1 Index: trunk/doc/unbound.conf.5.in
2 ===================================================================
3 --- trunk/doc/unbound.conf.5.in (revision 4357)
4 +++ trunk/doc/unbound.conf.5.in (working copy)
6 this option in enabled. Only use if you know what you are doing.
7 This option only has effect when qname-minimisation is enabled. Default is off.
9 +.B aaaa\-filter: \fI<yes or no>
10 +Activate behavior similar to BIND's AAAA-filter.
11 +This forces the dropping of all AAAA records, unless in the case of
12 +explicit AAAA queries, when no A records have been confirmed.
13 +This also causes an additional A query to be sent for each AAAA query.
16 .B private\-address: \fI<IP address or subnet>
17 Give IPv4 of IPv6 addresses or classless subnets. These are addresses
18 on your private network, and are not allowed to be returned for
19 Index: trunk/iterator/iter_scrub.c
20 ===================================================================
21 --- trunk/iterator/iter_scrub.c (revision 4357)
22 +++ trunk/iterator/iter_scrub.c (working copy)
27 + * ASN: Lookup A records from rrset cache.
28 + * @param qinfo: the question originally asked.
29 + * @param env: module environment with config and cache.
30 + * @param ie: iterator environment with private address data.
31 + * @return 0 if no A record found, 1 if A record found.
34 +asn_lookup_a_record_from_cache(struct query_info* qinfo,
35 + struct module_env* env, struct iter_env* ATTR_UNUSED(ie))
37 + struct ub_packed_rrset_key* akey;
39 + /* get cached A records for queried name */
40 + akey = rrset_cache_lookup(env->rrset_cache, qinfo->qname,
41 + qinfo->qname_len, LDNS_RR_TYPE_A, qinfo->qclass,
43 + if(akey) { /* we had some. */
44 + log_rrset_key(VERB_ALGO, "ASN-AAAA-filter: found A record",
46 + lock_rw_unlock(&akey->entry.lock);
53 * Given a response event, remove suspect RRsets from the response.
54 * "Suspect" rrsets are potentially poison. Note that this routine expects
55 * the response to be in a "normalized" state -- that is, all "irrelevant"
57 struct query_info* qinfo, uint8_t* zonename, struct module_env* env,
60 + int found_a_record = 0; /* ASN: do we have a A record? */
61 int del_addi = 0; /* if additional-holding rrsets are deleted, we
62 do not trust the normalized additional-A-AAAA any more */
63 struct rrset_parse* rrset, *prev;
65 rrset = rrset->rrset_all_next;
68 + /* ASN: Locate any A record we can find */
69 + if((ie->aaaa_filter) && (qinfo->qtype == LDNS_RR_TYPE_AAAA)) {
70 + found_a_record = asn_lookup_a_record_from_cache(qinfo,
73 + /* ASN: End of added code */
75 /* At this point, we brutally remove ALL rrsets that aren't
76 * children of the originating zone. The idea here is that,
77 * as far as we know, the server that we contacted is ONLY
80 rrset = msg->rrset_first;
83 + /* ASN: For AAAA records only... */
84 + if((ie->aaaa_filter) && (rrset->type == LDNS_RR_TYPE_AAAA)) {
85 + /* ASN: If this is not a AAAA query, then remove AAAA
86 + * records, no questions asked. If this IS a AAAA query
87 + * then remove AAAA records if we have an A record.
88 + * Otherwise, leave things be. */
89 + if((qinfo->qtype != LDNS_RR_TYPE_AAAA) ||
91 + remove_rrset("ASN-AAAA-filter: removing AAAA "
92 + "for record", pkt, msg, prev, &rrset);
95 + log_nametypeclass(VERB_ALGO, "ASN-AAAA-filter: "
96 + "keep AAAA for", zonename,
97 + LDNS_RR_TYPE_AAAA, qinfo->qclass);
99 + /* ASN: End of added code */
101 /* remove private addresses */
102 if( (rrset->type == LDNS_RR_TYPE_A ||
103 Index: trunk/iterator/iter_utils.c
104 ===================================================================
105 --- trunk/iterator/iter_utils.c (revision 4357)
106 +++ trunk/iterator/iter_utils.c (working copy)
109 iter_env->supports_ipv6 = cfg->do_ip6;
110 iter_env->supports_ipv4 = cfg->do_ip4;
111 + iter_env->aaaa_filter = cfg->aaaa_filter;
115 Index: trunk/iterator/iterator.c
116 ===================================================================
117 --- trunk/iterator/iterator.c (revision 4357)
118 +++ trunk/iterator/iterator.c (working copy)
119 @@ -1847,6 +1847,53 @@
125 + * ASN: This event state was added as an intermediary step between
126 + * QUERYTARGETS_STATE and the next step, in order to cast a subquery for the
127 + * purpose of caching A records for the queried name.
129 + * @param qstate: query state.
130 + * @param iq: iterator query state.
131 + * @param ie: iterator shared global environment.
132 + * @param id: module id.
133 + * @return true if the event requires more request processing immediately,
134 + * false if not. This state only returns true when it is generating
135 + * a SERVFAIL response because the query has hit a dead end.
138 +asn_processQueryAAAA(struct module_qstate* qstate, struct iter_qstate* iq,
139 + struct iter_env* ATTR_UNUSED(ie), int id)
141 + struct module_qstate* subq = NULL;
143 + log_assert(iq->fetch_a_for_aaaa == 0);
145 + /* flag the query properly in order to not loop */
146 + iq->fetch_a_for_aaaa = 1;
148 + /* re-throw same query, but with a different type */
149 + if(!generate_sub_request(iq->qchase.qname,
150 + iq->qchase.qname_len, LDNS_RR_TYPE_A,
151 + iq->qchase.qclass, qstate, id, iq,
152 + INIT_REQUEST_STATE, FINISHED_STATE, &subq, 1)) {
153 + log_nametypeclass(VERB_ALGO, "ASN-AAAA-filter: failed "
154 + "preloading of A record for",
155 + iq->qchase.qname, LDNS_RR_TYPE_A,
156 + iq->qchase.qclass);
157 + return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
159 + log_nametypeclass(VERB_ALGO, "ASN-AAAA-filter: "
160 + "preloading records in cache for",
161 + iq->qchase.qname, LDNS_RR_TYPE_A,
162 + iq->qchase.qclass);
164 + /* set this query as waiting */
165 + qstate->ext_state[id] = module_wait_subquery;
166 + /* at this point break loop */
169 +/* ASN: End of added code */
172 * This is the request event state where the request will be sent to one of
173 @@ -1894,6 +1941,13 @@
174 return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
177 + /* ASN: If we have a AAAA query, then also query for A records */
178 + if((ie->aaaa_filter) && (iq->qchase.qtype == LDNS_RR_TYPE_AAAA) &&
179 + (iq->fetch_a_for_aaaa == 0)) {
180 + return next_state(iq, ASN_FETCH_A_FOR_AAAA_STATE);
182 + /* ASN: End of added code */
184 /* Make sure we have a delegation point, otherwise priming failed
185 * or another failure occurred */
187 @@ -3095,6 +3149,61 @@
192 + * ASN: Do final processing on responses to A queries originated from AAAA
193 + * queries. Events reach this state after the iterative resolution algorithm
195 + * This is required down the road to decide whether to scrub AAAA records
196 + * from the results or not.
198 + * @param qstate: query state.
199 + * @param id: module id.
200 + * @param forq: super query state.
203 +asn_processAAAAResponse(struct module_qstate* qstate, int id,
204 + struct module_qstate* super)
206 + /*struct iter_qstate* iq = (struct iter_qstate*)qstate->minfo[id];*/
207 + struct iter_qstate* super_iq = (struct iter_qstate*)super->minfo[id];
208 + struct delegpt_ns* dpns = NULL;
209 + int error = (qstate->return_rcode != LDNS_RCODE_NOERROR);
211 + log_assert(super_iq->fetch_a_for_aaaa > 0);
213 + /* let super go to evaluation of targets after this */
214 + super_iq->state = QUERYTARGETS_STATE;
216 + log_query_info(VERB_ALGO, "ASN-AAAA-filter: processAAAAResponse",
218 + log_query_info(VERB_ALGO, "ASN-AAAA-filter: processAAAAResponse super",
222 + dpns = delegpt_find_ns(super_iq->dp,
223 + qstate->qinfo.qname, qstate->qinfo.qname_len);
225 + /* not interested */
226 + verbose(VERB_ALGO, "ASN-AAAA-filter: subq: %s, but parent not "
227 + "interested%s", (error ? "error, but" : "success"),
228 + (super_iq->dp ? "anymore" : " (was reset)"));
229 + log_query_info(VERB_ALGO, "ASN-AAAA-filter: superq", &super->qinfo);
230 + if(super_iq->dp && error)
231 + delegpt_log(VERB_ALGO, super_iq->dp);
233 + } else if (error) {
234 + verbose(VERB_ALGO, "ASN-AAAA-filter: mark as failed, "
235 + "and go to target query.");
236 + /* see if the failure did get (parent-lame) info */
237 + if(!cache_fill_missing(super->env,
238 + super_iq->qchase.qclass, super->region,
240 + log_err("ASN-AAAA-filter: out of memory adding missing");
241 + dpns->resolved = 1; /* mark as failed */
244 +/* ASN: End of added code */
247 * Return priming query results to interested super querystates.
249 @@ -3114,6 +3223,9 @@
250 else if(super->qinfo.qtype == LDNS_RR_TYPE_DS && ((struct iter_qstate*)
251 super->minfo[id])->state == DSNS_FIND_STATE)
252 processDSNSResponse(qstate, id, super);
253 + else if (super->qinfo.qtype == LDNS_RR_TYPE_AAAA && ((struct iter_qstate*)
254 + super->minfo[id])->state == ASN_FETCH_A_FOR_AAAA_STATE)
255 + asn_processAAAAResponse(qstate, id, super);
256 else if(qstate->return_rcode != LDNS_RCODE_NOERROR)
257 error_supers(qstate, id, super);
258 else if(qstate->is_priming)
259 @@ -3151,6 +3263,9 @@
260 case INIT_REQUEST_3_STATE:
261 cont = processInitRequest3(qstate, iq, id);
263 + case ASN_FETCH_A_FOR_AAAA_STATE:
264 + cont = asn_processQueryAAAA(qstate, iq, ie, id);
266 case QUERYTARGETS_STATE:
267 cont = processQueryTargets(qstate, iq, ie, id);
269 @@ -3460,6 +3575,8 @@
270 return "INIT REQUEST STATE (stage 2)";
271 case INIT_REQUEST_3_STATE:
272 return "INIT REQUEST STATE (stage 3)";
273 + case ASN_FETCH_A_FOR_AAAA_STATE:
274 + return "ASN_FETCH_A_FOR_AAAA_STATE";
275 case QUERYTARGETS_STATE :
276 return "QUERY TARGETS STATE";
277 case PRIME_RESP_STATE :
278 @@ -3484,6 +3601,7 @@
279 case INIT_REQUEST_STATE :
280 case INIT_REQUEST_2_STATE :
281 case INIT_REQUEST_3_STATE :
282 + case ASN_FETCH_A_FOR_AAAA_STATE :
283 case QUERYTARGETS_STATE :
284 case COLLECT_CLASS_STATE :
286 Index: trunk/iterator/iterator.h
287 ===================================================================
288 --- trunk/iterator/iterator.h (revision 4357)
289 +++ trunk/iterator/iterator.h (working copy)
292 int* target_fetch_policy;
294 + /** ASN: AAAA-filter flag */
297 /** lock on ratelimit counter */
298 lock_basic_type queries_ratelimit_lock;
299 /** number of queries that have been ratelimited */
301 INIT_REQUEST_3_STATE,
304 + * This state is responsible for intercepting AAAA queries,
305 + * and launch a A subquery on the same target, to populate the
306 + * cache with A records, so the AAAA filter scrubbing logic can
309 + ASN_FETCH_A_FOR_AAAA_STATE,
312 * Each time a delegation point changes for a given query or a
313 * query times out and/or wakes up, this state is (re)visited.
314 * This state is responsible for iterating through a list of
316 * be used when creating the state. A higher one will be attempted.
321 + * ASN: This is a flag that, if true, means that this query is
322 + * for fetching A records to populate cache and determine if we must
323 + * return AAAA records or not.
325 + int fetch_a_for_aaaa;
327 /** list of pending queries to authoritative servers. */
328 struct outbound_list outlist;
329 Index: trunk/pythonmod/interface.i
330 ===================================================================
331 --- trunk/pythonmod/interface.i (revision 4357)
332 +++ trunk/pythonmod/interface.i (working copy)
334 int harden_dnssec_stripped;
335 int harden_referral_path;
336 int use_caps_bits_for_id;
337 + int aaaa_filter; /* ASN */
338 struct config_strlist* private_address;
339 struct config_strlist* private_domain;
340 size_t unwanted_threshold;
341 Index: trunk/util/config_file.c
342 ===================================================================
343 --- trunk/util/config_file.c (revision 4357)
344 +++ trunk/util/config_file.c (working copy)
346 cfg->harden_referral_path = 0;
347 cfg->harden_algo_downgrade = 0;
348 cfg->use_caps_bits_for_id = 0;
349 + cfg->aaaa_filter = 0; /* ASN: default is disabled */
350 cfg->caps_whitelist = NULL;
351 cfg->private_address = NULL;
352 cfg->private_domain = NULL;
353 Index: trunk/util/config_file.h
354 ===================================================================
355 --- trunk/util/config_file.h (revision 4357)
356 +++ trunk/util/config_file.h (working copy)
358 int harden_algo_downgrade;
359 /** use 0x20 bits in query as random ID bits */
360 int use_caps_bits_for_id;
361 + /** ASN: enable AAAA filter? */
363 /** 0x20 whitelist, domains that do not use capsforid */
364 struct config_strlist* caps_whitelist;
365 /** strip away these private addrs from answers, no DNS Rebinding */
366 Index: trunk/util/configlexer.lex
367 ===================================================================
368 --- trunk/util/configlexer.lex (revision 4357)
369 +++ trunk/util/configlexer.lex (working copy)
371 use-caps-for-id{COLON} { YDVAR(1, VAR_USE_CAPS_FOR_ID) }
372 caps-whitelist{COLON} { YDVAR(1, VAR_CAPS_WHITELIST) }
373 unwanted-reply-threshold{COLON} { YDVAR(1, VAR_UNWANTED_REPLY_THRESHOLD) }
374 +aaaa-filter{COLON} { YDVAR(1, VAR_AAAA_FILTER) }
375 private-address{COLON} { YDVAR(1, VAR_PRIVATE_ADDRESS) }
376 private-domain{COLON} { YDVAR(1, VAR_PRIVATE_DOMAIN) }
377 prefetch-key{COLON} { YDVAR(1, VAR_PREFETCH_KEY) }
378 Index: trunk/util/configparser.y
379 ===================================================================
380 --- trunk/util/configparser.y (revision 4357)
381 +++ trunk/util/configparser.y (working copy)
383 %token VAR_STATISTICS_CUMULATIVE VAR_OUTGOING_PORT_PERMIT
384 %token VAR_OUTGOING_PORT_AVOID VAR_DLV_ANCHOR_FILE VAR_DLV_ANCHOR
385 %token VAR_NEG_CACHE_SIZE VAR_HARDEN_REFERRAL_PATH VAR_PRIVATE_ADDRESS
386 +%token VAR_AAAA_FILTER
387 %token VAR_PRIVATE_DOMAIN VAR_REMOTE_CONTROL VAR_CONTROL_ENABLE
388 %token VAR_CONTROL_INTERFACE VAR_CONTROL_PORT VAR_SERVER_KEY_FILE
389 %token VAR_SERVER_CERT_FILE VAR_CONTROL_KEY_FILE VAR_CONTROL_CERT_FILE
391 server_dlv_anchor_file | server_dlv_anchor | server_neg_cache_size |
392 server_harden_referral_path | server_private_address |
393 server_private_domain | server_extended_statistics |
394 + server_aaaa_filter |
395 server_local_data_ptr | server_jostle_timeout |
396 server_unwanted_reply_threshold | server_log_time_ascii |
397 server_domain_insecure | server_val_sig_skew_min |
398 @@ -1183,6 +1185,15 @@
399 OUTYY(("P(server_caps_whitelist:%s)\n", $2));
400 if(!cfg_strlist_insert(&cfg_parser->cfg->caps_whitelist, $2))
401 yyerror("out of memory");
404 +server_aaaa_filter: VAR_AAAA_FILTER STRING_ARG
406 + OUTYY(("P(server_aaaa_filter:%s)\n", $2));
407 + if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
408 + yyerror("expected yes or no.");
409 + else cfg_parser->cfg->aaaa_filter = (strcmp($2, "yes")==0);
413 server_private_address: VAR_PRIVATE_ADDRESS STRING_ARG