systemd-resolved malformed packet on cert dns lookup

[Bryce Larson]

systemd-resolved returns a malformed packet when looking up an openpgp key (via a cert record rfc4398) from my internal authoritative dns server.

The command I used was gpg2 -v --auto-key-locate=clear,cert,local --locate-keys [Email Address]

This works correctly if I change /etc/resolv.conf symlink to point at /run/systemd/resolve/resolv.conf so that it doesn't use the local systemd-resolved resolver/cache instead of /run/resolvconf/resolv.conf

I'm including a wireshark capture of the malformed packet (filtered for 127.0.0.53).

I noticed that this was over udp. If I recall correctly, cert records are usually big enough that they require using tcp.

Description: Ubuntu Artful Aardvark (development branch)
Release: 17.10

systemd:
  Installed: 233-8ubuntu3
  Candidate: 233-8ubuntu3

[Dimitri John Ledkov (xnox)]

The systemd version you have installed appears to be quite out of date. Could you please upgrade to 234-2ubuntu10?

Note that I don't expect that to resolve the issue that you are reporting, but it would significantly reduce the amount of upstream code checks I will need to do before forwarding this bug report to them.

[Bryce Larson (bryceml)]

I have upgraded to version 234-2ubuntu10. It doesn't make a difference. I double checked and requested the key (cert record) using dig and it works just fine, no malformed packet. It's only when gpg2 requests it combined with systemd-resolved where there is a problem as far as I can tell.

[Bryce Larson (bryceml)]

To clarify, having dig request it from systemd-resolved works. Having dig request it directly from the server also works.

[Dan Streetman (ddstreet)]

please reopen if this is still an issue