From mboxrd@z Thu Jan 1 00:00:00 1970 X-Msuck: nntp://news.gmane.org/gmane.linux.lib.musl.general/11979 Path: news.gmane.org!.POSTED!not-for-mail From: Rich Felker Newsgroups: gmane.linux.lib.musl.general Subject: Re: DNS resolution happenning only after timeout Date: Wed, 4 Oct 2017 16:18:50 -0400 Message-ID: <20171004201850.GD1627@brightrain.aerifal.cx> References: <20170928102854.GI15263@port70.net> <20170928165528.GA1627@brightrain.aerifal.cx> <20171004164638.4k3ozfsavcsthmhw@voyager> Reply-To: musl@lists.openwall.com NNTP-Posting-Host: blaine.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Trace: blaine.gmane.org 1507148344 22167 195.159.176.226 (4 Oct 2017 20:19:04 GMT) X-Complaints-To: usenet@blaine.gmane.org NNTP-Posting-Date: Wed, 4 Oct 2017 20:19:04 +0000 (UTC) User-Agent: Mutt/1.5.21 (2010-09-15) To: musl@lists.openwall.com Original-X-From: musl-return-11992-gllmg-musl=m.gmane.org@lists.openwall.com Wed Oct 04 22:19:01 2017 Return-path: Envelope-to: gllmg-musl@m.gmane.org Original-Received: from mother.openwall.net ([195.42.179.200]) by blaine.gmane.org with smtp (Exim 4.84_2) (envelope-from ) id 1dzq8B-00058T-Ut for gllmg-musl@m.gmane.org; Wed, 04 Oct 2017 22:19:00 +0200 Original-Received: (qmail 10030 invoked by uid 550); 4 Oct 2017 20:19:04 -0000 Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Original-Received: (qmail 10006 invoked from network); 4 Oct 2017 20:19:03 -0000 Content-Disposition: inline In-Reply-To: Original-Sender: Rich Felker Xref: news.gmane.org gmane.linux.lib.musl.general:11979 Archived-At: On Wed, Oct 04, 2017 at 07:28:35PM +0000, Srinivasa Raghavan wrote: > Hi Markus, > > Thanks for the reply. > > The problem is not only in nslookup, it is there in ping, tracert, curl, > node.js, wget etc. :( > > I will debug and find the exact c api that is used for each of the > scenarios. > > I am just wondering if there is any workaround ? > > Lot of folks are facing this issue (slow dns name resolution in alpine > linux, with some dns servers) , and this may be the root cause? musl does not have any way to suppress applications' requests for IPv6 lookups. In theory if an application used the AI_ADDRCONF option to request "only give IPv6 results if IPv6 is supported" we could do it, but there are multiple reasons this hasn't been implemented including ambiguity as to how exactly it should behave, and I doubt it would help anyway since most applications don't use this option. >From the info you've provided so far, my best guess is that you have a buggy nameserver that either stalls or replies with a non-conclusive message like ServFail when it receives an AAAA query. If this is the case, there are a few possible fixes or workarounds you could try: 1. If the nameserver is on a device under your control, see if there's an upgrade/patch to fix the issue. 2. Switch to a different nameserver without the bug like the public Google ones at 8.8.8.8 etc. 3. Run your own caching/proxy nameserver on localhost and configure it to reply NxDomain (does not exist) for all AAAA lookups. 4. Use iptables to catch DNS query packets for AAAA records and redirect them to a dummy server that just always replies with NxDomain. Without knowing more about your environment I can't really guess which ones of these options, if any, might be practical for you but hopefully at least one is. Rich > On Wed, 4 Oct 2017 at 10:16 PM, Markus Wichmann wrote: > > > On Wed, Oct 04, 2017 at 07:18:10PM +0530, Srinivasa Raghavan wrote: > > > Hi Rich, > > > > > > Thanks for the reply. > > > > > > Some updates: > > > 1. Our DNS server is "Infoblox appliance". > > > 2. When we had a delay, we found that there was a "AAAA" query along with > > > "A" query. > > > > > > I did further debugging with "tcpdump" and able to narrow down on the > > > difference in behavior between "debian" and "alpine" images. > > > > > > In debian: > > > If ipv6 is disabled (net.ipv6.conf.default.disable_ipv6 = 1) > > > Then the "nslookup" (or name resolution) does *not* do a "AAAA" query > > > > > > > That's probably because glibc's DNS resolver only generates AAAA queries > > if it can create an IPv6 socket. > > > > > In alpine: > > > If ipv6 is disabled (net.ipv6.conf.default.disable_ipv6 = 1) > > > Then the "nslookup" (or name resolution) does an "AAAA" query along with > > > "A" query > > > > > > Is this intentional? > > > > > > Also, I was wondering if there was any way to disable AAAA query in name > > > resolution? > > > > > > > There does not appear to be a way without changing code. In musl, the > > function name_from_dns() will always generate both the AAAA and the A > > query unless "family" is explicitly set to one of the address families. > > No input from resolv.conf or similar is used for this. And "family" > > comes directly from the caller, i.e. nslookup. You'd have to change the > > nslookup code to only ask for IPv4 addresses. > > > > > Kind Regards, > > > Srinivasa Raghavan. > > > > Ciao, > > Markus > >