BIND, RPZ e prioridades de encaminhamento

Question

Meu objetivo é bloquear determinados domínios no bind sem primeiro procurar seu endereço (este é um pequeno servidor de DNS bind bind).

Atualmente, minha configuração encaminhará a solicitação para badhost.com e obterá o endereço IP (posso ver isso em wireshark) e, em seguida, substituirá essa resposta por NXDOMAIN.

bind.log:

client 192.168.1.1#46107 (badhost.com): rpz QNAME NXDOMAIN rewrite badhost.com via badhost.com.rpz

Mas não há sentido em buscar o endereço IP e atrasa a consulta. Eu só quero que ele retorne rapidamente NXDOMAIN para os domínios bloqueados sem fazer o encaminhamento.

configuração:

options {
  response-policy { zone "rpz" policy nxdomain; };
  cleaning-interval 360;
  forward only;
  forwarders { x.x.x.x; y.y.y.y; };
  allow-recursion { any; };
  allow-query { any; };
  allow-query-cache { any; };

}

zone "rpz" {
  type master;
  file "/etc/bind/rpz.zone";
};
zone "0.0.127.in-addr.arpa" {
        type master;
    notify no;
        file "pz/127.0.0";
};
zone "1.168.192.in-addr.arpa" {
        type master;
        notify no;
        file "pz/192.168.1";
};
zone "lan" {
        type master;
        notify no;
        file "pz/lan";
};

rpz.zone

$TTL    604800
@       IN      SOA     ns1.example.local. info.example.local. (
                          2         ; Serial
                     604800         ; Refresh
                      86400         ; Retry
                    2419200         ; Expire
                     604800 )       ; Negative Cache TTL

@       IN      NS      local.

$INCLUDE rpz.blacklist.db

rpz.blacklist.db

badhost.com CNAME .

Haverá milhares de entradas, então eu não quero uma zona apontando para o mesmo arquivo (0.0.0.0 ou 127.0.0.1) para cada uma.

    

Answer 1

Isso pode ser feito com qname-wait-recurse . Aqui está a documentação do BIND 9.10 ARM sobre o uso desta característica:

No DNS records are needed for a QNAME or Client-IP trigger. The name or IP address itself is sufficient, so in principle the query name need not be recursively resolved. However, not resolving the requested name can leak the fact that response policy rewriting is in use and that the name is listed in a policy zone to operators of servers for listed names. To prevent that information leak, by default any recursion needed for a request is done before any policy triggers are considered. Because listed domains often have slow authoritative servers, this default behavior can cost significant time. The qname-wait-recurse no option overrides that default behavior when recursion cannot change a non-error response. The option does not affect QNAME or client-IP triggers in policy zones listed after other zones containing IP, NSIP and NSDNAME triggers, because those may depend on the A, AAAA, and NS records that would be found during recursive resolution. It also does not affect DNSSEC requests (DO=1) unless break-dnssec yes is in use, because the response would depend on whether or not RRSIG records were found during resolution. Using this option can cause error responses such as SERVFAIL to appear to be rewritten, since no recursion is being done to discover problems at the authoritative server.

A sintaxe para ativar esse recurso é um pouco obscura. Em vez de colocá-lo no bloco global options {}; , ele precisa aparecer antes do ponto-e-vírgula final em sua definição response-policy {}; .

[ response-policy {
    zone zone_name
    [ policy (given | disabled | passthru | drop |
              nxdomain | nodata | cname domain) ]
    [ recursive-only yes_or_no ]
    [ max-policy-ttl number ]
    ; [...]
} [ recursive-only yes_or_no ]
  [ max-policy-ttl number ]
  [ break-dnssec yes_or_no ]
  [ min-ns-dots number ]
  [ qname-wait-recurse yes_or_no ]
  [ automatic-interface-scan yes_or_no ]
; ]

Antes:

response-policy { zone "rpz"; };

Depois:

response-policy { zone "rpz"; } qname-wait-recurse no;