Re: [Dnsmasq-discuss] CERT Vulnerability VU#598349

2018-09-09 Thread klondike
Hi Simon, El 08/09/18 a las 19:17, Simon Kelley escribió: > The question is, should the above configuration be "baked in" to the code? Yes. In general it is considered against good practice to provide insane defaults and in this case this entails software and not configuration defaults. Keep in

Re: [Dnsmasq-discuss] clients of DHCPv6 with constructed IPv6 address range are not notified on address range change

2018-09-09 Thread Simon Kelley
Dnsmasq doesn't implement RECONFIGURE. It probably should. The main problem, from a quick look at the RFC, is that RECONFIGURE mandates use of security mechanism, and dnsmasq doesn't implement that either! The intention is that address change is a gradual process. The old address gets deprecated w

Re: [Dnsmasq-discuss] CERT Vulnerability VU#598349

2018-09-09 Thread Uwe Schindler
Hey, > > The question is, should the above configuration be "baked in" to the code? > > As I understand, this vulnerability arises from the Web Proxy Automatic > Discovery (WPAD) protocol, not from dnsmasq itself. And, dnsmasq > configuration provides - or will provide - a configuration mechanism

[Dnsmasq-discuss] clients of DHCPv6 with constructed IPv6 address range are not notified on address range change

2018-09-09 Thread Andrey Vakhitov
Thanks for a great dnsmasq software. I'm using dnsmasq 2.79 in combination with IPv6 prefix delegation. The prefixes are changing daily due to daily reconnect of upstream router. Dhcpcd is used to handle prefix delegation on external interface and apply new address to internal interface (dmz0).