glibc resolver question

[Lennert Buytenhek <buytenh at wantstofly dot org>]

(please CC, I'm not on the list)

Hello,

I've coded up an async DNS stub resolver, and to make sure it behaves
more-or-less the same as other resolvers out there, I'm now looking at
the behavior of glibc's resolver.  (I tried looking at the code at first
but there's 320kB (!!) of stuff in resolv/ ..)

The glibc stub resolver has a number of pecularities, and I wonder if
they are in there by design, or are just accidental side-effects of the
way things are implemented.

This is on a vanilla Fedora 3 box, glibc version "2.3.4-2.fc3".

1. Each name server is queried twice, even if we see an error from
   that server:

18:06:45.859626 IP 10.0.0.10.32832 > 10.0.0.11.domain:  58460+ A? www.redhat.com. (32)
18:06:45.859734 IP 10.0.0.11 > 10.0.0.10: icmp 68: 10.0.0.11 udp port domain unreachable
18:06:45.859921 IP 10.0.0.10.32832 > 10.0.0.11.domain:  58460+ A? www.redhat.com. (32)
18:06:45.860060 IP 10.0.0.11 > 10.0.0.10: icmp 68: 10.0.0.11 udp port domain unreachable


2. Each search suffix from /etc/resolv.conf is tried, even if there were
   errors from all name servers.

18:06:45.859626 IP 10.0.0.10.32832 > 10.0.0.11.domain:  58460+ A? www.redhat.com. (32)
18:06:45.859734 IP 10.0.0.11 > 10.0.0.10: icmp 68: 10.0.0.11 udp port domain unreachable
18:06:45.859921 IP 10.0.0.10.32832 > 10.0.0.11.domain:  58460+ A? www.redhat.com. (32)
18:06:45.860060 IP 10.0.0.11 > 10.0.0.10: icmp 68: 10.0.0.11 udp port domain unreachable
18:06:45.860204 IP 10.0.0.10.32832 > 10.0.0.11.domain:  49382+ A? www.redhat.com.wantstofly.org. (47)
18:06:45.860343 IP 10.0.0.11 > 10.0.0.10: icmp 83: 10.0.0.11 udp port domain unreachable
18:06:45.860406 IP 10.0.0.10.32832 > 10.0.0.11.domain:  49382+ A? www.redhat.com.wantstofly.org. (47)
18:06:45.860523 IP 10.0.0.11 > 10.0.0.10: icmp 83: 10.0.0.11 udp port domain unreachable


3. The query timeout that glibc uses is always 5 seconds.


4. I don't understand the way glibc does socket/port reuse.  With two
   unresponsive nameservers, you get this:

18:10:57.264118 IP 10.0.0.10.32834 > 192.168.0.1.domain:  64321+ A? www.redhat.com. (32)
18:11:02.264515 IP 10.0.0.10.32836 > 192.168.0.2.domain:  64321+ A? www.redhat.com. (32)
18:11:07.264522 IP 10.0.0.10.32834 > 192.168.0.1.domain:  64321+ A? www.redhat.com. (32)
18:11:12.264579 IP 10.0.0.10.32836 > 192.168.0.2.domain:  64321+ A? www.redhat.com. (32)
18:11:17.264729 IP 10.0.0.10.32836 > 192.168.0.1.domain:  5641+ A? www.redhat.com.wantstofly.org. (47)
18:11:22.265765 IP 10.0.0.10.32838 > 192.168.0.2.domain:  5641+ A? www.redhat.com.wantstofly.org. (47)
18:11:27.266745 IP 10.0.0.10.32836 > 192.168.0.1.domain:  5641+ A? www.redhat.com.wantstofly.org. (47)
18:11:32.266804 IP 10.0.0.10.32838 > 192.168.0.2.domain:  5641+ A? www.redhat.com.wantstofly.org. (47)

   It seems to open a new socket for each name server for each iteration
   through the search list loop (32834/32836 in the first four queries),
   but then it reuses port 32836 for the first query in the second loop.

Anyone got any ideas?


thanks,
Lennert