From mboxrd@z Thu Jan 1 00:00:00 1970 Received: by passt.top (Postfix, from userid 1000) id 48DC65A0274; Fri, 11 Apr 2025 11:14:39 +0200 (CEST) From: Stefano Brivio To: passt-dev@passt.top Subject: [PATCH 2/2] conf: Honour --dns-forward for local resolver even with --no-map-gw Date: Fri, 11 Apr 2025 11:14:39 +0200 Message-ID: <20250411091439.2943014-3-sbrivio@redhat.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20250411091439.2943014-1-sbrivio@redhat.com> References: <20250411091439.2943014-1-sbrivio@redhat.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Message-ID-Hash: I6DUD7IDVK7CQGSPTQVQXONADTBQYFEI X-Message-ID-Hash: I6DUD7IDVK7CQGSPTQVQXONADTBQYFEI X-MailFrom: sbrivio@passt.top X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: Andrew Sayers , Paul Holzinger , David Gibson X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: If the first resolver listed in the host's /etc/resolv.conf is a loopback address, and --no-map-gw is given, we automatically conclude that the resolver is not reachable, discard it, and, if it's the only nameserver listed in /etc/resolv.conf, we'll warn that we: Couldn't get any nameserver address However, this isn't true in a general case: the user might have passed --dns-forward, and in that case, while we won't map the address of the default gateway to the host, we're still supposed to map that particular address. Otherwise, in this common Podman usage: pasta --config-net --dns-forward 169.254.1.1 -t none -u none -T none -U none --no-map-gw --netns /run/user/1000/netns/netns-c02a8d8f-6ee3-902e-33c5-317e0f24e0af --map-guest-addr 169.254.1.2 and with a loopback address in /etc/resolv.conf, we'll unexpectedly refuse to forward DNS queries: # nslookup passt.top 169.254.1.1 ;; connection timed out; no servers could be reached To fix this, make an exception for --dns-forward: if &c->ip4.dns_match or &c->ip6.dns_match are set in add_dns_resolv4() / add_dns_resolv6(), use that address as guest-facing resolver. We already set 'dns_host' to the address we found in /etc/resolv.conf, that's correct in this case and it makes us forward queries as expected. I'm not changing the man page as the current description of --dns-forward is already consistent with the new behaviour: there's no described way in which --no-map-gw should affect it. Reported-by: Andrew Sayers Link: https://bugs.passt.top/show_bug.cgi?id=111 Suggested-by: Paul Holzinger Signed-off-by: Stefano Brivio --- conf.c | 30 ++++++++++++++++++++++-------- 1 file changed, 22 insertions(+), 8 deletions(-) diff --git a/conf.c b/conf.c index 18ed11c..f942851 100644 --- a/conf.c +++ b/conf.c @@ -431,12 +431,19 @@ static void add_dns_resolv4(struct ctx *c, struct in_addr *ns, unsigned *idx) */ if (IN4_IS_ADDR_LOOPBACK(ns) || IN4_ARE_ADDR_EQUAL(ns, &c->ip4.map_host_loopback)) { - if (IN4_IS_ADDR_UNSPECIFIED(&c->ip4.map_host_loopback)) - return; + if (IN4_IS_ADDR_UNSPECIFIED(&c->ip4.dns_match)) { + if (IN4_IS_ADDR_UNSPECIFIED(&c->ip4.map_host_loopback)) + return; /* Address unreachable */ - *ns = c->ip4.map_host_loopback; - if (IN4_IS_ADDR_UNSPECIFIED(&c->ip4.dns_match)) + *ns = c->ip4.map_host_loopback; c->ip4.dns_match = c->ip4.map_host_loopback; + } else { + /* No general host mapping, but requested for DNS + * (--dns-forward and --no-map-gw): advertise resolver + * address from --dns-forward, and map that to loopback + */ + *ns = c->ip4.dns_match; + } } *idx += add_dns4(c, ns, *idx); @@ -459,12 +466,19 @@ static void add_dns_resolv6(struct ctx *c, struct in6_addr *ns, unsigned *idx) */ if (IN6_IS_ADDR_LOOPBACK(ns) || IN6_ARE_ADDR_EQUAL(ns, &c->ip6.map_host_loopback)) { - if (IN6_IS_ADDR_UNSPECIFIED(&c->ip6.map_host_loopback)) - return; + if (IN6_IS_ADDR_UNSPECIFIED(&c->ip6.dns_match)) { + if (IN6_IS_ADDR_UNSPECIFIED(&c->ip6.map_host_loopback)) + return; /* Address unreachable */ - *ns = c->ip6.map_host_loopback; - if (IN6_IS_ADDR_UNSPECIFIED(&c->ip6.dns_match)) + *ns = c->ip6.map_host_loopback; c->ip6.dns_match = c->ip6.map_host_loopback; + } else { + /* No general host mapping, but requested for DNS + * (--dns-forward and --no-map-gw): advertise resolver + * address from --dns-forward, and map that to loopback + */ + *ns = c->ip6.dns_match; + } } *idx += add_dns6(c, ns, *idx); -- 2.43.0