metal-stack / firewall-controller

A kubernetes controller running on bare-metal firewalls, creating nftables rules, configures suricata, collects network metrics
MIT License
47 stars 4 forks source link

Follow CNAME and DNAME records #138

Closed mreiger closed 1 year ago

mreiger commented 1 year ago

Hi @GrigoriyMikhalkin can you have a look at what I am trying here and tell me if this is a valid approach? (Following the CNAME redirection with recursive DNS lookups)

Im still a bit concerned if this works as intended; in a test I got a name with multiple CNAME redirections resolved even though there were more redirection levels than the TTL I built into the recursive lookup. Also the code is at least somewhat ineffective: Usually the resolution of CNAME to A record comes in the same reply but this is currently ignored and a recursive DNS query vor the CNAME is done anyway.

So @chbmuc: I'd like to resolve these issues before I declare it ready for review.

mreiger commented 1 year ago

I think this is ready to look at now. Couple thoughts though:

Concerning DNAME: This seems to indicate that there's always a CNAME returned as well, so it may not be necessary to handle DNAME records separately.

Gerrit91 commented 1 year ago

From the code perspective I do not really understand it and I find it hard to read, but it's passing the integration tests and if you say it works, we can put this into the release.