[PR #2126] [MERGED] Add option to specify a restricted set of networks capable of accessing the Hickory DNS server #2828

New issue

Closed

opened 2026-03-16 11:10:21 +03:00 by kerem · 0 comments

kerem commented

2026-03-16 11:10:21 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/hickory-dns/hickory-dns/pull/2126
Author: @bluejekyll
Created: 1/7/2024
Status: ✅ Merged
Merged: 2/6/2024
Merged by: @bluejekyll

Base: main ← Head: deny-list-on-request-addrs

📝 Commits (10+)

70bceaf add access check for IP networks
7da8193 wire up Access to check request IP addr before servicing the IP
e4a8484 add config option for allow_networks
b191f16 add deny networks to access
679c2e9 add deny networks config option and examples
eca5f05 use get_or_insert_with to clean up code
144a89d fix typos in Access usage
1e66a9b renamce Access to AccessControl
8f2e523 cleanup evaluation of access lists
b568dac remove single add access control methods, only allow slice

📊 Changes

18 files changed (+547 additions, -57 deletions)

View changed files

📝 Cargo.lock (+24 -0)
📝 Cargo.toml (+1 -0)
📝 bin/src/hickory-dns.rs (+3 -1)
📝 bin/tests/named_tests.rs (+101 -7)
📝 bin/tests/server_harness/mod.rs (+21 -8)
📝 crates/proto/src/error.rs (+5 -0)
📝 crates/server/Cargo.toml (+2 -0)
➕ crates/server/src/access.rs (+184 -0)
📝 crates/server/src/config/mod.rs (+17 -0)
📝 crates/server/src/lib.rs (+1 -0)
📝 crates/server/src/server/h2_handler.rs (+14 -2)
📝 crates/server/src/server/h3_handler.rs (+8 -2)
📝 crates/server/src/server/quic_handler.rs (+7 -2)
📝 crates/server/src/server/server_future.rs (+116 -35)
📝 tests/test-data/test_configs/example.toml (+11 -0)
➕ tests/test-data/test_configs/example_allow_networks.toml (+10 -0)
➕ tests/test-data/test_configs/example_deny_allow_networks.toml (+12 -0)
➕ tests/test-data/test_configs/example_deny_networks.toml (+10 -0)

📄 Description

See github.com/hickory-dns/hickory-dns@3a1b74eabd/tests/test-data/test_configs/example_allow_networks.toml for an example. Of how this would be used.

fixes: #1719

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/hickory-dns/hickory-dns/pull/2126 **Author:** [@bluejekyll](https://github.com/bluejekyll) **Created:** 1/7/2024 **Status:** ✅ Merged **Merged:** 2/6/2024 **Merged by:** [@bluejekyll](https://github.com/bluejekyll) **Base:** `main` ← **Head:** `deny-list-on-request-addrs` --- ### 📝 Commits (10+) - [`70bceaf`](https://github.com/hickory-dns/hickory-dns/commit/70bceaf31558562a56b014f35e2947becba4fd57) add access check for IP networks - [`7da8193`](https://github.com/hickory-dns/hickory-dns/commit/7da819365b5d101460792f455ebbcb1db4066589) wire up Access to check request IP addr before servicing the IP - [`e4a8484`](https://github.com/hickory-dns/hickory-dns/commit/e4a8484fb3f848e2cadfcc76f66e939ff248765d) add config option for allow_networks - [`b191f16`](https://github.com/hickory-dns/hickory-dns/commit/b191f16f16be82bee16d854057ade9e0b4374ea3) add deny networks to access - [`679c2e9`](https://github.com/hickory-dns/hickory-dns/commit/679c2e9372537114fed7e973f6e79d19377e56f5) add deny networks config option and examples - [`eca5f05`](https://github.com/hickory-dns/hickory-dns/commit/eca5f05684790b68e4e4dcfd93bb13692bb921c9) use get_or_insert_with to clean up code - [`144a89d`](https://github.com/hickory-dns/hickory-dns/commit/144a89dd20de18123ae4e8b12e70cc65d9eb1520) fix typos in Access usage - [`1e66a9b`](https://github.com/hickory-dns/hickory-dns/commit/1e66a9bae2fdb280862e96b17f51c383595d09c7) renamce Access to AccessControl - [`8f2e523`](https://github.com/hickory-dns/hickory-dns/commit/8f2e523eb6ebc1c6a1bb33c3bc20b36b308425c9) cleanup evaluation of access lists - [`b568dac`](https://github.com/hickory-dns/hickory-dns/commit/b568dac3e7338f272f1aa5c7bf71e28068c0ec89) remove single add access control methods, only allow slice ### 📊 Changes **18 files changed** (+547 additions, -57 deletions) <details> <summary>View changed files</summary> 📝 `Cargo.lock` (+24 -0) 📝 `Cargo.toml` (+1 -0) 📝 `bin/src/hickory-dns.rs` (+3 -1) 📝 `bin/tests/named_tests.rs` (+101 -7) 📝 `bin/tests/server_harness/mod.rs` (+21 -8) 📝 `crates/proto/src/error.rs` (+5 -0) 📝 `crates/server/Cargo.toml` (+2 -0) ➕ `crates/server/src/access.rs` (+184 -0) 📝 `crates/server/src/config/mod.rs` (+17 -0) 📝 `crates/server/src/lib.rs` (+1 -0) 📝 `crates/server/src/server/h2_handler.rs` (+14 -2) 📝 `crates/server/src/server/h3_handler.rs` (+8 -2) 📝 `crates/server/src/server/quic_handler.rs` (+7 -2) 📝 `crates/server/src/server/server_future.rs` (+116 -35) 📝 `tests/test-data/test_configs/example.toml` (+11 -0) ➕ `tests/test-data/test_configs/example_allow_networks.toml` (+10 -0) ➕ `tests/test-data/test_configs/example_deny_allow_networks.toml` (+12 -0) ➕ `tests/test-data/test_configs/example_deny_networks.toml` (+10 -0) </details> ### 📄 Description See https://github.com/hickory-dns/hickory-dns/blob/3a1b74eabd4e593f8030d56720bb0b4c878b2734/tests/test-data/test_configs/example_allow_networks.toml for an example. Of how this would be used. fixes: #1719 --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>