openresty / lua-resty-dns Goto Github PK

Hi All,

I had build the nginx binary on rhel 7.6 ppc64le (version 1.17.1.1rc0) from source code - https://github.com/openresty/openresty.
Please note that, I had copied and used ppc64le compiled LuaJIT code while building openresty (nginx).
Below command I used to compile the openresty -

./configure --with-cc-opt=-O2 --with-http_image_filter_module --with-http_dav_module --with-http_auth_request_module --with-poll_module --with-stream --with-stream_ssl_module --with-stream_ssl_preread_module --with-http_ssl_module --with-http_iconv_module --with-http_drizzle_module --with-http_postgres_module --with-http_addition_module --with-debug --add-module=/usr/openresty/openresty_test_modules/nginx-eval-module --add-module=/usr/openresty/openresty_test_modules/replace-filter-nginx-module;

And then tried to execute the test cases for 'lua-resty-dns-0.21' like below -

[root]# pwd
/usr/openresty/openresty/openresty-1.17.1.1rc0/build/lua-resty-dns-0.21
[root]# prove -r t

NOTE: The 'lua-resty-dns' version is 0.21 which was downloaded as part of openresty bundle.

I am getting below test case failures. The errors "lua udp socket read timed out" repeats for all failing test cases but I have kept below uniq errors.

	[root@ lua-resty-dns-0.21]# prove -r t/
	t/mock.t .... ok
	t/sanity.t .. 1/102
	#   Failed test 'ERROR: client socket timed out - TEST 9: TXT query (with ans)
	# '
	#   at /usr/local/share/perl5/Test/Nginx/Socket.pm line 2062.

	#   Failed test 'TEST 9: TXT query (with ans) - status code ok'
	#   at /usr/local/share/perl5/Test/Nginx/Socket.pm line 948.
	#          got: ''
	#     expected: '200'

	#   Failed test 'TEST 9: TXT query (with ans) - response_body_like - response is expected ()'
	#   at /usr/local/share/perl5/Test/Nginx/Socket.pm line 1635.
	#                   ''
	#     doesn't match '(?^s:^records: \[\{.*?"txt":"v=spf\d+\s[^"]+".*?\}\]$)'

	#   Failed test 'TEST 9: TXT query (with ans) - pattern "[error]" should not match any line in error.log but matches line "2019/10/16 14:57:46 [error] 3799\#0: *1 lua udp socket read timed out, client: 127.0.0.1, server: localhost, request: \"GET /t HTTP/1.1\", host: \"localhost\"" (req 0)
	# 2019/10/16 14:57:46 [debug] 3799\#0: *1 lua udp socket handle error
	# 2019/10/16 14:57:46 [debug] 3799\#0: *1 lua udp socket waking up the current request
	# 2019/10/16 14:57:46 [debug] 3799\#0: *1 lua udp operation done, resuming lua thread
	# 2019/10/16 14:57:46 [debug] 3799\#0: *1 lua udp socket calling prepare retvals handler 0000000010165BA0, u:000000006EDAD528
	# 2019/10/16 14:57:46 [debug] 3799\#0: *1 lua udp socket receive return value handler
	# 2019/10/16 14:57:46 [debug] 3799\#0: *1 lua udp socket error retval handler
	# 2019/10/16 14:57:46 [debug] 3799\#0: *1 lua run thread, top:9 c:1
	# 2019/10/16 14:57:46 [debug] 3799\#0: *1 send: fd:13 27 of 27
	# 2019/10/16 14:57:46 [debug] 3799\#0: *1 lua udp socket calling receive() method
	# '
	#   at /usr/local/share/perl5/Test/Nginx/Socket.pm line 1280.
	t/sanity.t .. 5/102
	#   Failed test 'ERROR: client socket timed out - TEST 9: TXT query (with ans)
	# '
	#   at /usr/local/share/perl5/Test/Nginx/Socket.pm line 2062.

	#   Failed test 'TEST 9: TXT query (with ans) - status code ok'
	#   at /usr/local/share/perl5/Test/Nginx/Socket.pm line 948.
	#          got: ''
	#     expected: '200'

	#   Failed test 'TEST 9: TXT query (with ans) - response_body_like - response is expected ()'
	#   at /usr/local/share/perl5/Test/Nginx/Socket.pm line 1635.
	#                   ''
	#     doesn't match '(?^s:^records: \[\{.*?"txt":"v=spf\d+\s[^"]+".*?\}\]$)'

	#   Failed test 'TEST 9: TXT query (with ans) - pattern "[error]" should not match any line in error.log but matches line "2019/10/16 14:57:48 [error] 3799\#0: *1 lua udp socket read timed out, client: 127.0.0.1, server: localhost, request: \"GET /t HTTP/1.1\", host: \"localhost\"" (req 1)
	# 2019/10/16 14:57:48 [debug] 3799\#0: *1 lua udp socket handle error
	# 2019/10/16 14:57:48 [debug] 3799\#0: *1 lua udp socket waking up the current request
	# 2019/10/16 14:57:48 [debug] 3799\#0: *1 lua udp operation done, resuming lua thread
	# 2019/10/16 14:57:48 [debug] 3799\#0: *1 lua udp socket calling prepare retvals handler 0000000010165BA0, u:000000006EDAD528
	# 2019/10/16 14:57:48 [debug] 3799\#0: *1 lua udp socket receive return value handler
	# 2019/10/16 14:57:48 [debug] 3799\#0: *1 lua udp socket error retval handler
	# 2019/10/16 14:57:48 [debug] 3799\#0: *1 lua run thread, top:9 c:1
	# 2019/10/16 14:57:48 [debug] 3799\#0: *1 send: fd:13 27 of 27
	# 2019/10/16 14:57:48 [debug] 3799\#0: *1 lua udp socket calling receive() method
	# '
	#   at /usr/local/share/perl5/Test/Nginx/Socket.pm line 1280.

	#   Failed test 'TEST 9: TXT query (with ans) - pattern "[error]" should not match any line in error.log but matches line "2019/10/16 14:57:49 [error] 3799\#0: *3 lua udp socket read timed out, client: 127.0.0.1, server: localhost, request: \"GET /t HTTP/1.1\", host: \"localhost\"" (req 1)
	# 2019/10/16 14:57:49 [debug] 3799\#0: *3 lua udp socket handle error
	# 2019/10/16 14:57:49 [debug] 3799\#0: *3 lua udp socket waking up the current request
	# 2019/10/16 14:57:49 [debug] 3799\#0: *3 lua udp operation done, resuming lua thread
	# 2019/10/16 14:57:49 [debug] 3799\#0: *3 lua udp socket calling prepare retvals handler 0000000010165BA0, u:000000006ED94FB0
	# 2019/10/16 14:57:49 [debug] 3799\#0: *3 lua udp socket receive return value handler
	# 2019/10/16 14:57:49 [debug] 3799\#0: *3 lua udp socket error retval handler
	# 2019/10/16 14:57:49 [debug] 3799\#0: *3 lua run thread, top:9 c:1
	# 2019/10/16 14:57:49 [debug] 3799\#0: *3 send: fd:15 27 of 27
	# 2019/10/16 14:57:49 [debug] 3799\#0: *3 lua udp socket calling receive() method
	# '
	#   at /usr/local/share/perl5/Test/Nginx/Socket.pm line 1280.

	#   Failed test 'TEST 9: TXT query (with ans) - pattern "[error]" should not match any line in error.log but matches line "2019/10/16 14:57:50 [error] 3799\#0: *1 lua udp socket read timed out, client: 127.0.0.1, server: localhost, request: \"GET /t HTTP/1.1\", host: \"localhost\"" (req 1)
	# 2019/10/16 14:57:50 [debug] 3799\#0: *1 lua udp socket handle error
	# 2019/10/16 14:57:50 [debug] 3799\#0: *1 lua udp socket waking up the current request
	# 2019/10/16 14:57:50 [debug] 3799\#0: *1 lua udp operation done, resuming lua thread
	# 2019/10/16 14:57:50 [debug] 3799\#0: *1 lua udp socket calling prepare retvals handler 0000000010165BA0, u:000000006EDAD528
	# 2019/10/16 14:57:50 [debug] 3799\#0: *1 lua udp socket receive return value handler
	# 2019/10/16 14:57:50 [debug] 3799\#0: *1 lua udp socket error retval handler
	# 2019/10/16 14:57:50 [debug] 3799\#0: *1 lua run thread, top:9 c:1
	# 2019/10/16 14:57:50 [debug] 3799\#0: *1 send: fd:13 27 of 27
	# 2019/10/16 14:57:50 [debug] 3799\#0: *1 lua udp socket calling receive() method
	# '
	#   at /usr/local/share/perl5/Test/Nginx/Socket.pm line 1280.
	t/sanity.t .. 11/102
	#   Failed test 'ERROR: client socket timed out - TEST 17: SOA records
	# '
	#   at /usr/local/share/perl5/Test/Nginx/Socket.pm line 2062.

	#   Failed test 'TEST 17: SOA records - status code ok'
	#   at /usr/local/share/perl5/Test/Nginx/Socket.pm line 948.
	#          got: ''
	#     expected: '200'

	#   Failed test 'TEST 17: SOA records - response_body_like - response is expected ()'
	#   at /usr/local/share/perl5/Test/Nginx/Socket.pm line 1635.
	#                   ''
	#     doesn't match '(?^s:^records: \[(?:{"class":1,"expire":\d+,"minimum":\d+,"mname":"ns\d+\.google\.com","name":"google\.com","refresh":\d+,"retry":\d+,"rname":"dns-admin\.google\.com","section":2,"serial":\d+,"ttl":\d+,"type":6},?)+\]$)'

	#   Failed test 'TEST 17: SOA records - pattern "[error]" should not match any line in error.log but matches line "2019/10/16 14:57:52 [error] 3912\#0: *1 lua udp socket read timed out, client: 127.0.0.1, server: localhost, request: \"GET /t HTTP/1.1\", host: \"localhost\"" (req 0)
	# 2019/10/16 14:57:52 [debug] 3912\#0: *1 lua udp socket handle error
	# 2019/10/16 14:57:52 [debug] 3912\#0: *1 lua udp socket waking up the current request
	# 2019/10/16 14:57:52 [debug] 3912\#0: *1 lua udp operation done, resuming lua thread
	# 2019/10/16 14:57:52 [debug] 3912\#0: *1 lua udp socket calling prepare retvals handler 0000000010165BA0, u:000000000AA8D528
	# 2019/10/16 14:57:52 [debug] 3912\#0: *1 lua udp socket receive return value handler
	# 2019/10/16 14:57:52 [debug] 3912\#0: *1 lua udp socket error retval handler
	# 2019/10/16 14:57:52 [debug] 3912\#0: *1 lua run thread, top:9 c:1
	# 2019/10/16 14:57:52 [debug] 3912\#0: *1 send: fd:13 32 of 32
	# 2019/10/16 14:57:52 [debug] 3912\#0: *1 lua udp socket calling receive() method
	# '
	#   at /usr/local/share/perl5/Test/Nginx/Socket.pm line 1280.
	t/sanity.t .. 15/102
	#   Failed test 'ERROR: client socket timed out - TEST 17: SOA records
	# '
	#   at /usr/local/share/perl5/Test/Nginx/Socket.pm line 2062.

	#   Failed test 'TEST 17: SOA records - status code ok'
	#   at /usr/local/share/perl5/Test/Nginx/Socket.pm line 948.
	#          got: ''
	#     expected: '200'

	#   Failed test 'TEST 17: SOA records - response_body_like - response is expected ()'
	#   at /usr/local/share/perl5/Test/Nginx/Socket.pm line 1635.
	#                   ''
	#     doesn't match '(?^s:^records: \[(?:{"class":1,"expire":\d+,"minimum":\d+,"mname":"ns\d+\.google\.com","name":"google\.com","refresh":\d+,"retry":\d+,"rname":"dns-admin\.google\.com","section":2,"serial":\d+,"ttl":\d+,"type":6},?)+\]$)'


	Test Summary Report
	-------------------
	t/sanity.t (Wstat: 0 Tests: 154 Failed: 130)
	  Failed tests:  1-30, 37-56, 63-82, 95-154
	  Parse errors: Bad plan.  You planned 102 tests but ran 154.
	Files=2, Tests=410, 101 wallclock secs ( 0.15 usr  0.02 sys +  2.64 cusr  1.18 csys =  3.99 CPU)
	Result: FAIL
	[root@pts00450-vm1 lua-resty-dns-0.21]#

Please help suggest if I need to export any specific environment/setup any additional service or should try any compiler flag/somehow increase timeout value to make these test cases pass?

nginx version (compiled with libdrizzle 1.0 and radius, mariadb, postgresql services setup) -

# nginx -V
nginx version: openresty/1.17.1.1rc0
built by gcc 4.8.5 20150623 (Red Hat 4.8.5-39) (GCC)
built with OpenSSL 1.0.2k-fips  26 Jan 2017
TLS SNI support enabled
configure arguments: --prefix=/usr/local/openresty/nginx --with-debug --with-cc-opt='-DNGX_LUA_USE_ASSERT -DNGX_LUA_ABORT_AT_PANIC -O2 -O2' --add-module=../ngx_devel_kit-0.3.1rc1 --add-module=../iconv-nginx-module-0.14 --add-module=../echo-nginx-module-0.61 --add-module=../xss-nginx-module-0.06 --add-module=../ngx_coolkit-0.2 --add-module=../set-misc-nginx-module-0.32 --add-module=../form-input-nginx-module-0.12 --add-module=../encrypted-session-nginx-module-0.08 --add-module=../drizzle-nginx-module-0.1.11 --add-module=../ngx_postgres-1.0 --add-module=../srcache-nginx-module-0.31 --add-module=../ngx_lua-0.10.15 --add-module=../ngx_lua_upstream-0.07 --add-module=../headers-more-nginx-module-0.33 --add-module=../array-var-nginx-module-0.05 --add-module=../memc-nginx-module-0.19 --add-module=../redis2-nginx-module-0.15 --add-module=../redis-nginx-module-0.3.7 --add-module=../rds-json-nginx-module-0.15 --add-module=../rds-csv-nginx-module-0.09 --add-module=../ngx_stream_lua-0.0.7 --with-ld-opt=-Wl,-rpath,/usr/local/openresty/luajit/lib --with-http_image_filter_module --with-http_dav_module --with-http_auth_request_module --with-poll_module --with-stream --with-stream_ssl_module --with-stream_ssl_preread_module --with-http_ssl_module --with-http_addition_module --add-module=/usr/openresty/openresty_test_modules/nginx-eval-module --add-module=/usr/openresty/openresty_test_modules/replace-filter-nginx-module --with-stream --with-stream_ssl_preread_module

I am using NGX_OPENRESTY server, can I use this module for DNS Lookup?

This is with Lua 5.1 and the stock (homebrew) version of openresty 11.11.2.3:

2017/05/17 15:55:26 [error] 40352#32797624: *1 failed to run set_by_lua*: lib/annotation.lua:4: module 'resty.dns.resolver' not found:
	no field package.preload['resty.dns.resolver']
	no file 'lib/resty/dns/resolver.lua'
	no file '/Users/zachwalton/.homebrew/Cellar/openresty/1.11.2.3/site/lualib/resty/dns/resolver.so'
	no file '/Users/zachwalton/.homebrew/Cellar/openresty/1.11.2.3/lualib/resty/dns/resolver.so'
	no file './resty/dns/resolver.so'
	no file '/usr/local/lib/lua/5.1/resty/dns/resolver.so'
	no file '/Users/zachwalton/.homebrew/Cellar/openresty/1.11.2.3/luajit/lib/lua/5.1/resty/dns/resolver.so'
	no file '/usr/local/lib/lua/5.1/loadall.so'
	no file '/Users/zachwalton/.homebrew/Cellar/openresty/1.11.2.3/site/lualib/resty.so'
	no file '/Users/zachwalton/.homebrew/Cellar/openresty/1.11.2.3/lualib/resty.so'
	no file './resty.so'
	no file '/usr/local/lib/lua/5.1/resty.so'
	no file '/Users/zachwalton/.homebrew/Cellar/openresty/1.11.2.3/luajit/lib/lua/5.1/resty.so'
	no file '/usr/local/lib/lua/5.1/loadall.so'

The module is present at /Users/zachwalton/.homebrew/Cellar/openresty/1.11.2.3/lualib/resty/dns/resolver.lua, but in the path it's looking for /Users/zachwalton/.homebrew/Cellar/openresty/1.11.2.3/lualib/resty/dns/resolver.so.

New to Lua so feel free to chastise me if I'm doing something wrong.

the code did not worked
local answers, err = r:query("216.58.221.164")

got the error
server returned error code: 3: name error

ERROR: /usr/local/openresty/lualib/resty/dns/resolver.lua:384: bad argument #1 to 'lshift' (number expected, got nil)
stack traceback:
/usr/local/openresty/lualib/resty/dns/resolver.lua:384: in function 'parse_section'
/usr/local/openresty/lualib/resty/dns/resolver.lua:745: in function 'parse_response'
/usr/local/openresty/lualib/resty/dns/resolver.lua:909: in function 'query'
test.lua:19: in function 'file_gen'
init_worker_by_lua:45: in function <init_worker_by_lua:43>
[C]: in function 'xpcall'
init_worker_by_lua:52: in function <init_worker_by_lua:50>
It seems to be an issue with lua-resty-dns. Do you have any suggestions for the next steps?

looks like /etc/hosts is not supported yet,
which becomes an issue for docker run with --link

Could it be considered to move the DNS library within the lua-resty-core repository?

The idea behind is to create a unique package having the basic functionality to create custom upstreams ngx and dns resolvers resolver.

By doing this basically one single could package could be installed after having nginx + lua already compiled. (FreeBSD nginx port + lua-resty-core)

The current structure of lua-resty-core including DNS is like this::

├── ngx
│   ├── balancer.lua
│   ├── ocsp.lua
│   ├── re.lua
│   ├── semaphore.lua
│   ├── ssl
│   │   └── session.lua
│   └── ssl.lua
└── resty
    ├── core
    │   ├── base.lua
    │   ├── base64.lua
    │   ├── ctx.lua
    │   ├── exit.lua
    │   ├── hash.lua
    │   ├── misc.lua
    │   ├── regex.lua
    │   ├── request.lua
    │   ├── response.lua
    │   ├── shdict.lua
    │   ├── time.lua
    │   ├── uri.lua
    │   ├── var.lua
    │   └── worker.lua
    ├── core.lua
    └── dns
        └── resolver.lua

is there any chance to get the wire format as a result of query() ?

I get the TTL from Google DNS server (8.8.8.8) via query method is dynamic, it will decrease the TTL every time I call this function, until 0.

How to get the domain original TTL, which is set by DNS owner?

There is a dns resolving action that is performed pretty much on every request to the server. Eventually we start seeing the "failed to set peer name: resource temporarily unavailable". Any ideas why that could be happening?
Thanks.

I am currently working on some PTR queries using lua-resty-dns, where it took me quite some effort in build the rDNS string for IPv6 addresses, especially in shortened (::) notation. Would it be interesting to include such a helper function in lua-resty-dns to build strings like b.a.9.8.7.6.5.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa for ipv6 and 5.2.0.192.in-addr.arpa for ipv4?
In particular I am thinking about a function called rdns_string that looks roughly like this:

_M.expand_ipv6_address = function (ip)
  ...
  return expanded_ipv6_address
end

_M.rdns_string = function (ip)
  if ipv6 then
    local ip = _M.expand_ipv6_address (ip)
    ...
    return ipv6_rdns_string
  else
    ...
    return ipv4_rdns_string
  end
end

Hello,
I am getting following error while resolving IPV6 host:

failed to set peer name: failed to parse host name "1011:568:feed::1": invalid port

hi, when I try to use this module it got me this error:
nginx: [error] init_by_lua error: .../modules/lua-resty-dns-master/lib/resty/dns/resolver.lua:92: attempt to call local 'new_tab' (a table value)
stack traceback:
.../modules/lua-resty-dns-master/lib/resty/dns/resolver.lua:92: in main chunk
[C]: in function 'require'
init_by_lua:2: in main chunk

the configuration that I use in nginx.conf is :
lua_package_path "/etc/nginx/modules/lua-resty-dns-master/lib/resty/dns/resolver.lua";

Is there something that I doing wrong? Thanks.

Update: is it need to use lua 5.2.3? because my current lua version is 5.1.4

Update: this issues is resolved by not using require "resty.dns.resolver" in init_by_lua_block. THanks

We've had a number of cases where we had inexplicable things happen with dns resolution. Turned out, that multiple name servers had been configured and they did not all respond in the same way.

To make it easier to troubleshoot those cases, would a PR be accepted that would make the query methods also return the ip:port of the nameserver that provided the answer?

Noticed that if you have a resolver that returns connection refused, then the library raises an exception:

Jan  2 14:24:51 klic local7.err nginx: 2019/01/02 14:24:51 [error] 44#44: *5 recv() failed (111: Connection refused), client: 172.17.0.1, server: _, request: "POST /l HTTP/1.1", host: "172.17.0.2"

Trivial to replicate if you set one of your resolvers to 127.0.0.1 (or 0.0.0.0).

Expected behaviour probably should be that the library retries with any other nameservers supplied when available.

iirc the current implementation is limited per handler because the sockets share the lifetime of the handler in which they were created. As such caching the resolver objects in a module level upvalue won't work because on the next request, all sockets will have been closed.

Now if the code were changed such that;

• local sock = pick_sock(self, socks) would become local sock = send_query(self, socks, query)
• and send_query would, just as currently, pick the socket, but would also send the query, and return the socket only for reading the response.
• if sending fails with a closed error, then it would reinitialize the connection by calling setpeername again (or even create a new socket), and retry sending the query.

then it would become possible to reuse the resolver objects, and cache them on a module level. Instead of recreating and initializing the entire resolver objects, it would only take recreating a single socket connection.

Is this feasible? any other thoughts? with a positive response, I wouldn't mind creating a PR for this.

(PS. I'm aware that a single resolver object should never be reused by a handler while it is still in the process of resolving a request for another handler and is currently yielded, waiting for socket operations)

This library doesn't handle the TTL by storing the resolution in a local cache, is this correct?

Hello,
How to return domain name by ip address? Not PTR record
For example nslookup 8.8.8.8 will return dns.google

Is there any plan to add support for edns, mainly for client-subnet?

hello zhang :
I have two questions:

1.I want to know if this module use dns cache for ip, and will the module query the local hosts file when it resolver dns?

2.if i use lua-resty-redis module , when ip of redis domain changed and call redis again, will the lua-resty-redis module resolve the redis domain realtime or throw a exception ?

thanks.

I see lua-resty-dns is using math.random to generate packet ids.

This sounds similar to nginx dns cache poisoning vulnerability: http://blog.zorinaq.com/nginx-resolver-vulns/ (more useful info in https://news.ycombinator.com/item?id=14316430).

Would properly calling math.randomseed prevent this? Would it be reasonable to be able to swap the id generator function to something using secure random generator?

Hi guys,

can we micro cache the answers for 15 secs so lua doesn't have to always query the result?

Cheer.

The UDP part can be sequentially used for multiple requests. But the TCP socket is closed upon completion, and hence the second request fails because the socket is closed.

So instead of creating the TCP socket up front (in new, I think it should be created upon actually querying in _tcp_query.

Correct?

In resolver.lua, the last 7 bits is use as code:
local code = band(flags, 0x7f)
and fill answers.errcode with this code
if code ~= 0 then
answers.errcode = code
answers.errstr = resolver_errstrs[code] or "unknown"
end

Which is wrong according to rfc4035.
Only the last 4 bits are the RCODE. Using the last 7 bits may make some normal response to be considered error.

Hi,

We have problem with domain-name resolution when running on kubernetes pure ipv6. The nodes in cluster do not have assigned fqdns. There is however a name (netguard-dns) that is resolvable by dns on the nginx node (the edge-node). We run however into problems with this approach as the domain-name is not resolvable - for example when making get token request. We checked domain-name resolution (via nslookup, dig) throughout the cluster and it works, however requests on this domain-name fail,

F.e. when trying to get token, we've got following log from nginx ingress-controller:

{"type":"log","level":"ERROR","facility":"23","time":"2020-05-04T21:29:44.459+00:00","timezone":"UTC","process":"nginx","system":"CITM nginx","systemid":"citm-citm-ingress-controller-6z47q","host":"nsmc-ipv6-edge-01","log":{"message":"93#93: *296 [lua] openidc.lua:502: call_token_endpoint(): accessing token endpoint (https://netguard-dns/auth/realms/netguard/protocol/openid-connect/token) failed: netguard-dns could not be resolved (2: Server failure), client: 2a00:8a00:4000:7622:f816:3eff:fe1d:dc75, server: _, request: 'GET /sso-redirect?state=4935cb01f42c3facebf7d7a87b014ad4&session_state=e9c710fb-c3c8-47a9-9d23-c5f82e0dfde3&code=1a41a825-c718-43aa-a537-788dff1f47fe.e9c710fb-c3c8-47a9-9d23-c5f82e0dfde3.ca00b0f3-0d6a-45b3-951c-a4981376cf97 HTTP/2.0', host: 'netguard-dns', referrer: 'https://netguard-dns/auth/realms/netguard/protocol/openid-connect/auth?response_type=code&nonce=423145c66b107c9b20384f5cfa832d8a&scope=openid%20email%20profile&state=4935cb01f42c3facebf7d7a87b014ad4&redirect_uri=https%3A%2F%2Fnetguard-dns%2Fsso-redirect&client_id=base_platform_sso'"}}

What should be the proper configuration in case of running kubernetes on pure ipv6 from lua-openresty point of view?

Are there maybe some specific parameters to be configured in opts passed to openidc.authenticate(opts, target_url, unauth_action, session_opts) method?

---------------------DNS CONFIGURATION

#ingress-controller(nginx) has configured resolver as:
kubectl exec -n base nginx-ingress-controller-lpkfs cat /etc/nginx/nginx.conf | grep resolver

resolver [fd6a:b5d7:21dd:f829::4] valid=30s;

#The resolver points to the internal IP address of ingress-controller pod:
kubectl get pod -n base -o wide

NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
nginx-ingress-controller-lpkfs 1/1 Running 0 57m fd6a:b5d7:21dd:f829::4 ipv6-edge-01
...

#nginx-ingress-controller-lpkfs pod (fd6a:b5d7:21dd:f829::4) /etc/hosts:

kubectl exec -it -n base citm-citm-ingress-controller-lpkfs bash

[nginx@ipv6-edge-01 /]$ cat /etc/hosts
#Kubernetes-managed hosts file (host network).
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
fd6a:b5d7:21dd:f829::4 ipv6-edge-01
2a00:8a00:4000:7622:f816:3eff:febd:d523 netguard-dns

and 2a00:8a00:4000:7622:f816:3eff:febd:d523 is ip address of the ingress-controller(nginx) node (edge-node).

Also the dnsmasq service is configured to resolve 2a00:8a00:4000:7622:f816:3eff:febd:d523 netguard-dns

--------------Used lua libs versions:

#openidc.lua
local openidc = {
_VERSION = "1.7.2"
}

#resty/http.lua
local _M = {
_VERSION = '0.13',
}

#resty/dns/resolver.lua
local _M = {
_VERSION = '0.21',

In the _tcp_query function https://github.com/openresty/lua-resty-dns/blob/273db4f348d4676f554c5319a902e7b836153192/lib/resty/dns/resolver.lua#L790C16-L790C26,

The TCP socket is closed after query:

What if another _tcp_query is called? Like here: https://github.com/openresty/lua-resty-dns/blob/273db4f348d4676f554c5319a902e7b836153192/lib/resty/dns/resolver.lua#L916C27-L916C27

the configuration property "nameservers" is not in the documentation

Hi,

When we do "dig @8.8.8.8 +short NS " returns NS list correctly.

When we do "dig @37.235.1.174 +short NS " returns nothing.

Is it possibile that the second resolver has some security restrictions or it can be a a problem in our code?

Thanks a lot!
Eug

Is it possible to use EDNS ?

Since the dns server cannot be accessed directly, I need to go through a proxy when accessing the dns server

域名解析报错 server returned error code: 3: name error
name error 是什么意思？

The UDP query does do retries, the TCP one doesn't. Is there a specific reason behind this? if not I could provide a PR.

In some cases, I'm seeing an extra character preceding TXT record values (ans.txt).

• when the TXT record value at my DNS provider is set to Redirects to https://github.com/holic, the ans.txt value returned by r:query is %Redirects to http://example.com/
• when the TXT record value at my DNS provider is set to redirect.name=https://github.com/holic, the ans.txt value returned by r:query is &redirect.name=http://example.com/
• when the TXT record is redirect=https://github.com/holic, the ans.txt value is !redirect=https://github.com/holic
• but when the TXT record is redirect=aaa, the ans.txt value is, as expected, redirect=aaa

Any ideas if this is due to parsing of the DNS response or due to the DNS reply sent by my DNS provider?