rec: allow negation in outgoing.edns_subnet_allow_list #15811
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Casting input part to Netmask does not allow to insert negation in s_ednsremotesubnets list as ComboAddress would not allow, however if we directly use addMask from NetmaskGroup negation are handled properly. In case the input is not a valid netmask, catch() will still add the string as a domain.
Pull Request Test Coverage Report for Build 16174256413Details
💛 - Coveralls |
|
I am not a big fan of this. IMO ECS is troublesome for various reasons: it kills cache performance, adds a layer of complexity in the Recursor, many auths do not handle it properly and it has privacy issues as well. ECS should not be used unless you have very good reasons to use it. If you want to use ECS, targets should be added to the outgoing ECS list based on observed proper and desired ECS behavior in the answers. Adding negation suggests it is a good thing to use it for big subnets and only disallow outgoing ECS for a few targets. |
miodvallat
approved these changes
Jul 10, 2025
|
(approving on technical grounds, not wanting to overcome @omoerbeek's comments) |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Casting input part to Netmask does not allow to insert negation in s_ednsremotesubnets list as ComboAddress would not allow, however if we directly use addMask from NetmaskGroup negation are handled properly. In case the input is not a valid netmask, catch() will still add the string as a domain.
Note that this does not allow names to be negated.
Short description
Checklist
I have: