dnsmasq: Add EDNS0 Upstream support #14349

db260179 · 2024-01-06T14:18:37Z

Forward client mac address and subnet on dns queries.

Pi-hole and Adguard use this feature to send the originators ip address/subnet so it can be logged and not just the nat address of the router.

This feature has been added since version 2.56 of dnsmasq and would be nice to expose this feature in openwrt.

schuettecarsten · 2024-01-15T08:25:43Z

Please make this configurable (default: on), as adding the requestors MAC address to upstream forwarded requests might have security or privacy implications. It is only useful if you use Pihole/Adguard but not for external upstream servers.

KanjiMonster · 2024-01-15T09:57:05Z

Please make this configurable (default: on), as adding the requestors MAC address to upstream forwarded requests might have security or privacy implications. It is only useful if you use Pihole/Adguard but not for external upstream servers.

If this can have security or privacy implications the default should be off, not on.

db260179 · 2024-01-15T09:58:54Z

Please make this configurable (default: on), as adding the requestors MAC address to upstream forwarded requests might have security or privacy implications. It is only useful if you use Pihole/Adguard but not for external upstream servers.

If this can have security or privacy implications the default should be off, not on.

Yes i agree, this is just exposing the options, its up to the user to configure via uci or luci (patch coming for this)

schuettecarsten · 2024-02-20T08:23:39Z

Tested together with PiHole (development-v6), works.
I would also suggest to add an option for "--strip-subnet" and "--strip-mac":

append_bool "$cfg" strip_mac "--strip-mac"
append_bool "$cfg" strip_subnet "--strip-subnet"

I've also created a draft to add this to LuCI in dhcp.js (line 650):

s.taboption('forward', form.Flag, 'add_mac',
        _('Add requestor MAC address to forwards'),
        _('Add the MAC address of the requestor to DNS queries which are forwarded upstream.'));

s.taboption('forward', form.Flag, 'strip_mac',
        _('Remove MAC address before forwarding query'),
        _('Remove any MAC address information already in downstream queries before forwarding upstream.'));

o = s.taboption('forward', form.Value, 'add_subnet',
        _('Add subnet address to forwards'),
        _('Add a subnet address to the DNS queries which are forwarded upstream, e.g. {32,128} for full requestor address.'));
o.optional = true;

s.taboption('forward', form.Flag, 'strip_subnet',
        _('Remove subnet address before forwarding query'),
        _('Remove any subnet address already present in a downstream query before forwarding it upstream.'));

Forward client mac address and subnet on dns queries. Pi-hole and Adguard use this feature to send the originators ip address/subnet so it can be logged and not just the nat address of the router. This feature has been added since version 2.56 of dnsmasq and would be nice to expose this feature in openwrt. Signed-off-by: David Bentham <db260179@gmail.com>

The pull request openwrt/openwrt#14349 adds four new options to configure EDNS0 upstream support. This patch adds the new settings to DNSMASQ web UI. Signed-off-by: Carsten Schuette <schuettecarsten@googlemail.com>

systemcrash · 2024-03-08T00:26:14Z

package/network/services/dnsmasq/files/dnsmasq.init

@@ -972,12 +972,16 @@ dnsmasq_start()
 	append_bool "$cfg" noping "--no-ping"
 	append_bool "$cfg" rapidcommit "--dhcp-rapid-commit"
 	append_bool "$cfg" scriptarp "--script-arp"
+	append_bool "$cfg" add_mac "--add-mac"


This parameter is NOT a boolean. This must change. The manpage says --add-mac[=base64|text].

So either --add-mac by itself, or --add-mac=base64 or --add-mac=text. There might appear other variations, but I doubt it. This param must handle a naked param, or with an option (which the user provides).

systemcrash · 2024-03-08T00:26:27Z

package/network/services/dnsmasq/files/dnsmasq.init

@@ -972,12 +972,16 @@ dnsmasq_start()
 	append_bool "$cfg" noping "--no-ping"
 	append_bool "$cfg" rapidcommit "--dhcp-rapid-commit"
 	append_bool "$cfg" scriptarp "--script-arp"
+	append_bool "$cfg" add_mac "--add-mac"
+	append_bool "$cfg" strip_mac "--strip-mac"


This is fine.

systemcrash · 2024-03-08T00:29:45Z

package/network/services/dnsmasq/files/dnsmasq.init


 	append_bool "$cfg" filter_aaaa "--filter-AAAA"
 	append_bool "$cfg" filter_a "--filter-A"

 	append_parm "$cfg" logfacility "--log-facility"
 	config_get logfacility "$cfg" "logfacility"
+	append_parm "$cfg" add_subnet "--add-subnet"


This looks OK. This must be able to supply a naked parameter as with --add-mac, or with any combination mentioned in the manpage: --add-subnet[[=[<IPv4 address>/]<IPv4 prefix length>][,[<IPv6 address>/]<IPv6 prefix length>]].

--add-mac by itself means: the address of the requestor will be used.

The pull request openwrt/openwrt#14349 adds four new options to configure EDNS0 upstream support. This patch adds the new settings to DNSMASQ web UI. Signed-off-by: Carsten Schuette <schuettecarsten@googlemail.com>

systemcrash · 2024-04-23T12:12:08Z

ping @db260179 - please resolve the code-change comments

db260179 · 2024-04-25T08:52:34Z

ping @db260179 - please resolve the code-change comments

When i get time to do this, busy at the moment

The pull request openwrt/openwrt#14349 adds four new options to configure EDNS0 upstream support. This patch adds the new settings to DNSMASQ web UI. Signed-off-by: Carsten Schuette <schuettecarsten@googlemail.com>

schuettecarsten · 2024-07-17T20:06:53Z

I've created two new PRs for this, one for the openwrt core system and a luci patch.

systemcrash · 2024-07-17T22:48:02Z

Please close this PR as outdated/abandoned.

db260179 force-pushed the edns0-master branch from ede09a1 to 63fc90e Compare January 6, 2024 14:21

github-actions bot added the core packages pull request/issue for core (in-tree) packages label Jan 6, 2024

db260179 force-pushed the edns0-master branch from 63fc90e to df7742d Compare January 7, 2024 14:25

db260179 force-pushed the edns0-master branch from df7742d to 63deef5 Compare January 31, 2024 18:06

schuettecarsten approved these changes Feb 20, 2024

View reviewed changes

db260179 force-pushed the edns0-master branch from 6d8f1fd to 1b6ee94 Compare February 21, 2024 14:14

schuettecarsten approved these changes Mar 7, 2024

View reviewed changes

schuettecarsten mentioned this pull request Mar 7, 2024

dnsmasq: Add options for new EDNS0 options openwrt/luci#6972

Closed

systemcrash suggested changes Mar 8, 2024

View reviewed changes

schuettecarsten mentioned this pull request Apr 23, 2024

dnsmasq: add filter-rr and cache-rr options #14975

Merged

schuettecarsten mentioned this pull request Jul 17, 2024

dnsmasq: Add EDNS0 Upstream support #15965

Merged

db260179 closed this Jul 18, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

dnsmasq: Add EDNS0 Upstream support #14349

dnsmasq: Add EDNS0 Upstream support #14349

db260179 commented Jan 6, 2024

schuettecarsten commented Jan 15, 2024 •

edited

Loading

KanjiMonster commented Jan 15, 2024

db260179 commented Jan 15, 2024

schuettecarsten commented Feb 20, 2024 •

edited

Loading

systemcrash Mar 8, 2024

systemcrash Mar 8, 2024

systemcrash Mar 8, 2024 •

edited

Loading

systemcrash commented Apr 23, 2024

db260179 commented Apr 25, 2024

schuettecarsten commented Jul 17, 2024

systemcrash commented Jul 17, 2024

dnsmasq: Add EDNS0 Upstream support #14349

dnsmasq: Add EDNS0 Upstream support #14349

Conversation

db260179 commented Jan 6, 2024

schuettecarsten commented Jan 15, 2024 • edited Loading

KanjiMonster commented Jan 15, 2024

db260179 commented Jan 15, 2024

schuettecarsten commented Feb 20, 2024 • edited Loading

systemcrash Mar 8, 2024

Choose a reason for hiding this comment

systemcrash Mar 8, 2024

Choose a reason for hiding this comment

systemcrash Mar 8, 2024 • edited Loading

Choose a reason for hiding this comment

systemcrash commented Apr 23, 2024

db260179 commented Apr 25, 2024

schuettecarsten commented Jul 17, 2024

systemcrash commented Jul 17, 2024

schuettecarsten commented Jan 15, 2024 •

edited

Loading

schuettecarsten commented Feb 20, 2024 •

edited

Loading

systemcrash Mar 8, 2024 •

edited

Loading