tests.sh revision 0c27b3fe77ac1d5094ba3521e8142d9e7973133f
#
# Copyright (C) 2010, 2012, 2013, 2016 Internet Systems Consortium, Inc. ("ISC")
#
# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, You can obtain one at http://mozilla.org/MPL/2.0/.
# $Id: tests.sh,v 1.3 2010/12/02 23:22:41 marka Exp $
# Test of allow-query statement.
# allow-query takes an address match list and can be included in either the
# options statement or in the zone statement. This test assumes that the
# acl tests cover the details of the address match list and uses a limited
# number of address match test cases to ensure that allow-query finds the
# expected match.
# Test list:
# In options:
# default (any), any, none, [localhost, localnets],
# allowed address, not allowed address, denied address,
# allowed key, not allowed key, denied key
# allowed acl, not allowed acl, denied acl (acls pointing to addresses)
#
# Each of these tests requires changing to a new configuration
# file and using rndc to update the server
#
# In view, with nothing in options (default to any)
# default (any), any, none, [localhost, localnets],
# allowed address, not allowed address, denied address,
# allowed key, not allowed key, denied key
# allowed acl, not allowed acl, denied acl (acls pointing to addresses)
#
# In view, with options set to none, view set to any
# In view, with options set to any, view set to none
#
# In zone, with nothing in options (default to any)
# any, none, [localhost, localnets],
# allowed address, denied address,
# allowed key, not allowed key, denied key
# allowed acl, not allowed acl, denied acl (acls pointing to addresses),
#
# In zone, with options set to none, zone set to any
# In zone, with options set to any, zone set to none
# In zone, with view set to none, zone set to any
# In zone, with view set to any, zone set to none
#
# zone types of master, slave and stub can be tested in parallel by using
# multiple instances (ns2 as master, ns3 as slave, ns4 as stub) and querying
# as necessary.
#
DIGOPTS="+tcp +nosea +nostat +nocmd +norec +noques +noauth +noadd +nostats +dnssec -p 5300"
status=0
n=0
# Test 1 - default, query allowed
n=`expr $n + 1`
echo "I:test $n: default - query allowed"
ret=0
# Test 2 - explicit any, query allowed
n=`expr $n + 1`
sleep 5
echo "I:test $n: explicit any - query allowed"
ret=0
# Test 3 - none, query refused
n=`expr $n + 1`
sleep 5
echo "I:test $n: none - query refused"
ret=0
# Test 4 - address allowed, query allowed
n=`expr $n + 1`
sleep 5
echo "I:test $n: address allowed - query allowed"
ret=0
# Test 5 - address not allowed, query refused
n=`expr $n + 1`
sleep 5
echo "I:test $n: address not allowed - query refused"
ret=0
# Test 6 - address disallowed, query refused
n=`expr $n + 1`
sleep 5
echo "I:test $n: address disallowed - query refused"
ret=0
# Test 7 - acl allowed, query allowed
n=`expr $n + 1`
sleep 5
echo "I:test $n: acl allowed - query allowed"
ret=0
# Test 8 - acl not allowed, query refused
n=`expr $n + 1`
sleep 5
echo "I:test $n: acl not allowed - query refused"
ret=0
# Test 9 - acl disallowed, query refused
n=`expr $n + 1`
sleep 5
echo "I:test $n: acl disallowed - query refused"
ret=0
# Test 10 - key allowed, query allowed
n=`expr $n + 1`
sleep 5
echo "I:test $n: key allowed - query allowed"
ret=0
$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1
# Test 11 - key not allowed, query refused
n=`expr $n + 1`
sleep 5
echo "I:test $n: key not allowed - query refused"
ret=0
$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y two:1234efgh8765 a.normal.example a > dig.out.ns2.$n || ret=1
# Test 12 - key disallowed, query refused
n=`expr $n + 1`
sleep 5
echo "I:test $n: key disallowed - query refused"
ret=0
$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1
# The next set of tests check if allow-query works in a view
n=20
# Test 21 - views default, query allowed
n=`expr $n + 1`
sleep 5
echo "I:test $n: views default - query allowed"
ret=0
# Test 22 - views explicit any, query allowed
n=`expr $n + 1`
sleep 5
echo "I:test $n: views explicit any - query allowed"
ret=0
# Test 23 - views none, query refused
n=`expr $n + 1`
sleep 5
echo "I:test $n: views none - query refused"
ret=0
# Test 24 - views address allowed, query allowed
n=`expr $n + 1`
sleep 5
echo "I:test $n: views address allowed - query allowed"
ret=0
# Test 25 - views address not allowed, query refused
n=`expr $n + 1`
sleep 5
echo "I:test $n: views address not allowed - query refused"
ret=0
# Test 26 - views address disallowed, query refused
n=`expr $n + 1`
sleep 5
echo "I:test $n: views address disallowed - query refused"
ret=0
# Test 27 - views acl allowed, query allowed
n=`expr $n + 1`
sleep 5
echo "I:test $n: views acl allowed - query allowed"
ret=0
# Test 28 - views acl not allowed, query refused
n=`expr $n + 1`
sleep 5
echo "I:test $n: views acl not allowed - query refused"
ret=0
# Test 29 - views acl disallowed, query refused
n=`expr $n + 1`
sleep 5
echo "I:test $n: views acl disallowed - query refused"
ret=0
# Test 30 - views key allowed, query allowed
n=`expr $n + 1`
sleep 5
echo "I:test $n: views key allowed - query allowed"
ret=0
$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1
# Test 31 - views key not allowed, query refused
n=`expr $n + 1`
sleep 5
echo "I:test $n: views key not allowed - query refused"
ret=0
$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y two:1234efgh8765 a.normal.example a > dig.out.ns2.$n || ret=1
# Test 32 - views key disallowed, query refused
n=`expr $n + 1`
sleep 5
echo "I:test $n: views key disallowed - query refused"
ret=0
$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1
# Test 33 - views over options, views allow, query allowed
n=`expr $n + 1`
sleep 5
echo "I:test $n: views over options, views allow - query allowed"
ret=0
# Test 34 - views over options, views disallow, query refused
n=`expr $n + 1`
sleep 5
echo "I:test $n: views over options, views disallow - query refused"
ret=0
# Tests for allow-query in the zone statements
n=40
# Test 41 - zone default, query allowed
n=`expr $n + 1`
sleep 5
echo "I:test $n: zone default - query allowed"
ret=0
# Test 42 - zone explicit any, query allowed
n=`expr $n + 1`
echo "I:test $n: zone explicit any - query allowed"
ret=0
# Test 43 - zone none, query refused
n=`expr $n + 1`
echo "I:test $n: zone none - query refused"
ret=0
# Test 44 - zone address allowed, query allowed
n=`expr $n + 1`
echo "I:test $n: zone address allowed - query allowed"
ret=0
# Test 45 - zone address not allowed, query refused
n=`expr $n + 1`
echo "I:test $n: zone address not allowed - query refused"
ret=0
# Test 46 - zone address disallowed, query refused
n=`expr $n + 1`
echo "I:test $n: zone address disallowed - query refused"
ret=0
# Test 47 - zone acl allowed, query allowed
n=`expr $n + 1`
echo "I:test $n: zone acl allowed - query allowed"
ret=0
# Test 48 - zone acl not allowed, query refused
n=`expr $n + 1`
echo "I:test $n: zone acl not allowed - query refused"
ret=0
# Test 49 - zone acl disallowed, query refused
n=`expr $n + 1`
echo "I:test $n: zone acl disallowed - query refused"
ret=0
# Test 50 - zone key allowed, query allowed
n=`expr $n + 1`
echo "I:test $n: zone key allowed - query allowed"
ret=0
$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.keyallow.example a > dig.out.ns2.$n || ret=1
# Test 51 - zone key not allowed, query refused
n=`expr $n + 1`
echo "I:test $n: zone key not allowed - query refused"
ret=0
$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y two:1234efgh8765 a.keyallow.example a > dig.out.ns2.$n || ret=1
# Test 52 - zone key disallowed, query refused
n=`expr $n + 1`
echo "I:test $n: zone key disallowed - query refused"
ret=0
$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.keydisallow.example a > dig.out.ns2.$n || ret=1
# Test 53 - zones over options, zones allow, query allowed
n=`expr $n + 1`
sleep 5
echo "I:test $n: views over options, views allow - query allowed"
ret=0
# Test 54 - zones over options, zones disallow, query refused
n=`expr $n + 1`
sleep 5
echo "I:test $n: views over options, views disallow - query refused"
ret=0
# Test 55 - zones over views, zones allow, query allowed
n=`expr $n + 1`
sleep 5
echo "I:test $n: zones over views, views allow - query allowed"
ret=0
# Test 56 - zones over views, zones disallow, query refused
n=`expr $n + 1`
sleep 5
echo "I:test $n: zones over views, views disallow - query refused"
ret=0
# Test 57 - zones over views, zones disallow, query refused (allow-query-on)
n=`expr $n + 1`
sleep 5
echo "I:test $n: zones over views, allow-query-on"
ret=0
echo "I:exit status: $status"