contrib/aaaa-filter-iterator.patch

   1 --- unbound-1.4.17.orig/doc/unbound.conf.5.in
   2 +++ unbound-1.4.17/doc/unbound.conf.5.in
   3 @@ -519,6 +519,13 @@ authority servers and checks if the repl
   4  Disabled by default.
   5  This feature is an experimental implementation of draft dns\-0x20.
   6  .TP
   7 +.B aaaa\-filter: \fI<yes or no>
   8 +Activate behavior similar to BIND's AAAA-filter.
   9 +This forces the dropping of all AAAA records, unless in the case of
  10 +explicit AAAA queries, when no A records have been confirmed.
  11 +This also causes an additional A query to be sent for each AAAA query.
  12 +This breaks DNSSEC!
  13 +.TP
  14  .B private\-address: \fI<IP address or subnet>
  15  Give IPv4 of IPv6 addresses or classless subnets. These are addresses
  16  on your private network, and are not allowed to be returned for public
  17 --- unbound-1.4.17.orig/util/config_file.c
  18 +++ unbound-1.4.17/util/config_file.c
  19 @@ -160,6 +160,7 @@ config_create(void)
  20         cfg->harden_below_nxdomain = 0;
  21         cfg->harden_referral_path = 0;
  22         cfg->use_caps_bits_for_id = 0;
  23 +       cfg->aaaa_filter = 0; /* ASN: default is disabled */
  24         cfg->private_address = NULL;
  25         cfg->private_domain = NULL;
  26         cfg->unwanted_threshold = 0;
  27 --- unbound-1.4.17.orig/iterator/iter_scrub.c
  28 +++ unbound-1.4.17/iterator/iter_scrub.c
  29 @@ -580,6 +580,32 @@ static int sanitize_nsec_is_overreach(st
  30  }
  31
  32  /**
  33 + * ASN: Lookup A records from rrset cache.
  34 + * @param qinfo: the question originally asked.
  35 + * @param env: module environment with config and cache.
  36 + * @param ie: iterator environment with private address data.
  37 + * @return 0 if no A record found, 1 if A record found.
  38 + */
  39 +static int
  40 +asn_lookup_a_record_from_cache(struct query_info* qinfo,
  41 +       struct module_env* env, struct iter_env* ie)
  42 +{
  43 +       struct ub_packed_rrset_key* akey;
  44 +
  45 +       /* get cached A records for queried name */
  46 +       akey = rrset_cache_lookup(env->rrset_cache, qinfo->qname,
  47 +               qinfo->qname_len, LDNS_RR_TYPE_A, qinfo->qclass,
  48 +               0, *env->now, 0);
  49 +       if(akey) { /* we had some. */
  50 +               log_rrset_key(VERB_ALGO, "ASN-AAAA-filter: found A record",
  51 +                             akey);
  52 +               lock_rw_unlock(&akey->entry.lock);
  53 +               return 1;
  54 +       }
  55 +       return 0;
  56 +}
  57 +
  58 +/**
  59   * Given a response event, remove suspect RRsets from the response.
  60   * "Suspect" rrsets are potentially poison. Note that this routine expects
  61   * the response to be in a "normalized" state -- that is, all "irrelevant"
  62 @@ -598,6 +625,7 @@ scrub_sanitize(ldns_buffer* pkt, struct
  63         struct query_info* qinfo, uint8_t* zonename, struct module_env* env,
  64         struct iter_env* ie)
  65  {
  66 +       int found_a_record = 0; /* ASN: do we have a A record? */
  67         int del_addi = 0; /* if additional-holding rrsets are deleted, we
  68                 do not trust the normalized additional-A-AAAA any more */
  69         struct rrset_parse* rrset, *prev;
  70 @@ -633,6 +661,13 @@ scrub_sanitize(ldns_buffer* pkt, struct
  71                 rrset = rrset->rrset_all_next;
  72         }
  73
  74 +       /* ASN: Locate any A record we can find */
  75 +       if((ie->aaaa_filter) && (qinfo->qtype == LDNS_RR_TYPE_AAAA)) {
  76 +               found_a_record = asn_lookup_a_record_from_cache(qinfo,
  77 +                       env, ie);
  78 +       }
  79 +       /* ASN: End of added code */
  80 +
  81         /* At this point, we brutally remove ALL rrsets that aren't
  82          * children of the originating zone. The idea here is that,
  83          * as far as we know, the server that we contacted is ONLY
  84 @@ -644,6 +679,24 @@ scrub_sanitize(ldns_buffer* pkt, struct
  85         rrset = msg->rrset_first;
  86         while(rrset) {
  87
  88 +               /* ASN: For AAAA records only... */
  89 +               if((ie->aaaa_filter) && (rrset->type == LDNS_RR_TYPE_AAAA)) {
  90 +                       /* ASN: If this is not a AAAA query, then remove AAAA
  91 +                        * records, no questions asked. If this IS a AAAA query
  92 +                        * then remove AAAA records if we have an A record.
  93 +                        * Otherwise, leave things be. */
  94 +                       if((qinfo->qtype != LDNS_RR_TYPE_AAAA) ||
  95 +                               (found_a_record)) {
  96 +                               remove_rrset("ASN-AAAA-filter: removing AAAA "
  97 +                                       "for record", pkt, msg, prev, &rrset);
  98 +                               continue;
  99 +                       }
 100 +                       log_nametypeclass(VERB_ALGO, "ASN-AAAA-filter: "
 101 +                               "keep AAAA for", zonename,
 102 +                               LDNS_RR_TYPE_AAAA, qinfo->qclass);
 103 +               }
 104 +               /* ASN: End of added code */
 105 +
 106                 /* remove private addresses */
 107                 if( (rrset->type == LDNS_RR_TYPE_A ||
 108                         rrset->type == LDNS_RR_TYPE_AAAA) &&
 109 --- unbound-1.4.17.orig/iterator/iterator.c
 110 +++ unbound-1.4.17/iterator/iterator.c
 111 @@ -1579,6 +1579,53 @@ processDSNSFind(struct module_qstate* qs
 112
 113         return 0;
 114  }
 115 +
 116 +/**
 117 + * ASN: This event state was added as an intermediary step between
 118 + * QUERYTARGETS_STATE and the next step, in order to cast a subquery for the
 119 + * purpose of caching A records for the queried name.
 120 + *
 121 + * @param qstate: query state.
 122 + * @param iq: iterator query state.
 123 + * @param ie: iterator shared global environment.
 124 + * @param id: module id.
 125 + * @return true if the event requires more request processing immediately,
 126 + *         false if not. This state only returns true when it is generating
 127 + *         a SERVFAIL response because the query has hit a dead end.
 128 + */
 129 +static int
 130 +asn_processQueryAAAA(struct module_qstate* qstate, struct iter_qstate* iq,
 131 +       struct iter_env* ie, int id)
 132 +{
 133 +       struct module_qstate* subq = NULL;
 134 +
 135 +       log_assert(iq->fetch_a_for_aaaa == 0);
 136 +
 137 +       /* flag the query properly in order to not loop */
 138 +       iq->fetch_a_for_aaaa = 1;
 139 +
 140 +       /* re-throw same query, but with a different type */
 141 +       if(!generate_sub_request(iq->qchase.qname,
 142 +               iq->qchase.qname_len, LDNS_RR_TYPE_A,
 143 +               iq->qchase.qclass, qstate, id, iq,
 144 +               INIT_REQUEST_STATE, FINISHED_STATE, &subq, 1)) {
 145 +               log_nametypeclass(VERB_ALGO, "ASN-AAAA-filter: failed "
 146 +                       "preloading of A record for",
 147 +                       iq->qchase.qname, LDNS_RR_TYPE_A,
 148 +                       iq->qchase.qclass);
 149 +               return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
 150 +       }
 151 +       log_nametypeclass(VERB_ALGO, "ASN-AAAA-filter: "
 152 +               "preloading records in cache for",
 153 +               iq->qchase.qname, LDNS_RR_TYPE_A,
 154 +               iq->qchase.qclass);
 155 +
 156 +       /* set this query as waiting */
 157 +       qstate->ext_state[id] = module_wait_subquery;
 158 +       /* at this point break loop */
 159 +       return 0;
 160 +}
 161 +/* ASN: End of added code */
 162
 163  /**
 164   * This is the request event state where the request will be sent to one of
 165 @@ -1626,6 +1673,13 @@ processQueryTargets(struct module_qstate
 166                 return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
 167         }
 168
 169 +       /* ASN: If we have a AAAA query, then also query for A records */
 170 +       if((ie->aaaa_filter) && (iq->qchase.qtype == LDNS_RR_TYPE_AAAA) &&
 171 +               (iq->fetch_a_for_aaaa == 0)) {
 172 +               return next_state(iq, ASN_FETCH_A_FOR_AAAA_STATE);
 173 +       }
 174 +       /* ASN: End of added code */
 175 +
 176         /* Make sure we have a delegation point, otherwise priming failed
 177          * or another failure occurred */
 178         if(!iq->dp) {
 179 @@ -2568,6 +2622,62 @@ processFinished(struct module_qstate* qs
 180         return 0;
 181  }
 182
 183 +/**
 184 + * ASN: Do final processing on responses to A queries originated from AAAA
 185 + * queries. Events reach this state after the iterative resolution algorithm
 186 + * terminates.
 187 + * This is required down the road to decide whether to scrub AAAA records
 188 + * from the results or not.
 189 + *
 190 + * @param qstate: query state.
 191 + * @param id: module id.
 192 + * @param forq: super query state.
 193 + */
 194 +static void
 195 +asn_processAAAAResponse(struct module_qstate* qstate, int id,
 196 +       struct module_qstate* super)
 197 +{
 198 +       struct iter_qstate* iq = (struct iter_qstate*)qstate->minfo[id];
 199 +       struct iter_qstate* super_iq = (struct iter_qstate*)super->minfo[id];
 200 +       struct ub_packed_rrset_key* rrset;
 201 +       struct delegpt_ns* dpns = NULL;
 202 +       int error = (qstate->return_rcode != LDNS_RCODE_NOERROR);
 203 +
 204 +       log_assert(super_iq->fetch_a_for_aaaa > 0);
 205 +
 206 +       /* let super go to evaluation of targets after this */
 207 +       super_iq->state = QUERYTARGETS_STATE;
 208 +
 209 +       log_query_info(VERB_ALGO, "ASN-AAAA-filter: processAAAAResponse",
 210 +               &qstate->qinfo);
 211 +       log_query_info(VERB_ALGO, "ASN-AAAA-filter: processAAAAResponse super",
 212 +               &super->qinfo);
 213 +
 214 +       if(super_iq->dp)
 215 +               dpns = delegpt_find_ns(super_iq->dp,
 216 +                       qstate->qinfo.qname, qstate->qinfo.qname_len);
 217 +       if (!dpns) {
 218 +               /* not interested */
 219 +               verbose(VERB_ALGO, "ASN-AAAA-filter: subq: %s, but parent not "
 220 +                       "interested%s", (error ? "error, but" : "success"),
 221 +                       (super_iq->dp ? "anymore" : " (was reset)"));
 222 +               log_query_info(VERB_ALGO, "ASN-AAAA-filter: superq", &super->qinfo);
 223 +               if(super_iq->dp && error)
 224 +                       delegpt_log(VERB_ALGO, super_iq->dp);
 225 +               return;
 226 +       } else if (error) {
 227 +               verbose(VERB_ALGO, "ASN-AAAA-filter: mark as failed, "
 228 +                       "and go to target query.");
 229 +               /* see if the failure did get (parent-lame) info */
 230 +               if(!cache_fill_missing(super->env,
 231 +                       super_iq->qchase.qclass, super->region,
 232 +                       super_iq->dp))
 233 +               log_err("ASN-AAAA-filter: out of memory adding missing");
 234 +               dpns->resolved = 1; /* mark as failed */
 235 +       }
 236 +}
 237 +/* ASN: End of added code */
 238 +
 239  /*
 240   * Return priming query results to interestes super querystates.
 241   *
 242 @@ -2587,6 +2697,9 @@ iter_inform_super(struct module_qstate*
 243         else if(super->qinfo.qtype == LDNS_RR_TYPE_DS && ((struct iter_qstate*)
 244                 super->minfo[id])->state == DSNS_FIND_STATE)
 245                 processDSNSResponse(qstate, id, super);
 246 +       else if (super->qinfo.qtype == LDNS_RR_TYPE_AAAA && ((struct iter_qstate*)
 247 +               super->minfo[id])->state == ASN_FETCH_A_FOR_AAAA_STATE)
 248 +               asn_processAAAAResponse(qstate, id, super);
 249         else if(qstate->return_rcode != LDNS_RCODE_NOERROR)
 250                 error_supers(qstate, id, super);
 251         else if(qstate->is_priming)
 252 @@ -2624,6 +2737,9 @@ iter_handle(struct module_qstate* qstate
 253                         case INIT_REQUEST_3_STATE:
 254                                 cont = processInitRequest3(qstate, iq, id);
 255                                 break;
 256 +                       case ASN_FETCH_A_FOR_AAAA_STATE:
 257 +                               cont = asn_processQueryAAAA(qstate, iq, ie, id);
 258 +                               break;
 259                         case QUERYTARGETS_STATE:
 260                                 cont = processQueryTargets(qstate, iq, ie, id);
 261                                 break;
 262 @@ -2863,6 +2979,8 @@ iter_state_to_string(enum iter_state sta
 263                 return "INIT REQUEST STATE (stage 2)";
 264         case INIT_REQUEST_3_STATE:
 265                 return "INIT REQUEST STATE (stage 3)";
 266 +       case ASN_FETCH_A_FOR_AAAA_STATE:
 267 +               return "ASN_FETCH_A_FOR_AAAA_STATE";
 268         case QUERYTARGETS_STATE :
 269                 return "QUERY TARGETS STATE";
 270         case PRIME_RESP_STATE :
 271 @@ -2887,6 +3005,7 @@ iter_state_is_responsestate(enum iter_st
 272                 case INIT_REQUEST_STATE :
 273                 case INIT_REQUEST_2_STATE :
 274                 case INIT_REQUEST_3_STATE :
 275 +               case ASN_FETCH_A_FOR_AAAA_STATE :
 276                 case QUERYTARGETS_STATE :
 277                 case COLLECT_CLASS_STATE :
 278                         return 0;
 279 --- unbound-1.4.17.orig/iterator/iter_utils.c
 280 +++ unbound-1.4.17/iterator/iter_utils.c
 281 @@ -128,6 +128,7 @@ iter_apply_cfg(struct iter_env* iter_env
 282         }
 283         iter_env->supports_ipv6 = cfg->do_ip6;
 284         iter_env->supports_ipv4 = cfg->do_ip4;
 285 +       iter_env->aaaa_filter = cfg->aaaa_filter;
 286         return 1;
 287  }
 288
 289 --- unbound-1.4.17.orig/iterator/iterator.h
 290 +++ unbound-1.4.17/iterator/iterator.h
 291 @@ -110,6 +110,9 @@ struct iter_env {
 292          * array of max_dependency_depth+1 size.
 293          */
 294         int* target_fetch_policy;
 295 +
 296 +       /** ASN: AAAA-filter flag */
 297 +       int aaaa_filter;
 298  };
 299
 300  /**
 301 @@ -135,6 +138,14 @@ enum iter_state {
 302         INIT_REQUEST_3_STATE,
 303
 304         /**
 305 +        * This state is responsible for intercepting AAAA queries,
 306 +        * and launch a A subquery on the same target, to populate the
 307 +        * cache with A records, so the AAAA filter scrubbing logic can
 308 +        * work.
 309 +        */
 310 +       ASN_FETCH_A_FOR_AAAA_STATE,
 311 +
 312 +       /**
 313          * Each time a delegation point changes for a given query or a
 314          * query times out and/or wakes up, this state is (re)visited.
 315          * This state is reponsible for iterating through a list of
 316 @@ -309,6 +320,13 @@ struct iter_qstate {
 317          */
 318         int refetch_glue;
 319
 320 +       /**
 321 +        * ASN: This is a flag that, if true, means that this query is
 322 +        * for fetching A records to populate cache and determine if we must
 323 +        * return AAAA records or not.
 324 +        */
 325 +       int fetch_a_for_aaaa;
 326 +
 327         /** list of pending queries to authoritative servers. */
 328         struct outbound_list outlist;
 329  };
 330 --- unbound-1.4.17.orig/util/config_file.h
 331 +++ unbound-1.4.17/util/config_file.h
 332 @@ -169,6 +169,8 @@ struct config_file {
 333         int harden_referral_path;
 334         /** use 0x20 bits in query as random ID bits */
 335         int use_caps_bits_for_id;
 336 +       /** ASN: enable AAAA filter? */
 337 +       int aaaa_filter;
 338         /** strip away these private addrs from answers, no DNS Rebinding */
 339         struct config_strlist* private_address;
 340         /** allow domain (and subdomains) to use private address space */
 341 --- unbound-1.4.17.orig/util/configlexer.lex
 342 +++ unbound-1.4.17/util/configlexer.lex
 343 @@ -177,6 +177,7 @@ harden-below-nxdomain{COLON}        { YDVAR(1,
 344  harden-referral-path{COLON}    { YDVAR(1, VAR_HARDEN_REFERRAL_PATH) }
 345  use-caps-for-id{COLON}         { YDVAR(1, VAR_USE_CAPS_FOR_ID) }
 346  unwanted-reply-threshold{COLON}        { YDVAR(1, VAR_UNWANTED_REPLY_THRESHOLD) }
 347 +aaaa-filter{COLON}             { YDVAR(1, VAR_AAAA_FILTER) }
 348  private-address{COLON}         { YDVAR(1, VAR_PRIVATE_ADDRESS) }
 349  private-domain{COLON}          { YDVAR(1, VAR_PRIVATE_DOMAIN) }
 350  prefetch-key{COLON}            { YDVAR(1, VAR_PREFETCH_KEY) }
 351 --- unbound-1.4.17.orig/util/configparser.y
 352 +++ unbound-1.4.17/util/configparser.y
 353 @@ -92,6 +92,7 @@ extern struct config_parser_state* cfg_p
 354  %token VAR_STATISTICS_CUMULATIVE VAR_OUTGOING_PORT_PERMIT
 355  %token VAR_OUTGOING_PORT_AVOID VAR_DLV_ANCHOR_FILE VAR_DLV_ANCHOR
 356  %token VAR_NEG_CACHE_SIZE VAR_HARDEN_REFERRAL_PATH VAR_PRIVATE_ADDRESS
 357 +%token VAR_AAAA_FILTER
 358  %token VAR_PRIVATE_DOMAIN VAR_REMOTE_CONTROL VAR_CONTROL_ENABLE
 359  %token VAR_CONTROL_INTERFACE VAR_CONTROL_PORT VAR_SERVER_KEY_FILE
 360  %token VAR_SERVER_CERT_FILE VAR_CONTROL_KEY_FILE VAR_CONTROL_CERT_FILE
 361 @@ -151,6 +152,7 @@ content_server: server_num_threads | ser
 362         server_dlv_anchor_file | server_dlv_anchor | server_neg_cache_size |
 363         server_harden_referral_path | server_private_address |
 364         server_private_domain | server_extended_statistics |
 365 +       server_aaaa_filter |
 366         server_local_data_ptr | server_jostle_timeout |
 367         server_unwanted_reply_threshold | server_log_time_ascii |
 368         server_domain_insecure | server_val_sig_skew_min |
 369 @@ -802,6 +803,15 @@ server_use_caps_for_id: VAR_USE_CAPS_FOR
 370                 free($2);
 371         }
 372         ;
 373 +server_aaaa_filter: VAR_AAAA_FILTER STRING_ARG
 374 +       {
 375 +               OUTYY(("P(server_aaaa_filter:%s)\n", $2));
 376 +               if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
 377 +                       yyerror("expected yes or no.");
 378 +               else cfg_parser->cfg->aaaa_filter = (strcmp($2, "yes")==0);
 379 +               free($2);
 380 +       }
 381 +       ;
 382  server_private_address: VAR_PRIVATE_ADDRESS STRING_ARG
 383         {
 384                 OUTYY(("P(server_private_address:%s)\n", $2));
 385 --- unbound-1.4.17.orig/pythonmod/interface.i
 386 +++ unbound-1.4.17/pythonmod/interface.i
 387 @@ -626,6 +626,7 @@ struct config_file {
 388     int harden_dnssec_stripped;
 389     int harden_referral_path;
 390     int use_caps_bits_for_id;
 391 +   int aaaa_filter; /* ASN */
 392     struct config_strlist* private_address;
 393     struct config_strlist* private_domain;
 394     size_t unwanted_threshold;