dnsmasq failed to send packet: Network is unreachable
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| | dnsmasq (Ubuntu) |
Undecided
|
Ubuntu Security Team | ||
Bug Description
the log shows this:
Feb 22 09:37:53 myserver dnsmasq[2259]: failed to send packet: Network is unreachable
repeatedly and frequently.
This is a known bug in dnsmasq and has been fixed upstream (according to the thread quoted below). Apparently it is IPv6 related and triggered by Windows and Mac clients. An extensive thread on the subject is here on the OpenWRT forum:
I think this has been reported in the fallout of the quoted security vulnerabilities. I don't think it is a security vulnerability in itself.
dnsmasq version: 2.80-1.1ubuntu1.2
ProblemType: Bug
DistroRelease: Ubuntu 20.04
Package: dnsmasq 2.80-1.1ubuntu1.2
Uname: Linux 5.4.98-219 armv7l
ApportVersion: 2.20.11-
Architecture: armhf
CasperMD5CheckR
Date: Mon Feb 22 09:34:12 2021
PackageArchitec
ProcEnviron:
TERM=xterm
PATH=(custom, no user)
XDG_RUNTIME_
LANG=en_GB.UTF-8
SHELL=/bin/bash
SourcePackage: dnsmasq
UpgradeStatus: Upgraded to focal on 2020-11-15 (98 days ago)
modified.
mtime.conffile.
| Nigel Hathaway (nhathaway) wrote : | #1 |
| Nigel Hathaway (nhathaway) wrote : | #2 |
| Nigel Hathaway (nhathaway) wrote : | #3 |
(redacted) dnsmasq conf fields are:
bind-dynamic
domain=
dhcp-authoritative
domain-needed
stop-dns-rebind
rebind-localhost-ok
no-hosts
dhcp-broadcast=
no-poll
enable-ra
bogus-priv
bogus-nxdomain=
dhcp-boot=
dhcp-boot=
enable-tftp
tftp-root=
dhcp-option=
dhcp-option=19,0
dhcp-option=
dhcp-option=
dhcp-option=46,8
dhcp-option=
dhcp-option=
dhcp-option=
dhcp-option=
dhcp-range=
dhcp-range=
dhcp-range=
dhcp-range=
dhcp-range=
dhcp-range=
...plus several dhcp-host and address fields
| tags: | added: regression-update |
| Christian Ehrhardt (paelzer) wrote : | #4 |
I've yesterday pinged the security Team as FYI on this.
In the meanwhile by tracking the upstream list this seems to be the follow up fix:
https:/
With the following being related
https:/
It will fix the immediate issue, but compared to the past the SP will stay the same now, see this discussion.
https:/
@Marc/Security - are you going to follow on on those CVE pushes with that fix or do we need a different plan of action?
| Changed in dnsmasq (Ubuntu): | |
| assignee: | nobody → Ubuntu Security Team (ubuntu-security) |
| Marc Deslauriers (mdeslaur) wrote : | #5 |
So it looks like there are two different issues here:
Bug in handling multiple queries (openwrt bug):
Move fd into frec_src, fixes 15b60ddf935a531
https:/
Fix to 75e2f0aec33e58e
https:/
Fix for 12af2b171de0d67
https:/
Bug with DNS retries (post from mailing list):
Fix problem with DNS retries in 2.83/2.84.
http://
Simplify preceding fix.
https:/
I'll prepare updated packages with these fixes.
| Marc Deslauriers (mdeslaur) wrote : | #6 |
I have backported the patches and have some packages to test in the security team PPA here:
https:/
Could you please see if they solve the issue for you? Once you've tried them, I will release them as a security regression fix.
Thanks!
| Nigel Hathaway (nhathaway) wrote : | #7 |
Initial indications are that it has, but I will leave it running overnight and look at the logs in the morning.
| Nigel Hathaway (nhathaway) wrote : | #8 |
Confirmed: with the updated package, the reported problem no longer exists. Please make that release.
| Launchpad Janitor (janitor) wrote : | #9 |
This bug was fixed in the package dnsmasq - 2.82-1ubuntu1.2
---------------
dnsmasq (2.82-1ubuntu1.2) groovy-security; urgency=medium
* SECURITY REGRESSION: issue with multiple queries and issue with retries
(LP: #1916462)
- backport multiple upstream commits to fix regressions
+ 04490bf622ac848
+ 12af2b171de0d67
+ 3f535da79e7a421
+ 25e63f1e56f5acd
+ 141a26f979b4bc9
+ 305cb79c5754d55
-- Marc Deslauriers <email address hidden> Tue, 23 Feb 2021 07:52:53 -0500
| Changed in dnsmasq (Ubuntu): | |
| status: | New → Fix Released |
The (redacted) output of ip addr show is:
1: lo: <LOOPBACK,
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,
link/ether ...my mac... brd ff:ff:ff:ff:ff:ff
inet 192.168.1.1/24 brd 192.168.1.255 scope global eth0
valid_lft forever preferred_lft forever
inet6 ...internet ipv6 addr.../64 scope global
valid_lft forever preferred_lft forever
inet6 ...internet ipv6 addr.../64 scope global
valid_lft forever preferred_lft forever
inet6 ...internet ipv6 addr.../64 scope global
valid_lft forever preferred_lft forever
inet6 fe80::21e:
valid_lft forever preferred_lft forever
3: vlan4@eth0: <BROADCAST,
link/ether ...my mac... brd ff:ff:ff:ff:ff:ff
inet ...internet ipv4.../24 brd ...internet ipv4....255 scope global dynamic vlan4
valid_lft 351763sec preferred_lft 351763sec
inet6 fe80::21e:
valid_lft forever preferred_lft forever
4: vlan5@eth0: <BROADCAST,
link/ether ...my mac... brd ff:ff:ff:ff:ff:ff
inet 192.168.2.1/24 brd 192.168.2.255 scope global vlan5
valid_lft forever preferred_lft forever
inet6 fd17:6e78:
valid_lft forever preferred_lft forever
inet6 fe80::21e:
valid_lft forever preferred_lft forever
5: vlan6@eth0: <BROADCAST,
link/ether ...my mac... brd ff:ff:ff:ff:ff:ff
inet 192.168.3.1/24 brd 192.168.3.255 scope global vlan6
valid_lft forever preferred_lft forever
inet6 fd17:6e78:
valid_lft forever preferred_lft forever
inet6 fe80::21e:
valid_lft forever preferred_lft forever
6: sit0@NONE: <NOARP> mtu 1480 qdisc noop state DOWN group default qlen 1000
link/sit 0.0.0.0 brd 0.0.0.0
7: he-ipv6@NONE: <POINTOPOINT,
link/sit ...internet ipv4... peer ...internet ipv4...
inet6 ...internet ipv6 addr.../64 scope global
valid_lft forever preferred_lft forever
inet6 fe80::5ce9:ca14/64 scope link
valid_lft forever preferred_lft forever
8: tunl0@NONE: <NOARP> mtu 1480 qdisc noop state DOWN group default qlen 1000
link/ipip 0.0.0.0 brd 0.0.0.0
9: ipv4-tunnel@NONE: <POINTOPOINT,
link/ipip ...internet ipv4... peer ...internet ipv4...
inet ...internet ipv4.../32 scope global ipv4-tunnel
valid_lft forever preferred_lft forever
inet6 fe80::200: