RPZ response's SOA record is incorrectly set to 1

An RPZ response's SOA record TTL is set to 1 instead of the SOA TTL,
a boolean value is passed on to query_addsoa, which is supposed to be
a TTL value. I don't see what value is appropriate to be used for
overriding, so we will pass UINT32_MAX.

(cherry picked from commit 5d7e613e8103b81cf47a22c72310a38737fbe3c6)

diff --git a/bin/tests/system/rpz/tests.sh b/bin/tests/system/rpz/tests.sh
index 575cac4cd734f2051814e299465b1c5b46a6840c..2404c9f4ba1849c58000073ca34f4dd32cebb4d1 100644 (file)
--- a/bin/tests/system/rpz/tests.sh
+++ b/bin/tests/system/rpz/tests.sh
@@ -838,13 +838,13 @@ grep NXDOMAIN dig.out.${t} >/dev/null || setret "failed"
 t=$((t + 1))
 echo_i "checking that "add-soa no" at rpz zone level works (${t})"
 $DIG z.x.servfail -p ${PORT} @$ns7 >dig.out.${t} || setret "failed"
-grep SOA dig.out.${t} >/dev/null && setret "failed"
+grep "SOA" dig.out.${t} >/dev/null && setret "failed"
 
 if [ native = "$MODE" ]; then
   t=$((t + 1))
   echo_i "checking that "add-soa yes" at response-policy level works (${t})"
   $DIG walled.tld2 -p ${PORT} +noall +add @$ns3 >dig.out.${t} || setret "failed"
-  grep "^manual-update-rpz\..*SOA" dig.out.${t} >/dev/null || setret "failed"
+  grep "^manual-update-rpz\..*60.*SOA" dig.out.${t} >/dev/null || setret "failed"
 fi
 
 if [ native = "$MODE" ]; then
@@ -862,7 +862,7 @@ if [ native = "$MODE" ]; then
   t=$((t + 1))
   echo_i "checking that 'add-soa unset' works (${t})"
   $DIG walled.tld2 -p ${PORT} +noall +add @$ns8 >dig.out.${t} || setret "failed"
-  grep "^manual-update-rpz\..*SOA" dig.out.${t} >/dev/null || setret "failed"
+  grep "^manual-update-rpz\..*60.*SOA" dig.out.${t} >/dev/null || setret "failed"
 fi
 
 # dnsrps does not allow NS RRs in policy zones, so this check

diff --git a/lib/ns/query.c b/lib/ns/query.c
index 537d332a56d14fbf9a3f2dd2ef0d625ae35c75cd..37b0d0ab0dc4e1bc1a81d36bb4216db78ca5fc59 100644 (file)
--- a/lib/ns/query.c
+++ b/lib/ns/query.c
@@ -7359,9 +7359,7 @@ query_checkrpz(query_ctx_t *qctx, isc_result_t result) {
                 * Add SOA record to additional section
                 */
                if (qctx->rpz_st->m.rpz->addsoa) {
-                       bool override_ttl =
-                               dns_rdataset_isassociated(qctx->rdataset);
-                       rresult = query_addsoa(qctx, override_ttl,
+                       rresult = query_addsoa(qctx, UINT32_MAX,
                                               DNS_SECTION_ADDITIONAL);
                        if (rresult != ISC_R_SUCCESS) {
                                QUERY_ERROR(qctx, result);