Revert "Remove unused SCANNER_NAMESERVER setting" as it is implied fu…

dashboard/internet_nl_dashboard/check_dns.py

@@ -0,0 +1,26 @@
+from dns.resolver import Resolver
+from websecmap.app.constance import constance_cached_value
+
+
+def check_dns_resolvers():
+    # this checks the configured dns resolver and alerts if something does not resolve.
+    # This is made for debugging purposes only.
+
+    nameservers = constance_cached_value("SCANNER_NAMESERVERS")
+    for server in nameservers:
+        check_dns_resolver(server)
+
+
+def check_dns_resolver(server) -> bool:
+    resolver = Resolver()
+    resolver.nameservers = [server]
+
+    search_domain = constance_cached_value("CONNECTIVITY_TEST_DOMAIN")
+
+    try:
+        resolver.resolve(search_domain, "A", search=True)
+        print(f"Resolved {search_domain} on {server}")
+        return True
+    except Exception as exc:  # pylint: disable=broad-except
+        print(f"Did not resolve {search_domain} on {server}. Error: {exc}")
+        return False

dashboard/internet_nl_dashboard/management/commands/check_dns_resolvers.py

@@ -0,0 +1,10 @@
+# SPDX-License-Identifier: Apache-2.0
+from django.core.management.base import BaseCommand
+
+from dashboard.internet_nl_dashboard.check_dns import check_dns_resolvers
+
+
+class Command(BaseCommand):
+    def handle(self, *args, **options):
+        check_dns_resolvers()
+        print("Done!")

dashboard/settings_constance.py

@@ -58,6 +58,26 @@
         "organization name. The maximum length is 40 characters.",
         str,
     ),
+    "SCANNER_NAMESERVERS": (
+        [
+            "193.17.47.1",
+            "185.43.135.1",
+            "193.110.81.0",
+            "185.253.5.0",
+            "9.9.9.9",
+            "149.112.112.112",
+            "2001:148f:ffff::1",
+            "2001:148f:fffe::1",
+            "2a0f:fc80::",
+            "2a0f:fc81::",
+            "2620:fe::fe",
+            "2620:fe::9",
+        ],
+        "Nameservers used during scans (dns endpoints and subdomains). This string is loaded as JSON, but not validated"
+        " due to limitations of this settings library. Be careful when editing(!). "
+        "This information is cached and loaded only once every 10 minutes.",
+        "json",
+    ),
     "CREDENTIAL_CHECK_URL": (
         "http://localhost:8080/api/",
         "The url where internet.nl api credentials are checked. This is usually the bare INTERNET_NL_API_URL endpoint. "
@@ -259,6 +279,7 @@
                 "SCAN_AT_ALL",
                 "INTERNET_NL_API_URL",
                 "INTERNET_NL_SCAN_TRACKING_NAME",
+                "SCANNER_NAMESERVERS",
                 "CREDENTIAL_CHECK_URL",
             ),
         ),