From 421f084346a46bd96a765599b3649f2bb746bdac Mon Sep 17 00:00:00 2001 From: Ross Lawley Date: Mon, 15 Jun 2026 17:18:46 +0100 Subject: [PATCH 1/4] Add configurable DNS domain validation for SRV records Add a MongoClient-level `srvAllowedHostsSuffix` option that overrides the domain inferred from the SRV host name when validating the hosts returned by an SRV lookup. The value is normalized at configuration time (a leading "." is prepended if absent, so the stored and returned value always begins with "."), and every resolved host must end with it, matched case-insensitively; otherwise the existing inferred-domain validation is unchanged. The option is parsed from the connection string, carried on ClusterSettings, rejected on non-mongodb+srv URIs, rejected when it contains whitespace, no domain label, or an empty domain label, and threaded through the internal DNS resolution path. It is supported with both multi-server and load-balanced SRV connection strings, which now also apply srvServiceName consistently. JAVA-6233 --- .../main/com/mongodb/ConnectionString.java | 39 ++++++++- .../mongodb/connection/ClusterSettings.java | 65 ++++++++++++-- .../DefaultDnsSrvRecordMonitor.java | 10 ++- .../DefaultDnsSrvRecordMonitorFactory.java | 7 +- .../connection/DnsMultiServerCluster.java | 1 + .../DnsSrvRecordMonitorFactory.java | 5 +- .../internal/connection/DomainNameUtils.java | 40 +++++++++ .../connection/LoadBalancedCluster.java | 1 + .../internal/dns/DefaultDnsResolver.java | 63 +++++++++----- .../com/mongodb/internal/dns/DnsResolver.java | 4 +- .../mongodb/AbstractConnectionStringTest.java | 3 + .../com/mongodb/ConnectionStringUnitTest.java | 84 +++++++++++++++++++ .../ClusterSettingsSpecification.groovy | 67 +++++++++++++++ ...ultDnsSrvRecordMonitorSpecification.groovy | 17 ++-- .../DnsMultiServerClusterSpecification.groovy | 3 +- .../InitialDnsSeedListDiscoveryProseTest.java | 34 +++++++- .../connection/LoadBalancedClusterTest.java | 48 +++++------ .../connection/SrvPollingProseTests.java | 9 +- .../internal/dns/DefaultDnsResolverTest.java | 61 +++++++++++++- .../InitialDnsSeedlistDiscoveryTest.java | 3 + 20 files changed, 485 insertions(+), 79 deletions(-) diff --git a/driver-core/src/main/com/mongodb/ConnectionString.java b/driver-core/src/main/com/mongodb/ConnectionString.java index 659e8fd02aa..662a6d6fd23 100644 --- a/driver-core/src/main/com/mongodb/ConnectionString.java +++ b/driver-core/src/main/com/mongodb/ConnectionString.java @@ -53,6 +53,7 @@ import java.util.stream.Stream; import static com.mongodb.MongoCredential.ALLOWED_HOSTS_KEY; +import static com.mongodb.internal.connection.DomainNameUtils.normalizeSrvAllowedHostsSuffix; import static com.mongodb.internal.connection.OidcAuthenticator.OidcValidator.validateCreateOidcCredential; import static java.lang.String.format; import static java.util.Arrays.asList; @@ -265,6 +266,8 @@ * *

General configuration:

*