GNOME Bugzilla – Bug 766769
vpn with ipv6 support breaks DNS resolution completely
Last modified: 2016-05-26 08:55:59 UTC
Created attachment 328339 [details] configuration file Hello, This is happening with network-manager 1.0.4 and network-manager-openvpn 0.9.10, but upgrading to 1.1.93 gets the same issue. We have added support for ipv6 in our vpn server, and this broke DNS resolution for our clients using network-manager. We provide an open server so that you can test, I am attaching the configuration. For authentification, just use whatever login / password, anything will be accepted. What happens is that the VPN connexion succeeds, but although the server sends dhcp-option DNS 80.67.169.12, dhcp-option DNS 2001:910:800::40, dhcp-option DNS 80.67.169.40, dhcp-option DNS 2001:910:800::12, network-manager does not take the IPv6 DNS addresses into account. The consequence seems to be that network-manager turns into split-dns mode. And that happens to break DNS resolution completely, the started dnsmasq only supports the RDNS zone for the IP range of the VPN, and all other domains are rejected. I.e. ping bugzilla.gnome.org returns "unknown host bugzilla.gnome.org", while ping 209.132.180.186" works fine (as well as IPv6 addresses) Adding the IPv6 DNS addresses by hand in the IPv6 part of the configuration of the VPN works around the issue: there is no split-dns mode any more, everything works fine. That's however not a proper fix, network-manager should just automatically take what the server provides. Samuel
Created attachment 328340 [details] cert file for server
(In reply to Samuel Thibault from comment #0) > What happens is that the VPN connexion succeeds, but although the server > sends dhcp-option DNS 80.67.169.12, dhcp-option DNS 2001:910:800::40, > dhcp-option DNS 80.67.169.40, dhcp-option DNS 2001:910:800::12, > network-manager does not take the IPv6 DNS addresses into account. The > consequence seems to be that network-manager turns into split-dns mode. And > that happens to break DNS resolution completely, the started dnsmasq only > supports the RDNS zone for the IP range of the VPN, and all other domains > are rejected. I.e. ping bugzilla.gnome.org returns "unknown host > bugzilla.gnome.org", while ping 209.132.180.186" works fine (as well as IPv6 > addresses) Are you using dns=dnsmasq with NM? Does it work if you switch to dns=none? Also, do you push a DNS domain/search list? It looks like at the moment, when dnsmasq is enabled, NM always uses split DNS for VPNs; but if the server doesn't push a domain only an entry for reverse queries gets added: https://cgit.freedesktop.org/NetworkManager/NetworkManager/tree/src/dns-manager/nm-dns-dnsmasq.c?id=d3d648f9ef1086fdba8f5c320b380ff962f674db#n74 The fix is probably to unconditionally add the nameserver pushed by server without split DNS if the server didn't push any domain. Also, the feature in bug 746422 would be helpful since it would allow to disable split DNS for VPNs having the default route.
Also, we don't support IPv6 addresses in "dhcp-option DNS" ATM, while openvpn client scripts support them.
Created attachment 328389 [details] [review] [PATCH] helper: support IPv6 DNS servers Patch for network-manager-openvpn.
Created attachment 328390 [details] [review] [PATCH] dns/dnsmasq: use servers without split DNS if no domain was received Patch for NM master.
This first patch adds support to nm-openvpn plugin for parsing IPv6 DNS server pushed through "dhcp-option DNS". The second one fixes NM to add the received DNS servers to dnsmasq without split DNS if the server didn't supply any domain. These two patches should fix the issue, do you have a way to recompile and test them?
Hello, We are using the default ubuntu configuration, which does use dns=dnsmasq indeed. Switching to dns=none fixes the issue indeed (but that's only a workaround which we don't want to have to tell our users to do) We are not pushing any DNS domain/search list. The network-manager-openvpn patch alone indeed fixes the issue, and the IPv6 DNS servers are properly used. The network-manager patch alone also fixes the issue (since we don't push any domain/search). Could these be applied to the 1.1 branch, so that our clients get them relatively soon? Thanks!
(In reply to Beniamino Galvani from comment #4) > Created attachment 328389 [details] [review] [review] > [PATCH] helper: support IPv6 DNS servers > > Patch for network-manager-openvpn. I don't really understand why you add dns_domains both to NM_VPN_PLUGIN_IP4_CONFIG_DOMAINS and NM_VPN_PLUGIN_IP6_CONFIG_DOMAINS. Could you explain that in a code comment?
(In reply to Beniamino Galvani from comment #5) > Created attachment 328390 [details] [review] [review] > [PATCH] dns/dnsmasq: use servers without split DNS if no domain was received > > Patch for NM master. lgtm
Both patches LGTM.
(In reply to Thomas Haller from comment #8) > > [PATCH] helper: support IPv6 DNS servers > I don't really understand why you add dns_domains both to > NM_VPN_PLUGIN_IP4_CONFIG_DOMAINS and NM_VPN_PLUGIN_IP6_CONFIG_DOMAINS. > Could you explain that in a code comment? The reason is that the domain list is not specific to IPv4 and is valid also for IPv6; we have a NMIP4Config and a NMIP6Config with their own nameservers and domains, and when using dnsmasq we use IPv4 nameservers only for IPv4 domains and IPv6 nameservers only for IPv6 domains. In order to achieve the desired result, domains must be added to both configurations. How about this? ++ /* Domains apply to both IPv4 and IPv6 configurations */ + if (has_ip6_address) { + val = g_variant_new_strv ((const gchar **) dns_domains->pdata, dns_domains->len); + g_variant_builder_add (&ip6builder, "{sv}", NM_VPN_PLUGIN_IP6_CONFIG_DOMAINS, val); + }
(In reply to Beniamino Galvani from comment #11) > The reason is that [...] Understood, thanks. > How about this? lgtm
Patches applied to master: https://cgit.freedesktop.org/NetworkManager/NetworkManager/commit/?id=0c80e38f640c3d838806b537864c1702583cd9e4 https://git.gnome.org/browse/network-manager-openvpn/commit/?id=c23c74e23da667187f5e1c4524a875f2d5942280 and nm-1-2: https://cgit.freedesktop.org/NetworkManager/NetworkManager/commit/?h=nm-1-2&id=dd3dfad5835eea7617d883d4c665c0be66fa09f7 https://git.gnome.org/browse/network-manager-openvpn/commit/?h=nm-1-2&id=b9f75032d205082e01f19e126a4ef9504f44148e