701e9f3149e79740c42786c5c241a762135318e7Tinderbox User# Copyright (C) 2008, 2012-2014, 2016, 2017 Internet Systems Consortium, Inc. ("ISC")
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews# This Source Code Form is subject to the terms of the Mozilla Public
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews# License, v. 2.0. If a copy of the MPL was not distributed with this
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews# file, You can obtain one at http://mozilla.org/MPL/2.0/.
7ed4399c6598276b76df95e6dc91ed7b2834abc6Evan Hunt# $Id: tests.sh,v 1.4 2008/07/19 00:02:14 each Exp $
1c9f629c181dfd14bb429a6699d22c3c023aa218Mark AndrewsDIGOPTS="+tcp +noadd +nosea +nostat +noquest +nocomm +nocmd"
1c9f629c181dfd14bb429a6699d22c3c023aa218Mark Andrewsecho "I:testing basic ACL processing"
1c9f629c181dfd14bb429a6699d22c3c023aa218Mark Andrews# key "one" should fail
cfe32752a66fe1f050d5ed7ddce75f6d58fe1637Evan Hunt @10.53.0.2 -b 10.53.0.1 axfr -y one:1234abcd8765 -p 5300 > dig.out.${t}
cfe32752a66fe1f050d5ed7ddce75f6d58fe1637Evan Huntgrep "^;" dig.out.${t} > /dev/null 2>&1 || { echo "I:test $t failed" ; status=1; }
1c9f629c181dfd14bb429a6699d22c3c023aa218Mark Andrews# any other key should be fine
cfe32752a66fe1f050d5ed7ddce75f6d58fe1637Evan Hunt @10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 -p 5300 > dig.out.${t}
cfe32752a66fe1f050d5ed7ddce75f6d58fe1637Evan Huntgrep "^;" dig.out.${t} > /dev/null 2>&1 && { echo "I:test $t failed" ; status=1; }
1c9f629c181dfd14bb429a6699d22c3c023aa218Mark Andrews$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 reload 2>&1 | sed 's/^/I:ns2 /'
1c9f629c181dfd14bb429a6699d22c3c023aa218Mark Andrews# prefix 10/8 should fail
cfe32752a66fe1f050d5ed7ddce75f6d58fe1637Evan Hunt @10.53.0.2 -b 10.53.0.1 axfr -y one:1234abcd8765 -p 5300 > dig.out.${t}
cfe32752a66fe1f050d5ed7ddce75f6d58fe1637Evan Huntgrep "^;" dig.out.${t} > /dev/null 2>&1 || { echo "I:test $t failed" ; status=1; }
1c9f629c181dfd14bb429a6699d22c3c023aa218Mark Andrews# any other address should work, as long as it sends key "one"
cfe32752a66fe1f050d5ed7ddce75f6d58fe1637Evan Hunt @10.53.0.2 -b 127.0.0.1 axfr -y two:1234abcd8765 -p 5300 > dig.out.${t}
cfe32752a66fe1f050d5ed7ddce75f6d58fe1637Evan Huntgrep "^;" dig.out.${t} > /dev/null 2>&1 || { echo "I:test $t failed" ; status=1; }
cfe32752a66fe1f050d5ed7ddce75f6d58fe1637Evan Hunt @10.53.0.2 -b 127.0.0.1 axfr -y one:1234abcd8765 -p 5300 > dig.out.${t}
cfe32752a66fe1f050d5ed7ddce75f6d58fe1637Evan Huntgrep "^;" dig.out.${t} > /dev/null 2>&1 && { echo "I:test $t failed" ; status=1; }
1c9f629c181dfd14bb429a6699d22c3c023aa218Mark Andrewsecho "I:testing nested ACL processing"
1c9f629c181dfd14bb429a6699d22c3c023aa218Mark Andrews# all combinations of 10.53.0.{1|2} with key {one|two}, should succeed
1c9f629c181dfd14bb429a6699d22c3c023aa218Mark Andrews$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 reload 2>&1 | sed 's/^/I:ns2 /'
1c9f629c181dfd14bb429a6699d22c3c023aa218Mark Andrews# should succeed
cfe32752a66fe1f050d5ed7ddce75f6d58fe1637Evan Hunt @10.53.0.2 -b 10.53.0.2 axfr -y two:1234abcd8765 -p 5300 > dig.out.${t}
cfe32752a66fe1f050d5ed7ddce75f6d58fe1637Evan Huntgrep "^;" dig.out.${t} > /dev/null 2>&1 && { echo "I:test $t failed" ; status=1; }
1c9f629c181dfd14bb429a6699d22c3c023aa218Mark Andrews# should succeed
cfe32752a66fe1f050d5ed7ddce75f6d58fe1637Evan Hunt @10.53.0.2 -b 10.53.0.2 axfr -y one:1234abcd8765 -p 5300 > dig.out.${t}
cfe32752a66fe1f050d5ed7ddce75f6d58fe1637Evan Huntgrep "^;" dig.out.${t} > /dev/null 2>&1 && { echo "I:test $t failed" ; status=1; }
1c9f629c181dfd14bb429a6699d22c3c023aa218Mark Andrews# should succeed
cfe32752a66fe1f050d5ed7ddce75f6d58fe1637Evan Hunt @10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 -p 5300 > dig.out.${t}
cfe32752a66fe1f050d5ed7ddce75f6d58fe1637Evan Huntgrep "^;" dig.out.${t} > /dev/null 2>&1 && { echo "I:test $t failed" ; status=1; }
1c9f629c181dfd14bb429a6699d22c3c023aa218Mark Andrews# should succeed
cfe32752a66fe1f050d5ed7ddce75f6d58fe1637Evan Hunt @10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 -p 5300 > dig.out.${t}
cfe32752a66fe1f050d5ed7ddce75f6d58fe1637Evan Huntgrep "^;" dig.out.${t} > /dev/null 2>&1 && { echo "I:test $t failed" ; status=1; }
1c9f629c181dfd14bb429a6699d22c3c023aa218Mark Andrews# but only one or the other should fail
cfe32752a66fe1f050d5ed7ddce75f6d58fe1637Evan Hunt @10.53.0.2 -b 127.0.0.1 axfr -y one:1234abcd8765 -p 5300 > dig.out.${t}
cfe32752a66fe1f050d5ed7ddce75f6d58fe1637Evan Huntgrep "^;" dig.out.${t} > /dev/null 2>&1 || { echo "I:test $t failed" ; status=1; }
cfe32752a66fe1f050d5ed7ddce75f6d58fe1637Evan Hunt @10.53.0.2 -b 10.53.0.2 axfr -p 5300 > dig.out.${t}
cfe32752a66fe1f050d5ed7ddce75f6d58fe1637Evan Huntgrep "^;" dig.out.${t} > /dev/null 2>&1 || { echo "I:test $tt failed" ; status=1; }
1c9f629c181dfd14bb429a6699d22c3c023aa218Mark Andrews# and other values? right out
cfe32752a66fe1f050d5ed7ddce75f6d58fe1637Evan Hunt @10.53.0.2 -b 127.0.0.1 axfr -y three:1234abcd8765 -p 5300 > dig.out.${t}
cfe32752a66fe1f050d5ed7ddce75f6d58fe1637Evan Huntgrep "^;" dig.out.${t} > /dev/null 2>&1 || { echo "I:test $t failed" ; status=1; }
1c9f629c181dfd14bb429a6699d22c3c023aa218Mark Andrews# now we only allow 10.53.0.1 *and* key one, or 10.53.0.2 *and* key two
1c9f629c181dfd14bb429a6699d22c3c023aa218Mark Andrews$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 reload 2>&1 | sed 's/^/I:ns2 /'
1c9f629c181dfd14bb429a6699d22c3c023aa218Mark Andrews# should succeed
cfe32752a66fe1f050d5ed7ddce75f6d58fe1637Evan Hunt @10.53.0.2 -b 10.53.0.2 axfr -y two:1234abcd8765 -p 5300 > dig.out.${t}
cfe32752a66fe1f050d5ed7ddce75f6d58fe1637Evan Huntgrep "^;" dig.out.${t} > /dev/null 2>&1 && { echo "I:test $t failed" ; status=1; }
1c9f629c181dfd14bb429a6699d22c3c023aa218Mark Andrews# should succeed
cfe32752a66fe1f050d5ed7ddce75f6d58fe1637Evan Hunt @10.53.0.2 -b 10.53.0.1 axfr -y one:1234abcd8765 -p 5300 > dig.out.${t}
cfe32752a66fe1f050d5ed7ddce75f6d58fe1637Evan Huntgrep "^;" dig.out.${t} > /dev/null 2>&1 && { echo "I:test $t failed" ; status=1; }
1c9f629c181dfd14bb429a6699d22c3c023aa218Mark Andrews# should fail
cfe32752a66fe1f050d5ed7ddce75f6d58fe1637Evan Hunt @10.53.0.2 -b 10.53.0.2 axfr -y one:1234abcd8765 -p 5300 > dig.out.${t}
cfe32752a66fe1f050d5ed7ddce75f6d58fe1637Evan Huntgrep "^;" dig.out.${t} > /dev/null 2>&1 || { echo "I:test $t failed" ; status=1; }
1c9f629c181dfd14bb429a6699d22c3c023aa218Mark Andrews# should fail
cfe32752a66fe1f050d5ed7ddce75f6d58fe1637Evan Hunt @10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 -p 5300 > dig.out.${t}
cfe32752a66fe1f050d5ed7ddce75f6d58fe1637Evan Huntgrep "^;" dig.out.${t} > /dev/null 2>&1 || { echo "I:test $t failed" ; status=1; }
1c9f629c181dfd14bb429a6699d22c3c023aa218Mark Andrews# should fail
cfe32752a66fe1f050d5ed7ddce75f6d58fe1637Evan Hunt @10.53.0.2 -b 10.53.0.3 axfr -y one:1234abcd8765 -p 5300 > dig.out.${t}
cfe32752a66fe1f050d5ed7ddce75f6d58fe1637Evan Huntgrep "^;" dig.out.${t} > /dev/null 2>&1 || { echo "I:test $t failed" ; status=1; }
997c2c5116927bab77284c24c3bd0d7f646da5eeMark Andrewsecho "I:testing allow-query-on ACL processing"
997c2c5116927bab77284c24c3bd0d7f646da5eeMark Andrews$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 reload 2>&1 | sed 's/^/I:ns2 /'
cfe32752a66fe1f050d5ed7ddce75f6d58fe1637Evan Huntgrep "status: NOERROR" dig.out.${t} > /dev/null 2>&1 || { echo "I:test $t failed" ; status=1; }
d46855caedd5cb101795707f6f467fa363ef1448Evan Huntecho "I:testing EDNS client-subnet ACL processing"
d46855caedd5cb101795707f6f467fa363ef1448Evan Hunt$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 reload 2>&1 | sed 's/^/I:ns2 /'
d46855caedd5cb101795707f6f467fa363ef1448Evan Hunt# should fail
d46855caedd5cb101795707f6f467fa363ef1448Evan Hunt @10.53.0.2 -b 10.53.0.2 axfr -p 5300 > dig.out.${t}
d46855caedd5cb101795707f6f467fa363ef1448Evan Huntgrep "^;" dig.out.${t} > /dev/null 2>&1 || { echo "I:test $t failed" ; status=1; }
d46855caedd5cb101795707f6f467fa363ef1448Evan Hunt# should succeed
d46855caedd5cb101795707f6f467fa363ef1448Evan Hunt @10.53.0.2 -b 10.53.0.2 +subnet="10.53.0/24" axfr -p 5300 > dig.out.${t}
d46855caedd5cb101795707f6f467fa363ef1448Evan Huntgrep "^;" dig.out.${t} > /dev/null 2>&1 && { echo "I:test $t failed" ; status=1; }
d46855caedd5cb101795707f6f467fa363ef1448Evan Huntecho "I:testing EDNS client-subnet response scope"
d46855caedd5cb101795707f6f467fa363ef1448Evan Hunt$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 reload 2>&1 | sed 's/^/I:ns2 /'
d46855caedd5cb101795707f6f467fa363ef1448Evan Hunt$DIG example. soa @10.53.0.2 +subnet="10.53.0.1/32" -p 5300 > dig.out.${t}
d46855caedd5cb101795707f6f467fa363ef1448Evan Huntgrep "CLIENT-SUBNET.*10.53.0.1/32/0" dig.out.${t} > /dev/null || { echo "I:test $t failed" ; status=1; }
d46855caedd5cb101795707f6f467fa363ef1448Evan Hunt$DIG example. soa @10.53.0.2 +subnet="192.0.2.128/32" -p 5300 > dig.out.${t}
d46855caedd5cb101795707f6f467fa363ef1448Evan Huntgrep "CLIENT-SUBNET.*192.0.2.128/32/24" dig.out.${t} > /dev/null || { echo "I:test $t failed" ; status=1; }
f53e0bda467d96dfeeba1b4da30c37b37766bb75Evan Hunt# AXFR tests against ns3
f53e0bda467d96dfeeba1b4da30c37b37766bb75Evan Huntecho "I:testing allow-transfer ACLs against ns3 (no existing zones)"
f53e0bda467d96dfeeba1b4da30c37b37766bb75Evan Huntecho "I:calling addzone example.com on ns3"
f53e0bda467d96dfeeba1b4da30c37b37766bb75Evan Hunt$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p 9953 addzone 'example.com {type master; file "example.db"; }; '
f53e0bda467d96dfeeba1b4da30c37b37766bb75Evan Huntecho "I:checking AXFR of example.com from ns3 with ACL allow-transfer { none; }; (${t})"
f53e0bda467d96dfeeba1b4da30c37b37766bb75Evan Hunt$DIG @10.53.0.3 -p 5300 example.com axfr > dig.out.${t} 2>&1
f53e0bda467d96dfeeba1b4da30c37b37766bb75Evan Huntgrep "Transfer failed." dig.out.${t} >/dev/null 2>&1 || ret=1
f53e0bda467d96dfeeba1b4da30c37b37766bb75Evan Huntecho "I:calling rndc reconfig"
f53e0bda467d96dfeeba1b4da30c37b37766bb75Evan Hunt$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p 9953 reconfig
f53e0bda467d96dfeeba1b4da30c37b37766bb75Evan Huntecho "I:re-checking AXFR of example.com from ns3 with ACL allow-transfer { none; }; (${t})"
f53e0bda467d96dfeeba1b4da30c37b37766bb75Evan Hunt$DIG @10.53.0.3 -p 5300 example.com axfr > dig.out.${t} 2>&1
f53e0bda467d96dfeeba1b4da30c37b37766bb75Evan Huntgrep "Transfer failed." dig.out.${t} >/dev/null 2>&1 || ret=1
f53e0bda467d96dfeeba1b4da30c37b37766bb75Evan Hunt# AXFR tests against ns4
f53e0bda467d96dfeeba1b4da30c37b37766bb75Evan Huntecho "I:testing allow-transfer ACLs against ns4 (1 pre-existing zone)"
f53e0bda467d96dfeeba1b4da30c37b37766bb75Evan Huntecho "I:calling addzone example.com on ns4"
f53e0bda467d96dfeeba1b4da30c37b37766bb75Evan Hunt$RNDC -c ../common/rndc.conf -s 10.53.0.4 -p 9953 addzone 'example.com {type master; file "example.db"; }; '
f53e0bda467d96dfeeba1b4da30c37b37766bb75Evan Huntecho "I:checking AXFR of example.com from ns4 with ACL allow-transfer { none; }; (${t})"
f53e0bda467d96dfeeba1b4da30c37b37766bb75Evan Hunt$DIG @10.53.0.4 -p 5300 example.com axfr > dig.out.${t} 2>&1
f53e0bda467d96dfeeba1b4da30c37b37766bb75Evan Huntgrep "Transfer failed." dig.out.${t} >/dev/null 2>&1 || ret=1
f53e0bda467d96dfeeba1b4da30c37b37766bb75Evan Huntecho "I:calling rndc reconfig"
f53e0bda467d96dfeeba1b4da30c37b37766bb75Evan Hunt$RNDC -c ../common/rndc.conf -s 10.53.0.4 -p 9953 reconfig
f53e0bda467d96dfeeba1b4da30c37b37766bb75Evan Huntecho "I:re-checking AXFR of example.com from ns4 with ACL allow-transfer { none; }; (${t})"
f53e0bda467d96dfeeba1b4da30c37b37766bb75Evan Hunt$DIG @10.53.0.4 -p 5300 example.com axfr > dig.out.${t} 2>&1
f53e0bda467d96dfeeba1b4da30c37b37766bb75Evan Huntgrep "Transfer failed." dig.out.${t} >/dev/null 2>&1 || ret=1
1c9f629c181dfd14bb429a6699d22c3c023aa218Mark Andrewsecho "I:exit status: $status"