Date: Wed, 17 Nov 1999 07:35:29 +0100 From: sthaug@nethelp.no To: freebsd@gndrsh.dnsmgr.net Cc: freebsd-security@FreeBSD.ORG Subject: Re: Tracing Spoofed Packets Message-ID: <87189.942820529@verdi.nethelp.no> In-Reply-To: Your message of "Tue, 16 Nov 1999 20:12:44 -0800 (PST)" References: <199911170412.UAA20102@gndrsh.dnsmgr.net>
next in thread | previous in thread | raw e-mail | index | archive | help
> That reminds me of a hack I started working on that someone really should > do. In gated for routing we have the ``martians list'' of ip addresses > that it won't listen to nobody nohow about routing for, well, it would > be really sweet if bind/named could also have this, so that these bogus > NS records with RFC1918 addresses in them (mostly due to misconfigured > internal nameservers leaking info to the internet) could be easily ignored > by those of us who know how to do it correctly. BIND already does a similar thing for 0.0.0.0, 127.0.0.1 etc. See the code from BIND 8.2.2-P3 src/bin/named/ns_forw.c included below. It should be easy enough to extend this list - but it would be even better if the list was configurable, of course. Steinar Haug, Nethelp consulting, sthaug@nethelp.no ---------------------------------------------------------------------- if (ina_hlong(ina_get(dp->d_data)) == INADDR_ANY) { static const char *complaint = "Bogus (0.0.0.0) A RR"; nslookupComplain(sysloginfo, syslogdname, complaint, dname, dp, nsdp); continue; } #ifdef INADDR_LOOPBACK if (ina_hlong(ina_get(dp->d_data))==INADDR_LOOPBACK) { static const char *complaint = "Bogus LOOPBACK A RR"; nslookupComplain(sysloginfo, syslogdname, complaint, dname, dp, nsdp); continue; } #endif #ifdef INADDR_BROADCAST if (ina_hlong(ina_get(dp->d_data))==INADDR_BROADCAST){ static const char *complaint = "Bogus BROADCAST A RR"; nslookupComplain(sysloginfo, syslogdname, complaint, dname, dp, nsdp); continue; } #endif #ifdef IN_MULTICAST if (IN_MULTICAST(ina_hlong(ina_get(dp->d_data)))) { static const char *complaint = "Bogus MULTICAST A RR"; nslookupComplain(sysloginfo, syslogdname, complaint, dname, dp, nsdp); continue; } #endif To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?87189.942820529>