Open TheSiman opened 3 months ago
Because you exhaust the ephemeral port range on the host with the ports. As such the aardvark-dns can no longer make dns requests on its own. At least that is the error condition.
It is not clear from the strace but it looks like aardvark-dns requests a random port on bind not 0 where the kernel should assign a random free one
bind(10, {sa_family=AF_INET, sin_port=htons(53788), sin_addr=inet_addr("0.0.0.0")}, 16) = -1 EADDRINUSE (Address already in use)
Thus it is likely a bug in aardvark-dns as it should just bind port 0 because if we look in the kernel there is still plenty of space.
$ cat /proc/sys/net/ipv4/ip_local_port_range 32768 60999
I'm sorry, I don't completely follow. Why would freeing up port 65535 fix it if this was the case, since it's well outside of the ip_local_port_range and the chance of it being picked randomly seems extremely low?
I agree that is seems odd to we hit 65535 randomly but I looked at the code and this is what our lib is doing, it also does not respect ip_local_port_range at all.
No idea why they did this instead of just binding to 0 and let the kernel pick the port.
Note that I linked the new range there that is not in a new release yet so we do not make use of it, https://github.com/hickory-dns/hickory-dns/commit/8f05d14eed53c488ee14fa860ef68cad352168ff
And if I look at the strace output we have thousands of bind retires so It makes sense that it hit the one free one eventually.
I created https://github.com/hickory-dns/hickory-dns/pull/2260 over there
Issue Description
When publishing a udp range larger than 16383 ports ending with 65535, dns resolution on user defined networks stops working. I could only reproduce it with larger ranges ending with 65535. (the intended use-case was coturn)
Steps to reproduce the issue
Steps to reproduce the issue
Describe the results you received
DNS requests inside container time out.
Describe the results you expected
DNS requests inside container get a response.
podman info output
Podman in a container
No
Privileged Or Rootless
Privileged
Upstream Latest Release
No
Additional environment details
QEMU/KVM (netcup.eu)
Additional information
No response