Skynet Latest update break dnsmasq

[BOFH]

Hi Guys,

Since the latest Skynet update, dnsmasq is not able to start.

Error:

Dec 29 13:37:55 Net-FE74DEB-C rc_service: service 61051:notify_rc restart_dnsmasq
Dec 29 13:37:55 Net-FE74DEB-C custom_script: Running /jffs/scripts/service-event (args: restart dnsmasq)
Dec 29 13:37:55 Net-FE74DEB-C custom_config: Appending content of /jffs/configs/dnsmasq.conf.add.
Dec 29 13:37:55 Net-FE74DEB-C custom_script: Running /jffs/scripts/dnsmasq.postconf (args: /etc/dnsmasq.conf)
Dec 29 13:37:57 Net-FE74DEB-C Diversion: started second Dnsmasq instance for alternate blocking list
Dec 29 13:37:57 Net-FE74DEB-C Diversion: restarted Dnsmasq to apply settings
Dec 29 13:37:57 Net-FE74DEB-C dnsmasq[61528]: bad option at line 70 of /etc/dnsmasq.conf
Dec 29 13:37:57 Net-FE74DEB-C dnsmasq[61528]: FAILED to start up
Dec 29 13:37:57 Net-FE74DEB-C custom_script: Running /jffs/scripts/service-event-end (args: restart dnsmasq)
Dec 29 13:37:57 Net-FE74DEB-C uiDivStats: dnsmasq has restarted, restarting taildns
Dec 29 13:38:00 Net-FE74DEB-C admin: Started taildns from .

The DHCP is no more working as expected. New client can't connect to WIFI cause of dhcp

admin@Net:/tmp/home/root#  grep -n ipset /etc/dnsmasq.conf
69:ipset=/1drv.ms/aax-eu.amazon-adsystem.com/aax-us-east.amazon-adsystem.com/acr0.samsungcloudsolution.com/app-measurement.com/asuswrt-merlin.net/asuswrt.lostrealm.ca/bin.entware.net/cdn.staticneo.com/clarium.global.ssl.fastly.net/codeload.github.com/coinbase.com/daisy.ubuntu.com/dbl.oisd.nl/diversion.ch/events-service.coinbase.com/fls-na.amazon-adsystem.com/fwupdate.asuswrt-merlin.net/hostfiles.frogeye.fr/hosts.oisd.nl/hosts.ubuntu101.co.za/ib.adnxs.com/images-na.ssl-images-amazon.com/ir-na.amazon-adsystem.com/ir-uk.amazon-adsystem.com/localhost.localdomain/maurerr.github.io/noticefile.samsungcloudsolution.com/ns11.whois.co.kr/onclkds.com/onedrive.live.com/pagead2.googlesyndication.com/pgl.yoyo.org/pkg.entware.net/raw.githubusercontent.com/servedbyadbutler.com/smallnetbuilder.com/snbforums.com/someonewhocares.org/sourceforge.net/whoami.akamai.net/winhelp2002.mvps.org/wms-eu.amazon-adsystem.com/wms-na.amazon-adsystem.com/wms-na.assoc-amazon.com/ws-eu.amazon-adsystem.com/ws-na.amazon-adsystem.com/z-na.amazon-adsystem.com/iplists.firehol.org/sigs.interserver.net/Skynet-WhitelistDomains # Skynet
70:ipset=/threatview.io/ipdeny.com/ipapi.co/api.db-ip.com/api.bgpview.io/speedguide.net/otx.alienvault.com/github.com/astrill.com/strongpath.net/nwsrv-ns1.asus.com/ntp.metas.ch/time.nist.gov/Skynet-WhitelistDomains # Skynet

Any fix ?

 

[BOFH]

Hi Guys,

Since the latest Skynet update, dnsmasq is not able to start.

Error:

Dec 29 13:37:55 Net-FE74DEB-C rc_service: service 61051:notify_rc restart_dnsmasq
Dec 29 13:37:55 Net-FE74DEB-C custom_script: Running /jffs/scripts/service-event (args: restart dnsmasq)
Dec 29 13:37:55 Net-FE74DEB-C custom_config: Appending content of /jffs/configs/dnsmasq.conf.add.
Dec 29 13:37:55 Net-FE74DEB-C custom_script: Running /jffs/scripts/dnsmasq.postconf (args: /etc/dnsmasq.conf)
Dec 29 13:37:57 Net-FE74DEB-C Diversion: started second Dnsmasq instance for alternate blocking list
Dec 29 13:37:57 Net-FE74DEB-C Diversion: restarted Dnsmasq to apply settings
Dec 29 13:37:57 Net-FE74DEB-C dnsmasq[61528]: bad option at line 70 of /etc/dnsmasq.conf
Dec 29 13:37:57 Net-FE74DEB-C dnsmasq[61528]: FAILED to start up
Dec 29 13:37:57 Net-FE74DEB-C custom_script: Running /jffs/scripts/service-event-end (args: restart dnsmasq)
Dec 29 13:37:57 Net-FE74DEB-C uiDivStats: dnsmasq has restarted, restarting taildns
Dec 29 13:38:00 Net-FE74DEB-C admin: Started taildns from .

The DHCP is no more working as expected. New client can't connect to WIFI cause of dhcp

admin@Net:/tmp/home/root#  grep -n ipset /etc/dnsmasq.conf
69:ipset=/1drv.ms/aax-eu.amazon-adsystem.com/aax-us-east.amazon-adsystem.com/acr0.samsungcloudsolution.com/app-measurement.com/asuswrt-merlin.net/asuswrt.lostrealm.ca/bin.entware.net/cdn.staticneo.com/clarium.global.ssl.fastly.net/codeload.github.com/coinbase.com/daisy.ubuntu.com/dbl.oisd.nl/diversion.ch/events-service.coinbase.com/fls-na.amazon-adsystem.com/fwupdate.asuswrt-merlin.net/hostfiles.frogeye.fr/hosts.oisd.nl/hosts.ubuntu101.co.za/ib.adnxs.com/images-na.ssl-images-amazon.com/ir-na.amazon-adsystem.com/ir-uk.amazon-adsystem.com/localhost.localdomain/maurerr.github.io/noticefile.samsungcloudsolution.com/ns11.whois.co.kr/onclkds.com/onedrive.live.com/pagead2.googlesyndication.com/pgl.yoyo.org/pkg.entware.net/raw.githubusercontent.com/servedbyadbutler.com/smallnetbuilder.com/snbforums.com/someonewhocares.org/sourceforge.net/whoami.akamai.net/winhelp2002.mvps.org/wms-eu.amazon-adsystem.com/wms-na.amazon-adsystem.com/wms-na.assoc-amazon.com/ws-eu.amazon-adsystem.com/ws-na.amazon-adsystem.com/z-na.amazon-adsystem.com/iplists.firehol.org/sigs.interserver.net/Skynet-WhitelistDomains # Skynet
70:ipset=/threatview.io/ipdeny.com/ipapi.co/api.db-ip.com/api.bgpview.io/speedguide.net/otx.alienvault.com/github.com/astrill.com/strongpath.net/nwsrv-ns1.asus.com/ntp.metas.ch/time.nist.gov/Skynet-WhitelistDomains # Skynet

Any fix ?

Removing the 2 lines starting with ipset= and restarting dnsmasq manually seems to solve the error issue and let wifi clients connect back.


After checking the backup, it seems that the file "/jffs/configs/dnsmasq.conf.add" changed from an empty file to a file containing the "ipset" lines

 

[dave14305]

This happened before. As a temporary workaround, look for the line linked below and change the xargs -n 50 to xargs -n 25 or 20 or 15, etc. until it works without a failure.

https://github.com/Adamm00/IPSet_ASUS/blob/55cc2356a3fa405186095a9b5146ff2745b696a2/firewall.sh#L916

 

[BOFH]

Thanks Dave, changing the max-args to 20 seems to fix the issue for me.

 

[John Fitzgerald]

@Adamm : Is this going to get an "Official Fix"?

 

[dave14305]

It looks like the maximum length of a dnsmasq option line can be 1025 characters (MAXDNAME in the dnsmasq option.c source).

 

[dave14305]

Is this going to get an "Official Fix"?

Report an issue here: https://github.com/Adamm00/IPSet_ASUS/issues

Or ping @Adamm and wait for him to wake up down under.

 

[Adamm]

Sorry. Tested the method with a 1000 domain list and it worked fine so assumed it was okay… reduced the line size to 20 entries.

 

[Sonyrolfy]

Thanks for super Quick fix. Everything is working again after click update nr 10

 

[John Fitzgerald]

Sorry. Tested the method with a 1000 domain list and it worked fine so assumed it was okay… reduced the line size to 20 entries.

Thank you!

 

[SomeWhereOverTheRainBow]

Sorry. Tested the method with a 1000 domain list and it worked fine so assumed it was okay… reduced the line size to 20 entries.

working that trusty @Adamm magic!

 

[Mister2088]

Hi - before I reinstall skynet, can someone confirm that 7.3.4 works?
Should I now expect ipset whitelist entries in dnsmasq.conf and dnsmasq.conf_add as I never saw any with 7.2.8 (sorry for the dumb question) ?
Finally, compared to 7.2.8, I am curious what this fix was meant to improve? (why fix if aint broke?)

 

[SomeWhereOverTheRainBow]

Hi - before I reinstall skynet, can someone confirm that 7.3.4 works?
Should I now expect ipset whitelist entries in dnsmasq.conf and dnsmasq.conf_add as I never saw any with 7.2.8 (sorry for the dumb question) ?
Finally, compared to 7.2.8, I am curious what this fix was meant to improve? (why fix if aint broke?)

Or, you could try it out and let us know. I am sure it would help out another user who has your same questions.

 

[Mister2088]

Or, you could try it out and let us know. I am sure it would help out another user who has your same questions.

I have reinstalled Skynet v. 7.3.4. It is working well and dnsmasq started fine.
It did add the following line to /etc/dsnmasq.conf via dnsmasq.conf.add.
ipset=/ipdeny.com/ipapi.co/api.db-ip.com/api.bgpview.io/speedguide.net/otx.alienvault.com/github.com/raw.githubusercontent.com/iplists.firehol.org/astrill.com/strongpath.net/snbforums.com/t

I still am not sure what this does. Perhaps @Adamm could explain to all of us one day !

 

[SomeWhereOverTheRainBow]

I have reinstalled Skynet v. 7.3.4. It is working well and dnsmasq started fine.
It did add the following line to /etc/dsnmasq.conf via dnsmasq.conf.add.
ipset=/ipdeny.com/ipapi.co/api.db-ip.com/api.bgpview.io/speedguide.net/otx.alienvault.com/github.com/raw.githubusercontent.com/iplists.firehol.org/astrill.com/strongpath.net/snbforums.com/t

I still am not sure what this does. Perhaps @Adamm could explain to all of us one day !

An educated observation would be that some of those are the domains used in the downloading of skynets filters. While naturally skynet has already allowlisted the ip addresses of those domains, by adding an ipset into dnsmasq @Adamm has ensured that it is also protected from being blocked via dns as well. This is only just a guess. I may be absolutely wrong.

 

[dave14305]

ipset=/ipdeny.com/ipapi.co/api.db-ip.com/api.bgpview.io/speedguide.net/otx.alienvault.com/github.com/raw.githubusercontent.com/iplists.firehol.org/astrill.com/strongpath.net/snbforums.com/t

This line isn’t valid as you posted it. Did you truncate it, or did your terminal emulator wrap it oddly?

 

[SomeWhereOverTheRainBow]

This line isn’t valid as you posted it. Did you truncate it, or did your terminal emulator wrap it oddly?

To me it looks like it is just a copy of parts of the line that were terminally visible. However, I was wondering the same question as well.

 

[Adamm]

I have reinstalled Skynet v. 7.3.4. It is working well and dnsmasq started fine.
It did add the following line to /etc/dsnmasq.conf via dnsmasq.conf.add.
ipset=/ipdeny.com/ipapi.co/api.db-ip.com/api.bgpview.io/speedguide.net/otx.alienvault.com/github.com/raw.githubusercontent.com/iplists.firehol.org/astrill.com/strongpath.net/snbforums.com/t

I still am not sure what this does. Perhaps @Adamm could explain to all of us one day !

This change has actually been present in a testing branch for 11 months. Essentially it is a more efficient domain whitelisting method that in theory should keep its-self updated and prevent false positives.

As with any large userbase there are edge cases with updates, unfortunately you experienced one of them.

 

[Mister2088]

This change has actually been present in a testing branch for 11 months. Essentially it is a more efficient domain whitelisting method that in theory should keep its-self updated and prevent false positives.

As with any large userbase there are edge cases with updates, unfortunately you experienced one of them.

Thanks for the explanation. Cheers!

 

[Mister2088]

To me it looks like it is just a copy of parts of the line that were terminally visible. However, I was wondering the same question as well.

You are correct. I copy pasted and realize I did not get everything.