feat(dns): status reports what the resolver accepted, not what we wrote - #197
Merged
Conversation
The check that existed compared the config file against the registry --
two numbers we control, which agreed with each other -- and said nothing.
The resolver is the one that gets a vote, and it silently declines to
take them all: handed 4586 endings, systemd-resolved accepted 1090
alphabetically, rejected the rest one journal line at a time with
"Argument list too long", and reported success.
That is why `moshcode dns resolve chovy.hacker` answered while `curl
chovy.hacker` could not resolve, with `dns status` calling the routing
configured throughout. Nothing in the output distinguished an ending that
routed from one that had been dropped.
Run against this machine in that exact state, status now says:
! wrote 4586 endings, the resolver accepted 1090 — 3561 are not routed
missing: criminology crip cripple cripples crips crochet … and 3553 more
systemd-resolved caps how many search domains it takes and drops the rest:
journalctl -u systemd-resolved | grep 'Argument list too long'
a name in that list answers `moshcode dns resolve` and fails `curl`.
The missing list starts at the alphabetical cut, which is the evidence:
`.hacker` sits past it.
Unknown is never "none". A machine with no resolvectl -- dnsmasq, macOS,
anything not systemd -- gets null and is told nothing, rather than being
told its routing is missing.
Kept useful after the catch-all lands: `~.` cannot be truncated, so this
stays quiet there and keeps reporting for anyone still on a per-ending
config, which is every installed copy until they upgrade.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
vu1nz Security Review0 finding(s) in PR #? No security issues found. |
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Recovers a commit that was orphaned: it was pushed to #195's branch after #195 had already been squash-merged, so it never reached
main.The bug
The check that existed compared the config file against the registry — two numbers we control, which agreed with each other — and said nothing. The resolver is the only party that gets a vote, and it silently declines to take them all: handed 4,586 endings, systemd-resolved accepts ~1,090 alphabetically, rejects the rest one journal line at a time with
Argument list too long, and reports success.That's why
moshcode dns resolve chovy.hackeranswers whilecurl chovy.hackercannot resolve, withdns statuscalling the routing configured throughout.Run against a machine in that state
The missing list starts at the alphabetical cut, which is the evidence —
.hackersits past it.Details
resolvectl— dnsmasq, macOS, anything not systemd — getsnulland is told nothing, rather than told its routing is missing.~.cannot be truncated, so this stays quiet on a catch-all config and keeps reporting for anyone still on a per-ending one — which is every installed copy until they upgrade.Tests
Included in
test/dns-catchall.test.mjs, covering the parser, the shortfall calculation, the unknown-resolver case, and a reproduction of the 4586→1090 cut.🤖 Generated with Claude Code