systemd-resolved doesn't set IP_RECVERR, and thus misses out on ICMP error feedback

[isomer]

Is your feature request related to a problem? Please describe.

systemd-resolved attempts to handle the case where an ICMP error is received in response to a DNS request to an upstream server (https://github.com/systemd/systemd/blob/master/src/resolve/resolved-dns-transaction.c#L1187)

However, systemd-resolved never sets IP_RECVERR on the fd (see ip(7),ipv6(7)), so the kernel will not report these errors back to systemd-resolved, thus causing systemd-resolved up waiting for the entire DNS timeout before continuing on to another nameserver.

This provides a terrible user experience in situations where one upstream nameserver is temporarily unreachable.

Describe the solution you'd like

I believe that somewhere (possibly in dns_scope_socket()?) should contain a line similar to:
setsockopt(fd, SOL_IP, family == AF_INET ? IP_RECVERR : IPV6_RECVERR, &one, sizeof(one));

Then unreachable ICMP errors will be returned by the kernel to systemd-resolved, which will immediately treat the packet as lost avoiding the extremely long wait time.

Describe alternatives you've considered
The obvious alternative is to do nothing, and wait for the full timeout.

[poettering]

hmm, to my knowledge this does not enable us to receive more errors, but just more details about the same errors. And I am not sure why this should matter to us: as long as we notified about all errors, it doesn't matter what the precise reason why we didn't reach a DNS server. Or am I missing something?

[isomer]

RECVERR means that the socket remembers that there was an error (and all the information about what that error was), without it you get no notification that there was any asynchronous error on the socket. As an added bonus, you also get a bunch of information about that error (which you don't care about).

Trivial example: https://gist.github.com/isomer/e9a3cf917123e1175ba80b4ca6670166

$ make recverr
$ strace ./recverr
<snip ridiculous amount of output>
socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 3
sendto(3, "Hello world\0", 12, 0, {sa_family=AF_INET, sin_port=htons(54), 
sin_addr=inet_addr("127.0.0.1")}, 16) = 12
recvmsg(3,  <hangs>

uncomment the line and:

$ make recverr
$ strace ./recverr
<snip more stuff>
socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 3
setsockopt(3, SOL_IP, IP_RECVERR, [1], 4) = 0
sendto(3, "Hello world\0", 12, 0, {sa_family=AF_INET, sin_port=htons(54), sin_addr=inet_addr("127.0.0.1")}, 16) = 12
recvmsg(3, {msg_namelen=16}, 0)         = -1 ECONNREFUSED (Connection refused)

Without IP_RECVERR you get no errno back from recvmsg(2) and it hangs, systemd-resolved then has to wait for a full timeout, despite there being information it could use to shortcut that.

[poettering]

interesting. If only the man pages would make this clearer...

Sounds like an easy fix.