Re: Internal CNAME in RPZ

2019-10-24 Thread Andrey Geyn
Thank you, Bob. Unfortunately, records are generated by my users, not by me, so I can't change them as I want. Thanks again for your time and detailed explanation. Andrey. 24.10.2019, 19:53, "Bob Harold" : > On Thu, Oct 24, 2019 at 9:20 AM Andrey Geyn wrote: >> Hi, Bob, thank you for respons

Re: Internal CNAME in RPZ

2019-10-24 Thread Bob Harold
On Thu, Oct 24, 2019 at 9:20 AM Andrey Geyn wrote: > Hi, Bob, thank you for response! > > What if I want to make following configuration (as an example): > > domain.comA10.10.10.10 > *.domain.com CNAMEdomain.com > > I don't want to write 10.10.10.10 twice, I want to use magic of CNAM

Re: Internal CNAME in RPZ

2019-10-24 Thread Andrey Geyn
Hi, Bob, thank you for response! What if I want to make following configuration (as an example): domain.com    A    10.10.10.10*.domain.com  CNAME    domain.com I don't want to write 10.10.10.10 twice, I want to use magic of CNAME's here. > Do you want cname.domain.com to point to 10.10.10.10?  The

Re: Internal CNAME in RPZ

2019-10-24 Thread Bob Harold
On Wed, Oct 23, 2019 at 10:34 AM Andrey Geyn wrote: > Hello, I would like to set up RPZ with CNAME and A. There are two options: > > 1. > cname.domain.comCNAME test.domain.com(without trailing dot) > test.domain.com A 10.10.10.10 > There is a misunderstanding here. Y

Re: Internal CNAME in RPZ

2019-10-24 Thread Андрей Гейн
I enabled debug and query logs for BIND and no, it's not look like caching problems... Do you have any idea how to force BIND look for CNAMEd name in RPZ? I tried to analyze source codes, and it seems that this line prohibits to apply policy on the second iteration: https://gitlab.isc.org/isc-

Re: Internal CNAME in RPZ

2019-10-23 Thread m3047
Eh? I don't understand this. Response Policy Zones are /zones/, as the nomenclature implies: they are maintained, transferred, managed with zone handling machinery. On Wed, 23 Oct 2019, julien soula wrote: On Wed, Oct 23, 2019 at 10:21:08PM +0500, Andrey Geyn wrote: In my test (I have BIND

Re: Internal CNAME in RPZ

2019-10-23 Thread m3047
Hello... On Wed, 23 Oct 2019, Andrey Geyn wrote: [...] I don't understand why your tests for "cname.example.com" and "cname.test.m3047.net" differ (first one returns only CNAME.EXAMPLE.COM. 5 IN CNAME TEST.EXAMPLE.COM. I didn't understand this as well. Is it something about caching perhaps?

Re: Internal CNAME in RPZ

2019-10-23 Thread julien soula
On Wed, Oct 23, 2019 at 10:21:08PM +0500, Andrey Geyn wrote: > Hi, Fred! > > Thank for your reply and tests. > The questions you ask are my questions too, just asked more professionally. > Thanks for it :) > > .../... > In my test (I have BIND 9.11.3-1ubuntu1.9-Ubuntu) I have following named.c

Re: Internal CNAME in RPZ

2019-10-23 Thread Andrey Geyn
Hi, Fred! Thank for your reply and tests. The questions you ask are my questions too, just asked more professionally. Thanks for it :) Okay, let's use only variant with trailing dot, thank you for clarification. I don't understand why your tests for "cname.example.com" and "cname.test.m3047.n

Re: Internal CNAME in RPZ

2019-10-23 Thread m3047
Hi, so Andrey, Your output doesn't reflect what I would expect to see from an RPZ-mediated query, but rather what I would expect to see if querying a zone, such as the RPZ itself, directly. So I am not sure I understand your question. To the broader ISC community: however, I'm confused by th

Re: Internal CNAME in RPZ

2019-10-23 Thread Андрей Гейн
// Sorry for HTML embedded to my first email. Hello, I would like to set up RPZ with CNAME and A. There are two options: 1. cname.domain.comCNAME test.domain.com(without trailing dot) test.domain.com A 10.10.10.10 In this case I receive # dig cname.domain.com @12