netbird/plugins
0
0
Fork 0
mirror of https://github.com/netbirdio/plugins.git synced 2026-05-22 18:44:07 -07:00
Code Issues Packages Projects Releases Wiki Activity

dns/bind: change dnsbl to RPZ, add allow-recursion and dnssec (#760)

Browse Source
This commit is contained in:
Michael
2018-07-26 19:43:42 +02:00
committed by Franco Fichtner
parent 57611d73b8
commit 749486315f
10 changed files with 101 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/forms/dnsbl.xml
+8
View File
@@ -11,4 +11,12 @@
<type>select_multiple</type>
<help>Select which kind of DNSBL you want to use.</help>
</field>
<field>
<id>dnsbl.whitelists</id>
<label>Whitelist Domains</label>
<type>select_multiple</type>
<style>tokenize</style>
<allownew>true</allownew>
<help>List of domains to whitelist. It will add a entry for the domains itself and all sub domains.</help>
</field>
</form>
dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/forms/general.xml
+18
View File
@@ -41,4 +41,22 @@
<type>text</type>
<help>Set the amount how big a logfile can growth.</help>
</field>
<field>
<id>general.maxcachesize</id>
<label>Maximum Cache Size</label>
<type>text</type>
<help>How much memory in percent the cache can use from the system. Default is 80%.</help>
</field>
<field>
<id>general.recursion</id>
<label>Recursion</label>
<type>dropdown</type>
<help>Define an ACL where you allow which clients can resolve via this service. Usually use your local LAN.</help>
</field>
<field>
<id>general.dnssecvalidation</id>
<label>DNSSEC Validation</label>
<type>dropdown</type>
<help>Default is "No". Set to "Auto" to use the static trust anchor configuration by the system.</help>
</field>
</form>
dns/bind/src/opnsense/mvc/app/models/OPNsense/Bind/Dnsbl.xml
+4 -1
View File
@@ -1,7 +1,7 @@
<model>
<mount>//OPNsense/bind/dnsbl</mount>
<description>DNSBL configuration</description>
<version>1.0.0</version>
<version>1.0.1</version>
<items>
<enabled type="BooleanField">
<default>0</default>
@@ -19,5 +19,8 @@
<rw>Ransomware Tracker List</rw>
</OptionValues>
</type>
<whitelists type="CSVListField">
<Required>N</Required>
</whitelists>
</items>
</model>
dns/bind/src/opnsense/mvc/app/models/OPNsense/Bind/General.xml
+29 -1
View File
@@ -1,7 +1,7 @@
<model>
<mount>//OPNsense/bind/general</mount>
<description>BIND configuration</description>
<version>1.0.2</version>
<version>1.0.3</version>
<items>
<enabled type="BooleanField">
<default>0</default>
@@ -35,5 +35,33 @@
<MaximumValue>1000</MaximumValue>
<ValidationMessage>Choose a value between 1 and 1000.</ValidationMessage>
</logsize>
<maxcachesize type="IntegerField">
<default>80</default>
<Required>Y</Required>
<MinimumValue>1</MinimumValue>
<MaximumValue>99</MaximumValue>
<ValidationMessage>Choose a value between 1 and 99.</ValidationMessage>
</maxcachesize>
<recursion type="ModelRelationField">
<Model>
<template>
<source>OPNsense.Bind.Acl</source>
<items>acls.acl</items>
<display>name</display>
</template>
</Model>
<Multiple>N</Multiple>
<Required>N</Required>
<ValidationMessage>Choose an ACL.</ValidationMessage>
</recursion>
<dnssecvalidation type="OptionField">
<OptionValues>
<no>No</no>
<auto>Auto</auto>
</OptionValues>
<default>no</default>
<Multiple>N</Multiple>
<Required>Y</Required>
</dnssecvalidation>
</items>
</model>
dns/bind/src/opnsense/scripts/OPNsense/Bind/dnsbl.sh
+1 -1
View File
@@ -80,7 +80,7 @@ mwdomains() {
install() {
# Put all files in correct format
for FILE in $(find ${WORKDIR} -type f); do
awk '{ print "zone " $1 " " $2 " {type master; file \"/usr/local/etc/namedb/master/blacklist.db\"; notify no; };" }' ${FILE} | sort -u > ${FILE}.inc
awk '{ if (length($1) < 245) print ""$1" CNAME .\n*."$1" CNAME ."}' ${FILE} | sort -u > ${FILE}.inc
done
# Merge resulting files (/dev/null in case there are none)
cat $(find ${WORKDIR} -type f -name "*.inc") /dev/null | sort -u > ${DESTDIR}/dnsbl.inc
dns/bind/src/opnsense/service/templates/OPNsense/Bind/+TARGETS
+1
View File
@@ -2,3 +2,4 @@ blacklist.db:/usr/local/etc/namedb/master/blacklist.db
named:/etc/rc.conf.d/named
named.conf:/usr/local/etc/namedb/named.conf
rndc.conf:/usr/local/etc/namedb/rndc.conf
whitelist.inc:/usr/local/etc/namedb/whitelist.inc
dns/bind/src/opnsense/service/templates/OPNsense/Bind/blacklist.db
+3 -6
View File
@@ -5,9 +5,6 @@ $TTL 86400
7200
864000
3600 )
NS localhost.
NS localhost.
A 127.0.0.1
@ IN A 127.0.0.1
* IN A 127.0.0.1
* IN AAAA ::1
@ NS localhost.
$INCLUDE /usr/local/etc/namedb/whitelist.inc
$INCLUDE /usr/local/etc/namedb/dnsbl.inc
dns/bind/src/opnsense/service/templates/OPNsense/Bind/named.conf
+24 -1
View File
@@ -26,6 +26,29 @@ options {
forwarders { {{ OPNsense.bind.general.forwarders.replace(',', '; ') }}; };
{% endif %}
{% if helpers.exists('OPNsense.bind.dnsbl.enabled') and OPNsense.bind.dnsbl.enabled == '1' %}
{% if helpers.exists('OPNsense.bind.dnsbl.type') and OPNsense.bind.dnsbl.type != '' %}
response-policy { zone "blacklist.localdomain"; };
{% endif %}
{% endif %}
{% if helpers.exists('OPNsense.bind.general.recursion') and OPNsense.bind.general.recursion != '' %}
{% for list in helpers.toList('OPNsense.bind.general.recursion') %}
{% set recursionlist = helpers.getUUID(list) %}
recursion yes;
allow-recursion { {{ recursionlist.name }}; };
{% endfor %}
{% endif %}
{% if helpers.exists('OPNsense.bind.general.maxcachesize') and OPNsense.bind.general.maxcachesize != '' %}
max-cache-size {{ OPNsense.bind.general.maxcachesize }}%;
{% endif %}
{% if helpers.exists('OPNsense.bind.general.dnssecvalidation') and OPNsense.bind.general.dnssecvalidation != '' %}
dnssec-validation {{ OPNsense.bind.general.dnssecvalidation }};
{% endif %}
};
key "rndc-key" {
@@ -45,7 +68,7 @@ zone "0.ip6.arpa" { type master; file "/usr/local/etc/namedb/master/localh
{% if helpers.exists('OPNsense.bind.dnsbl.enabled') and OPNsense.bind.dnsbl.enabled == '1' %}
{% if helpers.exists('OPNsense.bind.dnsbl.type') and OPNsense.bind.dnsbl.type != '' %}
include "/usr/local/etc/namedb/dnsbl.inc";
zone "blacklist.localdomain" { type master; file "/usr/local/etc/namedb/master/blacklist.db"; notify no; check-names ignore; };
{% endif %}
{% endif %}
dns/bind/src/opnsense/service/templates/OPNsense/Bind/whitelist.inc
+12
View File
@@ -0,0 +1,12 @@
{% if helpers.exists('OPNsense.bind.general.enabled') and OPNsense.bind.general.enabled == '1' %}
{% if helpers.exists('OPNsense.bind.dnsbl.enabled') and OPNsense.bind.dnsbl.enabled == '1' %}
{% if helpers.exists('OPNsense.bind.dnsbl.type') and OPNsense.bind.dnsbl.type != '' %}
{% if helpers.exists('OPNsense.bind.dnsbl.whitelists') and OPNsense.bind.dnsbl.whitelists != '' %}
{% for whitelist in OPNsense.bind.dnsbl.whitelists.split(',') %}
{{ whitelist }} IN CNAME rpz-passthru.
*.{{ whitelist }} IN CNAME rpz-passthru.
{% endfor %}
{% endif %}
{% endif %}
{% endif %}
{% endif %}