xref: /freebsd/contrib/unbound/services/localzone.c (revision ec0ea6efa1ad229d75c394c1a9b9cac33af2b1d3)
1 /*
2  * services/localzone.c - local zones authority service.
3  *
4  * Copyright (c) 2007, NLnet Labs. All rights reserved.
5  *
6  * This software is open source.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  *
12  * Redistributions of source code must retain the above copyright notice,
13  * this list of conditions and the following disclaimer.
14  *
15  * Redistributions in binary form must reproduce the above copyright notice,
16  * this list of conditions and the following disclaimer in the documentation
17  * and/or other materials provided with the distribution.
18  *
19  * Neither the name of the NLNET LABS nor the names of its contributors may
20  * be used to endorse or promote products derived from this software without
21  * specific prior written permission.
22  *
23  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
24  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
25  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
26  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
27  * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
28  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
29  * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
30  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
31  * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
32  * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
33  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
34  */
35 
36 /**
37  * \file
38  *
39  * This file contains functions to enable local zone authority service.
40  */
41 #include "config.h"
42 #include "services/localzone.h"
43 #include "sldns/str2wire.h"
44 #include "util/regional.h"
45 #include "util/config_file.h"
46 #include "util/data/dname.h"
47 #include "util/data/packed_rrset.h"
48 #include "util/data/msgencode.h"
49 #include "util/net_help.h"
50 #include "util/netevent.h"
51 #include "util/data/msgreply.h"
52 #include "util/data/msgparse.h"
53 #include "util/as112.h"
54 
55 /* maximum RRs in an RRset, to cap possible 'endless' list RRs.
56  * with 16 bytes for an A record, a 64K packet has about 4000 max */
57 #define LOCALZONE_RRSET_COUNT_MAX 4096
58 
59 struct local_zones*
60 local_zones_create(void)
61 {
62 	struct local_zones* zones = (struct local_zones*)calloc(1,
63 		sizeof(*zones));
64 	if(!zones)
65 		return NULL;
66 	rbtree_init(&zones->ztree, &local_zone_cmp);
67 	lock_rw_init(&zones->lock);
68 	lock_protect(&zones->lock, &zones->ztree, sizeof(zones->ztree));
69 	/* also lock protects the rbnode's in struct local_zone */
70 	return zones;
71 }
72 
73 /** helper traverse to delete zones */
74 static void
75 lzdel(rbnode_type* n, void* ATTR_UNUSED(arg))
76 {
77 	struct local_zone* z = (struct local_zone*)n->key;
78 	local_zone_delete(z);
79 }
80 
81 void
82 local_zones_delete(struct local_zones* zones)
83 {
84 	if(!zones)
85 		return;
86 	lock_rw_destroy(&zones->lock);
87 	/* walk through zones and delete them all */
88 	traverse_postorder(&zones->ztree, lzdel, NULL);
89 	free(zones);
90 }
91 
92 void
93 local_zone_delete(struct local_zone* z)
94 {
95 	if(!z)
96 		return;
97 	lock_rw_destroy(&z->lock);
98 	regional_destroy(z->region);
99 	free(z->name);
100 	free(z->taglist);
101 	free(z);
102 }
103 
104 int
105 local_zone_cmp(const void* z1, const void* z2)
106 {
107 	/* first sort on class, so that hierarchy can be maintained within
108 	 * a class */
109 	struct local_zone* a = (struct local_zone*)z1;
110 	struct local_zone* b = (struct local_zone*)z2;
111 	int m;
112 	if(a->dclass != b->dclass) {
113 		if(a->dclass < b->dclass)
114 			return -1;
115 		return 1;
116 	}
117 	return dname_lab_cmp(a->name, a->namelabs, b->name, b->namelabs, &m);
118 }
119 
120 int
121 local_data_cmp(const void* d1, const void* d2)
122 {
123 	struct local_data* a = (struct local_data*)d1;
124 	struct local_data* b = (struct local_data*)d2;
125 	int m;
126 	return dname_canon_lab_cmp(a->name, a->namelabs, b->name,
127 		b->namelabs, &m);
128 }
129 
130 /* form wireformat from text format domain name */
131 int
132 parse_dname(const char* str, uint8_t** res, size_t* len, int* labs)
133 {
134 	*res = sldns_str2wire_dname(str, len);
135 	*labs = 0;
136 	if(!*res) {
137 		log_err("cannot parse name %s", str);
138 		return 0;
139 	}
140 	*labs = dname_count_size_labels(*res, len);
141 	return 1;
142 }
143 
144 /** create a new localzone */
145 static struct local_zone*
146 local_zone_create(uint8_t* nm, size_t len, int labs,
147 	enum localzone_type t, uint16_t dclass)
148 {
149 	struct local_zone* z = (struct local_zone*)calloc(1, sizeof(*z));
150 	if(!z) {
151 		return NULL;
152 	}
153 	z->node.key = z;
154 	z->dclass = dclass;
155 	z->type = t;
156 	z->name = nm;
157 	z->namelen = len;
158 	z->namelabs = labs;
159 	lock_rw_init(&z->lock);
160 	z->region = regional_create_nochunk(sizeof(struct regional));
161 	if(!z->region) {
162 		free(z);
163 		return NULL;
164 	}
165 	rbtree_init(&z->data, &local_data_cmp);
166 	lock_protect(&z->lock, &z->parent, sizeof(*z)-sizeof(rbnode_type));
167 	/* also the zones->lock protects node, parent, name*, class */
168 	return z;
169 }
170 
171 /** enter a new zone with allocated dname returns with WRlock */
172 static struct local_zone*
173 lz_enter_zone_dname(struct local_zones* zones, uint8_t* nm, size_t len,
174 	int labs, enum localzone_type t, uint16_t c)
175 {
176 	struct local_zone* z = local_zone_create(nm, len, labs, t, c);
177 	if(!z) {
178 		free(nm);
179 		log_err("out of memory");
180 		return NULL;
181 	}
182 
183 	/* add to rbtree */
184 	lock_rw_wrlock(&zones->lock);
185 	lock_rw_wrlock(&z->lock);
186 	if(!rbtree_insert(&zones->ztree, &z->node)) {
187 		struct local_zone* oldz;
188 		char str[256];
189 		dname_str(nm, str);
190 		log_warn("duplicate local-zone %s", str);
191 		lock_rw_unlock(&z->lock);
192 		/* save zone name locally before deallocation,
193 		 * otherwise, nm is gone if we zone_delete now. */
194 		oldz = z;
195 		/* find the correct zone, so not an error for duplicate */
196 		z = local_zones_find(zones, nm, len, labs, c);
197 		lock_rw_wrlock(&z->lock);
198 		lock_rw_unlock(&zones->lock);
199 		local_zone_delete(oldz);
200 		return z;
201 	}
202 	lock_rw_unlock(&zones->lock);
203 	return z;
204 }
205 
206 /** enter a new zone */
207 static struct local_zone*
208 lz_enter_zone(struct local_zones* zones, const char* name, const char* type,
209 	uint16_t dclass)
210 {
211 	struct local_zone* z;
212 	enum localzone_type t;
213 	uint8_t* nm;
214 	size_t len;
215 	int labs;
216 	if(!parse_dname(name, &nm, &len, &labs)) {
217 		log_err("bad zone name %s %s", name, type);
218 		return NULL;
219 	}
220 	if(!local_zone_str2type(type, &t)) {
221 		log_err("bad lz_enter_zone type %s %s", name, type);
222 		free(nm);
223 		return NULL;
224 	}
225 	if(!(z=lz_enter_zone_dname(zones, nm, len, labs, t, dclass))) {
226 		log_err("could not enter zone %s %s", name, type);
227 		return NULL;
228 	}
229 	return z;
230 }
231 
232 int
233 rrstr_get_rr_content(const char* str, uint8_t** nm, uint16_t* type,
234 	uint16_t* dclass, time_t* ttl, uint8_t* rr, size_t len,
235 	uint8_t** rdata, size_t* rdata_len)
236 {
237 	size_t dname_len = 0;
238 	int e = sldns_str2wire_rr_buf(str, rr, &len, &dname_len, 3600,
239 		NULL, 0, NULL, 0);
240 	if(e) {
241 		log_err("error parsing local-data at %d: '%s': %s",
242 			LDNS_WIREPARSE_OFFSET(e), str,
243 			sldns_get_errorstr_parse(e));
244 		return 0;
245 	}
246 	*nm = memdup(rr, dname_len);
247 	if(!*nm) {
248 		log_err("out of memory");
249 		return 0;
250 	}
251 	*dclass = sldns_wirerr_get_class(rr, len, dname_len);
252 	*type = sldns_wirerr_get_type(rr, len, dname_len);
253 	*ttl = (time_t)sldns_wirerr_get_ttl(rr, len, dname_len);
254 	*rdata = sldns_wirerr_get_rdatawl(rr, len, dname_len);
255 	*rdata_len = sldns_wirerr_get_rdatalen(rr, len, dname_len)+2;
256 	return 1;
257 }
258 
259 /** return name and class of rr; parses string */
260 static int
261 get_rr_nameclass(const char* str, uint8_t** nm, uint16_t* dclass,
262 	uint16_t* dtype)
263 {
264 	uint8_t rr[LDNS_RR_BUF_SIZE];
265 	size_t len = sizeof(rr), dname_len = 0;
266 	int s = sldns_str2wire_rr_buf(str, rr, &len, &dname_len, 3600,
267 		NULL, 0, NULL, 0);
268 	if(s != 0) {
269 		log_err("error parsing local-data at %d '%s': %s",
270 			LDNS_WIREPARSE_OFFSET(s), str,
271 			sldns_get_errorstr_parse(s));
272 		return 0;
273 	}
274 	*nm = memdup(rr, dname_len);
275 	*dclass = sldns_wirerr_get_class(rr, len, dname_len);
276 	*dtype = sldns_wirerr_get_type(rr, len, dname_len);
277 	if(!*nm) {
278 		log_err("out of memory");
279 		return 0;
280 	}
281 	return 1;
282 }
283 
284 /**
285  * Find an rrset in local data structure.
286  * @param data: local data domain name structure.
287  * @param type: type to look for (host order).
288  * @param alias_ok: 1 if matching a non-exact, alias type such as CNAME is
289  * allowed.  otherwise 0.
290  * @return rrset pointer or NULL if not found.
291  */
292 static struct local_rrset*
293 local_data_find_type(struct local_data* data, uint16_t type, int alias_ok)
294 {
295 	struct local_rrset* p;
296 	type = htons(type);
297 	for(p = data->rrsets; p; p = p->next) {
298 		if(p->rrset->rk.type == type)
299 			return p;
300 		if(alias_ok && p->rrset->rk.type == htons(LDNS_RR_TYPE_CNAME))
301 			return p;
302 	}
303 	return NULL;
304 }
305 
306 /** check for RR duplicates */
307 static int
308 rr_is_duplicate(struct packed_rrset_data* pd, uint8_t* rdata, size_t rdata_len)
309 {
310 	size_t i;
311 	for(i=0; i<pd->count; i++) {
312 		if(pd->rr_len[i] == rdata_len &&
313 			memcmp(pd->rr_data[i], rdata, rdata_len) == 0)
314 			return 1;
315 	}
316 	return 0;
317 }
318 
319 /** new local_rrset */
320 static struct local_rrset*
321 new_local_rrset(struct regional* region, struct local_data* node,
322 	uint16_t rrtype, uint16_t rrclass)
323 {
324 	struct packed_rrset_data* pd;
325 	struct local_rrset* rrset = (struct local_rrset*)
326 		regional_alloc_zero(region, sizeof(*rrset));
327 	if(!rrset) {
328 		log_err("out of memory");
329 		return NULL;
330 	}
331 	rrset->next = node->rrsets;
332 	node->rrsets = rrset;
333 	rrset->rrset = (struct ub_packed_rrset_key*)
334 		regional_alloc_zero(region, sizeof(*rrset->rrset));
335 	if(!rrset->rrset) {
336 		log_err("out of memory");
337 		return NULL;
338 	}
339 	rrset->rrset->entry.key = rrset->rrset;
340 	pd = (struct packed_rrset_data*)regional_alloc_zero(region,
341 		sizeof(*pd));
342 	if(!pd) {
343 		log_err("out of memory");
344 		return NULL;
345 	}
346 	pd->trust = rrset_trust_prim_noglue;
347 	pd->security = sec_status_insecure;
348 	rrset->rrset->entry.data = pd;
349 	rrset->rrset->rk.dname = node->name;
350 	rrset->rrset->rk.dname_len = node->namelen;
351 	rrset->rrset->rk.type = htons(rrtype);
352 	rrset->rrset->rk.rrset_class = htons(rrclass);
353 	return rrset;
354 }
355 
356 /** insert RR into RRset data structure; Wastes a couple of bytes */
357 int
358 rrset_insert_rr(struct regional* region, struct packed_rrset_data* pd,
359 	uint8_t* rdata, size_t rdata_len, time_t ttl, const char* rrstr)
360 {
361 	size_t* oldlen = pd->rr_len;
362 	time_t* oldttl = pd->rr_ttl;
363 	uint8_t** olddata = pd->rr_data;
364 
365 	/* add RR to rrset */
366 	if(pd->count > LOCALZONE_RRSET_COUNT_MAX) {
367 		log_warn("RRset '%s' has more than %d records, record ignored",
368 			rrstr, LOCALZONE_RRSET_COUNT_MAX);
369 		return 1;
370 	}
371 	pd->count++;
372 	pd->rr_len = regional_alloc(region, sizeof(*pd->rr_len)*pd->count);
373 	pd->rr_ttl = regional_alloc(region, sizeof(*pd->rr_ttl)*pd->count);
374 	pd->rr_data = regional_alloc(region, sizeof(*pd->rr_data)*pd->count);
375 	if(!pd->rr_len || !pd->rr_ttl || !pd->rr_data) {
376 		log_err("out of memory");
377 		return 0;
378 	}
379 	if(pd->count > 1) {
380 		memcpy(pd->rr_len+1, oldlen,
381 			sizeof(*pd->rr_len)*(pd->count-1));
382 		memcpy(pd->rr_ttl+1, oldttl,
383 			sizeof(*pd->rr_ttl)*(pd->count-1));
384 		memcpy(pd->rr_data+1, olddata,
385 			sizeof(*pd->rr_data)*(pd->count-1));
386 	}
387 	pd->rr_len[0] = rdata_len;
388 	pd->rr_ttl[0] = ttl;
389 	pd->rr_data[0] = regional_alloc_init(region, rdata, rdata_len);
390 	if(!pd->rr_data[0]) {
391 		log_err("out of memory");
392 		return 0;
393 	}
394 	return 1;
395 }
396 
397 /** Delete RR from local-zone RRset, wastes memory as the deleted RRs cannot be
398  * free'd (regionally alloc'd) */
399 int
400 local_rrset_remove_rr(struct packed_rrset_data* pd, size_t index)
401 {
402 	log_assert(pd->count > 0);
403 	if(index >= pd->count) {
404 		log_warn("Trying to remove RR with out of bound index");
405 		return 0;
406 	}
407 	if(index + 1 < pd->count) {
408 		/* not removing last element */
409 		size_t nexti = index + 1;
410 		size_t num = pd->count - nexti;
411 		memmove(pd->rr_len+index, pd->rr_len+nexti, sizeof(*pd->rr_len)*num);
412 		memmove(pd->rr_ttl+index, pd->rr_ttl+nexti, sizeof(*pd->rr_ttl)*num);
413 		memmove(pd->rr_data+index, pd->rr_data+nexti, sizeof(*pd->rr_data)*num);
414 	}
415 	pd->count--;
416 	return 1;
417 }
418 
419 struct local_data*
420 local_zone_find_data(struct local_zone* z, uint8_t* nm, size_t nmlen, int nmlabs)
421 {
422 	struct local_data key;
423 	key.node.key = &key;
424 	key.name = nm;
425 	key.namelen = nmlen;
426 	key.namelabs = nmlabs;
427 	return (struct local_data*)rbtree_search(&z->data, &key.node);
428 }
429 
430 /** find a node, create it if not and all its empty nonterminal parents */
431 static int
432 lz_find_create_node(struct local_zone* z, uint8_t* nm, size_t nmlen,
433 	int nmlabs, struct local_data** res)
434 {
435 	struct local_data* ld = local_zone_find_data(z, nm, nmlen, nmlabs);
436 	if(!ld) {
437 		/* create a domain name to store rr. */
438 		ld = (struct local_data*)regional_alloc_zero(z->region,
439 			sizeof(*ld));
440 		if(!ld) {
441 			log_err("out of memory adding local data");
442 			return 0;
443 		}
444 		ld->node.key = ld;
445 		ld->name = regional_alloc_init(z->region, nm, nmlen);
446 		if(!ld->name) {
447 			log_err("out of memory");
448 			return 0;
449 		}
450 		ld->namelen = nmlen;
451 		ld->namelabs = nmlabs;
452 		if(!rbtree_insert(&z->data, &ld->node)) {
453 			log_assert(0); /* duplicate name */
454 		}
455 		/* see if empty nonterminals need to be created */
456 		if(nmlabs > z->namelabs) {
457 			dname_remove_label(&nm, &nmlen);
458 			if(!lz_find_create_node(z, nm, nmlen, nmlabs-1, res))
459 				return 0;
460 		}
461 	}
462 	*res = ld;
463 	return 1;
464 }
465 
466 /* Mark the SOA record for the zone. This only marks the SOA rrset; the data
467  * for the RR is entered later on local_zone_enter_rr() as with the other
468  * records. An artificial soa_negative record with a modified TTL (minimum of
469  * the TTL and the SOA.MINIMUM) is also created and marked for usage with
470  * negative answers and to avoid allocations during those answers. */
471 static int
472 lz_mark_soa_for_zone(struct local_zone* z, struct ub_packed_rrset_key* soa_rrset,
473 	uint8_t* rdata, size_t rdata_len, time_t ttl, const char* rrstr)
474 {
475 	struct packed_rrset_data* pd = (struct packed_rrset_data*)
476 		regional_alloc_zero(z->region, sizeof(*pd));
477 	struct ub_packed_rrset_key* rrset_negative = (struct ub_packed_rrset_key*)
478 		regional_alloc_zero(z->region, sizeof(*rrset_negative));
479 	time_t minimum;
480 	if(!rrset_negative||!pd) {
481 		log_err("out of memory");
482 		return 0;
483 	}
484 	/* Mark the original SOA record and then continue with the negative one. */
485 	z->soa = soa_rrset;
486 	rrset_negative->entry.key = rrset_negative;
487 	pd->trust = rrset_trust_prim_noglue;
488 	pd->security = sec_status_insecure;
489 	rrset_negative->entry.data = pd;
490 	rrset_negative->rk.dname = soa_rrset->rk.dname;
491 	rrset_negative->rk.dname_len = soa_rrset->rk.dname_len;
492 	rrset_negative->rk.type = soa_rrset->rk.type;
493 	rrset_negative->rk.rrset_class = soa_rrset->rk.rrset_class;
494 	if(!rrset_insert_rr(z->region, pd, rdata, rdata_len, ttl, rrstr))
495 		return 0;
496 	/* last 4 bytes are minimum ttl in network format */
497 	if(pd->count == 0 || pd->rr_len[0] < 2+4)
498 		return 0;
499 	minimum = (time_t)sldns_read_uint32(pd->rr_data[0]+(pd->rr_len[0]-4));
500 	minimum = ttl<minimum?ttl:minimum;
501 	pd->ttl = minimum;
502 	pd->rr_ttl[0] = minimum;
503 
504 	z->soa_negative = rrset_negative;
505 	return 1;
506 }
507 
508 int
509 local_zone_enter_rr(struct local_zone* z, uint8_t* nm, size_t nmlen,
510 	int nmlabs, uint16_t rrtype, uint16_t rrclass, time_t ttl,
511 	uint8_t* rdata, size_t rdata_len, const char* rrstr)
512 {
513 	struct local_data* node;
514 	struct local_rrset* rrset;
515 	struct packed_rrset_data* pd;
516 
517 	if(!lz_find_create_node(z, nm, nmlen, nmlabs, &node)) {
518 		return 0;
519 	}
520 	log_assert(node);
521 
522 	/* Reject it if we would end up having CNAME and other data (including
523 	 * another CNAME) for a redirect zone. */
524 	if((z->type == local_zone_redirect ||
525 		z->type == local_zone_inform_redirect) && node->rrsets) {
526 		const char* othertype = NULL;
527 		if (rrtype == LDNS_RR_TYPE_CNAME)
528 			othertype = "other";
529 		else if (node->rrsets->rrset->rk.type ==
530 			 htons(LDNS_RR_TYPE_CNAME)) {
531 			othertype = "CNAME";
532 		}
533 		if(othertype) {
534 			log_err("local-data '%s' in redirect zone must not "
535 				"coexist with %s local-data", rrstr, othertype);
536 			return 0;
537 		}
538 	}
539 	rrset = local_data_find_type(node, rrtype, 0);
540 	if(!rrset) {
541 		rrset = new_local_rrset(z->region, node, rrtype, rrclass);
542 		if(!rrset)
543 			return 0;
544 		if(query_dname_compare(node->name, z->name) == 0) {
545 			if(rrtype == LDNS_RR_TYPE_NSEC)
546 			  rrset->rrset->rk.flags = PACKED_RRSET_NSEC_AT_APEX;
547 			if(rrtype == LDNS_RR_TYPE_SOA &&
548 				!lz_mark_soa_for_zone(z, rrset->rrset, rdata, rdata_len, ttl,
549 					rrstr))
550 				return 0;
551 		}
552 	}
553 	pd = (struct packed_rrset_data*)rrset->rrset->entry.data;
554 	log_assert(rrset && pd);
555 
556 	/* check for duplicate RR */
557 	if(rr_is_duplicate(pd, rdata, rdata_len)) {
558 		verbose(VERB_ALGO, "ignoring duplicate RR: %s", rrstr);
559 		return 1;
560 	}
561 	return rrset_insert_rr(z->region, pd, rdata, rdata_len, ttl, rrstr);
562 }
563 
564 /** enter data RR into auth zone */
565 static int
566 lz_enter_rr_into_zone(struct local_zone* z, const char* rrstr)
567 {
568 	uint8_t* nm;
569 	size_t nmlen;
570 	int nmlabs, ret;
571 	uint16_t rrtype = 0, rrclass = 0;
572 	time_t ttl = 0;
573 	uint8_t rr[LDNS_RR_BUF_SIZE];
574 	uint8_t* rdata;
575 	size_t rdata_len;
576 	if(!rrstr_get_rr_content(rrstr, &nm, &rrtype, &rrclass, &ttl, rr,
577 		sizeof(rr), &rdata, &rdata_len)) {
578 		log_err("bad local-data: %s", rrstr);
579 		return 0;
580 	}
581 	log_assert(z->dclass == rrclass);
582 	if((z->type == local_zone_redirect ||
583 		z->type == local_zone_inform_redirect) &&
584 		query_dname_compare(z->name, nm) != 0) {
585 		log_err("local-data in redirect zone must reside at top of zone"
586 			", not at %s", rrstr);
587 		free(nm);
588 		return 0;
589 	}
590 	nmlabs = dname_count_size_labels(nm, &nmlen);
591 	ret = local_zone_enter_rr(z, nm, nmlen, nmlabs, rrtype, rrclass, ttl,
592 		rdata, rdata_len, rrstr);
593 	free(nm);
594 	return ret;
595 }
596 
597 /** enter a data RR into auth data; a zone for it must exist */
598 static int
599 lz_enter_rr_str(struct local_zones* zones, const char* rr)
600 {
601 	uint8_t* rr_name;
602 	uint16_t rr_class, rr_type;
603 	size_t len;
604 	int labs;
605 	struct local_zone* z;
606 	int r;
607 	if(!get_rr_nameclass(rr, &rr_name, &rr_class, &rr_type)) {
608 		log_err("bad rr %s", rr);
609 		return 0;
610 	}
611 	labs = dname_count_size_labels(rr_name, &len);
612 	lock_rw_rdlock(&zones->lock);
613 	z = local_zones_lookup(zones, rr_name, len, labs, rr_class, rr_type);
614 	if(!z) {
615 		lock_rw_unlock(&zones->lock);
616 		fatal_exit("internal error: no zone for rr %s", rr);
617 	}
618 	lock_rw_wrlock(&z->lock);
619 	lock_rw_unlock(&zones->lock);
620 	free(rr_name);
621 	r = lz_enter_rr_into_zone(z, rr);
622 	lock_rw_unlock(&z->lock);
623 	return r;
624 }
625 
626 /** enter tagstring into zone */
627 static int
628 lz_enter_zone_tag(struct local_zones* zones, char* zname, uint8_t* list,
629 	size_t len, uint16_t rr_class)
630 {
631 	uint8_t dname[LDNS_MAX_DOMAINLEN+1];
632 	size_t dname_len = sizeof(dname);
633 	int dname_labs, r = 0;
634 	struct local_zone* z;
635 
636 	if(sldns_str2wire_dname_buf(zname, dname, &dname_len) != 0) {
637 		log_err("cannot parse zone name in local-zone-tag: %s", zname);
638 		return 0;
639 	}
640 	dname_labs = dname_count_labels(dname);
641 
642 	lock_rw_rdlock(&zones->lock);
643 	z = local_zones_find(zones, dname, dname_len, dname_labs, rr_class);
644 	if(!z) {
645 		lock_rw_unlock(&zones->lock);
646 		log_err("no local-zone for tag %s", zname);
647 		return 0;
648 	}
649 	lock_rw_wrlock(&z->lock);
650 	lock_rw_unlock(&zones->lock);
651 	free(z->taglist);
652 	z->taglist = memdup(list, len);
653 	z->taglen = len;
654 	if(z->taglist)
655 		r = 1;
656 	lock_rw_unlock(&z->lock);
657 	return r;
658 }
659 
660 /** enter override into zone */
661 static int
662 lz_enter_override(struct local_zones* zones, char* zname, char* netblock,
663 	char* type, uint16_t rr_class)
664 {
665 	uint8_t dname[LDNS_MAX_DOMAINLEN+1];
666 	size_t dname_len = sizeof(dname);
667 	int dname_labs;
668 	struct sockaddr_storage addr;
669 	int net;
670 	socklen_t addrlen;
671 	struct local_zone* z;
672 	enum localzone_type t;
673 
674 	/* parse zone name */
675 	if(sldns_str2wire_dname_buf(zname, dname, &dname_len) != 0) {
676 		log_err("cannot parse zone name in local-zone-override: %s %s",
677 			zname, netblock);
678 		return 0;
679 	}
680 	dname_labs = dname_count_labels(dname);
681 
682 	/* parse netblock */
683 	if(!netblockstrtoaddr(netblock, UNBOUND_DNS_PORT, &addr, &addrlen,
684 		&net)) {
685 		log_err("cannot parse netblock in local-zone-override: %s %s",
686 			zname, netblock);
687 		return 0;
688 	}
689 
690 	/* parse zone type */
691 	if(!local_zone_str2type(type, &t)) {
692 		log_err("cannot parse type in local-zone-override: %s %s %s",
693 			zname, netblock, type);
694 		return 0;
695 	}
696 
697 	/* find localzone entry */
698 	lock_rw_rdlock(&zones->lock);
699 	z = local_zones_find(zones, dname, dname_len, dname_labs, rr_class);
700 	if(!z) {
701 		lock_rw_unlock(&zones->lock);
702 		log_err("no local-zone for local-zone-override %s", zname);
703 		return 0;
704 	}
705 	lock_rw_wrlock(&z->lock);
706 	lock_rw_unlock(&zones->lock);
707 
708 	/* create netblock addr_tree if not present yet */
709 	if(!z->override_tree) {
710 		z->override_tree = (struct rbtree_type*)regional_alloc_zero(
711 			z->region, sizeof(*z->override_tree));
712 		if(!z->override_tree) {
713 			lock_rw_unlock(&z->lock);
714 			log_err("out of memory");
715 			return 0;
716 		}
717 		addr_tree_init(z->override_tree);
718 	}
719 	/* add new elem to tree */
720 	if(z->override_tree) {
721 		struct local_zone_override* n;
722 		n = (struct local_zone_override*)regional_alloc_zero(
723 			z->region, sizeof(*n));
724 		if(!n) {
725 			lock_rw_unlock(&z->lock);
726 			log_err("out of memory");
727 			return 0;
728 		}
729 		n->type = t;
730 		if(!addr_tree_insert(z->override_tree,
731 			(struct addr_tree_node*)n, &addr, addrlen, net)) {
732 			lock_rw_unlock(&z->lock);
733 			log_err("duplicate local-zone-override %s %s",
734 				zname, netblock);
735 			return 1;
736 		}
737 	}
738 
739 	lock_rw_unlock(&z->lock);
740 	return 1;
741 }
742 
743 /** parse local-zone: statements */
744 static int
745 lz_enter_zones(struct local_zones* zones, struct config_file* cfg)
746 {
747 	struct config_str2list* p;
748 #ifndef THREADS_DISABLED
749 	struct local_zone* z;
750 #endif
751 	for(p = cfg->local_zones; p; p = p->next) {
752 		if(!(
753 #ifndef THREADS_DISABLED
754 			z=
755 #endif
756 			lz_enter_zone(zones, p->str, p->str2,
757 			LDNS_RR_CLASS_IN)))
758 			return 0;
759 		lock_rw_unlock(&z->lock);
760 	}
761 	return 1;
762 }
763 
764 /** lookup a zone in rbtree; exact match only; SLOW due to parse */
765 static int
766 lz_exists(struct local_zones* zones, const char* name)
767 {
768 	struct local_zone z;
769 	z.node.key = &z;
770 	z.dclass = LDNS_RR_CLASS_IN;
771 	if(!parse_dname(name, &z.name, &z.namelen, &z.namelabs)) {
772 		log_err("bad name %s", name);
773 		return 0;
774 	}
775 	lock_rw_rdlock(&zones->lock);
776 	if(rbtree_search(&zones->ztree, &z.node)) {
777 		lock_rw_unlock(&zones->lock);
778 		free(z.name);
779 		return 1;
780 	}
781 	lock_rw_unlock(&zones->lock);
782 	free(z.name);
783 	return 0;
784 }
785 
786 /** lookup a zone in cfg->nodefault list */
787 static int
788 lz_nodefault(struct config_file* cfg, const char* name)
789 {
790 	struct config_strlist* p;
791 	size_t len = strlen(name);
792 	if(len == 0) return 0;
793 	if(name[len-1] == '.') len--;
794 
795 	for(p = cfg->local_zones_nodefault; p; p = p->next) {
796 		/* compare zone name, lowercase, compare without ending . */
797 		if(strncasecmp(p->str, name, len) == 0 &&
798 			(strlen(p->str) == len || (strlen(p->str)==len+1 &&
799 			p->str[len] == '.')))
800 			return 1;
801 	}
802 	return 0;
803 }
804 
805 /** enter (AS112) empty default zone */
806 static int
807 add_empty_default(struct local_zones* zones, struct config_file* cfg,
808         const char* name)
809 {
810 	struct local_zone* z;
811 	char str[1024]; /* known long enough */
812 	if(lz_exists(zones, name) || lz_nodefault(cfg, name))
813 		return 1; /* do not enter default content */
814 	if(!(z=lz_enter_zone(zones, name, "static", LDNS_RR_CLASS_IN)))
815 		return 0;
816 	snprintf(str, sizeof(str), "%s 10800 IN SOA localhost. "
817 		"nobody.invalid. 1 3600 1200 604800 10800", name);
818 	if(!lz_enter_rr_into_zone(z, str)) {
819 		lock_rw_unlock(&z->lock);
820 		return 0;
821 	}
822 	snprintf(str, sizeof(str), "%s 10800 IN NS localhost. ", name);
823 	if(!lz_enter_rr_into_zone(z, str)) {
824 		lock_rw_unlock(&z->lock);
825 		return 0;
826 	}
827 	lock_rw_unlock(&z->lock);
828 	return 1;
829 }
830 
831 /** enter default zones */
832 int local_zone_enter_defaults(struct local_zones* zones, struct config_file* cfg)
833 {
834 	struct local_zone* z;
835 	const char** zstr;
836 
837 	/* Do not add any default */
838 	if(cfg->local_zones_disable_default)
839 		return 1;
840 
841 	/* this list of zones is from RFC 6303 and RFC 7686 */
842 
843 	/* block localhost level zones first, then onion and later the LAN zones */
844 
845 	/* localhost. zone */
846 	if(!lz_exists(zones, "localhost.") &&
847 		!lz_nodefault(cfg, "localhost.")) {
848 		if(!(z=lz_enter_zone(zones, "localhost.", "redirect",
849 			LDNS_RR_CLASS_IN)) ||
850 		   !lz_enter_rr_into_zone(z,
851 			"localhost. 10800 IN NS localhost.") ||
852 		   !lz_enter_rr_into_zone(z,
853 			"localhost. 10800 IN SOA localhost. nobody.invalid. "
854 			"1 3600 1200 604800 10800") ||
855 		   !lz_enter_rr_into_zone(z,
856 			"localhost. 10800 IN A 127.0.0.1") ||
857 		   !lz_enter_rr_into_zone(z,
858 			"localhost. 10800 IN AAAA ::1")) {
859 			log_err("out of memory adding default zone");
860 			if(z) { lock_rw_unlock(&z->lock); }
861 			return 0;
862 		}
863 		lock_rw_unlock(&z->lock);
864 	}
865 	/* reverse ip4 zone */
866 	if(!lz_exists(zones, "127.in-addr.arpa.") &&
867 		!lz_nodefault(cfg, "127.in-addr.arpa.")) {
868 		if(!(z=lz_enter_zone(zones, "127.in-addr.arpa.", "static",
869 			LDNS_RR_CLASS_IN)) ||
870 		   !lz_enter_rr_into_zone(z,
871 			"127.in-addr.arpa. 10800 IN NS localhost.") ||
872 		   !lz_enter_rr_into_zone(z,
873 			"127.in-addr.arpa. 10800 IN SOA localhost. "
874 			"nobody.invalid. 1 3600 1200 604800 10800") ||
875 		   !lz_enter_rr_into_zone(z,
876 			"1.0.0.127.in-addr.arpa. 10800 IN PTR localhost.")) {
877 			log_err("out of memory adding default zone");
878 			if(z) { lock_rw_unlock(&z->lock); }
879 			return 0;
880 		}
881 		lock_rw_unlock(&z->lock);
882 	}
883 	/* reverse ip6 zone */
884 	if(!lz_exists(zones, "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa.") &&
885 		!lz_nodefault(cfg, "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa.")) {
886 		if(!(z=lz_enter_zone(zones, "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa.", "static",
887 			LDNS_RR_CLASS_IN)) ||
888 		   !lz_enter_rr_into_zone(z,
889 			"1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa. 10800 IN NS localhost.") ||
890 		   !lz_enter_rr_into_zone(z,
891 			"1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa. 10800 IN SOA localhost. "
892 			"nobody.invalid. 1 3600 1200 604800 10800") ||
893 		   !lz_enter_rr_into_zone(z,
894 			"1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa. 10800 IN PTR localhost.")) {
895 			log_err("out of memory adding default zone");
896 			if(z) { lock_rw_unlock(&z->lock); }
897 			return 0;
898 		}
899 		lock_rw_unlock(&z->lock);
900 	}
901 	/* home.arpa. zone (RFC 8375) */
902 	if(!add_empty_default(zones, cfg, "home.arpa.")) {
903 		log_err("out of memory adding default zone");
904 		return 0;
905 	}
906 	/* onion. zone (RFC 7686) */
907 	if(!add_empty_default(zones, cfg, "onion.")) {
908 		log_err("out of memory adding default zone");
909 		return 0;
910 	}
911 	/* test. zone (RFC 6761) */
912 	if(!add_empty_default(zones, cfg, "test.")) {
913 		log_err("out of memory adding default zone");
914 		return 0;
915 	}
916 	/* invalid. zone (RFC 6761) */
917 	if(!add_empty_default(zones, cfg, "invalid.")) {
918 		log_err("out of memory adding default zone");
919 		return 0;
920 	}
921 	/* block AS112 zones, unless asked not to */
922 	if(!cfg->unblock_lan_zones) {
923 		for(zstr = as112_zones; *zstr; zstr++) {
924 			if(!add_empty_default(zones, cfg, *zstr)) {
925 				log_err("out of memory adding default zone");
926 				return 0;
927 			}
928 		}
929 	}
930 	return 1;
931 }
932 
933 /** parse local-zone-override: statements */
934 static int
935 lz_enter_overrides(struct local_zones* zones, struct config_file* cfg)
936 {
937 	struct config_str3list* p;
938 	for(p = cfg->local_zone_overrides; p; p = p->next) {
939 		if(!lz_enter_override(zones, p->str, p->str2, p->str3,
940 			LDNS_RR_CLASS_IN))
941 			return 0;
942 	}
943 	return 1;
944 }
945 
946 /** setup parent pointers, so that a lookup can be done for closest match */
947 static void
948 init_parents(struct local_zones* zones)
949 {
950         struct local_zone* node, *prev = NULL, *p;
951         int m;
952 	lock_rw_wrlock(&zones->lock);
953         RBTREE_FOR(node, struct local_zone*, &zones->ztree) {
954 		lock_rw_wrlock(&node->lock);
955                 node->parent = NULL;
956                 if(!prev || prev->dclass != node->dclass) {
957                         prev = node;
958 			lock_rw_unlock(&node->lock);
959                         continue;
960                 }
961                 (void)dname_lab_cmp(prev->name, prev->namelabs, node->name,
962                         node->namelabs, &m); /* we know prev is smaller */
963                 /* sort order like: . com. bla.com. zwb.com. net. */
964                 /* find the previous, or parent-parent-parent */
965                 for(p = prev; p; p = p->parent)
966                         /* looking for name with few labels, a parent */
967                         if(p->namelabs <= m) {
968                                 /* ==: since prev matched m, this is closest*/
969                                 /* <: prev matches more, but is not a parent,
970                                  * this one is a (grand)parent */
971                                 node->parent = p;
972                                 break;
973                         }
974                 prev = node;
975 
976 		if(node->override_tree)
977 			addr_tree_init_parents(node->override_tree);
978 		lock_rw_unlock(&node->lock);
979         }
980 	lock_rw_unlock(&zones->lock);
981 }
982 
983 /** enter implicit transparent zone for local-data: without local-zone: */
984 static int
985 lz_setup_implicit(struct local_zones* zones, struct config_file* cfg)
986 {
987 	/* walk over all items that have no parent zone and find
988 	 * the name that covers them all (could be the root) and
989 	 * add that as a transparent zone */
990 	struct config_strlist* p;
991 	int have_name = 0;
992 	int have_other_classes = 0;
993 	uint16_t dclass = 0;
994 	uint8_t* nm = 0;
995 	size_t nmlen = 0;
996 	int nmlabs = 0;
997 	int match = 0; /* number of labels match count */
998 
999 	init_parents(zones); /* to enable local_zones_lookup() */
1000 	for(p = cfg->local_data; p; p = p->next) {
1001 		uint8_t* rr_name;
1002 		uint16_t rr_class, rr_type;
1003 		size_t len;
1004 		int labs;
1005 		if(!get_rr_nameclass(p->str, &rr_name, &rr_class, &rr_type)) {
1006 			log_err("Bad local-data RR %s", p->str);
1007 			return 0;
1008 		}
1009 		labs = dname_count_size_labels(rr_name, &len);
1010 		lock_rw_rdlock(&zones->lock);
1011 		if(!local_zones_lookup(zones, rr_name, len, labs, rr_class,
1012 			rr_type)) {
1013 			if(!have_name) {
1014 				dclass = rr_class;
1015 				nm = rr_name;
1016 				nmlen = len;
1017 				nmlabs = labs;
1018 				match = labs;
1019 				have_name = 1;
1020 			} else {
1021 				int m;
1022 				if(rr_class != dclass) {
1023 					/* process other classes later */
1024 					free(rr_name);
1025 					have_other_classes = 1;
1026 					lock_rw_unlock(&zones->lock);
1027 					continue;
1028 				}
1029 				/* find smallest shared topdomain */
1030 				(void)dname_lab_cmp(nm, nmlabs,
1031 					rr_name, labs, &m);
1032 				free(rr_name);
1033 				if(m < match)
1034 					match = m;
1035 			}
1036 		} else free(rr_name);
1037 		lock_rw_unlock(&zones->lock);
1038 	}
1039 	if(have_name) {
1040 		uint8_t* n2;
1041 #ifndef THREADS_DISABLED
1042 		struct local_zone* z;
1043 #endif
1044 		/* allocate zone of smallest shared topdomain to contain em */
1045 		n2 = nm;
1046 		dname_remove_labels(&n2, &nmlen, nmlabs - match);
1047 		n2 = memdup(n2, nmlen);
1048 		free(nm);
1049 		if(!n2) {
1050 			log_err("out of memory");
1051 			return 0;
1052 		}
1053 		log_nametypeclass(VERB_ALGO, "implicit transparent local-zone",
1054 			n2, 0, dclass);
1055 		if(!(
1056 #ifndef THREADS_DISABLED
1057 			z=
1058 #endif
1059 			lz_enter_zone_dname(zones, n2, nmlen, match,
1060 			local_zone_transparent, dclass))) {
1061 			return 0;
1062 		}
1063 		lock_rw_unlock(&z->lock);
1064 	}
1065 	if(have_other_classes) {
1066 		/* restart to setup other class */
1067 		return lz_setup_implicit(zones, cfg);
1068 	}
1069 	return 1;
1070 }
1071 
1072 /** enter local-zone-tag info */
1073 static int
1074 lz_enter_zone_tags(struct local_zones* zones, struct config_file* cfg)
1075 {
1076 	struct config_strbytelist* p;
1077 	int c = 0;
1078 	for(p = cfg->local_zone_tags; p; p = p->next) {
1079 		if(!lz_enter_zone_tag(zones, p->str, p->str2, p->str2len,
1080 			LDNS_RR_CLASS_IN))
1081 			return 0;
1082 		c++;
1083 	}
1084 	if(c) verbose(VERB_ALGO, "applied tags to %d local zones", c);
1085 	return 1;
1086 }
1087 
1088 /** enter auth data */
1089 static int
1090 lz_enter_data(struct local_zones* zones, struct config_file* cfg)
1091 {
1092 	struct config_strlist* p;
1093 	for(p = cfg->local_data; p; p = p->next) {
1094 		if(!lz_enter_rr_str(zones, p->str))
1095 			return 0;
1096 	}
1097 	return 1;
1098 }
1099 
1100 /** free memory from config */
1101 static void
1102 lz_freeup_cfg(struct config_file* cfg)
1103 {
1104 	config_deldblstrlist(cfg->local_zones);
1105 	cfg->local_zones = NULL;
1106 	config_delstrlist(cfg->local_zones_nodefault);
1107 	cfg->local_zones_nodefault = NULL;
1108 	config_delstrlist(cfg->local_data);
1109 	cfg->local_data = NULL;
1110 }
1111 
1112 int
1113 local_zones_apply_cfg(struct local_zones* zones, struct config_file* cfg)
1114 {
1115 	/* create zones from zone statements. */
1116 	if(!lz_enter_zones(zones, cfg)) {
1117 		return 0;
1118 	}
1119 	/* apply default zones+content (unless disabled, or overridden) */
1120 	if(!local_zone_enter_defaults(zones, cfg)) {
1121 		return 0;
1122 	}
1123 	/* enter local zone overrides */
1124 	if(!lz_enter_overrides(zones, cfg)) {
1125 		return 0;
1126 	}
1127 	/* create implicit transparent zone from data. */
1128 	if(!lz_setup_implicit(zones, cfg)) {
1129 		return 0;
1130 	}
1131 
1132 	/* setup parent ptrs for lookup during data entry */
1133 	init_parents(zones);
1134 	/* insert local zone tags */
1135 	if(!lz_enter_zone_tags(zones, cfg)) {
1136 		return 0;
1137 	}
1138 	/* insert local data */
1139 	if(!lz_enter_data(zones, cfg)) {
1140 		return 0;
1141 	}
1142 	/* freeup memory from cfg struct. */
1143 	lz_freeup_cfg(cfg);
1144 	return 1;
1145 }
1146 
1147 struct local_zone*
1148 local_zones_lookup(struct local_zones* zones,
1149         uint8_t* name, size_t len, int labs, uint16_t dclass, uint16_t dtype)
1150 {
1151 	return local_zones_tags_lookup(zones, name, len, labs,
1152 		dclass, dtype, NULL, 0, 1);
1153 }
1154 
1155 struct local_zone*
1156 local_zones_tags_lookup(struct local_zones* zones,
1157         uint8_t* name, size_t len, int labs, uint16_t dclass, uint16_t dtype,
1158 	uint8_t* taglist, size_t taglen, int ignoretags)
1159 {
1160 	rbnode_type* res = NULL;
1161 	struct local_zone *result;
1162 	struct local_zone key;
1163 	int m;
1164 	/* for type DS use a zone higher when on a zonecut */
1165 	if(dtype == LDNS_RR_TYPE_DS && !dname_is_root(name)) {
1166 		dname_remove_label(&name, &len);
1167 		labs--;
1168 	}
1169 	key.node.key = &key;
1170 	key.dclass = dclass;
1171 	key.name = name;
1172 	key.namelen = len;
1173 	key.namelabs = labs;
1174 	rbtree_find_less_equal(&zones->ztree, &key, &res);
1175 	result = (struct local_zone*)res;
1176 	/* exact or smaller element (or no element) */
1177 	if(!result || result->dclass != dclass)
1178 		return NULL;
1179 	/* count number of labels matched */
1180 	(void)dname_lab_cmp(result->name, result->namelabs, key.name,
1181 		key.namelabs, &m);
1182 	while(result) { /* go up until qname is zone or subdomain of zone */
1183 		if(result->namelabs <= m)
1184 			if(ignoretags || !result->taglist ||
1185 				taglist_intersect(result->taglist,
1186 				result->taglen, taglist, taglen))
1187 				break;
1188 		result = result->parent;
1189 	}
1190 	return result;
1191 }
1192 
1193 struct local_zone*
1194 local_zones_find(struct local_zones* zones,
1195         uint8_t* name, size_t len, int labs, uint16_t dclass)
1196 {
1197 	struct local_zone key;
1198 	key.node.key = &key;
1199 	key.dclass = dclass;
1200 	key.name = name;
1201 	key.namelen = len;
1202 	key.namelabs = labs;
1203 	/* exact */
1204 	return (struct local_zone*)rbtree_search(&zones->ztree, &key);
1205 }
1206 
1207 struct local_zone*
1208 local_zones_find_le(struct local_zones* zones,
1209         uint8_t* name, size_t len, int labs, uint16_t dclass,
1210 	int* exact)
1211 {
1212 	struct local_zone key;
1213 	rbnode_type *node;
1214 	key.node.key = &key;
1215 	key.dclass = dclass;
1216 	key.name = name;
1217 	key.namelen = len;
1218 	key.namelabs = labs;
1219 	*exact = rbtree_find_less_equal(&zones->ztree, &key, &node);
1220 	return (struct local_zone*)node;
1221 }
1222 
1223 /** print all RRsets in local zone */
1224 static void
1225 local_zone_out(struct local_zone* z)
1226 {
1227 	struct local_data* d;
1228 	struct local_rrset* p;
1229 	RBTREE_FOR(d, struct local_data*, &z->data) {
1230 		for(p = d->rrsets; p; p = p->next) {
1231 			log_nametypeclass(NO_VERBOSE, "rrset", d->name,
1232 				ntohs(p->rrset->rk.type),
1233 				ntohs(p->rrset->rk.rrset_class));
1234 		}
1235 	}
1236 }
1237 
1238 void local_zones_print(struct local_zones* zones)
1239 {
1240 	struct local_zone* z;
1241 	lock_rw_rdlock(&zones->lock);
1242 	log_info("number of auth zones %u", (unsigned)zones->ztree.count);
1243 	RBTREE_FOR(z, struct local_zone*, &zones->ztree) {
1244 		char buf[64];
1245 		lock_rw_rdlock(&z->lock);
1246 		snprintf(buf, sizeof(buf), "%s zone",
1247 			local_zone_type2str(z->type));
1248 		log_nametypeclass(NO_VERBOSE, buf, z->name, 0, z->dclass);
1249 		local_zone_out(z);
1250 		lock_rw_unlock(&z->lock);
1251 	}
1252 	lock_rw_unlock(&zones->lock);
1253 }
1254 
1255 /** encode answer consisting of 1 rrset */
1256 static int
1257 local_encode(struct query_info* qinfo, struct module_env* env,
1258 	struct edns_data* edns, struct comm_reply* repinfo, sldns_buffer* buf,
1259 	struct regional* temp, struct ub_packed_rrset_key* rrset, int ansec,
1260 	int rcode)
1261 {
1262 	struct reply_info rep;
1263 	uint16_t udpsize;
1264 	/* make answer with time=0 for fixed TTL values */
1265 	memset(&rep, 0, sizeof(rep));
1266 	rep.flags = (uint16_t)((BIT_QR | BIT_AA | BIT_RA) | rcode);
1267 	rep.qdcount = 1;
1268 	if(ansec)
1269 		rep.an_numrrsets = 1;
1270 	else	rep.ns_numrrsets = 1;
1271 	rep.rrset_count = 1;
1272 	rep.rrsets = &rrset;
1273 	udpsize = edns->udp_size;
1274 	edns->edns_version = EDNS_ADVERTISED_VERSION;
1275 	edns->udp_size = EDNS_ADVERTISED_SIZE;
1276 	edns->ext_rcode = 0;
1277 	edns->bits &= EDNS_DO;
1278 	if(!inplace_cb_reply_local_call(env, qinfo, NULL, &rep, rcode, edns,
1279 		repinfo, temp, env->now_tv) || !reply_info_answer_encode(qinfo, &rep,
1280 		*(uint16_t*)sldns_buffer_begin(buf), sldns_buffer_read_u16_at(buf, 2),
1281 		buf, 0, 0, temp, udpsize, edns, (int)(edns->bits&EDNS_DO), 0)) {
1282 		error_encode(buf, (LDNS_RCODE_SERVFAIL|BIT_AA), qinfo,
1283 			*(uint16_t*)sldns_buffer_begin(buf),
1284 			sldns_buffer_read_u16_at(buf, 2), edns);
1285 	}
1286 	return 1;
1287 }
1288 
1289 /** encode local error answer */
1290 static void
1291 local_error_encode(struct query_info* qinfo, struct module_env* env,
1292 	struct edns_data* edns, struct comm_reply* repinfo, sldns_buffer* buf,
1293 	struct regional* temp, int rcode, int r)
1294 {
1295 	edns->edns_version = EDNS_ADVERTISED_VERSION;
1296 	edns->udp_size = EDNS_ADVERTISED_SIZE;
1297 	edns->ext_rcode = 0;
1298 	edns->bits &= EDNS_DO;
1299 
1300 	if(!inplace_cb_reply_local_call(env, qinfo, NULL, NULL,
1301 		rcode, edns, repinfo, temp, env->now_tv))
1302 		edns->opt_list_inplace_cb_out = NULL;
1303 	error_encode(buf, r, qinfo, *(uint16_t*)sldns_buffer_begin(buf),
1304 		sldns_buffer_read_u16_at(buf, 2), edns);
1305 }
1306 
1307 /** find local data tag string match for the given type in the list */
1308 int
1309 local_data_find_tag_datas(const struct query_info* qinfo,
1310 	struct config_strlist* list, struct ub_packed_rrset_key* r,
1311 	struct regional* temp)
1312 {
1313 	struct config_strlist* p;
1314 	char buf[65536];
1315 	uint8_t rr[LDNS_RR_BUF_SIZE];
1316 	size_t len;
1317 	int res;
1318 	struct packed_rrset_data* d;
1319 	for(p=list; p; p=p->next) {
1320 		uint16_t rdr_type;
1321 
1322 		len = sizeof(rr);
1323 		/* does this element match the type? */
1324 		snprintf(buf, sizeof(buf), ". %s", p->str);
1325 		res = sldns_str2wire_rr_buf(buf, rr, &len, NULL, 3600,
1326 			NULL, 0, NULL, 0);
1327 		if(res != 0)
1328 			/* parse errors are already checked before, in
1329 			 * acllist check_data, skip this for robustness */
1330 			continue;
1331 		if(len < 1 /* . */ + 8 /* typeclassttl*/ + 2 /*rdatalen*/)
1332 			continue;
1333 		rdr_type = sldns_wirerr_get_type(rr, len, 1);
1334 		if(rdr_type != qinfo->qtype && rdr_type != LDNS_RR_TYPE_CNAME)
1335 			continue;
1336 
1337 		/* do we have entries already? if not setup key */
1338 		if(r->rk.dname == NULL) {
1339 			r->entry.key = r;
1340 			r->rk.dname = qinfo->qname;
1341 			r->rk.dname_len = qinfo->qname_len;
1342 			r->rk.type = htons(rdr_type);
1343 			r->rk.rrset_class = htons(qinfo->qclass);
1344 			r->rk.flags = 0;
1345 			d = (struct packed_rrset_data*)regional_alloc_zero(
1346 				temp, sizeof(struct packed_rrset_data)
1347 				+ sizeof(size_t) + sizeof(uint8_t*) +
1348 				sizeof(time_t));
1349 			if(!d) return 0; /* out of memory */
1350 			r->entry.data = d;
1351 			d->ttl = sldns_wirerr_get_ttl(rr, len, 1);
1352 			d->rr_len = (size_t*)((uint8_t*)d +
1353 				sizeof(struct packed_rrset_data));
1354 			d->rr_data = (uint8_t**)&(d->rr_len[1]);
1355 			d->rr_ttl = (time_t*)&(d->rr_data[1]);
1356 		}
1357 		d = (struct packed_rrset_data*)r->entry.data;
1358 		/* add entry to the data */
1359 		if(d->count != 0) {
1360 			size_t* oldlen = d->rr_len;
1361 			uint8_t** olddata = d->rr_data;
1362 			time_t* oldttl = d->rr_ttl;
1363 			/* increase arrays for lookup */
1364 			/* this is of course slow for very many records,
1365 			 * but most redirects are expected with few records */
1366 			d->rr_len = (size_t*)regional_alloc_zero(temp,
1367 				(d->count+1)*sizeof(size_t));
1368 			d->rr_data = (uint8_t**)regional_alloc_zero(temp,
1369 				(d->count+1)*sizeof(uint8_t*));
1370 			d->rr_ttl = (time_t*)regional_alloc_zero(temp,
1371 				(d->count+1)*sizeof(time_t));
1372 			if(!d->rr_len || !d->rr_data || !d->rr_ttl)
1373 				return 0; /* out of memory */
1374 			/* first one was allocated after struct d, but new
1375 			 * ones get their own array increment alloc, so
1376 			 * copy old content */
1377 			memmove(d->rr_len, oldlen, d->count*sizeof(size_t));
1378 			memmove(d->rr_data, olddata, d->count*sizeof(uint8_t*));
1379 			memmove(d->rr_ttl, oldttl, d->count*sizeof(time_t));
1380 		}
1381 
1382 		d->rr_len[d->count] = sldns_wirerr_get_rdatalen(rr, len, 1)+2;
1383 		d->rr_ttl[d->count] = sldns_wirerr_get_ttl(rr, len, 1);
1384 		d->rr_data[d->count] = regional_alloc_init(temp,
1385 			sldns_wirerr_get_rdatawl(rr, len, 1),
1386 			d->rr_len[d->count]);
1387 		if(!d->rr_data[d->count])
1388 			return 0; /* out of memory */
1389 		d->count++;
1390 	}
1391 	if(r->rk.dname)
1392 		return 1;
1393 	return 0;
1394 }
1395 
1396 static int
1397 find_tag_datas(struct query_info* qinfo, struct config_strlist* list,
1398 	struct ub_packed_rrset_key* r, struct regional* temp)
1399 {
1400 	int result = local_data_find_tag_datas(qinfo, list, r, temp);
1401 
1402 	/* If we've found a non-exact alias type of local data, make a shallow
1403 	 * copy of the RRset and remember it in qinfo to complete the alias
1404 	 * chain later. */
1405 	if(result && qinfo->qtype != LDNS_RR_TYPE_CNAME &&
1406 		r->rk.type == htons(LDNS_RR_TYPE_CNAME)) {
1407 		qinfo->local_alias =
1408 			regional_alloc_zero(temp, sizeof(struct local_rrset));
1409 		if(!qinfo->local_alias)
1410 			return 0; /* out of memory */
1411 		qinfo->local_alias->rrset =
1412 			regional_alloc_init(temp, r, sizeof(*r));
1413 		if(!qinfo->local_alias->rrset)
1414 			return 0; /* out of memory */
1415 	}
1416 	return result;
1417 }
1418 
1419 int
1420 local_data_answer(struct local_zone* z, struct module_env* env,
1421 	struct query_info* qinfo, struct edns_data* edns,
1422 	struct comm_reply* repinfo, sldns_buffer* buf,
1423 	struct regional* temp, int labs, struct local_data** ldp,
1424 	enum localzone_type lz_type, int tag, struct config_strlist** tag_datas,
1425 	size_t tag_datas_size, char** tagname, int num_tags)
1426 {
1427 	struct local_data key;
1428 	struct local_data* ld;
1429 	struct local_rrset* lr;
1430 	key.node.key = &key;
1431 	key.name = qinfo->qname;
1432 	key.namelen = qinfo->qname_len;
1433 	key.namelabs = labs;
1434 	if(lz_type == local_zone_redirect ||
1435 		lz_type == local_zone_inform_redirect) {
1436 		key.name = z->name;
1437 		key.namelen = z->namelen;
1438 		key.namelabs = z->namelabs;
1439 		if(tag != -1 && (size_t)tag<tag_datas_size && tag_datas[tag]) {
1440 			struct ub_packed_rrset_key r;
1441 			memset(&r, 0, sizeof(r));
1442 			if(find_tag_datas(qinfo, tag_datas[tag], &r, temp)) {
1443 				verbose(VERB_ALGO, "redirect with tag data [%d] %s",
1444 					tag, (tag<num_tags?tagname[tag]:"null"));
1445 
1446 				/* If we found a matching alias, we should
1447 				 * use it as part of the answer, but we can't
1448 				 * encode it until we complete the alias
1449 				 * chain. */
1450 				if(qinfo->local_alias)
1451 					return 1;
1452 				return local_encode(qinfo, env, edns, repinfo, buf, temp,
1453 					&r, 1, LDNS_RCODE_NOERROR);
1454 			}
1455 		}
1456 	}
1457 	ld = (struct local_data*)rbtree_search(&z->data, &key.node);
1458 	*ldp = ld;
1459 	if(!ld) {
1460 		return 0;
1461 	}
1462 	lr = local_data_find_type(ld, qinfo->qtype, 1);
1463 	if(!lr)
1464 		return 0;
1465 
1466 	/* Special case for alias matching.  See local_data_answer(). */
1467 	if((lz_type == local_zone_redirect ||
1468 		lz_type == local_zone_inform_redirect) &&
1469 		qinfo->qtype != LDNS_RR_TYPE_CNAME &&
1470 		lr->rrset->rk.type == htons(LDNS_RR_TYPE_CNAME)) {
1471 		uint8_t* ctarget;
1472 		size_t ctargetlen = 0;
1473 
1474 		qinfo->local_alias =
1475 			regional_alloc_zero(temp, sizeof(struct local_rrset));
1476 		if(!qinfo->local_alias)
1477 			return 0; /* out of memory */
1478 		qinfo->local_alias->rrset = regional_alloc_init(
1479 			temp, lr->rrset, sizeof(*lr->rrset));
1480 		if(!qinfo->local_alias->rrset)
1481 			return 0; /* out of memory */
1482 		qinfo->local_alias->rrset->rk.dname = qinfo->qname;
1483 		qinfo->local_alias->rrset->rk.dname_len = qinfo->qname_len;
1484 		get_cname_target(lr->rrset, &ctarget, &ctargetlen);
1485 		if(!ctargetlen)
1486 			return 0; /* invalid cname */
1487 		if(dname_is_wild(ctarget)) {
1488 			/* synthesize cname target */
1489 			struct packed_rrset_data* d;
1490 			/* -3 for wildcard label and root label from qname */
1491 			size_t newtargetlen = qinfo->qname_len + ctargetlen - 3;
1492 
1493 			log_assert(ctargetlen >= 3);
1494 			log_assert(qinfo->qname_len >= 1);
1495 
1496 			if(newtargetlen > LDNS_MAX_DOMAINLEN) {
1497 				qinfo->local_alias = NULL;
1498 				local_error_encode(qinfo, env, edns, repinfo,
1499 					buf, temp, LDNS_RCODE_YXDOMAIN,
1500 					(LDNS_RCODE_YXDOMAIN|BIT_AA));
1501 				return 1;
1502 			}
1503 			memset(&qinfo->local_alias->rrset->entry, 0,
1504 				sizeof(qinfo->local_alias->rrset->entry));
1505 			qinfo->local_alias->rrset->entry.key =
1506 				qinfo->local_alias->rrset;
1507 			qinfo->local_alias->rrset->entry.hash =
1508 				rrset_key_hash(&qinfo->local_alias->rrset->rk);
1509 			d = (struct packed_rrset_data*)regional_alloc_zero(temp,
1510 				sizeof(struct packed_rrset_data) + sizeof(size_t) +
1511 				sizeof(uint8_t*) + sizeof(time_t) + sizeof(uint16_t)
1512 				+ newtargetlen);
1513 			if(!d)
1514 				return 0; /* out of memory */
1515 			qinfo->local_alias->rrset->entry.data = d;
1516 			d->ttl = 0; /* 0 for synthesized CNAME TTL */
1517 			d->count = 1;
1518 			d->rrsig_count = 0;
1519 			d->trust = rrset_trust_ans_noAA;
1520 			d->rr_len = (size_t*)((uint8_t*)d +
1521 				sizeof(struct packed_rrset_data));
1522 			d->rr_len[0] = newtargetlen + sizeof(uint16_t);
1523 			packed_rrset_ptr_fixup(d);
1524 			d->rr_ttl[0] = d->ttl;
1525 			sldns_write_uint16(d->rr_data[0], newtargetlen);
1526 			/* write qname */
1527 			memmove(d->rr_data[0] + sizeof(uint16_t), qinfo->qname,
1528 				qinfo->qname_len - 1);
1529 			/* write cname target wildcard label */
1530 			memmove(d->rr_data[0] + sizeof(uint16_t) +
1531 				qinfo->qname_len - 1, ctarget + 2,
1532 				ctargetlen - 2);
1533 		}
1534 		return 1;
1535 	}
1536 	if(lz_type == local_zone_redirect ||
1537 		lz_type == local_zone_inform_redirect) {
1538 		/* convert rrset name to query name; like a wildcard */
1539 		struct ub_packed_rrset_key r = *lr->rrset;
1540 		r.rk.dname = qinfo->qname;
1541 		r.rk.dname_len = qinfo->qname_len;
1542 		return local_encode(qinfo, env, edns, repinfo, buf, temp, &r, 1,
1543 			LDNS_RCODE_NOERROR);
1544 	}
1545 	return local_encode(qinfo, env, edns, repinfo, buf, temp, lr->rrset, 1,
1546 		LDNS_RCODE_NOERROR);
1547 }
1548 
1549 /**
1550  * See if the local zone does not cover the name, eg. the name is not
1551  * in the zone and the zone is transparent */
1552 static int
1553 local_zone_does_not_cover(struct local_zone* z, struct query_info* qinfo,
1554 	int labs)
1555 {
1556 	struct local_data key;
1557 	struct local_data* ld = NULL;
1558 	struct local_rrset* lr = NULL;
1559 	if(z->type == local_zone_always_transparent)
1560 		return 1;
1561 	if(z->type != local_zone_transparent
1562 		&& z->type != local_zone_typetransparent
1563 		&& z->type != local_zone_inform)
1564 		return 0;
1565 	key.node.key = &key;
1566 	key.name = qinfo->qname;
1567 	key.namelen = qinfo->qname_len;
1568 	key.namelabs = labs;
1569 	ld = (struct local_data*)rbtree_search(&z->data, &key.node);
1570 	if(z->type == local_zone_transparent || z->type == local_zone_inform)
1571 		return (ld == NULL);
1572 	if(ld)
1573 		lr = local_data_find_type(ld, qinfo->qtype, 1);
1574 	/* local_zone_typetransparent */
1575 	return (lr == NULL);
1576 }
1577 
1578 static inline int
1579 local_zone_is_udp_query(struct comm_reply* repinfo) {
1580 	return repinfo != NULL
1581 			? (repinfo->c != NULL
1582 				? repinfo->c->type == comm_udp
1583 				: 0)
1584 			: 0;
1585 }
1586 
1587 int
1588 local_zones_zone_answer(struct local_zone* z, struct module_env* env,
1589 	struct query_info* qinfo, struct edns_data* edns,
1590 	struct comm_reply* repinfo, sldns_buffer* buf, struct regional* temp,
1591 	struct local_data* ld, enum localzone_type lz_type)
1592 {
1593 	if(lz_type == local_zone_deny ||
1594 		lz_type == local_zone_always_deny ||
1595 		lz_type == local_zone_inform_deny) {
1596 		/** no reply at all, signal caller by clearing buffer. */
1597 		sldns_buffer_clear(buf);
1598 		sldns_buffer_flip(buf);
1599 		return 1;
1600 	} else if(lz_type == local_zone_refuse
1601 		|| lz_type == local_zone_always_refuse) {
1602 		local_error_encode(qinfo, env, edns, repinfo, buf, temp,
1603 			LDNS_RCODE_REFUSED, (LDNS_RCODE_REFUSED|BIT_AA));
1604 		return 1;
1605 	} else if(lz_type == local_zone_static ||
1606 		lz_type == local_zone_redirect ||
1607 		lz_type == local_zone_inform_redirect ||
1608 		lz_type == local_zone_always_nxdomain ||
1609 		lz_type == local_zone_always_nodata ||
1610 		(lz_type == local_zone_truncate
1611 			&& local_zone_is_udp_query(repinfo))) {
1612 		/* for static, reply nodata or nxdomain
1613 		 * for redirect, reply nodata */
1614 		/* no additional section processing,
1615 		 * cname, dname or wildcard processing,
1616 		 * or using closest match for NSEC.
1617 		 * or using closest match for returning delegation downwards
1618 		 */
1619 		int rcode = (ld || lz_type == local_zone_redirect ||
1620 			lz_type == local_zone_inform_redirect ||
1621 			lz_type == local_zone_always_nodata ||
1622 			lz_type == local_zone_truncate)?
1623 			LDNS_RCODE_NOERROR:LDNS_RCODE_NXDOMAIN;
1624 		rcode = (lz_type == local_zone_truncate ? (rcode|BIT_TC) : rcode);
1625 		if(z != NULL && z->soa && z->soa_negative)
1626 			return local_encode(qinfo, env, edns, repinfo, buf, temp,
1627 				z->soa_negative, 0, rcode);
1628 		local_error_encode(qinfo, env, edns, repinfo, buf, temp, rcode,
1629 			(rcode|BIT_AA));
1630 		return 1;
1631 	} else if(lz_type == local_zone_typetransparent
1632 		|| lz_type == local_zone_always_transparent) {
1633 		/* no NODATA or NXDOMAINS for this zone type */
1634 		return 0;
1635 	} else if(lz_type == local_zone_always_null) {
1636 		/* 0.0.0.0 or ::0 or noerror/nodata for this zone type,
1637 		 * used for blocklists. */
1638 		if(qinfo->qtype == LDNS_RR_TYPE_A ||
1639 			qinfo->qtype == LDNS_RR_TYPE_AAAA) {
1640 			struct ub_packed_rrset_key lrr;
1641 			struct packed_rrset_data d;
1642 			time_t rr_ttl = 3600;
1643 			size_t rr_len = 0;
1644 			uint8_t rr_data[2+16] = {0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0};
1645 			uint8_t* rr_datas = rr_data;
1646 			memset(&lrr, 0, sizeof(lrr));
1647 			memset(&d, 0, sizeof(d));
1648 			lrr.entry.data = &d;
1649 			lrr.rk.dname = qinfo->qname;
1650 			lrr.rk.dname_len = qinfo->qname_len;
1651 			lrr.rk.type = htons(qinfo->qtype);
1652 			lrr.rk.rrset_class = htons(qinfo->qclass);
1653 			if(qinfo->qtype == LDNS_RR_TYPE_A) {
1654 				rr_len = 4;
1655 				sldns_write_uint16(rr_data, rr_len);
1656 				rr_len += 2;
1657 			} else {
1658 				rr_len = 16;
1659 				sldns_write_uint16(rr_data, rr_len);
1660 				rr_len += 2;
1661 			}
1662 			d.ttl = rr_ttl;
1663 			d.count = 1;
1664 			d.rr_len = &rr_len;
1665 			d.rr_data = &rr_datas;
1666 			d.rr_ttl = &rr_ttl;
1667 			return local_encode(qinfo, env, edns, repinfo, buf, temp,
1668 				&lrr, 1, LDNS_RCODE_NOERROR);
1669 		} else {
1670 			local_error_encode(qinfo, env, edns, repinfo, buf,
1671 				temp, LDNS_RCODE_NOERROR,
1672 				(LDNS_RCODE_NOERROR|BIT_AA));
1673 		}
1674 		return 1;
1675 	}
1676 	/* else lz_type == local_zone_transparent */
1677 
1678 	/* if the zone is transparent and the name exists, but the type
1679 	 * does not, then we should make this noerror/nodata */
1680 	if(ld && ld->rrsets) {
1681 		int rcode = LDNS_RCODE_NOERROR;
1682 		if(z != NULL && z->soa && z->soa_negative)
1683 			return local_encode(qinfo, env, edns, repinfo, buf, temp,
1684 				z->soa_negative, 0, rcode);
1685 		local_error_encode(qinfo, env, edns, repinfo, buf, temp, rcode,
1686 			(rcode|BIT_AA));
1687 		return 1;
1688 	}
1689 
1690 	/* stop here, and resolve further on */
1691 	return 0;
1692 }
1693 
1694 /** print log information for an inform zone query */
1695 static void
1696 lz_inform_print(struct local_zone* z, struct query_info* qinfo,
1697 	struct comm_reply* repinfo)
1698 {
1699 	char ip[128], txt[512];
1700 	char zname[LDNS_MAX_DOMAINLEN+1];
1701 	uint16_t port = ntohs(((struct sockaddr_in*)&repinfo->addr)->sin_port);
1702 	dname_str(z->name, zname);
1703 	addr_to_str(&repinfo->addr, repinfo->addrlen, ip, sizeof(ip));
1704 	snprintf(txt, sizeof(txt), "%s %s %s@%u", zname, local_zone_type2str(z->type), ip,
1705 		(unsigned)port);
1706 	log_nametypeclass(NO_VERBOSE, txt, qinfo->qname, qinfo->qtype, qinfo->qclass);
1707 }
1708 
1709 static enum localzone_type
1710 lz_type(uint8_t *taglist, size_t taglen, uint8_t *taglist2, size_t taglen2,
1711 	uint8_t *tagactions, size_t tagactionssize, enum localzone_type lzt,
1712 	struct comm_reply* repinfo, struct rbtree_type* override_tree,
1713 	int* tag, char** tagname, int num_tags)
1714 {
1715 	struct local_zone_override* lzo;
1716 	if(repinfo && override_tree) {
1717 		lzo = (struct local_zone_override*)addr_tree_lookup(
1718 			override_tree, &repinfo->addr, repinfo->addrlen);
1719 		if(lzo && lzo->type) {
1720 			verbose(VERB_ALGO, "local zone override to type %s",
1721 				local_zone_type2str(lzo->type));
1722 			return lzo->type;
1723 		}
1724 	}
1725 	if(!taglist || !taglist2)
1726 		return lzt;
1727 	return local_data_find_tag_action(taglist, taglen, taglist2, taglen2,
1728 		tagactions, tagactionssize, lzt, tag, tagname, num_tags);
1729 }
1730 
1731 enum localzone_type
1732 local_data_find_tag_action(const uint8_t* taglist, size_t taglen,
1733 	const uint8_t* taglist2, size_t taglen2, const uint8_t* tagactions,
1734 	size_t tagactionssize, enum localzone_type lzt, int* tag,
1735 	char* const* tagname, int num_tags)
1736 {
1737 	size_t i, j;
1738 	uint8_t tagmatch;
1739 
1740 	for(i=0; i<taglen && i<taglen2; i++) {
1741 		tagmatch = (taglist[i] & taglist2[i]);
1742 		for(j=0; j<8 && tagmatch>0; j++) {
1743 			if((tagmatch & 0x1)) {
1744 				*tag = (int)(i*8+j);
1745 				verbose(VERB_ALGO, "matched tag [%d] %s",
1746 					*tag, (*tag<num_tags?tagname[*tag]:"null"));
1747 				/* does this tag have a tag action? */
1748 				if(i*8+j < tagactionssize && tagactions
1749 				   && tagactions[i*8+j] != 0) {
1750 				  verbose(VERB_ALGO, "tag action [%d] %s to type %s",
1751 					*tag, (*tag<num_tags?tagname[*tag]:"null"),
1752 				  	local_zone_type2str(
1753 					(enum localzone_type)
1754 					tagactions[i*8+j]));
1755 				  return (enum localzone_type)tagactions[i*8+j];
1756 				}
1757 				return lzt;
1758 			}
1759 			tagmatch >>= 1;
1760 		}
1761 	}
1762 	return lzt;
1763 }
1764 
1765 int
1766 local_zones_answer(struct local_zones* zones, struct module_env* env,
1767 	struct query_info* qinfo, struct edns_data* edns, sldns_buffer* buf,
1768 	struct regional* temp, struct comm_reply* repinfo, uint8_t* taglist,
1769 	size_t taglen, uint8_t* tagactions, size_t tagactionssize,
1770 	struct config_strlist** tag_datas, size_t tag_datas_size,
1771 	char** tagname, int num_tags, struct view* view)
1772 {
1773 	/* see if query is covered by a zone,
1774 	 * 	if so:	- try to match (exact) local data
1775 	 * 		- look at zone type for negative response. */
1776 	int labs = dname_count_labels(qinfo->qname);
1777 	struct local_data* ld = NULL;
1778 	struct local_zone* z = NULL;
1779 	enum localzone_type lzt = local_zone_transparent;
1780 	int r, tag = -1;
1781 
1782 	if(view) {
1783 		lock_rw_rdlock(&view->lock);
1784 		if(view->local_zones &&
1785 			(z = local_zones_lookup(view->local_zones,
1786 			qinfo->qname, qinfo->qname_len, labs,
1787 			qinfo->qclass, qinfo->qtype))) {
1788 			lock_rw_rdlock(&z->lock);
1789 			lzt = z->type;
1790 		}
1791 		if(lzt == local_zone_noview) {
1792 			lock_rw_unlock(&z->lock);
1793 			z = NULL;
1794 		}
1795 		if(z && (lzt == local_zone_transparent ||
1796 			lzt == local_zone_typetransparent ||
1797 			lzt == local_zone_inform ||
1798 			lzt == local_zone_always_transparent) &&
1799 			local_zone_does_not_cover(z, qinfo, labs)) {
1800 			lock_rw_unlock(&z->lock);
1801 			z = NULL;
1802 		}
1803 		if(view->local_zones && !z && !view->isfirst){
1804 			lock_rw_unlock(&view->lock);
1805 			return 0;
1806 		}
1807 		if(z && verbosity >= VERB_ALGO) {
1808 			char zname[255+1];
1809 			dname_str(z->name, zname);
1810 			verbose(VERB_ALGO, "using localzone %s %s from view %s",
1811 				zname, local_zone_type2str(lzt), view->name);
1812 		}
1813 		lock_rw_unlock(&view->lock);
1814 	}
1815 	if(!z) {
1816 		/* try global local_zones tree */
1817 		lock_rw_rdlock(&zones->lock);
1818 		if(!(z = local_zones_tags_lookup(zones, qinfo->qname,
1819 			qinfo->qname_len, labs, qinfo->qclass, qinfo->qtype,
1820 			taglist, taglen, 0))) {
1821 			lock_rw_unlock(&zones->lock);
1822 			return 0;
1823 		}
1824 		lock_rw_rdlock(&z->lock);
1825 		lzt = lz_type(taglist, taglen, z->taglist, z->taglen,
1826 			tagactions, tagactionssize, z->type, repinfo,
1827 			z->override_tree, &tag, tagname, num_tags);
1828 		lock_rw_unlock(&zones->lock);
1829 		if(z && verbosity >= VERB_ALGO) {
1830 			char zname[255+1];
1831 			dname_str(z->name, zname);
1832 			verbose(VERB_ALGO, "using localzone %s %s", zname,
1833 				local_zone_type2str(lzt));
1834 		}
1835 	}
1836 	if((env->cfg->log_local_actions ||
1837 			lzt == local_zone_inform ||
1838 			lzt == local_zone_inform_deny ||
1839 			lzt == local_zone_inform_redirect)
1840 			&& repinfo)
1841 		lz_inform_print(z, qinfo, repinfo);
1842 
1843 	if(lzt != local_zone_always_refuse
1844 		&& lzt != local_zone_always_transparent
1845 		&& lzt != local_zone_always_nxdomain
1846 		&& lzt != local_zone_always_nodata
1847 		&& lzt != local_zone_always_deny
1848 		&& local_data_answer(z, env, qinfo, edns, repinfo, buf, temp, labs,
1849 			&ld, lzt, tag, tag_datas, tag_datas_size, tagname, num_tags)) {
1850 		lock_rw_unlock(&z->lock);
1851 		/* We should tell the caller that encode is deferred if we found
1852 		 * a local alias. */
1853 		return !qinfo->local_alias;
1854 	}
1855 	r = local_zones_zone_answer(z, env, qinfo, edns, repinfo, buf, temp, ld, lzt);
1856 	lock_rw_unlock(&z->lock);
1857 	return r && !qinfo->local_alias; /* see above */
1858 }
1859 
1860 const char* local_zone_type2str(enum localzone_type t)
1861 {
1862 	switch(t) {
1863 		case local_zone_unset: return "unset";
1864 		case local_zone_deny: return "deny";
1865 		case local_zone_refuse: return "refuse";
1866 		case local_zone_redirect: return "redirect";
1867 		case local_zone_transparent: return "transparent";
1868 		case local_zone_typetransparent: return "typetransparent";
1869 		case local_zone_static: return "static";
1870 		case local_zone_nodefault: return "nodefault";
1871 		case local_zone_inform: return "inform";
1872 		case local_zone_inform_deny: return "inform_deny";
1873 		case local_zone_inform_redirect: return "inform_redirect";
1874 		case local_zone_always_transparent: return "always_transparent";
1875 		case local_zone_always_refuse: return "always_refuse";
1876 		case local_zone_always_nxdomain: return "always_nxdomain";
1877 		case local_zone_always_nodata: return "always_nodata";
1878 		case local_zone_always_deny: return "always_deny";
1879 		case local_zone_always_null: return "always_null";
1880 		case local_zone_noview: return "noview";
1881 		case local_zone_truncate: return "truncate";
1882 		case local_zone_invalid: return "invalid";
1883 	}
1884 	return "badtyped";
1885 }
1886 
1887 int local_zone_str2type(const char* type, enum localzone_type* t)
1888 {
1889 	if(strcmp(type, "deny") == 0)
1890 		*t = local_zone_deny;
1891 	else if(strcmp(type, "refuse") == 0)
1892 		*t = local_zone_refuse;
1893 	else if(strcmp(type, "static") == 0)
1894 		*t = local_zone_static;
1895 	else if(strcmp(type, "transparent") == 0)
1896 		*t = local_zone_transparent;
1897 	else if(strcmp(type, "typetransparent") == 0)
1898 		*t = local_zone_typetransparent;
1899 	else if(strcmp(type, "redirect") == 0)
1900 		*t = local_zone_redirect;
1901 	else if(strcmp(type, "inform") == 0)
1902 		*t = local_zone_inform;
1903 	else if(strcmp(type, "inform_deny") == 0)
1904 		*t = local_zone_inform_deny;
1905 	else if(strcmp(type, "inform_redirect") == 0)
1906 		*t = local_zone_inform_redirect;
1907 	else if(strcmp(type, "always_transparent") == 0)
1908 		*t = local_zone_always_transparent;
1909 	else if(strcmp(type, "always_refuse") == 0)
1910 		*t = local_zone_always_refuse;
1911 	else if(strcmp(type, "always_nxdomain") == 0)
1912 		*t = local_zone_always_nxdomain;
1913 	else if(strcmp(type, "always_nodata") == 0)
1914 		*t = local_zone_always_nodata;
1915 	else if(strcmp(type, "always_deny") == 0)
1916 		*t = local_zone_always_deny;
1917 	else if(strcmp(type, "always_null") == 0)
1918 		*t = local_zone_always_null;
1919 	else if(strcmp(type, "noview") == 0)
1920 		*t = local_zone_noview;
1921 	else if(strcmp(type, "truncate") == 0)
1922 		*t = local_zone_truncate;
1923 	else if(strcmp(type, "nodefault") == 0)
1924 		*t = local_zone_nodefault;
1925 	else return 0;
1926 	return 1;
1927 }
1928 
1929 /** iterate over the kiddies of the given name and set their parent ptr */
1930 static void
1931 set_kiddo_parents(struct local_zone* z, struct local_zone* match,
1932 	struct local_zone* newp)
1933 {
1934 	/* both zones and z are locked already */
1935 	/* in the sorted rbtree, the kiddies of z are located after z */
1936 	/* z must be present in the tree */
1937 	struct local_zone* p = z;
1938 	p = (struct local_zone*)rbtree_next(&p->node);
1939 	while(p!=(struct local_zone*)RBTREE_NULL &&
1940 		p->dclass == z->dclass && dname_strict_subdomain(p->name,
1941 		p->namelabs, z->name, z->namelabs)) {
1942 		/* update parent ptr */
1943 		/* only when matches with existing parent pointer, so that
1944 		 * deeper child structures are not touched, i.e.
1945 		 * update of x, and a.x, b.x, f.b.x, g.b.x, c.x, y
1946 		 * gets to update a.x, b.x and c.x */
1947 		lock_rw_wrlock(&p->lock);
1948 		if(p->parent == match)
1949 			p->parent = newp;
1950 		lock_rw_unlock(&p->lock);
1951 		p = (struct local_zone*)rbtree_next(&p->node);
1952 	}
1953 }
1954 
1955 struct local_zone* local_zones_add_zone(struct local_zones* zones,
1956 	uint8_t* name, size_t len, int labs, uint16_t dclass,
1957 	enum localzone_type tp)
1958 {
1959 	/* create */
1960 	struct local_zone* z = local_zone_create(name, len, labs, tp, dclass);
1961 	if(!z) {
1962 		free(name);
1963 		return NULL;
1964 	}
1965 	lock_rw_wrlock(&z->lock);
1966 
1967 	/* find the closest parent */
1968 	z->parent = local_zones_find(zones, name, len, labs, dclass);
1969 
1970 	/* insert into the tree */
1971 	if(!rbtree_insert(&zones->ztree, &z->node)) {
1972 		/* duplicate entry! */
1973 		lock_rw_unlock(&z->lock);
1974 		local_zone_delete(z);
1975 		log_err("internal: duplicate entry in local_zones_add_zone");
1976 		return NULL;
1977 	}
1978 
1979 	/* set parent pointers right */
1980 	set_kiddo_parents(z, z->parent, z);
1981 
1982 	lock_rw_unlock(&z->lock);
1983 	return z;
1984 }
1985 
1986 void local_zones_del_zone(struct local_zones* zones, struct local_zone* z)
1987 {
1988 	/* fix up parents in tree */
1989 	lock_rw_wrlock(&z->lock);
1990 	set_kiddo_parents(z, z, z->parent);
1991 
1992 	/* remove from tree */
1993 	(void)rbtree_delete(&zones->ztree, z);
1994 
1995 	/* delete the zone */
1996 	lock_rw_unlock(&z->lock);
1997 	local_zone_delete(z);
1998 }
1999 
2000 int
2001 local_zones_add_RR(struct local_zones* zones, const char* rr)
2002 {
2003 	uint8_t* rr_name;
2004 	uint16_t rr_class, rr_type;
2005 	size_t len;
2006 	int labs;
2007 	struct local_zone* z;
2008 	int r;
2009 	if(!get_rr_nameclass(rr, &rr_name, &rr_class, &rr_type)) {
2010 		return 0;
2011 	}
2012 	labs = dname_count_size_labels(rr_name, &len);
2013 	/* could first try readlock then get writelock if zone does not exist,
2014 	 * but we do not add enough RRs (from multiple threads) to optimize */
2015 	lock_rw_wrlock(&zones->lock);
2016 	z = local_zones_lookup(zones, rr_name, len, labs, rr_class, rr_type);
2017 	if(!z) {
2018 		z = local_zones_add_zone(zones, rr_name, len, labs, rr_class,
2019 			local_zone_transparent);
2020 		if(!z) {
2021 			lock_rw_unlock(&zones->lock);
2022 			return 0;
2023 		}
2024 	} else {
2025 		free(rr_name);
2026 	}
2027 	lock_rw_wrlock(&z->lock);
2028 	lock_rw_unlock(&zones->lock);
2029 	r = lz_enter_rr_into_zone(z, rr);
2030 	lock_rw_unlock(&z->lock);
2031 	return r;
2032 }
2033 
2034 /** returns true if the node is terminal so no deeper domain names exist */
2035 static int
2036 is_terminal(struct local_data* d)
2037 {
2038 	/* for empty nonterminals, the deeper domain names are sorted
2039 	 * right after them, so simply check the next name in the tree
2040 	 */
2041 	struct local_data* n = (struct local_data*)rbtree_next(&d->node);
2042 	if(n == (struct local_data*)RBTREE_NULL)
2043 		return 1; /* last in tree, no deeper node */
2044 	if(dname_strict_subdomain(n->name, n->namelabs, d->name, d->namelabs))
2045 		return 0; /* there is a deeper node */
2046 	return 1;
2047 }
2048 
2049 /** delete empty terminals from tree when final data is deleted */
2050 static void
2051 del_empty_term(struct local_zone* z, struct local_data* d,
2052 	uint8_t* name, size_t len, int labs)
2053 {
2054 	while(d && d->rrsets == NULL && is_terminal(d)) {
2055 		/* is this empty nonterminal? delete */
2056 		/* note, no memory recycling in zone region */
2057 		(void)rbtree_delete(&z->data, d);
2058 
2059 		/* go up and to the next label */
2060 		if(dname_is_root(name))
2061 			return;
2062 		dname_remove_label(&name, &len);
2063 		labs--;
2064 		d = local_zone_find_data(z, name, len, labs);
2065 	}
2066 }
2067 
2068 /** find and remove type from list in domain struct */
2069 static void
2070 del_local_rrset(struct local_data* d, uint16_t dtype)
2071 {
2072 	struct local_rrset* prev=NULL, *p=d->rrsets;
2073 	while(p && ntohs(p->rrset->rk.type) != dtype) {
2074 		prev = p;
2075 		p = p->next;
2076 	}
2077 	if(!p)
2078 		return; /* rrset type not found */
2079 	/* unlink it */
2080 	if(prev) prev->next = p->next;
2081 	else d->rrsets = p->next;
2082 	/* no memory recycling for zone deletions ... */
2083 }
2084 
2085 void local_zones_del_data(struct local_zones* zones,
2086 	uint8_t* name, size_t len, int labs, uint16_t dclass)
2087 {
2088 	/* find zone */
2089 	struct local_zone* z;
2090 	struct local_data* d;
2091 
2092 	/* remove DS */
2093 	lock_rw_rdlock(&zones->lock);
2094 	z = local_zones_lookup(zones, name, len, labs, dclass, LDNS_RR_TYPE_DS);
2095 	if(z) {
2096 		lock_rw_wrlock(&z->lock);
2097 		d = local_zone_find_data(z, name, len, labs);
2098 		if(d) {
2099 			del_local_rrset(d, LDNS_RR_TYPE_DS);
2100 			del_empty_term(z, d, name, len, labs);
2101 		}
2102 		lock_rw_unlock(&z->lock);
2103 	}
2104 	lock_rw_unlock(&zones->lock);
2105 
2106 	/* remove other types */
2107 	lock_rw_rdlock(&zones->lock);
2108 	z = local_zones_lookup(zones, name, len, labs, dclass, 0);
2109 	if(!z) {
2110 		/* no such zone, we're done */
2111 		lock_rw_unlock(&zones->lock);
2112 		return;
2113 	}
2114 	lock_rw_wrlock(&z->lock);
2115 	lock_rw_unlock(&zones->lock);
2116 
2117 	/* find the domain */
2118 	d = local_zone_find_data(z, name, len, labs);
2119 	if(d) {
2120 		/* no memory recycling for zone deletions ... */
2121 		d->rrsets = NULL;
2122 		/* did we delete the soa record ? */
2123 		if(query_dname_compare(d->name, z->name) == 0) {
2124 			z->soa = NULL;
2125 			z->soa_negative = NULL;
2126 		}
2127 
2128 		/* cleanup the empty nonterminals for this name */
2129 		del_empty_term(z, d, name, len, labs);
2130 	}
2131 
2132 	lock_rw_unlock(&z->lock);
2133 }
2134