From: Wouter Wijngaards Date: Mon, 4 Jan 2016 12:50:23 +0000 (+0000) Subject: Fixup that patch does not try to patch itself. X-Git-Tag: release-1.5.8~48 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=4f6dcce9e2693eb713ed458c151c203ad4e18f44;p=thirdparty%2Funbound.git Fixup that patch does not try to patch itself. git-svn-id: file:///svn/unbound/trunk@3590 be551aaa-1e26-0410-a405-d3ace91eadb9 --- diff --git a/contrib/aaaa-filter-iterator.patch b/contrib/aaaa-filter-iterator.patch index f91cc9026..0647f4979 100644 --- a/contrib/aaaa-filter-iterator.patch +++ b/contrib/aaaa-filter-iterator.patch @@ -1,402 +1,3 @@ -Index: trunk/contrib/aaaa-filter-iterator.patch -=================================================================== ---- trunk/contrib/aaaa-filter-iterator.patch (revision 3587) -+++ trunk/contrib/aaaa-filter-iterator.patch (working copy) -@@ -1,394 +0,0 @@ ----- unbound-1.4.17.orig/doc/unbound.conf.5.in --+++ unbound-1.4.17/doc/unbound.conf.5.in --@@ -519,6 +519,13 @@ authority servers and checks if the repl -- Disabled by default. -- This feature is an experimental implementation of draft dns\-0x20. -- .TP --+.B aaaa\-filter: \fI --+Activate behavior similar to BIND's AAAA-filter. --+This forces the dropping of all AAAA records, unless in the case of --+explicit AAAA queries, when no A records have been confirmed. --+This also causes an additional A query to be sent for each AAAA query. --+This breaks DNSSEC! --+.TP -- .B private\-address: \fI -- Give IPv4 of IPv6 addresses or classless subnets. These are addresses -- on your private network, and are not allowed to be returned for public ----- unbound-1.4.17.orig/util/config_file.c --+++ unbound-1.4.17/util/config_file.c --@@ -160,6 +160,7 @@ config_create(void) -- cfg->harden_below_nxdomain = 0; -- cfg->harden_referral_path = 0; -- cfg->use_caps_bits_for_id = 0; --+ cfg->aaaa_filter = 0; /* ASN: default is disabled */ -- cfg->private_address = NULL; -- cfg->private_domain = NULL; -- cfg->unwanted_threshold = 0; ----- unbound-1.4.17.orig/iterator/iter_scrub.c --+++ unbound-1.4.17/iterator/iter_scrub.c --@@ -580,6 +580,32 @@ static int sanitize_nsec_is_overreach(st -- } -- -- /** --+ * ASN: Lookup A records from rrset cache. --+ * @param qinfo: the question originally asked. --+ * @param env: module environment with config and cache. --+ * @param ie: iterator environment with private address data. --+ * @return 0 if no A record found, 1 if A record found. --+ */ --+static int --+asn_lookup_a_record_from_cache(struct query_info* qinfo, --+ struct module_env* env, struct iter_env* ie) --+{ --+ struct ub_packed_rrset_key* akey; --+ --+ /* get cached A records for queried name */ --+ akey = rrset_cache_lookup(env->rrset_cache, qinfo->qname, --+ qinfo->qname_len, LDNS_RR_TYPE_A, qinfo->qclass, --+ 0, *env->now, 0); --+ if(akey) { /* we had some. */ --+ log_rrset_key(VERB_ALGO, "ASN-AAAA-filter: found A record", --+ akey); --+ lock_rw_unlock(&akey->entry.lock); --+ return 1; --+ } --+ return 0; --+} --+ --+/** -- * Given a response event, remove suspect RRsets from the response. -- * "Suspect" rrsets are potentially poison. Note that this routine expects -- * the response to be in a "normalized" state -- that is, all "irrelevant" --@@ -598,6 +625,7 @@ scrub_sanitize(ldns_buffer* pkt, struct -- struct query_info* qinfo, uint8_t* zonename, struct module_env* env, -- struct iter_env* ie) -- { --+ int found_a_record = 0; /* ASN: do we have a A record? */ -- int del_addi = 0; /* if additional-holding rrsets are deleted, we -- do not trust the normalized additional-A-AAAA any more */ -- struct rrset_parse* rrset, *prev; --@@ -633,6 +661,13 @@ scrub_sanitize(ldns_buffer* pkt, struct -- rrset = rrset->rrset_all_next; -- } -- --+ /* ASN: Locate any A record we can find */ --+ if((ie->aaaa_filter) && (qinfo->qtype == LDNS_RR_TYPE_AAAA)) { --+ found_a_record = asn_lookup_a_record_from_cache(qinfo, --+ env, ie); --+ } --+ /* ASN: End of added code */ --+ -- /* At this point, we brutally remove ALL rrsets that aren't -- * children of the originating zone. The idea here is that, -- * as far as we know, the server that we contacted is ONLY --@@ -644,6 +679,24 @@ scrub_sanitize(ldns_buffer* pkt, struct -- rrset = msg->rrset_first; -- while(rrset) { -- --+ /* ASN: For AAAA records only... */ --+ if((ie->aaaa_filter) && (rrset->type == LDNS_RR_TYPE_AAAA)) { --+ /* ASN: If this is not a AAAA query, then remove AAAA --+ * records, no questions asked. If this IS a AAAA query --+ * then remove AAAA records if we have an A record. --+ * Otherwise, leave things be. */ --+ if((qinfo->qtype != LDNS_RR_TYPE_AAAA) || --+ (found_a_record)) { --+ remove_rrset("ASN-AAAA-filter: removing AAAA " --+ "for record", pkt, msg, prev, &rrset); --+ continue; --+ } --+ log_nametypeclass(VERB_ALGO, "ASN-AAAA-filter: " --+ "keep AAAA for", zonename, --+ LDNS_RR_TYPE_AAAA, qinfo->qclass); --+ } --+ /* ASN: End of added code */ --+ -- /* remove private addresses */ -- if( (rrset->type == LDNS_RR_TYPE_A || -- rrset->type == LDNS_RR_TYPE_AAAA) && ----- unbound-1.4.17.orig/iterator/iterator.c --+++ unbound-1.4.17/iterator/iterator.c --@@ -1579,6 +1579,53 @@ processDSNSFind(struct module_qstate* qs -- -- return 0; -- } --+ --+/** --+ * ASN: This event state was added as an intermediary step between --+ * QUERYTARGETS_STATE and the next step, in order to cast a subquery for the --+ * purpose of caching A records for the queried name. --+ * --+ * @param qstate: query state. --+ * @param iq: iterator query state. --+ * @param ie: iterator shared global environment. --+ * @param id: module id. --+ * @return true if the event requires more request processing immediately, --+ * false if not. This state only returns true when it is generating --+ * a SERVFAIL response because the query has hit a dead end. --+ */ --+static int --+asn_processQueryAAAA(struct module_qstate* qstate, struct iter_qstate* iq, --+ struct iter_env* ie, int id) --+{ --+ struct module_qstate* subq = NULL; --+ --+ log_assert(iq->fetch_a_for_aaaa == 0); --+ --+ /* flag the query properly in order to not loop */ --+ iq->fetch_a_for_aaaa = 1; --+ --+ /* re-throw same query, but with a different type */ --+ if(!generate_sub_request(iq->qchase.qname, --+ iq->qchase.qname_len, LDNS_RR_TYPE_A, --+ iq->qchase.qclass, qstate, id, iq, --+ INIT_REQUEST_STATE, FINISHED_STATE, &subq, 1)) { --+ log_nametypeclass(VERB_ALGO, "ASN-AAAA-filter: failed " --+ "preloading of A record for", --+ iq->qchase.qname, LDNS_RR_TYPE_A, --+ iq->qchase.qclass); --+ return error_response(qstate, id, LDNS_RCODE_SERVFAIL); --+ } --+ log_nametypeclass(VERB_ALGO, "ASN-AAAA-filter: " --+ "preloading records in cache for", --+ iq->qchase.qname, LDNS_RR_TYPE_A, --+ iq->qchase.qclass); --+ --+ /* set this query as waiting */ --+ qstate->ext_state[id] = module_wait_subquery; --+ /* at this point break loop */ --+ return 0; --+} --+/* ASN: End of added code */ -- -- /** -- * This is the request event state where the request will be sent to one of --@@ -1626,6 +1673,13 @@ processQueryTargets(struct module_qstate -- return error_response(qstate, id, LDNS_RCODE_SERVFAIL); -- } -- --+ /* ASN: If we have a AAAA query, then also query for A records */ --+ if((ie->aaaa_filter) && (iq->qchase.qtype == LDNS_RR_TYPE_AAAA) && --+ (iq->fetch_a_for_aaaa == 0)) { --+ return next_state(iq, ASN_FETCH_A_FOR_AAAA_STATE); --+ } --+ /* ASN: End of added code */ --+ -- /* Make sure we have a delegation point, otherwise priming failed -- * or another failure occurred */ -- if(!iq->dp) { --@@ -2568,6 +2622,62 @@ processFinished(struct module_qstate* qs -- return 0; -- } -- --+/** --+ * ASN: Do final processing on responses to A queries originated from AAAA --+ * queries. Events reach this state after the iterative resolution algorithm --+ * terminates. --+ * This is required down the road to decide whether to scrub AAAA records --+ * from the results or not. --+ * --+ * @param qstate: query state. --+ * @param id: module id. --+ * @param forq: super query state. --+ */ --+static void --+asn_processAAAAResponse(struct module_qstate* qstate, int id, --+ struct module_qstate* super) --+{ --+ struct iter_qstate* iq = (struct iter_qstate*)qstate->minfo[id]; --+ struct iter_qstate* super_iq = (struct iter_qstate*)super->minfo[id]; --+ struct ub_packed_rrset_key* rrset; --+ struct delegpt_ns* dpns = NULL; --+ int error = (qstate->return_rcode != LDNS_RCODE_NOERROR); --+ --+ log_assert(super_iq->fetch_a_for_aaaa > 0); --+ --+ /* let super go to evaluation of targets after this */ --+ super_iq->state = QUERYTARGETS_STATE; --+ --+ log_query_info(VERB_ALGO, "ASN-AAAA-filter: processAAAAResponse", --+ &qstate->qinfo); --+ log_query_info(VERB_ALGO, "ASN-AAAA-filter: processAAAAResponse super", --+ &super->qinfo); --+ --+ if(super_iq->dp) --+ dpns = delegpt_find_ns(super_iq->dp, --+ qstate->qinfo.qname, qstate->qinfo.qname_len); --+ if (!dpns) { --+ /* not interested */ --+ verbose(VERB_ALGO, "ASN-AAAA-filter: subq: %s, but parent not " --+ "interested%s", (error ? "error, but" : "success"), --+ (super_iq->dp ? "anymore" : " (was reset)")); --+ log_query_info(VERB_ALGO, "ASN-AAAA-filter: superq", &super->qinfo); --+ if(super_iq->dp && error) --+ delegpt_log(VERB_ALGO, super_iq->dp); --+ return; --+ } else if (error) { --+ verbose(VERB_ALGO, "ASN-AAAA-filter: mark as failed, " --+ "and go to target query."); --+ /* see if the failure did get (parent-lame) info */ --+ if(!cache_fill_missing(super->env, --+ super_iq->qchase.qclass, super->region, --+ super_iq->dp)) --+ log_err("ASN-AAAA-filter: out of memory adding missing"); --+ dpns->resolved = 1; /* mark as failed */ --+ } --+} --+/* ASN: End of added code */ --+ -- /* -- * Return priming query results to interestes super querystates. -- * --@@ -2587,6 +2697,9 @@ iter_inform_super(struct module_qstate* -- else if(super->qinfo.qtype == LDNS_RR_TYPE_DS && ((struct iter_qstate*) -- super->minfo[id])->state == DSNS_FIND_STATE) -- processDSNSResponse(qstate, id, super); --+ else if (super->qinfo.qtype == LDNS_RR_TYPE_AAAA && ((struct iter_qstate*) --+ super->minfo[id])->state == ASN_FETCH_A_FOR_AAAA_STATE) --+ asn_processAAAAResponse(qstate, id, super); -- else if(qstate->return_rcode != LDNS_RCODE_NOERROR) -- error_supers(qstate, id, super); -- else if(qstate->is_priming) --@@ -2624,6 +2737,9 @@ iter_handle(struct module_qstate* qstate -- case INIT_REQUEST_3_STATE: -- cont = processInitRequest3(qstate, iq, id); -- break; --+ case ASN_FETCH_A_FOR_AAAA_STATE: --+ cont = asn_processQueryAAAA(qstate, iq, ie, id); --+ break; -- case QUERYTARGETS_STATE: -- cont = processQueryTargets(qstate, iq, ie, id); -- break; --@@ -2863,6 +2979,8 @@ iter_state_to_string(enum iter_state sta -- return "INIT REQUEST STATE (stage 2)"; -- case INIT_REQUEST_3_STATE: -- return "INIT REQUEST STATE (stage 3)"; --+ case ASN_FETCH_A_FOR_AAAA_STATE: --+ return "ASN_FETCH_A_FOR_AAAA_STATE"; -- case QUERYTARGETS_STATE : -- return "QUERY TARGETS STATE"; -- case PRIME_RESP_STATE : --@@ -2887,6 +3005,7 @@ iter_state_is_responsestate(enum iter_st -- case INIT_REQUEST_STATE : -- case INIT_REQUEST_2_STATE : -- case INIT_REQUEST_3_STATE : --+ case ASN_FETCH_A_FOR_AAAA_STATE : -- case QUERYTARGETS_STATE : -- case COLLECT_CLASS_STATE : -- return 0; ----- unbound-1.4.17.orig/iterator/iter_utils.c --+++ unbound-1.4.17/iterator/iter_utils.c --@@ -128,6 +128,7 @@ iter_apply_cfg(struct iter_env* iter_env -- } -- iter_env->supports_ipv6 = cfg->do_ip6; -- iter_env->supports_ipv4 = cfg->do_ip4; --+ iter_env->aaaa_filter = cfg->aaaa_filter; -- return 1; -- } -- ----- unbound-1.4.17.orig/iterator/iterator.h --+++ unbound-1.4.17/iterator/iterator.h --@@ -110,6 +110,9 @@ struct iter_env { -- * array of max_dependency_depth+1 size. -- */ -- int* target_fetch_policy; --+ --+ /** ASN: AAAA-filter flag */ --+ int aaaa_filter; -- }; -- -- /** --@@ -135,6 +138,14 @@ enum iter_state { -- INIT_REQUEST_3_STATE, -- -- /** --+ * This state is responsible for intercepting AAAA queries, --+ * and launch a A subquery on the same target, to populate the --+ * cache with A records, so the AAAA filter scrubbing logic can --+ * work. --+ */ --+ ASN_FETCH_A_FOR_AAAA_STATE, --+ --+ /** -- * Each time a delegation point changes for a given query or a -- * query times out and/or wakes up, this state is (re)visited. -- * This state is responsible for iterating through a list of --@@ -309,6 +320,13 @@ struct iter_qstate { -- */ -- int refetch_glue; -- --+ /** --+ * ASN: This is a flag that, if true, means that this query is --+ * for fetching A records to populate cache and determine if we must --+ * return AAAA records or not. --+ */ --+ int fetch_a_for_aaaa; --+ -- /** list of pending queries to authoritative servers. */ -- struct outbound_list outlist; -- }; ----- unbound-1.4.17.orig/util/config_file.h --+++ unbound-1.4.17/util/config_file.h --@@ -169,6 +169,8 @@ struct config_file { -- int harden_referral_path; -- /** use 0x20 bits in query as random ID bits */ -- int use_caps_bits_for_id; --+ /** ASN: enable AAAA filter? */ --+ int aaaa_filter; -- /** strip away these private addrs from answers, no DNS Rebinding */ -- struct config_strlist* private_address; -- /** allow domain (and subdomains) to use private address space */ ----- unbound-1.4.17.orig/util/configlexer.lex --+++ unbound-1.4.17/util/configlexer.lex --@@ -177,6 +177,7 @@ harden-below-nxdomain{COLON} { YDVAR(1, -- harden-referral-path{COLON} { YDVAR(1, VAR_HARDEN_REFERRAL_PATH) } -- use-caps-for-id{COLON} { YDVAR(1, VAR_USE_CAPS_FOR_ID) } -- unwanted-reply-threshold{COLON} { YDVAR(1, VAR_UNWANTED_REPLY_THRESHOLD) } --+aaaa-filter{COLON} { YDVAR(1, VAR_AAAA_FILTER) } -- private-address{COLON} { YDVAR(1, VAR_PRIVATE_ADDRESS) } -- private-domain{COLON} { YDVAR(1, VAR_PRIVATE_DOMAIN) } -- prefetch-key{COLON} { YDVAR(1, VAR_PREFETCH_KEY) } ----- unbound-1.4.17.orig/util/configparser.y --+++ unbound-1.4.17/util/configparser.y --@@ -92,6 +92,7 @@ extern struct config_parser_state* cfg_p -- %token VAR_STATISTICS_CUMULATIVE VAR_OUTGOING_PORT_PERMIT -- %token VAR_OUTGOING_PORT_AVOID VAR_DLV_ANCHOR_FILE VAR_DLV_ANCHOR -- %token VAR_NEG_CACHE_SIZE VAR_HARDEN_REFERRAL_PATH VAR_PRIVATE_ADDRESS --+%token VAR_AAAA_FILTER -- %token VAR_PRIVATE_DOMAIN VAR_REMOTE_CONTROL VAR_CONTROL_ENABLE -- %token VAR_CONTROL_INTERFACE VAR_CONTROL_PORT VAR_SERVER_KEY_FILE -- %token VAR_SERVER_CERT_FILE VAR_CONTROL_KEY_FILE VAR_CONTROL_CERT_FILE --@@ -151,6 +152,7 @@ content_server: server_num_threads | ser -- server_dlv_anchor_file | server_dlv_anchor | server_neg_cache_size | -- server_harden_referral_path | server_private_address | -- server_private_domain | server_extended_statistics | --+ server_aaaa_filter | -- server_local_data_ptr | server_jostle_timeout | -- server_unwanted_reply_threshold | server_log_time_ascii | -- server_domain_insecure | server_val_sig_skew_min | --@@ -802,6 +803,15 @@ server_use_caps_for_id: VAR_USE_CAPS_FOR -- free($2); -- } -- ; --+server_aaaa_filter: VAR_AAAA_FILTER STRING_ARG --+ { --+ OUTYY(("P(server_aaaa_filter:%s)\n", $2)); --+ if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0) --+ yyerror("expected yes or no."); --+ else cfg_parser->cfg->aaaa_filter = (strcmp($2, "yes")==0); --+ free($2); --+ } --+ ; -- server_private_address: VAR_PRIVATE_ADDRESS STRING_ARG -- { -- OUTYY(("P(server_private_address:%s)\n", $2)); ----- unbound-1.4.17.orig/pythonmod/interface.i --+++ unbound-1.4.17/pythonmod/interface.i --@@ -626,6 +626,7 @@ struct config_file { -- int harden_dnssec_stripped; -- int harden_referral_path; -- int use_caps_bits_for_id; --+ int aaaa_filter; /* ASN */ -- struct config_strlist* private_address; -- struct config_strlist* private_domain; -- size_t unwanted_threshold; Index: trunk/doc/unbound.conf.5.in =================================================================== --- trunk/doc/unbound.conf.5.in (revision 3587)