xref: /freebsd/contrib/unbound/iterator/iter_scrub.c (revision 5ab1c5846ff41be24b1f6beb0317bf8258cd4409)
1 /*
2  * iterator/iter_scrub.c - scrubbing, normalization, sanitization of DNS msgs.
3  *
4  * Copyright (c) 2007, NLnet Labs. All rights reserved.
5  *
6  * This software is open source.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  *
12  * Redistributions of source code must retain the above copyright notice,
13  * this list of conditions and the following disclaimer.
14  *
15  * Redistributions in binary form must reproduce the above copyright notice,
16  * this list of conditions and the following disclaimer in the documentation
17  * and/or other materials provided with the distribution.
18  *
19  * Neither the name of the NLNET LABS nor the names of its contributors may
20  * be used to endorse or promote products derived from this software without
21  * specific prior written permission.
22  *
23  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
24  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
25  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
26  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
27  * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
28  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
29  * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
30  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
31  * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
32  * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
33  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
34  */
35 
36 /**
37  * \file
38  *
39  * This file has routine(s) for cleaning up incoming DNS messages from
40  * possible useless or malicious junk in it.
41  */
42 #include "config.h"
43 #include "iterator/iter_scrub.h"
44 #include "iterator/iterator.h"
45 #include "iterator/iter_priv.h"
46 #include "services/cache/rrset.h"
47 #include "util/log.h"
48 #include "util/net_help.h"
49 #include "util/regional.h"
50 #include "util/config_file.h"
51 #include "util/module.h"
52 #include "util/data/msgparse.h"
53 #include "util/data/dname.h"
54 #include "util/data/msgreply.h"
55 #include "util/alloc.h"
56 #include "sldns/sbuffer.h"
57 
58 /** RRset flag used during scrubbing. The RRset is OK. */
59 #define RRSET_SCRUB_OK	0x80
60 
61 /** remove rrset, update loop variables */
62 static void
63 remove_rrset(const char* str, sldns_buffer* pkt, struct msg_parse* msg,
64 	struct rrset_parse* prev, struct rrset_parse** rrset)
65 {
66 	if(verbosity >= VERB_QUERY && str
67 		&& (*rrset)->dname_len <= LDNS_MAX_DOMAINLEN) {
68 		uint8_t buf[LDNS_MAX_DOMAINLEN+1];
69 		dname_pkt_copy(pkt, buf, (*rrset)->dname);
70 		log_nametypeclass(VERB_QUERY, str, buf,
71 			(*rrset)->type, ntohs((*rrset)->rrset_class));
72 	}
73 	if(prev)
74 		prev->rrset_all_next = (*rrset)->rrset_all_next;
75 	else	msg->rrset_first = (*rrset)->rrset_all_next;
76 	if(msg->rrset_last == *rrset)
77 		msg->rrset_last = prev;
78 	msg->rrset_count --;
79 	switch((*rrset)->section) {
80 		case LDNS_SECTION_ANSWER: msg->an_rrsets--; break;
81 		case LDNS_SECTION_AUTHORITY: msg->ns_rrsets--; break;
82 		case LDNS_SECTION_ADDITIONAL: msg->ar_rrsets--; break;
83 		default: log_assert(0);
84 	}
85 	msgparse_bucket_remove(msg, *rrset);
86 	*rrset = (*rrset)->rrset_all_next;
87 }
88 
89 /** return true if rr type has additional names in it */
90 static int
91 has_additional(uint16_t t)
92 {
93 	switch(t) {
94 		case LDNS_RR_TYPE_MB:
95 		case LDNS_RR_TYPE_MD:
96 		case LDNS_RR_TYPE_MF:
97 		case LDNS_RR_TYPE_NS:
98 		case LDNS_RR_TYPE_MX:
99 		case LDNS_RR_TYPE_KX:
100 		case LDNS_RR_TYPE_SRV:
101 			return 1;
102 		case LDNS_RR_TYPE_NAPTR:
103 			/* TODO: NAPTR not supported, glue stripped off */
104 			return 0;
105 	}
106 	return 0;
107 }
108 
109 /** get additional name from rrset RR, return false if no name present */
110 static int
111 get_additional_name(struct rrset_parse* rrset, struct rr_parse* rr,
112 	uint8_t** nm, size_t* nmlen, sldns_buffer* pkt)
113 {
114 	size_t offset = 0;
115 	size_t len, oldpos;
116 	switch(rrset->type) {
117 		case LDNS_RR_TYPE_MB:
118 		case LDNS_RR_TYPE_MD:
119 		case LDNS_RR_TYPE_MF:
120 		case LDNS_RR_TYPE_NS:
121 			offset = 0;
122 			break;
123 		case LDNS_RR_TYPE_MX:
124 		case LDNS_RR_TYPE_KX:
125 			offset = 2;
126 			break;
127 		case LDNS_RR_TYPE_SRV:
128 			offset = 6;
129 			break;
130 		case LDNS_RR_TYPE_NAPTR:
131 			/* TODO: NAPTR not supported, glue stripped off */
132 			return 0;
133 		default:
134 			return 0;
135 	}
136 	len = sldns_read_uint16(rr->ttl_data+sizeof(uint32_t));
137 	if(len < offset+1)
138 		return 0; /* rdata field too small */
139 	*nm = rr->ttl_data+sizeof(uint32_t)+sizeof(uint16_t)+offset;
140 	oldpos = sldns_buffer_position(pkt);
141 	sldns_buffer_set_position(pkt, (size_t)(*nm - sldns_buffer_begin(pkt)));
142 	*nmlen = pkt_dname_len(pkt);
143 	sldns_buffer_set_position(pkt, oldpos);
144 	if(*nmlen == 0)
145 		return 0;
146 	return 1;
147 }
148 
149 /** Place mark on rrsets in additional section they are OK */
150 static void
151 mark_additional_rrset(sldns_buffer* pkt, struct msg_parse* msg,
152 	struct rrset_parse* rrset)
153 {
154 	/* Mark A and AAAA for NS as appropriate additional section info. */
155 	uint8_t* nm = NULL;
156 	size_t nmlen = 0;
157 	struct rr_parse* rr;
158 
159 	if(!has_additional(rrset->type))
160 		return;
161 	for(rr = rrset->rr_first; rr; rr = rr->next) {
162 		if(get_additional_name(rrset, rr, &nm, &nmlen, pkt)) {
163 			/* mark A */
164 			hashvalue_type h = pkt_hash_rrset(pkt, nm,
165 				LDNS_RR_TYPE_A, rrset->rrset_class, 0);
166 			struct rrset_parse* r = msgparse_hashtable_lookup(
167 				msg, pkt, h, 0, nm, nmlen,
168 				LDNS_RR_TYPE_A, rrset->rrset_class);
169 			if(r && r->section == LDNS_SECTION_ADDITIONAL) {
170 				r->flags |= RRSET_SCRUB_OK;
171 			}
172 
173 			/* mark AAAA */
174 			h = pkt_hash_rrset(pkt, nm, LDNS_RR_TYPE_AAAA,
175 				rrset->rrset_class, 0);
176 			r = msgparse_hashtable_lookup(msg, pkt, h, 0, nm,
177 				nmlen, LDNS_RR_TYPE_AAAA, rrset->rrset_class);
178 			if(r && r->section == LDNS_SECTION_ADDITIONAL) {
179 				r->flags |= RRSET_SCRUB_OK;
180 			}
181 		}
182 	}
183 }
184 
185 /** Get target name of a CNAME */
186 static int
187 parse_get_cname_target(struct rrset_parse* rrset, uint8_t** sname,
188 	size_t* snamelen)
189 {
190 	if(rrset->rr_count != 1) {
191 		struct rr_parse* sig;
192 		verbose(VERB_ALGO, "Found CNAME rrset with "
193 			"size > 1: %u", (unsigned)rrset->rr_count);
194 		/* use the first CNAME! */
195 		rrset->rr_count = 1;
196 		rrset->size = rrset->rr_first->size;
197 		for(sig=rrset->rrsig_first; sig; sig=sig->next)
198 			rrset->size += sig->size;
199 		rrset->rr_last = rrset->rr_first;
200 		rrset->rr_first->next = NULL;
201 	}
202 	if(rrset->rr_first->size < sizeof(uint16_t)+1)
203 		return 0; /* CNAME rdata too small */
204 	*sname = rrset->rr_first->ttl_data + sizeof(uint32_t)
205 		+ sizeof(uint16_t); /* skip ttl, rdatalen */
206 	*snamelen = rrset->rr_first->size - sizeof(uint16_t);
207 	return 1;
208 }
209 
210 /** Synthesize CNAME from DNAME, false if too long */
211 static int
212 synth_cname(uint8_t* qname, size_t qnamelen, struct rrset_parse* dname_rrset,
213 	uint8_t* alias, size_t* aliaslen, sldns_buffer* pkt)
214 {
215 	/* we already know that sname is a strict subdomain of DNAME owner */
216 	uint8_t* dtarg = NULL;
217 	size_t dtarglen;
218 	if(!parse_get_cname_target(dname_rrset, &dtarg, &dtarglen))
219 		return 0;
220 	log_assert(qnamelen > dname_rrset->dname_len);
221 	/* DNAME from com. to net. with qname example.com. -> example.net. */
222 	/* so: \3com\0 to \3net\0 and qname \7example\3com\0 */
223 	*aliaslen = qnamelen + dtarglen - dname_rrset->dname_len;
224 	if(*aliaslen > LDNS_MAX_DOMAINLEN)
225 		return 0; /* should have been RCODE YXDOMAIN */
226 	/* decompress dnames into buffer, we know it fits */
227 	dname_pkt_copy(pkt, alias, qname);
228 	dname_pkt_copy(pkt, alias+(qnamelen-dname_rrset->dname_len), dtarg);
229 	return 1;
230 }
231 
232 /** synthesize a CNAME rrset */
233 static struct rrset_parse*
234 synth_cname_rrset(uint8_t** sname, size_t* snamelen, uint8_t* alias,
235 	size_t aliaslen, struct regional* region, struct msg_parse* msg,
236 	struct rrset_parse* rrset, struct rrset_parse* prev,
237 	struct rrset_parse* nx, sldns_buffer* pkt)
238 {
239 	struct rrset_parse* cn = (struct rrset_parse*)regional_alloc(region,
240 		sizeof(struct rrset_parse));
241 	if(!cn)
242 		return NULL;
243 	memset(cn, 0, sizeof(*cn));
244 	cn->rr_first = (struct rr_parse*)regional_alloc(region,
245 		sizeof(struct rr_parse));
246 	if(!cn->rr_first)
247 		return NULL;
248 	cn->rr_last = cn->rr_first;
249 	/* CNAME from sname to alias */
250 	cn->dname = (uint8_t*)regional_alloc(region, *snamelen);
251 	if(!cn->dname)
252 		return NULL;
253 	dname_pkt_copy(pkt, cn->dname, *sname);
254 	cn->dname_len = *snamelen;
255 	cn->type = LDNS_RR_TYPE_CNAME;
256 	cn->section = rrset->section;
257 	cn->rrset_class = rrset->rrset_class;
258 	cn->rr_count = 1;
259 	cn->size = sizeof(uint16_t) + aliaslen;
260 	cn->hash=pkt_hash_rrset(pkt, cn->dname, cn->type, cn->rrset_class, 0);
261 	/* allocate TTL + rdatalen + uncompressed dname */
262 	memset(cn->rr_first, 0, sizeof(struct rr_parse));
263 	cn->rr_first->outside_packet = 1;
264 	cn->rr_first->ttl_data = (uint8_t*)regional_alloc(region,
265 		sizeof(uint32_t)+sizeof(uint16_t)+aliaslen);
266 	if(!cn->rr_first->ttl_data)
267 		return NULL;
268 	sldns_write_uint32(cn->rr_first->ttl_data, 0); /* TTL = 0 */
269 	sldns_write_uint16(cn->rr_first->ttl_data+4, aliaslen);
270 	memmove(cn->rr_first->ttl_data+6, alias, aliaslen);
271 	cn->rr_first->size = sizeof(uint16_t)+aliaslen;
272 
273 	/* link it in */
274 	cn->rrset_all_next = nx;
275 	if(prev)
276 		prev->rrset_all_next = cn;
277 	else	msg->rrset_first = cn;
278 	if(nx == NULL)
279 		msg->rrset_last = cn;
280 	msg->rrset_count ++;
281 	msg->an_rrsets++;
282 	/* it is not inserted in the msg hashtable. */
283 
284 	*sname = cn->rr_first->ttl_data + sizeof(uint32_t)+sizeof(uint16_t);
285 	*snamelen = aliaslen;
286 	return cn;
287 }
288 
289 /** check if DNAME applies to a name */
290 static int
291 pkt_strict_sub(sldns_buffer* pkt, uint8_t* sname, uint8_t* dr)
292 {
293 	uint8_t buf1[LDNS_MAX_DOMAINLEN+1];
294 	uint8_t buf2[LDNS_MAX_DOMAINLEN+1];
295 	/* decompress names */
296 	dname_pkt_copy(pkt, buf1, sname);
297 	dname_pkt_copy(pkt, buf2, dr);
298 	return dname_strict_subdomain_c(buf1, buf2);
299 }
300 
301 /** check subdomain with decompression */
302 static int
303 pkt_sub(sldns_buffer* pkt, uint8_t* comprname, uint8_t* zone)
304 {
305 	uint8_t buf[LDNS_MAX_DOMAINLEN+1];
306 	dname_pkt_copy(pkt, buf, comprname);
307 	return dname_subdomain_c(buf, zone);
308 }
309 
310 /** check subdomain with decompression, compressed is parent */
311 static int
312 sub_of_pkt(sldns_buffer* pkt, uint8_t* zone, uint8_t* comprname)
313 {
314 	uint8_t buf[LDNS_MAX_DOMAINLEN+1];
315 	dname_pkt_copy(pkt, buf, comprname);
316 	return dname_subdomain_c(zone, buf);
317 }
318 
319 /** Check if there are SOA records in the authority section (negative) */
320 static int
321 soa_in_auth(struct msg_parse* msg)
322 {
323 	struct rrset_parse* rrset;
324 	for(rrset = msg->rrset_first; rrset; rrset = rrset->rrset_all_next)
325 		if(rrset->type == LDNS_RR_TYPE_SOA &&
326 			rrset->section == LDNS_SECTION_AUTHORITY)
327 			return 1;
328 	return 0;
329 }
330 
331 /**
332  * This routine normalizes a response. This includes removing "irrelevant"
333  * records from the answer and additional sections and (re)synthesizing
334  * CNAMEs from DNAMEs, if present.
335  *
336  * @param pkt: packet.
337  * @param msg: msg to normalize.
338  * @param qinfo: original query.
339  * @param region: where to allocate synthesized CNAMEs.
340  * @return 0 on error.
341  */
342 static int
343 scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
344 	struct query_info* qinfo, struct regional* region)
345 {
346 	uint8_t* sname = qinfo->qname;
347 	size_t snamelen = qinfo->qname_len;
348 	struct rrset_parse* rrset, *prev, *nsset=NULL;
349 
350 	if(FLAGS_GET_RCODE(msg->flags) != LDNS_RCODE_NOERROR &&
351 		FLAGS_GET_RCODE(msg->flags) != LDNS_RCODE_NXDOMAIN)
352 		return 1;
353 
354 	/* For the ANSWER section, remove all "irrelevant" records and add
355 	 * synthesized CNAMEs from DNAMEs
356 	 * This will strip out-of-order CNAMEs as well. */
357 
358 	/* walk through the parse packet rrset list, keep track of previous
359 	 * for insert and delete ease, and examine every RRset */
360 	prev = NULL;
361 	rrset = msg->rrset_first;
362 	while(rrset && rrset->section == LDNS_SECTION_ANSWER) {
363 		if(rrset->type == LDNS_RR_TYPE_DNAME &&
364 			pkt_strict_sub(pkt, sname, rrset->dname)) {
365 			/* check if next rrset is correct CNAME. else,
366 			 * synthesize a CNAME */
367 			struct rrset_parse* nx = rrset->rrset_all_next;
368 			uint8_t alias[LDNS_MAX_DOMAINLEN+1];
369 			size_t aliaslen = 0;
370 			if(rrset->rr_count != 1) {
371 				verbose(VERB_ALGO, "Found DNAME rrset with "
372 					"size > 1: %u",
373 					(unsigned)rrset->rr_count);
374 				return 0;
375 			}
376 			if(!synth_cname(sname, snamelen, rrset, alias,
377 				&aliaslen, pkt)) {
378 				verbose(VERB_ALGO, "synthesized CNAME "
379 					"too long");
380 				return 0;
381 			}
382 			if(nx && nx->type == LDNS_RR_TYPE_CNAME &&
383 			   dname_pkt_compare(pkt, sname, nx->dname) == 0) {
384 				/* check next cname */
385 				uint8_t* t = NULL;
386 				size_t tlen = 0;
387 				if(!parse_get_cname_target(nx, &t, &tlen))
388 					return 0;
389 				if(dname_pkt_compare(pkt, alias, t) == 0) {
390 					/* it's OK and better capitalized */
391 					prev = rrset;
392 					rrset = nx;
393 					continue;
394 				}
395 				/* synth ourselves */
396 			}
397 			/* synth a CNAME rrset */
398 			prev = synth_cname_rrset(&sname, &snamelen, alias,
399 				aliaslen, region, msg, rrset, rrset, nx, pkt);
400 			if(!prev) {
401 				log_err("out of memory synthesizing CNAME");
402 				return 0;
403 			}
404 			/* FIXME: resolve the conflict between synthesized
405 			 * CNAME ttls and the cache. */
406 			rrset = nx;
407 			continue;
408 
409 		}
410 
411 		/* The only records in the ANSWER section not allowed to */
412 		if(dname_pkt_compare(pkt, sname, rrset->dname) != 0) {
413 			remove_rrset("normalize: removing irrelevant RRset:",
414 				pkt, msg, prev, &rrset);
415 			continue;
416 		}
417 
418 		/* Follow the CNAME chain. */
419 		if(rrset->type == LDNS_RR_TYPE_CNAME) {
420 			struct rrset_parse* nx = rrset->rrset_all_next;
421 			uint8_t* oldsname = sname;
422 			/* see if the next one is a DNAME, if so, swap them */
423 			if(nx && nx->section == LDNS_SECTION_ANSWER &&
424 				nx->type == LDNS_RR_TYPE_DNAME &&
425 				nx->rr_count == 1 &&
426 				pkt_strict_sub(pkt, sname, nx->dname)) {
427 				/* there is a DNAME after this CNAME, it
428 				 * is in the ANSWER section, and the DNAME
429 				 * applies to the name we cover */
430 				/* check if the alias of the DNAME equals
431 				 * this CNAME */
432 				uint8_t alias[LDNS_MAX_DOMAINLEN+1];
433 				size_t aliaslen = 0;
434 				uint8_t* t = NULL;
435 				size_t tlen = 0;
436 				if(synth_cname(sname, snamelen, nx, alias,
437 					&aliaslen, pkt) &&
438 					parse_get_cname_target(rrset, &t, &tlen) &&
439 			   		dname_pkt_compare(pkt, alias, t) == 0) {
440 					/* the synthesized CNAME equals the
441 					 * current CNAME.  This CNAME is the
442 					 * one that the DNAME creates, and this
443 					 * CNAME is better capitalised */
444 					verbose(VERB_ALGO, "normalize: re-order of DNAME and its CNAME");
445 					if(prev) prev->rrset_all_next = nx;
446 					else msg->rrset_first = nx;
447 					if(nx->rrset_all_next == NULL)
448 						msg->rrset_last = rrset;
449 					rrset->rrset_all_next =
450 						nx->rrset_all_next;
451 					nx->rrset_all_next = rrset;
452 					/* prev = nx; unused, enable if there
453 					 * is other rrset removal code after
454 					 * this */
455 				}
456 			}
457 
458 			/* move to next name in CNAME chain */
459 			if(!parse_get_cname_target(rrset, &sname, &snamelen))
460 				return 0;
461 			prev = rrset;
462 			rrset = rrset->rrset_all_next;
463 			/* in CNAME ANY response, can have data after CNAME */
464 			if(qinfo->qtype == LDNS_RR_TYPE_ANY) {
465 				while(rrset && rrset->section ==
466 					LDNS_SECTION_ANSWER &&
467 					dname_pkt_compare(pkt, oldsname,
468 					rrset->dname) == 0) {
469 					prev = rrset;
470 					rrset = rrset->rrset_all_next;
471 				}
472 			}
473 			continue;
474 		}
475 
476 		/* Otherwise, make sure that the RRset matches the qtype. */
477 		if(qinfo->qtype != LDNS_RR_TYPE_ANY &&
478 			qinfo->qtype != rrset->type) {
479 			remove_rrset("normalize: removing irrelevant RRset:",
480 				pkt, msg, prev, &rrset);
481 			continue;
482 		}
483 
484 		/* Mark the additional names from relevant rrset as OK. */
485 		/* only for RRsets that match the query name, other ones
486 		 * will be removed by sanitize, so no additional for them */
487 		if(dname_pkt_compare(pkt, qinfo->qname, rrset->dname) == 0)
488 			mark_additional_rrset(pkt, msg, rrset);
489 
490 		prev = rrset;
491 		rrset = rrset->rrset_all_next;
492 	}
493 
494 	/* Mark additional names from AUTHORITY */
495 	while(rrset && rrset->section == LDNS_SECTION_AUTHORITY) {
496 		if(rrset->type==LDNS_RR_TYPE_DNAME ||
497 			rrset->type==LDNS_RR_TYPE_CNAME ||
498 			rrset->type==LDNS_RR_TYPE_A ||
499 			rrset->type==LDNS_RR_TYPE_AAAA) {
500 			remove_rrset("normalize: removing irrelevant "
501 				"RRset:", pkt, msg, prev, &rrset);
502 			continue;
503 		}
504 		/* only one NS set allowed in authority section */
505 		if(rrset->type==LDNS_RR_TYPE_NS) {
506 			/* NS set must be pertinent to the query */
507 			if(!sub_of_pkt(pkt, qinfo->qname, rrset->dname)) {
508 				remove_rrset("normalize: removing irrelevant "
509 					"RRset:", pkt, msg, prev, &rrset);
510 				continue;
511 			}
512 			/* we don't want NS sets for NXDOMAIN answers,
513 			 * because they could contain poisonous contents,
514 			 * from. eg. fragmentation attacks, inserted after
515 			 * long RRSIGs in the packet get to the packet
516 			 * border and such */
517 			/* also for NODATA answers */
518 			if(FLAGS_GET_RCODE(msg->flags) == LDNS_RCODE_NXDOMAIN ||
519 			   (FLAGS_GET_RCODE(msg->flags) == LDNS_RCODE_NOERROR
520 			    && soa_in_auth(msg) && msg->an_rrsets == 0)) {
521 				remove_rrset("normalize: removing irrelevant "
522 					"RRset:", pkt, msg, prev, &rrset);
523 				continue;
524 			}
525 			if(nsset == NULL) {
526 				nsset = rrset;
527 			} else {
528 				remove_rrset("normalize: removing irrelevant "
529 					"RRset:", pkt, msg, prev, &rrset);
530 				continue;
531 			}
532 		}
533 		/* if this is type DS and we query for type DS we just got
534 		 * a referral answer for our type DS query, fix packet */
535 		if(rrset->type==LDNS_RR_TYPE_DS &&
536 			qinfo->qtype == LDNS_RR_TYPE_DS &&
537 			dname_pkt_compare(pkt, qinfo->qname, rrset->dname) == 0) {
538 			rrset->section = LDNS_SECTION_ANSWER;
539 			msg->ancount = rrset->rr_count + rrset->rrsig_count;
540 			msg->nscount = 0;
541 			msg->arcount = 0;
542 			msg->an_rrsets = 1;
543 			msg->ns_rrsets = 0;
544 			msg->ar_rrsets = 0;
545 			msg->rrset_count = 1;
546 			msg->rrset_first = rrset;
547 			msg->rrset_last = rrset;
548 			rrset->rrset_all_next = NULL;
549 			return 1;
550 		}
551 		mark_additional_rrset(pkt, msg, rrset);
552 		prev = rrset;
553 		rrset = rrset->rrset_all_next;
554 	}
555 
556 	/* For each record in the additional section, remove it if it is an
557 	 * address record and not in the collection of additional names
558 	 * found in ANSWER and AUTHORITY. */
559 	/* These records have not been marked OK previously */
560 	while(rrset && rrset->section == LDNS_SECTION_ADDITIONAL) {
561 		/* FIXME: what about other types? */
562 		if(rrset->type==LDNS_RR_TYPE_A ||
563 			rrset->type==LDNS_RR_TYPE_AAAA)
564 		{
565 			if((rrset->flags & RRSET_SCRUB_OK)) {
566 				/* remove flag to clean up flags variable */
567 				rrset->flags &= ~RRSET_SCRUB_OK;
568 			} else {
569 				remove_rrset("normalize: removing irrelevant "
570 					"RRset:", pkt, msg, prev, &rrset);
571 				continue;
572 			}
573 		}
574 		if(rrset->type==LDNS_RR_TYPE_DNAME ||
575 			rrset->type==LDNS_RR_TYPE_CNAME ||
576 			rrset->type==LDNS_RR_TYPE_NS) {
577 			remove_rrset("normalize: removing irrelevant "
578 				"RRset:", pkt, msg, prev, &rrset);
579 			continue;
580 		}
581 		prev = rrset;
582 		rrset = rrset->rrset_all_next;
583 	}
584 
585 	return 1;
586 }
587 
588 /**
589  * Store potential poison in the cache (only if hardening disabled).
590  * The rrset is stored in the cache but removed from the message.
591  * So that it will be used for infrastructure purposes, but not be
592  * returned to the client.
593  * @param pkt: packet
594  * @param msg: message parsed
595  * @param env: environment with cache
596  * @param rrset: to store.
597  */
598 static void
599 store_rrset(sldns_buffer* pkt, struct msg_parse* msg, struct module_env* env,
600 	struct rrset_parse* rrset)
601 {
602 	struct ub_packed_rrset_key* k;
603 	struct packed_rrset_data* d;
604 	struct rrset_ref ref;
605 	time_t now = *env->now;
606 
607 	k = alloc_special_obtain(env->alloc);
608 	if(!k)
609 		return;
610 	k->entry.data = NULL;
611 	if(!parse_copy_decompress_rrset(pkt, msg, rrset, NULL, k)) {
612 		alloc_special_release(env->alloc, k);
613 		return;
614 	}
615 	d = (struct packed_rrset_data*)k->entry.data;
616 	packed_rrset_ttl_add(d, now);
617 	ref.key = k;
618 	ref.id = k->id;
619 	/*ignore ret: it was in the cache, ref updated */
620 	(void)rrset_cache_update(env->rrset_cache, &ref, env->alloc, now);
621 }
622 
623 /**
624  * Check if right hand name in NSEC is within zone
625  * @param rrset: the NSEC rrset
626  * @param zonename: the zone name.
627  * @return true if BAD.
628  */
629 static int sanitize_nsec_is_overreach(struct rrset_parse* rrset,
630 	uint8_t* zonename)
631 {
632 	struct rr_parse* rr;
633 	uint8_t* rhs;
634 	size_t len;
635 	log_assert(rrset->type == LDNS_RR_TYPE_NSEC);
636 	for(rr = rrset->rr_first; rr; rr = rr->next) {
637 		rhs = rr->ttl_data+4+2;
638 		len = sldns_read_uint16(rr->ttl_data+4);
639 		if(!dname_valid(rhs, len)) {
640 			/* malformed domain name in rdata */
641 			return 1;
642 		}
643 		if(!dname_subdomain_c(rhs, zonename)) {
644 			/* overreaching */
645 			return 1;
646 		}
647 	}
648 	/* all NSEC RRs OK */
649 	return 0;
650 }
651 
652 /**
653  * Given a response event, remove suspect RRsets from the response.
654  * "Suspect" rrsets are potentially poison. Note that this routine expects
655  * the response to be in a "normalized" state -- that is, all "irrelevant"
656  * RRsets have already been removed, CNAMEs are in order, etc.
657  *
658  * @param pkt: packet.
659  * @param msg: msg to normalize.
660  * @param qinfo: the question originally asked.
661  * @param zonename: name of server zone.
662  * @param env: module environment with config and cache.
663  * @param ie: iterator environment with private address data.
664  * @return 0 on error.
665  */
666 static int
667 scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg,
668 	struct query_info* qinfo, uint8_t* zonename, struct module_env* env,
669 	struct iter_env* ie)
670 {
671 	int del_addi = 0; /* if additional-holding rrsets are deleted, we
672 		do not trust the normalized additional-A-AAAA any more */
673 	struct rrset_parse* rrset, *prev;
674 	prev = NULL;
675 	rrset = msg->rrset_first;
676 
677 	/* the first DNAME is allowed to stay. It needs checking before
678 	 * it can be used from the cache. After normalization, an initial
679 	 * DNAME will have a correctly synthesized CNAME after it. */
680 	if(rrset && rrset->type == LDNS_RR_TYPE_DNAME &&
681 		rrset->section == LDNS_SECTION_ANSWER &&
682 		pkt_strict_sub(pkt, qinfo->qname, rrset->dname) &&
683 		pkt_sub(pkt, rrset->dname, zonename)) {
684 		prev = rrset; /* DNAME allowed to stay in answer section */
685 		rrset = rrset->rrset_all_next;
686 	}
687 
688 	/* remove all records from the answer section that are
689 	 * not the same domain name as the query domain name.
690 	 * The answer section should contain rrsets with the same name
691 	 * as the question. For DNAMEs a CNAME has been synthesized.
692 	 * Wildcards have the query name in answer section.
693 	 * ANY queries get query name in answer section.
694 	 * Remainders of CNAME chains are cut off and resolved by iterator. */
695 	while(rrset && rrset->section == LDNS_SECTION_ANSWER) {
696 		if(dname_pkt_compare(pkt, qinfo->qname, rrset->dname) != 0) {
697 			if(has_additional(rrset->type)) del_addi = 1;
698 			remove_rrset("sanitize: removing extraneous answer "
699 				"RRset:", pkt, msg, prev, &rrset);
700 			continue;
701 		}
702 		prev = rrset;
703 		rrset = rrset->rrset_all_next;
704 	}
705 
706 	/* At this point, we brutally remove ALL rrsets that aren't
707 	 * children of the originating zone. The idea here is that,
708 	 * as far as we know, the server that we contacted is ONLY
709 	 * authoritative for the originating zone. It, of course, MAY
710 	 * be authoritative for any other zones, and of course, MAY
711 	 * NOT be authoritative for some subdomains of the originating
712 	 * zone. */
713 	prev = NULL;
714 	rrset = msg->rrset_first;
715 	while(rrset) {
716 
717 		/* remove private addresses */
718 		if( (rrset->type == LDNS_RR_TYPE_A ||
719 			rrset->type == LDNS_RR_TYPE_AAAA)) {
720 
721 			/* do not set servfail since this leads to too
722 			 * many drops of other people using rfc1918 space */
723 			/* also do not remove entire rrset, unless all records
724 			 * in it are bad */
725 			if(priv_rrset_bad(ie->priv, pkt, rrset)) {
726 				remove_rrset(NULL, pkt, msg, prev, &rrset);
727 				continue;
728 			}
729 		}
730 
731 		/* skip DNAME records -- they will always be followed by a
732 		 * synthesized CNAME, which will be relevant.
733 		 * FIXME: should this do something differently with DNAME
734 		 * rrsets NOT in Section.ANSWER? */
735 		/* But since DNAME records are also subdomains of the zone,
736 		 * same check can be used */
737 
738 		if(!pkt_sub(pkt, rrset->dname, zonename)) {
739 			if(msg->an_rrsets == 0 &&
740 				rrset->type == LDNS_RR_TYPE_NS &&
741 				rrset->section == LDNS_SECTION_AUTHORITY &&
742 				FLAGS_GET_RCODE(msg->flags) ==
743 				LDNS_RCODE_NOERROR && !soa_in_auth(msg) &&
744 				sub_of_pkt(pkt, zonename, rrset->dname)) {
745 				/* noerror, nodata and this NS rrset is above
746 				 * the zone. This is LAME!
747 				 * Leave in the NS for lame classification. */
748 				/* remove everything from the additional
749 				 * (we dont want its glue that was approved
750 				 * during the normalize action) */
751 				del_addi = 1;
752 			} else if(!env->cfg->harden_glue && (
753 				rrset->type == LDNS_RR_TYPE_A ||
754 				rrset->type == LDNS_RR_TYPE_AAAA)) {
755 				/* store in cache! Since it is relevant
756 				 * (from normalize) it will be picked up
757 				 * from the cache to be used later */
758 				store_rrset(pkt, msg, env, rrset);
759 				remove_rrset("sanitize: storing potential "
760 				"poison RRset:", pkt, msg, prev, &rrset);
761 				continue;
762 			} else {
763 				if(has_additional(rrset->type)) del_addi = 1;
764 				remove_rrset("sanitize: removing potential "
765 				"poison RRset:", pkt, msg, prev, &rrset);
766 				continue;
767 			}
768 		}
769 		if(del_addi && rrset->section == LDNS_SECTION_ADDITIONAL) {
770 			remove_rrset("sanitize: removing potential "
771 			"poison reference RRset:", pkt, msg, prev, &rrset);
772 			continue;
773 		}
774 		/* check if right hand side of NSEC is within zone */
775 		if(rrset->type == LDNS_RR_TYPE_NSEC &&
776 			sanitize_nsec_is_overreach(rrset, zonename)) {
777 			remove_rrset("sanitize: removing overreaching NSEC "
778 				"RRset:", pkt, msg, prev, &rrset);
779 			continue;
780 		}
781 		prev = rrset;
782 		rrset = rrset->rrset_all_next;
783 	}
784 	return 1;
785 }
786 
787 int
788 scrub_message(sldns_buffer* pkt, struct msg_parse* msg,
789 	struct query_info* qinfo, uint8_t* zonename, struct regional* region,
790 	struct module_env* env, struct iter_env* ie)
791 {
792 	/* basic sanity checks */
793 	log_nametypeclass(VERB_ALGO, "scrub for", zonename, LDNS_RR_TYPE_NS,
794 		qinfo->qclass);
795 	if(msg->qdcount > 1)
796 		return 0;
797 	if( !(msg->flags&BIT_QR) )
798 		return 0;
799 	msg->flags &= ~(BIT_AD|BIT_Z); /* force off bit AD and Z */
800 
801 	/* make sure that a query is echoed back when NOERROR or NXDOMAIN */
802 	/* this is not required for basic operation but is a forgery
803 	 * resistance (security) feature */
804 	if((FLAGS_GET_RCODE(msg->flags) == LDNS_RCODE_NOERROR ||
805 		FLAGS_GET_RCODE(msg->flags) == LDNS_RCODE_NXDOMAIN) &&
806 		msg->qdcount == 0)
807 		return 0;
808 
809 	/* if a query is echoed back, make sure it is correct. Otherwise,
810 	 * this may be not a reply to our query. */
811 	if(msg->qdcount == 1) {
812 		if(dname_pkt_compare(pkt, msg->qname, qinfo->qname) != 0)
813 			return 0;
814 		if(msg->qtype != qinfo->qtype || msg->qclass != qinfo->qclass)
815 			return 0;
816 	}
817 
818 	/* normalize the response, this cleans up the additional.  */
819 	if(!scrub_normalize(pkt, msg, qinfo, region))
820 		return 0;
821 	/* delete all out-of-zone information */
822 	if(!scrub_sanitize(pkt, msg, qinfo, zonename, env, ie))
823 		return 0;
824 	return 1;
825 }
826