Re: [PATCH] wg-quick: linux: Don't fail systemd service when using systemd-resolved

From: "Jason A. Donenfeld" <Jason@zx2c4.com>
To: Ronan Pigott <rpigott314@gmail.com>
Cc: Ronan Pigott <rpigott@berkeley.edu>,
	WireGuard mailing list <wireguard@lists.zx2c4.com>
Subject: Re: [PATCH] wg-quick: linux: Don't fail systemd service when using systemd-resolved
Date: Tue, 27 Aug 2019 20:20:38 -0600	[thread overview]
Message-ID: <CAHmME9q6hQfrQK_1pRB=tbtJ_Sn=-3Z=8v_ZJW7uB6UuxDx15Q@mail.gmail.com> (raw)
In-Reply-To: <BWKVAQQ0RFKJ.2FBG8FY1MXOR1@rxps>

Hi Ronan,

On Tue, Aug 27, 2019 at 7:21 PM Ronan Pigott <rpigott314@gmail.com> wrote:
> Yeah that was my first thought, then I supposed that perhaps it was
> ordered that way intentionally to prevent a situation where the dns is
> unset and a client would make a dns lookup on the interface before it is
> deleted. It would use the sd-resolved 'global' configured dns servers in
> that case which is maybe undesired.

Right, exactly.

> I realize it's a hack. I gave the explanation somewhat in the hope
> someone had a better solution to the problem I was experiencing.

One approach to the hack would be to just take it all the way and
append `|| true`. That is, make it non-fatal. A tear down routine,
anyway, has very few choices on what to do when something goes wrong,
and sometimes continuing isn't such a bad policy.

> The real issue here is that there are there are three common
> implementations of resolvconf: debian resolvconf, openresolv, and
> sd-resolved compat interface. So wg-quick uses resolvconf, but is only
> fully compatible with openresolv. wg-quick is (accidentally) compatible
> with sd-resolved through the resolvconf compat interface, except for
> this minor hiccup. This hack allows wg-quick to work for both methods
> with no extra configuration from the user, no alternative code path
> for sd-resolved, and no change in behavior for non sd-resolved users.

"wg-quick is (accidentally) compatible with sd-resolved" That's
actually not totally true. Systemd has that resolvconf compat
interface because I annoyed Lennart about it a bunch. :-P

> There is another way that is might be more palatable: openresolv and
> sd-resolved resolvconf both support a '-f' flag for ignoring missing
> interfaces, which neatly sidesteps this error. However, I don't think
> debian's resolvconf supports this flag. Now that I look into it though,
> it seems debian's resolvconf does not support '-l' either, which wg-quick
> uses, so maybe we don't care to support this anyway. I think v2 will
> just use the flag instead, if that's alright.

Yes, that's terrific. If I recall correctly, Debian's resolvconf will
ignore arguments it doesn't understand if they're in the right
position. It seems, anyhow, that -f is exactly what we should be
using. I'll gladly merge a signed-off-by v2 that adds it.

> Users of openvpn use sd-resolved dbus interface in place of resolvconf,
> such as seen here: https://github.com/jonathanio/update-systemd-resolved
> but I believe this is overkill for wg-quick.

Ahhh yes the amazing shell-script IPv6 parser. I recall reading this
in wonder a few years ago. Indeed it's a bit "much" for wg-quick, and
I think your solution of adding -f to resolvconf is a good approach.

Jason
_______________________________________________
WireGuard mailing list
WireGuard@lists.zx2c4.com
https://lists.zx2c4.com/mailman/listinfo/wireguard