1 /* 2 * services/rpz.h - rpz service 3 * 4 * Copyright (c) 2019, NLnet Labs. All rights reserved. 5 * 6 * This software is open source. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * Redistributions of source code must retain the above copyright notice, 13 * this list of conditions and the following disclaimer. 14 * 15 * Redistributions in binary form must reproduce the above copyright notice, 16 * this list of conditions and the following disclaimer in the documentation 17 * and/or other materials provided with the distribution. 18 * 19 * Neither the name of the NLNET LABS nor the names of its contributors may 20 * be used to endorse or promote products derived from this software without 21 * specific prior written permission. 22 * 23 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 24 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 25 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR 26 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT 27 * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 28 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED 29 * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR 30 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF 31 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING 32 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 33 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 34 */ 35 36 /** 37 * \file 38 * 39 * This file contains functions to enable RPZ service. 40 */ 41 42 #ifndef SERVICES_RPZ_H 43 #define SERVICES_RPZ_H 44 45 #include "services/localzone.h" 46 #include "util/locks.h" 47 #include "util/log.h" 48 #include "util/config_file.h" 49 #include "services/authzone.h" 50 #include "sldns/sbuffer.h" 51 #include "daemon/stats.h" 52 #include "respip/respip.h" 53 struct iter_qstate; 54 55 /** 56 * RPZ triggers, only the QNAME trigger is currently supported in Unbound. 57 */ 58 enum rpz_trigger { 59 RPZ_QNAME_TRIGGER = 0, 60 /* unsupported triggers */ 61 RPZ_CLIENT_IP_TRIGGER, /* rpz-client-ip */ 62 RPZ_RESPONSE_IP_TRIGGER, /* rpz-ip */ 63 RPZ_NSDNAME_TRIGGER, /* rpz-nsdname */ 64 RPZ_NSIP_TRIGGER, /* rpz-nsip */ 65 RPZ_INVALID_TRIGGER, /* dname does not contain valid trigger */ 66 }; 67 68 /** 69 * RPZ actions. 70 */ 71 enum rpz_action { 72 RPZ_NXDOMAIN_ACTION = 0,/* CNAME . */ 73 RPZ_NODATA_ACTION, /* CNAME *. */ 74 RPZ_PASSTHRU_ACTION, /* CNAME rpz-passthru. */ 75 RPZ_DROP_ACTION, /* CNAME rpz-drop. */ 76 RPZ_TCP_ONLY_ACTION, /* CNAME rpz-tcp-only. */ 77 RPZ_INVALID_ACTION, /* CNAME with (child of) TLD starting with 78 "rpz-" in target, SOA, NS, DNAME and 79 DNSSEC-related records. */ 80 RPZ_LOCAL_DATA_ACTION, /* anything else */ 81 /* RPZ override actions */ 82 RPZ_DISABLED_ACTION, /* RPZ action disabled using override */ 83 RPZ_NO_OVERRIDE_ACTION, /* RPZ action no override*/ 84 RPZ_CNAME_OVERRIDE_ACTION, /* RPZ CNAME action override*/ 85 }; 86 87 struct clientip_synthesized_rrset{ 88 struct regional* region; 89 struct rbtree_type entries; 90 lock_rw_type lock; /* lock on the respip tree */ 91 }; 92 93 struct clientip_synthesized_rr { 94 /** node in address tree */ 95 struct addr_tree_node node; 96 /** lock on the node item */ 97 lock_rw_type lock; 98 /** tag bitlist */ 99 uint8_t* taglist; 100 /** length of the taglist (in bytes) */ 101 size_t taglen; 102 /** action for this address span */ 103 enum rpz_action action; 104 /** "local data" for this node */ 105 struct local_rrset* data; 106 }; 107 108 /** 109 * RPZ containing policies. Pointed to from corresponding auth-zone. Part of a 110 * linked list to keep configuration order. Iterating or changing the linked 111 * list requires the rpz_lock from struct auth_zones. Changing items in this 112 * struct require the lock from struct auth_zone. 113 */ 114 struct rpz { 115 struct local_zones* local_zones; 116 struct respip_set* respip_set; 117 struct clientip_synthesized_rrset* client_set; 118 struct clientip_synthesized_rrset* ns_set; 119 struct local_zones* nsdname_zones; 120 uint8_t* taglist; 121 size_t taglistlen; 122 enum rpz_action action_override; 123 struct ub_packed_rrset_key* cname_override; 124 int log; 125 char* log_name; 126 /** signal NXDOMAIN blocked with unset RA flag */ 127 int signal_nxdomain_ra; 128 struct regional* region; 129 int disabled; 130 }; 131 132 /** 133 * Create policy from RR and add to this RPZ. 134 * @param r: the rpz to add the policy to. 135 * @param azname: dname of the auth-zone 136 * @param aznamelen: the length of the auth-zone name 137 * @param dname: dname of the RR 138 * @param dnamelen: length of the dname 139 * @param rr_type: RR type of the RR 140 * @param rr_class: RR class of the RR 141 * @param rr_ttl: TTL of the RR 142 * @param rdatawl: rdata of the RR, prepended with the rdata size 143 * @param rdatalen: length if the RR, including the prepended rdata size 144 * @param rr: the complete RR, for logging purposes 145 * @param rr_len: the length of the complete RR 146 * @return: 0 on error 147 */ 148 int rpz_insert_rr(struct rpz* r, uint8_t* azname, size_t aznamelen, uint8_t* dname, 149 size_t dnamelen, uint16_t rr_type, uint16_t rr_class, uint32_t rr_ttl, 150 uint8_t* rdatawl, size_t rdatalen, uint8_t* rr, size_t rr_len); 151 152 /** 153 * Delete policy matching RR, used for IXFR. 154 * @param r: the rpz to add the policy to. 155 * @param aznamelen: the length of the auth-zone name 156 * @param dname: dname of the RR 157 * @param dnamelen: length of the dname 158 * @param rr_type: RR type of the RR 159 * @param rr_class: RR class of the RR 160 * @param rdatawl: rdata of the RR, prepended with the rdata size 161 * @param rdatalen: length if the RR, including the prepended rdata size 162 */ 163 void rpz_remove_rr(struct rpz* r, size_t aznamelen, uint8_t* dname, 164 size_t dnamelen, uint16_t rr_type, uint16_t rr_class, uint8_t* rdatawl, 165 size_t rdatalen); 166 167 /** 168 * Walk over the RPZ zones to find and apply a QNAME trigger policy. 169 * @param az: auth_zones struct, containing first RPZ item and RPZ lock 170 * @param env: module env 171 * @param qinfo: qinfo containing qname and qtype 172 * @param edns: edns data 173 * @param buf: buffer to write answer to 174 * @param temp: scratchpad 175 * @param repinfo: reply info 176 * @param taglist: taglist to lookup. 177 * @param taglen: length of taglist. 178 * @param stats: worker stats struct 179 * @return: 1 if client answer is ready, 0 to continue resolving 180 */ 181 int rpz_callback_from_worker_request(struct auth_zones* az, struct module_env* env, 182 struct query_info* qinfo, struct edns_data* edns, sldns_buffer* buf, 183 struct regional* temp, struct comm_reply* repinfo, 184 uint8_t* taglist, size_t taglen, struct ub_server_stats* stats); 185 186 /** 187 * Callback to process when the iterator module is about to send queries. 188 * Checks for nsip and nsdname triggers. 189 * @param qstate: the query state. 190 * @param iq: iterator module query state. 191 * @return NULL if nothing is done. Or a new message with the contents from 192 * the rpz, based on the delegation point. It is allocated in the 193 * qstate region. 194 */ 195 struct dns_msg* rpz_callback_from_iterator_module(struct module_qstate* qstate, 196 struct iter_qstate* iq); 197 198 /** 199 * Callback to process when the iterator module has followed a cname. 200 * There can be a qname trigger for the new query name. 201 * @param qstate: the query state. 202 * @param iq: iterator module query state. 203 * @return NULL if nothing is done. Or a new message with the contents from 204 * the rpz, based on the iq.qchase. It is allocated in the qstate region. 205 */ 206 struct dns_msg* rpz_callback_from_iterator_cname(struct module_qstate* qstate, 207 struct iter_qstate* iq); 208 209 /** 210 * Delete RPZ 211 * @param r: RPZ struct to delete 212 */ 213 void rpz_delete(struct rpz* r); 214 215 /** 216 * Clear local-zones and respip data in RPZ, used after reloading file or 217 * AXFR/HTTP transfer. 218 * @param r: RPZ to use 219 */ 220 int rpz_clear(struct rpz* r); 221 222 /** 223 * Create RPZ. RPZ must be added to linked list after creation. 224 * @return: the newly created RPZ 225 */ 226 struct rpz* rpz_create(struct config_auth* p); 227 228 /** 229 * String for RPZ action enum 230 * @param a: RPZ action to get string for 231 * @return: string for RPZ action 232 */ 233 const char* rpz_action_to_string(enum rpz_action a); 234 235 enum rpz_action 236 respip_action_to_rpz_action(enum respip_action a); 237 238 /** 239 * Prepare RPZ after processing feed content. 240 * @param r: RPZ to use 241 */ 242 void rpz_finish_config(struct rpz* r); 243 244 /** 245 * Classify respip action for RPZ action 246 * @param a: RPZ action 247 * @return: the respip action 248 */ 249 enum respip_action 250 rpz_action_to_respip_action(enum rpz_action a); 251 252 /** 253 * Enable RPZ 254 * @param r: RPZ struct to enable 255 */ 256 void rpz_enable(struct rpz* r); 257 258 /** 259 * Disable RPZ 260 * @param r: RPZ struct to disable 261 */ 262 void rpz_disable(struct rpz* r); 263 264 #endif /* SERVICES_RPZ_H */ 265