mdnsd, branch master

Change domain variable to const char* for gcc 15 compatibility

2026-06-27T15:25:14Z

This fixes: ``` cache.c: In function 'cache_dump_records': cache.c:523:40: error: assignment discards 'const' qualifier from pointer target type [-Werror=discarded-qualifiers] 523 | domain = strstr(r->record, "._udp."); | ^ cache.c:526:48: error: assignment discards 'const' qualifier from pointer target type [-Werror=discarded-qualifiers] 526 | domain = strstr(r->record, "._tcp."); | ^ cc1: all warnings being treated as errors ninja: build stopped: subcommand failed. ``` This fixes #31 Signed-off-by: Carsten Schuette Link: https://github.com/openwrt/mdnsd/pull/32 Signed-off-by: Hauke Mehrtens

cache: bound cache size and clamp hostile TTLs

2026-06-16T00:00:27Z

mDNS answers are unsolicited and unauthenticated, so any host on the local segment can spray responses for an unbounded number of unique names. cache_answer()/cache_service() cached every such record with no entry cap; the only eviction is the TTL-based GC, which an attacker defeats by sending a very large TTL. A sustained flood thus grows the heap without bound until the daemon OOMs or crashes. On top of that, the calloc_a() returns were dereferenced without a NULL check, so the failing allocation itself wrote through NULL and SIGSEGVd. Cap the number of cached records and services, clamp the stored TTL so the GC keeps reclaiming hostile records (and the cache recovers once a flood stops), and NULL-check both calloc_a() returns. Reported-by: Puru Kulkarni Link: https://github.com/openwrt/mdnsd/security/advisories/GHSA-jg8f-fhfw-jg46 Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Hauke Mehrtens

fix calloc_a size argument type

2026-05-22T11:46:34Z

Use size_t instead of int to prevent bogus overflow Signed-off-by: Felix Fietkau

dns: validate IPv4 record addresses

2026-02-07T12:37:55Z

Ensure the IPv4 PTR address contains exactly four numbers, and no excess characters. This avoids leaving ip1 potentially uninitialized for shorter prefixes. Fixes: 2b28094 ("dns: add support for reverse address mapping queries") Signed-off-by: Jonas Gorski

dns: validate IPv6 record addresses

2026-02-07T12:37:55Z

IPv6 PTR record addresses always alternate dots and nibbles, so check that the request name follows that, and reject if not. This avoids overrunning temp_ip if the prefix contains more than 16 non-dot characters. Fixes: TOB-OWRT-2 Fixes: 2b28094 ("dns: add support for reverse address mapping queries") Reported-by: Trail of Bits Signed-off-by: Jonas Gorski

dns: validate reverse dns query name lengths

2026-02-07T10:03:18Z

Validate reverse dns query names length to be able to be valid names: For IPv6 records there is a fixed name length of 72 (32 nibbles + 31 dots + ".ip6.arpa". For Ipv4 it's a bit more complicated since the decimal numbers have variable lenghts, so we need to check a range. Reject any names that do not fit within those bounds. This also ensures that the name fits into name_buf{,6}. Fixes: TOB-OWRT-1 Fixes: 2b28094 ("dns: add support for reverse address mapping queries") Reported-by: Trail of Bits Signed-off-by: Jonas Gorski

build: require CMake >= 3.10 due to dropped legacy support

2025-10-04T11:29:11Z

CMake version 4.0 and later require minimum version of 3.5 or later. Update to minimum version 3.10 which is the last not deprecated minimum version. CMake 3.10 was released in November 2017 and is included in Ubuntu 18.04. Signed-off-by: Hauke Mehrtens

dns: add support for reverse address mapping queries

2025-05-28T22:40:37Z

The mdnsd currently does not have the capability of responding to reverse address mapping dns requests for either IPv4 or IPv6. This commit adds support to handle reverse address mapping and respond with hostname if the address matches that of the DUT. Signed-off-by: Rahul Thakur Signed-off-by: Felix Fietkau [cleanup]

Make mdns responder case-insensitive.

2025-05-28T22:28:57Z

From [the RFC](https://github.com/openwrt/mdnsd/blob/master/rfc6762.txt#L2532-L2550): > The simple rules for case-insensitivity in Unicast DNS [RFC1034] [RFC1035] also apply in Multicast DNS; that is to say, in name comparisons, the lowercase letters "a" to "z" (0x61 to 0x7A) match their uppercase equivalents "A" to "Z" (0x41 to 0x5A). Hence, if a querier issues a query for an address record with the name "myprinter.local.", then a responder having an address record with the name "MyPrinter.local." should issue a response. No other automatic equivalences should be assumed. Fixes #15. Signed-off-by: Felix Fietkau

ubus: fix ubus announcements txt fields

2025-05-28T22:28:43Z

The txt field of multicast dns is defined as an array of concatenated length-values, where length is encoded in the first byte and value is a non-NUL terminated string. The ubus announcements callback tokenized the txt buffer by dividing it between non-ASCII characters. This works fine for values with a length <32 characters, but not for longer strings. This patch correctly deserializes the txt values and removes the need for dynamic allocation. Signed-off-by: Andrew Karpow Signed-off-by: Felix Fietkau [minor cleanup]