Bug 1600551
| Summary: | Intermittent dnsmasq outages | |||
|---|---|---|---|---|
| Product: | OpenShift Container Platform | Reporter: | Robert Bost <rbost> | |
| Component: | Networking | Assignee: | Miciah Dashiel Butler Masters <mmasters> | |
| Networking sub component: | router | QA Contact: | zhaozhanqi <zzhao> | |
| Status: | CLOSED CURRENTRELEASE | Docs Contact: | ||
| Severity: | high | |||
| Priority: | high | CC: | aos-bugs, bbennett, dmace, farandac, jfoots, mfiedler, mmasters, msomasun, nbhatt, pdwyer, rfoyle, rhowe | |
| Version: | 3.7.0 | |||
| Target Milestone: | --- | |||
| Target Release: | 3.7.z | |||
| Hardware: | Unspecified | |||
| OS: | Unspecified | |||
| Whiteboard: | ||||
| Fixed In Version: | Doc Type: | Bug Fix | ||
| Doc Text: |
Cause: By default, older versions of dnsmasq can use privileged, lower-numbered source ports for outbound DNS queries.
Consequence: Outbound DNS queries may be dropped; for example, firewall rules may drop queries coming from reserved ports.
Fix: We now configure dnsmasq using its min-port setting to set the minimum port number for outbound queries to 1024.
Result: DNS queries should no longer be dropped.
Additional information: dnsmasq 2.79 changes the default min-port setting to 1024.
|
Story Points: | --- | |
| Clone Of: | ||||
| : | 1609390 1614981 1614983 1614984 1620230 (view as bug list) | Environment: | ||
| Last Closed: | 2019-01-29 16:16:38 UTC | Type: | Bug | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
| Bug Depends On: | 1620230 | |||
| Bug Blocks: | 1267746, 1609390, 1614981, 1614983, 1614984 | |||
|
Description
Robert Bost
2018-07-12 13:25:57 UTC
Working another OpenShift dnsmasq issue we figured the issue to happen when dnsmasq uses a low port number.
Setting min-port=1024 in dnsmasq worked around the issue.
--min-port=<port>
Do not use ports less than that given as source for outbound DNS queries. Dnsmasq picks random ports as source for outbound queries: when this option is given, the ports used will always to larger than that specified. Useful for systems behind firewalls.
Dnsmasq bug was logged:
https://bugzilla.redhat.com/show_bug.cgi?id=1614331
I was not able to reproduce the issue again with this configuration in place.
Created PR to add this configuration via the ansible installer for OpenShift: https://github.com/openshift/openshift-ansible/pull/9505 Backport for OCP 3.7.z: https://github.com/openshift/openshift-ansible/pull/9539 Workaround # echo "min-port=1024" > /etc/dnsmasq.d/lowport.conf # systemctl restart dnsmasq https://access.redhat.com/solutions/3558531 I opened bug 1620230 to track the dnsmasq configuration change for OCP 3.7.z so we can get that fix verified and shipped while we continue to determine other issues that could be causing the problems that we are tracking with this bug. All linked cases are closed and with resolutions that didn't require a new release. I'm going to close this bug and we can open new bugs as necessary. The needinfo request[s] on this closed bug have been removed as they have been unresolved for 365 days |