<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" dir="ltr" style="">
<p style="color: rgb(0, 0, 0); font-family: Calibri, Helvetica, sans-serif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 12pt;">
All,</p>
<p style="color: rgb(0, 0, 0); font-family: Calibri, Helvetica, sans-serif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 12pt;">
<br>
</p>
<p style="color: rgb(0, 0, 0); font-family: Calibri, Helvetica, sans-serif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 12pt;">
As you may know ThreatSTOP provides an RPZ service and it works on power DNS. What doesn't quite work is logging and I'm trying to fix that.</p>
<p style="color: rgb(0, 0, 0); font-family: Calibri, Helvetica, sans-serif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 12pt;">
<br>
</p>
<p style=""><span style="font-size: 12pt;">My problem is that the documentation for what is output in the protobuf logging is unclear - </span><a href="https://github.com/PowerDNS/pdns/blob/master/pdns/dnsmessage.proto" class="OWAAutoLink" id="LPlnk7266" previewremoved="true" style="color: rgb(0, 0, 0); font-family: Calibri, Helvetica, sans-serif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 12pt;">https://github.com/PowerDNS/pdns/blob/master/pdns/dnsmessage.proto</a><span style="font-size: 12pt;">
is the only thing I can find - but it doesn't look like power dns provides the record that caused the RPZ rewrite that is made available in bind. The </span><span class="pl-en" style="color: rgb(111, 66, 193); font-family: SFMono-Regular, Consolas, "Liberation Mono", Menlo, monospace; font-size: 12px; white-space: pre;">PolicyType</span>
enum tells me that the hit was RESPONSEIP etc. but I don't see anything in the rest of the protobug that gives me the actual rule that was hit.</p>
<br>
<p style="color: rgb(0, 0, 0); font-family: Calibri, Helvetica, sans-serif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 12pt;">
<span style="font-size: 12pt;">In bind you have a "via blahblah.." stanza in the log line that does this e.g.</span><br>
</p>
<div id="Signature" style="color: rgb(0, 0, 0); font-family: Calibri, Helvetica, sans-serif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 12pt;">
<div style="font-family:Tahoma; font-size:13px">
<div><span>17-Mar-2020 09:34:49.887 rpz: info: client 192.168.123.10#53112 (casasur.cl): rpz QNAME NODATA rewrite casasur.cl via casasur.cl.phishy.di000001.rpz.threatstop.local</span><br>
</div>
<div><span><br>
</span></div>
<div><span>For RPZ hits that work on dnames the qname is (plus or minus a *.) such as in the example above then that's fine but if the rule his i somethign else e.g. responseip or nsip then this isn't helpful<br>
e.g. bind tells me this<br>
<div>19-Mar-2020 09:00:45.878 rpz: info: client 192.168.123.12#55929 (peccsr.com): rpz NSIP CNAME rewrite peccsr.com via 29.120.82.251.162.rpz-nsip.phishy.di000001.rpz.threatstop.local</div>
<div><br>
</div>
<div>so far as I can tell what I get from power dns is the rewritten return e.g. NXDOMAIN or CNAME something but not the record that caused the rewrite. This makes it hard for us to provide details on why the record was rewritten. E.g. that it was a botnet
or phishing or porn or whatever</div>
<div><br>
</div>
<div>So my questions are<br>
is there more documentation on what is in the protobuf output?<br>
is there a way to configure it so that it can contain what I need? (ideally without recompiling powerDNS)<br>
<br>
</div>
<div>Regards<br>
<br>
Francis </div>
<br>
</span></div>
<div>
<p class="MsoNormal" style="margin:0in 0in 0.0001pt; font-size:11pt; font-family:Calibri,sans-serif; background:white">
<b><span style="font-size:12pt; color:rgb(89,89,89)">Francis Turner</span></b></p>
<p class="MsoNormal" style="margin:0in 0in 0.0001pt; font-size:11pt; font-family:Calibri,sans-serif; background:white">
Threat STOP Global SE</p>
<p class="MsoNormal" style="margin:0in 0in 0.0001pt; font-size:11pt; font-family:Calibri,sans-serif; background:white">
<span style="font-size:12pt; color:rgb(89,89,89)">JP Cell: +81-8080404701 | US Cell: +1-760-402-7676</span></p>
<p class="MsoNormal" style="margin:0in 0in 0.0001pt; font-size:11pt; font-family:Calibri,sans-serif; background:white">
<span style="font-size:12pt; color:rgb(89,89,89)">Office: +1-760-542-1550 | Skype: francis.turner.threatstop</span></p>
<p class="MsoNormal" style="margin:0in 0in 0.0001pt; font-size:11pt; font-family:Calibri,sans-serif; background:white">
<span style="font-size:12pt"><a href="https://west.exch030.serverdata.net/owa/redir.aspx?C=_XQ5Vz8Mcce6FBPWG3SRNURxxWucllPOVpIrIsW2dHMdMWpxOJbWCA..&URL=mailto%3afrancis%40threatstop.com" target="_blank" id="LPNoLP" style="color:rgb(149,79,114)"><span style="color:rgb(5,99,193)">francis@threatstop.com</span></a> | </span><a href="https://west.exch030.serverdata.net/owa/redir.aspx?C=tQTMDuD3pdxKjYNQkf_pe3ePQk-0j-owQDEt5bnZf0YdMWpxOJbWCA..&URL=http%3a%2f%2fwww.threatstop.com%2f" target="_blank" id="LPNoLP" style="color:rgb(149,79,114)"><span style="font-size:12pt; color:rgb(0,112,192)">www.threatstop.com</span></a></p>
<p class="MsoNormal" style="margin:0in 0in 0.0001pt; font-size:11pt; font-family:Calibri,sans-serif; background:white">
<b><span style="font-size:12pt; color:rgb(89,89,89)">Weaponize Your Threat Intelligence</span></b><b><span style="font-size:12pt"> </span></b></p>
<p class="MsoNormal" style="margin:0in 0in 0.0001pt; font-size:11pt; font-family:Calibri,sans-serif; background:white">
“If You Don’t Build It, They Definitely Will Not Come” – P. Vixie</p>
</div>
</div>
</div>
</div>
</body>
</html>