From c77f1040728d693cd1b2c2b567f2185056d023d5 Mon Sep 17 00:00:00 2001 From: DL6ER Date: Fri, 6 Aug 2021 21:35:41 +0200 Subject: [PATCH 01/11] Add interpretation for Pi-hole message type RATE_LIMIT Signed-off-by: DL6ER --- scripts/pi-hole/js/messages.js | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/scripts/pi-hole/js/messages.js b/scripts/pi-hole/js/messages.js index e9728508..2f1aca3d 100644 --- a/scripts/pi-hole/js/messages.js +++ b/scripts/pi-hole/js/messages.js @@ -77,6 +77,17 @@ function renderMessage(data, type, row) { case "DNSMASQ_CONFIG": return "FTL failed to start due to " + row.message; + case "RATE_LIMIT": + return ( + "Client " + + row.message + + " has been rate-limited (current config allows up to " + + parseInt(row.blob1, 10) + + " queries in " + + parseInt(row.blob2, 10) + + " seconds)" + ); + default: return "Unknown message type
" + JSON.stringify(row) + "
"; } From b4a26d3d591b7d02301bfefb37466d904495003e Mon Sep 17 00:00:00 2001 From: DL6ER Date: Wed, 18 Aug 2021 11:23:56 +0200 Subject: [PATCH 02/11] Add new blocked by database status and NONE reply types Signed-off-by: DL6ER --- db_queries.php | 3 ++- scripts/pi-hole/js/db_queries.js | 21 ++++++++++++++------- scripts/pi-hole/js/queries.js | 12 +++++++----- 3 files changed, 23 insertions(+), 13 deletions(-) diff --git a/db_queries.php b/db_queries.php index e8962604..b248968a 100644 --- a/db_queries.php +++ b/db_queries.php @@ -45,11 +45,12 @@

-
+

+

diff --git a/scripts/pi-hole/js/db_queries.js b/scripts/pi-hole/js/db_queries.js index 6cc2de32..3e20638c 100644 --- a/scripts/pi-hole/js/db_queries.js +++ b/scripts/pi-hole/js/db_queries.js @@ -137,6 +137,12 @@ function getQueryTypes() { queryType.push([12, 13]); } + // 14 is defined above + + if ($("#type_dbbusy").prop("checked")) { + queryType.push(15); + } + return queryType.join(","); } @@ -172,7 +178,7 @@ function refreshTableData() { var APIstring = "api_db.php?getAllQueries&from=" + from + "&until=" + until; // Check if query type filtering is enabled var queryType = getQueryTypes(); - if (queryType !== "1,2,3,4,5,6") { + if (queryType !== "1,2,3,4,5,6,7,8,9,10,11,12,13,14,15") { APIstring += "&types=" + queryType; } @@ -194,7 +200,9 @@ $(function () { tableApi = $("#all-queries").DataTable({ rowCallback: function (row, data) { - var fieldtext, buttontext, color; + var fieldtext, + buttontext = "", + color; switch (data[4]) { case 1: color = "red"; @@ -232,17 +240,14 @@ $(function () { case 6: color = "red"; fieldtext = "Blocked (external, IP)"; - buttontext = ""; break; case 7: color = "red"; fieldtext = "Blocked (external, NULL)"; - buttontext = ""; break; case 8: color = "red"; fieldtext = "Blocked (external, NXRA)"; - buttontext = ""; break; case 9: color = "red"; @@ -265,7 +270,6 @@ $(function () { case 12: color = "green"; fieldtext = "Retried"; - buttontext = ""; break; case 13: color = "green"; @@ -278,10 +282,13 @@ $(function () { buttontext = ''; break; + case 15: + color = "text-orange"; + fieldtext = "Blocked (database is busy)"; + break; default: color = "black"; fieldtext = "Unknown"; - buttontext = ""; } $(row).css("color", color); diff --git a/scripts/pi-hole/js/queries.js b/scripts/pi-hole/js/queries.js index 80344564..54405804 100644 --- a/scripts/pi-hole/js/queries.js +++ b/scripts/pi-hole/js/queries.js @@ -23,6 +23,7 @@ var replyTypes = [ "NOTIMP", "upstream error", "DNSSEC", + "NONE", ]; var colTypes = ["time", "query type", "domain", "client", "status", "reply type"]; @@ -78,7 +79,7 @@ $(function () { var replyid = parseInt(data[5], 10); // DNSSEC status var dnssecStatus; - var ede = data[11]; + var ede = data[11] ? data[11] : ""; switch (data[6]) { case "1": dnssecStatus = '
SECURE'; @@ -108,7 +109,7 @@ $(function () { // Query status var fieldtext, - buttontext, + buttontext = "", colorClass = false, isCNAME = false, regexLink = false; @@ -197,12 +198,10 @@ $(function () { case "12": colorClass = "text-green"; fieldtext = "Retried"; - buttontext = ""; break; case "13": colorClass = "text-green"; fieldtext = "Retried (ignored)"; - buttontext = ""; break; case "14": colorClass = "text-green"; @@ -210,10 +209,13 @@ $(function () { buttontext = ''; break; + case "15": + colorClass = "text-orange"; + fieldtext = "Blocked (database is busy)"; + break; default: colorClass = false; fieldtext = "Unknown (" + parseInt(data[4], 10) + ")"; - buttontext = ""; } // Add EDE here if available and not included in dnssecStatus From 487ac384351cafb94fe451b5ee94bd3c481d9611 Mon Sep 17 00:00:00 2001 From: DL6ER Date: Fri, 27 Aug 2021 15:13:55 +0200 Subject: [PATCH 03/11] Show response time only when reply is not N/A Signed-off-by: DL6ER --- scripts/pi-hole/js/queries.js | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/scripts/pi-hole/js/queries.js b/scripts/pi-hole/js/queries.js index 54405804..e926ad49 100644 --- a/scripts/pi-hole/js/queries.js +++ b/scripts/pi-hole/js/queries.js @@ -275,7 +275,8 @@ $(function () { $("td:eq(5)", row).html(replytext); - if (data.length > 7) { + // Show response time only when reply is not N/A + if (data.length > 7 && replyid !== 0) { var content = $("td:eq(5)", row).html(); $("td:eq(5)", row).html(content + " (" + (0.1 * data[7]).toFixed(1) + "ms)"); } From b9645ff6c57a7532b9833efe83f0d7119eac2175 Mon Sep 17 00:00:00 2001 From: DL6ER Date: Fri, 27 Aug 2021 15:14:33 +0200 Subject: [PATCH 04/11] Add new BLOB reply type Signed-off-by: DL6ER --- scripts/pi-hole/js/queries.js | 1 + 1 file changed, 1 insertion(+) diff --git a/scripts/pi-hole/js/queries.js b/scripts/pi-hole/js/queries.js index e926ad49..44a7c2ea 100644 --- a/scripts/pi-hole/js/queries.js +++ b/scripts/pi-hole/js/queries.js @@ -24,6 +24,7 @@ var replyTypes = [ "upstream error", "DNSSEC", "NONE", + "BLOB", ]; var colTypes = ["time", "query type", "domain", "client", "status", "reply type"]; From cce6889226485a0d059b35245d0f9be9c6286b8b Mon Sep 17 00:00:00 2001 From: yubiuser Date: Mon, 30 Aug 2021 10:44:03 +0200 Subject: [PATCH 05/11] Add notes about order of locally stored DNS records (#1865) * Add notes about order of locally stored DNS records --- dns_records.php | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/dns_records.php b/dns_records.php index e20c2058..36311ef2 100644 --- a/dns_records.php +++ b/dns_records.php @@ -39,6 +39,15 @@
+ Note: +

The order of locally defined DNS records is:

+
    +
  1. The device's host name and pi.hole
    2. +
  2. Configured in a config file in /etc/dnsmasq.d/
    3. +
  3. Read from /etc/hosts
    4. +
  4. Read from the "Local (custom) DNS" list (stored in /etc/pihole/custom.list)
    5. +
+

Only the first record will trigger an address-to-name association.

From b174bad7704aff8d57f3cc713d4c64b7a3918198 Mon Sep 17 00:00:00 2001 From: DL6ER Date: Thu, 9 Sep 2021 20:33:11 +0200 Subject: [PATCH 06/11] Less color for the Query Log Signed-off-by: DL6ER --- scripts/pi-hole/js/queries.js | 17 ++++++----------- 1 file changed, 6 insertions(+), 11 deletions(-) diff --git a/scripts/pi-hole/js/queries.js b/scripts/pi-hole/js/queries.js index 54405804..b97cf104 100644 --- a/scripts/pi-hole/js/queries.js +++ b/scripts/pi-hole/js/queries.js @@ -122,8 +122,7 @@ $(function () { ''; break; case "2": - colorClass = "text-green"; - fieldtext = replyid === 0 ? "OK, sent to " : "OK, answered by "; + fieldtext = replyid === 0 ? "OK, sent to " : "OK, answered by "; fieldtext += "" + (data.length > 10 && data[10] !== "N/A" ? data[10] : "") + @@ -132,8 +131,7 @@ $(function () { ''; break; case "3": - colorClass = "text-green"; - fieldtext = "OK (cached)" + dnssecStatus; + fieldtext = "OK (cache)" + dnssecStatus; buttontext = ''; break; @@ -196,16 +194,13 @@ $(function () { isCNAME = true; break; case "12": - colorClass = "text-green"; - fieldtext = "Retried"; + fieldtext = "Retried"; break; case "13": - colorClass = "text-green"; - fieldtext = "Retried (ignored)"; + fieldtext = "Retried (ignored)"; break; case "14": - colorClass = "text-green"; - fieldtext = "OK (already forwarded)" + dnssecStatus; + fieldtext = "OK (already forwarded)" + dnssecStatus; buttontext = ''; break; @@ -227,7 +222,7 @@ $(function () { fieldtext += ''; if (colorClass !== false) { - $(row).addClass(colorClass); + $("td:eq(4)", row).addClass(colorClass); } $("td:eq(4)", row).html(fieldtext); From 5db2fc27867053404a98024197ec804d6d7f3d8a Mon Sep 17 00:00:00 2001 From: DL6ER Date: Thu, 9 Sep 2021 20:51:16 +0200 Subject: [PATCH 07/11] Remove coloring of the domain names Signed-off-by: DL6ER --- scripts/pi-hole/js/queries.js | 53 ++++++++++++++++------------------- 1 file changed, 24 insertions(+), 29 deletions(-) diff --git a/scripts/pi-hole/js/queries.js b/scripts/pi-hole/js/queries.js index b97cf104..1a38afd1 100644 --- a/scripts/pi-hole/js/queries.js +++ b/scripts/pi-hole/js/queries.js @@ -110,19 +110,20 @@ $(function () { // Query status var fieldtext, buttontext = "", - colorClass = false, isCNAME = false, regexLink = false; switch (data[4]) { case "1": - colorClass = "text-red"; - fieldtext = "Blocked (gravity)"; + fieldtext = "Blocked (gravity)"; buttontext = ''; break; case "2": - fieldtext = replyid === 0 ? "OK, sent to " : "OK, answered by "; + fieldtext = + replyid === 0 + ? "OK, sent to " + : "OK, answered by "; fieldtext += "" + (data.length > 10 && data[10] !== "N/A" ? data[10] : "") + @@ -131,13 +132,13 @@ $(function () { ''; break; case "3": - fieldtext = "OK (cache)" + dnssecStatus; + fieldtext = + "OK (cache)" + dnssecStatus; buttontext = ''; break; case "4": - colorClass = "text-red"; - fieldtext = "Blocked (regex blacklist)"; + fieldtext = "Blocked (regex blacklist)"; if (data.length > 9 && data[9] > 0) { regexLink = true; @@ -147,36 +148,33 @@ $(function () { ''; break; case "5": - colorClass = "text-red"; - fieldtext = "Blocked (exact blacklist)"; + fieldtext = "Blocked (exact blacklist)"; buttontext = ''; break; case "6": - colorClass = "text-red"; - fieldtext = "Blocked (external, IP)"; + fieldtext = "Blocked (external, IP)"; buttontext = ""; break; case "7": - colorClass = "text-red"; - fieldtext = "Blocked (external, NULL)"; + fieldtext = + "Blocked (external, NULL)"; buttontext = ""; break; case "8": - colorClass = "text-red"; - fieldtext = "Blocked (external, NXRA)"; + fieldtext = + "Blocked (external, NXRA)"; buttontext = ""; break; case "9": - colorClass = "text-red"; - fieldtext = "Blocked (gravity, CNAME)"; + fieldtext = "Blocked (gravity, CNAME)"; buttontext = ''; isCNAME = true; break; case "10": - colorClass = "text-red"; - fieldtext = "Blocked (regex blacklist, CNAME)"; + fieldtext = + "Blocked (regex blacklist, CNAME)"; if (data.length > 9 && data[9] > 0) { regexLink = true; @@ -187,8 +185,8 @@ $(function () { isCNAME = true; break; case "11": - colorClass = "text-red"; - fieldtext = "Blocked (exact blacklist, CNAME)"; + fieldtext = + "Blocked (exact blacklist, CNAME)"; buttontext = ''; isCNAME = true; @@ -200,16 +198,17 @@ $(function () { fieldtext = "Retried (ignored)"; break; case "14": - fieldtext = "OK (already forwarded)" + dnssecStatus; + fieldtext = + "OK (already forwarded)" + + dnssecStatus; buttontext = ''; break; case "15": - colorClass = "text-orange"; - fieldtext = "Blocked (database is busy)"; + fieldtext = + "Blocked (database is busy)"; break; default: - colorClass = false; fieldtext = "Unknown (" + parseInt(data[4], 10) + ")"; } @@ -221,10 +220,6 @@ $(function () { fieldtext += ''; - if (colorClass !== false) { - $("td:eq(4)", row).addClass(colorClass); - } - $("td:eq(4)", row).html(fieldtext); $("td:eq(6)", row).html(buttontext); From d39e0809da0cf768847c45f81448048b24355c7a Mon Sep 17 00:00:00 2001 From: DL6ER Date: Thu, 9 Sep 2021 21:03:57 +0200 Subject: [PATCH 08/11] Clarify how and when UQDN are forwarded with conditional forwarding Signed-off-by: DL6ER --- settings.php | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/settings.php b/settings.php index d08d17fb..67420e9c 100644 --- a/settings.php +++ b/settings.php @@ -904,7 +904,9 @@ if (isset($_GET['tab']) && in_array($_GET['tab'], array("sysadmin", "adlists", "

When there is a Pi-hole domain set and this box is ticked, this asks FTL that this domain is purely local and FTL may answer queries from /etc/hosts or DHCP leases - but should never forward queries on that domain to any upstream servers.

+ but should never forward queries on that domain to any upstream servers. + If Conditional Fowarding is enabled, unticking this box may cause a partial + DNS loop under certain circumstances (e.g. if a client would send TLD DNSSEC queries).

checked> @@ -953,6 +955,8 @@ if (isset($_GET['tab']) && in_array($_GET['tab'], array("sysadmin", "adlists", " devices ending in your local domain name will not leave your network, however, this is optional. The local domain name must match the domain name specified in your DHCP server for this to work. You can likely find it within the DHCP settings.

+

Enabling Conditional Fowarding will also forward all hostnames (i.e., non-FQDNs) to the router + when "Never forward non-FQDNs" is not enable.

checked> From 8940e79f070a52bd404c43d2ecc7720a33cb01a8 Mon Sep 17 00:00:00 2001 From: DL6ER Date: Fri, 10 Sep 2021 09:20:01 +0200 Subject: [PATCH 09/11] Fix typo Co-authored-by: XhmikosR --- settings.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/settings.php b/settings.php index 67420e9c..074bb02f 100644 --- a/settings.php +++ b/settings.php @@ -956,7 +956,7 @@ if (isset($_GET['tab']) && in_array($_GET['tab'], array("sysadmin", "adlists", " The local domain name must match the domain name specified in your DHCP server for this to work. You can likely find it within the DHCP settings.

Enabling Conditional Fowarding will also forward all hostnames (i.e., non-FQDNs) to the router - when "Never forward non-FQDNs" is not enable.

+ when "Never forward non-FQDNs" is not enabled.

checked> From cf8602eedd4a31eadb72372fc878c12d342f8600 Mon Sep 17 00:00:00 2001 From: Adam Warner Date: Sat, 11 Sep 2021 19:34:32 +0100 Subject: [PATCH 10/11] set httponly to true when calling setcookie. the ini_set option above doesn't actually seem to do anything... (but not removing it just in case Signed-off-by: Adam Warner --- scripts/pi-hole/php/password.php | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/scripts/pi-hole/php/password.php b/scripts/pi-hole/php/password.php index 01e7efd6..91888a0b 100644 --- a/scripts/pi-hole/php/password.php +++ b/scripts/pi-hole/php/password.php @@ -50,7 +50,8 @@ { $auth = true; // Refresh cookie with new expiry - setcookie('persistentlogin', $pwhash, time()+60*60*24*7); + // setcookie( $name, $value, $expire, $path, $domain, $secure, $httponly ) + setcookie('persistentlogin', $pwhash, time()+60*60*24*7, null, null, null, true ); } else { @@ -79,7 +80,8 @@ // Set persistent cookie if selected if (isset($_POST['persistentlogin'])) { - setcookie('persistentlogin', $pwhash, time()+60*60*24*7); + // setcookie( $name, $value, $expire, $path, $domain, $secure, $httponly ) + setcookie('persistentlogin', $pwhash, time()+60*60*24*7, null, null, null, true ); } header('Location: index.php'); exit(); From 25df78337800e62117dbf1b7a1565bc449331307 Mon Sep 17 00:00:00 2001 From: Adam Warner Date: Sat, 11 Sep 2021 20:03:05 +0100 Subject: [PATCH 11/11] Apply htmlentities in a couple of places to prevent xss Co-authored-by: wtwver Signed-off-by: Adam Warner --- scripts/pi-hole/php/func.php | 1 + settings.php | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/scripts/pi-hole/php/func.php b/scripts/pi-hole/php/func.php index 12e41061..4d79872b 100644 --- a/scripts/pi-hole/php/func.php +++ b/scripts/pi-hole/php/func.php @@ -472,6 +472,7 @@ function returnSuccess($message = "", $json = true) function returnError($message = "", $json = true) { + $message = htmlentities($message) ; if ($json) { return [ "success" => false, "message" => $message ]; } else { diff --git a/settings.php b/settings.php index d08d17fb..a3ce919a 100644 --- a/settings.php +++ b/settings.php @@ -41,7 +41,7 @@ if (isset($_POST["submit"])) {

Debug

-
+