Bug#895981: please cleanup /var/cache/nscd on restart

[Marco M.]

On Wed, 18 Apr 2018 10:18:44 +0200 Harald Dunkel
 wrote:
> Package: nscd
> Version: 2.24-11+deb9u3
> 
> If I change nscd.conf (to adjust some ttl or to disable some cache)
> and restart the service, then the cache files in /var/cache/nscd
> are not adjusted accordingly, AFIACS. In worst case the passwd cache
> is kept forever and never adjusted, even though it has been disabled
> in nscd.conf.
> 
> nscd's caches should be deleted or recreated at service start or
> restart, as applicable.

See manapge for nscd.conf, for me it looks like it is intended
behavior of that setting.

   persistent service bool
  bool  must  be  one of yes (default) or no.  Keep the content of
  the  cache  for  service  over  nscd(8)  restarts.  Useful  when
  paranoia mode is set.

Does it work if that is set to no?


-- 
Gruß
Marco

Bug#895981: please cleanup /var/cache/nscd on restart

[Harald Dunkel]

Any news on this? Did you report this bug upstream?


Here is a sample session showing the effect:

# ping lxc01
PING lxc01.example.de (172.16.99.198) 56(84) bytes of data.
From dpcl082.example.de (172.16.97.128) icmp_seq=1 Destination Host Unreachable
From dpcl082.example.de (172.16.97.128) icmp_seq=2 Destination Host Unreachable
From dpcl082.example.de (172.16.97.128) icmp_seq=3 Destination Host Unreachable
^C
--- lxc01.example.de ping statistics ---
4 packets transmitted, 0 received, +3 errors, 100% packet loss, time 3050ms
pipe 4

# service nscd stop

# ping lxc01
PING lxc01.example.de (172.16.99.28) 56(84) bytes of data.
64 bytes from lxc01.example.de (172.16.99.28): icmp_seq=1 ttl=64 time=0.362 ms
64 bytes from lxc01.example.de (172.16.99.28): icmp_seq=2 ttl=64 time=0.396 ms
^C
--- lxc01.example.de ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1001ms
rtt min/avg/max/mdev = 0.362/0.379/0.396/0.017 ms

# service nscd start

# ping lxc01
PING lxc01.example.de (172.16.99.198) 56(84) bytes of data.
From dpcl082.example.de (172.16.97.128) icmp_seq=1 Destination Host Unreachable
From dpcl082.example.de (172.16.97.128) icmp_seq=2 Destination Host Unreachable
From dpcl082.example.de (172.16.97.128) icmp_seq=3 Destination Host Unreachable
^C
--- lxc01.example.de ping statistics ---
4 packets transmitted, 0 received, +3 errors, 100% packet loss, time 3050ms
pipe 4


See how the old IP address pops up again, as soon as nscd is active?
Obviously "service nscd stop" did not flush the cache.


Regards
Harri
--
aixigo AG, Karl-Friedrich-Strasse 68, 52072 Aachen, Germany
phone: +49 241 559709-79, fax: +49 241 559709-99
eMail: harald.dun...@aixigo.de, web: http://www.aixigo.de
Amtsgericht Aachen - HRB 8057, Vorstand: Erich Borsch, Christian Friedrich, 
Tobias Haustein, Vors. des Aufsichtsrates: Prof. Dr. Ruediger von Nitzsch

Bug#895981: please cleanup /var/cache/nscd on restart

[Harald Dunkel]

Not sure if it matters, but if resolvconf is active, then /etc/resolv.conf
is a symbolic link.


Regards
Harri

Bug#895981: please cleanup /var/cache/nscd on restart

[Florian Weimer]

* Carlos O'Donell:

> Then each registered file, like /etc/resolv.conf, is watched via
> inotify for any changes, and if a change is detected and
> finfo->call_res_init was true (and it's true only for resolv.conf)
> then we call res_init().

But res_init does not flush the nscd cache, doesn't it?

Bug#895981: please cleanup /var/cache/nscd on restart

[Carlos O'Donell]

On Sun, Apr 29, 2018 at 2:56 PM, Florian Weimer  wrote:

> * Harald Dunkel:
>
> > I am using both systemd and sysvinit-core, but I am not sure which one
> > was active when I ran into this problem.
> >
> > Consider a split DNS setup for a remote network. I had started an IPsec
> > connection to the remote side. /etc/resolv.conf was changed to include
> > the new internal DNServer on the remote side, but a host lookup gave me
> > still the old external address. Stopping nscd did not help, AFAIR.
>
> That's arguably a bug in nscd.  It should flush the cache each time it
> detects a change in /etc/resolv.conf (or /etc/gai.conf, for that
> matter).
>

 And it does, this is what define_traced_file/init_traced_file do in
nss/nss_files/files-init.c.

Then via the nscd callback nscd_init_cb, we call register_traced_file for
each loaded database.

Then each registered file, like /etc/resolv.conf, is watched via inotify
for any changes, and if
a change is detected and finfo->call_res_init was true (and it's true only
for resolv.conf) then
we call res_init().

We do not handle anything for changes in gai.conf, we would have to add
that.

Cheers,
Carlos.

Bug#895981: please cleanup /var/cache/nscd on restart

[Florian Weimer]

* Harald Dunkel:

> I am using both systemd and sysvinit-core, but I am not sure which one
> was active when I ran into this problem.
>
> Consider a split DNS setup for a remote network. I had started an IPsec
> connection to the remote side. /etc/resolv.conf was changed to include
> the new internal DNServer on the remote side, but a host lookup gave me
> still the old external address. Stopping nscd did not help, AFAIR.

That's arguably a bug in nscd.  It should flush the cache each time it
detects a change in /etc/resolv.conf (or /etc/gai.conf, for that
matter).

Bug#895981: please cleanup /var/cache/nscd on restart

[Harald Dunkel]

Hi Aurelien,

I am using both systemd and sysvinit-core, but I am not sure which one
was active when I ran into this problem.

Consider a split DNS setup for a remote network. I had started an IPsec
connection to the remote side. /etc/resolv.conf was changed to include
the new internal DNServer on the remote side, but a host lookup gave me
still the old external address. Stopping nscd did not help, AFAIR.

See also #895977 (resolvconf).


Regards
Harri

Bug#895981: please cleanup /var/cache/nscd on restart

[Aurelien Jarno]

Hi,

On 2018-04-18 10:18, Harald Dunkel wrote:
> Package: nscd
> Version: 2.24-11+deb9u3
> 
> If I change nscd.conf (to adjust some ttl or to disable some cache)
> and restart the service, then the cache files in /var/cache/nscd
> are not adjusted accordingly, AFIACS. In worst case the passwd cache
> is kept forever and never adjusted, even though it has been disabled
> in nscd.conf.

Could you please tell me if you use systemd or sysvinit, to know if the
systemd service file is used, or the old init script.

> nscd's caches should be deleted or recreated at service start or
> restart, as applicable.

With both the systemd service and the old init script, the caches should
be invalidated through nscd -i, which is the proper way to start with a
clean cache. Now there might be a case which is not handled correctly.

Aurelien

-- 
Aurelien Jarno  GPG: 4096R/1DDD8C9B
aurel...@aurel32.net http://www.aurel32.net

Bug#895981: please cleanup /var/cache/nscd on restart

[Harald Dunkel]

Package: nscd
Version: 2.24-11+deb9u3

If I change nscd.conf (to adjust some ttl or to disable some cache)
and restart the service, then the cache files in /var/cache/nscd
are not adjusted accordingly, AFIACS. In worst case the passwd cache
is kept forever and never adjusted, even though it has been disabled
in nscd.conf.

nscd's caches should be deleted or recreated at service start or
restart, as applicable.


Regards
Harri