Extra CPU usage by DNS filtering when in flight mode / no Internet connection

[ameshkov]

Please answer the following questions for yourself before submitting an issue

• Filters were updated before reproducing an issue
• I checked the knowledge base and found no answer
• I checked to make sure that this issue has not already been filed

AdGuard version

All v4.X versions

Environment

• OS version: Any Android version
• Device: Any Android device

HTTPS filtering

• yes, I do

Root access

• yes, I have it

Integration with AdGuard VPN

• yes, I do

Routing mode

Local VPN

Which DNS server do you use?

AdGuard DNS Non-filtering

DNS protocol

DNS-over-HTTPS

Issue Details

This issue was discovered while troubleshooting another one: #5505 (comment) (reported by @0x4a4700)

Please inspect the logs attached to the linked private JIRA task, they demonstrate the issue.

Here's what happens:

1. Device is in flight mode
2. At the same time local VPN tunnel is still up so the device "thinks" that the Internet is available.
3. The app (Streamio) continues to send DNS queries and AdGuard goes through the "full cycle" for every DNS query: tries to bootstrap the resolver and send the DNS query and when it fails it sends a SERVFAIL response. The app does not have any back-off strategy so it sends a new DNS query immediately.

Why this can be important: this is not just about flight mode. Android can limit Internet connectivity when idle so it's a normal situation when there's no Internet connection at night. Actually, this is what happens on the affected user's device - at night time there's extra CPU usage due to Streamio "bombarding" AdGuard with DNS queries.

Expected Behavior

I had already suggested a solution to @sfionov and @ngorskikh in another issue: we have to change the default approach to handling failed DNS queries instead of crafting a SERVFAIL response. For most of the cases it will be enough to just change one default value for a setting in DnsLibs configuration.

Ultimately, we need to emulate DNS query timeout instead of sending a SERVFAIL in response.

It should be done in the case of any network issue that does not allow us to do the resolution.

This includes the following cases:

1. Real upstream timeout.
2. Inability to bootstrap the upstream resolver.
3. Inability to connect to the upstream resolver.

However, if we were able to bootstrap the resolver AND connect to it I think it's fine to return SERVAIL.

Actual Behavior

Currently, we emulate a SERVFAIL response in the case when AdGuard fails to do the DNS resolution. This leads to apps making extra DNS queries (and in the case of Streamio it is a ton of extra DNS queries).