[resty.resolver] support ipv6 resolvers #511

mikz · 2017-11-29T11:06:04Z

Fixes #510

@nmasse-itix do you mind trying it out?

TODO

write unit tests
try with ipv6 tunnel

nmasse-itix · 2017-11-29T16:40:14Z

I had a look and it seems to work on my machine ! 👍

Just one side note: this time there is no port at the end of the IPv6 address in my resolv.conf. I don't know why there is such difference with my tests this morning...

If I do the test with the ':53' at the end it does not seems correct.

2017/11/29 17:32:12 [info] 97696#2766655: [lua] resolver.lua:132: init_nameservers(): adding [fe80::ba26:6cff:fef6:e526:53]:53 as default nameserver

Otherwise, without the port at the end of the IPv6 address, it works.
I suggest we leave it as is. I will investigate on the ':53' at the end of the IPv6 addresses... :(

$ git pull upstream resolver-ipv6
remote: Counting objects: 47, done.
remote: Compressing objects: 100% (8/8), done.
remote: Total 47 (delta 20), reused 26 (delta 20), pack-reused 19
Unpacking objects: 100% (47/47), done.
From https://github.com/3scale/apicast
 * branch            resolver-ipv6 -> FETCH_HEAD
 * [new branch]      resolver-ipv6 -> upstream/resolver-ipv6
Updating 0613e63..438c327
Fast-forward
 CHANGELOG.md                            |  1 +
 examples/policy_chain/README.md         | 13 +++++++++++++
 examples/policy_chain/configuration.lua | 13 +++++++++++++
 gateway/http.d/init.conf                |  7 +++++++
 gateway/src/apicast/cli/environment.lua |  4 ++++
 gateway/src/apicast/policy/echo.lua     | 35 +++++++++++++++++++++++++++++++----
 gateway/src/resty/resolver.lua          | 30 ++++++++++++++++++++++++++----
 t/resolver.t                            | 34 +++++++++++++++++++++++++++++-----
 8 files changed, 124 insertions(+), 13 deletions(-)
 create mode 100644 examples/policy_chain/README.md
 create mode 100644 examples/policy_chain/configuration.lua


$ cat /etc/resolv.conf 
#
# macOS Notice
#
# This file is not consulted for DNS hostname resolution, address
# resolution, or the DNS query routing mechanism used by most
# processes on this system.
#
# To view the DNS configuration used by this system, use:
#   scutil --dns
#
# SEE ALSO
#   dns-sd(1), scutil(8)
#
# This file is automatically generated.
#
search home
nameserver fe80::ba26:6cff:fef6:e526
nameserver 192.168.1.1

$ ./bin/apicast --dev -vvvv
loading production environment configuration: /Users/nmasse/git/3scale-apicast/gateway/config/production.lua
loading development environment configuration: /Users/nmasse/git/3scale-apicast/gateway/config/development.lua
nginx: [alert] lua_code_cache is off; this will hurt performance in /tmp/lua_CHnQGI:35
2017/11/29 17:29:43 [debug] 96615#2758434: [lua] resolver.lua:90: parse_nameservers(): /etc/resolv.conf:
#
# macOS Notice
#
# This file is not consulted for DNS hostname resolution, address
# resolution, or the DNS query routing mechanism used by most
# processes on this system.
#
# To view the DNS configuration used by this system, use:
#   scutil --dns
#
# SEE ALSO
#   dns-sd(1), scutil(8)
#
# This file is automatically generated.
#
search home
nameserver fe80::ba26:6cff:fef6:e526
nameserver 192.168.1.1

2017/11/29 17:29:43 [debug] 96615#2758434: [lua] resolver.lua:97: parse_nameservers(): search home
2017/11/29 17:29:43 [debug] 96615#2758434: [lua] resolver.lua:99: parse_nameservers(): search domain: home
2017/11/29 17:29:43 [info] 96615#2758434: [lua] resolver.lua:132: init_nameservers(): adding [fe80::ba26:6cff:fef6:e526]:53 as default nameserver
2017/11/29 17:29:43 [info] 96615#2758434: [lua] resolver.lua:132: init_nameservers(): adding 192.168.1.1:53 as default nameserver
2017/11/29 17:29:43 [info] 96615#2758434: [lua] resolver.lua:137: init_nameservers(): adding home as search domain
2017/11/29 17:29:43 [debug] 96615#2758434: [lua] env.lua:86: fetch(): env: SSL_CERT_FILE = nil
2017/11/29 17:29:43 [debug] 96615#2758434: [lua] policy_chain.lua:75: load(): loading policy module: apicast.policy.apicast
2017/11/29 17:29:43 [debug] 96615#2758434: [lua] policy_chain.lua:75: load(): loading policy module: apicast.policy.load_configuration
2017/11/29 17:29:43 [debug] 96615#2758434: [lua] env.lua:86: fetch(): env: APICAST_PATH_ROUTING_ENABLED = nil
2017/11/29 17:29:43 [debug] 96615#2758434: [lua] env.lua:86: fetch(): env: BACKEND_ENDPOINT_OVERRIDE = nil
2017/11/29 17:29:43 [debug] 96615#2758434: [lua] env.lua:86: fetch(): env: PWD = /Users/nmasse/git/3scale-apicast
2017/11/29 17:29:43 [debug] 96615#2758434: [lua] env.lua:86: fetch(): env: APICAST_CONFIGURATION_LOADER = lazy
2017/11/29 17:29:43 [info] 96615#2758434: [lua] configuration_loader.lua:222: new(): using lazy configuration loader
2017/11/29 17:29:43 [debug] 96615#2758434: [lua] policy_chain.lua:75: load(): loading policy module: apicast.policy.find_service
2017/11/29 17:29:43 [debug] 96615#2758434: [lua] policy_chain.lua:75: load(): loading policy module: apicast.policy.local_chain
2017/11/29 17:29:43 [debug] 96615#2758434: [lua] env.lua:86: fetch(): env: APICAST_CUSTOM_CONFIG = nil
2017/11/29 17:29:43 [debug] 96615#2758434: [lua] env.lua:86: fetch(): env: APICAST_REPORTING_THREADS = nil
2017/11/29 17:29:43 [debug] 96615#2758434: [lua] env.lua:86: fetch(): env: APICAST_RESPONSE_CODES = nil
2017/11/29 17:29:43 [debug] 96615#2758434: [lua] env.lua:86: fetch(): env: APICAST_MODULE = nil
2017/11/29 17:29:43 [debug] 96615#2758434: [lua] policy_chain.lua:75: load(): loading policy module: apicast.policy.apicast
2017/11/29 17:29:43 [debug] 96615#2758434: [lua] resolver.lua:90: parse_nameservers(): /etc/resolv.conf:
#
# macOS Notice
#
# This file is not consulted for DNS hostname resolution, address
# resolution, or the DNS query routing mechanism used by most
# processes on this system.
#
# To view the DNS configuration used by this system, use:
#   scutil --dns
#
# SEE ALSO
#   dns-sd(1), scutil(8)
#
# This file is automatically generated.
#
search home
nameserver fe80::ba26:6cff:fef6:e526
nameserver 192.168.1.1

2017/11/29 17:29:43 [debug] 96615#2758434: [lua] resolver.lua:97: parse_nameservers(): search home
2017/11/29 17:29:43 [debug] 96615#2758434: [lua] resolver.lua:99: parse_nameservers(): search domain: home
2017/11/29 17:29:43 [info] 96615#2758434: [lua] resolver.lua:132: init_nameservers(): adding [fe80::ba26:6cff:fef6:e526]:53 as default nameserver
2017/11/29 17:29:43 [info] 96615#2758434: [lua] resolver.lua:132: init_nameservers(): adding 192.168.1.1:53 as default nameserver
2017/11/29 17:29:43 [info] 96615#2758434: [lua] resolver.lua:137: init_nameservers(): adding home as search domain
2017/11/29 17:29:43 [debug] 96615#2758434: [lua] env.lua:86: fetch(): env: APICAST_LOADED_ENVIRONMENTS = /Users/nmasse/git/3scale-apicast/gateway/config/production.lua|/Users/nmasse/git/3scale-apicast/gateway/config/development.lua
2017/11/29 17:29:43 [debug] 96615#2758434: [lua] env.lua:86: fetch(): env: APICAST_DIR = nil
2017/11/29 17:29:43 [notice] 96615#2758434: [lua] environment.lua:124: add(): loading environment configuration: /Users/nmasse/git/3scale-apicast/gateway/config/production.lua
2017/11/29 17:29:43 [notice] 96615#2758434: [lua] environment.lua:124: add(): loading environment configuration: /Users/nmasse/git/3scale-apicast/gateway/config/development.lua
sh: sw_vers: command not found
2017/11/29 17:29:43 [debug] 96615#2758434: [lua] policy_chain.lua:75: load(): loading policy module: apicast.policy.load_configuration
2017/11/29 17:29:43 [debug] 96615#2758434: [lua] policy_chain.lua:75: load(): loading policy module: apicast.policy.find_service
2017/11/29 17:29:43 [debug] 96615#2758434: [lua] policy_chain.lua:75: load(): loading policy module: apicast.policy.local_chain
2017/11/29 17:29:43 [debug] 96615#2758434: [lua] env.lua:86: fetch(): env: THREESCALE_DEPLOYMENT_ENV = development
2017/11/29 17:29:43 [notice] 96615#2758434: using the "kqueue" event method
2017/11/29 17:29:43 [warn] 96615#2758434: 16192 worker_connections exceed open file resource limit: 256
2017/11/29 17:29:43 [notice] 96615#2758434: openresty/1.11.2.3
2017/11/29 17:29:43 [notice] 96615#2758434: built by clang 8.1.0 (clang-802.0.42)
2017/11/29 17:29:43 [notice] 96615#2758434: OS: Darwin 17.2.0
2017/11/29 17:29:43 [notice] 96615#2758434: hw.ncpu: 8
2017/11/29 17:29:43 [notice] 96615#2758434: net.inet.tcp.sendspace: 131072
2017/11/29 17:29:43 [notice] 96615#2758434: kern.ipc.somaxconn: 128
2017/11/29 17:29:43 [notice] 96615#2758434: getrlimit(RLIMIT_NOFILE): 256:9223372036854775807

mikz · 2017-11-29T16:43:25Z

@nmasse-itix I think the :53 was coming from APIcast itself and was not in the resolv.conf.
There is no way to determine if the trailing :53 is a port or part of the IPv6 address. Thats why they need to have [] around if they appear with a port like [dead::beef]:53 because dead::beef:53 is also a valid IPv6 address.

mikz · 2017-11-29T16:47:45Z

@nmasse-itix thanks for the thorough investigation! And sorry it broke. Unfortunately IPv6 is not as widespread as it should be.

Hopefully we can merge this soon.

davidor · 2017-11-29T17:10:50Z

t/resolver.t

+
+=== TEST 3: can have ipv6 RESOLVER
+RESOLVER env variable can be IPv6 address
+--- ONLY


Hah! I'm going to fix the CI to catch this.

Fixed. And verified it was failing.

davidor · 2017-11-30T09:47:08Z

gateway/src/resty/resolver.lua

-    -- see https://github.com/3scale/apicast/issues/321 for more details
+    local m
+
+    m, err = re_match(resolver, '^(.+?)(?<!:)(?:\\:(\\d+))?$', 'oj')


If we extract the regex to a constant, readers will be able to know what we need to match here without understanding the regex.

It matches anything optionally followed by just one : and a series of numbers.
I'm not even sure how to call it :)

It needs to match 1.2.3.4:53 and [dead::beef]:53 but not dead::beef::53.

Actually I see there is a bug as it matches the 3rd example as a port. http://rubular.com/r/j6rm3ObFIM

Updated to extended regex with comments 9226b0b

just print the most critical errors so we don't see ngx.log statements when running busted

* the second test does not need it * and init_worker can get variables set by the env directive

davidor

Looks good @mikz 👍

Thanks for your help @nmasse-itix !

octobot assigned mikz Nov 29, 2017

mikz force-pushed the resolver-ipv6 branch 2 times, most recently from ce246d5 to 438c327 Compare November 29, 2017 16:11

mikz mentioned this pull request Nov 29, 2017

Apicast fail to start when the resolv.conf contains an IPv6 DNS server #510

Closed

mikz requested a review from davidor November 29, 2017 16:12

mikz force-pushed the resolver-ipv6 branch from 438c327 to 26520e8 Compare November 29, 2017 16:45

davidor reviewed Nov 29, 2017

View reviewed changes

mikz force-pushed the resolver-ipv6 branch 2 times, most recently from 4344391 to c367185 Compare November 29, 2017 18:13

mikz requested a review from davidor November 29, 2017 18:19

davidor reviewed Nov 30, 2017

View reviewed changes

mikz force-pushed the resolver-ipv6 branch 2 times, most recently from 9226b0b to 1df4cf4 Compare November 30, 2017 12:42

mikz added 4 commits November 30, 2017 13:44

[busted] don't print error logs in tests

7560435

just print the most critical errors so we don't see ngx.log statements when running busted

[resty.resolver] properly serialize ipv6 nameserver

70720c2

[t] use RESOLVER just when necessary

95b0c85

* the second test does not need it * and init_worker can get variables set by the env directive

[resty.resolver] properly parse ipv6 RESOLVER env

f4fa5b3

mikz force-pushed the resolver-ipv6 branch from 1df4cf4 to f4fa5b3 Compare November 30, 2017 12:44

davidor approved these changes Nov 30, 2017

View reviewed changes

davidor merged commit 1657f15 into master Nov 30, 2017

davidor deleted the resolver-ipv6 branch November 30, 2017 13:13

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[resty.resolver] support ipv6 resolvers #511

[resty.resolver] support ipv6 resolvers #511

mikz commented Nov 29, 2017 •

edited

Loading

nmasse-itix commented Nov 29, 2017

mikz commented Nov 29, 2017

mikz commented Nov 29, 2017

davidor Nov 29, 2017

mikz Nov 29, 2017

mikz Nov 29, 2017

davidor Nov 30, 2017 •

edited

Loading

mikz Nov 30, 2017

mikz Nov 30, 2017

davidor left a comment

[resty.resolver] support ipv6 resolvers #511

[resty.resolver] support ipv6 resolvers #511

Conversation

mikz commented Nov 29, 2017 • edited Loading

TODO

nmasse-itix commented Nov 29, 2017

mikz commented Nov 29, 2017

mikz commented Nov 29, 2017

davidor Nov 29, 2017

Choose a reason for hiding this comment

mikz Nov 29, 2017

Choose a reason for hiding this comment

mikz Nov 29, 2017

Choose a reason for hiding this comment

davidor Nov 30, 2017 • edited Loading

Choose a reason for hiding this comment

mikz Nov 30, 2017

Choose a reason for hiding this comment

mikz Nov 30, 2017

Choose a reason for hiding this comment

davidor left a comment

Choose a reason for hiding this comment

mikz commented Nov 29, 2017 •

edited

Loading

davidor Nov 30, 2017 •

edited

Loading