atenet/egress: resolve upstream names on both address families - #1060
Open
Yuan Gao (ygao-g) wants to merge 1 commit into
Open
atenet/egress: resolve upstream names on both address families#1060Yuan Gao (ygao-g) wants to merge 1 commit into
Yuan Gao (ygao-g) wants to merge 1 commit into
Conversation
Yuan Gao (ygao-g)
marked this pull request as draft
August 19, 2026 16:12
Yuan Gao (ygao-g)
force-pushed
the
atenet-egress-dns-lookup-family
branch
from
August 19, 2026 22:34
1898a7f to
de81578
Compare
Yuan Gao (ygao-g)
force-pushed
the
atenet-egress-dns-lookup-family
branch
3 times, most recently
from
August 20, 2026 15:16
e1c077a to
0772d77
Compare
Yuan Gao (ygao-g)
marked this pull request as ready for review
August 20, 2026 16:07
Yuan Gao (ygao-g)
force-pushed
the
atenet-egress-dns-lookup-family
branch
2 times, most recently
from
August 20, 2026 19:25
5ea5c07 to
3a9ea53
Compare
The egress gateway's dynamic forward proxy pinned dns_lookup_family to V4_ONLY at all six sites, so on an IPv6-only cluster it asked only for A records and no upstream name resolved. All six now use ALL, which returns both families and lets Envoy Happy-Eyeballs between them. AUTO will not do: it returns AAAA whenever the name has one, leaving no A address to retry when that AAAA is unroutable. A test walks the shipped manifests and requires ALL on every dns_cache_config, so a new egress variant cannot reintroduce the pin.
Yuan Gao (ygao-g)
force-pushed
the
atenet-egress-dns-lookup-family
branch
from
August 20, 2026 19:34
3a9ea53 to
778b9d7
Compare
| // matching, not that the config got better. | ||
| const minDNSCacheConfigs = 6 | ||
|
|
||
| // TestEgressDNSLookupFamily requires ALL on every dynamic forward proxy DNS |
Collaborator
Author
There was a problem hiding this comment.
We need to focus on the guide to verify the indices instead of why we want this inside the paper. That comment should actually be where we set it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of #246
The egress Envoy pinned
dns_lookup_familytoV4_ONLYin both the dynamicforward proxy filter and the dynamic forward proxy cluster, so it only ever
asked for A records. On an IPv6-only cluster no upstream hostname resolves and
no actor can reach the internet. Six sites across the two egress manifests,
including the sdsmint variant, now use
ALL: it returns both families andenables Happy Eyeballs.
AUTOwill not do — it returns AAAA whenever the namehas one, leaving no A address to retry when that AAAA is unroutable.
This is a prerequisite for IPv6 egress, not the fix on its own. An actor's
connection is redirected by nftables and atunnel recovers the original
destination with
getsockopt(SOL_IP, SO_ORIGINAL_DST), which returns ENOENTfor a v6-redirected connection — so egress fails before Envoy is ever asked to
resolve anything.
Testing
make verifyis clean. A new test walks the shipped manifests and requiresALLon everydns_cache_config, so a new egress variant cannot reintroducethe pin. The egress e2e suites have not been re-run against this value on an
IPv6-only cluster.
🤖 Generated with Claude Code