rpz.h revision 7e6cf6fc6e700061a1cec3bcf67786706d956fc5
/*
* Copyright (C) 2011-2013 Internet Systems Consortium, Inc. ("ISC")
*
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
* THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
* REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
* AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
* INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
* LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
* OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
* PERFORMANCE OF THIS SOFTWARE.
*/
/* $Id$ */
#ifndef DNS_RPZ_H
#define DNS_RPZ_H 1
#include <dns/fixedname.h>
#include <isc/refcount.h>
#define DNS_RPZ_PREFIX "rpz-"
/*
* Sub-zones of various trigger types.
*/
/*
* Special policies.
*/
typedef isc_uint8_t dns_rpz_prefix_t;
typedef enum {
/*
* Require DNS_RPZ_POLICY_PASSTHRU < DNS_RPZ_POLICY_DROP
* < DNS_RPZ_POLICY_TCP_ONLY DNS_RPZ_POLICY_NXDOMAIN < DNS_RPZ_POLICY_NODATA
* < DNS_RPZ_POLICY_CNAME to choose among competing policies.
*/
typedef enum {
DNS_RPZ_POLICY_GIVEN = 0, /* 'given': what policy record says */
typedef isc_uint8_t dns_rpz_num_t;
#define DNS_RPZ_MAX_ZONES 32
#if DNS_RPZ_MAX_ZONES > 32
# if DNS_RPZ_MAX_ZONES > 64
# error "rpz zone bit masks must fit in a word"
# endif
typedef isc_uint64_t dns_rpz_zbits_t;
#else
typedef isc_uint32_t dns_rpz_zbits_t;
#endif
#define DNS_RPZ_INVALID_NUM DNS_RPZ_MAX_ZONES
/*
* Mask of the specified and higher numbered policy zones
* Avoid hassles with (1<<33) or (1<<65)
*/
0 : (1<<((n)+1))) -1))
/*
* The number of triggers of each type in a response policy zone.
*/
typedef struct dns_rpz_triggers dns_rpz_triggers_t;
struct dns_rpz_triggers {
int client_ipv4;
int client_ipv6;
int qname;
int ipv4;
int ipv6;
int nsdname;
int nsipv4;
int nsipv6;
};
/*
* A single response policy zone.
*/
typedef struct dns_rpz_zone dns_rpz_zone_t;
struct dns_rpz_zone {
};
/*
* Radix tree node for response policy IP addresses
*/
typedef struct dns_rpz_cidr_node dns_rpz_cidr_node_t;
/*
* Bitfields indicating which policy zones have policies of
* which type.
*/
typedef struct dns_rpz_have dns_rpz_have_t;
struct dns_rpz_have {
};
/*
* Policy options
*/
typedef struct dns_rpz_popt dns_rpz_popt_t;
struct dns_rpz_popt {
unsigned int min_ns_labels;
};
/*
* Response policy zones known to a view.
*/
typedef struct dns_rpz_zones dns_rpz_zones_t;
struct dns_rpz_zones {
/*
* RPZ policy version number (initially 0, increases whenever
* the server is reconfigured with new zones or policy)
*/
int rpz_ver;
dns_rpz_zbits_t defined;
/*
* The set of records for a policy zone are in one of these states:
* never loaded load_begun=0 have=0
* during initial loading load_begun=1 have=0
* and rbtdb->rpzsp == rbtdb->load_rpzsp
* after good load load_begun=1 have!=0
* after failed initial load load_begun=1 have=0
* and rbtdb->load_rpzsp == NULL
* reloading after failure load_begun=1 have=0
* reloading after success
* main rpzs load_begun=1 have!=0
* load rpzs load_begun=1 have=0
*/
/*
* One lock for short term read-only search that guarantees the
* consistency of the pointers.
* A second lock for maintenance that guarantees no other thread
* is adding or deleting nodes.
*/
};
/*
* context for finding the best policy
*/
typedef struct {
unsigned int state;
# define DNS_RPZ_REWRITTEN 0x0001
# define DNS_RPZ_DONE_IPv4 0x0020
# define DNS_RPZ_RECURSING 0x0040
/*
* Best match so far.
*/
struct {
} m;
/*
* State for chasing IP addresses and NS names including recursion.
*/
struct {
unsigned int label;
} r;
/*
* State of real query while recursing for NSIP or NSDNAME.
*/
struct {
} q;
/*
* A copy of the 'have' and 'p' structures and the RPZ
* policy version as of the beginning of RPZ processing,
* used to avoid problems when policy is updated while
* RPZ recursion is ongoing.
*/
int rpz_ver;
/*
* p_name: current policy owner name
* r_name: recursing for this name to possible policy triggers
* f_name: saved found name from before recursion
*/
} dns_rpz_st_t;
#define DNS_RPZ_TTL_DEFAULT 5
/*
* So various response policy zone messages can be turned up or down.
*/
#define DNS_RPZ_ERROR_LEVEL ISC_LOG_WARNING
#define DNS_RPZ_INFO_LEVEL ISC_LOG_INFO
const char *
dns_rpz_str2policy(const char *str);
const char *
void
void
void
#endif /* DNS_RPZ_H */