Stub resolver cache is corrupted

Status changed to 'Confirmed' because the bug affects multiple users.

This seems to be the same issue previously reported at https://github.com/systemd/systemd/issues/9833, which was fixed in https://github.com/systemd/systemd/pull/9836 (commit 3740146) and released in v240.

This bug also affects MaaS when commissioning is done with Bionic 18.04 and an external proxy is set.

Commissioning fails at the <Hardware Test> step inside the <smartctl-validate> script when trying to install packages for the test itself.

Error message:
Temporary failure resolving <External proxy>

[sts-sponsor]

There is an SRU in progress for systemd already for Bionic. It will have to wait for LP: #1814373 and #1825997 to be 'Fix Released' before sponsoring that particular bug.

Thanks Heitor for your contribution.

Let's circle back later.

- Eric

I can include this in my next systemd upload, once the current -proposed versions are released.

Sponsored in Bionic.

* The fix LGTM.
- Looking in systemd git upstream repo, I couldn't find anything (revert, known regression introduced by this particular fix or else)
- I easily reproduced the bug using systemd without the fix, and I confirm it works for both enumerated scenarios found in [Test Case] just fine[0] with the fix.
- This has been extensively tested in both upstream and other Debian/Ubuntu releases.

* Very minor modifications:
- Slightly modified the DEP3 header (Adding the upstream bug link, ....)
- Renamed the patch from "lp1818527-resolved-do-not-hit-CNAME-in-NODATA.patch" to "resolved-do-not-hit-CNAME-in-NODATA.patch" to stay consistent with current other "resolved" patch type.

Thanks Heitor for your contribution.

- Eric

[0] - Validation of the fix in Bionic:
# systemd-resolve --flush-caches
# dig github.com -t CNAME

; <<>> DiG 9.11.3-1ubuntu1.7-Ubuntu <<>> github.com -t CNAME
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 8781
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;github.com. IN CNAME

;; Query time: 22 msec
;; SERVER: 127.0.0.53#53(127.0.0.53)
;; WHEN: Tue Jun 11 15:43:51 EDT 2019
;; MSG SIZE rcvd: 39

# dig github.com

; <<>> DiG 9.11.3-1ubuntu1.7-Ubuntu <<>> github.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 2811
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;github.com. IN A

;; ANSWER SECTION:
github.com. 42 IN A 192.30.253.113

;; Query time: 13 msec
;; SERVER: 127.0.0.53#53(127.0.0.53)
;; WHEN: Tue Jun 11 15:43:55 EDT 2019
;; MSG SIZE rcvd: 55

Hello Abam, or anyone else affected,

Accepted systemd into bionic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/systemd/237-3ubuntu10.23 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-bionic to verification-done-bionic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-bionic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Verified for Bionic:

ubuntu@bionic:~$ dpkg -l | grep systemd
ii systemd 237-3ubuntu10.23 amd64 system and service manager

ubuntu@bionic:~$ systemd-resolve --flush-caches

ubuntu@bionic:~$ dig +noall +answer github.com CNAME

ubuntu@bionic:~$ dig +noall +answer github.com A
github.com. 18 IN A 140.82.118.4

Some comments on the Autopkgtest regressions:

- lxc (armhf) fails due to the ftpmaster.internal mirror failing

- libvirt (armhf) fails for the same reason ("Unable to connect to ftpmaster.internal:http")

- systemd (ppc64el) has been failing since before this patch was introduced, and looking at the test logs it doesn't seem to be related to the stub resolver

- network-manager (arm64) has been failing since previous systemd versions (since systemd/237-3ubuntu10.21)

- gvfs (arm64) fails due to a permission error that should be unrelated to the stub resolver ("GLib.Error('Not authorized to perform ope[83 chars]', 0) != True")

- gvfs (i386) has been failing since before this patch was introduced

After going through the autopkgtest logs for the above, it seems that the failures are either due to autopkgtest infra, or have been introduced by something other than the systemd upload.

This bug was fixed in the package systemd - 237-3ubuntu10.23

---------------
systemd (237-3ubuntu10.23) bionic; urgency=medium

  * d/p/resolved-do-not-hit-CNAME-in-NODATA.patch:
    - fix stub resolver cache (LP: #1818527)

 -- Heitor Alves de Siqueira <email address hidden> Tue, 04 Jun 2019 15:54:24 -0300

The verification of the Stable Release Update for systemd has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.