dnsmasq

mirror of http://thekelleys.org.uk/git/dnsmasq.git synced 2026-10-12 10:22:34 +00:00

T

Simon Kelley 74d4fcd756 Use random source ports where possible if source addresses/interfaces in use.

CVE-2021-3448 applies.

It's possible to specify the source address or interface to be
used when contacting upstream nameservers: server=8.8.8.8@1.2.3.4
or server=8.8.8.8@1.2.3.4#66 or server=8.8.8.8@eth0, and all of
these have, until now, used a single socket, bound to a fixed
port. This was originally done to allow an error (non-existent
interface, or non-local address) to be detected at start-up. This
means that any upstream servers specified in such a way don't use
random source ports, and are more susceptible to cache-poisoning
attacks.

We now use random ports where possible, even when the
source is specified, so server=8.8.8.8@1.2.3.4 or
server=8.8.8.8@eth0 will use random source
ports. server=8.8.8.8@1.2.3.4#66 or any use of --query-port will
use the explicitly configured port, and should only be done with
understanding of the security implications.
Note that this change changes non-existing interface, or non-local
source address errors from fatal to run-time. The error will be
logged and communiction with the server not possible.

2021-03-17 20:39:33 +00:00

bld

Tweak f1204a875e

2021-02-01 23:46:43 +00:00

contrib

Fix systemd unit startup order

2019-10-30 21:50:23 +00:00

dbus

Add --enable-ubus option.

2018-07-21 22:11:08 +01:00

debian

Bump version in Debian changelog.