Simon Kelley
c6d4c33d61
Bump copyright to 2022.
2022-01-24 15:19:00 +00:00
Simon Kelley
27ce754b3d
Tidy previous commit and add manpage entries for new options.
2022-01-15 17:57:57 +00:00
Dominik Derigs
3ab0ad8748
Strip EDNS(0) Client Subnet / MAC information if --strip-subnet or --strip-mac is set. If both the add and strip options are set, incoming EDNS0 options are replaced. This ensures we do not unintentionally forward client information somewhere upstream when ECS is used in lower DNS layers in our local network.
...
Signed-off-by: DL6ER <dl6er@dl6er.de >
2022-01-15 15:36:28 +00:00
Simon Kelley
011f8cf1d0
Tidy code for --umbrella option.
2022-01-01 23:33:39 +00:00
Simon Kelley
37a70d39e0
Add --filter and --filter-AAAA options.
2021-10-07 23:12:59 +01:00
Brian Hartvigsen
d942aa9321
Support Cisco Umbrella/OpenDNS Device ID & Remote IP
...
This is based on the information at
https://docs.umbrella.com/umbrella-api/docs/identifying-dns-traffic and
https://docs.umbrella.com/umbrella-api/docs/identifying-dns-traffic2 .
Using --umbrella by itself will enable Remote IP reporting. This can not
be used for any policy filtering in Cisco Umbrella/OpenDNS. Additional
information can be supplied using specific option specifications,
multiple can be separated by a comma:
--umbrella=orgid:1234,deviceid=0123456789abcdef
Specifies that you want to report organization 1234 using device
0123456789abcdef. For Cisco Umbrella Enterprise, see "Register (Create)
a device" (https://docs.umbrella.com/umbrella-api/docs/create-a-device )
for how to get a Device ID and "Organization ID endpoint"
(https://docs.umbrella.com/umbrella-api/docs/organization-endpoint ) to
get organizations ID. For OpenDNS Home Users, there is no organization,
see Registration API endpoint
(https://docs.umbrella.com/umbrella-api/docs/registration-api-endpoint2 )
for how to get a Device ID. Asset ID should be ignored unless
specifically instructed to use by support.
Signed-off-by: Brian Hartvigsen <brian.andrew@brianandjenny.com >
2021-04-14 00:16:14 +01:00
Simon Kelley
c8e8f5c204
Bump copyright notices for 2021. Happy New Year!
2021-01-24 21:59:37 +00:00
Simon Kelley
25e63f1e56
Handle caching with EDNS options better.
...
If we add the EDNS client subnet option, or the client's
MAC address, then the reply we get back may very depending on
that. Since the cache is ignorant of such things, it's not safe to
cache such replies. This patch determines when a dangerous EDNS
option is being added and disables caching.
Note that for much the same reason, we can't combine multiple
queries for the same question when dangerous EDNS options are
being added, and the code now handles that in the same way. This
query combining is required for security against cache poisoning,
so disabling the cache has a security function as well as a
correctness one.
2020-12-16 15:49:03 +00:00
Simon Kelley
2a8710ac2f
Update copyrights to 2020.
2020-01-05 16:40:06 +00:00
Simon Kelley
ee8750451b
Remove ability to compile without IPv6 support.
...
This was the source of a large number of #ifdefs, originally
included for use with old embedded libc versions. I'm
sure no-one wants or needs IPv6-free code these days, so this
is a move towards more maintainable code.
2018-10-23 22:10:17 +01:00
Simon Kelley
d1ced3ae38
Update copyrights to 2018.
2018-01-01 22:18:03 +00:00
Simon Kelley
6a0b00f0d6
Misc code cleanups arising from Google analysis.
...
No security impleications or CVEs.
2017-09-25 20:19:55 +01:00
Simon Kelley
51eadb692a
Security fix, CVE-2017-14495, OOM in DNS response creation.
...
Fix out-of-memory Dos vulnerability. An attacker which can
send malicious DNS queries to dnsmasq can trigger memory
allocations in the add_pseudoheader function
The allocated memory is never freed which leads to a DoS
through memory exhaustion. dnsmasq is vulnerable only
if one of the following option is specified:
--add-mac, --add-cpe-id or --add-subnet.
2017-09-25 20:16:50 +01:00
Simon Kelley
897c113fda
Security fix, CVE-2017-14496, Integer underflow in DNS response creation.
...
Fix DoS in DNS. Invalid boundary checks in the
add_pseudoheader function allows a memcpy call with negative
size An attacker which can send malicious DNS queries
to dnsmasq can trigger a DoS remotely.
dnsmasq is vulnerable only if one of the following option is
specified: --add-mac, --add-cpe-id or --add-subnet.
2017-09-25 20:11:58 +01:00
Simon Kelley
a3303e196e
Don't return arcount=1 if EDNS0 RR won't fit in the packet.
...
Omitting the EDNS0 RR but setting arcount gives a malformed packet.
Also, don't accept UDP packet size less than 512 in recieved EDNS0.
2017-09-07 20:45:00 +01:00
Simon Kelley
50ca85504c
Bump year in copyrights.
2017-06-24 22:43:18 +01:00
Simon Kelley
0fbd980639
Fix compiler warning.
2017-05-21 22:24:43 +01:00
Simon Kelley
87985855ad
Remove pre-existing EDNS0_OPTION_NOMDEVICEID if MAC address unknown.
2016-04-25 15:33:30 +01:00
Simon Kelley
aa300f7167
Fix typo in last commit.
2016-03-01 15:19:13 +00:00
Simon Kelley
c7f3bd2ac8
Replace incoming EDNS0_OPTION_NOMDEVICEID and EDNS0_OPTION_NOMCPEID options.
2016-02-28 21:48:34 +00:00
Simon Kelley
22fe2fd038
Fix --add-subnet when returning empty or default subnet.
2016-02-28 17:07:10 +00:00
Simon Kelley
9e4cf47ee8
Add --add-mac=text option.
2016-02-17 20:26:32 +00:00
Simon Kelley
1e5051228d
Final form of configuration for EDNS0 MAC-address code.
2016-01-25 21:29:23 +00:00
Simon Kelley
c49778df4a
Update copyright notices. Happy new year!
2016-01-06 18:52:33 +00:00
Simon Kelley
33702ab1f8
First complete version of DNS-client-id EDNS0 and ARP tracking code.
2015-12-28 23:17:15 +00:00
Simon Kelley
11867dc28c
Cache access to the kernel's ARP table.
2015-12-23 16:15:58 +00:00
Simon Kelley
efef497b89
Fix build failure when DNSSEC code omitted.
2015-12-21 17:30:44 +00:00
Simon Kelley
5aa5f0ff2f
Truncate DNS replies >512 bytes that the client isn't expecting.
2015-12-21 17:20:35 +00:00
Simon Kelley
5bb88f0963
Handle extending EDNS0 OPT RR.
2015-12-21 16:23:47 +00:00
Simon Kelley
1d03016bbc
Split EDNS0 stuff into its own source file.
2015-12-21 14:17:06 +00:00
Simon Kelley