97 lines
3.9 KiB
Rust
97 lines
3.9 KiB
Rust
//! DNSBL: DNS blocklist checks on connect. The resolver thread reverses the
|
|
//! client's IP under each configured blocklist zone and A-looks it up (see
|
|
//! [`crate::resolver`]); a listing triggers the configured action. Works for IPv4
|
|
//! (reversed octets) and IPv6 (reversed nibbles); a v4-only blocklist NXDOMAINs a
|
|
//! v6 query, which reads as "not listed".
|
|
//!
|
|
//! Actions (`dnsbl_action`): `mark` shows the notice and lets them in (default),
|
|
//! `kill` disconnects, `kline`/`gline`/`zline` add a 1-day ban and disconnect.
|
|
//! Driven from the connection lifecycle (`Server::add_conn` → `on_resolved`)
|
|
//! rather than as a hook `Module`.
|
|
|
|
use std::net::{IpAddr, Ipv4Addr};
|
|
use std::time::Duration;
|
|
|
|
use crate::resolver;
|
|
use crate::server::Server;
|
|
use crate::xline::XKind;
|
|
use crate::Uid;
|
|
|
|
/// Ban length applied by the `*line` actions on a hit.
|
|
const DNSBL_BAN: u64 = 86_400; // default ban length (1 day) if `dnsbl_duration` unset
|
|
|
|
/// Outcome of a DNSBL check for one connecting client.
|
|
pub enum Outcome {
|
|
/// No blocklists configured — the check didn't run.
|
|
Skipped,
|
|
/// Checked against every zone; the address is not listed.
|
|
Clean,
|
|
/// Listed: `zone` returned `reply` (`127.0.0.x`, last octet = reason code).
|
|
Hit { zone: String, reply: Ipv4Addr },
|
|
}
|
|
|
|
/// Check `ip` against every blocklist `zone`; the first listing wins. Runs off the
|
|
/// core thread (called from the resolver worker), so it may block on DNS.
|
|
pub fn check(ip: IpAddr, zones: &[String], timeout: Duration) -> Outcome {
|
|
if zones.is_empty() {
|
|
return Outcome::Skipped;
|
|
}
|
|
for zone in zones {
|
|
let z = zone.trim().trim_end_matches('.');
|
|
let qname = format!("{}.{z}", resolver::reverse_labels(ip));
|
|
if let Some(reply) = resolver::a_lookup(&qname, timeout) {
|
|
return Outcome::Hit {
|
|
zone: zone.clone(),
|
|
reply,
|
|
};
|
|
}
|
|
}
|
|
Outcome::Clean
|
|
}
|
|
|
|
/// Emit the DNSBL notices for `outcome` and, on a hit, take the configured action.
|
|
/// Called from `Server::on_resolved` on the core thread.
|
|
pub fn report(s: &mut Server, uid: Uid, outcome: Outcome) {
|
|
match outcome {
|
|
Outcome::Skipped => {}
|
|
Outcome::Clean => {
|
|
s.notice_star(uid, "Checking for DNSBL");
|
|
s.notice_star(uid, "Checking for DNSBL done, no hit.");
|
|
}
|
|
Outcome::Hit { zone, reply } => {
|
|
s.notice_star(uid, "Checking for DNSBL");
|
|
s.notice_star(
|
|
uid,
|
|
&format!("Checking for DNSBL done — LISTED on {zone} ({reply})."),
|
|
);
|
|
act(s, uid, &zone, reply);
|
|
}
|
|
}
|
|
}
|
|
|
|
/// Act on a hit per `dnsbl_action`: `mark` just informs; the `*line` actions add a
|
|
/// temporary ban and close; `kill` closes without a persistent ban.
|
|
fn act(s: &mut Server, uid: Uid, zone: &str, reply: Ipv4Addr) {
|
|
let (mask, ip) = match s.users.get(&uid) {
|
|
Some(u) => (u.prefix(), u.addr.ip()),
|
|
None => return,
|
|
};
|
|
let action = s.dnsbl_action.clone();
|
|
s.snotice_c('d', &format!(
|
|
"DNSBL: {mask} is listed on {zone} ({reply}); action={action}"
|
|
));
|
|
let reason = format!("{} (listed on {zone})", s.dnsbl_reason);
|
|
let ipstr = ip.to_string();
|
|
let dur = s.conf_num("dnsbl_duration", DNSBL_BAN);
|
|
match action.as_str() {
|
|
"kline" => s.add_xline(XKind::Kline, &format!("*@{ipstr}"), dur, "dnsbl", &reason),
|
|
"gline" => s.add_xline(XKind::Gline, &format!("*@{ipstr}"), dur, "dnsbl", &reason),
|
|
"zline" => s.add_xline(XKind::Zline, &ipstr, dur, "dnsbl", &reason),
|
|
"kill" | "reject" => {}
|
|
_ => return, // "mark" or unknown: notify only, don't disconnect
|
|
}
|
|
// pre-registration users aren't caught by add_xline's enforce sweep, so close
|
|
// this connection explicitly (the ERROR flushes before the socket).
|
|
s.send(uid, format!("ERROR :Closing link: ({reason})"));
|
|
s.remove_user(uid, &reason);
|
|
}
|