Report RPZ prefixes in not canonical form as error

RPZ prefixes in not canonical form where not effective but were not
reported as an error like other parsing errors.  This has been
fixed.

diff --git a/bin/tests/system/rpz/tests.sh b/bin/tests/system/rpz/tests.sh
index 7ce7b0926a1756f6a3c647203560d3165fc3ed2c..82a7135ca109375eb93b1aa5653d4a65db679035 100644 (file)
--- a/bin/tests/system/rpz/tests.sh
+++ b/bin/tests/system/rpz/tests.sh
@@ -494,8 +494,8 @@ ckstats $ns5 test1 ns5 0
 ckstats $ns6 test1 ns6 0
 
 start_group "IP rewrites" test2
-msg='rpz IP address "128.2.0.0.0.0.3.2.2001" is not the canonical "128.2.zz.3.2.2001"'
-grep "$msg" ns3/named.run >/dev/null || setret "expected 'is not the canonical' message not logged"
+msg='invalid rpz IP address "128.2.0.0.0.0.3.2.2001.rpz-ip.bl" is not in canonical form 128.2.zz.3.2.2001.rpz-nsdname.bl'
+grep "$msg" ns3/named.run >/dev/null || setret "expected 'not in canonical form' message not logged"
 nodata a3-1.tld2                    # 1 NODATA
 nochange a3-2.tld2                  # 2 no policy record so no change
 nochange a4-1.tld2                  # 3 obsolete PASSTHRU record style

diff --git a/lib/dns/rpz.c b/lib/dns/rpz.c
index a0c6737e4fa277d196105037f2917ec0dad0ad7a..684f25675215b58afee0ef882ef0799d7f5abbfe 100644 (file)
--- a/lib/dns/rpz.c
+++ b/lib/dns/rpz.c
@@ -1008,27 +1008,22 @@ name2ipkey(int log_level, dns_rpz_zone_t *rpz, dns_rpz_type_t rpz_type,
        }
 
        /*
-        * Complain about bad names but be generous and accept them.
+        * Convert the address back to a canonical domain name
+        * to ensure that the original name is in canonical form.
         */
-       if (log_level < DNS_RPZ_DEBUG_QUIET && isc_log_wouldlog(log_level)) {
-               /*
-                * Convert the address back to a canonical domain name
-                * to ensure that the original name is in canonical form.
-                */
-               dns_name_t *ip_name2 = dns_fixedname_initname(&ip_name2f);
-               result = ip2name(tgt_ip, (dns_rpz_prefix_t)prefix_num, NULL,
-                                ip_name2);
-               if (result != ISC_R_SUCCESS ||
-                   !dns_name_equal(&ip_name, ip_name2))
-               {
-                       char ip2_str[DNS_NAME_FORMATSIZE];
-                       dns_name_format(ip_name2, ip2_str, sizeof(ip2_str));
-                       isc_log_write(DNS_LOGCATEGORY_RPZ, DNS_LOGMODULE_RPZ,
-                                     log_level,
-                                     "rpz IP address \"%s\""
-                                     " is not the canonical \"%s\"",
-                                     ip_str, ip2_str);
+       dns_name_t *ip_name2 = dns_fixedname_initname(&ip_name2f);
+       result = ip2name(tgt_ip, (dns_rpz_prefix_t)prefix_num, NULL, ip_name2);
+       if (result != ISC_R_SUCCESS || !dns_name_equal(&ip_name, ip_name2)) {
+               char ip2_str[DNS_NAME_FORMATSIZE];
+               if (rpz_type == DNS_RPZ_TYPE_QNAME) {
+                       dns_name_concatenate(ip_name2, &rpz->origin, ip_name2);
+               } else {
+                       dns_name_concatenate(ip_name2, &rpz->nsdname, ip_name2);
                }
+               dns_name_format(ip_name2, ip2_str, sizeof(ip2_str));
+               badname(log_level, src_name, " is not in canonical form ",
+                       ip2_str);
+               return ISC_R_FAILURE;
        }
 
        return ISC_R_SUCCESS;