Security Advisory 2021-01-19-1 - dnsmasq multiple vulnerabilities

I located the problem to my wife's Windows work computer. It is in an external windows domain and we have no administrator rights to it. There seems to be some incompatibility with this new dnsmasq fix.

Is it ok for me to downgrade my wrt3200acm back to 19.07.5 or does it break something?

Here is a technical paper from jsof about this issue


I can confirm that the mitigation steps from ynezz work, without any noticeable problems or log entries.
OpenWrt 19.07.5 / R7800

PS: It feels good that there is already a mitigation when you become aware of the problem yourself.

2 Likes

I tried setting the odhcpd log level from my current setting of '4' to '0', then tried '7'.
In both cases restarted odhcpd and dnsmasq.

Still getting the daemon.err dnsmasq error log entries.

BTW: IPv6 is running on the OpenWrt network; not my ISP / VPN network

Same here, my pings to the node at CMTS+1 are usually well below 50ms at all times, but since the upgrade, it is super spiky as shown in the ping plot

I do have a mix of Windows 10, MacOS and Ubuntu boxes, plus OpenWRT-based APs on the network. so guessing it's the IPv6 from the Windows boxes causing the log spam.

@Ellah1 @TopDog Did you just upgrade the dnsmasq package, or did you upgrade the whole system to 19.07.6? Just curious since it doesn't seem like dnsmasq would cause issues with sqm. It might be good to bring up this concern in the 19.07.6 thread if it wasn't just dnsmasq you upgraded: OpenWrt 19.07.6 service release

I just upgraded the package on my 19.07.4 build.

Must be some resource contention, but I don't see elevated SIRQ nor load (15 min avg is 0.2)

Hello,
Upgrade package to Archer C7 v4, keep settings checkbox unchecked, no error. Everything is functional
Thanks for all

This update boke my camera system, cannot view cameras from my phone. My rtsp stream is not working at all.

I just would like to add this also getting triggered by Windows Server client machines with IPv6, i just tested booting one of my WinServer VM's (specifically 2019 version), and after opening Edge and tried browsing an IPv6 site, the openwrt logs started to get the following

Fri Jan 22 06:30:04 2021 daemon.err dnsmasq[14996]: failed to send packet: Address family not supported by protocol
Fri Jan 22 06:30:07 2021 daemon.err dnsmasq[14996]: failed to send packet: Address family not supported by protocol
Fri Jan 22 06:30:08 2021 daemon.err dnsmasq[14996]: failed to send packet: Network unreachable
Fri Jan 22 06:30:08 2021 daemon.err dnsmasq[14996]: failed to send packet: Network unreachable
Fri Jan 22 06:30:09 2021 daemon.err dnsmasq[14996]: failed to send packet: Network unreachable
Fri Jan 22 06:30:09 2021 daemon.err dnsmasq[14996]: failed to send packet: Network unreachable
Fri Jan 22 06:30:14 2021 daemon.err dnsmasq[14996]: failed to send packet: Network unreachable
Fri Jan 22 06:30:23 2021 daemon.err dnsmasq[14996]: failed to send packet: Network unreachable
Fri Jan 22 06:30:25 2021 daemon.err dnsmasq[14996]: failed to send packet: Address family not supported by protocol
Fri Jan 22 06:30:25 2021 daemon.err dnsmasq[14996]: failed to send packet: Address family not supported by protocol
Fri Jan 22 06:30:28 2021 daemon.err dnsmasq[14996]: failed to send packet: Address family not supported by protocol
Fri Jan 22 06:30:28 2021 daemon.err dnsmasq[14996]: failed to send packet: Address family not supported by protocol
Fri Jan 22 06:30:28 2021 daemon.err dnsmasq[14996]: failed to send packet: Address family not supported by protocol
Fri Jan 22 06:30:28 2021 daemon.err dnsmasq[14996]: failed to send packet: Address family not supported by protocol

And stopped after shutting down the VM machine

Ok.. it seems even my MacOS machines are affected.. it gets triggered mostly by browsing (using Safari, Chrome, or Edge - these are the only available browsers I have installed)

Fri Jan 22 07:03:16 2021 daemon.err dnsmasq[16020]: failed to send packet: Network unreachable
Fri Jan 22 07:03:16 2021 daemon.err dnsmasq[16020]: failed to send packet: Network unreachable
Fri Jan 22 07:03:16 2021 daemon.err dnsmasq[16020]: failed to send packet: Network unreachable
Fri Jan 22 07:03:16 2021 daemon.err dnsmasq[16020]: failed to send packet: Network unreachable
Fri Jan 22 07:03:16 2021 daemon.err dnsmasq[16020]: failed to send packet: Network unreachable
Fri Jan 22 07:03:16 2021 daemon.err dnsmasq[16020]: failed to send packet: Network unreachable
Fri Jan 22 07:03:22 2021 daemon.err dnsmasq[16020]: failed to send packet: Network unreachable
Fri Jan 22 07:03:22 2021 daemon.err dnsmasq[16020]: failed to send packet: Network unreachable
Fri Jan 22 07:03:22 2021 daemon.err dnsmasq[16020]: failed to send packet: Network unreachable
Fri Jan 22 07:03:23 2021 daemon.err dnsmasq[16020]: failed to send packet: Network unreachable
Fri Jan 22 07:03:26 2021 daemon.err dnsmasq[16020]: failed to send packet: Network unreachable
Fri Jan 22 07:03:27 2021 daemon.err dnsmasq[16020]: failed to send packet: Network unreachable
Fri Jan 22 07:03:30 2021 daemon.err dnsmasq[16020]: failed to send packet: Network unreachable
Fri Jan 22 07:03:30 2021 daemon.err dnsmasq[16020]: failed to send packet: Network unreachable
Fri Jan 22 07:03:30 2021 daemon.err dnsmasq[16020]: failed to send packet: Network unreachable
Fri Jan 22 07:03:32 2021 daemon.err dnsmasq[16020]: failed to send packet: Address family not supported by protocol
Fri Jan 22 07:03:32 2021 daemon.err dnsmasq[16020]: failed to send packet: Network unreachable
Fri Jan 22 07:03:32 2021 daemon.err dnsmasq[16020]: failed to send packet: Network unreachable
Fri Jan 22 07:03:32 2021 daemon.err dnsmasq[16020]: failed to send packet: Network unreachable
Fri Jan 22 07:03:33 2021 daemon.err dnsmasq[16020]: failed to send packet: Address family not supported by protocol
Fri Jan 22 07:03:34 2021 daemon.err dnsmasq[16020]: failed to send packet: Address family not supported by protocol
Fri Jan 22 07:03:34 2021 daemon.err dnsmasq[16020]: failed to send packet: Address family not supported by protocol
Fri Jan 22 07:03:34 2021 daemon.err dnsmasq[16020]: failed to send packet: Network unreachable
Fri Jan 22 07:03:34 2021 daemon.err dnsmasq[16020]: failed to send packet: Network unreachable
Fri Jan 22 07:03:54 2021 daemon.err dnsmasq[16020]: failed to send packet: Address family not supported by protocol
Fri Jan 22 07:03:54 2021 daemon.err dnsmasq[16020]: failed to send packet: Address family not supported by protocol
Fri Jan 22 07:04:10 2021 daemon.err dnsmasq[16020]: failed to send packet: Network unreachable

I firstly upgraded dnsmasq yesterday. Then today I have carried out additional troubleshooting: disabled IPv6 across the network, then turned off all Windows clients, then reset router and upgraded to v19.07.6 and reinstalled apps / config. None of the above have stopped the error logs.

If I'm honest I don't think I can categorically link the logs to ping spikes or video chop as I previously reported based on my experience of today - video has been relatively stable but I've obviously been doing a lot of tweaking so only time will tell.

I am wondering if hardware makes any difference. I am on Linksys WRT but at face value it seems that Netgear folk may have a better experience?

I doubt it, since it seems to affect across various types of routers.

Ok it seems my machine using MacOS Big Sur is triggering the failed to send packet with dnsmasq-full (i'm using the full version on my router), but testing on a MacOS Mojave doesn't seems to trigger the dnsmasq error

I think this needs attention, pinging @hauke as the author/commiter of the backports in the hope they notice.

3 Likes

Is there any precedent for an action on a client device reflecting in the syslog like the excerpts above show? It's surprising to me. Other than DHCP and wifi activity, I wasn't aware that anything a PC could do would show up there.

Based on some of my test it's related on how the clients are doing DNS request via IPv6 on the network

A few more observations. With the updated DNSMASQ, I noticed my Win10 pc was not getting a DHCPv6 lease in the Overview page, but a 'ipconfig /all' shows a lease obtained.

So I firewalled ports 546-547 so no DHCPv6 requests can be received by the router. Most of the errors messages stopped. IPv6 still works via SLAAC.

And I did notice SQM does not work the same as noticed by @TopDog in post #38.

So I reverted to the older build, installed BIND9 on my file server, and redirected DNS to it. I guess if this doesn't get sorted out in a reasonable time, I'll get out the WRT1900 and re-purpose the RPi4 as a Bind9 DNS server.

Hi everybody,
have two links in edgerouter x and today weirdly they went down for two times.
Set the suggested mitigation above and got 'udhcpc: no lease, failing."

Thnks in advance for n word.

rgds,

thnk u guys, read the FS#887 - udhcpc: no lease, failing in this link

Rgds