RDKCOM-5501: RDKBDEV-3351 Fix for EDNS package size incorrect, CVE-2023-28450 by owen-lu-sercomm · Pull Request #192 · rdkcentral/utopia

owen-lu-sercomm · 2026-01-27T10:28:01Z

Reason for change:
An issue was discovered in Dnsmasq before 2.90. The default maximum EDNS.0 UDP packet size was set to 4096 but should be 1232 because of DNS Flag Day 2020.
Test Procedure:

Capture packages on lan client
Send query with edns from lan client
Check the UDP payload size in the Additional records in DNS response package, which should be 1232 instead of 4096
Risks: Low

Signed-off-by: Owen Lu owen_lu@sercomm.com

SanthoshGujulvajagadeesh

-P option should be set to 1232 instead of 4096 since the dnsmasq version currently used is 2.83 which doesn't set default EDNS UDP packet size to 1232.
'-P 4096' needs to be replaced with '-P 1232' in many places.

AkhilaReddyK7 · 2026-04-02T05:19:09Z

@SanthoshGujulvajagadeesh
Review comments are addressed. Can you please review and merge the PR.

SanthoshGujulvajagadeesh · 2026-04-07T10:47:22Z

@AkhilaReddyK7 Need to know for which platforms this change is applicable

GoutamD2905

Requested DevQA Tina to validate the test procedure shared in RDKCOM-5501

tinaelizabeth84 · 2026-04-20T14:15:13Z

@GoutamD2905 Could you please check the test results?

GoutamD2905 · 2026-04-27T14:08:45Z

@owen-lu-sercomm

Could you please add the pack size changes under the non-Comcast platform–specific flag, as shown in the code below?

else
                if [ non-comcast platform ]
                $SERVER -P 1232 -C $DHCP_CONF $DNS_ADDITIONAL_OPTION  #--enable-dbus
                else
                $SERVER -P 4096 -C $DHCP_CONF $DNS_ADDITIONAL_OPTION  #--enable-dbus
                fi
fi

CC : @tinaelizabeth84

owen-lu-sercomm · 2026-05-14T06:59:19Z

@GoutamD2905 , I have added non-Comcast platform–specific flag, please help review

pradeeptakdas · 2026-05-20T18:50:28Z

Hi @owen-lu-sercomm

Thanks for your patience.

We discussed this internally with the component owners , and they’re aligned on accepting this as a generic change without any vendor-specific conditional flag. One suggestion from them is to add a new Custom RFC parameter for the packet size, with the default set to 1232, so we can adjust it at runtime if any issues are observed in field deployments.

Please let us know if you have any question or concern .

CC @anoopchelakkode , @snayak002c , @sshriv323 , @SanthoshGujulvajagadeesh , @GoutamD2905

github-actions · 2026-07-16T05:55:12Z

📋 PR Format Reminder

Description missing:
- Priority (P0 / P1 / P2)

Expected:

TICKET-123 : brief description

Reason for change: why
Test Procedure: how to verify
Risks: Low / Medium / High
Priority: P0 / P1 / P2

Copilot

Pull request overview

Adjusts dnsmasq startup parameters in the DHCP/DNS service script to address the incorrect default EDNS.0 UDP packet size (per DNS Flag Day 2020 / CVE context).

Changes:

Reads PartnerID and an edns_packet_size syscfg value when starting dnsmasq in the non-XDNS path.
Defaults EDNS packet size to 1232 for non-Comcast partners, while keeping 4096 for Comcast.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

+                PARTNER_ID=$(syscfg get PartnerID)
+                EDNS_PACKET_SIZE=$(syscfg get edns_packet_size)
+                EDNS_PACKET_SIZE=${EDNS_PACKET_SIZE:-1232}
+                if [ "$PARTNER_ID" != "comcast" ]; then
+                    $SERVER -P $EDNS_PACKET_SIZE -C $DHCP_CONF $DNS_ADDITIONAL_OPTION  #--enable-dbus
+                else
+                    $SERVER -P 4096 -C $DHCP_CONF $DNS_ADDITIONAL_OPTION  #--enable-dbus
+                fi


+                if [ "$PARTNER_ID" != "comcast" ]; then
+                    $SERVER -P $EDNS_PACKET_SIZE -C $DHCP_CONF $DNS_ADDITIONAL_OPTION  #--enable-dbus
+                else
+                    $SERVER -P 4096 -C $DHCP_CONF $DNS_ADDITIONAL_OPTION  #--enable-dbus
+                fi


Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 2 comments.

+                PARTNER_ID=$(syscfg get PartnerID)
+                EDNS_PACKET_SIZE=$(syscfg get edns_packet_size)
+                EDNS_PACKET_SIZE=${EDNS_PACKET_SIZE:-1232}
+                if [ "$PARTNER_ID" != "comcast" ]; then
+                    $SERVER -P $EDNS_PACKET_SIZE -C $DHCP_CONF $DNS_ADDITIONAL_OPTION  #--enable-dbus
+                else
+                    $SERVER -P 4096 -C $DHCP_CONF $DNS_ADDITIONAL_OPTION  #--enable-dbus
+                fi


+                if [ "$PARTNER_ID" != "comcast" ]; then
+                    $SERVER -P $EDNS_PACKET_SIZE -C $DHCP_CONF $DNS_ADDITIONAL_OPTION  #--enable-dbus
+                else
+                    $SERVER -P 4096 -C $DHCP_CONF $DNS_ADDITIONAL_OPTION  #--enable-dbus
+                fi


…for the packet size,add default syscfg edns_packet_size=1232. CVE-2023-28450 Reason for change: Add an RFC option to control the EDNS packet size. Test Procedure: 1. Capture packages on lan client 2. Send query with edns from lan client 3. Check the UDP payload size in the Additional records in DNS response package, which should be 1232 instead of 4096 4. set Device.DeviceInfo.X_RDKCENTRAL-COM_RFC.Feature.EDNSPacketSize to 1800 5. Send query with edns from lan client 6. Check the UDP payload size in the Additional records in DNS response package, which should be 1800 Risks: Low Priority:P3 Signed-off-by: Owen Lu <owen_lu@sercomm.com>

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

+#Edns Packet Size
+$edns_packet_size=1232


+#Edns Packet Size
+$edns_packet_size=1232


+#Edns Packet Size
+$edns_packet_size=1232


…for the packet size. CVE-2023-28450 Reason for change: Add an RFC option to control the EDNS packet size. Test Procedure: 1. Capture packages on lan client 2. Send query with edns from lan client 3. Check the UDP payload size in the Additional records in DNS response package, which should be 1232 instead of 4096 4. set Device.DeviceInfo.X_RDKCENTRAL-COM_RFC.Feature.EDNSPacketSize to 1800 5. Send query with edns from lan client 6. Check the UDP payload size in the Additional records in DNS response package, which should be 1800 Risks: Low Signed-off-by: Owen Lu <owen_lu@sercomm.com>

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

+                PARTNER_ID=$(syscfg get PartnerID)
+                EDNS_PACKET_SIZE=$(syscfg get edns_packet_size)
+                EDNS_PACKET_SIZE=${EDNS_PACKET_SIZE:-1232}
+                if [ "$PARTNER_ID" != "comcast" ]; then
+                    $SERVER -P $EDNS_PACKET_SIZE -C $DHCP_CONF $DNS_ADDITIONAL_OPTION  #--enable-dbus
+                else
+                    $SERVER -P 4096 -C $DHCP_CONF $DNS_ADDITIONAL_OPTION  #--enable-dbus
+                fi


owen-lu-sercomm requested review from a team as code owners January 27, 2026 10:28

pradeeptakdas changed the title ~~RDKBDEV-3351:Fix for EDNS package size incorrect, CVE-2023-28450~~ RDKCOM-5501: RDKBDEV-3351 Fix for EDNS package size incorrect, CVE-2023-28450 Jan 27, 2026

tinaelizabeth84 force-pushed the RDKBDEV-3351 branch from 8bf115f to 944d4f5 Compare February 13, 2026 17:06

tinaelizabeth84 force-pushed the RDKBDEV-3351 branch from 944d4f5 to b354aa0 Compare March 2, 2026 19:05

SanthoshGujulvajagadeesh requested changes Mar 13, 2026

View reviewed changes

AkhilaReddyK7 added the community-contribution Contribution from community label Mar 17, 2026

tinaelizabeth84 force-pushed the RDKBDEV-3351 branch from d55306a to 6a6be70 Compare March 20, 2026 18:36

SanthoshGujulvajagadeesh previously approved these changes Apr 2, 2026

View reviewed changes

SanthoshGujulvajagadeesh self-requested a review April 7, 2026 10:43

GoutamD2905 reviewed Apr 13, 2026

View reviewed changes

tinaelizabeth84 force-pushed the RDKBDEV-3351 branch from 7632fc7 to d7087ff Compare April 21, 2026 15:05

AkhilaReddyK7 assigned GoutamD2905 Apr 22, 2026

AkhilaReddyK7 assigned owen-lu-sercomm and unassigned GoutamD2905 Apr 29, 2026

owen-lu-sercomm dismissed SanthoshGujulvajagadeesh’s stale review via 24297da May 14, 2026 06:57

AkhilaReddyK7 assigned SanthoshGujulvajagadeesh and unassigned owen-lu-sercomm May 18, 2026

Copilot AI review requested due to automatic review settings July 16, 2026 05:55

Copilot started reviewing on behalf of owen-lu-sercomm July 16, 2026 05:55 View session

Copilot AI reviewed Jul 16, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings July 16, 2026 07:08

Copilot started reviewing on behalf of owen-lu-sercomm July 16, 2026 07:09 View session

Copilot AI reviewed Jul 16, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings July 16, 2026 09:07

owen-lu-sercomm force-pushed the RDKBDEV-3351 branch from 48a2d9a to b92272e Compare July 16, 2026 09:07

Copilot started reviewing on behalf of owen-lu-sercomm July 16, 2026 09:08 View session

Copilot AI reviewed Jul 16, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings July 16, 2026 09:31

Copilot started reviewing on behalf of owen-lu-sercomm July 16, 2026 09:32 View session

Copilot AI reviewed Jul 16, 2026

View reviewed changes

		#Edns Packet Size
		$edns_packet_size=1232

		#Edns Packet Size
		$edns_packet_size=1232

		#Edns Packet Size
		$edns_packet_size=1232

Uh oh!

Conversation

owen-lu-sercomm commented Jan 27, 2026

Uh oh!

SanthoshGujulvajagadeesh left a comment

Choose a reason for hiding this comment

Uh oh!

AkhilaReddyK7 commented Apr 2, 2026

Uh oh!

SanthoshGujulvajagadeesh commented Apr 7, 2026

Uh oh!

GoutamD2905 left a comment

Choose a reason for hiding this comment

Uh oh!

tinaelizabeth84 commented Apr 20, 2026

Uh oh!

GoutamD2905 commented Apr 27, 2026

Uh oh!

owen-lu-sercomm commented May 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pradeeptakdas commented May 20, 2026

Uh oh!

github-actions Bot commented Jul 16, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

owen-lu-sercomm commented May 14, 2026 •

edited

Loading