This file contains functions to enable RPZ service. More...

#include "services/localzone.h"
#include "util/locks.h"
#include "util/log.h"
#include "util/config_file.h"
#include "services/authzone.h"
#include "sldns/sbuffer.h"
#include "daemon/stats.h"
#include "respip/respip.h"

Data Structures
struct	clientip_synthesized_rrset

struct	clientip_synthesized_rr

struct	rpz
	RPZ containing policies. More...

Enumerations
enum	rpz_trigger { RPZ_QNAME_TRIGGER = 0 , RPZ_CLIENT_IP_TRIGGER , RPZ_RESPONSE_IP_TRIGGER , RPZ_NSDNAME_TRIGGER , RPZ_NSIP_TRIGGER , RPZ_INVALID_TRIGGER }
	RPZ triggers, only the QNAME trigger is currently supported in Unbound.

enum	rpz_action { RPZ_NXDOMAIN_ACTION = 0 , RPZ_NODATA_ACTION , RPZ_PASSTHRU_ACTION , RPZ_DROP_ACTION , RPZ_TCP_ONLY_ACTION , RPZ_INVALID_ACTION , RPZ_LOCAL_DATA_ACTION , RPZ_DISABLED_ACTION , RPZ_NO_OVERRIDE_ACTION , RPZ_CNAME_OVERRIDE_ACTION }
	RPZ actions.

Functions
int	rpz_insert_rr (struct rpz r, uint8_t azname, size_t aznamelen, uint8_t dname, size_t dnamelen, uint16_t rr_type, uint16_t rr_class, uint32_t rr_ttl, uint8_t rdatawl, size_t rdatalen, uint8_t *rr, size_t rr_len)
	Create policy from RR and add to this RPZ. More...

void	rpz_remove_rr (struct rpz r, uint8_t azname, size_t aznamelen, uint8_t dname, size_t dnamelen, uint16_t rr_type, uint16_t rr_class, uint8_t rdatawl, size_t rdatalen)
	Delete policy matching RR, used for IXFR. More...

int	rpz_callback_from_worker_request (struct auth_zones az, struct module_env env, struct query_info qinfo, struct edns_data edns, sldns_buffer buf, struct regional temp, struct comm_reply repinfo, uint8_t taglist, size_t taglen, struct ub_server_stats stats, int passthru)
	Walk over the RPZ zones to find and apply a QNAME trigger policy. More...

struct dns_msg *	rpz_callback_from_iterator_module (struct module_qstate qstate, struct iter_qstate iq)
	Callback to process when the iterator module is about to send queries. More...

struct dns_msg *	rpz_callback_from_iterator_cname (struct module_qstate qstate, struct iter_qstate iq)
	Callback to process when the iterator module has followed a cname. More...

void	rpz_delete (struct rpz *r)
	Delete RPZ. More...

int	rpz_clear (struct rpz *r)
	Clear local-zones and respip data in RPZ, used after reloading file or AXFR/HTTP transfer. More...

struct rpz *	rpz_create (struct config_auth *p)
	Create RPZ. More...

const char *	rpz_action_to_string (enum rpz_action a)
	String for RPZ action enum. More...

enum rpz_action	respip_action_to_rpz_action (enum respip_action a)

void	rpz_finish_config (struct rpz *r)
	Prepare RPZ after processing feed content. More...

enum respip_action	rpz_action_to_respip_action (enum rpz_action a)
	Classify respip action for RPZ action. More...

void	rpz_enable (struct rpz *r)
	Enable RPZ. More...

void	rpz_disable (struct rpz *r)
	Disable RPZ. More...

Detailed Description

This file contains functions to enable RPZ service.

Function Documentation

◆ rpz_insert_rr()

int rpz_insert_rr	(	struct rpz *	r,
		uint8_t *	azname,
		size_t	aznamelen,
		uint8_t *	dname,
		size_t	dnamelen,
		uint16_t	rr_type,
		uint16_t	rr_class,
		uint32_t	rr_ttl,
		uint8_t *	rdatawl,
		size_t	rdatalen,
		uint8_t *	rr,
		size_t	rr_len
	)

Create policy from RR and add to this RPZ.

Parameters

r	the rpz to add the policy to.
azname	dname of the auth-zone
aznamelen	the length of the auth-zone name
dname	dname of the RR
dnamelen	length of the dname
rr_type	RR type of the RR
rr_class	RR class of the RR
rr_ttl	TTL of the RR
rdatawl	rdata of the RR, prepended with the rdata size
rdatalen	length if the RR, including the prepended rdata size
rr	the complete RR, for logging purposes
rr_len	the length of the complete RR

Returns: : 0 on error

References dname_str(), dname_subdomain_c(), log_assert, log_err(), rpz_dname_to_trigger(), rpz_rr_to_action(), rpz_type_ignored(), sldns_wire2str_dname(), and strip_dname_origin().

Referenced by az_insert_rr().

◆ rpz_remove_rr()

void rpz_remove_rr	(	struct rpz *	r,
		uint8_t *	azname,
		size_t	aznamelen,
		uint8_t *	dname,
		size_t	dnamelen,
		uint16_t	rr_type,
		uint16_t	rr_class,
		uint8_t *	rdatawl,
		size_t	rdatalen
	)

Delete policy matching RR, used for IXFR.

Parameters

r	the rpz to add the policy to.
azname	dname of the auth-zone
aznamelen	the length of the auth-zone name
dname	dname of the RR
dnamelen	length of the dname
rr_type	RR type of the RR
rr_class	RR class of the RR
rdatawl	rdata of the RR, prepended with the rdata size
rdatalen	length if the RR, including the prepended rdata size

References dname_subdomain_c(), LDNS_MAX_DOMAINLEN, rpz_rr_to_action(), and rpz_type_ignored().

Referenced by az_remove_rr().

◆ rpz_callback_from_worker_request()

int rpz_callback_from_worker_request	(	struct auth_zones *	az,
		struct module_env *	env,
		struct query_info *	qinfo,
		struct edns_data *	edns,
		sldns_buffer *	buf,
		struct regional *	temp,
		struct comm_reply *	repinfo,
		uint8_t *	taglist,
		size_t	taglen,
		struct ub_server_stats *	stats,
		int *	passthru
	)

Walk over the RPZ zones to find and apply a QNAME trigger policy.

Parameters

az	auth_zones struct, containing first RPZ item and RPZ lock
env	module env
qinfo	qinfo containing qname and qtype
edns	edns data
buf	buffer to write answer to
temp	scratchpad
repinfo	reply info
taglist	taglist to lookup.
taglen	length of taglist.
stats	worker stats struct
passthru	returns if the query can passthru further rpz processing.

Returns: : 1 if client answer is ready, 0 to continue resolving

◆ rpz_callback_from_iterator_module()

struct dns_msg* rpz_callback_from_iterator_module	(	struct module_qstate *	qstate,
		struct iter_qstate *	iq
	)

Callback to process when the iterator module is about to send queries.

Checks for nsip and nsdname triggers.

Parameters

qstate	the query state.
iq	iterator module query state.

Returns: NULL if nothing is done. Or a new message with the contents from the rpz, based on the delegation point. It is allocated in the qstate region.

References module_env::auth_zones, module_qstate::env, auth_zone::lock, match(), auth_zone::rpz, auth_zone::rpz_az_next, auth_zones::rpz_first, auth_zones::rpz_lock, module_qstate::rpz_passthru, VERB_ALGO, and verbose().