From 96fab4aaa60cacd123b3125d7b7c2e68704f8df1 Mon Sep 17 00:00:00 2001 From: Nick Mathewson Date: Wed, 24 May 2017 10:32:38 -0400 Subject: Improve clarity, safety, and rate of dns spoofing log msg Closes ticket 3056. --- src/or/dns.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) (limited to 'src/or/dns.c') diff --git a/src/or/dns.c b/src/or/dns.c index 024a21abfe..53f7a820f3 100644 --- a/src/or/dns.c +++ b/src/or/dns.c @@ -182,6 +182,18 @@ evdns_log_cb(int warn, const char *msg) } else if (!strcmp(msg, "All nameservers have failed")) { control_event_server_status(LOG_WARN, "NAMESERVER_ALL_DOWN"); all_down = 1; + } else if (!strcmpstart(msg, "Address mismatch on received DNS")) { + static ratelim_t mismatch_limit = RATELIM_INIT(3600); + const char *src = strstr(msg, " Apparent source"); + if (!src || get_options()->SafeLogging) { + src = ""; + } + log_fn_ratelim(&mismatch_limit, severity, LD_EXIT, + "eventdns: Received a DNS packet from " + "an IP address to which we did not send a request. This " + "could be a DNS spoofing attempt, or some kind of " + "misconfiguration.%s", src); + return; } tor_log(severity, LD_EXIT, "eventdns: %s", msg); } -- cgit v1.2.3-54-g00ecf