dnsmasq

wt/dnsmasq

0 Fork 0

mirror of http://thekelleys.org.uk/git/dnsmasq.git synced 2026-10-28 12:40:47 +00:00

T

Simon Kelley 11493fe218 Improve resistance to many simultaneous TCP connections.

Dnsmasq limits the number of simultaneous TCP connections,
to avoid resource-exhaustion attacks. Once the limit if reached,
dnsmasq stops accepting TCP connections from the kernel.

When doing dnssec validation, the same resources are used to
handle internally generated queries with large answers
needed to validate incoming queries which can still arrive via UDP.
If a dnsmasq daemon has reached the limit on incoming
TCP connections then these queries will fail to validate needlessly.

Bump the number of TCP-process resources by 50% when dnssec validation
is enabled, and reserve the extra 50% only for internally-generated
dnssec validation queries. This allows validation to continue even
when dnsmasq is ignoring new TCP requests.

Thanks to Lucas Celant <lcelant@redhat.com> for spotting this.

CVE-2026-93007 may apply.

2026-10-20 00:07:33 +01:00

bld

Remove hash-questions.c - no longer required.

2024-11-02 21:29:47 +00:00

contrib

Fix OOB writes in contrib/leasequesry/leasequery.c

2026-05-30 15:58:52 +01:00

dbus

Allow configuring filter-A/AAAA via dbus.

2023-03-08 15:35:05 +00:00

logo

tweak favicon