respip.h (65b390aa03158608c95d842609dcc4c7129d6476) respip.h (091e9e469b768d3263f475047776732ffb126cfe)
1/*
2 * respip/respip.h - IP-based response modification module
3 */
4
5/**
6 * \file
7 *
8 * This file contains a module that selectively modifies query responses
9 * based on their AAAA/A IP addresses.
10 */
11
12#ifndef RESPIP_RESPIP_H
13#define RESPIP_RESPIP_H
14
15#include "util/module.h"
16#include "services/localzone.h"
1/*
2 * respip/respip.h - IP-based response modification module
3 */
4
5/**
6 * \file
7 *
8 * This file contains a module that selectively modifies query responses
9 * based on their AAAA/A IP addresses.
10 */
11
12#ifndef RESPIP_RESPIP_H
13#define RESPIP_RESPIP_H
14
15#include "util/module.h"
16#include "services/localzone.h"
17#include "util/locks.h"
17
18/**
18
19/**
19 * Set of response IP addresses with associated actions and tags.
20 * Forward declaration only here. Actual definition is hidden within the
21 * module.
20 * Conceptual set of IP addresses for response AAAA or A records that should
21 * trigger special actions.
22 */
22 */
23struct respip_set;
23struct respip_set {
24 struct regional* region;
25 struct rbtree_type ip_tree;
26 lock_rw_type lock; /* lock on the respip tree */
27 char* const* tagname; /* shallow copy of tag names, for logging */
28 int num_tags; /* number of tagname entries */
29};
24
30
25/**
26 * Forward declaration for the structure that represents a node in the
27 * respip_set address tree
28 */
29struct resp_addr;
30
31
32/** An address span with response control information */
33struct resp_addr {
34 /** node in address tree */
35 struct addr_tree_node node;
36 /** lock on the node item */
37 lock_rw_type lock;
38 /** tag bitlist */
39 uint8_t* taglist;
40 /** length of the taglist (in bytes) */
41 size_t taglen;
42 /** action for this address span */
43 enum respip_action action;
44 /** "local data" for this node */
45 struct ub_packed_rrset_key* data;
46};
47
48
31/**
32 * Forward declaration for the structure that represents a tree of view data.
33 */
49/**
50 * Forward declaration for the structure that represents a tree of view data.
51 */
52
34struct views;
35
36struct respip_addr_info;
37
38/**
39 * Client-specific attributes that can affect IP-based actions.
40 * This is essentially a subset of acl_addr (except for respip_set) but
41 * defined as a separate structure to avoid dependency on the daemon-specific

--- 13 unchanged lines hidden (view full) ---

55
56/**
57 * Data items representing the result of response-ip processing.
58 * Note: this structure currently only define a few members, but exists
59 * as a separate struct mainly for the convenience of custom extensions.
60 */
61struct respip_action_info {
62 enum respip_action action;
53struct views;
54
55struct respip_addr_info;
56
57/**
58 * Client-specific attributes that can affect IP-based actions.
59 * This is essentially a subset of acl_addr (except for respip_set) but
60 * defined as a separate structure to avoid dependency on the daemon-specific

--- 13 unchanged lines hidden (view full) ---

74
75/**
76 * Data items representing the result of response-ip processing.
77 * Note: this structure currently only define a few members, but exists
78 * as a separate struct mainly for the convenience of custom extensions.
79 */
80struct respip_action_info {
81 enum respip_action action;
82 int rpz_used;
83 int rpz_log;
84 int rpz_disabled;
85 char* log_name;
86 int rpz_cname_override;
63 struct respip_addr_info* addrinfo; /* set only for inform variants */
64};
65
66/**
67 * Forward declaration for the structure that represents a node in the
68 * respip_set address tree
69 */
70struct resp_addr;

--- 48 unchanged lines hidden (view full) ---

119 * @param base_rep: the reply info containing an incomplete CNAME.
120 * @param qinfo: query info corresponding to 'base_rep'.
121 * @param tgt_rep: the reply info that completes the CNAME chain.
122 * @param cinfo: client info corresponding to 'base_rep'.
123 * @param must_validate: whether 'tgt_rep' must be DNSSEC-validated.
124 * @param new_repp: pointer placeholder for the merged reply. will be intact
125 * on error.
126 * @param region: allocator to build *new_repp.
87 struct respip_addr_info* addrinfo; /* set only for inform variants */
88};
89
90/**
91 * Forward declaration for the structure that represents a node in the
92 * respip_set address tree
93 */
94struct resp_addr;

--- 48 unchanged lines hidden (view full) ---

143 * @param base_rep: the reply info containing an incomplete CNAME.
144 * @param qinfo: query info corresponding to 'base_rep'.
145 * @param tgt_rep: the reply info that completes the CNAME chain.
146 * @param cinfo: client info corresponding to 'base_rep'.
147 * @param must_validate: whether 'tgt_rep' must be DNSSEC-validated.
148 * @param new_repp: pointer placeholder for the merged reply. will be intact
149 * on error.
150 * @param region: allocator to build *new_repp.
151 * @param az: auth zones containing RPZ information.
127 * @return 1 on success, 0 on error.
128 */
129int respip_merge_cname(struct reply_info* base_rep,
130 const struct query_info* qinfo, const struct reply_info* tgt_rep,
131 const struct respip_client_info* cinfo, int must_validate,
152 * @return 1 on success, 0 on error.
153 */
154int respip_merge_cname(struct reply_info* base_rep,
155 const struct query_info* qinfo, const struct reply_info* tgt_rep,
156 const struct respip_client_info* cinfo, int must_validate,
132 struct reply_info** new_repp, struct regional* region);
157 struct reply_info** new_repp, struct regional* region,
158 struct auth_zones* az);
133
134/**
135 * See if any IP-based action should apply to any IP address of AAAA/A answer
136 * record in the reply. If so, apply the action. In some cases it rewrites
137 * the reply rrsets, in which case *new_repp will point to the updated reply
138 * info. Depending on the action, some of the rrsets in 'rep' will be
139 * shallow-copied into '*new_repp'; the caller must ensure that the rrsets
140 * in 'rep' are valid throughout the lifetime of *new_repp, and it must
141 * provide appropriate mutex if the rrsets can be shared by multiple threads.
142 * @param qinfo: query info corresponding to the reply.
143 * @param cinfo: client-specific info to identify the best matching action.
144 * can be NULL.
145 * @param rep: original reply info. must not be NULL.
146 * @param new_repp: can be set to the rewritten reply info (intact on failure).
147 * @param actinfo: result of response-ip processing
148 * @param alias_rrset: must not be NULL.
149 * @param search_only: if true, only check if an action would apply. actionp
150 * will be set (or intact) accordingly but the modified reply won't be built.
159
160/**
161 * See if any IP-based action should apply to any IP address of AAAA/A answer
162 * record in the reply. If so, apply the action. In some cases it rewrites
163 * the reply rrsets, in which case *new_repp will point to the updated reply
164 * info. Depending on the action, some of the rrsets in 'rep' will be
165 * shallow-copied into '*new_repp'; the caller must ensure that the rrsets
166 * in 'rep' are valid throughout the lifetime of *new_repp, and it must
167 * provide appropriate mutex if the rrsets can be shared by multiple threads.
168 * @param qinfo: query info corresponding to the reply.
169 * @param cinfo: client-specific info to identify the best matching action.
170 * can be NULL.
171 * @param rep: original reply info. must not be NULL.
172 * @param new_repp: can be set to the rewritten reply info (intact on failure).
173 * @param actinfo: result of response-ip processing
174 * @param alias_rrset: must not be NULL.
175 * @param search_only: if true, only check if an action would apply. actionp
176 * will be set (or intact) accordingly but the modified reply won't be built.
177 * @param az: auth zones containing RPZ information.
151 * @param region: allocator to build *new_repp.
152 * @return 1 on success, 0 on error.
153 */
154int respip_rewrite_reply(const struct query_info* qinfo,
155 const struct respip_client_info* cinfo,
156 const struct reply_info *rep, struct reply_info** new_repp,
157 struct respip_action_info* actinfo,
158 struct ub_packed_rrset_key** alias_rrset,
178 * @param region: allocator to build *new_repp.
179 * @return 1 on success, 0 on error.
180 */
181int respip_rewrite_reply(const struct query_info* qinfo,
182 const struct respip_client_info* cinfo,
183 const struct reply_info *rep, struct reply_info** new_repp,
184 struct respip_action_info* actinfo,
185 struct ub_packed_rrset_key** alias_rrset,
159 int search_only, struct regional* region);
186 int search_only, struct regional* region, struct auth_zones* az);
160
161/**
162 * Get the response-ip function block.
163 * @return: function block with function pointers to response-ip methods.
164 */
165struct module_func_block* respip_get_funcblock(void);
166
167/** response-ip init */

--- 40 unchanged lines hidden (view full) ---

208 * @return 0 if the specified set exists (non-NULL) and is non-empty;
209 * otherwise returns 1
210 */
211int respip_set_is_empty(const struct respip_set* set);
212
213/**
214 * print log information for a query subject to an inform or inform-deny
215 * response-ip action.
187
188/**
189 * Get the response-ip function block.
190 * @return: function block with function pointers to response-ip methods.
191 */
192struct module_func_block* respip_get_funcblock(void);
193
194/** response-ip init */

--- 40 unchanged lines hidden (view full) ---

235 * @return 0 if the specified set exists (non-NULL) and is non-empty;
236 * otherwise returns 1
237 */
238int respip_set_is_empty(const struct respip_set* set);
239
240/**
241 * print log information for a query subject to an inform or inform-deny
242 * response-ip action.
216 * @param respip_addr: response-ip information that causes the action
243 * @param respip_actinfo: response-ip information that causes the action
217 * @param qname: query name in the context, will be ignored if local_alias is
218 * non-NULL.
219 * @param qtype: query type, in host byte order.
220 * @param qclass: query class, in host byte order.
221 * @param local_alias: set to a local alias if the query matches an alias in
222 * a local zone. In this case its owner name will be considered the actual
223 * query name.
224 * @param repinfo: reply info containing the client's source address and port.
225 */
244 * @param qname: query name in the context, will be ignored if local_alias is
245 * non-NULL.
246 * @param qtype: query type, in host byte order.
247 * @param qclass: query class, in host byte order.
248 * @param local_alias: set to a local alias if the query matches an alias in
249 * a local zone. In this case its owner name will be considered the actual
250 * query name.
251 * @param repinfo: reply info containing the client's source address and port.
252 */
226void respip_inform_print(struct respip_addr_info* respip_addr, uint8_t* qname,
227 uint16_t qtype, uint16_t qclass, struct local_rrset* local_alias,
228 struct comm_reply* repinfo);
253void respip_inform_print(struct respip_action_info* respip_actinfo,
254 uint8_t* qname, uint16_t qtype, uint16_t qclass,
255 struct local_rrset* local_alias, struct comm_reply* repinfo);
229
256
257/**
258 * Find resp_addr in tree, create and add to tree if it does not exist.
259 * @param set: struct containing the tree and region to alloc new node on.
260 * should hold write lock.
261 * @param addr: address to look up.
262 * @param addrlen: length of addr.
263 * @param net: netblock to lookup.
264 * @param create: create node if it does not exist when 1.
265 * @param ipstr: human redable ip string, for logging.
266 * @return newly created of found node, not holding lock.
267 */
268struct resp_addr*
269respip_sockaddr_find_or_create(struct respip_set* set, struct sockaddr_storage* addr,
270 socklen_t addrlen, int net, int create, const char* ipstr);
271
272/**
273 * Add RR to resp_addr's RRset. Create RRset if not existing.
274 * @param region: region to alloc RR(set).
275 * @param raddr: resp_addr containing RRset. Must hold write lock.
276 * @param rrtype: RR type.
277 * @param rrclass: RR class.
278 * @param ttl: TTL.
279 * @param rdata: RDATA.
280 * @param rdata_len: length of rdata.
281 * @param rrstr: RR as string, for logging
282 * @param netblockstr: netblock as string, for logging
283 * @return 0 on error
284 */
285int
286respip_enter_rr(struct regional* region, struct resp_addr* raddr,
287 uint16_t rrtype, uint16_t rrclass, time_t ttl, uint8_t* rdata,
288 size_t rdata_len, const char* rrstr, const char* netblockstr);
289
290/**
291 * Delete resp_addr node from tree.
292 * @param set: struct containing tree. Must hold write lock.
293 * @param node: node to delete. Not locked.
294 */
295void
296respip_sockaddr_delete(struct respip_set* set, struct resp_addr* node);
230#endif /* RESPIP_RESPIP_H */
297#endif /* RESPIP_RESPIP_H */