Pi-Hole/dnsmasq
1
0
Fork 0
mirror of https://github.com/pi-hole/dnsmasq.git synced 2025-12-19 18:28:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

--local-service. Default protection from DNS amplification attacks.

Browse Source
This commit is contained in:
Simon Kelley
2014-03-05 14:29:54 +00:00
parent 4ea8e80dd9
commit c8a80487cd
6 changed files with 133 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

62
src/forward.c
View File

@@ -1081,6 +1081,37 @@ void receive_query(struct listener *listen, time_t now)
source_addr.in6.sin6_flowinfo = 0;
#endif
/* We can be configured to only accept queries from at-most-one-hop-away addresses. */
if (option_bool(OPT_LOCAL_SERVICE))
{
struct addrlist *addr;
#ifdef HAVE_IPV6
if (listen->family == AF_INET6)
{
for (addr = daemon->interface_addrs; addr; addr = addr->next)
if ((addr->flags & ADDRLIST_IPV6) &&
is_same_net6(&addr->addr.addr.addr6, &source_addr.in6.sin6_addr, addr->prefixlen))
break;
}
else
#endif
{
struct in_addr netmask;
for (addr = daemon->interface_addrs; addr; addr = addr->next)
{
netmask.s_addr = 0xffffffff << (32 - addr->prefixlen);
if (!(addr->flags & ADDRLIST_IPV6) &&
is_same_net(addr->addr.addr.addr4, source_addr.in.sin_addr, netmask))
break;
}
}
if (!addr)
{
my_syslog(LOG_WARNING, _("Ignoring query from non-local network"));
return;
}
}
if (check_dst)
{
struct ifreq ifr;
@@ -1544,6 +1575,37 @@ unsigned char *tcp_request(int confd, time_t now,
if (getpeername(confd, (struct sockaddr *)&peer_addr, &peer_len) == -1)
return packet;
/* We can be configured to only accept queries from at-most-one-hop-away addresses. */
if (option_bool(OPT_LOCAL_SERVICE))
{
struct addrlist *addr;
#ifdef HAVE_IPV6
if (peer_addr.sa.sa_family == AF_INET6)
{
for (addr = daemon->interface_addrs; addr; addr = addr->next)
if ((addr->flags & ADDRLIST_IPV6) &&
is_same_net6(&addr->addr.addr.addr6, &peer_addr.in6.sin6_addr, addr->prefixlen))
break;
}
else
#endif
{
struct in_addr netmask;
for (addr = daemon->interface_addrs; addr; addr = addr->next)
{
netmask.s_addr = 0xffffffff << (32 - addr->prefixlen);
if (!(addr->flags & ADDRLIST_IPV6) &&
is_same_net(addr->addr.addr.addr4, peer_addr.in.sin_addr, netmask))
break;
}
}
if (!addr)
{
my_syslog(LOG_WARNING, _("Ignoring query from non-local network"));
return packet;
}
}
while (1)
{