Resolver is able to insert dummy client cookies into generated requests.

lib/cookies/control.c

+/*  Copyright (C) 2016 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <assert.h>
+#include <stdint.h>
+#include <libknot/error.h>
+#include <libknot/rrtype/opt_cookie.h>
+
+#include "lib/cookies/control.h"
+
+struct cookies_control cookies_control = {
+	.enabled = true
+};
+
+static int opt_rr_add_cookies(knot_rrset_t *opt_rr,
+                              uint8_t cc[KNOT_OPT_COOKIE_CLNT],
+                              uint8_t *sc, uint16_t sc_len,
+                              knot_mm_t *mm)
+{
+	int ret;
+	uint16_t cookies_size = 0;
+	uint8_t *cookies_data = NULL;
+
+	cookies_size = knot_edns_opt_cookie_data_len(sc_len);
+
+	ret = knot_edns_reserve_option(opt_rr, KNOT_EDNS_OPTION_COOKIE,
+	                               cookies_size, &cookies_data, mm);
+	if (ret != KNOT_EOK) {
+		return ret;
+	}
+	assert(cookies_data != NULL);
+
+	ret = knot_edns_opt_cookie_create(cc, sc, sc_len,
+	                                  cookies_data, &cookies_size);
+	if (ret != KNOT_EOK) {
+		return ret;
+	}
+
+	assert(cookies_size == knot_edns_opt_cookie_data_len(sc_len));
+
+	return KNOT_EOK;
+}
+
+int kr_pkt_add_cookie(knot_pkt_t *pkt)
+{
+	assert(pkt);
+	assert(pkt->opt_rr);
+
+	/* TODO -- generate cleitn cookie from client address, server address
+	 * and secret quentity. */
+	static uint8_t cc[KNOT_OPT_COOKIE_CLNT] = { 1, 2, 3, 4, 5, 6, 7, 8};
+
+	int ret = opt_rr_add_cookies(pkt->opt_rr, cc, NULL, 0, &pkt->mm);
+	return ret;
+}

lib/cookies/control.h

+/*  Copyright (C) 2016 CZ.NIC, z.s.p.o. <knot-dns@labs.nic.cz>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#pragma once
+
+#include <libknot/packet/pkt.h>
+#include <stdbool.h>
+
+#define KR_COOKIE_PLD_MAX 44 /* Define in libknot. */
+
+/** DNSSEC cookies controlling structure. */
+struct cookies_control {
+	bool enabled; /*!< Enabled/disables DNS cookies functionality. */
+	/* Cache. */
+};
+
+/** Global cookies control. */
+extern struct cookies_control cookies_control;
+
+/**
+ * Insert a DNS cookie into the packet.
+ * @note The packet must already contain ENDS section.
+ * @param pkt Packet.
+ */
+int kr_pkt_add_cookie(knot_pkt_t *pkt);

lib/lib.mk

@@ -4,6 +4,7 @@ libkres_SOURCES := \
 	lib/layer/validate.c   \
 	lib/layer/rrcache.c    \
 	lib/layer/pktcache.c   \
+	lib/cookies/control.c  \
 	lib/dnssec/nsec.c      \
 	lib/dnssec/nsec3.c     \
 	lib/dnssec/signature.c \
@@ -23,6 +24,7 @@ libkres_HEADERS := \
 	lib/generic/map.h      \
 	lib/generic/set.h      \
 	lib/layer.h            \
+	lib/cookies/control.h  \
 	lib/dnssec/nsec.h      \
 	lib/dnssec/nsec3.h     \
 	lib/dnssec/signature.h \

lib/resolve.c

@@ -27,6 +27,7 @@
 #include "lib/rplan.h"
 #include "lib/layer/iterate.h"
 #include "lib/dnssec/ta.h"
+#include "lib/cookies/control.h"
 
 #define DEBUG_MSG(qry, fmt...) QRDEBUG((qry), "resl",  fmt)
 
@@ -266,7 +267,11 @@ static int edns_put(knot_pkt_t *pkt)
 static int edns_create(knot_pkt_t *pkt, knot_pkt_t *template, struct kr_request *req)
 {
 	pkt->opt_rr = knot_rrset_copy(req->ctx->opt_rr, &pkt->mm);
-	return knot_pkt_reserve(pkt, knot_edns_wire_size(pkt->opt_rr));
+	size_t wire_size = knot_edns_wire_size(pkt->opt_rr);
+	if (cookies_control.enabled) {
+		wire_size += KR_COOKIE_PLD_MAX;
+	}
+	return knot_pkt_reserve(pkt, wire_size);
 }
 
 static int answer_prepare(knot_pkt_t *answer, knot_pkt_t *query, struct kr_request *req)
@@ -356,6 +361,10 @@ static int query_finalize(struct kr_request *request, struct kr_query *qry, knot
 				knot_edns_set_do(pkt->opt_rr);
 				knot_wire_set_cd(pkt->wire);
 			}
+			/* Insert cookies. */
+			if (cookies_control.enabled) {
+				ret = kr_pkt_add_cookie(pkt);
+			}
 			ret = edns_put(pkt);
 		}
 	}