Ali Farzanrad <[email protected]> wrote: > Hello misc@, > > I noticed that in curl and git (which uses libcurl), most of the time I > can't resolve the hostname. > > Here is my config: > > $ cat /etc/unwind.conf > forwarder { > 9.9.9.9 authentication name "dns.quad9.net" DoT > 149.112.112.112 authentication name "dns.quad9.net" DoT > 2620:fe::fe authentication name "dns.quad9.net" DoT > 2620:fe::9 authentication name "dns.quad9.net" DoT > } > > preference { DoT } > > Here is list of hosts that I test with: > > $ cat hosts > www.apple.com > www.debian.org > www.freebsd.org > www.google.org > www.kernel.org > www.linux.com > www.microsoft.com > www.netbsd.org > www.openbsd.org > www.ubuntu.com > www.wikipedia.org > > Here is a simple script to test host resolve in curl: > > $ cat curl > for i in $(< hosts) > do > curl -Sso/dev/null http://$i:443 > done 2>&1 | grep resolve > > Here is a simple script to test host resolve in netcat: > > $ cat netcat > for i in $(< hosts) > do > nc -z $i 443 > done 2>&1 | grep addrinfo > > First scenario is to run netcat first, then curl: > > $ doas rcctl start unwind > unwind(ok) > $ sh netcat > $ sh curl > > As you see there is no error. > > Second scenario is to run curl first, then netcat: > > $ doas rcctl restart unwind > unwind(ok) > unwind(ok) > $ sh curl > curl: (6) Could not resolve host: www.debian.org > curl: (6) Could not resolve host: www.freebsd.org > curl: (6) Could not resolve host: www.google.org > curl: (6) Could not resolve host: www.kernel.org > curl: (6) Could not resolve host: www.netbsd.org > curl: (6) Could not resolve host: www.openbsd.org > curl: (6) Could not resolve host: www.wikipedia.org > $ sh netcat > nc: getaddrinfo for host "www.debian.org" port 443: no address associated > with name > nc: getaddrinfo for host "www.freebsd.org" port 443: no address associated > with name > nc: getaddrinfo for host "www.google.org" port 443: no address associated > with name > nc: getaddrinfo for host "www.kernel.org" port 443: no address associated > with name > nc: getaddrinfo for host "www.netbsd.org" port 443: no address associated > with name > nc: getaddrinfo for host "www.openbsd.org" port 443: no address associated > with name > nc: getaddrinfo for host "www.wikipedia.org" port 443: no address associated > with name > > As you see curl cause unwind to fail resolving names. > > I also tested same scenario without unwind(8) to verify it is > unwind(8)'s fail: > > $ doas rcctl stop unwind > unwind(ok) > $ sh curl > $ sh netcat > > I used OpenBSD 7.9-stable for these tests. > Anybody knows what is the problem? > > > Bests, > Ali Farzanrad
Here are the unwind(8) errors when I run curl first: # unwind -d validation failure <www.apple.com. A IN>: from 9.9.9.9 for trust anchor . no signatures from 2620:fe::fe for key com. while building chain of trust validation failure <www.apple.com. AAAA IN>: no signatures from 2620:fe::fe for key com. while building chain of trust validation failure <www.apple.com.arpa. AAAA IN>: no NSEC3 records for DS com.arpa. while building chain of trust validation failure <www.debian.org. A IN>: no signatures from 9.9.9.9 for DS org. while building chain of trust validation failure <www.debian.org. AAAA IN>: no signatures from 9.9.9.9 for DS org. while building chain of trust validation failure <www.debian.org.arpa. A IN>: no NSEC3 records from 149.112.112.112 for DS org.arpa. while building chain of trust validation failure <www.debian.org.arpa. AAAA IN>: no NSEC3 records from 149.112.112.112 for DS org.arpa. while building chain of trust validation failure <www.freebsd.org. A IN>: key for validation org. is marked as invalid because of a previous no signatures validation failure <www.freebsd.org. AAAA IN>: key for validation org. is marked as invalid because of a previous no signatures validation failure <www.google.org. AAAA IN>: key for validation org. is marked as invalid because of a previous no signatures validation failure <www.google.org. A IN>: key for validation org. is marked as invalid because of a previous no signatures validation failure <www.kernel.org. A IN>: key for validation org. is marked as invalid because of a previous no signatures validation failure <www.kernel.org. AAAA IN>: key for validation org. is marked as invalid because of a previous no signatures validation failure <www.linux.com. AAAA IN>: key for validation com. is marked as invalid because of a previous no signatures validation failure <www.linux.com. A IN>: key for validation com. is marked as invalid because of a previous no signatures validation failure <www.microsoft.com. AAAA IN>: key for validation com. is marked as invalid because of a previous no signatures validation failure <www.microsoft.com. A IN>: key for validation com. is marked as invalid because of a previous no signatures validation failure <www.netbsd.org. AAAA IN>: key for validation org. is marked as invalid because of a previous no signatures validation failure <www.netbsd.org. A IN>: key for validation org. is marked as invalid because of a previous no signatures validation failure <www.openbsd.org. A IN>: key for validation org. is marked as invalid because of a previous no signatures validation failure <www.openbsd.org. AAAA IN>: key for validation org. is marked as invalid because of a previous no signatures validation failure <www.ubuntu.com. A IN>: key for validation com. is marked as invalid because of a previous no signatures validation failure <www.ubuntu.com. AAAA IN>: key for validation com. is marked as invalid because of a previous no signatures validation failure <www.wikipedia.org. AAAA IN>: key for validation org. is marked as invalid because of a previous no signatures validation failure <www.wikipedia.org. A IN>: key for validation org. is marked as invalid because of a previous no signatures I see no error from unwind(8) whenever I run netcat first. Bests, Ali Farzanrad
