nixos/avahi-daemon: disable the full mDNS NSS module by default

Previously, enabling nssmdns would enable the full mdns module by
default, as well as the minimal one. Unfortunately, the full mdns module
introduces a 5 second delay whenever it fails to perform a reverse
hostname lookup (`gethostbyaddr`).

For example, this adds a 5 second delay to ping as follows:

1. Ping resolves the hostname (example.com) to an IP address. This query
   is serviced by the user's DNS resolver, so it returns quickly.
2. Ping attempts to resolve the IP address back into a hostname via
   `gethostbyaddr`.
3. If the upstream DNS server fails to resolve the IP address back into
   a hostname (many domain-names lack reverse DNS records), NSS falls
   back on querying via Avahi (via the `mdns` module).
4. mDNS is a broadcast protocol, so Avahi has to wait the full 5 second
   timeout before it can return a failure.

This patch fixes this by disabling the full `mdns` NSS module unless the
new disabled-by-default `nssmdnsFull` option is enabled. The
still-enabled `mdns_minimal` module only performs reverse IP lookups for
`169.254.0.0/16` (link-local IP addresses) so this 5 second delay will
only apply to link-local pings by domain-name.

In practice, this change shouldn't negatively affect the vast majority
of users. The only affected users are those who:

1. Are relying on Avahi to resolve IP addresses into hostnames on their
   local network via `gethostbyaddr`.
2. Are using mDNS hostnames that don't end in `.local`.

The minimal module is sufficient for, e.g., users who just want to
resolve hostnames for local printers and network shares.

Note: This patch not fix this by adding [!UNAVAIL=return] after `dns` as
discussed in (#291108) as that would treat mDNS as a fallback for DNS when
DNS is unavailable which, IMO, is incorrect. Whether or not we use mDNS
shouldn't depend on whether or not our DNS server is available.

fixes #291108

nixos/doc/manual/release-notes/rl-2611.section.md

@@ -40,6 +40,8 @@
 
 - `security.polkit.enablePkexecWrapper` has been introduced, making the `pkexec` setuid wrapper opt-in.
 
+- When Avahi's mDNS resolver is enabled (`services.avahi.nssmdns4` or `services.avahi.nssmdns6`), only the minimal mDNS resolver is enabled by default to avoid adding a 5 second delay to every failed reverse hostname lookup (e.g., delaying ping by 5 seconds). The "full" mDNS resolver now remains disabled unless `services.avahi.nssmdnsFull` is also enabled. Users who have customized [`/etc/mdns.allow`](https://github.com/avahi/nss-mdns/tree/master#etcmdnsallow) to allow mDNS domains not ending `.local` must enable `services.avahi.nssmdnsFull` to continue to resolve such domains.
+
 - `systemd.user.extraConfig` has been removed in favor of the structured [](#opt-systemd.user.settings.Manager) option. Use `systemd.user.settings.Manager` to set any `systemd-user.conf(5)` option directly. For example, replace `systemd.user.extraConfig = "DefaultTimeoutStartSec=60";` with `systemd.user.settings.Manager.DefaultTimeoutStartSec = 60;`.
 
 - `services.timesyncd.extraConfig` has been removed in favor of the structured [](#opt-services.timesyncd.settings.Time) option. Use `services.timesyncd.settings.Time` to set any `timesyncd.conf(5)` option directly. For example, replace `services.timesyncd.extraConfig = "PollIntervalMaxSec=180";` with `services.timesyncd.settings.Time.PollIntervalMaxSec = 180;`.

nixos/modules/services/networking/avahi-daemon.nix

@@ -262,6 +262,28 @@ in
       '';
     };
 
+    nssmdnsFull = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = ''
+        Whether to enable the full mDNS NSS (Name Service Switch) plug-in.
+
+        By default, only the minimal module is enabled. The minimal module
+        will only resolve `.local` domains and only perform reverse hostname
+        lookups for `169.254.0.0/16`. The full module will use mDNS to resolve any
+        domain allowed by [`/etc/mdns.allow`][1] and will perform reverse hostname
+        lookups for any IP address.
+
+        [1]: https://github.com/avahi/nss-mdns/tree/master#etcmdnsallow
+
+        ::: {.note}
+        Enabling this option will introduce a 5 second delay to failed reverse
+        hostname lookups. For example, this will often add a 5 second delay to
+        ping.
+        :::
+      '';
+    };
+
     cacheEntriesMax = lib.mkOption {
       type = lib.types.nullOr lib.types.int;
       default = null;
@@ -287,6 +309,15 @@ in
       (lib.mkIf cfg.wideArea "Enabling `services.avahi.wideArea` exposes this system to `CVE-2024-52615`.")
     ];
 
+    assertions = [
+      {
+        assertion = cfg.nssmdnsFull -> (cfg.nssmdns4 || cfg.nssmdns6);
+        message = ''
+          `services.avahi.nssmdnsFull` requires one or both of `services.avahi.nssmdns4` and/or `services.avahi.nssmdns6` to be enabled.
+        '';
+      }
+    ];
+
     users.users.avahi = {
       description = "avahi-daemon privilege separation user";
       home = "/var/empty";
@@ -312,7 +343,7 @@ in
       lib.optionals (cfg.nssmdns4 || cfg.nssmdns6) (
         lib.mkMerge [
           (lib.mkBefore [ "${mdns}_minimal [NOTFOUND=return]" ]) # before resolve
-          (lib.mkAfter [ "${mdns}" ]) # after dns
+          (lib.mkAfter (lib.optional cfg.nssmdnsFull "${mdns}")) # after dns
         ]
       );