[SSSD] [PATCH] Filter out IP addresses inappropriate for DNS forward records
Jakub Hrozek
jhrozek at redhat.com
Thu May 10 17:30:35 UTC 2012
This is a ressurrection of a very old thread
https://fedorahosted.org/pipermail/sssd-devel/2011-July/006493.html
Compared to what Honza suggested, I'm not checking the reserverd space.
I don't think we should be babysitting the admin that much - if he wants
to use a reserved address, let him. The main point of the patch is to
skip addresses such as IPv6 Link-Local that may be present on the
interface.
-------------- next part --------------
>From 9c6281fc1f9cd777b7c99f8bcd7a4ab4898955f6 Mon Sep 17 00:00:00 2001
From: Jakub Hrozek <jhrozek at redhat.com>
Date: Mon, 4 Jul 2011 17:16:31 -0400
Subject: [PATCH] Filter out IP addresses inappropriate for DNS forward
records
https://fedorahosted.org/sssd/ticket/949
---
src/providers/ipa/ipa_dyndns.c | 58 +++++++++++++++++++++++++++++++++++++++-
1 files changed, 57 insertions(+), 1 deletions(-)
diff --git a/src/providers/ipa/ipa_dyndns.c b/src/providers/ipa/ipa_dyndns.c
index 4224919bb59ad781a61adbc4c4126c8d0d28d2a5..66515e840ebcf20e78deb405c3c456e1905032a5 100644
--- a/src/providers/ipa/ipa_dyndns.c
+++ b/src/providers/ipa/ipa_dyndns.c
@@ -180,6 +180,60 @@ void ipa_dyndns_update(void *pvt)
tevent_req_set_callback(req, ipa_dyndns_update_done, NULL);
}
+static bool ok_for_dns(struct sockaddr *sa)
+{
+ char straddr[INET6_ADDRSTRLEN];
+
+ if (sa->sa_family == AF_INET6) {
+ struct in6_addr *addr = &((struct sockaddr_in6 *) sa)->sin6_addr;
+
+ if (inet_ntop(AF_INET6, addr, straddr, INET6_ADDRSTRLEN) == NULL) {
+ DEBUG(SSSDBG_MINOR_FAILURE,
+ ("inet_ntop failed, won't log IP addresses\n"));
+ snprintf(straddr, INET6_ADDRSTRLEN, "unknown");
+ }
+
+ if (IN6_IS_ADDR_LINKLOCAL(addr)) {
+ DEBUG(SSSDBG_FUNC_DATA, ("Link local IPv6 address %s\n", straddr));
+ return false;
+ } else if (IN6_IS_ADDR_LOOPBACK(addr)) {
+ DEBUG(SSSDBG_FUNC_DATA, ("Loopback IPv6 address %s\n", straddr));
+ return false;
+ } else if (IN6_IS_ADDR_MULTICAST(addr)) {
+ DEBUG(SSSDBG_FUNC_DATA, ("Multicast IPv6 address %s\n", straddr));
+ return false;
+ }
+ } else if (sa->sa_family == AF_INET) {
+ struct in_addr *addr = &((struct sockaddr_in *) sa)->sin_addr;
+
+ if (inet_ntop(AF_INET, addr, straddr, INET6_ADDRSTRLEN) == NULL) {
+ DEBUG(SSSDBG_MINOR_FAILURE,
+ ("inet_ntop failed, won't log IP addresses\n"));
+ snprintf(straddr, INET6_ADDRSTRLEN, "unknown");
+ }
+
+ if (IN_MULTICAST(addr->s_addr)) {
+ DEBUG(SSSDBG_FUNC_DATA, ("Multicast IPv4 address %s\n", straddr));
+ return false;
+ } else if (inet_netof(*addr) == IN_LOOPBACKNET) {
+ DEBUG(SSSDBG_FUNC_DATA, ("Loopback IPv4 address %s\n", straddr));
+ return false;
+ } else if ((addr->s_addr & 0xffff0000) == 0xa9fe0000) {
+ /* 169.254.0.0/16 */
+ DEBUG(SSSDBG_FUNC_DATA, ("Link-local IPv4 address %s\n", straddr));
+ return false;
+ } else if (addr->s_addr == htonl(INADDR_BROADCAST)) {
+ DEBUG(SSSDBG_FUNC_DATA, ("Broadcast IPv4 address %s\n", straddr));
+ return false;
+ }
+ } else {
+ DEBUG(SSSDBG_CRIT_FAILURE, ("Unknown address family\n"));
+ return false;
+ }
+
+ return true;
+}
+
static void ipa_dyndns_sdap_connect_done(struct tevent_req *subreq);
static int ipa_dyndns_add_ldap_iface(struct ipa_dyndns_ctx *state,
struct sdap_handle *sh);
@@ -233,7 +287,9 @@ ipa_dyndns_update_send(struct ipa_options *ctx)
/* Add IP addresses to the list */
if((ifa->ifa_addr->sa_family == AF_INET ||
ifa->ifa_addr->sa_family == AF_INET6) &&
- strcasecmp(ifa->ifa_name, iface) == 0) {
+ strcasecmp(ifa->ifa_name, iface) == 0 &&
+ ok_for_dns(ifa->ifa_addr)) {
+
/* Add this address to the IP address list */
address = talloc_zero(state, struct ipa_ipaddress);
if (!address) {
--
1.7.7.6
More information about the sssd-devel
mailing list