Some (mirrored?) websites don't load

bsduck

Hello,
Some websites, like for example freebsd.org, debian.org or archlinux.org refuse to load in either Firefox or Midori, while I can load most others without a problem. I suspect this is because these websites are mirrored and the redirection does not work. What is wrong with my configuration?

bsduck 🤔

Jay

bsduck could it be not installation of mozilla-rootcert ?

bsduck

I investigated a little more and I think the problem comes from time settings. I get stuck at the "TLS-Handshake" phase and read that this kind of problem can be related with a wrong system time. Then I realised my Xfce clock is an hour too early (it shows 00:14 but it is currently 23:14 CET). However if I run xclock it shows the correct time and the system login shell tells me the correct time and timezone. It's something like: the system is set to the correct time and timezone, but Xfce thinks it's set to UTC so it adds +1:00 one more time.

bsduck Did you set the time in rc.conf?
See, https://www.netbsd.org/docs/guide/en/chap-boot.html#chap-boot-system-time

EDIT: Here's mine...

# rc.conf

if [ -r /etc/defaults/rc.conf ]; then
	. /etc/defaults/rc.conf
fi

rc_configured=YES
hostname=mybox
random_file=/etc/entropy-file
securelevel=1
microcode=YES
rtclocaltime=YES
rpcbind=YES
dbus=YES
famd=YES
wpa_supplicant=YES
wpa_supplicant_flags="-B -D bsd -i iwn0 -c /etc/wpa_supplicant.conf"
dhcpcd=YES
dhcpcd_flags="-qM iwn0 -b"
wscons=YES
sshd=YES
raidframe=NO
postfix=NO

JuvenalUrbino

bsduck I always find it advisable to let a reliable NTP server adjust the system time properly at boot; you don't need a ntpd daemon running in background in order to do that, but can use ntpdate(8), which is included in base.

bsduck

I did not enable rtclocaltime because I thought this was in case the BIOS clock was set to local time, which is not the case here (my BIOS clock is set to UTC time). Am I wrong?

bsduck just try it, please.
I thought like you some... time... ago 😉

As for your other issue with backlight...
I don't know if/when I have time but, without promises I'll look at it.

bsduck

I tried and then as expected the Xfce clock was on time but the system time was wrong (showing the UTC time but telling it was CET). It didn't solve the TLS problem. I think the problem comes from the difference between these two clocks (just why is Xfce adding +1:00?), but maybe it's something else. I'm going to investigate this next week.

Don't waste too much of your free time for me, this is not a priority 🙂
As for now I'm just exploring NetBSD. If everything I need turns out to be possible with it I may consider using it more seriously.

bsduck

I just tried to set the system timezone to UTC (# ln -fs /usr/share/zoneinfo/UTC /etc/localtime) and now all clocks agree on displaying the same time. Really strange behaviour.
But this didn't solve the websites problem, so it must be something else...
... and I will set the timezone to CET again and tell the Xfce clock to display the "Europe/London" time to get the correct one.

el-topo

I don't use Xfce with NetBSD but I ln /etc/localtime to Stockholm in my case while having the BIOS clock set to UTC and it haven't given me any issues with websites or otherwise so I wonder a bit about pin's solution 🙂

el-topo Yes, I have both...
in /etc
lrwxr-xr-x 1 root wheel 36 Dec 22 17:18 localtime -> /usr/share/zoneinfo/Europe/Stockholm
and in /etc/rc.conf
rtclocaltime=YES

bsduck

I ran # mozilla-rootcerts install which indeed installed the certificates, so they were not, however after reboot I tried to open the websites again but it was still not working. I'm giving up for now.

el-topo

Someone in the #netbsd irc told me I should install mozilla-rootcerts-openssl when I had trouble connecting to Github and that did indeed solve the problem.

el-topo hmm...
...git-base desktop-file-utils feh mozilla-rootcerts-openssl

el-topo

pin I built git from current I think, perhaps that was the problem?

el-topo Sorry, I was not refering to that...
Usually I prefer to install mozilla-rootcerts-openssl straight away 😉

bsduck

I finally found out where the problem is: IPv6.
I activated network.dns.disableIPv6 in Firefox and now it loads everything fine.

That clock thing was probably unrelated (no idea if the bug is still there, I don't use Xfce anymore).

Anyway: is there a way to disable IPv6 system-wide? I couldn't find any.

rvp

bsduck Anyway: is there a way to disable IPv6 system-wide? I couldn't find any.

Before doing this, see if your ISP (and their dinky little router boxes) already support IPv6:

Add these to /etc/rc.conf

dhcpcd=YES
dhcpcd_flags="-6"

This will try to get your home router to assign your NetBSD machine an IPv6 address (assuming here that you have a static IPv4 addr.). If the router/ISP doesn't support IPv6 (my current one doesn't), then those lines are still OK--keep 'em.

Then, try:

$ ping6 -nc10 google.com

What's the output?

bsduck

I already had

dhcpcd=YES
dhcpcd_flags="-qM wm0"

from default installer configuration.

I tried removing those flags and running dhcpcd with just -6 instead. That doesn't make a difference, sites that don't load (such as freebsd.org) still don't load in Firefox if I don't use network.dns.disableIPv6 and still do if I do.

ping6 seems fine:

PING6(56=40+8+8 bytes) 2001:1715:4e20:851:9e38:9b22:1686:dae0 --> 2a00:1450:400a:808::200e
16 bytes from 2a00:1450:400a:808::200e, icmp_seq=0 hlim=61 time=9.932 ms
16 bytes from 2a00:1450:400a:808::200e, icmp_seq=1 hlim=61 time=8.927 ms
16 bytes from 2a00:1450:400a:808::200e, icmp_seq=2 hlim=61 time=8.917 ms
16 bytes from 2a00:1450:400a:808::200e, icmp_seq=3 hlim=61 time=8.983 ms
16 bytes from 2a00:1450:400a:808::200e, icmp_seq=4 hlim=61 time=8.935 ms
16 bytes from 2a00:1450:400a:808::200e, icmp_seq=5 hlim=61 time=8.921 ms
16 bytes from 2a00:1450:400a:808::200e, icmp_seq=6 hlim=61 time=8.916 ms
16 bytes from 2a00:1450:400a:808::200e, icmp_seq=7 hlim=61 time=8.930 ms
16 bytes from 2a00:1450:400a:808::200e, icmp_seq=8 hlim=61 time=8.931 ms
16 bytes from 2a00:1450:400a:808::200e, icmp_seq=9 hlim=61 time=8.936 ms

--- google.com ping6 statistics ---
10 packets transmitted, 10 packets received, 0.0% packet loss
round-trip min/avg/max/std-dev = 8.916/9.033/9.932/0.317 ms

So I think I do have proper IPv6.

Anyway: dhcpcd_flags="-4" is what I was looking for.
Everything works fine that way, and not only in Firefox.

Thank you!

rvp

bsduck So I think I do have proper IPv6.

Anyway: dhcpcd_flags="-4" is what I was looking for.
Everything works fine that way, and not only in Firefox.

Cool. Though, it's a shame to not use IPv6 when you clearly have it (ICMPv6 bi-dir is OK; routing works).

I was going to suggest checking your firewall(s) (both on the ISP router and elsewhere--if you have it) to see if the other sorts of IPv6 traffic was being blocked...but, this is your show...