upstream/bind9
1
0
Fork 0
mirror of https://github.com/isc-projects/bind9.git synced 2026-06-08 18:32:10 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

Check that RPZ 'CNAME *.' (NODATA) works with DNS64.

Browse source
This commit is contained in:
Mark Andrews 2019-07-01 11:23:28 +10:00
parent 59a7f75b7e
commit b9dc9b68cd
6 changed files with 108 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
bin/tests/system/rpz/ns1/root.db
View file

@ -33,3 +33,8 @@ ns.tld5. A 10.53.0.5
; generate SERVFAIL
servfail NS ns.tld2.
a-only.example A 1.2.3.4
no-a-no-aaaa.example TXT placeholder
a-plus-aaaa.example A 1.2.3.4
a-plus-aaaa.example AAAA ::1

11
bin/tests/system/rpz/ns9/hints Normal file
View file

@ -0,0 +1,11 @@
; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
;
; This Source Code Form is subject to the terms of the Mozilla Public
; License, v. 2.0. If a copy of the MPL was not distributed with this
; file, You can obtain one at http://mozilla.org/MPL/2.0/.
;
; See the COPYRIGHT file distributed with this work for additional
; information regarding copyright ownership.
. 120 NS ns.
ns. 120 A 10.53.0.1

59
bin/tests/system/rpz/ns9/named.conf.in Normal file
View file

@ -0,0 +1,59 @@
/*
* Copyright (C) Internet Systems Consortium, Inc. ("ISC")
*
* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
* file, You can obtain one at http://mozilla.org/MPL/2.0/.
*
* See the COPYRIGHT file distributed with this work for additional
* information regarding copyright ownership.
*/
/*
* DNS64 / RPZ server.
*/
options {
query-source address 10.53.0.9;
notify-source 10.53.0.9;
transfer-source 10.53.0.9;
port @PORT@;
pid-file "named.pid";
statistics-file "named.stats";
session-keyfile "session.key";
listen-on { 10.53.0.9; };
listen-on-v6 { none; };
notify yes;
minimal-responses no;
recursion yes;
dnssec-validation yes;
dns64-server "example.localdomain.";
dns64 64:ff9b::/96 { };
response-policy {
zone "rpz";
}
qname-wait-recurse no ;
include "../dnsrps.conf";
notify-delay 0;
};
logging { category rpz { default_debug; }; };
key rndc_key {
secret "1234abcd8765";
algorithm hmac-sha256;
};
controls {
inet 10.53.0.9 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
};
zone "." { type hint; file "hints"; };
zone "rpz." {
type master;
file "rpz.db";
notify no;
};

5
bin/tests/system/rpz/ns9/rpz.db Normal file
View file

@ -0,0 +1,5 @@
rpz. 28800 IN SOA rpz. hostmaster.rpz. 6 10800 3600 2419200 900
rpz. 28800 IN NS .
a-only.example.rpz. 28800 IN CNAME *.
no-a-no-aaaa.example.rpz. 28800 IN CNAME *.
a-plus-aaaa.example.rpz. 28800 IN CNAME *.

1
bin/tests/system/rpz/setup.sh
View file

@ -51,6 +51,7 @@ copy_setports ns5/named.conf.in ns5/named.conf
copy_setports ns6/named.conf.in ns6/named.conf
copy_setports ns7/named.conf.in ns7/named.conf
copy_setports ns8/named.conf.in ns8/named.conf
copy_setports ns9/named.conf.in ns9/named.conf
copy_setports dnsrpzd.conf.in dnsrpzd.conf

27
bin/tests/system/rpz/tests.sh
View file

@ -856,6 +856,33 @@ EOF
grep "status: SERVFAIL" dig.out.$t > /dev/null || setret "failed"
fi
# RPZ 'CNAME *.' (NODATA) trumps DNS64. Test against various DNS64 senarios.
for label in a-only no-a-no-aaaa a-plus-aaaa
do
for type in AAAA A
do
t=`expr $t + 1`
case $label in
a-only)
echo_i "checking rpz 'CNAME *.' (NODATA) with dns64, $type lookup with A-only (${t})"
;;
no-a-no-aaaa)
echo_i "checking rpz 'CNAME *.' (NODATA) with dns64, $type lookup with no A or AAAA (${t})"
;;
a-plus-aaaa)
echo_i "checking rpz 'CNAME *.' (NODATA) with dns64, $type lookup with A and AAAA (${t})"
;;
esac
ret=0
$DIG ${label}.example -p ${PORT} $type @10.53.0.9 > dig.out.${t}
grep "status: NOERROR" dig.out.$t > /dev/null || ret=1
grep "ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 2$" dig.out.$t > /dev/null || ret=1
grep "^rpz" dig.out.$t > /dev/null || ret=1
[ $ret -eq 0 ] || echo_i "failed"
status=`expr $status + $ret`
done
done
[ $status -ne 0 ] && pf=fail || pf=pass
case $mode in
native)