policy: add extended errors

diff --git a/modules/policy/README.rst b/modules/policy/README.rst
index 51f467e8789ab69cf7e2a9abc458bff6e6acbbfd..a769a692171f815bcc2106a5909b76b56ec7d986 100644 (file)
--- a/modules/policy/README.rst
+++ b/modules/policy/README.rst
@@ -123,9 +123,18 @@ Following actions stop the policy matching on the query, i.e. other rules are no
 
    Deny existence of names matching filter, i.e. reply NXDOMAIN authoritatively.
 
-.. function:: DENY_MSG(message)
-
-   Deny existence of a given domain and add explanatory message. NXDOMAIN reply contains an additional explanatory message as TXT record in the additional section.
+.. function:: DENY_MSG(message, [extended_error=kres.extended_error.BLOCKED])
+
+   Deny existence of a given domain and add explanatory message. NXDOMAIN reply
+   contains an additional explanatory message as TXT record in the additional
+   section.
+
+   You may override the extended DNS error to provide the user with more
+   information. By default, ``BLOCKED`` is returned to indicate the domain is
+   blocked due to the internal policy of the operator. Other suitable error
+   codes are ``CENSORED`` (for externally imposed policy reasons) or
+   ``FILTERED`` (for blocking requested by the client). For more information,
+   please refer to :rfc:`8914`.
 
 .. py:attribute:: DROP
 

diff --git a/modules/policy/policy.lua b/modules/policy/policy.lua
index e8d7e9b96a2c17e217854cebb97aaca03d273047..d54c96e8a543cbb24ed492a99df9ae7bfe87e117 100644 (file)
--- a/modules/policy/policy.lua
+++ b/modules/policy/policy.lua
@@ -236,6 +236,7 @@ function policy.ANSWER(rtable, nodata)
                ffi.C.kr_pkt_make_auth_header(answer)
                local ttl = (data or {}).ttl or 1
                answer:rcode(kres.rcode.NOERROR)
+               ffi.C.kr_request_set_extended_error(req, kres.extended_error.FORGED, nil)
 
                if data == nil then -- want NODATA, i.e. just a SOA
                        answer:begin(kres.section.AUTHORITY)
@@ -664,10 +665,13 @@ local function answer_clear(req)
        return pkt
 end
 
-function policy.DENY_MSG(msg)
+function policy.DENY_MSG(msg, extended_error)
        if msg and (type(msg) ~= 'string' or #msg >= 255) then
                error('DENY_MSG: optional msg must be string shorter than 256 characters')
         end
+       if extended_error == nil then
+               extended_error = kres.extended_error.BLOCKED
+       end
 
        return function (_, req)
                -- Write authority information
@@ -683,6 +687,7 @@ function policy.DENY_MSG(msg)
                                   string.char(#msg) .. msg)
 
                end
+               ffi.C.kr_request_set_extended_error(req, extended_error, nil)
                return kres.DONE
        end
 end
@@ -780,6 +785,7 @@ policy.DENY = policy.DENY_MSG() -- compatibility with < 2.0
 function policy.DROP(_, req)
        local answer = answer_clear(req)
        if answer == nil then return nil end
+       ffi.C.kr_request_set_extended_error(req, kres.extended_error.PROHIBITED, nil)
        return kres.FAIL
 end
 
@@ -788,6 +794,7 @@ function policy.REFUSE(_, req)
        if answer == nil then return nil end
        answer:rcode(kres.rcode.REFUSED)
        answer:ad(false)
+       ffi.C.kr_request_set_extended_error(req, kres.extended_error.PROHIBITED, nil)
        return kres.DONE
 end
 
@@ -990,7 +997,8 @@ policy.special_names = {
                cb=policy.suffix_common(policy.DENY_MSG(
                        'Blocking is mandated by standards, see references on '
                        .. 'https://www.iana.org/assignments/'
-                       .. 'locally-served-dns-zones/locally-served-dns-zones.xhtml'),
+                       .. 'locally-served-dns-zones/locally-served-dns-zones.xhtml',
+                       kres.extended_error.NOTSUP),
                        private_zones, todname('arpa.')),
                count=0
        },
@@ -998,7 +1006,8 @@ policy.special_names = {
                cb=policy.suffix(policy.DENY_MSG(
                        'Blocking is mandated by standards, see references on '
                        .. 'https://www.iana.org/assignments/'
-                       .. 'special-use-domain-names/special-use-domain-names.xhtml'),
+                       .. 'special-use-domain-names/special-use-domain-names.xhtml',
+                       kres.extended_error.NOTSUP),
                        {
                                todname('test.'),
                                todname('onion.'),

diff --git a/modules/renumber/renumber.lua b/modules/renumber/renumber.lua
index c10063ca56ae781e54dc625738384d3068ee34c2..b670695eec569da8cdd148455480ee6f009735d8 100644 (file)
--- a/modules/renumber/renumber.lua
+++ b/modules/renumber/renumber.lua
@@ -99,6 +99,7 @@ local function rule(prefixes)
                                pkt:put(rr.owner, rr.ttl, rr.class, rr.type, rr.rdata)
                        end
                end
+               ffi.C.kr_request_set_extended_error(req, kres.extended_error.FORGED, nil)
                return state
        end
 end