on ubuntu 22.04 systemd fails with per interface dns configurations

Bug #2030505 reported by devanath
26
This bug affects 5 people
Affects Status Importance Assigned to Milestone
systemd (Ubuntu)
Confirmed
Low
Unassigned

Bug Description

Hi There,

Systemd seems to work awesome, except when dns proxy is running on localhost ipaddress. The below fix seems to takescare of such cases. Unfortunately this is not included in the latest systemd versions on ubuntu22.04 LTS. Is it possible to consider our humble request and add this to the systemd versions supported on ubuntu22.04, it is creating lots of issues for our users.

https://github.com/systemd/systemd/pull/25438

I am raising this ticket as requested below

-----snippet

actionparsnip <email address hidden>
Aug 5, 2023, 6:26 PM (2 days ago)
to me

Your question #707538 on systemd in Ubuntu changed:
https://answers.launchpad.net/ubuntu/+source/systemd/+question/707538

    Status: Open => Answered

actionparsnip proposed the following answer:
I suggest you report a bug. Add your URL to the bug for visibility. You
can start the process by running:

ubuntu-bug systemd
--------

Thanks in advance

Regards,
Dev

devanath (dsrinivasa)
description: updated
Revision history for this message
Nick Rosbrook (enr0n) wrote :

Can you please elaborate on the issue you are experiencing, and provide steps for someone else to reproduce the problem?

Changed in systemd (Ubuntu):
status: New → Incomplete
importance: Undecided → Low
Revision history for this message
devanath (dsrinivasa) wrote (last edit ):

All I am asking is to add the patch/fix to the latest LTS ubuntu version. The corresponding ticket below has all the steps and details. Also its fixed in the latest systemd-resolved versions, but LTS ubuntu version 22.4 does not seem to have this latest version. Plz do the needful.

For the exact problem statement and steps to reproduce plz use this ticket https://github.com/systemd/systemd/issues/25397

Changed in systemd (Ubuntu):
status: Incomplete → New
Revision history for this message
Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in systemd (Ubuntu):
status: New → Confirmed
Nick Rosbrook (enr0n)
Changed in systemd (Ubuntu):
status: Confirmed → New
Revision history for this message
Nick Rosbrook (enr0n) wrote (last edit ):

> All I am asking is to add the patch/fix to the latest LTS ubuntu version.

In order to be able to help with that and prioritize this, we need to know exactly what your trouble is and how to reproduce it.

> For the exact problem statement and steps to reproduce plz use this ticket https://github.com/systemd/systemd/issues/25397

Have you tried the workaround suggested in https://github.com/systemd/systemd/issues/25397#issuecomment-1320205005?

I quickly tried to reproduce this on a pi hole of mine that is running Jammy, and I could not do so. Please provide a more specific example of your setup that can be used to reproduce the issue.

Changed in systemd (Ubuntu):
status: New → Incomplete
Revision history for this message
devanath (dsrinivasa) wrote :
Download full text (20.9 KiB)

We have a dns proxy running on 127.0.0.5:53. Below are the logs for ubuntu 22.04 LTS and is not working

1...... dig google.com
;; communications error to 127.0.0.53#53: timed out
;; communications error to 127.0.0.53#53: timed out
;; communications error to 127.0.0.53#53: timed out

; <<>> DiG 9.18.12-0ubuntu0.22.04.2-Ubuntu <<>> google.com
;; global options: +cmd
;; no servers could be reached

2...... resolvectl
Global
       Protocols: -LLMNR -mDNS -DNSOverTLS DNSSEC=no/unsupported
resolv.conf mode: stub

Link 2 (ens33)
    Current Scopes: DNS
         Protocols: +DefaultRoute +LLMNR -mDNS -DNSOverTLS DNSSEC=no/unsupported
Current DNS Server: 75.75.75.75
       DNS Servers: 75.75.75.75 75.75.76.76
        DNS Domain: hsd1.ca.comcast.net

Link 3 (wg0)
    Current Scopes: DNS
         Protocols: -DefaultRoute +LLMNR -mDNS -DNSOverTLS DNSSEC=no/unsupported
Current DNS Server: 127.0.0.5
       DNS Servers: 127.0.0.5
        DNS Domain: ~google.com ~icanhazip.com ~myvm.banyan.local

Link 4 (docker0)
Current Scopes: none
     Protocols: -DefaultRoute +LLMNR -mDNS -DNSOverTLS DNSSEC=no/unsupported

3.....TCPDUMP on loopback interface shows some packets for first request and after that there are no packets seen at all. Command used tcpdump -v -i lo host 127.0.0.5 -n -e

13:49:10.755476 00:00:00:00:00:00 > 00:00:00:00:00:00, ethertype IPv4 (0x0800), length 87: (tos 0x0, ttl 64, id 37216, offset 0, flags [none], proto UDP (17), length 73)
    10.115.0.12.41708 > 127.0.0.5.53: [bad udp cksum 0x89ca -> 0x5f03!] 27623+ [1au] A? mtalk.google.com. ar: . OPT UDPsize=65508 (45)
13:49:10.823942 00:00:00:00:00:00 > 00:00:00:00:00:00, ethertype IPv4 (0x0800), length 103: (tos 0x0, ttl 64, id 20158, offset 0, flags [DF], proto UDP (17), length 89)
    127.0.0.5.53 > 10.115.0.12.41708: [bad udp cksum 0x89da -> 0xea69!] 27623 q: A? mtalk.google.com. 1/0/1 mtalk.google.com. [5m] A 142.250.136.188 ar: . OPT UDPsize=512 (61)
13:49:14.005421 00:00:00:00:00:00 > 00:00:00:00:00:00, ethertype IPv4 (0x0800), length 87: (tos 0x0, ttl 64, id 31594, offset 0, flags [none], proto UDP (17), length 73)
    10.115.0.12.54467 > 127.0.0.5.53: [bad udp cksum 0x89ca -> 0xe4a5!] 44148+ [1au] A? drive.google.com. ar: . OPT UDPsize=65508 (45)
13:49:14.005498 00:00:00:00:00:00 > 00:00:00:00:00:00, ethertype IPv4 (0x0800), length 87: (tos 0x0, ttl 64, id 9557, offset 0, flags [none], proto UDP (17), length 73)
    10.115.0.12.35442 > 127.0.0.5.53: [bad udp cksum 0x89ca -> 0x39bb!] 41328+ [1au] Type65? drive.google.com. ar: . OPT UDPsize=65508 (45)
13:49:14.070235 00:00:00:00:00:00 > 00:00:00:00:00:00, ethertype IPv4 (0x0800), length 137: (tos 0x0, ttl 64, id 20216, offset 0, flags [DF], proto UDP (17), length 123)
    127.0.0.5.53 > 10.115.0.12.35442: [bad udp cksum 0x89fc -> 0xb9dc!] 41328 q: Type65? drive.google.com. 0/1/1 ns: google.com. [1m] SOA ns1.google.com. dns-admin.google.com. 561875416 900 900 1800 60 ar: . OPT UDPsize=512 (95)
13:49:14.071633 00:00:00:00:00:00 > 00:00:00:00:00:00, ethertype IPv4 (0x0800), length 183: (tos 0x0, ttl 64, id 20217, offset 0, flags [DF], proto UDP (17), length 169)
    127.0.0.5.53 > 10.115.0.12.54467: [bad udp cksum 0x8a2a -> 0x5a27!] 4...

Revision history for this message
devanath (dsrinivasa) wrote :
Download full text (14.3 KiB)

WORKING logs from ubuntu 23.04

1……. dig google.com

; <<>> DiG 9.18.12-1ubuntu1.1-Ubuntu <<>> google.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 44609
;; flags: qr rd ra; QUERY: 1, ANSWER: 6, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;google.com. IN A

;; ANSWER SECTION:
google.com. 300 IN A 108.177.121.139
google.com. 300 IN A 108.177.121.101
google.com. 300 IN A 108.177.121.102
google.com. 300 IN A 108.177.121.113
google.com. 300 IN A 108.177.121.100
google.com. 300 IN A 108.177.121.138

;; Query time: 88 msec
;; SERVER: 127.0.0.53#53(127.0.0.53) (UDP)
;; WHEN: Wed Sep 06 13:26:32 PDT 2023
;; MSG SIZE  rcvd: 135

2…… resolvectl --version
systemd 252 (252.5-2ubuntu3)
+PAM +AUDIT +SELINUX +APPARMOR +IMA +SMACK +SECCOMP +GCRYPT -GNUTLS
+OPENSSL +ACL +BLKID +CURL +ELFUTILS +FIDO2 +IDN2 -IDN +IPTC +KMOD
+LIBCRYPTSETUP +LIBFDISK +PCRE2 -PWQUALITY +P11KIT +QRENCODE +TPM2
+BZIP2 +LZ4 +XZ +ZLIB +ZSTD -BPF_FRAMEWORK -XKBCOMMON +UTMP +SYSVINIT
default-hierarchy=unified

3…… resolvectl
Global
       Protocols: -LLMNR -mDNS -DNSOverTLS DNSSEC=no/unsupported
resolv.conf mode: stub

Link 2 (enp0s25)
Current Scopes: none
     Protocols: -DefaultRoute +LLMNR -mDNS -DNSOverTLS DNSSEC=no/unsupported

Link 3 (wlp3s0)
    Current Scopes: DNS
         Protocols: +DefaultRoute +LLMNR -mDNS -DNSOverTLS DNSSEC=no/unsupported
Current DNS Server: 2001:558:feed::1
       DNS Servers: 75.75.75.75 75.75.76.76 2001:558:feed::1 2001:558:feed::2
        DNS Domain: hsd1.ca.comcast.net

Link 4 (wg0)
    Current Scopes: DNS
         Protocols: -DefaultRoute +LLMNR -mDNS -DNSOverTLS DNSSEC=no/unsupported
Current DNS Server: 127.0.0.5
       DNS Servers: 127.0.0.5
        DNS Domain: ~google.com ~icanhazip.com ~myvm.banyan.local ~starfall.com

4……. TCPDUMP on loopback interface shows packets for each new requests from the browser. Command used tcpdump -v -i lo host 127.0.0.5 -n -e

tcpdump -i lo host 127.0.0.5 -n -e
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on lo, link-type EN10MB (Ethernet), snapshot length 262144 bytes

13:15:13.688335 00:00:00:00:00:00 > 00:00:00:00:00:00, ethertype IPv4
(0x0800), length 90: 127.0.0.1.43650 > 127.0.0.5.53: 37616+ [1au]
AAAA? accounts.google.com. (48)
13:15:13.688629 00:00:00:00:00:00 > 00:00:00:00:00:00, ethertype IPv4
(0x0800), length 162: 127.0.0.5.53 > 127.0.0.1.43650: 37616 0/1/0
(120)
13:15:13.688735 00:00:00:00:00:00 > 00:00:00:00:00:00, ethertype IPv4
(0x0800), length 79: 127.0.0.1.43650 > 127.0.0.5.53: 17606+ AAAA?
accounts.google.com. (37)
13:15:13.689592 00:00:00:00:00:00 > 00:00:00:00:00:00, ethertype IPv4
(0x0800), length 162: 127.0.0.5.53 > 127.0.0.1.43650: 17606 0/1/0
(120)
13:15:13.691846 00:00:00:00:00:00 > 00:00:00:00:00:00, ethertype IPv4
(0x0800), length 79: 127.0.0.1.52745 > 127.0.0.5.53: 31481+ A?
accounts.google.com. (37)
13:15:13.691977 00:00:00:00:00:00 > 00:00:00:00:00:00, ethertype IPv4
(0x0800), length 79: 127.0.0.1.51923 > 127.0.0.5.53: 35485+ Type65?
accounts.google.com. (37)
13:15:13.758834 00:00:00:00:00:00 > 00:00:00:00:00:00, ethertype IPv4...

Changed in systemd (Ubuntu):
status: Incomplete → New
Revision history for this message
devanath (dsrinivasa) wrote :

@Nick are you running pihole listening on some port on 127.0.0.x ?? You should be able to reproduce the problem fairly easily

Revision history for this message
Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in systemd (Ubuntu):
status: New → Confirmed
Revision history for this message
Carlos Martinez (carlosmart) wrote :

Any update on when this will be addressed in Ubuntu 22.04? This is impacting several of our users.

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.