-/* dnsmasq is Copyright (c) 2000-2013 Simon Kelley
+/* dnsmasq is Copyright (c) 2000-2014 Simon Kelley
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
#include "dnsmasq.h"
+#ifndef IN6_IS_ADDR_ULA
+#define IN6_IS_ADDR_ULA(a) ((((__const uint32_t *) (a))[0] & htonl (0xfe00000)) == htonl (0xfc000000))
+#endif
+
#ifdef HAVE_LINUX_NETWORK
int indextoname(int fd, int index, char *name)
for (tmp = daemon->authinterface; tmp; tmp = tmp->next)
if (tmp->name)
{
- if (strcmp(tmp->name, name) == 0)
+ if (strcmp(tmp->name, name) == 0 &&
+ (tmp->addr.sa.sa_family == 0 || tmp->addr.sa.sa_family == family))
break;
}
else if (addr && tmp->addr.sa.sa_family == AF_INET && family == AF_INET &&
};
static int iface_allowed(struct iface_param *param, int if_index, char *label,
- union mysockaddr *addr, struct in_addr netmask, int dad)
+ union mysockaddr *addr, struct in_addr netmask, int prefixlen, int dad)
{
struct irec *iface;
int mtu = 0, loopback;
int tftp_ok = !!option_bool(OPT_TFTP);
int dhcp_ok = 1;
int auth_dns = 0;
-#ifdef HAVE_DHCP
+#if defined(HAVE_DHCP) || defined(HAVE_TFTP)
struct iname *tmp;
#endif
+ (void)prefixlen;
+
if (!indextoname(param->fd, if_index, ifr.ifr_name) ||
ioctl(param->fd, SIOCGIFFLAGS, &ifr) == -1)
return 0;
label = ifr.ifr_name;
- /* Update addresses from interface_names. These are a set independent
- of the set we're listening on. */
#ifdef HAVE_IPV6
if (addr->sa.sa_family != AF_INET6 || !IN6_IS_ADDR_LINKLOCAL(&addr->in6.sin6_addr))
#endif
{
struct interface_name *int_name;
struct addrlist *al;
-
+#ifdef HAVE_AUTH
+ struct auth_zone *zone;
+ struct auth_name_list *name;
+
+ /* Find subnets in auth_zones */
+ for (zone = daemon->auth_zones; zone; zone = zone->next)
+ for (name = zone->interface_names; name; name = name->next)
+ if (wildcard_match(name->name, label))
+ {
+ if (addr->sa.sa_family == AF_INET && (name->flags & AUTH4))
+ {
+ if (param->spare)
+ {
+ al = param->spare;
+ param->spare = al->next;
+ }
+ else
+ al = whine_malloc(sizeof(struct addrlist));
+
+ if (al)
+ {
+ al->next = zone->subnet;
+ zone->subnet = al;
+ al->prefixlen = prefixlen;
+ al->addr.addr.addr4 = addr->in.sin_addr;
+ al->flags = 0;
+ }
+ }
+
+#ifdef HAVE_IPV6
+ if (addr->sa.sa_family == AF_INET6 && (name->flags & AUTH6))
+ {
+ if (param->spare)
+ {
+ al = param->spare;
+ param->spare = al->next;
+ }
+ else
+ al = whine_malloc(sizeof(struct addrlist));
+
+ if (al)
+ {
+ al->next = zone->subnet;
+ zone->subnet = al;
+ al->prefixlen = prefixlen;
+ al->addr.addr.addr6 = addr->in6.sin6_addr;
+ al->flags = ADDRLIST_IPV6;
+ }
+ }
+#endif
+
+ }
+#endif
+
+ /* Update addresses from interface_names. These are a set independent
+ of the set we're listening on. */
for (int_name = daemon->int_names; int_name; int_name = int_name->next)
- if (strncmp(label, int_name->intr, IF_NAMESIZE) == 0)
+ if (strncmp(label, int_name->intr, IF_NAMESIZE) == 0 &&
+ (addr->sa.sa_family == int_name->family || int_name->family == 0))
{
if (param->spare)
{
if (al)
{
+ al->next = int_name->addr;
+ int_name->addr = al;
+
if (addr->sa.sa_family == AF_INET)
{
al->addr.addr.addr4 = addr->in.sin_addr;
- al->next = int_name->addr4;
- int_name->addr4 = al;
+ al->flags = 0;
}
#ifdef HAVE_IPV6
else
{
al->addr.addr.addr6 = addr->in6.sin6_addr;
- al->next = int_name->addr6;
- int_name->addr6 = al;
+ al->flags = ADDRLIST_IPV6;
}
#endif
}
if (sockaddr_isequal(&iface->addr, addr))
{
iface->dad = dad;
+ iface->found = 1; /* for garbage collection */
return 1;
}
#endif
+#ifdef HAVE_TFTP
if (daemon->tftp_interfaces)
{
/* dedicated tftp interface list */
if (tmp->name && wildcard_match(tmp->name, ifr.ifr_name))
tftp_ok = 1;
}
+#endif
/* add to list */
if ((iface = whine_malloc(sizeof(struct irec))))
iface->dns_auth = auth_dns;
iface->mtu = mtu;
iface->dad = dad;
- iface->done = iface->multicast_done = 0;
+ iface->found = 1;
+ iface->done = iface->multicast_done = iface->warned = 0;
iface->index = if_index;
if ((iface->name = whine_malloc(strlen(ifr.ifr_name)+1)))
{
struct in_addr netmask; /* dummy */
netmask.s_addr = 0;
- (void)prefix; /* warning */
(void)scope; /* warning */
(void)preferred;
(void)valid;
addr.in6.sin6_family = AF_INET6;
addr.in6.sin6_addr = *local;
addr.in6.sin6_port = htons(daemon->port);
- addr.in6.sin6_scope_id = if_index;
+ /* FreeBSD insists this is zero for non-linklocal addresses */
+ if (IN6_IS_ADDR_LINKLOCAL(local))
+ addr.in6.sin6_scope_id = if_index;
+ else
+ addr.in6.sin6_scope_id = 0;
- return iface_allowed((struct iface_param *)vparam, if_index, NULL, &addr, netmask, !!(flags & IFACE_TENTATIVE));
+ return iface_allowed((struct iface_param *)vparam, if_index, NULL, &addr, netmask, prefix, !!(flags & IFACE_TENTATIVE));
}
#endif
struct in_addr netmask, struct in_addr broadcast, void *vparam)
{
union mysockaddr addr;
+ int prefix, bit;
memset(&addr, 0, sizeof(addr));
#ifdef HAVE_SOCKADDR_SA_LEN
addr.in.sin_addr = local;
addr.in.sin_port = htons(daemon->port);
- return iface_allowed((struct iface_param *)vparam, if_index, label, &addr, netmask, 0);
+ /* determine prefix length from netmask */
+ for (prefix = 32, bit = 1; (bit & ntohl(netmask.s_addr)) == 0 && prefix != 0; bit = bit << 1, prefix--);
+
+ return iface_allowed((struct iface_param *)vparam, if_index, label, &addr, netmask, prefix, 0);
}
int enumerate_interfaces(int reset)
int errsave, ret = 1;
struct addrlist *addr, *tmp;
struct interface_name *intname;
-
+ struct irec *iface;
+#ifdef HAVE_AUTH
+ struct auth_zone *zone;
+#endif
+
/* Do this max once per select cycle - also inhibits netlink socket use
in TCP child processes. */
if ((param.fd = socket(PF_INET, SOCK_DGRAM, 0)) == -1)
return 0;
+ /* Mark interfaces for garbage collection */
+ for (iface = daemon->interfaces; iface; iface = iface->next)
+ iface->found = 0;
+
/* remove addresses stored against interface_names */
for (intname = daemon->int_names; intname; intname = intname->next)
{
- for (addr = intname->addr4; addr; addr = tmp)
+ for (addr = intname->addr; addr; addr = tmp)
{
tmp = addr->next;
addr->next = spare;
spare = addr;
}
- intname->addr4 = NULL;
+ intname->addr = NULL;
+ }
-#ifdef HAVE_IPV6
- for (addr = intname->addr6; addr; addr = tmp)
- {
- tmp = addr->next;
- addr->next = spare;
- spare = addr;
- }
-
- intname->addr6 = NULL;
+#ifdef HAVE_AUTH
+ /* remove addresses stored against auth_zone subnets, but not
+ ones configured as address literals */
+ for (zone = daemon->auth_zones; zone; zone = zone->next)
+ if (zone->interface_names)
+ {
+ struct addrlist **up;
+ for (up = &zone->subnet, addr = zone->subnet; addr; addr = tmp)
+ {
+ tmp = addr->next;
+ if (addr->flags & ADDRLIST_LITERAL)
+ up = &addr->next;
+ else
+ {
+ *up = addr->next;
+ addr->next = spare;
+ spare = addr;
+ }
+ }
+ }
#endif
- }
-
+
param.spare = spare;
#ifdef HAVE_IPV6
errsave = errno;
close(param.fd);
+
+ if (option_bool(OPT_CLEVERBIND))
+ {
+ /* Garbage-collect listeners listening on addresses that no longer exist.
+ Does nothing when not binding interfaces or for listeners on localhost,
+ since the ->iface field is NULL. Note that this needs the protections
+ against re-entrancy, hence it's here. It also means there's a possibility,
+ in OPT_CLEVERBIND mode, that at listener will just disappear after
+ a call to enumerate_interfaces, this is checked OK on all calls. */
+ struct listener *l, *tmp, **up;
+
+ for (up = &daemon->listeners, l = daemon->listeners; l; l = tmp)
+ {
+ tmp = l->next;
+
+ if (!l->iface || l->iface->found)
+ up = &l->next;
+ else
+ {
+ *up = l->next;
+
+ /* In case it ever returns */
+ l->iface->done = 0;
+
+ if (l->fd != -1)
+ close(l->fd);
+ if (l->tcpfd != -1)
+ close(l->tcpfd);
+ if (l->tftpfd != -1)
+ close(l->tftpfd);
+
+ free(l);
+ }
+ }
+ }
+
errno = errsave;
-
+
spare = param.spare;
active = 0;
-
+
return ret;
}
if ((fd = socket(family, type, 0)) == -1)
{
- int port;
+ int port, errsav;
char *s;
/* No error if the kernel just doesn't support this IP flavour */
return -1;
err:
+ errsav = errno;
port = prettyprint_addr(addr, daemon->addrbuff);
if (!option_bool(OPT_NOWILD) && !option_bool(OPT_CLEVERBIND))
sprintf(daemon->addrbuff, "port %d", port);
if (fd != -1)
close (fd);
-
+
+ errno = errsav;
+
if (dienow)
{
/* failure to bind addresses given by --listen-address at this point
if (listen(fd, 5) == -1)
goto err;
}
- else if (!option_bool(OPT_NOWILD))
+ else if (family == AF_INET)
{
- if (family == AF_INET)
+ if (!option_bool(OPT_NOWILD))
{
#if defined(HAVE_LINUX_NETWORK)
if (setsockopt(fd, IPPROTO_IP, IP_PKTINFO, &opt, sizeof(opt)) == -1)
goto err;
#endif
}
+ }
#ifdef HAVE_IPV6
- else if (!set_ipv6pktinfo(fd))
- goto err;
+ else if (!set_ipv6pktinfo(fd))
+ goto err;
#endif
- }
return fd;
}
struct listener *l = NULL;
int fd = -1, tcpfd = -1, tftpfd = -1;
+ (void)do_tftp;
+
if (daemon->port != 0)
{
fd = make_sock(addr, SOCK_DGRAM, dienow);
l->family = addr->sa.sa_family;
l->fd = fd;
l->tcpfd = tcpfd;
- l->tftpfd = tftpfd;
+ l->tftpfd = tftpfd;
+ l->iface = NULL;
}
return l;
struct iname *if_tmp;
for (iface = daemon->interfaces; iface; iface = iface->next)
- if (!iface->done && !iface->dad &&
+ if (!iface->done && !iface->dad && iface->found &&
(new = create_listeners(&iface->addr, iface->tftp_ok, dienow)))
{
new->iface = iface;
if (!if_tmp->used &&
(new = create_listeners(&if_tmp->addr, !!option_bool(OPT_TFTP), dienow)))
{
- new->iface = NULL;
new->next = daemon->listeners;
daemon->listeners = new;
}
}
+/* In --bind-interfaces, the only access control is the addresses we're listening on.
+ There's nothing to avoid a query to the address of an internal interface arriving via
+ an external interface where we don't want to accept queries, except that in the usual
+ case the addresses of internal interfaces are RFC1918. When bind-interfaces in use,
+ and we listen on an address that looks like it's probably globally routeable, shout.
+
+ The fix is to use --bind-dynamic, which actually checks the arrival interface too.
+ Tough if your platform doesn't support this.
+
+ Note that checking the arrival interface is supported in the standard IPv6 API and
+ always done, so we don't warn about any IPv6 addresses here.
+*/
+
+void warn_bound_listeners(void)
+{
+ struct irec *iface;
+ int advice = 0;
+
+ for (iface = daemon->interfaces; iface; iface = iface->next)
+ if (!iface->dns_auth)
+ {
+ if (iface->addr.sa.sa_family == AF_INET)
+ {
+ if (!private_net(iface->addr.in.sin_addr, 1))
+ {
+ inet_ntop(AF_INET, &iface->addr.in.sin_addr, daemon->addrbuff, ADDRSTRLEN);
+ iface->warned = advice = 1;
+ my_syslog(LOG_WARNING,
+ _("LOUD WARNING: listening on %s may accept requests via interfaces other than %s"),
+ daemon->addrbuff, iface->name);
+ }
+ }
+ }
+
+ if (advice)
+ my_syslog(LOG_WARNING, _("LOUD WARNING: use --bind-dynamic rather than --bind-interfaces to avoid DNS amplification attacks via these interface(s)"));
+}
+
+void warn_int_names(void)
+{
+ struct interface_name *intname;
+
+ for (intname = daemon->int_names; intname; intname = intname->next)
+ if (!intname->addr)
+ my_syslog(LOG_WARNING, _("warning: no addresses found for interface %s"), intname->intr);
+}
+
int is_dad_listeners(void)
{
struct irec *iface;
}
}
+void mark_servers(int flag)
+{
+ struct server *serv;
+
+ /* mark everything with argument flag */
+ for (serv = daemon->servers; serv; serv = serv->next)
+ if (serv->flags & flag)
+ serv->flags |= SERV_MARK;
+}
+
+void cleanup_servers(void)
+{
+ struct server *serv, *tmp, **up;
+
+ /* unlink and free anything still marked. */
+ for (serv = daemon->servers, up = &daemon->servers; serv; serv = tmp)
+ {
+ tmp = serv->next;
+ if (serv->flags & SERV_MARK)
+ {
+ server_gone(serv);
+ *up = serv->next;
+ if (serv->domain)
+ free(serv->domain);
+ free(serv);
+ }
+ else
+ up = &serv->next;
+ }
+}
+
+void add_update_server(int flags,
+ union mysockaddr *addr,
+ union mysockaddr *source_addr,
+ const char *interface,
+ const char *domain)
+{
+ struct server *serv;
+
+ /* See if there is a suitable candidate, and unmark */
+ for (serv = daemon->servers; serv; serv = serv->next)
+ if (serv->flags & SERV_MARK)
+ {
+ if (domain)
+ {
+ if (!(serv->flags & SERV_HAS_DOMAIN) || !hostname_isequal(domain, serv->domain))
+ continue;
+ }
+ else
+ {
+ if (serv->flags & SERV_HAS_DOMAIN)
+ continue;
+ }
+
+ serv->flags &= ~SERV_MARK;
+
+ break;
+ }
+
+ if (!serv && (serv = whine_malloc(sizeof (struct server))))
+ {
+ /* Not found, create a new one. */
+ memset(serv, 0, sizeof(struct server));
+
+ if (domain && !(serv->domain = whine_malloc(strlen(domain)+1)))
+ {
+ free(serv);
+ serv = NULL;
+ }
+ else
+ {
+ struct server *s;
+ /* Add to the end of the chain, for order */
+ if (!daemon->servers)
+ daemon->servers = serv;
+ else
+ {
+ for (s = daemon->servers; s->next; s = s->next);
+ s->next = serv;
+ }
+ if (domain)
+ strcpy(serv->domain, domain);
+ }
+ }
+
+ if (serv)
+ {
+ serv->flags = flags;
+ serv->queries = serv->failed_queries = 0;
+
+ if (domain)
+ serv->flags |= SERV_HAS_DOMAIN;
+
+ if (interface)
+ strcpy(serv->interface, interface);
+ else
+ serv->interface[0] = 0;
+
+ serv->addr = *addr;
+ serv->source_addr = *source_addr;
+ }
+}
void check_servers(void)
{
struct irec *iface;
- struct server *new, *tmp, *ret = NULL;
+ struct server *new, *tmp, **up;
int port = 0;
/* interface may be new since startup */
if (!option_bool(OPT_NOWILD))
enumerate_interfaces(0);
- for (new = daemon->servers; new; new = tmp)
+ for (up = &daemon->servers, new = daemon->servers; new; new = tmp)
{
tmp = new->next;
if (new->addr.sa.sa_family == AF_INET &&
new->addr.in.sin_addr.s_addr == 0)
{
+ *up = tmp;
free(new);
continue;
}
if (iface)
{
my_syslog(LOG_WARNING, _("ignoring nameserver %s - local interface"), daemon->namebuff);
+ *up = tmp;
free(new);
continue;
}
my_syslog(LOG_WARNING,
_("ignoring nameserver %s - cannot make/bind socket: %s"),
daemon->namebuff, strerror(errno));
+ *up = tmp;
free(new);
continue;
}
}
- /* reverse order - gets it right. */
- new->next = ret;
- ret = new;
-
if (!(new->flags & SERV_NO_REBIND))
{
if (new->flags & (SERV_HAS_DOMAIN | SERV_FOR_NODOTS | SERV_USE_RESOLV))
else
my_syslog(LOG_INFO, _("using nameserver %s#%d"), daemon->namebuff, port);
}
+
+ up = &new->next;
}
-
- daemon->servers = ret;
}
/* Return zero if no servers found, in that case we keep polling.
{
FILE *f;
char *line;
- struct server *old_servers = NULL;
- struct server *new_servers = NULL;
- struct server *serv;
int gotone = 0;
/* buff happens to be MAXDNAME long... */
my_syslog(LOG_ERR, _("failed to read %s: %s"), fname, strerror(errno));
return 0;
}
-
- /* move old servers to free list - we can reuse the memory
- and not risk malloc if there are the same or fewer new servers.
- Servers which were specced on the command line go to the new list. */
- for (serv = daemon->servers; serv;)
- {
- struct server *tmp = serv->next;
- if (serv->flags & SERV_FROM_RESOLV)
- {
- serv->next = old_servers;
- old_servers = serv;
- /* forward table rules reference servers, so have to blow them away */
- server_gone(serv);
- }
- else
- {
- serv->next = new_servers;
- new_servers = serv;
- }
- serv = tmp;
- }
-
+
+ mark_servers(SERV_FROM_RESOLV);
+
while ((line = fgets(daemon->namebuff, MAXDNAME, f)))
{
union mysockaddr addr, source_addr;
continue;
#endif
- if (old_servers)
- {
- serv = old_servers;
- old_servers = old_servers->next;
- }
- else if (!(serv = whine_malloc(sizeof (struct server))))
- continue;
-
- /* this list is reverse ordered:
- it gets reversed again in check_servers */
- serv->next = new_servers;
- new_servers = serv;
- serv->addr = addr;
- serv->source_addr = source_addr;
- serv->domain = NULL;
- serv->interface[0] = 0;
- serv->sfd = NULL;
- serv->flags = SERV_FROM_RESOLV;
- serv->queries = serv->failed_queries = 0;
+ add_update_server(SERV_FROM_RESOLV, &addr, &source_addr, NULL, NULL);
gotone = 1;
}
- /* Free any memory not used. */
- while (old_servers)
- {
- struct server *tmp = old_servers->next;
- free(old_servers);
- old_servers = tmp;
- }
-
- daemon->servers = new_servers;
fclose(f);
+ cleanup_servers();
return gotone;
}
+#if defined(HAVE_LINUX_NETWORK) || defined(HAVE_BSD_NETWORK)
+/* Called when addresses are added or deleted from an interface */
+void newaddress(time_t now)
+{
+ (void)now;
+
+ if (option_bool(OPT_CLEVERBIND) || daemon->doing_dhcp6 || daemon->relay6 || daemon->doing_ra)
+ enumerate_interfaces(0);
+
+ if (option_bool(OPT_CLEVERBIND))
+ create_bound_listeners(0);
+
+#ifdef HAVE_DHCP6
+ if (daemon->doing_dhcp6 || daemon->relay6 || daemon->doing_ra)
+ join_multicast(0);
+
+ if (daemon->doing_dhcp6 || daemon->doing_ra)
+ dhcp_construct_contexts(now);
+
+ if (daemon->doing_dhcp6)
+ lease_find_interfaces(now);
+#endif
+}
+#endif
projects / people / ms / dnsmasq.git / blobdiff