From: Mukund Sivaraman Date: Mon, 6 Jul 2015 03:18:37 +0000 (+0530) Subject: Allow RPZ rewrite logging to be configured on a per-zone basis (#39754) X-Git-Tag: v9.11.0a1~683 X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=33ca26968b638b4ff9c657e9574d14d1a04a52dd;p=thirdparty%2Fbind9.git Allow RPZ rewrite logging to be configured on a per-zone basis (#39754) --- diff --git a/CHANGES b/CHANGES index f1f6995768d..f13b8e1af3b 100644 --- a/CHANGES +++ b/CHANGES @@ -1,3 +1,7 @@ +4155. [func] Allow RPZ rewrite logging to be configured on a + per-zone basis using a newly introduced log clause in + the response-policy option. [RT #39754] + 4154. [bug] A OPT record should be included with the FORMERR response when there is a malformed EDNS option. [RT #39647] diff --git a/bin/named/query.c b/bin/named/query.c index d62aa70aec7..57fd1cfbad6 100644 --- a/bin/named/query.c +++ b/bin/named/query.c @@ -943,13 +943,14 @@ static void rpz_log_rewrite(ns_client_t *client, isc_boolean_t disabled, dns_rpz_policy_t policy, dns_rpz_type_t type, dns_zone_t *p_zone, dns_name_t *p_name, - dns_name_t *cname) + dns_name_t *cname, dns_rpz_num_t rpz_num) { isc_stats_t *zonestats; char qname_buf[DNS_NAME_FORMATSIZE]; char p_name_buf[DNS_NAME_FORMATSIZE]; char cname_buf[DNS_NAME_FORMATSIZE] = { 0 }; const char *s1 = cname_buf, *s2 = cname_buf; + dns_rpz_st_t *st; /* * Count enabled rewrites in the global counter. @@ -969,6 +970,10 @@ rpz_log_rewrite(ns_client_t *client, isc_boolean_t disabled, if (!isc_log_wouldlog(ns_g_lctx, DNS_RPZ_INFO_LEVEL)) return; + st = client->query.rpz_st; + if ((st->popt.no_log & DNS_RPZ_ZBIT(rpz_num)) != 0) + return; + dns_name_format(client->query.qname, qname_buf, sizeof(qname_buf)); dns_name_format(p_name, p_name_buf, sizeof(p_name_buf)); if (cname != NULL) { @@ -1029,7 +1034,15 @@ rpz_getdb(ns_client_t *client, dns_name_t *p_name, dns_rpz_type_t rpz_type, result = query_getzonedb(client, p_name, dns_rdatatype_any, DNS_GETDB_IGNOREACL, zonep, dbp, &rpz_version); if (result == ISC_R_SUCCESS) { - if (isc_log_wouldlog(ns_g_lctx, DNS_RPZ_DEBUG_LEVEL2)) { + dns_rpz_st_t *st = client->query.rpz_st; + + /* + * It isn't meaningful to log this message when + * logging is disabled for some policy zones. + */ + if (st->popt.no_log == 0 && + isc_log_wouldlog(ns_g_lctx, DNS_RPZ_DEBUG_LEVEL2)) + { dns_name_format(client->query.qname, qnamebuf, sizeof(qnamebuf)); dns_name_format(p_name, p_namebuf, sizeof(p_namebuf)); @@ -4731,7 +4744,7 @@ rpz_rewrite_ip(ns_client_t *client, const isc_netaddr_t *netaddr, * and try the next eligible policy zone. */ rpz_log_rewrite(client, ISC_TRUE, policy, rpz_type, - p_zone, p_name, NULL); + p_zone, p_name, NULL, rpz_num); } } @@ -5068,7 +5081,7 @@ rpz_rewrite_name(ns_client_t *client, dns_name_t *trig_name, * and try the next eligible policy zone. */ rpz_log_rewrite(client, ISC_TRUE, policy, rpz_type, - p_zone, p_name, NULL); + p_zone, p_name, NULL, rpz_num); break; } } @@ -5474,7 +5487,7 @@ cleanup: result != DNS_R_DELEGATION) rpz_log_rewrite(client, ISC_FALSE, st->m.policy, st->m.type, st->m.zone, st->p_name, - NULL); + NULL, st->m.rpz->num); rpz_match_clear(st); } if (st->m.policy == DNS_RPZ_POLICY_ERROR) { @@ -5596,7 +5609,8 @@ rpz_add_cname(ns_client_t *client, dns_rpz_st_t *st, if (result != ISC_R_SUCCESS) return (result); rpz_log_rewrite(client, ISC_FALSE, st->m.policy, - st->m.type, st->m.zone, st->p_name, fname); + st->m.type, st->m.zone, st->p_name, fname, + st->m.rpz->num); ns_client_qnamereplace(client, fname); /* * Turn off DNSSEC because the results of a @@ -7046,14 +7060,16 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype) rpz_log_rewrite(client, ISC_FALSE, rpz_st->m.policy, rpz_st->m.type, zone, - rpz_st->p_name, NULL); + rpz_st->p_name, NULL, + rpz_st->m.rpz->num); goto cleanup; case DNS_RPZ_POLICY_DROP: QUERY_ERROR(DNS_R_DROP); rpz_log_rewrite(client, ISC_FALSE, rpz_st->m.policy, rpz_st->m.type, zone, - rpz_st->p_name, NULL); + rpz_st->p_name, NULL, + rpz_st->m.rpz->num); goto cleanup; case DNS_RPZ_POLICY_NXDOMAIN: result = DNS_R_NXDOMAIN; @@ -7127,7 +7143,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype) is_zone = ISC_TRUE; rpz_log_rewrite(client, ISC_FALSE, rpz_st->m.policy, rpz_st->m.type, zone, rpz_st->p_name, - NULL); + NULL, rpz_st->m.rpz->num); } } diff --git a/bin/named/server.c b/bin/named/server.c index 92f119073f2..1e2e8fc484a 100644 --- a/bin/named/server.c +++ b/bin/named/server.c @@ -1740,6 +1740,13 @@ configure_rpz_zone(dns_view_t *view, const cfg_listelt_t *element, view->rpzs->p.no_rd_ok |= DNS_RPZ_ZBIT(new->num); } + obj = cfg_tuple_get(rpz_obj, "log"); + if (!cfg_obj_isvoid(obj) && !cfg_obj_asboolean(obj)) { + view->rpzs->p.no_log |= DNS_RPZ_ZBIT(new->num); + } else { + view->rpzs->p.no_log &= ~DNS_RPZ_ZBIT(new->num); + } + obj = cfg_tuple_get(rpz_obj, "max-policy-ttl"); if (cfg_obj_isuint32(obj)) { new->max_policy_ttl = cfg_obj_asuint32(obj); diff --git a/bin/tests/system/rpzrecurse/ns2/db.log1 b/bin/tests/system/rpzrecurse/ns2/db.log1 new file mode 100644 index 00000000000..6c010e0f22f --- /dev/null +++ b/bin/tests/system/rpzrecurse/ns2/db.log1 @@ -0,0 +1,19 @@ +; Copyright (C) 2015 Internet Systems Consortium, Inc. ("ISC") +; +; Permission to use, copy, modify, and/or distribute this software for any +; purpose with or without fee is hereby granted, provided that the above +; copyright notice and this permission notice appear in all copies. +; +; THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH +; REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY +; AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, +; INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM +; LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE +; OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR +; PERFORMANCE OF THIS SOFTWARE. + +$TTL 60 +@ IN SOA root.ns ns 1996072700 3600 1800 86400 60 + NS ns +ns A 127.0.0.1 +32.4.0.53.10.rpz-client-ip A 10.53.0.4 diff --git a/bin/tests/system/rpzrecurse/ns2/db.log2 b/bin/tests/system/rpzrecurse/ns2/db.log2 new file mode 100644 index 00000000000..7da1d810a7f --- /dev/null +++ b/bin/tests/system/rpzrecurse/ns2/db.log2 @@ -0,0 +1,20 @@ +; Copyright (C) 2015 Internet Systems Consortium, Inc. ("ISC") +; +; Permission to use, copy, modify, and/or distribute this software for any +; purpose with or without fee is hereby granted, provided that the above +; copyright notice and this permission notice appear in all copies. +; +; THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH +; REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY +; AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, +; INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM +; LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE +; OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR +; PERFORMANCE OF THIS SOFTWARE. + +$TTL 60 +@ IN SOA root.ns ns 1996072700 3600 1800 86400 60 + NS ns +ns A 127.0.0.1 +32.4.0.53.10.rpz-client-ip A 10.53.0.4 +32.3.0.53.10.rpz-client-ip A 10.53.0.3 diff --git a/bin/tests/system/rpzrecurse/ns2/db.log3 b/bin/tests/system/rpzrecurse/ns2/db.log3 new file mode 100644 index 00000000000..451589e7d91 --- /dev/null +++ b/bin/tests/system/rpzrecurse/ns2/db.log3 @@ -0,0 +1,21 @@ +; Copyright (C) 2015 Internet Systems Consortium, Inc. ("ISC") +; +; Permission to use, copy, modify, and/or distribute this software for any +; purpose with or without fee is hereby granted, provided that the above +; copyright notice and this permission notice appear in all copies. +; +; THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH +; REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY +; AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, +; INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM +; LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE +; OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR +; PERFORMANCE OF THIS SOFTWARE. + +$TTL 60 +@ IN SOA root.ns ns 1996072700 3600 1800 86400 60 + NS ns +ns A 127.0.0.1 +32.4.0.53.10.rpz-client-ip A 10.53.0.4 +32.3.0.53.10.rpz-client-ip A 10.53.0.3 +32.2.0.53.10.rpz-client-ip A 10.53.0.2 diff --git a/bin/tests/system/rpzrecurse/ns2/named.log.conf b/bin/tests/system/rpzrecurse/ns2/named.log.conf new file mode 100644 index 00000000000..8fbe50a371a --- /dev/null +++ b/bin/tests/system/rpzrecurse/ns2/named.log.conf @@ -0,0 +1,37 @@ +/* + * Copyright (C) 2015 Internet Systems Consortium, Inc. ("ISC") + * + * Permission to use, copy, modify, and/or distribute this software for any + * purpose with or without fee is hereby granted, provided that the above + * copyright notice and this permission notice appear in all copies. + * + * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH + * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY + * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, + * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM + * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE + * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR + * PERFORMANCE OF THIS SOFTWARE. + */ + +# common configuration +include "named.conf.header"; + +view "recursive" { + zone "." { + type hint; + file "root.hint"; + }; + + # policy configuration to be tested + response-policy { + zone "log1" log no; + zone "log2" log yes; + zone "log3"; # missing log clause + } qname-wait-recurse no; + + # policy zones to be tested + zone "log1" { type master; file "db.log1"; }; + zone "log2" { type master; file "db.log2"; }; + zone "log3" { type master; file "db.log3"; }; +}; diff --git a/bin/tests/system/rpzrecurse/tests.sh b/bin/tests/system/rpzrecurse/tests.sh index 02a5949aec2..cc5c45a5d04 100644 --- a/bin/tests/system/rpzrecurse/tests.sh +++ b/bin/tests/system/rpzrecurse/tests.sh @@ -245,4 +245,25 @@ grep "^l2.l1.l0.[[:space:]]*[0-9]*[[:space:]]*IN[[:space:]]*A[[:space:]]*10.53.0 status=1 } +# Check RPZ log clause +t=`expr $t + 1` +echo "I:testing RPZ log clause (${t})" +run_server log +cur=`awk 'BEGIN {l=0} // {l++} END { print l }' ns2/named.run` +$DIG $DIGOPTS l2.l1.l0 a @10.53.0.2 -p 5300 -b 10.53.0.4 > dig.out.${t} +$DIG $DIGOPTS l2.l1.l0 a @10.53.0.2 -p 5300 -b 10.53.0.3 >> dig.out.${t} +$DIG $DIGOPTS l2.l1.l0 a @10.53.0.2 -p 5300 -b 10.53.0.2 >> dig.out.${t} +tail -n +"$cur" < ns2/named.run | grep "view recursive: rpz CLIENT-IP Local-Data rewrite l2.l1.l0 via 32.4.0.53.10.rpz-client-ip.log1" > /dev/null && { + echo "I: failed: unexpected rewrite message for policy zone log1 was logged" + status=1 +} +tail -n +"$cur" < ns2/named.run | grep "view recursive: rpz CLIENT-IP Local-Data rewrite l2.l1.l0 via 32.3.0.53.10.rpz-client-ip.log2" > /dev/null || { + echo "I: failed: expected rewrite message for policy zone log2 was not logged" + status=1 +} +tail -n +"$cur" < ns2/named.run | grep "view recursive: rpz CLIENT-IP Local-Data rewrite l2.l1.l0 via 32.2.0.53.10.rpz-client-ip.log3" > /dev/null || { + echo "I: failed: expected rewrite message for policy zone log3 was not logged" + status=1 +} + exit $status diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml index 5df08865652..3882028db1f 100644 --- a/doc/arm/Bv9ARM-book.xml +++ b/doc/arm/Bv9ARM-book.xml @@ -5018,6 +5018,7 @@ badresp:1,adberr:0,findfail:0,valfail:0] policy (given | disabled | passthru | drop | tcp-only | nxdomain | nodata | cname domain) recursive-only yes_or_no + log yes_or_no max-policy-ttl number ; ... } recursive-only yes_or_no @@ -10296,6 +10297,12 @@ example.com CNAME rpz-tcp-only. Responses rewritten by RPZ are counted in the RPZRewrites statistics. + + + The log clause can be used to optionally + turn off rewrite logging for a particular response policy + zone. By default, all rewrites are logged. + diff --git a/doc/arm/notes.xml b/doc/arm/notes.xml index afc29285637..96699948b3c 100644 --- a/doc/arm/notes.xml +++ b/doc/arm/notes.xml @@ -517,6 +517,13 @@ on Linux is now supported. + + + Within the option, it is now + possible to configure RPZ rewrite logging on a per-zone basis + using the clause. + + diff --git a/doc/misc/options b/doc/misc/options index 04af49977f0..54a6320be04 100644 --- a/doc/misc/options +++ b/doc/misc/options @@ -257,6 +257,7 @@ options { response-policy { zone [ policy ( given | disabled | passthru | no-op | drop | tcp-only | nxdomain | nodata | cname ) ] [ recursive-only ] [ + log ] [ max-policy-ttl ]; ... } [ recursive-only ] [ break-dnssec ] [ max-policy-ttl ] [ min-ns-dots ] [ qname-wait-recurse ]; diff --git a/lib/dns/include/dns/rpz.h b/lib/dns/include/dns/rpz.h index cae90cbec9b..d61730566bf 100644 --- a/lib/dns/include/dns/rpz.h +++ b/lib/dns/include/dns/rpz.h @@ -173,6 +173,7 @@ struct dns_rpz_have { typedef struct dns_rpz_popt dns_rpz_popt_t; struct dns_rpz_popt { dns_rpz_zbits_t no_rd_ok; + dns_rpz_zbits_t no_log; isc_boolean_t break_dnssec; isc_boolean_t qname_wait_recurse; unsigned int min_ns_labels; diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c index a0acf0ae80e..ef110dd8039 100644 --- a/lib/isccfg/namedconf.c +++ b/lib/isccfg/namedconf.c @@ -1113,7 +1113,8 @@ static cfg_type_t cfg_type_masterstyle = { * response-policy { * zone [ policy (given|disabled|passthru|drop|tcp-only| * nxdomain|nodata|cname ) ] - * [ recursive-only yes|no ] [ max-policy-ttl number ] ; + * [ recursive-only yes|no ] [ log yes|no ] + * [ max-policy-ttl number ] ; * } [ recursive-only yes|no ] [ max-policy-ttl number ] * [ break-dnssec yes|no ] [ min-ns-dots number ] * [ qname-wait-recurse yes|no ] ; @@ -1303,6 +1304,7 @@ static cfg_tuplefielddef_t rpz_zone_fields[] = { { "zone name", &cfg_type_rpz_zone, 0 }, { "policy", &cfg_type_rpz_policy, 0 }, { "recursive-only", &cfg_type_boolean, 0 }, + { "log", &cfg_type_boolean, 0 }, { "max-policy-ttl", &cfg_type_uint32, 0 }, { NULL, NULL, 0 } };