1diff --git a/doc/unbound.conf.5.in b/doc/unbound.conf.5.in 2index f426ac5f..147fbfa9 100644 3--- a/doc/unbound.conf.5.in 4+++ b/doc/unbound.conf.5.in 5@@ -872,6 +872,13 @@ potentially broken nameservers. A lot of domains will not be resolvable when 6 this option in enabled. Only use if you know what you are doing. 7 This option only has effect when qname-minimisation is enabled. Default is no. 8 .TP 9+.B aaaa\-filter: \fI<yes or no> 10+Activate behavior similar to BIND's AAAA-filter. 11+This forces the dropping of all AAAA records, unless in the case of 12+explicit AAAA queries, when no A records have been confirmed. 13+This also causes an additional A query to be sent for each AAAA query. 14+This breaks DNSSEC! 15+.TP 16 .B aggressive\-nsec: \fI<yes or no> 17 Aggressive NSEC uses the DNSSEC NSEC chain to synthesize NXDOMAIN 18 and other denials, using information from previous NXDOMAINs answers. 19diff --git a/iterator/iter_scrub.c b/iterator/iter_scrub.c 20index aae934dd..55c55de0 100644 21--- a/iterator/iter_scrub.c 22+++ b/iterator/iter_scrub.c 23@@ -667,6 +667,32 @@ static int sanitize_nsec_is_overreach(struct rrset_parse* rrset, 24 return 0; 25 } 26 27+/** 28+ * ASN: Lookup A records from rrset cache. 29+ * @param qinfo: the question originally asked. 30+ * @param env: module environment with config and cache. 31+ * @param ie: iterator environment with private address data. 32+ * @return 0 if no A record found, 1 if A record found. 33+ */ 34+static int 35+asn_lookup_a_record_from_cache(struct query_info* qinfo, 36+ struct module_env* env, struct iter_env* ATTR_UNUSED(ie)) 37+{ 38+ struct ub_packed_rrset_key* akey; 39+ 40+ /* get cached A records for queried name */ 41+ akey = rrset_cache_lookup(env->rrset_cache, qinfo->qname, 42+ qinfo->qname_len, LDNS_RR_TYPE_A, qinfo->qclass, 43+ 0, *env->now, 0); 44+ if(akey) { /* we had some. */ 45+ log_rrset_key(VERB_ALGO, "ASN-AAAA-filter: found A record", 46+ akey); 47+ lock_rw_unlock(&akey->entry.lock); 48+ return 1; 49+ } 50+ return 0; 51+} 52+ 53 /** 54 * Given a response event, remove suspect RRsets from the response. 55 * "Suspect" rrsets are potentially poison. Note that this routine expects 56@@ -686,6 +712,7 @@ scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg, 57 struct query_info* qinfo, uint8_t* zonename, struct module_env* env, 58 struct iter_env* ie) 59 { 60+ int found_a_record = 0; /* ASN: do we have a A record? */ 61 int del_addi = 0; /* if additional-holding rrsets are deleted, we 62 do not trust the normalized additional-A-AAAA any more */ 63 struct rrset_parse* rrset, *prev; 64@@ -721,6 +748,13 @@ scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg, 65 rrset = rrset->rrset_all_next; 66 } 67 68+ /* ASN: Locate any A record we can find */ 69+ if((ie->aaaa_filter) && (qinfo->qtype == LDNS_RR_TYPE_AAAA)) { 70+ found_a_record = asn_lookup_a_record_from_cache(qinfo, 71+ env, ie); 72+ } 73+ /* ASN: End of added code */ 74+ 75 /* At this point, we brutally remove ALL rrsets that aren't 76 * children of the originating zone. The idea here is that, 77 * as far as we know, the server that we contacted is ONLY 78@@ -732,6 +766,24 @@ scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg, 79 rrset = msg->rrset_first; 80 while(rrset) { 81 82+ /* ASN: For AAAA records only... */ 83+ if((ie->aaaa_filter) && (rrset->type == LDNS_RR_TYPE_AAAA)) { 84+ /* ASN: If this is not a AAAA query, then remove AAAA 85+ * records, no questions asked. If this IS a AAAA query 86+ * then remove AAAA records if we have an A record. 87+ * Otherwise, leave things be. */ 88+ if((qinfo->qtype != LDNS_RR_TYPE_AAAA) || 89+ (found_a_record)) { 90+ remove_rrset("ASN-AAAA-filter: removing AAAA " 91+ "for record", pkt, msg, prev, &rrset); 92+ continue; 93+ } 94+ log_nametypeclass(VERB_ALGO, "ASN-AAAA-filter: " 95+ "keep AAAA for", zonename, 96+ LDNS_RR_TYPE_AAAA, qinfo->qclass); 97+ } 98+ /* ASN: End of added code */ 99+ 100 /* remove private addresses */ 101 if( (rrset->type == LDNS_RR_TYPE_A || 102 rrset->type == LDNS_RR_TYPE_AAAA)) { 103diff --git a/iterator/iter_utils.c b/iterator/iter_utils.c 104index 7bc67da6..e10f547a 100644 105--- a/iterator/iter_utils.c 106+++ b/iterator/iter_utils.c 107@@ -175,6 +175,7 @@ iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg) 108 } 109 iter_env->supports_ipv6 = cfg->do_ip6; 110 iter_env->supports_ipv4 = cfg->do_ip4; 111+ iter_env->aaaa_filter = cfg->aaaa_filter; 112 iter_env->outbound_msg_retry = cfg->outbound_msg_retry; 113 return 1; 114 } 115diff --git a/iterator/iterator.c b/iterator/iterator.c 116index 23b07ea9..ca29b48c 100644 117--- a/iterator/iterator.c 118+++ b/iterator/iterator.c 119@@ -2127,6 +2127,53 @@ processDSNSFind(struct module_qstate* qstate, struct iter_qstate* iq, int id) 120 121 return 0; 122 } 123+ 124+/** 125+ * ASN: This event state was added as an intermediary step between 126+ * QUERYTARGETS_STATE and the next step, in order to cast a subquery for the 127+ * purpose of caching A records for the queried name. 128+ * 129+ * @param qstate: query state. 130+ * @param iq: iterator query state. 131+ * @param ie: iterator shared global environment. 132+ * @param id: module id. 133+ * @return true if the event requires more request processing immediately, 134+ * false if not. This state only returns true when it is generating 135+ * a SERVFAIL response because the query has hit a dead end. 136+ */ 137+static int 138+asn_processQueryAAAA(struct module_qstate* qstate, struct iter_qstate* iq, 139+ struct iter_env* ATTR_UNUSED(ie), int id) 140+{ 141+ struct module_qstate* subq = NULL; 142+ 143+ log_assert(iq->fetch_a_for_aaaa == 0); 144+ 145+ /* flag the query properly in order to not loop */ 146+ iq->fetch_a_for_aaaa = 1; 147+ 148+ /* re-throw same query, but with a different type */ 149+ if(!generate_sub_request(iq->qchase.qname, 150+ iq->qchase.qname_len, LDNS_RR_TYPE_A, 151+ iq->qchase.qclass, qstate, id, iq, 152+ INIT_REQUEST_STATE, FINISHED_STATE, &subq, 1, 0)) { 153+ log_nametypeclass(VERB_ALGO, "ASN-AAAA-filter: failed " 154+ "preloading of A record for", 155+ iq->qchase.qname, LDNS_RR_TYPE_A, 156+ iq->qchase.qclass); 157+ return error_response(qstate, id, LDNS_RCODE_SERVFAIL); 158+ } 159+ log_nametypeclass(VERB_ALGO, "ASN-AAAA-filter: " 160+ "preloading records in cache for", 161+ iq->qchase.qname, LDNS_RR_TYPE_A, 162+ iq->qchase.qclass); 163+ 164+ /* set this query as waiting */ 165+ qstate->ext_state[id] = module_wait_subquery; 166+ /* at this point break loop */ 167+ return 0; 168+} 169+/* ASN: End of added code */ 170 171 /** 172 * This is the request event state where the request will be sent to one of 173@@ -2186,6 +2233,13 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq, 174 return error_response(qstate, id, LDNS_RCODE_SERVFAIL); 175 } 176 177+ /* ASN: If we have a AAAA query, then also query for A records */ 178+ if((ie->aaaa_filter) && (iq->qchase.qtype == LDNS_RR_TYPE_AAAA) && 179+ (iq->fetch_a_for_aaaa == 0)) { 180+ return next_state(iq, ASN_FETCH_A_FOR_AAAA_STATE); 181+ } 182+ /* ASN: End of added code */ 183+ 184 /* Make sure we have a delegation point, otherwise priming failed 185 * or another failure occurred */ 186 if(!iq->dp) { 187@@ -3574,6 +3628,61 @@ processFinished(struct module_qstate* qstate, struct iter_qstate* iq, 188 return 0; 189 } 190 191+/** 192+ * ASN: Do final processing on responses to A queries originated from AAAA 193+ * queries. Events reach this state after the iterative resolution algorithm 194+ * terminates. 195+ * This is required down the road to decide whether to scrub AAAA records 196+ * from the results or not. 197+ * 198+ * @param qstate: query state. 199+ * @param id: module id. 200+ * @param forq: super query state. 201+ */ 202+static void 203+asn_processAAAAResponse(struct module_qstate* qstate, int id, 204+ struct module_qstate* super) 205+{ 206+ /*struct iter_qstate* iq = (struct iter_qstate*)qstate->minfo[id];*/ 207+ struct iter_qstate* super_iq = (struct iter_qstate*)super->minfo[id]; 208+ struct delegpt_ns* dpns = NULL; 209+ int error = (qstate->return_rcode != LDNS_RCODE_NOERROR); 210+ 211+ log_assert(super_iq->fetch_a_for_aaaa > 0); 212+ 213+ /* let super go to evaluation of targets after this */ 214+ super_iq->state = QUERYTARGETS_STATE; 215+ 216+ log_query_info(VERB_ALGO, "ASN-AAAA-filter: processAAAAResponse", 217+ &qstate->qinfo); 218+ log_query_info(VERB_ALGO, "ASN-AAAA-filter: processAAAAResponse super", 219+ &super->qinfo); 220+ 221+ if(super_iq->dp) 222+ dpns = delegpt_find_ns(super_iq->dp, 223+ qstate->qinfo.qname, qstate->qinfo.qname_len); 224+ if (!dpns) { 225+ /* not interested */ 226+ verbose(VERB_ALGO, "ASN-AAAA-filter: subq: %s, but parent not " 227+ "interested%s", (error ? "error, but" : "success"), 228+ (super_iq->dp ? "anymore" : " (was reset)")); 229+ log_query_info(VERB_ALGO, "ASN-AAAA-filter: superq", &super->qinfo); 230+ if(super_iq->dp && error) 231+ delegpt_log(VERB_ALGO, super_iq->dp); 232+ return; 233+ } else if (error) { 234+ verbose(VERB_ALGO, "ASN-AAAA-filter: mark as failed, " 235+ "and go to target query."); 236+ /* see if the failure did get (parent-lame) info */ 237+ if(!cache_fill_missing(super->env, 238+ super_iq->qchase.qclass, super->region, 239+ super_iq->dp)) 240+ log_err("ASN-AAAA-filter: out of memory adding missing"); 241+ dpns->resolved = 1; /* mark as failed */ 242+ } 243+} 244+/* ASN: End of added code */ 245+ 246 /* 247 * Return priming query results to interested super querystates. 248 * 249@@ -3593,6 +3702,9 @@ iter_inform_super(struct module_qstate* qstate, int id, 250 else if(super->qinfo.qtype == LDNS_RR_TYPE_DS && ((struct iter_qstate*) 251 super->minfo[id])->state == DSNS_FIND_STATE) 252 processDSNSResponse(qstate, id, super); 253+ else if (super->qinfo.qtype == LDNS_RR_TYPE_AAAA && ((struct iter_qstate*) 254+ super->minfo[id])->state == ASN_FETCH_A_FOR_AAAA_STATE) 255+ asn_processAAAAResponse(qstate, id, super); 256 else if(qstate->return_rcode != LDNS_RCODE_NOERROR) 257 error_supers(qstate, id, super); 258 else if(qstate->is_priming) 259@@ -3630,6 +3742,9 @@ iter_handle(struct module_qstate* qstate, struct iter_qstate* iq, 260 case INIT_REQUEST_3_STATE: 261 cont = processInitRequest3(qstate, iq, id); 262 break; 263+ case ASN_FETCH_A_FOR_AAAA_STATE: 264+ cont = asn_processQueryAAAA(qstate, iq, ie, id); 265+ break; 266 case QUERYTARGETS_STATE: 267 cont = processQueryTargets(qstate, iq, ie, id); 268 break; 269@@ -3961,6 +4076,8 @@ iter_state_to_string(enum iter_state state) 270 return "INIT REQUEST STATE (stage 2)"; 271 case INIT_REQUEST_3_STATE: 272 return "INIT REQUEST STATE (stage 3)"; 273+ case ASN_FETCH_A_FOR_AAAA_STATE: 274+ return "ASN_FETCH_A_FOR_AAAA_STATE"; 275 case QUERYTARGETS_STATE : 276 return "QUERY TARGETS STATE"; 277 case PRIME_RESP_STATE : 278@@ -3985,6 +4102,7 @@ iter_state_is_responsestate(enum iter_state s) 279 case INIT_REQUEST_STATE : 280 case INIT_REQUEST_2_STATE : 281 case INIT_REQUEST_3_STATE : 282+ case ASN_FETCH_A_FOR_AAAA_STATE : 283 case QUERYTARGETS_STATE : 284 case COLLECT_CLASS_STATE : 285 return 0; 286diff --git a/iterator/iterator.h b/iterator/iterator.h 287index 342ac207..731948d1 100644 288--- a/iterator/iterator.h 289+++ b/iterator/iterator.h 290@@ -135,6 +135,9 @@ struct iter_env { 291 */ 292 int* target_fetch_policy; 293 294+ /** ASN: AAAA-filter flag */ 295+ int aaaa_filter; 296+ 297 /** lock on ratelimit counter */ 298 lock_basic_type queries_ratelimit_lock; 299 /** number of queries that have been ratelimited */ 300@@ -186,6 +189,14 @@ enum iter_state { 301 */ 302 INIT_REQUEST_3_STATE, 303 304+ /** 305+ * This state is responsible for intercepting AAAA queries, 306+ * and launch a A subquery on the same target, to populate the 307+ * cache with A records, so the AAAA filter scrubbing logic can 308+ * work. 309+ */ 310+ ASN_FETCH_A_FOR_AAAA_STATE, 311+ 312 /** 313 * Each time a delegation point changes for a given query or a 314 * query times out and/or wakes up, this state is (re)visited. 315@@ -375,6 +386,13 @@ struct iter_qstate { 316 */ 317 int refetch_glue; 318 319+ /** 320+ * ASN: This is a flag that, if true, means that this query is 321+ * for fetching A records to populate cache and determine if we must 322+ * return AAAA records or not. 323+ */ 324+ int fetch_a_for_aaaa; 325+ 326 /** list of pending queries to authoritative servers. */ 327 struct outbound_list outlist; 328 329diff --git a/pythonmod/interface.i b/pythonmod/interface.i 330index f08b575d..47f1bb2e 100644 331--- a/pythonmod/interface.i 332+++ b/pythonmod/interface.i 333@@ -975,6 +975,7 @@ struct config_file { 334 int harden_dnssec_stripped; 335 int harden_referral_path; 336 int use_caps_bits_for_id; 337+ int aaaa_filter; /* ASN */ 338 struct config_strlist* private_address; 339 struct config_strlist* private_domain; 340 size_t unwanted_threshold; 341diff --git a/util/config_file.c b/util/config_file.c 342index 0ab8614a..729fb147 100644 343--- a/util/config_file.c 344+++ b/util/config_file.c 345@@ -218,6 +218,7 @@ config_create(void) 346 cfg->harden_referral_path = 0; 347 cfg->harden_algo_downgrade = 0; 348 cfg->use_caps_bits_for_id = 0; 349+ cfg->aaaa_filter = 0; /* ASN: default is disabled */ 350 cfg->caps_whitelist = NULL; 351 cfg->private_address = NULL; 352 cfg->private_domain = NULL; 353diff --git a/util/config_file.h b/util/config_file.h 354index e61257a3..dabaa7bb 100644 355--- a/util/config_file.h 356+++ b/util/config_file.h 357@@ -260,6 +260,8 @@ struct config_file { 358 int harden_algo_downgrade; 359 /** use 0x20 bits in query as random ID bits */ 360 int use_caps_bits_for_id; 361+ /** ASN: enable AAAA filter? */ 362+ int aaaa_filter; 363 /** 0x20 whitelist, domains that do not use capsforid */ 364 struct config_strlist* caps_whitelist; 365 /** strip away these private addrs from answers, no DNS Rebinding */ 366diff --git a/util/configlexer.lex b/util/configlexer.lex 367index 79a0edca..4eaec678 100644 368--- a/util/configlexer.lex 369+++ b/util/configlexer.lex 370@@ -304,6 +304,7 @@ harden-algo-downgrade{COLON} { YDVAR(1, VAR_HARDEN_ALGO_DOWNGRADE) } 371 use-caps-for-id{COLON} { YDVAR(1, VAR_USE_CAPS_FOR_ID) } 372 caps-whitelist{COLON} { YDVAR(1, VAR_CAPS_WHITELIST) } 373 unwanted-reply-threshold{COLON} { YDVAR(1, VAR_UNWANTED_REPLY_THRESHOLD) } 374+aaaa-filter{COLON} { YDVAR(1, VAR_AAAA_FILTER) } 375 private-address{COLON} { YDVAR(1, VAR_PRIVATE_ADDRESS) } 376 private-domain{COLON} { YDVAR(1, VAR_PRIVATE_DOMAIN) } 377 prefetch-key{COLON} { YDVAR(1, VAR_PREFETCH_KEY) } 378diff --git a/util/configparser.y b/util/configparser.y 379index 1d0e8658..f284dd43 100644 380--- a/util/configparser.y 381+++ b/util/configparser.y 382@@ -97,6 +97,7 @@ extern struct config_parser_state* cfg_parser; 383 %token VAR_STATISTICS_CUMULATIVE VAR_OUTGOING_PORT_PERMIT 384 %token VAR_OUTGOING_PORT_AVOID VAR_DLV_ANCHOR_FILE VAR_DLV_ANCHOR 385 %token VAR_NEG_CACHE_SIZE VAR_HARDEN_REFERRAL_PATH VAR_PRIVATE_ADDRESS 386+%token VAR_AAAA_FILTER 387 %token VAR_PRIVATE_DOMAIN VAR_REMOTE_CONTROL VAR_CONTROL_ENABLE 388 %token VAR_CONTROL_INTERFACE VAR_CONTROL_PORT VAR_SERVER_KEY_FILE 389 %token VAR_SERVER_CERT_FILE VAR_CONTROL_KEY_FILE VAR_CONTROL_CERT_FILE 390@@ -244,6 +244,7 @@ content_server: server_num_threads | server_verbosity | server_port | 391 server_dlv_anchor_file | server_dlv_anchor | server_neg_cache_size | 392 server_harden_referral_path | server_private_address | 393 server_private_domain | server_extended_statistics | 394+ server_aaaa_filter | 395 server_local_data_ptr | server_jostle_timeout | 396 server_unwanted_reply_threshold | server_log_time_ascii | 397 398@@ -1742,6 +1744,15 @@ server_caps_whitelist: VAR_CAPS_WHITELIST STRING_ARG 399 yyerror("out of memory"); 400 } 401 ; 402+server_aaaa_filter: VAR_AAAA_FILTER STRING_ARG 403+ { 404+ OUTYY(("P(server_aaaa_filter:%s)\n", $2)); 405+ if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0) 406+ yyerror("expected yes or no."); 407+ else cfg_parser->cfg->aaaa_filter = (strcmp($2, "yes")==0); 408+ free($2); 409+ } 410+ ; 411 server_private_address: VAR_PRIVATE_ADDRESS STRING_ARG 412 { 413 OUTYY(("P(server_private_address:%s)\n", $2)); 414