Comments (5)
This is not really an rpki-client issue.
a) your system resolver prefers IPv6 over IPv4, this can be altered in resolv.conf (family inet4 inet6)
b) idnic should stop putting a AAAA IPv6 record in their DNS entry if they can't provide reliable IPv6 connectivity
In older version of rpki-client this is worse because of the lack of proper session keep-alive. There will be a new version in the coming days that fixes this.
from rpki-client-portable.
I'm seeing the same issue with IDNIC while using transit from AS1299. Personally it feels like the timeout for IPv6 (until the fallback to IPv happens) seems to be longer when using https rather when using rsync (even with rpki-client 7.3)…could that be?
from rpki-client-portable.
The http code uses getaddrinfo() and then connects to the IPs returned. I think this is a common idiom and the timeouts are all driven by libc and the kernel. openrsync uses the same method not sure about GNU rsync it kind of does the same but the code is complex with extra options on top.
As mentioned above, this is not something rpki-client must fix, the code works and the fallback happens. This is a problem of IDNIC publishing a broken IPv6 setup on systems preferring IPv6 over IPv4.
from rpki-client-portable.
The http code uses getaddrinfo() and then connects to the IPs returned. I think this is a common idiom and the timeouts are all driven by libc and the kernel. openrsync uses the same method not sure about GNU rsync it kind of does the same but the code is complex with extra options on top. As mentioned above, this is not something rpki-client must fix, the code works and the fallback happens. This is a problem of IDNIC publishing a broken IPv6 setup on systems preferring IPv6 over IPv4.
I don't think I can couch this as an obligation, but I observe its an implicit DOS on all your dual-stack clients: block V6 in novel ways, and your client hangs for an inordinate period of time. In the DNS, people do things in parallel in async ways to avoid this. in the web browser, the HE code does things in parallel to avoid this. It's a huge complexity and I can "get" you want to keep it simple. I just observe, its a royal pain. I think you could mitigate.
I think you should code more defensively. (btw I have sought to communicate with IDNIC about their platform)
If you want to go to WONTFIX I won't kick up a stink. i think this is a missed opportunity, but sure: all workarounds have cost.
from rpki-client-portable.
We don't think this needs fixing right now. Having a bad IPv6 CA repo will increase runtime but it is something that operators can fix by adjusting resolv.conf or reject routing IPv6 prefixes. Having workarounds for broken setups is out of scope for rpki-client.
from rpki-client-portable.
Related Issues (20)
- Issuer certificate not found even tough it is in cache `ta` folder HOT 5
- better documentation on metrics
- vis.c warning on debian HOT 1
- Nightly GitHub Action failure: undefined reference to `spl_read'
- Nightly GitHub Action failure HOT 2
- outformats patch misaligned HOT 2
- 7.9 - release HOT 2
- Nightly GitHub Action failure HOT 2
- Upload signing public key of rpki-client to keys.openpgp.org? HOT 2
- Proxy support issues since 8.0 HOT 11
- crash with unhandled entity type 7 HOT 6
- Geofeed validation doesn't seem to work correctly on Ubuntu 22.04.1 LTS - RPKI-client 8.2 HOT 2
- Updated rpki-client interval for crontab?
- Nightly GitHub Action failure HOT 1
- Add ARIN TAL to OpenBSD upstream repository? HOT 2
- Nightly GitHub Action failure HOT 1
- symbol collision between libcompat.a and libtls HOT 2
- Apparent lack of HOST_NAME_MAX on macOS? HOT 2
- GitHub Action failure: undefined reference to `inflate' HOT 1
- Nightly GitHub Action failure: implicit declaration of function 'arc4random_uniform' HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from rpki-client-portable.