Bug#1017899: apt - Considers hard DNS errors as transient, prolongs fallback
On Mon, Aug 22, 2022 at 09:47:46AM +0200, Bastian Blank wrote:
> Package: apt
> Version: 2.5.2
> Severity: important
>
> Moin
>
> apt considers all hard DNS errors (NXDOMAIN), aka
> EAI_NONAME from getaddrinfo, as transient and retries.
I'm pretty sure this is the right behavior, there certainly
are very strange captive portals in the wild that will return
wrong DNS results to unauthorized clients; and that's what the
transient error feature is for.
>
> Example response from the http method:
>
> | 400 URI Failure
> | Transient-Failure: true
> | FailReason: ResolveFailure
> | Message: Could not resolve 'test.example.com'
> | URI: https://test.example.com/debian/dists/experimental/InRelease
>
> Responsible code seems to be methods/connect.cc:ConnectToHostname.
>
> So if you use apt-transport-mirror, specifying a non-resolving name just
> forces a retry, four time, before it can go to the backup mirror. This
> means an additional five seconds is added to every download.
>
> It get's a bit complicated, as a SERVFAIL response from DNS seems to
> provoke an EAI_NONAME error as well, as can be easily checked with
> dnssec-failed.org. But as SERVFAIL only gets out if the DNS resolver
> already hit an unrecoverable error during it's one retries or something
> like broken signatures, retrying is also not really useful.
>
> Back story:
>
> For the cloud images we think about specifying something like this via
> apt-transport-mirror if the user does not define anything different:
> | https://vendor.deb.debian.cloud priority:1
> | https://deb.debian.org
>
> This will force a fallback to deb.debian.org if the other one does not
> work. This is meant to be used only if hell breaks loose, so is a last
> resort fallback. However just killing the DNS records for the first
> listed one does produce a lot of retries because of the described
> behaviour.
The integration with mirror fallback is not nice apparently, it
might make more sense to rotate to other mirrors on errors before
retrying the already tried ones.
--
debian developer - deb.li/jak | jak-linux.org - free software dev
ubuntu core developer i speak de, en
Reply to: