Hostname lookups favour DNS before hosts file

[defau1t]

Good day,

We have a network environment wherein sometimes "localhost.domain" appears in our DNS records. This has caused some issues with our PandABox attempting to resolve localhost to itself and, instead, attempting to connect to a random host on our network.

It appears that the /etc/nsswitch.conf file currently shipped with the PandABox firmware is set to the following

hosts: dns files
networks: files

I propose the following change be made. I don't have a dev environment to attempt to build the image myself so I didn't want to blindly submit a PR without being able to test. That being said, it does follow already established patterns (replacing an /etc file with another one as in rootfs/skeleton/etc/profile) so I do not expect issues. Let me know if I can go ahead and submit a PR. Thanks!

diff --git a/rootfs/skeleton/etc/nsswitch.conf b/rootfs/skeleton/etc/nsswitch.conf
new file mode 100644
index 0000000..0321a7f
--- /dev/null
+++ b/rootfs/skeleton/etc/nsswitch.conf
@@ -0,0 +1,2 @@
+hosts:      files dns
+networks:   files
diff --git a/rootfs/skeleton/file-list b/rootfs/skeleton/file-list
index ba85dac..db14353 100644
--- a/rootfs/skeleton/file-list
+++ b/rootfs/skeleton/file-list
@@ -19,5 +19,10 @@ f 644 /usr/lib/python3.8/site-packages/defaults.pth defaults.pth
 rm - /etc/profile
 f 555 /etc/profile
 
+# Copy in nsswitch.conf file that conforms with vendor and glibc
+# defaults
+rm - /etc/nsswitch.conf
+f 644 /etc/nsswitch.conf
+
 # link firmware folder
 l 777 /lib/firmware /opt/firmware

EDIT: localhost description didn't translate

[coretl]

@EmilioPeJu what do you think?
@tomtrafford will there be another rootfs release, or should this go in the Yocto build?

[Araneidae]

Arguably this is a bug against the original rootfs, specifically this file: rootfs:skeleton/etc/nsswitch.conf and could be applied there instead.

[EmilioPeJu]

@coretl In the yocto build, nsswitch.conf is correct, when are we planning to do the next release? I think CI might be ready next week

[defau1t]

Arguably this is a bug against the original rootfs, specifically this file: rootfs:skeleton/etc/nsswitch.conf and could be applied there instead.

Oh man I was trying to find the origin of that file, thanks!

I'll leave it up to you guys to decide if it's worth making the change here or just closing this as wontdo given the file in yocto is correct. Thanks for considering!

[davidpcls]

Will this be fixed in the next release of the pandablocks "os" then you think? We're having weird issues partially because this configuration means the pandabox violates RFC 6761 and requests externally a DNS response for localhost.

[coretl]

Given that the yocto release fundamentally changes the structure of the firmware we put on the PandA, I wonder if we should make one more rootfs release before we switch to it?

@EmilioPeJu what do you reckon, would you be able to do this quickly?

[EmilioPeJu]

@coretl , What would be the advantage of doing that? In my opinion, spending effort into the old rootfs is a waste because the yocto rootfs is ready to be used, I made a beta pre-release to facilitate adopting it and can be installed in 2 ways:

• With the tar file at boot-pandabox-4.2b1.tar.gz, just un-compress it in the SD card (make sure the old rootfs files are removed first, only config.txt and authorized_keys can be reused)
• With the legacy upgrader at legacyupgrader@pandabox-4.2b1.zpg which can be installed via the web interface

Now, this is not a final release because we need people to start using it to find the details that needs to be fine tuned, but it is fully usable.

P.S. if you still insist in releasing the old rootfs, it would probably take me one or two days to implement.

[coretl]

@davidpcls I imagine it would be another month or two before we have a release of the new Yocto release with accompanying docs. Is that a reasonable timescale for you? We have betas now that (listed above) that will fix the problem, but haven't been well tested, so you're welcome to try them but there will be some rough edges.

[davidpcls]

@coretl I think that would be fine to wait for the yocto release. It might actually be better, as given that we don't have many Pandaboxes yet we could potentially standardize on the yocto builds.

I'm hoping that we can do the work to resolve our network issues that are contributing to the problem in the meantime, as regardless of if this change is made we still need to fix the DNS providing an address other than 127.0.0.1.

[coretl]

Ok, we will aim to have a Yocto release you can test by early July.

[davidpcls]

Thanks @coretl !

Also thank you for even considering making a special release just for us, that was very generous of you!