Re: (ITS#8979) The -l <timelimit> or -o nettimeout=<timelimit> don't limit DNS lookup time

[hyc@symas.com]

=C3=86var Arnfj=C3=B6r=C3=B0 Bjarmason wrote:
> On Mon, Feb 18, 2019 at 5:18 PM Howard Chu <hyc@symas.com> wrote:
>>
>> avarab@gmail.com wrote:
>>> Full_Name: .var Arnfj.r. Bjarmason
>>> Version: 2.4.44-21
>>> OS: CentOS 7.6
>>> URL: ftp://ftp.openldap.org/incoming/
>>> Submission from: (NULL) (5.57.21.154)
>>>
>>>
>>> On a setup where you have a blackholed DNS server:
>>>
>>> $ grep ^name /etc/resolv.conf
>>> nameserver 1.2.3.4
>>>
>>> Running e.g.:
>>>
>>> $ time ldapsearch -l 2 -o nettimeout=3D1 [...]
>>>
>>> Will (on my system) eventually return:
>>>
>>> ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)
>>>
>>> real    0m24.039s
>>> user    0m0.004s
>>> sys     0m0.007s
>>>
>>> It'll take around 48 seconds if I have two DNS servers. Running strac=
e(1) on it
>>> reveals that it's sitting in a socket/connect/poll loop trying to loo=
kup the
>>> hostname of the LDAP server I'm trying to talk to.
>>>
>>> Instead one of these options should limit time spent on DNS lookups, =
or there
>>> should be another option, so that you can run ldapsearch with a combi=
nation of
>>> these options and be sure that it'll run in at most the <timeout> you=
 give it.
>>
>> The current code in libldap uses gethostbyname() and this API doesn't =
offer
>> any parameters for setting a timeout. You can configure a timeout in y=
our
>> system's /etc/resolv.conf or using RES_OPTIONS environment variable. R=
ead your
>> system's resolver(5) manpage.
>>
>> If you know of any widely available resolver API that allows specifyin=
g a timeout
>> on individual queries, you're welcome to submit a patch supporting thi=
s feature.
>> The standard -lresolv doesn't provide such an interface.
>=20
> That resolv.conf had "options timeout:2". That it didn't kick in is
> probably a bug somewhere else, but it would still be handy if
> ldapsearch had this itself, since the timeout you use for general
> resolutions might not be what you want for ldapsearch.

If all you need is a timeout in the ldapsearch command, wrap it in a scri=
pt
that sets the RES_OPTIONS environment variable.

> But implementing that is a mess. This SO post has a summary:
> https://stackoverflow.com/questions/24403435/socket-hostname-lookup-tim=
eout-how-to-implement-it
>=20
> So e.g. there could be a probe for getaddrinfo_a() on GNU systems.
>=20
>> Closing this ITS.
>=20
> Fair enough, but is that a "we don't want this ever" or "if someone
> submitted a patch for (possibly OS-specific) DNS timeout we'd be
> interested".

Generally not fond of features that aren't available cross-platform, part=
icularly
if that means it can only be tested on a particular OS. I guess for GNU e=
xtensions
that are easily detected and widely supported it may be OK.

We already use getaddrinfo() if it's available, so adding getaddrinfo_a()=
 may
not be too messy.

--=20
  -- Howard Chu
  CTO, Symas Corp.           http://www.symas.com
  Director, Highland Sun     http://highlandsun.com/hyc/
  Chief Architect, OpenLDAP  http://www.openldap.org/project/