lekensteyn/dnsallow

dnsallow enables whitelisting of IP addresses based on DNS responses.

dnsallow

dnsallow enables whitelisting of IP addresses based on DNS responses.

It involves these components:

• NFQUEUE for intercepting IP packets.
• Some code to parse relevant DNS details (name, type, address) from an IP packet.
• Some code to handle the policy (allow / reject a DNS response).
• ipset for storing whitelisted addresses.
• iptables for whitelisting traffic based on the queries.

DNS responses are forwarded after checking against the policy, regardless of the policy outcome. In combination with a default-deny policy for a firewall, this technique allows non-disruption of normal whitelisted traffic. Assuming a trustworthy DNS server and a sane policy, unwanted traffic is also blocked.

Ideas

Ideas and TODO items

• Argument processing:
  • Allow nfqueue queue number to be changed (currently hardcoded to 53).
  • Allow IPv4 and IPv6 ipset setnames to be changed (currently hardcoded to dnsallow-ipv4 and dnsallow-ipv6).
  • Add --help option.
• Decide on policy file format (currently all names are accepted).
• Extend policy to further filter IP addresses?
• Allow CNAME records to satisfy policies. If the policy allows X, and a response for X contains CNAME Y, then addresses in the answer for Y should also be accepted by the policy.
• Accept TCP responses. Will likely not happen as TCP is often not used for simple DNS queries/responses and requires tracking of the TCP stream.
• Rewrite the DNS response. Possibly out of scope for this packet since crafting valid DNS responses is more complex and might invalidate signatures.

License

Copyright (c) 2016 Peter Wu [email protected] This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. See LICENSE.txt for details.

dnsallow's Issues

Policy file format

Currently the queue processing, DNS parsing and ipset insertion are working. What missing is the policy check before inserting the IP into the ipset.

Possible ideas for policy format regarding domain names patterns:

• Regular expressions.
• Simple matches based on labels, with wildcard support.
  • example.com matches example.com but not www.example.com.
  • .example.com matches example.com, www.example.com and a.b.example.com.
  • *.example.com matches www.example.com but not example.com nor a.b.example.com.
  • .*.example.com matches a.b.example.com and a.b.c.example.com but not www.example.com. (really?)
  • sub.*.example.com matches sub.a.example.com but not sub.a.b.example.com

Policy format options:

• Line by line, first match will accept.
• Default policy is to ignore.
• Leading spaces are ignored.
• Ignore comments (lines starting with #).
• One pattern, optionally followed by options? E.g. example.com action=REJECT?

Currently the policy can only give a yes/no answer, should it be changed such that multiple ipsets can be configured?