tests.sh revision 1.1
1 # Copyright (C) Internet Systems Consortium, Inc. ("ISC") 2 # 3 # This Source Code Form is subject to the terms of the Mozilla Public 4 # License, v. 2.0. If a copy of the MPL was not distributed with this 5 # file, You can obtain one at http://mozilla.org/MPL/2.0/. 6 # 7 # See the COPYRIGHT file distributed with this work for additional 8 # information regarding copyright ownership. 9 10 # test response rate limiting 11 12 SYSTEMTESTTOP=.. 13 . $SYSTEMTESTTOP/conf.sh 14 15 RNDCCMD="$RNDC -c $SYSTEMTESTTOP/common/rndc.conf -p ${CONTROLPORT} -s" 16 17 #set -x 18 19 ns1=10.53.0.1 # root, defining the others 20 ns2=10.53.0.2 # test server 21 ns3=10.53.0.3 # secondary test server 22 ns4=10.53.0.4 # log-only test server 23 ns7=10.53.0.7 # whitelisted client 24 25 USAGE="$0: [-x]" 26 while getopts "x" c; do 27 case $c in 28 x) set -x;; 29 *) echo "$USAGE" 1>&2; exit 1;; 30 esac 31 done 32 shift `expr $OPTIND - 1 || true` 33 if test "$#" -ne 0; then 34 echo "$USAGE" 1>&2 35 exit 1 36 fi 37 # really quit on control-C 38 trap 'exit 1' 1 2 15 39 40 41 ret=0 42 setret () { 43 ret=1 44 echo_i "$*" 45 } 46 47 48 # Wait until soon after the start of a second to make results consistent. 49 # The start of a second credits a rate limit. 50 # This would be far easier in C or by assuming a modern version of perl. 51 sec_start () { 52 START=`date` 53 while true; do 54 NOW=`date` 55 if test "$START" != "$NOW"; then 56 return 57 fi 58 $PERL -e 'select(undef, undef, undef, 0.05)' || true 59 done 60 } 61 62 63 # turn off ${HOME}/.digrc 64 HOME=/dev/null; export HOME 65 66 # $1=number of tests $2=target domain $3=dig options 67 QNUM=1 68 burst () { 69 BURST_LIMIT=$1; shift 70 BURST_DOM_BASE="$1"; shift 71 72 XCNT=$CNT 73 CNT='XXX' 74 eval FILENAME="mdig.out-$BURST_DOM_BASE" 75 CNT=$XCNT 76 77 DOMS="" 78 CNTS=`$PERL -e 'for ( $i = 0; $i < '$BURST_LIMIT'; $i++) { printf "%03d\n", '$QNUM' + $i; }'` 79 for CNT in $CNTS 80 do 81 eval BURST_DOM="$BURST_DOM_BASE" 82 DOMS="$DOMS $BURST_DOM" 83 done 84 ARGS="+nocookie +continue +time=1 +tries=1 -p ${PORT} $* @$ns2 $DOMS" 85 $MDIG $ARGS 2>&1 | tee -a full-$FILENAME | sed -n -e '/^;; AUTHORITY/,/^$/d' \ 86 -e '/^;; ADDITIONAL/,/^$/d' \ 87 -e 's/^[^;].* \([^ ]\{1,\}\)$/\1/p' \ 88 -e 's/;; flags.* tc .*/TC/p' \ 89 -e 's/;; .* status: NXDOMAIN.*/NXDOMAIN/p' \ 90 -e 's/;; .* status: NOERROR.*/NOERROR/p' \ 91 -e 's/;; .* status: SERVFAIL.*/SERVFAIL/p' \ 92 -e 's/response failed with timed out.*/drop/p' \ 93 -e 's/;; communications error to.*/drop/p' >> $FILENAME 94 QNUM=`expr $QNUM + $BURST_LIMIT` 95 } 96 97 # compare integers $1 and $2; ensure the difference is no more than $3 98 range () { 99 $PERL -e 'if (abs(int($ARGV[0]) - int($ARGV[1])) > int($ARGV[2])) { exit(1) }' $1 $2 $3 100 } 101 102 # $1=domain $2=IP address $3=# of IP addresses $4=TC $5=drop 103 # $6=NXDOMAIN $7=SERVFAIL or other errors 104 ck_result() { 105 BAD=no 106 ADDRS=`egrep "^$2$" mdig.out-$1 2>/dev/null | wc -l` 107 # count simple truncated and truncated NXDOMAIN as TC 108 TC=`egrep "^TC|NXDOMAINTC$" mdig.out-$1 2>/dev/null | wc -l` 109 DROP=`egrep "^drop$" mdig.out-$1 2>/dev/null | wc -l` 110 # count NXDOMAIN and truncated NXDOMAIN as NXDOMAIN 111 NXDOMAIN=`egrep "^NXDOMAIN|NXDOMAINTC$" mdig.out-$1 2>/dev/null | wc -l` 112 SERVFAIL=`egrep "^SERVFAIL$" mdig.out-$1 2>/dev/null | wc -l` 113 NOERROR=`egrep "^NOERROR$" mdig.out-$1 2>/dev/null | wc -l` 114 115 range $ADDRS "$3" 1 || 116 setret "$ADDRS instead of $3 '$2' responses for $1" && 117 BAD=yes 118 119 range $TC "$4" 1 || 120 setret "$TC instead of $4 truncation responses for $1" && 121 BAD=yes 122 123 range $DROP "$5" 1 || 124 setret "$DROP instead of $5 dropped responses for $1" && 125 BAD=yes 126 127 range $NXDOMAIN "$6" 1 || 128 setret "$NXDOMAIN instead of $6 NXDOMAIN responses for $1" && 129 BAD=yes 130 131 range $SERVFAIL "$7" 1 || 132 setret "$SERVFAIL instead of $7 error responses for $1" && 133 BAD=yes 134 135 range $NOERROR "$8" 1 || 136 setret "$NOERROR instead of $8 NOERROR responses for $1" && 137 BAD=yes 138 139 if test -z "$BAD"; then 140 rm -f mdig.out-$1 141 fi 142 } 143 144 145 ckstats () { 146 LABEL="$1"; shift 147 TYPE="$1"; shift 148 EXPECTED="$1"; shift 149 C=`sed -n -e "s/[ ]*\([0-9]*\).responses $TYPE for rate limits.*/\1/p" \ 150 ns2/named.stats | tail -1` 151 C=`expr 0$C + 0` 152 153 range "$C" $EXPECTED 1 || 154 setret "wrong $LABEL $TYPE statistics of $C instead of $EXPECTED" 155 } 156 157 158 ######### 159 sec_start 160 161 # Tests of referrals to "." must be done before the hints are loaded 162 # or with "additional-from-cache no" 163 burst 5 a1.tld3 +norec 164 # basic rate limiting 165 burst 3 a1.tld2 166 # delay allows an additional response. 167 sleep 1 168 burst 10 a1.tld2 169 # Request 30 different qnames to try a wildcard. 170 burst 30 'x$CNT.a2.tld2' 171 # These should be counted and limited but are not. See RT33138. 172 burst 10 'y.x$CNT.a2.tld2' 173 174 # IP TC drop NXDOMAIN SERVFAIL NOERROR 175 # referrals to "." 176 ck_result a1.tld3 x 0 1 2 0 0 2 177 # check 13 results including 1 second delay that allows an additional response 178 ck_result a1.tld2 192.0.2.1 3 4 6 0 0 8 179 180 # Check the wild card answers. 181 # The parent name of the 30 requests is counted. 182 ck_result 'x*.a2.tld2' 192.0.2.2 2 10 18 0 0 12 183 184 # These should be limited but are not. See RT33138. 185 ck_result 'y.x*.a2.tld2' 192.0.2.2 10 0 0 0 0 10 186 187 ######### 188 sec_start 189 190 burst 10 'x.a3.tld3' 191 burst 10 'y$CNT.a3.tld3' 192 burst 10 'z$CNT.a4.tld2' 193 194 # 10 identical recursive responses are limited 195 ck_result 'x.a3.tld3' 192.0.3.3 2 3 5 0 0 5 196 197 # 10 different recursive responses are not limited 198 ck_result 'y*.a3.tld3' 192.0.3.3 10 0 0 0 0 10 199 200 # 10 different NXDOMAIN responses are limited based on the parent name. 201 # We count 13 responses because we count truncated NXDOMAIN responses 202 # as both truncated and NXDOMAIN. 203 ck_result 'z*.a4.tld2' x 0 3 5 5 0 0 204 205 $RNDCCMD $ns2 stats 206 ckstats first dropped 36 207 ckstats first truncated 21 208 209 210 ######### 211 sec_start 212 213 burst 10 a5.tld2 +tcp 214 burst 10 a6.tld2 -b $ns7 215 burst 10 a7.tld4 216 burst 2 a8.tld2 -t AAAA 217 burst 2 a8.tld2 -t TXT 218 burst 2 a8.tld2 -t SPF 219 220 # IP TC drop NXDOMAIN SERVFAIL NOERROR 221 # TCP responses are not rate limited 222 ck_result a5.tld2 192.0.2.5 10 0 0 0 0 10 223 224 # whitelisted client is not rate limited 225 ck_result a6.tld2 192.0.2.6 10 0 0 0 0 10 226 227 # Errors such as SERVFAIL are rate limited. 228 ck_result a7.tld4 x 0 0 8 0 2 0 229 230 # NODATA responses are counted as the same regardless of qtype. 231 ck_result a8.tld2 x 0 2 2 0 0 4 232 233 $RNDCCMD $ns2 stats 234 ckstats second dropped 46 235 ckstats second truncated 23 236 237 238 ######### 239 sec_start 240 241 # IP TC drop NXDOMAIN SERVFAIL NOERROR 242 # all-per-second 243 # The qnames are all unique but the client IP address is constant. 244 QNUM=101 245 burst 60 'all$CNT.a9.tld2' 246 247 ck_result 'a*.a9.tld2' 192.0.2.8 50 0 10 0 0 50 248 249 $RNDCCMD $ns2 stats 250 ckstats final dropped 56 251 ckstats final truncated 23 252 253 ######### 254 sec_start 255 256 DIGOPTS="+nocookie +nosearch +time=1 +tries=1 +ignore -p ${PORT}" 257 $DIG $DIGOPTS @$ns4 A a7.tld4 > /dev/null 2>&1 258 $DIG $DIGOPTS @$ns4 A a7.tld4 > /dev/null 2>&1 259 $DIG $DIGOPTS @$ns4 A a7.tld4 > /dev/null 2>&1 260 $DIG $DIGOPTS @$ns4 A a7.tld4 > /dev/null 2>&1 261 $DIG $DIGOPTS @$ns4 A a7.tld4 > /dev/null 2>&1 262 $DIG $DIGOPTS @$ns4 A a7.tld4 > /dev/null 2>&1 263 $DIG $DIGOPTS @$ns4 A a7.tld4 > /dev/null 2>&1 264 $DIG $DIGOPTS @$ns4 A a7.tld4 > /dev/null 2>&1 265 $DIG $DIGOPTS @$ns4 A a7.tld4 > /dev/null 2>&1 266 $DIG $DIGOPTS @$ns4 A a7.tld4 > /dev/null 2>&1 267 $DIG $DIGOPTS @$ns4 A a7.tld4 > /dev/null 2>&1 268 269 grep "would limit" ns4/named.run >/dev/null 2>&1 || 270 setret "\"would limit\" not found in log file." 271 272 $NAMED -gc broken.conf > broken.out 2>&1 & 273 sleep 2 274 grep "min-table-size 1" broken.out > /dev/null || setret "min-table-size 0 was not changed to 1" 275 276 if [ -f named.pid ]; then 277 $KILL `cat named.pid` 278 setret "named should not have started, but did" 279 fi 280 281 echo_i "exit status: $ret" 282 [ $ret -eq 0 ] || exit 1 283
Indexes created Thu Mar 19 00:23:35 UTC 2026