rpz.h revision 87708bde16713bc02ff2598f4a82f98c699a2f2d
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews/*
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews * Copyright (C) 2010 Internet Systems Consortium, Inc. ("ISC")
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews *
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews * Permission to use, copy, modify, and/or distribute this software for any
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews * purpose with or without fee is hereby granted, provided that the above
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews * copyright notice and this permission notice appear in all copies.
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews *
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews * PERFORMANCE OF THIS SOFTWARE.
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews */
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews/* $Id: rpz.h,v 1.2 2011/01/13 01:59:28 marka Exp $ */
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews#ifndef DNS_RPZ_H
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews#define DNS_RPZ_H 1
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews#include <isc/lang.h>
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews#include <dns/fixedname.h>
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews#include <dns/rdata.h>
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews#include <dns/types.h>
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews
87708bde16713bc02ff2598f4a82f98c699a2f2dMark AndrewsISC_LANG_BEGINDECLS
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews#define DNS_RPZ_IP_ZONE "rpz-ip"
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews#define DNS_RPZ_NSIP_ZONE "rpz-nsip"
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews#define DNS_RPZ_NSDNAME_ZONE "rpz-nsdname"
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrewstypedef isc_uint8_t dns_rpz_cidr_bits_t;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrewstypedef enum {
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews DNS_RPZ_TYPE_BAD,
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews DNS_RPZ_TYPE_QNAME,
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews DNS_RPZ_TYPE_IP,
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews DNS_RPZ_TYPE_NSIP,
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews DNS_RPZ_TYPE_NSDNAME
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews} dns_rpz_type_t;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews/*
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews * Require DNS_RPZ_POLICY_NO_OP < DNS_RPZ_POLICY_NXDOMAIN <
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews * DNS_RPZ_POLICY_NODATA < DNS_RPZ_POLICY_CNAME.
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews */
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrewstypedef enum {
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews DNS_RPZ_POLICY_GIVEN = 0, /* 'given': what something else says */
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews DNS_RPZ_POLICY_NO_OP = 1, /* 'no-op': do not rewrite */
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews DNS_RPZ_POLICY_NXDOMAIN = 2, /* 'nxdomain': answer with NXDOMAIN */
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews DNS_RPZ_POLICY_NODATA = 3, /* 'nodata': answer with ANCOUNT=0 */
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews DNS_RPZ_POLICY_CNAME = 4, /* 'cname x': answer with x's rrsets */
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews DNS_RPZ_POLICY_RECORD = 5,
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews DNS_RPZ_POLICY_MISS,
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews DNS_RPZ_POLICY_ERROR
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews} dns_rpz_policy_t;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews/*
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews * Specify a response policy zone.
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews */
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrewstypedef struct dns_rpz_zone dns_rpz_zone_t;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrewsstruct dns_rpz_zone {
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews ISC_LINK(dns_rpz_zone_t) link;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews int num;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews dns_name_t origin; /* Policy zone name */
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews dns_name_t nsdname; /* RPZ_NSDNAME_ZONE.origin */
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews dns_rpz_policy_t policy; /* RPZ_POLICY_GIVEN or override */
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews dns_name_t cname; /* override name for
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews RPZ_POLICY_CNAME */
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews};
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews/*
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews * Radix trees for response policy IP addresses.
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews */
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrewstypedef struct dns_rpz_cidr dns_rpz_cidr_t;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews/*
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews * context for finding the best policy
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews */
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrewstypedef struct {
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews unsigned int state;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews# define DNS_RPZ_REWRITTEN 0x0001
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews# define DNS_RPZ_DONE_QNAME 0x0002
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews# define DNS_RPZ_DONE_A 0x0004
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews# define DNS_RPZ_RECURSING 0x0008
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews# define DNS_RPZ_HAVE_IP 0x0010
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews# define DNS_RPZ_HAVE_NSIPv4 0x0020
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews# define DNS_RPZ_HAVE_NSIPv6 0x0040
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews# define DNS_RPZ_HAD_NSDNAME 0x0080
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews /*
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews * Best match so far.
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews */
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews struct {
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews dns_rpz_type_t type;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews dns_rpz_zone_t *rpz;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews dns_rpz_cidr_bits_t prefix;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews dns_rpz_policy_t policy;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews dns_ttl_t ttl;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews isc_result_t result;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews dns_zone_t *zone;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews dns_db_t *db;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews dns_dbnode_t *node;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews dns_rdataset_t *rdataset;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews } m;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews /*
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews * State for chasing NS names and addresses including recursion.
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews */
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews struct {
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews unsigned int label;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews dns_db_t *db;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews dns_rdataset_t *ns_rdataset;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews dns_rdatatype_t r_type;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews isc_result_t r_result;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews dns_rdataset_t *r_rdataset;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews } ns;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews /*
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews * State of real query while recursing for NSIP or NSDNAME.
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews */
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews struct {
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews isc_result_t result;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews isc_boolean_t is_zone;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews isc_boolean_t authoritative;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews dns_zone_t *zone;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews dns_db_t *db;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews dns_dbnode_t *node;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews dns_rdataset_t *rdataset;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews dns_rdataset_t *sigrdataset;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews dns_rdatatype_t qtype;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews } q;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews dns_name_t *qname;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews dns_name_t *r_name;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews dns_name_t *fname;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews dns_fixedname_t _qnamef;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews dns_fixedname_t _r_namef;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews dns_fixedname_t _fnamef;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews} dns_rpz_st_t;
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews#define DNS_RPZ_TTL_DEFAULT 5
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews/*
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews * So various response policy zone messages can be turned up or down.
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews */
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews#define DNS_RPZ_ERROR_LEVEL ISC_LOG_WARNING
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews#define DNS_RPZ_INFO_LEVEL ISC_LOG_INFO
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews#define DNS_RPZ_DEBUG_LEVEL1 ISC_LOG_DEBUG(1)
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews#define DNS_RPZ_DEBUG_LEVEL2 ISC_LOG_DEBUG(2)
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrewsconst char *
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrewsdns_rpz_type2str(dns_rpz_type_t type);
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrewsdns_rpz_policy_t
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrewsdns_rpz_str2policy(const char *str);
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrewsvoid
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrewsdns_rpz_set_need(isc_boolean_t need);
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrewsisc_boolean_t
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrewsdns_rpz_needed(void);
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrewsvoid
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrewsdns_rpz_cidr_free(dns_rpz_cidr_t **cidr);
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrewsvoid
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrewsdns_rpz_view_destroy(dns_view_t *view);
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrewsisc_result_t
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrewsdns_rpz_new_cidr(isc_mem_t *mctx, dns_name_t *origin,
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews dns_rpz_cidr_t **rbtdb_cidr);
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrewsvoid
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrewsdns_rpz_enabled(dns_rpz_cidr_t *cidr, dns_rpz_st_t *st);
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrewsvoid
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrewsdns_rpz_cidr_deleteip(dns_rpz_cidr_t *cidr, dns_name_t *name);
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrewsvoid
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrewsdns_rpz_cidr_addip(dns_rpz_cidr_t *cidr, dns_name_t *name);
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrewsisc_result_t
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrewsdns_rpz_cidr_find(dns_rpz_cidr_t *cidr, const isc_netaddr_t *netaddr,
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews dns_rpz_type_t type, dns_name_t *canon_name,
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews dns_name_t *search_name, dns_rpz_cidr_bits_t *prefix);
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrewsdns_rpz_policy_t
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrewsdns_rpz_decode_cname(dns_rdataset_t *, dns_name_t *selfname);
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews#endif /* DNS_RPZ_H */
87708bde16713bc02ff2598f4a82f98c699a2f2dMark Andrews