<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Aptos;
panose-1:2 11 0 4 2 2 2 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Aptos",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#467886;
text-decoration:underline;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:11.0pt;
mso-ligatures:none;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="#467886" vlink="#96607D" style="word-wrap:break-word">
<div class="WordSection1">
<div>
<p class="MsoNormal">Hi systemd-devel,</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">I wanted to run a concern with systemd-resolved through the mailing list before opening an issue in the github.com repository. The below behavior does not reproduce with any other resolver I’ve used before.</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">I noticed that each time a program calls gethostbyaddr() a connection is attempted to the specified IP on port 5355 even when that IP is not link local nor in the private ranges specified in RFC-1918 [1].</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">This can be verified/seen using a fresh installation of Debian 12, however systemd-resolved must be installed. From this point, set the nftables outbound chain to log connections [2], then have an application call gethostbyaddr() [3]. A
log entry should appear with a destination port of 5355 and the IP should be consistent with the addr parameter used in the gethostbyaddr() call.</p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Port 5355 is used for LLMNR and RFC-4795 [4], states in the abstract that “LLMNR only operates on the local link” so I think the current behavior of contacting hosts on port 5355 is incorrect, especially if that host IP is not link-local
and not in the private IP range.</p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">An immeditate workaround to this behavior is to update the systemd-resolved configuration file and specify LLMNR=no and then reload/restart the resolved service.</p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Please let me know if this issue should be added to the github.com issue tracker.
</p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks,</p>
<p class="MsoNormal">Anthony</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">[1] <a href="https://www.rfc-editor.org/rfc/rfc1918.html">https://www.rfc-editor.org/rfc/rfc1918.html</a></p>
<p class="MsoNormal">[2] nft add rule inet filter output log prefix \"nftables: \"</p>
<p class="MsoNormal">[3] python3 -c 'import socket; socket.gethostbyaddr("131.252.210.176 ")'</p>
<p class="MsoNormal">[4 ] <a href="https://datatracker.ietf.org/doc/html/rfc4795">
https://datatracker.ietf.org/doc/html/rfc4795</a></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
<p><strong>TREND MICRO EMAIL NOTICE</strong></p>
<p>The information contained in this email and any attachments is confidential and may be subject to copyright or other intellectual property protection. If you are not the intended recipient, you are not authorized to use or disclose this information, and
we request that you notify us by reply mail or telephone and delete the original message from your mail system.</p>
<p>For details about what personal information we collect and why, please see our Privacy Notice on our website at:
<a href="http://www.trendmicro.com/privacy" target="_blank"><span style="color: #cc0000;">Read privacy policy</span></a></p>
</body>
</html>