AdguardTeam / AdguardTeam/AdGuardHome

AGH is non-compliant with RFC 7873 and RFC 9018 DNS Cookies

Open
#7,183 2 comments 0 reactions 0 assignees View on GitHub
feature request
Dominant language
TypeScript
Stars
36.9k
Forks
2.5k
PR merge metrics
No merged PRs in 30d

Description

### Prerequisites

- [X] I have checked the [Wiki](https://github.com/AdguardTeam/AdGuardHome/wiki) and [Discussions](https://github.com/AdguardTeam/AdGuardHome/discussions) and found no answer

- [X] I have searched other issues and found no duplicates

- [X] I want to request a feature or enhancement and not ask a question

### The problem

AdGuardHome is non-compliant with RFC 7873 and RFC 9018 DNS Cookies

> DNS Cookies are a lightweight DNS transaction security mechanism that
provides limited protection to DNS servers and clients against a
variety of increasingly common denial-of-service and amplification/
forgery or cache poisoning attacks by off-path attackers. DNS
Cookies are tolerant of NAT, NAT-PT (Network Address Translation -
Protocol Translation), and anycast and can be incrementally deployed.
(Since DNS Cookies are only returned to the IP address from which
they were originally received, they cannot be used to generally track
Internet users.)

### Proposed solution

Create and return server cookies for clients that send client cookies.

### Alternatives considered and additional information

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.