Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

WIP: Implement Dns record filtering #1

Open
wants to merge 4 commits into
base: master
Choose a base branch
from
Open

WIP: Implement Dns record filtering #1

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
e4f666b
config: Add FilterDNSRecords option for DNS leak prevention
LaakkonenJussi Jan 29, 2020
0f214fa
resolver: Support options in resolvfile and prepending entries
LaakkonenJussi Jan 14, 2021
385f2e3
dnsproxy: Filter DNS records based on IP families enabled
LaakkonenJussi Jan 16, 2020
e005625
dnsproxy: no toggle if filtering disabled.
LaakkonenJussi Jan 26, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions connman/doc/connman.conf.5.in
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -136,6 +136,15 @@ If /sys/class/net/<interface>/uevent does not contain DEVTYPE information,
heuristics are used to choose between wifi and ethernet device types. If
neither is appropriate, this setting can be used to provide more suitable
fallback value - e.g. rndis0:gadget.
.TP
.BI FilterDNSRecords= true\ \fR|\fB\ false
Filter out DNS records that have no connected network on the default
service. This setting has effect only on A and AAAA DNS records. If the
default online service has only IPv4 enabled and there is an another
service online supporting also IPv6 then AAAA requests and replies are
filtered out to prevent DNS leak. This is useful when using IPv4 only VPN
in networks supporting IPv6 as well. By default this setting is enabled
to provide more security.
.SH "EXAMPLE"
The following example configuration disables hostname updates and enables
ethernet tethering.
Expand Down
2 changes: 2 additions & 0 deletions connman/src/connman.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -265,7 +265,9 @@ int __connman_inet_get_address_netmask(int ifindex,
int __connman_resolver_init(gboolean dnsproxy);
void __connman_resolver_cleanup(void);
void __connman_resolver_append_fallback_nameservers(void);
void __connman_resolver_set_single_request_options(bool on);
int __connman_resolvfile_append(int index, const char *domain, const char *server);
int __connman_resolvfile_prepend(int index, const char *domain, const char *server);
int __connman_resolvfile_remove(int index, const char *domain, const char *server);
int __connman_resolver_redo_servers(int index);

Expand Down
Loading