Bug 904940

From original Bug #894486


--- Josh Stone 2013-01-11 16:03:31 EST ---

Description of problem:
On my workstation, as a virtual machine host, I have NetworkManager's dnsmasq configured to forward DNS queries for a local domain to 192.168.122.1, so I can resolve those to virtual machine DHCP hostnames.  Recently this stopped working.

With manual dig commands, I found that TCP queries still work, but UDP doesn't.  For example, in libvirt I have a statically defined name "vhost" to 192.168.122.1 itself.  From the host, the command "dig +short +tcp @192.168.122.1 vhost" resolves that just fine.  But "dig +short +notcp @192.168.122.1 vhost" says "connection timed out; no servers could be reached".  From a guest, +tcp and +notcp both work fine.

Version-Release number of selected component (if applicable):
libvirt-0.9.11.8-2.fc17.x86_64, dnsmasq-2.63-1.fc17.x86_64
I also tried dnsmasq-2.65-1.fc17.x86_64 from updates-testing

How reproducible:
100%

Steps to Reproduce:
1. From the virtual machine host, try to query the libvirt dnsmasq.
  
Actual results:
$ dig +short +tcp @192.168.122.1 vhost
192.168.122.1
$ dig +short +notcp @192.168.122.1 vhost
;; connection timed out; no servers could be reached

Expected results:
A positive answer from both TCP and UDP queries.

Additional info:
I suspect this is related to the fixes for CVE-2012-3411, but it seems weird that UDP and TCP would be treated differently.


--- Josh Stone 2013-01-17 14:30:07 EST ---

This is still a problem on F18, but I've reproduced it with dnsmasq alone, so I'm retitling and reassigning this bug.

Using dnsmasq-2.65-1.fc18.x86_64, the difference is demonstrated between --bind-dynamic and the old --bind-interfaces.

A local query to dnsmasq --bind-dynamic works in TCP, but times out in UDP:
# dnsmasq --no-daemon --conf-file= --bind-dynamic --interface em1 --except-interface lo

$ dig +tcp +short @192.168.1.203 localhost
127.0.0.1
$ dig +notcp +short @192.168.1.203 localhost
;; connection timed out; no servers could be reached


The same query with --bind-interfaces works fine either way:
# dnsmasq --no-daemon --conf-file= --bind-interfaces --interface em1 --except-interface lo

$ dig +tcp +short @192.168.1.203 localhost
127.0.0.1
$ dig +notcp +short @192.168.1.203 localhost
127.0.0.1


--- Tomas Hozza 2013-01-25 02:47:44 EST ---

(In reply to comment #23)
> I would like NM's dnsmasq to answer 127.0.0.1 (by nature lo), and libvirt's
> to answer 192.168.122.1 on virbr0 or lo.  The fact that NM's can still start
> by using --bind-dynamic doesn't mean it will be the one responding, as your
> bug 886663 comment 6 indicates.  It seems you'd have a startup race for
> whoever really grabbed 127.0.0.1 first, and that's not ok.

dnsmasq with --except-interface lo will *NOT* bind to the loopback interface
this means the 127.0.0.1 will be available. Since CVE-2012-3411 and CVE-2013-0198
were fixed, libvirt's dnsmasq will *NOT* answer any DNS Queries coming on another
interface that virbrX.

Answering DNS Queries coming through lo with --except-interface lo used was
an error.

> I'll file a separate bug later today to stop polluting this CVE, and from
> there hopefully it can be hashed out who among dnsmasq, libvirt, and/or
> NetworkManager can change their options to make this work, if it is possible
> at all.

This could be resolved by implementing new option for dnsmasq, to enable
local DNS Queries (without binding to lo). It would need to be used by libvirt.
Please create the new Bug for dnsmasq.