Anonymize single-label DNS zones in debug bundles

client/internal/debug/debug.go

@@ -1551,7 +1551,7 @@ func anonymizeRoute(route *mgmProto.Route, anonymizer *anonymize.Anonymizer) {
 	}
 
 	for i, domain := range route.Domains {
-		route.Domains[i] = anonymizer.AnonymizeDomain(domain)
+		route.Domains[i] = anonymizer.AnonymizeDomainName(domain)
 	}
 
 	route.NetID = anonymizer.AnonymizeString(route.NetID)
@@ -1583,20 +1583,21 @@ func anonymizeBundleGenerators(servers []*mgmProto.NameServer, anonymizer *anony
 
 func anonymizeDomains(domains []string, anonymizer *anonymize.Anonymizer) {
 	for i, domain := range domains {
-		domains[i] = anonymizer.AnonymizeDomain(domain)
+		domains[i] = anonymizer.AnonymizeDomainName(domain)
 	}
 }
 
 func anonymizeCustomZones(zones []*mgmProto.CustomZone, anonymizer *anonymize.Anonymizer) {
 	for _, zone := range zones {
-		zone.Domain = anonymizer.AnonymizeDomain(zone.Domain)
+		// The zone goes first: its records are then keyed on it.
+		zone.Domain = anonymizer.AnonymizeDomainName(zone.Domain)
 		anonymizeRecords(zone.Records, anonymizer)
 	}
 }
 
 func anonymizeRecords(records []*mgmProto.SimpleRecord, anonymizer *anonymize.Anonymizer) {
 	for _, record := range records {
-		record.Name = anonymizer.AnonymizeDomain(record.Name)
+		record.Name = anonymizer.AnonymizeDomainName(record.Name)
 		anonymizeRData(record, anonymizer)
 	}
 }

client/internal/debug/debug_test.go

@@ -447,6 +447,52 @@ func TestAnonymizeNetworkMap(t *testing.T) {
 	}
 }
 
+// TestAnonymizeNetworkMap_SingleLabelZone covers the shape a real bundle
+// carried: a custom zone named by a single label, alongside a nameserver group
+// whose match domain is an ordinary two-label domain. The single-label zone
+// used to pass through in the clear while its own records were anonymized.
+func TestAnonymizeNetworkMap_SingleLabelZone(t *testing.T) {
+	networkMap := &mgmProto.NetworkMap{
+		DNSConfig: &mgmProto.DNSConfig{
+			NameServerGroups: []*mgmProto.NameServerGroup{
+				{
+					NameServers: []*mgmProto.NameServer{{IP: "203.0.113.53"}},
+					Domains:     []string{"example.net"},
+				},
+			},
+			CustomZones: []*mgmProto.CustomZone{
+				{
+					Domain: "corp.",
+					Records: []*mgmProto.SimpleRecord{
+						{Name: "test.corp.", Type: 1, RData: "203.0.113.10"},
+						{Name: "app.corp.", Type: 1, RData: "203.0.113.10"},
+					},
+				},
+			},
+		},
+		Routes: []*mgmProto.Route{
+			{Network: "203.0.113.0/24", Domains: []string{"corp"}, NetID: "net-1"},
+		},
+	}
+
+	anonymizer := anonymize.NewAnonymizer(anonymize.DefaultAddresses())
+	require.NoError(t, anonymizeNetworkMap(networkMap, anonymizer), "anonymize the network map")
+
+	zone := networkMap.DNSConfig.CustomZones[0]
+	assert.NotContains(t, zone.Domain, "corp", "the single-label zone name should not survive")
+	assert.Regexp(t, `^anon-[a-zA-Z0-9]+\.domain\.$`, zone.Domain, "the zone should be replaced by an anon domain, trailing dot kept")
+
+	for _, record := range zone.Records {
+		assert.NotContains(t, record.Name, "corp", "a record name should not carry the original zone")
+		assert.True(t, strings.HasSuffix(record.Name, "."+zone.Domain),
+			"record %q should sit under the anonymized zone %q", record.Name, zone.Domain)
+	}
+
+	assert.NotContains(t, networkMap.DNSConfig.NameServerGroups[0].Domains[0], "example",
+		"the nameserver match domain should not survive")
+	assert.NotContains(t, networkMap.Routes[0].Domains[0], "corp", "a route domain should not survive")
+}
+
 func TestIsSensitiveEnvVar(t *testing.T) {
 	tests := []struct {
 		key       string

client/internal/dns/server.go

@@ -356,7 +356,7 @@ func (s *DefaultServer) RegisterHandler(domains domain.List, handler dns.Handler
 }
 
 func (s *DefaultServer) registerHandler(domains []string, handler dns.Handler, priority int) {
-	log.Debugf("registering handler %s with priority %d for %v", handler, priority, domains)
+	log.Debugf("registering handler %s with priority %d for %s", handler, priority, joinDomainsForLog(domains))
 
 	for _, domain := range domains {
 		if domain == "" {
@@ -417,7 +417,7 @@ func (s *DefaultServer) CancelBatch() {
 }
 
 func (s *DefaultServer) deregisterHandler(domains []string, priority int) {
-	log.Debugf("deregistering handler with priority %d for %v", priority, domains)
+	log.Debugf("deregistering handler with priority %d for %s", priority, joinDomainsForLog(domains))
 
 	for _, domain := range domains {
 		if domain == "" {
@@ -1362,6 +1362,16 @@ func joinAddrPorts(servers []netip.AddrPort) string {
 	return strings.Join(parts, ", ")
 }
 
+// joinDomainsForLog renders domains as domain=<name> tokens, the form the
+// debug bundle recognizes as a DNS name when it anonymizes a log line.
+func joinDomainsForLog(domains []string) string {
+	parts := make([]string, 0, len(domains))
+	for _, d := range domains {
+		parts = append(parts, "domain="+d)
+	}
+	return strings.Join(parts, " ")
+}
+
 // generateGroupKey returns a stable identity for an NS group so health
 // state (everHealthy / warningActive) survives reorderings in the
 // configured nameserver or domain lists.