Home | History | Annotate | Line # | Download | only in rpzrecurse 
      1 Copyright (C) Internet Systems Consortium, Inc. ("ISC")
      2 
      3 SPDX-License-Identifier: MPL-2.0
      4 
      5 This Source Code Form is subject to the terms of the Mozilla Public
      6 License, v. 2.0.  If a copy of the MPL was not distributed with this
      7 file, you can obtain one at https://mozilla.org/MPL/2.0/.
      8 
      9 See the COPYRIGHT file distributed with this work for additional
     10 information regarding copyright ownership.
     11 
     12 These tests check RPZ recursion behavior (including skipping
     13 recursion when appropriate).
     14 
     15 The general structure of the tests is:
     16 
     17 * The resolver (ns2) with an unqualified view containing the policy
     18   zones, the response-policy statement, and a root hint zone
     19 
     20 * The auth server that contains two authoritative zones, l1.l0 and
     21   l2.l1.l0, both delegated to itself. l2.l1.l0 specifies a non-existent
     22   zone data file and so will generate SERVFAILs for any queries to it.
     23 
     24 The l2.l1.l0 zone was chosen to generate SERVFAIL responses because RPZ
     25 evaluation will use that error response whenever it encounters it during
     26 processing, thus making it a binary indicator for whether or not
     27 recursion was attempted.  This also allows us to not worry about having
     28 to craft 'ip', 'nsdname', and 'nsip' rules that matched the queries.
     29 
     30 Each test is intended to be fed a number of queries constructed as
     31 qXX.l2.l1.l0, where XX is the 1-based query sequence number (e.g. the
     32 first query of each test is q01.l2.l1.l0).
     33 
     34 For all the tests the triggers are constructed as follows:
     35 client-ip - match 127.0.0.1/32
     36 ip - match 255.255.255.255/32 (does not matter due to SERVFAIL)
     37 nsdname - match ns.example.org (also does not matter)
     38 nsip - match 255.255.255.255/32 (also does not matter)
     39 qname - match qXX.l2.l1.l0, where XX is the query sequence number that
     40 is intended to be matched by this qname rule.
     41 
     42 Here's the detail on the test cases:
     43 
     44 Group 1 - testing skipping recursion for a single policy zone with only
     45 records that allow recursion to be skipped
     46 
     47 Test 1a:
     48     1 policy zone containing 1 'client-ip' trigger
     49     1 query, expected to skip recursion
     50 
     51 Test 1b:
     52     1 policy zone containing 1 'qname' trigger (q01)
     53     2 queries, q01 is expected to skip recursion, q02 is expected to
     54       recurse
     55 
     56 Test 1c:
     57     1 policy zone containing both a 'client-ip' and 'qname' trigger (q02)
     58     1 query, expected to skip recursion
     59 
     60 Group 2 - testing skipping recursion with multiple policy zones when all
     61 zones have only trigger types eligible to skip recursion with
     62 
     63 Test 2a:
     64     32 policy zones, each containing 1 'qname' trigger (qNN, where NN is
     65        the zone's sequence 1-based sequence number formatted to 2 digits,
     66        so each of the first 32 queries should match a different zone)
     67     33 queries, the first 32 of which are expected to skip recursion
     68        while the 33rd is expected to recurse
     69 
     70 Group 3 - Testing interaction of triggers that require recursion when in
     71 a single zone, both alone and with triggers that allow recursion to be
     72 skipped
     73 
     74 Test 3a:
     75     1 policy zone containing 1 'ip' trigger
     76     1 query, expected to recurse
     77 
     78 Test 3b:
     79     1 policy zone containing 1 'nsdname' trigger
     80     1 query, expected to recurse
     81 
     82 Test 3c:
     83     1 policy zone containing 1 'nsip' trigger
     84     1 query, expected to recurse
     85 
     86 Test 3d:
     87     1 policy zone containing 1 'ip' trigger and 1 'qname' trigger (q02)
     88     2 queries, the first should not recurse and the second should recurse
     89 
     90 Test 3e:
     91     1 policy zone containing 1 'nsdname' trigger and 1 'qname' trigger
     92       (q02)
     93     2 queries, the first should not recurse and the second should recurse
     94 
     95 Test 3f:
     96     1 policy zone containing 1 'nsip' trigger and 1 'qname' trigger (q02)
     97     2 queries, the first should not recurse and the second should recurse
     98 
     99 Group 4 - contains 32 subtests designed to verify that recursion is
    100 skippable for only the appropriate zones based on the order specified in
    101 the 'response-policy' statement
    102 
    103 Tests 4aa to 4bf:
    104     32 policy zones per test, one of which is configured with 1 'ip'
    105        trigger and one 'qname' trigger while the others are configured
    106        only with 1 'qname' trigger.  The zone with both triggers starts
    107        listed first and is moved backwards by one position with each
    108        test.  The 'qname' triggers in the zones are structured so that
    109        the zones are tested starting with the first zone and the 'ip'
    110        trigger is tested before the 'qname' trigger for that zone.
    111     33 queries per test, where the number expected to skip recursion
    112        matches the test sequence number: e.g. 1 skip for 4aa, 26 skips
    113        for 4az, and 32 skips for 4bf
    114 
    115 Group 5 - This test verifies that the "pivot" policy zone for whether or
    116 not recursion can be skipped is the first listed zone with applicable
    117 trigger types rather than a later listed zone.
    118 
    119 Test 5a:
    120     5 policy zones, the 1st, 3rd, and 5th configured with 1 'qname'
    121       trigger each (q01, q04, and q06, respectively), the 2nd and 4th
    122       each configured with an 'ip' and 'qname' trigger (q02 and q05,
    123       respectively for the 'qname' triggers
    124     6 queries, of which only q01 and q02 are expected to skip recursion
    125