BUG/MINOR: resolvers: warn about ignored arguments on datagram nameservers

Since TCP nameservers were supported, the "nameserver" line accepts server
keywords after the address (e.g. "ssl", "verify"), which are parsed by
parse_server() for "tcp@" addresses. For datagram nameservers these
arguments are silently ignored. A typo such as forgetting the "tcp@"
prefix on "nameserver ns1 1.2.3.4:853 ssl verify none" thus results in
plain DNS being sent over UDP to the DoT port (and, since commit bc20f8c0b
("MEDIUM: resolvers: retry truncated UDP responses over TCP"), over plain
TCP for fallback queries) without any notice.

Let's emit a warning when arguments follow the address of a datagram
nameserver. A warning rather than an error is used so as not to break
existing configurations.

This patch may be backported to stable branches.

diff --git a/doc/configuration.txt b/doc/configuration.txt
index 1c10ef62ad87b170078cc2f2ea2ccd57f0bfcb97..dc8a2c3f019b1bdc5b13cd89876bde805580dee6 100644 (file)
--- a/doc/configuration.txt
+++ b/doc/configuration.txt
@@ -21210,6 +21210,11 @@ nameserver <name> <address>[:port] [param*]
   TCP follows the normal resolver error path and does not start another
   fallback.
 
+  The optional [param*] arguments are only supported with a stream address
+  prefix: for a datagram nameserver ("udp@", "udp4@", "udp6@", "dgram+" or a
+  plain address), any argument following the address is ignored and a
+  warning is emitted during the configuration parsing.
+
   If a stream protocol address prefix is used, the nameserver will be
   considered as a stream server (TCP for instance) and
   "server" parameters found in 5.2 paragraph which are relevant for DNS

diff --git a/src/resolvers.c b/src/resolvers.c
index 51fd04ca4232d63b8289d2290d4c49ce00a65afc..ccfc2582ecd7a6b21f26aac7f1c7ae272c1e8cd7 100644 (file)
--- a/src/resolvers.c
+++ b/src/resolvers.c
@@ -4001,6 +4001,12 @@ int cfg_parse_resolvers(const char *file, int linenum, char **args, int kwm)
                        }
                }
                else {
+                       if (*args[3]) {
+                               ha_warning("parsing [%s:%d] : '%s %s' : arguments following the address are ignored for datagram nameservers, they are only supported with 'tcp@' addresses.\n",
+                                          file, linenum, args[0], args[1]);
+                               err_code |= ERR_WARN;
+                       }
+
                        if (dns_dgram_init(newnameserver, sk) < 0) {
                                ha_alert("parsing [%s:%d] : out of memory.\n", file, linenum);
                                err_code |= ERR_ALERT | ERR_ABORT;