check that bits 64..71 in a dns64 prefix are zero

(cherry picked from commit a7ec7eb6edaa71c3cc141879ce23c5369bbabf87)

diff --git a/bin/tests/system/dns64/clean.sh b/bin/tests/system/dns64/clean.sh
index fdb0053d9fe091e7cbd57f0a126ca25797da7548..8bb11df2d91ea090783bc4541eb82ae746c60a31 100644 (file)
--- a/bin/tests/system/dns64/clean.sh
+++ b/bin/tests/system/dns64/clean.sh
@@ -9,11 +9,8 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
-rm -f ns*/named.conf
-rm -f ns1/K*
-rm -f ns1/signed.db*
-rm -f ns1/dsset-signed.
 rm -f */named.memstats
 rm -f */named.run
+rm -f checkconf.out*
 rm -f dig.out.*
 rm -f ns*/named.lock

diff --git a/bin/tests/system/dns64/conf/bad18.conf b/bin/tests/system/dns64/conf/bad18.conf
new file mode 100644 (file)
index 0000000..60a9ad5
--- /dev/null
+++ b/bin/tests/system/dns64/conf/bad18.conf
@@ -0,0 +1,14 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+       dns64 ::/32 { suffix ::8000:0000:0000:0000; }; /* bits [64..71] MBZ */
+};

diff --git a/bin/tests/system/dns64/conf/bad19.conf b/bin/tests/system/dns64/conf/bad19.conf
new file mode 100644 (file)
index 0000000..3fa8b4c
--- /dev/null
+++ b/bin/tests/system/dns64/conf/bad19.conf
@@ -0,0 +1,14 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+       dns64 ::/32 { suffix ::0100:0000:0000:0000; }; /* bits [64..71] MBZ */
+};

diff --git a/bin/tests/system/dns64/conf/warn1.conf b/bin/tests/system/dns64/conf/warn1.conf
new file mode 100644 (file)
index 0000000..8bc2f48
--- /dev/null
+++ b/bin/tests/system/dns64/conf/warn1.conf
@@ -0,0 +1,14 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+       dns64 0000:0000:0000:0000:0100:000f::/96 { };  /* bits [64..71] MBZ */
+};

diff --git a/bin/tests/system/dns64/conf/warn2.conf b/bin/tests/system/dns64/conf/warn2.conf
new file mode 100644 (file)
index 0000000..8cf4cd8
--- /dev/null
+++ b/bin/tests/system/dns64/conf/warn2.conf
@@ -0,0 +1,14 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+       dns64 0000:0000:0000:0000:0200:000f::/96 { }; /* bits [64..71] MBZ */
+};

diff --git a/bin/tests/system/dns64/conf/warn3.conf b/bin/tests/system/dns64/conf/warn3.conf
new file mode 100644 (file)
index 0000000..277f324
--- /dev/null
+++ b/bin/tests/system/dns64/conf/warn3.conf
@@ -0,0 +1,14 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+       dns64 0000:0000:0000:0000:0400:000f::/96 { }; /* bits [64..71] MBZ */
+};

diff --git a/bin/tests/system/dns64/conf/warn4.conf b/bin/tests/system/dns64/conf/warn4.conf
new file mode 100644 (file)
index 0000000..ee8ee3c
--- /dev/null
+++ b/bin/tests/system/dns64/conf/warn4.conf
@@ -0,0 +1,14 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+       dns64 0000:0000:0000:0000:0800:000f::/96 { }; /* bits [64..71] MBZ */
+};

diff --git a/bin/tests/system/dns64/conf/warn5.conf b/bin/tests/system/dns64/conf/warn5.conf
new file mode 100644 (file)
index 0000000..1551192
--- /dev/null
+++ b/bin/tests/system/dns64/conf/warn5.conf
@@ -0,0 +1,14 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+       dns64 0000:0000:0000:0000:1000:000f::/96 { }; /* bits [64..71] MBZ */
+};

diff --git a/bin/tests/system/dns64/conf/warn6.conf b/bin/tests/system/dns64/conf/warn6.conf
new file mode 100644 (file)
index 0000000..c41356f
--- /dev/null
+++ b/bin/tests/system/dns64/conf/warn6.conf
@@ -0,0 +1,14 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+       dns64 0000:0000:0000:0000:2000:000f::/96 { }; /* bits [64..71] MBZ */
+};

diff --git a/bin/tests/system/dns64/conf/warn7.conf b/bin/tests/system/dns64/conf/warn7.conf
new file mode 100644 (file)
index 0000000..58c7915
--- /dev/null
+++ b/bin/tests/system/dns64/conf/warn7.conf
@@ -0,0 +1,14 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+       dns64 0000:0000:0000:0000:4000:000f::/96 { }; /* bits [64..71] MBZ */
+};

diff --git a/bin/tests/system/dns64/conf/warn8.conf b/bin/tests/system/dns64/conf/warn8.conf
new file mode 100644 (file)
index 0000000..fe9c63e
--- /dev/null
+++ b/bin/tests/system/dns64/conf/warn8.conf
@@ -0,0 +1,14 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+       dns64 0000:0000:0000:0000:8000:000f::/96 { }; /* bits [64..71] MBZ */
+};

diff --git a/bin/tests/system/dns64/tests.sh b/bin/tests/system/dns64/tests.sh
index ce5287efc6c28c66a1c7891254c5e6587c173c69..ed1e8af9a0cefe6c4cf6acd70cda17f4b18ba48c 100644 (file)
--- a/bin/tests/system/dns64/tests.sh
+++ b/bin/tests/system/dns64/tests.sh
@@ -39,6 +39,19 @@ do
         status=`expr $status + $ret`
 done
 
+for conf in conf/warn*.conf
+do
+        echo_i "checking that $conf produces a warning ($n)"
+        ret=0
+        $CHECKCONF "$conf" > checkconf.out$n || ret=1
+       l=`wc -l < checkconf.out$n`
+       grep "warning" checkconf.out$n > /dev/null || ret=1
+       test $l -ne 0 || ret=1
+       n=`expr $n + 1`
+        if [ $ret != 0 ]; then echo_i "failed"; fi
+        status=`expr $status + $ret`
+done
+
 # Check the example. domain
 
 echo_i "checking non-excluded AAAA lookup works ($n)"

diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
index 6cb0f1caf33e6123197cbacbcd1b6a7aa7dacc65..5565b601a364a0dce320d9efa4544086a06e9f12 100644 (file)
--- a/doc/arm/Bv9ARM-book.xml
+++ b/doc/arm/Bv9ARM-book.xml
@@ -5265,7 +5265,9 @@ options {
              </para>
              <para>
                Compatible IPv6 prefixes have lengths of 32, 40, 48, 56,
-               64 and 96 as per RFC 6052.
+               64 and 96 as per RFC 6052.  Bits 64..71 inclusive must
+               be zero with the most significate bit of the prefix in
+               position 0.
              </para>
              <para>
                Additionally a reverse IP6.ARPA zone will be created for

diff --git a/lib/bind9/check.c b/lib/bind9/check.c
index faf2040a11b5bd08eb1b7bfd64f60d148dc26a06..ec0ab6daf92bf93d9b754ea07abf5a12a63b7aaa 100644 (file)
--- a/lib/bind9/check.c
+++ b/lib/bind9/check.c
@@ -519,6 +519,12 @@ check_dns64(cfg_aclconfctx_t *actx, const cfg_obj_t *voptions,
                        continue;
                }
 
+               if (na.type.in6.s6_addr[8] != 0) {
+                       cfg_obj_log(map, logctx, ISC_LOG_WARNING,
+                                   "warning: invalid prefix, bits [64..71] "
+                                   "must be zero");
+               }
+
                if (prefixlen != 32 && prefixlen != 40 && prefixlen != 48 &&
                    prefixlen != 56 && prefixlen != 64 && prefixlen != 96) {
                        cfg_obj_log(map, logctx, ISC_LOG_ERROR,

diff --git a/util/copyrights b/util/copyrights
index 68101f612ca271b2fa488d2bc9024d2e19bba433..5e7fa61b3c3f02e4246dd1d77844f183a2600bfb 100644 (file)
--- a/util/copyrights
+++ b/util/copyrights
@@ -1059,6 +1059,8 @@
 ./bin/tests/system/dlzexternal/tests.sh                SH      2010,2011,2012,2013,2014,2015,2016,2018,2019
 ./bin/tests/system/dns64/clean.sh              SH      2010,2012,2014,2015,2016,2018,2019
 ./bin/tests/system/dns64/conf/bad1.conf                CONF-C  2010,2016,2018,2019
+./bin/tests/system/dns64/conf/bad18.conf       CONF-C  2019
+./bin/tests/system/dns64/conf/bad19.conf       CONF-C  2019
 ./bin/tests/system/dns64/conf/bad2.conf                CONF-C  2010,2016,2018,2019
 ./bin/tests/system/dns64/conf/bad3.conf                CONF-C  2010,2016,2018,2019
 ./bin/tests/system/dns64/conf/bad4.conf                CONF-C  2010,2016,2018,2019
@@ -1072,6 +1074,14 @@
 ./bin/tests/system/dns64/conf/good3.conf       CONF-C  2010,2016,2018,2019
 ./bin/tests/system/dns64/conf/good4.conf       CONF-C  2010,2016,2018,2019
 ./bin/tests/system/dns64/conf/good5.conf       CONF-C  2010,2016,2018,2019
+./bin/tests/system/dns64/conf/warn1.conf       CONF-C  2019
+./bin/tests/system/dns64/conf/warn2.conf       CONF-C  2019
+./bin/tests/system/dns64/conf/warn3.conf       CONF-C  2019
+./bin/tests/system/dns64/conf/warn4.conf       CONF-C  2019
+./bin/tests/system/dns64/conf/warn5.conf       CONF-C  2019
+./bin/tests/system/dns64/conf/warn6.conf       CONF-C  2019
+./bin/tests/system/dns64/conf/warn7.conf       CONF-C  2019
+./bin/tests/system/dns64/conf/warn8.conf       CONF-C  2019
 ./bin/tests/system/dns64/ns1/example.db                ZONE    2010,2011,2013,2016,2018,2019
 ./bin/tests/system/dns64/ns1/named.conf.in     CONF-C  2018,2019
 ./bin/tests/system/dns64/ns1/root.db           ZONE    2010,2016,2018,2019