IP based RPZ file application

[SuhaniPatel88]

Hey all...

• I have a doubt regarding the recursor. I have been assigned a task to write a Lua script for recursor which can load two custom rpz files (one blacklist and another whitelist) per IP address along with two global rpz files. I have not been able to make logic work in Lua for it. It's like I want only 4 lists to work per request( 2 custom and 2 global lists) and discard the rest which are meant for other IPs. Also, it is to be further expanded for multiple IPs as well.

---

• Here's the script that I tried:

local custom_lists = {
    ["<ip_address>"] = {
        whitelist = "/etc/powerdns/rpz/ip1-whitelist.rpz",
        blacklist = "/etc/powerdns/rpz/ip1-blacklist.rpz"
    },
    ["<ip-address>"] = {
        whitelist = "/etc/powerdns/rpz/ip2-whitelist.rpz",
        blacklist = "/etc/powerdns/rpz/ip2-blacklist.rpz"
    }
}


for ip, config in pairs(custom_lists) do
    rpzFile(config.whitelist, {
        policyName = "CUSTOM-"..ip.."-WHITELIST",
        defpol = Policy.PASSTHRU,
    })

    rpzFile(config.blacklist, {
        policyName = "CUSTOM-"..ip.."-BLACKLIST",
        defpol = Policy.NXDOMAIN,
    })
end


rpzFile("/etc/powerdns/whitelist.rpz", {
    policyName = "GLOBAL-WHITELIST",
    defpol = Policy.PASSTHRU
})

rpzFile("/etc/powerdns/blacklist.rpz", {
    policyName = "GLOBAL-BLACKLIST",
    defpol = Policy.NXDOMAIN
})



function preresolve(dq)
    local client_ip = dq.remoteaddr:toString()
    local allowed_policies = {}

    if custom_lists[client_ip] then
        table.insert(allowed_policies, "CUSTOM-"..client_ip.."-WHITELIST")
        table.insert(allowed_policies, "CUSTOM-"..client_ip.."-BLACKLIST")
    end

    table.insert(allowed_policies, "GLOBAL-WHITELIST")
    table.insert(allowed_policies, "GLOBAL-BLACKLIST")


    if dq.appliedPolicy then
        for _, policy in ipairs(dq.appliedPolicy.policyName) do
            local pname = policy.policyName
            local allowed = false
            for _, allowed_name in ipairs(allowed_policies) do
                if pname == allowed_name then
                    allowed = true
                    break
                end
            end
            if not allowed then
                dq:discardPolicy(pname)
            end
        end
    end

    return false
end

---

• I have tried disabling pdns cache as well, but that didn't help! My hunch is, there's some issue with preresolve function and it's not even being called, but then again, I don't know, I am new to this.
• I am also sharing an easier hard-coded version of the above mentioned script, that didn't work either.

---

rpzFile("/etc/powerdns/rpz/ip1-whitelist.rpz", { policyName = "CUSTOM-<ip_address>-WHITELIST" })
rpzFile("/etc/powerdns/rpz/ip2-whitelist.rpz", { policyName = "CUSTOM-<ip_address>-WHITELIST" })
rpzFile("/etc/powerdns/rpz/ip1-blacklist.rpz", { policyName = "CUSTOM-<ip_address>-BLACKLIST" })
rpzFile("/etc/powerdns/rpz/ip2-blacklist.rpz", { policyName = "CUSTOM-<ip-address>-BLACKLIST" })




rpzFile("/etc/powerdns/whitelist.rpz", {
    policyName = "GLOBAL-WHITELIST",
    defpol = Policy.PASSTHRU
})

rpzFile("/etc/powerdns/blacklist.rpz", {
    policyName = "GLOBAL-BLACKLIST",
    defpol = Policy.NXDOMAIN
})



function policyEventFilter(event)
        local client_ip = event.remote:toString()
        if client_ip == "<ip_address>" then
                event:discardPolicy("CUSTOM-<ip_address>-WHITELIST")
                event:discardPolicy("CUSTOM-<ip_address> -BLACKLIST")
        else
                event:discardPolicy("CUSTOM-<ip_address>-WHITELIST")
                event:discardPolicy("CUSTOM-<ip_address>-BLACKLIST")
        end
 
end

---

• Is it possible in POWERDNS RECURSOR to do so? If yes, then please do help me out!!!!

[omoerbeek]

Yes, I think it is possible.

But I do not think this approach will scale well with many IPs.

I did not look at the details of your two approaches yet, but as first glance: your policyEventFilter does not return a value. It should return true or false, see https://docs.powerdns.com/recursor/lua-scripting/hooks.html#modifying-policy-decisions. I'll try to look in more detail later.

[omoerbeek]

Looking a bit more in detail:

1. Both your approaches show a mixup of lua config and lua script. You should make separate files for them, possibly including common stuff. Set them using https://docs.powerdns.com/recursor/yamlsettings.html#recursor-lua-config-file and https://docs.powerdns.com/recursor/yamlsettings.html#recursor-lua-dns-script
2. You are looping over ipairs(dq.appliedPolicy.policyName) but this is a string, not a table. It gets set when a policy has hit.
3. There is no way built-in to get all configured policies, so the loop you are trying to build should get a list of policynames built by your own code.

Given all that, I think you second appoach is more promising, but it suffers from point 1 as well. Plus the return value is not set.

The comment about scalability still applies.