From 4da215221ae8a27341681d2bb4fa4b91c0b6a8d6 Mon Sep 17 00:00:00 2001
From: Fedor Setrakov <f.setrakov@adguard.com>
Date: Wed, 15 Jul 2026 09:15:56 +0000
Subject: [PATCH] Pull request 2700: 8183-include-edns

Updates #8183.

Squashed commit of the following:

commit b6ada16f9121fd2ed3fae5de2446c8c2c42ef183
Author: f.setrakov <f.setrakov@adguard.com>
Date:   Wed Jul 15 12:03:19 2026 +0300

    all: fix changelog

commit c920b48346174d56a83ef69dc02c96ea05a60df3
Merge: 70a703c31 c1f208ef6
Author: f.setrakov <f.setrakov@adguard.com>
Date:   Wed Jul 15 11:47:39 2026 +0300

    Merge branch 'master' into 8183-include-edns

commit 70a703c31294d94835a319845e6faacc69983532
Author: f.setrakov <f.setrakov@adguard.com>
Date:   Mon Jul 13 15:27:07 2026 +0300

    all: imp docs

commit 941bdabebe8a7368abfeac96a6cf33d39b8d20b4
Author: f.setrakov <f.setrakov@adguard.com>
Date:   Thu Jul 9 14:36:41 2026 +0300

    all: include edns opt for filtered req
---
 CHANGELOG.md               |  8 ++++++--
 internal/dnsforward/msg.go | 18 ++++++++++++++++--
 2 files changed, 22 insertions(+), 4 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 531b9c674..0377da170 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -18,6 +18,12 @@ See also the [v0.107.79 GitHub milestone][ms-v0.107.79].
 NOTE: Add new changes BELOW THIS COMMENT.
 -->
 
+### Fixed
+
+- Blocked requests without an EDNS(0) OPT record ([#8183]).
+
+[#8183]:     https://github.com/AdguardTeam/AdGuardHome/issues/8183
+
 <!--
 NOTE: Add new changes ABOVE THIS COMMENT.
 -->
@@ -62,8 +68,6 @@ See also the [v0.107.78 GitHub milestone][ms-v0.107.78].
 
 - The `filtering` object of the YAML configuration now includes a new property, `max_http_size`, which defines the maximum size of the HTTP request for rulelists. To disable the limitation, set a large size, such as `1 TB`.
 
-### Fixed
-
 - Invalid AA flag in DNS responses ([#7955]).
 
 - The parsing of the `ech` parameter in DNS rewrite rules for the HTTPS record type ([#8276]).
diff --git a/internal/dnsforward/msg.go b/internal/dnsforward/msg.go
index 5dba5927a..b361f22d7 100644
--- a/internal/dnsforward/msg.go
+++ b/internal/dnsforward/msg.go
@@ -17,10 +17,17 @@ import (
 // template.  Also extract all the methods to a separate entity.
 
 // reply creates a DNS response for req.
+//
+// NOTE: If req uses EDNS(0), the response copies its UDP size and DO flag.
 func (*Server) reply(req *dns.Msg, code int) (resp *dns.Msg) {
 	resp = (&dns.Msg{}).SetRcode(req, code)
 	resp.RecursionAvailable = true
 
+	opt := req.IsEdns0()
+	if opt != nil {
+		resp.SetEdns0(opt.UDPSize(), opt.Do())
+	}
+
 	return resp
 }
 
@@ -404,7 +411,11 @@ func (s *Server) NewMsgSERVFAIL(req *dns.Msg) (resp *dns.Msg) {
 // NewMsgNOTIMPLEMENTED implements the [proxy.MessageConstructor] interface for
 // *Server.
 func (s *Server) NewMsgNOTIMPLEMENTED(req *dns.Msg) (resp *dns.Msg) {
-	resp = s.reply(req, dns.RcodeNotImplemented)
+	// NOTE: [Server.reply] must not be used there, because it unconditionally
+	// copies UDP size and DO bit from the request, when in this case we want to
+	// use constant values.
+	resp = (&dns.Msg{}).SetRcode(req, dns.RcodeNotImplemented)
+	resp.RecursionAvailable = true
 
 	// Most of the Internet and especially the inner core has an MTU of at least
 	// 1500 octets.  Maximum DNS/UDP payload size for IPv6 on MTU 1500 ethernet
@@ -415,7 +426,10 @@ func (s *Server) NewMsgNOTIMPLEMENTED(req *dns.Msg) (resp *dns.Msg) {
 
 	// NOTIMPLEMENTED without EDNS is treated as 'we don't support EDNS', so
 	// explicitly set it.
-	resp.SetEdns0(maxUDPPayload, false)
+	opt := req.IsEdns0()
+	if opt != nil {
+		resp.SetEdns0(maxUDPPayload, false)
+	}
 
 	return resp
 }