Bug#1031236: ifupdown: dns-nameservers with systemd-resolved is broken

[Dmytro Kolesnykov]

Package: ifupdown
Version: 0.8.41
Severity: normal

Dear Maintainer,

I was doing my network setup, which included statically configured
logical interfaces. So there were dns-nameservers entries in my
/etc/network/interfaces. My configuration files is below (the actual
IPs and MACs is wiped).

I noted that ifup with my setup is producing error messages like this:

...
guessnet: Started tests
guessnet: 3 candidates
guessnet: Got ARP reply from 192.168.0.1 XX:XX:XX:XX:XX:XX
guessnet: ARP reply from 192.168.0.1 XX:XX:XX:XX:XX:XX matches
guessnet: Notified success of scan peer 192.168.0.1 XX:XX:XX:XX:XX:XX
guessnet: Removing candidate enp4s0-direct
guessnet: Keeping candidate enp4s0-router
guessnet: We had changes, notifying the listener
guessnet: Got ARP reply from 192.168.0.1 XX:XX:XX:XX:XX:XX
/etc/network/if-up.d/resolved: 69: DNS: not found
/etc/network/if-up.d/resolved: 1: /run/network/ifupdown-inet-enp4s0: DNS=192.168.0.1 192.168.0.12: not found
Failed to parse DNS server address: DNS
Failed to set DNS configuration: Invalid argument

I have found discussion about similar problem there:
https://unix.stackexchange.com/questions/714901/dns-broken-when-using-ifupdown-and-systemd-resolved-after-upgrade-to-ubuntu-22-0

Also I had a look into the /etc/network/if-up.d/resolved and I assume
this is a typo in the line 69:
https://salsa.debian.org/debian/ifupdown/-/blob/master/debian/if-up.d/resolved#L69

Then I edited mine /etc/network/if-up.d/resolved this way:

--- a/network/if-up.d/resolved
+++ b/network/if-up.d/resolved
@@ -43,11 +43,11 @@ if systemctl is-enabled systemd-resolved > /dev/null 2>&1; then
fi
if [ -n "$NEW_DNS" ]; then
cat <<EOF >"$mystatedir/ifupdown-${ADDRFAM}-$interface"
-"$DNS"="$NEW_DNS"
+$DNS="$NEW_DNS"
EOF
if [ -n "$NEW_DOMAINS" ]; then
cat <<EOF >>"$mystatedir/ifupdown-${ADDRFAM}-$interface"
-"$DOMAINS"="$NEW_DOMAINS"
+$DOMAINS="$NEW_DOMAINS"
EOF
fi
fi
@@ -66,7 +66,7 @@ EOF
# ignore errors due to nonexistent file
md5sum "$mystatedir/isc-dhcp-v4-$interface" "$mystatedir/isc-dhcp-v6-$interface" "$mystatedir/ifupdown-inet-$interface" "$mystatedir/ifupdown-inet6-$interface" > "$newstate" 2> /dev/null || true
if ! cmp --silent "$oldstate" "$newstate" 2>/dev/null; then
- DNS DNS6 DOMAINS DOMAINS6 DEFAULT_ROUTE
+ # DNS DNS6 DOMAINS DOMAINS6 DEFAULT_ROUTE
# v4 first
if [ -e "$mystatedir/isc-dhcp-v4-$interface" ]; then
. "$mystatedir/isc-dhcp-v4-$interface"

And now it works well.

I'm guessing that someone might also have a static network
configuration at the same time as systemd-resolved installed, so I hope
this information can help someone.

Kind regards,
Dmytro


-- Package-specific info:
--- /etc/network/interfaces:
# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

source /etc/network/interfaces.d/*

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
# allow-hotplug enp4s0
# iface enp4s0 inet dhcp
# This is an autoconfigured IPv6 interface
# iface enp4s0 inet6 auto

allow-hotplug wlp0s20f3
iface wlp0s20f3 inet manual
wpa-driver wext
wpa-roam /etc/wpa_supplicant/wpa_supplicant.conf

iface default inet dhcp

allow-hotplug enp4s0

mapping enp4s0
script /usr/sbin/guessnet-ifupdown
map autofilter: true
map verbose: true
map debug: true
map default: enp4s0-guest

# sorry, I do not wish to publish the actual addresses there

iface enp4s0-router inet static
address 192.168.0.44
netmask 255.255.255.0
gateway 192.168.0.1
test peer address 192.168.0.1 mac XX:XX:XX:XX:XX:XX source
dns-nameservers 192.168.0.1
dns-nameservers 192.168.0.12

iface enp4s0-direct inet static
address XX.XX.XXX.XX
netmask 255.255.255.0
gateway XX.XX.XXX.X
test peer address XX.XX.XXX.X mac XX:XX:XX:XX:XX:XX source
dns-nameservers XX.XX.XXX.XXX
dns-nameservers XX.XXX.XXX.XXX

iface enp4s0-guest inet dhcp


--- /etc/network/interfaces.d/*:
cat: '/etc/network/interfaces.d/*': No such file or directory

--- up and down scripts installed:
/etc/network/if-down.d:
total 8
-rwxr-xr-x 1 root root 372 Apr 21 2020 openvpn
-rwxr-xr-x 1 root root 759 Sep 27 16:09 resolved
lrwxrwxrwx 1 root root 32 Jan 31 13:58 wpasupplicant -> ../../wpa_supplicant/ifupdown.sh

/etc/network/if-post-down.d:
total 4
-rwxr-xr-x 1 root root 1409 Jun 5 2018 wireless-tools
lrwxrwxrwx 1 root root 32 Jan 31 13:58 wpasupplicant -> ../../wpa_supplicant/ifupdown.sh

/etc/network/if-pre-up.d:
total 8
-rwxr-xr-x 1 root root 4191 Sep 15 2018 wireless-tools
lrwxrwxrwx 1 root root 32 Jan 31 13:58 wpasupplicant -> ../../wpa_supplicant/ifupdown.sh

/etc/network/if-up.d:
total 12
-rwxr-xr-x 1 root root 385 Apr 21 2020 openvpn
-rwxr-xr-x 1 root root 4661 Feb 13 19:47 resolved
lrwxrwxrwx 1 root root 32 Jan 31 13:58 wpasupplicant -> ../../wpa_supplicant/ifupdown.sh


-- System Information:
Debian Release: bookworm/sid
APT prefers testing
APT policy: (800, 'testing'), (700, 'stable'), (600, 'unstable'), (500, 'stable-security'), (50, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 6.1.0-3-amd64 (SMP w/8 CPU threads; PREEMPT)
Kernel taint flags: TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE
Locale: LANG=uk_UA.UTF-8, LC_CTYPE=uk_UA.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages ifupdown depends on:
ii adduser 3.131
ii iproute2 6.1.0-1
ii libc6 2.36-8

Versions of packages ifupdown recommends:
ii isc-dhcp-client [dhcp-client] 4.4.3-P1-1.1

Versions of packages ifupdown suggests:
ii ppp 2.4.9-1+1.1+b1
pn rdnssd <none>

-- Configuration Files:
/etc/network/if-up.d/resolved changed:
case "$ADDRFAM" in
inet|inet6) : ;;
*) exit 0 ;;
esac
if systemctl is-enabled systemd-resolved > /dev/null 2>&1; then
interface=$IFACE
if [ ! "$interface" ]; then
return
fi
# TODO handle lo interface settings
if [ "$interface" = "lo" ]; then
return
fi
ifindex=$(cat "/sys/class/net/$interface/ifindex")
if [ ! "$ifindex" ]; then
return
fi
mystatedir=/run/network
mkdir -p $mystatedir
statedir=/run/systemd/resolve/netif
mkdir -p $statedir
chown systemd-resolve:systemd-resolve $statedir
oldstate="$(mktemp)"
# ignore errors due to nonexistent file
md5sum "$mystatedir/isc-dhcp-v4-$interface" "$mystatedir/isc-dhcp-v6-$interface" "$mystatedir/ifupdown-inet-$interface" "$mystatedir/ifupdown-inet6-$interface" > "$oldstate" 2> /dev/null || true
NEW_DEFAULT_ROUTE=$IF_DNS_DEFAULT_ROUTE
NEW_DNS=$(echo $IF_DNS_NAMESERVERS $IF_DNS_NAMESERVER)
NEW_DOMAINS=$(echo $IF_DNS_DOMAIN $IF_DNS_SEARCH)
DNS=DNS
DOMAINS=DOMAINS
if [ "$ADDRFAM" = "inet6" ]; then
DNS=DNS6
DOMAINS=DOMAINS6
fi
if [ -n "$NEW_DNS" ]; then
cat <<EOF >"$mystatedir/ifupdown-${ADDRFAM}-$interface"
$DNS="$NEW_DNS"
EOF
if [ -n "$NEW_DOMAINS" ]; then
cat <<EOF >>"$mystatedir/ifupdown-${ADDRFAM}-$interface"
$DOMAINS="$NEW_DOMAINS"
EOF
fi
fi
case "$NEW_DEFAULT_ROUTE" in
1|yes|true|on) NEW_DEFAULT_ROUTE=yes ;;
0|no|false|off) NEW_DEFAULT_ROUTE=no ;;
*) NEW_DEFAULT_ROUTE= ;;
esac
if [ -n "$NEW_DEFAULT_ROUTE" ]; then
cat <<EOF >>"$mystatedir/ifupdown-${ADDRFAM}-$interface"
DEFAULT_ROUTE="$NEW_DEFAULT_ROUTE"
EOF
fi
newstate="$(mktemp)"
# ignore errors due to nonexistent file
md5sum "$mystatedir/isc-dhcp-v4-$interface" "$mystatedir/isc-dhcp-v6-$interface" "$mystatedir/ifupdown-inet-$interface" "$mystatedir/ifupdown-inet6-$interface" > "$newstate" 2> /dev/null || true
if ! cmp --silent "$oldstate" "$newstate" 2>/dev/null; then
# DNS DNS6 DOMAINS DOMAINS6 DEFAULT_ROUTE
# v4 first
if [ -e "$mystatedir/isc-dhcp-v4-$interface" ]; then
. "$mystatedir/isc-dhcp-v4-$interface"
fi
# v4 manual config overrides
if [ -e "$mystatedir/ifupdown-inet-$interface" ]; then
. "$mystatedir/ifupdown-inet-$interface"
fi
# v6 preffered
if [ -e "$mystatedir/isc-dhcp-v6-$interface" ]; then
. "$mystatedir/isc-dhcp-v6-$interface"
fi
# v6 manual config overrides
if [ -e "$mystatedir/ifupdown-inet6-$interface" ]; then
. "$mystatedir/ifupdown-inet6-$interface"
fi
resolvectl_failed=
if [ "$DNS" ] || [ "$DNS6" ] ; then
cat <<EOF >"$statedir/$ifindex"
LLMNR=yes
MDNS=no
SERVERS=$(echo $DNS6 $DNS)
DOMAINS=$(echo $DOMAINS6 $DOMAINS)
EOF
if [ -n "$DEFAULT_ROUTE" ]; then
cat <<EOF >>"$statedir/$ifindex"
DEFAULT_ROUTE=$DEFAULT_ROUTE
EOF
fi
chown systemd-resolve:systemd-resolve "$statedir/$ifindex"
# In addition to creating the state file (needed if we run before
# resolved is started), also feed the information directly to
# resolved.
if systemctl --quiet is-active systemd-resolved; then
resolvectl llmnr "$ifindex" yes || resolvectl_failed=$?
resolvectl mdns "$ifindex" no || resolvectl_failed=$?
if [ "$DOMAINS6" ] || [ "$DOMAINS" ]; then
resolvectl domain "$ifindex" $DOMAINS6 $DOMAINS || resolvectl_failed=$?
else
resolvectl domain "$ifindex" "" || resolvectl_failed=$?
fi
resolvectl dns "$ifindex" $DNS6 $DNS || resolvectl_failed=$?
if [ "$DEFAULT_ROUTE" ]; then
resolvectl default-route "$ifindex" $DEFAULT_ROUTE || resolvectl_failed=$?
fi
fi
else
rm -f "$statedir/$ifindex"
if systemctl --quiet is-active systemd-resolved; then
resolvectl revert "$ifindex" || resolvectl_failed=$?
fi
fi
# resolved was running, but without dbus, it means state files
# will not be read & resolvectl commands failed, restart it
if [ "$resolvectl_failed" ]; then
systemctl try-restart systemd-resolved
fi
fi
rm -f "$oldstate" "$newstate"
fi


-- no debconf information

[Santiago Ruano Rincón]

Control: tags -1 + patch
Control: severity -1 important

El 13/02/23 a las 20:38, Dmytro Kolesnykov escribió:

> Package: ifupdown
> Version: 0.8.41
> Severity: normal
>
> Dear Maintainer,

Dear ifupdown user,

>
> I was doing my network setup, which included statically configured
> logical interfaces. So there were dns-nameservers entries in my
> /etc/network/interfaces. My configuration files is below (the actual
> IPs and MACs is wiped).
>
> I noted that ifup with my setup is producing error messages like this:
>
> ...
> guessnet: Started tests
> guessnet: 3 candidates
> guessnet: Got ARP reply from 192.168.0.1 XX:XX:XX:XX:XX:XX
> guessnet: ARP reply from 192.168.0.1 XX:XX:XX:XX:XX:XX matches
> guessnet: Notified success of scan peer 192.168.0.1 XX:XX:XX:XX:XX:XX
> guessnet: Removing candidate enp4s0-direct
> guessnet: Keeping candidate enp4s0-router
> guessnet: We had changes, notifying the listener
> guessnet: Got ARP reply from 192.168.0.1 XX:XX:XX:XX:XX:XX
> /etc/network/if-up.d/resolved: 69: DNS: not found
> /etc/network/if-up.d/resolved: 1: /run/network/ifupdown-inet-enp4s0: DNS=192.168.0.1 192.168.0.12: not found
> Failed to parse DNS server address: DNS
> Failed to set DNS configuration: Invalid argument
>
> I have found discussion about similar problem there:
> https://unix.stackexchange.com/questions/714901/dns-broken-when-using-ifupdown-and-systemd-resolved-after-upgrade-to-ubuntu-22-0
>
> Also I had a look into the /etc/network/if-up.d/resolved and I assume
> this is a typo in the line 69:
> https://salsa.debian.org/debian/ifupdown/-/blob/master/debian/if-up.d/resolved#L69
>

[...]

Thanks for reporting this issue, and for proposing the patch.

Have you had the chance to test an IPv6 configuration?
I'll need to change my setup for testing that. And I'd love add tests to
check this.

Cheers,

-- Santiago

[Ken Milmore]

With a minor modification, the suggested patch seems to work correctly for me on both IPv4 and IPv6 static configurations.

The modification I have added is to clear the variables DNS, DNS6, DOMAINS, DOMAINS6, DEFAULT_ROUTE before importing the state files,
otherwise their previous contents may be carried through. Without this, I was getting a search domain of "DOMAINS" configured in resolved.

I have attached a source patch against ifupdown master on Salsa.

I note that the resolved hook script we're working with here seems to be derived from the (fairly hacky) dhclient hook scripts being shipped by Ubuntu.
To get DNS working for DHCP cases as well as for static ones, will require a corresponding hook script for dhclient in Debian: see bug #1025062.

Note also in ifupdown it is possible to have independent DHCP and/or static configurations for IPv4 and IPv6 on the same interface.
I'm not sure how common those cases are, but the hook scripts for ifupdown and dhclient would have to use the same protocol and state file for it to work with all the possible combinations. I'm going to post a comment and patch against bug #1025062 to this effect.

-Ken.

[Uwe Kleine-König]

Control: tags 1031236 + pending

Dear maintainer,

I've prepared an NMU for ifupdown (versioned as 0.8.41+nmu1) and intend
to upload it to DELAYED/10 once I properly tested the patch.
(Unfortunately I locked myself out of the affected machine while
reconfiguring the network devices. So testing will have to wait until I
find someone with physical access to that machine.)

The change is effectively what Ken Milmore proposed.

Best regards
Uwe

[Santiago Ruano Rincón]

El 21/06/23 a las 19:10, Uwe Kleine-König escribió:

Thanks for this. Would you like to prepare a MR instead. I would like to
handle the switch to dependency on dhcpcd-base along.

Cheers,

-- Santiago

[Uwe Kleine-König]

Hello Santiago,

Sure:
https://salsa.debian.org/debian/ifupdown/-/merge_requests/20

Best regards
Uwe