Bug 1876492 - RPZ wildcard passthru ignored
Summary: RPZ wildcard passthru ignored
Alias: None
Product: Red Hat Enterprise Linux 8
Classification: Red Hat
Component: bind
Version: 8.2
Hardware: Unspecified
OS: Unspecified
Target Milestone: rc
: 8.4
Assignee: Tomas Korbar
QA Contact: Petr Sklenar
Prerana Sharma
Depends On:
Blocks: 1894575
TreeView+ depends on / blocked
Reported: 2020-09-07 10:27 UTC by Apurbita Mukherjee
Modified: 2021-05-18 14:59 UTC (History)
5 users (show)

Fixed In Version: bind-9.11.20-6.el8
Doc Type: Bug Fix
Doc Text:
.RPZ now works with wildcard characters Previously, the `dns_rpz_find_name` function in the `lib/dns/rpz.c` file did not consider wildcard characters when a record for the same suffix was present. Consequently, some records containing wildcard characters were ignored. With this update, the `dns_rpz_find_name` function has been fixed and it now considers wildcard characters.
Clone Of:
Last Closed: 2021-05-18 14:59:05 UTC
Type: Bug
Target Upstream Version:

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
Internet Systems Consortium (ISC) isc-projects/bind9 - issues 1619 0 None None None 2020-09-23 16:52:48 UTC
Internet Systems Consortium (ISC) isc-projects/bind9 - merge_requests 3874 0 None None None 2020-09-21 11:53:12 UTC
Red Hat Product Errata RHBA-2021:1645 0 None None None 2021-05-18 14:59:31 UTC

Description Apurbita Mukherjee 2020-09-07 10:27:03 UTC
Description of problem:
Bind 9.11.13 appears to introduce this Bind bug:  https://gitlab.isc.org/isc-projects/bind9/-/issues/1619   It looks like it's introduced by a different bug fix, which have been presumably backported.

I have two response-policy zones configured. The first zone is a local whitelist with the policy passthru. The second zone is a local blacklist with the policy given. If the blacklist rpz zone contains www.example.com CNAME . (nxdomain) and the whitelist rpz zone contains a wildcard to whitelist *.example.com with *.example.com CNAME rpz-passthru. then this wildcard is ignored.

This has works as intended in Bind 9.11.4, but fails in 9.11.13

Version-Release number of selected component (if applicable):

How reproducible:
Continually, whenever a host-level RPZ block interacts with a wildcard-level PASSTHRU

Steps to Reproduce:
1. Install bind release 9.11.13
2. Use the named.conf and whitelist.zone, blacklist.zone listed below
3. Start bind e.g. systemctl start named
4. Use dig to check the behavior and check the logs

dig @::1 www.example.com

Actual results:
The wildcard passthru entry in the whitelist.zone is ignored.

Expected results:
The wildcard passthru entry in the whitelist.zone is used.

Relevant configuration files

Used named.conf

logging {
	channel "default_debug" {
		file "named.log";
		severity info;
		print-time yes;
		print-severity yes;
		print-category yes;
options {
	directory "/var/named/data";
	listen-on port 53 {;
	listen-on-v6 port 53 {
	dnssec-enable yes;
	dnssec-validation auto;
	empty-zones-enable yes;
	recursion yes;
	response-policy {
		zone "whitelist.zone" policy passthru;
		zone "blacklist.zone" policy given;
	} break-dnssec yes;
	allow-query {
	allow-transfer {
zone "whitelist.zone" {
	type master;
	file "whitelist.zone";
	allow-query {
zone "blacklist.zone" {
	type master;
	file "blacklist.zone";
	allow-query {

Used whitelist.zone

$ORIGIN whitelist.zone.
$TTL 3600
@		IN SOA ns.whitelist.zone.  hostmaster.whitelist.zone. 1 600 300 604800 3600
		IN NS	ns2.switch.ch.

example.com	CNAME rpz-passthru.
*.example.com	CNAME rpz-passthru.

Used blacklist.zone

$ORIGIN blacklist.zone.
$TTL 3600
@		IN SOA ns.blacklist.zone.  hostmaster.blacklist.zone. 1 600 300 604800 3600
		IN NS	ns2.switch.ch.

www.example.com	CNAME .
; test record
test.example.org CNAME .

Additional info:

Comment 1 Petr Menšík 2020-09-21 11:53:12 UTC
Thank you for the report. It is fixed only in 9.11.22, which is not yet prepared for RHEL8. It also includes tests for missing fix. The main fix is include by commit 33ae88f08dabea846aee3be3af8a515fd9774ee1.

Comment 2 Petr Menšík 2020-09-23 16:52:52 UTC
Similar issue[1] was recently fixed in upstrem release.

1. https://gitlab.isc.org/isc-projects/bind9/-/issues/1619

Comment 21 errata-xmlrpc 2021-05-18 14:59:05 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (bind bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.