From 6669973c3f1bc9e93776da0a91e7e75c58630c3a Mon Sep 17 00:00:00 2001
From: Ronan Pigott <ronan@rjp.ie>
Date: Thu, 7 Mar 2024 14:27:52 -0700
Subject: [PATCH 0444/1160] resolved: refuse queries with no suitable scope

In some cases there is no configured server to answer a given question,
because all scopes refused the query. In this case we currently return
rcode SERVFAIL.

In dns it is customary for authoritative nameservers to return REFUSED
where the question is outside of their authority. This is better than
SERVFAIL because it informs the client that they aren't likely to get an
answer out of us anytime soon, and either the configuration, or the
query, need to change.

Similar logic invites us to use use the rcode REFUSED on the stub if we
aren't configured with any suitable scope for this question.

(cherry picked from commit 4f2da49fcd333dcd1542278dce5b9642dcdeb984)
---
 src/resolve/resolved-dns-stub.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/resolve/resolved-dns-stub.c b/src/resolve/resolved-dns-stub.c
index c59e3b7f49..c4bc034ea1 100644
--- a/src/resolve/resolved-dns-stub.c
+++ b/src/resolve/resolved-dns-stub.c
@@ -837,6 +837,10 @@ static void dns_stub_query_complete(DnsQuery *query) {
                 break;
 
         case DNS_TRANSACTION_NO_SERVERS:
+                /* We're not configured to give answers for this question. Refuse it. */
+                (void) dns_stub_send_reply(q, DNS_RCODE_REFUSED);
+                break;
+
         case DNS_TRANSACTION_INVALID_REPLY:
         case DNS_TRANSACTION_ERRNO:
         case DNS_TRANSACTION_ABORTED:
-- 
2.33.0