bind/lib/dns/dns64.c

/*
 * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 *
 * SPDX-License-Identifier: MPL-2.0
 *
 * This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, you can obtain one at https://mozilla.org/MPL/2.0/.
 *
 * See the COPYRIGHT file distributed with this work for additional
 * information regarding copyright ownership.
 */

#include <stdbool.h>
#include <string.h>

#include <isc/list.h>
#include <isc/mem.h>
#include <isc/netaddr.h>
#include <isc/result.h>
#include <isc/string.h>
#include <isc/util.h>

#include <dns/acl.h>
#include <dns/dns64.h>
#include <dns/rdata.h>
#include <dns/rdatalist.h>
#include <dns/rdataset.h>

struct dns_dns64 {
	unsigned char bits[16]; /*
				 * Prefix + suffix bits.
				 */
	dns_acl_t *clients;	/*
				 * Which clients get mapped
				 * addresses.
				 */
	dns_acl_t *mapped;	/*
				 * IPv4 addresses to be mapped.
				 */
	dns_acl_t *excluded;	/*
				 * IPv6 addresses that are
				 * treated as not existing.
				 */
	unsigned int prefixlen; /*
				 * Start of mapped address.
				 */
	unsigned int flags;
	isc_mem_t *mctx;
	ISC_LINK(dns_dns64_t) link;
};

void
dns_dns64_create(isc_mem_t *mctx, const isc_netaddr_t *prefix,
		 unsigned int prefixlen, const isc_netaddr_t *suffix,
		 dns_acl_t *clients, dns_acl_t *mapped, dns_acl_t *excluded,
		 unsigned int flags, dns_dns64_t **dns64p) {
	dns_dns64_t *dns64;
	unsigned int nbytes = 16;

	REQUIRE(prefix != NULL && prefix->family == AF_INET6);
	/* Legal prefix lengths from rfc6052.txt. */
	REQUIRE(prefixlen == 32 || prefixlen == 40 || prefixlen == 48 ||
		prefixlen == 56 || prefixlen == 64 || prefixlen == 96);
	REQUIRE(isc_netaddr_prefixok(prefix, prefixlen) == ISC_R_SUCCESS);
	REQUIRE(dns64p != NULL && *dns64p == NULL);

	if (suffix != NULL) {
		static const unsigned char zeros[16];
		REQUIRE(prefix->family == AF_INET6);
		nbytes = prefixlen / 8 + 4;
		/* Bits 64-71 are zeros. rfc6052.txt */
		if (prefixlen >= 32 && prefixlen <= 64) {
			nbytes++;
		}
		REQUIRE(memcmp(suffix->type.in6.s6_addr, zeros, nbytes) == 0);
	}

	dns64 = isc_mem_get(mctx, sizeof(dns_dns64_t));
	memset(dns64->bits, 0, sizeof(dns64->bits));
	memmove(dns64->bits, prefix->type.in6.s6_addr, prefixlen / 8);
	if (suffix != NULL) {
		memmove(dns64->bits + nbytes, suffix->type.in6.s6_addr + nbytes,
			16 - nbytes);
	}
	dns64->clients = NULL;
	if (clients != NULL) {
		dns_acl_attach(clients, &dns64->clients);
	}
	dns64->mapped = NULL;
	if (mapped != NULL) {
		dns_acl_attach(mapped, &dns64->mapped);
	}
	dns64->excluded = NULL;
	if (excluded != NULL) {
		dns_acl_attach(excluded, &dns64->excluded);
	}
	dns64->prefixlen = prefixlen;
	dns64->flags = flags;
	ISC_LINK_INIT(dns64, link);
	dns64->mctx = NULL;
	isc_mem_attach(mctx, &dns64->mctx);
	*dns64p = dns64;
}

void
dns_dns64_destroy(dns_dns64list_t *list, dns_dns64_t **dns64p) {
	dns_dns64_t *dns64;

	REQUIRE(dns64p != NULL && *dns64p != NULL);

	dns64 = *dns64p;
	*dns64p = NULL;

	ISC_LIST_UNLINK(*list, dns64, link);

	if (dns64->clients != NULL) {
		dns_acl_detach(&dns64->clients);
	}
	if (dns64->mapped != NULL) {
		dns_acl_detach(&dns64->mapped);
	}
	if (dns64->excluded != NULL) {
		dns_acl_detach(&dns64->excluded);
	}
	isc_mem_putanddetach(&dns64->mctx, dns64, sizeof(*dns64));
}

isc_result_t
dns_dns64_aaaafroma(const dns_dns64_t *dns64, const isc_netaddr_t *reqaddr,
		    const dns_name_t *reqsigner, dns_aclenv_t *env,
		    unsigned int flags, unsigned char *a, unsigned char *aaaa) {
	unsigned int nbytes, i;
	isc_result_t result;
	int match;

	if ((dns64->flags & DNS_DNS64_RECURSIVE_ONLY) != 0 &&
	    (flags & DNS_DNS64_RECURSIVE) == 0)
	{
		return DNS_R_DISALLOWED;
	}

	if ((dns64->flags & DNS_DNS64_BREAK_DNSSEC) == 0 &&
	    (flags & DNS_DNS64_DNSSEC) != 0)
	{
		return DNS_R_DISALLOWED;
	}

	if (dns64->clients != NULL && reqaddr != NULL) {
		result = dns_acl_match(reqaddr, reqsigner, dns64->clients, env,
				       &match, NULL);
		if (result != ISC_R_SUCCESS) {
			return result;
		}
		if (match <= 0) {
			return DNS_R_DISALLOWED;
		}
	}

	if (dns64->mapped != NULL) {
		struct in_addr ina;
		isc_netaddr_t netaddr;

		memmove(&ina.s_addr, a, 4);
		isc_netaddr_fromin(&netaddr, &ina);
		result = dns_acl_match(&netaddr, NULL, dns64->mapped, env,
				       &match, NULL);
		if (result != ISC_R_SUCCESS) {
			return result;
		}
		if (match <= 0) {
			return DNS_R_DISALLOWED;
		}
	}

	nbytes = dns64->prefixlen / 8;
	INSIST(nbytes <= 12);
	/* Copy prefix. */
	memmove(aaaa, dns64->bits, nbytes);
	/* Bits 64-71 are zeros. rfc6052.txt */
	if (nbytes == 8) {
		aaaa[nbytes++] = 0;
	}
	/* Copy mapped address. */
	for (i = 0; i < 4U; i++) {
		aaaa[nbytes++] = a[i];
		/* Bits 64-71 are zeros. rfc6052.txt */
		if (nbytes == 8) {
			aaaa[nbytes++] = 0;
		}
	}
	/* Copy suffix. */
	memmove(aaaa + nbytes, dns64->bits + nbytes, 16 - nbytes);
	return ISC_R_SUCCESS;
}

void
dns_dns64_append(dns_dns64list_t *list, dns_dns64_t *dns64) {
	ISC_LIST_APPEND(*list, dns64, link);
}

bool
dns_dns64_aaaaok(const dns_dns64_t *dns64, const isc_netaddr_t *reqaddr,
		 const dns_name_t *reqsigner, dns_aclenv_t *env,
		 unsigned int flags, dns_rdataset_t *rdataset, bool *aaaaok,
		 size_t aaaaoklen) {
	struct in6_addr in6;
	isc_netaddr_t netaddr;
	isc_result_t result;
	int match;
	bool answer = false;
	bool found = false;
	unsigned int i, ok;

	REQUIRE(rdataset != NULL);
	REQUIRE(rdataset->type == dns_rdatatype_aaaa);
	REQUIRE(rdataset->rdclass == dns_rdataclass_in);
	if (aaaaok != NULL) {
		REQUIRE(aaaaoklen == dns_rdataset_count(rdataset));
	}

	for (; dns64 != NULL; dns64 = ISC_LIST_NEXT(dns64, link)) {
		if ((dns64->flags & DNS_DNS64_RECURSIVE_ONLY) != 0 &&
		    (flags & DNS_DNS64_RECURSIVE) == 0)
		{
			continue;
		}

		if ((dns64->flags & DNS_DNS64_BREAK_DNSSEC) == 0 &&
		    (flags & DNS_DNS64_DNSSEC) != 0)
		{
			continue;
		}
		/*
		 * Work out if this dns64 structure applies to this client.
		 */
		if (dns64->clients != NULL) {
			result = dns_acl_match(reqaddr, reqsigner,
					       dns64->clients, env, &match,
					       NULL);
			if (result != ISC_R_SUCCESS) {
				continue;
			}
			if (match <= 0) {
				continue;
			}
		}

		if (!found && aaaaok != NULL) {
			for (i = 0; i < aaaaoklen; i++) {
				aaaaok[i] = false;
			}
		}
		found = true;

		/*
		 * If we are not excluding any addresses then any AAAA
		 * will do.
		 */
		if (dns64->excluded == NULL) {
			answer = true;
			if (aaaaok == NULL) {
				goto done;
			}
			for (i = 0; i < aaaaoklen; i++) {
				aaaaok[i] = true;
			}
			goto done;
		}

		i = 0;
		ok = 0;
		DNS_RDATASET_FOREACH(rdataset) {
			dns_rdata_t rdata = DNS_RDATA_INIT;
			if (aaaaok == NULL || !aaaaok[i]) {
				dns_rdataset_current(rdataset, &rdata);
				memmove(&in6.s6_addr, rdata.data, 16);
				isc_netaddr_fromin6(&netaddr, &in6);

				result = dns_acl_match(&netaddr, NULL,
						       dns64->excluded, env,
						       &match, NULL);
				if (result == ISC_R_SUCCESS && match <= 0) {
					answer = true;
					if (aaaaok == NULL) {
						goto done;
					}
					aaaaok[i] = true;
					ok++;
				}
			} else {
				ok++;
			}
			i++;
		}
		/*
		 * Are all addresses ok?
		 */
		if (aaaaok != NULL && ok == aaaaoklen) {
			goto done;
		}
	}

done:
	if (!found && aaaaok != NULL) {
		for (i = 0; i < aaaaoklen; i++) {
			aaaaok[i] = true;
		}
	}
	return found ? answer : true;
}

/*
 * Posible mapping of IPV4ONLY.ARPA A records into AAAA records
 * for valid RFC6052 prefixes.
 */
static struct {
	const unsigned char aa[16]; /* mapped version of 192.0.0.170 */
	const unsigned char ab[16]; /* mapped version of 192.0.0.171 */
	const unsigned char mask[16];
	const unsigned int plen;
} const prefixes[6] = {
	{ { 0, 0, 0, 0, 192, 0, 0, 170, 0, 0, 0, 0, 0, 0, 0, 0 },
	  { 0, 0, 0, 0, 192, 0, 0, 171, 0, 0, 0, 0, 0, 0, 0, 0 },
	  { 0, 0, 0, 0, 255, 255, 255, 255, 255, 0, 0, 0, 0, 0, 0, 0 },
	  32 },
	{ { 0, 0, 0, 0, 0, 192, 0, 0, 0, 170, 0, 0, 0, 0, 0, 0 },
	  { 0, 0, 0, 0, 0, 192, 0, 0, 0, 171, 0, 0, 0, 0, 0, 0 },
	  { 0, 0, 0, 0, 0, 255, 255, 255, 255, 255, 0, 0, 0, 0, 0, 0 },
	  40 },
	{ { 0, 0, 0, 0, 0, 0, 192, 0, 0, 0, 170, 0, 0, 0, 0, 0 },
	  { 0, 0, 0, 0, 0, 0, 192, 0, 0, 0, 171, 0, 0, 0, 0, 0 },
	  { 0, 0, 0, 0, 0, 0, 255, 255, 255, 255, 255, 0, 0, 0, 0, 0 },
	  48 },
	{ { 0, 0, 0, 0, 0, 0, 0, 192, 0, 0, 0, 170, 0, 0, 0, 0 },
	  { 0, 0, 0, 0, 0, 0, 0, 192, 0, 0, 0, 171, 0, 0, 0, 0 },
	  { 0, 0, 0, 0, 0, 0, 0, 255, 255, 255, 255, 255, 0, 0, 0, 0 },
	  56 },
	{ { 0, 0, 0, 0, 0, 0, 0, 0, 0, 192, 0, 0, 170, 0, 0, 0 },
	  { 0, 0, 0, 0, 0, 0, 0, 0, 0, 192, 0, 0, 171, 0, 0, 0 },
	  { 0, 0, 0, 0, 0, 0, 0, 0, 255, 255, 255, 255, 255, 0, 0, 0 },
	  64 },
	{ { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 192, 0, 0, 170 },
	  { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 192, 0, 0, 171 },
	  { 0, 0, 0, 0, 0, 0, 0, 0, 255, 0, 0, 0, 255, 255, 255, 255 },
	  96 }
};

static unsigned int
search(const dns_rdata_t *rd1, const dns_rdata_t *rd2, unsigned int plen) {
	unsigned int i = 0, j;
	const unsigned char *c, *m;

	/*
	 * Resume looking for another aa match?
	 */
	if (plen != 0U && rd2 == NULL) {
		while (i < 6U) {
			/* Post increment as we resume on next entry. */
			if (prefixes[i++].plen == plen) {
				break;
			}
		}
	}

	for (; i < 6U; i++) {
		j = 0;
		if (rd2 != NULL) {
			/* Find the right entry. */
			if (prefixes[i].plen != plen) {
				continue;
			}
			/* Does the prefix match? */
			while ((j * 8U) < plen) {
				if (rd1->data[j] != rd2->data[j]) {
					return 0;
				}
				j++;
			}
		}

		/* Match well known mapped addresses. */
		c = (rd2 == NULL) ? prefixes[i].aa : prefixes[i].ab;
		m = prefixes[i].mask;
		for (; j < 16U; j++) {
			if ((rd1->data[j] & m[j]) != (c[j] & m[j])) {
				break;
			}
		}
		if (j == 16U) {
			return prefixes[i].plen;
		}
		if (rd2 != NULL) {
			return 0;
		}
	}
	return 0;
}

isc_result_t
dns_dns64_findprefix(dns_rdataset_t *rdataset, isc_netprefix_t *prefix,
		     size_t *len) {
	dns_rdataset_t outer, inner;
	unsigned int oplen, iplen;
	size_t count = 0;
	struct in6_addr ina6;

	REQUIRE(prefix != NULL && len != NULL && *len != 0U);
	REQUIRE(rdataset != NULL && rdataset->type == dns_rdatatype_aaaa);

	dns_rdataset_init(&outer);
	dns_rdataset_init(&inner);
	dns_rdataset_clone(rdataset, &outer);
	dns_rdataset_clone(rdataset, &inner);

	DNS_RDATASET_FOREACH(&outer) {
		dns_rdata_t rd1 = DNS_RDATA_INIT;
		dns_rdataset_current(&outer, &rd1);
		oplen = 0;
	resume:
		/* Look for a 192.0.0.170 match. */
		oplen = search(&rd1, NULL, oplen);
		if (oplen == 0) {
			continue;
		}

		/* Look for the 192.0.0.171 match. */
		bool matched = false;
		DNS_RDATASET_FOREACH(&inner) {
			dns_rdata_t rd2 = DNS_RDATA_INIT;

			dns_rdataset_current(&inner, &rd2);
			iplen = search(&rd2, &rd1, oplen);
			if (iplen != 0) {
				matched = true;
				INSIST(iplen == oplen);
				if (count >= *len) {
					count++;
					break;
				}

				/* We have a prefix. */
				memset(ina6.s6_addr, 0, sizeof(ina6.s6_addr));
				memmove(ina6.s6_addr, rd1.data, oplen / 8);
				isc_netaddr_fromin6(&prefix[count].addr, &ina6);
				prefix[count].prefixlen = oplen;
				count++;
			}
		}
		/* Didn't find a match look for a different prefix length. */
		if (!matched) {
			goto resume;
		}
	}
	if (count == 0U) {
		return ISC_R_NOTFOUND;
	}
	if (count > *len) {
		*len = count;
		return ISC_R_NOSPACE;
	}
	*len = count;
	return ISC_R_SUCCESS;
}

isc_result_t
dns_dns64_apply(isc_mem_t *mctx, dns_dns64list_t dns64s, unsigned int count,
		dns_message_t *message, dns_aclenv_t *env, isc_sockaddr_t *peer,
		dns_name_t *reqsigner, unsigned int flags, dns_rdataset_t *a,
		dns_rdataset_t **aaaap) {
	isc_result_t result;
	dns_rdatalist_t *aaaalist = NULL;
	isc_buffer_t *buffer = NULL;
	isc_netaddr_t netaddr;

	REQUIRE(aaaap != NULL && *aaaap == NULL);
	REQUIRE(a->type == dns_rdatatype_a);

	isc_netaddr_fromsockaddr(&netaddr, peer);

	isc_buffer_allocate(mctx, &buffer, count * 16 * dns_rdataset_count(a));

	dns_message_gettemprdatalist(message, &aaaalist);
	aaaalist->rdclass = dns_rdataclass_in;
	aaaalist->type = dns_rdatatype_aaaa;

	DNS_RDATASET_FOREACH(a) {
		dns_rdata_t rdata = DNS_RDATA_INIT;
		dns_rdataset_current(a, &rdata);

		ISC_LIST_FOREACH(dns64s, dns64, link) {
			dns_rdata_t *dns64_rdata = NULL;
			isc_region_t r;

			isc_buffer_availableregion(buffer, &r);
			INSIST(r.length >= 16);
			result = dns_dns64_aaaafroma(dns64, &netaddr, reqsigner,
						     env, flags, rdata.data,
						     r.base);
			if (result != ISC_R_SUCCESS) {
				continue;
			}
			isc_buffer_add(buffer, 16);
			isc_buffer_remainingregion(buffer, &r);
			isc_buffer_forward(buffer, 16);
			dns_message_gettemprdata(message, &dns64_rdata);
			dns_rdata_fromregion(dns64_rdata, dns_rdataclass_in,
					     dns_rdatatype_aaaa, &r);
			ISC_LIST_APPEND(aaaalist->rdata, dns64_rdata, link);
		}
	}

	if (!ISC_LIST_EMPTY(aaaalist->rdata)) {
		dns_rdataset_t *aaaa = NULL;
		dns_message_gettemprdataset(message, &aaaa);
		dns_rdatalist_tordataset(aaaalist, aaaa);
		dns_message_takebuffer(message, &buffer);
		aaaa->trust = a->trust;
		*aaaap = aaaa;
		return ISC_R_SUCCESS;
	}

	/* No applicable dns64; free the resources */
	isc_buffer_free(&buffer);
	ISC_LIST_FOREACH(aaaalist->rdata, rdata, link) {
		ISC_LIST_UNLINK(aaaalist->rdata, rdata, link);
		dns_message_puttemprdata(message, &rdata);
	}
	dns_message_puttemprdatalist(message, &aaaalist);

	return ISC_R_NOMORE;
}