Hello, This is v2 of the UDP-to-TCP DNS fallback series. Thanks to Christopher for the detailed review of v1.
The previous version and its review are available here: https://www.mail-archive.com/[email protected]/msg47409.html https://www.mail-archive.com/[email protected]/msg47432.html Unprefixed IPv4, IPv6 and hostname nameservers use UDP normally. When a validated response is truncated, HAProxy retries the same question over TCP against the same nameserver. Explicit datagram prefixes remain UDP-only, while explicit stream prefixes remain TCP-only. TCP connections are established lazily through the existing DNS stream code. The returned question name, class and type are validated before acting on TC. A and AAAA remain compatible for address resolutions so a late response received after a query-type switch is still usable. The accepted_payload_size setting remains the EDNS advertisement and UDP receive limit. Stream responses are accepted up to the DNS protocol maximum. Christopher also noticed an existing issue in the explicit TCP nameserver setup: after parse_server() appends a server, the code uses proxy_first_server() instead of proxy_last_server(). He indicated that he would fix this separately, so that change is not included here. The fallback helper selects the newly appended server, but a mixed section with a later explicit tcp@ nameserver remains affected until that fix lands. Changes since v1: - Rebased on master and dropped the response-boundary, idle-task and nameserver-cleanup patches which were merged separately. - Split empty truncated-response classification, DNS message-size constant cleanup and response-buffer cleanup into separate patches. - Report explicit address type selection from str2sa_range() instead of matching address prefixes again in the resolver parser. - Rename the transport selector to dns_server_type, add predicates and separate the server-selection API change from fallback behavior. - Move the stream response-size behavior into a dedicated patch. - Infer fallback capability from the datagram and stream servers, and drop the extra flag, reverse reference and special snd_error update. - Validate the returned question class and type while preserving late A and AAAA responses. - Tag the standard-library-only Python regtest as devel and retain its python3 feature guard. - Extend the regression coverage for family-only prefixes, late responses, invalid questions, truncated TCP responses, unavailable TCP endpoints and the Prometheus metric. Thanks, Manu Manu Nicolas (8): BUG/MINOR: resolvers: classify empty truncated responses CLEANUP: dns: use a single maximum DNS message size CLEANUP: resolvers: stop clearing the DNS response buffer MINOR: tools: report explicit address type selection MINOR: dns: select the nameserver server type explicitly MEDIUM: resolvers: accept full-size DNS messages over streams MEDIUM: resolvers: retry truncated UDP responses over TCP REGTEST: resolvers: cover UDP to TCP fallback addons/promex/README | 1 + doc/configuration.txt | 35 +++- include/haproxy/dns-t.h | 16 +- include/haproxy/dns.h | 22 ++- include/haproxy/resolvers-t.h | 8 +- include/haproxy/tools-t.h | 5 +- reg-tests/contrib/prometheus.vtc | 1 + reg-tests/resolvers/tcp_fallback.py | 182 ++++++++++++++++++ reg-tests/resolvers/tcp_fallback.vtc | 174 +++++++++++++++++ src/dns.c | 36 ++-- src/resolvers.c | 268 ++++++++++++++++++++------- src/tools.c | 18 ++ 12 files changed, 663 insertions(+), 103 deletions(-) create mode 100644 reg-tests/resolvers/tcp_fallback.py create mode 100644 reg-tests/resolvers/tcp_fallback.vtc base-commit: d2a40adda9715c20f5c5e188d5fa5995dc5524e9 -- 2.55.0
