Changeset 699 for trunk/pdns/pdns/pdns_recursor.cc

Timestamp:

04/14/06 13:26:50 (7 years ago)

Author:

ahu

Message:

implement stunningly cool spoofing protection, plus spoofer in dnspbench

Files:

• trunk/pdns/pdns/pdns_recursor.cc (modified) (3 diffs)

trunk/pdns/pdns/pdns_recursor.cc

@@ -128 +128 @@
 static map<int,PacketID> d_tcpclientreadsocks, d_tcpclientwritesocks;
 
-MTasker<PacketID,string>* MT;
+typedef MTasker<PacketID,string> MT_t;
+MT_t* MT;
 
 int asendtcp(const string& data, Socket* sock) 
@@ -183 +184 @@
     *d_len=packet.size();
     memcpy(data,packet.c_str(),min(len,*d_len));
+    if(pident.nearMisses > 100) {
+      L<<Logger::Error<<"Too many ("<<pident.nearMisses<<") bogus answers came in from "<<sockAddrToString((struct sockaddr_in*)toaddr, sizeof(pident.remote))<<", assuming spoof attempt."<<endl;
+      return -1;
+    }
   }
   return ret;
@@ -1000 +1005 @@
                     L<<Logger::Warning<<"Discarding unexpected packet from "<<sockAddrToString((struct sockaddr_in*) &fromaddr, addrlen)<<endl;
                   g_stats.unexpectedCount++;
+                  
+                  for(MT_t::waiters_t::iterator mthread=MT->d_waiters.begin(); mthread!=MT->d_waiters.end(); ++mthread) {
+                    if(!memcmp(&mthread->key.remote.sin_addr, &pident.remote.sin_addr, sizeof(pident.remote.sin_addr))) {
+                      mthread->key.nearMisses++;
+                    }
+                  }
                 }
               }