Documentation
¶
Index ¶
- Variables
- func FormatCookie(clientCookie [8]byte, serverCookie []byte) []byte
- func GenerateClientCookie(clientIP, serverIP []byte) [8]byte
- func ParseCookie(data []byte) (clientCookie [8]byte, serverCookie []byte, err error)
- type Config
- type Manager
- func (m *Manager) GenerateServerCookie(clientCookie [8]byte, clientIP []byte) ([serverCookieSize]byte, error)
- func (m *Manager) RotateSecretPeriodically(stop <-chan struct{})
- func (m *Manager) Stats() Stats
- func (m *Manager) ValidateQueryCookie(clientCookie [8]byte, serverCookie []byte, clientIP []byte) (bool, error)
- func (m *Manager) ValidateServerCookie(clientCookie [8]byte, serverCookie [serverCookieSize]byte, clientIP []byte) error
- type Stats
Constants ¶
This section is empty.
Variables ¶
Functions ¶
func FormatCookie ¶
FormatCookie creates EDNS0 COOKIE option data
func GenerateClientCookie ¶
GenerateClientCookie generates an 8-byte client cookie Client cookie = Hash(client-IP || server-IP || random) In practice, clients should generate this, but we provide for testing
Types ¶
type Config ¶
type Config struct {
// Enable DNS cookies
Enabled bool `yaml:"enabled"`
// Require valid server cookie (BADCOOKIE if missing/invalid)
RequireValid bool `yaml:"require_valid"`
// Cluster secret for load-balanced deployments
// All servers in cluster must use same secret
ClusterSecret []byte `yaml:"cluster_secret"`
}
Config holds cookie manager configuration
type Manager ¶
type Manager struct {
// contains filtered or unexported fields
}
Manager handles DNS cookie generation and validation
func NewManager ¶
NewManager creates a new DNS cookie manager
func (*Manager) GenerateServerCookie ¶
func (m *Manager) GenerateServerCookie(clientCookie [8]byte, clientIP []byte) ([serverCookieSize]byte, error)
GenerateServerCookie generates a 16-byte server cookie per RFC 9018 §5. The timestamp is embedded in bytes 4-7 and the MAC (bytes 8-15) is computed over the client cookie, the fixed fields (version, reserved, timestamp) and the client IP, keyed by the current server secret.
func (*Manager) RotateSecretPeriodically ¶
func (m *Manager) RotateSecretPeriodically(stop <-chan struct{})
RotateSecretPeriodically runs secret rotation in background
func (*Manager) ValidateQueryCookie ¶
func (m *Manager) ValidateQueryCookie(clientCookie [8]byte, serverCookie []byte, clientIP []byte) (bool, error)
ValidateQueryCookie validates the cookie in a DNS query Returns whether to send BADCOOKIE response
func (*Manager) ValidateServerCookie ¶
func (m *Manager) ValidateServerCookie(clientCookie [8]byte, serverCookie [serverCookieSize]byte, clientIP []byte) error
ValidateServerCookie validates a 16-byte server cookie. It reads the timestamp embedded in the cookie (NOT the current wall-clock), recomputes the MAC using that timestamp, constant-time compares it, and enforces the freshness window. Both the current and previous secret are tried so cookies minted just before a secret rotation still validate.
Source Files