Re: [RFC] unbound: Increase timeout value for unknown dns-server

[Tapani Tarvainen <ipfire@tapanitarvainen.fi>]

[-- Attachment #1: Type: text/plain, Size: 1945 bytes --]

On Wed, Jan 06, 2021 at 03:14:52PM +0000, Michael Tremer (michael.tremer(a)ipfire.org) wrote:

> > On 6 Jan 2021, at 12:02, Paul Simmons <mbatranch(a)gmail.com> wrote:
> > 
> > On 1/6/21 4:17 AM, Jonatan Schlag wrote:
> >> When unbound has no information about a DNS-server
> >> a timeout of 376 msec is assumed. This works well in a lot of situations,
> >> but they mention in their documentation that this could be way too low.
> >> They recommend a timeout of 1126 msec for satellite connections
> >> (https://nlnetlabs.nl/documentation/unbound/unbound.conf).

A small nit, they actually suggest 1128 ... and that's indeed what
the patch has:

> >> +	unknown-server-time-limit: 1128

But that's trivial. The point:

> I am not entirely sure what this is supposed to fix.

> It is possible that a DNS response takes longer than 376ms, indeed.
> Does it harm us if we send another packet? No.

If you are behind a slow satellite link, it can take more than that
*every time*. So you would always have sent another query before
getting a response to the previous one.

With TCP that would mean never getting a response, because you'd
always terminate the connection too soon. With UDP, I'm not sure,
depends on how unbound handles incoming responses to queries it's
already deemed lost and sent again. Adjusting delay-close might help.
But it may be it would not work at all when the limit is too small.

That would mean that someone installing IPFire in some remote location
with a slow link would conclude that it just doesn't work.

The downside of increasing the limit is that sometimes replies will
take longer when a packet is lost on the way because we'd wait longer
before re-sending. So it should not be increased too much either.

I don't have data to judge what the limit should be, but I'd tend to
trust nllabs recommendation here and go with the suggested 1128 ms.

-- 
Tapani Tarvainen