diff --git a/dns/bind/Makefile b/dns/bind/Makefile index a209aa2a0..4a8dcea55 100644 --- a/dns/bind/Makefile +++ b/dns/bind/Makefile @@ -1,5 +1,5 @@ PLUGIN_NAME= bind -PLUGIN_VERSION= 0.5 +PLUGIN_VERSION= 0.6 PLUGIN_COMMENT= BIND domain name service PLUGIN_DEPENDS= bind913 PLUGIN_MAINTAINER= m.muenz@gmail.com diff --git a/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/forms/dnsbl.xml b/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/forms/dnsbl.xml index 669ed7bbb..76efd1f49 100644 --- a/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/forms/dnsbl.xml +++ b/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/forms/dnsbl.xml @@ -11,4 +11,12 @@ select_multiple Select which kind of DNSBL you want to use. + + dnsbl.whitelists + + select_multiple + + true + List of domains to whitelist. It will add a entry for the domains itself and all sub domains. + diff --git a/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/forms/general.xml b/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/forms/general.xml index 923e5c697..a1658cedb 100644 --- a/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/forms/general.xml +++ b/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/forms/general.xml @@ -41,4 +41,22 @@ text Set the amount how big a logfile can growth. + + general.maxcachesize + + text + How much memory in percent the cache can use from the system. Default is 80%. + + + general.recursion + + dropdown + Define an ACL where you allow which clients can resolve via this service. Usually use your local LAN. + + + general.dnssecvalidation + + dropdown + Default is "No". Set to "Auto" to use the static trust anchor configuration by the system. + diff --git a/dns/bind/src/opnsense/mvc/app/models/OPNsense/Bind/Dnsbl.xml b/dns/bind/src/opnsense/mvc/app/models/OPNsense/Bind/Dnsbl.xml index ef128262c..86e4fb58b 100644 --- a/dns/bind/src/opnsense/mvc/app/models/OPNsense/Bind/Dnsbl.xml +++ b/dns/bind/src/opnsense/mvc/app/models/OPNsense/Bind/Dnsbl.xml @@ -1,7 +1,7 @@ //OPNsense/bind/dnsbl DNSBL configuration - 1.0.0 + 1.0.1 0 @@ -19,5 +19,8 @@ Ransomware Tracker List + + N + diff --git a/dns/bind/src/opnsense/mvc/app/models/OPNsense/Bind/General.xml b/dns/bind/src/opnsense/mvc/app/models/OPNsense/Bind/General.xml index 450c2edbd..b131afb2b 100644 --- a/dns/bind/src/opnsense/mvc/app/models/OPNsense/Bind/General.xml +++ b/dns/bind/src/opnsense/mvc/app/models/OPNsense/Bind/General.xml @@ -1,7 +1,7 @@ //OPNsense/bind/general BIND configuration - 1.0.2 + 1.0.3 0 @@ -35,5 +35,33 @@ 1000 Choose a value between 1 and 1000. + + 80 + Y + 1 + 99 + Choose a value between 1 and 99. + + + + + + N + N + Choose an ACL. + + + + No + Auto + + no + N + Y + diff --git a/dns/bind/src/opnsense/scripts/OPNsense/Bind/dnsbl.sh b/dns/bind/src/opnsense/scripts/OPNsense/Bind/dnsbl.sh index 82e1d34cb..bed944deb 100755 --- a/dns/bind/src/opnsense/scripts/OPNsense/Bind/dnsbl.sh +++ b/dns/bind/src/opnsense/scripts/OPNsense/Bind/dnsbl.sh @@ -80,7 +80,7 @@ mwdomains() { install() { # Put all files in correct format for FILE in $(find ${WORKDIR} -type f); do - awk '{ print "zone " $1 " " $2 " {type master; file \"/usr/local/etc/namedb/master/blacklist.db\"; notify no; };" }' ${FILE} | sort -u > ${FILE}.inc + awk '{ if (length($1) < 245) print ""$1" CNAME .\n*."$1" CNAME ."}' ${FILE} | sort -u > ${FILE}.inc done # Merge resulting files (/dev/null in case there are none) cat $(find ${WORKDIR} -type f -name "*.inc") /dev/null | sort -u > ${DESTDIR}/dnsbl.inc diff --git a/dns/bind/src/opnsense/service/templates/OPNsense/Bind/+TARGETS b/dns/bind/src/opnsense/service/templates/OPNsense/Bind/+TARGETS index 78bda9d92..6a5f5601b 100644 --- a/dns/bind/src/opnsense/service/templates/OPNsense/Bind/+TARGETS +++ b/dns/bind/src/opnsense/service/templates/OPNsense/Bind/+TARGETS @@ -2,3 +2,4 @@ blacklist.db:/usr/local/etc/namedb/master/blacklist.db named:/etc/rc.conf.d/named named.conf:/usr/local/etc/namedb/named.conf rndc.conf:/usr/local/etc/namedb/rndc.conf +whitelist.inc:/usr/local/etc/namedb/whitelist.inc diff --git a/dns/bind/src/opnsense/service/templates/OPNsense/Bind/blacklist.db b/dns/bind/src/opnsense/service/templates/OPNsense/Bind/blacklist.db index 2503b6cbe..a83c511af 100644 --- a/dns/bind/src/opnsense/service/templates/OPNsense/Bind/blacklist.db +++ b/dns/bind/src/opnsense/service/templates/OPNsense/Bind/blacklist.db @@ -5,9 +5,6 @@ $TTL 86400 7200 864000 3600 ) - NS localhost. - NS localhost. - A 127.0.0.1 -@ IN A 127.0.0.1 -* IN A 127.0.0.1 -* IN AAAA ::1 +@ NS localhost. +$INCLUDE /usr/local/etc/namedb/whitelist.inc +$INCLUDE /usr/local/etc/namedb/dnsbl.inc diff --git a/dns/bind/src/opnsense/service/templates/OPNsense/Bind/named.conf b/dns/bind/src/opnsense/service/templates/OPNsense/Bind/named.conf index 299cf9a3d..e8de44ea7 100644 --- a/dns/bind/src/opnsense/service/templates/OPNsense/Bind/named.conf +++ b/dns/bind/src/opnsense/service/templates/OPNsense/Bind/named.conf @@ -26,6 +26,29 @@ options { forwarders { {{ OPNsense.bind.general.forwarders.replace(',', '; ') }}; }; {% endif %} +{% if helpers.exists('OPNsense.bind.dnsbl.enabled') and OPNsense.bind.dnsbl.enabled == '1' %} +{% if helpers.exists('OPNsense.bind.dnsbl.type') and OPNsense.bind.dnsbl.type != '' %} + response-policy { zone "blacklist.localdomain"; }; +{% endif %} +{% endif %} + +{% if helpers.exists('OPNsense.bind.general.recursion') and OPNsense.bind.general.recursion != '' %} +{% for list in helpers.toList('OPNsense.bind.general.recursion') %} +{% set recursionlist = helpers.getUUID(list) %} + recursion yes; + allow-recursion { {{ recursionlist.name }}; }; +{% endfor %} +{% endif %} + + +{% if helpers.exists('OPNsense.bind.general.maxcachesize') and OPNsense.bind.general.maxcachesize != '' %} + max-cache-size {{ OPNsense.bind.general.maxcachesize }}%; +{% endif %} + +{% if helpers.exists('OPNsense.bind.general.dnssecvalidation') and OPNsense.bind.general.dnssecvalidation != '' %} + dnssec-validation {{ OPNsense.bind.general.dnssecvalidation }}; +{% endif %} + }; key "rndc-key" { @@ -45,7 +68,7 @@ zone "0.ip6.arpa" { type master; file "/usr/local/etc/namedb/master/localh {% if helpers.exists('OPNsense.bind.dnsbl.enabled') and OPNsense.bind.dnsbl.enabled == '1' %} {% if helpers.exists('OPNsense.bind.dnsbl.type') and OPNsense.bind.dnsbl.type != '' %} -include "/usr/local/etc/namedb/dnsbl.inc"; +zone "blacklist.localdomain" { type master; file "/usr/local/etc/namedb/master/blacklist.db"; notify no; check-names ignore; }; {% endif %} {% endif %} diff --git a/dns/bind/src/opnsense/service/templates/OPNsense/Bind/whitelist.inc b/dns/bind/src/opnsense/service/templates/OPNsense/Bind/whitelist.inc new file mode 100644 index 000000000..67575309f --- /dev/null +++ b/dns/bind/src/opnsense/service/templates/OPNsense/Bind/whitelist.inc @@ -0,0 +1,12 @@ +{% if helpers.exists('OPNsense.bind.general.enabled') and OPNsense.bind.general.enabled == '1' %} +{% if helpers.exists('OPNsense.bind.dnsbl.enabled') and OPNsense.bind.dnsbl.enabled == '1' %} +{% if helpers.exists('OPNsense.bind.dnsbl.type') and OPNsense.bind.dnsbl.type != '' %} +{% if helpers.exists('OPNsense.bind.dnsbl.whitelists') and OPNsense.bind.dnsbl.whitelists != '' %} +{% for whitelist in OPNsense.bind.dnsbl.whitelists.split(',') %} +{{ whitelist }} IN CNAME rpz-passthru. +*.{{ whitelist }} IN CNAME rpz-passthru. +{% endfor %} +{% endif %} +{% endif %} +{% endif %} +{% endif %}