Prevent AXFR over UDP

[chantra]

What happened: When sending an AXFR request over UDP (which typical clients like dig prevents you from doing), CoreDNS will happily reply over UDP, which has the potential of generating big payloads and used as an amplification vector.

What you expected to happen: AXFR to be limited in size and force TC or possibly return NOTIMPL (like root AXFR server do for instance)

How to reproduce it (as minimally and precisely as possible):

Using a modified miekg/exdns 's q.o

Running:

./coredns -dns.port=1053

With a Corefile:

$ cat Corefile
. {
 file somezonefile
    log
 transfer {
    to *
 }
}

using the modified q.go:

$ go run q.go -port 1053   @::1  AXFR

we can see that CoreDNS would reply to the AXFR request over UDP.
Anything else we need to know?:

Environment:

• the version of CoreDNS:

CoreDNS-1.8.1
linux/amd64, go1.14.7, 03812bb1

• Corefile:

. {
 file somezonefile
    log
 transfer {
    to *
 }
}

• OS (e.g: cat /etc/os-release):
  Ubuntu 20.10

[SuperQ]

For reference: https://tools.ietf.org/html/rfc5936#section-4.2