systemd-resolved’s 127.0.0.53 server does not follow CNAME records
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
Nextcloud |
Fix Released
|
Unknown
|
|||
systemd |
Fix Released
|
Unknown
|
|||
network-manager (Ubuntu) |
Fix Released
|
High
|
Barry Warsaw | ||
Xenial |
Invalid
|
Undecided
|
Unassigned | ||
Yakkety |
Invalid
|
Undecided
|
Unassigned | ||
systemd (Ubuntu) |
Fix Released
|
High
|
Steve Langasek | ||
Xenial |
Invalid
|
High
|
Unassigned | ||
Yakkety |
Fix Released
|
High
|
Dimitri John Ledkov |
Bug Description
[SRU Justification]
Ubuntu 16.10 server uses systemd-resolved by default, configured both as a DNS stub resolver on 127.0.0.53 and as an NSS module via libnss-resolved talking to the dbus service. The DNS stub resolver has a bug that causes it to fail to resolve CNAME records. This went unnoticed before release because by default the NSS module is used. But a chroot or container on the system that does not include libnss-resolved and is configured to use the stub resolver will experience DNS failures.
[Test case]
1. On a yakkety server system, create a xenial chroot with mk-sbuild (or equivalent).
2. Make sure that the host system has /etc/resolv.conf pointed at 127.0.0.53.
2. Enter the chroot with 'sudo schroot -c xenial-amd64' or such.
3. Install the iputils-ping package.
4. ping www.freedesktop.org
5. Confirm that the hostname does not resolve.
6. Install the systemd package from yakkety-proposed onto the host system.
7. ping www.freedesktop.org
8. Confirm that the hostname does now resolve.
[Regression potential]
With a 247-line patch to a key service, there is some risk of regression. Regression risk is mitigated because this patch is already present in zesty and upstream, where no regressions have been reported, and because it only touches the DNS stub resolver which is not the code path used by default on host systems.
$ systemd-resolve www.freedesktop.org
www.freedesktop
-- Information acquired via protocol DNS in 673.6ms.
-- Data is authenticated: no
$ ping www.freedesktop.org
ping: www.freedesktop
$ cat /etc/resolv.conf
# Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8)
# DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN
# 127.0.0.53 is the systemd-resolved stub resolver.
# run "systemd-resolve --status" to see details about the actual nameservers.
nameserver 127.0.0.53
$ dig +no{cmd,
;www.freedeskto
www.freedesktop
$ dig +no{cmd,
;www.freedeskto
www.freedesktop
annarchy.
I trust it needn’t be explained why this makes the internet almost completely useless in zesty.
Changed in systemd: | |
status: | Unknown → New |
tags: | added: resolved |
description: | updated |
tags: | added: zesty |
no longer affects: | glibc (Ubuntu) |
Changed in network-manager (Ubuntu): | |
status: | In Progress → Fix Committed |
Changed in nextcloud-snap: | |
importance: | Unknown → High |
description: | updated |
Changed in systemd (Ubuntu Xenial): | |
milestone: | ubuntu-16.04.3 → none |
Changed in nextcloud-snap: | |
importance: | High → Unknown |
status: | Unknown → Fix Released |
Changed in systemd: | |
status: | New → Fix Released |
Status changed to 'Confirmed' because the bug affects multiple users.