Enable DNS tunneling for VirtioProxy networking mode#14461
Merged
Conversation
- Allow VirtioProxy to keep EnableDnsTunneling=true in config, but clear socket-specific options (BestEffortDnsParsing, DnsTunnelingIpAddress) - Suppress dedicated DNS tunneling hvsocket for VirtioProxy; tunneling is handled through the VirtioNetworking device host instead - Set DnsTunneling flag on VirtioNetworkingFlags so the device host knows to tunnel DNS - Expand SWIOTLB kernel cmdline to cover VirtioFs and VirtioProxy - Bump DeviceHost package to 1.1.39-0 - Add VirtioProxy DNS test coverage for tunneling on/off - Skip GuestPortIsReleasedV6 on Windows 10
benhillis
requested review from
OneBlue,
Copilot,
craigloewen-msft,
jstarks and
justus-camp-microsoft
Contributor
There was a problem hiding this comment.
Pull request overview
Enable DNS tunneling support for VirtioProxy by moving tunneling responsibility to the VirtioNetworking device host (instead of a dedicated DNS hvsocket), while expanding related kernel configuration and test coverage.
Changes:
- Disable dedicated DNS tunneling hvsocket path for VirtioProxy and signal tunneling via VirtioNetworking flags.
- Adjust config validation to allow
EnableDnsTunnelingin VirtioProxy while clearing socket-specific tunneling options. - Expand SWIOTLB enablement to cover more virtio features and add VirtioProxy DNS tunneling on/off tests (plus Windows 11 gating for one IPv6 port-release test).
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 12 comments.
| File | Description |
|---|---|
| test/windows/NetworkTests.cpp | Adds a shared IPv6 dig helper and expands VirtioProxy DNS tests to cover tunneling enabled/disabled; gates one test to Windows 11. |
| src/windows/service/exe/WslCoreVm.cpp | Suppresses DNS hvsocket for VirtioProxy, sets VirtioNetworking DNS tunneling flag, and broadens SWIOTLB enablement. |
| src/windows/common/WslCoreConfig.cpp | Updates config validation to permit DNS tunneling in VirtioProxy while forcing socket-specific DNS tunneling options off. |
| packages.config | Updates Microsoft.WSL.DeviceHost dependency version to pick up VirtioProxy DNS tunneling support. |
You can also share your feedback on Copilot code review. Take the survey.
benhillis
commented
Mar 17, 2026
| TEST_METHOD(GuestPortIsReleasedV6) | ||
| { | ||
| VIRTIOPROXY_TEST_ONLY(); | ||
| WINDOWS_11_TEST_ONLY(); |
Member
Author
There was a problem hiding this comment.
Unrelated, to this PR but this test is failing on Windows 10, I will debug.
OneBlue
approved these changes
Mar 18, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This change lights up the wsldevicehost version of DNS tunneling. This uses a different mechanism than that dnstunneling approach for NAT and Mirrored networking modes which run a resolver inside the guest and send DNS queries over hvsocket to the host. For virtioproxy, /etc/resolv.conf is directed to the gateway address, and then intercepted in consomme where the same DNS tunneling APIs are used. For more information see the openvmm changes where this support was added:
microsoft/openvmm#2633
microsoft/openvmm#2807