From: Evan Hunt <each@isc.org>
Date: Fri, 3 Dec 2021 19:29:56 +0000 (-0800)
Subject: add system test for a no-questions reply over TCP
X-Git-Tag: v9.17.22~48^2~1
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=2f3ded7652e31be2a278c49b6e8e6219a11411b1;p=thirdparty%2Fbind9.git

add system test for a no-questions reply over TCP
---

diff --git a/bin/tests/system/resolver/ans8/ans.pl b/bin/tests/system/resolver/ans8/ans.pl
index 753fc65f65c..0364e13870e 100644
--- a/bin/tests/system/resolver/ans8/ans.pl
+++ b/bin/tests/system/resolver/ans8/ans.pl
@@ -86,8 +86,11 @@ sub handleUDP {
 	# versions just get it completely wrong.
 
 	if ($qname eq "truncated.no-questions") {
-		# QR, AA, TC
+		# QR, AA, TC: forces TCP retry
 		return (pack("nnnnnn", $id, 0x8600, 0, 0, 0, 0));
+	} elsif ($qname eq "tcpalso.no-questions") {
+		# QR, REFUSED: forces TCP retry
+		return (pack("nnnnnn", $id, 0x8205, 0, 0, 0, 0));
 	}
 	# QR, AA
 	return (pack("nnnnnn", $id, 0x8400, 0, 0, 0, 0));
@@ -118,9 +121,15 @@ sub handleTCP {
 	$response->header->qr(1);
 	$response->header->aa(1);
 	$response->header->id($id);
-
 	$response->push("answer", new Net::DNS::RR("$qname 300 A 1.2.3.4"));
-	push(@results, $response->data);
+
+	if ($qname eq "tcpalso.no-questions") {
+		# for this qname we also return a bad reply over TCP
+		# QR, REFUSED, no question section
+		push (@results, pack("nnnnnn", $id, 0x8005, 0, 0, 0, 0));
+	} else {
+		push(@results, $response->data);
+	}
 
 	return \@results;
 }
diff --git a/bin/tests/system/resolver/clean.sh b/bin/tests/system/resolver/clean.sh
index 1d32bc122ed..2a3b2e555c2 100644
--- a/bin/tests/system/resolver/clean.sh
+++ b/bin/tests/system/resolver/clean.sh
@@ -21,6 +21,7 @@ rm -f dig.out dig.out.* dig.*.out.*
 rm -f dig.*.foo.*
 rm -f dig.*.bar.*
 rm -f dig.*.prime.*
+rm -f nextpart.out.*
 rm -f ns4/tld.db
 rm -f ns6/K*
 rm -f ns6/example.net.db.signed ns6/example.net.db
diff --git a/bin/tests/system/resolver/tests.sh b/bin/tests/system/resolver/tests.sh
index 4f2cdc49078..e2a43bdf484 100755
--- a/bin/tests/system/resolver/tests.sh
+++ b/bin/tests/system/resolver/tests.sh
@@ -822,6 +822,27 @@ grep "1\.2\.3\.4" dig.ns5.out.${n} > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 
+n=`expr $n + 1`
+echo_i "check that SERVFAIL is returned for an empty question section via TCP ($n)"
+ret=0
+nextpart ns5/named.run > /dev/null
+# bind to local address so that addresses in log messages are consistent
+# between platforms; use tcp to get SERVFAIL rather than timeout on slow
+# machines
+$DIG $DIGOPTS @10.53.0.5 -b 10.53.0.5 +tcp tcpalso.no-questions. a +tries=3 +time=4 > dig.ns5.out.${n} || ret=1
+grep "status: SERVFAIL" dig.ns5.out.${n} > /dev/null || ret=1
+check_namedrun() {
+nextpartpeek ns5/named.run > nextpart.out.${n}
+grep 'resolving tcpalso.no-questions/A for [^:]*: empty question section, accepting it anyway as TC=1' nextpart.out.${n} > /dev/null || return 1
+grep '(tcpalso.no-questions/A): connecting via TCP' nextpart.out.${n} > /dev/null || return 1
+grep 'resolving tcpalso.no-questions/A for [^:]*: empty question section$' nextpart.out.${n} > /dev/null || return 1
+grep '(tcpalso.no-questions/A): nextitem' nextpart.out.${n} > /dev/null || return 1
+return 0
+}
+retry_quiet 12 check_namedrun || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
 n=`expr $n + 1`
 echo_i "checking SERVFAIL is returned when all authoritative servers return FORMERR ($n)"
 ret=0