test the use of the view ACL in DLZ

diff --git a/bin/tests/system/dlzexternal/driver.c b/bin/tests/system/dlzexternal/driver.c
index 35151441d4c372296f34163b36873b2bca4af703..6767bfc64ae6f23bb8d917339ee8437126c1f109 100644 (file)
--- a/bin/tests/system/dlzexternal/driver.c
+++ b/bin/tests/system/dlzexternal/driver.c
@@ -534,21 +534,56 @@ dlz_lookup(const char *zone, const char *name, void *dbdata,
  */
 isc_result_t
 dlz_allowzonexfr(void *dbdata, const char *name, const char *client) {
+       struct dlz_example_data *state = (struct dlz_example_data *)dbdata;
        isc_result_t result;
 
+       if (state->log != NULL) {
+               state->log(ISC_LOG_INFO,
+                          "dlz_example: dlz_allowzonexfr called for %s",
+                          name);
+       }
+
        result = dlz_findzonedb(dbdata, name, NULL, NULL);
        if (result != ISC_R_SUCCESS) {
+               if (state->log != NULL) {
+                       state->log(ISC_LOG_INFO,
+                                  "dlz_example: findzonedb returned %s",
+                                  isc_result_totext(result));
+               }
                return (result);
        }
 
+       /*
+        * Exception for "example.org" so we can test the use of
+        * the view ACL.
+        */
+       if (strcmp(name, "example.org") == 0) {
+               if (state->log != NULL) {
+                       state->log(ISC_LOG_INFO,
+                                  "dlz_example: use view ACL "
+                                  "for example.org");
+               }
+               return (ISC_R_DEFAULT);
+       }
+
        /*
         * Exception for 10.53.0.5 so we can test that allow-transfer
         * is effective.
         */
        if (strcmp(client, "10.53.0.5") == 0) {
+               if (state->log != NULL) {
+                       state->log(ISC_LOG_INFO,
+                                  "dlz_example: disallow transfer "
+                                  "to 10.53.0.5");
+               }
                return (ISC_R_NOPERM);
        }
 
+       if (state->log != NULL) {
+               state->log(ISC_LOG_INFO,
+                          "dlz_example: transfer allowed for %s", name);
+       }
+
        return (ISC_R_SUCCESS);
 }
 

diff --git a/bin/tests/system/dlzexternal/ns1/dlzs.conf.in b/bin/tests/system/dlzexternal/ns1/dlzs.conf.in
index d583cb4e1a0acdc7b00b7b62429a93ce40dce30d..07bf329b50504346ecc23b76a0d6ad574f524d94 100644 (file)
--- a/bin/tests/system/dlzexternal/ns1/dlzs.conf.in
+++ b/bin/tests/system/dlzexternal/ns1/dlzs.conf.in
@@ -17,6 +17,10 @@ dlz "example two" {
        database "dlopen ../driver.@SO@ alternate.nil";
 };
 
+dlz "example three" {
+       database "dlopen ../driver.@SO@ example.org";
+};
+
 dlz "unsearched1" {
        database "dlopen ../driver.@SO@ other.nil";
        search no;

diff --git a/bin/tests/system/dlzexternal/ns1/named.conf.in b/bin/tests/system/dlzexternal/ns1/named.conf.in
index d35061a8cbdcb5154e7f064fbdee77a0213e3d6a..591061cb85e70806e2d6643f1b77ca3ce464506d 100644 (file)
--- a/bin/tests/system/dlzexternal/ns1/named.conf.in
+++ b/bin/tests/system/dlzexternal/ns1/named.conf.in
@@ -18,6 +18,7 @@ options {
        session-keyfile "session.key";
        listen-on { 10.53.0.1; 127.0.0.1; };
        listen-on-v6 { none; };
+       allow-transfer { !10.53.0.1; any; };
        recursion no;
        notify yes;
 };

diff --git a/bin/tests/system/dlzexternal/tests.sh b/bin/tests/system/dlzexternal/tests.sh
index 6c84ad10eb1257e52e9fdeb8ea50aad701ed2f8f..b9d44057be959ce414b3ed76318fea6b6c9eb5e2 100644 (file)
--- a/bin/tests/system/dlzexternal/tests.sh
+++ b/bin/tests/system/dlzexternal/tests.sh
@@ -125,6 +125,16 @@ grep "; Transfer failed" dig.out.alternate.ns1.test$n > /dev/null || ret=1
 [ "$ret" -eq 0 ] || echo_i "failed"
 status=`expr $status + $ret`
 
+newtest "testing AXFR denied based on view ACL"
+# 10.53.0.1 should be disallowed
+$DIG $DIGOPTS -b 10.53.0.1 +noall +answer axfr example.org > dig.out.example.ns1.test$n.1
+grep "; Transfer failed" dig.out.example.ns1.test$n.1 > /dev/null || ret=1
+# 10.53.0.2 should be allowed
+$DIG $DIGOPTS -b 10.53.0.2 +noall +answer axfr example.org > dig.out.example.ns1.test$n.2
+grep "; Transfer failed" dig.out.example.ns1.test$n.2 > /dev/null && ret=1
+[ "$ret" -eq 0 ] || echo_i "failed"
+status=`expr $status + $ret`
+
 newtest "testing unsearched/unregistered DLZ zone is not found"
 $DIG $DIGOPTS +noall +answer ns other.nil > dig.out.ns1.test$n
 grep "3600.IN.NS.other.nil." dig.out.ns1.test$n > /dev/null && ret=1