simplification: search on rpz_st.p_name whenever RPZ is in use

- this is part of an effort to reduce interdependency between dns64 and
  other features, so that dns64 can more easily be compartmentalized
  into a module.
- this change keeps us from having to know whether dns64 is in use
  when updating the name to be searched for in query_lookup() because
  of RPZ processing. it seems to have no ill effects.
- also incorporated the test case from the CVE-2017-3135, which related
  to simultaneous use of dns64 and rpz.

diff --git a/bin/tests/system/dns64/ns3/example.db b/bin/tests/system/dns64/ns3/example.db
new file mode 100644 (file)
index 0000000..9b6d279
--- /dev/null
+++ b/bin/tests/system/dns64/ns3/example.db
@@ -0,0 +1,22 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 86400      ; 1 day
+@               SOA    example. noc.example. (
+                                1         ; serial
+                                86400      ; refresh (1 day)
+                                3600       ; retry (1 hour)
+                                2592000    ; expire (4 weeks 2 days)
+                                25200      ; minimum (7 hours)
+                                )
+                        NS      @
+                        IN A    10.53.0.3
+
+a              A       1.2.3.4
+noa            TXT     there is no A record here

diff --git a/bin/tests/system/dns64/ns3/named.conf.in b/bin/tests/system/dns64/ns3/named.conf.in
new file mode 100644 (file)
index 0000000..01abb12
--- /dev/null
+++ b/bin/tests/system/dns64/ns3/named.conf.in
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+// NS3
+
+controls { /* empty */ };
+
+acl rfc1918 { 10/8; 192.168/16; 172.16/12; };
+
+options {
+       query-source address 10.53.0.3;
+       notify-source 10.53.0.3;
+       transfer-source 10.53.0.3;
+       port @PORT@;
+       pid-file "named.pid";
+       listen-on { 10.53.0.3; };
+       listen-on-v6 { none; };
+       recursion yes;
+       notify yes;
+       dnssec-enable yes;
+       dnssec-validation yes;
+
+       dns64 2001:aaaa::/96 {
+               clients { none; };
+               mapped { !rfc1918; any; };
+               exclude { 2001:eeee::/32; 64:FF9B::/96; ::ffff:0000:0000/96; };
+               suffix ::;
+       };
+
+       dns64-server "dns64.example.net.";
+       dns64-contact "hostmaster.example.net.";
+
+       response-policy { zone "rpz"; };
+};
+
+zone "." {
+       type hint;
+       file "../../common/root.hint";
+};
+
+zone "rpz" {
+       type master;
+       file "rpz.db";
+};
+
+zone "example" {
+       type master;
+       file "example.db";
+};

diff --git a/bin/tests/system/dns64/ns3/rpz.db b/bin/tests/system/dns64/ns3/rpz.db
new file mode 100644 (file)
index 0000000..4703d62
--- /dev/null
+++ b/bin/tests/system/dns64/ns3/rpz.db
@@ -0,0 +1,21 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 86400      ; 1 day
+@               SOA    rpz. noc.rpz. (
+                                1         ; serial
+                                86400      ; refresh (1 day)
+                                3600       ; retry (1 hour)
+                                2592000    ; expire (4 weeks 2 days)
+                                25200      ; minimum (7 hours)
+                                )
+                        NS      @
+                        IN A    10.53.0.3
+a.example      CNAME   a.example.
+noa.example    CNAME   noa.example.

diff --git a/bin/tests/system/dns64/setup.sh b/bin/tests/system/dns64/setup.sh
index 5f2d9d26ded6ef745be7e7b3b176acfc89315dae..9c2756d6147f4cf70f8e9d184add38fdce5a0cee 100644 (file)
--- a/bin/tests/system/dns64/setup.sh
+++ b/bin/tests/system/dns64/setup.sh
@@ -16,5 +16,6 @@ $SHELL clean.sh
 
 copy_setports ns1/named.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
+copy_setports ns3/named.conf.in ns3/named.conf
 
 cd ns1 && $SHELL sign.sh

diff --git a/bin/tests/system/dns64/tests.sh b/bin/tests/system/dns64/tests.sh
index ce5287efc6c28c66a1c7891254c5e6587c173c69..bd2e03dce39adf54a9f449d66207f5e29d64ad74 100644 (file)
--- a/bin/tests/system/dns64/tests.sh
+++ b/bin/tests/system/dns64/tests.sh
@@ -1400,5 +1400,21 @@ n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
+echo_i "checking dns64 client resume after rpz match with A ($n)"
+ret=0
+$DIG $DIGOPTS aaaa a.example +rec @10.53.0.3 > dig.out.ns3.test$n || ret=1
+grep "status: NOERROR" dig.out.ns3.test$n >/dev/null || ret=1
+n=`expr $n + 1`
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
+echo_i "checking dns64 client resume after rpz match without A ($n)"
+ret=0
+$DIG $DIGOPTS aaaa noa.example +rec @10.53.0.3 > dig.out.ns3.test$n || ret=1
+grep "status: NOERROR" dig.out.ns3.test$n >/dev/null || ret=1
+n=`expr $n + 1`
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1

diff --git a/lib/ns/query.c b/lib/ns/query.c
index ce5d6374a163897f9c361a8e67e017be5d1a7fba..dba52bb6ab37c3e0408d45179fd0757886588889 100644 (file)
--- a/lib/ns/query.c
+++ b/lib/ns/query.c
@@ -5495,7 +5495,7 @@ query_lookup(query_ctx_t *qctx) {
        /*
         * Now look for an answer in the database.
         */
-       if (qctx->dns64 && qctx->rpz) {
+       if (qctx->rpz) {
                rpzqname = qctx->client->query.rpz_st->p_name;
        } else {
                rpzqname = qctx->client->query.qname;
@@ -5514,7 +5514,7 @@ query_lookup(query_ctx_t *qctx) {
        /*
         * Fixup fname and sigrdataset.
         */
-       if (qctx->dns64 && qctx->rpz) {
+       if (qctx->rpz) {
                isc_result_t rresult;
 
                rresult = dns_name_copy(qctx->client->query.qname,