rebinding: log each blocked request only in verbose mode

Also the log now uses the same format query UID format as elsewhere.

diff --git a/NEWS b/NEWS
index 51cd5fe12d18a02aa1f4fd226eeae0605132dfd5..1a6d7a86e611bfa4f10bcc86b41920ec39a69268 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -26,6 +26,7 @@ Bugfixes
 - prefill module: avoid crash on empty zone file (#474, !840)
 - rebinding module: avoid excessive iteration on blocked attempts (!842)
 - rebinding module: fix crash caused by race condition (!842)
+- rebinding module: log each blocked query only in verbose mode (!842)
 
 
 Knot Resolver 4.0.0 (2019-04-18)

diff --git a/daemon/lua/kres-gen.lua b/daemon/lua/kres-gen.lua
index aecd4cff533d297eeea5095562c4acaaa7052ac2..02e3ea2b8bf7b2ecef07cc5e75f1ca3f89b88c13 100644 (file)
--- a/daemon/lua/kres-gen.lua
+++ b/daemon/lua/kres-gen.lua
@@ -336,6 +336,7 @@ int kr_rplan_pop(struct kr_rplan *, struct kr_query *);
 struct kr_query *kr_rplan_resolved(struct kr_rplan *);
 struct kr_query *kr_rplan_last(struct kr_rplan *);
 int kr_nsrep_set(struct kr_query *, size_t, const struct sockaddr *);
+void kr_log_qverbose_impl(const struct kr_query *, const char *, const char *, ...);
 int kr_make_query(struct kr_query *, knot_pkt_t *);
 void kr_pkt_make_auth_header(knot_pkt_t *);
 int kr_pkt_put(knot_pkt_t *, const knot_dname_t *, uint32_t, uint16_t, uint16_t, const uint8_t *, uint16_t);

diff --git a/daemon/lua/kres-gen.sh b/daemon/lua/kres-gen.sh
index 118c63334dba832cfd674bd55642f4ac808559f3..b0ac3de15dbc090eb6085e0e45bca565ff5b9ad9 100755 (executable)
--- a/daemon/lua/kres-gen.sh
+++ b/daemon/lua/kres-gen.sh
@@ -186,6 +186,7 @@ ${CDEFS} ${LIBKRES} functions <<-EOF
 # Nameservers
        kr_nsrep_set
 # Utils
+       kr_log_qverbose_impl
        kr_make_query
        kr_pkt_make_auth_header
        kr_pkt_put

diff --git a/modules/rebinding/rebinding.lua b/modules/rebinding/rebinding.lua
index 372295fe650e58d1c84c0dc5e0a86e773c5ad616..1252549a2bc89514ec9d47404b5462581d7421ce 100644 (file)
--- a/modules/rebinding/rebinding.lua
+++ b/modules/rebinding/rebinding.lua
@@ -1,3 +1,5 @@
+local ffi = require('ffi')
+
 -- Protection from DNS rebinding attacks
 local kres = require('kres')
 local renumber = require('kres_modules.renumber')
@@ -101,9 +103,12 @@ function M.layer.consume(state, req, pkt)
        qry.flags.RESOLVED = 1  -- stop iteration
        qry.flags.CACHED = 1  -- do not cache
        refuse(req)
-       log('[' .. string.format('%5d', qry.id) .. '][rebinding] '
-           .. 'blocking blacklisted IP \'' .. kres.rr2str(bad_rr)
-           .. '\' received from IP ' .. tostring(kres.sockaddr_t(req.upstream.addr)))
+       if verbose() then
+               ffi.C.kr_log_qverbose_impl(qry, 'rebinding',
+                   'blocking blacklisted IP in RR \'%s\' received from IP %s\n',
+                   kres.rr2str(bad_rr),
+                   tostring(kres.sockaddr_t(req.upstream.addr)))
+       end
        return kres.DONE
 end