Ignore DNS queries from port 0: http://www.ietf.org/mail-archive/web/dnsop/current/msg11441.html
diff --git a/src/forward.c b/src/forward.c
index 4dc3dca..3f4ec62 100644
--- a/src/forward.c
+++ b/src/forward.c
@@ -1076,11 +1076,24 @@
return;
source_addr.sa.sa_family = listen->family;
+
+ if (listen->family == AF_INET)
+ {
+ /* Source-port == 0 is an error, we can't send back to that.
+ http://www.ietf.org/mail-archive/web/dnsop/current/msg11441.html */
+ if (source_addr.in.sin_port == 0)
+ return;
+ }
#ifdef HAVE_IPV6
- if (listen->family == AF_INET6)
- source_addr.in6.sin6_flowinfo = 0;
+ else
+ {
+ /* Source-port == 0 is an error, we can't send back to that. */
+ if (source_addr.in6.sin6_port == 0)
+ return;
+ source_addr.in6.sin6_flowinfo = 0;
+ }
#endif
-
+
/* We can be configured to only accept queries from at-most-one-hop-away addresses. */
if (option_bool(OPT_LOCAL_SERVICE))
{
