From 3590316121ac48b16e6a61d2022fd2a90d20ed57 Mon Sep 17 00:00:00 2001 From: Hans Dedecker Date: Wed, 6 Dec 2017 14:22:59 +0100 Subject: [PATCH] dnsmasq: backport infinite dns retries fix If all configured dns servers return refused in response to a query in strict mode; dnsmasq will end up in an infinite loop retransmitting the dns query resulting into high CPU load. Problem is fixed by checking for the end of a dns server list iteration in strict mode. Signed-off-by: Hans Dedecker --- package/network/services/dnsmasq/Makefile | 2 +- ...nfinite-retries-in-strict-order-mode.patch | 45 +++++++++++++++++++ 2 files changed, 46 insertions(+), 1 deletion(-) create mode 100644 package/network/services/dnsmasq/patches/250-Fix-infinite-retries-in-strict-order-mode.patch diff --git a/package/network/services/dnsmasq/Makefile b/package/network/services/dnsmasq/Makefile index 5888e1ef3f..fe6a6d2fed 100644 --- a/package/network/services/dnsmasq/Makefile +++ b/package/network/services/dnsmasq/Makefile @@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk PKG_NAME:=dnsmasq PKG_VERSION:=2.78 -PKG_RELEASE:=3 +PKG_RELEASE:=4 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz PKG_SOURCE_URL:=http://thekelleys.org.uk/dnsmasq/ diff --git a/package/network/services/dnsmasq/patches/250-Fix-infinite-retries-in-strict-order-mode.patch b/package/network/services/dnsmasq/patches/250-Fix-infinite-retries-in-strict-order-mode.patch new file mode 100644 index 0000000000..faff680e03 --- /dev/null +++ b/package/network/services/dnsmasq/patches/250-Fix-infinite-retries-in-strict-order-mode.patch @@ -0,0 +1,45 @@ +From ef3d137a646fa8309e1ff5184e3e145eef40cc4d Mon Sep 17 00:00:00 2001 +From: Simon Kelley +Date: Tue, 5 Dec 2017 22:37:29 +0000 +Subject: [PATCH] Fix infinite retries in strict-order mode. + + If all configured dns servers return refused in + response to a query; dnsmasq will end up in an infinite loop + retransmitting the dns query resulting into high CPU load. + Problem is caused by the dns refuse retransmission logic which does + not check for the end of a dns server list iteration in strict mode. + Having one configured dns server returning a refused reply easily + triggers this problem in strict order mode. This was introduced in + 9396752c115b3ab733fa476b30da73237e12e7ba + + Thanks to Hans Dedecker for spotting this + and the initial patch. +--- + src/forward.c | 14 ++++++++++++-- + 1 file changed, 12 insertions(+), 2 deletions(-) + +--- a/src/forward.c ++++ b/src/forward.c +@@ -797,10 +797,20 @@ void reply_query(int fd, int family, tim + unsigned char *pheader; + size_t plen; + int is_sign; +- ++ ++ /* In strict order mode, there must be a server later in the chain ++ left to send to, otherwise without the forwardall mechanism, ++ code further on will cycle around the list forwever if they ++ all return REFUSED. Note that server is always non-NULL before ++ this executes. */ ++ if (option_bool(OPT_ORDER)) ++ for (server = forward->sentto->next; server; server = server->next) ++ if (!(server->flags & (SERV_LITERAL_ADDRESS | SERV_HAS_DOMAIN | SERV_FOR_NODOTS | SERV_NO_ADDR | SERV_LOOP))) ++ break; ++ + /* recreate query from reply */ + pheader = find_pseudoheader(header, (size_t)n, &plen, NULL, &is_sign, NULL); +- if (!is_sign) ++ if (!is_sign && server) + { + header->ancount = htons(0); + header->nscount = htons(0);