[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20171004201850.GD1627@brightrain.aerifal.cx>
Date: Wed, 4 Oct 2017 16:18:50 -0400
From: Rich Felker <dalias@...c.org>
To: musl@...ts.openwall.com
Subject: Re: DNS resolution happenning only after timeout
On Wed, Oct 04, 2017 at 07:28:35PM +0000, Srinivasa Raghavan wrote:
> Hi Markus,
>
> Thanks for the reply.
>
> The problem is not only in nslookup, it is there in ping, tracert, curl,
> node.js, wget etc. :(
>
> I will debug and find the exact c api that is used for each of the
> scenarios.
>
> I am just wondering if there is any workaround ?
>
> Lot of folks are facing this issue (slow dns name resolution in alpine
> linux, with some dns servers) , and this may be the root cause?
musl does not have any way to suppress applications' requests for IPv6
lookups. In theory if an application used the AI_ADDRCONF option to
request "only give IPv6 results if IPv6 is supported" we could do it,
but there are multiple reasons this hasn't been implemented including
ambiguity as to how exactly it should behave, and I doubt it would
help anyway since most applications don't use this option.
>From the info you've provided so far, my best guess is that you have a
buggy nameserver that either stalls or replies with a non-conclusive
message like ServFail when it receives an AAAA query. If this is the
case, there are a few possible fixes or workarounds you could try:
1. If the nameserver is on a device under your control, see if there's
an upgrade/patch to fix the issue.
2. Switch to a different nameserver without the bug like the public
Google ones at 8.8.8.8 etc.
3. Run your own caching/proxy nameserver on localhost and configure it
to reply NxDomain (does not exist) for all AAAA lookups.
4. Use iptables to catch DNS query packets for AAAA records and
redirect them to a dummy server that just always replies with
NxDomain.
Without knowing more about your environment I can't really guess which
ones of these options, if any, might be practical for you but
hopefully at least one is.
Rich
> On Wed, 4 Oct 2017 at 10:16 PM, Markus Wichmann <nullplan@....net> wrote:
>
> > On Wed, Oct 04, 2017 at 07:18:10PM +0530, Srinivasa Raghavan wrote:
> > > Hi Rich,
> > >
> > > Thanks for the reply.
> > >
> > > Some updates:
> > > 1. Our DNS server is "Infoblox appliance".
> > > 2. When we had a delay, we found that there was a "AAAA" query along with
> > > "A" query.
> > >
> > > I did further debugging with "tcpdump" and able to narrow down on the
> > > difference in behavior between "debian" and "alpine" images.
> > >
> > > In debian:
> > > If ipv6 is disabled (net.ipv6.conf.default.disable_ipv6 = 1)
> > > Then the "nslookup" (or name resolution) does *not* do a "AAAA" query
> > >
> >
> > That's probably because glibc's DNS resolver only generates AAAA queries
> > if it can create an IPv6 socket.
> >
> > > In alpine:
> > > If ipv6 is disabled (net.ipv6.conf.default.disable_ipv6 = 1)
> > > Then the "nslookup" (or name resolution) does an "AAAA" query along with
> > > "A" query
> > >
> > > Is this intentional?
> > >
> > > Also, I was wondering if there was any way to disable AAAA query in name
> > > resolution?
> > >
> >
> > There does not appear to be a way without changing code. In musl, the
> > function name_from_dns() will always generate both the AAAA and the A
> > query unless "family" is explicitly set to one of the address families.
> > No input from resolv.conf or similar is used for this. And "family"
> > comes directly from the caller, i.e. nslookup. You'd have to change the
> > nslookup code to only ask for IPv4 addresses.
> >
> > > Kind Regards,
> > > Srinivasa Raghavan.
> >
> > Ciao,
> > Markus
> >
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
