NetBSD Problem Report #60475

From www@netbsd.org  Wed Jul 22 09:55:01 2026
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256
	 client-signature RSA-PSS (2048 bits) client-digest SHA256)
	(Client CN "mail.netbsd.org", Issuer "YR2" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 014631A923B
	for <gnats-bugs@gnats.NetBSD.org>; Wed, 22 Jul 2026 09:55:01 +0000 (UTC)
Message-Id: <20260722095459.96BEC1A923C@mollari.NetBSD.org>
Date: Wed, 22 Jul 2026 09:54:59 +0000 (UTC)
From: mayuresh@warunjikar.in
Reply-To: mayuresh@warunjikar.in
To: gnats-bugs@NetBSD.org
Subject: getaddrinfo should check both IPv4 and IPv6 before trying suffixes
X-Send-Pr-Version: www-1.0
X-From4GNATS: "mayuresh@warunjikar.in via gnats" <gnats-admin@NetBSD.org>

>Number:         60475
>Category:       lib
>Synopsis:       getaddrinfo should check both IPv4 and IPv6 before trying suffixes
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    lib-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Jul 22 10:00:00 +0000 2026
>Last-Modified:  Wed Jul 22 10:51:29 +0000 2026
>Originator:     Mayuresh
>Release:        10.1 amd64
>Organization:
>Environment:
NetBSD warunjikar.in 10.1 NetBSD 10.1 (GENERIC) #0: Mon Dec 16 13:08:11 UTC 2024  mkrepro@mkrepro.NetBSD.org:/usr/src/sys/arch/amd64/compile/GENERIC amd64 x86_64 Intel 686-class NetBSD
>Description:
The issue is fully discussed here:
https://mail-index.netbsd.org/netbsd-users/2026/07/21/msg034510.html

Summary:

When trying to resolve domainname github.com, the resolver looked for
IPv6 first.  But the domain does not support IPv6, no AAAA record.
Then the resolver tried suffixing the domain name of the local host
which is ".in".  Hence it tried github.com.in, which is a different
domain with AAAA record and this led to an incorrect resolution.

This can lead to serious security issues.
>How-To-Repeat:
Use tcpdump to monitor the DNS traffic.

Try pinging a non-existent domain or one with no IPv6 address.

Notice that if the given string does not yield results, it tries
suffixing it with the domain name of the host.

If the domain name does not contain a dot, it tries the same string
again, which is wasteful.
>Fix:
Post [1] has references to RFC 1535 that described the issue and links
to the documentation of how Linux and FreeBSD address the issue.

Post [2] asserts that the behavior on NetBSD is in line is same as
that described by the cited Linux documentation.

Post [3] reports that Linux attempts IPv4 and IPv6 first, before
attempting to suffix the domain name, which is safer for the
github.com scenario described.

[1] https://mail-index.netbsd.org/netbsd-users/2026/07/22/msg034538.html
[2] https://mail-index.netbsd.org/netbsd-users/2026/07/22/msg034539.html
[3] https://mail-index.netbsd.org/netbsd-users/2026/07/22/msg034544.html

>Release-Note:

>Audit-Trail:

>Unformatted:

Home	PR Database Search