dnsdist: Drop queries with no question (qdcount == 0)

Added a counter for these dropped queries, `emptyQueries` too.
This might be an issue for DNS cookies some day, as it uses
query with no question [1].
Additionnaly drops queries with QR set over TCP too to be
consistent with UDP.
This might close #3290.

[1]: https://tools.ietf.org/html/draft-ietf-dnsop-cookies-09#section-5.4

diff --git a/pdns/dnsdist-tcp.cc b/pdns/dnsdist-tcp.cc
index 9e458926d43a51308ae78ad2ec5b9ebec88ba937..78fa765b5f2ba63e8569248c721f2a4b72b70b8e 100644 (file)
--- a/pdns/dnsdist-tcp.cc
+++ b/pdns/dnsdist-tcp.cc
@@ -202,6 +202,17 @@ void* tcpClientThread(int pipefd)
           qlen = decryptedQueryLen;
         }
 #endif
+        struct dnsheader* dh = (struct dnsheader*) query;
+
+        if(dh->qr) {   // don't respond to responses
+          g_stats.nonCompliantQueries++;
+          goto drop;
+        }
+
+        if(dh->qdcount == 0) {
+          g_stats.emptyQueries++;
+          goto drop;
+        }
 
        uint16_t qtype;
        unsigned int consumed = 0;

diff --git a/pdns/dnsdist.cc b/pdns/dnsdist.cc
index b24a99483317d7cee13af1260bbe35a4e9384214..378bf82dec297139b470ee5de70eafd1af50a939 100644 (file)
--- a/pdns/dnsdist.cc
+++ b/pdns/dnsdist.cc
@@ -601,6 +601,11 @@ try
        continue;
       }
 
+      if(dh->qdcount == 0) {
+        g_stats.emptyQueries++;
+        continue;
+      }
+
       if (dh->rd) {
         g_stats.rdQueries++;
       }

diff --git a/pdns/dnsdist.hh b/pdns/dnsdist.hh
index c92ae9a322656d110b05fad93baaef934258fcc2..ec0ceb38cf25787978c495ea97e27fa3c008b718 100644 (file)
--- a/pdns/dnsdist.hh
+++ b/pdns/dnsdist.hh
@@ -42,6 +42,7 @@ struct DNSDistStats
   stat_t queries{0};
   stat_t nonCompliantQueries{0};
   stat_t rdQueries{0};
+  stat_t emptyQueries{0};
   stat_t aclDrops{0};
   stat_t blockFilter{0};
   stat_t dynBlocked{0};
@@ -73,6 +74,7 @@ struct DNSDistStats
     {"real-memory-usage", getRealMemoryUsage},
     {"noncompliant-queries", &nonCompliantQueries},
     {"rdqueries", &rdQueries},
+    {"empty-queries", &emptyQueries},
     {"cpu-user-msec", getCPUTimeUser},
     {"cpu-sys-msec", getCPUTimeSystem},
     {"fd-usage", getOpenFileDescriptors}, {"dyn-blocked", &dynBlocked},