mirror of https://github.com/ospab/ostp.git
ospab
51b947e6ff
DnsServer::run_local_udp_listener binds 0.0.0.0 and answers every UDP datagram by resolving it and replying to the packet's (unverified, spoofable) source address - a textbook DNS reflection/amplification primitive. An attacker spoofing a victim's IP as the query source turns any server with this listener running into a free amplifier against that victim, with zero authentication gating it (unlike the main OSTP port, there's no Noise handshake here). Nothing in the codebase currently calls this function - the live DNS path is router.route_dns(), reached only through the authenticated OSTP tunnel relay (relay.rs). But the doc comment describes this as an intended, not-yet-wired entry point for clients that point their OS resolver directly at the server, so it's a real latent risk for whoever connects it without realizing the implication. Added a global (not per-source-IP - per-IP limiting doesn't help against a reflection attack, since the attacker never sees the replies and can spread queries across arbitrary spoofed sources) token bucket capping total replies/sec, so connecting this later can't silently reintroduce unbounded amplification. |
||
|---|---|---|
| .. | ||
| transport | ||
| api.rs | ||
| dispatcher.rs | ||
| dns.rs | ||
| fallback.rs | ||
| lib.rs | ||
| outbound.rs | ||
| relay.rs | ||
| relay_node.rs | ||
| router.rs | ||
| signal.rs | ||
| tui.rs | ||