contrib/unbound/iterator/iter_scrub.c

   1 /*
   2  * iterator/iter_scrub.c - scrubbing, normalization, sanitization of DNS msgs.
   3  *
   4  * Copyright (c) 2007, NLnet Labs. All rights reserved.
   5  *
   6  * This software is open source.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  *
  12  * Redistributions of source code must retain the above copyright notice,
  13  * this list of conditions and the following disclaimer.
  14  *
  15  * Redistributions in binary form must reproduce the above copyright notice,
  16  * this list of conditions and the following disclaimer in the documentation
  17  * and/or other materials provided with the distribution.
  18  *
  19  * Neither the name of the NLNET LABS nor the names of its contributors may
  20  * be used to endorse or promote products derived from this software without
  21  * specific prior written permission.
  22  *
  23  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  24  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
  25  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  26  * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE
  27  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  28  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  29  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  30  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  31  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  32  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  33  * POSSIBILITY OF SUCH DAMAGE.
  34  */
  35
  36 /**
  37  * \file
  38  *
  39  * This file has routine(s) for cleaning up incoming DNS messages from
  40  * possible useless or malicious junk in it.
  41  */
  42 #include "config.h"
  43 #include "iterator/iter_scrub.h"
  44 #include "iterator/iterator.h"
  45 #include "iterator/iter_priv.h"
  46 #include "services/cache/rrset.h"
  47 #include "util/log.h"
  48 #include "util/net_help.h"
  49 #include "util/regional.h"
  50 #include "util/config_file.h"
  51 #include "util/module.h"
  52 #include "util/data/msgparse.h"
  53 #include "util/data/dname.h"
  54 #include "util/data/msgreply.h"
  55 #include "util/alloc.h"
  56
  57 /** RRset flag used during scrubbing. The RRset is OK. */
  58 #define RRSET_SCRUB_OK  0x80
  59
  60 /** remove rrset, update loop variables */
  61 static void
  62 remove_rrset(const char* str, ldns_buffer* pkt, struct msg_parse* msg,
  63         struct rrset_parse* prev, struct rrset_parse** rrset)
  64 {
  65         if(verbosity >= VERB_QUERY
  66                 && (*rrset)->dname_len <= LDNS_MAX_DOMAINLEN) {
  67                 uint8_t buf[LDNS_MAX_DOMAINLEN+1];
  68                 dname_pkt_copy(pkt, buf, (*rrset)->dname);
  69                 log_nametypeclass(VERB_QUERY, str, buf,
  70                         (*rrset)->type, ntohs((*rrset)->rrset_class));
  71         }
  72         if(prev)
  73                 prev->rrset_all_next = (*rrset)->rrset_all_next;
  74         else    msg->rrset_first = (*rrset)->rrset_all_next;
  75         if(msg->rrset_last == *rrset)
  76                 msg->rrset_last = prev;
  77         msg->rrset_count --;
  78         switch((*rrset)->section) {
  79                 case LDNS_SECTION_ANSWER: msg->an_rrsets--; break;
  80                 case LDNS_SECTION_AUTHORITY: msg->ns_rrsets--; break;
  81                 case LDNS_SECTION_ADDITIONAL: msg->ar_rrsets--; break;
  82                 default: log_assert(0);
  83         }
  84         msgparse_bucket_remove(msg, *rrset);
  85         *rrset = (*rrset)->rrset_all_next;
  86 }
  87
  88 /** return true if rr type has additional names in it */
  89 static int
  90 has_additional(uint16_t t)
  91 {
  92         switch(t) {
  93                 case LDNS_RR_TYPE_MB:
  94                 case LDNS_RR_TYPE_MD:
  95                 case LDNS_RR_TYPE_MF:
  96                 case LDNS_RR_TYPE_NS:
  97                 case LDNS_RR_TYPE_MX:
  98                 case LDNS_RR_TYPE_KX:
  99                 case LDNS_RR_TYPE_SRV:
 100                         return 1;
 101                 case LDNS_RR_TYPE_NAPTR:
 102                         /* TODO: NAPTR not supported, glue stripped off */
 103                         return 0;
 104         }
 105         return 0;
 106 }
 107
 108 /** get additional name from rrset RR, return false if no name present */
 109 static int
 110 get_additional_name(struct rrset_parse* rrset, struct rr_parse* rr,
 111         uint8_t** nm, size_t* nmlen, ldns_buffer* pkt)
 112 {
 113         size_t offset = 0;
 114         size_t len, oldpos;
 115         switch(rrset->type) {
 116                 case LDNS_RR_TYPE_MB:
 117                 case LDNS_RR_TYPE_MD:
 118                 case LDNS_RR_TYPE_MF:
 119                 case LDNS_RR_TYPE_NS:
 120                         offset = 0;
 121                         break;
 122                 case LDNS_RR_TYPE_MX:
 123                 case LDNS_RR_TYPE_KX:
 124                         offset = 2;
 125                         break;
 126                 case LDNS_RR_TYPE_SRV:
 127                         offset = 6;
 128                         break;
 129                 case LDNS_RR_TYPE_NAPTR:
 130                         /* TODO: NAPTR not supported, glue stripped off */
 131                         return 0;
 132                 default:
 133                         return 0;
 134         }
 135         len = ldns_read_uint16(rr->ttl_data+sizeof(uint32_t));
 136         if(len < offset+1)
 137                 return 0; /* rdata field too small */
 138         *nm = rr->ttl_data+sizeof(uint32_t)+sizeof(uint16_t)+offset;
 139         oldpos = ldns_buffer_position(pkt);
 140         ldns_buffer_set_position(pkt, (size_t)(*nm - ldns_buffer_begin(pkt)));
 141         *nmlen = pkt_dname_len(pkt);
 142         ldns_buffer_set_position(pkt, oldpos);
 143         if(*nmlen == 0)
 144                 return 0;
 145         return 1;
 146 }
 147
 148 /** Place mark on rrsets in additional section they are OK */
 149 static void
 150 mark_additional_rrset(ldns_buffer* pkt, struct msg_parse* msg,
 151         struct rrset_parse* rrset)
 152 {
 153         /* Mark A and AAAA for NS as appropriate additional section info. */
 154         uint8_t* nm = NULL;
 155         size_t nmlen = 0;
 156         struct rr_parse* rr;
 157
 158         if(!has_additional(rrset->type))
 159                 return;
 160         for(rr = rrset->rr_first; rr; rr = rr->next) {
 161                 if(get_additional_name(rrset, rr, &nm, &nmlen, pkt)) {
 162                         /* mark A */
 163                         hashvalue_t h = pkt_hash_rrset(pkt, nm, LDNS_RR_TYPE_A,
 164                                 rrset->rrset_class, 0);
 165                         struct rrset_parse* r = msgparse_hashtable_lookup(
 166                                 msg, pkt, h, 0, nm, nmlen,
 167                                 LDNS_RR_TYPE_A, rrset->rrset_class);
 168                         if(r && r->section == LDNS_SECTION_ADDITIONAL) {
 169                                 r->flags |= RRSET_SCRUB_OK;
 170                         }
 171
 172                         /* mark AAAA */
 173                         h = pkt_hash_rrset(pkt, nm, LDNS_RR_TYPE_AAAA,
 174                                 rrset->rrset_class, 0);
 175                         r = msgparse_hashtable_lookup(msg, pkt, h, 0, nm,
 176                                 nmlen, LDNS_RR_TYPE_AAAA, rrset->rrset_class);
 177                         if(r && r->section == LDNS_SECTION_ADDITIONAL) {
 178                                 r->flags |= RRSET_SCRUB_OK;
 179                         }
 180                 }
 181         }
 182 }
 183
 184 /** Get target name of a CNAME */
 185 static int
 186 parse_get_cname_target(struct rrset_parse* rrset, uint8_t** sname,
 187         size_t* snamelen)
 188 {
 189         if(rrset->rr_count != 1) {
 190                 struct rr_parse* sig;
 191                 verbose(VERB_ALGO, "Found CNAME rrset with "
 192                         "size > 1: %u", (unsigned)rrset->rr_count);
 193                 /* use the first CNAME! */
 194                 rrset->rr_count = 1;
 195                 rrset->size = rrset->rr_first->size;
 196                 for(sig=rrset->rrsig_first; sig; sig=sig->next)
 197                         rrset->size += sig->size;
 198                 rrset->rr_last = rrset->rr_first;
 199                 rrset->rr_first->next = NULL;
 200         }
 201         if(rrset->rr_first->size < sizeof(uint16_t)+1)
 202                 return 0; /* CNAME rdata too small */
 203         *sname = rrset->rr_first->ttl_data + sizeof(uint32_t)
 204                 + sizeof(uint16_t); /* skip ttl, rdatalen */
 205         *snamelen = rrset->rr_first->size - sizeof(uint16_t);
 206         return 1;
 207 }
 208
 209 /** Synthesize CNAME from DNAME, false if too long */
 210 static int
 211 synth_cname(uint8_t* qname, size_t qnamelen, struct rrset_parse* dname_rrset,
 212         uint8_t* alias, size_t* aliaslen, ldns_buffer* pkt)
 213 {
 214         /* we already know that sname is a strict subdomain of DNAME owner */
 215         uint8_t* dtarg = NULL;
 216         size_t dtarglen;
 217         if(!parse_get_cname_target(dname_rrset, &dtarg, &dtarglen))
 218                 return 0;
 219         log_assert(qnamelen > dname_rrset->dname_len);
 220         /* DNAME from com. to net. with qname example.com. -> example.net. */
 221         /* so: \3com\0 to \3net\0 and qname \7example\3com\0 */
 222         *aliaslen = qnamelen + dtarglen - dname_rrset->dname_len;
 223         if(*aliaslen > LDNS_MAX_DOMAINLEN)
 224                 return 0; /* should have been RCODE YXDOMAIN */
 225         /* decompress dnames into buffer, we know it fits */
 226         dname_pkt_copy(pkt, alias, qname);
 227         dname_pkt_copy(pkt, alias+(qnamelen-dname_rrset->dname_len), dtarg);
 228         return 1;
 229 }
 230
 231 /** synthesize a CNAME rrset */
 232 static struct rrset_parse*
 233 synth_cname_rrset(uint8_t** sname, size_t* snamelen, uint8_t* alias,
 234         size_t aliaslen, struct regional* region, struct msg_parse* msg,
 235         struct rrset_parse* rrset, struct rrset_parse* prev,
 236         struct rrset_parse* nx, ldns_buffer* pkt)
 237 {
 238         struct rrset_parse* cn = (struct rrset_parse*)regional_alloc(region,
 239                 sizeof(struct rrset_parse));
 240         if(!cn)
 241                 return NULL;
 242         memset(cn, 0, sizeof(*cn));
 243         cn->rr_first = (struct rr_parse*)regional_alloc(region,
 244                 sizeof(struct rr_parse));
 245         if(!cn->rr_first)
 246                 return NULL;
 247         cn->rr_last = cn->rr_first;
 248         /* CNAME from sname to alias */
 249         cn->dname = (uint8_t*)regional_alloc(region, *snamelen);
 250         if(!cn->dname)
 251                 return NULL;
 252         dname_pkt_copy(pkt, cn->dname, *sname);
 253         cn->dname_len = *snamelen;
 254         cn->type = LDNS_RR_TYPE_CNAME;
 255         cn->section = rrset->section;
 256         cn->rrset_class = rrset->rrset_class;
 257         cn->rr_count = 1;
 258         cn->size = sizeof(uint16_t) + aliaslen;
 259         cn->hash=pkt_hash_rrset(pkt, cn->dname, cn->type, cn->rrset_class, 0);
 260         /* allocate TTL + rdatalen + uncompressed dname */
 261         memset(cn->rr_first, 0, sizeof(struct rr_parse));
 262         cn->rr_first->outside_packet = 1;
 263         cn->rr_first->ttl_data = (uint8_t*)regional_alloc(region,
 264                 sizeof(uint32_t)+sizeof(uint16_t)+aliaslen);
 265         if(!cn->rr_first->ttl_data)
 266                 return NULL;
 267         ldns_write_uint32(cn->rr_first->ttl_data, 0); /* TTL = 0 */
 268         ldns_write_uint16(cn->rr_first->ttl_data+4, aliaslen);
 269         memmove(cn->rr_first->ttl_data+6, alias, aliaslen);
 270         cn->rr_first->size = sizeof(uint16_t)+aliaslen;
 271
 272         /* link it in */
 273         cn->rrset_all_next = nx;
 274         if(prev)
 275                 prev->rrset_all_next = cn;
 276         else    msg->rrset_first = cn;
 277         if(nx == NULL)
 278                 msg->rrset_last = cn;
 279         msg->rrset_count ++;
 280         msg->an_rrsets++;
 281         /* it is not inserted in the msg hashtable. */
 282
 283         *sname = cn->rr_first->ttl_data + sizeof(uint32_t)+sizeof(uint16_t);
 284         *snamelen = aliaslen;
 285         return cn;
 286 }
 287
 288 /** check if DNAME applies to a name */
 289 static int
 290 pkt_strict_sub(ldns_buffer* pkt, uint8_t* sname, uint8_t* dr)
 291 {
 292         uint8_t buf1[LDNS_MAX_DOMAINLEN+1];
 293         uint8_t buf2[LDNS_MAX_DOMAINLEN+1];
 294         /* decompress names */
 295         dname_pkt_copy(pkt, buf1, sname);
 296         dname_pkt_copy(pkt, buf2, dr);
 297         return dname_strict_subdomain_c(buf1, buf2);
 298 }
 299
 300 /** check subdomain with decompression */
 301 static int
 302 pkt_sub(ldns_buffer* pkt, uint8_t* comprname, uint8_t* zone)
 303 {
 304         uint8_t buf[LDNS_MAX_DOMAINLEN+1];
 305         dname_pkt_copy(pkt, buf, comprname);
 306         return dname_subdomain_c(buf, zone);
 307 }
 308
 309 /** check subdomain with decompression, compressed is parent */
 310 static int
 311 sub_of_pkt(ldns_buffer* pkt, uint8_t* zone, uint8_t* comprname)
 312 {
 313         uint8_t buf[LDNS_MAX_DOMAINLEN+1];
 314         dname_pkt_copy(pkt, buf, comprname);
 315         return dname_subdomain_c(zone, buf);
 316 }
 317
 318 /**
 319  * This routine normalizes a response. This includes removing "irrelevant"
 320  * records from the answer and additional sections and (re)synthesizing
 321  * CNAMEs from DNAMEs, if present.
 322  *
 323  * @param pkt: packet.
 324  * @param msg: msg to normalize.
 325  * @param qinfo: original query.
 326  * @param region: where to allocate synthesized CNAMEs.
 327  * @return 0 on error.
 328  */
 329 static int
 330 scrub_normalize(ldns_buffer* pkt, struct msg_parse* msg,
 331         struct query_info* qinfo, struct regional* region)
 332 {
 333         uint8_t* sname = qinfo->qname;
 334         size_t snamelen = qinfo->qname_len;
 335         struct rrset_parse* rrset, *prev, *nsset=NULL;
 336
 337         if(FLAGS_GET_RCODE(msg->flags) != LDNS_RCODE_NOERROR &&
 338                 FLAGS_GET_RCODE(msg->flags) != LDNS_RCODE_NXDOMAIN)
 339                 return 1;
 340
 341         /* For the ANSWER section, remove all "irrelevant" records and add
 342          * synthesized CNAMEs from DNAMEs
 343          * This will strip out-of-order CNAMEs as well. */
 344
 345         /* walk through the parse packet rrset list, keep track of previous
 346          * for insert and delete ease, and examine every RRset */
 347         prev = NULL;
 348         rrset = msg->rrset_first;
 349         while(rrset && rrset->section == LDNS_SECTION_ANSWER) {
 350                 if(rrset->type == LDNS_RR_TYPE_DNAME &&
 351                         pkt_strict_sub(pkt, sname, rrset->dname)) {
 352                         /* check if next rrset is correct CNAME. else,
 353                          * synthesize a CNAME */
 354                         struct rrset_parse* nx = rrset->rrset_all_next;
 355                         uint8_t alias[LDNS_MAX_DOMAINLEN+1];
 356                         size_t aliaslen = 0;
 357                         if(rrset->rr_count != 1) {
 358                                 verbose(VERB_ALGO, "Found DNAME rrset with "
 359                                         "size > 1: %u",
 360                                         (unsigned)rrset->rr_count);
 361                                 return 0;
 362                         }
 363                         if(!synth_cname(sname, snamelen, rrset, alias,
 364                                 &aliaslen, pkt)) {
 365                                 verbose(VERB_ALGO, "synthesized CNAME "
 366                                         "too long");
 367                                 return 0;
 368                         }
 369                         if(nx && nx->type == LDNS_RR_TYPE_CNAME &&
 370                            dname_pkt_compare(pkt, sname, nx->dname) == 0) {
 371                                 /* check next cname */
 372                                 uint8_t* t = NULL;
 373                                 size_t tlen = 0;
 374                                 if(!parse_get_cname_target(rrset, &t, &tlen))
 375                                         return 0;
 376                                 if(dname_pkt_compare(pkt, alias, t) == 0) {
 377                                         /* it's OK and better capitalized */
 378                                         prev = rrset;
 379                                         rrset = nx;
 380                                         continue;
 381                                 }
 382                                 /* synth ourselves */
 383                         }
 384                         /* synth a CNAME rrset */
 385                         prev = synth_cname_rrset(&sname, &snamelen, alias,
 386                                 aliaslen, region, msg, rrset, rrset, nx, pkt);
 387                         if(!prev) {
 388                                 log_err("out of memory synthesizing CNAME");
 389                                 return 0;
 390                         }
 391                         /* FIXME: resolve the conflict between synthesized
 392                          * CNAME ttls and the cache. */
 393                         rrset = nx;
 394                         continue;
 395
 396                 }
 397
 398                 /* The only records in the ANSWER section not allowed to */
 399                 if(dname_pkt_compare(pkt, sname, rrset->dname) != 0) {
 400                         remove_rrset("normalize: removing irrelevant RRset:",
 401                                 pkt, msg, prev, &rrset);
 402                         continue;
 403                 }
 404
 405                 /* Follow the CNAME chain. */
 406                 if(rrset->type == LDNS_RR_TYPE_CNAME) {
 407                         uint8_t* oldsname = sname;
 408                         if(!parse_get_cname_target(rrset, &sname, &snamelen))
 409                                 return 0;
 410                         prev = rrset;
 411                         rrset = rrset->rrset_all_next;
 412                         /* in CNAME ANY response, can have data after CNAME */
 413                         if(qinfo->qtype == LDNS_RR_TYPE_ANY) {
 414                                 while(rrset && rrset->section ==
 415                                         LDNS_SECTION_ANSWER &&
 416                                         dname_pkt_compare(pkt, oldsname,
 417                                         rrset->dname) == 0) {
 418                                         prev = rrset;
 419                                         rrset = rrset->rrset_all_next;
 420                                 }
 421                         }
 422                         continue;
 423                 }
 424
 425                 /* Otherwise, make sure that the RRset matches the qtype. */
 426                 if(qinfo->qtype != LDNS_RR_TYPE_ANY &&
 427                         qinfo->qtype != rrset->type) {
 428                         remove_rrset("normalize: removing irrelevant RRset:",
 429                                 pkt, msg, prev, &rrset);
 430                         continue;
 431                 }
 432
 433                 /* Mark the additional names from relevant rrset as OK. */
 434                 /* only for RRsets that match the query name, other ones
 435                  * will be removed by sanitize, so no additional for them */
 436                 if(dname_pkt_compare(pkt, qinfo->qname, rrset->dname) == 0)
 437                         mark_additional_rrset(pkt, msg, rrset);
 438
 439                 prev = rrset;
 440                 rrset = rrset->rrset_all_next;
 441         }
 442
 443         /* Mark additional names from AUTHORITY */
 444         while(rrset && rrset->section == LDNS_SECTION_AUTHORITY) {
 445                 if(rrset->type==LDNS_RR_TYPE_DNAME ||
 446                         rrset->type==LDNS_RR_TYPE_CNAME ||
 447                         rrset->type==LDNS_RR_TYPE_A ||
 448                         rrset->type==LDNS_RR_TYPE_AAAA) {
 449                         remove_rrset("normalize: removing irrelevant "
 450                                 "RRset:", pkt, msg, prev, &rrset);
 451                         continue;
 452                 }
 453                 /* only one NS set allowed in authority section */
 454                 if(rrset->type==LDNS_RR_TYPE_NS) {
 455                         /* NS set must be pertinent to the query */
 456                         if(!sub_of_pkt(pkt, qinfo->qname, rrset->dname)) {
 457                                 remove_rrset("normalize: removing irrelevant "
 458                                         "RRset:", pkt, msg, prev, &rrset);
 459                                 continue;
 460                         }
 461                         if(nsset == NULL) {
 462                                 nsset = rrset;
 463                         } else {
 464                                 remove_rrset("normalize: removing irrelevant "
 465                                         "RRset:", pkt, msg, prev, &rrset);
 466                                 continue;
 467                         }
 468                 }
 469                 mark_additional_rrset(pkt, msg, rrset);
 470                 prev = rrset;
 471                 rrset = rrset->rrset_all_next;
 472         }
 473
 474         /* For each record in the additional section, remove it if it is an
 475          * address record and not in the collection of additional names
 476          * found in ANSWER and AUTHORITY. */
 477         /* These records have not been marked OK previously */
 478         while(rrset && rrset->section == LDNS_SECTION_ADDITIONAL) {
 479                 /* FIXME: what about other types? */
 480                 if(rrset->type==LDNS_RR_TYPE_A ||
 481                         rrset->type==LDNS_RR_TYPE_AAAA)
 482                 {
 483                         if((rrset->flags & RRSET_SCRUB_OK)) {
 484                                 /* remove flag to clean up flags variable */
 485                                 rrset->flags &= ~RRSET_SCRUB_OK;
 486                         } else {
 487                                 remove_rrset("normalize: removing irrelevant "
 488                                         "RRset:", pkt, msg, prev, &rrset);
 489                                 continue;
 490                         }
 491                 }
 492                 if(rrset->type==LDNS_RR_TYPE_DNAME ||
 493                         rrset->type==LDNS_RR_TYPE_CNAME ||
 494                         rrset->type==LDNS_RR_TYPE_NS) {
 495                         remove_rrset("normalize: removing irrelevant "
 496                                 "RRset:", pkt, msg, prev, &rrset);
 497                         continue;
 498                 }
 499                 prev = rrset;
 500                 rrset = rrset->rrset_all_next;
 501         }
 502
 503         return 1;
 504 }
 505
 506 /**
 507  * Store potential poison in the cache (only if hardening disabled).
 508  * The rrset is stored in the cache but removed from the message.
 509  * So that it will be used for infrastructure purposes, but not be
 510  * returned to the client.
 511  * @param pkt: packet
 512  * @param msg: message parsed
 513  * @param env: environment with cache
 514  * @param rrset: to store.
 515  */
 516 static void
 517 store_rrset(ldns_buffer* pkt, struct msg_parse* msg, struct module_env* env,
 518         struct rrset_parse* rrset)
 519 {
 520         struct ub_packed_rrset_key* k;
 521         struct packed_rrset_data* d;
 522         struct rrset_ref ref;
 523         uint32_t now = *env->now;
 524
 525         k = alloc_special_obtain(env->alloc);
 526         if(!k)
 527                 return;
 528         k->entry.data = NULL;
 529         if(!parse_copy_decompress_rrset(pkt, msg, rrset, NULL, k)) {
 530                 alloc_special_release(env->alloc, k);
 531                 return;
 532         }
 533         d = (struct packed_rrset_data*)k->entry.data;
 534         packed_rrset_ttl_add(d, now);
 535         ref.key = k;
 536         ref.id = k->id;
 537         /*ignore ret: it was in the cache, ref updated */
 538         (void)rrset_cache_update(env->rrset_cache, &ref, env->alloc, now);
 539 }
 540
 541 /** Check if there are SOA records in the authority section (negative) */
 542 static int
 543 soa_in_auth(struct msg_parse* msg)
 544 {
 545         struct rrset_parse* rrset;
 546         for(rrset = msg->rrset_first; rrset; rrset = rrset->rrset_all_next)
 547                 if(rrset->type == LDNS_RR_TYPE_SOA &&
 548                         rrset->section == LDNS_SECTION_AUTHORITY)
 549                         return 1;
 550         return 0;
 551 }
 552
 553 /**
 554  * Check if right hand name in NSEC is within zone
 555  * @param rrset: the NSEC rrset
 556  * @param zonename: the zone name.
 557  * @return true if BAD.
 558  */
 559 static int sanitize_nsec_is_overreach(struct rrset_parse* rrset,
 560         uint8_t* zonename)
 561 {
 562         struct rr_parse* rr;
 563         uint8_t* rhs;
 564         size_t len;
 565         log_assert(rrset->type == LDNS_RR_TYPE_NSEC);
 566         for(rr = rrset->rr_first; rr; rr = rr->next) {
 567                 rhs = rr->ttl_data+4+2;
 568                 len = ldns_read_uint16(rr->ttl_data+4);
 569                 if(!dname_valid(rhs, len)) {
 570                         /* malformed domain name in rdata */
 571                         return 1;
 572                 }
 573                 if(!dname_subdomain_c(rhs, zonename)) {
 574                         /* overreaching */
 575                         return 1;
 576                 }
 577         }
 578         /* all NSEC RRs OK */
 579         return 0;
 580 }
 581
 582 /**
 583  * Given a response event, remove suspect RRsets from the response.
 584  * "Suspect" rrsets are potentially poison. Note that this routine expects
 585  * the response to be in a "normalized" state -- that is, all "irrelevant"
 586  * RRsets have already been removed, CNAMEs are in order, etc.
 587  *
 588  * @param pkt: packet.
 589  * @param msg: msg to normalize.
 590  * @param qinfo: the question originally asked.
 591  * @param zonename: name of server zone.
 592  * @param env: module environment with config and cache.
 593  * @param ie: iterator environment with private address data.
 594  * @return 0 on error.
 595  */
 596 static int
 597 scrub_sanitize(ldns_buffer* pkt, struct msg_parse* msg,
 598         struct query_info* qinfo, uint8_t* zonename, struct module_env* env,
 599         struct iter_env* ie)
 600 {
 601         int del_addi = 0; /* if additional-holding rrsets are deleted, we
 602                 do not trust the normalized additional-A-AAAA any more */
 603         struct rrset_parse* rrset, *prev;
 604         prev = NULL;
 605         rrset = msg->rrset_first;
 606
 607         /* the first DNAME is allowed to stay. It needs checking before
 608          * it can be used from the cache. After normalization, an initial
 609          * DNAME will have a correctly synthesized CNAME after it. */
 610         if(rrset && rrset->type == LDNS_RR_TYPE_DNAME &&
 611                 rrset->section == LDNS_SECTION_ANSWER &&
 612                 pkt_strict_sub(pkt, qinfo->qname, rrset->dname) &&
 613                 pkt_sub(pkt, rrset->dname, zonename)) {
 614                 prev = rrset; /* DNAME allowed to stay in answer section */
 615                 rrset = rrset->rrset_all_next;
 616         }
 617
 618         /* remove all records from the answer section that are
 619          * not the same domain name as the query domain name.
 620          * The answer section should contain rrsets with the same name
 621          * as the question. For DNAMEs a CNAME has been synthesized.
 622          * Wildcards have the query name in answer section.
 623          * ANY queries get query name in answer section.
 624          * Remainders of CNAME chains are cut off and resolved by iterator. */
 625         while(rrset && rrset->section == LDNS_SECTION_ANSWER) {
 626                 if(dname_pkt_compare(pkt, qinfo->qname, rrset->dname) != 0) {
 627                         if(has_additional(rrset->type)) del_addi = 1;
 628                         remove_rrset("sanitize: removing extraneous answer "
 629                                 "RRset:", pkt, msg, prev, &rrset);
 630                         continue;
 631                 }
 632                 prev = rrset;
 633                 rrset = rrset->rrset_all_next;
 634         }
 635
 636         /* At this point, we brutally remove ALL rrsets that aren't
 637          * children of the originating zone. The idea here is that,
 638          * as far as we know, the server that we contacted is ONLY
 639          * authoritative for the originating zone. It, of course, MAY
 640          * be authoriative for any other zones, and of course, MAY
 641          * NOT be authoritative for some subdomains of the originating
 642          * zone. */
 643         prev = NULL;
 644         rrset = msg->rrset_first;
 645         while(rrset) {
 646
 647                 /* remove private addresses */
 648                 if( (rrset->type == LDNS_RR_TYPE_A ||
 649                         rrset->type == LDNS_RR_TYPE_AAAA) &&
 650                         priv_rrset_bad(ie->priv, pkt, rrset)) {
 651
 652                         /* do not set servfail since this leads to too
 653                          * many drops of other people using rfc1918 space */
 654                         remove_rrset("sanitize: removing public name with "
 655                                 "private address", pkt, msg, prev, &rrset);
 656                         continue;
 657                 }
 658
 659                 /* skip DNAME records -- they will always be followed by a
 660                  * synthesized CNAME, which will be relevant.
 661                  * FIXME: should this do something differently with DNAME
 662                  * rrsets NOT in Section.ANSWER? */
 663                 /* But since DNAME records are also subdomains of the zone,
 664                  * same check can be used */
 665
 666                 if(!pkt_sub(pkt, rrset->dname, zonename)) {
 667                         if(msg->an_rrsets == 0 &&
 668                                 rrset->type == LDNS_RR_TYPE_NS &&
 669                                 rrset->section == LDNS_SECTION_AUTHORITY &&
 670                                 FLAGS_GET_RCODE(msg->flags) ==
 671                                 LDNS_RCODE_NOERROR && !soa_in_auth(msg) &&
 672                                 sub_of_pkt(pkt, zonename, rrset->dname)) {
 673                                 /* noerror, nodata and this NS rrset is above
 674                                  * the zone. This is LAME!
 675                                  * Leave in the NS for lame classification. */
 676                                 /* remove everything from the additional
 677                                  * (we dont want its glue that was approved
 678                                  * during the normalize action) */
 679                                 del_addi = 1;
 680                         } else if(!env->cfg->harden_glue) {
 681                                 /* store in cache! Since it is relevant
 682                                  * (from normalize) it will be picked up
 683                                  * from the cache to be used later */
 684                                 store_rrset(pkt, msg, env, rrset);
 685                                 remove_rrset("sanitize: storing potential "
 686                                 "poison RRset:", pkt, msg, prev, &rrset);
 687                                 continue;
 688                         } else {
 689                                 if(has_additional(rrset->type)) del_addi = 1;
 690                                 remove_rrset("sanitize: removing potential "
 691                                 "poison RRset:", pkt, msg, prev, &rrset);
 692                                 continue;
 693                         }
 694                 }
 695                 if(del_addi && rrset->section == LDNS_SECTION_ADDITIONAL) {
 696                         remove_rrset("sanitize: removing potential "
 697                         "poison reference RRset:", pkt, msg, prev, &rrset);
 698                         continue;
 699                 }
 700                 /* check if right hand side of NSEC is within zone */
 701                 if(rrset->type == LDNS_RR_TYPE_NSEC &&
 702                         sanitize_nsec_is_overreach(rrset, zonename)) {
 703                         remove_rrset("sanitize: removing overreaching NSEC "
 704                                 "RRset:", pkt, msg, prev, &rrset);
 705                         continue;
 706                 }
 707                 prev = rrset;
 708                 rrset = rrset->rrset_all_next;
 709         }
 710         return 1;
 711 }
 712
 713 int
 714 scrub_message(ldns_buffer* pkt, struct msg_parse* msg,
 715         struct query_info* qinfo, uint8_t* zonename, struct regional* region,
 716         struct module_env* env, struct iter_env* ie)
 717 {
 718         /* basic sanity checks */
 719         log_nametypeclass(VERB_ALGO, "scrub for", zonename, LDNS_RR_TYPE_NS,
 720                 qinfo->qclass);
 721         if(msg->qdcount > 1)
 722                 return 0;
 723         if( !(msg->flags&BIT_QR) )
 724                 return 0;
 725         msg->flags &= ~(BIT_AD|BIT_Z); /* force off bit AD and Z */
 726
 727         /* make sure that a query is echoed back when NOERROR or NXDOMAIN */
 728         /* this is not required for basic operation but is a forgery
 729          * resistance (security) feature */
 730         if((FLAGS_GET_RCODE(msg->flags) == LDNS_RCODE_NOERROR ||
 731                 FLAGS_GET_RCODE(msg->flags) == LDNS_RCODE_NXDOMAIN) &&
 732                 msg->qdcount == 0)
 733                 return 0;
 734
 735         /* if a query is echoed back, make sure it is correct. Otherwise,
 736          * this may be not a reply to our query. */
 737         if(msg->qdcount == 1) {
 738                 if(dname_pkt_compare(pkt, msg->qname, qinfo->qname) != 0)
 739                         return 0;
 740                 if(msg->qtype != qinfo->qtype || msg->qclass != qinfo->qclass)
 741                         return 0;
 742         }
 743
 744         /* normalize the response, this cleans up the additional.  */
 745         if(!scrub_normalize(pkt, msg, qinfo, region))
 746                 return 0;
 747         /* delete all out-of-zone information */
 748         if(!scrub_sanitize(pkt, msg, qinfo, zonename, env, ie))
 749                 return 0;
 750         return 1;
 751 }