mirror of
https://github.com/agent-substrate/substrate.git
synced 2026-11-12 10:35:06 +08:00
Yuan Gao
bb83206fd0
Part of #246 The egress Envoy pinned `dns_lookup_family` to `V4_ONLY` in both the dynamic forward proxy filter and the dynamic forward proxy cluster. On an IPv6-only cluster every upstream connection failed: Envoy reported a DNS resolution failure and the actor got a 503. Seven sites across the two egress manifests, including the sdsmint variant, now use `ALL`, which returns both families and enables Happy Eyeballs. This is a prerequisite for IPv6 egress, not the fix on its own. An actor's connection is redirected by nftables and atunnel recovers the original destination with `getsockopt(SOL_IP, SO_ORIGINAL_DST)`, which returns ENOENT for a v6-redirected connection — so egress fails before Envoy is ever asked to resolve anything. ## Testing `make verify` is clean. A new test walks the shipped manifests and requires `ALL` on every `dns_cache_config`, so a new egress variant cannot reintroduce the pin. It has already paid for itself: the seventh site arrived with the sdsmint MITM leg while this was in review, still pinned to `V4_ONLY`, and the test caught it on rebase. Measured on an IPv6-only kind cluster with #911, #958, #979 and #753 applied. Each value was deployed, Envoy restarted, and the live `/config_dump` checked before running the suites: | `dns_lookup_family` | `TestActorEgress` / `TestActorEgressHTTPS` | | --- | --- | | `ALL` (shipped) | pass / pass, `code=200` to `[2606:4700:10::ac42:93f3]:80` | | `V4_ONLY` (before) | fail / fail, `code=503 flags=DF` | | `AUTO` | pass / pass | `AUTO` is not distinguishable from `ALL` on this path: the dynamic forward proxy is handed the IP literal that atunnel recovered, never a hostname, so `dns_lookup_family` only decides which literal families it accepts. `ALL` is chosen as the value that strands neither family. The IPv4 lane is unaffected: `TestActorEgress` and `TestActorEgressHTTPS` pass with the change in place, across two runs of the standard e2e job. - [x] Tests pass - [x] Appropriate changes to documentation are included in the PR 🤖 Generated with [Claude Code](https://claude.com/claude-code)