#
# Copyright (C) 2008, 2012-2014, 2016, 2017 Internet Systems Consortium, Inc. ("ISC")
#
# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, You can obtain one at http://mozilla.org/MPL/2.0/.
# $Id: tests.sh,v 1.4 2008/07/19 00:02:14 each Exp $
DIGOPTS="+tcp +noadd +nosea +nostat +noquest +nocomm +nocmd"
status=0
t=0
echo "I:testing basic ACL processing"
# key "one" should fail
t=`expr $t + 1`
# any other key should be fine
t=`expr $t + 1`
sleep 5
# prefix 10/8 should fail
t=`expr $t + 1`
# any other address should work, as long as it sends key "one"
t=`expr $t + 1`
t=`expr $t + 1`
echo "I:testing nested ACL processing"
# all combinations of 10.53.0.{1|2} with key {one|two}, should succeed
sleep 5
# should succeed
t=`expr $t + 1`
# should succeed
t=`expr $t + 1`
# should succeed
t=`expr $t + 1`
# should succeed
t=`expr $t + 1`
# but only one or the other should fail
t=`expr $t + 1`
t=`expr $t + 1`
# and other values? right out
t=`expr $t + 1`
# now we only allow 10.53.0.1 *and* key one, or 10.53.0.2 *and* key two
sleep 5
# should succeed
t=`expr $t + 1`
# should succeed
t=`expr $t + 1`
# should fail
t=`expr $t + 1`
# should fail
t=`expr $t + 1`
# should fail
t=`expr $t + 1`
echo "I:testing allow-query-on ACL processing"
sleep 5
t=`expr $t + 1`
echo "I:testing EDNS client-subnet ACL processing"
sleep 5
# should fail
t=`expr $t + 1`
# should succeed
t=`expr $t + 1`
echo "I:testing EDNS client-subnet response scope"
sleep 5
t=`expr $t + 1`
grep "CLIENT-SUBNET.*10.53.0.1/32/0" dig.out.${t} > /dev/null || { echo "I:test $t failed" ; status=1; }
t=`expr $t + 1`
grep "CLIENT-SUBNET.*192.0.2.128/32/24" dig.out.${t} > /dev/null || { echo "I:test $t failed" ; status=1; }
# AXFR tests against ns3
echo "I:testing allow-transfer ACLs against ns3 (no existing zones)"
echo "I:calling addzone example.com on ns3"
$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p 9953 addzone 'example.com {type master; file "example.db"; }; '
sleep 1
t=`expr $t + 1`
ret=0
echo "I:checking AXFR of example.com from ns3 with ACL allow-transfer { none; }; (${t})"
echo "I:calling rndc reconfig"
sleep 1
t=`expr $t + 1`
ret=0
echo "I:re-checking AXFR of example.com from ns3 with ACL allow-transfer { none; }; (${t})"
# AXFR tests against ns4
echo "I:testing allow-transfer ACLs against ns4 (1 pre-existing zone)"
echo "I:calling addzone example.com on ns4"
$RNDC -c ../common/rndc.conf -s 10.53.0.4 -p 9953 addzone 'example.com {type master; file "example.db"; }; '
sleep 1
t=`expr $t + 1`
ret=0
echo "I:checking AXFR of example.com from ns4 with ACL allow-transfer { none; }; (${t})"
echo "I:calling rndc reconfig"
sleep 1
t=`expr $t + 1`
ret=0
echo "I:re-checking AXFR of example.com from ns4 with ACL allow-transfer { none; }; (${t})"
echo "I:exit status: $status"