net.http.request failing in Prosody

[wfleischer]

Upgrading from stable-7210-2 to stable-7287-2 results in net.http.request failing with

[1655191918] libunbound[248:0] error: udp connect failed: Cannot assign requested address for <IPv6 address> port 53

This seems to be related to NLnetLabs/unbound#364

Note: we noticed this with our custom REST API module for local authentication. So these commands are failing:

local util = module:require "util";
local http_get_with_retry = util.http_get_with_retry;

local content = http_get_with_retry(url, nr_retries);

I could not test, but mod_reservations.lua and token/util.lib.lua should also be affected. (Maybe somebody could check.)

[saghul]

Hum, that's odd, are you on a IPv4 only environment, and trying to connect to IPv6? I don't see any unbound version update in that timeframe: https://metadata.ftp-master.debian.org/changelogs//main/u/unbound/unbound_1.13.1-1_changelog

Debian used to have a patch to squelch that log, but the failure can still be there.

FWIW the unbound dependency came with Prosody 0.12.

[saghul]

Can you try to add a section to the general Prosody config file, like so:

unbound {
    forward = "8.8.8.8"
}

That should force DNS to be forwarded to Google's resolver (or you could pick a different one), if my reading of how that config works is right :-P

[wfleischer]

unbound {
forward = "8.8.8.8"
}

Thank you, @saghul. It works! (except for a missing =) How about using the embedded Docker DNS service IP address?

unbound = {
    forward = "127.0.0.11"
}

This way the container will use whatever DNS service is configured for the host.

[saghul]

Sounds like a good default, but it would probably be a good idea to add an env var for it since it may need adjusting in other environments like k8s.

Can you make a PR? :-)

[wfleischer]

@saghul: how about this?

unbound = {
    resolvconf = true
}

It works in Docker. Would this work in other environments, too? If not, I am willing to make a config option. I would just avoid bloating the product with unnecessary config options :)

[saghul]

If that works (which makes sense, because Docker does configure resolv.conf with its resolver) then it makes sense, let's have it!

I would just avoid bloating the product with unnecessary config options :)

❤️