Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add support for IPv6 Virtual DNS #462

Open
wants to merge 10 commits into
base: main
Choose a base branch
from

Conversation

1cho1ce
Copy link
Contributor

@1cho1ce 1cho1ce commented Oct 5, 2023

Add support for IPv6 DNS together with this pull request:
QubesOS/qubes-core-admin#558

@marmarek
Copy link
Member

marmarek commented Oct 5, 2023

Unfortunately this may not be as simple as this. All is fine if you really have IPv6 DNS in your network. But if you have IPv4 one (but otherwise have IPv6 connectivity), then queries sent to the "virtual DNS" address won't be redirected anywhere, most likely will be silently discarded somewhere along the way (either in sys-net, but more likely on some next router). This is bad, because from application point of view, this is no response and the application will wait for a timeout instead of immediately falling back to IPv4 DNS. And it is especially bad with infamous DNS fallback handling in Linux...
BTW, the same issue applies to the case of only IPv6 DNS (even without this PR), but it's a smaller problem because it's rather rare setup.

Some solution to this issue might be forwarding between IPv6 and IPv4 appropriately, for example using socat (socat UDP-LISTEN:... UDP:...). It's an ugly solution...

Or maybe there is some way to avoid long timeouts, like reject with some specific ICMP packet if no IPv6 DNS is present?

@1cho1ce
Copy link
Contributor Author

1cho1ce commented Oct 5, 2023

What if we add a reject rule for IPv6 DNS queries if it's a qube with:

  1. IPv6 enabled
  2. It's connected to outside network:
    2.1. Either with network adapter passthrough (sys-net) (check if /qubes-primary-dns or /qubes-ip is None?)
    2.2. Or it's a qube meant to encapsulate IPv6 traffic for only some subset of Qubes networking as described here for teredo example (check if /qubes-ip6 is set and /qubes-gateway6 is None?):
    https://www.qubes-os.org/doc/networking/#ipv6
  3. No real IPv6 DNS (not Qubes OS Virtual DNS address) found with get_dns_resolved()

Then IPv6 DNS queries will be rejected and there shouldn't be any timeouts or queries to Virtual DNS sent outside?
Drop rules are causing timeouts and reject rules should generate ICMP response so it won't wait anymore:
https://wiki.nftables.org/wiki-nftables/index.php/Rejecting_traffic
I think host-unreachable packet fits.

I'll try it out.

@marmarek
Copy link
Member

marmarek commented Oct 6, 2023

The second condition may not be needed in fact. Either qube has some IPv6 DNS it can forward traffic to (either "real" one outside, or virtual one, or via some VPN or such) or not. Specifically, if you have a VPN that is supposed to encapsulate all your traffic, it should adjust local DNS servers in that qube too - at which point the 3rd condition will handle this case.

@marmarek
Copy link
Member

marmarek commented Oct 6, 2023

But yes, something like this might work. Try it out and let me know :)

…s nowhere to forward them to avoid DNS query timeouts. There are hardcoded Qubes OS Virtual DNS addresses which is bad but I couldn't think of an easy way out.
…r code that only add Virtual DNS servers to qubes that have netvm set and don't add DNS to every qube that provides network (sys-net/sys-usb/etc).
@codecov
Copy link

codecov bot commented Oct 6, 2023

Codecov Report

Merging #462 (41a13ce) into main (e148214) will not change coverage.
Report is 8 commits behind head on main.
The diff coverage is n/a.

❗ Current head 41a13ce differs from pull request most recent head 3f2f25c. Consider uploading reports for the commit 3f2f25c to get more accurate results

@@           Coverage Diff           @@
##             main     #462   +/-   ##
=======================================
  Coverage   69.89%   69.89%           
=======================================
  Files           3        3           
  Lines         475      475           
=======================================
  Hits          332      332           
  Misses        143      143           

@1cho1ce
Copy link
Contributor Author

1cho1ce commented Oct 6, 2023

I've tested the reject rules and it works fine.
First one without reject or dnat DNS rules and second one with reject rules:

user@test:~$ time curl -o /dev/null -s https://debian.org

real	0m20.068s
user	0m0.009s
sys	0m0.018s
user@test:~$ time curl -o /dev/null -s https://debian.org

real	0m0.016s
user	0m0.009s
sys	0m0.006s

I had to change the way Qubes OS set DNS servers to qubes with these commits:
QubesOS/qubes-core-admin@98b184c
d659bfb
Before it was setting DNS for qubes that provides network and don't have netvm (sys-net/sys-usb/etc) which I think is pointless (maybe I just don't understand where it would be used) and It interfered with implementation of DNS reject rules.
I'm not sure if this will break anything. I've tested that it didn't break basic things but maybe there are some things that could break.

Also I had to hardcode Qubes OS Virtual DNS addresses here:
0aaad6a#diff-1e7c156682261fecd8a773620728327528f3be00468837709d7ffeb8073cc602R29
Which is bad but I couldn't think of an easy way out.
If we just reject all DNS queries in dnat-dns chain with rules like this:
tcp dport 53 reject with icmp type host-unreachable
Then it'll reject all DNS queries that would come from qubes including:

  • input queries to DNS server running in this qube
  • forward queries to some specific "real" DNS which downstream qubes used instead of "virtual" DNS

@marmarek
Copy link
Member

marmarek commented Oct 7, 2023

Also I had to hardcode Qubes OS Virtual DNS addresses here:

See my comment in the other PR.

Anyway, I think the general shape is getting there. But due to release stage of R4.2, it's too late to be included there, at least before final release. So, I'll merge it only after final R4.2 release.

@qubesos-bot
Copy link

qubesos-bot commented Oct 20, 2023

OpenQA test summary

Complete test suite and dependencies: https://openqa.qubes-os.org/tests/overview?distri=qubesos&version=4.2&build=2023102812-4.2&flavor=pull-requests

New failures, excluding unstable

Compared to: https://openqa.qubes-os.org/tests/overview?distri=qubesos&version=4.2&build=2023071104-4.2&flavor=update

  • system_tests_whonix

  • system_tests_gui_tools

    • qui_widgets_update: unnamed test (unknown)

    • qui_widgets_update: Failed (test died)
      # Test died: no candidate needle with tag(s) 'qubes-update-next' ma...

    • qui_widgets_update: unnamed test (unknown)

  • system_tests_basic_vm_qrexec_gui

  • system_tests_network

  • system_tests_gui_interactive

    • clipboard_and_web: unnamed test (unknown)
    • clipboard_and_web: Failed (test died)
      # Test died: no candidate needle with tag(s) 'qubes-website' matche...
  • system_tests_guivm_gui_interactive

    • update_guivm: Failed (test died)
      # Test died: command '(set -o pipefail; qubesctl --all --show-outpu...
  • system_tests_network_ipv6

  • system_tests_network_updates

    • TC_10_QvmTemplate_debian-12-xfce: test_000_template_list (failure)
      qvm-template: error: No matching templates to list

    • TC_10_QvmTemplate_debian-12-xfce: test_010_template_install (failure)
      qvm-template: error: Template 'debian-11-minimal' not found.

    • TC_10_QvmTemplate_fedora-38-xfce: test_000_template_list (failure)
      qvm-template: error: No matching templates to list

    • TC_10_QvmTemplate_fedora-38-xfce: test_010_template_install (failure)
      qvm-template: error: Template 'debian-11-minimal' not found.

    • TC_11_QvmTemplateMgmtVM_debian-12-xfce: test_000_template_list (failure)
      qvm-template: error: No matching templates to list

    • TC_11_QvmTemplateMgmtVM_debian-12-xfce: test_010_template_install (failure)
      qvm-template: error: Template 'debian-11-minimal' not found.

    • TC_11_QvmTemplateMgmtVM_fedora-38-xfce: test_000_template_list (failure)
      qvm-template: error: No matching templates to list

    • TC_11_QvmTemplateMgmtVM_fedora-38-xfce: test_010_template_install (failure)
      qvm-template: error: Template 'debian-11-minimal' not found.

    • VmUpdates_debian-12-xfce: test_000_simple_update (failure)
      AssertionError: 1 not found in [0] : set -o pipefail; apt-get updat...

    • VmUpdates_fedora-38-xfce: test_000_simple_update (failure)
      AssertionError: 1 not found in [0, 100] : dnf clean all; dnf check-...

  • system_tests_kde_gui_interactive

    • kde_install: wait_serial (wait serial expected)
      # wait_serial expected: qr/BGhMX-\d+-/...

    • kde_install: Failed (test died + timed out)
      # Test died: command 'curl --form upload=@/tmp/kde-install.log --fo...

  • system_tests_vm_qrexec_gui_pipewire

  • system_tests_basic_vm_qrexec_gui_btrfs

  • system_tests_gui_interactive@hw1

    • clipboard_and_web: unnamed test (unknown)
    • clipboard_and_web: Failed (test died)
      # Test died: no candidate needle with tag(s) 'qubes-website' matche...
  • system_tests_splitgpg

  • system_tests_pvgrub_salt_storage

    • TC_40_PVGrub_debian-12-xfce: test_000_standalone_vm (failure)
      AssertionError: Failed command: apt-get update && apt-get install -...

    • TC_41_HVMGrub_debian-12-xfce: test_000_standalone_vm (failure)
      AssertionError: Failed command: apt-get update && apt-get install -...

    • TC_41_HVMGrub_fedora-38-xfce: test_010_template_based_vm (error)
      qubes.exc.QubesVMError: Cannot connect to qrexec agent for 120 seco...

    • TC_42_PVHGrub_debian-12-xfce: test_000_standalone_vm (failure)
      AssertionError: Failed command: apt-get update && apt-get install -...

    • TC_42_PVHGrub_fedora-38-xfce: test_000_standalone_vm (failure)
      AssertionError: Failed command: dnf clean expire-cache && dnf insta...

    • TC_10_VMSalt_debian-12-xfce: test_003_update (failure)
      AssertionError: Salt command '['qubesctl', '--skip-dom0', '--show-o...

    • TC_10_VMSalt_fedora-38-xfce: test_003_update (failure)
      AssertionError: Salt command '['qubesctl', '--skip-dom0', '--show-o...

  • system_tests_basic_vm_qrexec_gui_xfs

    • switch_pool: wait_serial (wait serial expected)
      # wait_serial expected: qr/yE0ox-\d+-/...

    • switch_pool: Failed (test died + timed out)
      # Test died: command 'qubes-dom0-update -y xfsprogs' timed out at /...

  • system_tests_basic_vm_qrexec_gui_zfs

    • switch_pool: wait_serial (wait serial expected)
      # wait_serial expected: qr/eVFUj-\d+-/...

    • switch_pool: Failed (test died + timed out)
      # Test died: command 'qubes-dom0-update -y zfs' timed out at /usr/l...

  • system_tests_basic_vm_qrexec_gui@hw1

    • startup: unnamed test (unknown)
    • startup: Failed (test died)
      # Test died: no candidate needle with tag(s) 'desktop' matched...

Failed tests

127 failures
  • system_tests_whonix

    • whonix_torbrowser: unnamed test (unknown)

    • [unstable] whonix_torbrowser: Failed (test died)
      # Test died: no candidate needle with tag(s) 'tor-browser-ipcheck-o...

    • [unstable] whonix_torbrowser: unnamed test (unknown)

  • system_tests_gui_tools

    • qui_widgets_update: unnamed test (unknown)

    • qui_widgets_update: Failed (test died)
      # Test died: no candidate needle with tag(s) 'qubes-update-next' ma...

    • qui_widgets_update: unnamed test (unknown)

  • system_tests_basic_vm_qrexec_gui

  • system_tests_network

  • system_tests_gui_interactive

    • clipboard_and_web: unnamed test (unknown)
    • clipboard_and_web: Failed (test died)
      # Test died: no candidate needle with tag(s) 'qubes-website' matche...
  • system_tests_guivm_gui_interactive

    • update_guivm: Failed (test died)
      # Test died: command '(set -o pipefail; qubesctl --all --show-outpu...
  • system_tests_network_ipv6

  • system_tests_network_updates

    • [unstable] TC_00_Dom0Upgrade_debian-12-xfce: test_001_update_check (failure)
      self.assertTrue(self.app.domains[0].... AssertionError: '' is not true

    • [unstable] TC_00_Dom0Upgrade_fedora-38-xfce: test_001_update_check (failure)
      self.assertTrue(self.app.domains[0].... AssertionError: '' is not true

    • TC_10_QvmTemplate_debian-12-xfce: test_000_template_list (failure)
      qvm-template: error: No matching templates to list

    • TC_10_QvmTemplate_debian-12-xfce: test_010_template_install (failure)
      qvm-template: error: Template 'debian-11-minimal' not found.

    • TC_10_QvmTemplate_fedora-38-xfce: test_000_template_list (failure)
      qvm-template: error: No matching templates to list

    • TC_10_QvmTemplate_fedora-38-xfce: test_010_template_install (failure)
      qvm-template: error: Template 'debian-11-minimal' not found.

    • TC_11_QvmTemplateMgmtVM_debian-12-xfce: test_000_template_list (failure)
      qvm-template: error: No matching templates to list

    • TC_11_QvmTemplateMgmtVM_debian-12-xfce: test_010_template_install (failure)
      qvm-template: error: Template 'debian-11-minimal' not found.

    • TC_11_QvmTemplateMgmtVM_fedora-38-xfce: test_000_template_list (failure)
      qvm-template: error: No matching templates to list

    • TC_11_QvmTemplateMgmtVM_fedora-38-xfce: test_010_template_install (failure)
      qvm-template: error: Template 'debian-11-minimal' not found.

    • VmUpdates_debian-12-xfce: test_000_simple_update (failure)
      AssertionError: 1 not found in [0] : set -o pipefail; apt-get updat...

    • VmUpdates_fedora-38-xfce: test_000_simple_update (failure)
      AssertionError: 1 not found in [0, 100] : dnf clean all; dnf check-...

  • system_tests_kde_gui_interactive

    • kde_install: wait_serial (wait serial expected)
      # wait_serial expected: qr/BGhMX-\d+-/...

    • kde_install: Failed (test died + timed out)
      # Test died: command 'curl --form upload=@/tmp/kde-install.log --fo...

  • system_tests_vm_qrexec_gui_pipewire

  • system_tests_basic_vm_qrexec_gui_btrfs

  • system_tests_gui_interactive@hw1

    • clipboard_and_web: unnamed test (unknown)
    • clipboard_and_web: Failed (test died)
      # Test died: no candidate needle with tag(s) 'qubes-website' matche...
  • system_tests_splitgpg

  • system_tests_pvgrub_salt_storage

    • TC_40_PVGrub_debian-12-xfce: test_000_standalone_vm (failure)
      AssertionError: Failed command: apt-get update && apt-get install -...

    • TC_41_HVMGrub_debian-12-xfce: test_000_standalone_vm (failure)
      AssertionError: Failed command: apt-get update && apt-get install -...

    • [unstable] TC_41_HVMGrub_fedora-38-xfce: test_000_standalone_vm (failure)
      AssertionError: Failed command: dnf clean expire-cache && dnf insta...

    • TC_41_HVMGrub_fedora-38-xfce: test_010_template_based_vm (error)
      qubes.exc.QubesVMError: Cannot connect to qrexec agent for 120 seco...

    • TC_42_PVHGrub_debian-12-xfce: test_000_standalone_vm (failure)
      AssertionError: Failed command: apt-get update && apt-get install -...

    • TC_42_PVHGrub_fedora-38-xfce: test_000_standalone_vm (failure)
      AssertionError: Failed command: dnf clean expire-cache && dnf insta...

    • TC_10_VMSalt_debian-12-xfce: test_003_update (failure)
      AssertionError: Salt command '['qubesctl', '--skip-dom0', '--show-o...

    • TC_10_VMSalt_fedora-38-xfce: test_003_update (failure)
      AssertionError: Salt command '['qubesctl', '--skip-dom0', '--show-o...

  • system_tests_suspend@hw1

    • [unstable] suspend: Failed (test died)
      # Test died: command 'qvm-run -p sys-firewall "curl https://www.qub...
  • system_tests_suspend

    • [unstable] suspend: wait_serial (wait serial expected)
      # wait_serial expected: qr/0DNLB-\d+-/...

    • [unstable] suspend: Failed (test died + timed out)
      # Test died: command 'qvm-run -p sys-firewall "curl https://www.qub...

  • system_tests_basic_vm_qrexec_gui_xfs

    • switch_pool: wait_serial (wait serial expected)
      # wait_serial expected: qr/yE0ox-\d+-/...

    • switch_pool: Failed (test died + timed out)
      # Test died: command 'qubes-dom0-update -y xfsprogs' timed out at /...

  • system_tests_basic_vm_qrexec_gui_zfs

    • switch_pool: wait_serial (wait serial expected)
      # wait_serial expected: qr/eVFUj-\d+-/...

    • switch_pool: Failed (test died + timed out)
      # Test died: command 'qubes-dom0-update -y zfs' timed out at /usr/l...

  • system_tests_basic_vm_qrexec_gui@hw1

    • startup: unnamed test (unknown)
    • startup: Failed (test died)
      # Test died: no candidate needle with tag(s) 'desktop' matched...

Fixed failures

Compared to: https://openqa.qubes-os.org/tests/77326#dependencies

23 fixed
  • system_tests_whonix

  • system_tests_network

  • system_tests_guivm_gui_interactive

    • update_templates: Failed (test died)
      # Test died: command 'curl --form upload=@template-fedora-38-xfce-v...
  • system_tests_qrexec

  • system_tests_network_ipv6

    • VmIPv6Networking_fedora-38: test_040_inter_vm (error)
      qubes.exc.QubesMemoryError: Not enough memory to start domain 'test...

    • VmIPv6Networking_fedora-38: test_203_fake_ip_inter_vm_allow (error)
      qubes.exc.QubesMemoryError: Not enough memory to start domain 'test...

  • system_tests_dispvm

  • system_tests_splitgpg

  • system_tests_manager

    • VMSettingsTest: test_26_default_dispvm (failure)
      self.assertTrue(self.vm.property_... AssertionError: False is not true

Unstable tests

  • system_tests_whonix

    whonix_torbrowser/ (1/5 times with errors)
    whonix_torbrowser/ (1/5 times with errors)
    whonix_torbrowser/ (1/5 times with errors)
    whonix_torbrowser/ (1/5 times with errors)
    whonix_torbrowser/ (1/5 times with errors)
    whonix_torbrowser/ (1/5 times with errors)
    whonix_torbrowser/Failed (1/5 times with errors)
    • job 84077 # Test died: no candidate needle with tag(s) 'tor-browser-ipcheck-o...
    whonix_torbrowser/Failed (1/5 times with errors)
    • job 84081 # Test died: no candidate needle with tag(s) 'desktop-clear' matche...
    whonix_torbrowser/Failed (1/5 times with errors)
    • job 84054 # Test died: no candidate needle with tag(s) 'anon-whonix-tor-brows...
  • system_tests_basic_vm_qrexec_gui

    TC_20_AudioVM_Pulse_debian-12-xfce/test_222_audio_rec_unmuted_pulseaudio (1/5 times with errors)
    • job 82899 qubes.exc.QubesVMError: Failed to attach audio input from dom0 to t...
    TC_20_AudioVM_Pulse_fedora-38-xfce/test_222_audio_rec_unmuted_pulseaudio (1/5 times with errors)
    • job 82367 AssertionError: frequency 3366.354981298878 not in specified range,...
    TC_20_NonAudio_whonix-gateway-17/test_300_bug_1028_gui_memory_pinning (2/5 times with errors)
    • job 82367 AssertionError: Dom0 window doesn't match VM window content, saved ...
    • job 84061 AssertionError: Dom0 window doesn't match VM window content, saved ...
  • system_tests_network_ipv6

    VmIPv6Networking_debian-12-xfce/test_113_reattach_after_provider_kill (1/5 times with errors)
    • job 82377 raise exceptions.TimeoutError() from exc... TimeoutError
  • system_tests_network_updates

    TC_00_Dom0Upgrade_debian-12-xfce/test_001_update_check (1/3 times with errors)
    • job 82378 self.assertFalse(self.app.domains[... AssertionError: '1' is not false
    TC_00_Dom0Upgrade_fedora-38-xfce/test_001_update_check (1/3 times with errors)
    • job 82378 self.assertFalse(self.app.domains[... AssertionError: '1' is not false
  • system_tests_dispvm

    TC_20_DispVM_fedora-38-xfce/test_010_simple_dvm_run (1/5 times with errors)
    • job 83078 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^... AssertionError
    TC_20_DispVM_fedora-38-xfce/test_030_edit_file (1/5 times with errors)
    • job 82011 AssertionError: Timeout while waiting for disp[0-9]* window to show
    TC_20_DispVM_whonix-workstation-17/test_030_edit_file (2/5 times with errors)
    • job 82011 AssertionError: Timeout while waiting for disp[0-9]* window to show
    • job 83078 AssertionError: Timeout while waiting for disp[0-9]* window to show
    TC_20_DispVM_debian-12-xfce/test_100_open_in_dispvm (1/5 times with errors)
    • job 83078 AssertionError: Timeout while waiting for disp[0-9]* window to show
    TC_20_DispVM_whonix-workstation-17/test_100_open_in_dispvm (1/5 times with errors)
    • job 82011 AssertionError: Timeout while waiting for disp[0-9]* window to show
  • system_tests_whonix@hw1

    whonix_torbrowser/ (1/5 times with errors)
    whonix_torbrowser/ (1/5 times with errors)
    whonix_torbrowser/ (1/5 times with errors)
    whonix_torbrowser/ (1/5 times with errors)
    whonix_torbrowser/ (1/5 times with errors)
    whonix_torbrowser/ (1/5 times with errors)
    whonix_torbrowser/Failed (1/5 times with errors)
    • job 84077 # Test died: no candidate needle with tag(s) 'tor-browser-ipcheck-o...
    whonix_torbrowser/Failed (1/5 times with errors)
    • job 84081 # Test died: no candidate needle with tag(s) 'desktop-clear' matche...
    whonix_torbrowser/Failed (1/5 times with errors)
    • job 84054 # Test died: no candidate needle with tag(s) 'anon-whonix-tor-brows...
  • system_tests_basic_vm_qrexec_gui_btrfs

    TC_20_AudioVM_Pulse_debian-12-xfce-pool/test_222_audio_rec_unmuted_pulseaudio (1/5 times with errors)
    • job 83074 qubes.exc.QubesVMError: Failed to attach audio input from dom0 to t...
    TC_20_AudioVM_PipeWire_debian-12-xfce-pool/test_226_audio_playback_pipewire (1/5 times with errors)
    • job 81995 AssertionError: Command 'pw-play --format=f32 --rate=44100 --channe...
  • system_tests_splitgpg

    TC_10_Thunderbird_debian-12-xfce/test_000_send_receive_default (1/5 times with errors)
    • job 84075 dogtail.tree.SearchError: descendent of [application | Thunderbird]...
    TC_10_Thunderbird_fedora-38-xfce/test_000_send_receive_default (1/5 times with errors)
    • job 84075 dogtail.tree.SearchError: descendent of [application | Thunderbird]...
    TC_10_Thunderbird_whonix-workstation-17/test_000_send_receive_default (1/5 times with errors)
    • job 84075 dogtail.tree.SearchError: descendent of [application | Thunderbird]...
    TC_10_Thunderbird_debian-12-xfce/test_010_send_receive_inline_signed_only (1/5 times with errors)
    • job 84075 dogtail.tree.SearchError: descendent of [application | Thunderbird]...
    TC_10_Thunderbird_fedora-38-xfce/test_010_send_receive_inline_signed_only (1/5 times with errors)
    • job 84075 dogtail.tree.SearchError: descendent of [application | Thunderbird]...
    TC_10_Thunderbird_whonix-workstation-17/test_010_send_receive_inline_signed_only (1/5 times with errors)
    • job 84075 dogtail.tree.SearchError: descendent of [application | Thunderbird]...
    TC_10_Thunderbird_debian-12-xfce/test_020_send_receive_inline_with_attachment (1/5 times with errors)
    • job 84075 dogtail.tree.SearchError: descendent of [application | Thunderbird]...
    TC_10_Thunderbird_fedora-38-xfce/test_020_send_receive_inline_with_attachment (1/5 times with errors)
    • job 84075 dogtail.tree.SearchError: descendent of [application | Thunderbird]...
  • system_tests_pvgrub_salt_storage

    TC_41_HVMGrub_fedora-38-xfce/test_000_standalone_vm (4/5 times with errors)
    • job 82004 qubes.exc.QubesVMError: Cannot connect to qrexec agent for 120 seco...
    • job 82379 qubes.exc.QubesVMError: Cannot connect to qrexec agent for 120 seco...
    • job 83085 qubes.exc.QubesVMError: Cannot connect to qrexec agent for 120 seco...
    • job 84073 qubes.exc.QubesVMError: Cannot connect to qrexec agent for 120 seco...
  • system_tests_usbproxy

    TC_00_USBProxy_whonix-gateway-17/test_020_detach_on_remove (1/5 times with errors)
    • job 83065 qubes.exc.QubesMemoryError: Not enough memory to start domain 'test...
  • system_tests_suspend@hw1

    suspend/Failed (2/5 times with errors)
    • job 84711 # Test died: command 'true' timed out at /usr/lib/os-autoinst/autot...
    • job 84715 # Test died: command 'true' timed out at /usr/lib/os-autoinst/autot...
    suspend/Failed (1/5 times with errors)
    • job 83088 # Test died: command 'true' timed out at /usr/lib/os-autoinst/autot...
    suspend/wait_serial (2/5 times with errors)
    • job 84711 # wait_serial expected: qr/p5~T5-\d+-/...
    • job 84715 # wait_serial expected: qr/p5~T5-\d+-/...
    suspend/wait_serial (1/5 times with errors)
    • job 83088 # wait_serial expected: qr/p5~T5-\d+-/...
  • system_tests_suspend

    suspend/Failed (2/5 times with errors)
    • job 84711 # Test died: command 'true' timed out at /usr/lib/os-autoinst/autot...
    • job 84715 # Test died: command 'true' timed out at /usr/lib/os-autoinst/autot...
    suspend/Failed (1/5 times with errors)
    • job 83088 # Test died: command 'true' timed out at /usr/lib/os-autoinst/autot...
    suspend/wait_serial (2/5 times with errors)
    • job 84711 # wait_serial expected: qr/p5~T5-\d+-/...
    • job 84715 # wait_serial expected: qr/p5~T5-\d+-/...
    suspend/wait_serial (1/5 times with errors)
    • job 83088 # wait_serial expected: qr/p5~T5-\d+-/...
  • system_tests_basic_vm_qrexec_gui_ext4

    TC_00_Basic/test_120_start_standalone_with_cdrom_dom0 (1/5 times with errors)
    • job 81994 AssertionError: 1 != 0 : b'Timeout waiting for dom0:loop12 device t...
    TC_20_NonAudio_whonix-workstation-17-pool/test_130_qrexec_filemove_disk_full (1/5 times with errors)
    • job 82901 raise exceptions.TimeoutError() from exc... TimeoutError
    TC_20_AudioVM_Pulse_fedora-38-xfce-pool/test_222_audio_rec_unmuted_pulseaudio (1/5 times with errors)
    • job 82369 AssertionError: frequency 3252.494577006508 not in specified range,...
  • system_tests_basic_vm_qrexec_gui_xfs

    TC_20_NonAudio_debian-12-xfce-pool/test_130_qrexec_filemove_disk_full (1/5 times with errors)
    • job 83076 subprocess.CalledProcessError: Command 'mkdir -p /home/user/QubesIn...
    TC_20_AudioVM_Pulse_debian-12-xfce-pool/test_221_audio_rec_muted_pulseaudio (1/5 times with errors)
    • job 82370 AssertionError: source-output for VM test-inst-vm1 not found
    TC_20_AudioVM_PipeWire_debian-12-xfce-pool/test_226_audio_playback_pipewire (2/5 times with errors)
    • job 82370 AssertionError: Command 'pw-play --format=f32 --rate=44100 --channe...
    • job 82902 AssertionError: Command 'pw-play --format=f32 --rate=44100 --channe...
  • system_tests_basic_vm_qrexec_gui_zfs

    TC_20_NonAudio_whonix-gateway-17-pool/test_010_run_xterm (1/5 times with errors)
    • job 83067 raise exceptions.TimeoutError() from exc... TimeoutError
    TC_00_Basic/test_120_start_standalone_with_cdrom_dom0 (1/5 times with errors)
    • job 82357 AssertionError: 1 != 0 : b'Timeout waiting for dom0:loop4 device to...
    TC_00_Basic/test_200_shutdown_event_race (1/5 times with errors)
    • job 82357 AssertionError: libvirt event impl drain timeout
    TC_20_AudioVM_PipeWire_debian-12-xfce-pool/test_227_audio_rec_muted_pipewire (1/5 times with errors)
    • job 82889 subprocess.CalledProcessError: Command 'pkill pw-record' returned n...
  • system_tests_basic_vm_qrexec_gui@hw1

    TC_20_AudioVM_Pulse_debian-12-xfce/test_222_audio_rec_unmuted_pulseaudio (1/5 times with errors)
    • job 82899 qubes.exc.QubesVMError: Failed to attach audio input from dom0 to t...
    TC_20_AudioVM_Pulse_fedora-38-xfce/test_222_audio_rec_unmuted_pulseaudio (1/5 times with errors)
    • job 82367 AssertionError: frequency 3366.354981298878 not in specified range,...
    TC_20_NonAudio_whonix-gateway-17/test_300_bug_1028_gui_memory_pinning (2/5 times with errors)
    • job 82367 AssertionError: Dom0 window doesn't match VM window content, saved ...
    • job 84061 AssertionError: Dom0 window doesn't match VM window content, saved ...

@marmarek
Copy link
Member

This looks broken (click the link for full traceback)

@1cho1ce
Copy link
Contributor Author

1cho1ce commented Oct 29, 2023

This looks broken (click the link for full traceback)

Fixed and tested with systemd-resolved.

Copy link
Contributor

@SaswatPadhi SaswatPadhi left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @1cho1ce for working on this PR. I was trying to do something similar and came across this and your other PR.
Are you still working on this? I was going through the code and noticed some minor issues, so commenting below.

if [ -n "$primary_dns6" ]; then
cat > /var/run/qubes/qubes-ns<< EOF
NS1=$primary_dns6
NS1=$secondary_dns6
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
NS1=$secondary_dns6
NS2=$secondary_dns6

else
cat > /var/run/qubes/qubes-ns<< EOF
NS1=$primary_dns
NS1=$secondary_dns
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
NS1=$secondary_dns
NS2=$secondary_dns

if [ -n "$primary_dns6" ]; then
cat > /var/run/qubes/qubes-ns<< EOF
NS1=$primary_dns6
NS1=$secondary_dns6
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
NS1=$secondary_dns6
NS2=$secondary_dns6

else
cat > /var/run/qubes/qubes-ns<< EOF
NS1=$primary_dns
NS1=$secondary_dns
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
NS1=$secondary_dns
NS2=$secondary_dns

break
dns_ = str(dest)
if dest is None or (vm_nameserver == dest and
qdb.read('/qubes-ip') is None):
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
qdb.read('/qubes-ip') is None):
qdb.read('/qubes-primary-dns') is None):

for consistency?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants