atenet/dns: answer non-A actor queries instead of SERVFAIL - #874
atenet/dns: answer non-A actor queries instead of SERVFAIL#874Yuan Gao (ygao-g) wants to merge 1 commit into
Conversation
7a240f7 to
0272dc0
Compare
|
Bowei Du (@bowei) Julian Gutierrez Oschmann (@juli4n) mind taking a look? This is the SERVFAIL half of #246, step one of your three: the actor zone can't Julian Gutierrez Oschmann (@juli4n), the substance is three Verified against |
f4bc2e5 to
fd6e47c
Compare
|
Yuan -- it would be good to be very specific on what we are doing in this PR. From what I can tell:
Is this what you are trying to do? |
|
Close, but that's two PRs and this is the smaller one. This PR doesn't publish an AAAA. It makes the zone return a correct rcode for what it doesn't answer — NODATA for a real actor name on a non-A qtype, NXDOMAIN for a name in the zone that doesn't exist. Both SERVFAIL today, on IPv4-only clusters too, which is why musl-based actors can't resolve each other at all: #888. Publishing AAAA is #938. The three together:
Every actor name resolves to the same address — the router ClusterIP, with per-actor demux at Envoy on the Host header — so an AAAA for a Substrate name is those three things, and no one of them is useful alone. End state on dual-stack: an actor name resolves in both families and Envoy answers on either. Each PR carries its own verification; the real gap is that dual-stack isn't testable until #877 lands, so #911's dual-stack behaviour is argued rather than run. On "fix any associated things" — past DNS, three more sit between a published AAAA and a usable IPv6 path, now filed as step-3 sub-tasks: #943, #944, #945. |
1634ab3 to
f8b1782
Compare
Yuan Gao (ygao-g)
changed the title
482ec1d to
9cf8384
Compare
9cf8384 to
fd76e7b
Compare
There was a problem hiding this comment.
Is it possible to add test coverage to verify this change fixes the issue described in the PR?
There was a problem hiding this comment.
I filed a separate PR to add scripts to manually verify the new behavior. PTAL #1038
Yuan Gao (ygao-g)
changed the title
Before, the actor zone answered A queries and failed everything else -- AAAA for a valid actor, and any name in the zone that is not an actor. A failure reads as a temporary error rather than an answer, so clients retry it and then give up on the name; Alpine actors could not resolve each other at all, even on an IPv4-only cluster. After, those queries return a correct empty answer, and one that resolvers can cache. A unit test pins the whole rendered zone as a literal, so editing the name pattern or the suffix fails there rather than passing silently.
8c2a75e to
8eaf242
Compare
Not intended to merge. The unit test in agent-substrate#874 pins the rendered zone but nothing exercises CoreDNS, so this serves that zone with the pinned coredns/coredns:1.11.1 and checks the rcode returned for A, AAAA, HTTPS, SRV, a name in the zone that is not an actor, and a malformed one, plus an Alpine getent for the musl path. Pointing --corefile at a zone rendered before the fix turns the run into a negative control: the AAAA case SERVFAILs and getent stops resolving, while plain dig A still succeeds.
3 participants
Fixes #888
The actor DNS zone only answered
A; everything else —AAAAfor a validactor, and any other name in the zone — got SERVFAIL. Strict resolvers treat
that as a hard network error rather than an empty answer, and musl maps it to
EAI_AGAIN, sinking the pairedAquery with it, so Alpine actors could notresolve each other even on an IPv4-only cluster.
Valid actor names now return NODATA (NOERROR + SOA) for non-A types, and
anything else in the zone returns NXDOMAIN — both negatively cacheable. This
does not publish an
AAAArecord; that is #938.