connecting to packages.sury.org via IPv6

[SlimSchip]

Hi,

My server connects over ipv6 to update packages, however it fails updating although it doe see there are updates available:

Err:1 https://packages.sury.org/php buster/main amd64 php-common all 2:93+020230409.46+debian101.gbpdb4dcc
Could not wait for server fd - select (11: Resource temporarily unavailable) [IP: 2400:52e0:1e01::879:1 443]

it takes a very long time for the error to arrive and that times the number of packages it needs to update.

I checked my firewall for dropped messages or similar, but IPv6 is working fine on all my computers and connecting to the world

I tried : curl -6 https://packages.sury.org/php/dists/buster/main/binary-amd64/packages.gz

and get: curl: (35) error:02FFF036:system library:func(4095):Connection reset by peer

Is this a known issue?

Martijn

[oerdnj]

That seems like a connectivity issue on your side. How do you resolve the IPv6 address?

I can reach the address just fine:

$ openssl s_client -servername packages.sury.org -connect [2400:52e0:1e01::879:1]:443
CONNECTED(00000003)
depth=2 C = US, O = Internet Security Research Group, CN = ISRG Root X1
verify return:1
depth=1 C = US, O = Let's Encrypt, CN = R3
verify return:1
depth=0 CN = packages.sury.org
verify return:1
---
Certificate chain
 0 s:CN = packages.sury.org
   i:C = US, O = Let's Encrypt, CN = R3
   a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256
   v:NotBefore: Mar 20 18:10:34 2023 GMT; NotAfter: Jun 18 18:10:33 2023 GMT
 1 s:C = US, O = Let's Encrypt, CN = R3
   i:C = US, O = Internet Security Research Group, CN = ISRG Root X1
   a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256
   v:NotBefore: Sep  4 00:00:00 2020 GMT; NotAfter: Sep 15 16:00:00 2025 GMT
 2 s:C = US, O = Internet Security Research Group, CN = ISRG Root X1
   i:O = Digital Signature Trust Co., CN = DST Root CA X3
   a:PKEY: rsaEncryption, 4096 (bit); sigalg: RSA-SHA256
   v:NotBefore: Jan 20 19:14:03 2021 GMT; NotAfter: Sep 30 18:14:03 2024 GMT
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIFKDCCBBCgAwIBAgISAxJZ6ZrRDxXcTGiRIjcPFvJYMA0GCSqGSIb3DQEBCwUA
MDIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQswCQYDVQQD
EwJSMzAeFw0yMzAzMjAxODEwMzRaFw0yMzA2MTgxODEwMzNaMBwxGjAYBgNVBAMT
EXBhY2thZ2VzLnN1cnkub3JnMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
AQEAhEPLXO2LvoUg9If024K+QMg4Z1HAclZRXMP632K6fym384ZM7mRC1wHgthjY
dNYfMlq1hHTApmnyQioUZlM3UA0f9jGC8PZgVOXGwroj3mLu5rzfVlXgp7Mzeime
NI4Lv8eSRYs7UPw0Tr+OH1GuMRApwiiyYIzVlJPLRhBXUGgqw73ggMutf8ToEWRP
WJmIy/qhddvU4FAyQJPbDHtUpZZ5rPxxMro8KlCDvNTtmovqS9gxkl7HVx59COyk
MaIGxoFrIxllR0al9OpFIasOGkJB/KuKhLd+tazx35afGJ/Zu2f4ZFNfrWUkmpcV
eMozsPgsXpq4Zo5OHnNYMXtx2QIDAQABo4ICTDCCAkgwDgYDVR0PAQH/BAQDAgWg
MB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAMBgNVHRMBAf8EAjAAMB0G
A1UdDgQWBBQnU52nS9WQKp5k21rA6xyZKQdBMjAfBgNVHSMEGDAWgBQULrMXt1hW
y65QCUDmH6+dixTCxjBVBggrBgEFBQcBAQRJMEcwIQYIKwYBBQUHMAGGFWh0dHA6
Ly9yMy5vLmxlbmNyLm9yZzAiBggrBgEFBQcwAoYWaHR0cDovL3IzLmkubGVuY3Iu
b3JnLzAcBgNVHREEFTATghFwYWNrYWdlcy5zdXJ5Lm9yZzBMBgNVHSAERTBDMAgG
BmeBDAECATA3BgsrBgEEAYLfEwEBATAoMCYGCCsGAQUFBwIBFhpodHRwOi8vY3Bz
LmxldHNlbmNyeXB0Lm9yZzCCAQQGCisGAQQB1nkCBAIEgfUEgfIA8AB3ALc++yTf
nE26dfI5xbpY9Gxd/ELPep81xJ4dCYEl7bSZAAABhwBuMM8AAAQDAEgwRgIhALGD
c1RXlXVyYEMi3V6uTg8rgIGGpK+8hVfUVBmGk+SwAiEA4eONofBIqTXljizQMlLm
OZ6Fa9CzutWmMvz2j+TMPyAAdQDoPtDaPvUGNTLnVyi8iWvJA9PL0RFr7Otp4Xd9
bQa9bgAAAYcAbjDFAAAEAwBGMEQCICZK8jp6g1KzngVgcvmk5PpcyP1uoJ2cdbLf
l9dUnI37AiBaKFagPwVGs5tqFBHiY18QbOgZQwcA252ZrvbmY6lP6TANBgkqhkiG
9w0BAQsFAAOCAQEAoGY3vWx97yCOrMqoAFISO++SAfDdEs6EqBgZ5tCzZRVN3ZaA
qgVX69OeuLf1qHECoiYxFQPJr/bBfa8km4vKE5xDuiLxktbdJ9Z8okfx/OnlCYPX
atxW6Si7F/6i8qiyCFLRiFDQBp3oJ7AEnRO6vsPhz8lpfc61m36OrCMh2/AzsSj8
u0WMPHkeOKWAnNjUZ3HxB9SQ2agNWruROSwUPKpTaGo+5azOXSbCcGaR8t7RHshP
smkoZw2ylgb66Zzha5D2Zu6/z9KRn8bXC4QrCmD59N1yU2TWsnR5BuIPHdpYHwSE
tEnx8vdK21SuOfs3ncWYdTigkPJ+WzmmMP4x4Q==
-----END CERTIFICATE-----
subject=CN = packages.sury.org
issuer=C = US, O = Let's Encrypt, CN = R3
---
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: RSA-PSS
Server Temp Key: X25519, 253 bits
---
SSL handshake has read 4580 bytes and written 403 bytes
Verification: OK
---
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
Server public key is 2048 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---
---
Post-Handshake New Session Ticket arrived:
SSL-Session:
    Protocol  : TLSv1.3
    Cipher    : TLS_AES_256_GCM_SHA384
    Session-ID: 30AA6E5C3BB4D6928E0A4A8627E245740DC1A65A63A079E2DB2BD389B6308BA6
    Session-ID-ctx:
    Resumption PSK: 9EBCCA0148574E2ED595C6BF88E59B22FD7887018BE8299E2C1DBA50448AE8E0BEE89721020D85CCD02AB72186689DC5
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 43200 (seconds)
    TLS session ticket:
    0000 - 50 d4 12 27 2c a8 81 1a-5c d9 cf 35 2a 64 ad 2b   P..',...\..5*d.+
    0010 - 18 5e 1d 25 71 a9 44 fe-d5 07 13 09 c4 c9 a0 80   .^.%q.D.........
    0020 - fb 03 01 bc 4d 3b 0e fe-1c e5 84 b3 af 52 33 d6   ....M;.......R3.
    0030 - ff c4 55 16 67 40 b7 ab-5b fd 6a e4 a3 f2 9e c1   ..U.g@..[.j.....
    0040 - b4 0c 40 b4 b5 8e 48 83-87 b6 15 2d 6d 38 c3 24   ..@...H....-m8.$
    0050 - 56 1f 1a 88 56 31 6e a0-67 3c 12 22 42 7b 9d 89   V...V1n.g<."B{..
    0060 - 2d 30 75 fd 00 05 db 31-de a0 9f dc 16 a6 e1 9a   -0u....1........
    0070 - e6 5e f5 15 55 3f 03 64-4d f4 8b 62 8b 46 7c 82   .^..U?.dM..b.F|.
    0080 - b5 ca a7 0b 5c 7f b1 0b-ab 44 67 6a 23 9f cc 31   ....\....Dgj#..1
    0090 - 82 8a 64 a9 77 32 d4 39-d3 88 c8 cd d8 7e 53 20   ..d.w2.9.....~S
    00a0 - 6f 9b 7a 6a 5f 46 2a 3b-fb 51 a4 be 63 bf 14 c3   o.zj_F*;.Q..c...
    00b0 - 80 1c 31 84 d8 d9 9e 2e-99 78 e0 25 10 9a 40 f2   ..1......x.%..@.
    00c0 - 62 84 49 20 a6 0f 66 6a-97 e4 41 02 aa 7f d9 b4   b.I ..fj..A.....
    00d0 - 56 aa 82 31 84 9f 38 01-98 26 a4 66 02 d7 2e c9   V..1..8..&.f....
    00e0 - e6 41 98 f9 23 2f af 56-01 7e 10 4e 2c 8f c7 18   .A..#/.V.~.N,...

    Start Time: 1681967578
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
    Extended master secret: no
    Max Early Data: 0
---
read R BLOCK
---
Post-Handshake New Session Ticket arrived:
SSL-Session:
    Protocol  : TLSv1.3
    Cipher    : TLS_AES_256_GCM_SHA384
    Session-ID: A52B5CA7069677D694F4BF943097CC60B816EAF8D0B59597CE2FDA3437B27CD0
    Session-ID-ctx:
    Resumption PSK: D725F5D64B54EDFFAB45EFE03445A0B20CC6CE16D3ECBBF6FB5903BC4338B7052BAA46DAE4CFA791AAADA44DE732254E
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 43200 (seconds)
    TLS session ticket:
    0000 - 50 d4 12 27 2c a8 81 1a-5c d9 cf 35 2a 64 ad 2b   P..',...\..5*d.+
    0010 - 43 b5 77 f4 56 fe eb 2a-58 8b 2e 04 1a 08 c3 84   C.w.V..*X.......
    0020 - 8a cd 42 9b 41 12 ec 02-a7 4d 2b b9 4e b1 20 52   ..B.A....M+.N. R
    0030 - a8 12 36 a3 f5 3d ce b7-9d 46 d7 39 84 ba cf cc   ..6..=...F.9....
    0040 - 6c 10 d6 dd 9d 5d e3 ff-fa fa 26 d7 02 88 18 09   l....]....&.....
    0050 - 8a 6b 23 d1 0d 6e b6 23-f1 fd f6 3c ed 71 7d ce   .k#..n.#...<.q}.
    0060 - 2a 69 79 fe 48 dc 0e 49-d9 92 56 48 ba 20 d1 2d   *iy.H..I..VH. .-
    0070 - eb e5 d5 11 31 b6 78 52-a2 fe 74 46 9d 38 63 7b   ....1.xR..tF.8c{
    0080 - 76 9d 8f 69 45 20 b1 ed-a6 4a 90 9c 89 33 2f 3f   v..iE ...J...3/?
    0090 - 09 46 0d 9c 0c af 09 8a-5e d9 91 b7 f1 59 25 70   .F......^....Y%p
    00a0 - fa 8a c8 e8 2d 2c 96 96-a0 95 2e 60 e3 3c 49 41   ....-,.....`.<IA
    00b0 - 6e 37 3d a9 58 26 95 74-5f 57 71 64 cf d0 80 20   n7=.X&.t_Wqd...
    00c0 - bc 63 27 42 03 6e 07 09-44 dd 9f b3 92 27 0a 39   .c'B.n..D....'.9
    00d0 - 53 67 d8 57 17 db 0d 61-2d 2a 85 c4 65 df 53 17   Sg.W...a-*..e.S.
    00e0 - 74 71 a2 f1 37 03 ca be-e8 4c bd c8 28 6a f7 fb   tq..7....L..(j..

    Start Time: 1681967578
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
    Extended master secret: no
    Max Early Data: 0
---
read R BLOCK
GET / HTTP/1.0
Host: packages.sury.org

HTTP/1.1 200 OK
Date: Thu, 20 Apr 2023 05:13:31 GMT
Content-Type: text/html
Connection: close
Vary: Accept-Encoding
Server: BunnyCDN-AMS1-879
CDN-PullZone: 717719
CDN-Uid: a7a277f7-2828-404b-9c94-f3b9b03c0434
CDN-RequestCountryCode: CZ
Cache-Control: public, max-age=2592000
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
CDN-ProxyVer: 1.03
CDN-RequestPullSuccess: True
CDN-RequestPullCode: 200
CDN-CachedAt: 04/10/2023 23:12:34
CDN-EdgeStorageId: 1056
CDN-Status: 200
CDN-RequestId: 07c5b8e09ac221f6d8d5cb1c4d452a64
CDN-Cache: HIT

<html>
<head><title>Index of /</title></head>
<body>
<h1>Index of /</h1><hr><pre><a href="../">../</a>
<a href="apache2/">apache2/</a>                                           28-Feb-2023 11:40                   -
<a href="bind/">bind/</a>                                              28-Feb-2023 11:40                   -
<a href="bind-dev/">bind-dev/</a>                                          28-Feb-2023 11:40                   -
<a href="bind-esv/">bind-esv/</a>                                          28-Feb-2023 11:40                   -
<a href="coccinelle/">coccinelle/</a>                                        02-Mar-2022 09:39                   -
<a href="cppcheck/">cppcheck/</a>                                          02-Mar-2022 09:39                   -
<a href="frr/">frr/</a>                                               02-Mar-2022 09:39                   -
<a href="jenkins-debian-glue/">jenkins-debian-glue/</a>                               02-Mar-2022 09:39                   -
<a href="kea/">kea/</a>                                               02-Mar-2022 09:39                   -
<a href="lmdb/">lmdb/</a>                                              02-Mar-2022 09:39                   -
<a href="nginx/">nginx/</a>                                             28-Feb-2023 11:40                   -
<a href="nginx-mainline/">nginx-mainline/</a>                                    28-Feb-2023 11:40                   -
<a href="php/">php/</a>                                               28-Feb-2023 11:40                   -
<a href="php-qa/">php-qa/</a>                                            02-Mar-2022 09:39                   -
<a href="pool/">pool/</a>                                              03-Mar-2021 08:08                   -
<a href="qbittorrent/">qbittorrent/</a>                                       02-Mar-2022 09:39                   -
<a href="softhsm2/">softhsm2/</a>                                          02-Mar-2022 09:39                   -
<a href="wireguard/">wireguard/</a>                                         02-Mar-2022 09:39                   -
<a href="error403.html">error403.html</a>                                      22-Dec-2019 08:33                1083
<a href="report.html">report.html</a>                                        10-Apr-2023 00:01              964619
</pre><hr></body>
</html>
closed

$ traceroute6 -n 2400:52e0:1e01::879:1
traceroute to 2400:52e0:1e01::879:1 (2400:52e0:1e01::879:1), 30 hops max, 80 byte packets
 1  2001:1ae9:1d5:8d00::1  0.388 ms  0.170 ms  0.121 ms
 2  * * *
 3  * * *
 4  2001:af0:f::1da  11.466 ms  11.645 ms *
 5  * * *
 6  2001:2034:1:6f::1  23.403 ms  23.303 ms  23.285 ms
 7  2001:2034:1:c6::1  30.441 ms  30.286 ms  30.227 ms
 8  2001:2034:0:2a3::1  30.030 ms  29.989 ms  29.970 ms
 9  2001:2000:3080:1::2  30.021 ms 2001:2000:3080:15d9::2  30.094 ms 2001:2000:3080:1::2  30.055 ms
10  2a02:6ea0:1:1::111  29.897 ms 2a02:6ea0:1:1::113  29.861 ms 2a02:6ea0:1:1::109  29.841 ms
11  2400:52e0:1e01::879:1  31.216 ms  30.339 ms  30.303 ms

and

$ ping -n 2400:52e0:1e01::879:1
PING 2400:52e0:1e01::879:1(2400:52e0:1e01::879:1) 56 data bytes
64 bytes from 2400:52e0:1e01::879:1: icmp_seq=1 ttl=53 time=29.8 ms
64 bytes from 2400:52e0:1e01::879:1: icmp_seq=2 ttl=53 time=30.0 ms
64 bytes from 2400:52e0:1e01::879:1: icmp_seq=3 ttl=53 time=30.8 ms
64 bytes from 2400:52e0:1e01::879:1: icmp_seq=4 ttl=53 time=30.1 ms
64 bytes from 2400:52e0:1e01::879:1: icmp_seq=5 ttl=53 time=30.4 ms
64 bytes from 2400:52e0:1e01::879:1: icmp_seq=6 ttl=53 time=30.4 ms
64 bytes from 2400:52e0:1e01::879:1: icmp_seq=7 ttl=53 time=29.9 ms
64 bytes from 2400:52e0:1e01::879:1: icmp_seq=8 ttl=53 time=30.4 ms
64 bytes from 2400:52e0:1e01::879:1: icmp_seq=9 ttl=53 time=30.4 ms
64 bytes from 2400:52e0:1e01::879:1: icmp_seq=10 ttl=53 time=30.4 ms
64 bytes from 2400:52e0:1e01::879:1: icmp_seq=11 ttl=53 time=31.1 ms
64 bytes from 2400:52e0:1e01::879:1: icmp_seq=12 ttl=53 time=30.1 ms
64 bytes from 2400:52e0:1e01::879:1: icmp_seq=13 ttl=53 time=30.2 ms
64 bytes from 2400:52e0:1e01::879:1: icmp_seq=14 ttl=53 time=30.6 ms
^C
--- 2400:52e0:1e01::879:1 ping statistics ---
14 packets transmitted, 14 received, 0% packet loss, time 13021ms
rtt min/avg/max/mdev = 29.771/30.337/31.053/0.341 ms