Artem Boldariev
ef9f09252c
This commit adds a set of tests to verify that BIND will not crash when some opcodes are sent over DoT or DoH, leading to marking network handle in question as sequential.
259 lines
8.2 KiB
Bash
259 lines
8.2 KiB
Bash
#!/bin/sh
|
|
#
|
|
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
|
#
|
|
# This Source Code Form is subject to the terms of the Mozilla Public
|
|
# License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
# file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
|
#
|
|
# See the COPYRIGHT file distributed with this work for additional
|
|
# information regarding copyright ownership.
|
|
|
|
# shellcheck disable=SC1091
|
|
. ../conf.sh
|
|
|
|
dig_with_tls_opts() {
|
|
"$DIG" +tls +noadd +nosea +nostat +noquest +nocmd -p "${TLSPORT}" "$@"
|
|
}
|
|
|
|
dig_with_https_opts() {
|
|
"$DIG" +https +noadd +nosea +nostat +noquest +nocmd -p "${HTTPSPORT}" "$@"
|
|
}
|
|
|
|
dig_with_http_opts() {
|
|
"$DIG" +http-plain +noadd +nosea +nostat +noquest +nocmd -p "${HTTPPORT}" "$@"
|
|
}
|
|
|
|
wait_for_tls_xfer() (
|
|
dig_with_tls_opts -b 10.53.0.3 @10.53.0.2 example. AXFR > "dig.out.ns2.test$n" || return 1
|
|
grep "^;" "dig.out.ns2.test$n" > /dev/null && return 1
|
|
return 0
|
|
)
|
|
|
|
status=0
|
|
n=0
|
|
|
|
n=$((n+1))
|
|
echo_i "testing XoT server functionality (using dig) ($n)"
|
|
ret=0
|
|
dig_with_tls_opts example. -b 10.53.0.3 @10.53.0.1 axfr > dig.out.ns1.test$n || ret=1
|
|
grep "^;" dig.out.ns1.test$n | cat_i
|
|
digcomp example.axfr.good dig.out.ns1.test$n || ret=1
|
|
if test $ret != 0 ; then echo_i "failed"; fi
|
|
status=$((status+ret))
|
|
|
|
n=$((n+1))
|
|
echo_i "testing incoming XoT functionality (from secondary) ($n)"
|
|
ret=0
|
|
if retry_quiet 10 wait_for_tls_xfer; then
|
|
grep "^;" "dig.out.ns2.test$n" | cat_i
|
|
digcomp example.axfr.good "dig.out.ns2.test$n" || ret=1
|
|
else
|
|
echo_i "timed out waiting for zone transfer"
|
|
ret=1
|
|
fi
|
|
if test $ret != 0 ; then echo_i "failed"; fi
|
|
status=$((status+ret))
|
|
|
|
n=$((n + 1))
|
|
echo_i "checking DoT query (ephemeral key) ($n)"
|
|
ret=0
|
|
dig_with_tls_opts @10.53.0.1 . SOA > dig.out.test$n
|
|
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
|
|
if [ $ret != 0 ]; then echo_i "failed"; fi
|
|
status=$((status + ret))
|
|
|
|
n=$((n + 1))
|
|
echo_i "checking DoT query (static key) ($n)"
|
|
ret=0
|
|
dig_with_tls_opts @10.53.0.2 example SOA > dig.out.test$n
|
|
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
|
|
if [ $ret != 0 ]; then echo_i "failed"; fi
|
|
status=$((status + ret))
|
|
|
|
n=$((n + 1))
|
|
echo_i "checking DoT XFR ($n)"
|
|
ret=0
|
|
dig_with_tls_opts +comm @10.53.0.1 . AXFR > dig.out.test$n
|
|
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
|
|
if [ $ret != 0 ]; then echo_i "failed"; fi
|
|
status=$((status + ret))
|
|
|
|
n=$((n + 1))
|
|
echo_i "checking DoH query (POST) ($n)"
|
|
ret=0
|
|
dig_with_https_opts @10.53.0.1 . SOA > dig.out.test$n
|
|
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
|
|
if [ $ret != 0 ]; then echo_i "failed"; fi
|
|
status=$((status + ret))
|
|
|
|
n=$((n + 1))
|
|
echo_i "checking DoH query (POST, static key) ($n)"
|
|
ret=0
|
|
dig_with_https_opts @10.53.0.2 example SOA > dig.out.test$n
|
|
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
|
|
if [ $ret != 0 ]; then echo_i "failed"; fi
|
|
status=$((status + ret))
|
|
|
|
n=$((n + 1))
|
|
echo_i "checking DoH query (POST, nonstandard endpoint) ($n)"
|
|
ret=0
|
|
dig_with_https_opts +https=/alter @10.53.0.1 . SOA > dig.out.test$n
|
|
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
|
|
if [ $ret != 0 ]; then echo_i "failed"; fi
|
|
status=$((status + ret))
|
|
|
|
n=$((n + 1))
|
|
echo_i "checking DoH query (POST, undefined endpoint, failure expected) ($n)"
|
|
ret=0
|
|
dig_with_https_opts +tries=1 +time=1 +https=/fake @10.53.0.1 . SOA > dig.out.test$n
|
|
grep "communications error" dig.out.test$n > /dev/null || ret=1
|
|
if [ $ret != 0 ]; then echo_i "failed"; fi
|
|
status=$((status + ret))
|
|
|
|
n=$((n + 1))
|
|
echo_i "checking DoH XFR (POST) (failure expected) ($n)"
|
|
ret=0
|
|
dig_with_https_opts +comm @10.53.0.1 . AXFR > dig.out.test$n
|
|
grep "; Transfer failed." dig.out.test$n > /dev/null || ret=1
|
|
if [ $ret != 0 ]; then echo_i "failed"; fi
|
|
status=$((status + ret))
|
|
|
|
n=$((n + 1))
|
|
echo_i "checking DoH query (GET) ($n)"
|
|
ret=0
|
|
dig_with_https_opts +https-get @10.53.0.1 . SOA > dig.out.test$n
|
|
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
|
|
if [ $ret != 0 ]; then echo_i "failed"; fi
|
|
status=$((status + ret))
|
|
|
|
n=$((n + 1))
|
|
echo_i "checking DoH query (GET, static key) ($n)"
|
|
ret=0
|
|
dig_with_https_opts +https-get @10.53.0.2 example SOA > dig.out.test$n
|
|
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
|
|
if [ $ret != 0 ]; then echo_i "failed"; fi
|
|
status=$((status + ret))
|
|
|
|
n=$((n + 1))
|
|
echo_i "checking DoH query (GET, nonstandard endpoint) ($n)"
|
|
ret=0
|
|
dig_with_https_opts +https-get=/alter @10.53.0.1 . SOA > dig.out.test$n
|
|
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
|
|
if [ $ret != 0 ]; then echo_i "failed"; fi
|
|
status=$((status + ret))
|
|
|
|
n=$((n + 1))
|
|
echo_i "checking DoH query (GET, undefined endpoint, failure expected) ($n)"
|
|
ret=0
|
|
dig_with_https_opts +tries=1 +time=1 +https-get=/fake @10.53.0.1 . SOA > dig.out.test$n
|
|
grep "communications error" dig.out.test$n > /dev/null || ret=1
|
|
if [ $ret != 0 ]; then echo_i "failed"; fi
|
|
status=$((status + ret))
|
|
|
|
n=$((n + 1))
|
|
echo_i "checking DoH XFR (GET) (failure expected) ($n)"
|
|
ret=0
|
|
dig_with_https_opts +https-get +comm @10.53.0.1 . AXFR > dig.out.test$n
|
|
grep "; Transfer failed." dig.out.test$n > /dev/null || ret=1
|
|
if [ $ret != 0 ]; then echo_i "failed"; fi
|
|
status=$((status + ret))
|
|
|
|
n=$((n + 1))
|
|
echo_i "checking unencrypted DoH query (POST) ($n)"
|
|
ret=0
|
|
dig_with_http_opts @10.53.0.1 . SOA > dig.out.test$n
|
|
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
|
|
if [ $ret != 0 ]; then echo_i "failed"; fi
|
|
status=$((status + ret))
|
|
|
|
n=$((n + 1))
|
|
echo_i "checking unencrypted DoH query (GET) ($n)"
|
|
ret=0
|
|
dig_with_http_opts +http-plain-get @10.53.0.1 . SOA > dig.out.test$n
|
|
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
|
|
if [ $ret != 0 ]; then echo_i "failed"; fi
|
|
status=$((status + ret))
|
|
|
|
n=$((n + 1))
|
|
echo_i "checking unencrypted DoH XFR (failure expected) ($n)"
|
|
ret=0
|
|
dig_with_http_opts +comm @10.53.0.1 . AXFR > dig.out.test$n
|
|
grep "; Transfer failed." dig.out.test$n > /dev/null || ret=1
|
|
if [ $ret != 0 ]; then echo_i "failed"; fi
|
|
status=$((status + ret))
|
|
|
|
n=$((n + 1))
|
|
echo_i "checking DoH query for a large answer (POST) ($n)"
|
|
ret=0
|
|
dig_with_https_opts @10.53.0.1 biganswer.example A > dig.out.test$n
|
|
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
|
|
grep "ANSWER: 2500" dig.out.test$n > /dev/null || ret=1
|
|
if [ $ret != 0 ]; then echo_i "failed"; fi
|
|
status=$((status + ret))
|
|
|
|
n=$((n + 1))
|
|
echo_i "checking DoH query for a large answer (GET) ($n)"
|
|
ret=0
|
|
dig_with_https_opts +https-get @10.53.0.1 biganswer.example A > dig.out.test$n
|
|
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
|
|
grep "ANSWER: 2500" dig.out.test$n > /dev/null || ret=1
|
|
if [ $ret != 0 ]; then echo_i "failed"; fi
|
|
status=$((status + ret))
|
|
|
|
n=$((n + 1))
|
|
echo_i "checking unencrypted DoH query for a large answer (POST) ($n)"
|
|
ret=0
|
|
dig_with_http_opts @10.53.0.1 biganswer.example A > dig.out.test$n
|
|
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
|
|
grep "ANSWER: 2500" dig.out.test$n > /dev/null || ret=1
|
|
if [ $ret != 0 ]; then echo_i "failed"; fi
|
|
status=$((status + ret))
|
|
|
|
n=$((n + 1))
|
|
echo_i "checking unencrypted DoH query for a large answer (POST) ($n)"
|
|
ret=0
|
|
dig_with_http_opts +http-plain-get @10.53.0.1 biganswer.example A > dig.out.test$n
|
|
grep "status: NOERROR" dig.out.test$n > /dev/null || ret=1
|
|
grep "ANSWER: 2500" dig.out.test$n > /dev/null || ret=1
|
|
if [ $ret != 0 ]; then echo_i "failed"; fi
|
|
status=$((status + ret))
|
|
|
|
test_opcodes() {
|
|
EXPECT_STATUS="$1"
|
|
shift
|
|
for op in "$@";
|
|
do
|
|
n=$((n + 1))
|
|
echo_i "checking unexpected opcode query over DoH for opcode $op ($n)"
|
|
ret=0
|
|
dig_with_https_opts +https @10.53.0.1 +opcode="$op" > dig.out.test$n
|
|
grep "status: $EXPECT_STATUS" dig.out.test$n > /dev/null || ret=1
|
|
if [ $ret != 0 ]; then echo_i "failed"; fi
|
|
status=$((status + ret))
|
|
|
|
n=$((n + 1))
|
|
echo_i "checking unexpected opcode query over DoH without encryption for opcode $op ($n)"
|
|
ret=0
|
|
dig_with_http_opts +http-plain @10.53.0.1 +opcode="$op" > dig.out.test$n
|
|
grep "status: $EXPECT_STATUS" dig.out.test$n > /dev/null || ret=1
|
|
if [ $ret != 0 ]; then echo_i "failed"; fi
|
|
status=$((status + ret))
|
|
|
|
n=$((n + 1))
|
|
echo_i "checking unexpected opcode query over DoT for opcode $op ($n)"
|
|
ret=0
|
|
dig_with_tls_opts +tls @10.53.0.1 +opcode="$op" > dig.out.test$n
|
|
grep "status: $EXPECT_STATUS" dig.out.test$n > /dev/null || ret=1
|
|
if [ $ret != 0 ]; then echo_i "failed"; fi
|
|
status=$((status + ret))
|
|
done
|
|
}
|
|
|
|
test_opcodes NOERROR 0
|
|
test_opcodes NOTIMP 1 2 3 6 7 8 9 10 11 12 13 14 15
|
|
test_opcodes FORMERR 4 5
|
|
|
|
echo_i "exit status: $status"
|
|
[ $status -eq 0 ] || exit 1
|