[Bug 1714803] Re: Search list in resolv.conf breaks resolving for that domain

[Matthias Fratz]

As for ubuntu.com, that was only as an example to show a situations when
things break. I really just copied what the original submitter used -- I
should probably have used example.com instead though, that's less
confusing.

My concrete situation is that the server delivers only inf.uni-
konstanz.de because that's what matches the university's organizational
structure. (And having it changed it is not an option.) I put the other
two (disy.inf.uni-konstanz.de and uni-konstanz.de) in the search path
long ago because I regularly connect to hosts in those domains. Saves a
lot of typing errors, and AFAIK it's not an uncommon use case for the
search path. But this broke DNS resolution for disy.inf.uni-konstanz.de
and uni-konstanz.de (probably because they're not in any per-interface
search path) on upgrade to 17.04, and got me to this bug.

As far as I can tell now, the bug should only affect users on or
upgrading to zesty who have manually configured a search path using
resolvconf, and artful users who configure one in resolved.conf. That's
clearly a minority of users.

I certainly agree to the "only send queries to the right nameserver"
part. That makes sense, as does UseDomains and setting it to true by
default. What I find troubling is that it seems to just swallow the
query when there's no interface matching a search path entry. That
doesn't agree with the documentation of either Domains= or UseDomains=,
which both suggest that one can have search paths not associated with an
interface. But I guess that's a bug in the systemd-resolved and not in
Ubuntu, so I'll probably just report it upstream.

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to systemd in Ubuntu.
https://bugs.launchpad.net/bugs/1714803

Title:
  Search list in resolv.conf breaks resolving for that domain

Status in systemd package in Ubuntu:
  Incomplete

Bug description:
  Ubuntu 17.04
  systemd 232-21ubuntu5

  Adding a domain to the search list in /etc/resolv.conf breaks
  resolving for that domain. Not only does the search list not get used
  as expected, but host names in the domain cannot be resolved by
  systemd-resolved at all.

  I just ran into this after upgrading from ubuntu 16.04 to 17.04 which
  enabled systemd-resolved. I have for a long time used resolveconf to
  add a 'search my-domain'-line to my /etc/resolv.conf.

  
  Example of expected behaviour. With Googles DNS server (8.8.8.8) and ubuntu.com in the search list in /etc/resolv.conf. Both dig and systemd-resolve can resolve www.ubuntu.com and www:

      $ cat /etc/resolv.conf 
      nameserver 8.8.8.8
      search ubuntu.com
      $ dig +nostat +nocmd www.ubuntu.com
      ;; Got answer:
      ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 55037
      ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
      
      ;; OPT PSEUDOSECTION:
      ; EDNS: version: 0, flags:; udp: 512
      ;; QUESTION SECTION:
      ;www.ubuntu.com.			IN	A
      
      ;; ANSWER SECTION:
      www.ubuntu.com.		501	IN	A	91.189.89.115
      
      $ dig +search +nostat +nocmd www
      ;; Got answer:
      ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 25772
      ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
      
      ;; OPT PSEUDOSECTION:
      ; EDNS: version: 0, flags:; udp: 512
      ;; QUESTION SECTION:
      ;www.ubuntu.com.			IN	A
      
      ;; ANSWER SECTION:
      www.ubuntu.com.		382	IN	A	91.189.89.103
      
      $ systemd-resolve www.ubuntu.com
      www.ubuntu.com: 91.189.89.115
      
      -- Information acquired via protocol DNS in 2.7ms.
      -- Data is authenticated: no
      $ systemd-resolve www
      www: 91.189.90.59
           (www.ubuntu.com)
      
      -- Information acquired via protocol DNS in 3.8ms.
      -- Data is authenticated: no

  Ubuntu 17.04 default config, with the systemd-resolved name server in
  /etc/resolv.conf and no search list. www.ubuntu.com can still be
  resolved correctly:

      $ cat /etc/resolv.conf
      nameserver 127.0.0.53
      $ dig +nostat +nocmd www.ubuntu.com
      ;; Got answer:
      ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 64646
      ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
      
      ;; OPT PSEUDOSECTION:
      ; EDNS: version: 0, flags:; udp: 65494
      ;; QUESTION SECTION:
      ;www.ubuntu.com.			IN	A
      
      ;; ANSWER SECTION:
      www.ubuntu.com.		482	IN	A	91.189.89.110
      $ systemd-resolve www.ubuntu.com
      www.ubuntu.com: 91.189.90.58
      
      -- Information acquired via protocol DNS in 18.2ms.
      -- Data is authenticated: no

  Broken behaviour, using the systemd-resolved name server and specify
  ubuntu.com in search list. Resolving fails for www.ubuntu.com and www,
  both using dig (DNS) and using sytemd-resolve:

      $ cat /etc/resolv.conf
      nameserver 127.0.0.53
      search ubuntu.com
      $ dig +nostat +nocmd www.ubuntu.com
      ;; Got answer:
      ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 33334
      ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
      
      ;; OPT PSEUDOSECTION:
      ; EDNS: version: 0, flags:; udp: 65494
      ;; QUESTION SECTION:
      ;www.ubuntu.com.			IN	A
      
      $ dig +search +nostat +nocmd www
      ;; Got answer:
      ;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 50588
      ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
      
      ;; OPT PSEUDOSECTION:
      ; EDNS: version: 0, flags:; udp: 65494
      ;; QUESTION SECTION:
      ;www.ubuntu.com.			IN	A
      
      $ systemd-resolve www.ubuntu.com
      www.ubuntu.com: resolve call failed: No appropriate name servers or networks for name found
      $ systemd-resolve www
      www: resolve call failed: All attempts to contact name servers or networks failed

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1714803/+subscriptions