/contrib/bind9/lib/dns/rpz.c

https://bitbucket.org/freebsd/freebsd-head/ · C · 1183 lines · 822 code · 109 blank · 252 comment · 273 complexity · e5ba7ee1be9f9febee87039e6836207f MD5 · raw file

  1. /*
  2. * Copyright (C) 2011, 2012 Internet Systems Consortium, Inc. ("ISC")
  3. *
  4. * Permission to use, copy, modify, and/or distribute this software for any
  5. * purpose with or without fee is hereby granted, provided that the above
  6. * copyright notice and this permission notice appear in all copies.
  7. *
  8. * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
  9. * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
  10. * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
  11. * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
  12. * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
  13. * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  14. * PERFORMANCE OF THIS SOFTWARE.
  15. */
  16. /* $Id$ */
  17. /*! \file */
  18. #include <config.h>
  19. #include <isc/buffer.h>
  20. #include <isc/mem.h>
  21. #include <isc/net.h>
  22. #include <isc/netaddr.h>
  23. #include <isc/print.h>
  24. #include <isc/stdlib.h>
  25. #include <isc/string.h>
  26. #include <isc/util.h>
  27. #include <dns/db.h>
  28. #include <dns/fixedname.h>
  29. #include <dns/log.h>
  30. #include <dns/rdata.h>
  31. #include <dns/rdataset.h>
  32. #include <dns/rdatastruct.h>
  33. #include <dns/result.h>
  34. #include <dns/rpz.h>
  35. #include <dns/view.h>
  36. /*
  37. * Parallel radix trees for databases of response policy IP addresses
  38. *
  39. * The radix or Patricia trees are somewhat specialized to handle response
  40. * policy addresses by representing the two test of IP IP addresses and name
  41. * server IP addresses in a single tree.
  42. *
  43. * Each leaf indicates that an IP address is listed in the IP address or the
  44. * name server IP address policy sub-zone (or both) of the corresponding
  45. * response response zone. The policy data such as a CNAME or an A record
  46. * is kept in the policy zone. After an IP address has been found in a radix
  47. * tree, the node in the policy zone's database is found by converting
  48. * the IP address to a domain name in a canonical form.
  49. *
  50. * The response policy zone canonical form of IPv6 addresses is one of:
  51. * prefix.W.W.W.W.W.W.W.W
  52. * prefix.WORDS.zz
  53. * prefix.WORDS.zz.WORDS
  54. * prefix.zz.WORDS
  55. * where
  56. * prefix is the prefix length of the IPv6 address between 1 and 128
  57. * W is a number between 0 and 65535
  58. * WORDS is one or more numbers W separated with "."
  59. * zz corresponds to :: in the standard IPv6 text representation
  60. *
  61. * The canonical form of IPv4 addresses is:
  62. * prefix.B.B.B.B
  63. * where
  64. * prefix is the prefix length of the address between 1 and 32
  65. * B is a number between 0 and 255
  66. *
  67. * IPv4 addresses are distinguished from IPv6 addresses by having
  68. * 5 labels all of which are numbers, and a prefix between 1 and 32.
  69. */
  70. /*
  71. * Use a private definition of IPv6 addresses because s6_addr32 is not
  72. * always defined and our IPv6 addresses are in non-standard byte order
  73. */
  74. typedef isc_uint32_t dns_rpz_cidr_word_t;
  75. #define DNS_RPZ_CIDR_WORD_BITS ((int)sizeof(dns_rpz_cidr_word_t)*8)
  76. #define DNS_RPZ_CIDR_KEY_BITS ((int)sizeof(dns_rpz_cidr_key_t)*8)
  77. #define DNS_RPZ_CIDR_WORDS (128/DNS_RPZ_CIDR_WORD_BITS)
  78. typedef struct {
  79. dns_rpz_cidr_word_t w[DNS_RPZ_CIDR_WORDS];
  80. } dns_rpz_cidr_key_t;
  81. #define ADDR_V4MAPPED 0xffff
  82. #define DNS_RPZ_WORD_MASK(b) \
  83. ((b) == 0 ? (dns_rpz_cidr_word_t)(-1) \
  84. : ((dns_rpz_cidr_word_t)(-1) \
  85. << (DNS_RPZ_CIDR_WORD_BITS - (b))))
  86. #define DNS_RPZ_IP_BIT(ip, bitno) \
  87. (1 & ((ip)->w[(bitno)/DNS_RPZ_CIDR_WORD_BITS] >> \
  88. (DNS_RPZ_CIDR_WORD_BITS - 1 - ((bitno) % DNS_RPZ_CIDR_WORD_BITS))))
  89. typedef struct dns_rpz_cidr_node dns_rpz_cidr_node_t;
  90. typedef isc_uint8_t dns_rpz_cidr_flags_t;
  91. struct dns_rpz_cidr_node {
  92. dns_rpz_cidr_node_t *parent;
  93. dns_rpz_cidr_node_t *child[2];
  94. dns_rpz_cidr_key_t ip;
  95. dns_rpz_cidr_bits_t bits;
  96. dns_rpz_cidr_flags_t flags;
  97. #define DNS_RPZ_CIDR_FG_IP 0x01 /* has IP data or is parent of IP */
  98. #define DNS_RPZ_CIDR_FG_IP_DATA 0x02 /* has IP data */
  99. #define DNS_RPZ_CIDR_FG_NSIPv4 0x04 /* has or is parent of NSIPv4 data */
  100. #define DNS_RPZ_CIDR_FG_NSIPv6 0x08 /* has or is parent of NSIPv6 data */
  101. #define DNS_RPZ_CIDR_FG_NSIP_DATA 0x10 /* has NSIP data */
  102. };
  103. struct dns_rpz_cidr {
  104. isc_mem_t *mctx;
  105. isc_boolean_t have_nsdname; /* zone has NSDNAME record */
  106. dns_rpz_cidr_node_t *root;
  107. dns_name_t ip_name; /* RPZ_IP_ZONE.LOCALHOST. */
  108. dns_name_t nsip_name; /* RPZ_NSIP_ZONE.LOCALHOST. */
  109. dns_name_t nsdname_name; /* RPZ_NSDNAME_ZONE.LOCALHOST */
  110. };
  111. static isc_boolean_t have_rpz_zones = ISC_FALSE;
  112. const char *
  113. dns_rpz_type2str(dns_rpz_type_t type) {
  114. switch (type) {
  115. case DNS_RPZ_TYPE_QNAME:
  116. return ("QNAME");
  117. case DNS_RPZ_TYPE_IP:
  118. return ("IP");
  119. case DNS_RPZ_TYPE_NSIP:
  120. return ("NSIP");
  121. case DNS_RPZ_TYPE_NSDNAME:
  122. return ("NSDNAME");
  123. case DNS_RPZ_TYPE_BAD:
  124. break;
  125. }
  126. FATAL_ERROR(__FILE__, __LINE__,
  127. "impossible rpz type %d", type);
  128. return ("impossible");
  129. }
  130. dns_rpz_policy_t
  131. dns_rpz_str2policy(const char *str) {
  132. if (str == NULL)
  133. return (DNS_RPZ_POLICY_ERROR);
  134. if (!strcasecmp(str, "given"))
  135. return (DNS_RPZ_POLICY_GIVEN);
  136. if (!strcasecmp(str, "disabled"))
  137. return (DNS_RPZ_POLICY_DISABLED);
  138. if (!strcasecmp(str, "passthru"))
  139. return (DNS_RPZ_POLICY_PASSTHRU);
  140. if (!strcasecmp(str, "nxdomain"))
  141. return (DNS_RPZ_POLICY_NXDOMAIN);
  142. if (!strcasecmp(str, "nodata"))
  143. return (DNS_RPZ_POLICY_NODATA);
  144. if (!strcasecmp(str, "cname"))
  145. return (DNS_RPZ_POLICY_CNAME);
  146. /*
  147. * Obsolete
  148. */
  149. if (!strcasecmp(str, "no-op"))
  150. return (DNS_RPZ_POLICY_PASSTHRU);
  151. return (DNS_RPZ_POLICY_ERROR);
  152. }
  153. const char *
  154. dns_rpz_policy2str(dns_rpz_policy_t policy) {
  155. const char *str;
  156. switch (policy) {
  157. case DNS_RPZ_POLICY_PASSTHRU:
  158. str = "PASSTHRU";
  159. break;
  160. case DNS_RPZ_POLICY_NXDOMAIN:
  161. str = "NXDOMAIN";
  162. break;
  163. case DNS_RPZ_POLICY_NODATA:
  164. str = "NODATA";
  165. break;
  166. case DNS_RPZ_POLICY_RECORD:
  167. str = "records";
  168. break;
  169. case DNS_RPZ_POLICY_CNAME:
  170. case DNS_RPZ_POLICY_WILDCNAME:
  171. str = "CNAME";
  172. break;
  173. default:
  174. str = "";
  175. INSIST(0);
  176. }
  177. return (str);
  178. }
  179. /*
  180. * Free the radix tree of a response policy database.
  181. */
  182. void
  183. dns_rpz_cidr_free(dns_rpz_cidr_t **cidrp) {
  184. dns_rpz_cidr_node_t *cur, *child, *parent;
  185. dns_rpz_cidr_t *cidr;
  186. REQUIRE(cidrp != NULL);
  187. cidr = *cidrp;
  188. if (cidr == NULL)
  189. return;
  190. cur = cidr->root;
  191. while (cur != NULL) {
  192. /* Depth first. */
  193. child = cur->child[0];
  194. if (child != NULL) {
  195. cur = child;
  196. continue;
  197. }
  198. child = cur->child[1];
  199. if (child != NULL) {
  200. cur = child;
  201. continue;
  202. }
  203. /* Delete this leaf and go up. */
  204. parent = cur->parent;
  205. if (parent == NULL)
  206. cidr->root = NULL;
  207. else
  208. parent->child[parent->child[1] == cur] = NULL;
  209. isc_mem_put(cidr->mctx, cur, sizeof(*cur));
  210. cur = parent;
  211. }
  212. dns_name_free(&cidr->ip_name, cidr->mctx);
  213. dns_name_free(&cidr->nsip_name, cidr->mctx);
  214. dns_name_free(&cidr->nsdname_name, cidr->mctx);
  215. isc_mem_put(cidr->mctx, cidr, sizeof(*cidr));
  216. *cidrp = NULL;
  217. }
  218. /*
  219. * Forget a view's list of policy zones.
  220. */
  221. void
  222. dns_rpz_view_destroy(dns_view_t *view) {
  223. dns_rpz_zone_t *zone;
  224. REQUIRE(view != NULL);
  225. while (!ISC_LIST_EMPTY(view->rpz_zones)) {
  226. zone = ISC_LIST_HEAD(view->rpz_zones);
  227. ISC_LIST_UNLINK(view->rpz_zones, zone, link);
  228. if (dns_name_dynamic(&zone->origin))
  229. dns_name_free(&zone->origin, view->mctx);
  230. if (dns_name_dynamic(&zone->nsdname))
  231. dns_name_free(&zone->nsdname, view->mctx);
  232. if (dns_name_dynamic(&zone->cname))
  233. dns_name_free(&zone->cname, view->mctx);
  234. isc_mem_put(view->mctx, zone, sizeof(*zone));
  235. }
  236. }
  237. /*
  238. * Note that we have at least one response policy zone.
  239. * It would be better for something to tell the rbtdb code that the
  240. * zone is in at least one view's list of policy zones.
  241. */
  242. void
  243. dns_rpz_set_need(isc_boolean_t need) {
  244. have_rpz_zones = need;
  245. }
  246. isc_boolean_t
  247. dns_rpz_needed(void) {
  248. return (have_rpz_zones);
  249. }
  250. /*
  251. * Start a new radix tree for a response policy zone.
  252. */
  253. isc_result_t
  254. dns_rpz_new_cidr(isc_mem_t *mctx, dns_name_t *origin,
  255. dns_rpz_cidr_t **rbtdb_cidr)
  256. {
  257. isc_result_t result;
  258. dns_rpz_cidr_t *cidr;
  259. REQUIRE(rbtdb_cidr != NULL && *rbtdb_cidr == NULL);
  260. /*
  261. * Only if there is at least one response policy zone.
  262. */
  263. if (!have_rpz_zones)
  264. return (ISC_R_SUCCESS);
  265. cidr = isc_mem_get(mctx, sizeof(*cidr));
  266. if (cidr == NULL)
  267. return (ISC_R_NOMEMORY);
  268. memset(cidr, 0, sizeof(*cidr));
  269. cidr->mctx = mctx;
  270. dns_name_init(&cidr->ip_name, NULL);
  271. result = dns_name_fromstring2(&cidr->ip_name, DNS_RPZ_IP_ZONE, origin,
  272. DNS_NAME_DOWNCASE, mctx);
  273. if (result != ISC_R_SUCCESS) {
  274. isc_mem_put(mctx, cidr, sizeof(*cidr));
  275. return (result);
  276. }
  277. dns_name_init(&cidr->nsip_name, NULL);
  278. result = dns_name_fromstring2(&cidr->nsip_name, DNS_RPZ_NSIP_ZONE,
  279. origin, DNS_NAME_DOWNCASE, mctx);
  280. if (result != ISC_R_SUCCESS) {
  281. dns_name_free(&cidr->ip_name, mctx);
  282. isc_mem_put(mctx, cidr, sizeof(*cidr));
  283. return (result);
  284. }
  285. dns_name_init(&cidr->nsdname_name, NULL);
  286. result = dns_name_fromstring2(&cidr->nsdname_name, DNS_RPZ_NSDNAME_ZONE,
  287. origin, DNS_NAME_DOWNCASE, mctx);
  288. if (result != ISC_R_SUCCESS) {
  289. dns_name_free(&cidr->nsip_name, mctx);
  290. dns_name_free(&cidr->ip_name, mctx);
  291. isc_mem_put(mctx, cidr, sizeof(*cidr));
  292. return (result);
  293. }
  294. *rbtdb_cidr = cidr;
  295. return (ISC_R_SUCCESS);
  296. }
  297. /*
  298. * See if a policy zone has IP, NSIP, or NSDNAME rules or records.
  299. */
  300. void
  301. dns_rpz_enabled(dns_rpz_cidr_t *cidr, dns_rpz_st_t *st) {
  302. if (cidr == NULL)
  303. return;
  304. if (cidr->root != NULL &&
  305. (cidr->root->flags & DNS_RPZ_CIDR_FG_IP) != 0)
  306. st->state |= DNS_RPZ_HAVE_IP;
  307. if (cidr->root != NULL &&
  308. (cidr->root->flags & DNS_RPZ_CIDR_FG_NSIPv4) != 0)
  309. st->state |= DNS_RPZ_HAVE_NSIPv4;
  310. if (cidr->root != NULL &&
  311. (cidr->root->flags & DNS_RPZ_CIDR_FG_NSIPv6) != 0)
  312. st->state |= DNS_RPZ_HAVE_NSIPv6;
  313. if (cidr->have_nsdname)
  314. st->state |= DNS_RPZ_HAVE_NSDNAME;
  315. }
  316. static inline dns_rpz_cidr_flags_t
  317. get_flags(const dns_rpz_cidr_key_t *ip, dns_rpz_cidr_bits_t prefix,
  318. dns_rpz_type_t rpz_type)
  319. {
  320. if (rpz_type == DNS_RPZ_TYPE_NSIP) {
  321. if (prefix >= 96 &&
  322. ip->w[0] == 0 && ip->w[1] == 0 &&
  323. ip->w[2] == ADDR_V4MAPPED)
  324. return (DNS_RPZ_CIDR_FG_NSIP_DATA |
  325. DNS_RPZ_CIDR_FG_NSIPv4);
  326. else
  327. return (DNS_RPZ_CIDR_FG_NSIP_DATA |
  328. DNS_RPZ_CIDR_FG_NSIPv6);
  329. } else {
  330. return (DNS_RPZ_CIDR_FG_IP | DNS_RPZ_CIDR_FG_IP_DATA);
  331. }
  332. }
  333. /*
  334. * Mark a node as having IP or NSIP data and all of its parents
  335. * as members of the IP or NSIP tree.
  336. */
  337. static void
  338. set_node_flags(dns_rpz_cidr_node_t *node, dns_rpz_type_t rpz_type) {
  339. dns_rpz_cidr_flags_t flags;
  340. flags = get_flags(&node->ip, node->bits, rpz_type);
  341. node->flags |= flags;
  342. flags &= ~(DNS_RPZ_CIDR_FG_NSIP_DATA | DNS_RPZ_CIDR_FG_IP_DATA);
  343. for (;;) {
  344. node = node->parent;
  345. if (node == NULL)
  346. return;
  347. node->flags |= flags;
  348. }
  349. }
  350. /*
  351. * Make a radix tree node.
  352. */
  353. static dns_rpz_cidr_node_t *
  354. new_node(dns_rpz_cidr_t *cidr, const dns_rpz_cidr_key_t *ip,
  355. dns_rpz_cidr_bits_t bits, dns_rpz_cidr_flags_t flags)
  356. {
  357. dns_rpz_cidr_node_t *node;
  358. int i, words, wlen;
  359. node = isc_mem_get(cidr->mctx, sizeof(*node));
  360. if (node == NULL)
  361. return (NULL);
  362. memset(node, 0, sizeof(*node));
  363. node->flags = flags & ~(DNS_RPZ_CIDR_FG_IP_DATA |
  364. DNS_RPZ_CIDR_FG_NSIP_DATA);
  365. node->bits = bits;
  366. words = bits / DNS_RPZ_CIDR_WORD_BITS;
  367. wlen = bits % DNS_RPZ_CIDR_WORD_BITS;
  368. i = 0;
  369. while (i < words) {
  370. node->ip.w[i] = ip->w[i];
  371. ++i;
  372. }
  373. if (wlen != 0) {
  374. node->ip.w[i] = ip->w[i] & DNS_RPZ_WORD_MASK(wlen);
  375. ++i;
  376. }
  377. while (i < DNS_RPZ_CIDR_WORDS)
  378. node->ip.w[i++] = 0;
  379. return (node);
  380. }
  381. static void
  382. badname(int level, dns_name_t *name, const char *comment) {
  383. char printname[DNS_NAME_FORMATSIZE];
  384. if (isc_log_wouldlog(dns_lctx, level)) {
  385. dns_name_format(name, printname, sizeof(printname));
  386. isc_log_write(dns_lctx, DNS_LOGCATEGORY_RPZ,
  387. DNS_LOGMODULE_RBTDB, level,
  388. "invalid rpz \"%s\"%s", printname, comment);
  389. }
  390. }
  391. /*
  392. * Convert an IP address from radix tree binary (host byte order) to
  393. * to its canonical response policy domain name and its name in the
  394. * policy zone.
  395. */
  396. static isc_result_t
  397. ip2name(dns_rpz_cidr_t *cidr, const dns_rpz_cidr_key_t *tgt_ip,
  398. dns_rpz_cidr_bits_t tgt_prefix, dns_rpz_type_t type,
  399. dns_name_t *canon_name, dns_name_t *search_name)
  400. {
  401. #ifndef INET6_ADDRSTRLEN
  402. #define INET6_ADDRSTRLEN 46
  403. #endif
  404. int w[DNS_RPZ_CIDR_WORDS*2];
  405. char str[1+8+1+INET6_ADDRSTRLEN+1];
  406. isc_buffer_t buffer;
  407. dns_name_t *name;
  408. isc_result_t result;
  409. isc_boolean_t zeros;
  410. int i, n, len;
  411. if (tgt_prefix > 96 &&
  412. tgt_ip->w[0] == 0 &&
  413. tgt_ip->w[1] == 0 &&
  414. tgt_ip->w[2] == ADDR_V4MAPPED) {
  415. len = snprintf(str, sizeof(str), "%d.%d.%d.%d.%d",
  416. tgt_prefix - 96,
  417. tgt_ip->w[3] & 0xff,
  418. (tgt_ip->w[3]>>8) & 0xff,
  419. (tgt_ip->w[3]>>16) & 0xff,
  420. (tgt_ip->w[3]>>24) & 0xff);
  421. if (len == -1 || len > (int)sizeof(str))
  422. return (ISC_R_FAILURE);
  423. } else {
  424. for (i = 0; i < DNS_RPZ_CIDR_WORDS; i++) {
  425. w[i*2+1] = ((tgt_ip->w[DNS_RPZ_CIDR_WORDS-1-i] >> 16)
  426. & 0xffff);
  427. w[i*2] = tgt_ip->w[DNS_RPZ_CIDR_WORDS-1-i] & 0xffff;
  428. }
  429. zeros = ISC_FALSE;
  430. len = snprintf(str, sizeof(str), "%d", tgt_prefix);
  431. if (len == -1)
  432. return (ISC_R_FAILURE);
  433. i = 0;
  434. while (i < DNS_RPZ_CIDR_WORDS * 2) {
  435. if (w[i] != 0 || zeros
  436. || i >= DNS_RPZ_CIDR_WORDS * 2 - 1
  437. || w[i+1] != 0) {
  438. INSIST((size_t)len <= sizeof(str));
  439. n = snprintf(&str[len], sizeof(str) - len,
  440. ".%x", w[i++]);
  441. if (n < 0)
  442. return (ISC_R_FAILURE);
  443. len += n;
  444. } else {
  445. zeros = ISC_TRUE;
  446. INSIST((size_t)len <= sizeof(str));
  447. n = snprintf(&str[len], sizeof(str) - len,
  448. ".zz");
  449. if (n < 0)
  450. return (ISC_R_FAILURE);
  451. len += n;
  452. i += 2;
  453. while (i < DNS_RPZ_CIDR_WORDS * 2 && w[i] == 0)
  454. ++i;
  455. }
  456. if (len > (int)sizeof(str))
  457. return (ISC_R_FAILURE);
  458. }
  459. }
  460. if (canon_name != NULL) {
  461. isc__buffer_init(&buffer, str, sizeof(str));
  462. isc__buffer_add(&buffer, len);
  463. result = dns_name_fromtext(canon_name, &buffer,
  464. dns_rootname, 0, NULL);
  465. if (result != ISC_R_SUCCESS)
  466. return (result);
  467. }
  468. if (search_name != NULL) {
  469. isc__buffer_init(&buffer, str, sizeof(str));
  470. isc__buffer_add(&buffer, len);
  471. if (type == DNS_RPZ_TYPE_NSIP)
  472. name = &cidr->nsip_name;
  473. else
  474. name = &cidr->ip_name;
  475. result = dns_name_fromtext(search_name, &buffer, name, 0, NULL);
  476. if (result != ISC_R_SUCCESS)
  477. return (result);
  478. }
  479. return (ISC_R_SUCCESS);
  480. }
  481. /*
  482. * Decide which kind of IP address response policy zone a name is in.
  483. */
  484. static dns_rpz_type_t
  485. set_type(dns_rpz_cidr_t *cidr, dns_name_t *name) {
  486. if (dns_name_issubdomain(name, &cidr->ip_name))
  487. return (DNS_RPZ_TYPE_IP);
  488. /*
  489. * Require `./configure --enable-rpz-nsip` and nsdname
  490. * until consistency problems are resolved.
  491. */
  492. #ifdef ENABLE_RPZ_NSIP
  493. if (dns_name_issubdomain(name, &cidr->nsip_name))
  494. return (DNS_RPZ_TYPE_NSIP);
  495. #endif
  496. #ifdef ENABLE_RPZ_NSDNAME
  497. if (dns_name_issubdomain(name, &cidr->nsdname_name))
  498. return (DNS_RPZ_TYPE_NSDNAME);
  499. #endif
  500. return (DNS_RPZ_TYPE_QNAME);
  501. }
  502. /*
  503. * Convert an IP address from canonical response policy domain name form
  504. * to radix tree binary (host byte order).
  505. */
  506. static isc_result_t
  507. name2ipkey(dns_rpz_cidr_t *cidr, int level, dns_name_t *src_name,
  508. dns_rpz_type_t type, dns_rpz_cidr_key_t *tgt_ip,
  509. dns_rpz_cidr_bits_t *tgt_prefix)
  510. {
  511. isc_buffer_t buffer;
  512. unsigned char data[DNS_NAME_MAXWIRE+1];
  513. dns_fixedname_t fname;
  514. dns_name_t *name;
  515. const char *cp, *end;
  516. char *cp2;
  517. int ip_labels;
  518. dns_rpz_cidr_bits_t bits;
  519. unsigned long prefix, l;
  520. int i;
  521. /*
  522. * Need at least enough labels for the shortest name,
  523. * :: or 128.*.RPZ_x_ZONE.rpz.LOCALHOST.
  524. */
  525. ip_labels = dns_name_countlabels(src_name);
  526. ip_labels -= dns_name_countlabels(&cidr->ip_name);
  527. ip_labels--;
  528. if (ip_labels < 1) {
  529. badname(level, src_name, ", too short");
  530. return (ISC_R_FAILURE);
  531. }
  532. /*
  533. * Get text for the IP address without RPZ_x_ZONE.rpz.LOCALHOST.
  534. */
  535. dns_fixedname_init(&fname);
  536. name = dns_fixedname_name(&fname);
  537. dns_name_split(src_name, dns_name_countlabels(&cidr->ip_name),
  538. name, NULL);
  539. isc_buffer_init(&buffer, data, sizeof(data));
  540. dns_name_totext(name, ISC_TRUE, &buffer);
  541. isc_buffer_putuint8(&buffer, '\0');
  542. cp = isc_buffer_base(&buffer);
  543. prefix = strtoul(cp, &cp2, 10);
  544. if (prefix < 1U || prefix > 128U || *cp2 != '.') {
  545. badname(level, src_name, ", bad prefix length");
  546. return (ISC_R_FAILURE);
  547. }
  548. cp = cp2+1;
  549. end = isc_buffer_used(&buffer);
  550. if (ip_labels == 4 && !strchr(cp, 'z')) {
  551. /*
  552. * Convert an IPv4 address
  553. * from the form "prefix.w.z.y.x"
  554. */
  555. if (prefix > 32U) {
  556. badname(level, src_name, "; bad IPv4 prefix length");
  557. return (ISC_R_FAILURE);
  558. }
  559. prefix += 96;
  560. *tgt_prefix = (dns_rpz_cidr_bits_t)prefix;
  561. tgt_ip->w[0] = 0;
  562. tgt_ip->w[1] = 0;
  563. tgt_ip->w[2] = ADDR_V4MAPPED;
  564. tgt_ip->w[3] = 0;
  565. for (i = 0; i < 32; i += 8) {
  566. l = strtoul(cp, &cp2, 10);
  567. if (l > 255U || (*cp2 != '.' && *cp2 != '\0')) {
  568. badname(level, src_name, "; bad IPv4 address");
  569. return (ISC_R_FAILURE);
  570. }
  571. tgt_ip->w[3] |= l << i;
  572. cp = cp2 + 1;
  573. }
  574. } else {
  575. /*
  576. * Convert a text IPv6 address.
  577. */
  578. *tgt_prefix = (dns_rpz_cidr_bits_t)prefix;
  579. for (i = 0;
  580. ip_labels > 0 && i < DNS_RPZ_CIDR_WORDS * 2;
  581. ip_labels--) {
  582. if (cp[0] == 'z' && cp[1] == 'z' &&
  583. (cp[2] == '.' || cp[2] == '\0') &&
  584. i <= 6) {
  585. do {
  586. if ((i & 1) == 0)
  587. tgt_ip->w[3-i/2] = 0;
  588. ++i;
  589. } while (ip_labels + i <= 8);
  590. cp += 3;
  591. } else {
  592. l = strtoul(cp, &cp2, 16);
  593. if (l > 0xffffu ||
  594. (*cp2 != '.' && *cp2 != '\0')) {
  595. badname(level, src_name, "");
  596. return (ISC_R_FAILURE);
  597. }
  598. if ((i & 1) == 0)
  599. tgt_ip->w[3-i/2] = l;
  600. else
  601. tgt_ip->w[3-i/2] |= l << 16;
  602. i++;
  603. cp = cp2 + 1;
  604. }
  605. }
  606. }
  607. if (cp != end) {
  608. badname(level, src_name, "");
  609. return (ISC_R_FAILURE);
  610. }
  611. /*
  612. * Check for 1s after the prefix length.
  613. */
  614. bits = (dns_rpz_cidr_bits_t)prefix;
  615. while (bits < DNS_RPZ_CIDR_KEY_BITS) {
  616. dns_rpz_cidr_word_t aword;
  617. i = bits % DNS_RPZ_CIDR_WORD_BITS;
  618. aword = tgt_ip->w[bits / DNS_RPZ_CIDR_WORD_BITS];
  619. if ((aword & ~DNS_RPZ_WORD_MASK(i)) != 0) {
  620. badname(level, src_name, "; wrong prefix length");
  621. return (ISC_R_FAILURE);
  622. }
  623. bits -= i;
  624. bits += DNS_RPZ_CIDR_WORD_BITS;
  625. }
  626. /*
  627. * Convert the IPv6 address back to a canonical policy domain name
  628. * to ensure that it is in canonical form.
  629. */
  630. if (ISC_R_SUCCESS != ip2name(cidr, tgt_ip, (dns_rpz_cidr_bits_t)prefix,
  631. type, NULL, name) ||
  632. !dns_name_equal(src_name, name)) {
  633. badname(level, src_name, "; not canonical");
  634. return (ISC_R_FAILURE);
  635. }
  636. return (ISC_R_SUCCESS);
  637. }
  638. /*
  639. * Find first differing bit.
  640. */
  641. static int
  642. ffbit(dns_rpz_cidr_word_t w) {
  643. int bit;
  644. bit = DNS_RPZ_CIDR_WORD_BITS-1;
  645. if ((w & 0xffff0000) != 0) {
  646. w >>= 16;
  647. bit -= 16;
  648. }
  649. if ((w & 0xff00) != 0) {
  650. w >>= 8;
  651. bit -= 8;
  652. }
  653. if ((w & 0xf0) != 0) {
  654. w >>= 4;
  655. bit -= 4;
  656. }
  657. if ((w & 0xc) != 0) {
  658. w >>= 2;
  659. bit -= 2;
  660. }
  661. if ((w & 2) != 0)
  662. --bit;
  663. return (bit);
  664. }
  665. /*
  666. * Find the first differing bit in two keys.
  667. */
  668. static int
  669. diff_keys(const dns_rpz_cidr_key_t *key1, dns_rpz_cidr_bits_t bits1,
  670. const dns_rpz_cidr_key_t *key2, dns_rpz_cidr_bits_t bits2)
  671. {
  672. dns_rpz_cidr_word_t delta;
  673. dns_rpz_cidr_bits_t maxbit, bit;
  674. int i;
  675. maxbit = ISC_MIN(bits1, bits2);
  676. /*
  677. * find the first differing words
  678. */
  679. for (i = 0, bit = 0;
  680. bit <= maxbit;
  681. i++, bit += DNS_RPZ_CIDR_WORD_BITS) {
  682. delta = key1->w[i] ^ key2->w[i];
  683. if (delta != 0) {
  684. bit += ffbit(delta);
  685. break;
  686. }
  687. }
  688. return (ISC_MIN(bit, maxbit));
  689. }
  690. /*
  691. * Search a radix tree for an IP address for ordinary lookup
  692. * or for a CIDR block adding or deleting an entry
  693. * The tree read (for simple search) or write lock must be held by the caller.
  694. *
  695. * Return ISC_R_SUCCESS, ISC_R_NOTFOUND, DNS_R_PARTIALMATCH, ISC_R_EXISTS,
  696. * ISC_R_NOMEMORY
  697. */
  698. static isc_result_t
  699. search(dns_rpz_cidr_t *cidr, const dns_rpz_cidr_key_t *tgt_ip,
  700. dns_rpz_cidr_bits_t tgt_prefix, dns_rpz_type_t type,
  701. isc_boolean_t create,
  702. dns_rpz_cidr_node_t **found) /* NULL or longest match node */
  703. {
  704. dns_rpz_cidr_node_t *cur, *parent, *child, *new_parent, *sibling;
  705. int cur_num, child_num;
  706. dns_rpz_cidr_bits_t dbit;
  707. dns_rpz_cidr_flags_t flags, data_flag;
  708. isc_result_t find_result;
  709. flags = get_flags(tgt_ip, tgt_prefix, type);
  710. data_flag = flags & (DNS_RPZ_CIDR_FG_IP_DATA |
  711. DNS_RPZ_CIDR_FG_NSIP_DATA);
  712. find_result = ISC_R_NOTFOUND;
  713. if (found != NULL)
  714. *found = NULL;
  715. cur = cidr->root;
  716. parent = NULL;
  717. cur_num = 0;
  718. for (;;) {
  719. if (cur == NULL) {
  720. /*
  721. * No child so we cannot go down. Fail or
  722. * add the target as a child of the current parent.
  723. */
  724. if (!create)
  725. return (find_result);
  726. child = new_node(cidr, tgt_ip, tgt_prefix, 0);
  727. if (child == NULL)
  728. return (ISC_R_NOMEMORY);
  729. if (parent == NULL)
  730. cidr->root = child;
  731. else
  732. parent->child[cur_num] = child;
  733. child->parent = parent;
  734. set_node_flags(child, type);
  735. if (found != NULL)
  736. *found = cur;
  737. return (ISC_R_SUCCESS);
  738. }
  739. /*
  740. * Pretend a node not in the correct tree does not exist
  741. * if we are not adding to the tree,
  742. * If we are adding, then continue down to eventually
  743. * add a node and mark/put this node in the correct tree.
  744. */
  745. if ((cur->flags & flags) == 0 && !create)
  746. return (find_result);
  747. dbit = diff_keys(tgt_ip, tgt_prefix, &cur->ip, cur->bits);
  748. /*
  749. * dbit <= tgt_prefix and dbit <= cur->bits always.
  750. * We are finished searching if we matched all of the target.
  751. */
  752. if (dbit == tgt_prefix) {
  753. if (tgt_prefix == cur->bits) {
  754. /*
  755. * The current node matches the target exactly.
  756. * It is the answer if it has data.
  757. */
  758. if ((cur->flags & data_flag) != 0) {
  759. if (create)
  760. return (ISC_R_EXISTS);
  761. if (found != NULL)
  762. *found = cur;
  763. return (ISC_R_SUCCESS);
  764. } else if (create) {
  765. /*
  766. * The node had no data but does now.
  767. */
  768. set_node_flags(cur, type);
  769. if (found != NULL)
  770. *found = cur;
  771. return (ISC_R_SUCCESS);
  772. }
  773. return (find_result);
  774. }
  775. /*
  776. * We know tgt_prefix < cur_bits which means that
  777. * the target is shorter than the current node.
  778. * Add the target as the current node's parent.
  779. */
  780. if (!create)
  781. return (find_result);
  782. new_parent = new_node(cidr, tgt_ip, tgt_prefix,
  783. cur->flags);
  784. if (new_parent == NULL)
  785. return (ISC_R_NOMEMORY);
  786. new_parent->parent = parent;
  787. if (parent == NULL)
  788. cidr->root = new_parent;
  789. else
  790. parent->child[cur_num] = new_parent;
  791. child_num = DNS_RPZ_IP_BIT(&cur->ip, tgt_prefix+1);
  792. new_parent->child[child_num] = cur;
  793. cur->parent = new_parent;
  794. set_node_flags(new_parent, type);
  795. if (found != NULL)
  796. *found = new_parent;
  797. return (ISC_R_SUCCESS);
  798. }
  799. if (dbit == cur->bits) {
  800. /*
  801. * We have a partial match by matching of all of the
  802. * current node but only part of the target.
  803. * Try to go down.
  804. */
  805. if ((cur->flags & data_flag) != 0) {
  806. find_result = DNS_R_PARTIALMATCH;
  807. if (found != NULL)
  808. *found = cur;
  809. }
  810. parent = cur;
  811. cur_num = DNS_RPZ_IP_BIT(tgt_ip, dbit);
  812. cur = cur->child[cur_num];
  813. continue;
  814. }
  815. /*
  816. * dbit < tgt_prefix and dbit < cur->bits,
  817. * so we failed to match both the target and the current node.
  818. * Insert a fork of a parent above the current node and
  819. * add the target as a sibling of the current node
  820. */
  821. if (!create)
  822. return (find_result);
  823. sibling = new_node(cidr, tgt_ip, tgt_prefix, 0);
  824. if (sibling == NULL)
  825. return (ISC_R_NOMEMORY);
  826. new_parent = new_node(cidr, tgt_ip, dbit, cur->flags);
  827. if (new_parent == NULL) {
  828. isc_mem_put(cidr->mctx, sibling, sizeof(*sibling));
  829. return (ISC_R_NOMEMORY);
  830. }
  831. new_parent->parent = parent;
  832. if (parent == NULL)
  833. cidr->root = new_parent;
  834. else
  835. parent->child[cur_num] = new_parent;
  836. child_num = DNS_RPZ_IP_BIT(tgt_ip, dbit);
  837. new_parent->child[child_num] = sibling;
  838. new_parent->child[1-child_num] = cur;
  839. cur->parent = new_parent;
  840. sibling->parent = new_parent;
  841. set_node_flags(sibling, type);
  842. if (found != NULL)
  843. *found = sibling;
  844. return (ISC_R_SUCCESS);
  845. }
  846. }
  847. /*
  848. * Add an IP address to the radix tree of a response policy database.
  849. * The tree write lock must be held by the caller.
  850. */
  851. void
  852. dns_rpz_cidr_addip(dns_rpz_cidr_t *cidr, dns_name_t *name) {
  853. dns_rpz_cidr_key_t tgt_ip;
  854. dns_rpz_cidr_bits_t tgt_prefix;
  855. dns_rpz_type_t type;
  856. if (cidr == NULL)
  857. return;
  858. /*
  859. * No worries if the new name is not an IP address.
  860. */
  861. type = set_type(cidr, name);
  862. switch (type) {
  863. case DNS_RPZ_TYPE_IP:
  864. case DNS_RPZ_TYPE_NSIP:
  865. break;
  866. case DNS_RPZ_TYPE_NSDNAME:
  867. cidr->have_nsdname = ISC_TRUE;
  868. return;
  869. case DNS_RPZ_TYPE_QNAME:
  870. case DNS_RPZ_TYPE_BAD:
  871. return;
  872. }
  873. if (ISC_R_SUCCESS != name2ipkey(cidr, DNS_RPZ_ERROR_LEVEL, name,
  874. type, &tgt_ip, &tgt_prefix))
  875. return;
  876. if (ISC_R_EXISTS == search(cidr, &tgt_ip, tgt_prefix, type,
  877. ISC_TRUE, NULL) &&
  878. isc_log_wouldlog(dns_lctx, DNS_RPZ_ERROR_LEVEL)) {
  879. char printname[DNS_NAME_FORMATSIZE];
  880. dns_name_format(name, printname, sizeof(printname));
  881. isc_log_write(dns_lctx, DNS_LOGCATEGORY_RPZ,
  882. DNS_LOGMODULE_RBTDB, DNS_RPZ_ERROR_LEVEL,
  883. "duplicate rpz name \"%s\"", printname);
  884. }
  885. }
  886. /*
  887. * Delete an IP address from the radix tree of a response policy database.
  888. * The tree write lock must be held by the caller.
  889. */
  890. void
  891. dns_rpz_cidr_deleteip(dns_rpz_cidr_t *cidr, dns_name_t *name) {
  892. dns_rpz_cidr_key_t tgt_ip;
  893. dns_rpz_cidr_bits_t tgt_prefix;
  894. dns_rpz_type_t type;
  895. dns_rpz_cidr_node_t *tgt = NULL, *parent, *child;
  896. dns_rpz_cidr_flags_t flags, data_flag;
  897. if (cidr == NULL)
  898. return;
  899. /*
  900. * Decide which kind of policy zone IP address it is, if either
  901. * and then find its node.
  902. */
  903. type = set_type(cidr, name);
  904. switch (type) {
  905. case DNS_RPZ_TYPE_IP:
  906. case DNS_RPZ_TYPE_NSIP:
  907. break;
  908. case DNS_RPZ_TYPE_NSDNAME:
  909. /*
  910. * We cannot easily count nsdnames because
  911. * internal rbt nodes get deleted.
  912. */
  913. return;
  914. case DNS_RPZ_TYPE_QNAME:
  915. case DNS_RPZ_TYPE_BAD:
  916. return;
  917. }
  918. /*
  919. * Do not get excited about the deletion of interior rbt nodes.
  920. */
  921. if (ISC_R_SUCCESS != name2ipkey(cidr, DNS_RPZ_DEBUG_LEVEL3, name,
  922. type, &tgt_ip, &tgt_prefix))
  923. return;
  924. if (ISC_R_SUCCESS != search(cidr, &tgt_ip, tgt_prefix, type,
  925. ISC_FALSE, &tgt)) {
  926. if (isc_log_wouldlog(dns_lctx, DNS_RPZ_ERROR_LEVEL)) {
  927. char printname[DNS_NAME_FORMATSIZE];
  928. dns_name_format(name, printname, sizeof(printname));
  929. isc_log_write(dns_lctx, DNS_LOGCATEGORY_RPZ,
  930. DNS_LOGMODULE_RBTDB, DNS_RPZ_ERROR_LEVEL,
  931. "missing rpz node \"%s\"", printname);
  932. }
  933. return;
  934. }
  935. /*
  936. * Mark the node and its parents to reflect the deleted IP address.
  937. */
  938. flags = get_flags(&tgt_ip, tgt_prefix, type);
  939. data_flag = flags & (DNS_RPZ_CIDR_FG_IP_DATA |
  940. DNS_RPZ_CIDR_FG_NSIP_DATA);
  941. tgt->flags &= ~data_flag;
  942. for (parent = tgt; parent != NULL; parent = parent->parent) {
  943. if ((parent->flags & data_flag) != 0 ||
  944. (parent->child[0] != NULL &&
  945. (parent->child[0]->flags & flags) != 0) ||
  946. (parent->child[1] != NULL &&
  947. (parent->child[1]->flags & flags) != 0))
  948. break;
  949. parent->flags &= ~flags;
  950. }
  951. /*
  952. * We might need to delete 2 nodes.
  953. */
  954. do {
  955. /*
  956. * The node is now useless if it has no data of its own
  957. * and 0 or 1 children. We are finished if it is not useless.
  958. */
  959. if ((child = tgt->child[0]) != NULL) {
  960. if (tgt->child[1] != NULL)
  961. return;
  962. } else {
  963. child = tgt->child[1];
  964. }
  965. if ((tgt->flags & (DNS_RPZ_CIDR_FG_IP_DATA |
  966. DNS_RPZ_CIDR_FG_NSIP_DATA)) != 0)
  967. return;
  968. /*
  969. * Replace the pointer to this node in the parent with
  970. * the remaining child or NULL.
  971. */
  972. parent = tgt->parent;
  973. if (parent == NULL) {
  974. cidr->root = child;
  975. } else {
  976. parent->child[parent->child[1] == tgt] = child;
  977. }
  978. /*
  979. * If the child exists fix up its parent pointer.
  980. */
  981. if (child != NULL)
  982. child->parent = parent;
  983. isc_mem_put(cidr->mctx, tgt, sizeof(*tgt));
  984. tgt = parent;
  985. } while (tgt != NULL);
  986. }
  987. /*
  988. * Caller must hold tree lock.
  989. * Return ISC_R_NOTFOUND
  990. * or ISC_R_SUCCESS and the found entry's canonical and search names
  991. * and its prefix length
  992. */
  993. isc_result_t
  994. dns_rpz_cidr_find(dns_rpz_cidr_t *cidr, const isc_netaddr_t *netaddr,
  995. dns_rpz_type_t type, dns_name_t *canon_name,
  996. dns_name_t *search_name, dns_rpz_cidr_bits_t *prefix)
  997. {
  998. dns_rpz_cidr_key_t tgt_ip;
  999. isc_result_t result;
  1000. dns_rpz_cidr_node_t *found;
  1001. int i;
  1002. /*
  1003. * Convert IP address to CIDR tree key.
  1004. */
  1005. if (netaddr->family == AF_INET) {
  1006. tgt_ip.w[0] = 0;
  1007. tgt_ip.w[1] = 0;
  1008. tgt_ip.w[2] = ADDR_V4MAPPED;
  1009. tgt_ip.w[3] = ntohl(netaddr->type.in.s_addr);
  1010. } else if (netaddr->family == AF_INET6) {
  1011. dns_rpz_cidr_key_t src_ip6;
  1012. /*
  1013. * Given the int aligned struct in_addr member of netaddr->type
  1014. * one could cast netaddr->type.in6 to dns_rpz_cidr_key_t *,
  1015. * but there are objections.
  1016. */
  1017. memcpy(src_ip6.w, &netaddr->type.in6, sizeof(src_ip6.w));
  1018. for (i = 0; i < 4; i++) {
  1019. tgt_ip.w[i] = ntohl(src_ip6.w[i]);
  1020. }
  1021. } else {
  1022. return (ISC_R_NOTFOUND);
  1023. }
  1024. result = search(cidr, &tgt_ip, 128, type, ISC_FALSE, &found);
  1025. if (result != ISC_R_SUCCESS && result != DNS_R_PARTIALMATCH)
  1026. return (result);
  1027. *prefix = found->bits;
  1028. return (ip2name(cidr, &found->ip, found->bits, type,
  1029. canon_name, search_name));
  1030. }
  1031. /*
  1032. * Translate CNAME rdata to a QNAME response policy action.
  1033. */
  1034. dns_rpz_policy_t
  1035. dns_rpz_decode_cname(dns_rdataset_t *rdataset, dns_name_t *selfname) {
  1036. dns_rdata_t rdata = DNS_RDATA_INIT;
  1037. dns_rdata_cname_t cname;
  1038. isc_result_t result;
  1039. result = dns_rdataset_first(rdataset);
  1040. RUNTIME_CHECK(result == ISC_R_SUCCESS);
  1041. dns_rdataset_current(rdataset, &rdata);
  1042. result = dns_rdata_tostruct(&rdata, &cname, NULL);
  1043. RUNTIME_CHECK(result == ISC_R_SUCCESS);
  1044. dns_rdata_reset(&rdata);
  1045. /*
  1046. * CNAME . means NXDOMAIN
  1047. */
  1048. if (dns_name_equal(&cname.cname, dns_rootname))
  1049. return (DNS_RPZ_POLICY_NXDOMAIN);
  1050. if (dns_name_iswildcard(&cname.cname)) {
  1051. /*
  1052. * CNAME *. means NODATA
  1053. */
  1054. if (dns_name_countlabels(&cname.cname) == 2)
  1055. return (DNS_RPZ_POLICY_NODATA);
  1056. /*
  1057. * A qname of www.evil.com and a policy of
  1058. * *.evil.com CNAME *.garden.net
  1059. * gives a result of
  1060. * evil.com CNAME evil.com.garden.net
  1061. */
  1062. if (dns_name_countlabels(&cname.cname) > 2)
  1063. return (DNS_RPZ_POLICY_WILDCNAME);
  1064. }
  1065. /*
  1066. * 128.1.0.127.rpz-ip CNAME 128.1.0.0.127. means "do not rewrite"
  1067. */
  1068. if (selfname != NULL && dns_name_equal(&cname.cname, selfname))
  1069. return (DNS_RPZ_POLICY_PASSTHRU);
  1070. /*
  1071. * Any other rdata gives a response consisting of the rdata.
  1072. */
  1073. return (DNS_RPZ_POLICY_RECORD);
  1074. }