diff --git a/dns/bind/Makefile b/dns/bind/Makefile index 54ccdddfb..6fd58b9b5 100644 --- a/dns/bind/Makefile +++ b/dns/bind/Makefile @@ -1,5 +1,5 @@ PLUGIN_NAME= bind -PLUGIN_VERSION= 0.1 +PLUGIN_VERSION= 0.3 PLUGIN_COMMENT= BIND domain name service PLUGIN_DEPENDS= bind913 PLUGIN_MAINTAINER= m.muenz@gmail.com diff --git a/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/Api/DnsblController.php b/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/Api/DnsblController.php new file mode 100644 index 000000000..63323fcc9 --- /dev/null +++ b/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/Api/DnsblController.php @@ -0,0 +1,39 @@ +sessionClose(); + $mdl = new Dnsbl(); + if (!empty((string)$mdl->type)) { + $list = (string)$mdl->type; + } + $backend = new Backend(); + $response = $backend->configdpRun('bind dnsbl', $list); + return array("response" => $response); + } } diff --git a/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/GeneralController.php b/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/GeneralController.php index 1ce4029f9..9ec953086 100644 --- a/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/GeneralController.php +++ b/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/GeneralController.php @@ -33,6 +33,7 @@ class GeneralController extends \OPNsense\Base\IndexController public function indexAction() { $this->view->generalForm = $this->getForm("general"); + $this->view->dnsblForm = $this->getForm("dnsbl"); $this->view->formDialogEditBindAcl = $this->getForm("dialogEditBindAcl"); $this->view->pick('OPNsense/Bind/general'); } diff --git a/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/forms/dnsbl.xml b/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/forms/dnsbl.xml new file mode 100644 index 000000000..95b40cc7e --- /dev/null +++ b/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/forms/dnsbl.xml @@ -0,0 +1,14 @@ +
+ + dnsbl.enabled + + checkbox + This will enable the use of DNS Blocklists for ADs, Malware, or both. + + + dnsbl.type + + dropdown + Select which kind of DNSBL you want to use. + +
diff --git a/dns/bind/src/opnsense/mvc/app/models/OPNsense/Bind/Dnsbl.php b/dns/bind/src/opnsense/mvc/app/models/OPNsense/Bind/Dnsbl.php new file mode 100644 index 000000000..59afb7e55 --- /dev/null +++ b/dns/bind/src/opnsense/mvc/app/models/OPNsense/Bind/Dnsbl.php @@ -0,0 +1,35 @@ + + //OPNsense/bind/dnsbl + DNSBL configuration + 1.0.0 + + + 0 + Y + + + all + N + + ADWare Lists + Malware Lists + All in one + + + + diff --git a/dns/bind/src/opnsense/mvc/app/views/OPNsense/Bind/general.volt b/dns/bind/src/opnsense/mvc/app/views/OPNsense/Bind/general.volt index b855958ac..cf53da7e2 100644 --- a/dns/bind/src/opnsense/mvc/app/views/OPNsense/Bind/general.volt +++ b/dns/bind/src/opnsense/mvc/app/views/OPNsense/Bind/general.volt @@ -30,6 +30,7 @@ POSSIBILITY OF SUCH DAMAGE. @@ -43,6 +44,15 @@ POSSIBILITY OF SUCH DAMAGE. +
+
+ {{ partial("layout_partials/base_form",['fields':dnsblForm,'id':'frm_dnsbl_settings'])}} +
+
+ +
+
+
@@ -83,6 +93,12 @@ $( document ).ready(function() { $('.selectpicker').selectpicker('refresh'); }); + var data_get_map2 = {'frm_dnsbl_settings':"/api/bind/dnsbl/get"}; + mapDataToFormUI(data_get_map2).done(function(data){ + formatTokenizersUI(); + $('.selectpicker').selectpicker('refresh'); + }); + ajaxCall(url="/api/bind/service/status", sendData={}, callback=function(data,status) { updateServiceStatusUI(data['status']); }); @@ -109,6 +125,20 @@ $( document ).ready(function() { }); }); + $("#saveAct_dnsbl").click(function(){ + saveFormToEndpoint(url="/api/bind/dnsbl/set", formid='frm_dnsbl_settings',callback_ok=function(){ + $("#saveAct_acl_progress").addClass("fa fa-spinner fa-pulse"); + ajaxCall(url="/api/bind/service/dnsbl", sendData={}, callback=function(data,status) { + ajaxCall(url="/api/bind/service/reconfigure", sendData={}, callback=function(data,status) { + ajaxCall(url="/api/bind/service/status", sendData={}, callback=function(data,status) { + updateServiceStatusUI(data['status']); + }); + $("#saveAct_dnsbl_progress").removeClass("fa fa-spinner fa-pulse"); + }); + }); + }); + }); + $("#saveAct_acl").click(function(){ saveFormToEndpoint(url="/api/bind/acl/set", formid='frm_general_settings',callback_ok=function(){ $("#saveAct_acl_progress").addClass("fa fa-spinner fa-pulse"); diff --git a/dns/bind/src/opnsense/scripts/OPNsense/Bind/dnsbl.sh b/dns/bind/src/opnsense/scripts/OPNsense/Bind/dnsbl.sh new file mode 100644 index 000000000..f099e2933 --- /dev/null +++ b/dns/bind/src/opnsense/scripts/OPNsense/Bind/dnsbl.sh @@ -0,0 +1,132 @@ +#!/bin/sh + +# Copyright (c) 2018 Michael Muenz +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions +# are met: +# +# 1. Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# +# 2. Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in the +# documentation and/or other materials provided with the distribution. +# +# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND +# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE +# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE +# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS +# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) +# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT +# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY +# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF +# SUCH DAMAGE. + +SORT=/usr/bin/sort +UNIQ=/usr/bin/uniq +CD=/usr/bin/cd +CAT=/bin/cat +AWK=/usr/bin/awk +FETCH="/usr/bin/fetch -qT 5" +RM="/bin/rm -f" + +RAWDIR="/usr/local/etc/namedb/raw/" +WORKDIR="/usr/local/etc/namedb/" + +/bin/mkdir -p $RAWDIR +/usr/sbin/chown bind:bind $RAWDIR +/bin/chmod -R 755 $RAWDIR + + +# Download all lists: + +# EasyList: +easylist() { +$CD $RAWDIR +${FETCH} https://justdomains.github.io/blocklists/lists/easylist-justdomains.txt -o easylist-raw +sed "/\.$/d" easylist-raw > easylist +${RM} easylist-raw +} + +# EasyPrivacy: +easyprivacy() { +$CD $RAWDIR +${FETCH} https://justdomains.github.io/blocklists/lists/easyprivacy-justdomains.txt -o easyprivacy-raw +sed "/\.$/d" easyprivacy-raw > easyprivacy +${RM} easyprivacy-raw +} + +# AdGuard: +adguard() { +$CD $RAWDIR +${FETCH} https://justdomains.github.io/blocklists/lists/adguarddns-justdomains.txt -o adguard-raw +sed "/\.$/d" adguard-raw > adguard +${RM} adguard-raw +} + +# NoCoin: +nocoin() { +$CD $RAWDIR +${FETCH} https://justdomains.github.io/blocklists/lists/nocoin-justdomains.txt -o nocoin +} + +# RansomWare Tracker abuse.ch: +rwtracker() { +$CD $RAWDIR +${FETCH} https://ransomwaretracker.abuse.ch/downloads/RW_DOMBL.txt -o rwtracker-comments +sed '/^#/ d' rwtracker-comments > rwtracker +${RM} rwtracker-comments +} + +# MalwareDomains: +mwdomains() { +$CD $RAWDIR +${FETCH} http://malwaredomains.lehigh.edu/files/justdomains -o malwaredomains-comments +sed '/^#/ d' malwaredomains-comments > malwaredomains +${RM} malwaredomains-comments +} + +# Put all files in correct format +convert() { +$CD $RAWDIR +FILES=`ls -1` + +for i in $FILES; do + $AWK '{ print "zone " $1 " " $2 " {type master; file \"/usr/local/etc/namedb/master/blacklist.db\"; };" }' $i | $SORT | $UNIQ > $WORKDIR/$i.inc +done +} + +# Depending on the options +RETVAL=0 +case "$1" in + "") + echo "Usage: $0 ad|mw|all" + RETVAL=1 + ;; + ad) + easylist + easyprivacy + nocoin + convert + $CAT $WORKDIR/easylist.inc $WORKDIR/easyprivacy.inc $WORKDIR/adguard.inc | $SORT | $UNIQ > $WORKDIR/all.inc + ;; + mw) + rwtracker + mwdomains + convert + $CAT $WORKDIR/nocoin.inc $WORKDIR/rwtracker.inc $WORKDIR/malwaredomains.inc | $SORT | $UNIQ > $WORKDIR/all.inc + ;; + all) + easylist + easyprivacy + nocoin + rwtracker + mwdomains + convert + $CAT $WORKDIR/easylist.inc $WORKDIR/easyprivacy.inc $WORKDIR/adguard.inc $WORKDIR/nocoin.inc $WORKDIR/rwtracker.inc $WORKDIR/malwaredomains.inc | $SORT | $UNIQ > $WORKDIR/all.inc + ;; +esac +exit $RETVAL diff --git a/dns/bind/src/opnsense/service/conf/actions.d/actions_bind.conf b/dns/bind/src/opnsense/service/conf/actions.d/actions_bind.conf index 09902392f..e3b79887c 100644 --- a/dns/bind/src/opnsense/service/conf/actions.d/actions_bind.conf +++ b/dns/bind/src/opnsense/service/conf/actions.d/actions_bind.conf @@ -21,3 +21,9 @@ command:/usr/local/etc/rc.d/named status;exit 0 parameters: type:script_output message:request BIND status + +[dnsbl] +command:/usr/local/opnsense/scripts/OPNsense/Bind/dnsbl.sh +parameters: %s +type:script +message:fetching DNSBLs diff --git a/dns/bind/src/opnsense/service/templates/OPNsense/Bind/named.conf b/dns/bind/src/opnsense/service/templates/OPNsense/Bind/named.conf index 32098723f..29cf1244c 100644 --- a/dns/bind/src/opnsense/service/templates/OPNsense/Bind/named.conf +++ b/dns/bind/src/opnsense/service/templates/OPNsense/Bind/named.conf @@ -15,12 +15,12 @@ options { dump-file "/var/dump/named_dump.db"; statistics-file "/var/stats/named.stats"; -{% if helpers.exists('OPNsense.bind.general.listenv4') and OPNsense.bind.general.listenv4 != '' %} - listen-on { {{ OPNsense.bind.general.listenv4.replace(',', '; ') }}; }; -{% endif %} -{% if helpers.exists('OPNsense.bind.general.listenv6') and OPNsense.bind.general.listenv6 != '' %} - listen-on-v6 { {{ OPNsense.bind.general.listenv6.replace(',', '; ') }}; }; -{% endif %} +{% if helpers.exists('OPNsense.bind.general.listenv4') and OPNsense.bind.general.listenv4 != '' %} {% if helpers.exists('OPNsense.bind.general.port') and OPNsense.bind.general.port != '' %} + listen-on port {{ OPNsense.bind.general.port }} { {{ OPNsense.bind.general.listenv4.replace(',', '; ') }}; }; +{% endif %}{% endif %} +{% if helpers.exists('OPNsense.bind.general.listenv6') and OPNsense.bind.general.listenv6 != '' %} {% if helpers.exists('OPNsense.bind.general.port') and OPNsense.bind.general.port != '' %} + listen-on-v6 port {{ OPNsense.bind.general.port }} { {{ OPNsense.bind.general.listenv6.replace(',', '; ') }}; }; +{% endif %}{% endif %} {% if helpers.exists('OPNsense.bind.general.forwarders') and OPNsense.bind.general.forwarders != '' %} forwarders { {{ OPNsense.bind.general.forwarders.replace(',', '; ') }}; }; @@ -34,4 +34,10 @@ zone "localhost" { type master; file "/usr/local/etc/namedb/master/localh zone "127.in-addr.arpa" { type master; file "/usr/local/etc/namedb/master/localhost-reverse.db"; }; zone "0.ip6.arpa" { type master; file "/usr/local/etc/namedb/master/localhost-reverse.db"; }; +{% if helpers.exists('OPNsense.bind.dnsbl.enabled') and OPNsense.bind.dnsbl.enabled == '1' %} +{% if helpers.exists('OPNsense.bind.dnsbl.type') and OPNsense.bind.dnsbl.type != '' %} +include "/usr/local/etc/namedb/all.inc"; +{% endif %} +{% endif %} + {% endif %}