Bug 29017 - Change resolv.conf default to single-request
Summary: Change resolv.conf default to single-request
Status: UNCONFIRMED
Alias: None
Product: glibc
Classification: Unclassified
Component: network (show other bugs)
Version: 2.10
: P2 normal
Target Milestone: ---
Assignee: Not yet assigned to anyone
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2022-04-01 17:15 UTC by Philip Sanetra
Modified: 2024-03-12 19:58 UTC (History)
4 users (show)

See Also:
Host:
Target:
Build:
Last reconfirmed:
fweimer: security-


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Philip Sanetra 2022-04-01 17:15:03 UTC
glibc 2.9 introduced "same time" lookup of ipv4 and ipv6 host names via DNS and glibc 2.10 introduced the option "single-request" to introduce explicit sequential lookups of those addresses. The default since 2.10 is to send those lookups in parallel.

A known issue is that some firewalls and DNS servers fail to handle those parallel requests and return only a single response for one of those requests. In these cases glibc waits for 5 seconds and then switches to single-request mode for a specific process.

This default behavior leads to very bad performance on short living processes and is very hard to debug as specialized knowledge about resolv.conf and glibc is required.

See reports on Stack Exchange:
https://unix.stackexchange.com/questions/141163/dns-lookups-sometimes-take-5-seconds
https://serverfault.com/questions/906397/how-do-i-set-the-single-request-option-in-networkmanager
https://unix.stackexchange.com/questions/290987/resolving-hostname-takes-5-seconds

In my specific case the parallel lookups work just fine at home, while always causing issues at work.

We have the year 2022 and these issues still occur, so it was not some kind of issue that went away by time as it was possibly expected when glibc 2.10 was released.

I propose to change the default behavior to "single-request" to avoid those issues by default and optionally introduce a new option to lookup ipv4 and ipv6 addresses in parallel to improve performance, although I do not expect that this performance gain is really noticable anymore with the internet connections we have today.