unbound: services/rpz.h File Reference

unbound 0.1

Data Structures | Enumerations | Functions
rpz.h File Reference

This file contains functions to enable RPZ service. More...

`#include "services/localzone.h"`
`#include "util/locks.h"`
`#include "util/log.h"`
`#include "util/config_file.h"`
`#include "services/authzone.h"`
`#include "sldns/sbuffer.h"`
`#include "daemon/stats.h"`
`#include "respip/respip.h"`

## Data Structures
struct | clientip_synthesized_rrset
struct | clientip_synthesized_rr
struct | rpz
| RPZ containing policies. More...

## Enumerations
enum | rpz_trigger { RPZ_QNAME_TRIGGER = 0 , RPZ_CLIENT_IP_TRIGGER , RPZ_RESPONSE_IP_TRIGGER , RPZ_NSDNAME_TRIGGER , RPZ_NSIP_TRIGGER , RPZ_INVALID_TRIGGER }
| RPZ triggers, only the QNAME trigger is currently supported in Unbound.
enum | rpz_action { RPZ_NXDOMAIN_ACTION = 0 , RPZ_NODATA_ACTION , RPZ_PASSTHRU_ACTION , RPZ_DROP_ACTION , RPZ_TCP_ONLY_ACTION , RPZ_INVALID_ACTION , RPZ_LOCAL_DATA_ACTION , RPZ_DISABLED_ACTION , RPZ_NO_OVERRIDE_ACTION , RPZ_CNAME_OVERRIDE_ACTION }
| RPZ actions.

## Functions
int | rpz_insert_rr (struct rpz *r, uint8_t *azname, size_t aznamelen, uint8_t *dname, size_t dnamelen, uint16_t rr_type, uint16_t rr_class, uint32_t rr_ttl, uint8_t *rdatawl, size_t rdatalen, uint8_t *rr, size_t rr_len)
| Create policy from RR and add to this RPZ.
void | rpz_remove_rr (struct rpz *r, uint8_t *azname, size_t aznamelen, uint8_t *dname, size_t dnamelen, uint16_t rr_type, uint16_t rr_class, uint8_t *rdatawl, size_t rdatalen)
| Delete policy matching RR, used for IXFR.
int | rpz_callback_from_worker_request (struct auth_zones *az, struct module_env *env, struct query_info *qinfo, struct edns_data *edns, sldns_buffer *buf, struct regional *temp, struct comm_reply *repinfo, uint8_t *taglist, size_t taglen, struct ub_server_stats *stats, int *passthru)
| Walk over the RPZ zones to find and apply a QNAME trigger policy.
struct dns_msg * | rpz_callback_from_iterator_module (struct module_qstate *qstate, struct iter_qstate *iq)
| Callback to process when the iterator module is about to send queries.
struct dns_msg * | rpz_callback_from_iterator_cname (struct module_qstate *qstate, struct iter_qstate *iq)
| Callback to process when the iterator module has followed a cname.
void | rpz_delete (struct rpz *r)
| Delete RPZ.
int | rpz_clear (struct rpz *r)
| Clear local-zones and respip data in RPZ, used after reloading file or AXFR/HTTP transfer.
struct rpz * | rpz_create (struct config_auth *p)
| Create RPZ.
int | rpz_config (struct rpz *r, struct config_auth *p)
| Change config on rpz, after reload.
const char * | rpz_action_to_string (enum rpz_action a)
| String for RPZ action enum.
enum rpz_action | respip_action_to_rpz_action (enum respip_action a)
void | rpz_finish_config (struct rpz *r)
| Prepare RPZ after processing feed content.
enum respip_action | rpz_action_to_respip_action (enum rpz_action a)
| Classify respip action for RPZ action.
void | rpz_enable (struct rpz *r)
| Enable RPZ.
void | rpz_disable (struct rpz *r)
| Disable RPZ.
size_t | rpz_get_mem (struct rpz *r)
| Get memory usage of rpz.

## Detailed Description

This file contains functions to enable RPZ service.

## Function Documentation

## ◆ rpz_insert_rr()

int rpz_insert_rr | ( | struct rpz * | r,
|  | uint8_t * | azname,
|  | size_t | aznamelen,
|  | uint8_t * | dname,
|  | size_t | dnamelen,
|  | uint16_t | rr_type,
|  | uint16_t | rr_class,
|  | uint32_t | rr_ttl,
|  | uint8_t * | rdatawl,
|  | size_t | rdatalen,
|  | uint8_t * | rr,
|  | size_t | rr_len )

Create policy from RR and add to this RPZ.

Parameters

  r | the rpz to add the policy to.
  azname | dname of the auth-zone
  aznamelen | the length of the auth-zone name
  dname | dname of the RR
  dnamelen | length of the dname
  rr_type | RR type of the RR
  rr_class | RR class of the RR
  rr_ttl | TTL of the RR
  rdatawl | rdata of the RR, prepended with the rdata size
  rdatalen | length if the RR, including the prepended rdata size
  rr | the complete RR, for logging purposes
  rr_len | the length of the complete RR

Returns
  : 0 on error

References dname_str(), dname_subdomain_c(), log_assert, log_err(), rpz_dname_to_trigger(), rpz_insert_response_ip_trigger(), rpz_rr_to_action(), rpz_trigger_to_string(), rpz_type_ignored(), sldns_wire2str_dname(), strip_dname_origin(), VERB_ALGO, and verbose().

Referenced by az_insert_rr().

## ◆ rpz_remove_rr()

void rpz_remove_rr | ( | struct rpz * | r,
|  | uint8_t * | azname,
|  | size_t | aznamelen,
|  | uint8_t * | dname,
|  | size_t | dnamelen,
|  | uint16_t | rr_type,
|  | uint16_t | rr_class,
|  | uint8_t * | rdatawl,
|  | size_t | rdatalen )

Delete policy matching RR, used for IXFR.

Parameters

  r | the rpz to add the policy to.
  azname | dname of the auth-zone
  aznamelen | the length of the auth-zone name
  dname | dname of the RR
  dnamelen | length of the dname
  rr_type | RR type of the RR
  rr_class | RR class of the RR
  rdatawl | rdata of the RR, prepended with the rdata size
  rdatalen | length if the RR, including the prepended rdata size

References dname_subdomain_c(), LDNS_MAX_DOMAINLEN, rpz_dname_to_trigger(), rpz_remove_clientip_trigger(), rpz_remove_nsdname_trigger(), rpz_remove_nsip_trigger(), rpz_remove_qname_trigger(), rpz_rr_to_action(), rpz_type_ignored(), and strip_dname_origin().

Referenced by az_remove_rr().

## ◆ rpz_callback_from_worker_request()

int rpz_callback_from_worker_request | ( | struct auth_zones * | az,
|  | struct module_env * | env,
|  | struct query_info * | qinfo,
|  | struct edns_data * | edns,
|  | sldns_buffer * | buf,
|  | struct regional * | temp,
|  | struct comm_reply * | repinfo,
|  | uint8_t * | taglist,
|  | size_t | taglen,
|  | struct ub_server_stats * | stats,
|  | int * | passthru )

Walk over the RPZ zones to find and apply a QNAME trigger policy.

Parameters

  az | auth_zones struct, containing first RPZ item and RPZ lock
  env | module env
  qinfo | qinfo containing qname and qtype
  edns | edns data
  buf | buffer to write answer to
  temp | scratchpad
  repinfo | reply info
  taglist | taglist to lookup.
  taglen | length of taglist.
  stats | worker stats struct
  passthru | returns if the query can passthru further rpz processing.

Returns
  : 1 if client answer is ready, 0 to continue resolving

References dname_str(), LDNS_MAX_DOMAINLEN, local_zone_always_transparent, auth_zone::lock, local_zone::lock, log_assert, local_zone::name, query_info::qname, rpz_action_to_string(), local_zone::taglen, local_zone::taglist, local_zone::type, VERB_ALGO, verbose(), and verbosity.

Referenced by worker_handle_request().

## ◆ rpz_callback_from_iterator_module()

struct dns_msg * rpz_callback_from_iterator_module | ( | struct module_qstate * | qstate,
|  | struct iter_qstate * | iq )

Callback to process when the iterator module is about to send queries.

Checks for nsip and nsdname triggers.

Parameters

  qstate | the query state.
  iq | iterator module query state.

Returns
  NULL if nothing is done. Or a new message with the contents from the rpz, based on the delegation point. It is allocated in the qstate region.

References module_env::auth_zones, module_qstate::client_info, iter_qstate::dp, module_qstate::env, auth_zone::lock, local_zone::lock, match(), iter_qstate::qchase, query_info::qclass, auth_zone::rpz, auth_zone::rpz_az_next, auth_zones::rpz_first, auth_zones::rpz_lock, module_qstate::rpz_passthru, taglist_intersect(), VERB_ALGO, and verbose().

Referenced by processQueryTargets().

## ◆ rpz_callback_from_iterator_cname()

struct dns_msg * rpz_callback_from_iterator_cname | ( | struct module_qstate * | qstate,
|  | struct iter_qstate * | iq )

Callback to process when the iterator module has followed a cname.

There can be a qname trigger for the new query name.

Parameters

  qstate | the query state.
  iq | iterator module query state.

Returns
  NULL if nothing is done. Or a new message with the contents from the rpz, based on the iq.qchase. It is allocated in the qstate region.

References module_env::auth_zones, module_qstate::client_info, dname_str(), module_qstate::env, module_qstate::is_drop, LDNS_MAX_DOMAINLEN, auth_zone::lock, local_zone::lock, log_rpz_apply(), local_zone::name, iter_qstate::qchase, query_info::qclass, module_qstate::qinfo, query_info::qname, query_info::qname_len, auth_zone::rpz, ub_server_stats::rpz_action, rpz_action_to_string(), module_qstate::rpz_applied, auth_zone::rpz_az_next, rpz_find_zone(), auth_zones::rpz_first, auth_zones::rpz_lock, module_qstate::rpz_passthru, worker::stats, taglist_intersect(), local_zone::type, VERB_ALGO, verbose(), verbosity, and module_env::worker.

Referenced by processInitRequest(), processQueryResponse(), and processQueryTargets().

## ◆ rpz_delete()

void rpz_delete | ( | struct rpz * | r | ) |

Delete RPZ.

Parameters

  r | RPZ struct to delete

References local_zones_delete(), regional_destroy(), and respip_set_delete().

Referenced by auth_zone_delete().

## ◆ rpz_clear()

int rpz_clear | ( | struct rpz * | r | ) |

Clear local-zones and respip data in RPZ, used after reloading file or AXFR/HTTP transfer.

Parameters

  r | RPZ to use

References local_zones_create(), local_zones_delete(), respip_set_create(), and respip_set_delete().

Referenced by apply_axfr(), apply_http(), and auth_zone_read_zonefile().

## ◆ rpz_create()

struct rpz * rpz_create | ( | struct config_auth * | p | ) |

Create RPZ.

RPZ must be added to linked list after creation.

Returns
  : the newly created RPZ

References local_zones_create(), local_zones_delete(), regional_create_custom(), regional_destroy(), respip_set_create(), respip_set_delete(), and rpz_apply_cfg_elements().

Referenced by auth_zones_cfg().

## ◆ rpz_config()

int rpz_config | ( | struct rpz * | r,
|  | struct config_auth * | p )

Change config on rpz, after reload.

Parameters

  r | the rpz structure.
  p | the config that was read.

Returns
  false on failure.

References delete_cname_override(), and rpz_apply_cfg_elements().

Referenced by auth_zones_cfg().

## ◆ rpz_action_to_string()

const char * rpz_action_to_string | ( | enum rpz_action | a | ) |

String for RPZ action enum.

Parameters

  a | RPZ action to get string for

Returns
  : string for RPZ action

String for RPZ action enum.

Referenced by log_rpz_apply(), print_ext(), respip_inform_print(), respip_rewrite_reply(), rpz_callback_from_iterator_cname(), rpz_callback_from_worker_request(), and rpz_insert_response_ip_trigger().

## ◆ rpz_finish_config()

void rpz_finish_config | ( | struct rpz * | r | ) |

Prepare RPZ after processing feed content.

Parameters

  r | RPZ to use

References addr_tree_init_parents(), and clientip_synthesized_rrset::lock.

Referenced by auth_zone_read_zonefile(), and xfr_process_chunk_list().

## ◆ rpz_action_to_respip_action()

enum respip_action rpz_action_to_respip_action | ( | enum rpz_action | a | ) |

Classify respip action for RPZ action.

Parameters

  a | RPZ action

Returns
  : the respip action

References respip_always_deny, respip_always_nodata, respip_always_nxdomain, respip_always_transparent, respip_invalid, respip_redirect, and respip_truncate.

Referenced by rpz_insert_response_ip_trigger().

## ◆ rpz_enable()

void rpz_enable | ( | struct rpz * | r | ) |

Enable RPZ.

Parameters

  r | RPZ struct to enable

Referenced by do_rpz_enable_disable().

## ◆ rpz_disable()

void rpz_disable | ( | struct rpz * | r | ) |

Disable RPZ.

Parameters

  r | RPZ struct to disable

Referenced by do_rpz_enable_disable().

## ◆ rpz_get_mem()

size_t rpz_get_mem | ( | struct rpz * | r | ) |

Get memory usage of rpz.

Caller must manage locks.

Parameters

  r | RPZ struct.

Returns
  memory usage.

References local_zones_get_mem(), regional_get_mem(), respip_set_get_mem(), and rpz_clientip_synthesized_set_get_mem().

Referenced by auth_zone_get_mem().