From: Colin Vidal Date: Fri, 29 May 2026 08:59:41 +0000 (+0200) Subject: System test for delegation TTL options X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=5dde593aa4e0237896222f56de10239b617d0c8e;p=thirdparty%2Fbind9.git System test for delegation TTL options Add a system test which covers the behavior of the `min-delegation-ttl` and `max-delegation-ttl` options (including default, disabling, and enforcing that min- must be strictly less than max-). --- diff --git a/bin/tests/system/delegation_ttl/ns1/named.conf.j2 b/bin/tests/system/delegation_ttl/ns1/named.conf.j2 new file mode 100644 index 00000000000..1b3caaff9c7 --- /dev/null +++ b/bin/tests/system/delegation_ttl/ns1/named.conf.j2 @@ -0,0 +1,15 @@ +options { + query-source address 10.53.0.1; + notify-source 10.53.0.1; + transfer-source 10.53.0.1; + port @PORT@; + pid-file "named.pid"; + listen-on { 10.53.0.1; }; + recursion no; + dnssec-validation no; +}; + +zone "." { + type primary; + file "root.db"; +}; diff --git a/bin/tests/system/delegation_ttl/ns1/root.db b/bin/tests/system/delegation_ttl/ns1/root.db new file mode 100644 index 00000000000..14d72252fa1 --- /dev/null +++ b/bin/tests/system/delegation_ttl/ns1/root.db @@ -0,0 +1,19 @@ +$TTL 300 +. IN SOA owner.root-servers.nil. a.root.servers.nil. ( + 2010 ; serial + 600 ; refresh + 600 ; retry + 1200 ; expire + 600 ; minimum + ) +. NS a.root-servers.nil. +a.root-servers.nil. A 10.53.0.1 + +tld-10. 10 NS ns.tld-10. +ns.tld-10. 10 A 10.53.0.10 + +tld-50. 50 NS ns.tld-50. +ns.tld-50. 50 A 10.53.0.50 + +tld-100. 100 NS ns.tld-100. +ns.tld-100. 100 A 10.53.0.100 diff --git a/bin/tests/system/delegation_ttl/ns2/named.conf.j2 b/bin/tests/system/delegation_ttl/ns2/named.conf.j2 new file mode 100644 index 00000000000..04a64c15ef8 --- /dev/null +++ b/bin/tests/system/delegation_ttl/ns2/named.conf.j2 @@ -0,0 +1,33 @@ +{% set minttl = minttl | default(None) %} +{% set maxttl = maxttl | default(None) %} + +options { + query-source address 10.53.0.2; + notify-source 10.53.0.2; + transfer-source 10.53.0.2; + port @PORT@; + pid-file "named.pid"; + listen-on { 10.53.0.2; }; + recursion yes; + dnssec-validation no; +{% if minttl != None %} + min-delegation-ttl @minttl@; +{% endif %} +{% if maxttl != None %} + max-delegation-ttl @maxttl@; +{% endif %} +}; + +zone "." { + type hint; + file "root.hint"; +}; + +key rndc_key { + secret "1234abcd8765"; + algorithm @DEFAULT_HMAC@; +}; + +controls { + inet 10.53.0.2 port @CONTROLPORT@ allow { any; } keys { rndc_key; }; +}; diff --git a/bin/tests/system/delegation_ttl/ns2/root.hint b/bin/tests/system/delegation_ttl/ns2/root.hint new file mode 100644 index 00000000000..d7d0e1fabac --- /dev/null +++ b/bin/tests/system/delegation_ttl/ns2/root.hint @@ -0,0 +1,14 @@ +; Copyright (C) Internet Systems Consortium, Inc. ("ISC") +; +; SPDX-License-Identifier: MPL-2.0 +; +; This Source Code Form is subject to the terms of the Mozilla Public +; License, v. 2.0. If a copy of the MPL was not distributed with this +; file, you can obtain one at https://mozilla.org/MPL/2.0/. +; +; See the COPYRIGHT file distributed with this work for additional +; information regarding copyright ownership. + +$TTL 999999 +. IN NS a.root-servers.nil. +a.root-servers.nil. IN A 10.53.0.1 diff --git a/bin/tests/system/delegation_ttl/tests_delegation_ttl.py b/bin/tests/system/delegation_ttl/tests_delegation_ttl.py new file mode 100644 index 00000000000..e816bdfb268 --- /dev/null +++ b/bin/tests/system/delegation_ttl/tests_delegation_ttl.py @@ -0,0 +1,85 @@ +# Copyright (C) Internet Systems Consortium, Inc. ("ISC") +# +# SPDX-License-Identifier: MPL-2.0 +# +# This Source Code Form is subject to the terms of the Mozilla Public +# License, v. 2.0. If a copy of the MPL was not distributed with this +# file, you can obtain one at https://mozilla.org/MPL/2.0/. +# +# See the COPYRIGHT file distributed with this work for additional +# information regarding copyright ownership. + +from re import compile as Re + +import isctest + + +def found(cache, pattern): + assert len(cache.grep(Re(pattern))) == 1 + + +def warm_get_cache(ns): + with ns.watch_log_from_here() as watcher: + ns.rndc("flush") + ns.rndc("reload") + watcher.wait_for_sequence( + [ + "flushing caches in all views succeeded", + "loop exclusive mode: ended", + "running", + ] + ) + + msg = isctest.query.create("ns.tld-10.", "A") + isctest.query.udp(msg, ns.ip) + msg = isctest.query.create("ns.tld-50.", "A") + isctest.query.udp(msg, ns.ip) + msg = isctest.query.create("ns.tld-100.", "A") + isctest.query.udp(msg, ns.ip) + + with ns.watch_log_from_here() as watcher: + ns.rndc("dumpdb -deleg") + watcher.wait_for_line("dumpdb complete") + return isctest.text.TextFile(f"{ns.identifier}/named_dump.db") + + +def test_delegation_ttl_default(ns2): + cache = warm_get_cache(ns2) + found(cache, "tld-10\\. (60|5[0-9]) DELEG server-ipv4=") + found(cache, "tld-50\\. (60|5[0-9]) DELEG server-ipv4=") + found(cache, "tld-100\\. (100|9[0-9]) DELEG server-ipv4=") + + +def test_delegation_min_ttl_40_60(ns2, templates): + templates.render("ns2/named.conf", {"minttl": 40, "maxttl": 60}) + cache = warm_get_cache(ns2) + found(cache, "tld-10\\. (40|3[0-9]) DELEG server-ipv4=") + found(cache, "tld-50\\. (50|4[0-9]) DELEG server-ipv4=") + found(cache, "tld-100\\. (60|5[0-9]) DELEG server-ipv4=") + + +def test_delegation_min_ttl_disabled(ns2, templates): + templates.render("ns2/named.conf", {"minttl": 0, "maxttl": 0}) + cache = warm_get_cache(ns2) + found(cache, "tld-10\\. (10|[1-9]) DELEG server-ipv4=") + found(cache, "tld-50\\. (50|4[0-9]) DELEG server-ipv4=") + found(cache, "tld-100\\. (100|9[0-9]) DELEG server-ipv4=") + + +def check_ttl_error(ns): + with ns.watch_log_from_here() as watcher: + cmd = ns.rndc("reload", raise_on_exception=False) + assert cmd.rc != 0 + watcher.wait_for_line( + "When 'min-delegation-ttl' and 'max-delegation-ttl' are both positive, 'min-delegation-ttl' must be strictly less than 'max-delegation-ttl'" + ) + + +def test_delegdb_ttl_default_5(ns2, templates): + templates.render("ns2/named.conf", {"maxttl": 5}) + check_ttl_error(ns2) + + +def test_delegdb_ttl_10_5(ns2, templates): + templates.render("ns2/named.conf", {"minttl": 10, "maxttl": 5}) + check_ttl_error(ns2)