dnsdist: Add a 'disableZeroScope' option to the `newServer` command

diff --git a/pdns/dnsdist-lua.cc b/pdns/dnsdist-lua.cc
index 6b46afbc10741f22a47f3a6a7be32435c630f465..1dad2927120d634691583e046565b20bf05971e6 100644 (file)
--- a/pdns/dnsdist-lua.cc
+++ b/pdns/dnsdist-lua.cc
@@ -348,6 +348,10 @@ void setupLuaConfig(bool client)
                          ret->useECS=boost::get<bool>(vars["useClientSubnet"]);
                        }
 
+                       if(vars.count("disableZeroScope")) {
+                         ret->disableZeroScope=boost::get<bool>(vars["disableZeroScope"]);
+                       }
+
                        if(vars.count("ipBindAddrNoPort")) {
                          ret->ipBindAddrNoPort=boost::get<bool>(vars["ipBindAddrNoPort"]);
                        }

diff --git a/pdns/dnsdist-tcp.cc b/pdns/dnsdist-tcp.cc
index b2ccfe5c562dee1f0b2bc11b30f4d30ee175e3c0..777865ff162b5f130234964f0f21f6beadc58984 100644 (file)
--- a/pdns/dnsdist-tcp.cc
+++ b/pdns/dnsdist-tcp.cc
@@ -448,7 +448,7 @@ void tcpClientThread(int pipefd)
 
         if (dq.useECS && ((ds && ds->useECS) || (!ds && serverPool->getECS()))) {
           // we special case our cache in case a downstream explicitly gave us a universally valid response with a 0 scope
-          if (packetCache && !dq.skipCache && !ds->disableZeroScope && packetCache->isECSParsingEnabled()) {
+          if (packetCache && !dq.skipCache && (!ds || !ds->disableZeroScope) && packetCache->isECSParsingEnabled()) {
             if (packetCache->get(dq, consumed, dq.dh->id, cachedResponse, &cachedResponseSize, &cacheKeyNoECS, subnet, dnssecOK, allowExpired)) {
               DNSResponse dr(dq.qname, dq.qtype, dq.qclass, dq.consumed, dq.local, dq.remote, (dnsheader*) cachedResponse, sizeof cachedResponse, cachedResponseSize, true, &queryRealTime);
 #ifdef HAVE_PROTOBUF

diff --git a/pdns/dnsdist.cc b/pdns/dnsdist.cc
index a6c789907183c6e8e662f1359d94a41c55b6a9c0..8765fde4288439050d0496f3c78fdbceee7c0d29 100644 (file)
--- a/pdns/dnsdist.cc
+++ b/pdns/dnsdist.cc
@@ -1451,7 +1451,7 @@ static void processUDPQuery(ClientState& cs, LocalHolders& holders, const struct
 
     if (dq.useECS && ((ss && ss->useECS) || (!ss && serverPool->getECS()))) {
       // we special case our cache in case a downstream explicitly gave us a universally valid response with a 0 scope
-      if (packetCache && !dq.skipCache && !ss->disableZeroScope && packetCache->isECSParsingEnabled()) {
+      if (packetCache && !dq.skipCache && (!ss || !ss->disableZeroScope) && packetCache->isECSParsingEnabled()) {
         if (packetCache->get(dq, consumed, dh->id, query, &cachedResponseSize, &cacheKeyNoECS, subnet, dnssecOK, allowExpired)) {
           sendAndEncryptUDPResponse(holders, cs, dq, query, cachedResponseSize, dnsCryptQuery, delayMsec, dest, responsesVect, queuedResponses, respIOV, respCBuf, true);
           return;

diff --git a/pdns/dnsdistdist/docs/reference/config.rst b/pdns/dnsdistdist/docs/reference/config.rst
index 4c413fc8f1fe119d0cb6c619675d51f3eeb31c4e..3998faba27c7c5eabd26bcc8223f443b962d9362 100644 (file)
--- a/pdns/dnsdistdist/docs/reference/config.rst
+++ b/pdns/dnsdistdist/docs/reference/config.rst
@@ -349,7 +349,8 @@ Servers
                              --   "address@interface", e.g. "192.0.2.2@eth0"
       addXPF=NUM,            -- Add the client's IP address and port to the query, along with the original destination address and port,
                              -- using the experimental XPF record from `draft-bellis-dnsop-xpf <https://datatracker.ietf.org/doc/draft-bellis-dnsop-xpf/>`_ and the specified option code. Default is disabled (0)
-      sockets=NUM            -- Number of sockets (and thus source ports) used toward the backend server, defaults to a single one
+      sockets=NUM,           -- Number of sockets (and thus source ports) used toward the backend server, defaults to a single one
+      disableZeroScope       -- Disable the EDNS Client Subnet 'zero scope' feature, which does a cache lookup for an answer valid for all subnets (ECS scope of 0) before adding ECS information to the query and doing the regular lookup
     })
 
   :param str server_string: A simple IP:PORT string.