fix(resolver): match custom DNS PTR queries case insensitively (#2191)

reverseAddresses is keyed by the output of dns.ReverseAddr, which is
always lower case, but handleReverseDNS looked the question name up
verbatim. A PTR query that uses different case (upper case hex nibbles
in ip6.arpa, an upper case IN-ADDR.ARPA suffix, or 0x20 encoding) then
missed the mapping and fell through to the next resolver.

DNS names are case insensitive, and the forward path already normalizes
both the keys and the lookup via util.ExtractDomainOnly, so this only
brings the reverse path in line.

Signed-off-by: maximilize <max@maxmax.ch>
Co-authored-by: maximilize <max@maxmax.ch>
Co-authored-by: Dimitri Herzog <dimitri.herzog@gmail.com>

Author: 3 people

resolver/custom_dns_resolver.go

@@ -107,7 +107,9 @@ func (r *CustomDNSResolver) LookupReverse(ip net.IP) []string {
 func (r *CustomDNSResolver) handleReverseDNS(request *model.Request) *model.Response {
 	question := request.Req.Question[0]
 	if question.Qtype == dns.TypePTR {
-		urls, found := r.reverseAddresses[question.Name]
+		// reverseAddresses is keyed by dns.ReverseAddr output, which is lower case:
+		// DNS names are case insensitive, so normalize before looking up.
+		urls, found := r.reverseAddresses[strings.ToLower(question.Name)]
 		if found {
 			answers := make([]dns.RR, 0, len(urls))
 			for _, url := range urls {

resolver/custom_dns_resolver_test.go

@@ -486,6 +486,50 @@ var _ = Describe("CustomDNSResolver", func() {
 				})
 			})
 		})
+		When("Reverse DNS request uses a different case", func() {
+			It("should resolve the defined domain name", func() {
+				By("ipv4", func() {
+					Expect(sut.Resolve(ctx, newRequest("123.143.168.192.IN-ADDR.ARPA.", PTR))).
+						Should(
+							SatisfyAll(
+								WithTransform(ToAnswer, SatisfyAll(
+									HaveLen(2),
+									ContainElements(
+										BeDNSRecord("123.143.168.192.IN-ADDR.ARPA.", PTR, "custom.domain."),
+										BeDNSRecord("123.143.168.192.IN-ADDR.ARPA.", PTR, "multiple.ips.")),
+								)),
+								HaveResponseType(ResponseTypeCUSTOMDNS),
+								HaveReason("CUSTOM DNS"),
+								HaveReturnCode(dns.RcodeSuccess),
+							))
+
+					// will not delegate to next resolver
+					m.AssertNotCalled(GinkgoT(), "Resolve", mock.Anything)
+				})
+
+				By("ipv6", func() {
+					Expect(sut.Resolve(ctx, newRequest("4.3.3.7.0.7.3.0.E.2.A.8.0.0.0.0.0.0.0.0.3.A.5.8.8.B.D.0.1.0.0.2.IP6.ARPA.",
+						PTR))).
+						Should(
+							SatisfyAll(
+								WithTransform(ToAnswer, SatisfyAll(
+									HaveLen(2),
+									ContainElements(
+										BeDNSRecord("4.3.3.7.0.7.3.0.E.2.A.8.0.0.0.0.0.0.0.0.3.A.5.8.8.B.D.0.1.0.0.2.IP6.ARPA.",
+											PTR, "ip6.domain."),
+										BeDNSRecord("4.3.3.7.0.7.3.0.E.2.A.8.0.0.0.0.0.0.0.0.3.A.5.8.8.B.D.0.1.0.0.2.IP6.ARPA.",
+											PTR, "multiple.ips.")),
+								)),
+								HaveResponseType(ResponseTypeCUSTOMDNS),
+								HaveReason("CUSTOM DNS"),
+								HaveReturnCode(dns.RcodeSuccess),
+							))
+
+					// will not delegate to next resolver
+					m.AssertNotCalled(GinkgoT(), "Resolve", mock.Anything)
+				})
+			})
+		})
 		When("Domain mapping is defined", func() {
 			It("subdomain must also match", func() {
 				Expect(sut.Resolve(ctx, newRequest("ABC.CUSTOM.DOMAIN.", A))).