From: Mark Andrews Date: Fri, 9 Aug 2013 03:23:01 +0000 (+1000) Subject: 3627. [bug] RPZ changes were not effective on slaves. [RT #34450] X-Git-Tag: v9.10.0a1~176 X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=df0892aea6bfd20a01c3abf2b756625d23830390;p=thirdparty%2Fbind9.git 3627. [bug] RPZ changes were not effective on slaves. [RT #34450] --- diff --git a/CHANGES b/CHANGES index 30ac873d7bd..272cfa726fb 100644 --- a/CHANGES +++ b/CHANGES @@ -1,3 +1,5 @@ +3627. [bug] RPZ changes were not effective on slaves. [RT #34450] + 3626. [func] dig: NSID output now easier to read. [RT #21160] 3625. [bug] Don't send notify messages to machines outside of the diff --git a/bin/tests/system/rpz/clean.sh b/bin/tests/system/rpz/clean.sh index d0c47976e36..ed10bcda8db 100644 --- a/bin/tests/system/rpz/clean.sh +++ b/bin/tests/system/rpz/clean.sh @@ -19,7 +19,7 @@ # Clean up after rpz tests. rm -f proto.* dsset-* random.data trusted.conf dig.out* nsupdate.tmp ns*/*tmp -rm -f ns*/*.key ns*/*.private ns2/tld2s.db +rm -f ns*/*.key ns*/*.private ns2/tld2s.db ns2/bl.tld2.db rm -f ns3/bl*.db ns*/*switch ns5/requests ns5/example.db ns5/bl.db ns5/*.perf rm -f */named.memstats */named.run */named.stats */session.key rm -f */*.jnl */*.core */*.pid diff --git a/bin/tests/system/rpz/ns2/bl.tld2.db.in b/bin/tests/system/rpz/ns2/bl.tld2.db.in new file mode 100644 index 00000000000..84116807d12 --- /dev/null +++ b/bin/tests/system/rpz/ns2/bl.tld2.db.in @@ -0,0 +1,28 @@ +; Copyright (C) 2013 Internet Systems Consortium, Inc. ("ISC") +; +; Permission to use, copy, modify, and/or distribute this software for any +; purpose with or without fee is hereby granted, provided that the above +; copyright notice and this permission notice appear in all copies. +; +; THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH +; REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY +; AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, +; INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM +; LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE +; OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR +; PERFORMANCE OF THIS SOFTWARE. + +; $Id$ + + + +; master for slave RPZ zone + +$TTL 3600 +@ SOA rpz.tld2. hostmaster.ns.tld2. ( 1 3600 1200 604800 60 ) + NS ns2 + NS ns3 +ns2 A 10.53.0.2 +ns3 A 10.53.0.3 + +32.1.7.168.192.rpz-ip CNAME . diff --git a/bin/tests/system/rpz/ns2/blv2.tld2.db.in b/bin/tests/system/rpz/ns2/blv2.tld2.db.in new file mode 100644 index 00000000000..bd5a48444c7 --- /dev/null +++ b/bin/tests/system/rpz/ns2/blv2.tld2.db.in @@ -0,0 +1,26 @@ +; Copyright (C) 2013 Internet Systems Consortium, Inc. ("ISC") +; +; Permission to use, copy, modify, and/or distribute this software for any +; purpose with or without fee is hereby granted, provided that the above +; copyright notice and this permission notice appear in all copies. +; +; THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH +; REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY +; AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, +; INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM +; LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE +; OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR +; PERFORMANCE OF THIS SOFTWARE. + +; $Id$ + + + +; master for slave RPZ zone + +$TTL 3600 +@ SOA rpz.tld2. hostmaster.ns.tld2. ( 2 3600 1200 604800 60 ) + NS ns2 + NS ns3 +ns2 A 10.53.0.2 +ns3 A 10.53.0.3 diff --git a/bin/tests/system/rpz/ns2/blv3.tld2.db.in b/bin/tests/system/rpz/ns2/blv3.tld2.db.in new file mode 100644 index 00000000000..a4797b016ce --- /dev/null +++ b/bin/tests/system/rpz/ns2/blv3.tld2.db.in @@ -0,0 +1,28 @@ +; Copyright (C) 2013 Internet Systems Consortium, Inc. ("ISC") +; +; Permission to use, copy, modify, and/or distribute this software for any +; purpose with or without fee is hereby granted, provided that the above +; copyright notice and this permission notice appear in all copies. +; +; THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH +; REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY +; AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, +; INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM +; LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE +; OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR +; PERFORMANCE OF THIS SOFTWARE. + +; $Id$ + + + +; master for slave RPZ zone + +$TTL 3600 +@ SOA rpz.tld2. hostmaster.ns.tld2. ( 3 3600 1200 604800 60 ) + NS ns2 + NS ns3 +ns2 A 10.53.0.2 +ns3 A 10.53.0.3 + +32.1.7.168.192.rpz-ip CNAME . diff --git a/bin/tests/system/rpz/ns2/named.conf b/bin/tests/system/rpz/ns2/named.conf index c2235af24b3..2b3d65a7b85 100644 --- a/bin/tests/system/rpz/ns2/named.conf +++ b/bin/tests/system/rpz/ns2/named.conf @@ -32,6 +32,14 @@ options { notify no; }; +key rndc_key { + secret "1234abcd8765"; + algorithm hmac-sha256; +}; +controls { + inet 10.53.0.2 port 9953 allow { any; } keys { rndc_key; }; +}; + include "../trusted.conf"; zone "." { type hint; file "hints"; }; @@ -44,3 +52,5 @@ zone "sub3.tld2." {type master; file "tld2.db";}; zone "subsub.sub3.tld2." {type master; file "tld2.db";}; zone "tld2s." {type master; file "tld2s.db";}; + +zone "bl.tld2." {type master; file "bl.tld2.db"; notify yes; notify-delay 1;}; diff --git a/bin/tests/system/rpz/ns2/tld2.db b/bin/tests/system/rpz/ns2/tld2.db index 9c18fcf8db4..263d0fb6e19 100644 --- a/bin/tests/system/rpz/ns2/tld2.db +++ b/bin/tests/system/rpz/ns2/tld2.db @@ -124,3 +124,6 @@ a6-1 A 192.168.6.1 TXT "a6-1 tld2 text" a6-2 A 192.168.6.2 TXT "a6-2 tld2 text" + +a7-1 A 192.168.7.1 + TXT "a7-1 tld2 text" diff --git a/bin/tests/system/rpz/ns3/named.conf b/bin/tests/system/rpz/ns3/named.conf index 3d05297b97c..f4101150c04 100644 --- a/bin/tests/system/rpz/ns3/named.conf +++ b/bin/tests/system/rpz/ns3/named.conf @@ -48,6 +48,7 @@ options { zone "bl-garden" policy cname a12.tld2.; zone "bl-drop" policy drop; zone "bl-tcp-only" policy tcp-only; + zone "bl.tld2"; } min-ns-dots 0 qname-wait-recurse yes @@ -92,5 +93,8 @@ zone "bl-drop." {type master; file "bl-drop.db"; zone "bl-tcp-only." {type master; file "bl-tcp-only.db"; allow-update {any;};}; +zone "bl.tld2." {type slave; file "bl.tld2.db"; masters {10.53.0.2;}; + request-ixfr no; masterfile-format text;}; + zone "crash1.tld2" {type master; file "crash1";}; zone "crash2.tld3." {type master; file "crash2";}; diff --git a/bin/tests/system/rpz/setup.sh b/bin/tests/system/rpz/setup.sh index 58ec57e9a3f..b459a4a205d 100644 --- a/bin/tests/system/rpz/setup.sh +++ b/bin/tests/system/rpz/setup.sh @@ -116,3 +116,5 @@ $PERL -e 'for ($cnt = $val = 1; $cnt <= 3000; ++$cnt) { printf("host-%05d.example.tld5 A\n", $val); $val = ($val * 9 + 32771) % 65536; }' >ns5/requests + +cp ns2/bl.tld2.db.in ns2/bl.tld2.db diff --git a/bin/tests/system/rpz/tests.sh b/bin/tests/system/rpz/tests.sh index cf8390c94a3..7f8a18d0781 100644 --- a/bin/tests/system/rpz/tests.sh +++ b/bin/tests/system/rpz/tests.sh @@ -353,8 +353,30 @@ addr 14.14.14.14 a5-4.tld2 # 14 prefer QNAME to IP nochange a4-4.tld2 # 15 PASSTHRU nxdomain c2.crash2.tld3 # 16 assert in rbtdb.c addr 127.0.0.17 "a4-4.tld2 -b $ns1" # 17 client-IP address trigger +nxdomain a7-1.tld2 # 18 slave policy zone (RT34450) +cp ns2/blv2.tld2.db.in ns2/bl.tld2.db +$RNDCCMD 10.53.0.2 reload bl.tld2 +goodsoa="rpz.tld2. hostmaster.ns.tld2. 2 3600 1200 604800 60" +for i in 0 1 2 3 4 5 6 7 8 9 10 +do + soa=`$DIG -p 5300 +short soa bl.tld2 @10.53.0.3 -b10.53.0.3` + test "$soa" = "$goodsoa" && break + sleep 1 +done +nochange a7-1.tld2 # 19 PASSTHRU +sleep 1 # ensure that a clock tick has occured so that the reload takes effect +cp ns2/blv3.tld2.db.in ns2/bl.tld2.db +goodsoa="rpz.tld2. hostmaster.ns.tld2. 3 3600 1200 604800 60" +$RNDCCMD 10.53.0.2 reload bl.tld2 +for i in 0 1 2 3 4 5 6 7 8 9 10 +do + soa=`$DIG -p 5300 +short soa bl.tld2 @10.53.0.3 -b10.53.0.3` + test "$soa" = "$goodsoa" && break + sleep 1 +done +nxdomain a7-1.tld2 # 20 slave policy zone (RT34450) end_group -ckstats $ns3 test2 ns3 10 +ckstats $ns3 test2 ns3 12 # check that IP addresses for previous group were deleted from the radix tree start_group "radix tree deletions" diff --git a/lib/dns/include/dns/zone.h b/lib/dns/include/dns/zone.h index 1d1c6b3caed..5d28c2ac4cf 100644 --- a/lib/dns/include/dns/zone.h +++ b/lib/dns/include/dns/zone.h @@ -2228,6 +2228,12 @@ dns_zone_rpz_enable(dns_zone_t *zone, dns_rpz_zones_t *rpzs, * Set the response policy associated with a zone. */ +void +dns_zone_rpz_enable_db(dns_zone_t *zone, dns_db_t *db); +/*% + * If a zone is a response policy zone, mark its new database. + */ + dns_rpz_num_t dns_zone_get_rpz_num(dns_zone_t *zone); diff --git a/lib/dns/xfrin.c b/lib/dns/xfrin.c index ad676b74d07..118e109659b 100644 --- a/lib/dns/xfrin.c +++ b/lib/dns/xfrin.c @@ -270,13 +270,18 @@ axfr_init(dns_xfrin_ctx_t *xfr) { static isc_result_t axfr_makedb(dns_xfrin_ctx_t *xfr, dns_db_t **dbp) { - return (dns_db_create(xfr->mctx, /* XXX */ - "rbt", /* XXX guess */ - &xfr->name, - dns_dbtype_zone, - xfr->rdclass, - 0, NULL, /* XXX guess */ - dbp)); + isc_result_t result; + + result = dns_db_create(xfr->mctx, /* XXX */ + "rbt", /* XXX guess */ + &xfr->name, + dns_dbtype_zone, + xfr->rdclass, + 0, NULL, /* XXX guess */ + dbp); + if (result == ISC_R_SUCCESS) + dns_zone_rpz_enable_db(xfr->zone, *dbp); + return (result); } static isc_result_t diff --git a/lib/dns/zone.c b/lib/dns/zone.c index fa3b99bfeec..eb82ce0b47f 100644 --- a/lib/dns/zone.c +++ b/lib/dns/zone.c @@ -1598,6 +1598,17 @@ dns_zone_get_rpz_num(dns_zone_t *zone) { return (zone->rpz_num); } +/* + * If a zone is a response policy zone, mark its new database. + */ +void +dns_zone_rpz_enable_db(dns_zone_t *zone, dns_db_t *db) { + if (zone->rpz_num != DNS_RPZ_INVALID_NUM) { + REQUIRE(zone->rpzs != NULL); + dns_db_rpz_attach(db, zone->rpzs, zone->rpz_num); + } +} + static isc_boolean_t zone_touched(dns_zone_t *zone) { isc_result_t result; @@ -2162,11 +2173,7 @@ zone_startload(dns_db_t *db, dns_zone_t *zone, isc_time_t loadtime) { isc_result_t tresult; unsigned int options; - if (zone->rpz_num != DNS_RPZ_INVALID_NUM) { - REQUIRE(zone->rpzs != NULL); - dns_db_rpz_attach(db, zone->rpzs, zone->rpz_num); - } - + dns_zone_rpz_enable_db(zone, db); options = get_master_options(zone); if (DNS_ZONE_OPTION(zone, DNS_ZONEOPT_MANYERRORS)) options |= DNS_MASTER_MANYERRORS;