Blocked CNAME of allowed domain not able to easily be allowed

[CJ-Ross]

Important notices

Before you add a new report, we ask you kindly to acknowledge the following:

• [x ] I have read the contributing guide lines at https://github.com/opnsense/core/blob/master/CONTRIBUTING.md
• [ x] I am convinced that my issue is new after having checked both open and closed issues at https://github.com/opnsense/core/issues?q=is%3Aissue

Describe the bug

I've tested this with 23.1.11 but I don't believe any changes in 23.7 would have affected this. If the CNAME of an allowed domain is on a blocklist, there is not a simple way to allow that query to successfully complete.

To Reproduce

Steps to reproduce the behavior:

1. Enable DNSBL in Unbound using the Steven Black list.
2. Enable Unbound Reporting
3. Query click.redditmail.com
4. Visit Unbound Reporting and whitelist click.redditmail.com
5. Configure Unbound to flush cache on restart and restart Unbound
6. Query click.redditmail.com
7. Visit Unbound Reporting and see that A and AAAA records are allowed but CNAME is blocked
8. CNAME shows as already whitelisted but query for click.reddit.com still fails

Expected behavior

Whitelisted click.redditmail.com should resolve

Describe alternatives you considered

Current workaround is to manually query the allowed domain, get the resulting CNAME and then whitelist that in the DNSBL screen. Alternative would be for Unbound Reporting to show the both the original and resulting CNAME and/or recognize that the CNAME is what is still blocked and therefore show the whitelist option instead of block.

Probably the least feasible option would be for Unbound to realize that the original query is allowed and therefore not check the resulting CNAME against the blocklist. This would likely cause more problems than it solves as well as reducing security provided by the blocklist.

Screenshots

https://imgur.com/N3dFp03
https://imgur.com/79oddsl

Additional context

See thread for more context. https://forum.opnsense.org/index.php?topic=35218.0

[swhite2]

Probably the least feasible option would be for Unbound to realize that the original query is allowed and therefore not check the resulting CNAME against the blocklist. This would likely cause more problems than it solves as well as reducing security provided by the blocklist.

This is entirely correct.

Alternative would be for Unbound Reporting to show the both the original and resulting CNAME and/or recognize that the CNAME is what is still blocked and therefore show the whitelist option instead of block.

The statistics are from the perspective of the incoming queries, therefore showing two entries here will likely pollute the counters. The current code is somewhat aware of this situation, but pretends to be the original query so domains don't appear out of nowhere for the person reviewing the logs. The easiest solution would likely be to drop logging the incoming query (e.g. click.redditmail.com) and instead log <resulting CNAME> (CNAME of <original queried domain>).

[CJ-Ross]

Alternative would be for Unbound Reporting to show the both the original and resulting CNAME and/or recognize that the CNAME is what is still blocked and therefore show the whitelist option instead of block.

The statistics are from the perspective of the incoming queries, therefore showing two entries here will likely pollute the counters. The current code is somewhat aware of this situation, but pretends to be the original query so domains don't appear out of nowhere for the person reviewing the logs. The easiest solution would likely be to drop logging the incoming query (e.g. click.redditmail.com) and instead log <resulting CNAME> (CNAME of <original queried domain>).

Isn't that exactly what I listed as the first alternative?

[swhite2]

I am simply eliminating ambiguity.. "exactly" does not quite fit.

[CJ-Ross]

I've discovered another issue related to Unbound DNSBL and CNAME records. I'm not sure if it needs to be opened as a separate issue or rolled into this one.

https://forum.opnsense.org/index.php?topic=36068.0

The TLDR is that CNAME records that resolve to a CNAME record appear to be broken.

[AJSNetworks]

I am also experiencing the same issue. Some domains in my "Whitelist" work fine but the most recent one added does not, regardless of restarts and waiting out TTL.

Interesting observations that I hope can shed light on this:

• REPORTING: UNBOUND DNS logs it as a "block", but the "Command" button only offers to "Block Domain", when "Whitelist Domain" is expected
• Resolution issues coming from the browser with the following error "DNS_PROBE_POSSIBLE"
• Using nslookup (windows) does resolve the domain in question (I see it as a block in REPORTING: UNBOUND DNS
• Domain in question: "learn.cisecurity.org", being blocked from at least AdAway and EasyPrivacy lists

[oliveiraleo]

Hello, I'm currently using the versions listed below and I can confirm this bug

OPNsense 23.7.11-amd64
FreeBSD 13.2-RELEASE-p7
OpenSSL 1.1.1w

The domain I tried to whitelist is mparticle.weather.com but unbound still blocks the requests with the same behavior reported by @CJ-Ross and @AJSNetworks even after whitelisting and reloading the service

[gforgas]

Hello,

Running same version reported by OP here and same issue.

OPNsense 23.1.11_1-amd64 FreeBSD 13.1-RELEASE-p8 OpenSSL 1.1.1u 30 May 2023

In this case the domain that is not being whitelisted is go.missionbio.com. 2250 IN CNAME go.pardot.com.

Disabling DNSBL "solves" the issue, but is not really what we want.

[OPNsense-bot]

This issue has been automatically timed-out (after 180 days of inactivity).

For more information about the policies for this repository,
please read https://github.com/opnsense/core/blob/master/CONTRIBUTING.md for further details.

If someone wants to step up and work on this issue,
just let us know, so we can reopen the issue and assign an owner to it.

[CJ-Ross]

I have plans to work on this issue along with some other improvements to the whole DNSBL handling and reporting but with everything else I have going on I have no idea when I'll be able to dedicate time to it.

In the meantime, anyone coming across this issue can use a DNS lookup tool(local or online) to find out what the next CNAME in the chain is until they get to the actual domain and unblock each one of those. While cumbersome, it does work to allow you to access something that is on a downloaded DNSBL.

[nemxwasp]

In order to watch live sports on Paramount+ I have to allow pubads.g.doubleclick.net. I added it and its other cname pubads46.g.doubleclick.net to whitelist domains and its still blocked by DNSBL. I don't watch often but when I do I have to disable blocklist altogether and clear my local dns cache to get it to work.

EDIT: I was able to get this working by using regex that I found in the forums (hopefully this helps someone else):
(.*)?(.)?g.doubleclick.net