rpz.h revision 224092
1275970Scy/* 2275970Scy * Copyright (C) 2011 Internet Systems Consortium, Inc. ("ISC") 3275970Scy * 4275970Scy * Permission to use, copy, modify, and/or distribute this software for any 5275970Scy * purpose with or without fee is hereby granted, provided that the above 6275970Scy * copyright notice and this permission notice appear in all copies. 7275970Scy * 8275970Scy * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH 9275970Scy * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY 10275970Scy * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, 11275970Scy * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM 12275970Scy * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE 13275970Scy * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR 14275970Scy * PERFORMANCE OF THIS SOFTWARE. 15275970Scy */ 16275970Scy 17275970Scy/* $Id: rpz.h,v 1.3 2011-01-13 04:59:26 tbox Exp $ */ 18275970Scy 19275970Scy#ifndef DNS_RPZ_H 20275970Scy#define DNS_RPZ_H 1 21275970Scy 22275970Scy#include <isc/lang.h> 23275970Scy 24275970Scy#include <dns/fixedname.h> 25275970Scy#include <dns/rdata.h> 26275970Scy#include <dns/types.h> 27275970Scy 28275970ScyISC_LANG_BEGINDECLS 29275970Scy 30275970Scy#define DNS_RPZ_IP_ZONE "rpz-ip" 31275970Scy#define DNS_RPZ_NSIP_ZONE "rpz-nsip" 32275970Scy#define DNS_RPZ_NSDNAME_ZONE "rpz-nsdname" 33275970Scy 34275970Scytypedef isc_uint8_t dns_rpz_cidr_bits_t; 35275970Scy 36275970Scytypedef enum { 37275970Scy DNS_RPZ_TYPE_BAD, 38275970Scy DNS_RPZ_TYPE_QNAME, 39275970Scy DNS_RPZ_TYPE_IP, 40275970Scy DNS_RPZ_TYPE_NSIP, 41275970Scy DNS_RPZ_TYPE_NSDNAME 42275970Scy} dns_rpz_type_t; 43275970Scy 44275970Scy/* 45275970Scy * Require DNS_RPZ_POLICY_NO_OP < DNS_RPZ_POLICY_NXDOMAIN < 46275970Scy * DNS_RPZ_POLICY_NODATA < DNS_RPZ_POLICY_CNAME. 47275970Scy */ 48275970Scytypedef enum { 49275970Scy DNS_RPZ_POLICY_GIVEN = 0, /* 'given': what something else says */ 50275970Scy DNS_RPZ_POLICY_NO_OP = 1, /* 'no-op': do not rewrite */ 51275970Scy DNS_RPZ_POLICY_NXDOMAIN = 2, /* 'nxdomain': answer with NXDOMAIN */ 52275970Scy DNS_RPZ_POLICY_NODATA = 3, /* 'nodata': answer with ANCOUNT=0 */ 53275970Scy DNS_RPZ_POLICY_CNAME = 4, /* 'cname x': answer with x's rrsets */ 54275970Scy DNS_RPZ_POLICY_RECORD = 5, 55275970Scy DNS_RPZ_POLICY_MISS, 56275970Scy DNS_RPZ_POLICY_ERROR 57275970Scy} dns_rpz_policy_t; 58275970Scy 59275970Scy/* 60275970Scy * Specify a response policy zone. 61275970Scy */ 62275970Scytypedef struct dns_rpz_zone dns_rpz_zone_t; 63275970Scy 64275970Scystruct dns_rpz_zone { 65275970Scy ISC_LINK(dns_rpz_zone_t) link; 66275970Scy int num; 67275970Scy dns_name_t origin; /* Policy zone name */ 68275970Scy dns_name_t nsdname; /* RPZ_NSDNAME_ZONE.origin */ 69275970Scy dns_rpz_policy_t policy; /* RPZ_POLICY_GIVEN or override */ 70275970Scy dns_name_t cname; /* override name for 71275970Scy RPZ_POLICY_CNAME */ 72275970Scy}; 73275970Scy 74275970Scy/* 75275970Scy * Radix trees for response policy IP addresses. 76275970Scy */ 77275970Scytypedef struct dns_rpz_cidr dns_rpz_cidr_t; 78275970Scy 79275970Scy/* 80275970Scy * context for finding the best policy 81275970Scy */ 82275970Scytypedef struct { 83275970Scy unsigned int state; 84275970Scy# define DNS_RPZ_REWRITTEN 0x0001 85275970Scy# define DNS_RPZ_DONE_QNAME 0x0002 86275970Scy# define DNS_RPZ_DONE_A 0x0004 87275970Scy# define DNS_RPZ_RECURSING 0x0008 88275970Scy# define DNS_RPZ_HAVE_IP 0x0010 89275970Scy# define DNS_RPZ_HAVE_NSIPv4 0x0020 90275970Scy# define DNS_RPZ_HAVE_NSIPv6 0x0040 91275970Scy# define DNS_RPZ_HAD_NSDNAME 0x0080 92275970Scy /* 93275970Scy * Best match so far. 94275970Scy */ 95275970Scy struct { 96275970Scy dns_rpz_type_t type; 97275970Scy dns_rpz_zone_t *rpz; 98275970Scy dns_rpz_cidr_bits_t prefix; 99275970Scy dns_rpz_policy_t policy; 100275970Scy dns_ttl_t ttl; 101275970Scy isc_result_t result; 102275970Scy dns_zone_t *zone; 103275970Scy dns_db_t *db; 104275970Scy dns_dbnode_t *node; 105275970Scy dns_rdataset_t *rdataset; 106275970Scy } m; 107275970Scy /* 108275970Scy * State for chasing NS names and addresses including recursion. 109275970Scy */ 110275970Scy struct { 111275970Scy unsigned int label; 112275970Scy dns_db_t *db; 113275970Scy dns_rdataset_t *ns_rdataset; 114275970Scy dns_rdatatype_t r_type; 115275970Scy isc_result_t r_result; 116275970Scy dns_rdataset_t *r_rdataset; 117275970Scy } ns; 118275970Scy /* 119275970Scy * State of real query while recursing for NSIP or NSDNAME. 120275970Scy */ 121275970Scy struct { 122275970Scy isc_result_t result; 123275970Scy isc_boolean_t is_zone; 124275970Scy isc_boolean_t authoritative; 125275970Scy dns_zone_t *zone; 126275970Scy dns_db_t *db; 127275970Scy dns_dbnode_t *node; 128275970Scy dns_rdataset_t *rdataset; 129275970Scy dns_rdataset_t *sigrdataset; 130275970Scy dns_rdatatype_t qtype; 131275970Scy } q; 132275970Scy dns_name_t *qname; 133275970Scy dns_name_t *r_name; 134275970Scy dns_name_t *fname; 135275970Scy dns_fixedname_t _qnamef; 136275970Scy dns_fixedname_t _r_namef; 137275970Scy dns_fixedname_t _fnamef; 138275970Scy} dns_rpz_st_t; 139275970Scy 140275970Scy#define DNS_RPZ_TTL_DEFAULT 5 141275970Scy 142275970Scy/* 143275970Scy * So various response policy zone messages can be turned up or down. 144275970Scy */ 145275970Scy#define DNS_RPZ_ERROR_LEVEL ISC_LOG_WARNING 146275970Scy#define DNS_RPZ_INFO_LEVEL ISC_LOG_INFO 147275970Scy#define DNS_RPZ_DEBUG_LEVEL1 ISC_LOG_DEBUG(1) 148275970Scy#define DNS_RPZ_DEBUG_LEVEL2 ISC_LOG_DEBUG(2) 149275970Scy 150275970Scyconst char * 151275970Scydns_rpz_type2str(dns_rpz_type_t type); 152275970Scy 153275970Scydns_rpz_policy_t 154275970Scydns_rpz_str2policy(const char *str); 155275970Scy 156275970Scyvoid 157275970Scydns_rpz_set_need(isc_boolean_t need); 158275970Scy 159275970Scyisc_boolean_t 160275970Scydns_rpz_needed(void); 161275970Scy 162275970Scyvoid 163275970Scydns_rpz_cidr_free(dns_rpz_cidr_t **cidr); 164275970Scy 165275970Scyvoid 166275970Scydns_rpz_view_destroy(dns_view_t *view); 167275970Scy 168275970Scyisc_result_t 169275970Scydns_rpz_new_cidr(isc_mem_t *mctx, dns_name_t *origin, 170275970Scy dns_rpz_cidr_t **rbtdb_cidr); 171275970Scyvoid 172275970Scydns_rpz_enabled(dns_rpz_cidr_t *cidr, dns_rpz_st_t *st); 173275970Scy 174275970Scyvoid 175275970Scydns_rpz_cidr_deleteip(dns_rpz_cidr_t *cidr, dns_name_t *name); 176275970Scy 177275970Scyvoid 178275970Scydns_rpz_cidr_addip(dns_rpz_cidr_t *cidr, dns_name_t *name); 179275970Scy 180275970Scyisc_result_t 181275970Scydns_rpz_cidr_find(dns_rpz_cidr_t *cidr, const isc_netaddr_t *netaddr, 182275970Scy dns_rpz_type_t type, dns_name_t *canon_name, 183275970Scy dns_name_t *search_name, dns_rpz_cidr_bits_t *prefix); 184275970Scy 185275970Scydns_rpz_policy_t 186275970Scydns_rpz_decode_cname(dns_rdataset_t *, dns_name_t *selfname); 187275970Scy 188275970Scy#endif /* DNS_RPZ_H */ 189275970Scy 190275970Scy