Check that RPZ 'CNAME *.' (NODATA) works with DNS64.

(cherry picked from commit b9dc9b68cdbf51eb2656495c6d13e6b0f2279979)

diff --git a/bin/tests/system/rpz/ns1/root.db b/bin/tests/system/rpz/ns1/root.db
index 0abc1a2f999e6d0e8522592dac0691af36d5b6e7..2e8ce08e6978cec6d4d58260ddcbdee249279baf 100644 (file)
--- a/bin/tests/system/rpz/ns1/root.db
+++ b/bin/tests/system/rpz/ns1/root.db
@@ -33,3 +33,8 @@ ns.tld5.      A       10.53.0.5
 
 ; generate SERVFAIL
 servfail       NS      ns.tld2.
+
+a-only.example A       1.2.3.4
+no-a-no-aaaa.example   TXT     placeholder
+a-plus-aaaa.example    A       1.2.3.4
+a-plus-aaaa.example    AAAA    ::1

diff --git a/bin/tests/system/rpz/ns9/hints b/bin/tests/system/rpz/ns9/hints
new file mode 100644 (file)
index 0000000..28e5850
--- /dev/null
+++ b/bin/tests/system/rpz/ns9/hints
@@ -0,0 +1,11 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+.      120     NS      ns.
+ns.    120     A       10.53.0.1

diff --git a/bin/tests/system/rpz/ns9/named.conf.in b/bin/tests/system/rpz/ns9/named.conf.in
new file mode 100644 (file)
index 0000000..12d3a7b
--- /dev/null
+++ b/bin/tests/system/rpz/ns9/named.conf.in
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+
+/*
+ * DNS64 / RPZ server.
+ */
+
+options {
+       query-source address 10.53.0.9;
+       notify-source 10.53.0.9;
+       transfer-source 10.53.0.9;
+       port @PORT@;
+       pid-file "named.pid";
+       statistics-file "named.stats";
+       session-keyfile "session.key";
+       listen-on { 10.53.0.9; };
+       listen-on-v6 { none; };
+       notify yes;
+       minimal-responses no;
+       recursion yes;
+       dnssec-validation yes;
+       dns64-server "example.localdomain.";
+       dns64 64:ff9b::/96 { };
+       response-policy {
+           zone "rpz";
+       }
+       qname-wait-recurse no ;
+
+       notify-delay 0;
+};
+
+logging { category rpz { default_debug; }; };
+
+key rndc_key {
+       secret "1234abcd8765";
+       algorithm hmac-sha256;
+};
+controls {
+       inet 10.53.0.9 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+
+zone "." { type hint; file "hints"; };
+
+zone "rpz." {
+       type master;
+       file "rpz.db";
+       notify no;
+};

diff --git a/bin/tests/system/rpz/ns9/rpz.db b/bin/tests/system/rpz/ns9/rpz.db
new file mode 100644 (file)
index 0000000..8840a09
--- /dev/null
+++ b/bin/tests/system/rpz/ns9/rpz.db
@@ -0,0 +1,14 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+rpz.                                    28800 IN SOA      rpz. hostmaster.rpz. 6 10800 3600 2419200 900
+rpz.                                    28800 IN NS       .
+a-only.example.rpz.                     28800 IN CNAME    *.
+no-a-no-aaaa.example.rpz.               28800 IN CNAME    *.
+a-plus-aaaa.example.rpz.                28800 IN CNAME    *.

diff --git a/bin/tests/system/rpz/setup.sh b/bin/tests/system/rpz/setup.sh
index dc4ecd869e46f189c9a988611183997137c2c749..d6c78b029314fe6a721dcd1b5149c31f179000c9 100644 (file)
--- a/bin/tests/system/rpz/setup.sh
+++ b/bin/tests/system/rpz/setup.sh
@@ -25,6 +25,7 @@ copy_setports ns4/named.conf.in ns4/named.conf
 copy_setports ns5/named.conf.in ns5/named.conf
 copy_setports ns6/named.conf.in ns6/named.conf
 copy_setports ns7/named.conf.in ns7/named.conf
+copy_setports ns9/named.conf.in ns9/named.conf
 
 # set up test policy zones.
 #   bl is the main test zone

diff --git a/bin/tests/system/rpz/tests.sh b/bin/tests/system/rpz/tests.sh
index 3a5e9d773e36db77e0b604547278088330328c49..5636b8d35c9478a3e712086abec6a1c0b7ee36fc 100644 (file)
--- a/bin/tests/system/rpz/tests.sh
+++ b/bin/tests/system/rpz/tests.sh
@@ -25,6 +25,7 @@ HAVE_CORE=
 SAVE_RESULTS=
 
 status=0
+t=0
 
 USAGE="$0: [-x]"
 while getopts "x" c; do
@@ -706,6 +707,33 @@ EOF
   echo_i "checking rpz with delegation fails correctly"
   $DIG -p ${PORT} @$ns3 ns example.com > dig.out.delegation
   grep "status: SERVFAIL" dig.out.delegation > /dev/null || setret "I:failed"
+
+  # RPZ 'CNAME *.' (NODATA) trumps DNS64.  Test against various DNS64 senarios.
+  for label in a-only no-a-no-aaaa a-plus-aaaa
+  do
+    for type in AAAA A
+    do
+      t=`expr $t + 1`
+      case $label in
+      a-only)
+       echo_i "checking rpz 'CNAME *.' (NODATA) with dns64, $type lookup with A-only (${t})"
+       ;;
+      no-a-no-aaaa)
+       echo_i "checking rpz 'CNAME *.' (NODATA) with dns64, $type lookup with no A or AAAA (${t})"
+       ;;
+      a-plus-aaaa)
+       echo_i "checking rpz 'CNAME *.' (NODATA) with dns64, $type lookup with A and AAAA (${t})"
+       ;;
+      esac
+      ret=0
+      $DIG ${label}.example -p ${PORT} $type @10.53.0.9 > dig.out.${t}
+      grep "status: NOERROR" dig.out.$t > /dev/null || ret=1
+      grep "ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 2$" dig.out.$t > /dev/null || ret=1
+      grep "^rpz"  dig.out.$t > /dev/null || ret=1
+      [ $ret -eq 0 ] || echo_i "failed"
+      status=`expr $status + $ret`
+    done
+  done
 done
 
 echo_i "exit status: $status"

diff --git a/util/copyrights b/util/copyrights
index cbedfb57a81749b25c7e7246aac39d3ed205fd09..d6144f1d733c078bb0c46651eed2ab320675e42b 100644 (file)
--- a/util/copyrights
+++ b/util/copyrights
@@ -2042,6 +2042,9 @@
 ./bin/tests/system/rpz/ns6/named.conf.in       CONF-C  2018,2019
 ./bin/tests/system/rpz/ns7/hints               ZONE    2014,2016,2018,2019
 ./bin/tests/system/rpz/ns7/named.conf.in       CONF-C  2018,2019
+./bin/tests/system/rpz/ns9/hints               ZONE    2019
+./bin/tests/system/rpz/ns9/named.conf.in       CONF-C  2019
+./bin/tests/system/rpz/ns9/rpz.db              ZONE    2019
 ./bin/tests/system/rpz/prereq.sh               SH      2014,2016,2018,2019
 ./bin/tests/system/rpz/qperf.sh                        SH      2012,2013,2016,2018,2019
 ./bin/tests/system/rpz/setup.sh                        SH      2011,2012,2013,2014,2016,2018,2019