This machine has 'edns-udp-size: 1432' and, indeed, in the reply, it
displays this buffer size. But it does not respect that limit. Here,
with a big DNSKEY RRset, BIND should have truncated the answer and set
the TC bit but it didn't:
% dig @194.0.9.1 DNSKEY ma
; <<>> DiG 9.10.3-P4-Debian <<>> @194.0.9.1 DNSKEY ma
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 54499
;; flags: qr aa rd; QUERY: 1, ANSWER: 7, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 1432
;; QUESTION SECTION:
;ma. IN DNSKEY
;; ANSWER SECTION:
ma. 1296000 IN DNSKEY 256 3 8 (
AwEAAcKOK/IPpC+iUOHmrMg76aV+hAimErdlpiCpTGlu
c1+ZCXCLYEpZwaME9vUl5eMDPuEKxa/PkWMsXa89b+Ow
YveMSlESiHv/Jh7lu13Ar+9Ba3vQlTmt/JMBJ0/hR+jD
UXZNLuSjOdcDRfgafQt+pufpClocDCZPdvyP8u466xIr
) ; ZSK; alg = RSASHA256; key id = 25503
ma. 1296000 IN DNSKEY 256 3 8 (
AwEAAagLY1Xa6PqbPvsC5zHybhLFaJtnA/6/i+3wnLyh
3uvWzCOP56VXkn44aYDII+4E/ZrsC7GR4u7/P71PGejD
HcYRvHdRcreIItU8Xtql+hz2BgEn/IeG/Gs67EEEXbE2
t84pfyRzrcGQAz6nwwbzld1Ld+fQeS0ZT8w4XfMDBpa7
) ; ZSK; alg = RSASHA256; key id = 51900
ma. 1296000 IN DNSKEY 257 3 8 (
AwEAAaa+pkZNOrS5ZBslnyPGF5BwSFaAAUp48zevzufu
qRKH8bhWGNCV1t7IjX9a7VlxDGoSZk3evYQI6d7h4jzZ
8y0RjVc2jxZMKQeKHTHLVbUcTTqEp2jRFXSCRjT5vkuD
gPfVbajQZOpv+IZxroDdX6UpppEcB7l2qn6QO9RkVuZ9
Oy4CHhVre2vxL6TTcFGhP3ah/yaDYrmojbspdiCzW4nr
z1HClgy/VmNWQYWwx0ZgYIZiCbsS2gZTZYy8AX+40Y5Q
ZKGTPfF818g6OkEO9OJaZr/gKo+jqKYAIqkoHbsVlmII
jCcmt4rodAzWy59mrlLGiAZIlb93OAmo82SxmNU=
) ; KSK; alg = RSASHA256; key id = 15319
ma. 1296000 IN DNSKEY 257 3 8 (
AwEAAa2j7taBE5OkjqCWbfZ4k+A/lBedIt94dVhEfNpU
nskerqW5c+WL5thP/P3VdcHsPqdUv8fIqeGmVI1BwoUt
MqZmQiKkYntqagX1JpYXwgZmEyybfGUHls81dPIW74bd
aB5K4xcpfdEhnWxN3J9WGaDTRseCHWDKnMNhtqYi/4Sv
aXNH0eB1/8MZ/IH0ukPbwRSn8V8R6Qmn6HNjUpMtGh3e
7OROdDvMp/aTaKPUJ+Dgt74zlWCNwv/VmiEpC4AfHz5p
A23NR46qlIUED/aOuvCp3gZAp7R9uIqTMH0rRz4mB5ru
KJB/Xg5xLyqwOKx6cMHRSoA/nQQ4AKkZa4tWPhc=
) ; KSK; alg = RSASHA256; key id = 33982
ma. 1296000 IN RRSIG DNSKEY 8 1 1296000 (
20190401105301 20190302095632 15319 ma.
WD09LaVuAnrTMl8aZ4qVwiMz0r1qm98a68+vPdfHLsY4
W2nAriwpSZ+asGiWhrq4P4S+PEOStIgTycsnoKNyR8cX
VwLzXM7w7J9wGaDmvg0j4l0617zG18SKKD4sQoUoxCGV
zBE2j7HgAKwQVLKNOnN1EKSciBZS3o361t80TsG5Iid/
dNu2cYLIPTVblck/mA2CZaTzVz01zbUn5bGOx8GdEZvE
ld+1ej/jacaGCq80KXwEMxujPmp3tmi5kRpGgv4I+N82
WS4kdCMuDO05hwwqg52h2QfOkkPDR7g2G0D/6XokYAkg
5pvoj94N5n5zBR2L4BZVmxVZ5DcoE9+q7Q== )
ma. 1296000 IN RRSIG DNSKEY 8 1 1296000 (
20190401105301 20190302095632 33982 ma.
ItE1M13I/Nq9iY1PusCghth9oUbo4+tigZadHvZxjQRY
KNMOtCsOJg0pIdUXbBlPqpu2AG6vCO4gX+cc5/ZdP0Og
IKiAtCagA6/em/JBqR3QObWkJlcBtMoSpcs+rhUckd73
Y7MJYCMP6I08K1uD9KN6NqThjUEZ/RY9VUyVHlvZ+meJ
ajExJGDLJQ+dK4LPvmmS0JeXjIyOOmMt8411uzw+vTHc
iY4wleGbAfrfYiOsQWmoXJAU0piy5feUHBg8NdadCM6X
cG2k5pybSDEO2ghYK16P9cv0kvMchmTBvVJvDc4+YbWc
ocd9aqjmLCdWeeMQNi3gjZztLTe8Db6umw== )
ma. 1296000 IN RRSIG DNSKEY 8 1 1296000 (
20190401105301 20190302095632 51900 ma.
JUSYyoMbvmquVaxG3lPKBtNfcRYbx79xMKSSSDh8jP4b
TL10HIyYDpGBKujDX0E4TLIDcZWro97t4Mv8JTKL/n1H
0uphGTIFsHzBnp2w4o2/3TuRpoMBcqiTJDUL5PZz4tiO
YcQgwVgXcMjsoee6oFYTJ9O/B3z4eDlqaJQ6UQc= )
;; Query time: 4 msec
;; SERVER: 194.0.9.1#53(194.0.9.1)
;; WHEN: Fri Mar 08 15:39:42 CET 2019
;; MSG SIZE rcvd: 1621
(If you repeat the test, be careful, this IP address is an anycasted
machine, and some instances run NSD, which does not have the bug.)
You can see here this BIND 9.11 server returning a fragmented answer (precisely
what we wanted to avoid with edns-udp-size):
16:38:37.506180 64:00:6a:78:28:40 > 00:1b:17:00:01:35, ethertype IPv4 (0x0800),
length 73: 10.10.86.133.50572 > 194.0.9.1.53: 45007+ [1au] DNSKEY? ma. (31)
16:38:37.510516 00:1b:17:00:01:35 > 64:00:6a:78:28:40, ethertype IPv4 (0x0800),
length 1514: 194.0.9.1.53 > 10.10.86.133.50572: 45007*- 7/0/1 DNSKEY, DNSKEY,
DNSKEY, DNSKEY, RRSIG, RRSIG, RRSIG[|domain]
16:38:37.510531 00:1b:17:00:01:35 > 64:00:6a:78:28:40, ethertype IPv4 (0x0800),
length 183: 194.0.9.1 > 10.10.86.133: ip-proto-17
This is with BIND 9.11.5. NSD 4.1 does not have the bug and, on the
same zone, behaves correctly.
_______________________________________________
Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe
from this list
bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users
