--- /dev/null
+/* Copyright (C) CZ.NIC, z.s.p.o. <knot-resolver@labs.nic.cz>
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ */
+/** @file
+ *
+ * Code for loading rules from some kinds of zonefile, e.g. RPZ.
+ */
+
+#include "lib/rules/api.h"
+#include "lib/rules/impl.h"
+
+#include "lib/log.h"
+#include "lib/utils.h"
+#include "lib/generic/trie.h"
+
+#include <libzscanner/scanner.h>
+
+/// State used in zs_scanner_t::process.data
+typedef struct {
+ const struct kr_rule_zonefile_config *c; /// owned by the caller
+ trie_t *rrs; /// map: local_data_key() -> knot_rrset_t where we only use .ttl and .rrs
+ knot_mm_t *pool; /// used for everything inside s_data_t (unless noted otherwise)
+
+ // state data for owner_relativize()
+ const knot_dname_t *origin_soa;
+ bool seen_record, warned_soa, warned_bailiwick;
+} s_data_t;
+
+//TODO: logs should better include file name and position within
+
+
+/// Process scanned RR of other types, gather RRsets in a map.
+static void rr_scan2trie(zs_scanner_t *s)
+{
+ s_data_t *s_data = s->process.data;
+ uint8_t key_data[KEY_MAXLEN];
+ knot_rrset_t rrs_for_key = {
+ .owner = s->r_owner,
+ .type = s->r_type,
+ };
+ knot_db_val_t key = local_data_key(&rrs_for_key, key_data, RULESET_DEFAULT);
+ trie_val_t *rr_p = trie_get_ins(s_data->rrs, key.data, key.len);
+ knot_rrset_t *rr;
+ if (*rr_p) {
+ rr = *rr_p;
+ if (s->r_ttl < rr->ttl)
+ rr->ttl = s->r_ttl; // we could also warn here
+ } else {
+ rr = *rr_p = mm_alloc(s_data->pool, sizeof(*rr));
+ knot_rrset_init(rr, NULL, s->r_type, KNOT_CLASS_IN, s->r_ttl);
+ // we don't ^^ need owner so save allocation
+ }
+ knot_rrset_add_rdata(rr, s->r_data, s->r_data_length, s_data->pool);
+}
+/// Process an RRset of other types into a rule
+static int rr_trie2rule(const char *key_data, uint32_t key_len, trie_val_t *rr_p, void *config)
+{
+ const knot_db_val_t key = { .data = (void *)key_data, .len = key_len };
+ const knot_rrset_t *rr = *rr_p;
+ const struct kr_rule_zonefile_config *c = config;
+ return local_data_ins(key, rr, NULL, c->tags);
+ //TODO: check error logging path here (LMDB)
+}
+
+/// Process a scanned CNAME RR into a rule
+static void cname_scan2rule(zs_scanner_t *s)
+{
+ s_data_t *s_data = s->process.data;
+ const struct kr_rule_zonefile_config *c = s_data->c;
+
+ const char *last_label = NULL; // last label of the CNAME
+ for (knot_dname_t *dn = s->r_data; *dn != '\0'; dn += 1 + *dn)
+ last_label = (const char *)dn + 1;
+ if (last_label && strncmp(last_label, "rpz-", 4) == 0) {
+ kr_log_warning(RULES, "skipping unsupported CNAME target .%s\n", last_label);
+ return;
+ }
+ int ret = 0;
+ if (s->r_data[0] == 0) { // "CNAME ." i.e. NXDOMAIN
+ const knot_dname_t *apex = s->r_owner;
+ if (knot_dname_is_wildcard(apex))
+ apex += 2;
+ // RPZ_COMPAT: we NXDOMAIN the whole subtree regardless of being wildcard.
+ // Exact RPZ semantics would be hard here, it makes more sense
+ // to apply also to a subtree, and corresponding wildcard rule
+ // usually accompanies this rule anyway.
+ ret = insert_trivial_zone(VAL_ZLAT_NXDOMAIN, s->r_ttl, apex, c->tags);
+ } else if (knot_dname_is_wildcard(s->r_data) && s->r_data[2] == 0) {
+ // "CNAME *." -> NODATA
+ knot_dname_t *apex = s->r_owner;
+ if (knot_dname_is_wildcard(apex)) {
+ apex += 2;
+ ret = insert_trivial_zone(VAL_ZLAT_NODATA, s->r_ttl, apex, c->tags);
+ } else { // using special kr_rule_ semantics of empty CNAME RRset
+ knot_rrset_t rrs;
+ knot_rrset_init(&rrs, apex, KNOT_RRTYPE_CNAME,
+ KNOT_CLASS_IN, s->r_ttl);
+ ret = kr_rule_local_data_ins(&rrs, NULL, c->tags);
+ }
+ } else {
+ knot_dname_t *target = s->r_owner;
+ knot_rrset_t rrs;
+ knot_rrset_init(&rrs, target, KNOT_RRTYPE_CNAME, KNOT_CLASS_IN, s->r_ttl);
+ // TODO: implement wildcard expansion for target
+ ret = knot_rrset_add_rdata(&rrs, s->r_data, s->r_data_length, NULL);
+ if (!ret) ret = kr_rule_local_data_ins(&rrs, NULL, c->tags);
+ knot_rdataset_clear(&rrs.rrs, NULL);
+ }
+ if (ret)
+ kr_log_warning(RULES, "failure code %d\n", ret);
+}
+
+/// Relativize s->r_owner if suitable. (Also react to SOA.) Return false to skip RR.
+static bool owner_relativize(zs_scanner_t *s)
+{
+ s_data_t *d = s->process.data;
+ if (!d->c->is_rpz)
+ return true;
+
+ // SOA determines the zone apex, but lots of error/warn cases
+ if (s->r_type == KNOT_RRTYPE_SOA) {
+ if (d->seen_record && !knot_dname_is_equal(s->zone_origin, s->r_owner)) {
+ // We most likely inserted some rules wrong already, so abort.
+ kr_log_error(RULES,
+ "SOA encountered late, with unexpected owner; aborting\n");
+ s->state = ZS_STATE_STOP;
+ return false;
+ }
+ if (!d->warned_soa && (d->seen_record || d->origin_soa)) {
+ d->warned_soa = true;
+ kr_log_warning(RULES,
+ "SOA should come as the first record in a RPZ\n");
+ }
+ if (!d->origin_soa) // sticking with the first encountered SOA
+ d->origin_soa = knot_dname_copy(s->r_owner, d->pool);
+ }
+ d->seen_record = true;
+
+ // $ORIGIN as fallback if SOA is missing
+ const knot_dname_t *apex = d->origin_soa;
+ if (!apex)
+ apex = s->zone_origin;
+
+ const int labels = knot_dname_in_bailiwick(s->r_owner, apex);
+ if (labels < 0) {
+ if (!d->warned_bailiwick) {
+ d->warned_bailiwick = true;
+ KR_DNAME_GET_STR(owner_str, s->r_owner);
+ kr_log_warning(RULES,
+ "skipping out-of-zone record(s); first name %s\n",
+ owner_str);
+ }
+ return false;
+ }
+ const int len = knot_dname_prefixlen(s->r_owner, labels, NULL);
+ s->r_owner[len] = '\0'; // not very nice but safe at this point
+ return true;
+}
+
+/// Process a single scanned RR
+static void process_record(zs_scanner_t *s)
+{
+ s_data_t *s_data = s->process.data;
+ if (s->r_class != KNOT_CLASS_IN) {
+ kr_log_warning(RULES, "skipping unsupported RR class\n");
+ return;
+ }
+
+ // inspect the owner name
+ const bool ok = knot_dname_size(s->r_owner) == strlen((const char *)s->r_owner) + 1;
+ if (!ok) {
+ kr_log_warning(RULES, "skipping zero-containing RR owner name\n");
+ return;
+ }
+ // .rpz-* owner; sounds OK to warn and skip even for non-RPZ input
+ // TODO: support "rpz-client-ip"
+ const char *last_label = NULL;
+ for (knot_dname_t *dn = s->r_owner; *dn != '\0'; dn += 1 + *dn)
+ last_label = (const char *)dn + 1;
+ if (last_label && strncmp(last_label, "rpz-", 4) == 0) {
+ kr_log_warning(RULES, "skipping unsupported RR owner .%s\n", last_label);
+ return;
+ }
+ if (!owner_relativize(s))
+ return;
+
+ // RR type: mainly deal with various unsupported cases
+ switch (s->r_type) {
+ case KNOT_RRTYPE_RRSIG:
+ case KNOT_RRTYPE_NSEC:
+ case KNOT_RRTYPE_NSEC3:
+ case KNOT_RRTYPE_DNSKEY:
+ case KNOT_RRTYPE_DS:
+ unsupported_type:
+ (void)0; // C can't have a variable definition following a label
+ KR_RRTYPE_GET_STR(type_str, s->r_type);
+ kr_log_warning(RULES, "skipping unsupported RR type %s\n", type_str);
+ return;
+ }
+ if (knot_rrtype_is_metatype(s->r_type))
+ goto unsupported_type;
+ if (s_data->c->is_rpz && s->r_type == KNOT_RRTYPE_CNAME) {
+ cname_scan2rule(s);
+ return;
+ }
+ // Records in zonefile format generally may not be grouped by name and RR type,
+ // so we accumulate RR sets in a trie and push them as rules at the end.
+ rr_scan2trie(s);
+}
+
+int kr_rule_zonefile(const struct kr_rule_zonefile_config *c)
+{
+ kr_require(c && the_rules);
+ zs_scanner_t s_storage, *s = &s_storage;
+ /* zs_init(), zs_set_input_file(), zs_set_processing() returns -1 in case of error,
+ * so don't print error code as it meaningless. */
+ uint32_t ttl = c->ttl ? c->ttl : RULE_TTL_DEFAULT; // 0 would be nonsense
+ int ret = zs_init(s, NULL, KNOT_CLASS_IN, ttl);
+ if (ret) {
+ kr_log_error(RULES, "error initializing zone scanner instance, error: %i (%s)\n",
+ s->error.code, zs_strerror(s->error.code));
+ return ret;
+ }
+
+ s_data_t s_data = { 0 };
+ s_data.c = c;
+ s_data.pool = mm_ctx_mempool2(64 * 1024);
+ s_data.rrs = trie_create(s_data.pool);
+ ret = zs_set_processing(s, process_record, NULL, &s_data);
+ if (kr_fails_assert(ret == 0))
+ goto finish;
+
+ // set the input to parse
+ if (c->filename) {
+ kr_assert(!c->input_str && !c->input_len);
+ ret = zs_set_input_file(s, c->filename);
+ if (ret) {
+ kr_log_error(RULES, "error opening zone file `%s`, error: %i (%s)\n",
+ c->filename, s->error.code, zs_strerror(s->error.code));
+ goto finish;
+ }
+ } else {
+ if (kr_fails_assert(c->input_str)) {
+ ret = kr_error(EINVAL);
+ } else {
+ size_t len = c->input_len ? c->input_len : strlen(c->input_str);
+ ret = zs_set_input_string(s, c->input_str, len);
+ }
+ if (ret) {
+ kr_log_error(RULES, "error %d when opening input with rules\n", ret);
+ goto finish;
+ }
+ }
+
+ /* TODO: disable $INCLUDE? In future RPZones could come from wherever.
+ * Automatic processing will do $INCLUDE, so perhaps use a manual loop instead?
+ */
+ ret = zs_parse_all(s);
+ if (ret != 0) {
+ kr_log_error(RULES, "error parsing zone file `%s`, error %i: %s\n",
+ c->filename, s->error.code, zs_strerror(s->error.code));
+ } else if (s->state == ZS_STATE_STOP) { // interrupted inside
+ ret = kr_error(EINVAL);
+ } else { // no fatal error so far
+ ret = trie_apply_with_key(s_data.rrs, rr_trie2rule, (void *)c);
+ }
+finish:
+ zs_deinit(s);
+ mm_ctx_delete(s_data.pool); // this also deletes whole s_data.rrs
+ return ret;
+}
+
projects / thirdparty / knot-resolver.git / commitdiff
