3126. [security] Using DNAME record to generate replacements caused

                        RPZ to exit with a assertion failure. [RT #23766]

diff --git a/CHANGES b/CHANGES
index c89ca780687fb9bcf66934f6e6cace3aef6a470c..c1bb9219b2e106f7692c5f3314ce171bef193149 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+3126.  [security]      Using DNAME record to generate replacements caused
+                       RPZ to exit with a assertion failure. [RT #23766]
+
 3125.  [security]      Using wildcard CNAME records as a replacement with
                        RPZ caused named to exit with a assertion failure.
                        [RT #24715]

diff --git a/bin/named/query.c b/bin/named/query.c
index 51da19dd20d52af38809c385fb7e6c4e0675342e..a2c0cad5f12412d026b8e9f10c0248ccc6b6fcef 100644 (file)
--- a/bin/named/query.c
+++ b/bin/named/query.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: query.c,v 1.353.8.2.2.4 2011/06/09 00:56:10 marka Exp $ */
+/* $Id: query.c,v 1.353.8.2.2.5 2011/06/09 03:17:10 marka Exp $ */
 
 /*! \file */
 
@@ -4113,8 +4113,13 @@ rpz_find(ns_client_t *client, dns_rdatatype_t qtype, dns_name_t *qnamef,
                }
                break;
        case DNS_R_DNAME:
-               policy = DNS_RPZ_POLICY_RECORD;
-               break;
+               /*
+                * DNAME policy RRs have very few if any uses that are not
+                * better served with simple wildcards.  Making the work would
+                * require complications to get the number of labels matched
+                * in the name or the found name itself to the main DNS_R_DNAME
+                * case in query_find(). So fall through to treat them as NODATA.
+                */
        case DNS_R_NXRRSET:
                policy = DNS_RPZ_POLICY_NODATA;
                break;

diff --git a/bin/tests/system/rpz/test1 b/bin/tests/system/rpz/test1
index 373ea0f95f7ffb183965000b4713550895a800e3..0e99320963d0710d992a4b3c8b33e9ec9eb0966d 100644 (file)
--- a/bin/tests/system/rpz/test1
+++ b/bin/tests/system/rpz/test1
@@ -12,13 +12,19 @@
 ; OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 ; PERFORMANCE OF THIS SOFTWARE.
 
-; $Id: test1,v 1.4 2011/01/13 19:30:41 each Exp $
+; $Id: test1,v 1.4.130.1 2011/06/09 03:17:11 marka Exp $
 
 
 server 10.53.0.3 5300
 
+; NXDOMAIN
 update add  a0-1.tld2.bl.      300 CNAME .
-update add  a3-1.tld2.bl.      300 CNAME *.
+
+; NODATA
+update add  a1-1.tld2.bl.      300 CNAME *.
+;      and no assert-botch
+update add  a1-2.tld2.bl.      300 DNAME example.com.
+
 update add  *.sub1.tld2.bl.    300 A 12.12.12.12
 
 send

diff --git a/bin/tests/system/rpz/tests.sh b/bin/tests/system/rpz/tests.sh
index ac76f0a4c9b0added40dcf6f4cb6ba459efc72c8..cadaf64396478903a4c9c05f66d49e00248db75a 100644 (file)
--- a/bin/tests/system/rpz/tests.sh
+++ b/bin/tests/system/rpz/tests.sh
@@ -12,7 +12,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: tests.sh,v 1.3.130.2 2011/06/09 00:56:09 marka Exp $
+# $Id: tests.sh,v 1.3.130.3 2011/06/09 03:17:11 marka Exp $
 
 # test response policy zones (RPZ)
 
@@ -152,7 +152,9 @@ status=0
 
 start_test "RPZ QNAME rewrites" test1
 nxdomain a0-1.tld2
-nodata a3-1.tld2
+nodata a1-1.tld2
+nodata a1-2.tld2
+nodata sub.a1-2.tld2
 a12 a4-1.sub1.tld2
 end_test
 
@@ -266,6 +268,7 @@ if [ $ret != 0 ]; then
 fi
 status=`expr $status + $ret`
 
+
 if test "$status" -eq 0; then
     rm -f dig.out*
 fi

diff --git a/doc/arm/Bv9ARM-book.xml b/doc/arm/Bv9ARM-book.xml
index c6c860daf72fb613e149990980d7bc3d0b6e2c66..d1b04ce06c87b81a3435e37663a926d977649d7f 100644 (file)
--- a/doc/arm/Bv9ARM-book.xml
+++ b/doc/arm/Bv9ARM-book.xml
@@ -18,7 +18,7 @@
  - PERFORMANCE OF THIS SOFTWARE.
 -->
 
-<!-- File: $Id: Bv9ARM-book.xml,v 1.478.8.2 2011/02/03 07:39:02 marka Exp $ -->
+<!-- File: $Id: Bv9ARM-book.xml,v 1.478.8.2.2.1 2011/06/09 03:17:11 marka Exp $ -->
 <book xmlns:xi="http://www.w3.org/2001/XInclude">
   <title>BIND 9 Administrator Reference Manual</title>
 
@@ -9212,8 +9212,8 @@ deny-answer-aliases { "example.net"; };
           <para>
             The rules encoded in a response policy zone (RPZ) are applied
             only to responses to queries that ask for recursion (RD=1).
-            RPZs are normal DNS zones containing largely valid RRsets
-            that can be queried normal if allowed.
+            RPZs are normal DNS zones containing RRsets
+            that can be queried normally if allowed.
             It is usually best to restrict those queries with something like
             <command>allow-query {none; };</command> or
             <command>allow-query { 127.0.0.1; };</command>.
@@ -9225,6 +9225,8 @@ deny-answer-aliases { "example.net"; };
             records resolved in the process of generating the response.
             The owner name of a QNAME rule is the query name relativized
             to the RPZ.
+           The records in a rewrite rule are usually A, AAAA, or special
+           CNAMEs, but can be any type except DNAME.
           </para>
 
           <para>
@@ -9324,6 +9326,7 @@ nodata.domain.com           CNAME   *.
 bad.domain.com              A       10.0.0.1
                             AAAA    2001:2::1
 ok.domain.com               CNAME   ok.domain.com.
+*.badzone.domain.com       CNAME   garden.example.com.
 
 ; IP rules rewriting all answers for 127/8 except 127.0.0.1
 8.0.0.0.127.ip              CNAME   .