On 10/26/22 20:44, Thomas HUMMEL wrote:
Hello,

I'm not sure if this is a systemd-resolved or NetworkManager question but it involves both (I know Thomas HALLER is a member of this list too)

on

Fedora release 36 (Thirty Six) using the following kernel and packages

    5.19.16-200.fc36.x86_64 #1 SMP PREEMPT_DYNAMIC

    systemd-250.8-1.fc36.x86_64
    systemd-resolved-250.8-1.fc36.x86_64
    NetworkManager-1.38.4-1.fc36.x86_64

I'm using a proprietary vpn client which does not seem to work very well with systemd-resolved. As a matter of fact it seems to create a manual NM profile which does not include dns properties and it seems to (try to) set /etc/resolv.conf aside (F5 vpn linux client f5fpc for the record)

Making it work is not the question here. I'm trying to understand how the 2 nameservers it configures may end up in /run/systemd/resolve/resolv.conf (and global systemd-resolved config as shown by resolvectl status) ONLY when I switch from a non systemd-resolved config then back to a systemd-resolved config

/etc/resolv.conf is usually symlink to either /run/systemd/resolve/resolv.conf or /run/systemd/resolve/stub-resolv.conf. These nameservers ends there, because the f5fpc client just rewritten /etc/resolv.conf with a content it thought is appropriate.

I think you should raise and issue to f5 support and request correct integration with at least Network Manager. If it had been told the dns servers it should use, it could propagate them to systemd-resolved. If it has already NM profile, I don't see a reason why DNS servers are not configured by it. It should allow at least by some configuration change to propagate those servers to NM. It should not overwrite /etc/resolv.conf, especially if it is just symlink to other place.

I would suggest using strace to find what exactly it does and what it tries to modify. I expect sources for that client are not available.


Here's exactly what I'm doing/experiencing:

Starting from

a) default NetworkManager config:

# grep -iE 'dns|rc\.manager' NetworkManager.conf
# ls -l conf.d/
total 0

b) systemd-resolved stub-resolv.conf mode:

# ls -l /etc/resolv.conf
lrwxrwxrwx 1 root root 37 Oct 26 19:15 /etc/resolv.conf -> /run/systemd/resolve/stub-resolv.conf

and with (not linked from /etc/resolv.conf) :

/run/systemd/resolve/resolve.conf following content:

nameserver 192.168.1.1
nameserver 2a01:cb00:7e1:3300:aa6a:bbff:fe6e:190
search home

matching my auto wireless NM profile

1) I start the vpn client

obviously it does not work very well with systemd-resolved as I don't get corresponding nameserver (10.33.1.2,10.33.1.3) anywhere and name resolution does not work for corresponding zones

/run/systemd/resolve/resolve.conf content has not changed

2) I stop the vpn client, and switch to the following setup

# rm /etc/resolv.conf
rm: remove symbolic link '/etc/resolv.conf'? y

# cat <<EOF > /etc/NetworkManager/conf.d/foo.conf
> [main]
> dns=default
> rc.manager=file
> EOF

# reboot

-> after the reboot the /etc/resolv.conf link as been recreated : why ?

(/run/systemd/resolve/resolv.conf hasn't changed, which seems normal to me)

3) I remove it again and reboot

# rm /etc/resolv.conf
rm: remove symbolic link '/etc/resolv.conf'? y

# reboot
The systemd guys believe the systemd-resolved should always create /etc/resolv.conf if it does not exist already. Create empty /etc/resolv.conf file as a workaround.

-> this time /etc/resolv.conf is as expected a regular file which content is handled by NM:

$ ls -l /etc/resolv.conf
-rw-r--r-- 1 root root 114 Oct 26 20:22 /etc/resolv.conf
$ cat /etc/resolv.conf
# Generated by NetworkManager
search home
nameserver 192.168.1.1
nameserver 2a01:cb00:7e1:3300:aa6a:bbff:fe6e:190


4) I start the vpn client

it wrote to /etc/resolv.conf (which seems wrong to me but is out of scope here)

$ cat /etc/resolv.conf
#F5 Networks Inc. :File modified by VPN process
search pasteur.fr home
nameserver 10.33.1.2
nameserver 10.33.1.3

the 2 nameservers it provided do not appear in /run/systemd/resolve/resolv.conf

6) I stop the vpn client switch back to my orgininal config, and reboot

# rm /etc/NetworkManager/conf.d/foo.conf
rm: remove regular file '/etc/NetworkManager/conf.d/foo.conf'? y

# rm /etc/resolv.conf
rm: remove regular file '/etc/resolv.conf'? y

# ln -s /run/systemd/resolve/stub-resolv.conf /etc/resolv.conf

# reboot

-> everything looks as expected

7) I start the vpn client

-> its provided nameserver appear in /run/systemd/resolv/resolv.conf (and resolution of related zones work)

-> why ? Where does the info come from ?

nameserver 10.33.1.2
nameserver 10.33.1.3
nameserver 192.168.1.1
# Too many DNS servers configured, the following entries may be ignored.
nameserver 2a01:cb00:7e1:3300:aa6a:bbff:fe6e:190
search pasteur.fr home

Can you help me figure out what's happening or at least how can the behavior seem to change with what seem a rollback to the initial state ?

I just guess systemd-resolved might have detected outside change of resolv.conf and adds the values provided by F5 client to its servers set. I think systemd-resolved detects the file were modified by another process and rewrites it again. But first obtains nameservers in that changed file. Does it change resolvectl status output?

In any case please contact F5 client support and ask for at least working NM integration, including DNS servers provisioning. It would have the same problem with dns=dnsmasq plugin in NM, so it is not just systemd-resolved specific.

Does it show DNS servers on this command: nmcli connection show <F5connection> | grep .DNS

When the F5 client is connected?


Thanks for your help

--
Thomas HUMMEL

--
Petr Menšík
Software Engineer, RHEL
Red Hat, https://www.redhat.com/
PGP: DFCF908DB7C87E8E529925BC4931CA5B6C9FC5CB

Reply via email to