Bug 31476

Summary: Automatic activation of single-request options break resolv.conf reloading
Product: glibc Reporter: Florian Weimer <fweimer>
Component: networkAssignee: Florian Weimer <fweimer>
Status: RESOLVED FIXED    
Severity: normal CC: fweimer, levon
Priority: P2 Flags: fweimer: security-
Version: unspecified   
Target Milestone: 2.40   
See Also: https://sourceware.org/bugzilla/show_bug.cgi?id=29017
Host: Target:
Build: Last reconfirmed:

Description Florian Weimer 2024-03-12 06:43:31 UTC
Initial report from John Levon:

Issue with stale resolv.conf state
<https://inbox.sourceware.org/libc-alpha/Ze7KCkIzR5PuErba@movementarian.org/>

John traced the lack of reloading to a change in _res.options:

“
I don't understand the first part of the comment, but indeed, ->resp doesn't
match. In particular:

 62   return ctx->resp->options == ctx->conf->options                                

and ctx->resp (aka _resp) has 0x47002c1 whereas ctx->conf has 0x41002c1.

I'm not sure but I suspect the additional RES_SNGLKUP|RES_SNGLKUPREOP may be due
to this code:

1000                     /* There are quite a few broken name servers out             
1001                        there which don't handle two outstanding                  
1002                        requests from the same source.  There are also            
1003                        broken firewall settings.  If we time out after           
1004                        having received one answer switch to the mode             
1005                        where we send the second request only once we             
1006                        have received the first answer.  */                       
1007                     if (!single_request)                                         
1008                       {                                                          
1009                         statp->options |= RES_SNGLKUP;                           
1010                         single_request = true;                                   
1011                         *gotsomewhere = save_gotsomewhere;                       
1012                         goto retry;                                              
1013                       }                                                          
1014                     else if (!single_request_reopen)                             
1015                       {                                                          
1016                         statp->options |= RES_SNGLKUPREOP;                       
1017                         single_request_reopen = true;                            
1018                         *gotsomewhere = save_gotsomewhere;                       
1019                         __res_iclose (statp, false);                             
1020                         goto retry_reopen;                                       
1021                       }                                                          

I'm guessing these got set when the VPN dropped routing to the old nameservers,
but before the next getaddrinfo() came in, thus leading to the match failing.
”
Comment 1 Florian Weimer 2024-06-10 09:57:55 UTC
Patch posted:

[PATCH] resolv: Track single-request fallback via _res._flags (bug 31476)
<https://inbox.sourceware.org/libc-alpha/87ikyhqfwy.fsf@oldenburg.str.redhat.com/>
Comment 2 Florian Weimer 2024-06-13 16:57:36 UTC
Fixed for 2.40 via:

commit 868ab8923a2ec977faafec97ecafac0c3159c1b2
Author: Florian Weimer <fweimer@redhat.com>
Date:   Thu Jun 13 18:56:30 2024 +0200

    resolv: Track single-request fallback via _res._flags (bug 31476)
    
    This avoids changing _res.options, which inteferes with change
    detection as part of automatic reloading of /etc/resolv.conf.
    
    Reviewed-by: DJ Delorie <dj@redhat.com>