dns/bind: add dnsbl (#741)

dns/bind/Makefile

@@ -1,5 +1,5 @@
 PLUGIN_NAME=		bind
-PLUGIN_VERSION=		0.1
+PLUGIN_VERSION=		0.3
 PLUGIN_COMMENT=		BIND domain name service
 PLUGIN_DEPENDS=		bind913
 PLUGIN_MAINTAINER=	m.muenz@gmail.com

dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/Api/DnsblController.php

@@ -0,0 +1,39 @@
+<?php
+
+/**
+ *    Copyright (C) 2018 Michael Muenz
+ *
+ *    All rights reserved.
+ *
+ *    Redistribution and use in source and binary forms, with or without
+ *    modification, are permitted provided that the following conditions are met:
+ *
+ *    1. Redistributions of source code must retain the above copyright notice,
+ *       this list of conditions and the following disclaimer.
+ *
+ *    2. Redistributions in binary form must reproduce the above copyright
+ *       notice, this list of conditions and the following disclaimer in the
+ *       documentation and/or other materials provided with the distribution.
+ *
+ *    THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ *    INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+ *    AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ *    AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ *    OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ *    SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ *    INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ *    CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ *    ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ *    POSSIBILITY OF SUCH DAMAGE.
+ *
+ */
+
+namespace OPNsense\Bind\Api;
+
+use OPNsense\Base\ApiMutableModelControllerBase;
+
+class DnsblController extends ApiMutableModelControllerBase
+{
+    static protected $internalModelClass = '\OPNsense\Bind\Dnsbl';
+    static protected $internalModelName = 'dnsbl';
+}

dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/Api/ServiceController.php

@@ -33,6 +33,7 @@ namespace OPNsense\Bind\Api;
 use OPNsense\Base\ApiMutableServiceControllerBase;
 use OPNsense\Core\Backend;
 use OPNsense\Bind\General;
+use OPNsense\Bind\Dnsbl;
 
 /**
  * Class ServiceController
@@ -44,4 +45,16 @@ class ServiceController extends ApiMutableServiceControllerBase
     static protected $internalServiceTemplate = 'OPNsense/Bind';
     static protected $internalServiceEnabled = 'enabled';
     static protected $internalServiceName = 'bind';
+
+    public function dnsblAction()
+    {
+        $this->sessionClose();
+        $mdl = new Dnsbl();
+        if (!empty((string)$mdl->type)) {
+            $list = (string)$mdl->type;
+        }
+        $backend = new Backend();
+        $response = $backend->configdpRun('bind dnsbl', $list);
+        return array("response" => $response);
+    }
 }

dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/GeneralController.php

@@ -33,6 +33,7 @@ class GeneralController extends \OPNsense\Base\IndexController
     public function indexAction()
     {
         $this->view->generalForm = $this->getForm("general");
+        $this->view->dnsblForm = $this->getForm("dnsbl");
         $this->view->formDialogEditBindAcl = $this->getForm("dialogEditBindAcl");
         $this->view->pick('OPNsense/Bind/general');
     }

dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/forms/dnsbl.xml

@@ -0,0 +1,14 @@
+<form>
+    <field>
+        <id>dnsbl.enabled</id>
+        <label>Enable DNSBL</label>
+        <type>checkbox</type>
+        <help>This will enable the use of DNS Blocklists for ADs, Malware, or both.</help>
+    </field>
+    <field>
+        <id>dnsbl.type</id>
+        <label>Type of DNSBL</label>
+        <type>dropdown</type>
+        <help>Select which kind of DNSBL you want to use.</help>
+    </field>
+</form>

dns/bind/src/opnsense/mvc/app/models/OPNsense/Bind/Dnsbl.php

@@ -0,0 +1,35 @@
+<?php
+
+/*
+    Copyright (C) 2018 Michael Muenz
+    All rights reserved.
+
+    Redistribution and use in source and binary forms, with or without
+    modification, are permitted provided that the following conditions are met:
+
+    1. Redistributions of source code must retain the above copyright notice,
+       this list of conditions and the following disclaimer.
+
+    2. Redistributions in binary form must reproduce the above copyright
+       notice, this list of conditions and the following disclaimer in the
+       documentation and/or other materials provided with the distribution.
+
+    THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+    INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+    AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+    AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+    OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+    SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+    INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+    CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+    ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+    POSSIBILITY OF SUCH DAMAGE.
+*/
+
+namespace OPNsense\Bind;
+
+use OPNsense\Base\BaseModel;
+
+class Dnsbl extends BaseModel
+{
+}

dns/bind/src/opnsense/mvc/app/models/OPNsense/Bind/Dnsbl.xml

@@ -0,0 +1,20 @@
+<model>
+    <mount>//OPNsense/bind/dnsbl</mount>
+    <description>DNSBL configuration</description>
+    <version>1.0.0</version>
+    <items>
+        <enabled type="BooleanField">
+            <default>0</default>
+            <Required>Y</Required>
+        </enabled>
+        <type type="OptionField">
+            <default>all</default>
+            <Required>N</Required>
+            <OptionValues>
+                <ad>ADWare Lists</ad>
+                <mw>Malware Lists</mw>
+                <all>All in one</all>
+            </OptionValues>
+        </type>
+    </items>
+</model>

dns/bind/src/opnsense/mvc/app/views/OPNsense/Bind/general.volt

@@ -30,6 +30,7 @@ POSSIBILITY OF SUCH DAMAGE.
 <!-- Navigation bar -->
 <ul class="nav nav-tabs" data-tabs="tabs" id="maintabs">
     <li class="active"><a data-toggle="tab" href="#general">{{ lang._('General') }}</a></li>
+    <li><a data-toggle="tab" href="#dnsbl">{{ lang._('DNSBL') }}</a></li>
     <li><a data-toggle="tab" href="#acls">{{ lang._('ACLs') }}</a></li>
 </ul>
 
@@ -43,6 +44,15 @@ POSSIBILITY OF SUCH DAMAGE.
             </div>
         </div>
     </div>
+    <div id="dnsbl" class="tab-pane fade in">
+        <div class="content-box" style="padding-bottom: 1.5em;">
+            {{ partial("layout_partials/base_form",['fields':dnsblForm,'id':'frm_dnsbl_settings'])}}
+            <div class="col-md-12">
+                <hr />
+                <button class="btn btn-primary"  id="saveAct_dnsbl" type="button"><b>{{ lang._('Save') }}</b><i id="saveAct_dnsbl_progress"></i></button>
+            </div>
+        </div>
+    </div>
     <div id="acls" class="tab-pane fade in">
         <table id="grid-acls" class="table table-responsive" data-editDialog="dialogEditBindAcl">
             <thead>
@@ -83,6 +93,12 @@ $( document ).ready(function() {
         $('.selectpicker').selectpicker('refresh');
     });
 
+    var data_get_map2 = {'frm_dnsbl_settings':"/api/bind/dnsbl/get"};
+    mapDataToFormUI(data_get_map2).done(function(data){
+        formatTokenizersUI();
+        $('.selectpicker').selectpicker('refresh');
+    });
+
     ajaxCall(url="/api/bind/service/status", sendData={}, callback=function(data,status) {
         updateServiceStatusUI(data['status']);
     });
@@ -109,6 +125,20 @@ $( document ).ready(function() {
         });
     });
 
+    $("#saveAct_dnsbl").click(function(){
+        saveFormToEndpoint(url="/api/bind/dnsbl/set", formid='frm_dnsbl_settings',callback_ok=function(){
+        $("#saveAct_acl_progress").addClass("fa fa-spinner fa-pulse");
+            ajaxCall(url="/api/bind/service/dnsbl", sendData={}, callback=function(data,status) {
+                ajaxCall(url="/api/bind/service/reconfigure", sendData={}, callback=function(data,status) {
+                    ajaxCall(url="/api/bind/service/status", sendData={}, callback=function(data,status) {
+                        updateServiceStatusUI(data['status']);
+                    });
+                    $("#saveAct_dnsbl_progress").removeClass("fa fa-spinner fa-pulse");
+                });
+            });
+        });
+    });    
+    
     $("#saveAct_acl").click(function(){
         saveFormToEndpoint(url="/api/bind/acl/set", formid='frm_general_settings',callback_ok=function(){
         $("#saveAct_acl_progress").addClass("fa fa-spinner fa-pulse");

dns/bind/src/opnsense/scripts/OPNsense/Bind/dnsbl.sh

@@ -0,0 +1,132 @@
+#!/bin/sh
+
+# Copyright (c) 2018 Michael Muenz <m.muenz@gmail.com>
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+#
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+#
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+# ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+# SUCH DAMAGE.
+
+SORT=/usr/bin/sort
+UNIQ=/usr/bin/uniq
+CD=/usr/bin/cd
+CAT=/bin/cat
+AWK=/usr/bin/awk
+FETCH="/usr/bin/fetch -qT 5"
+RM="/bin/rm -f"
+
+RAWDIR="/usr/local/etc/namedb/raw/"
+WORKDIR="/usr/local/etc/namedb/"
+
+/bin/mkdir -p $RAWDIR
+/usr/sbin/chown bind:bind $RAWDIR
+/bin/chmod -R 755 $RAWDIR
+
+
+# Download all lists:
+
+# EasyList:
+easylist() {
+$CD $RAWDIR
+${FETCH} https://justdomains.github.io/blocklists/lists/easylist-justdomains.txt -o easylist-raw
+sed "/\.$/d" easylist-raw > easylist
+${RM} easylist-raw
+}
+
+# EasyPrivacy:
+easyprivacy() {
+$CD $RAWDIR
+${FETCH} https://justdomains.github.io/blocklists/lists/easyprivacy-justdomains.txt -o easyprivacy-raw
+sed "/\.$/d" easyprivacy-raw > easyprivacy
+${RM} easyprivacy-raw
+}
+
+# AdGuard:
+adguard() {
+$CD $RAWDIR
+${FETCH} https://justdomains.github.io/blocklists/lists/adguarddns-justdomains.txt -o adguard-raw
+sed "/\.$/d" adguard-raw > adguard
+${RM} adguard-raw
+}
+
+# NoCoin:
+nocoin() {
+$CD $RAWDIR
+${FETCH} https://justdomains.github.io/blocklists/lists/nocoin-justdomains.txt -o nocoin
+}
+
+# RansomWare Tracker abuse.ch:
+rwtracker() {
+$CD $RAWDIR
+${FETCH} https://ransomwaretracker.abuse.ch/downloads/RW_DOMBL.txt -o rwtracker-comments
+sed '/^#/ d' rwtracker-comments > rwtracker
+${RM} rwtracker-comments
+}
+
+# MalwareDomains:
+mwdomains() {
+$CD $RAWDIR
+${FETCH} http://malwaredomains.lehigh.edu/files/justdomains -o malwaredomains-comments
+sed '/^#/ d' malwaredomains-comments > malwaredomains
+${RM} malwaredomains-comments
+}
+
+# Put all files in correct format
+convert() {
+$CD $RAWDIR
+FILES=`ls -1`
+
+for i in $FILES; do
+  $AWK '{ print "zone " $1 " " $2 " {type master; file \"/usr/local/etc/namedb/master/blacklist.db\"; };" }' $i | $SORT | $UNIQ > $WORKDIR/$i.inc
+done
+}
+
+# Depending on the options
+RETVAL=0
+case "$1" in
+   "")
+      echo "Usage: $0 ad|mw|all"
+      RETVAL=1
+      ;;
+   ad)
+      easylist
+      easyprivacy
+      nocoin
+      convert
+      $CAT $WORKDIR/easylist.inc $WORKDIR/easyprivacy.inc $WORKDIR/adguard.inc | $SORT | $UNIQ > $WORKDIR/all.inc
+      ;;
+   mw)
+      rwtracker
+      mwdomains
+      convert
+      $CAT $WORKDIR/nocoin.inc $WORKDIR/rwtracker.inc $WORKDIR/malwaredomains.inc | $SORT | $UNIQ > $WORKDIR/all.inc
+      ;;
+   all)
+      easylist
+      easyprivacy
+      nocoin
+      rwtracker
+      mwdomains
+      convert
+      $CAT $WORKDIR/easylist.inc $WORKDIR/easyprivacy.inc $WORKDIR/adguard.inc $WORKDIR/nocoin.inc $WORKDIR/rwtracker.inc $WORKDIR/malwaredomains.inc | $SORT | $UNIQ > $WORKDIR/all.inc
+      ;;
+esac
+exit $RETVAL

dns/bind/src/opnsense/service/conf/actions.d/actions_bind.conf

@@ -21,3 +21,9 @@ command:/usr/local/etc/rc.d/named status;exit 0
 parameters:
 type:script_output
 message:request BIND status
+
+[dnsbl]
+command:/usr/local/opnsense/scripts/OPNsense/Bind/dnsbl.sh
+parameters: %s
+type:script
+message:fetching DNSBLs

dns/bind/src/opnsense/service/templates/OPNsense/Bind/named.conf

@@ -15,12 +15,12 @@ options {
         dump-file       "/var/dump/named_dump.db";
         statistics-file "/var/stats/named.stats";
 
-{% if helpers.exists('OPNsense.bind.general.listenv4') and OPNsense.bind.general.listenv4 != '' %}
-        listen-on       { {{ OPNsense.bind.general.listenv4.replace(',', '; ') }}; };
-{% endif %}
-{% if helpers.exists('OPNsense.bind.general.listenv6') and OPNsense.bind.general.listenv6 != '' %}
-        listen-on-v6    { {{ OPNsense.bind.general.listenv6.replace(',', '; ') }}; };
-{% endif %}
+{% if helpers.exists('OPNsense.bind.general.listenv4') and OPNsense.bind.general.listenv4 != '' %} {% if helpers.exists('OPNsense.bind.general.port') and OPNsense.bind.general.port != '' %}
+        listen-on port {{ OPNsense.bind.general.port }} { {{ OPNsense.bind.general.listenv4.replace(',', '; ') }}; };
+{% endif %}{% endif %}
+{% if helpers.exists('OPNsense.bind.general.listenv6') and OPNsense.bind.general.listenv6 != '' %} {% if helpers.exists('OPNsense.bind.general.port') and OPNsense.bind.general.port != '' %}
+        listen-on-v6 port {{ OPNsense.bind.general.port }} { {{ OPNsense.bind.general.listenv6.replace(',', '; ') }}; };
+{% endif %}{% endif %}
 
 {% if helpers.exists('OPNsense.bind.general.forwarders') and OPNsense.bind.general.forwarders != '' %}
         forwarders    { {{ OPNsense.bind.general.forwarders.replace(',', '; ') }}; };
@@ -34,4 +34,10 @@ zone "localhost"        { type master; file "/usr/local/etc/namedb/master/localh
 zone "127.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/localhost-reverse.db"; };
 zone "0.ip6.arpa"       { type master; file "/usr/local/etc/namedb/master/localhost-reverse.db"; };
 
+{% if helpers.exists('OPNsense.bind.dnsbl.enabled') and OPNsense.bind.dnsbl.enabled == '1' %}
+{%   if helpers.exists('OPNsense.bind.dnsbl.type') and OPNsense.bind.dnsbl.type != '' %}
+include "/usr/local/etc/namedb/all.inc";
+{%   endif %}
+{% endif %}
+
 {% endif %}