Security Advisory 2021-01-19-1 - dnsmasq multiple vulnerabilities

I'm also getting these errors (at least hourly) since the dnsmasq upgrade to v2.80-16.2 last night, running stock 19.07.5 r11257 on Linksys WRT3200ACM:

 dnsmasq Ignoring query from non-local network
 dnsmasq failed to send packet: Network unreachable
 dnsmasq failed to send packet: Address family not supported by protocol

Any advice much appreciated, unless we wait for a patch if this has been acknowledged as a bug and being actively worked on.

Thanks

It's certainly interesting. I wonder if there's a way to test if they're legit errors or false ones?

Like many, I spend most of my working life on video calls these days, and today my audio and video feeds have been choppy, roughly at the time of the errors. I have SQM running layer cake which is normally rock solid regardless of network traffic.... Not since the upgrade :worried:.

So for me anyway these are definitely legit errors which I need to fix somehow.

1 Like

updated my router which is running trunk and also have the error


daemon.err dnsmasq[24211]: failed to send packet: Network unreachable

Update: After watching dnsmasq with verbose output for a little while, I had the slight suspicion that the error was IPv6 related. And indeed, after I set the WAN interface to ipv6=0 the failed to send packet: Network unreachable errors have stopped.

Edit: Correct ballpark, wrong ball. See below. It was IPv6 on my Windows 10 machine, just like @94121-usr observed above.

1 Like

Running 19.07.6, Getting them same problem

Wed Jan 20 17:13:14 2021 daemon.err dnsmasq[2447]: failed to send packet: Address family not supported by protocol
Wed Jan 20 17:13:20 2021 daemon.err dnsmasq[2447]: failed to send packet: Address family not supported by protocol
Wed Jan 20 17:13:53 2021 daemon.err dnsmasq[2447]: failed to send packet: Address family not supported by protocol
Wed Jan 20 17:15:32 2021 daemon.err dnsmasq[2447]: failed to send packet: Network unreachable
Wed Jan 20 17:17:04 2021 daemon.err dnsmasq[2447]: failed to send packet: Network unreachable
Wed Jan 20 17:18:25 2021 daemon.err dnsmasq[2447]: failed to send packet: Network unreachable
Wed Jan 20 17:21:03 2021 daemon.err dnsmasq[2447]: failed to send packet: Network unreachable

Getting the same errors in bursts on a test device:


Wed Jan 20 12:29:22 2021 daemon.err dnsmasq[1]: failed to send packet: Address family not supported by protocol
Wed Jan 20 12:29:22 2021 daemon.err dnsmasq[1]: failed to send packet: Address family not supported by protocol
Wed Jan 20 12:29:24 2021 daemon.err dnsmasq[1]: failed to send packet: Address family not supported by protocol
Wed Jan 20 12:29:25 2021 daemon.err dnsmasq[1]: failed to send packet: Address family not supported by protocol
Wed Jan 20 12:38:09 2021 daemon.err dnsmasq[1]: failed to send packet: Address family not supported by protocol
Wed Jan 20 12:38:09 2021 daemon.err dnsmasq[1]: failed to send packet: Address family not supported by protocol
Wed Jan 20 12:38:09 2021 daemon.err dnsmasq[1]: failed to send packet: Address family not supported by protocol
Wed Jan 20 12:38:09 2021 daemon.err dnsmasq[1]: failed to send packet: Address family not supported by protocol
Wed Jan 20 12:38:09 2021 daemon.err dnsmasq[1]: failed to send packet: Address family not supported by protocol
Wed Jan 20 12:38:09 2021 daemon.err dnsmasq[1]: failed to send packet: Address family not supported by protocol

I have the same log errors that other members are reporting here but disabling ipv6 does not make these go away for me.

Sorry for editing this post so much, but I was wrong. It is definitely related to IPv6, but it has nothing to do with IPv6 on the WAN interface.

Turns out, it has been a client machine all along. I started out with disabling IPv6, everywhere, including my clients, then re-enabling it on all interfaces. After I finally enabled it on LAN, it led me to believe it was IPv6 on WAN, but it wasn't. I forgot my Windows 10 client.

After again turning on IPv6 on the Windows 10 machine, the "Network unreachable" errors are now back. I don't have any other machines with a different OS in my network (at least none that request IPv6 dhcp) to check if it is Windows specific or also happening with other OSes. But that's the culprit. Somehow dnsmasq is stepping on its own operation now, and going "ouch" a lot. Benign, but very noisy.

1 Like

Exactly in the same boat here, the only device with Window 10 connecting to OpenWrt gives me the errors again this morning, switched it off last night they disappeared!

Switched off IPv6 on the W10 PC:

  • removed the daemon.err dnsmasq[2861]: failed to send packet: Address family not supported by protocol errors
  • with only seldom no other daemon.err dnsmasq[2861]: failed to send packet: Network unreachable errors displayed

About it being benign or not, see @Ellah1's comment above. It may not be.

I hear you, and I really don't want to downplay anything. But this is dnsmasq we are talking about, it is responsible for DHCP and DNS requests, and the errors seem to be related to the latter.

I will happily stand corrected, but I don't see how an error thrown by dnsmasq can possibly influence other aspects of routing or SQM, those don't run through dnsmasq, you don't even need dnsmasq for regular router operation.

It just occurred to me that besides DHCPv4 and DNS operation, dnsmasq is also responsible for RA. My lack of experience with IPv6 is really start to show now, so I don't want to speculate any further.

I solved my problems by disabling IPv6 on the "offending" client, and my IPv6 being strictly local it's not something I terribly miss at the moment. But there is something off with dnsmasq and IPv6 and it doesn't seem to be a fringe problem.

I really hope a dev can chime in on the issue soon.

4 Likes

By default, dnsmasq isn't responsible for IPv6 though. That's what odhcpd is for.

2 Likes

I located the problem to my wife's Windows work computer. It is in an external windows domain and we have no administrator rights to it. There seems to be some incompatibility with this new dnsmasq fix.

Is it ok for me to downgrade my wrt3200acm back to 19.07.5 or does it break something?

Here is a technical paper from jsof about this issue


I can confirm that the mitigation steps from ynezz work, without any noticeable problems or log entries.
OpenWrt 19.07.5 / R7800

PS: It feels good that there is already a mitigation when you become aware of the problem yourself.

2 Likes

I tried setting the odhcpd log level from my current setting of '4' to '0', then tried '7'.
In both cases restarted odhcpd and dnsmasq.

Still getting the daemon.err dnsmasq error log entries.

BTW: IPv6 is running on the OpenWrt network; not my ISP / VPN network

Same here, my pings to the node at CMTS+1 are usually well below 50ms at all times, but since the upgrade, it is super spiky as shown in the ping plot

I do have a mix of Windows 10, MacOS and Ubuntu boxes, plus OpenWRT-based APs on the network. so guessing it's the IPv6 from the Windows boxes causing the log spam.

@Ellah1 @TopDog Did you just upgrade the dnsmasq package, or did you upgrade the whole system to 19.07.6? Just curious since it doesn't seem like dnsmasq would cause issues with sqm. It might be good to bring up this concern in the 19.07.6 thread if it wasn't just dnsmasq you upgraded: OpenWrt 19.07.6 service release

I just upgraded the package on my 19.07.4 build.

Must be some resource contention, but I don't see elevated SIRQ nor load (15 min avg is 0.2)