EnergizedProtection / block

Let's make an annoyance free, better open internet, altogether!
https://energized.pro
MIT License
2.5k stars 197 forks source link

Some listed domains exceed IDN's maximum length #477

Open L1Cafe opened 4 years ago

L1Cafe commented 4 years ago

Energized Protection - block ⚡

Let's make an annoyance free, better open internet, altogether!

Issue Submit Form

Provide the following infos properly, which will help us to resolve your issue quickly.

Issue(s):

Type x in between [ ] and make sure there isn't any space between brackets. Example; for Your Selected Issue(s), type like this - [x] You can select more than one category of issues if you need to!


Pack(s):

Write the name of the pack(s) you are using.

Extension(s):

Also name the extension(s) if you are using any. If you don't then leave it blank.

Domain(s):

If you are submitting this issue for whitelist/blacklist issue, send us the domain(s) for whitelisting/blacklisting here. Kindly use the Code Tag to prevent tracking.


Your Config:

Just to ensure there is no issues or conflicts with other app/software/magisk module/extension/source list. Make sure you are running Energized Protection Service only.

Details:

Write us a lil bit more about your issue or query. You can attach any screen shot or log of the issue or advert, this will help to highlight it.

There seems to be a lack of checks in place, and invalid hosts slip by at some stage of the list merging. I found more invalid domains in the Ultimate pack. Specifically, in the Unbound config file. https://block.energized.pro/ultimate/formats/unbound.conf

Some examples:

unbound:/etc/unbound# service unbound restart
 * Stopping unbound daemon ...                                                                                                                                          [ ok ]
 * Checking /etc/unbound/unbound.conf ...
[1591569404] unbound-checkconf[650:0] error: cannot parse name 756e646566696e6564756e646566696e6564756e646566696e6564756e646566696e6564756e646566696e6564756e646566696e6564756e646566696e6564756e646566696e6564.com
[1591569404] unbound-checkconf[650:0] error: bad zone name 756e646566696e6564756e646566696e6564756e646566696e6564756e646566696e6564756e646566696e6564756e646566696e6564756e646566696e6564756e646566696e6564.com static
[1591569404] unbound-checkconf[650:0] fatal error: failed local-zone, local-data configuration                                                                          [ !! ]
unbound:/etc/unbound# service unbound restart
 * Checking /etc/unbound/unbound.conf ...
[1591569466] unbound-checkconf[670:0] error: cannot parse name 7472756574727565747275657472756574727565747275657472756574727565.com
[1591569466] unbound-checkconf[670:0] error: bad zone name 7472756574727565747275657472756574727565747275657472756574727565.com static
[1591569466] unbound-checkconf[670:0] fatal error: failed local-zone, local-data configuration                                                                          [ !! ]
 * ERROR: unbound failed to start

If we use nslookup, we get an informative error message like so (please note that I manually shortened the output, to make it easier to read, I've already established why domains can't be so long):

# nslookup 756[...]e6564.com
nslookup: '756[...]e6564.com' is not a legal IDN name (domain label longer than 63 characters), use +noidnin

My suggestion would be to measure the length of every added domain and drop those that are longer than 63 characters. This should be done before the creation of software and device-specific packs.

More info:


Thank you for making Energized Protection great, with your kind help!

A project by Ador with ❤
ghost commented 4 years ago

I would reckon the local-zone statement should be constructed in a different than it current is, e.g.

local-zone: "Energized.Ultimate" 
  local-data:  "756e646566696e6564756e646566696e6564756e646566696e6564756e646566696e6564756e646566696e6564756e646566696e6564756e646566696e6564756e646566696e6564.com" always_nxdomain
  local-data: "next black listed domain" always_nxdomain
  local-data: "next black listed domain" always_nxdomain
  ...

For reference see unbound's documentation https://nlnetlabs.nl/documentation/unbound/unbound.conf/#local-zone


That said and solving the issue of the 63 octets label restriction the subdomain (as stipulated inlocal-data) should then not exceed 191 octets in order to prevent domain name length overflow issue https://github.com/EnergizedProtection/block/issues/526#issuecomment-687565355