1 /* 2 * services/rpz.h - rpz service 3 * 4 * Copyright (c) 2019, NLnet Labs. All rights reserved. 5 * 6 * This software is open source. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * Redistributions of source code must retain the above copyright notice, 13 * this list of conditions and the following disclaimer. 14 * 15 * Redistributions in binary form must reproduce the above copyright notice, 16 * this list of conditions and the following disclaimer in the documentation 17 * and/or other materials provided with the distribution. 18 * 19 * Neither the name of the NLNET LABS nor the names of its contributors may 20 * be used to endorse or promote products derived from this software without 21 * specific prior written permission. 22 * 23 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 24 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 25 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR 26 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT 27 * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 28 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED 29 * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR 30 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF 31 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING 32 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 33 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 34 */ 35 36 /** 37 * \file 38 * 39 * This file contains functions to enable RPZ service. 40 */ 41 42 #ifndef SERVICES_RPZ_H 43 #define SERVICES_RPZ_H 44 45 #include "services/localzone.h" 46 #include "util/locks.h" 47 #include "util/log.h" 48 #include "util/config_file.h" 49 #include "services/authzone.h" 50 #include "sldns/sbuffer.h" 51 #include "daemon/stats.h" 52 #include "respip/respip.h" 53 54 /** 55 * RPZ triggers, only the QNAME trigger is currently supported in Unbound. 56 */ 57 enum rpz_trigger { 58 RPZ_QNAME_TRIGGER = 0, 59 /* unsupported triggers */ 60 RPZ_CLIENT_IP_TRIGGER, /* rpz-client-ip */ 61 RPZ_RESPONSE_IP_TRIGGER, /* rpz-ip */ 62 RPZ_NSDNAME_TRIGGER, /* rpz-nsdname */ 63 RPZ_NSIP_TRIGGER, /* rpz-nsip */ 64 RPZ_INVALID_TRIGGER, /* dname does not contain valid trigger */ 65 }; 66 67 /** 68 * RPZ actions. 69 */ 70 enum rpz_action { 71 RPZ_NXDOMAIN_ACTION = 0,/* CNAME . */ 72 RPZ_NODATA_ACTION, /* CNAME *. */ 73 RPZ_PASSTHRU_ACTION, /* CNAME rpz-passthru. */ 74 RPZ_DROP_ACTION, /* CNAME rpz-drop. */ 75 RPZ_TCP_ONLY_ACTION, /* CNAME rpz-tcp-only. */ 76 RPZ_INVALID_ACTION, /* CNAME with (child of) TLD starting with 77 "rpz-" in target, SOA, NS, DNAME and 78 DNSSEC-related records. */ 79 RPZ_LOCAL_DATA_ACTION, /* anything else */ 80 /* RPZ override actions */ 81 RPZ_DISABLED_ACTION, /* RPZ action disabled using override */ 82 RPZ_NO_OVERRIDE_ACTION, /* RPZ action no override*/ 83 RPZ_CNAME_OVERRIDE_ACTION, /* RPZ CNAME action override*/ 84 }; 85 86 /** 87 * RPZ containing policies. Pointed to from corresponding auth-zone. Part of a 88 * linked list to keep configuration order. Iterating or changing the linked 89 * list requires the rpz_lock from struct auth_zones. Changing items in this 90 * struct require the lock from struct auth_zone. 91 */ 92 struct rpz { 93 struct local_zones* local_zones; 94 struct respip_set* respip_set; 95 uint8_t* taglist; 96 size_t taglistlen; 97 enum rpz_action action_override; 98 struct ub_packed_rrset_key* cname_override; 99 int log; 100 char* log_name; 101 struct regional* region; 102 int disabled; 103 }; 104 105 /** 106 * Create policy from RR and add to this RPZ. 107 * @param r: the rpz to add the policy to. 108 * @param azname: dname of the auth-zone 109 * @param aznamelen: the length of the auth-zone name 110 * @param dname: dname of the RR 111 * @param dnamelen: length of the dname 112 * @param rr_type: RR type of the RR 113 * @param rr_class: RR class of the RR 114 * @param rr_ttl: TTL of the RR 115 * @param rdatawl: rdata of the RR, prepended with the rdata size 116 * @param rdatalen: length if the RR, including the prepended rdata size 117 * @param rr: the complete RR, for logging purposes 118 * @param rr_len: the length of the complete RR 119 * @return: 0 on error 120 */ 121 int rpz_insert_rr(struct rpz* r, uint8_t* azname, size_t aznamelen, uint8_t* dname, 122 size_t dnamelen, uint16_t rr_type, uint16_t rr_class, uint32_t rr_ttl, 123 uint8_t* rdatawl, size_t rdatalen, uint8_t* rr, size_t rr_len); 124 125 /** 126 * Delete policy matching RR, used for IXFR. 127 * @param r: the rpz to add the policy to. 128 * @param aznamelen: the length of the auth-zone name 129 * @param dname: dname of the RR 130 * @param dnamelen: length of the dname 131 * @param rr_type: RR type of the RR 132 * @param rr_class: RR class of the RR 133 * @param rdatawl: rdata of the RR, prepended with the rdata size 134 * @param rdatalen: length if the RR, including the prepended rdata size 135 */ 136 void rpz_remove_rr(struct rpz* r, size_t aznamelen, uint8_t* dname, 137 size_t dnamelen, uint16_t rr_type, uint16_t rr_class, uint8_t* rdatawl, 138 size_t rdatalen); 139 140 /** 141 * Walk over the RPZ zones to find and apply a QNAME trigger policy. 142 * @param az: auth_zones struct, containing first RPZ item and RPZ lock 143 * @param env: module env 144 * @param qinfo: qinfo containing qname and qtype 145 * @param edns: edns data 146 * @param buf: buffer to write answer to 147 * @param temp: scratchpad 148 * @param repinfo: reply info 149 * @param taglist: taglist to lookup. 150 * @param taglen: lenth of taglist. 151 * @param stats: worker stats struct 152 * @return: 1 if client answer is ready, 0 to continue resolving 153 */ 154 int rpz_apply_qname_trigger(struct auth_zones* az, struct module_env* env, 155 struct query_info* qinfo, struct edns_data* edns, sldns_buffer* buf, 156 struct regional* temp, struct comm_reply* repinfo, 157 uint8_t* taglist, size_t taglen, struct ub_server_stats* stats); 158 159 /** 160 * Delete RPZ 161 * @param r: RPZ struct to delete 162 */ 163 void rpz_delete(struct rpz* r); 164 165 /** 166 * Clear local-zones and respip data in RPZ, used after reloading file or 167 * AXFR/HTTP transfer. 168 * @param r: RPZ to use 169 */ 170 int rpz_clear(struct rpz* r); 171 172 /** 173 * Create RPZ. RPZ must be added to linked list after creation. 174 * @return: the newly created RPZ 175 */ 176 struct rpz* rpz_create(struct config_auth* p); 177 178 /** 179 * String for RPZ action enum 180 * @param a: RPZ action to get string for 181 * @return: string for RPZ action 182 */ 183 const char* rpz_action_to_string(enum rpz_action a); 184 185 enum rpz_action 186 respip_action_to_rpz_action(enum respip_action a); 187 188 /** 189 * Prepare RPZ after procesing feed content. 190 * @param r: RPZ to use 191 */ 192 void rpz_finish_config(struct rpz* r); 193 194 /** 195 * Classify respip action for RPZ action 196 * @param a: RPZ action 197 * @return: the respip action 198 */ 199 enum respip_action 200 rpz_action_to_respip_action(enum rpz_action a); 201 202 /** 203 * Enable RPZ 204 * @param r: RPZ struct to enable 205 */ 206 void rpz_enable(struct rpz* r); 207 208 /** 209 * Disable RPZ 210 * @param r: RPZ struct to disable 211 */ 212 void rpz_disable(struct rpz* r); 213 214 #endif /* SERVICES_RPZ_H */ 215