Hi,
the systemd version distributed with ubuntu focal (245.4) has a bug in systemd-resolved that ends up breaking local name resolution via mDNS. From tests run with manjaro that uses a much more recent version of systemd I have reasons to believe that the issue may already be fixed in systemd. Unfortunately, there seems to be little interest in the distro about looking into the issue and I understand that there is no easy way to upgrade just systemd-resolved to a newer version on the distro. Hence I would like to see if there is a commit that is easy enough to backport over the ubuntu focal sources and I am seeking help on that. My hope is that the memory of those on this mailing list about what has been touched in systemd-resolved after version 245.4 can help restricting only to sensible commit candidates.
The bug scenario is the following.
Ubuntu ships with nsswitch.conf configured to include a line
hosts: files mdns4_minimal [NOTFOUND=return] dns
This means that when you need to access an host on .local, the query goes first through mdns4. However, the nss version of the mnds client before anything else queries unicast DNS to see if it responds to SOA queries for the top level local. In case it does, it assumes that in the LAN local is under the control of unicast DNS and it gives up.
The problem is that the ubuntu focal version of systemd-resolved replies to SOA queries about local when it should not. For instance you get things like:
host -t SOA local
local has SOA record local. nobody.invalid. 1 3600 1200 604800
10800
Specifically this happens when (the 245.4 version of) systemd-resolved accesses some other specific DNS servers such as knot-resolver that deliver an authority section:
dig SOA local. @192.168.10.103
; <<>> DiG 9.16.1-Ubuntu <<>> SOA local.
@192.168.10.103
;; global options: +cmd
;; Got answer:
;; WARNING: .local is reserved for Multicast DNS
;; You are currently testing what happens when an mDNS query is
leaked to DNS
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id:
55699
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1,
ADDITIONAL: 1
;; QUESTION SECTION:
;local. IN SOA
;; AUTHORITY SECTION:
local. 10800 IN SOA local.
nobody.invalid. 1 3600 1200 604800 10800
;; ADDITIONAL SECTION:
explanation.invalid. 10800 IN TXT "Blocking is
mandated by standards, see references on
https://www.iana.org/assignments/special-use-domain-names/special-use-domain-names.xhtml"
;; Query time: 4 msec
;; SERVER: 192.168.10.103#53(192.168.10.103)
;; WHEN: Fri Nov 12 08:15:31 CET 2021
;; MSG SIZE rcvd: 246
As already mentioned, recent versions of systemd-resolved do not seem to turn that authority section into a SOA reply. So I am trying to understand when and how that was fixed.
Thanks in advance and best regards,
Sergio Callegari
