unbound: Parallel dnsmasq bypasses "Localise queries"

Package Name

unbound

Maintainer

@EricLuehrsen

OpenWrt Version

24.10.1

OpenWrt Target/Subtarget

ath79/generic

Steps to Reproduce

Assuming the router's hostname is router:

1. Set up two subnets (i.e. lan at 192.168.0.1/24 and guest at 192.168.8.0/24)
2. Enable dnsmasq "Localise queries" option (in Luci, under Network > DHCP and DNS > Filter)
3. Confirm "Localise queries" is working with plain dnsmasq:

• Connect to lan and run dig router.lan..
  Expected output: a single A record pointing to 192.168.0.1.

• Connect to guest and run dig router.lan.
  Expected output: a single A record pointing to 192.168.8.1.

4. Configure unbound in "parallel dnsmasq" configuration.
5. Verify "Localise queries" is bypassed:

• Connect to lan and run dig router.lan..
  Expected output: a single A record pointing to 192.168.0.1.
  Actual output: two A records, one pointing to 192.168.0.1 and one pointing to 192.168.8.1.

• Connect to guest and run dig router.lan..
  Expected output: a single A record pointing to 192.168.8.1.
  Actual output: same as above.

Actual Behaviour

Addresses in both subnets are returned, meaning:

• A client application in the either subnet attempting to resolve the IP of the router may attempt (and possibly fail) to connect to the router in the wrong subnet (and it may not try the address in next record if it doesn't explicitly support this fail-over scenario).
• A client connected to the guest subnet may learn the IP addresses and hostnames of devices in the lan subnet, and vice-versa.

This is because the forwarding rule is set up such that unbound forwards queries to dnsmasq over the loopback interface, so dnsmasq can't localise them:

https://github.com/openwrt/packages/blob/f7505326d2d3cd52c960db857cbc60d1ff763a14/net/unbound/files/dnsmasq.sh#L367

This also means that if dnsmasq is configured not to listen on the loopback interface (in Luci, Network > DHCP and DNS > Devices & Ports > Exclude interfaces), unbound can't connect to it at all.

Suggested fixes

a. Allow specifying the address for dnsmasq. This is useful if unbound is serving only one subnet and/or dnsmasq is not listening on the loopback interface.
b. Document unsupported dnsmasq configurations.

Confirmation Checklist

• The package is maintained in this repository.
• I understand that issues related to the base OpenWrt repository or LuCI repository will be closed.
• I am reporting an issue for OpenWrt, not an unsupported fork.

Start with net/unbound/files/dnsmasq.sh at the forwarding rule around line 367, then reproduce the parallel dnsmasq setup described in the issue on OpenWrt 24.10.1. The work is done when localized answers remain limited to the requesting subnet and configurations that exclude loopback are handled or clearly documented.