net: EDNS(0) records may cause dns dropped by some gateway

[ArisAachen]

Go version

go1.21.6

Output of go env in your module/workspace:

go env
GO111MODULE=''
GOARCH='amd64'
GOBIN=''
GOCACHE='/home/aris/.cache/go-build'
GOENV='/home/aris/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFLAGS=''
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMODCACHE='/home/aris/go/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/home/aris/go'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/lib/go'
GOSUMDB='sum.golang.org'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/lib/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.21.6'
GCCGO='gccgo'
GOAMD64='v1'
AR='ar'
CC='gcc'
CXX='g++'
CGO_ENABLED='1'
GOMOD='/dev/null'
GOWORK=''
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
PKG_CONFIG='pkg-config'
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build2887989632=/tmp/go-build -gno-record-gcc-switches'

What did you do?

package main

import (
	"log"
	"net"
	"os/exec"
	"time"
)

func main() {
	for {
		// clear dns
		cmd := exec.Command("/bin/sh", "-c", "/etc/init.d/dnsmasq restart")
		buf, err := cmd.CombinedOutput()
		if err != nil {
			log.Fatalln("clear dns failed, err: ", string(buf))
		}
		addrSl, err := net.LookupHost("www.baidu.com")
		if err != nil {
			log.Fatalln("LookupHost failed, err: ", err)
		}
		log.Println("LookupHost successfully, addr: ", addrSl)
		time.Sleep(3 * time.Second)
	}
}

What did you see happen?

read udp 168.1.100:34737 →192. 168.1.1:53: i/o timeout

but when i use nslookup, It works fine

/ # nslookup www.baidu.com
Server:
192.168.0.1
Address:
192.168.0.1:53
Non-authoritative answer:
Name:
baidu.com
Address: 110.242.68.66
Name:
baidu.com
Address: 39.156.66.10
Non-authoritative answer:

When I use tcpdump to caputure the dns flow,
use go query dns request

11:18:45.149677 IP (tos 0x0, ttl 64, id 43114, offset 0, flags [none], proto UDP (17), length 70)
    10.1.3.12.47571 > pdns.dnspod.cn.53: [bad udp cksum 0xa18a -> 0xca03!] 6460+ [1au] A? www.baidu.com. ar: . OPT UDPsize=1232 (42)

use nslookup to query

11:20:57.941432 IP (tos 0x0, ttl 64, id 53544, offset 0, flags [none], proto UDP (17), length 71)
    10.1.3.12.39956 > pdns.dnspod.cn.53: [bad udp cksum 0xa18b -> 0x9262!] 53164+ PTR? 29.29.29.119.in-addr.arpa. (43)

Then different is shown, golang use default udp size as default

Frame 21: 84 bytes on wire (672 bits), 84 bytes captured (672 bits)
Ethernet II, Src: ZhejiangEver_2f:c3:34 (c0:4a:09:2f:c3:34), Dst: HuaweiTechno_ab:9a:01 (58:ae:a8:ab:9a:01)
Internet Protocol Version 4, Src: 10.1.3.12, Dst: 223.5.5.5
User Datagram Protocol, Src Port: 60929, Dst Port: 53
Domain Name System (query)
    Transaction ID: 0x3d7f
    Flags: 0x0100 Standard query
    Questions: 1
    Answer RRs: 0
    Authority RRs: 0
    Additional RRs: 1
    Queries
        www.baidu.com: type A, class IN
            Name: www.baidu.com
            [Name Length: 13]
            [Label Count: 3]
            Type: A (1) (Host Address)
            Class: IN (0x0001)
    Additional records
        <Root>: type OPT
            Name: <Root>
            Type: OPT (41) 
            UDP payload size: 1232
            Higher bits in extended RCODE: 0x00
            EDNS0 version: 0
            Z: 0x0000
                0... .... .... .... = DO bit: Cannot handle DNSSEC security RRs
                .000 0000 0000 0000 = Reserved: 0x0000
            Data length: 0
    [Response In: 25]

Then I find some doc in Microsoft Website
link: https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/dns-name-queries-not-success

More information
Some firewalls contain features to check certain parameters of the DNS packet. These firewall features may make sure that the DNS response is smaller than 512 bytes. If you capture the network traffic for an unsuccessful DNS lookup, you may notice that DNS requests EDNS0. Frames that resemble the following don't receive a reply:

Additional records
<Root>: type OPT, class unknown
Name: <Root>
Type: EDNS0 option
UDP payload size: 1280

In this scenario, the firewall may drop all EDNS0-extended UDP frames.

What did you expect to see?

dns response successfully

[ArisAachen]

Im not sure if it is right
Maybe one choice is offering some options to change this default behavior
or?

Here is the code

func newRequest(q dnsmessage.Question, ad bool) (id uint16, udpReq, tcpReq []byte, err error) {
	var rh dnsmessage.ResourceHeader
	if err := rh.SetEDNS0(maxDNSPacketSize, dnsmessage.RCodeSuccess, false); err != nil {
		return 0, nil, nil, err
	}
	if err := b.OPTResource(rh, dnsmessage.OPTResource{}); err != nil {
		return 0, nil, nil, err
	}
}

[mateusz834]

How the cgo resolver behaves? Please run that example with GODEBUG=netdns=cgo or compile with -tags netcgo.

We use EDNS(0) by default and ignore edns0 option in resolv.conf See: #13279 (comment)

Let us know, we can make EDNS(0) opt-in the same way as cgo (glibc) resolver currently does.

[gopherbot]

Timed out in state WaitingForInfo. Closing.

(I am just a bot, though. Please speak up if this is a mistake or you have the requested information.)