path: root/bin/tests/system/rrl/tests.sh

#!/bin/sh

# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
#
# SPDX-License-Identifier: MPL-2.0
#
# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0.  If a copy of the MPL was not distributed with this
# file, you can obtain one at https://mozilla.org/MPL/2.0/.
#
# See the COPYRIGHT file distributed with this work for additional
# information regarding copyright ownership.

# test response rate limiting

SYSTEMTESTTOP=..
. $SYSTEMTESTTOP/conf.sh

RNDCCMD="$RNDC -c $SYSTEMTESTTOP/common/rndc.conf -p ${CONTROLPORT} -s"

#set -x

ns1=10.53.0.1 # root, defining the others
ns2=10.53.0.2 # test server
ns3=10.53.0.3 # secondary test server
ns4=10.53.0.4 # log-only test server
ns7=10.53.0.7 # whitelisted client

USAGE="$0: [-x]"
while getopts "x" c; do
  case $c in
    x) set -x ;;
    *)
      echo "$USAGE" 1>&2
      exit 1
      ;;
  esac
done
shift $(expr $OPTIND - 1 || true)
if test "$#" -ne 0; then
  echo "$USAGE" 1>&2
  exit 1
fi
# really quit on control-C
trap 'exit 1' 1 2 15

ret=0
setret() {
  ret=1
  echo_i "$*"
}

# Wait until soon after the start of a second to make results consistent.
#   The start of a second credits a rate limit.
#   This would be far easier in C or by assuming a modern version of perl.
sec_start() {
  START=$(date)
  while true; do
    NOW=$(date)
    if test "$START" != "$NOW"; then
      return
    fi
    $PERL -e 'select(undef, undef, undef, 0.05)' || true
  done
}

# turn off ${HOME}/.digrc
HOME=/dev/null
export HOME

#   $1=number of tests  $2=target domain  $3=dig options
QNUM=1
burst() {
  BURST_LIMIT=$1
  shift
  BURST_DOM_BASE="$1"
  shift

  XCNT=$CNT
  CNT='XXX'
  eval FILENAME="mdig.out-$BURST_DOM_BASE"
  CNT=$XCNT

  DOMS=""
  CNTS=$($PERL -e 'for ( $i = 0; $i < '$BURST_LIMIT'; $i++) { printf "%03d\n", '$QNUM' + $i; }')
  for CNT in $CNTS; do
    eval BURST_DOM="$BURST_DOM_BASE"
    DOMS="$DOMS $BURST_DOM"
  done
  ARGS="+burst +nocookie +continue +time=1 +tries=1 -p ${PORT} $* @$ns2 $DOMS"
  $MDIG $ARGS 2>&1 \
    | tr -d '\r' \
    | tee -a full-$FILENAME \
    | sed -n -e '/^;; AUTHORITY/,/^$/d' \
      -e '/^;; ADDITIONAL/,/^$/d' \
      -e 's/^[^;].*	\([^	 ]\{1,\}\)$/\1/p' \
      -e 's/;; flags.* tc .*/TC/p' \
      -e 's/;; .* status: NXDOMAIN.*/NXDOMAIN/p' \
      -e 's/;; .* status: NOERROR.*/NOERROR/p' \
      -e 's/;; .* status: SERVFAIL.*/SERVFAIL/p' \
      -e 's/response failed with timed out.*/drop/p' \
      -e 's/;; communications error to.*/drop/p' >>$FILENAME &
  QNUM=$(expr $QNUM + $BURST_LIMIT)
}

# compare integers $1 and $2; ensure the difference is no more than $3
range() {
  $PERL -e 'if (abs(int($ARGV[0]) - int($ARGV[1])) > int($ARGV[2])) { exit(1) }' $1 $2 $3
}

#   $1=domain  $2=IP address  $3=# of IP addresses  $4=TC  $5=drop
#	$6=NXDOMAIN  $7=SERVFAIL or other errors
ck_result() {
  # wait to the background mdig calls to complete.
  wait
  BAD=no
  ADDRS=$(grep -E "^$2$" mdig.out-$1 2>/dev/null | wc -l)
  # count simple truncated and truncated NXDOMAIN as TC
  TC=$(grep -E "^TC|NXDOMAINTC$" mdig.out-$1 2>/dev/null | wc -l)
  DROP=$(grep -E "^drop$" mdig.out-$1 2>/dev/null | wc -l)
  # count NXDOMAIN and truncated NXDOMAIN as NXDOMAIN
  NXDOMAIN=$(grep -E "^NXDOMAIN|NXDOMAINTC$" mdig.out-$1 2>/dev/null | wc -l)
  SERVFAIL=$(grep -E "^SERVFAIL$" mdig.out-$1 2>/dev/null | wc -l)
  NOERROR=$(grep -E "^NOERROR$" mdig.out-$1 2>/dev/null | wc -l)

  range $ADDRS "$3" 1 \
    || setret "$ADDRS instead of $3 '$2' responses for $1" \
    && BAD=yes

  range $TC "$4" 1 \
    || setret "$TC instead of $4 truncation responses for $1" \
    && BAD=yes

  range $DROP "$5" 1 \
    || setret "$DROP instead of $5 dropped responses for $1" \
    && BAD=yes

  range $NXDOMAIN "$6" 1 \
    || setret "$NXDOMAIN instead of $6 NXDOMAIN responses for $1" \
    && BAD=yes

  range $SERVFAIL "$7" 1 \
    || setret "$SERVFAIL instead of $7 error responses for $1" \
    && BAD=yes

  range $NOERROR "$8" 1 \
    || setret "$NOERROR instead of $8 NOERROR responses for $1" \
    && BAD=yes

  if test -z "$BAD"; then
    rm -f mdig.out-$1
  fi
}

ckstats() {
  LABEL="$1"
  shift
  TYPE="$1"
  shift
  EXPECTED="$1"
  shift
  C=$(tr -d '\r' <ns2/named.stats \
    | sed -n -e "s/[	 ]*\([0-9]*\).responses $TYPE for rate limits.*/\1/p" \
    | tail -1)
  C=$(expr 0$C + 0)

  range "$C" $EXPECTED 1 \
    || setret "wrong $LABEL $TYPE statistics of $C instead of $EXPECTED"
}

#########
sec_start

# Tests of referrals to "." must be done before the hints are loaded
#   or with "additional-from-cache no"
burst 5 a1.tld3 +norec
# basic rate limiting
burst 3 a1.tld2
# delay allows an additional response.
sleep 1
burst 10 a1.tld2
# Request 30 different qnames to try a wildcard.
burst 30 'y.x$CNT.a2.tld2'

#					IP      TC      drop  NXDOMAIN SERVFAIL NOERROR
# referrals to "."
ck_result a1.tld3 x 0 1 2 0 0 2
# check 13 results including 1 second delay that allows an additional response
ck_result a1.tld2 192.0.2.1 3 4 6 0 0 8

# Check the wildcard answers.
# The zone origin name of the 30 requests is counted.
ck_result 'y.x*.a2.tld2' 192.0.2.2 2 10 18 0 0 12

#########
sec_start

burst 10 'x.a3.tld3'
burst 10 'y$CNT.a3.tld3'
burst 10 'z$CNT.a4.tld2'

# 10 identical recursive responses are limited
ck_result 'x.a3.tld3' 192.0.3.3 2 3 5 0 0 5

# 10 different recursive responses are not limited
ck_result 'y*.a3.tld3' 192.0.3.3 10 0 0 0 0 10

# 10 different NXDOMAIN responses are limited based on the parent name.
#   We count 13 responses because we count truncated NXDOMAIN responses
#   as both truncated and NXDOMAIN.
ck_result 'z*.a4.tld2' x 0 3 5 5 0 0

$RNDCCMD $ns2 stats
ckstats first dropped 36
ckstats first truncated 21

#########
sec_start

burst 10 a5.tld2 +tcp
burst 10 a6.tld2 -b $ns7
burst 10 a7.tld4
burst 2 a8.tld2 -t AAAA
burst 2 a8.tld2 -t TXT
burst 2 a8.tld2 -t SPF

#					IP      TC      drop  NXDOMAIN SERVFAIL NOERROR
# TCP responses are not rate limited
ck_result a5.tld2 192.0.2.5 10 0 0 0 0 10

# whitelisted client is not rate limited
ck_result a6.tld2 192.0.2.6 10 0 0 0 0 10

# Errors such as SERVFAIL are rate limited.
ck_result a7.tld4 x 0 0 8 0 2 0

# NODATA responses are counted as the same regardless of qtype.
ck_result a8.tld2 x 0 2 2 0 0 4

$RNDCCMD $ns2 stats
ckstats second dropped 46
ckstats second truncated 23

#########
sec_start

#					IP      TC      drop  NXDOMAIN SERVFAIL NOERROR
# all-per-second
#   The qnames are all unique but the client IP address is constant.
QNUM=101
burst 60 'all$CNT.a9.tld2'

ck_result 'a*.a9.tld2' 192.0.2.8 50 0 10 0 0 50

$RNDCCMD $ns2 stats
ckstats final dropped 56
ckstats final truncated 23

#########
sec_start

DIGOPTS="+nocookie +nosearch +time=1 +tries=1 +ignore -p ${PORT}"
$DIG $DIGOPTS @$ns4 A a7.tld4 >/dev/null 2>&1
$DIG $DIGOPTS @$ns4 A a7.tld4 >/dev/null 2>&1
$DIG $DIGOPTS @$ns4 A a7.tld4 >/dev/null 2>&1
$DIG $DIGOPTS @$ns4 A a7.tld4 >/dev/null 2>&1
$DIG $DIGOPTS @$ns4 A a7.tld4 >/dev/null 2>&1
$DIG $DIGOPTS @$ns4 A a7.tld4 >/dev/null 2>&1
$DIG $DIGOPTS @$ns4 A a7.tld4 >/dev/null 2>&1
$DIG $DIGOPTS @$ns4 A a7.tld4 >/dev/null 2>&1
$DIG $DIGOPTS @$ns4 A a7.tld4 >/dev/null 2>&1
$DIG $DIGOPTS @$ns4 A a7.tld4 >/dev/null 2>&1
$DIG $DIGOPTS @$ns4 A a7.tld4 >/dev/null 2>&1

# regression test for GL #2839
DIGOPTS="+bufsize=4096 +ignore -p ${PORT}"
$DIG $DIGOPTS @$ns4 TXT big.tld4 >/dev/null 2>&1

grep "would limit" ns4/named.run >/dev/null 2>&1 \
  || setret "\"would limit\" not found in log file."

$NAMED -D rrl-ns5 -gc broken.conf >broken.out 2>&1 &
sleep 2
grep "min-table-size 1" broken.out >/dev/null || setret "min-table-size 0 was not changed to 1"

if [ -f named.pid ]; then
  $KILL $(cat named.pid)
  setret "named should not have started, but did"
fi

echo_i "exit status: $ret"
[ $ret -eq 0 ] || exit 1