[Bug 1849658] [NEW] resolved fallback to TCP fails for truncated UDP replies

Dan Streetman ddstreet at canonical.com
Thu Oct 24 11:44:27 UTC 2019 

Public bug reported:

[impact]

for DNS UDP replies larger than 512 bytes, fallback to TCP is used.  For
example 'host toomany.ddstreet.org'.

Due to a bug in resolved in refcounting DNS stream types, the refcount
underflows for type 0 streams (which resolved uses to talk to upstream
nameservers), resulting in resolved being unable to fallback to TCP to
handle truncated UDP replies.

[test case]

ubuntu at sf247344-upstream:~$ dig +noanswer +noedns toomany.ddstreet.org
;; Truncated, retrying in TCP mode.

; <<>> DiG 9.11.3-1ubuntu1.9-Ubuntu <<>> +noanswer +noedns toomany.ddstreet.org
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 2683
;; flags: qr rd ra; QUERY: 1, ANSWER: 40, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;toomany.ddstreet.org.		IN	A

;; Query time: 0 msec
;; SERVER: 127.0.0.53#53(127.0.0.53)
;; WHEN: Thu Oct 24 11:40:29 UTC 2019
;; MSG SIZE  rcvd: 678

ubuntu at sf247344-upstream:~$ sudo resolvectl flush-caches
ubuntu at sf247344-upstream:~$ dig +noanswer +noedns toomany.ddstreet.org

; <<>> DiG 9.11.3-1ubuntu1.9-Ubuntu <<>> +noanswer +noedns toomany.ddstreet.org
;; global options: +cmd
;; connection timed out; no servers could be reached

[regression potential]

very low, as this only properly sets the stream type in the DnsStream
object; any regression would be a failure to be able to use TCP for DNS
requests or replies.

[other info]

https://github.com/systemd/systemd/pull/13838

The commit adding stream types is not present in x/b, so this is needed
only for disco and later.

** Affects: systemd (Ubuntu)
     Importance: Medium
     Assignee: Dan Streetman (ddstreet)
         Status: In Progress

** Affects: systemd (Ubuntu Disco)
     Importance: Medium
     Assignee: Dan Streetman (ddstreet)
         Status: In Progress

** Affects: systemd (Ubuntu Eoan)
     Importance: Medium
     Assignee: Dan Streetman (ddstreet)
         Status: In Progress

** Affects: systemd (Ubuntu Focal)
     Importance: Medium
     Assignee: Dan Streetman (ddstreet)
         Status: In Progress


** Tags: ddstreet disco eoan focal sts systemd

** Also affects: systemd (Ubuntu Focal)
   Importance: Undecided
       Status: New

** Also affects: systemd (Ubuntu Eoan)
   Importance: Undecided
       Status: New

** Description changed:

  [impact]
  
  for DNS UDP replies larger than 512 bytes, fallback to TCP is used.  For
  example 'host toomany.ddstreet.org'.
  
  Due to a bug in resolved in refcounting DNS stream types, the refcount
  underflows for type 0 streams (which resolved uses to talk to upstream
  nameservers), resulting in resolved being unable to fallback to TCP to
  handle truncated UDP replies.
  
  [test case]
  
  ubuntu at sf247344-upstream:~$ dig +noanswer +noedns toomany.ddstreet.org
  ;; Truncated, retrying in TCP mode.
  
  ; <<>> DiG 9.11.3-1ubuntu1.9-Ubuntu <<>> +noanswer +noedns toomany.ddstreet.org
  ;; global options: +cmd
  ;; Got answer:
  ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 2683
  ;; flags: qr rd ra; QUERY: 1, ANSWER: 40, AUTHORITY: 0, ADDITIONAL: 0
  
  ;; QUESTION SECTION:
  ;toomany.ddstreet.org.		IN	A
  
  ;; Query time: 0 msec
  ;; SERVER: 127.0.0.53#53(127.0.0.53)
  ;; WHEN: Thu Oct 24 11:40:29 UTC 2019
  ;; MSG SIZE  rcvd: 678
  
- ubuntu at sf247344-upstream:~$ sudo resolvectl flush-caches 
+ ubuntu at sf247344-upstream:~$ sudo resolvectl flush-caches
  ubuntu at sf247344-upstream:~$ dig +noanswer +noedns toomany.ddstreet.org
  
  ; <<>> DiG 9.11.3-1ubuntu1.9-Ubuntu <<>> +noanswer +noedns toomany.ddstreet.org
  ;; global options: +cmd
  ;; connection timed out; no servers could be reached
  
  [regression potential]
  
  very low, as this only properly sets the stream type in the DnsStream
  object; any regression would be a failure to be able to use TCP for DNS
  requests or replies.
  
  [other info]
  
  https://github.com/systemd/systemd/pull/13838
+ 
+ The commit adding stream types is not present in x/b, so this is needed
+ only for disco and later.

** Also affects: systemd (Ubuntu Disco)
   Importance: Undecided
       Status: New

** Changed in: systemd (Ubuntu Disco)
   Importance: Undecided => Medium

** Changed in: systemd (Ubuntu Eoan)
   Importance: Undecided => Medium

** Changed in: systemd (Ubuntu Focal)
   Importance: Undecided => Medium

** Changed in: systemd (Ubuntu Disco)
     Assignee: (unassigned) => Dan Streetman (ddstreet)

** Changed in: systemd (Ubuntu Eoan)
     Assignee: (unassigned) => Dan Streetman (ddstreet)

** Changed in: systemd (Ubuntu Eoan)
       Status: New => In Progress

** Changed in: systemd (Ubuntu Disco)
       Status: New => In Progress

** Changed in: systemd (Ubuntu Focal)
     Assignee: (unassigned) => Dan Streetman (ddstreet)

** Changed in: systemd (Ubuntu Focal)
       Status: New => In Progress

** Tags added: ddstreet disco eoan focal sts systemd

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to systemd in Ubuntu.
https://bugs.launchpad.net/bugs/1849658

Title:
  resolved fallback to TCP fails for truncated UDP replies

Status in systemd package in Ubuntu:
  In Progress
Status in systemd source package in Disco:
  In Progress
Status in systemd source package in Eoan:
  In Progress
Status in systemd source package in Focal:
  In Progress

Bug description:
  [impact]

  for DNS UDP replies larger than 512 bytes, fallback to TCP is used.
  For example 'host toomany.ddstreet.org'.

  Due to a bug in resolved in refcounting DNS stream types, the refcount
  underflows for type 0 streams (which resolved uses to talk to upstream
  nameservers), resulting in resolved being unable to fallback to TCP to
  handle truncated UDP replies.

  [test case]

  ubuntu at sf247344-upstream:~$ dig +noanswer +noedns toomany.ddstreet.org
  ;; Truncated, retrying in TCP mode.

  ; <<>> DiG 9.11.3-1ubuntu1.9-Ubuntu <<>> +noanswer +noedns toomany.ddstreet.org
  ;; global options: +cmd
  ;; Got answer:
  ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 2683
  ;; flags: qr rd ra; QUERY: 1, ANSWER: 40, AUTHORITY: 0, ADDITIONAL: 0

  ;; QUESTION SECTION:
  ;toomany.ddstreet.org.		IN	A

  ;; Query time: 0 msec
  ;; SERVER: 127.0.0.53#53(127.0.0.53)
  ;; WHEN: Thu Oct 24 11:40:29 UTC 2019
  ;; MSG SIZE  rcvd: 678

  ubuntu at sf247344-upstream:~$ sudo resolvectl flush-caches
  ubuntu at sf247344-upstream:~$ dig +noanswer +noedns toomany.ddstreet.org

  ; <<>> DiG 9.11.3-1ubuntu1.9-Ubuntu <<>> +noanswer +noedns toomany.ddstreet.org
  ;; global options: +cmd
  ;; connection timed out; no servers could be reached

  [regression potential]

  very low, as this only properly sets the stream type in the DnsStream
  object; any regression would be a failure to be able to use TCP for
  DNS requests or replies.

  [other info]

  https://github.com/systemd/systemd/pull/13838

  The commit adding stream types is not present in x/b, so this is
  needed only for disco and later.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1849658/+subscriptions

More information about the foundations-bugs mailing list