rpz.h revision f97d56e757b9a293ffbaa915ca4d792ae84ba85a
803b50652fd6ad81d04d18fc04332c8a94f8fe9aAndreas Gustafsson/*
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater * Copyright (C) 2011, 2012 Internet Systems Consortium, Inc. ("ISC")
75c0816e8295e180f4bc7f10db3d0d880383bc1cMark Andrews *
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein * Permission to use, copy, modify, and/or distribute this software for any
803b50652fd6ad81d04d18fc04332c8a94f8fe9aAndreas Gustafsson * purpose with or without fee is hereby granted, provided that the above
803b50652fd6ad81d04d18fc04332c8a94f8fe9aAndreas Gustafsson * copyright notice and this permission notice appear in all copies.
803b50652fd6ad81d04d18fc04332c8a94f8fe9aAndreas Gustafsson *
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
8a66318e41ed14c5a88130e8c362610e8faa2121Mark Andrews * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
8a66318e41ed14c5a88130e8c362610e8faa2121Mark Andrews * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
8a66318e41ed14c5a88130e8c362610e8faa2121Mark Andrews * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
8a66318e41ed14c5a88130e8c362610e8faa2121Mark Andrews * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
8a66318e41ed14c5a88130e8c362610e8faa2121Mark Andrews * PERFORMANCE OF THIS SOFTWARE.
8a66318e41ed14c5a88130e8c362610e8faa2121Mark Andrews */
803b50652fd6ad81d04d18fc04332c8a94f8fe9aAndreas Gustafsson
731cc132f22dbc9e0ecd7035dce314a61076d31bAutomatic Updater/* $Id$ */
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein#ifndef DNS_RPZ_H
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein#define DNS_RPZ_H 1
e21a2904f02a03fa06b6db04d348f65fe9c67b2bMark Andrews
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein#include <isc/lang.h>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater#include <dns/fixedname.h>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein#include <dns/rdata.h>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein#include <dns/types.h>
0c6ada0a814f3c5417daa1654129bc2af56ed504Automatic Updater#include <isc/refcount.h>
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob AusteinISC_LANG_BEGINDECLS
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein
731cc132f22dbc9e0ecd7035dce314a61076d31bAutomatic Updater#define DNS_RPZ_PREFIX "rpz-"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein#define DNS_RPZ_IP_ZONE DNS_RPZ_PREFIX"ip"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein#define DNS_RPZ_NSIP_ZONE DNS_RPZ_PREFIX"nsip"
731cc132f22dbc9e0ecd7035dce314a61076d31bAutomatic Updater#define DNS_RPZ_NSDNAME_ZONE DNS_RPZ_PREFIX"nsdname"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein#define DNS_RPZ_PASSTHRU_ZONE DNS_RPZ_PREFIX"passthru"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeintypedef isc_uint8_t dns_rpz_prefix_t;
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeintypedef enum {
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein DNS_RPZ_TYPE_BAD,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein DNS_RPZ_TYPE_QNAME,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein DNS_RPZ_TYPE_IP,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein DNS_RPZ_TYPE_NSDNAME,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein DNS_RPZ_TYPE_NSIP
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein} dns_rpz_type_t;
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein/*
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein * Require DNS_RPZ_POLICY_PASSTHRU < DNS_RPZ_POLICY_NXDOMAIN <
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein * DNS_RPZ_POLICY_NODATA < DNS_RPZ_POLICY_CNAME to choose among competing
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein * policies.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein */
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeintypedef enum {
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein DNS_RPZ_POLICY_GIVEN = 0, /* 'given': what policy record says */
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein DNS_RPZ_POLICY_DISABLED = 1, /* log what would have happened */
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein DNS_RPZ_POLICY_PASSTHRU = 2, /* 'passthru': do not rewrite */
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein DNS_RPZ_POLICY_NXDOMAIN = 3, /* 'nxdomain': answer with NXDOMAIN */
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein DNS_RPZ_POLICY_NODATA = 4, /* 'nodata': answer with ANCOUNT=0 */
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein DNS_RPZ_POLICY_CNAME = 5, /* 'cname x': answer with x's rrsets */
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein DNS_RPZ_POLICY_RECORD,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein DNS_RPZ_POLICY_WILDCNAME,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein DNS_RPZ_POLICY_MISS,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein DNS_RPZ_POLICY_ERROR
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein} dns_rpz_policy_t;
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeintypedef isc_uint8_t dns_rpz_num_t;
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein
731cc132f22dbc9e0ecd7035dce314a61076d31bAutomatic Updater#define DNS_RPZ_MAX_ZONES 32
731cc132f22dbc9e0ecd7035dce314a61076d31bAutomatic Updater#if DNS_RPZ_MAX_ZONES > 32
731cc132f22dbc9e0ecd7035dce314a61076d31bAutomatic Updater# if DNS_RPZ_MAX_ZONES > 64
731cc132f22dbc9e0ecd7035dce314a61076d31bAutomatic Updater# error "rpz zone bit masks must fit in a word"
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein# endif
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeintypedef isc_uint64_t dns_rpz_zbits_t;
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein#else
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeintypedef isc_uint32_t dns_rpz_zbits_t;
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein#endif
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein#define DNS_RPZ_ALL_ZBITS ((dns_rpz_zbits_t)-1)
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein#define DNS_RPZ_INVALID_NUM DNS_RPZ_MAX_ZONES
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein#define DNS_RPZ_ZBIT(n) (((dns_rpz_zbits_t)1) << (dns_rpz_num_t)(n))
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein
d71e2e0c61df16ff37c9934c371a4a60c08974f7Mark Andrews/*
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein * Mask of the specified and higher numbered policy zones
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein * Avoid hassles with (1<<33) or (1<<65)
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein */
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein#define DNS_RPZ_ZMASK(n) ((dns_rpz_zbits_t)((((n) >= DNS_RPZ_MAX_ZONES-1) ? \
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein 0 : (1<<((n)+1))) -1))
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein/*
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein * A single response policy zone.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein */
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeintypedef struct dns_rpz_triggers dns_rpz_triggers_t;
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeinstruct dns_rpz_triggers {
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein int qname;
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein int ipv4;
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein int ipv6;
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein int nsdname;
7329012471d165cd3dc4180ad2a0a43de91e7f01Mark Andrews int nsipv4;
7329012471d165cd3dc4180ad2a0a43de91e7f01Mark Andrews int nsipv6;
7329012471d165cd3dc4180ad2a0a43de91e7f01Mark Andrews};
7329012471d165cd3dc4180ad2a0a43de91e7f01Mark Andrewstypedef struct dns_rpz_zone dns_rpz_zone_t;
7329012471d165cd3dc4180ad2a0a43de91e7f01Mark Andrewsstruct dns_rpz_zone {
7329012471d165cd3dc4180ad2a0a43de91e7f01Mark Andrews isc_refcount_t refs;
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein dns_rpz_num_t num; /* ordinal in list of policy zones */
7329012471d165cd3dc4180ad2a0a43de91e7f01Mark Andrews dns_name_t origin; /* Policy zone name */
7329012471d165cd3dc4180ad2a0a43de91e7f01Mark Andrews dns_name_t ip; /* DNS_RPZ_IP_ZONE.origin. */
7329012471d165cd3dc4180ad2a0a43de91e7f01Mark Andrews dns_name_t nsdname; /* DNS_RPZ_NSDNAME_ZONE.origin */
7329012471d165cd3dc4180ad2a0a43de91e7f01Mark Andrews dns_name_t nsip; /* DNS_RPZ_NSIP_ZONE.origin. */
7329012471d165cd3dc4180ad2a0a43de91e7f01Mark Andrews dns_name_t passthru; /* DNS_RPZ_PASSTHRU_ZONE. */
7329012471d165cd3dc4180ad2a0a43de91e7f01Mark Andrews dns_name_t cname; /* override value for ..._CNAME */
7329012471d165cd3dc4180ad2a0a43de91e7f01Mark Andrews dns_ttl_t max_policy_ttl;
7329012471d165cd3dc4180ad2a0a43de91e7f01Mark Andrews dns_rpz_policy_t policy; /* DNS_RPZ_POLICY_GIVEN or override */
7329012471d165cd3dc4180ad2a0a43de91e7f01Mark Andrews dns_rpz_triggers_t triggers;
7329012471d165cd3dc4180ad2a0a43de91e7f01Mark Andrews};
7329012471d165cd3dc4180ad2a0a43de91e7f01Mark Andrews
7329012471d165cd3dc4180ad2a0a43de91e7f01Mark Andrews/*
7329012471d165cd3dc4180ad2a0a43de91e7f01Mark Andrews * Radix tree node for response policy IP addresses
7329012471d165cd3dc4180ad2a0a43de91e7f01Mark Andrews */
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeintypedef struct dns_rpz_cidr_node dns_rpz_cidr_node_t;
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein/*
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein * Response policy zones known to a view.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein */
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeintypedef struct dns_rpz_zones dns_rpz_zones_t;
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeinstruct dns_rpz_zones {
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein struct {
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein dns_rpz_zbits_t no_rd_ok;
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein isc_boolean_t break_dnssec;
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein isc_boolean_t qname_wait_recurse;
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein unsigned int min_ns_labels;
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein dns_rpz_num_t num_zones;
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein } p;
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein dns_rpz_zone_t *zones[DNS_RPZ_MAX_ZONES];
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein dns_rpz_zbits_t defined;
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein /*
d71e2e0c61df16ff37c9934c371a4a60c08974f7Mark Andrews * The set of records for a policy zone are in one of these states:
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein * never loaded load_begun=0 have=0
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein * during initial loading load_begun=1 have=0
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein * and rbtdb->rpzsp == rbtdb->load_rpzsp
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein * after good load load_begun=1 have!=0
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein * after failed initial load load_begun=1 have=0
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein * and rbtdb->load_rpzsp == NULL
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein * reloading after failure load_begun=1 have=0
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein * reloading after success
d71e2e0c61df16ff37c9934c371a4a60c08974f7Mark Andrews * main rpzs load_begun=1 have!=0
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein * load rpzs load_begun=1 have=0
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein */
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein dns_rpz_zbits_t load_begun;
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein struct {
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein dns_rpz_zbits_t qname;
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein dns_rpz_zbits_t ipv4;
d71e2e0c61df16ff37c9934c371a4a60c08974f7Mark Andrews dns_rpz_zbits_t ipv6;
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein dns_rpz_zbits_t ip;
f02216f5b390ff0a589fa080f29350fd7794bf5cMark Andrews dns_rpz_zbits_t nsdname;
f02216f5b390ff0a589fa080f29350fd7794bf5cMark Andrews dns_rpz_zbits_t nsipv4;
f02216f5b390ff0a589fa080f29350fd7794bf5cMark Andrews dns_rpz_zbits_t nsipv6;
f02216f5b390ff0a589fa080f29350fd7794bf5cMark Andrews dns_rpz_zbits_t nsip;
f02216f5b390ff0a589fa080f29350fd7794bf5cMark Andrews dns_rpz_zbits_t qname_skip_recurse;
f02216f5b390ff0a589fa080f29350fd7794bf5cMark Andrews } have;
f02216f5b390ff0a589fa080f29350fd7794bf5cMark Andrews
f02216f5b390ff0a589fa080f29350fd7794bf5cMark Andrews isc_mem_t *mctx;
f02216f5b390ff0a589fa080f29350fd7794bf5cMark Andrews isc_refcount_t refs;
f02216f5b390ff0a589fa080f29350fd7794bf5cMark Andrews /*
f02216f5b390ff0a589fa080f29350fd7794bf5cMark Andrews * One lock for short term read-only search that guarantees the
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein * consistency of the pointers.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein * A second lock for maintenance that guarantees no other thread
731cc132f22dbc9e0ecd7035dce314a61076d31bAutomatic Updater * is adding or deleting nodes.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein */
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein isc_mutex_t search_lock;
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein isc_mutex_t maint_lock;
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein dns_rpz_cidr_node_t *cidr;
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein dns_rbt_t *rbt;
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein};
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein/*
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein * context for finding the best policy
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein */
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeintypedef struct {
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein unsigned int state;
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein# define DNS_RPZ_REWRITTEN 0x0001
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein# define DNS_RPZ_DONE_QNAME 0x0002 /* qname checked */
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein# define DNS_RPZ_DONE_QNAME_IP 0x0004 /* IP addresses of qname checked */
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein# define DNS_RPZ_DONE_NSDNAME 0x0008 /* NS name missed; checking addresses */
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein# define DNS_RPZ_DONE_IPv4 0x0010
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein# define DNS_RPZ_RECURSING 0x0020
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein /*
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein * Best match so far.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein */
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein struct {
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein dns_rpz_type_t type;
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein dns_rpz_zone_t *rpz;
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein dns_rpz_prefix_t prefix;
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein dns_rpz_policy_t policy;
69f175fc57a578dd85c1548ed3f34284321f9d3aMark Andrews dns_ttl_t ttl;
69f175fc57a578dd85c1548ed3f34284321f9d3aMark Andrews isc_result_t result;
69f175fc57a578dd85c1548ed3f34284321f9d3aMark Andrews dns_zone_t *zone;
69f175fc57a578dd85c1548ed3f34284321f9d3aMark Andrews dns_db_t *db;
69f175fc57a578dd85c1548ed3f34284321f9d3aMark Andrews dns_dbversion_t *version;
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein dns_dbnode_t *node;
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein dns_rdataset_t *rdataset;
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein } m;
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein /*
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein * State for chasing IP addresses and NS names including recursion.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein */
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein struct {
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein unsigned int label;
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein dns_db_t *db;
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein dns_rdataset_t *ns_rdataset;
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein dns_rdatatype_t r_type;
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein isc_result_t r_result;
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein dns_rdataset_t *r_rdataset;
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein } r;
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein /*
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein * State of real query while recursing for NSIP or NSDNAME.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein */
69f175fc57a578dd85c1548ed3f34284321f9d3aMark Andrews struct {
69f175fc57a578dd85c1548ed3f34284321f9d3aMark Andrews isc_result_t result;
69f175fc57a578dd85c1548ed3f34284321f9d3aMark Andrews isc_boolean_t is_zone;
69f175fc57a578dd85c1548ed3f34284321f9d3aMark Andrews isc_boolean_t authoritative;
69f175fc57a578dd85c1548ed3f34284321f9d3aMark Andrews dns_zone_t *zone;
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein dns_db_t *db;
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein dns_dbnode_t *node;
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein dns_rdataset_t *rdataset;
61e1dc26d62c2a0059e3ca7efe2ad0f4a5b8df92Mark Andrews dns_rdataset_t *sigrdataset;
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein dns_rdatatype_t qtype;
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein } q;
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein /*
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein * p_name: current policy owner name
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein * r_name: recursing for this name to possible policy triggers
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein * f_name: saved found name from before recursion
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein */
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein dns_name_t *p_name;
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein dns_name_t *r_name;
69f175fc57a578dd85c1548ed3f34284321f9d3aMark Andrews dns_name_t *fname;
69f175fc57a578dd85c1548ed3f34284321f9d3aMark Andrews dns_fixedname_t _p_namef;
69f175fc57a578dd85c1548ed3f34284321f9d3aMark Andrews dns_fixedname_t _r_namef;
69f175fc57a578dd85c1548ed3f34284321f9d3aMark Andrews dns_fixedname_t _fnamef;
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein} dns_rpz_st_t;
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein#define DNS_RPZ_TTL_DEFAULT 5
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein#define DNS_RPZ_MAX_TTL_DEFAULT DNS_RPZ_TTL_DEFAULT
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein/*
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein * So various response policy zone messages can be turned up or down.
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein */
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein#define DNS_RPZ_ERROR_LEVEL ISC_LOG_WARNING
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein#define DNS_RPZ_INFO_LEVEL ISC_LOG_INFO
69f175fc57a578dd85c1548ed3f34284321f9d3aMark Andrews#define DNS_RPZ_DEBUG_LEVEL1 ISC_LOG_DEBUG(1)
69f175fc57a578dd85c1548ed3f34284321f9d3aMark Andrews#define DNS_RPZ_DEBUG_LEVEL2 ISC_LOG_DEBUG(2)
69f175fc57a578dd85c1548ed3f34284321f9d3aMark Andrews#define DNS_RPZ_DEBUG_LEVEL3 ISC_LOG_DEBUG(3)
69f175fc57a578dd85c1548ed3f34284321f9d3aMark Andrews#define DNS_RPZ_DEBUG_QUIET (DNS_RPZ_DEBUG_LEVEL3+1)
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeinconst char *
d71e2e0c61df16ff37c9934c371a4a60c08974f7Mark Andrewsdns_rpz_type2str(dns_rpz_type_t type);
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeindns_rpz_policy_t
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeindns_rpz_str2policy(const char *str);
731cc132f22dbc9e0ecd7035dce314a61076d31bAutomatic Updater
731cc132f22dbc9e0ecd7035dce314a61076d31bAutomatic Updaterconst char *
731cc132f22dbc9e0ecd7035dce314a61076d31bAutomatic Updaterdns_rpz_policy2str(dns_rpz_policy_t policy);
731cc132f22dbc9e0ecd7035dce314a61076d31bAutomatic Updater
731cc132f22dbc9e0ecd7035dce314a61076d31bAutomatic Updaterdns_rpz_policy_t
731cc132f22dbc9e0ecd7035dce314a61076d31bAutomatic Updaterdns_rpz_decode_cname(dns_rpz_zone_t *rpz, dns_rdataset_t *rdataset,
731cc132f22dbc9e0ecd7035dce314a61076d31bAutomatic Updater dns_name_t *selfname);
731cc132f22dbc9e0ecd7035dce314a61076d31bAutomatic Updater
731cc132f22dbc9e0ecd7035dce314a61076d31bAutomatic Updaterisc_result_t
69f175fc57a578dd85c1548ed3f34284321f9d3aMark Andrewsdns_rpz_new_zones(dns_rpz_zones_t **rpzsp, isc_mem_t *mctx);
69f175fc57a578dd85c1548ed3f34284321f9d3aMark Andrews
69f175fc57a578dd85c1548ed3f34284321f9d3aMark Andrewsvoid
69f175fc57a578dd85c1548ed3f34284321f9d3aMark Andrewsdns_rpz_attach_rpzs(dns_rpz_zones_t *source, dns_rpz_zones_t **target);
69f175fc57a578dd85c1548ed3f34284321f9d3aMark Andrews
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeinvoid
d71e2e0c61df16ff37c9934c371a4a60c08974f7Mark Andrewsdns_rpz_detach_rpzs(dns_rpz_zones_t **rpzsp);
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeinisc_result_t
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeindns_rpz_beginload(dns_rpz_zones_t **load_rpzsp,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein dns_rpz_zones_t *rpzs, dns_rpz_num_t rpz_num);
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein
69f175fc57a578dd85c1548ed3f34284321f9d3aMark Andrewsisc_result_t
69f175fc57a578dd85c1548ed3f34284321f9d3aMark Andrewsdns_rpz_ready(dns_rpz_zones_t *rpzs,
69f175fc57a578dd85c1548ed3f34284321f9d3aMark Andrews dns_rpz_zones_t **load_rpzsp, dns_rpz_num_t rpz_num);
69f175fc57a578dd85c1548ed3f34284321f9d3aMark Andrews
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeinisc_result_t
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeindns_rpz_add(dns_rpz_zones_t *rpzs, dns_rpz_num_t rpz_num, dns_name_t *name);
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeinvoid
69f175fc57a578dd85c1548ed3f34284321f9d3aMark Andrewsdns_rpz_delete(dns_rpz_zones_t *rpzs, dns_rpz_num_t rpz_num, dns_name_t *name);
69f175fc57a578dd85c1548ed3f34284321f9d3aMark Andrews
69f175fc57a578dd85c1548ed3f34284321f9d3aMark Andrewsdns_rpz_num_t
69f175fc57a578dd85c1548ed3f34284321f9d3aMark Andrewsdns_rpz_find_ip(dns_rpz_zones_t *rpzs, dns_rpz_type_t rpz_type,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein dns_rpz_zbits_t zbits, const isc_netaddr_t *netaddr,
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein dns_name_t *ip_name, dns_rpz_prefix_t *prefixp);
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeindns_rpz_zbits_t
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austeindns_rpz_find_name(dns_rpz_zones_t *rpzs, dns_rpz_type_t rpz_type,
69f175fc57a578dd85c1548ed3f34284321f9d3aMark Andrews dns_rpz_zbits_t zbits, dns_name_t *trig_name);
69f175fc57a578dd85c1548ed3f34284321f9d3aMark Andrews
69f175fc57a578dd85c1548ed3f34284321f9d3aMark AndrewsISC_LANG_ENDDECLS
69f175fc57a578dd85c1548ed3f34284321f9d3aMark Andrews
69f175fc57a578dd85c1548ed3f34284321f9d3aMark Andrews#endif /* DNS_RPZ_H */
69f175fc57a578dd85c1548ed3f34284321f9d3aMark Andrews
60e5e10f8d2e2b0c41e8abad38cacd867caa6ab2Rob Austein