xref: /freebsd/contrib/unbound/services/rpz.h (revision b3e7694832e81d7a904a10f525f8797b753bf0d3)
1 /*
2  * services/rpz.h - rpz service
3  *
4  * Copyright (c) 2019, NLnet Labs. All rights reserved.
5  *
6  * This software is open source.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  *
12  * Redistributions of source code must retain the above copyright notice,
13  * this list of conditions and the following disclaimer.
14  *
15  * Redistributions in binary form must reproduce the above copyright notice,
16  * this list of conditions and the following disclaimer in the documentation
17  * and/or other materials provided with the distribution.
18  *
19  * Neither the name of the NLNET LABS nor the names of its contributors may
20  * be used to endorse or promote products derived from this software without
21  * specific prior written permission.
22  *
23  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
24  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
25  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
26  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
27  * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
28  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
29  * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
30  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
31  * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
32  * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
33  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
34  */
35 
36 /**
37  * \file
38  *
39  * This file contains functions to enable RPZ service.
40  */
41 
42 #ifndef SERVICES_RPZ_H
43 #define SERVICES_RPZ_H
44 
45 #include "services/localzone.h"
46 #include "util/locks.h"
47 #include "util/log.h"
48 #include "util/config_file.h"
49 #include "services/authzone.h"
50 #include "sldns/sbuffer.h"
51 #include "daemon/stats.h"
52 #include "respip/respip.h"
53 struct iter_qstate;
54 
55 /**
56  * RPZ triggers, only the QNAME trigger is currently supported in Unbound.
57  */
58 enum rpz_trigger {
59 	RPZ_QNAME_TRIGGER = 0,
60 	/* unsupported triggers */
61 	RPZ_CLIENT_IP_TRIGGER,	 /* rpz-client-ip */
62 	RPZ_RESPONSE_IP_TRIGGER, /* rpz-ip */
63 	RPZ_NSDNAME_TRIGGER,	 /* rpz-nsdname */
64 	RPZ_NSIP_TRIGGER,	 /* rpz-nsip */
65 	RPZ_INVALID_TRIGGER, 	 /* dname does not contain valid trigger */
66 };
67 
68 /**
69  * RPZ actions.
70  */
71 enum rpz_action {
72 	RPZ_NXDOMAIN_ACTION = 0,/* CNAME . */
73 	RPZ_NODATA_ACTION,	/* CNAME *. */
74 	RPZ_PASSTHRU_ACTION,	/* CNAME rpz-passthru. */
75 	RPZ_DROP_ACTION,	/* CNAME rpz-drop. */
76 	RPZ_TCP_ONLY_ACTION,	/* CNAME rpz-tcp-only. */
77 	RPZ_INVALID_ACTION,	/* CNAME with (child of) TLD starting with
78 				   "rpz-" in target, SOA, NS, DNAME and
79 				   DNSSEC-related records. */
80 	RPZ_LOCAL_DATA_ACTION,	/* anything else */
81 	/* RPZ override actions */
82 	RPZ_DISABLED_ACTION,    /* RPZ action disabled using override */
83 	RPZ_NO_OVERRIDE_ACTION, /* RPZ action no override*/
84 	RPZ_CNAME_OVERRIDE_ACTION, /* RPZ CNAME action override*/
85 };
86 
87 struct clientip_synthesized_rrset{
88 	struct regional* region;
89 	struct rbtree_type entries;
90 	lock_rw_type lock;	/* lock on the respip tree */
91 };
92 
93 struct clientip_synthesized_rr {
94 	/** node in address tree */
95 	struct addr_tree_node node;
96 	/** lock on the node item */
97 	lock_rw_type lock;
98 	/** tag bitlist */
99 	uint8_t* taglist;
100 	/** length of the taglist (in bytes) */
101 	size_t taglen;
102 	/** action for this address span */
103 	enum rpz_action action;
104 	/** "local data" for this node */
105 	struct local_rrset* data;
106 };
107 
108 /**
109  * RPZ containing policies. Pointed to from corresponding auth-zone. Part of a
110  * linked list to keep configuration order. Iterating or changing the linked
111  * list requires the rpz_lock from struct auth_zones. Changing items in this
112  * struct require the lock from struct auth_zone.
113  */
114 struct rpz {
115 	struct local_zones* local_zones;
116 	struct respip_set* respip_set;
117 	struct clientip_synthesized_rrset* client_set;
118 	struct clientip_synthesized_rrset* ns_set;
119 	struct local_zones* nsdname_zones;
120 	uint8_t* taglist;
121 	size_t taglistlen;
122 	enum rpz_action action_override;
123 	struct ub_packed_rrset_key* cname_override;
124 	int log;
125 	char* log_name;
126 	/** signal NXDOMAIN blocked with unset RA flag */
127 	int signal_nxdomain_ra;
128 	struct regional* region;
129 	int disabled;
130 };
131 
132 /**
133  * Create policy from RR and add to this RPZ.
134  * @param r: the rpz to add the policy to.
135  * @param azname: dname of the auth-zone
136  * @param aznamelen: the length of the auth-zone name
137  * @param dname: dname of the RR
138  * @param dnamelen: length of the dname
139  * @param rr_type: RR type of the RR
140  * @param rr_class: RR class of the RR
141  * @param rr_ttl: TTL of the RR
142  * @param rdatawl: rdata of the RR, prepended with the rdata size
143  * @param rdatalen: length if the RR, including the prepended rdata size
144  * @param rr: the complete RR, for logging purposes
145  * @param rr_len: the length of the complete RR
146  * @return: 0 on error
147  */
148 int rpz_insert_rr(struct rpz* r, uint8_t* azname, size_t aznamelen, uint8_t* dname,
149 	size_t dnamelen, uint16_t rr_type, uint16_t rr_class, uint32_t rr_ttl,
150 	uint8_t* rdatawl, size_t rdatalen, uint8_t* rr, size_t rr_len);
151 
152 /**
153  * Delete policy matching RR, used for IXFR.
154  * @param r: the rpz to add the policy to.
155  * @param aznamelen: the length of the auth-zone name
156  * @param dname: dname of the RR
157  * @param dnamelen: length of the dname
158  * @param rr_type: RR type of the RR
159  * @param rr_class: RR class of the RR
160  * @param rdatawl: rdata of the RR, prepended with the rdata size
161  * @param rdatalen: length if the RR, including the prepended rdata size
162  */
163 void rpz_remove_rr(struct rpz* r, size_t aznamelen, uint8_t* dname,
164 	size_t dnamelen, uint16_t rr_type, uint16_t rr_class, uint8_t* rdatawl,
165 	size_t rdatalen);
166 
167 /**
168  * Walk over the RPZ zones to find and apply a QNAME trigger policy.
169  * @param az: auth_zones struct, containing first RPZ item and RPZ lock
170  * @param env: module env
171  * @param qinfo: qinfo containing qname and qtype
172  * @param edns: edns data
173  * @param buf: buffer to write answer to
174  * @param temp: scratchpad
175  * @param repinfo: reply info
176  * @param taglist: taglist to lookup.
177  * @param taglen: length of taglist.
178  * @param stats: worker stats struct
179  * @param passthru: returns if the query can passthru further rpz processing.
180  * @return: 1 if client answer is ready, 0 to continue resolving
181  */
182 int rpz_callback_from_worker_request(struct auth_zones* az, struct module_env* env,
183 	struct query_info* qinfo, struct edns_data* edns, sldns_buffer* buf,
184 	struct regional* temp, struct comm_reply* repinfo,
185 	uint8_t* taglist, size_t taglen, struct ub_server_stats* stats,
186 	int* passthru);
187 
188 /**
189  * Callback to process when the iterator module is about to send queries.
190  * Checks for nsip and nsdname triggers.
191  * @param qstate: the query state.
192  * @param iq: iterator module query state.
193  * @return NULL if nothing is done. Or a new message with the contents from
194  * 	the rpz, based on the delegation point. It is allocated in the
195  * 	qstate region.
196  */
197 struct dns_msg* rpz_callback_from_iterator_module(struct module_qstate* qstate,
198 	struct iter_qstate* iq);
199 
200 /**
201  * Callback to process when the iterator module has followed a cname.
202  * There can be a qname trigger for the new query name.
203  * @param qstate: the query state.
204  * @param iq: iterator module query state.
205  * @return NULL if nothing is done. Or a new message with the contents from
206  * 	the rpz, based on the iq.qchase. It is allocated in the qstate region.
207  */
208 struct dns_msg* rpz_callback_from_iterator_cname(struct module_qstate* qstate,
209 	struct iter_qstate* iq);
210 
211 /**
212  * Delete RPZ
213  * @param r: RPZ struct to delete
214  */
215 void rpz_delete(struct rpz* r);
216 
217 /**
218  * Clear local-zones and respip data in RPZ, used after reloading file or
219  * AXFR/HTTP transfer.
220  * @param r: RPZ to use
221  */
222 int rpz_clear(struct rpz* r);
223 
224 /**
225  * Create RPZ. RPZ must be added to linked list after creation.
226  * @return: the newly created RPZ
227  */
228 struct rpz* rpz_create(struct config_auth* p);
229 
230 /**
231  * String for RPZ action enum
232  * @param a: RPZ action to get string for
233  * @return: string for RPZ action
234  */
235 const char* rpz_action_to_string(enum rpz_action a);
236 
237 enum rpz_action
238 respip_action_to_rpz_action(enum respip_action a);
239 
240 /**
241  * Prepare RPZ after processing feed content.
242  * @param r: RPZ to use
243  */
244 void rpz_finish_config(struct rpz* r);
245 
246 /**
247  * Classify respip action for RPZ action
248  * @param a: RPZ action
249  * @return: the respip action
250  */
251 enum respip_action
252 rpz_action_to_respip_action(enum rpz_action a);
253 
254 /**
255  * Enable RPZ
256  * @param r: RPZ struct to enable
257  */
258 void rpz_enable(struct rpz* r);
259 
260 /**
261  * Disable RPZ
262  * @param r: RPZ struct to disable
263  */
264 void rpz_disable(struct rpz* r);
265 
266 #endif /* SERVICES_RPZ_H */
267