1 /* 2 * services/localzone.h - local zones authority service. 3 * 4 * Copyright (c) 2007, NLnet Labs. All rights reserved. 5 * 6 * This software is open source. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * Redistributions of source code must retain the above copyright notice, 13 * this list of conditions and the following disclaimer. 14 * 15 * Redistributions in binary form must reproduce the above copyright notice, 16 * this list of conditions and the following disclaimer in the documentation 17 * and/or other materials provided with the distribution. 18 * 19 * Neither the name of the NLNET LABS nor the names of its contributors may 20 * be used to endorse or promote products derived from this software without 21 * specific prior written permission. 22 * 23 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 24 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 25 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR 26 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT 27 * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 28 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED 29 * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR 30 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF 31 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING 32 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 33 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 34 */ 35 36 /** 37 * \file 38 * 39 * This file contains functions to enable local zone authority service. 40 */ 41 42 #ifndef SERVICES_LOCALZONE_H 43 #define SERVICES_LOCALZONE_H 44 #include "util/rbtree.h" 45 #include "util/locks.h" 46 #include "util/storage/dnstree.h" 47 #include "util/module.h" 48 #include "services/view.h" 49 #include "sldns/sbuffer.h" 50 struct packed_rrset_data; 51 struct ub_packed_rrset_key; 52 struct regional; 53 struct config_file; 54 struct edns_data; 55 struct query_info; 56 struct sldns_buffer; 57 struct comm_reply; 58 struct config_strlist; 59 60 /** 61 * Local zone type 62 * This type determines processing for queries that did not match 63 * local-data directly. 64 */ 65 enum localzone_type { 66 /** unset type, used for unset tag_action elements */ 67 local_zone_unset = 0, 68 /** drop query */ 69 local_zone_deny, 70 /** answer with error */ 71 local_zone_refuse, 72 /** answer nxdomain or nodata */ 73 local_zone_static, 74 /** resolve normally */ 75 local_zone_transparent, 76 /** do not block types at localdata names */ 77 local_zone_typetransparent, 78 /** answer with data at zone apex */ 79 local_zone_redirect, 80 /** remove default AS112 blocking contents for zone 81 * nodefault is used in config not during service. */ 82 local_zone_nodefault, 83 /** log client address, but no block (transparent) */ 84 local_zone_inform, 85 /** log client address, and block (drop) */ 86 local_zone_inform_deny, 87 /** log client address, and direct */ 88 local_zone_inform_redirect, 89 /** resolve normally, even when there is local data */ 90 local_zone_always_transparent, 91 /** answer with error, even when there is local data */ 92 local_zone_always_refuse, 93 /** answer with nxdomain, even when there is local data */ 94 local_zone_always_nxdomain, 95 /** answer with noerror/nodata, even when there is local data */ 96 local_zone_always_nodata, 97 /** drop query, even when there is local data */ 98 local_zone_always_deny, 99 /** answer with 0.0.0.0 or ::0 or noerror/nodata, even when there is 100 * local data */ 101 local_zone_always_null, 102 /** answer not from the view, but global or no-answer */ 103 local_zone_noview, 104 /** truncate the response; client should retry via tcp */ 105 local_zone_truncate, 106 /** Invalid type, cannot be used to generate answer */ 107 local_zone_invalid 108 }; 109 110 /** 111 * Authoritative local zones storage, shared. 112 */ 113 struct local_zones { 114 /** lock on the localzone tree */ 115 lock_rw_type lock; 116 /** rbtree of struct local_zone */ 117 rbtree_type ztree; 118 }; 119 120 /** 121 * Local zone. A locally served authoritative zone. 122 */ 123 struct local_zone { 124 /** rbtree node, key is name and class */ 125 rbnode_type node; 126 /** parent zone, if any. */ 127 struct local_zone* parent; 128 129 /** zone name, in uncompressed wireformat */ 130 uint8_t* name; 131 /** length of zone name */ 132 size_t namelen; 133 /** number of labels in zone name */ 134 int namelabs; 135 /** the class of this zone. 136 * uses 'dclass' to not conflict with c++ keyword class. */ 137 uint16_t dclass; 138 139 /** lock on the data in the structure 140 * For the node, parent, name, namelen, namelabs, dclass, you 141 * need to also hold the zones_tree lock to change them (or to 142 * delete this zone) */ 143 lock_rw_type lock; 144 145 /** how to process zone */ 146 enum localzone_type type; 147 /** tag bitlist */ 148 uint8_t* taglist; 149 /** length of the taglist (in bytes) */ 150 size_t taglen; 151 /** netblock addr_tree with struct local_zone_override information 152 * or NULL if there are no override elements */ 153 struct rbtree_type* override_tree; 154 155 /** in this region the zone's data is allocated. 156 * the struct local_zone itself is malloced. */ 157 struct regional* region; 158 /** local data for this zone 159 * rbtree of struct local_data */ 160 rbtree_type data; 161 /** if data contains zone apex SOA data, this is a ptr to it. */ 162 struct ub_packed_rrset_key* soa; 163 /** if data contains zone apex SOA data, this is a ptr to an 164 * artificial negative SOA rrset (TTL is the minimum of the TTL and the 165 * SOA.MINIMUM). */ 166 struct ub_packed_rrset_key* soa_negative; 167 }; 168 169 /** 170 * Local data. One domain name, and the RRs to go with it. 171 */ 172 struct local_data { 173 /** rbtree node, key is name only */ 174 rbnode_type node; 175 /** domain name */ 176 uint8_t* name; 177 /** length of name */ 178 size_t namelen; 179 /** number of labels in name */ 180 int namelabs; 181 /** the data rrsets, with different types, linked list. 182 * If this list is NULL, the node is an empty non-terminal. */ 183 struct local_rrset* rrsets; 184 }; 185 186 /** 187 * A local data RRset 188 */ 189 struct local_rrset { 190 /** next in list */ 191 struct local_rrset* next; 192 /** RRset data item */ 193 struct ub_packed_rrset_key* rrset; 194 }; 195 196 /** 197 * Local zone override information 198 */ 199 struct local_zone_override { 200 /** node in addrtree */ 201 struct addr_tree_node node; 202 /** override for local zone type */ 203 enum localzone_type type; 204 }; 205 206 /** 207 * Create local zones storage 208 * @return new struct or NULL on error. 209 */ 210 struct local_zones* local_zones_create(void); 211 212 /** 213 * Delete local zones storage 214 * @param zones: to delete. 215 */ 216 void local_zones_delete(struct local_zones* zones); 217 218 /** 219 * Apply config settings; setup the local authoritative data. 220 * Takes care of locking. 221 * @param zones: is set up. 222 * @param cfg: config data. 223 * @return false on error. 224 */ 225 int local_zones_apply_cfg(struct local_zones* zones, struct config_file* cfg); 226 227 /** 228 * Compare two local_zone entries in rbtree. Sort hierarchical but not 229 * canonical 230 * @param z1: zone 1 231 * @param z2: zone 2 232 * @return: -1, 0, +1 comparison value. 233 */ 234 int local_zone_cmp(const void* z1, const void* z2); 235 236 /** 237 * Compare two local_data entries in rbtree. Sort canonical. 238 * @param d1: data 1 239 * @param d2: data 2 240 * @return: -1, 0, +1 comparison value. 241 */ 242 int local_data_cmp(const void* d1, const void* d2); 243 244 /** 245 * Delete one zone 246 * @param z: to delete. 247 */ 248 void local_zone_delete(struct local_zone* z); 249 250 /** 251 * Lookup zone that contains the given name, class and taglist. 252 * User must lock the tree or result zone. 253 * @param zones: the zones tree 254 * @param name: dname to lookup 255 * @param len: length of name. 256 * @param labs: labelcount of name. 257 * @param dclass: class to lookup. 258 * @param dtype: type to lookup, if type DS a zone higher is used for zonecuts. 259 * @param taglist: taglist to lookup. 260 * @param taglen: length of taglist. 261 * @param ignoretags: lookup zone by name and class, regardless the 262 * local-zone's tags. 263 * @return closest local_zone or NULL if no covering zone is found. 264 */ 265 struct local_zone* local_zones_tags_lookup(struct local_zones* zones, 266 uint8_t* name, size_t len, int labs, uint16_t dclass, uint16_t dtype, 267 uint8_t* taglist, size_t taglen, int ignoretags); 268 269 /** 270 * Lookup zone that contains the given name, class. 271 * User must lock the tree or result zone. 272 * @param zones: the zones tree 273 * @param name: dname to lookup 274 * @param len: length of name. 275 * @param labs: labelcount of name. 276 * @param dclass: class to lookup. 277 * @param dtype: type of the record, if type DS then a zone higher up is found 278 * pass 0 to just plain find a zone for a name. 279 * @return closest local_zone or NULL if no covering zone is found. 280 */ 281 struct local_zone* local_zones_lookup(struct local_zones* zones, 282 uint8_t* name, size_t len, int labs, uint16_t dclass, uint16_t dtype); 283 284 /** 285 * Debug helper. Print all zones 286 * Takes care of locking. 287 * @param zones: the zones tree 288 */ 289 void local_zones_print(struct local_zones* zones); 290 291 /** 292 * Answer authoritatively for local zones. 293 * Takes care of locking. 294 * @param zones: the stored zones (shared, read only). 295 * @param env: the module environment. 296 * @param qinfo: query info (parsed). 297 * @param edns: edns info (parsed). 298 * @param buf: buffer with query ID and flags, also for reply. 299 * @param temp: temporary storage region. 300 * @param repinfo: source address for checks. may be NULL. 301 * @param taglist: taglist for checks. May be NULL. 302 * @param taglen: length of the taglist. 303 * @param tagactions: local zone actions for tags. May be NULL. 304 * @param tagactionssize: length of the tagactions. 305 * @param tag_datas: array per tag of strlist with rdata strings. or NULL. 306 * @param tag_datas_size: size of tag_datas array. 307 * @param tagname: array of tag name strings (for debug output). 308 * @param num_tags: number of items in tagname array. 309 * @param view: answer using this view. May be NULL. 310 * @return true if answer is in buffer. false if query is not answered 311 * by authority data. If the reply should be dropped altogether, the return 312 * value is true, but the buffer is cleared (empty). 313 * It can also return true if a non-exact alias answer is found. In this 314 * case qinfo->local_alias points to the corresponding alias RRset but the 315 * answer is NOT encoded in buffer. It's the caller's responsibility to 316 * complete the alias chain (if needed) and encode the final set of answer. 317 * Data pointed to by qinfo->local_alias is allocated in 'temp' or refers to 318 * configuration data. So the caller will need to make a deep copy of it 319 * if it needs to keep it beyond the lifetime of 'temp' or a dynamic update 320 * to local zone data. 321 */ 322 int local_zones_answer(struct local_zones* zones, struct module_env* env, 323 struct query_info* qinfo, struct edns_data* edns, struct sldns_buffer* buf, 324 struct regional* temp, struct comm_reply* repinfo, uint8_t* taglist, 325 size_t taglen, uint8_t* tagactions, size_t tagactionssize, 326 struct config_strlist** tag_datas, size_t tag_datas_size, 327 char** tagname, int num_tags, struct view* view); 328 329 /** 330 * Answer using the local zone only (not local data used). 331 * @param z: zone for query. 332 * @param env: module environment. 333 * @param qinfo: query. 334 * @param edns: edns from query. 335 * @param repinfo: source address for checks. may be NULL. 336 * @param buf: buffer for answer. 337 * @param temp: temp region for encoding. 338 * @param ld: local data, if NULL, no such name exists in localdata. 339 * @param lz_type: type of the local zone. 340 * @return 1 if a reply is to be sent, 0 if not. 341 */ 342 int 343 local_zones_zone_answer(struct local_zone* z, struct module_env* env, 344 struct query_info* qinfo, struct edns_data* edns, 345 struct comm_reply* repinfo, sldns_buffer* buf, struct regional* temp, 346 struct local_data* ld, enum localzone_type lz_type); 347 348 /** 349 * Parse the string into localzone type. 350 * 351 * @param str: string to parse 352 * @param t: local zone type returned here. 353 * @return 0 on parse error. 354 */ 355 int local_zone_str2type(const char* str, enum localzone_type* t); 356 357 /** 358 * Print localzone type to a string. Pointer to a constant string. 359 * 360 * @param t: local zone type. 361 * @return constant string that describes type. 362 */ 363 const char* local_zone_type2str(enum localzone_type t); 364 365 /** 366 * Find zone that with exactly given name, class. 367 * User must lock the tree or result zone. 368 * @param zones: the zones tree 369 * @param name: dname to lookup 370 * @param len: length of name. 371 * @param labs: labelcount of name. 372 * @param dclass: class to lookup. 373 * @return the exact local_zone or NULL. 374 */ 375 struct local_zone* local_zones_find(struct local_zones* zones, 376 uint8_t* name, size_t len, int labs, uint16_t dclass); 377 378 /** 379 * Find zone that with exactly or smaller name/class 380 * User must lock the tree or result zone. 381 * @param zones: the zones tree 382 * @param name: dname to lookup 383 * @param len: length of name. 384 * @param labs: labelcount of name. 385 * @param dclass: class to lookup. 386 * @param exact: 1 on return is this is an exact match. 387 * @return the exact or smaller local_zone or NULL. 388 */ 389 struct local_zone* 390 local_zones_find_le(struct local_zones* zones, 391 uint8_t* name, size_t len, int labs, uint16_t dclass, 392 int* exact); 393 394 /** 395 * Add a new zone. Caller must hold the zones lock. 396 * Adjusts the other zones as well (parent pointers) after insertion. 397 * The zone must NOT exist (returns NULL and logs error). 398 * @param zones: the zones tree 399 * @param name: dname to add 400 * @param len: length of name. 401 * @param labs: labelcount of name. 402 * @param dclass: class to add. 403 * @param tp: type. 404 * @return local_zone or NULL on error, caller must printout memory error. 405 */ 406 struct local_zone* local_zones_add_zone(struct local_zones* zones, 407 uint8_t* name, size_t len, int labs, uint16_t dclass, 408 enum localzone_type tp); 409 410 /** 411 * Delete a zone. Caller must hold the zones lock. 412 * Adjusts the other zones as well (parent pointers) after insertion. 413 * @param zones: the zones tree 414 * @param zone: the zone to delete from tree. Also deletes zone from memory. 415 */ 416 void local_zones_del_zone(struct local_zones* zones, struct local_zone* zone); 417 418 /** 419 * Add RR data into the localzone data. 420 * Looks up the zone, if no covering zone, a transparent zone with the 421 * name of the RR is created. 422 * @param zones: the zones tree. Not locked by caller. 423 * @param rr: string with on RR. 424 * @return false on failure. 425 */ 426 int local_zones_add_RR(struct local_zones* zones, const char* rr); 427 428 /** 429 * Remove data from domain name in the tree. 430 * All types are removed. No effect if zone or name does not exist. 431 * @param zones: zones tree. 432 * @param name: dname to remove 433 * @param len: length of name. 434 * @param labs: labelcount of name. 435 * @param dclass: class to remove. 436 */ 437 void local_zones_del_data(struct local_zones* zones, 438 uint8_t* name, size_t len, int labs, uint16_t dclass); 439 440 441 /** 442 * Form wireformat from text format domain name. 443 * @param str: the domain name in text "www.example.com" 444 * @param res: resulting wireformat is stored here with malloc. 445 * @param len: length of resulting wireformat. 446 * @param labs: number of labels in resulting wireformat. 447 * @return false on error, syntax or memory. Also logged. 448 */ 449 int parse_dname(const char* str, uint8_t** res, size_t* len, int* labs); 450 451 /** 452 * Find local data tag string match for the given type (in qinfo) in the list. 453 * If found, 'r' will be filled with corresponding rrset information. 454 * @param qinfo: contains name, type, and class for the data 455 * @param list: stores local tag data to be searched 456 * @param r: rrset key to be filled for matched data 457 * @param temp: region to allocate rrset in 'r' 458 * @return 1 if a match is found and rrset is built; otherwise 0 including 459 * errors. 460 */ 461 int local_data_find_tag_datas(const struct query_info* qinfo, 462 struct config_strlist* list, struct ub_packed_rrset_key* r, 463 struct regional* temp); 464 465 /** 466 * See if two sets of tag lists (in the form of bitmap) have the same tag that 467 * has an action. If so, '*tag' will be set to the found tag index, and the 468 * corresponding action will be returned in the form of local zone type. 469 * Otherwise the passed type (lzt) will be returned as the default action. 470 * Pointers except tagactions must not be NULL. 471 * @param taglist: 1st list of tags 472 * @param taglen: size of taglist in bytes 473 * @param taglist2: 2nd list of tags 474 * @param taglen2: size of taglist2 in bytes 475 * @param tagactions: local data actions for tags. May be NULL. 476 * @param tagactionssize: length of the tagactions. 477 * @param lzt: default action (local zone type) if no tag action is found. 478 * @param tag: see above. 479 * @param tagname: array of tag name strings (for debug output). 480 * @param num_tags: number of items in tagname array. 481 * @return found tag action or the default action. 482 */ 483 enum localzone_type local_data_find_tag_action(const uint8_t* taglist, 484 size_t taglen, const uint8_t* taglist2, size_t taglen2, 485 const uint8_t* tagactions, size_t tagactionssize, 486 enum localzone_type lzt, int* tag, char* const* tagname, int num_tags); 487 488 /** 489 * Enter defaults to local zone. 490 * @param zones: to add defaults to 491 * @param cfg: containing list of zones to exclude from default set. 492 * @return 1 on success; 0 otherwise. 493 */ 494 int local_zone_enter_defaults(struct local_zones* zones, 495 struct config_file* cfg); 496 497 /** 498 * Parses resource record string into wire format, also returning its field values. 499 * @param str: input resource record 500 * @param nm: domain name field 501 * @param type: record type field 502 * @param dclass: record class field 503 * @param ttl: ttl field 504 * @param rr: buffer for the parsed rr in wire format 505 * @param len: buffer length 506 * @param rdata: rdata field 507 * @param rdata_len: rdata field length 508 * @return 1 on success; 0 otherwise. 509 */ 510 int rrstr_get_rr_content(const char* str, uint8_t** nm, uint16_t* type, 511 uint16_t* dclass, time_t* ttl, uint8_t* rr, size_t len, 512 uint8_t** rdata, size_t* rdata_len); 513 514 /** 515 * Insert specified rdata into the specified resource record. 516 * @param region: allocator 517 * @param pd: data portion of the destination resource record 518 * @param rdata: source rdata 519 * @param rdata_len: source rdata length 520 * @param ttl: time to live 521 * @param rrstr: resource record in text form (for logging) 522 * @return 1 on success; 0 otherwise. 523 */ 524 int rrset_insert_rr(struct regional* region, struct packed_rrset_data* pd, 525 uint8_t* rdata, size_t rdata_len, time_t ttl, const char* rrstr); 526 527 /** 528 * Remove RR from rrset that is created using localzone's rrset_insert_rr. 529 * @param pd: the RRset containing the RR to remove 530 * @param index: index of RR to remove 531 * @return: 1 on success; 0 otherwise. 532 */ 533 int 534 local_rrset_remove_rr(struct packed_rrset_data* pd, size_t index); 535 536 /** 537 * Valid response ip actions for the IP-response-driven-action feature; 538 * defined here instead of in the respip module to enable sharing of enum 539 * values with the localzone_type enum. 540 * Note that these values except 'none' are the same as localzone types of 541 * the 'same semantics'. It's intentional as we use these values via 542 * access-control-tags, which can be shared for both response ip actions and 543 * local zones. 544 */ 545 enum respip_action { 546 /** no respip action */ 547 respip_none = local_zone_unset, 548 /** don't answer */ 549 respip_deny = local_zone_deny, 550 /** redirect as per provided data */ 551 respip_redirect = local_zone_redirect, 552 /** log query source and answer query */ 553 respip_inform = local_zone_inform, 554 /** log query source and don't answer query */ 555 respip_inform_deny = local_zone_inform_deny, 556 /** log query source and redirect */ 557 respip_inform_redirect = local_zone_inform_redirect, 558 /** resolve normally, even when there is response-ip data */ 559 respip_always_transparent = local_zone_always_transparent, 560 /** answer with 'refused' response */ 561 respip_always_refuse = local_zone_always_refuse, 562 /** answer with 'no such domain' response */ 563 respip_always_nxdomain = local_zone_always_nxdomain, 564 /** answer with nodata response */ 565 respip_always_nodata = local_zone_always_nodata, 566 /** answer with nodata response */ 567 respip_always_deny = local_zone_always_deny, 568 /** RPZ: truncate answer in order to force switch to tcp */ 569 respip_truncate = local_zone_truncate, 570 571 /* The rest of the values are only possible as 572 * access-control-tag-action */ 573 574 /** serves response data (if any), else, drops queries. */ 575 respip_refuse = local_zone_refuse, 576 /** serves response data, else, nodata answer. */ 577 respip_static = local_zone_static, 578 /** gives response data (if any), else nodata answer. */ 579 respip_transparent = local_zone_transparent, 580 /** gives response data (if any), else nodata answer. */ 581 respip_typetransparent = local_zone_typetransparent, 582 /** type invalid */ 583 respip_invalid = local_zone_invalid, 584 }; 585 586 /** 587 * Get local data from local zone and encode answer. 588 * @param z: local zone to use 589 * @param env: module env 590 * @param qinfo: qinfo 591 * @param edns: edns data, for message encoding 592 * @param repinfo: reply info, for message encoding 593 * @param buf: commpoint buffer 594 * @param temp: scratchpad region 595 * @param labs: number of labels in qname 596 * @param ldp: where to store local data 597 * @param lz_type: type of local zone 598 * @param tag: matching tag index 599 * @param tag_datas: alc specific tag data list 600 * @param tag_datas_size: size of tag_datas 601 * @param tagname: list of names of tags, for logging purpose 602 * @param num_tags: number of tags 603 * @return 1 on success 604 */ 605 int 606 local_data_answer(struct local_zone* z, struct module_env* env, 607 struct query_info* qinfo, struct edns_data* edns, 608 struct comm_reply* repinfo, sldns_buffer* buf, 609 struct regional* temp, int labs, struct local_data** ldp, 610 enum localzone_type lz_type, int tag, struct config_strlist** tag_datas, 611 size_t tag_datas_size, char** tagname, int num_tags); 612 613 /** 614 * Add RR to local zone. 615 * @param z: local zone to add RR to 616 * @param nm: dname of RR 617 * @param nmlen: length of nm 618 * @param nmlabs: number of labels of nm 619 * @param rrtype: RR type 620 * @param rrclass: RR class 621 * @param ttl: TTL of RR to add 622 * @param rdata: RDATA of RR to add 623 * @param rdata_len: length of rdata 624 * @param rrstr: RR in string format, for logging 625 * @return: 1 on success 626 */ 627 int 628 local_zone_enter_rr(struct local_zone* z, uint8_t* nm, size_t nmlen, 629 int nmlabs, uint16_t rrtype, uint16_t rrclass, time_t ttl, 630 uint8_t* rdata, size_t rdata_len, const char* rrstr); 631 632 /** 633 * Find a data node by exact name for a local zone 634 * @param z: local_zone containing data tree 635 * @param nm: name of local-data element to find 636 * @param nmlen: length of nm 637 * @param nmlabs: labs of nm 638 * @return local_data on exact match, NULL otherwise. 639 */ 640 struct local_data* 641 local_zone_find_data(struct local_zone* z, uint8_t* nm, size_t nmlen, int nmlabs); 642 #endif /* SERVICES_LOCALZONE_H */ 643