From 9cedc555709268e84489d08ac11b60992c9be9b9 Mon Sep 17 00:00:00 2001 From: Brad Fitzpatrick Date: Mon, 16 Oct 2023 09:16:01 -0700 Subject: net/dnsfallback, control/controlknobs: add knob to disable recursive resolver Updates tailscale/corp#15261 Change-Id: I099860c400c82617382723b96fd3a5193c45f0d7 Signed-off-by: Brad Fitzpatrick --- control/controlknobs/controlknobs.go | 15 +++++++++++++++ 1 file changed, 15 insertions(+) (limited to 'control/controlknobs/controlknobs.go') diff --git a/control/controlknobs/controlknobs.go b/control/controlknobs/controlknobs.go index e64bc8011..2678ba494 100644 --- a/control/controlknobs/controlknobs.go +++ b/control/controlknobs/controlknobs.go @@ -52,6 +52,10 @@ type Knobs struct { // DisableDNSForwarderTCPRetries is whether the DNS forwarder should // skip retrying truncated queries over TCP. DisableDNSForwarderTCPRetries atomic.Bool + + // DisableRecursiveResolver is whether the node should disable the + // dnsfallback recursive resolver. + DisableRecursiveResolver atomic.Bool } // UpdateFromNodeAttributes updates k (if non-nil) based on the provided self @@ -74,6 +78,7 @@ func (k *Knobs) UpdateFromNodeAttributes(selfNodeAttrs []tailcfg.NodeCapability, forceBackgroundSTUN = has(tailcfg.NodeAttrDebugForceBackgroundSTUN) peerMTUEnable = has(tailcfg.NodeAttrPeerMTUEnable) dnsForwarderDisableTCPRetries = has(tailcfg.NodeAttrDNSForwarderDisableTCPRetries) + dnsDisableRecursiveResolver = has(tailcfg.NodeAttrDisableRecursiveResolver) ) if has(tailcfg.NodeAttrOneCGNATEnable) { @@ -91,6 +96,7 @@ func (k *Knobs) UpdateFromNodeAttributes(selfNodeAttrs []tailcfg.NodeCapability, k.DisableDeltaUpdates.Store(disableDeltaUpdates) k.PeerMTUEnable.Store(peerMTUEnable) k.DisableDNSForwarderTCPRetries.Store(dnsForwarderDisableTCPRetries) + k.DisableRecursiveResolver.Store(dnsDisableRecursiveResolver) } // AsDebugJSON returns k as something that can be marshalled with json.Marshal @@ -111,3 +117,12 @@ func (k *Knobs) AsDebugJSON() map[string]any { "DisableDNSForwarderTCPRetries": k.DisableDNSForwarderTCPRetries.Load(), } } + +// EnableRecursiveResolver is whether the node should use its DNS recursive resolver +// as a fallback. It defaults to enabled unless disabled by the control plane. +func (k *Knobs) EnableRecursiveResolver() bool { + if k == nil { + return true + } + return !k.DisableRecursiveResolver.Load() +} -- cgit v1.3-3-g829e