A couple of RPZ options were not reconfigured as expected

[bug]	Changes to the RPZ response-policy min-update-interval
	and add-soa options now take effect as expected when
	named is reconfigured. [GL #3740]

diff --git a/CHANGES b/CHANGES
index 14be04987be4d1b8f9b3298d0605d401b808e904..869b930e99ec7be283662395ba12e75286a7db46 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,7 @@
+6050.  [bug]           Changes to the RPZ response-policy min-update-interval
+                       and add-soa options now take effect as expected when
+                       named is reconfigured. [GL #3740]
+
 6049.  [bug]           Exclude ABD hashtables from the ADB memory
                        overmem checks and don't clean ADB names
                        and ADB entries used in the last 10 seconds

diff --git a/bin/named/server.c b/bin/named/server.c
index 09eb53e2ed201b86f771807adfb6da5944e3709c..d6f5ed771b427f56575744ee482094ad211ae3a2 100644 (file)
--- a/bin/named/server.c
+++ b/bin/named/server.c
@@ -2309,6 +2309,9 @@ configure_rpz_zone(dns_view_t *view, const cfg_listelt_t *element,
        } else {
                zone->max_policy_ttl = ttl_default;
        }
+       if (*old_rpz_okp && zone->max_policy_ttl != old->max_policy_ttl) {
+               *old_rpz_okp = false;
+       }
 
        obj = cfg_tuple_get(rpz_obj, "min-update-interval");
        if (cfg_obj_isduration(obj)) {
@@ -2316,8 +2319,9 @@ configure_rpz_zone(dns_view_t *view, const cfg_listelt_t *element,
        } else {
                zone->min_update_interval = minupdateinterval_default;
        }
-
-       if (*old_rpz_okp && zone->max_policy_ttl != old->max_policy_ttl) {
+       if (*old_rpz_okp &&
+           zone->min_update_interval != old->min_update_interval)
+       {
                *old_rpz_okp = false;
        }
 
@@ -2432,6 +2436,9 @@ configure_rpz_zone(dns_view_t *view, const cfg_listelt_t *element,
        } else {
                zone->addsoa = cfg_obj_asboolean(obj);
        }
+       if (*old_rpz_okp && zone->addsoa != old->addsoa) {
+               *old_rpz_okp = false;
+       }
 
        return (ISC_R_SUCCESS);
 }

diff --git a/bin/tests/system/rpz/tests.sh b/bin/tests/system/rpz/tests.sh
index 36796dfccb76170f47c81f7829637121257d66eb..1cfafbe813c7898164db1bd29073b781185d1543 100644 (file)
--- a/bin/tests/system/rpz/tests.sh
+++ b/bin/tests/system/rpz/tests.sh
@@ -933,6 +933,17 @@ EOF
     grep "^manual-update-rpz\..*SOA" dig.out.${t} > /dev/null || setret "failed"
   fi
 
+  if [ native = "$mode" ]; then
+    t=`expr $t + 1`
+    echo_i "reconfiguring server with 'add-soa no' (${t})"
+    cp ns3/named.conf ns3/named.conf.tmp
+    sed -e "s/add-soa yes/add-soa no/g" < ns3/named.conf.tmp > ns3/named.conf
+    rndc_reconfig ns3 $ns3
+    echo_i "checking that 'add-soa no' at response-policy level works (${t})"
+    $DIG walled.tld2 -p ${PORT} +noall +add @$ns3 > dig.out.${t}
+    grep "^manual-update-rpz\..*SOA" dig.out.${t} > /dev/null && setret "failed"
+  fi
+
   if [ native = "$mode" ]; then
     t=`expr $t + 1`
     echo_i "checking that 'add-soa unset' works (${t})"