You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@spamassassin.apache.org by bu...@spamassassin.apache.org on 2026/10/05 09:19:43 UTC
[Bug 8432] New: TCP fallback for truncated UDP replies ignores the port from dns_server [ip]:port; retries go to port 53 and fail
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=8432
Bug ID: 8432
Summary: TCP fallback for truncated UDP replies ignores the
port from dns_server [ip]:port; retries go to port 53
and fail
Product: Spamassassin
Version: SVN Trunk (Latest Devel Version)
Hardware: PC
OS: Linux
Status: NEW
Severity: major
Priority: P2
Component: spamassassin
Assignee: dev@spamassassin.apache.org
Reporter: hasse-spamassassin@hagenjohansen.dk
Target Milestone: Undefined
`Mail::SpamAssassin::DnsResolver::load_resolver()` strips the port from
`dns_server` entries when configuring the underlying Net::DNS::Resolver object:
```perl
my @ns_addr_port =
$self->available_nameservers();
# drop port numbers,
Net::DNS::Resolver can't take them
@ns_addr_port =
map(/^\[(.*)\]:(\d+)\z/ ? $1 : $_, @ns_addr_port);
$res->nameservers(@ns_addr_port);
```
This is fine for SA's own async query
engine (which honors `[ip]:port`), but the bug 8225 TCP-fallback code
(DnsResolver.pm, ~line 846, `# bug 8225 - Do TCP fallback ... by retrying using
Net::DNS::Resolver bgsend and bgread`) retries through that same port-stripped
resolver. With a resolver configured on a nonstandard port (e.g. `dns_server
127.0.0.1:5352` for a local unbound), the retry is sent to port 53, where
nothing listens. The retry times out after the hardcoded `udp_timeout(3)` and
`bgread()` returns undef without setting `$!` or `$@`, producing the low-signal
error:
```
info:
dns: bad dns tcp fallback reply: errno=
```
Consequences: every lookup whose reply exceeds
the UDP payload size silently fails. Most visibly this breaks SPF:
`T_SPF_TEMPERROR` for any sender domain with a large TXT record set (e.g.
github.com, TXT currently 1928 bytes), and raises scan times from ~8 s to ~36 s
because SPF burns its full timeout budget waiting for the fallback that never
returns.
## Steps to reproduce
1. Run a local
recursive resolver on a nonstandard port; configure `dns_server
127.0.0.1:5352`. Nothing must listen on 127.0.0.1:53.
2. Scan a
message from a domain whose TXT answer exceeds the UDP payload size:
`spamassassin -D
dns,spf < message.eml`
3. Observed (SA 4.0.2, Net::DNS
1.54):
```
dbg: dns: bgsend, DNS servers: [127.0.0.1]:5352
dbg:
dns: bgread: received 39 bytes from 127.0.0.1 # truncated UDP reply, TC
set
dbg: dns: TCP
fallback retry with github.com, TXT, IN
info: dns: bad dns tcp
fallback reply: errno= # after ~3 s
dbg: spf: ... result: temperror ...
Time-out on DNS 'TXT' lookup of 'github.com'
```
Control: with
the same resolver reachable on port 53 and `dns_server 127.0.0.1`, the fallback
succeeds and SPF returns pass. A plain Net::DNS::Resolver created with `port =>
5352` performs the identical UDP-truncation → TCP retry sequence correctly,
which isolates the failure to SA's port stripping.
## Current status in trunk
Both the port-stripping in `load_resolver()` and the fallback delegating to
`get_resolver()` are unchanged in trunk HEAD (checked in the GitHub mirror,
lib/Mail/SpamAssassin/DnsResolver.pm as of commit 67445fc, 2025-01-16). The
related recent commit 67445fc only switches Plugin/DKIM.pm to SA's custom
resolver; it does not address the reopened 8225 issue.
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 8432] TCP fallback for truncated UDP replies ignores the port from dns_server [ip]:port; retries go to port 53 and fail
Posted by bu...@spamassassin.apache.org.
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=8432
Giovanni Bechis <gi...@paclan.it> changed:
What |Removed |Added
----------------------------------------------------------------------------
Target Milestone|Undefined |4.0.3
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 8432] TCP fallback for truncated UDP replies ignores the port from dns_server [ip]:port; retries go to port 53 and fail
Posted by bu...@spamassassin.apache.org.
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=8432
Giovanni Bechis <gi...@paclan.it> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |giovanni@paclan.it
--- Comment #3 from Giovanni Bechis <gi...@paclan.it> ---
+1 on sidney@ patch
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 8432] TCP fallback for truncated UDP replies ignores the port from dns_server [ip]:port; retries go to port 53 and fail
Posted by bu...@spamassassin.apache.org.
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=8432
Hasse Hagen Johansen <ha...@hagenjohansen.dk> changed:
What |Removed |Added
----------------------------------------------------------------------------
Depends on| |8225, 8280
CC| |hasse-spamassassin@hagenjoh
| |ansen.dk
Referenced Bugs:
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=8225
[Bug 8225] askdns TCP fallback not working with UDP truncated TXT response
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=8280
[Bug 8280] spf fails if too much DNS TXT data
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 8432] TCP fallback for truncated UDP replies ignores the port from dns_server [ip]:port; retries go to port 53 and fail
Posted by bu...@spamassassin.apache.org.
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=8432
Kent Oyer <ke...@mxguardian.net> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |kent@mxguardian.net
--- Comment #4 from Kent Oyer <ke...@mxguardian.net> ---
+1 on Sidney's patch
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 8432] TCP fallback for truncated UDP replies ignores the port from dns_server [ip]:port; retries go to port 53 and fail
Posted by bu...@spamassassin.apache.org.
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=8432
Sidney Markowitz <si...@sidney.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Attachment #6101|0 |1
is obsolete| |
CC| |sidney@sidney.com
--- Comment #2 from Sidney Markowitz <si...@sidney.com> ---
Created attachment 6127
--> https://bz.apache.org/SpamAssassin/attachment.cgi?id=6127&action=edit
Revised patch for custom port
I've attached a revised patch that fixes two things:
1. The bug affects CNAME lookups as well as SPF, and the proposed patch still
sends the CNAME lookups to port 53 when dns_server has entries with different
ports and the first one isn't on port 53. The revised patch gives
Net::DNS::Resolver only the servers with the same port as the first entry.
SpamAssassin's own lookups still use all of them.
2. Really minor tweak to handle a rare case of a truncated reply to a lookup of
a name with a slash in it, like include:a/b.example.com in an SPF record.
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 8432] TCP fallback for truncated UDP replies ignores the port from dns_server [ip]:port; retries go to port 53 and fail
Posted by bu...@spamassassin.apache.org.
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=8432
--- Comment #1 from Giovanni Bechis <gi...@paclan.it> ---
Created attachment 6101
--> https://bz.apache.org/SpamAssassin/attachment.cgi?id=6101&action=edit
use a custom port in tcp fallback
use a custom port in tcp fallback, if dns fails over udp, switch immediately to
tcp without retrying a second time.
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 8432] TCP fallback for truncated UDP replies ignores the port from dns_server [ip]:port; retries go to port 53 and fail
Posted by bu...@spamassassin.apache.org.
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=8432
Sidney Markowitz <si...@sidney.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
Resolution|--- |FIXED
--- Comment #5 from Sidney Markowitz <si...@sidney.com> ---
% svn commit -m "Bug 8432 - TCP fallback for truncated DNS replies uses the
port from dns_server" lib/Mail/SpamAssassin/DnsResolver.pm
Sending lib/Mail/SpamAssassin/DnsResolver.pm
Transmitting file data .done
Committing transaction...
Committed revision 1939275.
--
You are receiving this mail because:
You are the assignee for the bug.