1#!/bin/sh 2 3# Copyright (C) Internet Systems Consortium, Inc. ("ISC") 4# 5# SPDX-License-Identifier: MPL-2.0 6# 7# This Source Code Form is subject to the terms of the Mozilla Public 8# License, v. 2.0. If a copy of the MPL was not distributed with this 9# file, you can obtain one at https://mozilla.org/MPL/2.0/. 10# 11# See the COPYRIGHT file distributed with this work for additional 12# information regarding copyright ownership. 13 14SYSTEMTESTTOP=.. 15. $SYSTEMTESTTOP/conf.sh 16 17DIGOPTS="+tcp +noadd +nosea +nostat +noquest +nocomm +nocmd -p ${PORT}" 18RNDCCMD="$RNDC -c $SYSTEMTESTTOP/common/rndc.conf -p ${CONTROLPORT} -s" 19 20status=0 21t=0 22 23echo_i "testing basic ACL processing" 24# key "one" should fail 25t=`expr $t + 1` 26$DIG $DIGOPTS tsigzone. \ 27 @10.53.0.2 -b 10.53.0.1 axfr -y one:1234abcd8765 > dig.out.${t} 28grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; } 29 30 31# any other key should be fine 32t=`expr $t + 1` 33$DIG $DIGOPTS tsigzone. \ 34 @10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 > dig.out.${t} 35grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; } 36 37copy_setports ns2/named2.conf.in ns2/named.conf 38rndc_reload ns2 10.53.0.2 39sleep 5 40 41# prefix 10/8 should fail 42t=`expr $t + 1` 43$DIG $DIGOPTS tsigzone. \ 44 @10.53.0.2 -b 10.53.0.1 axfr -y one:1234abcd8765 > dig.out.${t} 45grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; } 46 47# any other address should work, as long as it sends key "one" 48t=`expr $t + 1` 49$DIG $DIGOPTS tsigzone. \ 50 @10.53.0.2 -b 127.0.0.1 axfr -y two:1234abcd8765 > dig.out.${t} 51grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; } 52 53t=`expr $t + 1` 54$DIG $DIGOPTS tsigzone. \ 55 @10.53.0.2 -b 127.0.0.1 axfr -y one:1234abcd8765 > dig.out.${t} 56grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; } 57 58echo_i "testing nested ACL processing" 59# all combinations of 10.53.0.{1|2} with key {one|two}, should succeed 60copy_setports ns2/named3.conf.in ns2/named.conf 61rndc_reload ns2 10.53.0.2 62sleep 5 63 64# should succeed 65t=`expr $t + 1` 66$DIG $DIGOPTS tsigzone. \ 67 @10.53.0.2 -b 10.53.0.2 axfr -y two:1234abcd8765 > dig.out.${t} 68grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; } 69 70# should succeed 71t=`expr $t + 1` 72$DIG $DIGOPTS tsigzone. \ 73 @10.53.0.2 -b 10.53.0.2 axfr -y one:1234abcd8765 > dig.out.${t} 74grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; } 75 76# should succeed 77t=`expr $t + 1` 78$DIG $DIGOPTS tsigzone. \ 79 @10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 > dig.out.${t} 80grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; } 81 82# should succeed 83t=`expr $t + 1` 84$DIG $DIGOPTS tsigzone. \ 85 @10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 > dig.out.${t} 86grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; } 87 88# but only one or the other should fail 89t=`expr $t + 1` 90$DIG $DIGOPTS tsigzone. \ 91 @10.53.0.2 -b 127.0.0.1 axfr -y one:1234abcd8765 > dig.out.${t} 92grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; } 93 94t=`expr $t + 1` 95$DIG $DIGOPTS tsigzone. \ 96 @10.53.0.2 -b 10.53.0.2 axfr > dig.out.${t} 97grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $tt failed" ; status=1; } 98 99# and other values? right out 100t=`expr $t + 1` 101$DIG $DIGOPTS tsigzone. \ 102 @10.53.0.2 -b 127.0.0.1 axfr -y "${DEFAULT_HMAC}:three:1234abcd8765" > dig.out.${t} 103grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; } 104 105# now we only allow 10.53.0.1 *and* key one, or 10.53.0.2 *and* key two 106copy_setports ns2/named4.conf.in ns2/named.conf 107rndc_reload ns2 10.53.0.2 108sleep 5 109 110# should succeed 111t=`expr $t + 1` 112$DIG $DIGOPTS tsigzone. \ 113 @10.53.0.2 -b 10.53.0.2 axfr -y two:1234abcd8765 > dig.out.${t} 114grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; } 115 116# should succeed 117t=`expr $t + 1` 118$DIG $DIGOPTS tsigzone. \ 119 @10.53.0.2 -b 10.53.0.1 axfr -y one:1234abcd8765 > dig.out.${t} 120grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; } 121 122# should fail 123t=`expr $t + 1` 124$DIG $DIGOPTS tsigzone. \ 125 @10.53.0.2 -b 10.53.0.2 axfr -y one:1234abcd8765 > dig.out.${t} 126grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; } 127 128# should fail 129t=`expr $t + 1` 130$DIG $DIGOPTS tsigzone. \ 131 @10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 > dig.out.${t} 132grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; } 133 134# should fail 135t=`expr $t + 1` 136$DIG $DIGOPTS tsigzone. \ 137 @10.53.0.2 -b 10.53.0.3 axfr -y one:1234abcd8765 > dig.out.${t} 138grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; } 139 140echo_i "testing allow-query-on ACL processing" 141copy_setports ns2/named5.conf.in ns2/named.conf 142rndc_reload ns2 10.53.0.2 143sleep 5 144t=`expr $t + 1` 145$DIG -p ${PORT} +tcp soa example. \ 146 @10.53.0.2 -b 10.53.0.3 > dig.out.${t} 147grep "status: NOERROR" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; } 148 149echo_i "testing blackhole ACL processing" 150t=`expr $t + 1` 151ret=0 152$DIG -p ${PORT} +tcp soa example. \ 153 @10.53.0.2 -b 10.53.0.3 > dig.out.1.${t} 154grep "status: NOERROR" dig.out.1.${t} > /dev/null 2>&1 || ret=1 155$DIG -p ${PORT} +tcp soa example. \ 156 @10.53.0.2 -b 10.53.0.8 > dig.out.2.${t} 157grep "status: NOERROR" dig.out.2.${t} > /dev/null 2>&1 && ret=1 158grep "communications error" dig.out.2.${t} > /dev/null 2>&1 || ret=1 159$DIG -p ${PORT} soa example. \ 160 @10.53.0.2 -b 10.53.0.3 > dig.out.3.${t} 161grep "status: NOERROR" dig.out.3.${t} > /dev/null 2>&1 || ret=1 162$DIG -p ${PORT} soa example. \ 163 @10.53.0.2 -b 10.53.0.8 > dig.out.4.${t} 164grep "status: NOERROR" dig.out.4.${t} > /dev/null 2>&1 && ret=1 165grep "connection timed out" dig.out.4.${t} > /dev/null 2>&1 || ret=1 166[ $ret -eq 0 ] || echo_i "failed" 167status=`expr $status + $ret` 168 169# AXFR tests against ns3 170 171echo_i "testing allow-transfer ACLs against ns3 (no existing zones)" 172 173echo_i "calling addzone example.com on ns3" 174$RNDCCMD 10.53.0.3 addzone 'example.com {type primary; file "example.db"; }; ' 175sleep 1 176 177t=`expr $t + 1` 178ret=0 179echo_i "checking AXFR of example.com from ns3 with ACL allow-transfer { none; }; (${t})" 180$DIG -p ${PORT} @10.53.0.3 example.com axfr > dig.out.${t} 2>&1 181grep "Transfer failed." dig.out.${t} >/dev/null 2>&1 || ret=1 182[ $ret -eq 0 ] || echo_i "failed" 183status=`expr $status + $ret` 184 185echo_i "calling rndc reconfig" 186rndc_reconfig ns3 10.53.0.3 187 188sleep 1 189 190t=`expr $t + 1` 191ret=0 192echo_i "re-checking AXFR of example.com from ns3 with ACL allow-transfer { none; }; (${t})" 193$DIG -p ${PORT} @10.53.0.3 example.com axfr > dig.out.${t} 2>&1 194grep "Transfer failed." dig.out.${t} >/dev/null 2>&1 || ret=1 195[ $ret -eq 0 ] || echo_i "failed" 196status=`expr $status + $ret` 197 198# AXFR tests against ns4 199 200echo_i "testing allow-transfer ACLs against ns4 (1 pre-existing zone)" 201 202echo_i "calling addzone example.com on ns4" 203$RNDCCMD 10.53.0.4 addzone 'example.com {type primary; file "example.db"; }; ' 204sleep 1 205 206t=`expr $t + 1` 207ret=0 208echo_i "checking AXFR of example.com from ns4 with ACL allow-transfer { none; }; (${t})" 209$DIG -p ${PORT} @10.53.0.4 example.com axfr > dig.out.${t} 2>&1 210grep "Transfer failed." dig.out.${t} >/dev/null 2>&1 || ret=1 211[ $ret -eq 0 ] || echo_i "failed" 212status=`expr $status + $ret` 213 214echo_i "calling rndc reconfig" 215rndc_reconfig ns4 10.53.0.4 216 217sleep 1 218 219t=`expr $t + 1` 220ret=0 221echo_i "re-checking AXFR of example.com from ns4 with ACL allow-transfer { none; }; (${t})" 222$DIG -p ${PORT} @10.53.0.4 example.com axfr > dig.out.${t} 2>&1 223grep "Transfer failed." dig.out.${t} >/dev/null 2>&1 || ret=1 224[ $ret -eq 0 ] || echo_i "failed" 225status=`expr $status + $ret` 226 227echo_i "exit status: $status" 228[ $status -eq 0 ] || exit 1 229