freebsd stable - Aug 2015 - freebsd-update to 10.2-RELEASE broken ?

On Sun, Aug 16, 2015 at 10:07 PM, Christian Kratzer <ck-lists at
cksoft.de> wrote:
> Hi,
>
> On Sun, 16 Aug 2015, Kurt Jaeger wrote:
> <snipp/>
>>
>> We assumed that I have a DNS problem because of this line:
>>
>>> Looking up update.FreeBSD.org mirrors... none found.
>>
>>
>> This happens with this query inside the freebsd-update script, at
>> line 950:
>>
>> host -t srv _http._tcp.update.FreeBSD.org
>>
>> If you prime your DNS cache with manual queries, then freebsd-update
>> will sometimes find the hosts and will report that it found some hosts.
>>
>> But, I just tried to reproduce this and failed, the problem persists.
>>
>> So, yes, it looks like a real issue.
>
>
> hmmm. Thanks for pointing me at the dns issue.
>
> I actually did not see that message as it seems to only appear on
> subsequent rounds of running freebsd-update.  I always deleted
> /var/db/freebsd-update and thus always started clean.
>
> I was able to complete the freebsd-update upgrade when I manually
> specified on of the mirrors as in:
>
>     freebsd-update -s update2.freebsd.org -r 10.2-RELEASE upgrade
>
> So this does seem to be a dns related issue.  It could also be the
> related to parsing the results of the dns lookup.
>
> Anyway seems we have a workaround if we specify the mirrors manually.
>
> Greetings
> Christian
>
> --


It could be the classic fall back to TCP on SRV records problem on
your upstream DNS forwarder if you're using one:

http://lists.freebsd.org/pipermail/freebsd-ports/2012-May/074801.html

The cure would be to use your own caching DNS resolver (configured to
query the authoritative name servers directly) such as dns/unbound.

-Kimmo

Hi,

On Sun, 16 Aug 2015, Kimmo Paasiala wrote:
> It could be the classic fall back to TCP on SRV records problem on
> your upstream DNS forwarder if you're using one:
>
> http://lists.freebsd.org/pipermail/freebsd-ports/2012-May/074801.html
>
> The cure would be to use your own caching DNS resolver (configured to
> query the authoritative name servers directly) such as dns/unbound.
I run my own bind9 resolvers on freebsd 10 at both sites.   I never
particurlarly like the concept of an "upstream" resolver.

All my resolvers are behind firewalls although different kinds.
ASA at one site and freebsd pf at the other.

I will investigate though.  Thanks for the tip.

Greetings
Christian

-- 
Christian Kratzer                   CK Software GmbH
Email:   ck at cksoft.de               Wildberger Weg 24/2
Phone:   +49 7032 893 997 - 0       D-71126 Gaeufelden
Fax:     +49 7032 893 997 - 9       HRB 245288, Amtsgericht Stuttgart
Mobile:  +49 171 1947 843           Geschaeftsfuehrer: Christian Kratzer
Web:     http://www.cksoft.de/

Hi!
> It could be the classic fall back to TCP on SRV records problem on
> your upstream DNS forwarder if you're using one:
> 
> http://lists.freebsd.org/pipermail/freebsd-ports/2012-May/074801.html
If I query that same DNS resolver using the line from
the script, it works every time. It's a 10.1p16 host with
a very recent ports build, and directly connected (no NAT, no
fw etc).

If that would be the problem, how could I diagnose it in depth ?

-- 
pi at opsec.eu            +49 171 3101372                         5 years to go
!