From owner-freebsd-stable@freebsd.org Mon Aug 17 13:27:45 2015 Return-Path: Delivered-To: freebsd-stable@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id D537E9BB336 for ; Mon, 17 Aug 2015 13:27:45 +0000 (UTC) (envelope-from Mark.Martinec@ijs.si) Received: from mail.ijs.si (mail.ijs.si [IPv6:2001:1470:ff80::25]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 8883C1635 for ; Mon, 17 Aug 2015 13:27:45 +0000 (UTC) (envelope-from Mark.Martinec@ijs.si) Received: from amavis-ori.ijs.si (localhost [IPv6:::1]) by mail.ijs.si (Postfix) with ESMTP id 3mvx4t1hlbz120; Mon, 17 Aug 2015 15:27:42 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ijs.si; h= user-agent:message-id:references:in-reply-to:organization :subject:subject:from:from:date:date:content-transfer-encoding :content-type:content-type:mime-version:received:received :received:received; s=jakla4; t=1439818059; x=1442410060; bh=Cbt 7081f2ZWeGIjIjfLNHxaWJJ5HgNzFIKnax2GbKJY=; b=dLtV5nDc1tuSoHiZpo0 RWNjdOxLvI/dCmSEPgTQuoKSfeJiHQqjSrGJTl71j4AudvoYtNEedh1P8XJopnQn Hm/RGdtNnyv69ofKxxU9vbGzC20zojXJ65mVq9PtqjzHJL6kkohX1cOkVxMoIl8E g/2yPX/nQZgA4PrDVmDEkJiQ= X-Virus-Scanned: amavisd-new at ijs.si Received: from mail.ijs.si ([IPv6:::1]) by amavis-ori.ijs.si (mail.ijs.si [IPv6:::1]) (amavisd-new, port 10026) with LMTP id C4ZbmLotii6c; Mon, 17 Aug 2015 15:27:39 +0200 (CEST) Received: from mildred.ijs.si (mailbox.ijs.si [IPv6:2001:1470:ff80::143:1]) by mail.ijs.si (Postfix) with ESMTP id 3mvx4q1z5tz11y; Mon, 17 Aug 2015 15:27:39 +0200 (CEST) Received: from nabiralnik.ijs.si (mailbox.ijs.si [IPv6:2001:1470:ff80::143:1]) by mildred.ijs.si (Postfix) with ESMTP id 3mvx4q09wpz1Q; Mon, 17 Aug 2015 15:27:39 +0200 (CEST) Received: from sleepy.ijs.si ([2001:1470:ff80:e001::1:1]) by nabiralnik.ijs.si with HTTP (HTTP/1.1 POST); Mon, 17 Aug 2015 15:27:39 +0200 MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII; format=flowed Content-Transfer-Encoding: 7bit Date: Mon, 17 Aug 2015 15:27:39 +0200 From: Mark Martinec To: Christian Kratzer Cc: freebsd-stable@freebsd.org Subject: Re: freebsd-update to 10.2-RELEASE broken ? Organization: Jozef Stefan Institute In-Reply-To: References: <2C3CC22D-749A-4B92-885C-D73311997050@gid.co.uk> <20150816180715.GM40589@home.opsec.eu> Message-ID: <9c6d132a96b08934c440300a43cf3ef4@mailbox.ijs.si> X-Sender: Mark.Martinec@ijs.si User-Agent: Roundcube Webmail/1.1.2 X-BeenThere: freebsd-stable@freebsd.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: Production branch of FreeBSD source code List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 17 Aug 2015 13:27:45 -0000 > On Sun, 16 Aug 2015, Kimmo Paasiala wrote: >> It could be the classic fall back to TCP on SRV records problem on >> your upstream DNS forwarder if you're using one: >> http://lists.freebsd.org/pipermail/freebsd-ports/2012-May/074801.html >> >> The cure would be to use your own caching DNS resolver (configured to >> query the authoritative name servers directly) such as dns/unbound. 2015-08-16 Christian Kratzer wrote: > I run my own bind9 resolvers on freebsd 10 at both sites. I never > particurlarly like the concept of an "upstream" resolver. > > All my resolvers are behind firewalls although different kinds. > ASA at one site and freebsd pf at the other. > > I will investigate though. Thanks for the tip. ASA firewall has a nasty setting to *discard* DNS UDP packets with UDP message size over 512 bytes, i.e. it does not allow EDNS0 option. Check that you have this DNS deep packet inspection misfeature turned off. Check also the firewall log. This would affect UDP DNS responses to a SRV query _http._tcp.update.FreeBSD.org, which comes close to the size limit (possibly depending on geolocation). Using google's public DNS server may avoid the problem by stripping nonessential records from the DNS reply (like the ADDITIONAL SECTION). Mark