Skip to content

Instantly share code, notes, and snippets.

@vavrusa
Last active Aug 29, 2015
Embed
What would you like to do?
DNS slowdrip
local slowdrip = {
tracked = {},
blocked = {},
window = 60, -- Length of the tracking window
threshold = 100, -- Number of NXDOMAINs before blocking
-- Track suffixes of names leading to NXDOMAIN
layer = {
finish = function(state, req, answer)
local parent = answer:qname()
parent = parent:sub(parent:find('.',0,true), -1)
if answer:rcode() == kres.rcode.NXDOMAIN then
local count = (slowdrip.tracked[parent] or 0) + 1
if count == slowdrip.threshold then
table.insert(slowdrip.blocked, parent)
end
slowdrip.tracked[parent] = count
end
return state
end
},
-- Set up suffix tracking and periodic flushing
init = function(modules)
block:add(block.suffix_common(block.DROP, slowdrip.blocked))
slowdrip.ev = event.recurrent(slowdrip.window * sec, function (ev)
local count = #slowdrip.blocked
for i=1, count do slowdrip.blocked[i] = nil end
slowdrip.tracked = {}
end)
end,
-- Stop tracking on unload
deinit = function(modules)
event.cancel(slowdrip.ev)
end
}
return slowdrip
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment