feat(dns): DNS_PUBLIC_NAMES_AS_LOCAL and DNS_PUBLIC_NAMESERVER_CIDRS_AS_LOCAL options

[qdm12]

Description

This should also exempt the names from the dns rebinding protection

Issue

#3233

[Copilot]

Pull request overview

Adds a new DNS configuration option to treat selected public domain names as “local”, enabling split-horizon DNS behavior while also bypassing DNS rebinding protection for those names.

Changes:

• Introduces DNS_PUBLIC_NAMES_AS_LOCAL as a new DNS setting and wires it through configuration, logging output, and env var defaults.
• Passes PublicNamesAsLocal into the local DNS middleware so selected public names are resolved via local resolvers.
• Passes PublicNamesAsLocal into the DNS filter so those names are treated as local (and thus exempt from rebinding protection checks).

Reviewed changes

Copilot reviewed 5 out of 6 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
internal/dns/settings.go	Wires PublicNamesAsLocal into the local DNS middleware settings.
internal/dns/loop.go	Wires PublicNamesAsLocal into the mapfilter settings.
internal/configuration/settings/dns.go	Adds the new setting field, reads it from env, and prints it in the settings tree.
go.mod	Bumps github.com/qdm12/dns/v2 to a newer pseudo-version providing the needed behavior.
go.sum	Updates checksums for the bumped github.com/qdm12/dns/v2 version.
Dockerfile	Adds DNS_PUBLIC_NAMES_AS_LOCAL to the documented container environment defaults.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 7 changed files in this pull request and generated no new comments.

Suppressed comments (3)

internal/configuration/settings/dns.go:115

• PublicNamesAsLocal is user-provided but never validated, and PublicNameserverCIDRsAsLocal validation only rejects private/loopback addresses (so link-local/multicast/unspecified can slip through even though the option is described as "public"). Consider validating hostnames with hostRegex (after trimming an optional trailing dot) and requiring a global-unicast, non-private address for CIDRs (consistent with internal/vpn/ipv6.go:33).

	for _, prefix := range d.PublicNameserverCIDRsAsLocal {
		switch {
		case prefix.Addr().IsPrivate(), prefix.Addr().IsLoopback():
			return fmt.Errorf("public nameserver prefix %s is not a public address", prefix)
		case !prefix.Addr().IsValid():

internal/configuration/settings/dns.go:61

• The JSON key for PublicNameserverCIDRsAsLocal is inconsistent with the field name and env var (DNS_PUBLIC_NAMESERVER_CIDRS_AS_LOCAL). As written (public_nameservers_as_local), config-file JSON/TOML unmarshalling will likely not populate this setting as intended.

This issue also appears on line 111 of the same file.

	PublicNameserverCIDRsAsLocal []netip.Prefix `json:"public_nameservers_as_local"`

internal/dns/setup.go:20

• The filter update now covers more than rebinding-protection settings (it also updates public FQDN handling), but the wrapped error message still says it's only for rebinding protection. This can mislead users during troubleshooting.

	updateSettings.SetRebindingProtectionExempt(settings.Blacklist.RebindingProtectionExemptHostnames)
	updateSettings.SetPublicFQDNsAsLocal(settings.PublicNamesAsLocal)
	err = l.filter.Update(updateSettings)
	if err != nil {
		return nil, fmt.Errorf("updating filter for rebinding protection: %w", err)