backport zero TTL system-resolved fix to 252 #336
Comments
|
@poettering Any chance in getting this backported to 252/253/254? That would be great. The reason I'm personally asking for this is that this also fixes systemd/systemd#19394 and systemd/systemd#22575 (comment). How so? As such, the ttl zero/non-zero merging bug is triggered and systemd-resolved returns errno 22 / |
keszybz
pushed a commit
that referenced
this issue
Mar 1, 2024
resolved rejected RRsets containing a RR with a zero TTL and a RR with a nonzero TTL. In practice—see the linked issues—, this case triggered when an AF_UNSPEC query to a CNAMEd domain returned a zero TTL for the CNAME on one address family and a nonzero TTL for the CNAME on the other address family. The zero-nonzero TTL check cites RFC 2181 § 5.2 in a comment. That section says DNS clients should reject any RRset containing differing TTLs, which the check only implements a very special case of. That the old behavior caused real-world false NXDOMAIN results is reason enough to completely ignore the RFC's recommendation. However, mDNS treats zero TTLs specially, so the error case needs to be kept for mDNS. Fixes systemd/systemd#22177 Fixes systemd/systemd#20617 Fixes systemd/systemd#19118 (cherry picked from commit 8ec951e) Related to #336
bluca
pushed a commit
to bluca/systemd-stable
that referenced
this issue
Apr 25, 2024
resolved rejected RRsets containing a RR with a zero TTL and a RR with a nonzero TTL. In practice—see the linked issues—, this case triggered when an AF_UNSPEC query to a CNAMEd domain returned a zero TTL for the CNAME on one address family and a nonzero TTL for the CNAME on the other address family. The zero-nonzero TTL check cites RFC 2181 § 5.2 in a comment. That section says DNS clients should reject any RRset containing differing TTLs, which the check only implements a very special case of. That the old behavior caused real-world false NXDOMAIN results is reason enough to completely ignore the RFC's recommendation. However, mDNS treats zero TTLs specially, so the error case needs to be kept for mDNS. Fixes systemd/systemd#22177 Fixes systemd/systemd#20617 Fixes systemd/systemd#19118 (cherry picked from commit 8ec951e) Related to systemd#336 (cherry picked from commit a3f3d47)
bluca
pushed a commit
that referenced
this issue
Apr 25, 2024
resolved rejected RRsets containing a RR with a zero TTL and a RR with a nonzero TTL. In practice—see the linked issues—, this case triggered when an AF_UNSPEC query to a CNAMEd domain returned a zero TTL for the CNAME on one address family and a nonzero TTL for the CNAME on the other address family. The zero-nonzero TTL check cites RFC 2181 § 5.2 in a comment. That section says DNS clients should reject any RRset containing differing TTLs, which the check only implements a very special case of. That the old behavior caused real-world false NXDOMAIN results is reason enough to completely ignore the RFC's recommendation. However, mDNS treats zero TTLs specially, so the error case needs to be kept for mDNS. Fixes systemd/systemd#22177 Fixes systemd/systemd#20617 Fixes systemd/systemd#19118 (cherry picked from commit 8ec951e) Related to #336 (cherry picked from commit a3f3d47)
bluca
pushed a commit
to bluca/systemd-stable
that referenced
this issue
Apr 25, 2024
resolved rejected RRsets containing a RR with a zero TTL and a RR with a nonzero TTL. In practice—see the linked issues—, this case triggered when an AF_UNSPEC query to a CNAMEd domain returned a zero TTL for the CNAME on one address family and a nonzero TTL for the CNAME on the other address family. The zero-nonzero TTL check cites RFC 2181 § 5.2 in a comment. That section says DNS clients should reject any RRset containing differing TTLs, which the check only implements a very special case of. That the old behavior caused real-world false NXDOMAIN results is reason enough to completely ignore the RFC's recommendation. However, mDNS treats zero TTLs specially, so the error case needs to be kept for mDNS. Fixes systemd/systemd#22177 Fixes systemd/systemd#20617 Fixes systemd/systemd#19118 (cherry picked from commit 8ec951e) Related to systemd#336 (cherry picked from commit a3f3d47) (cherry picked from commit 038effc)
bluca
pushed a commit
that referenced
this issue
Apr 26, 2024
resolved rejected RRsets containing a RR with a zero TTL and a RR with a nonzero TTL. In practice—see the linked issues—, this case triggered when an AF_UNSPEC query to a CNAMEd domain returned a zero TTL for the CNAME on one address family and a nonzero TTL for the CNAME on the other address family. The zero-nonzero TTL check cites RFC 2181 § 5.2 in a comment. That section says DNS clients should reject any RRset containing differing TTLs, which the check only implements a very special case of. That the old behavior caused real-world false NXDOMAIN results is reason enough to completely ignore the RFC's recommendation. However, mDNS treats zero TTLs specially, so the error case needs to be kept for mDNS. Fixes systemd/systemd#22177 Fixes systemd/systemd#20617 Fixes systemd/systemd#19118 (cherry picked from commit 8ec951e) Related to #336 (cherry picked from commit a3f3d47) (cherry picked from commit 038effc)
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Please consider backporting systemd/systemd#29307 to the 252 stable branch, so Debian stable can get the fix. Thank you.
The text was updated successfully, but these errors were encountered: