GithubHelp home page GithubHelp logo

lua-resty-dns's Introduction

Name

lua-resty-dns - Lua DNS resolver for the ngx_lua based on the cosocket API

Table of Contents

Status

This library is considered production ready.

Description

This Lua library provides a DNS resolver for the ngx_lua nginx module:

https://github.com/openresty/lua-nginx-module/#readme

This Lua library takes advantage of ngx_lua's cosocket API, which ensures 100% nonblocking behavior.

Note that at least ngx_lua 0.5.12 or OpenResty 1.2.1.11 is required.

Also, the bit library is also required. If you're using LuaJIT 2.0 with ngx_lua, then the bit library is already available by default.

Note that, this library is bundled and enabled by default in the OpenResty bundle.

IMPORTANT: to be able to generate unique ids, the random generator must be properly seeded using math.randomseed prior to using this module.

Synopsis

lua_package_path "/path/to/lua-resty-dns/lib/?.lua;;";

server {
    location = /dns {
        content_by_lua_block {
            local resolver = require "resty.dns.resolver"
            local r, err = resolver:new{
                nameservers = {"8.8.8.8", {"8.8.4.4", 53} },
                retrans = 5,  -- 5 retransmissions on receive timeout
                timeout = 2000,  -- 2 sec
                no_random = true, -- always start with first nameserver
            }

            if not r then
                ngx.say("failed to instantiate the resolver: ", err)
                return
            end

            local answers, err, tries = r:query("www.google.com", nil, {})
            if not answers then
                ngx.say("failed to query the DNS server: ", err)
                ngx.say("retry historie:\n  ", table.concat(tries, "\n  "))
                return
            end

            if answers.errcode then
                ngx.say("server returned error code: ", answers.errcode,
                        ": ", answers.errstr)
            end

            for i, ans in ipairs(answers) do
                ngx.say(ans.name, " ", ans.address or ans.cname,
                        " type:", ans.type, " class:", ans.class,
                        " ttl:", ans.ttl)
            end
        }
    }
}

Back to TOC

Methods

Back to TOC

new

syntax: r, err = class:new(opts)

Creates a dns.resolver object. Returns nil and a message string on error.

It accepts a opts table argument. The following options are supported:

  • nameservers

    a list of nameservers to be used. Each nameserver entry can be either a single hostname string or a table holding both the hostname string and the port number. The nameserver is picked up by a simple round-robin algorithm for each query method call. This option is required.

  • retrans

    the total number of times of retransmitting the DNS request when receiving a DNS response times out according to the timeout setting. Defaults to 5 times. When trying to retransmit the query, the next nameserver according to the round-robin algorithm will be picked up.

  • timeout

    the time in milliseconds for waiting for the response for a single attempt of request transmission. note that this is ''not'' the maximal total waiting time before giving up, the maximal total waiting time can be calculated by the expression timeout x retrans. The timeout setting can also be changed by calling the set_timeout method. The default timeout setting is 2000 milliseconds, or 2 seconds.

  • no_recurse

    a boolean flag controls whether to disable the "recursion desired" (RD) flag in the UDP request. Defaults to false.

  • no_random

    a boolean flag controls whether to randomly pick the nameserver to query first, if true will always start with the first nameserver listed. Defaults to false.

Back to TOC

destroy

syntax: r:destroy()

Destroy the dns.resolver object by releasing all the internal occupied resources.

Back to TOC

query

syntax: answers, err, tries? = r:query(name, options?, tries?)

Performs a DNS standard query to the nameservers specified by the new method, and returns all the answer records in an array-like Lua table. In case of errors, it will return nil and a string describing the error instead.

If the server returns a non-zero error code, the fields errcode and errstr will be set accordingly in the Lua table returned.

Each entry in the answers returned table value is also a hash-like Lua table which usually takes some of the following fields:

  • name

    The resource record name.

  • type

    The current resource record type, possible values are 1 (TYPE_A), 5 (TYPE_CNAME), 28 (TYPE_AAAA), and any other values allowed by RFC 1035.

  • address

    The IPv4 or IPv6 address in their textual representations when the resource record type is either 1 (TYPE_A) or 28 (TYPE_AAAA), respectively. Successive 16-bit zero groups in IPv6 addresses will not be compressed by default, if you want that, you need to call the compress_ipv6_addr static method instead.

  • section

    The identifier of the section that the current answer record belongs to. Possible values are 1 (SECTION_AN), 2 (SECTION_NS), and 3 (SECTION_AR).

  • cname

    The (decoded) record data value for CNAME resource records. Only present for CNAME records.

  • ttl

    The time-to-live (TTL) value in seconds for the current resource record.

  • class

    The current resource record class, possible values are 1 (CLASS_IN) or any other values allowed by RFC 1035.

  • preference

    The preference integer number for MX resource records. Only present for MX type records.

  • exchange

    The exchange domain name for MX resource records. Only present for MX type records.

  • nsdname

    A domain-name which specifies a host which should be authoritative for the specified class and domain. Usually present for NS type records.

  • rdata

    The raw resource data (RDATA) for resource records that are not recognized.

  • txt

    The record value for TXT records. When there is only one character string in this record, then this field takes a single Lua string. Otherwise this field takes a Lua table holding all the strings.

  • ptrdname

    The record value for PTR records.

This method also takes an optional options argument table, which takes the following fields:

  • qtype

    The type of the question. Possible values are 1 (TYPE_A), 5 (TYPE_CNAME), 28 (TYPE_AAAA), or any other QTYPE value specified by RFC 1035 and RFC 3596. Default to 1 (TYPE_A).

  • authority_section

    When set to a true value, the answers return value includes the Authority section of the DNS response. Default to false.

  • additional_section

    When set to a true value, the answers return value includes the Additional section of the DNS response. Default to false.

The optional parameter tries can be provided as an empty table, and will be returned as a third result. The table will be an array with the error message for each (if any) failed try.

When data truncation happens, the resolver will automatically retry using the TCP transport mode to query the current nameserver. All TCP connections are short lived.

Back to TOC

tcp_query

syntax: answers, err = r:tcp_query(name, options?)

Just like the query method, but enforce the TCP transport mode instead of UDP.

All TCP connections are short lived.

Here is an example:

    local resolver = require "resty.dns.resolver"

    local r, err = resolver:new{
        nameservers = { "8.8.8.8" }
    }
    if not r then
        ngx.say("failed to instantiate resolver: ", err)
        return
    end

    local ans, err = r:tcp_query("www.google.com", { qtype = r.TYPE_A })
    if not ans then
        ngx.say("failed to query: ", err)
        return
    end

    local cjson = require "cjson"
    ngx.say("records: ", cjson.encode(ans))

Back to TOC

set_timeout

syntax: r:set_timeout(time)

Overrides the current timeout setting by the time argument in milliseconds for all the nameserver peers.

Back to TOC

compress_ipv6_addr

syntax: compressed = resty.dns.resolver.compress_ipv6_addr(address)

Compresses the successive 16-bit zero groups in the textual format of the IPv6 address.

For example,

    local resolver = require "resty.dns.resolver"
    local compress = resolver.compress_ipv6_addr
    local new_addr = compress("FF01:0:0:0:0:0:0:101")

will yield FF01::101 in the new_addr return value.

Back to TOC

expand_ipv6_addr

syntax: expanded = resty.dns.resolver.expand_ipv6_addr(address)

Expands the successive 16-bit zero groups in the textual format of the IPv6 address.

For example,

    local resolver = require "resty.dns.resolver"
    local expand = resolver.expand_ipv6_addr
    local new_addr = expand("FF01::101")

will yield FF01:0:0:0:0:0:0:101 in the new_addr return value.

Back to TOC

arpa_str

syntax: arpa_record = resty.dns.resolver.arpa_str(address)

Generates the reverse domain name for PTR lookups for both IPv4 and IPv6 addresses. Compressed IPv6 addresses will be automatically expanded.

For example,

    local resolver = require "resty.dns.resolver"
    local ptr4 = resolver.arpa_str("1.2.3.4")
    local ptr6 = resolver.arpa_str("FF01::101")

will yield 4.3.2.1.in-addr.arpa for ptr4 and 1.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.1.0.F.F.ip6.arpa for ptr6.

Back to TOC

reverse_query

syntax: answers, err = r:reverse_query(address)

Performs a PTR lookup for both IPv4 and IPv6 addresses. This function is basically a wrapper for the query command which uses the arpa_str command to convert the IP address on the fly.

Back to TOC

Constants

Back to TOC

TYPE_A

The A resource record type, equal to the decimal number 1.

Back to TOC

TYPE_NS

The NS resource record type, equal to the decimal number 2.

Back to TOC

TYPE_CNAME

The CNAME resource record type, equal to the decimal number 5.

Back to TOC

TYPE_SOA

The SOA resource record type, equal to the decimal number 6.

Back to TOC

TYPE_PTR

The PTR resource record type, equal to the decimal number 12.

Back to TOC

TYPE_MX

The MX resource record type, equal to the decimal number 15.

Back to TOC

TYPE_TXT

The TXT resource record type, equal to the decimal number 16.

Back to TOC

TYPE_AAAA

syntax: typ = r.TYPE_AAAA

The AAAA resource record type, equal to the decimal number 28.

Back to TOC

TYPE_SRV

syntax: typ = r.TYPE_SRV

The SRV resource record type, equal to the decimal number 33.

See RFC 2782 for details.

Back to TOC

TYPE_SPF

syntax: typ = r.TYPE_SPF

The SPF resource record type, equal to the decimal number 99.

See RFC 4408 for details.

Back to TOC

CLASS_IN

syntax: class = r.CLASS_IN

The Internet resource record type, equal to the decimal number 1.

Back to TOC

SECTION_AN

syntax: stype = r.SECTION_AN

Identifier of the Answer section in the DNS response. Equal to decimal number 1.

Back to TOC

SECTION_NS

syntax: stype = r.SECTION_NS

Identifier of the Authority section in the DNS response. Equal to the decimal number 2.

Back to TOC

SECTION_AR

syntax: stype = r.SECTION_AR

Identifier of the Additional section in the DNS response. Equal to the decimal number 3.

Back to TOC

Automatic Error Logging

By default, the underlying ngx_lua module does error logging when socket errors happen. If you are already doing proper error handling in your own Lua code, then you are recommended to disable this automatic error logging by turning off ngx_lua's lua_socket_log_errors directive, that is,

    lua_socket_log_errors off;

Back to TOC

Limitations

  • This library cannot be used in code contexts like set_by_lua*, log_by_lua*, and header_filter_by_lua* where the ngx_lua cosocket API is not available.
  • The resty.dns.resolver object instance cannot be stored in a Lua variable at the Lua module level, because it will then be shared by all the concurrent requests handled by the same nginx worker process (see https://github.com/openresty/lua-nginx-module/#data-sharing-within-an-nginx-worker ) and result in bad race conditions when concurrent requests are trying to use the same resty.dns.resolver instance. You should always initiate resty.dns.resolver objects in function local variables or in the ngx.ctx table. These places all have their own data copies for each request.

Back to TOC

TODO

  • Concurrent (or parallel) query mode
  • Better support for other resource record types like TLSA.

Back to TOC

Author

Yichun "agentzh" Zhang (章亦春) [email protected], OpenResty Inc.

Back to TOC

Copyright and License

This module is licensed under the BSD license.

Copyright (C) 2012-2019, by Yichun "agentzh" Zhang (章亦春) [email protected], OpenResty Inc.

All rights reserved.

Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:

  • Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.

  • Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.

THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

Back to TOC

See Also

Back to TOC

lua-resty-dns's People

Contributors

agentzh avatar bjoe2k4 avatar chipitsine avatar doujiang24 avatar lekensteyn avatar liverpool8056 avatar moonming avatar rgieseke avatar thibaultcha avatar tieske avatar tiwarivikash avatar tomfitzhenry avatar xiaocang avatar zhuizhuhaomeng avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

lua-resty-dns's Issues

How to get the fixed TTL?

I get the TTL from Google DNS server (8.8.8.8) via query method is dynamic, it will decrease the TTL every time I call this function, until 0.

How to get the domain original TTL, which is set by DNS owner?

return the nameserver that provided the answers

We've had a number of cases where we had inexplicable things happen with dns resolution. Turned out, that multiple name servers had been configured and they did not all respond in the same way.

To make it easier to troubleshoot those cases, would a PR be accepted that would make the query methods also return the ip:port of the nameserver that provided the answer?

re-using dns resolvers

iirc the current implementation is limited per handler because the sockets share the lifetime of the handler in which they were created. As such caching the resolver objects in a module level upvalue won't work because on the next request, all sockets will have been closed.

Now if the code were changed such that;

  • local sock = pick_sock(self, socks) would become local sock = send_query(self, socks, query)
  • and send_query would, just as currently, pick the socket, but would also send the query, and return the socket only for reading the response.
  • if sending fails with a closed error, then it would reinitialize the connection by calling setpeername again (or even create a new socket), and retry sending the query.

then it would become possible to reuse the resolver objects, and cache them on a module level. Instead of recreating and initializing the entire resolver objects, it would only take recreating a single socket connection.

Is this feasible? any other thoughts? with a positive response, I wouldn't mind creating a PR for this.

(PS. I'm aware that a single resolver object should never be reused by a handler while it is still in the process of resolving a request for another handler and is currently yielded, waiting for socket operations)

move the library o the lua-rusty-core

Could it be considered to move the DNS library within the lua-resty-core repository?

The idea behind is to create a unique package having the basic functionality to create custom upstreams ngx and dns resolvers resolver.

By doing this basically one single could package could be installed after having nginx + lua already compiled. (FreeBSD nginx port + lua-resty-core)

The current structure of lua-resty-core including DNS is like this::


├── ngx
│   ├── balancer.lua
│   ├── ocsp.lua
│   ├── re.lua
│   ├── semaphore.lua
│   ├── ssl
│   │   └── session.lua
│   └── ssl.lua
└── resty
    ├── core
    │   ├── base.lua
    │   ├── base64.lua
    │   ├── ctx.lua
    │   ├── exit.lua
    │   ├── hash.lua
    │   ├── misc.lua
    │   ├── regex.lua
    │   ├── request.lua
    │   ├── response.lua
    │   ├── shdict.lua
    │   ├── time.lua
    │   ├── uri.lua
    │   ├── var.lua
    │   └── worker.lua
    ├── core.lua
    └── dns
        └── resolver.lua

dead resolver raises exception

Noticed that if you have a resolver that returns connection refused, then the library raises an exception:

Jan  2 14:24:51 klic local7.err nginx: 2019/01/02 14:24:51 [error] 44#44: *5 recv() failed (111: Connection refused), client: 172.17.0.1, server: _, request: "POST /l HTTP/1.1", host: "172.17.0.2"

Trivial to replicate if you set one of your resolvers to 127.0.0.1 (or 0.0.0.0).

Expected behaviour probably should be that the library retries with any other nameservers supplied when available.

error: .../modules/lua-resty-dns-master/lib/resty/dns/resolver.lua:92: attempt to call local 'new_tab' (a table value)

hi, when I try to use this module it got me this error:
nginx: [error] init_by_lua error: .../modules/lua-resty-dns-master/lib/resty/dns/resolver.lua:92: attempt to call local 'new_tab' (a table value)
stack traceback:
.../modules/lua-resty-dns-master/lib/resty/dns/resolver.lua:92: in main chunk
[C]: in function 'require'
init_by_lua:2: in main chunk

the configuration that I use in nginx.conf is :
lua_package_path "/etc/nginx/modules/lua-resty-dns-master/lib/resty/dns/resolver.lua";

Is there something that I doing wrong? Thanks.

Update: is it need to use lua 5.2.3? because my current lua version is 5.1.4

Update: this issues is resolved by not using require "resty.dns.resolver" in init_by_lua_block. THanks

Error doing NS query

Hi,

When we do "dig @8.8.8.8 +short NS " returns NS list correctly.

When we do "dig @37.235.1.174 +short NS " returns nothing.

Is it possibile that the second resolver has some security restrictions or it can be a a problem in our code?

Thanks a lot!
Eug

wire format

is there any chance to get the wire format as a result of query() ?

DNS ERROR

ERROR: /usr/local/openresty/lualib/resty/dns/resolver.lua:384: bad argument #1 to 'lshift' (number expected, got nil)
stack traceback:
/usr/local/openresty/lualib/resty/dns/resolver.lua:384: in function 'parse_section'
/usr/local/openresty/lualib/resty/dns/resolver.lua:745: in function 'parse_response'
/usr/local/openresty/lualib/resty/dns/resolver.lua:909: in function 'query'
test.lua:19: in function 'file_gen'
init_worker_by_lua:45: in function <init_worker_by_lua:43>
[C]: in function 'xpcall'
init_worker_by_lua:52: in function <init_worker_by_lua:50>
It seems to be an issue with lua-resty-dns. Do you have any suggestions for the next steps?

how can i do dns reverse query?

the code did not worked
local answers, err = r:query("216.58.221.164")

got the error
server returned error code: 3: name error

edns support

Is there any plan to add support for edns, mainly for client-subnet?

Usage

I am using NGX_OPENRESTY server, can I use this module for DNS Lookup?

Extra leading character in TXT records

In some cases, I'm seeing an extra character preceding TXT record values (ans.txt).

  • when the TXT record value at my DNS provider is set to Redirects to https://github.com/holic, the ans.txt value returned by r:query is %Redirects to http://example.com/
  • when the TXT record value at my DNS provider is set to redirect.name=https://github.com/holic, the ans.txt value returned by r:query is &redirect.name=http://example.com/
  • when the TXT record is redirect=https://github.com/holic, the ans.txt value is !redirect=https://github.com/holic
  • but when the TXT record is redirect=aaa, the ans.txt value is, as expected, redirect=aaa

Any ideas if this is due to parsing of the DNS response or due to the DNS reply sent by my DNS provider?

module 'resty.dns.resolver' not found

This is with Lua 5.1 and the stock (homebrew) version of openresty 11.11.2.3:

2017/05/17 15:55:26 [error] 40352#32797624: *1 failed to run set_by_lua*: lib/annotation.lua:4: module 'resty.dns.resolver' not found:
	no field package.preload['resty.dns.resolver']
	no file 'lib/resty/dns/resolver.lua'
	no file '/Users/zachwalton/.homebrew/Cellar/openresty/1.11.2.3/site/lualib/resty/dns/resolver.so'
	no file '/Users/zachwalton/.homebrew/Cellar/openresty/1.11.2.3/lualib/resty/dns/resolver.so'
	no file './resty/dns/resolver.so'
	no file '/usr/local/lib/lua/5.1/resty/dns/resolver.so'
	no file '/Users/zachwalton/.homebrew/Cellar/openresty/1.11.2.3/luajit/lib/lua/5.1/resty/dns/resolver.so'
	no file '/usr/local/lib/lua/5.1/loadall.so'
	no file '/Users/zachwalton/.homebrew/Cellar/openresty/1.11.2.3/site/lualib/resty.so'
	no file '/Users/zachwalton/.homebrew/Cellar/openresty/1.11.2.3/lualib/resty.so'
	no file './resty.so'
	no file '/usr/local/lib/lua/5.1/resty.so'
	no file '/Users/zachwalton/.homebrew/Cellar/openresty/1.11.2.3/luajit/lib/lua/5.1/resty.so'
	no file '/usr/local/lib/lua/5.1/loadall.so'

The module is present at /Users/zachwalton/.homebrew/Cellar/openresty/1.11.2.3/lualib/resty/dns/resolver.lua, but in the path it's looking for /Users/zachwalton/.homebrew/Cellar/openresty/1.11.2.3/lualib/resty/dns/resolver.so.

New to Lua so feel free to chastise me if I'm doing something wrong.

How does the module process for cache?

hello zhang :
I have two questions:

1.I want to know if this module use dns cache for ip, and will the module query the local hosts file when it resolver dns?

2.if i use lua-resty-redis module , when ip of redis domain changed and call redis again, will the lua-resty-redis module resolve the redis domain realtime or throw a exception ?

thanks.

TTL

This library doesn't handle the TTL by storing the resolution in a local cache, is this correct?

Wrong bits mask for the response RCODE

In resolver.lua, the last 7 bits is use as code:
local code = band(flags, 0x7f)
and fill answers.errcode with this code
if code ~= 0 then
answers.errcode = code
answers.errstr = resolver_errstrs[code] or "unknown"
end

Which is wrong according to rfc4035.
Only the last 4 bits are the RCODE. Using the last 7 bits may make some normal response to be considered error.

PTR query helper functions

I am currently working on some PTR queries using lua-resty-dns, where it took me quite some effort in build the rDNS string for IPv6 addresses, especially in shortened (::) notation. Would it be interesting to include such a helper function in lua-resty-dns to build strings like b.a.9.8.7.6.5.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa for ipv6 and 5.2.0.192.in-addr.arpa for ipv4?
In particular I am thinking about a function called rdns_string that looks roughly like this:

_M.expand_ipv6_address = function (ip)
  ...
  return expanded_ipv6_address
end

_M.rdns_string = function (ip)
  if ipv6 then
    local ip = _M.expand_ipv6_address (ip)
    ...
    return ipv6_rdns_string
  else
    ...
    return ipv4_rdns_string
  end
end

domain name resolution on pure ipv6 kubernetes

Hi,

We have problem with domain-name resolution when running on kubernetes pure ipv6. The nodes in cluster do not have assigned fqdns. There is however a name (netguard-dns) that is resolvable by dns on the nginx node (the edge-node). We run however into problems with this approach as the domain-name is not resolvable - for example when making get token request. We checked domain-name resolution (via nslookup, dig) throughout the cluster and it works, however requests on this domain-name fail,

F.e. when trying to get token, we've got following log from nginx ingress-controller:

{"type":"log","level":"ERROR","facility":"23","time":"2020-05-04T21:29:44.459+00:00","timezone":"UTC","process":"nginx","system":"CITM nginx","systemid":"citm-citm-ingress-controller-6z47q","host":"nsmc-ipv6-edge-01","log":{"message":"93#93: *296 [lua] openidc.lua:502: call_token_endpoint(): accessing token endpoint (https://netguard-dns/auth/realms/netguard/protocol/openid-connect/token) failed: netguard-dns could not be resolved (2: Server failure), client: 2a00:8a00:4000:7622:f816:3eff:fe1d:dc75, server: _, request: 'GET /sso-redirect?state=4935cb01f42c3facebf7d7a87b014ad4&session_state=e9c710fb-c3c8-47a9-9d23-c5f82e0dfde3&code=1a41a825-c718-43aa-a537-788dff1f47fe.e9c710fb-c3c8-47a9-9d23-c5f82e0dfde3.ca00b0f3-0d6a-45b3-951c-a4981376cf97 HTTP/2.0', host: 'netguard-dns', referrer: 'https://netguard-dns/auth/realms/netguard/protocol/openid-connect/auth?response_type=code&nonce=423145c66b107c9b20384f5cfa832d8a&scope=openid%20email%20profile&state=4935cb01f42c3facebf7d7a87b014ad4&redirect_uri=https%3A%2F%2Fnetguard-dns%2Fsso-redirect&client_id=base_platform_sso'"}}

What should be the proper configuration in case of running kubernetes on pure ipv6 from lua-openresty point of view?

Are there maybe some specific parameters to be configured in opts passed to openidc.authenticate(opts, target_url, unauth_action, session_opts) method?

---------------------DNS CONFIGURATION

#ingress-controller(nginx) has configured resolver as:
kubectl exec -n base nginx-ingress-controller-lpkfs cat /etc/nginx/nginx.conf | grep resolver

resolver [fd6a:b5d7:21dd:f829::4] valid=30s;

#The resolver points to the internal IP address of ingress-controller pod:
kubectl get pod -n base -o wide

NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
nginx-ingress-controller-lpkfs 1/1 Running 0 57m fd6a:b5d7:21dd:f829::4 ipv6-edge-01
...

#nginx-ingress-controller-lpkfs pod (fd6a:b5d7:21dd:f829::4) /etc/hosts:

kubectl exec -it -n base citm-citm-ingress-controller-lpkfs bash

[nginx@ipv6-edge-01 /]$ cat /etc/hosts
#Kubernetes-managed hosts file (host network).
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
fd6a:b5d7:21dd:f829::4 ipv6-edge-01
2a00:8a00:4000:7622:f816:3eff:febd:d523 netguard-dns

and 2a00:8a00:4000:7622:f816:3eff:febd:d523 is ip address of the ingress-controller(nginx) node (edge-node).

Also the dnsmasq service is configured to resolve 2a00:8a00:4000:7622:f816:3eff:febd:d523 netguard-dns

--------------Used lua libs versions:

#openidc.lua
local openidc = {
_VERSION = "1.7.2"
}

#resty/http.lua
local _M = {
_VERSION = '0.13',
}

#resty/dns/resolver.lua
local _M = {
_VERSION = '0.21',

TCP socket closed

The UDP part can be sequentially used for multiple requests. But the TCP socket is closed upon completion, and hence the second request fails because the socket is closed.

So instead of creating the TCP socket up front (in new, I think it should be created upon actually querying in _tcp_query.

Correct?

/etc/hosts support?

looks like /etc/hosts is not supported yet,
which becomes an issue for docker run with --link

Test case failing on rhel 7.6 ppc64le platform

Hi All,

I had build the nginx binary on rhel 7.6 ppc64le (version 1.17.1.1rc0) from source code - https://github.com/openresty/openresty.
Please note that, I had copied and used ppc64le compiled LuaJIT code while building openresty (nginx).
Below command I used to compile the openresty -

./configure --with-cc-opt=-O2 --with-http_image_filter_module --with-http_dav_module --with-http_auth_request_module --with-poll_module --with-stream --with-stream_ssl_module --with-stream_ssl_preread_module --with-http_ssl_module --with-http_iconv_module --with-http_drizzle_module --with-http_postgres_module --with-http_addition_module --with-debug --add-module=/usr/openresty/openresty_test_modules/nginx-eval-module --add-module=/usr/openresty/openresty_test_modules/replace-filter-nginx-module;

And then tried to execute the test cases for 'lua-resty-dns-0.21' like below -

[root]# pwd
/usr/openresty/openresty/openresty-1.17.1.1rc0/build/lua-resty-dns-0.21
[root]# prove -r t

NOTE: The 'lua-resty-dns' version is 0.21 which was downloaded as part of openresty bundle.

I am getting below test case failures. The errors "lua udp socket read timed out" repeats for all failing test cases but I have kept below uniq errors.

	[root@ lua-resty-dns-0.21]# prove -r t/
	t/mock.t .... ok
	t/sanity.t .. 1/102
	#   Failed test 'ERROR: client socket timed out - TEST 9: TXT query (with ans)
	# '
	#   at /usr/local/share/perl5/Test/Nginx/Socket.pm line 2062.

	#   Failed test 'TEST 9: TXT query (with ans) - status code ok'
	#   at /usr/local/share/perl5/Test/Nginx/Socket.pm line 948.
	#          got: ''
	#     expected: '200'

	#   Failed test 'TEST 9: TXT query (with ans) - response_body_like - response is expected ()'
	#   at /usr/local/share/perl5/Test/Nginx/Socket.pm line 1635.
	#                   ''
	#     doesn't match '(?^s:^records: \[\{.*?"txt":"v=spf\d+\s[^"]+".*?\}\]$)'

	#   Failed test 'TEST 9: TXT query (with ans) - pattern "[error]" should not match any line in error.log but matches line "2019/10/16 14:57:46 [error] 3799\#0: *1 lua udp socket read timed out, client: 127.0.0.1, server: localhost, request: \"GET /t HTTP/1.1\", host: \"localhost\"" (req 0)
	# 2019/10/16 14:57:46 [debug] 3799\#0: *1 lua udp socket handle error
	# 2019/10/16 14:57:46 [debug] 3799\#0: *1 lua udp socket waking up the current request
	# 2019/10/16 14:57:46 [debug] 3799\#0: *1 lua udp operation done, resuming lua thread
	# 2019/10/16 14:57:46 [debug] 3799\#0: *1 lua udp socket calling prepare retvals handler 0000000010165BA0, u:000000006EDAD528
	# 2019/10/16 14:57:46 [debug] 3799\#0: *1 lua udp socket receive return value handler
	# 2019/10/16 14:57:46 [debug] 3799\#0: *1 lua udp socket error retval handler
	# 2019/10/16 14:57:46 [debug] 3799\#0: *1 lua run thread, top:9 c:1
	# 2019/10/16 14:57:46 [debug] 3799\#0: *1 send: fd:13 27 of 27
	# 2019/10/16 14:57:46 [debug] 3799\#0: *1 lua udp socket calling receive() method
	# '
	#   at /usr/local/share/perl5/Test/Nginx/Socket.pm line 1280.
	t/sanity.t .. 5/102
	#   Failed test 'ERROR: client socket timed out - TEST 9: TXT query (with ans)
	# '
	#   at /usr/local/share/perl5/Test/Nginx/Socket.pm line 2062.

	#   Failed test 'TEST 9: TXT query (with ans) - status code ok'
	#   at /usr/local/share/perl5/Test/Nginx/Socket.pm line 948.
	#          got: ''
	#     expected: '200'

	#   Failed test 'TEST 9: TXT query (with ans) - response_body_like - response is expected ()'
	#   at /usr/local/share/perl5/Test/Nginx/Socket.pm line 1635.
	#                   ''
	#     doesn't match '(?^s:^records: \[\{.*?"txt":"v=spf\d+\s[^"]+".*?\}\]$)'

	#   Failed test 'TEST 9: TXT query (with ans) - pattern "[error]" should not match any line in error.log but matches line "2019/10/16 14:57:48 [error] 3799\#0: *1 lua udp socket read timed out, client: 127.0.0.1, server: localhost, request: \"GET /t HTTP/1.1\", host: \"localhost\"" (req 1)
	# 2019/10/16 14:57:48 [debug] 3799\#0: *1 lua udp socket handle error
	# 2019/10/16 14:57:48 [debug] 3799\#0: *1 lua udp socket waking up the current request
	# 2019/10/16 14:57:48 [debug] 3799\#0: *1 lua udp operation done, resuming lua thread
	# 2019/10/16 14:57:48 [debug] 3799\#0: *1 lua udp socket calling prepare retvals handler 0000000010165BA0, u:000000006EDAD528
	# 2019/10/16 14:57:48 [debug] 3799\#0: *1 lua udp socket receive return value handler
	# 2019/10/16 14:57:48 [debug] 3799\#0: *1 lua udp socket error retval handler
	# 2019/10/16 14:57:48 [debug] 3799\#0: *1 lua run thread, top:9 c:1
	# 2019/10/16 14:57:48 [debug] 3799\#0: *1 send: fd:13 27 of 27
	# 2019/10/16 14:57:48 [debug] 3799\#0: *1 lua udp socket calling receive() method
	# '
	#   at /usr/local/share/perl5/Test/Nginx/Socket.pm line 1280.

	#   Failed test 'TEST 9: TXT query (with ans) - pattern "[error]" should not match any line in error.log but matches line "2019/10/16 14:57:49 [error] 3799\#0: *3 lua udp socket read timed out, client: 127.0.0.1, server: localhost, request: \"GET /t HTTP/1.1\", host: \"localhost\"" (req 1)
	# 2019/10/16 14:57:49 [debug] 3799\#0: *3 lua udp socket handle error
	# 2019/10/16 14:57:49 [debug] 3799\#0: *3 lua udp socket waking up the current request
	# 2019/10/16 14:57:49 [debug] 3799\#0: *3 lua udp operation done, resuming lua thread
	# 2019/10/16 14:57:49 [debug] 3799\#0: *3 lua udp socket calling prepare retvals handler 0000000010165BA0, u:000000006ED94FB0
	# 2019/10/16 14:57:49 [debug] 3799\#0: *3 lua udp socket receive return value handler
	# 2019/10/16 14:57:49 [debug] 3799\#0: *3 lua udp socket error retval handler
	# 2019/10/16 14:57:49 [debug] 3799\#0: *3 lua run thread, top:9 c:1
	# 2019/10/16 14:57:49 [debug] 3799\#0: *3 send: fd:15 27 of 27
	# 2019/10/16 14:57:49 [debug] 3799\#0: *3 lua udp socket calling receive() method
	# '
	#   at /usr/local/share/perl5/Test/Nginx/Socket.pm line 1280.

	#   Failed test 'TEST 9: TXT query (with ans) - pattern "[error]" should not match any line in error.log but matches line "2019/10/16 14:57:50 [error] 3799\#0: *1 lua udp socket read timed out, client: 127.0.0.1, server: localhost, request: \"GET /t HTTP/1.1\", host: \"localhost\"" (req 1)
	# 2019/10/16 14:57:50 [debug] 3799\#0: *1 lua udp socket handle error
	# 2019/10/16 14:57:50 [debug] 3799\#0: *1 lua udp socket waking up the current request
	# 2019/10/16 14:57:50 [debug] 3799\#0: *1 lua udp operation done, resuming lua thread
	# 2019/10/16 14:57:50 [debug] 3799\#0: *1 lua udp socket calling prepare retvals handler 0000000010165BA0, u:000000006EDAD528
	# 2019/10/16 14:57:50 [debug] 3799\#0: *1 lua udp socket receive return value handler
	# 2019/10/16 14:57:50 [debug] 3799\#0: *1 lua udp socket error retval handler
	# 2019/10/16 14:57:50 [debug] 3799\#0: *1 lua run thread, top:9 c:1
	# 2019/10/16 14:57:50 [debug] 3799\#0: *1 send: fd:13 27 of 27
	# 2019/10/16 14:57:50 [debug] 3799\#0: *1 lua udp socket calling receive() method
	# '
	#   at /usr/local/share/perl5/Test/Nginx/Socket.pm line 1280.
	t/sanity.t .. 11/102
	#   Failed test 'ERROR: client socket timed out - TEST 17: SOA records
	# '
	#   at /usr/local/share/perl5/Test/Nginx/Socket.pm line 2062.

	#   Failed test 'TEST 17: SOA records - status code ok'
	#   at /usr/local/share/perl5/Test/Nginx/Socket.pm line 948.
	#          got: ''
	#     expected: '200'

	#   Failed test 'TEST 17: SOA records - response_body_like - response is expected ()'
	#   at /usr/local/share/perl5/Test/Nginx/Socket.pm line 1635.
	#                   ''
	#     doesn't match '(?^s:^records: \[(?:{"class":1,"expire":\d+,"minimum":\d+,"mname":"ns\d+\.google\.com","name":"google\.com","refresh":\d+,"retry":\d+,"rname":"dns-admin\.google\.com","section":2,"serial":\d+,"ttl":\d+,"type":6},?)+\]$)'

	#   Failed test 'TEST 17: SOA records - pattern "[error]" should not match any line in error.log but matches line "2019/10/16 14:57:52 [error] 3912\#0: *1 lua udp socket read timed out, client: 127.0.0.1, server: localhost, request: \"GET /t HTTP/1.1\", host: \"localhost\"" (req 0)
	# 2019/10/16 14:57:52 [debug] 3912\#0: *1 lua udp socket handle error
	# 2019/10/16 14:57:52 [debug] 3912\#0: *1 lua udp socket waking up the current request
	# 2019/10/16 14:57:52 [debug] 3912\#0: *1 lua udp operation done, resuming lua thread
	# 2019/10/16 14:57:52 [debug] 3912\#0: *1 lua udp socket calling prepare retvals handler 0000000010165BA0, u:000000000AA8D528
	# 2019/10/16 14:57:52 [debug] 3912\#0: *1 lua udp socket receive return value handler
	# 2019/10/16 14:57:52 [debug] 3912\#0: *1 lua udp socket error retval handler
	# 2019/10/16 14:57:52 [debug] 3912\#0: *1 lua run thread, top:9 c:1
	# 2019/10/16 14:57:52 [debug] 3912\#0: *1 send: fd:13 32 of 32
	# 2019/10/16 14:57:52 [debug] 3912\#0: *1 lua udp socket calling receive() method
	# '
	#   at /usr/local/share/perl5/Test/Nginx/Socket.pm line 1280.
	t/sanity.t .. 15/102
	#   Failed test 'ERROR: client socket timed out - TEST 17: SOA records
	# '
	#   at /usr/local/share/perl5/Test/Nginx/Socket.pm line 2062.

	#   Failed test 'TEST 17: SOA records - status code ok'
	#   at /usr/local/share/perl5/Test/Nginx/Socket.pm line 948.
	#          got: ''
	#     expected: '200'

	#   Failed test 'TEST 17: SOA records - response_body_like - response is expected ()'
	#   at /usr/local/share/perl5/Test/Nginx/Socket.pm line 1635.
	#                   ''
	#     doesn't match '(?^s:^records: \[(?:{"class":1,"expire":\d+,"minimum":\d+,"mname":"ns\d+\.google\.com","name":"google\.com","refresh":\d+,"retry":\d+,"rname":"dns-admin\.google\.com","section":2,"serial":\d+,"ttl":\d+,"type":6},?)+\]$)'


	Test Summary Report
	-------------------
	t/sanity.t (Wstat: 0 Tests: 154 Failed: 130)
	  Failed tests:  1-30, 37-56, 63-82, 95-154
	  Parse errors: Bad plan.  You planned 102 tests but ran 154.
	Files=2, Tests=410, 101 wallclock secs ( 0.15 usr  0.02 sys +  2.64 cusr  1.18 csys =  3.99 CPU)
	Result: FAIL
	[root@pts00450-vm1 lua-resty-dns-0.21]#

Please help suggest if I need to export any specific environment/setup any additional service or should try any compiler flag/somehow increase timeout value to make these test cases pass?

nginx version (compiled with libdrizzle 1.0 and radius, mariadb, postgresql services setup) -

# nginx -V
nginx version: openresty/1.17.1.1rc0
built by gcc 4.8.5 20150623 (Red Hat 4.8.5-39) (GCC)
built with OpenSSL 1.0.2k-fips  26 Jan 2017
TLS SNI support enabled
configure arguments: --prefix=/usr/local/openresty/nginx --with-debug --with-cc-opt='-DNGX_LUA_USE_ASSERT -DNGX_LUA_ABORT_AT_PANIC -O2 -O2' --add-module=../ngx_devel_kit-0.3.1rc1 --add-module=../iconv-nginx-module-0.14 --add-module=../echo-nginx-module-0.61 --add-module=../xss-nginx-module-0.06 --add-module=../ngx_coolkit-0.2 --add-module=../set-misc-nginx-module-0.32 --add-module=../form-input-nginx-module-0.12 --add-module=../encrypted-session-nginx-module-0.08 --add-module=../drizzle-nginx-module-0.1.11 --add-module=../ngx_postgres-1.0 --add-module=../srcache-nginx-module-0.31 --add-module=../ngx_lua-0.10.15 --add-module=../ngx_lua_upstream-0.07 --add-module=../headers-more-nginx-module-0.33 --add-module=../array-var-nginx-module-0.05 --add-module=../memc-nginx-module-0.19 --add-module=../redis2-nginx-module-0.15 --add-module=../redis-nginx-module-0.3.7 --add-module=../rds-json-nginx-module-0.15 --add-module=../rds-csv-nginx-module-0.09 --add-module=../ngx_stream_lua-0.0.7 --with-ld-opt=-Wl,-rpath,/usr/local/openresty/luajit/lib --with-http_image_filter_module --with-http_dav_module --with-http_auth_request_module --with-poll_module --with-stream --with-stream_ssl_module --with-stream_ssl_preread_module --with-http_ssl_module --with-http_addition_module --add-module=/usr/openresty/openresty_test_modules/nginx-eval-module --add-module=/usr/openresty/openresty_test_modules/replace-filter-nginx-module --with-stream --with-stream_ssl_preread_module

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.