Rebind and Victim IP in A Record Response Issues with DNSSEC and/or EDNS about rebind HOT 5 CLOSED

I'm looking into the issue, and it is reproducible. Based on my initial 
testing, this looks like a bug in Rebind; the code will likely have to be 
updated to explicitly handle queries with the OPT flag set.

Update: I've confirmed that this is a bug in the Rebind DNS server. With OPT 
set in the DNS request, Rebind places the OPT response in the Answers section 
instead of the Additional Records section of the DNS response packet. This 
makes the second IP address (that of the victim IP) appear as part of the 
Additional Records section. 

Bug fixed. DNS responses for dnssec and non-dnssec lookups both report the 
correct IP addresses in the answer section:

##########################################################################
user@machine:~$ dig @<rebind IP> wacme.attacker.com
##########################################################################

; <<>> DiG 9.7.0-P1 <<>> @<rebind IP> wacme.attacker.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 5352
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;wacme.attacker.com.            IN  A

;; ANSWER SECTION:
wacme.attacker.com.     5   IN  A   <rebind IP>
wacme.attacker.com.     5   IN  A   <target IP>

;; Query time: 47 msec
;; SERVER: <rebind IP>#53(<rebind IP>)
;; WHEN: Sat Aug  7 19:47:19 2010
;; MSG SIZE  rcvd: 62

##########################################################################





##########################################################################
user@machine:~$ dig @<rebind IP> wacme.attacker.com +dnssec
##########################################################################

; <<>> DiG 9.7.0-P1 <<>> @<rebind IP> wacme.attacker.com +dnssec
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 30948
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags: do; udp: 4096
;; QUESTION SECTION:
;wacme.attacker.com.            IN  A

;; ANSWER SECTION:
wacme.attacker.com.     5   IN  A   <rebind IP>
wacme.attacker.com.     5   IN  A   <target IP>

;; Query time: 47 msec
;; SERVER: <rebind IP>#53(<rebind IP>)
;; WHEN: Sat Aug  7 19:47:22 2010
;; MSG SIZE  rcvd: 73

##########################################################################

Code changes should also enable Rebind to handle other types of DNS requests 
that have Additional sections.

Perfect, can't reproduce this issue with version 0.3.3 any more on ISP's DNS.

Thanks

Awesome, thanks for the bug report and verification. Marking bug as verified.