Commit 324e595505 for bind

commit 324e5955051c08be7ae7cc28348d4224bea253a1
Author: Petr Špaček <pspacek@isc.org>
Date:   Fri Sep 11 11:14:24 2026 +0000

    Test CNAME into zone and DLZ refused by allow-query

    Related: #6407
    Related: #6412
    Assisted-by: Claude:claude-opus-5

diff --git a/bin/tests/system/allow_query_on/ns1/allowed.nil.db b/bin/tests/system/allow_query_on/ns1/allowed.nil.db
new file mode 100644
index 0000000000..b9857aa1ce
--- /dev/null
+++ b/bin/tests/system/allow_query_on/ns1/allowed.nil.db
@@ -0,0 +1,12 @@
+$TTL 300
+@			IN SOA	. a.root.servers.nil. (
+				2000042100	; serial
+				600		; refresh
+				600		; retry
+				1200		; expire
+				600		; minimum
+)
+
+@			NS	a.root-servers.nil.
+dlz			CNAME	example.nil.
+denied			CNAME	www.denied.nil.
diff --git a/bin/tests/system/allow_query_on/ns1/denied.nil.db b/bin/tests/system/allow_query_on/ns1/denied.nil.db
new file mode 100644
index 0000000000..8286548310
--- /dev/null
+++ b/bin/tests/system/allow_query_on/ns1/denied.nil.db
@@ -0,0 +1,11 @@
+$TTL 300
+@			IN SOA	. a.root.servers.nil. (
+				2000042100	; serial
+				600		; refresh
+				600		; retry
+				1200		; expire
+				600		; minimum
+)
+
+@			NS	a.root-servers.nil.
+www			A	10.53.0.99
diff --git a/bin/tests/system/allow_query_on/ns1/named.conf.j2 b/bin/tests/system/allow_query_on/ns1/named.conf.j2
index 0a4285a86b..fca5349a32 100644
--- a/bin/tests/system/allow_query_on/ns1/named.conf.j2
+++ b/bin/tests/system/allow_query_on/ns1/named.conf.j2
@@ -48,6 +48,12 @@ view "vdlz1" {
 		type primary;
 		file "root.db";
 	};
+
+	zone "allowed.nil" {
+		type primary;
+		file "allowed.nil.db";
+		allow-query { any; };
+	};
 };

 view "vdlz2" {
@@ -78,3 +84,25 @@ view "vdlz3" {
 		file "root.db";
 	};
 };
+
+view "vzone" {
+	match-clients { 10.53.0.6; };
+	recursion yes;
+	allow-recursion { any; };
+	zone "." {
+		type primary;
+		file "root.db";
+	};
+
+	zone "allowed.nil" {
+		type primary;
+		file "allowed.nil.db";
+		allow-query { any; };
+	};
+
+	zone "denied.nil" {
+		type primary;
+		file "denied.nil.db";
+		allow-query { none; };
+	};
+};
diff --git a/bin/tests/system/allow_query_on/tests_allow_query_on.py b/bin/tests/system/allow_query_on/tests_allow_query_on.py
index 813018f29e..6b8ee6dff9 100644
--- a/bin/tests/system/allow_query_on/tests_allow_query_on.py
+++ b/bin/tests/system/allow_query_on/tests_allow_query_on.py
@@ -10,7 +10,8 @@
 # information regarding copyright ownership.

 from dns.rcode import NOERROR, NXDOMAIN, REFUSED
-from pytest import mark
+from dns.rdatatype import CNAME
+from pytest import mark, xfail

 import isctest

@@ -24,6 +25,7 @@ import isctest
         ("example.nil", "SOA", "10.53.0.2", REFUSED),
         ("example.nil", "SOA", "10.53.0.3", REFUSED),
         ("example.nil", "SOA", "10.53.0.4", NOERROR),
+        ("www.denied.nil", "A", "10.53.0.6", REFUSED),
     ],
 )
 def test_allow_query_on(ns1, qname, qtype, srcip, rcode):
@@ -34,3 +36,24 @@ def test_allow_query_on(ns1, qname, qtype, srcip, rcode):
         assert res.answer
         isctest.check.aaflag(res)
         assert not res.authority
+
+
+@mark.parametrize("rd", [False, True])
+def test_cname_into_refused_dlz(ns1, rd):
+    msg = isctest.query.create("dlz.allowed.nil", "A", rd=rd)
+    res = isctest.query.udp(msg, ns1.ip, source="10.53.0.2")
+    assert [rrset.rdtype for rrset in res.answer] == [CNAME]
+    # GL #6412: should be REFUSED. Fix test failure once the bug is fixed.
+    isctest.check.noerror(res)
+    xfail("bug #6412")
+    isctest.check.refused(res)
+
+
+def test_cname_into_refused_zone(ns1):
+    msg = isctest.query.create("denied.allowed.nil", "A")
+    res = isctest.query.udp(msg, ns1.ip, source="10.53.0.6")
+    assert [rrset.rdtype for rrset in res.answer] == [CNAME]
+    # GL #6412: should be REFUSED. Fix test failure once the bug is fixed.
+    isctest.check.noerror(res)
+    xfail("bug #6412")
+    isctest.check.refused(res)