FastRPZ

FastRPZ is a software package that handles the rpz publish/subscribe functions and offers a fast shared-memory semi-portable API to the local name server to provide response policy support.

FastRPZ consists of the librpz library used by resolvers, the dnsrpzd daemon, and the utility program, rpztool. The primary connection among them is a shared, memory mapped file or special purpose database that contains response policy zone triggers and actions. The file is persistent and generally does not need to be rebuilt when the daemon restarts.

Features

• Adds RPZ capability to the Unbound recursive resolver.
• Improves the BIND9 RPZ implementation including:

• Hundreds of resolvers or BIND9 views can concurrently search the shared database using librpz without blocking or interference from each other or the dnsrpzd daemon using a patented (US 9,264,399) non-blocking mechanism. Each resolver or BIND9 view is configured to search an independent selection of policy zones selected from the up to 1600 zones maintained in the database by dnsrpzd.
• The FastRPZ limit of 192 policy zones per view is greater than the classic limit of 64.
• Individual resolvers or BIND9 views using FastRPZ can instantly change their selected sets of policy zones and the daemon rpzd can instantly add or remove zones from the database without stopping or interfering with other resolvers or views without the global stalling seen with classic BIND RPZ.
• The memory required for policy zones is shared. 100 BIND9 views using FastRPZ do not need 100 copies of the same 500 MByte (parsed) policy zone.
• Restarting either the resolver or the FastRPZ daemon does not require reloading any DNS zones. Instead, the persistent database file is mapped into the resolver's or the daemon's memory. This is significant as reloading BIND with large zones can interrupt resolution for multi-second outages.