Bootstrapping DOH and DOT uses system resolver on Windows #770

bestpika · 2019-05-20T01:04:23Z

Steps to reproduce

Install as service
Run ipconfig /flushdns
Run AdGuardHome.exe -s start
Run nslookup www.google.com

Expected behavior

Return something.

Actual behavior

If I get the timeout, always timeout.
When the timeout, [Test upstreams] will get the error.
But If I set any DNS (direct set IP) at the first upstream DNS, it will work.

Config: AdGuardHome.zip

Your environment

Description	Value
Version of AdGuard Home server:	v0.95-hotfix
How did you setup DNS configuration:	System
If it's a router or IoT, please write device model:	PC
Operating system and version:	Windows 10 x64/Windows 8.1 x64

The text was updated successfully, but these errors were encountered:

ameshkov · 2019-05-20T07:16:13Z

Well, it seems that CloudFlare DNS is not reachable from your place. You should contact your internet service provider and report this issue.

bestpika · 2019-05-20T07:34:02Z

When it happened, I can use nslookup to use 1.1.1.1 to query.
So I can reach Cloudflare DNS at that time.
I try setting 8.8.8.8:53, the problem still happened.

ameshkov · 2019-05-20T07:36:22Z

@bestpika maybe the issue is with their DNS-over-HTTPS server only?

What does AGH print to the log?

bestpika · 2019-05-20T07:45:41Z

Here is the log: log.zip
Flush system DNS cache before run service can reproduce this problem.
After setting a DNS (direct use IP) then apply (at log line 326) and the error is gone.

ameshkov · 2019-05-20T08:39:30Z

@bestpika could you please run AGH with -v parameter so that it printed more information? I can't see what's the root cause of the issue from the log.

bestpika · 2019-05-20T09:03:58Z

log.zip

Step:

Run ipconfig /flushdns
Run AdGuardHome.exe -v

When error, I can query DNS use 1.1.1.1 or 8.8.8.8.

line 3124: add DNS tls://1.1.1.1

ameshkov · 2019-05-20T09:28:36Z

2019/05/20 17:01:23 17520#67 [debug] github.com/AdguardTeam/dnsproxy/upstream.lookup(): failed to lookup for cloudflare-dns.com in 9999 milliseconds using 1.1.1.1:53: i/o timeout

ameshkov · 2019-05-20T09:29:37Z

Bootstrap DNS is set to 1.1.1.1 and it fails to resolve the IP addresses.
I have no clue why it works using nslookup, though:(

Try changing bootstrap DNS to 8.8.8.8 and see if there's any change

bestpika · 2019-05-20T09:34:25Z

2019/05/20 17:01:23 17520#68 [debug] github.com/AdguardTeam/dnsproxy/upstream.lookup(): failed to lookup for cloudflare-dns.com in 10000 milliseconds using 8.8.8.8:53: i/o timeout

In this log, 8.8.8.8 can't resolve too.

bestpika · 2019-05-20T09:36:36Z

After line 4243, it can get the IP address.
And it uses tls://1.1.1.1 not bootstrap DNS.

ameshkov · 2019-05-20T09:40:47Z

What happened after 4243?

bestpika · 2019-05-20T09:42:28Z

I have no idea.
But I set tls://1.1.1.1 at upstream DNS at line 1807.

ameshkov · 2019-05-20T09:47:41Z

@szolin plz take a look, maybe you can see what's wrong here

bestpika · 2019-05-20T09:50:28Z

If my upstreams DNS have any IP based DNS (like 1.1.1.1:53 or tls://1.1.1.1), I won't get any error.

ameshkov · 2019-05-20T09:52:28Z

Does it work if you disable browsing security?

ameshkov · 2019-05-20T09:53:39Z

So there's possibly an issue when:

Parallel resolution is enabled
Browsing security is enabled
All upstreams require bootstrapping

@szolin plz don't miss this

bestpika · 2019-05-20T09:59:17Z

I disable

protection_enabled
filtering_enabled
safebrowsing_enabled

still get the error.

bestpika · 2019-05-20T10:02:22Z

Please clear system DNS cache before the test.

bestpika · 2019-05-20T10:09:30Z

I disabled all filter.
It gets no error.
So the problem is caused by updating filter?

ameshkov · 2019-05-20T10:11:04Z

Not really, it looks as if it randomly fails to resolve the upstream's domain name. I don't know why, though.

bestpika · 2019-05-20T10:14:56Z

Oh, I try again, it got error too.

bestpika · 2019-05-20T10:19:47Z

All disabled, still error.

ameshkov · 2019-05-20T10:20:57Z

Try a different bootstrap DNS.

Try 176.103.130.130 and remove other addresses.

bestpika · 2019-05-20T10:24:00Z

I try

101.101.101.101
168.95.1.1
1.1.1.1
8.8.8.8
176.103.130.130

(only set one bootstrap DNS) and get the same error.

Only upstream DNS have IP based DNS won't get the error.

ameshkov · 2019-05-20T10:26:23Z

Then I have no idea what's wrong, and I cannot reproduce this issue.

I'll reopen this issue, maybe @szolin will see something

bestpika · 2019-05-20T10:28:41Z

By the way, my two computers are behind the wireless ap (different model).

ameshkov · 2019-05-20T10:31:14Z

It does not matter.

For some reason, for the first minute or so, AGH fails to bootstrap the addresses of the upstream servers. Maybe some firewall messes with it, maybe something else, I can only say what I see in the log.

This is clearly not a bug, but something specific to your computer configuration.

Onepamopa · 2019-06-05T08:00:47Z

The problem consists of using domains in the "Upstream DNS servers".

The bootstrap servers I use are 8.8.8.8 and 1.1.1.1 - they work when the SYSTEM DNS (The one in the network card's IPv4 settings) is not changed to 127.0.0.1.

As soon as I change the SYSTEM dns to 127.0.0.1 - AdGuard is unable to resolve the upstream DNS hostnames and the whole system looses DNS. It's like there are no bootstrap DNS servers at all.

If I place a tls://1.1.1.1 in Upstream DNS - I got resolve and adguard processes the system's DNS queries.

ameshkov · 2019-06-05T08:02:44Z

@Onepamopa just in case, what OS are you using?

Onepamopa · 2019-06-05T08:03:40Z

Windows 10 64 bit

ameshkov · 2019-06-05T08:04:43Z

Interesting, two identical issues both on Windows. This might be a bug of golang, we'll take a look at it.

Onepamopa · 2019-06-08T15:50:03Z

Still does not work, this issue should not be closed.

When SYSTEM resolver is set to AGH (127.0.0.1), AGH will not resolve the host names of Upstream DNS servers. Bootstrap DNS servers not working in this case.

Onepamopa · 2019-06-08T15:54:53Z

Steps to reproduce:

Set up AGH with the following Upstream DNS servers:
https://dns.cloudflare.com/dns-query
sdns://AgUAAAAAAAAAACAe9iTP_15r07rd8_3b_epWVGfjdymdx-5mdRZvMAzBuQ5kbnMuZ29vZ2xlLmNvbQ0vZXhwZXJpbWVudGFs
Set your desired bootstrap DNS servers.
Save settings.
Open network card's properties, go to TCP/IP and set DNS servers to: 127.0.0.1
System immediately looses DNS.
Open DNS serttings of AGH and click: "Test upstreams".
You will see red popups showing "Unable to resolve xyz whatever".

This indicates the bootstrap DNS servers are NOT USED AT ALL to resolve hostnames for upstream DNS servers.

ameshkov · 2019-06-09T15:07:11Z

Reopened and assigned back to v0.97.

@szolin could you please take a look at this?

szolin · 2019-06-10T08:05:54Z

@Onepamopa Can you attach new logs with v0.96-hotfix?

Onepamopa · 2019-06-11T19:32:33Z

@szolin I will do that tomorrow.

Onepamopa · 2019-06-13T14:14:46Z

I see what is going on - it's related to IPv6. I have IPv6 disabled on my network card, but adguard tries to connect using IPv6:
2019/06/13 17:11:13 19420#256 [debug] github.com/AdguardTeam/dnsproxy/upstream.createDialContext.func1(): Dialing to [2606:4700::6810:f8f9]:443 2019/06/13 17:11:13 19420#178 [debug] github.com/AdguardTeam/dnsproxy/upstream.createDialContext.func1(): dialer failed to initialize connection to [2606:4700::6810:f8f9]:443, in 10000 milliseconds, cause: dial tcp [2606:4700::6810:f8f9]:443: i/o timeout 2019/06/13 17:11:13 19420#178 [debug] github.com/AdguardTeam/dnsproxy/upstream.createDialContext.func1(): Dialing to [2606:4700::6810:f9f9]:443 2019/06/13 17:11:13 19420#58 [debug] github.com/AdguardTeam/dnsproxy/upstream.createDialContext.func1(): dialer failed to initialize connection to [2606:4700:4700::1111]:853, in 10001 milliseconds, cause: dial tcp [2606:4700:4700::1111]:853: i/o timeout 2019/06/13 17:11:13 19420#58 [debug] github.com/AdguardTeam/dnsproxy/upstream.createDialContext.func1(): Dialing to [2606:4700:4700::1001]:853 2019/06/13 17:11:13 19420#43 [debug] github.com/AdguardTeam/dnsproxy/upstream.createDialContext.func1(): dialer failed to initialize connection to [2606:4700:4700::1001]:853, in 10001 milliseconds, cause: dial tcp [2606:4700:4700::1001]:853: i/o timeout 2019/06/13 17:11:13 19420#43 [debug] github.com/AdguardTeam/dnsproxy/upstream.createDialContext.func1(): Dialing to [2606:4700:4700::1111]:853 2019/06/13 17:11:13 19420#49 [debug] github.com/AdguardTeam/dnsproxy/upstream.createDialContext.func1(): dialer failed to initialize connection to [2606:4700:4700::1111]:853, in 10000 milliseconds, cause: dial tcp [2606:4700:4700::1111]:853: i/o timeout 2019/06/13 17:11:13 19420#49 [debug] github.com/AdguardTeam/dnsproxy/upstream.createDialContext.func1(): Dialing to [2606:4700:4700::1001]:853

I suggest an option to enable/disable IPv6.

Onepamopa · 2019-06-18T13:54:58Z

@szolin @ameshkov

ameshkov · 2019-06-18T13:56:13Z

@Onepamopa thanks for the log, please wait till the next update.

szolin · 2019-06-25T13:46:03Z

Please attach the complete log, we need to see why there are no IPv4 addresses which AGH can use.

szolin · 2019-06-26T15:41:28Z

@Onepamopa

ameshkov added the question label May 20, 2019

ameshkov closed this as completed May 20, 2019

ameshkov reopened this May 20, 2019

ameshkov added this to the v0.97 milestone Jun 5, 2019

ameshkov added the compatibility label Jun 5, 2019

ameshkov assigned szolin Jun 5, 2019

ameshkov added bug P3: Medium and removed compatibility labels Jun 5, 2019

ameshkov modified the milestones: v0.97, v0.96 Jun 7, 2019

ameshkov changed the title ~~AGH can't resolve any domain (run AGH after clean the system DNS cache)~~ Bootstrapping DOH and DOT uses system resolver on Windows Jun 7, 2019

ameshkov closed this as completed in 9fe3481 Jun 7, 2019

ameshkov modified the milestones: v0.96, v0.97 Jun 9, 2019

ameshkov reopened this Jun 9, 2019

ameshkov modified the milestones: v0.97, v0.98 Jul 2, 2019

ameshkov closed this as completed Jul 31, 2019

Bootstrapping DOH and DOT uses system resolver on Windows #770

Bootstrapping DOH and DOT uses system resolver on Windows #770

Comments

bestpika commented May 20, 2019 • edited Loading

Steps to reproduce

Expected behavior

Actual behavior

Your environment

ameshkov commented May 20, 2019

bestpika commented May 20, 2019 • edited Loading

ameshkov commented May 20, 2019

bestpika commented May 20, 2019 • edited Loading

ameshkov commented May 20, 2019

bestpika commented May 20, 2019 • edited Loading

ameshkov commented May 20, 2019

ameshkov commented May 20, 2019

bestpika commented May 20, 2019 • edited Loading

bestpika commented May 20, 2019 • edited Loading

ameshkov commented May 20, 2019

bestpika commented May 20, 2019

ameshkov commented May 20, 2019

bestpika commented May 20, 2019

ameshkov commented May 20, 2019

ameshkov commented May 20, 2019

bestpika commented May 20, 2019 • edited Loading

bestpika commented May 20, 2019

bestpika commented May 20, 2019 • edited Loading

ameshkov commented May 20, 2019

bestpika commented May 20, 2019

bestpika commented May 20, 2019

ameshkov commented May 20, 2019

bestpika commented May 20, 2019 • edited Loading

ameshkov commented May 20, 2019

bestpika commented May 20, 2019 • edited Loading

ameshkov commented May 20, 2019

Onepamopa commented Jun 5, 2019

ameshkov commented Jun 5, 2019

Onepamopa commented Jun 5, 2019

ameshkov commented Jun 5, 2019

Onepamopa commented Jun 8, 2019

Onepamopa commented Jun 8, 2019

ameshkov commented Jun 9, 2019

szolin commented Jun 10, 2019

Onepamopa commented Jun 11, 2019

Onepamopa commented Jun 13, 2019

Onepamopa commented Jun 18, 2019

ameshkov commented Jun 18, 2019

szolin commented Jun 25, 2019

szolin commented Jun 26, 2019

bestpika commented May 20, 2019 •

edited

Loading

bestpika commented May 20, 2019 •

edited

Loading

bestpika commented May 20, 2019 •

edited

Loading

bestpika commented May 20, 2019 •

edited

Loading

bestpika commented May 20, 2019 •

edited

Loading

bestpika commented May 20, 2019 •

edited

Loading

bestpika commented May 20, 2019 •

edited

Loading

bestpika commented May 20, 2019 •

edited

Loading

bestpika commented May 20, 2019 •

edited

Loading

bestpika commented May 20, 2019 •

edited

Loading