[Bug libc/11950] New: res_send fails with ETIMEDOUT on successful DNS UPDATE

[Bug libc/11950] New: res_send fails with ETIMEDOUT on successful DNS UPDATE

[dos at scarff dot id dot au]

In the glibc resolver (previous versions and current git HEAD), res_send 
interprets some successful DNS UPDATE responses as an indication to retry with 
the next server, because of this test in res_send.c:

        if (anhp->rcode == NOERROR && anhp->ancount == 0
            && anhp->aa == 0 && anhp->ra == 0 && anhp->arcount == 0) {

This test is nonsensical for DNS UPDATE, where the "AA" and "RA" flags are part 
of the much larger Z bitfield, see

  http://tools.ietf.org/html/rfc2136#page-5

for more information.  This issue appears to be limited to UDP queries in 
send_dg().  The end result is that res_send returns failure and sets ETIMEDOUT.

This issue will not occur for all DNS servers; those which allow recursion 
(e.g. BIND9 without recursion disabled) will set the RA bit anyway.

Unfortunately, it's hard to generate a simple test case due to the nature of 
DNS UPDATE (needs crypto, a current timestamp, and a configured server).  I am 
experiencing this issue when using res_send in the context of the dudders DNS 
UPDATE client: http://dudders.sourceforge.net/

Patch attached.

-- 
           Summary: res_send fails with ETIMEDOUT on successful DNS UPDATE
           Product: glibc
           Version: unspecified
            Status: NEW
          Severity: normal
          Priority: P2
         Component: libc
        AssignedTo: drepper at redhat dot com
        ReportedBy: dos at scarff dot id dot au
                CC: glibc-bugs at sources dot redhat dot com


http://sourceware.org/bugzilla/show_bug.cgi?id=11950

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.

[Bug libc/11950] res_send fails with ETIMEDOUT on successful DNS UPDATE

[dos at scarff dot id dot au]

------- Additional Comments From dos at scarff dot id dot au  2010-08-27 05:22 -------
Created an attachment (id=4951)
 --> (http://sourceware.org/bugzilla/attachment.cgi?id=4951&action=view)
accept DNS UPDATE responses without RA set


-- 


http://sourceware.org/bugzilla/show_bug.cgi?id=11950

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.

[Bug libc/11950] res_send fails with ETIMEDOUT on successful DNS UPDATE

[dos at scarff dot id dot au]

------- Additional Comments From dos at scarff dot id dot au  2010-08-27 08:54 -------
Minor correction: testing again I see that res_send sets errno to ECONNREFUSED, 
not ETIMEDOUT.

-- 


http://sourceware.org/bugzilla/show_bug.cgi?id=11950

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.