upstream/bind9
1
0
Fork 0
mirror of https://github.com/isc-projects/bind9.git synced 2026-05-28 04:34:54 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

add a test for allow-recursion/allow-query-cache inheritance

Browse source 
allow-recursion is set to "none" in the options block and to
"any" in the view.  allow-query-cache in the view should inherit
the "any", not the "none". (currently this test does not pass.)
This commit is contained in:
Evan Hunt 2025-11-19 16:35:31 -08:00
parent fec55d786a
commit f9340fc152
5 changed files with 237 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

42
bin/tests/system/allow-query/ns3/named5.conf.in Normal file
View file

@ -0,0 +1,42 @@
/*
* Copyright (C) Internet Systems Consortium, Inc. ("ISC")
*
* SPDX-License-Identifier: MPL-2.0
*
* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
*
* See the COPYRIGHT file distributed with this work for additional
* information regarding copyright ownership.
*/
options {
port @PORT@;
pid-file "named.pid";
listen-on { 10.53.0.3; 10.53.1.2; };
listen-on-v6 { none; };
recursion no;
allow-recursion { none; };
dnssec-validation no;
};
key rndc_key {
secret "1234abcd8765";
algorithm @DEFAULT_HMAC@;
};
controls {
inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
};
view internal {
match-destinations { 10.53.0.3; };
zone "." {
type hint;
file "../../_common/root.hint";
};
recursion yes;
allow-recursion { any; };
};

41
bin/tests/system/allow-query/ns3/named6.conf.in Normal file
View file

@ -0,0 +1,41 @@
/*
* Copyright (C) Internet Systems Consortium, Inc. ("ISC")
*
* SPDX-License-Identifier: MPL-2.0
*
* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
*
* See the COPYRIGHT file distributed with this work for additional
* information regarding copyright ownership.
*/
options {
port @PORT@;
pid-file "named.pid";
listen-on { 10.53.0.3; };
listen-on-v6 { none; };
recursion no;
allow-query-cache { none; };
dnssec-validation no;
};
key rndc_key {
secret "1234abcd8765";
algorithm @DEFAULT_HMAC@;
};
controls {
inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
};
view internal {
match-destinations { 10.53.0.3; };
zone "." {
type hint;
file "../../_common/root.hint";
};
recursion yes;
allow-recursion{ any; };
};

41
bin/tests/system/allow-query/ns3/named7.conf.in Normal file
View file

@ -0,0 +1,41 @@
/*
* Copyright (C) Internet Systems Consortium, Inc. ("ISC")
*
* SPDX-License-Identifier: MPL-2.0
*
* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
*
* See the COPYRIGHT file distributed with this work for additional
* information regarding copyright ownership.
*/
options {
port @PORT@;
pid-file "named.pid";
listen-on { 10.53.0.3; };
listen-on-v6 { none; };
recursion no;
allow-recursion { none; };
dnssec-validation no;
};
key rndc_key {
secret "1234abcd8765";
algorithm @DEFAULT_HMAC@;
};
controls {
inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
};
view internal {
match-destinations { 10.53.0.3; };
zone "." {
type hint;
file "../../_common/root.hint";
};
recursion yes;
allow-query{ any; };
};

42
bin/tests/system/allow-query/ns3/named8.conf.in Normal file
View file

@ -0,0 +1,42 @@
/*
* Copyright (C) Internet Systems Consortium, Inc. ("ISC")
*
* SPDX-License-Identifier: MPL-2.0
*
* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
* file, you can obtain one at https://mozilla.org/MPL/2.0/.
*
* See the COPYRIGHT file distributed with this work for additional
* information regarding copyright ownership.
*/
options {
port @PORT@;
pid-file "named.pid";
listen-on { 10.53.0.3; 10.53.0.4; 10.53.1.2; };
listen-on-v6 { none; };
recursion no;
allow-query-cache { none; };
dnssec-validation no;
};
key rndc_key {
secret "1234abcd8765";
algorithm @DEFAULT_HMAC@;
};
controls {
inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
};
view internal {
zone "." {
type hint;
file "../../_common/root.hint";
};
recursion yes;
allow-query-cache { 10.53.0.3; 10.53.0.4; };
allow-query { 10.53.0.4; };
};

71
bin/tests/system/allow-query/tests.sh
View file

@ -734,5 +734,76 @@ nextpart ns3/named.run | grep 'allow-recursion-on did not match' >/dev/null || r
if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status + ret))
# Test 63 - allow-query-cache inheritance from allow-recursion
n=$((n + 1))
copy_setports ns3/named5.conf.in ns3/named.conf
rndc_reload ns3 10.53.0.3
echo_i "test $n: inheritance of allow-query-cache from allow-recursion"
ret=0
# this should be allowed
$DIG -p ${PORT} @10.53.0.3 e.normal.example a >dig.out.ns3.1.$n || ret=1
grep 'ANSWER: 1' dig.out.ns3.1.$n >/dev/null || ret=1
# this should be prohibited
$DIG -p ${PORT} @10.53.1.2 f.normal.example a >dig.out.ns3.2.$n || ret=1
grep 'recursion requested but not available' dig.out.ns3.2.$n >/dev/null || ret=1
grep 'status: REFUSED' dig.out.ns3.2.$n >/dev/null || ret=1
grep 'EDE: 18 (Prohibited)' dig.out.ns3.2.$n >/dev/null || ret=1
grep 'EDE: 20' dig.out.ns3.2.$n >/dev/null && ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status + ret))
# Test 64 - allow-query-cache no inheritance from allow-recursion as it is
# defined in the options
n=$((n + 1))
copy_setports ns3/named6.conf.in ns3/named.conf
rndc_reload ns3 10.53.0.3
echo_i "test $n: allow-query-cache defined in options, so it does not inherit from allow-recursion"
ret=0
$DIG -p ${PORT} @10.53.0.3 f.normal.example a >dig.out.ns3.1.$n || ret=1
grep 'recursion requested but not available' dig.out.ns3.1.$n >/dev/null || ret=1
grep 'status: REFUSED' dig.out.ns3.1.$n >/dev/null || ret=1
grep 'EDE: 18 (Prohibited)' dig.out.ns3.1.$n >/dev/null || ret=1
grep 'EDE: 20' dig.out.ns3.1.$n >/dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status + ret))
# Test 65 - allow-query-cache inherits from allow-recursion before allow-query
n=$((n + 1))
copy_setports ns3/named7.conf.in ns3/named.conf
rndc_reload ns3 10.53.0.3
echo_i "test $n: allow-query-cache inherits from allow-recursion before allow-query"
ret=0
$DIG -p ${PORT} -b 10.53.0.3 @10.53.0.3 f.normal.example a >dig.out.ns3.1.$n || ret=1
grep 'recursion requested but not available' dig.out.ns3.1.$n >/dev/null || ret=1
grep 'status: REFUSED' dig.out.ns3.1.$n >/dev/null || ret=1
grep 'EDE: 18 (Prohibited)' dig.out.ns3.1.$n >/dev/null || ret=1
grep 'EDE: 20' dig.out.ns3.1.$n >/dev/null || ret=1
if [ $ret != 0 ]; then echo_i "failed"; fi
status=$((status + ret))
# Test 66 - allow-recursion inheritance from allow-query
n=$((n + 1))
copy_setports ns3/named8.conf.in ns3/named.conf
rndc_reload ns3 10.53.0.3
echo_i "test $n: inheritance of allow-query-cache from allow-recursion"
ret=0
# this should be prohibited (10.53.1.2 does not have recursion allowed)
$DIG -p ${PORT} -b 10.53.1.2 @10.53.1.2 f.normal.example a >dig.out.ns3.1.$n || ret=1
grep 'recursion requested but not available' dig.out.ns3.1.$n >/dev/null || ret=1
grep 'status: REFUSED' dig.out.ns3.1.$n >/dev/null || ret=1
grep 'EDE: 18 (Prohibited)' dig.out.ns3.1.$n >/dev/null || ret=1
grep 'EDE: 20' dig.out.ns3.1.$n >/dev/null || ret=1
# this should be allowed
$DIG -p ${PORT} -b 10.53.0.4 @10.53.0.4 f.normal.example a >dig.out.ns3.2.$n || ret=1
grep 'ANSWER: 1' dig.out.ns3.2.$n >/dev/null || ret=1
# this should be allowed
$DIG -p ${PORT} -b 10.53.0.4 @10.53.0.4 e.normal.example a >dig.out.ns3.3.$n || ret=1
grep 'ANSWER: 1' dig.out.ns3.3.$n >/dev/null || ret=1
status=$((status + ret))
if [ $ret != 0 ]; then echo_i "failed"; fi
echo_i "exit status: $status"
[ $status -eq 0 ] || exit 1