fix: add rate limiting to AXFR/IXFR and TSIG verification on IXFR->AXFR fallback (#208, #205, #218)

[poyrazK]

Summary

Fixes 3 security issues in AXFR/IXFR handling:

• AXFR/IXFR bypasses rate limiting - DoS vector #208 & AXFR/IXFR bypasses rate limiting - DoS vector #205 (High): AXFR/IXFR bypasses rate limiting — adds rate limit check to handleAXFR and handleIXFR to prevent DoS vector
• IXFR fallback to AXFR bypasses TSIG verification #218 (High): IXFR fallback to AXFR bypasses TSIG verification — adds TSIG re-verification in the fallback path

Changes

internal/dns/server/axfr.go

Rate limiting for AXFR/IXFR:

• Added rate limit check at start of handleAXFR and handleIXFR (before processing)
• Uses same s.limiter.Allow(clientIP) pattern as regular DNS queries
• Returns SERVFAIL if rate limited

TSIG verification on IXFR→AXFR fallback:

• If original IXFR request had TSIG, the fallback AXFR now re-verifies TSIG
• Prevents auth bypass where IXFR with valid TSIG could trigger unauthenticated AXFR fallback
• TSIG check runs BEFORE both fallback paths (err != nil and !historyValid)

internal/dns/server/edge_test.go

• Fixed mockConn to implement RemoteAddr() and LocalAddr() properly (returns TCPAddr instead of nil)
• Added TestHandleAXFR_RateLimited and TestHandleIXFR_RateLimited tests

Testing

• All server tests pass: go test -v -timeout 60s ./internal/dns/server/
• AXFR/IXFR tests pass including new rate limit tests

Closes

Closes #208
Closes #205
Closes #218

[coderabbitai]

Warning

Review limit reached

@poyrazK, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 54 minutes and 31 seconds. Learn how PR review limits work.

Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file).

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: ae09738e-45ee-4186-acd0-55d21a2747a8

📥 Commits

Reviewing files that changed from the base of the PR and between 512f08c and e41912b.

📒 Files selected for processing (2)

• internal/dns/server/axfr.go
• internal/dns/server/edge_test.go

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch release/axfr-ixfr-fixes

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[poyrazK]

It's okay to merge