Date: Wed, 19 Apr 2023 22:39:53 +0000 From: bugzilla-noreply@freebsd.org To: ports-bugs@FreeBSD.org Subject: [Bug 270912] dns/unbound: issues with ASLR Message-ID: <bug-270912-7788-sjONdkucHa@https.bugs.freebsd.org/bugzilla/> In-Reply-To: <bug-270912-7788@https.bugs.freebsd.org/bugzilla/> References: <bug-270912-7788@https.bugs.freebsd.org/bugzilla/>
next in thread | previous in thread | raw e-mail | index | archive | help
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D270912 --- Comment #2 from Joshua Kinard <freebsd@kumba.dev> --- It appears to be failing in the SSL/TLS handshake to the upstream forwarders after a period of time. Almost seems like a queue is getting backed up somewhere and things start overflowing. I've spent the last hour trying to debug it, thinking it was a problem w/ Quad9 itself. The key error in log files from Unbound is this: > unbound[19]: [19:2] error: SSL_handshake syscall: Connection reset by peer I've turned up the verbosity, but the additional detail does not shed any additional light on why the connection was reset (no SSL errors/reasons, et= c).=20 It seems like everything just works with each connection until it doesn't. I started noticing these issues when my Squid proxy would just start return= ing read errors after launching a browser on one of my desktops. Waiting about ~30s-1m after launching the browser seemed to let the dust settle and then things would seemingly work fine for hours before you'd see things start to hiccup again. Websites that do a *lot* of background chatter, like Twitter, Facebook, etc, seemed to trip the issue up the most because they pile the queries up and seem to overload Unbound, causing the SSL errors to appear. A good way to reproduce is first, silence outbound network traffic on the network, or at least traffic that will hit a particular Unbound DNS server.= =20=20 Edit the config, set verbosity to '2' and restart the daemon. tail -f the = log file and once it's loaded up, find a Windows box, and launch MS Edge. Edge makes a *ton* of queries at once when it loads and on my end, the first few= got resolved fine against Quad9, then the SSL errors would start to appear, cau= sing Unbound to try other forwarders and eventually giving up and returning SERVFAIL. Can confirm, though, that turning ASLR off for the Unbound binary appears to make things smooth again. --=20 You are receiving this mail because: You are the assignee for the bug.=
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-270912-7788-sjONdkucHa>