Add a logged_qtypes feature to log only some query types
This commit is contained in:
parent
414d366cb2
commit
7103229609
|
@ -66,8 +66,9 @@ type SourceConfig struct {
|
|||
}
|
||||
|
||||
type QueryLogConfig struct {
|
||||
File string
|
||||
Format string
|
||||
File string
|
||||
Format string
|
||||
LoggedQtypes []string `toml:"logged_qtypes"`
|
||||
}
|
||||
|
||||
type BlockNameConfig struct {
|
||||
|
@ -120,6 +121,7 @@ func ConfigLoad(proxy *Proxy, svcFlag *string, config_file string) error {
|
|||
}
|
||||
proxy.queryLogFile = config.QueryLog.File
|
||||
proxy.queryLogFormat = config.QueryLog.Format
|
||||
proxy.queryLogLoggedQtypes = config.QueryLog.LoggedQtypes
|
||||
|
||||
if len(config.BlockName.Format) == 0 {
|
||||
config.BlockName.Format = "tsv"
|
||||
|
|
|
@ -126,6 +126,10 @@ cache_neg_ttl = 60
|
|||
format = 'tsv'
|
||||
|
||||
|
||||
## Only log these query types, to reduce verbosity. Keep empty to log everything.
|
||||
|
||||
# logged_qtypes = ['A', 'MX']
|
||||
|
||||
|
||||
######################################################
|
||||
# Pattern-based blocking (blacklists) #
|
||||
|
|
|
@ -38,6 +38,7 @@ type Proxy struct {
|
|||
cacheMaxTTL uint32
|
||||
queryLogFile string
|
||||
queryLogFormat string
|
||||
queryLogLoggedQtypes []string
|
||||
blockNameFile string
|
||||
blockNameLogFile string
|
||||
blockNameFormat string
|
||||
|
|
|
@ -5,6 +5,7 @@ import (
|
|||
"fmt"
|
||||
"net"
|
||||
"os"
|
||||
"strings"
|
||||
"sync"
|
||||
"time"
|
||||
|
||||
|
@ -14,8 +15,9 @@ import (
|
|||
|
||||
type PluginQueryLog struct {
|
||||
sync.Mutex
|
||||
outFd *os.File
|
||||
format string
|
||||
outFd *os.File
|
||||
format string
|
||||
loggedQTypes []string
|
||||
}
|
||||
|
||||
func (plugin *PluginQueryLog) Name() string {
|
||||
|
@ -35,6 +37,7 @@ func (plugin *PluginQueryLog) Init(proxy *Proxy) error {
|
|||
}
|
||||
plugin.outFd = outFd
|
||||
plugin.format = proxy.queryLogFormat
|
||||
plugin.loggedQTypes = proxy.queryLogLoggedQtypes
|
||||
|
||||
return nil
|
||||
}
|
||||
|
@ -53,6 +56,22 @@ func (plugin *PluginQueryLog) Eval(pluginsState *PluginsState, msg *dns.Msg) err
|
|||
return nil
|
||||
}
|
||||
question := questions[0]
|
||||
qType, ok := dns.TypeToString[question.Qtype]
|
||||
if !ok {
|
||||
qType = string(qType)
|
||||
}
|
||||
if len(plugin.loggedQTypes) > 0 {
|
||||
found := false
|
||||
for _, loggedQtype := range plugin.loggedQTypes {
|
||||
if strings.EqualFold(loggedQtype, qType) {
|
||||
found = true
|
||||
break
|
||||
}
|
||||
}
|
||||
if !found {
|
||||
return nil
|
||||
}
|
||||
}
|
||||
var clientIPStr string
|
||||
if pluginsState.clientProto == "udp" {
|
||||
clientIPStr = (*pluginsState.clientAddr).(*net.UDPAddr).IP.String()
|
||||
|
@ -60,10 +79,7 @@ func (plugin *PluginQueryLog) Eval(pluginsState *PluginsState, msg *dns.Msg) err
|
|||
clientIPStr = (*pluginsState.clientAddr).(*net.TCPAddr).IP.String()
|
||||
}
|
||||
qName := StripTrailingDot(question.Name)
|
||||
qType, ok := dns.TypeToString[question.Qtype]
|
||||
if !ok {
|
||||
qType = string(qType)
|
||||
}
|
||||
|
||||
var line string
|
||||
if plugin.format == "tsv" {
|
||||
now := time.Now()
|
||||
|
|
Loading…
Reference in New Issue