Am 16.09.26 um 05:00 schrieb Vincent Lefevre:
On 2026-09-15 21:46:17 +0200, Marco Moock wrote:
Am 10.09.26 um 18:50 schrieb Vincent Lefevre:
On 2026-09-10 10:00:16 +0700, Max Nikulin wrote:
On 10/09/2026 6:37 am, Vincent Lefevre wrote:
this is because getaddrinfo returns
only the IPv6 address. This is not a question of precedence.
Great. Do you see any benefits in disabling IPv6 on your machine?
Disabling completely, apparently not. Disabling a part of it, such
as SLAAC, yes, because in the past, some machines on the network
sent fake RA advertising. My main personal machine on the network
just has SLAAC disabled for this reason.
Then investigate which machine that is. It might be a bogus attacker
or just a completely misconfigured device.
I just know that misconfigured devices are found on the network.
They need to be removed, as they disturb any other device.
They can also be used for MITM attacks.
You definitely do not want such machines in your productive network.
Have you figured out if changes made in libc to handle the case of
SERVFAIL for A and success for AAAA queries affect nscd? Some
security issues are mentioned in the bug tracker.
I don't know. Note that I've also seen the reverse on the concerned
machine: AF_INET giving the IPv4 address and AF_INET6 giving the
IPv6 address as always, but AF_UNSPEC giving only the IPv4 address.
(Of course, even though this is buggy, it is fine for me.)
Have you tried to stop nscd to compare if general impression is better?
Nothing has been done yet, AFAIK (I am not the admin, and I can still
see nscd running).
Disable it for testing or at least clear the cache.
Is there a way to disable it for testing, as non-root?
No.
Note that I can still test on domains that are not in the cache.
This is how I can see that there are still temporary failures,
probably due to SERVFAIL from the nameservers.
If disabling IPv6 mitigates the problem, there is a serious problem
on your machine/network, that needs to be investigated and fixed.
There is a serious problem with nscd, as already said.
I have doubt. If nscd caches a negative response (from the faulty DNS),
it will not try again until the cache expired. Works as intended.
Disabling IPv6 is a dead-end street.
I don't see why. IPv6 is not supported on the network, so there
are no drawbacks in disabling it for hostname resolution. And if
it were supported, then there wouldn't have been any major issue
with nscd.
You do not try to solve the real issue, which will affect other machines
too. That is your big problem.
You currently have at least 2 problems:
A faulty DNS resolver
A misconfigured/hacked machine that sends bogus IPv6 router advertisements.
Fix them first.
--
Gruß
Marco
Spam bitte an [email protected]
