Why does nss-mdns query the default DNS before avahi?

[Mek101]

Trying to solve my local network's server name can take up to 14 seconds on all my local devices.
The avahi daemon cache is enabled on my Arch, Manjaro and Linux Mint clients, as well as in my Void-Linux musl server.

[mek101@arch-aspire ~]$ time getent hosts home-server.local
fe80::be5f:f4ff:fef8:2c96 home-server.local

real	0m14,026s
user	0m0,005s
sys	0m0,007s
[mek101@arch-aspire ~]$ time getent hosts home-server.local -s mdns
fe80::be5f:f4ff:fef8:2c96 home-server.local

real	0m8,323s
user	0m0,001s
sys	0m0,012s
[mek101@arch-aspire ~]$ time getent hosts home-server.local -s mdns_minimal
fe80::be5f:f4ff:fef8:2c96 home-server.local

real	0m5,087s
user	0m0,001s
sys	0m0,009s
[mek101@arch-aspire ~]$ time getent hosts home-server.local -s mdns4
192.168.0.100   home-server.local

real	0m14,045s
user	0m0,002s
sys	0m0,007s
[mek101@arch-aspire ~]$ time getent hosts home-server.local -s mdns4_minimal
192.168.0.100   home-server.local

real	0m5,279s
user	0m0,000s
sys	0m0,010s

[Mek101]

Apparently the slow name resolution was caused by my router setting itself as the default DNS and timing out: https://unix.stackexchange.com/questions/647832/why-does-getent-default-to-station-if-no-tld-is-specified

Still, why does the mdns option on /etc/nsswitch.conf query the default DNS before avahi? Analyzing getent behavior with strace it seems to query the dns even with the -s mnds4 option

[pemensik]

According to README.md, it is clearly documented mdns does SOA query to local. DNS domain, checking whether it is handled by DNS server. If your DNS server just timeouts, resolution time might be quite long. Consider using just mdns_minimal, which tries resolution of *.local using mdns only. Or fix your DNS server to respond. Unless local domain is served by DNS, I doubt there is any good reason to have also mdns plugin enabled.

[Mek101]

Consider using just mdns_minimal

I changed my nsswitch.conf to hosts: files mdns4_minimal [NOTFOUND=return] dns myhostname, but I'm seeing the same behavior

Or fix your DNS server to respond.

Unfortunately I can't do that, I'm using a Vodafone Power Station and I don't have access to it's dnsmasq configuration because of vendor lockdown

[pemensik]

Oh, I can see similar results only when names are not found. It is strange. Okay, even mdns*_minimal queries local DNS. Can you change configured DNS to your own server? Unless provider has reliable one, can you update DHCP offered DNS server to something not broken? As a workaround, you should be still able to override DNS server in network manager only for your machine.

[pemensik]

It queries localhost DNS to check, whether there exists local. domain in DNS. If it does, it would not use Avahi for multicast lookup, but use just DNS. I haven't found any way to skip this check and force avahi lookup. The only difference between mdns_minimal and mdns is that is does not try to read /etc/mdns.allow file. But it still checks local. SOA test in both cases.

[agoode]

You should be able to disable the SOA checking if you switch to the non-minimal library and configure mdns.allow. See https://github.com/lathiat/nss-mdns#etcmdnsallow and search for the word "heuristic".

Let me know how it works.

[Mek101]

@pemensik

Can you change configured DNS to your own server?

The power station sets itself as the first dns name resolver anyway

Unless provider has reliable one, can you update
DHCP offered DNS server to something not broken?

I use both my server as a dns and 9.9.9.9

@agoode
Will try

[Mek101]

I created a /etc/mdns.allow with the following content as suggested by the readme:

.local.
.local

And changed my /etc/nsswitch.conf line to

hosts: files mdns4 [NOTFOUND=return] dns myhostname

But getnent still queries the dns!
From strace getent hosts home-server.local

connect(3, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("192.168.0.1")}, 16) = 0
poll([{fd=3, events=POLLOUT}], 1, 0)    = 1 ([{fd=3, revents=POLLOUT}])
sendto(3, "Jl\1\0\0\1\0\0\0\0\0\0\vhome-server\5local\0\0"..., 35, MSG_NOSIGNAL, NULL, 0) = 35

I already tried rebooting

[agoode]

Thanks for doing the strace. Are you able to observe the binary reading mdns.allow and successfully reading the contents? If it does so, then no unicast DNS should happen.

[Mek101]

On my manjaro machine, it reads /etc/mdns.allow after having queried the dns!
strace getent hosts home-server.local: strace.txt

/etc/mdns.allow is opened at line 224 of the log, while the dns are queried from line 133

[tomeq82]

I'm observing the very same behavior, Ubuntu 20.04.3, updated fully. No matter if I use systemd-resolved or not, with avahi daemon running or not it seems that the udp 5353 queries for any .local do not work at all.... I did some tcpdumps and no avail.

[pemensik]

Ah, yes, reproduced that. That query to DNS is in fact AAAA query, which is NOT handled by mdns4. When I replaced mdns4 with just mdns, it does not reach to DNS at all.

hosts:      files myhostname mdns4 [NOTFOUND=return] resolve [!UNAVAIL=return] dns
connect(3, {sa_family=AF_UNIX, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (Adresář nebo soubor neexistuje)
connect(3, {sa_family=AF_UNIX, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (Adresář nebo soubor neexistuje)
connect(3, {sa_family=AF_UNIX, sun_path="/run/systemd/resolve/io.systemd.Resolve"}, 42) = -1 ENOENT (Adresář nebo soubor neexistuje)
connect(3, {sa_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("127.0.0.1")}, 16) = 0
connect(3, {sa_family=AF_UNIX, sun_path="/var/run/avahi-daemon/socket"}, 110) = 0

hosts:      files myhostname mdns [NOTFOUND=return] resolve [!UNAVAIL=return] dns
connect(3, {sa_family=AF_UNIX, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (Adresář nebo soubor neexistuje)
connect(3, {sa_family=AF_UNIX, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (Adresář nebo soubor neexistuje)
connect(3, {sa_family=AF_UNIX, sun_path="/var/run/avahi-daemon/socket"}, 110) = 0
connect(3, {sa_family=AF_UNIX, sun_path="/var/run/avahi-daemon/socket"}, 110) = 0

Now the question is, whether mdns4_minimal is a good default configuration in this case. It seems wrong to me.