2 * services/rpz.h - rpz service
4 * Copyright (c) 2019, NLnet Labs. All rights reserved.
6 * This software is open source.
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
12 * Redistributions of source code must retain the above copyright notice,
13 * this list of conditions and the following disclaimer.
15 * Redistributions in binary form must reproduce the above copyright notice,
16 * this list of conditions and the following disclaimer in the documentation
17 * and/or other materials provided with the distribution.
19 * Neither the name of the NLNET LABS nor the names of its contributors may
20 * be used to endorse or promote products derived from this software without
21 * specific prior written permission.
23 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
24 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
25 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
26 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
27 * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
28 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
29 * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
30 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
31 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
32 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
33 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
39 * This file contains functions to enable RPZ service.
42 #ifndef SERVICES_RPZ_H
43 #define SERVICES_RPZ_H
45 #include "services/localzone.h"
46 #include "util/locks.h"
48 #include "util/config_file.h"
49 #include "services/authzone.h"
50 #include "sldns/sbuffer.h"
51 #include "daemon/stats.h"
52 #include "respip/respip.h"
55 * RPZ triggers, only the QNAME trigger is currently supported in Unbound.
58 RPZ_QNAME_TRIGGER = 0,
59 /* unsupported triggers */
60 RPZ_CLIENT_IP_TRIGGER, /* rpz-client-ip */
61 RPZ_RESPONSE_IP_TRIGGER, /* rpz-ip */
62 RPZ_NSDNAME_TRIGGER, /* rpz-nsdname */
63 RPZ_NSIP_TRIGGER, /* rpz-nsip */
64 RPZ_INVALID_TRIGGER, /* dname does not contain valid trigger */
71 RPZ_NXDOMAIN_ACTION = 0,/* CNAME . */
72 RPZ_NODATA_ACTION, /* CNAME *. */
73 RPZ_PASSTHRU_ACTION, /* CNAME rpz-passthru. */
74 RPZ_DROP_ACTION, /* CNAME rpz-drop. */
75 RPZ_TCP_ONLY_ACTION, /* CNAME rpz-tcp-only. */
76 RPZ_INVALID_ACTION, /* CNAME with (child of) TLD starting with
77 "rpz-" in target, SOA, NS, DNAME and
78 DNSSEC-related records. */
79 RPZ_LOCAL_DATA_ACTION, /* anything else */
80 /* RPZ override actions */
81 RPZ_DISABLED_ACTION, /* RPZ action disabled using override */
82 RPZ_NO_OVERRIDE_ACTION, /* RPZ action no override*/
83 RPZ_CNAME_OVERRIDE_ACTION, /* RPZ CNAME action override*/
87 * RPZ containing policies. Pointed to from corresponding auth-zone. Part of a
88 * linked list to keep configuration order. Iterating or changing the linked
89 * list requires the rpz_lock from struct auth_zones.
92 struct local_zones* local_zones;
93 struct respip_set* respip_set;
96 enum rpz_action action_override;
97 struct ub_packed_rrset_key* cname_override;
102 struct regional* region;
106 * Create policy from RR and add to this RPZ.
107 * @param r: the rpz to add the policy to.
108 * @param aznamelen: the length of the auth-zone name
109 * @param dname: dname of the RR
110 * @param dnamelen: length of the dname
111 * @param rr_type: RR type of the RR
112 * @param rr_class: RR class of the RR
113 * @param rr_ttl: TTL of the RR
114 * @param rdatawl: rdata of the RR, prepended with the rdata size
115 * @param rdatalen: length if the RR, including the prepended rdata size
116 * @param rr: the complete RR, for logging purposes
117 * @param rr_len: the length of the complete RR
118 * @return: 0 on error
120 int rpz_insert_rr(struct rpz* r, size_t aznamelen, uint8_t* dname,
121 size_t dnamelen, uint16_t rr_type, uint16_t rr_class, uint32_t rr_ttl,
122 uint8_t* rdatawl, size_t rdatalen, uint8_t* rr, size_t rr_len);
125 * Delete policy matching RR, used for IXFR.
126 * @param r: the rpz to add the policy to.
127 * @param aznamelen: the length of the auth-zone name
128 * @param dname: dname of the RR
129 * @param dnamelen: length of the dname
130 * @param rr_type: RR type of the RR
131 * @param rr_class: RR class of the RR
132 * @param rdatawl: rdata of the RR, prepended with the rdata size
133 * @param rdatalen: length if the RR, including the prepended rdata size
135 void rpz_remove_rr(struct rpz* r, size_t aznamelen, uint8_t* dname,
136 size_t dnamelen, uint16_t rr_type, uint16_t rr_class, uint8_t* rdatawl,
140 * Walk over the RPZ zones to find and apply a QNAME trigger policy.
141 * @param az: auth_zones struct, containing first RPZ item and RPZ lock
142 * @param env: module env
143 * @param qinfo: qinfo containing qname and qtype
144 * @param edns: edns data
145 * @param buf: buffer to write answer to
146 * @param temp: scratchpad
147 * @param repinfo: reply info
148 * @param taglist: taglist to lookup.
149 * @param taglen: lenth of taglist.
150 * @param stats: worker stats struct
151 * @return: 1 if client answer is ready, 0 to continue resolving
153 int rpz_apply_qname_trigger(struct auth_zones* az, struct module_env* env,
154 struct query_info* qinfo, struct edns_data* edns, sldns_buffer* buf,
155 struct regional* temp, struct comm_reply* repinfo,
156 uint8_t* taglist, size_t taglen, struct ub_server_stats* stats);
160 * @param r: RPZ struct to delete
162 void rpz_delete(struct rpz* r);
165 * Clear local-zones and respip data in RPZ, used after reloading file or
166 * AXFR/HTTP transfer.
167 * @param r: RPZ to use
169 int rpz_clear(struct rpz* r);
172 * Create RPZ. RPZ must be added to linked list after creation.
173 * @return: the newly created RPZ
175 struct rpz* rpz_create(struct config_auth* p);
178 * String for RPZ action enum
179 * @param a: RPZ action to get string for
180 * @return: string for RPZ action
182 const char* rpz_action_to_string(enum rpz_action a);
185 respip_action_to_rpz_action(enum respip_action a);
188 * Prepare RPZ after procesing feed content.
189 * @param r: RPZ to use
191 void rpz_finish_config(struct rpz* r);
194 * Classify respip action for RPZ action
195 * @param a: RPZ action
196 * @return: the respip action
199 rpz_action_to_respip_action(enum rpz_action a);
201 #endif /* SERVICES_RPZ_H */