summaryrefslogtreecommitdiffstats
path: root/modules/cookies/cookiemonster.c
blob: fa1b869eb2668221c419c61118fdb344de54be3c (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
/*  Copyright (C) 2016-2017 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
 *  SPDX-License-Identifier: GPL-3.0-or-later
 */

#include <assert.h>
#include <ccan/json/json.h>
#include <libknot/db/db_lmdb.h>
#include <libknot/error.h>
#include <libknot/mm_ctx.h>
#include <libknot/rrtype/opt-cookie.h>
#include <libknot/version.h>
#include <stdlib.h>
#include <string.h>

#include "lib/cookies/alg_containers.h"
#include "lib/cookies/control.h"
#include "lib/cookies/helper.h"
#include "lib/cookies/lru_cache.h"
#include "lib/cookies/nonce.h"
#include "lib/resolve.h"
#include "lib/rplan.h"
#include "modules/cookies/cookiemonster.h"

#define VERBOSE_MSG(qry, ...) QRVERBOSE(qry, "cookies", __VA_ARGS__)

/**
 * Obtain address from query/response context if if can be obtained.
 * @param req resolution context
 * @return pointer to where the server socket address, NULL if not provided within context
 */
static const struct sockaddr *passed_server_sockaddr(const struct kr_request *req)
{
	if (!req || !req->upstream.addr) {
		return NULL;
	}

	if (req->upstream.addr->sa_family == AF_INET ||
	    req->upstream.addr->sa_family == AF_INET6) {
		return req->upstream.addr;
	}

	return NULL;
}

/**
 * Obtain pointer to server socket address that matches obtained cookie.
 * @param srvr_sa server socket address
 * @param cc         client cookie from the response
 * @param cc_len     client cookie size
 * @param clnt_sett  client cookie settings structure
 * @retval  1 if cookie matches current settings
 * @retval  0 if cookie matches recent settings
 * @return -1 if cookie does not match
 * @return -2 on any error
 */
static int srvr_sockaddr_cc_check(const struct sockaddr *srvr_sa,
                                  const uint8_t *cc, uint16_t cc_len,
                                  const struct kr_cookie_settings *clnt_sett)
{
	assert(cc && cc_len > 0 && clnt_sett);

	if (!srvr_sa) {
		return -2;
	}

	assert(clnt_sett->current.secr);

	/* The address must correspond with the client cookie. */
	struct knot_cc_input input = {
		.clnt_sockaddr = NULL, /* Not supported yet. */
		.srvr_sockaddr = srvr_sa,
		.secret_data = clnt_sett->current.secr->data,
		.secret_len = clnt_sett->current.secr->size
	};

	const struct knot_cc_alg *cc_alg = kr_cc_alg_get(clnt_sett->current.alg_id);
	if (!cc_alg) {
		return -2;
	}
	int comp_ret = -1; /* Cookie does not match. */
	int ret = knot_cc_check(cc, cc_len, &input, cc_alg);
	if (ret == KNOT_EOK) {
		comp_ret = 1;
	} else {
		cc_alg = kr_cc_alg_get(clnt_sett->recent.alg_id);
		if (clnt_sett->recent.secr && cc_alg) {
			input.secret_data = clnt_sett->recent.secr->data;
			input.secret_len = clnt_sett->recent.secr->size;
			ret = knot_cc_check(cc, cc_len, &input, cc_alg);
			if (ret == KNOT_EOK) {
				comp_ret = 0;
			}
		}
	}

	return comp_ret;
}

/**
 * Obtain cookie from cache.
 * @note Cookies with invalid length are ignored.
 * @param cache cache context
 * @param sa key value
 * @param cookie_opt entire EDNS cookie option (including header)
 * @return true if a cookie exists in cache
 */
static const uint8_t *get_cookie_opt(kr_cookie_lru_t *cache,
                                     const struct sockaddr *sa)
{
	assert(cache && sa);

	const uint8_t *cached_cookie_opt = kr_cookie_lru_get(cache, sa);
	if (!cached_cookie_opt) {
		return NULL;
	}

	size_t cookie_opt_size = KNOT_EDNS_OPTION_HDRLEN +
	                         knot_edns_opt_get_length(cached_cookie_opt);
	if (cookie_opt_size > KR_COOKIE_OPT_MAX_LEN) {
		return NULL;
	}

	return cached_cookie_opt;
}

/**
 * Check whether the supplied cookie is cached under the given key.
 * @param cache cache context
 * @param sa key value
 * @param cookie_opt cookie option to search for
 */
static bool is_cookie_cached(kr_cookie_lru_t *cache, const struct sockaddr *sa,
                             const uint8_t *cookie_opt)
{
	assert(cache && sa && cookie_opt);

	const uint8_t *cached_opt = get_cookie_opt(cache, sa);
	if (!cached_opt) {
		return false;
	}

	uint16_t cookie_opt_size = KNOT_EDNS_OPTION_HDRLEN +
	                           knot_edns_opt_get_length(cookie_opt);
	uint16_t cached_opt_size = KNOT_EDNS_OPTION_HDRLEN +
	                           knot_edns_opt_get_length(cached_opt);

	if (cookie_opt_size != cached_opt_size) {
		return false;
	}

	return memcmp(cookie_opt, cached_opt, cookie_opt_size) == 0;
}

/**
 * Check cookie content and store it to cache.
 */
static bool check_cookie_content_and_cache(const struct kr_cookie_settings *clnt_sett,
                                           struct kr_request *req,
                                           uint8_t *pkt_cookie_opt,
                                           kr_cookie_lru_t *cache)
{
	assert(clnt_sett && req && pkt_cookie_opt && cache);

	const uint8_t *pkt_cookie_data = knot_edns_opt_get_data(pkt_cookie_opt);
	uint16_t pkt_cookie_len = knot_edns_opt_get_length(pkt_cookie_opt);
	/* knot_edns_opt_cookie_parse() returns error on invalid data. */

	const uint8_t *pkt_cc = NULL, *pkt_sc = NULL;
	uint16_t pkt_cc_len = 0, pkt_sc_len = 0;

	int ret = knot_edns_opt_cookie_parse(pkt_cookie_data, pkt_cookie_len,
	                                     &pkt_cc, &pkt_cc_len,
	                                     &pkt_sc, &pkt_sc_len);
	if (ret != KNOT_EOK || !pkt_sc) {
		VERBOSE_MSG(NULL, "%s\n",
		          "got malformed DNS cookie or server cookie missing");
		return false;
	}
	assert(pkt_cc_len == KNOT_OPT_COOKIE_CLNT);

	/* Check server address against received client cookie. */
	const struct sockaddr *srvr_sockaddr = passed_server_sockaddr(req);
	ret = srvr_sockaddr_cc_check(srvr_sockaddr, pkt_cc, pkt_cc_len,
	                             clnt_sett);
	if (ret < 0) {
		VERBOSE_MSG(NULL, "%s\n", "could not match received cookie");
		return false;
	}
	assert(srvr_sockaddr);

	/* Don't cache received cookies that don't match the current secret. */
	if ((ret == 1) &&
	    !is_cookie_cached(cache, srvr_sockaddr, pkt_cookie_opt)) {
		ret = kr_cookie_lru_set(cache, srvr_sockaddr, pkt_cookie_opt);
		if (ret != kr_ok()) {
			VERBOSE_MSG(NULL, "%s\n", "failed caching cookie");
		} else {
			VERBOSE_MSG(NULL, "%s\n", "cookie cached");
		}
	}

	return true;
}

/** Process incoming response. */
int check_response(kr_layer_t *ctx, knot_pkt_t *pkt)
{
	struct kr_request *req = ctx->req;
	struct kr_query *qry = req->current_query;
	struct kr_cookie_ctx *cookie_ctx = &req->ctx->cookie_ctx;

	if (ctx->state & (KR_STATE_DONE | KR_STATE_FAIL)) {
		return ctx->state;
	}

	if (!cookie_ctx->clnt.enabled || (qry->flags.TCP)) {
		return ctx->state;
	}

	/* Obtain cookie if present in response. Don't check actual content. */
	uint8_t *pkt_cookie_opt = NULL;
	if (knot_pkt_has_edns(pkt)) {
		pkt_cookie_opt = knot_edns_get_option(pkt->opt_rr,
		                                      KNOT_EDNS_OPTION_COOKIE);
	}

	kr_cookie_lru_t *cookie_cache = req->ctx->cache_cookie;

	const struct sockaddr *srvr_sockaddr = passed_server_sockaddr(req);

	if (!pkt_cookie_opt && srvr_sockaddr &&
	    get_cookie_opt(cookie_cache, srvr_sockaddr)) {
		/* We haven't received any cookies although we should. */
		VERBOSE_MSG(NULL, "%s\n",
		          "expected to receive a cookie but none received");
		return KR_STATE_FAIL;
	}

	if (!pkt_cookie_opt) {
		/* Don't do anything if no cookies expected and received. */
		return ctx->state;
	}

	if (!check_cookie_content_and_cache(&cookie_ctx->clnt, req,
	                                    pkt_cookie_opt, cookie_cache)) {
		return KR_STATE_FAIL;
	}

	uint16_t rcode = knot_pkt_ext_rcode(pkt);
	if (rcode == KNOT_RCODE_BADCOOKIE) {
		struct kr_query *next = NULL;
		if (!(qry->flags.BADCOOKIE_AGAIN)) {
			/* Received first BADCOOKIE, regenerate query. */
			next = kr_rplan_push(&req->rplan, qry->parent,
			                     qry->sname,  qry->sclass,
			                     qry->stype);
		}

		if (next) {
			VERBOSE_MSG(NULL, "%s\n", "BADCOOKIE querying again");
			qry->flags.BADCOOKIE_AGAIN = true;
		} else {
			/*
			 * Either the planning of the second request failed or
			 * BADCOOKIE received for the second time.
			 *
			 * RFC7873 5.3 says that TCP should be used. Currently
			 * we always expect that the server doesn't support TCP.
			 */
			qry->flags.BADCOOKIE_AGAIN = false;
			return KR_STATE_FAIL;
		}

		return KR_STATE_CONSUME;
	}

	return ctx->state;
}

static inline uint8_t *req_cookie_option(struct kr_request *req)
{
	if (!req || !req->qsource.opt) {
		return NULL;
	}

	return knot_edns_get_option(req->qsource.opt, KNOT_EDNS_OPTION_COOKIE);
}

/**
 * @brief Returns resolver state and sets answer RCODE on missing or invalid
 *        server cookie.
 *
 * @note Caller should exit when only KR_STATE_FAIL is returned.
 *
 * @param state            original resolver state
 * @param sc_present       true if server cookie is present
 * @param ignore_badcookie true if bad cookies should be treated as good ones
 * @param req              request context
 * @return new resolver state
 */
static int invalid_sc_status(int state, bool sc_present, bool ignore_badcookie,
                             const struct kr_request *req, knot_pkt_t *answer)
{
	assert(req && answer);

	const knot_pkt_t *pkt = req->qsource.packet;

	if (!pkt) {
		return KR_STATE_FAIL;
	}

	if (knot_wire_get_qdcount(pkt->wire) == 0) {
		/* RFC7873 5.4 */
		state = KR_STATE_DONE;
		if (sc_present) {
			kr_pkt_set_ext_rcode(answer, KNOT_RCODE_BADCOOKIE);
			state |= KR_STATE_FAIL;
		}
	} else if (!ignore_badcookie) {
		/* Generate BADCOOKIE response. */
		VERBOSE_MSG(NULL, "%s\n",
		          !sc_present ? "request is missing server cookie" :
		                        "request has invalid server cookie");
		if (!knot_pkt_has_edns(answer)) {
			VERBOSE_MSG(NULL, "%s\n",
			          "missing EDNS section in prepared answer");
			/* Caller should exit on this (and only this) state. */
			return KR_STATE_FAIL;
		}
		kr_pkt_set_ext_rcode(answer, KNOT_RCODE_BADCOOKIE);
		state = KR_STATE_FAIL | KR_STATE_DONE;
	}

	return state;
}

int check_request(kr_layer_t *ctx)
{
	struct kr_request *req = ctx->req;
	struct kr_cookie_settings *srvr_sett = &req->ctx->cookie_ctx.srvr;

	if (!srvr_sett->enabled) {
		return ctx->state;
	}

	knot_pkt_t *answer = req->answer; // FIXME: see kr_request_ensure_answer()

	if (ctx->state & (KR_STATE_DONE | KR_STATE_FAIL)) {
		return ctx->state;
	}

	if (!srvr_sett->enabled) {
		if (knot_pkt_has_edns(answer)) {
			/* Delete any cookies. */
			knot_edns_remove_options(answer->opt_rr,
			                         KNOT_EDNS_OPTION_COOKIE);
		}
		return ctx->state;
	}

	uint8_t *req_cookie_opt = req_cookie_option(req);
	if (!req_cookie_opt) {
		return ctx->state; /* Don't do anything without cookies. */
	}

	struct knot_dns_cookies cookies;
	memset(&cookies, 0, sizeof(cookies));
	int ret = kr_parse_cookie_opt(req_cookie_opt, &cookies);
	if (ret != kr_ok()) {
		/* FORMERR -- malformed cookies. */
		VERBOSE_MSG(NULL, "%s\n", "request with malformed cookie");
		knot_wire_set_rcode(answer->wire, KNOT_RCODE_FORMERR);
		return KR_STATE_FAIL | KR_STATE_DONE;
	}

	/*
	 * RFC7873 5.2.3 and 5.2.4 suggest that queries with invalid or
	 * missing server cookies can be treated like normal.
	 * Right now bad cookies are always ignored (i.e. treated as valid).
	 */
	bool ignore_badcookie = true;

	const struct knot_sc_alg *current_sc_alg = kr_sc_alg_get(srvr_sett->current.alg_id);

	if (!req->qsource.addr || !srvr_sett->current.secr || !current_sc_alg) {
		VERBOSE_MSG(NULL, "%s\n", "missing valid server cookie context");
		return KR_STATE_FAIL;
	}

	int return_state = ctx->state;

	struct knot_sc_private srvr_data = {
		.clnt_sockaddr = req->qsource.addr,
		.secret_data = srvr_sett->current.secr->data,
		.secret_len = srvr_sett->current.secr->size
	};

	struct knot_sc_input sc_input = {
		.cc = cookies.cc,
		.cc_len = cookies.cc_len,
		/* Don't set nonce here. */
		.srvr_data = &srvr_data
	};

	struct kr_nonce_input nonce = {
		.rand = kr_rand_bytes(sizeof(nonce.rand)),
		.time = req->current_query->timestamp.tv_sec
	};

	if (!cookies.sc) {
		/* Request has no server cookie. */
		return_state = invalid_sc_status(return_state, false,
		                                 ignore_badcookie, req, answer);
		if (return_state & KR_STATE_FAIL) {
			return return_state;
		}
		goto answer_add_cookies;
	}

	/* Check server cookie obtained in request. */

	ret = knot_sc_check(KR_NONCE_LEN, &cookies, &srvr_data, current_sc_alg);
	if (ret == KNOT_EINVAL && srvr_sett->recent.secr) {
		const struct knot_sc_alg *recent_sc_alg = kr_sc_alg_get(srvr_sett->recent.alg_id);
		if (recent_sc_alg) {
			/* Try recent algorithm. */
			struct knot_sc_private recent_srvr_data = {
				.clnt_sockaddr = req->qsource.addr,
				.secret_data = srvr_sett->recent.secr->data,
				.secret_len = srvr_sett->recent.secr->size
			};
			ret = knot_sc_check(KR_NONCE_LEN, &cookies,
			                    &recent_srvr_data, recent_sc_alg);
		}
	}
	if (ret != KNOT_EOK) {
		/* Invalid server cookie. */
		return_state = invalid_sc_status(return_state, true,
		                                 ignore_badcookie, req, answer);
		if (return_state & KR_STATE_FAIL) {
			return return_state;
		}
		goto answer_add_cookies;
	}

	/* Server cookie is OK. */

answer_add_cookies:
	/* Add server cookie into response. */
	ret = kr_answer_write_cookie(&sc_input, &nonce, current_sc_alg, answer);
	if (ret != kr_ok()) {
		return_state = KR_STATE_FAIL;
	}
	return return_state;
}

#undef VERBOSE_MSG