<div dir="ltr">Resending since it seems it has few malicious domains<br><div class="gmail_quote">---------- Forwarded message ----------<br>From: <b class="gmail_sendername">Blason R</b> <span dir="ltr"><<a href="mailto:blason16@gmail.com">blason16@gmail.com</a>></span><br>Date: Tue, Apr 24, 2018 at 6:02 PM<br>Subject: Facing weird issue with DNS-RPZ<br>To: bind-users <<a href="mailto:bind-users@lists.isc.org">bind-users@lists.isc.org</a>><br><br><br><div dir="ltr">Hello All,<div><br></div><div>I am building DNS RPZ on named BIND 9.9.4-RedHat-9.9.4-51.el7_4.2 (Extended Support Version).</div><div><br></div><div>When I am manually creating writing a policy it works fine for CNAME while I have around 10k domains which needs to be wall-gardened but somehow as soon as I write simple while loop and entered in a .db file it stops RPZ functionality infact stops wall gardening instead it shows the real time.</div><div><br></div><div>here is my zone config</div><div><br></div><div>###############</div><div><br></div><div><div> recursion yes;</div><div> forwarders {1.1.1.1; 8.8.8.8; 9.9.9.9; };</div><div> querylog yes;</div><div> response-policy { zone "<a href="http://isnlab.in" target="_blank">isnlab.in</a>"; };</div><div> check-names master ignore;</div><div> check-names slave ignore;</div></div><div><br></div><div>###############</div><div><br></div><div><div>zone "<a href="http://isnlab.in" target="_blank">isnlab.in</a>" IN {</div><div> type master;</div><div> file "/var/named/firewall.local.db"<wbr>;</div><div> };</div></div><div><br></div><div><br></div><div>******************</div><div><div>$TTL 180</div><div>@ IN SOA <a href="http://ns1.isnlab.in" target="_blank">ns1.isnlab.in</a>. <a href="http://ns1.isnlab.in" target="_blank">ns1.isnlab.in</a>. (</div><div> 2006060301 ; Serial</div><div> 21600 ; Refresh</div><div> 3600 ; Retry</div><div> 604800 ; Expire</div><div> 3600 ) ; Minimum TTL</div><div><br></div><div> IN NS <a href="http://ns1.isnlab.in" target="_blank">ns1.isnlab.in</a>.</div><div><a href="http://ns1.isnlab.in" target="_blank">ns1.isnlab.in</a>. IN A 172.16.3.46</div><div><a href="http://wg.isnlab.in" target="_blank">wg.isnlab.in</a>. IN A 172.16.3.46</div><div>*.<a href="http://facebook.com" target="_blank">facebook.com</a> CNAME <a href="http://wg.isnlab.in" target="_blank">wg.isnlab.in</a>.<br></div><div><a href="http://facebook.com" target="_blank">facebook.com</a> CNAME <a href="http://wg.isnlab.in" target="_blank">wg.isnlab.in</a>.</div><div><a href="http://testing.com" target="_blank">testing.com</a> CNAME <a href="http://wg.isnlab.in" target="_blank">wg.isnlab.in</a>.</div><div>*.<a href="http://testing.com" target="_blank">testing.com</a> CNAME <a href="http://wg.isnlab.in" target="_blank">wg.isnlab.in</a>.</div><div><a href="http://000cas.info" target="_blank">000cas.info</a> CNAME <a href="http://wg.isnlab.in" target="_blank">wg.isnlab.in</a>.<br></div><div><a href="http://000dfcc96tkpc.com" target="_blank">000dfcc96tkpc.com</a> CNAME <a href="http://wg.isnlab.in" target="_blank">wg.isnlab.in</a>.</div><div><br></div></div><div>As soon as I add up the zones using below funcitonality it stops wallgardening and starts giving me real IPs</div><div><br></div><div>This is before</div><div><div><b>$ dig @<a href="http://172.16.3.46" target="_blank">172.16.3.46</a> <a href="http://facebook.com" target="_blank">facebook.com</a></b></div><div><br></div><div>; <<>> DiG 9.11.0-P5 <<>> @<a href="http://172.16.3.46" target="_blank">172.16.3.46</a> <a href="http://facebook.com" target="_blank">facebook.com</a></div><div>; (1 server found)</div><div>;; global options: +cmd</div><div>;; Got answer:</div><div>;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 6228</div><div>;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 1, ADDITIONAL: 2</div><div><br></div><div>;; OPT PSEUDOSECTION:</div><div>; EDNS: version: 0, flags:; udp: 4096</div><div>;; QUESTION SECTION:</div><div>;<a href="http://facebook.com" target="_blank">facebook.com</a>. IN A</div><div><br></div><div><b>;; ANSWER SECTION:</b></div><div><b><a href="http://facebook.com" target="_blank">facebook.com</a>. 5 IN CNAME <a href="http://wg.isnlab.in" target="_blank">wg.isnlab.in</a>.</b></div><div><b><a href="http://wg.isnlab.in" target="_blank">wg.isnlab.in</a>. 180 IN A 172.16.3.46</b></div><div><b><br></b></div><div><b>;; AUTHORITY SECTION:</b></div><div><b><a href="http://isnlab.in" target="_blank">isnlab.in</a>. 180 IN NS <a href="http://ns1.isnlab.in" target="_blank">ns1.isnlab.in</a>.</b></div></div><div><br></div><div><br></div><div>****************</div><div>cat /tmp/sinkhole.zones | awk '{print $2}' | sed -e 's/\"//g' | while read line;do echo -e $line' \t ' CNAME' \t ' wg.isnlab.in.;done >> /var/named/firewall.local.db<br></div><div><br></div><div>After this</div><div><div><b>$ dig @<a href="http://172.16.3.46" target="_blank">172.16.3.46</a> <a href="http://facebook.com" target="_blank">facebook.com</a></b></div><div><br></div><div>; <<>> DiG 9.11.0-P5 <<>> @<a href="http://172.16.3.46" target="_blank">172.16.3.46</a> <a href="http://facebook.com" target="_blank">facebook.com</a></div><div>; (1 server found)</div><div>;; global options: +cmd</div><div>;; Got answer:</div><div>;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 32058</div><div>;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 13, ADDITIONAL: 1</div><div><br></div><div>;; OPT PSEUDOSECTION:</div><div>; EDNS: version: 0, flags:; udp: 4096</div><div>;; QUESTION SECTION:</div><div>;<a href="http://facebook.com" target="_blank">facebook.com</a>. IN A</div><div><br></div><div>;; ANSWER SECTION:</div><div><b><a href="http://facebook.com" target="_blank">facebook.com</a>. 225 IN A 157.240.13.35</b></div><div><br></div><div>;; AUTHORITY SECTION:</div><div>. 2972 IN NS <a href="http://m.root-servers.net" target="_blank">m.root-servers.net</a>.</div><div>. 2972 IN NS <a href="http://a.root-servers.net" target="_blank">a.root-servers.net</a>.</div><div>. 2972 IN NS <a href="http://h.root-servers.net" target="_blank">h.root-servers.net</a>.</div><div>. 2972 IN NS <a href="http://j.root-servers.net" target="_blank">j.root-servers.net</a>.</div><div>. 2972 IN NS <a href="http://c.root-servers.net" target="_blank">c.root-servers.net</a>.</div><div>. 2972 IN NS <a href="http://i.root-servers.net" target="_blank">i.root-servers.net</a>.</div><div>. 2972 IN NS <a href="http://b.root-servers.net" target="_blank">b.root-servers.net</a>.</div><div>. 2972 IN NS <a href="http://g.root-servers.net" target="_blank">g.root-servers.net</a>.</div><div>. 2972 IN NS <a href="http://e.root-servers.net" target="_blank">e.root-servers.net</a>.</div><div>. 2972 IN NS <a href="http://k.root-servers.net" target="_blank">k.root-servers.net</a>.</div><div>. 2972 IN NS <a href="http://f.root-servers.net" target="_blank">f.root-servers.net</a>.</div><div>. 2972 IN NS <a href="http://d.root-servers.net" target="_blank">d.root-servers.net</a>.</div><div>. 2972 IN NS <a href="http://l.root-servers.net" target="_blank">l.root-servers.net</a>.</div><div><br></div><div>;; Query time: 128 msec</div></div><div><br></div><div><br></div><div>Any clue why this is happening?</div><div><br></div></div>
</div><br></div>