Correct RPZ NSDNAME precedence documentation

The implementation intentionally prefers the name appearing last in
DNSSEC canonical order. Align the ARM and source comment with the RPZ
specification.

diff --git a/doc/arm/reference.rst b/doc/arm/reference.rst
index cbe42d6913a4ad48858d2a604f1702a712258ad6..76e0afa4f00bb66d46e7af900f0cf156fab0e892 100644 (file)
--- a/doc/arm/reference.rst
+++ b/doc/arm/reference.rst
@@ -5113,8 +5113,8 @@ rewriting in the following order:
    response-policy option.
 2. Prefer CLIENT-IP to QNAME to IP to NSDNAME to NSIP triggers in a
    single zone.
-3. Among NSDNAME triggers, prefer the trigger that matches the smallest
-   name under the DNSSEC ordering.
+3. Among NSDNAME triggers, prefer the trigger whose matched name server
+   domain name appears last in the DNSSEC canonical ordering.
 4. Among IP or NSIP triggers, prefer the trigger with the longest
    prefix.
 5. Among triggers with the same prefix length, prefer the IP or NSIP

diff --git a/lib/ns/query.c b/lib/ns/query.c
index 65c92f5371e7477d7f31c1d59f4ec71e1f40bb4d..2059619a21ce9affaa4d48ad56a3f128f9f91bd1 100644 (file)
--- a/lib/ns/query.c
+++ b/lib/ns/query.c
@@ -3583,7 +3583,8 @@ rpz_rewrite_name(ns_client_t *client, dns_name_t *trig_name,
                         * With more than one applicable policy, prefer
                         * the earliest configured policy,
                         * client-IP over QNAME over IP over NSDNAME over NSIP,
-                        * and the smallest name.
+                        * and the name that appears last in DNSSEC canonical
+                        * order.
                         * We known st->m.rpz->num >= rpz->num  and either
                         * st->m.rpz->num > rpz->num or st->m.type >= rpz_type
                         */