DNS trouble?

[OscarHedeby]

Hi

We have this problem where everything works until we use our domain. We have gotten a confirmation email from apple confirming their OHTTP relay has been configured to talk to our gateway. There is no difference in the console when using the domain or the ip, but only the ip is working. The build is installed through TestFlight on an iPhone running the latest iOS version. Running it directly from Xcode works as long as we only use http and our ip address.

Unless the error seems obvious to anybody, Im only looking for ways to debug this.

Just a quick summery of what we have tried:

• Works with the PIR service running locally
• Works with the PIR service on a server
• Does not work with PIR service running on server AND using our domain

Even when it doesn't work we can see that the client is querying the server, and that the server is returning a response.

default	13:28:10.500696+0200	installd	0x16d55f000 -[MIInstallationJournalEntry _refreshUUIDForContainer:withError:]: Data container for dk.wearesafe.app.safe-caller is now at /private/var/mobile/Containers/Data/PluginKitPlugin/90B912D9-A763-4B75-A0D8-D873A930D950
default	13:28:11.255883+0200	callservicesd	discovered extensions: attributes <private>, extensionSet {(
    <EXConcreteExtension: 0xd3731b480> {id = com.truesoftware.TrueCallerOther.IncrementalCallerID},
    <EXConcreteExtension: 0xd3731b720> {id = com.truesoftware.TrueCallerOther.Block},
    <EXConcreteExtension: 0xd3731b100> {id = com.truesoftware.TrueCallerOther.PriorityCallerID},
    <EXConcreteExtension: 0xd3731b9c0> {id = com.truesoftware.TrueCallerOther.TrueCallerId},
    <EXConcreteExtension: 0xd3731baa0> {id = dk.wearesafe.app.safe-caller},
    <EXConcreteExtension: 0xd37318ee0> {id = com.truesoftware.TrueCallerOther.TrueLiveCallerID}
)}
default	13:29:38.733951+0200	com.apple.CallKit.CallDirectory	initWithUseCase:sourceApplicationBundleIdentifier: using sourceApplicationBundleIdentifier 'dk.wearesafe.app.safe-caller' for useCase 'dk.wearesafe.app.safe-caller.block'
default	13:29:38.734730+0200	com.apple.CallKit.CallDirectory	initWithUseCase:sourceApplicationBundleIdentifier: using sourceApplicationBundleIdentifier 'dk.wearesafe.app.safe-caller' for useCase 'dk.wearesafe.app.safe-caller.identity'
default	13:29:38.735527+0200	ciphermld	initWithUseCase:sourceApplicationBundleIdentifier: using sourceApplicationBundleIdentifier 'dk.wearesafe.app.safe-caller' for useCase 'dk.wearesafe.app.safe-caller.block'
default	13:29:38.735694+0200	ciphermld	initWithUseCase:sourceApplicationBundleIdentifier: using sourceApplicationBundleIdentifier 'dk.wearesafe.app.safe-caller' for useCase 'dk.wearesafe.app.safe-caller.identity'
default	13:29:38.745302+0200	ciphermld	[C95 34FC689A-66D7-40E5-A9E2-0EFE01042974 Hostname#9d4dd540:443 quic, bundle id: dk.wearesafe.app.safe-caller, url hash: 566239dc, expected workload: 0, definite, attribution: developer, using ephemeral configuration, context: NWURLSession (sensitive), proc: 8A826FA2-125B-38B5-A574-B70B44DCDBAC, effective proc: 5014E8FC-7C9D-3627-B6F4-AF2E997C72F6, delegated upid: 0] start
default	13:29:38.753014+0200	ciphermld	[C96 ECD793E1-434E-43C5-B972-D8EFB736807C Hostname#9d4dd540:443 quic, bundle id: dk.wearesafe.app.safe-caller, url hash: 566239dc, expected workload: 0, definite, attribution: developer, using ephemeral configuration, context: NWURLSession (sensitive), proc: 8A826FA2-125B-38B5-A574-B70B44DCDBAC, effective proc: 5014E8FC-7C9D-3627-B6F4-AF2E997C72F6, delegated upid: 0] start
default	13:29:38.763673+0200	ciphermld	[C97 5FAF114E-A115-4CB6-85B7-BE21AB35719E 172.224.41.3:443 quic, bundle id: dk.wearesafe.app.safe-caller, expected workload: 0, definite, attribution: developer, using ephemeral configuration, context: Default Network Context (private), proc: 8A826FA2-125B-38B5-A574-B70B44DCDBAC, effective proc: 5014E8FC-7C9D-3627-B6F4-AF2E997C72F6, delegated upid: 0] start
default	13:29:38.812774+0200	symptomsd	Data Usage for dk.wearesafe.app.safe-caller (delegation: com.apple.ciphermld) on flow 488601 - WiFi in/out: 1391283/15299443, WiFi delta_in/delta_out: 1256/2940, Cell in/out: 0/0, Cell delta_in/delta_out: 0/0, RNF: 0, subscriber tag: 6, total duration: 0.050
default	13:29:39.015188+0200	ciphermld	[C95 34FC689A-66D7-40E5-A9E2-0EFE01042974 Hostname#9d4dd540:443 quic, bundle id: dk.wearesafe.app.safe-caller, url hash: 566239dc, expected workload: 0, definite, attribution: developer] cancel
default	13:29:39.015532+0200	ciphermld	[C95 34FC689A-66D7-40E5-A9E2-0EFE01042974 Hostname#9d4dd540:443 quic, bundle id: dk.wearesafe.app.safe-caller, url hash: 566239dc, expected workload: 0, definite, attribution: developer] cancelled
	[C95.1.1.1.1.1 F7D265E7-51A8-445D-8384-F9CB8F10E4B8 192.168.50.46:62876<->172.224.41.3:443]
	Connected Path: satisfied (Path is satisfied), viable, interface: en0[802.11], ipv4, dns, uses wifi, LQM: good
	Privacy Stance: Proxied
	Duration: 0.270s, DNS @0.006s took 0.006s, QUIC @0.017s took 0.042s
	bytes in/out: 3860/65253, packets in/out: 27/58, rtt: 0.015s, retransmitted bytes: 0, out-of-order bytes: 803
	ecn packets sent/acked/marked/lost: 0/0/0/0
default	13:29:39.018261+0200	ciphermld	[C96 ECD793E1-434E-43C5-B972-D8EFB736807C Hostname#9d4dd540:443 quic, bundle id: dk.wearesafe.app.safe-caller, url hash: 566239dc, expected workload: 0, definite, attribution: developer] cancel
default	13:29:39.018382+0200	ciphermld	[C96 ECD793E1-434E-43C5-B972-D8EFB736807C Hostname#9d4dd540:443 quic, bundle id: dk.wearesafe.app.safe-caller, url hash: 566239dc, expected workload: 0, definite, attribution: developer] cancelled
	[C96.1.1.1.1.1 F7D265E7-51A8-445D-8384-F9CB8F10E4B8 192.168.50.46:62876<->172.224.41.3:443]
	Connected Path: satisfied (Path is satisfied), viable, interface: en0[802.11], ipv4, dns, uses wifi, LQM: good
	Privacy Stance: Proxied
	Duration: 0.264s, DNS @0.060s took 0.004s, QUIC @0.064s took 0.001s
	bytes in/out: 3860/65253, packets in/out: 27/58, rtt: 0.015s, retransmitted bytes: 0, out-of-order bytes: 803
	ecn packets sent/acked/marked/lost: 0/0/0/0
default	13:29:42.100768+0200	symptomsd	Data Usage for dk.wearesafe.app.safe-caller (delegation: com.apple.ciphermld) on flow 488601 - WiFi in/out: 1395399/15364192, WiFi delta_in/delta_out: 4116/64749, Cell in/out: 0/0, Cell delta_in/delta_out: 0/0, RNF: 0, subscriber tag: 6, total duration: 3.334
default	13:29:44.103286+0200	com.apple.CallKit.CallDirectory	initWithUseCase:sourceApplicationBundleIdentifier: using sourceApplicationBundleIdentifier 'dk.wearesafe.app.safe-caller' for useCase 'dk.wearesafe.app.safe-caller.block'
default	13:29:44.104834+0200	com.apple.CallKit.CallDirectory	initWithUseCase:sourceApplicationBundleIdentifier: using sourceApplicationBundleIdentifier 'dk.wearesafe.app.safe-caller' for useCase 'dk.wearesafe.app.safe-caller.identity'
default	13:29:44.105151+0200	ciphermld	initWithUseCase:sourceApplicationBundleIdentifier: using sourceApplicationBundleIdentifier 'dk.wearesafe.app.safe-caller' for useCase 'dk.wearesafe.app.safe-caller.block'
default	13:29:44.105429+0200	ciphermld	initWithUseCase:sourceApplicationBundleIdentifier: using sourceApplicationBundleIdentifier 'dk.wearesafe.app.safe-caller' for useCase 'dk.wearesafe.app.safe-caller.identity'
default	13:29:44.110990+0200	ciphermld	[C98 18215EEB-AF21-4865-8D7C-36641571A638 Hostname#9d4dd540:443 quic, bundle id: dk.wearesafe.app.safe-caller, url hash: 566239dc, expected workload: 0, definite, attribution: developer, using ephemeral configuration, context: NWURLSession (sensitive), proc: 8A826FA2-125B-38B5-A574-B70B44DCDBAC, effective proc: 5014E8FC-7C9D-3627-B6F4-AF2E997C72F6, delegated upid: 0] start
default	13:29:44.117537+0200	ciphermld	[C99 95860FF1-8254-4C59-98E3-F732AD0146BD Hostname#9d4dd540:443 quic, bundle id: dk.wearesafe.app.safe-caller, url hash: 566239dc, expected workload: 0, definite, attribution: developer, using ephemeral configuration, context: NWURLSession (sensitive), proc: 8A826FA2-125B-38B5-A574-B70B44DCDBAC, effective proc: 5014E8FC-7C9D-3627-B6F4-AF2E997C72F6, delegated upid: 0] start
default	13:29:44.251768+0200	ciphermld	[C98 18215EEB-AF21-4865-8D7C-36641571A638 Hostname#9d4dd540:443 quic, bundle id: dk.wearesafe.app.safe-caller, url hash: 566239dc, expected workload: 0, definite, attribution: developer] cancel
default	13:29:44.252079+0200	ciphermld	[C98 18215EEB-AF21-4865-8D7C-36641571A638 Hostname#9d4dd540:443 quic, bundle id: dk.wearesafe.app.safe-caller, url hash: 566239dc, expected workload: 0, definite, attribution: developer] cancelled
	[C98.1.1.1.1.1 F7D265E7-51A8-445D-8384-F9CB8F10E4B8 192.168.50.46:62876<->172.224.41.3:443]
	Connected Path: satisfied (Path is satisfied), viable, interface: en0[802.11], ipv4, dns, uses wifi, LQM: good
	Privacy Stance: Proxied
	Duration: 0.140s, DNS @0.004s took 0.001s, QUIC @0.007s took 0.000s
	bytes in/out: 4742/125160, packets in/out: 39/107, rtt: 0.009s, retransmitted bytes: 0, out-of-order bytes: 1320
	ecn packets sent/acked/marked/lost: 0/0/0/0
default	13:29:44.274801+0200	ciphermld	[C99 95860FF1-8254-4C59-98E3-F732AD0146BD Hostname#9d4dd540:443 quic, bundle id: dk.wearesafe.app.safe-caller, url hash: 566239dc, expected workload: 0, definite, attribution: developer] cancel
default	13:29:44.274832+0200	ciphermld	[C99 95860FF1-8254-4C59-98E3-F732AD0146BD Hostname#9d4dd540:443 quic, bundle id: dk.wearesafe.app.safe-caller, url hash: 566239dc, expected workload: 0, definite, attribution: developer] cancelled
	[C99.1.1.1.1.1 F7D265E7-51A8-445D-8384-F9CB8F10E4B8 192.168.50.46:62876<->172.224.41.3:443]
	Connected Path: satisfied (Path is satisfied), viable, interface: en0[802.11], ipv4, dns, uses wifi, LQM: good
	Privacy Stance: Proxied
	Duration: 0.144s, DNS @0.007s took 0.001s, QUIC @0.009s took 0.000s
	bytes in/out: 5276/125206, packets in/out: 40/108, rtt: 0.009s, retransmitted bytes: 0, out-of-order bytes: 1320
	ecn packets sent/acked/marked/lost: 0/0/0/0

[karulont]

I believe that the root cause is a configuration issue on Apple's OHTTP relay.
When you filled out the onboarding form you said that:

Expected response size (kb)
1.2

So the relay was configured to limited the response size at ~10KB. Actual response size is about 25kb.
So we need to update the relay configuration to allow for larger responses.

I believe you should see a HTTP 502 error, when this happens, but the logs showed here do not show that far.

When you are using the IP address and installing from Xcode, then you are bypassing the OHTTP relay and the phone is connecting directly to the server. When you use the domain name, the OHTTP relay is used and the above issue will not let it work.

[OscarHedeby]

Ahhh ok, that makes sense.

Does the response size scale with the total database size, or could I fix this by tweaking the shading parameter?

[karulont]

The response size does not scale with the total database size.
It depends on the encryption parameters & number of hash functions.

[OscarHedeby]

That makes a lot of sense, I must have made some wrong measurements when we did the request.

Do you know if this would require a resubmission or if apple support would be able to increase the size at this point?

[karulont]

I have made the request to get the response size limit increased. Not need to resubmit. However, be advised that it is going to take some time.

[OscarHedeby]

Perfect, thank you so much

[karulont]

Let's keep this issue open. I will close it when I hear back that the configuration has been changed.

[OscarHedeby]

Hello again, have you heard anything back from the team updating the configuration?