Hi, I am facing an issue where sd-resolved doesn't configure a DNS scope on
links even though I'm explicitly setting DNS addresses for that link
(`resolvectl dns wg0 1.2.3.4`). I believe this is due to the logic in
link_relevant() as these links only have link-local addresses.
What I'm doing: I have a number of wireguard interfaces, bearing link-local
addresses, that I use to establish tunnels to peers, and I establish BGP
sessions over these links. The peers then advertise routes to the dn42.net
network, and my BGP router configures these routes in the kernel. On the
dn42 network there are DNS servers I'd like to use, but of course I can
only use them once the wg links are up, and to enable the wg links I need
to resolve hostnames on the public Internet first. So I have global DNS
servers set to quad1/8/9s for that initial resolution. Once the wg
interfaces are up I configure DNS servers on them with `resolvectl dns
wgXX fd42:d42:d42:54::1`
What I expect: I can then resolve names using the nameservers on the dn42
network.
The observed issue: despite setting the nameservers for the interface, the
interface has "Current Scopes: (none)". As an effect, name resolution is
never performed via the nameservers configured for these interfaces.
```
[root@dn42:~]# resolvectl dns wg0 fd42:d42:d42:54::1
[root@dn42:~]# resolvectl status wg0
Link 3 (wg0)
Current Scopes: none
Protocols: -DefaultRoute +LLMNR +mDNS -DNSOverTLS
DNSSEC=no/unsupported
DNS Servers: fd42:d42:d42:54::1
Default Route: no
```
Why that's happening (I think): when handling the SetDNS message,
sd-resolved checks link_relevant() for unicast destinations
in link_allocate_scopes(). The logic in link_relevant says that for
non-multicast traffic, the link should have at least one address that is
better than link-local (since my dns server's address is not link-local).
I can fix this by adding a ULA address to the link:
```
[root@dn42:~]# ip addr add dev wg1 fdc0:507f:8710::4:1/128
[root@dn42:~]# resolvectl dns wg1 fd42:d42:d42:54::1
[root@dn42:~]# resolvectl status wg1
Link 4 (wg1)
Current Scopes: DNS
Protocols: +DefaultRoute +LLMNR +mDNS -DNSOverTLS
DNSSEC=no/unsupported
Current DNS Server: fd42:d42:d42:54::1
DNS Servers: fd42:d42:d42:54::1
Default Route: yes
```
I was however trying to avoid having non-link-local addresses on the tunnel
links. They are able to route traffic to and from the nameserver after all,
as long as the packets are routed properly. Interestingly, as long as I
have a non-link-local address on the interface, I can add a nameserver in
IPv4 and sd-resolved will follow that scope happily.
In #37780 it was mentioned that using a link-local nameserver is exotic,
and I realize my use-case is even more exotic, so I understand if this is
out of scope.
Is there a way I can make sd-resolved consider this interface relevant, and
create the scope?
Is the heuristic in link_relevant correct, considering this use-case, as
uncommon as it is, exists?
Thanks for your consideration,
--
Uriel Corfa
