1 /* 2 * services/rpz.h - rpz service 3 * 4 * Copyright (c) 2019, NLnet Labs. All rights reserved. 5 * 6 * This software is open source. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * Redistributions of source code must retain the above copyright notice, 13 * this list of conditions and the following disclaimer. 14 * 15 * Redistributions in binary form must reproduce the above copyright notice, 16 * this list of conditions and the following disclaimer in the documentation 17 * and/or other materials provided with the distribution. 18 * 19 * Neither the name of the NLNET LABS nor the names of its contributors may 20 * be used to endorse or promote products derived from this software without 21 * specific prior written permission. 22 * 23 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 24 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 25 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR 26 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT 27 * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 28 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED 29 * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR 30 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF 31 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING 32 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 33 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 34 */ 35 36 /** 37 * \file 38 * 39 * This file contains functions to enable RPZ service. 40 */ 41 42 #ifndef SERVICES_RPZ_H 43 #define SERVICES_RPZ_H 44 45 #include "services/localzone.h" 46 #include "util/locks.h" 47 #include "util/log.h" 48 #include "util/config_file.h" 49 #include "services/authzone.h" 50 #include "sldns/sbuffer.h" 51 #include "daemon/stats.h" 52 #include "respip/respip.h" 53 struct iter_qstate; 54 55 /** 56 * RPZ triggers, only the QNAME trigger is currently supported in Unbound. 57 */ 58 enum rpz_trigger { 59 RPZ_QNAME_TRIGGER = 0, 60 /* unsupported triggers */ 61 RPZ_CLIENT_IP_TRIGGER, /* rpz-client-ip */ 62 RPZ_RESPONSE_IP_TRIGGER, /* rpz-ip */ 63 RPZ_NSDNAME_TRIGGER, /* rpz-nsdname */ 64 RPZ_NSIP_TRIGGER, /* rpz-nsip */ 65 RPZ_INVALID_TRIGGER, /* dname does not contain valid trigger */ 66 }; 67 68 /** 69 * RPZ actions. 70 */ 71 enum rpz_action { 72 RPZ_NXDOMAIN_ACTION = 0,/* CNAME . */ 73 RPZ_NODATA_ACTION, /* CNAME *. */ 74 RPZ_PASSTHRU_ACTION, /* CNAME rpz-passthru. */ 75 RPZ_DROP_ACTION, /* CNAME rpz-drop. */ 76 RPZ_TCP_ONLY_ACTION, /* CNAME rpz-tcp-only. */ 77 RPZ_INVALID_ACTION, /* CNAME with (child of) TLD starting with 78 "rpz-" in target, SOA, NS, DNAME and 79 DNSSEC-related records. */ 80 RPZ_LOCAL_DATA_ACTION, /* anything else */ 81 /* RPZ override actions */ 82 RPZ_DISABLED_ACTION, /* RPZ action disabled using override */ 83 RPZ_NO_OVERRIDE_ACTION, /* RPZ action no override*/ 84 RPZ_CNAME_OVERRIDE_ACTION, /* RPZ CNAME action override*/ 85 }; 86 87 struct clientip_synthesized_rrset{ 88 struct regional* region; 89 struct rbtree_type entries; 90 lock_rw_type lock; /* lock on the respip tree */ 91 }; 92 93 struct clientip_synthesized_rr { 94 /** node in address tree */ 95 struct addr_tree_node node; 96 /** lock on the node item */ 97 lock_rw_type lock; 98 /** tag bitlist */ 99 uint8_t* taglist; 100 /** length of the taglist (in bytes) */ 101 size_t taglen; 102 /** action for this address span */ 103 enum rpz_action action; 104 /** "local data" for this node */ 105 struct local_rrset* data; 106 }; 107 108 /** 109 * RPZ containing policies. Pointed to from corresponding auth-zone. Part of a 110 * linked list to keep configuration order. Iterating or changing the linked 111 * list requires the rpz_lock from struct auth_zones. Changing items in this 112 * struct require the lock from struct auth_zone. 113 */ 114 struct rpz { 115 struct local_zones* local_zones; 116 struct respip_set* respip_set; 117 struct clientip_synthesized_rrset* client_set; 118 struct clientip_synthesized_rrset* ns_set; 119 struct local_zones* nsdname_zones; 120 uint8_t* taglist; 121 size_t taglistlen; 122 enum rpz_action action_override; 123 struct ub_packed_rrset_key* cname_override; 124 int log; 125 char* log_name; 126 /** signal NXDOMAIN blocked with unset RA flag */ 127 int signal_nxdomain_ra; 128 struct regional* region; 129 int disabled; 130 }; 131 132 /** 133 * Create policy from RR and add to this RPZ. 134 * @param r: the rpz to add the policy to. 135 * @param azname: dname of the auth-zone 136 * @param aznamelen: the length of the auth-zone name 137 * @param dname: dname of the RR 138 * @param dnamelen: length of the dname 139 * @param rr_type: RR type of the RR 140 * @param rr_class: RR class of the RR 141 * @param rr_ttl: TTL of the RR 142 * @param rdatawl: rdata of the RR, prepended with the rdata size 143 * @param rdatalen: length if the RR, including the prepended rdata size 144 * @param rr: the complete RR, for logging purposes 145 * @param rr_len: the length of the complete RR 146 * @return: 0 on error 147 */ 148 int rpz_insert_rr(struct rpz* r, uint8_t* azname, size_t aznamelen, uint8_t* dname, 149 size_t dnamelen, uint16_t rr_type, uint16_t rr_class, uint32_t rr_ttl, 150 uint8_t* rdatawl, size_t rdatalen, uint8_t* rr, size_t rr_len); 151 152 /** 153 * Delete policy matching RR, used for IXFR. 154 * @param r: the rpz to add the policy to. 155 * @param aznamelen: the length of the auth-zone name 156 * @param dname: dname of the RR 157 * @param dnamelen: length of the dname 158 * @param rr_type: RR type of the RR 159 * @param rr_class: RR class of the RR 160 * @param rdatawl: rdata of the RR, prepended with the rdata size 161 * @param rdatalen: length if the RR, including the prepended rdata size 162 */ 163 void rpz_remove_rr(struct rpz* r, size_t aznamelen, uint8_t* dname, 164 size_t dnamelen, uint16_t rr_type, uint16_t rr_class, uint8_t* rdatawl, 165 size_t rdatalen); 166 167 /** 168 * Walk over the RPZ zones to find and apply a QNAME trigger policy. 169 * @param az: auth_zones struct, containing first RPZ item and RPZ lock 170 * @param env: module env 171 * @param qinfo: qinfo containing qname and qtype 172 * @param edns: edns data 173 * @param buf: buffer to write answer to 174 * @param temp: scratchpad 175 * @param repinfo: reply info 176 * @param taglist: taglist to lookup. 177 * @param taglen: length of taglist. 178 * @param stats: worker stats struct 179 * @param passthru: returns if the query can passthru further rpz processing. 180 * @return: 1 if client answer is ready, 0 to continue resolving 181 */ 182 int rpz_callback_from_worker_request(struct auth_zones* az, struct module_env* env, 183 struct query_info* qinfo, struct edns_data* edns, sldns_buffer* buf, 184 struct regional* temp, struct comm_reply* repinfo, 185 uint8_t* taglist, size_t taglen, struct ub_server_stats* stats, 186 int* passthru); 187 188 /** 189 * Callback to process when the iterator module is about to send queries. 190 * Checks for nsip and nsdname triggers. 191 * @param qstate: the query state. 192 * @param iq: iterator module query state. 193 * @return NULL if nothing is done. Or a new message with the contents from 194 * the rpz, based on the delegation point. It is allocated in the 195 * qstate region. 196 */ 197 struct dns_msg* rpz_callback_from_iterator_module(struct module_qstate* qstate, 198 struct iter_qstate* iq); 199 200 /** 201 * Callback to process when the iterator module has followed a cname. 202 * There can be a qname trigger for the new query name. 203 * @param qstate: the query state. 204 * @param iq: iterator module query state. 205 * @return NULL if nothing is done. Or a new message with the contents from 206 * the rpz, based on the iq.qchase. It is allocated in the qstate region. 207 */ 208 struct dns_msg* rpz_callback_from_iterator_cname(struct module_qstate* qstate, 209 struct iter_qstate* iq); 210 211 /** 212 * Delete RPZ 213 * @param r: RPZ struct to delete 214 */ 215 void rpz_delete(struct rpz* r); 216 217 /** 218 * Clear local-zones and respip data in RPZ, used after reloading file or 219 * AXFR/HTTP transfer. 220 * @param r: RPZ to use 221 */ 222 int rpz_clear(struct rpz* r); 223 224 /** 225 * Create RPZ. RPZ must be added to linked list after creation. 226 * @return: the newly created RPZ 227 */ 228 struct rpz* rpz_create(struct config_auth* p); 229 230 /** 231 * String for RPZ action enum 232 * @param a: RPZ action to get string for 233 * @return: string for RPZ action 234 */ 235 const char* rpz_action_to_string(enum rpz_action a); 236 237 enum rpz_action 238 respip_action_to_rpz_action(enum respip_action a); 239 240 /** 241 * Prepare RPZ after processing feed content. 242 * @param r: RPZ to use 243 */ 244 void rpz_finish_config(struct rpz* r); 245 246 /** 247 * Classify respip action for RPZ action 248 * @param a: RPZ action 249 * @return: the respip action 250 */ 251 enum respip_action 252 rpz_action_to_respip_action(enum rpz_action a); 253 254 /** 255 * Enable RPZ 256 * @param r: RPZ struct to enable 257 */ 258 void rpz_enable(struct rpz* r); 259 260 /** 261 * Disable RPZ 262 * @param r: RPZ struct to disable 263 */ 264 void rpz_disable(struct rpz* r); 265 266 #endif /* SERVICES_RPZ_H */ 267