Bug#960739: libc-bin: getaddrinfo() fails with EAI_AGAIN when the DNS query returns a large number of A and AAAA records.

[Aurelien Jarno <aurelien@aurel32.net>]

Hi Mike,

On 2020-05-16 10:57, Mike Przybylski wrote:
> Hi, Aurelien,
> 
> Thank you for looking into this.  I really appreciate it.
> 
> > Which nameserver do you use?
> 
> Google DNS ( 8.8.8.8 and 8.8.4.4 )
> 
> > As the answer is probably large, it might
> > be interesting to check if it supports TCP connections as a fallback.
> > Alternative you might want to enable edns0 if it's not already done.
> 
> I will definitely look into that.
> 
> > Could you try with other nameservers, there are many public DNS servers
> > available to test.
> 
> I’m sorry that I didn’t think of that.  Everything works fine with OpenDNS ( 208.67.222.222 and  208.67.220.220 ).
> 
> > Finally would it be possible to get a tcpdump trace of the issue? That
> > would likely help to understand the issue.
> 
> Please see the attached pcap file.

Thanks a lot for the pcap file. I got a look at it, and there is indeed
something fishy:
- 10.0.2.15 asks 8.8.8.8/UDP for A download.docker.com (query 0xd009)
- 10.0.2.15 asks 8.8.8.8/UDP for AAAA download.docker.com (query 0x710a)
- 8.8.8.8 answers query 0xd009
- 8.8.8.8 answers query 0x710a but marks it as truncated as it it too
  big.

Up to there all looks normal. As expected the AAAA query 0x710a is
retried using TCP:
- 10.0.2.15 asks 8.8.8.8/TCP for AAAA download.docker.com (query 0x710a)
- 8.8.8.8 answers to query *0xd009* with the *A* records. This is
  totally unexpected.

The glibc resolvers therefore retries with the second name server:
- 10.0.2.15 asks 8.8.8.4/TCP for AAAA download.docker.com (query 0x710a)
- 8.8.8.4 answers to query *0xd009* with the *A* records, the same way
  as 8.8.8.8. This is again totally unexpected.

As both TCP queries failed, glibc concludes there is a server error.

I have no idea what could explain that, it seems there is something
between the Google DNS servers and you host mangling the answers. I
noticed that the IP of your host is 10.0.2.15. Could it be a QEMU or
Virtualbox VM running with the user mode network stack?

Regards,
Aurelien

-- 
Aurelien Jarno                          GPG: 4096R/1DDD8C9B
aurelien@aurel32.net                 http://www.aurel32.net