3 ms·

Wishful thinking: OpenWRT userland can now replace dnsmasq with two separate programs. The DHCP server, odhcpd, is already included (for DHCP6). They just nee

Wishful thinking: OpenWRT userland can now replace dnsmasq with two separate programs. The DHCP server, odhcpd, is already included (for DHCP6). They just need to write the DNS software. I always disable/remove dnsmasq when I can. Compared to the alternatives, I have never liked it. This is at least the second major dnsmasq coding mistake that has been published in recent memory.^1 Pi-Hole was based on dnsmasq which turned me off that as well. 1. https://www.jsof-tech.com/wp-content/uploads/2021/01/DNSpooq_Technical-Whitepaper.pdf https://www.jsof-tech.com/wp-content/uploads/2021/01/DNSpooq... https://www.cisa.gov/news-events/ics-advisories/icsa-21-019-01 https://www.cisa.gov/news-events/ics-advisories/icsa-21-019-... https://www.malwarebytes.com/blog/news/2021/01/dnspooq-the-bugs-haunting-dnsmasq https://www.malwarebytes.com/blog/news/2021/01/dnspooq-the-b... https://web.archive.org/web/20210119133618if_/https://www.jsof-tech.com/disclosures/dnspooq/ https://web.archive.org/web/20210119133618if_/https://www.js... https://seclists.org/oss-sec/2021/q1/49 https://seclists.org/oss-sec/2021/q1/49 Anyway, never gonna happen. Just wishful thinking.

yjftsjthsd-h 1y ago
> This is at least the second major dnsmasq coding mistake that has been published in recent memory. What was the first?
- tptacek 1y ago
  There was like a memory corruption RCE not long ago.
  - aspenmayer 1y ago
    I think there were two sets of 7 total vulnerabilities at the same time so they might be perceived as one event? I don’t know for sure, the wording was kind of ambiguous. https://openwrt.org/advisory/2021-01-19-1 https://openwrt.org/advisory/2021-01-19-1 > Dnsmasq has two sets of vulnerabilities, one set of memory corruption issues handling DNSSEC and a second set of issues validating DNS responses. These vulnerabilities could allow an attacker to corrupt memory on the target device and perform cache poisoning attacks against the target environment. > These vulnerabilities are also tracked as ICS-VU-668462 and referred to as DNSpooq. https://web.archive.org/web/20250121143405/https://www.jsof-tech.com/disclosures/dnspooq/ https://web.archive.org/web/20250121143405/https://www.jsof-... > DNSpooq - Kaminsky attack is back! > 7 new vulnerabilities are being disclosed in common DNS software dnsmasq, reminiscent of 2008 weaknesses in Internet DNS Architecture Some less breathless sourcing, though I can’t blame OP for being excited in the above post: https://www.kb.cert.org/vuls/id/434904 https://www.kb.cert.org/vuls/id/434904 https://www.cisa.gov/news-events/ics-advisories/icsa-21-019-01 https://www.cisa.gov/news-events/ics-advisories/icsa-21-019-...
cnst 1y ago
Would OpenWrt even be vulnerable in the first place? If you're using dnsmasq behind NAT or a stateful firewall, how would an attacker be able to access the service in the first place?
- aspenmayer 1y ago
  In the past, this has been the case. I looked and didn’t see anything on the forum about this news, but it may be too soon to hit the forum? I don’t visit it very often. https://forum.openwrt.org/t/security-advisory-2021-01-19-1-dnsmasq-multiple-vulnerabilities/85903 https://forum.openwrt.org/t/security-advisory-2021-01-19-1-d... https://openwrt.org/advisory/2021-01-19-1 https://openwrt.org/advisory/2021-01-19-1
dc396 1y ago
While the functionality/complexity of dnsmasq makes me nervous and I use it (I don't have a use case for it), it isn't clear to me that dnsmasq is doing anything wrong in this particular case.
noinsight 1y ago
You can just use Unbound for DNS.
- 1vuio0pswjnm7 1y ago
  I use tinydns or nsd You can use unbound I do not use a cache For HTTP I use a localhost-bound TLS forward proxy that has the DNS data in memory; I gather the DNS data in bulk from various sources using various methods; there are no remote DNS queries when I make HTTP requests Unbound is overkill for how I use DNS on the local network
  - throw0101c 1y ago
    Unbound is a recursive-only resolver. NSD is an authoritative-only resolver. Those are different use cases.
    - JdeBP 1y ago
      Psst! NSD isn't a "resolver" at all. Traditional DNS terminology is tricky to use (given that what is covered by "resolver" in the RFCs does not match how most people see the system as divided up) but something that does not do the resolving part at all is definitely not a resolver. * https://jdebp.uk/FGA/dns-server-roles.html https://jdebp.uk/FGA/dns-server-roles.html
    - 1vuio0pswjnm7 1y ago
      "Unbound is a recursive-only resolver" https://raw.githubusercontent.com/NLnetLabs/unbound/master/doc/FEATURES https://raw.githubusercontent.com/NLnetLabs/unbound/master/d... https://raw.githubusercontent.com/NLnetLabs/unbound/master/doc/example.conf.in https://raw.githubusercontent.com/NLnetLabs/unbound/master/d... Unbound can also answer queries from data in a text file read into memory at startup, like an authoritative nameserver would; no recursion
- stock_toaster 1y ago
  Unbound unfortunately has some a pair of issues ([1][2]) that in some situations (adblocking, source address based dns selection) can make it a less than optimal match for some use-cases. [1]: https://github.com/NLnetLabs/unbound/issues/132 https://github.com/NLnetLabs/unbound/issues/132 [2]: https://github.com/NLnetLabs/unbound/issues/210 https://github.com/NLnetLabs/unbound/issues/210

yjftsjthsd-h 1y ago

> This is at least the second major dnsmasq coding mistake that has been published in recent memory. What was the first?

tptacek 1y ago
There was like a memory corruption RCE not long ago.
- aspenmayer 1y ago
  I think there were two sets of 7 total vulnerabilities at the same time so they might be perceived as one event? I don’t know for sure, the wording was kind of ambiguous. https://openwrt.org/advisory/2021-01-19-1 https://openwrt.org/advisory/2021-01-19-1 > Dnsmasq has two sets of vulnerabilities, one set of memory corruption issues handling DNSSEC and a second set of issues validating DNS responses. These vulnerabilities could allow an attacker to corrupt memory on the target device and perform cache poisoning attacks against the target environment. > These vulnerabilities are also tracked as ICS-VU-668462 and referred to as DNSpooq. https://web.archive.org/web/20250121143405/https://www.jsof-tech.com/disclosures/dnspooq/ https://web.archive.org/web/20250121143405/https://www.jsof-... > DNSpooq - Kaminsky attack is back! > 7 new vulnerabilities are being disclosed in common DNS software dnsmasq, reminiscent of 2008 weaknesses in Internet DNS Architecture Some less breathless sourcing, though I can’t blame OP for being excited in the above post: https://www.kb.cert.org/vuls/id/434904 https://www.kb.cert.org/vuls/id/434904 https://www.cisa.gov/news-events/ics-advisories/icsa-21-019-01 https://www.cisa.gov/news-events/ics-advisories/icsa-21-019-...

cnst 1y ago

Would OpenWrt even be vulnerable in the first place? If you're using dnsmasq behind NAT or a stateful firewall, how would an attacker be able to access the service in the first place?

aspenmayer 1y ago
In the past, this has been the case. I looked and didn’t see anything on the forum about this news, but it may be too soon to hit the forum? I don’t visit it very often. https://forum.openwrt.org/t/security-advisory-2021-01-19-1-dnsmasq-multiple-vulnerabilities/85903 https://forum.openwrt.org/t/security-advisory-2021-01-19-1-d... https://openwrt.org/advisory/2021-01-19-1 https://openwrt.org/advisory/2021-01-19-1

dc396 1y ago

While the functionality/complexity of dnsmasq makes me nervous and I use it (I don't have a use case for it), it isn't clear to me that dnsmasq is doing anything wrong in this particular case.

noinsight 1y ago

You can just use Unbound for DNS.

1vuio0pswjnm7 1y ago
I use tinydns or nsd You can use unbound I do not use a cache For HTTP I use a localhost-bound TLS forward proxy that has the DNS data in memory; I gather the DNS data in bulk from various sources using various methods; there are no remote DNS queries when I make HTTP requests Unbound is overkill for how I use DNS on the local network
- throw0101c 1y ago
  Unbound is a recursive-only resolver. NSD is an authoritative-only resolver. Those are different use cases.
  - JdeBP 1y ago
    Psst! NSD isn't a "resolver" at all. Traditional DNS terminology is tricky to use (given that what is covered by "resolver" in the RFCs does not match how most people see the system as divided up) but something that does not do the resolving part at all is definitely not a resolver. * https://jdebp.uk/FGA/dns-server-roles.html https://jdebp.uk/FGA/dns-server-roles.html
  - 1vuio0pswjnm7 1y ago
    "Unbound is a recursive-only resolver" https://raw.githubusercontent.com/NLnetLabs/unbound/master/doc/FEATURES https://raw.githubusercontent.com/NLnetLabs/unbound/master/d... https://raw.githubusercontent.com/NLnetLabs/unbound/master/doc/example.conf.in https://raw.githubusercontent.com/NLnetLabs/unbound/master/d... Unbound can also answer queries from data in a text file read into memory at startup, like an authoritative nameserver would; no recursion
stock_toaster 1y ago
Unbound unfortunately has some a pair of issues ([1][2]) that in some situations (adblocking, source address based dns selection) can make it a less than optimal match for some use-cases. [1]: https://github.com/NLnetLabs/unbound/issues/132 https://github.com/NLnetLabs/unbound/issues/132 [2]: https://github.com/NLnetLabs/unbound/issues/210 https://github.com/NLnetLabs/unbound/issues/210