Restricted mode for connected objects

From 0.8.0 (free, every plan, homes and Warda Business; beta; catalogue restricted-mode; internal/restrict). The threat it answers: a connected object (a camera, a TV, a smart speaker, a sensor) taken over and enrolled in a botnet, which then asks the names of its new masters. An object talks to a few servers of its maker, always the same: once they are known, anything else is suspect.

The modes (off, learning, restricted), for a device or for a group of devices:

• Learning lasts N days (7 by default, 1 to 30). It records the registrable domains (the eTLD+1 of the public suffix list, as the collective base uses: cdn.example.co.uk → example.co.uk; a name under a private suffix, as abc.cloudfront.net, is its own domain) of the names the device asks that nothing else blocked, with when each was first and last asked and how often. Nothing is blocked during the learning. The counts are kept in memory and written once a minute in one transaction; the end of a learning is checked every minute.
• At its end the mode becomes restricted (notice restricted.learned, with the number of names).
• Restricted: a query whose registrable domain is not among the names of the device (or of its group), nor among the names allowed for all objects, nor allowed for that device by a rule of the device, is blocked with the answer of the other blocks (null address, NXDOMAIN or REFUSED, as set). Reason restricted, origin restricted:<domain> in the query log, "Restricted mode (objects)" in the reports.
• Limit: 500 names per device, per group and for all objects. A learning that goes beyond stops by itself (mode off, stopped: toomany, notice restricted.toomany: "too many names: this device is not a simple object"); an administrator's name beyond 500 is refused (400).

Never blocked: the names of the home (one label, .arpa, .lan, .home, .local, .internal, .corp, .localdomain, .intranet, .private, .test, .invalid, .example, and any top-level domain the public suffix list does not know), the local DNS records, the DHCP names, the local zones and the names of the box (answered before), the queries of the box itself, and warda-dns.com, warda-dns.net. The pauses still apply: "something is broken" on the device, or a name unblocked for it, lets a name outside through (recorded as paused), useful during an update of the firmware. Only the name asked is checked, never the targets of its CNAME records (the content networks of the maker, which the device never asks by name); the usual check of the trackers hidden behind a CNAME still applies. In the filter it comes after the quarantine, the hours of Internet, the services, the rules (of the network then of the device), the tunnels, the spyware, the look-alikes, the categories and the data loss prevention, and only for a name none of them blocked: a name blocked by the lists is never learned. It holds outside the home too, for an object enrolled in the protection outside the home.

Told: one notice restricted per device and outside domain per day (the domain as detail), 20 domains a day per device at most (a device that asks hundreds of random names — a botnet looking for its server — is told 20 times, then only counted); group Security of Alerts, with Allow for this device and Allow for all objects; SIEM severity 6 (restricted.toomany 3, restricted.learned 2). Household → Devices shows the domains blocked over the last 7 days per device with the same two buttons, so it works on the free plan too.

How to use it. Household → Devices: a card Restricted mode for connected objects when objects without a mode exist (the kinds TV / media box, smart speaker, camera, connected object and printer, chosen or proposed: see Kinds of devices), with Restricted mode for all connected objects (each starts its learning, default length), and the Names allowed for all objects (list, add, remove). On each device: a badge (Learning · n days left, Restricted mode, suspended) and Restricted mode, which opens a panel: the state, the length of the learning, Start learning, Restrict now, Learn again, Turn off restricted mode, blocked today, the names blocked lately with the two allow buttons, Show the names (domain, learned or added, queries and last time, remove), Allow a name, Export the list (JSON). A warning shows when a device in this mode now looks like a phone, a tablet, a computer or a watch, with Turn off restricted mode — or, for a device that follows the mode of its group, the advice to place it in another group. Household → Groups: the same panel on each group.

• A group (cameras, sensors) learns into one list, then keeps to it; a device placed in it later gets the names of the group at once; a device with a mode of its own follows its own; a name can still be allowed for one device of the group; a device taken out of the group is no longer restricted (within a minute).
• Adults: the mode is refused (400) for a device used by an adult or shared with one, and suspended if a restricted device becomes an adult's: learning its names, or telling them, would record the sites that adult visits. The devices of children and teenagers, of nobody and of groups may have it.
• Learn again forgets the learned names and keeps those an administrator added.
• A merge of two devices moves the mode and the names of the device merged to the one kept (its own mode wins; the names of both are kept).
• An update of the firmware may need a new name: the device is then blocked and the notice says so; the remedy is one click (Allow for this device), a pause or a new learning.

Limits. A program with its own resolver or addresses written in it goes around any filter by names, and so does DNS over HTTPS inside the object (the category VPN, proxies and encrypted DNS blocks the known servers of it). A learning made while the object was already taken over learns the names of its masters too: start it on an object reset to its factory settings, or look at Show the names.

Stored. Tables restrict_modes (the mode of each device or group, the days, the start, why it stopped) and restrict_names (the domains of a device, of a group or of all objects, learned or added, first and last seen, a count: never a time per query), deleted with their device or group, in the backups (and so given to the secondary of a pair). Nothing leaves the box. Administration log: restrict.mode, restrict.objects, restrict.allow, restrict.remove.

API (area devices: read for GET, written otherwise; {scope} is device, group, or all with the id 0 for the names of all objects):