Skip to content

dnsmasq: update to use alpine dnsmasq#5948

Merged
eriknordmark merged 4 commits into
lf-edge:masterfrom
christoph-zededa:upgrade_dnsmasq
May 21, 2026
Merged

dnsmasq: update to use alpine dnsmasq#5948
eriknordmark merged 4 commits into
lf-edge:masterfrom
christoph-zededa:upgrade_dnsmasq

Conversation

@christoph-zededa
Copy link
Copy Markdown
Contributor

@christoph-zededa christoph-zededa commented May 12, 2026 •
edited
Loading

Description

I just saw https://www.heise.de/en/news/Pi-hole-update-closes-dnsmasq-security-vulnerabilities-11291212.html - might be good to update dnsmasq ...

version 2.92rel2
2.92 point release incorporating fixes for
CVE-2026-2291
CVE-2026-4890
CVE-2026-4891
CVE-2026-4892
CVE-2026-4893
CVE-2026-5172
(https://thekelleys.org.uk/dnsmasq/CHANGELOG )

How to test and validate this PR

Check that dnsmasq in version 2.92rel2 is running on the system

Changelog notes

Upgrade dnsmasq to include security fixes

PR Backports

For all current LTS branches, please state explicitly if this PR should be
backported or not. This section is used by our scripts to track the backports,
so, please, do not omit it.

Here is the list of current LTS branches (it should be always up to date):

  • 16.0-stable: yes
  • 14.5-stable: yes
  • 13.4-stable: yes

Also, to the PRs that should be backported into any stable branch, please
add a label stable.

Checklist

  • I've provided a proper description
  • I've added the proper documentation
  • I've tested my PR on amd64 device
  • I've tested my PR on arm64 device
  • I've written the test verification instructions
  • I've set the proper labels to this PR

And the last but not least:

  • I've checked the boxes above, or I've provided a good reason why I didn't
    check them.

Please, check the boxes above after submitting the PR in interactive mode.

@github-actions github-actions Bot requested a review from eriknordmark May 12, 2026 14:31
@christoph-zededa christoph-zededa added bug Something isn't working stable Should be backported to stable release(s) labels May 12, 2026
@christoph-zededa
Copy link
Copy Markdown
Contributor Author

christoph-zededa commented May 12, 2026 

Warning: Failed to download action 'https://codeload.github.com/github/codeql-action/tar.gz/c10b8064de6f491fea524254123dbe5e09572f13'. Error: Response status code does not indicate success: 429 (Too Many Requests). 2C41:111B6C:56A840:62D238:6A0339BD
Warning: Back off 24.724 seconds before retry.

:-(

@christoph-zededa
Copy link
Copy Markdown
Contributor Author

christoph-zededa commented May 12, 2026

/rerun red

@codecov
Copy link
Copy Markdown

codecov Bot commented May 12, 2026 •
edited
Loading

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 21.07%. Comparing base (241bcc1) to head (6b12e91).
⚠️ Report is 7 commits behind head on master.

Additional details and impacted files 
@@            Coverage Diff             @@
##           master    #5948      +/-   ##
==========================================
+ Coverage   20.65%   21.07%   +0.41%     
==========================================
  Files         489      499      +10     
  Lines       90373    92071    +1698     
==========================================
+ Hits        18665    19401     +736     
- Misses      70130    70913     +783     
- Partials     1578     1757     +179

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

eriknordmark
eriknordmark approved these changes May 12, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@eriknordmark eriknordmark left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Run tests

rene
rene reviewed May 13, 2026
View reviewed changes
Comment thread pkg/dnsmasq/dnsmasq-2.92rel2.tar.xz Outdated
@github-actions github-actions Bot requested a review from eriknordmark May 13, 2026 10:36
@christoph-zededa christoph-zededa force-pushed the upgrade_dnsmasq branch 2 times, most recently from 259d7ff to 1efbe64 Compare May 13, 2026 10:41
@christoph-zededa christoph-zededa marked this pull request as ready for review May 13, 2026 10:53
@rene
Copy link
Copy Markdown
Contributor

rene commented May 13, 2026

LGTM

@rene
Copy link
Copy Markdown
Contributor

rene commented May 13, 2026

@christoph-zededa , please, rebase on top of master....

@christoph-zededa
Copy link
Copy Markdown
Contributor Author

christoph-zededa commented May 13, 2026

@christoph-zededa , please, rebase on top of master....

done, but it does not help with yetus (https://github.com/lf-edge/eve/actions/runs/25807155223/job/75813016215?pr=5948 )

I think it struggles when removing a file.

@rene
Copy link
Copy Markdown
Contributor

rene commented May 13, 2026

The original link doesn't seems to be very reliable (apparently it's a small server), it has failed to download on some runs, do we have any other official mirror to download from? In worst case, let's bring the binary back... sorry....

@christoph-zededa
Copy link
Copy Markdown
Contributor Author

christoph-zededa commented May 13, 2026

The original link doesn't seems to be very reliable (apparently it's a small server), it has failed to download on some runs, do we have any other official mirror to download from? In worst case, let's bring the binary back... sorry....

Unfortunately I did not find a mirror, even the github mirror is behind (https://github.com/imp/dnsmasq/commits/master/ )

It's okay.

@eriknordmark
Copy link
Copy Markdown
Contributor

eriknordmark commented May 13, 2026

The original link doesn't seems to be very reliable (apparently it's a small server), it has failed to download on some runs, do we have any other official mirror to download from? In worst case, let's bring the binary back... sorry....

Would we get these patches if we just grab dnsmasq from Alpine 3.22?
The unique EVE-OS patches (around shorter or longer than /64 IPv6 prefixes) is not something we've needed for 4+ years - it was only needed for the LISP overlay network.

@christoph-zededa
Copy link
Copy Markdown
Contributor Author

christoph-zededa commented May 15, 2026

The original link doesn't seems to be very reliable (apparently it's a small server), it has failed to download on some runs, do we have any other official mirror to download from? In worst case, let's bring the binary back... sorry....

Would we get these patches if we just grab dnsmasq from Alpine 3.22? The unique EVE-OS patches (around shorter or longer than /64 IPv6 prefixes) is not something we've needed for 4+ years - it was only needed for the LISP overlay network.

I see for all the CVEs mentioned in this PR a patch in https://gitlab.alpinelinux.org/alpine/aports/-/tree/3.22-stable/main/dnsmasq?__goaway_challenge=cookie&__goaway_id=8c0acd18336881080decce87aa5ab5f9&__goaway_referer=https%3A%2F%2Fpkgs.alpinelinux.org%2F

I am checking if we can just get rid of pkg/dnsmasq then.

@christoph-zededa
Copy link
Copy Markdown
Contributor Author

christoph-zededa commented May 18, 2026

Now it is using the package from alpine.
Two things I want to mention:

  1. Kept 1bf1104 so that I can cherry-pick it for the backports
  2. I am allowing to overwrite packages in build-cache.sh: 1bf1104

@eriknordmark
Copy link
Copy Markdown
Contributor

eriknordmark commented May 18, 2026

Are the files where the SPDX fails check things added/modified bt this PR, or are they copied from somehere else?

@christoph-zededa
Copy link
Copy Markdown
Contributor Author

christoph-zededa commented May 18, 2026

Are the files where the SPDX fails check things added/modified bt this PR, or are they copied from somehere else?

they have been moved within the repository; anyways I am fixing those ...

@christoph-zededa christoph-zededa force-pushed the upgrade_dnsmasq branch 2 times, most recently from 5f0ddcb to 3c28d31 Compare May 18, 2026 11:47
@christoph-zededa
Copy link
Copy Markdown
Contributor Author

christoph-zededa commented May 18, 2026

/rerun red

1 similar comment
@christoph-zededa
Copy link
Copy Markdown
Contributor Author

christoph-zededa commented May 19, 2026

/rerun red

@christoph-zededa christoph-zededa mentioned this pull request May 19, 2026
Merged
@eriknordmark
Copy link
Copy Markdown
Contributor

eriknordmark commented May 20, 2026

I've tested this manually on two devices in the lab and it looks fine.

eriknordmark
eriknordmark approved these changes May 20, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@eriknordmark eriknordmark left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@eriknordmark eriknordmark mentioned this pull request May 20, 2026
Merged
3 tasks
@christoph-zededa
dnsmasq: update to 2.92rel2
75bf270 
version 2.92rel2
        2.92 point release incorporating fixes for
	CVE-2026-2291
	CVE-2026-4890
	CVE-2026-4891
	CVE-2026-4892
	CVE-2026-4893
	CVE-2026-5172
(https://thekelleys.org.uk/dnsmasq/CHANGELOG )

Signed-off-by: Christoph Ostarek <christoph@zededa.com>
@github-actions github-actions Bot requested a review from eriknordmark May 20, 2026 22:36
@eriknordmark
Copy link
Copy Markdown
Contributor

eriknordmark commented May 21, 2026

@christoph-zededa a suggestion for the build failures:
Proposed fix unchanged: delete pkg/pillar/Dockerfile lines 213 and 220 of the
PR head. No other edits required.

christoph-zededa and others added 3 commits May 21, 2026 09:27
@christoph-zededa @claude
dnsmasq: replace custom eve-dnsmasq image with Alpine package
bcb9197 
Remove the dedicated eve-dnsmasq container image (Dockerfile, source tarball,
patches, and tests) and use the dnsmasq package from Alpine instead.
The binary stays at its default Alpine location /usr/sbin/dnsmasq.
Pass -u/-g nobody to drop privileges to not use the patched user/group
from APKBUILD.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Christoph Ostarek <christoph@zededa.com>
@christoph-zededa
pkg/alpine: overwrite packages
0183802 
in order to get the newest package with fixes, etc.

Signed-off-by: Christoph Ostarek <christoph@zededa.com>
@christoph-zededa
pkg/alpine: base on eve-alpine
6b12e91 
to trigger re-download of the newest packages from alpine

and bump package hashes

Signed-off-by: Christoph Ostarek <christoph@zededa.com>
@eriknordmark eriknordmark changed the title dnsmasq: update to 2.92rel2 dnsmasq: update to use alpine dnsmasq May 21, 2026
@eriknordmark eriknordmark merged commit 8fa79c1 into lf-edge:master May 21, 2026
36 of 37 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@rucoder rucoder Awaiting requested review from rucoder rucoder is a code owner

@shjala shjala Awaiting requested review from shjala shjala is a code owner

@milan-zededa milan-zededa Awaiting requested review from milan-zededa milan-zededa is a code owner

@zedi-pramodh zedi-pramodh Awaiting requested review from zedi-pramodh zedi-pramodh is a code owner

@andrewd-zededa andrewd-zededa Awaiting requested review from andrewd-zededa

@europaul europaul Awaiting requested review from europaul

@jsfakian jsfakian Awaiting requested review from jsfakian

@naiming-zededa naiming-zededa Awaiting requested review from naiming-zededa

@OhmSpectator OhmSpectator Awaiting requested review from OhmSpectator

@rene rene Awaiting requested review from rene rene is a code owner

@eriknordmark eriknordmark Awaiting requested review from eriknordmark eriknordmark is a code owner

Assignees

No one assigned

Labels

bug Something isn't working stable Should be backported to stable release(s)

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@christoph-zededa @rene @eriknordmark