From: Peter van Dijk <peter.van.dijk@powerdns.com>
Date: Thu, 19 Oct 2023 14:58:01 +0000 (+0200)
Subject: drop packets from 100% impossible sources
X-Git-Tag: rec-5.0.0-beta1~38^2~1
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=36463240927598bbf5f24c6879552fbad1554811;p=thirdparty%2Fpdns.git

drop packets from 100% impossible sources
---

diff --git a/pdns/ixfrdist.cc b/pdns/ixfrdist.cc
index ca7d18c096..2b00ecb363 100644
--- a/pdns/ixfrdist.cc
+++ b/pdns/ixfrdist.cc
@@ -913,6 +913,11 @@ try
     return;
   }
 
+  if (!allowedByACL(saddr, true) && !allowedByACL(saddr, false)) {
+    g_log<<Logger::Warning<<"UDP query from "<<saddr.toString()<<" did not match any valid query or NOTIFY source, dropping"<<endl;
+    return;
+  }
+
   MOADNSParser mdp(true, string(&buf[0], static_cast<size_t>(res)));
   vector<uint8_t> packet;