[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 1dbea98bc14984d847fa932453ff2059c6e47be7

[Michael Tremer <git@ipfire.org>]

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".

The branch, next has been updated
       via  1dbea98bc14984d847fa932453ff2059c6e47be7 (commit)
       via  bc5011beb7a43e4f22afc5d9ab3ce3cad3ad51b5 (commit)
      from  e82430c4a4cd3d395f4ad37e3d9274fb00080d31 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 1dbea98bc14984d847fa932453ff2059c6e47be7
Author: Michael Tremer <michael.tremer@ipfire.org>
Date:   Mon Jun 1 14:40:25 2026 +0100

    dnsforward.cgi: Only accept IP addresses as targets for forwarding
    
    Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit bc5011beb7a43e4f22afc5d9ab3ce3cad3ad51b5
Author: Michael Tremer <michael.tremer@ipfire.org>
Date:   Mon Jun 1 14:38:33 2026 +0100

    knot resolver: Only accept IP addresses for forwarding
    
    Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

-----------------------------------------------------------------------

Summary of changes:
 config/knot-resolver/config.lua | 32 +++++++++++++++++++++++++++++---
 html/cgi-bin/dnsforward.cgi     |  4 ++--
 2 files changed, 31 insertions(+), 5 deletions(-)

Difference in files:
diff --git a/config/knot-resolver/config.lua b/config/knot-resolver/config.lua
index d563ed7f8..46cfac5e9 100644
--- a/config/knot-resolver/config.lua
+++ b/config/knot-resolver/config.lua
@@ -105,6 +105,27 @@ local function netmask_to_prefix(netmask)
 	return prefix
 end
 
+local function check_ipv4_address(address)
+	local a, b, c, d = address:match("^(%d+)%.(%d+)%.(%d+)%.(%d+)$")
+
+	-- Return if we could not parse the address
+	if not a or not b or not c or not d then
+		return false
+	end
+
+	-- Convert the octets into numbers
+	a, b, c, d = tonumber(a), tonumber(b), tonumber(c), tonumber(d)
+
+	-- Check if all octets are in range
+	for _, octet in ipairs({a, b, c, d}) do
+		if octet > 255 then
+			return false
+		end
+	end
+
+	return true
+end
+
 local function reverse_zones(address, netmask)
 	local a, b, c, d = address:match("^(%d+)%.(%d+)%.(%d+)%.(%d+)$")
 
@@ -350,12 +371,14 @@ function config.load_forwarding()
 		local status, name, address, comment, no_dnssec = unpack(fields)
 
 		if status == "on" then
+			local addresses = {}
 			local dnssec = true
 
 			-- Split multiple addresses
-			local addresses = {}
 			for a in address:gmatch("[^|]+") do
-				addresses[#addresses+1] = { a }
+				if check_ipv4_address(a) then
+					table.insert(addresses, { a })
+				end
 			end
 
 			-- Use a stub resolver if we don't want DNSSEC
@@ -364,7 +387,10 @@ function config.load_forwarding()
 			end
 
 			-- Apply the forwarding rule
-			policy.rule_forward_add(name, { dnssec=dnssec, auth=false }, addresses)
+			if #addresses > 0 then
+				policy.rule_forward_add(name,
+					{ dnssec=dnssec, auth=false }, addresses)
+			end
 		end
 	end
 end
diff --git a/html/cgi-bin/dnsforward.cgi b/html/cgi-bin/dnsforward.cgi
index 3b066902b..29576eb27 100644
--- a/html/cgi-bin/dnsforward.cgi
+++ b/html/cgi-bin/dnsforward.cgi
@@ -71,8 +71,8 @@ if ($cgiparams{'ACTION'} eq $Lang::tr{'add'})
 	my @forward_servers = split(/\,/, $cgiparams{'FORWARD_SERVERS'});
 	foreach my $forward_server (@forward_servers) {
 		# Check if the settings for the forward server are valid.
-		unless(&General::validip($forward_server) || &General::validfqdn($forward_server)) {
-			$errormessage = "$Lang::tr{'invalid ip or hostname'}: $forward_server";
+		unless(&General::validip($forward_server)) {
+			$errormessage = "$Lang::tr{'invalid ip address'}: $forward_server";
 			last;
 		}
 	}


hooks/post-receive
--
IPFire 2.x development tree