Security Advisory 2021-01-19-1 - dnsmasq multiple vulnerabilities

Release and security announcements
85

Thanks for the tip!

I compiled two master shapshots where one had the dnsmasq update reverted (i.e. running version v2.82) and the other had the newest test build (v.2.84test3). There doesn't really seem like there's much difference in load between the two, but I admit that my testing had been fairly naive, so feel free to poke holes in it. What I did was:

  1. ssh into the router and run: htop -p <pid of dnsmasq> -d 0.2

  2. Disable the DNS cache on my Fedora 33 laptop by uncommenting #Cache=no in /etc/systemd/resolved.conf and restarting systemd-resolved with sudo systemctl restart systemd-resolved

  3. Run dnsperf -s 192.168.1.1 -d address_file -n 10 on the laptop

  4. Compare the load in the two builds

I used the addresses of a few large newspapers in Norway and the Norwegian google page:

$ cat address_file 
www.vg.no AAAA
www.vg.no A
www.ap.no AAAA
www.ap.no A
www.google.no AAAA
www.google.no A

The resulting CPU load was more or less the same at short bursts of 10% when the request went through. Sometimes it reached 20%, but this happened on both builds.