mir/bind
2
0
Fork 0
mirror of https://gitlab.isc.org/isc-projects/bind9 synced 2025-09-01 15:05:23 +00:00
Code Issues Releases Wiki Activity

RPZ response's SOA record is incorrectly set to 1

Browse Source 
An RPZ response's SOA record TTL is set to 1 instead of the SOA TTL,
a boolean value is passed on to query_addsoa, which is supposed to be
a TTL value. I don't see what value is appropriate to be used for
overriding, so we will pass UINT32_MAX.

(cherry picked from commit 5d7e613e81)
This commit is contained in:
Matthijs Mekking
2024-04-30 11:14:42 +02:00
parent 7ed19b1e1e
commit 4ef23ad0ff
2 changed files with 4 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
bin/tests/system/rpz/tests.sh
View File

@@ -838,13 +838,13 @@ grep NXDOMAIN dig.out.${t} >/dev/null || setret "failed"
t=$((t + 1)) t=$((t + 1))
echo_i "checking that "add-soa no" at rpz zone level works (${t})" echo_i "checking that "add-soa no" at rpz zone level works (${t})"
$DIG z.x.servfail -p ${PORT} @$ns7 >dig.out.${t} || setret "failed" $DIG z.x.servfail -p ${PORT} @$ns7 >dig.out.${t} || setret "failed"
grep SOA dig.out.${t} >/dev/null && setret "failed" grep "SOA" dig.out.${t} >/dev/null && setret "failed"
if [ native = "$MODE" ]; then if [ native = "$MODE" ]; then
t=$((t + 1)) t=$((t + 1))
echo_i "checking that "add-soa yes" at response-policy level works (${t})" echo_i "checking that "add-soa yes" at response-policy level works (${t})"
$DIG walled.tld2 -p ${PORT} +noall +add @$ns3 >dig.out.${t} || setret "failed" $DIG walled.tld2 -p ${PORT} +noall +add @$ns3 >dig.out.${t} || setret "failed"
grep "^manual-update-rpz\..*SOA" dig.out.${t} >/dev/null || setret "failed" grep "^manual-update-rpz\..*60.*SOA" dig.out.${t} >/dev/null || setret "failed"
fi fi
if [ native = "$MODE" ]; then if [ native = "$MODE" ]; then
@@ -862,7 +862,7 @@ if [ native = "$MODE" ]; then
t=$((t + 1)) t=$((t + 1))
echo_i "checking that 'add-soa unset' works (${t})" echo_i "checking that 'add-soa unset' works (${t})"
$DIG walled.tld2 -p ${PORT} +noall +add @$ns8 >dig.out.${t} || setret "failed" $DIG walled.tld2 -p ${PORT} +noall +add @$ns8 >dig.out.${t} || setret "failed"
grep "^manual-update-rpz\..*SOA" dig.out.${t} >/dev/null || setret "failed" grep "^manual-update-rpz\..*60.*SOA" dig.out.${t} >/dev/null || setret "failed"
fi fi
# dnsrps does not allow NS RRs in policy zones, so this check # dnsrps does not allow NS RRs in policy zones, so this check

4
lib/ns/query.c
View File

@@ -7359,9 +7359,7 @@ query_checkrpz(query_ctx_t *qctx, isc_result_t result) {
* Add SOA record to additional section * Add SOA record to additional section
*/ */
if (qctx->rpz_st->m.rpz->addsoa) { if (qctx->rpz_st->m.rpz->addsoa) {
bool override_ttl = rresult = query_addsoa(qctx, UINT32_MAX,
dns_rdataset_isassociated(qctx->rdataset);
rresult = query_addsoa(qctx, override_ttl,
DNS_SECTION_ADDITIONAL); DNS_SECTION_ADDITIONAL);
if (rresult != ISC_R_SUCCESS) { if (rresult != ISC_R_SUCCESS) {
QUERY_ERROR(qctx, result); QUERY_ERROR(qctx, result);