[master] better error message when exceeding RPZ zone limit

3726.	[cleanup]	Clarified the error message when attempting
			to configure more than 32 response-policy zones.
			[RT #35283]

diff --git a/CHANGES b/CHANGES
index cc9a00d5945e21c1030d57dc0847dc9ff6efb60f..cbe306ce69ad05708a7f4f7a6a8e80fcefe4a096 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,7 @@
+3726.  [cleanup]       Clarified the error message when attempting
+                       to configure more than 32 response-policy zones.
+                       [RT #35283]
+
 3725.  [contrib]       Updated zkt and nslint to newest versions,
                        cleaned up and rearranged the contrib
                        directory, and added a README.

diff --git a/bin/named/server.c b/bin/named/server.c
index b4f7918c291c98fc9b9d71c6d682cd386e6d0cfc..15b822e016f9dc87fe1c68a67f61f55392257d68 100644 (file)
--- a/bin/named/server.c
+++ b/bin/named/server.c
@@ -1628,8 +1628,12 @@ configure_rpz_zone(dns_view_t *view, const cfg_listelt_t *element,
 
        rpz_obj = cfg_listelt_value(element);
 
-       if (view->rpzs->p.num_zones >= DNS_RPZ_MAX_ZONES)
-               return (ISC_R_NOMEMORY);
+       if (view->rpzs->p.num_zones >= DNS_RPZ_MAX_ZONES) {
+               cfg_obj_log(rpz_obj, ns_g_lctx, DNS_RPZ_ERROR_LEVEL,
+                           "limit of %d response policy zones exceeded",
+                           DNS_RPZ_MAX_ZONES);
+               return (ISC_R_FAILURE);
+       }
 
        new = isc_mem_get(view->rpzs->mctx, sizeof(*new));
        if (new == NULL) {

diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
index 9d1a3450a0eb7c6f4b1d6297528e2431be9c89bf..16490079ae805801eab51548a1f2115d8138e68e 100644 (file)
--- a/doc/arm/Bv9ARM-book.xml
+++ b/doc/arm/Bv9ARM-book.xml
@@ -9364,6 +9364,16 @@ deny-answer-aliases { "example.net"; };
            <command>allow-query { localhost; };</command>.
          </para>
 
+         <para>
+           A <command>response-policy</command> option can support
+           multiple policy zones.  To maximize performance, a radix
+           tree is used to quickly identify response policy zones
+           containing triggers that match the current query.  This
+           imposes an upper limit of 32 on the number of policy zones
+           in a single <command>response-policy</option> option; more
+           than that is a configuration error.
+         </para>
+
          <para>
            Five policy triggers can be encoded in RPZ records.
            <variablelist>