DNS responses are cached

[zhenyavinogradov]

According to #89274, NixOS uses nscd only for dispatching nss modules, and caching functionality of nscd is disabled by default. But when I run any application that resolves the same DNS name in a loop on a clean NixOS system, I observe that DNS packets are not sent on each request, they are only sent after ttl elapses. It means that other requests are served from some local cache. Only if I stop nscd service I see the packets being sent on each request.

A simple script to reproduce this: while true; do getent ahosts github.com; sleep 1; done

Is there some component other than nscd that does this caching, or does nscd itself needs some extra configuration to actually disable caching?

cc @flokli

[flokli]

Do you have systemd-resolved or unbound enabled? How does your /etc/nsswitch.conf and /etc/resolv.conf look like?

[zhenyavinogradov]

I'm testing it in a qemu VM with a minimal NixOS config, with no systemd-resolved/unbound:

{ lib, ... }: {
  boot.initrd.availableKernelModules = [ "virtio_net" "virtio_pci" "virtio_mmio" "virtio_blk" "virtio_scsi" ];
  boot.initrd.kernelModules = [ "virtio_balloon" "virtio_console" "virtio_rng" ];
  boot.growPartition = true;
  boot.loader.grub.device = "/dev/vda";
  fileSystems."/".device = "/dev/disk/by-label/nixos";
  fileSystems."/".fsType = "ext4";
  fileSystems."/".autoResize = true;
  services.getty.autologinUser = lib.mkForce "root";
}

/etc/nsswitch.conf:

passwd:    files systemd
group:     files systemd
shadow:    files

hosts:     mymachines files myhostname dns
networks:  files

ethers:    files
services:  files
protocols: files
rpc:       files

/etc/resolv.conf:

# Generated by resolvconf
nameserver 10.0.99.1
options edns0

[flokli]

cc @arianvp (who did dig into nscd and its caching behaviour)

[3nprob]

Confirmed.

When changing nameserver in /etc/resolv.conf, nslookup and dig resolve through new server but other applications return a cached result. No systemd-resolved/local DNS services or entries in /etc/hosts

Restarting nscd yields the new entry.

# echo "nameserver $NS1" > /etc/resolv.conf
# nslookup $HOST
Server:         $NS1
Address:        $NS1#53

Name:   $HOST
Address: $IP1

# getent hosts $HOST
$IP1  $HOST

# echo "nameserver $NS2" > /etc/resolv.conf
# nslookup $HOST
Server:         $NS2
Address:        $NS2#53

Name:   $HOST
Address: $IP2

# getent hosts $HOST
$IP1  $HOST

# grep hosts /etc/nsswitch.conf
hosts:     files mymachines dns myhostname

# grep hosts /etc/nscd.conf
enable-cache            hosts           yes
positive-time-to-live   hosts           0
negative-time-to-live   hosts           0
shared                  hosts           yes

# systemctl restart nscd
# getent hosts $HOST
$IP2  $HOST

[flokli]

Thanks for the digging! In that case, one more reason to work on #55276 :-)