Add a new check in the RPZ system test

Check that reloading a response policy zone which has an '$INCLUDE'
directive defined is working as expected.

(cherry picked from commit d81a2457d6fe09a01d60d4204fb80c3e2feec88d)

diff --git a/bin/tests/system/rpz/ns2/tld2.db b/bin/tests/system/rpz/ns2/tld2.db
index c6f2556db59975b6088e76df78edd8fb7b99a841..a66ee16d14d1808e34d8ee629e40d67993fe7bcd 100644 (file)
--- a/bin/tests/system/rpz/ns2/tld2.db
+++ b/bin/tests/system/rpz/ns2/tld2.db
@@ -123,3 +123,6 @@ a7-1                A       192.168.7.1
 
 a7-2           A       192.168.7.2
                TXT     "a7-2 tld2 text"
+
+a8-1           A       192.168.8.1
+               TXT     "a8-1 tld2 text"

diff --git a/bin/tests/system/rpz/ns3/include-rpz.db.in b/bin/tests/system/rpz/ns3/include-rpz.db.in
new file mode 100644 (file)
index 0000000..5133b78
--- /dev/null
+++ b/bin/tests/system/rpz/ns3/include-rpz.db.in
@@ -0,0 +1,14 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+
+$INCLUDE include-rpz.inc

diff --git a/bin/tests/system/rpz/ns3/include-rpz.inc-1.in b/bin/tests/system/rpz/ns3/include-rpz.inc-1.in
new file mode 100644 (file)
index 0000000..5d316a8
--- /dev/null
+++ b/bin/tests/system/rpz/ns3/include-rpz.inc-1.in
@@ -0,0 +1,14 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+@              SOA     include-rpz.  hostmaster.ns.include-rpz. ( 1 3600 1200 604800 60 )
+       NS      ns.tld3.

diff --git a/bin/tests/system/rpz/ns3/include-rpz.inc-2.in b/bin/tests/system/rpz/ns3/include-rpz.inc-2.in
new file mode 100644 (file)
index 0000000..4bce853
--- /dev/null
+++ b/bin/tests/system/rpz/ns3/include-rpz.inc-2.in
@@ -0,0 +1,16 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+@              SOA     include-rpz.  hostmaster.ns.include-rpz. ( 2 3600 1200 604800 60 )
+       NS      ns.tld3.
+
+a8-1.tld2      CNAME   .

diff --git a/bin/tests/system/rpz/ns3/named.conf.j2 b/bin/tests/system/rpz/ns3/named.conf.j2
index 6d8c9e7b66d821ed01ff7b77b2870ef61111a64e..19ed91996876ec4feaf34285355372d83a22f626 100644 (file)
--- a/bin/tests/system/rpz/ns3/named.conf.j2
+++ b/bin/tests/system/rpz/ns3/named.conf.j2
@@ -53,6 +53,7 @@ options {
            zone "bl.tld2";
            zone "manual-update-rpz"    ede forged;
            zone "mixed-case-rpz";
+           zone "include-rpz";
            zone "evil-cname"  policy cname a12.tld2. ede blocked;
            zone "wild-cname"  ede blocked;
            zone "slow-rpz";
@@ -130,6 +131,12 @@ zone "mixed-case-rpz." {
        notify no;
 };
 
+zone "include-rpz." {
+       type primary;
+       file "include-rpz.db";
+       notify no;
+};
+
 zone "slow-rpz." {
     type primary;
     file "slow-rpz.db";

diff --git a/bin/tests/system/rpz/setup.sh b/bin/tests/system/rpz/setup.sh
index 0762a68441b9190bb6a6dcececb9008d27257966..c40782185df265665edffefad20e715334eb6de7 100644 (file)
--- a/bin/tests/system/rpz/setup.sh
+++ b/bin/tests/system/rpz/setup.sh
@@ -43,6 +43,9 @@ cp ns3/wild-cname.db.in ns3/wild-cname.db
 
 cp ns3/mixed-case-rpz-1.db.in ns3/mixed-case-rpz.db
 
+cp ns3/include-rpz.db.in ns3/include-rpz.db
+cp ns3/include-rpz.inc-1.in ns3/include-rpz.inc
+
 # a "big" zone (tested with '-T rpzslow' enabled to slow down loading)
 cp ns3/slow-rpz.db.in ns3/slow-rpz.db
 

diff --git a/bin/tests/system/rpz/tests.sh b/bin/tests/system/rpz/tests.sh
index 7104b0180bde24eefdb732f95ca705be544c931b..6e818661269a16c2e61ce643779d5a9f301f7152 100644 (file)
--- a/bin/tests/system/rpz/tests.sh
+++ b/bin/tests/system/rpz/tests.sh
@@ -795,6 +795,16 @@ if [ native = "$MODE" ]; then
   $DIG -p ${PORT} @$ns3 walled.tld2 >dig.out.$t.after || setret "failed"
   grep "walled\.tld2\..*IN.*A.*10\.0\.0\.1" dig.out.$t.after >/dev/null || setret "failed"
 
+  t=$((t + 1))
+  echo_i "checking rpz with included rules can reload (${t})"
+  $DIG -p ${PORT} @$ns3 a8-1.tld2 >dig.out.$t.before || setret "failed"
+  grep "status: NOERROR" dig.out.$t.before >/dev/null || setret "failed"
+  cp ns3/include-rpz.inc-2.in ns3/include-rpz.inc
+  rndc_reload ns3 $ns3 include-rpz
+  sleep 1
+  $DIG -p ${PORT} @$ns3 a8-1.tld2 >dig.out.$t.after || setret "failed"
+  grep "status: NXDOMAIN" dig.out.$t.after >/dev/null || setret "failed"
+
   t=$((t + 1))
   echo_i "checking the default (unset) extended DNS error code (EDE) (${t})"
   $DIG -p ${PORT} @$ns3 a6-2.tld2. A >dig.out.$t || setret "failed"

diff --git a/bin/tests/system/rpz/tests_sh_rpz.py b/bin/tests/system/rpz/tests_sh_rpz.py
index 303a71f50dfa0c8780369caf7b21b0ddb314e9c9..86fe2acc2bcd52c09ea3caaf8186627f3281faa3 100644 (file)
--- a/bin/tests/system/rpz/tests_sh_rpz.py
+++ b/bin/tests/system/rpz/tests_sh_rpz.py
@@ -39,6 +39,8 @@ pytestmark = pytest.mark.extra_artifacts(
         "ns3/bl.tld2.db",
         "ns3/evil-cname.db",
         "ns3/fast-expire.db",
+        "ns3/include-rpz.db",
+        "ns3/include-rpz.inc",
         "ns3/manual-update-rpz.db",
         "ns3/mixed-case-rpz.db",
         "ns3/named.conf.tmp",

diff --git a/bin/tests/system/rpz/tests_sh_rpz_dnsrps.py b/bin/tests/system/rpz/tests_sh_rpz_dnsrps.py
index e286db9ce5f76a30408a815c38b65ad3a7e5ebf1..1b7e33b01481fa0abaee628c875e7bab939f9e81 100644 (file)
--- a/bin/tests/system/rpz/tests_sh_rpz_dnsrps.py
+++ b/bin/tests/system/rpz/tests_sh_rpz_dnsrps.py
@@ -43,6 +43,8 @@ pytestmark = [
             "ns3/bl.tld2.db",
             "ns3/evil-cname.db",
             "ns3/fast-expire.db",
+            "ns3/include-rpz.db",
+            "ns3/include-rpz.inc",
             "ns3/manual-update-rpz.db",
             "ns3/mixed-case-rpz.db",
             "ns3/named.conf.tmp",