1 /* $NetBSD: dns64.c,v 1.1 2024/02/18 20:57:31 christos Exp $ */
2
3 /*
4 * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
5 *
6 * SPDX-License-Identifier: MPL-2.0
7 *
8 * This Source Code Form is subject to the terms of the Mozilla Public
9 * License, v. 2.0. If a copy of the MPL was not distributed with this
10 * file, you can obtain one at https://mozilla.org/MPL/2.0/.
11 *
12 * See the COPYRIGHT file distributed with this work for additional
13 * information regarding copyright ownership.
14 */
15
16 #include <stdbool.h>
17 #include <string.h>
18
19 #include <isc/list.h>
20 #include <isc/mem.h>
21 #include <isc/netaddr.h>
22 #include <isc/string.h>
23 #include <isc/util.h>
24
25 #include <dns/acl.h>
26 #include <dns/dns64.h>
27 #include <dns/rdata.h>
28 #include <dns/rdataset.h>
29 #include <dns/result.h>
30
31 struct dns_dns64 {
32 unsigned char bits[16]; /*
33 * Prefix + suffix bits.
34 */
35 dns_acl_t *clients; /*
36 * Which clients get mapped
37 * addresses.
38 */
39 dns_acl_t *mapped; /*
40 * IPv4 addresses to be mapped.
41 */
42 dns_acl_t *excluded; /*
43 * IPv6 addresses that are
44 * treated as not existing.
45 */
46 unsigned int prefixlen; /*
47 * Start of mapped address.
48 */
49 unsigned int flags;
50 isc_mem_t *mctx;
51 ISC_LINK(dns_dns64_t) link;
52 };
53
54 isc_result_t
dns_dns64_create(isc_mem_t * mctx,const isc_netaddr_t * prefix,unsigned int prefixlen,const isc_netaddr_t * suffix,dns_acl_t * clients,dns_acl_t * mapped,dns_acl_t * excluded,unsigned int flags,dns_dns64_t ** dns64p)55 dns_dns64_create(isc_mem_t *mctx, const isc_netaddr_t *prefix,
56 unsigned int prefixlen, const isc_netaddr_t *suffix,
57 dns_acl_t *clients, dns_acl_t *mapped, dns_acl_t *excluded,
58 unsigned int flags, dns_dns64_t **dns64p) {
59 dns_dns64_t *dns64;
60 unsigned int nbytes = 16;
61
62 REQUIRE(prefix != NULL && prefix->family == AF_INET6);
63 /* Legal prefix lengths from rfc6052.txt. */
64 REQUIRE(prefixlen == 32 || prefixlen == 40 || prefixlen == 48 ||
65 prefixlen == 56 || prefixlen == 64 || prefixlen == 96);
66 REQUIRE(isc_netaddr_prefixok(prefix, prefixlen) == ISC_R_SUCCESS);
67 REQUIRE(dns64p != NULL && *dns64p == NULL);
68
69 if (suffix != NULL) {
70 static const unsigned char zeros[16];
71 REQUIRE(prefix->family == AF_INET6);
72 nbytes = prefixlen / 8 + 4;
73 /* Bits 64-71 are zeros. rfc6052.txt */
74 if (prefixlen >= 32 && prefixlen <= 64) {
75 nbytes++;
76 }
77 REQUIRE(memcmp(suffix->type.in6.s6_addr, zeros, nbytes) == 0);
78 }
79
80 dns64 = isc_mem_get(mctx, sizeof(dns_dns64_t));
81 memset(dns64->bits, 0, sizeof(dns64->bits));
82 memmove(dns64->bits, prefix->type.in6.s6_addr, prefixlen / 8);
83 if (suffix != NULL) {
84 memmove(dns64->bits + nbytes, suffix->type.in6.s6_addr + nbytes,
85 16 - nbytes);
86 }
87 dns64->clients = NULL;
88 if (clients != NULL) {
89 dns_acl_attach(clients, &dns64->clients);
90 }
91 dns64->mapped = NULL;
92 if (mapped != NULL) {
93 dns_acl_attach(mapped, &dns64->mapped);
94 }
95 dns64->excluded = NULL;
96 if (excluded != NULL) {
97 dns_acl_attach(excluded, &dns64->excluded);
98 }
99 dns64->prefixlen = prefixlen;
100 dns64->flags = flags;
101 ISC_LINK_INIT(dns64, link);
102 dns64->mctx = NULL;
103 isc_mem_attach(mctx, &dns64->mctx);
104 *dns64p = dns64;
105 return (ISC_R_SUCCESS);
106 }
107
108 void
dns_dns64_destroy(dns_dns64_t ** dns64p)109 dns_dns64_destroy(dns_dns64_t **dns64p) {
110 dns_dns64_t *dns64;
111
112 REQUIRE(dns64p != NULL && *dns64p != NULL);
113
114 dns64 = *dns64p;
115 *dns64p = NULL;
116
117 REQUIRE(!ISC_LINK_LINKED(dns64, link));
118
119 if (dns64->clients != NULL) {
120 dns_acl_detach(&dns64->clients);
121 }
122 if (dns64->mapped != NULL) {
123 dns_acl_detach(&dns64->mapped);
124 }
125 if (dns64->excluded != NULL) {
126 dns_acl_detach(&dns64->excluded);
127 }
128 isc_mem_putanddetach(&dns64->mctx, dns64, sizeof(*dns64));
129 }
130
131 isc_result_t
dns_dns64_aaaafroma(const dns_dns64_t * dns64,const isc_netaddr_t * reqaddr,const dns_name_t * reqsigner,const dns_aclenv_t * env,unsigned int flags,unsigned char * a,unsigned char * aaaa)132 dns_dns64_aaaafroma(const dns_dns64_t *dns64, const isc_netaddr_t *reqaddr,
133 const dns_name_t *reqsigner, const dns_aclenv_t *env,
134 unsigned int flags, unsigned char *a, unsigned char *aaaa) {
135 unsigned int nbytes, i;
136 isc_result_t result;
137 int match;
138
139 if ((dns64->flags & DNS_DNS64_RECURSIVE_ONLY) != 0 &&
140 (flags & DNS_DNS64_RECURSIVE) == 0)
141 {
142 return (DNS_R_DISALLOWED);
143 }
144
145 if ((dns64->flags & DNS_DNS64_BREAK_DNSSEC) == 0 &&
146 (flags & DNS_DNS64_DNSSEC) != 0)
147 {
148 return (DNS_R_DISALLOWED);
149 }
150
151 if (dns64->clients != NULL) {
152 result = dns_acl_match(reqaddr, reqsigner, dns64->clients, env,
153 &match, NULL);
154 if (result != ISC_R_SUCCESS) {
155 return (result);
156 }
157 if (match <= 0) {
158 return (DNS_R_DISALLOWED);
159 }
160 }
161
162 if (dns64->mapped != NULL) {
163 struct in_addr ina;
164 isc_netaddr_t netaddr;
165
166 memmove(&ina.s_addr, a, 4);
167 isc_netaddr_fromin(&netaddr, &ina);
168 result = dns_acl_match(&netaddr, NULL, dns64->mapped, env,
169 &match, NULL);
170 if (result != ISC_R_SUCCESS) {
171 return (result);
172 }
173 if (match <= 0) {
174 return (DNS_R_DISALLOWED);
175 }
176 }
177
178 nbytes = dns64->prefixlen / 8;
179 INSIST(nbytes <= 12);
180 /* Copy prefix. */
181 memmove(aaaa, dns64->bits, nbytes);
182 /* Bits 64-71 are zeros. rfc6052.txt */
183 if (nbytes == 8) {
184 aaaa[nbytes++] = 0;
185 }
186 /* Copy mapped address. */
187 for (i = 0; i < 4U; i++) {
188 aaaa[nbytes++] = a[i];
189 /* Bits 64-71 are zeros. rfc6052.txt */
190 if (nbytes == 8) {
191 aaaa[nbytes++] = 0;
192 }
193 }
194 /* Copy suffix. */
195 memmove(aaaa + nbytes, dns64->bits + nbytes, 16 - nbytes);
196 return (ISC_R_SUCCESS);
197 }
198
199 dns_dns64_t *
dns_dns64_next(dns_dns64_t * dns64)200 dns_dns64_next(dns_dns64_t *dns64) {
201 dns64 = ISC_LIST_NEXT(dns64, link);
202 return (dns64);
203 }
204
205 void
dns_dns64_append(dns_dns64list_t * list,dns_dns64_t * dns64)206 dns_dns64_append(dns_dns64list_t *list, dns_dns64_t *dns64) {
207 ISC_LIST_APPEND(*list, dns64, link);
208 }
209
210 void
dns_dns64_unlink(dns_dns64list_t * list,dns_dns64_t * dns64)211 dns_dns64_unlink(dns_dns64list_t *list, dns_dns64_t *dns64) {
212 ISC_LIST_UNLINK(*list, dns64, link);
213 }
214
215 bool
dns_dns64_aaaaok(const dns_dns64_t * dns64,const isc_netaddr_t * reqaddr,const dns_name_t * reqsigner,const dns_aclenv_t * env,unsigned int flags,dns_rdataset_t * rdataset,bool * aaaaok,size_t aaaaoklen)216 dns_dns64_aaaaok(const dns_dns64_t *dns64, const isc_netaddr_t *reqaddr,
217 const dns_name_t *reqsigner, const dns_aclenv_t *env,
218 unsigned int flags, dns_rdataset_t *rdataset, bool *aaaaok,
219 size_t aaaaoklen) {
220 struct in6_addr in6;
221 isc_netaddr_t netaddr;
222 isc_result_t result;
223 int match;
224 bool answer = false;
225 bool found = false;
226 unsigned int i, ok;
227
228 REQUIRE(rdataset != NULL);
229 REQUIRE(rdataset->type == dns_rdatatype_aaaa);
230 REQUIRE(rdataset->rdclass == dns_rdataclass_in);
231 if (aaaaok != NULL) {
232 REQUIRE(aaaaoklen == dns_rdataset_count(rdataset));
233 }
234
235 for (; dns64 != NULL; dns64 = ISC_LIST_NEXT(dns64, link)) {
236 if ((dns64->flags & DNS_DNS64_RECURSIVE_ONLY) != 0 &&
237 (flags & DNS_DNS64_RECURSIVE) == 0)
238 {
239 continue;
240 }
241
242 if ((dns64->flags & DNS_DNS64_BREAK_DNSSEC) == 0 &&
243 (flags & DNS_DNS64_DNSSEC) != 0)
244 {
245 continue;
246 }
247 /*
248 * Work out if this dns64 structure applies to this client.
249 */
250 if (dns64->clients != NULL) {
251 result = dns_acl_match(reqaddr, reqsigner,
252 dns64->clients, env, &match,
253 NULL);
254 if (result != ISC_R_SUCCESS) {
255 continue;
256 }
257 if (match <= 0) {
258 continue;
259 }
260 }
261
262 if (!found && aaaaok != NULL) {
263 for (i = 0; i < aaaaoklen; i++) {
264 aaaaok[i] = false;
265 }
266 }
267 found = true;
268
269 /*
270 * If we are not excluding any addresses then any AAAA
271 * will do.
272 */
273 if (dns64->excluded == NULL) {
274 answer = true;
275 if (aaaaok == NULL) {
276 goto done;
277 }
278 for (i = 0; i < aaaaoklen; i++) {
279 aaaaok[i] = true;
280 }
281 goto done;
282 }
283
284 i = 0;
285 ok = 0;
286 for (result = dns_rdataset_first(rdataset);
287 result == ISC_R_SUCCESS;
288 result = dns_rdataset_next(rdataset))
289 {
290 dns_rdata_t rdata = DNS_RDATA_INIT;
291 if (aaaaok == NULL || !aaaaok[i]) {
292 dns_rdataset_current(rdataset, &rdata);
293 memmove(&in6.s6_addr, rdata.data, 16);
294 isc_netaddr_fromin6(&netaddr, &in6);
295
296 result = dns_acl_match(&netaddr, NULL,
297 dns64->excluded, env,
298 &match, NULL);
299 if (result == ISC_R_SUCCESS && match <= 0) {
300 answer = true;
301 if (aaaaok == NULL) {
302 goto done;
303 }
304 aaaaok[i] = true;
305 ok++;
306 }
307 } else {
308 ok++;
309 }
310 i++;
311 }
312 /*
313 * Are all addresses ok?
314 */
315 if (aaaaok != NULL && ok == aaaaoklen) {
316 goto done;
317 }
318 }
319
320 done:
321 if (!found && aaaaok != NULL) {
322 for (i = 0; i < aaaaoklen; i++) {
323 aaaaok[i] = true;
324 }
325 }
326 return (found ? answer : true);
327 }
328