Downstream DNS Server Cookies a la RFC7873 and RFC9018 #762
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Create server cookies for clients that send client cookies. Needs to be turned on in the config file with: answer-cookie: yes A cookie-secret can be configured for anycast setups. Also adds an access control list that will allow queries with either a valid cookie or over a stateful transport.
…heir own file in util/rfc_1982.[ch].
…figparser.c, configparser.h).
by allowing Cookies to bypass the ratelimit, but still allowing ratelimit to valid DNS Cookie clients via the new ip-ratelimit-cookie option.
thread and total: num.queries_cookie_valid, num.queries_cookie_client, num.queries.cookie_invalid.
|
@wcawijngaards, with the recent changes for refactoring, unit/rpl/tdir tests, cookie/ip_ratelimiting interaction and new stat counters for queries with cookies, I believe this is ready for merging after your final review :) |
8 bytes after a client option of length 8, and then ignore them to recreate a 24 byte response. The fixup does not read out of bounds, and puts zeroes in the buffer at that point, that then are ignored.
wcawijngaards
approved these changes
Aug 16, 2023
wcawijngaards
added a commit
that referenced
this pull request
Aug 17, 2023
- Merge PR #762: Downstream DNS Server Cookies a la RFC7873 and RFC9018. Create server cookies for clients that send client cookies. This needs to be explicitly turned on in the config file with: `answer-cookie: yes`. A `cookie-secret:` can be configured for anycast setups. Without one, a random cookie secret is generated. The acl option `allow_cookie` allows queries with either a valid cookie or over a stateful transport. The statistics output has `queries_cookie_valid` and `queries_cookie_client` and `queries_cookie_invalid` information. The `ip\-ratelimit\-cookie:` value determines a rate limit for queries with cookies, if desired.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Create server cookies for clients that send client cookies.
This needs to be explicitly turned on in the config file with:
A
cookie-secret:can be configured for anycast setups. Without one, a random cookie secret is generated.This PR also adds an access control list policy
allow_cookiethat allows queries with either a valid cookie or over a stateful transport.This PR replaces #322