Is 'Blocked IPs' functionality broken (DNS rebinding tests resolve)

[cobratbq]

Is the Blocked IPs functionality broken? It seems like the DNS rebinding protection ip-blocks successfully resolve. (I.e. they shouldn't.)

dnscrypt-proxy.toml (dnscrypt-proxy 2.1.12, from github, today)

[blocked_ips]
blocked_ips_file='blocked-ips.txt'

blocked-ips.txt

# Rebinding protection for localhost
0.0.0.0
127.*
# Rebinding protection for private network IP-ranges
10.*
172.16.*
172.17.*
172.18.*
172.19.*
172.20.*
172.21.*
172.22.*
172.23.*
172.24.*
172.25.*
172.26.*
172.27.*
172.28.*
172.29.*
172.30.*
172.31.*
192.168.*

systemctl status dnscrypt-proxy

[..]: [2025-06-22 19:50:13] [NOTICE] Loading the set of IP blocking rules from [blocked-ips.txt]

host -v net10.rebindtest.com.

Trying "net10.rebindtest.com"
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 54600
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; EDNS: version: 0, udp=1232

;; QUESTION SECTION:
;net10.rebindtest.com.		IN	A

;; ANSWER SECTION:
net10.rebindtest.com.	80519	IN	A	10.0.0.1

Received 65 bytes from 127.0.0.1#53 in 0 ms
Trying "net10.rebindtest.com"
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 9168
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; EDNS: version: 0, udp=1232

;; QUESTION SECTION:
;net10.rebindtest.com.		IN	AAAA

;; ANSWER SECTION:
net10.rebindtest.com.	84508	IN	AAAA	::ffff:10.0.0.1

Received 77 bytes from 127.0.0.1#53 in 1 ms
Trying "net10.rebindtest.com"
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 40044
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
;; EDNS: version: 0, udp=1232

;; QUESTION SECTION:
;net10.rebindtest.com.		IN	MX

;; AUTHORITY SECTION:
rebindtest.com.		1708	IN	SOA	rebindtest.com. dns2006.grc.com. 2019122701 43200 300 5184000 3600

Received 97 bytes from 127.0.0.1#53 in 0 ms

dnscrypt-proxy -config /etc/dnscrypt-proxy/dnscrypt-proxy.toml -resolve net10.rebindtest.com.

Resolving [net10.rebindtest.com.] using 127.0.0.1 port 53

Resolver      : 51.15.122.250 (scaleway-ams.dnscrypt.info.)

Canonical name: net10.rebindtest.com.

IPv4 addresses: 10.0.0.1
IPv6 addresses: 10.0.0.1

Name servers  : no name servers found
DNSSEC signed : no
Mail servers  : no mail servers found

HTTPS alias   : -
HTTPS info    : -

Host info     : -
TXT records   : -

Blocked IP entries are absent from blocked-ips log-file.

Just did a quick check: it works as expected on version 2.1.8. (I used the 2.1.12 config but with key http3_probe and section monitoring_ui disabled.)

P.s.: I recently fixed your 127/8 IP-range from 127.0.0.* to 127.* on the wiki.

[cobratbq]

This might have been fixed in commit 94323d5, though that commit is not part of release 2.1.12.

If this is indeed the fix, then it might be good to add a note to release 2.1.12 to warn of broken functionality.

[jedisct1]

I think that was fixed in 94323d5