From: Rich Felker <dalias@libc.org>
To: Markus Geiger <markus.geiger@nielsen.com>
Cc: musl@lists.openwall.com
Subject: Re: [musl] [BUG] Non-FQDN domain resolving failure on musl-1.2.x
Date: Fri, 24 Jun 2022 21:56:56 -0400 [thread overview]
Message-ID: <20220625015655.GR7074@brightrain.aerifal.cx> (raw)
In-Reply-To: <CAMsuMPgKYe5aeuGe5C-Km5O=c6JVDhAcPZH5Qxd3TNt+jrJVyA@mail.gmail.com>
On Fri, Jun 24, 2022 at 07:14:10PM +0200, Markus Geiger wrote:
> Sorry: not Amazon DNS – 10.204.109.209 is a BIND server in our network
> we've setup to work with our global VPN/DNS.
>
> BUT the strange thing is that the domain lookup works with musl-1.1.24
> while with some musl-1.2.x just quits with an error.
>
> a comparison with the docker runs and `sudo tcpdump -v -i docker0 udp port
> 53 or tcp port 53` did not bring up any diffs except the list of A records
> returned is in a different order (which i think is completely normal). the
> order of requests is the same
>
> tcpdump from working version:
> > bind-us-east-1a.XXXXXXXXXXXXXX.domain > 172.17.0.3.45501: 18685 9/13/8
> slack.com. A 3.95.117.96, slack.com. A 34.231.24.224, slack.com. A
> 54.163.235.119, slack.com. A 54.147.59.169, slack.com. A 34.193.255.5,
> slack.com. A 34.204.109.226, slack.com. A 34.225.62.185, slack.com. A
> 34.203.97.10, slack.com. A 54.92.199.186 (510)
>
> tcpdump from non-working version:
> > bind-us-east-1a.XXXXXXXXXXXXXX.domain > 172.17.0.3.59951: 49211 9/13/8
> slack.com. A 34.225.62.185, slack.com. A 54.163.235.119, slack.com. A
> 34.231.24.224, slack.com. A 54.147.59.169, slack.com. A 34.193.255.5,
> slack.com. A 34.204.109.226, slack.com. A 54.92.199.186, slack.com. A
> 3.95.117.96, slack.com. A 34.203.97.10 (510)
>
> Complete log:
>
> 172.17.0.3.59951 > bind-us-east-1a.XXXXXXXXXXXXXXXXXXXXXXXXXx.domain:
> 49211+ A? slack.com. (27)
> 18:56:19.990087 IP (tos 0x0, ttl 64, id 10210, offset 0, flags [DF], proto
> UDP (17), length 55)
> 172.17.0.3.59951 > bind-us-east-1a.XXXXXXXXXXXXXXXXXXXXXXXXXx.domain:
> 49334+ AAAA? slack.com. (27)
> 18:56:20.154990 IP (tos 0x0, ttl 250, id 17825, offset 0, flags [none],
> proto UDP (17), length 538)
> bind-us-east-1a.XXXXXXXXXXXXXXXXXXXXXXXXXx.domain > 172.17.0.3.59951:
> 49211 9/13/8 slack.com. A 34.225.62.185, slack.com. A 54.163.235.119,
> slack.com. A 34.231.24.224, slack.com. A 54.147.59.169, slack.com. A
> 34.193.255.5, slack.com. A 34.204.109.226, slack.com. A 54.92.199.186,
> slack.com. A 3.95.117.96, slack.com. A 34.203.97.10 (510)
> 18:56:20.241377 IP (tos 0x0, ttl 250, id 17846, offset 0, flags [none],
> proto UDP (17), length 55)
> bind-us-east-1a.XXXXXXXXXXXXXXXXXXXXXXXXXx.domain > 172.17.0.3.59951:
> 49334 ServFail 0/0/0 (27)
> 18:56:20.241501 IP (tos 0x0, ttl 64, id 10233, offset 0, flags [DF], proto
> UDP (17), length 55)
Here's your problem -- the server is returning ServFail rather than an
answer for some of the queries. This makes musl's resolver continue
retrying for an answer. In an old version, there may have been a bug
whereby, after the retries timed out, the fact that one query failed
was sometimes overlooked. This logic was improved between the versions
you tested as part of ensuring DNSSEC integrity. In any case, you just
need to find the cause of the ServFail (maybe a hack someone put in
place to try to suppress use of IPv6?) and fix it.
Rich
next prev parent reply other threads:[~2022-06-25 1:57 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-06-24 10:28 Markus Geiger
2022-06-24 14:59 ` Rich Felker
2022-06-24 15:10 ` Jeffrey Walton
2022-06-24 15:15 ` Rich Felker
2022-06-24 17:14 ` Markus Geiger
2022-06-25 1:56 ` Rich Felker [this message]
2022-06-27 11:35 ` Markus Geiger
2022-06-27 14:06 ` Rich Felker
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220625015655.GR7074@brightrain.aerifal.cx \
--to=dalias@libc.org \
--cc=markus.geiger@nielsen.com \
--cc=musl@lists.openwall.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://git.vuxu.org/mirror/musl/
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).