diff options
author | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-08 16:41:28 +0000 |
---|---|---|
committer | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-08 16:41:28 +0000 |
commit | 14509ce60103dab695cef4d4f31321bab27ab967 (patch) | |
tree | 5959cfb9832b3af242a1ca45d4a1227acae67d87 /bin/tests/system/acl | |
parent | Adding debian version 1:9.18.19-1~deb12u1. (diff) | |
download | bind9-14509ce60103dab695cef4d4f31321bab27ab967.tar.xz bind9-14509ce60103dab695cef4d4f31321bab27ab967.zip |
Merging upstream version 1:9.18.24.
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to 'bin/tests/system/acl')
-rw-r--r-- | bin/tests/system/acl/ns2/named1.conf.in | 2 | ||||
-rw-r--r-- | bin/tests/system/acl/ns2/named2.conf.in | 2 | ||||
-rw-r--r-- | bin/tests/system/acl/ns2/named3.conf.in | 2 | ||||
-rw-r--r-- | bin/tests/system/acl/ns2/named4.conf.in | 2 | ||||
-rw-r--r-- | bin/tests/system/acl/ns2/named5.conf.in | 2 | ||||
-rw-r--r-- | bin/tests/system/acl/tests.sh | 159 |
6 files changed, 111 insertions, 58 deletions
diff --git a/bin/tests/system/acl/ns2/named1.conf.in b/bin/tests/system/acl/ns2/named1.conf.in index c3343a3..d87b1a7 100644 --- a/bin/tests/system/acl/ns2/named1.conf.in +++ b/bin/tests/system/acl/ns2/named1.conf.in @@ -47,7 +47,7 @@ key two { zone "." { type hint; - file "../../common/root.hint"; + file "../../_common/root.hint"; }; zone "example" { diff --git a/bin/tests/system/acl/ns2/named2.conf.in b/bin/tests/system/acl/ns2/named2.conf.in index ac9ac84..2456e99 100644 --- a/bin/tests/system/acl/ns2/named2.conf.in +++ b/bin/tests/system/acl/ns2/named2.conf.in @@ -47,7 +47,7 @@ key two { zone "." { type hint; - file "../../common/root.hint"; + file "../../_common/root.hint"; }; zone "example" { diff --git a/bin/tests/system/acl/ns2/named3.conf.in b/bin/tests/system/acl/ns2/named3.conf.in index efa73fa..99320a7 100644 --- a/bin/tests/system/acl/ns2/named3.conf.in +++ b/bin/tests/system/acl/ns2/named3.conf.in @@ -60,7 +60,7 @@ acl accept { zone "." { type hint; - file "../../common/root.hint"; + file "../../_common/root.hint"; }; zone "example" { diff --git a/bin/tests/system/acl/ns2/named4.conf.in b/bin/tests/system/acl/ns2/named4.conf.in index 54c0da3..08bd80c 100644 --- a/bin/tests/system/acl/ns2/named4.conf.in +++ b/bin/tests/system/acl/ns2/named4.conf.in @@ -59,7 +59,7 @@ acl check2 { !key two; 10.53.0.2; }; zone "." { type hint; - file "../../common/root.hint"; + file "../../_common/root.hint"; }; zone "example" { diff --git a/bin/tests/system/acl/ns2/named5.conf.in b/bin/tests/system/acl/ns2/named5.conf.in index e5b57f0..94371d0 100644 --- a/bin/tests/system/acl/ns2/named5.conf.in +++ b/bin/tests/system/acl/ns2/named5.conf.in @@ -49,7 +49,7 @@ key two { zone "." { type hint; - file "../../common/root.hint"; + file "../../_common/root.hint"; }; zone "example" { diff --git a/bin/tests/system/acl/tests.sh b/bin/tests/system/acl/tests.sh index 48536da..4e6c241 100644 --- a/bin/tests/system/acl/tests.sh +++ b/bin/tests/system/acl/tests.sh @@ -16,7 +16,7 @@ set -e . ../conf.sh DIGOPTS="+tcp +noadd +nosea +nostat +noquest +nocomm +nocmd -p ${PORT}" -RNDCCMD="$RNDC -c ../common/rndc.conf -p ${CONTROLPORT} -s" +RNDCCMD="$RNDC -c ../_common/rndc.conf -p ${CONTROLPORT} -s" status=0 t=0 @@ -25,15 +25,20 @@ echo_i "testing basic ACL processing" # key "one" should fail t=$((t + 1)) $DIG $DIGOPTS tsigzone. \ - @10.53.0.2 -b 10.53.0.1 axfr -y one:1234abcd8765 > dig.out.${t} -grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; } - + @10.53.0.2 -b 10.53.0.1 axfr -y one:1234abcd8765 >dig.out.${t} +grep "^;" dig.out.${t} >/dev/null 2>&1 || { + echo_i "test $t failed" + status=1 +} # any other key should be fine t=$((t + 1)) $DIG $DIGOPTS tsigzone. \ - @10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 > dig.out.${t} -grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; } + @10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 >dig.out.${t} +grep "^;" dig.out.${t} >/dev/null 2>&1 && { + echo_i "test $t failed" + status=1 +} copy_setports ns2/named2.conf.in ns2/named.conf rndc_reload ns2 10.53.0.2 @@ -42,19 +47,28 @@ sleep 5 # prefix 10/8 should fail t=$((t + 1)) $DIG $DIGOPTS tsigzone. \ - @10.53.0.2 -b 10.53.0.1 axfr -y one:1234abcd8765 > dig.out.${t} -grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; } + @10.53.0.2 -b 10.53.0.1 axfr -y one:1234abcd8765 >dig.out.${t} +grep "^;" dig.out.${t} >/dev/null 2>&1 || { + echo_i "test $t failed" + status=1 +} # any other address should work, as long as it sends key "one" t=$((t + 1)) $DIG $DIGOPTS tsigzone. \ - @10.53.0.2 -b 127.0.0.1 axfr -y two:1234abcd8765 > dig.out.${t} -grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; } + @10.53.0.2 -b 127.0.0.1 axfr -y two:1234abcd8765 >dig.out.${t} +grep "^;" dig.out.${t} >/dev/null 2>&1 || { + echo_i "test $t failed" + status=1 +} t=$((t + 1)) $DIG $DIGOPTS tsigzone. \ - @10.53.0.2 -b 127.0.0.1 axfr -y one:1234abcd8765 > dig.out.${t} -grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; } + @10.53.0.2 -b 127.0.0.1 axfr -y one:1234abcd8765 >dig.out.${t} +grep "^;" dig.out.${t} >/dev/null 2>&1 && { + echo_i "test $t failed" + status=1 +} echo_i "testing nested ACL processing" # all combinations of 10.53.0.{1|2} with key {one|two}, should succeed @@ -65,43 +79,64 @@ sleep 5 # should succeed t=$((t + 1)) $DIG $DIGOPTS tsigzone. \ - @10.53.0.2 -b 10.53.0.2 axfr -y two:1234abcd8765 > dig.out.${t} -grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; } + @10.53.0.2 -b 10.53.0.2 axfr -y two:1234abcd8765 >dig.out.${t} +grep "^;" dig.out.${t} >/dev/null 2>&1 && { + echo_i "test $t failed" + status=1 +} # should succeed t=$((t + 1)) $DIG $DIGOPTS tsigzone. \ - @10.53.0.2 -b 10.53.0.2 axfr -y one:1234abcd8765 > dig.out.${t} -grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; } + @10.53.0.2 -b 10.53.0.2 axfr -y one:1234abcd8765 >dig.out.${t} +grep "^;" dig.out.${t} >/dev/null 2>&1 && { + echo_i "test $t failed" + status=1 +} # should succeed t=$((t + 1)) $DIG $DIGOPTS tsigzone. \ - @10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 > dig.out.${t} -grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; } + @10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 >dig.out.${t} +grep "^;" dig.out.${t} >/dev/null 2>&1 && { + echo_i "test $t failed" + status=1 +} # should succeed t=$((t + 1)) $DIG $DIGOPTS tsigzone. \ - @10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 > dig.out.${t} -grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; } + @10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 >dig.out.${t} +grep "^;" dig.out.${t} >/dev/null 2>&1 && { + echo_i "test $t failed" + status=1 +} # but only one or the other should fail t=$((t + 1)) $DIG $DIGOPTS tsigzone. \ - @10.53.0.2 -b 127.0.0.1 axfr -y one:1234abcd8765 > dig.out.${t} -grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; } + @10.53.0.2 -b 127.0.0.1 axfr -y one:1234abcd8765 >dig.out.${t} +grep "^;" dig.out.${t} >/dev/null 2>&1 || { + echo_i "test $t failed" + status=1 +} t=$((t + 1)) $DIG $DIGOPTS tsigzone. \ - @10.53.0.2 -b 10.53.0.2 axfr > dig.out.${t} -grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $tt failed" ; status=1; } + @10.53.0.2 -b 10.53.0.2 axfr >dig.out.${t} +grep "^;" dig.out.${t} >/dev/null 2>&1 || { + echo_i "test $tt failed" + status=1 +} # and other values? right out t=$((t + 1)) $DIG $DIGOPTS tsigzone. \ - @10.53.0.2 -b 127.0.0.1 axfr -y "${DEFAULT_HMAC}:three:1234abcd8765" > dig.out.${t} -grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; } + @10.53.0.2 -b 127.0.0.1 axfr -y "${DEFAULT_HMAC}:three:1234abcd8765" >dig.out.${t} +grep "^;" dig.out.${t} >/dev/null 2>&1 || { + echo_i "test $t failed" + status=1 +} # now we only allow 10.53.0.1 *and* key one, or 10.53.0.2 *and* key two copy_setports ns2/named4.conf.in ns2/named.conf @@ -111,32 +146,47 @@ sleep 5 # should succeed t=$((t + 1)) $DIG $DIGOPTS tsigzone. \ - @10.53.0.2 -b 10.53.0.2 axfr -y two:1234abcd8765 > dig.out.${t} -grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; } + @10.53.0.2 -b 10.53.0.2 axfr -y two:1234abcd8765 >dig.out.${t} +grep "^;" dig.out.${t} >/dev/null 2>&1 && { + echo_i "test $t failed" + status=1 +} # should succeed t=$((t + 1)) $DIG $DIGOPTS tsigzone. \ - @10.53.0.2 -b 10.53.0.1 axfr -y one:1234abcd8765 > dig.out.${t} -grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; } + @10.53.0.2 -b 10.53.0.1 axfr -y one:1234abcd8765 >dig.out.${t} +grep "^;" dig.out.${t} >/dev/null 2>&1 && { + echo_i "test $t failed" + status=1 +} # should fail t=$((t + 1)) $DIG $DIGOPTS tsigzone. \ - @10.53.0.2 -b 10.53.0.2 axfr -y one:1234abcd8765 > dig.out.${t} -grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; } + @10.53.0.2 -b 10.53.0.2 axfr -y one:1234abcd8765 >dig.out.${t} +grep "^;" dig.out.${t} >/dev/null 2>&1 || { + echo_i "test $t failed" + status=1 +} # should fail t=$((t + 1)) $DIG $DIGOPTS tsigzone. \ - @10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 > dig.out.${t} -grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; } + @10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 >dig.out.${t} +grep "^;" dig.out.${t} >/dev/null 2>&1 || { + echo_i "test $t failed" + status=1 +} # should fail t=$((t + 1)) $DIG $DIGOPTS tsigzone. \ - @10.53.0.2 -b 10.53.0.3 axfr -y one:1234abcd8765 > dig.out.${t} -grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; } + @10.53.0.2 -b 10.53.0.3 axfr -y one:1234abcd8765 >dig.out.${t} +grep "^;" dig.out.${t} >/dev/null 2>&1 || { + echo_i "test $t failed" + status=1 +} echo_i "testing allow-query-on ACL processing" copy_setports ns2/named5.conf.in ns2/named.conf @@ -144,27 +194,30 @@ rndc_reload ns2 10.53.0.2 sleep 5 t=$((t + 1)) $DIG -p ${PORT} +tcp soa example. \ - @10.53.0.2 -b 10.53.0.3 > dig.out.${t} -grep "status: NOERROR" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; } + @10.53.0.2 -b 10.53.0.3 >dig.out.${t} +grep "status: NOERROR" dig.out.${t} >/dev/null 2>&1 || { + echo_i "test $t failed" + status=1 +} echo_i "testing blackhole ACL processing" t=$((t + 1)) ret=0 $DIG -p ${PORT} +tcp soa example. \ - @10.53.0.2 -b 10.53.0.3 > dig.out.1.${t} -grep "status: NOERROR" dig.out.1.${t} > /dev/null 2>&1 || ret=1 + @10.53.0.2 -b 10.53.0.3 >dig.out.1.${t} +grep "status: NOERROR" dig.out.1.${t} >/dev/null 2>&1 || ret=1 $DIG -p ${PORT} +tcp soa example. \ - @10.53.0.2 -b 10.53.0.8 > dig.out.2.${t} && ret=1 -grep "status: NOERROR" dig.out.2.${t} > /dev/null 2>&1 && ret=1 -grep "communications error" dig.out.2.${t} > /dev/null 2>&1 || ret=1 + @10.53.0.2 -b 10.53.0.8 >dig.out.2.${t} && ret=1 +grep "status: NOERROR" dig.out.2.${t} >/dev/null 2>&1 && ret=1 +grep "communications error" dig.out.2.${t} >/dev/null 2>&1 || ret=1 $DIG -p ${PORT} soa example. \ - @10.53.0.2 -b 10.53.0.3 > dig.out.3.${t} -grep "status: NOERROR" dig.out.3.${t} > /dev/null 2>&1 || ret=1 + @10.53.0.2 -b 10.53.0.3 >dig.out.3.${t} +grep "status: NOERROR" dig.out.3.${t} >/dev/null 2>&1 || ret=1 $DIG -p ${PORT} soa example. \ - @10.53.0.2 -b 10.53.0.8 > dig.out.4.${t} && ret=1 -grep "status: NOERROR" dig.out.4.${t} > /dev/null 2>&1 && ret=1 -grep "timed out" dig.out.4.${t} > /dev/null 2>&1 || ret=1 -grep ";; no servers could be reached" dig.out.4.${t} > /dev/null 2>&1 || ret=1 + @10.53.0.2 -b 10.53.0.8 >dig.out.4.${t} && ret=1 +grep "status: NOERROR" dig.out.4.${t} >/dev/null 2>&1 && ret=1 +grep "timed out" dig.out.4.${t} >/dev/null 2>&1 || ret=1 +grep ";; no servers could be reached" dig.out.4.${t} >/dev/null 2>&1 || ret=1 [ $ret -eq 0 ] || echo_i "failed" status=$((status + ret)) @@ -179,7 +232,7 @@ sleep 1 t=$((t + 1)) ret=0 echo_i "checking AXFR of example.com from ns3 with ACL allow-transfer { none; }; (${t})" -$DIG -p ${PORT} @10.53.0.3 example.com axfr > dig.out.${t} 2>&1 +$DIG -p ${PORT} @10.53.0.3 example.com axfr >dig.out.${t} 2>&1 grep "Transfer failed." dig.out.${t} >/dev/null 2>&1 || ret=1 [ $ret -eq 0 ] || echo_i "failed" status=$((status + ret)) @@ -192,7 +245,7 @@ sleep 1 t=$((t + 1)) ret=0 echo_i "re-checking AXFR of example.com from ns3 with ACL allow-transfer { none; }; (${t})" -$DIG -p ${PORT} @10.53.0.3 example.com axfr > dig.out.${t} 2>&1 +$DIG -p ${PORT} @10.53.0.3 example.com axfr >dig.out.${t} 2>&1 grep "Transfer failed." dig.out.${t} >/dev/null 2>&1 || ret=1 [ $ret -eq 0 ] || echo_i "failed" status=$((status + ret)) @@ -208,7 +261,7 @@ sleep 1 t=$((t + 1)) ret=0 echo_i "checking AXFR of example.com from ns4 with ACL allow-transfer { none; }; (${t})" -$DIG -p ${PORT} @10.53.0.4 example.com axfr > dig.out.${t} 2>&1 +$DIG -p ${PORT} @10.53.0.4 example.com axfr >dig.out.${t} 2>&1 grep "Transfer failed." dig.out.${t} >/dev/null 2>&1 || ret=1 [ $ret -eq 0 ] || echo_i "failed" status=$((status + ret)) @@ -221,7 +274,7 @@ sleep 1 t=$((t + 1)) ret=0 echo_i "re-checking AXFR of example.com from ns4 with ACL allow-transfer { none; }; (${t})" -$DIG -p ${PORT} @10.53.0.4 example.com axfr > dig.out.${t} 2>&1 +$DIG -p ${PORT} @10.53.0.4 example.com axfr >dig.out.${t} 2>&1 grep "Transfer failed." dig.out.${t} >/dev/null 2>&1 || ret=1 [ $ret -eq 0 ] || echo_i "failed" status=$((status + ret)) |