chg: test: Use isctest.asyncserver in the "chain" test

Replace the custom DNS servers used in the "chain" system test with
new code based on the isctest.asyncserver module.

For ans3, replace the sequence of logical conditions present in Perl
code with zone files and a limited amount of custom logic applied on top
of them where necessary.

For ans4, replace the ctl_channel() and create_response() functions with
a custom control command handler coupled with a dynamically instantiated
response handler, making the code more robust and readable.

Migrate sendcmd() and its uses to the new way of sending control queries
to custom servers used in system tests.

Depends on !10409

Merge branch 'michal/chain-asyncserver' into 'main'

See merge request isc-projects/bind9!10410

bin/tests/system/chain/ans3/ans.pl

@@ -1,167 +0,0 @@
-#!/usr/bin/env perl
-
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# SPDX-License-Identifier: MPL-2.0
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0.  If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-use strict;
-use warnings;
-
-use IO::File;
-use Getopt::Long;
-use Net::DNS::Nameserver;
-
-my $pidf = new IO::File "ans.pid", "w" or die "cannot open pid file: $!";
-print $pidf "$$\n" or die "cannot write pid file: $!";
-$pidf->close or die "cannot close pid file: $!";
-sub rmpid { unlink "ans.pid"; exit 1; };
-sub term { };
-
-$SIG{INT} = \&rmpid;
-if ($Net::DNS::VERSION > 1.41) {
-    $SIG{TERM} = \&term;
-} else {
-    $SIG{TERM} = \&rmpid;
-}
-
-my $localaddr = "10.53.0.3";
-
-my $localport = int($ENV{'PORT'});
-if (!$localport) { $localport = 5300; }
-
-my $verbose = 0;
-my $ttl = 60;
-my $zone = "example.broken";
-my $nsname = "ns3.$zone";
-my $synth = "synth-then-dname.$zone";
-my $synth2 = "synth2-then-dname.$zone";
-
-sub reply_handler {
-    my ($qname, $qclass, $qtype, $peerhost, $query, $conn) = @_;
-    my ($rcode, @ans, @auth, @add);
-
-    print ("request: $qname/$qtype\n");
-    STDOUT->flush();
-
-    if ($qname eq "example.broken") {
-	if ($qtype eq "SOA") {
-	    my $rr = new Net::DNS::RR("$qname $ttl $qclass SOA . . 0 0 0 0 0");
-	    push @ans, $rr;
-	} elsif ($qtype eq "NS") {
-	    my $rr = new Net::DNS::RR("$qname $ttl $qclass NS $nsname");
-	    push @ans, $rr;
-	    $rr = new Net::DNS::RR("$nsname $ttl $qclass A $localaddr");
-	    push @add, $rr;
-	}
-	$rcode = "NOERROR";
-    } elsif ($qname eq "cname-to-$synth2") {
-	my $rr = new Net::DNS::RR("$qname $ttl $qclass CNAME name.$synth2");
-	push @ans, $rr;
-	$rr = new Net::DNS::RR("name.$synth2 $ttl $qclass CNAME name");
-	push @ans, $rr;
-	$rr = new Net::DNS::RR("$synth2 $ttl $qclass DNAME .");
-	push @ans, $rr;
-	$rcode = "NOERROR";
-    } elsif ($qname eq "$synth" || $qname eq "$synth2") {
-	if ($qtype eq "DNAME") {
-	    my $rr = new Net::DNS::RR("$qname $ttl $qclass DNAME .");
-	    push @ans, $rr;
-	}
-	$rcode = "NOERROR";
-    } elsif ($qname eq "name.$synth") {
-	my $rr = new Net::DNS::RR("$qname $ttl $qclass CNAME name.");
-	push @ans, $rr;
-	$rr = new Net::DNS::RR("$synth $ttl $qclass DNAME .");
-	push @ans, $rr;
-	$rcode = "NOERROR";
-    } elsif ($qname eq "name.$synth2") {
-	my $rr = new Net::DNS::RR("$qname $ttl $qclass CNAME name.");
-	push @ans, $rr;
-	$rr = new Net::DNS::RR("$synth2 $ttl $qclass DNAME .");
-	push @ans, $rr;
-	$rcode = "NOERROR";
-    # The following three code branches referring to the "example.dname"
-    # zone are necessary for the resolver variant of the CVE-2021-25215
-    # regression test to work.  A named instance cannot be used for
-    # serving the DNAME records below as a version of BIND vulnerable to
-    # CVE-2021-25215 would crash while answering the queries asked by
-    # the tested resolver.
-    } elsif ($qname eq "ns3.example.dname") {
-	if ($qtype eq "A") {
-		my $rr = new Net::DNS::RR("$qname $ttl $qclass A 10.53.0.3");
-		push @ans, $rr;
-	}
-	if ($qtype eq "AAAA") {
-		my $rr = new Net::DNS::RR("example.dname. $ttl $qclass SOA . . 0 0 0 0 $ttl");
-		push @auth, $rr;
-	}
-	$rcode = "NOERROR";
-    } elsif ($qname eq "self.example.self.example.dname") {
-	my $rr = new Net::DNS::RR("self.example.dname. $ttl $qclass DNAME dname.");
-	push @ans, $rr;
-	$rr = new Net::DNS::RR("$qname $ttl $qclass CNAME self.example.dname.");
-	push @ans, $rr;
-	$rcode = "NOERROR";
-    } elsif ($qname eq "self.example.dname") {
-	if ($qtype eq "DNAME") {
-		my $rr = new Net::DNS::RR("$qname $ttl $qclass DNAME dname.");
-		push @ans, $rr;
-	}
-	$rcode = "NOERROR";
-    # The next few branches produce a zone with an illegal NS below a DNAME.
-    } elsif ($qname eq "jeff.dname") {
-	if ($qtype eq "SOA") {
-	    my $rr = new Net::DNS::RR("$qname $ttl $qclass SOA . . 0 0 0 0 0");
-	    push @ans, $rr;
-	} elsif ($qtype eq "NS") {
-	    my $rr = new Net::DNS::RR("$qname $ttl $qclass NS ns.jeff.dname.");
-	    push @ans, $rr;
-	    $rr = new Net::DNS::RR("$nsname $ttl $qclass A $localaddr");
-	    push @add, $rr;
-	} elsif ($qtype eq "DNAME") {
-	    my $rr = new Net::DNS::RR("$qname $ttl $qclass DNAME mutt.example.");
-	    push @ans, $rr;
-	}
-	$rcode = "NOERROR";
-    } elsif ($qname eq "ns.jeff.dname") {
-	if ($qtype eq "A") {
-		my $rr = new Net::DNS::RR("$qname $ttl $qclass A 10.53.0.3");
-		push @ans, $rr;
-	} elsif ($qtype eq "AAAA") {
-		my $rr = new Net::DNS::RR("jeff.dname. $ttl $qclass SOA . . 0 0 0 0 $ttl");
-		push @auth, $rr;
-	}
-	$rcode = "NOERROR";
-    } else {
-	$rcode = "REFUSED";
-    }
-    return ($rcode, \@ans, \@auth, \@add, { aa => 1 });
-}
-
-GetOptions(
-    'port=i' => \$localport,
-    'verbose!' => \$verbose,
-);
-
-my $ns = Net::DNS::Nameserver->new(
-    LocalAddr => $localaddr,
-    LocalPort => $localport,
-    ReplyHandler => \&reply_handler,
-    Verbose => $verbose,
-);
-
-if ($Net::DNS::VERSION >= 1.42) {
-    $ns->start_server();
-    select(undef, undef, undef, undef);
-    $ns->stop_server();
-    unlink "ans.pid";
-} else {
-    $ns->main_loop;
-}

bin/tests/system/chain/ans3/ans.py

@@ -0,0 +1,122 @@
+"""
+Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+
+SPDX-License-Identifier: MPL-2.0
+
+This Source Code Form is subject to the terms of the Mozilla Public
+License, v. 2.0.  If a copy of the MPL was not distributed with this
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
+
+See the COPYRIGHT file distributed with this work for additional
+information regarding copyright ownership.
+"""
+
+from typing import AsyncGenerator
+
+import dns.name
+import dns.rdataclass
+import dns.rdatatype
+import dns.rrset
+import dns.zone
+
+from isctest.asyncserver import (
+    AsyncDnsServer,
+    DnsResponseSend,
+    DomainHandler,
+    QueryContext,
+    ResponseAction,
+)
+
+try:
+    dns_namerelation_equal = dns.name.NameRelation.EQUAL
+    dns_namerelation_subdomain = dns.name.NameRelation.SUBDOMAIN
+except AttributeError:  # dnspython < 2.0.0 compat
+    dns_namerelation_equal = dns.name.NAMERELN_EQUAL  # type: ignore
+    dns_namerelation_subdomain = dns.name.NAMERELN_SUBDOMAIN  # type: ignore
+
+
+def get_dname_rrset_at_name(
+    zone: dns.zone.Zone, name: dns.name.Name
+) -> dns.rrset.RRset:
+    node = zone.get_node(name)
+    assert node
+    dname = node.get_rdataset(dns.rdataclass.IN, dns.rdatatype.DNAME)
+    assert dname
+    rrset = dns.rrset.RRset(name, dname.rdclass, dname.rdtype)
+    rrset.update(dname)
+    return rrset
+
+
+class CnameThenDnameHandler(DomainHandler):
+    """
+    For certain trigger QNAMEs, insert a DNAME RRset after the CNAME chain
+    prepared from zone data.
+    """
+
+    domains = ["example.broken."]
+
+    async def get_responses(
+        self, qctx: QueryContext
+    ) -> AsyncGenerator[ResponseAction, None]:
+        assert qctx.zone
+        assert qctx.zone.origin
+
+        relative_qname = qctx.qname.relativize(qctx.zone.origin)
+        if relative_qname.labels[-1].endswith(b"-then-dname"):
+            last_cname = qctx.response.answer[-1]
+            assert last_cname.rdtype == dns.rdatatype.CNAME
+            dname_owner = last_cname.name.parent()
+            dname_rrset = get_dname_rrset_at_name(qctx.zone, dname_owner)
+            qctx.response.answer.append(dname_rrset)
+
+        yield DnsResponseSend(qctx.response, authoritative=True)
+
+
+class Cve202125215(DomainHandler):
+    """
+    Attempt to trigger the resolver variant of CVE-2021-25215.  A `named`
+    instance cannot be used for serving the DNAME records returned by this
+    response handler as a version of BIND 9 vulnerable to CVE-2021-25215 would
+    crash while answering the queries sent by the tested resolver.
+    """
+
+    domains = ["example.dname."]
+
+    async def get_responses(
+        self, qctx: QueryContext
+    ) -> AsyncGenerator[ResponseAction, None]:
+        assert qctx.zone
+        assert qctx.zone.origin
+
+        self_example_dname = dns.name.Name(["self"]).concatenate(qctx.zone.origin)
+        dname_rrset = get_dname_rrset_at_name(qctx.zone, self_example_dname)
+
+        relation, _, _ = qctx.qname.fullcompare(self_example_dname)
+
+        if relation in (dns_namerelation_equal, dns_namerelation_subdomain):
+            del qctx.response.authority[:]
+            qctx.response.set_rcode(dns.rcode.NOERROR)
+
+        if relation == dns_namerelation_subdomain:
+            qctx.response.answer.append(dname_rrset)
+            cname_rrset = dns.rrset.from_text(
+                qctx.qname,
+                60,
+                qctx.qclass,
+                dns.rdatatype.CNAME,
+                self_example_dname.to_text(),
+            )
+            qctx.response.answer.append(cname_rrset)
+
+        yield DnsResponseSend(qctx.response, authoritative=True)
+
+
+def main() -> None:
+    server = AsyncDnsServer(acknowledge_manual_dname_handling=True)
+    server.install_response_handler(CnameThenDnameHandler())
+    server.install_response_handler(Cve202125215())
+    server.run()
+
+
+if __name__ == "__main__":
+    main()

bin/tests/system/chain/ans3/example.broken.db

@@ -0,0 +1,29 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@				60	SOA	. . 0 0 0 0 0
+
+@				60	NS	ns3
+ns3				60	A	10.53.0.3
+
+cname-to-synth2-then-dname	60	CNAME	name.synth2-then-dname
+
+name.synth-then-dname		60	CNAME	name.
+name.synth2-then-dname		60	CNAME	name.
+
+; isctest.asyncserver does no special handling of DNAME records (e.g. by
+; occluding names below them or synthesizing CNAMEs), so the following
+; DNAME records are only returned for certain trigger QNAMEs (see
+; CnameThenDnameHandler.get_responses() in ans3/ans.py) or if they are
+; queried for explicitly.
+
+synth-then-dname		60	DNAME	.
+synth2-then-dname		60	DNAME	.

bin/tests/system/chain/ans3/example.dname.db

@@ -0,0 +1,24 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@	60	SOA	. . 0 0 0 0 0
+
+@	60	NS	ns3
+ns3	60	A	10.53.0.3
+
+; isctest.asyncserver does no special handling of DNAME records (e.g. by
+; occluding names below them or synthesizing CNAMEs), so the following
+; DNAME record is only appended to responses by a custom response
+; handler that attempts to trigger the resolver variant of
+; CVE-2021-25215 in `named` (see Cve202125215Handler.get_responses()
+; in ans3/ans.py) or when it is queried for explicitly.
+
+self	60	DNAME	dname.

bin/tests/system/chain/ans3/jeff.dname.db

@@ -0,0 +1,21 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+@	60	SOA	. . 0 0 0 0 0
+
+@	60	NS	ns
+ns	60	A	10.53.0.3
+
+; isctest.asyncserver does no special handling of DNAME records (e.g. by
+; occluding names below them or synthesizing CNAMEs), so the following
+; DNAME record is only returned when it is queried for explicitly.
+
+@	60	DNAME	mutt.example.

bin/tests/system/chain/ans4/.gitignore

@@ -1 +0,0 @@
-/*.pyc

bin/tests/system/chain/ans4/README.anspy

@@ -1,24 +0,0 @@
-Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-
-SPDX-License-Identifier: MPL-2.0
-
-This Source Code Form is subject to the terms of the Mozilla Public
-License, v. 2.0.  If a copy of the MPL was not distributed with this
-file, you can obtain one at https://mozilla.org/MPL/2.0/.
-
-See the COPYRIGHT file distributed with this work for additional
-information regarding copyright ownership.
-
-REQUIREMENTS
-ans.py requires at least dnspython 1.12.0.
-
-"ans.py" is a fairly simple Python script that will respond as an
-authoritative server to DNS queries. It opens a UDP socket on 10.53.0.4
-and fd92:7065:b8e:ffff::8, port 5300 (or PORT) (these are for DNS queries)
-and a TCP socket addresses on 10.53.0.4 at port 5301 (or EXTRAPORT1)
-(this is the control channel).
-
-Please note that all functionality and formatting are subject to change as
-we determine what features the tool will need.
-
-"ans.py" will respond to queries as follows: TBD

bin/tests/system/chain/ans4/ans.py

@@ -1,386 +1,481 @@
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+"""
-#
+Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-# SPDX-License-Identifier: MPL-2.0
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0.  If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
 
-############################################################################
+SPDX-License-Identifier: MPL-2.0
-# ans.py: See README.anspy for details.
-############################################################################
 
-from __future__ import print_function
+This Source Code Form is subject to the terms of the Mozilla Public
-import os
+License, v. 2.0.  If a copy of the MPL was not distributed with this
-import sys
+file, you can obtain one at https://mozilla.org/MPL/2.0/.
-import signal
-import socket
-import select
-from datetime import datetime, timedelta
-import functools
 
-import dns, dns.message, dns.query
+See the COPYRIGHT file distributed with this work for additional
-from dns.rdatatype import *
+information regarding copyright ownership.
-from dns.rdataclass import *
+"""
-from dns.rcode import *
-from dns.name import *
 
-############################################################################
+from dataclasses import dataclass
-# set up the RRs to be returned in the next answer
+from enum import Enum
-#
+from typing import AsyncGenerator, List, Optional, Tuple
-# the message contains up to two pipe-separated ('|') fields.
+
-#
+import abc
-# the first field of the message is a comma-separated list
+import logging
-# of actions indicating what to put into the answer set
+import re
-# (e.g., a dname, a cname, another cname, etc)
+
-#
+import dns.rcode
-# supported actions:
+import dns.rdata
-# - cname (cname from the current name to a new one in the same domain)
+import dns.rdataclass
-# - dname (dname to a new domain, plus a synthesized cname)
+import dns.rdatatype
-# - xname ("external" cname, to a new name in a new domain)
+import dns.rrset
-#
+
-# example: xname, dname, cname represents a CNAME to an external
+from isctest.asyncserver import (
-# domain which is then answered by a DNAME and synthesized
+    ControlCommand,
-# CNAME pointing to yet another domain, which is then answered
+    ControllableAsyncDnsServer,
-# by a CNAME within the same domain, and finally an answer
+    DnsResponseSend,
-# to the query. each RR in the answer set has a corresponding
+    DomainHandler,
-# RRSIG. these signatures are not valid, but will exercise the
+    QueryContext,
-# response parser.
+    ResponseAction,
-#
+)
-# the second field is a comma-separated list of which RRs in the
+
-# answer set to include in the answer, in which order. if prepended
+try:
-# with 's', the number indicates which signature to include.
+    RdataType = dns.rdatatype.RdataType
-#
+except AttributeError:  # dnspython < 2.0.0 compat
-# examples: for the answer set "cname, cname, cname", an rr set
+    RdataType = int  # type: ignore
-# '1, s1, 2, s2, 3, s3, 4, s4' indicates that all four RRs should
-# be included in the answer, with siagntures, in the original
-# order, while 4, s4, 3, s3, 2, s2, 1, s1' indicates the order
-# should be reversed, 's3, s3, s3, s3' indicates that the third
-# RRSIG should be repeated four times and everything else should
-# be omitted, and so on.
-#
-# if there is no second field (i.e., no pipe symbol appears in
-# the line) , the default is to send all answers and signatures.
-# if a pipe symbol exists but the second field is empty, then
-# nothing is sent at all.
-############################################################################
-actions = []
-rrs = []
 
 
-def ctl_channel(msg):
+class ChainNameGenerator:
-    global actions, rrs
+    """
+    Convenience class generating sequential owner/target names used in chained
+    responses.
 
-    msg = msg.splitlines().pop(0)
+    >>> name_generator = ChainNameGenerator()
-    print("received control message: %s" % msg)
+    >>> name_generator.current_name
+    <DNS name test.domain.nil.>
+    >>> name_generator.generate_next_name()
+    <DNS name cname0.domain.nil.>
+    >>> name_generator.generate_next_name()
+    <DNS name cname1.domain.nil.>
+    >>> name_generator.generate_next_sld()
+    <DNS name domain2.nil.>
+    >>> name_generator.generate_next_sld()
+    <DNS name domain3.nil.>
+    >>> name_generator.current_name
+    <DNS name cname1.domain3.nil.>
+    >>> name_generator.generate_next_name()
+    <DNS name cname4.domain3.nil.>
+    >>> name_generator.generate_next_name_in_next_sld()
+    <DNS name cname5.domain6.nil.>
+    >>> name_generator.generate_next_name_in_next_sld()
+    <DNS name cname7.domain8.nil.>
+    """
 
-    msg = msg.split(b"|")
+    def __init__(self) -> None:
-    if len(msg) == 0:
+        self._i = 0
-        return
+        self._current_label = dns.name.Name(["test"])
+        self._current_sld = dns.name.Name(["domain"])
+        self._tld = dns.name.Name(["nil", ""])
 
-    actions = [x.strip() for x in msg[0].split(b",")]
+    @property
-    n = functools.reduce(
+    def current_name(self) -> dns.name.Name:
-        lambda n, act: (n + (2 if act == b"dname" else 1)), [0] + actions
+        return self._current_label.concatenate(self.current_domain)
-    )
 
-    if len(msg) == 1:
+    @property
-        rrs = []
+    def current_domain(self) -> dns.name.Name:
-        for i in range(n):
+        return self._current_sld.concatenate(self._tld)
-            for b in [False, True]:
-                rrs.append((i, b))
-        return
 
-    rlist = [x.strip() for x in msg[1].split(b",")]
+    def generate_next_name(self) -> dns.name.Name:
-    rrs = []
+        self._current_label = dns.name.Name([f"cname{self._i}"])
-    for item in rlist:
+        self._i += 1
-        if item[0] == b"s"[0]:
+        return self.current_name
-            i = int(item[1:].strip()) - 1
+
-            if i > n:
+    def generate_next_sld(self) -> dns.name.Name:
-                print("invalid index %d" + (i + 1))
+        self._current_sld = dns.name.Name([f"domain{self._i}"])
-                continue
+        self._i += 1
-            rrs.append((int(item[1:]) - 1, True))
+        return self.current_domain
-        else:
+
-            i = int(item) - 1
+    def generate_next_name_in_next_sld(self) -> dns.name.Name:
-            if i > n:
+        self.generate_next_name()
-                print("invalid index %d" % (i + 1))
+        self.generate_next_sld()
-                continue
+        return self.current_name
-            rrs.append((i, False))
 
 
-############################################################################
+class RecordGenerator(abc.ABC):
-# Respond to a DNS query.
+    """
-############################################################################
+    An abstract class used as a base class for RRset generators (see the
-def create_response(msg):
+    description of "actions" in `ChainSetupCommand`) and as a convenience class
-    m = dns.message.from_wire(msg)
+    for creating RRsets in `ChainResponseHandler`.
-    qname = m.question[0].name.to_text()
+    """
-    labels = qname.lower().split(".")
-    wantsigs = True if m.ednsflags & dns.flags.DO else False
 
-    # get qtype
+    @classmethod
-    rrtype = m.question[0].rdtype
+    def create_rrset(
-    typename = dns.rdatatype.to_text(rrtype)
+        cls, owner: dns.name.Name, rrtype: RdataType, rdata: str
+    ) -> dns.rrset.RRset:
+        return dns.rrset.from_text(owner, 86400, dns.rdataclass.IN, rrtype, rdata)
 
-    # for 'www.example.com.'...
+    @classmethod
-    # - name is 'www'
+    def create_rrset_signature(
-    # - domain is 'example.com.'
+        cls, owner: dns.name.Name, rrtype: RdataType
-    # - sld is 'example'
+    ) -> dns.rrset.RRset:
-    # - tld is 'com.'
+        covers = dns.rdatatype.to_text(rrtype)
-    name = labels.pop(0)
+        ttl = "86400"
-    domain = ".".join(labels)
+        expiry = "20900101000000"
-    sld = labels.pop(0)
+        inception = "20250101000000"
-    tld = ".".join(labels)
+        domain = "domain.nil."
+        sigdata = "OCXH2De0yE4NMTl9UykvOsJ4IBGs/ZIpff2rpaVJrVG7jQfmj50otBAp "
+        sigdata += "A0Zo7dpBU4ofv0N/F2Ar6LznCncIojkWptEJIAKA5tHegf/jY39arEpO "
+        sigdata += "cevbGp6DKxFhlkLXNcw7k9o7DSw14OaRmgAjXdTFbrl4AiAa0zAttFko "
+        sigdata += "Tso="
+        rdata = f"{covers} 5 3 {ttl} {expiry} {inception} 12345 {domain} {sigdata}"
+        return cls.create_rrset(owner, dns.rdatatype.RRSIG, rdata)
 
-    print("query: " + qname + "/" + typename)
+    def __init__(self, name_generator: ChainNameGenerator) -> None:
-    print("domain: " + domain)
+        self._name_generator = name_generator
 
-    # default answers, depending on QTYPE.
+    def get_rrsets(self) -> Tuple[List[dns.rrset.RRset], List[dns.rrset.RRset]]:
-    # currently only A, AAAA, TXT and NS are supported.
+        """
-    ttl = 86400
+        Return the lists of records and their signatures that should be
-    additionalA = "10.53.0.4"
+        generated in response to a given "action".
-    additionalAAAA = "fd92:7065:b8e:ffff::4"
-    if typename == "A":
-        final = "10.53.0.4"
-    elif typename == "AAAA":
-        final = "fd92:7065:b8e:ffff::4"
-    elif typename == "TXT":
-        final = "Some\ text\ here"
-    elif typename == "NS":
-        domain = qname
-        final = "ns1.%s" % domain
-    else:
-        final = None
 
-    # RRSIG rdata - won't validate but will exercise response parsing
+        This method is a wrapper around `generate_rrsets()` that ensures all
-    t = datetime.now()
+        derived classes obey their promises about the number of records they
-    delta = timedelta(30)
+        generate.
-    t1 = t - delta
+        """
-    t2 = t + delta
+        responses, signatures = self.generate_rrsets()
-    inception = t1.strftime("%Y%m%d000000")
+        assert len(responses) == self.response_count
-    expiry = t2.strftime("%Y%m%d000000")
+        assert len(signatures) == self.response_count
-    sigdata = "OCXH2De0yE4NMTl9UykvOsJ4IBGs/ZIpff2rpaVJrVG7jQfmj50otBAp A0Zo7dpBU4ofv0N/F2Ar6LznCncIojkWptEJIAKA5tHegf/jY39arEpO cevbGp6DKxFhlkLXNcw7k9o7DSw14OaRmgAjXdTFbrl4AiAa0zAttFko Tso="
+        return responses, signatures
 
-    # construct answer set.
+    @property
-    answers = []
+    @abc.abstractmethod
-    sigs = []
+    def response_count(self) -> int:
-    curdom = domain
+        """
-    curname = name
+        How many records this generator creates each time the "action"
-    i = 0
+        associated with it is used.  Every generated record needs to be
+        accompanied by its corresponding signature, so e.g. setting this to 1
+        causes `get_rrsets()` callers to expect it to return two RRset lists,
+        each containing one RRset.
 
-    for action in actions:
+        This property could be derived from the size of the lists returned by
-        if name != "test":
+        `generate_rrsets()`, but it is left as a separate value to enable early
-            continue
+        detection of invalid "selector" indexes when the control commands are
-        if action == b"xname":
+        first parsed.
-            owner = curname + "." + curdom
+        """
-            newname = "cname%d" % i
+        raise NotImplementedError
-            i += 1
-            newdom = "domain%d.%s" % (i, tld)
-            i += 1
-            target = newname + "." + newdom
-            print("add external CNAME %s to %s" % (owner, target))
-            answers.append(dns.rrset.from_text(owner, ttl, IN, CNAME, target))
-            rrsig = "CNAME 5 3 %d %s %s 12345 %s %s" % (
-                ttl,
-                expiry,
-                inception,
-                domain,
-                sigdata,
-            )
-            print("add external RRISG(CNAME) %s to %s" % (owner, target))
-            sigs.append(dns.rrset.from_text(owner, ttl, IN, RRSIG, rrsig))
-            curname = newname
-            curdom = newdom
-            continue
 
-        if action == b"cname":
+    @abc.abstractmethod
-            owner = curname + "." + curdom
+    def generate_rrsets(self) -> Tuple[List[dns.rrset.RRset], List[dns.rrset.RRset]]:
-            newname = "cname%d" % i
+        """
-            target = newname + "." + curdom
+        Return the lists of records and their signatures that should be
-            i += 1
+        generated in response to a given "action".
-            print("add CNAME %s to %s" % (owner, target))
-            answers.append(dns.rrset.from_text(owner, ttl, IN, CNAME, target))
-            rrsig = "CNAME 5 3 %d %s %s 12345 %s %s" % (
-                ttl,
-                expiry,
-                inception,
-                domain,
-                sigdata,
-            )
-            print("add RRSIG(CNAME) %s to %s" % (owner, target))
-            sigs.append(dns.rrset.from_text(owner, ttl, IN, RRSIG, rrsig))
-            curname = newname
-            continue
 
-        if action == b"dname":
+        This method must be defined by every derived class, but RecordGenerator
-            owner = curdom
+        users should call `get_rrsets()` instead.
-            newdom = "domain%d.%s" % (i, tld)
+        """
-            i += 1
+        raise NotImplementedError
-            print("add DNAME %s to %s" % (owner, newdom))
-            answers.append(dns.rrset.from_text(owner, ttl, IN, DNAME, newdom))
-            rrsig = "DNAME 5 3 %d %s %s 12345 %s %s" % (
-                ttl,
-                expiry,
-                inception,
-                domain,
-                sigdata,
-            )
-            print("add RRSIG(DNAME) %s to %s" % (owner, newdom))
-            sigs.append(dns.rrset.from_text(owner, ttl, IN, RRSIG, rrsig))
-            owner = curname + "." + curdom
-            target = curname + "." + newdom
-            print("add synthesized CNAME %s to %s" % (owner, target))
-            answers.append(dns.rrset.from_text(owner, ttl, IN, CNAME, target))
-            rrsig = "CNAME 5 3 %d %s %s 12345 %s %s" % (
-                ttl,
-                expiry,
-                inception,
-                domain,
-                sigdata,
-            )
-            print("add synthesized RRSIG(CNAME) %s to %s" % (owner, target))
-            sigs.append(dns.rrset.from_text(owner, ttl, IN, RRSIG, rrsig))
-            curdom = newdom
-            continue
 
-    # now add the final answer
-    owner = curname + "." + curdom
-    answers.append(dns.rrset.from_text(owner, ttl, IN, rrtype, final))
-    rrsig = "%s 5 3 %d %s %s 12345 %s %s" % (
-        typename,
-        ttl,
-        expiry,
-        inception,
-        domain,
-        sigdata,
-    )
-    sigs.append(dns.rrset.from_text(owner, ttl, IN, RRSIG, rrsig))
 
-    # prepare the response and convert to wire format
+class CnameRecordGenerator(RecordGenerator):
-    r = dns.message.make_response(m)
 
-    if name != "test":
+    response_count = 1
-        r.answer.append(answers[-1])
-        if wantsigs:
-            r.answer.append(sigs[-1])
-    else:
-        for i, sig in rrs:
-            if sig and not wantsigs:
-                continue
-            elif sig:
-                r.answer.append(sigs[i])
-            else:
-                r.answer.append(answers[i])
 
-    if typename != "NS":
+    def generate_rrsets(self) -> Tuple[List[dns.rrset.RRset], List[dns.rrset.RRset]]:
-        r.authority.append(
+        owner = self._name_generator.current_name
-            dns.rrset.from_text(domain, ttl, IN, "NS", ("ns1.%s" % domain))
+        target = self._name_generator.generate_next_name().to_text()
+        response = self.create_rrset(owner, dns.rdatatype.CNAME, target)
+        signature = self.create_rrset_signature(owner, response.rdtype)
+        return [response], [signature]
+
+
+class DnameRecordGenerator(RecordGenerator):
+
+    response_count = 2
+
+    def generate_rrsets(self) -> Tuple[List[dns.rrset.RRset], List[dns.rrset.RRset]]:
+        dname_owner = self._name_generator.current_domain
+        cname_owner = self._name_generator.current_name
+        dname_target = self._name_generator.generate_next_sld().to_text()
+        cname_target = self._name_generator.current_name.to_text()
+        dname_response = self.create_rrset(
+            dname_owner, dns.rdatatype.DNAME, dname_target
         )
-    r.additional.append(
+        cname_response = self.create_rrset(
-        dns.rrset.from_text(("ns1.%s" % domain), 86400, IN, A, additionalA)
+            cname_owner, dns.rdatatype.CNAME, cname_target
-    )
+        )
-    r.additional.append(
+        dname_signature = self.create_rrset_signature(
-        dns.rrset.from_text(("ns1.%s" % domain), 86400, IN, AAAA, additionalAAAA)
+            dname_owner, dname_response.rdtype
-    )
+        )
-
+        cname_signature = self.create_rrset_signature(
-    r.flags |= dns.flags.AA
+            cname_owner, cname_response.rdtype
-    r.use_edns()
+        )
-    return r.to_wire()
+        return [dname_response, cname_response], [dname_signature, cname_signature]
 
 
-def sigterm(signum, frame):
+class XnameRecordGenerator(RecordGenerator):
-    print("Shutting down now...")
+
-    os.remove("ans.pid")
+    response_count = 1
-    running = False
+
-    sys.exit(0)
+    def generate_rrsets(self) -> Tuple[List[dns.rrset.RRset], List[dns.rrset.RRset]]:
+        owner = self._name_generator.current_name
+        target = self._name_generator.generate_next_name_in_next_sld().to_text()
+        response = self.create_rrset(owner, dns.rdatatype.CNAME, target)
+        signature = self.create_rrset_signature(owner, response.rdtype)
+        return [response], [signature]
 
 
-############################################################################
+class FinalRecordGenerator(RecordGenerator):
-# Main
-#
-# Set up responder and control channel, open the pid file, and start
-# the main loop, listening for queries on the query channel or commands
-# on the control channel and acting on them.
-############################################################################
-ip4 = "10.53.0.4"
-ip6 = "fd92:7065:b8e:ffff::4"
 
-try:
+    response_count = 1
-    port = int(os.environ["PORT"])
-except:
-    port = 5300
 
-try:
+    def generate_rrsets(self) -> Tuple[List[dns.rrset.RRset], List[dns.rrset.RRset]]:
-    ctrlport = int(os.environ["EXTRAPORT1"])
+        owner = self._name_generator.current_name
-except:
+        response = self.create_rrset(owner, dns.rdatatype.A, "10.53.0.4")
-    ctrlport = 5300
+        signature = self.create_rrset_signature(owner, response.rdtype)
+        return [response], [signature]
 
-query4_socket = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
-query4_socket.bind((ip4, port))
 
-havev6 = True
+class ChainAction(Enum):
-try:
+    """
-    query6_socket = socket.socket(socket.AF_INET6, socket.SOCK_DGRAM)
+    Chained answer types that this server can send.  `ChainSetupCommand` sets
-    try:
+    up a collection of these for generating responses.
-        query6_socket.bind((ip6, port))
+    """
-    except:
-        query6_socket.close()
-        havev6 = False
-except:
-    havev6 = False
 
-ctrl_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+    CNAME = CnameRecordGenerator
-ctrl_socket.bind((ip4, ctrlport))
+    DNAME = DnameRecordGenerator
-ctrl_socket.listen(5)
+    XNAME = XnameRecordGenerator
+    FINAL = FinalRecordGenerator
 
-signal.signal(signal.SIGTERM, sigterm)
 
-f = open("ans.pid", "w")
+@dataclass(frozen=True)
-pid = os.getpid()
+class ChainSelector:
-print(pid, file=f)
+    """
-f.close()
+    A "selector" for a specific RRset - one of all possible RRsets generated by
+    `ChainAction`s - to include in responses to queries.
+    """
 
-running = True
+    response_index: int
+    response_signature: bool
 
-print("Listening on %s port %d" % (ip4, port))
-if havev6:
-    print("Listening on %s port %d" % (ip6, port))
-print("Control channel on %s port %d" % (ip4, ctrlport))
-print("Ctrl-c to quit")
 
-if havev6:
+class ChainSetupCommand(ControlCommand):
-    input = [query4_socket, query6_socket, ctrl_socket]
+    """
-else:
+    Set up a chained response to return for subsequent queries.
-    input = [query4_socket, ctrl_socket]
 
-while running:
+    The control query consists of two label sequences separated by a `_` label.
-    try:
-        inputready, outputready, exceptready = select.select(input, [], [])
-    except select.error as e:
-        break
-    except socket.error as e:
-        break
-    except KeyboardInterrupt:
-        break
 
-    for s in inputready:
+    The first label sequence is a set of "actions"; these cause a set of
-        if s == ctrl_socket:
+    response RRsets to be generated.  Valid labels in that sequence are:
-            # Handle control channel input
+
-            conn, addr = s.accept()
+      - `cname`: CNAME from the current name to a new one in the same domain,
-            print("Control channel connected")
+      - `dname`: DNAME to a new domain, plus a synthesized CNAME,
-            while True:
+      - `xname`: "external" CNAME, to a new name in a new domain.
-                msg = conn.recv(65535)
+
-                if not msg:
+    The final response to the client query (an A RRset) is automatically
-                    break
+    appended to the ANSWER section of every response.
-                ctl_channel(msg)
+
-            conn.close()
+    Example: `xname.dname.cname` represents a CNAME to an external domain which
-        if s == query4_socket or s == query6_socket:
+    is then answered by a DNAME and a synthesized CNAME pointing to yet another
-            print("Query received on %s" % (ip4 if s == query4_socket else ip6))
+    domain, which is then answered by a CNAME within the same domain, and
-            # Handle incoming queries
+    finally an answer to the query.
-            msg = s.recvfrom(65535)
+
-            rsp = create_response(msg[0])
+    Each of the generated RRsets is associated with a corresponding RRSIG.
-            if rsp:
+    These signatures are not valid, but are intended to exercise the response
-                s.sendto(rsp, msg[1])
+    parser.
-    if not running:
+
-        break
+    The second label sequence is a set of "selectors"; these specify which
+    RRsets out of all the possible RRsets generated by "actions" to actually
+    include in the answer and in what order.  The RRsets are indexed starting
+    from 1.  If prepended with `s`, the number indicates which signature to
+    include.
+
+    Examples:
+
+      - `cname.cname.cname._.1.s1.2.s2.3.s3.4.s4` indicates that all four
+        RRsets (three CNAME RRsets + one A RRset with the final answer) should
+        be included in the answer, with their corresponding signatures, in the
+        original order,
+
+      - `cname.cname.cname._.4.s4.3.s3.2.s2.1.s1` causes the same RRsets to be
+        returned, but in reverse order,
+
+      - `cname.cname.cname._.s3.s3.s3.s3` causes the RRSIG RRset for the third
+        CNAME to be repeated four times in the response and everything else to
+        be omitted.
+    """
+
+    control_subdomain = "setup-chain"
+
+    def __init__(self) -> None:
+        self._current_handler: Optional[ChainResponseHandler] = None
+
+    def handle(
+        self, args: List[str], server: ControllableAsyncDnsServer, qctx: QueryContext
+    ) -> Optional[str]:
+        try:
+            actions, selectors = self._parse_args(args)
+        except ValueError as exc:
+            qctx.response.set_rcode(dns.rcode.SERVFAIL)
+            logging.error("%s", exc)
+            return str(exc)
+
+        if self._current_handler:
+            server.uninstall_response_handler(self._current_handler)
+
+        answer_rrsets = self._prepare_answer(actions, selectors)
+
+        self._current_handler = ChainResponseHandler(answer_rrsets)
+        server.install_response_handler(self._current_handler)
+
+        return "chain response setup successful"
+
+    def _parse_args(
+        self, args: List[str]
+    ) -> Tuple[List[ChainAction], List[ChainSelector]]:
+        try:
+            delimiter = args.index("_")
+        except ValueError as exc:
+            raise ValueError("chain setup delimiter not found in QNAME") from exc
+
+        args_actions = args[:delimiter]
+        actions = self._parse_args_actions(args_actions)
+
+        args_selectors = args[delimiter + 1 :]
+        selectors = self._parse_args_selectors(args_selectors, actions)
+
+        return actions, selectors
+
+    def _parse_args_actions(self, args_actions: List[str]) -> List[ChainAction]:
+        actions = []
+
+        for action in args_actions + ["FINAL"]:
+            try:
+                actions.append(ChainAction[action.upper()])
+            except KeyError as exc:
+                raise ValueError(f"unsupported action '{action}'") from exc
+
+        return actions
+
+    def _parse_args_selectors(
+        self, args_selectors: List[str], actions: List[ChainAction]
+    ) -> List[ChainSelector]:
+        max_response_index = self._get_max_response_index(actions)
+        selectors = []
+
+        for selector in args_selectors:
+            match = re.match(r"^(?P<signature>s?)(?P<index>[0-9]+)$", selector)
+            if not match:
+                raise ValueError(f"invalid selector '{selector}'")
+            response_index = int(match.group("index"))
+            if response_index > max_response_index:
+                raise ValueError(
+                    f"invalid response index {response_index} in '{selector}'"
+                )
+            response_signature = bool(match.group("signature"))
+            selectors.append(ChainSelector(response_index, response_signature))
+
+        return selectors
+
+    def _get_max_response_index(self, actions: List[ChainAction]) -> int:
+        rrset_generator_classes = [a.value for a in actions]
+        return sum(g.response_count for g in rrset_generator_classes)
+
+    def _prepare_answer(
+        self, actions: List[ChainAction], selectors: List[ChainSelector]
+    ) -> List[dns.rrset.RRset]:
+        all_responses, all_signatures = self._generate_rrsets(actions)
+        return self._select_rrsets(all_responses, all_signatures, selectors)
+
+    def _generate_rrsets(
+        self, actions: List[ChainAction]
+    ) -> Tuple[List[dns.rrset.RRset], List[dns.rrset.RRset]]:
+        all_responses = []
+        all_signatures = []
+        name_generator = ChainNameGenerator()
+
+        for action in actions:
+            rrset_generator_class = action.value
+            rrset_generator = rrset_generator_class(name_generator)
+            responses, signatures = rrset_generator.get_rrsets()
+            all_responses.extend(responses)
+            all_signatures.extend(signatures)
+
+        return all_responses, all_signatures
+
+    def _select_rrsets(
+        self,
+        all_responses: List[dns.rrset.RRset],
+        all_signatures: List[dns.rrset.RRset],
+        selectors: List[ChainSelector],
+    ) -> List[dns.rrset.RRset]:
+        rrsets = []
+
+        for selector in selectors:
+            index = selector.response_index - 1
+            source = all_signatures if selector.response_signature else all_responses
+            rrsets.append(source[index])
+
+        return rrsets
+
+
+class ChainResponseHandler(DomainHandler):
+    """
+    For trigger queries (`test.domain.nil`), return a chained response
+    previously prepared by `ChainSetupCommand`.
+
+    For any other query, return a non-chained response (a single A RRset).
+    """
+
+    domains = ["domain.nil."]
+
+    def __init__(self, answer_rrsets: List[dns.rrset.RRset]):
+        super().__init__()
+        self._answer_rrsets = answer_rrsets
+
+    async def get_responses(
+        self, qctx: QueryContext
+    ) -> AsyncGenerator[ResponseAction, None]:
+        trigger_qname = dns.name.from_text("test.domain.nil.")
+        if qctx.qname == trigger_qname:
+            answer_rrsets = self._answer_rrsets
+        else:
+            answer_rrsets = self._non_chain_answer(qctx)
+
+        for rrset in answer_rrsets:
+            qctx.response.answer.append(rrset)
+        for rrset in self._authority_rrsets:
+            qctx.response.authority.append(rrset)
+        for rrset in self._additional_rrsets:
+            qctx.response.additional.append(rrset)
+
+        qctx.response.set_rcode(dns.rcode.NOERROR)
+        qctx.response.use_edns()
+        yield DnsResponseSend(qctx.response, authoritative=True)
+
+    def _non_chain_answer(self, qctx: QueryContext) -> List[dns.rrset.RRset]:
+        owner = qctx.qname
+        return [
+            RecordGenerator.create_rrset(owner, dns.rdatatype.A, "10.53.0.4"),
+            RecordGenerator.create_rrset_signature(owner, dns.rdatatype.A),
+        ]
+
+    @property
+    def _authority_rrsets(self) -> List[dns.rrset.RRset]:
+        owner = dns.name.from_text("domain.nil.")
+        return [
+            RecordGenerator.create_rrset(owner, dns.rdatatype.NS, "ns1.domain.nil."),
+        ]
+
+    @property
+    def _additional_rrsets(self) -> List[dns.rrset.RRset]:
+        owner = dns.name.from_text("ns1.domain.nil.")
+        return [
+            RecordGenerator.create_rrset(owner, dns.rdatatype.A, "10.53.0.4"),
+            RecordGenerator.create_rrset(
+                owner, dns.rdatatype.AAAA, "fd92:7065:b8e:ffff::4"
+            ),
+        ]
+
+
+def main() -> None:
+    server = ControllableAsyncDnsServer(commands=[ChainSetupCommand])
+    server.run()
+
+
+if __name__ == "__main__":
+    main()

bin/tests/system/chain/tests.sh

@@ -19,7 +19,10 @@ DIGOPTS="-p ${PORT}"
 RNDCCMD="$RNDC -c ../_common/rndc.conf -p ${CONTROLPORT} -s"
 
 sendcmd() {
-  send 10.53.0.4 "${EXTRAPORT1}"
+  SERVER="${1}"
+  COMMAND="${2}"
+  COMMAND_ARGS="${3}"
+  $DIG $DIGOPTS "@${SERVER}" "${COMMAND_ARGS}.${COMMAND}._control." TXT +time=5 +tries=1 +tcp >/dev/null 2>&1
 }
 
 status=0
@@ -502,29 +505,29 @@ n=$((n + 1))
 echo_i "checking CNAME chains in various orders ($n)"
 ret=0
 $RNDCCMD 10.53.0.7 null --- start test$n - step 1 --- 2>&1 | sed 's/^/ns7 /' | cat_i
-echo "cname,cname,cname|1,2,3,4,s1,s2,s3,s4" | sendcmd
+sendcmd 10.53.0.4 setup-chain "cname.cname.cname._.1.2.3.4.s1.s2.s3.s4"
 $DIG $DIGOPTS @10.53.0.7 test.domain.nil >dig.out.1.$n 2>&1
 grep 'status: NOERROR' dig.out.1.$n >/dev/null 2>&1 || ret=1
 grep 'ANSWER: 2' dig.out.1.$n >/dev/null 2>&1 || ret=1
 $RNDCCMD 10.53.0.7 null --- start test$n - step 2 --- 2>&1 | sed 's/^/ns7 /' | cat_i
 $RNDCCMD 10.53.0.7 flush 2>&1 | sed 's/^/ns7 /' | cat_i
-echo "cname,cname,cname|1,1,2,2,3,4,s4,s3,s1" | sendcmd
+sendcmd 10.53.0.4 setup-chain "cname.cname.cname._.1.1.2.2.3.4.s4.s3.s1"
 $DIG $DIGOPTS @10.53.0.7 test.domain.nil >dig.out.2.$n 2>&1
 grep 'status: NOERROR' dig.out.2.$n >/dev/null 2>&1 || ret=1
 grep 'ANSWER: 2' dig.out.2.$n >/dev/null 2>&1 || ret=1
 $RNDCCMD 10.53.0.7 null --- start test$n - step 3 --- 2>&1 | sed 's/^/ns7 /' | cat_i
 $RNDCCMD 10.53.0.7 flush 2>&1 | sed 's/^/ns7 /' | cat_i
-echo "cname,cname,cname|2,1,3,4,s3,s1,s2,s4" | sendcmd
+sendcmd 10.53.0.4 setup-chain "cname.cname.cname._.2.1.3.4.s3.s1.s2.s4"
 $DIG $DIGOPTS @10.53.0.7 test.domain.nil >dig.out.3.$n 2>&1
 grep 'status: NOERROR' dig.out.3.$n >/dev/null 2>&1 || ret=1
 grep 'ANSWER: 2' dig.out.3.$n >/dev/null 2>&1 || ret=1
 $RNDCCMD 10.53.0.7 null --- start test$n - step 4 --- 2>&1 | sed 's/^/ns7 /' | cat_i
 $RNDCCMD 10.53.0.7 flush 2>&1 | sed 's/^/ns7 /' | cat_i
-echo "cname,cname,cname|4,3,2,1,s4,s3,s2,s1" | sendcmd
+sendcmd 10.53.0.4 setup-chain "cname.cname.cname._.4.3.2.1.s4.s3.s2.s1"
 $DIG $DIGOPTS @10.53.0.7 test.domain.nil >dig.out.4.$n 2>&1
 grep 'status: NOERROR' dig.out.4.$n >/dev/null 2>&1 || ret=1
 grep 'ANSWER: 2' dig.out.4.$n >/dev/null 2>&1 || ret=1
-echo "cname,cname,cname|4,3,2,1,s4,s3,s2,s1" | sendcmd
+sendcmd 10.53.0.4 setup-chain "cname.cname.cname._.4.3.2.1.s4.s3.s2.s1"
 $RNDCCMD 10.53.0.7 null --- start test$n - step 5 --- 2>&1 | sed 's/^/ns7 /' | cat_i
 $RNDCCMD 10.53.0.7 flush 2>&1 | sed 's/^/ns7 /' | cat_i
 $DIG $DIGOPTS @10.53.0.7 test.domain.nil >dig.out.5.$n 2>&1
@@ -532,7 +535,7 @@ grep 'status: NOERROR' dig.out.5.$n >/dev/null 2>&1 || ret=1
 grep 'ANSWER: 2' dig.out.5.$n >/dev/null 2>&1 || ret=1
 $RNDCCMD 10.53.0.7 null --- start test$n - step 6 --- 2>&1 | sed 's/^/ns7 /' | cat_i
 $RNDCCMD 10.53.0.7 flush 2>&1 | sed 's/^/ns7 /' | cat_i
-echo "cname,cname,cname|4,3,3,3,s1,s1,1,3,4" | sendcmd
+sendcmd 10.53.0.4 setup-chain "cname.cname.cname._.4.3.3.3.s1.s1.1.3.4"
 $DIG $DIGOPTS @10.53.0.7 test.domain.nil >dig.out.6.$n 2>&1
 grep 'status: NOERROR' dig.out.6.$n >/dev/null 2>&1 || ret=1
 grep 'ANSWER: 2' dig.out.6.$n >/dev/null 2>&1 || ret=1
@@ -543,7 +546,7 @@ n=$((n + 1))
 echo_i "checking that only the initial CNAME is cached ($n)"
 ret=0
 $RNDCCMD 10.53.0.7 flush 2>&1 | sed 's/^/ns7 /' | cat_i
-echo "cname,cname,cname|1,2,3,4,s1,s2,s3,s4" | sendcmd
+sendcmd 10.53.0.4 setup-chain "cname.cname.cname._.1.2.3.4.s1.s2.s3.s4"
 $RNDCCMD 10.53.0.7 null --- start test$n --- 2>&1 | sed 's/^/ns7 /' | cat_i
 $DIG $DIGOPTS @10.53.0.7 test.domain.nil >dig.out.1.$n 2>&1
 sleep 1
@@ -558,19 +561,19 @@ echo_i "checking DNAME chains in various orders ($n)"
 ret=0
 $RNDCCMD 10.53.0.7 null --- start test$n - step 1 --- 2>&1 | sed 's/^/ns7 /' | cat_i
 $RNDCCMD 10.53.0.7 flush 2>&1 | sed 's/^/ns7 /' | cat_i
-echo "dname,dname|5,4,3,2,1,s5,s4,s3,s2,s1" | sendcmd
+sendcmd 10.53.0.4 setup-chain "dname.dname._.5.4.3.2.1.s5.s4.s3.s2.s1"
 $DIG $DIGOPTS @10.53.0.7 test.domain.nil >dig.out.1.$n 2>&1
 grep 'status: NOERROR' dig.out.1.$n >/dev/null 2>&1 || ret=1
 grep 'ANSWER: 3' dig.out.1.$n >/dev/null 2>&1 || ret=1
 $RNDCCMD 10.53.0.7 null --- start test$n - step 2 --- 2>&1 | sed 's/^/ns7 /' | cat_i
 $RNDCCMD 10.53.0.7 flush 2>&1 | sed 's/^/ns7 /' | cat_i
-echo "dname,dname|5,4,3,2,1,s5,s4,s3,s2,s1" | sendcmd
+sendcmd 10.53.0.4 setup-chain "dname.dname._.5.4.3.2.1.s5.s4.s3.s2.s1"
 $DIG $DIGOPTS @10.53.0.7 test.domain.nil >dig.out.2.$n 2>&1
 grep 'status: NOERROR' dig.out.2.$n >/dev/null 2>&1 || ret=1
 grep 'ANSWER: 3' dig.out.2.$n >/dev/null 2>&1 || ret=1
 $RNDCCMD 10.53.0.7 null --- start test$n - step 3 --- 2>&1 | sed 's/^/ns7 /' | cat_i
 $RNDCCMD 10.53.0.7 flush 2>&1 | sed 's/^/ns7 /' | cat_i
-echo "dname,dname|2,3,s1,s2,s3,s4,1" | sendcmd
+sendcmd 10.53.0.4 setup-chain "dname.dname._.2.3.s1.s2.s3.s4.1"
 $DIG $DIGOPTS @10.53.0.7 test.domain.nil >dig.out.3.$n 2>&1
 grep 'status: NOERROR' dig.out.3.$n >/dev/null 2>&1 || ret=1
 grep 'ANSWER: 3' dig.out.3.$n >/dev/null 2>&1 || ret=1
@@ -582,19 +585,19 @@ n=$((n + 1))
 echo_i "checking external CNAME/DNAME chains in various orders ($n)"
 ret=0
 $RNDCCMD 10.53.0.7 null --- start test$n - step 1 --- 2>&1 | sed 's/^/ns7 /' | cat_i
-echo "xname,dname|1,2,3,4,s1,s2,s3,s4" | sendcmd
+sendcmd 10.53.0.4 setup-chain "xname.dname._.1.2.3.4.s1.s2.s3.s4"
 $DIG $DIGOPTS @10.53.0.7 test.domain.nil >dig.out.1.$n 2>&1
 grep 'status: NOERROR' dig.out.1.$n >/dev/null 2>&1 || ret=1
 grep 'ANSWER: 2' dig.out.1.$n >/dev/null 2>&1 || ret=1
 $RNDCCMD 10.53.0.7 null --- start test$n - step 2 --- 2>&1 | sed 's/^/ns7 /' | cat_i
 $RNDCCMD 10.53.0.7 flush 2>&1 | sed 's/^/ns7 /' | cat_i
-echo "xname,dname|s2,2,s1,1,4,s4,3" | sendcmd
+sendcmd 10.53.0.4 setup-chain "xname.dname._.s2.2.s1.1.4.s4.3"
 $DIG $DIGOPTS @10.53.0.7 test.domain.nil >dig.out.2.$n 2>&1
 grep 'status: NOERROR' dig.out.2.$n >/dev/null 2>&1 || ret=1
 grep 'ANSWER: 2' dig.out.2.$n >/dev/null 2>&1 || ret=1
 $RNDCCMD 10.53.0.7 null --- start test$n - step 3 --- 2>&1 | sed 's/^/ns7 /' | cat_i
 $RNDCCMD 10.53.0.7 flush 2>&1 | sed 's/^/ns7 /' | cat_i
-echo "xname,dname|s2,2,2,2" | sendcmd
+sendcmd 10.53.0.4 setup-chain "xname.dname._.s2.2.2.2"
 $DIG $DIGOPTS @10.53.0.7 test.domain.nil >dig.out.3.$n 2>&1
 grep 'status: SERVFAIL' dig.out.3.$n >/dev/null 2>&1 || ret=1
 $RNDCCMD 10.53.0.7 flush 2>&1 | sed 's/^/ns7 /' | cat_i

bin/tests/system/forward/tests.sh

@@ -21,7 +21,10 @@ dig_with_opts() (
 )
 
 sendcmd() (
-  dig_with_opts "@${1}" "${2}._control." TXT +time=5 +tries=1 +tcp >/dev/null 2>&1
+  SERVER="${1}"
+  COMMAND="${2}"
+  COMMAND_ARGS="${3}"
+  dig_with_opts "@${SERVER}" "${COMMAND_ARGS}.${COMMAND}._control." TXT +time=5 +tries=1 +tcp >/dev/null 2>&1
 )
 
 rndccmd() {
@@ -260,7 +263,7 @@ n=$((n + 1))
 echo_i "checking that a forwarder timeout prevents it from being reused in the same fetch context ($n)"
 ret=0
 # Make ans6 receive queries without responding to them.
-sendcmd 10.53.0.6 "disable.send-responses"
+sendcmd 10.53.0.6 send-responses "disable"
 # Query for a record in a zone which is forwarded to a non-responding forwarder
 # and is delegated from the root to check whether the forwarder will be retried
 # when a delegation is encountered after falling back to full recursive
@@ -271,7 +274,7 @@ dig_with_opts txt.example7. txt @$f1 >dig.out.$n.f1 || ret=1
 start_pattern="sending packet from [^ ]* to 10\.53\.0\.6"
 retry_quiet 5 wait_for_log ns3/named.run "$start_pattern"
 check_sent 1 ns3/named.run "$start_pattern" ";txt\.example7\.[[:space:]]*IN[[:space:]]*TXT$" || ret=1
-sendcmd 10.53.0.6 "enable.send-responses"
+sendcmd 10.53.0.6 send-responses "enable"
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))
 
@@ -325,7 +328,7 @@ status=$((status + ret))
 
 # See [GL #3129].
 # Enable silent mode for ans11.
-sendcmd 10.53.0.11 "disable.send-responses"
+sendcmd 10.53.0.11 send-responses "disable"
 n=$((n + 1))
 echo_i "checking the handling of hung DS fetch while chasing DS ($n)"
 ret=0
@@ -339,7 +342,7 @@ nextpart ns3/named.run >/dev/null
 dig_with_opts @$f1 xxx.yyy.sld.tld ds >dig.out.$n.f1 || ret=1
 grep "status: SERVFAIL" dig.out.$n.f1 >/dev/null || ret=1
 # Disable silent mode for ans11.
-sendcmd 10.53.0.11 "enable.send-responses"
+sendcmd 10.53.0.11 send-responses "enable"
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=$((status + ret))