<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" dir="ltr" style="font-size:12pt; color:rgb(0,0,0); font-family:Calibri,Helvetica,sans-serif,EmojiFont,"Apple Color Emoji","Segoe UI Emoji",NotoColorEmoji,"Segoe UI Symbol","Android Emoji",EmojiSymbols">
<p>I think you may have hit the problem I ran into a while back which led to me filing this - <a href="https://github.com/PowerDNS/pdns/issues/9058" class="OWAAutoLink" id="LPlnk203562" previewremoved="true">https://github.com/PowerDNS/pdns/issues/9058</a></p>
<p><br>
</p>
<p>I can't see a way to get this data out of pdns as it is currently built</p>
<div id="LPBorder_GT_15964176601150.08153804082440819" style="margin-bottom: 20px; overflow: auto; width: 100%; text-indent: 0px;">
<table id="LPContainer_15964176601120.6165073983030762" role="presentation" cellspacing="0" style="width: 90%; background-color: rgb(255, 255, 255); position: relative; overflow: auto; padding-top: 20px; padding-bottom: 20px; margin-top: 20px; border-top: 1px dotted rgb(200, 200, 200); border-bottom: 1px dotted rgb(200, 200, 200);">
<tbody>
<tr valign="top" style="border-spacing: 0px;">
<td id="ImageCell_15964176601130.6776990002115995" colspan="1" style="width: 250px; position: relative; display: table-cell; padding-right: 20px;">
<div id="LPImageContainer_15964176601130.26532276833375734" style="background-color: rgb(255, 255, 255); height: 250px; position: relative; margin: auto; display: table; width: 250px;">
<a id="LPImageAnchor_15964176601130.04549025241584159" href="https://github.com/PowerDNS/pdns/issues/9058" target="_blank" style="display: table-cell; text-align: center;"><img aria-label="Preview image with link selected. Double-tap to open the link." id="LPThumbnailImageID_15964176601140.6211614419249054" width="250" height="250" style="display: inline-block; max-width: 250px; max-height: 250px; height: 250px; width: 250px; border-width: 0px; vertical-align: bottom;" src="https://avatars2.githubusercontent.com/u/1282630?s=400&v=4"></a></div>
</td>
<td id="TextCell_15964176601140.22359093167389177" colspan="2" style="vertical-align: top; position: relative; padding: 0px; display: table-cell;">
<div id="LPRemovePreviewContainer_15964176601140.6138450182580724"></div>
<div id="LPTitle_15964176601140.732699051287989" style="top: 0px; color: rgb(0, 120, 215); font-weight: 400; font-size: 21px; font-family: wf_segoe-ui_light, "Segoe UI Light", "Segoe WP Light", "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; line-height: 21px;">
<a id="LPUrlAnchor_15964176601150.8544963581781442" href="https://github.com/PowerDNS/pdns/issues/9058" target="_blank" style="text-decoration: none;">Additional data for RPZ logging/protobuf · Issue #9058 · PowerDNS/pdns · GitHub</a></div>
<div id="LPMetadata_15964176601150.3779032239328568" style="margin: 10px 0px 16px; color: rgb(102, 102, 102); font-weight: 400; font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; font-size: 14px; line-height: 14px;">
github.com</div>
<div id="LPDescription_15964176601150.8642267469616205" style="display: block; color: rgb(102, 102, 102); font-weight: 400; font-family: wf_segoe-ui_normal, "Segoe UI", "Segoe WP", Tahoma, Arial, sans-serif; font-size: 14px; line-height: 20px; max-height: 100px; overflow: hidden;">
In order to provide details for reporting and/or troubleshooting it would be helpful if there was an option to report the actual zone record that caused an RPZ hit. In bind syslogs you have a "via blahblah.." stanza in the log line that ...</div>
</td>
</tr>
</tbody>
</table>
</div>
<br>
<br>
<br>
<div style="color:rgb(0,0,0)">
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> Pdns-users <pdns-users-bounces@mailman.powerdns.com> on behalf of Dave Burkholder via Pdns-users <pdns-users@mailman.powerdns.com><br>
<b>Sent:</b> Friday, July 31, 2020 11:41<br>
<b>To:</b> pdns-users@mailman.powerdns.com<br>
<b>Subject:</b> [Pdns-users] postresolve never gets rpz triggered requests</font>
<div> </div>
</div>
<div>
<p>I have a number of RPZs and want to log to file when an RPZ action fires. But the postresolve method doesn't have get the DNSQuestion. Here are some example log lines that don't fire an RPZ action:<br>
</p>
<pre>Jul 30 22:32:27 system pdns_recursor[4789]: washington.voip.ms. prerpz
Jul 30 22:32:30 system pdns_recursor[4789]: washington.voip.ms. 10.3.5.104 rcode is 2
Jul 30 22:33:13 system pdns_recursor[4789]: get-maps-bx.g.aaplimg.com. prerpz
Jul 30 22:33:13 system pdns_recursor[4789]: get-maps-bx.g.aaplimg.com. 10.3.5.119 rcode is 0
</pre>
<p>And here are lines that trigger an RPZ action. As you can see, the postresolve function never gets fired.<br>
</p>
<pre>Jul 30 22:36:12 system pdns_recursor[4789]: evidaac.com. prerpz / rcode 0
Jul 30 22:36:17 system pdns_recursor[4789]: num.to. prerpz / rcode 0</pre>
<p>Here's my RPZ definition:</p>
<pre>rpzFile("/path/to/phishtank-online-verified/zone.conf", {defpol=Policy.Custom, defcontent="fishtank.local.blockpage.server", policyName='FishTank'})</pre>
<p><br>
</p>
<p>And here's the lua script:</p>
<pre>function prerpz(dq)
pdnslog(dq.qname:toString() .. ' prerpz')
return false
end
function postresolve(dq)
pdnslog(dq.qname:toString() .. " " .. dq.remoteaddr:toString() .. " rcode is " .. dq.rcode, pdns.loglevels.All)
return false
end
</pre>
<p><br>
</p>
<p>Any ideas how I can configure my lua scripts to log when an RPZ action fires?</p>
<p><br>
</p>
<p>Much obliged!</p>
<p><br>
Dave<br>
</p>
<p><br>
</p>
</div>
</div>
</div>
</body>
</html>