[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

tags from tagged rpz zones are no longer honored after upgrade from 1.19.3 to 1.20.0 #1079

Closed
jbfamyaCfC opened this issue May 30, 2024 · 2 comments
Closed

tags from tagged rpz zones are no longer honored after upgrade from 1.19.3 to 1.20.0 #1079

jbfamyaCfC opened this issue May 30, 2024 · 2 comments

Comments

@jbfamyaCfC
Copy link
jbfamyaCfC commented May 30, 2024 •
edited
Loading

Describe the bug
After upgrade from 1.19.3 to 1.20.0 tagged rpz zones are always used.

To reproduce
Steps to reproduce the behavior:

  1. Starting unbound with unbound.conf.txt
  2. Add the following entry to rpz.test.intern:
    archive.ubuntu.com.rpz.test.intern. 300 IN CNAME install.intern.
  3. Query ::1 and 127.0.0.1, both return rpz modified data.

Expected behavior
dig @127.0.0.1 archive.ubuntu.com +nocomment shouldn't return rpz modified data but it does.
with unbound 1.19.3:

dig @127.0.0.1 archive.ubuntu.com +nocomment

; <<>> DiG 9.11.36-RedHat-9.11.36-11.el8_9.1 <<>> @127.0.0.1 archive.ubuntu.com +nocomment
; (1 server found)
;; global options: +cmd
;archive.ubuntu.com. IN A
archive.ubuntu.com. 17 IN A 91.189.91.81
archive.ubuntu.com. 17 IN A 91.189.91.82
archive.ubuntu.com. 17 IN A 185.125.190.39
archive.ubuntu.com. 17 IN A 185.125.190.36
archive.ubuntu.com. 17 IN A 91.189.91.83
;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Thu May 30 09:56:59 CEST 2024
;; MSG SIZE rcvd: 127

However with unbound 1.20.0 the following answer is returned:

dig @127.0.0.1 archive.ubuntu.com +nocomment

; <<>> DiG 9.11.36-RedHat-9.11.36-14.el8_10 <<>> @127.0.0.1 archive.ubuntu.com +nocomment
; (1 server found)
;; global options: +cmd
;archive.ubuntu.com. IN A
archive.ubuntu.com. 300 IN CNAME install.intern.
install.intern. 60 IN A 192.0.2.2
;; Query time: 1 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Thu May 30 09:59:12 CEST 2024
;; MSG SIZE rcvd: 97

System:

  • Unbound version: 1.20.0
  • OS: Almalinux 8.10
  • Version 1.20.0

Configure line: --build=x86_64-redhat-linux-gnu --host=x86_64-redhat-linux-gnu --program-prefix= --disable-dependency-tracking --prefix=/usr --exec-prefix=/usr --bindir=/usr/bin --sbindir=/usr/sbin --sysconfdir=/etc --datadir=/usr/share --includedir=/usr/include --libdir=/usr/lib64 --libexecdir=/usr/libexec --localstatedir=/var --sharedstatedir=/var/lib --mandir=/usr/share/man --infodir=/usr/share/info --with-pythonmodule --with-pyunbound PYTHON=/usr/libexec/platform-python --with-libevent --with-pthreads --with-ssl --disable-rpath --disable-static --enable-relro-now --enable-pie --enable-subnet --enable-ipsecmod --with-conf-file=/etc/unbound/unbound.conf --with-pidfile=/var/run/unbound/unbound.pid --enable-sha2 --disable-gost --enable-ecdsa --enable-dnstap --with-rootkey-file=/var/lib/unbound/root.key
Linked libs: libevent 2.1.8-stable (it uses epoll), OpenSSL 1.1.1k FIPS 25 Mar 2021
Linked modules: dns64 python ipsecmod subnetcache respip validator iterator

BSD licensed, see LICENSE in source package for details.
Report bugs to unbound-bugs@nlnetlabs.nl or https://github.com/NLnetLabs/unbound/issues

Additional information
The same happens if using access-control-tags.
@wcawijngaards
Copy link
Member

The functionality for RPZ CNAME handling started working better in 1.20.0, and this has a bug that tags are not handled correctly. The bugfix for this issue has the tag handling fixed in the code that deals with RPZ iterator callbacks. That also fixes tag handling for other RPZ triggers and RPZ actions.

wcawijngaards added a commit that referenced this issue May 30, 2024
@wcawijngaards
- Fix for #1079: fix RPZ taglist in iterator callback that no client
4b30e88 
  info is like no taglist intersection.
@wcawijngaards
Copy link
Member

Another bug fix for cases where no tag is set and also due to the query type the respip client_info is a NULL pointer, it should be handled like no tags are matched.

jedisct1 added a commit to jedisct1/unbound that referenced this issue Jun 16, 2024
@jedisct1
Merge remote-tracking branch 'nlnet/master'
b23387a 
* nlnet/master: (35 commits)
  - Add unit test for validation of repeated use of a DNAME record.
  - Fix validation for repeated use of a DNAME record.
  - Fix typos for 'the the' in text.
  - Fix memory leak in setup of dsa sig.
  - Skip unbound-dnstap-socket unit test when not compiled with   --enable-debug.
  - Fix to squelch connection reset by peer errors from log. And fix   that the tcp read errors are labeled as initial for the first calls.
  - Fix memory leak on exit for unbound-dnstap-socket; creates false negatives   during testing.
  - Fix memory leak when reload_keep_cache is used and num-threads changes.
  - Enable AddressSanitizer error detection in tdir tests.
  - Fix for NLnetLabs#1079: fix RPZ taglist in iterator callback that no client   info is like no taglist intersection.
  - Fix NLnetLabs#1079: tags from tagged rpz zones are no longer honored after   upgrade from 1.19.3 to 1.20.0.
  Changelog note for NLnetLabs#1078. - Merge NLnetLabs#1078: Only check old pid if no username.
  Only check old pid if no username
  - Update patch to remove 'command' shell builtin and update error   text.
  unbound-control-setup: check openssl
  - Fix unused variable warning on compilation with no thread support.
  - Fix spelling of tcp-idle-timeout docs, from Michael Tokarev.
  - Fix to enable that SERVFAIL is cached, for a short period, for more   cases. In the cases where limits are exceeded.
  Changelog entry for NLnetLabs#1059: - Fix NLnetLabs#1059: Intermittent DNS blocking failure with local-zone and   always_nxdomain. Addition of local_zones dynamically via   unbound-control was not finding the zone's parent correctly.
  Proper parent identification for dynamically entered local zones (NLnetLabs#1076)
  ...
@wcawijngaards wcawijngaards mentioned this issue Jun 21, 2024
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@wcawijngaards @jbfamyaCfC