Both at work and at home I use vscode a lot. The main reason to use vscode is the extension ecosystem that enhances it in all kinds of ways.

And while I think it’s a native component, I consider the (Markdown) preview feature part of this.

Sadly, recently this feature no longer worked for me. I mainly noticed this on the corporate laptop. For reasons related to the remote machine I mainly work on, I use the vscode serve-web variant there.

I’m not sure whether this was part of the issue, but at least it made it easy to use the chrome tools to investigate what’s wrong.

The Problem

#

The problem was quite simple. When I tried to use the markdown preview in vscode, it didn’t work. The error:

1bga7dmns1juqodksn1380pfm0pknqc9k70ogl3613kl3hd3ivhb.vscode-cdn.net took too long to respond

Which tells us everything we need to know. So after this happened a couple times, I decide it’s time to look into the chrome devtooling. But they aren’t terribly more helpful. While it gives a full URL, the error is still just net:ERR_TIMED_OUT. And the timing tells me the connection never got established.

Curl -v

#

The next step is to get out curl. With the -v flag, it will tell you which IP address it uses. It looks something like

$ curl -v https://1bga7dmns1juqodksn1380pfm0pknqc9k70ogl3613kl3hd3ivhb.vscode-cdn.net
* Host 1bga7dmns1juqodksn1380pfm0pknqc9k70ogl3613kl3hd3ivhb.vscode-cdn.net:443 was resolved.
* IPv6: 2603:1061:14:135::1
* IPv4: 150.171.110.53
*   Trying [2603:1061:14:135::1]:443...
* ALPN: curl offers h2,http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* SSL Trust Anchors:
*   OpenSSL default paths (fallback)
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS change cipher, Change cipher spec (1):
* Recv failure: Connection reset by peer
* TLS connect error: error:00000000:lib(0)::reason(0)
* OpenSSL SSL_connect: Connection reset by peer in connection to 1bga7dmns1juqodksn1380pfm0pknqc9k70ogl3613kl3hd3ivhb.vscode-cdn.net:443
* closing connection #0
curl: (35) Recv failure: Connection reset by peer

Huh. IPv6… That’s always a bit fishy. Let’s try IPv4.

$ curl -4v https://1bga7dmns1juqodksn1380pfm0pknqc9k70ogl3613kl3hd3ivhb.vscode-cdn.net -o /dev/null
* Host 1bga7dmns1juqodksn1380pfm0pknqc9k70ogl3613kl3hd3ivhb.vscode-cdn.net:443 was resolved.
* IPv6: (none)
* IPv4: 150.171.110.56
*   Trying 150.171.110.56:443...
[...]
* Established connection to 1bga7dmns1juqodksn1380pfm0pknqc9k70ogl3613kl3hd3ivhb.vscode-cdn.net (150.171.110.56 port 443) from 192.168.1.7 port 59574

now that looks a lot better. I also figured, I cannot ping the host.

$ ping -6 1bga7dmns1juqodksn1380pfm0pknqc9k70ogl3613kl3hd3ivhb.vscode-cdn.net
PING 1bga7dmns1juqodksn1380pfm0pknqc9k70ogl3613kl3hd3ivhb.vscode-cdn.net (2603:1061:14:133::1) 56 data bytes
^C
--- 1bga7dmns1juqodksn1380pfm0pknqc9k70ogl3613kl3hd3ivhb.vscode-cdn.net ping statistics ---
4 packets transmitted, 0 received, 100% packet loss, time 3107ms

So while I first thought the issue might be in my setup, curl -6 works perfectly fine for google infra:

curl -v6 https://www.google.com -o /dev/null
* Host www.google.com:443 was resolved.
* IPv6: 2001:4860:482d:7700::, 2001:4860:4826:7700::, 2001:4860:4827:7700::, 2001:4860:4828:7700::, 2001:4860:4829:7700::, 2001:4860:482a:7700::, 2001:4860:482b:7700::, 2001:4860:482c:7700::
* IPv4: (none)
*   Trying [2001:4860:482d:7700::]:443...
[...]
* Established connection to www.google.com (2001:4860:482d:7700:: port 443) from [...] port 54230

so something must be wrong with that particular server.

Fixing it the infra way

#

Obviously as infra eng, I cannot let this pass and must find a way to fix this problem.

Luckily I run an overengineered home network and got just the tool: DNS.

I run knot resolver as my main edge resolving DNS. So with a quick config snippet, that only took ~one corporate meeting worth of time to write, I can solve this problem once and for all.

lua:
  script: |
    policy.add(function(req, qry)
      if qry == nil then return end

      local name = kres.dname2str(qry.sname)
      local type_str = tostring(qry.stype)
      if qry.stype == kres.type.AAAA then
        if name:match("%.vscode%-cdn%.net%.$") or name == "vscode-cdn.net." then
          print(string.format("%s (%s)", name, type_str))
          return policy.DENY
        end
        if name:match("%.visualstudio%.com%.$") or name == "visualstudio.com" then
          print(string.format("%s (%s)", name, type_str))
          return policy.DENY
        end
      end
    end)

Because now, by DNS, there is no IPv6 address for this server:

curl -v https://1bga7dmns1juqodksn1380pfm0pknqc9k70ogl3613kl3hd3ivhb.vscode-cdn.net -o /dev/null
* Host 1bga7dmns1juqodksn1380pfm0pknqc9k70ogl3613kl3hd3ivhb.vscode-cdn.net:443 was resolved.
* IPv6: (none)
* IPv4: 150.171.110.52
*   Trying 150.171.110.52:443...

And everyone is happy ever after.

Discovered during writeup

#

So, fun fact. While writing this, I first thought they had solved the problem and I can no longer demonstrate the curl commands. BUT! the error was in the command I used for testing:

curl 1bga7dmns1juqodksn1380pfm0pknqc9k70ogl3613kl3hd3ivhb.vscode-cdn.net -v
*   Trying [2603:1061:14:135::1]:80...
* Host 1bga7dmns1juqodksn1380pfm0pknqc9k70ogl3613kl3hd3ivhb.vscode-cdn.net:80 was resolved.
* IPv6: 2603:1061:14:135::1
* IPv4: 150.171.110.54
* Established connection to 1bga7dmns1juqodksn1380pfm0pknqc9k70ogl3613kl3hd3ivhb.vscode-cdn.net (2603:1061:14:135::1 port 80) from [...] port 42588

It works on port 80, but not 443… I’m honestly mad.

What it tells us

#

It wasn’t really worth looking at the ping. Pings often get dropped for stupid reasons :/