pdns/filterpo.hh

   1 /*
   2  * This file is part of PowerDNS or dnsdist.
   3  * Copyright -- PowerDNS.COM B.V. and its contributors
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of version 2 of the GNU General Public License as
   7  * published by the Free Software Foundation.
   8  *
   9  * In addition, for the avoidance of any doubt, permission is granted to
  10  * link this program with OpenSSL and to (re)distribute the binaries
  11  * produced as the result of such linking.
  12  *
  13  * This program is distributed in the hope that it will be useful,
  14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16  * GNU General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU General Public License
  19  * along with this program; if not, write to the Free Software
  20  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  21  */
  22 #pragma once
  23 #include "iputils.hh"
  24 #include "dns.hh"
  25 #include "dnsname.hh"
  26 #include "dnsparser.hh"
  27 #include <map>
  28 #include <unordered_map>
  29
  30 /* This class implements a filtering policy that is able to fully implement RPZ, but is not bound to it.
  31    In other words, it is generic enough to support RPZ, but could get its data from other places.
  32
  33
  34    We know the following actions:
  35
  36    No action - just pass it on
  37    Drop - drop a query, no response
  38    NXDOMAIN - fake up an NXDOMAIN for the query
  39    NODATA - just return no data for this qtype
  40    Truncate - set TC bit
  41    Modified - "we fake an answer for you"
  42
  43    These actions can be caused by the following triggers:
  44
  45    qname - the query name
  46    client-ip - the IP address of the requestor
  47    response-ip - an IP address in the response
  48    ns-name - the name of a server used in the delegation
  49    ns-ip - the IP address of a server used in the delegation
  50
  51    This means we get several hook points:
  52    1) when the query comes in: qname & client-ip
  53    2) during processing: ns-name & ns-ip
  54    3) after processing: response-ip
  55
  56    Triggers meanwhile can apply to:
  57    Verbatim domain names
  58    Wildcard versions (*.domain.com does NOT match domain.com)
  59    Netmasks (IPv4 and IPv6)
  60    Finally, triggers are grouped in different zones. The "first" zone that has a match
  61    is consulted. Then within that zone, rules again have precedences.
  62 */
  63
  64
  65 class DNSFilterEngine
  66 {
  67 public:
  68   enum class PolicyKind { NoAction, Drop, NXDOMAIN, NODATA, Truncate, Custom};
  69   enum class PolicyType { None, QName, ClientIP, ResponseIP, NSDName, NSIP };
  70
  71   struct Policy
  72   {
  73     Policy(): d_custom(nullptr), d_name(nullptr), d_kind(PolicyKind::NoAction), d_type(PolicyType::None), d_ttl(0)
  74     {
  75     }
  76     bool operator==(const Policy& rhs) const
  77     {
  78       return d_kind == rhs.d_kind; // XXX check d_custom too!
  79     }
  80     std::string getKindToString() const;
  81     DNSRecord getCustomRecord(const DNSName& qname) const;
  82     DNSRecord getRecord(const DNSName& qname) const;
  83
  84     std::shared_ptr<DNSRecordContent> d_custom;
  85     std::shared_ptr<std::string> d_name;
  86     PolicyKind d_kind;
  87     PolicyType d_type;
  88     int32_t d_ttl;
  89   };
  90
  91   class Zone {
  92   public:
  93     void clear()
  94     {
  95       d_qpolAddr.clear();
  96       d_postpolAddr.clear();
  97       d_propolName.clear();
  98       d_propolNSAddr.clear();
  99       d_qpolName.clear();
 100     }
 101     void reserve(size_t entriesCount)
 102     {
 103       d_qpolName.reserve(entriesCount);
 104     }
 105     void setName(const std::string& name)
 106     {
 107       d_name = std::make_shared<std::string>(name);
 108     }
 109     void setDomain(const DNSName& domain)
 110     {
 111       d_domain = domain;
 112     }
 113     void setSerial(uint32_t serial)
 114     {
 115       d_serial = serial;
 116     }
 117     void setRefresh(uint32_t refresh)
 118     {
 119       d_refresh = refresh;
 120     }
 121     const std::shared_ptr<std::string> getName() const
 122     {
 123       return d_name;
 124     }
 125
 126     DNSName getDomain() const
 127     {
 128       return d_domain;
 129     }
 130
 131     uint32_t getRefresh() const
 132     {
 133       return d_refresh;
 134     }
 135
 136     size_t size() const
 137     {
 138       return d_qpolAddr.size() + d_postpolAddr.size() + d_propolName.size() + d_propolNSAddr.size() + d_qpolName.size();
 139
 140     }
 141
 142     void dump(FILE * fp) const;
 143
 144     void addClientTrigger(const Netmask& nm, Policy pol);
 145     void addQNameTrigger(const DNSName& nm, Policy pol);
 146     void addNSTrigger(const DNSName& dn, Policy pol);
 147     void addNSIPTrigger(const Netmask& nm, Policy pol);
 148     void addResponseTrigger(const Netmask& nm, Policy pol);
 149
 150     bool rmClientTrigger(const Netmask& nm, Policy& pol);
 151     bool rmQNameTrigger(const DNSName& nm, Policy& pol);
 152     bool rmNSTrigger(const DNSName& dn, Policy& pol);
 153     bool rmNSIPTrigger(const Netmask& nm, Policy& pol);
 154     bool rmResponseTrigger(const Netmask& nm, Policy& pol);
 155
 156     bool findQNamePolicy(const DNSName& qname, DNSFilterEngine::Policy& pol) const;
 157     bool findNSPolicy(const DNSName& qname, DNSFilterEngine::Policy& pol) const;
 158     bool findNSIPPolicy(const ComboAddress& addr, DNSFilterEngine::Policy& pol) const;
 159     bool findResponsePolicy(const ComboAddress& addr, DNSFilterEngine::Policy& pol) const;
 160     bool findClientPolicy(const ComboAddress& addr, DNSFilterEngine::Policy& pol) const;
 161
 162   private:
 163     static DNSName maskToRPZ(const Netmask& nm);
 164     bool findNamedPolicy(const std::unordered_map<DNSName, DNSFilterEngine::Policy>& polmap, const DNSName& qname, DNSFilterEngine::Policy& pol) const;
 165     void dumpNamedPolicy(FILE* fp, const DNSName& name, const Policy& pol) const;
 166     void dumpAddrPolicy(FILE* fp, const Netmask& nm, const DNSName& name, const Policy& pol) const;
 167
 168     std::unordered_map<DNSName, Policy> d_qpolName;   // QNAME trigger (RPZ)
 169     NetmaskTree<Policy> d_qpolAddr;         // Source address
 170     std::unordered_map<DNSName, Policy> d_propolName; // NSDNAME (RPZ)
 171     NetmaskTree<Policy> d_propolNSAddr;     // NSIP (RPZ)
 172     NetmaskTree<Policy> d_postpolAddr;      // IP trigger (RPZ)
 173     DNSName d_domain;
 174     std::shared_ptr<std::string> d_name;
 175     uint32_t d_serial{0};
 176     uint32_t d_refresh{0};
 177   };
 178
 179   DNSFilterEngine();
 180   void clear()
 181   {
 182     for(auto& z : d_zones) {
 183       z->clear();
 184     }
 185   }
 186   const std::shared_ptr<Zone> getZone(size_t zoneIdx) const
 187   {
 188     std::shared_ptr<Zone> result{nullptr};
 189     if (zoneIdx < d_zones.size()) {
 190       result = d_zones[zoneIdx];
 191     }
 192     return result;
 193   }
 194   const std::shared_ptr<Zone> getZone(const std::string& name) const
 195   {
 196     for (const auto zone : d_zones) {
 197       const auto& zName = zone->getName();
 198       if (zName && *zName == name) {
 199         return zone;
 200       }
 201     }
 202     return nullptr;
 203   }
 204   size_t addZone(std::shared_ptr<Zone> newZone)
 205   {
 206     d_zones.push_back(newZone);
 207     return (d_zones.size() - 1);
 208   }
 209   void setZone(size_t zoneIdx, std::shared_ptr<Zone> newZone)
 210   {
 211     if (newZone) {
 212       assureZones(zoneIdx);
 213       d_zones[zoneIdx] = newZone;
 214     }
 215   }
 216
 217   Policy getQueryPolicy(const DNSName& qname, const ComboAddress& nm, const std::unordered_map<std::string,bool>& discardedPolicies) const;
 218   Policy getProcessingPolicy(const DNSName& qname, const std::unordered_map<std::string,bool>& discardedPolicies) const;
 219   Policy getProcessingPolicy(const ComboAddress& address, const std::unordered_map<std::string,bool>& discardedPolicies) const;
 220   Policy getPostPolicy(const vector<DNSRecord>& records, const std::unordered_map<std::string,bool>& discardedPolicies) const;
 221
 222   size_t size() const {
 223     return d_zones.size();
 224   }
 225 private:
 226   void assureZones(size_t zone);
 227   vector<std::shared_ptr<Zone>> d_zones;
 228 };