Security enhancement for the "never forward non-FQDNs" feature

[DL6ER]

By submitting this pull request, I confirm the following:

• I have read and understood the contributors guide, as well as this entire template.
• I have made only one major change in my proposed changes.
• I have commented my proposed changes within the code.
• I have tested my proposed changes, and have included unit tests where possible.
• I am willing to help maintain this change if there are issues with it later.
• I give this submission freely and claim no ownership.
• It is compatible with the EUPL 1.2 license
• I have squashed any insignificant commits. (git rebase)

---

What does this PR aim to accomplish?:

Security enhancement for the "never forward non-FQDNs" feature

How does this PR accomplish the above?:

This should prevent all local queries from being forwarded (will show up as blocked by regex) as well as any hostname without a domain (for example one word searches from the address bar in browsers). This fixes issue #3303 where this improvement was suggested by @jacklul.

Tests

(:green_circle: = not forwarded, :red_circle: = forwarded, domain = lan)

Before this PR:

• localhost 🟢 (IP)
• localhost.lan 🔴 (forwarded, came back as NXDOMAIN)
• dhcphost 🟢 (IP)
• dhcphost.lan 🟢 (IP)
• nonexistinghost 🟢 (NODATA)
• nonexistinghost.lan 🔴 (forwarded, came back as NXDOMAIN)

After this PR:

• localhost 🟢 (IP)
• localhost.lan 🟢 (IP)
• dhcphost 🟢 (IP)
• dhcphost.lan 🟢 (IP)
• nonexistinghost 🟢 (NODATA)
• nonexistinghost.lan 🟢 (NXDOMAIN)

What documentation changes (if any) are needed to support this PR?:

None

[DL6ER]

Note: Currently, the web interface shows queries like nonexistinghost.lan as Blocked (blacklist regex) because it cannot distinguish them from wildcards in dnsmasq style. Any suggestions for how to deal with them?

(Note that this is a separate issue in the realm of FTL which does not prevent this security fix from being merged!)

[dschaper]

for example one word searches from the address bar in browsers

That's an annoying "feature", to clarify, this will just prevent the DNS lookup but the actual search will still go through?

[pralor-bot]

This pull request has been mentioned on Pi-hole Userspace. There might be relevant details there:

https://discourse.pi-hole.net/t/pi-hole-core-web-v5-2-and-ftl-v5-3-released/40909/1

[pralor-bot]

This pull request has been mentioned on Pi-hole Userspace. There might be relevant details there:

https://discourse.pi-hole.net/t/all-requests-for-local-are-blocked/41601/10