fix(docker): add usage instructions for rootless Podman and service ports

fix(cache): sync question section with current request to prevent mismatches
fix(forward): validate response types against request types in concurrent queries

Author: lazywalker

docker/docker-compose.yml

@@ -9,6 +9,12 @@
 # To make persistent across reboots, create a sysctl config file:
 #  echo "net.ipv4.ip_unprivileged_port_start=53" | sudo tee /etc/sysctl.d/99-unprivileged-ports.conf
 #  sudo sysctl --system
+#
+# Run with `--service-ports` to ensure all ports are exposed, especially for rootless Podman.
+# Example usage:
+#  podman compose -f docker-compose.yml run --rm --service-ports -it lazydns
+#  podman compose -f docker-compose.yml up -d
+
 
 services:
   lazydns:

src/plugins/cache.rs

@@ -645,6 +645,14 @@ impl CachePlugin {
                 q.qclass().to_u16()
             );
 
+            trace!(
+                "Generated cache key: {} | qname={} | qtype={:?} | qclass={:?}",
+                key,
+                qname_lower,
+                q.qtype(),
+                q.qclass()
+            );
+
             // TODO: Add EDNS0 flags if message has EDNS0
             // This would ensure DNSSEC queries are cached separately from non-DNSSEC
             // Currently, we focus on the main fix: domain name normalization
@@ -857,6 +865,11 @@ impl Plugin for CachePlugin {
                         let response_ref = Arc::make_mut(&mut response_arc);
                         Self::update_ttls(response_ref, STALE_RESPONSE_TTL_SECS); // stale response TTL is fixed to 5s (matches upstream)
                         response_ref.set_id(context.request().id());
+                        // Sync question section with current request to fix question/answer mismatch
+                        response_ref.clear_questions();
+                        for q in context.request().questions() {
+                            response_ref.add_question(q.clone());
+                        }
                         context.set_response_arc(Some(response_arc));
 
                         // Mark that response came from cache to prevent Phase 2 re-execution
@@ -1012,6 +1025,11 @@ impl Plugin for CachePlugin {
                     let response_ref = Arc::make_mut(&mut response_arc);
                     Self::update_ttls(response_ref, remaining_ttl);
                     response_ref.set_id(context.request().id());
+                    // Sync question section with current request to fix question/answer mismatch
+                    response_ref.clear_questions();
+                    for q in context.request().questions() {
+                        response_ref.add_question(q.clone());
+                    }
                     context.set_response_arc(Some(response_arc));
 
                     // Mark that response came from cache to prevent Phase 2 re-execution
@@ -1125,6 +1143,11 @@ impl Plugin for CachePlugin {
                         let response_ref = Arc::make_mut(&mut response_arc);
                         Self::update_ttls(response_ref, remaining_ttl);
                         response_ref.set_id(context.request().id());
+                        // Sync question section with current request to fix question/answer mismatch
+                        response_ref.clear_questions();
+                        for q in context.request().questions() {
+                            response_ref.add_question(q.clone());
+                        }
                         context.set_response_arc(Some(response_arc));
 
                         // Mark that response came from cache to prevent Phase 2 re-execution
@@ -1179,9 +1202,32 @@ impl Plugin for CachePlugin {
                     if ttl > 0 {
                         // Determine cache TTL: if cache_ttl is set, use it for positive answers
                         let cache_ttl = self.cache_ttl.unwrap_or(ttl);
+
+                        // Verify cache key matches request question type
+                        let request_qtype = context
+                            .request()
+                            .questions()
+                            .first()
+                            .map(|q| format!("{:?}", q.qtype()))
+                            .unwrap_or_else(|| "N/A".to_string());
+
+                        // Get response answer record types
+                        let answer_types: Vec<String> = response
+                            .answers()
+                            .iter()
+                            .map(|r| r.rtype())
+                            .collect::<std::collections::HashSet<_>>()
+                            .iter()
+                            .map(|rt| format!("{:?}", rt))
+                            .collect();
+
                         debug!(
-                            "Storing response in cache: {} (message TTL: {}s, cache TTL: {}s)",
-                            key, ttl, cache_ttl
+                            "Storing response in cache: {} | request_qtype={} | answer_types={} | message_ttl={}s | cache_ttl={}s",
+                            key,
+                            request_qtype,
+                            answer_types.join(","),
+                            ttl,
+                            cache_ttl
                         );
 
                         // Always create/replace with new entry
@@ -1909,4 +1955,52 @@ plugins:
         // because we're testing with a different cache instance. But we've verified the task
         // spawns and runs without errors.
     }
+
+    #[tokio::test]
+    async fn test_cache_hit_syncs_question_section() {
+        // Test the critical fix: cache hit should sync question section with current request
+        let cache = CachePlugin::new(100);
+
+        // Create initial A query response with A question
+        let mut a_response = create_test_response();
+        a_response.clear_questions();
+        a_response.add_question(Question::new("example.com", RecordType::A, RecordClass::IN));
+
+        // Store in cache with key "example.com:1:1" (A query)
+        let entry = CacheEntry::new(a_response, 300, 300);
+        cache
+            .cache
+            .write()
+            .push("example.com:1:1".to_string(), entry);
+
+        // Verify the cached response has A question
+        let cached = cache.cache.write().get("example.com:1:1").cloned();
+        assert!(cached.is_some());
+        let cached_resp = cached.unwrap().response;
+        assert_eq!(cached_resp.questions()[0].qtype(), RecordType::A);
+
+        // Simulate what cache does: prepare response for AAAA request
+        // by syncing question section (this is the fix)
+        let mut aaaa_request = Message::new();
+        aaaa_request.add_question(Question::new(
+            "example.com",
+            RecordType::AAAA,
+            RecordClass::IN,
+        ));
+
+        if let Some(entry) = cache.cache.write().get("example.com:1:1").cloned() {
+            let mut response_arc = Arc::clone(&entry.response);
+            let response_ref = Arc::make_mut(&mut response_arc);
+
+            // This is the fix: sync question section with current request
+            response_ref.clear_questions();
+            for q in aaaa_request.questions() {
+                response_ref.add_question(q.clone());
+            }
+
+            // Verify the question section was updated
+            assert_eq!(response_ref.question_count(), 1);
+            assert_eq!(response_ref.questions()[0].qtype(), RecordType::AAAA);
+        }
+    }
 }

src/plugins/forward.rs

@@ -847,11 +847,51 @@ impl ForwardPlugin {
             tasks.push(task);
         }
 
-        // Wait for first success
+        // Get request qtype for validation
+        let request_qtype = request.questions().first().map(|q| q.qtype());
+
+        // Wait for first success with response validation
         for task in tasks {
             if let Ok(Ok(response)) = task.await {
-                trace!(answers = ?response.answers(), "Got fastest response in concurrent mode");
-                return Ok(response);
+                // CRITICAL FIX: Validate response answers match request query type
+                // This prevents mismatched responses from concurrent queries being returned
+                let response_valid = match request_qtype {
+                    Some(req_qtype) => {
+                        // Check if response has answers and if ANY answer matches the request type
+                        if response.answers().is_empty() {
+                            // Empty answer is valid (NODATA response)
+                            true
+                        } else {
+                            // At least one answer must match the requested type
+                            response
+                                .answers()
+                                .iter()
+                                .any(|record| record.rtype() == req_qtype)
+                        }
+                    }
+                    None => true, // No request question, accept any response
+                };
+
+                if response_valid {
+                    debug!(
+                        answers = ?response.answers(),
+                        "Got fastest response in concurrent mode (validated)"
+                    );
+                    return Ok(response);
+                } else {
+                    // Response doesn't match request type - skip and continue
+                    warn!(
+                        "Skipping concurrent response with mismatched answer type. \
+                        Request: {:?}, Response answers: {:?}",
+                        request_qtype,
+                        response
+                            .answers()
+                            .iter()
+                            .map(|r| format!("{}:{:?}", r.name(), r.rtype()))
+                            .collect::<Vec<_>>()
+                    );
+                    continue;
+                }
             }
         }
 
@@ -1684,4 +1724,84 @@ mod tests {
         let url = format!("https://localhost:{}/dns-query", local_addr.port());
         (url, handle)
     }
+
+    #[test]
+    fn test_concurrent_response_validation_filters_mismatched_types() {
+        // This test verifies that execute_concurrent validates response types match request types
+        // Scenario: Two concurrent requests (A and AAAA) should each get correct response type
+
+        let mut req_a = Message::new();
+        req_a.add_question(Question::new("example.com", RecordType::A, RecordClass::IN));
+
+        let mut req_aaaa = Message::new();
+        req_aaaa.add_question(Question::new(
+            "example.com",
+            RecordType::AAAA,
+            RecordClass::IN,
+        ));
+
+        // Create response with AAAA record when A was requested
+        let mut wrong_response = Message::new();
+        wrong_response.add_answer(ResourceRecord::new(
+            "example.com",
+            RecordType::AAAA, // Response has AAAA but request is A
+            RecordClass::IN,
+            300,
+            RData::AAAA("2001:db8::1".parse().unwrap()),
+        ));
+
+        // The concurrent validator should detect this mismatch
+        // When request is for A type but response contains only AAAA records,
+        // it should be marked as invalid and skipped
+        let request_qtype = req_a.questions().first().map(|q| q.qtype());
+
+        let response_valid = match request_qtype {
+            Some(req_qtype) => {
+                if wrong_response.answers().is_empty() {
+                    true
+                } else {
+                    wrong_response
+                        .answers()
+                        .iter()
+                        .any(|record| record.rtype() == req_qtype)
+                }
+            }
+            None => true,
+        };
+
+        // Should be invalid: A request getting AAAA response
+        assert!(
+            !response_valid,
+            "Response with wrong answer type should be rejected"
+        );
+
+        // Now test correct response is accepted
+        let mut correct_response = Message::new();
+        correct_response.add_answer(ResourceRecord::new(
+            "example.com",
+            RecordType::A, // Correct type for A request
+            RecordClass::IN,
+            300,
+            RData::A("192.0.2.1".parse().unwrap()),
+        ));
+
+        let response_valid = match request_qtype {
+            Some(req_qtype) => {
+                if correct_response.answers().is_empty() {
+                    true
+                } else {
+                    correct_response
+                        .answers()
+                        .iter()
+                        .any(|record| record.rtype() == req_qtype)
+                }
+            }
+            None => true,
+        };
+
+        assert!(
+            response_valid,
+            "Response with matching answer type should be accepted"
+        );
+    }
 }