Lightweight, Easy-to-Configure DNS Forwarder and DHCP Server
Dnsmasq is a lightweight, easy-to-configure DNS forwarder and DHCP
server. It is designed to provide DNS and, optionally, DHCP, to a small
network. It can serve the names of local machines that are not in the
global DNS. The DHCP server integrates with the DNS server and allows
machines with DHCP-allocated addresses to appear in DNS with names
configured either in each host or in a central configuration file.
Dnsmasq supports static and dynamic DHCP leases and BOOTP for network
booting of diskless machines.
- Developed at network
- Sources inherited from project openSUSE:Factory
-
4
derived packages
- Download package
-
Checkout Package
osc -A https://api.opensuse.org checkout openSUSE:Leap:15.0:Staging:FactoryCandidates/dnsmasq && cd $_
- Create Badge
Refresh
Refresh
Source Files
Filename | Size | Changed |
---|---|---|
dnsmasq-2.83.tar.xz | 0000513880 502 KB | |
dnsmasq-2.83.tar.xz.asc | 0000000833 833 Bytes | |
dnsmasq-groups.patch | 0000000538 538 Bytes | |
dnsmasq-rpmlintrc | 0000000113 113 Bytes | |
dnsmasq.changes | 0000071963 70.3 KB | |
dnsmasq.keyring | 0000007323 7.15 KB | |
dnsmasq.reg | 0000000325 325 Bytes | |
dnsmasq.service | 0000000411 411 Bytes | |
dnsmasq.spec | 0000007284 7.11 KB | |
rc.dnsmasq-suse | 0000002202 2.15 KB |
Revision 79 (latest revision is 96)
Dominique Leuenberger (dimstar_suse)
accepted
request 864301
from
Reinhard Max (rmax)
(revision 79)
- Update to 2.83: * bsc#1177077: Fixed DNSpooq vulnerabilities * Use the values of --min-port and --max-port in outgoing TCP connections to upstream DNS servers. * Fix a remote buffer overflow problem in the DNSSEC code. Any dnsmasq with DNSSEC compiled in and enabled is vulnerable to this, referenced by CVE-2020-25681, CVE-2020-25682, CVE-2020-25683 CVE-2020-25687. * Be sure to only accept UDP DNS query replies at the address from which the query was originated. This keeps as much entropy in the {query-ID, random-port} tuple as possible, to help defeat cache poisoning attacks. Refer: CVE-2020-25684. * Use the SHA-256 hash function to verify that DNS answers received are for the questions originally asked. This replaces the slightly insecure SHA-1 (when compiled with DNSSEC) or the very insecure CRC32 (otherwise). Refer: CVE-2020-25685 * Handle multiple identical near simultaneous DNS queries better. Previously, such queries would all be forwarded independently. This is, in theory, inefficent but in practise not a problem, _except_ that is means that an answer for any of the forwarded queries will be accepted and cached. An attacker can send a query multiple times, and for each repeat, another {port, ID} becomes capable of accepting the answer he is sending in the blind, to random IDs and ports. The chance of a succesful attack is therefore multiplied by the number of repeats of the query. The new behaviour detects repeated queries and merely stores the clients sending repeats so that when the first query completes, the answer can be sent to all the clients who asked. Refer: CVE-2020-25686.
Comments 0