FM / dns

/usr/include/bind9/dns

Name	Size	Mode	Actions
acl.h	6477	0644	edit dl rm
adb.h	22267	0644	edit dl rm
badcache.h	3387	0644	edit dl rm
bit.h	798	0644	edit dl rm
byaddr.h	3598	0644	edit dl rm
cache.h	8730	0644	edit dl rm
callbacks.h	2280	0644	edit dl rm
catz.h	11881	0644	edit dl rm
cert.h	1465	0644	edit dl rm
client.h	14527	0644	edit dl rm
clientinfo.h	2015	0644	edit dl rm
compress.h	7047	0644	edit dl rm
db.h	50446	0644	edit dl rm
dbiterator.h	7385	0644	edit dl rm
dbtable.h	3167	0644	edit dl rm
diff.h	7039	0644	edit dl rm
dispatch.h	15538	0644	edit dl rm
dlz.h	10876	0644	edit dl rm
dlz_dlopen.h	4394	0644	edit dl rm
dns64.h	5720	0644	edit dl rm
dnsrps.h	2572	0644	edit dl rm
dnssec.h	12841	0644	edit dl rm
dnstap.h	10193	0644	edit dl rm
ds.h	1665	0644	edit dl rm
dsdigest.h	1713	0644	edit dl rm
dyndb.h	4869	0644	edit dl rm
ecdb.h	806	0644	edit dl rm
ecs.h	1250	0644	edit dl rm
edns.h	783	0644	edit dl rm
enumclass.h	1220	0644	edit dl rm
enumtype.h	8485	0644	edit dl rm
events.h	4451	0644	edit dl rm
fixedname.h	1652	0644	edit dl rm
forward.h	3060	0644	edit dl rm
geoip.h	2340	0644	edit dl rm
ipkeylist.h	2219	0644	edit dl rm
iptable.h	1521	0644	edit dl rm
journal.h	9712	0644	edit dl rm
kasp.h	12124	0644	edit dl rm
keydata.h	1047	0644	edit dl rm
keyflags.h	1277	0644	edit dl rm
keymgr.h	4107	0644	edit dl rm
keytable.h	7871	0644	edit dl rm
keyvalues.h	4083	0644	edit dl rm
lib.h	993	0644	edit dl rm
librpz.h	31401	0644	edit dl rm
lmdb.h	779	0644	edit dl rm
log.h	4029	0644	edit dl rm
lookup.h	2921	0644	edit dl rm
master.h	8786	0644	edit dl rm
masterdump.h	10133	0644	edit dl rm
message.h	39567	0644	edit dl rm
name.h	37781	0644	edit dl rm
ncache.h	4960	0644	edit dl rm
nsec.h	3065	0644	edit dl rm
nsec3.h	8258	0644	edit dl rm
nta.h	4846	0644	edit dl rm
opcode.h	1006	0644	edit dl rm
order.h	2010	0644	edit dl rm
peer.h	6475	0644	edit dl rm
portlist.h	2101	0644	edit dl rm
private.h	1962	0644	edit dl rm
rbt.h	37484	0644	edit dl rm
rcode.h	2472	0644	edit dl rm
rdata.h	22564	0644	edit dl rm
rdataclass.h	2248	0644	edit dl rm
rdatalist.h	2557	0644	edit dl rm
rdataset.h	18714	0644	edit dl rm
rdatasetiter.h	3912	0644	edit dl rm
rdataslab.h	4267	0644	edit dl rm
rdatastruct.h	62703	0644	edit dl rm
rdatatype.h	2290	0644	edit dl rm
request.h	9187	0644	edit dl rm
resolver.h	20152	0644	edit dl rm
result.h	9196	0644	edit dl rm
rootns.h	891	0644	edit dl rm
rpz.h	12156	0644	edit dl rm
rriterator.h	4214	0644	edit dl rm
rrl.h	6959	0644	edit dl rm
sdb.h	7350	0644	edit dl rm
sdlz.h	14090	0644	edit dl rm
secalg.h	1705	0644	edit dl rm
secproto.h	1556	0644	edit dl rm
soa.h	2179	0644	edit dl rm
ssu.h	7182	0644	edit dl rm
stats.h	24689	0644	edit dl rm
tcpmsg.h	3128	0644	edit dl rm
time.h	1693	0644	edit dl rm
timer.h	1050	0644	edit dl rm
tkey.h	7655	0644	edit dl rm
tsec.h	2946	0644	edit dl rm
tsig.h	8497	0644	edit dl rm
ttl.h	1876	0644	edit dl rm
types.h	14584	0644	edit dl rm
update.h	2004	0644	edit dl rm
validator.h	6679	0644	edit dl rm
version.h	679	0644	edit dl rm
view.h	35341	0644	edit dl rm
xfrin.h	2314	0644	edit dl rm
zone.h	65543	0644	edit dl rm
zonekey.h	776	0644	edit dl rm
zoneverify.h	1393	0644	edit dl rm
zt.h	5241	0644	edit dl rm

Edit: /usr/include/bind9/dns/rpz.h (12156B)

/*
 * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 *
 * This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, you can obtain one at https://mozilla.org/MPL/2.0/.
 *
 * See the COPYRIGHT file distributed with this work for additional
 * information regarding copyright ownership.
 */

#ifndef DNS_RPZ_H
#define DNS_RPZ_H 1

#include <inttypes.h>
#include <stdbool.h>

#include <isc/deprecated.h>
#include <isc/event.h>
#include <isc/ht.h>
#include <isc/lang.h>
#include <isc/refcount.h>
#include <isc/rwlock.h>
#include <isc/time.h>
#include <isc/timer.h>

#include <dns/fixedname.h>
#include <dns/rdata.h>
#include <dns/types.h>

ISC_LANG_BEGINDECLS

#define DNS_RPZ_PREFIX "rpz-"
/*
 * Sub-zones of various trigger types.
 */
#define DNS_RPZ_CLIENT_IP_ZONE DNS_RPZ_PREFIX "client-ip"
#define DNS_RPZ_IP_ZONE	       DNS_RPZ_PREFIX "ip"
#define DNS_RPZ_NSIP_ZONE      DNS_RPZ_PREFIX "nsip"
#define DNS_RPZ_NSDNAME_ZONE   DNS_RPZ_PREFIX "nsdname"
/*
 * Special policies.
 */
#define DNS_RPZ_PASSTHRU_NAME DNS_RPZ_PREFIX "passthru"
#define DNS_RPZ_DROP_NAME     DNS_RPZ_PREFIX "drop"
#define DNS_RPZ_TCP_ONLY_NAME DNS_RPZ_PREFIX "tcp-only"

typedef uint8_t dns_rpz_prefix_t;

typedef enum {
	DNS_RPZ_TYPE_BAD,
	DNS_RPZ_TYPE_CLIENT_IP,
	DNS_RPZ_TYPE_QNAME,
	DNS_RPZ_TYPE_IP,
	DNS_RPZ_TYPE_NSDNAME,
	DNS_RPZ_TYPE_NSIP
} dns_rpz_type_t;

/*
 * Require DNS_RPZ_POLICY_PASSTHRU < DNS_RPZ_POLICY_DROP
 * < DNS_RPZ_POLICY_TCP_ONLY DNS_RPZ_POLICY_NXDOMAIN < DNS_RPZ_POLICY_NODATA
 * < DNS_RPZ_POLICY_CNAME to choose among competing policies.
 */
typedef enum {
	DNS_RPZ_POLICY_GIVEN = 0,    /* 'given': what policy record says */
	DNS_RPZ_POLICY_DISABLED = 1, /* log what would have happened */
	DNS_RPZ_POLICY_PASSTHRU = 2, /* 'passthru': do not rewrite */
	DNS_RPZ_POLICY_DROP = 3,     /* 'drop': do not respond */
	DNS_RPZ_POLICY_TCP_ONLY = 4, /* 'tcp-only': answer UDP with TC=1 */
	DNS_RPZ_POLICY_NXDOMAIN = 5, /* 'nxdomain': answer with NXDOMAIN */
	DNS_RPZ_POLICY_NODATA = 6,   /* 'nodata': answer with ANCOUNT=0 */
	DNS_RPZ_POLICY_CNAME = 7,    /* 'cname x': answer with x's rrsets */
	DNS_RPZ_POLICY_DNS64,	     /* Apply DN64 to the A rewrite */
	DNS_RPZ_POLICY_RECORD,
	DNS_RPZ_POLICY_WILDCNAME,
	DNS_RPZ_POLICY_MISS,
	DNS_RPZ_POLICY_ERROR
} dns_rpz_policy_t;

typedef uint8_t dns_rpz_num_t;

#define DNS_RPZ_MAX_ZONES 64
/*
 * Type dns_rpz_zbits_t must be an unsigned int wide enough to contain
 * at least DNS_RPZ_MAX_ZONES bits.
 */
typedef uint64_t dns_rpz_zbits_t;

#define DNS_RPZ_ALL_ZBITS ((dns_rpz_zbits_t)-1)

#define DNS_RPZ_INVALID_NUM DNS_RPZ_MAX_ZONES

#define DNS_RPZ_ZBIT(n) (((dns_rpz_zbits_t)1) << (dns_rpz_num_t)(n))

/*
 * Mask of the specified and higher numbered policy zones
 * Avoid hassles with (1<<33) or (1<<65)
 */
#define DNS_RPZ_ZMASK(n)                                     \
	((dns_rpz_zbits_t)((((n) >= DNS_RPZ_MAX_ZONES - 1)   \
				    ? 0                      \
				    : (1ULL << ((n) + 1))) - \
			   1))

/*
 * The trigger counter type.
 */
typedef size_t dns_rpz_trigger_counter_t;

/*
 * The number of triggers of each type in a response policy zone.
 */
typedef struct dns_rpz_triggers dns_rpz_triggers_t;
struct dns_rpz_triggers {
	dns_rpz_trigger_counter_t client_ipv4;
	dns_rpz_trigger_counter_t client_ipv6;
	dns_rpz_trigger_counter_t qname;
	dns_rpz_trigger_counter_t ipv4;
	dns_rpz_trigger_counter_t ipv6;
	dns_rpz_trigger_counter_t nsdname;
	dns_rpz_trigger_counter_t nsipv4;
	dns_rpz_trigger_counter_t nsipv6;
};

/*
 * A single response policy zone.
 */
typedef struct dns_rpz_zone  dns_rpz_zone_t;
typedef struct dns_rpz_zones dns_rpz_zones_t;

struct dns_rpz_zone {
	isc_refcount_t	 refs;
	dns_rpz_num_t	 num;	    /* ordinal in list of policy zones */
	dns_name_t	 origin;    /* Policy zone name */
	dns_name_t	 client_ip; /* DNS_RPZ_CLIENT_IP_ZONE.origin. */
	dns_name_t	 ip;	    /* DNS_RPZ_IP_ZONE.origin. */
	dns_name_t	 nsdname;   /* DNS_RPZ_NSDNAME_ZONE.origin */
	dns_name_t	 nsip;	    /* DNS_RPZ_NSIP_ZONE.origin. */
	dns_name_t	 passthru;  /* DNS_RPZ_PASSTHRU_NAME. */
	dns_name_t	 drop;	    /* DNS_RPZ_DROP_NAME. */
	dns_name_t	 tcp_only;  /* DNS_RPZ_TCP_ONLY_NAME. */
	dns_name_t	 cname;	    /* override value for ..._CNAME */
	dns_ttl_t	 max_policy_ttl;
	dns_rpz_policy_t policy; /* DNS_RPZ_POLICY_GIVEN or override */

uint32_t min_update_interval;	 /* minimal interval between
					  * updates */
	isc_ht_t	 *nodes;		 /* entries in zone */
	dns_rpz_zones_t *rpzs;		 /* owner */
	isc_time_t	 lastupdated;	 /* last time the zone was processed
					  * */
	bool updatepending;		 /* there is an update
					  * pending/waiting */
	bool		 updaterunning;	 /* there is an update running */
	dns_db_t	 *db;		 /* zones database */
	dns_dbversion_t *dbversion;	 /* version we will be updating to */
	dns_db_t	 *updb;		 /* zones database we're working on */
	dns_dbversion_t *updbversion;	 /* version we're currently working
					  * on */
	dns_dbiterator_t *updbit;	 /* iterator to use when updating */
	isc_ht_t	 *newnodes;	 /* entries in zone being updated */
	bool		  db_registered; /* is the notify event
					  * registered? */
	bool	     addsoa;		 /* add soa to the additional section */
	isc_timer_t *updatetimer;
	isc_event_t  updateevent;
};

/*
 * Radix tree node for response policy IP addresses
 */
typedef struct dns_rpz_cidr_node dns_rpz_cidr_node_t;

/*
 * Bitfields indicating which policy zones have policies of
 * which type.
 */
typedef struct dns_rpz_have dns_rpz_have_t;
struct dns_rpz_have {
	dns_rpz_zbits_t client_ipv4;
	dns_rpz_zbits_t client_ipv6;
	dns_rpz_zbits_t client_ip;
	dns_rpz_zbits_t qname;
	dns_rpz_zbits_t ipv4;
	dns_rpz_zbits_t ipv6;
	dns_rpz_zbits_t ip;
	dns_rpz_zbits_t nsdname;
	dns_rpz_zbits_t nsipv4;
	dns_rpz_zbits_t nsipv6;
	dns_rpz_zbits_t nsip;
	dns_rpz_zbits_t qname_skip_recurse;
};

/*
 * Policy options
 */
typedef struct dns_rpz_popt dns_rpz_popt_t;
struct dns_rpz_popt {
	dns_rpz_zbits_t no_rd_ok;
	dns_rpz_zbits_t no_log;
	dns_rpz_zbits_t nsip_on;
	dns_rpz_zbits_t nsdname_on;
	bool		dnsrps_enabled;
	bool		break_dnssec;
	bool		qname_wait_recurse;
	bool		nsip_wait_recurse;
	unsigned int	min_ns_labels;
	dns_rpz_num_t	num_zones;
};

/*
 * Response policy zones known to a view.
 */
struct dns_rpz_zones {
	dns_rpz_popt_t	   p;
	dns_rpz_zone_t    *zones[DNS_RPZ_MAX_ZONES];
	dns_rpz_triggers_t triggers[DNS_RPZ_MAX_ZONES];

/*
	 * RPZ policy version number.
	 * It is initially 0 and it increases whenever the server is
	 * reconfigured with new zones or policy.
	 */
	int rpz_ver;

dns_rpz_zbits_t defined;

/*
	 * The set of records for a policy zone are in one of these states:
	 *	never loaded		    load_begun=0  have=0
	 *	during initial loading	    load_begun=1  have=0
	 *				and rbtdb->rpzsp == rbtdb->load_rpzsp
	 *	after good load		    load_begun=1  have!=0
	 *	after failed initial load   load_begun=1  have=0
	 *				and rbtdb->load_rpzsp == NULL
	 *	reloading after failure	    load_begun=1  have=0
	 *	reloading after success
	 *		main rpzs	    load_begun=1  have!=0
	 *		load rpzs	    load_begun=1  have=0
	 */
	dns_rpz_zbits_t load_begun;
	dns_rpz_have_t	have;

/*
	 * total_triggers maintains the total number of triggers in all
	 * policy zones in the view. It is only used to print summary
	 * statistics after a zone load of how the trigger counts
	 * changed.
	 */
	dns_rpz_triggers_t total_triggers;

isc_mem_t	  *mctx;
	isc_taskmgr_t  *taskmgr;
	isc_timermgr_t *timermgr;
	isc_task_t	   *updater;
	isc_refcount_t	refs;
	isc_refcount_t	irefs;
	/*
	 * One lock for short term read-only search that guarantees the
	 * consistency of the pointers.
	 * A second lock for maintenance that guarantees no other thread
	 * is adding or deleting nodes.
	 */
	isc_rwlock_t search_lock;
	isc_mutex_t  maint_lock;

dns_rpz_cidr_node_t *cidr;
	dns_rbt_t		  *rbt;

/*
	 * DNSRPZ librpz configuration string and handle on librpz connection
	 */
	char		     *rps_cstr;
	size_t		      rps_cstr_size;
	struct librpz_client *rps_client;
};

/*
 * context for finding the best policy
 */
typedef struct {
	unsigned int state;
#define DNS_RPZ_REWRITTEN      0x0001
#define DNS_RPZ_DONE_CLIENT_IP 0x0002 /* client IP address checked */
#define DNS_RPZ_DONE_QNAME     0x0004 /* qname checked */
#define DNS_RPZ_DONE_QNAME_IP  0x0008 /* IP addresses of qname checked */
#define DNS_RPZ_DONE_NSDNAME   0x0010 /* NS name missed; checking addresses */
#define DNS_RPZ_DONE_IPv4      0x0020
#define DNS_RPZ_RECURSING      0x0040
#define DNS_RPZ_ACTIVE	       0x0080
	/*
	 * Best match so far.
	 */
	struct {
		dns_rpz_type_t	 type;
		dns_rpz_zone_t  *rpz;
		dns_rpz_prefix_t prefix;
		dns_rpz_policy_t policy;
		dns_ttl_t	 ttl;
		isc_result_t	 result;
		dns_zone_t	   *zone;
		dns_db_t	 *db;
		dns_dbversion_t *version;
		dns_dbnode_t    *node;
		dns_rdataset_t  *rdataset;
	} m;
	/*
	 * State for chasing IP addresses and NS names including recursion.
	 */
	struct {
		unsigned int	label;
		dns_db_t	 *db;
		dns_rdataset_t *ns_rdataset;
		dns_rdatatype_t r_type;
		isc_result_t	r_result;
		dns_rdataset_t *r_rdataset;
	} r;

/*
	 * State of real query while recursing for NSIP or NSDNAME.
	 */
	struct {
		isc_result_t	result;
		bool		is_zone;
		bool		authoritative;
		dns_zone_t	   *zone;
		dns_db_t	 *db;
		dns_dbnode_t   *node;
		dns_rdataset_t *rdataset;
		dns_rdataset_t *sigrdataset;
		dns_rdatatype_t qtype;
	} q;

/*
	 * A copy of the 'have' and 'p' structures and the RPZ
	 * policy version as of the beginning of RPZ processing,
	 * used to avoid problems when policy is updated while
	 * RPZ recursion is ongoing.
	 */
	dns_rpz_have_t have;
	dns_rpz_popt_t popt;
	int	       rpz_ver;

/*
	 * Shim db between BIND and DNRPS librpz.
	 */
	dns_db_t *rpsdb;

/*
	 * p_name: current policy owner name
	 * r_name: recursing for this name to possible policy triggers
	 * f_name: saved found name from before recursion
	 */
	dns_name_t	   *p_name;
	dns_name_t	   *r_name;
	dns_name_t	   *fname;
	dns_fixedname_t _p_namef;
	dns_fixedname_t _r_namef;
	dns_fixedname_t _fnamef;
} dns_rpz_st_t;

#define DNS_RPZ_TTL_DEFAULT		  5
#define DNS_RPZ_MAX_TTL_DEFAULT		  DNS_RPZ_TTL_DEFAULT
#define DNS_RPZ_MINUPDATEINTERVAL_DEFAULT 60

/*
 * So various response policy zone messages can be turned up or down.
 */
#define DNS_RPZ_ERROR_LEVEL  ISC_LOG_WARNING
#define DNS_RPZ_INFO_LEVEL   ISC_LOG_INFO
#define DNS_RPZ_DEBUG_LEVEL1 ISC_LOG_DEBUG(1)
#define DNS_RPZ_DEBUG_LEVEL2 ISC_LOG_DEBUG(2)
#define DNS_RPZ_DEBUG_LEVEL3 ISC_LOG_DEBUG(3)
#define DNS_RPZ_DEBUG_QUIET  (DNS_RPZ_DEBUG_LEVEL3 + 1)

const char *
dns_rpz_type2str(dns_rpz_type_t type);

dns_rpz_policy_t
dns_rpz_str2policy(const char *str);

const char *
dns_rpz_policy2str(dns_rpz_policy_t policy);

dns_rpz_policy_t
dns_rpz_decode_cname(dns_rpz_zone_t *rpz, dns_rdataset_t *rdataset,
		     dns_name_t *selfname);

isc_result_t
dns_rpz_new_zones(dns_rpz_zones_t **rpzsp, char *rps_cstr, size_t rps_cstr_size,
		  isc_mem_t *mctx, isc_taskmgr_t *taskmgr,
		  isc_timermgr_t *timermgr);

isc_result_t
dns_rpz_new_zone(dns_rpz_zones_t *rpzs, dns_rpz_zone_t **rpzp);

isc_result_t
dns_rpz_dbupdate_callback(dns_db_t *db, void *fn_arg);

void
dns_rpz_attach_rpzs(dns_rpz_zones_t *source, dns_rpz_zones_t **target);

void
dns_rpz_detach_rpzs(dns_rpz_zones_t **rpzsp);

isc_result_t
dns_rpz_beginload(dns_rpz_zones_t **load_rpzsp, dns_rpz_zones_t *rpzs,
		  dns_rpz_num_t rpz_num) ISC_DEPRECATED;

isc_result_t
dns_rpz_ready(dns_rpz_zones_t *rpzs, dns_rpz_zones_t **load_rpzsp,
	      dns_rpz_num_t rpz_num) ISC_DEPRECATED;

isc_result_t
dns_rpz_add(dns_rpz_zones_t *rpzs, dns_rpz_num_t rpz_num,
	    const dns_name_t *name);

void
dns_rpz_delete(dns_rpz_zones_t *rpzs, dns_rpz_num_t rpz_num,
	       const dns_name_t *name);

dns_rpz_num_t
dns_rpz_find_ip(dns_rpz_zones_t *rpzs, dns_rpz_type_t rpz_type,
		dns_rpz_zbits_t zbits, const isc_netaddr_t *netaddr,
		dns_name_t *ip_name, dns_rpz_prefix_t *prefixp);

dns_rpz_zbits_t
dns_rpz_find_name(dns_rpz_zones_t *rpzs, dns_rpz_type_t rpz_type,
		  dns_rpz_zbits_t zbits, dns_name_t *trig_name);

ISC_LANG_ENDDECLS

#endif /* DNS_RPZ_H */

cmd: