3125. [security] Using wildcard CNAME records as a replacement with

                        RPZ caused named to exit with a assertion failure.
                        [RT #24715]

diff --git a/CHANGES b/CHANGES
index f7b4742b85314e0fb5b0d3acbdc8e70c82c87553..c89ca780687fb9bcf66934f6e6cace3aef6a470c 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,7 @@
+3125.  [security]      Using wildcard CNAME records as a replacement with
+                       RPZ caused named to exit with a assertion failure.
+                       [RT #24715]
+
 3123.  [security]      Change #2912 exposed a latent flaw in
                        dns_rdataset_totext() that could cause named to
                        crash with an assertion failure. [RT #24777]

diff --git a/bin/named/query.c b/bin/named/query.c
index 5de67e54f84cc6aac540b81bdd71305d13ae7661..51da19dd20d52af38809c385fb7e6c4e0675342e 100644 (file)
--- a/bin/named/query.c
+++ b/bin/named/query.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: query.c,v 1.353.8.2.2.3 2011/06/08 23:52:50 marka Exp $ */
+/* $Id: query.c,v 1.353.8.2.2.4 2011/06/09 00:56:10 marka Exp $ */
 
 /*! \file */
 
@@ -5324,6 +5324,7 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
                                break;
                        case DNS_RPZ_POLICY_RECORD:
                                if (type == dns_rdatatype_any &&
+                                   result != DNS_R_CNAME &&
                                    dns_rdataset_isassociated(rdataset))
                                        dns_rdataset_disassociate(rdataset);
                                break;

diff --git a/bin/tests/system/rpz/ns3/base.db b/bin/tests/system/rpz/ns3/base.db
index 8cef62b195820ee9c6bcb5108a2f18dab3a6b152..cbf37e40ceeed9b92525e7754e40b64540faf596 100644 (file)
--- a/bin/tests/system/rpz/ns3/base.db
+++ b/bin/tests/system/rpz/ns3/base.db
@@ -12,7 +12,7 @@
 ; OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 ; PERFORMANCE OF THIS SOFTWARE.
 
-; $Id: base.db,v 1.3.130.1 2011/04/27 17:06:28 each Exp $
+; $Id: base.db,v 1.3.130.2 2011/06/09 00:56:09 marka Exp $
 
 ; RPZ test
 
@@ -33,3 +33,4 @@ $TTL  120
 ; for testing rrset replacement
 redirect       IN      A       127.0.0.1
 *.redirect     IN      A       127.0.0.1
+*.cname-redirect       IN      CNAME   google.com.

diff --git a/bin/tests/system/rpz/tests.sh b/bin/tests/system/rpz/tests.sh
index a87f005d66f270ffd7109b586e444b7bc846ef41..ac76f0a4c9b0added40dcf6f4cb6ba459efc72c8 100644 (file)
--- a/bin/tests/system/rpz/tests.sh
+++ b/bin/tests/system/rpz/tests.sh
@@ -12,7 +12,7 @@
 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
 # PERFORMANCE OF THIS SOFTWARE.
 
-# $Id: tests.sh,v 1.3.130.1 2011/04/27 17:06:27 each Exp $
+# $Id: tests.sh,v 1.3.130.2 2011/06/09 00:56:09 marka Exp $
 
 # test response policy zones (RPZ)
 
@@ -223,6 +223,7 @@ $DIGCMD a3-1.tld2 -trrsig @$s3 > /dev/null 2>&1
 $DIGCMD a3-2.tld2 -trrsig @$s3 > /dev/null 2>&1
 $DIGCMD a3-5.tld2 -trrsig @$s3 > /dev/null 2>&1
 $DIGCMD www.redirect -trrsig @$s3 > /dev/null 2>&1
+$DIGCMD www.cname-redirect -trrsig @$s3 > /dev/null 2>&1
 
 $RNDC -c ../common/rndc.conf -s $s3 -p 9953 status > /dev/null 2>&1 || ret=1
 if [ $ret != 0 ]; then
@@ -239,6 +240,24 @@ $DIGCMD a3-1.tld2 -tsig @$s3 > /dev/null 2>&1
 $DIGCMD a3-2.tld2 -tsig @$s3 > /dev/null 2>&1
 $DIGCMD a3-5.tld2 -tsig @$s3 > /dev/null 2>&1
 $DIGCMD www.redirect -tsig @$s3 > /dev/null 2>&1
+$DIGCMD www.cname-redirect -tsig @$s3 > /dev/null 2>&1
+
+$RNDC -c ../common/rndc.conf -s $s3 -p 9953 status > /dev/null 2>&1 || ret=1
+if [ $ret != 0 ]; then
+    echo "I:failed";
+    (cd ..; $PERL start.pl --noclean --restart rpz ns3)
+fi
+status=`expr $status + $ret`
+
+ret=0
+echo "I:checking ANY queries"
+# We don't actually care about the query results; the important
+# thing is the server handles SIG queries okay
+$DIGCMD a3-1.tld2 -tany @$s3 > /dev/null 2>&1
+$DIGCMD a3-2.tld2 -tany @$s3 > /dev/null 2>&1
+$DIGCMD a3-5.tld2 -tany @$s3 > /dev/null 2>&1
+$DIGCMD www.redirect -tany @$s3 > /dev/null 2>&1
+$DIGCMD www.cname-redirect -tany @$s3 > /dev/null 2>&1
 
 $RNDC -c ../common/rndc.conf -s $s3 -p 9953 status > /dev/null 2>&1 || ret=1
 if [ $ret != 0 ]; then