From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4gTZtd3twdz2xQT for ; Mon, 01 Jun 2026 13:43:53 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [IPv6:2001:678:b28::25]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "R12" (not verified)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4gTZtd3Xdsz2xNM for ; Mon, 01 Jun 2026 13:43:53 +0000 (UTC) Received: from people01.haj.ipfire.org (people01.haj.ipfire.org [172.28.1.161]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bit raw public key) server-digest SHA256 client-signature ECDSA (secp384r1) client-digest SHA384) (Client CN "people01.haj.ipfire.org", Issuer "E8" (not verified)) by mail01.ipfire.org (Postfix) with ESMTPS id 4gTZtc4HsWz2Zx for ; Mon, 01 Jun 2026 13:43:52 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1780321432; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc; bh=v3LM6Xl2vAvOkUFS74VnWt7g/rO4OmcTT0z01zV7cvY=; b=kLYNqWySz3uMlSVCbLlvgIbrYmsQVnTOzdEnuMDfy1EqHW/QBY/7544xxtJihu4VZLq9rD nuITdcfUOlY6wFCQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1780321432; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc; bh=v3LM6Xl2vAvOkUFS74VnWt7g/rO4OmcTT0z01zV7cvY=; b=NkPI9K3AAV8w8zu63ZTpo04QlRMaV/mHotFU1y5HPiN4opKn+yiBD6EFpnjVq067Ehogvr CPw0joJMfgj/r9eBP8DWFQkJY+moCgb32H/7Q0WNGV/NDwUZeQtpf6Uev2iwrgC9QhFdtJ F8gUOarNh4XmYXM5LX+cI2h1oD+fP9T/iiT7/zdsjl/8PFjSfR0tj5653ZUB4da9b5F84v 3oR15Hss1qkM3jp43gLYZlvjJpQEPkUzJe729Dcbt9RoSDabtGS7hC9ktBTGOV+CYoZaQI jZOQj2i8XrYJEN10g1LWnYkOPbGix4gJ7diHIm52zvHQo0XIe+P5ePvdT3TLpQ== Received: by people01.haj.ipfire.org (Postfix, from userid 1000) id 4gTZtc27Gqz2xK2; Mon, 01 Jun 2026 13:43:52 +0000 (UTC) To: ipfire-scm@lists.ipfire.org Subject: [git.ipfire.org] IPFire 2.x development tree branch, next, updated. 1dbea98bc14984d847fa932453ff2059c6e47be7 X-Git-Refname: refs/heads/next X-Git-Reftype: branch X-Git-Oldrev: e82430c4a4cd3d395f4ad37e3d9274fb00080d31 X-Git-Newrev: 1dbea98bc14984d847fa932453ff2059c6e47be7 Message-Id: <4gTZtc27Gqz2xK2@people01.haj.ipfire.org> Date: Mon, 01 Jun 2026 13:43:52 +0000 (UTC) From: Michael Tremer Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: This is an automated email from the git hooks/post-receive script. It was generated because a ref change was pushed to the repository containing the project "IPFire 2.x development tree". The branch, next has been updated via 1dbea98bc14984d847fa932453ff2059c6e47be7 (commit) via bc5011beb7a43e4f22afc5d9ab3ce3cad3ad51b5 (commit) from e82430c4a4cd3d395f4ad37e3d9274fb00080d31 (commit) Those revisions listed above that are new to this repository have not appeared on any other notification email; so we list those revisions in full, below. - Log ----------------------------------------------------------------- commit 1dbea98bc14984d847fa932453ff2059c6e47be7 Author: Michael Tremer Date: Mon Jun 1 14:40:25 2026 +0100 dnsforward.cgi: Only accept IP addresses as targets for forwarding Signed-off-by: Michael Tremer commit bc5011beb7a43e4f22afc5d9ab3ce3cad3ad51b5 Author: Michael Tremer Date: Mon Jun 1 14:38:33 2026 +0100 knot resolver: Only accept IP addresses for forwarding Signed-off-by: Michael Tremer ----------------------------------------------------------------------- Summary of changes: config/knot-resolver/config.lua | 32 +++++++++++++++++++++++++++++--- html/cgi-bin/dnsforward.cgi | 4 ++-- 2 files changed, 31 insertions(+), 5 deletions(-) Difference in files: diff --git a/config/knot-resolver/config.lua b/config/knot-resolver/config.lua index d563ed7f8..46cfac5e9 100644 --- a/config/knot-resolver/config.lua +++ b/config/knot-resolver/config.lua @@ -105,6 +105,27 @@ local function netmask_to_prefix(netmask) return prefix end +local function check_ipv4_address(address) + local a, b, c, d = address:match("^(%d+)%.(%d+)%.(%d+)%.(%d+)$") + + -- Return if we could not parse the address + if not a or not b or not c or not d then + return false + end + + -- Convert the octets into numbers + a, b, c, d = tonumber(a), tonumber(b), tonumber(c), tonumber(d) + + -- Check if all octets are in range + for _, octet in ipairs({a, b, c, d}) do + if octet > 255 then + return false + end + end + + return true +end + local function reverse_zones(address, netmask) local a, b, c, d = address:match("^(%d+)%.(%d+)%.(%d+)%.(%d+)$") @@ -350,12 +371,14 @@ function config.load_forwarding() local status, name, address, comment, no_dnssec = unpack(fields) if status == "on" then + local addresses = {} local dnssec = true -- Split multiple addresses - local addresses = {} for a in address:gmatch("[^|]+") do - addresses[#addresses+1] = { a } + if check_ipv4_address(a) then + table.insert(addresses, { a }) + end end -- Use a stub resolver if we don't want DNSSEC @@ -364,7 +387,10 @@ function config.load_forwarding() end -- Apply the forwarding rule - policy.rule_forward_add(name, { dnssec=dnssec, auth=false }, addresses) + if #addresses > 0 then + policy.rule_forward_add(name, + { dnssec=dnssec, auth=false }, addresses) + end end end end diff --git a/html/cgi-bin/dnsforward.cgi b/html/cgi-bin/dnsforward.cgi index 3b066902b..29576eb27 100644 --- a/html/cgi-bin/dnsforward.cgi +++ b/html/cgi-bin/dnsforward.cgi @@ -71,8 +71,8 @@ if ($cgiparams{'ACTION'} eq $Lang::tr{'add'}) my @forward_servers = split(/\,/, $cgiparams{'FORWARD_SERVERS'}); foreach my $forward_server (@forward_servers) { # Check if the settings for the forward server are valid. - unless(&General::validip($forward_server) || &General::validfqdn($forward_server)) { - $errormessage = "$Lang::tr{'invalid ip or hostname'}: $forward_server"; + unless(&General::validip($forward_server)) { + $errormessage = "$Lang::tr{'invalid ip address'}: $forward_server"; last; } } hooks/post-receive -- IPFire 2.x development tree