Commit Graph
3976 Commits
Author SHA1 Message Date
Ondřej SurýandAram Sargsyan b35861f1eb Increase the BUFSIZ-long buffers
The BUFSIZ value varies between platforms, it could be 8K on Linux and
512 bytes on mingw.  Make sure the buffers are always big enough for the
output data to prevent truncation of the output by appropriately
enlarging or sizing the buffers.
2022-07-15 10:33:46 +00:00
Ondřej SurýandEvan Hunt d1433da524 Wait for TCP connection refused in the statistics system test
The statistics system test makes a query to foo.info to check for the
pending connections because the ans4 doesn't respond to the query.

This might or might not (depending on exact timing) increment the failed
TCP connection counter when the query is retried over TCP because ans4
doesn't listen on the TCP.

Wait for the 'connection refused' in the ns3 log file to be able to
count the exactly 1 failed TCP connection.
2022-07-14 13:08:29 -07:00
Mark Andrews eb5e5edf82 kasp: add missing logging during setup
Some zones where not being logged when just DNSSEC keys where being
generated in system test setup phase.  Add logging for these zones.
2022-07-13 23:19:39 +00:00
Mark Andrews 513cb24b55 Make "checking revoked key with duplicate key ID" work
There should be 2 keys with the same key id after the numerically
lower one is revoked (serial space arithmetic).  The DS points
at the non-revoked key so validation should still succeed.
2022-07-13 00:47:49 +00:00
Matthijs Mekking efa8a4e88d Test setting of inline-signing with dnssec-policy
When dnssec-policy is used, and the zone is not dynamic, BIND will
assume that the zone is inline-signed. Add test cases to verify this.
2022-07-12 11:29:03 +02:00
Matthijs Mekking ff65f07779 Fix kasp system test bugs
Fix a comment, ensuring the right parameters are used (zone is
parameter $3, not $2) and add view and policy parameters to the comment.

Fix the view tests and test the correct view (example3 instead of
example2).

Fix placement of "n=$((n+1)" for two test cases.
2022-07-12 11:29:03 +02:00
Mark Andrews 459e6980e5 zonechecks: use $DEFAULT_ALGORITHM 2022-07-12 13:29:07 +10:00
Mark Andrews 3f65c9cf85 wildcard: use $DEFAULT_ALGORITHM 2022-07-12 13:29:07 +10:00
Mark Andrews 86b29606c3 views: use $DEFAULT_ALGORITHM 2022-07-12 13:29:07 +10:00
Mark Andrews 93f7c7cdcd verify: use $DEFAULT_ALGORITHM 2022-07-12 13:29:07 +10:00
Mark Andrews 5585909904 upforwd: use $DEFAULT_ALGORITHM 2022-07-12 13:29:07 +10:00
Mark Andrews 9970d4317d unknown: use $DEFAULT_ALGORITHM 2022-07-12 13:29:07 +10:00
Mark Andrews 73fd49f8bb synthfromdnssec: use $DEFAULT_ALGORITHM 2022-07-12 13:29:07 +10:00
Mark Andrews 32337b9dbf staticstub: use $DEFAULT_ALGORITHM 2022-07-12 13:29:07 +10:00
Mark Andrews 941b95edb0 smartsign: use $DEFAULT_ALGORITHM 2022-07-12 13:29:07 +10:00
Mark Andrews 1861c3e503 rpz: use $DEFAULT_ALGORITHM 2022-07-12 13:29:07 +10:00
Mark Andrews b0e1d9b1b3 rootkeysentinel: use $DEFAULT_ALGORITHM 2022-07-12 13:29:07 +10:00
Mark Andrews 05ef8c81dd resolver: use $DEFAULT_ALGORITHM 2022-07-12 10:40:30 +10:00
Mark Andrews e0e03602ba redirect: use $DEFAULT_ALGORITHM 2022-07-12 10:40:30 +10:00
Mark Andrews 6fd50b9fda pending: use $DEFAULT_ALGORITHM 2022-07-12 10:40:30 +10:00
Mark Andrews c2d18567fc nsupdate: use $DEFAULT_ALGORITHM 2022-07-12 10:40:30 +10:00
Mark Andrews 78fa082999 mkeys: use $DEFAULT_ALGORITHM 2022-07-12 10:40:30 +10:00
Mark Andrews ff95bafa39 mirror: use $DEFAULT_ALGORITHM 2022-07-12 10:40:29 +10:00
Mark Andrews 3f1dc83bfb metadata: use $DEFAULT_ALGORITHM 2022-07-12 10:40:29 +10:00
Mark Andrews e3acddefd1 inline: use $DEFAULT_ALGORITHM 2022-07-12 10:40:29 +10:00
Mark Andrews 49de14cb9e dsdigest: use $DEFAULT_ALGORITHM 2022-07-12 10:40:29 +10:00
Mark Andrews d0b0139c90 dnssec: use $DEFAULT_ALGORITHM 2022-07-12 10:40:29 +10:00
Mark Andrews 5cbf1e1598 dns64: use $DEFAULT_ALGORITHM 2022-07-12 10:40:29 +10:00
Mark Andrews 3419178bd2 chain: use $DEFAULT_ALGORITHM 2022-07-12 10:40:29 +10:00
Mark Andrews 6cf0b73ede cds: use $DEFAULT_ALGORITHM 2022-07-12 10:40:29 +10:00
Mark Andrews bb810b0ac9 autosign: use $DEFAULT_ALGORITHM 2022-07-12 10:40:29 +10:00
Evan Hunt 549cf0f3e6 "rndc fetchlimit" now also lists rate-limited domains
"rndc fetchlimit" now also prints a list of domain names that are
currently rate-limited by "fetches-per-zone".

The "fetchlimit" system test has been updated to use this feature
to check that domain limits are applied correctly.
2022-07-06 19:46:23 -07:00
Evan Hunt 6175897478 add "rndc fetchlimit" to show fetchlimited servers
this command runs dns_adb_dumpquota() to display all servers
in the ADB that are being actively fetchlimited by the
fetches-per-server controls (i.e, servers with a nonzero average
timeout ratio or with the quota having been reduced from the
default value).

the "fetchlimit" system test has been updated to use the
new command to check quota values instead of "rndc dumpdb".
2022-07-06 19:46:20 -07:00
Mark Andrews 9366ed58b4 Upgrade uses of hmac-md5 to DEFAULT_HMAC
where the test is not hmac-md5 specific
2022-07-07 10:11:42 +10:00
Mark Andrews c533e8bc5b Upgrade uses of hmac-sha1 to DEFAULT_HMAC
where the test is not hmac-sha1 specific
2022-07-07 10:11:42 +10:00
Mark Andrews 19a7a1e557 Convert hmac-sha256 references in system tests to DEFAULT_HMAC
where a future change from hmac-sha256 would be applicable.  This
change involves dnssec, nsupdate and rndc system tests.
2022-07-07 10:11:42 +10:00
Mark Andrews ce324ae8ba Use DEFAULT_HMAC for rndc 2022-07-07 10:11:42 +10:00
Mark Andrews 972d7fd682 Add DEFAULT_HMAC to conf.sh.common 2022-07-07 10:11:42 +10:00
Mark Andrews abfb5b1173 update ifconfig.sh
* make it harder to get the interface numbers wrong by using 'max'
to specify the upper bound of the sequence of interfaces and use 'max'
when calculating the interface number
* extract the platform specific instruction into 'up' and 'down'
and call them from the inner loop so that the interface number is
calculated in one place.
* calculate the A and AAAA address in a single place rather than
in each command
* use /sbin/ipadm on Solaris 2.11 and greater
2022-07-07 09:54:48 +10:00
Evan Hunt f6abb80746 try other servers when receiving FORMERR
previously, when an iterative query returned FORMERR, resolution
would be stopped under the assumption that other servers for
the same domain would likely have the same capabilities. this
assumption is not correct; some domains have been reported for
which some but not all servers will return FORMERR to a given
query; retrying allows recursion to succeed.
2022-07-06 14:15:32 -07:00
Mark AndrewsandEvan Hunt 7be64c0e94 Tighten $GENERATE directive parsing
The original sscanf processing allowed for a number of syntax errors
to be accepted.  This included missing the closing brace in
${modifiers}

Look for both comma and right brace as intermediate seperators as
well as consuming the final right brace in the sscanf processing
for ${modifiers}.  Check when we got right brace to determine if
the sscanf consumed more input than expected and if so behave as
if it had stopped at the first right brace.
2022-07-05 09:41:33 -07:00
Mark AndrewsandEvan Hunt 5327b9708f Check for overflow in $GENERATE computations
$GENERATE uses 'int' for its computations and some constructions
can overflow values that can be represented by an 'int' resulting
in undefined behaviour.  Detect these conditions and return a
range error.
2022-07-05 09:41:29 -07:00
Mark Andrews 4db847e80e Increase the amount of time allowed for signing to occur in
On slow systems we have seen this take 9 seconds.  Increased the
allowance from 3 seconds to 10 seconds to reduce the probabilty of
a false negative from the system test.
2022-07-05 12:36:36 +00:00
Mark Andrews 304d33fb32 Only report not matching stderr content when we look for it
The previous test code could emit "D:cds:stderr did not match ''" rather
that just showing the contents of stderr.  Moved the debug line inside
the if/else block.

Replaced backquotes with $() and $(()) as approriate.
2022-07-05 12:36:36 +00:00
Mark Andrews 33454fb0e9 Test grafting and synth-from-dnssec using primary zone 2022-07-05 12:29:01 +10:00
Mark Andrews 8af5d0ad68 Add system test for forward only grafted zone with synth-from-dnssec
We are grafting on an unsigned zone "example.internal" where the higher
zone (".") is signed and would otherwise cause named to synthesise a
NXDOMAIN for example.internal.  We prime the cache by performing a
lookup for "internal" and then lookup "example.internal".
2022-07-05 12:29:01 +10:00
Michał Kępień 887c666caf Obsolete the "glue-cache" option
The "glue-cache" option was marked as deprecated by commit
5ae33351f2 (first released in BIND 9.17.6,
back in October 2020), so now obsolete that option, removing all code
and documentation related to it.

Note: this causes the glue cache feature to be permanently enabled, not
disabled.
2022-06-30 15:24:08 +02:00
Artem Boldariev 7822670d0f doth test: extend with HTTP endpoints reconfiguration check
This commit add a check which verifies that HTTP endpoints are being
picked up properly by the BIND instance on a reconfiguration.
2022-06-28 15:43:19 +03:00
Matthijs Mekking 8e18fa5874 Fix a bug in the duration_fromtext function
The function actually did not enforce that the duration string starts
with a P (or p), just that there is a P (or p) in the string.
2022-06-28 11:56:31 +02:00
Michał Kępień 4f12892740 Also test DNS-over-TLS code using sslyze
Since sslyze can test any TLS-enabled server, also use it for exercising
DNS-over-TLS code rather than just DNS-over-HTTPS code.
2022-06-27 22:50:00 +02:00