On 2026-09-15 21:46:17 +0200, Marco Moock wrote: > Am 10.09.26 um 18:50 schrieb Vincent Lefevre: > > On 2026-09-10 10:00:16 +0700, Max Nikulin wrote: > > > On 10/09/2026 6:37 am, Vincent Lefevre wrote: > > > > this is because getaddrinfo returns > > > > only the IPv6 address. This is not a question of precedence. > > > > > > Great. Do you see any benefits in disabling IPv6 on your machine? > > > > Disabling completely, apparently not. Disabling a part of it, such > > as SLAAC, yes, because in the past, some machines on the network > > sent fake RA advertising. My main personal machine on the network > > just has SLAAC disabled for this reason. > > Then investigate which machine that is. It might be a bogus attacker > or just a completely misconfigured device.
I just know that misconfigured devices are found on the network. > > > Have you figured out if changes made in libc to handle the case of > > > SERVFAIL for A and success for AAAA queries affect nscd? Some > > > security issues are mentioned in the bug tracker. > > > > I don't know. Note that I've also seen the reverse on the concerned > > machine: AF_INET giving the IPv4 address and AF_INET6 giving the > > IPv6 address as always, but AF_UNSPEC giving only the IPv4 address. > > (Of course, even though this is buggy, it is fine for me.) > > > > > Have you tried to stop nscd to compare if general impression is better? > > > > Nothing has been done yet, AFAIK (I am not the admin, and I can still > > see nscd running). > > Disable it for testing or at least clear the cache. Is there a way to disable it for testing, as non-root? Note that I can still test on domains that are not in the cache. This is how I can see that there are still temporary failures, probably due to SERVFAIL from the nameservers. > If disabling IPv6 mitigates the problem, there is a serious problem > on your machine/network, that needs to be investigated and fixed. There is a serious problem with nscd, as already said. > Disabling IPv6 is a dead-end street. I don't see why. IPv6 is not supported on the network, so there are no drawbacks in disabling it for hostname resolution. And if it were supported, then there wouldn't have been any major issue with nscd. -- Vincent Lefèvre <[email protected]> - Web: <https://www.vinc17.net/> 100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/> Work: CR INRIA - computer arithmetic / Pascaline project (LIP, ENS-Lyon)
