MaxQPS rule for zones/RCODE

[nlmark]

• Program: dnsdist
• Issue type: Feature request

Short description

Add an option to set a max qps per zone/zonedepth dynamically. Don't let it depend on the requesting IP.

eg: MaxQPSZoneRule (qps[, labels[, burst[, expiration[, cleanupdelay]]]])
By setting the qps to for example 10 and the labels to 2 it would mean that example.com would in total be allowed 10 queries per second before the rule comes in to effect. The other rule option are inspired by https://dnsdist.org/rules-actions.html?highlight=maxqpsiprule#MaxQPSIPRule .

Usecase

Combined with an addAction it would make it possible to automatically detect levels above the threshold and handle them differently. eg sending them to a different server pool or drop them or require tcp. The idea is to make it possible to automatically drop/handle suspected attacks.

Description

Make it possible to add rules based on the zone name (or zone labels) to have an action based on the qps for it. It could also be combined with RCODE to only do it for certain RCODE levels (eg nxdomain) to defend against nxdomain attacks (by putting the attacked domain on a different server pool and that way keeping the other zones online).

[rgacogne]

I'm tentatively putting this into the 1.9 milestone, but we already have a lot on our plate so this feature is likely to get postponed. It will help if someone actually contributes the code, as always :-)