wt/dnsmasq
1
0 Fork 0
mirror of http://thekelleys.org.uk/git/dnsmasq.git synced 2026-10-29 12:50:47 +00:00
Code Issues Packages Projects Releases Wiki Activity

Don't pass arbitrary characters to DNSMASQ_SUPPLIED_HOSTNAME.

Browse Source 
If the hostname supplied by a DHCPv4 client doesn't pass the
test if being an allowed hostname (ie without metacharacters) it
is ignored, but still passed to the environment variable
DNSMASQ_SUPPLIED_HOSTNAME in the dhcp-script.

Change this so that only valid hostnames appear in thos variable,
to avoid security problems with scripts that son't sanitise.

This brings DHCPv4 behaviour in line with DHCPv6.

Thanks to Daniel Birtwhistle for spotting the problem.
This commit is contained in:
Simon Kelley committed 2026-08-09 16:23:54 +01:00
1 parent 1f122521bb
commit 7a663fd46b
1 file changed
+2 -1
Download Patch File Download Diff File Expand all files Collapse all files
src/rfc2131.c
+2 -1
View File
@@ -1611,7 +1611,8 @@ size_t dhcp_reply(struct dhcp_context *context, char *iface_name, int int_index,
lease->extradata_size = lease->extradata_len = 0;
add_extradata_opt(lease, option_find(mess, sz, OPTION_VENDOR_ID, 1));
add_extradata_opt(lease, option_find(mess, sz, OPTION_HOSTNAME, 1));
lease_add_extradata(lease, (unsigned char *)client_hostname,
client_hostname ? strlen(client_hostname) : 0, 0);
add_extradata_opt(lease, oui);
add_extradata_opt(lease, serial);
add_extradata_opt(lease, class);