aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorKevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>2018-09-20 18:26:33 +0100
committerKevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>2018-09-21 09:59:03 +0100
commit6c4cbe94bd940b5c061e27744eb78805764d6b34 (patch)
treee887c491de6f7897a05fb8f39eb68ea46fdf7dae
parent95b3f8ec8d4d27525c8eb016b70290d380c55d0a (diff)
downloadupstream-6c4cbe94bd940b5c061e27744eb78805764d6b34.tar.gz
upstream-6c4cbe94bd940b5c061e27744eb78805764d6b34.tar.bz2
upstream-6c4cbe94bd940b5c061e27744eb78805764d6b34.zip
dnsmasq: Change behavior when RD bit unset in queries.
Backport upstream commit Change anti cache-snooping behaviour with queries with the recursion-desired bit unset. Instead to returning SERVFAIL, we now always forward, and never answer from the cache. This allows "dig +trace" command to work. Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
-rw-r--r--package/network/services/dnsmasq/Makefile2
-rw-r--r--package/network/services/dnsmasq/patches/0002-Change-behavior-when-RD-bit-unset-in-queries.patch54
2 files changed, 55 insertions, 1 deletions
diff --git a/package/network/services/dnsmasq/Makefile b/package/network/services/dnsmasq/Makefile
index 936d73895e..4213e70eae 100644
--- a/package/network/services/dnsmasq/Makefile
+++ b/package/network/services/dnsmasq/Makefile
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
PKG_NAME:=dnsmasq
PKG_VERSION:=2.80test6
-PKG_RELEASE:=2
+PKG_RELEASE:=3
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
PKG_SOURCE_URL:=http://thekelleys.org.uk/dnsmasq/test-releases
diff --git a/package/network/services/dnsmasq/patches/0002-Change-behavior-when-RD-bit-unset-in-queries.patch b/package/network/services/dnsmasq/patches/0002-Change-behavior-when-RD-bit-unset-in-queries.patch
new file mode 100644
index 0000000000..4f787e3cd5
--- /dev/null
+++ b/package/network/services/dnsmasq/patches/0002-Change-behavior-when-RD-bit-unset-in-queries.patch
@@ -0,0 +1,54 @@
+From 4139298d287eb5c57f4aa53c459cb02fc5be2495 Mon Sep 17 00:00:00 2001
+From: Simon Kelley <simon@thekelleys.org.uk>
+Date: Wed, 19 Sep 2018 22:27:11 +0100
+Subject: [PATCH 2/2] Change behavior when RD bit unset in queries.
+
+Change anti cache-snooping behaviour with queries with the
+recursion-desired bit unset. Instead to returning SERVFAIL, we
+now always forward, and never answer from the cache. This
+allows "dig +trace" command to work.
+
+Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
+---
+ CHANGELOG | 7 ++++++-
+ src/rfc1035.c | 8 +++-----
+ 2 files changed, 9 insertions(+), 6 deletions(-)
+
+--- a/CHANGELOG
++++ b/CHANGELOG
+@@ -59,7 +59,12 @@ version 2.80
+ Returning null addresses is a useful technique for ad-blocking.
+ Thanks to Peter Russell for the suggestion.
+
+-
++ Change anti cache-snooping behaviour with queries with the
++ recursion-desired bit unset. Instead to returning SERVFAIL, we
++ now always forward, and never answer from the cache. This
++ allows "dig +trace" command to work.
++
++
+ version 2.79
+ Fix parsing of CNAME arguments, which are confused by extra spaces.
+ Thanks to Diego Aguirre for spotting the bug.
+--- a/src/rfc1035.c
++++ b/src/rfc1035.c
+@@ -1293,16 +1293,14 @@ size_t answer_request(struct dns_header
+ struct mx_srv_record *rec;
+ size_t len;
+
+- if (ntohs(header->ancount) != 0 ||
++ /* never answer queries with RD unset, to avoid cache snooping. */
++ if (!(header->hb3 & HB3_RD) ||
++ ntohs(header->ancount) != 0 ||
+ ntohs(header->nscount) != 0 ||
+ ntohs(header->qdcount) == 0 ||
+ OPCODE(header) != QUERY )
+ return 0;
+
+- /* always servfail queries with RD unset, to avoid cache snooping. */
+- if (!(header->hb3 & HB3_RD))
+- return setup_reply(header, qlen, NULL, F_SERVFAIL, 0);
+-
+ /* Don't return AD set if checking disabled. */
+ if (header->hb4 & HB4_CD)
+ sec_data = 0;