From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [45.144.208.40]) by lore.proxmox.com (Postfix) with ESMTPS id D568A1FF0B3 for ; Thu, 12 Nov 2026 00:15:28 +0100 (CET) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id 8CB1F21638; Thu, 12 Nov 2026 00:15:25 +0100 (CET) Message-ID: Date: Thu, 12 Nov 2026 00:15:21 +0100 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Beta Subject: Re: [PATCH common] fix #6357: inotify: resolv.conf: parse all search domains To: Lucas Barros , pve-devel@lists.proxmox.com References: <20261107223019.21361-1-lucasbarros.kam@gmail.com> Content-Language: en-US From: Thomas Lamprecht Autocrypt: addr=t.lamprecht@proxmox.com; keydata= xsFNBFsLjcYBEACsaQP6uTtw/xHTUCKF4VD4/Wfg7gGn47+OfCKJQAD+Oyb3HSBkjclopC5J uXsB1vVOfqVYE6PO8FlD2L5nxgT3SWkc6Ka634G/yGDU3ZC3C/7NcDVKhSBI5E0ww4Qj8s9w OQRloemb5LOBkJNEUshkWRTHHOmk6QqFB/qBPW2COpAx6oyxVUvBCgm/1S0dAZ9gfkvpqFSD 90B5j3bL6i9FIv3YGUCgz6Ue3f7u+HsEAew6TMtlt90XV3vT4M2IOuECG/pXwTy7NtmHaBQ7 UJBcwSOpDEweNob50+9B4KbnVn1ydx+K6UnEcGDvUWBkREccvuExvupYYYQ5dIhRFf3fkS4+ wMlyAFh8PQUgauod+vqs45FJaSgTqIALSBsEHKEs6IoTXtnnpbhu3p6XBin4hunwoBFiyYt6 YHLAM1yLfCyX510DFzX/Ze2hLqatqzY5Wa7NIXqYYelz7tXiuCLHP84+sV6JtEkeSUCuOiUY virj6nT/nJK8m0BzdR6FgGtNxp7RVXFRz/+mwijJVLpFsyG1i0Hmv2zTn3h2nyGK/I6yhFNt dX69y5hbo6LAsRjLUvZeHXpTU4TrpN/WiCjJblbj5um5eEr4yhcwhVmG102puTtuCECsDucZ jpKpUqzXlpLbzG/dp9dXFH3MivvfuaHrg3MtjXY1i+/Oxyp5iwARAQABzTNUaG9tYXMgTGFt cHJlY2h0IChBdXRoLTQpIDx0LmxhbXByZWNodEBwcm94bW94LmNvbT7CwY4EEwEIADgWIQQO R4qbEl/pah9K6VrTZCM6gDZWBgUCWwuNxgIbAwULCQgHAgYVCAkKCwIEFgIDAQIeAQIXgAAK CRDTZCM6gDZWBm/jD/4+6JB2s67eaqoP6x9VGaXNGJPCscwzLuxDTCG90G9FYu29VcXtubH/ bPwsyBbNUQpqTm/s4XboU2qpS5ykCuTjqavrcP33tdkYfGcItj2xMipJ1i3TWvpikQVsX42R G64wovLs/dvpTYphRZkg5DwhgTmy3mRkmofFCTa+//MOcNOORltemp984tWjpR3bUJETNWpF sKGZHa3N4kCNxb7A+VMsJZ/1gN3jbQbQG7GkJtnHlWkw9rKCYqBtWrnrHa4UAvSa9M/XCIAB FThFGqZI1ojdVlv5gd6b/nWxfOPrLlSxbUo5FZ1i/ycj7/24nznW1V4ykG9iUld4uYUY86bB UGSjew1KYp9FmvKiwEoB+zxNnuEQfS7/Bj1X9nxizgweiHIyFsRqgogTvLh403QMSGNSoArk tqkorf1U+VhEncIn4H3KksJF0njZKfilrieOO7Vuot1xKr9QnYrZzJ7m7ZxJ/JfKGaRHXkE1 feMmrvZD1AtdUATZkoeQtTOpMu4r6IQRfSdwm/CkppZXfDe50DJxAMDWwfK2rr2bVkNg/yZI tKLBS0YgRTIynkvv0h8d9dIjiicw3RMeYXyqOnSWVva2r+tl+JBaenr8YTQw0zARrhC0mttu cIZGnVEvQuDwib57QLqMjQaC1gazKHvhA15H5MNxUhwm229UmdH3KM7BTQRbC43GARAAyTkR D6KRJ9Xa2fVMh+6f186q0M3ni+5tsaVhUiykxjsPgkuWXWW9MbLpYXkzX6h/RIEKlo2BGA95 QwG5+Ya2Bo3g7FGJHAkXY6loq7DgMp5/TVQ8phsSv3WxPTJLCBq6vNBamp5hda4cfXFUymsy HsJy4dtgkrPQ/bnsdFDCRUuhJHopnAzKHN8APXpKU6xV5e3GE4LwFsDhNHfH/m9+2yO/trcD txSFpyftbK2gaMERHgA8SKkzRhiwRTt9w5idOfpJVkYRsgvuSGZ0pcD4kLCOIFrer5xXudk6 NgJc36XkFRMnwqrL/bB4k6Pi2u5leyqcXSLyBgeHsZJxg6Lcr2LZ35+8RQGPOw9C0ItmRjtY ZpGKPlSxjxA1WHT2YlF9CEt3nx7c4C3thHHtqBra6BGPyW8rvtq4zRqZRLPmZ0kt/kiMPhTM 8wZAlObbATVrUMcZ/uNjRv2vU9O5aTAD9E5r1B0dlqKgxyoImUWB0JgpILADaT3VybDd3C8X s6Jt8MytUP+1cEWt9VKo4vY4Jh5vwrJUDLJvzpN+TsYCZPNVj18+jf9uGRaoK6W++DdMAr5l gQiwsNgf9372dbMI7pt2gnT5/YdG+ZHnIIlXC6OUonA1Ro/Itg90Q7iQySnKKkqqnWVc+qO9 GJbzcGykxD6EQtCSlurt3/5IXTA7t6sAEQEAAcLBdgQYAQgAIBYhBA5HipsSX+lqH0rpWtNk IzqANlYGBQJbC43GAhsMAAoJENNkIzqANlYGD1sP/ikKgHgcspEKqDED9gQrTBvipH85si0j /Jwu/tBtnYjLgKLh2cjv1JkgYYjb3DyZa1pLsIv6rGnPX9bH9IN03nqirC/Q1Y1lnbNTynPk IflgvsJjoTNZjgu1wUdQlBgL/JhUp1sIYID11jZphgzfDgp/E6ve/8xE2HMAnf4zAfJaKgD0 F+fL1DlcdYUditAiYEuN40Ns/abKs8I1MYx7Yglu3RzJfBzV4t86DAR+OvuF9v188WrFwXCS RSf4DmJ8tntyNej+DVGUnmKHupLQJO7uqCKB/1HLlMKc5G3GLoGqJliHjUHUAXNzinlpE2Vj C78pxpwxRNg2ilE3AhPoAXrY5qED5PLE9sLnmQ9AzRcMMJUXjTNEDxEYbF55SdGBHHOAcZtA kEQKub86e+GHA+Z8oXQSGeSGOkqHi7zfgW1UexddTvaRwE6AyZ6FxTApm8wq8NT2cryWPWTF BDSGB3ujWHMM8ERRYJPcBSjTvt0GcEqnd+OSGgxTkGOdufn51oz82zfpVo1t+J/FNz6MRMcg 8nEC+uKvgzH1nujxJ5pRCBOquFZaGn/p71Yr0oVitkttLKblFsqwa+10Lt6HBxm+2+VLp4Ja 0WZNncZciz3V3cuArpan/ZhhyiWYV5FD0pOXPCJIx7WS9PTtxiv0AOS4ScWEUmBxyhFeOpYa DrEx In-Reply-To: <20261107223019.21361-1-lucasbarros.kam@gmail.com> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1794438921834 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.259 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) RCVD_IN_DNSWL_MED -2.3 Sender listed at https://www.dnswl.org/, medium trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: 2NUNWF3DL5P4ZHU7PVWPDLCJKX3PH5YR X-Message-ID-Hash: 2NUNWF3DL5P4ZHU7PVWPDLCJKX3PH5YR X-MailFrom: t.lamprecht@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Am 07.11.26 um 23:30 schrieb Lucas Barros: > The 'search' line of /etc/resolv.conf can list multiple domains, but > the parser only kept the first one. Writing the DNS settings of a node > with multiple search domains worked, but reading them back, for example > in the node's DNS panel in the web UI, only showed the first domain, so > saving the dialog again silently dropped the others. > > Keep the whole list, with the domains separated by a single space. This > is the format the DNS API already accepts when writing, and the in-tree > users of the value that fall back to the host's search domains for > guests, cloud-init in qemu-server and the container setup code in > pve-container, already split it on whitespace. Thanks for your patch, this can be fine, but needs some special care to ensure we do not have any use site where this causes problems, see inline below. > > Add a small test for the parser. > > Signed-off-by: Lucas Barros > --- > > The users of the parsed value that I found are the DNS API of the node > in pve-manager, get_dns_conf() in qemu-server's cloud-init code and > get_dns_settings() / update_etc_hosts() in pve-container's setup code. > The last two already treat it as a whitespace separated list. Note that > this means guests without their own 'searchdomain' now get all search > domains of the host instead of only the first one, both in their > resolv.conf and, for containers, as additional names in /etc/hosts. > That is what the host itself uses, so I think it is the expected > behavior, but please tell me if you prefer to keep that path as is. > > Ran the new test/resolv_conf_test.pl, which fails on the parser before > this change (3 of 7) and passes with it. I ran it on perl 5.34 with > stubs for the Linux-only modules (Linux::Inotify2, syscall.ph), not on > a Debian system, and did not run the rest of 'make check'. proxmox- > perltidy was not available, the code was formatted by hand. > > This patch was prepared with the help of an LLM based coding assistant; I > reviewed the change and ran the tests mentioned above myself. > > src/PVE/INotify.pm | 4 +-- > test/Makefile | 1 + > test/resolv_conf_test.pl | 65 ++++++++++++++++++++++++++++++++++++++++ > 3 files changed, 68 insertions(+), 2 deletions(-) > create mode 100755 test/resolv_conf_test.pl > > diff --git a/src/PVE/INotify.pm b/src/PVE/INotify.pm > index 53b4e21..4a0355e 100644 > --- a/src/PVE/INotify.pm > +++ b/src/PVE/INotify.pm > @@ -609,8 +609,8 @@ sub read_etc_resolv_conf { > my $nscount = 0; > while (my $line = <$fh>) { > chomp $line; > - if ($line =~ m/^(search|domain)\s+(\S+)\s*/) { > - $res->{search} = $2; > + if ($line =~ m/^(search|domain)\s+(\S.*)$/) { > + $res->{search} = join(' ', split(/\s+/, $2)); The node certificate generator in src/PVE/Cluster/Setup.pm builds the certificate FQDN by appending the whole search value to the node name, for both the subject CN and a DNS subject alternative name. With a multi-domain search list this now yields a CN and SAN like `node.a.example b.example` - so that needs to cope with this. Maybe there are other sites, checking the behavior in the rust side (PBS, PDM) might be good to, even just to ensure consistency. > } elsif ($line =~ m/^\s*nameserver\s+($PVE::Tools::IPRE)\s*/) { > $nscount++; > if ($nscount <= 3) { > diff --git a/test/Makefile b/test/Makefile > index 9caba10..416bc0c 100644 > --- a/test/Makefile > +++ b/test/Makefile > @@ -19,6 +19,7 @@ TESTS = lock_file.test \ > ticket_test.test \ > check_pem_test.test \ > split_pem_test.test \ > + resolv_conf_test.test \ > > all: >