github/portmaster
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Move LMS scoring from nameserver to firewall

Browse Source
This commit is contained in:
Patrick Pacher
2020-08-10 08:36:44 +02:00
parent b3657e17ce
commit 85e4beafa1
8 changed files with 53 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
nameserver/nameserver.go
View File

@@ -12,7 +12,6 @@ import (
"github.com/safing/portbase/log"
"github.com/safing/portbase/modules"
"github.com/safing/portmaster/detection/dga"
"github.com/safing/portmaster/firewall"
"github.com/safing/portmaster/nameserver/nsutil"
"github.com/safing/portmaster/netenv"
@@ -211,17 +210,6 @@ func handleRequest(ctx context.Context, w dns.ResponseWriter, query *dns.Msg) er
// save security level to query
q.SecurityLevel = conn.Process().Profile().SecurityLevel()
// check for possible DNS tunneling / data transmission
// TODO: improve this
lms := dga.LmsScoreOfDomain(q.FQDN)
// log.Tracef("nameserver: domain %s has lms score of %f", fqdn, lms)
if lms < 10 {
tracer.Warningf("nameserver: possible data tunnel by %s: %s has lms score of %f, returning nxdomain", conn.Process(), q.FQDN, lms)
conn.Block("Possible data tunnel")
sendResponse(w, query, conn.Verdict, conn.Reason, conn.ReasonContext)
return nil
}
// check profile before we even get intel and rr
firewall.DecideOnConnection(ctx, conn, nil)