From e2fc8e037ea6bb5de92b25ec9c12a624737ac5ca Mon Sep 17 00:00:00 2001 From: Daniel Baumann Date: Mon, 8 Apr 2024 18:41:29 +0200 Subject: Merging upstream version 1:9.18.24. Signed-off-by: Daniel Baumann --- bin/tests/system/rpz/clean.sh | 41 +- bin/tests/system/rpz/qperf.sh | 10 +- bin/tests/system/rpz/setup.sh | 68 +-- bin/tests/system/rpz/tests.sh | 1078 +++++++++++++++++++++-------------------- 4 files changed, 608 insertions(+), 589 deletions(-) (limited to 'bin/tests/system/rpz') diff --git a/bin/tests/system/rpz/clean.sh b/bin/tests/system/rpz/clean.sh index 35d6211..07cd667 100644 --- a/bin/tests/system/rpz/clean.sh +++ b/bin/tests/system/rpz/clean.sh @@ -16,16 +16,19 @@ USAGE="$0: [-Px]" DEBUG= while getopts "Px" c; do - case $c in - x) set -x ;; - P) PARTIAL=set ;; - *) echo "$USAGE" 1>&2; exit 1;; - esac + case $c in + x) set -x ;; + P) PARTIAL=set ;; + *) + echo "$USAGE" 1>&2 + exit 1 + ;; + esac done shift $((OPTIND - 1)) if test "$#" -ne 0; then - echo "$USAGE" 1>&2 - exit 1 + echo "$USAGE" 1>&2 + exit 1 fi # this might be called from setup.sh to partially clean up the files @@ -42,16 +45,16 @@ rm -f */policy2.db rm -f */*.jnl if [ ${PARTIAL:-unset} = unset ]; then - rm -f proto.* dsset-* trusted.conf dig.out* nsupdate.tmp ns*/*tmp - rm -f ns5/requests ns5/*.perf - rm -f */named.memstats */*.run */*.run.prev */named.stats */session.key - rm -f */*.log */*core */*.pid - rm -f ns*/named.lock - rm -f ns*/named.conf - rm -f ns*/*switch - rm -f dnsrps*.conf - rm -f dnsrpzd.conf - rm -f dnsrpzd-license-cur.conf dnsrpzd.rpzf dnsrpzd.sock dnsrpzd.pid - rm -f ns*/managed-keys.bind* - rm -f tmp + rm -f proto.* dsset-* trusted.conf dig.out* nsupdate.tmp ns*/*tmp + rm -f ns5/requests ns5/*.perf + rm -f */named.memstats */*.run */*.run.prev */named.stats */session.key + rm -f */*.log */*core */*.pid + rm -f ns*/named.lock + rm -f ns*/named.conf + rm -f ns*/*switch + rm -f dnsrps*.conf + rm -f dnsrpzd.conf + rm -f dnsrpzd-license-cur.conf dnsrpzd.rpzf dnsrpzd.sock dnsrpzd.pid + rm -f ns*/managed-keys.bind* + rm -f tmp fi diff --git a/bin/tests/system/rpz/qperf.sh b/bin/tests/system/rpz/qperf.sh index 146d1e2..1ec64fe 100644 --- a/bin/tests/system/rpz/qperf.sh +++ b/bin/tests/system/rpz/qperf.sh @@ -12,11 +12,11 @@ # information regarding copyright ownership. for QDIR in $(echo "$PATH" | tr : ' ') ../../../../contrib/queryperf; do - QPERF=$QDIR/queryperf - if test -f "$QPERF" -a -x "$QPERF"; then - echo $QPERF - exit 0 - fi + QPERF=$QDIR/queryperf + if test -f "$QPERF" -a -x "$QPERF"; then + echo $QPERF + exit 0 + fi done exit 0 diff --git a/bin/tests/system/rpz/setup.sh b/bin/tests/system/rpz/setup.sh index 75e4957..b263fda 100644 --- a/bin/tests/system/rpz/setup.sh +++ b/bin/tests/system/rpz/setup.sh @@ -22,26 +22,32 @@ QPERF=$($SHELL qperf.sh) USAGE="$0: [-DNx]" DEBUG= while getopts "DNx" c; do - case $c in - x) set -x; DEBUG=-x ;; - D) TEST_DNSRPS="-D" ;; - N) PARTIAL=-P ;; - *) echo "$USAGE" 1>&2; exit 1 ;; - esac + case $c in + x) + set -x + DEBUG=-x + ;; + D) TEST_DNSRPS="-D" ;; + N) PARTIAL=-P ;; + *) + echo "$USAGE" 1>&2 + exit 1 + ;; + esac done shift $((OPTIND - 1)) if test "$#" -ne 0; then - echo "$USAGE" 1>&2 - exit 1 + echo "$USAGE" 1>&2 + exit 1 fi if [ ${NOCLEAN:-unset} = unset ]; then - $SHELL clean.sh $PARTIAL $DEBUG + $SHELL clean.sh $PARTIAL $DEBUG fi for dir in ns*; do - touch $dir/named.run - nextpart $dir/named.run > /dev/null + touch $dir/named.run + nextpart $dir/named.run >/dev/null done copy_setports ns1/named.conf.in ns1/named.conf @@ -70,7 +76,7 @@ test -z "$(grep 'dnsrps-enable yes' dnsrps.conf)" && TEST_DNSRPS= # drop,tcp-only} are used to check policy overrides in named.conf. # NO-OP is an obsolete synonym for PASSHTRU for NM in '' -2 -given -disabled -passthru -no-op -nodata -nxdomain -cname -wildcname -garden -drop -tcp-only; do - sed -e "/SOA/s/blx/bl$NM/g" ns3/base.db >ns3/bl$NM.db + sed -e "/SOA/s/blx/bl$NM/g" ns3/base.db >ns3/bl$NM.db done # bl zones are dynamically updated. Add one zone that is updated manually. cp ns3/manual-update-rpz.db.in ns3/manual-update-rpz.db @@ -86,13 +92,13 @@ cp ns5/expire.conf.in ns5/expire.conf # $2=domain name # $3=input zone file # $4=output file -signzone () { - KEYNAME=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -K $1 $2) - cat $1/$3 $1/$KEYNAME.key > $1/tmp - $SIGNER -P -K $1 -o $2 -f $1/$4 $1/tmp >/dev/null - sed -n -e 's/\(.*\) IN DNSKEY \([0-9]\{1,\} [0-9]\{1,\} [0-9]\{1,\}\) \(.*\)/trust-anchors {"\1" static-key \2 "\3";};/p' $1/$KEYNAME.key >>trusted.conf - DSFILENAME=dsset-${2}. - rm $DSFILENAME $1/tmp +signzone() { + KEYNAME=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} -K $1 $2) + cat $1/$3 $1/$KEYNAME.key >$1/tmp + $SIGNER -P -K $1 -o $2 -f $1/$4 $1/tmp >/dev/null + sed -n -e 's/\(.*\) IN DNSKEY \([0-9]\{1,\} [0-9]\{1,\} [0-9]\{1,\}\) \(.*\)/trust-anchors {"\1" static-key \2 "\3";};/p' $1/$KEYNAME.key >>trusted.conf + DSFILENAME=dsset-${2}. + rm $DSFILENAME $1/tmp } signzone ns2 tld2s base-tld2s.db tld2s.db @@ -140,20 +146,20 @@ ns1.x.rpz-nsdname CNAME . EOF if test -n "$QPERF"; then - # Do not build the full zones if we will not use them. - $PERL -e 'for ($val = 1; $val <= 65535; ++$val) { + # Do not build the full zones if we will not use them. + $PERL -e 'for ($val = 1; $val <= 65535; ++$val) { printf("host-%05d\tA 192.168.%d.%d\n", $val, $val/256, $val%256); }' >>ns5/example.db - echo >>ns5/bl.db - echo "; rewrite some names" >>ns5/bl.db - $PERL -e 'for ($val = 2; $val <= 65535; $val += 69) { + echo >>ns5/bl.db + echo "; rewrite some names" >>ns5/bl.db + $PERL -e 'for ($val = 2; $val <= 65535; $val += 69) { printf("host-%05d.example.tld5\tCNAME\t.\n", $val); }' >>ns5/bl.db - echo >>ns5/bl.db - echo "; rewrite with some not entirely trivial patricia trees" >>ns5/bl.db - $PERL -e 'for ($val = 3; $val <= 65535; $val += 69) { + echo >>ns5/bl.db + echo "; rewrite with some not entirely trivial patricia trees" >>ns5/bl.db + $PERL -e 'for ($val = 3; $val <= 65535; $val += 69) { printf("32.%d.%d.168.192.rpz-ip \tCNAME\t.\n", $val%256, $val/256); }' >>ns5/bl.db @@ -172,8 +178,8 @@ cp ns6/bl.tld2s.db.in ns6/bl.tld2s.db # Run dnsrpzd to get the license and prime the static policy zones if test -n "$TEST_DNSRPS"; then - DNSRPZD="$(../rpz/dnsrps -p)" - cd ns3 - "$DNSRPZ" -D../dnsrpzd.rpzf -S../dnsrpzd.sock -C../dnsrpzd.conf \ - -w 0 -dddd -L stdout >./dnsrpzd.run 2>&1 + DNSRPZD="$(../rpz/dnsrps -p)" + cd ns3 + "$DNSRPZ" -D../dnsrpzd.rpzf -S../dnsrpzd.sock -C../dnsrpzd.conf \ + -w 0 -dddd -L stdout >./dnsrpzd.run 2>&1 fi diff --git a/bin/tests/system/rpz/tests.sh b/bin/tests/system/rpz/tests.sh index 658250e..199e75d 100644 --- a/bin/tests/system/rpz/tests.sh +++ b/bin/tests/system/rpz/tests.sh @@ -21,16 +21,16 @@ set -e . ../conf.sh ns=10.53.0 -ns1=$ns.1 # root, defining the others -ns2=$ns.2 # authoritative server whose records are rewritten -ns3=$ns.3 # main rewriting resolver -ns4=$ns.4 # another authoritative server that is rewritten -ns5=$ns.5 # another rewriting resolver -ns6=$ns.6 # a forwarding server -ns7=$ns.7 # another rewriting resolver -ns8=$ns.8 # another rewriting resolver -ns9=$ns.9 # another rewriting resolver -ns10=$ns.10 # authoritative server +ns1=$ns.1 # root, defining the others +ns2=$ns.2 # authoritative server whose records are rewritten +ns3=$ns.3 # main rewriting resolver +ns4=$ns.4 # another authoritative server that is rewritten +ns5=$ns.5 # another rewriting resolver +ns6=$ns.6 # a forwarding server +ns7=$ns.7 # another rewriting resolver +ns8=$ns.8 # another rewriting resolver +ns9=$ns.9 # another rewriting resolver +ns10=$ns.10 # authoritative server HAVE_CORE= @@ -43,90 +43,100 @@ ARGS= USAGE="$0: [-xS]" while getopts "xS:" c; do - case $c in - x) set -x; DEBUG=-x; ARGS="$ARGS -x";; - S) SAVE_RESULTS=-S; ARGS="$ARGS -S";; - *) echo "$USAGE" 1>&2; exit 1;; - esac + case $c in + x) + set -x + DEBUG=-x + ARGS="$ARGS -x" + ;; + S) + SAVE_RESULTS=-S + ARGS="$ARGS -S" + ;; + *) + echo "$USAGE" 1>&2 + exit 1 + ;; + esac done shift $((OPTIND - 1)) if test "$#" -ne 0; then - echo "$USAGE" 1>&2 - exit 1 + echo "$USAGE" 1>&2 + exit 1 fi # really quit on control-C trap 'exit 1' 1 2 15 TS='%H:%M:%S ' TS= -comment () { - if test -n "$TS"; then - date "+${TS}$*" | cat_i - fi +comment() { + if test -n "$TS"; then + date "+${TS}$*" | cat_i + fi } DNSRPSCMD=./dnsrps -RNDCCMD="$RNDC -c ../common/rndc.conf -p ${CONTROLPORT} -s" +RNDCCMD="$RNDC -c ../_common/rndc.conf -p ${CONTROLPORT} -s" if test -x "$DNSRPSCMD"; then - # speed up the many delays for dnsrpzd by waiting only 0.1 seconds - WAIT_CMD="$DNSRPSCMD -w 0.1" - TEN_SECS=100 + # speed up the many delays for dnsrpzd by waiting only 0.1 seconds + WAIT_CMD="$DNSRPSCMD -w 0.1" + TEN_SECS=100 else - WAIT_CMD="sleep 1" - TEN_SECS=10 + WAIT_CMD="sleep 1" + TEN_SECS=10 fi -digcmd () { - if test "$1" = TCP; then - shift - fi - # Default to +noauth and @$ns3 - # Also default to -bX where X is the @value so that OS X will choose - # the right IP source address. - digcmd_args=$(echo "+nocookie +noadd +time=2 +tries=1 -p ${PORT} $*" | \ - sed -e "/@/!s/.*/& @$ns3/" \ - -e '/-b/!s/@\([^ ]*\)/@\1 -b\1/' \ - -e '/+n?o?auth/!s/.*/+noauth &/') - #echo_i "dig $digcmd_args 1>&2 - $DIG $digcmd_args || return +digcmd() { + if test "$1" = TCP; then + shift + fi + # Default to +noauth and @$ns3 + # Also default to -bX where X is the @value so that OS X will choose + # the right IP source address. + digcmd_args=$(echo "+nocookie +noadd +time=2 +tries=1 -p ${PORT} $*" \ + | sed -e "/@/!s/.*/& @$ns3/" \ + -e '/-b/!s/@\([^ ]*\)/@\1 -b\1/' \ + -e '/+n?o?auth/!s/.*/+noauth &/') + #echo_i "dig $digcmd_args 1>&2 + $DIG $digcmd_args || return } # set DIGNM=file name for dig output GROUP_NM= TEST_NUM=0 -make_dignm () { - TEST_NUM=$((TEST_NUM + 1)) - DIGNM=dig.out$GROUP_NM-$TEST_NUM - while test -f $DIGNM; do - DIGNM="$DIGNM+" - done +make_dignm() { + TEST_NUM=$((TEST_NUM + 1)) + DIGNM=dig.out$GROUP_NM-$TEST_NUM + while test -f $DIGNM; do + DIGNM="$DIGNM+" + done } -setret () { - ret=1 - status=$((status + 1)) - echo_i "$*" +setret() { + ret=1 + status=$((status + 1)) + echo_i "$*" } # set $SN to the SOA serial number of a zone # $1=domain # $2=DNS server and client IP address get_sn() { - SOA=$($DIG -p ${PORT} +short +norecurse soa "$1" "@$2" "-b$2") - SN=$(expr "$SOA" : '[^ ]* [^ ]* \([^ ]*\) .*' || true) - test "$SN" != "" && return - echo_i "no serial number from \`dig -p ${PORT} soa $1 @$2\` in \"$SOA\"" - exit 1 + SOA=$($DIG -p ${PORT} +short +norecurse soa "$1" "@$2" "-b$2") + SN=$(expr "$SOA" : '[^ ]* [^ ]* \([^ ]*\) .*' || true) + test "$SN" != "" && return + echo_i "no serial number from \`dig -p ${PORT} soa $1 @$2\` in \"$SOA\"" + exit 1 } -get_sn_fast () { - RSN=$($DNSRPSCMD -n "$1") - #echo "dnsrps serial for $1 is $RSN" - if test -z "$RSN"; then - echo_i "dnsrps failed to get SOA serial number for $1" - exit 1 - fi +get_sn_fast() { + RSN=$($DNSRPSCMD -n "$1") + #echo "dnsrps serial for $1 is $RSN" + if test -z "$RSN"; then + echo_i "dnsrps failed to get SOA serial number for $1" + exit 1 + fi } # check that dnsrpzd has loaded its zones @@ -134,25 +144,25 @@ get_sn_fast () { # $2=DNS server IP address FZONES=$(sed -n -e 's/^zone "\(.*\)".*\(10.53.0..\).*/Z=\1;M=\2/p' dnsrpzd.conf) dnsrps_loaded() { - test "$mode" = dnsrps || return 0 - n=0 - for V in $FZONES; do - eval "$V" - get_sn $Z $M - while true; do - get_sn_fast "$Z" - if test "$SN" -eq "0$RSN"; then - #echo "$Z @$M serial=$SN" - break - fi - n=$((n + 1)) - if test "$n" -gt $TEN_SECS; then - echo_i "dnsrps serial for $Z is $RSN instead of $SN" - exit 1 - fi - $WAIT_CMD - done + test "$mode" = dnsrps || return 0 + n=0 + for V in $FZONES; do + eval "$V" + get_sn $Z $M + while true; do + get_sn_fast "$Z" + if test "$SN" -eq "0$RSN"; then + #echo "$Z @$M serial=$SN" + break + fi + n=$((n + 1)) + if test "$n" -gt $TEN_SECS; then + echo_i "dnsrps serial for $Z is $RSN instead of $SN" + exit 1 + fi + $WAIT_CMD done + done } # check the serial number in an SOA to ensure that a policy zone has @@ -161,219 +171,219 @@ dnsrps_loaded() { # $2=domain # $3=DNS server ck_soa() { - n=0 - while true; do - if test "$mode" = dnsrps; then - get_sn_fast "$2" - test "$RSN" -eq "$1" && return - else - get_sn "$2" "$3" - test "$SN" -eq "$1" && return - fi - n=$((n + 1)) - if test "$n" -gt $TEN_SECS; then - echo_i "got serial number \"$SN\" instead of \"$1\" from $2 @$3" - return - fi - $WAIT_CMD - done + n=0 + while true; do + if test "$mode" = dnsrps; then + get_sn_fast "$2" + test "$RSN" -eq "$1" && return + else + get_sn "$2" "$3" + test "$SN" -eq "$1" && return + fi + n=$((n + 1)) + if test "$n" -gt $TEN_SECS; then + echo_i "got serial number \"$SN\" instead of \"$1\" from $2 @$3" + return + fi + $WAIT_CMD + done } # (re)load the response policy zones with the rules in the file $TEST_FILE -load_db () { - if test -n "$TEST_FILE"; then - copy_setports $TEST_FILE tmp - if $NSUPDATE -v tmp; then : - $RNDCCMD $ns3 sync - else - echo_i "failed to update policy zone with $TEST_FILE" - $RNDCCMD $ns3 sync - exit 1 - fi - rm -f tmp +load_db() { + if test -n "$TEST_FILE"; then + copy_setports $TEST_FILE tmp + if $NSUPDATE -v tmp; then + : + $RNDCCMD $ns3 sync + else + echo_i "failed to update policy zone with $TEST_FILE" + $RNDCCMD $ns3 sync + exit 1 fi + rm -f tmp + fi } # restart name server # $1 ns number # $2 rebuild bl rpz zones if "rebuild-bl-rpz" -restart () { - # try to ensure that the server really has stopped - # and won't mess with ns$1/name.pid - if test -z "$HAVE_CORE" -a -f ns$1/named.pid; then - $RNDCCMD $ns$1 halt >/dev/null 2>&1 - if test -f ns$1/named.pid; then - sleep 1 - PID=$(cat ns$1/named.pid 2>/dev/null) - if test -n "$PID"; then - echo_i "killing ns$1 server $PID" - kill -9 $PID - fi - fi +restart() { + # try to ensure that the server really has stopped + # and won't mess with ns$1/name.pid + if test -z "$HAVE_CORE" -a -f ns$1/named.pid; then + $RNDCCMD $ns$1 halt >/dev/null 2>&1 + if test -f ns$1/named.pid; then + sleep 1 + PID=$(cat ns$1/named.pid 2>/dev/null) + if test -n "$PID"; then + echo_i "killing ns$1 server $PID" + kill -9 $PID + fi fi - rm -f ns$1/*.jnl - if [ "$2" = "rebuild-bl-rpz" ]; then - if test -f ns$1/base.db; then - for NM in ns$1/bl*.db; do - cp -f ns$1/base.db $NM - done - fi + fi + rm -f ns$1/*.jnl + if [ "$2" = "rebuild-bl-rpz" ]; then + if test -f ns$1/base.db; then + for NM in ns$1/bl*.db; do + cp -f ns$1/base.db $NM + done fi - start_server --noclean --restart --port ${PORT} ns$1 - load_db - dnsrps_loaded - sleep 1 + fi + start_server --noclean --restart --port ${PORT} ns$1 + load_db + dnsrps_loaded + sleep 1 } # $1=server and irrelevant args # $2=error message -ckalive () { - CKALIVE_NS=$(expr "$1" : '.*@ns\([1-9]\).*' || true) - if test -z "$CKALIVE_NS"; then - CKALIVE_NS=3 - fi - eval CKALIVE_IP=\$ns$CKALIVE_NS - $RNDCCMD $CKALIVE_IP status >/dev/null 2>&1 && return 0 - HAVE_CORE=yes - setret "$2" - # restart the server to avoid stalling waiting for it to stop - restart $CKALIVE_NS "rebuild-bl-rpz" - return 0 +ckalive() { + CKALIVE_NS=$(expr "$1" : '.*@ns\([1-9]\).*' || true) + if test -z "$CKALIVE_NS"; then + CKALIVE_NS=3 + fi + eval CKALIVE_IP=\$ns$CKALIVE_NS + $RNDCCMD $CKALIVE_IP status >/dev/null 2>&1 && return 0 + HAVE_CORE=yes + setret "$2" + # restart the server to avoid stalling waiting for it to stop + restart $CKALIVE_NS "rebuild-bl-rpz" + return 0 } -resetstats () { - NSDIR=$1 - eval "${NSDIR}_CNT=''" +resetstats() { + NSDIR=$1 + eval "${NSDIR}_CNT=''" } -ckstats () { - HOST=$1 - LABEL="$2" - NSDIR="$3" - EXPECTED="$4" - $RNDCCMD $HOST stats - NEW_CNT=$(sed -n -e 's/[ ]*\([0-9]*\).response policy.*/\1/p' \ - $NSDIR/named.stats | tail -1) - eval "OLD_CNT=\$${NSDIR}_CNT" - NEW_CNT=$((NEW_CNT)) - OLD_CNT=$((OLD_CNT)) - GOT=$((NEW_CNT - OLD_CNT)) - if test "$GOT" -ne "$EXPECTED"; then - setret "wrong $LABEL $NSDIR statistics of $GOT instead of $EXPECTED" - fi - eval "${NSDIR}_CNT=$NEW_CNT" +ckstats() { + HOST=$1 + LABEL="$2" + NSDIR="$3" + EXPECTED="$4" + $RNDCCMD $HOST stats + NEW_CNT=$(sed -n -e 's/[ ]*\([0-9]*\).response policy.*/\1/p' \ + $NSDIR/named.stats | tail -1) + eval "OLD_CNT=\$${NSDIR}_CNT" + NEW_CNT=$((NEW_CNT)) + OLD_CNT=$((OLD_CNT)) + GOT=$((NEW_CNT - OLD_CNT)) + if test "$GOT" -ne "$EXPECTED"; then + setret "wrong $LABEL $NSDIR statistics of $GOT instead of $EXPECTED" + fi + eval "${NSDIR}_CNT=$NEW_CNT" } -ckstatsrange () { - HOST=$1 - LABEL="$2" - NSDIR="$3" - MIN="$4" - MAX="$5" - $RNDCCMD $HOST stats - NEW_CNT=$(sed -n -e 's/[ ]*\([0-9]*\).response policy.*/\1/p' \ - $NSDIR/named.stats | tail -1) - eval "OLD_CNT=\$${NSDIR}_CNT" - NEW_CNT=$((NEW_CNT)) - OLD_CNT=$((OLD_CNT)) - GOT=$((NEW_CNT - OLD_CNT)) - if test "$GOT" -lt "$MIN" -o "$GOT" -gt "$MAX"; then - setret "wrong $LABEL $NSDIR statistics of $GOT instead of ${MIN}..${MAX}" - fi - eval "${NSDIR}_CNT=$NEW_CNT" +ckstatsrange() { + HOST=$1 + LABEL="$2" + NSDIR="$3" + MIN="$4" + MAX="$5" + $RNDCCMD $HOST stats + NEW_CNT=$(sed -n -e 's/[ ]*\([0-9]*\).response policy.*/\1/p' \ + $NSDIR/named.stats | tail -1) + eval "OLD_CNT=\$${NSDIR}_CNT" + NEW_CNT=$((NEW_CNT)) + OLD_CNT=$((OLD_CNT)) + GOT=$((NEW_CNT - OLD_CNT)) + if test "$GOT" -lt "$MIN" -o "$GOT" -gt "$MAX"; then + setret "wrong $LABEL $NSDIR statistics of $GOT instead of ${MIN}..${MAX}" + fi + eval "${NSDIR}_CNT=$NEW_CNT" } # $1=message # $2=optional test file name -start_group () { - ret=0 - t=$((t + 1)) - test -n "$1" && date "+${TS}checking $1 (${t})" | cat_i - TEST_FILE=$2 - if test -n "$TEST_FILE"; then - GROUP_NM="-$TEST_FILE" - load_db - else - GROUP_NM= - fi - dnsrps_loaded - TEST_NUM=0 +start_group() { + ret=0 + t=$((t + 1)) + test -n "$1" && date "+${TS}checking $1 (${t})" | cat_i + TEST_FILE=$2 + if test -n "$TEST_FILE"; then + GROUP_NM="-$TEST_FILE" + load_db + else + GROUP_NM= + fi + dnsrps_loaded + TEST_NUM=0 } -end_group () { - if test -n "$TEST_FILE"; then - # remove the previous set of test rules - copy_setports $TEST_FILE tmp - sed -e 's/[ ]add[ ]/ delete /' tmp | $NSUPDATE - rm -f tmp - TEST_FILE= - fi - ckalive $ns3 "failed; ns3 server crashed and restarted" - dnsrps_loaded - GROUP_NM= +end_group() { + if test -n "$TEST_FILE"; then + # remove the previous set of test rules + copy_setports $TEST_FILE tmp + sed -e 's/[ ]add[ ]/ delete /' tmp | $NSUPDATE + rm -f tmp + TEST_FILE= + fi + ckalive $ns3 "failed; ns3 server crashed and restarted" + dnsrps_loaded + GROUP_NM= } -clean_result () { - if test -z "$SAVE_RESULTS"; then - rm -f $* - fi +clean_result() { + if test -z "$SAVE_RESULTS"; then + rm -f $* + fi } # $1=dig args # $2=other dig output file -ckresult () { - #ckalive "$1" "server crashed by 'dig $1'" || return 1 - expr "$1" : 'TCP ' > /dev/null && tcp=1 || tcp=0 - digarg=${1#TCP } - - if grep "flags:.* aa .*ad;" $DIGNM; then - setret "'dig $digarg' AA and AD set;" - elif grep "flags:.* aa .*ad;" $DIGNM; then - setret "'dig $digarg' AD set;" - fi +ckresult() { + #ckalive "$1" "server crashed by 'dig $1'" || return 1 + expr "$1" : 'TCP ' >/dev/null && tcp=1 || tcp=0 + digarg=${1#TCP } + + if grep "flags:.* aa .*ad;" $DIGNM; then + setret "'dig $digarg' AA and AD set;" + elif grep "flags:.* aa .*ad;" $DIGNM; then + setret "'dig $digarg' AD set;" + fi - if $PERL ../digcomp.pl $DIGNM $2 >/dev/null; then - grep -q 'Truncated, retrying in TCP' $DIGNM && trunc=1 || trunc=0 - if [ "$tcp" -ne "$trunc" ]; then - setret "'dig $digarg' wrong; no or unexpected truncation in $DIGNM" - else - clean_result ${DIGNM}* - fi - return 0 + if $PERL ../digcomp.pl $DIGNM $2 >/dev/null; then + grep -q 'Truncated, retrying in TCP' $DIGNM && trunc=1 || trunc=0 + if [ "$tcp" -ne "$trunc" ]; then + setret "'dig $digarg' wrong; no or unexpected truncation in $DIGNM" + else + clean_result ${DIGNM}* fi - setret "'dig $digarg' wrong; diff $DIGNM $2" return 0 + fi + setret "'dig $digarg' wrong; diff $DIGNM $2" + return 0 } # check only that the server does not crash # $1=target domain # $2=optional query type -nocrash () { - digcmd $* >/dev/null - ckalive "$*" "server crashed by 'dig $*'" +nocrash() { + digcmd $* >/dev/null + ckalive "$*" "server crashed by 'dig $*'" } - # check rewrite to NXDOMAIN # $1=target domain # $2=optional query type -nxdomain () { - make_dignm - digcmd $* \ - | sed -e 's/^[a-z].* IN CNAME /;xxx &/' \ - -e 's/^[a-z].* IN RRSIG /;xxx &/' \ - >$DIGNM - ckresult "$*" proto.nxdomain +nxdomain() { + make_dignm + digcmd $* \ + | sed -e 's/^[a-z].* IN CNAME /;xxx &/' \ + -e 's/^[a-z].* IN RRSIG /;xxx &/' \ + >$DIGNM + ckresult "$*" proto.nxdomain } # check rewrite to NODATA # $1=target domain # $2=optional query type -nodata () { - make_dignm - digcmd $* \ - | sed -e 's/^[a-z].* IN CNAME /;xxx &/' >$DIGNM - ckresult "$*" proto.nodata +nodata() { + make_dignm + digcmd $* \ + | sed -e 's/^[a-z].* IN CNAME /;xxx &/' >$DIGNM + ckresult "$*" proto.nodata } # check rewrite to an address @@ -381,22 +391,22 @@ nodata () { # $1=IPv4 address # $2=digcmd args # $3=optional TTL -addr () { - ADDR=$1 - make_dignm - digcmd $2 >$DIGNM - #ckalive "$2" "server crashed by 'dig $2'" || return 1 - ADDR_ESC=$(echo "$ADDR" | sed -e 's/\./\\./g') - ADDR_TTL=$(sed -n -e "s/^[-.a-z0-9]\{1,\}[ ]*\([0-9]*\) IN AA* ${ADDR_ESC}\$/\1/p" $DIGNM) - if test -z "$ADDR_TTL"; then - setret "'dig $2' wrong; no address $ADDR record in $DIGNM" - return 0 - fi - if test -n "$3" && test "$ADDR_TTL" -ne "$3"; then - setret "'dig $2' wrong; TTL=$ADDR_TTL instead of $3 in $DIGNM" - return 0 - fi - clean_result ${DIGNM}* +addr() { + ADDR=$1 + make_dignm + digcmd $2 >$DIGNM + #ckalive "$2" "server crashed by 'dig $2'" || return 1 + ADDR_ESC=$(echo "$ADDR" | sed -e 's/\./\\./g') + ADDR_TTL=$(sed -n -e "s/^[-.a-z0-9]\{1,\}[ ]*\([0-9]*\) IN AA* ${ADDR_ESC}\$/\1/p" $DIGNM) + if test -z "$ADDR_TTL"; then + setret "'dig $2' wrong; no address $ADDR record in $DIGNM" + return 0 + fi + if test -n "$3" && test "$ADDR_TTL" -ne "$3"; then + setret "'dig $2' wrong; TTL=$ADDR_TTL instead of $3 in $DIGNM" + return 0 + fi + clean_result ${DIGNM}* } # Check that a response is not rewritten @@ -404,43 +414,43 @@ addr () { # spurious differences for `dig +norecurse` # $1=optional "TCP" # remaining args for dig -nochange () { - make_dignm - digcmd $* >$DIGNM - digcmd $* @$ns1 >${DIGNM}_OK - ckresult "$*" ${DIGNM}_OK && clean_result ${DIGNM}_OK +nochange() { + make_dignm + digcmd $* >$DIGNM + digcmd $* @$ns1 >${DIGNM}_OK + ckresult "$*" ${DIGNM}_OK && clean_result ${DIGNM}_OK } -nochange_ns10 () { - make_dignm - digcmd $* >$DIGNM - digcmd $* @$ns10 >${DIGNM}_OK - ckresult "$*" ${DIGNM}_OK && clean_result ${DIGNM}_OK +nochange_ns10() { + make_dignm + digcmd $* >$DIGNM + digcmd $* @$ns10 >${DIGNM}_OK + ckresult "$*" ${DIGNM}_OK && clean_result ${DIGNM}_OK } # check against a 'here document' -here () { - make_dignm - sed -e 's/^[ ]*//' >${DIGNM}_OK - digcmd $* >$DIGNM - ckresult "$*" ${DIGNM}_OK +here() { + make_dignm + sed -e 's/^[ ]*//' >${DIGNM}_OK + digcmd $* >$DIGNM + ckresult "$*" ${DIGNM}_OK } # check dropped response DROPPED='^;; no servers could be reached' -drop () { - make_dignm - digcmd $* >$DIGNM || true - if grep "$DROPPED" $DIGNM >/dev/null; then - clean_result ${DIGNM}* - return 0 - fi - setret "'dig $1' wrong; response in $DIGNM" +drop() { + make_dignm + digcmd $* >$DIGNM || true + if grep "$DROPPED" $DIGNM >/dev/null; then + clean_result ${DIGNM}* return 0 + fi + setret "'dig $1' wrong; response in $DIGNM" + return 0 } nsd() { - $NSUPDATE -p ${PORT} << EOF + $NSUPDATE -p ${PORT} </dev/null; then - echo_i "exit status: 1" - exit 1 - fi - if grep '^#skip' dnsrps.conf > /dev/null; then - echo_i "DNSRPS sub-test skipped" - continue - else - echo_i "running DNSRPS sub-test" - start_server --noclean --restart --port ${PORT} - sleep 3 - fi - ;; + native) + if [ -e dnsrps-only ]; then + echo_i "'dnsrps-only' found: skipping native RPZ sub-test" + continue + else + echo_i "running native RPZ sub-test" + fi + ;; + dnsrps) + if [ -e dnsrps-off ]; then + echo_i "'dnsrps-off' found: skipping DNSRPS sub-test" + continue + fi + echo_i "attempting to configure servers with DNSRPS..." + stop_server --use-rndc --port ${CONTROLPORT} + $SHELL ./setup.sh -N -D $DEBUG + for server in ns*; do + resetstats $server + done + sed -n 's/^## //p' dnsrps.conf | cat_i + if grep '^#fail' dnsrps.conf >/dev/null; then + echo_i "exit status: 1" + exit 1 + fi + if grep '^#skip' dnsrps.conf >/dev/null; then + echo_i "DNSRPS sub-test skipped" + continue + else + echo_i "running DNSRPS sub-test" + start_server --noclean --restart --port ${PORT} + sleep 3 + fi + ;; esac # make prototype files to check against rewritten results @@ -516,104 +526,104 @@ for mode in native dnsrps; do retry_quiet 10 make_proto_nodata start_group "QNAME rewrites" test1 - nochange . # 1 do not crash or rewrite root - nxdomain a0-1.tld2 # 2 - nodata a3-1.tld2 # 3 - nodata a3-2.tld2 # 4 nodata at DNAME itself - nochange sub.a3-2.tld2 # 5 miss where DNAME might work - nxdomain a4-2.tld2 # 6 rewrite based on CNAME target - nxdomain a4-2-cname.tld2 # 7 - nodata a4-3-cname.tld2 # 8 - addr 12.12.12.12 a4-1.sub1.tld2 # 9 A replacement - addr 12.12.12.12 a4-1.sub2.tld2 # 10 A replacement with wildcard - addr 12.12.12.12 nxc1.sub1.tld2 # 11 replace NXDOMAIN with CNAME - addr 12.12.12.12 nxc2.sub1.tld2 # 12 replace NXDOMAIN with CNAME chain - addr 127.4.4.1 a4-4.tld2 # 13 prefer 1st conflicting QNAME zone - nochange a6-1.tld2 # 14 - addr 127.6.2.1 a6-2.tld2 # 15 - addr 56.56.56.56 a3-6.tld2 # 16 wildcard CNAME - addr 57.57.57.57 a3-7.sub1.tld2 # 17 wildcard CNAME - addr 127.0.0.16 a4-5-cname3.tld2 # 18 CNAME chain - addr 127.0.0.17 a4-6-cname3.tld2 # 19 stop short in CNAME chain - nochange a5-2.tld2 +norecurse # 20 check that RD=1 is required - nochange a5-3.tld2 +norecurse # 21 - nochange a5-4.tld2 +norecurse # 22 - nochange sub.a5-4.tld2 +norecurse # 23 - nxdomain c1.crash2.tld3 # 24 assert in rbtdb.c - nxdomain a0-1.tld2 +dnssec # 25 simple DO=1 without signatures - nxdomain a0-1.tld2s +nodnssec # 26 simple DO=0 with signatures - nochange a0-1.tld2s +dnssec # 27 simple DO=1 with signatures - nxdomain a0-1s-cname.tld2s +dnssec # 28 DNSSEC too early in CNAME chain - nochange a0-1-scname.tld2 +dnssec # 29 DNSSEC on target in CNAME chain - nochange a0-1.tld2s srv +auth +dnssec # 30 no write for DNSSEC and no record - nxdomain a0-1.tld2s srv +nodnssec # 31 - drop a3-8.tld2 any # 32 drop - nochange TCP a3-9.tld2 # 33 tcp-only - here x.servfail <<'EOF' # 34 qname-wait-recurse yes + nochange . # 1 do not crash or rewrite root + nxdomain a0-1.tld2 # 2 + nodata a3-1.tld2 # 3 + nodata a3-2.tld2 # 4 nodata at DNAME itself + nochange sub.a3-2.tld2 # 5 miss where DNAME might work + nxdomain a4-2.tld2 # 6 rewrite based on CNAME target + nxdomain a4-2-cname.tld2 # 7 + nodata a4-3-cname.tld2 # 8 + addr 12.12.12.12 a4-1.sub1.tld2 # 9 A replacement + addr 12.12.12.12 a4-1.sub2.tld2 # 10 A replacement with wildcard + addr 12.12.12.12 nxc1.sub1.tld2 # 11 replace NXDOMAIN with CNAME + addr 12.12.12.12 nxc2.sub1.tld2 # 12 replace NXDOMAIN with CNAME chain + addr 127.4.4.1 a4-4.tld2 # 13 prefer 1st conflicting QNAME zone + nochange a6-1.tld2 # 14 + addr 127.6.2.1 a6-2.tld2 # 15 + addr 56.56.56.56 a3-6.tld2 # 16 wildcard CNAME + addr 57.57.57.57 a3-7.sub1.tld2 # 17 wildcard CNAME + addr 127.0.0.16 a4-5-cname3.tld2 # 18 CNAME chain + addr 127.0.0.17 a4-6-cname3.tld2 # 19 stop short in CNAME chain + nochange a5-2.tld2 +norecurse # 20 check that RD=1 is required + nochange a5-3.tld2 +norecurse # 21 + nochange a5-4.tld2 +norecurse # 22 + nochange sub.a5-4.tld2 +norecurse # 23 + nxdomain c1.crash2.tld3 # 24 assert in rbtdb.c + nxdomain a0-1.tld2 +dnssec # 25 simple DO=1 without signatures + nxdomain a0-1.tld2s +nodnssec # 26 simple DO=0 with signatures + nochange a0-1.tld2s +dnssec # 27 simple DO=1 with signatures + nxdomain a0-1s-cname.tld2s +dnssec # 28 DNSSEC too early in CNAME chain + nochange a0-1-scname.tld2 +dnssec # 29 DNSSEC on target in CNAME chain + nochange a0-1.tld2s srv +auth +dnssec # 30 no write for DNSSEC and no record + nxdomain a0-1.tld2s srv +nodnssec # 31 + drop a3-8.tld2 any # 32 drop + nochange TCP a3-9.tld2 # 33 tcp-only + here x.servfail <<'EOF' # 34 qname-wait-recurse yes ;; status: SERVFAIL, x EOF - addr 35.35.35.35 "x.servfail @$ns5" # 35 qname-wait-recurse no + addr 35.35.35.35 "x.servfail @$ns5" # 35 qname-wait-recurse no end_group ckstats $ns3 test1 ns3 22 ckstats $ns5 test1 ns5 1 ckstats $ns6 test1 ns6 0 start_group "NXDOMAIN/NODATA action on QNAME trigger" test1 - nxdomain a0-1.tld2 @$ns6 # 1 - nodata a3-1.tld2 @$ns6 # 2 - nodata a3-2.tld2 @$ns6 # 3 nodata at DNAME itself - nxdomain a4-2.tld2 @$ns6 # 4 rewrite based on CNAME target - nxdomain a4-2-cname.tld2 @$ns6 # 5 - nodata a4-3-cname.tld2 @$ns6 # 6 - addr 12.12.12.12 "a4-1.sub1.tld2 @$ns6" # 7 A replacement - addr 12.12.12.12 "a4-1.sub2.tld2 @$ns6" # 8 A replacement with wildcard - addr 127.4.4.1 "a4-4.tld2 @$ns6" # 9 prefer 1st conflicting QNAME zone - addr 12.12.12.12 "nxc1.sub1.tld2 @$ns6" # 10 replace NXDOMAIN w/ CNAME - addr 12.12.12.12 "nxc2.sub1.tld2 @$ns6" # 11 replace NXDOMAIN w/ CNAME chain - addr 127.6.2.1 "a6-2.tld2 @$ns6" # 12 - addr 56.56.56.56 "a3-6.tld2 @$ns6" # 13 wildcard CNAME - addr 57.57.57.57 "a3-7.sub1.tld2 @$ns6" # 14 wildcard CNAME - addr 127.0.0.16 "a4-5-cname3.tld2 @$ns6" # 15 CNAME chain - addr 127.0.0.17 "a4-6-cname3.tld2 @$ns6" # 16 stop short in CNAME chain - nxdomain c1.crash2.tld3 @$ns6 # 17 assert in rbtdb.c - nxdomain a0-1.tld2 +dnssec @$ns6 # 18 simple DO=1 without sigs - nxdomain a0-1s-cname.tld2s +dnssec @$ns6 # 19 - drop a3-8.tld2 any @$ns6 # 20 drop + nxdomain a0-1.tld2 @$ns6 # 1 + nodata a3-1.tld2 @$ns6 # 2 + nodata a3-2.tld2 @$ns6 # 3 nodata at DNAME itself + nxdomain a4-2.tld2 @$ns6 # 4 rewrite based on CNAME target + nxdomain a4-2-cname.tld2 @$ns6 # 5 + nodata a4-3-cname.tld2 @$ns6 # 6 + addr 12.12.12.12 "a4-1.sub1.tld2 @$ns6" # 7 A replacement + addr 12.12.12.12 "a4-1.sub2.tld2 @$ns6" # 8 A replacement with wildcard + addr 127.4.4.1 "a4-4.tld2 @$ns6" # 9 prefer 1st conflicting QNAME zone + addr 12.12.12.12 "nxc1.sub1.tld2 @$ns6" # 10 replace NXDOMAIN w/ CNAME + addr 12.12.12.12 "nxc2.sub1.tld2 @$ns6" # 11 replace NXDOMAIN w/ CNAME chain + addr 127.6.2.1 "a6-2.tld2 @$ns6" # 12 + addr 56.56.56.56 "a3-6.tld2 @$ns6" # 13 wildcard CNAME + addr 57.57.57.57 "a3-7.sub1.tld2 @$ns6" # 14 wildcard CNAME + addr 127.0.0.16 "a4-5-cname3.tld2 @$ns6" # 15 CNAME chain + addr 127.0.0.17 "a4-6-cname3.tld2 @$ns6" # 16 stop short in CNAME chain + nxdomain c1.crash2.tld3 @$ns6 # 17 assert in rbtdb.c + nxdomain a0-1.tld2 +dnssec @$ns6 # 18 simple DO=1 without sigs + nxdomain a0-1s-cname.tld2s +dnssec @$ns6 # 19 + drop a3-8.tld2 any @$ns6 # 20 drop end_group ckstatsrange $ns3 test1 ns3 22 30 ckstats $ns5 test1 ns5 0 ckstats $ns6 test1 ns6 0 start_group "IP rewrites" test2 - nodata a3-1.tld2 # 1 NODATA - nochange a3-2.tld2 # 2 no policy record so no change - nochange a4-1.tld2 # 3 obsolete PASSTHRU record style - nxdomain a4-2.tld2 # 4 - nochange a4-2.tld2 -taaaa # 5 no A => no policy rewrite - nochange a4-2.tld2 -ttxt # 6 no A => no policy rewrite - nxdomain a4-2.tld2 -tany # 7 no A => no policy rewrite - nodata a4-3.tld2 # 8 - nxdomain a3-1.tld2 -taaaa # 9 IPv6 policy - nochange a4-1-aaaa.tld2 -taaaa # 10 - addr 127.0.0.1 a5-1-2.tld2 # 11 prefer smallest policy address - addr 127.0.0.1 a5-3.tld2 # 12 prefer first conflicting IP zone - nochange a5-4.tld2 +norecurse # 13 check that RD=1 is required for #14 - addr 14.14.14.14 a5-4.tld2 # 14 prefer QNAME to IP - nochange a4-4.tld2 # 15 PASSTHRU - nxdomain c2.crash2.tld3 # 16 assert in rbtdb.c - addr 127.0.0.17 "a4-4.tld2 -b $ns1" # 17 client-IP address trigger - nxdomain a7-1.tld2 # 18 secondary policy zone (RT34450) + nodata a3-1.tld2 # 1 NODATA + nochange a3-2.tld2 # 2 no policy record so no change + nochange a4-1.tld2 # 3 obsolete PASSTHRU record style + nxdomain a4-2.tld2 # 4 + nochange a4-2.tld2 -taaaa # 5 no A => no policy rewrite + nochange a4-2.tld2 -ttxt # 6 no A => no policy rewrite + nxdomain a4-2.tld2 -tany # 7 no A => no policy rewrite + nodata a4-3.tld2 # 8 + nxdomain a3-1.tld2 -taaaa # 9 IPv6 policy + nochange a4-1-aaaa.tld2 -taaaa # 10 + addr 127.0.0.1 a5-1-2.tld2 # 11 prefer smallest policy address + addr 127.0.0.1 a5-3.tld2 # 12 prefer first conflicting IP zone + nochange a5-4.tld2 +norecurse # 13 check that RD=1 is required for #14 + addr 14.14.14.14 a5-4.tld2 # 14 prefer QNAME to IP + nochange a4-4.tld2 # 15 PASSTHRU + nxdomain c2.crash2.tld3 # 16 assert in rbtdb.c + addr 127.0.0.17 "a4-4.tld2 -b $ns1" # 17 client-IP address trigger + nxdomain a7-1.tld2 # 18 secondary policy zone (RT34450) # updating an response zone policy cp ns2/blv2.tld2.db.in ns2/bl.tld2.db rndc_reload ns2 $ns2 bl.tld2 ck_soa 2 bl.tld2 $ns3 - nochange a7-1.tld2 # 19 PASSTHRU + nochange a7-1.tld2 # 19 PASSTHRU # ensure that a clock tick has occurred so that named will do the reload sleep 1 cp ns2/blv3.tld2.db.in ns2/bl.tld2.db rndc_reload ns2 $ns2 bl.tld2 ck_soa 3 bl.tld2 $ns3 - nxdomain a7-1.tld2 # 20 secondary policy zone (RT34450) + nxdomain a7-1.tld2 # 20 secondary policy zone (RT34450) end_group ckstats $ns3 test2 ns3 12 @@ -635,29 +645,29 @@ EOF # these tests assume "min-ns-dots 0" start_group "NSDNAME rewrites" test3 - nextpart ns3/named.run > /dev/null - nochange a3-1.tld2 # 1 - nochange a3-1.tld2 +dnssec # 2 this once caused problems - nxdomain a3-1.sub1.tld2 # 3 NXDOMAIN *.sub1.tld2 by NSDNAME - nxdomain a3-1.subsub.sub1.tld2 # 4 - nxdomain a3-1.subsub.sub1.tld2 -tany # 5 - addr 12.12.12.12 a4-2.subsub.sub2.tld2 # 6 walled garden for *.sub2.tld2 - nochange a3-2.tld2. # 7 exempt rewrite by name - nochange a0-1.tld2. # 8 exempt rewrite by address block - addr 12.12.12.12 a4-1.tld2 # 9 prefer QNAME policy to NSDNAME - addr 127.0.0.1 a3-1.sub3.tld2 # 10 prefer policy for largest NSDNAME - addr 127.0.0.2 a3-1.subsub.sub3.tld2 # 11 - nxdomain xxx.crash1.tld2 # 12 dns_db_detachnode() crash - - nxdomain a3-1.stub # 13 - nxdomain a3-1.static-stub # 14 - nochange_ns10 a3-1.stub-nomatch # 15 - nochange_ns10 a3-1.static-stub-nomatch # 16 + nextpart ns3/named.run >/dev/null + nochange a3-1.tld2 # 1 + nochange a3-1.tld2 +dnssec # 2 this once caused problems + nxdomain a3-1.sub1.tld2 # 3 NXDOMAIN *.sub1.tld2 by NSDNAME + nxdomain a3-1.subsub.sub1.tld2 # 4 + nxdomain a3-1.subsub.sub1.tld2 -tany # 5 + addr 12.12.12.12 a4-2.subsub.sub2.tld2 # 6 walled garden for *.sub2.tld2 + nochange a3-2.tld2. # 7 exempt rewrite by name + nochange a0-1.tld2. # 8 exempt rewrite by address block + addr 12.12.12.12 a4-1.tld2 # 9 prefer QNAME policy to NSDNAME + addr 127.0.0.1 a3-1.sub3.tld2 # 10 prefer policy for largest NSDNAME + addr 127.0.0.2 a3-1.subsub.sub3.tld2 # 11 + nxdomain xxx.crash1.tld2 # 12 dns_db_detachnode() crash + + nxdomain a3-1.stub # 13 + nxdomain a3-1.static-stub # 14 + nochange_ns10 a3-1.stub-nomatch # 15 + nochange_ns10 a3-1.static-stub-nomatch # 16 if [ "$mode" = dnsrps ]; then - addr 12.12.12.12 as-ns.tld5. # 17 qname-as-ns + addr 12.12.12.12 as-ns.tld5. # 17 qname-as-ns fi - nextpart ns3/named.run | grep -q "unrecognized NS rpz_rrset_find() failed: glue" && - setret "seen: unrecognized NS rpz_rrset_find() failed: glue" + nextpart ns3/named.run | grep -q "unrecognized NS rpz_rrset_find() failed: glue" \ + && setret "seen: unrecognized NS rpz_rrset_find() failed: glue" end_group if [ "$mode" = dnsrps ]; then ckstats $ns3 test3 ns3 10 @@ -667,26 +677,26 @@ EOF # these tests assume "min-ns-dots 0" start_group "NSIP rewrites" test4 - nextpart ns3/named.run > /dev/null - nxdomain a3-1.tld2 # 1 NXDOMAIN for all of tld2 - nochange a3-2.tld2. # 2 exempt rewrite by name - nochange a0-1.tld2. # 3 exempt rewrite by address block - nochange a3-1.tld4 # 4 different NS IP address - nxdomain a4-1.stub # 5 - nxdomain a4-1.static-stub # 6 - nochange_ns10 a4-1.stub-nomatch # 7 - nochange_ns10 a4-1.static-stub-nomatch # 8 + nextpart ns3/named.run >/dev/null + nxdomain a3-1.tld2 # 1 NXDOMAIN for all of tld2 + nochange a3-2.tld2. # 2 exempt rewrite by name + nochange a0-1.tld2. # 3 exempt rewrite by address block + nochange a3-1.tld4 # 4 different NS IP address + nxdomain a4-1.stub # 5 + nxdomain a4-1.static-stub # 6 + nochange_ns10 a4-1.stub-nomatch # 7 + nochange_ns10 a4-1.static-stub-nomatch # 8 if [ "$mode" = dnsrps ]; then - addr 12.12.12.12 as-ns.tld5. # 9 ip-as-ns + addr 12.12.12.12 as-ns.tld5. # 9 ip-as-ns fi - nextpart ns3/named.run | grep -q "unrecognized NS rpz_rrset_find() failed: glue" && - setret "seen: unrecognized NS rpz_rrset_find() failed: glue" + nextpart ns3/named.run | grep -q "unrecognized NS rpz_rrset_find() failed: glue" \ + && setret "seen: unrecognized NS rpz_rrset_find() failed: glue" end_group start_group "walled garden NSIP rewrites" test4a - addr 41.41.41.41 a3-1.tld2 # 1 walled garden for all of tld2 - addr 2041::41 'a3-1.tld2 AAAA' # 2 walled garden for all of tld2 - here a3-1.tld2 TXT <<'EOF' # 3 text message for all of tld2 + addr 41.41.41.41 a3-1.tld2 # 1 walled garden for all of tld2 + addr 2041::41 'a3-1.tld2 AAAA' # 2 walled garden for all of tld2 + here a3-1.tld2 TXT <<'EOF' # 3 text message for all of tld2 ;; status: NOERROR, x a3-1.tld2. x IN TXT "NSIP walled garden" EOF @@ -700,29 +710,29 @@ EOF # policies in ./test5 overridden by response-policy{} in ns3/named.conf # and in ns5/named.conf start_group "policy overrides" test5 - addr 127.0.0.1 a3-1.tld2 # 1 bl-given - nochange a3-2.tld2 # 2 bl-passthru - nochange a3-3.tld2 # 3 bl-no-op (obsolete for passthru) - nochange a3-4.tld2 # 4 bl-disabled - nodata a3-5.tld2 # 5 bl-nodata zone recursive-only no - nodata a3-5.tld2 +norecurse # 6 bl-nodata zone recursive-only no - nodata a3-5.tld2 # 7 bl-nodata not needed - nxdomain a3-5.tld2 +norecurse @$ns5 # 8 bl-nodata global recursive-only no - nxdomain a3-5.tld2s @$ns5 # 9 bl-nodata global break-dnssec - nxdomain a3-5.tld2s +dnssec @$ns5 # 10 bl-nodata global break-dnssec - nxdomain a3-6.tld2 # 11 bl-nxdomain - here a3-7.tld2 -tany <<'EOF' # 12 + addr 127.0.0.1 a3-1.tld2 # 1 bl-given + nochange a3-2.tld2 # 2 bl-passthru + nochange a3-3.tld2 # 3 bl-no-op (obsolete for passthru) + nochange a3-4.tld2 # 4 bl-disabled + nodata a3-5.tld2 # 5 bl-nodata zone recursive-only no + nodata a3-5.tld2 +norecurse # 6 bl-nodata zone recursive-only no + nodata a3-5.tld2 # 7 bl-nodata not needed + nxdomain a3-5.tld2 +norecurse @$ns5 # 8 bl-nodata global recursive-only no + nxdomain a3-5.tld2s @$ns5 # 9 bl-nodata global break-dnssec + nxdomain a3-5.tld2s +dnssec @$ns5 # 10 bl-nodata global break-dnssec + nxdomain a3-6.tld2 # 11 bl-nxdomain + here a3-7.tld2 -tany <<'EOF' # 12 ;; status: NOERROR, x a3-7.tld2. x IN CNAME txt-only.tld2. txt-only.tld2. x IN TXT "txt-only-tld2" EOF - addr 58.58.58.58 a3-8.tld2 # 13 bl_wildcname - addr 59.59.59.59 a3-9.sub9.tld2 # 14 bl_wildcname - addr 12.12.12.12 a3-15.tld2 # 15 bl-garden via CNAME to a12.tld2 - addr 127.0.0.16 a3-16.tld2 100 # 16 bl max-policy-ttl 100 - addr 17.17.17.17 "a3-17.tld2 @$ns5" 90 # 17 ns5 bl max-policy-ttl 90 - drop a3-18.tld2 any # 18 bl-drop - nxdomain TCP a3-19.tld2 # 19 bl-tcp-only + addr 58.58.58.58 a3-8.tld2 # 13 bl_wildcname + addr 59.59.59.59 a3-9.sub9.tld2 # 14 bl_wildcname + addr 12.12.12.12 a3-15.tld2 # 15 bl-garden via CNAME to a12.tld2 + addr 127.0.0.16 a3-16.tld2 100 # 16 bl max-policy-ttl 100 + addr 17.17.17.17 "a3-17.tld2 @$ns5" 90 # 17 ns5 bl max-policy-ttl 90 + drop a3-18.tld2 any # 18 bl-drop + nxdomain TCP a3-19.tld2 # 19 bl-tcp-only end_group ckstats $ns3 test5 ns3 12 ckstats $ns5 test5 ns5 4 @@ -747,25 +757,25 @@ EOF # superficial test for major performance bugs QPERF=$(sh qperf.sh) if test -n "$QPERF"; then - perf () { - date "+${TS}checking performance $1" | cat_i - # Dry run to prime everything - comment "before dry run $1" - $RNDCCMD $ns5 notrace - $QPERF -c -1 -l30 -d ns5/requests -s $ns5 -p ${PORT} >/dev/null - comment "before real test $1" - PFILE="ns5/$2.perf" - $QPERF -c -1 -l30 -d ns5/requests -s $ns5 -p ${PORT} >$PFILE - comment "after test $1" - X=$(sed -n -e 's/.*Returned *\([^ ]*:\) *\([0-9]*\) .*/\1\2/p' $PFILE \ - | tr '\n' ' ') - if test "$X" != "$3"; then - setret "wrong results '$X' in $PFILE" - fi - ckalive $ns5 "failed; server #5 crashed" + perf() { + date "+${TS}checking performance $1" | cat_i + # Dry run to prime everything + comment "before dry run $1" + $RNDCCMD $ns5 notrace + $QPERF -c -1 -l30 -d ns5/requests -s $ns5 -p ${PORT} >/dev/null + comment "before real test $1" + PFILE="ns5/$2.perf" + $QPERF -c -1 -l30 -d ns5/requests -s $ns5 -p ${PORT} >$PFILE + comment "after test $1" + X=$(sed -n -e 's/.*Returned *\([^ ]*:\) *\([0-9]*\) .*/\1\2/p' $PFILE \ + | tr '\n' ' ') + if test "$X" != "$3"; then + setret "wrong results '$X' in $PFILE" + fi + ckalive $ns5 "failed; server #5 crashed" } - trim () { - sed -n -e 's/.*Queries per second: *\([0-9]*\).*/\1/p' ns5/$1.perf + trim() { + sed -n -e 's/.*Queries per second: *\([0-9]*\).*/\1/p' ns5/$1.perf } # get qps with rpz @@ -777,16 +787,16 @@ EOF perf 'without RPZ' norpz 'NOERROR:3000 ' NORPZ=$(trim norpz) - PERCENT=$(( (RPZ * 100 + (NORPZ / 2)) / NORPZ)) + PERCENT=$(((RPZ * 100 + (NORPZ / 2)) / NORPZ)) echo_i "$RPZ qps with RPZ is $PERCENT% of $NORPZ qps without RPZ" MIN_PERCENT=30 if test "$PERCENT" -lt $MIN_PERCENT; then - echo_i "$RPZ qps with rpz or $PERCENT% is below $MIN_PERCENT% of $NORPZ qps" + echo_i "$RPZ qps with rpz or $PERCENT% is below $MIN_PERCENT% of $NORPZ qps" fi if test "$PERCENT" -ge 100; then - echo_i "$RPZ qps with RPZ or $PERCENT% of $NORPZ qps without RPZ is too high" + echo_i "$RPZ qps with RPZ or $PERCENT% of $NORPZ qps without RPZ is too high" fi ckstats $ns5 performance ns5 200 @@ -801,18 +811,18 @@ EOF kill "$OLD_PID" n=0 while true; do - NEW_PID=$(cat dnsrpzd.pid 2>/dev/null) - if test -n "$NEW_PID" -a "0$OLD_PID" -ne "0$NEW_PID"; then - #echo "OLD_PID=$OLD_PID NEW_PID=$NEW_PID" - break; - fi - $DIG -p ${PORT} +short +norecurse a0-1.tld2 @$ns3 >/dev/null - n=$((n + 1)) - if test "$n" -gt $TEN_SECS; then - setret "dnsrpzd did not restart" - break - fi - $WAIT_CMD + NEW_PID=$(cat dnsrpzd.pid 2>/dev/null) + if test -n "$NEW_PID" -a "0$OLD_PID" -ne "0$NEW_PID"; then + #echo "OLD_PID=$OLD_PID NEW_PID=$NEW_PID" + break + fi + $DIG -p ${PORT} +short +norecurse a0-1.tld2 @$ns3 >/dev/null + n=$((n + 1)) + if test "$n" -gt $TEN_SECS; then + setret "dnsrpzd did not restart" + break + fi + $WAIT_CMD done fi @@ -822,7 +832,7 @@ EOF # reconfigure the ns5 primary server without the fast-expire zone, so # it can't be refreshed on ns3, and will expire in 5 seconds. - cat /dev/null > ns5/expire.conf + cat /dev/null >ns5/expire.conf rndc_reconfig ns5 10.53.0.5 # restart the main test RPZ server to see if that creates a core file @@ -838,8 +848,8 @@ EOF EMSGS=$(nextpart $runfile | grep -E -l 'invalid rpz|rpz.*failed' || true) if test -n "$EMSGS"; then setret "error messages in $runfile starting with:" - grep -E 'invalid rpz|rpz.*failed' ns*/named.run | \ - sed -e '10,$d' -e 's/^//' | cat_i + grep -E 'invalid rpz|rpz.*failed' ns*/named.run \ + | sed -e '10,$d' -e 's/^//' | cat_i fi done @@ -856,10 +866,10 @@ EOF t=$((t + 1)) echo_i "checking if rpz survives a certain class of failed reconfiguration attempts (${t})" - sed -e "s/^#BAD//" < ns3/named.conf.in > ns3/named.conf.tmp + sed -e "s/^#BAD//" ns3/named.conf.tmp copy_setports ns3/named.conf.tmp ns3/named.conf rm ns3/named.conf.tmp - $RNDCCMD $ns3 reconfig > /dev/null 2>&1 && setret "failed" + $RNDCCMD $ns3 reconfig >/dev/null 2>&1 && setret "failed" sleep 1 copy_setports ns3/named.conf.in ns3/named.conf $RNDCCMD $ns3 reconfig || setret "failed" @@ -867,37 +877,37 @@ EOF # reload a RPZ zone that is now deliberately broken. t=$((t + 1)) echo_i "checking rpz failed update will keep previous rpz rules (${t})" - $DIG -p ${PORT} @$ns3 walled.tld2 > dig.out.$t.before - grep "walled\.tld2\..*IN.*A.*10\.0\.0\.1" dig.out.$t.before > /dev/null || setret "failed" + $DIG -p ${PORT} @$ns3 walled.tld2 >dig.out.$t.before + grep "walled\.tld2\..*IN.*A.*10\.0\.0\.1" dig.out.$t.before >/dev/null || setret "failed" cp ns3/broken.db.in ns3/manual-update-rpz.db rndc_reload ns3 $ns3 manual-update-rpz sleep 1 # ensure previous RPZ rules still apply. - $DIG -p ${PORT} @$ns3 walled.tld2 > dig.out.$t.after - grep "walled\.tld2\..*IN.*A.*10\.0\.0\.1" dig.out.$t.after > /dev/null || setret "failed" + $DIG -p ${PORT} @$ns3 walled.tld2 >dig.out.$t.after + grep "walled\.tld2\..*IN.*A.*10\.0\.0\.1" dig.out.$t.after >/dev/null || setret "failed" t=$((t + 1)) echo_i "checking reload of a mixed-case RPZ zone (${t})" # First, a sanity check: the A6-2.TLD2.mixed-case-rpz RPZ record should # cause a6-2.tld2 NOERROR answers to be rewritten to NXDOMAIN answers. - $DIG -p ${PORT} @$ns3 a6-2.tld2. A > dig.out.$t.before + $DIG -p ${PORT} @$ns3 a6-2.tld2. A >dig.out.$t.before grep "status: NXDOMAIN" dig.out.$t.before >/dev/null || setret "failed" # Add a sibling name (a6-1.tld2.mixed-case-rpz, with "tld2" in lowercase # rather than uppercase) before A6-2.TLD.mixed-case-rpz. - nextpart ns3/named.run > /dev/null + nextpart ns3/named.run >/dev/null cp ns3/mixed-case-rpz-2.db.in ns3/mixed-case-rpz.db rndc_reload ns3 $ns3 mixed-case-rpz wait_for_log 20 "rpz: mixed-case-rpz: reload done" ns3/named.run # a6-2.tld2 NOERROR answers should still be rewritten to NXDOMAIN answers. # (The bug we try to trigger here caused a6-2.tld2.mixed-case-rpz to be # erroneously removed from the summary RPZ database after reload.) - $DIG -p ${PORT} @$ns3 a6-2.tld2. A > dig.out.$t.after + $DIG -p ${PORT} @$ns3 a6-2.tld2. A >dig.out.$t.after grep "status: NXDOMAIN" dig.out.$t.after >/dev/null || setret "failed" fi t=$((t + 1)) echo_i "checking that ttl values are not zeroed when qtype is '*' (${t})" - $DIG +noall +answer -p ${PORT} @$ns3 any a3-2.tld2 > dig.out.$t + $DIG +noall +answer -p ${PORT} @$ns3 any a3-2.tld2 >dig.out.$t ttl=$(awk '/a3-2 tld2 text/ {print $2}' dig.out.$t) if test ${ttl:=0} -eq 0; then setret "failed"; fi @@ -919,37 +929,37 @@ EOF nsd $ns5 add '*.x.servfail.policy2.' x.servfail.policy2. sleep 1 rndc_reload ns7 $ns7 policy2 - $DIG z.x.servfail -p ${PORT} @$ns7 > dig.out.${t} - grep NXDOMAIN dig.out.${t} > /dev/null || setret "failed" + $DIG z.x.servfail -p ${PORT} @$ns7 >dig.out.${t} + grep NXDOMAIN dig.out.${t} >/dev/null || setret "failed" t=$((t + 1)) echo_i "checking that "add-soa no" at rpz zone level works (${t})" - $DIG z.x.servfail -p ${PORT} @$ns7 > dig.out.${t} - grep SOA dig.out.${t} > /dev/null && setret "failed" + $DIG z.x.servfail -p ${PORT} @$ns7 >dig.out.${t} + grep SOA dig.out.${t} >/dev/null && setret "failed" if [ native = "$mode" ]; then t=$((t + 1)) echo_i "checking that "add-soa yes" at response-policy level works (${t})" - $DIG walled.tld2 -p ${PORT} +noall +add @$ns3 > dig.out.${t} - grep "^manual-update-rpz\..*SOA" dig.out.${t} > /dev/null || setret "failed" + $DIG walled.tld2 -p ${PORT} +noall +add @$ns3 >dig.out.${t} + grep "^manual-update-rpz\..*SOA" dig.out.${t} >/dev/null || setret "failed" fi if [ native = "$mode" ]; then t=$((t + 1)) echo_i "reconfiguring server with 'add-soa no' (${t})" cp ns3/named.conf ns3/named.conf.tmp - sed -e "s/add-soa yes/add-soa no/g" < ns3/named.conf.tmp > ns3/named.conf + sed -e "s/add-soa yes/add-soa no/g" ns3/named.conf rndc_reconfig ns3 $ns3 echo_i "checking that 'add-soa no' at response-policy level works (${t})" - $DIG walled.tld2 -p ${PORT} +noall +add @$ns3 > dig.out.${t} - grep "^manual-update-rpz\..*SOA" dig.out.${t} > /dev/null && setret "failed" + $DIG walled.tld2 -p ${PORT} +noall +add @$ns3 >dig.out.${t} + grep "^manual-update-rpz\..*SOA" dig.out.${t} >/dev/null && setret "failed" fi if [ native = "$mode" ]; then t=$((t + 1)) echo_i "checking that 'add-soa unset' works (${t})" - $DIG walled.tld2 -p ${PORT} +noall +add @$ns8 > dig.out.${t} - grep "^manual-update-rpz\..*SOA" dig.out.${t} > /dev/null || setret "failed" + $DIG walled.tld2 -p ${PORT} +noall +add @$ns8 >dig.out.${t} + grep "^manual-update-rpz\..*SOA" dig.out.${t} >/dev/null || setret "failed" fi # dnsrps does not allow NS RRs in policy zones, so this check @@ -957,38 +967,36 @@ EOF if [ native = "$mode" ]; then t=$((t + 1)) echo_i "checking rpz with delegation fails correctly (${t})" - $DIG -p ${PORT} @$ns3 ns example.com > dig.out.$t - grep "status: SERVFAIL" dig.out.$t > /dev/null || setret "failed" + $DIG -p ${PORT} @$ns3 ns example.com >dig.out.$t + grep "status: SERVFAIL" dig.out.$t >/dev/null || setret "failed" t=$((t + 1)) echo_i "checking policies from expired zone are no longer in effect ($t)" - $DIG -p ${PORT} @$ns3 a expired > dig.out.$t - grep "expired.*10.0.0.10" dig.out.$t > /dev/null && setret "failed" - grep "fast-expire/IN: response-policy zone expired" ns3/named.run > /dev/null || setret "failed" + $DIG -p ${PORT} @$ns3 a expired >dig.out.$t + grep "expired.*10.0.0.10" dig.out.$t >/dev/null && setret "failed" + grep "fast-expire/IN: response-policy zone expired" ns3/named.run >/dev/null || setret "failed" fi # RPZ 'CNAME *.' (NODATA) trumps DNS64. Test against various DNS64 scenarios. - for label in a-only no-a-no-aaaa a-plus-aaaa - do - for type in AAAA A - do + for label in a-only no-a-no-aaaa a-plus-aaaa; do + for type in AAAA A; do t=$((t + 1)) case $label in - a-only) - echo_i "checking rpz 'CNAME *.' (NODATA) with dns64, $type lookup with A-only (${t})" - ;; - no-a-no-aaaa) - echo_i "checking rpz 'CNAME *.' (NODATA) with dns64, $type lookup with no A or AAAA (${t})" - ;; - a-plus-aaaa) - echo_i "checking rpz 'CNAME *.' (NODATA) with dns64, $type lookup with A and AAAA (${t})" - ;; + a-only) + echo_i "checking rpz 'CNAME *.' (NODATA) with dns64, $type lookup with A-only (${t})" + ;; + no-a-no-aaaa) + echo_i "checking rpz 'CNAME *.' (NODATA) with dns64, $type lookup with no A or AAAA (${t})" + ;; + a-plus-aaaa) + echo_i "checking rpz 'CNAME *.' (NODATA) with dns64, $type lookup with A and AAAA (${t})" + ;; esac ret=0 - $DIG ${label}.example -p ${PORT} $type @10.53.0.9 > dig.out.${t} - grep "status: NOERROR" dig.out.$t > /dev/null || ret=1 - grep "ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 2$" dig.out.$t > /dev/null || ret=1 - grep "^rpz" dig.out.$t > /dev/null || ret=1 + $DIG ${label}.example -p ${PORT} $type @10.53.0.9 >dig.out.${t} + grep "status: NOERROR" dig.out.$t >/dev/null || ret=1 + grep "ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 2$" dig.out.$t >/dev/null || ret=1 + grep "^rpz" dig.out.$t >/dev/null || ret=1 [ $ret -eq 0 ] || echo_i "failed" status=$((status + ret)) done @@ -999,20 +1007,22 @@ EOF echo_i "checking that rewriting CD=1 queries handles pending data correctly (${t})" $RNDCCMD $ns3 flush $RNDCCMD $ns6 flush - $DIG a7-2.tld2s -p ${PORT} @$ns6 +cd > dig.out.${t} - grep -w "1.1.1.1" dig.out.${t} > /dev/null || setret "failed" + $DIG a7-2.tld2s -p ${PORT} @$ns6 +cd >dig.out.${t} + grep -w "1.1.1.1" dig.out.${t} >/dev/null || setret "failed" fi [ $status -ne 0 ] && pf=fail || pf=pass case $mode in - native) - native=$status - echo_i "status (native RPZ sub-test): $status ($pf)";; - - dnsrps) - dnsrps=$status - echo_i "status (DNSRPS sub-test): $status ($pf)";; - *) echo_i "invalid test mode";; + native) + native=$status + echo_i "status (native RPZ sub-test): $status ($pf)" + ;; + + dnsrps) + dnsrps=$status + echo_i "status (DNSRPS sub-test): $status ($pf)" + ;; + *) echo_i "invalid test mode" ;; esac done status=$((native + dnsrps)) -- cgit v1.2.3