[Bug]: N26/27 : This server has no working internet connection after upgrade

[sebastienmuller57]

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

Hello,

Since I migrated to version 26.0.7 then 27.1.2 , In Administration > overview, I have this error :

This server has no working internet connection: Multiple endpoints could not be reached. This means that some of the features like mounting external storage, notifications about updates or installation of third-party apps will not work. Accessing files remotely and sending of notification emails might not work, either. Establish a connection from this server to the internet to enjoy all features.

This was working in past without any error. My server has no direct connexion to internet but use proxy.
so DNS lookup is no working directly when I try for example : nslookup www.nextcloud.com, give no response.
but wget www.nextcloud.com, for example, is working because I use proxy.

Seems in the file DnsPinMiddleware.php, this add had been done some times ago, causing my error :

              if (empty($targetIps)) {
                      throw new LocalServerException('No DNS record found for ' . $hostName);
              }

See modification for details : 03f1f1e

When I comment this 3 lines, error connexion disappear and I can again have connexion to internet (when I check Overview page or Apps page to have the update of apps).

Can someone say me if it can be this adding in DnsPinMiddleware.php which can be the root cause ?

Other point : When I made the same upgrade to 26.0.7 then 27.1.2 on another server where connexion internet is UP, all is OK. So I can suppose the modification in DnsPinMiddleware.php can affect a server in a LAN, as in my case. Because my 2 servers have the same configuration.

Thanks for help

Expected behavior

Connexion to internet need to be operationnal.

Installation method

Other Community project

Nextcloud Server version

27

Operating system

RHEL/CentOS

PHP engine version

PHP 8.2

Web server

Nginx

Database engine version

PostgreSQL

Is this bug present after an update or on a fresh install?

Updated from a MINOR version (ex. 22.1 to 22.2)

Are you using the Nextcloud Server Encryption module?

Encryption is Disabled

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

'has_internet_connection' fixed to true,
'proxy' fixed to myproxy:port

List of activated Apps

No response

Nextcloud Signing status

No errors have been found.

Nextcloud Logs

In nextcloud log, I have hist error :
{"reqId":"ut47NCSoxwaHPiEKbGsQ","level":3,"time":"2023-10-12T14:34:44+02:00","remoteAddr":"x.x.x.x","user":"admin","app":"internet_connection_check","method":"GET","url":"/settings/ajax/checksetup","message":"Cannot connect to: www.nextcloud.com","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36","version":"27.1.2.1","exception":{"Exception":"OCP\\Http\\Client\\LocalServerException","Message":"No DNS record found for www.nextcloud.com"
[...]
File":"/u01/app/nextcloud_install/nextcloud/lib/private/Http/Client/DnsPinMiddleware.php","Line":132,"message":"Cannot connect to: www.nextcloud.com","exception":{},"CustomMessage":"Cannot connect to: www.nextcloud.com"}}

Additional info

No response

[solracsf]

Cc @kesselb

[kesselb]

DNS pinning is a protection against server-side request forgery.

To use it, make it possible to resolve dns records or, if you understand the impact, turn it off via #40108.

[sebastienmuller57]

DNS pinning is a protection against server-side request forgery.

To use it, make it possible to resolve dns records or, if you understand the impact, turn it off via #40108.

Thanks for reply. I will do this until I can activate DNS lookup on my server.

[laama1]

Even if this is closed, you should always check if SELinux is blocking your httpd connectin to internet