Re: Internal CNAME in RPZ

2019-10-24 Thread Andrey Geyn
Thank you, Bob. Unfortunately, records are generated by my users, not by me, so I can't change them as I want. Thanks again for your time and detailed explanation. Andrey. 24.10.2019, 19:53, "Bob Harold" : > On Thu, Oct 24, 2019 at 9:20 AM Andrey Geyn wrote: >> Hi, Bob, thank you for respons

Re: Internal CNAME in RPZ

2019-10-24 Thread Bob Harold
On Thu, Oct 24, 2019 at 9:20 AM Andrey Geyn wrote: > Hi, Bob, thank you for response! > > What if I want to make following configuration (as an example): > > domain.comA10.10.10.10 > *.domain.com CNAMEdomain.com > > I don't want to write 10.10.10.10 twice, I want to use magic of CNAM

Re: Internal CNAME in RPZ

2019-10-24 Thread Andrey Geyn
Hi, Bob, thank you for response! What if I want to make following configuration (as an example): domain.com    A    10.10.10.10*.domain.com  CNAME    domain.com I don't want to write 10.10.10.10 twice, I want to use magic of CNAME's here. > Do you want cname.domain.com to point to 10.10.10.10?  The

Re: Internal CNAME in RPZ

2019-10-24 Thread Bob Harold
On Wed, Oct 23, 2019 at 10:34 AM Andrey Geyn wrote: > Hello, I would like to set up RPZ with CNAME and A. There are two options: > > 1. > cname.domain.comCNAME test.domain.com(without trailing dot) > test.domain.com A 10.10.10.10 > There is a misunderstanding here. Y

Re: Internal CNAME in RPZ

2019-10-24 Thread Андрей Гейн
I enabled debug and query logs for BIND and no, it's not look like caching problems... Do you have any idea how to force BIND look for CNAMEd name in RPZ? I tried to analyze source codes, and it seems that this line prohibits to apply policy on the second iteration: https://gitlab.isc.org/isc-

Re: Internal CNAME in RPZ

2019-10-23 Thread m3047
Eh? I don't understand this. Response Policy Zones are /zones/, as the nomenclature implies: they are maintained, transferred, managed with zone handling machinery. On Wed, 23 Oct 2019, julien soula wrote: On Wed, Oct 23, 2019 at 10:21:08PM +0500, Andrey Geyn wrote: In my test (I have BIND

Re: Internal CNAME in RPZ

2019-10-23 Thread m3047
Hello... On Wed, 23 Oct 2019, Andrey Geyn wrote: [...] I don't understand why your tests for "cname.example.com" and "cname.test.m3047.net" differ (first one returns only CNAME.EXAMPLE.COM. 5 IN CNAME TEST.EXAMPLE.COM. I didn't understand this as well. Is it something about caching perhaps?

Re: Internal CNAME in RPZ

2019-10-23 Thread julien soula
On Wed, Oct 23, 2019 at 10:21:08PM +0500, Andrey Geyn wrote: > Hi, Fred! > > Thank for your reply and tests. > The questions you ask are my questions too, just asked more professionally. > Thanks for it :) > > .../... > In my test (I have BIND 9.11.3-1ubuntu1.9-Ubuntu) I have following named.c

Re: Internal CNAME in RPZ

2019-10-23 Thread Andrey Geyn
> getting. Oddly enough dig is giving me the unexpected results, and > (Python) socket.getaddrinfo() does what I expect. It appears that CNAME > resolution within RPZ is escaping... > > On Wed, 23 Oct 2019, Andrey Geyn wrote: > >>  Date: Wed, 23 Oct 2019 19:34:39

Re: Internal CNAME in RPZ

2019-10-23 Thread m3047
Andrey Geyn To: "bind-users@lists.isc.org" Subject: Internal CNAME in RPZ Hello, I would like to set up RPZ with CNAME and A. There are two options:   1. cname.domain.com        CNAME   test.domain.com    (without trailing dot) test.domain.com         A       10.10.10.10 Tr

Re: Internal CNAME in RPZ

2019-10-23 Thread Андрей Гейн
// Sorry for HTML embedded to my first email. Hello, I would like to set up RPZ with CNAME and A. There are two options: 1. cname.domain.comCNAME test.domain.com(without trailing dot) test.domain.com A 10.10.10.10 In this case I receive # dig cname.domain.com @12

Internal CNAME in RPZ

2019-10-23 Thread Andrey Geyn
Hello, I would like to set up RPZ with CNAME and A. There are two options: 1.cname.domain.com        CNAME   test.domain.com    (without trailing dot)test.domain.com         A       10.10.10.10 In this case I receive # dig cname.domain.com @127.0.0.1...cname.domain.com.       5       IN      CNAME