Problem - Kevin Tafuro

The first step in restricting access from the network based on hostname or IP address
is to ensure that the remote connection is not engaging in a DNS spoofing attack. No
foolproof method exists for guaranteeing that the address is not being spoofed,
though the code presented here can provide a reasonable assurance for most cases. In
particular, if the DNS server for the domain that an IP address reverse-maps to has
been compromised, there is no way to know.
The first code listing that we present implements a worker function, check_spoofdns( ),
which performs a set of DNS lookups and compares the results. The first lookup
retrieves the hostname to which an IP address maps. An IP address does not necessarily
have to reverse-map to a hostname, so if this first lookup yields no mapping, it is generally
safe to assume that no spoofing is taking place.
If the IP address does map to a hostname, a lookup is performed on that hostname to
retrieve the IP address or addresses to which it maps. The hostname should exist, but
if it does not, the connection should be considered suspect. Although it is possible
that something funny is going on with the remote connection, the lack of a name-toaddress
mapping could be innocent.
Each of the addresses returned by the hostname lookup is compared against the IP
address of the remote connection. If the IP address of the remote connection is not
matched, the likelihood of a spoofing attack is high, though still not guaranteed. If
the IP address of the remote connection is matched, the code assumes that no spoofing
attack is taking place.
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
#define SPC_ERROR_NOREVERSE 1 /* IP address does not map to a hostname */
#define SPC_ERROR_NOHOSTNAME 2 /* Reversed hostname does not exist */
#define SPC_ERROR_BADHOSTNAME 3 /* IP addresses do not match */
#define SPC_ERROR_HOSTDENIED 4 /* TCP/SPC Wrappers denied host access */
static int check_spoofdns(int sockfd, struct sockaddr_in *addr, char **name) {
int addrlen, i;
char *hostname;
struct hostent *he;
*name = 0;
for (;;) {
addrlen = sizeof(struct sockaddr_in);
if (getpeername(sockfd, (struct sockaddr *)addr, &addrlen) != -1) break;
380 | Chapter 8: Authentication and Key Exchange
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.