<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p><font size="2"><span style="font-size:11pt;">This is a request
for feature feasibility or acceptability.<br>
<br>
Some circumstances may be vulnerable to DNS rebinding attacks
against global IPv6 address. Through DHPCv6-PD the local
network is a uniquely identifying global subnet. This makes
DNS rebinding to a local machine on its global IPv6 as easy as
traditional RFC1918. It would be a good idea to eliminate any
local network IP (RFC1918 or otherwise) from global DNS
responses. <br>
<br>
For dnsmasq, this could be implemented with a few options or
option variations. One option is to rebind </span></font><font
size="2"><span style="font-size:11pt;"><font size="2"><span
style="font-size:11pt;">protect range </span></font>on
all DHCP served address, if outside of the normal local IPv4/6
ranges. Another option would add the IPv4/6 discovered on an
interface to the rebind protection range. Granted few small
installations (dnsmasq user base) have the cash for a global
IPv4, but maybe implement this generically for completeness.
This could either reuse the current option or create a new
option. The following is just a rough concept.<br>
</span></font><br>
--stop-dns-rebind<br>
without sub options, it takes its original actions<br>
<br>
<font size="2"><span style="font-size:11pt;"><span class="pl-s">--stop-dns-rebind=dhcp,[tag],[tag],...<br>
add DHCPv4/v6 address into the rebind protection range. Tag
is optional to include only include limited subnets, else
all DHCP server ranges are added.<br>
<br>
--stop-dns-rebind=interface:name<br>
uses the same method as the DHCPv6 construction to obtain
the subnet IPv6 prefix. May not work or be implemented for
IPv4.<br>
<br>
--stop-dns-rebind=address:ipv4/v6<br>
just insert any address into the rebind protection range.<br>
<br>
</span>Notable use case: if you actually have outward facing
servers such as http or vpn, then they should probably be on a
unique subnet DMZ. If excluding those interfaces in the rebind
protection (maybe =dhcp,[tag]), or running a separate dnsmasq
instance for the subnet, then such subnet would resolve
globally and locally without filtering.<br>
<br>
Eric</span></font></p>
<p><font size="2"><span style="font-size:11pt;"><br>
</span></font></p>
</body>
</html>