Pi-Hole/dnsmasq
1
0
Fork 0
mirror of https://github.com/pi-hole/dnsmasq.git synced 2025-12-19 10:18:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

Set --local-service in Debian package startup.

Browse Source
This commit is contained in:
Simon Kelley
2014-03-05 15:01:08 +00:00
parent c8a80487cd
commit 1a9a3489ec
3 changed files with 17 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
debian/changelog vendored
View File

@@ -1,6 +1,12 @@
dnsmasq (2.69-1) unstable; urgency=low dnsmasq (2.69-1) unstable; urgency=low
* New upstream. * New upstream.
* Set --local-service. (closes: #732610)
This tells dnsmasq to ignore DNS requests that don't come from a local network.
It's automatically ignored if --interface --except-interface, --listen-address
or --auth-server exist in the configuration, so for most installations, it will
have no effect, but for otherwise-unconfigured installations, it stops dnsmasq
from being vulnerable to DNS-reflection attacks.
-- Simon Kelley <simon@thekelleys.org.uk> Tue, 4 Feb 2014 16:28:12 +0000 -- Simon Kelley <simon@thekelleys.org.uk> Tue, 4 Feb 2014 16:28:12 +0000

8
debian/init vendored
View File

@@ -90,6 +90,14 @@ if [ ! "$DNSMASQ_USER" ]; then
DNSMASQ_USER="dnsmasq" DNSMASQ_USER="dnsmasq"
fi fi
# This tells dnsmasq to ignore DNS requests that don't come from a local network.
# It's automatically ignored if --interface --except-interface, --listen-address
# or --auth-server exist in the configuration, so for most installations, it will
# have no effect, but for otherwise-unconfigured installations, it stops dnsmasq
# from being vulnerable to DNS-reflection attacks.
DNSMASQ_OPTS="$DNSMASQ_OPTS --local-service"
start() start()
{ {
# Return # Return

3
src/dnsmasq.c
View File

@@ -662,6 +662,9 @@ int main (int argc, char **argv)
} }
#endif #endif
if (option_bool(OPT_LOCAL_SERVICE))
my_syslog(LOG_INFO, _("DNS service limited to local subnets"));
#ifdef HAVE_DNSSEC #ifdef HAVE_DNSSEC
if (option_bool(OPT_DNSSEC_VALID)) if (option_bool(OPT_DNSSEC_VALID))
my_syslog(LOG_INFO, _("DNSSEC validation enabled")); my_syslog(LOG_INFO, _("DNSSEC validation enabled"));