- Fix #1130: Loads of logs: "validation failure: key for validation

  <domain>. is marked as invalid because of a previous" for
  non-DNSSEC signed zone.

diff --git a/doc/Changelog b/doc/Changelog
index 17b683e6e9e21ef3ec086607f0e288469007dbac..ccf334038d10e93ab7763e1200f58fed04f66683 100644 (file)
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,3 +1,8 @@
+27 August 2024: Wouter
+       - Fix #1130: Loads of logs: "validation failure: key for validation
+         <domain>. is marked as invalid because of a previous" for
+         non-DNSSEC signed zone.
+
 23 August 2024: Wouter
        - Merge patch to fix for glue that is outside of zone, with
          `harden-unverified-glue`, from Karthik Umashankar (Microsoft).

diff --git a/services/rpz.c b/services/rpz.c
index d8999a8a55eb8a737df9f25c1a22dda7e541cc17..1ee143f848421059a55be4f31d347f10367a8bc8 100644 (file)
--- a/services/rpz.c
+++ b/services/rpz.c
@@ -2288,15 +2288,18 @@ rpz_apply_nsip_trigger(struct module_qstate* ms, struct query_info* qchase,
        if(action == RPZ_LOCAL_DATA_ACTION && raddr->data == NULL) {
                verbose(VERB_ALGO, "rpz: bug: nsip local data action but no local data");
                ret = rpz_synthesize_nodata(r, ms, qchase, az);
+               ms->rpz_applied = 1;
                goto done;
        }
 
        switch(action) {
        case RPZ_NXDOMAIN_ACTION:
                ret = rpz_synthesize_nxdomain(r, ms, qchase, az);
+               ms->rpz_applied = 1;
                break;
        case RPZ_NODATA_ACTION:
                ret = rpz_synthesize_nodata(r, ms, qchase, az);
+               ms->rpz_applied = 1;
                break;
        case RPZ_TCP_ONLY_ACTION:
                /* basically a passthru here but the tcp-only will be
@@ -2306,11 +2309,13 @@ rpz_apply_nsip_trigger(struct module_qstate* ms, struct query_info* qchase,
                break;
        case RPZ_DROP_ACTION:
                ret = rpz_synthesize_nodata(r, ms, qchase, az);
+               ms->rpz_applied = 1;
                ms->is_drop = 1;
                break;
        case RPZ_LOCAL_DATA_ACTION:
                ret = rpz_synthesize_nsip_localdata(r, ms, qchase, raddr, az);
                if(ret == NULL) { ret = rpz_synthesize_nodata(r, ms, qchase, az); }
+               ms->rpz_applied = 1;
                break;
        case RPZ_PASSTHRU_ACTION:
                ret = NULL;
@@ -2318,6 +2323,7 @@ rpz_apply_nsip_trigger(struct module_qstate* ms, struct query_info* qchase,
                break;
        case RPZ_CNAME_OVERRIDE_ACTION:
                ret = rpz_synthesize_cname_override_msg(r, ms, qchase);
+               ms->rpz_applied = 1;
                break;
        default:
                verbose(VERB_ALGO, "rpz: nsip: bug: unhandled or invalid action: '%s'",
@@ -2352,9 +2358,11 @@ rpz_apply_nsdname_trigger(struct module_qstate* ms, struct query_info* qchase,
        switch(action) {
        case RPZ_NXDOMAIN_ACTION:
                ret = rpz_synthesize_nxdomain(r, ms, qchase, az);
+               ms->rpz_applied = 1;
                break;
        case RPZ_NODATA_ACTION:
                ret = rpz_synthesize_nodata(r, ms, qchase, az);
+               ms->rpz_applied = 1;
                break;
        case RPZ_TCP_ONLY_ACTION:
                /* basically a passthru here but the tcp-only will be
@@ -2364,11 +2372,13 @@ rpz_apply_nsdname_trigger(struct module_qstate* ms, struct query_info* qchase,
                break;
        case RPZ_DROP_ACTION:
                ret = rpz_synthesize_nodata(r, ms, qchase, az);
+               ms->rpz_applied = 1;
                ms->is_drop = 1;
                break;
        case RPZ_LOCAL_DATA_ACTION:
                ret = rpz_synthesize_nsdname_localdata(r, ms, qchase, z, match, az);
                if(ret == NULL) { ret = rpz_synthesize_nodata(r, ms, qchase, az); }
+               ms->rpz_applied = 1;
                break;
        case RPZ_PASSTHRU_ACTION:
                ret = NULL;
@@ -2376,6 +2386,7 @@ rpz_apply_nsdname_trigger(struct module_qstate* ms, struct query_info* qchase,
                break;
        case RPZ_CNAME_OVERRIDE_ACTION:
                ret = rpz_synthesize_cname_override_msg(r, ms, qchase);
+               ms->rpz_applied = 1;
                break;
        default:
                verbose(VERB_ALGO, "rpz: nsdname: bug: unhandled or invalid action: '%s'",
@@ -2579,9 +2590,11 @@ struct dns_msg* rpz_callback_from_iterator_cname(struct module_qstate* ms,
        switch(localzone_type_to_rpz_action(lzt)) {
        case RPZ_NXDOMAIN_ACTION:
                ret = rpz_synthesize_nxdomain(r, ms, &is->qchase, a);
+               ms->rpz_applied = 1;
                break;
        case RPZ_NODATA_ACTION:
                ret = rpz_synthesize_nodata(r, ms, &is->qchase, a);
+               ms->rpz_applied = 1;
                break;
        case RPZ_TCP_ONLY_ACTION:
                /* basically a passthru here but the tcp-only will be
@@ -2591,11 +2604,13 @@ struct dns_msg* rpz_callback_from_iterator_cname(struct module_qstate* ms,
                break;
        case RPZ_DROP_ACTION:
                ret = rpz_synthesize_nodata(r, ms, &is->qchase, a);
+               ms->rpz_applied = 1;
                ms->is_drop = 1;
                break;
        case RPZ_LOCAL_DATA_ACTION:
                ret = rpz_synthesize_qname_localdata_msg(r, ms, &is->qchase, z, a);
                if(ret == NULL) { ret = rpz_synthesize_nodata(r, ms, &is->qchase, a); }
+               ms->rpz_applied = 1;
                break;
        case RPZ_PASSTHRU_ACTION:
                ret = NULL;

diff --git a/testdata/rpz_val_block.rpl b/testdata/rpz_val_block.rpl
new file mode 100644 (file)
index 0000000..45bfcce
--- /dev/null
+++ b/testdata/rpz_val_block.rpl
@@ -0,0 +1,414 @@
+; config options
+server:
+       module-config: "respip validator iterator"
+       target-fetch-policy: "0 0 0 0 0"
+       qname-minimisation: no
+       trust-anchor: "org. DS 1444 8 2 5224fb17d630a2e3efdc863a05a4032c5db415b5de3f32472ee9abed42e10146"
+       val-override-date: "20070916134226"
+       trust-anchor-signaling: no
+       log-servfail: yes
+       val-log-level: 2
+       ede: yes
+
+stub-zone:
+        name: "."
+        stub-addr: 193.0.14.129         # K.ROOT-SERVERS.NET.
+
+rpz:
+        name: "rpz.example.com."
+        rpz-log: yes
+        rpz-log-name: "rpz.example.com"
+        zonefile:
+TEMPFILE_NAME rpz.example.com
+TEMPFILE_CONTENTS rpz.example.com
+$ORIGIN example.com.
+rpz     3600    IN      SOA     ns1.rpz.example.com. hostmaster.rpz.example.com. (
+                1379078166 28800 7200 604800 7200 )
+        3600    IN      NS      ns1.rpz.example.com.
+        3600    IN      NS      ns2.rpz.example.com.
+$ORIGIN rpz.example.com.
+foo.org CNAME .
+foo2.org CNAME .
+foo3.org CNAME .
+TEMPFILE_END
+
+CONFIG_END
+
+SCENARIO_BEGIN Test RPZ with validator handles blocked zone.
+; The DNSKEY and DS lookups are stopped.
+
+; K.ROOT-SERVERS.NET.
+RANGE_BEGIN 0 1000
+       ADDRESS 193.0.14.129
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS K.ROOT-SERVERS.NET.
+SECTION ADDITIONAL
+K.ROOT-SERVERS.NET. IN A 193.0.14.129
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+org. IN NS
+SECTION AUTHORITY
+org.    IN NS  ns1.servers.org.
+SECTION ADDITIONAL
+ns1.servers.org. IN A 1.2.3.51
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION AUTHORITY
+com.    IN NS  ns1.servers.com.
+SECTION ADDITIONAL
+ns1.servers.com. IN A 1.2.3.52
+ENTRY_END
+RANGE_END
+
+; ns1.servers.org for .org
+RANGE_BEGIN 0 1000
+       ADDRESS 1.2.3.51
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+org. IN NS
+SECTION ANSWER
+org.   3600    IN      NS      ns1.servers.org.
+org.   3600    IN      RRSIG   NS 8 1 3600 20070926134150 20070829134150 1444 org. arkVLr3b2Ip4bkWpjPTywYWzoVqay11KLB+ZygfoIWtq7mKW20SjRGI+AzIviHHWPv8iibzA8nwcTehuSmqIuRTmZXYj58hpi/AxrqqzJNiwE60swi1dKn3ti0SZKZaLMRnxrrAv7yu3PR6zGt7CD7gJgxfMfQMc6QryQJQbiyM=
+SECTION ADDITIONAL
+ns1.servers.org.       3600    IN      A       1.2.3.51
+ns1.servers.org.       3600    IN      RRSIG   A 8 3 3600 20070926134150 20070829134150 1444 org. k+9JSbFm5GWSzEbVckC9bVXvzQYwbLvMbHMYmL5tIjt8RMhVhbkyqu+XER5m8xUFL0nrUqJ8ad6SKI9X/8FYGk1iSegpAjIh4bHGzea7vvM7CWw0HfTmmwDhS569IvUfxHyjH4TjSVlM1x9o/d8NGSLAa7h34b0s+NXLEEjNNbI=
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+org. IN DNSKEY
+SECTION ANSWER
+org.   3600    IN      DNSKEY  257 3 8 AwEAAbd9WqjzE2Pynz21OG5doSf9hFzMr5dhzz2waZ3vTa+0o5r7AjTAqmA1yH/B3+aAMihUm5ucZSfVqo7+kOaRE8yFj9aivOmA1n1+JLevJq/oyvQyjxQN2Qb89LyaNUT5oKZIiL+uyyhNW3KDR3SSbQ/GBwQNDHVcZi+JDR3RC0r7 ;{id = 1444 (ksk), size = 1024b}
+org.   3600    IN      RRSIG   DNSKEY 8 1 3600 20070926134150 20070829134150 1444 org. pJVKrXD3veTg0qOB2PSQAWdeTEyFFzSbMHJ2F9J9WyxVuMMIDj119aJrkHtkXTmLT7wdOd9RZxDfG0A1H30lQeQdvaJoymaVUgWLXfiwIAYg+4Uk7vZrP7UzHJO2BgDnGdf42h2vgBoboyP9szNMHTGGQdpUk7VkhtE6djonzwg=
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+foo.org. IN NS
+SECTION AUTHORITY
+foo.org.       3600    IN      DS      29332 8 2 d38b124648bd7e32033a7fe9fd94ceab56e971ea9e61b3365566ccc028c15c98
+foo.org.       3600    IN      RRSIG   DS 8 2 3600 20070926134150 20070829134150 1444 org. BE2cR03ecUYk/nRsJNMcNfsOWnSoOfkwx4zmF9eEqwoRn/i5QzsrRBEUdorfBsFjpdKqB2R6jSu53CTQAGv392w8AE0cRANPBxcDUiWaRyFZ7CaqspKorPijOJCKEtgztEfFgC9YXab3xvRkJVUZzZRJ4nCrpmNIGzvmf7LlCTg=
+foo.org. IN NS  ns.foo.org.
+SECTION ADDITIONAL
+ns.foo.org. IN A 1.2.3.53
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+foo2.org. IN NS
+SECTION AUTHORITY
+foo2.org.      3600    IN      NSEC    foo3.org. NS RRSIG NSEC
+foo2.org.      3600    IN      RRSIG   NSEC 8 2 3600 20070926134150 20070829134150 1444 org. RfkRfmLeyLYtdDKrLBaXTk/KXTkUn9/4dMZtm3Kl5k5oa9/LkbPmnPb0z+zZ/3aBBKZu0QIevS7w++fdYWfIQiK+DIgG9hhp+lNxakLKp4M5SiWuh+zlTjwbRzlf4abWe/c/FR4bjesgObUdLnaIoM4h3aQUS1KsjyGFmLOCUGM=
+foo2.org. IN NS  ns.foo2.org.
+SECTION ADDITIONAL
+ns.foo2.org. IN A 1.2.3.54
+ENTRY_END
+
+; for this entry the org zone is suddenly resigned with NSEC3.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+foo3.org. IN NS
+SECTION AUTHORITY
+; org. NSEC3PARAM 1 0 0 -
+; org. -> mvnq25j8mo8ge527pikocn5rl72s2o0s.
+; foo3.org. -> n3dm0vverfek5tl6klsp0k0gduj0gk92.
+mvnq25j8mo8ge527pikocn5rl72s2o0s.org. IN NSEC3 1 0 0 - mvnq25j8mo8ge527pikocn5rl72s2o0t NS SOA RRSIG DNSKEY
+mvnq25j8mo8ge527pikocn5rl72s2o0s.org.  3600    IN      RRSIG   NSEC3 8 2 3600 20070926134150 20070829134150 1444 org. MBmDCmjCeXShkwoDI/I04KK7w33FkNs7vci+SKoR5uWS24E3yt2AVgfkwFkKh42+MgqZnBUJEdRPOfATc80XDwxDhdymB3Ff4W1KAVFpJAkU42ii3bdiyYr+YPWVWdCYG2EfSpLcJiD6E21mW2DNRR7Lj9/W89WmndeUEgpjALA=
+n3dm0vverfek5tl6klsp0k0gduj0gk91.org. IN NSEC3 1 0 0 - n3dm0vverfek5tl6klsp0k0gduj0gk93 NS DS RRSIG
+n3dm0vverfek5tl6klsp0k0gduj0gk91.org.  3600    IN      RRSIG   NSEC3 8 2 3600 20070926134150 20070829134150 1444 org. H5aeeVc6k8fTSwUYDA9BW4ScHazb2b3NfvdQwRbKYj97tlJnJa+cojgOnyvP3qW9YoqO0aRT8rzUjFPJajOIRoS/6XVWCZ3ymDNQIi8oW6vT8qQYA2ldmoWDvFK9fHSgiwqJzQiKXtNGdqTfj2HEyVKVbFTv/Cgxh5jLcB6r9jM=
+foo3.org. IN NS  ns.foo3.org.
+SECTION ADDITIONAL
+ns.foo3.org. IN A 1.2.3.55
+ENTRY_END
+RANGE_END
+
+; ns1.servers.com for .com
+RANGE_BEGIN 0 1000
+       ADDRESS 1.2.3.52
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION ANSWER
+com.    IN NS  ns1.servers.com.
+SECTION ADDITIONAL
+ns1.servers.com. IN A 1.2.3.52
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+foo.com. IN TXT
+SECTION ANSWER
+foo.com. IN CNAME www.foo.org.
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+foo2.com. IN TXT
+SECTION ANSWER
+foo2.com. IN CNAME www.foo2.org.
+ENTRY_END
+RANGE_END
+
+; ns.foo.org for foo.org
+RANGE_BEGIN 0 1000
+       ADDRESS 1.2.3.53
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+foo.org. IN NS
+SECTION ANSWER
+foo.org.       3600    IN      NS      ns.foo.org.
+foo.org.       3600    IN      RRSIG   NS 8 2 3600 20070926134150 20070829134150 29332 foo.org. WfSshqIf/LdScUjw5uyB10t3yoF36aOc+lkhTQsAiR7gat14Un+F1s8bQiG3gU8mnMirsu7M1aMBeQlbJncFhLu4av6ZkkI5L/qvojBAL0AF7Rj0gUWKbMc2NsAeAKY8ySzDXqF7ol9YEskHWW35aL+r5DB91u4joZVsANSqeAfLWAhm47hDGlWgzQ1us72dWOPxPqNBG0sx48xaFxiZJjowXVs/zbRQ1TyIFPeKztayc6HL2gaOPPUoOuHp/AEecySqjamXI28mqBBs8MGJoArFaJ05wIuWEdOzsfc+BcYnmuCaTVgEHUvZMbNvi2CYCY4l0jcl1UD7i4FzPhC4jQ==
+SECTION ADDITIONAL
+ns.foo.org.    3600    IN      A       1.2.3.53
+ns.foo.org.    3600    IN      RRSIG   A 8 3 3600 20070926134150 20070829134150 29332 foo.org. pScBuh9fyXazJLV4yPGQsDKAnNgAGe5G5712sQ46V9CA4Rv+STTI9p6JDyqu1EWVJupLwbL7dqqypSwcSy8CpCO1nH/n/yBnT/9txduEpzvr4OtVJnRZS1LMMlpb4NrT+QPpzxXZH5Zlc+Axevbxj7FVeFIAUq9Fh2+yO6lYXffIy9BW85VOZa1S08/O/2ZyZwPh6pdxB7HRGe/KuD86TMjfjVsveYL4w7UFC+wk1XGQA+zuXOIm+9MQC+UzM/cVR38nW/7Oj1hY2iAgvevFrT75tesf+H927uaHaPrWqSVJLPRIfm4O5wT5K1bgvfYDSlpU/YLf7vaCtJ+kKSOpJw==
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+foo.org. IN DNSKEY
+SECTION ANSWER
+foo.org.       3600    IN      DNSKEY  257 3 8 AwEAAb4WMOTBLTFvmBra5m6SK4VfViOzmvyUAU0qv861ZQXeEFvwlndqNU9rwRsMxrSWAYs5nHErKDn49usC/HyxxW1477iGFHhfgL4mjNreJm9zft2QFB1VLbRbEPYdDMLCn4co0qnG7/KG8W2i8Pym1L7f+aREwbLo+/716AS2PbaKMhfWLKLiq5wnBcUClQMNzCiwhqxDJp1oePqfkVdeUgXOtgi0dYRIKyQFhJ5VWJ22npoi/Gif0XLCADAlAwRLKc8o/yJkCxskzgpHpw5Cki1lclg0aq4ssOuPRQ+ne6IHYCz9D2mwzulblhLFamKdq7aHzNt4NlyxhpANVFiKLD8= ;{id = 29332 (ksk), size = 2048b}
+foo.org.       3600    IN      RRSIG   DNSKEY 8 2 3600 20070926134150 20070829134150 29332 foo.org. qlZQpZG+prXK6vsd+zObdHj8DbPBCpjB16B7UgTwsgmVxGRX9nSBnkqUqcIrnszJMHvEwu7VPWjegPX3E8LESgz2Slepa5T8hWmcoega2vWakIzIRNtDxH9PXDy804Dmduk/fxBzMlbbFLfsSrG5+cK5PhingjjxNbEuG3V124xTjFUGHKu4NM6kMfPcHOwjTTQLt6azJ10i6CeyaUXCSYz5xGE7Z4PSLYAstlLsM64EtLTGQHAZIEr2Dq6C23u23sRrj/0qcMFo0Nv8E3rjnkfJIo+RYuqqAznFsLMqfveX42ElWBl5YVLQHSo+kFbXcvgX7gzL8X9u4Z6MJ9zUkw==
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+foo.org. IN TXT
+SECTION ANSWER
+foo.org.       3600    IN      TXT     "a.b.c."
+foo.org.       3600    IN      RRSIG   TXT 8 2 3600 20070926134150 20070829134150 29332 foo.org. UW/T+M0crcfzQ6PVM/0o1ZtXF2o26VTm/V/9/+F873aQnDwfRLH+tzYSC+yfWZ/0niuif6fv9FYWisE8CyAIIMZ8mrxM7M4JgEZ0/vFOC2sN0qnmqSoZoZaeOEjJIAS6F2om+L6AAFtAH2Khbm0wkHc0jBWj3vK8HoXO38iLe1pPnuBK6BhE2+tyDIcUCoABFrycT0E5NBKFERQL+CzYMEzMUS/joSeWloFw1AB1X9Z94ezgmD+g2MnbW78DR6TRZXGD4DWXuxYNswRnfp4VENSOsSbhX9ixtuxwGn1fhiZeTxN84zE/ERiLK59Yo1bQ3TFjOY0cCvj+c2NulTAr9w==
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+www.foo.org. IN TXT
+SECTION ANSWER
+www.foo.org.   3600    IN      TXT     "a.b.d."
+www.foo.org.   3600    IN      RRSIG   TXT 8 3 3600 20070926134150 20070829134150 29332 foo.org. EjFHdpJdlFFLDWabiMsMzUPE1+brzq/0ecRG39bpPuU/6MW4HCQs4rlLlZNmmJP/vj+kLTGfguSrKyLQt8n9Tf1fKbvD6NUOIOwiVUOE4kb54JghbiBhWeCnRLmUQwi7DKy0UEw8niX3SY6WwJxO/e7+leQJY7Gpg3S00vKskTAjnKeDYiHcrO69Dpyc0l/qtR1Bb98xcs4vMsh6//BBklSlPTMKBcu2uK6sK7G2ZR1lOtShoginq5UHa+EZWR6Pxn8pLkfQGOXTjGq5WaTeEdcinBlvXYBGhAPKWXHwcEtEjClkWi1ZXOnSgwHu9dRxgSk/jcfSmjBFzw2bycq2Lg==
+ENTRY_END
+RANGE_END
+
+; ns.foo2.org for foo2.org
+RANGE_BEGIN 0 1000
+       ADDRESS 1.2.3.54
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+foo2.org. IN NS
+SECTION ANSWER
+foo2.org. IN NS  ns.foo2.org.
+SECTION ADDITIONAL
+ns.foo2.org. IN A 1.2.3.54
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+www.foo2.org. IN TXT
+SECTION ANSWER
+www.foo2.org. IN TXT "a.b.e."
+ENTRY_END
+RANGE_END
+
+; ns.foo3.org for foo3.org
+RANGE_BEGIN 0 1000
+       ADDRESS 1.2.3.55
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+foo3.org. IN NS
+SECTION ANSWER
+foo3.org. IN NS  ns.foo3.org.
+SECTION ADDITIONAL
+ns.foo3.org. IN A 1.2.3.55
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns.foo3.org. IN A
+SECTION ANSWER
+ns.foo3.org. IN A 1.2.3.55
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns.foo3.org. IN AAAA
+SECTION AUTHORITY
+foo3.org. IN SOA ns.foo3.org. host.foo3.org. 2007090422 3600 300 604800 3600
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+www.foo3.org. IN TXT
+SECTION ANSWER
+www.foo3.org. IN TXT "a.b.f."
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+www2.foo3.org. IN TXT
+SECTION ANSWER
+www2.foo3.org. IN TXT "a.b.g."
+ENTRY_END
+RANGE_END
+
+; Test query
+STEP 10 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+foo.org. IN TXT
+ENTRY_END
+
+; It is blocked
+STEP 11 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA AA NXDOMAIN
+SECTION QUESTION
+foo.org. IN TXT
+SECTION ANSWER
+ENTRY_END
+
+STEP 20 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+www.foo2.org. IN TXT
+ENTRY_END
+
+STEP 21 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+www.foo2.org. IN TXT
+SECTION ANSWER
+www.foo2.org. IN TXT "a.b.e."
+ENTRY_END
+
+STEP 30 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+www.foo3.org. IN TXT
+ENTRY_END
+
+STEP 31 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+www.foo3.org. IN TXT
+SECTION ANSWER
+www.foo3.org. IN TXT "a.b.f."
+ENTRY_END
+
+STEP 32 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+www2.foo3.org. IN TXT
+ENTRY_END
+
+STEP 33 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+www2.foo3.org. IN TXT
+SECTION ANSWER
+www2.foo3.org. IN TXT "a.b.g."
+ENTRY_END
+
+; This query has a CNAME to foo.org.
+STEP 40 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+foo.com. IN TXT
+ENTRY_END
+
+STEP 41 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+foo.com. IN TXT
+SECTION ANSWER
+foo.com. IN CNAME www.foo.org.
+www.foo.org.   3600    IN      TXT     "a.b.d."
+ENTRY_END
+
+SCENARIO_END

diff --git a/util/module.h b/util/module.h
index 5bdb622a2515448f7bb6d255542ddc357b25e244..03f3eab0b2418857558d5b52e2949457400a7fa6 100644 (file)
--- a/util/module.h
+++ b/util/module.h
@@ -696,6 +696,8 @@ struct module_qstate {
        /** Extended result of response-ip action processing, mainly
         *  for logging purposes. */
        struct respip_action_info* respip_action_info;
+       /** if the query has been modified by rpz processing. */
+       int rpz_applied;
        /** if the query is rpz passthru, no further rpz processing for it */
        int rpz_passthru;
        /* Flag tcp required. */

diff --git a/validator/validator.c b/validator/validator.c
index e6d19a2c9f06f3bac8030dcd1d7ef153543e574d..194671e58134fe0fc5786fec24efddf187d9f01e 100644 (file)
--- a/validator/validator.c
+++ b/validator/validator.c
@@ -3053,6 +3053,14 @@ process_ds_response(struct module_qstate* qstate, struct val_qstate* vq,
        int ret;
        *suspend = 0;
        vq->empty_DS_name = NULL;
+       if(sub_qstate && sub_qstate->rpz_applied) {
+               verbose(VERB_ALGO, "rpz was applied to the DS lookup, "
+                       "make it insecure");
+               vq->key_entry = NULL;
+               vq->state = VAL_FINISHED_STATE;
+               vq->chase_reply->security = sec_status_insecure;
+               return;
+       }
        ret = ds_response_to_ke(qstate, vq, id, rcode, msg, qinfo, &dske,
                sub_qstate);
        if(ret != 0) {
@@ -3146,6 +3154,15 @@ process_dnskey_response(struct module_qstate* qstate, struct val_qstate* vq,
        char* reason = NULL;
        sldns_ede_code reason_bogus = LDNS_EDE_DNSSEC_BOGUS;
 
+       if(sub_qstate && sub_qstate->rpz_applied) {
+               verbose(VERB_ALGO, "rpz was applied to the DNSKEY lookup, "
+                       "make it insecure");
+               vq->key_entry = NULL;
+               vq->state = VAL_FINISHED_STATE;
+               vq->chase_reply->security = sec_status_insecure;
+               return;
+       }
+
        if(rcode == LDNS_RCODE_NOERROR)
                dnskey = reply_find_answer_rrset(qinfo, msg->rep);