coq.inria.fr IPv6 issue?

[erikmd]

Description of the problem

This is a follow-up of the issue raised on Zulip, which is still reproducible:

it seems the coq.inria.fr server has some configuration issue w.r.t. IPv6, which can also impact opam update:

$ opam update

<><> Updating package repositories ><><><><><><><><><><><><><><><><><><><><><><>
[default] no changes from https://opam.ocaml.org/
[ERROR] Could not update repository "coq-extra-dev": OpamDownload.Download_fail(_, "Curl failed:
        \"/usr/bin/curl --write-out %{http_code}\\\\n --retry 3 --retry-delay 2 --user-agent opam/2.0.5
        -L -o /tmp/opam-31195-4bcc67/index.tar.gz.part
        https://coq.inria.fr/opam/extra-dev/index.tar.gz\" exited with code 35")
[ERROR] Could not update repository "coq-released": OpamDownload.Download_fail(_, "Curl failed:
        \"/usr/bin/curl --write-out %{http_code}\\\\n --retry 3 --retry-delay 2 --user-agent opam/2.0.5
        -L -o /tmp/opam-31195-9b8556/index.tar.gz.part https://coq.inria.fr/opam/released/index.tar.gz\"
        exited with code 35")

To be more precise, here is an example session on a Linux environment where DNS addresses appear to resolve to IPv6 first:

$ timeout -s SIGINT 10s curl -s -v -o /dev/null https://coq.inria.fr
* Rebuilt URL to: https://coq.inria.fr/
*   Trying 2001:41d0:305:2100::8b43...
* TCP_NODELAY set
* Connected to coq.inria.fr (2001:41d0:305:2100::8b43) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: /etc/ssl/certs
* TLSv1.2 (OUT), TLS header, Certificate Status (22):
} [5 bytes data]
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
} [512 bytes data]

$ timeout -s SIGINT 10s ping coq.inria.fr
PING coq.inria.fr(2001:41d0:305:2100::8b43 (2001:41d0:305:2100::8b43)) 56 data bytes

--- coq.inria.fr ping statistics ---
10 packets transmitted, 0 received, 100% packet loss, time 9222ms

while it is OK with IPv4:

$ sudo docker run --rm -it debian

root@9d275163954e:/# timeout -s SIGINT 10s ping coq.inria.fr
PING coq.inria.fr (51.91.56.51) 56(84) bytes of data.
64 bytes from 51.ip-51-91-56.eu (51.91.56.51): icmp_seq=1 ttl=58 time=39.1 ms
64 bytes from 51.ip-51-91-56.eu (51.91.56.51): icmp_seq=2 ttl=58 time=298 ms
64 bytes from 51.ip-51-91-56.eu (51.91.56.51): icmp_seq=3 ttl=58 time=59.6 ms
64 bytes from 51.ip-51-91-56.eu (51.91.56.51): icmp_seq=4 ttl=58 time=100 ms
64 bytes from 51.ip-51-91-56.eu (51.91.56.51): icmp_seq=5 ttl=58 time=40.8 ms
64 bytes from 51.ip-51-91-56.eu (51.91.56.51): icmp_seq=6 ttl=58 time=36.8 ms
64 bytes from 51.ip-51-91-56.eu (51.91.56.51): icmp_seq=7 ttl=58 time=416 ms
64 bytes from 51.ip-51-91-56.eu (51.91.56.51): icmp_seq=8 ttl=58 time=132 ms
64 bytes from 51.ip-51-91-56.eu (51.91.56.51): icmp_seq=9 ttl=58 time=36.5 ms
64 bytes from 51.ip-51-91-56.eu (51.91.56.51): icmp_seq=10 ttl=58 time=42.3 ms

--- coq.inria.fr ping statistics ---
10 packets transmitted, 10 received, 0% packet loss, time 13ms
rtt min/avg/max/mdev = 36.528/120.106/415.658/124.943 ms
root@9d275163954e:/# 

ideas on how this could be fixed or workarounded? (especially for the opam update use case)

[maximedenes]

@erikmd Thanks for reporting! The DNS resolution seems ok, the web server too (no IPv4-specific config), but there seems to be something wrong on the network routes set up by the VPS. I'll try to fix that first.

[maximedenes]

@erikmd do you mind testing again?

[erikmd]

Hi @maximedenes, yes, that seems very OK now:

$ timeout -s SIGINT 10s ping coq.inria.fr
PING coq.inria.fr(2001:41d0:305:2100::8b43 (2001:41d0:305:2100::8b43)) 56 data bytes
64 bytes from 2001:41d0:305:2100::8b43 (2001:41d0:305:2100::8b43): icmp_seq=1 ttl=47 time=28.2 ms
64 bytes from 2001:41d0:305:2100::8b43 (2001:41d0:305:2100::8b43): icmp_seq=2 ttl=47 time=28.6 ms
64 bytes from 2001:41d0:305:2100::8b43 (2001:41d0:305:2100::8b43): icmp_seq=3 ttl=47 time=35.5 ms
64 bytes from 2001:41d0:305:2100::8b43 (2001:41d0:305:2100::8b43): icmp_seq=4 ttl=47 time=46.1 ms
64 bytes from 2001:41d0:305:2100::8b43 (2001:41d0:305:2100::8b43): icmp_seq=5 ttl=47 time=27.3 ms
64 bytes from 2001:41d0:305:2100::8b43 (2001:41d0:305:2100::8b43): icmp_seq=6 ttl=47 time=53.4 ms
64 bytes from 2001:41d0:305:2100::8b43 (2001:41d0:305:2100::8b43): icmp_seq=7 ttl=47 time=29.1 ms
64 bytes from 2001:41d0:305:2100::8b43 (2001:41d0:305:2100::8b43): icmp_seq=8 ttl=47 time=29.0 ms
64 bytes from 2001:41d0:305:2100::8b43 (2001:41d0:305:2100::8b43): icmp_seq=9 ttl=47 time=28.9 ms
64 bytes from 2001:41d0:305:2100::8b43 (2001:41d0:305:2100::8b43): icmp_seq=10 ttl=47 time=28.5 ms

--- coq.inria.fr ping statistics ---
10 packets transmitted, 10 received, 0% packet loss, time 9012ms
rtt min/avg/max/mdev = 27.330/33.500/53.499/8.593 ms

and opam update was successful on this machine.

Thanks for the fix!