3126. [security] Using DNAME record to generate replacements caused

                        RPZ to exit with a assertion failure. [RT #23766]

diff --git a/CHANGES b/CHANGES
index 783c733b8e8796ba43447b1f724f428173cae78e..fb6f5e2fc229d5ec17b7ced1724baaa49e0f64d8 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+3126.  [security]      Using DNAME record to generate replacements caused
+                       RPZ to exit with a assertion failure. [RT #23766]
+
 3125.  [security]      Using wildcard CNAME records as a replacement with
                        RPZ caused named to exit with a assertion failure.
                        [RT #24715]

diff --git a/bin/named/query.c b/bin/named/query.c
index 44833c1253f30b672ba9cf35ffb591a96c2e3064..76adb49eb852d6e4f0cfa0f355392bb90ca14878 100644 (file)
--- a/bin/named/query.c
+++ b/bin/named/query.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: query.c,v 1.366 2011/06/09 00:42:51 marka Exp $ */
+/* $Id: query.c,v 1.367 2011/06/09 03:10:17 marka Exp $ */
 
 /*! \file */
 
@@ -4105,8 +4105,13 @@ rpz_find(ns_client_t *client, dns_rdatatype_t qtype, dns_name_t *qnamef,
                }
                break;
        case DNS_R_DNAME:
-               policy = DNS_RPZ_POLICY_RECORD;
-               break;
+               /*
+                * DNAME policy RRs have very few if any uses that are not
+                * better served with simple wildcards.  Making the work would
+                * require complications to get the number of labels matched
+                * in the name or the found name itself to the main DNS_R_DNAME
+                * case in query_find(). So fall through to treat them as NODATA.
+                */
        case DNS_R_NXRRSET:
                policy = DNS_RPZ_POLICY_NODATA;
                break;

diff --git a/bin/tests/system/rpz/test1 b/bin/tests/system/rpz/test1
index 373ea0f95f7ffb183965000b4713550895a800e3..3ad35d27bb6877ff9728753803ce0f4e86f5f565 100644 (file)
--- a/bin/tests/system/rpz/test1
+++ b/bin/tests/system/rpz/test1
@@ -12,13 +12,19 @@
 ; OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 ; PERFORMANCE OF THIS SOFTWARE.
 
-; $Id: test1,v 1.4 2011/01/13 19:30:41 each Exp $
+; $Id: test1,v 1.5 2011/06/09 03:10:17 marka Exp $
 
 
 server 10.53.0.3 5300
 
+; NXDOMAIN
 update add  a0-1.tld2.bl.      300 CNAME .
-update add  a3-1.tld2.bl.      300 CNAME *.
+
+; NODATA
+update add  a1-1.tld2.bl.      300 CNAME *.
+;      and no assert-botch
+update add  a1-2.tld2.bl.      300 DNAME example.com.
+
 update add  *.sub1.tld2.bl.    300 A 12.12.12.12
 
 send

diff --git a/bin/tests/system/rpz/tests.sh b/bin/tests/system/rpz/tests.sh
index 0facc30dde8c584fe0691dd85d5ddf1ca74f2674..4c3e52c4c11c25184fdf6ea687a13234666887ab 100644 (file)
--- a/bin/tests/system/rpz/tests.sh
+++ b/bin/tests/system/rpz/tests.sh
@@ -12,7 +12,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: tests.sh,v 1.5 2011/06/09 00:42:51 marka Exp $
+# $Id: tests.sh,v 1.6 2011/06/09 03:10:17 marka Exp $
 
 # test response policy zones (RPZ)
 
@@ -152,7 +152,9 @@ status=0
 
 start_test "RPZ QNAME rewrites" test1
 nxdomain a0-1.tld2
-nodata a3-1.tld2
+nodata a1-1.tld2
+nodata a1-2.tld2
+nodata sub.a1-2.tld2
 a12 a4-1.sub1.tld2
 end_test
 
@@ -266,6 +268,7 @@ if [ $ret != 0 ]; then
 fi
 status=`expr $status + $ret`
 
+
 if test "$status" -eq 0; then
     rm -f dig.out*
 fi

diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
index ae73065755ea0f4400111d1e70704b7e4a301eef..77ce23fde5b15761b1738b6d2e2e27691ce636f1 100644 (file)
--- a/doc/arm/Bv9ARM-book.xml
+++ b/doc/arm/Bv9ARM-book.xml
@@ -18,7 +18,7 @@
  - PERFORMANCE OF THIS SOFTWARE.
 -->
 
-<!-- File: $Id: Bv9ARM-book.xml,v 1.493 2011/05/23 20:11:14 each Exp $ -->
+<!-- File: $Id: Bv9ARM-book.xml,v 1.494 2011/06/09 03:10:17 marka Exp $ -->
 <book xmlns:xi="http://www.w3.org/2001/XInclude">
   <title>BIND 9 Administrator Reference Manual</title>
 
@@ -9317,8 +9317,8 @@ deny-answer-aliases { "example.net"; };
           <para>
             The rules encoded in a response policy zone (RPZ) are applied
             only to responses to queries that ask for recursion (RD=1).
-            RPZs are normal DNS zones containing largely valid RRsets
-            that can be queried normal if allowed.
+            RPZs are normal DNS zones containing RRsets
+            that can be queried normally if allowed.
             It is usually best to restrict those queries with something like
             <command>allow-query {none; };</command> or
             <command>allow-query { 127.0.0.1; };</command>.
@@ -9330,6 +9330,8 @@ deny-answer-aliases { "example.net"; };
             records resolved in the process of generating the response.
             The owner name of a QNAME rule is the query name relativized
             to the RPZ.
+           The records in a rewrite rule are usually A, AAAA, or special
+           CNAMEs, but can be any type except DNAME.
           </para>
 
           <para>
@@ -9429,6 +9431,7 @@ nodata.domain.com           CNAME   *.
 bad.domain.com              A       10.0.0.1
                             AAAA    2001:2::1
 ok.domain.com               CNAME   ok.domain.com.
+*.badzone.domain.com       CNAME   garden.example.com.
 
 ; IP rules rewriting all answers for 127/8 except 127.0.0.1
 8.0.0.0.127.ip              CNAME   .