From 4fc13d7f62811ef3fa7e35caa0e573353c1ffd58 Mon Sep 17 00:00:00 2001
From: Aram Sargsyan <aram@isc.org>
Date: Mon, 25 May 2026 14:17:26 +0000
Subject: [PATCH] Add a new check for the 'geoip2' system test

Check that an ACL can't be matched by a substring in the
GeoIP database, instead of the full string comparision.

(cherry picked from commit bdf4ab92805011e8946c264a6962f26e32a3bc12)
---
 .../system/geoip2/data/GeoIP2-Domain.json     |  10 ++++++++++
 .../system/geoip2/data/GeoIP2-Domain.mmdb     | Bin 2524 -> 2575 bytes
 bin/tests/system/geoip2/ns2/named11.conf.j2   |   8 ++++++++
 bin/tests/system/geoip2/setup.sh              |   2 +-
 bin/tests/system/geoip2/tests.sh              |   4 ++--
 5 files changed, 21 insertions(+), 3 deletions(-)

diff --git a/bin/tests/system/geoip2/data/GeoIP2-Domain.json b/bin/tests/system/geoip2/data/GeoIP2-Domain.json
index fb8e914fe5..6786de7fa6 100644
--- a/bin/tests/system/geoip2/data/GeoIP2-Domain.json
+++ b/bin/tests/system/geoip2/data/GeoIP2-Domain.json
@@ -34,6 +34,11 @@
          "domain" : "seven.org"
       }
    },
+   {
+      "::10.53.0.8/128" : {
+         "domain" : "seven"
+      }
+   },
    {
       "fd92:7065:b8e:ffff::1/128" : {
          "domain" : "one.de"
@@ -68,5 +73,10 @@
       "fd92:7065:b8e:ffff::7/128" : {
          "domain" : "seven.org"
       }
+   },
+   {
+      "fd92:7065:b8e:ffff::8/128" : {
+         "domain" : "seven"
+      }
    }
 ]
diff --git a/bin/tests/system/geoip2/data/GeoIP2-Domain.mmdb b/bin/tests/system/geoip2/data/GeoIP2-Domain.mmdb
index fe93decbbebf03ce5a0dcbad5d3beec5bddf7212..a0ee647f16d3ae64273deafe83f1ed586338b085 100644
GIT binary patch
literal 2575
zcmZA1cX-rf9Ki8kN-2AnT_Efh+5^hQg;-kJT17=g5s&olZJW|d&g8DNC@vhh759X?
z75Cl)_rSe(-MDb?^(Nmw#)tdobHDMvc}Jdz7$S0;NREgxPo$HM&JoEa>I`|%1-e2v
z=ng%gC-j2e&<FZLKj;qwARh+8AQ%ioU?>cO;ZOi0U?hwJ6Gp=r7z^WIJWPOzPzXgZ
z2_{1^lt2uoz*Lw9r7#_4z)YA0vtbU*1$_s>J?sEG!cMR=>;m&)S6BeMK^ZKBa;Shs
zPzhB~4ZA}P>;ZeiV%ST+A;*jCO|%azfqh{=*dLa{0dOEJgM(l>91L+-0T$Fk0+J!Y
zL5UKni=ujw23l-rjA|>xla(fsRFrf?+$c(m9Ktvce8@l+nqd{RKr5_<L*X!3qt|(i
z$l;o!M2^rL8Lq{s5+gVly`7_Va;+G_)7OZxPP1O*SdHG}aUsSA2sXWrt(*WS!bxy4
zoC2r9X>dB60qfyRI1A2(6(Z;I^z-0+xBxDMi{N6o1X!nRBx-|8^{Q`W>dQnfCwT>2
z30J|@a1C4wo8UUQ9&Uge;U>5lZUMcG-~=IjUv6g+cfg%+7u+p!PdFg#yqDyCBKI@P
z15xckk%ve=93?l4JVNr(DESz(JPuEYJW0z_@H9LF&xV9g-@<_BM4qSiLR5QE<fSNj
zS>zR3UWM1-^{C|ykvF60Ev9}O-Vu410q?>4QRfG=w8MuYA4Ro~Nqz#K!e{U~Y=tl2
zOZW=DhHqdSd<);f_wa+rkF4w`_!)kIU*R|S9sYnn;V<|b{s}Sk3#kv<&<5l{C&-1)
zkOy6$D|CbI&;xoxFX#<@pfB`;{xAUYVIT~G!7v1d!Y~*P1uz0e!YD9dG>n0<Fb>AU
z1egegPy~};G897z#9#_c)yx)Snr4O=rJCvC{Y4)+W2R2d+U_G~%+X1G0drwPh`yWu
z|JuuwZpyNqa@SF@q-r;fip(lEmT*)0Z)K*zQ>r6aROe>Bm`Y}Yo;tf(#gwoAmiu-~
z%+3VezG_xZ%=PMZurLfZZP`|1wba;7GMHrRvRd1*yw-S~>!qwrJY_YyUc6a(zU?|~
zIonrlC#r6&uFcv_$+$|piH6*q#{8w_HAyRD)mpxaXIj&$rb4-ui%Uz&!rfFSm7nnJ
zbVg6yzCbz4iz%Cw%_Yjum}MQ~&B8isr7}A@f?11Ay+Tv9SgCZAGSgWv?fS|$U8kwF
wsLD?Nx8%IaCd;YMTJ_2|a`j`X95<=r2{-FxHXHM*J(Y01WZbt`tG0rF0SY)=u>b%7

literal 2524
zcmZA1cX-rf9Ki8kN-4YST_Efh+5<}68*58jPf>AVJ<_}P+R(e?Ozt{xpn`kvt<<f!
zCvL?(aPM6=F5G*)mv0~AL;m^XH{Lhz`zB9B3=z3Sq(H=|66vL*GeruCdP5QPfxgfW
z`ojPi2!o&)2Ez~-3d3MHjDV3a3P!^i7z^WIJe0r$m<W@=gvl@krouFs4l`gTltLNI
zg4s|G6%c_rFc;=QCCmqXviZ~93^s=?U`yBvwuWtBTi6b^haF%?*a;TE&QJ}zKn>Kw
zLa2j!Xn<WI3cJDXun6|hU&tzvJ&E>$#jrQ*1N*{$us<9COW;6ggo7XkOTmIBh(jVE
zf25*Bl3~;=(n5<3%feb~@D3y;k`9xOh#N*3k%JlMfe%^8K^wF~2Xw-6I0O!b!{Bhe
z+#^L+XpRWhVpNNfKS90mqjYkm7_B;L7ehzJNi6qhI0lY|<KTEW0ZxRTaVHa<0;j@h
za5|g;OGVDo&(nu_Hk<?J!g+8$TmTosMQ|}(0+;Ho+|1OgMY>2{2A9JXa3x#?SHm@M
zEnEj{;Ci?LZiJgaZzI142tJKlS;TE{JKO<xirf_p2s+o2yj$cRX1O=4-6wKC$p^yZ
zgCY-+d^k+5W0ptYQIW@Jc^saAC*i4p;OS2@;2Du;sjUxd&xt%AMlXoGNXtv`GQ1MD
zyejfq7`@KaZ@`-(Z!zF)cqi<9mzMY7eUT5sS~tlL;UoAMK7mi+Gx!`fz!&f(d<9>_
zH?R@D75R>peGfmtkMI-x48Opy@EiONf54yc7yJ$X1Q-HZ{Su4<=mmw)8;YP0^o4%V
z9|pic7zD*I7>2-57zV>(1dN1HFdD|dSQrQ6p#&ztM3@97Ook~i6{f*-m;p1P6v|*0
z%!YEPfQV+E7;`jpgZCHy&x}f)oWIHcOrQAwukM<Jo3?DH#&uLAp}I|@Hrwt-;%-{s
z)@55frFw#eNjK+3R3ew}N!o2HqI`W@<J%n(JDczJRhx1muGhR~{l=)(5w)E}e(Z)N
zO}1lsow20rrLAl%Z7p-XSex>E+jY7MHm%xDSY6%Fl(SQbn98{EmcoL@;<Z)Lgq5|L
zEMLX4of#FaRc_s)%8Ke>6AcOF$2~if)f0CwP)=hxWs|bGSovAAx@WvunzUM#+0&7q
zwcOMzG*yR{&ZLx?$$1&qSH9^wsm`)`JM-U?i|SIA)10%Km2VX4$J9G+LdD{4&dIJb
Ssv0~McfCZ+x0kD~l79i1bWYg-

diff --git a/bin/tests/system/geoip2/ns2/named11.conf.j2 b/bin/tests/system/geoip2/ns2/named11.conf.j2
index b6d2a44624..e684c9a6ad 100644
--- a/bin/tests/system/geoip2/ns2/named11.conf.j2
+++ b/bin/tests/system/geoip2/ns2/named11.conf.j2
@@ -91,6 +91,14 @@ view seven {
 	};
 };
 
+view eight {
+	match-clients { geoip domain seven; }; # non-matching name (a substring of the previous entry), see GL#6019
+	zone "example" {
+		type primary;
+		file "example8.db";
+	};
+};
+
 view none {
 	match-clients { any; };
 	zone "example" {
diff --git a/bin/tests/system/geoip2/setup.sh b/bin/tests/system/geoip2/setup.sh
index f3acf988c5..20b64462da 100644
--- a/bin/tests/system/geoip2/setup.sh
+++ b/bin/tests/system/geoip2/setup.sh
@@ -13,7 +13,7 @@
 
 . ../conf.sh
 
-for i in 1 2 3 4 5 6 7 other bogus; do
+for i in 1 2 3 4 5 6 7 8 other bogus; do
   cp ns2/example.db.in ns2/example${i}.db
   echo "@ IN TXT \"$i\"" >>ns2/example$i.db
 done
diff --git a/bin/tests/system/geoip2/tests.sh b/bin/tests/system/geoip2/tests.sh
index a8e8845a41..b448694cf8 100644
--- a/bin/tests/system/geoip2/tests.sh
+++ b/bin/tests/system/geoip2/tests.sh
@@ -431,7 +431,7 @@ n=$((n + 1))
 echo_i "checking Domain database using IPv4 ($n)"
 ret=0
 lret=0
-for i in 1 2 3 4 5 6 7; do
+for i in 1 2 3 4 5 6 7 8; do
   $DIG $DIGOPTS txt example -b 10.53.0.$i >dig.out.ns2.test$n.$i || lret=1
   j=$(cat dig.out.ns2.test$n.$i | tr -d '"')
   [ "$i" = "$j" ] || lret=1
@@ -446,7 +446,7 @@ if testsock6 fd92:7065:b8e:ffff::3; then
   echo_i "checking Domain database using IPv6 ($n)"
   ret=0
   lret=0
-  for i in 1 2 3 4 5 6 7; do
+  for i in 1 2 3 4 5 6 7 8; do
     $DIG $DIGOPTS6 txt example -b fd92:7065:b8e:ffff::$i >dig.out.ns2.test$n.$i || lret=1
     j=$(cat dig.out.ns2.test$n.$i | tr -d '"')
     [ "$i" = "$j" ] || lret=1