diff options
Diffstat (limited to 'bin/tests/system/allow-query')
44 files changed, 2321 insertions, 0 deletions
diff --git a/bin/tests/system/allow-query/clean.sh b/bin/tests/system/allow-query/clean.sh new file mode 100644 index 0000000..9914de7 --- /dev/null +++ b/bin/tests/system/allow-query/clean.sh @@ -0,0 +1,24 @@ +#!/bin/sh + +# Copyright (C) Internet Systems Consortium, Inc. ("ISC") +# +# SPDX-License-Identifier: MPL-2.0 +# +# This Source Code Form is subject to the terms of the Mozilla Public +# License, v. 2.0. If a copy of the MPL was not distributed with this +# file, you can obtain one at https://mozilla.org/MPL/2.0/. +# +# See the COPYRIGHT file distributed with this work for additional +# information regarding copyright ownership. + +# +# Clean up after allow query tests. +# + +rm -f dig.out.* +rm -f ns*/named.conf +rm -f ns2/controls.conf +rm -f */named.memstats +rm -f ns*/named.lock +rm -f ns*/named.run ns*/named.run.prev +rm -f ns*/managed-keys.bind* ns*/*.mkeys* diff --git a/bin/tests/system/allow-query/ns1/named.conf.in b/bin/tests/system/allow-query/ns1/named.conf.in new file mode 100644 index 0000000..dd786e2 --- /dev/null +++ b/bin/tests/system/allow-query/ns1/named.conf.in @@ -0,0 +1,26 @@ +/* + * Copyright (C) Internet Systems Consortium, Inc. ("ISC") + * + * SPDX-License-Identifier: MPL-2.0 + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, you can obtain one at https://mozilla.org/MPL/2.0/. + * + * See the COPYRIGHT file distributed with this work for additional + * information regarding copyright ownership. + */ + +options { + port @PORT@; + pid-file "named.pid"; + listen-on { 10.53.0.1; }; + listen-on-v6 { none; }; + recursion no; + dnssec-validation no; +}; + +zone "." { + type primary; + file "root.db"; +}; diff --git a/bin/tests/system/allow-query/ns1/root.db b/bin/tests/system/allow-query/ns1/root.db new file mode 100644 index 0000000..456198e --- /dev/null +++ b/bin/tests/system/allow-query/ns1/root.db @@ -0,0 +1,18 @@ +; Copyright (C) Internet Systems Consortium, Inc. ("ISC") +; +; SPDX-License-Identifier: MPL-2.0 +; +; This Source Code Form is subject to the terms of the Mozilla Public +; License, v. 2.0. If a copy of the MPL was not distributed with this +; file, you can obtain one at https://mozilla.org/MPL/2.0/. +; +; See the COPYRIGHT file distributed with this work for additional +; information regarding copyright ownership. + +$TTL 300 +@ SOA a.root-servers.nil. hostmaster.localhost. 1 3600 1200 604800 3600 + NS a.root-servers.nil. +a.root-servers.nil. A 10.53.0.1 + +normal.example. NS ns2.normal.example. +ns2.normal.example. A 10.53.0.2 diff --git a/bin/tests/system/allow-query/ns2/generic.db b/bin/tests/system/allow-query/ns2/generic.db new file mode 100644 index 0000000..83e66f9 --- /dev/null +++ b/bin/tests/system/allow-query/ns2/generic.db @@ -0,0 +1,33 @@ +; Copyright (C) Internet Systems Consortium, Inc. ("ISC") +; +; SPDX-License-Identifier: MPL-2.0 +; +; This Source Code Form is subject to the terms of the Mozilla Public +; License, v. 2.0. If a copy of the MPL was not distributed with this +; file, you can obtain one at https://mozilla.org/MPL/2.0/. +; +; See the COPYRIGHT file distributed with this work for additional +; information regarding copyright ownership. + +$ORIGIN @ +$TTL 300 ; 5 minutes +@ IN SOA mname1. . ( + 1 ; serial + 20 ; refresh (20 seconds) + 20 ; retry (20 seconds) + 1814400 ; expire (3 weeks) + 3600 ; minimum (1 hour) + ) + NS ns2 +ns2 A 10.53.0.2 + MX 10 mail + +a A 10.0.7.1 +mail A 10.0.7.2 +b A 10.0.7.3 +c A 10.0.7.4 +d A 10.0.7.5 +e A 10.0.7.6 +f A 10.0.7.7 +g A 10.0.7.8 +h A 10.0.7.9 diff --git a/bin/tests/system/allow-query/ns2/named01.conf.in b/bin/tests/system/allow-query/ns2/named01.conf.in new file mode 100644 index 0000000..3069010 --- /dev/null +++ b/bin/tests/system/allow-query/ns2/named01.conf.in @@ -0,0 +1,33 @@ +/* + * Copyright (C) Internet Systems Consortium, Inc. ("ISC") + * + * SPDX-License-Identifier: MPL-2.0 + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, you can obtain one at https://mozilla.org/MPL/2.0/. + * + * See the COPYRIGHT file distributed with this work for additional + * information regarding copyright ownership. + */ + +options { + port @PORT@; + pid-file "named.pid"; + listen-on { 10.53.0.2; }; + listen-on-v6 { none; }; + recursion no; + dnssec-validation no; +}; + +include "controls.conf"; + +zone "." { + type hint; + file "../../common/root.hint"; +}; + +zone "normal.example" { + type primary; + file "generic.db"; +}; diff --git a/bin/tests/system/allow-query/ns2/named02.conf.in b/bin/tests/system/allow-query/ns2/named02.conf.in new file mode 100644 index 0000000..678c417 --- /dev/null +++ b/bin/tests/system/allow-query/ns2/named02.conf.in @@ -0,0 +1,34 @@ +/* + * Copyright (C) Internet Systems Consortium, Inc. ("ISC") + * + * SPDX-License-Identifier: MPL-2.0 + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, you can obtain one at https://mozilla.org/MPL/2.0/. + * + * See the COPYRIGHT file distributed with this work for additional + * information regarding copyright ownership. + */ + +options { + port @PORT@; + pid-file "named.pid"; + listen-on { 10.53.0.2; }; + listen-on-v6 { none; }; + recursion no; + allow-query { any; }; + dnssec-validation no; +}; + +include "controls.conf"; + +zone "." { + type hint; + file "../../common/root.hint"; +}; + +zone "normal.example" { + type primary; + file "generic.db"; +}; diff --git a/bin/tests/system/allow-query/ns2/named03.conf.in b/bin/tests/system/allow-query/ns2/named03.conf.in new file mode 100644 index 0000000..cdc64ff --- /dev/null +++ b/bin/tests/system/allow-query/ns2/named03.conf.in @@ -0,0 +1,34 @@ +/* + * Copyright (C) Internet Systems Consortium, Inc. ("ISC") + * + * SPDX-License-Identifier: MPL-2.0 + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, you can obtain one at https://mozilla.org/MPL/2.0/. + * + * See the COPYRIGHT file distributed with this work for additional + * information regarding copyright ownership. + */ + +options { + port @PORT@; + pid-file "named.pid"; + listen-on { 10.53.0.2; }; + listen-on-v6 { none; }; + recursion no; + allow-query { none; }; + dnssec-validation no; +}; + +include "controls.conf"; + +zone "." { + type hint; + file "../../common/root.hint"; +}; + +zone "normal.example" { + type primary; + file "generic.db"; +}; diff --git a/bin/tests/system/allow-query/ns2/named04.conf.in b/bin/tests/system/allow-query/ns2/named04.conf.in new file mode 100644 index 0000000..0544662 --- /dev/null +++ b/bin/tests/system/allow-query/ns2/named04.conf.in @@ -0,0 +1,34 @@ +/* + * Copyright (C) Internet Systems Consortium, Inc. ("ISC") + * + * SPDX-License-Identifier: MPL-2.0 + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, you can obtain one at https://mozilla.org/MPL/2.0/. + * + * See the COPYRIGHT file distributed with this work for additional + * information regarding copyright ownership. + */ + +options { + port @PORT@; + pid-file "named.pid"; + listen-on { 10.53.0.2; }; + listen-on-v6 { none; }; + recursion no; + allow-query { 10.53.0.2; }; + dnssec-validation no; +}; + +include "controls.conf"; + +zone "." { + type hint; + file "../../common/root.hint"; +}; + +zone "normal.example" { + type primary; + file "generic.db"; +}; diff --git a/bin/tests/system/allow-query/ns2/named05.conf.in b/bin/tests/system/allow-query/ns2/named05.conf.in new file mode 100644 index 0000000..6f92049 --- /dev/null +++ b/bin/tests/system/allow-query/ns2/named05.conf.in @@ -0,0 +1,34 @@ +/* + * Copyright (C) Internet Systems Consortium, Inc. ("ISC") + * + * SPDX-License-Identifier: MPL-2.0 + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, you can obtain one at https://mozilla.org/MPL/2.0/. + * + * See the COPYRIGHT file distributed with this work for additional + * information regarding copyright ownership. + */ + +options { + port @PORT@; + pid-file "named.pid"; + listen-on { 10.53.0.2; }; + listen-on-v6 { none; }; + recursion no; + allow-query { 10.53.0.1; }; + dnssec-validation no; +}; + +include "controls.conf"; + +zone "." { + type hint; + file "../../common/root.hint"; +}; + +zone "normal.example" { + type primary; + file "generic.db"; +}; diff --git a/bin/tests/system/allow-query/ns2/named06.conf.in b/bin/tests/system/allow-query/ns2/named06.conf.in new file mode 100644 index 0000000..261c75b --- /dev/null +++ b/bin/tests/system/allow-query/ns2/named06.conf.in @@ -0,0 +1,34 @@ +/* + * Copyright (C) Internet Systems Consortium, Inc. ("ISC") + * + * SPDX-License-Identifier: MPL-2.0 + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, you can obtain one at https://mozilla.org/MPL/2.0/. + * + * See the COPYRIGHT file distributed with this work for additional + * information regarding copyright ownership. + */ + +options { + port @PORT@; + pid-file "named.pid"; + listen-on { 10.53.0.2; }; + listen-on-v6 { none; }; + recursion no; + allow-query {! 10.53.0.2; }; + dnssec-validation no; +}; + +include "controls.conf"; + +zone "." { + type hint; + file "../../common/root.hint"; +}; + +zone "normal.example" { + type primary; + file "generic.db"; +}; diff --git a/bin/tests/system/allow-query/ns2/named07.conf.in b/bin/tests/system/allow-query/ns2/named07.conf.in new file mode 100644 index 0000000..8050fa2 --- /dev/null +++ b/bin/tests/system/allow-query/ns2/named07.conf.in @@ -0,0 +1,36 @@ +/* + * Copyright (C) Internet Systems Consortium, Inc. ("ISC") + * + * SPDX-License-Identifier: MPL-2.0 + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, you can obtain one at https://mozilla.org/MPL/2.0/. + * + * See the COPYRIGHT file distributed with this work for additional + * information regarding copyright ownership. + */ + +acl accept { 10.53.0.2; }; + +options { + port @PORT@; + pid-file "named.pid"; + listen-on { 10.53.0.2; }; + listen-on-v6 { none; }; + recursion no; + allow-query { accept; }; + dnssec-validation no; +}; + +include "controls.conf"; + +zone "." { + type hint; + file "../../common/root.hint"; +}; + +zone "normal.example" { + type primary; + file "generic.db"; +}; diff --git a/bin/tests/system/allow-query/ns2/named08.conf.in b/bin/tests/system/allow-query/ns2/named08.conf.in new file mode 100644 index 0000000..ffa4cdc --- /dev/null +++ b/bin/tests/system/allow-query/ns2/named08.conf.in @@ -0,0 +1,36 @@ +/* + * Copyright (C) Internet Systems Consortium, Inc. ("ISC") + * + * SPDX-License-Identifier: MPL-2.0 + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, you can obtain one at https://mozilla.org/MPL/2.0/. + * + * See the COPYRIGHT file distributed with this work for additional + * information regarding copyright ownership. + */ + +acl accept { 10.53.0.1; }; + +options { + port @PORT@; + pid-file "named.pid"; + listen-on { 10.53.0.2; }; + listen-on-v6 { none; }; + recursion no; + allow-query { accept; }; + dnssec-validation no; +}; + +include "controls.conf"; + +zone "." { + type hint; + file "../../common/root.hint"; +}; + +zone "normal.example" { + type primary; + file "generic.db"; +}; diff --git a/bin/tests/system/allow-query/ns2/named09.conf.in b/bin/tests/system/allow-query/ns2/named09.conf.in new file mode 100644 index 0000000..49166e6 --- /dev/null +++ b/bin/tests/system/allow-query/ns2/named09.conf.in @@ -0,0 +1,36 @@ +/* + * Copyright (C) Internet Systems Consortium, Inc. ("ISC") + * + * SPDX-License-Identifier: MPL-2.0 + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, you can obtain one at https://mozilla.org/MPL/2.0/. + * + * See the COPYRIGHT file distributed with this work for additional + * information regarding copyright ownership. + */ + +acl accept { 10.53.0.2; }; + +options { + port @PORT@; + pid-file "named.pid"; + listen-on { 10.53.0.2; }; + listen-on-v6 { none; }; + recursion no; + allow-query {! accept; }; + dnssec-validation no; +}; + +include "controls.conf"; + +zone "." { + type hint; + file "../../common/root.hint"; +}; + +zone "normal.example" { + type primary; + file "generic.db"; +}; diff --git a/bin/tests/system/allow-query/ns2/named10.conf.in b/bin/tests/system/allow-query/ns2/named10.conf.in new file mode 100644 index 0000000..d684c2d --- /dev/null +++ b/bin/tests/system/allow-query/ns2/named10.conf.in @@ -0,0 +1,39 @@ +/* + * Copyright (C) Internet Systems Consortium, Inc. ("ISC") + * + * SPDX-License-Identifier: MPL-2.0 + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, you can obtain one at https://mozilla.org/MPL/2.0/. + * + * See the COPYRIGHT file distributed with this work for additional + * information regarding copyright ownership. + */ + +key one { + algorithm hmac-md5; + secret "1234abcd8765"; +}; + +options { + port @PORT@; + pid-file "named.pid"; + listen-on { 10.53.0.2; }; + listen-on-v6 { none; }; + recursion no; + allow-query { key one; }; + dnssec-validation no; +}; + +include "controls.conf"; + +zone "." { + type hint; + file "../../common/root.hint"; +}; + +zone "normal.example" { + type primary; + file "generic.db"; +}; diff --git a/bin/tests/system/allow-query/ns2/named11.conf.in b/bin/tests/system/allow-query/ns2/named11.conf.in new file mode 100644 index 0000000..59b9e0e --- /dev/null +++ b/bin/tests/system/allow-query/ns2/named11.conf.in @@ -0,0 +1,45 @@ +/* + * Copyright (C) Internet Systems Consortium, Inc. ("ISC") + * + * SPDX-License-Identifier: MPL-2.0 + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, you can obtain one at https://mozilla.org/MPL/2.0/. + * + * See the COPYRIGHT file distributed with this work for additional + * information regarding copyright ownership. + */ + +key one { + algorithm hmac-md5; + secret "1234abcd8765"; +}; + +key two { + algorithm hmac-md5; + secret "1234efgh8765"; +}; + + +options { + port @PORT@; + pid-file "named.pid"; + listen-on { 10.53.0.2; }; + listen-on-v6 { none; }; + recursion no; + allow-query { key one; }; + dnssec-validation no; +}; + +include "controls.conf"; + +zone "." { + type hint; + file "../../common/root.hint"; +}; + +zone "normal.example" { + type primary; + file "generic.db"; +}; diff --git a/bin/tests/system/allow-query/ns2/named12.conf.in b/bin/tests/system/allow-query/ns2/named12.conf.in new file mode 100644 index 0000000..a8e9107 --- /dev/null +++ b/bin/tests/system/allow-query/ns2/named12.conf.in @@ -0,0 +1,39 @@ +/* + * Copyright (C) Internet Systems Consortium, Inc. ("ISC") + * + * SPDX-License-Identifier: MPL-2.0 + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, you can obtain one at https://mozilla.org/MPL/2.0/. + * + * See the COPYRIGHT file distributed with this work for additional + * information regarding copyright ownership. + */ + +key one { + algorithm hmac-md5; + secret "1234abcd8765"; +}; + +options { + port @PORT@; + pid-file "named.pid"; + listen-on { 10.53.0.2; }; + listen-on-v6 { none; }; + recursion no; + allow-query {! key one; }; + dnssec-validation no; +}; + +include "controls.conf"; + +zone "." { + type hint; + file "../../common/root.hint"; +}; + +zone "normal.example" { + type primary; + file "generic.db"; +}; diff --git a/bin/tests/system/allow-query/ns2/named21.conf.in b/bin/tests/system/allow-query/ns2/named21.conf.in new file mode 100644 index 0000000..c6204a3 --- /dev/null +++ b/bin/tests/system/allow-query/ns2/named21.conf.in @@ -0,0 +1,36 @@ +/* + * Copyright (C) Internet Systems Consortium, Inc. ("ISC") + * + * SPDX-License-Identifier: MPL-2.0 + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, you can obtain one at https://mozilla.org/MPL/2.0/. + * + * See the COPYRIGHT file distributed with this work for additional + * information regarding copyright ownership. + */ + +options { + port @PORT@; + pid-file "named.pid"; + listen-on { 10.53.0.2; }; + listen-on-v6 { none; }; + recursion no; + dnssec-validation no; +}; + +include "controls.conf"; + +view "internal" { + + zone "." { + type hint; + file "../../common/root.hint"; + }; + + zone "normal.example" { + type primary; + file "generic.db"; + }; +}; diff --git a/bin/tests/system/allow-query/ns2/named22.conf.in b/bin/tests/system/allow-query/ns2/named22.conf.in new file mode 100644 index 0000000..454f24a --- /dev/null +++ b/bin/tests/system/allow-query/ns2/named22.conf.in @@ -0,0 +1,39 @@ +/* + * Copyright (C) Internet Systems Consortium, Inc. ("ISC") + * + * SPDX-License-Identifier: MPL-2.0 + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, you can obtain one at https://mozilla.org/MPL/2.0/. + * + * See the COPYRIGHT file distributed with this work for additional + * information regarding copyright ownership. + */ + +options { + port @PORT@; + pid-file "named.pid"; + listen-on { 10.53.0.2; }; + listen-on-v6 { none; }; + recursion no; + dnssec-validation no; +}; + +include "controls.conf"; + +view "internal" { + + allow-query { any; }; + + zone "." { + type hint; + file "../../common/root.hint"; + }; + + zone "normal.example" { + type primary; + file "generic.db"; + }; + +}; diff --git a/bin/tests/system/allow-query/ns2/named23.conf.in b/bin/tests/system/allow-query/ns2/named23.conf.in new file mode 100644 index 0000000..f62337b --- /dev/null +++ b/bin/tests/system/allow-query/ns2/named23.conf.in @@ -0,0 +1,38 @@ +/* + * Copyright (C) Internet Systems Consortium, Inc. ("ISC") + * + * SPDX-License-Identifier: MPL-2.0 + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, you can obtain one at https://mozilla.org/MPL/2.0/. + * + * See the COPYRIGHT file distributed with this work for additional + * information regarding copyright ownership. + */ + +options { + port @PORT@; + pid-file "named.pid"; + listen-on { 10.53.0.2; }; + listen-on-v6 { none; }; + recursion no; + dnssec-validation no; +}; + +include "controls.conf"; + +view "internal" { + + allow-query { none; }; + + zone "." { + type hint; + file "../../common/root.hint"; + }; + + zone "normal.example" { + type primary; + file "generic.db"; + }; +}; diff --git a/bin/tests/system/allow-query/ns2/named24.conf.in b/bin/tests/system/allow-query/ns2/named24.conf.in new file mode 100644 index 0000000..1e277a9 --- /dev/null +++ b/bin/tests/system/allow-query/ns2/named24.conf.in @@ -0,0 +1,38 @@ +/* + * Copyright (C) Internet Systems Consortium, Inc. ("ISC") + * + * SPDX-License-Identifier: MPL-2.0 + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, you can obtain one at https://mozilla.org/MPL/2.0/. + * + * See the COPYRIGHT file distributed with this work for additional + * information regarding copyright ownership. + */ + +options { + port @PORT@; + pid-file "named.pid"; + listen-on { 10.53.0.2; }; + listen-on-v6 { none; }; + recursion no; + dnssec-validation no; +}; + +include "controls.conf"; + +view "internal" { + + allow-query { 10.53.0.2; }; + + zone "." { + type hint; + file "../../common/root.hint"; + }; + + zone "normal.example" { + type primary; + file "generic.db"; + }; +}; diff --git a/bin/tests/system/allow-query/ns2/named25.conf.in b/bin/tests/system/allow-query/ns2/named25.conf.in new file mode 100644 index 0000000..0548af2 --- /dev/null +++ b/bin/tests/system/allow-query/ns2/named25.conf.in @@ -0,0 +1,38 @@ +/* + * Copyright (C) Internet Systems Consortium, Inc. ("ISC") + * + * SPDX-License-Identifier: MPL-2.0 + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, you can obtain one at https://mozilla.org/MPL/2.0/. + * + * See the COPYRIGHT file distributed with this work for additional + * information regarding copyright ownership. + */ + +options { + port @PORT@; + pid-file "named.pid"; + listen-on { 10.53.0.2; }; + listen-on-v6 { none; }; + recursion no; + dnssec-validation no; +}; + +include "controls.conf"; + +view "internal" { + + allow-query { 10.53.0.1; }; + + zone "." { + type hint; + file "../../common/root.hint"; + }; + + zone "normal.example" { + type primary; + file "generic.db"; + }; +}; diff --git a/bin/tests/system/allow-query/ns2/named26.conf.in b/bin/tests/system/allow-query/ns2/named26.conf.in new file mode 100644 index 0000000..40e5dfd --- /dev/null +++ b/bin/tests/system/allow-query/ns2/named26.conf.in @@ -0,0 +1,38 @@ +/* + * Copyright (C) Internet Systems Consortium, Inc. ("ISC") + * + * SPDX-License-Identifier: MPL-2.0 + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, you can obtain one at https://mozilla.org/MPL/2.0/. + * + * See the COPYRIGHT file distributed with this work for additional + * information regarding copyright ownership. + */ + +options { + port @PORT@; + pid-file "named.pid"; + listen-on { 10.53.0.2; }; + listen-on-v6 { none; }; + recursion no; + dnssec-validation no; +}; + +include "controls.conf"; + +view "internal" { + + allow-query {! 10.53.0.2; }; + + zone "." { + type hint; + file "../../common/root.hint"; + }; + + zone "normal.example" { + type primary; + file "generic.db"; + }; +}; diff --git a/bin/tests/system/allow-query/ns2/named27.conf.in b/bin/tests/system/allow-query/ns2/named27.conf.in new file mode 100644 index 0000000..92fa1f8 --- /dev/null +++ b/bin/tests/system/allow-query/ns2/named27.conf.in @@ -0,0 +1,41 @@ +/* + * Copyright (C) Internet Systems Consortium, Inc. ("ISC") + * + * SPDX-License-Identifier: MPL-2.0 + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, you can obtain one at https://mozilla.org/MPL/2.0/. + * + * See the COPYRIGHT file distributed with this work for additional + * information regarding copyright ownership. + */ + +acl accept { 10.53.0.2; }; + +options { + port @PORT@; + pid-file "named.pid"; + listen-on { 10.53.0.2; }; + listen-on-v6 { none; }; + recursion no; + dnssec-validation no; +}; + +include "controls.conf"; + +view "internal" { + + allow-query { accept; }; + + zone "." { + type hint; + file "../../common/root.hint"; + }; + + zone "normal.example" { + type primary; + file "generic.db"; + }; + +}; diff --git a/bin/tests/system/allow-query/ns2/named28.conf.in b/bin/tests/system/allow-query/ns2/named28.conf.in new file mode 100644 index 0000000..2ecac7c --- /dev/null +++ b/bin/tests/system/allow-query/ns2/named28.conf.in @@ -0,0 +1,40 @@ +/* + * Copyright (C) Internet Systems Consortium, Inc. ("ISC") + * + * SPDX-License-Identifier: MPL-2.0 + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, you can obtain one at https://mozilla.org/MPL/2.0/. + * + * See the COPYRIGHT file distributed with this work for additional + * information regarding copyright ownership. + */ + +acl accept { 10.53.0.1; }; + +options { + port @PORT@; + pid-file "named.pid"; + listen-on { 10.53.0.2; }; + listen-on-v6 { none; }; + recursion no; + dnssec-validation no; +}; + +include "controls.conf"; + +view "internal" { + + allow-query { accept; }; + + zone "." { + type hint; + file "../../common/root.hint"; + }; + + zone "normal.example" { + type primary; + file "generic.db"; + }; +}; diff --git a/bin/tests/system/allow-query/ns2/named29.conf.in b/bin/tests/system/allow-query/ns2/named29.conf.in new file mode 100644 index 0000000..9a6c9e5 --- /dev/null +++ b/bin/tests/system/allow-query/ns2/named29.conf.in @@ -0,0 +1,40 @@ +/* + * Copyright (C) Internet Systems Consortium, Inc. ("ISC") + * + * SPDX-License-Identifier: MPL-2.0 + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, you can obtain one at https://mozilla.org/MPL/2.0/. + * + * See the COPYRIGHT file distributed with this work for additional + * information regarding copyright ownership. + */ + +acl accept { 10.53.0.2; }; + +options { + port @PORT@; + pid-file "named.pid"; + listen-on { 10.53.0.2; }; + listen-on-v6 { none; }; + recursion no; + dnssec-validation no; +}; + +include "controls.conf"; + +view "internal" { + + allow-query {! accept; }; + + zone "." { + type hint; + file "../../common/root.hint"; + }; + + zone "normal.example" { + type primary; + file "generic.db"; + }; +}; diff --git a/bin/tests/system/allow-query/ns2/named30.conf.in b/bin/tests/system/allow-query/ns2/named30.conf.in new file mode 100644 index 0000000..f7084c8 --- /dev/null +++ b/bin/tests/system/allow-query/ns2/named30.conf.in @@ -0,0 +1,43 @@ +/* + * Copyright (C) Internet Systems Consortium, Inc. ("ISC") + * + * SPDX-License-Identifier: MPL-2.0 + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, you can obtain one at https://mozilla.org/MPL/2.0/. + * + * See the COPYRIGHT file distributed with this work for additional + * information regarding copyright ownership. + */ + +key one { + algorithm hmac-md5; + secret "1234abcd8765"; +}; + +options { + port @PORT@; + pid-file "named.pid"; + listen-on { 10.53.0.2; }; + listen-on-v6 { none; }; + recursion no; + dnssec-validation no; +}; + +include "controls.conf"; + +view "internal" { + + allow-query { key one; }; + + zone "." { + type hint; + file "../../common/root.hint"; + }; + + zone "normal.example" { + type primary; + file "generic.db"; + }; +}; diff --git a/bin/tests/system/allow-query/ns2/named31.conf.in b/bin/tests/system/allow-query/ns2/named31.conf.in new file mode 100644 index 0000000..d6a7af5 --- /dev/null +++ b/bin/tests/system/allow-query/ns2/named31.conf.in @@ -0,0 +1,50 @@ +/* + * Copyright (C) Internet Systems Consortium, Inc. ("ISC") + * + * SPDX-License-Identifier: MPL-2.0 + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, you can obtain one at https://mozilla.org/MPL/2.0/. + * + * See the COPYRIGHT file distributed with this work for additional + * information regarding copyright ownership. + */ + +key one { + algorithm hmac-md5; + secret "1234abcd8765"; +}; + +key two { + algorithm hmac-md5; + secret "1234efgh8765"; +}; + + +options { + port @PORT@; + pid-file "named.pid"; + listen-on { 10.53.0.2; }; + listen-on-v6 { none; }; + recursion no; + allow-query { key one; }; + dnssec-validation no; +}; + +include "controls.conf"; + +view "internal" { + + allow-query { key one; }; + + zone "." { + type hint; + file "../../common/root.hint"; + }; + + zone "normal.example" { + type primary; + file "generic.db"; + }; +}; diff --git a/bin/tests/system/allow-query/ns2/named32.conf.in b/bin/tests/system/allow-query/ns2/named32.conf.in new file mode 100644 index 0000000..b7d7ee4 --- /dev/null +++ b/bin/tests/system/allow-query/ns2/named32.conf.in @@ -0,0 +1,43 @@ +/* + * Copyright (C) Internet Systems Consortium, Inc. ("ISC") + * + * SPDX-License-Identifier: MPL-2.0 + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, you can obtain one at https://mozilla.org/MPL/2.0/. + * + * See the COPYRIGHT file distributed with this work for additional + * information regarding copyright ownership. + */ + +key one { + algorithm hmac-md5; + secret "1234abcd8765"; +}; + +options { + port @PORT@; + pid-file "named.pid"; + listen-on { 10.53.0.2; }; + listen-on-v6 { none; }; + recursion no; + dnssec-validation no; +}; + +include "controls.conf"; + +view "internal" { + + allow-query {! key one; }; + + zone "." { + type hint; + file "../../common/root.hint"; + }; + + zone "normal.example" { + type primary; + file "generic.db"; + }; +}; diff --git a/bin/tests/system/allow-query/ns2/named33.conf.in b/bin/tests/system/allow-query/ns2/named33.conf.in new file mode 100644 index 0000000..be31b72 --- /dev/null +++ b/bin/tests/system/allow-query/ns2/named33.conf.in @@ -0,0 +1,40 @@ +/* + * Copyright (C) Internet Systems Consortium, Inc. ("ISC") + * + * SPDX-License-Identifier: MPL-2.0 + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, you can obtain one at https://mozilla.org/MPL/2.0/. + * + * See the COPYRIGHT file distributed with this work for additional + * information regarding copyright ownership. + */ + +options { + port @PORT@; + pid-file "named.pid"; + listen-on { 10.53.0.2; }; + listen-on-v6 { none; }; + recursion no; + allow-query { none; }; + dnssec-validation no; +}; + +include "controls.conf"; + +view "internal" { + + allow-query { any; }; + + zone "." { + type hint; + file "../../common/root.hint"; + }; + + zone "normal.example" { + type primary; + file "generic.db"; + }; + +}; diff --git a/bin/tests/system/allow-query/ns2/named34.conf.in b/bin/tests/system/allow-query/ns2/named34.conf.in new file mode 100644 index 0000000..165ff06 --- /dev/null +++ b/bin/tests/system/allow-query/ns2/named34.conf.in @@ -0,0 +1,39 @@ +/* + * Copyright (C) Internet Systems Consortium, Inc. ("ISC") + * + * SPDX-License-Identifier: MPL-2.0 + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, you can obtain one at https://mozilla.org/MPL/2.0/. + * + * See the COPYRIGHT file distributed with this work for additional + * information regarding copyright ownership. + */ + +options { + port @PORT@; + pid-file "named.pid"; + listen-on { 10.53.0.2; }; + listen-on-v6 { none; }; + recursion no; + allow-query { any; }; + dnssec-validation no; +}; + +include "controls.conf"; + +view "internal" { + + allow-query { none; }; + + zone "." { + type hint; + file "../../common/root.hint"; + }; + + zone "normal.example" { + type primary; + file "generic.db"; + }; +}; diff --git a/bin/tests/system/allow-query/ns2/named40.conf.in b/bin/tests/system/allow-query/ns2/named40.conf.in new file mode 100644 index 0000000..b7a8746 --- /dev/null +++ b/bin/tests/system/allow-query/ns2/named40.conf.in @@ -0,0 +1,108 @@ +/* + * Copyright (C) Internet Systems Consortium, Inc. ("ISC") + * + * SPDX-License-Identifier: MPL-2.0 + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, you can obtain one at https://mozilla.org/MPL/2.0/. + * + * See the COPYRIGHT file distributed with this work for additional + * information regarding copyright ownership. + */ + +acl accept { 10.53.0.2; }; + +acl badaccept { 10.53.0.1; }; + +key one { + algorithm hmac-md5; + secret "1234abcd8765"; +}; + +key two { + algorithm hmac-md5; + secret "1234efgh8765"; +}; + +options { + port @PORT@; + pid-file "named.pid"; + listen-on { 10.53.0.2; }; + listen-on-v6 { none; }; + recursion no; + dnssec-validation no; +}; + +include "controls.conf"; + +zone "." { + type hint; + file "../../common/root.hint"; +}; + +zone "normal.example" { + type primary; + file "generic.db"; +}; + +zone "any.example" { + type primary; + file "generic.db"; + allow-query { any; }; +}; + +zone "none.example" { + type primary; + file "generic.db"; + allow-query { none; }; +}; + +zone "addrallow.example" { + type primary; + file "generic.db"; + allow-query { 10.53.0.2; }; +}; + +zone "addrnotallow.example" { + type primary; + file "generic.db"; + allow-query { 10.53.0.1; }; +}; + +zone "addrdisallow.example" { + type primary; + file "generic.db"; + allow-query { ! 10.53.0.2; }; +}; + +zone "aclallow.example" { + type primary; + file "generic.db"; + allow-query { accept; }; +}; + +zone "aclnotallow.example" { + type primary; + file "generic.db"; + allow-query { badaccept; }; +}; + +zone "acldisallow.example" { + type primary; + file "generic.db"; + allow-query { ! accept; }; +}; + +/* Also usable for testing key not allowed */ +zone "keyallow.example" { + type primary; + file "generic.db"; + allow-query { key one; }; +}; + +zone "keydisallow.example" { + type primary; + file "generic.db"; + allow-query { ! key one; }; +}; diff --git a/bin/tests/system/allow-query/ns2/named53.conf.in b/bin/tests/system/allow-query/ns2/named53.conf.in new file mode 100644 index 0000000..bd0af28 --- /dev/null +++ b/bin/tests/system/allow-query/ns2/named53.conf.in @@ -0,0 +1,35 @@ +/* + * Copyright (C) Internet Systems Consortium, Inc. ("ISC") + * + * SPDX-License-Identifier: MPL-2.0 + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, you can obtain one at https://mozilla.org/MPL/2.0/. + * + * See the COPYRIGHT file distributed with this work for additional + * information regarding copyright ownership. + */ + +options { + port @PORT@; + pid-file "named.pid"; + listen-on { 10.53.0.2; }; + listen-on-v6 { none; }; + recursion no; + allow-query { none; }; + dnssec-validation no; +}; + +include "controls.conf"; + +zone "." { + type hint; + file "../../common/root.hint"; +}; + +zone "normal.example" { + type primary; + file "generic.db"; + allow-query { any; }; +}; diff --git a/bin/tests/system/allow-query/ns2/named54.conf.in b/bin/tests/system/allow-query/ns2/named54.conf.in new file mode 100644 index 0000000..a6ca424 --- /dev/null +++ b/bin/tests/system/allow-query/ns2/named54.conf.in @@ -0,0 +1,35 @@ +/* + * Copyright (C) Internet Systems Consortium, Inc. ("ISC") + * + * SPDX-License-Identifier: MPL-2.0 + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, you can obtain one at https://mozilla.org/MPL/2.0/. + * + * See the COPYRIGHT file distributed with this work for additional + * information regarding copyright ownership. + */ + +options { + port @PORT@; + pid-file "named.pid"; + listen-on { 10.53.0.2; }; + listen-on-v6 { none; }; + recursion no; + allow-query { any; }; + dnssec-validation no; +}; + +include "controls.conf"; + +zone "." { + type hint; + file "../../common/root.hint"; +}; + +zone "normal.example" { + type primary; + file "generic.db"; + allow-query { none; }; +}; diff --git a/bin/tests/system/allow-query/ns2/named55.conf.in b/bin/tests/system/allow-query/ns2/named55.conf.in new file mode 100644 index 0000000..6bcba07 --- /dev/null +++ b/bin/tests/system/allow-query/ns2/named55.conf.in @@ -0,0 +1,40 @@ +/* + * Copyright (C) Internet Systems Consortium, Inc. ("ISC") + * + * SPDX-License-Identifier: MPL-2.0 + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, you can obtain one at https://mozilla.org/MPL/2.0/. + * + * See the COPYRIGHT file distributed with this work for additional + * information regarding copyright ownership. + */ + +options { + port @PORT@; + pid-file "named.pid"; + listen-on { 10.53.0.2; }; + listen-on-v6 { none; }; + recursion no; + dnssec-validation no; +}; + +include "controls.conf"; + +view "internal" { + + allow-query { none; }; + + zone "." { + type hint; + file "../../common/root.hint"; + }; + + zone "normal.example" { + type primary; + file "generic.db"; + allow-query { any; }; + }; + +}; diff --git a/bin/tests/system/allow-query/ns2/named56.conf.in b/bin/tests/system/allow-query/ns2/named56.conf.in new file mode 100644 index 0000000..d89a5fb --- /dev/null +++ b/bin/tests/system/allow-query/ns2/named56.conf.in @@ -0,0 +1,39 @@ +/* + * Copyright (C) Internet Systems Consortium, Inc. ("ISC") + * + * SPDX-License-Identifier: MPL-2.0 + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, you can obtain one at https://mozilla.org/MPL/2.0/. + * + * See the COPYRIGHT file distributed with this work for additional + * information regarding copyright ownership. + */ + +options { + port @PORT@; + pid-file "named.pid"; + listen-on { 10.53.0.2; }; + listen-on-v6 { none; }; + recursion no; + dnssec-validation no; +}; + +include "controls.conf"; + +view "internal" { + + allow-query { any; }; + + zone "." { + type hint; + file "../../common/root.hint"; + }; + + zone "normal.example" { + type primary; + file "generic.db"; + allow-query { none; }; + }; +}; diff --git a/bin/tests/system/allow-query/ns2/named57.conf.in b/bin/tests/system/allow-query/ns2/named57.conf.in new file mode 100644 index 0000000..bcc3a85 --- /dev/null +++ b/bin/tests/system/allow-query/ns2/named57.conf.in @@ -0,0 +1,43 @@ +/* + * Copyright (C) Internet Systems Consortium, Inc. ("ISC") + * + * SPDX-License-Identifier: MPL-2.0 + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, you can obtain one at https://mozilla.org/MPL/2.0/. + * + * See the COPYRIGHT file distributed with this work for additional + * information regarding copyright ownership. + */ + +options { + port @PORT@; + pid-file "named.pid"; + listen-on { 10.53.0.2; }; + listen-on-v6 { none; }; + recursion no; + dnssec-validation no; +}; + +include "controls.conf"; + +view "internal" { + allow-query-on { any; }; + + zone "." { + type hint; + file "../../common/root.hint"; + }; + + zone "normal.example" { + type primary; + file "generic.db"; + }; + + zone "aclnotallow.example" { + type primary; + file "generic.db"; + allow-query-on { none; }; + }; +}; diff --git a/bin/tests/system/allow-query/ns3/named.args b/bin/tests/system/allow-query/ns3/named.args new file mode 100644 index 0000000..e875a57 --- /dev/null +++ b/bin/tests/system/allow-query/ns3/named.args @@ -0,0 +1,2 @@ +# this server only has 127.0.0.1 in its localhost/localnets ACLs +-m record -c named.conf -d 99 -D allow-query-ns3 -X named.lock -g -T maxcachesize=2097152 -T fixedlocal diff --git a/bin/tests/system/allow-query/ns3/named1.conf.in b/bin/tests/system/allow-query/ns3/named1.conf.in new file mode 100644 index 0000000..74b9885 --- /dev/null +++ b/bin/tests/system/allow-query/ns3/named1.conf.in @@ -0,0 +1,35 @@ +/* + * Copyright (C) Internet Systems Consortium, Inc. ("ISC") + * + * SPDX-License-Identifier: MPL-2.0 + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, you can obtain one at https://mozilla.org/MPL/2.0/. + * + * See the COPYRIGHT file distributed with this work for additional + * information regarding copyright ownership. + */ + +options { + port @PORT@; + pid-file "named.pid"; + listen-on { 10.53.0.3; }; + listen-on-v6 { none; }; + recursion yes; + dnssec-validation no; +}; + +key rndc_key { + secret "1234abcd8765"; + algorithm @DEFAULT_HMAC@; +}; + +controls { + inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; }; +}; + +zone "." { + type hint; + file "../../common/root.hint"; +}; diff --git a/bin/tests/system/allow-query/ns3/named2.conf.in b/bin/tests/system/allow-query/ns3/named2.conf.in new file mode 100644 index 0000000..c4a4e8f --- /dev/null +++ b/bin/tests/system/allow-query/ns3/named2.conf.in @@ -0,0 +1,38 @@ +/* + * Copyright (C) Internet Systems Consortium, Inc. ("ISC") + * + * SPDX-License-Identifier: MPL-2.0 + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, you can obtain one at https://mozilla.org/MPL/2.0/. + * + * See the COPYRIGHT file distributed with this work for additional + * information regarding copyright ownership. + */ + +options { + port @PORT@; + pid-file "named.pid"; + listen-on { 10.53.0.3; }; + listen-on-v6 { none; }; + recursion yes; + allow-recursion { any; }; + allow-recursion-on { none; }; + allow-query-cache-on { 10.53.0.3; }; + dnssec-validation no; +}; + +key rndc_key { + secret "1234abcd8765"; + algorithm @DEFAULT_HMAC@; +}; + +controls { + inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; }; +}; + +zone "." { + type hint; + file "../../common/root.hint"; +}; diff --git a/bin/tests/system/allow-query/ns3/named3.conf.in b/bin/tests/system/allow-query/ns3/named3.conf.in new file mode 100644 index 0000000..0e1f7b0 --- /dev/null +++ b/bin/tests/system/allow-query/ns3/named3.conf.in @@ -0,0 +1,38 @@ +/* + * Copyright (C) Internet Systems Consortium, Inc. ("ISC") + * + * SPDX-License-Identifier: MPL-2.0 + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, you can obtain one at https://mozilla.org/MPL/2.0/. + * + * See the COPYRIGHT file distributed with this work for additional + * information regarding copyright ownership. + */ + +options { + port @PORT@; + pid-file "named.pid"; + listen-on { 10.53.0.3; 10.53.1.2; }; + listen-on-v6 { none; }; + recursion yes; + allow-recursion { any; }; + allow-query-cache { any; }; + allow-query-cache-on { 10.53.0.3; }; # allow-recursion-on inherits + dnssec-validation no; +}; + +key rndc_key { + secret "1234abcd8765"; + algorithm @DEFAULT_HMAC@; +}; + +controls { + inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; }; +}; + +zone "." { + type hint; + file "../../common/root.hint"; +}; diff --git a/bin/tests/system/allow-query/ns3/named4.conf.in b/bin/tests/system/allow-query/ns3/named4.conf.in new file mode 100644 index 0000000..36ff911 --- /dev/null +++ b/bin/tests/system/allow-query/ns3/named4.conf.in @@ -0,0 +1,38 @@ +/* + * Copyright (C) Internet Systems Consortium, Inc. ("ISC") + * + * SPDX-License-Identifier: MPL-2.0 + * + * This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, you can obtain one at https://mozilla.org/MPL/2.0/. + * + * See the COPYRIGHT file distributed with this work for additional + * information regarding copyright ownership. + */ + +options { + port @PORT@; + pid-file "named.pid"; + listen-on { 10.53.0.3; 10.53.1.2; }; + listen-on-v6 { none; }; + recursion yes; + allow-recursion { any; }; + allow-query-cache { any; }; + allow-recursion-on { 10.53.0.3; }; # allow-query-cache-on inherits + dnssec-validation no; +}; + +key rndc_key { + secret "1234abcd8765"; + algorithm @DEFAULT_HMAC@; +}; + +controls { + inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; }; +}; + +zone "." { + type hint; + file "../../common/root.hint"; +}; diff --git a/bin/tests/system/allow-query/setup.sh b/bin/tests/system/allow-query/setup.sh new file mode 100644 index 0000000..c85676e --- /dev/null +++ b/bin/tests/system/allow-query/setup.sh @@ -0,0 +1,19 @@ +#!/bin/sh -e + +# Copyright (C) Internet Systems Consortium, Inc. ("ISC") +# +# SPDX-License-Identifier: MPL-2.0 +# +# This Source Code Form is subject to the terms of the Mozilla Public +# License, v. 2.0. If a copy of the MPL was not distributed with this +# file, you can obtain one at https://mozilla.org/MPL/2.0/. +# +# See the COPYRIGHT file distributed with this work for additional +# information regarding copyright ownership. + +. ../conf.sh + +copy_setports ../common/controls.conf.in ns2/controls.conf +copy_setports ns1/named.conf.in ns1/named.conf +copy_setports ns2/named01.conf.in ns2/named.conf +copy_setports ns3/named1.conf.in ns3/named.conf diff --git a/bin/tests/system/allow-query/tests.sh b/bin/tests/system/allow-query/tests.sh new file mode 100644 index 0000000..3a1b8b4 --- /dev/null +++ b/bin/tests/system/allow-query/tests.sh @@ -0,0 +1,739 @@ +#!/bin/sh + +# Copyright (C) Internet Systems Consortium, Inc. ("ISC") +# +# SPDX-License-Identifier: MPL-2.0 +# +# This Source Code Form is subject to the terms of the Mozilla Public +# License, v. 2.0. If a copy of the MPL was not distributed with this +# file, you can obtain one at https://mozilla.org/MPL/2.0/. +# +# See the COPYRIGHT file distributed with this work for additional +# information regarding copyright ownership. + +# Test of allow-query statement. +# allow-query takes an address match list and can be included in either the +# options statement or in the zone statement. This test assumes that the +# acl tests cover the details of the address match list and uses a limited +# number of address match test cases to ensure that allow-query finds the +# expected match. +# Test list: +# In options: +# default (any), any, none, [localhost, localnets], +# allowed address, not allowed address, denied address, +# allowed key, not allowed key, denied key +# allowed acl, not allowed acl, denied acl (acls pointing to addresses) +# +# Each of these tests requires changing to a new configuration +# file and using rndc to update the server +# +# In view, with nothing in options (default to any) +# default (any), any, none, [localhost, localnets], +# allowed address, not allowed address, denied address, +# allowed key, not allowed key, denied key +# allowed acl, not allowed acl, denied acl (acls pointing to addresses) +# +# In view, with options set to none, view set to any +# In view, with options set to any, view set to none +# +# In zone, with nothing in options (default to any) +# any, none, [localhost, localnets], +# allowed address, denied address, +# allowed key, not allowed key, denied key +# allowed acl, not allowed acl, denied acl (acls pointing to addresses), +# +# In zone, with options set to none, zone set to any +# In zone, with options set to any, zone set to none +# In zone, with view set to none, zone set to any +# In zone, with view set to any, zone set to none +# +# zone types of primary, secondary and stub can be tested in parallel by +# using multiple instances (ns2 as primary, ns3 as secondary, ns4 as stub) +# and querying as necessary. +# + +set -e + +. ../conf.sh + +DIGOPTS="+tcp +nosea +nostat +nocmd +norec +noques +noauth +noadd +nostats +dnssec -p ${PORT}" + +status=0 +n=0 + +nextpart ns2/named.run > /dev/null + +# Test 1 - default, query allowed +n=$((n + 1)) +echo_i "test $n: default - query allowed" +ret=0 +$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1 +grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1 +grep '^a.normal.example' dig.out.ns2.$n > /dev/null || ret=1 +if [ $ret != 0 ]; then echo_i "failed"; fi +status=$((status + ret)) + +# Test 2 - explicit any, query allowed +n=$((n + 1)) +copy_setports ns2/named02.conf.in ns2/named.conf +rndc_reload ns2 10.53.0.2 + +echo_i "test $n: explicit any - query allowed" +ret=0 +$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1 +grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1 +grep '^a.normal.example' dig.out.ns2.$n > /dev/null || ret=1 +if [ $ret != 0 ]; then echo_i "failed"; fi +status=$((status + ret)) + +# Test 3 - none, query refused +n=$((n + 1)) +copy_setports ns2/named03.conf.in ns2/named.conf +rndc_reload ns2 10.53.0.2 + +echo_i "test $n: none - query refused" +ret=0 +$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1 +grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1 +grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1 +grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1 +nextpart ns2/named.run | grep 'recursion not enabled for view' > /dev/null || ret=1 +if [ $ret != 0 ]; then echo_i "failed"; fi +status=$((status + ret)) + +n=$((n + 1)) +DIGNOEDNS="+tcp +nosea +nostat +nocmd +norec +noques +noauth +noadd +nostats +noedns -p ${PORT}" + +echo_i "test $n: none - query refused (no edns)" +ret=0 +$DIG $DIGNOEDNS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1 +grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1 +grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null && ret=1 +grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1 +if [ $ret != 0 ]; then echo_i "failed"; fi +status=$((status + ret)) + +# Test 4 - address allowed, query allowed +n=$((n + 1)) +copy_setports ns2/named04.conf.in ns2/named.conf +rndc_reload ns2 10.53.0.2 + +echo_i "test $n: address allowed - query allowed" +ret=0 +$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1 +grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1 +grep '^a.normal.example' dig.out.ns2.$n > /dev/null || ret=1 +if [ $ret != 0 ]; then echo_i "failed"; fi +status=$((status + ret)) + +# Test 5 - address not allowed, query refused +n=$((n + 1)) +copy_setports ns2/named05.conf.in ns2/named.conf +rndc_reload ns2 10.53.0.2 + +echo_i "test $n: address not allowed - query refused" +ret=0 +$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1 +grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1 +grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1 +grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1 +if [ $ret != 0 ]; then echo_i "failed"; fi +status=$((status + ret)) + +# Test 6 - address disallowed, query refused +n=$((n + 1)) +copy_setports ns2/named06.conf.in ns2/named.conf +rndc_reload ns2 10.53.0.2 + +echo_i "test $n: address disallowed - query refused" +ret=0 +$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1 +grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1 +grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1 +grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1 +if [ $ret != 0 ]; then echo_i "failed"; fi +status=$((status + ret)) + +# Test 7 - acl allowed, query allowed +n=$((n + 1)) +copy_setports ns2/named07.conf.in ns2/named.conf +rndc_reload ns2 10.53.0.2 + +echo_i "test $n: acl allowed - query allowed" +ret=0 +$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1 +grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1 +grep '^a.normal.example' dig.out.ns2.$n > /dev/null || ret=1 +if [ $ret != 0 ]; then echo_i "failed"; fi +status=$((status + ret)) + +# Test 8 - acl not allowed, query refused +n=$((n + 1)) +copy_setports ns2/named08.conf.in ns2/named.conf +rndc_reload ns2 10.53.0.2 + +echo_i "test $n: acl not allowed - query refused" +ret=0 +$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1 +grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1 +grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1 +grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1 +if [ $ret != 0 ]; then echo_i "failed"; fi +status=$((status + ret)) + + +# Test 9 - acl disallowed, query refused +n=$((n + 1)) +copy_setports ns2/named09.conf.in ns2/named.conf +rndc_reload ns2 10.53.0.2 + +echo_i "test $n: acl disallowed - query refused" +ret=0 +$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1 +grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1 +grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1 +grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1 +if [ $ret != 0 ]; then echo_i "failed"; fi +status=$((status + ret)) + +# Test 10 - key allowed, query allowed +n=$((n + 1)) +copy_setports ns2/named10.conf.in ns2/named.conf +rndc_reload ns2 10.53.0.2 + +echo_i "test $n: key allowed - query allowed" +ret=0 +$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1 +grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1 +grep '^a.normal.example' dig.out.ns2.$n > /dev/null || ret=1 +if [ $ret != 0 ]; then echo_i "failed"; fi +status=$((status + ret)) + +# Test 11 - key not allowed, query refused +n=$((n + 1)) +copy_setports ns2/named11.conf.in ns2/named.conf +rndc_reload ns2 10.53.0.2 + +echo_i "test $n: key not allowed - query refused" +ret=0 +$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y two:1234efgh8765 a.normal.example a > dig.out.ns2.$n || ret=1 +grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1 +grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1 +grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1 +if [ $ret != 0 ]; then echo_i "failed"; fi +status=$((status + ret)) + +# Test 12 - key disallowed, query refused +n=$((n + 1)) +copy_setports ns2/named12.conf.in ns2/named.conf +rndc_reload ns2 10.53.0.2 + +echo_i "test $n: key disallowed - query refused" +ret=0 +$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1 +grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1 +grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1 +grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1 +if [ $ret != 0 ]; then echo_i "failed"; fi +status=$((status + ret)) + +# The next set of tests check if allow-query works in a view + +n=20 +# Test 21 - views default, query allowed +n=$((n + 1)) +copy_setports ns2/named21.conf.in ns2/named.conf +rndc_reload ns2 10.53.0.2 + +echo_i "test $n: views default - query allowed" +ret=0 +$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1 +grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1 +grep '^a.normal.example' dig.out.ns2.$n > /dev/null || ret=1 +if [ $ret != 0 ]; then echo_i "failed"; fi +status=$((status + ret)) + +# Test 22 - views explicit any, query allowed +n=$((n + 1)) +copy_setports ns2/named22.conf.in ns2/named.conf +rndc_reload ns2 10.53.0.2 + +echo_i "test $n: views explicit any - query allowed" +ret=0 +$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1 +grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1 +grep '^a.normal.example' dig.out.ns2.$n > /dev/null || ret=1 +if [ $ret != 0 ]; then echo_i "failed"; fi +status=$((status + ret)) + +# Test 23 - views none, query refused +n=$((n + 1)) +copy_setports ns2/named23.conf.in ns2/named.conf +rndc_reload ns2 10.53.0.2 + +echo_i "test $n: views none - query refused" +ret=0 +$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1 +grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1 +grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1 +grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1 +if [ $ret != 0 ]; then echo_i "failed"; fi +status=$((status + ret)) + +# Test 24 - views address allowed, query allowed +n=$((n + 1)) +copy_setports ns2/named24.conf.in ns2/named.conf +rndc_reload ns2 10.53.0.2 + +echo_i "test $n: views address allowed - query allowed" +ret=0 +$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1 +grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1 +grep '^a.normal.example' dig.out.ns2.$n > /dev/null || ret=1 +if [ $ret != 0 ]; then echo_i "failed"; fi +status=$((status + ret)) + +# Test 25 - views address not allowed, query refused +n=$((n + 1)) +copy_setports ns2/named25.conf.in ns2/named.conf +rndc_reload ns2 10.53.0.2 + +echo_i "test $n: views address not allowed - query refused" +ret=0 +$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1 +grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1 +grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1 +grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1 +if [ $ret != 0 ]; then echo_i "failed"; fi +status=$((status + ret)) + +# Test 26 - views address disallowed, query refused +n=$((n + 1)) +copy_setports ns2/named26.conf.in ns2/named.conf +rndc_reload ns2 10.53.0.2 + +echo_i "test $n: views address disallowed - query refused" +ret=0 +$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1 +grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1 +grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1 +grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1 +if [ $ret != 0 ]; then echo_i "failed"; fi +status=$((status + ret)) + +# Test 27 - views acl allowed, query allowed +n=$((n + 1)) +copy_setports ns2/named27.conf.in ns2/named.conf +rndc_reload ns2 10.53.0.2 + +echo_i "test $n: views acl allowed - query allowed" +ret=0 +$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1 +grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1 +grep '^a.normal.example' dig.out.ns2.$n > /dev/null || ret=1 +if [ $ret != 0 ]; then echo_i "failed"; fi +status=$((status + ret)) + +# Test 28 - views acl not allowed, query refused +n=$((n + 1)) +copy_setports ns2/named28.conf.in ns2/named.conf +rndc_reload ns2 10.53.0.2 + +echo_i "test $n: views acl not allowed - query refused" +ret=0 +$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1 +grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1 +grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1 +grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1 +if [ $ret != 0 ]; then echo_i "failed"; fi +status=$((status + ret)) + +# Test 29 - views acl disallowed, query refused +n=$((n + 1)) +copy_setports ns2/named29.conf.in ns2/named.conf +rndc_reload ns2 10.53.0.2 + +echo_i "test $n: views acl disallowed - query refused" +ret=0 +$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1 +grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1 +grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1 +grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1 +if [ $ret != 0 ]; then echo_i "failed"; fi +status=$((status + ret)) + +# Test 30 - views key allowed, query allowed +n=$((n + 1)) +copy_setports ns2/named30.conf.in ns2/named.conf +rndc_reload ns2 10.53.0.2 + +echo_i "test $n: views key allowed - query allowed" +ret=0 +$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1 +grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1 +grep '^a.normal.example' dig.out.ns2.$n > /dev/null || ret=1 +if [ $ret != 0 ]; then echo_i "failed"; fi +status=$((status + ret)) + +# Test 31 - views key not allowed, query refused +n=$((n + 1)) +copy_setports ns2/named31.conf.in ns2/named.conf +rndc_reload ns2 10.53.0.2 + +echo_i "test $n: views key not allowed - query refused" +ret=0 +$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y two:1234efgh8765 a.normal.example a > dig.out.ns2.$n || ret=1 +grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1 +grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1 +grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1 +if [ $ret != 0 ]; then echo_i "failed"; fi +status=$((status + ret)) + +# Test 32 - views key disallowed, query refused +n=$((n + 1)) +copy_setports ns2/named32.conf.in ns2/named.conf +rndc_reload ns2 10.53.0.2 + +echo_i "test $n: views key disallowed - query refused" +ret=0 +$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1 +grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1 +grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1 +grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1 +if [ $ret != 0 ]; then echo_i "failed"; fi +status=$((status + ret)) + +# Test 33 - views over options, views allow, query allowed +n=$((n + 1)) +copy_setports ns2/named33.conf.in ns2/named.conf +rndc_reload ns2 10.53.0.2 + +echo_i "test $n: views over options, views allow - query allowed" +ret=0 +$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1 +grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1 +grep '^a.normal.example' dig.out.ns2.$n > /dev/null || ret=1 +if [ $ret != 0 ]; then echo_i "failed"; fi +status=$((status + ret)) + +# Test 34 - views over options, views disallow, query refused +n=$((n + 1)) +copy_setports ns2/named34.conf.in ns2/named.conf +rndc_reload ns2 10.53.0.2 + +echo_i "test $n: views over options, views disallow - query refused" +ret=0 +$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1 +grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1 +grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1 +grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1 +if [ $ret != 0 ]; then echo_i "failed"; fi +status=$((status + ret)) + +# Tests for allow-query in the zone statements + +n=40 + +# Test 41 - zone default, query allowed +n=$((n + 1)) +copy_setports ns2/named40.conf.in ns2/named.conf +rndc_reload ns2 10.53.0.2 + +echo_i "test $n: zone default - query allowed" +ret=0 +$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1 +grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1 +grep '^a.normal.example' dig.out.ns2.$n > /dev/null || ret=1 +if [ $ret != 0 ]; then echo_i "failed"; fi +status=$((status + ret)) + +# Test 42 - zone explicit any, query allowed +n=$((n + 1)) +echo_i "test $n: zone explicit any - query allowed" +ret=0 +$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.any.example a > dig.out.ns2.$n || ret=1 +grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1 +grep '^a.any.example' dig.out.ns2.$n > /dev/null || ret=1 +if [ $ret != 0 ]; then echo_i "failed"; fi +status=$((status + ret)) + +# Test 43 - zone none, query refused +n=$((n + 1)) +echo_i "test $n: zone none - query refused" +ret=0 +$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.none.example a > dig.out.ns2.$n || ret=1 +grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1 +grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1 +grep '^a.none.example' dig.out.ns2.$n > /dev/null && ret=1 +if [ $ret != 0 ]; then echo_i "failed"; fi +status=$((status + ret)) + +# Test 44 - zone address allowed, query allowed +n=$((n + 1)) +echo_i "test $n: zone address allowed - query allowed" +ret=0 +$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.addrallow.example a > dig.out.ns2.$n || ret=1 +grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1 +grep '^a.addrallow.example' dig.out.ns2.$n > /dev/null || ret=1 +if [ $ret != 0 ]; then echo_i "failed"; fi +status=$((status + ret)) + +# Test 45 - zone address not allowed, query refused +n=$((n + 1)) +echo_i "test $n: zone address not allowed - query refused" +ret=0 +$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.addrnotallow.example a > dig.out.ns2.$n || ret=1 +grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1 +grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1 +grep '^a.addrnotallow.example' dig.out.ns2.$n > /dev/null && ret=1 +if [ $ret != 0 ]; then echo_i "failed"; fi +status=$((status + ret)) + +# Test 46 - zone address disallowed, query refused +n=$((n + 1)) +echo_i "test $n: zone address disallowed - query refused" +ret=0 +$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.addrdisallow.example a > dig.out.ns2.$n || ret=1 +grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1 +grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1 +grep '^a.addrdisallow.example' dig.out.ns2.$n > /dev/null && ret=1 +if [ $ret != 0 ]; then echo_i "failed"; fi +status=$((status + ret)) + +# Test 47 - zone acl allowed, query allowed +n=$((n + 1)) +echo_i "test $n: zone acl allowed - query allowed" +ret=0 +$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.aclallow.example a > dig.out.ns2.$n || ret=1 +grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1 +grep '^a.aclallow.example' dig.out.ns2.$n > /dev/null || ret=1 +if [ $ret != 0 ]; then echo_i "failed"; fi +status=$((status + ret)) + +# Test 48 - zone acl not allowed, query refused +n=$((n + 1)) +echo_i "test $n: zone acl not allowed - query refused" +ret=0 +$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.aclnotallow.example a > dig.out.ns2.$n || ret=1 +grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1 +grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1 +grep '^a.aclnotallow.example' dig.out.ns2.$n > /dev/null && ret=1 +if [ $ret != 0 ]; then echo_i "failed"; fi +status=$((status + ret)) + +# Test 49 - zone acl disallowed, query refused +n=$((n + 1)) +echo_i "test $n: zone acl disallowed - query refused" +ret=0 +$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.acldisallow.example a > dig.out.ns2.$n || ret=1 +grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1 +grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1 +grep '^a.acldisallow.example' dig.out.ns2.$n > /dev/null && ret=1 +if [ $ret != 0 ]; then echo_i "failed"; fi +status=$((status + ret)) + +# Test 50 - zone key allowed, query allowed +n=$((n + 1)) +echo_i "test $n: zone key allowed - query allowed" +ret=0 +$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.keyallow.example a > dig.out.ns2.$n || ret=1 +grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1 +grep '^a.keyallow.example' dig.out.ns2.$n > /dev/null || ret=1 +if [ $ret != 0 ]; then echo_i "failed"; fi +status=$((status + ret)) + +# Test 51 - zone key not allowed, query refused +n=$((n + 1)) +echo_i "test $n: zone key not allowed - query refused" +ret=0 +$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y two:1234efgh8765 a.keyallow.example a > dig.out.ns2.$n || ret=1 +grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1 +grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1 +grep '^a.keyallow.example' dig.out.ns2.$n > /dev/null && ret=1 +if [ $ret != 0 ]; then echo_i "failed"; fi +status=$((status + ret)) + +# Test 52 - zone key disallowed, query refused +n=$((n + 1)) +echo_i "test $n: zone key disallowed - query refused" +ret=0 +$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.keydisallow.example a > dig.out.ns2.$n || ret=1 +grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1 +grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1 +grep '^a.keydisallow.example' dig.out.ns2.$n > /dev/null && ret=1 +if [ $ret != 0 ]; then echo_i "failed"; fi +status=$((status + ret)) + +# Test 53 - zones over options, zones allow, query allowed +n=$((n + 1)) +copy_setports ns2/named53.conf.in ns2/named.conf +rndc_reload ns2 10.53.0.2 + +echo_i "test $n: views over options, views allow - query allowed" +ret=0 +$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1 +grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1 +grep '^a.normal.example' dig.out.ns2.$n > /dev/null || ret=1 +if [ $ret != 0 ]; then echo_i "failed"; fi +status=$((status + ret)) + +# Test 54 - zones over options, zones disallow, query refused +n=$((n + 1)) +copy_setports ns2/named54.conf.in ns2/named.conf +rndc_reload ns2 10.53.0.2 + +echo_i "test $n: views over options, views disallow - query refused" +ret=0 +$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1 +grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1 +grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1 +grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1 +if [ $ret != 0 ]; then echo_i "failed"; fi +status=$((status + ret)) + +# Test 55 - zones over views, zones allow, query allowed +n=$((n + 1)) +copy_setports ns2/named55.conf.in ns2/named.conf +rndc_reload ns2 10.53.0.2 + +echo_i "test $n: zones over views, views allow - query allowed" +ret=0 +$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1 +grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1 +grep '^a.normal.example' dig.out.ns2.$n > /dev/null || ret=1 +if [ $ret != 0 ]; then echo_i "failed"; fi +status=$((status + ret)) + +# Test 56 - zones over views, zones disallow, query refused +n=$((n + 1)) +copy_setports ns2/named56.conf.in ns2/named.conf +rndc_reload ns2 10.53.0.2 + +echo_i "test $n: zones over views, views disallow - query refused" +ret=0 +$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.$n || ret=1 +grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1 +grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1 +grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1 +if [ $ret != 0 ]; then echo_i "failed"; fi +status=$((status + ret)) + +# Test 57 - zones over views, zones disallow, query refused (allow-query-on) +n=$((n + 1)) +copy_setports ns2/named57.conf.in ns2/named.conf +rndc_reload ns2 10.53.0.2 + +echo_i "test $n: zones over views, allow-query-on" +ret=0 +$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.normal.example a > dig.out.ns2.1.$n || ret=1 +grep 'status: NOERROR' dig.out.ns2.1.$n > /dev/null || ret=1 +grep '^a.normal.example' dig.out.ns2.1.$n > /dev/null || ret=1 +$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 a.aclnotallow.example a > dig.out.ns2.2.$n || ret=1 +grep 'status: REFUSED' dig.out.ns2.2.$n > /dev/null || ret=1 +grep 'EDE: 18 (Prohibited)' dig.out.ns2.2.$n > /dev/null || ret=1 +grep '^a.aclnotallow.example' dig.out.ns2.2.$n > /dev/null && ret=1 +if [ $ret != 0 ]; then echo_i "failed"; fi +status=$((status + ret)) + +# Test 58 - allow-recursion default +n=$((n + 1)) +echo_i "test $n: default allow-recursion configuration" +ret=0 +nextpart ns3/named.run > /dev/null +$DIG -p ${PORT} @10.53.0.3 -b 127.0.0.1 a.normal.example a > dig.out.ns3.1.$n +grep 'status: NOERROR' dig.out.ns3.1.$n > /dev/null || ret=1 +$DIG -p ${PORT} @10.53.0.3 -b 10.53.0.1 a.normal.example a > dig.out.ns3.2.$n +grep 'status: REFUSED' dig.out.ns3.2.$n > /dev/null || ret=1 +grep 'EDE: 18 (Prohibited)' dig.out.ns3.2.$n > /dev/null || ret=1 +nextpart ns3/named.run | grep 'allow-recursion did not match' > /dev/null || ret=1 +if [ $ret != 0 ]; then echo_i "failed"; fi +status=$((status + ret)) + +# Test 59 - allow-query-cache default +n=$((n + 1)) +echo_i "test $n: default allow-query-cache configuration" +ret=0 +$DIG -p ${PORT} @10.53.0.3 -b 127.0.0.1 ns . > dig.out.ns3.1.$n +grep 'status: NOERROR' dig.out.ns3.1.$n > /dev/null || ret=1 +$DIG -p ${PORT} @10.53.0.3 -b 10.53.0.1 ns . > dig.out.ns3.2.$n +grep 'status: REFUSED' dig.out.ns3.2.$n > /dev/null || ret=1 +grep 'EDE: 18 (Prohibited)' dig.out.ns3.2.$n > /dev/null || ret=1 +nextpart ns3/named.run | grep 'allow-recursion did not match' > /dev/null || ret=1 +if [ $ret != 0 ]; then echo_i "failed"; fi +status=$((status + ret)) + +# Test 60 - block recursion-on, allow query-cache-on +n=$((n + 1)) +copy_setports ns3/named2.conf.in ns3/named.conf +rndc_reload ns3 10.53.0.3 + +echo_i "test $n: block recursion-on, allow query-cache-on" +ret=0 +# this should query the cache, and an answer should already be there +$DIG -p ${PORT} @10.53.0.3 a.normal.example a > dig.out.ns3.1.$n +grep 'recursion requested but not available' dig.out.ns3.1.$n > /dev/null || ret=1 +grep 'ANSWER: 1' dig.out.ns3.1.$n > /dev/null || ret=1 +# this should require recursion and therefore can't get an answer +$DIG -p ${PORT} @10.53.0.3 b.normal.example a > dig.out.ns3.2.$n +grep 'recursion requested but not available' dig.out.ns3.2.$n > /dev/null || ret=1 +grep 'ANSWER: 0' dig.out.ns3.2.$n > /dev/null || ret=1 +nextpart ns3/named.run | grep 'allow-recursion-on did not match' > /dev/null || ret=1 +if [ $ret != 0 ]; then echo_i "failed"; fi +status=$((status + ret)) + +# Test 61 - inheritance of allow-query-cache-on from allow-recursion-on +n=$((n + 1)) +copy_setports ns3/named3.conf.in ns3/named.conf +rndc_reload ns3 10.53.0.3 + +echo_i "test $n: inheritance of allow-query-cache-on" +ret=0 +# this should query the cache, an answer should already be there +$DIG -p ${PORT} @10.53.0.3 a.normal.example a > dig.out.ns3.1.$n +grep 'ANSWER: 1' dig.out.ns3.1.$n > /dev/null || ret=1 +# this should be refused due to allow-recursion-on/allow-query-cache-on +$DIG -p ${PORT} @10.53.1.2 a.normal.example a > dig.out.ns3.2.$n +grep 'recursion requested but not available' dig.out.ns3.2.$n > /dev/null || ret=1 +grep 'status: REFUSED' dig.out.ns3.2.$n > /dev/null || ret=1 +grep 'EDE: 18 (Prohibited)' dig.out.ns3.2.$n > /dev/null || ret=1 +# this should require recursion and should be allowed +$DIG -p ${PORT} @10.53.0.3 c.normal.example a > dig.out.ns3.3.$n +grep 'ANSWER: 1' dig.out.ns3.3.$n > /dev/null || ret=1 +# this should require recursion and be refused +$DIG -p ${PORT} @10.53.1.2 d.normal.example a > dig.out.ns3.4.$n +grep 'recursion requested but not available' dig.out.ns3.4.$n > /dev/null || ret=1 +grep 'status: REFUSED' dig.out.ns3.4.$n > /dev/null || ret=1 +grep 'EDE: 18 (Prohibited)' dig.out.ns3.4.$n > /dev/null || ret=1 +nextpart ns3/named.run | grep 'allow-recursion-on did not match' > /dev/null || ret=1 +if [ $ret != 0 ]; then echo_i "failed"; fi +status=$((status + ret)) + +# Test 62 - inheritance of allow-recursion-on from allow-query-cache-on +n=$((n + 1)) +copy_setports ns3/named4.conf.in ns3/named.conf +rndc_reload ns3 10.53.0.3 + +echo_i "test $n: inheritance of allow-recursion-on" +ret=0 +# this should query the cache, an answer should already be there +$DIG -p ${PORT} @10.53.0.3 a.normal.example a > dig.out.ns3.1.$n +grep 'ANSWER: 1' dig.out.ns3.1.$n > /dev/null || ret=1 +# this should be refused due to allow-recursion-on/allow-query-cache-on +$DIG -p ${PORT} @10.53.1.2 a.normal.example a > dig.out.ns3.2.$n +grep 'recursion requested but not available' dig.out.ns3.2.$n > /dev/null || ret=1 +grep 'status: REFUSED' dig.out.ns3.2.$n > /dev/null || ret=1 +grep 'EDE: 18 (Prohibited)' dig.out.ns3.2.$n > /dev/null || ret=1 +# this should require recursion and should be allowed +$DIG -p ${PORT} @10.53.0.3 e.normal.example a > dig.out.ns3.3.$n +grep 'ANSWER: 1' dig.out.ns3.3.$n > /dev/null || ret=1 +# this should require recursion and be refused +$DIG -p ${PORT} @10.53.1.2 f.normal.example a > dig.out.ns3.4.$n +grep 'recursion requested but not available' dig.out.ns3.4.$n > /dev/null || ret=1 +grep 'status: REFUSED' dig.out.ns3.4.$n > /dev/null || ret=1 +grep 'EDE: 18 (Prohibited)' dig.out.ns3.4.$n > /dev/null || ret=1 +nextpart ns3/named.run | grep 'allow-recursion-on did not match' > /dev/null || ret=1 +if [ $ret != 0 ]; then echo_i "failed"; fi +status=$((status + ret)) + +echo_i "exit status: $status" +[ $status -eq 0 ] || exit 1 diff --git a/bin/tests/system/allow-query/tests_sh_allowquery.py b/bin/tests/system/allow-query/tests_sh_allowquery.py new file mode 100644 index 0000000..ce20d79 --- /dev/null +++ b/bin/tests/system/allow-query/tests_sh_allowquery.py @@ -0,0 +1,14 @@ +# Copyright (C) Internet Systems Consortium, Inc. ("ISC") +# +# SPDX-License-Identifier: MPL-2.0 +# +# This Source Code Form is subject to the terms of the Mozilla Public +# License, v. 2.0. If a copy of the MPL was not distributed with this +# file, you can obtain one at https://mozilla.org/MPL/2.0/. +# +# See the COPYRIGHT file distributed with this work for additional +# information regarding copyright ownership. + + +def test_allowquery(run_tests_sh): + run_tests_sh() |