EDNS0 Client Subnet for Delivery Services

CHANGELOG.md

@@ -5,6 +5,8 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/).
 
 ## [unreleased]
 ### Added
+- Added a boolean to delivery service in Traffic Portal and Traffic Ops to enable EDNS0 client subnet at the delivery service level and include it in the cr-config.
+- Updated Traffic Router to read new EDSN0 client subnet field and route accordingly only for enabled delivery services. When enabled and a subnet is present in the request, the subnet appears in the `chi` field and the resolver address is in the `rhi` field.
 
 ### Changed
 

docs/source/admin/traffic_router.rst

@@ -195,7 +195,8 @@ Much of a Traffic Router's configuration can be obtained through the :term:`Para
 	+-----------------------------------------+------------------------------+---------------------------------------------------------------------------------------------------------------------------------------+
 	| CoverageZoneJsonURL                     | CRConfig.xml                 | The location (URL) where a :term:`Coverage Zone Map` may be found.                                                                    |
 	+-----------------------------------------+------------------------------+---------------------------------------------------------------------------------------------------------------------------------------+
-	| ecsEnable                               | CRConfig.json                | Boolean value to enable or disable ENDS0 client subnet extensions.                                                                    |
+	| ecsEnable                               | CRConfig.json                | Boolean value to enable or disable EDNS0 client subnet extensions.                                                                    |
+	|                                         |                              | This is a universal value for the CDN but can be set on the :term:`Delivery Service` level through the :ref:`ds-ecs` field.           |
 	+-----------------------------------------+------------------------------+---------------------------------------------------------------------------------------------------------------------------------------+
 	| geolocation.polling.url                 | CRConfig.json                | The location (URL) where a geographic IP mapping database may be found.                                                               |
 	+-----------------------------------------+------------------------------+---------------------------------------------------------------------------------------------------------------------------------------+
@@ -539,7 +540,7 @@ DNS Specifics
 	+=======+=================================================================================+===================================================================================================+
 	| xn    | The ID from the client DNS request header                                       | a whole number between 0 and 65535 (inclusive)                                                    |
 	+-------+---------------------------------------------------------------------------------+---------------------------------------------------------------------------------------------------+
-	| rhi   | The IP address of the resolver when ENDS0 client subnet extensions are enabled. | An IPv4 or IPv6 string, or dash if request is for resolver only and no client subnet is present   |
+	| rhi   | The IP address of the resolver when EDNS0 client subnet extensions are enabled. | An IPv4 or IPv6 string, or dash if request is for resolver only and no client subnet is present   |
 	+-------+---------------------------------------------------------------------------------+---------------------------------------------------------------------------------------------------+
 	| fqdn  | The qname field from the client DNS request message (i.e. the                   | A series of DNS labels/domains separated by '.' characters and ending with a '.' character        |
 	|       | :abbr:`FQDN (Fully Qualified Domain Name)` the client is requesting be          |                                                                                                   |

docs/source/api/cdns_name_snapshot.rst

@@ -191,6 +191,13 @@ Response Structure
 				:term:`Cache servers` will be chosen at random
 
 	:domains:             An array of domains served by this :term:`Delivery Service`
+	:ecsEnabled:          A string containing a boolean from :ref:`ds-ecs` that tells whether EDNS0 client subnet is enabled on this :term:`Delivery Service`; one of:
+
+		"false"
+			EDNS0 client subnet is not enabled on this :term:`Delivery Service`
+		"true"
+			EDNS0 client subnet is enabled on this :term:`Delivery Service`
+
 	:geolocationProvider: The name of a provider for IP-to-geographic-location mapping services - currently the only valid value is ``"maxmindGeolocationService"``
 	:ip6RoutingEnabled:   A string containing a boolean that defines the :ref:`ds-ipv6-routing` setting for this :term:`Delivery Service`; one of:
 
@@ -483,6 +490,7 @@ Response Structure
 					"SOA": "86400"
 				},
 				"ip6RoutingEnabled": "true",
+				"ecsEnabled": "false",
 				"routingName": "video",
 				"deepCachingType": "NEVER"
 			}

docs/source/api/cdns_name_snapshot_new.rst

@@ -190,6 +190,13 @@ Response Structure
 				:term:`Cache servers` will be chosen at random
 
 	:domains:             An array of domains served by this :term:`Delivery Service`
+	:ecsEnabled:          A string containing a boolean from :ref:`ds-ecs` that tells whether EDNS0 client subnet is enabled on this :term:`Delivery Service`; one of:
+
+		"false"
+			EDNS0 client subnet is not enabled on this :term:`Delivery Service`
+		"true"
+			EDNS0 client subnet is enabled on this :term:`Delivery Service`
+
 	:geolocationProvider: The name of a provider for IP-to-geographic-location mapping services - currently the only valid value is ``"maxmindGeolocationService"``
 	:ip6RoutingEnabled:   A string containing a boolean that defines the :ref:`ds-ipv6-routing` setting for this :term:`Delivery Service`; one of:
 
@@ -483,6 +490,7 @@ Response Structure
 					"SOA": "86400"
 				},
 				"ip6RoutingEnabled": "true",
+				"ecsEnabled": "false",
 				"routingName": "video",
 				"deepCachingType": "NEVER"
 			}

docs/source/api/deliveryservices.rst

@@ -90,6 +90,10 @@ Response Structure
 :dnsBypassIp6:      A :ref:`ds-dns-bypass-ipv6`
 :dnsBypassTtl:      The :ref:`ds-dns-bypass-ttl`
 :dscp:              A :ref:`ds-dscp` to be used within the :term:`Delivery Service`
+:ecsEnabled:        A boolean that defines the :ref:`ds-ecs` setting on this :term:`Delivery Service`
+
+	.. versionadded:: 1.5
+
 :edgeHeaderRewrite: A set of :ref:`ds-edge-header-rw-rules`
 :exampleURLs:       An array of :ref:`ds-example-urls`
 :fqPacingRate:      The :ref:`ds-fqpr`
@@ -253,7 +257,8 @@ Response Structure
 			"xxx",
 			"zyx"
 		],
-		"maxOriginConnections": 0
+		"maxOriginConnections": 0,
+		"ecsEnabled": false
 	}]}
 
 
@@ -295,6 +300,10 @@ Request Structure
 :dnsBypassIp6:      A :ref:`ds-dns-bypass-ipv6`
 :dnsBypassTtl:      The :ref:`ds-dns-bypass-ttl`
 :dscp:              A :ref:`ds-dscp` to be used within the :term:`Delivery Service`
+:ecsEnabled:        A boolean that defines the :ref:`ds-ecs` setting on this :term:`Delivery Service`
+
+	.. versionadded:: 1.4
+
 :edgeHeaderRewrite: A set of :ref:`ds-edge-header-rw-rules`
 :fqPacingRate:      The :ref:`ds-fqpr`
 
@@ -372,6 +381,7 @@ Request Structure
 		"deepCachingType": "NEVER",
 		"displayName": "test",
 		"dscp": 0,
+		"ecsEnabled": true,
 		"geoLimit": 0,
 		"geoProvider": 0,
 		"initialDispersion": 1,
@@ -427,6 +437,10 @@ Response Structure
 :dnsBypassIp6:      A :ref:`ds-dns-bypass-ipv6`
 :dnsBypassTtl:      The :ref:`ds-dns-bypass-ttl`
 :dscp:              A :ref:`ds-dscp` to be used within the :term:`Delivery Service`
+:ecsEnabled:        A boolean that defines the :ref:`ds-ecs` setting on this :term:`Delivery Service`
+
+	.. versionadded:: 1.4
+
 :edgeHeaderRewrite: A set of :ref:`ds-edge-header-rw-rules`
 :exampleURLs:       An array of :ref:`ds-example-urls`
 :fqPacingRate:      The :ref:`ds-fqpr`
@@ -586,7 +600,8 @@ Response Structure
 			],
 			"deepCachingType": "NEVER",
 			"signingAlgorithm": null,
-			"tenant": "root"
+			"tenant": "root",
+			"ecsEnabled": true
 		}
 	]}
 

docs/source/api/deliveryservices_id.rst

@@ -100,6 +100,10 @@ Response Structure
 :dnsBypassIp6:      A :ref:`ds-dns-bypass-ipv6`
 :dnsBypassTtl:      The :ref:`ds-dns-bypass-ttl`
 :dscp:              A :ref:`ds-dscp` to be used within the :term:`Delivery Service`
+:ecsEnabled:        A boolean that defines the :ref:`ds-ecs` setting on this :term:`Delivery Service`
+
+	.. versionadded:: 1.4
+
 :edgeHeaderRewrite: A set of :ref:`ds-edge-header-rw-rules`
 :exampleURLs:       An array of :ref:`ds-example-urls`
 :fqPacingRate:      The :ref:`ds-fqpr`
@@ -263,7 +267,8 @@ Response Structure
 			"xxx",
 			"zyx"
 		],
-		"maxOriginConnections": 0
+		"maxOriginConnections": 0,
+		"ecsEnabled": false
 	}]}
 
 
@@ -305,6 +310,10 @@ Request Structure
 :dnsBypassIp6:      A :ref:`ds-dns-bypass-ipv6`
 :dnsBypassTtl:      The :ref:`ds-dns-bypass-ttl`
 :dscp:              A :ref:`ds-dscp` to be used within the :term:`Delivery Service`
+:ecsEnabled:        A boolean that defines the :ref:`ds-ecs` setting on this :term:`Delivery Service`
+
+	.. versionadded:: 1.4
+
 :edgeHeaderRewrite: A set of :ref:`ds-edge-header-rw-rules`
 :fqPacingRate:      The :ref:`ds-fqpr`
 
@@ -386,6 +395,7 @@ Request Structure
 		"deepCachingType": "NEVER",
 		"displayName": "demo",
 		"dscp": 0,
+		"ecsEnabled": true,
 		"geoLimit": 0,
 		"geoProvider": 0,
 		"initialDispersion": 1,

docs/source/api/deliveryservices_id_safe.rst

@@ -96,6 +96,10 @@ Response Structure
 :dnsBypassIp6:      A :ref:`ds-dns-bypass-ipv6`
 :dnsBypassTtl:      The :ref:`ds-dns-bypass-ttl`
 :dscp:              A :ref:`ds-dscp` to be used within the :term:`Delivery Service`
+:ecsEnabled:        A boolean that defines the :ref:`ds-ecs` setting on this :term:`Delivery Service`
+
+	.. versionadded:: 1.4
+
 :edgeHeaderRewrite: A set of :ref:`ds-edge-header-rw-rules`
 :exampleURLs:       An array of :ref:`ds-example-urls`
 :fqPacingRate:      The :ref:`ds-fqpr`
@@ -259,7 +263,8 @@ Response Structure
 			"xxx",
 			"zyx"
 		],
-		"maxOriginConnections": 0
+		"maxOriginConnections": 0,
+		"ecsEnabled": false
 	}]}
 
 

docs/source/api/servers_id_deliveryservices.rst

@@ -96,6 +96,10 @@ Response Structure
 :dnsBypassIp6:      A :ref:`ds-dns-bypass-ipv6`
 :dnsBypassTtl:      The :ref:`ds-dns-bypass-ttl`
 :dscp:              A :ref:`ds-dscp` to be used within the :term:`Delivery Service`
+:ecsEnabled:        A boolean that defines the :ref:`ds-ecs` setting on this :term:`Delivery Service`
+
+	.. versionadded:: 1.4
+
 :edgeHeaderRewrite: A set of :ref:`ds-edge-header-rw-rules`
 :exampleURLs:       An array of :ref:`ds-example-urls`
 :fqPacingRate:      The :ref:`ds-fqpr`
@@ -259,7 +263,8 @@ Response Structure
 			"xxx",
 			"zyx"
 		],
-		"maxOriginConnections": 0
+		"maxOriginConnections": 0,
+		"ecsEnabled": false
 	}]}
 
 

docs/source/api/users_id_deliveryservices.rst

@@ -80,6 +80,10 @@ Response Structure
 :dnsBypassIp6:      A :ref:`ds-dns-bypass-ipv6`
 :dnsBypassTtl:      The :ref:`ds-dns-bypass-ttl`
 :dscp:              A :ref:`ds-dscp` to be used within the :term:`Delivery Service`
+:ecsEnabled:        A boolean that defines the :ref:`ds-ecs` setting on this :term:`Delivery Service`
+
+	.. versionadded:: 1.4
+
 :edgeHeaderRewrite: A set of :ref:`ds-edge-header-rw-rules`
 :exampleURLs:       An array of :ref:`ds-example-urls`
 :fqPacingRate:      The :ref:`ds-fqpr`
@@ -229,7 +233,8 @@ Response Structure
 		"trRequestHeaders": null,
 		"consistentHashRegex": null,
 		"consistentHashQueryParams": null,
-		"maxOriginConnections": null
+		"maxOriginConnections": null,
+		"ecsEnabled": false
 	}]}
 
 .. [#tenancy] While it is totally possible to assign a :term:`Delivery Service` to a user who's :term:`Tenant` does not have permission to own said :term:`Delivery Service`, users that request this endpoint will only see :term:`Delivery Services` that their :term:`Tenant` has permission to see. This means that there's no real guarantee that the output of this endpoint shows all of the :term:`Delivery Services` assigned to the user requested, even if the user is requesting their own assigned :term:`Delivery Services`.

docs/source/overview/delivery_services.rst

@@ -189,6 +189,12 @@ This field in general contains the contents of the a configuration file used by
 
 .. tip:: Because this ultimately is the contents of an :abbr:`ATS (Apache Traffic Server)` configuration file, it can make use of the :ref:`ort-special-strings`.
 
+.. _ds-ecs:
+
+EDNS0 Client Subnet Enabled
+---------------------------
+A boolean value that controls whether or not EDNS0 client subnet is enabled on this Delivery Service by Traffic Router. When creating a Delivery Service in Traffic Portal, this will default to "false".
+
 .. _ds-example-urls:
 
 Example URLs

lib/go-tc/crconfig.go

@@ -121,6 +121,7 @@ type CRConfigDeliveryService struct {
 	TTLs                      *CRConfigTTL                          `json:"ttls,omitempty"`
 	MaxDNSIPsForLocation      *int                                  `json:"maxDnsIpsForLocation,omitempty"`
 	IP6RoutingEnabled         *bool                                 `json:"ip6RoutingEnabled,string,omitempty"`
+	EcsEnabled                *bool                                 `json:"ecsEnabled,string,omitempty"`
 	RoutingName               *string                               `json:"routingName,omitempty"`
 	BypassDestination         map[string]*CRConfigBypassDestination `json:"bypassDestination,omitempty"`
 	DeepCachingType           *DeepCachingType                      `json:"deepCachingType"`

lib/go-tc/deliveryservices.go

@@ -158,9 +158,13 @@ type DeliveryServiceV11 struct {
 	XMLID                    string                 `json:"xmlId"`
 }
 
-type DeliveryServiceNullableV14 DeliveryServiceNullable // this type alias should always alias the latest minor version of the deliveryservices endpoints
+type DeliveryServiceNullableV15 DeliveryServiceNullable // this type alias should always alias the latest minor version of the deliveryservices endpoints
 
 type DeliveryServiceNullable struct {
+	DeliveryServiceNullableV14
+	EcsEnabled bool `json:"ecsEnabled" db:"ecs_enabled"`
+}
+type DeliveryServiceNullableV14 struct {
 	DeliveryServiceNullableV13
 	ConsistentHashRegex       *string  `json:"consistentHashRegex"`
 	ConsistentHashQueryParams []string `json:"consistentHashQueryParams"`

traffic_ops/app/db/migrations/20191215000000_add_ecs_enabled.sql

@@ -0,0 +1,22 @@
+/*
+
+    Licensed under the Apache License, Version 2.0 (the "License");
+    you may not use this file except in compliance with the License.
+    You may obtain a copy of the License at
+
+        http://www.apache.org/licenses/LICENSE-2.0
+
+    Unless required by applicable law or agreed to in writing, software
+    distributed under the License is distributed on an "AS IS" BASIS,
+    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+    See the License for the specific language governing permissions and
+    limitations under the License.
+*/
+
+-- +goose Up
+-- SQL in section 'Up' is executed when this migration is applied
+ALTER TABLE deliveryservice ADD COLUMN ecs_enabled boolean NOT NULL DEFAULT false;
+
+-- +goose Down
+-- SQL section 'Down' is executed when this migration is rolled back
+ALTER TABLE deliveryservice DROP COLUMN ecs_enabled;

traffic_ops/traffic_ops_golang/crconfig/deliveryservice.go

@@ -114,6 +114,7 @@ SELECT d.xml_id,
        d.dns_bypass_cname,
        d.http_bypass_fqdn,
        d.ipv6_routing_enabled,
+       d.ecs_enabled,
        d.deep_caching_type,
        d.tr_request_headers,
        d.tr_response_headers,
@@ -165,6 +166,7 @@ AND d.active = true
 		dnsBypassCName := sql.NullString{}
 		httpBypassFQDN := sql.NullString{}
 		ip6RoutingEnabled := sql.NullBool{}
+		ecsEnabled := sql.NullBool{}
 		deepCachingType := sql.NullString{}
 		trRequestHeaders := sql.NullString{}
 		trResponseHeaders := sql.NullString{}
@@ -193,6 +195,7 @@ AND d.active = true
 			&dnsBypassCName,
 			&httpBypassFQDN,
 			&ip6RoutingEnabled,
+			&ecsEnabled,
 			&deepCachingType,
 			&trRequestHeaders,
 			&trResponseHeaders,
@@ -375,6 +378,7 @@ AND d.active = true
 		}
 
 		ds.IP6RoutingEnabled = &ip6RoutingEnabled.Bool // No Valid check, false if null
+		ds.EcsEnabled = &ecsEnabled.Bool               // No Valid check, false if null
 
 		if trResponseHeaders.Valid && trResponseHeaders.String != "" {
 			trResponseHeaders.String = strings.Replace(trResponseHeaders.String, "__RETURN__", "\n", -1)

traffic_ops/traffic_ops_golang/crconfig/deliveryservice_test.go

@@ -82,6 +82,7 @@ func randDS() tc.CRConfigDeliveryService {
 	ttlNS := "3600"
 	ttlSOA := "86400"
 	geoProviderStr := GeoProviderMaxmindStr
+	ecsEnabled := false
 	return tc.CRConfigDeliveryService{
 		AnonymousBlockingEnabled:  &falseStrPtr,
 		CoverageZoneOnly:          false,
@@ -113,6 +114,7 @@ func randDS() tc.CRConfigDeliveryService {
 			RetrySeconds:   &ttlRetry,
 		},
 		SSLEnabled: false,
+		EcsEnabled: &ecsEnabled,
 		TTL:        ttl,
 		TTLs: &tc.CRConfigTTL{
 			ASeconds:    &ttlStr,
@@ -178,6 +180,7 @@ func MockMakeDSes(mock sqlmock.Sqlmock, expected map[string]tc.CRConfigDeliveryS
 		"dns_bypass_cname",
 		"http_bypass_fqdn",
 		"ipv6_routing_enabled",
+		"ecs_enabled",
 		"deep_caching_type",
 		"tr_request_headers",
 		"tr_response_headers",
@@ -210,6 +213,7 @@ func MockMakeDSes(mock sqlmock.Sqlmock, expected map[string]tc.CRConfigDeliveryS
 			"",
 			*ds.BypassDestination["HTTP"].FQDN,
 			*ds.IP6RoutingEnabled,
+			*ds.EcsEnabled,
 			nil,
 			"",
 			"",