- Fix for #596: Fix rpz-signal-nxdomain-ra to work for clientip

  triggered operation.

diff --git a/doc/Changelog b/doc/Changelog
index af5cfedee3a710678fa8d8dc6ab06776d89a064d..23c1c05c0be91da77cc1ed905255c255b54b33d4 100644 (file)
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -8,6 +8,8 @@
        - Fix for #596: add unit test for nsip trigger and signal unset RA.
        - Fix #598: Fix unbound-checkconf fatal error: module conf
          'respip dns64 validator iterator' is not known to work.
+       - Fix for #596: Fix rpz-signal-nxdomain-ra to work for clientip
+         triggered operation.
 
 4 January 2022: Wouter
        - Fix #596: unset the RA bit when a query is blocked by an unbound

diff --git a/services/rpz.c b/services/rpz.c
index a8e8b5503baeed7951ecb07e2940452b8b3d323f..322e9d1393c44c07d2f47a7f5edb3a09473e7986 100644 (file)
--- a/services/rpz.c
+++ b/services/rpz.c
@@ -2303,6 +2303,10 @@ rpz_apply_maybe_clientip_trigger(struct auth_zones* az, struct module_env* env,
                        local_zones_zone_answer(*z_out /*likely NULL, no zone*/, env, qinfo, edns,
                                repinfo, buf, temp, 0 /* no local data used */,
                                rpz_action_to_localzone_type(client_action));
+                       if(*r_out && (*r_out)->signal_nxdomain_ra &&
+                               LDNS_RCODE_WIRE(sldns_buffer_begin(buf))
+                               == LDNS_RCODE_NXDOMAIN)
+                               LDNS_RA_CLR(sldns_buffer_begin(buf));
                }
                ret = 1;
                goto done;

diff --git a/testdata/rpz_signal_nxdomain_ra.rpl b/testdata/rpz_signal_nxdomain_ra.rpl
index d0fbaaa5c99a6bca388174a65daecca4e02839f4..b89498cf96267d650099c133b5987b21a99c23b6 100644 (file)
--- a/testdata/rpz_signal_nxdomain_ra.rpl
+++ b/testdata/rpz_signal_nxdomain_ra.rpl
@@ -3,6 +3,7 @@ server:
        module-config: "respip validator iterator"
        target-fetch-policy: "0 0 0 0 0"
        qname-minimisation: no
+       access-control: 192.0.0.0/8 allow
 
 rpz:
        name: "rpz.example.com."
@@ -20,6 +21,7 @@ a.a CNAME .
 b.a CNAME .
 ns1.a.rpz-nsdname CNAME .
 24.0.0.0.192.rpz-nsip CNAME .
+24.0.3.0.192.rpz-client-ip CNAME .
 TEMPFILE_END
 
 stub-zone:
@@ -99,6 +101,16 @@ SECTION ADDITIONAL
 ns2.a. IN A 192.0.0.5
 ENTRY_END
 
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+f.a.  IN  TXT
+SECTION ANSWER
+f.a.  IN  TXT "upstream txt rr f.a."
+ENTRY_END
+
 RANGE_END
 
 RANGE_BEGIN 0 100
@@ -222,4 +234,21 @@ e.e.a.  IN TXT
 SECTION ANSWER
 ENTRY_END
 
+; clientip trigger
+STEP 50 QUERY ADDRESS 192.0.3.1
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+f.a.  IN TXT
+ENTRY_END
+
+STEP 51 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR AA RD NXDOMAIN
+SECTION QUESTION
+f.a.  IN TXT
+SECTION ANSWER
+ENTRY_END
+
 SCENARIO_END