Aram Sargsyan baa9698c9d Fix RRL responses-per-second bypass using wildcard names ... It is possible to bypass Response Rate Limiting (RRL) `responses-per-second` limitation using specially crafted wildcard names, because the current implementation, when encountering a found DNS name generated from a wildcard record, just strips the leftmost label of the name before making a key for the bucket. While that technique helps with limiting random requests like <random>.example.com (because all those requests will be accounted as belonging to a bucket constructed from "example.com" name), it does not help with random names like subdomain.<random>.example.com. The best solution would have been to strip not just the leftmost label, but as many labels as necessary until reaching the suffix part of the wildcard record from which the found name is generated, however, we do not have that information readily available in the context of RRL processing code. Fix the issue by interpreting all valid wildcard domain names as the zone's origin name concatenated to the "*" name, so they all will be put into the same bucket.		2022-09-08 09:15:30 +02:00
..
startperf	Update the copyright information in all files in the repository	2022-01-11 09:05:02 +01:00
system	Fix RRL responses-per-second bypass using wildcard names	2022-09-08 09:15:30 +02:00
testdata/wire	move all optional tests from bin/tests to bin/tests/optional	2018-03-09 14:12:47 -08:00
.gitignore	Refactor TLSDNS module to work with libuv/ssl directly	2021-01-25 09:19:22 +01:00
convert-trs-to-junit.py	Auto-format Python files with black	2022-06-08 10:28:08 +02:00
Makefile.am	Avoid using C99 variable length arrays	2022-03-18 15:11:48 +00:00
test_client.c	Update netmgr, tasks, and applications to use isc_loopmgr	2022-08-26 09:09:24 +02:00
test_server.c	Update netmgr, tasks, and applications to use isc_loopmgr	2022-08-26 09:09:24 +02:00
wire_test.c	DNS name compression does not depend on the EDNS version	2022-06-01 13:00:40 +01:00