1224090Sdougb/* 2254402Serwin * Copyright (C) 2011-2013 Internet Systems Consortium, Inc. ("ISC") 3224090Sdougb * 4224090Sdougb * Permission to use, copy, modify, and/or distribute this software for any 5224090Sdougb * purpose with or without fee is hereby granted, provided that the above 6224090Sdougb * copyright notice and this permission notice appear in all copies. 7224090Sdougb * 8224090Sdougb * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH 9224090Sdougb * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY 10224090Sdougb * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, 11224090Sdougb * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM 12224090Sdougb * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE 13224090Sdougb * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR 14224090Sdougb * PERFORMANCE OF THIS SOFTWARE. 15224090Sdougb */ 16224090Sdougb 17234010Sdougb/* $Id$ */ 18224090Sdougb 19254897Serwin 20224090Sdougb#ifndef DNS_RPZ_H 21224090Sdougb#define DNS_RPZ_H 1 22224090Sdougb 23224090Sdougb#include <isc/lang.h> 24224090Sdougb 25224090Sdougb#include <dns/fixedname.h> 26224090Sdougb#include <dns/rdata.h> 27224090Sdougb#include <dns/types.h> 28224090Sdougb 29224090SdougbISC_LANG_BEGINDECLS 30224090Sdougb 31254402Serwin#define DNS_RPZ_PREFIX "rpz-" 32254402Serwin#define DNS_RPZ_IP_ZONE DNS_RPZ_PREFIX"ip" 33254402Serwin#define DNS_RPZ_NSIP_ZONE DNS_RPZ_PREFIX"nsip" 34254402Serwin#define DNS_RPZ_NSDNAME_ZONE DNS_RPZ_PREFIX"nsdname" 35254402Serwin#define DNS_RPZ_PASSTHRU_ZONE DNS_RPZ_PREFIX"passthru" 36224090Sdougb 37224090Sdougbtypedef isc_uint8_t dns_rpz_cidr_bits_t; 38224090Sdougb 39224090Sdougbtypedef enum { 40224090Sdougb DNS_RPZ_TYPE_BAD, 41224090Sdougb DNS_RPZ_TYPE_QNAME, 42224090Sdougb DNS_RPZ_TYPE_IP, 43234010Sdougb DNS_RPZ_TYPE_NSDNAME, 44234010Sdougb DNS_RPZ_TYPE_NSIP 45224090Sdougb} dns_rpz_type_t; 46224090Sdougb 47224090Sdougb/* 48234010Sdougb * Require DNS_RPZ_POLICY_PASSTHRU < DNS_RPZ_POLICY_NXDOMAIN < 49234010Sdougb * DNS_RPZ_POLICY_NODATA < DNS_RPZ_POLICY_CNAME to choose among competing 50234010Sdougb * policies. 51224090Sdougb */ 52224090Sdougbtypedef enum { 53234010Sdougb DNS_RPZ_POLICY_GIVEN = 0, /* 'given': what policy record says */ 54234010Sdougb DNS_RPZ_POLICY_DISABLED = 1, /* 'cname x': answer with x's rrsets */ 55234010Sdougb DNS_RPZ_POLICY_PASSTHRU = 2, /* 'passthru': do not rewrite */ 56234010Sdougb DNS_RPZ_POLICY_NXDOMAIN = 3, /* 'nxdomain': answer with NXDOMAIN */ 57234010Sdougb DNS_RPZ_POLICY_NODATA = 4, /* 'nodata': answer with ANCOUNT=0 */ 58234010Sdougb DNS_RPZ_POLICY_CNAME = 5, /* 'cname x': answer with x's rrsets */ 59234010Sdougb DNS_RPZ_POLICY_RECORD, 60234010Sdougb DNS_RPZ_POLICY_WILDCNAME, 61224090Sdougb DNS_RPZ_POLICY_MISS, 62224090Sdougb DNS_RPZ_POLICY_ERROR 63224090Sdougb} dns_rpz_policy_t; 64224090Sdougb 65224090Sdougb/* 66224090Sdougb * Specify a response policy zone. 67224090Sdougb */ 68224090Sdougbtypedef struct dns_rpz_zone dns_rpz_zone_t; 69224090Sdougb 70224090Sdougbstruct dns_rpz_zone { 71224090Sdougb ISC_LINK(dns_rpz_zone_t) link; 72245163Serwin int num; /* ordinal in list of policy zones */ 73224090Sdougb dns_name_t origin; /* Policy zone name */ 74234010Sdougb dns_name_t nsdname; /* DNS_RPZ_NSDNAME_ZONE.origin */ 75245163Serwin dns_name_t passthru;/* DNS_RPZ_PASSTHRU_ZONE. */ 76245163Serwin dns_name_t cname; /* override value for ..._CNAME */ 77245163Serwin dns_ttl_t max_policy_ttl; 78234010Sdougb dns_rpz_policy_t policy; /* DNS_RPZ_POLICY_GIVEN or override */ 79245163Serwin isc_boolean_t recursive_only; 80254402Serwin isc_boolean_t defined; 81224090Sdougb}; 82224090Sdougb 83224090Sdougb/* 84224090Sdougb * Radix trees for response policy IP addresses. 85224090Sdougb */ 86224090Sdougbtypedef struct dns_rpz_cidr dns_rpz_cidr_t; 87224090Sdougb 88224090Sdougb/* 89224090Sdougb * context for finding the best policy 90224090Sdougb */ 91224090Sdougbtypedef struct { 92224090Sdougb unsigned int state; 93224090Sdougb# define DNS_RPZ_REWRITTEN 0x0001 94234010Sdougb# define DNS_RPZ_DONE_QNAME 0x0002 /* qname checked */ 95234010Sdougb# define DNS_RPZ_DONE_QNAME_IP 0x0004 /* IP addresses of qname checked */ 96234010Sdougb# define DNS_RPZ_DONE_NSDNAME 0x0008 /* NS name missed; checking addresses */ 97234010Sdougb# define DNS_RPZ_DONE_IPv4 0x0010 98234010Sdougb# define DNS_RPZ_RECURSING 0x0020 99234010Sdougb# define DNS_RPZ_HAVE_IP 0x0040 /* a policy zone has IP addresses */ 100234010Sdougb# define DNS_RPZ_HAVE_NSIPv4 0x0080 /* IPv4 NISP addresses */ 101234010Sdougb# define DNS_RPZ_HAVE_NSIPv6 0x0100 /* IPv6 NISP addresses */ 102234010Sdougb# define DNS_RPZ_HAVE_NSDNAME 0x0200 /* NS names */ 103224090Sdougb /* 104224090Sdougb * Best match so far. 105224090Sdougb */ 106224090Sdougb struct { 107224090Sdougb dns_rpz_type_t type; 108224090Sdougb dns_rpz_zone_t *rpz; 109224090Sdougb dns_rpz_cidr_bits_t prefix; 110224090Sdougb dns_rpz_policy_t policy; 111224090Sdougb dns_ttl_t ttl; 112224090Sdougb isc_result_t result; 113224090Sdougb dns_zone_t *zone; 114224090Sdougb dns_db_t *db; 115234010Sdougb dns_dbversion_t *version; 116224090Sdougb dns_dbnode_t *node; 117224090Sdougb dns_rdataset_t *rdataset; 118224090Sdougb } m; 119224090Sdougb /* 120234010Sdougb * State for chasing IP addresses and NS names including recursion. 121224090Sdougb */ 122224090Sdougb struct { 123224090Sdougb unsigned int label; 124224090Sdougb dns_db_t *db; 125224090Sdougb dns_rdataset_t *ns_rdataset; 126224090Sdougb dns_rdatatype_t r_type; 127224090Sdougb isc_result_t r_result; 128224090Sdougb dns_rdataset_t *r_rdataset; 129234010Sdougb } r; 130224090Sdougb /* 131224090Sdougb * State of real query while recursing for NSIP or NSDNAME. 132224090Sdougb */ 133224090Sdougb struct { 134224090Sdougb isc_result_t result; 135224090Sdougb isc_boolean_t is_zone; 136224090Sdougb isc_boolean_t authoritative; 137224090Sdougb dns_zone_t *zone; 138224090Sdougb dns_db_t *db; 139224090Sdougb dns_dbnode_t *node; 140224090Sdougb dns_rdataset_t *rdataset; 141224090Sdougb dns_rdataset_t *sigrdataset; 142224090Sdougb dns_rdatatype_t qtype; 143224090Sdougb } q; 144224090Sdougb dns_name_t *qname; 145224090Sdougb dns_name_t *r_name; 146224090Sdougb dns_name_t *fname; 147224090Sdougb dns_fixedname_t _qnamef; 148224090Sdougb dns_fixedname_t _r_namef; 149224090Sdougb dns_fixedname_t _fnamef; 150224090Sdougb} dns_rpz_st_t; 151224090Sdougb 152224090Sdougb#define DNS_RPZ_TTL_DEFAULT 5 153245163Serwin#define DNS_RPZ_MAX_TTL_DEFAULT DNS_RPZ_TTL_DEFAULT 154224090Sdougb 155224090Sdougb/* 156224090Sdougb * So various response policy zone messages can be turned up or down. 157224090Sdougb */ 158224090Sdougb#define DNS_RPZ_ERROR_LEVEL ISC_LOG_WARNING 159224090Sdougb#define DNS_RPZ_INFO_LEVEL ISC_LOG_INFO 160224090Sdougb#define DNS_RPZ_DEBUG_LEVEL1 ISC_LOG_DEBUG(1) 161224090Sdougb#define DNS_RPZ_DEBUG_LEVEL2 ISC_LOG_DEBUG(2) 162234010Sdougb#define DNS_RPZ_DEBUG_LEVEL3 ISC_LOG_DEBUG(3) 163245163Serwin#define DNS_RPZ_DEBUG_QUIET (DNS_RPZ_DEBUG_LEVEL3+1) 164224090Sdougb 165224090Sdougbconst char * 166224090Sdougbdns_rpz_type2str(dns_rpz_type_t type); 167224090Sdougb 168224090Sdougbdns_rpz_policy_t 169224090Sdougbdns_rpz_str2policy(const char *str); 170224090Sdougb 171234010Sdougbconst char * 172234010Sdougbdns_rpz_policy2str(dns_rpz_policy_t policy); 173234010Sdougb 174224090Sdougbvoid 175224090Sdougbdns_rpz_cidr_free(dns_rpz_cidr_t **cidr); 176224090Sdougb 177224090Sdougbvoid 178224090Sdougbdns_rpz_view_destroy(dns_view_t *view); 179224090Sdougb 180224090Sdougbisc_result_t 181224090Sdougbdns_rpz_new_cidr(isc_mem_t *mctx, dns_name_t *origin, 182224090Sdougb dns_rpz_cidr_t **rbtdb_cidr); 183224090Sdougbvoid 184254402Serwindns_rpz_enabled_get(dns_rpz_cidr_t *cidr, dns_rpz_st_t *st); 185224090Sdougb 186224090Sdougbvoid 187224090Sdougbdns_rpz_cidr_deleteip(dns_rpz_cidr_t *cidr, dns_name_t *name); 188224090Sdougb 189224090Sdougbvoid 190224090Sdougbdns_rpz_cidr_addip(dns_rpz_cidr_t *cidr, dns_name_t *name); 191224090Sdougb 192224090Sdougbisc_result_t 193224090Sdougbdns_rpz_cidr_find(dns_rpz_cidr_t *cidr, const isc_netaddr_t *netaddr, 194224090Sdougb dns_rpz_type_t type, dns_name_t *canon_name, 195224090Sdougb dns_name_t *search_name, dns_rpz_cidr_bits_t *prefix); 196224090Sdougb 197224090Sdougbdns_rpz_policy_t 198245163Serwindns_rpz_decode_cname(dns_rpz_zone_t *rpz, dns_rdataset_t *rdataset, 199245163Serwin dns_name_t *selfname); 200224090Sdougb 201236374SdougbISC_LANG_ENDDECLS 202236374Sdougb 203224090Sdougb#endif /* DNS_RPZ_H */ 204224090Sdougb 205