Systems-resolved: Calling gethostbyaddr on non-local/non-private causes connection attempt

Hi systemd-devel,

I wanted to run a concern with systemd-resolved through the mailing list before opening an issue in the github.com repository. The below behavior does not reproduce with any other resolver I’ve used before.

I noticed that each time a program calls gethostbyaddr() a connection is attempted to the specified IP on port 5355 even when that IP is not link local nor in the private ranges specified in RFC-1918 [1].

This can be verified/seen using a fresh installation of Debian 12, however systemd-resolved must be installed. From this point, set the nftables outbound chain to log connections [2], then have an application call gethostbyaddr() [3]. A log entry should appear with a destination port of 5355 and the IP should be consistent with the addr parameter used in the gethostbyaddr() call.

Port 5355 is used for LLMNR and RFC-4795 [4], states in the abstract that “LLMNR only operates on the local link” so I think the current behavior of contacting hosts on port 5355 is incorrect, especially if that host IP is not link-local and not in the private IP range.

An immeditate workaround to this behavior is to update the systemd-resolved configuration file and specify LLMNR=no and then reload/restart the resolved service.

Please let me know if this issue should be added to the github.com issue tracker.

Thanks,

Anthony

[1] https://www.rfc-editor.org/rfc/rfc1918.html

[2] nft add rule inet filter output log prefix \"nftables: \"

[3] python3 -c 'import socket; socket.gethostbyaddr("131.252.210.176 ")'

[4 ] https://datatracker.ietf.org/doc/html/rfc4795