[PR #2604] [MERGED] Referral filtering #3171

New issue

Closed

opened 2026-03-16 11:29:15 +03:00 by kerem · 0 comments

kerem commented

2026-03-16 11:29:15 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/hickory-dns/hickory-dns/pull/2604
Author: @marcus0x62
Created: 11/21/2024
Status: ✅ Merged
Merged: 11/29/2024
Merged by: @marcus0x62

Base: main ← Head: referral_filtering

📝 Commits (3)

47eb73e change PrefixSet::contains to PrefixSet::get_spm in matches_do_not_query
3b6d832 Referral limits
7d4fa8d update bad referral tests in conformance

📊 Changes

11 files changed (+261 additions, -95 deletions)

View changed files

📝 conformance/packages/conformance-tests/src/resolver/dns/scenarios/bad_referral.rs (+30 -53)
📝 conformance/packages/dns-test/src/templates/hickory.resolver.toml.jinja (+1 -1)
📝 crates/recursor/src/recursor.rs (+48 -6)
📝 crates/recursor/src/recursor_dns_handle.rs (+85 -17)
📝 crates/server/src/store/recursor/authority.rs (+1 -1)
📝 crates/server/src/store/recursor/config.rs (+5 -1)
📝 tests/e2e-tests/src/resolver/do_not_query.rs (+48 -8)
📝 tests/e2e-tests/src/resolver/do_not_query.toml.jinja (+7 -2)
📝 tests/test-data/test_configs/chained_blocklist.toml (+2 -2)
📝 tests/test-data/test_configs/consulting_blocklist.toml (+2 -2)
📝 tests/test-data/test_configs/example_recursor.toml (+32 -2)

📄 Description

Fixes a bug in the do not query match logic
Adds some never-query hosts (127.0.0.0/8, 0.0.0.0/8, 255.255.255.255/32, ::/128, and ::1/128.) and an optional 'recommended filtering' setting that will filter against RFC 1918 and other reserved or special purpose addresses in the do not query list.
Eliminates most reserved-/private- address range conformance tests and adds a test to verify referrals for the remaining bad referral tests are being dropped due to the failed do not query check, and not because of a timeout (see related discussion in #2545)

The recommended filtering list is enabled by default. I don't think the ranges included will cause problems for most users, although there are scenarios where it should be turned off:

Organizations using private or reserved space for their DNS infrastructure
Test environments (such as our CI) that use private address space

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/hickory-dns/hickory-dns/pull/2604 **Author:** [@marcus0x62](https://github.com/marcus0x62) **Created:** 11/21/2024 **Status:** ✅ Merged **Merged:** 11/29/2024 **Merged by:** [@marcus0x62](https://github.com/marcus0x62) **Base:** `main` ← **Head:** `referral_filtering` --- ### 📝 Commits (3) - [`47eb73e`](https://github.com/hickory-dns/hickory-dns/commit/47eb73e66998bd4621d2783db96f9649f01f79fb) change PrefixSet::contains to PrefixSet::get_spm in matches_do_not_query - [`3b6d832`](https://github.com/hickory-dns/hickory-dns/commit/3b6d832165363edd1d50b4e4c2e5e35d195e0e2e) Referral limits - [`7d4fa8d`](https://github.com/hickory-dns/hickory-dns/commit/7d4fa8d191838b7804b5aee1ff1480eb50164ac3) update bad referral tests in conformance ### 📊 Changes **11 files changed** (+261 additions, -95 deletions) <details> <summary>View changed files</summary> 📝 `conformance/packages/conformance-tests/src/resolver/dns/scenarios/bad_referral.rs` (+30 -53) 📝 `conformance/packages/dns-test/src/templates/hickory.resolver.toml.jinja` (+1 -1) 📝 `crates/recursor/src/recursor.rs` (+48 -6) 📝 `crates/recursor/src/recursor_dns_handle.rs` (+85 -17) 📝 `crates/server/src/store/recursor/authority.rs` (+1 -1) 📝 `crates/server/src/store/recursor/config.rs` (+5 -1) 📝 `tests/e2e-tests/src/resolver/do_not_query.rs` (+48 -8) 📝 `tests/e2e-tests/src/resolver/do_not_query.toml.jinja` (+7 -2) 📝 `tests/test-data/test_configs/chained_blocklist.toml` (+2 -2) 📝 `tests/test-data/test_configs/consulting_blocklist.toml` (+2 -2) 📝 `tests/test-data/test_configs/example_recursor.toml` (+32 -2) </details> ### 📄 Description * Fixes a bug in the do not query match logic * Adds some never-query hosts (127.0.0.0/8, 0.0.0.0/8, 255.255.255.255/32, ::/128, and ::1/128.) and an optional 'recommended filtering' setting that will filter against RFC 1918 and other reserved or special purpose addresses in the do not query list. * Eliminates most reserved-/private- address range conformance tests and adds a test to verify referrals for the remaining bad referral tests are being dropped due to the failed do not query check, and not because of a timeout (see related discussion in #2545) The recommended filtering list is enabled by default. I don't think the ranges included will cause problems for most users, although there are scenarios where it should be turned off: * Organizations using private or reserved space for their DNS infrastructure * Test environments (such as our CI) that use private address space --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>