mirror of
https://github.com/google/nomulus.git
synced 2025-05-15 00:47:11 +02:00
Add validation during domain creation for locked down TLDs
During domain create/applicationcreate/allocate, domains that are on the reserved list(s) with nameserver restricted reservation type must set nameservers that are part of the allowed nameservers for that domain in the reserved list(s) applied to that TLD. Additionally a boolean is added to Registry to indicate if a TLD is restricting domain create. If it is, only domains that are nameserver restricted can be registered. For consistency with a similar feature that validates a TLD-wide nameserver whitelist, the per-domain nameserver validation is performed even when the operation is in super-user mode. Similarly, if a domain is nameserver restricted, nameservers must be supplied (i. e. the nameservers set cannot be empty) when registering the domain. ------------- Created by MOE: https://github.com/google/moe MOE_MIGRATED_REVID=150641269
This commit is contained in:
jianglai
Ben McIlwain
parent
582469e052
commit
620d698479
15 changed files with 735 additions and 49 deletions
|
|
@ -71,6 +71,7 @@ import google.registry.flows.domain.DomainFlowUtils.CurrencyUnitMismatchExceptio
|
|||
import google.registry.flows.domain.DomainFlowUtils.CurrencyValueScaleException;
|
||||
import google.registry.flows.domain.DomainFlowUtils.DashesInThirdAndFourthException;
|
||||
import google.registry.flows.domain.DomainFlowUtils.DomainLabelTooLongException;
|
||||
import google.registry.flows.domain.DomainFlowUtils.DomainNotAllowedForTldWithCreateRestrictionException;
|
||||
import google.registry.flows.domain.DomainFlowUtils.DomainReservedException;
|
||||
import google.registry.flows.domain.DomainFlowUtils.DuplicateContactForRoleException;
|
||||
import google.registry.flows.domain.DomainFlowUtils.EmptyDomainNamePartException;
|
||||
|
|
@ -90,8 +91,10 @@ import google.registry.flows.domain.DomainFlowUtils.MalformedTcnIdException;
|
|||
import google.registry.flows.domain.DomainFlowUtils.MaxSigLifeNotSupportedException;
|
||||
import google.registry.flows.domain.DomainFlowUtils.MissingClaimsNoticeException;
|
||||
import google.registry.flows.domain.DomainFlowUtils.MissingContactTypeException;
|
||||
import google.registry.flows.domain.DomainFlowUtils.NameserversNotAllowedException;
|
||||
import google.registry.flows.domain.DomainFlowUtils.NameserversNotSpecifiedException;
|
||||
import google.registry.flows.domain.DomainFlowUtils.NameserversNotAllowedForDomainException;
|
||||
import google.registry.flows.domain.DomainFlowUtils.NameserversNotAllowedForTldException;
|
||||
import google.registry.flows.domain.DomainFlowUtils.NameserversNotSpecifiedForNameserverRestrictedDomainException;
|
||||
import google.registry.flows.domain.DomainFlowUtils.NameserversNotSpecifiedForTldWithNameserverWhitelistException;
|
||||
import google.registry.flows.domain.DomainFlowUtils.NotAuthorizedForTldException;
|
||||
import google.registry.flows.domain.DomainFlowUtils.PremiumNameBlockedException;
|
||||
import google.registry.flows.domain.DomainFlowUtils.RegistrantNotAllowedException;
|
||||
|
|
@ -1546,7 +1549,7 @@ public class DomainApplicationCreateFlowTest
|
|||
persistResource(Registry.get("tld").asBuilder()
|
||||
.setAllowedFullyQualifiedHostNames(ImmutableSet.of("ns2.example.net"))
|
||||
.build());
|
||||
thrown.expect(NameserversNotAllowedException.class, "ns1.example.net");
|
||||
thrown.expect(NameserversNotAllowedForTldException.class, "ns1.example.net");
|
||||
runFlow();
|
||||
}
|
||||
|
||||
|
|
@ -1572,7 +1575,173 @@ public class DomainApplicationCreateFlowTest
|
|||
.build());
|
||||
persistContactsAndHosts();
|
||||
clock.advanceOneMilli();
|
||||
thrown.expect(NameserversNotSpecifiedException.class);
|
||||
thrown.expect(NameserversNotSpecifiedForTldWithNameserverWhitelistException.class);
|
||||
runFlow();
|
||||
}
|
||||
|
||||
@Test
|
||||
public void testSuccess_domainNameserverRestricted_allNameserversAllowed() throws Exception {
|
||||
persistResource(
|
||||
Registry.get("tld")
|
||||
.asBuilder()
|
||||
.setReservedLists(
|
||||
persistReservedList(
|
||||
"reserved",
|
||||
"test-validate,NAMESERVER_RESTRICTED,"
|
||||
+ "ns1.example.net:ns2.example.net:ns3.example.net"))
|
||||
.build());
|
||||
persistContactsAndHosts();
|
||||
clock.advanceOneMilli();
|
||||
doSuccessfulTest("domain_create_sunrise_encoded_signed_mark_response.xml", true);
|
||||
assertAboutApplications()
|
||||
.that(getOnlyGlobalResource(DomainApplication.class))
|
||||
.hasApplicationStatus(ApplicationStatus.VALIDATED);
|
||||
}
|
||||
|
||||
@Test
|
||||
public void testFailure_domainNameserverRestricted_someNameserversDisallowed() throws Exception {
|
||||
persistResource(
|
||||
Registry.get("tld")
|
||||
.asBuilder()
|
||||
.setReservedLists(
|
||||
persistReservedList(
|
||||
"reserved",
|
||||
"test-validate,NAMESERVER_RESTRICTED,ns2.example.net:ns3.example.net"))
|
||||
.build());
|
||||
persistContactsAndHosts();
|
||||
clock.advanceOneMilli();
|
||||
thrown.expect(NameserversNotAllowedForDomainException.class, "ns1.example.net");
|
||||
runFlow();
|
||||
}
|
||||
|
||||
@Test
|
||||
public void testFailure_domainNameserverRestricted_noNameserversAllowed() throws Exception {
|
||||
setEppInput("domain_create_sunrise_encoded_signed_mark_no_hosts.xml");
|
||||
persistResource(
|
||||
Registry.get("tld")
|
||||
.asBuilder()
|
||||
.setReservedLists(
|
||||
persistReservedList(
|
||||
"reserved",
|
||||
"test-validate,NAMESERVER_RESTRICTED,ns2.example.net:ns3.example.net"))
|
||||
.build());
|
||||
persistContactsAndHosts();
|
||||
clock.advanceOneMilli();
|
||||
thrown.expect(NameserversNotSpecifiedForNameserverRestrictedDomainException.class);
|
||||
runFlow();
|
||||
}
|
||||
|
||||
@Test
|
||||
public void testFailure_domainCreateRestricted_domainNotReserved() throws Exception {
|
||||
persistResource(
|
||||
Registry.get("tld")
|
||||
.asBuilder()
|
||||
.setDomainCreateRestricted(true)
|
||||
.setReservedLists(
|
||||
persistReservedList(
|
||||
"reserved", "test,NAMESERVER_RESTRICTED,ns2.example.net:ns3.example.net"))
|
||||
.build());
|
||||
persistContactsAndHosts();
|
||||
clock.advanceOneMilli();
|
||||
thrown.expect(DomainNotAllowedForTldWithCreateRestrictionException.class, "test-validate.tld");
|
||||
runFlow();
|
||||
}
|
||||
|
||||
@Test
|
||||
public void testSuccess_domainCreateNotRestricted_domainNotReserved() throws Exception {
|
||||
persistResource(
|
||||
Registry.get("tld")
|
||||
.asBuilder()
|
||||
.setReservedLists(
|
||||
persistReservedList(
|
||||
"reserved", "test,NAMESERVER_RESTRICTED,ns2.example.net:ns3.example.net"))
|
||||
.build());
|
||||
persistContactsAndHosts();
|
||||
clock.advanceOneMilli();
|
||||
doSuccessfulTest("domain_create_sunrise_encoded_signed_mark_response.xml", true);
|
||||
assertAboutApplications()
|
||||
.that(getOnlyGlobalResource(DomainApplication.class))
|
||||
.hasApplicationStatus(ApplicationStatus.VALIDATED);
|
||||
}
|
||||
|
||||
@Test
|
||||
public void testSuccess_tldAndDomainNameserversWhitelistBothSatistfied() throws Exception {
|
||||
persistResource(
|
||||
Registry.get("tld")
|
||||
.asBuilder()
|
||||
.setDomainCreateRestricted(true)
|
||||
.setReservedLists(
|
||||
persistReservedList(
|
||||
"reserved",
|
||||
"test-validate,NAMESERVER_RESTRICTED,"
|
||||
+ "ns1.example.net:ns2.example.net:ns3.example.net"))
|
||||
.setAllowedFullyQualifiedHostNames(
|
||||
ImmutableSet.of("ns1.example.net", "ns2.example.net", "ns4.examplet.net"))
|
||||
.build());
|
||||
persistContactsAndHosts();
|
||||
clock.advanceOneMilli();
|
||||
doSuccessfulTest("domain_create_sunrise_encoded_signed_mark_response.xml", true);
|
||||
assertAboutApplications()
|
||||
.that(getOnlyGlobalResource(DomainApplication.class))
|
||||
.hasApplicationStatus(ApplicationStatus.VALIDATED);
|
||||
}
|
||||
|
||||
@Test
|
||||
public void testFailure_domainNameserversDisallowed_tldNameserversAllowed() throws Exception {
|
||||
persistResource(
|
||||
Registry.get("tld")
|
||||
.asBuilder()
|
||||
.setReservedLists(
|
||||
persistReservedList(
|
||||
"reserved",
|
||||
"test-validate,NAMESERVER_RESTRICTED,"
|
||||
+ "ns2.example.net:ns3.example.net:ns4.example.net"))
|
||||
.setAllowedFullyQualifiedHostNames(
|
||||
ImmutableSet.of("ns1.example.net", "ns2.example.net", "ns3.examplet.net"))
|
||||
.build());
|
||||
persistContactsAndHosts();
|
||||
clock.advanceOneMilli();
|
||||
thrown.expect(NameserversNotAllowedForDomainException.class, "ns1.example.net");
|
||||
runFlow();
|
||||
}
|
||||
|
||||
@Test
|
||||
public void testFailure_domainNameserversAllowed_tldNameserversDisallowed() throws Exception {
|
||||
persistResource(
|
||||
Registry.get("tld")
|
||||
.asBuilder()
|
||||
.setReservedLists(
|
||||
persistReservedList(
|
||||
"reserved",
|
||||
"test-validate,NAMESERVER_RESTRICTED,"
|
||||
+ "ns1.example.net:ns2.example.net:ns3.example.net"))
|
||||
.setAllowedFullyQualifiedHostNames(
|
||||
ImmutableSet.of("ns2.example.net", "ns3.example.net", "ns4.examplet.net"))
|
||||
.build());
|
||||
persistContactsAndHosts();
|
||||
clock.advanceOneMilli();
|
||||
thrown.expect(NameserversNotAllowedForTldException.class, "ns1.example.net");
|
||||
runFlow();
|
||||
}
|
||||
|
||||
@Test
|
||||
public void testFailure_tldNameserversAllowed_domainCreateRestricted_domainNotReserved()
|
||||
throws Exception {
|
||||
persistResource(
|
||||
Registry.get("tld")
|
||||
.asBuilder()
|
||||
.setDomainCreateRestricted(true)
|
||||
.setReservedLists(
|
||||
persistReservedList(
|
||||
"reserved",
|
||||
"lol,NAMESERVER_RESTRICTED,"
|
||||
+ "ns1.example.net:ns2.example.net:ns3.example.net"))
|
||||
.setAllowedFullyQualifiedHostNames(
|
||||
ImmutableSet.of("ns1.example.net", "ns2.example.net", "ns3.examplet.net"))
|
||||
.build());
|
||||
persistContactsAndHosts();
|
||||
clock.advanceOneMilli();
|
||||
thrown.expect(DomainNotAllowedForTldWithCreateRestrictionException.class, "test-validate.tld");
|
||||
runFlow();
|
||||
}
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue