Package: dnsmasq
Version: 2.89-1
Severity: grave
Justification: renders package unusable
X-Debbugs-Cc: heptal...@gmx.de

Hello,

dnsmasq on bookworm fails to start after installation because the dns port 53 
is already is use by systemd-resolved.
After stopping systemd-resolved dnsmasq will start but refuses all dns queries 
with the Extended DNS Error Code 14 "Not Ready".
This error is reproducible on new installation.

Setting severity to grave because it affects clean installs. 

Regards,
Jens


Steps to reproduce to problem:

1. Create a new instance from the generic bookworm image: 
https://cdimage.debian.org/images/cloud/bookworm/daily/20230505-1371/debian-12-generic-amd64-daily-20230505-1371.qcow2
2. Update package cache and install dnsmasq: apt update && apt install -y 
dnsmasq
3. dnsmasq will fail to start:

May 05 13:57:17 bookworm systemd[1]: Starting dnsmasq.service - dnsmasq - A 
lightweight DHCP and caching DNS server...
May 05 13:57:17 bookworm dnsmasq[1078]: dnsmasq: failed to create listening 
socket for port 53: Address already in use
May 05 13:57:17 bookworm dnsmasq[1078]: failed to create listening socket for 
port 53: Address already in use
May 05 13:57:17 bookworm dnsmasq[1078]: FAILED to start up
May 05 13:57:17 bookworm systemd[1]: dnsmasq.service: Control process exited, 
code=exited, status=2/INVALIDARGUMENT
May 05 13:57:17 bookworm systemd[1]: dnsmasq.service: Failed with result 
'exit-code'.
May 05 13:57:17 bookworm systemd[1]: Failed to start dnsmasq.service - dnsmasq 
- A lightweight DHCP and caching DNS server.

4. This first problem can be solved by disabling systemd-resolved: systemctl 
disable --now systemd-resolved.service

5. Now dnsmasq can be started (systemctl start dnsmasq.service), but it logs an 
error:

May 05 13:58:51 bookworm systemd[1]: Starting dnsmasq.service - dnsmasq - A 
lightweight DHCP and caching DNS server...
May 05 13:58:51 bookworm dnsmasq[1184]: started, version 2.89 cachesize 150
May 05 13:58:51 bookworm dnsmasq[1184]: DNS service limited to local subnets
May 05 13:58:51 bookworm dnsmasq[1184]: compile time options: IPv6 GNU-getopt 
DBus no-UBus i18n IDN2 DHCP DHCPv6 no-Lua TFTP conntrack ipset nftset auth 
cryptohash DNSSEC loop-detect inotify dumpfile
May 05 13:58:51 bookworm dnsmasq[1184]: read /etc/hosts - 8 names
May 05 13:58:51 bookworm resolvconf[1193]: Dropped protocol specifier 
'.dnsmasq' from 'lo.dnsmasq'. Using 'lo' (ifindex=1).
May 05 13:58:51 bookworm resolvconf[1193]: Failed to set DNS configuration: 
Unit dbus-org.freedesktop.resolve1.service not found.
May 05 13:58:51 bookworm systemd[1]: Started dnsmasq.service - dnsmasq - A 
lightweight DHCP and caching DNS server.

6. Install dnsutils: apt install -y dnsutils

7. Try to query the local nameserver. It will refuse to respond:

$ dig @127.0.0.1 debian.org

; <<>> DiG 9.18.12-1-Debian <<>> @127.0.0.1 debian.org
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 14242
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; EDE: 14 (Not Ready)
;; QUESTION SECTION:
;debian.org.                    IN      A

;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1) (UDP)
;; WHEN: Fri May 05 14:00:51 UTC 2023
;; MSG SIZE  rcvd: 45


-- System Information:
Debian Release: 12.0
  APT prefers testing-security
  APT policy: (500, 'testing-security'), (500, 'testing')
Architecture: amd64 (x86_64)

Kernel: Linux 6.1.0-7-amd64 (SMP w/2 CPU threads; PREEMPT)
Locale: LANG=C.UTF-8, LC_CTYPE=C.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages dnsmasq depends on:
ii  dnsmasq-base [dnsmasq-base]  2.89-1
ii  init-system-helpers          1.65.2
ii  netbase                      6.4
ii  runit-helper                 2.15.2
ii  sysvinit-utils [lsb-base]    3.06-4

dnsmasq recommends no packages.

Versions of packages dnsmasq suggests:
ii  systemd-resolved [resolvconf]  252.6-1

-- no debconf information

Reply via email to