Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add DNSStaticResolver option #7336

Merged
merged 7 commits into from
Feb 23, 2024
Merged

Add DNSStaticResolver option #7336

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
bfbcdaa
Add DNSStaticResolver option
mcpherrinm Feb 23, 2024
33f279b
Fix
mcpherrinm Feb 23, 2024
2784dd8
Test configs
mcpherrinm Feb 23, 2024
ae62945
Use Doh ports with Doh flag enabled
mcpherrinm Feb 23, 2024
7f271ba
And use IP from cert
mcpherrinm Feb 23, 2024
5995926
Validate hostname_port
mcpherrinm Feb 23, 2024
24a6c92
Comment documenting DNSStaticResolvers
mcpherrinm Feb 23, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 15 additions & 9 deletions cmd/boulder-va/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,9 +26,13 @@ type Config struct {
// DNSTries is the number of times to try a DNS query (that has a temporary error)
// before giving up. May be short-circuited by deadlines. A zero value
// will be turned into 1.
DNSTries int
DNSProvider *cmd.DNSProvider `validate:"required"`
DNSTimeout config.Duration `validate:"required"`
DNSTries int
DNSProvider *cmd.DNSProvider `validate:"required_without=DNSStaticResolvers"`
// DNSStaticResolvers is a list of DNS resolvers. Each entry must
// be a host or IP and port separated by a colon. IPv6 addresses
// must be enclosed in square brackets.
DNSStaticResolvers []string `validate:"required_without=DNSProvider,dive,hostname_port"`
DNSTimeout config.Duration `validate:"required"`
DNSAllowLoopbackAddresses bool

RemoteVAs []cmd.GRPCClientConfig `validate:"omitempty,dive"`
Expand Down Expand Up @@ -79,17 +83,19 @@ func main() {
}
clk := cmd.Clock()

if c.VA.DNSProvider == nil {
cmd.Fail("Must specify dnsProvider")
}

var servers bdns.ServerProvider
proto := "udp"
if features.Get().DOH {
proto = "tcp"
}
servers, err = bdns.StartDynamicProvider(c.VA.DNSProvider, 60*time.Second, proto)
cmd.FailOnError(err, "Couldn't start dynamic DNS server resolver")

if len(c.VA.DNSStaticResolvers) != 0 {
servers, err = bdns.NewStaticProvider(c.VA.DNSStaticResolvers)
cmd.FailOnError(err, "Couldn't start static DNS server resolver")
} else {
servers, err = bdns.StartDynamicProvider(c.VA.DNSProvider, 60*time.Second, proto)
cmd.FailOnError(err, "Couldn't start dynamic DNS server resolver")
}
defer servers.Stop()

tlsConfig, err := c.VA.TLS.Load(scope)
Expand Down
11 changes: 4 additions & 7 deletions test/config-next/va-remote-a.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,13 +2,10 @@
"va": {
"userAgent": "boulder-remote-a",
"dnsTries": 3,
"dnsProvider": {
"dnsAuthority": "consul.service.consul",
"srvLookup": {
"service": "doh",
"domain": "service.consul"
}
},
"dnsStaticResolvers": [
"10.77.77.77:8343",
"10.77.77.77:8443"
],
"dnsTimeout": "1s",
"dnsAllowLoopbackAddresses": true,
"issuerDomain": "happy-hacker-ca.invalid",
Expand Down
11 changes: 4 additions & 7 deletions test/config-next/va-remote-b.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,13 +2,10 @@
"va": {
"userAgent": "boulder-remote-b",
"dnsTries": 3,
"dnsProvider": {
"dnsAuthority": "consul.service.consul",
"srvLookup": {
"service": "doh",
"domain": "service.consul"
}
},
"dnsStaticResolvers": [
"10.77.77.77:8343",
"10.77.77.77:8443"
],
"dnsTimeout": "1s",
"dnsAllowLoopbackAddresses": true,
"issuerDomain": "happy-hacker-ca.invalid",
Expand Down
Loading