transform.go

/*
File:    transform.go
Version: 1.0.0
Updated: 2026-03-23 16:00 CET

Description:
  Outbound response mutation functions for sdproxy. Applied in ProcessDNS
  (process.go) after a response arrives from the cache or upstream, before
  it is written to the client.

    transformResponse — dispatcher; calls the active transforms in order.
    flattenCNAME      — collapses a CNAME chain into a single A/AAAA record
                        under the original query name (flatten_cname: true).
    responseContainsNullIP — detects 0.0.0.0 / :: sentinel IPs used by
                        upstream blocklists; used to annotate cache-hit logs.

  All functions operate on an existing *dns.Msg — no upstream calls, no I/O.

Changes:
  1.0.0 - Split from process.go v1.52.0.

  ... Older commit-information removed for brevity.
*/

package main

import "github.com/miekg/dns"

// transformResponse applies the configured response transforms in order:
//   1. flattenCNAME  — when flatten_cname: true and qtype is A or AAAA.
//   2. minimizeAnswer — strips Ns and Extra sections when minimize_answer: true.
//
// inPlace controls whether msg is mutated directly (true) or a copy is made
// first (false). Callers that own the message (e.g. upstream response) pass
// true; callers sharing a pooled pointer pass false.
//
// Returns msg unchanged when neither transform is active — zero overhead on
// the common path.
func transformResponse(msg *dns.Msg, qtype uint16, inPlace bool) *dns.Msg {
	if !cfg.Server.FlattenCNAME && !cfg.Server.MinimizeAnswer {
		return msg
	}
	out := msg
	if !inPlace {
		out = msg.Copy()
	}
	if cfg.Server.FlattenCNAME && (qtype == dns.TypeA || qtype == dns.TypeAAAA) {
		flattenCNAME(out)
	}
	if cfg.Server.MinimizeAnswer {
		out.Ns    = nil
		out.Extra = nil
	}
	return out
}

// flattenCNAME collapses a CNAME chain in out.Answer into a single A or AAAA
// record under the original query name. TTL is set to the chain minimum so
// the result expires no later than the shortest-lived link in the chain.
//
// No-ops when the answer has fewer than two records or does not start with a
// CNAME — avoids touching direct A/AAAA responses.
func flattenCNAME(out *dns.Msg) {
	if len(out.Answer) < 2 {
		return
	}
	first, ok := out.Answer[0].(*dns.CNAME)
	if !ok {
		return
	}
	queryName := first.Hdr.Name
	minTTL    := first.Hdr.Ttl
	finals    := make([]dns.RR, 0, len(out.Answer)-1)

	for _, rr := range out.Answer[1:] {
		if rr.Header().Ttl < minTTL {
			minTTL = rr.Header().Ttl
		}
		switch r := rr.(type) {
		case *dns.A:
			cp          := *r
			cp.Hdr.Name  = queryName
			cp.Hdr.Ttl   = minTTL
			finals        = append(finals, &cp)
		case *dns.AAAA:
			cp          := *r
			cp.Hdr.Name  = queryName
			cp.Hdr.Ttl   = minTTL
			finals        = append(finals, &cp)
		}
	}
	if len(finals) == 0 {
		return // only CNAMEs with no terminal address — leave chain intact
	}
	// Apply the chain-minimum TTL to every final record.
	for _, rr := range finals {
		rr.Header().Ttl = minTTL
	}
	out.Answer = finals
}

// responseContainsNullIP reports whether any A or AAAA answer carries an
// unspecified address (0.0.0.0 or ::). Upstream blocklists commonly use this
// as a sentinel instead of returning NXDOMAIN. Used to annotate log lines.
func responseContainsNullIP(msg *dns.Msg) bool {
	for _, rr := range msg.Answer {
		switch r := rr.(type) {
		case *dns.A:
			if r.A.IsUnspecified() {
				return true
			}
		case *dns.AAAA:
			if r.AAAA.IsUnspecified() {
				return true
			}
		}
	}
	return false
}