dnsbl: per-zone name/action/duration/reason with %ip%; XLINE notice shows duration + absolute expiry
This commit is contained in:
parent
1824af5d90
commit
b693c5e5df
6 changed files with 309 additions and 37 deletions
|
|
@ -17,6 +17,89 @@ use crate::server::Server;
|
|||
use crate::xline::XKind;
|
||||
use crate::Uid;
|
||||
|
||||
/// One configured DNS blocklist. The resolver worker only needs `domain` (the zone
|
||||
/// it reverses the client IP under); the rest shape what happens on a hit and are
|
||||
/// looked up on the core thread. Unset per-zone fields fall back to the global
|
||||
/// `dnsbl_action` / `dnsbl_reason` / `dnsbl_duration`.
|
||||
#[derive(Clone, Debug)]
|
||||
pub struct DnsblZone {
|
||||
pub domain: String, // DNS zone queried (e.g. torexit.dan.me.uk)
|
||||
pub name: String, // friendly label shown in the hit notice
|
||||
pub action: Option<String>, // per-zone action override (mark/kill/kline/gline/zline)
|
||||
pub duration: Option<u64>, // per-zone ban duration override (seconds)
|
||||
pub reason: Option<String>, // per-zone ban reason (supports %ip%)
|
||||
}
|
||||
|
||||
/// Parse one `dnsbl = …` config value. Two forms:
|
||||
/// * bare zone — `dnsbl = torexit.dan.me.uk` (uses the global action/reason)
|
||||
/// * attributes — `dnsbl = domain=torexit.dan.me.uk name="Tor exit node"
|
||||
/// action=zline duration=1w reason="… %ip% …"` (values may be "quoted")
|
||||
pub fn parse_zone(value: &str) -> Option<DnsblZone> {
|
||||
let value = value.trim();
|
||||
let first = value.split_whitespace().next().unwrap_or("");
|
||||
if first.is_empty() {
|
||||
return None;
|
||||
}
|
||||
if !first.contains('=') {
|
||||
let domain = first.trim_end_matches('.').to_string();
|
||||
return Some(DnsblZone { name: domain.clone(), domain, action: None, duration: None, reason: None });
|
||||
}
|
||||
let attrs = parse_kv(value);
|
||||
let get = |k: &str| attrs.iter().find(|(a, _)| a == k).map(|(_, v)| v.clone());
|
||||
let domain = get("domain")?.trim_end_matches('.').to_string();
|
||||
if domain.is_empty() {
|
||||
return None;
|
||||
}
|
||||
Some(DnsblZone {
|
||||
action: get("action").map(|a| a.to_ascii_lowercase()),
|
||||
duration: get("duration").and_then(|d| crate::xline::parse_duration(&d)),
|
||||
reason: get("reason"),
|
||||
name: get("name").unwrap_or_else(|| domain.clone()),
|
||||
domain,
|
||||
})
|
||||
}
|
||||
|
||||
/// Tokenise `key=value` attributes, honouring `"double quotes"` so a value may
|
||||
/// contain spaces (a reason string, a URL).
|
||||
fn parse_kv(s: &str) -> Vec<(String, String)> {
|
||||
let b: Vec<char> = s.chars().collect();
|
||||
let mut out = Vec::new();
|
||||
let mut i = 0;
|
||||
while i < b.len() {
|
||||
while i < b.len() && b[i].is_whitespace() {
|
||||
i += 1;
|
||||
}
|
||||
let ks = i;
|
||||
while i < b.len() && b[i] != '=' && !b[i].is_whitespace() {
|
||||
i += 1;
|
||||
}
|
||||
let key: String = b[ks..i].iter().collect();
|
||||
if i < b.len() && b[i] == '=' {
|
||||
i += 1;
|
||||
let val = if i < b.len() && b[i] == '"' {
|
||||
i += 1;
|
||||
let vs = i;
|
||||
while i < b.len() && b[i] != '"' {
|
||||
i += 1;
|
||||
}
|
||||
let v: String = b[vs..i].iter().collect();
|
||||
i += 1; // skip the closing quote (or the end)
|
||||
v
|
||||
} else {
|
||||
let vs = i;
|
||||
while i < b.len() && !b[i].is_whitespace() {
|
||||
i += 1;
|
||||
}
|
||||
b[vs..i].iter().collect()
|
||||
};
|
||||
if !key.is_empty() {
|
||||
out.push((key.to_ascii_lowercase(), val));
|
||||
}
|
||||
}
|
||||
}
|
||||
out
|
||||
}
|
||||
|
||||
/// Ban length applied by the `*line` actions on a hit.
|
||||
const DNSBL_BAN: u64 = 86_400; // default ban length (1 day) if `dnsbl_duration` unset
|
||||
|
||||
|
|
@ -64,40 +147,100 @@ pub fn report(s: &mut Server, uid: Uid, outcome: Outcome) {
|
|||
s.notice_star(uid, "Checking for DNSBL");
|
||||
s.notice_star(uid, "Checking for DNSBL done, no hit.");
|
||||
}
|
||||
Outcome::Hit { zone, reply } => {
|
||||
Outcome::Hit { zone, reply: _ } => {
|
||||
s.notice_star(uid, "Checking for DNSBL");
|
||||
s.notice_star(
|
||||
uid,
|
||||
&format!("Checking for DNSBL done — LISTED on {zone} ({reply})."),
|
||||
);
|
||||
act(s, uid, &zone, reply);
|
||||
s.notice_star(uid, "Checking for DNSBL done.");
|
||||
act(s, uid, &zone);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/// Act on a hit per `dnsbl_action`: `mark` just informs; the `*line` actions add a
|
||||
/// temporary ban and close; `kill` closes without a persistent ban.
|
||||
fn act(s: &mut Server, uid: Uid, zone: &str, reply: Ipv4Addr) {
|
||||
/// Act on a hit against blocklist `domain` per its (or the global) action: `mark`
|
||||
/// just informs; the `*line` actions add a ban and close; `kill` closes without a
|
||||
/// persistent ban. Emits the XLINE notice (via `add_xline`) then the DNSBL one.
|
||||
fn act(s: &mut Server, uid: Uid, domain: &str) {
|
||||
let (mask, ip) = match s.users.get(&uid) {
|
||||
Some(u) => (u.prefix(), u.addr.ip()),
|
||||
None => return,
|
||||
};
|
||||
let action = s.dnsbl_action.clone();
|
||||
s.snotice_c('d', &format!(
|
||||
"DNSBL: {mask} is listed on {zone} ({reply}); action={action}"
|
||||
));
|
||||
let reason = format!("{} (listed on {zone})", s.dnsbl_reason);
|
||||
let ipstr = ip.to_string();
|
||||
let dur = s.conf_num("dnsbl_duration", DNSBL_BAN);
|
||||
match action.as_str() {
|
||||
"kline" => s.add_xline(XKind::Kline, &format!("*@{ipstr}"), dur, "dnsbl", &reason),
|
||||
"gline" => s.add_xline(XKind::Gline, &format!("*@{ipstr}"), dur, "dnsbl", &reason),
|
||||
"zline" => s.add_xline(XKind::Zline, &ipstr, dur, "dnsbl", &reason),
|
||||
"kill" | "reject" => {}
|
||||
_ => return, // "mark" or unknown: notify only, don't disconnect
|
||||
// Resolve this hit's per-zone settings, each falling back to the global default.
|
||||
let zone = s
|
||||
.dnsbl_zones
|
||||
.iter()
|
||||
.find(|z| z.domain.eq_ignore_ascii_case(domain))
|
||||
.cloned();
|
||||
let name = zone.as_ref().map(|z| z.name.clone()).unwrap_or_else(|| domain.to_string());
|
||||
let action = zone
|
||||
.as_ref()
|
||||
.and_then(|z| z.action.clone())
|
||||
.unwrap_or_else(|| s.dnsbl_action.clone());
|
||||
let dur = zone
|
||||
.as_ref()
|
||||
.and_then(|z| z.duration)
|
||||
.unwrap_or_else(|| s.conf_num("dnsbl_duration", DNSBL_BAN));
|
||||
let reason_tmpl = zone
|
||||
.as_ref()
|
||||
.and_then(|z| z.reason.clone())
|
||||
.unwrap_or_else(|| s.dnsbl_reason.clone());
|
||||
// Reason templating: %ip% → the client IP, %dnsbl% → the zone domain.
|
||||
let reason = reason_tmpl.replace("%ip%", &ipstr).replace("%dnsbl%", domain);
|
||||
let setter = format!("dnsbl@{}", s.name);
|
||||
// Apply the action first so the XLINE notice precedes the DNSBL one, matching
|
||||
// how an operator watching both snomasks sees a blocklist ban land.
|
||||
let closes = match action.as_str() {
|
||||
"kline" => {
|
||||
s.add_xline(XKind::Kline, &format!("*@{ipstr}"), dur, &setter, &reason);
|
||||
true
|
||||
}
|
||||
"gline" => {
|
||||
s.add_xline(XKind::Gline, &format!("*@{ipstr}"), dur, &setter, &reason);
|
||||
true
|
||||
}
|
||||
"zline" => {
|
||||
s.add_xline(XKind::Zline, &ipstr, dur, &setter, &reason);
|
||||
true
|
||||
}
|
||||
"kill" | "reject" => true,
|
||||
_ => false, // "mark" or unknown: notify only, let them in
|
||||
};
|
||||
s.snotice_c('d', &format!(
|
||||
"DNSBL: Connecting user {mask} ({ipstr}) detected as being on the '{domain}' DNSBL: {name}"
|
||||
));
|
||||
if closes {
|
||||
// pre-registration users aren't caught by add_xline's enforce sweep, so close
|
||||
// this connection explicitly (the ERROR flushes before the socket).
|
||||
s.send(uid, format!("ERROR :Closing link: ({reason})"));
|
||||
s.remove_user(uid, &reason);
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
|
||||
#[test]
|
||||
fn parse_zone_bare_domain() {
|
||||
let z = parse_zone("torexit.dan.me.uk.").unwrap();
|
||||
assert_eq!(z.domain, "torexit.dan.me.uk"); // trailing dot trimmed
|
||||
assert_eq!(z.name, "torexit.dan.me.uk"); // name defaults to the domain
|
||||
assert!(z.action.is_none() && z.duration.is_none() && z.reason.is_none());
|
||||
assert!(parse_zone(" ").is_none());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn parse_zone_with_quoted_attrs() {
|
||||
let z = parse_zone(
|
||||
"domain=torexit.dan.me.uk name=\"Tor exit node\" action=ZLINE duration=1w \
|
||||
reason=\"Not allowed. See https://x/%ip% here\"",
|
||||
)
|
||||
.unwrap();
|
||||
assert_eq!(z.domain, "torexit.dan.me.uk");
|
||||
assert_eq!(z.name, "Tor exit node");
|
||||
assert_eq!(z.action.as_deref(), Some("zline")); // lower-cased
|
||||
assert_eq!(z.duration, Some(604800)); // 1w
|
||||
assert_eq!(z.reason.as_deref(), Some("Not allowed. See https://x/%ip% here"));
|
||||
// attrs missing a domain are rejected
|
||||
assert!(parse_zone("name=\"no domain\" action=zline").is_none());
|
||||
}
|
||||
// pre-registration users aren't caught by add_xline's enforce sweep, so close
|
||||
// this connection explicitly (the ERROR flushes before the socket).
|
||||
s.send(uid, format!("ERROR :Closing link: ({reason})"));
|
||||
s.remove_user(uid, &reason);
|
||||
}
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue