diff options
| author | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-27 07:24:22 +0000 |
|---|---|---|
| committer | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-27 07:24:22 +0000 |
| commit | 45d6379135504814ab723b57f0eb8be23393a51d (patch) | |
| tree | d4f2ec4acca824a8446387a758b0ce4238a4dffa /bin/tests/system/rpzrecurse | |
| parent | Initial commit. (diff) | |
| download | bind9-564253c724404fc788d27ab128f285c1070fe23c.tar.xz bind9-564253c724404fc788d27ab128f285c1070fe23c.zip | |
Adding upstream version 1:9.16.44.upstream/1%9.16.44upstream
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to '')
47 files changed, 2385 insertions, 0 deletions
diff --git a/bin/tests/system/rpzrecurse/README b/bin/tests/system/rpzrecurse/README new file mode 100644 index 0000000..5936e05 --- /dev/null +++ b/bin/tests/system/rpzrecurse/README @@ -0,0 +1,124 @@ +Copyright (C) Internet Systems Consortium, Inc. ("ISC") + +SPDX-License-Identifier: MPL-2.0 + +This Source Code Form is subject to the terms of the Mozilla Public +License, v. 2.0. If a copy of the MPL was not distributed with this +file, you can obtain one at https://mozilla.org/MPL/2.0/. + +See the COPYRIGHT file distributed with this work for additional +information regarding copyright ownership. + +These tests check RPZ recursion behavior (including skipping +recursion when appropriate). + +The general structure of the tests is: + +* The resolver (ns2) with an unqualified view containing the policy + zones, the response-policy statement, and a root hint zone + +* The auth server that contains two authoritative zones, l1.l0 and + l2.l1.l0, both delegated to itself. l2.l1.l0 specifies a non-existent + zone data file and so will generate SERVFAILs for any queries to it. + +The l2.l1.l0 zone was chosen to generate SERVFAIL responses because RPZ +evaluation will use that error response whenever it encounters it during +processing, thus making it a binary indicator for whether or not +recursion was attempted. This also allows us to not worry about having +to craft 'ip', 'nsdname', and 'nsip' rules that matched the queries. + +Each test is intended to be fed a number of queries constructed as +qXX.l2.l1.l0, where XX is the 1-based query sequence number (e.g. the +first query of each test is q01.l2.l1.l0). + +For all the tests the triggers are constructed as follows: +client-ip - match 127.0.0.1/32 +ip - match 255.255.255.255/32 (does not matter due to SERVFAIL) +nsdname - match ns.example.org (also does not matter) +nsip - match 255.255.255.255/32 (also does not matter) +qname - match qXX.l2.l1.l0, where XX is the query sequence number that +is intended to be matched by this qname rule. + +Here's the detail on the test cases: + +Group 1 - testing skipping recursion for a single policy zone with only +records that allow recursion to be skipped + +Test 1a: + 1 policy zone containing 1 'client-ip' trigger + 1 query, expected to skip recursion + +Test 1b: + 1 policy zone containing 1 'qname' trigger (q01) + 2 queries, q01 is expected to skip recursion, q02 is expected to + recurse + +Test 1c: + 1 policy zone containing both a 'client-ip' and 'qname' trigger (q02) + 1 query, expected to skip recursion + +Group 2 - testing skipping recursion with multiple policy zones when all +zones have only trigger types eligible to skip recursion with + +Test 2a: + 32 policy zones, each containing 1 'qname' trigger (qNN, where NN is + the zone's sequence 1-based sequence number formatted to 2 digits, + so each of the first 32 queries should match a different zone) + 33 queries, the first 32 of which are expected to skip recursion + while the 33rd is expected to recurse + +Group 3 - Testing interaction of triggers that require recursion when in +a single zone, both alone and with triggers that allow recursion to be +skipped + +Test 3a: + 1 policy zone containing 1 'ip' trigger + 1 query, expected to recurse + +Test 3b: + 1 policy zone containing 1 'nsdname' trigger + 1 query, expected to recurse + +Test 3c: + 1 policy zone containing 1 'nsip' trigger + 1 query, expected to recurse + +Test 3d: + 1 policy zone containing 1 'ip' trigger and 1 'qname' trigger (q02) + 2 queries, the first should not recurse and the second should recurse + +Test 3e: + 1 policy zone containing 1 'nsdname' trigger and 1 'qname' trigger + (q02) + 2 queries, the first should not recurse and the second should recurse + +Test 3f: + 1 policy zone containing 1 'nsip' trigger and 1 'qname' trigger (q02) + 2 queries, the first should not recurse and the second should recurse + +Group 4 - contains 32 subtests designed to verify that recursion is +skippable for only the appropriate zones based on the order specified in +the 'response-policy' statement + +Tests 4aa to 4bf: + 32 policy zones per test, one of which is configured with 1 'ip' + trigger and one 'qname' trigger while the others are configured + only with 1 'qname' trigger. The zone with both triggers starts + listed first and is moved backwards by one position with each + test. The 'qname' triggers in the zones are structured so that + the zones are tested starting with the first zone and the 'ip' + trigger is tested before the 'qname' trigger for that zone. + 33 queries per test, where the number expected to skip recursion + matches the test sequence number: e.g. 1 skip for 4aa, 26 skips + for 4az, and 32 skips for 4bf + +Group 5 - This test verifies that the "pivot" policy zone for whether or +not recursion can be skipped is the first listed zone with applicable +trigger types rather than a later listed zone. + +Test 5a: + 5 policy zones, the 1st, 3rd, and 5th configured with 1 'qname' + trigger each (q01, q04, and q06, respectively), the 2nd and 4th + each configured with an 'ip' and 'qname' trigger (q02 and q05, + respectively for the 'qname' triggers + 6 queries, of which only q01 and q02 are expected to skip recursion diff --git a/bin/tests/system/rpzrecurse/ans5/ans.pl b/bin/tests/system/rpzrecurse/ans5/ans.pl new file mode 100644 index 0000000..9c5efb3 --- /dev/null +++ b/bin/tests/system/rpzrecurse/ans5/ans.pl @@ -0,0 +1,81 @@ +#!/usr/bin/perl -w + +# Copyright (C) Internet Systems Consortium, Inc. ("ISC") +# +# SPDX-License-Identifier: MPL-2.0 +# +# This Source Code Form is subject to the terms of the Mozilla Public +# License, v. 2.0. If a copy of the MPL was not distributed with this +# file, you can obtain one at https://mozilla.org/MPL/2.0/. +# +# See the COPYRIGHT file distributed with this work for additional +# information regarding copyright ownership. + +use IO::File; +use IO::Socket; +use Net::DNS; +use Net::DNS::Packet; + +my $localport = int($ENV{'PORT'}); +if (!$localport) { $localport = 5300; } + +my $sock = IO::Socket::INET->new(LocalAddr => "10.53.0.5", + LocalPort => $localport, Proto => "udp") or die "$!"; + +my $pidf = new IO::File "ans.pid", "w" or die "cannot open pid file: $!"; +print $pidf "$$\n" or die "cannot write pid file: $!"; +$pidf->close or die "cannot close pid file: $!"; +sub rmpid { unlink "ans.pid"; exit 1; }; + +$SIG{INT} = \&rmpid; +$SIG{TERM} = \&rmpid; + +for (;;) { + $sock->recv($buf, 512); + + print "**** request from " , $sock->peerhost, " port ", $sock->peerport, "\n"; + + my $packet; + + if ($Net::DNS::VERSION > 0.68) { + $packet = new Net::DNS::Packet(\$buf, 0); + $@ and die $@; + } else { + my $err; + ($packet, $err) = new Net::DNS::Packet(\$buf, 0); + $err and die $err; + } + + print "REQUEST:\n"; + $packet->print; + + $packet->header->qr(1); + + my @questions = $packet->question; + my $qname = $questions[0]->qname; + my $qtype = $questions[0]->qtype; + + my $donotrespond = 0; + + $packet->header->aa(1); + if ($qtype eq "A") { + $packet->push("answer", + new Net::DNS::RR($qname . + " 300 A 10.53.0.5")); + #} elsif ($qtype eq "AAAA") { + #$packet->push("answer", + #new Net::DNS::RR($qname . + #" 300 AAAA 2001:db8:beef::1")); + } elsif ($qtype eq "NS") { + $donotrespond = 1; + } + + if ($donotrespond == 0) { + $sock->send($packet->data); + print "RESPONSE:\n"; + $packet->print; + print "\n"; + } else { + print "DROP:\n"; + } +} diff --git a/bin/tests/system/rpzrecurse/clean.sh b/bin/tests/system/rpzrecurse/clean.sh new file mode 100644 index 0000000..7b1a8a9 --- /dev/null +++ b/bin/tests/system/rpzrecurse/clean.sh @@ -0,0 +1,34 @@ +#!/bin/sh + +# Copyright (C) Internet Systems Consortium, Inc. ("ISC") +# +# SPDX-License-Identifier: MPL-2.0 +# +# This Source Code Form is subject to the terms of the Mozilla Public +# License, v. 2.0. If a copy of the MPL was not distributed with this +# file, you can obtain one at https://mozilla.org/MPL/2.0/. +# +# See the COPYRIGHT file distributed with this work for additional +# information regarding copyright ownership. + +# Clean up after rpz tests. + +rm -f dig.out.* + +rm -f ns*/named.lock +rm -f ns*/named.memstats +rm -f ns*/*.run +rm -f ns*/*core *core +rm -f ns*/named.conf + +rm -f ns2/*.local +rm -f ns2/*.queries +rm -f ns2/named.[0-9]*.conf +rm -f ns2/named.conf.header + +rm -f ns3/named2.conf +rm -f ns3/named.run.prev + +rm -f dnsrps*.conf dnsrpzd* +rm -f ns*/session.key +rm -f ns*/managed-keys.bind* ns*/*.mkeys* diff --git a/bin/tests/system/rpzrecurse/ns1/db.l0 b/bin/tests/system/rpzrecurse/ns1/db.l0 new file mode 100644 index 0000000..e6077fc --- /dev/null +++ b/bin/tests/system/rpzrecurse/ns1/db.l0 @@ -0,0 +1,17 @@ +; Copyright (C) Internet Systems Consortium, Inc. ("ISC") +; +; SPDX-License-Identifier: MPL-2.0 +; +; This Source Code Form is subject to the terms of the Mozilla Public +; License, v. 2.0. If a copy of the MPL was not distributed with this +; file, you can obtain one at https://mozilla.org/MPL/2.0/. +; +; See the COPYRIGHT file distributed with this work for additional +; information regarding copyright ownership. + +$TTL 60 +@ IN SOA root.ns ns 1996072700 3600 1800 86400 60 + NS ns +ns A 10.53.0.1 +l1 NS ns.l1 +ns.l1 A 10.53.0.1 diff --git a/bin/tests/system/rpzrecurse/ns1/db.l1.l0 b/bin/tests/system/rpzrecurse/ns1/db.l1.l0 new file mode 100644 index 0000000..f51d5f7 --- /dev/null +++ b/bin/tests/system/rpzrecurse/ns1/db.l1.l0 @@ -0,0 +1,17 @@ +; Copyright (C) Internet Systems Consortium, Inc. ("ISC") +; +; SPDX-License-Identifier: MPL-2.0 +; +; This Source Code Form is subject to the terms of the Mozilla Public +; License, v. 2.0. If a copy of the MPL was not distributed with this +; file, you can obtain one at https://mozilla.org/MPL/2.0/. +; +; See the COPYRIGHT file distributed with this work for additional +; information regarding copyright ownership. + +$TTL 60 +@ IN SOA root.ns ns 1996072700 3600 1800 86400 60 + NS ns +ns A 10.53.0.1 +l2 NS ns.l2 +ns.l2 A 10.53.0.1 diff --git a/bin/tests/system/rpzrecurse/ns1/example.com.db b/bin/tests/system/rpzrecurse/ns1/example.com.db new file mode 100644 index 0000000..3bd11ec --- /dev/null +++ b/bin/tests/system/rpzrecurse/ns1/example.com.db @@ -0,0 +1,18 @@ +; Copyright (C) Internet Systems Consortium, Inc. ("ISC") +; +; SPDX-License-Identifier: MPL-2.0 +; +; This Source Code Form is subject to the terms of the Mozilla Public +; License, v. 2.0. If a copy of the MPL was not distributed with this +; file, you can obtain one at https://mozilla.org/MPL/2.0/. +; +; See the COPYRIGHT file distributed with this work for additional +; information regarding copyright ownership. + +$TTL 3600 +@ IN SOA ns.example.com. root.example.com. 1 3600 3600 3600 3600 +@ NS ns.example.com. + +ns.example.com. A 10.53.0.1 +@ A 1.2.3.4 +www A 1.2.3.5 diff --git a/bin/tests/system/rpzrecurse/ns1/example.db b/bin/tests/system/rpzrecurse/ns1/example.db new file mode 100644 index 0000000..0e71776 --- /dev/null +++ b/bin/tests/system/rpzrecurse/ns1/example.db @@ -0,0 +1,16 @@ +; Copyright (C) Internet Systems Consortium, Inc. ("ISC") +; +; SPDX-License-Identifier: MPL-2.0 +; +; This Source Code Form is subject to the terms of the Mozilla Public +; License, v. 2.0. If a copy of the MPL was not distributed with this +; file, you can obtain one at https://mozilla.org/MPL/2.0/. +; +; See the COPYRIGHT file distributed with this work for additional +; information regarding copyright ownership. + +$TTL 3600 +@ IN SOA root.example. example. 1 3600 3600 3600 3600 +@ IN NS ns.example. +www IN CNAME cname +cname IN A 10.53.0.1 diff --git a/bin/tests/system/rpzrecurse/ns1/named.conf.in b/bin/tests/system/rpzrecurse/ns1/named.conf.in new file mode 100644 index 0000000..f1e4c5c --- /dev/null +++ b/bin/tests/system/rpzrecurse/ns1/named.conf.in @@ -0,0 +1,75 @@ +/* + * Copyright (C) Internet Systems Consortium, Inc. ("ISC") + * + * SPDX-License-Identifier: MPL-2.0 + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, you can obtain one at https://mozilla.org/MPL/2.0/. + * + * See the COPYRIGHT file distributed with this work for additional + * information regarding copyright ownership. + */ + +options { + query-source address 10.53.0.1; + notify-source 10.53.0.1; + transfer-source 10.53.0.1; + port @PORT@; + session-keyfile "session.key"; + pid-file "named.pid"; + listen-on { 10.53.0.1; }; + listen-on-v6 { none; }; + recursion no; + dnssec-validation no; + querylog yes; +}; + +key rndc_key { + secret "1234abcd8765"; + algorithm hmac-sha256; +}; + +controls { + inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { rndc_key; }; +}; + +zone "." { + type master; + file "root.db"; +}; + +zone "test.example.org" { + type master; + file "example.db"; +}; + +zone "l0" { + type master; + file "db.l0"; +}; + +zone "l1.l0" { + type master; + file "db.l1.l0"; +}; + +zone "l2.l1.l0" { + type master; + file "does-not-exist"; +}; + +zone "test1.example.net" { + type master; + file "test1.example.net.db"; +}; + +zone "test2.example.net" { + type master; + file "test2.example.net.db"; +}; + +zone "example.com" { + type master; + file "example.com.db"; +}; diff --git a/bin/tests/system/rpzrecurse/ns1/root.db b/bin/tests/system/rpzrecurse/ns1/root.db new file mode 100644 index 0000000..51be203 --- /dev/null +++ b/bin/tests/system/rpzrecurse/ns1/root.db @@ -0,0 +1,24 @@ +; Copyright (C) Internet Systems Consortium, Inc. ("ISC") +; +; SPDX-License-Identifier: MPL-2.0 +; +; This Source Code Form is subject to the terms of the Mozilla Public +; License, v. 2.0. If a copy of the MPL was not distributed with this +; file, you can obtain one at https://mozilla.org/MPL/2.0/. +; +; See the COPYRIGHT file distributed with this work for additional +; information regarding copyright ownership. + +$TTL 300 +@ IN SOA muks.isc.org. a.root.servers.nil. ( + 2010 ; serial + 600 ; refresh + 600 ; retry + 1200 ; expire + 600 ; minimum + ) +@ NS ns.example. +ns.example. A 10.53.0.1 + +l0. NS ns.l0. +ns.l0. A 10.53.0.1 diff --git a/bin/tests/system/rpzrecurse/ns1/test1.example.net.db b/bin/tests/system/rpzrecurse/ns1/test1.example.net.db new file mode 100644 index 0000000..66ca007 --- /dev/null +++ b/bin/tests/system/rpzrecurse/ns1/test1.example.net.db @@ -0,0 +1,17 @@ +; Copyright (C) Internet Systems Consortium, Inc. ("ISC") +; +; SPDX-License-Identifier: MPL-2.0 +; +; This Source Code Form is subject to the terms of the Mozilla Public +; License, v. 2.0. If a copy of the MPL was not distributed with this +; file, you can obtain one at https://mozilla.org/MPL/2.0/. +; +; See the COPYRIGHT file distributed with this work for additional +; information regarding copyright ownership. + +$TTL 3600 +@ IN SOA root.example. example. 1 3600 3600 3600 3600 +@ NS ns.example. +ns.example. A 10.53.0.1 +test1.example.net. A 1.2.3.4 +www.test1.example.net. A 5.6.7.8 diff --git a/bin/tests/system/rpzrecurse/ns1/test2.example.net.db b/bin/tests/system/rpzrecurse/ns1/test2.example.net.db new file mode 100644 index 0000000..57db115 --- /dev/null +++ b/bin/tests/system/rpzrecurse/ns1/test2.example.net.db @@ -0,0 +1,17 @@ +; Copyright (C) Internet Systems Consortium, Inc. ("ISC") +; +; SPDX-License-Identifier: MPL-2.0 +; +; This Source Code Form is subject to the terms of the Mozilla Public +; License, v. 2.0. If a copy of the MPL was not distributed with this +; file, you can obtain one at https://mozilla.org/MPL/2.0/. +; +; See the COPYRIGHT file distributed with this work for additional +; information regarding copyright ownership. + +$TTL 3600 +@ IN SOA root.example. example. 1 3600 3600 3600 3600 +@ NS ns.example. +ns.example. A 10.53.0.1 +test2.example.net. A 8.7.6.5 +www.test2.example.net. A 4.3.2.1 diff --git a/bin/tests/system/rpzrecurse/ns2/db.clientip1 b/bin/tests/system/rpzrecurse/ns2/db.clientip1 new file mode 100644 index 0000000..f0d53d2 --- /dev/null +++ b/bin/tests/system/rpzrecurse/ns2/db.clientip1 @@ -0,0 +1,17 @@ +; Copyright (C) Internet Systems Consortium, Inc. ("ISC") +; +; SPDX-License-Identifier: MPL-2.0 +; +; This Source Code Form is subject to the terms of the Mozilla Public +; License, v. 2.0. If a copy of the MPL was not distributed with this +; file, you can obtain one at https://mozilla.org/MPL/2.0/. +; +; See the COPYRIGHT file distributed with this work for additional +; information regarding copyright ownership. + +$TTL 60 +@ IN SOA root.ns ns 1996072700 3600 1800 86400 60 + NS ns +ns A 127.0.0.1 +32.4.0.53.10.rpz-client-ip A 10.53.0.2 +24.0.0.53.10.rpz-client-ip A 10.53.0.1 diff --git a/bin/tests/system/rpzrecurse/ns2/db.clientip2 b/bin/tests/system/rpzrecurse/ns2/db.clientip2 new file mode 100644 index 0000000..dfcc341 --- /dev/null +++ b/bin/tests/system/rpzrecurse/ns2/db.clientip2 @@ -0,0 +1,16 @@ +; Copyright (C) Internet Systems Consortium, Inc. ("ISC") +; +; SPDX-License-Identifier: MPL-2.0 +; +; This Source Code Form is subject to the terms of the Mozilla Public +; License, v. 2.0. If a copy of the MPL was not distributed with this +; file, you can obtain one at https://mozilla.org/MPL/2.0/. +; +; See the COPYRIGHT file distributed with this work for additional +; information regarding copyright ownership. + +$TTL 60 +@ IN SOA root.ns ns 1996072700 3600 1800 86400 60 + NS ns +ns A 127.0.0.1 +24.0.0.53.10.rpz-client-ip A 10.53.0.3 diff --git a/bin/tests/system/rpzrecurse/ns2/db.clientip21 b/bin/tests/system/rpzrecurse/ns2/db.clientip21 new file mode 100644 index 0000000..4ce2af1 --- /dev/null +++ b/bin/tests/system/rpzrecurse/ns2/db.clientip21 @@ -0,0 +1,17 @@ +; Copyright (C) Internet Systems Consortium, Inc. ("ISC") +; +; SPDX-License-Identifier: MPL-2.0 +; +; This Source Code Form is subject to the terms of the Mozilla Public +; License, v. 2.0. If a copy of the MPL was not distributed with this +; file, you can obtain one at https://mozilla.org/MPL/2.0/. +; +; See the COPYRIGHT file distributed with this work for additional +; information regarding copyright ownership. + +$TTL 60 +@ IN SOA root.ns ns 1996072700 3600 1800 86400 60 + NS ns +ns A 127.0.0.1 +32.3.0.53.10.rpz-client-ip A 10.53.0.1 +31.2.0.53.10.rpz-client-ip CNAME . diff --git a/bin/tests/system/rpzrecurse/ns2/db.given b/bin/tests/system/rpzrecurse/ns2/db.given new file mode 100644 index 0000000..d464a53 --- /dev/null +++ b/bin/tests/system/rpzrecurse/ns2/db.given @@ -0,0 +1,21 @@ +; Copyright (C) Internet Systems Consortium, Inc. ("ISC") +; +; SPDX-License-Identifier: MPL-2.0 +; +; This Source Code Form is subject to the terms of the Mozilla Public +; License, v. 2.0. If a copy of the MPL was not distributed with this +; file, you can obtain one at https://mozilla.org/MPL/2.0/. +; +; See the COPYRIGHT file distributed with this work for additional +; information regarding copyright ownership. + +$ORIGIN given.zone. +$TTL 3600 +@ IN SOA ns.given.zone. hostmaster.given.zone. 1 600 300 604800 3600 + IN NS ns.given.zone. + +ns.given.zone. IN A 127.0.0.1 +; this should be ignored as it matches an earlier passthru entry. +example.com CNAME . +; this should be ignored as it matches an earlier wildcard passthru entry. +www.example.com CNAME . diff --git a/bin/tests/system/rpzrecurse/ns2/db.invalidprefixlength b/bin/tests/system/rpzrecurse/ns2/db.invalidprefixlength new file mode 100644 index 0000000..f496670 --- /dev/null +++ b/bin/tests/system/rpzrecurse/ns2/db.invalidprefixlength @@ -0,0 +1,16 @@ +; Copyright (C) Internet Systems Consortium, Inc. ("ISC") +; +; SPDX-License-Identifier: MPL-2.0 +; +; This Source Code Form is subject to the terms of the Mozilla Public +; License, v. 2.0. If a copy of the MPL was not distributed with this +; file, you can obtain one at https://mozilla.org/MPL/2.0/. +; +; See the COPYRIGHT file distributed with this work for additional +; information regarding copyright ownership. + +$TTL 60 +@ IN SOA root.ns ns 1996072700 3600 1800 86400 60 + NS ns +ns A 127.0.0.1 +1000.4.0.53.10.rpz-client-ip A 10.53.0.1 diff --git a/bin/tests/system/rpzrecurse/ns2/db.log1 b/bin/tests/system/rpzrecurse/ns2/db.log1 new file mode 100644 index 0000000..495885b --- /dev/null +++ b/bin/tests/system/rpzrecurse/ns2/db.log1 @@ -0,0 +1,16 @@ +; Copyright (C) Internet Systems Consortium, Inc. ("ISC") +; +; SPDX-License-Identifier: MPL-2.0 +; +; This Source Code Form is subject to the terms of the Mozilla Public +; License, v. 2.0. If a copy of the MPL was not distributed with this +; file, you can obtain one at https://mozilla.org/MPL/2.0/. +; +; See the COPYRIGHT file distributed with this work for additional +; information regarding copyright ownership. + +$TTL 60 +@ IN SOA root.ns ns 1996072700 3600 1800 86400 60 + NS ns +ns A 127.0.0.1 +32.4.0.53.10.rpz-client-ip A 10.53.0.4 diff --git a/bin/tests/system/rpzrecurse/ns2/db.log2 b/bin/tests/system/rpzrecurse/ns2/db.log2 new file mode 100644 index 0000000..91ff8c5 --- /dev/null +++ b/bin/tests/system/rpzrecurse/ns2/db.log2 @@ -0,0 +1,17 @@ +; Copyright (C) Internet Systems Consortium, Inc. ("ISC") +; +; SPDX-License-Identifier: MPL-2.0 +; +; This Source Code Form is subject to the terms of the Mozilla Public +; License, v. 2.0. If a copy of the MPL was not distributed with this +; file, you can obtain one at https://mozilla.org/MPL/2.0/. +; +; See the COPYRIGHT file distributed with this work for additional +; information regarding copyright ownership. + +$TTL 60 +@ IN SOA root.ns ns 1996072700 3600 1800 86400 60 + NS ns +ns A 127.0.0.1 +32.4.0.53.10.rpz-client-ip A 10.53.0.4 +32.3.0.53.10.rpz-client-ip A 10.53.0.3 diff --git a/bin/tests/system/rpzrecurse/ns2/db.log3 b/bin/tests/system/rpzrecurse/ns2/db.log3 new file mode 100644 index 0000000..65ed980 --- /dev/null +++ b/bin/tests/system/rpzrecurse/ns2/db.log3 @@ -0,0 +1,18 @@ +; Copyright (C) Internet Systems Consortium, Inc. ("ISC") +; +; SPDX-License-Identifier: MPL-2.0 +; +; This Source Code Form is subject to the terms of the Mozilla Public +; License, v. 2.0. If a copy of the MPL was not distributed with this +; file, you can obtain one at https://mozilla.org/MPL/2.0/. +; +; See the COPYRIGHT file distributed with this work for additional +; information regarding copyright ownership. + +$TTL 60 +@ IN SOA root.ns ns 1996072700 3600 1800 86400 60 + NS ns +ns A 127.0.0.1 +32.4.0.53.10.rpz-client-ip A 10.53.0.4 +32.3.0.53.10.rpz-client-ip A 10.53.0.3 +32.2.0.53.10.rpz-client-ip A 10.53.0.2 diff --git a/bin/tests/system/rpzrecurse/ns2/db.passthru b/bin/tests/system/rpzrecurse/ns2/db.passthru new file mode 100644 index 0000000..eac3533 --- /dev/null +++ b/bin/tests/system/rpzrecurse/ns2/db.passthru @@ -0,0 +1,20 @@ +; Copyright (C) Internet Systems Consortium, Inc. ("ISC") +; +; SPDX-License-Identifier: MPL-2.0 +; +; This Source Code Form is subject to the terms of the Mozilla Public +; License, v. 2.0. If a copy of the MPL was not distributed with this +; file, you can obtain one at https://mozilla.org/MPL/2.0/. +; +; See the COPYRIGHT file distributed with this work for additional +; information regarding copyright ownership. + +$ORIGIN passthru.zone. +$TTL 3600 +@ IN SOA ns.passthru.zone. hostmaster.passthru.zone. 1 600 300 604800 3600 + IN NS ns.passthru.zone. + +ns.passthru.zone. IN A 127.0.0.1 + +example.com CNAME rpz-passthru. +*.example.com CNAME rpz-passthru. diff --git a/bin/tests/system/rpzrecurse/ns2/db.wildcard1 b/bin/tests/system/rpzrecurse/ns2/db.wildcard1 new file mode 100644 index 0000000..3e5c78f --- /dev/null +++ b/bin/tests/system/rpzrecurse/ns2/db.wildcard1 @@ -0,0 +1,17 @@ +; Copyright (C) Internet Systems Consortium, Inc. ("ISC") +; +; SPDX-License-Identifier: MPL-2.0 +; +; This Source Code Form is subject to the terms of the Mozilla Public +; License, v. 2.0. If a copy of the MPL was not distributed with this +; file, you can obtain one at https://mozilla.org/MPL/2.0/. +; +; See the COPYRIGHT file distributed with this work for additional +; information regarding copyright ownership. + +$TTL 60 +@ IN SOA root.ns ns 1996072700 3600 1800 86400 60 + NS ns +ns A 127.0.0.1 +*.test1.example.net CNAME . +test1.example.net CNAME . diff --git a/bin/tests/system/rpzrecurse/ns2/db.wildcard2a b/bin/tests/system/rpzrecurse/ns2/db.wildcard2a new file mode 100644 index 0000000..3e5c78f --- /dev/null +++ b/bin/tests/system/rpzrecurse/ns2/db.wildcard2a @@ -0,0 +1,17 @@ +; Copyright (C) Internet Systems Consortium, Inc. ("ISC") +; +; SPDX-License-Identifier: MPL-2.0 +; +; This Source Code Form is subject to the terms of the Mozilla Public +; License, v. 2.0. If a copy of the MPL was not distributed with this +; file, you can obtain one at https://mozilla.org/MPL/2.0/. +; +; See the COPYRIGHT file distributed with this work for additional +; information regarding copyright ownership. + +$TTL 60 +@ IN SOA root.ns ns 1996072700 3600 1800 86400 60 + NS ns +ns A 127.0.0.1 +*.test1.example.net CNAME . +test1.example.net CNAME . diff --git a/bin/tests/system/rpzrecurse/ns2/db.wildcard2b b/bin/tests/system/rpzrecurse/ns2/db.wildcard2b new file mode 100644 index 0000000..f8e6123 --- /dev/null +++ b/bin/tests/system/rpzrecurse/ns2/db.wildcard2b @@ -0,0 +1,17 @@ +; Copyright (C) Internet Systems Consortium, Inc. ("ISC") +; +; SPDX-License-Identifier: MPL-2.0 +; +; This Source Code Form is subject to the terms of the Mozilla Public +; License, v. 2.0. If a copy of the MPL was not distributed with this +; file, you can obtain one at https://mozilla.org/MPL/2.0/. +; +; See the COPYRIGHT file distributed with this work for additional +; information regarding copyright ownership. + +$TTL 60 +@ IN SOA root.ns ns 1996072700 3600 1800 86400 60 + NS ns +ns A 127.0.0.1 +*.test2.example.net CNAME . +test2.example.net CNAME . diff --git a/bin/tests/system/rpzrecurse/ns2/db.wildcard3 b/bin/tests/system/rpzrecurse/ns2/db.wildcard3 new file mode 100644 index 0000000..5354c04 --- /dev/null +++ b/bin/tests/system/rpzrecurse/ns2/db.wildcard3 @@ -0,0 +1,16 @@ +; Copyright (C) Internet Systems Consortium, Inc. ("ISC") +; +; SPDX-License-Identifier: MPL-2.0 +; +; This Source Code Form is subject to the terms of the Mozilla Public +; License, v. 2.0. If a copy of the MPL was not distributed with this +; file, you can obtain one at https://mozilla.org/MPL/2.0/. +; +; See the COPYRIGHT file distributed with this work for additional +; information regarding copyright ownership. + +$TTL 60 +@ IN SOA root.ns ns 1996072700 3600 1800 86400 60 + NS ns +ns A 127.0.0.1 +*.test1.example.net CNAME . diff --git a/bin/tests/system/rpzrecurse/ns2/named.clientip.conf b/bin/tests/system/rpzrecurse/ns2/named.clientip.conf new file mode 100644 index 0000000..8df90a3 --- /dev/null +++ b/bin/tests/system/rpzrecurse/ns2/named.clientip.conf @@ -0,0 +1,37 @@ +/* + * Copyright (C) Internet Systems Consortium, Inc. ("ISC") + * + * SPDX-License-Identifier: MPL-2.0 + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, you can obtain one at https://mozilla.org/MPL/2.0/. + * + * See the COPYRIGHT file distributed with this work for additional + * information regarding copyright ownership. + */ + +# common configuration +include "named.conf.header"; + +view "recursive" { + zone "." { + type hint; + file "root.hint"; + }; + + # policy configuration to be tested + response-policy { + zone "clientip1"; + zone "clientip2"; + } qname-wait-recurse no + nsdname-enable yes + nsip-enable yes; + + # policy zones to be tested + zone "clientip1" { type master; file "db.clientip1"; }; + zone "clientip2" { type master; file "db.clientip2"; }; + + recursion yes; + dnssec-validation yes; +}; diff --git a/bin/tests/system/rpzrecurse/ns2/named.clientip2.conf b/bin/tests/system/rpzrecurse/ns2/named.clientip2.conf new file mode 100644 index 0000000..8c15909 --- /dev/null +++ b/bin/tests/system/rpzrecurse/ns2/named.clientip2.conf @@ -0,0 +1,37 @@ +/* + * Copyright (C) Internet Systems Consortium, Inc. ("ISC") + * + * SPDX-License-Identifier: MPL-2.0 + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, you can obtain one at https://mozilla.org/MPL/2.0/. + * + * See the COPYRIGHT file distributed with this work for additional + * information regarding copyright ownership. + */ + +# common configuration +include "named.conf.header"; + +view "recursive" { + zone "." { + type hint; + file "root.hint"; + }; + + servfail-ttl 0; + + # policy configuration to be tested + response-policy { + zone "clientip21"; + } qname-wait-recurse no + nsdname-enable yes + nsip-enable yes; + + # policy zones to be tested + zone "clientip21" { type master; file "db.clientip21"; }; + + recursion yes; + dnssec-validation yes; +}; diff --git a/bin/tests/system/rpzrecurse/ns2/named.conf.header.in b/bin/tests/system/rpzrecurse/ns2/named.conf.header.in new file mode 100644 index 0000000..77c3c6a --- /dev/null +++ b/bin/tests/system/rpzrecurse/ns2/named.conf.header.in @@ -0,0 +1,41 @@ +/* + * Copyright (C) Internet Systems Consortium, Inc. ("ISC") + * + * SPDX-License-Identifier: MPL-2.0 + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, you can obtain one at https://mozilla.org/MPL/2.0/. + * + * See the COPYRIGHT file distributed with this work for additional + * information regarding copyright ownership. + */ + +controls { /* empty */ }; + +options { + query-source address 10.53.0.2; + notify-source 10.53.0.2; + transfer-source 10.53.0.2; + port @PORT@; + session-keyfile "session.key"; + pid-file "named.pid"; + listen-on { 10.53.0.2; }; + listen-on-v6 { none; }; + recursion yes; + dnssec-validation yes; + querylog yes; + + # let ns3 start dnsrpzd + include "../dnsrps-slave.conf"; +}; + +key rndc_key { + secret "1234abcd8765"; + algorithm hmac-sha256; +}; + +controls { + inet 10.53.0.2 port @CONTROLPORT@ allow { any; } keys { rndc_key; }; +}; + diff --git a/bin/tests/system/rpzrecurse/ns2/named.default.conf b/bin/tests/system/rpzrecurse/ns2/named.default.conf new file mode 100644 index 0000000..929b88f --- /dev/null +++ b/bin/tests/system/rpzrecurse/ns2/named.default.conf @@ -0,0 +1,25 @@ +/* + * Copyright (C) Internet Systems Consortium, Inc. ("ISC") + * + * SPDX-License-Identifier: MPL-2.0 + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, you can obtain one at https://mozilla.org/MPL/2.0/. + * + * See the COPYRIGHT file distributed with this work for additional + * information regarding copyright ownership. + */ + +# common configuration +include "named.conf.header"; + +view "recursive" { + zone "." { + type hint; + file "root.hint"; + }; + + recursion yes; + dnssec-validation yes; +}; diff --git a/bin/tests/system/rpzrecurse/ns2/named.invalidprefixlength.conf b/bin/tests/system/rpzrecurse/ns2/named.invalidprefixlength.conf new file mode 100644 index 0000000..c7dad28 --- /dev/null +++ b/bin/tests/system/rpzrecurse/ns2/named.invalidprefixlength.conf @@ -0,0 +1,30 @@ +/* + * Copyright (C) Internet Systems Consortium, Inc. ("ISC") + * + * SPDX-License-Identifier: MPL-2.0 + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, you can obtain one at https://mozilla.org/MPL/2.0/. + * + * See the COPYRIGHT file distributed with this work for additional + * information regarding copyright ownership. + */ + +# common configuration +include "named.conf.header"; + +view "recursive" { + zone "." { + type hint; + file "root.hint"; + }; + + # policy configuration to be tested + response-policy { + zone "invalidprefixlength"; + }; + + # policy zones to be tested + zone "invalidprefixlength" { type master; file "db.invalidprefixlength"; }; +}; diff --git a/bin/tests/system/rpzrecurse/ns2/named.log.conf b/bin/tests/system/rpzrecurse/ns2/named.log.conf new file mode 100644 index 0000000..c3b4df6 --- /dev/null +++ b/bin/tests/system/rpzrecurse/ns2/named.log.conf @@ -0,0 +1,39 @@ +/* + * Copyright (C) Internet Systems Consortium, Inc. ("ISC") + * + * SPDX-License-Identifier: MPL-2.0 + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, you can obtain one at https://mozilla.org/MPL/2.0/. + * + * See the COPYRIGHT file distributed with this work for additional + * information regarding copyright ownership. + */ + +# common configuration +include "named.conf.header"; + +view "recursive" { + zone "." { + type hint; + file "root.hint"; + }; + + # policy configuration to be tested + response-policy { + zone "log1" log no; + zone "log2" log yes; + zone "log3"; # missing log clause + } qname-wait-recurse no + nsdname-enable yes + nsip-enable yes; + + # policy zones to be tested + zone "log1" { type master; file "db.log1"; }; + zone "log2" { type master; file "db.log2"; }; + zone "log3" { type master; file "db.log3"; }; + + recursion yes; + dnssec-validation yes; +}; diff --git a/bin/tests/system/rpzrecurse/ns2/named.max.conf b/bin/tests/system/rpzrecurse/ns2/named.max.conf new file mode 100644 index 0000000..5b9f8a2 --- /dev/null +++ b/bin/tests/system/rpzrecurse/ns2/named.max.conf @@ -0,0 +1,161 @@ +/* + * Copyright (C) Internet Systems Consortium, Inc. ("ISC") + * + * SPDX-License-Identifier: MPL-2.0 + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, you can obtain one at https://mozilla.org/MPL/2.0/. + * + * See the COPYRIGHT file distributed with this work for additional + * information regarding copyright ownership. + */ + +# common configuration +include "named.conf.header"; + +view "recursive" { + zone "." { + type hint; + file "root.hint"; + }; + + # policy configuration to be tested + response-policy { + zone "max1"; + zone "max2"; + zone "max3"; + zone "max4"; + zone "max5"; + zone "max6"; + zone "max7"; + zone "max8"; + zone "max9"; + zone "max10"; + zone "max11"; + zone "max12"; + zone "max13"; + zone "max14"; + zone "max15"; + zone "max16"; + zone "max17"; + zone "max18"; + zone "max19"; + zone "max20"; + zone "max21"; + zone "max22"; + zone "max23"; + zone "max24"; + zone "max25"; + zone "max26"; + zone "max27"; + zone "max28"; + zone "max29"; + zone "max30"; + zone "max31"; + zone "max32"; + zone "max33"; + zone "max34"; + zone "max35"; + zone "max36"; + zone "max37"; + zone "max38"; + zone "max39"; + zone "max40"; + zone "max41"; + zone "max42"; + zone "max43"; + zone "max44"; + zone "max45"; + zone "max46"; + zone "max47"; + zone "max48"; + zone "max49"; + zone "max50"; + zone "max51"; + zone "max52"; + zone "max53"; + zone "max54"; + zone "max55"; + zone "max56"; + zone "max57"; + zone "max58"; + zone "max59"; + zone "max60"; + zone "max61"; + zone "max62"; + zone "max63"; + zone "max64"; + } qname-wait-recurse no + nsdname-enable yes + nsip-enable yes; + + # policy zones to be tested + zone "max1" { type master; file "db.max1.local"; }; + zone "max2" { type master; file "db.max2.local"; }; + zone "max3" { type master; file "db.max3.local"; }; + zone "max4" { type master; file "db.max4.local"; }; + zone "max5" { type master; file "db.max5.local"; }; + zone "max6" { type master; file "db.max6.local"; }; + zone "max7" { type master; file "db.max7.local"; }; + zone "max8" { type master; file "db.max8.local"; }; + zone "max9" { type master; file "db.max9.local"; }; + zone "max10" { type master; file "db.max10.local"; }; + zone "max11" { type master; file "db.max11.local"; }; + zone "max12" { type master; file "db.max12.local"; }; + zone "max13" { type master; file "db.max13.local"; }; + zone "max14" { type master; file "db.max14.local"; }; + zone "max15" { type master; file "db.max15.local"; }; + zone "max16" { type master; file "db.max16.local"; }; + zone "max17" { type master; file "db.max17.local"; }; + zone "max18" { type master; file "db.max18.local"; }; + zone "max19" { type master; file "db.max19.local"; }; + zone "max20" { type master; file "db.max20.local"; }; + zone "max21" { type master; file "db.max21.local"; }; + zone "max22" { type master; file "db.max22.local"; }; + zone "max23" { type master; file "db.max23.local"; }; + zone "max24" { type master; file "db.max24.local"; }; + zone "max25" { type master; file "db.max25.local"; }; + zone "max26" { type master; file "db.max26.local"; }; + zone "max27" { type master; file "db.max27.local"; }; + zone "max28" { type master; file "db.max28.local"; }; + zone "max29" { type master; file "db.max29.local"; }; + zone "max30" { type master; file "db.max30.local"; }; + zone "max31" { type master; file "db.max31.local"; }; + zone "max32" { type master; file "db.max32.local"; }; + zone "max33" { type master; file "db.max33.local"; }; + zone "max34" { type master; file "db.max34.local"; }; + zone "max35" { type master; file "db.max35.local"; }; + zone "max36" { type master; file "db.max36.local"; }; + zone "max37" { type master; file "db.max37.local"; }; + zone "max38" { type master; file "db.max38.local"; }; + zone "max39" { type master; file "db.max39.local"; }; + zone "max40" { type master; file "db.max40.local"; }; + zone "max41" { type master; file "db.max41.local"; }; + zone "max42" { type master; file "db.max42.local"; }; + zone "max43" { type master; file "db.max43.local"; }; + zone "max44" { type master; file "db.max44.local"; }; + zone "max45" { type master; file "db.max45.local"; }; + zone "max46" { type master; file "db.max46.local"; }; + zone "max47" { type master; file "db.max47.local"; }; + zone "max48" { type master; file "db.max48.local"; }; + zone "max49" { type master; file "db.max49.local"; }; + zone "max50" { type master; file "db.max50.local"; }; + zone "max51" { type master; file "db.max51.local"; }; + zone "max52" { type master; file "db.max52.local"; }; + zone "max53" { type master; file "db.max53.local"; }; + zone "max54" { type master; file "db.max54.local"; }; + zone "max55" { type master; file "db.max55.local"; }; + zone "max56" { type master; file "db.max56.local"; }; + zone "max57" { type master; file "db.max57.local"; }; + zone "max58" { type master; file "db.max58.local"; }; + zone "max59" { type master; file "db.max59.local"; }; + zone "max60" { type master; file "db.max60.local"; }; + zone "max61" { type master; file "db.max61.local"; }; + zone "max62" { type master; file "db.max62.local"; }; + zone "max63" { type master; file "db.max63.local"; }; + zone "max64" { type master; file "db.max64.local"; }; + + recursion yes; + dnssec-validation yes; +}; diff --git a/bin/tests/system/rpzrecurse/ns2/named.wildcard1.conf b/bin/tests/system/rpzrecurse/ns2/named.wildcard1.conf new file mode 100644 index 0000000..f9e205d --- /dev/null +++ b/bin/tests/system/rpzrecurse/ns2/named.wildcard1.conf @@ -0,0 +1,35 @@ +/* + * Copyright (C) Internet Systems Consortium, Inc. ("ISC") + * + * SPDX-License-Identifier: MPL-2.0 + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, you can obtain one at https://mozilla.org/MPL/2.0/. + * + * See the COPYRIGHT file distributed with this work for additional + * information regarding copyright ownership. + */ + +# common configuration +include "named.conf.header"; + +view "recursive" { + zone "." { + type hint; + file "root.hint"; + }; + + # policy configuration to be tested + response-policy { + zone "wildcard1" policy NXDOMAIN; + } qname-wait-recurse yes + nsdname-enable yes + nsip-enable yes; + + # policy zones to be tested + zone "wildcard1" { type master; file "db.wildcard1"; }; + + recursion yes; + dnssec-validation yes; +}; diff --git a/bin/tests/system/rpzrecurse/ns2/named.wildcard2.conf b/bin/tests/system/rpzrecurse/ns2/named.wildcard2.conf new file mode 100644 index 0000000..31d05c6 --- /dev/null +++ b/bin/tests/system/rpzrecurse/ns2/named.wildcard2.conf @@ -0,0 +1,37 @@ +/* + * Copyright (C) Internet Systems Consortium, Inc. ("ISC") + * + * SPDX-License-Identifier: MPL-2.0 + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, you can obtain one at https://mozilla.org/MPL/2.0/. + * + * See the COPYRIGHT file distributed with this work for additional + * information regarding copyright ownership. + */ + +# common configuration +include "named.conf.header"; + +view "recursive" { + zone "." { + type hint; + file "root.hint"; + }; + + # policy configuration to be tested + response-policy { + zone "wildcard2a" policy NXDOMAIN; + zone "wildcard2b" policy NXDOMAIN; + } qname-wait-recurse yes + nsdname-enable yes + nsip-enable yes; + + # policy zones to be tested + zone "wildcard2a" { type master; file "db.wildcard2a"; }; + zone "wildcard2b" { type master; file "db.wildcard2b"; }; + + recursion yes; + dnssec-validation yes; +}; diff --git a/bin/tests/system/rpzrecurse/ns2/named.wildcard3.conf b/bin/tests/system/rpzrecurse/ns2/named.wildcard3.conf new file mode 100644 index 0000000..7164d70 --- /dev/null +++ b/bin/tests/system/rpzrecurse/ns2/named.wildcard3.conf @@ -0,0 +1,35 @@ +/* + * Copyright (C) Internet Systems Consortium, Inc. ("ISC") + * + * SPDX-License-Identifier: MPL-2.0 + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, you can obtain one at https://mozilla.org/MPL/2.0/. + * + * See the COPYRIGHT file distributed with this work for additional + * information regarding copyright ownership. + */ + +# common configuration +include "named.conf.header"; + +view "recursive" { + zone "." { + type hint; + file "root.hint"; + }; + + # policy configuration to be tested + response-policy { + zone "wildcard3" policy NXDOMAIN; + } qname-wait-recurse yes + nsdname-enable yes + nsip-enable yes; + + # policy zones to be tested + zone "wildcard3" { type master; file "db.wildcard3"; }; + + recursion yes; + dnssec-validation yes; +}; diff --git a/bin/tests/system/rpzrecurse/ns2/named.wildcard4.conf b/bin/tests/system/rpzrecurse/ns2/named.wildcard4.conf new file mode 100644 index 0000000..b6a76d0 --- /dev/null +++ b/bin/tests/system/rpzrecurse/ns2/named.wildcard4.conf @@ -0,0 +1,37 @@ +/* + * Copyright (C) Internet Systems Consortium, Inc. ("ISC") + * + * SPDX-License-Identifier: MPL-2.0 + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, you can obtain one at https://mozilla.org/MPL/2.0/. + * + * See the COPYRIGHT file distributed with this work for additional + * information regarding copyright ownership. + */ + +# common configuration +include "named.conf.header"; + +view "recursive" { + # policy configuration to be tested + response-policy { + zone "passthru.zone" policy passthru; + zone "given.zone" policy given; + } qname-wait-recurse yes + nsdname-enable yes + nsip-enable yes; + + # policy zones to be tested + zone "passthru.zone" { type master; file "db.passthru"; }; + zone "given.zone" { type master; file "db.given"; }; + + zone "." { + type hint; + file "root.hint"; + }; + + recursion yes; + dnssec-validation yes; +}; diff --git a/bin/tests/system/rpzrecurse/ns2/root.hint b/bin/tests/system/rpzrecurse/ns2/root.hint new file mode 100644 index 0000000..ced47f3 --- /dev/null +++ b/bin/tests/system/rpzrecurse/ns2/root.hint @@ -0,0 +1,14 @@ +; Copyright (C) Internet Systems Consortium, Inc. ("ISC") +; +; SPDX-License-Identifier: MPL-2.0 +; +; This Source Code Form is subject to the terms of the Mozilla Public +; License, v. 2.0. If a copy of the MPL was not distributed with this +; file, you can obtain one at https://mozilla.org/MPL/2.0/. +; +; See the COPYRIGHT file distributed with this work for additional +; information regarding copyright ownership. + +$TTL 999999 +. IN NS ns.example. +ns.example. IN A 10.53.0.1 diff --git a/bin/tests/system/rpzrecurse/ns3/example.db b/bin/tests/system/rpzrecurse/ns3/example.db new file mode 100644 index 0000000..201a174 --- /dev/null +++ b/bin/tests/system/rpzrecurse/ns3/example.db @@ -0,0 +1,17 @@ +; Copyright (C) Internet Systems Consortium, Inc. ("ISC") +; +; SPDX-License-Identifier: MPL-2.0 +; +; This Source Code Form is subject to the terms of the Mozilla Public +; License, v. 2.0. If a copy of the MPL was not distributed with this +; file, you can obtain one at https://mozilla.org/MPL/2.0/. +; +; See the COPYRIGHT file distributed with this work for additional +; information regarding copyright ownership. + +$TTL 0 +@ SOA . . 0 0 0 0 0 +@ NS ns +ns A 10.53.0.3 +child NS ns.child +ns.child A 10.53.0.4 diff --git a/bin/tests/system/rpzrecurse/ns3/named1.conf.in b/bin/tests/system/rpzrecurse/ns3/named1.conf.in new file mode 100644 index 0000000..1a56066 --- /dev/null +++ b/bin/tests/system/rpzrecurse/ns3/named1.conf.in @@ -0,0 +1,43 @@ +/* + * Copyright (C) Internet Systems Consortium, Inc. ("ISC") + * + * SPDX-License-Identifier: MPL-2.0 + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, you can obtain one at https://mozilla.org/MPL/2.0/. + * + * See the COPYRIGHT file distributed with this work for additional + * information regarding copyright ownership. + */ + +include "../../common/rndc.key"; + +controls { + inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; }; +}; + +options { + query-source address 10.53.0.3; + notify-source 10.53.0.3; + transfer-source 10.53.0.3; + port @PORT@; + session-keyfile "session.key"; + pid-file "named.pid"; + listen-on { 10.53.0.3; }; + listen-on-v6 { none; }; + recursion yes; + dnssec-validation yes; + response-policy { zone "policy"; } + qname-wait-recurse yes + nsip-enable yes + nsdname-enable yes; + + include "../dnsrps.conf"; +}; + +zone "policy" { type master; file "policy.db"; }; + +zone "example.tld" { type master; file "example.db"; }; + +zone "." { type master; file "root.db"; }; diff --git a/bin/tests/system/rpzrecurse/ns3/named2.conf.in b/bin/tests/system/rpzrecurse/ns3/named2.conf.in new file mode 100644 index 0000000..b5370bf --- /dev/null +++ b/bin/tests/system/rpzrecurse/ns3/named2.conf.in @@ -0,0 +1,42 @@ +/* + * Copyright (C) Internet Systems Consortium, Inc. ("ISC") + * + * SPDX-License-Identifier: MPL-2.0 + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, you can obtain one at https://mozilla.org/MPL/2.0/. + * + * See the COPYRIGHT file distributed with this work for additional + * information regarding copyright ownership. + */ + +include "../../common/rndc.key"; + +controls { + inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; }; +}; + +options { + query-source address 10.53.0.3; + notify-source 10.53.0.3; + transfer-source 10.53.0.3; + port @PORT@; + pid-file "named.pid"; + listen-on { 10.53.0.3; }; + listen-on-v6 { none; }; + recursion yes; + dnssec-validation yes; + response-policy { zone "policy"; } nsip-wait-recurse no + qname-wait-recurse yes + nsip-enable yes + nsdname-enable yes; + + include "../dnsrps.conf"; +}; + +zone "policy" { type master; file "policy.db"; }; + +zone "example.tld" { type master; file "example.db"; }; + +zone "." { type master; file "root.db"; }; diff --git a/bin/tests/system/rpzrecurse/ns3/policy.db b/bin/tests/system/rpzrecurse/ns3/policy.db new file mode 100644 index 0000000..526d75c --- /dev/null +++ b/bin/tests/system/rpzrecurse/ns3/policy.db @@ -0,0 +1,15 @@ +; Copyright (C) Internet Systems Consortium, Inc. ("ISC") +; +; SPDX-License-Identifier: MPL-2.0 +; +; This Source Code Form is subject to the terms of the Mozilla Public +; License, v. 2.0. If a copy of the MPL was not distributed with this +; file, you can obtain one at https://mozilla.org/MPL/2.0/. +; +; See the COPYRIGHT file distributed with this work for additional +; information regarding copyright ownership. + +$TTL 0 +@ SOA . . 0 0 0 0 0 +@ NS . +32.100.0.53.10.rpz-nsip CNAME . diff --git a/bin/tests/system/rpzrecurse/ns3/root.db b/bin/tests/system/rpzrecurse/ns3/root.db new file mode 100644 index 0000000..665953d --- /dev/null +++ b/bin/tests/system/rpzrecurse/ns3/root.db @@ -0,0 +1,17 @@ +; Copyright (C) Internet Systems Consortium, Inc. ("ISC") +; +; SPDX-License-Identifier: MPL-2.0 +; +; This Source Code Form is subject to the terms of the Mozilla Public +; License, v. 2.0. If a copy of the MPL was not distributed with this +; file, you can obtain one at https://mozilla.org/MPL/2.0/. +; +; See the COPYRIGHT file distributed with this work for additional +; information regarding copyright ownership. + +$TTL 0 +@ SOA . . 0 0 0 0 0 +@ NS ns +ns A 10.53.0.3 +foo NS foo.ns5 +ns5.foo A 10.53.0.5 diff --git a/bin/tests/system/rpzrecurse/ns4/child.example.db b/bin/tests/system/rpzrecurse/ns4/child.example.db new file mode 100644 index 0000000..47a90fb --- /dev/null +++ b/bin/tests/system/rpzrecurse/ns4/child.example.db @@ -0,0 +1,18 @@ +; Copyright (C) Internet Systems Consortium, Inc. ("ISC") +; +; SPDX-License-Identifier: MPL-2.0 +; +; This Source Code Form is subject to the terms of the Mozilla Public +; License, v. 2.0. If a copy of the MPL was not distributed with this +; file, you can obtain one at https://mozilla.org/MPL/2.0/. +; +; See the COPYRIGHT file distributed with this work for additional +; information regarding copyright ownership. + +$TTL 0 +@ SOA . . 0 0 0 0 0 +@ NS ns +ns A 10.53.0.4 +foo NS ns.foo +foo NS ns.foo. +ns.foo A 10.53.0.5 diff --git a/bin/tests/system/rpzrecurse/ns4/named.conf.in b/bin/tests/system/rpzrecurse/ns4/named.conf.in new file mode 100644 index 0000000..372f5ad --- /dev/null +++ b/bin/tests/system/rpzrecurse/ns4/named.conf.in @@ -0,0 +1,38 @@ +/* + * Copyright (C) Internet Systems Consortium, Inc. ("ISC") + * + * SPDX-License-Identifier: MPL-2.0 + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, you can obtain one at https://mozilla.org/MPL/2.0/. + * + * See the COPYRIGHT file distributed with this work for additional + * information regarding copyright ownership. + */ + +controls { /* empty */ }; + +options { + query-source address 10.53.0.4; + notify-source 10.53.0.4; + transfer-source 10.53.0.4; + port @PORT@; + session-keyfile "session.key"; + pid-file "named.pid"; + listen-on { 10.53.0.4; }; + listen-on-v6 { none; }; + recursion no; + dnssec-validation no; +}; + +key rndc_key { + secret "1234abcd8765"; + algorithm hmac-sha256; +}; + +controls { + inet 10.53.0.4 port @CONTROLPORT@ allow { any; } keys { rndc_key; }; +}; + +zone "child.example.tld" { type master; file "child.example.db"; }; diff --git a/bin/tests/system/rpzrecurse/prereq.sh b/bin/tests/system/rpzrecurse/prereq.sh new file mode 100644 index 0000000..b30cb41 --- /dev/null +++ b/bin/tests/system/rpzrecurse/prereq.sh @@ -0,0 +1,25 @@ +#!/bin/sh + +# Copyright (C) Internet Systems Consortium, Inc. ("ISC") +# +# SPDX-License-Identifier: MPL-2.0 +# +# This Source Code Form is subject to the terms of the Mozilla Public +# License, v. 2.0. If a copy of the MPL was not distributed with this +# file, you can obtain one at https://mozilla.org/MPL/2.0/. +# +# See the COPYRIGHT file distributed with this work for additional +# information regarding copyright ownership. + +SYSTEMTESTTOP=.. +. $SYSTEMTESTTOP/conf.sh + +if $PERL -e 'use Net::DNS;' 2>/dev/null +then + : +else + echo_i "This test requires the Net::DNS library." >&2 + exit 1 +fi + +exit 0 diff --git a/bin/tests/system/rpzrecurse/setup.sh b/bin/tests/system/rpzrecurse/setup.sh new file mode 100644 index 0000000..7c15414 --- /dev/null +++ b/bin/tests/system/rpzrecurse/setup.sh @@ -0,0 +1,89 @@ +#!/bin/sh + +# Copyright (C) Internet Systems Consortium, Inc. ("ISC") +# +# SPDX-License-Identifier: MPL-2.0 +# +# This Source Code Form is subject to the terms of the Mozilla Public +# License, v. 2.0. If a copy of the MPL was not distributed with this +# file, you can obtain one at https://mozilla.org/MPL/2.0/. +# +# See the COPYRIGHT file distributed with this work for additional +# information regarding copyright ownership. + +# touch dnsrps-off to not test with DNSRPS + +set -e + +SYSTEMTESTTOP=.. +. $SYSTEMTESTTOP/conf.sh + +USAGE="$0: [-DNx]" +DEBUG= +while getopts "DNx" c; do + case $c in + x) set -x; DEBUG=-x;; + D) TEST_DNSRPS="-D";; + N) NOCLEAN=set;; + *) echo "$USAGE" 1>&2; exit 1;; + esac +done +shift `expr $OPTIND - 1 || true` +if test "$#" -ne 0; then + echo "$USAGE" 1>&2 + exit 1 +fi + +[ ${NOCLEAN:-unset} = unset ] && $SHELL clean.sh $DEBUG + +$PERL testgen.pl + +copy_setports ns1/named.conf.in ns1/named.conf + +copy_setports ns2/named.conf.header.in ns2/named.conf.header +copy_setports ns2/named.default.conf ns2/named.conf + +copy_setports ns3/named1.conf.in ns3/named.conf +copy_setports ns3/named2.conf.in ns3/named2.conf + +copy_setports ns4/named.conf.in ns4/named.conf + +# setup policy zones for a 64-zone test +i=1 +while test $i -le 64 +do + echo "\$TTL 60" > ns2/db.max$i.local + echo "@ IN SOA root.ns ns 1996072700 3600 1800 86400 60" >> ns2/db.max$i.local + echo " NS ns" >> ns2/db.max$i.local + echo "ns A 127.0.0.1" >> ns2/db.max$i.local + + j=1 + while test $j -le $i + do + echo "name$j A 10.53.0.$i" >> ns2/db.max$i.local + j=`expr $j + 1` + done + i=`expr $i + 1` +done + +# decide whether to test DNSRPS +$SHELL ../ckdnsrps.sh $TEST_DNSRPS $DEBUG +test -z "`grep 'dnsrps-enable yes' dnsrps.conf`" && TEST_DNSRPS= + +CWD=`pwd` +cat <<EOF >dnsrpzd.conf +PID-FILE $CWD/dnsrpzd.pid; + +include $CWD/dnsrpzd-license-cur.conf + +zone "policy" { type master; file "`pwd`/ns3/policy.db"; }; +EOF +sed -n -e 's/^ *//' -e "/zone.*.*master/s@file \"@&$CWD/ns2/@p" ns2/*.conf \ + >>dnsrpzd.conf + +# Run dnsrpzd to get the license and prime the static policy zones +if test -n "$TEST_DNSRPS"; then + DNSRPZD="`../rpz/dnsrps -p`" + "$DNSRPZD" -D./dnsrpzd.rpzf -S./dnsrpzd.sock -C./dnsrpzd.conf \ + -w 0 -dddd -L stdout >./dnsrpzd.run 2>&1 +fi diff --git a/bin/tests/system/rpzrecurse/testgen.pl b/bin/tests/system/rpzrecurse/testgen.pl new file mode 100755 index 0000000..399f343 --- /dev/null +++ b/bin/tests/system/rpzrecurse/testgen.pl @@ -0,0 +1,343 @@ +#!/usr/bin/env perl + +# Copyright (C) Internet Systems Consortium, Inc. ("ISC") +# +# SPDX-License-Identifier: MPL-2.0 +# +# This Source Code Form is subject to the terms of the Mozilla Public +# License, v. 2.0. If a copy of the MPL was not distributed with this +# file, you can obtain one at https://mozilla.org/MPL/2.0/. +# +# See the COPYRIGHT file distributed with this work for additional +# information regarding copyright ownership. + +use strict; +use warnings; + +my $boilerplate_header = <<'EOB'; +# common configuration +include "named.conf.header"; + +view "recursive" { + zone "." { + type hint; + file "root.hint"; + }; + + # policy configuration to be tested + response-policy { +EOB + +my $no_option = <<'EOB'; + } nsdname-enable yes nsip-enable yes; + + # policy zones to be tested +EOB + +my $qname_wait_recurse = <<'EOB'; + } nsdname-enable yes nsip-enable yes qname-wait-recurse no; + + # policy zones to be tested +EOB + +my $boilerplate_end = <<'EOB'; +}; +EOB + +my $policy_option = $qname_wait_recurse; + +my $serialnum = "1"; +my $policy_zone_header = <<'EOH'; +$TTL 60 +@ IN SOA root.ns ns SERIAL 3600 1800 86400 60 + NS ns +ns A 127.0.0.1 +EOH + +sub policy_client_ip { + return "32.1.0.0.127.rpz-client-ip CNAME .\n"; +} + +sub policy_qname { + my $query_nbr = shift; + return sprintf "q%02d.l2.l1.l0 CNAME .\n", $query_nbr; +} + +sub policy_ip { + return "32.255.255.255.255.rpz-ip CNAME .\n"; +} + +sub policy_nsdname { + return "ns.example.org.rpz-nsdname CNAME .\n"; +} + +sub policy_nsip { + return "32.255.255.255.255.rpz-ip CNAME .\n"; +} + +my %static_triggers = ( + 'client-ip' => \&policy_client_ip, + 'ip' => \&policy_ip, + 'nsdname' => \&policy_nsdname, + 'nsip' => \&policy_nsip, +); + +sub mkconf { + my $case_id = shift; + my $n_queries = shift; + + { # generate the query list + my $query_list_filename = "ns2/$case_id.queries"; + my $query_list_fh; + + open $query_list_fh, ">$query_list_filename" or die; + + for( my $i = 1; $i <= $n_queries; $i++ ) { + print $query_list_fh sprintf "q%02d.l2.l1.l0\n", $i; + } + } + + my @zones; + + { # generate the conf file + my $conf_filename = "ns2/named.$case_id.conf"; + + my $conf_fh; + + open $conf_fh, ">$conf_filename" or die; + + print $conf_fh $boilerplate_header; + + my $zone_seq = 0; + + @zones = map { + [ + sprintf( "$case_id.%02d.policy.local", $zone_seq++ ), + $_, + ]; + } @_; + + print $conf_fh map { qq{ zone "$_->[0]";\n} } @zones; + + print $conf_fh $policy_option; + + print $conf_fh map { qq{ zone "$_->[0]" { type master; file "db.$_->[0]"; };\n} } @zones; + + print $conf_fh $boilerplate_end; + } + + # generate the policy zone contents + foreach my $policy_zone_info( @zones ) { + my $policy_zone_name = $policy_zone_info->[0]; + my $policy_zone_contents = $policy_zone_info->[1]; + + my $policy_zone_filename = "ns2/db.$policy_zone_name"; + my $policy_zone_fh; + + open $policy_zone_fh, ">$policy_zone_filename" or die; + + my $header = $policy_zone_header; + $header =~ s/SERIAL/$serialnum/; + print $policy_zone_fh $header; + + foreach my $trigger( @$policy_zone_contents ) { + if( exists $static_triggers{$trigger} ) { + # matches a trigger type with a static value + print $policy_zone_fh $static_triggers{$trigger}->(); + } + else { + # a qname trigger, where what was specified is the query number it should match + print $policy_zone_fh policy_qname( $trigger ); + } + } + } +} + +mkconf( + '1a', + 1, + [ 'client-ip' ], +); + +mkconf( + '1b', + 2, + [ 1 ], +); + +mkconf( + '1c', + 1, + [ 'client-ip', 2 ], +); + +mkconf( + '2a', + 33, + map { [ $_ ]; } 1 .. 32 +); + +mkconf( + '3a', + 1, + [ 'ip' ], +); + +mkconf( + '3b', + 1, + [ 'nsdname' ], +); + +mkconf( + '3c', + 1, + [ 'nsip' ], +); + +mkconf( + '3d', + 2, + [ 'ip', 1 ] +); + +mkconf( + '3e', + 2, + [ 'nsdname', 1 ] +); + +mkconf( + '3f', + 2, + [ 'nsip', 1 ] +); + +{ + my $seq_code = 'aa'; + my $seq_nbr = 0; + + while( $seq_nbr < 32 ) { + + mkconf( + "4$seq_code", + 33, + ( map { [ $_ ]; } 1 .. $seq_nbr ), + [ 'ip', $seq_nbr + 2 ], + ( map { [ $_ + 2 ]; } ($seq_nbr + 1) .. 31 ), + ); + + $seq_code++; + $seq_nbr++; + } +} + +mkconf( + '5a', + 6, + [ 1 ], + [ 2, 'ip' ], + [ 4 ], + [ 5, 'ip' ], + [ 6 ], +); + +$policy_option = $no_option; + +mkconf( + '6a', + 0, + [ ], +); + +$serialnum = "2"; +mkconf( + '6b', + 0, + [ 'nsdname' ], +); + +$serialnum = "3"; +mkconf( + '6c', + 0, + [ ], +); + +__END__ + +0x01 - has client-ip + 32.1.0.0.127.rpz-client-ip CNAME . +0x02 - has qname + qX.l2.l1.l0 CNAME . +0x10 - has ip + 32.255.255.255.255.rpz-ip CNAME . +0x20 - has nsdname + ns.example.org.rpz-nsdname CNAME . +0x40 - has nsip + 32.255.255.255.255.rpz-nsip CNAME . + +$case.$seq.policy.local + +case 1a = 0x01 + .q01 = (00,0x01)=-r +case 1b = 0x02 + .q01 = (00,0x02)=-r + .q02 = (--,----)=+r +case 1c = 0x03 + .q01 = (00,0x01)=-r + +case 2a = 0x03{32} + .q01 = (00,0x02)=-r + .q02 = (01,0x02)=-r + ... + .q31 = (30,0x02)=-r + .q32 = (31,0x02)=-r + .q33 = (--,----)=+r + +case 3a = 0x10 + .q01 = (00,0x10)=+r +case 3b = 0x20 + .q01 = (00,0x20)=+r +case 3c = 0x40 + .q01 = (00,0x40)=+r +case 3d = 0x12 + .q01 = (00,0x10)=+r + .q02 = (00,0x02)=-r +case 3e = 0x22 + .q01 = (00,0x20)=+r + .q02 = (00,0x02)=-r +case 3f = 0x42 + .q01 = (00,0x40)=+r + .q02 = (00,0x02)=-r + +case 4aa = 0x12,0x02{31} + .q01 = (00,0x10)=+r + .q02 = (00,0x02)=-r + .q03 = (01,0x02)=+r + ... + .q32 = (30,0x02)=+r + .q33 = (31,0x02)=+r +case 4__ = 0x02{n(1->30)},0x12,0x02{31-n} + .q01 = (00,0x02)=-r + ... + .q(n+1) = (n,0x10)=+r + .q(n+2) = (n,0x02)=-r + ... + .q33 = (31,0x02)=+r +case 4bf = 0x02{31},0x12 + .q01 = (00,0x02)=-r + .q02 = (01,0x02)=-r + ... + .q31 = (30,0x02)=-r + .q32 = (31,0x10)=+r + .q33 = (31,0x02)=-r + +case 5a = 0x02,0x12,0x02,0x12,0x02 + .q01 = (00,0x02)=-r + .q02 = (01,0x02)=-r + .q03 = (01,0x10)=+r + .q04 = (02,0x02)=+r + .q05 = (03,0x02)=+r + .q06 = (04,0x02)=+r + diff --git a/bin/tests/system/rpzrecurse/tests.sh b/bin/tests/system/rpzrecurse/tests.sh new file mode 100644 index 0000000..950b610 --- /dev/null +++ b/bin/tests/system/rpzrecurse/tests.sh @@ -0,0 +1,545 @@ +#!/bin/sh + +# Copyright (C) Internet Systems Consortium, Inc. ("ISC") +# +# SPDX-License-Identifier: MPL-2.0 +# +# This Source Code Form is subject to the terms of the Mozilla Public +# License, v. 2.0. If a copy of the MPL was not distributed with this +# file, you can obtain one at https://mozilla.org/MPL/2.0/. +# +# See the COPYRIGHT file distributed with this work for additional +# information regarding copyright ownership. + +# touch dnsrps-off to not test with DNSRPS +# touch dnsrps-only to not test with classic RPZ + +SYSTEMTESTTOP=.. +. $SYSTEMTESTTOP/conf.sh + +status=0 + +t=0 + +DEBUG= +ARGS= + +USAGE="$0: [-xS]" +while getopts "xS:" c; do + case $c in + x) set -x; DEBUG=-x; ARGS="$ARGS -x";; + S) SAVE_RESULTS=-S; ARGS="$ARGS -S";; + *) echo "$USAGE" 1>&2; exit 1;; + esac +done +shift `expr $OPTIND - 1 || true` +if test "$#" -ne 0; then + echo "$USAGE" 1>&2 + exit 1 +fi +# really quit on control-C +trap 'exit 1' 1 2 15 + +DNSRPSCMD=../rpz/dnsrps +RNDCCMD="$RNDC -c $SYSTEMTESTTOP/common/rndc.conf -p ${CONTROLPORT} -s" + +# $1 = test name (such as 1a, 1b, etc. for which named.$1.conf exists) +run_server() { + TESTNAME=$1 + + echo_i "stopping resolver" + stop_server --use-rndc --port ${CONTROLPORT} ns2 + + sleep 1 + + echo_i "starting resolver using named.$TESTNAME.conf" + cp -f ns2/named.$TESTNAME.conf ns2/named.conf + start_server --noclean --restart --port ${PORT} ns2 + sleep 3 +} + +run_query() { + TESTNAME=$1 + LINE=$2 + + NAME=`sed -n -e "$LINE,"'$p' ns2/$TESTNAME.queries | head -n 1` + $DIG $DIGOPTS $NAME a @10.53.0.2 -p ${PORT} -b 127.0.0.1 > dig.out.${t} + grep "status: SERVFAIL" dig.out.${t} > /dev/null 2>&1 && return 1 + return 0 +} + +# $1 = test name (such as 1a, 1b, etc. for which $1.queries exists) +# $2 = line number in query file to test (the name to query is taken from this line) +expect_norecurse() { + TESTNAME=$1 + LINE=$2 + + NAME=`sed -n -e "$LINE,"'$p' ns2/$TESTNAME.queries | head -n 1` + t=`expr $t + 1` + echo_i "testing $NAME doesn't recurse (${t})" + add_test_marker 10.53.0.2 + run_query $TESTNAME $LINE || { + echo_i "test ${t} failed" + status=1 + } +} + +# $1 = test name (such as 1a, 1b, etc. for which $1.queries exists) +# $2 = line number in query file to test (the name to query is taken from this line) +expect_recurse() { + TESTNAME=$1 + LINE=$2 + + NAME=`sed -n -e "$LINE,"'$p' ns2/$TESTNAME.queries | head -n 1` + t=`expr $t + 1` + echo_i "testing $NAME recurses (${t})" + add_test_marker 10.53.0.2 + run_query $TESTNAME $LINE && { + echo_i "test ${t} failed" + status=1 + } +} + +add_test_marker() { + for ns in $@ + do + $RNDCCMD $ns null ---- test ${t} ---- + done +} + +for mode in native dnsrps; do + status=0 + case $mode in + native) + if [ -e dnsrps-only ] ; then + echo_i "'dnsrps-only' found: skipping native RPZ sub-test" + continue + else + echo_i "running native RPZ sub-test" + fi + ;; + dnsrps) + if [ -e dnsrps-off ] ; then + echo_i "'dnsrps-off' found: skipping DNSRPS sub-test" + continue + fi + echo_i "attempting to configure servers with DNSRPS..." + stop_server --use-rndc --port ${CONTROLPORT} + $SHELL ./setup.sh -N -D $DEBUG + sed -n 's/^## //p' dnsrps.conf | cat_i + if grep '^#fail' dnsrps.conf >/dev/null; then + echo_i "exit status: 1" + exit 1 + fi + if grep '^#skip' dnsrps.conf > /dev/null; then + echo_i "DNSRPS sub-test skipped" + continue + else + echo_i "running DNSRPS sub-test" + start_server --noclean --restart --port ${PORT} + sleep 3 + fi + ;; + esac + + # show whether and why DNSRPS is enabled or disabled + sed -n 's/^## //p' dnsrps.conf | cat_i + + t=`expr $t + 1` + echo_i "testing that l1.l0 exists without RPZ (${t})" + add_test_marker 10.53.0.2 + $DIG $DIGOPTS l1.l0 ns @10.53.0.2 -p ${PORT} > dig.out.${t} + grep "status: NOERROR" dig.out.${t} > /dev/null 2>&1 || { + echo_i "test ${t} failed" + status=1 + } + + t=`expr $t + 1` + echo_i "testing that l2.l1.l0 returns SERVFAIL without RPZ (${t})" + add_test_marker 10.53.0.2 + $DIG $DIGOPTS l2.l1.l0 ns @10.53.0.2 -p ${PORT} > dig.out.${t} + grep "status: SERVFAIL" dig.out.${t} > /dev/null 2>&1 || { + echo_i "test ${t} failed" + status=1 + } + + # Group 1 + run_server 1a + expect_norecurse 1a 1 + run_server 1b + expect_norecurse 1b 1 + expect_recurse 1b 2 + run_server 1c + expect_norecurse 1c 1 + + # Group 2 + run_server 2a + for n in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 \ + 21 22 23 24 25 26 27 28 29 30 31 32 + do + expect_norecurse 2a $n + done + expect_recurse 2a 33 + + # Group 3 + run_server 3a + expect_recurse 3a 1 + run_server 3b + expect_recurse 3b 1 + run_server 3c + expect_recurse 3c 1 + run_server 3d + expect_norecurse 3d 1 + expect_recurse 3d 2 + run_server 3e + expect_norecurse 3e 1 + expect_recurse 3e 2 + run_server 3f + expect_norecurse 3f 1 + expect_recurse 3f 2 + + # Group 4 + testlist="aa ap bf" + values="1 16 32" + # Uncomment the following to test every skip value instead of + # only a sample of values + # + #testlist="aa ab ac ad ae af ag ah ai aj ak al am an ao ap \ + # aq ar as at au av aw ax ay az ba bb bc bd be bf" + #values="1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 \ + # 21 22 23 24 25 26 27 28 29 30 31 32" + set -- $values + for n in $testlist; do + run_server 4$n + ni=$1 + t=`expr $t + 1` + echo_i "testing that ${ni} of 33 queries skip recursion (${t})" + add_test_marker 10.53.0.2 + c=0 + for i in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 \ + 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 + do + run_query 4$n $i + c=`expr $c + $?` + done + skipped=`expr 33 - $c` + if [ $skipped != $ni ]; then + echo_i "test $t failed (actual=$skipped, expected=$ni)" + status=1 + fi + shift + done + + # Group 5 + run_server 5a + expect_norecurse 5a 1 + expect_norecurse 5a 2 + expect_recurse 5a 3 + expect_recurse 5a 4 + expect_recurse 5a 5 + expect_recurse 5a 6 + + if [ ! "$CYGWIN" -o -n "$PSSUSPEND" ] + then + # Group 6 + echo_i "check recursive behavior consistency during policy update races" + run_server 6a + sleep 1 + t=`expr $t + 1` + echo_i "running dig to cache CNAME record (${t})" + add_test_marker 10.53.0.1 10.53.0.2 + $DIG $DIGOPTS @10.53.0.2 -p ${PORT} www.test.example.org CNAME > dig.out.${t} + sleep 1 + echo_i "suspending authority server" + PID=`cat ns1/named.pid` + if [ "$CYGWIN" ] + then + $PSSUSPEND $PID + else + $KILL -STOP $PID + fi + echo_i "adding an NSDNAME policy" + cp ns2/db.6a.00.policy.local ns2/saved.policy.local + cp ns2/db.6b.00.policy.local ns2/db.6a.00.policy.local + $RNDC -c ../common/rndc.conf -s 10.53.0.2 -p ${CONTROLPORT} reload 6a.00.policy.local 2>&1 | sed 's/^/ns2 /' | cat_i + test -f dnsrpzd.pid && $KILL -USR1 `cat dnsrpzd.pid` + sleep 1 + t=`expr $t + 1` + echo_i "running dig to follow CNAME (blocks, so runs in the background) (${t})" + add_test_marker 10.53.0.2 + $DIG $DIGOPTS @10.53.0.2 -p ${PORT} www.test.example.org A +time=5 > dig.out.${t} & + sleep 1 + echo_i "removing the NSDNAME policy" + cp ns2/db.6c.00.policy.local ns2/db.6a.00.policy.local + $RNDC -c ../common/rndc.conf -s 10.53.0.2 -p ${CONTROLPORT} reload 6a.00.policy.local 2>&1 | sed 's/^/ns2 /' | cat_i + test -f dnsrpzd.pid && $KILL -USR1 `cat dnsrpzd.pid` + sleep 1 + echo_i "resuming authority server" + PID=`cat ns1/named.pid` + if [ "$CYGWIN" ] + then + $PSSUSPEND -r $PID + else + $KILL -CONT $PID + fi + add_test_marker 10.53.0.1 + for n in 1 2 3 4 5 6 7 8 9 + do + sleep 1 + [ -s dig.out.${t} ] || continue + grep "status: .*," dig.out.${t} > /dev/null 2>&1 && break + done + grep "status: NOERROR" dig.out.${t} > /dev/null 2>&1 || { + echo_i "test ${t} failed" + status=1 + } + + echo_i "check recursive behavior consistency during policy removal races" + cp ns2/saved.policy.local ns2/db.6a.00.policy.local + run_server 6a + sleep 1 + t=`expr $t + 1` + echo_i "running dig to cache CNAME record (${t})" + add_test_marker 10.53.0.1 10.53.0.2 + $DIG $DIGOPTS @10.53.0.2 -p ${PORT} www.test.example.org CNAME > dig.out.${t} + sleep 1 + echo_i "suspending authority server" + PID=`cat ns1/named.pid` + if [ "$CYGWIN" ] + then + $PSSUSPEND $PID + else + $KILL -STOP $PID + fi + echo_i "adding an NSDNAME policy" + cp ns2/db.6b.00.policy.local ns2/db.6a.00.policy.local + $RNDC -c ../common/rndc.conf -s 10.53.0.2 -p ${CONTROLPORT} reload 6a.00.policy.local 2>&1 | sed 's/^/ns2 /' | cat_i + test -f dnsrpzd.pid && $KILL -USR1 `cat dnsrpzd.pid` + sleep 1 + t=`expr $t + 1` + echo_i "running dig to follow CNAME (blocks, so runs in the background) (${t})" + add_test_marker 10.53.0.2 + $DIG $DIGOPTS @10.53.0.2 -p ${PORT} www.test.example.org A +time=5 > dig.out.${t} & + sleep 1 + echo_i "removing the policy zone" + cp ns2/named.default.conf ns2/named.conf + rndc_reconfig ns2 10.53.0.2 + test -f dnsrpzd.pid && $KILL -USR1 `cat dnsrpzd.pid` + sleep 1 + echo_i "resuming authority server" + PID=`cat ns1/named.pid` + if [ "$CYGWIN" ] + then + $PSSUSPEND -r $PID + else + $KILL -CONT $PID + fi + add_test_marker 10.53.0.1 + for n in 1 2 3 4 5 6 7 8 9; do + sleep 1 + [ -s dig.out.${t} ] || continue + grep "status: .*," dig.out.${t} > /dev/null 2>&1 && break + done + grep "status: NOERROR" dig.out.${t} > /dev/null 2>&1 || { + echo_i "test ${t} failed" + status=1 + } + fi + + # Check maximum number of RPZ zones (64) + t=`expr $t + 1` + echo_i "testing maximum number of RPZ zones (${t})" + add_test_marker 10.53.0.2 + run_server max + i=1 + while test $i -le 64 + do + $DIG $DIGOPTS name$i a @10.53.0.2 -p ${PORT} -b 10.53.0.1 > dig.out.${t}.${i} + grep "^name$i.[ ]*[0-9]*[ ]*IN[ ]*A[ ]*10.53.0.$i" dig.out.${t}.${i} > /dev/null 2>&1 || { + echo_i "test $t failed: didn't get expected answer from policy zone $i" + status=1 + } + i=`expr $i + 1` + done + + # Check CLIENT-IP behavior + t=`expr $t + 1` + echo_i "testing CLIENT-IP behavior (${t})" + add_test_marker 10.53.0.2 + run_server clientip + $DIG $DIGOPTS l2.l1.l0 a @10.53.0.2 -p ${PORT} -b 10.53.0.4 > dig.out.${t} + grep "status: NOERROR" dig.out.${t} > /dev/null 2>&1 || { + echo_i "test $t failed: query failed" + status=1 + } + grep "^l2.l1.l0.[ ]*[0-9]*[ ]*IN[ ]*A[ ]*10.53.0.2" dig.out.${t} > /dev/null 2>&1 || { + echo_i "test $t failed: didn't get expected answer" + status=1 + } + + # Check CLIENT-IP behavior #2 + t=`expr $t + 1` + echo_i "testing CLIENT-IP behavior #2 (${t})" + add_test_marker 10.53.0.2 + run_server clientip2 + $DIG $DIGOPTS l2.l1.l0 a @10.53.0.2 -p ${PORT} -b 10.53.0.1 > dig.out.${t}.1 + grep "status: SERVFAIL" dig.out.${t}.1 > /dev/null 2>&1 || { + echo_i "test $t failed: query failed" + status=1 + } + $DIG $DIGOPTS l2.l1.l0 a @10.53.0.2 -p ${PORT} -b 10.53.0.2 > dig.out.${t}.2 + grep "status: NXDOMAIN" dig.out.${t}.2 > /dev/null 2>&1 || { + echo_i "test $t failed: query failed" + status=1 + } + $DIG $DIGOPTS l2.l1.l0 a @10.53.0.2 -p ${PORT} -b 10.53.0.3 > dig.out.${t}.3 + grep "status: NOERROR" dig.out.${t}.3 > /dev/null 2>&1 || { + echo_i "test $t failed: query failed" + status=1 + } + grep "^l2.l1.l0.[ ]*[0-9]*[ ]*IN[ ]*A[ ]*10.53.0.1" dig.out.${t}.3 > /dev/null 2>&1 || { + echo_i "test $t failed: didn't get expected answer" + status=1 + } + $DIG $DIGOPTS l2.l1.l0 a @10.53.0.2 -p ${PORT} -b 10.53.0.4 > dig.out.${t}.4 + grep "status: SERVFAIL" dig.out.${t}.4 > /dev/null 2>&1 || { + echo_i "test $t failed: query failed" + status=1 + } + + # Check RPZ log clause + t=`expr $t + 1` + echo_i "testing RPZ log clause (${t})" + add_test_marker 10.53.0.2 + run_server log + cur=`awk 'BEGIN {l=0} /^/ {l++} END { print l }' ns2/named.run` + $DIG $DIGOPTS l2.l1.l0 a @10.53.0.2 -p ${PORT} -b 10.53.0.4 > dig.out.${t} + $DIG $DIGOPTS l2.l1.l0 a @10.53.0.2 -p ${PORT} -b 10.53.0.3 >> dig.out.${t} + $DIG $DIGOPTS l2.l1.l0 a @10.53.0.2 -p ${PORT} -b 10.53.0.2 >> dig.out.${t} + sed -n "$cur,"'$p' < ns2/named.run | grep "view recursive: rpz CLIENT-IP Local-Data rewrite l2.l1.l0/A/IN via 32.4.0.53.10.rpz-client-ip.log1" > /dev/null && { + echo_ic "failed: unexpected rewrite message for policy zone log1 was logged" + status=1 + } + sed -n "$cur,"'$p' < ns2/named.run | grep "view recursive: rpz CLIENT-IP Local-Data rewrite l2.l1.l0/A/IN via 32.3.0.53.10.rpz-client-ip.log2" > /dev/null || { + echo_ic "failed: expected rewrite message for policy zone log2 was not logged" + status=1 + } + sed -n "$cur,"'$p' < ns2/named.run | grep "view recursive: rpz CLIENT-IP Local-Data rewrite l2.l1.l0/A/IN via 32.2.0.53.10.rpz-client-ip.log3" > /dev/null || { + echo_ic "failed: expected rewrite message for policy zone log3 was not logged" + status=1 + } + + # Check wildcard behavior + + t=`expr $t + 1` + echo_i "testing wildcard behavior with 1 RPZ zone (${t})" + add_test_marker 10.53.0.2 + run_server wildcard1 + $DIG $DIGOPTS www.test1.example.net a @10.53.0.2 -p ${PORT} > dig.out.${t}.1 + grep "status: NXDOMAIN" dig.out.${t}.1 > /dev/null || { + echo_i "test ${t} failed" + status=1 + } + $DIG $DIGOPTS test1.example.net a @10.53.0.2 -p ${PORT} > dig.out.${t}.2 + grep "status: NXDOMAIN" dig.out.${t}.2 > /dev/null || { + echo_i "test ${t} failed" + status=1 + } + + t=`expr $t + 1` + echo_i "testing wildcard behavior with 2 RPZ zones (${t})" + add_test_marker 10.53.0.2 + run_server wildcard2 + $DIG $DIGOPTS www.test1.example.net a @10.53.0.2 -p ${PORT} > dig.out.${t}.1 + grep "status: NXDOMAIN" dig.out.${t}.1 > /dev/null || { + echo_i "test ${t} failed" + status=1 + } + $DIG $DIGOPTS test1.example.net a @10.53.0.2 -p ${PORT} > dig.out.${t}.2 + grep "status: NXDOMAIN" dig.out.${t}.2 > /dev/null || { + echo_i "test ${t} failed" + status=1 + } + + t=`expr $t + 1` + echo_i "testing wildcard behavior with 1 RPZ zone and no non-wildcard triggers (${t})" + add_test_marker 10.53.0.2 + run_server wildcard3 + $DIG $DIGOPTS www.test1.example.net a @10.53.0.2 -p ${PORT} > dig.out.${t}.1 + grep "status: NXDOMAIN" dig.out.${t}.1 > /dev/null || { + echo_i "test ${t} failed" + status=1 + } + $DIG $DIGOPTS test1.example.net a @10.53.0.2 -p ${PORT} > dig.out.${t}.2 + grep "status: NOERROR" dig.out.${t}.2 > /dev/null || { + echo_i "test ${t} failed" + status=1 + } + + # Check for invalid prefix length error + t=`expr $t + 1` + echo_i "testing for invalid prefix length error (${t})" + add_test_marker 10.53.0.2 + run_server invalidprefixlength + grep "invalid rpz IP address \"1000.4.0.53.10.rpz-client-ip.invalidprefixlength\"; invalid prefix length of 1000$" ns2/named.run > /dev/null || { + echo_ic "failed: expected that invalid prefix length error would be logged" + status=1 + } + + t=`expr $t + 1` + echo_i "testing wildcard passthru before explicit drop (${t})" + add_test_marker 10.53.0.2 + run_server wildcard4 + $DIG $DIGOPTS example.com a @10.53.0.2 -p ${PORT} > dig.out.${t}.1 + grep "status: NOERROR" dig.out.${t}.1 > /dev/null || { + echo_i "test ${t} failed" + status=1 + } + $DIG $DIGOPTS www.example.com a @10.53.0.2 -p ${PORT} > dig.out.${t}.2 + grep "status: NOERROR" dig.out.${t}.2 > /dev/null || { + echo_i "test ${t} failed" + status=1 + } + + t=`expr $t + 1` + echo_i "checking 'nsip-wait-recurse no' is faster than 'nsip-wait-recurse yes' ($t)" + add_test_marker 10.53.0.2 10.53.0.3 + echo_i "timing 'nsip-wait-recurse yes' (default)" + ret=0 + t1=`$PERL -e 'print time()."\n";'` + $DIG -p ${PORT} @10.53.0.3 foo.child.example.tld a > dig.out.yes.$t + t2=`$PERL -e 'print time()."\n";'` + p1=`expr $t2 - $t1` + echo_i "elasped time $p1 seconds" + + $RNDC -c ../common/rndc.conf -s 10.53.0.3 -p ${CONTROLPORT} flush + copy_setports ns3/named2.conf.in ns3/named.conf + nextpart ns3/named.run > /dev/null + $RNDC -c ../common/rndc.conf -s 10.53.0.3 -p ${CONTROLPORT} reload > /dev/null + wait_for_log 20 "rpz: policy: reload done" ns3/named.run || ret=1 + + echo_i "timing 'nsip-wait-recurse no'" + t3=`$PERL -e 'print time()."\n";'` + $DIG -p ${PORT} @10.53.0.3 foo.child.example.tld a > dig.out.no.$t + t4=`$PERL -e 'print time()."\n";'` + p2=`expr $t4 - $t3` + echo_i "elasped time $p2 seconds" + + if test $p1 -le $p2; then ret=1; fi + if test $ret != 0; then echo_i "failed"; fi + status=`expr $status + $ret` + + [ $status -ne 0 ] && pf=fail || pf=pass + case $mode in + native) + native=$status + echo_i "status (native RPZ sub-test): $status ($pf)";; + dnsrps) + dnsrps=$status + echo_i "status (DNSRPS sub-test): $status ($pf)";; + *) echo_i "invalid test mode";; + esac +done +status=`expr ${native:-0} + ${dnsrps:-0}` + +[ $status -eq 0 ] || exit 1 |