Knot Resolver: Resolve DNS names like it's 2021! https://www.knot-resolver.cz/support/
Sorry for inconvenience!
How does one create acme certificates for doh2? https://github.com/NixOS/nixpkgs/pull/103633#issuecomment-732082513 Before I had nginx running in front of kresd
cc @vcunat
Should I open a ticket for this? I see this as a major issue when deploying kresd with http2.
but it's lua, so you can e.g. wrap the blocking function by one that adds counts into some global table or something.
(not every nxdomain will be from a block)
Policy rules have a counter for each rule (not per-user).
The callbacks of rules are general lua functions, so you can't introspect them... so this way it isn't very user-friendly.
But
policy.add() returns reference to the added rule, so you can track it that way.
The function takes two parameters (which you'd better pass through) and the second one is of type
kr_request, so it contains e.g. .qsource.addr which is the requestor's address (as C structure; == nil for internal ones)
I've found something similar, but thats not working due to changes in newer version of knot.
-- start of config snippet
function LOG_IP(state, req)
req = kres.request_t(req)
if req.qsource == nil or req.qsource.addr == nil then
-- internal request, no source
return state end
print('query from IP ' .. tostring(req.qsource.addr))
return -- continue with other policy rules
end
policy.add(policy.all(LOG_IP))
-- end of config snipper
Okei thats a step forward. What should I modify in this snippet to get the blocked domain next to the IP?
Read? You mean like this?
$ kdig @odvr.nic.cz -x 10.0.0.1
;; ->>HEADER<<- opcode: QUERY; status: NXDOMAIN; id: 1538
;; Flags: qr aa rd ra; QUERY: 1; ANSWER: 0; AUTHORITY: 1; ADDITIONAL: 1
;; QUESTION SECTION:
;; 1.0.0.10.in-addr.arpa. IN PTR
;; AUTHORITY SECTION:
1.0.0.10.in-addr.arpa. 10800 IN SOA 1.0.0.10.in-addr.arpa. nobody.invalid. 1 3600 1200 604800 10800
;; ADDITIONAL SECTION:
explanation.invalid. 10800 IN TXT "Blocking is mandated by standards, see references on https://www.iana.org/assignments/locally-served-dns-zones/locally-served-dns-zones.xhtml"
;; Received 262 B
;; Time 2020-11-24 18:39:07 CET
;; From 2001:148f:fffe::1@53(UDP) in 20.6 ms
If you don't block, you don't get that far.
It's possible I misunderstand how you're using the parts at this moment.
modules = {
'policy',
'view',
'hints > iterate',
'stats',
}
function LOG_IP(state, req)
req = kres.request_t(req)
if req.qsource == nil or req.qsource.addr == nil then
-- internal request, no source
return state
end
print('query from IP ' .. tostring(req.qsource.addr) .. tostring(req:initial():name()))
return -- continue with other policy rules
end
view:addr('127.0.0.1', function (req, qry) return policy.PASS end)
policy.add(policy.rpz(policy.DENY_MSG('blocked'), '/etc/knot-resolver/blocked.rpz',true))
view:addr('127.0.0.1', policy.rpz(policy.DROP, '/etc/knot-resolver/blocked.rpz'))
policy.add(policy.all(LOG_IP))
-- Drop everything that hasn't matched
view:addr('0.0.0.0/0', function (req, qry) return policy.DROP end)
this logs everything now, but what I'm trying to achieve is, printing only the blocked ones.
As an optimization you can do
DENY_MSG('blocked')(state, req) at the return line of LOG_IP to combine those two into one.
any idea how to fix this?