From 4f2da49fcd333dcd1542278dce5b9642dcdeb984 Mon Sep 17 00:00:00 2001 From: Ronan Pigott Date: Thu, 7 Mar 2024 14:27:52 -0700 Subject: [PATCH] resolved: refuse queries with no suitable scope In some cases there is no configured server to answer a given question, because all scopes refused the query. In this case we currently return rcode SERVFAIL. In dns it is customary for authoritative nameservers to return REFUSED where the question is outside of their authority. This is better than SERVFAIL because it informs the client that they aren't likely to get an answer out of us anytime soon, and either the configuration, or the query, need to change. Similar logic invites us to use use the rcode REFUSED on the stub if we aren't configured with any suitable scope for this question. --- src/resolve/resolved-dns-stub.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/resolve/resolved-dns-stub.c b/src/resolve/resolved-dns-stub.c index 87f7aab6e93..378d55e2302 100644 --- a/src/resolve/resolved-dns-stub.c +++ b/src/resolve/resolved-dns-stub.c @@ -837,6 +837,10 @@ static void dns_stub_query_complete(DnsQuery *query) { break; case DNS_TRANSACTION_NO_SERVERS: + /* We're not configured to give answers for this question. Refuse it. */ + (void) dns_stub_send_reply(q, DNS_RCODE_REFUSED); + break; + case DNS_TRANSACTION_INVALID_REPLY: case DNS_TRANSACTION_ERRNO: case DNS_TRANSACTION_ABORTED: -- 2.47.3