Do not attempt to perform a DNS64 rewrite if RPZ returns NODATA.

diff --git a/lib/dns/include/dns/rpz.h b/lib/dns/include/dns/rpz.h
index 612a543e5fec66d5338ae0ace8f473632eba488d..0c403d8a9e27fe22c2cc612a779c0b7d9e57ae25 100644 (file)
--- a/lib/dns/include/dns/rpz.h
+++ b/lib/dns/include/dns/rpz.h
@@ -71,6 +71,7 @@ typedef enum {
        DNS_RPZ_POLICY_NXDOMAIN = 5,    /* 'nxdomain': answer with NXDOMAIN */
        DNS_RPZ_POLICY_NODATA = 6,      /* 'nodata': answer with ANCOUNT=0 */
        DNS_RPZ_POLICY_CNAME = 7,       /* 'cname x': answer with x's rrsets */
+       DNS_RPZ_POLICY_DNS64,           /* Apply DN64 to the A rewrite */
        DNS_RPZ_POLICY_RECORD,
        DNS_RPZ_POLICY_WILDCNAME,
        DNS_RPZ_POLICY_MISS,

diff --git a/lib/dns/rpz.c b/lib/dns/rpz.c
index 5aaab10d1dc85a11eaf385eebb006118b48aa882..dc319dde4464119c7dc8c665f920081a48a0e155 100644 (file)
--- a/lib/dns/rpz.c
+++ b/lib/dns/rpz.c
@@ -265,6 +265,9 @@ dns_rpz_policy2str(dns_rpz_policy_t policy) {
        case DNS_RPZ_POLICY_MISS:
                str = "MISS";
                break;
+       case DNS_RPZ_POLICY_DNS64:
+               str = "DNS64";
+               break;
        default:
                INSIST(0);
                ISC_UNREACHABLE();

diff --git a/lib/ns/query.c b/lib/ns/query.c
index 39709bba83726a4fcccd35986fe6cd2bc468a60e..f1f2cf9b7dd0ae3d966e607fbe6d79941e1df980 100644 (file)
--- a/lib/ns/query.c
+++ b/lib/ns/query.c
@@ -2950,6 +2950,7 @@ rpz_find_p(ns_client_t *client, dns_name_t *self_name, dns_rdatatype_t qtype,
        isc_result_t result;
        dns_clientinfomethods_t cm;
        dns_clientinfo_t ci;
+       bool found_a = false;
 
        REQUIRE(nodep != NULL);
 
@@ -2993,6 +2994,18 @@ rpz_find_p(ns_client_t *client, dns_name_t *self_name, dns_rdatatype_t qtype,
                               "rpz_find_p: allrdatasets failed");
                        return (DNS_R_SERVFAIL);
                }
+               if (qtype == dns_rdatatype_aaaa &&
+                   !ISC_LIST_EMPTY(client->view->dns64)) {
+                       for (result = dns_rdatasetiter_first(rdsiter);
+                            result == ISC_R_SUCCESS;
+                            result = dns_rdatasetiter_next(rdsiter)) {
+                               dns_rdatasetiter_current(rdsiter, *rdatasetp);
+                               if ((*rdatasetp)->type == dns_rdatatype_a) {
+                                       found_a = true;
+                               }
+                               dns_rdataset_disassociate(*rdatasetp);
+                       }
+               }
                for (result = dns_rdatasetiter_first(rdsiter);
                     result == ISC_R_SUCCESS;
                     result = dns_rdatasetiter_next(rdsiter)) {
@@ -3045,7 +3058,11 @@ rpz_find_p(ns_client_t *client, dns_name_t *self_name, dns_rdatatype_t qtype,
                }
                return (ISC_R_SUCCESS);
        case DNS_R_NXRRSET:
-               *policyp = DNS_RPZ_POLICY_NODATA;
+               if (found_a) {
+                       *policyp = DNS_RPZ_POLICY_DNS64;
+               } else {
+                       *policyp = DNS_RPZ_POLICY_NODATA;
+               }
                return (result);
        case DNS_R_DNAME:
                /*
@@ -6424,8 +6441,10 @@ query_checkrpz(query_ctx_t *qctx, isc_result_t result) {
                        qctx->rpz = true;
                        break;
                case DNS_RPZ_POLICY_NODATA:
-                       result = DNS_R_NXRRSET;
                        qctx->nxrewrite = true;
+                       /* FALLTHROUGH */
+               case DNS_RPZ_POLICY_DNS64:
+                       result = DNS_R_NXRRSET;
                        qctx->rpz = true;
                        break;
                case DNS_RPZ_POLICY_RECORD:
@@ -8235,6 +8254,7 @@ query_nodata(query_ctx_t *qctx, isc_result_t res) {
        } else if ((result == DNS_R_NXRRSET ||
                    result == DNS_R_NCACHENXRRSET) &&
                   !ISC_LIST_EMPTY(qctx->view->dns64) &&
+                  !qctx->nxrewrite &&
                   qctx->client->message->rdclass == dns_rdataclass_in &&
                   qctx->qtype == dns_rdatatype_aaaa)
        {