[GH-ISSUE #2411] wrong answer (NOERROR or timeout) when referral includes a private IP address #982

New issue

Open

opened 2026-03-16 01:09:51 +03:00 by kerem · 0 comments

kerem commented

2026-03-16 01:09:51 +03:00

Owner

Originally created by @japaric on GitHub (Sep 3, 2024).
Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/2411

Describe the bug
what the title says

To Reproduce
send a query of the form A $SUB.extended-dns-errors.com. to hickory-dns where $SUB is one of these

v4-doc
v4-link-local
v4-loopback
v4-private-10
v4-private-172
v4-private-192
v4-reserved
v4-this-host
v6-localhost
v6-mapped
v6-unspecified

Expected behavior
All these subdomains should return a SERVFAIL answer.

In the case of the v6 subdomains and v4-this-host hickory times out. In the other cases, hickory responds with a NOERROR response that has empty sections (ANSWER, ADDITIONALS, etc.)

System:

OS: Ubuntu
Architecture: x86_64
Version 22.04
rustc version: 1.80.1

Version:
Crate: hickory-dns
Version: 752559e6a8

Additional context

Some of these scenarios are being ported to conformance-tests in #2410

Even though these issues were found through the ede-dot-com test suite, they are not DNSSEC issues but issues in regular DNS recursive resolution.

hickory-dns could consider putting some of these private IP subnets and/or IP addresses (e.g. 127.0.0.1, 0.0.0.0) in its default "blocklist" to avoid trying to establish a network connection with a reserved IP address. There are legitimate use cases for having name servers in private IP subnets (e.g. 172.16.0.1/16) which is what conformance-tests does so those should not be put in a default blocklist.

Even without a default blocklist , hickory-dns should not respond with NOERROR if the referral is unreachable.

Originally created by @japaric on GitHub (Sep 3, 2024). Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/2411 **Describe the bug** what the title says **To Reproduce** send a query of the form `A $SUB.extended-dns-errors.com.` to hickory-dns where `$SUB` is one of these - v4-doc - v4-link-local - v4-loopback - v4-private-10 - v4-private-172 - v4-private-192 - v4-reserved - v4-this-host - v6-localhost - v6-mapped - v6-unspecified **Expected behavior** All these subdomains should return a `SERVFAIL` answer. In the case of the `v6` subdomains and `v4-this-host` hickory times out. In the other cases, hickory responds with a NOERROR response that has empty sections (ANSWER, ADDITIONALS, etc.) **System:** - OS: Ubuntu - Architecture: x86_64 - Version 22.04 - rustc version: 1.80.1 **Version:** Crate: `hickory-dns` Version: 752559e6a8fbd198074dd6f89251a838ae466dfb **Additional context** Some of these scenarios are being ported to `conformance-tests` in #2410 Even though these issues were found through the `ede-dot-com` test suite, they are *not* DNSSEC issues but issues in regular DNS recursive resolution. hickory-dns could consider putting *some* of these private IP subnets and/or IP addresses (e.g. `127.0.0.1`, `0.0.0.0`) in its default "blocklist" to avoid trying to establish a network connection with a reserved IP address. There are legitimate use cases for having name servers in private IP subnets (e.g. `172.16.0.1/16`) which is what `conformance-tests` does so those should *not* be put in a default blocklist. Even without a default blocklist , hickory-dns should not respond with NOERROR if the referral is unreachable.