29 Čec
2019
29 Čec
'19
13:28
Hello,
first note the change to the correct mailing-list.
On 7/29/19 10:20 AM, Balakrishnan B wrote:
I am trying to add wildcard static hints to catch all
local domains like
below. But does not seem to work.
hints['nextcloud.local'] = '127.0.0.1' # This works fine
hints['*.local'] = '127.0.0.1'
hints['.local'] = '127.0.0.1'
DNSMasq supports this like https://stackoverflow.com/a/22551303
Is there way to do this in knot?
No, I don't think there's a good way currently. The hints module only
supports exact names with A and AAAA and corresponding PTR, like in
/etc/hosts files. With our [RPZ] you can do wildcards, but there's no
support for positive answers (so you need to do NXDOMAIN or similar
denials).
BTW, note that .local is reserved for [mDNS] protocol, in particular
kresd might never get to such requests because it's "only" a DNS server:
3. Name resolution APIs and libraries SHOULD recognize
these names as
special and SHOULD NOT send queries for these names to their
configured (unicast) caching DNS server(s).
[RPZ]
https://knot-resolver.readthedocs.io/en/stable/modules.html#c.policy.rpz
[mDNS] https://tools.ietf.org/html/rfc6762#section-22.1
--Vladimir
30 Čec
30 Čec
7:40
New subject: Specify wildcard subdomain static hints
I have a RPZ configuration with positive answers. I redirect RPZ hits to a landing page. I
also wanted the DNS response to be verbose (SOA in additional section) so that in case I
forget about it, a DNS lookup makes it obvious what's going on. This page
https://knot-resolver.readthedocs.io/en/stable/modules.html?highlight=genRR…
helped me coming up with the following solution:
-- RPZ
-- custom response
local function mkauth_soa(answer, dname, mname)
if mname == nil then
mname = dname
end
return answer:put(dname, 900, answer:qclass(), kres.type.SOA,
mname ..
'\6daniel\10stirnimann\5gmail\3com\0\0\0\0\0\0\0\14\16\0\0\3\132\0\9\58\128\0\0\3\132')
end
local ffi = require('ffi')
local function genRR (state, req)
local answer = req.answer
local qry = req:current()
if qry.stype == kres.type.A then
ffi.C.kr_pkt_make_auth_header(answer)
answer:rcode(kres.rcode.NOERROR)
answer:begin(kres.section.ANSWER)
answer:put(qry.sname, 900, answer:qclass(), kres.type.A,
'\192\168\2\1')
answer:begin(kres.section.ADDITIONAL)
mkauth_soa(answer, '\3rpz\3int\6seckle\2ch\0')
return kres.DONE
elseif qry.stype == kres.type.AAAA then
ffi.C.kr_pkt_make_auth_header(answer)
answer:rcode(kres.rcode.NOERROR)
answer:begin(kres.section.ANSWER)
answer:put(qry.sname, 900, answer:qclass(), kres.type.AAAA,
'\042\002\001\104\064\036\0\0\0\0\0\0\0\0\0\1')
answer:begin(kres.section.ADDITIONAL)
mkauth_soa(answer, '\3rpz\3int\6seckle\2ch\0')
return kres.DONE
else
return state
end
end
-- rpz policy: respond with custom function genRR
policy.add(policy.rpz(genRR, '/etc/kresd/rpz.int.seckle.ch.zone'))
Daniel
________________________________
On 7/29/19 10:20 AM, Balakrishnan B wrote:
I am trying to add wildcard static hints to catch all local domains like
below. But does not seem to work.
hints['nextcloud.local'] = '127.0.0.1' # This works fine
hints['*.local'] = '127.0.0.1'
hints['.local'] = '127.0.0.1'
DNSMasq supports this like https://stackoverflow.com/a/22551303
Is there way to do this in knot?
No, I don't think there's a good way currently. The hints module only supports
exact names with A and AAAA and corresponding PTR, like in /etc/hosts files. With our
[RPZ] you can do wildcards, but there's no support for positive answers (so you need
to do NXDOMAIN or similar denials).
11:27
New subject: Specify wildcard subdomain static hints
On 7/30/19 7:40 AM, Daniel Stirnimann wrote:
I have a RPZ configuration with positive answers.
Right, thank you. I forgot we even put this way into documentation.
(This genRR is not what I'd call a simple way, but on the other hand
it's very flexible, if you know the DNS protocol a bit.)
--Vladimir
1743
days inactive
1744
days old
knot-resolver-users@lists.nic.cz
2 comments
2 participants
participants (2)
-
Daniel Stirnimann -
Vladimír Čunát