[PR #2307] [MERGED] leave query/opt in truncated msg #2938

New issue

Closed

opened 2026-03-16 11:16:19 +03:00 by kerem · 0 comments

kerem commented

2026-03-16 11:16:19 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/hickory-dns/hickory-dns/pull/2307
Author: @leshow
Created: 7/11/2024
Status: ✅ Merged
Merged: 7/26/2024
Merged by: @bluejekyll

Base: main ← Head: fix_truncate

📝 Commits (1)

2b43be4 leave query/opt in truncated msg

📊 Changes

1 file changed (+18 additions, -7 deletions)

View changed files

📝 crates/proto/src/op/message.rs (+18 -7)

📄 Description

We were removing the query section on truncate, which some clients complain about, we forgot to drop name_servers and signatures though, which can be large.

AFAICT this is what BIND will do, except if the message was sent without EDNS, then it will try to include parts of the response up to 512 bytes total. The safer thing here I think is to just add queries/opt and drop the other parts of the message.

See an example here using google:

this is a large message with signatures:

❯ kdig @8.8.8.8 +notcp +dnssec A error.             
;; ->>HEADER<<- opcode: QUERY; status: NXDOMAIN; id: 3612
;; Flags: qr rd ra ad; QUERY: 1; ANSWER: 0; AUTHORITY: 6; ADDITIONAL: 1

;; EDNS PSEUDOSECTION:
;; Version: 0; flags: do; UDP size: 512 B; ext-rcode: NOERROR

;; QUESTION SECTION:
;; error.              		IN	A

;; AUTHORITY SECTION:
.                   	86399	IN	SOA	a.root-servers.net. nstld.verisign-grs.com. 2024071100 1800 900 604800 86400
.                   	86399	IN	RRSIG	SOA 8 0 86400 20240724050000 20240711040000 20038 . Rnq2JmIMC4njiR5eGYnnuEte1BEfbldeyfx1SliE67OTYnIxl30ibPhTq0+D0nTbUefoaQHYGjvSM7oQYtvNx3AofST2mA6+dQq+NaanQ3fQfwFRWhqEpU4aLMrb9YYl7FzvI1VkLHbX8kYeoKElfeEbe07w8lt/KvFxp+QeogwH1iTYZsGlyQnEgv+7QTG4fjesV4YJ7tl4zYpHndROhft9iMfYN8MfVnOvl40vPap37lT1OaqWG6Db7rwvG7yGKc4NKa2EqUnZdkdb0b9wIUB6HRxPw2f558M6ZWOBL8PNKw1vwHQG2cSH0ipJaQdMZ4V2tNEDXHskL2m16+K6ZA==
.                   	86398	IN	NSEC	aaa. NS SOA RRSIG NSEC DNSKEY ZONEMD
.                   	86398	IN	RRSIG	NSEC 8 0 86400 20240724050000 20240711040000 20038 . yxr1n/TsFZhBQNGpKsjWdUqAlu4hm/1jM3/x+EEZdnEE819gCnZWj4InHf1ta2EuEagwJgJLbKOODh0F1KIqWAlwte51VxqK2Iw4ibcBy6LCak81LTV8SG2uNFDb1MupWwFCbkJjgC9XMa1EfKmHFvkXIIBfkwsyBF7irWql7YVvZXoPkyEQE28nzGYMt29AQOv/38OreMuDmShpkAwKMdUfK4e+k8UjfH69s74Sa/tRy5vAuUCuurCEfJK44eFE83JEP7kJpKxSYwecIp94nEWK9uFd33K/IRQ9HHppl7bja7O6eJGIXmVcBxt/ZAS1FXxg6XTckb10BrGuPfOuCg==
erni.               	40209	IN	NSEC	es. NS DS RRSIG NSEC
erni.               	40209	IN	RRSIG	NSEC 8 1 86400 20240723170000 20240710160000 20038 . vPSZZzZccbfs/h3CM461FlSYx4WTwNc7O2R395aVCKpkgcJrsAkrHcoix0+zaBL8iDN3jNRYxGa681HxtzGth9U/SHkyY1jZrttGZfLUtlAKSGncXQTq4hCH0hn8rbZ+PFbHAv5ejcR4FNfXtaaTTU1etSlch9dkCP+btrA+6LsbJEtHWju9qzGVG3v5lzAXsHVvRhglc/dnAODoyr0rvbLY43n+6YKU4NyE/Pzf3aQDhD5K4BnDDAMz24+wmtWcRhJhfo1X9d7Q1UHw8iYop0FV8eZ/4cJVuLKF0sYnt2x3Yr5C/u8WjABJPlf2TibWcFHnfko191CZ9KGw+QBXFg==

;; Received 1022 B
;; Time 2024-07-11 12:03:30 EDT
;; From 8.8.8.8@53(UDP) in 6.4 ms

and here, setting bufsize to 512 so we truncate, the response has kept query & opt but removed other sections (note: google changes response to NOERROR but other resolvers like cloudflare do not)

❯ kdig @8.8.8.8 +notcp +dnssec +bufsize=512 A error.
;; ->>HEADER<<- opcode: QUERY; status: NOERROR; id: 22792
;; Flags: qr tc rd ra; QUERY: 1; ANSWER: 0; AUTHORITY: 0; ADDITIONAL: 1

;; EDNS PSEUDOSECTION:
;; Version: 0; flags: do; UDP size: 512 B; ext-rcode: NOERROR

;; QUESTION SECTION:
;; error.              		IN	A

;; Received 34 B
;; Time 2024-07-11 12:01:27 EDT
;; From 8.8.8.8@53(UDP) in 2.8 ms

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/hickory-dns/hickory-dns/pull/2307 **Author:** [@leshow](https://github.com/leshow) **Created:** 7/11/2024 **Status:** ✅ Merged **Merged:** 7/26/2024 **Merged by:** [@bluejekyll](https://github.com/bluejekyll) **Base:** `main` ← **Head:** `fix_truncate` --- ### 📝 Commits (1) - [`2b43be4`](https://github.com/hickory-dns/hickory-dns/commit/2b43be49238674a7de6e4f827d13fb6683e730e3) leave query/opt in truncated msg ### 📊 Changes **1 file changed** (+18 additions, -7 deletions) <details> <summary>View changed files</summary> 📝 `crates/proto/src/op/message.rs` (+18 -7) </details> ### 📄 Description We were removing the query section on truncate, which some clients complain about, we forgot to drop `name_servers` and `signatures` though, which can be large. AFAICT this is what BIND will do, except if the message was sent without EDNS, then it will try to include parts of the response up to 512 bytes total. The safer thing here I think is to just add queries/opt and drop the other parts of the message. See an example here using google: this is a large message with signatures: ``` ❯ kdig @8.8.8.8 +notcp +dnssec A error. ;; ->>HEADER<<- opcode: QUERY; status: NXDOMAIN; id: 3612 ;; Flags: qr rd ra ad; QUERY: 1; ANSWER: 0; AUTHORITY: 6; ADDITIONAL: 1 ;; EDNS PSEUDOSECTION: ;; Version: 0; flags: do; UDP size: 512 B; ext-rcode: NOERROR ;; QUESTION SECTION: ;; error. IN A ;; AUTHORITY SECTION: . 86399 IN SOA a.root-servers.net. nstld.verisign-grs.com. 2024071100 1800 900 604800 86400 . 86399 IN RRSIG SOA 8 0 86400 20240724050000 20240711040000 20038 . Rnq2JmIMC4njiR5eGYnnuEte1BEfbldeyfx1SliE67OTYnIxl30ibPhTq0+D0nTbUefoaQHYGjvSM7oQYtvNx3AofST2mA6+dQq+NaanQ3fQfwFRWhqEpU4aLMrb9YYl7FzvI1VkLHbX8kYeoKElfeEbe07w8lt/KvFxp+QeogwH1iTYZsGlyQnEgv+7QTG4fjesV4YJ7tl4zYpHndROhft9iMfYN8MfVnOvl40vPap37lT1OaqWG6Db7rwvG7yGKc4NKa2EqUnZdkdb0b9wIUB6HRxPw2f558M6ZWOBL8PNKw1vwHQG2cSH0ipJaQdMZ4V2tNEDXHskL2m16+K6ZA== . 86398 IN NSEC aaa. NS SOA RRSIG NSEC DNSKEY ZONEMD . 86398 IN RRSIG NSEC 8 0 86400 20240724050000 20240711040000 20038 . yxr1n/TsFZhBQNGpKsjWdUqAlu4hm/1jM3/x+EEZdnEE819gCnZWj4InHf1ta2EuEagwJgJLbKOODh0F1KIqWAlwte51VxqK2Iw4ibcBy6LCak81LTV8SG2uNFDb1MupWwFCbkJjgC9XMa1EfKmHFvkXIIBfkwsyBF7irWql7YVvZXoPkyEQE28nzGYMt29AQOv/38OreMuDmShpkAwKMdUfK4e+k8UjfH69s74Sa/tRy5vAuUCuurCEfJK44eFE83JEP7kJpKxSYwecIp94nEWK9uFd33K/IRQ9HHppl7bja7O6eJGIXmVcBxt/ZAS1FXxg6XTckb10BrGuPfOuCg== erni. 40209 IN NSEC es. NS DS RRSIG NSEC erni. 40209 IN RRSIG NSEC 8 1 86400 20240723170000 20240710160000 20038 . vPSZZzZccbfs/h3CM461FlSYx4WTwNc7O2R395aVCKpkgcJrsAkrHcoix0+zaBL8iDN3jNRYxGa681HxtzGth9U/SHkyY1jZrttGZfLUtlAKSGncXQTq4hCH0hn8rbZ+PFbHAv5ejcR4FNfXtaaTTU1etSlch9dkCP+btrA+6LsbJEtHWju9qzGVG3v5lzAXsHVvRhglc/dnAODoyr0rvbLY43n+6YKU4NyE/Pzf3aQDhD5K4BnDDAMz24+wmtWcRhJhfo1X9d7Q1UHw8iYop0FV8eZ/4cJVuLKF0sYnt2x3Yr5C/u8WjABJPlf2TibWcFHnfko191CZ9KGw+QBXFg== ;; Received 1022 B ;; Time 2024-07-11 12:03:30 EDT ;; From 8.8.8.8@53(UDP) in 6.4 ms ``` and here, setting bufsize to 512 so we truncate, the response has kept query & opt but removed other sections (note: google changes response to NOERROR but other resolvers like cloudflare do not) ``` ❯ kdig @8.8.8.8 +notcp +dnssec +bufsize=512 A error. ;; ->>HEADER<<- opcode: QUERY; status: NOERROR; id: 22792 ;; Flags: qr tc rd ra; QUERY: 1; ANSWER: 0; AUTHORITY: 0; ADDITIONAL: 1 ;; EDNS PSEUDOSECTION: ;; Version: 0; flags: do; UDP size: 512 B; ext-rcode: NOERROR ;; QUESTION SECTION: ;; error. IN A ;; Received 34 B ;; Time 2024-07-11 12:01:27 EDT ;; From 8.8.8.8@53(UDP) in 2.8 ms ``` --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>