4 ms·
My favorite feature is a tiny, couple line bug fix that I pushed hard to get included during the feature freeze. Full details here, but a summary is below: http
by AaronFriel 5y ago
My favorite feature is a tiny, couple line bug fix that I pushed hard to get included during the feature freeze. Full details here, but a summary is below: https://github.com/golang/go/issues/51127 https://github.com/golang/go/issues/51127
For the past ~8 years, many hundreds of people reported on GitHub - and likely many multiples more have encountered and not reported - a program that didn't work with the error "cannot unmarshal DNS..."
This error seems to be caused by two things:
1. DNS proxies not adhering to the DNS spec. This would be due to VPNs with integrated DNS proxies such as Cisco AnyConnect, internet connection sharing on Windows (which affects DNS resolution in the Windows Subsystem for Linux), or even just incorrectly implemented recursive resolvers. Specifically, if these servers receive a DNS message that utilizes RFC 1035, section 4.1.4 "message compression", which is an extremely simple compression scheme, then they may transmit a DNS message that doesn't utilize message compression, which means the proxy isn't in response size 1:1 but almost always increases the size of DNS responses.
2. Go's net/dns resolver enforcing a strict 512 byte limit on responses. This is the same behavior as musl (and I would implore a musl maintainer to increase this limit) but not in glibc or most OS distributions' default DNS behavior.
I read every single GitHub issue related to this and found the frustration of both end-users and OSS software maintainers overwhelming. End users lacked the tools to diagnose why the software didn't work, maintainers couldn't reproduce the issue.
This bug affected major projects: Mesos, Docker, Consul, Terraform, and more. For nearly a decade. Sometimes (as in Mesos) these were projects where they controlled the DNS server and client, so they could implement DNS message compression and solve it. In other cases, such as with Docker or Pulumi, where software runs on end-user machines, maintainers may have had to "close, can't repro" issues. The error was inscrutable and otherwise very skilled maintainers wrote this off as a fluke or user error.
And these are just the tools that are typically used by skilled technical users - usually engineers. It's hard to estimate but not difficult to imagine underestimating how many bug reports and issues end-users encountered where a cryptic error message, if shown, never made its way to GitHub.
Software that works is better than software that - sometimes cryptically - does not. And when things just work, well, very few people using Go will realize that this fix prevented them from experiencing an afternoon or a day or more of frustration; but I will :) and I think that's what makes contributing to OSS awesome.
- tedunangst 5y agoTo save a click: the fix was increasing packet size limit to 1232.
- sdfhbdf 5y agoI read through the whole issue thread. I admire your firmness on pushing through while at the same time maintaining professional and analytical tone in your responses. To me it is a good example how I'd imagine most open-source issue discussions should go. I understand both sides, and trade offs taken. Nice work. Although the "your best bet to get a desired change through isn't via a private call with a maintainer." comment directed at you made me chuckle.
- mindwok 5y agoThat was a good read. Well done pushing that forward, I believe it was the right position to take.
- ArchOversight 5y agoI wish I had your time and effort to be able to fix the issues of split DNS in macOS being broken unless using cgo. https://github.com/golang/go/issues/12524 https://github.com/golang/go/issues/12524 This has been an open issue since 2015. It's a pain because every single last tool using go cross compilation fails to use the proper DNS resolver and thereby doesn't work when using work VPN's. This is tools like: kubectl, vault, concourse (fly), and many other binaries that get built on CI, and unless the company builds on macOS builders and uses CGO_ENABLED=1 DNS resolution is just broken. And it is increasingly frustrating.
- AaronFriel 5y agoVery interesting and very helpful. TLD-specific resolvers on Mac not working is the missing piece I needed to understand why our team builds binaries on Mac and cross-compiles to the other two.
- int_19h 5y agoA better question is, why is Go using its own DNS resolver instead of the OS-provided one in the first place?