1 /* 2 * services/rpz.h - rpz service 3 * 4 * Copyright (c) 2019, NLnet Labs. All rights reserved. 5 * 6 * This software is open source. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * Redistributions of source code must retain the above copyright notice, 13 * this list of conditions and the following disclaimer. 14 * 15 * Redistributions in binary form must reproduce the above copyright notice, 16 * this list of conditions and the following disclaimer in the documentation 17 * and/or other materials provided with the distribution. 18 * 19 * Neither the name of the NLNET LABS nor the names of its contributors may 20 * be used to endorse or promote products derived from this software without 21 * specific prior written permission. 22 * 23 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 24 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 25 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR 26 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT 27 * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 28 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED 29 * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR 30 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF 31 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING 32 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS 33 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 34 */ 35 36 /** 37 * \file 38 * 39 * This file contains functions to enable RPZ service. 40 */ 41 42 #ifndef SERVICES_RPZ_H 43 #define SERVICES_RPZ_H 44 45 #include "services/localzone.h" 46 #include "util/locks.h" 47 #include "util/log.h" 48 #include "util/config_file.h" 49 #include "services/authzone.h" 50 #include "sldns/sbuffer.h" 51 #include "daemon/stats.h" 52 #include "respip/respip.h" 53 struct iter_qstate; 54 55 /** 56 * RPZ triggers, only the QNAME trigger is currently supported in Unbound. 57 */ 58 enum rpz_trigger { 59 RPZ_QNAME_TRIGGER = 0, 60 /* unsupported triggers */ 61 RPZ_CLIENT_IP_TRIGGER, /* rpz-client-ip */ 62 RPZ_RESPONSE_IP_TRIGGER, /* rpz-ip */ 63 RPZ_NSDNAME_TRIGGER, /* rpz-nsdname */ 64 RPZ_NSIP_TRIGGER, /* rpz-nsip */ 65 RPZ_INVALID_TRIGGER, /* dname does not contain valid trigger */ 66 }; 67 68 /** 69 * RPZ actions. 70 */ 71 enum rpz_action { 72 RPZ_NXDOMAIN_ACTION = 0,/* CNAME . */ 73 RPZ_NODATA_ACTION, /* CNAME *. */ 74 RPZ_PASSTHRU_ACTION, /* CNAME rpz-passthru. */ 75 RPZ_DROP_ACTION, /* CNAME rpz-drop. */ 76 RPZ_TCP_ONLY_ACTION, /* CNAME rpz-tcp-only. */ 77 RPZ_INVALID_ACTION, /* CNAME with (child of) TLD starting with 78 "rpz-" in target, SOA, NS, DNAME and 79 DNSSEC-related records. */ 80 RPZ_LOCAL_DATA_ACTION, /* anything else */ 81 /* RPZ override actions */ 82 RPZ_DISABLED_ACTION, /* RPZ action disabled using override */ 83 RPZ_NO_OVERRIDE_ACTION, /* RPZ action no override*/ 84 RPZ_CNAME_OVERRIDE_ACTION, /* RPZ CNAME action override*/ 85 }; 86 87 struct clientip_synthesized_rrset{ 88 struct regional* region; 89 struct rbtree_type entries; 90 lock_rw_type lock; /* lock on the respip tree */ 91 }; 92 93 struct clientip_synthesized_rr { 94 /** node in address tree */ 95 struct addr_tree_node node; 96 /** lock on the node item */ 97 lock_rw_type lock; 98 /** tag bitlist */ 99 uint8_t* taglist; 100 /** length of the taglist (in bytes) */ 101 size_t taglen; 102 /** action for this address span */ 103 enum rpz_action action; 104 /** "local data" for this node */ 105 struct local_rrset* data; 106 }; 107 108 /** 109 * RPZ containing policies. Pointed to from corresponding auth-zone. Part of a 110 * linked list to keep configuration order. Iterating or changing the linked 111 * list requires the rpz_lock from struct auth_zones. Changing items in this 112 * struct require the lock from struct auth_zone. 113 */ 114 struct rpz { 115 struct local_zones* local_zones; 116 struct respip_set* respip_set; 117 struct clientip_synthesized_rrset* client_set; 118 struct clientip_synthesized_rrset* ns_set; 119 struct local_zones* nsdname_zones; 120 uint8_t* taglist; 121 size_t taglistlen; 122 enum rpz_action action_override; 123 struct ub_packed_rrset_key* cname_override; 124 int log; 125 char* log_name; 126 struct regional* region; 127 int disabled; 128 }; 129 130 /** 131 * Create policy from RR and add to this RPZ. 132 * @param r: the rpz to add the policy to. 133 * @param azname: dname of the auth-zone 134 * @param aznamelen: the length of the auth-zone name 135 * @param dname: dname of the RR 136 * @param dnamelen: length of the dname 137 * @param rr_type: RR type of the RR 138 * @param rr_class: RR class of the RR 139 * @param rr_ttl: TTL of the RR 140 * @param rdatawl: rdata of the RR, prepended with the rdata size 141 * @param rdatalen: length if the RR, including the prepended rdata size 142 * @param rr: the complete RR, for logging purposes 143 * @param rr_len: the length of the complete RR 144 * @return: 0 on error 145 */ 146 int rpz_insert_rr(struct rpz* r, uint8_t* azname, size_t aznamelen, uint8_t* dname, 147 size_t dnamelen, uint16_t rr_type, uint16_t rr_class, uint32_t rr_ttl, 148 uint8_t* rdatawl, size_t rdatalen, uint8_t* rr, size_t rr_len); 149 150 /** 151 * Delete policy matching RR, used for IXFR. 152 * @param r: the rpz to add the policy to. 153 * @param aznamelen: the length of the auth-zone name 154 * @param dname: dname of the RR 155 * @param dnamelen: length of the dname 156 * @param rr_type: RR type of the RR 157 * @param rr_class: RR class of the RR 158 * @param rdatawl: rdata of the RR, prepended with the rdata size 159 * @param rdatalen: length if the RR, including the prepended rdata size 160 */ 161 void rpz_remove_rr(struct rpz* r, size_t aznamelen, uint8_t* dname, 162 size_t dnamelen, uint16_t rr_type, uint16_t rr_class, uint8_t* rdatawl, 163 size_t rdatalen); 164 165 /** 166 * Walk over the RPZ zones to find and apply a QNAME trigger policy. 167 * @param az: auth_zones struct, containing first RPZ item and RPZ lock 168 * @param env: module env 169 * @param qinfo: qinfo containing qname and qtype 170 * @param edns: edns data 171 * @param buf: buffer to write answer to 172 * @param temp: scratchpad 173 * @param repinfo: reply info 174 * @param taglist: taglist to lookup. 175 * @param taglen: length of taglist. 176 * @param stats: worker stats struct 177 * @return: 1 if client answer is ready, 0 to continue resolving 178 */ 179 int rpz_callback_from_worker_request(struct auth_zones* az, struct module_env* env, 180 struct query_info* qinfo, struct edns_data* edns, sldns_buffer* buf, 181 struct regional* temp, struct comm_reply* repinfo, 182 uint8_t* taglist, size_t taglen, struct ub_server_stats* stats); 183 184 /** 185 * Callback to process when the iterator module is about to send queries. 186 * Checks for nsip and nsdname triggers. 187 * @param qstate: the query state. 188 * @param iq: iterator module query state. 189 * @return NULL if nothing is done. Or a new message with the contents from 190 * the rpz, based on the delegation point. It is allocated in the 191 * qstate region. 192 */ 193 struct dns_msg* rpz_callback_from_iterator_module(struct module_qstate* qstate, 194 struct iter_qstate* iq); 195 196 /** 197 * Callback to process when the iterator module has followed a cname. 198 * There can be a qname trigger for the new query name. 199 * @param qstate: the query state. 200 * @param iq: iterator module query state. 201 * @return NULL if nothing is done. Or a new message with the contents from 202 * the rpz, based on the iq.qchase. It is allocated in the qstate region. 203 */ 204 struct dns_msg* rpz_callback_from_iterator_cname(struct module_qstate* qstate, 205 struct iter_qstate* iq); 206 207 /** 208 * Delete RPZ 209 * @param r: RPZ struct to delete 210 */ 211 void rpz_delete(struct rpz* r); 212 213 /** 214 * Clear local-zones and respip data in RPZ, used after reloading file or 215 * AXFR/HTTP transfer. 216 * @param r: RPZ to use 217 */ 218 int rpz_clear(struct rpz* r); 219 220 /** 221 * Create RPZ. RPZ must be added to linked list after creation. 222 * @return: the newly created RPZ 223 */ 224 struct rpz* rpz_create(struct config_auth* p); 225 226 /** 227 * String for RPZ action enum 228 * @param a: RPZ action to get string for 229 * @return: string for RPZ action 230 */ 231 const char* rpz_action_to_string(enum rpz_action a); 232 233 enum rpz_action 234 respip_action_to_rpz_action(enum respip_action a); 235 236 /** 237 * Prepare RPZ after processing feed content. 238 * @param r: RPZ to use 239 */ 240 void rpz_finish_config(struct rpz* r); 241 242 /** 243 * Classify respip action for RPZ action 244 * @param a: RPZ action 245 * @return: the respip action 246 */ 247 enum respip_action 248 rpz_action_to_respip_action(enum rpz_action a); 249 250 /** 251 * Enable RPZ 252 * @param r: RPZ struct to enable 253 */ 254 void rpz_enable(struct rpz* r); 255 256 /** 257 * Disable RPZ 258 * @param r: RPZ struct to disable 259 */ 260 void rpz_disable(struct rpz* r); 261 262 #endif /* SERVICES_RPZ_H */ 263