2 * This file is part of PowerDNS or dnsdist.
3 * Copyright -- PowerDNS.COM B.V. and its contributors
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of version 2 of the GNU General Public License as
7 * published by the Free Software Foundation.
9 * In addition, for the avoidance of any doubt, permission is granted to
10 * link this program with OpenSSL and to (re)distribute the binaries
11 * produced as the result of such linking.
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, write to the Free Software
20 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
25 #include "dnsdist-rings.hh"
27 class DynBlockRulesGroup
33 std::map<uint8_t, uint64_t> d_rcodeCounts;
34 std::map<uint16_t, uint64_t> d_qtypeCounts;
36 uint64_t respBytes{0};
41 DynBlockRule(): d_enabled(false)
45 DynBlockRule(const std::string& blockReason, unsigned int blockDuration, unsigned int rate, unsigned int seconds, DNSAction::Action action): d_blockReason(blockReason), d_blockDuration(blockDuration), d_rate(rate), d_seconds(seconds), d_action(action), d_enabled(true)
49 bool matches(const struct timespec& when)
55 if (d_seconds && when < d_cutOff) {
59 if (when < d_minTime) {
66 bool rateExceeded(unsigned int count, const struct timespec& now) const
72 double delta = d_seconds ? d_seconds : DiffTime(now, d_minTime);
73 double limit = delta * d_rate;
74 return (count > limit);
77 bool isEnabled() const
82 std::string toString() const
88 std::stringstream result;
89 if (d_action != DNSAction::Action::None) {
90 result << DNSAction::typeToString(d_action) << " ";
93 result << "Apply the global DynBlock action ";
95 result << "for " << std::to_string(d_blockDuration) << " seconds when over " << std::to_string(d_rate) << " during the last " << d_seconds << " seconds, reason: '" << d_blockReason << "'";
100 std::string d_blockReason;
101 struct timespec d_cutOff;
102 struct timespec d_minTime;
103 unsigned int d_blockDuration{0};
104 unsigned int d_rate{0};
105 unsigned int d_seconds{0};
106 DNSAction::Action d_action{DNSAction::Action::None};
107 bool d_enabled{false};
110 typedef std::unordered_map<ComboAddress, Counts, ComboAddress::addressOnlyHash, ComboAddress::addressOnlyEqual> counts_t;
117 void setQueryRate(unsigned int rate, unsigned int seconds, std::string reason, unsigned int blockDuration, DNSAction::Action action)
119 d_queryRateRule = DynBlockRule(reason, blockDuration, rate, seconds, action);
122 void setResponseByteRate(unsigned int rate, unsigned int seconds, std::string reason, unsigned int blockDuration, DNSAction::Action action)
124 d_respRateRule = DynBlockRule(reason, blockDuration, rate, seconds, action);
127 void setRCodeRate(uint8_t rcode, unsigned int rate, unsigned int seconds, std::string reason, unsigned int blockDuration, DNSAction::Action action)
129 auto& entry = d_rcodeRules[rcode];
130 entry = DynBlockRule(reason, blockDuration, rate, seconds, action);
133 void setQTypeRate(uint16_t qtype, unsigned int rate, unsigned int seconds, std::string reason, unsigned int blockDuration, DNSAction::Action action)
135 auto& entry = d_qtypeRules[qtype];
136 entry = DynBlockRule(reason, blockDuration, rate, seconds, action);
143 size_t entriesCount = 0;
144 if (hasQueryRules()) {
145 entriesCount += g_rings.getNumberOfQueryEntries();
147 if (hasResponseRules()) {
148 entriesCount += g_rings.getNumberOfResponseEntries();
150 counts.reserve(entriesCount);
152 processQueryRules(counts);
153 processResponseRules(counts);
155 if (counts.empty()) {
159 boost::optional<NetmaskTree<DynBlock> > blocks;
160 bool updated = false;
164 for (const auto& entry : counts) {
165 if (d_queryRateRule.rateExceeded(entry.second.queries, now)) {
166 addBlock(blocks, now, entry.first, d_queryRateRule, updated);
170 if (d_respRateRule.rateExceeded(entry.second.respBytes, now)) {
171 addBlock(blocks, now, entry.first, d_respRateRule, updated);
175 for (const auto& rule : d_qtypeRules) {
176 const auto& typeIt = entry.second.d_qtypeCounts.find(rule.first);
177 if (typeIt != entry.second.d_qtypeCounts.cend() && rule.second.rateExceeded(typeIt->second, now)) {
178 addBlock(blocks, now, entry.first, rule.second, updated);
183 for (const auto& rule : d_rcodeRules) {
184 const auto& rcodeIt = entry.second.d_rcodeCounts.find(rule.first);
185 if (rcodeIt != entry.second.d_rcodeCounts.cend() && rule.second.rateExceeded(rcodeIt->second, now)) {
186 addBlock(blocks, now, entry.first, rule.second, updated);
192 if (updated && blocks) {
193 g_dynblockNMG.setState(*blocks);
197 void excludeRange(const Netmask& range)
199 d_excludedSubnets.addMask(range);
202 void includeRange(const Netmask& range)
204 d_excludedSubnets.addMask(range, false);
207 std::string toString() const
209 std::stringstream result;
211 result << "Query rate rule: " << d_queryRateRule.toString() << std::endl;
212 result << "Response rate rule: " << d_respRateRule.toString() << std::endl;
213 result << "RCode rules: " << std::endl;
214 for (const auto& rule : d_rcodeRules) {
215 result << "- " << RCode::to_s(rule.first) << ": " << rule.second.toString() << std::endl;
217 result << "QType rules: " << std::endl;
218 for (const auto& rule : d_qtypeRules) {
219 result << "- " << QType(rule.first).getName() << ": " << rule.second.toString() << std::endl;
221 result << "Excluded Subnets: " << d_excludedSubnets.toString() << std::endl;
227 bool checkIfQueryTypeMatches(const Rings::Query& query)
229 auto rule = d_qtypeRules.find(query.qtype);
230 if (rule == d_qtypeRules.end()) {
234 return rule->second.matches(query.when);
237 bool checkIfResponseCodeMatches(const Rings::Response& response)
239 auto rule = d_rcodeRules.find(response.dh.rcode);
240 if (rule == d_rcodeRules.end()) {
244 return rule->second.matches(response.when);
247 void addBlock(boost::optional<NetmaskTree<DynBlock> >& blocks, const struct timespec& now, const ComboAddress& requestor, const DynBlockRule& rule, bool& updated)
249 if (d_excludedSubnets.match(requestor)) {
250 /* do not add a block for excluded subnets */
255 blocks = g_dynblockNMG.getCopy();
257 struct timespec until = now;
258 until.tv_sec += rule.d_blockDuration;
259 unsigned int count = 0;
260 const auto& got = blocks->lookup(Netmask(requestor));
261 bool expired = false;
263 if (until < got->second.until) {
264 // had a longer policy
268 if (now < got->second.until) {
269 // only inherit count on fresh query we are extending
270 count = got->second.blocks;
277 DynBlock db{rule.d_blockReason, until, DNSName(), rule.d_action};
279 if (!got || expired) {
280 warnlog("Inserting dynamic block for %s for %d seconds: %s", requestor.toString(), rule.d_blockDuration, rule.d_blockReason);
282 blocks->insert(Netmask(requestor)).second = db;
286 bool hasQueryRules() const
288 return d_queryRateRule.isEnabled() || !d_qtypeRules.empty();
291 bool hasResponseRules() const
293 return d_respRateRule.isEnabled() || !d_rcodeRules.empty();
296 bool hasRules() const
298 return hasQueryRules() || hasResponseRules();
301 void processQueryRules(counts_t& counts)
303 if (!hasQueryRules()) {
309 d_queryRateRule.d_cutOff = d_queryRateRule.d_minTime = now;
310 d_queryRateRule.d_cutOff.tv_sec -= d_queryRateRule.d_seconds;
312 for (auto& rule : d_qtypeRules) {
313 rule.second.d_cutOff = rule.second.d_minTime = now;
314 rule.second.d_cutOff.tv_sec -= rule.second.d_seconds;
317 for (const auto& shard : g_rings.d_shards) {
318 std::lock_guard<std::mutex> rl(shard->queryLock);
319 for(const auto& c : shard->queryRing) {
324 bool qRateMatches = d_queryRateRule.matches(c.when);
325 bool typeRuleMatches = checkIfQueryTypeMatches(c);
327 if (qRateMatches || typeRuleMatches) {
328 auto& entry = counts[c.requestor];
332 if (typeRuleMatches) {
333 entry.d_qtypeCounts[c.qtype]++;
340 void processResponseRules(counts_t& counts)
342 if (!hasResponseRules()) {
348 d_respRateRule.d_cutOff = d_respRateRule.d_minTime = now;
349 d_respRateRule.d_cutOff.tv_sec -= d_respRateRule.d_seconds;
351 for (auto& rule : d_rcodeRules) {
352 rule.second.d_cutOff = rule.second.d_minTime = now;
353 rule.second.d_cutOff.tv_sec -= rule.second.d_seconds;
356 for (const auto& shard : g_rings.d_shards) {
357 std::lock_guard<std::mutex> rl(shard->respLock);
358 for(const auto& c : shard->respRing) {
363 bool respRateMatches = d_respRateRule.matches(c.when);
364 bool rcodeRuleMatches = checkIfResponseCodeMatches(c);
366 if (respRateMatches || rcodeRuleMatches) {
367 auto& entry = counts[c.requestor];
368 if (respRateMatches) {
369 entry.respBytes += c.size;
371 if (rcodeRuleMatches) {
372 entry.d_rcodeCounts[c.dh.rcode]++;
379 std::map<uint8_t, DynBlockRule> d_rcodeRules;
380 std::map<uint16_t, DynBlockRule> d_qtypeRules;
381 DynBlockRule d_queryRateRule;
382 DynBlockRule d_respRateRule;
383 NetmaskGroup d_excludedSubnets;