[PR #3298] [MERGED] Do not resolve private/reserved addresses on public zones #3720

New issue

Closed

opened 2026-03-16 11:59:08 +03:00 by kerem · 0 comments

kerem commented

2026-03-16 11:59:08 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/hickory-dns/hickory-dns/pull/3298
Author: @marcus0x62
Created: 10/3/2025
Status: ✅ Merged
Merged: 10/10/2025
Merged by: @marcus0x62

Base: main ← Head: do-not-resolve

📝 Commits (4)

3b05f42 recursor: add generic AccessControlSet for name server filtering
6b40df4 recursor: add response IP address filtering
ebd4879 combine bailiwick checking with answer filter
024ab3b conformance: add e2e-test coverage for response answer filtering

📊 Changes

10 files changed (+411 additions, -104 deletions)

View changed files

📝 conformance/e2e-tests/src/resolver.rs (+1 -0)
➕ conformance/e2e-tests/src/resolver/do_not_answer.rs (+90 -0)
➕ conformance/e2e-tests/src/resolver/do_not_answer.toml (+14 -0)
📝 crates/recursor/src/lib.rs (+148 -1)
📝 crates/recursor/src/metrics_tests.rs (+1 -1)
📝 crates/recursor/src/recursor.rs (+54 -9)
📝 crates/recursor/src/recursor_dns_handle.rs (+73 -71)
📝 crates/recursor/src/recursor_pool.rs (+3 -22)
📝 crates/server/src/store/recursor.rs (+17 -0)
📝 tests/test-data/test_configs/example_recursor.toml (+10 -0)

📄 Description

This PR introduces response address filtering (#347) for the recursor. The main intended use case is to filter out answers in public zones that contain private or reserved addresses.

I noticed while working on this PR that, for NS referral filtering configuration, we add whatever the user configures to the default lists. I think the approach used here is probably easier for people to reason about:

If you just want to add exceptions to the default deny list, you can use allow_answers = [ ... ] to do that.
If you provide a custom deny_answers configuration, that is used in lieu of the default list.

Of course, if people want to combine these, they can. For example:

allow_answers=["192.168.1.100/32"]
deny_answers=["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"]

would block only the RFC-1918 address space, but allow answers from 192.168.1.100 to flow through.

Regardless, I think these two features -- NS referral filtering and answer filtering should have the some configuration logic, and if everyone agrees on the above approach, I'll add changes for that feature to match.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/hickory-dns/hickory-dns/pull/3298 **Author:** [@marcus0x62](https://github.com/marcus0x62) **Created:** 10/3/2025 **Status:** ✅ Merged **Merged:** 10/10/2025 **Merged by:** [@marcus0x62](https://github.com/marcus0x62) **Base:** `main` ← **Head:** `do-not-resolve` --- ### 📝 Commits (4) - [`3b05f42`](https://github.com/hickory-dns/hickory-dns/commit/3b05f42b8f21f6b37d7b9414e5e4f81fde1314c6) recursor: add generic AccessControlSet for name server filtering - [`6b40df4`](https://github.com/hickory-dns/hickory-dns/commit/6b40df4ced3580f9ccc81a7e739006c5aede5191) recursor: add response IP address filtering - [`ebd4879`](https://github.com/hickory-dns/hickory-dns/commit/ebd48795a516dd997a2586dfd091e49fc3c27830) combine bailiwick checking with answer filter - [`024ab3b`](https://github.com/hickory-dns/hickory-dns/commit/024ab3b7ab1c7d1ef488ba41e12f82f65b5b0559) conformance: add e2e-test coverage for response answer filtering ### 📊 Changes **10 files changed** (+411 additions, -104 deletions) <details> <summary>View changed files</summary> 📝 `conformance/e2e-tests/src/resolver.rs` (+1 -0) ➕ `conformance/e2e-tests/src/resolver/do_not_answer.rs` (+90 -0) ➕ `conformance/e2e-tests/src/resolver/do_not_answer.toml` (+14 -0) 📝 `crates/recursor/src/lib.rs` (+148 -1) 📝 `crates/recursor/src/metrics_tests.rs` (+1 -1) 📝 `crates/recursor/src/recursor.rs` (+54 -9) 📝 `crates/recursor/src/recursor_dns_handle.rs` (+73 -71) 📝 `crates/recursor/src/recursor_pool.rs` (+3 -22) 📝 `crates/server/src/store/recursor.rs` (+17 -0) 📝 `tests/test-data/test_configs/example_recursor.toml` (+10 -0) </details> ### 📄 Description This PR introduces response address filtering (#347) for the recursor. The main intended use case is to filter out answers in public zones that contain private or reserved addresses. I noticed while working on this PR that, for NS referral filtering configuration, we add whatever the user configures to the default lists. I think the approach used here is probably easier for people to reason about: * If you just want to add exceptions to the default deny list, you can use allow_answers = [ ... ] to do that. * If you provide a custom deny_answers configuration, that is used in lieu of the default list. Of course, if people want to combine these, they can. For example: allow_answers=["192.168.1.100/32"] deny_answers=["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"] would block only the RFC-1918 address space, but allow answers from 192.168.1.100 to flow through. Regardless, I think these two features -- NS referral filtering and answer filtering should have the some configuration logic, and if everyone agrees on the above approach, I'll add changes for that feature to match. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>