Added basic DNS cookie support with rate limiting

[zbalkan]

Adds DNS Cookies support across DnsServer with EDNS(0) COOKIE parsing, server-side cookie generation/validation, and request/response handling per RFC 7873/9018.

• EDNS COOKIE parsing/serialization (code 10) via EDnsCookieOptionData; 8-byte client cookie; 8–32-byte server cookie.
• DnsCookieSecretManager for 32-byte HMAC secrets with persistence and rotation.
• DnsCookieValidator builds v1 server cookies (version, timestamp, HMAC‑SHA256‑64) and validates within 5 minutes; server replies BADCOOKIE with TC and a fresh cookie on failure.
• Response path echoes/attaches server cookies when absent or forced and updates OPT safely.

Relies on PR TechnitiumSoftware/TechnitiumLibrary#56

Edit: Solves #1151
Edit 2: Removed configuration for cookies for the sake of simplicity

[Copilot]

Pull request overview

This pull request adds DNS Cookie support to the Technitium DNS Server, implementing RFC 7873 and RFC 9018 specifications. The implementation includes EDNS(0) COOKIE option parsing, server-side cookie generation and validation using HMAC-SHA256, secret management with automatic rotation, and appropriate request/response handling with BADCOOKIE responses.

Changes:

• Added DnsCookieSecretManager class for managing 32-byte HMAC secrets with file persistence and automatic rotation
• Added DnsCookieValidator class for generating and validating DNS cookies using RFC 9018 server cookie structure (version 1 with timestamp and HMAC-SHA256-64)
• Integrated DNS cookie validation and response handling into DnsServer with configuration options for enabling cookies, secret file path, rotation period, TC-on-bad-cookie behavior, and always-echo mode

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 19 comments.

File	Description
DnsServerCore/Dns/Security/DnsCookieSecretManager.cs	Manages cryptographic secrets for DNS cookies with persistence, rotation, and thread-safe access
DnsServerCore/Dns/Security/DnsCookieValidator.cs	Implements RFC 9018 server cookie generation and validation with timestamp and HMAC verification
DnsServerCore/Dns/DnsServer.cs	Integrates DNS cookie support with request validation, BADCOOKIE response generation, and configuration management

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 6 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 6 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 8 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[zbalkan]

I'll roll back last two commits. I shouldn't blindly listen to the copilot review. Original code was okay. But tomorrow.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 5 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[zbalkan]

Ready.

[zbalkan]

BTW, this is the first iteration of the progress. The next step is to add another rate-limiter making use of DNS cookies. The flow would be:

• If there is no valid cookie for N amount of queries, escalate to DNS-over-TCP
• If there are valid UDP cookies, proceed with DNS-over-UDP.

[zbalkan]

After 2 months, I finally found time to work on where I've left. Now, blocking traffic based on DNS query BADCOOKIE event has become another rate limiter. It can be enabled/disabled by a checkbox under Settings>General tab. The other values are hardcoded. The idea is to minimize the workload under a DDoS by responding queries with bad cookies ASAP with a truncate message, and beyond a threshold, dropping them altogether with no response. Blocking must be cheaper than resolving for this to work as intended.