summaryrefslogtreecommitdiffstats
path: root/bin/tests/system/rpz
diff options
context:
space:
mode:
Diffstat (limited to 'bin/tests/system/rpz')
-rw-r--r--bin/tests/system/rpz/Makefile.in48
-rw-r--r--bin/tests/system/rpz/README36
-rw-r--r--bin/tests/system/rpz/clean.sh57
-rw-r--r--bin/tests/system/rpz/dnsrps.c172
-rw-r--r--bin/tests/system/rpz/dnsrpzd-license.conf23
-rw-r--r--bin/tests/system/rpz/dnsrpzd.conf.in62
-rw-r--r--bin/tests/system/rpz/ns1/named.conf.in36
-rw-r--r--bin/tests/system/rpz/ns1/root.db42
-rw-r--r--bin/tests/system/rpz/ns10/hints13
-rw-r--r--bin/tests/system/rpz/ns10/named.conf.in42
-rw-r--r--bin/tests/system/rpz/ns10/stub.db21
-rw-r--r--bin/tests/system/rpz/ns2/base-tld2s.db26
-rw-r--r--bin/tests/system/rpz/ns2/bl.tld2.db.in21
-rw-r--r--bin/tests/system/rpz/ns2/blv2.tld2.db.in19
-rw-r--r--bin/tests/system/rpz/ns2/blv3.tld2.db.in21
-rw-r--r--bin/tests/system/rpz/ns2/hints13
-rw-r--r--bin/tests/system/rpz/ns2/named.conf.in55
-rw-r--r--bin/tests/system/rpz/ns2/stub.db20
-rw-r--r--bin/tests/system/rpz/ns2/tld2.db125
-rw-r--r--bin/tests/system/rpz/ns3/base.db24
-rw-r--r--bin/tests/system/rpz/ns3/broken.db.in18
-rw-r--r--bin/tests/system/rpz/ns3/crash118
-rw-r--r--bin/tests/system/rpz/ns3/crash224
-rw-r--r--bin/tests/system/rpz/ns3/hints13
-rw-r--r--bin/tests/system/rpz/ns3/manual-update-rpz-2.db.in22
-rw-r--r--bin/tests/system/rpz/ns3/manual-update-rpz.db.in21
-rw-r--r--bin/tests/system/rpz/ns3/mixed-case-rpz-1.db.in16
-rw-r--r--bin/tests/system/rpz/ns3/mixed-case-rpz-2.db.in17
-rw-r--r--bin/tests/system/rpz/ns3/named.conf.in160
-rw-r--r--bin/tests/system/rpz/ns4/hints13
-rw-r--r--bin/tests/system/rpz/ns4/named.conf.in45
-rw-r--r--bin/tests/system/rpz/ns4/tld4.db66
-rw-r--r--bin/tests/system/rpz/ns5/empty.db.in14
-rw-r--r--bin/tests/system/rpz/ns5/expire.conf.in19
-rw-r--r--bin/tests/system/rpz/ns5/fast-expire.db.in18
-rw-r--r--bin/tests/system/rpz/ns5/hints13
-rw-r--r--bin/tests/system/rpz/ns5/named.args2
-rw-r--r--bin/tests/system/rpz/ns5/named.conf.in91
-rw-r--r--bin/tests/system/rpz/ns5/tld5.db32
-rw-r--r--bin/tests/system/rpz/ns6/bl.tld2s.db.in20
-rw-r--r--bin/tests/system/rpz/ns6/hints13
-rw-r--r--bin/tests/system/rpz/ns6/named.conf.in67
-rw-r--r--bin/tests/system/rpz/ns7/hints13
-rw-r--r--bin/tests/system/rpz/ns7/named.conf.in59
-rw-r--r--bin/tests/system/rpz/ns8/hints13
-rw-r--r--bin/tests/system/rpz/ns8/manual-update-rpz.db.in21
-rw-r--r--bin/tests/system/rpz/ns8/named.conf.in66
-rw-r--r--bin/tests/system/rpz/ns9/hints13
-rw-r--r--bin/tests/system/rpz/ns9/named.conf.in60
-rw-r--r--bin/tests/system/rpz/ns9/rpz.db16
-rw-r--r--bin/tests/system/rpz/qperf.sh22
-rw-r--r--bin/tests/system/rpz/setup.sh180
-rw-r--r--bin/tests/system/rpz/test199
-rw-r--r--bin/tests/system/rpz/test277
-rw-r--r--bin/tests/system/rpz/test347
-rw-r--r--bin/tests/system/rpz/test436
-rw-r--r--bin/tests/system/rpz/test4a27
-rw-r--r--bin/tests/system/rpz/test560
-rw-r--r--bin/tests/system/rpz/test637
-rw-r--r--bin/tests/system/rpz/tests.sh1012
60 files changed, 3456 insertions, 0 deletions
diff --git a/bin/tests/system/rpz/Makefile.in b/bin/tests/system/rpz/Makefile.in
new file mode 100644
index 0000000..bc73907
--- /dev/null
+++ b/bin/tests/system/rpz/Makefile.in
@@ -0,0 +1,48 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+srcdir = @srcdir@
+VPATH = @srcdir@
+top_srcdir = @top_srcdir@
+
+VERSION=@BIND9_VERSION@
+
+@BIND9_MAKE_INCLUDES@
+
+CINCLUDES = ${ISC_INCLUDES} ${DNS_INCLUDES}
+
+CDEFINES =
+CWARNINGS =
+
+ISCLIBS = ../../../../lib/isc/libisc.@A@ @NO_LIBTOOL_ISCLIBS@
+
+ISCDEPLIBS = ../../../../lib/isc/libisc.@A@
+
+DEPLIBS = ${ISCDEPLIBS}
+
+LIBS = ${ISCLIBS} @LIBS@
+
+TARGETS = dnsrps@EXEEXT@
+
+DNSRPSOBJS = dnsrps.@O@
+
+SRCS = dnsrps.c
+
+@BIND9_MAKE_RULES@
+
+all: dnsrps@EXEEXT@
+
+dnsrps@EXEEXT@: ${DNSRPSOBJS} ${DEPLIBS}
+ ${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ ${DNSRPSOBJS} ${LIBS}
+
+clean distclean::
+ rm -f ${TARGETS}
+
diff --git a/bin/tests/system/rpz/README b/bin/tests/system/rpz/README
new file mode 100644
index 0000000..238e360
--- /dev/null
+++ b/bin/tests/system/rpz/README
@@ -0,0 +1,36 @@
+Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+
+SPDX-License-Identifier: MPL-2.0
+
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0. If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
+
+The test setup for the RPZ tests prepares a query perf tool and sets up
+policy zones.
+
+Name servers
+------------
+
+ns1 is the root server.
+
+ns2 and ns4 are authoritative servers for the various test domains.
+
+ns3 is the main rewriting resolver.
+
+ns5 and ns7 are additional rewriting resolvers.
+
+ns6 is a forwarding server.
+
+
+Updating the response policy zones
+----------------------------------
+
+test1, test2, test3, test4, test5, and test6 are dynamic update files. These
+updates are made against ns3. The script function "start_group" is called to
+start an new batch of tests that may depend on certain server updates. The
+function takes an optional file name and if provided the server updates are
+performed before executing the test batch.
diff --git a/bin/tests/system/rpz/clean.sh b/bin/tests/system/rpz/clean.sh
new file mode 100644
index 0000000..1a3127c
--- /dev/null
+++ b/bin/tests/system/rpz/clean.sh
@@ -0,0 +1,57 @@
+#!/bin/sh
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+# Clean up after rpz tests.
+
+USAGE="$0: [-Px]"
+DEBUG=
+while getopts "Px" c; do
+ case $c in
+ x) set -x ;;
+ P) PARTIAL=set ;;
+ *) echo "$USAGE" 1>&2; exit 1;;
+ esac
+done
+shift `expr $OPTIND - 1 || true`
+if test "$#" -ne 0; then
+ echo "$USAGE" 1>&2
+ exit 1
+fi
+
+# this might be called from setup.sh to partially clean up the files
+# from the first test pass so the second pass can be set up correctly.
+# remove those files first, then decide whether to remove the others.
+rm -f ns*/*.key ns*/*.private
+rm -f ns2/tld2s.db */bl.tld2.db */bl.tld2s.db
+rm -f ns3/bl*.db ns3/fast-expire.db ns*/empty.db
+rm -f ns3/manual-update-rpz.db
+rm -f ns3/mixed-case-rpz.db
+rm -f ns5/example.db ns5/bl.db ns5/fast-expire.db ns5/expire.conf
+rm -f ns8/manual-update-rpz.db
+rm -f */policy2.db
+rm -f */*.jnl
+
+if [ ${PARTIAL:-unset} = unset ]; then
+ rm -f proto.* dsset-* trusted.conf dig.out* nsupdate.tmp ns*/*tmp
+ rm -f ns5/requests ns5/*.perf
+ rm -f */named.memstats */*.run */*.run.prev */named.stats */session.key
+ rm -f */*.log */*core */*.pid
+ rm -f ns*/named.lock
+ rm -f ns*/named.conf
+ rm -f ns*/*switch
+ rm -f dnsrps*.conf
+ rm -f dnsrpzd.conf
+ rm -f dnsrpzd-license-cur.conf dnsrpzd.rpzf dnsrpzd.sock dnsrpzd.pid
+ rm -f ns*/managed-keys.bind*
+ rm -f tmp
+fi
diff --git a/bin/tests/system/rpz/dnsrps.c b/bin/tests/system/rpz/dnsrps.c
new file mode 100644
index 0000000..82ee05f
--- /dev/null
+++ b/bin/tests/system/rpz/dnsrps.c
@@ -0,0 +1,172 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/*
+ * -a exit(0) if dnsrps is available or dlopen() msg if not
+ * -p print the path to dnsrpzd configured in dnsrps so that
+ * dnsrpzd can be run by a setup.sh script.
+ * Exit(1) if dnsrps is not available
+ * -n domain print the serial number of a domain to check if a new
+ * version of a policy zone has been transferred to dnsrpzd.
+ * Exit(1) if dnsrps is not available
+ * -w sec.ond wait for seconds, because `sleep 0.1` is not portable
+ */
+
+#include <errno.h>
+#include <inttypes.h>
+#include <stdbool.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <unistd.h>
+
+#include <isc/print.h>
+#include <isc/util.h>
+
+#ifdef USE_DNSRPS
+#define LIBRPZ_LIB_OPEN DNSRPS_LIB_OPEN
+#include <dns/librpz.h>
+
+librpz_t *librpz;
+#else /* ifdef USE_DNSRPS */
+typedef struct {
+ char c[120];
+} librpz_emsg_t;
+#endif /* ifdef USE_DNSRPS */
+
+static bool
+link_dnsrps(librpz_emsg_t *emsg);
+
+#define USAGE "usage: [-ap] [-n domain] [-w sec.onds]\n"
+
+int
+main(int argc, char **argv) {
+#ifdef USE_DNSRPS
+ char cstr[sizeof("zone ") + 1024 + 10];
+ librpz_clist_t *clist;
+ librpz_client_t *client;
+ librpz_rsp_t *rsp;
+ uint32_t serial;
+#endif /* ifdef USE_DNSRPS */
+ double seconds;
+ librpz_emsg_t emsg;
+ char *p;
+ int i;
+
+ while ((i = getopt(argc, argv, "apn:w:")) != -1) {
+ switch (i) {
+ case 'a':
+ if (!link_dnsrps(&emsg)) {
+ printf("I:%s\n", emsg.c);
+ return (1);
+ }
+ return (0);
+
+ case 'p':
+ if (!link_dnsrps(&emsg)) {
+ fprintf(stderr, "## %s\n", emsg.c);
+ return (1);
+ }
+#ifdef USE_DNSRPS
+ printf("%s\n", librpz->dnsrpzd_path);
+#else /* ifdef USE_DNSRPS */
+ UNREACHABLE();
+#endif /* ifdef USE_DNSRPS */
+ return (0);
+
+ case 'n':
+ if (!link_dnsrps(&emsg)) {
+ fprintf(stderr, "## %s\n", emsg.c);
+ return (1);
+ }
+#ifdef USE_DNSRPS
+ /*
+ * Get the serial number of a policy zone from
+ * a running dnsrpzd daemon.
+ */
+ clist = librpz->clist_create(&emsg, NULL, NULL, NULL,
+ NULL, NULL);
+ if (clist == NULL) {
+ fprintf(stderr, "## %s: %s\n", optarg, emsg.c);
+ return (1);
+ }
+ snprintf(cstr, sizeof(cstr),
+ "zone %s; dnsrpzd \"\";"
+ " dnsrpzd-sock dnsrpzd.sock;"
+ " dnsrpzd-rpzf dnsrpzd.rpzf",
+ optarg);
+ client = librpz->client_create(&emsg, clist, cstr,
+ true);
+ if (client == NULL) {
+ fprintf(stderr, "## %s\n", emsg.c);
+ return (1);
+ }
+
+ rsp = NULL;
+ if (!librpz->rsp_create(&emsg, &rsp, NULL, client, true,
+ false) ||
+ rsp == NULL)
+ {
+ fprintf(stderr, "## %s\n", emsg.c);
+ librpz->client_detach(&client);
+ return (1);
+ }
+
+ if (!librpz->soa_serial(&emsg, &serial, optarg, rsp)) {
+ fprintf(stderr, "## %s\n", emsg.c);
+ librpz->client_detach(&client);
+ return (1);
+ }
+ librpz->rsp_detach(&rsp);
+ librpz->client_detach(&client);
+ printf("%u\n", serial);
+#else /* ifdef USE_DNSRPS */
+ UNREACHABLE();
+#endif /* ifdef USE_DNSRPS */
+ return (0);
+
+ case 'w':
+ seconds = strtod(optarg, &p);
+ if (seconds <= 0 || *p != '\0') {
+ fputs(USAGE, stderr);
+ return (1);
+ }
+ usleep((int)(seconds * 1000.0 * 1000.0));
+ return (0);
+
+ default:
+ fputs(USAGE, stderr);
+ return (1);
+ }
+ }
+ fputs(USAGE, stderr);
+ return (1);
+}
+
+static bool
+link_dnsrps(librpz_emsg_t *emsg) {
+#ifdef USE_DNSRPS
+ librpz = librpz_lib_open(emsg, NULL, DNSRPS_LIBRPZ_PATH);
+ if (librpz == NULL) {
+ return (false);
+ }
+
+ return (true);
+#else /* ifdef USE_DNSRPS */
+ snprintf(emsg->c, sizeof(emsg->c), "DNSRPS not configured");
+ return (false);
+#endif /* ifdef USE_DNSRPS */
+}
diff --git a/bin/tests/system/rpz/dnsrpzd-license.conf b/bin/tests/system/rpz/dnsrpzd-license.conf
new file mode 100644
index 0000000..d9cf2b5
--- /dev/null
+++ b/bin/tests/system/rpz/dnsrpzd-license.conf
@@ -0,0 +1,23 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+zone isc.license.fastrpz.com {
+ masters port 53 {
+ KEY farsight_fastrpz_license 104.244.14.176;
+ KEY farsight_fastrpz_license 2620:11c:f008::176;
+ };
+};
+
+key farsight_fastrpz_license {
+ algorithm hmac-sha256; secret "f405d02b4c8af54855fcebc1";
+};
diff --git a/bin/tests/system/rpz/dnsrpzd.conf.in b/bin/tests/system/rpz/dnsrpzd.conf.in
new file mode 100644
index 0000000..ce2442c
--- /dev/null
+++ b/bin/tests/system/rpz/dnsrpzd.conf.in
@@ -0,0 +1,62 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+# dnsrpzd configuration.
+
+pid-file ../dnsrpzd.pid
+
+include ../dnsrpzd-license-cur.conf
+
+# configure NOTIFY and zone transfers
+port @EXTRAPORT1@;
+listen-on port @EXTRAPORT1@ { 10.53.0.3; };
+allow-notify { 10.53.0.0/24; };
+
+zone "bl0" {type primary; file "../ns5/bl.db"; };
+zone "bl1" {type primary; file "../ns5/bl.db"; };
+zone "bl2" {type primary; file "../ns5/bl.db"; };
+zone "bl3" {type primary; file "../ns5/bl.db"; };
+zone "bl4" {type primary; file "../ns5/bl.db"; };
+zone "bl5" {type primary; file "../ns5/bl.db"; };
+zone "bl6" {type primary; file "../ns5/bl.db"; };
+zone "bl7" {type primary; file "../ns5/bl.db"; };
+zone "bl8" {type primary; file "../ns5/bl.db"; };
+zone "bl9" {type primary; file "../ns5/bl.db"; };
+zone "bl10" {type primary; file "../ns5/bl.db"; };
+zone "bl11" {type primary; file "../ns5/bl.db"; };
+zone "bl12" {type primary; file "../ns5/bl.db"; };
+zone "bl13" {type primary; file "../ns5/bl.db"; };
+zone "bl14" {type primary; file "../ns5/bl.db"; };
+zone "bl15" {type primary; file "../ns5/bl.db"; };
+zone "bl16" {type primary; file "../ns5/bl.db"; };
+zone "bl17" {type primary; file "../ns5/bl.db"; };
+zone "bl18" {type primary; file "../ns5/bl.db"; };
+zone "bl19" {type primary; file "../ns5/bl.db"; };
+
+zone "bl" {type slave; masters port @PORT@ { 10.53.0.3; }; };
+zone "bl-2" {type slave; masters port @PORT@ { 10.53.0.3; }; };
+zone "bl-given" {type slave; masters port @PORT@ { 10.53.0.3; }; };
+zone "bl-passthru" {type slave; masters port @PORT@ { 10.53.0.3; }; };
+zone "bl-no-op" {type slave; masters port @PORT@ { 10.53.0.3; }; };
+zone "bl-disabled" {type slave; masters port @PORT@ { 10.53.0.3; }; };
+zone "bl-nodata" {type slave; masters port @PORT@ { 10.53.0.3; }; };
+zone "bl-nxdomain" {type slave; masters port @PORT@ { 10.53.0.3; }; };
+zone "bl-cname" {type slave; masters port @PORT@ { 10.53.0.3; }; };
+zone "bl-wildcname" {type slave; masters port @PORT@ { 10.53.0.3; }; };
+zone "bl-garden" {type slave; masters port @PORT@ { 10.53.0.3; }; };
+zone "bl-drop" {type slave; masters port @PORT@ { 10.53.0.3; }; };
+zone "bl-tcp-only" {type slave; masters port @PORT@ { 10.53.0.3; }; };
+zone "bl.tld2" {type slave; masters port @PORT@ { 10.53.0.3; }; };
+
+zone "policy1" {type slave; masters port @PORT@ { 10.53.0.6; }; };
+zone "policy2" {type slave; masters port @PORT@ { 10.53.0.7; }; };
diff --git a/bin/tests/system/rpz/ns1/named.conf.in b/bin/tests/system/rpz/ns1/named.conf.in
new file mode 100644
index 0000000..439ecff
--- /dev/null
+++ b/bin/tests/system/rpz/ns1/named.conf.in
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+ query-source address 10.53.0.1;
+ notify-source 10.53.0.1;
+ transfer-source 10.53.0.1;
+ port @PORT@;
+ session-keyfile "session.key";
+ pid-file "named.pid";
+ listen-on { 10.53.0.1; };
+ listen-on-v6 { none; };
+ notify no;
+ minimal-responses no;
+};
+
+key rndc_key {
+ secret "1234abcd8765";
+ algorithm hmac-sha256;
+};
+
+controls {
+ inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+zone "." {type primary; file "root.db";};
diff --git a/bin/tests/system/rpz/ns1/root.db b/bin/tests/system/rpz/ns1/root.db
new file mode 100644
index 0000000..6bf3d5a
--- /dev/null
+++ b/bin/tests/system/rpz/ns1/root.db
@@ -0,0 +1,42 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 120
+. SOA ns. hostmaster.ns. ( 1 3600 1200 604800 60 )
+ NS ns.
+ns. A 10.53.0.1
+
+; rewrite responses from this zone
+tld2. NS ns.tld2.
+ns.tld2. A 10.53.0.2
+
+; rewrite responses from this secure zone unless dnssec requested (DO=1)
+tld2s. NS ns.tld2.
+
+; requests come from here
+tld3. NS ns.tld3.
+ns.tld3. A 10.53.0.3
+
+; rewrite responses from this zone
+tld4. NS ns.tld4.
+ns.tld4. A 10.53.0.4
+
+; performance test
+tld5. NS ns.tld5.
+ns.tld5. A 10.53.0.5
+
+; generate SERVFAIL
+servfail NS ns.tld2.
+
+a-only.example A 1.2.3.4
+no-a-no-aaaa.example TXT placeholder
+a-plus-aaaa.example A 1.2.3.4
+a-plus-aaaa.example AAAA ::1
diff --git a/bin/tests/system/rpz/ns10/hints b/bin/tests/system/rpz/ns10/hints
new file mode 100644
index 0000000..b657c39
--- /dev/null
+++ b/bin/tests/system/rpz/ns10/hints
@@ -0,0 +1,13 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+. 120 NS ns.
+ns. 120 A 10.53.0.1
diff --git a/bin/tests/system/rpz/ns10/named.conf.in b/bin/tests/system/rpz/ns10/named.conf.in
new file mode 100644
index 0000000..b34ce79
--- /dev/null
+++ b/bin/tests/system/rpz/ns10/named.conf.in
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+ query-source address 10.53.0.10;
+ notify-source 10.53.0.10;
+ transfer-source 10.53.0.10;
+ port @PORT@;
+ pid-file "named.pid";
+ session-keyfile "session.key";
+ listen-on { 10.53.0.10; };
+ listen-on-v6 { none; };
+ notify no;
+ minimal-responses no;
+ recursion yes;
+ dnssec-validation yes;
+};
+
+key rndc_key {
+ secret "1234abcd8765";
+ algorithm hmac-sha256;
+};
+controls {
+ inet 10.53.0.10 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+include "../trusted.conf";
+zone "." { type hint; file "hints"; };
+
+# grafted on zones using stub and static-stub
+zone "stub-nomatch." {type primary; file "stub.db"; };
+zone "static-stub-nomatch." {type primary; file "stub.db"; };
diff --git a/bin/tests/system/rpz/ns10/stub.db b/bin/tests/system/rpz/ns10/stub.db
new file mode 100644
index 0000000..8ecac8c
--- /dev/null
+++ b/bin/tests/system/rpz/ns10/stub.db
@@ -0,0 +1,21 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+; RPZ rewrite responses from this zone
+
+$TTL 120
+@ SOA ns hostmaster.ns ( 1 3600 1200 604800 60 )
+ NS ns
+ns A 10.53.0.10
+
+a3-1 A 10.53.99.99
+
+a4-1 A 10.53.99.99
diff --git a/bin/tests/system/rpz/ns2/base-tld2s.db b/bin/tests/system/rpz/ns2/base-tld2s.db
new file mode 100644
index 0000000..77114ec
--- /dev/null
+++ b/bin/tests/system/rpz/ns2/base-tld2s.db
@@ -0,0 +1,26 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+; RPZ rewrite responses from this signed zone
+
+$TTL 120
+@ SOA tld2s. hostmaster.ns.tld2. ( 1 3600 1200 604800 60 )
+ NS ns
+ NS . ; check for RT 24985
+ns A 10.53.0.2
+
+
+a0-1 A 192.168.0.1
+a0-1-scname CNAME a0-1.tld2.
+
+a3-5 A 192.168.3.5
+
+a7-2 A 192.168.7.2
diff --git a/bin/tests/system/rpz/ns2/bl.tld2.db.in b/bin/tests/system/rpz/ns2/bl.tld2.db.in
new file mode 100644
index 0000000..25780b7
--- /dev/null
+++ b/bin/tests/system/rpz/ns2/bl.tld2.db.in
@@ -0,0 +1,21 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+; primary for secondary RPZ zone
+
+$TTL 3600
+@ SOA rpz.tld2. hostmaster.ns.tld2. ( 1 3600 1200 604800 60 )
+ NS ns2
+ NS ns3
+ns2 A 10.53.0.2
+ns3 A 10.53.0.3
+
+32.1.7.168.192.rpz-ip CNAME .
diff --git a/bin/tests/system/rpz/ns2/blv2.tld2.db.in b/bin/tests/system/rpz/ns2/blv2.tld2.db.in
new file mode 100644
index 0000000..123e1b4
--- /dev/null
+++ b/bin/tests/system/rpz/ns2/blv2.tld2.db.in
@@ -0,0 +1,19 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+; primary for secondary RPZ zone
+
+$TTL 3600
+@ SOA rpz.tld2. hostmaster.ns.tld2. ( 2 3600 1200 604800 60 )
+ NS ns2
+ NS ns3
+ns2 A 10.53.0.2
+ns3 A 10.53.0.3
diff --git a/bin/tests/system/rpz/ns2/blv3.tld2.db.in b/bin/tests/system/rpz/ns2/blv3.tld2.db.in
new file mode 100644
index 0000000..b8ba587
--- /dev/null
+++ b/bin/tests/system/rpz/ns2/blv3.tld2.db.in
@@ -0,0 +1,21 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+; primary for secondary RPZ zone
+
+$TTL 3600
+@ SOA rpz.tld2. hostmaster.ns.tld2. ( 3 3600 1200 604800 60 )
+ NS ns2
+ NS ns3
+ns2 A 10.53.0.2
+ns3 A 10.53.0.3
+
+32.1.7.168.192.rpz-ip CNAME .
diff --git a/bin/tests/system/rpz/ns2/hints b/bin/tests/system/rpz/ns2/hints
new file mode 100644
index 0000000..b657c39
--- /dev/null
+++ b/bin/tests/system/rpz/ns2/hints
@@ -0,0 +1,13 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+. 120 NS ns.
+ns. 120 A 10.53.0.1
diff --git a/bin/tests/system/rpz/ns2/named.conf.in b/bin/tests/system/rpz/ns2/named.conf.in
new file mode 100644
index 0000000..1dde354
--- /dev/null
+++ b/bin/tests/system/rpz/ns2/named.conf.in
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+ query-source address 10.53.0.2;
+ notify-source 10.53.0.2;
+ transfer-source 10.53.0.2;
+ port @PORT@;
+ pid-file "named.pid";
+ session-keyfile "session.key";
+ listen-on { 10.53.0.2; };
+ listen-on-v6 { none; };
+ notify no;
+ minimal-responses no;
+ recursion yes;
+ dnssec-validation yes;
+};
+
+key rndc_key {
+ secret "1234abcd8765";
+ algorithm hmac-sha256;
+};
+controls {
+ inet 10.53.0.2 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+include "../trusted.conf";
+zone "." { type hint; file "hints"; };
+
+zone "tld2." {type primary; file "tld2.db";};
+zone "sub1.tld2." {type primary; file "tld2.db";};
+zone "subsub.sub1.tld2." {type primary; file "tld2.db";};
+zone "sub2.tld2." {type primary; file "tld2.db";};
+zone "subsub.sub2.tld2." {type primary; file "tld2.db";};
+zone "sub3.tld2." {type primary; file "tld2.db";};
+zone "subsub.sub3.tld2." {type primary; file "tld2.db";};
+
+zone "tld2s." {type primary; file "tld2s.db";};
+
+zone "bl.tld2." {type primary; file "bl.tld2.db";
+ notify yes; notify-delay 0;};
+
+# grafted on zones using stub and static-stub
+zone "stub." {type primary; file "stub.db"; };
+zone "static-stub." {type primary; file "stub.db"; };
diff --git a/bin/tests/system/rpz/ns2/stub.db b/bin/tests/system/rpz/ns2/stub.db
new file mode 100644
index 0000000..e4b8781
--- /dev/null
+++ b/bin/tests/system/rpz/ns2/stub.db
@@ -0,0 +1,20 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+; RPZ rewrite responses from this zone
+
+$TTL 120
+@ SOA tld2. hostmaster.ns.tld2. ( 1 3600 1200 604800 60 )
+ NS ns.sub1.tld2.
+
+a3-1 A 10.53.99.99
+
+a4-1 A 10.53.99.99
diff --git a/bin/tests/system/rpz/ns2/tld2.db b/bin/tests/system/rpz/ns2/tld2.db
new file mode 100644
index 0000000..c6f2556
--- /dev/null
+++ b/bin/tests/system/rpz/ns2/tld2.db
@@ -0,0 +1,125 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+; RPZ rewrite responses from this zone
+
+$TTL 120
+@ SOA tld2. hostmaster.ns.tld2. ( 1 3600 1200 604800 60 )
+ NS ns
+ NS . ; check for RT 24985
+ns A 10.53.0.2
+
+
+txt-only TXT "txt-only-tld2"
+
+a12 A 12.12.12.12
+ AAAA 2001::12
+ TXT "a12 tld2 text"
+a12-cname CNAME a12
+
+a0-1 A 192.168.0.1
+ AAAA 2001:2::1
+ TXT "a0-1 tld2 text"
+a0-1-scname CNAME a0-1.tld2s.
+
+
+a3-1 A 192.168.3.1
+ AAAA 2001:2:3::1
+ TXT "a3-1 tld2 text"
+
+a3-2 A 192.168.3.2
+ AAAA 2001:2:3::2
+ TXT "a3-2 tld2 text"
+
+a3-3 A 192.168.3.3
+ AAAA 2001:2:3::3
+ TXT "a3-3 tld2 text"
+
+a3-4 A 192.168.3.4
+ AAAA 2001:2:3::4
+ TXT "a3-4 tld2 text"
+
+a3-5 A 192.168.3.5
+ AAAA 2001:2:3::5
+ TXT "a3-5 tld2 text"
+
+a3-6 A 192.168.3.6
+ AAAA 2001:2:3::6
+ TXT "a3-6 tld2 text"
+
+a3-7 A 192.168.3.7
+ AAAA 2001:2:3::7
+ TXT "a3-7 tld2 text"
+
+a3-8 A 192.168.3.8
+ AAAA 2001:2:3::8
+ TXT "a3-8 tld2 text"
+
+a3-9 A 192.168.3.9
+ AAAA 2001:2:3::9
+ TXT "a3-9 tld2 text"
+
+a4-1 A 192.168.4.1
+ AAAA 2001:2:4::1
+ TXT "a4-1 tld2 text"
+a4-1-aaaa AAAA 2001:2:4::1
+
+a4-2 A 192.168.4.2
+ AAAA 2001:2:4::2
+ TXT "a4-2 tld2 text"
+a4-2-cname CNAME a4-2
+
+a4-3 A 192.168.4.3
+ AAAA 2001:2:4::3
+ TXT "a4-3 tld2 text"
+a4-3-cname CNAME a4-3
+
+a4-4 A 192.168.4.4
+ AAAA 2001:2:4::4
+ TXT "a4-4 tld2 text"
+
+a4-5 A 192.168.4.5
+ AAAA 2001:2:4::5
+ TXT "a4-5 tld2 text"
+a4-5-cname CNAME a4-5
+a4-5-cname2 CNAME a4-5-cname
+a4-5-cname3 CNAME a4-5-cname2
+
+a4-6 A 192.168.4.6
+ AAAA 2001:2:4::6
+ TXT "a4-6 tld2 text"
+a4-6-cname CNAME a4-6
+a4-6-cname2 CNAME a4-6-cname
+a4-6-cname3 CNAME a4-6-cname2
+
+a5-1-2 A 192.168.5.1
+ A 192.168.5.2
+ TXT "a5-1-2 tld2 text"
+
+a5-2 A 192.168.5.2
+ TXT "a5-2 tld2 text"
+
+a5-3 A 192.168.5.3
+ TXT "a5-3 tld2 text"
+
+a5-4 A 192.168.5.4
+ TXT "a5-4 tld2 text"
+
+a6-1 A 192.168.6.1
+ TXT "a6-1 tld2 text"
+a6-2 A 192.168.6.2
+ TXT "a6-2 tld2 text"
+
+a7-1 A 192.168.7.1
+ TXT "a7-1 tld2 text"
+
+a7-2 A 192.168.7.2
+ TXT "a7-2 tld2 text"
diff --git a/bin/tests/system/rpz/ns3/base.db b/bin/tests/system/rpz/ns3/base.db
new file mode 100644
index 0000000..f2f15a0
--- /dev/null
+++ b/bin/tests/system/rpz/ns3/base.db
@@ -0,0 +1,24 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+; RPZ test
+; This basic file is copied to several zone files before being used.
+; Its contents are also changed with nsupdate
+
+
+$TTL 300
+@ SOA blx. hostmaster.ns.blx. ( 1 3600 1200 604800 60 )
+ NS ns.tld3.
+
+; regression testing for some old crashes
+example.com NS example.org.
+
+domain.com cname foobar.com
diff --git a/bin/tests/system/rpz/ns3/broken.db.in b/bin/tests/system/rpz/ns3/broken.db.in
new file mode 100644
index 0000000..80aa313
--- /dev/null
+++ b/bin/tests/system/rpz/ns3/broken.db.in
@@ -0,0 +1,18 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+; RPZ test
+; This basic file is copied to several zone files before being used.
+; Its contents are also changed with nsupdate
+
+
+; broken zone
+foobar
diff --git a/bin/tests/system/rpz/ns3/crash1 b/bin/tests/system/rpz/ns3/crash1
new file mode 100644
index 0000000..0c85191
--- /dev/null
+++ b/bin/tests/system/rpz/ns3/crash1
@@ -0,0 +1,18 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+
+; a bad zone that caused a crash related to dns_rdataset_disassociate()
+
+$TTL 120
+@ SOA crash1.tld2. hostmaster.ns.tld2. ( 1 3600 1200 604800 60 )
+
+ NS tld2.
diff --git a/bin/tests/system/rpz/ns3/crash2 b/bin/tests/system/rpz/ns3/crash2
new file mode 100644
index 0000000..ab70283
--- /dev/null
+++ b/bin/tests/system/rpz/ns3/crash2
@@ -0,0 +1,24 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+
+; a valid zone containing records that caused crashes
+
+$TTL 120
+@ SOA crash2.tld3. hostmaster.ns.tld3. ( 1 3600 1200 604800 60 )
+ NS ns
+ns A 10.53.0.3
+
+; #24 in test1, crashed new ASSERT() in rbtdb.c
+c1 A 172.16.1.24
+
+; #16 in test2, crashed new ASSERT() in rbtdb.c
+c2 A 172.16.1.16
diff --git a/bin/tests/system/rpz/ns3/hints b/bin/tests/system/rpz/ns3/hints
new file mode 100644
index 0000000..b657c39
--- /dev/null
+++ b/bin/tests/system/rpz/ns3/hints
@@ -0,0 +1,13 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+. 120 NS ns.
+ns. 120 A 10.53.0.1
diff --git a/bin/tests/system/rpz/ns3/manual-update-rpz-2.db.in b/bin/tests/system/rpz/ns3/manual-update-rpz-2.db.in
new file mode 100644
index 0000000..f670b0c
--- /dev/null
+++ b/bin/tests/system/rpz/ns3/manual-update-rpz-2.db.in
@@ -0,0 +1,22 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+; RPZ test
+; This basic file is copied to several zone files before being used.
+; Its contents are also changed with nsupdate
+
+
+$TTL 300
+@ SOA bl-reload. hostmaster.ns.bl-reload. ( 2 3600 1200 604800 60 )
+ NS ns.tld3.
+
+walled.tld2.bl-reload. 300 A 10.0.0.2
+
diff --git a/bin/tests/system/rpz/ns3/manual-update-rpz.db.in b/bin/tests/system/rpz/ns3/manual-update-rpz.db.in
new file mode 100644
index 0000000..a823448
--- /dev/null
+++ b/bin/tests/system/rpz/ns3/manual-update-rpz.db.in
@@ -0,0 +1,21 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+; RPZ test
+; This basic file is copied to several zone files before being used.
+; Its contents are also changed with nsupdate
+
+
+$TTL 300
+@ SOA manual-update-rpz. hostmaster.ns.manual-rpz-update. ( 1 3600 1200 604800 60 )
+ NS ns.tld3.
+
+walled.tld2.manual-update-rpz. 300 A 10.0.0.1
diff --git a/bin/tests/system/rpz/ns3/mixed-case-rpz-1.db.in b/bin/tests/system/rpz/ns3/mixed-case-rpz-1.db.in
new file mode 100644
index 0000000..c8548fc
--- /dev/null
+++ b/bin/tests/system/rpz/ns3/mixed-case-rpz-1.db.in
@@ -0,0 +1,16 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+@ SOA mixed-case-rpz. hostmaster.ns.mixed-case-rpz. ( 1 3600 1200 604800 60 )
+ NS ns.tld3.
+
+A6-2.TLD2 CNAME .
diff --git a/bin/tests/system/rpz/ns3/mixed-case-rpz-2.db.in b/bin/tests/system/rpz/ns3/mixed-case-rpz-2.db.in
new file mode 100644
index 0000000..7d99c5a
--- /dev/null
+++ b/bin/tests/system/rpz/ns3/mixed-case-rpz-2.db.in
@@ -0,0 +1,17 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+@ SOA mixed-case-rpz. hostmaster.ns.mixed-case-rpz. ( 2 3600 1200 604800 60 )
+ NS ns.tld3.
+
+a6-1.tld2 CNAME .
+A6-2.TLD2 CNAME .
diff --git a/bin/tests/system/rpz/ns3/named.conf.in b/bin/tests/system/rpz/ns3/named.conf.in
new file mode 100644
index 0000000..dc069d8
--- /dev/null
+++ b/bin/tests/system/rpz/ns3/named.conf.in
@@ -0,0 +1,160 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/*
+ * Main rpz test DNS server.
+ */
+
+options {
+ query-source address 10.53.0.3;
+ notify-source 10.53.0.3;
+ transfer-source 10.53.0.3;
+ port @PORT@;
+ pid-file "named.pid";
+ statistics-file "named.stats";
+ session-keyfile "session.key";
+ listen-on { 10.53.0.3; };
+ listen-on-v6 { none; };
+ notify yes;
+ minimal-responses no;
+ recursion yes;
+ dnssec-validation yes;
+ min-refresh-time 1;
+ min-retry-time 1;
+
+ response-policy {
+ zone "fast-expire";
+ zone "bl" max-policy-ttl 100;
+ zone "bl-2";
+ zone "bl-given" policy given recursive-only yes;
+ zone "bl-passthru" policy passthru;
+ zone "bl-no-op" policy no-op; # obsolete for passthru
+ zone "bl-disabled" policy disabled;
+ zone "bl-nodata" policy nodata recursive-only no;
+ zone "bl-nxdomain" policy nxdomain;
+ zone "bl-cname" policy cname txt-only.tld2.;
+ zone "bl-wildcname" policy cname *.tld4.;
+ zone "bl-garden" policy cname a12.tld2.;
+ zone "bl-drop" policy drop;
+ zone "bl-tcp-only" policy tcp-only;
+ zone "bl.tld2";
+ zone "manual-update-rpz";
+ zone "mixed-case-rpz";
+ }
+ add-soa yes
+ min-ns-dots 0
+ qname-wait-recurse yes
+ min-update-interval 0
+ nsdname-enable yes
+ nsip-enable yes
+ ;
+
+ include "../dnsrps.conf";
+ also-notify { 10.53.0.3 port @EXTRAPORT1@; };
+ notify-delay 0;
+};
+
+logging { category rpz { default_debug; }; };
+
+key rndc_key {
+ secret "1234abcd8765";
+ algorithm hmac-sha256;
+};
+controls {
+ inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+
+zone "." { type hint; file "hints"; };
+
+zone "bl." {type primary; file "bl.db";
+ allow-update {any;};};
+zone "bl-2." {type primary; file "bl-2.db";
+ allow-update {any;};};
+zone "bl-given." {type primary; file "bl-given.db";
+ allow-update {any;};};
+zone "bl-passthru." {type primary; file "bl-passthru.db";
+ allow-update {any;};};
+zone "bl-no-op." {type primary; file "bl-no-op.db";
+ allow-update {any;};};
+zone "bl-disabled." {type primary; file "bl-disabled.db";
+ allow-update {any;};};
+zone "bl-nodata." {type primary; file "bl-nodata.db";
+ allow-update {any;};};
+zone "bl-nxdomain." {type primary; file "bl-nxdomain.db";
+ allow-update {any;};};
+zone "bl-cname." {type primary; file "bl-cname.db";
+ allow-update {any;};};
+zone "bl-wildcname." {type primary; file "bl-wildcname.db";
+ allow-update {any;};};
+zone "bl-garden." {type primary; file "bl-garden.db";
+ allow-update {any;};};
+zone "bl-drop." {type primary; file "bl-drop.db";
+ allow-update {any;};};
+zone "bl-tcp-only." {type primary; file "bl-tcp-only.db";
+ allow-update {any;};};
+
+zone "bl.tld2." {type secondary; file "bl.tld2.db"; primaries {10.53.0.2;};
+ request-ixfr no; masterfile-format text;};
+
+zone "crash1.tld2" {type primary; file "crash1"; notify no;};
+zone "crash2.tld3." {type primary; file "crash2"; notify no;};
+
+zone "manual-update-rpz." {
+ type primary;
+ file "manual-update-rpz.db";
+ notify no;
+};
+
+zone "mixed-case-rpz." {
+ type primary;
+ file "mixed-case-rpz.db";
+ notify no;
+};
+
+zone "fast-expire." {
+ type secondary;
+ file "fast-expire.db";
+ primaries { 10.53.0.5; };
+ notify no;
+};
+
+zone "stub." {
+ type stub;
+ primaries { 10.53.0.2; };
+};
+
+zone "static-stub." {
+ type static-stub;
+ server-addresses { 10.53.0.2; };
+};
+
+zone "stub-nomatch." {
+ type stub;
+ primaries { 10.53.0.10; };
+};
+
+zone "static-stub-nomatch." {
+ type static-stub;
+ server-addresses { 10.53.0.10; };
+};
+
+# A faulty dlz configuration to check if named with response policy zones
+# survives a certain class of failed configuration attempts (see GL #3880).
+# "dlz" is used because the dlz processing code is located in an ideal place in
+# the view configuration function for the test to cover the view reverting code.
+# The "BAD" comments below are necessary, because they will be removed using
+# 'sed' by tests.sh in order to activate the faulty configuration.
+#BAD dlz "bad-dlz" {
+#BAD database "dlopen bad-dlz.so example.org";
+#BAD };
diff --git a/bin/tests/system/rpz/ns4/hints b/bin/tests/system/rpz/ns4/hints
new file mode 100644
index 0000000..b657c39
--- /dev/null
+++ b/bin/tests/system/rpz/ns4/hints
@@ -0,0 +1,13 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+. 120 NS ns.
+ns. 120 A 10.53.0.1
diff --git a/bin/tests/system/rpz/ns4/named.conf.in b/bin/tests/system/rpz/ns4/named.conf.in
new file mode 100644
index 0000000..e2a9546
--- /dev/null
+++ b/bin/tests/system/rpz/ns4/named.conf.in
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+ query-source address 10.53.0.4;
+ notify-source 10.53.0.4;
+ transfer-source 10.53.0.4;
+ port @PORT@;
+ pid-file "named.pid";
+ session-keyfile "session.key";
+ listen-on { 10.53.0.4; };
+ listen-on-v6 { none; };
+ notify no;
+ minimal-responses no;
+ recursion yes;
+ dnssec-validation yes;
+};
+
+key rndc_key {
+ secret "1234abcd8765";
+ algorithm hmac-sha256;
+};
+
+controls {
+ inet 10.53.0.4 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+include "../trusted.conf";
+zone "." { type hint; file "hints"; };
+
+zone "tld4." {type primary; file "tld4.db";};
+zone "sub1.tld4." {type primary; file "tld4.db";};
+zone "subsub.sub1.tld4." {type primary; file "tld4.db";};
+zone "sub2.tld4." {type primary; file "tld4.db";};
+zone "subsub.sub2.tld4." {type primary; file "tld4.db";};
diff --git a/bin/tests/system/rpz/ns4/tld4.db b/bin/tests/system/rpz/ns4/tld4.db
new file mode 100644
index 0000000..fca419c
--- /dev/null
+++ b/bin/tests/system/rpz/ns4/tld4.db
@@ -0,0 +1,66 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+; RPZ rewrite responses from this zone
+
+$TTL 120
+@ SOA tld4. hostmaster.ns.tld4. ( 1 3600 1200 604800 60 )
+ NS ns
+ns A 10.53.0.4
+
+
+txt-only TXT "txt-only-tld4"
+
+a14 A 14.14.14.14
+ AAAA 2001::14
+ TXT "a14 text"
+a14-cname CNAME a14
+
+a0-1 A 192.168.0.1
+ AAAA 2001:2::1
+ TXT "a0-1 text"
+
+a3-1 A 192.168.3.1
+ AAAA 2001:2:3::1
+ TXT "a3-1 text"
+
+a3-2 A 192.168.3.2
+ AAAA 2001:2:3::2
+ TXT "a3-2 text"
+
+a4-1 A 192.168.4.1
+ AAAA 2001:2:4::1
+ TXT "a4-1 text"
+a4-1-aaaa AAAA 2001:2:4::1
+
+a4-2 A 192.168.4.2
+ AAAA 2001:2:4::2
+ TXT "a4-2 text"
+a4-2-cname CNAME a4-2
+
+a4-3 A 192.168.4.3
+ AAAA 2001:2:4::3
+ TXT "a4-3 text"
+a4-3-cname CNAME a4-3
+
+a4-4 A 192.168.4.4
+ AAAA 2001:2:4::4
+ TXT "a4-4 text"
+
+a3-6.tld2 A 56.56.56.56
+
+a3-7.sub1.tld2 A 57.57.57.57
+
+a3-8.tld2 A 58.58.58.58
+
+a3-9.sub9.tld2 A 59.59.59.59
+
+a3-10.tld2 A 60.60.60.60
diff --git a/bin/tests/system/rpz/ns5/empty.db.in b/bin/tests/system/rpz/ns5/empty.db.in
new file mode 100644
index 0000000..a7e9144
--- /dev/null
+++ b/bin/tests/system/rpz/ns5/empty.db.in
@@ -0,0 +1,14 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 120
+@ SOA . hostmaster.ns.example.tld5. ( 1 3600 1200 604800 60 )
+ NS .
diff --git a/bin/tests/system/rpz/ns5/expire.conf.in b/bin/tests/system/rpz/ns5/expire.conf.in
new file mode 100644
index 0000000..4c1c228
--- /dev/null
+++ b/bin/tests/system/rpz/ns5/expire.conf.in
@@ -0,0 +1,19 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+zone "fast-expire." {
+ type primary;
+ file "fast-expire.db";
+ allow-transfer { any; };
+ notify no;
+};
diff --git a/bin/tests/system/rpz/ns5/fast-expire.db.in b/bin/tests/system/rpz/ns5/fast-expire.db.in
new file mode 100644
index 0000000..cb2672e
--- /dev/null
+++ b/bin/tests/system/rpz/ns5/fast-expire.db.in
@@ -0,0 +1,18 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+@ SOA fast-expire. hostmaster (
+ 1 3 1 5 60
+ )
+ NS ns.tld3.
+
+expired.fast-expire. A 10.0.0.10
diff --git a/bin/tests/system/rpz/ns5/hints b/bin/tests/system/rpz/ns5/hints
new file mode 100644
index 0000000..b657c39
--- /dev/null
+++ b/bin/tests/system/rpz/ns5/hints
@@ -0,0 +1,13 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+. 120 NS ns.
+ns. 120 A 10.53.0.1
diff --git a/bin/tests/system/rpz/ns5/named.args b/bin/tests/system/rpz/ns5/named.args
new file mode 100644
index 0000000..56edbe3
--- /dev/null
+++ b/bin/tests/system/rpz/ns5/named.args
@@ -0,0 +1,2 @@
+# run the performance test close to real life
+-c named.conf -D rpz-ns5 -X named.lock -gd3 -T maxcachesize=2097152
diff --git a/bin/tests/system/rpz/ns5/named.conf.in b/bin/tests/system/rpz/ns5/named.conf.in
new file mode 100644
index 0000000..b0fecdf
--- /dev/null
+++ b/bin/tests/system/rpz/ns5/named.conf.in
@@ -0,0 +1,91 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/*
+ * Test rpz performance.
+ */
+
+options {
+ query-source address 10.53.0.5;
+ notify-source 10.53.0.5;
+ transfer-source 10.53.0.5;
+ port @PORT@;
+ pid-file "named.pid";
+ statistics-file "named.stats";
+ session-keyfile "session.key";
+ listen-on { 10.53.0.5; };
+ listen-on-v6 { none; };
+ ixfr-from-differences yes;
+ notify-delay 0;
+ notify yes;
+ minimal-responses no;
+ recursion yes;
+ dnssec-validation yes;
+
+ # turn rpz on or off
+ include "rpz-switch";
+
+ include "../dnsrps-slave.conf";
+};
+
+key rndc_key {
+ secret "1234abcd8765";
+ algorithm hmac-sha256;
+};
+controls {
+ inet 10.53.0.5 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+include "../trusted.conf";
+zone "." {type hint; file "hints"; };
+
+zone "tld5." {type primary; file "tld5.db"; };
+zone "example.tld5." {type primary; file "example.db"; };
+
+zone "bl0." {type primary; file "bl.db"; };
+zone "bl1." {type primary; file "bl.db"; };
+zone "bl2." {type primary; file "bl.db"; };
+zone "bl3." {type primary; file "bl.db"; };
+zone "bl4." {type primary; file "bl.db"; };
+zone "bl5." {type primary; file "bl.db"; };
+zone "bl6." {type primary; file "bl.db"; };
+zone "bl7." {type primary; file "bl.db"; };
+zone "bl8." {type primary; file "bl.db"; };
+zone "bl9." {type primary; file "bl.db"; };
+zone "bl10." {type primary; file "bl.db"; };
+zone "bl11." {type primary; file "bl.db"; };
+zone "bl12." {type primary; file "bl.db"; };
+zone "bl13." {type primary; file "bl.db"; };
+zone "bl14." {type primary; file "bl.db"; };
+zone "bl15." {type primary; file "bl.db"; };
+zone "bl16." {type primary; file "bl.db"; };
+zone "bl17." {type primary; file "bl.db"; };
+zone "bl18." {type primary; file "bl.db"; };
+zone "bl19." {type primary; file "bl.db"; };
+
+zone "policy1" {
+ type primary;
+ file "empty.db";
+ also-notify { 10.53.0.6; };
+ allow-update { any; };
+ allow-transfer { any; };
+};
+
+zone "policy2" {
+ type primary;
+ file "policy2.db";
+ allow-update { any; };
+ allow-transfer { any; };
+};
+
+include "expire.conf";
diff --git a/bin/tests/system/rpz/ns5/tld5.db b/bin/tests/system/rpz/ns5/tld5.db
new file mode 100644
index 0000000..b75e72f
--- /dev/null
+++ b/bin/tests/system/rpz/ns5/tld5.db
@@ -0,0 +1,32 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+; RPZ performance test
+
+$TTL 120
+@ SOA . hostmaster.ns.example.tld5. ( 1 3600 1200 604800 60 )
+ NS ns
+ NS ns1
+ NS ns2
+ NS ns3
+ns A 10.53.0.5
+ns1 A 10.53.0.5
+ns2 A 10.53.0.5
+ns3 A 10.53.0.5
+
+
+$ORIGIN example.tld5.
+example.tld5. NS ns
+ NS ns1
+ns A 10.53.0.5
+ns1 A 10.53.0.5
+
+as-ns TXT "rewritten with ip-as-ns and qname-as-ns"
diff --git a/bin/tests/system/rpz/ns6/bl.tld2s.db.in b/bin/tests/system/rpz/ns6/bl.tld2s.db.in
new file mode 100644
index 0000000..4538050
--- /dev/null
+++ b/bin/tests/system/rpz/ns6/bl.tld2s.db.in
@@ -0,0 +1,20 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 3600
+@ SOA rpz.tld2. hostmaster.ns.tld2. ( 3 3600 1200 604800 60 )
+ NS ns2
+ NS ns3
+ns2 A 10.53.0.2
+ns3 A 10.53.0.3
+
+32.2.7.168.192.rpz-ip A 1.1.1.1
+ AAAA ::1
diff --git a/bin/tests/system/rpz/ns6/hints b/bin/tests/system/rpz/ns6/hints
new file mode 100644
index 0000000..b657c39
--- /dev/null
+++ b/bin/tests/system/rpz/ns6/hints
@@ -0,0 +1,13 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+. 120 NS ns.
+ns. 120 A 10.53.0.1
diff --git a/bin/tests/system/rpz/ns6/named.conf.in b/bin/tests/system/rpz/ns6/named.conf.in
new file mode 100644
index 0000000..4c05207
--- /dev/null
+++ b/bin/tests/system/rpz/ns6/named.conf.in
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+ query-source address 10.53.0.6;
+ notify-source 10.53.0.6;
+ transfer-source 10.53.0.6;
+ port @PORT@;
+ pid-file "named.pid";
+ statistics-file "named.stats";
+ session-keyfile "session.key";
+ listen-on { 10.53.0.6; };
+ listen-on-v6 { none; };
+ forward only;
+ forwarders { 10.53.0.3; };
+ minimal-responses no;
+ recursion yes;
+ dnssec-validation yes;
+ qname-minimization disabled;
+
+ response-policy {
+ zone "policy1" min-update-interval 0;
+ zone "bl.tld2s" policy given;
+ } qname-wait-recurse yes
+ // add-soa yes # leave add-soa as default for unset test
+ nsip-enable yes
+ nsdname-enable yes;
+
+ include "../dnsrps-slave.conf";
+};
+
+logging { category rpz { default_debug; }; };
+
+key rndc_key {
+ secret "1234abcd8765";
+ algorithm hmac-sha256;
+};
+
+controls {
+ inet 10.53.0.6 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+include "../trusted.conf";
+
+zone "policy1" {
+ type secondary;
+ primaries { 10.53.0.5; };
+ file "empty.db";
+ also-notify { 10.53.0.3 port @EXTRAPORT1@; };
+ notify-delay 0;
+ allow-transfer { any; };
+};
+
+zone "bl.tld2s." {
+ type primary;
+ file "bl.tld2s.db";
+};
diff --git a/bin/tests/system/rpz/ns7/hints b/bin/tests/system/rpz/ns7/hints
new file mode 100644
index 0000000..b657c39
--- /dev/null
+++ b/bin/tests/system/rpz/ns7/hints
@@ -0,0 +1,13 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+. 120 NS ns.
+ns. 120 A 10.53.0.1
diff --git a/bin/tests/system/rpz/ns7/named.conf.in b/bin/tests/system/rpz/ns7/named.conf.in
new file mode 100644
index 0000000..24d9c62
--- /dev/null
+++ b/bin/tests/system/rpz/ns7/named.conf.in
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+ query-source address 10.53.0.7;
+ notify-source 10.53.0.7;
+ transfer-source 10.53.0.7;
+ port @PORT@;
+ pid-file "named.pid";
+ statistics-file "named.stats";
+ session-keyfile "session.key";
+ listen-on { 10.53.0.7; };
+ listen-on-v6 { none; };
+ minimal-responses no;
+ recursion yes;
+ dnssec-validation yes;
+
+ response-policy {
+ zone "policy2" add-soa no;
+ } qname-wait-recurse no
+ nsip-enable yes
+ nsdname-enable yes
+ min-update-interval 0;
+
+ include "../dnsrps-slave.conf";
+};
+
+logging { category rpz { default_debug; }; };
+
+key rndc_key {
+ secret "1234abcd8765";
+ algorithm hmac-sha256;
+};
+
+controls {
+ inet 10.53.0.7 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+include "../trusted.conf";
+
+zone "policy2" {
+ type secondary;
+ primaries { 10.53.0.5; };
+ file "policy2.db";
+ also-notify { 10.53.0.3 port @EXTRAPORT1@; };
+ notify-delay 0;
+ allow-transfer { any; };
+ request-ixfr no; // force axfr on rndc reload
+};
diff --git a/bin/tests/system/rpz/ns8/hints b/bin/tests/system/rpz/ns8/hints
new file mode 100644
index 0000000..b657c39
--- /dev/null
+++ b/bin/tests/system/rpz/ns8/hints
@@ -0,0 +1,13 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+. 120 NS ns.
+ns. 120 A 10.53.0.1
diff --git a/bin/tests/system/rpz/ns8/manual-update-rpz.db.in b/bin/tests/system/rpz/ns8/manual-update-rpz.db.in
new file mode 100644
index 0000000..a823448
--- /dev/null
+++ b/bin/tests/system/rpz/ns8/manual-update-rpz.db.in
@@ -0,0 +1,21 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+; RPZ test
+; This basic file is copied to several zone files before being used.
+; Its contents are also changed with nsupdate
+
+
+$TTL 300
+@ SOA manual-update-rpz. hostmaster.ns.manual-rpz-update. ( 1 3600 1200 604800 60 )
+ NS ns.tld3.
+
+walled.tld2.manual-update-rpz. 300 A 10.0.0.1
diff --git a/bin/tests/system/rpz/ns8/named.conf.in b/bin/tests/system/rpz/ns8/named.conf.in
new file mode 100644
index 0000000..f228c00
--- /dev/null
+++ b/bin/tests/system/rpz/ns8/named.conf.in
@@ -0,0 +1,66 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/*
+ * Main rpz test DNS server.
+ */
+
+options {
+ query-source address 10.53.0.8;
+ notify-source 10.53.0.8;
+ transfer-source 10.53.0.8;
+ port @PORT@;
+ pid-file "named.pid";
+ statistics-file "named.stats";
+ session-keyfile "session.key";
+ listen-on { 10.53.0.8; };
+ listen-on-v6 { none; };
+ notify yes;
+ minimal-responses no;
+ recursion yes;
+ dnssec-validation yes;
+
+ response-policy {
+ zone "manual-update-rpz";
+ }
+ // add-soa yes // do not set testing default mode
+ min-ns-dots 0
+ qname-wait-recurse yes
+ min-update-interval 0
+ nsdname-enable yes
+ nsip-enable yes
+ ;
+
+ include "../dnsrps.conf";
+ also-notify { 10.53.0.8 port @EXTRAPORT1@; };
+ notify-delay 0;
+};
+
+logging { category rpz { default_debug; }; };
+
+key rndc_key {
+ secret "1234abcd8765";
+ algorithm hmac-sha256;
+};
+controls {
+ inet 10.53.0.8 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+
+zone "." { type hint; file "hints"; };
+
+zone "manual-update-rpz." {
+ type primary;
+ file "manual-update-rpz.db";
+ notify no;
+};
diff --git a/bin/tests/system/rpz/ns9/hints b/bin/tests/system/rpz/ns9/hints
new file mode 100644
index 0000000..b657c39
--- /dev/null
+++ b/bin/tests/system/rpz/ns9/hints
@@ -0,0 +1,13 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+. 120 NS ns.
+ns. 120 A 10.53.0.1
diff --git a/bin/tests/system/rpz/ns9/named.conf.in b/bin/tests/system/rpz/ns9/named.conf.in
new file mode 100644
index 0000000..e57591c
--- /dev/null
+++ b/bin/tests/system/rpz/ns9/named.conf.in
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+/*
+ * DNS64 / RPZ server.
+ */
+
+options {
+ query-source address 10.53.0.9;
+ notify-source 10.53.0.9;
+ transfer-source 10.53.0.9;
+ port @PORT@;
+ pid-file "named.pid";
+ statistics-file "named.stats";
+ session-keyfile "session.key";
+ listen-on { 10.53.0.9; };
+ listen-on-v6 { none; };
+ notify yes;
+ minimal-responses no;
+ recursion yes;
+ dnssec-validation yes;
+ dns64-server "example.localdomain.";
+ dns64 64:ff9b::/96 { };
+ response-policy {
+ zone "rpz";
+ }
+ qname-wait-recurse no ;
+
+ include "../dnsrps.conf";
+ notify-delay 0;
+};
+
+logging { category rpz { default_debug; }; };
+
+key rndc_key {
+ secret "1234abcd8765";
+ algorithm hmac-sha256;
+};
+controls {
+ inet 10.53.0.9 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+
+zone "." { type hint; file "hints"; };
+
+zone "rpz." {
+ type primary;
+ file "rpz.db";
+ notify no;
+};
diff --git a/bin/tests/system/rpz/ns9/rpz.db b/bin/tests/system/rpz/ns9/rpz.db
new file mode 100644
index 0000000..dcbe5d6
--- /dev/null
+++ b/bin/tests/system/rpz/ns9/rpz.db
@@ -0,0 +1,16 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+rpz. 28800 IN SOA rpz. hostmaster.rpz. 6 10800 3600 2419200 900
+rpz. 28800 IN NS .
+a-only.example.rpz. 28800 IN CNAME *.
+no-a-no-aaaa.example.rpz. 28800 IN CNAME *.
+a-plus-aaaa.example.rpz. 28800 IN CNAME *.
diff --git a/bin/tests/system/rpz/qperf.sh b/bin/tests/system/rpz/qperf.sh
new file mode 100644
index 0000000..dc79de9
--- /dev/null
+++ b/bin/tests/system/rpz/qperf.sh
@@ -0,0 +1,22 @@
+#!/bin/sh
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+for QDIR in `echo "$PATH" | tr : ' '` ../../../../contrib/queryperf; do
+ QPERF=$QDIR/queryperf
+ if test -f "$QPERF" -a -x "$QPERF"; then
+ echo $QPERF
+ exit 0
+ fi
+done
+
+exit 0
diff --git a/bin/tests/system/rpz/setup.sh b/bin/tests/system/rpz/setup.sh
new file mode 100644
index 0000000..10ab738
--- /dev/null
+++ b/bin/tests/system/rpz/setup.sh
@@ -0,0 +1,180 @@
+#!/bin/sh
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+# touch dnsrps-off to not test with DNSRPS
+
+set -e
+
+SYSTEMTESTTOP=..
+. $SYSTEMTESTTOP/conf.sh
+
+QPERF=$($SHELL qperf.sh)
+
+USAGE="$0: [-DNx]"
+DEBUG=
+while getopts "DNx" c; do
+ case $c in
+ x) set -x; DEBUG=-x ;;
+ D) TEST_DNSRPS="-D" ;;
+ N) PARTIAL=-P ;;
+ *) echo "$USAGE" 1>&2; exit 1 ;;
+ esac
+done
+shift $((OPTIND - 1))
+if test "$#" -ne 0; then
+ echo "$USAGE" 1>&2
+ exit 1
+fi
+
+if [ ${NOCLEAN:-unset} = unset ]; then
+ $SHELL clean.sh $PARTIAL $DEBUG
+fi
+
+for dir in ns*; do
+ touch $dir/named.run
+ nextpart $dir/named.run > /dev/null
+done
+
+copy_setports ns1/named.conf.in ns1/named.conf
+copy_setports ns2/named.conf.in ns2/named.conf
+copy_setports ns3/named.conf.in ns3/named.conf
+copy_setports ns4/named.conf.in ns4/named.conf
+copy_setports ns5/named.conf.in ns5/named.conf
+copy_setports ns6/named.conf.in ns6/named.conf
+copy_setports ns7/named.conf.in ns7/named.conf
+copy_setports ns8/named.conf.in ns8/named.conf
+copy_setports ns9/named.conf.in ns9/named.conf
+copy_setports ns10/named.conf.in ns10/named.conf
+
+copy_setports dnsrpzd.conf.in dnsrpzd.conf
+
+# decide whether to test DNSRPS
+# Note that dnsrps.conf and dnsrps-slave.conf are included in named.conf
+# and differ from dnsrpz.conf which is used by dnsrpzd.
+$SHELL ../ckdnsrps.sh -A $TEST_DNSRPS $DEBUG
+test -z "$(grep 'dnsrps-enable yes' dnsrps.conf)" && TEST_DNSRPS=
+
+# set up test policy zones.
+# bl is the main test zone
+# bl-2 is used to check competing zones.
+# bl-{given,disabled,passthru,no-data,nxdomain,cname,wildcard,garden,
+# drop,tcp-only} are used to check policy overrides in named.conf.
+# NO-OP is an obsolete synonym for PASSHTRU
+for NM in '' -2 -given -disabled -passthru -no-op -nodata -nxdomain -cname -wildcname -garden -drop -tcp-only; do
+ sed -e "/SOA/s/blx/bl$NM/g" ns3/base.db >ns3/bl$NM.db
+done
+# bl zones are dynamically updated. Add one zone that is updated manually.
+cp ns3/manual-update-rpz.db.in ns3/manual-update-rpz.db
+cp ns8/manual-update-rpz.db.in ns8/manual-update-rpz.db
+
+cp ns3/mixed-case-rpz-1.db.in ns3/mixed-case-rpz.db
+
+# a zone that expires quickly and then can't be refreshed
+cp ns5/fast-expire.db.in ns5/fast-expire.db
+cp ns5/expire.conf.in ns5/expire.conf
+
+# $1=directory
+# $2=domain name
+# $3=input zone file
+# $4=output file
+signzone () {
+ KEYNAME=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -K $1 $2)
+ cat $1/$3 $1/$KEYNAME.key > $1/tmp
+ $SIGNER -P -K $1 -o $2 -f $1/$4 $1/tmp >/dev/null
+ sed -n -e 's/\(.*\) IN DNSKEY \([0-9]\{1,\} [0-9]\{1,\} [0-9]\{1,\}\) \(.*\)/trust-anchors {"\1" static-key \2 "\3";};/p' $1/$KEYNAME.key >>trusted.conf
+ DSFILENAME=dsset-${2}${TP}
+ rm $DSFILENAME $1/tmp
+}
+signzone ns2 tld2s base-tld2s.db tld2s.db
+
+# Performance and a few other checks.
+cat <<EOF >ns5/rpz-switch
+response-policy {
+ zone "bl0"; zone "bl1"; zone "bl2"; zone "bl3"; zone "bl4";
+ zone "bl5"; zone "bl6"; zone "bl7"; zone "bl8"; zone "bl9";
+ zone "bl10"; zone "bl11"; zone "bl12"; zone "bl13"; zone "bl14";
+ zone "bl15"; zone "bl16"; zone "bl17"; zone "bl18"; zone "bl19";
+ } recursive-only no
+ qname-wait-recurse no
+ nsip-enable yes
+ nsdname-enable yes
+ max-policy-ttl 90
+ break-dnssec yes
+ ;
+EOF
+
+cat <<EOF >ns5/example.db
+\$TTL 300
+@ SOA . hostmaster.ns.example.tld5. ( 1 3600 1200 604800 60 )
+ NS ns
+ NS ns1
+ns A 10.53.0.5
+ns1 A 10.53.0.5
+EOF
+
+cat <<EOF >ns5/bl.db
+\$TTL 300
+@ SOA . hostmaster.ns.blperf. ( 1 3600 1200 604800 60 )
+ NS ns.tld5.
+
+; for "qname-wait-recurse no" in #35 test1
+x.servfail A 35.35.35.35
+; for "recursive-only no" in #8 test5
+a3-5.tld2 CNAME .
+; for "break-dnssec" in #9 & #10 test5
+a3-5.tld2s CNAME .
+; for "max-policy-ttl 90" in #17 test5
+a3-17.tld2 500 A 17.17.17.17
+
+; dummy NSDNAME policy to trigger lookups
+ns1.x.rpz-nsdname CNAME .
+EOF
+
+if test -n "$QPERF"; then
+ # Do not build the full zones if we will not use them.
+ $PERL -e 'for ($val = 1; $val <= 65535; ++$val) {
+ printf("host-%05d\tA 192.168.%d.%d\n", $val, $val/256, $val%256);
+ }' >>ns5/example.db
+
+ echo >>ns5/bl.db
+ echo "; rewrite some names" >>ns5/bl.db
+ $PERL -e 'for ($val = 2; $val <= 65535; $val += 69) {
+ printf("host-%05d.example.tld5\tCNAME\t.\n", $val);
+ }' >>ns5/bl.db
+
+ echo >>ns5/bl.db
+ echo "; rewrite with some not entirely trivial patricia trees" >>ns5/bl.db
+ $PERL -e 'for ($val = 3; $val <= 65535; $val += 69) {
+ printf("32.%d.%d.168.192.rpz-ip \tCNAME\t.\n",
+ $val%256, $val/256);
+ }' >>ns5/bl.db
+fi
+
+# some psuedo-random queryperf requests
+$PERL -e 'for ($cnt = $val = 1; $cnt <= 3000; ++$cnt) {
+ printf("host-%05d.example.tld5 A\n", $val);
+ $val = ($val * 9 + 32771) % 65536;
+ }' >ns5/requests
+
+cp ns2/bl.tld2.db.in ns2/bl.tld2.db
+cp ns5/empty.db.in ns5/empty.db
+cp ns5/empty.db.in ns5/policy2.db
+cp ns6/bl.tld2s.db.in ns6/bl.tld2s.db
+
+# Run dnsrpzd to get the license and prime the static policy zones
+if test -n "$TEST_DNSRPS"; then
+ DNSRPZD="$(../rpz/dnsrps -p)"
+ cd ns3
+ "$DNSRPZ" -D../dnsrpzd.rpzf -S../dnsrpzd.sock -C../dnsrpzd.conf \
+ -w 0 -dddd -L stdout >./dnsrpzd.run 2>&1
+fi
diff --git a/bin/tests/system/rpz/test1 b/bin/tests/system/rpz/test1
new file mode 100644
index 0000000..3dc0375
--- /dev/null
+++ b/bin/tests/system/rpz/test1
@@ -0,0 +1,99 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+
+
+
+; Use comment lines instead of blank lines to combine update requests into
+; single requests
+; Separate update requests for distinct TLDs with blank lines or 'send'
+; End the file with a blank line or 'send'
+
+server 10.53.0.3 @PORT@
+
+; QNAME tests
+
+; NXDOMAIN
+; 2, 25
+update add a0-1.tld2.bl. 300 CNAME .
+; NODATA
+; 3
+update add a3-1.tld2.bl. 300 CNAME *.
+; and no assert-botch
+; 4, 5
+update add a3-2.tld2.bl. 300 DNAME example.com.
+;
+; NXDOMAIN for a4-2-cname.tld2 via its target a4-2.tld2.
+; 6 and 7
+update add a4-2.tld2.bl 300 CNAME .
+; 8
+; NODATA for a4-3-cname.tld2 via its target a4-3.tld2.
+update add a4-3.tld2.bl 300 CNAME *.
+;
+; replace the A for a4-1.sub1.tld2 with 12.12.12.12
+; 9
+update add a4-1.sub1.tld2.bl. 300 A 12.12.12.12
+;
+; replace the A for *.sub2.tld2 with 12.12.12.12
+; 10
+update add a4-1.sub2.tld2.bl. 300 A 12.12.12.12
+;
+; replace NXDOMAIN for {nxc1,nxc2}.sub1.tld2 with 12.12.12.12 using CNAMEs
+; 11
+update add nxc1.sub1.tld2.bl. 300 CNAME a12.tld2.
+; 12
+update add nxc2.sub1.tld2.bl. 300 CNAME a12-cname.tld2.
+;
+; prefer the first conflicting zone
+; 13
+update add a4-4.tld2.bl. 300 A 127.4.4.1
+update add a6-1.tld2.bl. 300 CNAME a6-1.tld2.
+update add a6-2.tld2.bl. 300 A 127.6.2.1
+update add a6-1.tld2.bl. 300 A 127.6.1.1
+update add a6-2.tld2.bl. 300 CNAME a6-2.tld2.
+send
+update add a4-4.tld2.bl-2. 300 A 127.4.4.2
+send
+
+; wildcard CNAME
+; 16
+update add a3-6.tld2.bl. 300 CNAME *.tld4.
+; 17
+update add *.sub1.tld2.bl. 300 CNAME *.tld4.
+; CNAME chain
+; 18
+update add a4-5.tld2.bl. 300 A 127.0.0.16
+; stop at first hit in CNAME chain
+; 19
+update add a4-6.tld2.bl. 300 CNAME .
+update add a4-6-cname.tld2.bl. 300 A 127.0.0.17
+; no change instead of NXDOMAIN because +norecurse
+; 20
+update add a5-2.tld2.bl. 300 CNAME .
+; no change instead of NODATA because +norecurse
+; 21
+update add a5-3.tld2.bl. 300 CNAME *.
+; 22, 23
+update add a5-4.tld2.bl. 300 DNAME example.com.
+;
+; assert in rbtdb.c
+; 24
+update add c1.crash2.tld3.bl. 300 CNAME .
+; DO=1 without signatures, DO=0 with signatures are rewritten
+; 26 - 27
+update add a0-1.tld2s.bl. 300 CNAME .
+; 32
+update add a3-8.tld2.bl. 300 CNAME rpz-drop.
+; 33
+update add a3-9.tld2.bl. 300 CNAME rpz-tcp-only.
+; 34 qname-wait-recurse yes
+update add x.servfail.bl. 300 A 127.0.0.34
+send
diff --git a/bin/tests/system/rpz/test2 b/bin/tests/system/rpz/test2
new file mode 100644
index 0000000..ad71e3a
--- /dev/null
+++ b/bin/tests/system/rpz/test2
@@ -0,0 +1,77 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+
+
+
+; Use comment lines instead of blank lines to combine update requests into
+; single requests
+; Separate update requests for distinct TLDs with blank lines or 'send'
+; End the file with a blank line or 'send'
+; CNAME targets are absolute even without trailing "."
+
+; IP tests
+
+server 10.53.0.3 @PORT@
+
+; NODATA a3-1.tld2
+; 1
+update add 32.1.3.168.192.rpz-ip.bl 300 CNAME *.
+;
+; NXDOMAIN for 192.168.4.0/24, the network of a4-1.tld2 and a4-2.tld2
+; 4
+update add 24.0.4.168.192.rpz-ip.bl 300 CNAME .
+;
+; old passthru in NXDOMAIN CIDR block to leave a4-1.tld2 unchanged
+; 3
+update add 32.1.4.168.192.rpz-ip.bl 300 CNAME 32.1.4.168.192
+;
+; NODATA for a4-3.tld2
+; 8
+update add 32.3.4.168.192.rpz-ip.bl 300 CNAME *.
+;
+; NXDOMAIN for IPv6 a3-1.tld2
+; 9
+update add 128.1.zz.3.2.2001.rpz-ip.bl 300 CNAME .
+;
+; apply the policy with the lexically smaller trigger address of 192.168.5.1
+; to an RRset of more than one A RR
+; 11
+update add 32.1.5.168.192.rpz-ip.bl 300 A 127.0.0.1
+update add 32.2.5.168.192.rpz-ip.bl 300 A 127.0.0.2
+;
+; prefer first conflicting IP zone for a5-3.tld2
+; 12
+update add 32.3.5.168.192.rpz-ip.bl 300 A 127.0.0.1
+send
+update add 32.3.5.168.192.rpz-ip.bl-2 300 A 127.0.0.2
+send
+
+; prefer QNAME to IP for a5-4.tld2
+; 13, 14
+update add 32.4.5.168.192.rpz-ip.bl 300 CNAME a12.tld2.
+update add a5-4.tld2.bl 300 CNAME a14.tld4.
+;
+; poke hole in NXDOMAIN CIDR block to leave a4-4.tld2 unchanged
+; 15
+update add 32.4.4.168.192.rpz-ip.bl 300 CNAME rpz-passthru.
+;
+; assert in rbtdb.c
+; 16
+update add 32.16.1.16.172.rpz-ip.bl 300 CNAME .
+send
+update add c2.crash2.tld3.bl-2 300 A 127.0.0.16
+send
+
+; client-IP address trigger
+; 17
+update add 32.1.0.53.10.rpz-client-ip.bl 300 A 127.0.0.17
+send
diff --git a/bin/tests/system/rpz/test3 b/bin/tests/system/rpz/test3
new file mode 100644
index 0000000..222b757
--- /dev/null
+++ b/bin/tests/system/rpz/test3
@@ -0,0 +1,47 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+
+
+; Use comment lines instead of blank lines to combine update requests into
+; single requests
+; Separate update requests for distinct TLDs with blank lines or 'send'
+; End the file with a blank line or 'send'
+
+; NSDNAME tests
+
+server 10.53.0.3 @PORT@
+
+; 3, 4, 5
+; NXDOMAIN for *.sub1.tld2 by NSDNAME
+update add *.sub1.tld2.rpz-nsdname.bl. 300 CNAME .
+;
+; 6
+; walled garden for *.sub2.tld2
+update add *.sub2.tld2.rpz-nsdname.bl. 300 CNAME a12-cname.tld2.
+;
+; 7, 8
+; exempt a3-2.tld2 and anything in 192.168.0.0/24
+; also checks that IP policies are preferred over NSDNAME policies
+update add a3-2.tld2.bl 300 CNAME a3-2.tld2.
+update add 24.0.0.168.192.rpz-ip.bl 300 CNAME 24.0.0.168.192.
+;
+; 9
+; prefer QNAME policy to NSDNAME policy
+update add a4-1.tld2.bl. 300 A 12.12.12.12
+; 10
+; prefer policy for largest NS name
+update add ns.sub3.tld2.rpz-nsdname.bl. 300 A 127.0.0.1
+update add ns.subsub.sub3.tld2.rpz-nsdname.bl. 300 A 127.0.0.2
+
+; ip-as-qname rewrites all of tld5
+update add ns.tld5.bl. 300 A 12.12.12.12
+send
diff --git a/bin/tests/system/rpz/test4 b/bin/tests/system/rpz/test4
new file mode 100644
index 0000000..7b95dd3
--- /dev/null
+++ b/bin/tests/system/rpz/test4
@@ -0,0 +1,36 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+
+
+; Use comment lines instead of blank lines to combine update requests into
+; single requests
+; Separate update requests for distinct TLDs with blank lines or 'send'
+; End the file with a blank line or 'send'
+
+; NSIP tests
+
+server 10.53.0.3 @PORT@
+
+; NXDOMAIN for all of tld2 based on its server IP address
+update add 32.2.0.53.10.rpz-nsip.bl. 300 CNAME .
+;
+; exempt a3-2.tld2 and anything in 192.168.0.0/24
+; also checks that IP policies are preferred over NSIP policies
+update add a3-2.tld2.bl 300 CNAME a3-2.tld2.
+update add 24.0.0.168.192.rpz-ip.bl 300 CNAME 24.0.0.168.192.
+;
+; prefer NSIP policy to NSDNAME policy
+update add ns.tld2.rpz-nsdname.bl. 300 CNAME 10.0.0.1
+
+; ip-as-ns rewrites all of tld5
+update add 32.5.0.53.10.rpz-ip.bl. 300 A 12.12.12.12
+send
diff --git a/bin/tests/system/rpz/test4a b/bin/tests/system/rpz/test4a
new file mode 100644
index 0000000..83a175d
--- /dev/null
+++ b/bin/tests/system/rpz/test4a
@@ -0,0 +1,27 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+
+
+; Use comment lines instead of blank lines to combine update requests into
+; single requests
+; Separate update requests for distinct TLDs with blank lines or 'send'
+; End the file with a blank line or 'send'
+
+; walled-garden NSIP tests
+
+server 10.53.0.3 @PORT@
+
+; rewrite all of tld2 based on its server IP address
+update add 32.2.0.53.10.rpz-nsip.bl. 300 A 41.41.41.41
+update add 32.2.0.53.10.rpz-nsip.bl. 300 AAAA 2041::41
+update add 32.2.0.53.10.rpz-nsip.bl. 300 TXT "NSIP walled garden"
+send
diff --git a/bin/tests/system/rpz/test5 b/bin/tests/system/rpz/test5
new file mode 100644
index 0000000..f30a6be
--- /dev/null
+++ b/bin/tests/system/rpz/test5
@@ -0,0 +1,60 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+
+
+; Use comment lines instead of blank lines to combine update requests into
+; single requests
+; Separate update requests for distinct TLDs with blank lines or 'send'
+; End the file with a blank line or 'send'
+
+; the policies or replacements specified in ns3/named.conf override these
+
+server 10.53.0.3 @PORT@
+
+; 1
+update add a3-1.tld2.bl-given. 300 A 127.0.0.1
+send
+; 2
+update add a3-2.tld2.bl-passthru. 300 A 127.0.0.2
+send
+; 3
+update add a3-3.tld2.bl-no-op. 300 A 127.0.0.3
+send
+; 4
+update add a3-4.tld2.bl-disabled. 300 A 127.0.0.4
+send
+; 5 - 7
+update add a3-5.tld2.bl-nodata. 300 A 127.0.0.5
+send
+; 11
+update add a3-6.tld2.bl-nxdomain. 300 A 127.0.0.11
+send
+; 12
+update add a3-7.tld2.bl-cname. 300 A 127.0.0.12
+send
+; 13
+update add a3-8.tld2.bl-wildcname. 300 A 127.0.0.13
+; 14
+update add *.sub9.tld2.bl-wildcname. 300 A 127.0.1.14
+send
+; 15
+update add a3-15.tld2.bl-garden. 300 A 127.0.0.15
+send
+; 16
+update add a3-16.tld2.bl. 300 A 127.0.0.16
+send
+; 18
+update add a3-18.tld2.bl-drop. 300 A 127.0.0.18
+send
+; 19
+update add a3-19.tld2.bl-tcp-only. 300 A 127.0.0.19
+send
diff --git a/bin/tests/system/rpz/test6 b/bin/tests/system/rpz/test6
new file mode 100644
index 0000000..e5c2381
--- /dev/null
+++ b/bin/tests/system/rpz/test6
@@ -0,0 +1,37 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+
+
+; Use comment lines instead of blank lines to combine update requests into
+; single requests
+; Separate update requests for distinct TLDs with blank lines or 'send'
+; End the file with a blank line or 'send'
+
+server 10.53.0.3 @PORT@
+
+; Poke the radix tree a little.
+update add 128.1111.2222.3333.4444.5555.6666.7777.8888.rpz-ip.bl. 300 CNAME .
+update add 128.1111.2222.3333.4444.5555.6666.zz.rpz-ip.bl. 300 CNAME .
+update add 128.1111.2222.3333.4444.5555.zz.8888.rpz-ip.bl. 300 CNAME .
+update add 128.1111.2222.3333.4444.zz.8888.rpz-ip.bl. 300 CNAME .
+update add 128.zz.3333.4444.0.0.8888.rpz-ip.bl. 300 CNAME .
+update add 128.zz.3333.4444.0.7777.8888.rpz-ip.bl. 300 CNAME .
+update add 128.zz.3333.4444.0.8777.8888.rpz-ip.bl. 300 CNAME .
+update add 127.zz.3333.4444.0.8777.8888.rpz-ip.bl. 300 CNAME .
+;
+;
+; regression testing for some old crashes
+update add redirect.bl. 300 A 127.0.0.1
+update add *.redirect.bl. 300 A 127.0.0.1
+update add *.credirect.bl. 300 CNAME google.com.
+;
+send
diff --git a/bin/tests/system/rpz/tests.sh b/bin/tests/system/rpz/tests.sh
new file mode 100644
index 0000000..738df3c
--- /dev/null
+++ b/bin/tests/system/rpz/tests.sh
@@ -0,0 +1,1012 @@
+#!/bin/sh
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+# test response policy zones (RPZ)
+
+# touch dnsrps-off to not test with DNSRPS
+# touch dnsrps-only to not test with classic RPZ
+
+SYSTEMTESTTOP=..
+. $SYSTEMTESTTOP/conf.sh
+
+ns=10.53.0
+ns1=$ns.1 # root, defining the others
+ns2=$ns.2 # authoritative server whose records are rewritten
+ns3=$ns.3 # main rewriting resolver
+ns4=$ns.4 # another authoritative server that is rewritten
+ns5=$ns.5 # another rewriting resolver
+ns6=$ns.6 # a forwarding server
+ns7=$ns.7 # another rewriting resolver
+ns8=$ns.8 # another rewriting resolver
+ns9=$ns.9 # another rewriting resolver
+ns10=$ns.10 # authoritative server
+
+HAVE_CORE=
+
+status=0
+t=0
+
+DEBUG=
+SAVE_RESULTS=
+ARGS=
+
+USAGE="$0: [-xS]"
+while getopts "xS:" c; do
+ case $c in
+ x) set -x; DEBUG=-x; ARGS="$ARGS -x";;
+ S) SAVE_RESULTS=-S; ARGS="$ARGS -S";;
+ *) echo "$USAGE" 1>&2; exit 1;;
+ esac
+done
+shift `expr $OPTIND - 1 || true`
+if test "$#" -ne 0; then
+ echo "$USAGE" 1>&2
+ exit 1
+fi
+# really quit on control-C
+trap 'exit 1' 1 2 15
+
+TS='%H:%M:%S '
+TS=
+comment () {
+ if test -n "$TS"; then
+ date "+${TS}$*" | cat_i
+ fi
+}
+
+DNSRPSCMD=./dnsrps
+RNDCCMD="$RNDC -c $SYSTEMTESTTOP/common/rndc.conf -p ${CONTROLPORT} -s"
+
+if test -x "$DNSRPSCMD"; then
+ # speed up the many delays for dnsrpzd by waiting only 0.1 seconds
+ WAIT_CMD="$DNSRPSCMD -w 0.1"
+ TEN_SECS=100
+else
+ WAIT_CMD="sleep 1"
+ TEN_SECS=10
+fi
+
+digcmd () {
+ if test "$1" = TCP; then
+ shift
+ fi
+ # Default to +noauth and @$ns3
+ # Also default to -bX where X is the @value so that OS X will choose
+ # the right IP source address.
+ digcmd_args=`echo "+nocookie +noadd +time=2 +tries=1 -p ${PORT} $*" | \
+ sed -e "/@/!s/.*/& @$ns3/" \
+ -e '/-b/!s/@\([^ ]*\)/@\1 -b\1/' \
+ -e '/+n?o?auth/!s/.*/+noauth &/'`
+ #echo_i "dig $digcmd_args 1>&2
+ $DIG $digcmd_args
+}
+
+# set DIGNM=file name for dig output
+GROUP_NM=
+TEST_NUM=0
+make_dignm () {
+ TEST_NUM=`expr $TEST_NUM : '\([0-9]*\).*'` # trim '+' characters
+ TEST_NUM=`expr $TEST_NUM + 1`
+ DIGNM=dig.out$GROUP_NM-$TEST_NUM
+ while test -f $DIGNM; do
+ TEST_NUM="$TEST_NUM+"
+ DIGNM=dig.out$GROUP_NM-$TEST_NUM
+ done
+}
+
+setret () {
+ ret=1
+ status=`expr $status + 1`
+ echo_i "$*"
+}
+
+# set $SN to the SOA serial number of a zone
+# $1=domain
+# $2=DNS server and client IP address
+get_sn() {
+ SOA=`$DIG -p ${PORT} +short +norecurse soa "$1" "@$2" "-b$2"`
+ SN=`expr "$SOA" : '[^ ]* [^ ]* \([^ ]*\) .*'`
+ test "$SN" != "" && return
+ echo_i "no serial number from \`dig -p ${PORT} soa $1 @$2\` in \"$SOA\""
+ exit 1
+}
+
+get_sn_fast () {
+ RSN=`$DNSRPSCMD -n "$1"`
+ #echo "dnsrps serial for $1 is $RSN"
+ if test -z "$RSN"; then
+ echo_i "dnsrps failed to get SOA serial number for $1"
+ exit 1
+ fi
+}
+
+# check that dnsrpzd has loaded its zones
+# $1=domain
+# $2=DNS server IP address
+FZONES=`sed -n -e 's/^zone "\(.*\)".*\(10.53.0..\).*/Z=\1;M=\2/p' dnsrpzd.conf`
+dnsrps_loaded() {
+ test "$mode" = dnsrps || return
+ n=0
+ for V in $FZONES; do
+ eval "$V"
+ get_sn $Z $M
+ while true; do
+ get_sn_fast "$Z"
+ if test "$SN" -eq "0$RSN"; then
+ #echo "$Z @$M serial=$SN"
+ break
+ fi
+ n=`expr $n + 1`
+ if test "$n" -gt $TEN_SECS; then
+ echo_i "dnsrps serial for $Z is $RSN instead of $SN"
+ exit 1
+ fi
+ $WAIT_CMD
+ done
+ done
+}
+
+# check the serial number in an SOA to ensure that a policy zone has
+# been (re)loaded
+# $1=serial number
+# $2=domain
+# $3=DNS server
+ck_soa() {
+ n=0
+ while true; do
+ if test "$mode" = dnsrps; then
+ get_sn_fast "$2"
+ test "$RSN" -eq "$1" && return
+ else
+ get_sn "$2" "$3"
+ test "$SN" -eq "$1" && return
+ fi
+ n=`expr $n + 1`
+ if test "$n" -gt $TEN_SECS; then
+ echo_i "got serial number \"$SN\" instead of \"$1\" from $2 @$3"
+ return
+ fi
+ $WAIT_CMD
+ done
+}
+
+# (re)load the response policy zones with the rules in the file $TEST_FILE
+load_db () {
+ if test -n "$TEST_FILE"; then
+ copy_setports $TEST_FILE tmp
+ if $NSUPDATE -v tmp; then :
+ $RNDCCMD $ns3 sync
+ else
+ echo_i "failed to update policy zone with $TEST_FILE"
+ $RNDCCMD $ns3 sync
+ exit 1
+ fi
+ rm -f tmp
+ fi
+}
+
+# restart name server
+# $1 ns number
+# $2 rebuild bl rpz zones if "rebuild-bl-rpz"
+restart () {
+ # try to ensure that the server really has stopped
+ # and won't mess with ns$1/name.pid
+ if test -z "$HAVE_CORE" -a -f ns$1/named.pid; then
+ $RNDCCMD $ns$1 halt >/dev/null 2>&1
+ if test -f ns$1/named.pid; then
+ sleep 1
+ PID=`cat ns$1/named.pid 2>/dev/null`
+ if test -n "$PID"; then
+ echo_i "killing ns$1 server $PID"
+ $KILL -9 $PID
+ fi
+ fi
+ fi
+ rm -f ns$1/*.jnl
+ if [ "$2" = "rebuild-bl-rpz" ]; then
+ if test -f ns$1/base.db; then
+ for NM in ns$1/bl*.db; do
+ cp -f ns$1/base.db $NM
+ done
+ fi
+ fi
+ start_server --noclean --restart --port ${PORT} ns$1
+ load_db
+ dnsrps_loaded
+ sleep 1
+}
+
+# $1=server and irrelevant args
+# $2=error message
+ckalive () {
+ CKALIVE_NS=`expr "$1" : '.*@ns\([1-9]\).*'`
+ if test -z "$CKALIVE_NS"; then
+ CKALIVE_NS=3
+ fi
+ eval CKALIVE_IP=\$ns$CKALIVE_NS
+ $RNDCCMD $CKALIVE_IP status >/dev/null 2>&1 && return 0
+ HAVE_CORE=yes
+ setret "$2"
+ # restart the server to avoid stalling waiting for it to stop
+ restart $CKALIVE_NS "rebuild-bl-rpz"
+ return 1
+}
+
+resetstats () {
+ NSDIR=$1
+ eval "${NSDIR}_CNT=''"
+}
+
+ckstats () {
+ HOST=$1
+ LABEL="$2"
+ NSDIR="$3"
+ EXPECTED="$4"
+ $RNDCCMD $HOST stats
+ NEW_CNT=0`sed -n -e 's/[ ]*\([0-9]*\).response policy.*/\1/p' \
+ $NSDIR/named.stats | tail -1`
+ eval "OLD_CNT=0\$${NSDIR}_CNT"
+ GOT=`expr $NEW_CNT - $OLD_CNT`
+ if test "$GOT" -ne "$EXPECTED"; then
+ setret "wrong $LABEL $NSDIR statistics of $GOT instead of $EXPECTED"
+ fi
+ eval "${NSDIR}_CNT=$NEW_CNT"
+}
+
+ckstatsrange () {
+ HOST=$1
+ LABEL="$2"
+ NSDIR="$3"
+ MIN="$4"
+ MAX="$5"
+ $RNDCCMD $HOST stats
+ NEW_CNT=0`sed -n -e 's/[ ]*\([0-9]*\).response policy.*/\1/p' \
+ $NSDIR/named.stats | tail -1`
+ eval "OLD_CNT=0\$${NSDIR}_CNT"
+ GOT=`expr $NEW_CNT - $OLD_CNT`
+ if test "$GOT" -lt "$MIN" -o "$GOT" -gt "$MAX"; then
+ setret "wrong $LABEL $NSDIR statistics of $GOT instead of ${MIN}..${MAX}"
+ fi
+ eval "${NSDIR}_CNT=$NEW_CNT"
+}
+
+# $1=message
+# $2=optional test file name
+start_group () {
+ ret=0
+ t=`expr $t + 1`
+ test -n "$1" && date "+${TS}checking $1 (${t})" | cat_i
+ TEST_FILE=$2
+ if test -n "$TEST_FILE"; then
+ GROUP_NM="-$TEST_FILE"
+ load_db
+ else
+ GROUP_NM=
+ fi
+ dnsrps_loaded
+ TEST_NUM=0
+}
+
+end_group () {
+ if test -n "$TEST_FILE"; then
+ # remove the previous set of test rules
+ copy_setports $TEST_FILE tmp
+ sed -e 's/[ ]add[ ]/ delete /' tmp | $NSUPDATE
+ rm -f tmp
+ TEST_FILE=
+ fi
+ ckalive $ns3 "failed; ns3 server crashed and restarted"
+ dnsrps_loaded
+ GROUP_NM=
+}
+
+clean_result () {
+ if test -z "$SAVE_RESULTS"; then
+ rm -f $*
+ fi
+}
+
+# $1=dig args
+# $2=other dig output file
+ckresult () {
+ #ckalive "$1" "server crashed by 'dig $1'" || return 1
+ expr "$1" : 'TCP ' > /dev/null && tcp=1 || tcp=0
+ digarg=${1#TCP }
+
+ if grep "flags:.* aa .*ad;" $DIGNM; then
+ setret "'dig $digarg' AA and AD set;"
+ elif grep "flags:.* aa .*ad;" $DIGNM; then
+ setret "'dig $digarg' AD set;"
+ fi
+
+ if $PERL $SYSTEMTESTTOP/digcomp.pl $DIGNM $2 >/dev/null; then
+ grep -q 'Truncated, retrying in TCP' $DIGNM && trunc=1 || trunc=0
+ if [ "$tcp" -ne "$trunc" ]; then
+ setret "'dig $digarg' wrong; no or unexpected truncation in $DIGNM"
+ return 1
+ fi
+ clean_result ${DIGNM}*
+ return 0
+ fi
+ setret "'dig $digarg' wrong; diff $DIGNM $2"
+ return 1
+}
+
+# check only that the server does not crash
+# $1=target domain
+# $2=optional query type
+nocrash () {
+ digcmd $* >/dev/null
+ ckalive "$*" "server crashed by 'dig $*'"
+}
+
+
+# check rewrite to NXDOMAIN
+# $1=target domain
+# $2=optional query type
+nxdomain () {
+ make_dignm
+ digcmd $* \
+ | sed -e 's/^[a-z].* IN CNAME /;xxx &/' \
+ -e 's/^[a-z].* IN RRSIG /;xxx &/' \
+ >$DIGNM
+ ckresult "$*" proto.nxdomain
+}
+
+# check rewrite to NODATA
+# $1=target domain
+# $2=optional query type
+nodata () {
+ make_dignm
+ digcmd $* \
+ | sed -e 's/^[a-z].* IN CNAME /;xxx &/' >$DIGNM
+ ckresult "$*" proto.nodata
+}
+
+# check rewrite to an address
+# modify the output so that it is easily compared, but save the original line
+# $1=IPv4 address
+# $2=digcmd args
+# $3=optional TTL
+addr () {
+ ADDR=$1
+ make_dignm
+ digcmd $2 >$DIGNM
+ #ckalive "$2" "server crashed by 'dig $2'" || return 1
+ ADDR_ESC=`echo "$ADDR" | sed -e 's/\./\\\\./g'`
+ ADDR_TTL=`tr -d '\r' < $DIGNM | sed -n -e "s/^[-.a-z0-9]\{1,\}[ ]*\([0-9]*\) IN AA* ${ADDR_ESC}\$/\1/p"`
+ if test -z "$ADDR_TTL"; then
+ setret "'dig $2' wrong; no address $ADDR record in $DIGNM"
+ return 1
+ fi
+ if test -n "$3" && test "$ADDR_TTL" -ne "$3"; then
+ setret "'dig $2' wrong; TTL=$ADDR_TTL instead of $3 in $DIGNM"
+ return 1
+ fi
+ clean_result ${DIGNM}*
+}
+
+# Check that a response is not rewritten
+# Use $ns1 instead of the authority for most test domains, $ns2 to prevent
+# spurious differences for `dig +norecurse`
+# $1=optional "TCP"
+# remaining args for dig
+nochange () {
+ make_dignm
+ digcmd $* >$DIGNM
+ digcmd $* @$ns1 >${DIGNM}_OK
+ ckresult "$*" ${DIGNM}_OK && clean_result ${DIGNM}_OK
+}
+
+nochange_ns10 () {
+ make_dignm
+ digcmd $* >$DIGNM
+ digcmd $* @$ns10 >${DIGNM}_OK
+ ckresult "$*" ${DIGNM}_OK && clean_result ${DIGNM}_OK
+}
+
+# check against a 'here document'
+here () {
+ make_dignm
+ sed -e 's/^[ ]*//' >${DIGNM}_OK
+ digcmd $* >$DIGNM
+ ckresult "$*" ${DIGNM}_OK
+}
+
+# check dropped response
+DROPPED='^;; connection timed out; no servers could be reached'
+drop () {
+ make_dignm
+ digcmd $* >$DIGNM
+ if grep "$DROPPED" $DIGNM >/dev/null; then
+ clean_result ${DIGNM}*
+ return 0
+ fi
+ setret "'dig $1' wrong; response in $DIGNM"
+ return 1
+}
+
+nsd() {
+ $NSUPDATE -p ${PORT} << EOF
+ server $1
+ ttl 300
+ update $2 $3 IN CNAME .
+ update $2 $4 IN CNAME .
+ send
+EOF
+ sleep 2
+}
+
+#
+# generate prototype NXDOMAIN response to compare against.
+#
+make_proto_nxdomain() {
+ digcmd nonexistent @$ns2 >proto.nxdomain || return 1
+ grep "status: NXDOMAIN" proto.nxdomain >/dev/null || return 1
+ return 0
+}
+
+#
+# generate prototype NODATA response to compare against.
+#
+make_proto_nodata() {
+ digcmd txt-only.tld2 @$ns2 >proto.nodata || return 1
+ grep "status: NOERROR" proto.nodata >/dev/null || return 1
+ return 0
+}
+
+for mode in native dnsrps; do
+ status=0
+ case ${mode} in
+ native)
+ if [ -e dnsrps-only ] ; then
+ echo_i "'dnsrps-only' found: skipping native RPZ sub-test"
+ continue
+ else
+ echo_i "running native RPZ sub-test"
+ fi
+ ;;
+ dnsrps)
+ if [ -e dnsrps-off ] ; then
+ echo_i "'dnsrps-off' found: skipping DNSRPS sub-test"
+ continue
+ fi
+ echo_i "attempting to configure servers with DNSRPS..."
+ stop_server --use-rndc --port ${CONTROLPORT}
+ $SHELL ./setup.sh -N -D $DEBUG
+ for server in ns*; do
+ resetstats $server
+ done
+ sed -n 's/^## //p' dnsrps.conf | cat_i
+ if grep '^#fail' dnsrps.conf >/dev/null; then
+ echo_i "exit status: 1"
+ exit 1
+ fi
+ if grep '^#skip' dnsrps.conf > /dev/null; then
+ echo_i "DNSRPS sub-test skipped"
+ continue
+ else
+ echo_i "running DNSRPS sub-test"
+ start_server --noclean --restart --port ${PORT}
+ sleep 3
+ fi
+ ;;
+ esac
+
+ # make prototype files to check against rewritten results
+ retry_quiet 10 make_proto_nxdomain
+ retry_quiet 10 make_proto_nodata
+
+ start_group "QNAME rewrites" test1
+ nochange . # 1 do not crash or rewrite root
+ nxdomain a0-1.tld2 # 2
+ nodata a3-1.tld2 # 3
+ nodata a3-2.tld2 # 4 nodata at DNAME itself
+ nochange sub.a3-2.tld2 # 5 miss where DNAME might work
+ nxdomain a4-2.tld2 # 6 rewrite based on CNAME target
+ nxdomain a4-2-cname.tld2 # 7
+ nodata a4-3-cname.tld2 # 8
+ addr 12.12.12.12 a4-1.sub1.tld2 # 9 A replacement
+ addr 12.12.12.12 a4-1.sub2.tld2 # 10 A replacement with wildcard
+ addr 12.12.12.12 nxc1.sub1.tld2 # 11 replace NXDOMAIN with CNAME
+ addr 12.12.12.12 nxc2.sub1.tld2 # 12 replace NXDOMAIN with CNAME chain
+ addr 127.4.4.1 a4-4.tld2 # 13 prefer 1st conflicting QNAME zone
+ nochange a6-1.tld2 # 14
+ addr 127.6.2.1 a6-2.tld2 # 15
+ addr 56.56.56.56 a3-6.tld2 # 16 wildcard CNAME
+ addr 57.57.57.57 a3-7.sub1.tld2 # 17 wildcard CNAME
+ addr 127.0.0.16 a4-5-cname3.tld2 # 18 CNAME chain
+ addr 127.0.0.17 a4-6-cname3.tld2 # 19 stop short in CNAME chain
+ nochange a5-2.tld2 +norecurse # 20 check that RD=1 is required
+ nochange a5-3.tld2 +norecurse # 21
+ nochange a5-4.tld2 +norecurse # 22
+ nochange sub.a5-4.tld2 +norecurse # 23
+ nxdomain c1.crash2.tld3 # 24 assert in rbtdb.c
+ nxdomain a0-1.tld2 +dnssec # 25 simple DO=1 without signatures
+ nxdomain a0-1.tld2s +nodnssec # 26 simple DO=0 with signatures
+ nochange a0-1.tld2s +dnssec # 27 simple DO=1 with signatures
+ nxdomain a0-1s-cname.tld2s +dnssec # 28 DNSSEC too early in CNAME chain
+ nochange a0-1-scname.tld2 +dnssec # 29 DNSSEC on target in CNAME chain
+ nochange a0-1.tld2s srv +auth +dnssec # 30 no write for DNSSEC and no record
+ nxdomain a0-1.tld2s srv +nodnssec # 31
+ drop a3-8.tld2 any # 32 drop
+ nochange TCP a3-9.tld2 # 33 tcp-only
+ here x.servfail <<'EOF' # 34 qname-wait-recurse yes
+ ;; status: SERVFAIL, x
+EOF
+ addr 35.35.35.35 "x.servfail @$ns5" # 35 qname-wait-recurse no
+ end_group
+ ckstats $ns3 test1 ns3 22
+ ckstats $ns5 test1 ns5 1
+ ckstats $ns6 test1 ns6 0
+
+ start_group "NXDOMAIN/NODATA action on QNAME trigger" test1
+ nxdomain a0-1.tld2 @$ns6 # 1
+ nodata a3-1.tld2 @$ns6 # 2
+ nodata a3-2.tld2 @$ns6 # 3 nodata at DNAME itself
+ nxdomain a4-2.tld2 @$ns6 # 4 rewrite based on CNAME target
+ nxdomain a4-2-cname.tld2 @$ns6 # 5
+ nodata a4-3-cname.tld2 @$ns6 # 6
+ addr 12.12.12.12 "a4-1.sub1.tld2 @$ns6" # 7 A replacement
+ addr 12.12.12.12 "a4-1.sub2.tld2 @$ns6" # 8 A replacement with wildcard
+ addr 127.4.4.1 "a4-4.tld2 @$ns6" # 9 prefer 1st conflicting QNAME zone
+ addr 12.12.12.12 "nxc1.sub1.tld2 @$ns6" # 10 replace NXDOMAIN w/ CNAME
+ addr 12.12.12.12 "nxc2.sub1.tld2 @$ns6" # 11 replace NXDOMAIN w/ CNAME chain
+ addr 127.6.2.1 "a6-2.tld2 @$ns6" # 12
+ addr 56.56.56.56 "a3-6.tld2 @$ns6" # 13 wildcard CNAME
+ addr 57.57.57.57 "a3-7.sub1.tld2 @$ns6" # 14 wildcard CNAME
+ addr 127.0.0.16 "a4-5-cname3.tld2 @$ns6" # 15 CNAME chain
+ addr 127.0.0.17 "a4-6-cname3.tld2 @$ns6" # 16 stop short in CNAME chain
+ nxdomain c1.crash2.tld3 @$ns6 # 17 assert in rbtdb.c
+ nxdomain a0-1.tld2 +dnssec @$ns6 # 18 simple DO=1 without sigs
+ nxdomain a0-1s-cname.tld2s +dnssec @$ns6 # 19
+ drop a3-8.tld2 any @$ns6 # 20 drop
+ end_group
+ ckstatsrange $ns3 test1 ns3 22 30
+ ckstats $ns5 test1 ns5 0
+ ckstats $ns6 test1 ns6 0
+
+ start_group "IP rewrites" test2
+ nodata a3-1.tld2 # 1 NODATA
+ nochange a3-2.tld2 # 2 no policy record so no change
+ nochange a4-1.tld2 # 3 obsolete PASSTHRU record style
+ nxdomain a4-2.tld2 # 4
+ nochange a4-2.tld2 -taaaa # 5 no A => no policy rewrite
+ nochange a4-2.tld2 -ttxt # 6 no A => no policy rewrite
+ nxdomain a4-2.tld2 -tany # 7 no A => no policy rewrite
+ nodata a4-3.tld2 # 8
+ nxdomain a3-1.tld2 -taaaa # 9 IPv6 policy
+ nochange a4-1-aaaa.tld2 -taaaa # 10
+ addr 127.0.0.1 a5-1-2.tld2 # 11 prefer smallest policy address
+ addr 127.0.0.1 a5-3.tld2 # 12 prefer first conflicting IP zone
+ nochange a5-4.tld2 +norecurse # 13 check that RD=1 is required for #14
+ addr 14.14.14.14 a5-4.tld2 # 14 prefer QNAME to IP
+ nochange a4-4.tld2 # 15 PASSTHRU
+ nxdomain c2.crash2.tld3 # 16 assert in rbtdb.c
+ addr 127.0.0.17 "a4-4.tld2 -b $ns1" # 17 client-IP address trigger
+ nxdomain a7-1.tld2 # 18 secondary policy zone (RT34450)
+ # updating an response zone policy
+ cp ns2/blv2.tld2.db.in ns2/bl.tld2.db
+ rndc_reload ns2 $ns2 bl.tld2
+ ck_soa 2 bl.tld2 $ns3
+ nochange a7-1.tld2 # 19 PASSTHRU
+ # ensure that a clock tick has occurred so that named will do the reload
+ sleep 1
+ cp ns2/blv3.tld2.db.in ns2/bl.tld2.db
+ rndc_reload ns2 $ns2 bl.tld2
+ ck_soa 3 bl.tld2 $ns3
+ nxdomain a7-1.tld2 # 20 secondary policy zone (RT34450)
+ end_group
+ ckstats $ns3 test2 ns3 12
+
+ # check that IP addresses for previous group were deleted from the radix tree
+ start_group "radix tree deletions"
+ nochange a3-1.tld2
+ nochange a3-2.tld2
+ nochange a4-1.tld2
+ nochange a4-2.tld2
+ nochange a4-2.tld2 -taaaa
+ nochange a4-2.tld2 -ttxt
+ nochange a4-2.tld2 -tany
+ nochange a4-3.tld2
+ nochange a3-1.tld2 -tAAAA
+ nochange a4-1-aaaa.tld2 -tAAAA
+ nochange a5-1-2.tld2
+ end_group
+ ckstats $ns3 'radix tree deletions' ns3 0
+
+ # these tests assume "min-ns-dots 0"
+ start_group "NSDNAME rewrites" test3
+ nextpart ns3/named.run > /dev/null
+ nochange a3-1.tld2 # 1
+ nochange a3-1.tld2 +dnssec # 2 this once caused problems
+ nxdomain a3-1.sub1.tld2 # 3 NXDOMAIN *.sub1.tld2 by NSDNAME
+ nxdomain a3-1.subsub.sub1.tld2 # 4
+ nxdomain a3-1.subsub.sub1.tld2 -tany # 5
+ addr 12.12.12.12 a4-2.subsub.sub2.tld2 # 6 walled garden for *.sub2.tld2
+ nochange a3-2.tld2. # 7 exempt rewrite by name
+ nochange a0-1.tld2. # 8 exempt rewrite by address block
+ addr 12.12.12.12 a4-1.tld2 # 9 prefer QNAME policy to NSDNAME
+ addr 127.0.0.1 a3-1.sub3.tld2 # 10 prefer policy for largest NSDNAME
+ addr 127.0.0.2 a3-1.subsub.sub3.tld2 # 11
+ nxdomain xxx.crash1.tld2 # 12 dns_db_detachnode() crash
+
+ nxdomain a3-1.stub # 13
+ nxdomain a3-1.static-stub # 14
+ nochange_ns10 a3-1.stub-nomatch # 15
+ nochange_ns10 a3-1.static-stub-nomatch # 16
+ if [ "$mode" = dnsrps ]; then
+ addr 12.12.12.12 as-ns.tld5. # 17 qname-as-ns
+ fi
+ nextpart ns3/named.run | grep -q "unrecognized NS rpz_rrset_find() failed: glue" &&
+ setret "seen: unrecognized NS rpz_rrset_find() failed: glue"
+ end_group
+ if [ "$mode" = dnsrps ]; then
+ ckstats $ns3 test3 ns3 10
+ else
+ ckstats $ns3 test3 ns3 9
+ fi
+
+ # these tests assume "min-ns-dots 0"
+ start_group "NSIP rewrites" test4
+ nextpart ns3/named.run > /dev/null
+ nxdomain a3-1.tld2 # 1 NXDOMAIN for all of tld2
+ nochange a3-2.tld2. # 2 exempt rewrite by name
+ nochange a0-1.tld2. # 3 exempt rewrite by address block
+ nochange a3-1.tld4 # 4 different NS IP address
+ nxdomain a4-1.stub # 5
+ nxdomain a4-1.static-stub # 6
+ nochange_ns10 a4-1.stub-nomatch # 7
+ nochange_ns10 a4-1.static-stub-nomatch # 8
+ if [ "$mode" = dnsrps ]; then
+ addr 12.12.12.12 as-ns.tld5. # 9 ip-as-ns
+ fi
+ nextpart ns3/named.run | grep -q "unrecognized NS rpz_rrset_find() failed: glue" &&
+ setret "seen: unrecognized NS rpz_rrset_find() failed: glue"
+ end_group
+
+ start_group "walled garden NSIP rewrites" test4a
+ addr 41.41.41.41 a3-1.tld2 # 1 walled garden for all of tld2
+ addr 2041::41 'a3-1.tld2 AAAA' # 2 walled garden for all of tld2
+ here a3-1.tld2 TXT <<'EOF' # 3 text message for all of tld2
+ ;; status: NOERROR, x
+ a3-1.tld2. x IN TXT "NSIP walled garden"
+EOF
+ end_group
+ if [ "$mode" = dnsrps ]; then
+ ckstats $ns3 test4 ns3 7
+ else
+ ckstats $ns3 test4 ns3 6
+ fi
+
+ # policies in ./test5 overridden by response-policy{} in ns3/named.conf
+ # and in ns5/named.conf
+ start_group "policy overrides" test5
+ addr 127.0.0.1 a3-1.tld2 # 1 bl-given
+ nochange a3-2.tld2 # 2 bl-passthru
+ nochange a3-3.tld2 # 3 bl-no-op (obsolete for passthru)
+ nochange a3-4.tld2 # 4 bl-disabled
+ nodata a3-5.tld2 # 5 bl-nodata zone recursive-only no
+ nodata a3-5.tld2 +norecurse # 6 bl-nodata zone recursive-only no
+ nodata a3-5.tld2 # 7 bl-nodata not needed
+ nxdomain a3-5.tld2 +norecurse @$ns5 # 8 bl-nodata global recursive-only no
+ nxdomain a3-5.tld2s @$ns5 # 9 bl-nodata global break-dnssec
+ nxdomain a3-5.tld2s +dnssec @$ns5 # 10 bl-nodata global break-dnssec
+ nxdomain a3-6.tld2 # 11 bl-nxdomain
+ here a3-7.tld2 -tany <<'EOF' # 12
+ ;; status: NOERROR, x
+ a3-7.tld2. x IN CNAME txt-only.tld2.
+ txt-only.tld2. x IN TXT "txt-only-tld2"
+EOF
+ addr 58.58.58.58 a3-8.tld2 # 13 bl_wildcname
+ addr 59.59.59.59 a3-9.sub9.tld2 # 14 bl_wildcname
+ addr 12.12.12.12 a3-15.tld2 # 15 bl-garden via CNAME to a12.tld2
+ addr 127.0.0.16 a3-16.tld2 100 # 16 bl max-policy-ttl 100
+ addr 17.17.17.17 "a3-17.tld2 @$ns5" 90 # 17 ns5 bl max-policy-ttl 90
+ drop a3-18.tld2 any # 18 bl-drop
+ nxdomain TCP a3-19.tld2 # 19 bl-tcp-only
+ end_group
+ ckstats $ns3 test5 ns3 12
+ ckstats $ns5 test5 ns5 4
+
+ # check that miscellaneous bugs are still absent
+ start_group "crashes" test6
+ for Q in RRSIG SIG ANY 'ANY +dnssec'; do
+ nocrash a3-1.tld2 -t$Q
+ nocrash a3-2.tld2 -t$Q
+ nocrash a3-5.tld2 -t$Q
+ nocrash www.redirect -t$Q
+ nocrash www.credirect -t$Q
+ done
+
+ # This is not a bug, because any data leaked by writing 24.4.3.2.10.rpz-ip
+ # (or whatever) is available by publishing "foo A 10.2.3.4" and then
+ # resolving foo.
+ # nxdomain 32.3.2.1.127.rpz-ip
+ end_group
+ ckstats $ns3 bugs ns3 8
+
+ # superficial test for major performance bugs
+ QPERF=`sh qperf.sh`
+ if test -n "$QPERF"; then
+ perf () {
+ date "+${TS}checking performance $1" | cat_i
+ # Dry run to prime everything
+ comment "before dry run $1"
+ $RNDCCMD $ns5 notrace
+ $QPERF -c -1 -l30 -d ns5/requests -s $ns5 -p ${PORT} >/dev/null
+ comment "before real test $1"
+ PFILE="ns5/$2.perf"
+ $QPERF -c -1 -l30 -d ns5/requests -s $ns5 -p ${PORT} >$PFILE
+ comment "after test $1"
+ X=`sed -n -e 's/.*Returned *\([^ ]*:\) *\([0-9]*\) .*/\1\2/p' $PFILE \
+ | tr '\n' ' '`
+ if test "$X" != "$3"; then
+ setret "wrong results '$X' in $PFILE"
+ fi
+ ckalive $ns5 "failed; server #5 crashed"
+ }
+ trim () {
+ sed -n -e 's/.*Queries per second: *\([0-9]*\).*/\1/p' ns5/$1.perf
+ }
+
+ # get qps with rpz
+ perf 'with RPZ' rpz 'NOERROR:2900 NXDOMAIN:100 '
+ RPZ=`trim rpz`
+ # turn off rpz and measure qps again
+ echo "# RPZ off" >ns5/rpz-switch
+ RNDCCMD_OUT=`$RNDCCMD $ns5 reload`
+ perf 'without RPZ' norpz 'NOERROR:3000 '
+ NORPZ=`trim norpz`
+
+ PERCENT=`expr \( "$RPZ" \* 100 + \( $NORPZ / 2 \) \) / $NORPZ`
+ echo_i "$RPZ qps with RPZ is $PERCENT% of $NORPZ qps without RPZ"
+
+ MIN_PERCENT=30
+ if test "$PERCENT" -lt $MIN_PERCENT; then
+ echo_i "$RPZ qps with rpz or $PERCENT% is below $MIN_PERCENT% of $NORPZ qps"
+ fi
+
+ if test "$PERCENT" -ge 100; then
+ echo_i "$RPZ qps with RPZ or $PERCENT% of $NORPZ qps without RPZ is too high"
+ fi
+
+ ckstats $ns5 performance ns5 200
+
+ else
+ echo_i "performance not checked; queryperf not available"
+ fi
+
+ if [ "$mode" = dnsrps ]; then
+ echo_i "checking that dnsrpzd is automatically restarted"
+ OLD_PID=`cat dnsrpzd.pid`
+ $KILL "$OLD_PID"
+ n=0
+ while true; do
+ NEW_PID=`cat dnsrpzd.pid 2>/dev/null`
+ if test -n "$NEW_PID" -a "0$OLD_PID" -ne "0$NEW_PID"; then
+ #echo "OLD_PID=$OLD_PID NEW_PID=$NEW_PID"
+ break;
+ fi
+ $DIG -p ${PORT} +short +norecurse a0-1.tld2 @$ns3 >/dev/null
+ n=`expr $n + 1`
+ if test "$n" -gt $TEN_SECS; then
+ setret "dnsrpzd did not restart"
+ break
+ fi
+ $WAIT_CMD
+ done
+ fi
+
+ # Ensure ns3 manages to transfer the fast-expire zone before shutdown.
+ nextpartreset ns3/named.run
+ wait_for_log 20 "zone fast-expire/IN: transferred serial 1" ns3/named.run
+
+ # reconfigure the ns5 primary server without the fast-expire zone, so
+ # it can't be refreshed on ns3, and will expire in 5 seconds.
+ cat /dev/null > ns5/expire.conf
+ rndc_reconfig ns5 10.53.0.5
+
+ # restart the main test RPZ server to see if that creates a core file
+ if test -z "$HAVE_CORE"; then
+ stop_server --use-rndc --port ${CONTROLPORT} ns3
+ restart 3 "rebuild-bl-rpz"
+ HAVE_CORE=`find ns* -name '*core*' -print`
+ test -z "$HAVE_CORE" || setret "found $HAVE_CORE; memory leak?"
+ fi
+
+ # look for complaints from lib/dns/rpz.c and bin/name/query.c
+ for runfile in ns*/named.run; do
+ EMSGS=`nextpart $runfile | grep -E -l 'invalid rpz|rpz.*failed'`
+ if test -n "$EMSGS"; then
+ setret "error messages in $runfile starting with:"
+ grep -E 'invalid rpz|rpz.*failed' ns*/named.run | \
+ sed -e '10,$d' -e 's/^//' | cat_i
+ fi
+ done
+
+ if [ native = "$mode" ]; then
+ # restart the main test RPZ server with a bad zone.
+ t=`expr $t + 1`
+ echo_i "checking that ns3 with broken rpz does not crash (${t})"
+ stop_server --use-rndc --port ${CONTROLPORT} ns3
+ cp ns3/broken.db.in ns3/bl.db
+ restart 3 # do not rebuild rpz zones
+ nocrash a3-1.tld2 -tA
+ stop_server --use-rndc --port ${CONTROLPORT} ns3
+ restart 3 "rebuild-bl-rpz"
+
+ t=`expr $t + 1`
+ echo_i "checking if rpz survives a certain class of failed reconfiguration attempts (${t})"
+ sed -e "s/^#BAD//" < ns3/named.conf.in > ns3/named.conf.tmp
+ copy_setports ns3/named.conf.tmp ns3/named.conf
+ rm ns3/named.conf.tmp
+ $RNDCCMD $ns3 reconfig > /dev/null 2>&1 && setret "failed"
+ sleep 1
+ copy_setports ns3/named.conf.in ns3/named.conf
+ $RNDCCMD $ns3 reconfig || setret "failed"
+
+ # reload a RPZ zone that is now deliberately broken.
+ t=`expr $t + 1`
+ echo_i "checking rpz failed update will keep previous rpz rules (${t})"
+ $DIG -p ${PORT} @$ns3 walled.tld2 > dig.out.$t.before
+ grep "walled\.tld2\..*IN.*A.*10\.0\.0\.1" dig.out.$t.before > /dev/null || setret "failed"
+ cp ns3/broken.db.in ns3/manual-update-rpz.db
+ rndc_reload ns3 $ns3 manual-update-rpz
+ sleep 1
+ # ensure previous RPZ rules still apply.
+ $DIG -p ${PORT} @$ns3 walled.tld2 > dig.out.$t.after
+ grep "walled\.tld2\..*IN.*A.*10\.0\.0\.1" dig.out.$t.after > /dev/null || setret "failed"
+
+ t=`expr $t + 1`
+ echo_i "checking reload of a mixed-case RPZ zone (${t})"
+ # First, a sanity check: the A6-2.TLD2.mixed-case-rpz RPZ record should
+ # cause a6-2.tld2 NOERROR answers to be rewritten to NXDOMAIN answers.
+ $DIG -p ${PORT} @$ns3 a6-2.tld2. A > dig.out.$t.before
+ grep "status: NXDOMAIN" dig.out.$t.before >/dev/null || setret "failed"
+ # Add a sibling name (a6-1.tld2.mixed-case-rpz, with "tld2" in lowercase
+ # rather than uppercase) before A6-2.TLD.mixed-case-rpz.
+ nextpart ns3/named.run > /dev/null
+ cp ns3/mixed-case-rpz-2.db.in ns3/mixed-case-rpz.db
+ rndc_reload ns3 $ns3 mixed-case-rpz
+ wait_for_log 20 "rpz: mixed-case-rpz: reload done" ns3/named.run
+ # a6-2.tld2 NOERROR answers should still be rewritten to NXDOMAIN answers.
+ # (The bug we try to trigger here caused a6-2.tld2.mixed-case-rpz to be
+ # erroneously removed from the summary RPZ database after reload.)
+ $DIG -p ${PORT} @$ns3 a6-2.tld2. A > dig.out.$t.after
+ grep "status: NXDOMAIN" dig.out.$t.after >/dev/null || setret "failed"
+ fi
+
+ t=`expr $t + 1`
+ echo_i "checking that ttl values are not zeroed when qtype is '*' (${t})"
+ $DIG +noall +answer -p ${PORT} @$ns3 any a3-2.tld2 > dig.out.$t
+ ttl=`awk '/a3-2 tld2 text/ {print $2}' dig.out.$t`
+ if test ${ttl:=0} -eq 0; then setret "failed"; fi
+
+ t=`expr $t + 1`
+ echo_i "checking rpz updates/transfers with parent nodes added after children (${t})"
+ # regression test for RT #36272: the success condition
+ # is the secondary server not crashing.
+ for i in 1 2 3 4 5; do
+ nsd $ns5 add example.com.policy1. '*.example.com.policy1.'
+ nsd $ns5 delete example.com.policy1. '*.example.com.policy1.'
+ done
+ for i in 1 2 3 4 5; do
+ nsd $ns5 add '*.example.com.policy1.' example.com.policy1.
+ nsd $ns5 delete '*.example.com.policy1.' example.com.policy1.
+ done
+
+ t=`expr $t + 1`
+ echo_i "checking that going from an empty policy zone works (${t})"
+ nsd $ns5 add '*.x.servfail.policy2.' x.servfail.policy2.
+ sleep 1
+ rndc_reload ns7 $ns7 policy2
+ $DIG z.x.servfail -p ${PORT} @$ns7 > dig.out.${t}
+ grep NXDOMAIN dig.out.${t} > /dev/null || setret "failed"
+
+ t=`expr $t + 1`
+ echo_i "checking that "add-soa no" at rpz zone level works (${t})"
+ $DIG z.x.servfail -p ${PORT} @$ns7 > dig.out.${t}
+ grep SOA dig.out.${t} > /dev/null && setret "failed"
+
+ if [ native = "$mode" ]; then
+ t=`expr $t + 1`
+ echo_i "checking that "add-soa yes" at response-policy level works (${t})"
+ $DIG walled.tld2 -p ${PORT} +noall +add @$ns3 > dig.out.${t}
+ grep "^manual-update-rpz\..*SOA" dig.out.${t} > /dev/null || setret "failed"
+ fi
+
+ if [ native = "$mode" ]; then
+ t=`expr $t + 1`
+ echo_i "reconfiguring server with 'add-soa no' (${t})"
+ cp ns3/named.conf ns3/named.conf.tmp
+ sed -e "s/add-soa yes/add-soa no/g" < ns3/named.conf.tmp > ns3/named.conf
+ rndc_reconfig ns3 $ns3
+ echo_i "checking that 'add-soa no' at response-policy level works (${t})"
+ $DIG walled.tld2 -p ${PORT} +noall +add @$ns3 > dig.out.${t}
+ grep "^manual-update-rpz\..*SOA" dig.out.${t} > /dev/null && setret "failed"
+ fi
+
+ if [ native = "$mode" ]; then
+ t=`expr $t + 1`
+ echo_i "checking that 'add-soa unset' works (${t})"
+ $DIG walled.tld2 -p ${PORT} +noall +add @$ns8 > dig.out.${t}
+ grep "^manual-update-rpz\..*SOA" dig.out.${t} > /dev/null || setret "failed"
+ fi
+
+ # dnsrps does not allow NS RRs in policy zones, so this check
+ # with dnsrps results in no rewriting.
+ if [ native = "$mode" ]; then
+ t=`expr $t + 1`
+ echo_i "checking rpz with delegation fails correctly (${t})"
+ $DIG -p ${PORT} @$ns3 ns example.com > dig.out.$t
+ grep "status: SERVFAIL" dig.out.$t > /dev/null || setret "failed"
+
+ t=`expr $t + 1`
+ echo_i "checking policies from expired zone are no longer in effect ($t)"
+ $DIG -p ${PORT} @$ns3 a expired > dig.out.$t
+ grep "expired.*10.0.0.10" dig.out.$t > /dev/null && setret "failed"
+ grep "fast-expire/IN: response-policy zone expired" ns3/named.run > /dev/null || setret "failed"
+ fi
+
+ # RPZ 'CNAME *.' (NODATA) trumps DNS64. Test against various DNS64 scenarios.
+ for label in a-only no-a-no-aaaa a-plus-aaaa
+ do
+ for type in AAAA A
+ do
+ t=`expr $t + 1`
+ case $label in
+ a-only)
+ echo_i "checking rpz 'CNAME *.' (NODATA) with dns64, $type lookup with A-only (${t})"
+ ;;
+ no-a-no-aaaa)
+ echo_i "checking rpz 'CNAME *.' (NODATA) with dns64, $type lookup with no A or AAAA (${t})"
+ ;;
+ a-plus-aaaa)
+ echo_i "checking rpz 'CNAME *.' (NODATA) with dns64, $type lookup with A and AAAA (${t})"
+ ;;
+ esac
+ ret=0
+ $DIG ${label}.example -p ${PORT} $type @10.53.0.9 > dig.out.${t}
+ grep "status: NOERROR" dig.out.$t > /dev/null || ret=1
+ grep "ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 2$" dig.out.$t > /dev/null || ret=1
+ grep "^rpz" dig.out.$t > /dev/null || ret=1
+ [ $ret -eq 0 ] || echo_i "failed"
+ status=`expr $status + $ret`
+ done
+ done
+
+ if [ native = "$mode" ]; then
+ t=`expr $t + 1`
+ echo_i "checking that rewriting CD=1 queries handles pending data correctly (${t})"
+ $RNDCCMD $ns3 flush
+ $RNDCCMD $ns6 flush
+ $DIG a7-2.tld2s -p ${PORT} @$ns6 +cd > dig.out.${t}
+ grep -w "1.1.1.1" dig.out.${t} > /dev/null || setret "failed"
+ fi
+
+ [ $status -ne 0 ] && pf=fail || pf=pass
+ case $mode in
+ native)
+ native=$status
+ echo_i "status (native RPZ sub-test): $status ($pf)";;
+
+ dnsrps)
+ dnsrps=$status
+ echo_i "status (DNSRPS sub-test): $status ($pf)";;
+ *) echo_i "invalid test mode";;
+ esac
+done
+status=`expr ${native:-0} + ${dnsrps:-0}`
+
+[ $status -eq 0 ] || exit 1