Re: split-DNS, resolvconf on Fedora (OpenVPN related issues)

Hi David, more below. On 2/25/21 11:57 AM, David Sommerseth wrote: This case is exactly what I am trying to prevent. There is multiple implementations of dns cache, most of them can support split-DNS by some configuration. If openvpn supports systemd-resolved natively, does that mean it would not be able to support split-DNS on dnsmasq or unbound? What is motivation to support specific implementation instead of generic interface? I don't want to ask openvpn to support also dnsmasq or unbound natively, because I think there should be middle layer support. I am trying to use resolvconf as such layer. I am dnsmasq, unbound and bind (co)maintainer. I want them to stay first class citizens in Fedora, even when they are not installed by default. Of course, also knot-resolver and pdns-recursor should be supported, if they are (willing and) able to. I think it should be configurable from server side with ability to override it on client side. The VPN owner should be able to do specify, whether all queries or only domain-selected queries should go over the VPN. Is it already possible to choose the variant from server side? The default should matter only in case VPN administrator does not care. Is there a reason, why systemd-resolved's resolvconf does not work for you? Does update-systemd-resolved need more functionality than resolvconf is able to provide? Was the reason missing resolvconf on Ubuntu/Debian? For example, resolvconf -p -a <resolv.conf would request only selected domains over provided interface. resolvconf -x -a <resolv.conf would send all queries over the interface, according to man 8 resolvconf. The same seems to be supported also by systemd's resolvconf. Was resolvconf usage tried for this purpose? AFAIK systemd does not provide resolvconf on Ubuntu nor Debian, where only openresolv and resolvconf packages exist to provide resolvconf binary. In Fedora, only systemd provided it until now. I think resolvectl might expose resolvconf interface via parameters, not only by resolvconf symlink to resolvectl. It misuses search resolv.conf clause to list provided domains a bit. I doubt ~domain notation is supported by openresolv already, but I think it would not be hard to implement it. NM can set ipv4.dns-search and ipv4.dns, with ipv6 having this too. My ethernet nmcli shows values from DHCP as IP4.DNS[*] and IP4.DOMAIN[*]. I think that is almost all we need. Set of DNS IPs and list of domains handled by them. Then just a signal of preference, whether to forward all unspecific queries to this connection by default. NM has also ipv4.dns-priority number, I guess it is for similar thing. Problem is as you already noted, NM limits some feature uses. I think NM can store only values per connection only when it manages such connection. I doubt it can store dns properties on connections or devices not managed by it. resolvconf should make possible even pure openvpn connections having list of dns servers and list of domains. Can or should we ignore connections not managed by NM? How rare are they? Of course! Providers of VPN are a primary target to split-DNS support. There should be unified interface for them, without having to implement any specific cache details. Implementation-specific mapping to cache implementation should be provided by dns cache maintainers IMHO. If resolvconf is problematic in any way, what features are missing? What requirements are important for OpenVPN? Is OpenVPN 3 even packaged on Fedora? -- Petr Menšík Software Engineer Red Hat, http://www.redhat.com/ email: pemensik(a)redhat.com PGP: DFCF908DB7C87E8E529925BC4931CA5B6C9FC5CB