On 10/09/2026 11:46 pm, Vincent Lefevre wrote:
On 2026-09-10 10:00:16 +0700, Max Nikulin wrote:
Have you figured out if changes made in libc to handle the case of
SERVFAIL for A and success for AAAA queries affect nscd? Some
security issues are mentioned in the bug tracker.
I don't know. Note that I've also seen the reverse on the concerned
machine: AF_INET giving the IPv4 address and AF_INET6 giving the
IPv6 address as always, but AF_UNSPEC giving only the IPv4 address.
(Of course, even though this is buggy, it is fine for me.)
It seems, resolv.conf(5) was not updated by commits related to the bug
27929. From <file:///usr/share/doc/libc6/NEWS.gz>:
Version 2.41
* The DNS stub resolver now supports the strict-error option. If
activated, getaddrinfo for the AF_UNSPEC address family (with dual
A/AAAA DNS lookups) attemps to obtain an A/AAAA response pair from
another DNS server if one of the responses indicates failure. Without
the strict-error option, getaddrinfo returns the A record data it has
obtained even if the AAAA query failed. The new strict error mode is
incompatible with some DNS environments which do not follow the RFCs,
which is why this mode is not enabled by default. A future version
of the library may turn it on by default, however.
It doesn't look better than "no-aaaa" as a workaround.
