2024-01-10 16:19:20 +00:00
|
|
|
// Copyright (c) HashiCorp, Inc.
|
|
|
|
// SPDX-License-Identifier: BUSL-1.1
|
|
|
|
|
|
|
|
package dns
|
|
|
|
|
|
|
|
import (
|
2024-01-17 03:36:02 +00:00
|
|
|
"encoding/hex"
|
|
|
|
"errors"
|
2024-01-10 16:19:20 +00:00
|
|
|
"fmt"
|
|
|
|
"net"
|
2024-01-29 22:33:45 +00:00
|
|
|
"regexp"
|
|
|
|
"strings"
|
2024-01-10 16:19:20 +00:00
|
|
|
"sync/atomic"
|
|
|
|
"time"
|
|
|
|
|
2024-02-13 17:08:01 +00:00
|
|
|
"github.com/armon/go-metrics"
|
2024-01-10 16:19:20 +00:00
|
|
|
"github.com/armon/go-radix"
|
|
|
|
"github.com/miekg/dns"
|
|
|
|
|
2024-02-02 23:29:38 +00:00
|
|
|
"github.com/hashicorp/go-hclog"
|
|
|
|
|
2024-02-09 16:26:02 +00:00
|
|
|
"github.com/hashicorp/consul/acl"
|
2024-01-10 16:19:20 +00:00
|
|
|
"github.com/hashicorp/consul/agent/config"
|
|
|
|
"github.com/hashicorp/consul/agent/discovery"
|
|
|
|
"github.com/hashicorp/consul/agent/structs"
|
2024-01-29 16:40:10 +00:00
|
|
|
"github.com/hashicorp/consul/internal/dnsutil"
|
2024-01-17 03:36:02 +00:00
|
|
|
"github.com/hashicorp/consul/logging"
|
|
|
|
)
|
|
|
|
|
|
|
|
const (
|
|
|
|
addrLabel = "addr"
|
|
|
|
|
2024-01-29 16:40:10 +00:00
|
|
|
arpaDomain = "arpa."
|
|
|
|
arpaLabel = "arpa"
|
2024-01-17 03:36:02 +00:00
|
|
|
|
2024-01-29 22:33:45 +00:00
|
|
|
suffixFailover = "failover."
|
|
|
|
suffixNoFailover = "no-failover."
|
|
|
|
maxRecursionLevelDefault = 3 // This field comes from the V1 DNS server and affects V1 catalog lookups
|
|
|
|
maxRecurseRecords = 5
|
2024-01-17 03:36:02 +00:00
|
|
|
)
|
|
|
|
|
|
|
|
var (
|
|
|
|
errInvalidQuestion = fmt.Errorf("invalid question")
|
2024-01-18 23:30:04 +00:00
|
|
|
errNameNotFound = fmt.Errorf("name not found")
|
2024-02-02 23:29:38 +00:00
|
|
|
errNotImplemented = fmt.Errorf("not implemented")
|
2024-01-18 23:30:04 +00:00
|
|
|
errRecursionFailed = fmt.Errorf("recursion failed")
|
2024-01-29 22:33:45 +00:00
|
|
|
|
|
|
|
trailingSpacesRE = regexp.MustCompile(" +$")
|
2024-01-10 16:19:20 +00:00
|
|
|
)
|
|
|
|
|
2024-02-02 23:29:38 +00:00
|
|
|
// Context is used augment a DNS message with Consul-specific metadata.
|
|
|
|
type Context struct {
|
2024-02-09 02:56:04 +00:00
|
|
|
Token string
|
|
|
|
DefaultPartition string
|
|
|
|
DefaultDatacenter string
|
2024-02-02 23:29:38 +00:00
|
|
|
}
|
|
|
|
|
2024-01-10 16:19:20 +00:00
|
|
|
// RouterDynamicConfig is the dynamic configuration that can be hot-reloaded
|
|
|
|
type RouterDynamicConfig struct {
|
2024-02-14 22:38:11 +00:00
|
|
|
ARecordLimit int
|
|
|
|
DisableCompression bool
|
|
|
|
EnableTruncate bool
|
|
|
|
NodeMetaTXT bool
|
|
|
|
NodeTTL time.Duration
|
|
|
|
Recursors []string
|
|
|
|
RecursorTimeout time.Duration
|
|
|
|
RecursorStrategy structs.RecursorStrategy
|
|
|
|
SOAConfig SOAConfig
|
2024-01-10 16:19:20 +00:00
|
|
|
// TTLRadix sets service TTLs by prefix, eg: "database-*"
|
|
|
|
TTLRadix *radix.Tree
|
|
|
|
// TTLStrict sets TTLs to service by full name match. It Has higher priority than TTLRadix
|
|
|
|
TTLStrict map[string]time.Duration
|
|
|
|
UDPAnswerLimit int
|
|
|
|
}
|
|
|
|
|
|
|
|
type SOAConfig struct {
|
|
|
|
Refresh uint32 // 3600 by default
|
|
|
|
Retry uint32 // 600
|
|
|
|
Expire uint32 // 86400
|
|
|
|
Minttl uint32 // 0
|
|
|
|
}
|
|
|
|
|
|
|
|
// DiscoveryQueryProcessor is an interface that can be used by any consumer requesting Service Discovery results.
|
|
|
|
// This could be attached to a gRPC endpoint in the future in addition to DNS.
|
|
|
|
// Making this an interface means testing the router with a mock is trivial.
|
|
|
|
type DiscoveryQueryProcessor interface {
|
|
|
|
QueryByName(*discovery.Query, discovery.Context) ([]*discovery.Result, error)
|
|
|
|
QueryByIP(net.IP, discovery.Context) ([]*discovery.Result, error)
|
|
|
|
}
|
|
|
|
|
2024-01-18 23:30:04 +00:00
|
|
|
// dnsRecursor is an interface that can be used to mock calls to external DNS servers for unit testing.
|
|
|
|
//
|
|
|
|
//go:generate mockery --name dnsRecursor --inpackage
|
|
|
|
type dnsRecursor interface {
|
2024-02-03 03:23:52 +00:00
|
|
|
handle(req *dns.Msg, cfgCtx *RouterDynamicConfig, remoteAddress net.Addr) (*dns.Msg, error)
|
2024-01-18 23:30:04 +00:00
|
|
|
}
|
|
|
|
|
2024-01-10 16:19:20 +00:00
|
|
|
// Router replaces miekg/dns.ServeMux with a simpler router that only checks for the 2-3 valid domains
|
|
|
|
// that Consul supports and forwards to a single DiscoveryQueryProcessor handler. If there is no match, it will recurse.
|
|
|
|
type Router struct {
|
2024-01-17 23:46:18 +00:00
|
|
|
processor DiscoveryQueryProcessor
|
2024-01-18 23:30:04 +00:00
|
|
|
recursor dnsRecursor
|
2024-01-17 23:46:18 +00:00
|
|
|
domain string
|
|
|
|
altDomain string
|
|
|
|
datacenter string
|
2024-02-13 17:08:01 +00:00
|
|
|
nodeName string
|
2024-01-17 23:46:18 +00:00
|
|
|
logger hclog.Logger
|
2024-01-10 16:19:20 +00:00
|
|
|
|
2024-02-12 19:27:25 +00:00
|
|
|
tokenFunc func() string
|
|
|
|
translateAddressFunc func(dc string, addr string, taggedAddresses map[string]string, accept dnsutil.TranslateAddressAccept) string
|
|
|
|
translateServiceAddressFunc func(dc string, address string, taggedAddresses map[string]structs.ServiceAddress, accept dnsutil.TranslateAddressAccept) string
|
2024-01-10 16:19:20 +00:00
|
|
|
|
|
|
|
// dynamicConfig stores the config as an atomic value (for hot-reloading).
|
|
|
|
// It is always of type *RouterDynamicConfig
|
|
|
|
dynamicConfig atomic.Value
|
|
|
|
}
|
|
|
|
|
|
|
|
var _ = dns.Handler(&Router{})
|
2024-01-22 15:10:03 +00:00
|
|
|
var _ = DNSRouter(&Router{})
|
2024-01-10 16:19:20 +00:00
|
|
|
|
|
|
|
func NewRouter(cfg Config) (*Router, error) {
|
2024-01-17 03:36:02 +00:00
|
|
|
// Make sure domains are FQDN, make them case-insensitive for DNSRequestRouter
|
|
|
|
domain := dns.CanonicalName(cfg.AgentConfig.DNSDomain)
|
|
|
|
altDomain := dns.CanonicalName(cfg.AgentConfig.DNSAltDomain)
|
|
|
|
|
2024-01-18 23:30:04 +00:00
|
|
|
logger := cfg.Logger.Named(logging.DNS)
|
|
|
|
|
2024-01-10 16:19:20 +00:00
|
|
|
router := &Router{
|
2024-02-12 19:27:25 +00:00
|
|
|
processor: cfg.Processor,
|
|
|
|
recursor: newRecursor(logger),
|
|
|
|
domain: domain,
|
|
|
|
altDomain: altDomain,
|
|
|
|
datacenter: cfg.AgentConfig.Datacenter,
|
|
|
|
logger: logger,
|
2024-02-13 17:08:01 +00:00
|
|
|
nodeName: cfg.AgentConfig.NodeName,
|
2024-02-12 19:27:25 +00:00
|
|
|
tokenFunc: cfg.TokenFunc,
|
|
|
|
translateAddressFunc: cfg.TranslateAddressFunc,
|
|
|
|
translateServiceAddressFunc: cfg.TranslateServiceAddressFunc,
|
2024-01-10 16:19:20 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
if err := router.ReloadConfig(cfg.AgentConfig); err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
return router, nil
|
|
|
|
}
|
|
|
|
|
2024-01-17 23:46:18 +00:00
|
|
|
// HandleRequest is used to process an individual DNS request. It returns a message in success or fail cases.
|
2024-02-02 23:29:38 +00:00
|
|
|
func (r *Router) HandleRequest(req *dns.Msg, reqCtx Context, remoteAddress net.Addr) *dns.Msg {
|
2024-02-13 17:08:01 +00:00
|
|
|
configCtx := r.dynamicConfig.Load().(*RouterDynamicConfig)
|
|
|
|
|
|
|
|
r.logger.Trace("received request", "question", req.Question[0].Name, "type", dns.Type(req.Question[0].Qtype).String())
|
|
|
|
|
|
|
|
err := validateAndNormalizeRequest(req)
|
|
|
|
if err != nil {
|
|
|
|
r.logger.Error("error parsing DNS query", "error", err)
|
|
|
|
if errors.Is(err, errInvalidQuestion) {
|
|
|
|
return createRefusedResponse(req)
|
|
|
|
}
|
|
|
|
return createServerFailureResponse(req, configCtx, false)
|
|
|
|
}
|
|
|
|
|
|
|
|
defer func(s time.Time, q dns.Question) {
|
|
|
|
metrics.MeasureSinceWithLabels([]string{"dns", "query"}, s,
|
|
|
|
[]metrics.Label{
|
|
|
|
{Name: "node", Value: r.nodeName},
|
|
|
|
{Name: "type", Value: dns.Type(q.Qtype).String()},
|
|
|
|
})
|
|
|
|
|
2024-02-14 17:40:38 +00:00
|
|
|
r.logger.Trace("request served from client",
|
2024-02-13 17:08:01 +00:00
|
|
|
"name", q.Name,
|
|
|
|
"type", dns.Type(q.Qtype).String(),
|
|
|
|
"class", dns.Class(q.Qclass).String(),
|
|
|
|
"latency", time.Since(s).String(),
|
|
|
|
"client", remoteAddress.String(),
|
|
|
|
"client_network", remoteAddress.Network(),
|
|
|
|
)
|
|
|
|
}(time.Now(), req.Question[0])
|
|
|
|
|
|
|
|
return r.handleRequestRecursively(req, reqCtx, configCtx, remoteAddress, maxRecursionLevelDefault)
|
2024-01-29 22:33:45 +00:00
|
|
|
}
|
|
|
|
|
2024-02-08 04:24:00 +00:00
|
|
|
// getErrorFromECSNotGlobalError returns the underlying error from an ECSNotGlobalError, if it exists.
|
|
|
|
func getErrorFromECSNotGlobalError(err error) error {
|
|
|
|
if errors.Is(err, discovery.ErrECSNotGlobal) {
|
|
|
|
return err.(discovery.ECSNotGlobalError).Unwrap()
|
|
|
|
}
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2024-01-29 22:33:45 +00:00
|
|
|
// handleRequestRecursively is used to process an individual DNS request. It will recurse as needed
|
|
|
|
// a maximum number of times and returns a message in success or fail cases.
|
2024-02-13 17:08:01 +00:00
|
|
|
func (r *Router) handleRequestRecursively(req *dns.Msg, reqCtx Context, configCtx *RouterDynamicConfig,
|
2024-01-29 22:33:45 +00:00
|
|
|
remoteAddress net.Addr, maxRecursionLevel int) *dns.Msg {
|
2024-01-10 16:19:20 +00:00
|
|
|
|
2024-02-13 17:08:01 +00:00
|
|
|
r.logger.Trace(
|
|
|
|
"received request",
|
|
|
|
"question", req.Question[0].Name,
|
|
|
|
"type", dns.Type(req.Question[0].Qtype).String(),
|
|
|
|
"recursion_remaining", maxRecursionLevel)
|
2024-01-10 16:19:20 +00:00
|
|
|
|
2024-02-03 03:23:52 +00:00
|
|
|
responseDomain, needRecurse := r.parseDomain(req.Question[0].Name)
|
2024-01-18 23:30:04 +00:00
|
|
|
if needRecurse && !canRecurse(configCtx) {
|
2024-01-24 20:32:42 +00:00
|
|
|
// This is the same error as an unmatched domain
|
|
|
|
return createRefusedResponse(req)
|
2024-01-18 23:30:04 +00:00
|
|
|
}
|
2024-01-10 16:19:20 +00:00
|
|
|
|
2024-01-18 23:30:04 +00:00
|
|
|
if needRecurse {
|
2024-02-09 22:41:40 +00:00
|
|
|
r.logger.Trace("checking recursors to handle request", "question", req.Question[0].Name, "type", dns.Type(req.Question[0].Qtype).String())
|
|
|
|
|
2024-01-18 23:30:04 +00:00
|
|
|
// This assumes `canRecurse(configCtx)` is true above
|
|
|
|
resp, err := r.recursor.handle(req, configCtx, remoteAddress)
|
|
|
|
if err != nil && !errors.Is(err, errRecursionFailed) {
|
|
|
|
r.logger.Error("unhandled error recursing DNS query", "error", err)
|
|
|
|
}
|
|
|
|
if err != nil {
|
|
|
|
return createServerFailureResponse(req, configCtx, true)
|
|
|
|
}
|
|
|
|
return resp
|
2024-01-17 03:36:02 +00:00
|
|
|
}
|
2024-01-10 16:19:20 +00:00
|
|
|
|
2024-01-30 22:34:35 +00:00
|
|
|
// Need to pass the question name to properly support recursion and the
|
|
|
|
// trimming of the domain suffixes.
|
|
|
|
qName := dns.CanonicalName(req.Question[0].Name)
|
|
|
|
if maxRecursionLevel < maxRecursionLevelDefault {
|
|
|
|
// Get the QName without the domain suffix
|
|
|
|
qName = r.trimDomain(qName)
|
|
|
|
}
|
|
|
|
|
2024-01-24 20:32:42 +00:00
|
|
|
reqType := parseRequestType(req)
|
2024-02-03 03:23:52 +00:00
|
|
|
results, query, err := r.getQueryResults(req, reqCtx, reqType, qName, remoteAddress)
|
2024-02-02 23:29:38 +00:00
|
|
|
|
2024-02-09 02:56:04 +00:00
|
|
|
// in case of the wrapped ECSNotGlobalError, extract the error from it.
|
2024-02-08 04:24:00 +00:00
|
|
|
isECSGlobal := !errors.Is(err, discovery.ErrECSNotGlobal)
|
|
|
|
err = getErrorFromECSNotGlobalError(err)
|
|
|
|
if err != nil {
|
2024-02-09 02:56:04 +00:00
|
|
|
return r.generateResponseFromError(req, err, qName, configCtx, responseDomain,
|
|
|
|
isECSGlobal, query, canRecurse(configCtx))
|
2024-01-17 03:36:02 +00:00
|
|
|
}
|
2024-01-10 16:19:20 +00:00
|
|
|
|
2024-02-09 22:41:40 +00:00
|
|
|
r.logger.Trace("serializing results", "question", req.Question[0].Name, "results-found", len(results))
|
|
|
|
|
2024-01-17 03:36:02 +00:00
|
|
|
// This needs the question information because it affects the serialization format.
|
|
|
|
// e.g., the Consul service has the same "results" for both NS and A/AAAA queries, but the serialization differs.
|
2024-01-29 22:33:45 +00:00
|
|
|
resp, err := r.serializeQueryResults(req, reqCtx, query, results, configCtx, responseDomain, remoteAddress, maxRecursionLevel)
|
2024-01-17 03:36:02 +00:00
|
|
|
if err != nil {
|
|
|
|
r.logger.Error("error serializing DNS results", "error", err)
|
2024-02-09 02:56:04 +00:00
|
|
|
return r.generateResponseFromError(req, err, qName, configCtx, responseDomain,
|
|
|
|
false, query, false)
|
2024-01-17 03:36:02 +00:00
|
|
|
}
|
2024-02-08 04:24:00 +00:00
|
|
|
|
|
|
|
// Switch to TCP if the client is
|
|
|
|
network := "udp"
|
|
|
|
if _, ok := remoteAddress.(*net.TCPAddr); ok {
|
|
|
|
network = "tcp"
|
|
|
|
}
|
|
|
|
|
|
|
|
trimDNSResponse(configCtx, network, req, resp, r.logger)
|
|
|
|
|
|
|
|
setEDNS(req, resp, isECSGlobal)
|
2024-01-17 03:36:02 +00:00
|
|
|
return resp
|
2024-01-10 16:19:20 +00:00
|
|
|
}
|
|
|
|
|
2024-02-09 02:56:04 +00:00
|
|
|
// generateResponseFromError generates a response from an error.
|
|
|
|
func (r *Router) generateResponseFromError(req *dns.Msg, err error, qName string,
|
|
|
|
configCtx *RouterDynamicConfig, responseDomain string, isECSGlobal bool,
|
|
|
|
query *discovery.Query, canRecurse bool) *dns.Msg {
|
|
|
|
switch {
|
|
|
|
case errors.Is(err, errInvalidQuestion):
|
|
|
|
r.logger.Error("invalid question", "name", qName)
|
|
|
|
|
|
|
|
return createAuthoritativeResponse(req, configCtx, responseDomain, dns.RcodeNameError, isECSGlobal)
|
|
|
|
case errors.Is(err, errNameNotFound):
|
|
|
|
r.logger.Error("name not found", "name", qName)
|
|
|
|
|
|
|
|
return createAuthoritativeResponse(req, configCtx, responseDomain, dns.RcodeNameError, isECSGlobal)
|
|
|
|
case errors.Is(err, errNotImplemented):
|
|
|
|
r.logger.Error("query not implemented", "name", qName, "type", dns.Type(req.Question[0].Qtype).String())
|
|
|
|
|
|
|
|
return createAuthoritativeResponse(req, configCtx, responseDomain, dns.RcodeNotImplemented, isECSGlobal)
|
|
|
|
case errors.Is(err, discovery.ErrNotSupported):
|
|
|
|
r.logger.Debug("query name syntax not supported", "name", req.Question[0].Name)
|
|
|
|
|
|
|
|
return createAuthoritativeResponse(req, configCtx, responseDomain, dns.RcodeNameError, isECSGlobal)
|
|
|
|
case errors.Is(err, discovery.ErrNotFound):
|
|
|
|
r.logger.Debug("query name not found", "name", req.Question[0].Name)
|
|
|
|
|
|
|
|
return createAuthoritativeResponse(req, configCtx, responseDomain, dns.RcodeNameError, isECSGlobal)
|
|
|
|
case errors.Is(err, discovery.ErrNoData):
|
|
|
|
r.logger.Debug("no data available", "name", qName)
|
|
|
|
|
|
|
|
return createAuthoritativeResponse(req, configCtx, responseDomain, dns.RcodeSuccess, isECSGlobal)
|
|
|
|
case errors.Is(err, discovery.ErrNoPathToDatacenter):
|
|
|
|
dc := ""
|
|
|
|
if query != nil {
|
|
|
|
dc = query.QueryPayload.Tenancy.Datacenter
|
|
|
|
}
|
|
|
|
r.logger.Debug("no path to datacenter", "datacenter", dc)
|
|
|
|
return createAuthoritativeResponse(req, configCtx, responseDomain, dns.RcodeNameError, isECSGlobal)
|
|
|
|
}
|
|
|
|
r.logger.Error("error processing discovery query", "error", err)
|
|
|
|
return createServerFailureResponse(req, configCtx, canRecurse)
|
|
|
|
}
|
|
|
|
|
2024-01-30 22:34:35 +00:00
|
|
|
// trimDomain trims the domain from the question name.
|
|
|
|
func (r *Router) trimDomain(questionName string) string {
|
|
|
|
longer := r.domain
|
|
|
|
shorter := r.altDomain
|
|
|
|
|
|
|
|
if len(shorter) > len(longer) {
|
|
|
|
longer, shorter = shorter, longer
|
|
|
|
}
|
|
|
|
|
|
|
|
if strings.HasSuffix(questionName, "."+strings.TrimLeft(longer, ".")) {
|
|
|
|
return strings.TrimSuffix(questionName, longer)
|
|
|
|
}
|
|
|
|
return strings.TrimSuffix(questionName, shorter)
|
|
|
|
}
|
|
|
|
|
2024-01-29 22:33:45 +00:00
|
|
|
// getTTLForResult returns the TTL for a given result.
|
2024-02-09 16:26:02 +00:00
|
|
|
func getTTLForResult(name string, overrideTTL *uint32, query *discovery.Query, cfg *RouterDynamicConfig) uint32 {
|
2024-02-02 23:29:38 +00:00
|
|
|
// In the case we are not making a discovery query, such as addr. or arpa. lookups,
|
|
|
|
// use the node TTL by convention
|
|
|
|
if query == nil {
|
|
|
|
return uint32(cfg.NodeTTL / time.Second)
|
|
|
|
}
|
|
|
|
|
2024-02-09 16:26:02 +00:00
|
|
|
if overrideTTL != nil {
|
|
|
|
// If a result was provided with an override, use that. This is the case for some prepared queries.
|
|
|
|
return *overrideTTL
|
|
|
|
}
|
|
|
|
|
2024-02-02 23:29:38 +00:00
|
|
|
switch query.QueryType {
|
2024-02-09 16:26:02 +00:00
|
|
|
case discovery.QueryTypeService, discovery.QueryTypePreparedQuery:
|
2024-02-02 23:29:38 +00:00
|
|
|
ttl, ok := cfg.getTTLForService(name)
|
2024-01-29 22:33:45 +00:00
|
|
|
if ok {
|
|
|
|
return uint32(ttl / time.Second)
|
|
|
|
}
|
|
|
|
fallthrough
|
|
|
|
default:
|
|
|
|
return uint32(cfg.NodeTTL / time.Second)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2024-01-17 23:46:18 +00:00
|
|
|
// getQueryResults returns a discovery.Result from a DNS message.
|
2024-02-03 03:23:52 +00:00
|
|
|
func (r *Router) getQueryResults(req *dns.Msg, reqCtx Context, reqType requestType,
|
|
|
|
qName string, remoteAddress net.Addr) ([]*discovery.Result, *discovery.Query, error) {
|
2024-01-17 23:46:18 +00:00
|
|
|
switch reqType {
|
2024-01-24 20:32:42 +00:00
|
|
|
case requestTypeConsul:
|
|
|
|
// This is a special case of discovery.QueryByName where we know that we need to query the consul service
|
|
|
|
// regardless of the question name.
|
|
|
|
query := &discovery.Query{
|
|
|
|
QueryType: discovery.QueryTypeService,
|
|
|
|
QueryPayload: discovery.QueryPayload{
|
|
|
|
Name: structs.ConsulServiceName,
|
2024-02-02 23:29:38 +00:00
|
|
|
Tenancy: discovery.QueryTenancy{
|
|
|
|
// We specify the partition here so that in the case we are a client agent in a non-default partition.
|
|
|
|
// We don't want the query processors default partition to be used.
|
|
|
|
// This is a small hack because for V1 CE, this is not the correct default partition name, but we
|
|
|
|
// need to add something to disambiguate the empty field.
|
2024-02-08 04:24:00 +00:00
|
|
|
Partition: acl.DefaultPartitionName, //NOTE: note this won't work if we ever have V2 client agents
|
2024-02-02 23:29:38 +00:00
|
|
|
},
|
2024-02-06 16:12:04 +00:00
|
|
|
Limit: 3,
|
2024-01-24 20:32:42 +00:00
|
|
|
},
|
|
|
|
}
|
2024-01-29 22:33:45 +00:00
|
|
|
|
2024-02-02 23:29:38 +00:00
|
|
|
results, err := r.processor.QueryByName(query, discovery.Context{Token: reqCtx.Token})
|
2024-01-29 22:33:45 +00:00
|
|
|
return results, query, err
|
2024-01-17 23:46:18 +00:00
|
|
|
case requestTypeName:
|
2024-02-03 03:23:52 +00:00
|
|
|
query, err := buildQueryFromDNSMessage(req, reqCtx, r.domain, r.altDomain, remoteAddress)
|
2024-01-17 23:46:18 +00:00
|
|
|
if err != nil {
|
|
|
|
r.logger.Error("error building discovery query from DNS request", "error", err)
|
2024-01-29 22:33:45 +00:00
|
|
|
return nil, query, err
|
|
|
|
}
|
2024-02-02 23:29:38 +00:00
|
|
|
results, err := r.processor.QueryByName(query, discovery.Context{Token: reqCtx.Token})
|
2024-02-03 03:23:52 +00:00
|
|
|
|
2024-02-08 04:24:00 +00:00
|
|
|
if getErrorFromECSNotGlobalError(err) != nil {
|
|
|
|
r.logger.Error("error processing discovery query", "error", err)
|
2024-01-29 22:33:45 +00:00
|
|
|
return nil, query, err
|
2024-01-17 23:46:18 +00:00
|
|
|
}
|
2024-02-08 04:24:00 +00:00
|
|
|
return results, query, err
|
2024-01-17 23:46:18 +00:00
|
|
|
case requestTypeIP:
|
2024-01-30 22:34:35 +00:00
|
|
|
ip := dnsutil.IPFromARPA(qName)
|
2024-01-29 16:40:10 +00:00
|
|
|
if ip == nil {
|
2024-01-30 22:34:35 +00:00
|
|
|
r.logger.Error("error building IP from DNS request", "name", qName)
|
2024-01-29 22:33:45 +00:00
|
|
|
return nil, nil, errNameNotFound
|
2024-01-29 16:40:10 +00:00
|
|
|
}
|
2024-02-02 23:29:38 +00:00
|
|
|
results, err := r.processor.QueryByIP(ip, discovery.Context{Token: reqCtx.Token})
|
|
|
|
return results, nil, err
|
2024-01-17 23:46:18 +00:00
|
|
|
case requestTypeAddress:
|
2024-01-29 22:33:45 +00:00
|
|
|
results, err := buildAddressResults(req)
|
|
|
|
if err != nil {
|
|
|
|
r.logger.Error("error processing discovery query", "error", err)
|
2024-02-02 23:29:38 +00:00
|
|
|
return nil, nil, err
|
2024-01-29 22:33:45 +00:00
|
|
|
}
|
2024-02-02 23:29:38 +00:00
|
|
|
return results, nil, nil
|
2024-01-17 23:46:18 +00:00
|
|
|
}
|
2024-02-08 04:24:00 +00:00
|
|
|
|
|
|
|
r.logger.Error("error parsing discovery query type", "requestType", reqType)
|
|
|
|
return nil, nil, errInvalidQuestion
|
2024-01-17 23:46:18 +00:00
|
|
|
}
|
|
|
|
|
2024-01-17 03:36:02 +00:00
|
|
|
// ServeDNS implements the miekg/dns.Handler interface.
|
|
|
|
// This is a standard DNS listener, so we inject a default request context based on the agent's config.
|
|
|
|
func (r *Router) ServeDNS(w dns.ResponseWriter, req *dns.Msg) {
|
2024-01-10 16:19:20 +00:00
|
|
|
reqCtx := r.defaultAgentDNSRequestContext()
|
|
|
|
out := r.HandleRequest(req, reqCtx, w.RemoteAddr())
|
|
|
|
w.WriteMsg(out)
|
|
|
|
}
|
|
|
|
|
|
|
|
// ReloadConfig hot-reloads the router config with new parameters
|
2024-01-17 03:36:02 +00:00
|
|
|
func (r *Router) ReloadConfig(newCfg *config.RuntimeConfig) error {
|
|
|
|
cfg, err := getDynamicRouterConfig(newCfg)
|
2024-01-10 16:19:20 +00:00
|
|
|
if err != nil {
|
|
|
|
return fmt.Errorf("error loading DNS config: %w", err)
|
|
|
|
}
|
|
|
|
r.dynamicConfig.Store(cfg)
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2024-02-02 23:29:38 +00:00
|
|
|
// getTTLForService Find the TTL for a given service.
|
|
|
|
// return ttl, true if found, 0, false otherwise
|
|
|
|
func (cfg *RouterDynamicConfig) getTTLForService(service string) (time.Duration, bool) {
|
|
|
|
if cfg.TTLStrict != nil {
|
|
|
|
ttl, ok := cfg.TTLStrict[service]
|
|
|
|
if ok {
|
|
|
|
return ttl, true
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if cfg.TTLRadix != nil {
|
|
|
|
_, ttlRaw, ok := cfg.TTLRadix.LongestPrefix(service)
|
|
|
|
if ok {
|
|
|
|
return ttlRaw.(time.Duration), true
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return 0, false
|
|
|
|
}
|
|
|
|
|
2024-01-17 03:36:02 +00:00
|
|
|
// Request type is similar to miekg/dns.Type, but correlates to the different query processors we might need to invoke.
|
|
|
|
type requestType string
|
|
|
|
|
|
|
|
const (
|
2024-01-24 20:32:42 +00:00
|
|
|
requestTypeName requestType = "NAME" // A/AAAA/CNAME/SRV
|
|
|
|
requestTypeIP requestType = "IP" // PTR
|
|
|
|
requestTypeAddress requestType = "ADDR" // Custom addr. A/AAAA lookups
|
|
|
|
requestTypeConsul requestType = "CONSUL" // SOA/NS
|
2024-01-17 03:36:02 +00:00
|
|
|
)
|
|
|
|
|
2024-01-24 20:32:42 +00:00
|
|
|
// parseDomain converts a DNS message into a generic discovery request.
|
2024-01-17 03:36:02 +00:00
|
|
|
// If the request domain does not match "consul." or the alternative domain,
|
|
|
|
// it will return true for needRecurse. The logic is based on miekg/dns.ServeDNS matcher.
|
|
|
|
// The implementation assumes that the only valid domains are "consul." and the alternative domain, and
|
|
|
|
// that DS query types are not supported.
|
2024-02-03 03:23:52 +00:00
|
|
|
func (r *Router) parseDomain(questionName string) (string, bool) {
|
|
|
|
target := dns.CanonicalName(questionName)
|
2024-01-17 03:36:02 +00:00
|
|
|
target, _ = stripSuffix(target)
|
|
|
|
|
|
|
|
for offset, overflow := 0, false; !overflow; offset, overflow = dns.NextLabel(target, offset) {
|
|
|
|
subdomain := target[offset:]
|
|
|
|
switch subdomain {
|
2024-01-24 20:32:42 +00:00
|
|
|
case ".":
|
|
|
|
// We don't support consul having a domain or altdomain attached to the root.
|
|
|
|
return "", true
|
2024-01-17 03:36:02 +00:00
|
|
|
case r.domain:
|
2024-01-24 20:32:42 +00:00
|
|
|
return r.domain, false
|
2024-01-17 03:36:02 +00:00
|
|
|
case r.altDomain:
|
2024-01-24 20:32:42 +00:00
|
|
|
return r.altDomain, false
|
2024-01-17 03:36:02 +00:00
|
|
|
case arpaDomain:
|
|
|
|
// PTR queries always respond with the primary domain.
|
2024-01-24 20:32:42 +00:00
|
|
|
return r.domain, false
|
2024-01-17 03:36:02 +00:00
|
|
|
// Default: fallthrough
|
|
|
|
}
|
|
|
|
}
|
|
|
|
// No match found; recurse if possible
|
2024-01-24 20:32:42 +00:00
|
|
|
return "", true
|
|
|
|
}
|
|
|
|
|
|
|
|
// parseRequestType inspects the DNS message type and question name to determine the requestType of request.
|
|
|
|
// We assume by the time this is called, we are responding to a question with a domain we serve.
|
|
|
|
// This is used internally to determine which query processor method (if any) to invoke.
|
|
|
|
func parseRequestType(req *dns.Msg) requestType {
|
|
|
|
switch {
|
|
|
|
case req.Question[0].Qtype == dns.TypeSOA || req.Question[0].Qtype == dns.TypeNS:
|
|
|
|
// SOA and NS type supersede the domain
|
|
|
|
// NOTE!: In V1 of the DNS server it was possible to serve a PTR lookup using the arpa domain but a SOA question type.
|
|
|
|
// This also included the SOA record. This seemed inconsistent and unnecessary - it was removed for simplicity.
|
|
|
|
return requestTypeConsul
|
|
|
|
case isPTRSubdomain(req.Question[0].Name):
|
|
|
|
return requestTypeIP
|
|
|
|
case isAddrSubdomain(req.Question[0].Name):
|
|
|
|
return requestTypeAddress
|
|
|
|
default:
|
|
|
|
return requestTypeName
|
|
|
|
}
|
2024-01-17 03:36:02 +00:00
|
|
|
}
|
|
|
|
|
2024-02-09 22:41:40 +00:00
|
|
|
func getPortsFromResult(result *discovery.Result) []discovery.Port {
|
|
|
|
if len(result.Ports) > 0 {
|
|
|
|
return result.Ports
|
|
|
|
}
|
|
|
|
// return one record.
|
|
|
|
return []discovery.Port{{}}
|
|
|
|
}
|
|
|
|
|
2024-01-17 23:46:18 +00:00
|
|
|
// serializeQueryResults converts a discovery.Result into a DNS message.
|
2024-02-02 23:29:38 +00:00
|
|
|
func (r *Router) serializeQueryResults(req *dns.Msg, reqCtx Context,
|
2024-01-29 22:33:45 +00:00
|
|
|
query *discovery.Query, results []*discovery.Result, cfg *RouterDynamicConfig,
|
|
|
|
responseDomain string, remoteAddress net.Addr, maxRecursionLevel int) (*dns.Msg, error) {
|
2024-01-17 03:36:02 +00:00
|
|
|
resp := new(dns.Msg)
|
|
|
|
resp.SetReply(req)
|
|
|
|
resp.Compress = !cfg.DisableCompression
|
|
|
|
resp.Authoritative = true
|
|
|
|
resp.RecursionAvailable = canRecurse(cfg)
|
|
|
|
|
2024-01-29 22:33:45 +00:00
|
|
|
qType := req.Question[0].Qtype
|
|
|
|
reqType := parseRequestType(req)
|
|
|
|
|
|
|
|
// Always add the SOA record if requested.
|
|
|
|
switch {
|
|
|
|
case qType == dns.TypeSOA:
|
|
|
|
resp.Answer = append(resp.Answer, makeSOARecord(responseDomain, cfg))
|
|
|
|
for _, result := range results {
|
2024-02-09 22:41:40 +00:00
|
|
|
for _, port := range getPortsFromResult(result) {
|
|
|
|
ans, ex, ns := r.getAnswerExtraAndNs(result, port, req, reqCtx, query, cfg, responseDomain, remoteAddress, maxRecursionLevel)
|
|
|
|
resp.Answer = append(resp.Answer, ans...)
|
|
|
|
resp.Extra = append(resp.Extra, ex...)
|
|
|
|
resp.Ns = append(resp.Ns, ns...)
|
|
|
|
}
|
2024-01-29 22:33:45 +00:00
|
|
|
}
|
2024-02-08 04:24:00 +00:00
|
|
|
case reqType == requestTypeAddress:
|
|
|
|
for _, result := range results {
|
2024-02-09 22:41:40 +00:00
|
|
|
for _, port := range getPortsFromResult(result) {
|
|
|
|
ans, ex, ns := r.getAnswerExtraAndNs(result, port, req, reqCtx, query, cfg, responseDomain, remoteAddress, maxRecursionLevel)
|
|
|
|
resp.Answer = append(resp.Answer, ans...)
|
|
|
|
resp.Extra = append(resp.Extra, ex...)
|
|
|
|
resp.Ns = append(resp.Ns, ns...)
|
|
|
|
}
|
2024-02-08 04:24:00 +00:00
|
|
|
}
|
|
|
|
case qType == dns.TypeSRV:
|
|
|
|
handled := make(map[string]struct{})
|
2024-01-29 22:33:45 +00:00
|
|
|
for _, result := range results {
|
2024-02-09 22:41:40 +00:00
|
|
|
for _, port := range getPortsFromResult(result) {
|
|
|
|
|
|
|
|
// Avoid duplicate entries, possible if a node has
|
|
|
|
// the same service the same port, etc.
|
|
|
|
|
|
|
|
// The datacenter should be empty during translation if it is a peering lookup.
|
|
|
|
// This should be fine because we should always prefer the WAN address.
|
|
|
|
|
|
|
|
address := ""
|
|
|
|
if result.Service != nil {
|
|
|
|
address = result.Service.Address
|
|
|
|
} else {
|
|
|
|
address = result.Node.Address
|
|
|
|
}
|
|
|
|
tuple := fmt.Sprintf("%s:%s:%d", result.Node.Name, address, port.Number)
|
|
|
|
if _, ok := handled[tuple]; ok {
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
handled[tuple] = struct{}{}
|
|
|
|
|
|
|
|
ans, ex, ns := r.getAnswerExtraAndNs(result, port, req, reqCtx, query, cfg, responseDomain, remoteAddress, maxRecursionLevel)
|
|
|
|
resp.Answer = append(resp.Answer, ans...)
|
|
|
|
resp.Extra = append(resp.Extra, ex...)
|
|
|
|
resp.Ns = append(resp.Ns, ns...)
|
2024-02-08 04:24:00 +00:00
|
|
|
}
|
2024-01-29 22:33:45 +00:00
|
|
|
}
|
|
|
|
default:
|
|
|
|
// default will send it to where it does some de-duping while it calls getAnswerExtraAndNs and recurses.
|
|
|
|
r.appendResultsToDNSResponse(req, reqCtx, query, resp, results, cfg, responseDomain, remoteAddress, maxRecursionLevel)
|
|
|
|
}
|
|
|
|
|
2024-02-12 19:27:25 +00:00
|
|
|
if query != nil && query.QueryType != discovery.QueryTypeVirtual &&
|
|
|
|
len(resp.Answer) == 0 && len(resp.Extra) == 0 {
|
2024-02-09 02:56:04 +00:00
|
|
|
return nil, discovery.ErrNoData
|
|
|
|
}
|
|
|
|
|
2024-01-29 22:33:45 +00:00
|
|
|
return resp, nil
|
|
|
|
}
|
|
|
|
|
2024-02-12 19:27:25 +00:00
|
|
|
// getServiceAddressMapFromLocationMap converts a map of Location to a map of ServiceAddress.
|
|
|
|
func getServiceAddressMapFromLocationMap(taggedAddresses map[string]*discovery.TaggedAddress) map[string]structs.ServiceAddress {
|
|
|
|
taggedServiceAddresses := make(map[string]structs.ServiceAddress, len(taggedAddresses))
|
|
|
|
for k, v := range taggedAddresses {
|
|
|
|
taggedServiceAddresses[k] = structs.ServiceAddress{
|
|
|
|
Address: v.Address,
|
|
|
|
Port: int(v.Port.Number),
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return taggedServiceAddresses
|
|
|
|
}
|
|
|
|
|
|
|
|
// getStringAddressMapFromTaggedAddressMap converts a map of Location to a map of string.
|
|
|
|
func getStringAddressMapFromTaggedAddressMap(taggedAddresses map[string]*discovery.TaggedAddress) map[string]string {
|
|
|
|
taggedServiceAddresses := make(map[string]string, len(taggedAddresses))
|
|
|
|
for k, v := range taggedAddresses {
|
|
|
|
taggedServiceAddresses[k] = v.Address
|
|
|
|
}
|
|
|
|
return taggedServiceAddresses
|
|
|
|
}
|
|
|
|
|
2024-01-29 22:33:45 +00:00
|
|
|
// appendResultsToDNSResponse builds dns message from the discovery results and
|
|
|
|
// appends them to the dns response.
|
2024-02-02 23:29:38 +00:00
|
|
|
func (r *Router) appendResultsToDNSResponse(req *dns.Msg, reqCtx Context,
|
2024-01-29 22:33:45 +00:00
|
|
|
query *discovery.Query, resp *dns.Msg, results []*discovery.Result, cfg *RouterDynamicConfig,
|
|
|
|
responseDomain string, remoteAddress net.Addr, maxRecursionLevel int) {
|
|
|
|
|
2024-01-24 20:32:42 +00:00
|
|
|
// Always add the SOA record if requested.
|
|
|
|
if req.Question[0].Qtype == dns.TypeSOA {
|
|
|
|
resp.Answer = append(resp.Answer, makeSOARecord(responseDomain, cfg))
|
|
|
|
}
|
2024-01-17 03:36:02 +00:00
|
|
|
|
2024-01-29 22:33:45 +00:00
|
|
|
handled := make(map[string]struct{})
|
|
|
|
var answerCNAME []dns.RR = nil
|
|
|
|
|
|
|
|
count := 0
|
2024-01-17 03:36:02 +00:00
|
|
|
for _, result := range results {
|
2024-02-09 22:41:40 +00:00
|
|
|
for _, port := range getPortsFromResult(result) {
|
2024-01-29 22:33:45 +00:00
|
|
|
|
2024-02-09 22:41:40 +00:00
|
|
|
// Add the node record
|
|
|
|
had_answer := false
|
|
|
|
ans, extra, _ := r.getAnswerExtraAndNs(result, port, req, reqCtx, query, cfg, responseDomain, remoteAddress, maxRecursionLevel)
|
|
|
|
resp.Extra = append(resp.Extra, extra...)
|
2024-01-29 22:33:45 +00:00
|
|
|
|
2024-02-09 22:41:40 +00:00
|
|
|
if len(ans) == 0 {
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
|
|
|
|
// Avoid duplicate entries, possible if a node has
|
|
|
|
// the same service on multiple ports, etc.
|
|
|
|
if _, ok := handled[ans[0].String()]; ok {
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
handled[ans[0].String()] = struct{}{}
|
|
|
|
|
|
|
|
switch ans[0].(type) {
|
|
|
|
case *dns.CNAME:
|
|
|
|
// keep track of the first CNAME + associated RRs but don't add to the resp.Answer yet
|
|
|
|
// this will only be added if no non-CNAME RRs are found
|
|
|
|
if len(answerCNAME) == 0 {
|
|
|
|
answerCNAME = ans
|
|
|
|
}
|
|
|
|
default:
|
|
|
|
resp.Answer = append(resp.Answer, ans...)
|
|
|
|
had_answer = true
|
2024-01-29 22:33:45 +00:00
|
|
|
}
|
|
|
|
|
2024-02-09 22:41:40 +00:00
|
|
|
if had_answer {
|
|
|
|
count++
|
|
|
|
if count == cfg.ARecordLimit {
|
|
|
|
// We stop only if greater than 0 or we reached the limit
|
|
|
|
return
|
|
|
|
}
|
2024-01-29 22:33:45 +00:00
|
|
|
}
|
|
|
|
}
|
2024-01-17 03:36:02 +00:00
|
|
|
}
|
2024-01-29 22:33:45 +00:00
|
|
|
if len(resp.Answer) == 0 && len(answerCNAME) > 0 {
|
|
|
|
resp.Answer = answerCNAME
|
|
|
|
}
|
2024-01-17 03:36:02 +00:00
|
|
|
}
|
|
|
|
|
2024-01-18 23:30:04 +00:00
|
|
|
// defaultAgentDNSRequestContext returns a default request context based on the agent's config.
|
2024-02-02 23:29:38 +00:00
|
|
|
func (r *Router) defaultAgentDNSRequestContext() Context {
|
|
|
|
return Context{
|
2024-02-09 02:56:04 +00:00
|
|
|
Token: r.tokenFunc(),
|
|
|
|
DefaultDatacenter: r.datacenter,
|
2024-02-02 23:29:38 +00:00
|
|
|
// We don't need to specify the agent's partition here because that will be handled further down the stack
|
|
|
|
// in the query processor.
|
2024-01-18 23:30:04 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2024-01-29 22:33:45 +00:00
|
|
|
// resolveCNAME is used to recursively resolve CNAME records
|
2024-02-13 17:08:01 +00:00
|
|
|
func (r *Router) resolveCNAME(cfgContext *RouterDynamicConfig, name string, reqCtx Context,
|
2024-01-29 22:33:45 +00:00
|
|
|
remoteAddress net.Addr, maxRecursionLevel int) []dns.RR {
|
|
|
|
// If the CNAME record points to a Consul address, resolve it internally
|
2024-02-14 17:40:38 +00:00
|
|
|
// Convert query to lowercase because DNS is case-insensitive; r.domain and
|
|
|
|
// r.altDomain are already converted
|
2024-01-29 22:33:45 +00:00
|
|
|
|
|
|
|
if ln := strings.ToLower(name); strings.HasSuffix(ln, "."+r.domain) || strings.HasSuffix(ln, "."+r.altDomain) {
|
|
|
|
if maxRecursionLevel < 1 {
|
2024-02-14 17:40:38 +00:00
|
|
|
r.logger.Error("Infinite recursion detected for name, won't perform any CNAME resolution.", "name", name)
|
2024-01-29 22:33:45 +00:00
|
|
|
return nil
|
|
|
|
}
|
|
|
|
req := &dns.Msg{}
|
|
|
|
|
|
|
|
req.SetQuestion(name, dns.TypeANY)
|
2024-02-14 17:40:38 +00:00
|
|
|
// TODO: handle error response (this is a comment from the V1 DNS Server)
|
2024-02-13 17:08:01 +00:00
|
|
|
resp := r.handleRequestRecursively(req, reqCtx, cfgContext, nil, maxRecursionLevel-1)
|
2024-01-29 22:33:45 +00:00
|
|
|
|
|
|
|
return resp.Answer
|
|
|
|
}
|
|
|
|
|
|
|
|
// Do nothing if we don't have a recursor
|
2024-02-13 17:08:01 +00:00
|
|
|
if !canRecurse(cfgContext) {
|
2024-01-29 22:33:45 +00:00
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// Ask for any A records
|
|
|
|
m := new(dns.Msg)
|
|
|
|
m.SetQuestion(name, dns.TypeA)
|
|
|
|
|
|
|
|
// Make a DNS lookup request
|
2024-02-13 17:08:01 +00:00
|
|
|
recursorResponse, err := r.recursor.handle(m, cfgContext, remoteAddress)
|
2024-01-29 22:33:45 +00:00
|
|
|
if err == nil {
|
|
|
|
return recursorResponse.Answer
|
|
|
|
}
|
|
|
|
|
|
|
|
r.logger.Error("all resolvers failed for name", "name", name)
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2024-01-18 23:30:04 +00:00
|
|
|
// validateAndNormalizeRequest validates the DNS request and normalizes the request name.
|
|
|
|
func validateAndNormalizeRequest(req *dns.Msg) error {
|
|
|
|
// like upstream miekg/dns, we require at least one question,
|
|
|
|
// but we will only answer the first.
|
|
|
|
if len(req.Question) == 0 {
|
|
|
|
return errInvalidQuestion
|
|
|
|
}
|
|
|
|
|
|
|
|
// We mutate the request name to respond with the canonical name.
|
|
|
|
// This is Consul convention.
|
|
|
|
req.Question[0].Name = dns.CanonicalName(req.Question[0].Name)
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2024-01-17 23:46:18 +00:00
|
|
|
// stripSuffix strips off the suffixes that may have been added to the request name.
|
2024-01-17 03:36:02 +00:00
|
|
|
func stripSuffix(target string) (string, bool) {
|
|
|
|
enableFailover := false
|
|
|
|
|
|
|
|
// Strip off any suffixes that may have been added.
|
|
|
|
offset, underflow := dns.PrevLabel(target, 1)
|
|
|
|
if !underflow {
|
|
|
|
maybeSuffix := target[offset:]
|
|
|
|
switch maybeSuffix {
|
|
|
|
case suffixFailover:
|
|
|
|
target = target[:offset]
|
|
|
|
enableFailover = true
|
|
|
|
case suffixNoFailover:
|
|
|
|
target = target[:offset]
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return target, enableFailover
|
|
|
|
}
|
|
|
|
|
2024-01-17 23:46:18 +00:00
|
|
|
// isAddrSubdomain returns true if the domain is a valid addr subdomain.
|
2024-01-17 03:36:02 +00:00
|
|
|
func isAddrSubdomain(domain string) bool {
|
|
|
|
labels := dns.SplitDomainName(domain)
|
|
|
|
|
|
|
|
// Looking for <hexadecimal-encoded IP>.addr.<optional datacenter>.consul.
|
|
|
|
if len(labels) > 2 {
|
|
|
|
return labels[1] == addrLabel
|
|
|
|
}
|
|
|
|
return false
|
|
|
|
}
|
|
|
|
|
2024-01-24 20:32:42 +00:00
|
|
|
// isPTRSubdomain returns true if the domain ends in the PTR domain, "in-addr.arpa.".
|
|
|
|
func isPTRSubdomain(domain string) bool {
|
|
|
|
labels := dns.SplitDomainName(domain)
|
|
|
|
labelCount := len(labels)
|
|
|
|
|
2024-01-29 16:40:10 +00:00
|
|
|
// We keep this check brief so we can have more specific error handling later.
|
|
|
|
if labelCount < 1 {
|
2024-01-24 20:32:42 +00:00
|
|
|
return false
|
|
|
|
}
|
|
|
|
|
2024-01-29 16:40:10 +00:00
|
|
|
return labels[labelCount-1] == arpaLabel
|
2024-01-24 20:32:42 +00:00
|
|
|
}
|
|
|
|
|
2024-01-17 03:36:02 +00:00
|
|
|
// getDynamicRouterConfig takes agent config and creates/resets the config used by DNS Router
|
|
|
|
func getDynamicRouterConfig(conf *config.RuntimeConfig) (*RouterDynamicConfig, error) {
|
|
|
|
cfg := &RouterDynamicConfig{
|
|
|
|
ARecordLimit: conf.DNSARecordLimit,
|
|
|
|
EnableTruncate: conf.DNSEnableTruncate,
|
|
|
|
NodeTTL: conf.DNSNodeTTL,
|
|
|
|
RecursorStrategy: conf.DNSRecursorStrategy,
|
|
|
|
RecursorTimeout: conf.DNSRecursorTimeout,
|
|
|
|
UDPAnswerLimit: conf.DNSUDPAnswerLimit,
|
|
|
|
NodeMetaTXT: conf.DNSNodeMetaTXT,
|
|
|
|
DisableCompression: conf.DNSDisableCompression,
|
|
|
|
SOAConfig: SOAConfig{
|
|
|
|
Expire: conf.DNSSOA.Expire,
|
|
|
|
Minttl: conf.DNSSOA.Minttl,
|
|
|
|
Refresh: conf.DNSSOA.Refresh,
|
|
|
|
Retry: conf.DNSSOA.Retry,
|
|
|
|
},
|
2024-01-10 16:19:20 +00:00
|
|
|
}
|
2024-01-17 03:36:02 +00:00
|
|
|
|
2024-01-29 22:33:45 +00:00
|
|
|
if conf.DNSServiceTTL != nil {
|
|
|
|
cfg.TTLRadix = radix.New()
|
|
|
|
cfg.TTLStrict = make(map[string]time.Duration)
|
|
|
|
|
|
|
|
for key, ttl := range conf.DNSServiceTTL {
|
|
|
|
// All suffix with '*' are put in radix
|
|
|
|
// This include '*' that will match anything
|
|
|
|
if strings.HasSuffix(key, "*") {
|
|
|
|
cfg.TTLRadix.Insert(key[:len(key)-1], ttl)
|
|
|
|
} else {
|
|
|
|
cfg.TTLStrict[key] = ttl
|
|
|
|
}
|
|
|
|
}
|
|
|
|
} else {
|
|
|
|
cfg.TTLRadix = nil
|
|
|
|
cfg.TTLStrict = nil
|
|
|
|
}
|
2024-01-17 03:36:02 +00:00
|
|
|
|
2024-01-18 23:30:04 +00:00
|
|
|
for _, r := range conf.DNSRecursors {
|
|
|
|
ra, err := formatRecursorAddress(r)
|
|
|
|
if err != nil {
|
|
|
|
return nil, fmt.Errorf("invalid recursor address: %w", err)
|
|
|
|
}
|
|
|
|
cfg.Recursors = append(cfg.Recursors, ra)
|
|
|
|
}
|
|
|
|
|
2024-01-17 03:36:02 +00:00
|
|
|
return cfg, nil
|
|
|
|
}
|
|
|
|
|
2024-01-17 23:46:18 +00:00
|
|
|
// canRecurse returns true if the router can recurse on the request.
|
2024-01-17 03:36:02 +00:00
|
|
|
func canRecurse(cfg *RouterDynamicConfig) bool {
|
|
|
|
return len(cfg.Recursors) > 0
|
2024-01-10 16:19:20 +00:00
|
|
|
}
|
|
|
|
|
2024-01-17 23:46:18 +00:00
|
|
|
// createServerFailureResponse returns a SERVFAIL message.
|
2024-01-10 16:19:20 +00:00
|
|
|
func createServerFailureResponse(req *dns.Msg, cfg *RouterDynamicConfig, recursionAvailable bool) *dns.Msg {
|
|
|
|
// Return a SERVFAIL message
|
|
|
|
m := &dns.Msg{}
|
|
|
|
m.SetReply(req)
|
|
|
|
m.Compress = !cfg.DisableCompression
|
|
|
|
m.SetRcode(req, dns.RcodeServerFailure)
|
|
|
|
m.RecursionAvailable = recursionAvailable
|
2024-01-18 23:30:04 +00:00
|
|
|
if edns := req.IsEdns0(); edns != nil {
|
|
|
|
setEDNS(req, m, true)
|
|
|
|
}
|
2024-02-08 04:24:00 +00:00
|
|
|
|
2024-01-10 16:19:20 +00:00
|
|
|
return m
|
|
|
|
}
|
2024-01-17 03:36:02 +00:00
|
|
|
|
2024-01-18 23:30:04 +00:00
|
|
|
// setEDNS is used to set the responses EDNS size headers and
|
|
|
|
// possibly the ECS headers as well if they were present in the
|
|
|
|
// original request
|
|
|
|
func setEDNS(request *dns.Msg, response *dns.Msg, ecsGlobal bool) {
|
|
|
|
edns := request.IsEdns0()
|
|
|
|
if edns == nil {
|
|
|
|
return
|
|
|
|
}
|
|
|
|
|
|
|
|
// cannot just use the SetEdns0 function as we need to embed
|
|
|
|
// the ECS option as well
|
|
|
|
ednsResp := new(dns.OPT)
|
|
|
|
ednsResp.Hdr.Name = "."
|
|
|
|
ednsResp.Hdr.Rrtype = dns.TypeOPT
|
|
|
|
ednsResp.SetUDPSize(edns.UDPSize())
|
|
|
|
|
2024-01-24 20:32:42 +00:00
|
|
|
// Set up the ECS option if present
|
2024-01-18 23:30:04 +00:00
|
|
|
if subnet := ednsSubnetForRequest(request); subnet != nil {
|
|
|
|
subOp := new(dns.EDNS0_SUBNET)
|
|
|
|
subOp.Code = dns.EDNS0SUBNET
|
|
|
|
subOp.Family = subnet.Family
|
|
|
|
subOp.Address = subnet.Address
|
|
|
|
subOp.SourceNetmask = subnet.SourceNetmask
|
|
|
|
if c := response.Rcode; ecsGlobal || c == dns.RcodeNameError || c == dns.RcodeServerFailure || c == dns.RcodeRefused || c == dns.RcodeNotImplemented {
|
|
|
|
// reply is globally valid and should be cached accordingly
|
|
|
|
subOp.SourceScope = 0
|
|
|
|
} else {
|
|
|
|
// reply is only valid for the subnet it was queried with
|
|
|
|
subOp.SourceScope = subnet.SourceNetmask
|
|
|
|
}
|
|
|
|
ednsResp.Option = append(ednsResp.Option, subOp)
|
|
|
|
}
|
|
|
|
|
|
|
|
response.Extra = append(response.Extra, ednsResp)
|
|
|
|
}
|
|
|
|
|
|
|
|
// ednsSubnetForRequest looks through the request to find any EDS subnet options
|
|
|
|
func ednsSubnetForRequest(req *dns.Msg) *dns.EDNS0_SUBNET {
|
|
|
|
// IsEdns0 returns the EDNS RR if present or nil otherwise
|
|
|
|
edns := req.IsEdns0()
|
|
|
|
if edns == nil {
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
for _, o := range edns.Option {
|
|
|
|
if subnet, ok := o.(*dns.EDNS0_SUBNET); ok {
|
|
|
|
return subnet
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2024-01-24 20:32:42 +00:00
|
|
|
// createRefusedResponse returns a REFUSED message. This is the default behavior for unmatched queries in
|
|
|
|
// upstream miekg/dns.
|
2024-01-17 03:36:02 +00:00
|
|
|
func createRefusedResponse(req *dns.Msg) *dns.Msg {
|
|
|
|
// Return a REFUSED message
|
|
|
|
m := &dns.Msg{}
|
|
|
|
m.SetRcode(req, dns.RcodeRefused)
|
|
|
|
return m
|
|
|
|
}
|
|
|
|
|
2024-01-24 20:32:42 +00:00
|
|
|
// createAuthoritativeResponse returns an authoritative message that contains the SOA in the event that data is
|
|
|
|
// not return for a query. There can be multiple reasons for not returning data, hence the rcode argument.
|
|
|
|
func createAuthoritativeResponse(req *dns.Msg, cfg *RouterDynamicConfig, domain string, rcode int, ecsGlobal bool) *dns.Msg {
|
2024-01-17 03:36:02 +00:00
|
|
|
m := &dns.Msg{}
|
2024-01-24 20:32:42 +00:00
|
|
|
m.SetRcode(req, rcode)
|
2024-01-17 03:36:02 +00:00
|
|
|
m.Compress = !cfg.DisableCompression
|
|
|
|
m.Authoritative = true
|
2024-01-24 20:32:42 +00:00
|
|
|
m.RecursionAvailable = canRecurse(cfg)
|
|
|
|
if edns := req.IsEdns0(); edns != nil {
|
|
|
|
setEDNS(req, m, ecsGlobal)
|
|
|
|
}
|
2024-01-17 03:36:02 +00:00
|
|
|
|
|
|
|
// We add the SOA on NameErrors
|
2024-01-24 20:32:42 +00:00
|
|
|
soa := makeSOARecord(domain, cfg)
|
2024-01-17 03:36:02 +00:00
|
|
|
m.Ns = append(m.Ns, soa)
|
|
|
|
|
|
|
|
return m
|
|
|
|
}
|
|
|
|
|
2024-01-17 23:46:18 +00:00
|
|
|
// buildAddressResults returns a discovery.Result from a DNS request for addr. records.
|
2024-01-17 03:36:02 +00:00
|
|
|
func buildAddressResults(req *dns.Msg) ([]*discovery.Result, error) {
|
|
|
|
domain := dns.CanonicalName(req.Question[0].Name)
|
|
|
|
labels := dns.SplitDomainName(domain)
|
|
|
|
hexadecimal := labels[0]
|
|
|
|
|
|
|
|
if len(hexadecimal)/2 != 4 && len(hexadecimal)/2 != 16 {
|
|
|
|
return nil, errNameNotFound
|
|
|
|
}
|
|
|
|
|
|
|
|
var ip net.IP
|
|
|
|
ip, err := hex.DecodeString(hexadecimal)
|
|
|
|
if err != nil {
|
|
|
|
return nil, errNameNotFound
|
|
|
|
}
|
|
|
|
|
|
|
|
return []*discovery.Result{
|
|
|
|
{
|
2024-02-03 03:23:52 +00:00
|
|
|
Node: &discovery.Location{
|
|
|
|
Address: ip.String(),
|
|
|
|
},
|
|
|
|
Type: discovery.ResultTypeNode, // We choose node by convention since we do not know the origin of the IP
|
2024-01-17 03:36:02 +00:00
|
|
|
},
|
|
|
|
}, nil
|
|
|
|
}
|
|
|
|
|
2024-01-29 22:33:45 +00:00
|
|
|
// getAnswerAndExtra creates the dns answer and extra from discovery results.
|
2024-02-09 22:41:40 +00:00
|
|
|
func (r *Router) getAnswerExtraAndNs(result *discovery.Result, port discovery.Port, req *dns.Msg, reqCtx Context,
|
2024-01-30 22:34:35 +00:00
|
|
|
query *discovery.Query, cfg *RouterDynamicConfig, domain string, remoteAddress net.Addr,
|
|
|
|
maxRecursionLevel int) (answer []dns.RR, extra []dns.RR, ns []dns.RR) {
|
2024-02-12 19:27:25 +00:00
|
|
|
serviceAddress, nodeAddress := r.getServiceAndNodeAddresses(result, req)
|
2024-01-29 22:33:45 +00:00
|
|
|
qName := req.Question[0].Name
|
|
|
|
ttlLookupName := qName
|
|
|
|
if query != nil {
|
|
|
|
ttlLookupName = query.QueryPayload.Name
|
2024-01-17 03:36:02 +00:00
|
|
|
}
|
2024-02-09 16:26:02 +00:00
|
|
|
|
|
|
|
ttl := getTTLForResult(ttlLookupName, result.DNS.TTL, query, cfg)
|
|
|
|
|
2024-01-17 03:36:02 +00:00
|
|
|
qType := req.Question[0].Qtype
|
|
|
|
|
2024-01-24 20:32:42 +00:00
|
|
|
// TODO (v2-dns): skip records that refer to a workload/node that don't have a valid DNS name.
|
|
|
|
|
|
|
|
// Special case responses
|
2024-01-29 16:40:10 +00:00
|
|
|
switch {
|
|
|
|
// PTR requests are first since they are a special case of domain overriding question type
|
|
|
|
case parseRequestType(req) == requestTypeIP:
|
2024-02-03 03:23:52 +00:00
|
|
|
ptrTarget := ""
|
|
|
|
if result.Type == discovery.ResultTypeNode {
|
|
|
|
ptrTarget = result.Node.Name
|
|
|
|
} else if result.Type == discovery.ResultTypeService {
|
|
|
|
ptrTarget = result.Service.Name
|
|
|
|
}
|
|
|
|
|
2024-01-29 16:40:10 +00:00
|
|
|
ptr := &dns.PTR{
|
|
|
|
Hdr: dns.RR_Header{Name: qName, Rrtype: dns.TypePTR, Class: dns.ClassINET, Ttl: 0},
|
2024-02-09 22:41:40 +00:00
|
|
|
Ptr: canonicalNameForResult(result.Type, ptrTarget, domain, result.Tenancy, port.Name),
|
2024-01-29 16:40:10 +00:00
|
|
|
}
|
2024-01-29 22:33:45 +00:00
|
|
|
answer = append(answer, ptr)
|
2024-01-29 16:40:10 +00:00
|
|
|
case qType == dns.TypeNS:
|
2024-02-08 04:24:00 +00:00
|
|
|
resultType := result.Type
|
|
|
|
target := result.Node.Name
|
|
|
|
if parseRequestType(req) == requestTypeConsul && resultType == discovery.ResultTypeService {
|
|
|
|
resultType = discovery.ResultTypeNode
|
|
|
|
}
|
2024-02-09 22:41:40 +00:00
|
|
|
fqdn := canonicalNameForResult(resultType, target, domain, result.Tenancy, port.Name)
|
2024-02-14 22:38:11 +00:00
|
|
|
extraRecord := makeIPBasedRecord(fqdn, nodeAddress, ttl)
|
2024-01-29 16:40:10 +00:00
|
|
|
|
2024-01-29 22:33:45 +00:00
|
|
|
answer = append(answer, makeNSRecord(domain, fqdn, ttl))
|
|
|
|
extra = append(extra, extraRecord)
|
2024-01-29 16:40:10 +00:00
|
|
|
case qType == dns.TypeSOA:
|
|
|
|
// to be returned in the result.
|
2024-02-09 22:41:40 +00:00
|
|
|
fqdn := canonicalNameForResult(result.Type, result.Node.Name, domain, result.Tenancy, port.Name)
|
2024-02-14 22:38:11 +00:00
|
|
|
extraRecord := makeIPBasedRecord(fqdn, nodeAddress, ttl)
|
2024-01-24 20:32:42 +00:00
|
|
|
|
2024-01-29 22:33:45 +00:00
|
|
|
ns = append(ns, makeNSRecord(domain, fqdn, ttl))
|
|
|
|
extra = append(extra, extraRecord)
|
2024-01-29 16:40:10 +00:00
|
|
|
case qType == dns.TypeSRV:
|
2024-01-17 03:36:02 +00:00
|
|
|
// We put A/AAAA/CNAME records in the additional section for SRV requests
|
2024-02-03 03:23:52 +00:00
|
|
|
a, e := r.getAnswerExtrasForAddressAndTarget(nodeAddress, serviceAddress, req, reqCtx,
|
2024-02-09 22:41:40 +00:00
|
|
|
result, port, ttl, remoteAddress, cfg, domain, maxRecursionLevel)
|
2024-01-29 22:33:45 +00:00
|
|
|
answer = append(answer, a...)
|
|
|
|
extra = append(extra, e...)
|
|
|
|
|
|
|
|
default:
|
2024-02-03 03:23:52 +00:00
|
|
|
a, e := r.getAnswerExtrasForAddressAndTarget(nodeAddress, serviceAddress, req, reqCtx,
|
2024-02-09 22:41:40 +00:00
|
|
|
result, port, ttl, remoteAddress, cfg, domain, maxRecursionLevel)
|
2024-01-29 22:33:45 +00:00
|
|
|
answer = append(answer, a...)
|
|
|
|
extra = append(extra, e...)
|
|
|
|
}
|
2024-02-06 14:53:39 +00:00
|
|
|
|
2024-02-09 22:41:40 +00:00
|
|
|
a, e := getAnswerAndExtraTXT(req, cfg, qName, result, ttl, domain, query, &port)
|
2024-02-06 14:53:39 +00:00
|
|
|
answer = append(answer, a...)
|
|
|
|
extra = append(extra, e...)
|
2024-01-29 22:33:45 +00:00
|
|
|
return
|
|
|
|
}
|
2024-01-17 03:36:02 +00:00
|
|
|
|
2024-02-12 19:27:25 +00:00
|
|
|
// getServiceAndNodeAddresses returns the service and node addresses from a discovery result.
|
|
|
|
func (r *Router) getServiceAndNodeAddresses(result *discovery.Result, req *dns.Msg) (*dnsAddress, *dnsAddress) {
|
|
|
|
addrTranslate := dnsutil.TranslateAddressAcceptDomain
|
|
|
|
if req.Question[0].Qtype == dns.TypeA {
|
|
|
|
addrTranslate |= dnsutil.TranslateAddressAcceptIPv4
|
|
|
|
} else if req.Question[0].Qtype == dns.TypeAAAA {
|
|
|
|
addrTranslate |= dnsutil.TranslateAddressAcceptIPv6
|
|
|
|
} else {
|
|
|
|
addrTranslate |= dnsutil.TranslateAddressAcceptAny
|
|
|
|
}
|
|
|
|
|
|
|
|
// The datacenter should be empty during translation if it is a peering lookup.
|
|
|
|
// This should be fine because we should always prefer the WAN address.
|
|
|
|
serviceAddress := newDNSAddress("")
|
|
|
|
if result.Service != nil {
|
|
|
|
sa := r.translateServiceAddressFunc(result.Tenancy.Datacenter,
|
|
|
|
result.Service.Address, getServiceAddressMapFromLocationMap(result.Service.TaggedAddresses),
|
|
|
|
addrTranslate)
|
|
|
|
serviceAddress = newDNSAddress(sa)
|
|
|
|
}
|
|
|
|
nodeAddress := newDNSAddress("")
|
|
|
|
if result.Node != nil {
|
|
|
|
na := r.translateAddressFunc(result.Tenancy.Datacenter, result.Node.Address,
|
|
|
|
getStringAddressMapFromTaggedAddressMap(result.Node.TaggedAddresses), addrTranslate)
|
|
|
|
nodeAddress = newDNSAddress(na)
|
|
|
|
}
|
|
|
|
return serviceAddress, nodeAddress
|
|
|
|
}
|
|
|
|
|
2024-02-03 03:23:52 +00:00
|
|
|
// getAnswerExtrasForAddressAndTarget creates the dns answer and extra from nodeAddress and serviceAddress dnsAddress pairs.
|
|
|
|
func (r *Router) getAnswerExtrasForAddressAndTarget(nodeAddress *dnsAddress, serviceAddress *dnsAddress, req *dns.Msg,
|
2024-02-09 22:41:40 +00:00
|
|
|
reqCtx Context, result *discovery.Result, port discovery.Port, ttl uint32, remoteAddress net.Addr,
|
2024-02-03 03:23:52 +00:00
|
|
|
cfg *RouterDynamicConfig, domain string, maxRecursionLevel int) (answer []dns.RR, extra []dns.RR) {
|
2024-01-29 22:33:45 +00:00
|
|
|
qName := req.Question[0].Name
|
|
|
|
reqType := parseRequestType(req)
|
|
|
|
|
|
|
|
switch {
|
2024-01-30 22:34:35 +00:00
|
|
|
case (reqType == requestTypeAddress || result.Type == discovery.ResultTypeVirtual) &&
|
2024-02-03 03:23:52 +00:00
|
|
|
serviceAddress.IsEmptyString() && nodeAddress.IsIP():
|
2024-02-09 22:41:40 +00:00
|
|
|
a, e := getAnswerExtrasForIP(qName, nodeAddress, req.Question[0], reqType, result, ttl, domain, &port)
|
2024-02-03 03:23:52 +00:00
|
|
|
answer = append(answer, a...)
|
|
|
|
extra = append(extra, e...)
|
|
|
|
|
2024-02-06 15:16:02 +00:00
|
|
|
case result.Type == discovery.ResultTypeNode && nodeAddress.IsIP():
|
2024-02-09 22:41:40 +00:00
|
|
|
canonicalNodeName := canonicalNameForResult(result.Type, result.Node.Name, domain, result.Tenancy, port.Name)
|
2024-02-03 03:23:52 +00:00
|
|
|
a, e := getAnswerExtrasForIP(canonicalNodeName, nodeAddress, req.Question[0], reqType,
|
2024-02-09 22:41:40 +00:00
|
|
|
result, ttl, domain, &port)
|
2024-02-03 03:23:52 +00:00
|
|
|
answer = append(answer, a...)
|
|
|
|
extra = append(extra, e...)
|
|
|
|
|
2024-02-06 15:16:02 +00:00
|
|
|
case result.Type == discovery.ResultTypeNode && !nodeAddress.IsIP():
|
2024-02-09 22:41:40 +00:00
|
|
|
a, e := r.makeRecordFromFQDN(result, req, reqCtx, cfg,
|
|
|
|
ttl, remoteAddress, maxRecursionLevel, serviceAddress.FQDN(), &port)
|
2024-02-06 15:16:02 +00:00
|
|
|
answer = append(answer, a...)
|
|
|
|
extra = append(extra, e...)
|
|
|
|
|
2024-02-03 03:23:52 +00:00
|
|
|
case serviceAddress.IsEmptyString() && nodeAddress.IsEmptyString():
|
|
|
|
return nil, nil
|
|
|
|
|
|
|
|
// There is no service address and the node address is an IP
|
|
|
|
case serviceAddress.IsEmptyString() && nodeAddress.IsIP():
|
2024-02-09 22:41:40 +00:00
|
|
|
resultType := discovery.ResultTypeNode
|
|
|
|
if result.Type == discovery.ResultTypeWorkload {
|
|
|
|
resultType = discovery.ResultTypeWorkload
|
|
|
|
}
|
|
|
|
canonicalNodeName := canonicalNameForResult(resultType, result.Node.Name, domain, result.Tenancy, port.Name)
|
|
|
|
a, e := getAnswerExtrasForIP(canonicalNodeName, nodeAddress, req.Question[0], reqType, result, ttl, domain, &port)
|
2024-02-03 03:23:52 +00:00
|
|
|
answer = append(answer, a...)
|
|
|
|
extra = append(extra, e...)
|
|
|
|
|
|
|
|
// There is no service address and the node address is a FQDN (external service)
|
|
|
|
case serviceAddress.IsEmptyString():
|
2024-02-09 22:41:40 +00:00
|
|
|
a, e := r.makeRecordFromFQDN(result, req, reqCtx, cfg, ttl, remoteAddress, maxRecursionLevel, nodeAddress.FQDN(), &port)
|
2024-02-03 03:23:52 +00:00
|
|
|
answer = append(answer, a...)
|
|
|
|
extra = append(extra, e...)
|
|
|
|
|
|
|
|
// The service address is an IP
|
|
|
|
case serviceAddress.IsIP():
|
2024-02-09 22:41:40 +00:00
|
|
|
canonicalServiceName := canonicalNameForResult(discovery.ResultTypeService, result.Service.Name, domain, result.Tenancy, port.Name)
|
|
|
|
a, e := getAnswerExtrasForIP(canonicalServiceName, serviceAddress, req.Question[0], reqType, result, ttl, domain, &port)
|
2024-01-29 22:33:45 +00:00
|
|
|
answer = append(answer, a...)
|
|
|
|
extra = append(extra, e...)
|
|
|
|
|
2024-02-03 03:23:52 +00:00
|
|
|
// If the service address is a CNAME for the service we are looking
|
|
|
|
// for then use the node address.
|
|
|
|
case serviceAddress.FQDN() == req.Question[0].Name && nodeAddress.IsIP():
|
2024-02-09 22:41:40 +00:00
|
|
|
canonicalNodeName := canonicalNameForResult(discovery.ResultTypeNode, result.Node.Name, domain, result.Tenancy, port.Name)
|
|
|
|
a, e := getAnswerExtrasForIP(canonicalNodeName, nodeAddress, req.Question[0], reqType, result, ttl, domain, &port)
|
2024-02-03 03:23:52 +00:00
|
|
|
answer = append(answer, a...)
|
|
|
|
extra = append(extra, e...)
|
|
|
|
|
|
|
|
// The service address is a FQDN (internal or external service name)
|
2024-01-29 22:33:45 +00:00
|
|
|
default:
|
2024-02-09 22:41:40 +00:00
|
|
|
a, e := r.makeRecordFromFQDN(result, req, reqCtx, cfg, ttl, remoteAddress, maxRecursionLevel, serviceAddress.FQDN(), &port)
|
2024-02-03 03:23:52 +00:00
|
|
|
answer = append(answer, a...)
|
|
|
|
extra = append(extra, e...)
|
2024-01-17 03:36:02 +00:00
|
|
|
}
|
2024-02-06 14:53:39 +00:00
|
|
|
|
2024-01-29 22:33:45 +00:00
|
|
|
return
|
|
|
|
}
|
|
|
|
|
2024-02-06 14:53:39 +00:00
|
|
|
// getAnswerAndExtraTXT determines whether a TXT needs to be create and then
|
|
|
|
// returns the TXT record in the answer or extra depending on the question type.
|
|
|
|
func getAnswerAndExtraTXT(req *dns.Msg, cfg *RouterDynamicConfig, qName string,
|
2024-02-09 22:41:40 +00:00
|
|
|
result *discovery.Result, ttl uint32, domain string, query *discovery.Query, port *discovery.Port) (answer []dns.RR, extra []dns.RR) {
|
2024-02-08 04:24:00 +00:00
|
|
|
if !shouldAppendTXTRecord(query, cfg, req) {
|
|
|
|
return
|
|
|
|
}
|
2024-02-06 14:53:39 +00:00
|
|
|
recordHeaderName := qName
|
|
|
|
serviceAddress := newDNSAddress("")
|
|
|
|
if result.Service != nil {
|
|
|
|
serviceAddress = newDNSAddress(result.Service.Address)
|
|
|
|
}
|
|
|
|
if result.Type != discovery.ResultTypeNode &&
|
|
|
|
result.Type != discovery.ResultTypeVirtual &&
|
|
|
|
!serviceAddress.IsInternalFQDN(domain) &&
|
|
|
|
!serviceAddress.IsExternalFQDN(domain) {
|
|
|
|
recordHeaderName = canonicalNameForResult(discovery.ResultTypeNode, result.Node.Name,
|
2024-02-09 22:41:40 +00:00
|
|
|
domain, result.Tenancy, port.Name)
|
2024-02-06 14:53:39 +00:00
|
|
|
}
|
|
|
|
qType := req.Question[0].Qtype
|
|
|
|
generateMeta := false
|
|
|
|
metaInAnswer := false
|
|
|
|
if qType == dns.TypeANY || qType == dns.TypeTXT {
|
|
|
|
generateMeta = true
|
|
|
|
metaInAnswer = true
|
|
|
|
} else if cfg.NodeMetaTXT {
|
|
|
|
generateMeta = true
|
|
|
|
}
|
|
|
|
|
|
|
|
// Do not generate txt records if we don't have to: https://github.com/hashicorp/consul/pull/5272
|
|
|
|
if generateMeta {
|
|
|
|
meta := makeTXTRecord(recordHeaderName, result, ttl)
|
|
|
|
if metaInAnswer {
|
|
|
|
answer = append(answer, meta...)
|
|
|
|
} else {
|
|
|
|
extra = append(extra, meta...)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return answer, extra
|
|
|
|
}
|
|
|
|
|
2024-02-08 04:24:00 +00:00
|
|
|
// shouldAppendTXTRecord determines whether a TXT record should be appended to the response.
|
|
|
|
func shouldAppendTXTRecord(query *discovery.Query, cfg *RouterDynamicConfig, req *dns.Msg) bool {
|
|
|
|
qType := req.Question[0].Qtype
|
|
|
|
switch {
|
|
|
|
// Node records
|
|
|
|
case query != nil && query.QueryType == discovery.QueryTypeNode && (cfg.NodeMetaTXT || qType == dns.TypeANY || qType == dns.TypeTXT):
|
|
|
|
return true
|
|
|
|
// Service records
|
|
|
|
case query != nil && query.QueryType == discovery.QueryTypeService && cfg.NodeMetaTXT && qType == dns.TypeSRV:
|
|
|
|
return true
|
|
|
|
// Prepared query records
|
|
|
|
case query != nil && query.QueryType == discovery.QueryTypePreparedQuery && cfg.NodeMetaTXT && qType == dns.TypeSRV:
|
|
|
|
return true
|
|
|
|
}
|
|
|
|
return false
|
|
|
|
}
|
|
|
|
|
2024-01-30 22:34:35 +00:00
|
|
|
// getAnswerExtrasForIP creates the dns answer and extra from IP dnsAddress pairs.
|
|
|
|
func getAnswerExtrasForIP(name string, addr *dnsAddress, question dns.Question,
|
2024-02-09 22:41:40 +00:00
|
|
|
reqType requestType, result *discovery.Result, ttl uint32, domain string, port *discovery.Port) (answer []dns.RR, extra []dns.RR) {
|
2024-01-29 22:33:45 +00:00
|
|
|
qType := question.Qtype
|
2024-02-09 02:56:04 +00:00
|
|
|
canReturnARecord := qType == dns.TypeSRV || qType == dns.TypeA || qType == dns.TypeANY || qType == dns.TypeNS || qType == dns.TypeTXT
|
|
|
|
canReturnAAAARecord := qType == dns.TypeSRV || qType == dns.TypeAAAA || qType == dns.TypeANY || qType == dns.TypeNS || qType == dns.TypeTXT
|
2024-02-12 19:27:25 +00:00
|
|
|
if reqType != requestTypeAddress && result.Type != discovery.ResultTypeVirtual {
|
2024-02-09 02:56:04 +00:00
|
|
|
switch {
|
|
|
|
// check IPV4
|
|
|
|
case addr.IsIP() && addr.IsIPV4() && !canReturnARecord,
|
|
|
|
// check IPV6
|
|
|
|
addr.IsIP() && !addr.IsIPV4() && !canReturnAAAARecord:
|
|
|
|
return
|
|
|
|
}
|
|
|
|
}
|
2024-01-29 22:33:45 +00:00
|
|
|
|
2024-01-30 22:34:35 +00:00
|
|
|
// Have to pass original question name here even if the system has recursed
|
|
|
|
// and stripped off the domain suffix.
|
|
|
|
recHdrName := question.Name
|
|
|
|
if qType == dns.TypeSRV {
|
2024-02-03 03:23:52 +00:00
|
|
|
nameSplit := strings.Split(name, ".")
|
|
|
|
if len(nameSplit) > 1 && nameSplit[1] == addrLabel {
|
|
|
|
recHdrName = name
|
|
|
|
} else {
|
|
|
|
recHdrName = name
|
|
|
|
}
|
|
|
|
name = question.Name
|
2024-01-30 22:34:35 +00:00
|
|
|
}
|
2024-02-03 03:23:52 +00:00
|
|
|
|
2024-02-09 02:56:04 +00:00
|
|
|
if reqType != requestTypeAddress && qType == dns.TypeSRV {
|
2024-02-12 19:27:25 +00:00
|
|
|
if result.Type == discovery.ResultTypeService && addr.IsIP() && result.Node.Address != addr.String() {
|
2024-02-09 02:56:04 +00:00
|
|
|
// encode the ip to be used in the header of the A/AAAA record
|
|
|
|
// as well as the target of the SRV record.
|
|
|
|
recHdrName = encodeIPAsFqdn(result, addr.IP(), domain)
|
|
|
|
}
|
2024-02-09 22:41:40 +00:00
|
|
|
if result.Type == discovery.ResultTypeWorkload {
|
|
|
|
recHdrName = canonicalNameForResult(result.Type, result.Node.Name, domain, result.Tenancy, port.Name)
|
|
|
|
}
|
|
|
|
srv := makeSRVRecord(name, recHdrName, result, ttl, port)
|
2024-02-09 02:56:04 +00:00
|
|
|
answer = append(answer, srv)
|
|
|
|
}
|
|
|
|
|
2024-01-30 22:34:35 +00:00
|
|
|
record := makeIPBasedRecord(recHdrName, addr, ttl)
|
|
|
|
|
2024-01-29 22:33:45 +00:00
|
|
|
isARecordWhenNotExplicitlyQueried := record.Header().Rrtype == dns.TypeA && qType != dns.TypeA && qType != dns.TypeANY
|
|
|
|
isAAAARecordWhenNotExplicitlyQueried := record.Header().Rrtype == dns.TypeAAAA && qType != dns.TypeAAAA && qType != dns.TypeANY
|
2024-01-17 03:36:02 +00:00
|
|
|
|
|
|
|
// For explicit A/AAAA queries, we must only return those records in the answer section.
|
2024-01-29 22:33:45 +00:00
|
|
|
if isARecordWhenNotExplicitlyQueried ||
|
|
|
|
isAAAARecordWhenNotExplicitlyQueried {
|
|
|
|
extra = append(extra, record)
|
|
|
|
} else {
|
|
|
|
answer = append(answer, record)
|
2024-01-17 03:36:02 +00:00
|
|
|
}
|
|
|
|
|
2024-01-29 22:33:45 +00:00
|
|
|
return
|
2024-01-17 03:36:02 +00:00
|
|
|
}
|
|
|
|
|
2024-02-03 03:23:52 +00:00
|
|
|
// encodeIPAsFqdn encodes an IP address as a FQDN.
|
|
|
|
func encodeIPAsFqdn(result *discovery.Result, ip net.IP, responseDomain string) string {
|
|
|
|
ipv4 := ip.To4()
|
|
|
|
ipStr := hex.EncodeToString(ip)
|
|
|
|
if ipv4 != nil {
|
|
|
|
ipStr = ipStr[len(ipStr)-(net.IPv4len*2):]
|
|
|
|
}
|
|
|
|
if result.Tenancy.PeerName != "" {
|
|
|
|
// Exclude the datacenter from the FQDN on the addr for peers.
|
|
|
|
// This technically makes no difference, since the addr endpoint ignores the DC
|
|
|
|
// component of the request, but do it anyway for a less confusing experience.
|
|
|
|
return fmt.Sprintf("%s.addr.%s", ipStr, responseDomain)
|
|
|
|
}
|
|
|
|
return fmt.Sprintf("%s.addr.%s.%s", ipStr, result.Tenancy.Datacenter, responseDomain)
|
|
|
|
}
|
|
|
|
|
2024-01-24 20:32:42 +00:00
|
|
|
func makeSOARecord(domain string, cfg *RouterDynamicConfig) dns.RR {
|
|
|
|
return &dns.SOA{
|
|
|
|
Hdr: dns.RR_Header{
|
|
|
|
Name: domain,
|
|
|
|
Rrtype: dns.TypeSOA,
|
|
|
|
Class: dns.ClassINET,
|
|
|
|
// Has to be consistent with MinTTL to avoid invalidation
|
|
|
|
Ttl: cfg.SOAConfig.Minttl,
|
|
|
|
},
|
|
|
|
Ns: "ns." + domain,
|
|
|
|
Serial: uint32(time.Now().Unix()),
|
|
|
|
Mbox: "hostmaster." + domain,
|
|
|
|
Refresh: cfg.SOAConfig.Refresh,
|
|
|
|
Retry: cfg.SOAConfig.Retry,
|
|
|
|
Expire: cfg.SOAConfig.Expire,
|
|
|
|
Minttl: cfg.SOAConfig.Minttl,
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
func makeNSRecord(domain, fqdn string, ttl uint32) dns.RR {
|
|
|
|
return &dns.NS{
|
|
|
|
Hdr: dns.RR_Header{
|
|
|
|
Name: domain,
|
|
|
|
Rrtype: dns.TypeNS,
|
|
|
|
Class: dns.ClassINET,
|
|
|
|
Ttl: ttl,
|
|
|
|
},
|
|
|
|
Ns: fqdn,
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2024-01-29 22:33:45 +00:00
|
|
|
// makeIPBasedRecord an A or AAAA record for the given name and IP.
|
2024-01-17 03:36:02 +00:00
|
|
|
// Note: we might want to pass in the Query Name here, which is used in addr. and virtual. queries
|
|
|
|
// since there is only ever one result. Right now choosing to leave it off for simplification.
|
2024-01-29 22:33:45 +00:00
|
|
|
func makeIPBasedRecord(name string, addr *dnsAddress, ttl uint32) dns.RR {
|
2024-01-17 03:36:02 +00:00
|
|
|
|
2024-01-29 22:33:45 +00:00
|
|
|
if addr.IsIPV4() {
|
2024-01-17 03:36:02 +00:00
|
|
|
// check if the query type is A for IPv4 or ANY
|
|
|
|
return &dns.A{
|
|
|
|
Hdr: dns.RR_Header{
|
|
|
|
Name: name,
|
|
|
|
Rrtype: dns.TypeA,
|
|
|
|
Class: dns.ClassINET,
|
|
|
|
Ttl: ttl,
|
|
|
|
},
|
2024-01-29 22:33:45 +00:00
|
|
|
A: addr.IP(),
|
|
|
|
}
|
2024-01-17 03:36:02 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
return &dns.AAAA{
|
|
|
|
Hdr: dns.RR_Header{
|
|
|
|
Name: name,
|
|
|
|
Rrtype: dns.TypeAAAA,
|
|
|
|
Class: dns.ClassINET,
|
|
|
|
Ttl: ttl,
|
|
|
|
},
|
2024-01-29 22:33:45 +00:00
|
|
|
AAAA: addr.IP(),
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2024-02-09 22:41:40 +00:00
|
|
|
func (r *Router) makeRecordFromFQDN(result *discovery.Result, req *dns.Msg, reqCtx Context, cfg *RouterDynamicConfig, ttl uint32, remoteAddress net.Addr, maxRecursionLevel int, fqdn string, port *discovery.Port) ([]dns.RR, []dns.RR) {
|
2024-01-29 22:33:45 +00:00
|
|
|
edns := req.IsEdns0() != nil
|
|
|
|
q := req.Question[0]
|
|
|
|
|
|
|
|
more := r.resolveCNAME(cfg, dns.Fqdn(fqdn), reqCtx, remoteAddress, maxRecursionLevel)
|
|
|
|
var additional []dns.RR
|
|
|
|
extra := 0
|
|
|
|
MORE_REC:
|
|
|
|
for _, rr := range more {
|
|
|
|
switch rr.Header().Rrtype {
|
2024-02-06 15:16:02 +00:00
|
|
|
case dns.TypeCNAME, dns.TypeA, dns.TypeAAAA, dns.TypeTXT:
|
2024-01-29 22:33:45 +00:00
|
|
|
// set the TTL manually
|
|
|
|
rr.Header().Ttl = ttl
|
|
|
|
additional = append(additional, rr)
|
|
|
|
|
|
|
|
extra++
|
|
|
|
if extra == maxRecurseRecords && !edns {
|
|
|
|
break MORE_REC
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
if q.Qtype == dns.TypeSRV {
|
2024-02-09 22:41:40 +00:00
|
|
|
answer := makeSRVRecord(q.Name, fqdn, result, ttl, port)
|
|
|
|
return []dns.RR{answer}, additional
|
2024-01-29 22:33:45 +00:00
|
|
|
}
|
|
|
|
|
2024-02-03 03:23:52 +00:00
|
|
|
address := ""
|
|
|
|
if result.Service != nil && result.Service.Address != "" {
|
|
|
|
address = result.Service.Address
|
|
|
|
} else if result.Node != nil {
|
|
|
|
address = result.Node.Address
|
|
|
|
}
|
|
|
|
|
2024-01-29 22:33:45 +00:00
|
|
|
answers := []dns.RR{
|
2024-02-03 03:23:52 +00:00
|
|
|
makeCNAMERecord(q.Name, address, ttl),
|
2024-01-29 22:33:45 +00:00
|
|
|
}
|
|
|
|
answers = append(answers, additional...)
|
|
|
|
|
|
|
|
return answers, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// makeCNAMERecord returns a CNAME record for the given name and target.
|
2024-01-30 22:34:35 +00:00
|
|
|
func makeCNAMERecord(name string, target string, ttl uint32) *dns.CNAME {
|
2024-01-29 22:33:45 +00:00
|
|
|
return &dns.CNAME{
|
|
|
|
Hdr: dns.RR_Header{
|
2024-01-30 22:34:35 +00:00
|
|
|
Name: name,
|
2024-01-29 22:33:45 +00:00
|
|
|
Rrtype: dns.TypeCNAME,
|
|
|
|
Class: dns.ClassINET,
|
|
|
|
Ttl: ttl,
|
|
|
|
},
|
2024-01-30 22:34:35 +00:00
|
|
|
Target: dns.Fqdn(target),
|
2024-01-29 22:33:45 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// func makeSRVRecord returns an SRV record for the given name and target.
|
2024-02-09 22:41:40 +00:00
|
|
|
func makeSRVRecord(name, target string, result *discovery.Result, ttl uint32, port *discovery.Port) *dns.SRV {
|
2024-01-29 22:33:45 +00:00
|
|
|
return &dns.SRV{
|
|
|
|
Hdr: dns.RR_Header{
|
|
|
|
Name: name,
|
|
|
|
Rrtype: dns.TypeSRV,
|
|
|
|
Class: dns.ClassINET,
|
|
|
|
Ttl: ttl,
|
|
|
|
},
|
|
|
|
Priority: 1,
|
2024-02-09 16:26:02 +00:00
|
|
|
Weight: uint16(result.DNS.Weight),
|
2024-02-09 22:41:40 +00:00
|
|
|
Port: uint16(port.Number),
|
2024-01-29 22:33:45 +00:00
|
|
|
Target: target,
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// encodeKVasRFC1464 encodes a key-value pair according to RFC1464
|
|
|
|
func encodeKVasRFC1464(key, value string) (txt string) {
|
|
|
|
// For details on these replacements c.f. https://www.ietf.org/rfc/rfc1464.txt
|
|
|
|
key = strings.Replace(key, "`", "``", -1)
|
|
|
|
key = strings.Replace(key, "=", "`=", -1)
|
|
|
|
|
|
|
|
// Backquote the leading spaces
|
|
|
|
leadingSpacesRE := regexp.MustCompile("^ +")
|
|
|
|
numLeadingSpaces := len(leadingSpacesRE.FindString(key))
|
|
|
|
key = leadingSpacesRE.ReplaceAllString(key, strings.Repeat("` ", numLeadingSpaces))
|
|
|
|
|
|
|
|
// Backquote the trailing spaces
|
|
|
|
numTrailingSpaces := len(trailingSpacesRE.FindString(key))
|
|
|
|
key = trailingSpacesRE.ReplaceAllString(key, strings.Repeat("` ", numTrailingSpaces))
|
|
|
|
|
|
|
|
value = strings.Replace(value, "`", "``", -1)
|
|
|
|
|
|
|
|
return key + "=" + value
|
|
|
|
}
|
|
|
|
|
|
|
|
// makeTXTRecord returns a TXT record for the given name and result metadata.
|
|
|
|
func makeTXTRecord(name string, result *discovery.Result, ttl uint32) []dns.RR {
|
|
|
|
extra := make([]dns.RR, 0, len(result.Metadata))
|
|
|
|
for key, value := range result.Metadata {
|
|
|
|
txt := value
|
|
|
|
if !strings.HasPrefix(strings.ToLower(key), "rfc1035-") {
|
|
|
|
txt = encodeKVasRFC1464(key, value)
|
|
|
|
}
|
|
|
|
|
|
|
|
extra = append(extra, &dns.TXT{
|
|
|
|
Hdr: dns.RR_Header{
|
|
|
|
Name: name,
|
|
|
|
Rrtype: dns.TypeTXT,
|
|
|
|
Class: dns.ClassINET,
|
|
|
|
Ttl: ttl,
|
|
|
|
},
|
|
|
|
Txt: []string{txt},
|
|
|
|
})
|
|
|
|
}
|
|
|
|
return extra
|
|
|
|
}
|
2024-02-14 17:40:38 +00:00
|
|
|
|
|
|
|
// canonicalNameForResult returns the canonical name for a discovery result.
|
|
|
|
func canonicalNameForResult(resultType discovery.ResultType, target, domain string,
|
|
|
|
tenancy discovery.ResultTenancy, portName string) string {
|
|
|
|
switch resultType {
|
|
|
|
case discovery.ResultTypeService:
|
|
|
|
if tenancy.Namespace != "" {
|
|
|
|
return fmt.Sprintf("%s.%s.%s.%s.%s", target, "service", tenancy.Namespace, tenancy.Datacenter, domain)
|
|
|
|
}
|
|
|
|
return fmt.Sprintf("%s.%s.%s.%s", target, "service", tenancy.Datacenter, domain)
|
|
|
|
case discovery.ResultTypeNode:
|
|
|
|
if tenancy.PeerName != "" && tenancy.Partition != "" {
|
|
|
|
// We must return a more-specific DNS name for peering so
|
|
|
|
// that there is no ambiguity with lookups.
|
|
|
|
// Nodes are always registered in the default namespace, so
|
|
|
|
// the `.ns` qualifier is not required.
|
|
|
|
return fmt.Sprintf("%s.node.%s.peer.%s.ap.%s",
|
|
|
|
target,
|
|
|
|
tenancy.PeerName,
|
|
|
|
tenancy.Partition,
|
|
|
|
domain)
|
|
|
|
}
|
|
|
|
if tenancy.PeerName != "" {
|
|
|
|
// We must return a more-specific DNS name for peering so
|
|
|
|
// that there is no ambiguity with lookups.
|
|
|
|
return fmt.Sprintf("%s.node.%s.peer.%s",
|
|
|
|
target,
|
|
|
|
tenancy.PeerName,
|
|
|
|
domain)
|
|
|
|
}
|
|
|
|
// Return a simpler format for non-peering nodes.
|
|
|
|
return fmt.Sprintf("%s.node.%s.%s", target, tenancy.Datacenter, domain)
|
|
|
|
case discovery.ResultTypeWorkload:
|
|
|
|
// TODO (v2-dns): it doesn't appear this is being used to return a result. Need to investigate and refactor
|
|
|
|
if portName != "" {
|
|
|
|
return fmt.Sprintf("%s.port.%s.workload.%s.ns.%s.ap.%s", portName, target, tenancy.Namespace, tenancy.Partition, domain)
|
|
|
|
}
|
|
|
|
return fmt.Sprintf("%s.workload.%s.ns.%s.ap.%s", target, tenancy.Namespace, tenancy.Partition, domain)
|
|
|
|
}
|
|
|
|
return ""
|
|
|
|
}
|