Signed-off-by: DL6ER <dl6er@dl6er.de>

Per-client blocking rules, intermediate CNAME path blocking and some more

…to disable deep CNAME inspection. This might be beneficial for very low-end devices.

Signed-off-by: DL6ER <dl6er@dl6er.de>

Signed-off-by: DL6ER <dl6er@dl6er.de>

Signed-off-by: DL6ER <dl6er@dl6er.de>

…ular query is only seen by this client).

Signed-off-by: DL6ER <dl6er@dl6er.de>

Add CNAME_DEEP_INSPECT config option

…are never untrusted data, so not security problem.

Thanks to Klaus Eisentraut <klaus.eisentraut@web.de> for finding this.

Signed-off-by: DL6ER <dl6er@dl6er.de>

Signed-off-by: DL6ER <dl6er@dl6er.de>

…onally leads to false-negatives during the CI testing (the CI cannot always resolve the hostnames).

Signed-off-by: DL6ER <dl6er@dl6er.de>

Do not try to resolve client host names during the tests

Add group zero support

Signed-off-by: DL6ER <dl6er@dl6er.de>

Thanks to Klaus Eisentraut <klaus.eisentraut@web.de> for finding this.

Signed-off-by: DL6ER <dl6er@dl6er.de>

Calling lease_update_file() _can_ result in a call to  periodic_ra()

Since both the DHCPv6 and RA subsystems use the same packet buffer
this can overwrite the DHCPv6 packet. To avoid this we ensure the
DHCPv6 packet has been sent before calling lease_update_file().

Signed-off-by: DL6ER <dl6er@dl6er.de>

… chain, the originally queried domain itself was not counted as blocked (but as (permitted). Later in the chain, when we find that this is a bad guy, we short-circuit it. We need to correct the domain counter of the domain at the head of the chain, otherwise, the data for the top lists is misleading. For this, we go back the entire path and change the original request to blocked by increasing the blocked count of this domain by one. Fortunately, each CNAME path can easily be tracked back to the original head in FTL's data so we do not need to search it. This makes the change able to happen without causing any delay.

Signed-off-by: DL6ER <dl6er@dl6er.de>

… this information during possible later CNAME inspection. This avoids the necessity to check the whitelist filters multiple times.

Signed-off-by: DL6ER <dl6er@dl6er.de>

…ermitted property during an entire CNAME inspection process.

Signed-off-by: DL6ER <dl6er@dl6er.de>

Signed-off-by: DL6ER <dl6er@dl6er.de>

…FTL.

Signed-off-by: DL6ER <dl6er@dl6er.de>

Change ownership of all shared memory objects before switching user

Tweak CNAME whitelisting behavior

Fix two testing errors

Top lists fix for deeply blocked CNAME chains

…an be used by TCP and UDP clients avoiding any doubled amount of work.

Signed-off-by: DL6ER <dl6er@dl6er.de>

…now the same details about client/regex combinations. This commit also fixes an issue with regex group associations for configured clients that have no assigned group.

Signed-off-by: DL6ER <dl6er@dl6er.de>

…rsion 9.

Signed-off-by: DL6ER <dl6er@dl6er.de>

…t for domains and clients.

Signed-off-by: DL6ER <dl6er@dl6er.de>

Signed-off-by: DL6ER <dl6er@dl6er.de>

Add shared DNS cache between forks

Since the source address of the RAs must be the link-local address.

Hello,

My home network has a DNS search domain of home.arpa and my machine's dnsmasq
instance is configured with:

        server=/home.arpa/192.168.0.1
        server=//192.168.0.1
        stop-dns-rebind
        rebind-domain-ok=home.arpa
        rebind-domain-ok=// # Match unqualified domains

Querying my router's FQDN works as expected:

        dnsmasq: query[A] gateway.home.arpa from 127.0.0.1
        dnsmasq: forwarded gateway.home.arpa to 192.168.0.1
        dnsmasq: reply gateway.home.arpa is 192.168.0.1

But using an unqualified domain name does not:

        dnsmasq: query[A] gateway from 127.0.0.1
        dnsmasq: forwarded gateway to 192.168.0.1
        dnsmasq: possible DNS-rebind attack detected: gateway

The attached patch addresses this issue by checking for SERV_NO_REBIND when
handling dotless domains.

>From 0460b07108b009cff06e29eac54910ec2e7fafce Mon Sep 17 00:00:00 2001
From: guns <self@sungpae.com>
Date: Mon, 30 Dec 2019 16:34:23 -0600
Subject: [PATCH] Check for SERV_NO_REBIND on unqualified domains

Signed-off-by: DL6ER <dl6er@dl6er.de>

Fail on overlarge files (block numbers are limited to 16 bits)
Honour tftp-max setting in single port mode.
Tweak timeouts, and fix logic which suppresses errors if the
last ACK is missing.

Signed-off-by: DL6ER <dl6er@dl6er.de>

Signed-off-by: DL6ER <dl6er@dl6er.de>

The standard for this never made it beyond an internet-draft which expired
in 2012, so it can be considered dead, I think.

Signed-off-by: DL6ER <dl6er@dl6er.de>

Signed-off-by: DL6ER <dl6er@dl6er.de>

…s the compilation process faster. It tells the compiler to use pipes instead of temporary files during the different stages of compilation. Experiments on an AMD Athlon II X2 shows that the compile time reduces from (95.4+/-2.8)s to (88.4+/-0.2)s with this option. The measured differences are averages over 20 compilations, each.

Signed-off-by: DL6ER <dl6er@dl6er.de>

Signed-off-by: DL6ER <dl6er@dl6er.de>

Signed-off-by: DL6ER <dl6er@dl6er.de>

Fix for blocking modes

…n to be blocked.

Signed-off-by: DL6ER <dl6er@dl6er.de>

Store additional data when a deep CNAME inspection identified a domain to be blocked

…he entire CNAME chain is to be permitted.

Signed-off-by: DL6ER <dl6er@dl6er.de>

Signed-off-by: DL6ER <dl6er@dl6er.de>

Fix internal DNS cache twist

Signed-off-by: DL6ER <dl6er@dl6er.de>

Clarify gravity database debug message

…EX_CNAME, QUERY_BLACKLIST_CNAME] and store domain that was the reason for blocking during a CNAME inspection

Signed-off-by: DL6ER <dl6er@dl6er.de>

Don't use the `latest` tag, use the specific version.

Pin build image to specific version.

…EX_CNAME, QUERY_BLACKLIST_CNAME] and store domain that was the reason for blocking during a CNAME inspection

Signed-off-by: DL6ER <dl6er@dl6er.de>

…e -g itself. This drastically reduces the runtime of reload-lists.

Signed-off-by: DL6ER <dl6er@dl6er.de>

Signed-off-by: DL6ER <dl6er@dl6er.de>

Signed-off-by: DL6ER <dl6er@dl6er.de>

Signed-off-by: DL6ER <dl6er@dl6er.de>

Signed-off-by: DL6ER <dl6er@dl6er.de>

Use precomputed gravity count from database

Signed-off-by: DL6ER <dl6er@dl6er.de>

…rting identical regex filters multiple times.

Signed-off-by: DL6ER <dl6er@dl6er.de>

… empty domains in server=//... configurations.

Signed-off-by: DL6ER <dl6er@dl6er.de>

…66b3434

Signed-off-by: DL6ER <dl6er@dl6er.de>

Signed-off-by: DL6ER <dl6er@dl6er.de>

The previous code here, which started fast-RA whenever that local
address associated with a DHCP context changed, is very vulnerable
to flapping  due to dynamically created addresses in the same net.

Simplify so that if a context which has never found an interface now
finds one, that gets advertised, but not for other changes. That satisfies
the original intention that prefixes not in place when dnsmasq starts
should be recognised.

Also totally ignore all interfaces where we are configured not to do DHCP,
to preclude flapping of they have prefixes in common with interfaces
where we do DHCP.

Signed-off-by: DL6ER <dl6er@dl6er.de>

When a request matching the clid or mac address is
recieved the server will iterate over all candidate
addresses until it find's one that is not already
leased to a different clid/iaid and advertise
this address.

Using multiple reservations for a single host makes it
possible to maintain a static leases only configuration
which support network booting systems with UEFI firmware
that request a new address (a new SOLICIT with a new IA_NA
option using a new IAID) for different boot modes, for
instance 'PXE over IPv6', and 'HTTP-Boot over IPv6'. Open
Virtual Machine Firmware (OVMF) and most UEFI firmware
build on the EDK2 code base exhibit this behaviour.

Signed-off-by: DL6ER <dl6er@dl6er.de>

…resses.

Signed-off-by: DL6ER <dl6er@dl6er.de>

Fix negative blocked queries on v5.0 beta

Use -pipe

Ensure each regex is imported only once

Signed-off-by: DL6ER <dl6er@dl6er.de>

…uture. We used sed to ensure to have caught every reference.

Signed-off-by: DL6ER <dl6er@dl6er.de>

Signed-off-by: DL6ER <dl6er@dl6er.de>

… into new/CNAME_inspection_details

Signed-off-by: DL6ER <dl6er@dl6er.de>

Signed-off-by: DL6ER <dl6er@dl6er.de>

Fix subtracting one from the wrong variable

Improvements to deep CNAME inspection data processing

…ain if blocking happend during CNAME inspection

Signed-off-by: DL6ER <dl6er@dl6er.de>

Signed-off-by: DL6ER <dl6er@dl6er.de>

Signed-off-by: DL6ER <dl6er@dl6er.de>

When dnsmasq forks a child to handle a TCP connection, that
child inherits the netlink socket that the main process has open.

The child never uses that socket, but there's a chance that when the
main process uses the netlink socket, the answer will go to a child
process which has a copy of the socket. This causes the main process
to block forever awaiting the answer which never comes.

The solution is for the child process to close the netlink socket it
inherits after the fork().  There's a nasty race because the error
decribed above could still occur in the window between the fork()
and the close() syscalls. That's fixed by blocking the parent awaiting
a single byte sent though the pipe the two processes share. This byte
is sent by the child after calling close() on the netlink socket.

Thanks to Alin Năstac for spotting this.

Signed-off-by: DL6ER <dl6er@dl6er.de>

…1b49c851b531810

Signed-off-by: DL6ER <dl6er@dl6er.de>

Instead, check only local configured entries are answered without
rdbit set. All cached replies are still denied, but locally configured
names are available with both recursion and without it.

Fixes commit 4139298d287eb5c57f4aa53c459cb02fc5be2495 unintended
behaviour.

Signed-off-by: DL6ER <dl6er@dl6er.de>

Signed-off-by: DL6ER <dl6er@dl6er.de>

The former should be used according to POSIX, otherwise it causes
bunches of warnings when compiling for musl-based distros like Alpine
Linux.

Signed-off-by: DL6ER <dl6er@dl6er.de>

Make the existing "insecure DS received" warning more informative by
reporting the domain name reporting the issue.

This may help identify a problem with a specific domain or server
configuration.

Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
Signed-off-by: DL6ER <dl6er@dl6er.de>

Signed-off-by: DL6ER <dl6er@dl6er.de>

Signed-off-by: DL6ER <dl6er@dl6er.de>

Propagate ID of responsible regex up in CNAME inspection

…server. This is using an undocumented feature.

Signed-off-by: DL6ER <dl6er@dl6er.de>

Force FTL to use itself as DNS server for name lookups