22 Říj
2026
22 Říj
'26
7:02
Just a quick reaction for now.
On 21/10/2026 22.27, Mateusz Masłowski wrote:
Could Knot Resolver accept queries from source port 53
by default, as
RFC 5452 allows ?
I'm not inclined to do it (by default, immediately).
The source IP+port are easily spoofed. If it's 53, attackers can choose
e.g. an authoritative DNS server's IP, so your resolver sends reply to
an authoritative server - as it's correct IP+port, it will get delivered
to the daemon - which may or may not react by sending an answer back to
you. While a loop doesn't seem likely with decent SW on the other end,
I believe the low ports would increase the potential for reflection attacks.
But it uses an internal structure, so it may not be
safe for future
versions.
This part in particular seems very likely not to change for years.