From 73fff669db7e00dff480a80296bf688bb47e3801 Mon Sep 17 00:00:00 2001 From: Mark Andrews Date: Fri, 10 Apr 2026 10:24:06 +1000 Subject: [PATCH 1/3] Fix TTL extraction from A/AAAA record (cherry picked from commit 89c86e338db2492b92e6618c586f146c6928dc6d) --- bin/tests/system/rpz/tests.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/bin/tests/system/rpz/tests.sh b/bin/tests/system/rpz/tests.sh index fe72456..54b1535 100644 --- a/bin/tests/system/rpz/tests.sh +++ b/bin/tests/system/rpz/tests.sh @@ -380,7 +380,7 @@ addr () { digcmd $2 >$DIGNM #ckalive "$2" "server crashed by 'dig $2'" || return 1 ADDR_ESC=`echo "$ADDR" | sed -e 's/\./\\\\./g'` - ADDR_TTL=`tr -d '\r' < $DIGNM | sed -n -e "s/^[-.a-z0-9]\{1,\}[ ]*\([0-9]*\) IN AA* ${ADDR_ESC}\$/\1/p"` + ADDR_TTL=$(tr -d '\r' <$DIGNM | sed -n -e "s/^[-.a-z0-9]\{1,\}[ ]*\([0-9]*\)[ ]IN[ ]AA*[ ]${ADDR_ESC}\$/\1/p") if test -z "$ADDR_TTL"; then setret "'dig $2' wrong; no address $ADDR record in $DIGNM" return 1 -- 2.55.0 From 7de152142d546eebfadbd7b0a3a73518b0db0a8e Mon Sep 17 00:00:00 2001 From: Mark Andrews Date: Fri, 10 Apr 2026 10:24:40 +1000 Subject: [PATCH 2/3] Check rpz name too long wildcard CNAME expansion handling (cherry picked from commit 9345394e2097031b55b3ef34ceaadf5a7ebbeef2) --- bin/tests/system/rpz/ns2/tld2.db | 2 ++ bin/tests/system/rpz/ns4/tld4.db | 2 ++ bin/tests/system/rpz/tests.sh | 5 ++++- 3 files changed, 8 insertions(+), 1 deletion(-) diff --git a/bin/tests/system/rpz/ns2/tld2.db b/bin/tests/system/rpz/ns2/tld2.db index a16d196..2308dfb 100644 --- a/bin/tests/system/rpz/ns2/tld2.db +++ b/bin/tests/system/rpz/ns2/tld2.db @@ -118,3 +118,5 @@ a6-2 A 192.168.6.2 a7-1 A 192.168.7.1 TXT "a7-1 tld2 text" + +*.wild A 192.168.9.1 diff --git a/bin/tests/system/rpz/ns4/tld4.db b/bin/tests/system/rpz/ns4/tld4.db index a164818..a3ac815 100644 --- a/bin/tests/system/rpz/ns4/tld4.db +++ b/bin/tests/system/rpz/ns4/tld4.db @@ -57,6 +57,8 @@ a3-6.tld2 A 56.56.56.56 a3-7.sub1.tld2 A 57.57.57.57 +*.wild.sub1.tld2 A 57.57.57.57 + a3-8.tld2 A 58.58.58.58 a3-9.sub9.tld2 A 59.59.59.59 diff --git a/bin/tests/system/rpz/tests.sh b/bin/tests/system/rpz/tests.sh index 54b1535..9200ac3 100644 --- a/bin/tests/system/rpz/tests.sh +++ b/bin/tests/system/rpz/tests.sh @@ -533,7 +533,10 @@ for mode in native dnsrps; do here x.servfail <<'EOF' # 34 qname-wait-recurse yes ;; status: SERVFAIL, x EOF - addr 35.35.35.35 "x.servfail @$ns5" # 35 qname-wait-recurse no + addr 35.35.35.35 "x.servfail @$ns5" # 35 qname-wait-recurse no + here aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.wild.sub1.tld2 <<'EOF' # 36 wildcard CNAME name to long + ;; status: YXDOMAIN, x +EOF end_group ckstats $ns3 test1 ns3 22 ckstats $ns5 test1 ns5 1 -- 2.55.0 From 4be53aaf32f8df3ca7cce9a25737890e3d33819e Mon Sep 17 00:00:00 2001 From: Mark Andrews Date: Fri, 10 Apr 2026 10:26:14 +1000 Subject: [PATCH 3/3] Properly handle rpz name to long wildcard expansion Previously a self referential CNAME and the original address record were returned. We now return a YXDOMAIN response. (cherry picked from commit cfc4c4f69870ce492deaaa429453563d1621ded3) --- lib/ns/query.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/lib/ns/query.c b/lib/ns/query.c index 249321c..d11a18c 100644 --- a/lib/ns/query.c +++ b/lib/ns/query.c @@ -7061,8 +7061,9 @@ query_rpzcname(query_ctx_t *qctx, dns_name_t *cname) { qctx->fname, NULL); if (result == DNS_R_NAMETOOLONG) { client->message->rcode = dns_rcode_yxdomain; - } else if (result != ISC_R_SUCCESS) { - return (result); + } + if (result != ISC_R_SUCCESS) { + return result; } } else { dns_name_copynf(cname, qctx->fname); -- 2.55.0