iterate: tests for CNAME chain restrictions

diff --git a/lib/layer/test.integr/deckard.yaml b/lib/layer/test.integr/deckard.yaml
new file mode 100644 (file)
index 0000000..88c934f
--- /dev/null
+++ b/lib/layer/test.integr/deckard.yaml
@@ -0,0 +1,13 @@
+programs:
+- name: kresd
+  binary: kresd
+  additional:
+    - -f
+    - "1"
+  templates:
+    - lib/layer/test.integr/kresd_config.j2
+    - tests/integration/hints_zone.j2
+  configs:
+    - config
+    - hints
+noclean: True

diff --git a/lib/layer/test.integr/iter_cname_length.rpl b/lib/layer/test.integr/iter_cname_length.rpl
new file mode 100644 (file)
index 0000000..cb2ad2f
--- /dev/null
+++ b/lib/layer/test.integr/iter_cname_length.rpl
@@ -0,0 +1,224 @@
+; config options
+       stub-addr: 193.0.14.129         # k.root-servers.net.
+CONFIG_END
+
+SCENARIO_BEGIN Test restriction on CNAME chain length.
+
+
+; k.root-servers.net.
+RANGE_BEGIN 0 100
+       ADDRESS 193.0.14.129
+
+ENTRY_BEGIN
+MATCH opcode qname
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+n1.tld.        IN NS
+SECTION ANSWER
+n1.tld.        IN CNAME        n2.tld.
+n2.tld.        IN CNAME        n3.tld.
+n3.tld.        IN CNAME        n4.tld.
+n4.tld.        IN CNAME        n5.tld.
+n5.tld.        IN CNAME        n6.tld.
+n6.tld.        IN CNAME        n7.sub.
+SECTION AUTHORITY
+sub.           IN NS           ns.sub.
+SECTION ADDITIONAL
+ns.sub.                IN A            194.0.14.1
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qname
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+n2.tld.        IN NS
+SECTION ANSWER
+n2.tld.        IN CNAME        n3.tld.
+n3.tld.        IN CNAME        n4.tld.
+n4.tld.        IN CNAME        n5.tld.
+n5.tld.        IN CNAME        n6.tld.
+n6.tld.        IN CNAME        n7.sub.
+SECTION AUTHORITY
+sub.           IN NS           ns.sub.
+SECTION ADDITIONAL
+ns.sub.                IN A            194.0.14.1
+ENTRY_END
+
+
+; empty non-terminal for query name minimization
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR AA NOERROR
+SECTION QUESTION
+tld.   IN NS
+SECTION ANSWER
+ENTRY_END
+
+
+
+; sub. subdomains
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+sub.           IN NS
+SECTION AUTHORITY
+sub.           IN NS           ns.sub.
+SECTION ADDITIONAL
+ns.sub.                IN A            194.0.14.1
+ENTRY_END
+
+RANGE_END
+
+
+; ns.sub.
+RANGE_BEGIN 0 100
+       ADDRESS 194.0.14.1
+
+ENTRY_BEGIN
+MATCH opcode qname qtype
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns.sub.                IN A
+SECTION ANSWER
+ns.sub.                IN A            194.0.14.1
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qname qtype
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns.sub.                IN AAAA
+SECTION ANSWER
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qname qtype
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+n7.sub.                IN A
+SECTION ANSWER
+n7.sub.        IN CNAME        n8.sub.
+n8.sub.        IN CNAME        n9.sub.
+n9.sub.        IN CNAME        n10.sub.
+n10.sub.       IN CNAME        n11.sub.
+n11.sub.       IN CNAME        n12.sub.
+n12.sub.       IN CNAME        n13.sub.
+n13.sub.       IN CNAME        n14.sub.
+n14.sub.       IN A            198.18.0.1
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qname qtype
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+loop7.sub.             IN A
+SECTION ANSWER
+loop7.sub.     IN CNAME        loop8.sub.
+loop8.sub.     IN CNAME        loop9.sub.
+loop9.sub.     IN CNAME        loop10.sub.
+loop10.sub.    IN CNAME        loop11.sub.
+; loop11 -> loop7 -> ... -> loop11
+loop11.sub.    IN CNAME        loop7.sub.
+loop12.sub.    IN CNAME        loop13.sub.
+loop13.sub.    IN CNAME        loop14.sub.
+loop14.sub.    IN A            198.18.0.1
+ENTRY_END
+
+RANGE_END
+
+; maximum allowed chain length
+STEP 10 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+n2.tld.        IN A
+ENTRY_END
+
+STEP 11 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+n2.tld.        IN A
+SECTION ANSWER
+n2.tld.        IN CNAME        n3.tld.
+n3.tld.        IN CNAME        n4.tld.
+n4.tld.        IN CNAME        n5.tld.
+n5.tld.        IN CNAME        n6.tld.
+n6.tld.        IN CNAME        n7.sub.
+n7.sub.        IN CNAME        n8.sub.
+n8.sub.        IN CNAME        n9.sub.
+n9.sub.        IN CNAME        n10.sub.
+n10.sub.       IN CNAME        n11.sub.
+n11.sub.       IN CNAME        n12.sub.
+n12.sub.       IN CNAME        n13.sub.
+n13.sub.       IN CNAME        n14.sub.
+n14.sub.       IN A            198.18.0.1
+ENTRY_END
+
+
+; too long CNAME chain across two zones
+STEP 20 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+n1.tld.        IN A
+ENTRY_END
+
+STEP 21 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA SERVFAIL
+SECTION QUESTION
+n1.tld.        IN A
+SECTION ANSWER
+n1.tld.        IN CNAME        n2.tld.
+n2.tld.        IN CNAME        n3.tld.
+n3.tld.        IN CNAME        n4.tld.
+n4.tld.        IN CNAME        n5.tld.
+n5.tld.        IN CNAME        n6.tld.
+n6.tld.        IN CNAME        n7.sub.
+n7.sub.        IN CNAME        n8.sub.
+n8.sub.        IN CNAME        n9.sub.
+n9.sub.        IN CNAME        n10.sub.
+n10.sub.       IN CNAME        n11.sub.
+n11.sub.       IN CNAME        n12.sub.
+n12.sub.       IN CNAME        n13.sub.
+n13.sub.       IN CNAME        n14.sub.
+; This chain is too long (> 13):
+; n14.sub.     IN A            198.18.0.1
+ENTRY_END
+
+
+; CNAME loop detection
+STEP 30 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+loop7.sub.     IN A
+ENTRY_END
+
+STEP 31 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA SERVFAIL
+SECTION QUESTION
+loop7.sub.     IN A
+SECTION ANSWER
+loop7.sub.     IN CNAME        loop8.sub.
+loop8.sub.     IN CNAME        loop9.sub.
+loop9.sub.     IN CNAME        loop10.sub.
+loop10.sub.    IN CNAME        loop11.sub.
+loop11.sub.    IN CNAME        loop7.sub.
+ENTRY_END
+
+SCENARIO_END

diff --git a/lib/layer/test.integr/kresd_config.j2 b/lib/layer/test.integr/kresd_config.j2
new file mode 100644 (file)
index 0000000..add4dfa
--- /dev/null
+++ b/lib/layer/test.integr/kresd_config.j2
@@ -0,0 +1,57 @@
+trust_anchors.remove('.')
+{% for TAF in TRUST_ANCHOR_FILES %}
+-- trust_anchors.add_file('{{TAF}}')
+{% endfor %}
+
+{% raw %}
+-- Disable RFC5011 TA update
+if ta_update then
+        modules.unload('ta_update')
+end
+
+-- Disable RFC8145 signaling, scenario doesn't provide expected answers
+if ta_signal_query then
+        modules.unload('ta_signal_query')
+end
+
+-- Disable RFC8109 priming, scenario doesn't provide expected answers
+if priming then
+        modules.unload('priming')
+end
+
+-- Disable this module because it make one priming query
+if detect_time_skew then
+        modules.unload('detect_time_skew')
+end
+
+_hint_root_file('hints')
+cache.size = 2*MB
+verbose(true)
+{% endraw %}
+
+net = { '{{SELF_ADDR}}' }
+
+
+{% if QMIN == "false" %}
+option('NO_MINIMIZE', true)
+{% else %}
+option('NO_MINIMIZE', false)
+{% endif %}
+
+
+-- Self-checks on globals
+assert(help() ~= nil)
+assert(worker.id ~= nil)
+-- Self-checks on facilities
+assert(cache.count() == 0)
+assert(cache.stats() ~= nil)
+assert(cache.backends() ~= nil)
+assert(worker.stats() ~= nil)
+assert(net.interfaces() ~= nil)
+-- Self-checks on loaded stuff
+assert(net.list()[1].transport.ip == '{{SELF_ADDR}}')
+assert(#modules.list() > 0)
+-- Self-check timers
+ev = event.recurrent(1 * sec, function (ev) return 1 end)
+event.cancel(ev)
+ev = event.after(0, function (ev) return 1 end)

diff --git a/lib/meson.build b/lib/meson.build
index 8303dc044c719ace856625430a2391379eb0bd84..affc53cfbf6b4bef323fa13f292e3930710ce2b1 100644 (file)
--- a/lib/meson.build
+++ b/lib/meson.build
@@ -73,7 +73,8 @@ unit_tests += [
 ]
 
 integr_tests += [
-  ['cache_minimal_nsec', join_paths(meson.current_source_dir(), 'cache', 'test.integr')]
+  ['cache_minimal_nsec', join_paths(meson.current_source_dir(), 'cache', 'test.integr')],
+  ['iter_cname_length' , join_paths(meson.current_source_dir(), 'layer', 'test.integr')],
 ]
 
 libkres_inc = include_directories('..')