contrib/unbound/iterator/iter_scrub.c

   1 /*
   2  * iterator/iter_scrub.c - scrubbing, normalization, sanitization of DNS msgs.
   3  *
   4  * Copyright (c) 2007, NLnet Labs. All rights reserved.
   5  *
   6  * This software is open source.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  *
  12  * Redistributions of source code must retain the above copyright notice,
  13  * this list of conditions and the following disclaimer.
  14  *
  15  * Redistributions in binary form must reproduce the above copyright notice,
  16  * this list of conditions and the following disclaimer in the documentation
  17  * and/or other materials provided with the distribution.
  18  *
  19  * Neither the name of the NLNET LABS nor the names of its contributors may
  20  * be used to endorse or promote products derived from this software without
  21  * specific prior written permission.
  22  *
  23  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  24  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  25  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  26  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  27  * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  28  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
  29  * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
  30  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
  31  * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
  32  * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
  33  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  34  */
  35
  36 /**
  37  * \file
  38  *
  39  * This file has routine(s) for cleaning up incoming DNS messages from
  40  * possible useless or malicious junk in it.
  41  */
  42 #include "config.h"
  43 #include "iterator/iter_scrub.h"
  44 #include "iterator/iterator.h"
  45 #include "iterator/iter_priv.h"
  46 #include "services/cache/rrset.h"
  47 #include "util/log.h"
  48 #include "util/net_help.h"
  49 #include "util/regional.h"
  50 #include "util/config_file.h"
  51 #include "util/module.h"
  52 #include "util/data/msgparse.h"
  53 #include "util/data/dname.h"
  54 #include "util/data/msgreply.h"
  55 #include "util/alloc.h"
  56 #include "sldns/sbuffer.h"
  57
  58 /** RRset flag used during scrubbing. The RRset is OK. */
  59 #define RRSET_SCRUB_OK  0x80
  60
  61 /** remove rrset, update loop variables */
  62 static void
  63 remove_rrset(const char* str, sldns_buffer* pkt, struct msg_parse* msg,
  64         struct rrset_parse* prev, struct rrset_parse** rrset)
  65 {
  66         if(verbosity >= VERB_QUERY && str
  67                 && (*rrset)->dname_len <= LDNS_MAX_DOMAINLEN) {
  68                 uint8_t buf[LDNS_MAX_DOMAINLEN+1];
  69                 dname_pkt_copy(pkt, buf, (*rrset)->dname);
  70                 log_nametypeclass(VERB_QUERY, str, buf,
  71                         (*rrset)->type, ntohs((*rrset)->rrset_class));
  72         }
  73         if(prev)
  74                 prev->rrset_all_next = (*rrset)->rrset_all_next;
  75         else    msg->rrset_first = (*rrset)->rrset_all_next;
  76         if(msg->rrset_last == *rrset)
  77                 msg->rrset_last = prev;
  78         msg->rrset_count --;
  79         switch((*rrset)->section) {
  80                 case LDNS_SECTION_ANSWER: msg->an_rrsets--; break;
  81                 case LDNS_SECTION_AUTHORITY: msg->ns_rrsets--; break;
  82                 case LDNS_SECTION_ADDITIONAL: msg->ar_rrsets--; break;
  83                 default: log_assert(0);
  84         }
  85         msgparse_bucket_remove(msg, *rrset);
  86         *rrset = (*rrset)->rrset_all_next;
  87 }
  88
  89 /** return true if rr type has additional names in it */
  90 static int
  91 has_additional(uint16_t t)
  92 {
  93         switch(t) {
  94                 case LDNS_RR_TYPE_MB:
  95                 case LDNS_RR_TYPE_MD:
  96                 case LDNS_RR_TYPE_MF:
  97                 case LDNS_RR_TYPE_NS:
  98                 case LDNS_RR_TYPE_MX:
  99                 case LDNS_RR_TYPE_KX:
 100                 case LDNS_RR_TYPE_SRV:
 101                         return 1;
 102                 case LDNS_RR_TYPE_NAPTR:
 103                         /* TODO: NAPTR not supported, glue stripped off */
 104                         return 0;
 105         }
 106         return 0;
 107 }
 108
 109 /** get additional name from rrset RR, return false if no name present */
 110 static int
 111 get_additional_name(struct rrset_parse* rrset, struct rr_parse* rr,
 112         uint8_t** nm, size_t* nmlen, sldns_buffer* pkt)
 113 {
 114         size_t offset = 0;
 115         size_t len, oldpos;
 116         switch(rrset->type) {
 117                 case LDNS_RR_TYPE_MB:
 118                 case LDNS_RR_TYPE_MD:
 119                 case LDNS_RR_TYPE_MF:
 120                 case LDNS_RR_TYPE_NS:
 121                         offset = 0;
 122                         break;
 123                 case LDNS_RR_TYPE_MX:
 124                 case LDNS_RR_TYPE_KX:
 125                         offset = 2;
 126                         break;
 127                 case LDNS_RR_TYPE_SRV:
 128                         offset = 6;
 129                         break;
 130                 case LDNS_RR_TYPE_NAPTR:
 131                         /* TODO: NAPTR not supported, glue stripped off */
 132                         return 0;
 133                 default:
 134                         return 0;
 135         }
 136         len = sldns_read_uint16(rr->ttl_data+sizeof(uint32_t));
 137         if(len < offset+1)
 138                 return 0; /* rdata field too small */
 139         *nm = rr->ttl_data+sizeof(uint32_t)+sizeof(uint16_t)+offset;
 140         oldpos = sldns_buffer_position(pkt);
 141         sldns_buffer_set_position(pkt, (size_t)(*nm - sldns_buffer_begin(pkt)));
 142         *nmlen = pkt_dname_len(pkt);
 143         sldns_buffer_set_position(pkt, oldpos);
 144         if(*nmlen == 0)
 145                 return 0;
 146         return 1;
 147 }
 148
 149 /** Place mark on rrsets in additional section they are OK */
 150 static void
 151 mark_additional_rrset(sldns_buffer* pkt, struct msg_parse* msg,
 152         struct rrset_parse* rrset)
 153 {
 154         /* Mark A and AAAA for NS as appropriate additional section info. */
 155         uint8_t* nm = NULL;
 156         size_t nmlen = 0;
 157         struct rr_parse* rr;
 158
 159         if(!has_additional(rrset->type))
 160                 return;
 161         for(rr = rrset->rr_first; rr; rr = rr->next) {
 162                 if(get_additional_name(rrset, rr, &nm, &nmlen, pkt)) {
 163                         /* mark A */
 164                         hashvalue_type h = pkt_hash_rrset(pkt, nm,
 165                                 LDNS_RR_TYPE_A, rrset->rrset_class, 0);
 166                         struct rrset_parse* r = msgparse_hashtable_lookup(
 167                                 msg, pkt, h, 0, nm, nmlen,
 168                                 LDNS_RR_TYPE_A, rrset->rrset_class);
 169                         if(r && r->section == LDNS_SECTION_ADDITIONAL) {
 170                                 r->flags |= RRSET_SCRUB_OK;
 171                         }
 172
 173                         /* mark AAAA */
 174                         h = pkt_hash_rrset(pkt, nm, LDNS_RR_TYPE_AAAA,
 175                                 rrset->rrset_class, 0);
 176                         r = msgparse_hashtable_lookup(msg, pkt, h, 0, nm,
 177                                 nmlen, LDNS_RR_TYPE_AAAA, rrset->rrset_class);
 178                         if(r && r->section == LDNS_SECTION_ADDITIONAL) {
 179                                 r->flags |= RRSET_SCRUB_OK;
 180                         }
 181                 }
 182         }
 183 }
 184
 185 /** Get target name of a CNAME */
 186 static int
 187 parse_get_cname_target(struct rrset_parse* rrset, uint8_t** sname,
 188         size_t* snamelen, sldns_buffer* pkt)
 189 {
 190         size_t oldpos, dlen;
 191         if(rrset->rr_count != 1) {
 192                 struct rr_parse* sig;
 193                 verbose(VERB_ALGO, "Found CNAME rrset with "
 194                         "size > 1: %u", (unsigned)rrset->rr_count);
 195                 /* use the first CNAME! */
 196                 rrset->rr_count = 1;
 197                 rrset->size = rrset->rr_first->size;
 198                 for(sig=rrset->rrsig_first; sig; sig=sig->next)
 199                         rrset->size += sig->size;
 200                 rrset->rr_last = rrset->rr_first;
 201                 rrset->rr_first->next = NULL;
 202         }
 203         if(rrset->rr_first->size < sizeof(uint16_t)+1)
 204                 return 0; /* CNAME rdata too small */
 205         *sname = rrset->rr_first->ttl_data + sizeof(uint32_t)
 206                 + sizeof(uint16_t); /* skip ttl, rdatalen */
 207         *snamelen = rrset->rr_first->size - sizeof(uint16_t);
 208
 209         if(rrset->rr_first->outside_packet) {
 210                 if(!dname_valid(*sname, *snamelen))
 211                         return 0;
 212                 return 1;
 213         }
 214         oldpos = sldns_buffer_position(pkt);
 215         sldns_buffer_set_position(pkt, (size_t)(*sname - sldns_buffer_begin(pkt)));
 216         dlen = pkt_dname_len(pkt);
 217         sldns_buffer_set_position(pkt, oldpos);
 218         if(dlen == 0)
 219                 return 0; /* parse fail on the rdata name */
 220         *snamelen = dlen;
 221         return 1;
 222 }
 223
 224 /** Synthesize CNAME from DNAME, false if too long */
 225 static int
 226 synth_cname(uint8_t* qname, size_t qnamelen, struct rrset_parse* dname_rrset,
 227         uint8_t* alias, size_t* aliaslen, sldns_buffer* pkt)
 228 {
 229         /* we already know that sname is a strict subdomain of DNAME owner */
 230         uint8_t* dtarg = NULL;
 231         size_t dtarglen;
 232         if(!parse_get_cname_target(dname_rrset, &dtarg, &dtarglen, pkt))
 233                 return 0;
 234         if(qnamelen <= dname_rrset->dname_len)
 235                 return 0;
 236         if(qnamelen == 0)
 237                 return 0;
 238         log_assert(qnamelen > dname_rrset->dname_len);
 239         /* DNAME from com. to net. with qname example.com. -> example.net. */
 240         /* so: \3com\0 to \3net\0 and qname \7example\3com\0 */
 241         *aliaslen = qnamelen + dtarglen - dname_rrset->dname_len;
 242         if(*aliaslen > LDNS_MAX_DOMAINLEN)
 243                 return 0; /* should have been RCODE YXDOMAIN */
 244         /* decompress dnames into buffer, we know it fits */
 245         dname_pkt_copy(pkt, alias, qname);
 246         dname_pkt_copy(pkt, alias+(qnamelen-dname_rrset->dname_len), dtarg);
 247         return 1;
 248 }
 249
 250 /** synthesize a CNAME rrset */
 251 static struct rrset_parse*
 252 synth_cname_rrset(uint8_t** sname, size_t* snamelen, uint8_t* alias,
 253         size_t aliaslen, struct regional* region, struct msg_parse* msg,
 254         struct rrset_parse* rrset, struct rrset_parse* prev,
 255         struct rrset_parse* nx, sldns_buffer* pkt)
 256 {
 257         struct rrset_parse* cn = (struct rrset_parse*)regional_alloc(region,
 258                 sizeof(struct rrset_parse));
 259         if(!cn)
 260                 return NULL;
 261         memset(cn, 0, sizeof(*cn));
 262         cn->rr_first = (struct rr_parse*)regional_alloc(region,
 263                 sizeof(struct rr_parse));
 264         if(!cn->rr_first)
 265                 return NULL;
 266         cn->rr_last = cn->rr_first;
 267         /* CNAME from sname to alias */
 268         cn->dname = (uint8_t*)regional_alloc(region, *snamelen);
 269         if(!cn->dname)
 270                 return NULL;
 271         dname_pkt_copy(pkt, cn->dname, *sname);
 272         cn->dname_len = *snamelen;
 273         cn->type = LDNS_RR_TYPE_CNAME;
 274         cn->section = rrset->section;
 275         cn->rrset_class = rrset->rrset_class;
 276         cn->rr_count = 1;
 277         cn->size = sizeof(uint16_t) + aliaslen;
 278         cn->hash=pkt_hash_rrset(pkt, cn->dname, cn->type, cn->rrset_class, 0);
 279         /* allocate TTL + rdatalen + uncompressed dname */
 280         memset(cn->rr_first, 0, sizeof(struct rr_parse));
 281         cn->rr_first->outside_packet = 1;
 282         cn->rr_first->ttl_data = (uint8_t*)regional_alloc(region,
 283                 sizeof(uint32_t)+sizeof(uint16_t)+aliaslen);
 284         if(!cn->rr_first->ttl_data)
 285                 return NULL;
 286         sldns_write_uint32(cn->rr_first->ttl_data, 0); /* TTL = 0 */
 287         sldns_write_uint16(cn->rr_first->ttl_data+4, aliaslen);
 288         memmove(cn->rr_first->ttl_data+6, alias, aliaslen);
 289         cn->rr_first->size = sizeof(uint16_t)+aliaslen;
 290
 291         /* link it in */
 292         cn->rrset_all_next = nx;
 293         if(prev)
 294                 prev->rrset_all_next = cn;
 295         else    msg->rrset_first = cn;
 296         if(nx == NULL)
 297                 msg->rrset_last = cn;
 298         msg->rrset_count ++;
 299         msg->an_rrsets++;
 300         /* it is not inserted in the msg hashtable. */
 301
 302         *sname = cn->rr_first->ttl_data + sizeof(uint32_t)+sizeof(uint16_t);
 303         *snamelen = aliaslen;
 304         return cn;
 305 }
 306
 307 /** check if DNAME applies to a name */
 308 static int
 309 pkt_strict_sub(sldns_buffer* pkt, uint8_t* sname, uint8_t* dr)
 310 {
 311         uint8_t buf1[LDNS_MAX_DOMAINLEN+1];
 312         uint8_t buf2[LDNS_MAX_DOMAINLEN+1];
 313         /* decompress names */
 314         dname_pkt_copy(pkt, buf1, sname);
 315         dname_pkt_copy(pkt, buf2, dr);
 316         return dname_strict_subdomain_c(buf1, buf2);
 317 }
 318
 319 /** check subdomain with decompression */
 320 static int
 321 pkt_sub(sldns_buffer* pkt, uint8_t* comprname, uint8_t* zone)
 322 {
 323         uint8_t buf[LDNS_MAX_DOMAINLEN+1];
 324         dname_pkt_copy(pkt, buf, comprname);
 325         return dname_subdomain_c(buf, zone);
 326 }
 327
 328 /** check subdomain with decompression, compressed is parent */
 329 static int
 330 sub_of_pkt(sldns_buffer* pkt, uint8_t* zone, uint8_t* comprname)
 331 {
 332         uint8_t buf[LDNS_MAX_DOMAINLEN+1];
 333         dname_pkt_copy(pkt, buf, comprname);
 334         return dname_subdomain_c(zone, buf);
 335 }
 336
 337 /** Check if there are SOA records in the authority section (negative) */
 338 static int
 339 soa_in_auth(struct msg_parse* msg)
 340 {
 341         struct rrset_parse* rrset;
 342         for(rrset = msg->rrset_first; rrset; rrset = rrset->rrset_all_next)
 343                 if(rrset->type == LDNS_RR_TYPE_SOA &&
 344                         rrset->section == LDNS_SECTION_AUTHORITY)
 345                         return 1;
 346         return 0;
 347 }
 348
 349 /**
 350  * This routine normalizes a response. This includes removing "irrelevant"
 351  * records from the answer and additional sections and (re)synthesizing
 352  * CNAMEs from DNAMEs, if present.
 353  *
 354  * @param pkt: packet.
 355  * @param msg: msg to normalize.
 356  * @param qinfo: original query.
 357  * @param region: where to allocate synthesized CNAMEs.
 358  * @return 0 on error.
 359  */
 360 static int
 361 scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 362         struct query_info* qinfo, struct regional* region)
 363 {
 364         uint8_t* sname = qinfo->qname;
 365         size_t snamelen = qinfo->qname_len;
 366         struct rrset_parse* rrset, *prev, *nsset=NULL;
 367
 368         if(FLAGS_GET_RCODE(msg->flags) != LDNS_RCODE_NOERROR &&
 369                 FLAGS_GET_RCODE(msg->flags) != LDNS_RCODE_NXDOMAIN)
 370                 return 1;
 371
 372         /* For the ANSWER section, remove all "irrelevant" records and add
 373          * synthesized CNAMEs from DNAMEs
 374          * This will strip out-of-order CNAMEs as well. */
 375
 376         /* walk through the parse packet rrset list, keep track of previous
 377          * for insert and delete ease, and examine every RRset */
 378         prev = NULL;
 379         rrset = msg->rrset_first;
 380         while(rrset && rrset->section == LDNS_SECTION_ANSWER) {
 381                 if(rrset->type == LDNS_RR_TYPE_DNAME &&
 382                         pkt_strict_sub(pkt, sname, rrset->dname)) {
 383                         /* check if next rrset is correct CNAME. else,
 384                          * synthesize a CNAME */
 385                         struct rrset_parse* nx = rrset->rrset_all_next;
 386                         uint8_t alias[LDNS_MAX_DOMAINLEN+1];
 387                         size_t aliaslen = 0;
 388                         if(rrset->rr_count != 1) {
 389                                 verbose(VERB_ALGO, "Found DNAME rrset with "
 390                                         "size > 1: %u",
 391                                         (unsigned)rrset->rr_count);
 392                                 return 0;
 393                         }
 394                         if(!synth_cname(sname, snamelen, rrset, alias,
 395                                 &aliaslen, pkt)) {
 396                                 verbose(VERB_ALGO, "synthesized CNAME "
 397                                         "too long");
 398                                 return 0;
 399                         }
 400                         if(nx && nx->type == LDNS_RR_TYPE_CNAME &&
 401                            dname_pkt_compare(pkt, sname, nx->dname) == 0) {
 402                                 /* check next cname */
 403                                 uint8_t* t = NULL;
 404                                 size_t tlen = 0;
 405                                 if(!parse_get_cname_target(nx, &t, &tlen, pkt))
 406                                         return 0;
 407                                 if(dname_pkt_compare(pkt, alias, t) == 0) {
 408                                         /* it's OK and better capitalized */
 409                                         prev = rrset;
 410                                         rrset = nx;
 411                                         continue;
 412                                 }
 413                                 /* synth ourselves */
 414                         }
 415                         /* synth a CNAME rrset */
 416                         prev = synth_cname_rrset(&sname, &snamelen, alias,
 417                                 aliaslen, region, msg, rrset, rrset, nx, pkt);
 418                         if(!prev) {
 419                                 log_err("out of memory synthesizing CNAME");
 420                                 return 0;
 421                         }
 422                         /* FIXME: resolve the conflict between synthesized
 423                          * CNAME ttls and the cache. */
 424                         rrset = nx;
 425                         continue;
 426
 427                 }
 428
 429                 /* The only records in the ANSWER section not allowed to */
 430                 if(dname_pkt_compare(pkt, sname, rrset->dname) != 0) {
 431                         remove_rrset("normalize: removing irrelevant RRset:",
 432                                 pkt, msg, prev, &rrset);
 433                         continue;
 434                 }
 435
 436                 /* Follow the CNAME chain. */
 437                 if(rrset->type == LDNS_RR_TYPE_CNAME) {
 438                         struct rrset_parse* nx = rrset->rrset_all_next;
 439                         uint8_t* oldsname = sname;
 440                         /* see if the next one is a DNAME, if so, swap them */
 441                         if(nx && nx->section == LDNS_SECTION_ANSWER &&
 442                                 nx->type == LDNS_RR_TYPE_DNAME &&
 443                                 nx->rr_count == 1 &&
 444                                 pkt_strict_sub(pkt, sname, nx->dname)) {
 445                                 /* there is a DNAME after this CNAME, it
 446                                  * is in the ANSWER section, and the DNAME
 447                                  * applies to the name we cover */
 448                                 /* check if the alias of the DNAME equals
 449                                  * this CNAME */
 450                                 uint8_t alias[LDNS_MAX_DOMAINLEN+1];
 451                                 size_t aliaslen = 0;
 452                                 uint8_t* t = NULL;
 453                                 size_t tlen = 0;
 454                                 if(synth_cname(sname, snamelen, nx, alias,
 455                                         &aliaslen, pkt) &&
 456                                         parse_get_cname_target(rrset, &t, &tlen, pkt) &&
 457                                         dname_pkt_compare(pkt, alias, t) == 0) {
 458                                         /* the synthesized CNAME equals the
 459                                          * current CNAME.  This CNAME is the
 460                                          * one that the DNAME creates, and this
 461                                          * CNAME is better capitalised */
 462                                         verbose(VERB_ALGO, "normalize: re-order of DNAME and its CNAME");
 463                                         if(prev) prev->rrset_all_next = nx;
 464                                         else msg->rrset_first = nx;
 465                                         if(nx->rrset_all_next == NULL)
 466                                                 msg->rrset_last = rrset;
 467                                         rrset->rrset_all_next =
 468                                                 nx->rrset_all_next;
 469                                         nx->rrset_all_next = rrset;
 470                                         /* prev = nx; unused, enable if there
 471                                          * is other rrset removal code after
 472                                          * this */
 473                                 }
 474                         }
 475
 476                         /* move to next name in CNAME chain */
 477                         if(!parse_get_cname_target(rrset, &sname, &snamelen, pkt))
 478                                 return 0;
 479                         prev = rrset;
 480                         rrset = rrset->rrset_all_next;
 481                         /* in CNAME ANY response, can have data after CNAME */
 482                         if(qinfo->qtype == LDNS_RR_TYPE_ANY) {
 483                                 while(rrset && rrset->section ==
 484                                         LDNS_SECTION_ANSWER &&
 485                                         dname_pkt_compare(pkt, oldsname,
 486                                         rrset->dname) == 0) {
 487                                         prev = rrset;
 488                                         rrset = rrset->rrset_all_next;
 489                                 }
 490                         }
 491                         continue;
 492                 }
 493
 494                 /* Otherwise, make sure that the RRset matches the qtype. */
 495                 if(qinfo->qtype != LDNS_RR_TYPE_ANY &&
 496                         qinfo->qtype != rrset->type) {
 497                         remove_rrset("normalize: removing irrelevant RRset:",
 498                                 pkt, msg, prev, &rrset);
 499                         continue;
 500                 }
 501
 502                 /* Mark the additional names from relevant rrset as OK. */
 503                 /* only for RRsets that match the query name, other ones
 504                  * will be removed by sanitize, so no additional for them */
 505                 if(dname_pkt_compare(pkt, qinfo->qname, rrset->dname) == 0)
 506                         mark_additional_rrset(pkt, msg, rrset);
 507
 508                 prev = rrset;
 509                 rrset = rrset->rrset_all_next;
 510         }
 511
 512         /* Mark additional names from AUTHORITY */
 513         while(rrset && rrset->section == LDNS_SECTION_AUTHORITY) {
 514                 if(rrset->type==LDNS_RR_TYPE_DNAME ||
 515                         rrset->type==LDNS_RR_TYPE_CNAME ||
 516                         rrset->type==LDNS_RR_TYPE_A ||
 517                         rrset->type==LDNS_RR_TYPE_AAAA) {
 518                         remove_rrset("normalize: removing irrelevant "
 519                                 "RRset:", pkt, msg, prev, &rrset);
 520                         continue;
 521                 }
 522                 /* only one NS set allowed in authority section */
 523                 if(rrset->type==LDNS_RR_TYPE_NS) {
 524                         /* NS set must be pertinent to the query */
 525                         if(!sub_of_pkt(pkt, qinfo->qname, rrset->dname)) {
 526                                 remove_rrset("normalize: removing irrelevant "
 527                                         "RRset:", pkt, msg, prev, &rrset);
 528                                 continue;
 529                         }
 530                         /* we don't want NS sets for NXDOMAIN answers,
 531                          * because they could contain poisonous contents,
 532                          * from. eg. fragmentation attacks, inserted after
 533                          * long RRSIGs in the packet get to the packet
 534                          * border and such */
 535                         /* also for NODATA answers */
 536                         if(FLAGS_GET_RCODE(msg->flags) == LDNS_RCODE_NXDOMAIN ||
 537                            (FLAGS_GET_RCODE(msg->flags) == LDNS_RCODE_NOERROR
 538                             && soa_in_auth(msg) && msg->an_rrsets == 0)) {
 539                                 remove_rrset("normalize: removing irrelevant "
 540                                         "RRset:", pkt, msg, prev, &rrset);
 541                                 continue;
 542                         }
 543                         if(nsset == NULL) {
 544                                 nsset = rrset;
 545                         } else {
 546                                 remove_rrset("normalize: removing irrelevant "
 547                                         "RRset:", pkt, msg, prev, &rrset);
 548                                 continue;
 549                         }
 550                 }
 551                 /* if this is type DS and we query for type DS we just got
 552                  * a referral answer for our type DS query, fix packet */
 553                 if(rrset->type==LDNS_RR_TYPE_DS &&
 554                         qinfo->qtype == LDNS_RR_TYPE_DS &&
 555                         dname_pkt_compare(pkt, qinfo->qname, rrset->dname) == 0) {
 556                         rrset->section = LDNS_SECTION_ANSWER;
 557                         msg->ancount = rrset->rr_count + rrset->rrsig_count;
 558                         msg->nscount = 0;
 559                         msg->arcount = 0;
 560                         msg->an_rrsets = 1;
 561                         msg->ns_rrsets = 0;
 562                         msg->ar_rrsets = 0;
 563                         msg->rrset_count = 1;
 564                         msg->rrset_first = rrset;
 565                         msg->rrset_last = rrset;
 566                         rrset->rrset_all_next = NULL;
 567                         return 1;
 568                 }
 569                 mark_additional_rrset(pkt, msg, rrset);
 570                 prev = rrset;
 571                 rrset = rrset->rrset_all_next;
 572         }
 573
 574         /* For each record in the additional section, remove it if it is an
 575          * address record and not in the collection of additional names
 576          * found in ANSWER and AUTHORITY. */
 577         /* These records have not been marked OK previously */
 578         while(rrset && rrset->section == LDNS_SECTION_ADDITIONAL) {
 579                 /* FIXME: what about other types? */
 580                 if(rrset->type==LDNS_RR_TYPE_A ||
 581                         rrset->type==LDNS_RR_TYPE_AAAA)
 582                 {
 583                         if((rrset->flags & RRSET_SCRUB_OK)) {
 584                                 /* remove flag to clean up flags variable */
 585                                 rrset->flags &= ~RRSET_SCRUB_OK;
 586                         } else {
 587                                 remove_rrset("normalize: removing irrelevant "
 588                                         "RRset:", pkt, msg, prev, &rrset);
 589                                 continue;
 590                         }
 591                 }
 592                 if(rrset->type==LDNS_RR_TYPE_DNAME ||
 593                         rrset->type==LDNS_RR_TYPE_CNAME ||
 594                         rrset->type==LDNS_RR_TYPE_NS) {
 595                         remove_rrset("normalize: removing irrelevant "
 596                                 "RRset:", pkt, msg, prev, &rrset);
 597                         continue;
 598                 }
 599                 prev = rrset;
 600                 rrset = rrset->rrset_all_next;
 601         }
 602
 603         return 1;
 604 }
 605
 606 /**
 607  * Store potential poison in the cache (only if hardening disabled).
 608  * The rrset is stored in the cache but removed from the message.
 609  * So that it will be used for infrastructure purposes, but not be
 610  * returned to the client.
 611  * @param pkt: packet
 612  * @param msg: message parsed
 613  * @param env: environment with cache
 614  * @param rrset: to store.
 615  */
 616 static void
 617 store_rrset(sldns_buffer* pkt, struct msg_parse* msg, struct module_env* env,
 618         struct rrset_parse* rrset)
 619 {
 620         struct ub_packed_rrset_key* k;
 621         struct packed_rrset_data* d;
 622         struct rrset_ref ref;
 623         time_t now = *env->now;
 624
 625         k = alloc_special_obtain(env->alloc);
 626         if(!k)
 627                 return;
 628         k->entry.data = NULL;
 629         if(!parse_copy_decompress_rrset(pkt, msg, rrset, NULL, k)) {
 630                 alloc_special_release(env->alloc, k);
 631                 return;
 632         }
 633         d = (struct packed_rrset_data*)k->entry.data;
 634         packed_rrset_ttl_add(d, now);
 635         ref.key = k;
 636         ref.id = k->id;
 637         /*ignore ret: it was in the cache, ref updated */
 638         (void)rrset_cache_update(env->rrset_cache, &ref, env->alloc, now);
 639 }
 640
 641 /**
 642  * Check if right hand name in NSEC is within zone
 643  * @param rrset: the NSEC rrset
 644  * @param zonename: the zone name.
 645  * @return true if BAD.
 646  */
 647 static int sanitize_nsec_is_overreach(struct rrset_parse* rrset,
 648         uint8_t* zonename)
 649 {
 650         struct rr_parse* rr;
 651         uint8_t* rhs;
 652         size_t len;
 653         log_assert(rrset->type == LDNS_RR_TYPE_NSEC);
 654         for(rr = rrset->rr_first; rr; rr = rr->next) {
 655                 rhs = rr->ttl_data+4+2;
 656                 len = sldns_read_uint16(rr->ttl_data+4);
 657                 if(!dname_valid(rhs, len)) {
 658                         /* malformed domain name in rdata */
 659                         return 1;
 660                 }
 661                 if(!dname_subdomain_c(rhs, zonename)) {
 662                         /* overreaching */
 663                         return 1;
 664                 }
 665         }
 666         /* all NSEC RRs OK */
 667         return 0;
 668 }
 669
 670 /**
 671  * Given a response event, remove suspect RRsets from the response.
 672  * "Suspect" rrsets are potentially poison. Note that this routine expects
 673  * the response to be in a "normalized" state -- that is, all "irrelevant"
 674  * RRsets have already been removed, CNAMEs are in order, etc.
 675  *
 676  * @param pkt: packet.
 677  * @param msg: msg to normalize.
 678  * @param qinfo: the question originally asked.
 679  * @param zonename: name of server zone.
 680  * @param env: module environment with config and cache.
 681  * @param ie: iterator environment with private address data.
 682  * @return 0 on error.
 683  */
 684 static int
 685 scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg,
 686         struct query_info* qinfo, uint8_t* zonename, struct module_env* env,
 687         struct iter_env* ie)
 688 {
 689         int del_addi = 0; /* if additional-holding rrsets are deleted, we
 690                 do not trust the normalized additional-A-AAAA any more */
 691         struct rrset_parse* rrset, *prev;
 692         prev = NULL;
 693         rrset = msg->rrset_first;
 694
 695         /* the first DNAME is allowed to stay. It needs checking before
 696          * it can be used from the cache. After normalization, an initial
 697          * DNAME will have a correctly synthesized CNAME after it. */
 698         if(rrset && rrset->type == LDNS_RR_TYPE_DNAME &&
 699                 rrset->section == LDNS_SECTION_ANSWER &&
 700                 pkt_strict_sub(pkt, qinfo->qname, rrset->dname) &&
 701                 pkt_sub(pkt, rrset->dname, zonename)) {
 702                 prev = rrset; /* DNAME allowed to stay in answer section */
 703                 rrset = rrset->rrset_all_next;
 704         }
 705
 706         /* remove all records from the answer section that are
 707          * not the same domain name as the query domain name.
 708          * The answer section should contain rrsets with the same name
 709          * as the question. For DNAMEs a CNAME has been synthesized.
 710          * Wildcards have the query name in answer section.
 711          * ANY queries get query name in answer section.
 712          * Remainders of CNAME chains are cut off and resolved by iterator. */
 713         while(rrset && rrset->section == LDNS_SECTION_ANSWER) {
 714                 if(dname_pkt_compare(pkt, qinfo->qname, rrset->dname) != 0) {
 715                         if(has_additional(rrset->type)) del_addi = 1;
 716                         remove_rrset("sanitize: removing extraneous answer "
 717                                 "RRset:", pkt, msg, prev, &rrset);
 718                         continue;
 719                 }
 720                 prev = rrset;
 721                 rrset = rrset->rrset_all_next;
 722         }
 723
 724         /* At this point, we brutally remove ALL rrsets that aren't
 725          * children of the originating zone. The idea here is that,
 726          * as far as we know, the server that we contacted is ONLY
 727          * authoritative for the originating zone. It, of course, MAY
 728          * be authoritative for any other zones, and of course, MAY
 729          * NOT be authoritative for some subdomains of the originating
 730          * zone. */
 731         prev = NULL;
 732         rrset = msg->rrset_first;
 733         while(rrset) {
 734
 735                 /* remove private addresses */
 736                 if( (rrset->type == LDNS_RR_TYPE_A ||
 737                         rrset->type == LDNS_RR_TYPE_AAAA)) {
 738
 739                         /* do not set servfail since this leads to too
 740                          * many drops of other people using rfc1918 space */
 741                         /* also do not remove entire rrset, unless all records
 742                          * in it are bad */
 743                         if(priv_rrset_bad(ie->priv, pkt, rrset)) {
 744                                 remove_rrset(NULL, pkt, msg, prev, &rrset);
 745                                 continue;
 746                         }
 747                 }
 748
 749                 /* skip DNAME records -- they will always be followed by a
 750                  * synthesized CNAME, which will be relevant.
 751                  * FIXME: should this do something differently with DNAME
 752                  * rrsets NOT in Section.ANSWER? */
 753                 /* But since DNAME records are also subdomains of the zone,
 754                  * same check can be used */
 755
 756                 if(!pkt_sub(pkt, rrset->dname, zonename)) {
 757                         if(msg->an_rrsets == 0 &&
 758                                 rrset->type == LDNS_RR_TYPE_NS &&
 759                                 rrset->section == LDNS_SECTION_AUTHORITY &&
 760                                 FLAGS_GET_RCODE(msg->flags) ==
 761                                 LDNS_RCODE_NOERROR && !soa_in_auth(msg) &&
 762                                 sub_of_pkt(pkt, zonename, rrset->dname)) {
 763                                 /* noerror, nodata and this NS rrset is above
 764                                  * the zone. This is LAME!
 765                                  * Leave in the NS for lame classification. */
 766                                 /* remove everything from the additional
 767                                  * (we dont want its glue that was approved
 768                                  * during the normalize action) */
 769                                 del_addi = 1;
 770                         } else if(!env->cfg->harden_glue && (
 771                                 rrset->type == LDNS_RR_TYPE_A ||
 772                                 rrset->type == LDNS_RR_TYPE_AAAA)) {
 773                                 /* store in cache! Since it is relevant
 774                                  * (from normalize) it will be picked up
 775                                  * from the cache to be used later */
 776                                 store_rrset(pkt, msg, env, rrset);
 777                                 remove_rrset("sanitize: storing potential "
 778                                 "poison RRset:", pkt, msg, prev, &rrset);
 779                                 continue;
 780                         } else {
 781                                 if(has_additional(rrset->type)) del_addi = 1;
 782                                 remove_rrset("sanitize: removing potential "
 783                                 "poison RRset:", pkt, msg, prev, &rrset);
 784                                 continue;
 785                         }
 786                 }
 787                 if(del_addi && rrset->section == LDNS_SECTION_ADDITIONAL) {
 788                         remove_rrset("sanitize: removing potential "
 789                         "poison reference RRset:", pkt, msg, prev, &rrset);
 790                         continue;
 791                 }
 792                 /* check if right hand side of NSEC is within zone */
 793                 if(rrset->type == LDNS_RR_TYPE_NSEC &&
 794                         sanitize_nsec_is_overreach(rrset, zonename)) {
 795                         remove_rrset("sanitize: removing overreaching NSEC "
 796                                 "RRset:", pkt, msg, prev, &rrset);
 797                         continue;
 798                 }
 799                 prev = rrset;
 800                 rrset = rrset->rrset_all_next;
 801         }
 802         return 1;
 803 }
 804
 805 int
 806 scrub_message(sldns_buffer* pkt, struct msg_parse* msg,
 807         struct query_info* qinfo, uint8_t* zonename, struct regional* region,
 808         struct module_env* env, struct iter_env* ie)
 809 {
 810         /* basic sanity checks */
 811         log_nametypeclass(VERB_ALGO, "scrub for", zonename, LDNS_RR_TYPE_NS,
 812                 qinfo->qclass);
 813         if(msg->qdcount > 1)
 814                 return 0;
 815         if( !(msg->flags&BIT_QR) )
 816                 return 0;
 817         msg->flags &= ~(BIT_AD|BIT_Z); /* force off bit AD and Z */
 818
 819         /* make sure that a query is echoed back when NOERROR or NXDOMAIN */
 820         /* this is not required for basic operation but is a forgery
 821          * resistance (security) feature */
 822         if((FLAGS_GET_RCODE(msg->flags) == LDNS_RCODE_NOERROR ||
 823                 FLAGS_GET_RCODE(msg->flags) == LDNS_RCODE_NXDOMAIN) &&
 824                 msg->qdcount == 0)
 825                 return 0;
 826
 827         /* if a query is echoed back, make sure it is correct. Otherwise,
 828          * this may be not a reply to our query. */
 829         if(msg->qdcount == 1) {
 830                 if(dname_pkt_compare(pkt, msg->qname, qinfo->qname) != 0)
 831                         return 0;
 832                 if(msg->qtype != qinfo->qtype || msg->qclass != qinfo->qclass)
 833                         return 0;
 834         }
 835
 836         /* normalize the response, this cleans up the additional.  */
 837         if(!scrub_normalize(pkt, msg, qinfo, region))
 838                 return 0;
 839         /* delete all out-of-zone information */
 840         if(!scrub_sanitize(pkt, msg, qinfo, zonename, env, ie))
 841                 return 0;
 842         return 1;
 843 }