Files
jarl/internal/render/stats.go
T
adamandClaude Opus 5.5 bdd7acfd3b Internet exposure checks and response rate limiting
Jarl works out which views are reachable from the internet (match-clients
ending in a catch-all, not private-looking addresses: an internal view of a
global IPv6 prefix is still yours; a server without views: open allow-query
and a non-private listen address), with a per-view override (schema 9), and
checks public ones: rate limiting, open resolver, minimal-any, cache
snooping, open NOTIFY and transfers, version and host name, management
interfaces. Fixes are staged like any change, including rate limiting from
ISC's example in log-only mode with the secondaries exempt, then enforcing.
named logs what rate limiting limits (or would, in log-only mode, where its
counters don't move) as query-errors; Jarl routes those lines to its log
and counts them (rrl breakdown, ratelimited top lists, Prometheus
jarl_ratelimit_logged_total), shown on the new Exposure page.

A change that newly opens a public view up must be confirmed (accept_risk,
--accept-risk, a checkbox on the Changes page; 409 confirm_risk
otherwise). Findings can be acknowledged with a reason and stay visible as
info. GET /exposure, POST /exposure/fix|ack|unack, jarl exposure,
docs/exposure.md.

Also fixes query statistics skipping TSIG-signed queries ("IP#port/key
NAME" in named's log).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-12 10:38:56 +01:00

130 lines
4.2 KiB
Go

package render
import (
"net/netip"
"strconv"
"strings"
"jarl/internal/model"
"jarl/internal/namedconf"
)
// Extras are additions to named's configuration that come from jarld's
// own configuration (jarl.yaml) rather than from the database.
type Extras struct {
// Stats, when set, makes named publish what Jarl's statistics
// collector reads.
Stats *StatsHooks
// ViewKeySeed, when set, gives every view a TSIG key that selects it
// (viewkeys.go).
ViewKeySeed []byte
}
// StatsHooks describe the statistics channel and response log Jarl needs.
type StatsHooks struct {
Channel netip.AddrPort // statistics-channels address (loopback)
LogFile string // response log; "" disables response logging
LogVersions int
LogSize string
}
// StatsChannelName is the logging channel Jarl adds for responses.
const StatsChannelName = "jarl_responses"
const statsComment = "Added by Jarl for query statistics (stats in /etc/jarl/jarl.yaml)."
// statsInet is the statistics-channels clause for the collector.
func (h *StatsHooks) statsInet() *namedconf.Stmt {
addr := h.Channel.Addr().String()
return namedconf.NewStmt("inet", addr, "port", strconv.Itoa(int(h.Channel.Port())),
"allow", namedconf.NewBlock(namedconf.NewStmt(addr)))
}
// logChannel is the logging channel the response log is written to.
func (h *StatsHooks) logChannel() *namedconf.Stmt {
return namedconf.NewStmt("channel", StatsChannelName, namedconf.NewBlock(
namedconf.NewStmt("file", namedconf.Quoted(h.LogFile), "versions", strconv.Itoa(h.LogVersions), "size", h.LogSize),
namedconf.NewStmt("print-time", "yes"),
namedconf.NewStmt("severity", "info"),
))
}
// statsStatement returns the statistics-channels statement, merged into the
// user's own if there is one.
func (h *StatsHooks) statsStatement(user *model.Option) string {
if user != nil {
if st, err := namedconf.ParseOptionValue(user.Name, user.Value); err == nil && st.FirstBlock() != nil {
b := st.FirstBlock()
want := namedconf.CompactStmt(h.statsInet())
for _, s := range b.Stmts {
if namedconf.CompactStmt(s) == want {
return optionText(user, 0)
}
}
b.Stmts = append(b.Stmts, h.statsInet())
return commentLines(user.Comment) + commentBlock("//", statsComment) + formatStmt(st, 0)
}
// Unparsable: validation reports it; leave it alone.
return optionText(user, 0)
}
st := namedconf.NewStmt("statistics-channels", namedconf.NewBlock(h.statsInet()))
return commentBlock("//", statsComment) + formatStmt(st, 0)
}
// loggingStatement returns the logging statement with Jarl's channel and
// the responses category (rpz too, for blocking's rewrites, and
// query-errors for rate limiting), merged into the user's own if there is
// one.
func (h *StatsHooks) loggingStatement(user *model.Option, rpz, rrl bool) string {
var st *namedconf.Stmt
if user != nil {
var err error
st, err = namedconf.ParseOptionValue(user.Name, user.Value)
if err != nil || st.FirstBlock() == nil {
return optionText(user, 0)
}
} else {
st = namedconf.NewStmt("logging", namedconf.NewBlock())
}
b := st.FirstBlock()
// Channels must be defined before the categories that use them.
b.Stmts = append([]*namedconf.Stmt{h.logChannel()}, b.Stmts...)
categories := []string{"responses"}
if rpz {
categories = append(categories, "rpz")
}
if rrl {
categories = append(categories, "query-errors")
}
for _, cat := range categories {
merged := false
for _, s := range b.Stmts {
if s.Keyword() == "category" && strings.EqualFold(s.Arg(0), cat) && s.FirstBlock() != nil {
s.FirstBlock().Stmts = append(s.FirstBlock().Stmts, namedconf.NewStmt(StatsChannelName))
merged = true
}
}
if !merged {
channels := namedconf.NewBlock(namedconf.NewStmt(StatsChannelName))
if cat == "query-errors" {
// Naming the category takes it away from named's
// default destination: keep that too.
channels.Stmts = append(channels.Stmts, namedconf.NewStmt("default_syslog"))
}
b.Stmts = append(b.Stmts, namedconf.NewStmt("category", cat, channels))
}
}
prefix := ""
if user != nil {
prefix = commentLines(user.Comment)
}
return prefix + commentBlock("//", statsComment) + formatStmt(st, 0)
}
func commentLines(c string) string {
if c == "" {
return ""
}
return commentBlock("//", c)
}