[Bug network/34515] resolver applies search path for AAAA queries even though ndots is exceeded

https://sourceware.org/bugzilla/show_bug.cgi?id=34515

--- Comment #3 from Fabian Vogt <[email protected]> ---
(In reply to Florian Weimer from comment #1)
> Is this specifically about the behavior of the getent tool? For getent
> hosts, an AAAA lookup is made, and only if that fails, an A lookup is made.
> This means that the behavior is as expected.

Initially I hit it by using git, which is not able to clone from
https://code.qt.io/qt/qtbase.git due to an SSL certificate mismatch. The same
also affects curl, which tries IPv6 first and IPv4 later (or maybe in
parallel?)

 > curl -v https://code.qt.io/qt/qtbase.git/
 * Host code.qt.io:443 was resolved.
 * IPv6: 2a07:de40:b205:1c:10:144:53:65
         ^ wrong
 * IPv4: 54.247.17.180
         ^ correct
 *   Trying [2a07:de40:b205:1c:10:144:53:65]:443...
 * ALPN: curl offers h2,http/1.1
 * TLSv1.3 (OUT), TLS handshake, Client hello (1):
 * SSL Trust Anchors:
 *   OpenSSL default paths (fallback)
 * TLSv1.3 (IN), TLS handshake, Server hello (2):
 * TLSv1.2 (IN), TLS handshake, Certificate (11):
 * TLSv1.2 (IN), TLS handshake, Server key exchange (12):
 * TLSv1.2 (IN), TLS handshake, Server finished (14):
 * TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
 * TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):
 * TLSv1.2 (OUT), TLS handshake, Finished (20):
 * TLSv1.2 (IN), TLS handshake, Finished (20):
 * SSL connection using TLSv1.2 / ECDHE-RSA-AES128-GCM-SHA256 / x25519 /
RSASSA-PSS
 * ALPN: server accepted http/1.1
 * Server certificate:
 *   subject: CN=gitlab.suse.de
              ^ won't match
 [...]

Using the FQDN with trailing dot to bypass the search list works:

 > curl -v https://code.qt.io./qt/qtbase.git/
 * Host code.qt.io.:443 was resolved.
 * IPv6: (none)
 * IPv4: 54.247.17.180
 *   Trying 54.247.17.180:443...
 * ALPN: curl offers h2,http/1.1

-- 
You are receiving this mail because:
You are on the CC list for the bug.