Use local-service=host for initial configuration (#2258062)

Use just specialized local-service option, which would deactivate as soon as any interface= or listen-address= options are used. Update default configuration to use it.
2024-01-12 17:13:36 +01:00 · 2024-01-12 17:13:36 +01:00 · 31e2c5fa8f
commit 31e2c5fa8f
parent f1847fcc57
3 changed files with 200 additions and 22 deletions
--- a/dnsmasq-2.81-configuration.patch
+++ b/dnsmasq-2.81-configuration.patch
@ -1,4 +1,4 @@
-From 194e7521399048e37c5c2cff18b9c8d442b893ae Mon Sep 17 00:00:00 2001
+From cba77f08dbded8af45de2ee985200b12de7c8d13 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
 Date: Tue, 30 Jun 2020 18:06:29 +0200
 Subject: [PATCH] Modify upstream configuration to safe defaults
@ -7,11 +7,11 @@ Most important change would be to listen only on localhost. Default
 configuration should not listen to request from remote hosts. Match also
 user and paths to directories shipped in Fedora.
 ---
- dnsmasq.conf.example | 29 ++++++++++++++++++++++++-----
- 1 file changed, 24 insertions(+), 5 deletions(-)
+ dnsmasq.conf.example | 28 ++++++++++++++++++++++++----
+ 1 file changed, 24 insertions(+), 4 deletions(-)

 diff --git a/dnsmasq.conf.example b/dnsmasq.conf.example
-index bf19424..8b85f44 100644
+index 0cbf572..6c47c3c 100644
 --- a/dnsmasq.conf.example
 +++ b/dnsmasq.conf.example
@@ -22,7 +22,7 @@
@ -23,7 +23,7 @@ index bf19424..8b85f44 100644
 #dnssec
 
 # Replies which are not DNSSEC signed may be legitimate, because the domain
-@@ -96,14 +96,16 @@
+@@ -106,8 +106,8 @@
 
 # If you want dnsmasq to change uid and gid to something other
 # than the default, edit the following lines.
@ -34,36 +34,30 @@ index bf19424..8b85f44 100644
 
 # If you want dnsmasq to listen for DHCP and DNS requests only on
 # specified interfaces (and the loopback) give the name of the
- # interface (eg eth0) here.
- # Repeat the line for more than one interface.
- #interface=
-+# Listen only on localhost by default
-+interface=lo
- # Or you can specify which interface _not_ to listen on
- #except-interface=
- # Or which to listen on by address (remember to include 127.0.0.1 if
-@@ -114,6 +116,10 @@
+@@ -124,6 +124,14 @@
 # disable DHCP and TFTP on it.
 #no-dhcp-interface=
 
 +# Serve DNS and DHCP only to networks directly connected to this machine.
 +# Any interface= line will override it.
 +#local-service
+# Accept queries in default configuration only from localhost
+# Comment out following option or explicitly configure interfaces or
+# listen-address
+local-service=host
 +
 # On systems which support it, dnsmasq binds the wildcard address,
 # even when it is listening on only some interfaces. It then discards
 # requests that it shouldn't reply to. This has the advantage of
-@@ -121,7 +127,16 @@
+@@ -131,7 +139,15 @@
 # want dnsmasq to really bind only the interfaces it is listening on,
 # uncomment this option. About the only time you may need this is when
 # running another nameserver on the same machine.
-#bind-interfaces
 +#
 +# To listen only on localhost and do not receive packets on other
 +# interfaces, bind only to lo device. Comment out to bind on single
 +# wildcard socket.
-+bind-interfaces
-+
+ #bind-interfaces
 +# Comment out above line and uncoment following 2 lines.
 +# Update interface name, use ip link to get its name.
 +#bind-dynamic
@ -71,7 +65,7 @@ index bf19424..8b85f44 100644
 
 # If you don't want dnsmasq to read /etc/hosts, uncomment the
 # following line.
-@@ -535,7 +550,7 @@
+@@ -545,7 +561,7 @@
 # The DHCP server needs somewhere on disk to keep its lease database.
 # This defaults to a sane location, but if you want to change it, use
 # the line below.
@ -80,7 +74,7 @@ index bf19424..8b85f44 100644
 
 # Set the DHCP server to authoritative mode. In this mode it will barge in
 # and take over the lease for any client which broadcasts on the network,
-@@ -673,7 +688,11 @@
+@@ -683,7 +699,11 @@
 # Include all files in a directory which end in .conf
 #conf-dir=/etc/dnsmasq.d/,*.conf
 
@ -93,5 +87,5 @@ index bf19424..8b85f44 100644
 #dhcp-ignore-names=tag:wpad-ignore
 +
 -- 
-2.31.1
+2.43.0

--- a/dnsmasq-2.90-local-service-host.patch
+++ b/dnsmasq-2.90-local-service-host.patch
@ -0,0 +1,179 @@
+From 68e9ba58d39a442c1f0f55cd35de6f0e69345950 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= <pemensik@redhat.com>
+Date: Tue, 5 Oct 2021 13:46:51 +0200
+Subject: [PATCH] Introduce new --local-service=host parameter
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Similar to local-service, but more strict. Listen only on localhost
+unless other interface is specified. Has no effect when interface is
+provided explicitly. I had multiple bugs fillen on Fedora, because I have
+changed default configuration to:
+
+interface=lo
+bind-interfaces
+
+People just adding configuration parts to /etc/dnsmasq.d or appending to
+existing configuration often fail to see some defaults are already there.
+Give them auto-ignored configuration as smart default.
+
+Signed-off-by: Petr Menšík <pemensik@redhat.com>
+
+Do not add a new parameter on command line. Instead add just parameter
+for behaviour modification of existing local-service option. Now it
+accepts two optional values:
+- net: exactly the same as before
+- host: bind only to lo interface, do not listen on any other addresses
+  than loopback.
+---
+ man/dnsmasq.8 |  8 +++++---
+ src/dnsmasq.c |  2 ++
+ src/dnsmasq.h |  3 ++-
+ src/option.c  | 44 +++++++++++++++++++++++++++++++++-----------
+ 4 files changed, 42 insertions(+), 15 deletions(-)
+
+diff --git a/man/dnsmasq.8 b/man/dnsmasq.8
+index e21bd09..855eda6 100644
+--- a/man/dnsmasq.8
+++ b/man/dnsmasq.8
+@@ -270,14 +270,16 @@ the address dnsmasq is listening on. When an interface is specified,
+ it may be qualified with "/4" or "/6" to specify only the IPv4 or IPv6
+ addresses associated with the interface. Since any defined authoritative zones are also available as part of the normal recusive DNS service supplied by dnsmasq, it can make sense to have an --auth-server declaration with no interfaces or address, but simply specifying the primary external nameserver.
+ .TP
+-.B --local-service
+.B --local-service[=net|host]
+Without parameter or with net parameter, restricts service to connected network.
+ Accept DNS queries only from hosts whose address is on a local subnet,
+-ie a subnet for which an interface exists on the server. This option
+ie a subnet for which an interface exists on the server. With host parameter, listens
+only on lo interface and accepts queries from localhost only. This option
+ only has effect if there are no \fB--interface\fP, \fB--except-interface\fP,
+ \fB--listen-address\fP or \fB--auth-server\fP options. It is intended to be set as
+ a default on installation, to allow unconfigured installations to be
+ useful but also safe from being used for DNS amplification attacks.
+-.TP 
+.TP
+ .B \-2, --no-dhcp-interface=<interface name>
+ Do not provide DHCP or TFTP on the specified interface, but do provide DNS service.
+ .TP
+diff --git a/src/dnsmasq.c b/src/dnsmasq.c
+index 14fe368..0b34627 100644
+--- a/src/dnsmasq.c
+++ b/src/dnsmasq.c
+@@ -864,6 +864,8 @@ int main (int argc, char **argv)
+ 
+       if (option_bool(OPT_LOCAL_SERVICE))
+ 	my_syslog(LOG_INFO, _("DNS service limited to local subnets"));
+      else if (option_bool(OPT_LOCALHOST_SERVICE))
+	my_syslog(LOG_INFO, _("DNS service limited to localhost"));
+     }
+   
+   my_syslog(LOG_INFO, _("compile time options: %s"), compile_opts);
+diff --git a/src/dnsmasq.h b/src/dnsmasq.h
+index fe9aa07..1fabc22 100644
+--- a/src/dnsmasq.h
+++ b/src/dnsmasq.h
+@@ -282,7 +282,8 @@ struct event_desc {
+ #define OPT_STRIP_MAC      70
+ #define OPT_NORR           71
+ #define OPT_NO_IDENT       72
+-#define OPT_LAST           73
+#define OPT_LOCALHOST_SERVICE  73
+#define OPT_LAST           74
+ 
+ #define OPTION_BITS (sizeof(unsigned int)*8)
+ #define OPTION_SIZE ( (OPT_LAST/OPTION_BITS)+((OPT_LAST%OPTION_BITS)!=0) )
+diff --git a/src/option.c b/src/option.c
+index e4810fd..70cece6 100644
+--- a/src/option.c
+++ b/src/option.c
+@@ -217,7 +217,7 @@ static const struct myoption opts[] =
+     { "domain-suffix", 1, 0, 's' },
+     { "interface", 1, 0, 'i' },
+     { "listen-address", 1, 0, 'a' },
+-    { "local-service", 0, 0, LOPT_LOCAL_SERVICE },
+    { "local-service", 2, 0, LOPT_LOCAL_SERVICE },
+     { "bogus-priv", 0, 0, 'b' },
+     { "bogus-nxdomain", 1, 0, 'B' },
+     { "ignore-address", 1, 0, LOPT_IGNORE_ADDR },
+@@ -560,7 +560,7 @@ static struct {
+   { LOPT_QUIET_DHCP6, OPT_QUIET_DHCP6, NULL, gettext_noop("Do not log routine DHCPv6."), NULL },
+   { LOPT_QUIET_RA, OPT_QUIET_RA, NULL, gettext_noop("Do not log RA."), NULL },
+   { LOPT_LOG_DEBUG, OPT_LOG_DEBUG, NULL, gettext_noop("Log debugging information."), NULL }, 
+-  { LOPT_LOCAL_SERVICE, OPT_LOCAL_SERVICE, NULL, gettext_noop("Accept queries only from directly-connected networks."), NULL },
+  { LOPT_LOCAL_SERVICE, ARG_ONE, NULL, gettext_noop("Accept queries only from directly-connected networks."), NULL },
+   { LOPT_LOOP_DETECT, OPT_LOOP_DETECT, NULL, gettext_noop("Detect and remove DNS forwarding loops."), NULL },
+   { LOPT_IGNORE_ADDR, ARG_DUP, "<ipaddr>", gettext_noop("Ignore DNS responses containing ipaddr."), NULL }, 
+   { LOPT_DHCPTTL, ARG_ONE, "<ttl>", gettext_noop("Set TTL in DNS responses with DHCP-derived addresses."), NULL }, 
+@@ -1390,6 +1390,16 @@ static void dhcp_opt_free(struct dhcp_opt *opt)
+   free(opt);
+ }
+ 
+static void if_names_add(const char *ifname)
+{
+  struct iname *new = opt_malloc(sizeof(struct iname));
+  new->next = daemon->if_names;
+  daemon->if_names = new;
+  /* new->name may be NULL if someone does
+     "interface=" to disable all interfaces except loop. */
+  new->name = opt_string_alloc(ifname);
+  new->used = 0;
+}
+ 
+ /* This is too insanely large to keep in-line in the switch */
+ static int parse_dhcp_opt(char *errstr, char *arg, int flags)
+@@ -2811,14 +2821,8 @@ static int one_opt(int option, char *arg, char *errstr, char *gen_err, int comma
+       
+     case 'i':  /* --interface */
+       do {
+-	struct iname *new = opt_malloc(sizeof(struct iname));
+-	comma = split(arg);
+-	new->next = daemon->if_names;
+-	daemon->if_names = new;
+-	/* new->name may be NULL if someone does
+-	   "interface=" to disable all interfaces except loop. */
+-	new->name = opt_string_alloc(arg);
+-	new->used = 0;
+        comma = split(arg);
+	if_names_add(arg);
+ 	arg = comma;
+       } while (arg);
+       break;
+@@ -3377,6 +3381,15 @@ static int one_opt(int option, char *arg, char *errstr, char *gen_err, int comma
+ 	ret_err(gen_err);
+       else if (daemon->max_logs > 100)
+ 	daemon->max_logs = 100;
+      break;
+
+    case LOPT_LOCAL_SERVICE:  /* --local-service */
+      if (!arg || !strcmp(arg, "net"))
+	set_option_bool(OPT_LOCAL_SERVICE);
+      else if (!strcmp(arg, "host"))
+	set_option_bool(OPT_LOCALHOST_SERVICE);
+      else
+	ret_err(gen_err);
+       break;  
+ 
+     case 'P': /* --edns-packet-max */
+@@ -6056,7 +6069,16 @@ void read_opts(int argc, char **argv, char *compile_opts)
+   /* If there's access-control config, then ignore --local-service, it's intended
+      as a system default to keep otherwise unconfigured installations safe. */
+   if (daemon->if_names || daemon->if_except || daemon->if_addrs || daemon->authserver)
+-    reset_option_bool(OPT_LOCAL_SERVICE); 
+    {
+      reset_option_bool(OPT_LOCAL_SERVICE);
+      reset_option_bool(OPT_LOCALHOST_SERVICE);
+    }
+  else if (option_bool(OPT_LOCALHOST_SERVICE) && !option_bool(OPT_LOCAL_SERVICE))
+    {
+      /* listen only on localhost, emulate --interface=lo --bind-interfaces */
+      if_names_add(NULL);
+      set_option_bool(OPT_NOWILD);
+    }
+ 
+   if (testmode)
+     {
+-- 
+2.43.0
+
--- a/dnsmasq.spec
+++ b/dnsmasq.spec
@ -23,7 +23,7 @@

 Name:           dnsmasq
 Version:        2.89
-Release:        6%{?extraversion:.%{extraversion}}%{?dist}
+Release:        7%{?extraversion:.%{extraversion}}%{?dist}
 Summary:        A lightweight DHCP/caching DNS server

 # SPDX identifiers already
@ -50,6 +50,8 @@ Patch3:         dnsmasq-2.78-fips.patch
 Patch4:         dnsmasq-2.89-edns0-size.patch
 # http://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commit;h=33635d8564f96cedcef9bf9826cbbca76f28aa81
 Patch5:         dnsmasq-2.90-dbus-watchers-bz2186468.patch
+# https://bugzilla.redhat.com/show_bug.cgi?id=2258062
+Patch6:         dnsmasq-2.90-local-service-host.patch


 Requires:       nettle
@ -220,6 +222,9 @@ install -Dpm 644 %{SOURCE2} %{buildroot}%{_sysusersdir}/%{name}.conf
 %endif

 %changelog
+* Fri Jan 12 2024 Petr Menšík <pemensik@redhat.com> - 2.89-7
+- Use local-service=host for initial configuration (#2258062)
+
 * Wed Jul 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2.89-6
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild