Add setting and metric

diff --git a/pdns/recursordist/RECURSOR-MIB.txt b/pdns/recursordist/RECURSOR-MIB.txt
index 2f95b69bf5a8460a55c9d715b5c3487291ae909f..c9b83836d3d29f441a782556321700f2178e524a 100644 (file)
--- a/pdns/recursordist/RECURSOR-MIB.txt
+++ b/pdns/recursordist/RECURSOR-MIB.txt
@@ -1291,6 +1291,14 @@ tcpOverflow OBJECT-TYPE
         "Incoming TCP limits reached"
     ::= { stats 152 }
 
+ecsMissing OBJECT-TYPE
+    SYNTAX Counter64
+    MAX-ACCESS read-only
+    STATUS current
+    DESCRIPTION
+        "Number of answers where ECS info was missing"
+    ::= { stats 153 }
+
 ---
 --- Traps / Notifications
 ---
@@ -1489,7 +1497,8 @@ recGroup OBJECT-GROUP
         maxChainLength,
         maxChainWeight,
         chainLimits,
-        tcpOverflow
+        tcpOverflow,
+        ecsMissing
     }
     STATUS current
     DESCRIPTION "Objects conformance group for PowerDNS Recursor"

diff --git a/pdns/recursordist/lwres.cc b/pdns/recursordist/lwres.cc
index 5923fb1c10a0f77b0bd50bcf148d476ddf059444..f00fa48908ea1adc4881b4b778ce3b762a06f124 100644 (file)
--- a/pdns/recursordist/lwres.cc
+++ b/pdns/recursordist/lwres.cc
@@ -58,7 +58,7 @@
 thread_local TCPOutConnectionManager t_tcp_manager;
 std::shared_ptr<Logr::Logger> g_slogout;
 bool g_paddingOutgoing;
-bool g_ECSHardening{false};
+bool g_ECSHardening;
 
 void remoteLoggerQueueData(RemoteLoggerInterface& rli, const std::string& data)
 {

diff --git a/pdns/recursordist/metrics_table.py b/pdns/recursordist/metrics_table.py
index f1ef6eb608582d16c29f141c2dacb06fbc481cca..9bd117049a0e05711a344a928bffb16f58fa37d4 100644 (file)
--- a/pdns/recursordist/metrics_table.py
+++ b/pdns/recursordist/metrics_table.py
@@ -1401,4 +1401,10 @@
         'pname': 'proxy-mapping-total-n-0', # For multicounters, state the first
         # No SNMP
     },
+    {
+        'name': 'ecs-missing',
+        'lambda': '[] { return g_Counters.sum(rec::Counter::ecsMissingCount); }',
+        'desc': 'Number of answers where ECS info was missing',
+        'snmp': 153,
+    },
 ]

diff --git a/pdns/recursordist/rec-main.cc b/pdns/recursordist/rec-main.cc
index 73f111a17e8862505ea001d4be118be53840ab1d..2f4540b20fd93a53cfc6011966907c5e98ad833b 100644 (file)
--- a/pdns/recursordist/rec-main.cc
+++ b/pdns/recursordist/rec-main.cc
@@ -2310,6 +2310,7 @@ static int serviceMain(Logr::log_t log)
   }
   g_paddingTag = ::arg().asNum("edns-padding-tag");
   g_paddingOutgoing = ::arg().mustDo("edns-padding-out");
+  g_ECSHardening = ::arg().mustDo("edns-subnet-harden");
 
   RecThreadInfo::setNumDistributorThreads(::arg().asNum("distributor-threads"));
   RecThreadInfo::setNumUDPWorkerThreads(::arg().asNum("threads"));

diff --git a/pdns/recursordist/rec-rust-lib/table.py b/pdns/recursordist/rec-rust-lib/table.py
index 71f67bde9bda43e35cf20b24f609fdadc8745d5a..3be6609cbb5ad5d6b0bab7dfe8926d07d79058dd 100644 (file)
--- a/pdns/recursordist/rec-rust-lib/table.py
+++ b/pdns/recursordist/rec-rust-lib/table.py
@@ -951,6 +951,18 @@ By default, this option is empty, meaning no EDNS Client Subnet information is s
  ''',
     'versionadded': '4.5.0'
     },
+    {
+        'name' : 'edns_subnet_harden',
+        'section' : 'outgoing',
+        'type' : LType.Bool,
+        'default' : 'false',
+        'help' : 'Do more strict checking or EDNS Client Subnet information returned by authoritative servers',
+        'doc' : '''
+Do more strict checking or EDNS Client Subnet information returned by authoritative servers.
+Answers missing ECS information will be ignored and followed up by an ECS-less query.
+ ''',
+    'versionadded': ['5.2.x', '5.1.x', '5.0.x']
+    },
     {
         'name' : 'enable_old_settings',
         'section' : 'recursor',

diff --git a/regression-tests.recursor-dnssec/test_SNMP.py b/regression-tests.recursor-dnssec/test_SNMP.py
index 40907ad3aba14fa21e4c8cd8a52ba029feebeaea..c55c5818ef3429bf1bb12462d9146c13cda2c0bb 100644 (file)
--- a/regression-tests.recursor-dnssec/test_SNMP.py
+++ b/regression-tests.recursor-dnssec/test_SNMP.py
@@ -21,7 +21,7 @@ class SNMPTest(RecursorTest):
     """
 
     def _checkStatsValues(self, results):
-        count = 152
+        count = 153
         for i in list(range(1, count)):
             oid = self._snmpOID + '.1.' + str(i) + '.0'
             self.assertTrue(oid in results)