From: Mark Andrews <marka@isc.org>
Date: Thu, 23 Jul 2026 05:06:20 +0000 (+1000)
Subject: Report RPZ prefixes in not canonical form as error
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=470824d44b8bfb6007a7b7e0b8814929f6483ebd;p=thirdparty%2Fbind9.git

Report RPZ prefixes in not canonical form as error

RPZ prefixes in not canonical form where not effective but were not
reported as an error like other parsing errors.  This has been
fixed.
---

diff --git a/bin/tests/system/rpz/tests.sh b/bin/tests/system/rpz/tests.sh
index 7ce7b0926a1..82a7135ca10 100644
--- a/bin/tests/system/rpz/tests.sh
+++ b/bin/tests/system/rpz/tests.sh
@@ -494,8 +494,8 @@ ckstats $ns5 test1 ns5 0
 ckstats $ns6 test1 ns6 0
 
 start_group "IP rewrites" test2
-msg='rpz IP address "128.2.0.0.0.0.3.2.2001" is not the canonical "128.2.zz.3.2.2001"'
-grep "$msg" ns3/named.run >/dev/null || setret "expected 'is not the canonical' message not logged"
+msg='invalid rpz IP address "128.2.0.0.0.0.3.2.2001.rpz-ip.bl" is not in canonical form 128.2.zz.3.2.2001.rpz-nsdname.bl'
+grep "$msg" ns3/named.run >/dev/null || setret "expected 'not in canonical form' message not logged"
 nodata a3-1.tld2                    # 1 NODATA
 nochange a3-2.tld2                  # 2 no policy record so no change
 nochange a4-1.tld2                  # 3 obsolete PASSTHRU record style
diff --git a/lib/dns/rpz.c b/lib/dns/rpz.c
index a0c6737e4fa..684f2567521 100644
--- a/lib/dns/rpz.c
+++ b/lib/dns/rpz.c
@@ -1008,27 +1008,22 @@ name2ipkey(int log_level, dns_rpz_zone_t *rpz, dns_rpz_type_t rpz_type,
 	}
 
 	/*
-	 * Complain about bad names but be generous and accept them.
+	 * Convert the address back to a canonical domain name
+	 * to ensure that the original name is in canonical form.
 	 */
-	if (log_level < DNS_RPZ_DEBUG_QUIET && isc_log_wouldlog(log_level)) {
-		/*
-		 * Convert the address back to a canonical domain name
-		 * to ensure that the original name is in canonical form.
-		 */
-		dns_name_t *ip_name2 = dns_fixedname_initname(&ip_name2f);
-		result = ip2name(tgt_ip, (dns_rpz_prefix_t)prefix_num, NULL,
-				 ip_name2);
-		if (result != ISC_R_SUCCESS ||
-		    !dns_name_equal(&ip_name, ip_name2))
-		{
-			char ip2_str[DNS_NAME_FORMATSIZE];
-			dns_name_format(ip_name2, ip2_str, sizeof(ip2_str));
-			isc_log_write(DNS_LOGCATEGORY_RPZ, DNS_LOGMODULE_RPZ,
-				      log_level,
-				      "rpz IP address \"%s\""
-				      " is not the canonical \"%s\"",
-				      ip_str, ip2_str);
+	dns_name_t *ip_name2 = dns_fixedname_initname(&ip_name2f);
+	result = ip2name(tgt_ip, (dns_rpz_prefix_t)prefix_num, NULL, ip_name2);
+	if (result != ISC_R_SUCCESS || !dns_name_equal(&ip_name, ip_name2)) {
+		char ip2_str[DNS_NAME_FORMATSIZE];
+		if (rpz_type == DNS_RPZ_TYPE_QNAME) {
+			dns_name_concatenate(ip_name2, &rpz->origin, ip_name2);
+		} else {
+			dns_name_concatenate(ip_name2, &rpz->nsdname, ip_name2);
 		}
+		dns_name_format(ip_name2, ip2_str, sizeof(ip2_str));
+		badname(log_level, src_name, " is not in canonical form ",
+			ip2_str);
+		return ISC_R_FAILURE;
 	}
 
 	return ISC_R_SUCCESS;