1329 lines
40 KiB
C
1329 lines
40 KiB
C
/*
|
|
* respip/respip.c - filtering response IP module
|
|
*/
|
|
|
|
/**
|
|
* \file
|
|
*
|
|
* This file contains a module that inspects a result of recursive resolution
|
|
* to see if any IP address record should trigger a special action.
|
|
* If applicable these actions can modify the original response.
|
|
*/
|
|
#include "config.h"
|
|
|
|
#include "services/localzone.h"
|
|
#include "services/authzone.h"
|
|
#include "services/cache/dns.h"
|
|
#include "sldns/str2wire.h"
|
|
#include "util/config_file.h"
|
|
#include "util/fptr_wlist.h"
|
|
#include "util/module.h"
|
|
#include "util/net_help.h"
|
|
#include "util/regional.h"
|
|
#include "util/data/msgreply.h"
|
|
#include "util/storage/dnstree.h"
|
|
#include "respip/respip.h"
|
|
#include "services/view.h"
|
|
#include "sldns/rrdef.h"
|
|
#include "util/data/dname.h"
|
|
|
|
|
|
/** Subset of resp_addr.node, used for inform-variant logging */
|
|
struct respip_addr_info {
|
|
struct sockaddr_storage addr;
|
|
socklen_t addrlen;
|
|
int net;
|
|
};
|
|
|
|
/** Query state regarding the response-ip module. */
|
|
enum respip_state {
|
|
/**
|
|
* The general state. Unless CNAME chasing takes place, all processing
|
|
* is completed in this state without any other asynchronous event.
|
|
*/
|
|
RESPIP_INIT = 0,
|
|
|
|
/**
|
|
* A subquery for CNAME chasing is completed.
|
|
*/
|
|
RESPIP_SUBQUERY_FINISHED
|
|
};
|
|
|
|
/** Per query state for the response-ip module. */
|
|
struct respip_qstate {
|
|
enum respip_state state;
|
|
};
|
|
|
|
struct respip_set*
|
|
respip_set_create(void)
|
|
{
|
|
struct respip_set* set = calloc(1, sizeof(*set));
|
|
if(!set)
|
|
return NULL;
|
|
set->region = regional_create();
|
|
if(!set->region) {
|
|
free(set);
|
|
return NULL;
|
|
}
|
|
addr_tree_init(&set->ip_tree);
|
|
lock_rw_init(&set->lock);
|
|
return set;
|
|
}
|
|
|
|
/** helper traverse to delete resp_addr nodes */
|
|
static void
|
|
resp_addr_del(rbnode_type* n, void* ATTR_UNUSED(arg))
|
|
{
|
|
struct resp_addr* r = (struct resp_addr*)n->key;
|
|
lock_rw_destroy(&r->lock);
|
|
#ifdef THREADS_DISABLED
|
|
(void)r;
|
|
#endif
|
|
}
|
|
|
|
void
|
|
respip_set_delete(struct respip_set* set)
|
|
{
|
|
if(!set)
|
|
return;
|
|
lock_rw_destroy(&set->lock);
|
|
traverse_postorder(&set->ip_tree, resp_addr_del, NULL);
|
|
regional_destroy(set->region);
|
|
free(set);
|
|
}
|
|
|
|
struct rbtree_type*
|
|
respip_set_get_tree(struct respip_set* set)
|
|
{
|
|
if(!set)
|
|
return NULL;
|
|
return &set->ip_tree;
|
|
}
|
|
|
|
struct resp_addr*
|
|
respip_sockaddr_find_or_create(struct respip_set* set, struct sockaddr_storage* addr,
|
|
socklen_t addrlen, int net, int create, const char* ipstr)
|
|
{
|
|
struct resp_addr* node;
|
|
node = (struct resp_addr*)addr_tree_find(&set->ip_tree, addr, addrlen, net);
|
|
if(!node && create) {
|
|
node = regional_alloc_zero(set->region, sizeof(*node));
|
|
if(!node) {
|
|
log_err("out of memory");
|
|
return NULL;
|
|
}
|
|
lock_rw_init(&node->lock);
|
|
node->action = respip_none;
|
|
if(!addr_tree_insert(&set->ip_tree, &node->node, addr,
|
|
addrlen, net)) {
|
|
/* We know we didn't find it, so this should be
|
|
* impossible. */
|
|
log_warn("unexpected: duplicate address: %s", ipstr);
|
|
}
|
|
}
|
|
return node;
|
|
}
|
|
|
|
void
|
|
respip_sockaddr_delete(struct respip_set* set, struct resp_addr* node)
|
|
{
|
|
struct resp_addr* prev;
|
|
prev = (struct resp_addr*)rbtree_previous((struct rbnode_type*)node);
|
|
lock_rw_destroy(&node->lock);
|
|
(void)rbtree_delete(&set->ip_tree, node);
|
|
/* no free'ing, all allocated in region */
|
|
if(!prev)
|
|
addr_tree_init_parents((rbtree_type*)set);
|
|
else
|
|
addr_tree_init_parents_node(&prev->node);
|
|
}
|
|
|
|
/** returns the node in the address tree for the specified netblock string;
|
|
* non-existent node will be created if 'create' is true */
|
|
static struct resp_addr*
|
|
respip_find_or_create(struct respip_set* set, const char* ipstr, int create)
|
|
{
|
|
struct sockaddr_storage addr;
|
|
int net;
|
|
socklen_t addrlen;
|
|
|
|
if(!netblockstrtoaddr(ipstr, 0, &addr, &addrlen, &net)) {
|
|
log_err("cannot parse netblock: '%s'", ipstr);
|
|
return NULL;
|
|
}
|
|
return respip_sockaddr_find_or_create(set, &addr, addrlen, net, create,
|
|
ipstr);
|
|
}
|
|
|
|
static int
|
|
respip_tag_cfg(struct respip_set* set, const char* ipstr,
|
|
const uint8_t* taglist, size_t taglen)
|
|
{
|
|
struct resp_addr* node;
|
|
|
|
if(!(node=respip_find_or_create(set, ipstr, 1)))
|
|
return 0;
|
|
if(node->taglist) {
|
|
log_warn("duplicate response-address-tag for '%s', overridden.",
|
|
ipstr);
|
|
}
|
|
node->taglist = regional_alloc_init(set->region, taglist, taglen);
|
|
if(!node->taglist) {
|
|
log_err("out of memory");
|
|
return 0;
|
|
}
|
|
node->taglen = taglen;
|
|
return 1;
|
|
}
|
|
|
|
/** set action for the node specified by the netblock string */
|
|
static int
|
|
respip_action_cfg(struct respip_set* set, const char* ipstr,
|
|
const char* actnstr)
|
|
{
|
|
struct resp_addr* node;
|
|
enum respip_action action;
|
|
|
|
if(!(node=respip_find_or_create(set, ipstr, 1)))
|
|
return 0;
|
|
if(node->action != respip_none) {
|
|
verbose(VERB_QUERY, "duplicate response-ip action for '%s', overridden.",
|
|
ipstr);
|
|
}
|
|
if(strcmp(actnstr, "deny") == 0)
|
|
action = respip_deny;
|
|
else if(strcmp(actnstr, "redirect") == 0)
|
|
action = respip_redirect;
|
|
else if(strcmp(actnstr, "inform") == 0)
|
|
action = respip_inform;
|
|
else if(strcmp(actnstr, "inform_deny") == 0)
|
|
action = respip_inform_deny;
|
|
else if(strcmp(actnstr, "inform_redirect") == 0)
|
|
action = respip_inform_redirect;
|
|
else if(strcmp(actnstr, "always_transparent") == 0)
|
|
action = respip_always_transparent;
|
|
else if(strcmp(actnstr, "always_refuse") == 0)
|
|
action = respip_always_refuse;
|
|
else if(strcmp(actnstr, "always_nxdomain") == 0)
|
|
action = respip_always_nxdomain;
|
|
else if(strcmp(actnstr, "always_nodata") == 0)
|
|
action = respip_always_nodata;
|
|
else if(strcmp(actnstr, "always_deny") == 0)
|
|
action = respip_always_deny;
|
|
else {
|
|
log_err("unknown response-ip action %s", actnstr);
|
|
return 0;
|
|
}
|
|
node->action = action;
|
|
return 1;
|
|
}
|
|
|
|
/** allocate and initialize an rrset structure; this function is based
|
|
* on new_local_rrset() from the localzone.c module */
|
|
static struct ub_packed_rrset_key*
|
|
new_rrset(struct regional* region, uint16_t rrtype, uint16_t rrclass)
|
|
{
|
|
struct packed_rrset_data* pd;
|
|
struct ub_packed_rrset_key* rrset = regional_alloc_zero(
|
|
region, sizeof(*rrset));
|
|
if(!rrset) {
|
|
log_err("out of memory");
|
|
return NULL;
|
|
}
|
|
rrset->entry.key = rrset;
|
|
pd = regional_alloc_zero(region, sizeof(*pd));
|
|
if(!pd) {
|
|
log_err("out of memory");
|
|
return NULL;
|
|
}
|
|
pd->trust = rrset_trust_prim_noglue;
|
|
pd->security = sec_status_insecure;
|
|
rrset->entry.data = pd;
|
|
rrset->rk.dname = regional_alloc_zero(region, 1);
|
|
if(!rrset->rk.dname) {
|
|
log_err("out of memory");
|
|
return NULL;
|
|
}
|
|
rrset->rk.dname_len = 1;
|
|
rrset->rk.type = htons(rrtype);
|
|
rrset->rk.rrset_class = htons(rrclass);
|
|
return rrset;
|
|
}
|
|
|
|
/** enter local data as resource records into a response-ip node */
|
|
|
|
int
|
|
respip_enter_rr(struct regional* region, struct resp_addr* raddr,
|
|
uint16_t rrtype, uint16_t rrclass, time_t ttl, uint8_t* rdata,
|
|
size_t rdata_len, const char* rrstr, const char* netblockstr)
|
|
{
|
|
struct packed_rrset_data* pd;
|
|
struct sockaddr* sa;
|
|
sa = (struct sockaddr*)&raddr->node.addr;
|
|
if (rrtype == LDNS_RR_TYPE_CNAME && raddr->data) {
|
|
log_err("CNAME response-ip data (%s) can not co-exist with other "
|
|
"response-ip data for netblock %s", rrstr, netblockstr);
|
|
return 0;
|
|
} else if (raddr->data &&
|
|
raddr->data->rk.type == htons(LDNS_RR_TYPE_CNAME)) {
|
|
log_err("response-ip data (%s) can not be added; CNAME response-ip "
|
|
"data already in place for netblock %s", rrstr, netblockstr);
|
|
return 0;
|
|
} else if((rrtype != LDNS_RR_TYPE_CNAME) &&
|
|
((sa->sa_family == AF_INET && rrtype != LDNS_RR_TYPE_A) ||
|
|
(sa->sa_family == AF_INET6 && rrtype != LDNS_RR_TYPE_AAAA))) {
|
|
log_err("response-ip data %s record type does not correspond "
|
|
"to netblock %s address family", rrstr, netblockstr);
|
|
return 0;
|
|
}
|
|
|
|
if(!raddr->data) {
|
|
raddr->data = new_rrset(region, rrtype, rrclass);
|
|
if(!raddr->data)
|
|
return 0;
|
|
}
|
|
pd = raddr->data->entry.data;
|
|
return rrset_insert_rr(region, pd, rdata, rdata_len, ttl, rrstr);
|
|
}
|
|
|
|
static int
|
|
respip_enter_rrstr(struct regional* region, struct resp_addr* raddr,
|
|
const char* rrstr, const char* netblock)
|
|
{
|
|
uint8_t* nm;
|
|
uint16_t rrtype = 0, rrclass = 0;
|
|
time_t ttl = 0;
|
|
uint8_t rr[LDNS_RR_BUF_SIZE];
|
|
uint8_t* rdata = NULL;
|
|
size_t rdata_len = 0;
|
|
char buf[65536];
|
|
char bufshort[64];
|
|
int ret;
|
|
if(raddr->action != respip_redirect
|
|
&& raddr->action != respip_inform_redirect) {
|
|
log_err("cannot parse response-ip-data %s: response-ip "
|
|
"action for %s is not redirect", rrstr, netblock);
|
|
return 0;
|
|
}
|
|
ret = snprintf(buf, sizeof(buf), ". %s", rrstr);
|
|
if(ret < 0 || ret >= (int)sizeof(buf)) {
|
|
strlcpy(bufshort, rrstr, sizeof(bufshort));
|
|
log_err("bad response-ip-data: %s...", bufshort);
|
|
return 0;
|
|
}
|
|
if(!rrstr_get_rr_content(buf, &nm, &rrtype, &rrclass, &ttl, rr, sizeof(rr),
|
|
&rdata, &rdata_len)) {
|
|
log_err("bad response-ip-data: %s", rrstr);
|
|
return 0;
|
|
}
|
|
free(nm);
|
|
return respip_enter_rr(region, raddr, rrtype, rrclass, ttl, rdata,
|
|
rdata_len, rrstr, netblock);
|
|
}
|
|
|
|
static int
|
|
respip_data_cfg(struct respip_set* set, const char* ipstr, const char* rrstr)
|
|
{
|
|
struct resp_addr* node;
|
|
|
|
node=respip_find_or_create(set, ipstr, 0);
|
|
if(!node || node->action == respip_none) {
|
|
log_err("cannot parse response-ip-data %s: "
|
|
"response-ip node for %s not found", rrstr, ipstr);
|
|
return 0;
|
|
}
|
|
return respip_enter_rrstr(set->region, node, rrstr, ipstr);
|
|
}
|
|
|
|
static int
|
|
respip_set_apply_cfg(struct respip_set* set, char* const* tagname, int num_tags,
|
|
struct config_strbytelist* respip_tags,
|
|
struct config_str2list* respip_actions,
|
|
struct config_str2list* respip_data)
|
|
{
|
|
struct config_strbytelist* p;
|
|
struct config_str2list* pa;
|
|
struct config_str2list* pd;
|
|
|
|
set->tagname = tagname;
|
|
set->num_tags = num_tags;
|
|
|
|
p = respip_tags;
|
|
while(p) {
|
|
struct config_strbytelist* np = p->next;
|
|
|
|
log_assert(p->str && p->str2);
|
|
if(!respip_tag_cfg(set, p->str, p->str2, p->str2len)) {
|
|
config_del_strbytelist(p);
|
|
return 0;
|
|
}
|
|
free(p->str);
|
|
free(p->str2);
|
|
free(p);
|
|
p = np;
|
|
}
|
|
|
|
pa = respip_actions;
|
|
while(pa) {
|
|
struct config_str2list* np = pa->next;
|
|
log_assert(pa->str && pa->str2);
|
|
if(!respip_action_cfg(set, pa->str, pa->str2)) {
|
|
config_deldblstrlist(pa);
|
|
return 0;
|
|
}
|
|
free(pa->str);
|
|
free(pa->str2);
|
|
free(pa);
|
|
pa = np;
|
|
}
|
|
|
|
pd = respip_data;
|
|
while(pd) {
|
|
struct config_str2list* np = pd->next;
|
|
log_assert(pd->str && pd->str2);
|
|
if(!respip_data_cfg(set, pd->str, pd->str2)) {
|
|
config_deldblstrlist(pd);
|
|
return 0;
|
|
}
|
|
free(pd->str);
|
|
free(pd->str2);
|
|
free(pd);
|
|
pd = np;
|
|
}
|
|
addr_tree_init_parents(&set->ip_tree);
|
|
|
|
return 1;
|
|
}
|
|
|
|
int
|
|
respip_global_apply_cfg(struct respip_set* set, struct config_file* cfg)
|
|
{
|
|
int ret = respip_set_apply_cfg(set, cfg->tagname, cfg->num_tags,
|
|
cfg->respip_tags, cfg->respip_actions, cfg->respip_data);
|
|
cfg->respip_data = NULL;
|
|
cfg->respip_actions = NULL;
|
|
cfg->respip_tags = NULL;
|
|
return ret;
|
|
}
|
|
|
|
/** Iterate through raw view data and apply the view-specific respip
|
|
* configuration; at this point we should have already seen all the views,
|
|
* so if any of the views that respip data refer to does not exist, that's
|
|
* an error. This additional iteration through view configuration data
|
|
* is expected to not have significant performance impact (or rather, its
|
|
* performance impact is not expected to be prohibitive in the configuration
|
|
* processing phase).
|
|
*/
|
|
int
|
|
respip_views_apply_cfg(struct views* vs, struct config_file* cfg,
|
|
int* have_view_respip_cfg)
|
|
{
|
|
struct config_view* cv;
|
|
struct view* v;
|
|
int ret;
|
|
|
|
for(cv = cfg->views; cv; cv = cv->next) {
|
|
|
|
/** if no respip config for this view then there's
|
|
* nothing to do; note that even though respip data must go
|
|
* with respip action, we're checking for both here because
|
|
* we want to catch the case where the respip action is missing
|
|
* while the data is present */
|
|
if(!cv->respip_actions && !cv->respip_data)
|
|
continue;
|
|
|
|
if(!(v = views_find_view(vs, cv->name, 1))) {
|
|
log_err("view '%s' unexpectedly missing", cv->name);
|
|
return 0;
|
|
}
|
|
if(!v->respip_set) {
|
|
v->respip_set = respip_set_create();
|
|
if(!v->respip_set) {
|
|
log_err("out of memory");
|
|
lock_rw_unlock(&v->lock);
|
|
return 0;
|
|
}
|
|
}
|
|
ret = respip_set_apply_cfg(v->respip_set, NULL, 0, NULL,
|
|
cv->respip_actions, cv->respip_data);
|
|
lock_rw_unlock(&v->lock);
|
|
if(!ret) {
|
|
log_err("Error while applying respip configuration "
|
|
"for view '%s'", cv->name);
|
|
return 0;
|
|
}
|
|
*have_view_respip_cfg = (*have_view_respip_cfg ||
|
|
v->respip_set->ip_tree.count);
|
|
cv->respip_actions = NULL;
|
|
cv->respip_data = NULL;
|
|
}
|
|
return 1;
|
|
}
|
|
|
|
/**
|
|
* make a deep copy of 'key' in 'region'.
|
|
* This is largely derived from packed_rrset_copy_region() and
|
|
* packed_rrset_ptr_fixup(), but differs in the following points:
|
|
*
|
|
* - It doesn't assume all data in 'key' are in a contiguous memory region.
|
|
* Although that would be the case in most cases, 'key' can be passed from
|
|
* a lower-level module and it might not build the rrset to meet the
|
|
* assumption. In fact, an rrset specified as response-ip-data or generated
|
|
* in local_data_find_tag_datas() breaks the assumption. So it would be
|
|
* safer not to naively rely on the assumption. On the other hand, this
|
|
* function ensures the copied rrset data are in a contiguous region so
|
|
* that it won't cause a disruption even if an upper layer module naively
|
|
* assumes the memory layout.
|
|
* - It doesn't copy RRSIGs (if any) in 'key'. The rrset will be used in
|
|
* a reply that was already faked, so it doesn't make much sense to provide
|
|
* partial sigs even if they are valid themselves.
|
|
* - It doesn't adjust TTLs as it basically has to be a verbatim copy of 'key'
|
|
* just allocated in 'region' (the assumption is necessary TTL adjustment
|
|
* has been already done in 'key').
|
|
*
|
|
* This function returns the copied rrset key on success, and NULL on memory
|
|
* allocation failure.
|
|
*/
|
|
struct ub_packed_rrset_key*
|
|
respip_copy_rrset(const struct ub_packed_rrset_key* key, struct regional* region)
|
|
{
|
|
struct ub_packed_rrset_key* ck = regional_alloc(region,
|
|
sizeof(struct ub_packed_rrset_key));
|
|
struct packed_rrset_data* d;
|
|
struct packed_rrset_data* data = key->entry.data;
|
|
size_t dsize, i;
|
|
uint8_t* nextrdata;
|
|
|
|
/* derived from packed_rrset_copy_region(), but don't use
|
|
* packed_rrset_sizeof() and do exclude RRSIGs */
|
|
if(!ck)
|
|
return NULL;
|
|
ck->id = key->id;
|
|
memset(&ck->entry, 0, sizeof(ck->entry));
|
|
ck->entry.hash = key->entry.hash;
|
|
ck->entry.key = ck;
|
|
ck->rk = key->rk;
|
|
if(key->rk.dname) {
|
|
ck->rk.dname = regional_alloc_init(region, key->rk.dname,
|
|
key->rk.dname_len);
|
|
if(!ck->rk.dname)
|
|
return NULL;
|
|
ck->rk.dname_len = key->rk.dname_len;
|
|
} else {
|
|
ck->rk.dname = NULL;
|
|
ck->rk.dname_len = 0;
|
|
}
|
|
|
|
if((unsigned)data->count >= 0xffff00U)
|
|
return NULL; /* guard against integer overflow in dsize */
|
|
dsize = sizeof(struct packed_rrset_data) + data->count *
|
|
(sizeof(size_t)+sizeof(uint8_t*)+sizeof(time_t));
|
|
for(i=0; i<data->count; i++) {
|
|
if((unsigned)dsize >= 0x0fffffffU ||
|
|
(unsigned)data->rr_len[i] >= 0x0fffffffU)
|
|
return NULL; /* guard against integer overflow */
|
|
dsize += data->rr_len[i];
|
|
}
|
|
d = regional_alloc_zero(region, dsize);
|
|
if(!d)
|
|
return NULL;
|
|
*d = *data;
|
|
d->rrsig_count = 0;
|
|
ck->entry.data = d;
|
|
|
|
/* derived from packed_rrset_ptr_fixup() with copying the data */
|
|
d->rr_len = (size_t*)((uint8_t*)d + sizeof(struct packed_rrset_data));
|
|
d->rr_data = (uint8_t**)&(d->rr_len[d->count]);
|
|
d->rr_ttl = (time_t*)&(d->rr_data[d->count]);
|
|
nextrdata = (uint8_t*)&(d->rr_ttl[d->count]);
|
|
for(i=0; i<d->count; i++) {
|
|
d->rr_len[i] = data->rr_len[i];
|
|
d->rr_ttl[i] = data->rr_ttl[i];
|
|
d->rr_data[i] = nextrdata;
|
|
memcpy(d->rr_data[i], data->rr_data[i], data->rr_len[i]);
|
|
nextrdata += d->rr_len[i];
|
|
}
|
|
|
|
return ck;
|
|
}
|
|
|
|
int
|
|
respip_init(struct module_env* env, int id)
|
|
{
|
|
(void)env;
|
|
(void)id;
|
|
return 1;
|
|
}
|
|
|
|
void
|
|
respip_deinit(struct module_env* env, int id)
|
|
{
|
|
(void)env;
|
|
(void)id;
|
|
}
|
|
|
|
/** Convert a packed AAAA or A RRset to sockaddr. */
|
|
static int
|
|
rdata2sockaddr(const struct packed_rrset_data* rd, uint16_t rtype, size_t i,
|
|
struct sockaddr_storage* ss, socklen_t* addrlenp)
|
|
{
|
|
/* unbound can accept and cache odd-length AAAA/A records, so we have
|
|
* to validate the length. */
|
|
if(rtype == LDNS_RR_TYPE_A && rd->rr_len[i] == 6) {
|
|
struct sockaddr_in* sa4 = (struct sockaddr_in*)ss;
|
|
|
|
memset(sa4, 0, sizeof(*sa4));
|
|
sa4->sin_family = AF_INET;
|
|
memcpy(&sa4->sin_addr, rd->rr_data[i] + 2,
|
|
sizeof(sa4->sin_addr));
|
|
*addrlenp = sizeof(*sa4);
|
|
return 1;
|
|
} else if(rtype == LDNS_RR_TYPE_AAAA && rd->rr_len[i] == 18) {
|
|
struct sockaddr_in6* sa6 = (struct sockaddr_in6*)ss;
|
|
|
|
memset(sa6, 0, sizeof(*sa6));
|
|
sa6->sin6_family = AF_INET6;
|
|
memcpy(&sa6->sin6_addr, rd->rr_data[i] + 2,
|
|
sizeof(sa6->sin6_addr));
|
|
*addrlenp = sizeof(*sa6);
|
|
return 1;
|
|
}
|
|
return 0;
|
|
}
|
|
|
|
/**
|
|
* Search the given 'iptree' for response address information that matches
|
|
* any of the IP addresses in an AAAA or A in the answer section of the
|
|
* response (stored in 'rep'). If found, a pointer to the matched resp_addr
|
|
* structure will be returned, and '*rrset_id' is set to the index in
|
|
* rep->rrsets for the RRset that contains the matching IP address record
|
|
* (the index is normally 0, but can be larger than that if this is a CNAME
|
|
* chain or type-ANY response).
|
|
* Returns resp_addr holding read lock.
|
|
*/
|
|
static struct resp_addr*
|
|
respip_addr_lookup(const struct reply_info *rep, struct respip_set* rs,
|
|
size_t* rrset_id, size_t* rr_id)
|
|
{
|
|
size_t i;
|
|
struct resp_addr* ra;
|
|
struct sockaddr_storage ss;
|
|
socklen_t addrlen;
|
|
|
|
lock_rw_rdlock(&rs->lock);
|
|
for(i=0; i<rep->an_numrrsets; i++) {
|
|
size_t j;
|
|
const struct packed_rrset_data* rd;
|
|
uint16_t rtype = ntohs(rep->rrsets[i]->rk.type);
|
|
|
|
if(rtype != LDNS_RR_TYPE_A && rtype != LDNS_RR_TYPE_AAAA)
|
|
continue;
|
|
rd = rep->rrsets[i]->entry.data;
|
|
for(j = 0; j < rd->count; j++) {
|
|
if(!rdata2sockaddr(rd, rtype, j, &ss, &addrlen))
|
|
continue;
|
|
ra = (struct resp_addr*)addr_tree_lookup(&rs->ip_tree,
|
|
&ss, addrlen);
|
|
if(ra) {
|
|
*rrset_id = i;
|
|
*rr_id = j;
|
|
lock_rw_rdlock(&ra->lock);
|
|
lock_rw_unlock(&rs->lock);
|
|
return ra;
|
|
}
|
|
}
|
|
}
|
|
lock_rw_unlock(&rs->lock);
|
|
return NULL;
|
|
}
|
|
|
|
/**
|
|
* See if response-ip or tag data should override the original answer rrset
|
|
* (which is rep->rrsets[rrset_id]) and if so override it.
|
|
* This is (mostly) equivalent to localzone.c:local_data_answer() but for
|
|
* response-ip actions.
|
|
* Note that this function distinguishes error conditions from "success but
|
|
* not overridden". This is because we want to avoid accidentally applying
|
|
* the "no data" action in case of error.
|
|
* @param action: action to apply
|
|
* @param data: RRset to use for override
|
|
* @param qtype: original query type
|
|
* @param rep: original reply message
|
|
* @param rrset_id: the rrset ID in 'rep' to which the action should apply
|
|
* @param new_repp: see respip_rewrite_reply
|
|
* @param tag: if >= 0 the tag ID used to determine the action and data
|
|
* @param tag_datas: data corresponding to 'tag'.
|
|
* @param tag_datas_size: size of 'tag_datas'
|
|
* @param tagname: array of tag names, used for logging
|
|
* @param num_tags: size of 'tagname', used for logging
|
|
* @param redirect_rrsetp: ptr to redirect record
|
|
* @param region: region for building new reply
|
|
* @return 1 if overridden, 0 if not overridden, -1 on error.
|
|
*/
|
|
static int
|
|
respip_data_answer(enum respip_action action,
|
|
struct ub_packed_rrset_key* data,
|
|
uint16_t qtype, const struct reply_info* rep,
|
|
size_t rrset_id, struct reply_info** new_repp, int tag,
|
|
struct config_strlist** tag_datas, size_t tag_datas_size,
|
|
char* const* tagname, int num_tags,
|
|
struct ub_packed_rrset_key** redirect_rrsetp, struct regional* region)
|
|
{
|
|
struct ub_packed_rrset_key* rp = data;
|
|
struct reply_info* new_rep;
|
|
*redirect_rrsetp = NULL;
|
|
|
|
if(action == respip_redirect && tag != -1 &&
|
|
(size_t)tag<tag_datas_size && tag_datas[tag]) {
|
|
struct query_info dataqinfo;
|
|
struct ub_packed_rrset_key r;
|
|
|
|
/* Extract parameters of the original answer rrset that can be
|
|
* rewritten below, in the form of query_info. Note that these
|
|
* can be different from the info of the original query if the
|
|
* rrset is a CNAME target.*/
|
|
memset(&dataqinfo, 0, sizeof(dataqinfo));
|
|
dataqinfo.qname = rep->rrsets[rrset_id]->rk.dname;
|
|
dataqinfo.qname_len = rep->rrsets[rrset_id]->rk.dname_len;
|
|
dataqinfo.qtype = ntohs(rep->rrsets[rrset_id]->rk.type);
|
|
dataqinfo.qclass = ntohs(rep->rrsets[rrset_id]->rk.rrset_class);
|
|
|
|
memset(&r, 0, sizeof(r));
|
|
if(local_data_find_tag_datas(&dataqinfo, tag_datas[tag], &r,
|
|
region)) {
|
|
verbose(VERB_ALGO,
|
|
"response-ip redirect with tag data [%d] %s",
|
|
tag, (tag<num_tags?tagname[tag]:"null"));
|
|
/* use copy_rrset() to 'normalize' memory layout */
|
|
rp = respip_copy_rrset(&r, region);
|
|
if(!rp)
|
|
return -1;
|
|
}
|
|
}
|
|
if(!rp)
|
|
return 0;
|
|
|
|
/* If we are using response-ip-data, we need to make a copy of rrset
|
|
* to replace the rrset's dname. Note that, unlike local data, we
|
|
* rename the dname for other actions than redirect. This is because
|
|
* response-ip-data isn't associated to any specific name. */
|
|
if(rp == data) {
|
|
rp = respip_copy_rrset(rp, region);
|
|
if(!rp)
|
|
return -1;
|
|
rp->rk.dname = rep->rrsets[rrset_id]->rk.dname;
|
|
rp->rk.dname_len = rep->rrsets[rrset_id]->rk.dname_len;
|
|
}
|
|
|
|
/* Build a new reply with redirect rrset. We keep any preceding CNAMEs
|
|
* and replace the address rrset that triggers the action. If it's
|
|
* type ANY query, however, no other answer records should be kept
|
|
* (note that it can't be a CNAME chain in this case due to
|
|
* sanitizing). */
|
|
if(qtype == LDNS_RR_TYPE_ANY)
|
|
rrset_id = 0;
|
|
new_rep = make_new_reply_info(rep, region, rrset_id + 1, rrset_id);
|
|
if(!new_rep)
|
|
return -1;
|
|
rp->rk.flags |= PACKED_RRSET_FIXEDTTL; /* avoid adjusting TTL */
|
|
new_rep->rrsets[rrset_id] = rp;
|
|
|
|
*redirect_rrsetp = rp;
|
|
*new_repp = new_rep;
|
|
return 1;
|
|
}
|
|
|
|
/**
|
|
* apply response ip action in case where no action data is provided.
|
|
* this is similar to localzone.c:lz_zone_answer() but simplified due to
|
|
* the characteristics of response ip:
|
|
* - 'deny' variants will be handled at the caller side
|
|
* - no specific processing for 'transparent' variants: unlike local zones,
|
|
* there is no such a case of 'no data but name existing'. so all variants
|
|
* just mean 'transparent if no data'.
|
|
* @param qtype: query type
|
|
* @param action: found action
|
|
* @param rep:
|
|
* @param new_repp
|
|
* @param rrset_id
|
|
* @param region: region for building new reply
|
|
* @return 1 on success, 0 on error.
|
|
*/
|
|
static int
|
|
respip_nodata_answer(uint16_t qtype, enum respip_action action,
|
|
const struct reply_info *rep, size_t rrset_id,
|
|
struct reply_info** new_repp, struct regional* region)
|
|
{
|
|
struct reply_info* new_rep;
|
|
|
|
if(action == respip_refuse || action == respip_always_refuse) {
|
|
new_rep = make_new_reply_info(rep, region, 0, 0);
|
|
if(!new_rep)
|
|
return 0;
|
|
FLAGS_SET_RCODE(new_rep->flags, LDNS_RCODE_REFUSED);
|
|
*new_repp = new_rep;
|
|
return 1;
|
|
} else if(action == respip_static || action == respip_redirect ||
|
|
action == respip_always_nxdomain ||
|
|
action == respip_always_nodata ||
|
|
action == respip_inform_redirect) {
|
|
/* Since we don't know about other types of the owner name,
|
|
* we generally return NOERROR/NODATA unless an NXDOMAIN action
|
|
* is explicitly specified. */
|
|
int rcode = (action == respip_always_nxdomain)?
|
|
LDNS_RCODE_NXDOMAIN:LDNS_RCODE_NOERROR;
|
|
/* We should empty the answer section except for any preceding
|
|
* CNAMEs (in that case rrset_id > 0). Type-ANY case is
|
|
* special as noted in respip_data_answer(). */
|
|
if(qtype == LDNS_RR_TYPE_ANY)
|
|
rrset_id = 0;
|
|
new_rep = make_new_reply_info(rep, region, rrset_id, rrset_id);
|
|
if(!new_rep)
|
|
return 0;
|
|
FLAGS_SET_RCODE(new_rep->flags, rcode);
|
|
*new_repp = new_rep;
|
|
return 1;
|
|
}
|
|
|
|
return 1;
|
|
}
|
|
|
|
/** Populate action info structure with the results of response-ip action
|
|
* processing, iff as the result of response-ip processing we are actually
|
|
* taking some action. Only action is set if action_only is true.
|
|
* Returns true on success, false on failure.
|
|
*/
|
|
static int
|
|
populate_action_info(struct respip_action_info* actinfo,
|
|
enum respip_action action, const struct resp_addr* raddr,
|
|
const struct ub_packed_rrset_key* ATTR_UNUSED(rrset),
|
|
int ATTR_UNUSED(tag), const struct respip_set* ATTR_UNUSED(ipset),
|
|
int ATTR_UNUSED(action_only), struct regional* region, int rpz_used,
|
|
int rpz_log, char* log_name, int rpz_cname_override)
|
|
{
|
|
if(action == respip_none || !raddr)
|
|
return 1;
|
|
actinfo->action = action;
|
|
actinfo->rpz_used = rpz_used;
|
|
actinfo->rpz_log = rpz_log;
|
|
actinfo->log_name = log_name;
|
|
actinfo->rpz_cname_override = rpz_cname_override;
|
|
|
|
/* for inform variants, make a copy of the matched address block for
|
|
* later logging. We make a copy to proactively avoid disruption if
|
|
* and when we allow a dynamic update to the respip tree. */
|
|
if(action == respip_inform || action == respip_inform_deny ||
|
|
rpz_used) {
|
|
struct respip_addr_info* a =
|
|
regional_alloc_zero(region, sizeof(*a));
|
|
if(!a) {
|
|
log_err("out of memory");
|
|
return 0;
|
|
}
|
|
a->addr = raddr->node.addr;
|
|
a->addrlen = raddr->node.addrlen;
|
|
a->net = raddr->node.net;
|
|
actinfo->addrinfo = a;
|
|
}
|
|
|
|
return 1;
|
|
}
|
|
|
|
static int
|
|
respip_use_rpz(struct resp_addr* raddr, struct rpz* r,
|
|
enum respip_action* action,
|
|
struct ub_packed_rrset_key** data, int* rpz_log, char** log_name,
|
|
int* rpz_cname_override, struct regional* region, int* is_rpz,
|
|
int* rpz_passthru)
|
|
{
|
|
if(rpz_passthru && *rpz_passthru)
|
|
return 0;
|
|
if(r->action_override == RPZ_DISABLED_ACTION) {
|
|
*is_rpz = 0;
|
|
return 1;
|
|
}
|
|
else if(r->action_override == RPZ_NO_OVERRIDE_ACTION)
|
|
*action = raddr->action;
|
|
else
|
|
*action = rpz_action_to_respip_action(r->action_override);
|
|
if(r->action_override == RPZ_CNAME_OVERRIDE_ACTION &&
|
|
r->cname_override) {
|
|
*data = r->cname_override;
|
|
*rpz_cname_override = 1;
|
|
}
|
|
if(*action == respip_always_transparent /* RPZ_PASSTHRU_ACTION */
|
|
&& rpz_passthru)
|
|
*rpz_passthru = 1;
|
|
*rpz_log = r->log;
|
|
if(r->log_name)
|
|
if(!(*log_name = regional_strdup(region, r->log_name)))
|
|
return 0;
|
|
*is_rpz = 1;
|
|
return 1;
|
|
}
|
|
|
|
int
|
|
respip_rewrite_reply(const struct query_info* qinfo,
|
|
const struct respip_client_info* cinfo, const struct reply_info* rep,
|
|
struct reply_info** new_repp, struct respip_action_info* actinfo,
|
|
struct ub_packed_rrset_key** alias_rrset, int search_only,
|
|
struct regional* region, struct auth_zones* az, int* rpz_passthru)
|
|
{
|
|
const uint8_t* ctaglist;
|
|
size_t ctaglen;
|
|
const uint8_t* tag_actions;
|
|
size_t tag_actions_size;
|
|
struct config_strlist** tag_datas;
|
|
size_t tag_datas_size;
|
|
struct view* view = NULL;
|
|
struct respip_set* ipset = NULL;
|
|
size_t rrset_id = 0, rr_id = 0;
|
|
enum respip_action action = respip_none;
|
|
int tag = -1;
|
|
struct resp_addr* raddr = NULL;
|
|
int ret = 1;
|
|
struct ub_packed_rrset_key* redirect_rrset = NULL;
|
|
struct rpz* r;
|
|
struct auth_zone* a = NULL;
|
|
struct ub_packed_rrset_key* data = NULL;
|
|
int rpz_used = 0;
|
|
int rpz_log = 0;
|
|
int rpz_cname_override = 0;
|
|
char* log_name = NULL;
|
|
|
|
if(!cinfo)
|
|
goto done;
|
|
ctaglist = cinfo->taglist;
|
|
ctaglen = cinfo->taglen;
|
|
tag_actions = cinfo->tag_actions;
|
|
tag_actions_size = cinfo->tag_actions_size;
|
|
tag_datas = cinfo->tag_datas;
|
|
tag_datas_size = cinfo->tag_datas_size;
|
|
view = cinfo->view;
|
|
ipset = cinfo->respip_set;
|
|
|
|
log_assert(ipset);
|
|
|
|
/** Try to use response-ip config from the view first; use
|
|
* global response-ip config if we don't have the view or we don't
|
|
* have the matching per-view config (and the view allows the use
|
|
* of global data in this case).
|
|
* Note that we lock the view even if we only use view members that
|
|
* currently don't change after creation. This is for safety for
|
|
* future possible changes as the view documentation seems to expect
|
|
* any of its member can change in the view's lifetime.
|
|
* Note also that we assume 'view' is valid in this function, which
|
|
* should be safe (see unbound bug #1191) */
|
|
if(view) {
|
|
lock_rw_rdlock(&view->lock);
|
|
if(view->respip_set) {
|
|
if((raddr = respip_addr_lookup(rep,
|
|
view->respip_set, &rrset_id, &rr_id))) {
|
|
/** for per-view respip directives the action
|
|
* can only be direct (i.e. not tag-based) */
|
|
action = raddr->action;
|
|
}
|
|
}
|
|
if(!raddr && !view->isfirst)
|
|
goto done;
|
|
if(!raddr && view->isfirst) {
|
|
lock_rw_unlock(&view->lock);
|
|
view = NULL;
|
|
}
|
|
}
|
|
if(!raddr && (raddr = respip_addr_lookup(rep, ipset,
|
|
&rrset_id, &rr_id))) {
|
|
action = (enum respip_action)local_data_find_tag_action(
|
|
raddr->taglist, raddr->taglen, ctaglist, ctaglen,
|
|
tag_actions, tag_actions_size,
|
|
(enum localzone_type)raddr->action, &tag,
|
|
ipset->tagname, ipset->num_tags);
|
|
}
|
|
lock_rw_rdlock(&az->rpz_lock);
|
|
for(a = az->rpz_first; a && !raddr && !(rpz_passthru && *rpz_passthru); a = a->rpz_az_next) {
|
|
lock_rw_rdlock(&a->lock);
|
|
r = a->rpz;
|
|
if(!r->taglist || taglist_intersect(r->taglist,
|
|
r->taglistlen, ctaglist, ctaglen)) {
|
|
if((raddr = respip_addr_lookup(rep,
|
|
r->respip_set, &rrset_id, &rr_id))) {
|
|
if(!respip_use_rpz(raddr, r, &action, &data,
|
|
&rpz_log, &log_name, &rpz_cname_override,
|
|
region, &rpz_used, rpz_passthru)) {
|
|
log_err("out of memory");
|
|
lock_rw_unlock(&raddr->lock);
|
|
lock_rw_unlock(&a->lock);
|
|
lock_rw_unlock(&az->rpz_lock);
|
|
return 0;
|
|
}
|
|
if(rpz_used) {
|
|
if(verbosity >= VERB_ALGO) {
|
|
struct sockaddr_storage ss;
|
|
socklen_t ss_len = 0;
|
|
char nm[256], ip[256];
|
|
char qn[255+1];
|
|
if(!rdata2sockaddr(rep->rrsets[rrset_id]->entry.data, ntohs(rep->rrsets[rrset_id]->rk.type), rr_id, &ss, &ss_len))
|
|
snprintf(ip, sizeof(ip), "invalidRRdata");
|
|
else
|
|
addr_to_str(&ss, ss_len, ip, sizeof(ip));
|
|
dname_str(qinfo->qname, qn);
|
|
addr_to_str(&raddr->node.addr,
|
|
raddr->node.addrlen,
|
|
nm, sizeof(nm));
|
|
verbose(VERB_ALGO, "respip: rpz: response-ip trigger %s/%d on %s %s with action %s", nm, raddr->node.net, qn, ip, rpz_action_to_string(respip_action_to_rpz_action(action)));
|
|
}
|
|
/* break to make sure 'a' stays pointed
|
|
* to used auth_zone, and keeps lock */
|
|
break;
|
|
}
|
|
lock_rw_unlock(&raddr->lock);
|
|
raddr = NULL;
|
|
actinfo->rpz_disabled++;
|
|
}
|
|
}
|
|
lock_rw_unlock(&a->lock);
|
|
}
|
|
lock_rw_unlock(&az->rpz_lock);
|
|
if(raddr && !search_only) {
|
|
int result = 0;
|
|
|
|
/* first, see if we have response-ip or tag action for the
|
|
* action except for 'always' variants. */
|
|
if(action != respip_always_refuse
|
|
&& action != respip_always_transparent
|
|
&& action != respip_always_nxdomain
|
|
&& action != respip_always_nodata
|
|
&& action != respip_always_deny
|
|
&& (result = respip_data_answer(action,
|
|
(data) ? data : raddr->data, qinfo->qtype, rep,
|
|
rrset_id, new_repp, tag, tag_datas, tag_datas_size,
|
|
ipset->tagname, ipset->num_tags, &redirect_rrset,
|
|
region)) < 0) {
|
|
ret = 0;
|
|
goto done;
|
|
}
|
|
|
|
/* if no action data applied, take action specific to the
|
|
* action without data. */
|
|
if(!result && !respip_nodata_answer(qinfo->qtype, action, rep,
|
|
rrset_id, new_repp, region)) {
|
|
ret = 0;
|
|
goto done;
|
|
}
|
|
}
|
|
done:
|
|
if(view) {
|
|
lock_rw_unlock(&view->lock);
|
|
}
|
|
if(ret) {
|
|
/* If we're redirecting the original answer to a
|
|
* CNAME, record the CNAME rrset so the caller can take
|
|
* the appropriate action. Note that we don't check the
|
|
* action type; it should normally be 'redirect', but it
|
|
* can be of other type when a data-dependent tag action
|
|
* uses redirect response-ip data.
|
|
*/
|
|
if(redirect_rrset &&
|
|
redirect_rrset->rk.type == ntohs(LDNS_RR_TYPE_CNAME) &&
|
|
qinfo->qtype != LDNS_RR_TYPE_ANY)
|
|
*alias_rrset = redirect_rrset;
|
|
/* on success, populate respip result structure */
|
|
ret = populate_action_info(actinfo, action, raddr,
|
|
redirect_rrset, tag, ipset, search_only, region,
|
|
rpz_used, rpz_log, log_name, rpz_cname_override);
|
|
}
|
|
if(raddr) {
|
|
lock_rw_unlock(&raddr->lock);
|
|
}
|
|
if(rpz_used) {
|
|
lock_rw_unlock(&a->lock);
|
|
}
|
|
return ret;
|
|
}
|
|
|
|
static int
|
|
generate_cname_request(struct module_qstate* qstate,
|
|
struct ub_packed_rrset_key* alias_rrset)
|
|
{
|
|
struct module_qstate* subq = NULL;
|
|
struct query_info subqi;
|
|
|
|
memset(&subqi, 0, sizeof(subqi));
|
|
get_cname_target(alias_rrset, &subqi.qname, &subqi.qname_len);
|
|
if(!subqi.qname)
|
|
return 0; /* unexpected: not a valid CNAME RDATA */
|
|
subqi.qtype = qstate->qinfo.qtype;
|
|
subqi.qclass = qstate->qinfo.qclass;
|
|
fptr_ok(fptr_whitelist_modenv_attach_sub(qstate->env->attach_sub));
|
|
return (*qstate->env->attach_sub)(qstate, &subqi, BIT_RD, 0, 0, &subq);
|
|
}
|
|
|
|
void
|
|
respip_operate(struct module_qstate* qstate, enum module_ev event, int id,
|
|
struct outbound_entry* outbound)
|
|
{
|
|
struct respip_qstate* rq = (struct respip_qstate*)qstate->minfo[id];
|
|
|
|
log_query_info(VERB_QUERY, "respip operate: query", &qstate->qinfo);
|
|
(void)outbound;
|
|
|
|
if(event == module_event_new || event == module_event_pass) {
|
|
if(!rq) {
|
|
rq = regional_alloc_zero(qstate->region, sizeof(*rq));
|
|
if(!rq)
|
|
goto servfail;
|
|
rq->state = RESPIP_INIT;
|
|
qstate->minfo[id] = rq;
|
|
}
|
|
if(rq->state == RESPIP_SUBQUERY_FINISHED) {
|
|
qstate->ext_state[id] = module_finished;
|
|
return;
|
|
}
|
|
verbose(VERB_ALGO, "respip: pass to next module");
|
|
qstate->ext_state[id] = module_wait_module;
|
|
} else if(event == module_event_moddone) {
|
|
/* If the reply may be subject to response-ip rewriting
|
|
* according to the query type, check the actions. If a
|
|
* rewrite is necessary, we'll replace the reply in qstate
|
|
* with the new one. */
|
|
enum module_ext_state next_state = module_finished;
|
|
|
|
if((qstate->qinfo.qtype == LDNS_RR_TYPE_A ||
|
|
qstate->qinfo.qtype == LDNS_RR_TYPE_AAAA ||
|
|
qstate->qinfo.qtype == LDNS_RR_TYPE_ANY) &&
|
|
qstate->return_msg && qstate->return_msg->rep) {
|
|
struct reply_info* new_rep = qstate->return_msg->rep;
|
|
struct ub_packed_rrset_key* alias_rrset = NULL;
|
|
struct respip_action_info actinfo = {0, 0, 0, 0, NULL, 0, NULL};
|
|
actinfo.action = respip_none;
|
|
|
|
if(!respip_rewrite_reply(&qstate->qinfo,
|
|
qstate->client_info, qstate->return_msg->rep,
|
|
&new_rep, &actinfo, &alias_rrset, 0,
|
|
qstate->region, qstate->env->auth_zones,
|
|
&qstate->rpz_passthru)) {
|
|
goto servfail;
|
|
}
|
|
if(actinfo.action != respip_none) {
|
|
/* save action info for logging on a
|
|
* per-front-end-query basis */
|
|
if(!(qstate->respip_action_info =
|
|
regional_alloc_init(qstate->region,
|
|
&actinfo, sizeof(actinfo))))
|
|
{
|
|
log_err("out of memory");
|
|
goto servfail;
|
|
}
|
|
} else {
|
|
qstate->respip_action_info = NULL;
|
|
}
|
|
if (actinfo.action == respip_always_deny ||
|
|
(new_rep == qstate->return_msg->rep &&
|
|
(actinfo.action == respip_deny ||
|
|
actinfo.action == respip_inform_deny))) {
|
|
/* for deny-variant actions (unless response-ip
|
|
* data is applied), mark the query state so
|
|
* the response will be dropped for all
|
|
* clients. */
|
|
qstate->is_drop = 1;
|
|
} else if(alias_rrset) {
|
|
if(!generate_cname_request(qstate, alias_rrset))
|
|
goto servfail;
|
|
next_state = module_wait_subquery;
|
|
}
|
|
qstate->return_msg->rep = new_rep;
|
|
}
|
|
qstate->ext_state[id] = next_state;
|
|
} else
|
|
qstate->ext_state[id] = module_finished;
|
|
|
|
return;
|
|
|
|
servfail:
|
|
qstate->return_rcode = LDNS_RCODE_SERVFAIL;
|
|
qstate->return_msg = NULL;
|
|
}
|
|
|
|
int
|
|
respip_merge_cname(struct reply_info* base_rep,
|
|
const struct query_info* qinfo, const struct reply_info* tgt_rep,
|
|
const struct respip_client_info* cinfo, int must_validate,
|
|
struct reply_info** new_repp, struct regional* region,
|
|
struct auth_zones* az)
|
|
{
|
|
struct reply_info* new_rep;
|
|
struct reply_info* tmp_rep = NULL; /* just a placeholder */
|
|
struct ub_packed_rrset_key* alias_rrset = NULL; /* ditto */
|
|
uint16_t tgt_rcode;
|
|
size_t i, j;
|
|
struct respip_action_info actinfo = {0, 0, 0, 0, NULL, 0, NULL};
|
|
actinfo.action = respip_none;
|
|
|
|
/* If the query for the CNAME target would result in an unusual rcode,
|
|
* we generally translate it as a failure for the base query
|
|
* (which would then be translated into SERVFAIL). The only exception
|
|
* is NXDOMAIN and YXDOMAIN, which are passed to the end client(s).
|
|
* The YXDOMAIN case would be rare but still possible (when
|
|
* DNSSEC-validated DNAME has been cached but synthesizing CNAME
|
|
* can't be generated due to length limitation) */
|
|
tgt_rcode = FLAGS_GET_RCODE(tgt_rep->flags);
|
|
if((tgt_rcode != LDNS_RCODE_NOERROR &&
|
|
tgt_rcode != LDNS_RCODE_NXDOMAIN &&
|
|
tgt_rcode != LDNS_RCODE_YXDOMAIN) ||
|
|
(must_validate && tgt_rep->security <= sec_status_bogus)) {
|
|
return 0;
|
|
}
|
|
|
|
/* see if the target reply would be subject to a response-ip action. */
|
|
if(!respip_rewrite_reply(qinfo, cinfo, tgt_rep, &tmp_rep, &actinfo,
|
|
&alias_rrset, 1, region, az, NULL))
|
|
return 0;
|
|
if(actinfo.action != respip_none) {
|
|
log_info("CNAME target of redirect response-ip action would "
|
|
"be subject to response-ip action, too; stripped");
|
|
*new_repp = base_rep;
|
|
return 1;
|
|
}
|
|
|
|
/* Append target reply to the base. Since we cannot assume
|
|
* tgt_rep->rrsets is valid throughout the lifetime of new_rep
|
|
* or it can be safely shared by multiple threads, we need to make a
|
|
* deep copy. */
|
|
new_rep = make_new_reply_info(base_rep, region,
|
|
base_rep->an_numrrsets + tgt_rep->an_numrrsets,
|
|
base_rep->an_numrrsets);
|
|
if(!new_rep)
|
|
return 0;
|
|
for(i=0,j=base_rep->an_numrrsets; i<tgt_rep->an_numrrsets; i++,j++) {
|
|
new_rep->rrsets[j] = respip_copy_rrset(tgt_rep->rrsets[i], region);
|
|
if(!new_rep->rrsets[j])
|
|
return 0;
|
|
}
|
|
|
|
FLAGS_SET_RCODE(new_rep->flags, tgt_rcode);
|
|
*new_repp = new_rep;
|
|
return 1;
|
|
}
|
|
|
|
void
|
|
respip_inform_super(struct module_qstate* qstate, int id,
|
|
struct module_qstate* super)
|
|
{
|
|
struct respip_qstate* rq = (struct respip_qstate*)super->minfo[id];
|
|
struct reply_info* new_rep = NULL;
|
|
|
|
rq->state = RESPIP_SUBQUERY_FINISHED;
|
|
|
|
/* respip subquery should have always been created with a valid reply
|
|
* in super. */
|
|
log_assert(super->return_msg && super->return_msg->rep);
|
|
|
|
/* return_msg can be NULL when, e.g., the sub query resulted in
|
|
* SERVFAIL, in which case we regard it as a failure of the original
|
|
* query. Other checks are probably redundant, but we check them
|
|
* for safety. */
|
|
if(!qstate->return_msg || !qstate->return_msg->rep ||
|
|
qstate->return_rcode != LDNS_RCODE_NOERROR)
|
|
goto fail;
|
|
|
|
if(!respip_merge_cname(super->return_msg->rep, &qstate->qinfo,
|
|
qstate->return_msg->rep, super->client_info,
|
|
super->env->need_to_validate, &new_rep, super->region,
|
|
qstate->env->auth_zones))
|
|
goto fail;
|
|
super->return_msg->rep = new_rep;
|
|
return;
|
|
|
|
fail:
|
|
super->return_rcode = LDNS_RCODE_SERVFAIL;
|
|
super->return_msg = NULL;
|
|
return;
|
|
}
|
|
|
|
void
|
|
respip_clear(struct module_qstate* qstate, int id)
|
|
{
|
|
qstate->minfo[id] = NULL;
|
|
}
|
|
|
|
size_t
|
|
respip_get_mem(struct module_env* env, int id)
|
|
{
|
|
(void)env;
|
|
(void)id;
|
|
return 0;
|
|
}
|
|
|
|
/**
|
|
* The response-ip function block
|
|
*/
|
|
static struct module_func_block respip_block = {
|
|
"respip",
|
|
&respip_init, &respip_deinit, &respip_operate, &respip_inform_super,
|
|
&respip_clear, &respip_get_mem
|
|
};
|
|
|
|
struct module_func_block*
|
|
respip_get_funcblock(void)
|
|
{
|
|
return &respip_block;
|
|
}
|
|
|
|
enum respip_action
|
|
resp_addr_get_action(const struct resp_addr* addr)
|
|
{
|
|
return addr ? addr->action : respip_none;
|
|
}
|
|
|
|
struct ub_packed_rrset_key*
|
|
resp_addr_get_rrset(struct resp_addr* addr)
|
|
{
|
|
return addr ? addr->data : NULL;
|
|
}
|
|
|
|
int
|
|
respip_set_is_empty(const struct respip_set* set)
|
|
{
|
|
return set ? set->ip_tree.count == 0 : 1;
|
|
}
|
|
|
|
void
|
|
respip_inform_print(struct respip_action_info* respip_actinfo, uint8_t* qname,
|
|
uint16_t qtype, uint16_t qclass, struct local_rrset* local_alias,
|
|
struct sockaddr_storage* addr, socklen_t addrlen)
|
|
{
|
|
char srcip[128], respip[128], txt[512];
|
|
unsigned port;
|
|
struct respip_addr_info* respip_addr = respip_actinfo->addrinfo;
|
|
size_t txtlen = 0;
|
|
const char* actionstr = NULL;
|
|
|
|
if(local_alias)
|
|
qname = local_alias->rrset->rk.dname;
|
|
port = (unsigned)((addr->ss_family == AF_INET) ?
|
|
ntohs(((struct sockaddr_in*)addr)->sin_port) :
|
|
ntohs(((struct sockaddr_in6*)addr)->sin6_port));
|
|
addr_to_str(addr, addrlen, srcip, sizeof(srcip));
|
|
addr_to_str(&respip_addr->addr, respip_addr->addrlen,
|
|
respip, sizeof(respip));
|
|
if(respip_actinfo->rpz_log) {
|
|
txtlen += snprintf(txt+txtlen, sizeof(txt)-txtlen, "%s",
|
|
"rpz: applied ");
|
|
if(respip_actinfo->rpz_cname_override)
|
|
actionstr = rpz_action_to_string(
|
|
RPZ_CNAME_OVERRIDE_ACTION);
|
|
else
|
|
actionstr = rpz_action_to_string(
|
|
respip_action_to_rpz_action(
|
|
respip_actinfo->action));
|
|
}
|
|
if(respip_actinfo->log_name) {
|
|
txtlen += snprintf(txt+txtlen, sizeof(txt)-txtlen,
|
|
"[%s] ", respip_actinfo->log_name);
|
|
}
|
|
snprintf(txt+txtlen, sizeof(txt)-txtlen,
|
|
"%s/%d %s %s@%u", respip, respip_addr->net,
|
|
(actionstr) ? actionstr : "inform", srcip, port);
|
|
log_nametypeclass(NO_VERBOSE, txt, qname, qtype, qclass);
|
|
}
|