unwind(8) could not resolve names from curl or libcurl based apps

[Ali Farzanrad]

Hello misc@,

I noticed that in curl and git (which uses libcurl), most of the time I
can't resolve the hostname.

Here is my config:

$ cat /etc/unwind.conf
forwarder {
        9.9.9.9 authentication name "dns.quad9.net" DoT
        149.112.112.112 authentication name "dns.quad9.net" DoT
        2620:fe::fe authentication name "dns.quad9.net" DoT
        2620:fe::9 authentication name "dns.quad9.net" DoT
}

preference { DoT }

Here is list of hosts that I test with:

$ cat hosts
www.apple.com
www.debian.org
www.freebsd.org
www.google.org
www.kernel.org
www.linux.com
www.microsoft.com
www.netbsd.org
www.openbsd.org
www.ubuntu.com
www.wikipedia.org

Here is a simple script to test host resolve in curl:

$ cat curl
for i in $(< hosts)
do
        curl -Sso/dev/null http://$i:443
done 2>&1 | grep resolve

Here is a simple script to test host resolve in netcat:

$ cat netcat
for i in $(< hosts)
do
        nc -z $i 443
done 2>&1 | grep addrinfo

First scenario is to run netcat first, then curl:

$ doas rcctl start unwind
unwind(ok)
$ sh netcat
$ sh curl

As you see there is no error.

Second scenario is to run curl first, then netcat:

$ doas rcctl restart unwind
unwind(ok)
unwind(ok)
$ sh curl
curl: (6) Could not resolve host: www.debian.org
curl: (6) Could not resolve host: www.freebsd.org
curl: (6) Could not resolve host: www.google.org
curl: (6) Could not resolve host: www.kernel.org
curl: (6) Could not resolve host: www.netbsd.org
curl: (6) Could not resolve host: www.openbsd.org
curl: (6) Could not resolve host: www.wikipedia.org
$ sh netcat
nc: getaddrinfo for host "www.debian.org" port 443: no address associated with 
name
nc: getaddrinfo for host "www.freebsd.org" port 443: no address associated with 
name
nc: getaddrinfo for host "www.google.org" port 443: no address associated with 
name
nc: getaddrinfo for host "www.kernel.org" port 443: no address associated with 
name
nc: getaddrinfo for host "www.netbsd.org" port 443: no address associated with 
name
nc: getaddrinfo for host "www.openbsd.org" port 443: no address associated with 
name
nc: getaddrinfo for host "www.wikipedia.org" port 443: no address associated 
with name

As you see curl cause unwind to fail resolving names.

I also tested same scenario without unwind(8) to verify it is
unwind(8)'s fail:

$ doas rcctl stop unwind
unwind(ok)
$ sh curl
$ sh netcat

I used OpenBSD 7.9-stable for these tests.
Anybody knows what is the problem?


Bests,
Ali Farzanrad