2023-02-25
Systemd-resolved plus LLMNR can create delays in name non-resolution
I recently switched my work and home desktops over to systemd-resolved from my previous tangle of an Unbound
configuration. Some time later, on my home desktop I accidentally
typo'd the name of a host I was trying to SSH to and discovered that
there was an appreciable pause and delay before SSH gave up with 'no
such host'. Some testing showed that I could reproduce this in other
programs for any non-existent name with no dots in it, and helpfully
it even reproduced with 'resolvectl query nosuchhost'.
Resolvectl
itself doesn't have any sort of 'trace' or 'debug' option that will
explain what it's doing during name resolution, but you can gingerly
turn on debug logging for resolved with 'resolvectl log-level
debug' (and then hastily turn it off afterward), and if you're
lucky not too many other name resolutions will be going on at the
same time. Eventually I was able to get lucky and track down what
was going on,
which was that systemd-resolved was trying to resolve these names
by doing Link-Local Multicast Name Resolution (LLMNR) over
my home machine's DSL PPPoE link. Naturally there was nothing
responding to them, so resolved had to wait for a several-second
timeout before it could declare that there was no such name out
there. Turning LLMNR off on my PPPoE link made the delays go away,
so now nonexistent names fail more or less immediately.
It's possible that if you set up a DSL PPPoE link with NetworkManager, NM will automatically tell resolved to not try LLMNR over the link. I don't use NM here (although I may need to switch someday), so my PPPoE link still had LLMNR enabled in resolved, although I'd turned off LLMNR for everything else. On my work desktop I explicitly configured LLMNR off globally in systemd-resolved, but I hadn't done that at home because it seemed possible that maybe I'd want it someday (that's now changed).
(As a system administrator, the idea that something on the network can just decide to start resolving names and get systems to listen to its views is not exactly a good thought. But things designed for home networks don't necessarily care about my opinions. On the other hand, Wikipedia tells me that the big user of LLMNR is Microsoft, and Microsoft is in process of phasing it out in favour of mDNS, which I already had off.)
I'll probably want to keep my eyes open for this happening on any machines I run systemd-resolved on. Although it doesn't seem to happen on another machine that does have LLMNR resolution enabled on its Ethernet link, so who knows; there may be other resolvectl things I have set that affect this. Whatever it is, I'm just happy that now my typos fail immediately.