☰

Ubuntu 16.04：curl、wget、ssh 无法使用 IPv6 从 dnsmasq 解析主机

tag-icon • tag-icon network-manager wget ipv6 curl dnsmasq
Ubuntu 16.04：curl、wget、ssh 无法使用 IPv6 从 dnsmasq 解析主机

花了很多时间在谷歌上搜索该问题，但没有找到答案。

假设：全新安装的 Ubuntu 16.04，这意味着 IPv6 已启用并且网络管理器服务正在使用 dnsmasq 进行本地 DNS 缓存。

问题在于，对于特定域，命令行实用程序无法解析主机名。

$ curl -v https://deb.nodesource.com/
* Could not resolve host: deb.nodesource.com
* Closing connection 0
curl: (6) Could not resolve host: deb.nodesource.com

$ wget http://deb.nodesource.com/
--2017-04-10 15:23:34--  http://deb.nodesource.com/
Resolving deb.nodesource.com (deb.nodesource.com)... failed: Name or service not known.
wget: unable to resolve host address ‘deb.nodesource.com’

$ ssh deb.nodesource.com
ssh: Could not resolve hostname deb.nodesource.com: Name or service not known

而其他“常见”主机运行良好。

$ curl http://www.google.com/
<HTML>...</HTML>

本地 DNS 缓存也正常工作。

$ dig deb.nodesource.com   
; <<>> DiG 9.10.3-P4-Ubuntu <<>> deb.nodesource.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 55668
;; flags: qr rd ra; QUERY: 1, ANSWER: 9, AUTHORITY: 13, ADDITIONAL: 12    
<...>
;; ANSWER SECTION:
deb.nodesource.com. 101 IN  CNAME   d2buw04m05mirl.cloudfront.net.
d2buw04m05mirl.cloudfront.net. 59 IN    A   54.192.98.17
<...>
;; Query time: 38 msec
;; SERVER: 127.0.1.1#53(127.0.1.1)
;; WHEN: Mon Apr 10 15:28:57 EEST 2017
;; MSG SIZE  rcvd: 615

$ dig AAAA deb.nodesource.com
; <<>> DiG 9.10.3-P4-Ubuntu <<>> AAAA deb.nodesource.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 52753
;; flags: qr rd ra; QUERY: 1, ANSWER: 9, AUTHORITY: 13, ADDITIONAL: 12
<...>
;; ANSWER SECTION:
deb.nodesource.com. 300 IN  CNAME   d2buw04m05mirl.cloudfront.net.
d2buw04m05mirl.cloudfront.net. 60 IN    AAAA    2600:9000:203b:9200:1f:6523:6040:93a1
<...>
;; Query time: 58 msec
;; SERVER: 127.0.1.1#53(127.0.1.1)
;; WHEN: Mon Apr 10 15:32:53 EEST 2017
;; MSG SIZE  rcvd: 711

IPv6 请求也有效：

$ dig -6 deb.nodesource.com    
; <<>> DiG 9.10.3-P4-Ubuntu <<>> -6 deb.nodesource.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 5056
;; flags: qr rd ra; QUERY: 1, ANSWER: 9, AUTHORITY: 13, ADDITIONAL: 12
<...>
;; ANSWER SECTION:
deb.nodesource.com. 290 IN  CNAME   d2buw04m05mirl.cloudfront.net.
d2buw04m05mirl.cloudfront.net. 60 IN    A   54.192.229.174
<...>
;; Query time: 21 msec
;; SERVER: ::1#53(::1)
;; WHEN: Mon Apr 10 16:05:52 EEST 2017
;; MSG SIZE  rcvd: 615

诀窍是，如果我强制使用 IPv4 来执行 curl 或 wget，那么它就可以奏效。

$ curl -4 http://deb.nodesource.com/
<html>
<head><title>302 Found</title></head>
<body bgcolor="white">
<center><h1>302 Found</h1></center>
<hr><center>nginx</center>
</body>
</html>

$ wget -4 http://deb.nodesource.com/
--2017-04-10 15:40:28--  http://deb.nodesource.com/
Resolving deb.nodesource.com (deb.nodesource.com)... 54.192.98.73, 54.192.98.106, 54.192.98.122, ...
Connecting to deb.nodesource.com (deb.nodesource.com)|54.192.98.73|:80... connected.
<...>
2017-04-10 15:40:29 (175 KB/s) - ‘index.html.1’ saved [83983]

如您所见，本地 DNS 缓存支持 IPv4 和 IPv6 请求，并返回有效答案。但我不明白是什么阻止了所有这些命令行实用程序解析主机，即使默认情况下系统尝试在 IPv6 上工作。

我目前发现的一些建议：

我将非常感激任何有关如何使这些功能协同工作的帮助。

谢谢！

相关配置和输出：

$ cat /etc/hosts
127.0.0.1   localhost
127.0.1.1   ubuntu-host

# The following lines are desirable for IPv6 capable hosts
::1     ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters

$ cat /etc/resolv.conf 
# Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8)
#     DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN

nameserver 127.0.1.1

$ cat /etc/NetworkManager/NetworkManager.conf 
[main]
plugins=ifupdown,keyfile,ofono
dns=dnsmasq

[ifupdown]
managed=false

$ cat /etc/nsswitch.conf 
# /etc/nsswitch.conf
#
# Example configuration of GNU Name Service Switch functionality.
# If you have the `glibc-doc-reference' and `info' packages installed, try:
# `info libc "Name Service Switch"' for information about this file.

passwd:         compat
group:          compat
shadow:         compat
gshadow:        files

hosts:          files mdns4_minimal [NOTFOUND=return] dns
networks:       files

protocols:      db files
services:       db files
ethers:         db files
rpc:            db files

netgroup:       nis

$ sudo tcpdump port 53
# curl -4 request
15:55:27.161321 IP 192.168.2.101.54124 > 192.168.2.1.domain: 32338+ A? deb.nodesource.com. (36)
15:55:27.184442 IP 192.168.2.1.domain > 192.168.2.101.54124: 32338 9/13/5 CNAME d2buw04m05mirl.cloudfront.net., A 54.192.229.151, A 54.192.229.174, A 54.192.229.177, A 54.192.229.185, A 54.192.229.62, A 54.192.229.76, A 54.192.229.81, A 54.192.229.98 (508)

# curl -6 request
15:57:17.283919 IP 192.168.2.101.54124 > 192.168.2.1.domain: 63423+ A? deb.nodesource.com. (36)
15:57:17.283950 IP 192.168.2.101.54124 > 192.168.2.1.domain: 4140+ AAAA? deb.nodesource.com. (36)
15:57:17.323109 IP 192.168.2.1.domain > 192.168.2.101.54124: 4140| 9/12/0 CNAME d2buw04m05mirl.cloudfront.net., AAAA 2600:9000:203b:8400:1f:6523:6040:93a1, AAAA 2600:9000:203b:da00:1f:6523:6040:93a1, AAAA 2600:9000:203b:f400:1f:6523:6040:93a1, AAAA 2600:9000:203b:2400:1f:6523:6040:93a1, AAAA 2600:9000:203b:2a00:1f:6523:6040:93a1, AAAA 2600:9000:203b:4600:1f:6523:6040:93a1, AAAA 2600:9000:203b:6000:1f:6523:6040:93a1, AAAA 2600:9000:203b:7800:1f:6523:6040:93a1 (508)
15:57:17.323132 IP 192.168.2.1.domain > 192.168.2.101.54124: 63423 9/13/5 CNAME d2buw04m05mirl.cloudfront.net., A 54.192.229.151, A 54.192.229.174, A 54.192.229.177, A 54.192.229.185, A 54.192.229.62, A 54.192.229.76, A 54.192.229.81, A 54.192.229.98 (508)
15:57:17.323683 IP 192.168.2.101.58769 > 192.168.2.1.domain: Flags [S], seq 783238377, win 29200, options [mss 1460,sackOK,TS val 4431703 ecr 0,nop,wscale 7], length 0
15:57:17.325295 IP 192.168.2.1.domain > 192.168.2.101.58769: Flags [R.], seq 0, ack 783238378, win 0, length 0
15:57:17.325933 IP 192.168.2.101.60649 > 192.168.2.1.domain: Flags [S], seq 665587122, win 29200, options [mss 1460,sackOK,TS val 4431704 ecr 0,nop,wscale 7], length 0
15:57:17.331301 IP 192.168.2.1.domain > 192.168.2.101.60649: Flags [R.], seq 0, ack 665587123, win 0, length 0
15:57:17.331540 IP 192.168.2.101.54124 > 192.168.2.1.domain: 29050+ A? deb.nodesource.com. (36)
15:57:17.331578 IP 192.168.2.101.54124 > 192.168.2.1.domain: 5852+ AAAA? deb.nodesource.com. (36)
15:57:17.334915 IP 192.168.2.1.domain > 192.168.2.101.54124: 29050 9/13/5 CNAME d2buw04m05mirl.cloudfront.net., A 54.192.229.98, A 54.192.229.151, A 54.192.229.174, A 54.192.229.177, A 54.192.229.185, A 54.192.229.62, A 54.192.229.76, A 54.192.229.81 (508)
15:57:17.334969 IP 192.168.2.1.domain > 192.168.2.101.54124: 5852| 9/12/0 CNAME d2buw04m05mirl.cloudfront.net., AAAA 2600:9000:203b:7800:1f:6523:6040:93a1, AAAA 2600:9000:203b:8400:1f:6523:6040:93a1, AAAA 2600:9000:203b:da00:1f:6523:6040:93a1, AAAA 2600:9000:203b:f400:1f:6523:6040:93a1, AAAA 2600:9000:203b:2400:1f:6523:6040:93a1, AAAA 2600:9000:203b:2a00:1f:6523:6040:93a1, AAAA 2600:9000:203b:4600:1f:6523:6040:93a1, AAAA 2600:9000:203b:6000:1f:6523:6040:93a1 (508)
15:57:17.335550 IP 192.168.2.101.38257 > 192.168.2.1.domain: Flags [S], seq 2283847070, win 29200, options [mss 1460,sackOK,TS val 4431706 ecr 0,nop,wscale 7], length 0
15:57:17.336614 IP 192.168.2.1.domain > 192.168.2.101.38257: Flags [R.], seq 0, ack 2283847071, win 0, length 0
15:57:17.336763 IP 192.168.2.101.42479 > 192.168.2.1.domain: Flags [S], seq 3878661065, win 29200, options [mss 1460,sackOK,TS val 4431707 ecr 0,nop,wscale 7], length 0
15:57:17.337800 IP 192.168.2.1.domain > 192.168.2.101.42479: Flags [R.], seq 0, ack 3878661066, win 0, length 0

答案1

终于找到问题的根源了：是我的WiFi路由器。

尽管事实上dig运行良好，但由于某种原因，使用的命令行实用程序getaddrinfo无法解析路由器的 DNS 应答（在我的情况下由代理dnsmasq）。

我已dnsmasq直接指向我的 ISP 的 DNS 服务器，它工作正常。出于某种原因，我的路由器破坏了从上游服务器获得的 DNS 答案。

curl --> dnsmasq -X-> router --> ISP --> ... # NOK
curl --> dnsmasq --> ISP --> ...             # OK

相关内容