87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews/*
ff2d95be3d5e0350c5b457582cdb08869fc17789Tinderbox User * Copyright (C) 2011-2013, 2015-2017 Internet Systems Consortium, Inc. ("ISC")
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews *
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews * This Source Code Form is subject to the terms of the Mozilla Public
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews * License, v. 2.0. If a copy of the MPL was not distributed with this
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews * file, You can obtain one at http://mozilla.org/MPL/2.0/.
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews */
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews
f97d56e757b9a293ffbaa915ca4d792ae84ba85aTinderbox User/* $Id$ */
f97d56e757b9a293ffbaa915ca4d792ae84ba85aTinderbox User
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews#ifndef DNS_RPZ_H
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews#define DNS_RPZ_H 1
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews
f44202ab640d22e17b4c74bdad7817622918bd27Mark Andrews#include <isc/deprecated.h>
f44202ab640d22e17b4c74bdad7817622918bd27Mark Andrews#include <isc/event.h>
f44202ab640d22e17b4c74bdad7817622918bd27Mark Andrews#include <isc/ht.h>
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews#include <isc/lang.h>
8c9fba44a41e3ea23e7e8405029980aba672f7ceEvan Hunt#include <isc/refcount.h>
8c9fba44a41e3ea23e7e8405029980aba672f7ceEvan Hunt#include <isc/rwlock.h>
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews#include <dns/fixedname.h>
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews#include <dns/rdata.h>
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews#include <dns/types.h>
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews
87708bde16713bc02ff2598f4a82f98c699a2f2dMark AndrewsISC_LANG_BEGINDECLS
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt#define DNS_RPZ_PREFIX "rpz-"
421d4a06479e61fbdc35087f3c4abc9fe65ad72aEvan Hunt/*
421d4a06479e61fbdc35087f3c4abc9fe65ad72aEvan Hunt * Sub-zones of various trigger types.
421d4a06479e61fbdc35087f3c4abc9fe65ad72aEvan Hunt */
421d4a06479e61fbdc35087f3c4abc9fe65ad72aEvan Hunt#define DNS_RPZ_CLIENT_IP_ZONE DNS_RPZ_PREFIX"client-ip"
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt#define DNS_RPZ_IP_ZONE DNS_RPZ_PREFIX"ip"
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt#define DNS_RPZ_NSIP_ZONE DNS_RPZ_PREFIX"nsip"
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt#define DNS_RPZ_NSDNAME_ZONE DNS_RPZ_PREFIX"nsdname"
421d4a06479e61fbdc35087f3c4abc9fe65ad72aEvan Hunt/*
421d4a06479e61fbdc35087f3c4abc9fe65ad72aEvan Hunt * Special policies.
421d4a06479e61fbdc35087f3c4abc9fe65ad72aEvan Hunt */
421d4a06479e61fbdc35087f3c4abc9fe65ad72aEvan Hunt#define DNS_RPZ_PASSTHRU_NAME DNS_RPZ_PREFIX"passthru"
421d4a06479e61fbdc35087f3c4abc9fe65ad72aEvan Hunt#define DNS_RPZ_DROP_NAME DNS_RPZ_PREFIX"drop"
421d4a06479e61fbdc35087f3c4abc9fe65ad72aEvan Hunt#define DNS_RPZ_TCP_ONLY_NAME DNS_RPZ_PREFIX"tcp-only"
421d4a06479e61fbdc35087f3c4abc9fe65ad72aEvan Hunt
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunttypedef isc_uint8_t dns_rpz_prefix_t;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrewstypedef enum {
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews DNS_RPZ_TYPE_BAD,
421d4a06479e61fbdc35087f3c4abc9fe65ad72aEvan Hunt DNS_RPZ_TYPE_CLIENT_IP,
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews DNS_RPZ_TYPE_QNAME,
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews DNS_RPZ_TYPE_IP,
9fee08f655527a5dd849b171daeeee1dbbccca76Vernon Schryver DNS_RPZ_TYPE_NSDNAME,
9fee08f655527a5dd849b171daeeee1dbbccca76Vernon Schryver DNS_RPZ_TYPE_NSIP
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews} dns_rpz_type_t;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews/*
421d4a06479e61fbdc35087f3c4abc9fe65ad72aEvan Hunt * Require DNS_RPZ_POLICY_PASSTHRU < DNS_RPZ_POLICY_DROP
421d4a06479e61fbdc35087f3c4abc9fe65ad72aEvan Hunt * < DNS_RPZ_POLICY_TCP_ONLY DNS_RPZ_POLICY_NXDOMAIN < DNS_RPZ_POLICY_NODATA
421d4a06479e61fbdc35087f3c4abc9fe65ad72aEvan Hunt * < DNS_RPZ_POLICY_CNAME to choose among competing policies.
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews */
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrewstypedef enum {
9fee08f655527a5dd849b171daeeee1dbbccca76Vernon Schryver DNS_RPZ_POLICY_GIVEN = 0, /* 'given': what policy record says */
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt DNS_RPZ_POLICY_DISABLED = 1, /* log what would have happened */
9fee08f655527a5dd849b171daeeee1dbbccca76Vernon Schryver DNS_RPZ_POLICY_PASSTHRU = 2, /* 'passthru': do not rewrite */
421d4a06479e61fbdc35087f3c4abc9fe65ad72aEvan Hunt DNS_RPZ_POLICY_DROP = 3, /* 'drop': do not respond */
421d4a06479e61fbdc35087f3c4abc9fe65ad72aEvan Hunt DNS_RPZ_POLICY_TCP_ONLY = 4, /* 'tcp-only': answer UDP with TC=1 */
421d4a06479e61fbdc35087f3c4abc9fe65ad72aEvan Hunt DNS_RPZ_POLICY_NXDOMAIN = 5, /* 'nxdomain': answer with NXDOMAIN */
421d4a06479e61fbdc35087f3c4abc9fe65ad72aEvan Hunt DNS_RPZ_POLICY_NODATA = 6, /* 'nodata': answer with ANCOUNT=0 */
421d4a06479e61fbdc35087f3c4abc9fe65ad72aEvan Hunt DNS_RPZ_POLICY_CNAME = 7, /* 'cname x': answer with x's rrsets */
9fee08f655527a5dd849b171daeeee1dbbccca76Vernon Schryver DNS_RPZ_POLICY_RECORD,
9fee08f655527a5dd849b171daeeee1dbbccca76Vernon Schryver DNS_RPZ_POLICY_WILDCNAME,
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews DNS_RPZ_POLICY_MISS,
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews DNS_RPZ_POLICY_ERROR
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews} dns_rpz_policy_t;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunttypedef isc_uint8_t dns_rpz_num_t;
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt#define DNS_RPZ_MAX_ZONES 32
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt#if DNS_RPZ_MAX_ZONES > 32
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt# if DNS_RPZ_MAX_ZONES > 64
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt# error "rpz zone bit masks must fit in a word"
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt# endif
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunttypedef isc_uint64_t dns_rpz_zbits_t;
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt#else
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunttypedef isc_uint32_t dns_rpz_zbits_t;
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt#endif
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt#define DNS_RPZ_ALL_ZBITS ((dns_rpz_zbits_t)-1)
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt#define DNS_RPZ_INVALID_NUM DNS_RPZ_MAX_ZONES
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt#define DNS_RPZ_ZBIT(n) (((dns_rpz_zbits_t)1) << (dns_rpz_num_t)(n))
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews/*
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt * Mask of the specified and higher numbered policy zones
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt * Avoid hassles with (1<<33) or (1<<65)
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews */
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt#define DNS_RPZ_ZMASK(n) ((dns_rpz_zbits_t)((((n) >= DNS_RPZ_MAX_ZONES-1) ? \
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt 0 : (1<<((n)+1))) -1))
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews
19365b43e922fcbaf5caff3f92b87b52cbc1b530Evan Hunt/*
19365b43e922fcbaf5caff3f92b87b52cbc1b530Evan Hunt * The trigger counter type.
19365b43e922fcbaf5caff3f92b87b52cbc1b530Evan Hunt */
a32b6291aa5f797e1336869390f99d4a655484c2Evan Hunttypedef size_t dns_rpz_trigger_counter_t;
19365b43e922fcbaf5caff3f92b87b52cbc1b530Evan Hunt
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt/*
421d4a06479e61fbdc35087f3c4abc9fe65ad72aEvan Hunt * The number of triggers of each type in a response policy zone.
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt */
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunttypedef struct dns_rpz_triggers dns_rpz_triggers_t;
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Huntstruct dns_rpz_triggers {
19365b43e922fcbaf5caff3f92b87b52cbc1b530Evan Hunt dns_rpz_trigger_counter_t client_ipv4;
19365b43e922fcbaf5caff3f92b87b52cbc1b530Evan Hunt dns_rpz_trigger_counter_t client_ipv6;
19365b43e922fcbaf5caff3f92b87b52cbc1b530Evan Hunt dns_rpz_trigger_counter_t qname;
19365b43e922fcbaf5caff3f92b87b52cbc1b530Evan Hunt dns_rpz_trigger_counter_t ipv4;
19365b43e922fcbaf5caff3f92b87b52cbc1b530Evan Hunt dns_rpz_trigger_counter_t ipv6;
19365b43e922fcbaf5caff3f92b87b52cbc1b530Evan Hunt dns_rpz_trigger_counter_t nsdname;
19365b43e922fcbaf5caff3f92b87b52cbc1b530Evan Hunt dns_rpz_trigger_counter_t nsipv4;
19365b43e922fcbaf5caff3f92b87b52cbc1b530Evan Hunt dns_rpz_trigger_counter_t nsipv6;
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt};
19365b43e922fcbaf5caff3f92b87b52cbc1b530Evan Hunt
421d4a06479e61fbdc35087f3c4abc9fe65ad72aEvan Hunt/*
421d4a06479e61fbdc35087f3c4abc9fe65ad72aEvan Hunt * A single response policy zone.
421d4a06479e61fbdc35087f3c4abc9fe65ad72aEvan Hunt */
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunttypedef struct dns_rpz_zone dns_rpz_zone_t;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrewsstruct dns_rpz_zone {
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt isc_refcount_t refs;
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt dns_rpz_num_t num; /* ordinal in list of policy zones */
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt dns_name_t origin; /* Policy zone name */
421d4a06479e61fbdc35087f3c4abc9fe65ad72aEvan Hunt dns_name_t client_ip; /* DNS_RPZ_CLIENT_IP_ZONE.origin. */
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt dns_name_t ip; /* DNS_RPZ_IP_ZONE.origin. */
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt dns_name_t nsdname; /* DNS_RPZ_NSDNAME_ZONE.origin */
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt dns_name_t nsip; /* DNS_RPZ_NSIP_ZONE.origin. */
421d4a06479e61fbdc35087f3c4abc9fe65ad72aEvan Hunt dns_name_t passthru; /* DNS_RPZ_PASSTHRU_NAME. */
421d4a06479e61fbdc35087f3c4abc9fe65ad72aEvan Hunt dns_name_t drop; /* DNS_RPZ_DROP_NAME. */
421d4a06479e61fbdc35087f3c4abc9fe65ad72aEvan Hunt dns_name_t tcp_only; /* DNS_RPZ_TCP_ONLY_NAME. */
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt dns_name_t cname; /* override value for ..._CNAME */
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt dns_ttl_t max_policy_ttl;
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt dns_rpz_policy_t policy; /* DNS_RPZ_POLICY_GIVEN or override */
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews};
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews/*
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt * Radix tree node for response policy IP addresses
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews */
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunttypedef struct dns_rpz_cidr_node dns_rpz_cidr_node_t;
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt
7e6cf6fc6e700061a1cec3bcf67786706d956fc5Evan Hunt/*
7e6cf6fc6e700061a1cec3bcf67786706d956fc5Evan Hunt * Bitfields indicating which policy zones have policies of
7e6cf6fc6e700061a1cec3bcf67786706d956fc5Evan Hunt * which type.
7e6cf6fc6e700061a1cec3bcf67786706d956fc5Evan Hunt */
7e6cf6fc6e700061a1cec3bcf67786706d956fc5Evan Hunttypedef struct dns_rpz_have dns_rpz_have_t;
7e6cf6fc6e700061a1cec3bcf67786706d956fc5Evan Huntstruct dns_rpz_have {
7e6cf6fc6e700061a1cec3bcf67786706d956fc5Evan Hunt dns_rpz_zbits_t client_ipv4;
7e6cf6fc6e700061a1cec3bcf67786706d956fc5Evan Hunt dns_rpz_zbits_t client_ipv6;
7e6cf6fc6e700061a1cec3bcf67786706d956fc5Evan Hunt dns_rpz_zbits_t client_ip;
7e6cf6fc6e700061a1cec3bcf67786706d956fc5Evan Hunt dns_rpz_zbits_t qname;
7e6cf6fc6e700061a1cec3bcf67786706d956fc5Evan Hunt dns_rpz_zbits_t ipv4;
7e6cf6fc6e700061a1cec3bcf67786706d956fc5Evan Hunt dns_rpz_zbits_t ipv6;
7e6cf6fc6e700061a1cec3bcf67786706d956fc5Evan Hunt dns_rpz_zbits_t ip;
7e6cf6fc6e700061a1cec3bcf67786706d956fc5Evan Hunt dns_rpz_zbits_t nsdname;
7e6cf6fc6e700061a1cec3bcf67786706d956fc5Evan Hunt dns_rpz_zbits_t nsipv4;
7e6cf6fc6e700061a1cec3bcf67786706d956fc5Evan Hunt dns_rpz_zbits_t nsipv6;
7e6cf6fc6e700061a1cec3bcf67786706d956fc5Evan Hunt dns_rpz_zbits_t nsip;
7e6cf6fc6e700061a1cec3bcf67786706d956fc5Evan Hunt dns_rpz_zbits_t qname_skip_recurse;
7e6cf6fc6e700061a1cec3bcf67786706d956fc5Evan Hunt};
7e6cf6fc6e700061a1cec3bcf67786706d956fc5Evan Hunt
7e6cf6fc6e700061a1cec3bcf67786706d956fc5Evan Hunt/*
7e6cf6fc6e700061a1cec3bcf67786706d956fc5Evan Hunt * Policy options
7e6cf6fc6e700061a1cec3bcf67786706d956fc5Evan Hunt */
7e6cf6fc6e700061a1cec3bcf67786706d956fc5Evan Hunttypedef struct dns_rpz_popt dns_rpz_popt_t;
7e6cf6fc6e700061a1cec3bcf67786706d956fc5Evan Huntstruct dns_rpz_popt {
7e6cf6fc6e700061a1cec3bcf67786706d956fc5Evan Hunt dns_rpz_zbits_t no_rd_ok;
33ca26968b638b4ff9c657e9574d14d1a04a52ddMukund Sivaraman dns_rpz_zbits_t no_log;
7e6cf6fc6e700061a1cec3bcf67786706d956fc5Evan Hunt isc_boolean_t break_dnssec;
7e6cf6fc6e700061a1cec3bcf67786706d956fc5Evan Hunt isc_boolean_t qname_wait_recurse;
08e36aa5a5c7697a839f83831fccf8fb3f792848Mark Andrews isc_boolean_t nsip_wait_recurse;
7e6cf6fc6e700061a1cec3bcf67786706d956fc5Evan Hunt unsigned int min_ns_labels;
7e6cf6fc6e700061a1cec3bcf67786706d956fc5Evan Hunt dns_rpz_num_t num_zones;
7e6cf6fc6e700061a1cec3bcf67786706d956fc5Evan Hunt};
7e6cf6fc6e700061a1cec3bcf67786706d956fc5Evan Hunt
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt/*
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt * Response policy zones known to a view.
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt */
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunttypedef struct dns_rpz_zones dns_rpz_zones_t;
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Huntstruct dns_rpz_zones {
7e6cf6fc6e700061a1cec3bcf67786706d956fc5Evan Hunt dns_rpz_popt_t p;
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt dns_rpz_zone_t *zones[DNS_RPZ_MAX_ZONES];
421d4a06479e61fbdc35087f3c4abc9fe65ad72aEvan Hunt dns_rpz_triggers_t triggers[DNS_RPZ_MAX_ZONES];
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt
7e6cf6fc6e700061a1cec3bcf67786706d956fc5Evan Hunt /*
7e6cf6fc6e700061a1cec3bcf67786706d956fc5Evan Hunt * RPZ policy version number (initially 0, increases whenever
7e6cf6fc6e700061a1cec3bcf67786706d956fc5Evan Hunt * the server is reconfigured with new zones or policy)
7e6cf6fc6e700061a1cec3bcf67786706d956fc5Evan Hunt */
7e6cf6fc6e700061a1cec3bcf67786706d956fc5Evan Hunt int rpz_ver;
7e6cf6fc6e700061a1cec3bcf67786706d956fc5Evan Hunt
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt dns_rpz_zbits_t defined;
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt /*
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt * The set of records for a policy zone are in one of these states:
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt * never loaded load_begun=0 have=0
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt * during initial loading load_begun=1 have=0
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt * and rbtdb->rpzsp == rbtdb->load_rpzsp
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt * after good load load_begun=1 have!=0
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt * after failed initial load load_begun=1 have=0
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt * and rbtdb->load_rpzsp == NULL
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt * reloading after failure load_begun=1 have=0
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt * reloading after success
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt * main rpzs load_begun=1 have!=0
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt * load rpzs load_begun=1 have=0
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt */
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt dns_rpz_zbits_t load_begun;
7e6cf6fc6e700061a1cec3bcf67786706d956fc5Evan Hunt dns_rpz_have_t have;
19365b43e922fcbaf5caff3f92b87b52cbc1b530Evan Hunt
19365b43e922fcbaf5caff3f92b87b52cbc1b530Evan Hunt /*
19365b43e922fcbaf5caff3f92b87b52cbc1b530Evan Hunt * total_triggers maintains the total number of triggers in all
19365b43e922fcbaf5caff3f92b87b52cbc1b530Evan Hunt * policy zones in the view. It is only used to print summary
19365b43e922fcbaf5caff3f92b87b52cbc1b530Evan Hunt * statistics after a zone load of how the trigger counts
19365b43e922fcbaf5caff3f92b87b52cbc1b530Evan Hunt * changed.
19365b43e922fcbaf5caff3f92b87b52cbc1b530Evan Hunt */
421d4a06479e61fbdc35087f3c4abc9fe65ad72aEvan Hunt dns_rpz_triggers_t total_triggers;
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt isc_mem_t *mctx;
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt isc_refcount_t refs;
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt /*
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt * One lock for short term read-only search that guarantees the
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt * consistency of the pointers.
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt * A second lock for maintenance that guarantees no other thread
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt * is adding or deleting nodes.
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt */
8c9fba44a41e3ea23e7e8405029980aba672f7ceEvan Hunt isc_rwlock_t search_lock;
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt isc_mutex_t maint_lock;
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt dns_rpz_cidr_node_t *cidr;
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt dns_rbt_t *rbt;
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt};
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews/*
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews * context for finding the best policy
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews */
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrewstypedef struct {
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews unsigned int state;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews# define DNS_RPZ_REWRITTEN 0x0001
421d4a06479e61fbdc35087f3c4abc9fe65ad72aEvan Hunt# define DNS_RPZ_DONE_CLIENT_IP 0x0002 /* client IP address checked */
421d4a06479e61fbdc35087f3c4abc9fe65ad72aEvan Hunt# define DNS_RPZ_DONE_QNAME 0x0004 /* qname checked */
421d4a06479e61fbdc35087f3c4abc9fe65ad72aEvan Hunt# define DNS_RPZ_DONE_QNAME_IP 0x0008 /* IP addresses of qname checked */
421d4a06479e61fbdc35087f3c4abc9fe65ad72aEvan Hunt# define DNS_RPZ_DONE_NSDNAME 0x0010 /* NS name missed; checking addresses */
421d4a06479e61fbdc35087f3c4abc9fe65ad72aEvan Hunt# define DNS_RPZ_DONE_IPv4 0x0020
421d4a06479e61fbdc35087f3c4abc9fe65ad72aEvan Hunt# define DNS_RPZ_RECURSING 0x0040
8c9fba44a41e3ea23e7e8405029980aba672f7ceEvan Hunt# define DNS_RPZ_ACTIVE 0x0080
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews /*
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews * Best match so far.
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews */
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews struct {
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews dns_rpz_type_t type;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews dns_rpz_zone_t *rpz;
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt dns_rpz_prefix_t prefix;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews dns_rpz_policy_t policy;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews dns_ttl_t ttl;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews isc_result_t result;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews dns_zone_t *zone;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews dns_db_t *db;
7b4b6f361b2fb2291c2019b377a9c0c8e80cfd6bMark Andrews dns_dbversion_t *version;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews dns_dbnode_t *node;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews dns_rdataset_t *rdataset;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews } m;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews /*
9fee08f655527a5dd849b171daeeee1dbbccca76Vernon Schryver * State for chasing IP addresses and NS names including recursion.
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews */
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews struct {
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews unsigned int label;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews dns_db_t *db;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews dns_rdataset_t *ns_rdataset;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews dns_rdatatype_t r_type;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews isc_result_t r_result;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews dns_rdataset_t *r_rdataset;
9fee08f655527a5dd849b171daeeee1dbbccca76Vernon Schryver } r;
7e6cf6fc6e700061a1cec3bcf67786706d956fc5Evan Hunt
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews /*
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews * State of real query while recursing for NSIP or NSDNAME.
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews */
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews struct {
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews isc_result_t result;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews isc_boolean_t is_zone;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews isc_boolean_t authoritative;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews dns_zone_t *zone;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews dns_db_t *db;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews dns_dbnode_t *node;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews dns_rdataset_t *rdataset;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews dns_rdataset_t *sigrdataset;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews dns_rdatatype_t qtype;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews } q;
7e6cf6fc6e700061a1cec3bcf67786706d956fc5Evan Hunt
7e6cf6fc6e700061a1cec3bcf67786706d956fc5Evan Hunt /*
7e6cf6fc6e700061a1cec3bcf67786706d956fc5Evan Hunt * A copy of the 'have' and 'p' structures and the RPZ
7e6cf6fc6e700061a1cec3bcf67786706d956fc5Evan Hunt * policy version as of the beginning of RPZ processing,
7e6cf6fc6e700061a1cec3bcf67786706d956fc5Evan Hunt * used to avoid problems when policy is updated while
7e6cf6fc6e700061a1cec3bcf67786706d956fc5Evan Hunt * RPZ recursion is ongoing.
7e6cf6fc6e700061a1cec3bcf67786706d956fc5Evan Hunt */
7e6cf6fc6e700061a1cec3bcf67786706d956fc5Evan Hunt dns_rpz_have_t have;
7e6cf6fc6e700061a1cec3bcf67786706d956fc5Evan Hunt dns_rpz_popt_t popt;
7e6cf6fc6e700061a1cec3bcf67786706d956fc5Evan Hunt int rpz_ver;
7e6cf6fc6e700061a1cec3bcf67786706d956fc5Evan Hunt
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt /*
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt * p_name: current policy owner name
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt * r_name: recursing for this name to possible policy triggers
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt * f_name: saved found name from before recursion
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt */
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt dns_name_t *p_name;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews dns_name_t *r_name;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews dns_name_t *fname;
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt dns_fixedname_t _p_namef;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews dns_fixedname_t _r_namef;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews dns_fixedname_t _fnamef;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews} dns_rpz_st_t;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews#define DNS_RPZ_TTL_DEFAULT 5
afaa290bb6acc504e93a0adbf20b6dd6c64e6d63Vernon Schryver#define DNS_RPZ_MAX_TTL_DEFAULT DNS_RPZ_TTL_DEFAULT
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews/*
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews * So various response policy zone messages can be turned up or down.
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews */
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews#define DNS_RPZ_ERROR_LEVEL ISC_LOG_WARNING
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews#define DNS_RPZ_INFO_LEVEL ISC_LOG_INFO
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews#define DNS_RPZ_DEBUG_LEVEL1 ISC_LOG_DEBUG(1)
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews#define DNS_RPZ_DEBUG_LEVEL2 ISC_LOG_DEBUG(2)
9fee08f655527a5dd849b171daeeee1dbbccca76Vernon Schryver#define DNS_RPZ_DEBUG_LEVEL3 ISC_LOG_DEBUG(3)
afaa290bb6acc504e93a0adbf20b6dd6c64e6d63Vernon Schryver#define DNS_RPZ_DEBUG_QUIET (DNS_RPZ_DEBUG_LEVEL3+1)
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrewsconst char *
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrewsdns_rpz_type2str(dns_rpz_type_t type);
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews
9cee5bb02863bf191e12cd4297adabf1971020deAutomatic Updaterdns_rpz_policy_t
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrewsdns_rpz_str2policy(const char *str);
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews
9fee08f655527a5dd849b171daeeee1dbbccca76Vernon Schryverconst char *
9fee08f655527a5dd849b171daeeee1dbbccca76Vernon Schryverdns_rpz_policy2str(dns_rpz_policy_t policy);
9fee08f655527a5dd849b171daeeee1dbbccca76Vernon Schryver
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Huntdns_rpz_policy_t
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Huntdns_rpz_decode_cname(dns_rpz_zone_t *rpz, dns_rdataset_t *rdataset,
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt dns_name_t *selfname);
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Huntisc_result_t
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Huntdns_rpz_new_zones(dns_rpz_zones_t **rpzsp, isc_mem_t *mctx);
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrewsvoid
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Huntdns_rpz_attach_rpzs(dns_rpz_zones_t *source, dns_rpz_zones_t **target);
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrewsvoid
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Huntdns_rpz_detach_rpzs(dns_rpz_zones_t **rpzsp);
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrewsisc_result_t
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Huntdns_rpz_beginload(dns_rpz_zones_t **load_rpzsp,
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt dns_rpz_zones_t *rpzs, dns_rpz_num_t rpz_num);
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Huntisc_result_t
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Huntdns_rpz_ready(dns_rpz_zones_t *rpzs,
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt dns_rpz_zones_t **load_rpzsp, dns_rpz_num_t rpz_num);
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Huntisc_result_t
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Huntdns_rpz_add(dns_rpz_zones_t *rpzs, dns_rpz_num_t rpz_num, dns_name_t *name);
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrewsvoid
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Huntdns_rpz_delete(dns_rpz_zones_t *rpzs, dns_rpz_num_t rpz_num, dns_name_t *name);
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Huntdns_rpz_num_t
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Huntdns_rpz_find_ip(dns_rpz_zones_t *rpzs, dns_rpz_type_t rpz_type,
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt dns_rpz_zbits_t zbits, const isc_netaddr_t *netaddr,
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt dns_name_t *ip_name, dns_rpz_prefix_t *prefixp);
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Huntdns_rpz_zbits_t
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Huntdns_rpz_find_name(dns_rpz_zones_t *rpzs, dns_rpz_type_t rpz_type,
94315060c2b0d9deafabe72d6a0482405fd9d377Evan Hunt dns_rpz_zbits_t zbits, dns_name_t *trig_name);
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews
4f3a3fc43c6e2de62997d2378e87b4248cf771aeMark AndrewsISC_LANG_ENDDECLS
4f3a3fc43c6e2de62997d2378e87b4248cf771aeMark Andrews
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews#endif /* DNS_RPZ_H */
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews