IP based RPZ file application

[SuhaniPatel88]

Hey all...

• I have a doubt regarding the recursor. I have been assigned a task to write a Lua script for recursor which can load two custom rpz files (one blacklist and another whitelist) per IP address along with two global rpz files. I have not been able to make logic work in Lua for it. It's like I want only 4 lists to work per request( 2 custom and 2 global lists) and discard the rest which are meant for other IPs. Also, it is to be further expanded for multiple IPs as well.

---

• Here's the script that I tried:

local custom_lists = {
    ["<ip_address>"] = {
        whitelist = "/etc/powerdns/rpz/ip1-whitelist.rpz",
        blacklist = "/etc/powerdns/rpz/ip1-blacklist.rpz"
    },
    ["<ip-address>"] = {
        whitelist = "/etc/powerdns/rpz/ip2-whitelist.rpz",
        blacklist = "/etc/powerdns/rpz/ip2-blacklist.rpz"
    }
}


for ip, config in pairs(custom_lists) do
    rpzFile(config.whitelist, {
        policyName = "CUSTOM-"..ip.."-WHITELIST",
        defpol = Policy.PASSTHRU,
    })

    rpzFile(config.blacklist, {
        policyName = "CUSTOM-"..ip.."-BLACKLIST",
        defpol = Policy.NXDOMAIN,
    })
end


rpzFile("/etc/powerdns/whitelist.rpz", {
    policyName = "GLOBAL-WHITELIST",
    defpol = Policy.PASSTHRU
})

rpzFile("/etc/powerdns/blacklist.rpz", {
    policyName = "GLOBAL-BLACKLIST",
    defpol = Policy.NXDOMAIN
})



function preresolve(dq)
    local client_ip = dq.remoteaddr:toString()
    local allowed_policies = {}

    if custom_lists[client_ip] then
        table.insert(allowed_policies, "CUSTOM-"..client_ip.."-WHITELIST")
        table.insert(allowed_policies, "CUSTOM-"..client_ip.."-BLACKLIST")
    end

    table.insert(allowed_policies, "GLOBAL-WHITELIST")
    table.insert(allowed_policies, "GLOBAL-BLACKLIST")


    if dq.appliedPolicy then
        for _, policy in ipairs(dq.appliedPolicy.policyName) do
            local pname = policy.policyName
            local allowed = false
            for _, allowed_name in ipairs(allowed_policies) do
                if pname == allowed_name then
                    allowed = true
                    break
                end
            end
            if not allowed then
                dq:discardPolicy(pname)
            end
        end
    end

    return false
end

---

• I have tried disabling pdns cache as well, but that didn't help! My hunch is, there's some issue with preresolve function and it's not even being called, but then again, I don't know, I am new to this.
• I am also sharing an easier hard-coded version of the above mentioned script, that didn't work either.

---

rpzFile("/etc/powerdns/rpz/ip1-whitelist.rpz", { policyName = "CUSTOM-<ip_address>-WHITELIST" })
rpzFile("/etc/powerdns/rpz/ip2-whitelist.rpz", { policyName = "CUSTOM-<ip_address>-WHITELIST" })
rpzFile("/etc/powerdns/rpz/ip1-blacklist.rpz", { policyName = "CUSTOM-<ip_address>-BLACKLIST" })
rpzFile("/etc/powerdns/rpz/ip2-blacklist.rpz", { policyName = "CUSTOM-<ip-address>-BLACKLIST" })




rpzFile("/etc/powerdns/whitelist.rpz", {
    policyName = "GLOBAL-WHITELIST",
    defpol = Policy.PASSTHRU
})

rpzFile("/etc/powerdns/blacklist.rpz", {
    policyName = "GLOBAL-BLACKLIST",
    defpol = Policy.NXDOMAIN
})



function policyEventFilter(event)
        local client_ip = event.remote:toString()
        if client_ip == "<ip_address>" then
                event:discardPolicy("CUSTOM-<ip_address>-WHITELIST")
                event:discardPolicy("CUSTOM-<ip_address> -BLACKLIST")
        else
                event:discardPolicy("CUSTOM-<ip_address>-WHITELIST")
                event:discardPolicy("CUSTOM-<ip_address>-BLACKLIST")
        end
 
end

---

• Is it possible in POWERDNS RECURSOR to do so? If yes, then please do help me out!!!!