dnsdist: Merge the client and server nonces to prevent replay attacks

[rgacogne]

Short description

Instead of using the local nonce to send messages (and so the remote one for received ones), split and merge the local and remote nonces to create two new nonces, one for client to server and one for server
to client.
This makes us more resistant against reply attacks, but note that it does break compatibility with previous versions.

Checklist

I have:

• read the CONTRIBUTING.md document
• compiled and tested this code

[pieterlexis]

this is milestone'd for dnsdist 1.1. Due to the incompatible change, I suggest we delay and merge this first thing for dnsdist 1.2.

[neilcook]

Question:

#ifndef HAVE_LIBSODIUM
struct SodiumNonce
{
void init(){};
void merge(const SodiumNonce& lower, const SodiumNonce& higher);
void increment(){};
unsigned char value[1];
};
#else

Shouldn't merge be an empty implementation here like init() and increment()?

[rgacogne]

Shouldn't merge be an empty implementation here like init() and increment()?

It absolutely should, nice catch!