ctrld not working under CachyOS

[xopez]

Hey,

on my gaming computer I am using CachyOS (https://cachyos.org/) which is Arch based. The network doesn't seem to get correctly changed. It uses still my router as DNS Server and not ctrld.

> sudo ctrld restart -vv
Nov 29 15:11:15.000 INF loading config file from: /etc/controld/ctrld.toml
Nov 29 15:11:16.066 DBG Running task Stop
Nov 29 15:11:19.140 DBG Running task Cleanup
Nov 29 15:11:19.140 DBG NetworkManager is not available
Nov 29 15:11:19.140 DBG No saved static DNS config for interface "enp10s0"; resetting to DHCP iface=enp10s0
Nov 29 15:11:19.144 DBG checking for IPv6 availability
Nov 29 15:11:22.154 DBG could not exchange DHCPv6 error="read udp6 [fe80::f82c:a533:c924:fe1b%enp10s0]:546: i/o timeout"
Nov 29 15:11:22.155 DBG dns: [resolved-ping=yes rc=nm resolved=nss nm-resolved=yes nm-safe=no resolv-conf-mode=foreign ret=systemd-resolved]
Nov 29 15:11:22.155 DBG dns: using "systemd-resolved" mode
Nov 29 15:11:22.156 DBG dns: [v1] dbus connected
Nov 29 15:11:22.168 DBG Running task Waiting for service to stop
Nov 29 15:11:23.169 DBG Running task Start
Nov 29 15:11:26.502 DBG dns: systemd-resolved restarted, syncing DNS config
Nov 29 15:11:26.503 NTC Service restarted
 

[xopez]

It seems like it is leaking DNS since I am seeing this requests on my router config and my local system.
toml I am using:

[service]
  cache_enable = true
  client_id_preference = 'mac'

[listener]
  [listener.0]
    ip = '127.0.0.1'
    port = 53

    [listener.0.policy]
      networks = [
        { 'network.0' = [
            'upstream.0'
        ] }
      ]

[network]
  [network.0]
    cidrs = ['0.0.0.0/0', '::/0']

[upstream]
  [upstream.0]
    type = 'doh'
    endpoint = 'https://dns.controld.com/RESOLVERID'
    timeout = 2500
    send_client_info = false

[yegors]

Please provide the output of the initial start/install command (one in web panel to perform the initial install), with a default non-custom config.

[xopez]

I have completly uninstalled to get a fresh start.
I have generated a new Linux profile, excecuted install. It seems to be the same behaviour.

sudo sh -c 'sh -c "$(curl -sSL https://147.185.34.1/dl)" -s RESOLVERID forced'

        __         .__       .___
  _____/  |________|  |    __| _/
_/ ___\   __\_  __ \  |   / __ |
\  \___|  |  |  | \/  |__/ /_/ |
 \___  >__|  |__|  |____/\____ |
     \/       installer       \/

---------------------
|    System Info    |
---------------------
OS Type      : linux
OS Vendor    : cachyos
Arch         : x86_64
CPU          : AMD Ryzen 7 9800X3D 8-Core Processor
Free RAM     : 26796 MB / 31161 MB
---------------------
|  Install Details  |
---------------------
Resolver ID  : RESOLVERID
Binary URL   : https://dl.controld.com/linux-amd64/ctrld
Install Path : /usr/local/bin
---------------------
 - Detected running process, this is an upgrade
 - Starting download
 - Stopping running process
 - Replacing old binary with the new one
 - Making binary executable
 - Launching /usr/local/bin/ctrld
---------------------
Nov 29 21:08:10.289 NTC Starting service
Nov 29 21:08:10.723 NTC Generating controld config: /etc/controld/ctrld.toml
Nov 29 21:08:12.174 NTC Service started

sudo cat /etc/controld/ctrld.toml
# AUTO-GENERATED VIA CD FLAG - DO NOT MODIFY

[listener]
  [listener.0]
    ip = '127.0.0.1'
    port = 53

    [listener.0.policy]
      name = 'My Policy'
      rules = [
        {        'captive.apple.com' = []},
        {        'aircanadawifi.com' = []},
        {        'acwifi.com' = []},
        {        'gogoinflight.com' = []},
        {        'southwestwifi.com' = []},
        {        'singaporeair-krisworld.com' = []},
        {        'airborne.gogoinflight.com' = []},
        {        'aainflight.com' = []},
        {        'aa.viasat.com' = []},
        {        'deltawifi.com' = []},
        {        'wifi.delta.com' = []},
        {        'unitedwifi.com' = []},
        {        'shop.ba.com' = []},
        {        'alaskawifi.com' = []},
        {        'flyfi.com' = []},
        {        'wifi.airasia.com' = []},
        {        'wifi.sncf' = []},
        {        'wifi.tgv-lyria.com' = []},
        {        'freewlan.sbb.ch' = []},
        {        'register.onboard.eurostar.com' = []},
        {        'thalysnet.com' = []},
        {        'iceportal.de' = []},
        {        'vvm.mstore.msg.t-mobile.com' = []},
        {        'wifi.inflightinternet.com' = []},
        {        'captive.inflightinternet.com' = []},
        {        'airbornesecure.inflightinternet.com' = []},
        {        'ip.videotron.ca' = []},
        {        'wifi.united.com' = []},
        {        'etihadwi-fly.com' = []},
        {        'inflight-wifi.com' = []},
        {        'southwestwifi.com' = []},
        {        'wifi.cathaypacific.com' = []},
        {        'timhortonswifi.com' = []},
        {        'detectportal.firefox.com' = []},
        {        'portal.mist.com' = []},
        {        'wifi.connected.xfinity.com' = []},
        {        'vvm.ee.co.uk' = []},
        {        'wifi.tgvlyria.com' = []},
        {        'guestinternet.com' = []},
        {        '*.network-auth.com' = []},
        {        'secure.datavalet.io' = []},
        {        'login.cloud5.com' = []},
        {        'wirelessportal.americanexpress.com' = []},
        {        '*.globalreachtech.com' = []},
        {        'neverssl.com' = []}
      ]

[network]
  [network.0]
    name = 'Network 0'
    cidrs = ['0.0.0.0/0']

[upstream]
  [upstream.0]
    type = 'doh'
    endpoint = 'https://dns.controld.com/RESOLVERID'
    bootstrap_ip = '76.76.2.22'
    timeout = 5000

[cuonglm]

@xopez Thanks for reporting.

Could you please paste the content of /run/systemd/resolve/resolv.conf before and after installing ctrld?

[xopez]

Before install:

❯ cat /run/systemd/resolve/resolv.conf
# This is /run/systemd/resolve/resolv.conf managed by man:systemd-resolved(8).
# Do not edit.
#
# This file might be symlinked as /etc/resolv.conf. If you're looking at
# /etc/resolv.conf and seeing this text, you have followed the symlink.
#
# This is a dynamic resolv.conf file for connecting local clients directly to
# all known uplink DNS servers. This file lists all configured search domains.
#
# Third party programs should typically not access this file directly, but only
# through the symlink at /etc/resolv.conf. To manage man:resolv.conf(5) in a
# different way, replace this symlink by a static file or a different symlink.
#
# See man:systemd-resolved.service(8) for details about the supported modes of
# operation for /etc/resolv.conf.

nameserver 10.17.17.1
search home

Which is correct since this is my router.

After install:

❯ cat /run/systemd/resolve/resolv.conf
# This is /run/systemd/resolve/resolv.conf managed by man:systemd-resolved(8).
# Do not edit.
#
# This file might be symlinked as /etc/resolv.conf. If you're looking at
# /etc/resolv.conf and seeing this text, you have followed the symlink.
#
# This is a dynamic resolv.conf file for connecting local clients directly to
# all known uplink DNS servers. This file lists all configured search domains.
#
# Third party programs should typically not access this file directly, but only
# through the symlink at /etc/resolv.conf. To manage man:resolv.conf(5) in a
# different way, replace this symlink by a static file or a different symlink.
#
# See man:systemd-resolved.service(8) for details about the supported modes of
# operation for /etc/resolv.conf.

nameserver 127.0.0.1
nameserver 10.17.17.1
search home

Which explains the leaking.

[cuonglm]

Thanks, what version of systemd that you are using?

Also, could you please try --rfc1918 flag when installing ctrld and see if things worked?

[xopez]

❯ systemctl --version
systemd 258 (258.2-2-arch)
+PAM +AUDIT -SELINUX +APPARMOR -IMA +IPE +SMACK +SECCOMP +GCRYPT +GNUTLS +OPENSSL +ACL +BLKID +CURL +ELFUTILS +FIDO2 +IDN2 -IDN +IPTC +KMOD +LIBCRYPTSETUP +LIBCRYPTSETUP_PLUGINS +LIBFDISK +PCRE2 +PWQUALITY +P11KIT +QRENCODE +TPM2 +BZIP2 +LZ4 +XZ +ZLIB +ZSTD +BPF_FRAMEWORK +BTF +XKBCOMMON +UTMP -SYSVINIT +LIBARCHIVE

with the flag it is looking the same. i have uninstalled ctrld before:

sudo sh -c 'sh -c "$(curl -sSL https://147.185.34.1/dl)" -s ID forced --rfc1918'

       __         .__       .___
 _____/  |________|  |    __| _/
_/ ___\   __\_  __ \  |   / __ |
\  \___|  |  |  | \/  |__/ /_/ |
\___  >__|  |__|  |____/\____ |
    \/       installer       \/

---------------------
|    System Info    |
---------------------
OS Type      : linux
OS Vendor    : cachyos
Arch         : x86_64
CPU          : AMD Ryzen 7 9800X3D 8-Core Processor
Free RAM     : 25998 MB / 31161 MB
---------------------
|  Install Details  |
---------------------
Resolver ID  : ID
Binary URL   : https://dl.controld.com/linux-amd64/ctrld
Install Path : /usr/local/bin
---------------------
- Starting download
- Making binary executable
- Launching /usr/local/bin/ctrld
---------------------
Dec  1 16:06:36.972 NTC Starting service
Dec  1 16:06:37.324 NTC Generating controld config: /etc/controld/ctrld.toml
Dec  1 16:06:38.370 NTC Service started

~
❯ cat /run/systemd/resolve/resolv.conf
# This is /run/systemd/resolve/resolv.conf managed by man:systemd-resolved(8).
# Do not edit.
#
# This file might be symlinked as /etc/resolv.conf. If you're looking at
# /etc/resolv.conf and seeing this text, you have followed the symlink.
#
# This is a dynamic resolv.conf file for connecting local clients directly to
# all known uplink DNS servers. This file lists all configured search domains.
#
# Third party programs should typically not access this file directly, but only
# through the symlink at /etc/resolv.conf. To manage man:resolv.conf(5) in a
# different way, replace this symlink by a static file or a different symlink.
#
# See man:systemd-resolved.service(8) for details about the supported modes of
# operation for /etc/resolv.conf.

nameserver 127.0.0.1
nameserver 10.17.17.1
search home

[xopez]

for note, I will delete the ID after we are finished here. its just for testing

[cuonglm]

❯ systemctl --version
systemd 258 (258.2-2-arch)
+PAM +AUDIT -SELINUX +APPARMOR -IMA +IPE +SMACK +SECCOMP +GCRYPT +GNUTLS +OPENSSL +ACL +BLKID +CURL +ELFUTILS +FIDO2 +IDN2 -IDN +IPTC +KMOD +LIBCRYPTSETUP +LIBCRYPTSETUP_PLUGINS +LIBFDISK +PCRE2 +PWQUALITY +P11KIT +QRENCODE +TPM2 +BZIP2 +LZ4 +XZ +ZLIB +ZSTD +BPF_FRAMEWORK +BTF +XKBCOMMON +UTMP -SYSVINIT +LIBARCHIVE

with the flag it is looking the same. i have uninstalled ctrld before:

sudo sh -c 'sh -c "$(curl -sSL https://147.185.34.1/dl)" -s ID forced --rfc1918'

       __         .__       .___
 _____/  |________|  |    __| _/
_/ ___\   __\_  __ \  |   / __ |
\  \___|  |  |  | \/  |__/ /_/ |
\___  >__|  |__|  |____/\____ |
    \/       installer       \/

---------------------
|    System Info    |
---------------------
OS Type      : linux
OS Vendor    : cachyos
Arch         : x86_64
CPU          : AMD Ryzen 7 9800X3D 8-Core Processor
Free RAM     : 25998 MB / 31161 MB
---------------------
|  Install Details  |
---------------------
Resolver ID  : ID
Binary URL   : https://dl.controld.com/linux-amd64/ctrld
Install Path : /usr/local/bin
---------------------
- Starting download
- Making binary executable
- Launching /usr/local/bin/ctrld
---------------------
Dec  1 16:06:36.972 NTC Starting service
Dec  1 16:06:37.324 NTC Generating controld config: /etc/controld/ctrld.toml
Dec  1 16:06:38.370 NTC Service started

~
❯ cat /run/systemd/resolve/resolv.conf
# This is /run/systemd/resolve/resolv.conf managed by man:systemd-resolved(8).
# Do not edit.
#
# This file might be symlinked as /etc/resolv.conf. If you're looking at
# /etc/resolv.conf and seeing this text, you have followed the symlink.
#
# This is a dynamic resolv.conf file for connecting local clients directly to
# all known uplink DNS servers. This file lists all configured search domains.
#
# Third party programs should typically not access this file directly, but only
# through the symlink at /etc/resolv.conf. To manage man:resolv.conf(5) in a
# different way, replace this symlink by a static file or a different symlink.
#
# See man:systemd-resolved.service(8) for details about the supported modes of
# operation for /etc/resolv.conf.

nameserver 127.0.0.1
nameserver 10.17.17.1
search home

Sorry, I mean running ctrld directly, not via oneliner:

sudo ctrld start --cd=<uid> --rfc1918

[xopez]

I have a fresh install of the OS, without ctrld in /run/systemd/resolve/resolv.conf
The endpoint "test" is the right over which cachyOS got installed. Unifi is my router where the request shouldn't end.

nameserver 10.53.53.1
search windowshome

and with the command:

nameserver 10.0.2.3
nameserver 127.0.0.1
nameserver 10.53.53.1
search windowshome

it seems that, if i use dig directly in the terminal, it works. if i try to open it via firefox it doesnt work