[v9_9] fix DNS64 with RPZ-remapped A records

3468.	[security]	RPZ rules to generate A records (but not AAAA records)
			could trigger an assertion failure when used in
			conjunction with DNS64. [RT #32141]
(cherry picked from commit 71f8edccba553c4ed4988dd12ac877564e4987d1)

diff --git a/CHANGES b/CHANGES
index aa89d57cd82ba872468cb4df4296c8c48829943a..9ddb2921ef09e5dc409a97c50dcbb21d2aacf580 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,5 +1,9 @@
-3467.  [bug]   Added checks in dnssec-keygen and dnssec-settime to check for
-                       delete date < inactive date. [RT #31719]
+3468.  [security]      RPZ rules to generate A records (but not AAAA records)
+                       could trigger an assertion failure when used in
+                       conjunction with DNS64. [RT #32141]
+
+3467.  [bug]           Added checks in dnssec-keygen and dnssec-settime
+                       to check for delete date < inactive date. [RT #31719]
 
        --- 9.9.3b1 released ---
        

diff --git a/bin/named/query.c b/bin/named/query.c
index 87394ba51b79cf6087ba2205cb4e3b75930c4001..853b7955c622349bcc8f7191788908c6680fc553 100644 (file)
--- a/bin/named/query.c
+++ b/bin/named/query.c
@@ -5938,6 +5938,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
                        client->attributes &= ~(NS_CLIENTATTR_WANTDNSSEC |
                                                DNS_MESSAGEFLAG_AD);
                        query_putrdataset(client, &sigrdataset);
+                       rpz_st->q.is_zone = is_zone;
                        is_zone = ISC_TRUE;
                        rpz_log_rewrite(client, "", rpz_st->m.policy,
                                        rpz_st->m.type, rpz_st->qname);
@@ -6316,6 +6317,15 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
                        rdataset = NULL;
                        sigrdataset = NULL;
                        type = qtype = dns_rdatatype_a;
+                       rpz_st = client->query.rpz_st;
+                       if (rpz_st != NULL) {
+                               /*
+                                * Arrange for RPZ rewriting of any A records.
+                                */
+                               if ((rpz_st->state & DNS_RPZ_REWRITTEN) != 0)
+                                       is_zone = rpz_st->q.is_zone;
+                               rpz_st_clear(client);
+                       }
                        dns64 = ISC_TRUE;
                        goto db_find;
                }
@@ -6584,6 +6594,15 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
                        sigrdataset = NULL;
                        fname = NULL;
                        type = qtype = dns_rdatatype_a;
+                       rpz_st = client->query.rpz_st;
+                       if (rpz_st != NULL) {
+                               /*
+                                * Arrange for RPZ rewriting of any A records.
+                                */
+                               if ((rpz_st->state & DNS_RPZ_REWRITTEN) != 0)
+                                       is_zone = rpz_st->q.is_zone;
+                               rpz_st_clear(client);
+                       }
                        dns64 = ISC_TRUE;
                        goto db_find;
                }
@@ -7084,6 +7103,15 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
                        rdataset = NULL;
                        sigrdataset = NULL;
                        type = qtype = dns_rdatatype_a;
+                       rpz_st = client->query.rpz_st;
+                       if (rpz_st != NULL) {
+                               /*
+                                * Arrange for RPZ rewriting of any A records.
+                                */
+                               if ((rpz_st->state & DNS_RPZ_REWRITTEN) != 0)
+                                       is_zone = rpz_st->q.is_zone;
+                               rpz_st_clear(client);
+                       }
                        dns64_exclude = dns64 = ISC_TRUE;
                        goto db_find;
                }

diff --git a/bin/tests/system/dns64/ns1/example.db b/bin/tests/system/dns64/ns1/example.db
index 44c563963150f65d0eb1ab60dbaaa090f9171a8c..161b8ef6c59f57c26957c433de6e51c46cedf3cc 100644 (file)
--- a/bin/tests/system/dns64/ns1/example.db
+++ b/bin/tests/system/dns64/ns1/example.db
@@ -53,3 +53,4 @@ ttl-less-than-600 500 A 5.6.7.8
 ttl-more-than-600 700 A 5.6.7.8
 ttl-less-than-minimum 1100 A 5.6.7.8
 ttl-more-than-minimum 1300 A 5.6.7.8
+rpz 1500 A 99.99.99.99

diff --git a/bin/tests/system/dns64/ns2/named.conf b/bin/tests/system/dns64/ns2/named.conf
index df6fb9273b1faadd8fdddb7fe0235e7455aac783..c2ba378d53e460258279640f4d6b28d947024af2 100644 (file)
--- a/bin/tests/system/dns64/ns2/named.conf
+++ b/bin/tests/system/dns64/ns2/named.conf
@@ -56,9 +56,18 @@ options {
        dns64 2001:48::/48 { clients { 10.53.0.6; }; };
        dns64 2001:56::/56 { clients { 10.53.0.6; }; };
        dns64 2001:64::/64 { clients { 10.53.0.6; }; };
+
+       dns64 2001:96::/96 { clients { 10.53.0.7; }; };
+
+        response-policy { zone "rpz"; };
 };
 
 zone "." {
        type hint;
        file "../../common/root.hint";
 };
+
+zone "rpz" {
+       type master;
+       file "rpz.db";
+};

diff --git a/bin/tests/system/dns64/ns2/rpz.db b/bin/tests/system/dns64/ns2/rpz.db
new file mode 100644 (file)
index 0000000..7a56e82
--- /dev/null
+++ b/bin/tests/system/dns64/ns2/rpz.db
@@ -0,0 +1,12 @@
+$TTL 86400      ; 1 day
+@               IN SOA  rpz. noc.rpz. (
+                                1         ; serial
+                                86400      ; refresh (1 day)
+                                3600       ; retry (1 hour)
+                                2592000    ; expire (4 weeks 2 days)
+                                25200      ; minimum (7 hours)
+                                )
+                        NS      @
+                        IN A    10.53.0.2
+
+rpz.example IN A    10.10.10.10

diff --git a/bin/tests/system/dns64/tests.sh b/bin/tests/system/dns64/tests.sh
index 1111c2f70a151a505ba5f652c094c651e1c00120..dbb8717bdb031e06c68e855040788f020b461bf4 100644 (file)
--- a/bin/tests/system/dns64/tests.sh
+++ b/bin/tests/system/dns64/tests.sh
@@ -1352,5 +1352,12 @@ n=`expr $n + 1`
 if [ $ret != 0 ]; then echo "I:failed"; fi
 status=`expr $status + $ret`
 
+echo "I: checking synthesis of AAAA from RPZ-remapped A ($n)"
+$DIG $DIGOPTS aaaa rpz.example +rec -b 10.53.0.7 @10.53.0.2 > dig.out.ns2.test$n || ret=1
+grep -i 'rpz.example.*IN.AAAA.2001:96::a0a:a0a' dig.out.ns2.test$n >/dev/null || ret=1
+n=`expr $n + 1`
+if [ $ret != 0 ]; then echo "I:failed"; fi
+status=`expr $status + $ret`
+
 echo "I:exit status: $status"
 exit $status