From 9bb96b5b9377a3ea25dcef80ce992e0a712190e8 Mon Sep 17 00:00:00 2001 From: DL6ER Date: Sun, 27 Nov 2022 10:47:03 +0100 Subject: [PATCH] Undo Pi-hole modification in src/dnsmasq/forward.c Signed-off-by: DL6ER --- src/dnsmasq/forward.c | 22 +--------------------- src/dnsmasq/rfc1035.c | 1 - 2 files changed, 1 insertion(+), 22 deletions(-) diff --git a/src/dnsmasq/forward.c b/src/dnsmasq/forward.c index 986bdc58..58b0b433 100644 --- a/src/dnsmasq/forward.c +++ b/src/dnsmasq/forward.c @@ -836,27 +836,7 @@ static size_t process_reply(struct dns_header *header, time_t now, struct server n = rrfilter(header, n, RRFILTER_AAAA); } - /******************************** Pi-hole modification ********************************/ - int ret = extract_addresses(header, n, daemon->namebuff, now, ipsets, nftsets, is_sign, check_rebind, no_cache, cache_secure, &doctored); - if (ret == 2) - { - cache_secure = 0; - // Make a private copy of the pheader to ensure - // we are not accidentially rewriting what is in - // the pheader when we're creating a crafted reply - // further below (when a query is to be blocked) - if (pheader) - { - pheader_copy = calloc(1, plen); - memcpy(pheader_copy, pheader, plen); - } - - // Generate DNS packet for reply, a possibly existing pseudo header - // will be restored later inside resize_packet() - n = FTL_make_answer(header, ((char *) header) + 65536, n, &ede); - } - else if(ret) - /**************************************************************************************/ + if (extract_addresses(header, n, daemon->namebuff, now, ipsets, nftsets, is_sign, check_rebind, no_cache, cache_secure, &doctored)) { my_syslog(LOG_WARNING, _("possible DNS-rebind attack detected: %s"), daemon->namebuff); munged = 1; diff --git a/src/dnsmasq/rfc1035.c b/src/dnsmasq/rfc1035.c index 3a0c03af..0237d3d3 100644 --- a/src/dnsmasq/rfc1035.c +++ b/src/dnsmasq/rfc1035.c @@ -540,7 +540,6 @@ static int print_txt(struct dns_header *header, const size_t qlen, char *name, either because of lack of memory, or lack of SOA records. These are treated by the cache code as expired and cleaned out that way. Return 1 if we reject an address because it look like part of dns-rebinding attack. */ -// Pi-hole: Return 2 if we reject a part of a CNAME chain int extract_addresses(struct dns_header *header, size_t qlen, char *name, time_t now, struct ipsets *ipsets, struct ipsets *nftsets, int is_sign, int check_rebind, int no_cache_dnssec, int secure, int *doctored)