check 'update-policy 6to4-self' over IPv4

(cherry picked from commit b28e5ff72174ebc91f0247e22efa6177fa0ccfcc)

diff --git a/bin/tests/system/nsupdate/clean.sh b/bin/tests/system/nsupdate/clean.sh
index 689c2f589af4af41463a4664c88da79428c7a299..933a77ba2ab15215119acfa545f50b75c1ef0eb9 100644 (file)
--- a/bin/tests/system/nsupdate/clean.sh
+++ b/bin/tests/system/nsupdate/clean.sh
@@ -51,6 +51,7 @@ rm -f ns3/many.test.bk
 rm -f ns3/nsec3param.test.db
 rm -f ns3/too-big.test.db
 rm -f ns5/local.db
+rm -f ns6/2.0.0.2.ip6.addr.db
 rm -f ns6/in-addr.db
 rm -f ns7/_default.tsigkeys
 rm -f ns7/example.com.db

diff --git a/bin/tests/system/nsupdate/ns6/2.0.0.2.ip6.addr.db.in b/bin/tests/system/nsupdate/ns6/2.0.0.2.ip6.addr.db.in
new file mode 100644 (file)
index 0000000..71609c3
--- /dev/null
+++ b/bin/tests/system/nsupdate/ns6/2.0.0.2.ip6.addr.db.in
@@ -0,0 +1,21 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300       ; 5 minutes
+@              IN SOA  ns5.local.nil. hostmaster.local.nil. (
+                               1          ; serial
+                               2000       ; refresh (2000 seconds)
+                               2000       ; retry (2000 seconds)
+                               1814400    ; expire (3 weeks)
+                               3600       ; minimum (1 hour)
+                               )
+                       NS      ns6
+ns6                    A       10.53.0.6

diff --git a/bin/tests/system/nsupdate/ns6/named.conf.in b/bin/tests/system/nsupdate/ns6/named.conf.in
index c636cfc7542e86ec1a5295516cdd1b0f34008cad..5ed16235462a19cd18a344a88c933d2a8cc45c00 100644 (file)
--- a/bin/tests/system/nsupdate/ns6/named.conf.in
+++ b/bin/tests/system/nsupdate/ns6/named.conf.in
@@ -39,3 +39,9 @@ zone "in-addr.arpa" {
        file "in-addr.db";
        update-policy { grant * tcp-self . PTR(1) ANY(2) A; };
 };
+
+zone "2.0.0.2.ip6.arpa" {
+       type primary;
+       file "2.0.0.2.ip6.addr.db";
+       update-policy { grant * 6to4-self . NS(10) DS(4); };
+};

diff --git a/bin/tests/system/nsupdate/setup.sh b/bin/tests/system/nsupdate/setup.sh
index 107449504e198e5e67f04b34e8a124a823c78a1a..e901ea05b897eca20c8f66361480de9cfd328ea2 100644 (file)
--- a/bin/tests/system/nsupdate/setup.sh
+++ b/bin/tests/system/nsupdate/setup.sh
@@ -107,6 +107,7 @@ cp ns2/sample.db.in ns2/sample.db
 cp -f ns1/maxjournal.db.in ns1/maxjournal.db
 
 cp -f ns5/local.db.in ns5/local.db
+cp -f ns6/2.0.0.2.ip6.addr.db.in ns6/2.0.0.2.ip6.addr.db
 cp -f ns6/in-addr.db.in ns6/in-addr.db
 cp -f ns7/in-addr.db.in ns7/in-addr.db
 cp -f ns7/example.com.db.in ns7/example.com.db

diff --git a/bin/tests/system/nsupdate/tests.sh b/bin/tests/system/nsupdate/tests.sh
index b69db64d3cf328a4c3965016cf32d8fa1b4f2b65..6ed09f6a79c43cc438c6c9d8cbff8a6cd7254604 100755 (executable)
--- a/bin/tests/system/nsupdate/tests.sh
+++ b/bin/tests/system/nsupdate/tests.sh
@@ -822,6 +822,48 @@ if test $ret -ne 0; then
   status=1
 fi
 
+n=$((n + 1))
+ret=0
+echo_i "check that 'update-policy 6to4-self' refuses update of records via UDP over IPv4 ($n)"
+REVERSE_NAME=6.0.0.0.5.3.a.0.2.0.0.2.ip6.arpa
+$NSUPDATE >nsupdate.out.$n 2>&1 <<END && ret=1
+server 10.53.0.6 ${PORT}
+local 10.53.0.6
+zone 2.0.0.2.ip6.arpa
+update add ${REVERSE_NAME} 600 NS localhost.
+send
+END
+grep REFUSED nsupdate.out.$n >/dev/null 2>&1 || ret=1
+$DIG $DIGOPTS @10.53.0.6 \
+  +tcp +noadd +nosea +nostat +noquest +nocomm +nocmd \
+  $REVERSE_NAME NS >dig.out.ns6.$n
+grep localhost. dig.out.ns6.$n >/dev/null 2>&1 && ret=1
+if test $ret -ne 0; then
+  echo_i "failed"
+  status=1
+fi
+
+n=$((n + 1))
+echo_i "check that 'update-policy 6to4-self' permits update of records for the client's own address via TCP over IPv4 ($n)"
+ret=0
+REVERSE_NAME=6.0.0.0.5.3.a.0.2.0.0.2.ip6.arpa
+$NSUPDATE -v >nsupdate.out.$n 2>&1 <<END || ret=1
+server 10.53.0.6 ${PORT}
+local 10.53.0.6
+zone 2.0.0.2.ip6.arpa
+update add ${REVERSE_NAME} 600 NS localhost.
+send
+END
+grep REFUSED nsupdate.out.$n >/dev/null 2>&1 && ret=1
+$DIG $DIGOPTS @10.53.0.6 \
+  +tcp +noadd +nosea +nostat +noquest +nocomm +nocmd \
+  $REVERSE_NAME NS >dig.out.ns6.$n || ret=1
+grep localhost. dig.out.ns6.$n >/dev/null 2>&1 || ret=1
+if test $ret -ne 0; then
+  echo_i "failed"
+  status=1
+fi
+
 n=$((n + 1))
 ret=0
 echo_i "check that 'update-policy subdomain' is properly enforced ($n)"