dnsmasq: add dhcp-ignore-names support - CERT VU#598349
authorKevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
Mon, 8 Oct 2018 19:40:36 +0000 (20:40 +0100)
committerKevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
Tue, 9 Oct 2018 08:45:16 +0000 (09:45 +0100)
commita45f4f50e16cd2d0370a4470c3ede0c6c7754ba9
tree0ea5e1900b54fa8ef5863b2a100c66aaf6962f3b
parent3925298f3ca9bcd854571367d98bb6ca07f4e66e
dnsmasq: add dhcp-ignore-names support - CERT VU#598349

dnsmasq v2.80test8 adds the ability to ignore dhcp client's requests for
specific hostnames.  Clients claiming certain hostnames and thus
claiming DNS namespace represent a potential security risk. e.g. a
malicious host could claim 'wpad' for itself and redirect other web
client requests to it for nefarious purpose. See CERT VU#598349 for more
details.

Some Samsung TVs are claiming the hostname 'localhost', it is believed
not (yet) for nefarious purposes.

/usr/share/dnsmasq/dhcpbogushostname.conf contains a list of hostnames
in correct syntax to be excluded. e.g.

dhcp-name-match=set:dhcp_bogus_hostname,localhost

Inclusion of this file is controlled by uci option dhcpbogushostname
which is enabled by default.

To be absolutely clear, DHCP leases to these requesting hosts are still
permitted, but they do NOT get to claim ownership of the hostname
itself and hence put into DNS for other hosts to be confused/manipulate by.

Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>
package/network/services/dnsmasq/Makefile
package/network/services/dnsmasq/files/dhcpbogushostname.conf [new file with mode: 0644]
package/network/services/dnsmasq/files/dnsmasq.init