Backport of NET-7813 - DNS : SERVFAIL when resolving PTR records into…

… release/1.18.0 (#20717) Backport of NET-7813 - DNS : SERVFAIL when resolving PTR records into release/1.18.x (#20693) NET-7813 - DNS : SERVFAIL when resolving PTR records Co-authored-by: hc-github-team-consul-core <[email protected]>
hashicorp · Feb 26, 2024 · fe8bbb3 · fe8bbb3
1 parent 50a6876
commit fe8bbb3
Show file tree

Hide file tree

Showing 6 changed files with 492 additions and 440 deletions.
diff --git a/.changelog/20679.txt b/.changelog/20679.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+dns: SERVFAIL when resolving not found PTR records.
+```
diff --git a/agent/discovery/query_fetcher_v1.go b/agent/discovery/query_fetcher_v1.go
@@ -250,6 +250,10 @@ func (f *V1DataFetcher) FetchRecordsByIp(reqCtx Context, ip net.IP) ([]*Result,
 
 	var sout structs.IndexedServiceNodes
 	if err := f.rpcFunc(context.Background(), "Catalog.ServiceNodes", &sargs, &sout); err == nil {
+		if len(sout.ServiceNodes) == 0 {
+			return nil, ErrNotFound
+		}
+
 		for _, n := range sout.ServiceNodes {
 			if n.ServiceAddress == targetIP {
 				results = append(results, &Result{

diff --git a/agent/dns.go b/agent/dns.go
@@ -413,7 +413,8 @@ func (d *DNSServer) handlePtr(resp dns.ResponseWriter, req *dns.Msg) {
 	m.SetReply(req)
 	m.Compress = !cfg.DisableCompression
 	m.Authoritative = true
-	m.RecursionAvailable = (len(cfg.Recursors) > 0)
+	recursionAvailable := atomic.LoadUint32(&(d.recursorEnabled)) == 1
+	m.RecursionAvailable = recursionAvailable
 
 	// Only add the SOA if requested
 	if req.Question[0].Qtype == dns.TypeSOA {
@@ -492,8 +493,13 @@ func (d *DNSServer) handlePtr(resp dns.ResponseWriter, req *dns.Msg) {
 
 	// nothing found locally, recurse
 	if len(m.Answer) == 0 {
-		d.handleRecurse(resp, req)
-		return
+		if recursionAvailable {
+			d.handleRecurse(resp, req)
+			return
+		} else {
+			m.SetRcode(req, dns.RcodeNameError)
+			d.addSOAToMessage(cfg, m, q.Name)
+		}
 	}
 
 	// ptr record responses are globally valid