[Bug 1804487] Re: systemd-resolved has issues when the answer is over 512 bytes with EDNS disabled

[Brian Murray]

Hello Victor, or anyone else affected,

Accepted systemd into cosmic-proposed. The package will build now and be
available at
https://launchpad.net/ubuntu/+source/systemd/239-7ubuntu10.5 in a few
hours, and then in the -proposed repository.

Please help us by testing this new package.  See
https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how
to enable and use -proposed.  Your feedback will aid us getting this
update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug,
mentioning the version of the package you tested and change the tag from
verification-needed-cosmic to verification-done-cosmic. If it does not
fix the bug for you, please add a comment stating that, and change the
tag to verification-failed-cosmic. In either case, without details of
your testing we will not be able to proceed.

Further information regarding the verification process can be found at
https://wiki.ubuntu.com/QATeam/PerformingSRUVerification .  Thank you in
advance for helping!

N.B. The updated package will be released to -updates after the bug(s)
fixed by this package have been verified and the package has been in
-proposed for a minimum of 7 days.

** Changed in: systemd (Ubuntu Cosmic)
       Status: In Progress => Fix Committed

** Tags added: verification-needed verification-needed-cosmic

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to systemd in Ubuntu.
https://bugs.launchpad.net/bugs/1804487

Title:
  systemd-resolved has issues when the answer is over 512 bytes with
  EDNS disabled

Status in systemd:
  Fix Released
Status in systemd package in Ubuntu:
  Fix Committed
Status in systemd source package in Xenial:
  Invalid
Status in systemd source package in Bionic:
  In Progress
Status in systemd source package in Cosmic:
  Fix Committed
Status in systemd source package in Disco:
  Fix Committed
Status in systemd package in Debian:
  Fix Released

Bug description:
  [Impact]

  TCP stub is cutting down the payload to 512 bytes when EDNS is
  disabled. This makes non-EDNS clients (nslookup) receive a "shortened"
  answer even when UDP returns a truncated reply for a new TCP query.
  For instance,

  - If the client supports EDNS:

  $ dig +noall +answer testing.irongiantdesign.com @127.0.0.53 | wc -l
  30

  - If the client does not support EDNS:

  $ dig +noedns +noall +answer testing.irongiantdesign.com @127.0.0.53 | wc -l
  29

  In the second case, no-EDNS, TCP should provide the complete answer,
  but it's capped at UDP's size.

  [Test Case]

  Query systemd-resolved with a domain name that resolves to multiple
  (lots.. 30+) A records. A client with EDNS support (dig) will receive
  all of them, a client without support (nslookup or dig +noedns) will
  have a truncated list. Using the example above:

  EDNS: dig +noall +answer testing.irongiantdesign.com @127.0.0.53 | wc -l
  non-EDNS: dig +noedns +noall +answer testing.irongiantdesign.com @127.0.0.53 | wc -l

  [Regression potential]

  Minimal. This change only affects TCP requests, and the new size is
  already used in the code for other requests.

  [Other Info]

  Upstream bug: https://github.com/systemd/systemd/issues/10816
  Fixed upstream with commit: https://github.com/systemd/systemd/commit/e6eed9445956cfa496e1db933bfd3530db23bfce

  [Original Description]

  Querying a domain name that has >512 bytes in records (e.g. 30+ A
  records), the number of results depends on the DNS client used:

  - If the client supports EDNS:

  $ dig +noall +answer testing.irongiantdesign.com @127.0.0.53 | wc -l
  30

  - If the client does not support EDNS:

  $ dig +noedns +noall +answer testing.irongiantdesign.com @127.0.0.53 | wc -l
  29

  Normally a client that doesn't support EDNS would receive a truncated
  reply from the initial UDP connection (limited by the spec to 512
  bytes) and a second query would be established via TCP to receive the
  complete results. In this case, the number of results is the same
  regardless of the protocol used (29).

  Upstream bug: https://github.com/systemd/systemd/issues/10816

To manage notifications about this bug go to:
https://bugs.launchpad.net/systemd/+bug/1804487/+subscriptions