mirror of
https://github.com/isc-projects/bind9.git
synced 2026-07-17 00:34:13 -04:00
Merge branch 'each-dnsrps-testlib' into 'main'
use a test library for DNSRPS See merge request isc-projects/bind9!7693
This commit is contained in:
Evan Hunt
commit
eeba1b8793
38 changed files with 4272 additions and 423 deletions
|
|
@ -226,6 +226,7 @@ stages:
|
|||
--enable-developer
|
||||
--enable-option-checking=fatal
|
||||
--enable-dnstap
|
||||
--enable-dnsrps
|
||||
--with-cmocka
|
||||
--with-libxml2
|
||||
--with-json-c
|
||||
|
|
|
|||
4
CHANGES
4
CHANGES
|
|
@ -1,3 +1,7 @@
|
|||
6131. [test] Add a minimal test-only library to allow testing
|
||||
of the DNSRPS API without FastRPZ installed.
|
||||
Thanks to Farsight Securty. [GL !7693]
|
||||
|
||||
6130. [func] The new "delv +ns" option activates name server mode,
|
||||
in which delv sets up an internal recursive
|
||||
resolver and uses that, rather than an external
|
||||
|
|
|
|||
|
|
@ -149,6 +149,9 @@ options {\n\
|
|||
clients-per-query 10;\n\
|
||||
dnssec-accept-expired no;\n\
|
||||
dnssec-validation " VALIDATION_DEFAULT "; \n"
|
||||
#ifdef USE_DNSRPS
|
||||
" dnsrps-library \"" DNSRPS_LIBRPZ_PATH "\";\n"
|
||||
#endif /* ifdef USE_DNSRPS */
|
||||
#ifdef HAVE_DNSTAP
|
||||
" dnstap-identity hostname;\n"
|
||||
#endif /* ifdef HAVE_DNSTAP */
|
||||
|
|
|
|||
|
|
@ -50,16 +50,15 @@ struct named_server {
|
|||
char *statsfile; /*%< Statistics file name */
|
||||
char *dumpfile; /*%< Dump file name */
|
||||
char *secrootsfile; /*%< Secroots file name */
|
||||
char *bindkeysfile; /*%< bind.keys file name
|
||||
* */
|
||||
char *bindkeysfile; /*%< bind.keys file name */
|
||||
char *recfile; /*%< Recursive file name */
|
||||
bool version_set; /*%< User has set version
|
||||
* */
|
||||
bool version_set; /*%< User has set version */
|
||||
char *version; /*%< User-specified version */
|
||||
bool hostname_set; /*%< User has set hostname
|
||||
* */
|
||||
char *hostname; /*%< User-specified hostname
|
||||
* */
|
||||
bool hostname_set; /*%< User has set hostname */
|
||||
char *hostname; /*%< User-specified hostname */
|
||||
#ifdef USE_DNSRPS
|
||||
char *dnsrpslib;
|
||||
#endif /* ifdef USE_DNSRPS */
|
||||
|
||||
/* Server data structures. */
|
||||
dns_loadmgr_t *loadmgr;
|
||||
|
|
|
|||
|
|
@ -2025,7 +2025,7 @@ conf_dnsrps_sadd(conf_dnsrps_ctx_t *ctx, const char *p, ...) {
|
|||
}
|
||||
|
||||
/*
|
||||
* Get an DNSRPS configuration value using the global and view options
|
||||
* Get a DNSRPS configuration value using the global and view options
|
||||
* for the default. Return false upon failure.
|
||||
*/
|
||||
static bool
|
||||
|
|
@ -9079,6 +9079,35 @@ load_configuration(const char *filename, named_server_t *server,
|
|||
server->kasplist = kasplist;
|
||||
kasplist = tmpkasplist;
|
||||
|
||||
#ifdef USE_DNSRPS
|
||||
/*
|
||||
* Find the path to the DNSRPS implementation library.
|
||||
*/
|
||||
obj = NULL;
|
||||
if (named_config_get(maps, "dnsrps-library", &obj) == ISC_R_SUCCESS) {
|
||||
if (server->dnsrpslib != NULL) {
|
||||
dns_dnsrps_server_destroy();
|
||||
isc_mem_free(server->mctx, server->dnsrpslib);
|
||||
server->dnsrpslib = NULL;
|
||||
}
|
||||
setstring(server, &server->dnsrpslib, cfg_obj_asstring(obj));
|
||||
result = dns_dnsrps_server_create(server->dnsrpslib);
|
||||
isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
|
||||
NAMED_LOGMODULE_SERVER, ISC_LOG_DEBUG(1),
|
||||
"initializing DNSRPS RPZ provider '%s': %s",
|
||||
server->dnsrpslib, isc_result_totext(result));
|
||||
/*
|
||||
* It's okay if librpz isn't available. We'll complain
|
||||
* later if it turns out to be needed for a view with
|
||||
* "dnsrps-enable yes".
|
||||
*/
|
||||
if (result == ISC_R_FILENOTFOUND) {
|
||||
result = ISC_R_SUCCESS;
|
||||
}
|
||||
CHECKFATAL(result, "initializing RPZ service interface");
|
||||
}
|
||||
#endif /* ifdef USE_DNSRPS */
|
||||
|
||||
/*
|
||||
* Configure the views.
|
||||
*/
|
||||
|
|
@ -10135,18 +10164,13 @@ named_server_create(isc_mem_t *mctx, named_server_t **serverp) {
|
|||
.recfile = isc_mem_strdup(mctx, "named.recursing"),
|
||||
};
|
||||
|
||||
#ifdef USE_DNSRPS
|
||||
CHECKFATAL(dns_dnsrps_server_create(), "initializing RPZ service "
|
||||
"interface");
|
||||
#endif /* ifdef USE_DNSRPS */
|
||||
|
||||
/* Initialize server data structures. */
|
||||
ISC_LIST_INIT(server->kasplist);
|
||||
ISC_LIST_INIT(server->viewlist);
|
||||
|
||||
/* Must be first. */
|
||||
CHECKFATAL(dst_lib_init(named_g_mctx, named_g_engine), "initializing "
|
||||
"DST");
|
||||
CHECKFATAL(dst_lib_init(named_g_mctx, named_g_engine),
|
||||
"initializing DST");
|
||||
|
||||
CHECKFATAL(dns_rootns_create(mctx, dns_rdataclass_in, NULL,
|
||||
&server->in_roothints),
|
||||
|
|
@ -10218,6 +10242,7 @@ named_server_destroy(named_server_t **serverp) {
|
|||
|
||||
#ifdef USE_DNSRPS
|
||||
dns_dnsrps_server_destroy();
|
||||
isc_mem_free(server->mctx, server->dnsrpslib);
|
||||
#endif /* ifdef USE_DNSRPS */
|
||||
|
||||
named_controls_destroy(&server->controls);
|
||||
|
|
@ -15826,7 +15851,7 @@ named_server_mkeys(named_server_t *server, isc_lex_t *lex,
|
|||
dns_view_t *view = NULL;
|
||||
dns_rdataclass_t rdclass;
|
||||
char msg[DNS_NAME_FORMATSIZE + 500] = "";
|
||||
enum { NONE, STATUS, REFRESH, SYNC, DESTROY } opt = NONE;
|
||||
enum { NONE, STAT, REFRESH, SYNC, DESTROY } opt = NONE;
|
||||
bool found = false;
|
||||
bool first = true;
|
||||
|
||||
|
|
@ -15845,7 +15870,7 @@ named_server_mkeys(named_server_t *server, isc_lex_t *lex,
|
|||
}
|
||||
|
||||
if (strcasecmp(cmd, "status") == 0) {
|
||||
opt = STATUS;
|
||||
opt = STAT;
|
||||
} else if (strcasecmp(cmd, "refresh") == 0) {
|
||||
opt = REFRESH;
|
||||
} else if (strcasecmp(cmd, "sync") == 0) {
|
||||
|
|
@ -15904,7 +15929,7 @@ named_server_mkeys(named_server_t *server, isc_lex_t *lex,
|
|||
}
|
||||
CHECK(mkey_refresh(view, text));
|
||||
break;
|
||||
case STATUS:
|
||||
case STAT:
|
||||
if (!first) {
|
||||
CHECK(putstr(text, "\n\n"));
|
||||
}
|
||||
|
|
|
|||
|
|
@ -11,11 +11,17 @@ dist-hook:
|
|||
|
||||
SUBDIRS = dyndb/driver dlzexternal/driver hooks/driver
|
||||
|
||||
if DNSRPS
|
||||
SUBDIRS += rpz/testlib
|
||||
endif
|
||||
|
||||
AM_CPPFLAGS += \
|
||||
$(LIBISC_CFLAGS)
|
||||
$(LIBISC_CFLAGS) \
|
||||
$(LIBDNS_CFLAGS)
|
||||
|
||||
LDADD += \
|
||||
$(LIBISC_LIBS)
|
||||
$(LIBISC_LIBS) \
|
||||
$(LIBDNS_LIBS)
|
||||
|
||||
if HAVE_PERL
|
||||
|
||||
|
|
@ -48,11 +54,13 @@ pipelined_pipequeries_LDADD = \
|
|||
|
||||
rpz_dnsrps_CPPFLAGS = \
|
||||
$(AM_CPPFLAGS) \
|
||||
$(LIBDNS_CFLAGS)
|
||||
$(LIBDNS_CFLAGS) \
|
||||
-DLIBRPZ_LIB_OPEN=\"$(abs_builddir)/rpz/testlib/.libs/libdummyrpz.so\"
|
||||
|
||||
rpz_dnsrps_LDADD = \
|
||||
$(LDADD) \
|
||||
$(LIBDNS_LIBS)
|
||||
$(LIBDNS_LIBS) \
|
||||
-ldl
|
||||
|
||||
TESTS =
|
||||
|
||||
|
|
|
|||
|
|
@ -14,9 +14,9 @@
|
|||
set -e
|
||||
|
||||
# Say on stdout whether to test DNSRPS
|
||||
# and create dnsrps.conf and dnsrps-secondary.conf
|
||||
# Note that dnsrps.conf and dnsrps-secondary.conf are included in named.conf
|
||||
# and differ from dnsrpz.conf which is used by dnsrpzd.
|
||||
# and creates dnsrps.conf
|
||||
# Note that dnsrps.conf is included in named.conf
|
||||
# and differs from dnsrpz.conf which is used by dnsrpzd.
|
||||
|
||||
|
||||
. ../conf.sh
|
||||
|
|
@ -26,15 +26,13 @@ DNSRPS_CMD=../rpz/dnsrps
|
|||
AS_NS=
|
||||
TEST_DNSRPS=
|
||||
MCONF=dnsrps.conf
|
||||
SCONF=dnsrps-secondary.conf
|
||||
USAGE="$0: [-xAD] [-M dnsrps.conf] [-S dnsrps-secondary.conf]"
|
||||
USAGE="$0: [-xAD] [-M dnsrps.conf]"
|
||||
while getopts "xADM:S:" c; do
|
||||
case $c in
|
||||
x) set -x; DEBUG=-x;;
|
||||
A) AS_NS=yes;;
|
||||
D) TEST_DNSRPS=yes;;
|
||||
M) MCONF="$OPTARG";;
|
||||
S) SCONF="$OPTARG";;
|
||||
*) echo "$USAGE" 1>&2; exit 1;;
|
||||
esac
|
||||
done
|
||||
|
|
@ -46,11 +44,9 @@ fi
|
|||
|
||||
# erase any existing conf files
|
||||
cat /dev/null > $MCONF
|
||||
cat /dev/null > $SCONF
|
||||
|
||||
add_conf () {
|
||||
echo "$*" >>$MCONF
|
||||
echo "$*" >>$SCONF
|
||||
}
|
||||
|
||||
if ! $FEATURETEST --enable-dnsrps; then
|
||||
|
|
@ -82,86 +78,6 @@ else
|
|||
exit 0
|
||||
fi
|
||||
|
||||
CMN=" dnsrps-options { dnsrpzd-conf ../dnsrpzd.conf
|
||||
dnsrpzd-sock ../dnsrpzd.sock
|
||||
dnsrpzd-rpzf ../dnsrpzd.rpzf
|
||||
dnsrpzd-args '-dddd -L stdout'
|
||||
log-level 3"
|
||||
|
||||
PRIMARY="$CMN"
|
||||
if [ -n "$AS_NS" ]; then
|
||||
PRIMARY="$PRIMARY
|
||||
qname-as-ns yes
|
||||
ip-as-ns yes"
|
||||
fi
|
||||
|
||||
# write dnsrps settings for primary resolver
|
||||
cat <<EOF >>$MCONF
|
||||
$PRIMARY };
|
||||
EOF
|
||||
|
||||
# write dnsrps settings for resolvers that should not start dnsrpzd
|
||||
cat <<EOF >>$SCONF
|
||||
$CMN
|
||||
dnsrpzd '' }; # do not start dnsrpzd
|
||||
EOF
|
||||
|
||||
|
||||
# DNSRPS is available.
|
||||
# The test should fail if the license is bad.
|
||||
add_conf "dnsrps-enable yes;"
|
||||
|
||||
# Use alt-dnsrpzd-license.conf if it exists
|
||||
CUR_L=dnsrpzd-license-cur.conf
|
||||
ALT_L=alt-dnsrpzd-license.conf
|
||||
# try ../rpz/alt-dnsrpzd-license.conf if alt-dnsrpzd-license.conf does not exist
|
||||
[ -s $ALT_L ] || ALT_L=../rpz/alt-dnsrpzd-license.conf
|
||||
if [ -s $ALT_L ]; then
|
||||
SRC_L=$ALT_L
|
||||
USE_ALT=
|
||||
else
|
||||
SRC_L=../rpz/dnsrpzd-license.conf
|
||||
USE_ALT="## consider installing alt-dnsrpzd-license.conf"
|
||||
fi
|
||||
cp $SRC_L $CUR_L
|
||||
|
||||
# parse $CUR_L for the license zone name, primary IP addresses, and optional
|
||||
# transfer-source IP addresses
|
||||
eval `sed -n -e 'y/ABCDEFGHIJKLMNOPQRSTUVWXYZ/abcdefghijklmnopqrstuvwxyz/'\
|
||||
-e 's/.*zone *\([-a-z0-9]*.license.fastrpz.com\).*/NAME=\1/p' \
|
||||
-e 's/.*farsight_fastrpz_license *\([0-9.]*\);.*/IPV4=\1/p' \
|
||||
-e 's/.*farsight_fastrpz_license *\([0-9a-f:]*\);.*/IPV6=\1/p' \
|
||||
-e 's/.*transfer-source *\([0-9.]*\);.*/TS4=-b\1/p' \
|
||||
-e 's/.*transfer-source *\([0-9a-f:]*\);.*/TS6=-b\1/p' \
|
||||
-e 's/.*transfer-source-v6 *\([0-9a-f:]*\);.*/TS6=-b\1/p' \
|
||||
$CUR_L`
|
||||
if [ -z "$NAME" ]; then
|
||||
add_conf "## no DNSRPS tests; no license domain name in $SRC_L"
|
||||
add_conf '#fail'
|
||||
exit 0
|
||||
fi
|
||||
if [ -z "$IPV4" ]; then
|
||||
IPV4=license1.fastrpz.com
|
||||
TS4=
|
||||
fi
|
||||
if [ -z "$IPV6" ]; then
|
||||
IPV6=license1.fastrpz.com
|
||||
TS6=
|
||||
fi
|
||||
|
||||
# This TSIG key is common and NOT a secret
|
||||
KEY='hmac-sha256:farsight_fastrpz_license:f405d02b4c8af54855fcebc1'
|
||||
|
||||
# Try IPv4 and then IPv6 to deal with IPv6 tunnel and connectivity problems
|
||||
if `$DIG -4 -t axfr -y$KEY $TS4 $NAME @$IPV4 \
|
||||
| grep -i "^$NAME.*TXT" >/dev/null`; then
|
||||
exit 0
|
||||
fi
|
||||
if `$DIG -6 -t axfr -y$KEY $TS6 $NAME @$IPV6 \
|
||||
| grep -i "^$NAME.*TXT" >/dev/null`; then
|
||||
exit 0
|
||||
fi
|
||||
|
||||
add_conf "## DNSRPS lacks a valid license via $SRC_L"
|
||||
[ -z "$USE_ALT" ] || add_conf "$USE_ALT"
|
||||
add_conf '#fail'
|
||||
add_conf 'dnsrps-options { log-level 3 };'
|
||||
add_conf 'dnsrps-enable yes;'
|
||||
add_conf 'dnsrps-library "../../rpz/testlib/.libs/libdummyrpz.so";'
|
||||
|
|
|
|||
1
bin/tests/system/rpz/.gitignore
vendored
1
bin/tests/system/rpz/.gitignore
vendored
|
|
@ -1,2 +1 @@
|
|||
alt-dnsrpzd-license.conf
|
||||
dnsrps
|
||||
|
|
|
|||
|
|
@ -40,6 +40,7 @@ rm -f ns5/example.db ns5/bl.db ns5/fast-expire.db ns5/expire.conf
|
|||
rm -f ns8/manual-update-rpz.db
|
||||
rm -f */policy2.db
|
||||
rm -f */*.jnl
|
||||
rm -f dnsrps.cache dnsrps.conf
|
||||
|
||||
if [ ${PARTIAL:-unset} = unset ]; then
|
||||
rm -f proto.* dsset-* trusted.conf dig.out* nsupdate.tmp ns*/*tmp
|
||||
|
|
@ -49,9 +50,7 @@ if [ ${PARTIAL:-unset} = unset ]; then
|
|||
rm -f ns*/named.lock
|
||||
rm -f ns*/named.conf
|
||||
rm -f ns*/*switch
|
||||
rm -f dnsrps*.conf
|
||||
rm -f dnsrpzd.conf
|
||||
rm -f dnsrpzd-license-cur.conf dnsrpzd.rpzf dnsrpzd.sock dnsrpzd.pid
|
||||
rm -f dnsrps.zones
|
||||
rm -f ns*/managed-keys.bind*
|
||||
rm -f tmp
|
||||
fi
|
||||
|
|
|
|||
|
|
@ -13,11 +13,8 @@
|
|||
|
||||
/*
|
||||
* -a exit(0) if dnsrps is available or dlopen() msg if not
|
||||
* -p print the path to dnsrpzd configured in dnsrps so that
|
||||
* dnsrpzd can be run by a setup.sh script.
|
||||
* Exit(1) if dnsrps is not available
|
||||
* -n domain print the serial number of a domain to check if a new
|
||||
* version of a policy zone has been transferred to dnsrpzd.
|
||||
* version of a policy zone is ready.
|
||||
* Exit(1) if dnsrps is not available
|
||||
* -w sec.ond wait for seconds, because `sleep 0.1` is not portable
|
||||
*/
|
||||
|
|
@ -36,10 +33,7 @@
|
|||
#include <isc/util.h>
|
||||
|
||||
#ifdef USE_DNSRPS
|
||||
#define LIBRPZ_LIB_OPEN DNSRPS_LIB_OPEN
|
||||
#include <dns/librpz.h>
|
||||
|
||||
librpz_t *librpz;
|
||||
#else /* ifdef USE_DNSRPS */
|
||||
typedef struct {
|
||||
char c[120];
|
||||
|
|
@ -49,15 +43,15 @@ typedef struct {
|
|||
static bool
|
||||
link_dnsrps(librpz_emsg_t *emsg);
|
||||
|
||||
#define USAGE "usage: [-ap] [-n domain] [-w sec.onds]\n"
|
||||
#define USAGE "usage: [-a] [-n domain] [-w sec.onds]\n"
|
||||
|
||||
int
|
||||
main(int argc, char **argv) {
|
||||
#ifdef USE_DNSRPS
|
||||
char cstr[sizeof("zone ") + 1024 + 10];
|
||||
librpz_clist_t *clist;
|
||||
librpz_client_t *client;
|
||||
librpz_rsp_t *rsp;
|
||||
librpz_clist_t *clist = NULL;
|
||||
librpz_client_t *client = NULL;
|
||||
librpz_rsp_t *rsp = NULL;
|
||||
uint32_t serial;
|
||||
#endif /* ifdef USE_DNSRPS */
|
||||
double seconds;
|
||||
|
|
@ -65,7 +59,7 @@ main(int argc, char **argv) {
|
|||
char *p;
|
||||
int i;
|
||||
|
||||
while ((i = getopt(argc, argv, "apn:w:")) != -1) {
|
||||
while ((i = getopt(argc, argv, "an:w:")) != -1) {
|
||||
switch (i) {
|
||||
case 'a':
|
||||
if (!link_dnsrps(&emsg)) {
|
||||
|
|
@ -74,18 +68,6 @@ main(int argc, char **argv) {
|
|||
}
|
||||
return (0);
|
||||
|
||||
case 'p':
|
||||
if (!link_dnsrps(&emsg)) {
|
||||
fprintf(stderr, "## %s\n", emsg.c);
|
||||
return (1);
|
||||
}
|
||||
#ifdef USE_DNSRPS
|
||||
printf("%s\n", librpz->dnsrpzd_path);
|
||||
#else /* ifdef USE_DNSRPS */
|
||||
UNREACHABLE();
|
||||
#endif /* ifdef USE_DNSRPS */
|
||||
return (0);
|
||||
|
||||
case 'n':
|
||||
if (!link_dnsrps(&emsg)) {
|
||||
fprintf(stderr, "## %s\n", emsg.c);
|
||||
|
|
@ -93,8 +75,7 @@ main(int argc, char **argv) {
|
|||
}
|
||||
#ifdef USE_DNSRPS
|
||||
/*
|
||||
* Get the serial number of a policy zone from
|
||||
* a running dnsrpzd daemon.
|
||||
* Get the serial number of a policy zone.
|
||||
*/
|
||||
clist = librpz->clist_create(&emsg, NULL, NULL, NULL,
|
||||
NULL, NULL);
|
||||
|
|
@ -102,15 +83,12 @@ main(int argc, char **argv) {
|
|||
fprintf(stderr, "## %s: %s\n", optarg, emsg.c);
|
||||
return (1);
|
||||
}
|
||||
snprintf(cstr, sizeof(cstr),
|
||||
"zone %s; dnsrpzd \"\";"
|
||||
" dnsrpzd-sock dnsrpzd.sock;"
|
||||
" dnsrpzd-rpzf dnsrpzd.rpzf",
|
||||
optarg);
|
||||
snprintf(cstr, sizeof(cstr), "zone %s;", optarg);
|
||||
client = librpz->client_create(&emsg, clist, cstr,
|
||||
true);
|
||||
if (client == NULL) {
|
||||
fprintf(stderr, "## %s\n", emsg.c);
|
||||
librpz->clist_detach(&clist);
|
||||
return (1);
|
||||
}
|
||||
|
||||
|
|
@ -121,16 +99,20 @@ main(int argc, char **argv) {
|
|||
{
|
||||
fprintf(stderr, "## %s\n", emsg.c);
|
||||
librpz->client_detach(&client);
|
||||
librpz->clist_detach(&clist);
|
||||
return (1);
|
||||
}
|
||||
|
||||
if (!librpz->soa_serial(&emsg, &serial, optarg, rsp)) {
|
||||
fprintf(stderr, "## %s\n", emsg.c);
|
||||
librpz->rsp_detach(&rsp);
|
||||
librpz->client_detach(&client);
|
||||
librpz->clist_detach(&clist);
|
||||
return (1);
|
||||
}
|
||||
librpz->rsp_detach(&rsp);
|
||||
librpz->client_detach(&client);
|
||||
librpz->clist_detach(&clist);
|
||||
printf("%u\n", serial);
|
||||
#else /* ifdef USE_DNSRPS */
|
||||
UNREACHABLE();
|
||||
|
|
@ -158,7 +140,7 @@ main(int argc, char **argv) {
|
|||
static bool
|
||||
link_dnsrps(librpz_emsg_t *emsg) {
|
||||
#ifdef USE_DNSRPS
|
||||
librpz = librpz_lib_open(emsg, NULL, DNSRPS_LIBRPZ_PATH);
|
||||
librpz = librpz_lib_open(emsg, NULL, LIBRPZ_LIB_OPEN);
|
||||
if (librpz == NULL) {
|
||||
return (false);
|
||||
}
|
||||
|
|
|
|||
|
|
@ -15,8 +15,6 @@
|
|||
|
||||
pid-file ../dnsrpzd.pid
|
||||
|
||||
include ../dnsrpzd-license-cur.conf
|
||||
|
||||
# configure NOTIFY and zone transfers
|
||||
port @EXTRAPORT1@;
|
||||
listen-on port @EXTRAPORT1@ { 10.53.0.3; };
|
||||
|
|
@ -1,23 +0,0 @@
|
|||
/*
|
||||
* Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
||||
*
|
||||
* SPDX-License-Identifier: MPL-2.0
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
*/
|
||||
|
||||
zone isc.license.fastrpz.com {
|
||||
primaries port 53 {
|
||||
KEY farsight_fastrpz_license 104.244.14.176;
|
||||
KEY farsight_fastrpz_license 2620:11c:f008::176;
|
||||
};
|
||||
};
|
||||
|
||||
key farsight_fastrpz_license {
|
||||
algorithm hmac-sha256; secret "f405d02b4c8af54855fcebc1";
|
||||
};
|
||||
|
|
@ -35,7 +35,7 @@ options {
|
|||
# turn rpz on or off
|
||||
include "rpz-switch";
|
||||
|
||||
include "../dnsrps-secondary.conf";
|
||||
include "../dnsrps.conf";
|
||||
};
|
||||
|
||||
key rndc_key {
|
||||
|
|
|
|||
|
|
@ -36,7 +36,7 @@ options {
|
|||
nsip-enable yes
|
||||
nsdname-enable yes;
|
||||
|
||||
include "../dnsrps-secondary.conf";
|
||||
include "../dnsrps.conf";
|
||||
};
|
||||
|
||||
logging { category rpz { default_debug; }; };
|
||||
|
|
@ -58,7 +58,7 @@ zone "policy1" {
|
|||
file "empty.db";
|
||||
also-notify { 10.53.0.3 port @EXTRAPORT1@; };
|
||||
notify-delay 0;
|
||||
allow-transfer { any; };
|
||||
allow-transfer { any; };
|
||||
};
|
||||
|
||||
zone "bl.tld2s." {
|
||||
|
|
|
|||
|
|
@ -32,7 +32,7 @@ options {
|
|||
nsdname-enable yes
|
||||
min-update-interval 0;
|
||||
|
||||
include "../dnsrps-secondary.conf";
|
||||
include "../dnsrps.conf";
|
||||
};
|
||||
|
||||
logging { category rpz { default_debug; }; };
|
||||
|
|
@ -54,6 +54,6 @@ zone "policy2" {
|
|||
file "policy2.db";
|
||||
also-notify { 10.53.0.3 port @EXTRAPORT1@; };
|
||||
notify-delay 0;
|
||||
allow-transfer { any; };
|
||||
allow-transfer { any; };
|
||||
request-ixfr no; // force axfr on rndc reload
|
||||
};
|
||||
|
|
|
|||
|
|
@ -30,7 +30,7 @@ options {
|
|||
recursion yes;
|
||||
dnssec-validation yes;
|
||||
dns64-server "example.localdomain.";
|
||||
dns64 64:ff9b::/96 { };
|
||||
dns64 64:ff9b::/96 { };
|
||||
response-policy {
|
||||
zone "rpz";
|
||||
}
|
||||
|
|
|
|||
|
|
@ -9,8 +9,9 @@
|
|||
; See the COPYRIGHT file distributed with this work for additional
|
||||
; information regarding copyright ownership.
|
||||
|
||||
rpz. 28800 IN SOA rpz. hostmaster.rpz. 6 10800 3600 2419200 900
|
||||
rpz. 28800 IN NS .
|
||||
a-only.example.rpz. 28800 IN CNAME *.
|
||||
no-a-no-aaaa.example.rpz. 28800 IN CNAME *.
|
||||
a-plus-aaaa.example.rpz. 28800 IN CNAME *.
|
||||
$TTL 28800
|
||||
rpz. IN SOA rpz. hostmaster.rpz. 6 10800 3600 2419200 900
|
||||
rpz. IN NS .
|
||||
a-only.example CNAME *.
|
||||
no-a-no-aaaa.example CNAME *.
|
||||
a-plus-aaaa.example CNAME *.
|
||||
|
|
|
|||
|
|
@ -55,13 +55,13 @@ copy_setports ns8/named.conf.in ns8/named.conf
|
|||
copy_setports ns9/named.conf.in ns9/named.conf
|
||||
copy_setports ns10/named.conf.in ns10/named.conf
|
||||
|
||||
copy_setports dnsrpzd.conf.in dnsrpzd.conf
|
||||
copy_setports dnsrps.zones.in dnsrps.zones
|
||||
|
||||
# decide whether to test DNSRPS
|
||||
# Note that dnsrps.conf and dnsrps-secondary.conf are included in named.conf
|
||||
# and differ from dnsrpz.conf which is used by dnsrpzd.
|
||||
$SHELL ../ckdnsrps.sh -A $TEST_DNSRPS $DEBUG
|
||||
test -z "$(grep 'dnsrps-enable yes' dnsrps.conf)" && TEST_DNSRPS=
|
||||
# Note that dnsrps.conf is included in named.conf
|
||||
$SHELL ../ckdnsrps.sh $TEST_DNSRPS $DEBUG
|
||||
test -z "$(grep 'testing with DNSRPS' dnsrps.conf)" && TEST_DNSRPS=
|
||||
touch dnsrps.cache
|
||||
|
||||
# set up test policy zones.
|
||||
# bl is the main test zone
|
||||
|
|
@ -169,11 +169,3 @@ cp ns2/bl.tld2.db.in ns2/bl.tld2.db
|
|||
cp ns5/empty.db.in ns5/empty.db
|
||||
cp ns5/empty.db.in ns5/policy2.db
|
||||
cp ns6/bl.tld2s.db.in ns6/bl.tld2s.db
|
||||
|
||||
# Run dnsrpzd to get the license and prime the static policy zones
|
||||
if test -n "$TEST_DNSRPS"; then
|
||||
DNSRPZD="$(../rpz/dnsrps -p)"
|
||||
cd ns3
|
||||
"$DNSRPZ" -D../dnsrpzd.rpzf -S../dnsrpzd.sock -C../dnsrpzd.conf \
|
||||
-w 0 -dddd -L stdout >./dnsrpzd.run 2>&1
|
||||
fi
|
||||
|
|
|
|||
12
bin/tests/system/rpz/testlib/Makefile.am
Normal file
12
bin/tests/system/rpz/testlib/Makefile.am
Normal file
|
|
@ -0,0 +1,12 @@
|
|||
include $(top_srcdir)/Makefile.top
|
||||
|
||||
AM_CPPFLAGS += \
|
||||
$(LIBISC_CFLAGS) \
|
||||
$(LIBDNS_CFLAGS)
|
||||
|
||||
AM_CFLAGS += -Wall -pedantic
|
||||
|
||||
check_LTLIBRARIES = libdummyrpz.la
|
||||
libdummyrpz_la_SOURCES= dummylib.c test-data.c trpz.h test-data.h
|
||||
libdummyrpz_la_LDFLAGS = -avoid-version -module -shared -export-dynamic -rpath $(abs_builddir)
|
||||
LDADD += -lpthread -ldl
|
||||
2239
bin/tests/system/rpz/testlib/dummylib.c
Normal file
2239
bin/tests/system/rpz/testlib/dummylib.c
Normal file
File diff suppressed because it is too large
Load diff
1489
bin/tests/system/rpz/testlib/test-data.c
Normal file
1489
bin/tests/system/rpz/testlib/test-data.c
Normal file
File diff suppressed because it is too large
Load diff
124
bin/tests/system/rpz/testlib/test-data.h
Normal file
124
bin/tests/system/rpz/testlib/test-data.h
Normal file
|
|
@ -0,0 +1,124 @@
|
|||
/*
|
||||
* Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
||||
*
|
||||
* SPDX-License-Identifier: MPL-2.0
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
*/
|
||||
|
||||
/*
|
||||
* Limited implementation of the DNSRPS API for testing purposes.
|
||||
*
|
||||
* Copyright (c) 2016-2017 Farsight Security, Inc.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
#define LIBRPZ_LIB_OPEN 2
|
||||
#include <dns/librpz.h>
|
||||
|
||||
#include "trpz.h"
|
||||
|
||||
#define NODE_FLAG_IPV6_ADDRESS 0x1
|
||||
#define NODE_FLAG_STATIC_DATA 0x2
|
||||
|
||||
#define ZOPT_POLICY_PASSTHRU 0x0001
|
||||
#define ZOPT_POLICY_DROP 0x0002
|
||||
#define ZOPT_POLICY_TCP_ONLY 0x0004
|
||||
#define ZOPT_POLICY_NXDOMAIN 0x0008
|
||||
#define ZOPT_POLICY_NODATA 0x0010
|
||||
#define ZOPT_POLICY_GIVEN 0x0020
|
||||
#define ZOPT_POLICY_DISABLED 0x0040
|
||||
|
||||
#define ZOPT_RECURSIVE_ONLY 0x0100
|
||||
#define ZOPT_NOT_RECURSIVE_ONLY 0x0200
|
||||
#define ZOPT_QNAME_AS_NS 0x0400
|
||||
#define ZOPT_IP_AS_NS 0x0800
|
||||
|
||||
#define ZOPT_QNAME_WAIT_RECURSE 0x1000
|
||||
#define ZOPT_NO_QNAME_WAIT_RECURSE 0x2000
|
||||
#define ZOPT_NO_NSIP_WAIT_RECURSE 0x4000
|
||||
|
||||
typedef struct {
|
||||
char name[256];
|
||||
uint32_t serial;
|
||||
int has_update;
|
||||
size_t rollback;
|
||||
int has_triggers[2][LIBRPZ_TRIG_NSIP + 1];
|
||||
bool forgotten;
|
||||
bool qname_as_ns, ip_as_ns;
|
||||
bool not_recursive_only;
|
||||
bool no_qname_wait_recurse, no_nsip_wait_recurse;
|
||||
unsigned long flags;
|
||||
} trpz_zone_t;
|
||||
|
||||
typedef struct {
|
||||
uint16_t type;
|
||||
uint16_t class;
|
||||
uint32_t ttl;
|
||||
uint16_t rdlength;
|
||||
uint8_t *rdata;
|
||||
unsigned int rrn;
|
||||
} trpz_rr_t;
|
||||
|
||||
typedef struct {
|
||||
char *canonical;
|
||||
char *dname;
|
||||
librpz_result_t result;
|
||||
uint32_t ttl;
|
||||
trpz_rr_t *rrs;
|
||||
size_t nrrs, rridx;
|
||||
librpz_policy_t poverride, hidden_policy;
|
||||
unsigned long flags;
|
||||
librpz_trig_t match_trig;
|
||||
} trpz_result_t;
|
||||
|
||||
#define DECL_NODE(canon, name, policy, znum, trig) \
|
||||
{ canon, name, { 0, 0, policy, policy, znum, znum, trig, true } },
|
||||
|
||||
#define NUM_ZONES_SNAPSHOT1 20
|
||||
|
||||
extern const rpz_soa_t g_soa_record;
|
||||
|
||||
#define WDNS_PRESLEN_NAME 1025
|
||||
extern size_t
|
||||
wdns_domain_to_str(const uint8_t *src, size_t src_len, char *dst);
|
||||
extern int
|
||||
wdns_str_to_name(const char *str, uint8_t **pbuf, bool downcase);
|
||||
|
||||
extern void
|
||||
reverse_labels(const char *str, char *pbuf);
|
||||
|
||||
extern rpz_soa_t *
|
||||
parse_serial(unsigned char *rdata, size_t rdlen);
|
||||
|
||||
extern int
|
||||
load_all_updates(const char *fname, trpz_result_t **presults, size_t *pnresults,
|
||||
trpz_zone_t **pzones, size_t *pnzones, char **errp);
|
||||
extern int
|
||||
apply_update(const char *updstr, trpz_result_t **presults, size_t *pnresults,
|
||||
trpz_zone_t **pzones, size_t *pnzones, int is_static,
|
||||
unsigned long flags, char **errp);
|
||||
extern int
|
||||
sanity_check_data_file(const char *fname, char **errp);
|
||||
|
||||
extern unsigned long
|
||||
parse_zone_options(const char *str);
|
||||
|
||||
extern int
|
||||
get_address_info(const char *astr, int *pfamily, char *pbuf,
|
||||
const char *optname, char **errp);
|
||||
58
bin/tests/system/rpz/testlib/trpz.h
Normal file
58
bin/tests/system/rpz/testlib/trpz.h
Normal file
|
|
@ -0,0 +1,58 @@
|
|||
/*
|
||||
* Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
||||
*
|
||||
* SPDX-License-Identifier: MPL-2.0
|
||||
*
|
||||
* This Source Code Form is subject to the terms of the Mozilla Public
|
||||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||||
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
||||
*
|
||||
* See the COPYRIGHT file distributed with this work for additional
|
||||
* information regarding copyright ownership.
|
||||
*/
|
||||
|
||||
/*
|
||||
* Limited implementation of the DNSRPS API for testing purposes.
|
||||
*
|
||||
* Copyright (c) 2016-2017 Farsight Security, Inc.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
#ifndef TRPZ_H
|
||||
#define TRPZ_H
|
||||
|
||||
#include <netinet/in.h>
|
||||
#include <sys/socket.h>
|
||||
#include <sys/un.h>
|
||||
|
||||
#define TARGET_ZONE "rpz-test.example.com"
|
||||
|
||||
/* This should be in the librpz.h include. */
|
||||
union socku {
|
||||
struct sockaddr sa;
|
||||
struct sockaddr_in ipv4;
|
||||
struct sockaddr_in6 ipv6;
|
||||
struct sockaddr_un sun;
|
||||
};
|
||||
|
||||
typedef struct {
|
||||
const char *mname;
|
||||
const char *rname;
|
||||
uint32_t serial;
|
||||
uint32_t refresh;
|
||||
uint32_t retry;
|
||||
uint32_t expire;
|
||||
uint32_t minimum;
|
||||
} rpz_soa_t;
|
||||
|
||||
#endif
|
||||
|
|
@ -35,6 +35,7 @@ HAVE_CORE=
|
|||
status=0
|
||||
t=0
|
||||
|
||||
export DNSRPS_TEST_UPDATE_FILE=$(pwd)/dnsrps.cache
|
||||
DEBUG=
|
||||
SAVE_RESULTS=
|
||||
ARGS=
|
||||
|
|
@ -67,7 +68,6 @@ DNSRPSCMD=./dnsrps
|
|||
RNDCCMD="$RNDC -c ../common/rndc.conf -p ${CONTROLPORT} -s"
|
||||
|
||||
if test -x $DNSRPSCMD; then
|
||||
# speed up the many delays for dnsrpzd by waiting only 0.1 seconds
|
||||
WAIT_CMD="$DNSRPSCMD -w 0.1"
|
||||
TEN_SECS=100
|
||||
else
|
||||
|
|
@ -129,10 +129,10 @@ get_sn_fast () {
|
|||
fi
|
||||
}
|
||||
|
||||
# check that dnsrpzd has loaded its zones
|
||||
# check that dnsrps provider has zones loaded
|
||||
# $1=domain
|
||||
# $2=DNS server IP address
|
||||
FZONES=`sed -n -e 's/^zone "\(.*\)".*\(10.53.0..\).*/Z=\1;M=\2/p' dnsrpzd.conf`
|
||||
FZONES=`sed -n -e 's/^zone "\(.*\)".*\(10.53.0..\).*/Z=\1;M=\2/p' dnsrps.zones`
|
||||
dnsrps_loaded() {
|
||||
test "$mode" = dnsrps || return
|
||||
n=0
|
||||
|
|
@ -182,7 +182,15 @@ ck_soa() {
|
|||
# (re)load the response policy zones with the rules in the file $TEST_FILE
|
||||
load_db () {
|
||||
if test -n "$TEST_FILE"; then
|
||||
copy_setports $TEST_FILE tmp
|
||||
copy_setports $TEST_FILE tmp
|
||||
|
||||
for ZONE in bl0 bl1 bl2 bl3 bl4 bl5 bl6 bl7 bl8 bl9 bl10 bl11 bl12 bl13 bl14 bl15 bl16 bl17 bl18 bl19; do
|
||||
produce_librpz_rules ns5 $ZONE bl
|
||||
done
|
||||
|
||||
produce_librpz_rules ns2 bl.tld2 bl.tld2
|
||||
cat tmp >> $DNSRPS_TEST_UPDATE_FILE
|
||||
|
||||
if $NSUPDATE -v tmp; then :
|
||||
$RNDCCMD $ns3 sync
|
||||
else
|
||||
|
|
@ -190,7 +198,7 @@ load_db () {
|
|||
$RNDCCMD $ns3 sync
|
||||
exit 1
|
||||
fi
|
||||
rm -f tmp
|
||||
rm -f tmp
|
||||
fi
|
||||
}
|
||||
|
||||
|
|
@ -213,11 +221,11 @@ restart () {
|
|||
fi
|
||||
rm -f ns$1/*.jnl
|
||||
if [ "$2" = "rebuild-bl-rpz" ]; then
|
||||
if test -f ns$1/base.db; then
|
||||
if test -f ns$1/base.db; then
|
||||
for NM in ns$1/bl*.db; do
|
||||
cp -f ns$1/base.db $NM
|
||||
done
|
||||
fi
|
||||
cp -f ns$1/base.db $NM
|
||||
done
|
||||
fi
|
||||
fi
|
||||
start_server --noclean --restart --port ${PORT} ns$1
|
||||
load_db
|
||||
|
|
@ -242,8 +250,8 @@ ckalive () {
|
|||
}
|
||||
|
||||
resetstats () {
|
||||
NSDIR=$1
|
||||
eval "${NSDIR}_CNT=''"
|
||||
NSDIR=$1
|
||||
eval "${NSDIR}_CNT=''"
|
||||
}
|
||||
|
||||
ckstats () {
|
||||
|
|
@ -279,6 +287,16 @@ ckstatsrange () {
|
|||
eval "${NSDIR}_CNT=$NEW_CNT"
|
||||
}
|
||||
|
||||
add_librpz_rule() {
|
||||
echo $1 >> $DNSRPS_TEST_UPDATE_FILE
|
||||
}
|
||||
|
||||
produce_librpz_rules() {
|
||||
# echo "Producing rules for $1"
|
||||
ZONEFILE=$1/$3.db
|
||||
cat $ZONEFILE | egrep -v '^;' | egrep '\<(A|CNAME)\>' | awk -v zone=$2 '{ if (NF == 4) {print "static add "$1"."zone" "$2" "$3" "$4} else if (NF == 3) {print "static add "$1"."zone" 300 "$2" "$3}}' >> $DNSRPS_TEST_UPDATE_FILE
|
||||
}
|
||||
|
||||
# $1=message
|
||||
# $2=optional test file name
|
||||
start_group () {
|
||||
|
|
@ -299,9 +317,10 @@ start_group () {
|
|||
end_group () {
|
||||
if test -n "$TEST_FILE"; then
|
||||
# remove the previous set of test rules
|
||||
copy_setports $TEST_FILE tmp
|
||||
copy_setports $TEST_FILE tmp
|
||||
add_librpz_rule "rollback"
|
||||
sed -e 's/[ ]add[ ]/ delete /' tmp | $NSUPDATE
|
||||
rm -f tmp
|
||||
rm -f tmp
|
||||
TEST_FILE=
|
||||
fi
|
||||
ckalive $ns3 "failed; ns3 server crashed and restarted"
|
||||
|
|
@ -510,6 +529,7 @@ for mode in native dnsrps; do
|
|||
retry_quiet 10 make_proto_nodata
|
||||
|
||||
start_group "QNAME rewrites" test1
|
||||
|
||||
nochange . # 1 do not crash or rewrite root
|
||||
nxdomain a0-1.tld2 # 2
|
||||
nodata a3-1.tld2 # 3
|
||||
|
|
@ -600,13 +620,18 @@ EOF
|
|||
# updating an response zone policy
|
||||
cp ns2/blv2.tld2.db.in ns2/bl.tld2.db
|
||||
rndc_reload ns2 $ns2 bl.tld2
|
||||
add_librpz_rule "update zone bl.tld2 1 inc"
|
||||
ck_soa 2 bl.tld2 $ns3
|
||||
add_librpz_rule "wipe"
|
||||
produce_librpz_rules ns2 bl.tld2 bl.tld2
|
||||
nochange a7-1.tld2 # 19 PASSTHRU
|
||||
# ensure that a clock tick has occurred so that named will do the reload
|
||||
sleep 1
|
||||
cp ns2/blv3.tld2.db.in ns2/bl.tld2.db
|
||||
rndc_reload ns2 $ns2 bl.tld2
|
||||
add_librpz_rule "update zone bl.tld2 1 inc"
|
||||
ck_soa 3 bl.tld2 $ns3
|
||||
produce_librpz_rules ns2 bl.tld2 bl.tld2
|
||||
nxdomain a7-1.tld2 # 20 secondary policy zone (RT34450)
|
||||
end_group
|
||||
ckstats $ns3 test2 ns3 12
|
||||
|
|
@ -647,17 +672,10 @@ EOF
|
|||
nxdomain a3-1.static-stub # 14
|
||||
nochange_ns10 a3-1.stub-nomatch # 15
|
||||
nochange_ns10 a3-1.static-stub-nomatch # 16
|
||||
if [ "$mode" = dnsrps ]; then
|
||||
addr 12.12.12.12 as-ns.tld5. # 17 qname-as-ns
|
||||
fi
|
||||
nextpart ns3/named.run | grep -q "unrecognized NS rpz_rrset_find() failed: glue" &&
|
||||
setret "seen: unrecognized NS rpz_rrset_find() failed: glue"
|
||||
end_group
|
||||
if [ "$mode" = dnsrps ]; then
|
||||
ckstats $ns3 test3 ns3 10
|
||||
else
|
||||
ckstats $ns3 test3 ns3 9
|
||||
fi
|
||||
ckstats $ns3 test3 ns3 9
|
||||
|
||||
# these tests assume "min-ns-dots 0"
|
||||
start_group "NSIP rewrites" test4
|
||||
|
|
@ -670,9 +688,6 @@ EOF
|
|||
nxdomain a4-1.static-stub # 6
|
||||
nochange_ns10 a4-1.stub-nomatch # 7
|
||||
nochange_ns10 a4-1.static-stub-nomatch # 8
|
||||
if [ "$mode" = dnsrps ]; then
|
||||
addr 12.12.12.12 as-ns.tld5. # 9 ip-as-ns
|
||||
fi
|
||||
nextpart ns3/named.run | grep -q "unrecognized NS rpz_rrset_find() failed: glue" &&
|
||||
setret "seen: unrecognized NS rpz_rrset_find() failed: glue"
|
||||
end_group
|
||||
|
|
@ -685,11 +700,7 @@ EOF
|
|||
a3-1.tld2. x IN TXT "NSIP walled garden"
|
||||
EOF
|
||||
end_group
|
||||
if [ "$mode" = dnsrps ]; then
|
||||
ckstats $ns3 test4 ns3 7
|
||||
else
|
||||
ckstats $ns3 test4 ns3 6
|
||||
fi
|
||||
ckstats $ns3 test4 ns3 6
|
||||
|
||||
# policies in ./test5 overridden by response-policy{} in ns3/named.conf
|
||||
# and in ns5/named.conf
|
||||
|
|
@ -722,6 +733,7 @@ EOF
|
|||
ckstats $ns5 test5 ns5 4
|
||||
|
||||
# check that miscellaneous bugs are still absent
|
||||
add_librpz_rule "wipe"
|
||||
start_group "crashes" test6
|
||||
for Q in RRSIG SIG ANY 'ANY +dnssec'; do
|
||||
nocrash a3-1.tld2 -t$Q
|
||||
|
|
@ -789,27 +801,6 @@ EOF
|
|||
echo_i "performance not checked; queryperf not available"
|
||||
fi
|
||||
|
||||
if [ "$mode" = dnsrps ]; then
|
||||
echo_i "checking that dnsrpzd is automatically restarted"
|
||||
OLD_PID=`cat dnsrpzd.pid`
|
||||
kill "$OLD_PID"
|
||||
n=0
|
||||
while true; do
|
||||
NEW_PID=`cat dnsrpzd.pid 2>/dev/null`
|
||||
if test -n "$NEW_PID" -a "0$OLD_PID" -ne "0$NEW_PID"; then
|
||||
#echo "OLD_PID=$OLD_PID NEW_PID=$NEW_PID"
|
||||
break;
|
||||
fi
|
||||
$DIG -p ${PORT} +short +norecurse a0-1.tld2 @$ns3 >/dev/null
|
||||
n=`expr $n + 1`
|
||||
if test "$n" -gt $TEN_SECS; then
|
||||
setret "dnsrpzd did not restart"
|
||||
break
|
||||
fi
|
||||
$WAIT_CMD
|
||||
done
|
||||
fi
|
||||
|
||||
# Ensure ns3 manages to transfer the fast-expire zone before shutdown.
|
||||
nextpartreset ns3/named.run
|
||||
wait_for_log 20 "zone fast-expire/IN: transferred serial 1" ns3/named.run
|
||||
|
|
@ -822,6 +813,7 @@ EOF
|
|||
# restart the main test RPZ server to see if that creates a core file
|
||||
if test -z "$HAVE_CORE"; then
|
||||
stop_server --use-rndc --port ${CONTROLPORT} ns3
|
||||
add_librpz_rule "restart"
|
||||
restart 3 "rebuild-bl-rpz"
|
||||
HAVE_CORE=`find ns* -name '*core*' -print`
|
||||
test -z "$HAVE_CORE" || setret "found $HAVE_CORE; memory leak?"
|
||||
|
|
@ -833,7 +825,7 @@ EOF
|
|||
if test -n "$EMSGS"; then
|
||||
setret "error messages in $runfile starting with:"
|
||||
grep -E 'invalid rpz|rpz.*failed' ns*/named.run | \
|
||||
sed -e '10,$d' -e 's/^//' | cat_i
|
||||
sed -e '10,$d' -e 's/^//' | cat_i
|
||||
fi
|
||||
done
|
||||
|
||||
|
|
@ -918,9 +910,11 @@ EOF
|
|||
nsd $ns5 delete '*.example.com.policy1.' example.com.policy1.
|
||||
done
|
||||
|
||||
|
||||
t=`expr $t + 1`
|
||||
echo_i "checking that going from an empty policy zone works (${t})"
|
||||
nsd $ns5 add '*.x.servfail.policy2.' x.servfail.policy2.
|
||||
add_librpz_rule "update add *.x.servfail.policy2 300 CNAME ."
|
||||
sleep 1
|
||||
rndc_reload ns7 $ns7 policy2
|
||||
$DIG z.x.servfail -p ${PORT} @$ns7 > dig.out.${t}
|
||||
|
|
@ -977,6 +971,7 @@ EOF
|
|||
fi
|
||||
|
||||
# RPZ 'CNAME *.' (NODATA) trumps DNS64. Test against various DNS64 scenarios.
|
||||
produce_librpz_rules ns9 rpz rpz
|
||||
for label in a-only no-a-no-aaaa a-plus-aaaa
|
||||
do
|
||||
for type in AAAA A
|
||||
|
|
|
|||
|
|
@ -40,19 +40,19 @@ options {
|
|||
|
||||
logging {
|
||||
channel rpz_passthru {
|
||||
file "rpz_passthru.txt" versions 3 size 5m;
|
||||
print-time yes;
|
||||
print-category yes;
|
||||
print-severity yes;
|
||||
severity info;
|
||||
file "rpz_passthru.txt" versions 3 size 5m;
|
||||
print-time yes;
|
||||
print-category yes;
|
||||
print-severity yes;
|
||||
severity info;
|
||||
};
|
||||
|
||||
channel rpz_log {
|
||||
file "rpz.txt" versions 3 size 20m;
|
||||
print-time yes;
|
||||
print-category yes;
|
||||
print-severity yes;
|
||||
severity info;
|
||||
file "rpz.txt" versions 3 size 20m;
|
||||
print-time yes;
|
||||
print-category yes;
|
||||
print-severity yes;
|
||||
severity info;
|
||||
};
|
||||
|
||||
category rpz { rpz_log; default_debug; };
|
||||
|
|
|
|||
1
bin/tests/system/rpzrecurse/.gitignore
vendored
1
bin/tests/system/rpzrecurse/.gitignore
vendored
|
|
@ -5,7 +5,6 @@
|
|||
/ns3/named2.conf
|
||||
/ns4/named.conf
|
||||
/ans5/ans.pid
|
||||
/dnsrps-secondary.conf
|
||||
/dnsrps.conf
|
||||
/dnsrpzd.conf
|
||||
session.key
|
||||
|
|
|
|||
|
|
@ -29,6 +29,7 @@ rm -f ns2/named.conf.header
|
|||
rm -f ns3/named.conf
|
||||
rm -f ns3/named.run.prev
|
||||
|
||||
rm -f dnsrps*.conf dnsrpzd*
|
||||
rm -f dnsrps.cache
|
||||
rm -f dnsrps*.conf
|
||||
rm -f ns*/session.key
|
||||
rm -f ns*/managed-keys.bind* ns*/*.mkeys*
|
||||
|
|
|
|||
|
|
@ -27,7 +27,7 @@ options {
|
|||
querylog yes;
|
||||
|
||||
# let ns3 start dnsrpzd
|
||||
include "../dnsrps-secondary.conf";
|
||||
include "../dnsrps.conf";
|
||||
};
|
||||
|
||||
key rndc_key {
|
||||
|
|
|
|||
|
|
@ -46,6 +46,11 @@ copy_setports ns3/named1.conf.in ns3/named.conf
|
|||
|
||||
copy_setports ns4/named.conf.in ns4/named.conf
|
||||
|
||||
# decide whether to test DNSRPS
|
||||
$SHELL ../ckdnsrps.sh $TEST_DNSRPS $DEBUG
|
||||
test -z "`grep 'dnsrps-enable yes' dnsrps.conf`" && TEST_DNSRPS=
|
||||
touch dnsrps.cache
|
||||
|
||||
# setup policy zones for a 64-zone test
|
||||
i=1
|
||||
while test $i -le 64
|
||||
|
|
@ -63,25 +68,3 @@ do
|
|||
done
|
||||
i=`expr $i + 1`
|
||||
done
|
||||
|
||||
# decide whether to test DNSRPS
|
||||
$SHELL ../ckdnsrps.sh $TEST_DNSRPS $DEBUG
|
||||
test -z "`grep 'dnsrps-enable yes' dnsrps.conf`" && TEST_DNSRPS=
|
||||
|
||||
CWD=`pwd`
|
||||
cat <<EOF >dnsrpzd.conf
|
||||
PID-FILE $CWD/dnsrpzd.pid;
|
||||
|
||||
include $CWD/dnsrpzd-license-cur.conf
|
||||
|
||||
zone "policy" { type primary; file "`pwd`/ns3/policy.db"; };
|
||||
EOF
|
||||
sed -n -e 's/^ *//' -e "/zone.*.*primary/s@file \"@&$CWD/ns2/@p" ns2/*.conf \
|
||||
>>dnsrpzd.conf
|
||||
|
||||
# Run dnsrpzd to get the license and prime the static policy zones
|
||||
if test -n "$TEST_DNSRPS"; then
|
||||
DNSRPZD="`../rpz/dnsrps -p`"
|
||||
"$DNSRPZD" -D./dnsrpzd.rpzf -S./dnsrpzd.sock -C./dnsrpzd.conf \
|
||||
-w 0 -dddd -L stdout >./dnsrpzd.run 2>&1
|
||||
fi
|
||||
|
|
|
|||
|
|
@ -20,6 +20,7 @@ status=0
|
|||
|
||||
t=0
|
||||
|
||||
export DNSRPS_TEST_UPDATE_FILE=$(pwd)/dnsrps.cache
|
||||
DEBUG=
|
||||
ARGS=
|
||||
|
||||
|
|
@ -46,6 +47,7 @@ RNDCCMD="$RNDC -c ../common/rndc.conf -p ${CONTROLPORT} -s"
|
|||
run_server() {
|
||||
TESTNAME=$1
|
||||
|
||||
start_server_rules $1 $2
|
||||
echo_i "stopping resolver"
|
||||
stop_server --use-rndc --port ${CONTROLPORT} ns2
|
||||
|
||||
|
|
@ -57,6 +59,22 @@ run_server() {
|
|||
sleep 3
|
||||
}
|
||||
|
||||
start_server_rules() {
|
||||
FCONF=ns2/named.$1.conf
|
||||
|
||||
cat /dev/null > $DNSRPS_TEST_UPDATE_FILE
|
||||
cat $FCONF | grep 'zone ' | grep ' primary' | while read LINE; do
|
||||
ZONE=`echo $LINE | sed 's/.*zone "//g' | awk -F '"' '{print $1}'`;
|
||||
DBFILE=`echo $LINE | sed 's/.*file "//g' | awk -F '"' '{print $1}'`;
|
||||
cat ns2/$DBFILE | egrep -v '^;' | egrep '\<(A|CNAME)\>' | awk -v zone=$ZONE '{ if (NF == 4) {print "static add "$1"."zone" "$2" "$3" "$4} else if (NF == 3) {print "static add "$1"."zone" 300 "$2" "$3}}' >> $DNSRPS_TEST_UPDATE_FILE
|
||||
done
|
||||
}
|
||||
|
||||
produce_librpz_rules() {
|
||||
ZONEFILE=$1/$3.db
|
||||
cat $ZONEFILE | egrep -v '^;' | egrep '\<(A|CNAME)\>' | awk -v zone=$2 '{ if (NF == 4) {print "static add "$1"."zone" "$2" "$3" "$4} else if (NF == 3) {print "static add "$1"."zone" 300 "$2" "$3}}' >> $DNSRPS_TEST_UPDATE_FILE
|
||||
}
|
||||
|
||||
run_query() {
|
||||
TESTNAME=$1
|
||||
LINE=$2
|
||||
|
|
@ -74,7 +92,7 @@ expect_norecurse() {
|
|||
LINE=$2
|
||||
|
||||
NAME=`sed -n -e "$LINE,"'$p' ns2/$TESTNAME.queries | head -n 1`
|
||||
t=`expr $t + 1`
|
||||
t=$((t+1))
|
||||
echo_i "testing $NAME doesn't recurse (${t})"
|
||||
add_test_marker 10.53.0.2
|
||||
run_query $TESTNAME $LINE || {
|
||||
|
|
@ -90,7 +108,7 @@ expect_recurse() {
|
|||
LINE=$2
|
||||
|
||||
NAME=`sed -n -e "$LINE,"'$p' ns2/$TESTNAME.queries | head -n 1`
|
||||
t=`expr $t + 1`
|
||||
t=$((t+1))
|
||||
echo_i "testing $NAME recurses (${t})"
|
||||
add_test_marker 10.53.0.2
|
||||
run_query $TESTNAME $LINE && {
|
||||
|
|
@ -144,7 +162,7 @@ for mode in native dnsrps; do
|
|||
# show whether and why DNSRPS is enabled or disabled
|
||||
sed -n 's/^## //p' dnsrps.conf | cat_i
|
||||
|
||||
t=`expr $t + 1`
|
||||
t=$((t+1))
|
||||
echo_i "testing that l1.l0 exists without RPZ (${t})"
|
||||
add_test_marker 10.53.0.2
|
||||
$DIG $DIGOPTS l1.l0 ns @10.53.0.2 -p ${PORT} > dig.out.${t}
|
||||
|
|
@ -153,7 +171,7 @@ for mode in native dnsrps; do
|
|||
status=1
|
||||
}
|
||||
|
||||
t=`expr $t + 1`
|
||||
t=$((t+1))
|
||||
echo_i "testing that l2.l1.l0 returns SERVFAIL without RPZ (${t})"
|
||||
add_test_marker 10.53.0.2
|
||||
$DIG $DIGOPTS l2.l1.l0 ns @10.53.0.2 -p ${PORT} > dig.out.${t}
|
||||
|
|
@ -211,7 +229,7 @@ for mode in native dnsrps; do
|
|||
for n in $testlist; do
|
||||
run_server 4$n
|
||||
ni=$1
|
||||
t=`expr $t + 1`
|
||||
t=$((t+1))
|
||||
echo_i "testing that ${ni} of 33 queries skip recursion (${t})"
|
||||
add_test_marker 10.53.0.2
|
||||
c=0
|
||||
|
|
@ -221,7 +239,7 @@ for mode in native dnsrps; do
|
|||
run_query 4$n $i
|
||||
c=`expr $c + $?`
|
||||
done
|
||||
skipped=`expr 33 - $c`
|
||||
skipped=$((33-c))
|
||||
if [ $skipped != $ni ]; then
|
||||
echo_i "test $t failed (actual=$skipped, expected=$ni)"
|
||||
status=1
|
||||
|
|
@ -242,7 +260,7 @@ for mode in native dnsrps; do
|
|||
echo_i "check recursive behavior consistency during policy update races"
|
||||
run_server 6a
|
||||
sleep 1
|
||||
t=`expr $t + 1`
|
||||
t=$((t+1))
|
||||
echo_i "running dig to cache CNAME record (${t})"
|
||||
add_test_marker 10.53.0.1 10.53.0.2
|
||||
$DIG $DIGOPTS @10.53.0.2 -p ${PORT} www.test.example.org CNAME > dig.out.${t}
|
||||
|
|
@ -256,7 +274,7 @@ for mode in native dnsrps; do
|
|||
$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p ${CONTROLPORT} reload 6a.00.policy.local 2>&1 | sed 's/^/ns2 /' | cat_i
|
||||
test -f dnsrpzd.pid && kill -USR1 `cat dnsrpzd.pid`
|
||||
sleep 1
|
||||
t=`expr $t + 1`
|
||||
t=$((t+1))
|
||||
echo_i "running dig to follow CNAME (blocks, so runs in the background) (${t})"
|
||||
add_test_marker 10.53.0.2
|
||||
$DIG $DIGOPTS @10.53.0.2 -p ${PORT} www.test.example.org A +time=5 > dig.out.${t} &
|
||||
|
|
@ -285,7 +303,7 @@ for mode in native dnsrps; do
|
|||
cp ns2/saved.policy.local ns2/db.6a.00.policy.local
|
||||
run_server 6a
|
||||
sleep 1
|
||||
t=`expr $t + 1`
|
||||
t=$((t+1))
|
||||
echo_i "running dig to cache CNAME record (${t})"
|
||||
add_test_marker 10.53.0.1 10.53.0.2
|
||||
$DIG $DIGOPTS @10.53.0.2 -p ${PORT} www.test.example.org CNAME > dig.out.${t}
|
||||
|
|
@ -298,7 +316,7 @@ for mode in native dnsrps; do
|
|||
$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p ${CONTROLPORT} reload 6a.00.policy.local 2>&1 | sed 's/^/ns2 /' | cat_i
|
||||
test -f dnsrpzd.pid && kill -USR1 `cat dnsrpzd.pid`
|
||||
sleep 1
|
||||
t=`expr $t + 1`
|
||||
t=$((t+1))
|
||||
echo_i "running dig to follow CNAME (blocks, so runs in the background) (${t})"
|
||||
add_test_marker 10.53.0.2
|
||||
$DIG $DIGOPTS @10.53.0.2 -p ${PORT} www.test.example.org A +time=5 > dig.out.${t} &
|
||||
|
|
@ -323,7 +341,7 @@ for mode in native dnsrps; do
|
|||
}
|
||||
|
||||
# Check maximum number of RPZ zones (64)
|
||||
t=`expr $t + 1`
|
||||
t=$((t+1))
|
||||
echo_i "testing maximum number of RPZ zones (${t})"
|
||||
add_test_marker 10.53.0.2
|
||||
run_server max
|
||||
|
|
@ -335,11 +353,11 @@ for mode in native dnsrps; do
|
|||
echo_i "test $t failed: didn't get expected answer from policy zone $i"
|
||||
status=1
|
||||
}
|
||||
i=`expr $i + 1`
|
||||
i=$((i+1))
|
||||
done
|
||||
|
||||
# Check CLIENT-IP behavior
|
||||
t=`expr $t + 1`
|
||||
t=$((t+1))
|
||||
echo_i "testing CLIENT-IP behavior (${t})"
|
||||
add_test_marker 10.53.0.2
|
||||
run_server clientip
|
||||
|
|
@ -354,7 +372,7 @@ for mode in native dnsrps; do
|
|||
}
|
||||
|
||||
# Check CLIENT-IP behavior #2
|
||||
t=`expr $t + 1`
|
||||
t=$((t+1))
|
||||
echo_i "testing CLIENT-IP behavior #2 (${t})"
|
||||
add_test_marker 10.53.0.2
|
||||
run_server clientip2
|
||||
|
|
@ -384,7 +402,7 @@ for mode in native dnsrps; do
|
|||
}
|
||||
|
||||
# Check RPZ log clause
|
||||
t=`expr $t + 1`
|
||||
t=$((t+1))
|
||||
echo_i "testing RPZ log clause (${t})"
|
||||
add_test_marker 10.53.0.2
|
||||
run_server log
|
||||
|
|
@ -407,7 +425,7 @@ for mode in native dnsrps; do
|
|||
|
||||
# Check wildcard behavior
|
||||
|
||||
t=`expr $t + 1`
|
||||
t=$((t+1))
|
||||
echo_i "testing wildcard behavior with 1 RPZ zone (${t})"
|
||||
add_test_marker 10.53.0.2
|
||||
run_server wildcard1
|
||||
|
|
@ -422,7 +440,7 @@ for mode in native dnsrps; do
|
|||
status=1
|
||||
}
|
||||
|
||||
t=`expr $t + 1`
|
||||
t=$((t+1))
|
||||
echo_i "testing wildcard behavior with 2 RPZ zones (${t})"
|
||||
add_test_marker 10.53.0.2
|
||||
run_server wildcard2
|
||||
|
|
@ -437,7 +455,7 @@ for mode in native dnsrps; do
|
|||
status=1
|
||||
}
|
||||
|
||||
t=`expr $t + 1`
|
||||
t=$((t+1))
|
||||
echo_i "testing wildcard behavior with 1 RPZ zone and no non-wildcard triggers (${t})"
|
||||
add_test_marker 10.53.0.2
|
||||
run_server wildcard3
|
||||
|
|
@ -452,7 +470,7 @@ for mode in native dnsrps; do
|
|||
status=1
|
||||
}
|
||||
|
||||
t=`expr $t + 1`
|
||||
t=$((t+1))
|
||||
echo_i "testing wildcard passthru before explicit drop (${t})"
|
||||
add_test_marker 10.53.0.2
|
||||
run_server wildcard4
|
||||
|
|
@ -469,7 +487,7 @@ for mode in native dnsrps; do
|
|||
|
||||
if [ "$mode" = "native" ]; then
|
||||
# Check for invalid prefix length error
|
||||
t=`expr $t + 1`
|
||||
t=$((t+1))
|
||||
echo_i "testing for invalid prefix length error (${t})"
|
||||
add_test_marker 10.53.0.2
|
||||
run_server invalidprefixlength
|
||||
|
|
@ -479,68 +497,72 @@ for mode in native dnsrps; do
|
|||
}
|
||||
fi
|
||||
|
||||
t=`expr $t + 1`
|
||||
echo_i "checking 'nsip-wait-recurse no' is faster than 'nsip-wait-recurse yes' ($t)"
|
||||
add_test_marker 10.53.0.2 10.53.0.3
|
||||
echo_i "timing 'nsip-wait-recurse yes' (default)"
|
||||
ret=0
|
||||
t1=`$PERL -e 'print time()."\n";'`
|
||||
$DIG -p ${PORT} @10.53.0.3 foo.child.example.tld a > dig.out.yes.$t
|
||||
t2=`$PERL -e 'print time()."\n";'`
|
||||
p1=`expr $t2 - $t1`
|
||||
echo_i "elapsed time $p1 seconds"
|
||||
if [ "$mode" = "native" ]; then
|
||||
t=$((t+1))
|
||||
echo_i "checking 'nsip-wait-recurse no' is faster than 'nsip-wait-recurse yes' ($t)"
|
||||
add_test_marker 10.53.0.2 10.53.0.3
|
||||
echo_i "timing 'nsip-wait-recurse yes' (default)"
|
||||
produce_librpz_rules ns3 policy policy
|
||||
ret=0
|
||||
t1=`$PERL -e 'print time()."\n";'`
|
||||
$DIG -p ${PORT} @10.53.0.3 foo.child.example.tld a > dig.out.yes.$t
|
||||
t2=`$PERL -e 'print time()."\n";'`
|
||||
p1=$((t2-t1))
|
||||
echo_i "elapsed time $p1 seconds"
|
||||
|
||||
$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p ${CONTROLPORT} flush
|
||||
copy_setports ns3/named2.conf.in ns3/named.conf
|
||||
nextpart ns3/named.run > /dev/null
|
||||
$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p ${CONTROLPORT} reload > /dev/null
|
||||
wait_for_log 20 "rpz: policy: reload done" ns3/named.run || ret=1
|
||||
$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p ${CONTROLPORT} flush
|
||||
copy_setports ns3/named2.conf.in ns3/named.conf
|
||||
nextpart ns3/named.run > /dev/null
|
||||
$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p ${CONTROLPORT} reload > /dev/null
|
||||
wait_for_log 20 "rpz: policy: reload done" ns3/named.run || ret=1
|
||||
|
||||
echo_i "timing 'nsip-wait-recurse no'"
|
||||
t3=`$PERL -e 'print time()."\n";'`
|
||||
$DIG -p ${PORT} @10.53.0.3 foo.child.example.tld a > dig.out.no.$t
|
||||
t4=`$PERL -e 'print time()."\n";'`
|
||||
p2=`expr $t4 - $t3`
|
||||
echo_i "elapsed time $p2 seconds"
|
||||
echo_i "timing 'nsip-wait-recurse no'"
|
||||
echo "update zone policy 0 no_nsip_wait_recurse" > $DNSRPS_TEST_UPDATE_FILE
|
||||
t3=`$PERL -e 'print time()."\n";'`
|
||||
$DIG -p ${PORT} @10.53.0.3 foo.child.example.tld a > dig.out.no.$t
|
||||
t4=`$PERL -e 'print time()."\n";'`
|
||||
p2=$((t4-t3))
|
||||
echo_i "elapsed time $p2 seconds"
|
||||
|
||||
if test $p1 -le $p2; then ret=1; fi
|
||||
if test $ret != 0; then echo_i "failed"; fi
|
||||
status=`expr $status + $ret`
|
||||
if test $p1 -le $p2; then ret=1; fi
|
||||
if test $ret != 0; then echo_i "failed"; fi
|
||||
status=$((status+ret))
|
||||
|
||||
$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p ${CONTROLPORT} flush
|
||||
# restore original named.conf
|
||||
copy_setports ns3/named1.conf.in ns3/named.conf
|
||||
nextpart ns3/named.run > /dev/null
|
||||
$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p ${CONTROLPORT} reload > /dev/null
|
||||
wait_for_log 20 "rpz: policy: reload done" ns3/named.run || ret=1
|
||||
$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p ${CONTROLPORT} flush
|
||||
# restore original named.conf
|
||||
copy_setports ns3/named1.conf.in ns3/named.conf
|
||||
nextpart ns3/named.run > /dev/null
|
||||
$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p ${CONTROLPORT} reload > /dev/null
|
||||
wait_for_log 20 "rpz: policy: reload done" ns3/named.run || ret=1
|
||||
|
||||
t=`expr $t + 1`
|
||||
echo_i "checking 'nsdname-wait-recurse no' is faster than 'nsdname-wait-recurse yes' ($t)"
|
||||
add_test_marker 10.53.0.2 10.53.0.3
|
||||
echo_i "timing 'nsdname-wait-recurse yes' (default)"
|
||||
ret=0
|
||||
t1=`$PERL -e 'print time()."\n";'`
|
||||
$DIG -p ${PORT} @10.53.0.3 foo.child.example.tld a > dig.out.yes.$t
|
||||
t2=`$PERL -e 'print time()."\n";'`
|
||||
p1=`expr $t2 - $t1`
|
||||
echo_i "elapsed time $p1 seconds"
|
||||
t=$((t+1))
|
||||
echo_i "checking 'nsdname-wait-recurse no' is faster than 'nsdname-wait-recurse yes' ($t)"
|
||||
add_test_marker 10.53.0.2 10.53.0.3
|
||||
echo_i "timing 'nsdname-wait-recurse yes' (default)"
|
||||
ret=0
|
||||
t1=`$PERL -e 'print time()."\n";'`
|
||||
$DIG -p ${PORT} @10.53.0.3 foo.child.example.tld a > dig.out.yes.$t
|
||||
t2=`$PERL -e 'print time()."\n";'`
|
||||
p1=$((t2-t1))
|
||||
echo_i "elapsed time $p1 seconds"
|
||||
|
||||
$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p ${CONTROLPORT} flush
|
||||
copy_setports ns3/named3.conf.in ns3/named.conf
|
||||
nextpart ns3/named.run > /dev/null
|
||||
$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p ${CONTROLPORT} reload > /dev/null
|
||||
wait_for_log 20 "rpz: policy: reload done" ns3/named.run || ret=1
|
||||
$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p ${CONTROLPORT} flush
|
||||
copy_setports ns3/named3.conf.in ns3/named.conf
|
||||
nextpart ns3/named.run > /dev/null
|
||||
$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p ${CONTROLPORT} reload > /dev/null
|
||||
wait_for_log 20 "rpz: policy: reload done" ns3/named.run || ret=1
|
||||
|
||||
echo_i "timing 'nsdname-wait-recurse no'"
|
||||
t3=`$PERL -e 'print time()."\n";'`
|
||||
$DIG -p ${PORT} @10.53.0.3 foo.child.example.tld a > dig.out.no.$t
|
||||
t4=`$PERL -e 'print time()."\n";'`
|
||||
p2=`expr $t4 - $t3`
|
||||
echo_i "elapsed time $p2 seconds"
|
||||
echo_i "timing 'nsdname-wait-recurse no'"
|
||||
t3=`$PERL -e 'print time()."\n";'`
|
||||
$DIG -p ${PORT} @10.53.0.3 foo.child.example.tld a > dig.out.no.$t
|
||||
t4=`$PERL -e 'print time()."\n";'`
|
||||
p2=$((t4-t3))
|
||||
echo_i "elapsed time $p2 seconds"
|
||||
|
||||
if test $p1 -le $p2; then ret=1; fi
|
||||
if test $ret != 0; then echo_i "failed"; fi
|
||||
status=`expr $status + $ret`
|
||||
if test $p1 -le $p2; then ret=1; fi
|
||||
if test $ret != 0; then echo_i "failed"; fi
|
||||
status=$((status+ret))
|
||||
fi
|
||||
|
||||
|
||||
[ $status -ne 0 ] && pf=fail || pf=pass
|
||||
|
|
|
|||
18
configure.ac
18
configure.ac
|
|
@ -1430,7 +1430,7 @@ no)
|
|||
AC_MSG_RESULT(no)
|
||||
;;
|
||||
*)
|
||||
AC_MSG_ERROR("--enable-querytrace requires yes or no (not $enable_querytrace)")
|
||||
AC_MSG_ERROR(["--enable-querytrace requires yes or no (not $enable_querytrace)"])
|
||||
;;
|
||||
esac
|
||||
|
||||
|
|
@ -1478,10 +1478,10 @@ AC_COMPILE_IFELSE(
|
|||
AC_ARG_ENABLE([dnsrps-dl],
|
||||
[AS_HELP_STRING([--enable-dnsrps-dl],
|
||||
[DNS Response Policy Service delayed link
|
||||
[default=$librpz_dl]])],
|
||||
[enable_librpz_dl="$enableval"], [enable_librpz_dl="$with_dlopen"])
|
||||
[default=yes]])],
|
||||
[enable_dnsprs_dl="$enableval"], [enable_dnsrps_dl="yes"])
|
||||
|
||||
AS_IF([test "$enable_librpz_dl" = "yes" -a "$with_dlopen" = "no"],
|
||||
AS_IF([test "$enable_dnsprs_dl" = "yes" -a "$with_dlopen" = "no"],
|
||||
[AC_MSG_ERROR([DNS Response Policy Service delayed link requires dlopen to be enabled])])
|
||||
|
||||
# [pairwise: skip]
|
||||
|
|
@ -1497,7 +1497,7 @@ AC_ARG_WITH([dnsrps-dir],
|
|||
[librpz_path="$withval/$librpz_name"], [librpz_path="$librpz_name"])
|
||||
AC_DEFINE_UNQUOTED([DNSRPS_LIBRPZ_PATH], ["$librpz_path"],
|
||||
[dnsrps $librpz_name])
|
||||
AS_IF([test "$enable_librpz_dl" = "yes"],
|
||||
AS_IF([test "$enable_dnsrps_dl" = "yes"],
|
||||
[
|
||||
dnsrps_lib_open=2
|
||||
],[
|
||||
|
|
@ -1517,13 +1517,13 @@ AC_ARG_ENABLE([dnsrps],
|
|||
[enable_dnsrps=$enableval], [enable_dnsrps=no])
|
||||
|
||||
AS_IF([test "$enable_dnsrps" != "no"],[
|
||||
AS_IF([test "$dnsrps_avail" != "yes"],
|
||||
[AC_MSG_ERROR([dlopen and librpz.so needed for DNSRPS])])
|
||||
AS_IF([test "$dnsrps_lib_open" = "0"],
|
||||
[AC_MSG_ERROR([dlopen and librpz.so needed for DNSRPS])])
|
||||
AC_DEFINE([USE_DNSRPS], [1], [Enable DNS Response Policy Service API])
|
||||
])
|
||||
|
||||
AM_CONDITIONAL([DNSRPS], [test "$enable_dnsrps" != "no"])
|
||||
|
||||
AC_CHECK_HEADERS([glob.h])
|
||||
|
||||
#
|
||||
|
|
@ -1592,7 +1592,9 @@ AC_CONFIG_FILES([bin/tests/Makefile
|
|||
bin/tests/system/conf.sh
|
||||
bin/tests/system/dyndb/driver/Makefile
|
||||
bin/tests/system/dlzexternal/driver/Makefile
|
||||
bin/tests/system/hooks/driver/Makefile])
|
||||
bin/tests/system/hooks/driver/Makefile
|
||||
bin/tests/system/rpz/testlib/Makefile
|
||||
])
|
||||
|
||||
AC_CONFIG_FILES([bin/tests/system/ifconfig.sh],
|
||||
[chmod +x bin/tests/system/ifconfig.sh])
|
||||
|
|
|
|||
|
|
@ -5110,6 +5110,15 @@ done to discover problems at the authoritative server.
|
|||
(DNSRPS) interface, if it has been compiled in :iscman:`named` using
|
||||
``configure --enable-dnsrps``.
|
||||
|
||||
.. namedconf:statement:: dnsrps-library
|
||||
:tags: server, security
|
||||
:short: Turns on the DNS Response Policy Service (DNSRPS) interface.
|
||||
|
||||
This option specifies the path to the DNSRPS provider library. Typically
|
||||
this library is detected when building with ``configure --enable-dnsrps``
|
||||
and does not need to be specified in ``named.conf``; the option exists
|
||||
to override the default library for testing purposes.
|
||||
|
||||
.. namedconf:statement:: dnsrps-options
|
||||
:tags: server, security
|
||||
:short: Provides additional RPZ configuration settings, which are passed to the DNS Response Policy Service (DNSRPS) provider library.
|
||||
|
|
@ -5117,7 +5126,7 @@ done to discover problems at the authoritative server.
|
|||
The block provides additional RPZ configuration
|
||||
settings, which are passed through to the DNSRPS provider library.
|
||||
Multiple DNSRPS settings in an :any:`dnsrps-options` string should be
|
||||
separated with semi-colons (;). The DNSRPS provider, librpz, is passed a
|
||||
separated with semi-colons (;). The DNSRPS provider library is passed a
|
||||
configuration string consisting of the :any:`dnsrps-options` text,
|
||||
concatenated with settings derived from the :any:`response-policy`
|
||||
statement.
|
||||
|
|
|
|||
|
|
@ -112,6 +112,7 @@ options {
|
|||
dns64-server <string>;
|
||||
dnskey-sig-validity <integer>;
|
||||
dnsrps-enable <boolean>; // not configured
|
||||
dnsrps-library <quoted_string>; // not configured
|
||||
dnsrps-options { <unspecified-text> }; // not configured
|
||||
dnssec-accept-expired <boolean>;
|
||||
dnssec-dnskey-kskonly <boolean>;
|
||||
|
|
|
|||
|
|
@ -33,9 +33,9 @@
|
|||
#include <dns/rdatasetiter.h>
|
||||
#include <dns/rpz.h>
|
||||
|
||||
librpz_t *librpz;
|
||||
librpz_t *librpz = NULL;
|
||||
librpz_emsg_t librpz_lib_open_emsg;
|
||||
static void *librpz_handle;
|
||||
static void *librpz_handle = NULL;
|
||||
|
||||
#define RPSDB_MAGIC ISC_MAGIC('R', 'P', 'Z', 'F')
|
||||
#define VALID_RPSDB(rpsdb) ((rpsdb)->common.impmagic == RPSDB_MAGIC)
|
||||
|
|
@ -98,12 +98,6 @@ dnsrps_log_fnc(librpz_log_level_t level, void *ctxt, const char *buf) {
|
|||
}
|
||||
|
||||
switch (level) {
|
||||
case LIBRPZ_LOG_FATAL:
|
||||
case LIBRPZ_LOG_ERROR: /* errors */
|
||||
default:
|
||||
isc_level = DNS_RPZ_ERROR_LEVEL;
|
||||
break;
|
||||
|
||||
case LIBRPZ_LOG_TRACE1: /* big events such as dnsrpzd starts */
|
||||
isc_level = DNS_RPZ_INFO_LEVEL;
|
||||
break;
|
||||
|
|
@ -119,6 +113,12 @@ dnsrps_log_fnc(librpz_log_level_t level, void *ctxt, const char *buf) {
|
|||
case LIBRPZ_LOG_TRACE4: /* librpz lookups */
|
||||
isc_level = DNS_RPZ_DEBUG_LEVEL3;
|
||||
break;
|
||||
|
||||
case LIBRPZ_LOG_FATAL:
|
||||
case LIBRPZ_LOG_ERROR: /* errors */
|
||||
default:
|
||||
isc_level = DNS_RPZ_ERROR_LEVEL;
|
||||
break;
|
||||
}
|
||||
isc_log_write(dns_lctx, DNS_LOGCATEGORY_RPZ, DNS_LOGMODULE_RBTDB,
|
||||
isc_level, "dnsrps: %s", buf);
|
||||
|
|
@ -129,7 +129,7 @@ dnsrps_log_fnc(librpz_log_level_t level, void *ctxt, const char *buf) {
|
|||
* This is not thread safe, but it is called by a single thread.
|
||||
*/
|
||||
isc_result_t
|
||||
dns_dnsrps_server_create(void) {
|
||||
dns_dnsrps_server_create(const char *librpz_path) {
|
||||
librpz_emsg_t emsg;
|
||||
|
||||
INSIST(clist == NULL);
|
||||
|
|
@ -140,14 +140,9 @@ dns_dnsrps_server_create(void) {
|
|||
* Notice if librpz is available.
|
||||
*/
|
||||
librpz = librpz_lib_open(&librpz_lib_open_emsg, &librpz_handle,
|
||||
DNSRPS_LIBRPZ_PATH);
|
||||
/*
|
||||
* Stop now without complaining if librpz is not available.
|
||||
* Complain later if and when librpz is needed for a view with
|
||||
* "dnsrps-enable yes" (including the default view).
|
||||
*/
|
||||
librpz_path);
|
||||
if (librpz == NULL) {
|
||||
return (ISC_R_SUCCESS);
|
||||
return (ISC_R_FILENOTFOUND);
|
||||
}
|
||||
|
||||
isc_mutex_init(&dnsrps_mutex);
|
||||
|
|
@ -176,7 +171,7 @@ dns_dnsrps_server_destroy(void) {
|
|||
librpz->clist_detach(&clist);
|
||||
}
|
||||
|
||||
#ifdef LIBRPZ_USE_DLOPEN
|
||||
#if DNSRPS_LIB_OPEN == 2
|
||||
if (librpz != NULL) {
|
||||
INSIST(librpz_handle != NULL);
|
||||
if (dlclose(librpz_handle) != 0) {
|
||||
|
|
@ -185,8 +180,9 @@ dns_dnsrps_server_destroy(void) {
|
|||
"dnsrps: dlclose(): %s", dlerror());
|
||||
}
|
||||
librpz_handle = NULL;
|
||||
librpz = NULL;
|
||||
}
|
||||
#endif /* ifdef LIBRPZ_USE_DLOPEN */
|
||||
#endif
|
||||
}
|
||||
|
||||
/*
|
||||
|
|
@ -323,9 +319,6 @@ dns_dnsrps_2policy(librpz_policy_t rps_policy) {
|
|||
dns_rpz_type_t
|
||||
dns_dnsrps_trig2type(librpz_trig_t trig) {
|
||||
switch (trig) {
|
||||
case LIBRPZ_TRIG_BAD:
|
||||
default:
|
||||
return (DNS_RPZ_TYPE_BAD);
|
||||
case LIBRPZ_TRIG_CLIENT_IP:
|
||||
return (DNS_RPZ_TYPE_CLIENT_IP);
|
||||
case LIBRPZ_TRIG_QNAME:
|
||||
|
|
@ -336,6 +329,9 @@ dns_dnsrps_trig2type(librpz_trig_t trig) {
|
|||
return (DNS_RPZ_TYPE_NSDNAME);
|
||||
case LIBRPZ_TRIG_NSIP:
|
||||
return (DNS_RPZ_TYPE_NSIP);
|
||||
case LIBRPZ_TRIG_BAD:
|
||||
default:
|
||||
return (DNS_RPZ_TYPE_BAD);
|
||||
}
|
||||
}
|
||||
|
||||
|
|
@ -345,9 +341,6 @@ dns_dnsrps_trig2type(librpz_trig_t trig) {
|
|||
librpz_trig_t
|
||||
dns_dnsrps_type2trig(dns_rpz_type_t type) {
|
||||
switch (type) {
|
||||
case DNS_RPZ_TYPE_BAD:
|
||||
default:
|
||||
return (LIBRPZ_TRIG_BAD);
|
||||
case DNS_RPZ_TYPE_CLIENT_IP:
|
||||
return (LIBRPZ_TRIG_CLIENT_IP);
|
||||
case DNS_RPZ_TYPE_QNAME:
|
||||
|
|
@ -358,6 +351,9 @@ dns_dnsrps_type2trig(dns_rpz_type_t type) {
|
|||
return (LIBRPZ_TRIG_NSDNAME);
|
||||
case DNS_RPZ_TYPE_NSIP:
|
||||
return (LIBRPZ_TRIG_NSIP);
|
||||
case DNS_RPZ_TYPE_BAD:
|
||||
default:
|
||||
return (LIBRPZ_TRIG_BAD);
|
||||
}
|
||||
}
|
||||
|
||||
|
|
@ -497,6 +493,16 @@ rpsdb_findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
|
|||
REQUIRE(node == &rpsdb->data_node);
|
||||
|
||||
switch (rpsdb->result.policy) {
|
||||
case LIBRPZ_POLICY_NXDOMAIN:
|
||||
return (DNS_R_NXDOMAIN);
|
||||
|
||||
case LIBRPZ_POLICY_NODATA:
|
||||
return (DNS_R_NXRRSET);
|
||||
|
||||
case LIBRPZ_POLICY_RECORD:
|
||||
case LIBRPZ_POLICY_CNAME:
|
||||
break;
|
||||
|
||||
case LIBRPZ_POLICY_UNDEFINED:
|
||||
case LIBRPZ_POLICY_DELETED:
|
||||
case LIBRPZ_POLICY_PASSTHRU:
|
||||
|
|
@ -509,16 +515,6 @@ rpsdb_findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
|
|||
"impossible dnsrps policy %d at %s:%d",
|
||||
rpsdb->result.policy, __FILE__, __LINE__);
|
||||
return (DNS_R_SERVFAIL);
|
||||
|
||||
case LIBRPZ_POLICY_NXDOMAIN:
|
||||
return (DNS_R_NXDOMAIN);
|
||||
|
||||
case LIBRPZ_POLICY_NODATA:
|
||||
return (DNS_R_NXRRSET);
|
||||
|
||||
case LIBRPZ_POLICY_RECORD:
|
||||
case LIBRPZ_POLICY_CNAME:
|
||||
break;
|
||||
}
|
||||
|
||||
if (type == dns_rdatatype_soa) {
|
||||
|
|
|
|||
|
|
@ -79,7 +79,7 @@ dns_dnsrps_type2trig(dns_rpz_type_t type);
|
|||
* Start dnsrps for the entire server.
|
||||
*/
|
||||
isc_result_t
|
||||
dns_dnsrps_server_create(void);
|
||||
dns_dnsrps_server_create(const char *librpz_path);
|
||||
|
||||
/*
|
||||
* Stop dnsrps for the entire server.
|
||||
|
|
|
|||
|
|
@ -55,6 +55,8 @@
|
|||
#define LIBDEF_F(f)
|
||||
#endif /* ifdef LIBRPZ_INTERNAL */
|
||||
|
||||
#define LIBRPZ_MAXDOMAIN 255
|
||||
|
||||
/*
|
||||
* Response Policy Zone triggers.
|
||||
* Comparisons of trigger precedences require
|
||||
|
|
@ -125,7 +127,7 @@ typedef struct librpz_prefix {
|
|||
typedef uint8_t librpz_dsize_t;
|
||||
typedef struct librpz_domain {
|
||||
librpz_dsize_t size; /* of only .d */
|
||||
uint8_t d[0]; /* variable length wire format */
|
||||
uint8_t d[]; /* variable length wire format */
|
||||
} librpz_domain_t;
|
||||
|
||||
/*
|
||||
|
|
@ -133,7 +135,7 @@ typedef struct librpz_domain {
|
|||
*/
|
||||
typedef struct librpz_domain_buf {
|
||||
librpz_dsize_t size;
|
||||
uint8_t d[NS_MAXCDNAME];
|
||||
uint8_t d[LIBRPZ_MAXDOMAIN];
|
||||
} librpz_domain_buf_t;
|
||||
|
||||
/*
|
||||
|
|
@ -145,7 +147,7 @@ typedef struct {
|
|||
uint16_t class; /* network byte order */
|
||||
uint32_t ttl; /* network byte order */
|
||||
uint16_t rdlength; /* network byte order */
|
||||
uint8_t rdata[0]; /* variable length */
|
||||
uint8_t rdata[]; /* variable length */
|
||||
} librpz_rr_t;
|
||||
|
||||
/*
|
||||
|
|
@ -169,8 +171,7 @@ typedef struct librpz_result {
|
|||
librpz_dznum_t dznum; /* dnsrpzd zone number */
|
||||
librpz_cznum_t cznum; /* librpz client zone number */
|
||||
librpz_trig_t trig : LIBRPZ_TRIG_SIZE;
|
||||
bool log : 1; /* log rewrite given librpz_log_level
|
||||
* */
|
||||
bool log : 1; /* log rewrite at given log level */
|
||||
} librpz_result_t;
|
||||
|
||||
/**
|
||||
|
|
@ -226,14 +227,15 @@ typedef struct {
|
|||
typedef bool(librpz_parse_log_opt_t)(librpz_emsg_t *emsg, const char *arg);
|
||||
LIBDEF_F(parse_log_opt)
|
||||
|
||||
typedef void(librpz_vpemsg_t)(librpz_emsg_t *emsg, const char *p, va_list args);
|
||||
typedef void(librpz_vpemsg_t)(librpz_emsg_t *emsg, const char *p, va_list args)
|
||||
LIBRPZ_PF(2, 0);
|
||||
LIBDEF_F(vpemsg)
|
||||
typedef void(librpz_pemsg_t)(librpz_emsg_t *emsg, const char *p, ...)
|
||||
LIBRPZ_PF(2, 3);
|
||||
LIBDEF_F(pemsg)
|
||||
|
||||
typedef void(librpz_vlog_t)(librpz_log_level_t level, void *ctx, const char *p,
|
||||
va_list args);
|
||||
va_list args) LIBRPZ_PF(3, 0);
|
||||
LIBDEF_F(vlog)
|
||||
typedef void(librpz_log_t)(librpz_log_level_t level, void *ctx, const char *p,
|
||||
...) LIBRPZ_PF(3, 4);
|
||||
|
|
@ -845,7 +847,7 @@ extern librpz_0_t librpz_def_0;
|
|||
typedef librpz_0_t librpz_t;
|
||||
extern librpz_t *librpz;
|
||||
|
||||
#if LIBRPZ_LIB_OPEN == 2
|
||||
#if DNSRPS_LIB_OPEN == 2
|
||||
#include <dlfcn.h>
|
||||
|
||||
/**
|
||||
|
|
@ -932,13 +934,13 @@ librpz_lib_open(librpz_emsg_t *emsg, void **dl_handle, const char *path) {
|
|||
*dl_handle = NULL;
|
||||
}
|
||||
|
||||
#if LIBRPZ_LIB_OPEN == 1
|
||||
#if DNSRPS_LIB_OPEN == 1
|
||||
emsg->c[0] = '\0';
|
||||
return (&LIBRPZ_DEF);
|
||||
#else /* if LIBRPZ_LIB_OPEN == 1 */
|
||||
#else /* if DNSRPS_LIB_OPEN == 1 */
|
||||
snprintf(emsg->c, sizeof(librpz_emsg_t),
|
||||
"librpz not available via ./configure");
|
||||
return (NULL);
|
||||
#endif /* LIBRPZ_LIB_OPEN */
|
||||
#endif /* DNSRPS_LIB_OPEN */
|
||||
}
|
||||
#endif /* LIBRPZ_LIB_OPEN */
|
||||
|
|
|
|||
|
|
@ -1206,6 +1206,11 @@ static cfg_clausedef_t options_clauses[] = {
|
|||
{ "datasize", &cfg_type_size, CFG_CLAUSEFLAG_ANCIENT },
|
||||
{ "deallocate-on-exit", NULL, CFG_CLAUSEFLAG_ANCIENT },
|
||||
{ "directory", &cfg_type_qstring, CFG_CLAUSEFLAG_CALLBACK },
|
||||
#ifdef USE_DNSRPS
|
||||
{ "dnsrps-library", &cfg_type_qstring, 0 },
|
||||
#else /* ifdef USE_DNSRPS */
|
||||
{ "dnsrps-library", &cfg_type_qstring, CFG_CLAUSEFLAG_NOTCONFIGURED },
|
||||
#endif /* ifdef USE_DNSRPS */
|
||||
#ifdef HAVE_DNSTAP
|
||||
{ "dnstap-output", &cfg_type_dnstapoutput, 0 },
|
||||
{ "dnstap-identity", &cfg_type_serverid, 0 },
|
||||
|
|
|
|||
|
|
@ -3348,6 +3348,8 @@ dnsrps_ck(librpz_emsg_t *emsg, ns_client_t *client, rpsdb_t *rpsdb,
|
|||
isc_region_t region;
|
||||
librpz_domain_buf_t pname_buf;
|
||||
|
||||
CTRACE(ISC_LOG_DEBUG(3), "dnsrps_ck");
|
||||
|
||||
if (!librpz->rsp_result(emsg, &rpsdb->result, recursed, rpsdb->rsp)) {
|
||||
return (-1);
|
||||
}
|
||||
|
|
@ -3396,18 +3398,18 @@ static bool
|
|||
dnsrps_set_p(librpz_emsg_t *emsg, ns_client_t *client, dns_rpz_st_t *st,
|
||||
dns_rdatatype_t qtype, dns_rdataset_t **p_rdatasetp,
|
||||
bool recursed) {
|
||||
rpsdb_t *rpsdb;
|
||||
rpsdb_t *rpsdb = NULL;
|
||||
librpz_domain_buf_t pname_buf;
|
||||
isc_region_t region;
|
||||
dns_zone_t *p_zone;
|
||||
dns_db_t *p_db;
|
||||
dns_dbnode_t *p_node;
|
||||
dns_zone_t *p_zone = NULL;
|
||||
dns_db_t *p_db = NULL;
|
||||
dns_dbnode_t *p_node = NULL;
|
||||
dns_rpz_policy_t policy;
|
||||
dns_fixedname_t foundf;
|
||||
dns_name_t *found;
|
||||
dns_rdatatype_t foundtype, searchtype;
|
||||
isc_result_t result;
|
||||
|
||||
CTRACE(ISC_LOG_DEBUG(3), "dnsrps_set_p");
|
||||
|
||||
rpsdb = (rpsdb_t *)st->rpsdb;
|
||||
|
||||
if (!librpz->rsp_result(emsg, &rpsdb->result, recursed, rpsdb->rsp)) {
|
||||
|
|
@ -3437,9 +3439,6 @@ dnsrps_set_p(librpz_emsg_t *emsg, ns_client_t *client, dns_rpz_st_t *st,
|
|||
region.length = pname_buf.size;
|
||||
dns_name_fromregion(st->p_name, ®ion);
|
||||
|
||||
p_zone = NULL;
|
||||
p_db = NULL;
|
||||
p_node = NULL;
|
||||
rpz_ready(client, p_rdatasetp);
|
||||
dns_db_attach(st->rpsdb, &p_db);
|
||||
policy = dns_dnsrps_2policy(rpsdb->result.policy);
|
||||
|
|
@ -3453,6 +3452,9 @@ dnsrps_set_p(librpz_emsg_t *emsg, ns_client_t *client, dns_rpz_st_t *st,
|
|||
result = DNS_R_NXRRSET;
|
||||
policy = DNS_RPZ_POLICY_NODATA;
|
||||
} else {
|
||||
dns_fixedname_t foundf;
|
||||
dns_name_t *found = NULL;
|
||||
|
||||
/*
|
||||
* Get the next (and so first) RR from the policy node.
|
||||
* If it is a CNAME, then look for it regardless of the
|
||||
|
|
@ -3464,6 +3466,7 @@ dnsrps_set_p(librpz_emsg_t *emsg, ns_client_t *client, dns_rpz_st_t *st,
|
|||
{
|
||||
return (false);
|
||||
}
|
||||
|
||||
if (foundtype == dns_rdatatype_cname) {
|
||||
searchtype = dns_rdatatype_cname;
|
||||
} else {
|
||||
|
|
@ -3511,6 +3514,8 @@ dnsrps_rewrite_ip(ns_client_t *client, const isc_netaddr_t *netaddr,
|
|||
librpz_emsg_t emsg;
|
||||
isc_result_t result;
|
||||
|
||||
CTRACE(ISC_LOG_DEBUG(3), "dnsrps_rewrite_ip");
|
||||
|
||||
st = client->query.rpz_st;
|
||||
rpsdb = (rpsdb_t *)st->rpsdb;
|
||||
|
||||
|
|
@ -3567,6 +3572,8 @@ dnsrps_rewrite_name(ns_client_t *client, dns_name_t *trig_name, bool recursed,
|
|||
librpz_emsg_t emsg;
|
||||
isc_result_t result;
|
||||
|
||||
CTRACE(ISC_LOG_DEBUG(3), "dnsrps_rewrite_name");
|
||||
|
||||
st = client->query.rpz_st;
|
||||
rpsdb = (rpsdb_t *)st->rpsdb;
|
||||
|
||||
|
|
@ -4201,6 +4208,7 @@ rpz_rewrite(ns_client_t *client, dns_rdatatype_t qtype, isc_result_t qresult,
|
|||
if (st->rpsdb != NULL) {
|
||||
dns_db_detach(&st->rpsdb);
|
||||
}
|
||||
CTRACE(ISC_LOG_DEBUG(3), "dns_dnsrps_rewrite_init");
|
||||
result = dns_dnsrps_rewrite_init(
|
||||
&emsg, st, rpzs, client->query.qname,
|
||||
client->manager->mctx, RECURSIONOK(client));
|
||||
|
|
|
|||
Loading…
Reference in a new issue