AOH :: HP Unsorted S :: TB13086.HTM

simple dns rebinding protection with dnsmasq



simple dns rebinding protection with dnsmasq
simple dns rebinding protection with dnsmasq



dnsmasq (http://www.thekelleys.org.uk/dnsmasq/doc.html) a popular DHCP 
and DNS forwarder and cache server used on many DSL/Cable routers now
has a simple DNS Rebinding protection mechanism. When executed with the
--stop-dns-rebind option the DNS resolver in dnsmasq will filter out
private IP addresses (127.0.0.0/8, 192.168.0.0/16, 10.0.0.0/8,
172.16.0.0/12 and 169.254.0.0/16). This should be sufficient for most
private/home users.

Feedback welcome.


dnsmasq:
http://www.thekelleys.org.uk/dnsmasq/doc.html 


dnsmasq with dns rebinding protection:
http://www.thekelleys.org.uk/dnsmasq/test-releases/dnsmasq-2.41test11.tar.gz 

orginal patch:  
http://www.mulliner.org/blog/blosxom.cgi/security/dnsmasq_dnsrebinding_protection_patch.html 



Collin

--
Collin R. Mulliner  
BETAVERSiON Systems [www.betaversion.net] 
info/pgp: finger collin@betaversion.net 
weblog: http://www.mulliner.org/blog/ 
Tabs are for indentation space is for astronauts.


The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH
We do not send spam. If you have received spam bearing an artofhacking.com email address, please forward it with full headers to abuse@artofhacking.com.