'emerge sync' not working; sudden rsync hostname problems?

plate · Posted: Tue Mar 11, 2003 1:31 am Post subject:

I can only suspect it's the provider who blocks TCP/53, I'm not doing it. And it's not even my access provider, the DNS I'm using is outside of their reach. I'm friendly with the DNS admin, but his say in what the network settings at the server location are is limited, too. Anyway, given the number of people who ran into this problem, can anyone think of a solution that doesn't involve searching for a more permissive DNS?

If somebody had said to me six months ago that I'd be worrying about UDP overspill one day...

aja · Posted: Tue Mar 11, 2003 2:01 am Post subject:

I've been doing a bit of reading. It seems that the practice of blocking TCP port 53 is done by some providers/routers/ISPs to block zone transfer attacks by script kiddies. This practice is consdered 'acceptable' by said organizations because most normal DNS queries are UDP. This is, as near as I can tell, considered the wrong thing because:

(1) The problem with fall-over to TCP for large DNS responses (what is biting us).

(2) TCP is used by DNS to handly lossy network conditions

(3) Some country domains require TCP/53 on name servers.

(4) It doesn't necessarily solve the zone transfers problem because there are protocols for UDP zone transfer.

And -- here's the big one -- RFC1035 (the DNS spec) specifically describes the fall-back to tcp for large DNS responses - so blocking TCP53 violates the DNS spec.

Looks to me like the TCP/53 blocking that is going on is a classic Microsoft-style response to a security problem - disable or cripple the service rather than resolve the issue.

That being said, I realize I'm being a bit of a purist (which is easy, because I'm not experiencing the problem). Do we want to put our standards hat on and tell people to take it to their ISPs or do we want to find a way to keep the DNS responses down at the UDP size to help our poor benighted brethren?

It seems to me that, with the amount of stuff that we are downloading to people during a typical emerge sync, we could feed them an updated server list and have some sort of client-side resolution of which rsync server to use (randomize? based on geography? based on current load downloaded from a central source?. The problem there is that we need to trust people (or at least most of them) not to spoof it to ensure that the load stays balanced.

Of course, that's just my opinion, I could be wrong... :-)

CJayNC · n00b Joined: 09 Mar 2003 Posts: 11 Location: Lexington, SC

Hi,

Just wanted to say thanks to everyone for your explanations. I'm not blocking TCP/53 either, but I imagine my ISP is...

The reduction in the number of servers that klieber mentioned has allowed sync to work for me again, but now that I know of the "preferred", possibly long-term solution (use the country-code-/continent- based domains), I'll gladly use that.

Thanks again,
CJ

perry · Posted: Tue Mar 11, 2003 4:12 am Post subject:

axxackall · Posted: Tue Mar 11, 2003 4:41 am Post subject:

Adding the country code to SYNC variable worked for me. Although I don't understand, why so much of fighting instead of extending the functionality of mirrorselct by handling the mirror setting also for rsync (in addition to setting of mirrors for downloading as mirrorselect is already doing today).

Of course I expect such patch for mirrorselect from rsync sysadmins, unless they still insist that the problem is on the client side and we users should do it ourself.

aja · Posted: Tue Mar 11, 2003 7:23 am Post subject:

batty-work · n00b Joined: 19 Feb 2003 Posts: 5 Location: Northampton

I completely agree that the Sys Admins will be helping the rest of us out of a hole (ISP's blocking TCP/53).
Though I may be biased cos I'm a sys admin myself.

I hadn't realised the UDP DNS query spilled over into TCP. I will be having a word with my ISP shortly. I'll let people know if I have any luck.

I think a feature improvement to extend the use of mirrorselect would be a benefit.
_________________
Cheers!

Batty:)

Do not meddle in the affairs of sysadmins, for they are subtle and quick to anger.

klieber · Posted: Tue Mar 11, 2003 10:13 am Post subject:

DaFire · n00b Joined: 07 Nov 2002 Posts: 25

It was definitly not a firewall issue.

I had no problems resolving other host... just this rsync.gentoo.org could not get resolved.

why should changing the dns server in resolv.conf to an other dns server in the net fix an firewall issue ??

I guess it was a server problem since about 6 or 7 ebuild scripts i got during the upade were corruped ( missing brackets in the last line etc.)

klieber · Posted: Tue Mar 11, 2003 1:24 pm Post subject:

klieber · Posted: Tue Mar 11, 2003 1:42 pm Post subject:

OK, I've been doing some testing related to various solutions. In an effort to put this whole "what caused the problem???" issue to rest, I invite people who were experiencing the problem before to try the following: (note: you need the bind-tools package emerged on your system in order for 'host' to work)

perry · Posted: Tue Mar 11, 2003 11:56 pm Post subject:

plate · Posted: Wed Mar 12, 2003 1:05 am Post subject:

Yes. He knew that.

Possible solution, but be very aware that I'm completely in the dark about how to implement this: Couldn't you create a cascading resolution scheme? rsync.gentoo.org points to rsync[1-5].gentoo.org or rsync.[continent].gentoo.org, which in turn point to a list of selected actual mirrors? The round-robin would still get to see them all, but doesn't blow out of proportion on the first resolution attempt.

klieber · Posted: Wed Mar 12, 2003 1:39 am Post subject:

plate · Posted: Wed Mar 12, 2003 2:15 am Post subject:

Well, nice try, I guess. Hope you're having more promising strokes of genius than me...

klieber · Posted: Wed Mar 12, 2003 2:18 am Post subject:

aja · Posted: Thu Mar 13, 2003 3:39 pm Post subject:

Is there a potential client-side solution?

What about the upthread suggestion to modify mirrorselect (axxackall, I think)?

Is there a way to use individual computer's localization settings (timezone?) to set a server (that might then round-robin a subset of the servers)?

Is my ignorance showing? :-)

vericgar · Posted: Thu Mar 13, 2003 4:40 pm Post subject:

ok, I hate to start this flame war, but what about migrating the rsync.gentoo.org nameservers to djbdns? when using a large round robin DNS it randomly chooses 8 of the servers and returns them in the UDP response. the next request will be another randomly generated 8 of the servers.
_________________
+~+ Sometimes a good ole loving kick is all it needs +~+

klieber · Posted: Thu Mar 13, 2003 4:51 pm Post subject:

klieber · Posted: Thu Mar 13, 2003 4:53 pm Post subject:

aja · Posted: Thu Mar 13, 2003 5:29 pm Post subject:

FarcePest · n00b Joined: 27 Jan 2003 Posts: 10 Location: Georgia, US

tore- · n00b Joined: 30 Sep 2002 Posts: 32

I've got some problems with this to, i think.

At the boostrap process i get an error with the gcc-3.2.2(?) pack.
Im using 1.3_rc3 stage1, i have'nt access to a full error msg right now but is this error related to this problem?

klieber · Posted: Thu Mar 20, 2003 3:01 pm Post subject:

co-D · n00b Joined: 19 Mar 2003 Posts: 16

..after installing iptables, emerge sync would hang on the first line longer than i cared to find out,,, and i noticed it worked fine when i turned the firewall off.

after it not working today, i tried dmesg and i noticed DPT=873 blocked, opening that TCP port and trying emerge sync once again worked for me.