Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix potential DoS with responding to responses #247

Merged
merged 1 commit into from
Jun 2, 2023
Merged

Fix potential DoS with responding to responses #247

merged 1 commit into from
Jun 2, 2023

Commits on Jun 2, 2023

  1. Fix potential DoS with responding to responses 

    An attacker could send a packet with the source address and port being
resolved's, which will make resolved send the response to itself.  But
resolved responds to an unexpected response by sending a format
error *response*.  Which would go back to itself, again, triggering an
infinite loop of responses.

Much as it pains me to just drop a perfectly decodable, but invalid,
message, this is the best solution since there isn't really a way to
reliably tell if an attacker is triggering this case (eg, they could use
two instances running on different IPs and bounce responses between
them).

See #246
    @barrucadu
    barrucadu committed Jun 2, 2023
    Configuration menu
    Copy the full SHA
    1cab468 View commit details
    Browse the repository at this point in the history