rdata,
 193                         (uint8_t*)&"\014rpz-tcp-only\000"))
 194                         return RPZ_TCP_ONLY_ACTION;
 195         }
 196
 197         /* all other TLDs starting with "rpz-" are invalid */
 198         tldlab = get_tld_label(rdata, rdatalen-2);
 199         if(tldlab && dname_lab_startswith(tldlab, "rpz-", &endptr))
 200                 return RPZ_INVALID_ACTION;
 201
 202         /* no special label found */
 203         return RPZ_LOCAL_DATA_ACTION;
 204 }
 205
 206 static enum localzone_type
 207 rpz_action_to_localzone_type(enum rpz_action a)
 208 {
 209         switch(a) {
 210         case RPZ_NXDOMAIN_ACTION:       return local_zone_always_nxdomain;
 211         case RPZ_NODATA_ACTION:         return local_zone_always_nodata;
 212         case RPZ_DROP_ACTION:           return local_zone_always_deny;
 213         case RPZ_PASSTHRU_ACTION:       return local_zone_always_transparent;
 214         case RPZ_LOCAL_DATA_ACTION:     /* fallthrough */
 215         case RPZ_CNAME_OVERRIDE_ACTION: return local_zone_redirect;
 216         case RPZ_INVALID_ACTION:        /* fallthrough */
 217         case RPZ_TCP_ONLY_ACTION:       /* fallthrough */
 218         default:                        return local_zone_invalid;
 219         }
 220 }
 221
 222 enum respip_action
 223 rpz_action_to_respip_action(enum rpz_action a)
 224 {
 225         switch(a) {
 226         case RPZ_NXDOMAIN_ACTION:       return respip_always_nxdomain;
 227         case RPZ_NODATA_ACTION:         return respip_always_nodata;
 228         case RPZ_DROP_ACTION:           return respip_always_deny;
 229         case RPZ_PASSTHRU_ACTION:       return respip_always_transparent;
 230         case RPZ_LOCAL_DATA_ACTION:     /* fallthrough */
 231         case RPZ_CNAME_OVERRIDE_ACTION: return respip_redirect;
 232         case RPZ_INVALID_ACTION:        /* fallthrough */
 233         case RPZ_TCP_ONLY_ACTION:       /* fallthrough */
 234         default:                        return respip_invalid;
 235         }
 236 }
 237
 238 static enum rpz_action
 239 localzone_type_to_rpz_action(enum localzone_type lzt)
 240 {
 241         switch(lzt) {
 242         case local_zone_always_nxdomain:        return RPZ_NXDOMAIN_ACTION;
 243         case local_zone_always_nodata:          return RPZ_NODATA_ACTION;
 244         case local_zone_always_deny:            return RPZ_DROP_ACTION;
 245         case local_zone_always_transparent:     return RPZ_PASSTHRU_ACTION;
 246         case local_zone_redirect:               return RPZ_LOCAL_DATA_ACTION;
 247         case local_zone_invalid:
 248         default:
 249                 return RPZ_INVALID_ACTION;
 250         }
 251 }
 252
 253 enum rpz_action
 254 respip_action_to_rpz_action(enum respip_action a)
 255 {
 256         switch(a) {
 257         case respip_always_nxdomain:    return RPZ_NXDOMAIN_ACTION;
 258         case respip_always_nodata:      return RPZ_NODATA_ACTION;
 259         case respip_always_deny:        return RPZ_DROP_ACTION;
 260         case respip_always_transparent: return RPZ_PASSTHRU_ACTION;
 261         case respip_redirect:           return RPZ_LOCAL_DATA_ACTION;
 262         case respip_invalid:
 263         default:
 264                 return RPZ_INVALID_ACTION;
 265         }
 266 }
 267
 268 /**
 269  * Get RPZ trigger for dname
 270  * @param dname: dname containing RPZ trigger
 271  * @param dname_len: length of the dname
 272  * @return: RPZ trigger enum
 273  */
 274 static enum rpz_trigger
 275 rpz_dname_to_trigger(uint8_t* dname, size_t dname_len)
 276 {
 277         uint8_t* tldlab;
 278         char* endptr;
 279
 280         if(dname_valid(dname, dname_len) != dname_len)
 281                 return RPZ_INVALID_TRIGGER;
 282
 283         tldlab = get_tld_label(dname, dname_len);
 284         if(!tldlab || !dname_lab_startswith(tldlab, "rpz-", &endptr))
 285                 return RPZ_QNAME_TRIGGER;
 286
 287         if(dname_subdomain_c(tldlab,
 288                 (uint8_t*)&"\015rpz-client-ip\000"))
 289                 return RPZ_CLIENT_IP_TRIGGER;
 290         else if(dname_subdomain_c(tldlab, (uint8_t*)&"\006rpz-ip\000"))
 291                 return RPZ_RESPONSE_IP_TRIGGER;
 292         else if(dname_subdomain_c(tldlab, (uint8_t*)&"\013rpz-nsdname\000"))
 293                 return RPZ_NSDNAME_TRIGGER;
 294         else if(dname_subdomain_c(tldlab, (uint8_t*)&"\010rpz-nsip\000"))
 295                 return RPZ_NSIP_TRIGGER;
 296
 297         return RPZ_QNAME_TRIGGER;
 298 }
 299
 300 void rpz_delete(struct rpz* r)
 301 {
 302         if(!r)
 303                 return;
 304         local_zones_delete(r->local_zones);
 305         respip_set_delete(r->respip_set);
 306         regional_destroy(r->region);
 307         free(r->taglist);
 308         free(r->log_name);
 309         free(r);
 310 }
 311
 312 int
 313 rpz_clear(struct rpz* r)
 314 {
 315         /* must hold write lock on auth_zone */
 316         local_zones_delete(r->local_zones);
 317         respip_set_delete(r->respip_set);
 318         if(!(r->local_zones = local_zones_create())){
 319                 return 0;
 320         }
 321         if(!(r->respip_set = respip_set_create())) {
 322                 return 0;
 323         }
 324         return 1;
 325 }
 326
 327 void
 328 rpz_finish_config(struct rpz* r)
 329 {
 330         lock_rw_wrlock(&r->respip_set->lock);
 331         addr_tree_init_parents(&r->respip_set->ip_tree);
 332         lock_rw_unlock(&r->respip_set->lock);
 333 }
 334
 335 /** new rrset containing CNAME override, does not yet contain a dname */
 336 static struct ub_packed_rrset_key*
 337 new_cname_override(struct regional* region, uint8_t* ct, size_t ctlen)
 338 {
 339         struct ub_packed_rrset_key* rrset;
 340         struct packed_rrset_data* pd;
 341         uint16_t rdlength = htons(ctlen);
 342         rrset = (struct ub_packed_rrset_key*)regional_alloc_zero(region,
 343                 sizeof(*rrset));
 344         if(!rrset) {
 345                 log_err("out of memory");
 346                 return NULL;
 347         }
 348         rrset->entry.key = rrset;
 349         pd = (struct packed_rrset_data*)regional_alloc_zero(region, sizeof(*pd));
 350         if(!pd) {
 351                 log_err("out of memory");
 352                 return NULL;
 353         }
 354         pd->trust = rrset_trust_prim_noglue;
 355         pd->security = sec_status_insecure;
 356
 357         pd->count = 1;
 358         pd->rr_len = regional_alloc_zero(region, sizeof(*pd->rr_len));
 359         pd->rr_ttl = regional_alloc_zero(region, sizeof(*pd->rr_ttl));
 360         pd->rr_data = regional_alloc_zero(region, sizeof(*pd->rr_data));
 361         if(!pd->rr_len || !pd->rr_ttl || !pd->rr_data) {
 362                 log_err("out of memory");
 363                 return NULL;
 364         }
 365         pd->rr_len[0] = ctlen+2;
 366         pd->rr_ttl[0] = 3600;
 367         pd->rr_data[0] = regional_alloc_zero(region, 2 /* rdlength */ + ctlen);
 368         if(!pd->rr_data[0]) {
 369                 log_err("out of memory");
 370                 return NULL;
 371         }
 372         memmove(pd->rr_data[0], &rdlength, 2);
 373         memmove(pd->rr_data[0]+2, ct, ctlen);
 374
 375         rrset->entry.data = pd;
 376         rrset->rk.type = htons(LDNS_RR_TYPE_CNAME);
 377         rrset->rk.rrset_class = htons(LDNS_RR_CLASS_IN);
 378         return rrset;
 379 }
 380
 381 struct rpz*
 382 rpz_create(struct config_auth* p)
 383 {
 384         struct rpz* r = calloc(1, sizeof(*r));
 385         if(!r)
 386                 goto err;
 387
 388         r->region = regional_create_custom(sizeof(struct regional));
 389         if(!r->region) {
 390                 goto err;
 391         }
 392
 393         if(!(r->local_zones = local_zones_create())){
 394                 goto err;
 395         }
 396         if(!(r->respip_set = respip_set_create())) {
 397                 goto err;
 398         }
 399         r->taglistlen = p->rpz_taglistlen;
 400         r->taglist = memdup(p->rpz_taglist, r->taglistlen);
 401         if(p->rpz_action_override) {
 402                 r->action_override = rpz_config_to_action(p->rpz_action_override);
 403         }
 404         else
 405                 r->action_override = RPZ_NO_OVERRIDE_ACTION;
 406
 407         if(r->action_override == RPZ_CNAME_OVERRIDE_ACTION) {
 408                 uint8_t nm[LDNS_MAX_DOMAINLEN+1];
 409                 size_t nmlen = sizeof(nm);
 410
 411                 if(!p->rpz_cname) {
 412                         log_err("RPZ override with cname action found, but no "
 413                                 "rpz-cname-override configured");
 414                         goto err;
 415                 }
 416
 417                 if(sldns_str2wire_dname_buf(p->rpz_cname, nm, &nmlen) != 0) {
 418                         log_err("cannot parse RPZ cname override: %s",
 419                                 p->rpz_cname);
 420                         goto err;
 421                 }
 422                 r->cname_override = new_cname_override(r->region, nm, nmlen);
 423                 if(!r->cname_override) {
 424                         goto err;
 425                 }
 426         }
 427         r->log = p->rpz_log;
 428         if(p->rpz_log_name) {
 429                 if(!(r->log_name = strdup(p->rpz_log_name))) {
 430                         log_err("malloc failure on RPZ log_name strdup");
 431                         goto err;
 432                 }
 433         }
 434         return r;
 435 err:
 436         if(r) {
 437                 if(r->local_zones)
 438                         local_zones_delete(r->local_zones);
 439                 if(r->respip_set)
 440                         respip_set_delete(r->respip_set);
 441                 if(r->taglist)
 442                         free(r->taglist);
 443                 free(r);
 444         }
 445         return NULL;
 446 }
 447
 448 /**
 449  * Remove RPZ zone name from dname
 450  * Copy dname to newdname, without the originlen number of trailing bytes
 451  */
 452 static size_t
 453 strip_dname_origin(uint8_t* dname, size_t dnamelen, size_t originlen,
 454         uint8_t* newdname, size_t maxnewdnamelen)
 455 {
 456         size_t newdnamelen;
 457         if(dnamelen < originlen)
 458                 return 0;
 459         newdnamelen = dnamelen - originlen;
 460         if(newdnamelen+1 > maxnewdnamelen)
 461                 return 0;
 462         memmove(newdname, dname, newdnamelen);
 463         newdname[newdnamelen] = 0;
 464         return newdnamelen + 1; /* + 1 for root label */
 465 }
 466
 467 /** Insert RR into RPZ's local-zone */
 468 static void
 469 rpz_insert_qname_trigger(struct rpz* r, uint8_t* dname, size_t dnamelen,
 470         enum rpz_action a, uint16_t rrtype, uint16_t rrclass, uint32_t ttl,
 471         uint8_t* rdata, size_t rdata_len, uint8_t* rr, size_t rr_len)
 472 {
 473         struct local_zone* z;
 474         enum localzone_type tp = local_zone_always_transparent;
 475         int dnamelabs = dname_count_labels(dname);
 476         char* rrstr;
 477         int newzone = 0;
 478
 479         if(a == RPZ_TCP_ONLY_ACTION || a == RPZ_INVALID_ACTION) {
 480                 verbose(VERB_ALGO, "RPZ: skipping unsupported action: %s",
 481                         rpz_action_to_string(a));
 482                 free(dname);
 483                 return;
 484         }
 485
 486         lock_rw_wrlock(&r->local_zones->lock);
 487         /* exact match */
 488         z = local_zones_find(r->local_zones, dname, dnamelen, dnamelabs,
 489                 LDNS_RR_CLASS_IN);
 490         if(z && a != RPZ_LOCAL_DATA_ACTION) {
 491                 rrstr = sldns_wire2str_rr(rr, rr_len);
 492                 if(!rrstr) {
 493                         log_err("malloc error while inserting RPZ qname "
 494                                 "trigger");
 495                         free(dname);
 496                         lock_rw_unlock(&r->local_zones->lock);
 497                         return;
 498                 }
 499                 verbose(VERB_ALGO, "RPZ: skipping duplicate record: '%s'",
 500                         rrstr);
 501                 free(rrstr);
 502                 free(dname);
 503                 lock_rw_unlock(&r->local_zones->lock);
 504                 return;
 505         }
 506         if(!z) {
 507                 tp = rpz_action_to_localzone_type(a);
 508                 if(!(z = local_zones_add_zone(r->local_zones, dname, dnamelen,
 509                         dnamelabs, rrclass, tp))) {
 510                         log_warn("RPZ create failed");
 511                         lock_rw_unlock(&r->local_zones->lock);
 512                         /* dname will be free'd in failed local_zone_create() */
 513                         return;
 514                 }
 515                 newzone = 1;
 516         }
 517         if(a == RPZ_LOCAL_DATA_ACTION) {
 518                 rrstr = sldns_wire2str_rr(rr, rr_len);
 519                 if(!rrstr) {
 520                         log_err("malloc error while inserting RPZ qname "
 521                                 "trigger");
 522                         free(dname);
 523                         lock_rw_unlock(&r->local_zones->lock);
 524                         return;
 525                 }
 526                 lock_rw_wrlock(&z->lock);
 527                 local_zone_enter_rr(z, dname, dnamelen, dnamelabs,
 528                         rrtype, rrclass, ttl, rdata, rdata_len, rrstr);
 529                 lock_rw_unlock(&z->lock);
 530                 free(rrstr);
 531         }
 532         if(!newzone)
 533                 free(dname);
 534         lock_rw_unlock(&r->local_zones->lock);
 535         return;
 536 }
 537
 538 /** Insert RR into RPZ's respip_set */
 539 static int
 540 rpz_insert_response_ip_trigger(struct rpz* r, uint8_t* dname, size_t dnamelen,
 541         enum rpz_action a, uint16_t rrtype, uint16_t rrclass, uint32_t ttl,
 542         uint8_t* rdata, size_t rdata_len, uint8_t* rr, size_t rr_len)
 543 {
 544         struct resp_addr* node;
 545         struct sockaddr_storage addr;
 546         socklen_t addrlen;
 547         int net, af;
 548         char* rrstr;
 549         enum respip_action respa = rpz_action_to_respip_action(a);
 550
 551         if(a == RPZ_TCP_ONLY_ACTION || a == RPZ_INVALID_ACTION ||
 552                 respa == respip_invalid) {
 553                 verbose(VERB_ALGO, "RPZ: skipping unsupported action: %s",
 554                         rpz_action_to_string(a));
 555                 return 0;
 556         }
 557
 558         if(!netblockdnametoaddr(dname, dnamelen, &addr, &addrlen, &net, &af))
 559                 return 0;
 560
 561         lock_rw_wrlock(&r->respip_set->lock);
 562         rrstr = sldns_wire2str_rr(rr, rr_len);
 563         if(!rrstr) {
 564                 log_err("malloc error while inserting RPZ respip trigger");
 565                 lock_rw_unlock(&r->respip_set->lock);
 566                 return 0;
 567         }
 568         if(!(node=respip_sockaddr_find_or_create(r->respip_set, &addr, addrlen,
 569                 net, 1, rrstr))) {
 570                 lock_rw_unlock(&r->respip_set->lock);
 571                 free(rrstr);
 572                 return 0;
 573         }
 574
 575         lock_rw_wrlock(&node->lock);
 576         lock_rw_unlock(&r->respip_set->lock);
 577         node->action = respa;
 578
 579         if(a == RPZ_LOCAL_DATA_ACTION) {
 580                 respip_enter_rr(r->respip_set->region, node, rrtype,
 581                         rrclass, ttl, rdata, rdata_len, rrstr, "");
 582         }
 583         lock_rw_unlock(&node->lock);
 584         free(rrstr);
 585         return 1;
 586 }
 587
 588 int
 589 rpz_insert_rr(struct rpz* r, size_t aznamelen, uint8_t* dname,
 590         size_t dnamelen, uint16_t rr_type, uint16_t rr_class, uint32_t rr_ttl,
 591         uint8_t* rdatawl, size_t rdatalen, uint8_t* rr, size_t rr_len)
 592 {
 593         size_t policydnamelen;
 594         /* name is free'd in local_zone delete */
 595         enum rpz_trigger t;
 596         enum rpz_action a;
 597         uint8_t* policydname;
 598
 599         log_assert(dnamelen >= aznamelen);
 600         if(!(policydname = calloc(1, (dnamelen-aznamelen)+1)))
 601                 return 0;
 602
 603         a = rpz_rr_to_action(rr_type, rdatawl, rdatalen);
 604         if(!(policydnamelen = strip_dname_origin(dname, dnamelen, aznamelen,
 605                 policydname, (dnamelen-aznamelen)+1))) {
 606                 free(policydname);
 607                 return 0;
 608         }
 609         t = rpz_dname_to_trigger(policydname, policydnamelen);
 610         if(t == RPZ_INVALID_TRIGGER) {
 611                 free(policydname);
 612                 verbose(VERB_ALGO, "RPZ: skipping invalid trigger");
 613                 return 1;
 614         }
 615         if(t == RPZ_QNAME_TRIGGER) {
 616                 rpz_insert_qname_trigger(r, policydname, policydnamelen,
 617                         a, rr_type, rr_class, rr_ttl, rdatawl, rdatalen, rr,
 618                         rr_len);
 619         }
 620         else if(t == RPZ_RESPONSE_IP_TRIGGER) {
 621                 rpz_insert_response_ip_trigger(r, policydname, policydnamelen,
 622                         a, rr_type, rr_class, rr_ttl, rdatawl, rdatalen, rr,
 623                         rr_len);
 624                 free(policydname);
 625         }
 626         else {
 627                 free(policydname);
 628                 verbose(VERB_ALGO, "RPZ: skipping unsupported trigger: %s",
 629                         rpz_trigger_to_string(t));
 630         }
 631         return 1;
 632 }
 633
 634 /**
 635  * Find RPZ local-zone by qname.
 636  * @param r: rpz containing local-zone tree
 637  * @param qname: qname
 638  * @param qname_len: length of qname
 639  * @param qclass: qclass
 640  * @param only_exact: if 1 only excact (non wildcard) matches are returned
 641  * @param wr: get write lock for local-zone if 1, read lock if 0
 642  * @param zones_keep_lock: if set do not release the r->local_zones lock, this
 643  *        makes the caller of this function responsible for releasing the lock.
 644  * @return: NULL or local-zone holding rd or wr lock
 645  */
 646 static struct local_zone*
 647 rpz_find_zone(struct rpz* r, uint8_t* qname, size_t qname_len, uint16_t qclass,
 648         int only_exact, int wr, int zones_keep_lock)
 649 {
 650         uint8_t* ce;
 651         size_t ce_len, ce_labs;
 652         uint8_t wc[LDNS_MAX_DOMAINLEN+1];
 653         int exact;
 654         struct local_zone* z = NULL;
 655         if(wr) {
 656                 lock_rw_wrlock(&r->local_zones->lock);
 657         } else {
 658                 lock_rw_rdlock(&r->local_zones->lock);
 659         }
 660         z = local_zones_find_le(r->local_zones, qname, qname_len,
 661                 dname_count_labels(qname),
 662                 LDNS_RR_CLASS_IN, &exact);
 663         if(!z || (only_exact && !exact)) {
 664                 lock_rw_unlock(&r->local_zones->lock);
 665                 return NULL;
 666         }
 667         if(wr) {
 668                 lock_rw_wrlock(&z->lock);
 669         } else {
 670                 lock_rw_rdlock(&z->lock);
 671         }
 672         if(!zones_keep_lock) {
 673                 lock_rw_unlock(&r->local_zones->lock);
 674         }
 675
 676         if(exact)
 677                 return z;
 678
 679         /* No exact match found, lookup wildcard. closest encloser must
 680          * be the shared parent between the qname and the best local
 681          * zone match, append '*' to that and do another lookup. */
 682
 683         ce = dname_get_shared_topdomain(z->name, qname);
 684         if(!ce /* should not happen */ || !*ce /* root */) {
 685                 lock_rw_unlock(&z->lock);
 686                 if(zones_keep_lock) {
 687                         lock_rw_unlock(&r->local_zones->lock);
 688                 }
 689                 return NULL;
 690         }
 691         ce_labs = dname_count_size_labels(ce, &ce_len);
 692         if(ce_len+2 > sizeof(wc)) {
 693                 lock_rw_unlock(&z->lock);
 694                 if(zones_keep_lock) {
 695                         lock_rw_unlock(&r->local_zones->lock);
 696                 }
 697                 return NULL;
 698         }
 699         wc[0] = 1; /* length of wildcard label */
 700         wc[1] = (uint8_t)'*'; /* wildcard label */
 701         memmove(wc+2, ce, ce_len);
 702         lock_rw_unlock(&z->lock);
 703
 704         if(!zones_keep_lock) {
 705                 if(wr) {
 706                         lock_rw_wrlock(&r->local_zones->lock);
 707                 } else {
 708                         lock_rw_rdlock(&r->local_zones->lock);
 709                 }
 710         }
 711         z = local_zones_find_le(r->local_zones, wc,
 712                 ce_len+2, ce_labs+1, qclass, &exact);
 713         if(!z || !exact) {
 714                 lock_rw_unlock(&r->local_zones->lock);
 715                 return NULL;
 716         }
 717         if(wr) {
 718                 lock_rw_wrlock(&z->lock);
 719         } else {
 720                 lock_rw_rdlock(&z->lock);
 721         }
 722         if(!zones_keep_lock) {
 723                 lock_rw_unlock(&r->local_zones->lock);
 724         }
 725         return z;
 726 }
 727
 728 /**
 729  * Remove RR from RPZ's local-data
 730  * @param z: local-zone for RPZ, holding write lock
 731  * @param policydname: dname of RR to remove
 732  * @param policydnamelen: lenth of policydname
 733  * @param rr_type: RR type of RR to remove
 734  * @param rdata: rdata of RR to remove
 735  * @param rdatalen: length of rdata
 736  * @return: 1 if zone must be removed after RR deletion
 737  */
 738 static int
 739 rpz_data_delete_rr(struct local_zone* z, uint8_t* policydname,
 740         size_t policydnamelen, uint16_t rr_type, uint8_t* rdata,
 741         size_t rdatalen)
 742 {
 743         struct local_data* ld;
 744         struct packed_rrset_data* d;
 745         size_t index;
 746         ld = local_zone_find_data(z, policydname, policydnamelen,
 747                 dname_count_labels(policydname));
 748         if(ld) {
 749                 struct local_rrset* prev=NULL, *p=ld->rrsets;
 750                 while(p && ntohs(p->rrset->rk.type) != rr_type) {
 751                         prev = p;
 752                         p = p->next;
 753                 }
 754                 if(!p)
 755                         return 0;
 756                 d = (struct packed_rrset_data*)p->rrset->entry.data;
 757                 if(packed_rrset_find_rr(d, rdata, rdatalen, &index)) {
 758                         if(d->count == 1) {
 759                                 /* no memory recycling for zone deletions ... */
 760                                 if(prev) prev->next = p->next;
 761                                 else ld->rrsets = p->next;
 762                         }
 763                         if(d->count > 1) {
 764                                 if(!local_rrset_remove_rr(d, index))
 765                                         return 0;
 766                         }
 767                 }
 768         }
 769         if(ld && ld->rrsets)
 770                 return 0;
 771         return 1;
 772 }
 773
 774 /**
 775  * Remove RR from RPZ's respip set
 776  * @param raddr: respip node
 777  * @param rr_type: RR type of RR to remove
 778  * @param rdata: rdata of RR to remove
 779  * @param rdatalen: length of rdata
 780  * @return: 1 if zone must be removed after RR deletion
 781  */
 782 static int
 783 rpz_rrset_delete_rr(struct resp_addr* raddr, uint16_t rr_type, uint8_t* rdata,
 784         size_t rdatalen)
 785 {
 786         size_t index;
 787         struct packed_rrset_data* d;
 788         if(!raddr->data)
 789                 return 1;
 790         d = raddr->data->entry.data;
 791         if(ntohs(raddr->data->rk.type) != rr_type) {
 792                 return 0;
 793         }
 794         if(packed_rrset_find_rr(d, rdata, rdatalen, &index)) {
 795                 if(d->count == 1) {
 796                         /* regional alloc'd */
 797                         raddr->data->entry.data = NULL;
 798                         raddr->data = NULL;
 799                         return 1;
 800                 }
 801                 if(d->count > 1) {
 802                         if(!local_rrset_remove_rr(d, index))
 803                                 return 0;
 804                 }
 805         }
 806         return 0;
 807
 808 }
 809
 810 /** Remove RR from RPZ's local-zone */
 811 static void
 812 rpz_remove_qname_trigger(struct rpz* r, uint8_t* dname, size_t dnamelen,
 813         enum rpz_action a, uint16_t rr_type, uint16_t rr_class,
 814         uint8_t* rdatawl, size_t rdatalen)
 815 {
 816         struct local_zone* z;
 817         int delete_zone = 1;
 818         z = rpz_find_zone(r, dname, dnamelen, rr_class,
 819                 1 /* only exact */, 1 /* wr lock */, 1 /* keep lock*/);
 820         if(!z) {
 821                 verbose(VERB_ALGO, "RPZ: cannot remove RR from IXFR, "
 822                         "RPZ domain not found");
 823                 return;
 824         }
 825         if(a == RPZ_LOCAL_DATA_ACTION)
 826                 delete_zone = rpz_data_delete_rr(z, dname,
 827                         dnamelen, rr_type, rdatawl, rdatalen);
 828         else if(a != localzone_type_to_rpz_action(z->type)) {
 829                 return;
 830         }
 831         lock_rw_unlock(&z->lock);
 832         if(delete_zone) {
 833                 local_zones_del_zone(r->local_zones, z);
 834         }
 835         lock_rw_unlock(&r->local_zones->lock);
 836         return;
 837 }
 838
 839 static void
 840 rpz_remove_response_ip_trigger(struct rpz* r, uint8_t* dname, size_t dnamelen,
 841         enum rpz_action a, uint16_t rr_type, uint8_t* rdatawl, size_t rdatalen)
 842 {
 843         struct resp_addr* node;
 844         struct sockaddr_storage addr;
 845         socklen_t addrlen;
 846         int net, af;
 847         int delete_respip = 1;
 848
 849         if(!netblockdnametoaddr(dname, dnamelen, &addr, &addrlen, &net, &af))
 850                 return;
 851
 852         lock_rw_wrlock(&r->respip_set->lock);
 853         if(!(node = (struct resp_addr*)addr_tree_find(
 854                 &r->respip_set->ip_tree, &addr, addrlen, net))) {
 855                 verbose(VERB_ALGO, "RPZ: cannot remove RR from IXFR, "
 856                         "RPZ domain not found");
 857                 lock_rw_unlock(&r->respip_set->lock);
 858                 return;
 859         }
 860
 861         lock_rw_wrlock(&node->lock);
 862         if(a == RPZ_LOCAL_DATA_ACTION) {
 863                 /* remove RR, signal whether RR can be removed */
 864                 delete_respip = rpz_rrset_delete_rr(node, rr_type, rdatawl,
 865                         rdatalen);
 866         }
 867         lock_rw_unlock(&node->lock);
 868         if(delete_respip)
 869                 respip_sockaddr_delete(r->respip_set, node);
 870         lock_rw_unlock(&r->respip_set->lock);
 871 }
 872
 873 void
 874 rpz_remove_rr(struct rpz* r, size_t aznamelen, uint8_t* dname, size_t dnamelen,
 875         uint16_t rr_type, uint16_t rr_class, uint8_t* rdatawl, size_t rdatalen)
 876 {
 877         size_t policydnamelen;
 878         enum rpz_trigger t;
 879         enum rpz_action a;
 880         uint8_t* policydname;
 881
 882         if(!(policydname = calloc(1, LDNS_MAX_DOMAINLEN + 1)))
 883                 return;
 884
 885         a = rpz_rr_to_action(rr_type, rdatawl, rdatalen);
 886         if(a == RPZ_INVALID_ACTION) {
 887                 free(policydname);
 888                 return;
 889         }
 890         if(!(policydnamelen = strip_dname_origin(dname, dnamelen, aznamelen,
 891                 policydname, LDNS_MAX_DOMAINLEN + 1))) {
 892                 free(policydname);
 893                 return;
 894         }
 895         t = rpz_dname_to_trigger(policydname, policydnamelen);
 896         if(t == RPZ_QNAME_TRIGGER) {
 897                 rpz_remove_qname_trigger(r, policydname, policydnamelen, a,
 898                         rr_type, rr_class, rdatawl, rdatalen);
 899         } else if(t == RPZ_RESPONSE_IP_TRIGGER) {
 900                 rpz_remove_response_ip_trigger(r, policydname, policydnamelen,
 901                         a, rr_type, rdatawl, rdatalen);
 902         }
 903         free(policydname);
 904 }
 905
 906 /** print log information for an applied RPZ policy. Based on local-zone's
 907  * lz_inform_print().
 908  */
 909 static void
 910 log_rpz_apply(uint8_t* dname, enum rpz_action a, struct query_info* qinfo,
 911         struct comm_reply* repinfo, char* log_name)
 912 {
 913         char ip[128], txt[512];
 914         char dnamestr[LDNS_MAX_DOMAINLEN+1];
 915         uint16_t port = ntohs(((struct sockaddr_in*)&repinfo->addr)->sin_port);
 916         dname_str(dname, dnamestr);
 917         addr_to_str(&repinfo->addr, repinfo->addrlen, ip, sizeof(ip));
 918         if(log_name)
 919                 snprintf(txt, sizeof(txt), "RPZ applied [%s] %s %s %s@%u",
 920                         log_name, dnamestr, rpz_action_to_string(a), ip,
 921                         (unsigned)port);
 922         else
 923                 snprintf(txt, sizeof(txt), "RPZ applied %s %s %s@%u",
 924                         dnamestr, rpz_action_to_string(a), ip, (unsigned)port);
 925         log_nametypeclass(0, txt, qinfo->qname, qinfo->qtype, qinfo->qclass);
 926 }
 927
 928 int
 929 rpz_apply_qname_trigger(struct auth_zones* az, struct module_env* env,
 930         struct query_info* qinfo, struct edns_data* edns, sldns_buffer* buf,
 931         struct regional* temp, struct comm_reply* repinfo,
 932         uint8_t* taglist, size_t taglen, struct ub_server_stats* stats)
 933 {
 934         struct rpz* r;
 935         int ret;
 936         enum localzone_type lzt;
 937         struct local_zone* z = NULL;
 938         struct local_data* ld = NULL;
 939         lock_rw_rdlock(&az->rpz_lock);
 940         for(r = az->rpz_first; r; r = r->next) {
 941                 if(!r->taglist || taglist_intersect(r->taglist,
 942                         r->taglistlen, taglist, taglen)) {
 943                         z = rpz_find_zone(r, qinfo->qname, qinfo->qname_len,
 944                                 qinfo->qclass, 0, 0, 0);
 945                         if(z && r->action_override == RPZ_DISABLED_ACTION) {
 946                                 if(r->log)
 947                                         log_rpz_apply(z->name,
 948                                                 r->action_override,
 949                                                 qinfo, repinfo, r->log_name);
 950                                 /* TODO only register stats when stats_extended?
 951                                  * */
 952                                 stats->rpz_action[r->action_override]++;
 953                                 lock_rw_unlock(&z->lock);
 954                                 z = NULL;
 955                         }
 956                         if(z)
 957                                 break;
 958                 }
 959         }
 960         lock_rw_unlock(&az->rpz_lock);
 961         if(!z)
 962                 return 0;
 963
 964
 965         if(r->action_override == RPZ_NO_OVERRIDE_ACTION)
 966                 lzt = z->type;
 967         else
 968                 lzt = rpz_action_to_localzone_type(r->action_override);
 969
 970         if(r->action_override == RPZ_CNAME_OVERRIDE_ACTION) {
 971                 qinfo->local_alias =
 972                         regional_alloc_zero(temp, sizeof(struct local_rrset));
 973                 if(!qinfo->local_alias) {
 974                         lock_rw_unlock(&z->lock);
 975                         return 0; /* out of memory */
 976                 }
 977                 qinfo->local_alias->rrset =
 978                         regional_alloc_init(temp, r->cname_override,
 979                                 sizeof(*r->cname_override));
 980                 if(!qinfo->local_alias->rrset) {
 981                         lock_rw_unlock(&z->lock);
 982                         return 0; /* out of memory */
 983                 }
 984                 qinfo->local_alias->rrset->rk.dname = qinfo->qname;
 985                 qinfo->local_alias->rrset->rk.dname_len = qinfo->qname_len;
 986                 if(r->log)
 987                         log_rpz_apply(z->name, RPZ_CNAME_OVERRIDE_ACTION,
 988                                 qinfo, repinfo, r->log_name);
 989                 stats->rpz_action[RPZ_CNAME_OVERRIDE_ACTION]++;
 990                 lock_rw_unlock(&z->lock);
 991                 return 0;
 992         }
 993
 994         if(lzt == local_zone_redirect && local_data_answer(z, env, qinfo,
 995                 edns, repinfo, buf, temp, dname_count_labels(qinfo->qname),
 996                 &ld, lzt, -1, NULL, 0, NULL, 0)) {
 997                 if(r->log)
 998                         log_rpz_apply(z->name,
 999                                 localzone_type_to_rpz_action(lzt), qinfo,
1000                                 repinfo, r->log_name);
1001                 stats->rpz_action[localzone_type_to_rpz_action(lzt)]++;
1002                 lock_rw_unlock(&z->lock);
1003                 return !qinfo->local_alias;
1004         }
1005
1006         ret = local_zones_zone_answer(z, env, qinfo, edns, repinfo, buf, temp,
1007                 0 /* no local data used */, lzt);
1008         if(r->log)
1009                 log_rpz_apply(z->name, localzone_type_to_rpz_action(lzt),
1010                         qinfo, repinfo, r->log_name);
1011         stats->rpz_action[localzone_type_to_rpz_action(lzt)]++;
1012         lock_rw_unlock(&z->lock);
1013
1014         return ret;
1015 }