Skip to content

Commit f7c9078

Browse files
MizzickMizzick
committed
Pull request: AGDNS-3870-imp-dnssec
Squashed commit of the following: commit 0daffc4 Merge: b75c382 b08e587 Author: Dimitry Kolyshev <dkolyshev@adguard.com> Date: Thu Apr 23 17:04:08 2026 +0700 Merge remote-tracking branch 'origin/master' into AGDNS-3870-imp-dnssec commit b75c382 Author: Dimitry Kolyshev <dkolyshev@adguard.com> Date: Thu Apr 23 17:02:23 2026 +0700 all: upd dnsproxy commit c9c133b Author: Dimitry Kolyshev <dkolyshev@adguard.com> Date: Thu Apr 23 10:39:15 2026 +0700 docs: upd changelog commit cbd9d3b Author: Dimitry Kolyshev <dkolyshev@adguard.com> Date: Wed Apr 22 09:42:37 2026 +0700 docs: upd changelog commit c7f204f Author: Dimitry Kolyshev <dkolyshev@adguard.com> Date: Tue Apr 21 11:54:02 2026 +0700 docs: upd changelog commit 1036e32 Author: Dimitry Kolyshev <dkolyshev@adguard.com> Date: Tue Apr 21 11:23:47 2026 +0700 home: dnssec default commit c043669 Merge: c8eb814 9e153fb Author: Dimitry Kolyshev <dkolyshev@adguard.com> Date: Tue Apr 21 11:09:37 2026 +0700 Merge remote-tracking branch 'origin/master' into AGDNS-3870-imp-dnssec commit c8eb814 Author: Dimitry Kolyshev <dkolyshev@adguard.com> Date: Wed Apr 15 11:41:11 2026 +0700 all: upd dnsproxy
1 parent b08e587 commit f7c9078

10 files changed

Lines changed: 23 additions & 52 deletions

File tree

‎CHANGELOG.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,10 +18,16 @@ See also the [v0.107.75 GitHub milestone][ms-v0.107.75].
1818
NOTE: Add new changes BELOW THIS COMMENT.
1919
-->
2020

21+
### Changed
22+
23+
- `enable_dnssec` in `dns` configuration now defines whether the proxy should set the DO flag in the upstream requests, the default is `true` ([#7046]).
24+
2125
### Fixed
2226

2327
- Safe Browsing and Parental Control labels on the General Settings page not updating after changing the UI language.
2428

29+
[#7046]: https://github.com/AdguardTeam/AdGuardHome/issues/7046
30+
2531
<!--
2632
NOTE: Add new changes ABOVE THIS COMMENT.
2733
-->

‎go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ module github.com/AdguardTeam/AdGuardHome
33
go 1.26.2
44

55
require (
6-
github.com/AdguardTeam/dnsproxy v0.81.1
6+
github.com/AdguardTeam/dnsproxy v0.81.2
77
github.com/AdguardTeam/golibs v0.35.11
88
github.com/AdguardTeam/urlfilter v0.23.2
99
github.com/NYTimes/gziphandler v1.1.1

‎go.sum‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,8 @@ cloud.google.com/go/auth v0.20.0 h1:kXTssoVb4azsVDoUiF8KvxAqrsQcQtB53DcSgta74CA=
44
cloud.google.com/go/auth v0.20.0/go.mod h1:942/yi/itH1SsmpyrbnTMDgGfdy2BUqIKyd0cyYLc5Q=
55
cloud.google.com/go/compute/metadata v0.9.0 h1:pDUj4QMoPejqq20dK0Pg2N4yG9zIkYGdBtwLoEkH9Zs=
66
cloud.google.com/go/compute/metadata v0.9.0/go.mod h1:E0bWwX5wTnLPedCKqk3pJmVgCBSM6qQI1yTBdEb3C10=
7-
github.com/AdguardTeam/dnsproxy v0.81.1 h1:LM0JYsm3tMRVbJAtjbPcZ9vVmWV9NDmpb+ZsW8I/apU=
8-
github.com/AdguardTeam/dnsproxy v0.81.1/go.mod h1:5lTCQqVQ8Kt4KnTOmdV0Ab3k58KZFOazupVfXJezwq8=
7+
github.com/AdguardTeam/dnsproxy v0.81.2 h1:j1p74pbzyrrE21OL1lmNEWxuhHXNykk+NDH4hgDD9Eg=
8+
github.com/AdguardTeam/dnsproxy v0.81.2/go.mod h1:5lTCQqVQ8Kt4KnTOmdV0Ab3k58KZFOazupVfXJezwq8=
99
github.com/AdguardTeam/golibs v0.35.11 h1:LooiyPNtsfv32reFz4qD8KpWQm9jIFuPwHxHyVgtaRg=
1010
github.com/AdguardTeam/golibs v0.35.11/go.mod h1:wBe9Vgrcn6M4T7p7z/vnRZANLzVO72myRggnCKBx+sQ=
1111
github.com/AdguardTeam/urlfilter v0.23.2 h1:EiS/PQZO/X2S6cduFW6BBoRLyjd6SqZj1ZiFbU1KaFE=

‎internal/dnsforward/config.go‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -140,7 +140,8 @@ type Config struct {
140140
// requests.
141141
AAAADisabled bool `yaml:"aaaa_disabled"`
142142

143-
// EnableDNSSEC, if true, set AD flag in outcoming DNS request.
143+
// EnableDNSSEC defines whether the proxy should set the AD/DO bits in the
144+
// upstream requests.
144145
EnableDNSSEC bool `yaml:"enable_dnssec"`
145146

146147
// EDNSClientSubnet is the settings list for EDNS Client Subnet.
@@ -365,7 +366,8 @@ func (s *Server) newProxyConfig(ctx context.Context) (conf *proxy.Config, err er
365366
PendingRequests: &proxy.PendingRequestsConfig{
366367
Enabled: srvConf.PendingRequestsEnabled,
367368
},
368-
HTTPConfig: httpConf,
369+
HTTPConfig: httpConf,
370+
DNSSECEnabled: srvConf.EnableDNSSEC,
369371
}
370372

371373
if srvConf.EDNSClientSubnet.UseCustom {

‎internal/dnsforward/dnsforward_internal_test.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -806,6 +806,7 @@ func TestServerCustomClientUpstream(t *testing.T) {
806806
Config: Config{
807807
CacheSize: defaultCacheSize,
808808
UpstreamMode: UpstreamModeLoadBalance,
809+
EnableDNSSEC: true,
809810
EDNSClientSubnet: &EDNSClientSubnet{
810811
Enabled: false,
811812
},

‎internal/dnsforward/process.go‎

Lines changed: 0 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -471,8 +471,6 @@ func (s *Server) processUpstream(
471471

472472
s.setCustomUpstream(ctx, l, pctx, dctx.clientID)
473473

474-
reqWantsDNSSEC := s.setReqAD(req)
475-
476474
// Process the request further since it wasn't filtered.
477475
prx := s.proxy()
478476
if prx == nil {
@@ -488,54 +486,9 @@ func (s *Server) processUpstream(
488486
dctx.responseFromUpstream = true
489487
dctx.responseAD = pctx.Res.AuthenticatedData
490488

491-
s.setRespAD(pctx, reqWantsDNSSEC)
492-
493489
return resultCodeSuccess
494490
}
495491

496-
// setReqAD changes the request based on the server settings. wantsDNSSEC is
497-
// false if the response should be cleared of the AD bit.
498-
//
499-
// TODO(a.garipov, e.burkov): This should probably be done in module dnsproxy.
500-
func (s *Server) setReqAD(req *dns.Msg) (wantsDNSSEC bool) {
501-
if !s.conf.EnableDNSSEC {
502-
return false
503-
}
504-
505-
origReqAD := req.AuthenticatedData
506-
req.AuthenticatedData = true
507-
508-
// Per [RFC 6840] says, validating resolvers should only set the AD bit when
509-
// the response has the AD bit set and the request contained either a set DO
510-
// bit or a set AD bit. So, if neither of these is true, clear the AD bits
511-
// in [Server.setRespAD].
512-
//
513-
// [RFC 6840]: https://datatracker.ietf.org/doc/html/rfc6840#section-5.8
514-
return origReqAD || hasDO(req)
515-
}
516-
517-
// hasDO returns true if msg has EDNS(0) options and the DNSSEC OK flag is set
518-
// in there.
519-
//
520-
// TODO(a.garipov): Move to golibs/dnsmsg when it's there.
521-
func hasDO(msg *dns.Msg) (do bool) {
522-
o := msg.IsEdns0()
523-
if o == nil {
524-
return false
525-
}
526-
527-
return o.Do()
528-
}
529-
530-
// setRespAD changes the request and response based on the server settings and
531-
// the original request data.
532-
func (s *Server) setRespAD(pctx *proxy.DNSContext, reqWantsDNSSEC bool) {
533-
if s.conf.EnableDNSSEC && !reqWantsDNSSEC {
534-
pctx.Req.AuthenticatedData = false
535-
pctx.Res.AuthenticatedData = false
536-
}
537-
}
538-
539492
// dhcpHostFromRequest returns a hostname from question, if the request is for a
540493
// DHCP client's hostname when DHCP is enabled, and an empty string otherwise.
541494
func (s *Server) dhcpHostFromRequest(q *dns.Question) (reqHost string) {

‎internal/home/config.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -494,6 +494,7 @@ var config = &configuration{
494494
CacheSize: 4 * 1024 * 1024,
495495
CacheOptimisticAnswerTTL: timeutil.Duration(30 * time.Second),
496496
CacheOptimisticMaxAge: timeutil.Duration(12 * time.Hour),
497+
EnableDNSSEC: true,
497498

498499
EDNSClientSubnet: &dnsforward.EDNSClientSubnet{
499500
CustomIP: netip.Addr{},

‎internal/next/dnssvc/config.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,10 @@ type Config struct {
5252
// CacheEnabled defines if the response cache should be used.
5353
CacheEnabled bool
5454

55+
// DNSSECEnabled specifies if the proxy should set the DO bits in the
56+
// upstream requests.
57+
DNSSECEnabled bool
58+
5559
// RefuseAny, if true, refuses DNS queries with the type ANY.
5660
RefuseAny bool
5761

‎internal/next/dnssvc/dnssvc.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -77,6 +77,7 @@ func New(c *Config) (svc *Service, err error) {
7777
CacheSizeBytes: c.CacheSize,
7878
CacheEnabled: c.CacheEnabled,
7979
RefuseAny: c.RefuseAny,
80+
DNSSECEnabled: c.DNSSECEnabled,
8081
UseDNS64: c.UseDNS64,
8182
},
8283
bootstraps: c.BootstrapServers,
@@ -109,6 +110,7 @@ func New(c *Config) (svc *Service, err error) {
109110
RequestHandler: rlMw.Wrap(proxy.DefaultHandler{}),
110111
DNS64Prefs: svc.proxyConf.DNS64Prefs,
111112
CacheEnabled: svc.proxyConf.CacheEnabled,
113+
DNSSECEnabled: svc.proxyConf.DNSSECEnabled,
112114
RefuseAny: svc.proxyConf.RefuseAny,
113115
UseDNS64: svc.proxyConf.UseDNS64,
114116
})

‎internal/next/websvc/dns.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@ type ReqPatchSettingsDNS struct {
2929
Ratelimit jsonpatch.NonRemovable[int] `json:"ratelimit"`
3030

3131
BootstrapPreferIPv6 jsonpatch.NonRemovable[bool] `json:"bootstrap_prefer_ipv6"`
32+
DNSSECEnabled jsonpatch.NonRemovable[bool] `json:"dnssec"`
3233
RefuseAny jsonpatch.NonRemovable[bool] `json:"refuse_any"`
3334
UseDNS64 jsonpatch.NonRemovable[bool] `json:"use_dns64"`
3435
}
@@ -92,6 +93,7 @@ func (svc *Service) handlePatchSettingsDNS(w http.ResponseWriter, r *http.Reques
9293
req.Ratelimit.Set(&newConf.Ratelimit)
9394

9495
req.BootstrapPreferIPv6.Set(&newConf.BootstrapPreferIPv6)
96+
req.DNSSECEnabled.Set(&newConf.DNSSECEnabled)
9597
req.RefuseAny.Set(&newConf.RefuseAny)
9698
req.UseDNS64.Set(&newConf.UseDNS64)
9799

0 commit comments

Comments
 (0)