Add option to disable additional out-of-zone data

Greg Bock · Jeroen Koekkoek · commit c416c7afc9c2 · 2019-10-15T20:12:42.000+02:00
Add option to not return additional information from disparate zones.
diff --git a/configlexer.lex b/configlexer.lex
@@ -288,6 +288,7 @@ dnstap-log-auth-response-messages{COLON}	{ LEXOUT(("v(%s) ", yytext)); return VA
 log-time-ascii{COLON}	{ LEXOUT(("v(%s) ", yytext)); return VAR_LOG_TIME_ASCII;}
 round-robin{COLON}	{ LEXOUT(("v(%s) ", yytext)); return VAR_ROUND_ROBIN;}
 minimal-responses{COLON} { LEXOUT(("v(%s) ", yytext)); return VAR_MINIMAL_RESPONSES;}
+confine-to-zone{COLON} { LEXOUT(("v(%s) ", yytext)); return VAR_CONFINE_TO_ZONE;}
 refuse-any{COLON}	{ LEXOUT(("v(%s) ", yytext)); return VAR_REFUSE_ANY;}
 max-refresh-time{COLON}	{ LEXOUT(("v(%s) ", yytext)); return VAR_MAX_REFRESH_TIME;}
 min-refresh-time{COLON}	{ LEXOUT(("v(%s) ", yytext)); return VAR_MIN_REFRESH_TIME;}
diff --git a/configparser.y b/configparser.y
@@ -71,7 +71,7 @@ extern config_parser_state_type* cfg_parser;
 %token VAR_ROUND_ROBIN VAR_ZONESTATS VAR_REUSEPORT VAR_VERSION
 %token VAR_MAX_REFRESH_TIME VAR_MIN_REFRESH_TIME
 %token VAR_MAX_RETRY_TIME VAR_MIN_RETRY_TIME
-%token VAR_MULTI_MASTER_CHECK VAR_MINIMAL_RESPONSES VAR_REFUSE_ANY
+%token VAR_MULTI_MASTER_CHECK VAR_MINIMAL_RESPONSES VAR_CONFINE_TO_ZONE VAR_REFUSE_ANY
 %token VAR_USE_SYSTEMD VAR_DNSTAP VAR_DNSTAP_ENABLE VAR_DNSTAP_SOCKET_PATH
 %token VAR_DNSTAP_SEND_IDENTITY VAR_DNSTAP_SEND_VERSION VAR_DNSTAP_IDENTITY
 %token VAR_DNSTAP_VERSION VAR_DNSTAP_LOG_AUTH_QUERY_MESSAGES
@@ -111,7 +111,7 @@ content_server: server_ip_address | server_ip_transparent | server_debug_mode |
 	server_zonefiles_write | server_log_time_ascii | server_round_robin |
 	server_reuseport | server_version | server_ip_freebind |
 	server_tls_service_key | server_tls_service_pem | server_tls_port |
-	server_minimal_responses | server_refuse_any | server_use_systemd |
+	server_minimal_responses | server_confine_to_zone | server_refuse_any | server_use_systemd |
 	server_hide_identity | server_tls_service_ocsp |
 	server_send_buffer_size | server_receive_buffer_size |
 	server_tcp_reject_overflow;
@@ -346,6 +346,16 @@ server_minimal_responses: VAR_MINIMAL_RESPONSES STRING
 		}
 	}
 	;
+server_confine_to_zone: VAR_CONFINE_TO_ZONE STRING
+	{
+		OUTYY(("P(server_confine_to_zone:%s)\n", $2));
+		if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0) {
+			yyerror("confine-to-zone: expected yes or no.");
+		} else {
+			cfg_parser->opt->confine_to_zone = (strcmp($2, "yes")==0);
+		}
+	}
+	;
 server_refuse_any: VAR_REFUSE_ANY STRING 
 	{ 
 		OUTYY(("P(server_refuse_any:%s)\n", $2)); 
diff --git a/nsd-checkconf.c b/nsd-checkconf.c
@@ -371,6 +371,7 @@ config_print_zone(nsd_options_type* opt, const char* k, int s, const char *o,
 		SERV_GET_BIN(log_time_ascii, o);
 		SERV_GET_BIN(round_robin, o);
 		SERV_GET_BIN(minimal_responses, o);
+		SERV_GET_BIN(confine_to_zone, o);
 		SERV_GET_BIN(refuse_any, o);
 		SERV_GET_BIN(tcp_reject_overflow, o);
 		/* str */
@@ -533,6 +534,8 @@ config_test_print_server(nsd_options_type* opt)
 	printf("\tlog-time-ascii: %s\n", opt->log_time_ascii?"yes":"no");
 	printf("\tround-robin: %s\n", opt->round_robin?"yes":"no");
 	printf("\tminimal-responses: %s\n", opt->minimal_responses?"yes":"no");
+	printf("\tconfine-to-zone: %s\n",
+		opt->confine_to_zone ? "yes" : "no");
 	printf("\trefuse-any: %s\n", opt->refuse_any?"yes":"no");
 	printf("\tverbosity: %d\n", opt->verbosity);
 	for(ip = opt->ip_addresses; ip; ip=ip->next)
diff --git a/nsd.conf.5.in b/nsd.conf.5.in
@@ -394,6 +394,11 @@ that reduces packets, but exactly to the fragmentation length, the nsd.conf
 option reduces packets as small as possible.
 The default is no.
 .TP
+.B confine\-to\-zone:\fR <yes or no>
+If set to yes, additional information will not be added to the response if the
+apex zone of the additional information does not match the apex zone of the
+initial query (E.G. CNAME resolution). Default is no. 
+.TP
 .B refuse\-any:\fR <yes or no>
 Refuse queries of type ANY.  This is useful to stop query floods trying
 to get large responses.  Note that rrl ratelimiting also has type ANY as
diff --git a/nsd.conf.sample.in b/nsd.conf.sample.in
@@ -151,6 +151,11 @@ server:
 	# minimal-responses only emits extra data for referrals.
 	# minimal-responses: no
 
+	# Do not return additional information if the apex zone of the
+	# additional information is configured but does not match the apex zone
+	# of the initial query.
+	# confine-to-zone: no
+
 	# refuse queries of type ANY.  For stopping floods.
 	# refuse-any: no
 
diff --git a/options.c b/options.c
@@ -68,6 +68,7 @@ nsd_options_create(region_type* region)
 	opt->log_time_ascii = 1;
 	opt->round_robin = 0; /* also packet.h::round_robin */
 	opt->minimal_responses = 0; /* also packet.h::minimal_responses */
+	opt->confine_to_zone = 0;
 	opt->refuse_any = 0;
 	opt->server_count = 1;
 	opt->tcp_count = 100;
diff --git a/options.h b/options.h
@@ -76,6 +76,7 @@ struct nsd_options {
 	int server_count;
 	int tcp_count;
 	int tcp_reject_overflow;
+	int confine_to_zone;
 	int tcp_query_count;
 	int tcp_timeout;
 	int tcp_mss;
diff --git a/query.c b/query.c
@@ -1219,6 +1219,7 @@ answer_lookup_zone(struct nsd *nsd, struct query *q, answer_type *answer,
 	size_t domain_number, int exact, domain_type *closest_match,
 	domain_type *closest_encloser, const dname_type *qname)
 {
+	zone_type* origzone = q->zone;
 	q->zone = domain_find_zone(nsd->db, closest_encloser);
 	if (!q->zone) {
 		/* no zone for this */
@@ -1233,6 +1234,16 @@ answer_lookup_zone(struct nsd *nsd, struct query *q, answer_type *answer,
 			RCODE_SET(q->packet, RCODE_SERVFAIL);
 		return;
 	}
+
+	/*
+	 * If confine-to-zone is set to no do not return additional
+	 * information for a zone with a different apex from the query zone.
+	*/
+	if (nsd->options->confine_to_zone &&
+	   (origzone != NULL && dname_compare(origzone->apex->dname, q->zone->apex->dname))) {
+		return;
+	}
+
 	/* now move up the closest encloser until it exists, previous
 	 * (possibly empty) closest encloser was useful to finding the zone
 	 * (for empty zones too), but now we want actual data nodes */
