Hacker News Reader

Comment by 1vuio0pswjnm7 | Hacker News Reader

Wishful thinking: OpenWRT userland can now replace dnsmasq with two separate programs. The DHCP server, odhcpd, is already included (for DHCP6). They just need to write the DNS software.

I always disable/remove dnsmasq when I can. Compared to the alternatives, I have never liked it. This is at least the second major dnsmasq coding mistake that has been published in recent memory.^1 Pi-Hole was based on dnsmasq which turned me off that as well.

https://www.jsof-tech.com/wp-content/uploads/2021/01/DNSpooq...

https://www.cisa.gov/news-events/ics-advisories/icsa-21-019-...

https://www.malwarebytes.com/blog/news/2021/01/dnspooq-the-b...

https://web.archive.org/web/20210119133618if_/https://www.js...

https://seclists.org/oss-sec/2021/q1/49

Anyway, never gonna happen. Just wishful thinking.

View on HN

Would OpenWrt even be vulnerable in the first place?

If you're using dnsmasq behind NAT or a stateful firewall, how would an attacker be able to access the service in the first place?

In the past, this has been the case. I looked and didn’t see anything on the forum about this news, but it may be too soon to hit the forum? I don’t visit it very often.

https://forum.openwrt.org/t/security-advisory-2021-01-19-1-d...

https://openwrt.org/advisory/2021-01-19-1

While the functionality/complexity of dnsmasq makes me nervous and I use it (I don't have a use case for it), it isn't clear to me that dnsmasq is doing anything wrong in this particular case.

> This is at least the second major dnsmasq coding mistake that has been published in recent memory.

What was the first?

There was like a memory corruption RCE not long ago.

I think there were two sets of 7 total vulnerabilities at the same time so they might be perceived as one event? I don’t know for sure, the wording was kind of ambiguous.

https://openwrt.org/advisory/2021-01-19-1

> Dnsmasq has two sets of vulnerabilities, one set of memory corruption issues handling DNSSEC and a second set of issues validating DNS responses. These vulnerabilities could allow an attacker to corrupt memory on the target device and perform cache poisoning attacks against the target environment.

> These vulnerabilities are also tracked as ICS-VU-668462 and referred to as DNSpooq.

https://web.archive.org/web/20250121143405/https://www.jsof-...

> DNSpooq - Kaminsky attack is back!

> 7 new vulnerabilities are being disclosed in common DNS software dnsmasq, reminiscent of 2008 weaknesses in Internet DNS Architecture

Some less breathless sourcing, though I can’t blame OP for being excited in the above post:

https://www.kb.cert.org/vuls/id/434904

https://www.cisa.gov/news-events/ics-advisories/icsa-21-019-...

You can just use Unbound for DNS.

I use tinydns or nsd

You can use unbound

I do not use a cache

For HTTP I use a localhost-bound TLS forward proxy that has the DNS data in memory; I gather the DNS data in bulk from various sources using various methods; there are no remote DNS queries when I make HTTP requests

Unbound is overkill for how I use DNS on the local network

Unbound is a recursive-only resolver. NSD is an authoritative-only resolver.

Those are different use cases.

Psst! NSD isn't a "resolver" at all. Traditional DNS terminology is tricky to use (given that what is covered by "resolver" in the RFCs does not match how most people see the system as divided up) but something that does not do the resolving part at all is definitely not a resolver.

* https://jdebp.uk/FGA/dns-server-roles.html

"Unbound is a recursive-only resolver"

https://raw.githubusercontent.com/NLnetLabs/unbound/master/d...

Unbound can also answer queries from data in a text file read into memory at startup, like an authoritative nameserver would; no recursion

Unbound unfortunately has some a pair of issues ([1][2]) that in some situations (adblocking, source address based dns selection) can make it a less than optimal match for some use-cases.

[1]: https://github.com/NLnetLabs/unbound/issues/132

[2]: https://github.com/NLnetLabs/unbound/issues/210

From https://github.com/NLnetLabs/unbound/issues/132

"Some users of our service (NextDNS), discovered this issue since edgekey.net has been added to some anti-tracker blocklists, resulting in the blocking of large sites like apple.com, airbnb.com, ebay.com when used with unbound."

As Pi-Hole is a modified dnsmasq, NextDNS may be a modified unbound

Reply on news.ycombinator.com