Control: tags 879079 + upstream patch On Thu 2017-10-19 01:44:34 -0400, Daniel Kahn Gillmor wrote:
> kdig +short +tls -p 853 @199.58.81.218 -t a www.ietf.org
[...]
> I note that there appears to be no attempt to call connect() with the
> newer version -- no wonder it's not working!
>
> It seems to work for TCP and UDP, fwiw. Just not for TLS.
This seems to be related to TCP fast open, because the following command
works fine:
kdig +short +nofastopen +tls @dns.cmrg.net www.ietf.org
Upstream has a workaround for it here:
https://gitlab.labs.nic.cz/knot/knot-dns/commit/b72d5cd032795703a2834ebecde321bae21964c6
(included below)
--dkg
From b72d5cd032795703a2834ebecde321bae21964c6 Mon Sep 17 00:00:00 2001 From: Daniel Salzman <[email protected]> Date: Thu, 12 Oct 2017 13:37:39 +0200 Subject: [PATCH] kdig: disable TCP Fastopen by default as it breaks TLS connection --- src/utils/kdig/kdig_params.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/utils/kdig/kdig_params.c b/src/utils/kdig/kdig_params.c index fb5687c0d..9c8b9e5f2 100644 --- a/src/utils/kdig/kdig_params.c +++ b/src/utils/kdig/kdig_params.c @@ -1117,7 +1117,7 @@ query_t *query_create(const char *owner, const query_t *conf) query->operation = OPERATION_QUERY; query->ip = IP_ALL; query->protocol = PROTO_ALL; - query->fastopen = true; + query->fastopen = false; query->port = strdup(""); query->udp_size = -1; query->retries = DEFAULT_RETRIES_DIG; -- 2.14.2
signature.asc
Description: PGP signature
