You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The current implementation of the DNS PTR records resolver iterates through all services and nodes and, if nothing is found, proceeds to call the function which handles recursion without checking if recursion is desired (rd flag) and if we have recursors configured.
This causes two issues:
PTR queries for non-existent IPs return SERVFAIL instead of NXDOMAIN as we end up here.
Request without the rd flag set are recursed.
Reproduction Steps
Issue with calling handleRecurse if not neeed:
Start Consul without recursors configured
dig -p 8600 -x 127.0.0.3 @localhost
It should return NXDOMAIN but returns SERVFAIL and in the logs:
2024-01-31T08:47:14.946Z [ERROR] agent.dns: all resolvers failed for question from client: question="{3.0.0.127.in-addr.arpa. 12 1}" client=127.0.0.1:41033 client_network=udp
Issue with lack of handling of the rd flag:
Start Consul with recursors = ["1.1.1.1"] configured
dig -p 8600-x 1.1.1.1 @localhost +norecurse
It should return NXDOMAIN but returns one.one.one.one.
The text was updated successfully, but these errors were encountered:
Overview of the Issue
The current implementation of the DNS PTR records resolver iterates through all services and nodes and, if nothing is found, proceeds to call the function which handles recursion without checking if recursion is desired (rd flag) and if we have recursors configured.
This causes two issues:
rd
flag set are recursed.Reproduction Steps
Issue with calling handleRecurse if not neeed:
dig -p 8600 -x 127.0.0.3 @localhost
It should return NXDOMAIN but returns SERVFAIL and in the logs:
Issue with lack of handling of the rd flag:
recursors = ["1.1.1.1"]
configureddig -p 8600-x 1.1.1.1 @localhost +norecurse
It should return NXDOMAIN but returns one.one.one.one.
The text was updated successfully, but these errors were encountered: