Upstream padding according to RFC7830 & RFC8467

diff --git a/services/outside_network.c b/services/outside_network.c
index b2c67766e3e96a2a7bf5ff026f85e2a8e70cfa9b..6ea8742d63c254234a6634f433886a02379c27c2 100644 (file)
--- a/services/outside_network.c
+++ b/services/outside_network.c
@@ -1577,6 +1577,7 @@ serviced_encode(struct serviced_query* sq, sldns_buffer* buff, int with_edns)
        if(with_edns) {
                /* add edns section */
                struct edns_data edns;
+               struct edns_option padding_option;
                edns.edns_present = 1;
                edns.ext_rcode = 0;
                edns.edns_version = EDNS_ADVERTISED_VERSION;
@@ -1599,6 +1600,15 @@ serviced_encode(struct serviced_query* sq, sldns_buffer* buff, int with_edns)
                        edns.bits = EDNS_DO;
                if(sq->dnssec & BIT_CD)
                        LDNS_CD_SET(sldns_buffer_begin(buff));
+               if (sq->ssl_upstream) {
+                       padding_option.opt_code = LDNS_EDNS_PADDING;
+                       padding_option.opt_len = 0;
+                       padding_option.opt_data = NULL;
+                       padding_option.next = edns.opt_list;
+                       edns.opt_list = &padding_option;
+                       fprintf(stderr, "add padding, pos: %d, limit: %d\n",
+                           (int)sldns_buffer_position(buff), (int)sldns_buffer_limit(buff));
+               }
                attach_edns_record(buff, &edns);
        }
 }

diff --git a/util/data/msgencode.c b/util/data/msgencode.c
index c0f78ee879394865314c19a5f222c56e463ee4a9..a710276a3775fd77c5db696b75af7dc1b22d632d 100644 (file)
--- a/util/data/msgencode.c
+++ b/util/data/msgencode.c
@@ -834,9 +834,12 @@ attach_edns_record_(sldns_buffer* pkt, struct edns_data* edns, uint16_t udpsize)
                        sldns_buffer_write(pkt, opt->opt_data, opt->opt_len);
        }
        if (padding_opt) {
+               size_t block_sz = LDNS_QR_WIRE(sldns_buffer_begin(pkt))
+                               ? EDNS_PADDING_RESPONSE_BLOCK_SIZE
+                               : EDNS_PADDING_QUERY_BLOCK_SIZE;
                size_t pad_pos = sldns_buffer_position(pkt);
                size_t max_sz = pad_pos + 4 - len + udpsize;
-               size_t msg_sz = ((pad_pos + 3) / 468 + 1) * 468;
+               size_t msg_sz = ((pad_pos + 3) / block_sz + 1) * block_sz;
                size_t pad_sz = msg_sz - pad_pos - 4;
 
                sldns_buffer_write_u16(pkt, LDNS_EDNS_PADDING);

diff --git a/util/net_help.c b/util/net_help.c
index 135d33427ee1752b0a917824a8f945233ba398f9..f2d5aae1fd68c6a583fffed13c6d12ed15422a02 100644 (file)
--- a/util/net_help.c
+++ b/util/net_help.c
@@ -63,6 +63,10 @@
 #define MAX_ADDR_STRLEN 128 /* characters */
 /** default value for EDNS ADVERTISED size */
 uint16_t EDNS_ADVERTISED_SIZE = 4096;
+/** default value of padding block size with encrypted queries (RFC8467) */
+uint16_t EDNS_PADDING_QUERY_BLOCK_SIZE = 128;
+/** default value of padding block size with encrypted responses (RFC8467) */
+uint16_t EDNS_PADDING_RESPONSE_BLOCK_SIZE = 468;
 
 /** minimal responses when positive answer: default is no */
 int MINIMAL_RESPONSES = 0;

diff --git a/util/net_help.h b/util/net_help.h
index d9ee37ad03ac35b2d5fabf7fd896e0b474a7851a..93e2ccaf73718e33a98ee8764e5b82589ae2d90a 100644 (file)
--- a/util/net_help.h
+++ b/util/net_help.h
@@ -88,6 +88,10 @@ extern uint16_t EDNS_ADVERTISED_SIZE;
 #define INET_SIZE 4
 /** byte size of ip6 address */
 #define INET6_SIZE 16
+/** block size with which to pad encrypted queries */
+extern uint16_t EDNS_PADDING_QUERY_BLOCK_SIZE;
+/** block size with which to pad encrypted responses */
+extern uint16_t EDNS_PADDING_RESPONSE_BLOCK_SIZE;
 
 /** DNSKEY zone sign key flag */
 #define DNSKEY_BIT_ZSK 0x0100