Filter Network App

[Singijeon]

I've wrote a plugin for filtering network in responses:
Filter Network.zip

Work algorithm:

1. Checking the request for type A or AAAA
2. Checking the response name for the content of the filtered zone
3. Checking the address in RDATA for the content of the filtered network
4. The exclusion of A and AAAA filtered records from the result, if there are no records then the NX Domain will be returned

Usage:

1. Download the archive and install it in the Apps tab of TDNS server
2. Click Config and enter required zones and networks:

{
	"enableFilter": true,
	"groups": [
		{
			"isEnabled": true,
			"filterZones": [
				"example.com"
			],
			"filterNetworks": [
				"203.0.113.0/24",
				"5f00::/16"
			]
		}
	]
}

Source code

using System;
using System.Collections.Generic;
using System.Collections.Immutable;
using System.Diagnostics.CodeAnalysis;
using System.Linq;
using System.Net;
using System.Text.Json;
using System.Threading.Tasks;

using TechnitiumLibrary;
using TechnitiumLibrary.Net;
using TechnitiumLibrary.Net.Dns;
using TechnitiumLibrary.Net.Dns.ResourceRecords;

using DnsServerCore.ApplicationCommon;

namespace FilterNetwork;

public sealed class App : IDnsApplication, IDnsPostProcessor {
	private sealed record Group {
		public bool IsEnabled { get; init; }

		public IReadOnlyList<string> FilterZones { get; init; }

		public IReadOnlyList<NetworkAddress> FilterNetworks { get; init; }
	}

	private IDnsServer dnsServer;

	private bool enableFilter;
	private IReadOnlyList<Group> groups;
	private Dictionary<string, IReadOnlyList<NetworkAddress>> groupMap;

	public void Dispose() {
		/* do nothing */
	}

	public Task InitializeAsync(IDnsServer dnsServer, string? config) {
		this.dnsServer = dnsServer;

		using var jsonDocument = JsonDocument.Parse(config!);
		var jsonConfig = jsonDocument.RootElement;

		this.enableFilter = jsonConfig.GetPropertyValue("enableFilter", false);

		this.groups = jsonConfig.ReadArray("groups", jsonGroup => {
			var isEnabled = jsonGroup.GetProperty("isEnabled").GetBoolean();

			var filterZones = jsonGroup.ReadArray("filterZones");
			var filterNetworkStrings = jsonGroup.ReadArray("filterNetworks");

			var filterNetwork = filterNetworkStrings.Select(
				element => NetworkAddress.TryParse(element, out var networkAddress)
					? networkAddress
					: throw new InvalidOperationException("Network group map contains an invalid network address: " + element)
			).ToImmutableList();

			return new Group {
				IsEnabled = isEnabled,
				FilterZones = filterZones,
				FilterNetworks = filterNetwork
			};
		});

		var groupMap = new Dictionary<string, IReadOnlyList<NetworkAddress>>();

		foreach (var group in this.groups) {
			if (!group.IsEnabled) {
				continue;
			}

			foreach (var zone in group.FilterZones) {
				List<NetworkAddress> list;

				if (groupMap.TryGetValue(zone, out var existingList)) {
					list = (List<NetworkAddress>) existingList;
				} else {
					list = [];

					groupMap.Add(zone, list);
				}

				list.AddRange(group.FilterNetworks);
			}
		}

		this.groupMap = groupMap;

		return Task.CompletedTask;
	}

	public Task<DnsDatagram?> PostProcessAsync(DnsDatagram request, IPEndPoint remoteEp, DnsTransportProtocol protocol, DnsDatagram? response) {
		if (!this.enableFilter) {
			return Task.FromResult(response);
		}

		if (response!.RCODE is not DnsResponseCode.NoError) {
			return Task.FromResult<DnsDatagram?>(response);
		}

		var question = request.Question[0];
		if (question.Type is not (DnsResourceRecordType.A or DnsResourceRecordType.AAAA)) {
			return Task.FromResult<DnsDatagram?>(response);
		}

		var isAnswerWasFiltered = false;
		string? blockedDomain = null;
		var newAnswer = new List<DnsResourceRecord>(response.Answer.Count);

		foreach (var record in response.Answer) {
			isAnswerWasFiltered |= IsAnswerFiltered(record, out var domain, out var newRecord);

			if (domain is not null) {
				blockedDomain = domain;
			}

			if (newRecord is not null) {
				newAnswer.Add(newRecord);
			}
		}

		if (!isAnswerWasFiltered) {
			return Task.FromResult<DnsDatagram?>(response);
		}

		var parentDomain = (blockedDomain is not null ? GetParentZone(blockedDomain) ?? string.Empty : string.Empty);

		IReadOnlyList<DnsResourceRecord> authority = [
			new(
				parentDomain,
				DnsResourceRecordType.SOA,
				question.Class,
				60,
				new DnsSOARecordData(
					this.dnsServer.ServerDomain,
					this.dnsServer.ResponsiblePerson.Address,
					1,
					14_400,
					3_600,
					604_800,
					60
				)
			)
		];

		var hasAddressRecords = newAnswer.Any(answer => answer.Type is DnsResourceRecordType.A or DnsResourceRecordType.AAAA);

		return Task.FromResult<DnsDatagram?>(new DnsDatagram(
			request.Identifier,
			true,
			hasAddressRecords ? response.OPCODE : DnsOpcode.StandardQuery,
			false,
			false,
			request.RecursionDesired,
			hasAddressRecords && response.RecursionAvailable,
			false,
			false,
			hasAddressRecords ? DnsResponseCode.NoError : DnsResponseCode.NxDomain,
			request.Question,
			newAnswer.Count is not 0 ? newAnswer : null,
			authority
		) {
			Tag = DnsServerResponseType.Blocked
		});
	}

	private bool IsAnswerFiltered(DnsResourceRecord record, out string? blockedDomain, out DnsResourceRecord? newRecord) {
		if (record.Type is not (DnsResourceRecordType.A or DnsResourceRecordType.AAAA)) {
			blockedDomain = null;
			newRecord = record;

			return false;
		}

		if (!IsZoneFiltered(record.Name, out blockedDomain, out var networks)) {
			newRecord = record;

			return false;
		}

		var address = record.Type is DnsResourceRecordType.A
			? ((DnsARecordData) record.RDATA).Address
			: ((DnsAAAARecordData) record.RDATA).Address;

		if (!networks.Any(network => network.Contains(address))) {
			newRecord = record;

			return false;
		}

		newRecord = null;

		return true;
	}

	private bool IsZoneFiltered(
		string domain,
		[NotNullWhen(true)] out string? blockedDomain,
		[NotNullWhen(true)] out IReadOnlyList<NetworkAddress>? networks
	) {
		var zone = domain.ToLowerInvariant();

		do {
			if (this.groupMap.TryGetValue(zone, out networks)) {
				/* found zone blocked */
				blockedDomain = zone;

				return true;
			}

			zone = GetParentZone(zone);
		} while (zone is not null);

		blockedDomain = null;
		return false;
	}

	private static string? GetParentZone(string domain) {
		var i = domain.IndexOf('.', StringComparison.Ordinal);
		if (i > -1) {
			return domain[(i + 1)..];
		}

		/* don't return root zone */
		return null;
	}

	public string Description => "Blocks configured networks with a NX Domain response.";
}