contrib/unbound/contrib/drop-tld.diff

   1 diff --git a/daemon/worker.c b/daemon/worker.c
   2 index 263fcdd..f787b70 100644
   3 --- a/daemon/worker.c
   4 +++ b/daemon/worker.c
   5 @@ -1213,6 +1213,15 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
   6                 addr_to_str(&repinfo->addr, repinfo->addrlen, ip, sizeof(ip));
   7                 log_query_in(ip, qinfo.qname, qinfo.qtype, qinfo.qclass);
   8         }
   9 +
  10 +       if(worker->env.cfg->drop_tld) {
  11 +               int lab = dname_count_labels(qinfo.qname);
  12 +               if (lab == 2) {
  13 +                       comm_point_drop_reply(repinfo);
  14 +                       verbose(VERB_ALGO, "Dropping one label query.");
  15 +                       return 0;
  16 +               }
  17 +       }
  18         if(qinfo.qtype == LDNS_RR_TYPE_AXFR ||
  19                 qinfo.qtype == LDNS_RR_TYPE_IXFR) {
  20                 verbose(VERB_ALGO, "worker request: refused zone transfer.");
  21 diff --git a/util/config_file.h b/util/config_file.h
  22 index b3ef930..2791541 100644
  23 --- a/util/config_file.h
  24 +++ b/util/config_file.h
  25 @@ -274,6 +274,8 @@ struct config_file {
  26         int prefetch_key;
  27         /** deny queries of type ANY with an empty answer */
  28         int deny_any;
  29 +       /** Drop TLD queries from clients **/
  30 +       int drop_tld;
  31
  32         /** chrootdir, if not "" or chroot will be done */
  33         char* chrootdir;
  34 diff --git a/util/configlexer.lex b/util/configlexer.lex
  35 index a86ddf5..9bbedbb 100644
  36 --- a/util/configlexer.lex
  37 +++ b/util/configlexer.lex
  38 @@ -299,6 +299,7 @@ private-domain{COLON}               { YDVAR(1, VAR_PRIVATE_DOMAIN) }
  39  prefetch-key{COLON}            { YDVAR(1, VAR_PREFETCH_KEY) }
  40  prefetch{COLON}                        { YDVAR(1, VAR_PREFETCH) }
  41  deny-any{COLON}                        { YDVAR(1, VAR_DENY_ANY) }
  42 +drop-tld{COLON}                        { YDVAR(1, VAR_DROP_TLD) }
  43  stub-zone{COLON}               { YDVAR(0, VAR_STUB_ZONE) }
  44  name{COLON}                    { YDVAR(1, VAR_NAME) }
  45  stub-addr{COLON}               { YDVAR(1, VAR_STUB_ADDR) }
  46 diff --git a/util/configparser.y b/util/configparser.y
  47 index 10227a2..567d68e 100644
  48 --- a/util/configparser.y
  49 +++ b/util/configparser.y
  50 @@ -164,6 +164,7 @@ extern struct config_parser_state* cfg_parser;
  51  %token VAR_FAST_SERVER_PERMIL VAR_FAST_SERVER_NUM
  52  %token VAR_ALLOW_NOTIFY VAR_TLS_WIN_CERT VAR_TCP_CONNECTION_LIMIT
  53  %token VAR_FORWARD_NO_CACHE VAR_STUB_NO_CACHE VAR_LOG_SERVFAIL VAR_DENY_ANY
  54 +%token VAR_DROP_TLD
  55  %token VAR_UNKNOWN_SERVER_TIME_LIMIT VAR_LOG_TAG_QUERYREPLY
  56  %token VAR_STREAM_WAIT_SIZE VAR_TLS_CIPHERS VAR_TLS_CIPHERSUITES
  57  %token VAR_TLS_SESSION_TICKET_KEYS
  58 @@ -266,6 +267,7 @@ content_server: server_num_threads | server_verbosity | server_port |
  59         server_tls_cert_bundle | server_tls_additional_port | server_low_rtt |
  60         server_fast_server_permil | server_fast_server_num  | server_tls_win_cert |
  61         server_tcp_connection_limit | server_log_servfail | server_deny_any |
  62 +       server_drop_tld |
  63         server_unknown_server_time_limit | server_log_tag_queryreply |
  64         server_stream_wait_size | server_tls_ciphers |
  65         server_tls_ciphersuites | server_tls_session_ticket_keys
  66 @@ -1466,6 +1468,16 @@ server_deny_any: VAR_DENY_ANY STRING_ARG
  67                 free($2);
  68         }
  69         ;
  70 +
  71 +server_drop_tld: VAR_DROP_TLD STRING_ARG
  72 +       {
  73 +               OUTYY(("P(server_drop_tld:%s)\n", $2));
  74 +               if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
  75 +                       yyerror("expected yes or no.");
  76 +               else cfg_parser->cfg->drop_tld = (strcmp($2, "yes")==0);
  77 +               free($2);
  78 +       }
  79 +       ;
  80  server_unwanted_reply_threshold: VAR_UNWANTED_REPLY_THRESHOLD STRING_ARG
  81         {
  82                 OUTYY(("P(server_unwanted_reply_threshold:%s)\n", $2));