policy: add policy.IPTRACE logging action

diff --git a/NEWS b/NEWS
index 88d588db2766bf769ee0c1fe6e639f96fefe3676..0b2b56186e9099261c44f2e9a92cc32a0bc44f43 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -4,6 +4,7 @@ Knot Resolver 5.5.0 (2022-mm-dd)
 Improvements
 ------------
 - extended_errors: module for extended DNS error support, RFC8914 (!1234)
+- policy: log policy actions; useful for RPZ debugging (!1239)
 - policy: new action policy.IPTRACE for logging request origin (!1239)
 
 Incompatible changes

diff --git a/modules/policy/README.rst b/modules/policy/README.rst
index 176ff1638d0594c2dc24d3e7c600a7aac9f8387d..33b26654ca05f5c08afcc370b239ef0ca102158d 100644 (file)
--- a/modules/policy/README.rst
+++ b/modules/policy/README.rst
@@ -301,6 +301,24 @@ They are marked as ``debug`` level, so e.g. with journalctl command you can use
    It makes most sense together with :ref:`mod-view` (enabling per-client)
    and probably with verbose logging those request (e.g. use :any:`DEBUG_ALWAYS` instead).
 
+.. py:attribute:: IPTRACE
+
+   Log how the request arrived.
+   Most notably, this includes the client's IP address, so beware of privacy implications.
+
+   .. code-block:: lua
+
+        -- example usage in configuration
+        policy.add(policy.all(policy.IPTRACE))
+        -- you might want to combine it with some other logs, e.g.
+        policy.add(policy.all(policy.DEBUG_ALWAYS))
+
+   .. code-block:: text
+
+        -- example log lines from IPTRACE:
+        [reqdbg][policy][57517.00] request packet arrived from ::1#37931 to ::1#00853 (TCP + TLS)
+        [reqdbg][policy][65538.00] request packet arrived internally
+
 
 Custom actions
 ^^^^^^^^^^^^^^

diff --git a/modules/policy/policy.lua b/modules/policy/policy.lua
index 8d9afbc3f93fda67526db8c5e4488dbf83524794..f17129bfb20df99cf24001b4b62f5dbe08dfefd8 100644 (file)
--- a/modules/policy/policy.lua
+++ b/modules/policy/policy.lua
@@ -748,6 +748,24 @@ function policy.REQTRACE(_, req)
        log_notrace(req, 'request packet:\n%s', req.qsource.packet)
 end
 
+-- log how the request arrived, notably the client's IP
+function policy.IPTRACE(_, req)
+       if req.qsource.addr == nil then
+               log_notrace(req, 'request packet arrived internally\n')
+       else
+               -- stringify transport flags: struct kr_request_qsource_flags
+               local qf = req.qsource.flags
+               local qf_str = qf.tcp and 'TCP' or 'UDP'
+               if qf.tls  then qf_str = qf_str .. ' + TLS'  end
+               if qf.http then qf_str = qf_str .. ' + HTTP' end
+               if qf.xdp  then qf_str = qf_str .. ' + XDP'  end
+
+               log_notrace(req, 'request packet arrived from %s to %s (%s)\n',
+                       req.qsource.addr, req.qsource.dst_addr, qf_str)
+       end
+       return nil -- chain rule
+end
+
 function policy.DEBUG_ALWAYS(state, req)
        policy.QTRACE(state, req)
        req:trace_chain_callbacks(debug_logline_cb, debug_logfinish_cb)