Unbound DNS vulnerability exploit DDOS attack

[mimugmail]

There are plenty of regexp, but I need the original content.

https://github.com/opnsense/core/blob/master/src/opnsense/scripts/unbound/download_blacklists.py

[schnipp]

Add the mentioned URL to a dummy list (e.g. Easy List) and hand it over to the configuration script. Then look, what happens 

[Patrick M. Hausen]

But the question is "how did that URL get into the list in the first place?"
Garbage in - garbage out. I won't expect unbound to gracefully skip syntactically incorrect config statements.

In my own installation e.g. the "Blocklist.site <something>" lists never worked for me and just crashed unbound. I am only using Ad*, Easy*, NoCoin, Simple*, Steven and Yoyo for that reason.

[Fright]

imho
it's definitely garbage on dnsbl record. something like

Code: [Select]

"0.0.0.0 adelogs.adobe.com  ister.co.uk/2014/10/07/adobe_digital_editions_4_caught_snooping_into_ebook_collections_of_users/ #See http://www.theregister.co.uk/2014/10/07/adobe_digital_editions_4_caught_snooping_into_ebook_collections_of_users/"but perhaps it makes sense to make it with temporary dnsbl.conf file? check it with unbound-checkconf  (it doesn't check FQDN syntax, but at least it will catch the  label length  overflow error) and copy to dnsbl.conf?

[schnipp]

But the question is "how did that URL get into the list in the first place?"

In my eyes this doesn't matter because the lists' intended use cases are manifold. It could be a copy and paste error made by humans

[mimugmail]

imho
it's definitely garbage on dnsbl record. something like

Code: [Select]

"0.0.0.0 adelogs.adobe.com  ister.co.uk/2014/10/07/adobe_digital_editions_4_caught_snooping_into_ebook_collections_of_users/ #See http://www.theregister.co.uk/2014/10/07/adobe_digital_editions_4_caught_snooping_into_ebook_collections_of_users/"but perhaps it makes sense to make it with temporary dnsbl.conf file? check it with unbound-checkconf  (it doesn't check FQDN syntax, but at least it will catch the  label length  overflow error) and copy to dnsbl.conf?

Do you know the list which includes it?

[marunjar]

Unfortunately these blocklists definitely may contain garbage data.
Additionaly they use different formats, which may be the reason why "NoCoin" works and "Blocklist.site <something>" doesn't.

• NoCoin: https://justdomains.github.io/blocklists/lists/nocoin-justdomains.txt
  uses simple domains
  
• Blocklist.site: eg. https://blocklistproject.github.io/Lists/malware.txt
  uses 0.0.0.0 + domain
  
• Adaway: https://adaway.org/hosts.txt
  uses 127.0.0.1 + domain, this list also contains entries for localhost which should never find it's way into generated dnsbl.conf
  

As far as i can see filtering of blocklist entries got lost when refactoring download script which happened with these commits:
https://github.com/opnsense/core/commit/5a364f741ce12ada6351a4cdcbeb0cf628c15ab3
https://github.com/opnsense/core/commit/f16b67232c6000137f210eba8567a8abe46d9b1d

[mimugmail]

I have chosen EVERY blocklist site, but no match on this entry

[Fright]

@mimugmail

Do you know the list which includes it?

I wish I knew )
I also want to test regex for whitelist )
and wondering why default_pattern_2 not working for this
(although there is a feeling that default_pattern_2 not entirely correct for fqdn syntax check)
but nevertheless, i think a "broken" fqdn is possible that satisfies the "right" regexp, but overflows the label length imho.
so unbound-checkconf would not be useless

[Fright]

test bad dnsbl:
--no more link here--
should import just one string.
now imports everything

[Fright]

seems to work (does not import broken records) with this regex in Blacklist-whitelist domain

Code: [Select]

^(?![a-zA-Z0-9._-]+$)imho may work as a temporary workaround
expressions like:
https://www.regextester.com/103452
https://regexr.com/3g5j0
(inverted)
filter out even more garbage records. but cannot be added via GUI

[Fright]

some test results
added

Code: [Select]

# exclude substandard and garbage entries
default_pattern_4=^(?!(?=^.{4,253}$)(^((?!-)[a-zA-Z0-9-_]{0,62}[a-zA-Z0-9]\.)+[a-zA-Z0-9-]{2,63}[\.]?$))
to blacklist template to filter broken and substandard  entries
check on "Blocklist.site Malware" dnsbl: 1108  of  456375 entries filtered (IPs and substandard  entries).
filtered entries attached

[schnipp]

filtered entries attached

The garbage list looks fine but contains some valid entries (e.g. securelogin.paypal.it.webapps.mpp.home.autenticazione.cfrsfp8hcpkwdzsetpo8vir0wi1t64yyfq5knbn4ckw231kifi4nz3a9st5m.jafinafara.f).

[Fright]

have you tried to resolve\use this fqdns?
afaik tld min length is 2
i think its parsing error on dnsbl side.
full fqdn was:
https://vulners.com/rst/RST:E77B01C1-CBC6-3AC1-91C0-2825F87F434C

[schnipp]

afaik tld min length is 2

That's not correct. FQDNs consist of one or more labels, where each label consists of at least one letter or digit. It's a decision of IANA that nowadays no one character TLDs are existing. But the tech specs still allow them.

A detailed description and restrictions can be found in rfc1035, rfc1123, rfc1912.