Public bug reported: [Impact]
On Ubuntu 26.04 LTS with bind9 [1:9.20.24-1ubuntu0.3], a recursive resolver that forwards queries over DNS-over-TLS stops resolving external names after some time. Every external query ends in SERVFAIL, while authoritative/internal zones keep working. The resolver logs show: named[...]: shut down hung fetch while resolving <name>/A named[...]: client @... <client>#<port> (<name>): query failed (SERVFAIL) for <name>/IN/A Sockets in CLOSE-WAIT towards the forwarder on port 853 accumulate continuously: $ ss -tn state close-wait '( dport = :853 )' | wc -l [N] The forwarder itself is healthy: querying it directly from the same host with `dig +tls +tls-ca +tls-hostname=<name>` works, and TCP/853 is reachable. Two independent servers with the same configuration failed at the same time. Restarting named restores service only temporarily. Root cause (upstream): BIND 9.20.23 introduced outgoing TCP connection reuse (GL !11845). named could hand a new query to an idle forwarder/upstream TCP or TLS connection that the peer had already closed, so the query hangs until timeout and CLOSE-WAIT sockets pile up. This was fixed upstream in BIND 9.20.26: "Stop reusing outgoing TCP connections the peer has already closed" https://gitlab.isc.org/isc-projects/bind9/-/issues/6171 9.20 backport: https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/12317 The same issue was reported on bind-users for 9.20.23 on Debian 13: https://lists.isc.org/pipermail/bind-users/2026-June/110653.html The current resolute-updates package (9.20.24 plus security patches) does not include this fix. Even the development series is still on 9.20.24. Any 26.04 server that uses DoT forwarders (a common privacy setup) is affected, and the failure is a complete outage of external resolution. [Test Plan] 1. Install bind9 on 26.04 and configure DoT forwarding, e.g.: tls cloudflare { remote-hostname "cloudflare-dns.com"; ca-file "/etc/ssl/certs/ca-certificates.crt"; }; options { forwarders port 853 tls cloudflare { 1.1.1.1; 1.0.0.1; }; forward only; }; 2. Send a steady stream of recursive queries for random external names, with idle gaps longer than the upstream's idle timeout. 3. Observe CLOSE-WAIT sockets to port 853 growing: ss -tn state close-wait '( dport = :853 )' | wc -l 4. Observe "shut down hung fetch" and SERVFAIL in the logs. With the fixed package, CLOSE-WAIT sockets should stay at or near zero and queries should keep resolving. [Where problems could occur] The fix changes how named tracks idle outgoing TCP/TLS connections in the dispatch layer. Regressions could affect resolver queries over TCP/DoT (forwarding and iterative TCP fallback), for example extra reconnects or latency. The upstream backport also adds a new `tcp-reuse-timeout` option (default 5s); existing configurations do not need it. [Other Info] - Ubuntu release: 26.04.1 LTS - Package: bind9 [1:9.20.24-1ubuntu0.3] - Issue started after upgrade to 9.20.24 on: [date from apt history] - Forwarder: Cloudflare 1.1.1.1 / 1.0.0.1 over DoT (port 853) - Workaround: periodic restart of named, or `forward first;` - Latest upstream 9.20 release: 9.20.29 ProblemType: Bug DistroRelease: Ubuntu 26.04 Package: bind9 1:9.20.24-1ubuntu0.3 ProcVersionSignature: Ubuntu 7.0.0-38.38-generic 7.0.14 Uname: Linux 7.0.0-38-generic x86_64 ApportVersion: 2.34.1-0ubuntu0.1 Architecture: amd64 CasperMD5CheckResult: unknown CloudArchitecture: x86_64 CloudID: nocloud CloudName: unknown CloudPlatform: nocloud CloudSubPlatform: seed-dir (/var/lib/cloud/seed/nocloud-net) Date: Sat Oct 10 10:05:48 2026 ProcEnviron: LANG=en_GB.UTF-8 PATH=(custom, no user) SHELL=/bin/bash TERM=xterm XDG_RUNTIME_DIR=<set> RelatedPackageVersions: bind9utils N/A apparmor 5.0.2-0ubuntu1~26.04.1 SourcePackage: bind9 UpgradeStatus: Upgraded to resolute on 2026-10-06 (4 days ago) mtime.conffile..etc.bind.named.conf: 2026-10-06T10:12:30.630724 mtime.conffile..etc.bind.named.conf.local: 2021-02-25T20:10:40.158314 mtime.conffile..etc.bind.named.conf.options: 2026-10-06T10:42:31.246653 ** Affects: bind9 (Ubuntu) Importance: Undecided Status: New ** Tags: amd64 apport-bug resolute -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2170433 Title: bind9 9.20.24: DoT forwarding fails with SERVFAIL, CLOSE-WAIT sockets pile up (fixed upstream in 9.20.26, GL #6171) To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/bind9/+bug/2170433/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
