Skip to content

Commit 5343c54

Browse files
benyamin-codezbenyamin-codez
committed
dns/bind: Fixup and feature expansion
a) Fixes zone_test b) Fixes command truncation in grid-primary-domains c) General tab help expansion and formatting d) General tab option grouping e) Converts NetworkType to ACLs where BIND uses Address Match Lists f) Reformats named.conf (spacing and layout) g) Adds listen-on-v6 { none; } when IPv6 is disabled (likely superflous) h) Adds other rate-limiting options i) Adds recursion no; option for authoritative servers j) Adds allow-query-cache option as this also controls recursion Signed-off-by: benyamin-codez <[email protected]>
1 parent dc0d1c3 commit 5343c54

File tree

4 files changed

+410
-99
lines changed

4 files changed

+410
-99
lines changed

‎dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/forms/general.xml‎

Lines changed: 172 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -9,29 +9,31 @@
99
<id>general.disablev6</id>
1010
<label>Disable IPv6</label>
1111
<type>checkbox</type>
12-
<help>This will run BIND in IPv4-only mode.</help>
12+
<help>This will cause BIND to run in IPv4-only mode.</help>
1313
</field>
1414
<field>
1515
<id>general.listenv4</id>
16-
<label>Listen IPs</label>
17-
<style>tokenize</style>
16+
<label>Listener IP Addresses (IPv4)</label>
1817
<type>select_multiple</type>
19-
<allownew>true</allownew>
20-
<help>Set the IPv4 addresses the service should listen to.</help>
18+
<help><![CDATA[
19+
Set ACLs defining IPv4 addresses the BIND service should listen on.
20+
<br/>The default is all IPv4 addresses on the host, i.e. { any; }.
21+
]]></help>
2122
</field>
2223
<field>
2324
<id>general.listenv6</id>
24-
<label>Listen IPv6</label>
25-
<style>tokenize</style>
25+
<label>Listener IP Addresses (IPv6)</label>
2626
<type>select_multiple</type>
27-
<allownew>true</allownew>
28-
<help>Set the IPv6 addresses the service should listen to.</help>
27+
<help><![CDATA[
28+
Set ACLs defining IPv6 addresses the BIND service should listen on.
29+
<br/>The default is all IPv6 addresses on the host, i.e. { any; } except when IPv6 is disabled which uses { none; }.
30+
]]></help>
2931
</field>
3032
<field>
3133
<id>general.port</id>
32-
<label>Listen Port</label>
34+
<label>Listen on Port</label>
3335
<type>text</type>
34-
<help>Set the port the service should listen to.</help>
36+
<help>Set the port the BIND service should listen on.</help>
3537
</field>
3638
<field>
3739
<id>general.querysource</id>
@@ -67,70 +69,71 @@
6769
<style>tokenize</style>
6870
<type>select_multiple</type>
6971
<allownew>true</allownew>
70-
<help>Set one or more hosts to send your DNS queries if the request is unknown.</help>
72+
<help>Set one or more hosts to send your DNS queries to if the request is unknown.</help>
7173
</field>
7274
<field>
7375
<id>general.filteraaaav4</id>
7476
<label>Enable filter-aaaa on IPv4 Clients</label>
7577
<type>checkbox</type>
76-
<help>This will filter AAAA records on IPv4 Clients. Set "DNSSEC Validation" to "No" and AAAA records will be omitted even if they are signed.</help>
78+
<help><![CDATA[
79+
This will filter AAAA records on IPv4 Clients.
80+
<br/>Set "DNSSEC Validation" to "No" and AAAA records will be omitted even if they are signed.
81+
]]></help>
7782
</field>
7883
<field>
7984
<id>general.filteraaaav6</id>
8085
<label>Enable filter-aaaa on IPv6 Clients</label>
8186
<type>checkbox</type>
82-
<help>This will filter AAAA records on IPv6 Clients. Set "DNSSEC Validation" to "No" and AAAA records will be omitted even if they are signed.</help>
87+
<help><![CDATA[
88+
This will filter AAAA records on IPv6 Clients.
89+
<br/>Set "DNSSEC Validation" to "No" and AAAA records will be omitted even if they are signed.
90+
]]></help>
8391
</field>
8492
<field>
8593
<id>general.filteraaaaacl</id>
86-
<label>ACL for filter-aaaa</label>
87-
<style>tokenize</style>
94+
<label>ACLs for filter-aaaa</label>
8895
<type>select_multiple</type>
89-
<allownew>true</allownew>
90-
<help>Specifies a list of client addresses for which AAAA filtering is to be applied.</help>
96+
<help>Set ACLs for which AAAA filtering is to be applied. The default is { any; }.</help>
9197
</field>
9298
<field>
9399
<id>general.logsize</id>
94100
<label>Logsize in MB</label>
95101
<type>text</type>
96-
<help>Set the amount how big a logfile can growth. For Query and Blocked logs.</help>
102+
<help>Set the amount how big a logfile can grow. For Query and Blocked logs.</help>
97103
</field>
98104
<field>
99105
<id>general.general_log_level</id>
100106
<label>General Log level</label>
101107
<style>selectpicker</style>
102108
<type>dropdown</type>
103-
<help>Select General Log level. Log levels are listed in the order of increasing verbosity. Setting a certain log level will cause all messages of the specified and more severe log levels to be logged.</help>
109+
<help><![CDATA[
110+
Select General Log level. Log levels are listed in the order of increasing verbosity.
111+
<br/>Setting a certain log level will cause all messages of the specified and more severe log levels to be logged.
112+
]]></help>
104113
</field>
105114
<field>
106115
<id>general.maxcachesize</id>
107116
<label>Maximum Cache Size</label>
108117
<type>text</type>
109-
<help>How much memory in percent the cache can use from the system. Default is 80%.</help>
110-
</field>
111-
<field>
112-
<id>general.recursion</id>
113-
<label>Recursion</label>
114-
<type>select_multiple</type>
115-
<help>Define an ACL where you allow which clients can resolve via this service. Usually use your local LAN.</help>
118+
<help>How much memory in percent the cache can use from the system. The default is 80%.</help>
116119
</field>
117120
<field>
118121
<id>general.allowtransfer</id>
119122
<label>Allow Transfer</label>
120123
<type>select_multiple</type>
121-
<help>Define the ACLs where you allow which server can retrieve zones.</help>
124+
<help>Set the ACLs to include hosts allowed to perform zones transfers.</help>
122125
</field>
123126
<field>
124127
<id>general.allowquery</id>
125128
<label>Allow Query</label>
126129
<type>select_multiple</type>
127-
<help>Define the ACLs where you allow which client are allowed to query this server.</help>
130+
<help>Set the ACLs from which you allow clients to query this server.</help>
128131
</field>
129132
<field>
130133
<id>general.dnssecvalidation</id>
131134
<label>DNSSEC Validation</label>
132135
<type>dropdown</type>
133-
<help>Default is "No". Set to "Auto" to use the static trust anchor configuration by the system.</help>
136+
<help>Default is "No". Set to "Auto" to use the system static trust anchor configuration.</help>
134137
</field>
135138
<field>
136139
<id>general.hidehostname</id>
@@ -153,28 +156,158 @@
153156
<advanced>true</advanced>
154157
<help>This will disable prefetching of domains before they time out.</help>
155158
</field>
159+
<field>
160+
<type>header</type>
161+
<label>Recursive Resolution</label>
162+
</field>
163+
<field>
164+
<id>general.enablerecursion</id>
165+
<label>Enable Recursive Resolution</label>
166+
<type>checkbox</type>
167+
<help>This will enable recursive resolution (default). Disable for public authoritative DNS servers.</help>
168+
</field>
169+
<field>
170+
<id>general.recursionallowedacls</id>
171+
<label>Recursion ACLs</label>
172+
<type>select_multiple</type>
173+
<help><![CDATA[
174+
Select ACLs for which you wish to enable recursive resolution.
175+
<br/>For public authoritative DNS servers, recursion should be disabled and this field left empty.
176+
<br/>For private recursive DNS servers, this is usually an ACL representing your local LAN.
177+
<br/>When recursion is enabled and no ACL is defined here or for allow-query-cache or allow-query, the
178+
<br/>builtin { localnets; localhost; } address list is used. Otherwise this field will default to the value
179+
<br/>found in allow-query-cache, or failing that, allow-query.
180+
]]></help>
181+
</field>
182+
<field>
183+
<id>general.allowcachequeries</id>
184+
<label>Cache Query ACLs</label>
185+
<advanced>true</advanced>
186+
<type>select_multiple</type>
187+
<help><![CDATA[
188+
Select ACLs for which you wish to enable cache access. This effectively controls recursion.
189+
<br/>For public authoritative DNS servers, recursion should be disabled, and this field defaults to using {none;}.
190+
<br/>For private recursive DNS servers, use this field to override the defaults.
191+
<br/>When recursion is enabled and allow-recursion has an ACL set, the default will be the same ACL.
192+
<br/>Otherwise if allow-recursion has no ACL set, the default will be the { localnets; localhost; } address list.
193+
]]></help>
194+
</field>
195+
<field>
196+
<type>header</type>
197+
<label>Rate Limiting</label>
198+
<advanced>true</advanced>
199+
</field>
156200
<field>
157201
<id>general.enableratelimiting</id>
158202
<label>Enable Rate Limiting</label>
159203
<type>checkbox</type>
160204
<advanced>true</advanced>
161-
<help>This will enable rate-limiting for DNS replies.</help>
205+
<help>This will enable rate-limiting for DNS responses.</help>
162206
</field>
163207
<field>
164-
<id>general.ratelimitcount</id>
165-
<label>Rate Limit Replies</label>
208+
<id>general.ratelimitrespps</id>
209+
<label>Responses Per Second</label>
166210
<type>text</type>
167211
<advanced>true</advanced>
168-
<help>Set how many replies per second are allowed.</help>
212+
<help><![CDATA[Set how many non-empty responses are allowed per second for valid domain names and record types.<br/>The default is 0 or no limit.]]></help>
169213
</field>
170214
<field>
171-
<id>general.ratelimitexcept</id>
172-
<label>Rate Limit Exceptions</label>
173-
<style>tokenize</style>
215+
<id>general.ratelimitwindow</id>
216+
<label>Window</label>
217+
<type>text</type>
218+
<advanced>true</advanced>
219+
<help>Set the number of second during which responses are tracked. The default is 15 seconds.</help>
220+
</field>
221+
<field>
222+
<id>general.ratelimitexempt</id>
223+
<label>Exempt Clients</label>
174224
<type>select_multiple</type>
175-
<allownew>true</allownew>
176225
<advanced>true</advanced>
177-
<help>Except a list of IPs from rate-limiting like ::1</help>
226+
<help>Set ACLs where rate-limiting should not apply.</help>
227+
</field>
228+
<field>
229+
<id>general.ratelimitipv4prefixlength</id>
230+
<label>IPv4 Prefix Length</label>
231+
<type>text</type>
232+
<advanced>true</advanced>
233+
<help>Set the number of bits of the address block. Used to distinquish clients into a rate-limited group. The default is 24.</help>
234+
</field>
235+
<field>
236+
<id>general.ratelimitipv6prefixlength</id>
237+
<label>IPv6 Prefix Length</label>
238+
<type>text</type>
239+
<advanced>true</advanced>
240+
<help>Set the number of bits of the address block. Used to distinquish clients into a rate-limited group. The default is 56.</help>
241+
</field>
242+
<field>
243+
<id>general.ratelimitnodataps</id>
244+
<label>NODATA Responses Per Second</label>
245+
<type>text</type>
246+
<advanced>true</advanced>
247+
<help><![CDATA[Set how many empty (NODATA) responses are allowed per second for valid domain names.<br/>The default is equal to the Responses Per Second value.]]></help>
248+
</field>
249+
<field>
250+
<id>general.ratelimitnxdomsps</id>
251+
<label>NXDOMAIN Responses Per Second</label>
252+
<type>text</type>
253+
<advanced>true</advanced>
254+
<help><![CDATA[Set how many NXDOMAIN errors are allowed per second for undefined subdomains for valid domain names.<br/>The default is equal to the Responses Per Second value.]]></help>
255+
</field>
256+
<field>
257+
<id>general.ratelimitrefsps</id>
258+
<label>Referrals Per Second</label>
259+
<type>text</type>
260+
<advanced>true</advanced>
261+
<help><![CDATA[Set how many referrals or delegations are allowed per second to a server for a given domain.<br/>The default is equal to the Responses Per Second value.]]></help>
262+
</field>
263+
<field>
264+
<id>general.ratelimiterrsps</id>
265+
<label>Errors Per Second</label>
266+
<type>text</type>
267+
<advanced>true</advanced>
268+
<help><![CDATA[Set how many errors are allowed per second for valid domain names and record types.<br/>The default is equal to the Responses Per Second value.]]></help>
269+
</field>
270+
<field>
271+
<id>general.ratelimitallps</id>
272+
<label>All Per Second</label>
273+
<type>text</type>
274+
<advanced>true</advanced>
275+
<help><![CDATA[Set how many UDP responses of all types are allowed per second.<br/>If used, this should be set to 4 times the size of other per second limits.]]></help>
276+
</field>
277+
<field>
278+
<id>general.ratelimitslip</id>
279+
<label>Slip</label>
280+
<type>text</type>
281+
<advanced>true</advanced>
282+
<help>Set how many responses to "slip", reducing the use of forged source addresses in attacks. The default is 2.</help>
283+
</field>
284+
<field>
285+
<id>general.ratelimitscale</id>
286+
<label>QPS Scale</label>
287+
<type>text</type>
288+
<advanced>true</advanced>
289+
<help><![CDATA[Set the ratio by which to scale back the Responses Per Second value during attacks.<br/>The formula is (qps-scale/total-query-rate)*responses-per-second to produce the new value.]]></help>
290+
</field>
291+
<field>
292+
<id>general.ratelimitmaxtbl</id>
293+
<label>Maximum Table Size</label>
294+
<type>text</type>
295+
<advanced>true</advanced>
296+
<help>Set the maximum number of table entries used to track requests and rate-limit responses. The default is 20,000.</help>
297+
</field>
298+
<field>
299+
<id>general.ratelimitmintbl</id>
300+
<label>Minimum Table Size</label>
301+
<type>text</type>
302+
<advanced>true</advanced>
303+
<help>Set the minimum number of table entries used to track requests and rate-limit responses. The default is 500.</help>
304+
</field>
305+
<field>
306+
<id>general.ratelimittry</id>
307+
<label>Trial Rate Limiting</label>
308+
<type>checkbox</type>
309+
<advanced>true</advanced>
310+
<help>Enable to test rate-limiting parameters without actually dropping any requests.</help>
178311
</field>
179312
<field>
180313
<type>header</type>

0 commit comments

Comments
 (0)