Internet exposure checks and response rate limiting
Jarl works out which views are reachable from the internet (match-clients
ending in a catch-all, not private-looking addresses: an internal view of a
global IPv6 prefix is still yours; a server without views: open allow-query
and a non-private listen address), with a per-view override (schema 9), and
checks public ones: rate limiting, open resolver, minimal-any, cache
snooping, open NOTIFY and transfers, version and host name, management
interfaces. Fixes are staged like any change, including rate limiting from
ISC's example in log-only mode with the secondaries exempt, then enforcing.
named logs what rate limiting limits (or would, in log-only mode, where its
counters don't move) as query-errors; Jarl routes those lines to its log
and counts them (rrl breakdown, ratelimited top lists, Prometheus
jarl_ratelimit_logged_total), shown on the new Exposure page.
A change that newly opens a public view up must be confirmed (accept_risk,
--accept-risk, a checkbox on the Changes page; 409 confirm_risk
otherwise). Findings can be acknowledged with a reason and stay visible as
info. GET /exposure, POST /exposure/fix|ack|unack, jarl exposure,
docs/exposure.md.
Also fixes query statistics skipping TSIG-signed queries ("IP#port/key
NAME" in named's log).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
adamandClaude Opus 5.5 committed
1 parent
cf550bd512
commit
bdd7acfd3b
50 files changed
+2019
-52
No files matched your search
@@ -26,10 +26,15 @@ const (
|
||||
KindBlocked = "blocked" // names blocked (docs/blocking.md)
|
||||
// KindBlockedClient: clients with the most blocked queries.
|
||||
KindBlockedClient = "blocked_client"
|
||||
// KindRateLimited: client networks whose responses rate limiting
|
||||
// limited (or would have, in log-only mode); KindRateLimitedName: the
|
||||
// names and types they asked for (docs/exposure.md).
|
||||
KindRateLimited = "ratelimited"
|
||||
KindRateLimitedName = "ratelimited_name"
|
||||
)
|
||||
|
||||
// Kinds lists the top-list kinds.
|
||||
var Kinds = []string{KindName, KindClient, KindNXDomain, KindServFail, KindRefused, KindBlocked, KindBlockedClient}
|
||||
var Kinds = []string{KindName, KindClient, KindNXDomain, KindServFail, KindRefused, KindBlocked, KindBlockedClient, KindRateLimited, KindRateLimitedName}
|
||||
|
||||
// OtherZone is the zone key for names outside every local zone (answered
|
||||
// by recursion, or refused).
|
||||
@@ -337,6 +342,8 @@ func (c *Collector) handleLine(line string) {
|
||||
if !ok {
|
||||
if rw, ok := ParseRewrite(line, c.opts.Location); ok {
|
||||
c.handleRewrite(rw)
|
||||
} else if rl, ok := ParseRateLimit(line, c.opts.Location); ok {
|
||||
c.handleRateLimit(rl)
|
||||
}
|
||||
return
|
||||
}
|
||||
@@ -416,6 +423,30 @@ func (c *Collector) handleRewrite(rw Rewrite) {
|
||||
hours[hour][KindBlockedClient][clientKey(rw.Client, c.opts.Anonymize)]++
|
||||
}
|
||||
|
||||
// handleRateLimit counts a response rate limiting limited, or would have:
|
||||
// "rrl:drop", "rrl:slip", "rrl:would-drop" or "rrl:would-slip", and the
|
||||
// client network and name in the hour's top lists.
|
||||
func (c *Collector) handleRateLimit(rl RateLimit) {
|
||||
for _, p := range c.opts.Exclude {
|
||||
if p.Contains(rl.Client) {
|
||||
return
|
||||
}
|
||||
}
|
||||
key := "rrl:" + rl.Action
|
||||
if rl.Would {
|
||||
key = "rrl:would-" + rl.Action
|
||||
}
|
||||
minute, hour := c.minuteOf(rl.Time), c.hourOf(rl.Time)
|
||||
c.count(minute, key, 1)
|
||||
hours := c.hours
|
||||
if hour < c.liveHour {
|
||||
hours = c.late
|
||||
}
|
||||
hours[hour] = c.hourMaps(hours, hour)
|
||||
hours[hour][KindRateLimited][rl.Prefix]++
|
||||
hours[hour][KindRateLimitedName][rl.Name+" "+rl.Type]++
|
||||
}
|
||||
|
||||
// policySource names what a rewrite came from: a blocklist's name, "rules"
|
||||
// for the rules entered in Jarl, or the policy zone for others.
|
||||
func policySource(via string) string {
|
||||
|
||||
+41
-3
@@ -33,17 +33,55 @@ type Rewrite struct {
|
||||
//
|
||||
// 07-Oct-2026 19:46:22.195 client @0x7135... 10.10.0.37#51709 (nas.adbraun.lol): view internal: response: nas.adbraun.lol IN A NOERROR 1 0 1 +E(0)K (10.10.0.2)
|
||||
//
|
||||
// The "view NAME: " part is missing when no views are configured.
|
||||
var responseRe = regexp.MustCompile(`^(\d{2}-[A-Za-z]{3}-\d{4} \d{2}:\d{2}:\d{2}\.\d{3}) client @0x[0-9a-fA-F]+ (\S+)#(\d+) \(.*?\): (?:view (.+?): )?response: (\S+) (\S+) (\S+) ([A-Z0-9]+) `)
|
||||
// The "view NAME: " part is missing when no views are configured, and a
|
||||
// query signed with a TSIG key has "/key NAME" after the port.
|
||||
var responseRe = regexp.MustCompile(`^(\d{2}-[A-Za-z]{3}-\d{4} \d{2}:\d{2}:\d{2}\.\d{3}) client @0x[0-9a-fA-F]+ (\S+)#(\d+)(?:/key \S+)? \(.*?\): (?:view (.+?): )?response: (\S+) (\S+) (\S+) ([A-Z0-9]+) `)
|
||||
|
||||
// rewriteRe matches named's RPZ rewrite lines (category rpz), logged just
|
||||
// before the response line of the same query:
|
||||
//
|
||||
// 09-Oct-2026 23:49:13.698 client @0x7135... 10.10.0.37#54468 (ads.example): view internal: rpz QNAME NXDOMAIN rewrite ads.example/A/IN via ads.example.hagezi.blocklist.jarl.invalid
|
||||
var rewriteRe = regexp.MustCompile(`^(\d{2}-[A-Za-z]{3}-\d{4} \d{2}:\d{2}:\d{2}\.\d{3}) client @0x[0-9a-fA-F]+ (\S+)#(\d+) \((.*?)\): (?:view (.+?): )?rpz \S+ (\S+) rewrite \S+ via (\S+)`)
|
||||
var rewriteRe = regexp.MustCompile(`^(\d{2}-[A-Za-z]{3}-\d{4} \d{2}:\d{2}:\d{2}\.\d{3}) client @0x[0-9a-fA-F]+ (\S+)#(\d+)(?:/key \S+)? \((.*?)\): (?:view (.+?): )?rpz \S+ (\S+) rewrite \S+ via (\S+)`)
|
||||
|
||||
// rateLimitRe matches named's response rate limiting lines (category
|
||||
// query-errors), when it limits a response or, in log-only mode, would:
|
||||
//
|
||||
// 12-Oct-2026 09:56:35.996 client @0x70a2... 127.0.0.2#59296 (www.rrl.test): would rate limit slip response to 127.0.0.0/24 for www.rrl.test IN A (0ce833a4)
|
||||
var rateLimitRe = regexp.MustCompile(`^(\d{2}-[A-Za-z]{3}-\d{4} \d{2}:\d{2}:\d{2}\.\d{3}) client @0x[0-9a-fA-F]+ (\S+)#(\d+)(?:/key \S+)? \(.*?\): (?:view (.+?): )?(would )?rate limit (drop|slip) (?:\S+ )?response to (\S+) for (\S+) \S+ (\S+)`)
|
||||
|
||||
// RateLimit is a response that rate limiting dropped or slipped (sent
|
||||
// truncated, so a real client retries over TCP), or would have in
|
||||
// log-only mode.
|
||||
type RateLimit struct {
|
||||
Time time.Time
|
||||
Client netip.Addr
|
||||
View string
|
||||
Would bool // log-only: nothing was limited
|
||||
Action string // drop or slip
|
||||
Prefix string // the client network named counts, e.g. 192.0.2.0/24
|
||||
Name string // the query name, normalized like Event.Name
|
||||
Type string
|
||||
}
|
||||
|
||||
const logTimeLayout = "02-Jan-2006 15:04:05.000"
|
||||
|
||||
// ParseRateLimit parses a rate limiting log line.
|
||||
func ParseRateLimit(line string, loc *time.Location) (rl RateLimit, ok bool) {
|
||||
m := rateLimitRe.FindStringSubmatch(line)
|
||||
if m == nil {
|
||||
return rl, false
|
||||
}
|
||||
t, err := time.ParseInLocation(logTimeLayout, m[1], loc)
|
||||
if err != nil {
|
||||
return rl, false
|
||||
}
|
||||
client, err := netip.ParseAddr(m[2])
|
||||
if err != nil {
|
||||
return rl, false
|
||||
}
|
||||
return RateLimit{Time: t, Client: client.Unmap(), View: m[4], Would: m[5] != "", Action: m[6], Prefix: m[7], Name: normalizeName(m[8]), Type: m[9]}, true
|
||||
}
|
||||
|
||||
// ParseResponse parses a response log line. ok is false for other lines
|
||||
// (named also logs to the channel when it starts and rotates files).
|
||||
func ParseResponse(line string, loc *time.Location) (ev Event, ok bool) {
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
package stats
|
||||
|
||||
import (
|
||||
"net/netip"
|
||||
"testing"
|
||||
"time"
|
||||
)
|
||||
@@ -42,3 +43,44 @@ func TestParseResponse(t *testing.T) {
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestParseRateLimit(t *testing.T) {
|
||||
loc := time.UTC
|
||||
for _, tc := range []struct {
|
||||
line string
|
||||
want RateLimit
|
||||
views bool
|
||||
}{
|
||||
{line: "12-Oct-2026 09:56:35.996 client @0x70a247adf000 127.0.0.2#59296 (www.rrl.test): would rate limit slip response to 127.0.0.0/24 for www.rrl.test IN A (0ce833a4)",
|
||||
want: RateLimit{Would: true, Action: "slip", Prefix: "127.0.0.0/24", Name: "www.rrl.test", Type: "A"}},
|
||||
{line: "12-Oct-2026 09:56:38.303 client @0x7eee390df000 127.0.0.2#35687 (www.rrl.test): rate limit drop response to 127.0.0.0/24 for www.rrl.test IN A (0ce833a4)",
|
||||
want: RateLimit{Action: "drop", Prefix: "127.0.0.0/24", Name: "www.rrl.test", Type: "A"}},
|
||||
{line: "12-Oct-2026 09:56:38.303 client @0x7eee390df000 2001:db8::7#35687 (Adbraun.lol): view external: rate limit drop response to 2001:db8::/56 for adbraun.lol IN ANY (0ce833a4)",
|
||||
want: RateLimit{View: "external", Action: "drop", Prefix: "2001:db8::/56", Name: "adbraun.lol", Type: "ANY"}},
|
||||
} {
|
||||
rl, ok := ParseRateLimit(tc.line, loc)
|
||||
rl.Time, rl.Client = time.Time{}, netip.Addr{}
|
||||
if !ok || rl != tc.want {
|
||||
t.Errorf("%s:\n got %+v %v\nwant %+v", tc.line, rl, ok, tc.want)
|
||||
}
|
||||
}
|
||||
if _, ok := ParseRateLimit("12-Oct-2026 09:56:35.996 rate-limit: info: would limit responses to 127.0.0.0/24 for www.rrl.test IN A (0ce833a4)", loc); ok {
|
||||
t.Error("the start-of-limiting line counted as a response")
|
||||
}
|
||||
}
|
||||
|
||||
// Signed queries have "/key NAME" after the client's port.
|
||||
func TestParseSigned(t *testing.T) {
|
||||
loc := time.UTC
|
||||
ev, ok := ParseResponse("12-Oct-2026 10:11:06.490 client @0x7a22f754b000 127.0.0.1#34745/key jarl-view-external (ns1.adbraun.test): view external: response: ns1.adbraun.test IN A NOERROR 1 0 2 +E(0)SK (127.0.0.1)", loc)
|
||||
if !ok || ev.View != "external" || ev.Name != "ns1.adbraun.test" || ev.Port != "34745" {
|
||||
t.Errorf("signed response = %+v %v", ev, ok)
|
||||
}
|
||||
rl, ok := ParseRateLimit("12-Oct-2026 10:11:06.599 client @0x7a22f754b000 127.0.0.1#34856/key jarl-view-external (ns1.adbraun.test): view external: would rate limit slip response to 127.0.0.0/24 for ns1.adbraun.test IN A (e777e288)", loc)
|
||||
if !ok || rl.View != "external" || !rl.Would || rl.Action != "slip" || rl.Prefix != "127.0.0.0/24" {
|
||||
t.Errorf("signed rate limit = %+v %v", rl, ok)
|
||||
}
|
||||
if _, ok := ParseRewrite("09-Oct-2026 23:49:13.089 client @0x7bd607320000 127.0.0.1#56905/key k1 (x.ads.example): view internal: rpz QNAME NXDOMAIN rewrite x.ads.example/A/IN via x.ads.example.rules.jarl.invalid", loc); !ok {
|
||||
t.Error("signed rewrite not parsed")
|
||||
}
|
||||
}
|
||||
@@ -256,7 +256,7 @@ func (q *Querier) Breakdown(ctx context.Context, group string, since time.Durati
|
||||
}
|
||||
|
||||
// Groups are the counter groups Breakdown accepts.
|
||||
var Groups = []string{"qtype", "rcode", "view", "zone", "answer", "transport", "rtt", "dnssec", "cache", "ratelimit", "blocklist"}
|
||||
var Groups = []string{"qtype", "rcode", "view", "zone", "answer", "transport", "rtt", "dnssec", "cache", "ratelimit", "rrl", "blocklist"}
|
||||
|
||||
// Timeline is a set of series over time.
|
||||
type Timeline struct {
|
||||
|
||||
Reference in new issue
Block a user