afff889e82
Use SHA-256 to provide security against DNS cache poisoning.
...
Use the SHA-256 hash function to verify that DNS answers
received are for the questions originally asked. This replaces
the slightly insecure SHA-1 (when compiled with DNSSEC) or
the very insecure CRC32 (otherwise). Refer: CERT VU#434904.
Signed-off-by: DL6ER <dl6er@dl6er.de >
2021-01-19 10:34:36 +01:00
9002e99cd8
Check destination of DNS UDP query replies.
...
At any time, dnsmasq will have a set of sockets open, bound to
random ports, on which it sends queries to upstream nameservers.
This patch fixes the existing problem that a reply for ANY in-flight
query would be accepted via ANY open port, which increases the
chances of an attacker flooding answers "in the blind" in an
attempt to poison the DNS cache. CERT VU#434904 refers.
Signed-off-by: DL6ER <dl6er@dl6er.de >
2021-01-19 10:34:36 +01:00
e68acd8e6c
Fix remote buffer overflow CERT VU#434904
...
The problem is in the sort_rrset() function and allows a remote
attacker to overwrite memory. Any dnsmasq instance with DNSSEC
enabled is vulnerable.
Signed-off-by: DL6ER <dl6er@dl6er.de >
2021-01-19 10:34:35 +01:00
5deb35b24f
Use the values of --min-port and --max-port in TCP connections.
...
Rather that letting the kernel pick source ports, do it ourselves
so that the --min-port and --max-port parameters are be obeyed.
Signed-off-by: DL6ER <dl6er@dl6er.de >
2021-01-19 10:34:35 +01:00
76b610ee39
pxe: support pxe clients with custom vendor-class
...
According to UEFI[1] and PXE[2] specs, PXE clients are required to have
`PXEClient` identfier in the vendor-class field of DHCP requests, and
PXE servers should also include that identifier in their responses.
However, the firmware of servers from a few vendors[3] are customized to
include a different identifier. This patch adds an option named
`dhcp-pxe-vendor` to provide a list of such identifiers. The identifier
used in responses sent from dnsmasq is identical to that in the coresponding
request.
[1]: https://uefi.org/sites/default/files/resources/UEFI%20Spec%202.8B%20May%202020.pdf
[2]: http://www.pix.net/software/pxeboot/archive/pxespec.pdf
[3]: For instance, TaiShan servers from Huawei, which are Arm64-based,
send `HW-Client` in PXE requests up to now.
Signed-off-by: Miao Wang <shankerwangmiao@gmail.com >
Signed-off-by: DL6ER <dl6er@dl6er.de >
2021-01-19 10:34:35 +01:00
96cb7fdeea
Merge pull request #1033 from pi-hole/fix/maxdb_overflow
...
Config option MAXDBDAYS fixes and tweaks
2021-01-18 22:09:18 +01:00
4d83a5adec
Merge pull request #1032 from pi-hole/fix/querylog_filtering
...
Fix for Query Log filtering and memory optimizations
2021-01-18 21:58:34 +01:00
ca36f2de8d
Add MAXDBDAYS=-1 to disable auto-cleaning and ensure overflow cannot happen (we just enforce the maximum in this case)
...
Signed-off-by: DL6ER <dl6er@dl6er.de >
2021-01-18 19:41:02 +01:00
471fbf7b62
Use blocked property in API code. Make query->upstreamID = -1 the new default to differentiate easily what was forwarded (ID will be >= 0) and what not (ID == -1). Store the upstream server also for other query types that were forwarded (like queries blocked during CNAME inspection).
...
Signed-off-by: DL6ER <dl6er@dl6er.de >
2021-01-18 15:19:50 +01:00
c227fc1598
Store blocked property in query flags.
...
Signed-off-by: DL6ER <dl6er@dl6er.de >
2021-01-18 15:04:59 +01:00
50d182950a
Statically assert struct sizes are what we expect. This prevents us from increasing the memory needs unintentionally (e.g. due to sub-optimal padding)
...
Signed-off-by: DL6ER <dl6er@dl6er.de >
2021-01-18 14:29:03 +01:00
deae66ba58
Optimize datastructures using bitfields and item re-arrangement (to minimize padding). This reduces the size of query, client, and regex records by 8 bytes per item. Note that this optimization was done on x86_64 and may not apply for other architectures (32bit architectures already used less padding).
...
Signed-off-by: DL6ER <dl6er@dl6er.de >
2021-01-17 13:06:16 +01:00
a5cb6f052a
Merge pull request #1023 from pi-hole/fix/posix_fallocate_return
...
Fix for errno not being set by posix_fallocate()
2021-01-15 19:04:18 +01:00
00492c1192
Merge pull request #1013 from pi-hole/new/OTHER_types
...
Implement support for displaying exact type instead of just "OTHER"
2021-01-15 18:23:33 +01:00
24914b8f29
Merge pull request #1022 from Daxtorim/fix/AdminLTE##1697
...
Don't show retried queries when filtering for blocked queries.
2021-01-15 18:13:10 +01:00
a87d59bc79
Merge pull request #1018 from pi-hole/fix/iface_name_in_TCP_worker
...
Check for validity if iface pointe before dereferencing it
2021-01-15 18:06:32 +01:00
1f7a1ddd60
Don't show retried queries when filtering for blocked queries.
...
Signed-off-by: Fabian Preuß <preuss_fabian@gmx.de >
2021-01-15 15:34:31 +01:00
6b9a116717
Merge pull request #1016 from pi-hole/fix/privacylevel_regexindex
...
Do not return regex idx if privacy level > 0
2021-01-14 21:06:27 +01:00
886fe6d00b
Merge pull request #1006 from pi-hole/update/sqlite_3.34.0
...
Update SQLite3 to 3.34.0
2021-01-14 21:02:02 +01:00
21537822cb
Merge pull request #999 from pi-hole/new/iface_change_same_IP
...
Detect and handle interface changes of clients with the same IP
2021-01-14 20:55:30 +01:00
0a9742af98
Check for validity if iface pointe before dereferencing it.
...
Signed-off-by: DL6ER <dl6er@dl6er.de >
2021-01-09 13:05:45 +01:00
ee971091b4
Only return regex index when allowed by privacy settings. This may leak information, otherwise.
...
Signed-off-by: DL6ER <dl6er@dl6er.de >
2021-01-08 19:22:38 +01:00
5989cf9216
Merge pull request #1014 from pi-hole/fix/config_is_not_regex
...
Do not record NXDOMAIN from DNS cache as "regex blocked"
2021-01-05 21:44:53 +01:00
31c9717aef
Clarify comment
...
Signed-off-by: DL6ER <dl6er@dl6er.de >
2021-01-05 13:46:48 +01:00
1e49abc919
We cannot really decide whether local configuration lines are meant for blocking or something else. Just record such queries as replied to from cache because this is what they are. This code made sense at the time where wildcards were implemented as dnsmasq config lines, however, we've advanced to our own regex engine since then and all config lines should have also been auto-migrated.
...
Signed-off-by: DL6ER <dl6er@dl6er.de >
2021-01-05 13:38:38 +01:00
a33c9d337e
Implement support for displaying exact type instead of the catch-them-all category OTHER. The OTHER category is still used when it comes to computing statistics to ensure your chart's legend does not explode.
...
Signed-off-by: DL6ER <dl6er@dl6er.de >
2021-01-03 22:10:09 +01:00
ce02d73995
Merge pull request #1010 from pi-hole/new/SVCB_HTTPS
...
Add new query types SVCB and HTTPS
2021-01-03 13:07:30 +01:00
6294d2c27d
Tests: Add SVCB and HTTPS as expected query types
...
Signed-off-by: DL6ER <dl6er@dl6er.de >
2020-12-31 10:39:07 +01:00
51bbaad6ea
Add new query types SVCB and HTTPS
...
Signed-off-by: DL6ER <dl6er@dl6er.de >
2020-12-31 10:33:28 +01:00
fdb3820421
Fix for errno not being set by posix_fallocate() in contrast to fallocte() who did set it.
...
Signed-off-by: DL6ER <dl6er@dl6er.de >
2020-12-29 07:16:22 +01:00
5f60ba911c
Merge pull request #1007 from Daxtorim/fix/query-types-chart-legend
...
Added missing NS query type to getQueryTypes()
2020-12-28 07:24:33 +01:00
d1e849e650
Modified test for NS type
...
Signed-off-by: Fabian Preuß <preuss_fabian@gmx.de >
2020-12-27 21:13:44 +01:00
8327f62f22
Test for embedded SQLite3 shell available and functional
...
Signed-off-by: DL6ER <dl6er@dl6er.de >
2020-12-27 17:47:19 +01:00
e3bbffddef
Log date/time of FTL in header just as SQLite3 does as well
...
Signed-off-by: DL6ER <dl6er@dl6er.de >
2020-12-27 17:35:02 +01:00
1b7bad88bb
Added missing NS query type to getQueryTypes()
...
Signed-off-by: Fabian Preuß <preuss_fabian@gmx.de >
2020-12-27 04:43:13 +01:00
3dac02b097
mend
...
Signed-off-by: DL6ER <dl6er@dl6er.de >
2020-12-26 20:15:12 +01:00
7dfaf68607
Update SQLite3 to 3.34.0 and expose sqlite3 shell as 'pihole-FTL sqlite3' (drop-in replacement is available as well)
...
Signed-off-by: DL6ER <dl6er@dl6er.de >
2020-12-26 20:04:04 +01:00
1fce44e3c9
Merge pull request #1001 from pi-hole/fix/no_regex_sync
...
Do not sync after executing regular expression on a domain
2020-12-25 18:32:00 +01:00
777c6f2ef4
Do not sync after executing regular expression on a domain
...
Signed-off-by: DL6ER <dl6er@dl6er.de >
2020-12-25 09:45:04 +01:00
95f8f62f21
Merge pull request #1000 from pi-hole/master
...
Sync dev with master
2020-12-24 13:21:21 +01:00
66919f2aa0
Merge pull request #998 from pi-hole/release/v5.3.3
...
Pi-hole FTL v5.3.3
2020-12-24 11:56:21 +01:00
fcd9228f20
Detect and handle interface changes of clients with the same IP
...
Signed-off-by: DL6ER <dl6er@dl6er.de >
2020-12-24 10:43:23 +01:00
3506b37b9f
Merge pull request #997 from pi-hole/fix/escape_spaces
...
Escape spaces by ~
2020-12-23 20:47:25 +01:00
e4483bd87b
Escape spaces by ~
...
Signed-off-by: DL6ER <dl6er@dl6er.de >
2020-12-23 18:28:46 +01:00
0eade4581e
Add DEBUG_EXTRA flag ( #994 )
...
* Add new DEBUG_EXTRA flag used for special (temporary) debugging
Signed-off-by: DL6ER <dl6er@dl6er.de >
2020-12-23 15:12:24 +01:00
12e73892e7
Merge pull request #996 from pi-hole/tweak/resolve_new_clients_as_event
...
Immediately resolve host names of clients and upstream destinations
2020-12-23 15:06:57 +01:00
7e8183615e
Merge pull request #995 from pi-hole/tweak/cname_inspection_blocking
...
Fix CNAME query blocking mode
2020-12-23 14:46:45 +01:00
5cca201338
Don't iterate over all clients every minute trying to find new ones but only do this when the RESOLVE_NEW_HOSTNAMES event is set
...
Signed-off-by: DL6ER <dl6er@dl6er.de >
2020-12-23 14:38:06 +01:00
55c2678eba
Merge pull request #985 from pi-hole/new/REFRESH_HOSTNAMES_NULL
...
Add UNKNOWN option for REFRESH_HOSTNAME
2020-12-23 14:01:57 +01:00
db72562845
Merge branch 'development' into fix/all_the_things
...
Signed-off-by: DL6ER <dl6er@dl6er.de >
2020-12-21 20:52:20 +01:00
Simon Kelley
Miao Wang
DL6ER
DL6ER
Fabian Preuß