consul
consul copied to clipboard
DNS : recurse for ptr records only if recursion is desired and configured
Description
This PR checks that the DNS request for the PTR has rd set (RecursionDesired) and we have recursors configured before calling the handleRecurse function.
Fixes:
Testing & Reproduction steps
Issue with calling handleRecurse if not neeed:
- Start Consul without
recursors
configured -
dig -p 8600 -x 127.0.0.3 @localhost
- It should return NXDOMAIN but returns SERVFAIL
Issue with lack of handling of the rd
flag:
- Start Consul with
recursors = ["1.1.1.1"]
configured -
dig -p 8600-x 1.1.1.1 @localhost +norecurse
- It should return NXDOMAIN but returns
one.one.one.one.
Links
Fixes: https://github.com/hashicorp/consul/issues/20413
PR Checklist
- [ ] updated test coverage
- [x] external facing docs updated
- [x] appropriate backport labels added
- [x] not a security concern