1 /* $NetBSD: rpz.c,v 1.1 2024/02/18 20:57:33 christos Exp $ */
2
3 /*
4 * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
5 *
6 * SPDX-License-Identifier: MPL-2.0
7 *
8 * This Source Code Form is subject to the terms of the Mozilla Public
9 * License, v. 2.0. If a copy of the MPL was not distributed with this
10 * file, you can obtain one at https://mozilla.org/MPL/2.0/.
11 *
12 * See the COPYRIGHT file distributed with this work for additional
13 * information regarding copyright ownership.
14 */
15
16 /*! \file */
17
18 #include <inttypes.h>
19 #include <stdbool.h>
20 #include <stdlib.h>
21
22 #include <isc/buffer.h>
23 #include <isc/mem.h>
24 #include <isc/net.h>
25 #include <isc/netaddr.h>
26 #include <isc/print.h>
27 #include <isc/rwlock.h>
28 #include <isc/string.h>
29 #include <isc/task.h>
30 #include <isc/util.h>
31
32 #include <dns/db.h>
33 #include <dns/dbiterator.h>
34 #include <dns/dnsrps.h>
35 #include <dns/events.h>
36 #include <dns/fixedname.h>
37 #include <dns/log.h>
38 #include <dns/rbt.h>
39 #include <dns/rdata.h>
40 #include <dns/rdataset.h>
41 #include <dns/rdatasetiter.h>
42 #include <dns/rdatastruct.h>
43 #include <dns/result.h>
44 #include <dns/rpz.h>
45 #include <dns/view.h>
46
47 /*
48 * Parallel radix trees for databases of response policy IP addresses
49 *
50 * The radix or patricia trees are somewhat specialized to handle response
51 * policy addresses by representing the two sets of IP addresses and name
52 * server IP addresses in a single tree. One set of IP addresses is
53 * for rpz-ip policies or policies triggered by addresses in A or
54 * AAAA records in responses.
55 * The second set is for rpz-nsip policies or policies triggered by addresses
56 * in A or AAAA records for NS records that are authorities for responses.
57 *
58 * Each leaf indicates that an IP address is listed in the IP address or the
59 * name server IP address policy sub-zone (or both) of the corresponding
60 * response policy zone. The policy data such as a CNAME or an A record
61 * is kept in the policy zone. After an IP address has been found in a radix
62 * tree, the node in the policy zone's database is found by converting
63 * the IP address to a domain name in a canonical form.
64 *
65 *
66 * The response policy zone canonical form of an IPv6 address is one of:
67 * prefix.W.W.W.W.W.W.W.W
68 * prefix.WORDS.zz
69 * prefix.WORDS.zz.WORDS
70 * prefix.zz.WORDS
71 * where
72 * prefix is the prefix length of the IPv6 address between 1 and 128
73 * W is a number between 0 and 65535
74 * WORDS is one or more numbers W separated with "."
75 * zz corresponds to :: in the standard IPv6 text representation
76 *
77 * The canonical form of IPv4 addresses is:
78 * prefix.B.B.B.B
79 * where
80 * prefix is the prefix length of the address between 1 and 32
81 * B is a number between 0 and 255
82 *
83 * Names for IPv4 addresses are distinguished from IPv6 addresses by having
84 * 5 labels all of which are numbers, and a prefix between 1 and 32.
85 */
86
87 /*
88 * Nodes hashtable calculation parameters
89 */
90 #define DNS_RPZ_HTSIZE_MAX 24
91 #define DNS_RPZ_HTSIZE_DIV 3
92
93 /*
94 * Maximum number of nodes to process per quantum
95 */
96 #define DNS_RPZ_QUANTUM 1024
97
98 static void
99 dns_rpz_update_from_db(dns_rpz_zone_t *rpz);
100
101 static void
102 dns_rpz_update_taskaction(isc_task_t *task, isc_event_t *event);
103
104 /*
105 * Use a private definition of IPv6 addresses because s6_addr32 is not
106 * always defined and our IPv6 addresses are in non-standard byte order
107 */
108 typedef uint32_t dns_rpz_cidr_word_t;
109 #define DNS_RPZ_CIDR_WORD_BITS ((int)sizeof(dns_rpz_cidr_word_t) * 8)
110 #define DNS_RPZ_CIDR_KEY_BITS ((int)sizeof(dns_rpz_cidr_key_t) * 8)
111 #define DNS_RPZ_CIDR_WORDS (128 / DNS_RPZ_CIDR_WORD_BITS)
112 typedef struct {
113 dns_rpz_cidr_word_t w[DNS_RPZ_CIDR_WORDS];
114 } dns_rpz_cidr_key_t;
115
116 #define ADDR_V4MAPPED 0xffff
117 #define KEY_IS_IPV4(prefix, ip) \
118 ((prefix) >= 96 && (ip)->w[0] == 0 && (ip)->w[1] == 0 && \
119 (ip)->w[2] == ADDR_V4MAPPED)
120
121 #define DNS_RPZ_WORD_MASK(b) \
122 ((b) == 0 ? (dns_rpz_cidr_word_t)(-1) \
123 : ((dns_rpz_cidr_word_t)(-1) \
124 << (DNS_RPZ_CIDR_WORD_BITS - (b))))
125
126 /*
127 * Get bit #n from the array of words of an IP address.
128 */
129 #define DNS_RPZ_IP_BIT(ip, n) \
130 (1 & ((ip)->w[(n) / DNS_RPZ_CIDR_WORD_BITS] >> \
131 (DNS_RPZ_CIDR_WORD_BITS - 1 - ((n) % DNS_RPZ_CIDR_WORD_BITS))))
132
133 /*
134 * A triplet of arrays of bits flagging the existence of
135 * client-IP, IP, and NSIP policy triggers.
136 */
137 typedef struct dns_rpz_addr_zbits dns_rpz_addr_zbits_t;
138 struct dns_rpz_addr_zbits {
139 dns_rpz_zbits_t client_ip;
140 dns_rpz_zbits_t ip;
141 dns_rpz_zbits_t nsip;
142 };
143
144 /*
145 * A CIDR or radix tree node.
146 */
147 struct dns_rpz_cidr_node {
148 dns_rpz_cidr_node_t *parent;
149 dns_rpz_cidr_node_t *child[2];
150 dns_rpz_cidr_key_t ip;
151 dns_rpz_prefix_t prefix;
152 dns_rpz_addr_zbits_t set;
153 dns_rpz_addr_zbits_t sum;
154 };
155
156 /*
157 * A pair of arrays of bits flagging the existence of
158 * QNAME and NSDNAME policy triggers.
159 */
160 typedef struct dns_rpz_nm_zbits dns_rpz_nm_zbits_t;
161 struct dns_rpz_nm_zbits {
162 dns_rpz_zbits_t qname;
163 dns_rpz_zbits_t ns;
164 };
165
166 /*
167 * The data in a RBT node has two pairs of bits for policy zones.
168 * One pair is for the corresponding name of the node such as example.com
169 * and the other pair is for a wildcard child such as *.example.com.
170 */
171 typedef struct dns_rpz_nm_data dns_rpz_nm_data_t;
172 struct dns_rpz_nm_data {
173 dns_rpz_nm_zbits_t set;
174 dns_rpz_nm_zbits_t wild;
175 };
176
177 static void
178 rpz_detach(dns_rpz_zone_t **rpzp);
179
180 static void
181 rpz_detach_rpzs(dns_rpz_zones_t **rpzsp);
182
183 #if 0
184 /*
185 * Catch a name while debugging.
186 */
187 static void
188 catch_name(const dns_name_t *src_name, const char *tgt, const char *str) {
189 dns_fixedname_t tgt_namef;
190 dns_name_t *tgt_name;
191
192 tgt_name = dns_fixedname_initname(&tgt_namef);
193 dns_name_fromstring(tgt_name, tgt, DNS_NAME_DOWNCASE, NULL);
194 if (dns_name_equal(src_name, tgt_name)) {
195 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RPZ,
196 DNS_LOGMODULE_RBTDB, DNS_RPZ_ERROR_LEVEL,
197 "rpz hit failed: %s %s", str, tgt);
198 }
199 }
200 #endif /* if 0 */
201
202 const char *
dns_rpz_type2str(dns_rpz_type_t type)203 dns_rpz_type2str(dns_rpz_type_t type) {
204 switch (type) {
205 case DNS_RPZ_TYPE_CLIENT_IP:
206 return ("CLIENT-IP");
207 case DNS_RPZ_TYPE_QNAME:
208 return ("QNAME");
209 case DNS_RPZ_TYPE_IP:
210 return ("IP");
211 case DNS_RPZ_TYPE_NSIP:
212 return ("NSIP");
213 case DNS_RPZ_TYPE_NSDNAME:
214 return ("NSDNAME");
215 case DNS_RPZ_TYPE_BAD:
216 break;
217 }
218 FATAL_ERROR(__FILE__, __LINE__, "impossible rpz type %d", type);
219 return ("impossible");
220 }
221
222 dns_rpz_policy_t
dns_rpz_str2policy(const char * str)223 dns_rpz_str2policy(const char *str) {
224 static struct {
225 const char *str;
226 dns_rpz_policy_t policy;
227 } tbl[] = {
228 { "given", DNS_RPZ_POLICY_GIVEN },
229 { "disabled", DNS_RPZ_POLICY_DISABLED },
230 { "passthru", DNS_RPZ_POLICY_PASSTHRU },
231 { "drop", DNS_RPZ_POLICY_DROP },
232 { "tcp-only", DNS_RPZ_POLICY_TCP_ONLY },
233 { "nxdomain", DNS_RPZ_POLICY_NXDOMAIN },
234 { "nodata", DNS_RPZ_POLICY_NODATA },
235 { "cname", DNS_RPZ_POLICY_CNAME },
236 { "no-op", DNS_RPZ_POLICY_PASSTHRU }, /* old passthru */
237 };
238 unsigned int n;
239
240 if (str == NULL) {
241 return (DNS_RPZ_POLICY_ERROR);
242 }
243 for (n = 0; n < sizeof(tbl) / sizeof(tbl[0]); ++n) {
244 if (!strcasecmp(tbl[n].str, str)) {
245 return (tbl[n].policy);
246 }
247 }
248 return (DNS_RPZ_POLICY_ERROR);
249 }
250
251 const char *
dns_rpz_policy2str(dns_rpz_policy_t policy)252 dns_rpz_policy2str(dns_rpz_policy_t policy) {
253 const char *str;
254
255 switch (policy) {
256 case DNS_RPZ_POLICY_PASSTHRU:
257 str = "PASSTHRU";
258 break;
259 case DNS_RPZ_POLICY_DROP:
260 str = "DROP";
261 break;
262 case DNS_RPZ_POLICY_TCP_ONLY:
263 str = "TCP-ONLY";
264 break;
265 case DNS_RPZ_POLICY_NXDOMAIN:
266 str = "NXDOMAIN";
267 break;
268 case DNS_RPZ_POLICY_NODATA:
269 str = "NODATA";
270 break;
271 case DNS_RPZ_POLICY_RECORD:
272 str = "Local-Data";
273 break;
274 case DNS_RPZ_POLICY_CNAME:
275 case DNS_RPZ_POLICY_WILDCNAME:
276 str = "CNAME";
277 break;
278 case DNS_RPZ_POLICY_MISS:
279 str = "MISS";
280 break;
281 case DNS_RPZ_POLICY_DNS64:
282 str = "DNS64";
283 break;
284 case DNS_RPZ_POLICY_ERROR:
285 str = "ERROR";
286 break;
287 default:
288 UNREACHABLE();
289 }
290 return (str);
291 }
292
293 /*
294 * Return the bit number of the highest set bit in 'zbit'.
295 * (for example, 0x01 returns 0, 0xFF returns 7, etc.)
296 */
297 static int
zbit_to_num(dns_rpz_zbits_t zbit)298 zbit_to_num(dns_rpz_zbits_t zbit) {
299 dns_rpz_num_t rpz_num;
300
301 REQUIRE(zbit != 0);
302 rpz_num = 0;
303 if ((zbit & 0xffffffff00000000ULL) != 0) {
304 zbit >>= 32;
305 rpz_num += 32;
306 }
307 if ((zbit & 0xffff0000) != 0) {
308 zbit >>= 16;
309 rpz_num += 16;
310 }
311 if ((zbit & 0xff00) != 0) {
312 zbit >>= 8;
313 rpz_num += 8;
314 }
315 if ((zbit & 0xf0) != 0) {
316 zbit >>= 4;
317 rpz_num += 4;
318 }
319 if ((zbit & 0xc) != 0) {
320 zbit >>= 2;
321 rpz_num += 2;
322 }
323 if ((zbit & 2) != 0) {
324 ++rpz_num;
325 }
326 return (rpz_num);
327 }
328
329 /*
330 * Make a set of bit masks given one or more bits and their type.
331 */
332 static void
make_addr_set(dns_rpz_addr_zbits_t * tgt_set,dns_rpz_zbits_t zbits,dns_rpz_type_t type)333 make_addr_set(dns_rpz_addr_zbits_t *tgt_set, dns_rpz_zbits_t zbits,
334 dns_rpz_type_t type) {
335 switch (type) {
336 case DNS_RPZ_TYPE_CLIENT_IP:
337 tgt_set->client_ip = zbits;
338 tgt_set->ip = 0;
339 tgt_set->nsip = 0;
340 break;
341 case DNS_RPZ_TYPE_IP:
342 tgt_set->client_ip = 0;
343 tgt_set->ip = zbits;
344 tgt_set->nsip = 0;
345 break;
346 case DNS_RPZ_TYPE_NSIP:
347 tgt_set->client_ip = 0;
348 tgt_set->ip = 0;
349 tgt_set->nsip = zbits;
350 break;
351 default:
352 UNREACHABLE();
353 }
354 }
355
356 static void
make_nm_set(dns_rpz_nm_zbits_t * tgt_set,dns_rpz_num_t rpz_num,dns_rpz_type_t type)357 make_nm_set(dns_rpz_nm_zbits_t *tgt_set, dns_rpz_num_t rpz_num,
358 dns_rpz_type_t type) {
359 switch (type) {
360 case DNS_RPZ_TYPE_QNAME:
361 tgt_set->qname = DNS_RPZ_ZBIT(rpz_num);
362 tgt_set->ns = 0;
363 break;
364 case DNS_RPZ_TYPE_NSDNAME:
365 tgt_set->qname = 0;
366 tgt_set->ns = DNS_RPZ_ZBIT(rpz_num);
367 break;
368 default:
369 UNREACHABLE();
370 }
371 }
372
373 /*
374 * Mark a node and all of its parents as having client-IP, IP, or NSIP data
375 */
376 static void
set_sum_pair(dns_rpz_cidr_node_t * cnode)377 set_sum_pair(dns_rpz_cidr_node_t *cnode) {
378 dns_rpz_cidr_node_t *child;
379 dns_rpz_addr_zbits_t sum;
380
381 do {
382 sum = cnode->set;
383
384 child = cnode->child[0];
385 if (child != NULL) {
386 sum.client_ip |= child->sum.client_ip;
387 sum.ip |= child->sum.ip;
388 sum.nsip |= child->sum.nsip;
389 }
390
391 child = cnode->child[1];
392 if (child != NULL) {
393 sum.client_ip |= child->sum.client_ip;
394 sum.ip |= child->sum.ip;
395 sum.nsip |= child->sum.nsip;
396 }
397
398 if (cnode->sum.client_ip == sum.client_ip &&
399 cnode->sum.ip == sum.ip && cnode->sum.nsip == sum.nsip)
400 {
401 break;
402 }
403 cnode->sum = sum;
404 cnode = cnode->parent;
405 } while (cnode != NULL);
406 }
407
408 /* Caller must hold rpzs->maint_lock */
409 static void
fix_qname_skip_recurse(dns_rpz_zones_t * rpzs)410 fix_qname_skip_recurse(dns_rpz_zones_t *rpzs) {
411 dns_rpz_zbits_t mask;
412
413 /*
414 * qname_wait_recurse and qname_skip_recurse are used to
415 * implement the "qname-wait-recurse" config option.
416 *
417 * When "qname-wait-recurse" is yes, no processing happens without
418 * recursion. In this case, qname_wait_recurse is true, and
419 * qname_skip_recurse (a bit field indicating which policy zones
420 * can be processed without recursion) is set to all 0's by
421 * fix_qname_skip_recurse().
422 *
423 * When "qname-wait-recurse" is no, qname_skip_recurse may be
424 * set to a non-zero value by fix_qname_skip_recurse(). The mask
425 * has to have bits set for the policy zones for which
426 * processing may continue without recursion, and bits cleared
427 * for the rest.
428 *
429 * (1) The ARM says:
430 *
431 * The "qname-wait-recurse no" option overrides that default
432 * behavior when recursion cannot change a non-error
433 * response. The option does not affect QNAME or client-IP
434 * triggers in policy zones listed after other zones
435 * containing IP, NSIP and NSDNAME triggers, because those may
436 * depend on the A, AAAA, and NS records that would be found
437 * during recursive resolution.
438 *
439 * Let's consider the following:
440 *
441 * zbits_req = (rpzs->have.ipv4 | rpzs->have.ipv6 |
442 * rpzs->have.nsdname |
443 * rpzs->have.nsipv4 | rpzs->have.nsipv6);
444 *
445 * zbits_req now contains bits set for zones which require
446 * recursion.
447 *
448 * But going by the description in the ARM, if the first policy
449 * zone requires recursion, then all zones after that (higher
450 * order bits) have to wait as well. If the Nth zone requires
451 * recursion, then (N+1)th zone onwards all need to wait.
452 *
453 * So mapping this, examples:
454 *
455 * zbits_req = 0b000 mask = 0xffffffff (no zones have to wait for
456 * recursion)
457 * zbits_req = 0b001 mask = 0x00000000 (all zones have to wait)
458 * zbits_req = 0b010 mask = 0x00000001 (the first zone doesn't have to
459 * wait, second zone onwards need
460 * to wait)
461 * zbits_req = 0b011 mask = 0x00000000 (all zones have to wait)
462 * zbits_req = 0b100 mask = 0x00000011 (the 1st and 2nd zones don't
463 * have to wait, third zone
464 * onwards need to wait)
465 *
466 * More generally, we have to count the number of trailing 0
467 * bits in zbits_req and only these can be processed without
468 * recursion. All the rest need to wait.
469 *
470 * (2) The ARM says that "qname-wait-recurse no" option
471 * overrides the default behavior when recursion cannot change a
472 * non-error response. So, in the order of listing of policy
473 * zones, within the first policy zone where recursion may be
474 * required, we should first allow CLIENT-IP and QNAME policy
475 * records to be attempted without recursion.
476 */
477
478 /*
479 * Get a mask covering all policy zones that are not subordinate to
480 * other policy zones containing triggers that require that the
481 * qname be resolved before they can be checked.
482 */
483 rpzs->have.client_ip = rpzs->have.client_ipv4 | rpzs->have.client_ipv6;
484 rpzs->have.ip = rpzs->have.ipv4 | rpzs->have.ipv6;
485 rpzs->have.nsip = rpzs->have.nsipv4 | rpzs->have.nsipv6;
486
487 if (rpzs->p.qname_wait_recurse) {
488 mask = 0;
489 } else {
490 dns_rpz_zbits_t zbits_req;
491 dns_rpz_zbits_t zbits_notreq;
492 dns_rpz_zbits_t mask2;
493 dns_rpz_zbits_t req_mask;
494
495 /*
496 * Get the masks of zones with policies that
497 * do/don't require recursion
498 */
499
500 zbits_req = (rpzs->have.ipv4 | rpzs->have.ipv6 |
501 rpzs->have.nsdname | rpzs->have.nsipv4 |
502 rpzs->have.nsipv6);
503 zbits_notreq = (rpzs->have.client_ip | rpzs->have.qname);
504
505 if (zbits_req == 0) {
506 mask = DNS_RPZ_ALL_ZBITS;
507 goto set;
508 }
509
510 /*
511 * req_mask is a mask covering used bits in
512 * zbits_req. (For instance, 0b1 => 0b1, 0b101 => 0b111,
513 * 0b11010101 => 0b11111111).
514 */
515 req_mask = zbits_req;
516 req_mask |= req_mask >> 1;
517 req_mask |= req_mask >> 2;
518 req_mask |= req_mask >> 4;
519 req_mask |= req_mask >> 8;
520 req_mask |= req_mask >> 16;
521 req_mask |= req_mask >> 32;
522
523 /*
524 * There's no point in skipping recursion for a later
525 * zone if it is required in a previous zone.
526 */
527 if ((zbits_notreq & req_mask) == 0) {
528 mask = 0;
529 goto set;
530 }
531
532 /*
533 * This bit arithmetic creates a mask of zones in which
534 * it is okay to skip recursion. After the first zone
535 * that has to wait for recursion, all the others have
536 * to wait as well, so we want to create a mask in which
537 * all the trailing zeroes in zbits_req are are 1, and
538 * more significant bits are 0. (For instance,
539 * 0x0700 => 0x00ff, 0x0007 => 0x0000)
540 */
541 mask = ~(zbits_req | ((~zbits_req) + 1));
542
543 /*
544 * As mentioned in (2) above, the zone corresponding to
545 * the least significant zero could have its CLIENT-IP
546 * and QNAME policies checked before recursion, if it
547 * has any of those policies. So if it does, we
548 * can set its 0 to 1.
549 *
550 * Locate the least significant 0 bit in the mask (for
551 * instance, 0xff => 0x100)...
552 */
553 mask2 = (mask << 1) & ~mask;
554
555 /*
556 * Also set the bit for zone 0, because if it's in
557 * zbits_notreq then it's definitely okay to attempt to
558 * skip recursion for zone 0...
559 */
560 mask2 |= 1;
561
562 /* Clear any bits *not* in zbits_notreq... */
563 mask2 &= zbits_notreq;
564
565 /* And merge the result into the skip-recursion mask */
566 mask |= mask2;
567 }
568
569 set:
570 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RPZ, DNS_LOGMODULE_RBTDB,
571 DNS_RPZ_DEBUG_QUIET,
572 "computed RPZ qname_skip_recurse mask=0x%" PRIx64,
573 (uint64_t)mask);
574 rpzs->have.qname_skip_recurse = mask;
575 }
576
577 static void
adj_trigger_cnt(dns_rpz_zones_t * rpzs,dns_rpz_num_t rpz_num,dns_rpz_type_t rpz_type,const dns_rpz_cidr_key_t * tgt_ip,dns_rpz_prefix_t tgt_prefix,bool inc)578 adj_trigger_cnt(dns_rpz_zones_t *rpzs, dns_rpz_num_t rpz_num,
579 dns_rpz_type_t rpz_type, const dns_rpz_cidr_key_t *tgt_ip,
580 dns_rpz_prefix_t tgt_prefix, bool inc) {
581 dns_rpz_trigger_counter_t *cnt = NULL;
582 dns_rpz_zbits_t *have = NULL;
583
584 switch (rpz_type) {
585 case DNS_RPZ_TYPE_CLIENT_IP:
586 REQUIRE(tgt_ip != NULL);
587 if (KEY_IS_IPV4(tgt_prefix, tgt_ip)) {
588 cnt = &rpzs->triggers[rpz_num].client_ipv4;
589 have = &rpzs->have.client_ipv4;
590 } else {
591 cnt = &rpzs->triggers[rpz_num].client_ipv6;
592 have = &rpzs->have.client_ipv6;
593 }
594 break;
595 case DNS_RPZ_TYPE_QNAME:
596 cnt = &rpzs->triggers[rpz_num].qname;
597 have = &rpzs->have.qname;
598 break;
599 case DNS_RPZ_TYPE_IP:
600 REQUIRE(tgt_ip != NULL);
601 if (KEY_IS_IPV4(tgt_prefix, tgt_ip)) {
602 cnt = &rpzs->triggers[rpz_num].ipv4;
603 have = &rpzs->have.ipv4;
604 } else {
605 cnt = &rpzs->triggers[rpz_num].ipv6;
606 have = &rpzs->have.ipv6;
607 }
608 break;
609 case DNS_RPZ_TYPE_NSDNAME:
610 cnt = &rpzs->triggers[rpz_num].nsdname;
611 have = &rpzs->have.nsdname;
612 break;
613 case DNS_RPZ_TYPE_NSIP:
614 REQUIRE(tgt_ip != NULL);
615 if (KEY_IS_IPV4(tgt_prefix, tgt_ip)) {
616 cnt = &rpzs->triggers[rpz_num].nsipv4;
617 have = &rpzs->have.nsipv4;
618 } else {
619 cnt = &rpzs->triggers[rpz_num].nsipv6;
620 have = &rpzs->have.nsipv6;
621 }
622 break;
623 default:
624 UNREACHABLE();
625 }
626
627 if (inc) {
628 if (++*cnt == 1U) {
629 *have |= DNS_RPZ_ZBIT(rpz_num);
630 fix_qname_skip_recurse(rpzs);
631 }
632 } else {
633 REQUIRE(*cnt != 0U);
634 if (--*cnt == 0U) {
635 *have &= ~DNS_RPZ_ZBIT(rpz_num);
636 fix_qname_skip_recurse(rpzs);
637 }
638 }
639 }
640
641 static dns_rpz_cidr_node_t *
new_node(dns_rpz_zones_t * rpzs,const dns_rpz_cidr_key_t * ip,dns_rpz_prefix_t prefix,const dns_rpz_cidr_node_t * child)642 new_node(dns_rpz_zones_t *rpzs, const dns_rpz_cidr_key_t *ip,
643 dns_rpz_prefix_t prefix, const dns_rpz_cidr_node_t *child) {
644 dns_rpz_cidr_node_t *node;
645 int i, words, wlen;
646
647 node = isc_mem_get(rpzs->mctx, sizeof(*node));
648 memset(node, 0, sizeof(*node));
649
650 if (child != NULL) {
651 node->sum = child->sum;
652 }
653
654 node->prefix = prefix;
655 words = prefix / DNS_RPZ_CIDR_WORD_BITS;
656 wlen = prefix % DNS_RPZ_CIDR_WORD_BITS;
657 i = 0;
658 while (i < words) {
659 node->ip.w[i] = ip->w[i];
660 ++i;
661 }
662 if (wlen != 0) {
663 node->ip.w[i] = ip->w[i] & DNS_RPZ_WORD_MASK(wlen);
664 ++i;
665 }
666 while (i < DNS_RPZ_CIDR_WORDS) {
667 node->ip.w[i++] = 0;
668 }
669
670 return (node);
671 }
672
673 static void
badname(int level,const dns_name_t * name,const char * str1,const char * str2)674 badname(int level, const dns_name_t *name, const char *str1, const char *str2) {
675 char namebuf[DNS_NAME_FORMATSIZE];
676
677 /*
678 * bin/tests/system/rpz/tests.sh looks for "invalid rpz".
679 */
680 if (level < DNS_RPZ_DEBUG_QUIET && isc_log_wouldlog(dns_lctx, level)) {
681 dns_name_format(name, namebuf, sizeof(namebuf));
682 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RPZ,
683 DNS_LOGMODULE_RBTDB, level,
684 "invalid rpz IP address \"%s\"%s%s", namebuf,
685 str1, str2);
686 }
687 }
688
689 /*
690 * Convert an IP address from radix tree binary (host byte order) to
691 * to its canonical response policy domain name without the origin of the
692 * policy zone.
693 *
694 * Generate a name for an IPv6 address that fits RFC 5952, except that our
695 * reversed format requires that when the length of the consecutive 16-bit
696 * 0 fields are equal (e.g., 1.0.0.1.0.0.db8.2001 corresponding to
697 * 2001:db8:0:0:1:0:0:1), we shorted the last instead of the first
698 * (e.g., 1.0.0.1.zz.db8.2001 corresponding to 2001:db8::1:0:0:1).
699 */
700 static isc_result_t
ip2name(const dns_rpz_cidr_key_t * tgt_ip,dns_rpz_prefix_t tgt_prefix,const dns_name_t * base_name,dns_name_t * ip_name)701 ip2name(const dns_rpz_cidr_key_t *tgt_ip, dns_rpz_prefix_t tgt_prefix,
702 const dns_name_t *base_name, dns_name_t *ip_name) {
703 #ifndef INET6_ADDRSTRLEN
704 #define INET6_ADDRSTRLEN 46
705 #endif /* ifndef INET6_ADDRSTRLEN */
706 int w[DNS_RPZ_CIDR_WORDS * 2];
707 char str[1 + 8 + 1 + INET6_ADDRSTRLEN + 1];
708 isc_buffer_t buffer;
709 isc_result_t result;
710 int best_first, best_len, cur_first, cur_len;
711 int i, n, len;
712
713 if (KEY_IS_IPV4(tgt_prefix, tgt_ip)) {
714 len = snprintf(str, sizeof(str), "%u.%u.%u.%u.%u",
715 tgt_prefix - 96U, tgt_ip->w[3] & 0xffU,
716 (tgt_ip->w[3] >> 8) & 0xffU,
717 (tgt_ip->w[3] >> 16) & 0xffU,
718 (tgt_ip->w[3] >> 24) & 0xffU);
719 if (len < 0 || (size_t)len >= sizeof(str)) {
720 return (ISC_R_FAILURE);
721 }
722 } else {
723 len = snprintf(str, sizeof(str), "%d", tgt_prefix);
724 if (len < 0 || (size_t)len >= sizeof(str)) {
725 return (ISC_R_FAILURE);
726 }
727
728 for (i = 0; i < DNS_RPZ_CIDR_WORDS; i++) {
729 w[i * 2 + 1] =
730 ((tgt_ip->w[DNS_RPZ_CIDR_WORDS - 1 - i] >> 16) &
731 0xffff);
732 w[i * 2] = tgt_ip->w[DNS_RPZ_CIDR_WORDS - 1 - i] &
733 0xffff;
734 }
735 /*
736 * Find the start and length of the first longest sequence
737 * of zeros in the address.
738 */
739 best_first = -1;
740 best_len = 0;
741 cur_first = -1;
742 cur_len = 0;
743 for (n = 0; n <= 7; ++n) {
744 if (w[n] != 0) {
745 cur_len = 0;
746 cur_first = -1;
747 } else {
748 ++cur_len;
749 if (cur_first < 0) {
750 cur_first = n;
751 } else if (cur_len >= best_len) {
752 best_first = cur_first;
753 best_len = cur_len;
754 }
755 }
756 }
757
758 for (n = 0; n <= 7; ++n) {
759 INSIST(len > 0 && (size_t)len < sizeof(str));
760 if (n == best_first) {
761 i = snprintf(str + len, sizeof(str) - len,
762 ".zz");
763 n += best_len - 1;
764 } else {
765 i = snprintf(str + len, sizeof(str) - len,
766 ".%x", w[n]);
767 }
768 if (i < 0 || (size_t)i >= (size_t)(sizeof(str) - len)) {
769 return (ISC_R_FAILURE);
770 }
771 len += i;
772 }
773 }
774
775 isc_buffer_init(&buffer, str, sizeof(str));
776 isc_buffer_add(&buffer, len);
777 result = dns_name_fromtext(ip_name, &buffer, base_name, 0, NULL);
778 return (result);
779 }
780
781 /*
782 * Determine the type of a name in a response policy zone.
783 */
784 static dns_rpz_type_t
type_from_name(const dns_rpz_zones_t * rpzs,dns_rpz_zone_t * rpz,const dns_name_t * name)785 type_from_name(const dns_rpz_zones_t *rpzs, dns_rpz_zone_t *rpz,
786 const dns_name_t *name) {
787 if (dns_name_issubdomain(name, &rpz->ip)) {
788 return (DNS_RPZ_TYPE_IP);
789 }
790
791 if (dns_name_issubdomain(name, &rpz->client_ip)) {
792 return (DNS_RPZ_TYPE_CLIENT_IP);
793 }
794
795 if ((rpzs->p.nsip_on & DNS_RPZ_ZBIT(rpz->num)) != 0 &&
796 dns_name_issubdomain(name, &rpz->nsip))
797 {
798 return (DNS_RPZ_TYPE_NSIP);
799 }
800
801 if ((rpzs->p.nsdname_on & DNS_RPZ_ZBIT(rpz->num)) != 0 &&
802 dns_name_issubdomain(name, &rpz->nsdname))
803 {
804 return (DNS_RPZ_TYPE_NSDNAME);
805 }
806
807 return (DNS_RPZ_TYPE_QNAME);
808 }
809
810 /*
811 * Convert an IP address from canonical response policy domain name form
812 * to radix tree binary (host byte order) for adding or deleting IP or NSIP
813 * data.
814 */
815 static isc_result_t
name2ipkey(int log_level,const dns_rpz_zones_t * rpzs,dns_rpz_num_t rpz_num,dns_rpz_type_t rpz_type,const dns_name_t * src_name,dns_rpz_cidr_key_t * tgt_ip,dns_rpz_prefix_t * tgt_prefix,dns_rpz_addr_zbits_t * new_set)816 name2ipkey(int log_level, const dns_rpz_zones_t *rpzs, dns_rpz_num_t rpz_num,
817 dns_rpz_type_t rpz_type, const dns_name_t *src_name,
818 dns_rpz_cidr_key_t *tgt_ip, dns_rpz_prefix_t *tgt_prefix,
819 dns_rpz_addr_zbits_t *new_set) {
820 dns_rpz_zone_t *rpz;
821 char ip_str[DNS_NAME_FORMATSIZE], ip2_str[DNS_NAME_FORMATSIZE];
822 dns_offsets_t ip_name_offsets;
823 dns_fixedname_t ip_name2f;
824 dns_name_t ip_name, *ip_name2;
825 const char *prefix_str, *cp, *end;
826 char *cp2;
827 int ip_labels;
828 dns_rpz_prefix_t prefix;
829 unsigned long prefix_num, l;
830 isc_result_t result;
831 int i;
832
833 REQUIRE(rpzs != NULL && rpz_num < rpzs->p.num_zones);
834 rpz = rpzs->zones[rpz_num];
835 REQUIRE(rpz != NULL);
836
837 make_addr_set(new_set, DNS_RPZ_ZBIT(rpz_num), rpz_type);
838
839 ip_labels = dns_name_countlabels(src_name);
840 if (rpz_type == DNS_RPZ_TYPE_QNAME) {
841 ip_labels -= dns_name_countlabels(&rpz->origin);
842 } else {
843 ip_labels -= dns_name_countlabels(&rpz->nsdname);
844 }
845 if (ip_labels < 2) {
846 badname(log_level, src_name, "; too short", "");
847 return (ISC_R_FAILURE);
848 }
849 dns_name_init(&ip_name, ip_name_offsets);
850 dns_name_getlabelsequence(src_name, 0, ip_labels, &ip_name);
851
852 /*
853 * Get text for the IP address
854 */
855 dns_name_format(&ip_name, ip_str, sizeof(ip_str));
856 end = &ip_str[strlen(ip_str) + 1];
857 prefix_str = ip_str;
858
859 prefix_num = strtoul(prefix_str, &cp2, 10);
860 if (*cp2 != '.') {
861 badname(log_level, src_name, "; invalid leading prefix length",
862 "");
863 return (ISC_R_FAILURE);
864 }
865 /*
866 * Patch in trailing nul character to print just the length
867 * label (for various cases below).
868 */
869 *cp2 = '\0';
870 if (prefix_num < 1U || prefix_num > 128U) {
871 badname(log_level, src_name, "; invalid prefix length of ",
872 prefix_str);
873 return (ISC_R_FAILURE);
874 }
875 cp = cp2 + 1;
876
877 if (--ip_labels == 4 && !strchr(cp, 'z')) {
878 /*
879 * Convert an IPv4 address
880 * from the form "prefix.z.y.x.w"
881 */
882 if (prefix_num > 32U) {
883 badname(log_level, src_name,
884 "; invalid IPv4 prefix length of ", prefix_str);
885 return (ISC_R_FAILURE);
886 }
887 prefix_num += 96;
888 *tgt_prefix = (dns_rpz_prefix_t)prefix_num;
889 tgt_ip->w[0] = 0;
890 tgt_ip->w[1] = 0;
891 tgt_ip->w[2] = ADDR_V4MAPPED;
892 tgt_ip->w[3] = 0;
893 for (i = 0; i < 32; i += 8) {
894 l = strtoul(cp, &cp2, 10);
895 if (l > 255U || (*cp2 != '.' && *cp2 != '\0')) {
896 if (*cp2 == '.') {
897 *cp2 = '\0';
898 }
899 badname(log_level, src_name,
900 "; invalid IPv4 octet ", cp);
901 return (ISC_R_FAILURE);
902 }
903 tgt_ip->w[3] |= l << i;
904 cp = cp2 + 1;
905 }
906 } else {
907 /*
908 * Convert a text IPv6 address.
909 */
910 *tgt_prefix = (dns_rpz_prefix_t)prefix_num;
911 for (i = 0; ip_labels > 0 && i < DNS_RPZ_CIDR_WORDS * 2;
912 ip_labels--)
913 {
914 if (cp[0] == 'z' && cp[1] == 'z' &&
915 (cp[2] == '.' || cp[2] == '\0') && i <= 6)
916 {
917 do {
918 if ((i & 1) == 0) {
919 tgt_ip->w[3 - i / 2] = 0;
920 }
921 ++i;
922 } while (ip_labels + i <= 8);
923 cp += 3;
924 } else {
925 l = strtoul(cp, &cp2, 16);
926 if (l > 0xffffu ||
927 (*cp2 != '.' && *cp2 != '\0'))
928 {
929 if (*cp2 == '.') {
930 *cp2 = '\0';
931 }
932 badname(log_level, src_name,
933 "; invalid IPv6 word ", cp);
934 return (ISC_R_FAILURE);
935 }
936 if ((i & 1) == 0) {
937 tgt_ip->w[3 - i / 2] = l;
938 } else {
939 tgt_ip->w[3 - i / 2] |= l << 16;
940 }
941 i++;
942 cp = cp2 + 1;
943 }
944 }
945 }
946 if (cp != end) {
947 badname(log_level, src_name, "", "");
948 return (ISC_R_FAILURE);
949 }
950
951 /*
952 * Check for 1s after the prefix length.
953 */
954 prefix = (dns_rpz_prefix_t)prefix_num;
955 while (prefix < DNS_RPZ_CIDR_KEY_BITS) {
956 dns_rpz_cidr_word_t aword;
957
958 i = prefix % DNS_RPZ_CIDR_WORD_BITS;
959 aword = tgt_ip->w[prefix / DNS_RPZ_CIDR_WORD_BITS];
960 if ((aword & ~DNS_RPZ_WORD_MASK(i)) != 0) {
961 badname(log_level, src_name,
962 "; too small prefix length of ", prefix_str);
963 return (ISC_R_FAILURE);
964 }
965 prefix -= i;
966 prefix += DNS_RPZ_CIDR_WORD_BITS;
967 }
968
969 /*
970 * Complain about bad names but be generous and accept them.
971 */
972 if (log_level < DNS_RPZ_DEBUG_QUIET &&
973 isc_log_wouldlog(dns_lctx, log_level))
974 {
975 /*
976 * Convert the address back to a canonical domain name
977 * to ensure that the original name is in canonical form.
978 */
979 ip_name2 = dns_fixedname_initname(&ip_name2f);
980 result = ip2name(tgt_ip, (dns_rpz_prefix_t)prefix_num, NULL,
981 ip_name2);
982 if (result != ISC_R_SUCCESS ||
983 !dns_name_equal(&ip_name, ip_name2))
984 {
985 dns_name_format(ip_name2, ip2_str, sizeof(ip2_str));
986 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RPZ,
987 DNS_LOGMODULE_RBTDB, log_level,
988 "rpz IP address \"%s\""
989 " is not the canonical \"%s\"",
990 ip_str, ip2_str);
991 }
992 }
993
994 return (ISC_R_SUCCESS);
995 }
996
997 /*
998 * Get trigger name and data bits for adding or deleting summary NSDNAME
999 * or QNAME data.
1000 */
1001 static void
name2data(dns_rpz_zones_t * rpzs,dns_rpz_num_t rpz_num,dns_rpz_type_t rpz_type,const dns_name_t * src_name,dns_name_t * trig_name,dns_rpz_nm_data_t * new_data)1002 name2data(dns_rpz_zones_t *rpzs, dns_rpz_num_t rpz_num, dns_rpz_type_t rpz_type,
1003 const dns_name_t *src_name, dns_name_t *trig_name,
1004 dns_rpz_nm_data_t *new_data) {
1005 dns_rpz_zone_t *rpz;
1006 dns_offsets_t tmp_name_offsets;
1007 dns_name_t tmp_name;
1008 unsigned int prefix_len, n;
1009
1010 REQUIRE(rpzs != NULL && rpz_num < rpzs->p.num_zones);
1011 rpz = rpzs->zones[rpz_num];
1012 REQUIRE(rpz != NULL);
1013
1014 /*
1015 * Handle wildcards by putting only the parent into the
1016 * summary RBT. The summary database only causes a check of the
1017 * real policy zone where wildcards will be handled.
1018 */
1019 if (dns_name_iswildcard(src_name)) {
1020 prefix_len = 1;
1021 memset(&new_data->set, 0, sizeof(new_data->set));
1022 make_nm_set(&new_data->wild, rpz_num, rpz_type);
1023 } else {
1024 prefix_len = 0;
1025 make_nm_set(&new_data->set, rpz_num, rpz_type);
1026 memset(&new_data->wild, 0, sizeof(new_data->wild));
1027 }
1028
1029 dns_name_init(&tmp_name, tmp_name_offsets);
1030 n = dns_name_countlabels(src_name);
1031 n -= prefix_len;
1032 if (rpz_type == DNS_RPZ_TYPE_QNAME) {
1033 n -= dns_name_countlabels(&rpz->origin);
1034 } else {
1035 n -= dns_name_countlabels(&rpz->nsdname);
1036 }
1037 dns_name_getlabelsequence(src_name, prefix_len, n, &tmp_name);
1038 (void)dns_name_concatenate(&tmp_name, dns_rootname, trig_name, NULL);
1039 }
1040
1041 #ifndef HAVE_BUILTIN_CLZ
1042 /**
1043 * \brief Count Leading Zeros: Find the location of the left-most set
1044 * bit.
1045 */
1046 static unsigned int
clz(dns_rpz_cidr_word_t w)1047 clz(dns_rpz_cidr_word_t w) {
1048 unsigned int bit;
1049
1050 bit = DNS_RPZ_CIDR_WORD_BITS - 1;
1051
1052 if ((w & 0xffff0000) != 0) {
1053 w >>= 16;
1054 bit -= 16;
1055 }
1056
1057 if ((w & 0xff00) != 0) {
1058 w >>= 8;
1059 bit -= 8;
1060 }
1061
1062 if ((w & 0xf0) != 0) {
1063 w >>= 4;
1064 bit -= 4;
1065 }
1066
1067 if ((w & 0xc) != 0) {
1068 w >>= 2;
1069 bit -= 2;
1070 }
1071
1072 if ((w & 2) != 0) {
1073 --bit;
1074 }
1075
1076 return (bit);
1077 }
1078 #endif /* ifndef HAVE_BUILTIN_CLZ */
1079
1080 /*
1081 * Find the first differing bit in two keys (IP addresses).
1082 */
1083 static int
diff_keys(const dns_rpz_cidr_key_t * key1,dns_rpz_prefix_t prefix1,const dns_rpz_cidr_key_t * key2,dns_rpz_prefix_t prefix2)1084 diff_keys(const dns_rpz_cidr_key_t *key1, dns_rpz_prefix_t prefix1,
1085 const dns_rpz_cidr_key_t *key2, dns_rpz_prefix_t prefix2) {
1086 dns_rpz_cidr_word_t delta;
1087 dns_rpz_prefix_t maxbit, bit;
1088 int i;
1089
1090 bit = 0;
1091 maxbit = ISC_MIN(prefix1, prefix2);
1092
1093 /*
1094 * find the first differing words
1095 */
1096 for (i = 0; bit < maxbit; i++, bit += DNS_RPZ_CIDR_WORD_BITS) {
1097 delta = key1->w[i] ^ key2->w[i];
1098 if (ISC_UNLIKELY(delta != 0)) {
1099 #ifdef HAVE_BUILTIN_CLZ
1100 bit += __builtin_clz(delta);
1101 #else /* ifdef HAVE_BUILTIN_CLZ */
1102 bit += clz(delta);
1103 #endif /* ifdef HAVE_BUILTIN_CLZ */
1104 break;
1105 }
1106 }
1107 return (ISC_MIN(bit, maxbit));
1108 }
1109
1110 /*
1111 * Given a hit while searching the radix trees,
1112 * clear all bits for higher numbered zones.
1113 */
1114 static dns_rpz_zbits_t
trim_zbits(dns_rpz_zbits_t zbits,dns_rpz_zbits_t found)1115 trim_zbits(dns_rpz_zbits_t zbits, dns_rpz_zbits_t found) {
1116 dns_rpz_zbits_t x;
1117
1118 /*
1119 * Isolate the first or smallest numbered hit bit.
1120 * Make a mask of that bit and all smaller numbered bits.
1121 */
1122 x = zbits & found;
1123 x &= (~x + 1);
1124 x = (x << 1) - 1;
1125 zbits &= x;
1126 return (zbits);
1127 }
1128
1129 /*
1130 * Search a radix tree for an IP address for ordinary lookup
1131 * or for a CIDR block adding or deleting an entry
1132 *
1133 * Return ISC_R_SUCCESS, DNS_R_PARTIALMATCH, ISC_R_NOTFOUND,
1134 * and *found=longest match node
1135 * or with create==true, ISC_R_EXISTS or ISC_R_NOMEMORY
1136 */
1137 static isc_result_t
search(dns_rpz_zones_t * rpzs,const dns_rpz_cidr_key_t * tgt_ip,dns_rpz_prefix_t tgt_prefix,const dns_rpz_addr_zbits_t * tgt_set,bool create,dns_rpz_cidr_node_t ** found)1138 search(dns_rpz_zones_t *rpzs, const dns_rpz_cidr_key_t *tgt_ip,
1139 dns_rpz_prefix_t tgt_prefix, const dns_rpz_addr_zbits_t *tgt_set,
1140 bool create, dns_rpz_cidr_node_t **found) {
1141 dns_rpz_cidr_node_t *cur, *parent, *child, *new_parent, *sibling;
1142 dns_rpz_addr_zbits_t set;
1143 int cur_num, child_num;
1144 dns_rpz_prefix_t dbit;
1145 isc_result_t find_result;
1146
1147 set = *tgt_set;
1148 find_result = ISC_R_NOTFOUND;
1149 *found = NULL;
1150 cur = rpzs->cidr;
1151 parent = NULL;
1152 cur_num = 0;
1153 for (;;) {
1154 if (cur == NULL) {
1155 /*
1156 * No child so we cannot go down.
1157 * Quit with whatever we already found
1158 * or add the target as a child of the current parent.
1159 */
1160 if (!create) {
1161 return (find_result);
1162 }
1163 child = new_node(rpzs, tgt_ip, tgt_prefix, NULL);
1164 if (child == NULL) {
1165 return (ISC_R_NOMEMORY);
1166 }
1167 if (parent == NULL) {
1168 rpzs->cidr = child;
1169 } else {
1170 parent->child[cur_num] = child;
1171 }
1172 child->parent = parent;
1173 child->set.client_ip |= tgt_set->client_ip;
1174 child->set.ip |= tgt_set->ip;
1175 child->set.nsip |= tgt_set->nsip;
1176 set_sum_pair(child);
1177 *found = child;
1178 return (ISC_R_SUCCESS);
1179 }
1180
1181 if ((cur->sum.client_ip & set.client_ip) == 0 &&
1182 (cur->sum.ip & set.ip) == 0 &&
1183 (cur->sum.nsip & set.nsip) == 0)
1184 {
1185 /*
1186 * This node has no relevant data
1187 * and is in none of the target trees.
1188 * Pretend it does not exist if we are not adding.
1189 *
1190 * If we are adding, continue down to eventually add
1191 * a node and mark/put this node in the correct tree.
1192 */
1193 if (!create) {
1194 return (find_result);
1195 }
1196 }
1197
1198 dbit = diff_keys(tgt_ip, tgt_prefix, &cur->ip, cur->prefix);
1199 /*
1200 * dbit <= tgt_prefix and dbit <= cur->prefix always.
1201 * We are finished searching if we matched all of the target.
1202 */
1203 if (dbit == tgt_prefix) {
1204 if (tgt_prefix == cur->prefix) {
1205 /*
1206 * The node's key matches the target exactly.
1207 */
1208 if ((cur->set.client_ip & set.client_ip) != 0 ||
1209 (cur->set.ip & set.ip) != 0 ||
1210 (cur->set.nsip & set.nsip) != 0)
1211 {
1212 /*
1213 * It is the answer if it has data.
1214 */
1215 *found = cur;
1216 if (create) {
1217 find_result = ISC_R_EXISTS;
1218 } else {
1219 find_result = ISC_R_SUCCESS;
1220 }
1221 } else if (create) {
1222 /*
1223 * The node lacked relevant data,
1224 * but will have it now.
1225 */
1226 cur->set.client_ip |=
1227 tgt_set->client_ip;
1228 cur->set.ip |= tgt_set->ip;
1229 cur->set.nsip |= tgt_set->nsip;
1230 set_sum_pair(cur);
1231 *found = cur;
1232 find_result = ISC_R_SUCCESS;
1233 }
1234 return (find_result);
1235 }
1236
1237 /*
1238 * We know tgt_prefix < cur->prefix which means that
1239 * the target is shorter than the current node.
1240 * Add the target as the current node's parent.
1241 */
1242 if (!create) {
1243 return (find_result);
1244 }
1245
1246 new_parent = new_node(rpzs, tgt_ip, tgt_prefix, cur);
1247 if (new_parent == NULL) {
1248 return (ISC_R_NOMEMORY);
1249 }
1250 new_parent->parent = parent;
1251 if (parent == NULL) {
1252 rpzs->cidr = new_parent;
1253 } else {
1254 parent->child[cur_num] = new_parent;
1255 }
1256 child_num = DNS_RPZ_IP_BIT(&cur->ip, tgt_prefix);
1257 new_parent->child[child_num] = cur;
1258 cur->parent = new_parent;
1259 new_parent->set = *tgt_set;
1260 set_sum_pair(new_parent);
1261 *found = new_parent;
1262 return (ISC_R_SUCCESS);
1263 }
1264
1265 if (dbit == cur->prefix) {
1266 if ((cur->set.client_ip & set.client_ip) != 0 ||
1267 (cur->set.ip & set.ip) != 0 ||
1268 (cur->set.nsip & set.nsip) != 0)
1269 {
1270 /*
1271 * We have a partial match between of all of the
1272 * current node but only part of the target.
1273 * Continue searching for other hits in the
1274 * same or lower numbered trees.
1275 */
1276 find_result = DNS_R_PARTIALMATCH;
1277 *found = cur;
1278 set.client_ip = trim_zbits(set.client_ip,
1279 cur->set.client_ip);
1280 set.ip = trim_zbits(set.ip, cur->set.ip);
1281 set.nsip = trim_zbits(set.nsip, cur->set.nsip);
1282 }
1283 parent = cur;
1284 cur_num = DNS_RPZ_IP_BIT(tgt_ip, dbit);
1285 cur = cur->child[cur_num];
1286 continue;
1287 }
1288
1289 /*
1290 * dbit < tgt_prefix and dbit < cur->prefix,
1291 * so we failed to match both the target and the current node.
1292 * Insert a fork of a parent above the current node and
1293 * add the target as a sibling of the current node
1294 */
1295 if (!create) {
1296 return (find_result);
1297 }
1298
1299 sibling = new_node(rpzs, tgt_ip, tgt_prefix, NULL);
1300 if (sibling == NULL) {
1301 return (ISC_R_NOMEMORY);
1302 }
1303 new_parent = new_node(rpzs, tgt_ip, dbit, cur);
1304 if (new_parent == NULL) {
1305 isc_mem_put(rpzs->mctx, sibling, sizeof(*sibling));
1306 return (ISC_R_NOMEMORY);
1307 }
1308 new_parent->parent = parent;
1309 if (parent == NULL) {
1310 rpzs->cidr = new_parent;
1311 } else {
1312 parent->child[cur_num] = new_parent;
1313 }
1314 child_num = DNS_RPZ_IP_BIT(tgt_ip, dbit);
1315 new_parent->child[child_num] = sibling;
1316 new_parent->child[1 - child_num] = cur;
1317 cur->parent = new_parent;
1318 sibling->parent = new_parent;
1319 sibling->set = *tgt_set;
1320 set_sum_pair(sibling);
1321 *found = sibling;
1322 return (ISC_R_SUCCESS);
1323 }
1324 }
1325
1326 /*
1327 * Add an IP address to the radix tree.
1328 */
1329 static isc_result_t
add_cidr(dns_rpz_zones_t * rpzs,dns_rpz_num_t rpz_num,dns_rpz_type_t rpz_type,const dns_name_t * src_name)1330 add_cidr(dns_rpz_zones_t *rpzs, dns_rpz_num_t rpz_num, dns_rpz_type_t rpz_type,
1331 const dns_name_t *src_name) {
1332 dns_rpz_cidr_key_t tgt_ip;
1333 dns_rpz_prefix_t tgt_prefix;
1334 dns_rpz_addr_zbits_t set;
1335 dns_rpz_cidr_node_t *found;
1336 isc_result_t result;
1337
1338 result = name2ipkey(DNS_RPZ_ERROR_LEVEL, rpzs, rpz_num, rpz_type,
1339 src_name, &tgt_ip, &tgt_prefix, &set);
1340 /*
1341 * Log complaints about bad owner names but let the zone load.
1342 */
1343 if (result != ISC_R_SUCCESS) {
1344 return (ISC_R_SUCCESS);
1345 }
1346
1347 result = search(rpzs, &tgt_ip, tgt_prefix, &set, true, &found);
1348 if (result != ISC_R_SUCCESS) {
1349 char namebuf[DNS_NAME_FORMATSIZE];
1350
1351 /*
1352 * Do not worry if the radix tree already exists,
1353 * because diff_apply() likes to add nodes before deleting.
1354 */
1355 if (result == ISC_R_EXISTS) {
1356 return (ISC_R_SUCCESS);
1357 }
1358
1359 /*
1360 * bin/tests/system/rpz/tests.sh looks for "rpz.*failed".
1361 */
1362 dns_name_format(src_name, namebuf, sizeof(namebuf));
1363 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RPZ,
1364 DNS_LOGMODULE_RBTDB, DNS_RPZ_ERROR_LEVEL,
1365 "rpz add_cidr(%s) failed: %s", namebuf,
1366 isc_result_totext(result));
1367 return (result);
1368 }
1369
1370 adj_trigger_cnt(rpzs, rpz_num, rpz_type, &tgt_ip, tgt_prefix, true);
1371 return (result);
1372 }
1373
1374 static isc_result_t
add_nm(dns_rpz_zones_t * rpzs,dns_name_t * trig_name,const dns_rpz_nm_data_t * new_data)1375 add_nm(dns_rpz_zones_t *rpzs, dns_name_t *trig_name,
1376 const dns_rpz_nm_data_t *new_data) {
1377 dns_rbtnode_t *nmnode;
1378 dns_rpz_nm_data_t *nm_data;
1379 isc_result_t result;
1380
1381 nmnode = NULL;
1382 result = dns_rbt_addnode(rpzs->rbt, trig_name, &nmnode);
1383 switch (result) {
1384 case ISC_R_SUCCESS:
1385 case ISC_R_EXISTS:
1386 nm_data = nmnode->data;
1387 if (nm_data == NULL) {
1388 nm_data = isc_mem_get(rpzs->mctx, sizeof(*nm_data));
1389 *nm_data = *new_data;
1390 nmnode->data = nm_data;
1391 return (ISC_R_SUCCESS);
1392 }
1393 break;
1394 default:
1395 return (result);
1396 }
1397
1398 /*
1399 * Do not count bits that are already present
1400 */
1401 if ((nm_data->set.qname & new_data->set.qname) != 0 ||
1402 (nm_data->set.ns & new_data->set.ns) != 0 ||
1403 (nm_data->wild.qname & new_data->wild.qname) != 0 ||
1404 (nm_data->wild.ns & new_data->wild.ns) != 0)
1405 {
1406 return (ISC_R_EXISTS);
1407 }
1408
1409 nm_data->set.qname |= new_data->set.qname;
1410 nm_data->set.ns |= new_data->set.ns;
1411 nm_data->wild.qname |= new_data->wild.qname;
1412 nm_data->wild.ns |= new_data->wild.ns;
1413 return (ISC_R_SUCCESS);
1414 }
1415
1416 static isc_result_t
add_name(dns_rpz_zones_t * rpzs,dns_rpz_num_t rpz_num,dns_rpz_type_t rpz_type,const dns_name_t * src_name)1417 add_name(dns_rpz_zones_t *rpzs, dns_rpz_num_t rpz_num, dns_rpz_type_t rpz_type,
1418 const dns_name_t *src_name) {
1419 dns_rpz_nm_data_t new_data;
1420 dns_fixedname_t trig_namef;
1421 dns_name_t *trig_name;
1422 isc_result_t result;
1423
1424 /*
1425 * We need a summary database of names even with 1 policy zone,
1426 * because wildcard triggers are handled differently.
1427 */
1428
1429 trig_name = dns_fixedname_initname(&trig_namef);
1430 name2data(rpzs, rpz_num, rpz_type, src_name, trig_name, &new_data);
1431
1432 result = add_nm(rpzs, trig_name, &new_data);
1433
1434 /*
1435 * Do not worry if the node already exists,
1436 * because diff_apply() likes to add nodes before deleting.
1437 */
1438 if (result == ISC_R_EXISTS) {
1439 return (ISC_R_SUCCESS);
1440 }
1441 if (result == ISC_R_SUCCESS) {
1442 adj_trigger_cnt(rpzs, rpz_num, rpz_type, NULL, 0, true);
1443 }
1444 return (result);
1445 }
1446
1447 /*
1448 * Callback to free the data for a node in the summary RBT database.
1449 */
1450 static void
rpz_node_deleter(void * nm_data,void * mctx)1451 rpz_node_deleter(void *nm_data, void *mctx) {
1452 isc_mem_put(mctx, nm_data, sizeof(dns_rpz_nm_data_t));
1453 }
1454
1455 /*
1456 * Get ready for a new set of policy zones for a view.
1457 */
1458 isc_result_t
dns_rpz_new_zones(dns_rpz_zones_t ** rpzsp,char * rps_cstr,size_t rps_cstr_size,isc_mem_t * mctx,isc_taskmgr_t * taskmgr,isc_timermgr_t * timermgr)1459 dns_rpz_new_zones(dns_rpz_zones_t **rpzsp, char *rps_cstr, size_t rps_cstr_size,
1460 isc_mem_t *mctx, isc_taskmgr_t *taskmgr,
1461 isc_timermgr_t *timermgr) {
1462 dns_rpz_zones_t *zones;
1463 isc_result_t result = ISC_R_SUCCESS;
1464
1465 REQUIRE(rpzsp != NULL && *rpzsp == NULL);
1466
1467 zones = isc_mem_get(mctx, sizeof(*zones));
1468 memset(zones, 0, sizeof(*zones));
1469
1470 isc_rwlock_init(&zones->search_lock, 0, 0);
1471 isc_mutex_init(&zones->maint_lock);
1472 isc_refcount_init(&zones->refs, 1);
1473 isc_refcount_init(&zones->irefs, 1);
1474
1475 zones->rps_cstr = rps_cstr;
1476 zones->rps_cstr_size = rps_cstr_size;
1477 #ifdef USE_DNSRPS
1478 if (rps_cstr != NULL) {
1479 result = dns_dnsrps_view_init(zones, rps_cstr);
1480 }
1481 #else /* ifdef USE_DNSRPS */
1482 INSIST(!zones->p.dnsrps_enabled);
1483 #endif /* ifdef USE_DNSRPS */
1484 if (result == ISC_R_SUCCESS && !zones->p.dnsrps_enabled) {
1485 result = dns_rbt_create(mctx, rpz_node_deleter, mctx,
1486 &zones->rbt);
1487 }
1488
1489 if (result != ISC_R_SUCCESS) {
1490 goto cleanup_rbt;
1491 }
1492
1493 result = isc_task_create(taskmgr, 0, &zones->updater);
1494 if (result != ISC_R_SUCCESS) {
1495 goto cleanup_task;
1496 }
1497
1498 isc_mem_attach(mctx, &zones->mctx);
1499 zones->timermgr = timermgr;
1500 zones->taskmgr = taskmgr;
1501
1502 *rpzsp = zones;
1503 return (ISC_R_SUCCESS);
1504
1505 cleanup_task:
1506 dns_rbt_destroy(&zones->rbt);
1507
1508 cleanup_rbt:
1509 isc_refcount_decrementz(&zones->irefs);
1510 isc_refcount_destroy(&zones->irefs);
1511 isc_refcount_decrementz(&zones->refs);
1512 isc_refcount_destroy(&zones->refs);
1513 isc_mutex_destroy(&zones->maint_lock);
1514 isc_rwlock_destroy(&zones->search_lock);
1515 isc_mem_put(mctx, zones, sizeof(*zones));
1516
1517 return (result);
1518 }
1519
1520 isc_result_t
dns_rpz_new_zone(dns_rpz_zones_t * rpzs,dns_rpz_zone_t ** rpzp)1521 dns_rpz_new_zone(dns_rpz_zones_t *rpzs, dns_rpz_zone_t **rpzp) {
1522 dns_rpz_zone_t *zone;
1523 isc_result_t result;
1524
1525 REQUIRE(rpzp != NULL && *rpzp == NULL);
1526 REQUIRE(rpzs != NULL);
1527 if (rpzs->p.num_zones >= DNS_RPZ_MAX_ZONES) {
1528 return (ISC_R_NOSPACE);
1529 }
1530
1531 zone = isc_mem_get(rpzs->mctx, sizeof(*zone));
1532
1533 memset(zone, 0, sizeof(*zone));
1534 isc_refcount_init(&zone->refs, 1);
1535
1536 result = isc_timer_create(rpzs->timermgr, isc_timertype_inactive, NULL,
1537 NULL, rpzs->updater,
1538 dns_rpz_update_taskaction, zone,
1539 &zone->updatetimer);
1540 if (result != ISC_R_SUCCESS) {
1541 goto cleanup_timer;
1542 }
1543
1544 /*
1545 * This will never be used, but costs us nothing and
1546 * simplifies update_from_db
1547 */
1548
1549 isc_ht_init(&zone->nodes, rpzs->mctx, 1, ISC_HT_CASE_SENSITIVE);
1550
1551 dns_name_init(&zone->origin, NULL);
1552 dns_name_init(&zone->client_ip, NULL);
1553 dns_name_init(&zone->ip, NULL);
1554 dns_name_init(&zone->nsdname, NULL);
1555 dns_name_init(&zone->nsip, NULL);
1556 dns_name_init(&zone->passthru, NULL);
1557 dns_name_init(&zone->drop, NULL);
1558 dns_name_init(&zone->tcp_only, NULL);
1559 dns_name_init(&zone->cname, NULL);
1560
1561 isc_time_settoepoch(&zone->lastupdated);
1562 zone->updatepending = false;
1563 zone->updaterunning = false;
1564 zone->db = NULL;
1565 zone->dbversion = NULL;
1566 zone->updb = NULL;
1567 zone->updbversion = NULL;
1568 zone->updbit = NULL;
1569 isc_refcount_increment(&rpzs->irefs);
1570 zone->rpzs = rpzs;
1571 zone->db_registered = false;
1572 zone->addsoa = true;
1573 ISC_EVENT_INIT(&zone->updateevent, sizeof(zone->updateevent), 0, NULL,
1574 0, NULL, NULL, NULL, NULL, NULL);
1575
1576 zone->num = rpzs->p.num_zones++;
1577 rpzs->zones[zone->num] = zone;
1578
1579 *rpzp = zone;
1580
1581 return (ISC_R_SUCCESS);
1582
1583 cleanup_timer:
1584 isc_refcount_decrementz(&zone->refs);
1585 isc_refcount_destroy(&zone->refs);
1586
1587 isc_mem_put(rpzs->mctx, zone, sizeof(*zone));
1588
1589 return (result);
1590 }
1591
1592 isc_result_t
dns_rpz_dbupdate_callback(dns_db_t * db,void * fn_arg)1593 dns_rpz_dbupdate_callback(dns_db_t *db, void *fn_arg) {
1594 dns_rpz_zone_t *zone = (dns_rpz_zone_t *)fn_arg;
1595 isc_time_t now;
1596 uint64_t tdiff;
1597 isc_result_t result = ISC_R_SUCCESS;
1598 char dname[DNS_NAME_FORMATSIZE];
1599
1600 REQUIRE(DNS_DB_VALID(db));
1601 REQUIRE(zone != NULL);
1602
1603 LOCK(&zone->rpzs->maint_lock);
1604
1605 /* New zone came as AXFR */
1606 if (zone->db != NULL && zone->db != db) {
1607 /* We need to clean up the old DB */
1608 if (zone->dbversion != NULL) {
1609 dns_db_closeversion(zone->db, &zone->dbversion, false);
1610 }
1611 dns_db_updatenotify_unregister(zone->db,
1612 dns_rpz_dbupdate_callback, zone);
1613 dns_db_detach(&zone->db);
1614 }
1615
1616 if (zone->db == NULL) {
1617 RUNTIME_CHECK(zone->dbversion == NULL);
1618 dns_db_attach(db, &zone->db);
1619 }
1620
1621 if (!zone->updatepending && !zone->updaterunning) {
1622 zone->updatepending = true;
1623 isc_time_now(&now);
1624 tdiff = isc_time_microdiff(&now, &zone->lastupdated) / 1000000;
1625 if (tdiff < zone->min_update_interval) {
1626 uint64_t defer = zone->min_update_interval - tdiff;
1627 isc_interval_t interval;
1628 dns_name_format(&zone->origin, dname,
1629 DNS_NAME_FORMATSIZE);
1630 isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
1631 DNS_LOGMODULE_MASTER, ISC_LOG_INFO,
1632 "rpz: %s: new zone version came "
1633 "too soon, deferring update for "
1634 "%" PRIu64 " seconds",
1635 dname, defer);
1636 isc_interval_set(&interval, (unsigned int)defer, 0);
1637 dns_db_currentversion(zone->db, &zone->dbversion);
1638 result = isc_timer_reset(zone->updatetimer,
1639 isc_timertype_once, NULL,
1640 &interval, true);
1641 if (result != ISC_R_SUCCESS) {
1642 goto cleanup;
1643 }
1644 } else {
1645 isc_event_t *event;
1646
1647 dns_db_currentversion(zone->db, &zone->dbversion);
1648 INSIST(!ISC_LINK_LINKED(&zone->updateevent, ev_link));
1649 ISC_EVENT_INIT(&zone->updateevent,
1650 sizeof(zone->updateevent), 0, NULL,
1651 DNS_EVENT_RPZUPDATED,
1652 dns_rpz_update_taskaction, zone, zone,
1653 NULL, NULL);
1654 event = &zone->updateevent;
1655 isc_task_send(zone->rpzs->updater, &event);
1656 }
1657 } else {
1658 zone->updatepending = true;
1659 dns_name_format(&zone->origin, dname, DNS_NAME_FORMATSIZE);
1660 isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
1661 DNS_LOGMODULE_MASTER, ISC_LOG_DEBUG(3),
1662 "rpz: %s: update already queued or running",
1663 dname);
1664 if (zone->dbversion != NULL) {
1665 dns_db_closeversion(zone->db, &zone->dbversion, false);
1666 }
1667 dns_db_currentversion(zone->db, &zone->dbversion);
1668 }
1669
1670 cleanup:
1671 UNLOCK(&zone->rpzs->maint_lock);
1672
1673 return (result);
1674 }
1675
1676 static void
dns_rpz_update_taskaction(isc_task_t * task,isc_event_t * event)1677 dns_rpz_update_taskaction(isc_task_t *task, isc_event_t *event) {
1678 isc_result_t result;
1679 dns_rpz_zone_t *zone;
1680
1681 REQUIRE(event != NULL);
1682 REQUIRE(event->ev_arg != NULL);
1683
1684 UNUSED(task);
1685 zone = (dns_rpz_zone_t *)event->ev_arg;
1686 isc_event_free(&event);
1687 LOCK(&zone->rpzs->maint_lock);
1688 zone->updatepending = false;
1689 zone->updaterunning = true;
1690 dns_rpz_update_from_db(zone);
1691 result = isc_timer_reset(zone->updatetimer, isc_timertype_inactive,
1692 NULL, NULL, true);
1693 RUNTIME_CHECK(result == ISC_R_SUCCESS);
1694 result = isc_time_now(&zone->lastupdated);
1695 RUNTIME_CHECK(result == ISC_R_SUCCESS);
1696 UNLOCK(&zone->rpzs->maint_lock);
1697 }
1698
1699 static isc_result_t
setup_update(dns_rpz_zone_t * rpz)1700 setup_update(dns_rpz_zone_t *rpz) {
1701 isc_result_t result;
1702 char domain[DNS_NAME_FORMATSIZE];
1703 unsigned int nodecount;
1704 uint32_t hashsize;
1705
1706 dns_name_format(&rpz->origin, domain, DNS_NAME_FORMATSIZE);
1707 isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL, DNS_LOGMODULE_MASTER,
1708 ISC_LOG_INFO, "rpz: %s: reload start", domain);
1709
1710 nodecount = dns_db_nodecount(rpz->updb);
1711 hashsize = 1;
1712 while (nodecount != 0 &&
1713 hashsize <= (DNS_RPZ_HTSIZE_MAX + DNS_RPZ_HTSIZE_DIV))
1714 {
1715 hashsize++;
1716 nodecount >>= 1;
1717 }
1718
1719 if (hashsize > DNS_RPZ_HTSIZE_DIV) {
1720 hashsize -= DNS_RPZ_HTSIZE_DIV;
1721 }
1722
1723 isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL, DNS_LOGMODULE_MASTER,
1724 ISC_LOG_DEBUG(1), "rpz: %s: using hashtable size %d",
1725 domain, hashsize);
1726
1727 isc_ht_init(&rpz->newnodes, rpz->rpzs->mctx, hashsize,
1728 ISC_HT_CASE_SENSITIVE);
1729
1730 result = dns_db_createiterator(rpz->updb, DNS_DB_NONSEC3, &rpz->updbit);
1731 if (result != ISC_R_SUCCESS) {
1732 isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
1733 DNS_LOGMODULE_MASTER, ISC_LOG_ERROR,
1734 "rpz: %s: failed to create DB iterator - %s",
1735 domain, isc_result_totext(result));
1736 goto cleanup;
1737 }
1738
1739 result = dns_dbiterator_first(rpz->updbit);
1740 if (result != ISC_R_SUCCESS) {
1741 isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
1742 DNS_LOGMODULE_MASTER, ISC_LOG_ERROR,
1743 "rpz: %s: failed to get db iterator - %s", domain,
1744 isc_result_totext(result));
1745 goto cleanup;
1746 }
1747
1748 result = dns_dbiterator_pause(rpz->updbit);
1749 if (result != ISC_R_SUCCESS) {
1750 isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
1751 DNS_LOGMODULE_MASTER, ISC_LOG_ERROR,
1752 "rpz: %s: failed to pause db iterator - %s",
1753 domain, isc_result_totext(result));
1754 goto cleanup;
1755 }
1756
1757 cleanup:
1758 if (result != ISC_R_SUCCESS) {
1759 if (rpz->updbit != NULL) {
1760 dns_dbiterator_destroy(&rpz->updbit);
1761 }
1762 if (rpz->newnodes != NULL) {
1763 isc_ht_destroy(&rpz->newnodes);
1764 }
1765 dns_db_closeversion(rpz->updb, &rpz->updbversion, false);
1766 }
1767
1768 return (result);
1769 }
1770
1771 static void
finish_update(dns_rpz_zone_t * rpz)1772 finish_update(dns_rpz_zone_t *rpz) {
1773 LOCK(&rpz->rpzs->maint_lock);
1774 rpz->updaterunning = false;
1775
1776 /*
1777 * If there's an update pending, schedule it.
1778 */
1779 if (rpz->updatepending) {
1780 if (rpz->min_update_interval > 0) {
1781 uint64_t defer = rpz->min_update_interval;
1782 char dname[DNS_NAME_FORMATSIZE];
1783 isc_interval_t interval;
1784
1785 dns_name_format(&rpz->origin, dname,
1786 DNS_NAME_FORMATSIZE);
1787 isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
1788 DNS_LOGMODULE_MASTER, ISC_LOG_INFO,
1789 "rpz: %s: new zone version came "
1790 "too soon, deferring update for "
1791 "%" PRIu64 " seconds",
1792 dname, defer);
1793 isc_interval_set(&interval, (unsigned int)defer, 0);
1794 isc_timer_reset(rpz->updatetimer, isc_timertype_once,
1795 NULL, &interval, true);
1796 } else {
1797 isc_event_t *event = NULL;
1798 INSIST(!ISC_LINK_LINKED(&rpz->updateevent, ev_link));
1799 ISC_EVENT_INIT(&rpz->updateevent,
1800 sizeof(rpz->updateevent), 0, NULL,
1801 DNS_EVENT_RPZUPDATED,
1802 dns_rpz_update_taskaction, rpz, rpz,
1803 NULL, NULL);
1804 event = &rpz->updateevent;
1805 isc_task_send(rpz->rpzs->updater, &event);
1806 }
1807 }
1808 UNLOCK(&rpz->rpzs->maint_lock);
1809 }
1810
1811 static void
cleanup_quantum(isc_task_t * task,isc_event_t * event)1812 cleanup_quantum(isc_task_t *task, isc_event_t *event) {
1813 isc_result_t result = ISC_R_SUCCESS;
1814 char domain[DNS_NAME_FORMATSIZE];
1815 dns_rpz_zone_t *rpz = NULL;
1816 isc_ht_iter_t *iter = NULL;
1817 dns_fixedname_t fname;
1818 dns_name_t *name = NULL;
1819 int count = 0;
1820
1821 UNUSED(task);
1822
1823 REQUIRE(event != NULL);
1824 REQUIRE(event->ev_sender != NULL);
1825
1826 rpz = (dns_rpz_zone_t *)event->ev_sender;
1827 iter = (isc_ht_iter_t *)event->ev_arg;
1828 isc_event_free(&event);
1829
1830 if (iter == NULL) {
1831 /*
1832 * Iterate over old ht with existing nodes deleted to
1833 * delete deleted nodes from RPZ
1834 */
1835 isc_ht_iter_create(rpz->nodes, &iter);
1836 }
1837
1838 name = dns_fixedname_initname(&fname);
1839
1840 LOCK(&rpz->rpzs->maint_lock);
1841
1842 /* Check that we aren't shutting down. */
1843 if (rpz->rpzs->zones[rpz->num] == NULL) {
1844 UNLOCK(&rpz->rpzs->maint_lock);
1845 goto cleanup;
1846 }
1847
1848 for (result = isc_ht_iter_first(iter);
1849 result == ISC_R_SUCCESS && count++ < DNS_RPZ_QUANTUM;
1850 result = isc_ht_iter_delcurrent_next(iter))
1851 {
1852 isc_region_t region;
1853 unsigned char *key = NULL;
1854 size_t keysize;
1855
1856 isc_ht_iter_currentkey(iter, &key, &keysize);
1857 region.base = key;
1858 region.length = (unsigned int)keysize;
1859 dns_name_fromregion(name, ®ion);
1860 dns_rpz_delete(rpz->rpzs, rpz->num, name);
1861 }
1862
1863 if (result == ISC_R_SUCCESS) {
1864 isc_event_t *nevent = NULL;
1865
1866 /*
1867 * We finished a quantum; trigger the next one and return.
1868 */
1869
1870 INSIST(!ISC_LINK_LINKED(&rpz->updateevent, ev_link));
1871 ISC_EVENT_INIT(&rpz->updateevent, sizeof(rpz->updateevent), 0,
1872 NULL, DNS_EVENT_RPZUPDATED, cleanup_quantum,
1873 iter, rpz, NULL, NULL);
1874 nevent = &rpz->updateevent;
1875 isc_task_send(rpz->rpzs->updater, &nevent);
1876 UNLOCK(&rpz->rpzs->maint_lock);
1877 return;
1878 } else if (result == ISC_R_NOMORE) {
1879 isc_ht_t *tmpht = NULL;
1880
1881 /*
1882 * Done with cleanup of deleted nodes; finalize
1883 * the update.
1884 */
1885 tmpht = rpz->nodes;
1886 rpz->nodes = rpz->newnodes;
1887 rpz->newnodes = tmpht;
1888
1889 UNLOCK(&rpz->rpzs->maint_lock);
1890 finish_update(rpz);
1891 dns_name_format(&rpz->origin, domain, DNS_NAME_FORMATSIZE);
1892 isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
1893 DNS_LOGMODULE_MASTER, ISC_LOG_INFO,
1894 "rpz: %s: reload done", domain);
1895 } else {
1896 UNLOCK(&rpz->rpzs->maint_lock);
1897 }
1898
1899 /*
1900 * If we're here, we're finished or something went wrong.
1901 */
1902 cleanup:
1903 if (iter != NULL) {
1904 isc_ht_iter_destroy(&iter);
1905 }
1906 if (rpz->newnodes != NULL) {
1907 isc_ht_destroy(&rpz->newnodes);
1908 }
1909 dns_db_closeversion(rpz->updb, &rpz->updbversion, false);
1910 dns_db_detach(&rpz->updb);
1911 rpz_detach(&rpz);
1912 }
1913
1914 static void
update_quantum(isc_task_t * task,isc_event_t * event)1915 update_quantum(isc_task_t *task, isc_event_t *event) {
1916 isc_result_t result = ISC_R_SUCCESS;
1917 dns_dbnode_t *node = NULL;
1918 dns_rpz_zone_t *rpz = NULL;
1919 char domain[DNS_NAME_FORMATSIZE];
1920 dns_fixedname_t fixname;
1921 dns_name_t *name = NULL;
1922 isc_event_t *nevent = NULL;
1923 int count = 0;
1924
1925 UNUSED(task);
1926
1927 REQUIRE(event != NULL);
1928 REQUIRE(event->ev_arg != NULL);
1929
1930 rpz = (dns_rpz_zone_t *)event->ev_arg;
1931 isc_event_free(&event);
1932
1933 REQUIRE(rpz->updbit != NULL);
1934 REQUIRE(rpz->newnodes != NULL);
1935
1936 name = dns_fixedname_initname(&fixname);
1937
1938 dns_name_format(&rpz->origin, domain, DNS_NAME_FORMATSIZE);
1939
1940 LOCK(&rpz->rpzs->maint_lock);
1941
1942 /* Check that we aren't shutting down. */
1943 if (rpz->rpzs->zones[rpz->num] == NULL) {
1944 UNLOCK(&rpz->rpzs->maint_lock);
1945 goto cleanup;
1946 }
1947
1948 while (result == ISC_R_SUCCESS && count++ < DNS_RPZ_QUANTUM) {
1949 char namebuf[DNS_NAME_FORMATSIZE];
1950 dns_rdatasetiter_t *rdsiter = NULL;
1951
1952 result = dns_dbiterator_current(rpz->updbit, &node, name);
1953 if (result != ISC_R_SUCCESS) {
1954 isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
1955 DNS_LOGMODULE_MASTER, ISC_LOG_ERROR,
1956 "rpz: %s: failed to get dbiterator - %s",
1957 domain, isc_result_totext(result));
1958 dns_db_detachnode(rpz->updb, &node);
1959 break;
1960 }
1961
1962 result = dns_db_allrdatasets(rpz->updb, node, rpz->updbversion,
1963 0, 0, &rdsiter);
1964 if (result != ISC_R_SUCCESS) {
1965 isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
1966 DNS_LOGMODULE_MASTER, ISC_LOG_ERROR,
1967 "rpz: %s: failed to fetch "
1968 "rrdatasets - %s",
1969 domain, isc_result_totext(result));
1970 dns_db_detachnode(rpz->updb, &node);
1971 break;
1972 }
1973
1974 result = dns_rdatasetiter_first(rdsiter);
1975 dns_rdatasetiter_destroy(&rdsiter);
1976 if (result != ISC_R_SUCCESS) { /* empty non-terminal */
1977 if (result != ISC_R_NOMORE) {
1978 isc_log_write(
1979 dns_lctx, DNS_LOGCATEGORY_GENERAL,
1980 DNS_LOGMODULE_MASTER, ISC_LOG_ERROR,
1981 "rpz: %s: error %s while creating "
1982 "rdatasetiter",
1983 domain, isc_result_totext(result));
1984 }
1985 dns_db_detachnode(rpz->updb, &node);
1986 result = dns_dbiterator_next(rpz->updbit);
1987 continue;
1988 }
1989
1990 dns_name_downcase(name, name, NULL);
1991 result = isc_ht_add(rpz->newnodes, name->ndata, name->length,
1992 rpz);
1993 if (result != ISC_R_SUCCESS) {
1994 dns_name_format(name, namebuf, sizeof(namebuf));
1995 isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
1996 DNS_LOGMODULE_MASTER, ISC_LOG_ERROR,
1997 "rpz: %s, adding node %s to HT error %s",
1998 domain, namebuf,
1999 isc_result_totext(result));
2000 dns_db_detachnode(rpz->updb, &node);
2001 result = dns_dbiterator_next(rpz->updbit);
2002 continue;
2003 }
2004
2005 result = isc_ht_find(rpz->nodes, name->ndata, name->length,
2006 NULL);
2007 if (result == ISC_R_SUCCESS) {
2008 isc_ht_delete(rpz->nodes, name->ndata, name->length);
2009 } else { /* not found */
2010 result = dns_rpz_add(rpz->rpzs, rpz->num, name);
2011 if (result != ISC_R_SUCCESS) {
2012 dns_name_format(name, namebuf, sizeof(namebuf));
2013 isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
2014 DNS_LOGMODULE_MASTER,
2015 ISC_LOG_ERROR,
2016 "rpz: %s: adding node %s "
2017 "to RPZ error %s",
2018 domain, namebuf,
2019 isc_result_totext(result));
2020 } else {
2021 dns_name_format(name, namebuf, sizeof(namebuf));
2022 isc_log_write(dns_lctx, DNS_LOGCATEGORY_GENERAL,
2023 DNS_LOGMODULE_MASTER,
2024 ISC_LOG_DEBUG(3),
2025 "rpz: %s: adding node %s", domain,
2026 namebuf);
2027 }
2028 }
2029
2030 dns_db_detachnode(rpz->updb, &node);
2031 result = dns_dbiterator_next(rpz->updbit);
2032 }
2033
2034 if (result == ISC_R_SUCCESS) {
2035 /*
2036 * Pause the iterator so that the DB is not locked.
2037 */
2038 dns_dbiterator_pause(rpz->updbit);
2039
2040 /*
2041 * We finished a quantum; trigger the next one and return.
2042 */
2043 INSIST(!ISC_LINK_LINKED(&rpz->updateevent, ev_link));
2044 ISC_EVENT_INIT(&rpz->updateevent, sizeof(rpz->updateevent), 0,
2045 NULL, DNS_EVENT_RPZUPDATED, update_quantum, rpz,
2046 rpz, NULL, NULL);
2047 nevent = &rpz->updateevent;
2048 isc_task_send(rpz->rpzs->updater, &nevent);
2049 UNLOCK(&rpz->rpzs->maint_lock);
2050 return;
2051 } else if (result == ISC_R_NOMORE) {
2052 /*
2053 * Done with the new database; now we just need to
2054 * clean up the old.
2055 */
2056 dns_dbiterator_destroy(&rpz->updbit);
2057
2058 INSIST(!ISC_LINK_LINKED(&rpz->updateevent, ev_link));
2059 ISC_EVENT_INIT(&rpz->updateevent, sizeof(rpz->updateevent), 0,
2060 NULL, DNS_EVENT_RPZUPDATED, cleanup_quantum,
2061 NULL, rpz, NULL, NULL);
2062 nevent = &rpz->updateevent;
2063 isc_task_send(rpz->rpzs->updater, &nevent);
2064 UNLOCK(&rpz->rpzs->maint_lock);
2065 return;
2066 }
2067
2068 /*
2069 * If we're here, something went wrong, so clean up.
2070 */
2071 UNLOCK(&rpz->rpzs->maint_lock);
2072
2073 cleanup:
2074 if (rpz->updbit != NULL) {
2075 dns_dbiterator_destroy(&rpz->updbit);
2076 }
2077 if (rpz->newnodes != NULL) {
2078 isc_ht_destroy(&rpz->newnodes);
2079 }
2080 dns_db_closeversion(rpz->updb, &rpz->updbversion, false);
2081 dns_db_detach(&rpz->updb);
2082 rpz_detach(&rpz);
2083 }
2084
2085 static void
dns_rpz_update_from_db(dns_rpz_zone_t * rpz)2086 dns_rpz_update_from_db(dns_rpz_zone_t *rpz) {
2087 isc_result_t result;
2088 isc_event_t *event;
2089
2090 REQUIRE(rpz != NULL);
2091 REQUIRE(DNS_DB_VALID(rpz->db));
2092 REQUIRE(rpz->updb == NULL);
2093 REQUIRE(rpz->updbversion == NULL);
2094 REQUIRE(rpz->updbit == NULL);
2095 REQUIRE(rpz->newnodes == NULL);
2096
2097 isc_refcount_increment(&rpz->refs);
2098 dns_db_attach(rpz->db, &rpz->updb);
2099 rpz->updbversion = rpz->dbversion;
2100 rpz->dbversion = NULL;
2101
2102 result = setup_update(rpz);
2103 if (result != ISC_R_SUCCESS) {
2104 goto cleanup;
2105 }
2106
2107 event = &rpz->updateevent;
2108 INSIST(!ISC_LINK_LINKED(&rpz->updateevent, ev_link));
2109 ISC_EVENT_INIT(&rpz->updateevent, sizeof(rpz->updateevent), 0, NULL,
2110 DNS_EVENT_RPZUPDATED, update_quantum, rpz, rpz, NULL,
2111 NULL);
2112 isc_task_send(rpz->rpzs->updater, &event);
2113 return;
2114
2115 cleanup:
2116 if (rpz->updbit != NULL) {
2117 dns_dbiterator_destroy(&rpz->updbit);
2118 }
2119 if (rpz->newnodes != NULL) {
2120 isc_ht_destroy(&rpz->newnodes);
2121 }
2122 dns_db_closeversion(rpz->updb, &rpz->updbversion, false);
2123 dns_db_detach(&rpz->updb);
2124 rpz_detach(&rpz);
2125 }
2126
2127 /*
2128 * Free the radix tree of a response policy database.
2129 */
2130 static void
cidr_free(dns_rpz_zones_t * rpzs)2131 cidr_free(dns_rpz_zones_t *rpzs) {
2132 dns_rpz_cidr_node_t *cur, *child, *parent;
2133
2134 cur = rpzs->cidr;
2135 while (cur != NULL) {
2136 /* Depth first. */
2137 child = cur->child[0];
2138 if (child != NULL) {
2139 cur = child;
2140 continue;
2141 }
2142 child = cur->child[1];
2143 if (child != NULL) {
2144 cur = child;
2145 continue;
2146 }
2147
2148 /* Delete this leaf and go up. */
2149 parent = cur->parent;
2150 if (parent == NULL) {
2151 rpzs->cidr = NULL;
2152 } else {
2153 parent->child[parent->child[1] == cur] = NULL;
2154 }
2155 isc_mem_put(rpzs->mctx, cur, sizeof(*cur));
2156 cur = parent;
2157 }
2158 }
2159
2160 /*
2161 * Discard a response policy zone blob
2162 * before discarding the overall rpz structure.
2163 */
2164 static void
rpz_detach(dns_rpz_zone_t ** rpzp)2165 rpz_detach(dns_rpz_zone_t **rpzp) {
2166 dns_rpz_zone_t *rpz;
2167 dns_rpz_zones_t *rpzs;
2168
2169 REQUIRE(rpzp != NULL && *rpzp != NULL);
2170
2171 rpz = *rpzp;
2172 *rpzp = NULL;
2173
2174 if (isc_refcount_decrement(&rpz->refs) == 1) {
2175 isc_refcount_destroy(&rpz->refs);
2176
2177 rpzs = rpz->rpzs;
2178 rpz->rpzs = NULL;
2179
2180 if (dns_name_dynamic(&rpz->origin)) {
2181 dns_name_free(&rpz->origin, rpzs->mctx);
2182 }
2183 if (dns_name_dynamic(&rpz->client_ip)) {
2184 dns_name_free(&rpz->client_ip, rpzs->mctx);
2185 }
2186 if (dns_name_dynamic(&rpz->ip)) {
2187 dns_name_free(&rpz->ip, rpzs->mctx);
2188 }
2189 if (dns_name_dynamic(&rpz->nsdname)) {
2190 dns_name_free(&rpz->nsdname, rpzs->mctx);
2191 }
2192 if (dns_name_dynamic(&rpz->nsip)) {
2193 dns_name_free(&rpz->nsip, rpzs->mctx);
2194 }
2195 if (dns_name_dynamic(&rpz->passthru)) {
2196 dns_name_free(&rpz->passthru, rpzs->mctx);
2197 }
2198 if (dns_name_dynamic(&rpz->drop)) {
2199 dns_name_free(&rpz->drop, rpzs->mctx);
2200 }
2201 if (dns_name_dynamic(&rpz->tcp_only)) {
2202 dns_name_free(&rpz->tcp_only, rpzs->mctx);
2203 }
2204 if (dns_name_dynamic(&rpz->cname)) {
2205 dns_name_free(&rpz->cname, rpzs->mctx);
2206 }
2207 if (rpz->db != NULL) {
2208 if (rpz->dbversion != NULL) {
2209 dns_db_closeversion(rpz->db, &rpz->dbversion,
2210 false);
2211 }
2212 dns_db_updatenotify_unregister(
2213 rpz->db, dns_rpz_dbupdate_callback, rpz);
2214 dns_db_detach(&rpz->db);
2215 }
2216 if (rpz->updaterunning) {
2217 isc_task_purgeevent(rpzs->updater, &rpz->updateevent);
2218 if (rpz->updbit != NULL) {
2219 dns_dbiterator_destroy(&rpz->updbit);
2220 }
2221 if (rpz->newnodes != NULL) {
2222 isc_ht_destroy(&rpz->newnodes);
2223 }
2224 if (rpz->updb != NULL) {
2225 if (rpz->updbversion != NULL) {
2226 dns_db_closeversion(rpz->updb,
2227 &rpz->updbversion,
2228 false);
2229 }
2230 dns_db_detach(&rpz->updb);
2231 }
2232 }
2233
2234 isc_timer_reset(rpz->updatetimer, isc_timertype_inactive, NULL,
2235 NULL, true);
2236 isc_timer_destroy(&rpz->updatetimer);
2237
2238 isc_ht_destroy(&rpz->nodes);
2239
2240 isc_mem_put(rpzs->mctx, rpz, sizeof(*rpz));
2241 rpz_detach_rpzs(&rpzs);
2242 }
2243 }
2244
2245 void
dns_rpz_attach_rpzs(dns_rpz_zones_t * rpzs,dns_rpz_zones_t ** rpzsp)2246 dns_rpz_attach_rpzs(dns_rpz_zones_t *rpzs, dns_rpz_zones_t **rpzsp) {
2247 REQUIRE(rpzsp != NULL && *rpzsp == NULL);
2248 isc_refcount_increment(&rpzs->refs);
2249 *rpzsp = rpzs;
2250 }
2251
2252 /*
2253 * Forget a view's policy zones.
2254 */
2255 void
dns_rpz_detach_rpzs(dns_rpz_zones_t ** rpzsp)2256 dns_rpz_detach_rpzs(dns_rpz_zones_t **rpzsp) {
2257 REQUIRE(rpzsp != NULL && *rpzsp != NULL);
2258 dns_rpz_zones_t *rpzs = *rpzsp;
2259 *rpzsp = NULL;
2260
2261 if (isc_refcount_decrement(&rpzs->refs) == 1) {
2262 LOCK(&rpzs->maint_lock);
2263 /*
2264 * Forget the last of view's rpz machinery after
2265 * the last reference.
2266 */
2267 for (dns_rpz_num_t rpz_num = 0; rpz_num < DNS_RPZ_MAX_ZONES;
2268 ++rpz_num)
2269 {
2270 dns_rpz_zone_t *rpz = rpzs->zones[rpz_num];
2271 rpzs->zones[rpz_num] = NULL;
2272 if (rpz != NULL) {
2273 rpz_detach(&rpz);
2274 }
2275 }
2276 UNLOCK(&rpzs->maint_lock);
2277 rpz_detach_rpzs(&rpzs);
2278 }
2279 }
2280
2281 static void
rpz_detach_rpzs(dns_rpz_zones_t ** rpzsp)2282 rpz_detach_rpzs(dns_rpz_zones_t **rpzsp) {
2283 REQUIRE(rpzsp != NULL && *rpzsp != NULL);
2284 dns_rpz_zones_t *rpzs = *rpzsp;
2285 *rpzsp = NULL;
2286
2287 if (isc_refcount_decrement(&rpzs->irefs) == 1) {
2288 if (rpzs->rps_cstr_size != 0) {
2289 #ifdef USE_DNSRPS
2290 librpz->client_detach(&rpzs->rps_client);
2291 #endif /* ifdef USE_DNSRPS */
2292 isc_mem_put(rpzs->mctx, rpzs->rps_cstr,
2293 rpzs->rps_cstr_size);
2294 }
2295
2296 cidr_free(rpzs);
2297 if (rpzs->rbt != NULL) {
2298 dns_rbt_destroy(&rpzs->rbt);
2299 }
2300 isc_task_destroy(&rpzs->updater);
2301 isc_mutex_destroy(&rpzs->maint_lock);
2302 isc_rwlock_destroy(&rpzs->search_lock);
2303 isc_refcount_destroy(&rpzs->refs);
2304 isc_mem_putanddetach(&rpzs->mctx, rpzs, sizeof(*rpzs));
2305 }
2306 }
2307
2308 /*
2309 * Deprecated and removed.
2310 */
2311 isc_result_t
dns_rpz_beginload(dns_rpz_zones_t ** load_rpzsp,dns_rpz_zones_t * rpzs,dns_rpz_num_t rpz_num)2312 dns_rpz_beginload(dns_rpz_zones_t **load_rpzsp, dns_rpz_zones_t *rpzs,
2313 dns_rpz_num_t rpz_num) {
2314 UNUSED(load_rpzsp);
2315 UNUSED(rpzs);
2316 UNUSED(rpz_num);
2317
2318 return (ISC_R_NOTIMPLEMENTED);
2319 }
2320
2321 /*
2322 * Deprecated and removed.
2323 */
2324 isc_result_t
dns_rpz_ready(dns_rpz_zones_t * rpzs,dns_rpz_zones_t ** load_rpzsp,dns_rpz_num_t rpz_num)2325 dns_rpz_ready(dns_rpz_zones_t *rpzs, dns_rpz_zones_t **load_rpzsp,
2326 dns_rpz_num_t rpz_num) {
2327 UNUSED(rpzs);
2328 UNUSED(load_rpzsp);
2329 UNUSED(rpz_num);
2330
2331 return (ISC_R_NOTIMPLEMENTED);
2332 }
2333
2334 /*
2335 * Add an IP address to the radix tree or a name to the summary database.
2336 */
2337 isc_result_t
dns_rpz_add(dns_rpz_zones_t * rpzs,dns_rpz_num_t rpz_num,const dns_name_t * src_name)2338 dns_rpz_add(dns_rpz_zones_t *rpzs, dns_rpz_num_t rpz_num,
2339 const dns_name_t *src_name) {
2340 dns_rpz_zone_t *rpz;
2341 dns_rpz_type_t rpz_type;
2342 isc_result_t result = ISC_R_FAILURE;
2343
2344 REQUIRE(rpzs != NULL && rpz_num < rpzs->p.num_zones);
2345 rpz = rpzs->zones[rpz_num];
2346 REQUIRE(rpz != NULL);
2347 RWLOCK(&rpzs->search_lock, isc_rwlocktype_write);
2348
2349 rpz_type = type_from_name(rpzs, rpz, src_name);
2350
2351 switch (rpz_type) {
2352 case DNS_RPZ_TYPE_QNAME:
2353 case DNS_RPZ_TYPE_NSDNAME:
2354 result = add_name(rpzs, rpz_num, rpz_type, src_name);
2355 break;
2356 case DNS_RPZ_TYPE_CLIENT_IP:
2357 case DNS_RPZ_TYPE_IP:
2358 case DNS_RPZ_TYPE_NSIP:
2359 result = add_cidr(rpzs, rpz_num, rpz_type, src_name);
2360 break;
2361 case DNS_RPZ_TYPE_BAD:
2362 break;
2363 }
2364 RWUNLOCK(&rpzs->search_lock, isc_rwlocktype_write);
2365
2366 return (result);
2367 }
2368
2369 /*
2370 * Remove an IP address from the radix tree.
2371 */
2372 static void
del_cidr(dns_rpz_zones_t * rpzs,dns_rpz_num_t rpz_num,dns_rpz_type_t rpz_type,const dns_name_t * src_name)2373 del_cidr(dns_rpz_zones_t *rpzs, dns_rpz_num_t rpz_num, dns_rpz_type_t rpz_type,
2374 const dns_name_t *src_name) {
2375 isc_result_t result;
2376 dns_rpz_cidr_key_t tgt_ip;
2377 dns_rpz_prefix_t tgt_prefix;
2378 dns_rpz_addr_zbits_t tgt_set;
2379 dns_rpz_cidr_node_t *tgt, *parent, *child;
2380
2381 /*
2382 * Do not worry about invalid rpz IP address names. If we
2383 * are here, then something relevant was added and so was
2384 * valid. Invalid names here are usually internal RBTDB nodes.
2385 */
2386 result = name2ipkey(DNS_RPZ_DEBUG_QUIET, rpzs, rpz_num, rpz_type,
2387 src_name, &tgt_ip, &tgt_prefix, &tgt_set);
2388 if (result != ISC_R_SUCCESS) {
2389 return;
2390 }
2391
2392 result = search(rpzs, &tgt_ip, tgt_prefix, &tgt_set, false, &tgt);
2393 if (result != ISC_R_SUCCESS) {
2394 INSIST(result == ISC_R_NOTFOUND ||
2395 result == DNS_R_PARTIALMATCH);
2396 /*
2397 * Do not worry about missing summary RBT nodes that probably
2398 * correspond to RBTDB nodes that were implicit RBT nodes
2399 * that were later added for (often empty) wildcards
2400 * and then to the RBTDB deferred cleanup list.
2401 */
2402 return;
2403 }
2404
2405 /*
2406 * Mark the node and its parents to reflect the deleted IP address.
2407 * Do not count bits that are already clear for internal RBTDB nodes.
2408 */
2409 tgt_set.client_ip &= tgt->set.client_ip;
2410 tgt_set.ip &= tgt->set.ip;
2411 tgt_set.nsip &= tgt->set.nsip;
2412 tgt->set.client_ip &= ~tgt_set.client_ip;
2413 tgt->set.ip &= ~tgt_set.ip;
2414 tgt->set.nsip &= ~tgt_set.nsip;
2415 set_sum_pair(tgt);
2416
2417 adj_trigger_cnt(rpzs, rpz_num, rpz_type, &tgt_ip, tgt_prefix, false);
2418
2419 /*
2420 * We might need to delete 2 nodes.
2421 */
2422 do {
2423 /*
2424 * The node is now useless if it has no data of its own
2425 * and 0 or 1 children. We are finished if it is not useless.
2426 */
2427 if ((child = tgt->child[0]) != NULL) {
2428 if (tgt->child[1] != NULL) {
2429 break;
2430 }
2431 } else {
2432 child = tgt->child[1];
2433 }
2434 if (tgt->set.client_ip != 0 || tgt->set.ip != 0 ||
2435 tgt->set.nsip != 0)
2436 {
2437 break;
2438 }
2439
2440 /*
2441 * Replace the pointer to this node in the parent with
2442 * the remaining child or NULL.
2443 */
2444 parent = tgt->parent;
2445 if (parent == NULL) {
2446 rpzs->cidr = child;
2447 } else {
2448 parent->child[parent->child[1] == tgt] = child;
2449 }
2450 /*
2451 * If the child exists fix up its parent pointer.
2452 */
2453 if (child != NULL) {
2454 child->parent = parent;
2455 }
2456 isc_mem_put(rpzs->mctx, tgt, sizeof(*tgt));
2457
2458 tgt = parent;
2459 } while (tgt != NULL);
2460 }
2461
2462 static void
del_name(dns_rpz_zones_t * rpzs,dns_rpz_num_t rpz_num,dns_rpz_type_t rpz_type,const dns_name_t * src_name)2463 del_name(dns_rpz_zones_t *rpzs, dns_rpz_num_t rpz_num, dns_rpz_type_t rpz_type,
2464 const dns_name_t *src_name) {
2465 char namebuf[DNS_NAME_FORMATSIZE];
2466 dns_fixedname_t trig_namef;
2467 dns_name_t *trig_name;
2468 dns_rbtnode_t *nmnode;
2469 dns_rpz_nm_data_t *nm_data, del_data;
2470 isc_result_t result;
2471 bool exists;
2472
2473 /*
2474 * We need a summary database of names even with 1 policy zone,
2475 * because wildcard triggers are handled differently.
2476 */
2477
2478 trig_name = dns_fixedname_initname(&trig_namef);
2479 name2data(rpzs, rpz_num, rpz_type, src_name, trig_name, &del_data);
2480
2481 nmnode = NULL;
2482 result = dns_rbt_findnode(rpzs->rbt, trig_name, NULL, &nmnode, NULL, 0,
2483 NULL, NULL);
2484 if (result != ISC_R_SUCCESS) {
2485 /*
2486 * Do not worry about missing summary RBT nodes that probably
2487 * correspond to RBTDB nodes that were implicit RBT nodes
2488 * that were later added for (often empty) wildcards
2489 * and then to the RBTDB deferred cleanup list.
2490 */
2491 if (result == ISC_R_NOTFOUND || result == DNS_R_PARTIALMATCH) {
2492 return;
2493 }
2494 dns_name_format(src_name, namebuf, sizeof(namebuf));
2495 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RPZ,
2496 DNS_LOGMODULE_RBTDB, DNS_RPZ_ERROR_LEVEL,
2497 "rpz del_name(%s) node search failed: %s",
2498 namebuf, isc_result_totext(result));
2499 return;
2500 }
2501
2502 nm_data = nmnode->data;
2503 INSIST(nm_data != NULL);
2504
2505 /*
2506 * Do not count bits that next existed for RBT nodes that would we
2507 * would not have found in a summary for a single RBTDB tree.
2508 */
2509 del_data.set.qname &= nm_data->set.qname;
2510 del_data.set.ns &= nm_data->set.ns;
2511 del_data.wild.qname &= nm_data->wild.qname;
2512 del_data.wild.ns &= nm_data->wild.ns;
2513
2514 exists = (del_data.set.qname != 0 || del_data.set.ns != 0 ||
2515 del_data.wild.qname != 0 || del_data.wild.ns != 0);
2516
2517 nm_data->set.qname &= ~del_data.set.qname;
2518 nm_data->set.ns &= ~del_data.set.ns;
2519 nm_data->wild.qname &= ~del_data.wild.qname;
2520 nm_data->wild.ns &= ~del_data.wild.ns;
2521
2522 if (nm_data->set.qname == 0 && nm_data->set.ns == 0 &&
2523 nm_data->wild.qname == 0 && nm_data->wild.ns == 0)
2524 {
2525 result = dns_rbt_deletenode(rpzs->rbt, nmnode, false);
2526 if (result != ISC_R_SUCCESS) {
2527 /*
2528 * bin/tests/system/rpz/tests.sh looks for
2529 * "rpz.*failed".
2530 */
2531 dns_name_format(src_name, namebuf, sizeof(namebuf));
2532 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RPZ,
2533 DNS_LOGMODULE_RBTDB, DNS_RPZ_ERROR_LEVEL,
2534 "rpz del_name(%s) node delete failed: %s",
2535 namebuf, isc_result_totext(result));
2536 }
2537 }
2538
2539 if (exists) {
2540 adj_trigger_cnt(rpzs, rpz_num, rpz_type, NULL, 0, false);
2541 }
2542 }
2543
2544 /*
2545 * Remove an IP address from the radix tree or a name from the summary database.
2546 */
2547 void
dns_rpz_delete(dns_rpz_zones_t * rpzs,dns_rpz_num_t rpz_num,const dns_name_t * src_name)2548 dns_rpz_delete(dns_rpz_zones_t *rpzs, dns_rpz_num_t rpz_num,
2549 const dns_name_t *src_name) {
2550 dns_rpz_zone_t *rpz;
2551 dns_rpz_type_t rpz_type;
2552
2553 REQUIRE(rpzs != NULL && rpz_num < rpzs->p.num_zones);
2554 rpz = rpzs->zones[rpz_num];
2555 REQUIRE(rpz != NULL);
2556
2557 RWLOCK(&rpzs->search_lock, isc_rwlocktype_write);
2558
2559 rpz_type = type_from_name(rpzs, rpz, src_name);
2560
2561 switch (rpz_type) {
2562 case DNS_RPZ_TYPE_QNAME:
2563 case DNS_RPZ_TYPE_NSDNAME:
2564 del_name(rpzs, rpz_num, rpz_type, src_name);
2565 break;
2566 case DNS_RPZ_TYPE_CLIENT_IP:
2567 case DNS_RPZ_TYPE_IP:
2568 case DNS_RPZ_TYPE_NSIP:
2569 del_cidr(rpzs, rpz_num, rpz_type, src_name);
2570 break;
2571 case DNS_RPZ_TYPE_BAD:
2572 break;
2573 }
2574
2575 RWUNLOCK(&rpzs->search_lock, isc_rwlocktype_write);
2576 }
2577
2578 /*
2579 * Search the summary radix tree to get a relative owner name in a
2580 * policy zone relevant to a triggering IP address.
2581 * rpz_type and zbits limit the search for IP address netaddr
2582 * return the policy zone's number or DNS_RPZ_INVALID_NUM
2583 * ip_name is the relative owner name found and
2584 * *prefixp is its prefix length.
2585 */
2586 dns_rpz_num_t
dns_rpz_find_ip(dns_rpz_zones_t * rpzs,dns_rpz_type_t rpz_type,dns_rpz_zbits_t zbits,const isc_netaddr_t * netaddr,dns_name_t * ip_name,dns_rpz_prefix_t * prefixp)2587 dns_rpz_find_ip(dns_rpz_zones_t *rpzs, dns_rpz_type_t rpz_type,
2588 dns_rpz_zbits_t zbits, const isc_netaddr_t *netaddr,
2589 dns_name_t *ip_name, dns_rpz_prefix_t *prefixp) {
2590 dns_rpz_cidr_key_t tgt_ip;
2591 dns_rpz_addr_zbits_t tgt_set;
2592 dns_rpz_cidr_node_t *found;
2593 isc_result_t result;
2594 dns_rpz_num_t rpz_num = 0;
2595 dns_rpz_have_t have;
2596 int i;
2597
2598 RWLOCK(&rpzs->search_lock, isc_rwlocktype_read);
2599 have = rpzs->have;
2600 RWUNLOCK(&rpzs->search_lock, isc_rwlocktype_read);
2601
2602 /*
2603 * Convert IP address to CIDR tree key.
2604 */
2605 if (netaddr->family == AF_INET) {
2606 tgt_ip.w[0] = 0;
2607 tgt_ip.w[1] = 0;
2608 tgt_ip.w[2] = ADDR_V4MAPPED;
2609 tgt_ip.w[3] = ntohl(netaddr->type.in.s_addr);
2610 switch (rpz_type) {
2611 case DNS_RPZ_TYPE_CLIENT_IP:
2612 zbits &= have.client_ipv4;
2613 break;
2614 case DNS_RPZ_TYPE_IP:
2615 zbits &= have.ipv4;
2616 break;
2617 case DNS_RPZ_TYPE_NSIP:
2618 zbits &= have.nsipv4;
2619 break;
2620 default:
2621 UNREACHABLE();
2622 }
2623 } else if (netaddr->family == AF_INET6) {
2624 dns_rpz_cidr_key_t src_ip6;
2625
2626 /*
2627 * Given the int aligned struct in_addr member of netaddr->type
2628 * one could cast netaddr->type.in6 to dns_rpz_cidr_key_t *,
2629 * but some people object.
2630 */
2631 memmove(src_ip6.w, &netaddr->type.in6, sizeof(src_ip6.w));
2632 for (i = 0; i < 4; i++) {
2633 tgt_ip.w[i] = ntohl(src_ip6.w[i]);
2634 }
2635 switch (rpz_type) {
2636 case DNS_RPZ_TYPE_CLIENT_IP:
2637 zbits &= have.client_ipv6;
2638 break;
2639 case DNS_RPZ_TYPE_IP:
2640 zbits &= have.ipv6;
2641 break;
2642 case DNS_RPZ_TYPE_NSIP:
2643 zbits &= have.nsipv6;
2644 break;
2645 default:
2646 UNREACHABLE();
2647 }
2648 } else {
2649 return (DNS_RPZ_INVALID_NUM);
2650 }
2651
2652 if (zbits == 0) {
2653 return (DNS_RPZ_INVALID_NUM);
2654 }
2655 make_addr_set(&tgt_set, zbits, rpz_type);
2656
2657 RWLOCK(&rpzs->search_lock, isc_rwlocktype_read);
2658 result = search(rpzs, &tgt_ip, 128, &tgt_set, false, &found);
2659 if (result == ISC_R_NOTFOUND) {
2660 /*
2661 * There are no eligible zones for this IP address.
2662 */
2663 RWUNLOCK(&rpzs->search_lock, isc_rwlocktype_read);
2664 return (DNS_RPZ_INVALID_NUM);
2665 }
2666
2667 /*
2668 * Construct the trigger name for the longest matching trigger
2669 * in the first eligible zone with a match.
2670 */
2671 *prefixp = found->prefix;
2672 switch (rpz_type) {
2673 case DNS_RPZ_TYPE_CLIENT_IP:
2674 rpz_num = zbit_to_num(found->set.client_ip & tgt_set.client_ip);
2675 break;
2676 case DNS_RPZ_TYPE_IP:
2677 rpz_num = zbit_to_num(found->set.ip & tgt_set.ip);
2678 break;
2679 case DNS_RPZ_TYPE_NSIP:
2680 rpz_num = zbit_to_num(found->set.nsip & tgt_set.nsip);
2681 break;
2682 default:
2683 UNREACHABLE();
2684 }
2685 result = ip2name(&found->ip, found->prefix, dns_rootname, ip_name);
2686 RWUNLOCK(&rpzs->search_lock, isc_rwlocktype_read);
2687 if (result != ISC_R_SUCCESS) {
2688 /*
2689 * bin/tests/system/rpz/tests.sh looks for "rpz.*failed".
2690 */
2691 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RPZ,
2692 DNS_LOGMODULE_RBTDB, DNS_RPZ_ERROR_LEVEL,
2693 "rpz ip2name() failed: %s",
2694 isc_result_totext(result));
2695 return (DNS_RPZ_INVALID_NUM);
2696 }
2697 return (rpz_num);
2698 }
2699
2700 /*
2701 * Search the summary radix tree for policy zones with triggers matching
2702 * a name.
2703 */
2704 dns_rpz_zbits_t
dns_rpz_find_name(dns_rpz_zones_t * rpzs,dns_rpz_type_t rpz_type,dns_rpz_zbits_t zbits,dns_name_t * trig_name)2705 dns_rpz_find_name(dns_rpz_zones_t *rpzs, dns_rpz_type_t rpz_type,
2706 dns_rpz_zbits_t zbits, dns_name_t *trig_name) {
2707 char namebuf[DNS_NAME_FORMATSIZE];
2708 dns_rbtnode_t *nmnode;
2709 const dns_rpz_nm_data_t *nm_data;
2710 dns_rpz_zbits_t found_zbits;
2711 dns_rbtnodechain_t chain;
2712 isc_result_t result;
2713 int i;
2714
2715 if (zbits == 0) {
2716 return (0);
2717 }
2718
2719 found_zbits = 0;
2720
2721 dns_rbtnodechain_init(&chain);
2722
2723 RWLOCK(&rpzs->search_lock, isc_rwlocktype_read);
2724
2725 nmnode = NULL;
2726 result = dns_rbt_findnode(rpzs->rbt, trig_name, NULL, &nmnode, &chain,
2727 DNS_RBTFIND_EMPTYDATA, NULL, NULL);
2728
2729 switch (result) {
2730 case ISC_R_SUCCESS:
2731 nm_data = nmnode->data;
2732 if (nm_data != NULL) {
2733 if (rpz_type == DNS_RPZ_TYPE_QNAME) {
2734 found_zbits = nm_data->set.qname;
2735 } else {
2736 found_zbits = nm_data->set.ns;
2737 }
2738 }
2739 FALLTHROUGH;
2740
2741 case DNS_R_PARTIALMATCH:
2742 i = chain.level_matches;
2743 nmnode = chain.levels[chain.level_matches];
2744
2745 /*
2746 * Whenever an exact match is found by dns_rbt_findnode(),
2747 * the highest level node in the chain will not be put into
2748 * chain->levels[] array, but instead the chain->end
2749 * pointer will be adjusted to point to that node.
2750 *
2751 * Suppose we have the following entries in a rpz zone:
2752 * example.com CNAME rpz-passthru.
2753 * *.example.com CNAME rpz-passthru.
2754 *
2755 * A query for www.example.com would result in the
2756 * following chain object returned by dns_rbt_findnode():
2757 * chain->level_count = 2
2758 * chain->level_matches = 2
2759 * chain->levels[0] = .
2760 * chain->levels[1] = example.com
2761 * chain->levels[2] = NULL
2762 * chain->end = www
2763 *
2764 * Since exact matches only care for testing rpz set bits,
2765 * we need to test for rpz wild bits through iterating the
2766 * nodechain, and that includes testing the rpz wild bits
2767 * in the highest level node found. In the case of an exact
2768 * match, chain->levels[chain->level_matches] will be NULL,
2769 * to address that we must use chain->end as the start
2770 * point, then iterate over the remaining levels in the
2771 * chain.
2772 */
2773 if (nmnode == NULL) {
2774 --i;
2775 nmnode = chain.end;
2776 }
2777
2778 while (nmnode != NULL) {
2779 nm_data = nmnode->data;
2780 if (nm_data != NULL) {
2781 if (rpz_type == DNS_RPZ_TYPE_QNAME) {
2782 found_zbits |= nm_data->wild.qname;
2783 } else {
2784 found_zbits |= nm_data->wild.ns;
2785 }
2786 }
2787
2788 if (i >= 0) {
2789 nmnode = chain.levels[i];
2790 --i;
2791 } else {
2792 break;
2793 }
2794 }
2795 break;
2796
2797 case ISC_R_NOTFOUND:
2798 break;
2799
2800 default:
2801 /*
2802 * bin/tests/system/rpz/tests.sh looks for "rpz.*failed".
2803 */
2804 dns_name_format(trig_name, namebuf, sizeof(namebuf));
2805 isc_log_write(dns_lctx, DNS_LOGCATEGORY_RPZ,
2806 DNS_LOGMODULE_RBTDB, DNS_RPZ_ERROR_LEVEL,
2807 "dns_rpz_find_name(%s) failed: %s", namebuf,
2808 isc_result_totext(result));
2809 break;
2810 }
2811
2812 RWUNLOCK(&rpzs->search_lock, isc_rwlocktype_read);
2813
2814 dns_rbtnodechain_invalidate(&chain);
2815
2816 return (zbits & found_zbits);
2817 }
2818
2819 /*
2820 * Translate CNAME rdata to a QNAME response policy action.
2821 */
2822 dns_rpz_policy_t
dns_rpz_decode_cname(dns_rpz_zone_t * rpz,dns_rdataset_t * rdataset,dns_name_t * selfname)2823 dns_rpz_decode_cname(dns_rpz_zone_t *rpz, dns_rdataset_t *rdataset,
2824 dns_name_t *selfname) {
2825 dns_rdata_t rdata = DNS_RDATA_INIT;
2826 dns_rdata_cname_t cname;
2827 isc_result_t result;
2828
2829 result = dns_rdataset_first(rdataset);
2830 INSIST(result == ISC_R_SUCCESS);
2831 dns_rdataset_current(rdataset, &rdata);
2832 result = dns_rdata_tostruct(&rdata, &cname, NULL);
2833 INSIST(result == ISC_R_SUCCESS);
2834 dns_rdata_reset(&rdata);
2835
2836 /*
2837 * CNAME . means NXDOMAIN
2838 */
2839 if (dns_name_equal(&cname.cname, dns_rootname)) {
2840 return (DNS_RPZ_POLICY_NXDOMAIN);
2841 }
2842
2843 if (dns_name_iswildcard(&cname.cname)) {
2844 /*
2845 * CNAME *. means NODATA
2846 */
2847 if (dns_name_countlabels(&cname.cname) == 2) {
2848 return (DNS_RPZ_POLICY_NODATA);
2849 }
2850
2851 /*
2852 * A qname of www.evil.com and a policy of
2853 * *.evil.com CNAME *.garden.net
2854 * gives a result of
2855 * evil.com CNAME evil.com.garden.net
2856 */
2857 if (dns_name_countlabels(&cname.cname) > 2) {
2858 return (DNS_RPZ_POLICY_WILDCNAME);
2859 }
2860 }
2861
2862 /*
2863 * CNAME rpz-tcp-only. means "send truncated UDP responses."
2864 */
2865 if (dns_name_equal(&cname.cname, &rpz->tcp_only)) {
2866 return (DNS_RPZ_POLICY_TCP_ONLY);
2867 }
2868
2869 /*
2870 * CNAME rpz-drop. means "do not respond."
2871 */
2872 if (dns_name_equal(&cname.cname, &rpz->drop)) {
2873 return (DNS_RPZ_POLICY_DROP);
2874 }
2875
2876 /*
2877 * CNAME rpz-passthru. means "do not rewrite."
2878 */
2879 if (dns_name_equal(&cname.cname, &rpz->passthru)) {
2880 return (DNS_RPZ_POLICY_PASSTHRU);
2881 }
2882
2883 /*
2884 * 128.1.0.127.rpz-ip CNAME 128.1.0.0.127. is obsolete PASSTHRU
2885 */
2886 if (selfname != NULL && dns_name_equal(&cname.cname, selfname)) {
2887 return (DNS_RPZ_POLICY_PASSTHRU);
2888 }
2889
2890 /*
2891 * Any other rdata gives a response consisting of the rdata.
2892 */
2893 return (DNS_RPZ_POLICY_RECORD);
2894 }
2895