plesk · npurtova · Nov 27, 2025 · Nov 27, 2025 · Nov 27, 2025 · Nov 27, 2025
diff --git a/consul_domain_fix.patch b/consul_domain_fix.patch
@@ -0,0 +1,62 @@
+diff --git a/vendor/github.com/letsencrypt/challtestsrv/dns.go b/vendor/github.com/letsencrypt/challtestsrv/dns.go
+index 98be04251..818aa35f6 100644
+--- a/vendor/github.com/letsencrypt/challtestsrv/dns.go
++++ b/vendor/github.com/letsencrypt/challtestsrv/dns.go
+@@ -5,6 +5,7 @@ import (
+ 	"io"
+ 	"net"
+ 	"net/http"
++	"strings"
+
+ 	"github.com/miekg/dns"
+ )
+@@ -53,7 +54,8 @@ func (s *ChallSrv) cnameAnswers(q dns.Question) []dns.RR {
+ 	}
+
+ 	// No mock data - check if we should forward to real DNS
+-	if s.useRealDNS && s.realDNSForwarder != nil {
++	// Skip forwarding for internal domains like .consul
++	if s.useRealDNS && s.realDNSForwarder != nil && !strings.HasSuffix(strings.ToLower(q.Name), ".consul.") {
+ 		s.log.Printf("CNAME query for %s: no mock data, forwarding to real DNS", q.Name)
+ 		realAnswers := s.realDNSForwarder.ForwardQuery(q)
+ 		if len(realAnswers) > 0 {
+@@ -92,7 +94,8 @@ func (s *ChallSrv) txtAnswers(q dns.Question) []dns.RR {
+ 	}
+
+ 	// No mock data - check if we should forward to real DNS
+-	if s.useRealDNS && s.realDNSForwarder != nil {
++	// Skip forwarding for internal domains like .consul
++	if s.useRealDNS && s.realDNSForwarder != nil && !strings.HasSuffix(strings.ToLower(q.Name), ".consul.") {
+ 		s.log.Printf("TXT query for %s: no mock data, forwarding to real DNS", q.Name)
+ 		realAnswers := s.realDNSForwarder.ForwardQuery(q)
+ 		if len(realAnswers) > 0 {
+@@ -142,7 +145,8 @@ func (s *ChallSrv) aAnswers(q dns.Question) []dns.RR {
+ 	}
+
+ 	// No mock data - check if we should forward to real DNS
+-	if s.useRealDNS && s.realDNSForwarder != nil {
++	// Skip forwarding for internal domains like .consul
++	if s.useRealDNS && s.realDNSForwarder != nil && !strings.HasSuffix(strings.ToLower(q.Name), ".consul.") {
+ 		s.log.Printf("A query for %s: no mock data, forwarding to real DNS", q.Name)
+ 		realAnswers := s.realDNSForwarder.ForwardQuery(q)
+ 		if len(realAnswers) > 0 {
+@@ -208,7 +212,8 @@ func (s *ChallSrv) aaaaAnswers(q dns.Question) []dns.RR {
+ 	}
+
+ 	// No mock data - check if we should forward to real DNS
+-	if s.useRealDNS && s.realDNSForwarder != nil {
++	// Skip forwarding for internal domains like .consul
++	if s.useRealDNS && s.realDNSForwarder != nil && !strings.HasSuffix(strings.ToLower(q.Name), ".consul.") {
+ 		s.log.Printf("AAAA query for %s: no mock data, forwarding to real DNS", q.Name)
+ 		realAnswers := s.realDNSForwarder.ForwardQuery(q)
+ 		if len(realAnswers) > 0 {
+@@ -269,7 +274,8 @@ func (s *ChallSrv) caaAnswers(q dns.Question) []dns.RR {
+ 	}
+
+ 	// No mock data - check if we should forward to real DNS
+-	if s.useRealDNS && s.realDNSForwarder != nil {
++	// Skip forwarding for internal domains like .consul
++	if s.useRealDNS && s.realDNSForwarder != nil && !strings.HasSuffix(strings.ToLower(q.Name), ".consul.") {
+ 		s.log.Printf("CAA query for %s: no mock data, forwarding to real DNS", q.Name)
+ 		realAnswers := s.realDNSForwarder.ForwardQuery(q)
+ 		if len(realAnswers) > 0 {
diff --git a/docker-compose.yml b/docker-compose.yml
@@ -14,6 +14,11 @@ services:
       # to the IP address where your ACME client's solver is listening. This is
       # pointing at the boulder service's "public" IP, where challtestsrv is.
       FAKE_DNS: 64.112.117.122
+      # Set to "true" to forward DNS queries to real upstream DNS servers instead of fake responses
+      # When enabled, mock data from tests will still take precedence over real DNS
+      USE_REAL_DNS: "true"
+      # Comma-separated list of upstream DNS servers to use when USE_REAL_DNS is enabled
+      UPSTREAM_DNS_SERVERS: "8.8.8.8:53,1.1.1.1:53"
       BOULDER_CONFIG_DIR: test/config
       GOCACHE: /boulder/.gocache/go-build
     volumes:
@@ -130,11 +135,11 @@ services:
   bconsul:
     image: hashicorp/consul:1.19.1
     volumes:
-     - ./test/:/test/:cached
+      - ./test/:/test/:cached
     networks:
       bouldernet:
         ipv4_address: 10.77.77.10
-    command: "consul agent -dev -config-format=hcl -config-file=/test/consul/config.hcl"
+    command: "consul agent -server -bootstrap-expect=1 -ui -config-format=hcl -config-file=/test/consul/config.hcl"
 
   bjaeger:
     image: jaegertracing/all-in-one:1.50

diff --git a/test/chall-test-srv/main.go b/test/chall-test-srv/main.go
@@ -72,6 +72,10 @@ func main() {
 		"Default IPv4 address for mock DNS responses to A queries")
 	defaultIPv6 := flag.String("defaultIPv6", "::1",
 		"Default IPv6 address for mock DNS responses to AAAA queries")
+	useRealDNS := flag.Bool("use-real-dns", false,
+		"Forward DNS queries to real DNS servers instead of returning fake responses")
+	upstreamDNS := flag.String("upstream-dns", "8.8.8.8:53,1.1.1.1:53",
+		"Comma separated list of upstream DNS servers to use when use-real-dns is enabled")
 
 	flag.Parse()
 
@@ -89,16 +93,20 @@ func main() {
 
 	logger := log.New(os.Stdout, "chall-test-srv - ", log.Ldate|log.Ltime)
 
+	upstreamServers := filterEmpty(strings.Split(*upstreamDNS, ","))
+
 	// Create a new challenge server with the provided config
 	srv, err := challtestsrv.New(challtestsrv.Config{
-		HTTPOneAddrs:    httpOneAddresses,
-		HTTPSOneAddrs:   httpsOneAddresses,
-		DOHAddrs:        dohAddresses,
-		DOHCert:         *dohCert,
-		DOHCertKey:      *dohCertKey,
-		DNSOneAddrs:     dnsOneAddresses,
-		TLSALPNOneAddrs: tlsAlpnOneAddresses,
-		Log:             logger,
+		HTTPOneAddrs:       httpOneAddresses,
+		HTTPSOneAddrs:      httpsOneAddresses,
+		DOHAddrs:           dohAddresses,
+		DOHCert:            *dohCert,
+		DOHCertKey:         *dohCertKey,
+		DNSOneAddrs:        dnsOneAddresses,
+		TLSALPNOneAddrs:    tlsAlpnOneAddresses,
+		Log:                logger,
+		UseRealDNS:         *useRealDNS,
+		UpstreamDNSServers: upstreamServers,
 	})
 	cmd.FailOnError(err, "Unable to construct challenge server")
 
@@ -148,6 +156,9 @@ func main() {
 			logger.Printf("Answering AAAA queries with %s by default",
 				*defaultIPv6)
 		}
+
+		srv.SetDefaultDNSIPv4(*defaultIPv4)
+		srv.SetDefaultDNSIPv6(*defaultIPv6)
 	}
 	if *tlsAlpnOneBind != "" {
 		http.HandleFunc("/add-tlsalpn01", oobSrv.addTLSALPN01)

diff --git a/test/config/remoteva-a.json b/test/config/remoteva-a.json
@@ -1,55 +1,49 @@
 {
-	"rva": {
-		"userAgent": "remoteva-a",
-		"debugAddr": ":8211",
-		"dnsTries": 3,
-		"dnsProvider": {
-			"dnsAuthority": "consul.service.consul",
-			"srvLookup": {
-				"service": "doh",
-				"domain": "service.consul"
-			}
-		},
-		"dnsTimeout": "1s",
-		"issuerDomain": "happy-hacker-ca.invalid",
-		"tls": {
-			"caCertfile": "test/certs/ipki/minica.pem",
-			"certFile": "test/certs/ipki/rva.boulder/cert.pem",
-			"keyFile": "test/certs/ipki/rva.boulder/key.pem"
-		},
-		"grpc": {
-			"maxConnectionAge": "30s",
-			"address": ":9897",
-			"services": {
-				"va.VA": {
-					"clientNames": [
-						"va.boulder"
-					]
-				},
-				"va.CAA": {
-					"clientNames": [
-						"va.boulder"
-					]
-				},
-				"grpc.health.v1.Health": {
-					"clientNames": [
-						"health-checker.boulder"
-					]
-				}
-			}
-		},
-		"features": {
-			"DOH": true
-		},
-		"accountURIPrefixes": [
-			"http://boulder.service.consul:4000/acme/reg/",
-			"http://boulder.service.consul:4001/acme/acct/"
-		],
-		"perspective": "dadaist",
-		"rir": "ARIN"
-	},
-	"syslog": {
-		"stdoutlevel": 4,
-		"sysloglevel": 4
-	}
+  "rva": {
+    "userAgent": "remoteva-a",
+    "debugAddr": ":8211",
+    "dnsTries": 3,
+    "dnsProvider": {
+      "dnsAuthority": "consul.service.consul",
+      "srvLookup": {
+        "service": "doh",
+        "domain": "service.consul"
+      }
+    },
+    "dnsTimeout": "1s",
+    "issuerDomain": "happy-hacker-ca.invalid",
+    "tls": {
+      "caCertfile": "test/certs/ipki/minica.pem",
+      "certFile": "test/certs/ipki/rva.boulder/cert.pem",
+      "keyFile": "test/certs/ipki/rva.boulder/key.pem"
+    },
+    "grpc": {
+      "maxConnectionAge": "30s",
+      "address": ":9897",
+      "services": {
+        "va.VA": {
+          "clientNames": ["va.boulder"]
+        },
+        "va.CAA": {
+          "clientNames": ["va.boulder"]
+        },
+        "grpc.health.v1.Health": {
+          "clientNames": ["health-checker.boulder"]
+        }
+      }
+    },
+    "features": {
+      "DOH": true
+    },
+    "accountURIPrefixes": [
+      "http://boulder.service.consul:4000/acme/reg/",
+      "http://boulder.service.consul:4001/acme/acct/"
+    ],
+    "perspective": "dadaist",
+    "rir": "ARIN"
+  },
+  "syslog": {
+    "stdoutlevel": 7,
+    "sysloglevel": 7
+  }
 }
diff --git a/test/config/remoteva-b.json b/test/config/remoteva-b.json
@@ -1,55 +1,49 @@
 {
-	"rva": {
-		"userAgent": "remoteva-b",
-		"debugAddr": ":8212",
-		"dnsTries": 3,
-		"dnsProvider": {
-			"dnsAuthority": "consul.service.consul",
-			"srvLookup": {
-				"service": "doh",
-				"domain": "service.consul"
-			}
-		},
-		"dnsTimeout": "1s",
-		"issuerDomain": "happy-hacker-ca.invalid",
-		"tls": {
-			"caCertfile": "test/certs/ipki/minica.pem",
-			"certFile": "test/certs/ipki/rva.boulder/cert.pem",
-			"keyFile": "test/certs/ipki/rva.boulder/key.pem"
-		},
-		"grpc": {
-			"maxConnectionAge": "30s",
-			"address": ":9998",
-			"services": {
-				"va.VA": {
-					"clientNames": [
-						"va.boulder"
-					]
-				},
-				"va.CAA": {
-					"clientNames": [
-						"va.boulder"
-					]
-				},
-				"grpc.health.v1.Health": {
-					"clientNames": [
-						"health-checker.boulder"
-					]
-				}
-			}
-		},
-		"features": {
-			"DOH": true
-		},
-		"accountURIPrefixes": [
-			"http://boulder.service.consul:4000/acme/reg/",
-			"http://boulder.service.consul:4001/acme/acct/"
-		],
-		"perspective": "surrealist",
-		"rir": "RIPE"
-	},
-	"syslog": {
-		"stdoutlevel": 4,
-		"sysloglevel": 4
-	}
+  "rva": {
+    "userAgent": "remoteva-b",
+    "debugAddr": ":8212",
+    "dnsTries": 3,
+    "dnsProvider": {
+      "dnsAuthority": "consul.service.consul",
+      "srvLookup": {
+        "service": "doh",
+        "domain": "service.consul"
+      }
+    },
+    "dnsTimeout": "1s",
+    "issuerDomain": "happy-hacker-ca.invalid",
+    "tls": {
+      "caCertfile": "test/certs/ipki/minica.pem",
+      "certFile": "test/certs/ipki/rva.boulder/cert.pem",
+      "keyFile": "test/certs/ipki/rva.boulder/key.pem"
+    },
+    "grpc": {
+      "maxConnectionAge": "30s",
+      "address": ":9998",
+      "services": {
+        "va.VA": {
+          "clientNames": ["va.boulder"]
+        },
+        "va.CAA": {
+          "clientNames": ["va.boulder"]
+        },
+        "grpc.health.v1.Health": {
+          "clientNames": ["health-checker.boulder"]
+        }
+      }
+    },
+    "features": {
+      "DOH": true
+    },
+    "accountURIPrefixes": [
+      "http://boulder.service.consul:4000/acme/reg/",
+      "http://boulder.service.consul:4001/acme/acct/"
+    ],
+    "perspective": "surrealist",
+    "rir": "RIPE"
+  },
+  "syslog": {
+    "stdoutlevel": 7,
+    "sysloglevel": 7
+  }
 }