Subject: simple dns rebinding protection with dnsmasq
From: "Collin R. Mulliner" <collin@betaversion.net.>
To: [email protected], [email protected]
Content-Type: text/plain
Organization: BETAVERSiON Systems
Date: Mon, 22 Oct 2007 20:05:06 +0200
Message-Id: <1193076306.4922.28.camel@panic.>
Mime-Version: 1.0
X-Mailer: Evolution 2.10.1
Content-Transfer-Encoding: 7bit
X-Virus-Scanned: by amavisd-new-20030616-p10 at elbarto.betaversion.net
X-Virus-Scanned: antivirus-gw at tyumen.ru
dnsmasq (http://www.thekelleys.org.uk/dnsmasq/doc.html) a popular DHCP
and DNS forwarder and cache server used on many DSL/Cable routers now
has a simple DNS Rebinding protection mechanism. When executed with the
--stop-dns-rebind option the DNS resolver in dnsmasq will filter out
private IP addresses (127.0.0.0/8, 192.168.0.0/16, 10.0.0.0/8,
172.16.0.0/12 and 169.254.0.0/16). This should be sufficient for most
private/home users.
Feedback welcome.
dnsmasq:
http://www.thekelleys.org.uk/dnsmasq/doc.html
dnsmasq with dns rebinding protection:
http://www.thekelleys.org.uk/dnsmasq/test-releases/dnsmasq-2.41test11.tar.gz
orginal patch:
http://www.mulliner.org/blog/blosxom.cgi/security/dnsmasq_dnsrebinding_protection_patch.html
Collin
--
Collin R. Mulliner <collin@betaversion.net.>
BETAVERSiON Systems [www.betaversion.net]
info/pgp: finger [email protected]
weblog: http://www.mulliner.org/blog/
Tabs are for indentation space is for astronauts.
