diff --git a/bin/tests/system/rpz/ns2/tld2.db b/bin/tests/system/rpz/ns2/tld2.db index c6f2556db5..a66ee16d14 100644 --- a/bin/tests/system/rpz/ns2/tld2.db +++ b/bin/tests/system/rpz/ns2/tld2.db @@ -123,3 +123,6 @@ a7-1 A 192.168.7.1 a7-2 A 192.168.7.2 TXT "a7-2 tld2 text" + +a8-1 A 192.168.8.1 + TXT "a8-1 tld2 text" diff --git a/bin/tests/system/rpz/ns3/include-rpz.db.in b/bin/tests/system/rpz/ns3/include-rpz.db.in new file mode 100644 index 0000000000..5133b78964 --- /dev/null +++ b/bin/tests/system/rpz/ns3/include-rpz.db.in @@ -0,0 +1,14 @@ +; Copyright (C) Internet Systems Consortium, Inc. ("ISC") +; +; SPDX-License-Identifier: MPL-2.0 +; +; This Source Code Form is subject to the terms of the Mozilla Public +; License, v. 2.0. If a copy of the MPL was not distributed with this +; file, you can obtain one at https://mozilla.org/MPL/2.0/. +; +; See the COPYRIGHT file distributed with this work for additional +; information regarding copyright ownership. + +$TTL 300 + +$INCLUDE include-rpz.inc diff --git a/bin/tests/system/rpz/ns3/include-rpz.inc-1.in b/bin/tests/system/rpz/ns3/include-rpz.inc-1.in new file mode 100644 index 0000000000..5d316a89b0 --- /dev/null +++ b/bin/tests/system/rpz/ns3/include-rpz.inc-1.in @@ -0,0 +1,14 @@ +; Copyright (C) Internet Systems Consortium, Inc. ("ISC") +; +; SPDX-License-Identifier: MPL-2.0 +; +; This Source Code Form is subject to the terms of the Mozilla Public +; License, v. 2.0. If a copy of the MPL was not distributed with this +; file, you can obtain one at https://mozilla.org/MPL/2.0/. +; +; See the COPYRIGHT file distributed with this work for additional +; information regarding copyright ownership. + +$TTL 300 +@ SOA include-rpz. hostmaster.ns.include-rpz. ( 1 3600 1200 604800 60 ) + NS ns.tld3. diff --git a/bin/tests/system/rpz/ns3/include-rpz.inc-2.in b/bin/tests/system/rpz/ns3/include-rpz.inc-2.in new file mode 100644 index 0000000000..4bce8532cc --- /dev/null +++ b/bin/tests/system/rpz/ns3/include-rpz.inc-2.in @@ -0,0 +1,16 @@ +; Copyright (C) Internet Systems Consortium, Inc. ("ISC") +; +; SPDX-License-Identifier: MPL-2.0 +; +; This Source Code Form is subject to the terms of the Mozilla Public +; License, v. 2.0. If a copy of the MPL was not distributed with this +; file, you can obtain one at https://mozilla.org/MPL/2.0/. +; +; See the COPYRIGHT file distributed with this work for additional +; information regarding copyright ownership. + +$TTL 300 +@ SOA include-rpz. hostmaster.ns.include-rpz. ( 2 3600 1200 604800 60 ) + NS ns.tld3. + +a8-1.tld2 CNAME . diff --git a/bin/tests/system/rpz/ns3/named.conf.j2 b/bin/tests/system/rpz/ns3/named.conf.j2 index 6d8c9e7b66..19ed919968 100644 --- a/bin/tests/system/rpz/ns3/named.conf.j2 +++ b/bin/tests/system/rpz/ns3/named.conf.j2 @@ -53,6 +53,7 @@ options { zone "bl.tld2"; zone "manual-update-rpz" ede forged; zone "mixed-case-rpz"; + zone "include-rpz"; zone "evil-cname" policy cname a12.tld2. ede blocked; zone "wild-cname" ede blocked; zone "slow-rpz"; @@ -130,6 +131,12 @@ zone "mixed-case-rpz." { notify no; }; +zone "include-rpz." { + type primary; + file "include-rpz.db"; + notify no; +}; + zone "slow-rpz." { type primary; file "slow-rpz.db"; diff --git a/bin/tests/system/rpz/setup.sh b/bin/tests/system/rpz/setup.sh index 0762a68441..c40782185d 100644 --- a/bin/tests/system/rpz/setup.sh +++ b/bin/tests/system/rpz/setup.sh @@ -43,6 +43,9 @@ cp ns3/wild-cname.db.in ns3/wild-cname.db cp ns3/mixed-case-rpz-1.db.in ns3/mixed-case-rpz.db +cp ns3/include-rpz.db.in ns3/include-rpz.db +cp ns3/include-rpz.inc-1.in ns3/include-rpz.inc + # a "big" zone (tested with '-T rpzslow' enabled to slow down loading) cp ns3/slow-rpz.db.in ns3/slow-rpz.db diff --git a/bin/tests/system/rpz/tests.sh b/bin/tests/system/rpz/tests.sh index 7104b0180b..6e81866126 100644 --- a/bin/tests/system/rpz/tests.sh +++ b/bin/tests/system/rpz/tests.sh @@ -795,6 +795,16 @@ if [ native = "$MODE" ]; then $DIG -p ${PORT} @$ns3 walled.tld2 >dig.out.$t.after || setret "failed" grep "walled\.tld2\..*IN.*A.*10\.0\.0\.1" dig.out.$t.after >/dev/null || setret "failed" + t=$((t + 1)) + echo_i "checking rpz with included rules can reload (${t})" + $DIG -p ${PORT} @$ns3 a8-1.tld2 >dig.out.$t.before || setret "failed" + grep "status: NOERROR" dig.out.$t.before >/dev/null || setret "failed" + cp ns3/include-rpz.inc-2.in ns3/include-rpz.inc + rndc_reload ns3 $ns3 include-rpz + sleep 1 + $DIG -p ${PORT} @$ns3 a8-1.tld2 >dig.out.$t.after || setret "failed" + grep "status: NXDOMAIN" dig.out.$t.after >/dev/null || setret "failed" + t=$((t + 1)) echo_i "checking the default (unset) extended DNS error code (EDE) (${t})" $DIG -p ${PORT} @$ns3 a6-2.tld2. A >dig.out.$t || setret "failed" diff --git a/bin/tests/system/rpz/tests_sh_rpz.py b/bin/tests/system/rpz/tests_sh_rpz.py index 303a71f50d..86fe2acc2b 100644 --- a/bin/tests/system/rpz/tests_sh_rpz.py +++ b/bin/tests/system/rpz/tests_sh_rpz.py @@ -39,6 +39,8 @@ pytestmark = pytest.mark.extra_artifacts( "ns3/bl.tld2.db", "ns3/evil-cname.db", "ns3/fast-expire.db", + "ns3/include-rpz.db", + "ns3/include-rpz.inc", "ns3/manual-update-rpz.db", "ns3/mixed-case-rpz.db", "ns3/named.conf.tmp", diff --git a/bin/tests/system/rpz/tests_sh_rpz_dnsrps.py b/bin/tests/system/rpz/tests_sh_rpz_dnsrps.py index e286db9ce5..1b7e33b014 100644 --- a/bin/tests/system/rpz/tests_sh_rpz_dnsrps.py +++ b/bin/tests/system/rpz/tests_sh_rpz_dnsrps.py @@ -43,6 +43,8 @@ pytestmark = [ "ns3/bl.tld2.db", "ns3/evil-cname.db", "ns3/fast-expire.db", + "ns3/include-rpz.db", + "ns3/include-rpz.inc", "ns3/manual-update-rpz.db", "ns3/mixed-case-rpz.db", "ns3/named.conf.tmp",