From 7e44f7f91895b19f4f629de8a001575c667fc51d Mon Sep 17 00:00:00 2001 From: Viktor Liu Date: Thu, 23 Jul 2026 18:06:41 +0200 Subject: [PATCH] Only force DNS resolution for domain-type resources --- management/server/types/account.go | 2 +- management/server/types/account_test.go | 14 ++++++++++++-- 2 files changed, 13 insertions(+), 3 deletions(-) diff --git a/management/server/types/account.go b/management/server/types/account.go index 94a8a0564..1a3a30544 100644 --- a/management/server/types/account.go +++ b/management/server/types/account.go @@ -1531,7 +1531,7 @@ func (a *Account) forcesRoutingPeerDNSResolution(peerID string, routers map[stri } for _, resource := range a.NetworkResources { - if resource == nil || !resource.Enabled { + if resource == nil || !resource.Enabled || resource.Type != resourceTypes.Domain { continue } if _, ok := targeted[resource.ID]; !ok { diff --git a/management/server/types/account_test.go b/management/server/types/account_test.go index adc90868b..80f2a950a 100644 --- a/management/server/types/account_test.go +++ b/management/server/types/account_test.go @@ -1753,7 +1753,7 @@ func hasPrivateAccessPolicy(account *Account, serviceID string) bool { } func TestForcesRoutingPeerDNSResolution(t *testing.T) { - buildAccount := func(serviceEnabled, targetEnabled, resourceEnabled bool, targetType service.TargetType) *Account { + buildAccountRes := func(serviceEnabled, targetEnabled, resourceEnabled bool, targetType service.TargetType, resType resourceTypes.NetworkResourceType) *Account { return &Account{ Id: "accountID", Groups: map[string]*Group{ @@ -1764,7 +1764,7 @@ func TestForcesRoutingPeerDNSResolution(t *testing.T) { {ID: "r2", NetworkID: "net-1", AccountID: "accountID", PeerGroups: []string{"router-group"}, Enabled: true}, }, NetworkResources: []*resourceTypes.NetworkResource{ - {ID: "res-domain", AccountID: "accountID", NetworkID: "net-1", Type: resourceTypes.Domain, Domain: "ipinfo.io", Enabled: resourceEnabled}, + {ID: "res-domain", AccountID: "accountID", NetworkID: "net-1", Type: resType, Domain: "example.org", Enabled: resourceEnabled}, }, Services: []*service.Service{ { @@ -1777,6 +1777,10 @@ func TestForcesRoutingPeerDNSResolution(t *testing.T) { } } + buildAccount := func(serviceEnabled, targetEnabled, resourceEnabled bool, targetType service.TargetType) *Account { + return buildAccountRes(serviceEnabled, targetEnabled, resourceEnabled, targetType, resourceTypes.Domain) + } + t.Run("router peer for RP-targeted domain resource is forced", func(t *testing.T) { account := buildAccount(true, true, true, service.TargetTypeDomain) routers := account.GetResourceRoutersMap() @@ -1808,4 +1812,10 @@ func TestForcesRoutingPeerDNSResolution(t *testing.T) { account := buildAccount(true, true, true, service.TargetTypePeer) assert.False(t, account.forcesRoutingPeerDNSResolution("router-peer", account.GetResourceRoutersMap())) }) + + t.Run("not forced when targeted resource is not a domain", func(t *testing.T) { + account := buildAccountRes(true, true, true, service.TargetTypeDomain, resourceTypes.Host) + assert.False(t, account.forcesRoutingPeerDNSResolution("router-peer", account.GetResourceRoutersMap()), + "a domain target pointing at a non-domain resource must not force resolution") + }) }