Fix: Fail closed on zero resolvers in enforce-redirect

Review follow-up: when /etc/resolv.conf yields no nameservers, the prior
code logged a WARNING and proceeded, leaving a running-but-DNS-dead pod
(UDP/53 dropped, TCP/53 captured) that is hard to triage. Exit non-zero
instead so the init container surfaces as Init:Error. In a Kubernetes pod
kubelet always populates resolv.conf, so this only fires on a genuine
misconfiguration; the error message points outside-Kubernetes users at
RESOLV_CONF. The guard runs before any iptables mutation. Adds a
fail-closed test case.

Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com>
Signed-off-by: Hai Huang <huang195@gmail.com>

Author: huang195

authbridge/proxy-init/init-iptables.sh

@@ -264,9 +264,17 @@ setup_enforce_redirect() {
   REDIR_CHAIN="AB_REDIRECT"
   NOTCP_CHAIN="AB_NOTCP"
 
+  # Fail closed and LOUD on zero resolvers: without a nameserver to exempt, the
+  # rules below would drop UDP/53 and capture TCP/53, leaving a running-but-DNS-
+  # dead pod that is far harder to triage than a failed init container. In a
+  # Kubernetes pod kubelet always populates resolv.conf, so an empty result means
+  # a real misconfiguration — surface it as Init:Error rather than silent breakage.
   NAMESERVERS=$(get_nameservers)
   if [ -z "${NAMESERVERS}" ]; then
-    echo "enforce-redirect: WARNING: no nameservers found in ${RESOLV_CONF} — cluster DNS may break (UDP/53 dropped, TCP/53 captured)"
+    echo "enforce-redirect: ERROR: no nameservers found in ${RESOLV_CONF}" >&2
+    echo "enforce-redirect: refusing to start — DNS egress would be dropped (UDP/53) / captured (TCP/53), silently breaking name resolution." >&2
+    echo "enforce-redirect: set RESOLV_CONF to a file with valid 'nameserver' entries if running outside Kubernetes." >&2
+    exit 1
   fi
 
   echo "enforce-redirect: installing fail-closed egress capture"

authbridge/proxy-init/test-enforce-redirect.sh

@@ -147,6 +147,19 @@ else
   echo "FAIL: external UDP not dropped (DROP=${dropc:-?})"; fail=1
 fi
 
+echo "### Fail-closed test: empty resolv.conf must abort init (exit non-zero)"
+# The zero-resolver check runs before any iptables mutation, so this re-invocation
+# leaves the rules above untouched. A running-but-DNS-dead pod is worse than a
+# failed init, so enforce-redirect refuses to start without a resolver to exempt.
+EMPTY_RESOLV=$(mktemp)   # created empty: no `nameserver` lines
+if env MODE=enforce-redirect PROXY_UID=1337 RESOLV_CONF="${EMPTY_RESOLV}" \
+       TRANSPARENT_PORT="${TPORT}" IPTABLES_CMD="${IPT}" IP6TABLES_CMD=ip6tables-nft \
+       sh "${INIT}" >/dev/null 2>&1; then
+  echo "FAIL: init succeeded with empty resolv.conf (should exit non-zero)"; fail=1
+else
+  echo "PASS: init aborts fail-closed when resolv.conf has no nameservers"
+fi
+
 echo
 [ "${fail}" -eq 0 ] && echo "ALL TESTS PASSED" || echo "SOME TESTS FAILED"
 exit "${fail}"