[master] disallow map zones in response-policy

4269.	[bug]		Zones using "map" format master files currently
			don't work as policy zones.  This limitation has
			now been documented; attempting to use such zones
			in "response-policy" statements is now a
			configuration error.  [RT #38321]

diff --git a/CHANGES b/CHANGES
index febce4882dbeb44fc4b76a79dd383dcaf9ea63e9..fb1abaee58d4b7e472b1721ffe708b5c0121f7d3 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,9 @@
+4269.  [bug]           Zones using "map" format master files currently
+                       don't work as policy zones.  This limitation has
+                       now been documented; attempting to use such zones
+                       in "response-policy" statements is now a
+                       configuration error.  [RT #38321]
+
 4268.  [func]          "rndc status" now reports the path to the
                        configuration file. [RT #36470]
 

diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
index e22f54f3e02c2c7574f1038f20f81c5660887784..1748d7ccfbd4a7dffa49131e96e1e7d1d599b21b 100644 (file)
--- a/doc/arm/Bv9ARM-book.xml
+++ b/doc/arm/Bv9ARM-book.xml
@@ -9924,6 +9924,8 @@ deny-answer-aliases { "example.net"; };
            that can be queried normally if allowed.
            It is usually best to restrict those queries with something like
            <command>allow-query { localhost; };</command>.
+           Note that zones using <command>masterfile-format map</command>
+           cannot be used as policy zones.
          </para>
 
          <para>

diff --git a/doc/arm/notes.xml b/doc/arm/notes.xml
index 3bd6690ccb62679d2a234a6fba5cf70115259ae0..9c23f721205e2b0168f5fa221c4457167559622c 100644 (file)
--- a/doc/arm/notes.xml
+++ b/doc/arm/notes.xml
@@ -907,6 +907,17 @@
              when the server was reloaded or reconfigured. [RT #41058]
            </para>
          </listitem>
+         <listitem>
+           <para>
+             Zones configured to use <command>map</command> format
+             master files can't be used as policy zones because RPZ
+             summary data isn't compiled when such zones are mapped into
+             memory.  This limitation may be fixed in a future release,
+             but in the meantime it has been documented, and attempting
+             to use such zones in <command>response-policy</command>
+             statements is now a configuration error.  [RT #38321]
+           </para>
+         </listitem>
        </itemizedlist>
       </listitem>
     </itemizedlist>

diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index 0f971add291cd0d27388f970ecac4bbc0b26f872..34610402e51f8497acbe0b439cbfd04a8b954dc6 100644 (file)
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -1710,6 +1710,8 @@ dns_zone_rpz_enable(dns_zone_t *zone, dns_rpz_zones_t *rpzs,
        if (strcmp(zone->db_argv[0], "rbt") != 0 &&
            strcmp(zone->db_argv[0], "rbt64") != 0)
                return (ISC_R_NOTIMPLEMENTED);
+       if (zone->masterformat == dns_masterformat_map)
+               return (ISC_R_NOTIMPLEMENTED);
 
        /*
         * This must happen only once or be redundant.