EDNS0 padding support in auth

[miodvallat]

Short description

Even though the auth<->recursor communication can probably be considered trustworthy, the auth server should nevertheless respond to queries containing the EDNS0 padding option with a similarly padded response. This PR achieves this.

(still marked as draft as I need to work on tests - I only checked the output of simple dig queries with and without +padding=128)

Checklist

I have:

• read the CONTRIBUTING.md document
• compiled this code
• tested this code
• included documentation (including possible behaviour changes)
• documented the code
• added or modified regression test(s)
• added or modified unit test(s)

[coveralls]

Pull Request Test Coverage Report for Build 12667063404

Details

• 9 of 21 (42.86%) changed or added relevant lines in 3 files are covered.
• 37 unchanged lines in 11 files lost coverage.
• Overall coverage decreased (-0.01%) to 64.815%

---

Changes Missing Coverage	Covered Lines	Changed/Added Lines	%
pdns/dnspacket.cc	5	17	29.41%

Files with Coverage Reduction	New Missed Lines	%
modules/godbcbackend/sodbc.cc	2	70.8%
ext/json11/json11.cpp	2	62.72%
pdns/sstuff.hh	2	56.83%
pdns/backends/gsql/gsqlbackend.hh	2	97.71%
pdns/recursordist/test-syncres_cc2.cc	3	88.85%
pdns/stubresolver.cc	3	77.58%
pdns/misc.cc	3	64.57%
pdns/iputils.cc	3	54.99%
pdns/recursordist/recpacketcache.hh	3	89.55%
pdns/recursordist/test-syncres_cc1.cc	7	89.26%

Totals
Change from base Build 12652818968:	-0.01%
Covered Lines:	126128
Relevant Lines:	163823

---

💛 - Coveralls

[Habbie]

seems to work, including packet cache handling! However, this needs configurability. I think allowing it by default on TCP is fine, but for UDP users should have control in some way.

[miodvallat]

Recursor uses a edns-padding-out option. How about edns-padding-udp? Note that this will have no effect if incoming queries are not sent with EDNS padding enabled.

[Habbie]

Recursor uses a edns-padding-out option. How about edns-padding-udp? Note that this will have no effect if incoming queries are not sent with EDNS padding enabled.

Recursor's edns-padding-from seems like an important inspiration, because it would allow a user to (with some care) separate "traffic that is going over an encrypted channel via dnsdist" from "actual UDP packets from the Internet".

The problem we're solving, I think, is that we don't want spoofed UDP queries to be able to get padded responses.