summaryrefslogtreecommitdiffstats
path: root/bin/tests/system/acl/tests.sh
diff options
context:
space:
mode:
Diffstat (limited to 'bin/tests/system/acl/tests.sh')
-rw-r--r--bin/tests/system/acl/tests.sh159
1 files changed, 106 insertions, 53 deletions
diff --git a/bin/tests/system/acl/tests.sh b/bin/tests/system/acl/tests.sh
index 48536da..4e6c241 100644
--- a/bin/tests/system/acl/tests.sh
+++ b/bin/tests/system/acl/tests.sh
@@ -16,7 +16,7 @@ set -e
. ../conf.sh
DIGOPTS="+tcp +noadd +nosea +nostat +noquest +nocomm +nocmd -p ${PORT}"
-RNDCCMD="$RNDC -c ../common/rndc.conf -p ${CONTROLPORT} -s"
+RNDCCMD="$RNDC -c ../_common/rndc.conf -p ${CONTROLPORT} -s"
status=0
t=0
@@ -25,15 +25,20 @@ echo_i "testing basic ACL processing"
# key "one" should fail
t=$((t + 1))
$DIG $DIGOPTS tsigzone. \
- @10.53.0.2 -b 10.53.0.1 axfr -y one:1234abcd8765 > dig.out.${t}
-grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
-
+ @10.53.0.2 -b 10.53.0.1 axfr -y one:1234abcd8765 >dig.out.${t}
+grep "^;" dig.out.${t} >/dev/null 2>&1 || {
+ echo_i "test $t failed"
+ status=1
+}
# any other key should be fine
t=$((t + 1))
$DIG $DIGOPTS tsigzone. \
- @10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 > dig.out.${t}
-grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
+ @10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 >dig.out.${t}
+grep "^;" dig.out.${t} >/dev/null 2>&1 && {
+ echo_i "test $t failed"
+ status=1
+}
copy_setports ns2/named2.conf.in ns2/named.conf
rndc_reload ns2 10.53.0.2
@@ -42,19 +47,28 @@ sleep 5
# prefix 10/8 should fail
t=$((t + 1))
$DIG $DIGOPTS tsigzone. \
- @10.53.0.2 -b 10.53.0.1 axfr -y one:1234abcd8765 > dig.out.${t}
-grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
+ @10.53.0.2 -b 10.53.0.1 axfr -y one:1234abcd8765 >dig.out.${t}
+grep "^;" dig.out.${t} >/dev/null 2>&1 || {
+ echo_i "test $t failed"
+ status=1
+}
# any other address should work, as long as it sends key "one"
t=$((t + 1))
$DIG $DIGOPTS tsigzone. \
- @10.53.0.2 -b 127.0.0.1 axfr -y two:1234abcd8765 > dig.out.${t}
-grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
+ @10.53.0.2 -b 127.0.0.1 axfr -y two:1234abcd8765 >dig.out.${t}
+grep "^;" dig.out.${t} >/dev/null 2>&1 || {
+ echo_i "test $t failed"
+ status=1
+}
t=$((t + 1))
$DIG $DIGOPTS tsigzone. \
- @10.53.0.2 -b 127.0.0.1 axfr -y one:1234abcd8765 > dig.out.${t}
-grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
+ @10.53.0.2 -b 127.0.0.1 axfr -y one:1234abcd8765 >dig.out.${t}
+grep "^;" dig.out.${t} >/dev/null 2>&1 && {
+ echo_i "test $t failed"
+ status=1
+}
echo_i "testing nested ACL processing"
# all combinations of 10.53.0.{1|2} with key {one|two}, should succeed
@@ -65,43 +79,64 @@ sleep 5
# should succeed
t=$((t + 1))
$DIG $DIGOPTS tsigzone. \
- @10.53.0.2 -b 10.53.0.2 axfr -y two:1234abcd8765 > dig.out.${t}
-grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
+ @10.53.0.2 -b 10.53.0.2 axfr -y two:1234abcd8765 >dig.out.${t}
+grep "^;" dig.out.${t} >/dev/null 2>&1 && {
+ echo_i "test $t failed"
+ status=1
+}
# should succeed
t=$((t + 1))
$DIG $DIGOPTS tsigzone. \
- @10.53.0.2 -b 10.53.0.2 axfr -y one:1234abcd8765 > dig.out.${t}
-grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
+ @10.53.0.2 -b 10.53.0.2 axfr -y one:1234abcd8765 >dig.out.${t}
+grep "^;" dig.out.${t} >/dev/null 2>&1 && {
+ echo_i "test $t failed"
+ status=1
+}
# should succeed
t=$((t + 1))
$DIG $DIGOPTS tsigzone. \
- @10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 > dig.out.${t}
-grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
+ @10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 >dig.out.${t}
+grep "^;" dig.out.${t} >/dev/null 2>&1 && {
+ echo_i "test $t failed"
+ status=1
+}
# should succeed
t=$((t + 1))
$DIG $DIGOPTS tsigzone. \
- @10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 > dig.out.${t}
-grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
+ @10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 >dig.out.${t}
+grep "^;" dig.out.${t} >/dev/null 2>&1 && {
+ echo_i "test $t failed"
+ status=1
+}
# but only one or the other should fail
t=$((t + 1))
$DIG $DIGOPTS tsigzone. \
- @10.53.0.2 -b 127.0.0.1 axfr -y one:1234abcd8765 > dig.out.${t}
-grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
+ @10.53.0.2 -b 127.0.0.1 axfr -y one:1234abcd8765 >dig.out.${t}
+grep "^;" dig.out.${t} >/dev/null 2>&1 || {
+ echo_i "test $t failed"
+ status=1
+}
t=$((t + 1))
$DIG $DIGOPTS tsigzone. \
- @10.53.0.2 -b 10.53.0.2 axfr > dig.out.${t}
-grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $tt failed" ; status=1; }
+ @10.53.0.2 -b 10.53.0.2 axfr >dig.out.${t}
+grep "^;" dig.out.${t} >/dev/null 2>&1 || {
+ echo_i "test $tt failed"
+ status=1
+}
# and other values? right out
t=$((t + 1))
$DIG $DIGOPTS tsigzone. \
- @10.53.0.2 -b 127.0.0.1 axfr -y "${DEFAULT_HMAC}:three:1234abcd8765" > dig.out.${t}
-grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
+ @10.53.0.2 -b 127.0.0.1 axfr -y "${DEFAULT_HMAC}:three:1234abcd8765" >dig.out.${t}
+grep "^;" dig.out.${t} >/dev/null 2>&1 || {
+ echo_i "test $t failed"
+ status=1
+}
# now we only allow 10.53.0.1 *and* key one, or 10.53.0.2 *and* key two
copy_setports ns2/named4.conf.in ns2/named.conf
@@ -111,32 +146,47 @@ sleep 5
# should succeed
t=$((t + 1))
$DIG $DIGOPTS tsigzone. \
- @10.53.0.2 -b 10.53.0.2 axfr -y two:1234abcd8765 > dig.out.${t}
-grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
+ @10.53.0.2 -b 10.53.0.2 axfr -y two:1234abcd8765 >dig.out.${t}
+grep "^;" dig.out.${t} >/dev/null 2>&1 && {
+ echo_i "test $t failed"
+ status=1
+}
# should succeed
t=$((t + 1))
$DIG $DIGOPTS tsigzone. \
- @10.53.0.2 -b 10.53.0.1 axfr -y one:1234abcd8765 > dig.out.${t}
-grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; }
+ @10.53.0.2 -b 10.53.0.1 axfr -y one:1234abcd8765 >dig.out.${t}
+grep "^;" dig.out.${t} >/dev/null 2>&1 && {
+ echo_i "test $t failed"
+ status=1
+}
# should fail
t=$((t + 1))
$DIG $DIGOPTS tsigzone. \
- @10.53.0.2 -b 10.53.0.2 axfr -y one:1234abcd8765 > dig.out.${t}
-grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
+ @10.53.0.2 -b 10.53.0.2 axfr -y one:1234abcd8765 >dig.out.${t}
+grep "^;" dig.out.${t} >/dev/null 2>&1 || {
+ echo_i "test $t failed"
+ status=1
+}
# should fail
t=$((t + 1))
$DIG $DIGOPTS tsigzone. \
- @10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 > dig.out.${t}
-grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
+ @10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 >dig.out.${t}
+grep "^;" dig.out.${t} >/dev/null 2>&1 || {
+ echo_i "test $t failed"
+ status=1
+}
# should fail
t=$((t + 1))
$DIG $DIGOPTS tsigzone. \
- @10.53.0.2 -b 10.53.0.3 axfr -y one:1234abcd8765 > dig.out.${t}
-grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
+ @10.53.0.2 -b 10.53.0.3 axfr -y one:1234abcd8765 >dig.out.${t}
+grep "^;" dig.out.${t} >/dev/null 2>&1 || {
+ echo_i "test $t failed"
+ status=1
+}
echo_i "testing allow-query-on ACL processing"
copy_setports ns2/named5.conf.in ns2/named.conf
@@ -144,27 +194,30 @@ rndc_reload ns2 10.53.0.2
sleep 5
t=$((t + 1))
$DIG -p ${PORT} +tcp soa example. \
- @10.53.0.2 -b 10.53.0.3 > dig.out.${t}
-grep "status: NOERROR" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; }
+ @10.53.0.2 -b 10.53.0.3 >dig.out.${t}
+grep "status: NOERROR" dig.out.${t} >/dev/null 2>&1 || {
+ echo_i "test $t failed"
+ status=1
+}
echo_i "testing blackhole ACL processing"
t=$((t + 1))
ret=0
$DIG -p ${PORT} +tcp soa example. \
- @10.53.0.2 -b 10.53.0.3 > dig.out.1.${t}
-grep "status: NOERROR" dig.out.1.${t} > /dev/null 2>&1 || ret=1
+ @10.53.0.2 -b 10.53.0.3 >dig.out.1.${t}
+grep "status: NOERROR" dig.out.1.${t} >/dev/null 2>&1 || ret=1
$DIG -p ${PORT} +tcp soa example. \
- @10.53.0.2 -b 10.53.0.8 > dig.out.2.${t} && ret=1
-grep "status: NOERROR" dig.out.2.${t} > /dev/null 2>&1 && ret=1
-grep "communications error" dig.out.2.${t} > /dev/null 2>&1 || ret=1
+ @10.53.0.2 -b 10.53.0.8 >dig.out.2.${t} && ret=1
+grep "status: NOERROR" dig.out.2.${t} >/dev/null 2>&1 && ret=1
+grep "communications error" dig.out.2.${t} >/dev/null 2>&1 || ret=1
$DIG -p ${PORT} soa example. \
- @10.53.0.2 -b 10.53.0.3 > dig.out.3.${t}
-grep "status: NOERROR" dig.out.3.${t} > /dev/null 2>&1 || ret=1
+ @10.53.0.2 -b 10.53.0.3 >dig.out.3.${t}
+grep "status: NOERROR" dig.out.3.${t} >/dev/null 2>&1 || ret=1
$DIG -p ${PORT} soa example. \
- @10.53.0.2 -b 10.53.0.8 > dig.out.4.${t} && ret=1
-grep "status: NOERROR" dig.out.4.${t} > /dev/null 2>&1 && ret=1
-grep "timed out" dig.out.4.${t} > /dev/null 2>&1 || ret=1
-grep ";; no servers could be reached" dig.out.4.${t} > /dev/null 2>&1 || ret=1
+ @10.53.0.2 -b 10.53.0.8 >dig.out.4.${t} && ret=1
+grep "status: NOERROR" dig.out.4.${t} >/dev/null 2>&1 && ret=1
+grep "timed out" dig.out.4.${t} >/dev/null 2>&1 || ret=1
+grep ";; no servers could be reached" dig.out.4.${t} >/dev/null 2>&1 || ret=1
[ $ret -eq 0 ] || echo_i "failed"
status=$((status + ret))
@@ -179,7 +232,7 @@ sleep 1
t=$((t + 1))
ret=0
echo_i "checking AXFR of example.com from ns3 with ACL allow-transfer { none; }; (${t})"
-$DIG -p ${PORT} @10.53.0.3 example.com axfr > dig.out.${t} 2>&1
+$DIG -p ${PORT} @10.53.0.3 example.com axfr >dig.out.${t} 2>&1
grep "Transfer failed." dig.out.${t} >/dev/null 2>&1 || ret=1
[ $ret -eq 0 ] || echo_i "failed"
status=$((status + ret))
@@ -192,7 +245,7 @@ sleep 1
t=$((t + 1))
ret=0
echo_i "re-checking AXFR of example.com from ns3 with ACL allow-transfer { none; }; (${t})"
-$DIG -p ${PORT} @10.53.0.3 example.com axfr > dig.out.${t} 2>&1
+$DIG -p ${PORT} @10.53.0.3 example.com axfr >dig.out.${t} 2>&1
grep "Transfer failed." dig.out.${t} >/dev/null 2>&1 || ret=1
[ $ret -eq 0 ] || echo_i "failed"
status=$((status + ret))
@@ -208,7 +261,7 @@ sleep 1
t=$((t + 1))
ret=0
echo_i "checking AXFR of example.com from ns4 with ACL allow-transfer { none; }; (${t})"
-$DIG -p ${PORT} @10.53.0.4 example.com axfr > dig.out.${t} 2>&1
+$DIG -p ${PORT} @10.53.0.4 example.com axfr >dig.out.${t} 2>&1
grep "Transfer failed." dig.out.${t} >/dev/null 2>&1 || ret=1
[ $ret -eq 0 ] || echo_i "failed"
status=$((status + ret))
@@ -221,7 +274,7 @@ sleep 1
t=$((t + 1))
ret=0
echo_i "re-checking AXFR of example.com from ns4 with ACL allow-transfer { none; }; (${t})"
-$DIG -p ${PORT} @10.53.0.4 example.com axfr > dig.out.${t} 2>&1
+$DIG -p ${PORT} @10.53.0.4 example.com axfr >dig.out.${t} 2>&1
grep "Transfer failed." dig.out.${t} >/dev/null 2>&1 || ret=1
[ $ret -eq 0 ] || echo_i "failed"
status=$((status + ret))
generated by cgit v1.2.3 (git 2.39.1) at 2024-06-07 08:46:12 +0000