1Copyright (C) 2015 Internet Systems Consortium, Inc. ("ISC") 2See COPYRIGHT in the source root or http://isc.org/copyright.html for terms. 3 4These tests check RPZ recursion behavior (including skipping 5recursion when appropriate). 6 7The general structure of the tests is: 8 9* The resolver (ns2) with an unqualified view containing the policy 10 zones, the response-policy statement, and a root hint zone 11 12* The auth server that contains two authoritative zones, l1.l0 and 13 l2.l1.l0, both delegated to itself. l2.l1.l0 specifies a non-existent 14 zone data file and so will generate SERVFAILs for any queries to it. 15 16The l2.l1.l0 zone was chosen to generate SERVFAIL responses because RPZ 17evaluation will use that error response whenever it encounters it during 18processing, thus making it a binary indicator for whether or not 19recursion was attempted. This also allows us to not worry about having 20to craft 'ip', 'nsdname', and 'nsip' rules that matched the queries. 21 22Each test is intended to be fed a number of queries constructed as 23qXX.l2.l1.l0, where XX is the 1-based query sequence number (e.g. the 24first query of each test is q01.l2.l1.l0). 25 26For all the tests the triggers are constructed as follows: 27client-ip - match 127.0.0.1/32 28ip - match 255.255.255.255/32 (does not matter due to SERVFAIL) 29nsdname - match ns.example.org (also does not matter) 30nsip - match 255.255.255.255/32 (also does not matter) 31qname - match qXX.l2.l1.l0, where XX is the query sequence number that 32is intended to be matched by this qname rule. 33 34Here's the detail on the test cases: 35 36Group 1 - testing skipping recursion for a single policy zone with only 37records that allow recursion to be skipped 38 39Test 1a: 40 1 policy zone containing 1 'client-ip' trigger 41 1 query, expected to skip recursion 42 43Test 1b: 44 1 policy zone containing 1 'qname' trigger (q01) 45 2 queries, q01 is expected to skip recursion, q02 is expected to 46 recurse 47 48Test 1c: 49 1 policy zone containing both a 'client-ip' and 'qname' trigger (q02) 50 1 query, expected to skip recursion 51 52Group 2 - testing skipping recursion with multiple policy zones when all 53zones have only trigger types eligible to skip recursion with 54 55Test 2a: 56 32 policy zones, each containing 1 'qname' trigger (qNN, where NN is 57 the zone's sequence 1-based sequence number formatted to 2 digits, 58 so each of the first 32 queries should match a different zone) 59 33 queries, the first 32 of which are expected to skip recursion 60 while the 33rd is expected to recurse 61 62Group 3 - Testing interaction of triggers that require recursion when in 63a single zone, both alone and with triggers that allow recursion to be 64skipped 65 66Test 3a: 67 1 policy zone containing 1 'ip' trigger 68 1 query, expected to recurse 69 70Test 3b: 71 1 policy zone containing 1 'nsdname' trigger 72 1 query, expected to recurse 73 74Test 3c: 75 1 policy zone containing 1 'nsip' trigger 76 1 query, expected to recurse 77 78Test 3d: 79 1 policy zone containing 1 'ip' trigger and 1 'qname' trigger (q02) 80 2 queries, the first should not recurse and the second should recurse 81 82Test 3e: 83 1 policy zone containing 1 'nsdname' trigger and 1 'qname' trigger 84 (q02) 85 2 queries, the first should not recurse and the second should recurse 86 87Test 3f: 88 1 policy zone containing 1 'nsip' trigger and 1 'qname' trigger (q02) 89 2 queries, the first should not recurse and the second should recurse 90 91Group 4 - contains 32 subtests designed to verify that recursion is 92skippable for only the appropriate zones based on the order specified in 93the 'response-policy' statement 94 95Tests 4aa to 4bf: 96 32 policy zones per test, one of which is configured with 1 'ip' 97 trigger and one 'qname' trigger while the others are configured 98 only with 1 'qname' trigger. The zone with both triggers starts 99 listed first and is moved backwards by one position with each 100 test. The 'qname' triggers in the zones are structured so that 101 the zones are tested starting with the first zone and the 'ip' 102 trigger is tested before the 'qname' trigger for that zone. 103 33 queries per test, where the number expected to skip recursion 104 matches the test sequence number: e.g. 1 skip for 4aa, 26 skips 105 for 4az, and 32 skips for 4bf 106 107Group 5 - This test verifies that the "pivot" policy zone for whether or 108not recursion can be skipped is the first listed zone with applicable 109trigger types rather than a later listed zone. 110 111Test 5a: 112 5 policy zones, the 1st, 3rd, and 5th configured with 1 'qname' 113 trigger each (q01, q04, and q06, respectively), the 2nd and 4th 114 each configured with an 'ip' and 'qname' trigger (q02 and q05, 115 respectively for the 'qname' triggers 116 6 queries, of which only q01 and q02 are expected to skip recursion 117