knot resolver: Load custom RPZs using the legacy engine

The new ruledb engine does not support the PASS action which is why we
will have to load this as a custom action into the workers. The extra
overhead of this is minimal.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

diff --git a/config/knot-resolver/config.lua b/config/knot-resolver/config.lua
index 39c4833212feb689b6a5bde149c844f368aec0e0..31f97c07396834b54d4bc6ded9e817b723cfe96b 100644 (file)
--- a/config/knot-resolver/config.lua
+++ b/config/knot-resolver/config.lua
@@ -559,4 +559,58 @@ function config.load_rpzs()
        end
 end
 
+local __policy_pass = {}
+local __policy_deny = {}
+
+function config.load_rpz_workaround()
+       local names_pass = {}
+       local names_deny = {}
+
+       -- Clear any previous rules
+       if __policy_pass then
+               policy.del(__policy_pass.id)
+               __policy_pass = {}
+       end
+
+       if __policy_deny then
+               policy.del(__policy_deny.id)
+               __policy_deny = {}
+       end
+
+       local f = csv.open("/var/ipfire/dns/custom_domains", { separator = "," })
+       if f then
+               -- Append all entries
+               for fields in f:lines() do
+                       local name, status = unpack(fields)
+                       local redirect
+
+                       if status == "allowed" then
+                               table.insert(names_pass, name)
+                       elseif status == "blocked" then
+                               table.insert(names_deny, name)
+                       end
+               end
+
+               -- Add allowed names
+               if names_pass then
+                       __policy_pass = policy.add(
+                               policy.suffix(
+                                       policy.PASS,
+                                       policy.todnames(names_pass)
+                               )
+                       )
+               end
+
+               -- Add denied names
+               if names_deny then
+                       __policy_deny = policy.add(
+                               policy.suffix(
+                                       policy.DENY,
+                                       policy.todnames(names_deny)
+                               )
+                       )
+               end
+       end
+end
+
 return config

diff --git a/config/knot-resolver/config.yaml b/config/knot-resolver/config.yaml
index 1cee0df1eef8a344e8b135298e983398e35d6cd3..989319cebda525460266ea4444f85801f7470211 100644 (file)
--- a/config/knot-resolver/config.yaml
+++ b/config/knot-resolver/config.yaml
@@ -48,6 +48,9 @@ lua:
     -- Load DHCP Leases Lookup
     config.load_leases()
 
+    -- Load custom RPZ allowlist workaround
+    config.load_rpz_workaround()
+
     -- Load Forwarders
     config.load_forwarders(settings)