Cuong Manh Le 7f3d332b64 cmd/cli: discard upstream answers whose question mismatches the request ...

Defense in depth against cache poisoning: a compromised or misbehaving
upstream can return an answer for a different name than was asked (e.g.
records for attacker.example in response to a query for victim.example).
Such an answer would be cached under the legitimate request key and
served to subsequent queries.

Validate that the upstream answer echoes the request's question
(case-insensitive name plus Qtype/Qclass, per RFC 1035 section 4.1.2)
before serving or caching it. A mismatch is logged at debug level and
the upstream is skipped, failing safe to the next upstream or SERVFAIL.

Refs github.com/Control-D-Inc/ctrld/issues/322

2026-07-14 23:20:51 +07:00

..

cli

cmd/cli: discard upstream answers whose question mismatches the request

2026-07-14 23:20:51 +07:00

ctrld

debugging save/restore staticinterface settings

2025-02-21 20:44:34 +07:00

ctrld_library

start mobile library with provision id and custom hostname.

2026-04-30 19:19:18 +07:00