net: add EDNS0 support to builtin DNS stub resolver #6464

mikioh · 2013-09-23T23:51:18Z

issue #6336 unveiled that we need minimum DNS transport support in build-in DNS resolver
for when we cannot rely on underlying stuff such as libc. For now, looks like EDNS0 is
the only missing piece.

rsc · 2013-09-24T02:33:23Z

Comment 1:

Why? What current C calls are we making that take advantage of EDNS0?

rsc · 2013-12-04T01:31:31Z

Comment 2:

Labels changed: added release-none, removed go1.3maybe.

rsc · 2013-12-04T01:51:54Z

Comment 3:

Labels changed: added repo-main.

garrickp · 2015-04-30T13:49:16Z

+1

Ran into this while debugging a problem with pulling Docker images: we were unable to pull an image due to a DNS resolution error. It turns out our router was forwarding up to 4k DNS responses regardless of the state of the EDNS0 flag, and the Go DNS package was (correctly to the spec) choking on the larger than expected message. The ultimate fix was for the router itself, setting the window to back down to the RFC correct 512 byte size.

Again, this is not a bug with the Go implementation of DNS, but considering how broadly used EDNS0 is for avoiding a fallback to TCP for large DNS responses (which are more and more common), it might be worth implementing the EDNS0 DNS extension if only for that feature.

bradfitz · 2015-04-30T15:58:39Z

/cc @mikioh @mdempsky

mikioh · 2015-06-05T01:43:49Z

I still hesitate to say "yup, that's the way to go" because we are already not innocent.

I also understand that EDNS0 would be pretty useful under the well-configured, managed and secured environment. In addition, DNS stub resolver perhaps might avoid being affected by various attacks based on UDP over IP fragmentation. I mean, with DNSSEC it sounds pretty reasonable, but in other cases... still thinking.

danp · 2015-11-17T15:19:22Z

Related to #13279

gopherbot · 2017-06-29T09:56:14Z

CL https://golang.org/cl/47170 mentions this issue.

This change introduces OPTResourse type to support DNS messages containing various extension options as defined in RFC 6891. Parsing and building OPT pseudo records requires allocations like TXT records. Also adds DNSSECAllowed, ExtendedRCode and SetEDNS0 methods to ResourceHeader for convenience. Updates golang/go#6464. Updates golang/go#16218. Change-Id: Ib72cea277201e4122c6b5effa320084ff351c886 Reviewed-on: https://go-review.googlesource.com/47170 Reviewed-by: Ian Gudger <igudger@google.com>

The CoreDNS bufsize plugin was enabled with a set size of 1232 bytes in order to ensure that outbound DNS queries contain EDNS OPT Resource Records, which resolved Bug 1949361. Some DNS Clients, such as Go's built-in stub DNS resolver, are not capable of handling DNS UDP messages that are larger than 512 bytes (even if the proper EDNS flags are included in the message). See golang/go#13561 & golang/go#6464 accordingly. This commit configures the bufsize plugin with a reduced bufsize of 512 bytes for all servers to ensure compatibility with primitive DNS clients. pkg/operator/controller/controller_dns_configmap.go: Set bufsize to 512 bytes for all servers. pkg/operator/controller/controller_dns_configmap_test.go: Update unit test cases. This commit is in support of Bug 196616 and should not cause any regression from the changes merged as a part of Bug 1949361.

The CoreDNS bufsize plugin was enabled with a set size of 1232 bytes in order to ensure that DNS queries bound for an upstream resolver contain EDNS OPT Resource Records. This resolved Bug 1949361. Some DNS Clients, such as Go's built-in stub DNS resolver, are not capable of handling DNS UDP messages that are larger than 512 bytes (even if the proper EDNS flags are included in the message). See golang/go#13561 & golang/go#6464 accordingly. This commit configures the bufsize plugin with a reduced bufsize of 512 bytes for all servers to ensure compatibility with primitive DNS clients. pkg/operator/controller/controller_dns_configmap.go: Set bufsize to 512 bytes for all servers. pkg/operator/controller/controller_dns_configmap_test.go: Update unit test cases. This commit is in support of Bug 196616 and should not cause any regression from the changes merged as a part of Bug 1949361.

gopherbot · 2022-02-11T04:18:28Z

Change https://go.dev/cl/385035 mentions this issue: net: send EDNS(0) packet length in DNS query

gopherbot · 2022-02-12T05:50:16Z

Change https://go.dev/cl/385374 mentions this issue: [release-branch.go1.17] net: send EDNS(0) packet length in DNS query

gopherbot · 2022-02-12T05:56:05Z

Change https://go.dev/cl/385375 mentions this issue: [release-branch.go1.16] net: send EDNS(0) packet length in DNS query

gopherbot · 2022-02-15T21:54:14Z

Change https://go.dev/cl/386015 mentions this issue: net: increase maximum accepted DNS packet to 1232 bytes

gopherbot · 2022-02-15T21:54:17Z

Change https://go.dev/cl/386016 mentions this issue: net: send EDNS(0) packet length in DNS query

gopherbot · 2022-02-15T21:54:21Z

Change https://go.dev/cl/386014 mentions this issue: Revert "net: send EDNS(0) packet length in DNS query"

This reverts https://go.dev/cl/385035. For 1.18 we will use a simple change to increase the accepted DNS packet size, to handle what appear to be broken resolvers that don't honor the 512 byte limit. For 1.19 we will restore CL 385035 to make a proper EDNS request, so that it has more testing time before it goes out in a release. For #6464 For #21160 For #44135 For #51127 For #51153 Change-Id: Ie4a0eb85ca0a6a73bee5cd4cfc6b7d2a15ef259f Reviewed-on: https://go-review.googlesource.com/c/go/+/386014 Trust: Ian Lance Taylor <iant@golang.org> Reviewed-by: Matthew Dempsky <mdempsky@google.com> Reviewed-by: Damien Neil <dneil@google.com>

gopherbot · 2022-02-15T22:31:49Z

Change https://go.dev/cl/386034 mentions this issue: [release-branch.go1.16] net: increase maximum accepted DNS packet to 1232 bytes

gopherbot · 2022-02-15T22:33:17Z

Change https://go.dev/cl/386035 mentions this issue: [release-branch.go1.17] net: increase maximum accepted DNS packet to 1232 bytes

The existing value of 512 bytes as is specified by RFC 1035. However, the WSL resolver reportedly sends larger packets without setting the truncation bit, which breaks using the Go resolver. For 1.18 and backports, just increase the accepted packet size. This is what GNU glibc does (they use 65536 bytes). For 1.19 we plan to use EDNS to set the accepted packet size. That will give us more time to test whether that causes any problems. No test because I'm not sure how to write one and it wouldn't really be useful anyhow. Fixes #6464 Fixes #21160 Fixes #44135 Fixes #51127 For #51153 Change-Id: I0243f274a06e010ebb714e138a65386086aecf17 Reviewed-on: https://go-review.googlesource.com/c/go/+/386015 Trust: Ian Lance Taylor <iant@golang.org> Run-TryBot: Ian Lance Taylor <iant@golang.org> Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Matthew Dempsky <mdempsky@google.com> TryBot-Result: Gopher Robot <gobot@golang.org>

…1232 bytes The existing value of 512 bytes as is specified by RFC 1035. However, the WSL resolver reportedly sends larger packets without setting the truncation bit, which breaks using the Go resolver. For 1.18 and backports, just increase the accepted packet size. This is what GNU glibc does (they use 65536 bytes). For 1.19 we plan to use EDNS to set the accepted packet size. That will give us more time to test whether that causes any problems. No test because I'm not sure how to write one and it wouldn't really be useful anyhow. For #6464 For #21160 For #44135 For #51127 For #51153 Fixes #51162 Change-Id: I0243f274a06e010ebb714e138a65386086aecf17 Reviewed-on: https://go-review.googlesource.com/c/go/+/386015 Trust: Ian Lance Taylor <iant@golang.org> Run-TryBot: Ian Lance Taylor <iant@golang.org> Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Matthew Dempsky <mdempsky@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> (cherry picked from commit 6e82ff8) Reviewed-on: https://go-review.googlesource.com/c/go/+/386035 Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org>

…1232 bytes The existing value of 512 bytes as is specified by RFC 1035. However, the WSL resolver reportedly sends larger packets without setting the truncation bit, which breaks using the Go resolver. For 1.18 and backports, just increase the accepted packet size. This is what GNU glibc does (they use 65536 bytes). For 1.19 we plan to use EDNS to set the accepted packet size. That will give us more time to test whether that causes any problems. No test because I'm not sure how to write one and it wouldn't really be useful anyhow. For #6464 For #21160 For #44135 For #51127 For #51153 Fixes #51161 Change-Id: I0243f274a06e010ebb714e138a65386086aecf17 Reviewed-on: https://go-review.googlesource.com/c/go/+/386015 Trust: Ian Lance Taylor <iant@golang.org> Run-TryBot: Ian Lance Taylor <iant@golang.org> Reviewed-by: Damien Neil <dneil@google.com> Reviewed-by: Matthew Dempsky <mdempsky@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> (cherry picked from commit 6e82ff8) Reviewed-on: https://go-review.googlesource.com/c/go/+/386034 Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org>

Advertise to DNS resolvers that we are willing and able to accept up to 1232 bytes in a DNS packet. The value 1232 was chosen based on https://dnsflagday.net/2020/. For #6464 For #21160 For #44135 For #51127 Fixes #51153 Change-Id: If9182d5210bfe047cf0a4d46163effc6812ab677 Reviewed-on: https://go-review.googlesource.com/c/go/+/386016 Trust: Ian Lance Taylor <iant@golang.org> Run-TryBot: Ian Lance Taylor <iant@golang.org> Reviewed-by: Damien Neil <dneil@google.com> TryBot-Result: Gopher Robot <gobot@golang.org>

mikioh added Thinking release-none labels Dec 4, 2013

rsc added this to the Unplanned milestone Apr 10, 2015

rsc removed release-none labels Apr 10, 2015

mikioh changed the title ~~net: add EDNS0 support to built-in DNS resolver~~ net: add EDNS0 support to builtin DNS stub resolver Jun 5, 2015

mikioh mentioned this issue Jun 5, 2015

net: builtin DNS stub resolver fails to parse responses from consul with "cannot unmarshal DNS message" #11070

Closed

mikioh mentioned this issue Jun 13, 2015

net/internal/dns: new package #11160

Closed

mikioh mentioned this issue Nov 22, 2015

proposal: security feature improvement for builtin DNS stub resolver #13356

Closed

mikioh mentioned this issue Dec 11, 2015

net: pure Go dns does not handle UDP packets > 512 octets #13561

Closed

ransombriggs mentioned this issue Mar 1, 2016

Unable to run heroku login 'cannot unmarshal DNS message' heroku/legacy-cli#1899

Closed

iangudger mentioned this issue Jan 16, 2017

proposal: x/net/dns, vendor/golang.org/x/net/dns: new package #16218

Closed

mikioh mentioned this issue Jul 26, 2017

net: issue with DNS response > 512 bytes (cannot unmarshal DNS message) #21160

Closed

mikioh mentioned this issue Dec 1, 2017

net: a better builtin DNS stub resolver #22956

Open

sgreene570 mentioned this issue Jun 2, 2021

Bug 1966116: Corefile: Set bufsize to 512 bytes for all servers openshift/cluster-dns-operator#276

Merged

simonpasquier mentioned this issue Jun 8, 2021

Thanos ruler fails to start with "cannot unmarshal DNS message" errors thanos-io/thanos#4204

Closed

seankhliao mentioned this issue Feb 10, 2022

net: 512 byte DNS response size limit causes "cannot unmarshal DNS" error #51127

Closed

gopherbot closed this as completed in f14ad78 Feb 12, 2022

golang locked and limited conversation to collaborators Feb 15, 2023

gopherbot added the FrozenDueToAge label Feb 15, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

net: add EDNS0 support to builtin DNS stub resolver #6464

net: add EDNS0 support to builtin DNS stub resolver #6464

mikioh commented Sep 23, 2013

rsc commented Sep 24, 2013

rsc commented Dec 4, 2013

rsc commented Dec 4, 2013

garrickp commented Apr 30, 2015

bradfitz commented Apr 30, 2015

mikioh commented Jun 5, 2015

danp commented Nov 17, 2015

gopherbot commented Jun 29, 2017

gopherbot commented Feb 11, 2022

gopherbot commented Feb 12, 2022

gopherbot commented Feb 12, 2022

gopherbot commented Feb 15, 2022

gopherbot commented Feb 15, 2022

gopherbot commented Feb 15, 2022

gopherbot commented Feb 15, 2022

gopherbot commented Feb 15, 2022

net: add EDNS0 support to builtin DNS stub resolver #6464

net: add EDNS0 support to builtin DNS stub resolver #6464

Comments

mikioh commented Sep 23, 2013

rsc commented Sep 24, 2013

rsc commented Dec 4, 2013

rsc commented Dec 4, 2013

garrickp commented Apr 30, 2015

bradfitz commented Apr 30, 2015

mikioh commented Jun 5, 2015

danp commented Nov 17, 2015

gopherbot commented Jun 29, 2017

gopherbot commented Feb 11, 2022

gopherbot commented Feb 12, 2022

gopherbot commented Feb 12, 2022

gopherbot commented Feb 15, 2022

gopherbot commented Feb 15, 2022

gopherbot commented Feb 15, 2022

gopherbot commented Feb 15, 2022

gopherbot commented Feb 15, 2022