Strip EDNS(0) Client Subnet / MAC information

[DL6ER]

By submitting this pull request, I confirm the following:

• I have read and understood the contributors guide.
• I have checked that another pull request for this purpose does not exist.
• I have considered, and confirmed that this submission will be valuable to others.
• I accept that this submission may not be used, and the pull request closed at the will of the maintainer.
• I give this submission freely, and claim no ownership to its content.

How familiar are you with the codebase?:

10

---

Strip EDNS(0) Client Subnet / MAC information if --strip-subnet or --strip-mac is set. If both the add and strip options are set, incoming EDNS0 options are replaced. This ensures we do not unintentionally forward client information somewhere upstream when ECS is used in lower DNS layers in our local network.

Note This PR is just here to remind us to work on and send this patch upstream to the main dnsmasq project once Simon Kelley is back.

[yubiuser]

Confirm working.

Standard behavior

After stripping enabled

[pralor-bot]

This pull request has been mentioned on Pi-hole Userspace. There might be relevant details there:

https://discourse.pi-hole.net/t/ecs-client-subnet-is-being-sent-to-upstream-server/50790/15

[yubiuser]

Confirm stripping MAC does also work. Additionally, replacing MAC/subnet by having strip-mac/subnet together with add-mac/subnet does also work.

[DL6ER]

Superseded by pi-hole/dnsmasq#1 to be submitted when Simon Kelley returns.

[DL6ER]

@yubiuser The changes have been merged by Simon Kelley. I imported them into update/dnsmasq just a few seconds ago. Simon changed a lot in the EDNS(0) code afterwards and asks us to verify he didn't broke anything. Could you, if you can find the time, assist in doing the exact same tests you did above, again with the update/dnsmasq branch?

[yubiuser]

I'll do. I wonder if we should set both strip options be default - could increase privacy of users?

[DL6ER]

EDNS(0) ECS shouldn't be used by any client by default. If we set it by default we have to construct all the machinery to allow users disabling it if they want to...

[yubiuser]

we have to construct all the machinery to allow users disabling it if they want to...

...true....

[yubiuser]

Tried both: stripping and replacing works with current update/dnsmasq