DNS Server crashes on settings change using TLS upstream

[Commy]

Prerequisites

• I have checked the Wiki and Discussions and found no answer

• I have searched other issues and found no duplicates

• I want to report a bug and not ask a question

Operating system type

Linux, Other (please mention the version in the description)

CPU architecture

64-bit ARM

Installation

GitHub releases or script from README

Setup

On one machine

AdGuard Home version

107.18

Description

What did you do?

Changed a setting, e.g. enabled DNSSEC or changed the blocking mode. (Doesn’t really matter what setting as long as it restarts the DNS server when applying).

The primary Upstream DNS is configured to use TLS using tls://1.1.1.1:853 or Adguard’s TLS equivalent.

Expected result

Settings should be applied and server should continue to run.

Actual result

DNS Server crashes and stops resolving until a manual restart of the AdGuard Home service.

Screenshots (if applicable)

Additional information

Hardware: Raspberry Pi 3b
OS: Raspbian lite 64 bit (Debian 11 Bullseye)

At first I thought this was due to a conflict with unbound when I installed it. I removed it, same error. I then reinstalled the entire OS and only installed AdGuard Home. Same error. I haven’t seen this error before, but I have started using a TLS upstream only recently. Doesn’t occur when using Plain DNS Upstream.

[monkitrainer]

Noticed the same issue in 107.17+ when trying to save changes in DNS settings.
I've been using 107.16 and never noticed such error until I updated to 107.18. Same issue was happening in 107.17.

/control/dns_config: could not reconfigure the server: closing primary resolvers: stopping dns proxy server: failed to close some upstreams: 3 errors: "failed to close some connections: 5 errors: \"tls: failed to send closeNotify alert (but connection was closed anyway): write tcp 172.19.6.25:39710->1.0.0.1:853: write: broken pipe\", \"tls: failed to send closeNotify alert (but connection was closed anyway): write tcp 172.19.6.25:39718->1.0.0.1:853: write: broken pipe\", \"tls: failed to send closeNotify alert (but connection was closed anyway): write tcp 172.19.6.25:39808->1.0.0.1:853: write: broken pipe\", \"tls: failed to send closeNotify alert (but connection was closed anyway): write tcp 172.19.6.25:39988->1.0.0.1:853: write: broken pipe\", \"tls: failed to send closeNotify alert (but connection was closed anyway): write tcp 172.19.6.25:39994->1.0.0.1:853: write: broken pipe\"", "failed to close some connections: 2 errors: \"tls: failed to send closeNotify alert (but connection was closed anyway): write tcp 172.19.6.25:58688->8.8.4.4:853: write: broken pipe\", \"tls: failed to send closeNotify alert (but connection was closed anyway): write tcp 172.19.6.25:58620->8.8.4.4:853: write: broken pipe\"", "failed to close some connections: tls: failed to send closeNotify alert (but connection was closed anyway): write tcp 172.19.6.25:40034->9.9.9.9:853: write: broken pipe"

[CDzungx]

Same error on v0.108.0-a.381+98af0e00. Occur kinda randomly.

[pendie]

I also experienced it im back 0.107.16

[Maffsie]

I'm experiencing this pretty regularly when saving settings in AdGuard Home 107.18, also only with DoT upstreams (dns.switch.ch and dns10.quad9.net)

[pauly2805]

Happens for me 100% of the time if there is any DoT upstream present. It crashes the entire DNS any time I try to apply any DNS config changes in the web interface. Without any DoT upstreams, problem is gone.
Not sure exactly when this first started occuring but last time I was fiddling with config it didn't have this issue (would be a few versions back)

Adguard version: v0.107.18
Environment: Docker on Unraid v6.11.2
Hardware: Intel 12600k, 64gb ram
Network:

• Docker config: macvlan with dedicated NIC/dedicated IP for adguard home (192.168.5.10) (realtek 2.5g onboard)

2022/11/13 12:13:23.934825 [info] Start reconfiguring the server 2022/11/13 12:13:23.934843 [info] Stopping the DNS proxy server 2022/11/13 12:13:23.935361 [info] Stopped the DNS proxy server 2022/11/13 12:13:23.935479 [error] POST [*my local adguard domain*] /control/dns_config: could not reconfigure the server: closing primary resolvers: stopping dns proxy server: failed to close some upstreams: failed to close some connections: 7 errors: "tls: failed to send closeNotify alert (but connection was closed anyway): write tcp 192.168.5.10:53692->1.0.0.1:853: write: broken pipe", "tls: failed to send closeNotify alert (but connection was closed anyway): write tcp 192.168.5.10:53760->1.0.0.1:853: write: broken pipe", "tls: failed to send closeNotify alert (but connection was closed anyway): write tcp 192.168.5.10:53714->1.0.0.1:853: write: broken pipe", "tls: failed to send closeNotify alert (but connection was closed anyway): write tcp 192.168.5.10:53730->1.0.0.1:853: write: broken pipe", "tls: failed to send closeNotify alert (but connection was closed anyway): write tcp 192.168.5.10:53764->1.0.0.1:853: write: broken pipe", "tls: failed to send closeNotify alert (but connection was closed anyway): write tcp 192.168.5.10:43144->1.0.0.1:853: write: broken pipe", "tls: failed to send closeNotify alert (but connection was closed anyway): write tcp 192.168.5.10:48814->1.0.0.1:853: write: broken pipe"

Works fine again upon restarting the container

[physx2494]

I can confirm everything that pauly2805 wrote. I'm, using AGH on macvlan too.

[Commy]

My problem went away after an update to version 107.19. Did somebody silently fix the issue? I don't see any more errors or server crashes when applying settings.

[Glassertje]

Same thing happens here 107.19 Raspberry Pi 4 wnrt back to DoH

Error: control/dns_config | could not reconfigure the server: closing primary resolvers: stopping dns proxy server: failed to close some upstreams: failed to close some connections: 4 errors: "tls: failed to send closeNotify alert (but connection was closed anyway): write tcp 192.168.50.200:37398->1.0.0.1:853: write: broken pipe", "tls: failed to send closeNotify alert (but connection was closed anyway): write tcp 192.168.50.200:44694->1.0.0.1:853: write: broken pipe", "tls: failed to send closeNotify alert (but connection was closed anyway): write tcp 192.168.50.200:44704->1.0.0.1:853: write: broken pipe", "tls: failed to send closeNotify alert (but connection was closed anyway): write tcp 192.168.50.200:35214->1.0.0.1:853: write: broken pipe" | 500

[buzzwebly]

I'm running 107.19 (on Linux) and it's still an issue, 107.19 didn't fix it.

[kuduacz]

same here on dell wyse dx0d with HA (ADH as addon).
And my adh resolve time jump from 5 ms to 80 ms...

[pbanana]

I'm also having the same issue. I have two AGH setups one on a Pi0 W and Pi4B. I've got NextDNS as my upstream for both DoH and DoT.

[iamydp]

Same question here on v0.107.19 x86_64. But v0.108.0-b.10 arm_64 doesn't have such problem, configurations are totally same.

[ICEY1W32]

Same question here on v0.107.20 x86_64 Docker.

[ainar-g]

Apologies for the long response, everyone. We're preparing a fix in #5251, and we're planning to publish a new release with this issue fixed very soon. I'll merge this issue into that one.