dnsdist: a way to set the EDNS Client Subnet SCOPE PREFIX-LENGTH on responses

[bmijusk]

 - Program: dnsdist 
 - Issue type: Feature request

Short description

dnsdist can make an answer depend on the client subnet, but it has no way to say so in the response: nothing can set the SCOPE PREFIX-LENGTH of the ECS option.

Usecase

Queries reach our dnsdist already carrying ECS from downstream resolvers. The answer we return depends on that client subnet, because pool
selection is derived from it. Those downstream resolvers cache what we hand back.

The scope can only be set by whoever used the subnet, and in this setup that is dnsdist, not the backend. The backend is handed the client's ECS option, does not use it to pick the answer, and therefore correctly returns SCOPE PREFIX-LENGTH 0. dnsdist then passes that response through untouched. So the answer goes out labelled "valid for every client" when it is in fact specific to one subnet.

Description

A response action, usable in the response rule chains, that sets the SCOPE PREFIX-LENGTH of the ECS option already present in a response.

Other information

Related on the selector side: #13826. ECS-based routing is what produces the subnet-specific answers this request is about.

[rgacogne]

Tentatively assigning to the 2.2.0 milestone, but no promises. As always it helps a lot when someone contributes (part of?) the code :)

A response action, usable in the response rule chains, that sets the SCOPE PREFIX-LENGTH of the ECS option already present in a response.

It might make sense to also handle the case where the is no ECS option in the response yet, even though it's of course more complicated.