EDNS0 padding option support with DoT

buffer.h

@@ -260,6 +260,14 @@ buffer_write(buffer_type *buffer, const void *data, size_t count)
 	buffer->_position += count;
 }
 
+static inline void
+buffer_fill(buffer_type *buffer, const int c, size_t count)
+{
+	assert(buffer_available_at(buffer, buffer->_position, count));
+	memset(buffer->_data + buffer->_position, c, count);
+	buffer->_position += count;
+}
+
 static inline int
 try_buffer_write_at(buffer_type *buffer, size_t at, const void *data, size_t count)
 {

edns.c

@@ -71,6 +71,7 @@ edns_init_record(edns_record_type *edns)
 	edns->dnssec_ok = 0;
 	edns->nsid = 0;
 	edns->zoneversion = 0;
+	edns->padding = 0;
 	edns->cookie_status = COOKIE_NOT_PRESENT;
 	edns->cookie_len = 0;
 	edns->ede = -1; /* -1 means no Extended DNS Error */
@@ -117,6 +118,11 @@ edns_handle_option(uint16_t optcode, uint16_t optlen, buffer_type* packet,
 			buffer_skip(packet, optlen);
 		}
 		break;
+	case PADDING_CODE:
+		if(query->tls)
+			edns->padding = 1;
+		buffer_skip(packet, optlen);
+		break;
 	case ZONEVERSION_CODE:
 		edns->zoneversion = 1;
 		if(optlen > 0)

edns.h

@@ -19,13 +19,17 @@ struct query;
 #define OPT_HDR 4U                      /* NSID opt header length */
 #define NSID_CODE       3               /* nsid option code */
 #define COOKIE_CODE    10               /* COOKIE option code */
+#define PADDING_CODE   12               /* Padding option code */
 #define EDE_CODE       15               /* Extended DNS Errors option code */
 #define ZONEVERSION_CODE 19             /* ZONEVERSION option code */
 #define DNSSEC_OK_MASK  0x8000U         /* do bit mask */
 
 /* https://iana.org/assignments/dns-parameters/#zoneversion-type-values */
 #define ZONEVERSION_SOA_SERIAL 0
 
+/* See RFC 8467 */
+#define PADDING_BLOCK_SZ 468
+
 struct edns_data
 {
 	unsigned char ok[OPT_LEN];
@@ -64,6 +68,7 @@ struct edns_record
 	int                dnssec_ok;
 	int                nsid;
 	int                zoneversion;
+	int                padding;
 	cookie_status_type cookie_status;
 	size_t             cookie_len;
 	uint8_t            cookie[40];

query.c

@@ -1839,7 +1839,19 @@ query_add_optional(query_type *q, nsd_type *nsd, uint32_t *now_p)
 			                           +  sizeof(uint8_t)
 			                           +  sizeof(uint8_t)
 			                           +  sizeof(uint32_t);
-
+		if(q->edns.padding) {
+			size_t cur_sz = buffer_position(q->packet) + 2 + q->edns.opt_reserved_space;
+			size_t padded_sz = (((cur_sz - 1) / PADDING_BLOCK_SZ) + 1) * PADDING_BLOCK_SZ;
+			size_t to_padd = padded_sz - cur_sz;
+			/* Need 4 bytes for option code and length */
+			q->edns.padding = to_padd >= 4 ? to_padd
+			                : to_padd >  0 ? (PADDING_BLOCK_SZ + to_padd) 
+					: 0; /* Multiple of PADDING_BLOCK_SZ,
+			                      * so no outgoing padding option */
+			if(q->edns.padding) {
+				q->edns.opt_reserved_space += q->edns.padding;
+			}
+		}
 		if(q->edns.opt_reserved_space == 0 || !buffer_available(
 			q->packet, 2+q->edns.opt_reserved_space)) {
 			/* fill with NULLs */
@@ -1895,6 +1907,12 @@ query_add_optional(query_type *q, nsd_type *nsd, uint32_t *now_p)
 							q->edns.ede_text,
 							q->edns.ede_text_len);
 			}
+			if(q->edns.padding) {
+				assert(q->edns.padding >= 4);
+				buffer_write_u16(q->packet, PADDING_CODE);
+				buffer_write_u16(q->packet, q->edns.padding - 4);
+				buffer_fill(q->packet, 0, q->edns.padding - 4);
+			}
 		}
 		ARCOUNT_SET(q->packet, ARCOUNT(q->packet) + 1);
 		STATUP(nsd, edns);

tpkg/dot_padding.tdir/dot_padding.conf.in

@@ -0,0 +1,14 @@
+server:
+	zonesdir: ""
+	verbosity: 2
+	ip-address: 127.0.0.1
+	ip-address: 127.0.0.1@@TPKG_DOT_PORT@
+	tls-port: @TPKG_DOT_PORT@
+	xfrdfile: "xfrd.state"
+	zonelistfile: "zone.list"
+	tls-service-key: "dot_padding.key"
+	tls-service-pem: "dot_padding.pem"
+
+zone:
+	name: "example.com"
+	zonefile: "dot_padding.zone"

tpkg/dot_padding.tdir/dot_padding.dsc

@@ -0,0 +1,16 @@
+BaseName: dot_padding
+Version: 1.0
+Description: Test EDNS0 padding option
+CreationDate: do  2 jul 2026 12:00:23 CEST
+Maintainer: Willem Toorop
+Category:
+Component:
+CmdDepends:
+Depends:
+Help:
+Pre: dot_padding.pre
+Post: dot_padding.post
+Test: dot_padding.test
+AuxFiles: dot_padding.conf.in dot_padding.zone dot_padding.key dot_padding.pem
+Passed:
+Failure:

tpkg/dot_padding.tdir/dot_padding.help

@@ -0,0 +1,3 @@
+Please describe how to use this test.
+i.e. tpkg -a ARG exe testname:
+   ARG is used to ...

tpkg/dot_padding.tdir/dot_padding.key

@@ -0,0 +1,40 @@
+-----BEGIN PRIVATE KEY-----
+MIIG/QIBADANBgkqhkiG9w0BAQEFAASCBucwggbjAgEAAoIBgQCjsBHexLKQb89F
+S+bj3t+QNWMvWgxWReBj7yCjDXGsMU/SaanMUs/4BgTE7IVeaqQQlYlr4TT0m5HS
+8UWSIp9BSYH+NA6epbCa7iBFKLOsTOvDAsQuWV3aB1ApqQYGp6Ou2TqIF0DupE0x
+jDE32+GEj8p/+jjKhC+BD9XtNf2RyOBQhCgTTlD8oKoPxo+V3T0N8fRymojXElTQ
+SP8cgZdHEUEOUlyiG3ACgv0/wJbpxyvs12nIvLPmWQ4L/QvqROwUCd4uMUmeAPSz
+ctD6kG+sf2lVPg0SOW9Of58DkaWHep6VeEoRoi0SQpJH+mg/EI6NsDLlvyjStkYk
+QuKh26I//QNLetPmTMlCeevMoVPB17cr3AhwudKaKD7EwVobgnuj9cmunUDJG/Mn
+jadbq//ZIQuSdha3ppx3A48CiX1+Iyi7PCv7r3rtQBkcmA1mIWir3zLHujZJ0wdB
+QL636Xz9enVyrCu4D26eJLgH1Vbhwgra2UPdkL9phA70PrL5qD8CAwEAAQKCAYAH
+3rxNOKnZNfcCPu7//8RB+78kFLFJKJzsUSABlvDjNY+/7yKh1012gFuUWEblTj1L
+KtVroW1ZYW12dfFBYHbFvdIJNdmKGS9Pk6lridRxsVUYkDZ8gAF6LSXWivDmOwMs
+sfcVegC+OJoZisMHC4RhSkSTOKWoXwilrOw9Nn5VlxHp7SC8JOTR8KucjJB0xSld
+VUfKhtGTfackSI4zgauTWCoHlUAs7yLIjCG/AfR/kvryrTzB0QjZR2jcfLMo9V1M
+tztJLE/xNEZR4T6QOVT+H7yOQFFrL5Pbsh0FOnjTlPjLhrVm+pY8KuQ8ctmFDk3b
+OI6dUXsRJQpKUUoGg/CCqUETl/aLQ1YJMzZFZ6NhJ1eLLCol2zduz273JPWa48F0
++gs8KXWzMsIRDsmEAVwHURyPUFn3/pxuyIuBB4eqKrzak07bN4oS/OLUZwPN/PXs
+rwzqRgqSBTNo8i4DhWn6OAn+VY2v54VaImg7Y3lBNoc90x0LnnpVcILtkcwAhtkC
+gcEA16qiAgLx3Vt1CqqL4WoFcg4/ZoMCu4dzuExrXzBvy70o8+16WQAlgiYt8e4C
+cBnteblRd5QSghlIC0vksuMycGTCWLnt3Ie0xssrRncPJcQW1/apUZnaMUXQCh4u
+bdx9LcP/onQWVNOgiTzQPG6DpcaQtQIb52VVVCROdv1m66LqWJLiXE+4pECr7HHC
+1u0DHtSVQlOZrKS2HnRsb0cxUvRG0E6jimORkWug+v3eElmK0E9/Icsd3oQLV4s0
+kOBVAoHBAMJM368ZDCdSQx6z7EKsnM5o0lo6DTj10WYbGGXIJELyUZl1SZzZLUe2
+UQ279/ljGN7MFA42GuUeYQYRsX+rQLjIxxg0LDbzhv5iWCgXhKWa10nDoRcNV4tX
+xGUDI+QiROwJ9mPZEgcNpJvPINPGTCFjGhGecooDVc8xSQdxDwqMBbucQOMEqSNN
+wrbyMm3+s5L5bJX6aEmuPcm07SjAZYgTSSu0YU56HwxBTnmmwSSR0QNHUkhIHODO
+bOXX2D0qQwKBwAha8PnY+VvVDjzCjLbH77wSdzxWeQWg4sfSFhrS+pHPG0YP/jxy
+eAGJzx/fU7LaHkwn9NMIJotpxVPCtfKEQND/5lOfqGpxy3wkJOIO/MQ+y4/EW5zw
+s/ZSuRObRbs13pemT0IQ80iIBmEqvPqKYYlLnxGUKlaVo2+mFHAhsxoP7rpNvn1L
+DWE3rDF12tGOzx8jp0CxknOQ0gluA0FwZaXMFu49DbLv1pTmsY7nxPG7DFizq744
+a0jSnsned8PhHQKBwQC3M0aBUWudM7onm9v7bceX80vLWQsYluaukIOrjE9sdBAu
+UmFrK3a/NA8ulPoVwbM0d1W9pJQtTjyLPWmQCAfJcz4N+ztpQKsa9d1LSAmBIAM4
+AOXF14Wg08tQtupDc3Bq4mXX9VdDIUEAzAaWx1UG8esli7FRoh1pc335L0fQWQAa
+yhSAOOfFas9aMfkMr2ff/5+7tdRZDJojsp0enHHfINgQBk7tcMYPhxAYMfvQoFBj
+9/6EOsJH0TrqaF7yJQMCgcATUPBv4R50vvD0AafWch/vJnt2EfbsH89aRmsM8quH
+9+rMcVUqN0yy5YveRsYxDvIpGPMbvXijG2O07xnPX/5yDV2JDGbWEwg9YUS2mb3g
+iGRc5KGJRZnFNdXnAhk8853k6FQbhLlB0fqbYH8x8KtwH9uMn9UkAXFdvr0JKrg7
+9xp+kDb98VxJtXSMeGB5iIgoi5jnAannMiNszk07IoClUpU5f1QZzmz5+UYTNEt9
+PPG/m1FTeHXH407sfqB8frY=
+-----END PRIVATE KEY-----

tpkg/dot_padding.tdir/dot_padding.pem

@@ -0,0 +1,25 @@
+-----BEGIN CERTIFICATE-----
+MIIEPDCCAqSgAwIBAgIUJGe+SRXT0yBhTv5pnLcuYt/29wgwDQYJKoZIhvcNAQEL
+BQAwDjEMMAoGA1UEAwwDbnNkMB4XDTIzMTExOTE2MjUxNFoXDTQzMDgwNjE2MjUx
+NFowDjEMMAoGA1UEAwwDbnNkMIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKC
+AYEAo7AR3sSykG/PRUvm497fkDVjL1oMVkXgY+8gow1xrDFP0mmpzFLP+AYExOyF
+XmqkEJWJa+E09JuR0vFFkiKfQUmB/jQOnqWwmu4gRSizrEzrwwLELlld2gdQKakG
+Bqejrtk6iBdA7qRNMYwxN9vhhI/Kf/o4yoQvgQ/V7TX9kcjgUIQoE05Q/KCqD8aP
+ld09DfH0cpqI1xJU0Ej/HIGXRxFBDlJcohtwAoL9P8CW6ccr7NdpyLyz5lkOC/0L
+6kTsFAneLjFJngD0s3LQ+pBvrH9pVT4NEjlvTn+fA5Glh3qelXhKEaItEkKSR/po
+PxCOjbAy5b8o0rZGJELioduiP/0DS3rT5kzJQnnrzKFTwde3K9wIcLnSmig+xMFa
+G4J7o/XJrp1AyRvzJ42nW6v/2SELknYWt6acdwOPAol9fiMouzwr+6967UAZHJgN
+ZiFoq98yx7o2SdMHQUC+t+l8/Xp1cqwruA9uniS4B9VW4cIK2tlD3ZC/aYQO9D6y
++ag/AgMBAAGjgZEwgY4wHQYDVR0OBBYEFPb//R1Ree4/yWEwjm4NDgyZFsVuMEkG
+A1UdIwRCMECAFPb//R1Ree4/yWEwjm4NDgyZFsVuoRKkEDAOMQwwCgYDVQQDDANu
+c2SCFCRnvkkV09MgYU7+aZy3LmLf9vcIMBIGA1UdEwEB/wQIMAYBAf8CAQAwDgYD
+VR0RBAcwBYIDbnNkMA0GCSqGSIb3DQEBCwUAA4IBgQBd6s8T0xbDqPOp4dTn3YDi
+y16owyzuIp1yE7Cyi1DJnKYaV43Svsc/M0ERg2nR8mv9Xka5z2rLvma2K00D4rl4
+zIgNrUg99l6TVmf3HHtXbUP4RKRSLivlNj4v2Qf1SlAnFUju0XPNOH7EzuiA/vLi
+DVwlLFrqyuayiJqnzmt9lLfwQCgpkzhxoHlAKy/YACLTv21sywzQYpWLupE2r/nG
+LSvXCOYquQNeYeiwpyXFptAQFRXcSIYfA3ayiEQWmZ/l1/J/4Xd2PJ++eImPoTMN
+rWRgymfVUah0e/G4SXrMmwpT07zdAZ87B2w6wRN3ZJekIoZY7Kqew0v4Knv7yY/Z
+H+48gnqK6wznGODW4KRh4Kaje2aYicviCfSEnh+jVRkFZfdBO+OXw9jqdoeaJRRV
++71izHLTmWqMvMKjnYHggxeS7TXcQM761wHAjm+8Zl6p4iMTVqIIKpln2JEteaJ3
+FYZtYjczaItlB5LrP++BrFi95s9sAYJ3SP6Uer4NVPI=
+-----END CERTIFICATE-----

tpkg/dot_padding.tdir/dot_padding.post

@@ -0,0 +1,18 @@
+# #-- dot_padding.post --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# source the test var file when it's there
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+#
+# do your teardown here
+. ../common.sh
+
+# do your teardown here
+if [ -z $TPKG_NSD_PID ]; then
+        exit 0
+fi
+
+# kill NSD
+NSD_PID=`cat $TPKG_NSD_PID`
+kill_pid $NSD_PID
+

tpkg/dot_padding.tdir/dot_padding.pre

@@ -0,0 +1,26 @@
+# #-- dot_padding.pre--#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+. ../common.sh
+
+# start NSD
+get_random_port 2
+TPKG_PORT=$RND_PORT
+TPKG_DOT_PORT=`expr $RND_PORT + 1`
+
+PRE="../.."
+TPKG_NSD_PID="$PRE/nsd.pid.$$"
+TPKG_NSD="$PRE/nsd"
+
+# share the vars
+echo "export TPKG_PORT=$TPKG_PORT" >> .tpkg.var.test
+echo "export TPKG_DOT_PORT=$TPKG_DOT_PORT" >> .tpkg.var.test
+echo "export TPKG_NSD_PID=$TPKG_NSD_PID" >> .tpkg.var.test
+
+sed -e "s/@TPKG_DOT_PORT@/$TPKG_DOT_PORT/" < dot_padding.conf.in > edit.conf
+
+$TPKG_NSD -c edit.conf -u "" -l nsd.log -p $TPKG_PORT -P $TPKG_NSD_PID
+wait_nsd_up nsd.log
+

tpkg/dot_padding.tdir/dot_padding.test

@@ -0,0 +1,72 @@
+# #-- dot_padding.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+for SIZE_PADDED in 463:468 464:468 465:936 466:936 467:936 468:468 469:936 \
+	    931:936 932:936 933:1404 934:1404 935:1404 936:936 937:1404
+do
+	SIZE=${SIZE_PADDED%:*}
+	PADDED=${SIZE_PADDED#*:}
+
+	dig @127.0.0.1 -p $TPKG_PORT ${SIZE}.example.com. TXT +padding=128 2>&1 > UDP-${SIZE}.out
+	if ! grep -q ';; SERVER:.*(UDP)$' UDP-${SIZE}.out; then
+		cat UDP-${SIZE}.out
+		echo "Error: transport was not UDP"
+		exit 1
+	fi
+	if grep -q '^; PAD:' UDP-${SIZE}.out; then
+		cat UDP-${SIZE}.out
+		echo "Error: padding option seen in UDP message"
+		exit 1
+	fi
+	if ! grep -q "^;; MSG SIZE[[:space:]][[:space:]]*rcvd: ${SIZE}$" UDP-${SIZE}.out; then
+		cat UDP-${SIZE}.out
+		echo "Error: UDP message has wrong message size"
+		exit 1
+	fi
+
+	dig @127.0.0.1 -p $TPKG_PORT ${SIZE}.example.com. TXT +padding=128 +tcp 2>&1 > TCP-${SIZE}.out
+	if ! grep -q ';; SERVER:.*(TCP)$' TCP-${SIZE}.out; then
+		cat TCP-${SIZE}.out
+		echo "Error: transport was not TCP"
+		exit 1
+	fi
+	if grep -q '^; PAD:' TCP-${SIZE}.out; then
+		cat TCP-${SIZE}.out
+		echo "Error: padding option seen in TCP message"
+		exit 1
+	fi
+	if ! grep -q "^;; MSG SIZE[[:space:]][[:space:]]*rcvd: ${SIZE}$" TCP-${SIZE}.out; then
+		cat TCP-${SIZE}.out
+		echo "Error: TCP message has wrong message size"
+		exit 1
+	fi
+
+	dig @127.0.0.1 -p $TPKG_DOT_PORT ${SIZE}.example.com. TXT +padding=128 +tls 2>&1 > TLS-${SIZE}.out
+	if ! grep -q ';; SERVER:.*(TLS)$' TLS-${SIZE}.out; then
+		cat TLS-${SIZE}.out
+		echo "Error: transport was not TLS"
+		exit 1
+	fi
+	if [ $SIZE -eq 468 -o $SIZE -eq 936 ]; then
+		if grep -q '^; PAD:' TLS-${SIZE}.out; then
+			cat TLS-${SIZE}.out
+			echo "Error: padding option seen in TLS message of size $SIZE"
+			exit 1
+		fi
+	else
+		if ! grep -q '^; PAD:' TLS-${SIZE}.out; then
+			cat TLS-${SIZE}.out
+			echo "Error: padding option not seen in TLS message"
+			exit 1
+		fi
+	fi
+	if ! grep -q "^;; MSG SIZE[[:space:]][[:space:]]*rcvd: ${PADDED}$" TLS-${SIZE}.out; then
+		cat TLS-${SIZE}.out
+		echo "Error: TLS message has wrong message size (should have been $PADDED)"
+		exit 1
+	fi
+done
+