Re: Improved handling of changing DNS resolvers

[Stefano Brivio <sbrivio@redhat.com>]

Hi Noah,

Sorry for the delay, I didn't check pending mailing list posts for a
couple of days. Comments below:

On Tue, 17 Jan 2023 11:50:50 -0800
Noah Gold <nkgold@google.com> wrote:

> Hi folks,
> 
> libslirp and Passt have different approaches to sharing DNS resolvers with
> the guest system, each with their own benefits & drawbacks. On the libslirp
> project, we're discussing [1] how to support DNS failover. Passt already has
>  support for this, but there is a drawback to its solution which prevents us
> from taking a similar approach: the resolvers are read exactly once, so if the
> host changes networks at runtime, the guest will not receive the updated
> resolvers and thus its connectivity will break.

Right -- the main motivation behind this (other than simplicity) is that
we can close /etc/resolv.conf before sandboxing.

However, we could keep a handle on it, just like we do for PID and pcap
files, while still unmounting the filesystem.

And we could also use inotify to detect changes I guess -- we do the
same to monitor namespaces in pasta mode (see pasta_netns_quit_init()).

> libslirp's current approach is to DNAT a single address exposed to the guest
> to one of the resolvers configured on the host. The problem here is that if that
> one resolver goes down, the guest can't resolve DNS names. We're
> considering changing so that instead of a single address, we expose a set of
> MAXNS addresses, and DNAT those 1:1 to the DNS resolvers registered with
> the host. Because the DNAT table lives on the host side, we can refresh the
> guest's resolvers whenever the host's resolvers change, but without the need to
> expire a DHCP lease (even with short leases, the guest will still lose
> connectivity
> for a time).
> 
> Does this sound like an approach Passt would be open to adopting as well?

Yes, definitely, patches would be very welcome.

Note that David (Cc'ed) is currently working on a generalised/flexible
address mapping mechanism, some kind of (simple) NAT table as far as I
understood it.

This might even address your DNS idea already, I'm not sure, I'd wait
for him to comment.

-- 
Stefano