From: Colin Vidal <colin@isc.org>
Date: Wed, 1 Jul 2026 08:59:01 +0000 (+0200)
Subject: Convert some chain shell-based system tests in python
X-Git-Tag: v9.21.24~8^2
X-Git-Url: http://git.ipfire.org/gitweb/index.cgi?a=commitdiff_plain;h=5033b9e51c8c8fa24b0378c4f8a3e16eade384bc;p=thirdparty%2Fbind9.git

Convert some chain shell-based system tests in python

Rewriting a couple of shell-based chain system test into python. Those
tests exercise the dname resolution of either an authoritative or
resolver without extra queries (it is self resolver either because the
target is in an authoritative zone or in the same authoritative answer).

Also add an extra test checking the same mechanism, this time, from the
resolver cache (no resolver involed).

Those highlight the fact that `query_dname()` can be called in situation
where the query type is DNAME, and even though, it needs to be resolved.
---

diff --git a/bin/tests/system/chain/tests.sh b/bin/tests/system/chain/tests.sh
index 876b80698bb..e19052ad111 100644
--- a/bin/tests/system/chain/tests.sh
+++ b/bin/tests/system/chain/tests.sh
@@ -623,24 +623,6 @@ grep 'status: NOERROR' dig.out.7.$n >/dev/null 2>&1 || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
 
-# Regression test for CVE-2021-25215 (authoritative server).
-n=$((n + 1))
-echo_i "checking DNAME resolution via itself (authoritative) ($n)"
-ret=0
-$DIG $DIGOPTS @10.53.0.2 DNAME self.domain0.self.domain0.nil. >dig.out.2.$n 2>&1
-grep 'status: NOERROR' dig.out.2.$n >/dev/null 2>&1 || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=$((status + ret))
-
-# Regression test for CVE-2021-25215 (recursive resolver).
-n=$((n + 1))
-echo_i "checking DNAME resolution via itself (recursive) ($n)"
-ret=0
-$DIG $DIGOPTS @10.53.0.7 DNAME self.example.self.example.dname. >dig.out.7.$n 2>&1
-grep 'status: NOERROR' dig.out.7.$n >/dev/null 2>&1 || ret=1
-if [ $ret != 0 ]; then echo_i "failed"; fi
-status=$((status + ret))
-
 # Regression test for GL #4652
 n=$((n + 1))
 echo_i "checking handling of illegal NS below DNAME ($n)"
diff --git a/bin/tests/system/chain/tests_chain.py b/bin/tests/system/chain/tests_chain.py
new file mode 100644
index 00000000000..25da50a6250
--- /dev/null
+++ b/bin/tests/system/chain/tests_chain.py
@@ -0,0 +1,28 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+import isctest
+
+
+def query(ns, name):
+    msg = isctest.query.create(name, "DNAME")
+    res = isctest.query.udp(msg, ns.ip)
+    isctest.check.noerror(res)
+    isctest.check.has_answer(res)
+
+
+# Regression test for CVE-2021-25215.
+def test_chain_dname_self_resolution(ns2, ns7):
+    # Checking DNAME resolution via itself (authoritative).
+    query(ns2, "self.domain0.self.domain0.nil.")
+
+    # Checking DNAME resolution via itself (recursive).
+    query(ns7, "self.example.self.example.dname.")
+
+    # Checking DNAME resolution via itself (resolver cache).
+    query(ns7, "self.example.self.example.dname.")