Opened 6 years ago

Closed 6 years ago

#11741 closed defect (duplicate)

Cannot resolve DNS hostname with many records

Reported by: T(A)ILS developers Owned by:
Priority: Medium Milestone:
Component: Core Tor/Tor Version: Tor: 0.2.4.21
Severity: Keywords:
Cc: tails@… Actual Points:
Parent ID: Points:
Reviewer: Sponsor:

Description

Hi,

today, the hostname used for the Tails mirrors pool (dl.amnesia.boum.org) has 31 A records.

It can be successfully resolved using non-Tor resolvers, but the Tor resolver fails to return anything useful.

$ tor-resolve dl.amnesia.boum.org 
May 05 10:15:34.891 [warn] Got SOCKS5 status response '4': host is unreachable
zsh: exit 1     tor-resolve dl.amnesia.boum.org

... and TBB times out with "Firefox can't establish a connection to the server at dl.amnesia.boum.org." when trying to connect to http://dl.amnesia.boum.org/. Note that ttdnsd works fine.

I suspect that's because we have reached the point when the DNS reply needed to answer the request exceeds the default maximum size of a UDP datagram (512 bytes). Perhaps the Tor DNS resolver fails to fallback to TCP, or to specify/handle larger UDP datagrams with the EDNS extension?

As a temporary workaround, I'll drop a few mirrors from our DNS round-robin pool, but given how quickly the amount of Tails downloads grows these days, it would be good for us to see our mirrors pool grow accordingly (which does happen, until this point). I'll report back to confirm if this workaround does the job.

Child Tickets

Change History (5)

comment:1 Changed 6 years ago by T(A)ILS developers

Cc: tails@… added

comment:2 Changed 6 years ago by T(A)ILS developers

Dropping two mirrors (=> now at 29 A records) "fixes" http://dl.a.b.o in TBB for me. tor-resolve still fails, but that may be due to caching on the exit node's side. When querying ttdnsd with dig, I'm told the received message is 512 bytes long.

comment:3 in reply to:  2 Changed 6 years ago by T(A)ILS developers

Replying to T(A)ILS developers:

tor-resolve still fails, but that may be due to caching on the exit node's side.

tor-resolve now works fine too.

comment:4 Changed 6 years ago by cypherpunks

comment:5 Changed 6 years ago by intrigeri

Resolution: duplicate
Status: newclosed

Accordingly closing as a duplicate. Sorry for the noise. Next short-term steps, from Tails PoV, are to be researched on https://labs.riseup.net/code/issues/7161.

Note: See TracTickets for help on using tickets.