From: Christopher Faulet <cfaulet@haproxy.com>
Date: Tue, 29 Sep 2026 08:54:09 +0000 (+0200)
Subject: BUG/MINOR: resolvers: warn about ignored arguments on datagram nameservers
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=facf6eba92e2ccdb29f47156cac65f6675227834;p=haproxy.git

BUG/MINOR: resolvers: warn about ignored arguments on datagram nameservers

Since TCP nameservers were supported, the "nameserver" line accepts server
keywords after the address (e.g. "ssl", "verify"), which are parsed by
parse_server() for "tcp@" addresses. For datagram nameservers these
arguments are silently ignored. A typo such as forgetting the "tcp@"
prefix on "nameserver ns1 1.2.3.4:853 ssl verify none" thus results in
plain DNS being sent over UDP to the DoT port (and, since commit bc20f8c0b
("MEDIUM: resolvers: retry truncated UDP responses over TCP"), over plain
TCP for fallback queries) without any notice.

Let's emit a warning when arguments follow the address of a datagram
nameserver. A warning rather than an error is used so as not to break
existing configurations.

This patch may be backported to stable branches.
---

diff --git a/doc/configuration.txt b/doc/configuration.txt
index 1c10ef62a..dc8a2c3f0 100644
--- a/doc/configuration.txt
+++ b/doc/configuration.txt
@@ -21210,6 +21210,11 @@ nameserver <name> <address>[:port] [param*]
   TCP follows the normal resolver error path and does not start another
   fallback.
 
+  The optional [param*] arguments are only supported with a stream address
+  prefix: for a datagram nameserver ("udp@", "udp4@", "udp6@", "dgram+" or a
+  plain address), any argument following the address is ignored and a
+  warning is emitted during the configuration parsing.
+
   If a stream protocol address prefix is used, the nameserver will be
   considered as a stream server (TCP for instance) and
   "server" parameters found in 5.2 paragraph which are relevant for DNS
diff --git a/src/resolvers.c b/src/resolvers.c
index 51fd04ca4..ccfc2582e 100644
--- a/src/resolvers.c
+++ b/src/resolvers.c
@@ -4001,6 +4001,12 @@ int cfg_parse_resolvers(const char *file, int linenum, char **args, int kwm)
 			}
 		}
 		else {
+			if (*args[3]) {
+				ha_warning("parsing [%s:%d] : '%s %s' : arguments following the address are ignored for datagram nameservers, they are only supported with 'tcp@' addresses.\n",
+				           file, linenum, args[0], args[1]);
+				err_code |= ERR_WARN;
+			}
+
 			if (dns_dgram_init(newnameserver, sk) < 0) {
 				ha_alert("parsing [%s:%d] : out of memory.\n", file, linenum);
 				err_code |= ERR_ALERT | ERR_ABORT;