rpz.h revision 7a440c4300b1a2712e18100772263c97ce1ab9d6
5cd4555ad444fd391002ae32450572054369fd42Rob Austein/*
5cd4555ad444fd391002ae32450572054369fd42Rob Austein * Copyright (C) 2011, 2012 Internet Systems Consortium, Inc. ("ISC")
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein *
d4ef65050feac78554addf6e16a06c6e2e0bd331Brian Wellington * Permission to use, copy, modify, and/or distribute this software for any
c1a883f2e04d94e99c433b1f6cfd0c0338f4ed85Mark Andrews * purpose with or without fee is hereby granted, provided that the above
c651f15b30f1dae5cc2f00878fb5da5b3a35a468Mark Andrews * copyright notice and this permission notice appear in all copies.
d4ef65050feac78554addf6e16a06c6e2e0bd331Brian Wellington *
ec5347e2c775f027573ce5648b910361aa926c01Automatic Updater * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
d4ef65050feac78554addf6e16a06c6e2e0bd331Brian Wellington * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
d4ef65050feac78554addf6e16a06c6e2e0bd331Brian Wellington * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
d4ef65050feac78554addf6e16a06c6e2e0bd331Brian Wellington * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
dafcb997e390efa4423883dafd100c975c4095d6Mark Andrews * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
dafcb997e390efa4423883dafd100c975c4095d6Mark Andrews * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
dafcb997e390efa4423883dafd100c975c4095d6Mark Andrews * PERFORMANCE OF THIS SOFTWARE.
dafcb997e390efa4423883dafd100c975c4095d6Mark Andrews */
dafcb997e390efa4423883dafd100c975c4095d6Mark Andrews
dafcb997e390efa4423883dafd100c975c4095d6Mark Andrews/* $Id: rpz.h,v 1.5 2011/10/28 11:46:50 marka Exp $ */
dafcb997e390efa4423883dafd100c975c4095d6Mark Andrews
d4ef65050feac78554addf6e16a06c6e2e0bd331Brian Wellington#ifndef DNS_RPZ_H
f5d30e2864e048a42c4dc1134993ae7efdb5d6c3Mark Andrews#define DNS_RPZ_H 1
ec5347e2c775f027573ce5648b910361aa926c01Automatic Updater
b5ad6dfea4cc3e7d1d322ac99f1e5a31096837c4Mark Andrews#include <isc/lang.h>
94bd918b63001277f1b28ae4581645f8a835688fBob Halley
94bd918b63001277f1b28ae4581645f8a835688fBob Halley#include <dns/fixedname.h>
94bd918b63001277f1b28ae4581645f8a835688fBob Halley#include <dns/rdata.h>
94bd918b63001277f1b28ae4581645f8a835688fBob Halley#include <dns/types.h>
94bd918b63001277f1b28ae4581645f8a835688fBob Halley
94bd918b63001277f1b28ae4581645f8a835688fBob HalleyISC_LANG_BEGINDECLS
94bd918b63001277f1b28ae4581645f8a835688fBob Halley
94bd918b63001277f1b28ae4581645f8a835688fBob Halley#define DNS_RPZ_IP_ZONE "rpz-ip"
94bd918b63001277f1b28ae4581645f8a835688fBob Halley#define DNS_RPZ_NSIP_ZONE "rpz-nsip"
94bd918b63001277f1b28ae4581645f8a835688fBob Halley#define DNS_RPZ_NSDNAME_ZONE "rpz-nsdname"
94bd918b63001277f1b28ae4581645f8a835688fBob Halley#define DNS_RPZ_PASSTHRU_ZONE "rpz-passthru"
94bd918b63001277f1b28ae4581645f8a835688fBob Halley
94bd918b63001277f1b28ae4581645f8a835688fBob Halleytypedef isc_uint8_t dns_rpz_cidr_bits_t;
94bd918b63001277f1b28ae4581645f8a835688fBob Halley
94bd918b63001277f1b28ae4581645f8a835688fBob Halleytypedef enum {
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein DNS_RPZ_TYPE_BAD,
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein DNS_RPZ_TYPE_QNAME,
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein DNS_RPZ_TYPE_IP,
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein DNS_RPZ_TYPE_NSDNAME,
c1a883f2e04d94e99c433b1f6cfd0c0338f4ed85Mark Andrews DNS_RPZ_TYPE_NSIP
4eb998928b9aef0ceda42d7529980d658138698aEvan Hunt} dns_rpz_type_t;
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein/*
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein * Require DNS_RPZ_POLICY_PASSTHRU < DNS_RPZ_POLICY_NXDOMAIN <
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein * DNS_RPZ_POLICY_NODATA < DNS_RPZ_POLICY_CNAME to choose among competing
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein * policies.
f5d30e2864e048a42c4dc1134993ae7efdb5d6c3Mark Andrews */
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austeintypedef enum {
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein DNS_RPZ_POLICY_GIVEN = 0, /* 'given': what policy record says */
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein DNS_RPZ_POLICY_DISABLED = 1, /* 'cname x': answer with x's rrsets */
94bd918b63001277f1b28ae4581645f8a835688fBob Halley DNS_RPZ_POLICY_PASSTHRU = 2, /* 'passthru': do not rewrite */
94bd918b63001277f1b28ae4581645f8a835688fBob Halley DNS_RPZ_POLICY_NXDOMAIN = 3, /* 'nxdomain': answer with NXDOMAIN */
94bd918b63001277f1b28ae4581645f8a835688fBob Halley DNS_RPZ_POLICY_NODATA = 4, /* 'nodata': answer with ANCOUNT=0 */
94bd918b63001277f1b28ae4581645f8a835688fBob Halley DNS_RPZ_POLICY_CNAME = 5, /* 'cname x': answer with x's rrsets */
94bd918b63001277f1b28ae4581645f8a835688fBob Halley DNS_RPZ_POLICY_RECORD,
94bd918b63001277f1b28ae4581645f8a835688fBob Halley DNS_RPZ_POLICY_WILDCNAME,
94bd918b63001277f1b28ae4581645f8a835688fBob Halley DNS_RPZ_POLICY_MISS,
94bd918b63001277f1b28ae4581645f8a835688fBob Halley DNS_RPZ_POLICY_ERROR
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein} dns_rpz_policy_t;
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein/*
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein * Specify a response policy zone.
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein */
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austeintypedef struct dns_rpz_zone dns_rpz_zone_t;
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austeinstruct dns_rpz_zone {
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein ISC_LINK(dns_rpz_zone_t) link;
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein int num; /* ordinal in list of policy zones */
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein dns_name_t origin; /* Policy zone name */
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein dns_name_t nsdname; /* DNS_RPZ_NSDNAME_ZONE.origin */
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein dns_name_t passthru;/* DNS_RPZ_PASSTHRU_ZONE. */
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein dns_name_t cname; /* override value for ..._CNAME */
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein dns_ttl_t max_policy_ttl;
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein dns_rpz_policy_t policy; /* DNS_RPZ_POLICY_GIVEN or override */
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein isc_boolean_t recursive_only;
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein};
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein/*
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein * Radix trees for response policy IP addresses.
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein */
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austeintypedef struct dns_rpz_cidr dns_rpz_cidr_t;
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein/*
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein * context for finding the best policy
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein */
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austeintypedef struct {
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein unsigned int state;
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein# define DNS_RPZ_REWRITTEN 0x0001
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein# define DNS_RPZ_DONE_QNAME 0x0002 /* qname checked */
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein# define DNS_RPZ_DONE_QNAME_IP 0x0004 /* IP addresses of qname checked */
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein# define DNS_RPZ_DONE_NSDNAME 0x0008 /* NS name missed; checking addresses */
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein# define DNS_RPZ_DONE_IPv4 0x0010
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein# define DNS_RPZ_RECURSING 0x0020
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein# define DNS_RPZ_HAVE_IP 0x0040 /* a policy zone has IP addresses */
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein# define DNS_RPZ_HAVE_NSIPv4 0x0080 /* IPv4 NISP addresses */
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein# define DNS_RPZ_HAVE_NSIPv6 0x0100 /* IPv6 NISP addresses */
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein# define DNS_RPZ_HAVE_NSDNAME 0x0200 /* NS names */
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein /*
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein * Best match so far.
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein */
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein struct {
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein dns_rpz_type_t type;
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein dns_rpz_zone_t *rpz;
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein dns_rpz_cidr_bits_t prefix;
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein dns_rpz_policy_t policy;
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein dns_ttl_t ttl;
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein isc_result_t result;
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein dns_zone_t *zone;
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein dns_db_t *db;
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein dns_dbversion_t *version;
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein dns_dbnode_t *node;
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein dns_rdataset_t *rdataset;
8b9fc7617b8f54641708c985697848e6cc10a5bbMark Andrews } m;
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein /*
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein * State for chasing IP addresses and NS names including recursion.
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein */
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein struct {
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein unsigned int label;
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein dns_db_t *db;
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein dns_rdataset_t *ns_rdataset;
4eb998928b9aef0ceda42d7529980d658138698aEvan Hunt dns_rdatatype_t r_type;
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein isc_result_t r_result;
4eb998928b9aef0ceda42d7529980d658138698aEvan Hunt dns_rdataset_t *r_rdataset;
4eb998928b9aef0ceda42d7529980d658138698aEvan Hunt } r;
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein /*
4eb998928b9aef0ceda42d7529980d658138698aEvan Hunt * State of real query while recursing for NSIP or NSDNAME.
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein */
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein struct {
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein isc_result_t result;
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein isc_boolean_t is_zone;
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein isc_boolean_t authoritative;
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein dns_zone_t *zone;
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein dns_db_t *db;
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein dns_dbnode_t *node;
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein dns_rdataset_t *rdataset;
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein dns_rdataset_t *sigrdataset;
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein dns_rdatatype_t qtype;
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein } q;
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein dns_name_t *qname;
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein dns_name_t *r_name;
94bd918b63001277f1b28ae4581645f8a835688fBob Halley dns_name_t *fname;
94bd918b63001277f1b28ae4581645f8a835688fBob Halley dns_fixedname_t _qnamef;
94bd918b63001277f1b28ae4581645f8a835688fBob Halley dns_fixedname_t _r_namef;
94bd918b63001277f1b28ae4581645f8a835688fBob Halley dns_fixedname_t _fnamef;
94bd918b63001277f1b28ae4581645f8a835688fBob Halley} dns_rpz_st_t;
94bd918b63001277f1b28ae4581645f8a835688fBob Halley
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein#define DNS_RPZ_TTL_DEFAULT 5
7389e8330d62a059b8923fb8ca6f933caeb559d9Mark Andrews#define DNS_RPZ_MAX_TTL_DEFAULT DNS_RPZ_TTL_DEFAULT
94bd918b63001277f1b28ae4581645f8a835688fBob Halley
94bd918b63001277f1b28ae4581645f8a835688fBob Halley/*
94bd918b63001277f1b28ae4581645f8a835688fBob Halley * So various response policy zone messages can be turned up or down.
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein */
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein#define DNS_RPZ_ERROR_LEVEL ISC_LOG_WARNING
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein#define DNS_RPZ_INFO_LEVEL ISC_LOG_INFO
94bd918b63001277f1b28ae4581645f8a835688fBob Halley#define DNS_RPZ_DEBUG_LEVEL1 ISC_LOG_DEBUG(1)
94bd918b63001277f1b28ae4581645f8a835688fBob Halley#define DNS_RPZ_DEBUG_LEVEL2 ISC_LOG_DEBUG(2)
94bd918b63001277f1b28ae4581645f8a835688fBob Halley#define DNS_RPZ_DEBUG_LEVEL3 ISC_LOG_DEBUG(3)
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein#define DNS_RPZ_DEBUG_QUIET (DNS_RPZ_DEBUG_LEVEL3+1)
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austeinconst char *
7389e8330d62a059b8923fb8ca6f933caeb559d9Mark Andrewsdns_rpz_type2str(dns_rpz_type_t type);
7389e8330d62a059b8923fb8ca6f933caeb559d9Mark Andrews
7389e8330d62a059b8923fb8ca6f933caeb559d9Mark Andrewsdns_rpz_policy_t
7389e8330d62a059b8923fb8ca6f933caeb559d9Mark Andrewsdns_rpz_str2policy(const char *str);
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austeinconst char *
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austeindns_rpz_policy2str(dns_rpz_policy_t policy);
94bd918b63001277f1b28ae4581645f8a835688fBob Halley
4eb998928b9aef0ceda42d7529980d658138698aEvan Huntvoid
7389e8330d62a059b8923fb8ca6f933caeb559d9Mark Andrewsdns_rpz_set_need(isc_boolean_t need);
94bd918b63001277f1b28ae4581645f8a835688fBob Halley
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austeinisc_boolean_t
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austeindns_rpz_needed(void);
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein
7389e8330d62a059b8923fb8ca6f933caeb559d9Mark Andrewsvoid
4eb998928b9aef0ceda42d7529980d658138698aEvan Huntdns_rpz_cidr_free(dns_rpz_cidr_t **cidr);
7389e8330d62a059b8923fb8ca6f933caeb559d9Mark Andrews
561a29af8c54a216e7d30b5b4f6e0d21661654ecMark Andrewsvoid
94bd918b63001277f1b28ae4581645f8a835688fBob Halleydns_rpz_view_destroy(dns_view_t *view);
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein
94bd918b63001277f1b28ae4581645f8a835688fBob Halleyisc_result_t
94bd918b63001277f1b28ae4581645f8a835688fBob Halleydns_rpz_new_cidr(isc_mem_t *mctx, dns_name_t *origin,
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein dns_rpz_cidr_t **rbtdb_cidr);
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austeinvoid
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austeindns_rpz_enabled(dns_rpz_cidr_t *cidr, dns_rpz_st_t *st);
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austeinvoid
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austeindns_rpz_cidr_deleteip(dns_rpz_cidr_t *cidr, dns_name_t *name);
4eb998928b9aef0ceda42d7529980d658138698aEvan Hunt
4eb998928b9aef0ceda42d7529980d658138698aEvan Huntvoid
94bd918b63001277f1b28ae4581645f8a835688fBob Halleydns_rpz_cidr_addip(dns_rpz_cidr_t *cidr, dns_name_t *name);
7389e8330d62a059b8923fb8ca6f933caeb559d9Mark Andrews
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austeinisc_result_t
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austeindns_rpz_cidr_find(dns_rpz_cidr_t *cidr, const isc_netaddr_t *netaddr,
7389e8330d62a059b8923fb8ca6f933caeb559d9Mark Andrews dns_rpz_type_t type, dns_name_t *canon_name,
94bd918b63001277f1b28ae4581645f8a835688fBob Halley dns_name_t *search_name, dns_rpz_cidr_bits_t *prefix);
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein
94bd918b63001277f1b28ae4581645f8a835688fBob Halleydns_rpz_policy_t
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austeindns_rpz_decode_cname(dns_rpz_zone_t *rpz, dns_rdataset_t *rdataset,
94bd918b63001277f1b28ae4581645f8a835688fBob Halley dns_name_t *selfname);
94bd918b63001277f1b28ae4581645f8a835688fBob Halley
268a4475065fe6a8cd7cc707820982cf5e98f430Rob AusteinISC_LANG_ENDDECLS
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein#endif /* DNS_RPZ_H */
561a29af8c54a216e7d30b5b4f6e0d21661654ecMark Andrews
268a4475065fe6a8cd7cc707820982cf5e98f430Rob Austein