unbound/iterator/iter_scrub.c

46 #include "services/cache/rrset.h"
61 /** remove rrset, update loop variables */
64 	struct rrset_parse* prev, struct rrset_parse** rrset)
67 		&& (*rrset)->dname_len <= LDNS_MAX_DOMAINLEN) {
69 		dname_pkt_copy(pkt, buf, (*rrset)->dname);
71 			(*rrset)->type, ntohs((*rrset)->rrset_class));
74 		prev->rrset_all_next = (*rrset)->rrset_all_next;
75 	else	msg->rrset_first = (*rrset)->rrset_all_next;
76 	if(msg->rrset_last == *rrset)
79 	switch((*rrset)->section) {
85 	msgparse_bucket_remove(msg, *rrset);
86 	*rrset = (*rrset)->rrset_all_next;
109 /** get additional name from rrset RR, return false if no name present */
111 get_additional_name(struct rrset_parse* rrset, struct rr_parse* rr,
116 	switch(rrset->type) {
152 	struct rrset_parse* rrset)
159 	if(!has_additional(rrset->type))
161 	for(rr = rrset->rr_first; rr; rr = rr->next) {
162 		if(get_additional_name(rrset, rr, &nm, &nmlen, pkt)) {
165 				rrset->rrset_class, 0);
168 				LDNS_RR_TYPE_A, rrset->rrset_class);
175 				rrset->rrset_class, 0);
177 				nmlen, LDNS_RR_TYPE_AAAA, rrset->rrset_class);
187 parse_get_cname_target(struct rrset_parse* rrset, uint8_t** sname,
190 	if(rrset->rr_count != 1) {
192 		verbose(VERB_ALGO, "Found CNAME rrset with "
193 			"size > 1: %u", (unsigned)rrset->rr_count);
195 		rrset->rr_count = 1;
196 		rrset->size = rrset->rr_first->size;
197 		for(sig=rrset->rrsig_first; sig; sig=sig->next)
198 			rrset->size += sig->size;
199 		rrset->rr_last = rrset->rr_first;
200 		rrset->rr_first->next = NULL;
202 	if(rrset->rr_first->size < sizeof(uint16_t)+1)
204 	*sname = rrset->rr_first->ttl_data + sizeof(uint32_t)
206 	*snamelen = rrset->rr_first->size - sizeof(uint16_t);
232 /** synthesize a CNAME rrset */
236 	struct rrset_parse* rrset, struct rrset_parse* prev,
256 	cn->section = rrset->section;
257 	cn->rrset_class = rrset->rrset_class;
336 	struct rrset_parse* rrset, *prev, *nsset=NULL;
346 	/* walk through the parse packet rrset list, keep track of previous
349 	rrset = msg->rrset_first;
350 	while(rrset && rrset->section == LDNS_SECTION_ANSWER) {
351 		if(rrset->type == LDNS_RR_TYPE_DNAME &&
352 			pkt_strict_sub(pkt, sname, rrset->dname)) {
353 			/* check if next rrset is correct CNAME. else,
355 			struct rrset_parse* nx = rrset->rrset_all_next;
358 			if(rrset->rr_count != 1) {
359 				verbose(VERB_ALGO, "Found DNAME rrset with "
361 					(unsigned)rrset->rr_count);
364 			if(!synth_cname(sname, snamelen, rrset, alias,
375 				if(!parse_get_cname_target(rrset, &t, &tlen))
379 					prev = rrset;
380 					rrset = nx;
385 			/* synth a CNAME rrset */
387 				aliaslen, region, msg, rrset, rrset, nx, pkt);
394 			rrset = nx;
400 		if(dname_pkt_compare(pkt, sname, rrset->dname) != 0) {
402 				pkt, msg, prev, &rrset);
407 		if(rrset->type == LDNS_RR_TYPE_CNAME) {
409 			if(!parse_get_cname_target(rrset, &sname, &snamelen))
411 			prev = rrset;
412 			rrset = rrset->rrset_all_next;
415 				while(rrset && rrset->section ==
418 					rrset->dname) == 0) {
419 					prev = rrset;
420 					rrset = rrset->rrset_all_next;
428 			qinfo->qtype != rrset->type) {
430 				pkt, msg, prev, &rrset);
434 		/* Mark the additional names from relevant rrset as OK. */
437 		if(dname_pkt_compare(pkt, qinfo->qname, rrset->dname) == 0)
438 			mark_additional_rrset(pkt, msg, rrset);
440 		prev = rrset;
441 		rrset = rrset->rrset_all_next;
445 	while(rrset && rrset->section == LDNS_SECTION_AUTHORITY) {
446 		if(rrset->type==LDNS_RR_TYPE_DNAME ||
447 			rrset->type==LDNS_RR_TYPE_CNAME ||
448 			rrset->type==LDNS_RR_TYPE_A ||
449 			rrset->type==LDNS_RR_TYPE_AAAA) {
451 				"RRset:", pkt, msg, prev, &rrset);
455 		if(rrset->type==LDNS_RR_TYPE_NS) {
457 			if(!sub_of_pkt(pkt, qinfo->qname, rrset->dname)) {
459 					"RRset:", pkt, msg, prev, &rrset);
463 				nsset = rrset;
466 					"RRset:", pkt, msg, prev, &rrset);
470 		mark_additional_rrset(pkt, msg, rrset);
471 		prev = rrset;
472 		rrset = rrset->rrset_all_next;
479 	while(rrset && rrset->section == LDNS_SECTION_ADDITIONAL) {
481 		if(rrset->type==LDNS_RR_TYPE_A ||
482 			rrset->type==LDNS_RR_TYPE_AAAA)
484 			if((rrset->flags & RRSET_SCRUB_OK)) {
486 				rrset->flags &= ~RRSET_SCRUB_OK;
489 					"RRset:", pkt, msg, prev, &rrset);
493 		if(rrset->type==LDNS_RR_TYPE_DNAME ||
494 			rrset->type==LDNS_RR_TYPE_CNAME ||
495 			rrset->type==LDNS_RR_TYPE_NS) {
497 				"RRset:", pkt, msg, prev, &rrset);
500 		prev = rrset;
501 		rrset = rrset->rrset_all_next;
509  * The rrset is stored in the cache but removed from the message.
515  * @param rrset: to store.
519 	struct rrset_parse* rrset)
530 	if(!parse_copy_decompress_rrset(pkt, msg, rrset, NULL, k)) {
546 	struct rrset_parse* rrset;
547 	for(rrset = msg->rrset_first; rrset; rrset = rrset->rrset_all_next)
548 		if(rrset->type == LDNS_RR_TYPE_SOA &&
549 			rrset->section == LDNS_SECTION_AUTHORITY)
556  * @param rrset: the NSEC rrset
560 static int sanitize_nsec_is_overreach(struct rrset_parse* rrset,
566 	log_assert(rrset->type == LDNS_RR_TYPE_NSEC);
567 	for(rr = rrset->rr_first; rr; rr = rr->next) {
604 	struct rrset_parse* rrset, *prev;
606 	rrset = msg->rrset_first;
611 	if(rrset && rrset->type == LDNS_RR_TYPE_DNAME &&
612 		rrset->section == LDNS_SECTION_ANSWER &&
613 		pkt_strict_sub(pkt, qinfo->qname, rrset->dname) &&
614 		pkt_sub(pkt, rrset->dname, zonename)) {
615 		prev = rrset; /* DNAME allowed to stay in answer section */
616 		rrset = rrset->rrset_all_next;
626 	while(rrset && rrset->section == LDNS_SECTION_ANSWER) {
627 		if(dname_pkt_compare(pkt, qinfo->qname, rrset->dname) != 0) {
628 			if(has_additional(rrset->type)) del_addi = 1;
630 				"RRset:", pkt, msg, prev, &rrset);
633 		prev = rrset;
634 		rrset = rrset->rrset_all_next;
645 	rrset = msg->rrset_first;
646 	while(rrset) {
649 		if( (rrset->type == LDNS_RR_TYPE_A ||
650 			rrset->type == LDNS_RR_TYPE_AAAA)) {
654 			/* also do not remove entire rrset, unless all records
656 			if(priv_rrset_bad(ie->priv, pkt, rrset)) {
657 				remove_rrset(NULL, pkt, msg, prev, &rrset);
669 		if(!pkt_sub(pkt, rrset->dname, zonename)) {
671 				rrset->type == LDNS_RR_TYPE_NS &&
672 				rrset->section == LDNS_SECTION_AUTHORITY &&
675 				sub_of_pkt(pkt, zonename, rrset->dname)) {
676 				/* noerror, nodata and this NS rrset is above
684 				rrset->type == LDNS_RR_TYPE_A ||
685 				rrset->type == LDNS_RR_TYPE_AAAA)) {
689 				store_rrset(pkt, msg, env, rrset);
691 				"poison RRset:", pkt, msg, prev, &rrset);
694 				if(has_additional(rrset->type)) del_addi = 1;
696 				"poison RRset:", pkt, msg, prev, &rrset);
700 		if(del_addi && rrset->section == LDNS_SECTION_ADDITIONAL) {
702 			"poison reference RRset:", pkt, msg, prev, &rrset);
706 		if(rrset->type == LDNS_RR_TYPE_NSEC &&
707 			sanitize_nsec_is_overreach(rrset, zonename)) {
709 				"RRset:", pkt, msg, prev, &rrset);
712 		prev = rrset;
713 		rrset = rrset->rrset_all_next;