From a45f4f50e16cd2d0370a4470c3ede0c6c7754ba9 Mon Sep 17 00:00:00 2001 From: Kevin Darbyshire-Bryant Date: Mon, 8 Oct 2018 20:40:36 +0100 Subject: dnsmasq: add dhcp-ignore-names support - CERT VU#598349 dnsmasq v2.80test8 adds the ability to ignore dhcp client's requests for specific hostnames. Clients claiming certain hostnames and thus claiming DNS namespace represent a potential security risk. e.g. a malicious host could claim 'wpad' for itself and redirect other web client requests to it for nefarious purpose. See CERT VU#598349 for more details. Some Samsung TVs are claiming the hostname 'localhost', it is believed not (yet) for nefarious purposes. /usr/share/dnsmasq/dhcpbogushostname.conf contains a list of hostnames in correct syntax to be excluded. e.g. dhcp-name-match=set:dhcp_bogus_hostname,localhost Inclusion of this file is controlled by uci option dhcpbogushostname which is enabled by default. To be absolutely clear, DHCP leases to these requesting hosts are still permitted, but they do NOT get to claim ownership of the hostname itself and hence put into DNS for other hosts to be confused/manipulate by. Signed-off-by: Kevin Darbyshire-Bryant --- package/network/services/dnsmasq/files/dhcpbogushostname.conf | 8 ++++++++ 1 file changed, 8 insertions(+) create mode 100644 package/network/services/dnsmasq/files/dhcpbogushostname.conf (limited to 'package/network/services/dnsmasq/files/dhcpbogushostname.conf') diff --git a/package/network/services/dnsmasq/files/dhcpbogushostname.conf b/package/network/services/dnsmasq/files/dhcpbogushostname.conf new file mode 100644 index 0000000000..e83b6975d0 --- /dev/null +++ b/package/network/services/dnsmasq/files/dhcpbogushostname.conf @@ -0,0 +1,8 @@ +# dhcpbogushostname.conf included configuration file for dnsmasq +# +# includes a list of hostnames that should not be associated with dhcp leases +# in response to CERT VU#598349 +# file included by default, option dhcpbogushostname 0 to disable + +dhcp-name-match=set:dhcp_bogus_hostname,localhost +dhcp-name-match=set:dhcp_bogus_hostname,wpad -- cgit v1.2.3