feat: add a Dnsmasq upstream resolver filtering option #3923
Conversation
📝 WalkthroughWalkthroughThe pull request introduces two new configuration options for the Dnsmasq service to filter A and AAAA DNS records. The changes add boolean flags with default values set to false in the primary configuration file and update the schema accordingly. Additionally, conditional directives based on these flags have been incorporated into the templated configuration file, and corresponding user-facing translations with descriptive text have been added. Changes
Sequence Diagram(s)sequenceDiagram
participant CF as Config (config.yaml)
participant TE as Template Engine (dnsmasq.config)
participant DS as DNS Service
participant TR as Translations (en.yaml)
CF->>TE: Provide options (filter_a & filter_aaaa flags)
TE->>DS: Apply conditional directives ("filter-A"/"filter-AAAA")
DS->>TR: Load translation strings for filter options
📜 Recent review detailsConfiguration used: CodeRabbit UI 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
|
Why would you filter AAAA responses? A properly working application should not pick the AAAA address if your host does not have a globally routable IPv6 address assigned. If you have problems with AAAA responses, that likely means your IPv6 setup is actually broken (e.g. you have a global IPv6 address assigned but it is not routed). |
There may be lack of IPv6 on WAN egress, and IPv6 may still be used within LAN (for ARP-less communication). While not globally routable, a host may assume IPv6 WAN routing is available due to presence of a default nexthop, and thus attempt to utilize the address. There are also rare cases of ISPs blocking border-crossing traffic (which is weird, however I've come across four instances of such over the past decade). There's a case to be made for end users, who would probably be keen on pointing their router's DNS towards HA's Dnsmasq instance and solve the IPv6 issue that way (especially when disabling IPv6 isn't available on some ISP hardware). Edit: IPv4-only VPNs may also cause problems. If a globally routed IPv6 is available, it could potentially bypass routes set up by an interface, thus causing hosts to potentially leak traffic. |
Sure, IPv6 in link-local addresses and ULA addresses can be assigned. But any correctly implemented IP client program should try all addresses returned by the DNS (just like this tcp_connect.c example). In fact, it seems that by default, If IPv6 address filtering is required on DNS level, then this hints to a seriously broken IPv6 address configuration (e.g. by manually configure global addresses which in the end are not routed and/or a router which hands out IPv6 and then blocks traffic still).
If ISPs provide such fucked up IPv6 implementation, they should complain with the ISP or switch to a sane ISP 🤷
But then fixing the problem on DNS level seems wrong. If something resolves an address somehow differently traffic still might get the wrong way. This seems like it needs a firewall solution. I am fine merging this, but can we add a hint that this typically should not be required ans hints to a IPv6 misconfiguration of some sort? |
This allows for filtering of upstream responses (A and AAAA separately). Quite useful when the ISP does not support IPv6, and the router used does not support AAAA filtering.
Filtering of A responses is added solely for completeness.
P.S. It must be mentioned that the option should be named
filter_AAAAsolely for correctness purposes, notfilter_aaaa; however YAML lowercase keying imposes styling constraints.Summary by CodeRabbit
Summary by CodeRabbit
filter_aandfilter_aaaain the settings.filter-Aandfilter-AAAAto enhance DNS record filtering.