aboutsummaryrefslogtreecommitdiff
path: root/external/unbound/iterator/iter_scrub.c
diff options
context:
space:
mode:
Diffstat (limited to 'external/unbound/iterator/iter_scrub.c')
m---------external/unbound0
-rw-r--r--external/unbound/iterator/iter_scrub.c792
2 files changed, 0 insertions, 792 deletions
diff --git a/external/unbound b/external/unbound
new file mode 160000
+Subproject 193bdc4ee3fe2b0d17e547e86512528c2614483
diff --git a/external/unbound/iterator/iter_scrub.c b/external/unbound/iterator/iter_scrub.c
deleted file mode 100644
index 1bee85c0b..000000000
--- a/external/unbound/iterator/iter_scrub.c
+++ /dev/null
@@ -1,792 +0,0 @@
-/*
- * iterator/iter_scrub.c - scrubbing, normalization, sanitization of DNS msgs.
- *
- * Copyright (c) 2007, NLnet Labs. All rights reserved.
- *
- * This software is open source.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * Redistributions of source code must retain the above copyright notice,
- * this list of conditions and the following disclaimer.
- *
- * Redistributions in binary form must reproduce the above copyright notice,
- * this list of conditions and the following disclaimer in the documentation
- * and/or other materials provided with the distribution.
- *
- * Neither the name of the NLNET LABS nor the names of its contributors may
- * be used to endorse or promote products derived from this software without
- * specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
- * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
- * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
- * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
- * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-/**
- * \file
- *
- * This file has routine(s) for cleaning up incoming DNS messages from
- * possible useless or malicious junk in it.
- */
-#include "config.h"
-#include "iterator/iter_scrub.h"
-#include "iterator/iterator.h"
-#include "iterator/iter_priv.h"
-#include "services/cache/rrset.h"
-#include "util/log.h"
-#include "util/net_help.h"
-#include "util/regional.h"
-#include "util/config_file.h"
-#include "util/module.h"
-#include "util/data/msgparse.h"
-#include "util/data/dname.h"
-#include "util/data/msgreply.h"
-#include "util/alloc.h"
-#include "sldns/sbuffer.h"
-
-/** RRset flag used during scrubbing. The RRset is OK. */
-#define RRSET_SCRUB_OK 0x80
-
-/** remove rrset, update loop variables */
-static void
-remove_rrset(const char* str, sldns_buffer* pkt, struct msg_parse* msg,
- struct rrset_parse* prev, struct rrset_parse** rrset)
-{
- if(verbosity >= VERB_QUERY && str
- && (*rrset)->dname_len <= LDNS_MAX_DOMAINLEN) {
- uint8_t buf[LDNS_MAX_DOMAINLEN+1];
- dname_pkt_copy(pkt, buf, (*rrset)->dname);
- log_nametypeclass(VERB_QUERY, str, buf,
- (*rrset)->type, ntohs((*rrset)->rrset_class));
- }
- if(prev)
- prev->rrset_all_next = (*rrset)->rrset_all_next;
- else msg->rrset_first = (*rrset)->rrset_all_next;
- if(msg->rrset_last == *rrset)
- msg->rrset_last = prev;
- msg->rrset_count --;
- switch((*rrset)->section) {
- case LDNS_SECTION_ANSWER: msg->an_rrsets--; break;
- case LDNS_SECTION_AUTHORITY: msg->ns_rrsets--; break;
- case LDNS_SECTION_ADDITIONAL: msg->ar_rrsets--; break;
- default: log_assert(0);
- }
- msgparse_bucket_remove(msg, *rrset);
- *rrset = (*rrset)->rrset_all_next;
-}
-
-/** return true if rr type has additional names in it */
-static int
-has_additional(uint16_t t)
-{
- switch(t) {
- case LDNS_RR_TYPE_MB:
- case LDNS_RR_TYPE_MD:
- case LDNS_RR_TYPE_MF:
- case LDNS_RR_TYPE_NS:
- case LDNS_RR_TYPE_MX:
- case LDNS_RR_TYPE_KX:
- case LDNS_RR_TYPE_SRV:
- return 1;
- case LDNS_RR_TYPE_NAPTR:
- /* TODO: NAPTR not supported, glue stripped off */
- return 0;
- }
- return 0;
-}
-
-/** get additional name from rrset RR, return false if no name present */
-static int
-get_additional_name(struct rrset_parse* rrset, struct rr_parse* rr,
- uint8_t** nm, size_t* nmlen, sldns_buffer* pkt)
-{
- size_t offset = 0;
- size_t len, oldpos;
- switch(rrset->type) {
- case LDNS_RR_TYPE_MB:
- case LDNS_RR_TYPE_MD:
- case LDNS_RR_TYPE_MF:
- case LDNS_RR_TYPE_NS:
- offset = 0;
- break;
- case LDNS_RR_TYPE_MX:
- case LDNS_RR_TYPE_KX:
- offset = 2;
- break;
- case LDNS_RR_TYPE_SRV:
- offset = 6;
- break;
- case LDNS_RR_TYPE_NAPTR:
- /* TODO: NAPTR not supported, glue stripped off */
- return 0;
- default:
- return 0;
- }
- len = sldns_read_uint16(rr->ttl_data+sizeof(uint32_t));
- if(len < offset+1)
- return 0; /* rdata field too small */
- *nm = rr->ttl_data+sizeof(uint32_t)+sizeof(uint16_t)+offset;
- oldpos = sldns_buffer_position(pkt);
- sldns_buffer_set_position(pkt, (size_t)(*nm - sldns_buffer_begin(pkt)));
- *nmlen = pkt_dname_len(pkt);
- sldns_buffer_set_position(pkt, oldpos);
- if(*nmlen == 0)
- return 0;
- return 1;
-}
-
-/** Place mark on rrsets in additional section they are OK */
-static void
-mark_additional_rrset(sldns_buffer* pkt, struct msg_parse* msg,
- struct rrset_parse* rrset)
-{
- /* Mark A and AAAA for NS as appropriate additional section info. */
- uint8_t* nm = NULL;
- size_t nmlen = 0;
- struct rr_parse* rr;
-
- if(!has_additional(rrset->type))
- return;
- for(rr = rrset->rr_first; rr; rr = rr->next) {
- if(get_additional_name(rrset, rr, &nm, &nmlen, pkt)) {
- /* mark A */
- hashvalue_type h = pkt_hash_rrset(pkt, nm,
- LDNS_RR_TYPE_A, rrset->rrset_class, 0);
- struct rrset_parse* r = msgparse_hashtable_lookup(
- msg, pkt, h, 0, nm, nmlen,
- LDNS_RR_TYPE_A, rrset->rrset_class);
- if(r && r->section == LDNS_SECTION_ADDITIONAL) {
- r->flags |= RRSET_SCRUB_OK;
- }
-
- /* mark AAAA */
- h = pkt_hash_rrset(pkt, nm, LDNS_RR_TYPE_AAAA,
- rrset->rrset_class, 0);
- r = msgparse_hashtable_lookup(msg, pkt, h, 0, nm,
- nmlen, LDNS_RR_TYPE_AAAA, rrset->rrset_class);
- if(r && r->section == LDNS_SECTION_ADDITIONAL) {
- r->flags |= RRSET_SCRUB_OK;
- }
- }
- }
-}
-
-/** Get target name of a CNAME */
-static int
-parse_get_cname_target(struct rrset_parse* rrset, uint8_t** sname,
- size_t* snamelen)
-{
- if(rrset->rr_count != 1) {
- struct rr_parse* sig;
- verbose(VERB_ALGO, "Found CNAME rrset with "
- "size > 1: %u", (unsigned)rrset->rr_count);
- /* use the first CNAME! */
- rrset->rr_count = 1;
- rrset->size = rrset->rr_first->size;
- for(sig=rrset->rrsig_first; sig; sig=sig->next)
- rrset->size += sig->size;
- rrset->rr_last = rrset->rr_first;
- rrset->rr_first->next = NULL;
- }
- if(rrset->rr_first->size < sizeof(uint16_t)+1)
- return 0; /* CNAME rdata too small */
- *sname = rrset->rr_first->ttl_data + sizeof(uint32_t)
- + sizeof(uint16_t); /* skip ttl, rdatalen */
- *snamelen = rrset->rr_first->size - sizeof(uint16_t);
- return 1;
-}
-
-/** Synthesize CNAME from DNAME, false if too long */
-static int
-synth_cname(uint8_t* qname, size_t qnamelen, struct rrset_parse* dname_rrset,
- uint8_t* alias, size_t* aliaslen, sldns_buffer* pkt)
-{
- /* we already know that sname is a strict subdomain of DNAME owner */
- uint8_t* dtarg = NULL;
- size_t dtarglen;
- if(!parse_get_cname_target(dname_rrset, &dtarg, &dtarglen))
- return 0;
- log_assert(qnamelen > dname_rrset->dname_len);
- /* DNAME from com. to net. with qname example.com. -> example.net. */
- /* so: \3com\0 to \3net\0 and qname \7example\3com\0 */
- *aliaslen = qnamelen + dtarglen - dname_rrset->dname_len;
- if(*aliaslen > LDNS_MAX_DOMAINLEN)
- return 0; /* should have been RCODE YXDOMAIN */
- /* decompress dnames into buffer, we know it fits */
- dname_pkt_copy(pkt, alias, qname);
- dname_pkt_copy(pkt, alias+(qnamelen-dname_rrset->dname_len), dtarg);
- return 1;
-}
-
-/** synthesize a CNAME rrset */
-static struct rrset_parse*
-synth_cname_rrset(uint8_t** sname, size_t* snamelen, uint8_t* alias,
- size_t aliaslen, struct regional* region, struct msg_parse* msg,
- struct rrset_parse* rrset, struct rrset_parse* prev,
- struct rrset_parse* nx, sldns_buffer* pkt)
-{
- struct rrset_parse* cn = (struct rrset_parse*)regional_alloc(region,
- sizeof(struct rrset_parse));
- if(!cn)
- return NULL;
- memset(cn, 0, sizeof(*cn));
- cn->rr_first = (struct rr_parse*)regional_alloc(region,
- sizeof(struct rr_parse));
- if(!cn->rr_first)
- return NULL;
- cn->rr_last = cn->rr_first;
- /* CNAME from sname to alias */
- cn->dname = (uint8_t*)regional_alloc(region, *snamelen);
- if(!cn->dname)
- return NULL;
- dname_pkt_copy(pkt, cn->dname, *sname);
- cn->dname_len = *snamelen;
- cn->type = LDNS_RR_TYPE_CNAME;
- cn->section = rrset->section;
- cn->rrset_class = rrset->rrset_class;
- cn->rr_count = 1;
- cn->size = sizeof(uint16_t) + aliaslen;
- cn->hash=pkt_hash_rrset(pkt, cn->dname, cn->type, cn->rrset_class, 0);
- /* allocate TTL + rdatalen + uncompressed dname */
- memset(cn->rr_first, 0, sizeof(struct rr_parse));
- cn->rr_first->outside_packet = 1;
- cn->rr_first->ttl_data = (uint8_t*)regional_alloc(region,
- sizeof(uint32_t)+sizeof(uint16_t)+aliaslen);
- if(!cn->rr_first->ttl_data)
- return NULL;
- sldns_write_uint32(cn->rr_first->ttl_data, 0); /* TTL = 0 */
- sldns_write_uint16(cn->rr_first->ttl_data+4, aliaslen);
- memmove(cn->rr_first->ttl_data+6, alias, aliaslen);
- cn->rr_first->size = sizeof(uint16_t)+aliaslen;
-
- /* link it in */
- cn->rrset_all_next = nx;
- if(prev)
- prev->rrset_all_next = cn;
- else msg->rrset_first = cn;
- if(nx == NULL)
- msg->rrset_last = cn;
- msg->rrset_count ++;
- msg->an_rrsets++;
- /* it is not inserted in the msg hashtable. */
-
- *sname = cn->rr_first->ttl_data + sizeof(uint32_t)+sizeof(uint16_t);
- *snamelen = aliaslen;
- return cn;
-}
-
-/** check if DNAME applies to a name */
-static int
-pkt_strict_sub(sldns_buffer* pkt, uint8_t* sname, uint8_t* dr)
-{
- uint8_t buf1[LDNS_MAX_DOMAINLEN+1];
- uint8_t buf2[LDNS_MAX_DOMAINLEN+1];
- /* decompress names */
- dname_pkt_copy(pkt, buf1, sname);
- dname_pkt_copy(pkt, buf2, dr);
- return dname_strict_subdomain_c(buf1, buf2);
-}
-
-/** check subdomain with decompression */
-static int
-pkt_sub(sldns_buffer* pkt, uint8_t* comprname, uint8_t* zone)
-{
- uint8_t buf[LDNS_MAX_DOMAINLEN+1];
- dname_pkt_copy(pkt, buf, comprname);
- return dname_subdomain_c(buf, zone);
-}
-
-/** check subdomain with decompression, compressed is parent */
-static int
-sub_of_pkt(sldns_buffer* pkt, uint8_t* zone, uint8_t* comprname)
-{
- uint8_t buf[LDNS_MAX_DOMAINLEN+1];
- dname_pkt_copy(pkt, buf, comprname);
- return dname_subdomain_c(zone, buf);
-}
-
-/**
- * This routine normalizes a response. This includes removing "irrelevant"
- * records from the answer and additional sections and (re)synthesizing
- * CNAMEs from DNAMEs, if present.
- *
- * @param pkt: packet.
- * @param msg: msg to normalize.
- * @param qinfo: original query.
- * @param region: where to allocate synthesized CNAMEs.
- * @return 0 on error.
- */
-static int
-scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
- struct query_info* qinfo, struct regional* region)
-{
- uint8_t* sname = qinfo->qname;
- size_t snamelen = qinfo->qname_len;
- struct rrset_parse* rrset, *prev, *nsset=NULL;
-
- if(FLAGS_GET_RCODE(msg->flags) != LDNS_RCODE_NOERROR &&
- FLAGS_GET_RCODE(msg->flags) != LDNS_RCODE_NXDOMAIN)
- return 1;
-
- /* For the ANSWER section, remove all "irrelevant" records and add
- * synthesized CNAMEs from DNAMEs
- * This will strip out-of-order CNAMEs as well. */
-
- /* walk through the parse packet rrset list, keep track of previous
- * for insert and delete ease, and examine every RRset */
- prev = NULL;
- rrset = msg->rrset_first;
- while(rrset && rrset->section == LDNS_SECTION_ANSWER) {
- if(rrset->type == LDNS_RR_TYPE_DNAME &&
- pkt_strict_sub(pkt, sname, rrset->dname)) {
- /* check if next rrset is correct CNAME. else,
- * synthesize a CNAME */
- struct rrset_parse* nx = rrset->rrset_all_next;
- uint8_t alias[LDNS_MAX_DOMAINLEN+1];
- size_t aliaslen = 0;
- if(rrset->rr_count != 1) {
- verbose(VERB_ALGO, "Found DNAME rrset with "
- "size > 1: %u",
- (unsigned)rrset->rr_count);
- return 0;
- }
- if(!synth_cname(sname, snamelen, rrset, alias,
- &aliaslen, pkt)) {
- verbose(VERB_ALGO, "synthesized CNAME "
- "too long");
- return 0;
- }
- if(nx && nx->type == LDNS_RR_TYPE_CNAME &&
- dname_pkt_compare(pkt, sname, nx->dname) == 0) {
- /* check next cname */
- uint8_t* t = NULL;
- size_t tlen = 0;
- if(!parse_get_cname_target(nx, &t, &tlen))
- return 0;
- if(dname_pkt_compare(pkt, alias, t) == 0) {
- /* it's OK and better capitalized */
- prev = rrset;
- rrset = nx;
- continue;
- }
- /* synth ourselves */
- }
- /* synth a CNAME rrset */
- prev = synth_cname_rrset(&sname, &snamelen, alias,
- aliaslen, region, msg, rrset, rrset, nx, pkt);
- if(!prev) {
- log_err("out of memory synthesizing CNAME");
- return 0;
- }
- /* FIXME: resolve the conflict between synthesized
- * CNAME ttls and the cache. */
- rrset = nx;
- continue;
-
- }
-
- /* The only records in the ANSWER section not allowed to */
- if(dname_pkt_compare(pkt, sname, rrset->dname) != 0) {
- remove_rrset("normalize: removing irrelevant RRset:",
- pkt, msg, prev, &rrset);
- continue;
- }
-
- /* Follow the CNAME chain. */
- if(rrset->type == LDNS_RR_TYPE_CNAME) {
- struct rrset_parse* nx = rrset->rrset_all_next;
- uint8_t* oldsname = sname;
- /* see if the next one is a DNAME, if so, swap them */
- if(nx && nx->section == LDNS_SECTION_ANSWER &&
- nx->type == LDNS_RR_TYPE_DNAME &&
- nx->rr_count == 1 &&
- pkt_strict_sub(pkt, sname, nx->dname)) {
- /* there is a DNAME after this CNAME, it
- * is in the ANSWER section, and the DNAME
- * applies to the name we cover */
- /* check if the alias of the DNAME equals
- * this CNAME */
- uint8_t alias[LDNS_MAX_DOMAINLEN+1];
- size_t aliaslen = 0;
- uint8_t* t = NULL;
- size_t tlen = 0;
- if(synth_cname(sname, snamelen, nx, alias,
- &aliaslen, pkt) &&
- parse_get_cname_target(rrset, &t, &tlen) &&
- dname_pkt_compare(pkt, alias, t) == 0) {
- /* the synthesized CNAME equals the
- * current CNAME. This CNAME is the
- * one that the DNAME creates, and this
- * CNAME is better capitalised */
- verbose(VERB_ALGO, "normalize: re-order of DNAME and its CNAME");
- if(prev) prev->rrset_all_next = nx;
- else msg->rrset_first = nx;
- if(nx->rrset_all_next == NULL)
- msg->rrset_last = rrset;
- rrset->rrset_all_next =
- nx->rrset_all_next;
- nx->rrset_all_next = rrset;
- prev = nx;
- }
- }
-
- /* move to next name in CNAME chain */
- if(!parse_get_cname_target(rrset, &sname, &snamelen))
- return 0;
- prev = rrset;
- rrset = rrset->rrset_all_next;
- /* in CNAME ANY response, can have data after CNAME */
- if(qinfo->qtype == LDNS_RR_TYPE_ANY) {
- while(rrset && rrset->section ==
- LDNS_SECTION_ANSWER &&
- dname_pkt_compare(pkt, oldsname,
- rrset->dname) == 0) {
- prev = rrset;
- rrset = rrset->rrset_all_next;
- }
- }
- continue;
- }
-
- /* Otherwise, make sure that the RRset matches the qtype. */
- if(qinfo->qtype != LDNS_RR_TYPE_ANY &&
- qinfo->qtype != rrset->type) {
- remove_rrset("normalize: removing irrelevant RRset:",
- pkt, msg, prev, &rrset);
- continue;
- }
-
- /* Mark the additional names from relevant rrset as OK. */
- /* only for RRsets that match the query name, other ones
- * will be removed by sanitize, so no additional for them */
- if(dname_pkt_compare(pkt, qinfo->qname, rrset->dname) == 0)
- mark_additional_rrset(pkt, msg, rrset);
-
- prev = rrset;
- rrset = rrset->rrset_all_next;
- }
-
- /* Mark additional names from AUTHORITY */
- while(rrset && rrset->section == LDNS_SECTION_AUTHORITY) {
- if(rrset->type==LDNS_RR_TYPE_DNAME ||
- rrset->type==LDNS_RR_TYPE_CNAME ||
- rrset->type==LDNS_RR_TYPE_A ||
- rrset->type==LDNS_RR_TYPE_AAAA) {
- remove_rrset("normalize: removing irrelevant "
- "RRset:", pkt, msg, prev, &rrset);
- continue;
- }
- /* only one NS set allowed in authority section */
- if(rrset->type==LDNS_RR_TYPE_NS) {
- /* NS set must be pertinent to the query */
- if(!sub_of_pkt(pkt, qinfo->qname, rrset->dname)) {
- remove_rrset("normalize: removing irrelevant "
- "RRset:", pkt, msg, prev, &rrset);
- continue;
- }
- if(nsset == NULL) {
- nsset = rrset;
- } else {
- remove_rrset("normalize: removing irrelevant "
- "RRset:", pkt, msg, prev, &rrset);
- continue;
- }
- }
- mark_additional_rrset(pkt, msg, rrset);
- prev = rrset;
- rrset = rrset->rrset_all_next;
- }
-
- /* For each record in the additional section, remove it if it is an
- * address record and not in the collection of additional names
- * found in ANSWER and AUTHORITY. */
- /* These records have not been marked OK previously */
- while(rrset && rrset->section == LDNS_SECTION_ADDITIONAL) {
- /* FIXME: what about other types? */
- if(rrset->type==LDNS_RR_TYPE_A ||
- rrset->type==LDNS_RR_TYPE_AAAA)
- {
- if((rrset->flags & RRSET_SCRUB_OK)) {
- /* remove flag to clean up flags variable */
- rrset->flags &= ~RRSET_SCRUB_OK;
- } else {
- remove_rrset("normalize: removing irrelevant "
- "RRset:", pkt, msg, prev, &rrset);
- continue;
- }
- }
- if(rrset->type==LDNS_RR_TYPE_DNAME ||
- rrset->type==LDNS_RR_TYPE_CNAME ||
- rrset->type==LDNS_RR_TYPE_NS) {
- remove_rrset("normalize: removing irrelevant "
- "RRset:", pkt, msg, prev, &rrset);
- continue;
- }
- prev = rrset;
- rrset = rrset->rrset_all_next;
- }
-
- return 1;
-}
-
-/**
- * Store potential poison in the cache (only if hardening disabled).
- * The rrset is stored in the cache but removed from the message.
- * So that it will be used for infrastructure purposes, but not be
- * returned to the client.
- * @param pkt: packet
- * @param msg: message parsed
- * @param env: environment with cache
- * @param rrset: to store.
- */
-static void
-store_rrset(sldns_buffer* pkt, struct msg_parse* msg, struct module_env* env,
- struct rrset_parse* rrset)
-{
- struct ub_packed_rrset_key* k;
- struct packed_rrset_data* d;
- struct rrset_ref ref;
- time_t now = *env->now;
-
- k = alloc_special_obtain(env->alloc);
- if(!k)
- return;
- k->entry.data = NULL;
- if(!parse_copy_decompress_rrset(pkt, msg, rrset, NULL, k)) {
- alloc_special_release(env->alloc, k);
- return;
- }
- d = (struct packed_rrset_data*)k->entry.data;
- packed_rrset_ttl_add(d, now);
- ref.key = k;
- ref.id = k->id;
- /*ignore ret: it was in the cache, ref updated */
- (void)rrset_cache_update(env->rrset_cache, &ref, env->alloc, now);
-}
-
-/** Check if there are SOA records in the authority section (negative) */
-static int
-soa_in_auth(struct msg_parse* msg)
-{
- struct rrset_parse* rrset;
- for(rrset = msg->rrset_first; rrset; rrset = rrset->rrset_all_next)
- if(rrset->type == LDNS_RR_TYPE_SOA &&
- rrset->section == LDNS_SECTION_AUTHORITY)
- return 1;
- return 0;
-}
-
-/**
- * Check if right hand name in NSEC is within zone
- * @param rrset: the NSEC rrset
- * @param zonename: the zone name.
- * @return true if BAD.
- */
-static int sanitize_nsec_is_overreach(struct rrset_parse* rrset,
- uint8_t* zonename)
-{
- struct rr_parse* rr;
- uint8_t* rhs;
- size_t len;
- log_assert(rrset->type == LDNS_RR_TYPE_NSEC);
- for(rr = rrset->rr_first; rr; rr = rr->next) {
- rhs = rr->ttl_data+4+2;
- len = sldns_read_uint16(rr->ttl_data+4);
- if(!dname_valid(rhs, len)) {
- /* malformed domain name in rdata */
- return 1;
- }
- if(!dname_subdomain_c(rhs, zonename)) {
- /* overreaching */
- return 1;
- }
- }
- /* all NSEC RRs OK */
- return 0;
-}
-
-/**
- * Given a response event, remove suspect RRsets from the response.
- * "Suspect" rrsets are potentially poison. Note that this routine expects
- * the response to be in a "normalized" state -- that is, all "irrelevant"
- * RRsets have already been removed, CNAMEs are in order, etc.
- *
- * @param pkt: packet.
- * @param msg: msg to normalize.
- * @param qinfo: the question originally asked.
- * @param zonename: name of server zone.
- * @param env: module environment with config and cache.
- * @param ie: iterator environment with private address data.
- * @return 0 on error.
- */
-static int
-scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg,
- struct query_info* qinfo, uint8_t* zonename, struct module_env* env,
- struct iter_env* ie)
-{
- int del_addi = 0; /* if additional-holding rrsets are deleted, we
- do not trust the normalized additional-A-AAAA any more */
- struct rrset_parse* rrset, *prev;
- prev = NULL;
- rrset = msg->rrset_first;
-
- /* the first DNAME is allowed to stay. It needs checking before
- * it can be used from the cache. After normalization, an initial
- * DNAME will have a correctly synthesized CNAME after it. */
- if(rrset && rrset->type == LDNS_RR_TYPE_DNAME &&
- rrset->section == LDNS_SECTION_ANSWER &&
- pkt_strict_sub(pkt, qinfo->qname, rrset->dname) &&
- pkt_sub(pkt, rrset->dname, zonename)) {
- prev = rrset; /* DNAME allowed to stay in answer section */
- rrset = rrset->rrset_all_next;
- }
-
- /* remove all records from the answer section that are
- * not the same domain name as the query domain name.
- * The answer section should contain rrsets with the same name
- * as the question. For DNAMEs a CNAME has been synthesized.
- * Wildcards have the query name in answer section.
- * ANY queries get query name in answer section.
- * Remainders of CNAME chains are cut off and resolved by iterator. */
- while(rrset && rrset->section == LDNS_SECTION_ANSWER) {
- if(dname_pkt_compare(pkt, qinfo->qname, rrset->dname) != 0) {
- if(has_additional(rrset->type)) del_addi = 1;
- remove_rrset("sanitize: removing extraneous answer "
- "RRset:", pkt, msg, prev, &rrset);
- continue;
- }
- prev = rrset;
- rrset = rrset->rrset_all_next;
- }
-
- /* At this point, we brutally remove ALL rrsets that aren't
- * children of the originating zone. The idea here is that,
- * as far as we know, the server that we contacted is ONLY
- * authoritative for the originating zone. It, of course, MAY
- * be authoritative for any other zones, and of course, MAY
- * NOT be authoritative for some subdomains of the originating
- * zone. */
- prev = NULL;
- rrset = msg->rrset_first;
- while(rrset) {
-
- /* remove private addresses */
- if( (rrset->type == LDNS_RR_TYPE_A ||
- rrset->type == LDNS_RR_TYPE_AAAA)) {
-
- /* do not set servfail since this leads to too
- * many drops of other people using rfc1918 space */
- /* also do not remove entire rrset, unless all records
- * in it are bad */
- if(priv_rrset_bad(ie->priv, pkt, rrset)) {
- remove_rrset(NULL, pkt, msg, prev, &rrset);
- continue;
- }
- }
-
- /* skip DNAME records -- they will always be followed by a
- * synthesized CNAME, which will be relevant.
- * FIXME: should this do something differently with DNAME
- * rrsets NOT in Section.ANSWER? */
- /* But since DNAME records are also subdomains of the zone,
- * same check can be used */
-
- if(!pkt_sub(pkt, rrset->dname, zonename)) {
- if(msg->an_rrsets == 0 &&
- rrset->type == LDNS_RR_TYPE_NS &&
- rrset->section == LDNS_SECTION_AUTHORITY &&
- FLAGS_GET_RCODE(msg->flags) ==
- LDNS_RCODE_NOERROR && !soa_in_auth(msg) &&
- sub_of_pkt(pkt, zonename, rrset->dname)) {
- /* noerror, nodata and this NS rrset is above
- * the zone. This is LAME!
- * Leave in the NS for lame classification. */
- /* remove everything from the additional
- * (we dont want its glue that was approved
- * during the normalize action) */
- del_addi = 1;
- } else if(!env->cfg->harden_glue && (
- rrset->type == LDNS_RR_TYPE_A ||
- rrset->type == LDNS_RR_TYPE_AAAA)) {
- /* store in cache! Since it is relevant
- * (from normalize) it will be picked up
- * from the cache to be used later */
- store_rrset(pkt, msg, env, rrset);
- remove_rrset("sanitize: storing potential "
- "poison RRset:", pkt, msg, prev, &rrset);
- continue;
- } else {
- if(has_additional(rrset->type)) del_addi = 1;
- remove_rrset("sanitize: removing potential "
- "poison RRset:", pkt, msg, prev, &rrset);
- continue;
- }
- }
- if(del_addi && rrset->section == LDNS_SECTION_ADDITIONAL) {
- remove_rrset("sanitize: removing potential "
- "poison reference RRset:", pkt, msg, prev, &rrset);
- continue;
- }
- /* check if right hand side of NSEC is within zone */
- if(rrset->type == LDNS_RR_TYPE_NSEC &&
- sanitize_nsec_is_overreach(rrset, zonename)) {
- remove_rrset("sanitize: removing overreaching NSEC "
- "RRset:", pkt, msg, prev, &rrset);
- continue;
- }
- prev = rrset;
- rrset = rrset->rrset_all_next;
- }
- return 1;
-}
-
-int
-scrub_message(sldns_buffer* pkt, struct msg_parse* msg,
- struct query_info* qinfo, uint8_t* zonename, struct regional* region,
- struct module_env* env, struct iter_env* ie)
-{
- /* basic sanity checks */
- log_nametypeclass(VERB_ALGO, "scrub for", zonename, LDNS_RR_TYPE_NS,
- qinfo->qclass);
- if(msg->qdcount > 1)
- return 0;
- if( !(msg->flags&BIT_QR) )
- return 0;
- msg->flags &= ~(BIT_AD|BIT_Z); /* force off bit AD and Z */
-
- /* make sure that a query is echoed back when NOERROR or NXDOMAIN */
- /* this is not required for basic operation but is a forgery
- * resistance (security) feature */
- if((FLAGS_GET_RCODE(msg->flags) == LDNS_RCODE_NOERROR ||
- FLAGS_GET_RCODE(msg->flags) == LDNS_RCODE_NXDOMAIN) &&
- msg->qdcount == 0)
- return 0;
-
- /* if a query is echoed back, make sure it is correct. Otherwise,
- * this may be not a reply to our query. */
- if(msg->qdcount == 1) {
- if(dname_pkt_compare(pkt, msg->qname, qinfo->qname) != 0)
- return 0;
- if(msg->qtype != qinfo->qtype || msg->qclass != qinfo->qclass)
- return 0;
- }
-
- /* normalize the response, this cleans up the additional. */
- if(!scrub_normalize(pkt, msg, qinfo, region))
- return 0;
- /* delete all out-of-zone information */
- if(!scrub_sanitize(pkt, msg, qinfo, zonename, env, ie))
- return 0;
- return 1;
-}
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-25 20:09:55 +0000