From bebec8865375011cf74d3c23363d37c9ebec5c4d Mon Sep 17 00:00:00 2001 From: Ronan Pigott Date: Wed, 21 Aug 2024 06:59:22 -0700 Subject: [PATCH 1/5] Revert "resolved: demote the global unicast scope" This commit may have been a breaking change for sd-resolved foreign resolv.conf mode, where a legacy network management daemon directly modifies resolv.conf and sd-resolved consumes that. This reverts commit eded61e410dfa6c16ae68cb624c58122fb18fd0e. --- man/systemd-resolved.service.xml | 5 +---- src/resolve/resolved-dns-scope.c | 3 +-- 2 files changed, 2 insertions(+), 6 deletions(-) diff --git a/man/systemd-resolved.service.xml b/man/systemd-resolved.service.xml index 34f05bd8b0..13c0da987f 100644 --- a/man/systemd-resolved.service.xml +++ b/man/systemd-resolved.service.xml @@ -217,10 +217,7 @@ If a query does not match any configured routing domain (either per-link or global), it is sent to all DNS servers that are configured on links with the DefaultRoute= - option set. - - If no links are configured with DefaultRoute=, it is sent to the - globally configured DNS server. + option set, as well as the globally configured DNS server. If there is no link configured as DefaultRoute= and no global DNS server configured, one of the compiled-in fallback DNS servers is used. diff --git a/src/resolve/resolved-dns-scope.c b/src/resolve/resolved-dns-scope.c index 3bb7c0aa21..21b9844e04 100644 --- a/src/resolve/resolved-dns-scope.c +++ b/src/resolve/resolved-dns-scope.c @@ -778,8 +778,7 @@ DnsScopeMatch dns_scope_good_domain( if (!dns_scope_is_default_route(s)) return DNS_SCOPE_NO; - /* Prefer suitable per-link scopes where possible */ - return s->link ? DNS_SCOPE_MAYBE : DNS_SCOPE_LAST_RESORT; + return DNS_SCOPE_MAYBE; } case DNS_PROTOCOL_MDNS: { From c00157ddc2a72e23d60b61c39961fe4fbfd40ad0 Mon Sep 17 00:00:00 2001 From: Ronan Pigott Date: Wed, 21 Aug 2024 09:36:13 -0700 Subject: [PATCH 2/5] resolved: introduce dns_server_is_fallback --- src/resolve/resolved-dns-server.c | 4 +--- src/resolve/resolved-dns-server.h | 4 ++++ 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/src/resolve/resolved-dns-server.c b/src/resolve/resolved-dns-server.c index 70894977eb..cfdcc6d9bc 100644 --- a/src/resolve/resolved-dns-server.c +++ b/src/resolve/resolved-dns-server.c @@ -100,9 +100,7 @@ int dns_server_new( /* A new DNS server that isn't fallback is added and the one * we used so far was a fallback one? Then let's try to pick * the new one */ - if (type != DNS_SERVER_FALLBACK && - m->current_dns_server && - m->current_dns_server->type == DNS_SERVER_FALLBACK) + if (type != DNS_SERVER_FALLBACK && dns_server_is_fallback(m->current_dns_server)) manager_set_dns_server(m, NULL); if (ret) diff --git a/src/resolve/resolved-dns-server.h b/src/resolve/resolved-dns-server.h index 5e1d5698f6..7d7d294c82 100644 --- a/src/resolve/resolved-dns-server.h +++ b/src/resolve/resolved-dns-server.h @@ -182,4 +182,8 @@ void dns_server_unref_stream(DnsServer *s); DnsScope *dns_server_scope(DnsServer *s); +static inline bool dns_server_is_fallback(DnsServer *s) { + return s && s->type == DNS_SERVER_FALLBACK; +} + int dns_server_dump_state_to_json(DnsServer *server, sd_json_variant **ret); From 73e566bf16341c2064598ccf2a060366113eeccc Mon Sep 17 00:00:00 2001 From: Ronan Pigott Date: Wed, 21 Aug 2024 09:41:35 -0700 Subject: [PATCH 3/5] resolved: introduce link_set_default_route --- src/resolve/resolved-link.c | 14 ++++++++++++++ src/resolve/resolved-link.h | 1 + 2 files changed, 15 insertions(+) diff --git a/src/resolve/resolved-link.c b/src/resolve/resolved-link.c index bb43a73de4..01fa5878a6 100644 --- a/src/resolve/resolved-link.c +++ b/src/resolve/resolved-link.c @@ -766,6 +766,20 @@ void link_next_dns_server(Link *l, DnsServer *if_current) { link_set_dns_server(l, l->dns_servers); } +void link_set_default_route(Link *l, bool b) { + assert(l); + + if (l->default_route == b) + return; + + l->default_route = b; + + /* If we are currently using the fallback servers, changing a link to be default-route means + * we should reconsider whether or not the fallback servers are necessary. */ + if (b && dns_server_is_fallback(l->manager->current_dns_server)) + manager_set_dns_server(l->manager, NULL); +} + DnsOverTlsMode link_get_dns_over_tls_mode(Link *l) { assert(l); diff --git a/src/resolve/resolved-link.h b/src/resolve/resolved-link.h index 0695a6ff83..482a4b4148 100644 --- a/src/resolve/resolved-link.h +++ b/src/resolve/resolved-link.h @@ -99,6 +99,7 @@ void link_allocate_scopes(Link *l); DnsServer* link_set_dns_server(Link *l, DnsServer *s); DnsServer* link_get_dns_server(Link *l); void link_next_dns_server(Link *l, DnsServer *if_current); +void link_set_default_route(Link *l, bool b); DnssecMode link_get_dnssec_mode(Link *l); bool link_dnssec_supported(Link *l); From 760fa203c2e335d437948355f1dc66b88b39b9f6 Mon Sep 17 00:00:00 2001 From: Ronan Pigott Date: Tue, 20 Aug 2024 10:25:28 -0700 Subject: [PATCH 4/5] resolved: use the fallback servers when no default dns is configured This expands the role of fallback servers so they are applied not only when there are no dns servers configured, but when all the configured dns servers are configured only for non-default-route links. --- src/resolve/resolved-dns-server.c | 2 +- src/resolve/resolved-link-bus.c | 3 +-- src/resolve/resolved-link.c | 2 +- 3 files changed, 3 insertions(+), 4 deletions(-) diff --git a/src/resolve/resolved-dns-server.c b/src/resolve/resolved-dns-server.c index cfdcc6d9bc..b48d8e1417 100644 --- a/src/resolve/resolved-dns-server.c +++ b/src/resolve/resolved-dns-server.c @@ -907,7 +907,7 @@ DnsServer *manager_get_dns_server(Manager *m) { * servers */ HASHMAP_FOREACH(l, m->links) - if (l->dns_servers) { + if (l->dns_servers && l->default_route) { found = true; break; } diff --git a/src/resolve/resolved-link-bus.c b/src/resolve/resolved-link-bus.c index f5a3b0e36b..5e9e5bf17a 100644 --- a/src/resolve/resolved-link-bus.c +++ b/src/resolve/resolved-link-bus.c @@ -463,8 +463,7 @@ int bus_link_method_set_default_route(sd_bus_message *message, void *userdata, s bus_client_log(message, "dns default route change"); if (l->default_route != b) { - l->default_route = b; - + link_set_default_route(l, b); (void) link_save_user(l); (void) manager_write_resolv_conf(l->manager); diff --git a/src/resolve/resolved-link.c b/src/resolve/resolved-link.c index 01fa5878a6..928137b967 100644 --- a/src/resolve/resolved-link.c +++ b/src/resolve/resolved-link.c @@ -319,7 +319,7 @@ static int link_update_default_route(Link *l) { if (r < 0) goto clear; - l->default_route = r > 0; + link_set_default_route(l, r > 0); return 0; clear: From d229e282d6b76a3c5980935dc26f799be7fb6784 Mon Sep 17 00:00:00 2001 From: Ronan Pigott Date: Wed, 21 Aug 2024 07:49:59 -0700 Subject: [PATCH 5/5] resolved: demote the fallback dns servers This softens the behavior originally introduced in eded61e410df to apply only to the fallback dns servers. The intent is that the global FallbackDNS (instead of DNS) can now be used in conjunction with the per-link dns, providing a fallback behavior without introducing a scope overlap. References: eded61e410df (resolved: demote the global unicast scope, 2024-08-19) --- man/systemd-resolved.service.xml | 5 +++-- src/resolve/resolved-dns-scope.c | 4 ++++ 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/man/systemd-resolved.service.xml b/man/systemd-resolved.service.xml index 13c0da987f..f7be0793cf 100644 --- a/man/systemd-resolved.service.xml +++ b/man/systemd-resolved.service.xml @@ -219,8 +219,9 @@ is sent to all DNS servers that are configured on links with the DefaultRoute= option set, as well as the globally configured DNS server. - If there is no link configured as DefaultRoute= and no global DNS - server configured, one of the compiled-in fallback DNS servers is used. + If there are no DNS servers configured on any link also configured as + DefaultRoute= and no global DNS server configured, one of the compiled-in fallback + DNS servers is used. Otherwise the unicast DNS query fails, as no suitable DNS servers can be determined. diff --git a/src/resolve/resolved-dns-scope.c b/src/resolve/resolved-dns-scope.c index 21b9844e04..4d4e952dac 100644 --- a/src/resolve/resolved-dns-scope.c +++ b/src/resolve/resolved-dns-scope.c @@ -778,6 +778,10 @@ DnsScopeMatch dns_scope_good_domain( if (!dns_scope_is_default_route(s)) return DNS_SCOPE_NO; + /* Prefer suitable per-link scopes where possible */ + if (dns_server_is_fallback(dns_scope_get_dns_server(s))) + return DNS_SCOPE_LAST_RESORT; + return DNS_SCOPE_MAYBE; }