Skip to content

Add response code REFUSED at Unbound blocklists #7530

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 7 commits into
base: master
Choose a base branch
from
Open

Add response code REFUSED at Unbound blocklists #7530

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
ce30f55
Update dnsbl_module.py
refuseduser Jun 15, 2024
9dc0833
Update blocklists.conf
refuseduser Jun 15, 2024
fe36df8
Update Unbound.xml
refuseduser Jun 15, 2024
89f1577
Update dnsbl.xml
refuseduser Jun 15, 2024
c9af424
Update blocklists.conf
refuseduser Jun 15, 2024
8efb5bf
Update src/opnsense/service/templates/OPNsense/Unbound/core/dnsbl_mod…
refuseduser Jul 8, 2024
d3f7e29
Update Unbound.xml
refuseduser Jul 8, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 10 additions & 8 deletions src/opnsense/mvc/app/controllers/OPNsense/Unbound/forms/dnsbl.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,21 +54,23 @@
be blocked. Blocking first-level domains is not supported.
</help>
</field>
<field>
<id>unbound.dnsbl.rcode</id>
<label>Return Response Code</label>
<type>dropdown</type>
<advanced>true</advanced>
<help>
Use the DNS response code for entries in the blocklist.
</help>
</field>
<field>
<id>unbound.dnsbl.address</id>
<label>Destination Address</label>
<type>text</type>
<advanced>true</advanced>
<help>
Destination ip address for entries in the blocklist (leave empty to use default: 0.0.0.0).
Not used when "Return NXDOMAIN" is checked.
Only used when "Return Response Code" is "A".
</help>
</field>
<field>
<id>unbound.dnsbl.nxdomain</id>
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this needs a model migration (https://docs.opnsense.org/development/frontend/models_migrations.html#migrations). If you need help with that, we have to postpone the merge for a while (when I have some time to test this myself).

<label>Return NXDOMAIN</label>
<type>checkbox</type>
<advanced>true</advanced>
<help>Use the DNS response code NXDOMAIN instead of a destination address.</help>
</field>
</form>
10 changes: 9 additions & 1 deletion src/opnsense/mvc/app/models/OPNsense/Unbound/Unbound.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -226,11 +226,19 @@
<ValidationMessage>A valid domain must be specified.</ValidationMessage>
<MaskPerItem>Y</MaskPerItem>
</wildcards>
<rcode type="OptionField">
<Default>NOERROR</Default>
<Required>Y</Required>
<OptionValues>
<REFUSED>REFUSED</REFUSED>
<NXDOMAIN>NXDOMAIN</NXDOMAIN>
<NOERROR>A</NOERROR>
</OptionValues>
</rcode>
<address type="NetworkField">
<NetMaskAllowed>N</NetMaskAllowed>
<AddressFamily>ipv4</AddressFamily>
</address>
<nxdomain type="BooleanField"/>
</dnsbl>
<forwarding>
<enabled type="BooleanField"/>
Expand Down
15 changes: 14 additions & 1 deletion src/opnsense/service/templates/OPNsense/Unbound/core/blocklists.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,10 @@
{%
set rcodes = {
"REFUSED": "REFUSED",
"NXDOMAIN": "NXDOMAIN",
"NOERROR": "NOERROR"
}
%}
{%
set predefined = {
"aa": "https://adaway.org/hosts.txt",
Expand Down Expand Up @@ -40,7 +47,13 @@
%}
{% if not helpers.empty('OPNsense.unboundplus.dnsbl.enabled') %}
[settings]
rcode={% if not helpers.empty('OPNsense.unboundplus.dnsbl.nxdomain') %}NXDOMAIN{%else%}NOERROR{%endif%}
{% if not helpers.empty('OPNsense.unboundplus.dnsbl.rcode') %}
{% if OPNsense.unboundplus.dnsbl.rcode in rcodes %}
rcode={{ rcodes[OPNsense.unboundplus.dnsbl.rcode] }}
{% endif%}
{% else %}
rcode={{ rcodes['REFUSED'] }}
{% endif%}

address={{OPNsense.unboundplus.dnsbl.address|default('0.0.0.0')}}

Expand Down
13 changes: 10 additions & 3 deletions src/opnsense/service/templates/OPNsense/Unbound/core/dnsbl_module.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,7 +57,9 @@
SOURCE_CACHE = 3

RCODE_NOERROR = 0
RCODE_SERVFAIL = 2
RCODE_NXDOMAIN = 3
RCODE_REFUSED = 5

def obj_path_exists(obj, path):
if obj and isinstance(path, str):
Expand Down Expand Up @@ -369,7 +371,12 @@ def set_config(self, config):
"""
self.config = config
self.dst_addr = self.config.get('dst_addr', '0.0.0.0')
self.rcode = RCODE_NXDOMAIN if self.config.get('rcode') == 'NXDOMAIN' else RCODE_NOERROR
if self.config.get('rcode') == 'NOERROR':
self.rcode = RCODE_NOERROR
elif self.config.get('rcode') == 'NXDOMAIN':
self.rcode = RCODE_NXDOMAIN
else:
self.rcode = RCODE_REFUSED

def time_diff_ms(start):
return round((time.time() - start) * 1000)
Expand Down Expand Up @@ -452,9 +459,9 @@ def set_answer_block(qstate, qdata, query, bl=None):
dnssec_status = sec_status_secure if ctx.dnssec_enabled else sec_status_unchecked
logger = mod_env['logger']

if ctx.rcode == RCODE_NXDOMAIN:
if ctx.rcode in [RCODE_NXDOMAIN, RCODE_REFUSED]:
# exit early
qstate.return_rcode = RCODE_NXDOMAIN
qstate.return_rcode = RCODE_REFUSED if ctx.rcode == RCODE_REFUSED else RCODE_NXDOMAIN
if logger.stats_enabled:
query.set_response(ACTION_BLOCK, SOURCE_LOCAL, bl, ctx.rcode,
time_diff_ms(qdata['start_time']), dnssec_status, 0)
Expand Down