aboutsummaryrefslogtreecommitdiffstats
path: root/target
diff options
context:
space:
mode:
authorKevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>2018-10-08 20:40:36 +0100
committerKevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>2018-10-09 09:45:16 +0100
commita45f4f50e16cd2d0370a4470c3ede0c6c7754ba9 (patch)
tree0ea5e1900b54fa8ef5863b2a100c66aaf6962f3b /target
parent3925298f3ca9bcd854571367d98bb6ca07f4e66e (diff)
downloadupstream-a45f4f50e16cd2d0370a4470c3ede0c6c7754ba9.tar.gz
upstream-a45f4f50e16cd2d0370a4470c3ede0c6c7754ba9.tar.bz2
upstream-a45f4f50e16cd2d0370a4470c3ede0c6c7754ba9.zip
dnsmasq: add dhcp-ignore-names support - CERT VU#598349
dnsmasq v2.80test8 adds the ability to ignore dhcp client's requests for specific hostnames. Clients claiming certain hostnames and thus claiming DNS namespace represent a potential security risk. e.g. a malicious host could claim 'wpad' for itself and redirect other web client requests to it for nefarious purpose. See CERT VU#598349 for more details. Some Samsung TVs are claiming the hostname 'localhost', it is believed not (yet) for nefarious purposes. /usr/share/dnsmasq/dhcpbogushostname.conf contains a list of hostnames in correct syntax to be excluded. e.g. dhcp-name-match=set:dhcp_bogus_hostname,localhost Inclusion of this file is controlled by uci option dhcpbogushostname which is enabled by default. To be absolutely clear, DHCP leases to these requesting hosts are still permitted, but they do NOT get to claim ownership of the hostname itself and hence put into DNS for other hosts to be confused/manipulate by. Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
Diffstat (limited to 'target')
0 files changed, 0 insertions, 0 deletions