[Bug 1600000] Re: libnss-resolve treats two trailing dots on a domain name incorrectly

[Brian Murray]

Hello Adam, or anyone else affected,

Accepted systemd into xenial-proposed. The package will build now and be
available at https://launchpad.net/ubuntu/+source/systemd/229-4ubuntu20
in a few hours, and then in the -proposed repository.

Please help us by testing this new package.  See
https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how
to enable and use -proposed.Your feedback will aid us getting this
update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug,
mentioning the version of the package you tested and change the tag from
verification-needed-xenial to verification-done-xenial. If it does not
fix the bug for you, please add a comment stating that, and change the
tag to verification-failed-xenial. In either case, details of your
testing will help us make a better decision.

Further information regarding the verification process can be found at
https://wiki.ubuntu.com/QATeam/PerformingSRUVerification .  Thank you in
advance!

** Changed in: systemd (Ubuntu Xenial)
       Status: In Progress => Fix Committed

** Tags added: verification-needed verification-needed-xenial

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to systemd in Ubuntu.
https://bugs.launchpad.net/bugs/1600000

Title:
  libnss-resolve treats two trailing dots on a domain name incorrectly

Status in systemd:
  New
Status in systemd package in Ubuntu:
  Fix Released
Status in systemd source package in Xenial:
  Fix Committed

Bug description:
  [Impact]
  libnss-resolve is an optional component not used by default in xenial. However it treats doubledot incorrectly, meaning it gets resolved when it shouldn't.

  [Fix]
  Cherrypick upstream patch to resolve this issue.

  [Testcase]

  * Enable resolve nss module
  * attempt resolving www.gnu.org..
  * It should fail to resolve

  (base)adconrad at nosferatu:~$ getent ahostsv4 www.gnu.org..
  208.118.235.148 STREAM wildebeest.gnu.org
  208.118.235.148 DGRAM
  208.118.235.148 RAW
  (base)adconrad at nosferatu:~$ sudo sed -i -e 's/ resolve dns/ dns/' /etc/nsswitch.conf
  (base)adconrad at nosferatu:~$ getent ahostsv4 www.gnu.org..
  (base)adconrad at nosferatu:~$ sudo sed -i -e 's/ dns/ resolve dns/' /etc/nsswitch.conf
  (base)adconrad at nosferatu:~$ getent ahostsv4 www.gnu.org..
  208.118.235.148 STREAM wildebeest.gnu.org
  208.118.235.148 DGRAM
  208.118.235.148 RAW
  (base)adconrad at nosferatu:~$

  This is responsible for the new regression in glibc:

  ----------
  FAIL: posix/tst-getaddrinfo5
  original exit status 1
  resolving "localhost." worked, proceeding to test
  resolving "localhost.." failed, test passed
  resolving "www.gnu.org." worked, proceeding to test
  resolving "www.gnu.org.." worked, test failed
  ----------

  [Regression potential]
  Minimal, since this component is not used by default. However, systems that have this enabled exhibit standards non-compliant behavior. It is not expected for anybody to depend on this broken behavior.

To manage notifications about this bug go to:
https://bugs.launchpad.net/systemd/+bug/1600000/+subscriptions