Adding upstream version 5.7.1.upstream/5.7.1

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

1 files changed, 65 insertions, 0 deletions

diff --git a/modules/policy/policy.rpz.test.lua b/modules/policy/policy.rpz.test.lua
new file mode 100644
index 0000000..94fb9ce
--- /dev/null
+++ b/modules/policy/policy.rpz.test.lua
@@ -0,0 +1,65 @@
+
+local function prepare_cache()
+	cache.open(100*MB)
+	cache.clear()
+
+	local ffi = require('ffi')
+	local c = kres.context().cache
+
+	local passthru_addr = '\127\0\0\9'
+	rr_passthru = kres.rrset(todname('rpzpassthru.'), kres.type.A, kres.class.IN, 2147483647)
+	assert(rr_passthru:add_rdata(passthru_addr, #passthru_addr))
+	assert(c:insert(rr_passthru, nil, ffi.C.KR_RANK_SECURE + ffi.C.KR_RANK_AUTH))
+
+	c:commit()
+end
+
+local check_answer = require('test_utils').check_answer
+
+local function test_rpz()
+	check_answer('"CNAME ." return NXDOMAIN',
+		'nxdomain.', kres.type.A, kres.rcode.NXDOMAIN)
+	check_answer('"CNAME *." return NODATA',
+		'nodata.', kres.type.A, kres.rcode.NOERROR, {})
+	check_answer('"CNAME *. on wildcard" return NODATA',
+		'nodata.nxdomain.', kres.type.A, kres.rcode.NOERROR, {})
+	check_answer('"CNAME rpz-drop." be dropped',
+		'rpzdrop.', kres.type.A, kres.rcode.SERVFAIL)
+	check_answer('"CNAME rpz-passthru" return A rrset',
+		'rpzpassthru.', kres.type.A, kres.rcode.NOERROR, '127.0.0.9')
+	check_answer('"A 192.168.5.5" return local A rrset',
+		'rra.', kres.type.A, kres.rcode.NOERROR, '192.168.5.5')
+	check_answer('"A 192.168.6.6" with suffixed zone name in owner return local A rrset',
+		'rra-zonename-suffix.', kres.type.A, kres.rcode.NOERROR, '192.168.6.6')
+	check_answer('"A 192.168.7.7" with suffixed zone name in owner return local A rrset',
+		'testdomain.rra.', kres.type.A, kres.rcode.NOERROR, '192.168.7.7')
+	check_answer('non existing AAAA on rra domain return NODATA',
+		'rra.', kres.type.AAAA, kres.rcode.NOERROR, {})
+	check_answer('"A 192.168.8.8" and domain with uppercase and lowercase letters',
+		'case.sensitive.', kres.type.A, kres.rcode.NOERROR, '192.168.8.8')
+	check_answer('"A 192.168.8.8" and domain with uppercase and lowercase letters',
+		'CASe.SENSItivE.', kres.type.A, kres.rcode.NOERROR, '192.168.8.8')
+	check_answer('two AAAA records',
+		'two.records.', kres.type.AAAA, kres.rcode.NOERROR,
+		{'2001:db8::2', '2001:db8::1'})
+end
+
+local function test_rpz_soa()
+	check_answer('"CNAME ." return NXDOMAIN (SOA origin)',
+		'nxdomain-fqdn.', kres.type.A, kres.rcode.NXDOMAIN)
+	check_answer('"CNAME *." return NODATA (SOA origin)',
+		'nodata-fqdn.', kres.type.A, kres.rcode.NOERROR, {})
+end
+
+net.ipv4 = false
+net.ipv6 = false
+
+prepare_cache()
+
+policy.add(policy.rpz(policy.DENY, 'policy.test.rpz'))
+policy.add(policy.rpz(policy.DENY, 'policy.test.rpz.soa'))
+
+return {
+	test_rpz,
+	test_rpz_soa,
+}