10:48 a.m.
Hello,
I am seeing a slightly annoying behavior of libvirt-created networks on
my system. Whenever a VM fails to renew its DHCP lease in time (for
example because my laptop is suspended), the IP address changes,
causing various annoyances. If this happens, the log message
"DHCPNAK(virbrX): ... lease not found" appears in the libvirtd logs.
Looking at the dnsmasq code, it seems that this would be fixed by
running dnsmasq with the "dhcp-authoritative" option, which, according
to the dnsmasq man page, "should be set when dnsmasq is definitely the
only DHCP server on a network" - IMO that's the case for libvirtd-
managed virtual networks. So the question comes to my mind: is there a
good reason why libvirtd doesn't set "dhcp-authoritative" on the
dnsmasq instances it starts?
Regards
Martin
--
Dr. Martin Wilck <mwilck(a)suse.com>, Tel. +49 (0)911 74053 2107
SUSELinux GmbH, GF: Felix Imendörffer, Jane Smithard, Graham Norton
HRB 21284 (AG Nürnberg)
4:25 p.m.
On 09/19/2016 09:48 AM, Martin Wilck wrote:
Hello,
I am seeing a slightly annoying behavior of libvirt-created networks on
my system. Whenever a VM fails to renew its DHCP lease in time (for
example because my laptop is suspended), the IP address changes,
causing various annoyances. If this happens, the log message
"DHCPNAK(virbrX): ... lease not found" appears in the libvirtd logs.
Looking at the dnsmasq code, it seems that this would be fixed by
running dnsmasq with the "dhcp-authoritative" option, which, according
to the dnsmasq man page, "should be set when dnsmasq is definitely the
only DHCP server on a network" - IMO that's the case for libvirtd-
managed virtual networks. So the question comes to my mind: is there a
good reason why libvirtd doesn't set "dhcp-authoritative" on the
dnsmasq instances it starts?
I've searched the list archives and didn't see any mention of the
'--dhcp-authoritative' option, so the reason may be that no one has made such an
inquiry :-). If it has been discussed and I missed it, Laine most likely knows
something about it.
A small bit of detective work shows that OpenStack neutron adopted use of this
option a while back
https://review.openstack.org/#/c/152080/
In a related discussion, Simon agrees with using '--dhcp-authoritative' when
dnsmasq is the only dhcp server on the network
http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2015q1/009171.html
I also stumbled across a complaint about using '--dhcp-authoritative' on a
network with multiple dhcp servers, but I can't find that now. I'm not sure if
there are use-cases for multiple dhcp servers on a single libvirt virtual network.
Regards,
Jim
4:45 p.m.
On 09/19/2016 05:25 PM, Jim Fehlig wrote:
On 09/19/2016 09:48 AM, Martin Wilck wrote:
> Hello,
>
> I am seeing a slightly annoying behavior of libvirt-created networks on
> my system. Whenever a VM fails to renew its DHCP lease in time (for
> example because my laptop is suspended), the IP address changes,
> causing various annoyances. If this happens, the log message
> "DHCPNAK(virbrX): ... lease not found" appears in the libvirtd logs.
>
> Looking at the dnsmasq code, it seems that this would be fixed by
> running dnsmasq with the "dhcp-authoritative" option, which, according
> to the dnsmasq man page, "should be set when dnsmasq is definitely the
> only DHCP server on a network" - IMO that's the case for libvirtd-
> managed virtual networks. So the question comes to my mind: is there a
> good reason why libvirtd doesn't set "dhcp-authoritative" on the
> dnsmasq instances it starts?
I've searched the list archives and didn't see any mention of the
'--dhcp-authoritative' option, so the reason may be that no one has made such an
inquiry :-). If it has been discussed and I missed it, Laine most likely knows
something about it.
Nope, this is the first I've heard of it.
A small bit of detective work shows that OpenStack neutron adopted use of this
option a while back
https://review.openstack.org/#/c/152080/
...but for a completely different reason - they were encountering
problems when they restarted their dnsmasq, because they didn't keep a
leasefile.
After reading Simon's mail, and the openstack patch and description, it
isn't clear that this will actually solve your problem. Have you tried
it? (to test it, you should be able to just kill dnsmasq, add the option
to the dnsmasq conf file referenced in its commandline, then restart it
with the same commandline. libvirt will no longer know where the dnsmasq
process is (since you will have changed its pid), but otherwise it
should operate okay)
If that does solve your problem, we could consider a patch to add it. Do
you know the first version of dnsmasq that had this option? Hopefully
the answer is "very old" so we don't have to check for support.
In a related discussion, Simon agrees with using '--dhcp-authoritative' when
dnsmasq is the only dhcp server on the network
http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2015q1/009171.html
I also stumbled across a complaint about using '--dhcp-authoritative' on a
network with multiple dhcp servers, but I can't find that now. I'm not sure if
there are use-cases for multiple dhcp servers on a single libvirt virtual network.
Yeah, I don't think that should ever happen with libvirt's networks
(unless somebody comes up with a network that is bridged across several
hosts, and they want each host to have a DHCP server, or something like
that. *I'm certainly not going to do that though :-)
3:49 a.m.
New subject: [libvirt] [RFC/PATCH 0/2] dnsmasq option "dhcp-authoritative"
On Mon, 2016-09-19 at 17:45 -0400, Laine Stump wrote:
After reading Simon's mail, and the openstack patch and
description,
it isn't clear that this will actually solve your problem. Have you
tried it? (to test it, you should be able to just kill dnsmasq, add the
option to the dnsmasq conf file referenced in its commandline, then restart
it with the same commandline.
I just tried this successfully (I had to remove the options
'--leasefile-ro --dhcp-script=/usr/lib64/libvirt/libvirt_leaseshelper' from
the dnsmasq command line in order to make dnsmasq start).
In order to be certain, I patched and rebuilt libvirt on OpenSUSE factory
using the follow-up patch set. That test was also successful - IP addresses
don't change any more when a VM renews too late.
Please review the patch set. As you can see I added the option only for IPv4
networks. For IPv6, it has a different effect (just setting the priority of
dnsmasq's replies) which isn't necessary here AFAICS.
Do you know the first version of dnsmasq that had this option?
Hopefully the answer is "very old" so we don't have to check for support.
The option pre-dates the import into dnsmasq repository
git://thekelleys.org.uk/dnsmasq.git which occured with v2.48 in June 2009.
According to CHANGELOG.archive, the option was added in dnsmasq v2.16 in 2004.
Regards,
Martin
Martin Wilck (2):
network: add dnsmasq option 'dhcp-authoritative'
tests/networkxml2confdata: add dhcp-authoritative option
src/network/bridge_driver.c | 4 +++-
tests/networkxml2confdata/dhcp6-nat-network.conf | 1 +
tests/networkxml2confdata/dhcp6host-routed-network.conf | 1 +
tests/networkxml2confdata/isolated-network.conf | 1 +
tests/networkxml2confdata/nat-network-dns-srv-record-minimal.conf | 1 +
tests/networkxml2confdata/nat-network-dns-srv-record.conf | 1 +
tests/networkxml2confdata/nat-network-dns-txt-record.conf | 1 +
tests/networkxml2confdata/nat-network-name-with-quotes.conf | 1 +
tests/networkxml2confdata/nat-network.conf | 1 +
tests/networkxml2confdata/netboot-network.conf | 1 +
tests/networkxml2confdata/netboot-proxy-network.conf | 1 +
11 files changed, 13 insertions(+), 1 deletion(-)
--
2.9.3
3:49 a.m.
New subject: [libvirt] [RFC/PATCH 1/2] network: add dnsmasq option 'dhcp-authoritative'
The dnsmasq man page recommends that dhcp-authoritative "should be
set when dnsmasq is definitely the only DHCP server on a network".
This is the case for libvirt-managed virtual networks.
The effect of this is that VMs that fail to renew their DHCP lease
in time (e.g. if the VM or host is suspended) will be able to
re-acquire the lease even if it's expired, unless the IP address has
been taken by some other host. This avoids various annoyances caused
by changing VM IP addresses.
---
src/network/bridge_driver.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/src/network/bridge_driver.c b/src/network/bridge_driver.c
index 7b99aca..cb4fb1c 100644
--- a/src/network/bridge_driver.c
+++ b/src/network/bridge_driver.c
@@ -1258,8 +1258,10 @@ networkDnsmasqConfContents(virNetworkObjPtr network,
/* Note: the following is IPv4 only */
if (VIR_SOCKET_ADDR_IS_FAMILY(&ipdef->address, AF_INET)) {
- if (ipdef->nranges || ipdef->nhosts)
+ if (ipdef->nranges || ipdef->nhosts) {
virBufferAddLit(&configbuf, "dhcp-no-override\n");
+ virBufferAddLit(&configbuf, "dhcp-authoritative\n");
+ }
if (ipdef->tftproot) {
virBufferAddLit(&configbuf, "enable-tftp\n");
--
2.9.3
2:25 p.m.
New subject: [libvirt] [RFC/PATCH 1/2] network: add dnsmasq option 'dhcp-authoritative'
On 09/21/2016 04:49 AM, Martin Wilck wrote:
The dnsmasq man page recommends that dhcp-authoritative "should
be
set when dnsmasq is definitely the only DHCP server on a network".
This is the case for libvirt-managed virtual networks.
The effect of this is that VMs that fail to renew their DHCP lease
in time (e.g. if the VM or host is suspended) will be able to
re-acquire the lease even if it's expired, unless the IP address has
been taken by some other host. This avoids various annoyances caused
by changing VM IP addresses.
We had earlier (finally!) agreed in principle on pushing this patch, but
were in freeze at the time, and I later forgot to do it.
I checked to be sure that the dnsmasq on one of the oldest Linux distros
that we still support does have the dhcp-authoritative option. It does
(it's dnsmasq-2.48-something) so we don't need any extra code to verify
the option is there.
I do have a couple comments below, so don't hit the "next" button yet! :-)
---
src/network/bridge_driver.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/src/network/bridge_driver.c b/src/network/bridge_driver.c
index 7b99aca..cb4fb1c 100644
--- a/src/network/bridge_driver.c
+++ b/src/network/bridge_driver.c
@@ -1258,8 +1258,10 @@ networkDnsmasqConfContents(virNetworkObjPtr network,
/* Note: the following is IPv4 only */
if (VIR_SOCKET_ADDR_IS_FAMILY(&ipdef->address, AF_INET)) {
- if (ipdef->nranges || ipdef->nhosts)
+ if (ipdef->nranges || ipdef->nhosts) {
virBufferAddLit(&configbuf, "dhcp-no-override\n");
+ virBufferAddLit(&configbuf, "dhcp-authoritative\n");
+ }
You accidentally got a tab character in the line below, so I replaced it
with spaces so that make syntax-check passes.
if (ipdef->tftproot) {
virBufferAddLit(&configbuf, "enable-tftp\n");
Although your cover letter included diff statistics for the
networkxml2conftest test cases that needed the extra line for
dhcp-authoritative, those diffs weren't included in the patch itself.
Fortunately it's simple to regenerate the test case outputs
(VIR_TEST_REGENERATE_OUTPUT=1 tests/networkxml2conftest), so I
regenerated and verified them.
ACK, and pushed. Thanks for the submission, and sorry for the delay (and
the seemingly protracted debate about a single line - we've been burned
in the past by unforeseen consequences of adding a seemingly innocuous
dnsmasq option to our dnsmasq conf files, and I was nervous about that
happening again, so I wanted to make sure we explored all possibilities.)
3:49 a.m.
New subject: [libvirt] [RFC/PATCH 2/2] tests/networkxml2confdata: add dhcp-authoritative option
The previous patch changes the confdata output for dnsmasq. Adapt
the expected test results to match.
---
tests/networkxml2confdata/dhcp6-nat-network.conf | 1 +
tests/networkxml2confdata/dhcp6host-routed-network.conf | 1 +
tests/networkxml2confdata/isolated-network.conf | 1 +
tests/networkxml2confdata/nat-network-dns-srv-record-minimal.conf | 1 +
tests/networkxml2confdata/nat-network-dns-srv-record.conf | 1 +
tests/networkxml2confdata/nat-network-dns-txt-record.conf | 1 +
tests/networkxml2confdata/nat-network-name-with-quotes.conf | 1 +
tests/networkxml2confdata/nat-network.conf | 1 +
tests/networkxml2confdata/netboot-network.conf | 1 +
tests/networkxml2confdata/netboot-proxy-network.conf | 1 +
10 files changed, 10 insertions(+)
diff --git a/tests/networkxml2confdata/dhcp6-nat-network.conf
b/tests/networkxml2confdata/dhcp6-nat-network.conf
index 17076b8..d1058df 100644
--- a/tests/networkxml2confdata/dhcp6-nat-network.conf
+++ b/tests/networkxml2confdata/dhcp6-nat-network.conf
@@ -10,6 +10,7 @@ bind-dynamic
interface=virbr0
dhcp-range=192.168.122.2,192.168.122.254
dhcp-no-override
+dhcp-authoritative
dhcp-range=2001:db8:ac10:fd01::1:10,2001:db8:ac10:fd01::1:ff,64
dhcp-lease-max=493
dhcp-hostsfile=/var/lib/libvirt/dnsmasq/default.hostsfile
diff --git a/tests/networkxml2confdata/dhcp6host-routed-network.conf
b/tests/networkxml2confdata/dhcp6host-routed-network.conf
index 5728ee4..87a1498 100644
--- a/tests/networkxml2confdata/dhcp6host-routed-network.conf
+++ b/tests/networkxml2confdata/dhcp6host-routed-network.conf
@@ -10,6 +10,7 @@ bind-dynamic
interface=virbr1
dhcp-range=192.168.122.1,static
dhcp-no-override
+dhcp-authoritative
dhcp-range=2001:db8:ac10:fd01::1,static,64
dhcp-hostsfile=/var/lib/libvirt/dnsmasq/local.hostsfile
addn-hosts=/var/lib/libvirt/dnsmasq/local.addnhosts
diff --git a/tests/networkxml2confdata/isolated-network.conf
b/tests/networkxml2confdata/isolated-network.conf
index fbdf75a..ce4a59f 100644
--- a/tests/networkxml2confdata/isolated-network.conf
+++ b/tests/networkxml2confdata/isolated-network.conf
@@ -12,6 +12,7 @@ dhcp-option=3
no-resolv
dhcp-range=192.168.152.2,192.168.152.254
dhcp-no-override
+dhcp-authoritative
dhcp-lease-max=253
dhcp-hostsfile=/var/lib/libvirt/dnsmasq/private.hostsfile
addn-hosts=/var/lib/libvirt/dnsmasq/private.addnhosts
diff --git a/tests/networkxml2confdata/nat-network-dns-srv-record-minimal.conf
b/tests/networkxml2confdata/nat-network-dns-srv-record-minimal.conf
index 08ed672..f35ea1d 100644
--- a/tests/networkxml2confdata/nat-network-dns-srv-record-minimal.conf
+++ b/tests/networkxml2confdata/nat-network-dns-srv-record-minimal.conf
@@ -15,6 +15,7 @@ listen-address=10.24.10.1
srv-host=_name._tcp
dhcp-range=192.168.122.2,192.168.122.254
dhcp-no-override
+dhcp-authoritative
dhcp-lease-max=253
dhcp-hostsfile=/var/lib/libvirt/dnsmasq/default.hostsfile
addn-hosts=/var/lib/libvirt/dnsmasq/default.addnhosts
diff --git a/tests/networkxml2confdata/nat-network-dns-srv-record.conf
b/tests/networkxml2confdata/nat-network-dns-srv-record.conf
index d7de422..af1ed70 100644
--- a/tests/networkxml2confdata/nat-network-dns-srv-record.conf
+++ b/tests/networkxml2confdata/nat-network-dns-srv-record.conf
@@ -17,6 +17,7 @@ srv-host=_name6._tcp.test6.com,test6.example.com,6666,0,666
srv-host=_name7._tcp.test7.com,test7.example.com,1,0,777
dhcp-range=192.168.122.2,192.168.122.254
dhcp-no-override
+dhcp-authoritative
dhcp-lease-max=253
dhcp-hostsfile=/var/lib/libvirt/dnsmasq/default.hostsfile
addn-hosts=/var/lib/libvirt/dnsmasq/default.addnhosts
diff --git a/tests/networkxml2confdata/nat-network-dns-txt-record.conf
b/tests/networkxml2confdata/nat-network-dns-txt-record.conf
index 44ed6bd..7f560fb 100644
--- a/tests/networkxml2confdata/nat-network-dns-txt-record.conf
+++ b/tests/networkxml2confdata/nat-network-dns-txt-record.conf
@@ -11,6 +11,7 @@ interface=virbr0
txt-record=example,example value
dhcp-range=192.168.122.2,192.168.122.254
dhcp-no-override
+dhcp-authoritative
dhcp-lease-max=253
dhcp-hostsfile=/var/lib/libvirt/dnsmasq/default.hostsfile
addn-hosts=/var/lib/libvirt/dnsmasq/default.addnhosts
diff --git a/tests/networkxml2confdata/nat-network-name-with-quotes.conf
b/tests/networkxml2confdata/nat-network-name-with-quotes.conf
index a1c839e..36e11d1 100644
--- a/tests/networkxml2confdata/nat-network-name-with-quotes.conf
+++ b/tests/networkxml2confdata/nat-network-name-with-quotes.conf
@@ -15,6 +15,7 @@ listen-address=10.24.10.1
srv-host=_name._tcp
dhcp-range=192.168.122.2,192.168.122.254
dhcp-no-override
+dhcp-authoritative
dhcp-lease-max=253
dhcp-hostsfile=/var/lib/libvirt/dnsmasq/default"with"quotes".hostsfile
addn-hosts=/var/lib/libvirt/dnsmasq/default"with"quotes".addnhosts
diff --git a/tests/networkxml2confdata/nat-network.conf
b/tests/networkxml2confdata/nat-network.conf
index 34d5b17..a3c8b10 100644
--- a/tests/networkxml2confdata/nat-network.conf
+++ b/tests/networkxml2confdata/nat-network.conf
@@ -10,6 +10,7 @@ bind-dynamic
interface=virbr0
dhcp-range=192.168.122.2,192.168.122.254
dhcp-no-override
+dhcp-authoritative
dhcp-lease-max=253
dhcp-hostsfile=/var/lib/libvirt/dnsmasq/default.hostsfile
addn-hosts=/var/lib/libvirt/dnsmasq/default.addnhosts
diff --git a/tests/networkxml2confdata/netboot-network.conf
b/tests/networkxml2confdata/netboot-network.conf
index 4b8f0cc..b554a54 100644
--- a/tests/networkxml2confdata/netboot-network.conf
+++ b/tests/networkxml2confdata/netboot-network.conf
@@ -12,6 +12,7 @@ bind-interfaces
listen-address=192.168.122.1
dhcp-range=192.168.122.2,192.168.122.254
dhcp-no-override
+dhcp-authoritative
enable-tftp
tftp-root=/var/lib/tftproot
dhcp-boot=pxeboot.img
diff --git a/tests/networkxml2confdata/netboot-proxy-network.conf
b/tests/networkxml2confdata/netboot-proxy-network.conf
index 61a025c..afb4033 100644
--- a/tests/networkxml2confdata/netboot-proxy-network.conf
+++ b/tests/networkxml2confdata/netboot-proxy-network.conf
@@ -12,6 +12,7 @@ bind-interfaces
listen-address=192.168.122.1
dhcp-range=192.168.122.2,192.168.122.254
dhcp-no-override
+dhcp-authoritative
dhcp-boot=pxeboot.img,,10.20.30.40
dhcp-lease-max=253
dhcp-hostsfile=/var/lib/libvirt/dnsmasq/netboot.hostsfile
--
2.9.3
2995
days inactive
3016
days old
6 comments
4 participants
participants (4)
-
Jim Fehlig -
Laine Stump -
Martin Wilck -
Martin Wilck