recursor: is it possible to write negation to edns_subnet_allow_list ?

[karelbilek]

Hello, I am now learning to use recursor.

I want to somehow set it up to send EDNS subnet for most requests, except requests to some servers/some domains.

The thinking is - I want to send EDNS subnet when I don't know if it makes a difference; but on some servers I know it makes no difference, so I don't want to send it there (so caching works better).

Is it somehow possible? edns_subnet_allow_list doesn't seem to support negation.

I am looking if it's possible to do this in lua scripting, but I don't see it there in the documentation.

[karelbilek]

Looking at the source code, it doesn't support negation.

This
s_ednsremotesubnets.addMask(Netmask(allow));
seems like not allowing negation, unlike for example this

s_ednslocalsubnets.addMask(allow);

that calls this

  void addMask(const string& address, bool positive = true)
  {
    if (!address.empty() && address[0] == '!') {
      addMask(Netmask(address.substr(1)), false);
    }

so yeah, edns_subnet_allow_list by default doesn't support negation :)

[Habbie]

I wonder if the obvious patch (remove the Netmask() bit of the call) does what you want!

[karelbilek]

It probably would, but... not sure if this is wanted and I'm not asking for something crazy.

But yeah it would be very small patch.

[omoerbeek]

See #15811

[karelbilek]

Thanks.

The privacy is not a concern for me, but the caching very well might be.

[karelbilek]

In the worst case, I can do some basic CIDR calculation like this, which gets me a minimal list of IP prefixes.. it's ugly but works :)

https://go.dev/play/p/W3-ve4dScLv