The health endpoint histogram has a large amount of cardinality for a
simple endpoint. Introduce a new "Slim" set of buckets for `/health` to
reduce the metrics load on large deployments. Especially those that have
per-node DNS caching services.
Add a metric to count internal health check failures rather than use the
timeout value as side effect monitor of the check error. This avoids
incorrectly recording the timeout value if there is an error that is not
a timeout (ex. refused)
Signed-off-by: SuperQ <superq@gmail.com>
* deprecate normalize and mustnormalize
Signed-off-by: Chris O'Haver <cohaver@infoblox.com>
* add runtime warning
Signed-off-by: Chris O'Haver <cohaver@infoblox.com>
* elaborate runtime warning
Signed-off-by: Chris O'Haver <cohaver@infoblox.com>
* include caller info
Signed-off-by: Chris O'Haver <cohaver@infoblox.com>
* trap unsupported FROM cidr notations
Signed-off-by: Chris O'Haver <cohaver@infoblox.com>
* make is a warning
Signed-off-by: Chris O'Haver <cohaver@infoblox.com>
This was found by fuzzing.
We need to make this a fully qualified domain name to catch all errors
in dnsserver/register.go and not later when plugin.Normalize() is called again on these
strings, with the prime difference being that the domain name is fully
qualified. This was found by fuzzing where "ȶ" is deemed OK, but "ȶ." is
not (might be a bug in miekg/dns actually). But here we were checking ȶ,
which is OK, and later we barf in ȶ. leading to "index out of range".
Added a tests and check manually if it would crash with the current code
(yes), and fail with an error in this PR (yes).
Signed-off-by: Miek Gieben <miek@miek.nl>
* plugin/file: Fix in wrong answers returned when wildcard and concrete records exist
Signed-off-by: Jason Du <xdu@infoblox.com>
* Remove superfluous change
Signed-off-by: Jason Du <xdu@infoblox.com>
* Re-implementation and new test case
If the domain's terminal is neither the matching wildcard, nor a domian directly
under the wildcard, return NXDOMAIN
Signed-off-by: Jason Du <xdu@infoblox.com>
* Fix empty non-terminal & add test case
Signed-off-by: Jason Du <xdu@infoblox.com>
* Cleanup
Signed-off-by: Jason Du <xdu@infoblox.com>
* Fix case on domain name with character before * and add more test cases
Signed-off-by: Jason Du <xdu@infoblox.com>
* Use different IPs for records in cornerCasesWildcard zone file
Signed-off-by: Jason Du <xdu@infoblox.com>
Make normalize return multiple "hosts" (= reverse zones) when a
non-octet boundary cidr is given.
Added pkg/cidr package that holds the cidr calculation routines; felt
they didn't really fit dnsutil.
This change means the IPNet return parameter isn't needed, the hosts are
all correct. The tests that tests this is also removed: TestSplitHostPortReverse
The fallout was that zoneAddr _also_ doesn't need the IPNet member, that
in turn make it visible that zoneAddr in address.go duplicated a bunch
of stuff from register.go; removed/refactored that too.
Created a plugin.OriginsFromArgsOrServerBlock to help plugins do the
right things, by consuming ZONE arguments; this now expands reverse
zones correctly. This is mostly mechanical.
Remove the reverse test in plugin/kubernetes which is a copy-paste from
a core test (which has since been fixed).
Remove MustNormalize as it has no plugin users.
This change is not backwards compatible to plugins that have a ZONE
argument that they parse in the setup util.
All in-tree plugins have been updated.
Signed-off-by: Miek Gieben <miek@miek.nl>
* core: fix v4 non-octet reverse zones
This fixes the reverse zones handling. Add expanstion of the reverse
notation to all octet boundary subnets and add those to the config - just as if
they were directly typed in the config.
This takes inspiration from #4501, but that (even with DCO!!) seems to
be just using https://github.com/apparentlymart/go-cidr/ so use that
instead - I think a minor function is still needed that one is copied
from #4501.
Also sort the zones we are listing on startup - caught in this PR
because of the expanded zones being not listed next to each other.
This also removes the need for FilterFunc from the config, so this is
now gone as well, making the whole thing slightly more efficient.
Add couple of reverse unit tests and a e2e test that queries for the
correct (and incorrect) reverse zones and checks the reply.
Closes: #4501Fixes: #2779
Signed-off-by: Miek Gieben <miek@miek.nl>
* Add more test cases
Add test from origin bug report: #2779
Signed-off-by: Miek Gieben <miek@miek.nl>
* Rebase and fix conflicts
Signed-off-by: Miek Gieben <miek@miek.nl>
The following test failure for `TestZoneReload` can be observed
periodically:
`file_reload_test.go:58: Expected two RR in answer section got 2`
This failure can be consistently reproduced using the following command
(on my machine, at least):
`( cd test ; go test -v -race -run "TestZoneReload" ./... -count=500)`
test/file_reload_test.go:
Address a typo in a test failure message.
Sleep for double the file reload interval to avoid a rare
race condition between test code and the file plugin's reload code,
which is presumably a result of the time it takes to actually reload.
Signed-off-by: Stephen Greene <sgreene@redhat.com>
* support v1 and v1beta1 endpointslice
Signed-off-by: Chris O'Haver <cohaver@infoblox.com>
* update comments
Signed-off-by: Chris O'Haver <cohaver@infoblox.com>
* fix SOA response for non-apex queries
Signed-off-by: Chris O'Haver <cohaver@infoblox.com>
* handle mixed case
Signed-off-by: Chris O'Haver <cohaver@infoblox.com>
* do full string compare
Signed-off-by: Chris O'Haver <cohaver@infoblox.com>
* plugin/rewrite: streamline the ResponseRule handling.
The functionality of a response rule is now completely encapsulated behind
a `ResponseRule` interface. This significantly simplifies the complete
processing flow, it enables more flexible response handling and it is possible
to eliminate lots of state flags, ifs and switches.
Based on the new flexibility the pull request also enables to support a
response name rewrite for all name rewrite types.
To be compatible, an explicit `answer auto` option is added to support
a best effort response rewrite (name and value).
Additionally now all name rewrite rules support additional name and value
reponse rewrite options.
Using this feature it is also possible now to rewrite a complete sub domain
hierarchy to a single domain name combined with a correct rewrite (#2389).
Signed-off-by: Uwe Krueger <uwe.krueger@sap.com>
* revert policy
Signed-off-by: Uwe Krueger <uwe.krueger@sap.com>
Co-authored-by: Miek Gieben <miek@miek.nl>
