Am 10.09.26 um 18:50 schrieb Vincent Lefevre:
On 2026-09-10 10:00:16 +0700, Max Nikulin wrote:
On 10/09/2026 6:37 am, Vincent Lefevre wrote:
this is because getaddrinfo returns
only the IPv6 address. This is not a question of precedence.
Great. Do you see any benefits in disabling IPv6 on your machine?
Disabling completely, apparently not. Disabling a part of it, such
as SLAAC, yes, because in the past, some machines on the network
sent fake RA advertising. My main personal machine on the network
just has SLAAC disabled for this reason.
Then investigate which machine that is. It might be a bogus attacker or
just a completely misconfigured device.
Have you figured out if changes made in libc to handle the case of
SERVFAIL for A and success for AAAA queries affect nscd? Some
security issues are mentioned in the bug tracker.
I don't know. Note that I've also seen the reverse on the concerned
machine: AF_INET giving the IPv4 address and AF_INET6 giving the
IPv6 address as always, but AF_UNSPEC giving only the IPv4 address.
(Of course, even though this is buggy, it is fine for me.)
Have you tried to stop nscd to compare if general impression is better?
Nothing has been done yet, AFAIK (I am not the admin, and I can still
see nscd running).
Disable it for testing or at least clear the cache.
I've found
https://lists.fedoraproject.org/archives/list/[email protected]/thread/4K634Q3567QMMVJIGXM6I6MOJPOWO6QF/
(November 2020): "While still maintained within the glibc source tree,
''nscd'' has received less than forty commits in the past three years
and has gathered significant technical debt, and has bugs which are
hard to fix. There are concurrency bugs in the shared mappings, cache
unification (IPv4 vs. IPv6 vs. AF_UNSPEC) issues, and more which would
require significant investment to fix in nscd."
nscd has been removed from RHEL/Fedora because of that. They use
systemd-resolved by default.
But I'd say that SERVFAIL should not be cached as it may be a temporary
failure.
Another question is whether it is reasonable to invest efforts into
suppressing AAAA queries completely at the libc level when IPv6 is
disabled.
This is probably not the way the nscd issue should be fixed (it is
not even sure that it fixes aything, and it wouldn't fix anything
when IPv6 isn't disabled but doesn't work).
If disabling IPv6 mitigates the problem, there is a serious problem on
your machine/network, that needs to be investigated and fixed. Disabling
IPv6 is a dead-end street.
--
Gruß
Marco
Spam bitte an [email protected]
