package/network/services/dnsmasq/patches/0002-Change-behavior-when-RD-bit-unset-in-queries.patch

   1 From 4139298d287eb5c57f4aa53c459cb02fc5be2495 Mon Sep 17 00:00:00 2001
   2 From: Simon Kelley <simon@thekelleys.org.uk>
   3 Date: Wed, 19 Sep 2018 22:27:11 +0100
   4 Subject: [PATCH 2/2] Change behavior when RD bit unset in queries.
   5
   6 Change anti cache-snooping behaviour with queries with the
   7 recursion-desired bit unset. Instead to returning SERVFAIL, we
   8 now always forward, and never answer from the cache. This
   9 allows "dig +trace" command to work.
  10
  11 Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
  12 ---
  13  CHANGELOG     | 7 ++++++-
  14  src/rfc1035.c | 8 +++-----
  15  2 files changed, 9 insertions(+), 6 deletions(-)
  16
  17 --- a/CHANGELOG
  18 +++ b/CHANGELOG
  19 @@ -59,7 +59,12 @@ version 2.80
  20         Returning null addresses is a useful technique for ad-blocking.
  21         Thanks to Peter Russell for the suggestion.
  22
  23 -
  24 +       Change anti cache-snooping behaviour with queries with the
  25 +       recursion-desired bit unset. Instead to returning SERVFAIL, we
  26 +       now always forward, and never answer from the cache. This
  27 +       allows "dig +trace" command to work.
  28 +
  29 +
  30  version 2.79
  31         Fix parsing of CNAME arguments, which are confused by extra spaces.
  32         Thanks to Diego Aguirre for spotting the bug.
  33 --- a/src/rfc1035.c
  34 +++ b/src/rfc1035.c
  35 @@ -1293,16 +1293,14 @@ size_t answer_request(struct dns_header
  36    struct mx_srv_record *rec;
  37    size_t len;
  38
  39 -  if (ntohs(header->ancount) != 0 ||
  40 +  /* never answer queries with RD unset, to avoid cache snooping. */
  41 +  if (!(header->hb3 & HB3_RD) ||
  42 +      ntohs(header->ancount) != 0 ||
  43        ntohs(header->nscount) != 0 ||
  44        ntohs(header->qdcount) == 0 ||
  45        OPCODE(header) != QUERY )
  46      return 0;
  47
  48 -  /* always servfail queries with RD unset, to avoid cache snooping. */
  49 -  if (!(header->hb3 & HB3_RD))
  50 -    return setup_reply(header, qlen, NULL, F_SERVFAIL, 0);
  51 -
  52    /* Don't return AD set if checking disabled. */
  53    if (header->hb4 & HB4_CD)
  54      sec_data = 0;