README.md

Breaking consul DNS with dnsmasq forwarding

Reproduction steps

1. docker-compose up
2. Find the UDP port that dnsmasq is listening on (docker ps)
3. Send a DNS query.
   1. dig @127.0.0.1 -p <dnsmasq port> A consul.service.consul (This works and resolves to 127.0.0.1)
   2. dig @127.0.0.1 -p <dnsmasq port> DS consul.service.consul (This does not work and times out in dig)
4. Have a look at your consul and dnsmasq logs. You have now succesfully DoS'ed consul and dnsmasq DNS.

dnsmasq.conf

port=53
bind-interfaces
server=/consul/10.33.10.2#8600
server=8.8.8.8
no-resolv

docker-compose.yml

version: '2.2'
services:
    consul:
        image: consul:1.5.2
        command: consul agent -server -bootstrap -bootstrap-expect=1 -recursor=10.33.10.3 -client=0.0.0.0 -data-dir=/consul/data -ui -dev
        ports:
            - 8500
        networks:
            default:
                ipv4_address: 10.33.10.2
    dnsmasq:
        image: programster/dnsmasq
        networks:
            default:
                ipv4_address: 10.33.10.3
        ports:
            - 53/udp
        volumes:
            - ./dnsmasq.conf:/etc/dnsmasq.conf:ro

networks:
    default:
        driver: bridge
        ipam:
            config:
                - subnet: 10.33.10.0/24
                  gateway: 10.33.10.1