[Bug network/19857] New: resolv: Switch to TCP unconditionally on TC=1 response over UDP

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=19857

            Bug ID: 19857
           Summary: resolv: Switch to TCP unconditionally on TC=1 response
                    over UDP
           Product: glibc
           Version: 2.24
            Status: NEW
          Severity: normal
          Priority: P2
         Component: network
          Assignee: unassigned at sourceware dot org
          Reporter: fweimer at redhat dot com
        Depends on: 19696, 19856
  Target Milestone: ---
             Flags: security-

A DNS server might send a TC=1 RA=0 (truncation, no recursion) reply over UDP,
while it still offers recursion over TCP.  We currently ignore this server
because we check for RA=0 before TC=1 in send_dg:

                if (anhp->rcode == NOERROR && anhp->ancount == 0
                    && anhp->aa == 0 && anhp->ra == 0 && anhp->arcount == 0) {
…
                }
                if (!(statp->options & RES_IGNTC) && anhp->tc) {

There is a thread about this on the dns-operations mailing list:

  https://lists.dns-oarc.net/pipermail/dns-operations/2016-March/014548.html

Fixing this needs timeouts for TCP connections and a server usability check on
the TCP path (see the blocking bugs).


Referenced Bugs:

https://sourceware.org/bugzilla/show_bug.cgi?id=19696
[Bug 19696] libresolv does not enforce timeouts on TCP connections
https://sourceware.org/bugzilla/show_bug.cgi?id=19856
[Bug 19856] resolv: send_vc should perform unusable server checks like send_dg
-- 
You are receiving this mail because:
You are on the CC list for the bug.