- Add RPZ AXFR test

- Fix memory leak

diff --git a/services/rpz.c b/services/rpz.c
index e3a890456476801685e1cefbb8a94b3d7b46c829..3118479a7cae2ad13727f36be1afe5ebd1abc485 100644 (file)
--- a/services/rpz.c
+++ b/services/rpz.c
@@ -444,7 +444,8 @@ strip_dname_origin(uint8_t* dname, size_t dnamelen, size_t originlen,
 static int
 rpz_insert_qname_trigger(struct rpz* r, uint8_t* dname, size_t dnamelen,
        enum rpz_action a, uint16_t rrtype, uint16_t rrclass, uint32_t ttl,
-       uint8_t* rdata, size_t rdata_len, uint8_t* rr, size_t rr_len)
+       uint8_t* rdata, size_t rdata_len, uint8_t* rr, size_t rr_len,
+       int* newzone)
 {
        struct local_zone* z;
        enum localzone_type tp = local_zone_always_transparent;
@@ -473,6 +474,7 @@ rpz_insert_qname_trigger(struct rpz* r, uint8_t* dname, size_t dnamelen,
                tp = rpz_action_to_localzone_type(a);
                z = local_zones_add_zone(r->local_zones, dname, dnamelen,
                        dnamelabs, rrclass, tp);
+               *newzone = 1;
        }
        if(!z) {
                log_warn("RPZ create failed");
@@ -501,7 +503,7 @@ rpz_insert_response_ip_trigger(struct rpz* r, uint8_t* dname,
        struct sockaddr_storage addr;
        socklen_t addrlen;
        int net, af;
-       char* rrstr = sldns_wire2str_rr(rr, rr_len);
+       char* rrstr;
        enum respip_action respa = rpz_action_to_respip_action(a);
 
        if(a == RPZ_TCP_ONLY_ACTION || a == RPZ_INVALID_ACTION ||
@@ -515,6 +517,7 @@ rpz_insert_response_ip_trigger(struct rpz* r, uint8_t* dname,
                return 0;
 
        lock_rw_wrlock(&r->respip_set->lock);
+       rrstr = sldns_wire2str_rr(rr, rr_len);
        if(!(node=respip_sockaddr_find_or_create(r->respip_set, &addr, addrlen,
                net, 1, rrstr))) {
                lock_rw_unlock(&r->respip_set->lock);
@@ -545,6 +548,7 @@ rpz_insert_rr(struct rpz* r, size_t aznamelen, uint8_t* dname,
        uint8_t* policydname = calloc(1, LDNS_MAX_DOMAINLEN + 1);
        enum rpz_trigger t;
        enum rpz_action a;
+       int newzone = 0;
        
        a = rpz_rr_to_action(rr_type, rdatawl, rdatalen);
        if(!(policydnamelen = strip_dname_origin(dname, dnamelen, aznamelen,
@@ -556,7 +560,7 @@ rpz_insert_rr(struct rpz* r, size_t aznamelen, uint8_t* dname,
        if(t == RPZ_QNAME_TRIGGER) {
                if(!rpz_insert_qname_trigger(r, policydname, policydnamelen,
                        a, rr_type, rr_class, rr_ttl, rdatawl, rdatalen, rr,
-                       rr_len))
+                       rr_len, &newzone) || !newzone)
                        free(policydname);
        }
        else if(t == RPZ_RESPONSE_IP_TRIGGER) {

diff --git a/testdata/rpz_axfr.rpl b/testdata/rpz_axfr.rpl
new file mode 100644 (file)
index 0000000..b5b84bf
--- /dev/null
+++ b/testdata/rpz_axfr.rpl
@@ -0,0 +1,362 @@
+; config options
+server:
+       module-config: "respip validator iterator"
+       target-fetch-policy: "0 0 0 0 0"
+       qname-minimisation: no
+
+rpz:
+       name: "rpz.example.com."
+       master: 10.20.30.40
+       zonefile:
+TEMPFILE_NAME rpz.example.com
+TEMPFILE_CONTENTS rpz.example.com
+$ORIGIN rpz.example.com.
+a      IN      CNAME *.
+c      IN      TXT     "hello from initial RPZ"
+c      IN      TXT     "another hello from initial RPZ"
+d      IN      CNAME .
+32.1.123.0.10.rpz-ip   CNAME *.
+32.3.123.0.10.rpz-ip   A 10.66.0.3
+32.3.123.0.10.rpz-ip   A 10.66.0.4
+32.4.123.0.10.rpz-ip   CNAME .
+TEMPFILE_END
+
+stub-zone:
+       name: "."
+       stub-addr: 10.20.30.40
+
+CONFIG_END
+
+SCENARIO_BEGIN Test RPZ QNAME trigger, loaded using AXFR
+
+RANGE_BEGIN 0 100
+       ADDRESS 10.20.30.40
+
+ENTRY_BEGIN
+MATCH opcode qname qtype
+ADJUST copy_id
+REPLY QR NOERROR AA
+SECTION QUESTION
+.      IN      NS
+SECTION ANSWER
+.      IN      NS      ns.
+SECTION ADDITIONAL
+ns.    IN      NS      10.20.30.40
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qname qtype
+ADJUST copy_id
+REPLY QR NOERROR AA
+SECTION QUESTION
+b.     IN      TXT
+SECTION ANSWER
+b.     TXT     "hello from upstream"
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qname qtype
+ADJUST copy_id
+REPLY QR NOERROR AA
+SECTION QUESTION
+d.     IN      TXT
+SECTION ANSWER
+d.     TXT     "hello from upstream"
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qname qtype
+ADJUST copy_id
+REPLY QR NOERROR AA
+SECTION QUESTION
+a.rpz-ip.      IN      A
+SECTION ANSWER
+a.rpz-ip.      IN      A       10.0.123.1
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qname qtype
+ADJUST copy_id
+REPLY QR NOERROR AA
+SECTION QUESTION
+c.rpz-ip.      IN      A
+SECTION ANSWER
+c.rpz-ip.      IN      A       10.0.123.3
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qname qtype
+ADJUST copy_id
+REPLY QR NOERROR AA
+SECTION QUESTION
+d.rpz-ip.      IN      A
+SECTION ANSWER
+d.rpz-ip.      IN      A       10.0.123.4
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qname qtype
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+rpz.example.com. IN SOA
+SECTION ANSWER
+rpz.example.com. IN SOA ns.rpz.example.com. hostmaster.rpz.example.com. 1 3600 900 86400 3600
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qname qtype
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+rpz.example.com. IN AXFR
+SECTION ANSWER
+rpz.example.com. IN SOA ns.rpz.example.com. hostmaster.rpz.example.com. 1 3600 900 86400 3600
+b.rpz.example.com. TXT "hello from RPZ"
+c.rpz.example.com. TXT "hello from RPZ"
+a.rpz.example.com. CNAME .
+32.1.123.0.10.rpz-ip.rpz.example.com.  CNAME .
+32.3.123.0.10.rpz-ip.rpz.example.com.  A 10.66.0.5
+32.3.123.0.10.rpz-ip.rpz.example.com.  A 10.66.0.6
+rpz.example.com. IN SOA ns.rpz.example.com. hostmaster.rpz.example.com. 1 3600 900 86400 3600
+ENTRY_END
+
+RANGE_END
+
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+b.     IN      TXT
+ENTRY_END
+
+STEP 2 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+b.     IN      TXT
+SECTION ANSWER
+b.     IN      TXT     "hello from upstream"
+ENTRY_END
+
+STEP 3 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+a.     IN      TXT
+ENTRY_END
+
+STEP 4 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA AA NOERROR
+SECTION QUESTION
+a.     IN      TXT
+SECTION ANSWER
+ENTRY_END
+
+STEP 5 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+a.rpz-ip.      IN      A
+ENTRY_END
+
+STEP 6 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+a.rpz-ip.      IN      A
+SECTION ANSWER
+ENTRY_END
+
+STEP 7 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+c.     IN      TXT
+ENTRY_END
+
+STEP 8 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA AA NOERROR
+SECTION QUESTION
+c.     IN      TXT
+SECTION ANSWER
+c.     IN      TXT "another hello from initial RPZ"
+c.     IN      TXT "hello from initial RPZ"
+ENTRY_END
+
+STEP 9 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+c.rpz-ip.      IN A
+ENTRY_END
+
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+c.rpz-ip.      IN      A
+SECTION ANSWER
+c.rpz-ip.      IN      A 10.66.0.4
+c.rpz-ip.      IN      A 10.66.0.3
+ENTRY_END
+
+STEP 11 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+d.     IN      TXT
+ENTRY_END
+
+STEP 12 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA AA NXDOMAIN
+SECTION QUESTION
+d.     IN      TXT
+ENTRY_END
+
+STEP 13 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+d.rpz-ip.      IN      A
+ENTRY_END
+
+STEP 14 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NXDOMAIN
+SECTION QUESTION
+d.rpz-ip.      IN      A
+ENTRY_END
+
+STEP 30 TIME_PASSES ELAPSE 10
+STEP 40 TRAFFIC
+
+STEP 50 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+b.     IN      TXT
+ENTRY_END
+
+STEP 51 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA AA NOERROR
+SECTION QUESTION
+b.     IN      TXT
+SECTION ANSWER
+b.     IN      TXT     "hello from RPZ"
+ENTRY_END
+
+STEP 52 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+a.     IN      TXT
+ENTRY_END
+
+STEP 53 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA AA NXDOMAIN
+SECTION QUESTION
+a.     IN      TXT
+SECTION ANSWER
+ENTRY_END
+
+STEP 54 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+a.rpz-ip.      IN      A
+ENTRY_END
+
+STEP 55 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NXDOMAIN
+SECTION QUESTION
+a.rpz-ip.      IN      A
+SECTION ANSWER
+ENTRY_END
+
+STEP 56 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+c.     IN      TXT
+ENTRY_END
+
+STEP 57 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA AA NOERROR
+SECTION QUESTION
+c.     IN      TXT
+SECTION ANSWER
+c.     IN      TXT "hello from RPZ"
+ENTRY_END
+
+STEP 58 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+c.rpz-ip.      IN      A
+ENTRY_END
+
+STEP 59 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+c.rpz-ip.      IN      A
+SECTION ANSWER
+c.rpz-ip.      IN      A 10.66.0.6
+c.rpz-ip.      IN      A 10.66.0.5
+ENTRY_END
+
+STEP 60 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+d.     IN      TXT
+ENTRY_END
+
+STEP 61 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+d.     IN      TXT
+SECTION ANSWER
+d.     IN      TXT "hello from upstream"
+ENTRY_END
+
+STEP 62 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+d.rpz-ip.      IN      A
+ENTRY_END
+
+STEP 63 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+d.rpz-ip.      IN      A
+SECTION ANSWER
+d.rpz-ip.      IN      A 10.0.123.4
+ENTRY_END
+
+SCENARIO_END