DNS slowdrip

slowdrip.lua

local slowdrip = {
  tracked = {},
  blocked = {},
  window = 60,     -- Length of the tracking window
  threshold = 100, -- Number of NXDOMAINs before blocking
  -- Track suffixes of names leading to NXDOMAIN
  layer = {
    finish = function(state, req, answer)
      local parent = answer:qname()
      parent = parent:sub(parent:find('.',0,true), -1)
      if answer:rcode() == kres.rcode.NXDOMAIN then
        local count = (slowdrip.tracked[parent] or 0) + 1
        if count == slowdrip.threshold then
          table.insert(slowdrip.blocked, parent)
        end
        slowdrip.tracked[parent] = count
      end
      return state
    end
  },
  -- Set up suffix tracking and periodic flushing
  init = function(modules)
    block:add(block.suffix_common(block.DROP, slowdrip.blocked))
    slowdrip.ev = event.recurrent(slowdrip.window * sec, function (ev)
      local count = #slowdrip.blocked
      for i=1, count do slowdrip.blocked[i] = nil end
      slowdrip.tracked = {}
    end)
  end,
  -- Stop tracking on unload
  deinit = function(modules)
    event.cancel(slowdrip.ev)
  end
}
return slowdrip