A couple of RPZ options were not reconfigured as expected

[bug]	Changes to the RPZ response-policy min-update-interval
	and add-soa options now take effect as expected when
	named is reconfigured. [GL #3740]

(cherry picked from commit d8a3d328db1fb530b6f29c03291e80252251a2e1)

diff --git a/CHANGES b/CHANGES
index 1cd6b8991fe669bfe3cdf07de258d6560b8b03e0..3fd8080ae6a7e833793fff4543f54b2362b1bad5 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,7 @@
+6050.  [bug]           Changes to the RPZ response-policy min-update-interval
+                       and add-soa options now take effect as expected when
+                       named is reconfigured. [GL #3740]
+
 6048.  [bug]           Fix a log message error in dns_catz_update_from_db(),
                        where serials with values of 2^31 or larger were logged
                        incorrectly as negative numbers. [GL #3742]

diff --git a/bin/named/server.c b/bin/named/server.c
index a1bee56b4d9a8fc8a641365c5ffd4bce07cc3f6a..29aed792b4f303e2a52ca1c5f86e9e17c3762dbd 100644 (file)
--- a/bin/named/server.c
+++ b/bin/named/server.c
@@ -2330,6 +2330,9 @@ configure_rpz_zone(dns_view_t *view, const cfg_listelt_t *element,
        } else {
                zone->max_policy_ttl = ttl_default;
        }
+       if (*old_rpz_okp && zone->max_policy_ttl != old->max_policy_ttl) {
+               *old_rpz_okp = false;
+       }
 
        obj = cfg_tuple_get(rpz_obj, "min-update-interval");
        if (cfg_obj_isduration(obj)) {
@@ -2337,8 +2340,9 @@ configure_rpz_zone(dns_view_t *view, const cfg_listelt_t *element,
        } else {
                zone->min_update_interval = minupdateinterval_default;
        }
-
-       if (*old_rpz_okp && zone->max_policy_ttl != old->max_policy_ttl) {
+       if (*old_rpz_okp &&
+           zone->min_update_interval != old->min_update_interval)
+       {
                *old_rpz_okp = false;
        }
 
@@ -2441,6 +2445,9 @@ configure_rpz_zone(dns_view_t *view, const cfg_listelt_t *element,
        } else {
                zone->addsoa = cfg_obj_asboolean(obj);
        }
+       if (*old_rpz_okp && zone->addsoa != old->addsoa) {
+               *old_rpz_okp = false;
+       }
 
        return (ISC_R_SUCCESS);
 }

diff --git a/bin/tests/system/rpz/tests.sh b/bin/tests/system/rpz/tests.sh
index 03d5d9780a07cf7319144146ae2c9eeb1985cca8..6505082b2c44ff351d520996d45468bd62e56480 100644 (file)
--- a/bin/tests/system/rpz/tests.sh
+++ b/bin/tests/system/rpz/tests.sh
@@ -918,7 +918,18 @@ EOF
 
   if [ native = "$mode" ]; then
     t=`expr $t + 1`
-    echo_i "checking that "add-soa unset" works (${t})"
+    echo_i "reconfiguring server with 'add-soa no' (${t})"
+    cp ns3/named.conf ns3/named.conf.tmp
+    sed -e "s/add-soa yes/add-soa no/g" < ns3/named.conf.tmp > ns3/named.conf
+    rndc_reconfig ns3 $ns3
+    echo_i "checking that 'add-soa no' at response-policy level works (${t})"
+    $DIG walled.tld2 -p ${PORT} +noall +add @$ns3 > dig.out.${t}
+    grep "^manual-update-rpz\..*SOA" dig.out.${t} > /dev/null && setret "failed"
+  fi
+
+  if [ native = "$mode" ]; then
+    t=`expr $t + 1`
+    echo_i "checking that 'add-soa unset' works (${t})"
     $DIG walled.tld2 -p ${PORT} +noall +add @$ns8 > dig.out.${t}
     grep "^manual-update-rpz\..*SOA" dig.out.${t} > /dev/null || setret "failed"
   fi