aboutsummaryrefslogtreecommitdiffstats
path: root/package/dnsmasq/files
diff options
context:
space:
mode:
authorJo-Philipp Wich <jow@openwrt.org>2010-07-16 00:06:59 +0000
committerJo-Philipp Wich <jow@openwrt.org>2010-07-16 00:06:59 +0000
commitd5e9eb69715f97c4c5dda4dc5da4c5839ebf152a (patch)
tree72a2b61930bdeb40bd7024ca2f3de41284fd7f35 /package/dnsmasq/files
parent8253f19290870c06aff6e43aa6ec86ec4bfce126 (diff)
downloadupstream-d5e9eb69715f97c4c5dda4dc5da4c5839ebf152a.tar.gz
upstream-d5e9eb69715f97c4c5dda4dc5da4c5839ebf152a.tar.bz2
upstream-d5e9eb69715f97c4c5dda4dc5da4c5839ebf152a.zip
[package] dnsmasq: add and enable DNS rebind protections
git-svn-id: svn://svn.openwrt.org/openwrt/trunk@22222 3c298f89-4303-0410-b956-a3cf2f4a3e73
Diffstat (limited to 'package/dnsmasq/files')
-rw-r--r--package/dnsmasq/files/dhcp.conf5
-rw-r--r--package/dnsmasq/files/dnsmasq.init23
2 files changed, 27 insertions, 1 deletions
diff --git a/package/dnsmasq/files/dhcp.conf b/package/dnsmasq/files/dhcp.conf
index 25ecde6f5d..c79458fb2b 100644
--- a/package/dnsmasq/files/dhcp.conf
+++ b/package/dnsmasq/files/dhcp.conf
@@ -1,8 +1,11 @@
config dnsmasq
option domainneeded 1
option boguspriv 1
- option filterwin2k '0' #enable for dial on demand
+ option filterwin2k 0 # enable for dial on demand
option localise_queries 1
+ option rebind_protection 1 # disable if upstream must serve RFC1918 addresses
+ option rebind_localhost 0 # enable for RBL checking and similar services
+ #list rebind_domain example.lan # whitelist RFC1918 responses for domains
option local '/lan/'
option domain 'lan'
option expandhosts 1
diff --git a/package/dnsmasq/files/dnsmasq.init b/package/dnsmasq/files/dnsmasq.init
index 9bf89fa6df..49291a5c8a 100644
--- a/package/dnsmasq/files/dnsmasq.init
+++ b/package/dnsmasq/files/dnsmasq.init
@@ -99,6 +99,29 @@ dnsmasq() {
config_get hostsfile "$cfg" dhcphostsfile
[ -e "$hostsfile" ] && append args "--dhcp-hostsfile=$hostsfile"
+
+ local rebind
+ config_get_bool rebind "$cfg" rebind_protection 1
+ [ $rebind -gt 0 ] && {
+ logger -t dnsmasq \
+ "DNS rebinding protection is active," \
+ "will discard upstream RFC1918 responses!"
+ append args "--stop-dns-rebind"
+
+ local rebind_localhost
+ config_get_bool rebind_localhost "$cfg" rebind_localhost 0
+ [ $rebind_localhost -gt 0 ] && {
+ logger -t dnsmasq "Allowing 127.0.0.0/8 responses"
+ append args "--rebind-localhost-ok"
+ }
+
+ append_rebind_domain() {
+ logger -t dnsmasq "Allowing RFC1918 responses for domain $1"
+ append args "--rebind-domain-ok=$1"
+ }
+
+ config_list_foreach "$cfg" rebind_domain append_rebind_domain
+ }
}
dhcp_subscrid_add() {