CDRouter IPv6 Test Summaries (Full)

Test Case Descriptions

  • Modules: 43
  • Test Cases: 715

Below is a full description of the testcases in each module


basic-v6.tcl

Basic IPv6 extension header processing tests

Test Name Synopsis
Verify DUT forwards packets with multiple extension headers ipv6_basic_1 Verify DUT forwards packets with multiple extension headers


    step 1. Generate a valid ICMPv6 Echo Request packet with the IPv6 Hop-by-Hop
    Options and Destination Options extension headers using the PadN and Pad1
    options, respectively

            Hop-by-Hop Options Header:
              Next Header        = 0x3c (Destination Options)
              Length             = 0x00 (8 bytes)
              Option Type        = 0x01 (PadN)
              Option Data Length = 0x04 (6 bytes)
              Option Data        = 0x00000000

            Destination Options Header:
              Next Header        = 0x3a (ICMP)
              Length             = 0x00 (8 bytes)
              Option Type        = 0x00 (Pad1)
              Option Type        = 0x00 (Pad1)
              Option Type        = 0x00 (Pad1)
              Option Type        = 0x00 (Pad1)
              Option Type        = 0x00 (Pad1)
              Option Type        = 0x00 (Pad1)

    step 2. Initiate an outbound ICMPv6 Echo Request to a WAN IPv6 destination
            using the extension headers generated in Step 1
    step 3. Verify that an ICMPv6 Echo Reply packet is received within 3 seconds


    References:

    IPv6 Ready Test Specification Core Protocols

    http://ipv6ready.org/docs/Core_Conformance_Latest.pdf

    IETF RFC 2460 "Internet Protocol, Version 6 (IPv6) Specification" Section 4: IPv6 Extension Headers

    https://tools.ietf.org/html/rfc2460#section-4

    IETF RFC 2460 "Internet Protocol, Version 6 (IPv6) Specification" Section 4.2: Options

    https://tools.ietf.org/html/rfc2460#section-4.2

    IETF RFC 2460 "Internet Protocol, Version 6 (IPv6) Specification" Section 4.3: Hop-by-Hop Options Header

    https://tools.ietf.org/html/rfc2460#section-4.3

    IETF RFC 2460 "Internet Protocol, Version 6 (IPv6) Specification" Section 4.6: Destination Options Header

    https://tools.ietf.org/html/rfc2460#section-4.6
Test Name Synopsis
Verify DUT responds to packets with multiple extension headers ipv6_basic_2 Verify DUT responds to packets with multiple extension headers


    step 1. Generate a valid ICMPv6 Echo Request packet with the IPv6 Hop-by-Hop
            Options and Destination Options extension headers using the PadN and
            Pad1 options, respectively

            Hop-by-Hop Options Header:
              Next Header        = 0x3c (Destination Options)
              Length             = 0x00 (8 bytes)
              Option Type        = 0x01 (PadN)
              Option Data Length = 0x04 (6 bytes)
              Option Data        = 0x00000000

            Destination Options Header:
              Next Header        = 0x3a (ICMP)
              Length             = 0x00 (8 bytes)
              Option Type        = 0x00 (Pad1)
              Option Type        = 0x00 (Pad1)
              Option Type        = 0x00 (Pad1)
              Option Type        = 0x00 (Pad1)
              Option Type        = 0x00 (Pad1)
              Option Type        = 0x00 (Pad1)

    step 2. Initiate an ICMPv6 Echo Request to the DUT's LAN-side IPv6
            link-local address using the extension headers generated in Step 1
    step 3. Verify that an ICMPv6 Echo Reply packet is received within 3 seconds


    References:

    IPv6 Ready Test Specification Core Protocols

    http://ipv6ready.org/docs/Core_Conformance_Latest.pdf

    IETF RFC 2460 "Internet Protocol, Version 6 (IPv6) Specification" Section 4: IPv6 Extension Headers

    https://tools.ietf.org/html/rfc2460#section-4

    IETF RFC 2460 "Internet Protocol, Version 6 (IPv6) Specification" Section 4.2: Options

    https://tools.ietf.org/html/rfc2460#section-4.2

    IETF RFC 2460 "Internet Protocol, Version 6 (IPv6) Specification" Section 4.3: Hop-by-Hop Options Header

    https://tools.ietf.org/html/rfc2460#section-4.3

    IETF RFC 2460 "Internet Protocol, Version 6 (IPv6) Specification" Section 4.6: Destination Options Header

    https://tools.ietf.org/html/rfc2460#section-4.6
Test Name Synopsis
Verify DUT discards packets with unknown extension headers ipv6_basic_3 Verify DUT discards packets with unknown extension headers


    step 1. Generate an ICMPv6 Echo Request packet containing a IPv6 Hop-by-Hop
            Options extension header with a Next Header value of 200 (IP
            protocol type 200 is currently unassigned)

            Hop-by-Hop Options Header:
              Next Header        = 0xc8 (IP protocol type 200, unknown)
              Length             = 0x00 (8 bytes)
              Option Type        = 0x01 (PadN)
              Option Data Length = 0x04 (6 bytes)
              Option Data        = 0x00000000

            Unrecognized Next Header:
              Next Header        = 0x3a (ICMP)
              Length             = 0x00 (8 bytes)
              Option Type        = 0x00 (Pad1)
              Option Type        = 0x00 (Pad1)
              Option Type        = 0x00 (Pad1)
              Option Type        = 0x00 (Pad1)
              Option Type        = 0x00 (Pad1)
              Option Type        = 0x00 (Pad1)

    step 2. Initiate an ICMPv6 Echo Request (ping) to the DUT's LAN-side IPv6
            link-local address using the extension headers generated in Step 1
    step 3. Verify that the packet transmitted in Step 2 is discarded by
            ensuring that no ICMPv6 Echo Reply packets are received within 3
            seconds
    step 4. Optional - if an ICMPv6 Parameter Problem packet is received, verify
            that the ICMPv6 Parameter Problem message contains a value of 1 in
            the Code field
    step 5. Optional - if an ICMPv6 Parameter Problem packet is received, verify
            that the ICMPv6 Parameter Problem message contains a value of 40 in
            the Pointer field


    References:

    IPv6 Ready Test Specification Core Protocols

    http://ipv6ready.org/docs/Core_Conformance_Latest.pdf

    IETF RFC 2460 "Internet Protocol, Version 6 (IPv6) Specification" Section 4: IPv6 Extension Headers

    If, as a result of processing a header, a node is required to proceed
    to the next header but the Next Header value in the current header is
    unrecognized by the node, it should discard the packet and send an
    ICMP Parameter Problem message to the source of the packet, with an
    ICMP Code value of 1 ("unrecognized Next Header type encountered")
    and the ICMP Pointer field containing the offset of the unrecognized
    value within the original packet.  The same action should be taken if
    a node encounters a Next Header value of zero in any header other
    than an IPv6 header.

    https://tools.ietf.org/html/rfc2460#section-4

    IETF RFC 4443 "Internet Control Message Protocol (ICMPv6) for the Internet Protocol Version 6 (IPv6) Specification" Section 3.4: Parameter Problem Message

    If an IPv6 node processing a packet finds a problem with a field in
    the IPv6 header or extension headers such that it cannot complete
    processing the packet, it MUST discard the packet and SHOULD send an
    ICMPv6 Parameter Problem message to the packet's source, indicating
    the type and location of the problem.

    Codes 1 and 2 are more informative subsets of Code 0.

    The pointer identifies the octet of the original packet's header
    where the error was detected. For example, an ICMPv6 message with
    Type field = 4, Code field = 1, and Pointer field = 40 would indicate
    that the IPv6 extension header following the IPv6 header of the
    original packet holds an unrecognized Next Header field value.

    https://tools.ietf.org/html/rfc4443#section-3.4
Test Name Synopsis
Verify DUT discards packets with Next Header value of zero in extension header ipv6_basic_4 Verify DUT discards packets with Next Header value of zero in extension header


    step 1. Generate an ICMPv6 Echo Request packet containing the IPv6
            Hop-by-Hop Options extension header with a Next Header value of 0

            Hop-by-Hop Options Header:
              Next Header        = 0x00 (HOPOPT)
              Length             = 0x00 (8 bytes)
              Option Type        = 0x01 (PadN)
              Option Data Length = 0x04 (6 bytes)
              Option Data        = 0x00000000

            Next Extension Header:
              Next Header        = 0x3a (ICMP)
              Length             = 0x00 (8 bytes)
              Option Type        = 0x00 (Pad1)
              Option Type        = 0x00 (Pad1)
              Option Type        = 0x00 (Pad1)
              Option Type        = 0x00 (Pad1)
              Option Type        = 0x00 (Pad1)
              Option Type        = 0x00 (Pad1)

    step 2. Initiate an ICMPv6 Echo Request (ping) to the DUT's LAN-side IPv6
            link-local address using the extension headers generated in Step 1
    step 3. Verify that the packet transmitted in Step 2 is discarded by
            ensuring that no ICMPv6 Echo Reply packets are received within 3
            seconds
    step 4. Optional - if an ICMPv6 Parameter Problem packet is received, verify
            that the ICMPv6 Parameter Problem message contains a value of 1 in
            the Code field
    step 5. Optional - if an ICMPv6 Parameter Problem packet is received, verify
            that the ICMPv6 Parameter Problem message contains a value of 40 in
            the Pointer field


    References:

    IPv6 Ready Test Specification Core Protocols

    http://ipv6ready.org/docs/Core_Conformance_Latest.pdf

    IETF RFC 2460 "Internet Protocol, Version 6 (IPv6) Specification" Section 4: IPv6 Extension Headers

    If, as a result of processing a header, a node is required to proceed
    to the next header but the Next Header value in the current header is
    unrecognized by the node, it should discard the packet and send an
    ICMP Parameter Problem message to the source of the packet, with an
    ICMP Code value of 1 ("unrecognized Next Header type encountered")
    and the ICMP Pointer field containing the offset of the unrecognized
    value within the original packet.  The same action should be taken if
    a node encounters a Next Header value of zero in any header other
    than an IPv6 header.

    https://tools.ietf.org/html/rfc2460#section-4

    IETF RFC 4443 "Internet Control Message Protocol (ICMPv6) for the Internet Protocol Version 6 (IPv6) Specification" Section 3.4: Parameter Problem Message

    If an IPv6 node processing a packet finds a problem with a field in
    the IPv6 header or extension headers such that it cannot complete
    processing the packet, it MUST discard the packet and SHOULD send an
    ICMPv6 Parameter Problem message to the packet's source, indicating
    the type and location of the problem.

    Codes 1 and 2 are more informative subsets of Code 0.

    The pointer identifies the octet of the original packet's header
    where the error was detected. For example, an ICMPv6 message with
    Type field = 4, Code field = 1, and Pointer field = 40 would indicate
    that the IPv6 extension header following the IPv6 header of the
    original packet holds an unrecognized Next Header field value.

    https://tools.ietf.org/html/rfc4443#section-3.4
Test Name Synopsis
Verify DUT ignores packets with extension header containing 'No Next Header' ipv6_basic_5 Verify DUT ignores packets with extension header containing ‘No Next Header’


    step 1. Generate a valid ICMPv6 Echo Request packet with the IPv6 Hop-by-Hop
            Options and Destination Options extension headers. The Hop-by-Hop
            Options extension header will have a Next Header value of 59 (no
            Next Header).

            Hop-by-Hop Options Header:
              Next Header        = 0x3b (no Next Header)
              Length             = 0x00 (8 bytes)
              Option Type        = 0x01 (PadN)
              Option Data Length = 0x04 (6 bytes)
              Option Data        = 0x00000000

            Destination Options Header:
              Next Header        = 0x3a (ICMP)
              Length             = 0x00 (8 bytes)
              Option Type        = 0x01 (PadN)
              Option Data Length = 0x04 (6 bytes)
              Option Data        = 0x00000000

    step 2. Initiate an ICMPv6 Echo Request (ping) to the DUT's LAN-side IPv6
            link-local address using the extension header generated in Step 1
    step 3. Verify that the DUT ignores the ICMPv6 Echo Request packet by
            ensuring that no ICMPv6 Echo Reply packets are received within 3
            seconds


    References:

    IPv6 Ready Test Specification Core Protocols

    http://ipv6ready.org/docs/Core_Conformance_Latest.pdf

    IETF RFC 2460 "Internet Protocol, Version 6 (IPv6) Specification" Section 4.7: No Next Header

    The value 59 in the Next Header field of an IPv6 header or any
    extension header indicates that there is nothing following that
    header.  If the Payload Length field of the IPv6 header indicates the
    presence of octets past the end of a header whose Next Header field
    contains 59, those octets must be ignored, and passed on unchanged if
    the packet is forwarded.

    https://tools.ietf.org/html/rfc2460#section-4.7
Test Name Synopsis
Verify DUT forwards packets with extension headers containing 'No Next Header' ipv6_basic_6 Verify DUT forwards packets with extension headers containing ‘No Next Header’


    step 1. Generate a valid ICMPv6 Echo Request packet with the IPv6 Hop-by-Hop
            Options and Destination Options extension headers. The Hop-by-Hop
            Options extension header will have a Next Header value of 59 (no
            Next Header).

            Hop-by-Hop Options Header:
              Next Header        = 0x3b (no Next Header)
              Length             = 0x00 (8 bytes)
              Option Type        = 0x01 (PadN)
              Option Data Length = 0x04 (6 bytes)
              Option Data        = 0x00000000

            Destination Options Header:
              Next Header        = 0x3a (ICMP)
              Length             = 0x00 (8 bytes)
              Option Type        = 0x01 (PadN)
              Option Data Length = 0x04 (6 bytes)
              Option Data        = 0x00000000

    step 2. Initiate an ICMPv6 Echo Request (ping) to a WAN IPv6 destination
            address using the extension header generated in Step 1
    step 3. Verify that the WAN host receives the packet transmitted in Step 2
    step 4. Verify that the ICMPv6 Echo Request packet received by the WAN host
            is identical to the packet that was transmitted. Note that the
            ICMPv6 Echo Request packet may be displayed as as an IPv6 protocol
            type 0 packet (Hop-by-Hop Options) due to the inclusion of the no
            Next Header field in the Hop-by-Hop Options extension header. The
            data portion of the received IPv6 packet on the WAN should be
            analayzed for the original ICMPv6 Echo Request.


    References:

    IPv6 Ready Test Specification Core Protocols

    http://ipv6ready.org/docs/Core_Conformance_Latest.pdf

    IETF RFC 2460 "Internet Protocol, Version 6 (IPv6) Specification" Section 4.7: No Next Header

    The value 59 in the Next Header field of an IPv6 header or any
    extension header indicates that there is nothing following that
    header.  If the Payload Length field of the IPv6 header indicates the
    presence of octets past the end of a header whose Next Header field
    contains 59, those octets must be ignored, and passed on unchanged if
    the packet is forwarded.

    https://tools.ietf.org/html/rfc2460#section-4.7
Test Name Synopsis
Verify DUT properly processes unknown Option Type identifiers with 00 high order bits ipv6_basic_10 Verify DUT properly processes unknown Option Type identifiers with 00 high order bits


    step 1. Generate a Hop-by-Hop Options extension header with an unknown
            Option Type of 17 (0x11). Option Type 17 contains high order bits of
            00.

            Hop-by-Hop Options Header:
              Next Header        = 0x3a (ICMP)
              Length             = 0x00 (8 bytes)
              Option Type        = 0x11 (type 17 unknown, 00 high order bits)
              Option Data Length = 0x04 (4 bytes)
              Option Data        = 0x00000000

    step 2. Initiate an outbound ICMPv6 Echo Request (ping) from a LAN client to
            a WAN IPv6 destination using the extension header generated in
            Step 1
    step 3. Verify that the DUT ignores the unknown Option Type by ensuring that
            an ICMPv6 Echo Reply (ping response) packet is received


    References:

    IPv6 Ready Test Specification Core Protocols

    http://ipv6ready.org/docs/Core_Conformance_Latest.pdf

    IPv6 Ready Test Specification Core Protocols

    http://ipv6ready.org/docs/Core_Conformance_Latest.pdf

    IETF RFC 2460 "Internet Protocol, Version 6 (IPv6) Specification" Section 4.2: Options

    The Option Type identifiers are internally encoded such that their
    highest-order two bits specify the action that must be taken if the
    processing IPv6 node does not recognize the Option Type:

      00 - skip over this option and continue processing the header.

      01 - discard the packet.

      10 - discard the packet and, regardless of whether or not the
           packet's Destination Address was a multicast address, send an
           ICMP Parameter Problem, Code 2, message to the packet's
           Source Address, pointing to the unrecognized Option Type.

      11 - discard the packet and, only if the packet's Destination
           Address was not a multicast address, send an ICMP Parameter
           Problem, Code 2, message to the packet's Source Address,
           pointing to the unrecognized Option Type.

    https://tools.ietf.org/html/rfc2460#section-4.2
Test Name Synopsis
Verify DUT properly processes unknown Option Type identifiers with 01 high order bits ipv6_basic_11 Verify DUT properly processes unknown Option Type identifiers with 01 high order bits


    step 1. Generate a Hop-by-Hop Options extension header with an unknown
            Option Type of 71 (0x47). Option Type 71 contains high order bits of
            01.

            Hop-by-Hop Options Header:
              Next Header        = 0x3a (ICMP)
              Length             = 0x00 (8 bytes)
              Option Type        = 0x47 (type 71 unknown, 01 high order bits)
              Option Data Length = 0x04 (4 bytes)
              Option Data        = 0x00000000

    step 2. Initiate an outbound ICMPv6 Echo Request (ping) from a LAN client to
            a WAN IPv6 destination using the extension header generated in
            Step 1
    step 3. Verify that the DUT silently discards the packet transmitted in Step
            2 be ensuring that it does not forward an ICMPv6 Echo Request packet
            to the WAN IPv6 destination within 3 seconds
    step 4. Repeat Step 2
    step 5. Verify that the DUT silently discards the packet transmitted in Step
            4 by ensuring that it does not send an ICMPv6 Parameter Problem
            packet to the LAN source within 3 seconds


    References:

    IPv6 Ready Test Specification Core Protocols

    http://ipv6ready.org/docs/Core_Conformance_Latest.pdf

    IPv6 Ready Test Specification Core Protocols

    http://ipv6ready.org/docs/Core_Conformance_Latest.pdf

    IETF RFC 2460 "Internet Protocol, Version 6 (IPv6) Specification" Section 4.2: Options

    The Option Type identifiers are internally encoded such that their
    highest-order two bits specify the action that must be taken if the
    processing IPv6 node does not recognize the Option Type:

      00 - skip over this option and continue processing the header.

      01 - discard the packet.

      10 - discard the packet and, regardless of whether or not the
           packet's Destination Address was a multicast address, send an
           ICMP Parameter Problem, Code 2, message to the packet's
           Source Address, pointing to the unrecognized Option Type.

      11 - discard the packet and, only if the packet's Destination
           Address was not a multicast address, send an ICMP Parameter
           Problem, Code 2, message to the packet's Source Address,
           pointing to the unrecognized Option Type.

    https://tools.ietf.org/html/rfc2460#section-4.2
Test Name Synopsis
Verify DUT properly processes unknown Option Type identifiers with 10 high order bits - unicast destination ipv6_basic_12 Verify DUT properly processes unknown Option Type identifiers with 10 high order bits - unicast destination


    step 1. Generate a Hop-by-Hop Options extension header with an unknown
            Option Type of 135 (0x87). Option Type 135 contains high order bits
            of 10.

            Hop-by-Hop Options Header:
              Next Header        = 0x3a (ICMP)
              Length             = 0x00 (8 bytes)
              Option Type        = 0x87 (type 135 unknown, 10 high order bits)
              Option Data Length = 0x04 (4 bytes)
              Option Data        = 0x00000000

    step 2. Initiate an outbound ICMPv6 Echo Request (ping) from a LAN client to
            a WAN IPv6 destination using the extension header generated in
            Step 1
    step 3. Verify that the DUT discards the packet transmitted in Step 2 by
            ensuring that it does not forward an ICMPv6 Echo Request packet to
            the WAN IPv6 destination within 3 seconds
    step 4. Repeat Step 2
    step 5. Verify that the DUT sends an ICMPv6 Parameter Problem packet to the
            source in response to the packet transmitted in Step 4 within 3
            seconds
    step 6. Verify that the ICMPv6 Parameter Problem message contains a value of
            2 in the Code field
    step 7. Verify that the ICMPv6 Parameter Problem message contains a value of
            42 in the Pointer field


    References:

    IPv6 Ready Test Specification Core Protocols

    http://ipv6ready.org/docs/Core_Conformance_Latest.pdf

    IPv6 Ready Test Specification Core Protocols

    http://ipv6ready.org/docs/Core_Conformance_Latest.pdf

    IETF RFC 2460 "Internet Protocol, Version 6 (IPv6) Specification" Section 4.2: Options

    The Option Type identifiers are internally encoded such that their
    highest-order two bits specify the action that must be taken if the
    processing IPv6 node does not recognize the Option Type:

      00 - skip over this option and continue processing the header.

      01 - discard the packet.

      10 - discard the packet and, regardless of whether or not the
           packet's Destination Address was a multicast address, send an
           ICMP Parameter Problem, Code 2, message to the packet's
           Source Address, pointing to the unrecognized Option Type.

      11 - discard the packet and, only if the packet's Destination
           Address was not a multicast address, send an ICMP Parameter
           Problem, Code 2, message to the packet's Source Address,
           pointing to the unrecognized Option Type.

    https://tools.ietf.org/html/rfc2460#section-4.2
Test Name Synopsis
Verify DUT properly processes unknown Option Type identifiers with 10 high order bits - multicast destination ipv6_basic_13 Verify DUT properly processes unknown Option Type identifiers with 10 high order bits - multicast destination


    step 1. Generate a Hop-by-Hop Options extension header with an unknown
            Option Type of 135 (0x87). Option Type 135 contains high order bits
            of 10.

            Hop-by-Hop Options Header:
              Next Header        = 0x3a (ICMP)
              Length             = 0x00 (8 bytes)
              Option Type        = 0x87 (type 135 unknown, 10 high order bits)
              Option Data Length = 0x04 (4 bytes)
              Option Data        = 0x00000000

    step 2. Initiate an outbound ICMPv6 Echo Request (ping) from a LAN client to
            the all routers multicast destination using the extension header
            generated in Step 1
    step 3. Verify that the DUT discards the packet transmitted in Step 2 be
            ensuring that it does not forward an ICMPv6 Echo Request packet to
            the LAN host within 3 seconds
    step 4. Repeat Step 2
    step 5. Verify that the DUT sends an ICMPv6 Parameter Problem packet to the
            source in response to the packet transmitted in Step 4 within 3
            seconds
    step 6. Verify that the ICMPv6 Parameter Problem message contains a value of
            2 in the Code field
    step 7. Verify that the ICMPv6 Parameter Problem message contains a value of
            42 in the Pointer field


    References:

    IPv6 Ready Test Specification Core Protocols

    http://ipv6ready.org/docs/Core_Conformance_Latest.pdf

    IPv6 Ready Test Specification Core Protocols

    http://ipv6ready.org/docs/Core_Conformance_Latest.pdf

    IETF RFC 2460 "Internet Protocol, Version 6 (IPv6) Specification" Section 4.2: Options

    The Option Type identifiers are internally encoded such that their
    highest-order two bits specify the action that must be taken if the
    processing IPv6 node does not recognize the Option Type:

      00 - skip over this option and continue processing the header.

      01 - discard the packet.

      10 - discard the packet and, regardless of whether or not the
           packet's Destination Address was a multicast address, send an
           ICMP Parameter Problem, Code 2, message to the packet's
           Source Address, pointing to the unrecognized Option Type.

      11 - discard the packet and, only if the packet's Destination
           Address was not a multicast address, send an ICMP Parameter
           Problem, Code 2, message to the packet's Source Address,
           pointing to the unrecognized Option Type.

    https://tools.ietf.org/html/rfc2460#section-4.2
Test Name Synopsis
Verify DUT properly processes unknown Option Type identifiers with 11 high order bits - unicast destination ipv6_basic_14 Verify DUT properly processes unknown Option Type identifiers with 11 high order bits - unicast destination


    step 1. Generate a Hop-by-Hop Options extension header with an unknown
            Option Type of 199 (0xc7). Option Type 199 contains high order bits
            of 11.

            Hop-by-Hop Options Header:
              Next Header        = 0x3a (ICMP)
              Length             = 0x00 (8 bytes)
              Option Type        = 0xc7 (type 199 unknown, 11 high order bits)
              Option Data Length = 0x04 (4 bytes)
              Option Data        = 0x00000000

    step 2. Initiate an outbound ICMPv6 Echo Request (ping) from a LAN client to
            a WAN IPv6 destination using the extension header generated in
            Step 1
    step 3. Verify that the DUT discards the packet transmitted in Step 2 be
            ensuring that it does not forward an ICMPv6 Echo Request packet to
            the WAN IPv6 destination within 3 seconds
    step 4. Repeat Step 2
    step 5. Verify that the DUT sends an ICMPv6 Parameter Problem packet to the
            source in response to the packet transmitted in Step 4 within 3
            seconds
    step 6. Verify that the ICMPv6 Parameter Problem message contains a value of
            2 in the Code field
    step 7. Verify that the ICMPv6 Parameter Problem message contains a value of
            42 in the Pointer field


    References:

    IPv6 Ready Test Specification Core Protocols

    http://ipv6ready.org/docs/Core_Conformance_Latest.pdf

    IPv6 Ready Test Specification Core Protocols

    http://ipv6ready.org/docs/Core_Conformance_Latest.pdf

    IETF RFC 2460 "Internet Protocol, Version 6 (IPv6) Specification" Section 4.2: Options

    The Option Type identifiers are internally encoded such that their
    highest-order two bits specify the action that must be taken if the
    processing IPv6 node does not recognize the Option Type:

      00 - skip over this option and continue processing the header.

      01 - discard the packet.

      10 - discard the packet and, regardless of whether or not the
           packet's Destination Address was a multicast address, send an
           ICMP Parameter Problem, Code 2, message to the packet's
           Source Address, pointing to the unrecognized Option Type.

      11 - discard the packet and, only if the packet's Destination
           Address was not a multicast address, send an ICMP Parameter
           Problem, Code 2, message to the packet's Source Address,
           pointing to the unrecognized Option Type.

    https://tools.ietf.org/html/rfc2460#section-4.2
Test Name Synopsis
Verify DUT properly processes unknown Option Type identifiers with 11 high order bits - multicast destination ipv6_basic_15 Verify DUT properly processes unknown Option Type identifiers with 11 high order bits - multicast destination


    step 1. Generate a Hop-by-Hop Options extension header with an unknown
            Option Type of 199 (0xc7). Option Type 199 contains high order bits
            of 11.

            Hop-by-Hop Options Header:
              Next Header        = 0x3a (ICMP)
              Length             = 0x00 (8 bytes)
              Option Type        = 0xc7 (type 199 unknown, 11 high order bits)
              Option Data Length = 0x04 (4 bytes)
              Option Data        = 0x00000000

    step 2. Initiate an outbound ICMPv6 Echo Request (ping) from a LAN client to
            the all routers multicast destination using the extension header
            generated in Step 1
    step 3. Verify that the DUT discards the packet transmitted in Step 2 and
            does not send an ICMPv6 Parameter Problem packet to the source


    References:

    IPv6 Ready Test Specification Core Protocols

    http://ipv6ready.org/docs/Core_Conformance_Latest.pdf

    IPv6 Ready Test Specification Core Protocols

    http://ipv6ready.org/docs/Core_Conformance_Latest.pdf

    IETF RFC 2460 "Internet Protocol, Version 6 (IPv6) Specification" Section 4.2: Options

    The Option Type identifiers are internally encoded such that their
    highest-order two bits specify the action that must be taken if the
    processing IPv6 node does not recognize the Option Type:

      00 - skip over this option and continue processing the header.

      01 - discard the packet.

      10 - discard the packet and, regardless of whether or not the
           packet's Destination Address was a multicast address, send an
           ICMP Parameter Problem, Code 2, message to the packet's
           Source Address, pointing to the unrecognized Option Type.

      11 - discard the packet and, only if the packet's Destination
           Address was not a multicast address, send an ICMP Parameter
           Problem, Code 2, message to the packet's Source Address,
           pointing to the unrecognized Option Type.

    https://tools.ietf.org/html/rfc2460#section-4.2
Test Name Synopsis
Verify DUT discards packets with Type 0 Routing Extension Header as an Intermediary Node ipv6_basic_20 Verify DUT discards packets with Type 0 Routing Extension Header as an Intermediary Node


    step 1. Generate an ICMP Echo Request packet containing an IPv6 Routing
            extension header. The destination address is the gateway's global
            address, which forces header processing. The segment is set to the
            RemoteHost's IPv6 address.

            Routing Extension Header:
              Next Header        = 0x3a (ICMPv6)
              Length             = 0x06 (56 bytes)
              Routing Type       = 0x00 (Source Routing)
              Segments Left:     = 0x01

    step 2. The RemoteHost is inspected to verify the gateway did not resend the
            packet
    step 3. The packet is resent
    step 4. ICMPv6 Parameter Problem packet is verified as delivered to the LAN
            client


    References:

    IPv6 Ready Test Specification Core Protocols

    http://ipv6ready.org/docs/Core_Conformance_Latest.pdf

    IPv6 Ready Test Specification Core Protocols

    http://ipv6ready.org/docs/Core_Conformance_Latest.pdf

    IETF RFC 5095 "Deprecation of Type 0 Routing Headers in IPv6" Section 3: Deprecation of RH0

    An IPv6 node that receives a packet with a destination address
    assigned to it and that contains an RH0 extension header MUST NOT
    execute the algorithm specified in the latter part of Section 4.4 of
    [RFC2460] for RH0.  Instead, such packets MUST be processed according
    to the behaviour specified in Section 4.4 of [RFC2460] for a datagram
    that includes an unrecognised Routing Type value, namely:

       If Segments Left is zero, the node must ignore the Routing header
       and proceed to process the next header in the packet, whose type
       is identified by the Next Header field in the Routing header.

       If Segments Left is non-zero, the node must discard the packet and
       send an ICMP Parameter Problem, Code 0, message to the packet's
       Source Address, pointing to the unrecognized Routing Type.

    https://tools.ietf.org/html/rfc5095#section-3
Test Name Synopsis
Verify DUT processes packets with Type 0 Routing Extension Header as an End Node ipv6_basic_21 Verify DUT processes packets with Type 0 Routing Extension Header as an End Node


    step 1. Generate an ICMP Echo Request packet containing an IPv6 Routing
            extension header. The destination address is the gateway's global
            address, which forces header processing. The segment is set to the
            RemoteHost's IPv6 address.

            Routing Extension Header:
              Next Header        = 0x3a (ICMPv6)
              Length             = 0x06 (56 bytes)
              Routing Type       = 0x00 (Source Routing)
              Segments Left:     = 0x00

    step 2. The RemoteHost is inspected to verify the gateway did not resend the
            packet
    step 3. The packet is resent
    step 4. The LAN client is inspected to verify the ICMPv6 Echo Reply was
            received from the gateway


    References:

    IPv6 Ready Test Specification Core Protocols

    http://ipv6ready.org/docs/Core_Conformance_Latest.pdf

    IPv6 Ready Test Specification Core Protocols

    http://ipv6ready.org/docs/Core_Conformance_Latest.pdf

    IETF RFC 5095 "Deprecation of Type 0 Routing Headers in IPv6" Section 3: Deprecation of RH0

    An IPv6 node that receives a packet with a destination address
    assigned to it and that contains an RH0 extension header MUST NOT
    execute the algorithm specified in the latter part of Section 4.4 of
    [RFC2460] for RH0.  Instead, such packets MUST be processed according
    to the behaviour specified in Section 4.4 of [RFC2460] for a datagram
    that includes an unrecognised Routing Type value, namely:

       If Segments Left is zero, the node must ignore the Routing header
       and proceed to process the next header in the packet, whose type
       is identified by the Next Header field in the Routing header.

       If Segments Left is non-zero, the node must discard the packet and
       send an ICMP Parameter Problem, Code 0, message to the packet's
       Source Address, pointing to the unrecognized Routing Type.

    https://tools.ietf.org/html/rfc5095#section-3
Test Name Synopsis
Verify DUT discards packets with Unknown Routing Extension Header as an Intermediary Node ipv6_basic_22 Verify DUT discards packets with Unknown Routing Extension Header as an Intermediary Node


    step 1. Generate an ICMP Echo Request packet containing an IPv6 Routing
            extension header. The destination address is the gateway's global
            address, which forces header processing. The segment is set to the
            RemoteHost's IPv6 address.

            Routing Extension Header:
              Next Header        = 0x3a (ICMPv6)
              Length             = 0x06 (56 bytes)
              Routing Type       = 0x33 (Unknown Type)
              Segments Left:     = 0x01

    step 2. The RemoteHost is inspected to verify the gateway did not resend the
            packet
    step 3. The packet is resent
    step 4. ICMPv6 Parameter Problem packet is verified as delivered to the LAN
            client


    References:

    IPv6 Ready Test Specification Core Protocols

    http://ipv6ready.org/docs/Core_Conformance_Latest.pdf

    IPv6 Ready Test Specification Core Protocols

    http://ipv6ready.org/docs/Core_Conformance_Latest.pdf

    IETF RFC 2460 "Internet Protocol, Version 6 (IPv6) Specification" Section 4.4: Routing Header

    If, while processing a received packet, a node encounters a Routing
    header with an unrecognized Routing Type value, the required behavior
    of the node depends on the value of the Segments Left field, as
    follows:

      If Segments Left is zero, the node must ignore the Routing header
      and proceed to process the next header in the packet, whose type
      is identified by the Next Header field in the Routing header.

      If Segments Left is non-zero, the node must discard the packet and
      send an ICMP Parameter Problem, Code 0, message to the packet's
      Source Address, pointing to the unrecognized Routing Type.

    https://tools.ietf.org/html/rfc2460#section-4.4
Test Name Synopsis
Verify DUT processes packets with Unknown Routing Extension Header as an End Node ipv6_basic_23 Verify DUT processes packets with Unknown Routing Extension Header as an End Node


    step 1. Generate an ICMP Echo Request packet containing an IPv6 Routing
            extension header. The destination address is the gateway's global
            address, which forces header processing. The segment is set to the
            RemoteHost's IPv6 address.

            Routing Extension Header:
              Next Header        = 0x3a (ICMPv6)
              Length             = 0x06 (56 bytes)
              Routing Type       = 0x33 (Unknown Type)
              Segments Left:     = 0x00

    step 2. The RemoteHost is inspected to verify the gateway did not resend the
            packet
    step 3. The packet is resent
    step 4. The LAN client is inspected to verify the ICMPv6 Echo Reply was
            received from the gateway


    References:

    IPv6 Ready Test Specification Core Protocols

    http://ipv6ready.org/docs/Core_Conformance_Latest.pdf

    IPv6 Ready Test Specification Core Protocols

    http://ipv6ready.org/docs/Core_Conformance_Latest.pdf

    IETF RFC 2460 "Internet Protocol, Version 6 (IPv6) Specification" Section 4.4: Routing Header

    If, while processing a received packet, a node encounters a Routing
    header with an unrecognized Routing Type value, the required behavior
    of the node depends on the value of the Segments Left field, as
    follows:

      If Segments Left is zero, the node must ignore the Routing header
      and proceed to process the next header in the packet, whose type
      is identified by the Next Header field in the Routing header.

      If Segments Left is non-zero, the node must discard the packet and
      send an ICMP Parameter Problem, Code 0, message to the packet's
      Source Address, pointing to the unrecognized Routing Type.

    https://tools.ietf.org/html/rfc2460#section-4.4

frag-v6.tcl

IPv6 fragmentation tests

Test Name Synopsis
Verify DUT responds to fragmented ICMPv6 Echo Requests ipv6_frag_1 Verify DUT responds to fragmented ICMPv6 Echo Requests


    step 1. Generate a valid 3000 byte ICMPv6 Echo Request packet
    step 2. Set IPv6 MTU of the LAN to 1280 bytes
    step 3. Initiate an outbound ICMPv6 Echo Request (ping) to the DUT's
            LAN-side IPv6 link-local address using the packet generated in
            Step 1
    step 4. Verify that an ICMPv6 Echo Reply packet is received within 3 seconds


    References:

    IETF RFC 2460 "Internet Protocol, Version 6 (IPv6) Specification" Section 4.5: Fragment Header

    https://tools.ietf.org/html/rfc2460#section-4.5
Test Name Synopsis
Verify DUT forwards fragmented ICMPv6 packets ipv6_frag_2 Verify DUT forwards fragmented ICMPv6 packets


    step 1. Generate a valid 3000 byte ICMPv6 Echo Request packet
    step 2. Set IPv6 MTU of the LAN client to 1280 bytes
    step 3. Set IPv6 MTU of the remoteHost WAN server to 1280 bytes
    step 4. Initiate an outbound ICMPv6 Echo Request to a WAN IPv6 destination
            using the packet generated in Step 1
    step 5. Verify that an ICMPv6 Echo Reply packet is received within 3 seconds


    References:

    IETF RFC 2460 "Internet Protocol, Version 6 (IPv6) Specification" Section 4.5: Fragment Header

    https://tools.ietf.org/html/rfc2460#section-4.5
Test Name Synopsis
Verify DUT forwards fragmented UDP packets ipv6_frag_3 Verify DUT forwards fragmented UDP packets


    step 1. Generate a valid 3000 byte UDP Echo packet
    step 2. Set IPv6 MTU of the LAN client to 1280 bytes
    step 3. Set IPv6 MTU of the remoteHost WAN server to 1280 bytes
    step 4. Initiate an outbound UDP Echo to a WAN IPv6 destination using the
            packet generated in Step 1
    step 5. Verify that a UDP Echo response is received on the LAN


    References:

    IETF RFC 2460 "Internet Protocol, Version 6 (IPv6) Specification" Section 4.5: Fragment Header

    https://tools.ietf.org/html/rfc2460#section-4.5

ndp.tcl

Neighbor Discovery Protocol and Router Advertisement tests for IPv6 devices

Test Name Synopsis
Verify DUT responds to Router Solicitations on the LAN ipv6_ndp_1 Verify DUT responds to Router Solicitations on the LAN


    step 1. Send a Router Solicitation from the LAN
    step 2. Wait for a Router Advertisement from the DUT
    step 3. Verify the fields in the Router Advertisement


    References:

    IETF RFC 4861 "Neighbor Discovery for IP version 6 (IPv6)"

    https://tools.ietf.org/html/rfc4861
Test Name Synopsis
Verify DUT periodically sends unsolicited Router Advertisements ipv6_ndp_2 Verify DUT periodically sends unsolicited Router Advertisements


    step 1. Listen for a Router Advertisement on the LAN
    step 2. Wait for a second Router Advertisement on the LAN
    step 3. Verify that the DUT is periodically sending Advertisments

    NOTE: The testvar ipv6RAInterval will control how long this test waits for a
    Router Advertisement.


    References:

    IETF RFC 4861 "Neighbor Discovery for IP version 6 (IPv6)"

    https://tools.ietf.org/html/rfc4861
Test Name Synopsis
Verify DUT responds to Neighbor Solicitations for its link-local address ipv6_ndp_10 Verify DUT responds to Neighbor Solicitations for its link-local address


    step 1. Send a Neighbor Solicitation on the LAN for the DUT's link-local address
    step 2. Wait for a Neighbor Advertisement from the DUT
    step 3. Verify fields of the Neighbor Advertisement


    References:

    IETF RFC 4861 "Neighbor Discovery for IP version 6 (IPv6)"

    https://tools.ietf.org/html/rfc4861
Test Name Synopsis
Verify DUT responds to Neighbor Solicitations for its global IPv6 address ipv6_ndp_11 Verify DUT responds to Neighbor Solicitations for its global IPv6 address


    step 1. Send a Neighbor Solicitation on the LAN for the DUT's global IPv6 address
    step 2. Wait for a Neighbor Advertisement from the DUT
    step 3. Verify fields of Neighbor Advertisement


    References:

    IETF RFC 4861 "Neighbor Discovery for IP version 6 (IPv6)"

    https://tools.ietf.org/html/rfc4861
Test Name Synopsis
Verify DUT ignores Neighbor Solicitations with an invalid hop-count ipv6_ndp_12 Verify DUT ignores Neighbor Solicitations with an invalid hop-count


    step 1. Send an Neighbor Solicitation for the DUT's link-local address with a hop-count of 64
    step 2. Verify the DUT ignores the Solicitation and doesn't respond with a Neighbor Advertisement
    step 3. Send a valid Neighbor Solicitation to make sure DUT is properly responding


    References:

    IETF RFC 4861 "Neighbor Discovery for IP version 6 (IPv6)"

    https://tools.ietf.org/html/rfc4861
Test Name Synopsis
Verify DUT responds to DAD-style Neighbor Solicitations for link-local address on LAN ipv6_ndp_13 Verify DUT responds to DAD-style Neighbor Solicitations for link-local address on LAN


    step 1. Send a Duplicate-Address-Detection (DAD) style Neighbor Solicition
            for the DUT's link-local address on the LAN
    step 2. Wait for a Neighbor Advertisement from the DUT
    step 3. Verify source, destination, and contents of Neighbor Advertisement


    References:

    IETF RFC 4861 "Neighbor Discovery for IP version 6 (IPv6)"

    https://tools.ietf.org/html/rfc4861

    IETF RFC 4862 "IPv6 Stateless Address Autoconfiguration" Section 5.4: Duplicate Address Detection

    https://tools.ietf.org/html/rfc4862#section-5.4
Test Name Synopsis
Verify DUT ignores Neighbor Solicitations with a different target than itself ipv6_ndp_14 Verify DUT ignores Neighbor Solicitations with a different target than itself


    step 1. Send an Neighbor Solicitation for the lanStack's link-local address to the DUT's link-local address
            and its global address
    step 2. Verify the DUT ignores the Solicitation and doesn't respond with a Neighbor Advertisement
    step 3. Send a valid Neighbor Solicitation to make sure DUT is properly responding


    References:

    IETF RFC 4861 "Neighbor Discovery for IP version 6 (IPv6)"

    https://tools.ietf.org/html/rfc4861
Test Name Synopsis
Verify DUT ignores Neighbor Solicitations sent to the wrong Solicited-Node Multicast Address ipv6_ndp_15 Verify DUT ignores Neighbor Solicitations sent to the wrong Solicited-Node Multicast Address


    step 1. Send an Neighbor Solicitation for the DUT's link-local address, but sent to the wrong
            Solicited-Node Multicast Address
    step 2. Verify the DUT ignores the Solicitation and doesn't respond with a Neighbor Advertisement
    step 3. Send a valid Neighbor Solicitation to make sure DUT is properly responding


    References:

    IETF RFC 4861 "Neighbor Discovery for IP version 6 (IPv6)"

    https://tools.ietf.org/html/rfc4861
Test Name Synopsis
Verify DUT responds to DAD-style Neighbor Solicitations for global address on LAN ipv6_ndp_16 Verify DUT responds to DAD-style Neighbor Solicitations for global address on LAN


    step 1. Send a Duplicate-Address-Detection (DAD) style Neighbor Solicition
            for the DUT's global address on the LAN
    step 2. Wait for a Neighbor Advertisement from the DUT
    step 3. Verify source, destination, and contents of Neighbor Advertisement


    References:

    IETF RFC 4861 "Neighbor Discovery for IP version 6 (IPv6)"

    https://tools.ietf.org/html/rfc4861

    IETF RFC 4862 "IPv6 Stateless Address Autoconfiguration" Section 5.4: Duplicate Address Detection

    https://tools.ietf.org/html/rfc4862#section-5.4
Test Name Synopsis
Verify DUT sends ICMPv6 Redirect messages for neighbor traffic forwarded to it ipv6_ndp_20 Verify DUT sends ICMPv6 Redirect messages for neighbor traffic forwarded to it


    step 1: Create a new client on the LAN
    step 2: Send a ping to the Global-Unicast-Address of the new client
    step 3: Verify the DUT sends an ICMPv6 Redirect messsage
    step 4. Verify the ICMPv6 Redirect message
    step 5: Verify the new client responds to the ping

    NOTE: This test is similar to ipv6_forward_3, except it verifies that the
    DUT is sending valid ICMPv6 Redirect messages back to the sender. Test
    ipv6_forward_3 verifies that the packet is forwarded to the correct
    destination.


    References:

    IETF RFC 4861 "Neighbor Discovery for IP version 6 (IPv6)" Section 8: Redirect Function

    https://tools.ietf.org/html/rfc4861#section-8
Test Name Synopsis
Verify Router Advertisements contain M bit and O bit based on LAN mode ipv6_ndp_30 Verify Router Advertisements contain M bit and O bit based on LAN mode


    step 1. Listen for a Router Advertisement on the LAN
    step 2. Check the "managed address configuration" flag (M bit) in the Router
            Advertisement received in Step 1
    step 3. If the DUT is configured to provide global addresses via DHCPv6 on
            the LAN, the M bit should be set; if autoconfiguration is used
            instead, the M bit should not be set
    step 4. If the DUT is configured to provide global addresses via
            autoconfiguration on the LAN, and the "other stateful configuration"
            flag (O bit) is set, send a DHCPv6 Information-request including an
            Option Request for DHCPv6 Options 23 'DNS Recursive Name Server'
            and 24 'Domain Search List' to the DUT. Skip to Step 6.
    step 5. If the DUT is configured to provide global addresses via
            DHCPv6 and the "managed address configuration" flag
            (M bit) is set, send a DHCPv6 Information-request including an
            Option Request for DHCPv6 Options 23 'DNS Recursive Name Server'
            and 24 'Domain Search List' to the DUT
    step 6. Verify that the DUT sends a DHCPv6 Reply in response to the DHCPv6
            Information-request message sent by the client in Steps 4 or 5
    step 7. Verify that the DUT's DHCPv6 Reply includes DHCPv6 Options 23 and 24
    Step 8. Verify the DNS server information provided by the DUT. If the testvar
            ipv6DNStoLAN is set to "yes", the DNS server addresses provided should
            match the addresses of the DNS servers configured on the WAN. If the
            ipv6DNStoLAN testvar is set to "no", the LAN side IPv6 address of the
            DUT should be provided as the DNS server.
    step 9. Verify the domain search list information provided by the DUT


    References:

    IETF RFC 4861 "Neighbor Discovery for IP version 6 (IPv6)" Section 4.2: Router Advertisement Message Format

    https://tools.ietf.org/html/rfc4861#section-4.2
Test Name Synopsis
Verify Router Advertisements contain valid prefix, A bit, and L bit based on LAN settings ipv6_ndp_31 Verify Router Advertisements contain valid prefix, A bit, and L bit based on LAN settings


    step 1. Listen for Router Advertisements on the LAN for one Router
            Advertisement interval
    step 2. Verify at least one Router Advertisement contains a valid prefix
            based on the DUT's LAN IPv6 address
    step 3. Verify that the prefix length associated with the prefix discovered
            in Step 2 is the same as the DUT's configured LAN prefix length
            (skip this step if the IPv6 WAN mode is 6to4)
    step 4. Verify that the prefix discovered in Step 2 contains a valid
            lifetime
    step 5. Verify that the prefix discovered in Step 2 has the autonomous
            address-configuration flag (A bit) set to either 0 or 1
    step 6. Verify that the prefix discovered in Step 2 has the on-link flag
            (L bit) set


    References:

    IETF RFC 4861 "Neighbor Discovery for IP version 6 (IPv6)" Section 4.6.2: Prefix Information

    https://tools.ietf.org/html/rfc4861#section-4.6.2
Test Name Synopsis
Verify Router Advertisements contain RDNSS option ipv6_ndp_32 Verify Router Advertisements contain RDNSS option


    step 1. Listen for a Router Advertisement on the LAN
    step 2. Verify that one or more RDNSS options (25) are present in RA
    step 3. Verify the addresses provided in RDNSS options. If the testvar
            ipv6DNStoLAN is set to "yes", the DNS server addresses listed
            in the RDNSS option should match the addresses of the DNS
            servers configured on the WAN. If the ipv6DNStoLAN testvar is
            set to "no", the RDNSS option should list only the LAN side
            IPv6 address of the DUT (global or link-local address).
    step 4. Verify the RDNSS option lifetime

    NOTE: This test is skipped if the testvar ipv6RdnssSupport is set to no
    indicating that the device does not support the RDNSS option.


    References:

    IETF RFC 4861 "Neighbor Discovery for IP version 6 (IPv6)"

    https://tools.ietf.org/html/rfc4861

    IETF RFC 6106 "IPv6 Router Advertisement Options for DNS Configuration"

    https://tools.ietf.org/html/rfc6106
Test Name Synopsis
Verify Router Advertisements contain DNSSL option ipv6_ndp_33 Verify Router Advertisements contain DNSSL option


    step 1. Listen for a Router Advertisement on the LAN
    step 2. Verify that one or more DNSSL options (31) are present in RA
    step 3. Verify the domain search list provided in the DNSSL option. The
            domain search list should contain the domain name specified by the
            testvar wanDomainName.
    step 4. Verify the DNSSL option lifetime

    NOTE: This test is skipped if the testvar ipv6DnsslSupport is set to no
    indicating that the device does not support the DNSSL option.


    References:

    IETF RFC 4861 "Neighbor Discovery for IP version 6 (IPv6)"

    https://tools.ietf.org/html/rfc4861

    IETF RFC 6106 "IPv6 Router Advertisement Options for DNS Configuration"

    https://tools.ietf.org/html/rfc6106
Test Name Synopsis
Verify DUT does not advertise itself as a default router when WAN RA lifetime is 0 ipv6_ndp_34 Verify DUT does not advertise itself as a default router when WAN RA lifetime is 0


    step 1. Send Router Advertisements on the WAN with a Router Lifetime of 0
    step 2. Listen for RAs from the DUT on the LAN for up to the [dhcpv6PDLatency
            + 1 LAN RA interval]
    step 3. Verify that the DUT eventually stops advertising itself as a default
            router by setting the Router Lifetime in LAN RAs to a value of 0
    step 3. Restore original Router Lifetime on WAN and start sending Router
            Advertisements on the WAN with a non-zero Router Lifetime
    step 4. Verify that the DUT starts advertising itself as a default router by
            setting the Router Lifetime in LAN RAs to a value greater than 0
    step 5. Wait for the duration of the dhcpv6PDLatency testvar and perform a
            connectivity check to ensure that the WAN link is operational


    References:

    IETF RFC 4861 "Neighbor Discovery for IP version 6 (IPv6)"

    https://tools.ietf.org/html/rfc4861

    IETF RFC 7084 "IPv6 CE Router Requirements" Section 4.1: General Requirements

    G-4: By default, an IPv6 CE router that has no default
         router(s) on its WAN interface MUST NOT advertise
         itself as an IPv6 default router on its LAN interfaces.
         That is, the "Router Lifetime" is set to zero in all
         Router Advertisement messages it originates [RFC4861].

    https://tools.ietf.org/html/rfc7084#section-4.1

    IETF RFC 7084 "IPv6 CE Router Requirements" Section 4.1: General Requirements

    G-5: By default, if the IPv6 CE router is an advertising router and
         loses its IPv6 default router(s) and/or detects loss of
         connectivity on the WAN interface, it MUST explicitly
         invalidate itself as an IPv6 default router on each of its
         advertising interfaces by immediately transmitting one or more
         Router Advertisement messages with the "Router Lifetime" field
         set to zero [RFC4861].

    https://tools.ietf.org/html/rfc7084#section-4.1
Test Name Synopsis
Verify Neighbor Unreachability Detection ipv6_ndp_40 Verify Neighbor Unreachability Detection


    step 1. Disable LAN client to prevent the DUT from receiving
            reachability confirmations
    step 2. Wait (ReachableTime + DELAY_FIRST_PROBE_TIME +
            (MAX_UNICAST_SOLICIT * RetransTimer)) seconds to ensure DUT's
            neighbor cache entry (NCE) for LAN client is deleted
    step 3. Enable LAN client
    step 4. Send a Neighbor Solicitation on the LAN for the DUT's
            link-local address to create a NCE on the DUT for the LAN
            client's link-local address in the STALE state
    step 5. Verify a Neighbor Advertisement is received from the DUT
    step 6. Send an ICMPv6 Echo Request from the LAN to the DUT's
            link-local address to transition the NCE on the DUT from
            STALE to DELAY state.
    step 7. Verify an ICMPv6 Echo Reply is received from the DUT
    step 8. Disable neighbor discovery (ND) on LAN client to prevent
            the sending of Neighbor Advertisements
    step 9. Wait DELAY_FIRST_PROBE_TIME-1 seconds to allow the NCE on
            the DUT to transition from DELAY to PROBE state
    step 10. Wait RetransTimer+1 seconds for the DUT to send a unicast
             Neighbor Solicitation for the LAN client's link local address
    step 11. Verify LAN client receives a unicast Neighbor Solicitation
    step 12. Repeat steps 10 and 11 to ensure that MAX_UNICAST_SOLICIT
             Neighbor Solications are sent.  On the
             MAX_UNICAST_SOLICIT'th Neighbor Solication, reenable
             neighbor discovery on LAN client and respond to the
             Neighbor Solicitation with a Neighbor Advertisement to
             allow the DUT's NCE to transition from PROBE to REACHABLE
             state
    step 13. Disable LAN client to prevent the DUT from receiving
             reachability confirmations
    step 14. Wait ReachableTime+1 seconds to allow DUT's NCE to
             transition from REACHABLE to STALE state
    step 15. Enable LAN client
    step 16. Send an ICMPv6 Echo Request from the LAN to the DUT's
             link-local address to transition the NCE on the DUT from
             STALE to DELAY state.
    step 17. Verify an ICMPv6 Echo Reply is received from the DUT
    step 18. Disable neighbor discovery (ND) on LAN client to prevent
             the sending of Neighbor Advertisements
    step 19. Wait DELAY_FIRST_PROBE_TIME-1 seconds to allow the NCE on
             the DUT to transition from DELAY to PROBE state
    step 20. Wait RetransTimer+1 seconds for the DUT to send a unicast
             Neighbor Solicitation for the LAN client's link local address
    step 21. Verify LAN client receives a unicast Neighbor Solicitation
    step 22. Repeat steps 20 and 21 to ensure that MAX_UNICAST_SOLICIT
             Neighbor Solications are sent.  The DUT's NCE should now
             be deleted


    References:

    IETF RFC 4861 "Neighbor Discovery for IP version 6 (IPv6)" Section 7.3: Neighbor Unreachability Detection

    https://tools.ietf.org/html/rfc4861#section-7.3
Test Name Synopsis
Verify ICMPv6 Destination Unreachable sent on address resolution failure ipv6_ndp_41 Verify ICMPv6 Destination Unreachable sent on address resolution failure


    step 1. Wait 60 seconds to ensure DUT has no neighbor cache entry
            (NCE) for ipv6WanIspNextIp
    step 2. Send an ICMPv6 Echo Request from the LAN to ipv6WanIspNextIp
    step 3. Wait 2 seconds for DUT to send a Neighbor Solicitation on
            the WAN.
    step 4. Verify that the Neighbor Solicitation is sent to the
            solicited-node multicast corresponding to ipv6WanIspNextIp
            with target ipv6WanIspNextIp and includes a Source
            Link-Layer Address option
    step 5. Repeat steps 3 & 4 MAX_MULTICAST_SOLICIT (3) times
    step 6. Verify DUT sends an ICMPv6 Destination Unreachable message
            to the LAN client with code 3 (Address Unreachable)


    References:

    IETF RFC 4861 "Neighbor Discovery for IP version 6 (IPv6)" Section 7.2.2: Sending Neighbor Solicitations

    https://tools.ietf.org/html/rfc4861#section-7.2.2

ndp-wan.tcl

Neighbor Discovery Protocol and Router Advertisement tests for the WAN side of IPv6 devices

Test Name Synopsis
Verify if DUT responds to Router Solicitations on the WAN ipv6_ndp_wan_1 Verify if DUT responds to Router Solicitations on the WAN


    step 1. Send a Router Solicitation from the WAN
    step 2. Wait to see if DUT sends a Router Advertisement on the WAN
    step 3. Verify the expected behavior

    Note: The testvar ipv6ExpectRAonWan determines if this test should
          expect to see Router Advertisements from the DUT on the WAN


    References:

    IETF RFC 4861 "Neighbor Discovery for IP version 6 (IPv6)"

    https://tools.ietf.org/html/rfc4861
Test Name Synopsis
Verify if DUT periodically sends unsolicited Router Advertisements ipv6_ndp_wan_2 Verify if DUT periodically sends unsolicited Router Advertisements


    step 1. Wait for a Router Advertisement on the WAN
    step 2. Wait for a second Router Advertisement on the WAN
    step 3. Verify if the DUT is periodically sending Advertisments as expected

    Notes: The testvar ipv6ExpectRAonWan determines if this test should
           expect to see Router Advertisements from the DUT on the WAN

           The testvar ipv6RAInterval will control how long
           this test waits for a Router Advertisement.



    References:

    IETF RFC 4861 "Neighbor Discovery for IP version 6 (IPv6)"

    https://tools.ietf.org/html/rfc4861
Test Name Synopsis
Verify DUT responds to Neighbor Solicitations on the WAN for its link-local address ipv6_ndp_wan_10 Verify DUT responds to Neighbor Solicitations on the WAN for its link-local address


    step 1. Send a Neighbor Solicitation on the WAN for the DUT's link-local address
    step 2. Wait for a Neighbor Advertisement from the DUT
    step 3. Verify fields of the Neighbor Advertisement


    References:

    IETF RFC 4861 "Neighbor Discovery for IP version 6 (IPv6)"

    https://tools.ietf.org/html/rfc4861
Test Name Synopsis
Verify DUT responds to Neighbor Solicitations on the WAN for its global IPv6 address ipv6_ndp_wan_11 Verify DUT responds to Neighbor Solicitations on the WAN for its global IPv6 address


    step 1. Send a Neighbor Solicitation on the WAN for the DUT's global IPv6 address
    step 2. Wait for a Neighbor Advertisement from the DUT
    step 3. Verify fields of Neighbor Advertisement


    References:

    IETF RFC 4861 "Neighbor Discovery for IP version 6 (IPv6)"

    https://tools.ietf.org/html/rfc4861
Test Name Synopsis
Verify DUT ignores invalid Neighbor Solicitations sent on the WAN ipv6_ndp_wan_12 Verify DUT ignores invalid Neighbor Solicitations sent on the WAN


    step 1. Send an invalid Neighbor Solicitation for the DUT's WAN-side global address
    step 2. Verify the DUT ignores the Solicitation and doesn't respond with a Neighbor Advertisement
    step 3. Send a valid Neighbor Solicitation to make sure DUT is properly responding


    References:

    IETF RFC 4861 "Neighbor Discovery for IP version 6 (IPv6)"

    https://tools.ietf.org/html/rfc4861
Test Name Synopsis
Verify DUT responds to DAD-style Neighbor Solicitations on the WAN for its link local address ipv6_ndp_wan_13 Verify DUT responds to DAD-style Neighbor Solicitations on the WAN for its link local address


    step 1. Send a Duplicate-Address-Detection style Neighbor Solicition for the DUT's
            link-local address on the WAN
    step 2. Wait for a Neighbor Advertisement from the DUT
    step 3. Verify source, destination, and contents of Neighbor Advertisement

    Reference: RFC 4862 Section 5.4


    References:

    IETF RFC 4861 "Neighbor Discovery for IP version 6 (IPv6)"

    https://tools.ietf.org/html/rfc4861

    IETF RFC 4862 "IPv6 Stateless Address Autoconfiguration" Section 5.4: Duplicate Address Detection

    https://tools.ietf.org/html/rfc4862#section-5.4
Test Name Synopsis
Verify DUT ignores Neighbor Solicitations with a different target than itself ipv6_ndp_wan_14 Verify DUT ignores Neighbor Solicitations with a different target than itself


    step 1. Send an Neighbor Solicitation for the wanStack's link-local address to the DUT's
            link-local address and its global address
    step 2. Verify the DUT ignores the Solicitation and doesn't respond with a Neighbor Advertisement
    step 3. Send a valid Neighbor Solicitation to make sure DUT is properly responding


    References:

    IETF RFC 4861 "Neighbor Discovery for IP version 6 (IPv6)"

    https://tools.ietf.org/html/rfc4861
Test Name Synopsis
Verify DUT ignores Neighbor Solicitations sent to the wrong Solicited-Node Multicast Address ipv6_ndp_wan_15 Verify DUT ignores Neighbor Solicitations sent to the wrong Solicited-Node Multicast Address


    step 1. Send an Neighbor Solicitation for the DUT's link-local address, but sent to the wrong
            Solicited-Node Multicast Address
    step 2. Verify the DUT ignores the Solicitation and doesn't respond with a Neighbor Advertisement
    step 3. Send a valid Neighbor Solicitation to make sure DUT is properly responding


    References:

    IETF RFC 4861 "Neighbor Discovery for IP version 6 (IPv6)"

    https://tools.ietf.org/html/rfc4861
Test Name Synopsis
Verify DUT responds to DAD-style Neighbor Solicitations on the WAN for its global IPv6 address ipv6_ndp_wan_16 Verify DUT responds to DAD-style Neighbor Solicitations on the WAN for its global IPv6 address


    step 1. Send a Duplicate-Address-Detection style Neighbor Solicition for the DUT's
            global address on the WAN
    step 2. Wait for a Neighbor Advertisement from the DUT
    step 3. Verify source, destination, and contents of Neighbor Advertisement


    References:

    IETF RFC 4861 "Neighbor Discovery for IP version 6 (IPv6)"

    https://tools.ietf.org/html/rfc4861

    IETF RFC 4862 "IPv6 Stateless Address Autoconfiguration" Section 5.4: Duplicate Address Detection

    https://tools.ietf.org/html/rfc4862#section-5.4

dhcpv6-c.tcl

DHCPv6 client tests for the WAN side of the router

Test Name Synopsis
Verify client requests the assignment of a non-temporary address dhcpv6_1 Verify client requests the assignment of a non-temporary address


    step 1. Check existing DHCPv6 bindings on the WAN side of the CPE
    step 2. Verify whether or not a non-temporary address binding exists
    step 3. Verify Valid and Preferred lifetimes for binding
    step 4. Verify that the binding has not expired


    References:

    IETF RFC 3315 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)" Section 17: DHCP Server Solicitation

    https://tools.ietf.org/html/rfc3315#section-17
Test Name Synopsis
Verify client renews non-temporary address when current binding expires dhcpv6_2 Verify client renews non-temporary address when current binding expires


    step 1. Wait for DHCPv6 client's current non-temporary address binding
            T1 timer to expire
    step 2. Verify DHCPv6 client sends DHCPv6 Renew
    step 3. Verify Renew contains Server Identifier option (2) with correct
            server DUID
    step 4. Verify Renew contains IA_NA option (3) for same non-temporary
            address
    step 5. Send valid Reply to update binding


    References:

    IETF RFC 3315 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)" Section 18.1.3: Creation and Transmission of Renew Messages

    To extend the valid and preferred lifetimes for the addresses
    associated with an IA, the client sends a Renew message to the server
    from which the client obtained the addresses in the IA containing an
    IA option for the IA.  The client includes IA Address options in the
    IA option for the addresses associated with the IA.  The server
    determines new lifetimes for the addresses in the IA according to the
    administrative configuration of the server.

    https://tools.ietf.org/html/rfc3315#section-18.1.3
Test Name Synopsis
Verify client obtains address from server using various undefined server DUID values dhcpv6_4 Verify client obtains address from server using various undefined server DUID values


    step 1. Configure the server to use an undefined server DUID format
    step 2. Wait for DHCPv6 client's current non-temporary address binding
            to expire
    step 3. Do not respond to Renew or Rebind messages from client
    step 4. Verify client sends Solicit message and obtains an IPv6 address
    step 5. Repeat steps 1 - 4 for various undefined DUID server formats
    step 6. Reestablish the DHCPv6 binding using the original DUID format


    References:

    IETF RFC 3315 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)" Section 9: DHCP Unique Identifier (DUID)

    https://tools.ietf.org/html/rfc3315#section-9
Test Name Synopsis
Verify client ignores replies with mismatched client DUID dhcpv6_10 Verify client ignores replies with mismatched client DUID


    step 1. Wait for DHCPv6 client's current non-temporary address binding
            to expire
    step 2. Do not respond to Renew or Rebind messages from client
    step 3. Verify client sends Solicit message
    step 4. Verify Solicit contains IA_NA option (3)
    step 5. Respond to first Solicit message with incorrect Client
            Identifier option(1) DUID
    step 6. Verify client restransmits Solicit message
    step 7. Send valid Advertise message and wait for transaction to
            finish


    References:

    IETF RFC 3315 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)" Section 17.1.2: Transmission of Solicit Messages

    If the client does not receive any Advertise messages before the
    first RT has elapsed, it begins the retransmission mechanism
    described in section 14.  The client terminates the retransmission
    process as soon as it receives any Advertise message, and the client
    acts on the received Advertise message without waiting for any
    additional Advertise messages.

    https://tools.ietf.org/html/rfc3315#section-17.1.2
Test Name Synopsis
Verify client ignores unknown or invalid DHCPv6 packets dhcpv6_11 Verify client ignores unknown or invalid DHCPv6 packets


    step 1. Send invalid DHCPv6 packet with message type 0 to client
            on the WAN
    step 2. Verify that client does not respond to packet transmitted
            in Step 1
    step 3. Repeat steps 1 and 2 for message types 1 through 255


    References:

    IETF RFC 3315 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)"

    https://tools.ietf.org/html/rfc3315
Test Name Synopsis
Verify client handles fragmented IPv6 packets dhcpv6_14 Verify client handles fragmented IPv6 packets


    step 1. Configure DHCPv6 server to use a large User Class option (15)
            to force IPv6 fragmentation
    step 2. Wait for DHCPv6 client's current non-temporary address binding
            to expire
    step 3. Do not respond to Renew or Rebind messages from client
    step 4. Verify client sends Solicit message
    step 5. Respond to first Solicit message with Advertise containing
            large User Class Option (15) causing fragmentation
    step 6. Verify client sends valid Request in response to Advertise
    step 7. Disable server User Class option (15) created in Step 1
    step 8. If client fails Step 6, cleanup and wait for client to
            retransmit Solicit message
    step 9. Send valid Advertise message and wait for transaction to
            finish


    References:

    IETF RFC 3315 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)" Section 18.1: Client Behavior

    https://tools.ietf.org/html/rfc3315#section-18.1
Test Name Synopsis
Verify client ignores server messages with invalid UDP checksum dhcpv6_15 Verify client ignores server messages with invalid UDP checksum


    step 1. Configure DHCPv6 server to use bad UDP checksums
    step 2. Wait for DHCPv6 client's current non-temporary address binding
            to expire
    step 3. Do not respond to Renew or Rebind messages from client
    step 4. Verify client sends Solicit message
    step 5. Respond to first Solicit message with Advertise containing
            invalid UDP checksum
    step 6. Verify client does not send valid Request in response to
            Advertise
    step 7. Configure DHCPv6 server to use valid UDP checksums
    step 8. Wait for client to retransmit Solicit message
    step 9. Send valid Advertise message and wait for transaction to
            finish


    References:

    IETF RFC 3315 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)"

    https://tools.ietf.org/html/rfc3315
Test Name Synopsis
Verify client composes DUID correctly dhcpv6_16 Verify client composes DUID correctly


    step 1. Wait for DHCPv6 client's current non-temporary address binding
            T1 timer to expire
    step 2. Verify DHCPv6 client sends DHCPv6 Renew
    step 3. Inspect the composition of the DUID to ensure correctness

    Reference: IETF RFC 3315 Section 9 "DHCP Unique Identifier (DUID)"


    References:

    IETF RFC 3315 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)" Section 9: DHCP Unique Identifier (DUID)

    https://tools.ietf.org/html/rfc3315#section-9
Test Name Synopsis
Verify client restarts when NoBinding failure occurs during Renew dhcpv6_20 Verify client restarts when NoBinding failure occurs during Renew


    step 1. Wait for DHCPv6 client's current non-temporary address binding
            T1 timer to expire
    step 2. Verify DHCPv6 client sends DHCPv6 Renew
    step 3. Verify Renew contains IA_NA option (3) for same non-temporary
            address
    step 4. Send valid DHCPv6 Reply with NoBinding status code (3)
    step 5. Verify DHCPv6 client sends Request message
    step 6. Verify Request contains IA_NA option (3) for same non-temporary
            address


    References:

    IETF RFC 3315 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)" Section 18.1.8: Receipt of Reply Messages

    When the client receives a Reply message in response to a Renew or
    Rebind message, the client examines each IA independently.  For each
    IA in the original Renew or Rebind message, the client:

    -  sends a Request message if the IA contained a Status Code option
       with the NoBinding status (and does not send any additional
       Renew/Rebind messages)

    -  sends a Renew/Rebind if the IA is not in the Reply message

    -  otherwise accepts the information in the IA

    https://tools.ietf.org/html/rfc3315#section-18.1.8
Test Name Synopsis
Verify client restarts when UnspecFail failure occurs during Renew dhcpv6_21 Verify client restarts when UnspecFail failure occurs during Renew


    step 1. Wait for DHCPv6 client's current non-temporary address binding
            T1 timer to expire
    step 2. Verify DHCPv6 client sends DHCPv6 Renew
    step 3. Verify Renew contains IA_NA option (3) for same non-temporary
            address
    step 4. Send valid DHCPv6 Reply with UnspecFail status code (1)
    step 5. Verify DHCPv6 client recovers by retransmitting Renew or
            sending Request
    step 6. Verify Renew or Request contains IA_NA option (3) for same
            non-temporary address


    References:

    IETF RFC 3315 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)" Section 18.1.8: Receipt of Reply Messages

    If the client receives a Reply message with a Status Code containing
    UnspecFail, the server is indicating that it was unable to process
    the message due to an unspecified failure condition.  If the client
    retransmits the original message to the same server to retry the
    desired operation, the client MUST limit the rate at which it
    retransmits the message and limit the duration of the time during
    which it retransmits the message.

    https://tools.ietf.org/html/rfc3315#section-18.1.8
Test Name Synopsis
Verify client restarts DHCPv6 when Reply to Request contains IA lifetimes set to 0 dhcpv6_22 Verify client restarts DHCPv6 when Reply to Request contains IA lifetimes set to 0


    step 1. Allow the DHCPv6 client to restart DHCPv6 by waiting for the IA_NA
            lifetime to expire without replying to any DHCPv6 messages
    step 2. Send a valid Advertise message in response to the DHCPv6 client's
            Solicit message
    step 3. Verify the DHCPv6 client sends a Request message
    step 4. Send a valid Reply message with all IA lifetimes set to 0
    step 5. Verify the DHCPv6 client sends a DHCPv6 Solicit message
    step 6. Verify the DHCPv6 client and server complete the DHCPv6 2 or 4 message
            exchange
    step 7. Verify DHCPv6 client recovered by waiting for the client to transmit
            a Renew at T1


    References:

    IETF RFC 8415 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)" Section 18.2.10.1: Reply for Solicit (with Rapid Commit), Request, Renew, or Rebind

    If the Reply message contains any IAs but the client finds no usable
    addresses and/or delegated prefixes in any of these IAs, the client
    may either try another server (perhaps restarting the DHCP server
    discovery process) or use the Information-request message to obtain
    other configuration information only.

    https://tools.ietf.org/html/rfc8415#section-18.2.10.1
Test Name Synopsis
Verify client restarts DHCPv6 when Reply to Renew contains IA lifetimes set to 0 dhcpv6_23 Verify client restarts DHCPv6 when Reply to Renew contains IA lifetimes set to 0


    step 1. Wait for DHCPv6 client's current IA_NA binding T1 timer to expire
    step 2. Verify the DHCPv6 client sends a DHCPv6 Renew
    step 3. Send a valid Reply message with all IA lifetimes set to 0
    step 4. Verify the DHCPv6 client sends a DHCPv6 Solicit message
    step 5. Verify the DHCPv6 client and server complete the DHCPv6 2 or 4 message
            exchange
    step 6. Verify the DHCPv6 client recovered by waiting for the client to transmit
            a Renew at T1


    References:

    IETF RFC 8415 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)" Section 18.2.10.1: Reply for Solicit (with Rapid Commit), Request, Renew, or Rebind

    If the Reply message contains any IAs but the client finds no usable
    addresses and/or delegated prefixes in any of these IAs, the client
    may either try another server (perhaps restarting the DHCP server
    discovery process) or use the Information-request message to obtain
    other configuration information only.

    https://tools.ietf.org/html/rfc8415#section-18.2.10.1
Test Name Synopsis
Verify client restarts DHCPv6 when Reply to Rebind contains IA lifetimes set to 0 dhcpv6_24 Verify client restarts DHCPv6 when Reply to Rebind contains IA lifetimes set to 0


    step 1. Wait for DHCPv6 client's current IA_NA binding T2 timer to expire
    step 2. Verify DHCPv6 client sends DHCPv6 Rebind
    step 3. Send a valid Reply message with all IA lifetimes set to 0
    step 4. Verify the DHCPv6 client sends a DHCPv6 Solicit message
    step 5. Verify the DHCPv6 client and server complete the DHCPv6 2 or 4 message
            exchange
    step 6. Verify the DHCPv6 client recovered by waiting for the client to transmit
            a Renew at T1


    References:

    IETF RFC 8415 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)" Section 18.2.10.1: Reply for Solicit (with Rapid Commit), Request, Renew, or Rebind

    If the Reply message contains any IAs but the client finds no usable
    addresses and/or delegated prefixes in any of these IAs, the client
    may either try another server (perhaps restarting the DHCP server
    discovery process) or use the Information-request message to obtain
    other configuration information only.

    https://tools.ietf.org/html/rfc8415#section-18.2.10.1
Test Name Synopsis
Verify client sends Rebind message if Renew for non-temporary address fails dhcpv6_30 Verify client sends Rebind message if Renew for non-temporary address fails


    step 1. Wait for DHCPv6 client's current non-temporary address binding
            T1 to expire
    step 2. Verify DHCPv6 client sends DHCPv6 Renew
    step 3. Do not respond to Renew message
    step 4. Verify DHCPv6 client sends Rebind message
    step 5. Verify Rebind contains IA_NA option (3) for same non-temporary
            address
    step 6. Send valid Reply to update binding


    References:

    IETF RFC 3315 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)" Section 18.1.4: Creation and Transmission of Rebind Messages

    At time T2 for an IA (which will only be reached if the server to
    which the Renew message was sent at time T1 has not responded), the
    client initiates a Rebind/Reply message exchange with any available
    server.  The client includes an IA option with all addresses
    currently assigned to the IA in its Rebind message.

    https://tools.ietf.org/html/rfc3315#section-18.1.4
Test Name Synopsis
Verify client sends Solicit message if Renew and Rebind for non-temporary address fails dhcpv6_31 Verify client sends Solicit message if Renew and Rebind for non-temporary address fails


    step 1. Wait for DHCPv6 client's current non-temporary address binding
            to expire
    step 2. Do not respond to Renew or Rebind messages from client
    step 3. Verify client sends Solicit message
    step 4. Verify Solicit contains IA_NA option (3)
    step 5. Send valid Advertise message and wait for transaction to
            finish


    References:

    IETF RFC 3315 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)" Section 18.1.4: Creation and Transmission of Rebind Messages

    The message exchange is terminated when the valid lifetimes of all
    the addresses assigned to the IA expire (see section 10), at which
    time the client has several alternative actions to choose from; for
    example:

    -  The client may choose to use a Solicit message to locate a new
       DHCP server and send a Request for the expired IA to the new
       server.

    -  The client may have other addresses in other IAs, so the client
       may choose to discard the expired IA and use the addresses in the
       other IAs.

    https://tools.ietf.org/html/rfc3315#section-18.1.4
Test Name Synopsis
Verify client supports DHCPv6 Reconfigure Key Authentication dhcpv6_32 Verify client supports DHCPv6 Reconfigure Key Authentication


    step 1. Check existing DHCPv6 bindings on the WAN side of the CPE
    step 2. Verify whether or not a non-temporary address binding
            exists
    step 3. Verify DHCPv6 Reconfigure Key exists for binding
    step 4. Send Reconfigure message requesting Renew
    step 5. Verify DHCPv6 client sends DHCPv6 Renew

    Reference:

    IETF RFC 3315 Section 21.5 "Reconfigure Key Authentication Protocol"


    References:

    IETF RFC 3315 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)" Section 21.5: Reconfigure Key Authentication Protocol

    https://tools.ietf.org/html/rfc3315#section-21.5
Test Name Synopsis
Verify client ignores DHCPv6 Reconfigure without Authentication option dhcpv6_33 Verify client ignores DHCPv6 Reconfigure without Authentication option


    step 1. Check existing DHCPv6 bindings on the WAN side of the CPE
    step 2. Verify whether or not a non-temporary address binding
            exists
    step 3. Verify DHCPv6 Reconfigure Key exists for binding
    step 4. Send Reconfigure message requesting Renew without
            Authentication option
    step 5. Verify DHCPv6 client does not send DHCPv6 Renew, Rebind or
            Information-Request


    References:

    IETF RFC 3315 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)" Section 15.11: Reconfigure Message

    https://tools.ietf.org/html/rfc3315#section-15.11
Test Name Synopsis
Verify client ignores DHCPv6 Reconfigure with incorrect Reconfigure Key dhcpv6_34 Verify client ignores DHCPv6 Reconfigure with incorrect Reconfigure Key


    step 1. Check existing DHCPv6 bindings on the WAN side of the CPE
    step 2. Verify whether or not a non-temporary address binding
            exists
    step 3. Verify DHCPv6 Reconfigure Key exists for binding
    step 4. Send Reconfigure message requesting Renew using
            incorrect DHCPv6 Reconfigure Key
    step 5. Verify DHCPv6 client does not send DHCPv6 Renew, Rebind or
            Information-Request


    References:

    IETF RFC 3315 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)" Section 15.11: Reconfigure Message

    https://tools.ietf.org/html/rfc3315#section-15.11
Test Name Synopsis
Verify client supports DHCPv6 Reconfigure with Rebind request dhcpv6_35 Verify client supports DHCPv6 Reconfigure with Rebind request


    step 1. Check existing DHCPv6 bindings on the WAN side of the CPE
    step 2. Verify whether or not a non-temporary address binding
            exists
    step 3. Verify DHCPv6 Reconfigure Key exists for binding
    step 4. Send Reconfigure message requesting Rebind
    step 5. Verify DHCPv6 client sends DHCPv6 Rebind


    References:

    IETF RFC 6644 "Rebind Capability in DHCPv6 Reconfigure Messages" Section 5: Client Behavior

    https://tools.ietf.org/html/rfc6644#section-5
Test Name Synopsis
Verify client ignores DHCPv6 Reconfigure requesting a Solicit dhcpv6_36 Verify client ignores DHCPv6 Reconfigure requesting a Solicit


    step 1. Check existing DHCPv6 bindings on the WAN side of the CPE
    step 2. Verify whether or not a non-temporary address binding
            exists
    step 3. Verify DHCPv6 Reconfigure Key exists for binding
    step 4. Send Reconfigure message requesting Solicit
    step 5. Verify DHCPv6 client does not send DHCPv6 Solicit, Renew,
            Rebind or Information-Request


    References:

    IETF RFC 6644 "Rebind Capability in DHCPv6 Reconfigure Messages" Section 5: Client Behavior

    https://tools.ietf.org/html/rfc6644#section-5
Test Name Synopsis
Verify client retransmits DHCPv6 Solicit messages for non-temporary address dhcpv6_50 Verify client retransmits DHCPv6 Solicit messages for non-temporary address


    step 1. Wait for DHCPv6 client's current non-temporary address binding
            to expire
    step 2. Do not respond to Renew or Rebind messages from client
    step 3. Verify client sends Solicit message
    step 4. Verify Solicit contains IA_NA option (3)
    step 5. Do not respond to first Solicit message
    step 6. Verify client restransmits Solicit message
    step 7. Verify retransmitted Solicit message contains same transaction
            ID as first Solicit message
    step 8. Send valid Advertise message and wait for transaction to
            finish


    References:

    IETF RFC 8415 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)" Section 16.1: Use of Transaction IDs

    The "transaction-id" field holds a value used by clients and servers
    to synchronize server responses to client messages.  A client SHOULD
    generate a random number that cannot easily be guessed or predicted
    to use as the transaction ID for each new message it sends.  Note
    that if a client generates easily predictable transaction
    identifiers, it may become more vulnerable to certain kinds of
    attacks from off-path intruders.  A client MUST leave the transaction
    ID unchanged in retransmissions of a message.

    https://tools.ietf.org/html/rfc8415#section-16.1

    IETF RFC 8415 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)" Section 18.2.1: Creation and Transmission of Solicit Messages

    If the client does not receive any valid Advertise messages before
    the first RT has elapsed, it then applies the retransmission
    mechanism described in Section 15.  The client terminates the
    retransmission process as soon as it receives any valid Advertise
    message, and the client acts on the received Advertise message
    without waiting for any additional Advertise messages.

    https://tools.ietf.org/html/rfc8415#section-18.2.1
Test Name Synopsis
Verify client retransmits DHCPv6 Request messages for non-temporary address dhcpv6_51 Verify client retransmits DHCPv6 Request messages for non-temporary address


    step 1.  Wait for DHCPv6 client's current non-temporary address binding
             to expire
    step 2.  Do not respond to Renew or Rebind messages from client
    step 3.  Verify client sends Solicit message
    step 4.  Verify Solicit contains IA_NA option (3)
    step 5.  Send valid Advertise message
    step 6.  Verify client sends Request message containing IA_NA option (3)
    step 7.  Do not respond to Request message
    step 8.  Verify client retransmists Request message
    step 9.  Verify retransmitted Request message contains same transaction
             ID as first Request message
    step 10. Send valid Advertise message and wait for transaction to
             finish

    Reference: IETF RFC 3315 Section 14 "Reliability of Client Initiated
    Message Exchanges"

    DHCP clients are responsible for reliable delivery of messages in the
    client-initiated message exchanges described in sections 17 and 18.
    If a DHCP client fails to receive an expected response from a server,
    the client must retransmit its message.  This section describes the
    retransmission strategy to be used by clients in client-initiated
    message exchanges.

    NOTE: This test will not work if Rapid-Commit is used!


    References:

    IETF RFC 8415 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)" Section 15: Reliability of Client Initiated Message Exchanges

    DHCP clients are responsible for reliable delivery of messages in the
    client-initiated message exchanges described in Section 18.  If a
    DHCP client fails to receive an expected response from a server, the
    client must retransmit its message according to the retransmission
    strategy described in this section.

    https://tools.ietf.org/html/rfc8415#section-15

    IETF RFC 8415 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)" Section 16.1: Use of Transaction IDs

    The "transaction-id" field holds a value used by clients and servers
    to synchronize server responses to client messages.  A client SHOULD
    generate a random number that cannot easily be guessed or predicted
    to use as the transaction ID for each new message it sends.  Note
    that if a client generates easily predictable transaction
    identifiers, it may become more vulnerable to certain kinds of
    attacks from off-path intruders.  A client MUST leave the transaction
    ID unchanged in retransmissions of a message.

    https://tools.ietf.org/html/rfc8415#section-16.1
Test Name Synopsis
Verify DHCPv6 Solicit retransmission times for IA_NA address bindings dhcpv6_52 Verify DHCPv6 Solicit retransmission times for IA_NA address bindings


    step 1. Reboot the client and wait for it to send a DHCPv6 Solicit
    step 2. Do not respond to Solicit messages from client
    step 3. Verify that the client retransmits the Solicit message following the
            retransmission algorithm

    Note: This test takes over 2 hours to run.


    References:

    IETF RFC 8415 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)" Section 15: Reliability of Client Initiated Message Exchanges

    DHCP clients are responsible for reliable delivery of messages in the
    client-initiated message exchanges described in Section 18.  If a
    DHCP client fails to receive an expected response from a server, the
    client must retransmit its message according to the retransmission
    strategy described in this section.

    https://tools.ietf.org/html/rfc8415#section-15
Test Name Synopsis
Verify DHCPv6 Request retransmission times for IA_NA address bindings dhcpv6_53 Verify DHCPv6 Request retransmission times for IA_NA address bindings

    step 1. Wait for DHCPv6 client's current non-temporary address binding to
            expire
    step 2. Do not respond to Request messages from client
    step 3. Verify that the client retransmits the Request message following the
            retransmission algorithm
    step 4. Verify that the client does not retransmit Request messages after
            MRC (Maximum Retransmission Count) has been reached.


    References:

    IETF RFC 8415 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)" Section 15: Reliability of Client Initiated Message Exchanges

    DHCP clients are responsible for reliable delivery of messages in the
    client-initiated message exchanges described in Section 18.  If a
    DHCP client fails to receive an expected response from a server, the
    client must retransmit its message according to the retransmission
    strategy described in this section.

    https://tools.ietf.org/html/rfc8415#section-15
Test Name Synopsis
Verify DHCPv6 Renew retransmission times for IA_NA address bindings dhcpv6_54 Verify DHCPv6 Renew retransmission times for IA_NA address bindings


     step 1. Wait for DHCPv6 client to renew its current non-temporary address
             binding
     step 2. Reply to the DHCPv6 Renew message with updated IA_NA lifetimes. If
             IA_PD is enabled, the lifetimes match the IA_NA lifetimes
     step 3. Do not respond to subsequent Renew messages from client
     step 4. Verify that the client retransmits the DHCPv6 Renew message
             following the retransmission algorithm
     step 5. Verify that the client does not retransmit Renew messages after
             Max Retransmission Duration (MRD) has been reached

     Note: This test takes over 1 hour to run.


    References:

    IETF RFC 8415 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)" Section 15: Reliability of Client Initiated Message Exchanges

    DHCP clients are responsible for reliable delivery of messages in the
    client-initiated message exchanges described in Section 18.  If a
    DHCP client fails to receive an expected response from a server, the
    client must retransmit its message according to the retransmission
    strategy described in this section.

    https://tools.ietf.org/html/rfc8415#section-15
Test Name Synopsis
Verify DHCPv6 Rebind retransmission times for IA_NA address bindings dhcpv6_55 Verify DHCPv6 Rebind retransmission times for IA_NA address bindings


     step 1. Wait for DHCPv6 client to renew its current non-temporary address
             binding
     step 2. Reply to the DHCPv6 Renew message with updated IA_NA lifetimes. If
             IA_PD is enabled, the lifetimes match the IA_NA lifetimes
     step 3. Do not respond to subsequent Renew or Rebind messages from client
     step 4. Verify that the client retransmits Rebind messages following the
             retransmission algorithm
     step 5. Verify that the client does not retransmit Rebind messages after
             Max Retransmission Duration (MRD) has been reached

     Note: This test takes over 2 hours to run.


    References:

    IETF RFC 8415 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)" Section 15: Reliability of Client Initiated Message Exchanges

    DHCP clients are responsible for reliable delivery of messages in the
    client-initiated message exchanges described in Section 18.  If a
    DHCP client fails to receive an expected response from a server, the
    client must retransmit its message according to the retransmission
    strategy described in this section.

    https://tools.ietf.org/html/rfc8415#section-15
Test Name Synopsis
Verify client learns new non-temporary address when WAN DHCPv6 server renumbers dhcpv6_60 Verify client learns new non-temporary address when WAN DHCPv6 server renumbers


    step 1. Change the client's DHCPv6 binding to use the new
            non-temporary IPv6 address address specified by the testvar
            "ipv6WanIspNextIp"
    step 2. Verify DHCPv6 client sends DHCPv6 Renew or Request
    step 3. Verify Renew or Request contains IA_NA option (3) for same
            non-temporary address
    step 4. Send valid DHCPv6 Reply with new non-temporary address
    step 5. Verify client updates with new non-temporary address
    step 6. Ping client's new non-temporary address
    step 7. Restore client's original non-temporary address by repeating
            Steps 1 through 5 using original non-temporary address
    step 8. Ping client's original non-temporary address


    References:

    IETF RFC 3315 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)" Section 18.1.8: Receipt of Reply Messages

    If the Reply was received in response to a Solicit (with a Rapid
    Commit option), Request, Renew or Rebind message, the client updates
    the information it has recorded about IAs from the IA options
    contained in the Reply message:

    -  Record T1 and T2 times.

    -  Add any new addresses in the IA option to the IA as recorded by
       the client.

    -  Update lifetimes for any addresses in the IA option that the
       client already has recorded in the IA.

    -  Discard any addresses from the IA, as recorded by the client, that
       have a valid lifetime of 0 in the IA Address option.

    -  Leave unchanged any information about addresses the client has
       recorded in the IA but that were not included in the IA from the
       server.

    https://tools.ietf.org/html/rfc3315#section-18.1.8
Test Name Synopsis
Verify client obtains IPv6 address when server uses unknown DHCPv6 options dhcpv6_100 Verify client obtains IPv6 address when server uses unknown DHCPv6 options


    step 1. Configure DHCPv6 server to use unknown DHCPv6 option type
    step 2. Wait for DHCPv6 client's current non-temporary address binding
            to expire
    step 3. Do not respond to Renew or Rebind messages from client
    step 4. Verify client sends Solicit message
    step 5. Respond to first Solicit message with Advertise containing
            unknown DHCPv6 option type
    step 6. Verify client sends valid Request in response to Advertise
    step 7. Disable unknown DHCPv6 server option
    step 8. If client fails Step 6, cleanup and wait for client to
            retransmit Solicit message
    step 9. Send valid Advertise message and wait for transaction to
            finish


    References:

    IETF RFC 3315 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)" Section 18.1: Client Behavior

    https://tools.ietf.org/html/rfc3315#section-18.1
Test Name Synopsis
Verify client ignores DHCPv6 messages with unknown options and invalid option length dhcpv6_101 Verify client ignores DHCPv6 messages with unknown options and invalid option length


    step 1. Configure DHCPv6 server to use unknown DHCPv6 option type
            with invalid length
    step 2. Wait for DHCPv6 client's current non-temporary address binding
            to expire
    step 3. Do not respond to Renew or Rebind messages from client
    step 4. Verify client sends Solicit message
    step 5. Respond to first Solicit message with Advertise containing
            unknown DHCPv6 option type
    step 6. Verify client does not send valid Request in response to
            Advertise
    step 7. Disable unknown DHCPv6 server option
    step 8. Wait for client to retransmit Solicit message
    step 9. Send valid Advertise message and wait for transaction to
            finish


    References:

    IETF RFC 3315 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)"

    https://tools.ietf.org/html/rfc3315
Test Name Synopsis
Verify client includes the Elapsed Time option with value 0 in first message dhcpv6_102 Verify client includes the Elapsed Time option with value 0 in first message


    step 1. Wait for DHCPv6 client's current non-temporary address binding
            to expire
    step 2. Do not respond to Renew or Rebind messages from client
    step 3. Verify client sends Solicit message
    step 4. Verify Solicit contains IA_NA option (3)
    step 5. Verify Solicit contains Elapsed Time option (8) with value of 0
    step 6. Send valid Advertise message and wait for transaction to
            finish


    References:

    IETF RFC 3315 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)" Section 22.9: Elapsed Time Option

    A client MUST include an Elapsed Time option in messages to indicate
    how long the client has been trying to complete a DHCP message
    exchange.  The elapsed time is measured from the time at which the
    client sent the first message in the message exchange, and the
    elapsed-time field is set to 0 in the first message in the message
    exchange.

    https://tools.ietf.org/html/rfc3315#section-22.9
Test Name Synopsis
Verify client increases value of Elapsed Time option when Solicit is retransmitted dhcpv6_103 Verify client increases value of Elapsed Time option when Solicit is retransmitted


    step 1. Wait for DHCPv6 client's current non-temporary address binding
            to expire
    step 2. Do not respond to Renew or Rebind messages from client
    step 3. Verify client sends Solicit message
    step 4. Verify Solicit contains IA_NA option (3)
    step 5. Verify Solicit contains Elapsed Time option (8) with value of 0
    step 6. Do not respond to Solicit
    step 7. Verify client retransmists Solicit message
    step 8. Verify retransmitted Solicit message contains Elapsed Time option
            (8) with a value greater than 0
    step 9. Send valid Advertise message and wait for transaction to
            finish


    References:

    IETF RFC 3315 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)" Section 22.9: Elapsed Time Option

    A client MUST include an Elapsed Time option in messages to indicate
    how long the client has been trying to complete a DHCP message
    exchange.  The elapsed time is measured from the time at which the
    client sent the first message in the message exchange, and the
    elapsed-time field is set to 0 in the first message in the message
    exchange.

    https://tools.ietf.org/html/rfc3315#section-22.9
Test Name Synopsis
Verify client handles Server Unicast Option dhcpv6_130 Verify client handles Server Unicast Option


    step 1.  Configure DHCPv6 server to use Server Unicast Option (12)
    step 2.  Wait for DHCPv6 client's current non-temporary address binding
             to expire
    step 3.  Do not respond to Renew or Rebind messages from client
    step 4.  Verify client sends Solicit message
    step 5.  Respond to first Solicit message with Advertise containing
             Server Unicast Option (12)
    step 6.  Verify client sends valid Renew message
    step 7.  Verify Renew message in Step 6 is sent to the address in
             the Server Unicast Option (12)
    step 8.  Disable Server Unicast option (12) created in Step 1
    step 9.  If client fails Step 6, cleanup and wait for client to
             retransmit Solicit message
    step 10. Send valid Advertise message and wait for transaction to
             finish


    References:

    IETF RFC 3315 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)" Section 22.12: Server Unicast Option

    https://tools.ietf.org/html/rfc3315#section-22.12
Test Name Synopsis
Verify client handles SOL_MAX_RT Option dhcpv6_140 Verify client handles SOL_MAX_RT Option


    step 1.  Configure DHCPv6 server to use Max Solicit Timeout Option (82)
    step 2.  Wait for DHCPv6 client's current non-temporary address binding
             to expire
    step 3.  Do not respond to Renew, Rebind or Solicit messages from
             client
    step 4.  Verify client sends Solicit message
    step 5.  Verify client uses the value of the Max
             Solicit Timeout option returned by the DHCPv6 server to
             limit the maximum delay for retransmissions of its
             Solicit message


    References:

    IETF RFC 3315 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)" Section 14: Reliability of Client Initiated Message Exchanges

    https://tools.ietf.org/html/rfc3315#section-14

    IETF RFC 3315 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)" Section 17.1.2: Transmission of Solicit Message

    https://tools.ietf.org/html/rfc3315#section-17.1.2

    IETF RFC 7083 "DHCPv6 SOL_MAX_RT Option" Section 6: Updates for SOL_MAX_RT and INF_MAX_RT Options to RFC 3315

    https://tools.ietf.org/html/rfc7083#section-6
Test Name Synopsis
Verify DHCPv6 client includes vendor defined options dhcpv6_150 Verify DHCPv6 client includes vendor defined options


    step 1. Wait for DHCPv6 client to renew address
    step 2. Search DHCPv6 Renew message from client for expected options

    The testvars wanDhcpv6ClientOptionCode and wanDhcpv6ClientOptionData can be
    used to configure a list of DHCP options that the client should include in
    requests sent to the DHCP server.


    References:

    IETF RFC 3315 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)"

    https://tools.ietf.org/html/rfc3315
Test Name Synopsis
Verify client supports DHCPv6 Rapid Commit option dhcpv6_160 Verify client supports DHCPv6 Rapid Commit option


    step 1. Wait for DHCPv6 client's current non-temporary address binding
            to expire
    step 2. Do not respond to Renew or Rebind messages from client
    step 3. Verify client sends Solicit message
    step 4. Verify Solicit contains the 'Rapid Commit' option
    step 5. Send valid Reply message and wait for transaction to
            finish


    References:

    IETF RFC 3315 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)" Section 22.14: Rapid Commit Option

    A client MAY include this option in a Solicit message if the client
    is prepared to perform the Solicit-Reply message exchange described
    in section 17.1.1.

    A server MUST include this option in a Reply message sent in response
    to a Solicit message when completing the Solicit-Reply message
    exchange.

    https://tools.ietf.org/html/rfc3315#section-22.14

dhcpv6-pd.tcl

DHCPv6 prefix delegation tests for WAN to LAN IPv6 configuration

Test Name Synopsis
Verify client requests the assignment of an IPv6 prefix dhcpv6_pd_1 Verify client requests the assignment of an IPv6 prefix


    step 1. Check existing DHCPv6 bindings on the WAN side of the CPE
    step 2. Verify whether or not prefix binding exists
    step 3. Verify Valid and Preferred lifetimes for binding
    step 4. Verify that the binding has not expired


    References:

    IETF RFC 3633 "IPv6 Prefix Options for Dynamic Host Configuration Protocol (DHCP) version 6" Section 12.1: Requesting router behavior

    The requesting router uses a Request message to populate IA_PDs with
    prefixes.  The requesting router includes one or more IA_PD options
    in the Request message.  The delegating router then returns the
    prefixes for the IA_PDs to the requesting router in IA_PD options in
    a Reply message.

    https://tools.ietf.org/html/rfc3633#section-12.1
Test Name Synopsis
Verify client renews prefix when current binding expires dhcpv6_pd_2 Verify client renews prefix when current binding expires


    step 1. Wait for DHCPv6 client's current prefix binding
            T1 timer to expire
    step 2. Verify DHCPv6 client sends DHCPv6 Renew
    step 3. Verify Renew contains Server Identifier option (2) with correct
            server DUID
    step 4. Verify Renew contains IA_NA option (3) for same address
            prefix
    step 5. Send valid Reply to update binding


    References:

    IETF RFC 3633 "IPv6 Prefix Options for Dynamic Host Configuration Protocol (DHCP) version 6" Section 7: Overview of DHCP with Prefix Delegation

    Before the valid lifetime on each delegated prefix expires, the
    requesting router includes the prefix in an IA_PD option sent in a
    Renew message to the delegating router.  The delegating router
    responds by returning the prefix with updated lifetimes to the
    requesting router.

    https://tools.ietf.org/html/rfc3633#section-7
Test Name Synopsis
Verify client sends router advertisements on LAN with delegated prefix dhcpv6_pd_10 Verify client sends router advertisements on LAN with delegated prefix


    step 1. Listen for IPv6 router advertisements from DUT on LAN
    step 2. Verify that router advertisement contains Prefix Information
            option (3) with valid prefix based on prefix assigned
            by DHCPv6 server on WAN


    References:

    IETF RFC 3633 "IPv6 Prefix Options for Dynamic Host Configuration Protocol (DHCP) version 6" Section 12.1: Requesting router behavior

    Upon the receipt of a valid Reply message, for each IA_PD the
    requesting router assigns a subnet from each of the delegated
    prefixes to each of the links to which the associated interfaces are
    attached, with the following exception: the requesting router MUST
    NOT assign any delegated prefixes or subnets from the delegated
    prefix(es) to the link through which it received the DHCP message
    from the delegating router.

    https://tools.ietf.org/html/rfc3633#section-12.1

    IETF RFC 7084 "IPv6 CE Router Requirements" Section 4.3: LAN-Side Configuration

    L-2:  The IPv6 CE router MUST assign a separate /64 from its
          delegated prefix(es) (and ULA prefix if configured to provide
          ULA addressing) for each of its LAN interfaces.

    https://tools.ietf.org/html/rfc7084#section-4.3
Test Name Synopsis
Verify client sends router advertisements on LAN with prefix lifetimes based on IA_PD lifetimes dhcpv6_pd_11 Verify client sends router advertisements on LAN with prefix lifetimes based on IA_PD lifetimes


    step 1. Listen for IPv6 router advertisements from DUT on LAN
    step 2. Verify that router advertisement contains Prefix Information
            option (3) with valid prefix based on prefix assigned
            by DHCPv6 server on WAN
    step 3. Verify Prefix Information option (3) contains a Valid lifetime
            not greater than the valid lifetime provided by the DHCPv6
            server in the IA_PD Prefix option
    step 4. Verify Prefix Information option (3) contains a Preferred
            lifetime not greater than the preferred lifetime provided by
            the DHCPv6 server in the IA_PD Prefix option


    References:

    IETF RFC 3633 "IPv6 Prefix Options for Dynamic Host Configuration Protocol (DHCP) version 6" Section 12.1: Requesting router behavior

    If the requesting router assigns a delegated prefix to a link to
    which the router is attached, and begins to send router
    advertisements for the prefix on the link, the requesting router MUST
    set the valid lifetime in those advertisements to be no later than
    the valid lifetime specified in the IA_PD Prefix option.  A
    requesting router MAY use the preferred lifetime specified in the
    IA_PD Prefix option.

    https://tools.ietf.org/html/rfc3633#section-12.1
Test Name Synopsis
Verify LAN side DHCPv6 client address is based on WAN side delegated prefix dhcpv6_pd_12 Verify LAN side DHCPv6 client address is based on WAN side delegated prefix


    step 1. Check existing DHCPv6 bindings on the LAN side of the CPE
    step 2. Verify whether or not a non-temporary address binding exists
    step 3. Verify that the non-temporary address prefix on the LAN
            matches the prefix delegated on the WAN

    NOTE: This test only applies to configurations where LAN clients
    obtain IPv6 addresses via DHCPv6
Test Name Synopsis
Verify LAN side DHCPv6 client lifetime is based on WAN side IA_PD prefix lifetimes dhcpv6_pd_13 Verify LAN side DHCPv6 client lifetime is based on WAN side IA_PD prefix lifetimes


    step 1. Listen for IPv6 router advertisements from DUT on LAN
    step 2. Verify that router advertisement contains Prefix Information
            option (3) with valid prefix based on prefix assigned
            by DHCPv6 server on WAN
    step 3. Verify Prefix Information option (3) contains a Valid lifetime
            not greater than the valid lifetime provided by the DHCPv6
            server in the IA_PD Prefix option
    step 4. Verify Prefix Information option (3) contains a Preferred
            lifetime not greater than the preferred lifetime provided by
            the DHCPv6 server in the IA_PD Prefix option
Test Name Synopsis
Verify client router advertisements on LAN include expected subnet ID dhcpv6_pd_14 Verify client router advertisements on LAN include expected subnet ID


    step 1. Listen for IPv6 RA from DUT
    step 2. Verify RA contains prefix based on public IPv4 WAN
    step 3. Verify advertised prefix includes the expected subnet ID

    Note: The expected subnet ID bits can be configured using the testvar
    ipv6LanSubnetId. The ipv6LanSubnetId testvar is a variable length string
    of hex characters. Examples:

    testvar ipv6LanSubnetId ffff
    testvar ipv6LanSubnetId 1
Test Name Synopsis
Verify DUT does not advertise itself as a default router when WAN link is down dhcpv6_pd_15 Verify DUT does not advertise itself as a default router when WAN link is down


    step 1. Bring down WAN link. For PPPoE WAN modes actively terminate the WAN
            link with a PPP LCP Terminate message. For DHCPv6 WAN modes or WAN
            modes where DHCPv6 prefix delegation is enabled, disable the DHCPv6
            server and wait for the current IA_NA and/or IA_PD bindings to
            expire
    step 2. Listen for RAs from the DUT on the LAN for up to the [WAN RA
            lifetime + 1 LAN RA interval] or the [LAN RA interval + 1 LAN RA
            interval] (whichever is greater)
    step 3. Verify that the DUT eventually stops advertising itself as a default
            router by setting the Router Lifetime in LAN RAs to a value of 0
    step 4. Restore all services on the WAN and wait for the WAN link to be
            re-established by the DUT
    step 5. Verify that the DUT starts advertising itself as a default router by
            setting the Router Lifetime in LAN RAs to a value greater than 0
    step 7. Wait for the duration of the dhcpv6PDLatency testvar and perform a
            connectivity check to ensure that the WAN link is operational


    References:

    IETF RFC 7084 "IPv6 CE Router Requirements" Section 4.1: General Requirements

    G-4:  By default, an IPv6 CE router that has no default
          router(s) on its WAN interface MUST NOT advertise
          itself as an IPv6 default router on its LAN interfaces.
          That is, the "Router Lifetime" is set to zero in all
          Router Advertisement messages it originates [RFC4861].

    https://tools.ietf.org/html/rfc7084#section-4.1

    IETF RFC 7084 "IPv6 CE Router Requirements" Section 4.1: General Requirements

    G-5:  By default, if the IPv6 CE router is an advertising router and
          loses its IPv6 default router(s) and/or detects loss of
          connectivity on the WAN interface, it MUST explicitly
          invalidate itself as an IPv6 default router on each of its
          advertising interfaces by immediately transmitting one or more
          Router Advertisement messages with the "Router Lifetime" field
          set to zero [RFC4861].

    https://tools.ietf.org/html/rfc7084#section-4.1
Test Name Synopsis
Verify client restarts when NoBinding failure occurs during IA_PD Renew dhcpv6_pd_20 Verify client restarts when NoBinding failure occurs during IA_PD Renew


    step 1. Wait for DHCPv6 client's current prefix binding
            T1 timer to expire
    step 2. Verify DHCPv6 client sends DHCPv6 Renew
    step 3. Verify Renew contains IA_PD option (26) for same address
            prefix
    step 4. Send valid DHCPv6 Reply with NoBinding status code (3)
    step 5. Verify DHCPv6 client sends Request message
    step 6. Verify Request contains IA_PD option (26) for same address
            prefix


    References:

    IETF RFC 3633 "IPv6 Prefix Options for Dynamic Host Configuration Protocol (DHCP) version 6" Section 12.1: Requesting router behavior

    https://tools.ietf.org/html/rfc3633#section-12.1
Test Name Synopsis
Verify client restarts when UnspecFail failure occurs during IA_PD Renew dhcpv6_pd_21 Verify client restarts when UnspecFail failure occurs during IA_PD Renew


    step 1. Wait for DHCPv6 client's current prefix binding
            T1 timer to expire
    step 2. Verify DHCPv6 client sends DHCPv6 Renew
    step 3. Verify Renew contains IA_PD option (26) for same address
            prefix
    step 4. Send valid DHCPv6 Reply with UnspecFail status code (1)
    step 5. Verify DHCPv6 client recovers by retransmitting Renew or
            sending Request
    step 6. Verify Renew or Request contains IA_PD option (26) for same
            prefix


    References:

    IETF RFC 3633 "IPv6 Prefix Options for Dynamic Host Configuration Protocol (DHCP) version 6" Section 12.1: Requesting router behavior

    https://tools.ietf.org/html/rfc3633#section-12.1
Test Name Synopsis
Verify client restarts DHCPv6 when Reply to Request contains IA lifetimes set to 0 dhcpv6_pd_22 Verify client restarts DHCPv6 when Reply to Request contains IA lifetimes set to 0


    step 1. Allow the DHCPv6 client to restart DHCPv6 by waiting for the IA_PD
            lifetime to expire without replying to any DHCPv6 messages
    step 2. Send a valid Advertise message in response to the DHCPv6 client's
            Solicit message
    step 3. Verify the DHCPv6 client sends a Request message
    step 4. Send a valid Reply message with all IA lifetimes set to 0
    step 5. Verify the DHCPv6 client sends a DHCPv6 Solicit message
    step 6. Verify the DHCPv6 client and server complete the DHCPv6 2 or 4 message
            exchange
    step 7. Verify the DHCPv6 client recovered by waiting for the client to transmit
            a Renew at T1


    References:

    IETF RFC 8415 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)" Section 18.2.10.1: Reply for Solicit (with Rapid Commit), Request, Renew, or Rebind

    If the Reply message contains any IAs but the client finds no usable
    addresses and/or delegated prefixes in any of these IAs, the client
    may either try another server (perhaps restarting the DHCP server
    discovery process) or use the Information-request message to obtain
    other configuration information only.

    https://tools.ietf.org/html/rfc8415#section-18.2.10.1
Test Name Synopsis
Verify client restarts DHCPv6 when Reply to Renew contains IA lifetimes set to 0 dhcpv6_pd_23 Verify client restarts DHCPv6 when Reply to Renew contains IA lifetimes set to 0


    step 1. Wait for DHCPv6 client's current IA_PD binding T1 timer to expire
    step 2. Verify DHCPv6 client sends DHCPv6 Renew
    step 3. Send a valid Reply message with all IA lifetimes set to 0
    step 4. Verify the DHCPv6 client sends a DHCPv6 Solicit message
    step 5. Verify the DHCPv6 client and server complete the DHCPv6 2 or 4 message
            exchange
    step 6. Verify the DHCPv6 client recovered by waiting for the client to transmit
            a Renew at T1


    References:

    IETF RFC 8415 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)" Section 18.2.10.1: Reply for Solicit (with Rapid Commit), Request, Renew, or Rebind

    If the Reply message contains any IAs but the client finds no usable
    addresses and/or delegated prefixes in any of these IAs, the client
    may either try another server (perhaps restarting the DHCP server
    discovery process) or use the Information-request message to obtain
    other configuration information only.

    https://tools.ietf.org/html/rfc8415#section-18.2.10.1
Test Name Synopsis
Verify client restarts DHCPv6 when Reply to Rebind contains IA lifetimes set to 0 dhcpv6_pd_24 Verify client restarts DHCPv6 when Reply to Rebind contains IA lifetimes set to 0


    step 1. Wait for DHCPv6 client's current IA_PD binding T2 timer to expire
    step 2. Verify DHCPv6 client sends DHCPv6 Rebind
    step 3. Send a valid Reply message with all IA lifetimes set to 0
    step 4. Verify the DHCPv6 client sends a DHCPv6 Solicit message
    step 5. Verify the DHCPv6 client and server complete the DHCPv6 2 or 4 message
            exchange
    step 6. Verify the DHCPv6 client recovered by waiting for the client to transmit
            a Renew at T1


    References:

    IETF RFC 8415 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)" Section 18.2.10.1: Reply for Solicit (with Rapid Commit), Request, Renew, or Rebind

    If the Reply message contains any IAs but the client finds no usable
    addresses and/or delegated prefixes in any of these IAs, the client
    may either try another server (perhaps restarting the DHCP server
    discovery process) or use the Information-request message to obtain
    other configuration information only.

    https://tools.ietf.org/html/rfc8415#section-18.2.10.1
Test Name Synopsis
Verify client sends Rebind message if Renew for prefix fails dhcpv6_pd_30 Verify client sends Rebind message if Renew for prefix fails


    step 1. Wait for DHCPv6 client's current prefix binding
            T1 to expire
    step 2. Verify DHCPv6 client sends DHCPv6 Renew
    step 3. Do not respond to Renew message
    step 4. Verify DHCPv6 client sends Rebind message
    step 5. Verify Rebind contains IA_PD option (26) for same address
            prefix
    step 6. Send valid Reply to update binding


    References:

    IETF RFC 3315 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)" Section 18.1.4: Creation and Transmission of Rebind Messages

    At time T2 for an IA (which will only be reached if the server to
    which the Renew message was sent at time T1 has not responded), the
    client initiates a Rebind/Reply message exchange with any available
    server.  The client includes an IA option with all addresses
    currently assigned to the IA in its Rebind message.

    https://tools.ietf.org/html/rfc3315#section-18.1.4
Test Name Synopsis
Verify client sends Solicit message if Renew and Rebind for prefix fails dhcpv6_pd_31 Verify client sends Solicit message if Renew and Rebind for prefix fails


    step 1. Wait for DHCPv6 client's current prefix binding
            to expire
    step 2. Do not respond to Renew or Rebind messages from client
    step 3. Verify client sends Solicit message
    step 4. Verify Solicit contains IA_PD option (26)
    step 5. Send valid Advertise message and wait for transaction to
            finish


    References:

    IETF RFC 3315 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)" Section 18.1.4: Creation and Transmission of Rebind Messages

    The message exchange is terminated when the valid lifetimes of all
    the addresses assigned to the IA expire (see section 10), at which
    time the client has several alternative actions to choose from; for
    example:

    -  The client may choose to use a Solicit message to locate a new
       DHCP server and send a Request for the expired IA to the new
       server.

    -  The client may have other addresses in other IAs, so the client
       may choose to discard the expired IA and use the addresses in the
       other IAs.

    https://tools.ietf.org/html/rfc3315#section-18.1.4
Test Name Synopsis
Verify DHCPv6 Solicit retransmission times for IA_PD prefix bindings dhcpv6_pd_52 Verify DHCPv6 Solicit retransmission times for IA_PD prefix bindings


    step 1. Wait for DHCPv6 client's current prefix binding to
            expire
    step 2. Do not respond to Solicit messages from client
    step 3. Verify that the client retransmits the Solicit message following the
            retransmission algorithm

    Note: This test takes over 2 hours to run.


    References:

    IETF RFC 8415 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)" Section 15: Reliability of Client Initiated Message Exchanges

    DHCP clients are responsible for reliable delivery of messages in the
    client-initiated message exchanges described in Section 18.  If a
    DHCP client fails to receive an expected response from a server, the
    client must retransmit its message according to the retransmission
    strategy described in this section.

    https://tools.ietf.org/html/rfc8415#section-15
Test Name Synopsis
Verify DHCPv6 Request retransmission times for IA_PD prefix bindings dhcpv6_pd_53 Verify DHCPv6 Request retransmission times for IA_PD prefix bindings

    step 1. Wait for DHCPv6 client's current prefix binding to
            expire
    step 2. Do not respond to Request messages from client
    step 3. Verify that the client retransmits the Request message following the
            retransmission algorithm
    step 4. Verify that the client does not retransmit Request messages after
            MRC (Maximum Retransmission Count) has been reached.


    References:

    IETF RFC 8415 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)" Section 15: Reliability of Client Initiated Message Exchanges

    DHCP clients are responsible for reliable delivery of messages in the
    client-initiated message exchanges described in Section 18.  If a
    DHCP client fails to receive an expected response from a server, the
    client must retransmit its message according to the retransmission
    strategy described in this section.

    https://tools.ietf.org/html/rfc8415#section-15
Test Name Synopsis
Verify DHCPv6 Renew retransmission times for IA_PD prefix bindings dhcpv6_pd_54 Verify DHCPv6 Renew retransmission times for IA_PD prefix bindings


     step 1. Wait for DHCPv6 client to renew its current prefix binding
     step 2. Reply to the DHCPv6 Renew message with updated IA_PD lifetimes. If
             IA_NA is enabled, the lifetimes match the IA_PD lifetimes
     step 3. Do not respond to subsequent Renew messages from client
     step 4. Verify that the client retransmits the DHCPv6 Renew message
             following the retransmission algorithm
     step 5. Verify that the client does not retransmit Renew messages after
             Max Retransmission Duration (MRD) has been reached

     Note: This test takes over 1 hour to run.

 
    References:

    IETF RFC 8415 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)" Section 15: Reliability of Client Initiated Message Exchanges

    DHCP clients are responsible for reliable delivery of messages in the
    client-initiated message exchanges described in Section 18.  If a
    DHCP client fails to receive an expected response from a server, the
    client must retransmit its message according to the retransmission
    strategy described in this section.

    https://tools.ietf.org/html/rfc8415#section-15
Test Name Synopsis
Verify DHCPv6 Rebind retransmission times for IA_PD prefix bindings dhcpv6_pd_55 Verify DHCPv6 Rebind retransmission times for IA_PD prefix bindings


     step 1. Wait for DHCPv6 client to renew its current prefix binding
     step 2. Reply to the DHCPv6 Renew message with updated IA_PD lifetimes. If
             IA_NA is enabled, the lifetimes match the IA_PD lifetimes
     step 3. Do not respond to subsequent Renew or Rebind messages from client
     step 4. Verify that the client retransmits Rebind messages following the
             retransmission algorithm
     step 5. Verify that the client does not retransmit Rebind messages after
             Max Retransmission Duration (MRD) has been reached

     Note: This test takes over 2 hours to run.

 
    References:

    IETF RFC 8415 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)" Section 15: Reliability of Client Initiated Message Exchanges

    DHCP clients are responsible for reliable delivery of messages in the
    client-initiated message exchanges described in Section 18.  If a
    DHCP client fails to receive an expected response from a server, the
    client must retransmit its message according to the retransmission
    strategy described in this section.

    https://tools.ietf.org/html/rfc8415#section-15
Test Name Synopsis
Verify client learns new IPv6 prefix when WAN DHCPv6 server renumbers dhcpv6_pd_60 Verify client learns new IPv6 prefix when WAN DHCPv6 server renumbers


    step 1. Change the client's DHCPv6 binding to use the new IPv6
            prefix specified by the testvar "dhcpv6WanAssignNextPrefix"
    step 2. Verify DHCPv6 client sends DHCPv6 Renew or Request
    step 3. Verify Renew or Request contains IA_PD option (26) for
            same prefix
    step 4. Send valid DHCPv6 Reply with new prefix
    step 5. Verify client updates router advertisements on LAN with new
            prefix information
    step 6. Send pings from LAN client to an IPv6 remote host on the
            WAN to verify connectivity with new prefix
    step 7. Restore client's original prefix by repeating Steps 1
            through 5 using original IPv6 prefix
    step 8. Send pings from LAN client to an IPv6 remote host on the
            WAN to verify connectivity with original prefix


    References:

    IETF RFC 3633 "IPv6 Prefix Options for Dynamic Host Configuration Protocol (DHCP) version 6" Section 12.1: Requesting router behavior

    Upon the receipt of a valid Reply message, for each IA_PD the
    requesting router assigns a subnet from each of the delegated
    prefixes to each of the links to which the associated interfaces are
    attached, with the following exception: the requesting router MUST
    NOT assign any delegated prefixes or subnets from the delegated
    prefix(es) to the link through which it received the DHCP message
    from the delegating router.

    https://tools.ietf.org/html/rfc3633#section-12.1
Test Name Synopsis
Verify LAN side DHCPv6 server switches to new IPv6 prefix when WAN DHCPv6 server renumbers dhcpv6_pd_61 Verify LAN side DHCPv6 server switches to new IPv6 prefix when WAN DHCPv6 server renumbers


    step 1. Change the client's DHCPv6 binding to use the new IPv6
            prefix specified by the testvar "dhcpv6WanAssignNextPrefix"
    step 2. Verify DHCPv6 client sends DHCPv6 Renew or Request
    step 3. Verify Renew or Request contains IA_PD option (26) for
            same prefix
    step 4. Send valid DHCPv6 Reply with new prefix
    step 5. Verify DHCPv6 client updates router advertisements on LAN with new
            prefix information
    step 6. Verify DHCPv6 client updates DHCPv6 server on the LAN with new
            prefix
    step 7. Send pings from LAN DHCPv6 client to an IPv6 remote host
            on the WAN to verify connectivity with new prefix
    step 8. Restore client's original prefix by repeating Steps 1
            through 6 using original IPv6 prefix
    step 9. Send pings from LAN DHCPv6 client to an IPv6 remote host
            on the WAN to verify connectivity with original prefix

    NOTE: This test only applies to configurations where LAN clients
    obtain IPv6 addresses via DHCPv6


    References:

    IETF RFC 3633 "IPv6 Prefix Options for Dynamic Host Configuration Protocol (DHCP) version 6" Section 12.1: Requesting router behavior

    Upon the receipt of a valid Reply message, for each IA_PD the
    requesting router assigns a subnet from each of the delegated
    prefixes to each of the links to which the associated interfaces are
    attached, with the following exception: the requesting router MUST
    NOT assign any delegated prefixes or subnets from the delegated
    prefix(es) to the link through which it received the DHCP message
    from the delegating router.

    https://tools.ietf.org/html/rfc3633#section-12.1
Test Name Synopsis
Verify DUT ages out prefix on LAN when WAN DHCPv6 server renumbers dhcpv6_pd_62 Verify DUT ages out prefix on LAN when WAN DHCPv6 server renumbers


    step 1. Change the DUT's WAN DHCPv6 client binding to use the new
            IPv6 prefix specified by the testvar "dhcpv6WanAssignNextPrefix"
    step 2. Listen for router advertisements on the LAN for
            "dhcpv6IAValidLifetime" seconds and verify the following:

            a. That the original prefix is consistently aged out according to
               requirement L-13 of RFC 7084

            b. That the valid lifetime of the aged out prefix decreases over
               time (if not equal to 0)

            c. That the new prefix is consistently advertised

    step 3. Restart the LAN IPv6 client and verify that it obtains an
            address within the new prefix
    step 4. Send pings from the LAN client to an IPv6 remote host
            on the WAN to verify connectivity with the new address
    step 5. Repeat steps 1 through 4 with the original address and prefix
            specified by the testvars "dhcpv6WanAssignIp" and
            "dhcpv6WanAssignPrefix"


    References:

    IETF RFC 7084 "IPv6 CE Router Requirements" Section 4.3: LAN-Side Requirements

    L-13:  If the delegated prefix changes, i.e., the current prefix is
           replaced with a new prefix without any overlapping time
           period, then the IPv6 CE router MUST immediately advertise the
           old prefix with a Preferred Lifetime of zero and a Valid
           Lifetime of either a) zero or b) the lower of the current
           Valid Lifetime and two hours (which must be decremented in
           real time) in a Router Advertisement message as described in
           Section 5.5.3, (e) of [RFC4862].

    https://tools.ietf.org/html/rfc7084#section-4.3
Test Name Synopsis
Verify DUT performs Duplicate Address Detection on global LAN address dhcpv6_pd_63 Verify DUT performs Duplicate Address Detection on global LAN address


    step 1. Change the DUT's WAN DHCPv6 client binding to use the new
            IPv6 prefix specified by the testvar
            dhcpv6WanAssignNextPrefix
    step 2. Verify DHCPv6 client sends DHCPv6 Renew or Request
    step 3. Wait up to dhcpv6PDLatency + 10 seconds for a DAD-style
            Neighbor Solicitation from the DUT on the LAN
    step 4. Verify the following about the received Neighbor
            Soliciation

            a. That the target address of the Neighbor Solicitation is
               the DUT's global IPv6 LAN address in the
               dhcpv6WanAssignNextPrefix prefix

            b. That the IPv6 source address is the unspecified address

            c. That the IPv6 destination address is the solicited-node
               multicast address of the DUT's global IPv6 LAN address
               in the dhcpv6WanAssignNextPrefix prefix

    step 5. Respond to the DUT's DAD-style Neighbor Solicitation by
            sending an unsolicited Neighbor Advertisement to the
            all-nodes multicast address ff02::1 on the LAN-WAN
    step 6. Wait for 2 seconds
    step 7. Send an ICMPv6 Echo Request message to the DUT's global
            IPv6 LAN address in the dhcpv6WanAssignNextPrefix prefix
    step 8. Verify that the DUT does not send an ICMPv6 Echo Response
            message
    step 9. Change the DUT's WAN DHCPv6 client binding to use the old
            IPv6 prefix specified by the testvar dhcpv6WanAssignPrefix
    step 10. Verify DHCPv6 client sends DHCPv6 Renew or Request
    step 11. Send pings from the LAN client to to the DUT's global IPv6
             LAN address in the dhcpv6WanAssignPrefix prefix to
             verify connectivity with the new address


    References:

    IETF RFC 4862 "IPv6 Stateless Address Autoconfiguration" Section 5.4: Duplicate Address Detection

    https://tools.ietf.org/html/rfc4862#section-5.4
Test Name Synopsis
Verify client attempts to learn non-temporary address and prefix in a single DHCPv6 session dhcpv6_pd_100 Verify client attempts to learn non-temporary address and prefix in a single DHCPv6 session


    step 1. Wait for DHCPv6 client's current prefix binding to expire
    step 2. Do not respond to Renew or Rebind messages from client
    step 3. Verify client sends Solicit message
    step 4. Verify Solicit contains both IA_NA option (3) and
            IA_PD option (26)
    step 5. Send valid Advertise message and wait for transaction to
            finish

    NOTE: IETF RFC 7084, which updates IETF RFC 6204, removed the
          above requirement.


    References:

    IETF RFC 6204 "Basic Requirements for IPv6 Customer Edge Routers" Section 4.2: WAN-Side Configuration

    W-5:  DHCPv6 address assignment (IA_NA) and DHCPv6 prefix delegation
          (IA_PD) SHOULD be done as a single DHCPv6 session.

    https://tools.ietf.org/html/rfc6204#section-4.2
Test Name Synopsis
Verify packets to unreachable subnets in the delegated prefix are dropped dhcpv6_pd_110 Verify packets to unreachable subnets in the delegated prefix are dropped


    step 1. Build a destination IPv6 address by setting all subnet bits
    step 2. This test assumes that this address is not configured on an
            interface
    step 3. Send a UDP echo to this destination from the LAN client
    step 4. Verify the packet is not forwarded to the WAN

    Reference: IETF RFC 7084 - Basic Requirements for IPv6 Customer Edge Routers, Requirement WPD-5:



    NOTE: This test is only applicable if the delegated prefix length
    is less than 64.


    References:

    IETF RFC 7084 "IPv6 CE Router Requirements" Section 4.2: WAN-Side Configuration

    WPD-5:  Any packet received by the CE router with a destination
            address in the prefix(es) delegated to the CE router but not
            in the set of prefixes assigned by the CE router to the LAN
            must be dropped.  In other words, the next hop for the
            prefix(es) delegated to the CE router should be the null
            destination.  This is necessary to prevent forwarding loops
            when some addresses covered by the aggregate are not
            reachable [RFC4632].

            (a) The IPv6 CE router SHOULD send an ICMPv6 Destination
                Unreachable message in accordance with Section 3.1 of
                [RFC4443] back to the source of the packet, if the
                packet is to be dropped due to this rule.

    https://tools.ietf.org/html/rfc7084#section-4.2
Test Name Synopsis
Verify LAN side DHCPv6 client address includes SLA ID dhcpv6_pd_120 Verify LAN side DHCPv6 client address includes SLA ID


    step 1. Check existing DHCPv6 bindings on the LAN side of the CPE
    step 2. Verify whether or not a non-temporary address binding exists
    step 3. Verify that the non-temporary address on the LAN includes
            the expected SLA ID

    RFC 3056 defines a 16 bit "SLA ID" field for subnetting. Most
    DUT's allow the SLA ID to be arbitrarily configured. This test
    verifies that the DUT uses the expected SLA ID. The expected SLA
    can be configured using the testvar "ipv6LanSubnetId" which must
    be a hex string with four or less characters. Examples:

    testvar ipv6LanSubnetId ffff
    testvar ipv6LanSubnetId 1


    References:

    IETF RFC 3056 "Connection of IPv6 Domains via IPv4 Clouds" Section 2: IPv6 Prefix Allocation

    https://tools.ietf.org/html/rfc3056#section-2
Test Name Synopsis
Verify Route Information option is advertised for delegated prefix dhcpv6_pd_130 Verify Route Information option is advertised for delegated prefix


    step 1. Listen for Router Advertisements on the LAN for up to one Router
            Advertisement interval
    step 2. Verify that the DUT includes a Route Information option for the
            delegated prefix configured using the testvar
            dhcpv6WanAssignPrefix


    References:

    IETF RFC 7084 "IPv6 CE Router Requirements" Section 4.3: LAN-Side Configuration

    L-3:  An IPv6 CE router MUST advertise itself as a router for the
          delegated prefix(es) (and ULA prefix if configured to provide
          ULA addressing) using the "Route Information Option" specified
          in Section 2.3 of [RFC4191].  This advertisement is
          independent of having or not having IPv6 connectivity on the
          WAN interface.

    https://tools.ietf.org/html/rfc7084#section-4.3

dhcpv6-s.tcl

DHCPv6 server tests for the LAN side of the router

Test Name Synopsis
Verify server assigns same address after client restart dhcpv6_server_1 Verify server assigns same address after client restart


    step 1. Restart DHCPv6 on LAN client without sending a Release to the server
    step 2. Verify that the server assigns an address to the client
    step 3. Verify that the address assigned by the server is the same as the
            client's original address


    References:

    IETF RFC 3315 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)" Section 18.2.1: Receipt of Request Messages

    https://tools.ietf.org/html/rfc3315#section-18.2.1
Test Name Synopsis
Verify server returns address within configured pool dhcpv6_server_2 Verify server returns address within configured pool


    step 1. Send DHCPv6 Release to release DHCPv6 client address on LAN
    step 2. Restart DHCPv6 client on LAN
    step 3. Verify DHCPv6 client receives an address from within the configured
            DHCPv6 pool

    Note: The DHCPv6 pool is configured using the testvars ipv6DhcpClientStart
    and ipv6DhcpClientEnd. These testvars must match the DHCPv6 pool settings on
    the DUT.


    References:

    IETF RFC 3315 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)"

    https://tools.ietf.org/html/rfc3315
Test Name Synopsis
Verify server returns IP address with expected valid lifetime dhcpv6_server_3 Verify server returns IP address with expected valid lifetime


    step 1. Send DHCPv6 Release to release DHCPv6 client address on LAN
    step 2. Restart DHCPv6 client on LAN
    step 3. Verify DHCPv6 client receives an address with the expected
            valid lifetime

    Note: The testvar ipv6DhcpClientValidLifetime can be used to configure the
    expected valid lifetime, in seconds, that is used by the DUT's DHCPv6 server
    on the LAN.

    This testvar can be set to a numeric value if the valid lifetime is fixed,
    or it can be set to a value of "dynamic" if the valid lifetime varies based
    on the delegated prefix (IA_PD) received on the WAN. If set to "dynamic"
    this test will verify that the valid lifetime received on the LAN is less
    than or equal to the IA_PD valid lifetime assigned by CDRouter's DHCPv6
    server on the WAN (which is configured using the testvar dhcpv6IAValidLifetime).


    References:

    IETF RFC 3315 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)"

    https://tools.ietf.org/html/rfc3315
Test Name Synopsis
Verify server assigns address to client using undefined client DUID values dhcpv6_server_5 Verify server assigns address to client using undefined client DUID values


    step 1. Release client's current DHCPv6 binding
    step 2. Configure the client to use a client DUID with unknown format
    step 3. Restart DHCPv6 on client
    step 4. Verify the client obtains an address
    step 5. Repeat Steps 1 through 4 for different unknown client DUID formats
    step 6. Release the DHCPv6 binding
    step 7. Verify that the server assigns an address to the client using the
            client's original DUID format


    References:

    IETF RFC 3315 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)" Section 9: DHCP Unique Identifier (DUID)

    https://tools.ietf.org/html/rfc3315#section-9
Test Name Synopsis
Verify server ignores Solicits sent to unicast address dhcpv6_server_8 Verify server ignores Solicits sent to unicast address


    step 1. Release client's current DHCPv6 binding
    step 2. Verify the DHCPv6 server reply contains a status code of 0 'Success'
    step 3. Configure LAN client to send DHCPv6 Solicit messages to server's
            unicast address
    step 4. Restart DHCPv6 on LAN client
    step 5. Verify that server does not provide an IPv6 address to the client.
    step 6. Restart DHCPv6 on LAN client using All_DHCP_Relay_Agents_and_Servers
            multicast address
    step 7. Verify that the server assigns an address to the client

    Unless otherwise specified in this document, or in a document that
    describes how IPv6 is carried over a specific type of link (for link
    types that do not support multicast), a client sends DHCP messages to
    the All_DHCP_Relay_Agents_and_Servers.


    References:

    IETF RFC 3315 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)" Section 13: Transmission of Messages by a Client

    https://tools.ietf.org/html/rfc3315#section-13
Test Name Synopsis
Verify server provides DNS and domain information to clients dhcpv6_server_9 Verify server provides DNS and domain information to clients


    step 1. Release client's current DHCPv6 binding
    step 2. Restart DHCPv6 on client
    step 3. Verify that LAN client receives DHCPv6 DNS Recursive Name Server
            (23) option from server
    step 4. Verify the DNS server addresses provided by the DHCPv6 server. If
            the testvar ipv6DNStoLAN is set to "yes", the DNS server addresses
            provided should match the addresses of the DNS servers configured on
            the WAN. If the ipv6DNStoLAN testvar is set to "no", the LAN side
            IPv6 address of the DUT should be provided as the DNS server.
    step 5. Check if LAN client receives DHCPv6 Domain Search List (24) option
            from server


    References:

    IETF RFC 3315 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)"

    https://tools.ietf.org/html/rfc3315

    IETF RFC 3646 "DNS Configuration options for Dynamic Host Configuration Protocol for IPv6 (DHCPv6)"

    https://tools.ietf.org/html/rfc3646
Test Name Synopsis
Verify server ignores requests with mismatched server DUID dhcpv6_server_10 Verify server ignores requests with mismatched server DUID


Description
    step 1. Modify client to use an unknown server DUID
    step 2. Restart DHCPv6 on client by sending Renew to the server
    step 3. Verify that server does not reply to Renew with unknown server DUID


    References:

    IETF RFC 3315 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)" Section 15.6: Renew Message

    https://tools.ietf.org/html/rfc3315#section-15.6
Test Name Synopsis
Verify server ignores unknown or invalid DHCPv6 packets dhcpv6_server_11 Verify server ignores unknown or invalid DHCPv6 packets


    step 1. Build DHCPv6 packet with msg-type field set to 0
    step 2. Send packet built in Step 1 to server
    step 3. Verify that server ignores invalid DHCPv6 packet generated in Step 2
    step 4. Repeat Steps 1 through 3 using msg-types 1 through 255
    step 5. Verify server is still functioning by running test dhcpv6_server_1


    References:

    IETF RFC 3315 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)"

    https://tools.ietf.org/html/rfc3315
Test Name Synopsis
Verify server assigns address when IA_NA request from client does not contain an IPv6 address dhcpv6_server_12 Verify server assigns address when IA_NA request from client does not contain an IPv6 address


    step 1. Release client's current DHCPv6 binding
    step 2. Configure client to omit address hint in DHCPv6 Request messages
    step 3. Restart DHCPv6 on client
    step 4. Verify client obtains an address
    step 5. Release client's current DHCPv6 binding
    step 6. Configure client to include address hint in DHCPv6 Request message
    step 7. Verify client obtains an address


    References:

    IETF RFC 3315 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)" Section 18.2.1: Receipt of Request Messages

    https://tools.ietf.org/html/rfc3315#section-18.2.1
Test Name Synopsis
Verify server assigns multiple addresses to client using multiple IA_NA identifiers dhcpv6_server_13 Verify server assigns multiple addresses to client using multiple IA_NA identifiers


    step 1. Configure the client to use a new IA_NA IAID
    step 2. Restart DHCPv6 on client without sending a Release to the server
    step 3. Verify that the server assigns a new address to the client
    step 4. Restore client's original IA_NA IAID
    step 5. Restart DHCPv6 on client without sending a Release to the server
    step 6. Verify that the server assigns an address to the client
    step 7. Verify that the address assigned by the server is the same as the
            client's original address


    References:

    IETF RFC 3315 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)" Section 18.2.1: Receipt of Request Messages

    https://tools.ietf.org/html/rfc3315#section-18.2.1
Test Name Synopsis
Verify server handles fragmented IPv6 packets dhcpv6_server_14 Verify server handles fragmented IPv6 packets


    step 1. Configure client to use a large User Class (15) option to force
            IPv6 fragmentation
    step 2. Initiate Renew for client's current IPv6 address
    step 3. Verify that server responds to Renew with valid Reply message


    References:

    IETF RFC 3315 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)" Section 18.2: Server Behavior

    https://tools.ietf.org/html/rfc3315#section-18.2
Test Name Synopsis
Verify server ignores client request with invalid UDP checksum dhcpv6_server_15 Verify server ignores client request with invalid UDP checksum


    step 1. Configure the client to send invalid UDP checksums
    step 2. Restart DHCPv6 on client without sending a Release to the server
    step 3. Verify that the server does not respond to DHCPv6 requests with bad
            UDP checksums
    step 4. Configure the client to send valid UDP checksums
    step 5. Restart DHCPv6 on the client without sending a Release to the server
    step 6. Verify that the server assigns an address to the client
    step 7. Verify that the address assigned by the server is the same as the
            client's original address


    References:

    IETF RFC 3315 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)"

    https://tools.ietf.org/html/rfc3315
Test Name Synopsis
Verify server composes DUID correctly dhcpv6_server_16 Verify server composes DUID correctly


    step 1. Initiate a DHCPv6 Renew for the client's current IPv6 address
    step 2. Verify that the server sends a Reply
    step 3. Inspect the composition of the server DUID in Reply to ensure
            correctness


    References:

    IETF RFC 3315 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)" Section 9: DHCP Unique Identifier (DUID)

    https://tools.ietf.org/html/rfc3315#section-9
Test Name Synopsis
Verify server assigns same IPv6 address after DHCPv6 Request from client dhcpv6_server_20 Verify server assigns same IPv6 address after DHCPv6 Request from client


    step 1. Initiate DHCPv6 Request from the client
    step 2. Verify that the server assigns the same address to the client

    When the server receives a valid Request message, the server creates
    the bindings for that client according to the server's policy and
    configuration information and records the IAs and other information
    requested by the client.


    References:

    IETF RFC 3315 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)" Section 18.2.1: Receipt of Request Messages

    https://tools.ietf.org/html/rfc3315#section-18.2.1
Test Name Synopsis
Verify server sends UseMulticast status code when client sends a unicast Request dhcpv6_server_21 Verify server sends UseMulticast status code when client sends a unicast Request


    step 1. Initiate a DHCPv6 Request from the client using the server's unicast
            address
    step 2. Verify the that the server sends a Reply message with a status code
            of 5 'UseMulticast'

    When the server receives a Request message via unicast from a client
    to which the server has not sent a unicast option, the server
    discards the Request message and responds with a Reply message
    containing a Status Code option with the value UseMulticast, a Server
    Identifier option containing the server's DUID, the Client Identifier
    option from the client message, and no other options.


    References:

    IETF RFC 3315 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)" Section 18.2.1: Receipt of Request Messages

    https://tools.ietf.org/html/rfc3315#section-18.2.1
Test Name Synopsis
Verify server sends NotOnLink status code when client sends Request with invalid link address dhcpv6_server_22 Verify server sends NotOnLink status code when client sends Request with invalid link address


    step 1. Initiate a DHCPv6 Request from the client with an unknown
            IAID containing an unknown address, which is not
            considered "on link"
    step 2. Verify that the server sends a Reply message with a status code of
            4 'NotOnLink'

    If the server finds that the prefix on one or more IP addresses in
    any IA in the message from the client is not appropriate for the link
    to which the client is connected, the server MUST return the IA to
    the client with a Status Code option with the value NotOnLink.


    References:

    IETF RFC 3315 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)" Section 18.2.1: Receipt of Request Messages

    https://tools.ietf.org/html/rfc3315#section-18.2.1
Test Name Synopsis
Verify server assigns same IPv6 address after DHCPv6 Confirm from client dhcpv6_server_30 Verify server assigns same IPv6 address after DHCPv6 Confirm from client


    step 1. Initiate a DHCPv6 Confirm from the client
    step 2. Verify that the server Reply contains a status code of 0 'success'


    References:

    IETF RFC 3315 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)" Section 18.2.2: Receipt of Confirm Messages

    https://tools.ietf.org/html/rfc3315#section-18.2.2
Test Name Synopsis
Verify server sends NotOnLink status code when client sends Confirm with invalid link address dhcpv6_server_31 Verify server sends NotOnLink status code when client sends Confirm with invalid link address


    step 1. Initiate a DHCPv6 Confirm from the client with an unknown
            IAID containing an unknown address, which is not
            considered "on link"
    step 2. Verify that the server sends a Reply message with a status code of
            4 'NotOnLink'

    When the server receives a Confirm message, the server determines
    whether the addresses in the Confirm message are appropriate for the
    link to which the client is attached.  If all of the addresses in the
    Confirm message pass this test, the server returns a status of
    Success.  If any of the addresses do not pass this test, the server
    returns a status of NotOnLink.  If the server is unable to perform
    this test (for example, the server does not have information about
    prefixes on the link to which the client is connected), or there were
    no addresses in any of the IAs sent by the client, the server MUST
    NOT send a reply to the client.


    References:

    IETF RFC 3315 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)" Section 18.2.2: Receipt of Confirm Messages

    https://tools.ietf.org/html/rfc3315#section-18.2.2
Test Name Synopsis
Verify server silently discards client Confirm messages that do not contain any addresses dhcpv6_server_32 Verify server silently discards client Confirm messages that do not contain any addresses


    step 1. Initiate a DHCPv6 Confirm from the client with an unknown IAID
            containing no addresses
    step 2. Verify that the server does not send a Reply message

    When the server receives a Confirm message, the server determines
    whether the addresses in the Confirm message are appropriate for the
    link to which the client is attached.  If all of the addresses in the
    Confirm message pass this test, the server returns a status of
    Success.  If any of the addresses do not pass this test, the server
    returns a status of NotOnLink.  If the server is unable to perform
    this test (for example, the server does not have information about
    prefixes on the link to which the client is connected), or there were
    no addresses in any of the IAs sent by the client, the server MUST
    NOT send a reply to the client.


    References:

    IETF RFC 3315 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)" Section 18.2.2: Receipt of Confirm Messages

    https://tools.ietf.org/html/rfc3315#section-18.2.2
Test Name Synopsis
Verify server assigns same IPv6 address after DHCPv6 Renew from client dhcpv6_server_40 Verify server assigns same IPv6 address after DHCPv6 Renew from client


    step 1. Initiate DHCPv6 Renew for the client's current IPv6 address
    step 2. Verify that the server updates the client's current IPv6 address
            binding


    References:

    IETF RFC 3315 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)" Section 18.2.3: Receipt of Renew Messages

    https://tools.ietf.org/html/rfc3315#section-18.2.3
Test Name Synopsis
Verify server sends UseMulticast status code when client sends unicast Renew dhcpv6_server_41 Verify server sends UseMulticast status code when client sends unicast Renew


    step 1. Initiate DHCPv6 Renew using the server's unicast address
    step 2. Verify the that the server sends a Reply message with a status
            code of 5 'UseMulticast'

    When the server receives a Renew message via unicast from a client to
    which the server has not sent a unicast option, the server discards
    the Renew message and responds with a Reply message containing a
    Status Code option with the value UseMulticast, a Server Identifier
    option containing the server's DUID, the Client Identifier option
    from the client message, and no other options.


    References:

    IETF RFC 3315 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)" Section 18.2.3: Receipt of Renew Messages

    https://tools.ietf.org/html/rfc3315#section-18.2.3
Test Name Synopsis
Verify server sends NoBinding status code when client attempts to renew unknown IAID dhcpv6_server_42 Verify server sends NoBinding status code when client attempts to renew unknown IAID


    step 1. Initiate DHCPv6 Renew with an unknown IAID that should not have a
            binding
    step 2. Verify that the server sends a Reply message with a status code of
            3 'NoBinding'

    If the server cannot find a client entry for the IA the server
    returns the IA containing no addresses with a Status Code option set
    to NoBinding in the Reply message.


    References:

    IETF RFC 3315 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)" Section 18.2.3: Receipt of Renew Messages

    https://tools.ietf.org/html/rfc3315#section-18.2.3
Test Name Synopsis
Verify server sends Reply with lifetimes of 0 when client attempts to renew unknown address dhcpv6_server_43 Verify server sends Reply with lifetimes of 0 when client attempts to renew unknown address


    step 1. Initiate a DHCPv6 Renew from client with a valid IAID containing
            unknown address
    step 2. Verify that the server sends Reply message with correct IAID
    step 3. Verify Reply contains correct IA IPv6 address
    step 4. Verify Reply contains IA Preferred lifetime of 0
    step 5. Verify Reply contains IA Valid lifetime of 0
    step 6. Restart DHPCv6 on client
    step 7. Verify that the server assigns an address to the client

    If the server finds that any of the addresses are not appropriate for
    the link to which the client is attached, the server returns the
    address to the client with lifetimes of 0.


    References:

    IETF RFC 3315 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)" Section 18.2.3: Receipt of Renew Messages

    https://tools.ietf.org/html/rfc3315#section-18.2.3
Test Name Synopsis
Verify server assigns same IPv6 address after DHCPv6 Rebind from client dhcpv6_server_50 Verify server assigns same IPv6 address after DHCPv6 Rebind from client


    step 1. Initiate a DHCPv6 Rebind from the client
    step 2. Verify that the server updates the client's current IPv6 address
            binding


    References:

    IETF RFC 3315 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)" Section 18.2.4: Receipt of Rebind Messages

    https://tools.ietf.org/html/rfc3315#section-18.2.4
Test Name Synopsis
Verify server sends Reply with lifetimes of 0 when client attempts to rebind with unknown address dhcpv6_server_52 Verify server sends Reply with lifetimes of 0 when client attempts to rebind with unknown address


    step 1. Initiate a DHCPv6 Rebind with a valid IAID containing unknown
            address
    step 2. Verify that the server sends a Reply message with correct IAID
    step 3. Verify Reply contains correct IA IPv6 address
    step 4. Verify Reply contains IA Preferred lifetime of 0
    step 5. Verify Reply contains IA Valid lifetime of 0
    step 6. Restart DHPCv6 on client
    step 7. Verify that the server assigns an address to the client

    If the server finds that any of the addresses are not appropriate for
    the link to which the client is attached, the server returns the
    address to the client with lifetimes of 0.


    References:

    IETF RFC 3315 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)" Section 18.2.4: Receipt of Rebind Messages

    https://tools.ietf.org/html/rfc3315#section-18.2.4
Test Name Synopsis
Verify server responds to an Information-request message from client dhcpv6_server_60 Verify server responds to an Information-request message from client


    step 1. Initiate a DHCPv6 Information-request from client
    step 2. Verify response from server


    References:

    IETF RFC 3315 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)" Section 18.2.5: Receipt of Information-request Messages

    https://tools.ietf.org/html/rfc3315#section-18.2.5
Test Name Synopsis
Verify server assigns same IPv6 address after DHCPv6 Release from client dhcpv6_server_70 Verify server assigns same IPv6 address after DHCPv6 Release from client


    step 1. Initiate a DHCPv6 Release from the client
    step 2. Verify that the server sends a Reply message with a status code of
            0 'Success'
    step 3. Restart DHCPv6 on client
    step 4. Verify that the server assigns an address to the client


    References:

    IETF RFC 3315 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)" Section 18.2.6: Receipt of Release Messages

    https://tools.ietf.org/html/rfc3315#section-18.2.6
Test Name Synopsis
Verify server sends UseMulticast status code when clients sends unicast DHCPv6 Release dhcpv6_server_71 Verify server sends UseMulticast status code when clients sends unicast DHCPv6 Release


    step 1. Initiate a DHCPv6 Release from the client using the server's unicast
            address
    step 2. Verify the that the server sends a Reply message with a status code
            of 5 'UseMulticast'
    step 3. Restart DHCPv6 on client
    step 4. Verify that the server assigns an address to the client

    When the server receives a Release message via unicast from a client
    to which the server has not sent a unicast option, the server
    discards the Release message and responds with a Reply message
    containing a Status Code option with value UseMulticast, a Server
    Identifier option containing the server's DUID, the Client Identifier
    option from the client message, and no other options.


    References:

    IETF RFC 3315 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)" Section 18.2.6: Receipt of Release Messages

    https://tools.ietf.org/html/rfc3315#section-18.2.6
Test Name Synopsis
Verify server sends NoBinding status code when client attempts to release unknown IAID dhcpv6_server_72 Verify server sends NoBinding status code when client attempts to release unknown IAID


    step 1. Initiate DHCPv6 Release with an unknown IAID that should not have a
            binding
    step 2. Verify that the server sends a Reply message with a status code of
            3 'NoBinding'

    For each IA in the Release message for which the server has no binding information,
    the serve adds an IA option using the IAID from the Release message, an includes a
    Status Code option with the value NoBinding in the IA option.  No other options are
    included in the IA option.


    References:

    IETF RFC 3315 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)" Section 18.2.6: Receipt of Release Messages

    https://tools.ietf.org/html/rfc3315#section-18.2.6
Test Name Synopsis
Verify server assigns IPv6 address after DHCPv6 Decline from client dhcpv6_server_80 Verify server assigns IPv6 address after DHCPv6 Decline from client


    step 1. Initiate a DHCPv6 Decline for the client's current IPv6 address
    step 2. Verify that the server sends a Reply message with status code of 0
            'Success'
    step 3. Restart DHCPv6 on client with a sending a Release to the server
    step 4. Verify that the server assigns an address to client
    step 5. Verify that the address assigned by the server is not the same as
            the client's original address


    References:

    IETF RFC 3315 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)" Section 18.2.7: Receipt of Decline Messages

    https://tools.ietf.org/html/rfc3315#section-18.2.7
Test Name Synopsis
Verify server sends UseMulticast status code when client sends unicast DHCPv6 Decline dhcpv6_server_81 Verify server sends UseMulticast status code when client sends unicast DHCPv6 Decline


    step 1. Initiate a DHCPv6 Decline from the client using the server's unicast
            address
    step 2. Verify the that the server sends a Reply message with a status code
            of 5 'UseMulticast'
    step 3. Restart DHCPv6 on LAN interface without sending a Release to the
            server
    step 4. Verify that the server assigns an address to the client
    step 5. Verify that the address assigned by the server is the same as the
            client's original address

    When the server receives a Decline message via unicast from a client
    to which the server has not sent a unicast option, the server
    discards the Decline message and responds with a Reply message
    containing a Status Code option with the value UseMulticast, a Server
    Identifier option containing the server's DUID, the Client Identifier
    option from the client message, and no other options.


    References:

    IETF RFC 3315 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)" Section 18.2.7: Receipt of Decline Messages

    https://tools.ietf.org/html/rfc3315#section-18.2.7
Test Name Synopsis
Verify server sends NoBinding status code when client attempts to decline unknown IAID dhcpv6_server_82 Verify server sends NoBinding status code when client attempts to decline unknown IAID


    step 1. Initiate DHCPv6 Decline with an unknown IAID that should not have a
            binding
    step 2. Verify that the server sends a Reply message with a status code of 3
            'NoBinding'

    For each IA in the Decline message for which the server has no binding information,
    the server adds an IA option using the IAID from the Release message and includes a
    Status Code option with the value NoBinding in the IA option.  No other options are
    included in the IA option.


    References:

    IETF RFC 3315 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)" Section 18.2.7: Receipt of Decline Messages

    https://tools.ietf.org/html/rfc3315#section-18.2.7
Test Name Synopsis
Verify server assigns IPv6 address when client uses unknown DHCPv6 options dhcpv6_server_100 Verify server assigns IPv6 address when client uses unknown DHCPv6 options


    step 1. Configure client to use unknown DHCPv6 option
    step 2. Restart DHCPv6 on LAN client without sending a Release to the server
    step 3. Verify that the server assigns an address to the client
    step 4. Verify that the address assigned by the server is the same as the
            client's original address

    Note: To ensure compatibility with future client implemenations that may
    support yet to be defined DHCPv6 options, servers should ignore any options
    that are unknown.


    References:

    IETF RFC 3315 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)"

    https://tools.ietf.org/html/rfc3315
Test Name Synopsis
Verify server ignores client requests with invalid option length dhcpv6_server_101 Verify server ignores client requests with invalid option length


    step 1. Configure client to use invalid DHCPv6 option length
    step 2. Restart DHCPv6 on LAN client without sending a Release to the server
    step 3. Verify that the server does not assign an address to the client
    step 4. Configure client to use valid DHCPv6 option length
    step 5. Restart DHCPv6 on LAN client without sending a Release to the server
    step 6. Verify that the server assigns an address to the client
    step 7. Verify that the address assigned by the server is the same as the
            client's original address


    References:

    IETF RFC 3315 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)"

    https://tools.ietf.org/html/rfc3315
Test Name Synopsis
Verify server supports Rapid Commit option dhcpv6_server_102 Verify server supports Rapid Commit option


    step 1. Configure the client to request DHCPv6 option 14 'Rapid Commit'
    step 2. Restart DHCPv6 on the client
    step 3. Verify that DHCPv6 server responds with Reply message containing the
           'Rapid Commit' option
    step 4. Verify that the server assigns an address to the client
    step 5. Verify that the address assigned by the server is the same as the
            client's original address

    A client MAY include this option in a Solicit message if the client
    is prepared to perform the Solicit-Reply message exchange described
    in section 17.1.1.

    A server MUST include this option in a Reply message sent in response
    to a Solicit message when completing the Solicit-Reply message
    exchange.


    References:

    IETF RFC 3315 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)" Section 22.14: Rapid Commit Option

    https://tools.ietf.org/html/rfc3315#section-22.14
Test Name Synopsis
Verify server assigns same IPv6 address when client requests both IA_NA and IA_PD dhcpv6_server_110 Verify server assigns same IPv6 address when client requests both IA_NA and IA_PD


    step 1. Configure client to request both IA_NA and IA_PD options
    step 2. Restart DHCPv6 on LAN without sending DHCPv6 Release to the server
    step 3. Verify that the server assigns an address to the client
    step 4. Verify that the address assigned by the server is the same as the
            client's original address


    References:

    IETF RFC 3315 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)"

    https://tools.ietf.org/html/rfc3315
Test Name Synopsis
Verify server assigns same IPv6 address when client requests both IA_NA and IA_TA dhcpv6_server_111 Verify server assigns same IPv6 address when client requests both IA_NA and IA_TA


    step 1. Configure client to request both IA_NA and IA_TA options
    step 2. Restart DHCPv6 on LAN without sending DHCPv6 Release to the server
    step 3. Verify that the server assigns an address to the client
    step 4. Verify that the address assigned by the server is the same as the
            client's original address


    References:

    IETF RFC 3315 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)"

    https://tools.ietf.org/html/rfc3315
Test Name Synopsis
Verify server responds to Relay-Forward requests sent to the All_DHCP_Servers multicast address dhcpv6_server_120 Verify server responds to Relay-Forward requests sent to the All_DHCP_Servers multicast address


    step 1. Configure a relay agent on the LAN to send to DHCPv6 messages to the
            All_DHCP_Servers multicast address
    step 2. Restart DHCPv6 on the client without sending a Release to the server
    step 3. Verify that the server assigns an address to the client

    The relay agent MAY be configured to use a list of destination
    addresses, which MAY include unicast addresses, the All_DHCP_Servers
    multicast address, or other addresses selected by the network
    administrator.


    References:

    IETF RFC 3315 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)" Section 20: Relay Agent Behavior

    https://tools.ietf.org/html/rfc3315#section-20
Test Name Synopsis
Verify server responds to Relay-Forward requests sent to server unicast address dhcpv6_server_121 Verify server responds to Relay-Forward requests sent to server unicast address


    step 1. Configure a relay agent on the LAN to send DHCPv6 messages to the
            server's global unicast address
    step 2. Restart DHCPv6 on the client without sending a Release to the server
    step 3. Verify that the server assigns an address to the client

    The relay agent MAY be configured to use a list of destination
    addresses, which MAY include unicast addresses, the All_DHCP_Servers
    multicast address, or other addresses selected by the network
    administrator.


    References:

    IETF RFC 3315 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)" Section 20: Relay Agent Behavior

    https://tools.ietf.org/html/rfc3315#section-20
Test Name Synopsis
Verify server includes Interface-Id option in Relay-Reply if included by relay agent dhcpv6_server_122 Verify server includes Interface-Id option in Relay-Reply if included by relay agent


    step 1. Configure a relay agent on the LAN to send DHCPv6 messages to the
            server's global unicast address
    step 2. Configure a relay agent to include the Interface-Id (18) option in
            Relay-Forward messages
    step 3. Restart DHCPv6 on the client without sending a Release to the server
    step 4. Verify that the server sends a Relay-Reply message to the relay
            agent
    step 5. Verify that the Relay-Reply message includes the original
            Interface-Id (18) option value included by the relay agent
    step 6. Wait for DHCPv6 transaction to complete

    Reference: IETF RFC 3315 Section 22.18 "Interface-Id Option"

    The server MUST copy the Interface-Id option from the Relay-Forward
    message into the Relay-Reply message the server sends to the relay
    agent in response to the Relay-Forward message.  This option MUST NOT
    appear in any message except a Relay-Forward or Relay-Reply message.


    References:

    IETF RFC 3315 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)" Section 22.18: Interface-Id Option

    https://tools.ietf.org/html/rfc3315#section-22.18

pppoe-c-v6.tcl

PPPoE client tests with IPv6 on the WAN side of the router

Test Name Synopsis
PPPoE client restarts PPPoE Discovery when PPP LCP Echo-Requests fail ipv6_pppoe_client_1 PPPoE client restarts PPPoE Discovery when PPP LCP Echo-Requests fail


    step 1. Turn off PPP LCP Echo-Reply on PPPoE server
    step 2. PPP client should send an LCP Echo-Request
    step 3. PPP client will not receive an LCP Echo-Reply
    step 4. Verify WAN PPPoE client sends PADI to restart PPPoE Discovery
            (wait up to 5 minutes for LCP to failover)
    step 5. Verify PPPoE client brings new PPPoE session up

    NOTE: Most PPPoE clients will terminate the existing PPPoE session after
    several LCP Echo-Requests have failed. However, some routers will
    simply initiate a new PPPoE session without sending a PADT. This
    test case does not FAIL the test if the existing PPPoE session is not
    terminated before starting a new PPPoE session. However, a warning
    will be issued.

    NOTE: The amount of time the test waits to recover the PPP based
    link can be configured by adjusting the testvar pppRestartTimeout.
    This variable contains the number of milliseconds to wait for
    PPP based protocols to recover. The default is 300000 (300 seconds).

    NOTE: By default, CDRouter will still respond to ICMP Echo
    Requests during this test. This allows the test to verify failure
    occurs because of PPP and not the ICMP Echo Replies. However, you
    can configure CDRouter to also ignore ICMP Echo Requests during
    this test by setting the testvar pppFailUsesICMP to yes:

    testvar pppFailUsesICMP yes
Test Name Synopsis
PPPoE client restarts PPPoE Discovery when PPP LCP terminates PPP link ipv6_pppoe_client_10 PPPoE client restarts PPPoE Discovery when PPP LCP terminates PPP link


    step 1. Check the current PPPoE session is established
    step 2. Terminate the current PPP session using LCP Terminate
    step 3. Verify WAN PPPoE client sends PADI to restart PPPoE Discovery
    step 4. Verify PPPoE client brings new PPPoE session up

    NOTE: The amount of time the test waits to recover the PPP based
    link can be configured by adjusting the testvar pppRestartTimeout.
    This variable contains the number of milliseconds to wait for
    PPP based protocols to recover. The default is 300000 (300 seconds).
Test Name Synopsis
PPPoE PPP client replies to LCP Echo-Requests ipv6_pppoe_client_50 PPPoE PPP client replies to LCP Echo-Requests


    step 1. Send 5 LCP Echo-Requests
    step 2. Verify LCP Echo-Replies are received
    step 3. Verify LCP Echo-Request data is echoed back in response
Test Name Synopsis
PPPoE PPP client maintains LCP Magic Number during session ipv6_pppoe_client_60 PPPoE PPP client maintains LCP Magic Number during session


    step 1. Terminate the current PPP session using LCP Terminate
    step 2. Check for Magic Number in LCP Configure Request
    step 3. Wait for LCP Echo Request and verify Magic Number is the same
    step 4. Send LCP Echo Request
    step 5. Verify Magic Number in LCP Echo Response is the same

    NOTE: CDRouter does not fail this test if the PPPoE PPP client
    does not send an LCP Echo Request. Some clients do not
    use LCP Echo Requests automtically.


    References:

    IETF RFC 1548 "The Point-to-Point Protocol (PPP)" Section 5.8: Echo-Request and Echo-Reply

    https://tools.ietf.org/html/rfc1548#section-5.8
Test Name Synopsis
IPv6CP Configure-Requests include Interface Identifier option ipv6_pppoe_client_70 IPv6CP Configure-Requests include Interface Identifier option


    step 1. Terminate the current PPP session using LCP Terminate
    step 2. Check for Interface Identifier in IPv6CP Configure Request
    step 3. Verify PPPoE link is reestablished


    References:

    IETF RFC 5072 "IP Version 6 over PPP" Section 5: Stateless Autoconfiguration and Link-Local Addresses

    The interface identifier of IPv6 unicast addresses [5] of a PPP
    interface SHOULD be negotiated in the IPV6CP phase of the PPP
    connection setup (see Section 4.1).

    https://tools.ietf.org/html/rfc5072#section-5
Test Name Synopsis
PPPoE/PPP restarts if PPP authentication fails ipv6_pppoe_client_200 PPPoE/PPP restarts if PPP authentication fails


    step 1. Terminate the current PPP session using LCP Terminate
    step 2. Verify WAN PPPoE client sends PADI to restart PPPoE Discovery
    step 3. Verify PPPoE client brings new PPPoE session up
    step 4. Reject any PAP or CHAP authentication attempts
    step 5. Wait 60 seconds, continuing to reject PPP authentication
    step 6. Accept PPP authentication after 60 seconds
    step 7. Send pings from LAN side to WAN side to force link to reestablish
    step 8. Verify PPP link is reestablished in 300 seconds (pppRestartTimeout)

    NOTE: This test supports PAP, CHAP, and MSCHAP authentication.

    NOTE: The amount of time the test waits to recover the PPP based
    link can be configured by adjusting the testvar pppRestartTimeout.
    This variable contains the number of milliseconds to wait for
    PPP based protocols to recover. The default is 300000 (300 seconds).
Test Name Synopsis
PPPoE/PPP can recover if LCP renegotiation is attempted ipv6_pppoe_client_210 PPPoE/PPP can recover if LCP renegotiation is attempted


    step 1. Send LCP Configure-Request to PPP peer
    step 2. Verify peer resends LCP configuration
    step 3. Verify the configuration is the same
    step 4. If the PPPoE link is terminated, issue ping to reestablish link
    step 5. Verify ping succeeds from LAN to WAN

    NOTE: Renegotiating LCP can cause some PPP implementations to terminate
    the PPP link or the PPPoE link. This test does not fail the DUT if this
    happens, but it does issue a warning if the PPPoE session is restarted.

    NOTE: The amount of time the test waits to recover the PPP based
    link can be configured by adjusting the testvar pppRestartTimeout.
    This variable contains the number of milliseconds to wait for
    PPP based protocols to recover. The default is 300000 (300 seconds).
Test Name Synopsis
PPPoE/PPP can recover if LCP Echo-Request contains bad length ipv6_pppoe_client_230 PPPoE/PPP can recover if LCP Echo-Request contains bad length


    step 1. Send out LCP Echo-Request with length 4096, but no data
    step 2. Peer may respond or drop LCP Echo-Request
    step 3. Verify PPP is still functioning using ICMP Echo

    NOTE: This test checks that the device under test behaves gracefully
    when it receives PPP options with a bad length. Some devices may
    still respond to the LCP Echo-Request, but it is not considered a failure if
    the device does not respond.
Test Name Synopsis
PPPoE client recovers if PPPoE server drops PADR from PPPoE client ipv6_pppoe_client_300 PPPoE client recovers if PPPoE server drops PADR from PPPoE client


    step 1. Terminate the current PPP session using LCP Terminate
    step 2. Verify WAN PPPoE client sends PADI to restart PPPoE Discovery
    step 3. Do not respond to the PADR packet from client
    step 4. Continue to ignore any PPPoE packets from the client until
            the client sends a new PADI packet
    step 5. Restore PPPoE server to normal operation
    step 6. Verify PPPoE client session recovers

    NOTE: The amount of time the test waits to recover the PPP based
    link can be configured by adjusting the testvar pppRestartTimeout.
    This variable contains the number of milliseconds to wait for
    PPP based protocols to recover. The default is 300000 (300 seconds).



    References:

    IETF RFC 2516 "A Method for Transmitting PPP Over Ethernet (PPPoE)" Section 8: Other Considerations

    If the Host is waiting to receive a PADS packet, a similar timeout
    mechanism SHOULD be used, with the Host re-sending the PADR.  After
    a specified number of retries, the Host SHOULD then resend a PADI
    packet.

    https://tools.ietf.org/html/rfc2516#section-8
Test Name Synopsis
PPPoE client returns AC-Cookie in PADR when server sends AC-Cookie in PADO ipv6_pppoe_client_310 PPPoE client returns AC-Cookie in PADR when server sends AC-Cookie in PADO


    step 1. Configure PPPoE server to use AC-Cookie Tag in PADO responses
    step 2. Terminate the current PPP session using LCP Terminate
    step 3. Verify WAN PPPoE client sends PADI to restart PPPoE Discovery
    step 4. Send AC-Cookie Tag in PADO
    step 5. Verify PADR from client contains AC-Cookie with the same cookie data


    References:

    IETF RFC 2516 "A Method for Transmitting PPP Over Ethernet (PPPoE)" Section A: AC-Cookie

    If a Host receives this TAG, it MUST return the TAG
    unmodified in the following PADR.

    https://tools.ietf.org/html/rfc2516
Test Name Synopsis
PPPoE client maintains Relay-Session-Id during PPPoE session establishment ipv6_pppoe_client_320 PPPoE client maintains Relay-Session-Id during PPPoE session establishment


    step 1. Configure PPPoE server to use Relay-Session-Id in PADO responses
    step 2. Terminate the current PPP session using LCP Terminate
    step 3. Verify WAN PPPoE client sends PADI to restart PPPoE Discovery
    step 4. If the PADI already contains a Relay-Session-Id from an actual
            PPPoE Relay server, configure the PPPoE server to use the same
            tag value
    step 5. Send Relay-Session-Id Tag in PADO
    step 6. Verify PADR from client contains Relay-Session-Id tag with the same cookie data

    NOTE: Normally, CDRouter does not expect a PPPoE relay server to be present
    between the PPPoE client and CDRouter. However, this test does check for
    an existing Relay-Session-Id in the PADI and will use this tag value
    for the test instead of generating a unique value. This allows the test
    to work with an existing PPPoE relay server on the WAN.


    References:

    IETF RFC 2516 "A Method for Transmitting PPP Over Ethernet (PPPoE)" Section A: Relay-Session-Id

    If either the Host or Access Concentrator receives this TAG they
    MUST include it unmodified in any discovery packet they send as a response.

    https://tools.ietf.org/html/rfc2516
Test Name Synopsis
PPPoE client reconnects to server after 15 minute WAN disconnect ipv6_pppoe_client_330 PPPoE client reconnects to server after 15 minute WAN disconnect


    step 1. Do not respond to any traffic from the WAN
    step 2. Wait 15 minutes, then reenable the WAN connection with CDRouter
    step 3. Verify WAN PPPoE client sends PADI to restart PPPoE Discovery
            (wait up to 5 minutes for LCP to failover)
    step 4. Verify PPPoE client reconnects with the PPPoE server

    NOTE: The amount of time the test waits to recover the PPP based
    link can be configured by adjusting the testvar pppRestartTimeout.
    This variable contains the number of milliseconds to wait for
    PPP based protocols to recover. The default is 300000 (300 seconds).
Test Name Synopsis
PPPoE client reconnects to server after 30 minute WAN disconnect ipv6_pppoe_client_331 PPPoE client reconnects to server after 30 minute WAN disconnect


    step 1. Do not respond to any traffic from the WAN
    step 2. Wait 15 minutes, then reenable the WAN connection with CDRouter
    step 3. Verify WAN PPPoE client sends PADI to restart PPPoE Discovery
            (wait up to 5 minutes for LCP to failover)
    step 4. Verify PPPoE client reconnects with the PPPoE server

    NOTE: The amount of time the test waits to recover the PPP based
    link can be configured by adjusting the testvar pppRestartTimeout.
    This variable contains the number of milliseconds to wait for
    PPP based protocols to recover. The default is 300000 (300 seconds).
Test Name Synopsis
PPPoE client reconnects to server after 60 minute WAN disconnect ipv6_pppoe_client_332 PPPoE client reconnects to server after 60 minute WAN disconnect


    step 1. Do not respond to any traffic from the WAN
    step 2. Wait 15 minutes, then reenable the WAN connection with CDRouter
    step 3. Verify WAN PPPoE client sends PADI to restart PPPoE Discovery
            (wait up to 5 minutes for LCP to failover)
    step 4. Verify PPPoE client reconnects with the PPPoE server

    NOTE: The amount of time the test waits to recover the PPP based
    link can be configured by adjusting the testvar pppRestartTimeout.
    This variable contains the number of milliseconds to wait for
    PPP based protocols to recover. The default is 300000 (300 seconds).

slaac-wan.tcl

Autoconf / SLAAC client tests for the WAN side of the router

Test Name Synopsis
Verify DUT configures a new address using SLAAC when a new prefix is advertised on the WAN ipv6_slaac_wan_1 Verify DUT configures a new address using SLAAC when a new prefix is advertised on the WAN


    step 1. Send a Router Advertisement on the WAN that advertises a new
            global prefix
    step 2. Verify that the DUT sends a DAD-style Neighbor Solicitation on the
            WAN
    step 3. Verify that the target address in the Neighbor Solicitation is
            based on the new prefix
    step 4. Wait 10 seconds for the DUT to configure the new target address
    step 5. Send 10 pings to verify that the DUT has configured the new target
            address


    References:

    IETF RFC 4862 "IPv6 Stateless Address Autoconfiguration"

    https://tools.ietf.org/html/rfc4862
Test Name Synopsis
Verify DUT sends DAD-style Neighbor Solicitations when configuring an address ipv6_slaac_wan_10 Verify DUT sends DAD-style Neighbor Solicitations when configuring an address


    step 1. Send a Router Advertisement on the WAN that advertises a new
            global prefix
    step 2. Verify that the DUT sends a DAD-style Neighbor Solicitation on the
            WAN
    step 3. Verify that the target address in the Neighbor Solicitation is
            based on the new prefix
    step 4. Verify that the source address of the Neighbor Solicitation is the
            unspecified address
    step 5. Verify that the destination address of the Neighbor Solicitation is
            a solicited-node multicast address based on the target address in
            step 3


    References:

    IETF RFC 4862 "IPv6 Stateless Address Autoconfiguration"

    https://tools.ietf.org/html/rfc4862
Test Name Synopsis
Verify DUT does not configure an address when a DAD collision occurs ipv6_slaac_wan_11 Verify DUT does not configure an address when a DAD collision occurs


    step 1. Send a Router Advertisement on the WAN that advertises a new prefix
    step 2. Verify that the DUT sends a DAD-style Neighbor Solicitation on the
            WAN
    step 3. Force a DAD collision by sending a Neighbor Advertisement for the
            target address used by the DUT in step 2
    step 4. Wait 10 seconds
    step 5. Verify that the DUT does not configure the target address by
            sending a Neighbor Solicitation


    References:

    IETF RFC 4862 "IPv6 Stateless Address Autoconfiguration"

    https://tools.ietf.org/html/rfc4862
Test Name Synopsis
Verify DUT responds to Neighbor Solicitations for new configured address on WAN ipv6_slaac_wan_12 Verify DUT responds to Neighbor Solicitations for new configured address on WAN


    step 1. Send a Router Advertisement on the WAN that advertises a new
            global prefix
    step 2. Verify that the DUT sends a DAD-style Neighbor Solicitation on the
            WAN
    step 3. Verify that the target address in the Neighbor Solicitation is
            based on the new prefix
    step 4. Wait 10 seconds
    step 5. Run test ipv6_ndp_wan_11 to verify that the DUT has configured
            and responds to Neighbor Solicitations for the newly configured
            target address


    References:

    IETF RFC 4862 "IPv6 Stateless Address Autoconfiguration"

    https://tools.ietf.org/html/rfc4862
Test Name Synopsis
Verify DUT responds to DAD-style Neighbor Solicitations for new configured address on WAN ipv6_slaac_wan_13 Verify DUT responds to DAD-style Neighbor Solicitations for new configured address on WAN


    step 1. Send a Router Advertisement on the WAN that advertises a new
            global prefix
    step 2. Verify that the DUT sends a DAD-style Neighbor Solicitation on the
            WAN
    step 3. Verify that the target address in the Neighbor Solicitation is
            based on the new prefix
    step 4. Wait 10 seconds
    step 5. Run test ipv6_ndp_wan_16 to verify that the DUT has configured
            and responds to DAD-style Neighbor Solicitations for the newly
            configured target address


    References:

    IETF RFC 4862 "IPv6 Stateless Address Autoconfiguration"

    https://tools.ietf.org/html/rfc4862
Test Name Synopsis
Verify DUT does not configure an address when the A-bit is not set ipv6_slaac_wan_20 Verify DUT does not configure an address when the A-bit is not set


    step 1. Send a Router Advertisement on the WAN that advertises a new
            global prefix with the A-bit not set
    step 2. Verify that the DUT does not send a DAD-style Neighbor Solicitation
            on the WAN for the prefix advertised in step 1


    References:

    IETF RFC 4862 "IPv6 Stateless Address Autoconfiguration" Section 5.5.3: Router Advertisement Processing

    For each Prefix-Information option in the Router Advertisement:

     a)  If the Autonomous flag is not set, silently ignore the Prefix
         Information option.

    https://tools.ietf.org/html/rfc4862#section-5.5.3
Test Name Synopsis
Verify DUT does not configure an address when the advertised prefix is a link-local prefix ipv6_slaac_wan_21 Verify DUT does not configure an address when the advertised prefix is a link-local prefix


    step 1. Send a Router Advertisement on the WAN that advertises a
            link-local prefix
    step 2. Verify that the DUT does not send a DAD-style Neighbor Solicitation
            on the WAN for the prefix advertised in step 1


    References:

    IETF RFC 4862 "IPv6 Stateless Address Autoconfiguration" Section 5.5.3: Router Advertisement Processing

    For each Prefix-Information option in the Router Advertisement:

     b)  If the prefix is the link-local prefix, silently ignore the
         Prefix Information option.

    https://tools.ietf.org/html/rfc4862#section-5.5.3
Test Name Synopsis
Verify DUT does not configure an address when the valid lifetime is 0 ipv6_slaac_wan_22 Verify DUT does not configure an address when the valid lifetime is 0


    step 1. Send a Router Advertisement on the WAN that advertises a new
            global prefix with a valid-lifetime of 0
    step 2. Verify that the DUT does not send a DAD-style Neighbor Solicitation
            on the WAN for the prefix advertised in step 1


    References:

    IETF RFC 4862 "IPv6 Stateless Address Autoconfiguration" Section 5.5.3: Router Advertisement Processing

    For each Prefix-Information option in the Router Advertisement:

     c)  If the preferred lifetime is greater than the valid lifetime,
         silently ignore the Prefix Information option.  A node MAY wish to
         log a system management error in this case.

    https://tools.ietf.org/html/rfc4862#section-5.5.3

6to4.tcl

6to4 tunnel tests for connecting IPv6 hosts over IPv4 networks

Test Name Synopsis
Verify IPv6 Router Advertisements include 6to4 prefix based on IPv4 WAN ipv6_6to4_1 Verify IPv6 Router Advertisements include 6to4 prefix based on IPv4 WAN


    step 1. Listen for IPv6 RA from DUT
    step 2. Verify RA contains 6to4 prefix based on public IPv4 WAN
    step 3. Verify 6to4 prefix contains a valid lifetime


    References:

    IETF RFC 3056 "Connection of IPv6 Domains via IPv4 Clouds" Section 2: IPv6 Prefix Allocation

    https://tools.ietf.org/html/rfc3056#section-2
Test Name Synopsis
Verify DUT assigns itself a global address on the LAN side 6to4 network ipv6_6to4_2 Verify DUT assigns itself a global address on the LAN side 6to4 network


    step 1. Determine the DUT's LAN side IPv6 global address
    step 2. Send ICMPv6 Echo Request to the DUT's global IPv6 address
    step 3. Verify ICMPv6 Echo Response is received from the global IPv6 address


    References:

    IETF RFC 3056 "Connection of IPv6 Domains via IPv4 Clouds" Section 2: IPv6 Prefix Allocation

    https://tools.ietf.org/html/rfc3056#section-2
Test Name Synopsis
Verify IPv6 Router Advertisements include SLA ID ipv6_6to4_3 Verify IPv6 Router Advertisements include SLA ID


    step 1. Listen for IPv6 RA from DUT
    step 2. Verify RA contains 6to4 prefix based on public IPv4 WAN
    step 3. Verify advertised 6to4 prefix includes the expected SLA ID

    RFC 3056 defines a 16 bit "SLA ID" field for subnetting. Most DUT's allow
    the SLA ID to be arbitrarily configured. This test verifies that the DUT
    advertises the expected SLA ID. The expected SLA can be configured using
    the testvar "ipv6LanSubnetId" which must be a hex string with four or less
    characters. Examples:

    testvar ipv6LanSubnetId ffff
    testvar ipv6LanSubnetId 1


    References:

    IETF RFC 3056 "Connection of IPv6 Domains via IPv4 Clouds" Section 2: IPv6 Prefix Allocation

    https://tools.ietf.org/html/rfc3056#section-2
Test Name Synopsis
Verify packets to 6to4 addresses are tunneled directly to IPv4 address ipv6_6to4_10 Verify packets to 6to4 addresses are tunneled directly to IPv4 address


    step 1. Forward IPv6 UDP to IPv6 address on 6to4 network that maps to
            remoteHost IPv4
    step 2. Verify remoteHost IPv4 on the WAN received tunneled IPv6 packet
    step 3. Verify return IPv6 UDP traffic is forwarded back from remoteHost IPv4


    References:

    IETF RFC 3056 "Connection of IPv6 Domains via IPv4 Clouds" Section 5.1: Simple scenario - all sites work the same

    https://tools.ietf.org/html/rfc3056#section-5.1
Test Name Synopsis
Verify packets to non 6to4 addresses are tunneled to 6to4 relay server ipv6_6to4_11 Verify packets to non 6to4 addresses are tunneled to 6to4 relay server


    step 1. Forward IPv6 UDP to remoteHostv6 address on non-6to4 network
    step 2. Verify 6to4 relay server on the WAN received tunneled IPv6 packet
    step 3. Verify return IPv6 UDP traffic is forwarded back from relay server


    References:

    IETF RFC 3056 "Connection of IPv6 Domains via IPv4 Clouds" Section 5.2: Mixed scenario with relay to native IPv6

    https://tools.ietf.org/html/rfc3056#section-5.2
Test Name Synopsis
Verify IPv4 src address of tunneled 6to4 packets matches WAN IPv4 address ipv6_6to4_12 Verify IPv4 src address of tunneled 6to4 packets matches WAN IPv4 address


    step 1. Forward IPv6 UDP to remoteHostv6 address on non-6to4 network
    step 2. Verify 6to4 relay server on the WAN received tunneled IPv6 packet
    step 3. Verify IPv4 src address of tunneled IPv6 traffic matches WAN
            IPv4 address


    References:

    IETF RFC 3056 "Connection of IPv6 Domains via IPv4 Clouds" Section 5.2: Mixed scenario with relay to native IPv6

    https://tools.ietf.org/html/rfc3056#section-5.2
Test Name Synopsis
Verify encapsulating IPv4 header for 6to4 has the DF flag set correctly ipv6_6to4_13 Verify encapsulating IPv4 header for 6to4 has the DF flag set correctly


    step 1. Forward IPv6 UDP to remoteHostv6 address
    step 2. Verify 6to4 relay server on the WAN received tunneled IPv6 packet
    step 3. Verify 'do not fragment' flag is set correctly on IPv4
            header based on the value of ipv6TunnelMtuType


    References:

    IETF RFC 3056 "Connection of IPv6 Domains via IPv4 Clouds" Section 4: Maximum Transmission Unit

    https://tools.ietf.org/html/rfc3056#section-4

    IETF RFC 4213 "Basic Transition Mechanisms for IPv6 Hosts and Routers" Section 3.2: Tunnel MTU and Fragmentation

    https://tools.ietf.org/html/rfc4213#section-3.2
Test Name Synopsis
Verify DUT handles incoming 6to4 fragmented packets ipv6_6to4_14 Verify DUT handles incoming 6to4 fragmented packets


    step 1. Configure 6to4 Relay server to use an IPv4 MTU of 252
    step 2. Forward IPv6 UDP to remoteHostv6 address with 1000 bytes of UDP data
    step 3. Verify 6to4 relay server on the WAN received tunneled IPv6 packet
    step 4. Send same UDP data back through 6to4 relay server
    step 5. 6to4 relay server will fragment the IPv4 packet
    step 6. Verify UDP data is sent to original IPv6 LAN client


    References:

    IETF RFC 3056 "Connection of IPv6 Domains via IPv4 Clouds" Section 4: Maximum Transmission Unit

    https://tools.ietf.org/html/rfc3056#section-4
Test Name Synopsis
Verify IPv6 Router Advertisements announce new 6to4 prefix when IPv4 WAN changes ipv6_6to4_100 Verify IPv6 Router Advertisements announce new 6to4 prefix when IPv4 WAN changes


    step 1. Bring down WAN link
    step 2. Bring up WAN link with new external IP address
    step 3. Listen for IPv6 RA from DUT
    step 4. Verify RA contains 6to4 prefix based on new public WAN IP
    step 5. Verify 6to4 prefix contains a valid lifetime
    step 6. Bring down WAN link
    step 7. Bring up WAN link with new original IP address


    References:

    IETF RFC 3056 "Connection of IPv6 Domains via IPv4 Clouds" Section 2: IPv6 Prefix Allocation

    https://tools.ietf.org/html/rfc3056#section-2
Test Name Synopsis
Verify DUT updates global IPv6 address after IPv4 WAN change ipv6_6to4_101 Verify DUT updates global IPv6 address after IPv4 WAN change


    step 1. Bring down WAN link
    step 2. Bring up WAN link with new external IPv4 address
    step 3. Listen for IPv6 RA from DUT
    step 4. Verify RA contains 6to4 prefix based on new public WAN IPv4
    step 5. Verify 6to4 prefix contains a valid lifetime
    step 6. Ping DUT's new IPv6 global address
    step 7. Verify IPv6 ping response
    step 8. Bring down WAN link
    step 9. Bring up WAN link with new original IPv4 address


    References:

    IETF RFC 3056 "Connection of IPv6 Domains via IPv4 Clouds" Section 2: IPv6 Prefix Allocation

    https://tools.ietf.org/html/rfc3056#section-2
Test Name Synopsis
Verify DUT forwards tunneled IPv6 traffic after IPv4 WAN change ipv6_6to4_102 Verify DUT forwards tunneled IPv6 traffic after IPv4 WAN change


    step 1. Bring down WAN link
    step 2. Bring up WAN link with new external IPv4 address
    step 3. Listen for IPv6 RA from DUT
    step 4. Verify RA contains 6to4 prefix based on new public WAN IPv4
    step 5. Verify 6to4 prefix contains a valid lifetime
    step 6. Forward IPv6 traffic from LAN to remoteHostv6
    step 7. Verify traffic is forwarded and src IPv4 of tunneled packets matched new IPv4 address
    step 8. Bring down WAN link
    step 9. Bring up WAN link with new original IPv4 address


    References:

    IETF RFC 3056 "Connection of IPv6 Domains via IPv4 Clouds" Section 2: IPv6 Prefix Allocation

    https://tools.ietf.org/html/rfc3056#section-2
Test Name Synopsis
Verify IPv6 router advertisements age out 6to4 prefix when IPv4 WAN link is down ipv6_6to4_103 Verify IPv6 router advertisements age out 6to4 prefix when IPv4 WAN link is down


    step 1. Bring down WAN link
    step 2. Listen for IPv6 RA from DUT
    step 3. Verify either the RA does not contain previous 6to4 prefix
            or the advertised 6to4 prefix preferred lifetime is now 0
    step 4. Bring up WAN link
    step 5. Listen for IPv6 RA from DUT
    step 6. Verify the RA contains the expected 6to4 prefix


    References:

    IETF RFC 3056 "Connection of IPv6 Domains via IPv4 Clouds"

    https://tools.ietf.org/html/rfc3056
Test Name Synopsis
Verify LAN side DHCPv6 client address contains a 6to4 prefix based on IPv4 WAN ipv6_6to4_150 Verify LAN side DHCPv6 client address contains a 6to4 prefix based on IPv4 WAN


    step 1. Check existing DHCPv6 bindings on the LAN side of the CPE
    step 2. Verify whether or not a non-temporary address binding exists
    step 3. Verify that the non-temporary address on the LAN contains
            a 6to4 prefix based on public IPv4 WAN


    References:

    IETF RFC 3056 "Connection of IPv6 Domains via IPv4 Clouds" Section 2: IPv6 Prefix Allocation

    https://tools.ietf.org/html/rfc3056#section-2
Test Name Synopsis
Verify LAN side DHCPv6 client address contains a 6to4 prefix which includes SLA ID ipv6_6to4_160 Verify LAN side DHCPv6 client address contains a 6to4 prefix which includes SLA ID


    step 1. Check existing DHCPv6 bindings on the LAN side of the CPE
    step 2. Verify whether or not a non-temporary address binding exists
    step 3. Verify that the non-temporary address on the LAN contains
            a 6to4 prefix which includes the expected SLA ID

    RFC 3056 defines a 16 bit "SLA ID" field for subnetting. Most
    DUT's allow the SLA ID to be arbitrarily configured. This test
    verifies that the DUT uses the expected SLA ID. The expected SLA
    can be configured using the testvar "ipv6LanSubnetId" which must
    be a hex string with four or less characters. Examples:

    testvar ipv6LanSubnetId ffff
    testvar ipv6LanSubnetId 1


    References:

    IETF RFC 3056 "Connection of IPv6 Domains via IPv4 Clouds" Section 2: IPv6 Prefix Allocation

    https://tools.ietf.org/html/rfc3056#section-2

6rd.tcl

6rd tunnel tests for connecting IPv6 hosts over IPv4 networks

Test Name Synopsis
Verify IPv6 Router Advertisements include 6rd prefix based on IPv4 WAN ipv6_6rd_1 Verify IPv6 Router Advertisements include 6rd prefix based on IPv4 WAN


    step 1. Listen for IPv6 RA from DUT
    step 2. Verify RA contains 6rd prefix based on public IPv4 WAN
    step 3. Verify 6rd prefix contains a valid lifetime


    References:

    IETF RFC 5969 "IPv6 Rapid Deployment on IPv4 Infrastructures (6rd)"

    https://tools.ietf.org/html/rfc5969
Test Name Synopsis
Verify DUT assigns itself a global address on the LAN side 6rd network ipv6_6rd_2 Verify DUT assigns itself a global address on the LAN side 6rd network


    step 1. Determine the DUT's LAN side IPv6 global address based
    step 2. Send ICMPv6 Echo Request to the DUT's global IPv6 address
    step 3. Verify ICMPv6 Echo Response is received from the global IPv6 address


    References:

    IETF RFC 5969 "IPv6 Rapid Deployment on IPv4 Infrastructures (6rd)"

    https://tools.ietf.org/html/rfc5969
Test Name Synopsis
Verify IPv6 Router Advertisements include subnet ID ipv6_6rd_3 Verify IPv6 Router Advertisements include subnet ID


    step 1. Listen for IPv6 RA from DUT
    step 2. Verify RA contains 6rd prefix based on public IPv4 WAN
    step 3. Verify advertised 6rd prefix includes the expected subnet ID

    Note: The expected subnet ID bits can be configured using the testvar
    ipv6LanSubnetId. The ipv6LanSubnetId testvar is a variable length string
    of hex characters. Examples:

    testvar ipv6LanSubnetId ffff
    testvar ipv6LanSubnetId 1


    References:

    IETF RFC 5969 "IPv6 Rapid Deployment on IPv4 Infrastructures (6rd)"

    https://tools.ietf.org/html/rfc5969
Test Name Synopsis
Verify packets to 6rd addresses are tunneled directly to IPv4 address ipv6_6rd_10 Verify packets to 6rd addresses are tunneled directly to IPv4 address


    step 1. Forward IPv6 UDP to IPv6 address on 6rd network that maps to
            new WAN side IPv4 gateway based on testvar wanIspNextIp
    step 2. Verify new gateway on the WAN receives tunneled IPv6 packet
    step 3. Verify return IPv6 UDP traffic is forwarded back from new IPv4 gateway

    IPv6 communication between customer sites of a same ISP is direct
    across the ISP IPv4 infrastructure: when a CPE sees that the IPv6
    destination address of an outgoing packet starts with its own 6rd
    relay ISPv6 prefix, it takes the 32 bits that follow this prefix as
    IPv4 destination of the encapsulating packet.


    References:

    IETF RFC 5969 "IPv6 Rapid Deployment on IPv4 Infrastructures (6rd)"

    https://tools.ietf.org/html/rfc5969
Test Name Synopsis
Verify packets to non 6rd addresses are tunneled to 6rd relay server ipv6_6rd_11 Verify packets to non 6rd addresses are tunneled to 6rd relay server


    step 1. Forward IPv6 UDP to remoteHostv6 address on non-6rd network
    step 2. Verify 6rd relay server on the WAN received tunneled IPv6 packet
    step 3. Verify return IPv6 UDP traffic is forwarded back from relay server


    References:

    IETF RFC 5969 "IPv6 Rapid Deployment on IPv4 Infrastructures (6rd)"

    https://tools.ietf.org/html/rfc5969
Test Name Synopsis
Verify IPv4 src address of tunneled 6rd packets matches WAN IPv4 address ipv6_6rd_12 Verify IPv4 src address of tunneled 6rd packets matches WAN IPv4 address


    step 1. Forward IPv6 UDP to remoteHostv6 address on non-6rd network
    step 2. Verify 6rd relay server on the WAN received tunneled IPv6 packet
    step 3. Verify IPv4 src address of tunneled IPv6 traffic matches WAN
            IPv4 address


    References:

    IETF RFC 5969 "IPv6 Rapid Deployment on IPv4 Infrastructures (6rd)"

    https://tools.ietf.org/html/rfc5969
Test Name Synopsis
Verify encapsulating IPv4 header for 6rd has the DF flag set correctly ipv6_6rd_13 Verify encapsulating IPv4 header for 6rd has the DF flag set correctly


    step 1. Forward IPv6 UDP to remoteHostv6 address
    step 2. Verify 6rd relay server on the WAN received tunneled IPv6 packet
    step 3. Verify 'do not fragment' flag is set correctly on IPv4
            header based on the value of ipv6TunnelMtuType


    References:

    IETF RFC 5969 "IPv6 Rapid Deployment on IPv4 Infrastructures (6rd)"

    https://tools.ietf.org/html/rfc5969

    IETF RFC 3056 "Connection of IPv6 Domains via IPv4 Clouds" Section 4: Maximum Transmission Unit

    https://tools.ietf.org/html/rfc3056#section-4

    IETF RFC 4213 "Basic Transition Mechanisms for IPv6 Hosts and Routers" Section 3.2: Tunnel MTU and Fragmentation

    https://tools.ietf.org/html/rfc4213#section-3.2
Test Name Synopsis
Verify DUT handles incoming 6rd fragmented packets ipv6_6rd_14 Verify DUT handles incoming 6rd fragmented packets


    step 1. Configure 6rd Relay server to use an IPv4 MTU of 252
    step 2. Forward IPv6 UDP to remoteHostv6 address with 1000 bytes of UDP data
    step 3. Verify 6rd relay server on the WAN received tunneled IPv6 packet
    step 4. Send same UDP data back through 6rd relay server
    step 5. 6rd relay server will fragment the IPv4 packet
    step 6. Verify UDP data is sent to original IPv6 LAN client


    References:

    IETF RFC 5969 "IPv6 Rapid Deployment on IPv4 Infrastructures (6rd)"

    https://tools.ietf.org/html/rfc5969
Test Name Synopsis
Verify IPv6 Router Advertisements announce new 6rd prefix when IPv4 WAN changes ipv6_6rd_100 Verify IPv6 Router Advertisements announce new 6rd prefix when IPv4 WAN changes


    step 1. Bring down WAN link
    step 2. Bring up WAN link with new external IP address
    step 3. Listen for IPv6 RA from DUT
    step 4. Verify RA contains 6rd prefix based on new public WAN IP
    step 5. Verify 6rd prefix contains a valid lifetime
    step 6. Bring down WAN link
    step 7. Bring up WAN link with new original IP address


    References:

    IETF RFC 5969 "IPv6 Rapid Deployment on IPv4 Infrastructures (6rd)"

    https://tools.ietf.org/html/rfc5969
Test Name Synopsis
Verify DUT updates global IPv6 address after IPv4 WAN change ipv6_6rd_101 Verify DUT updates global IPv6 address after IPv4 WAN change


    step 1. Bring down WAN link
    step 2. Bring up WAN link with new external IPv4 address
    step 3. Listen for IPv6 RA from DUT
    step 4. Verify RA contains 6rd prefix based on new public WAN IPv4
    step 5. Verify 6rd prefix contains a valid lifetime
    step 6. Ping DUT's new IPv6 global address
    step 7. Verify IPv6 ping response
    step 8. Bring down WAN link
    step 9. Bring up WAN link with new original IPv4 address


    References:

    IETF RFC 5969 "IPv6 Rapid Deployment on IPv4 Infrastructures (6rd)"

    https://tools.ietf.org/html/rfc5969
Test Name Synopsis
Verify DUT forwards tunneled IPv6 traffic after IPv4 WAN change ipv6_6rd_102 Verify DUT forwards tunneled IPv6 traffic after IPv4 WAN change


    step 1. Bring down WAN link
    step 2. Bring up WAN link with new external IPv4 address
    step 3. Listen for IPv6 RA from DUT
    step 4. Verify RA contains 6rd prefix based on new public WAN IPv4
    step 5. Verify 6rd prefix contains a valid lifetime
    step 6. Forward IPv6 traffic from LAN to remoteHostv6
    step 7. Verify traffic is forwarded and src IPv4 of tunneled packets matched new IPv4 address
    step 8. Bring down WAN link
    step 9. Bring up WAN link with new original IPv4 address


    References:

    IETF RFC 5969 "IPv6 Rapid Deployment on IPv4 Infrastructures (6rd)"

    https://tools.ietf.org/html/rfc5969
Test Name Synopsis
Verify IPv6 router advertisements age out 6rd prefix when IPv4 WAN link is down ipv6_6rd_103 Verify IPv6 router advertisements age out 6rd prefix when IPv4 WAN link is down


    step 1. Bring down WAN link
    step 2. Listen for IPv6 RA from DUT
    step 3. Verify either the RA does not contain previous 6rd prefix
            or the advertised 6rd prefix preferred lifetime is now 0
    step 4. Bring up WAN link
    step 5. Listen for IPv6 RA from DUT
    step 6. Verify the RA contains the expected 6rd prefix


    References:

    IETF RFC 5969 "IPv6 Rapid Deployment on IPv4 Infrastructures (6rd)"

    https://tools.ietf.org/html/rfc5969
Test Name Synopsis
Verify LAN side DHCPv6 client address contains a 6rd prefix based on IPv4 WAN ipv6_6rd_150 Verify LAN side DHCPv6 client address contains a 6rd prefix based on IPv4 WAN


    step 1. Check existing DHCPv6 bindings on the LAN side of the CPE
    step 2. Verify whether or not a non-temporary address binding exists
    step 3. Verify that the non-temporary address on the LAN contains
            a 6rd prefix based on public IPv4 WAN


    References:

    IETF RFC 5969 "IPv6 Rapid Deployment on IPv4 Infrastructures (6rd)"

    https://tools.ietf.org/html/rfc5969
Test Name Synopsis
Verify LAN side DHCPv6 client address contains a 6rd prefix which includes SLA ID ipv6_6rd_160 Verify LAN side DHCPv6 client address contains a 6rd prefix which includes SLA ID


    step 1. Check existing DHCPv6 bindings on the LAN side of the CPE
    step 2. Verify whether or not a non-temporary address binding exists
    step 3. Verify that the non-temporary address on the LAN contains
            a 6rd prefix which includes the expected SLA ID

    RFC 3056 defines a 16 bit "SLA ID" field for subnetting. Most
    DUT's allow the SLA ID to be arbitrarily configured. This test
    verifies that the DUT uses the expected SLA ID. The expected SLA
    can be configured using the testvar "ipv6LanSubnetId" which must
    be a hex string with four or less characters. Examples:

    testvar ipv6LanSubnetId ffff
    testvar ipv6LanSubnetId 1


    References:

    IETF RFC 5969 "IPv6 Rapid Deployment on IPv4 Infrastructures (6rd)"

    https://tools.ietf.org/html/rfc5969

    IETF RFC 3056 "Connection of IPv6 Domains via IPv4 Clouds" Section 2: IPv6 Prefix Allocation

    https://tools.ietf.org/html/rfc3056#section-2

icmp-v6.tcl

ICMPv6 tests for baseline ICMPv6 not including Neighbor Discovery

Test Name Synopsis
Verify ICMPv6 Echo Requests work through DUT icmpv6_1 Verify ICMPv6 Echo Requests work through DUT


    step 1. Initiate an outbound ICMPv6 Echo Request to a WAN IPv6 destination
    step 2. Verify ICMPv6 Echo Reply is received


    References:

    IETF RFC 4443 "Internet Control Message Protocol (ICMPv6) for the Internet Protocol Version 6 (IPv6) Specification"

    https://tools.ietf.org/html/rfc4443
Test Name Synopsis
Verify ICMPv6 Echo Requests from multiple LAN clients work through DUT icmpv6_2 Verify ICMPv6 Echo Requests from multiple LAN clients work through DUT


    step 1. Configure additional lan host
    step 2. Initiate an outbound ICMPv6 Echo Request to a WAN destination from host 1
    step 3. Verify ICMPv6 Echo Reply is received
    step 4. Initiate an outbound ICMPv6 Echo Request to a WAN destination from host 2
    step 5. Verify ICMPv6 Echo Reply is received


    References:

    IETF RFC 4443 "Internet Control Message Protocol (ICMPv6) for the Internet Protocol Version 6 (IPv6) Specification"

    https://tools.ietf.org/html/rfc4443
Test Name Synopsis
Verify DUT responds to ICMPv6 Echo Requests to its global IPv6 address from LAN icmpv6_3 Verify DUT responds to ICMPv6 Echo Requests to its global IPv6 address from LAN


    step 1. Initiate an outbound ICMPv6 Echo Request to the DUT's global IPv6 address
    step 2. Verify ICMPv6 Echo Reply is received


    References:

    IETF RFC 4443 "Internet Control Message Protocol (ICMPv6) for the Internet Protocol Version 6 (IPv6) Specification"

    https://tools.ietf.org/html/rfc4443
Test Name Synopsis
Verify DUT responds to ICMPv6 Echo Requests to its link-local address icmpv6_4 Verify DUT responds to ICMPv6 Echo Requests to its link-local address


    step 1. Initiate an outbound ICMPv6 Echo Request to the router's LAN side link-local address
    step 2. Verify ICMPv6 Echo Reply is received


    References:

    IETF RFC 4443 "Internet Control Message Protocol (ICMPv6) for the Internet Protocol Version 6 (IPv6) Specification"

    https://tools.ietf.org/html/rfc4443
Test Name Synopsis
Verify ICMPv6 Echo Requests to DUT's global IPv6 address behave as expected icmpv6_5 Verify ICMPv6 Echo Requests to DUT’s global IPv6 address behave as expected


    step 1. Determine expected DUT global address
    step 2. Initiate an outbound ICMPv6 Echo Request to the DUT's global address from the LAN
    step 3. Verify response is received
    step 4. Initiate an inbound ICMPv6 Echo Request to the DUT's global address from the WAN
    step 5. Verify the device behaves as expected.

    NOTE: the testvar ipv6WanPingRespond is used to determine if pinging the
          WAN-side of the DUT is expected to work or not.  It defaults to "no"
          which signifies that the device will not respond to IPv6 pings on its
          WAN interface.


    References:

    IETF RFC 4443 "Internet Control Message Protocol (ICMPv6) for the Internet Protocol Version 6 (IPv6) Specification"

    https://tools.ietf.org/html/rfc4443
Test Name Synopsis
Verify DUT responds to ICMPv6 Echo Requests sent to the All-Routers multicast group icmpv6_6 Verify DUT responds to ICMPv6 Echo Requests sent to the All-Routers multicast group


    step 1. Initiate an outbound ICMPv6 Ping to ff02::2 from the link-local IPv6 address
    step 2. Verify ICMPv6 Echo Reply is received


    References:

    IETF RFC 4443 "Internet Control Message Protocol (ICMPv6) for the Internet Protocol Version 6 (IPv6) Specification"

    https://tools.ietf.org/html/rfc4443
Test Name Synopsis
Verify DUT responds to ICMPv6 Echo Requests to the All-Routers group from a global prefix icmpv6_7 Verify DUT responds to ICMPv6 Echo Requests to the All-Routers group from a global prefix


    step 1. Initiate an outbound ICMPv6 Ping to ff02::2 from the global-prefix
    step 2. Verify ICMPv6 Echo Reply is received


    References:

    IETF RFC 4443 "Internet Control Message Protocol (ICMPv6) for the Internet Protocol Version 6 (IPv6) Specification"

    https://tools.ietf.org/html/rfc4443
Test Name Synopsis
Verify DUT responds to ICMPv6 Echo Requests sent to the All-Nodes group from a link-local address icmpv6_8 Verify DUT responds to ICMPv6 Echo Requests sent to the All-Nodes group from a link-local address


    step 1. Send an ICMPv6 Echo Request from the LAN to the All-Nodes Multicast group (ff02::1)
    step 2. Wait for an ICMPv6 Echo Response
    step 3. Verify the Echo Response is from the DUT
    step 4. Continue waiting until the DUT responds, or timeout


    References:

    IETF RFC 4443 "Internet Control Message Protocol (ICMPv6) for the Internet Protocol Version 6 (IPv6) Specification"

    https://tools.ietf.org/html/rfc4443
Test Name Synopsis
Verify DUT responds to ICMPv6 Echo Requests to the All-Nodes group from a global IPv6 address icmpv6_9 Verify DUT responds to ICMPv6 Echo Requests to the All-Nodes group from a global IPv6 address


    step 1. Send an ICMPv6 Echo Request from the LAN to the All-Nodes Multicast group (ff02::1)
    step 2. Wait for an ICMPv6 Echo Response
    step 3. Verify the Echo Response is from the DUT
    step 4. Continue waiting until the DUT responds, or timeout


    References:

    IETF RFC 4443 "Internet Control Message Protocol (ICMPv6) for the Internet Protocol Version 6 (IPv6) Specification"

    https://tools.ietf.org/html/rfc4443
Test Name Synopsis
Verify ICMPv6 Time Exceeded packet is sent when incoming Hop Limit is 0 or 1 on LAN icmpv6_10 Verify ICMPv6 Time Exceeded packet is sent when incoming Hop Limit is 0 or 1 on LAN


    step 1. Set the IPv6 Hop Limit of outbound packets on the LAN to 0
    step 2. Forward an IPv6 packet from a LAN client to the IPv6 WAN remote host
    step 3. Verify that the DUT does not forward the IPv6 packet to the IPv6 WAN
            remote host
    step 4. Verify that the DUT sends an ICMPv6 Time Exceeded packet to the LAN
            client
    step 5. Verify the ICMPv6 Time Exceeded packet contains the IPv6 header of
            the original packet
    step 6. Repeat steps 1 through 4 using an IPv6 Hop Limit of 1

    Note: This test is similar to icmpv6_32. The primary difference is that
    icmpv6_32 verifies that the DUT sends an ICMPv6 Time Exceeded when it
    receives a packet with a Hop Limit of 0 or 1 on the WAN side while this test
    verifies that the DUT sends an ICMPv6 Time Exceeded when it receives a
    packet with a Hop Limit of 0 or 1 on the LAN side.


    References:

    IETF RFC 4443 "Internet Control Message Protocol (ICMPv6) for the Internet Protocol Version 6 (IPv6) Specification" Section 3.3: Time Exceeded Message

    If a router receives a packet with a Hop Limit of zero, or if a
    router decrements a packet's Hop Limit to zero, it MUST discard the
    packet and originate an ICMPv6 Time Exceeded message with Code 0 to
    the source of the packet.  This indicates either a routing loop or
    too small an initial Hop Limit value.

    https://tools.ietf.org/html/rfc4443#section-3.3
Test Name Synopsis
Verify DUT forwards inbound ICMPv6 Time Exceeded icmpv6_11 Verify DUT forwards inbound ICMPv6 Time Exceeded


    step 1. Forward a UDP packet from a LAN client to the WAN
    step 2. Verify packet is received on WAN side
    step 3. Send ICMPv6 Time Exceeded packet with original UDP packet as data
    step 4. Verify ICMPv6 Time Exceeded packet is received by LAN host
    step 5. Verify the contents of the original IP packet included
            in the ICMPv6 Time Exceeded packet


    References:

    IETF RFC 4443 "Internet Control Message Protocol (ICMPv6) for the Internet Protocol Version 6 (IPv6) Specification"

    https://tools.ietf.org/html/rfc4443
Test Name Synopsis
Verify DUT forwards inbound ICMPv6 Destination Unreachable icmpv6_12 Verify DUT forwards inbound ICMPv6 Destination Unreachable


    step 1. Forward a UDP packet from a LAN client to the WAN
    step 2. Verify packet is received on WAN side
    step 3. Send ICMPv6 Destination Unreachable packet with original UDP packet as data
    step 4. Verify ICMPv6 Destination Unreachable is received by LAN host
    step 5. Verify the contents of the original IPv6 packet included
            in the ICMPv6 Destination Unreachable packet


    References:

    IETF RFC 4443 "Internet Control Message Protocol (ICMPv6) for the Internet Protocol Version 6 (IPv6) Specification"

    https://tools.ietf.org/html/rfc4443
Test Name Synopsis
Verify DUT forwards inbound ICMPv6 Packet Too Big messages icmpv6_13 Verify DUT forwards inbound ICMPv6 Packet Too Big messages


    step 1. Forward a UDP packet from a LAN client to the WAN
    step 2. Verify packet is received on WAN side
    step 3. Send ICMPv6 Packet Too Big packet with MTU size 1280
    step 4. Verify ICMPv6 Packet Too Big is received by LAN host
    step 5. Verify the received MTU in Packet Too Big message is unchanged


    References:

    IETF RFC 4443 "Internet Control Message Protocol (ICMPv6) for the Internet Protocol Version 6 (IPv6) Specification"

    https://tools.ietf.org/html/rfc4443
Test Name Synopsis
Verify DUT forwards inbound ICMPv6 Parameter Problem icmpv6_14 Verify DUT forwards inbound ICMPv6 Parameter Problem


    step 1. Forward a UDP packet from a LAN client to the WAN
    step 2. Verify packet is received on WAN side
    step 3. Send ICMPv6 Parameter Problem packet with pointer value of 40
    step 4. Verify ICMPv6 Parameter Problem is received by LAN host
    step 5. Verify the pointer value is unchanged
    step 6. Verify the contents of the include IPv6 packet in the ICMPv6 packet


    References:

    IETF RFC 4443 "Internet Control Message Protocol (ICMPv6) for the Internet Protocol Version 6 (IPv6) Specification"

    https://tools.ietf.org/html/rfc4443
Test Name Synopsis
Verify DUT supports Path MTU Discovery over WAN interface icmpv6_20 Verify DUT supports Path MTU Discovery over WAN interface


    step 1. Send 1500 byte UDP packet
    step 2. Check for an ICMPv6 Packet Too Big packet with code = 0
    step 3. Repeat process 2 more times until an ICMPv6 Packet Too Big
            is received, or all 3 packets are sent
    step 4. If an ICMPv6 Packet Too Big packet was sent, verify that
            the code value is 0 and verify the MTU value in the ICMP header
    step 5. Reduce the UDP packet size by 1 byte and repeat the process
            until no ICMPv6 Packet Too Big packet is sent
    step 6. When a packet size is found that does not generate an
            ICMPv6 Packet Too Big message,verify packets can be
            forwarded using this packet size
    step 7. Verify the final MTU size is the same as the MTU size
            reported in the ICMPv6 Packet Too Big packet

    NOTE: This test starts with an initial MTU of 1500. If the WAN interface
          already supports this MTU (DHCP), then this test will pass without
          exercising the real part of Path MTU Discovery.

    NOTE: Some devices rate limit the number of ICMP packets that may be
          sent. This test will send 3 UDP packets over a 15 second window
          in order to generate an ICMP Packet Too Big packet. If the
          router under test uses rate limiting on ICMP packets, it must allow
          at least one ICMP packet every 10 seconds.


    References:

    IETF RFC 1981 "Path MTU Discovery for IP version 6"

    https://tools.ietf.org/html/rfc1981
Test Name Synopsis
Verify Path MTU value is consistent with Router Advertisement MTU value icmpv6_30 Verify Path MTU value is consistent with Router Advertisement MTU value


    step 1. Send a Router Solicitation from LAN side
    step 2. Verify a Router Advertisement with an MTU option is
            received on LAN side
    step 3. Send 1500 byte UDP packet
    step 4. Check for an ICMPv6 Packet Too Big packet
    step 5. Repeat process 2 more times until an ICMPv6 Packet Too Big
            is received, or all 3 packets are sent
    step 6. If an ICMPv6 Packet Too Big packet was sent, verify that
            the MTU value is less than or equal to the MTU option
            contained in the Router Advertisement.
    step 7. Reduce the UDP packet size by 1 byte and repeat the process
            until no ICMPv6 Packet Too Big packet is sent
    step 8. Verify the final MTU size is less than or equal to the MTU
            option contained in the Router Advertisement.

    NOTE: This test starts with an initial MTU of 1500. If the WAN interface
          already supports this MTU (DHCP), then this test will pass without
          exercising the real part of Path MTU Discovery.

    NOTE: Some devices rate limit the number of ICMP packets that may be
          sent. This test will send 3 UDP packets over a 15 second window
          in order to generate an ICMP Packet Too Big packet. If the
          router under test uses rate limiting on ICMP packets, it must allow
          at least one ICMP packet every 10 seconds.


    References:

    IETF RFC 1981 "Path MTU Discovery for IP version 6"

    https://tools.ietf.org/html/rfc1981
Test Name Synopsis
Verify Packet Too Big messages as IPv6 WAN MTU changes icmpv6_31 Verify Packet Too Big messages as IPv6 WAN MTU changes


    step 1. Send an ICMPv6 Router Advertisement on the WAN containing the
            current WAN IPv6 MTU.
    step 2. Send a UDP packet equal to the current WAN IPv6 MTU from a LAN
            client to a WAN server.
    step 3. Verify an ICMPv6 Packet Too Big message is not sent.
    step 4. Repeat steps 2-3 two more times.
    step 5. Send a UDP packet greater than the current WAN IPv6 MTU from a LAN
            client to a WAN server; if the LAN MTU is too small to permit this
            packet to be sent, a warning will be generated.
    step 6. Verify an ICMPv6 Packet Too Big message is sent and includes the
            current WAN IPv6 MTU.
    step 7. Repeat steps 5-6 two more times.
    step 8. Repeat steps 1-7, decrementing the current WAN IPv6 MTU by 20 on
            each iteration until the WAN IPv6 MTU falls below the minimum IPv6
            link MTU of 1280.

    NOTE: Some devices rate limit the number of ICMP packets that may be
          sent. This test will send 3 UDP packets over a 15 second window
          in order to generate an ICMP Packet Too Big packet. If the
          router under test uses rate limiting on ICMP packets, it must allow
          at least one ICMP packet every 10 seconds.


    References:

    IETF RFC 4443 "Internet Control Message Protocol (ICMPv6) for the Internet Protocol Version 6 (IPv6) Specification" Section 3.2: Packet Too Big Message

    https://tools.ietf.org/html/rfc4443#section-3.2

    IETF RFC 4861 "Neighbor Discovery for IP version 6 (IPv6)" Section 6.3.4: Processing Received Router Advertisements

    https://tools.ietf.org/html/rfc4861#section-6.3.4
Test Name Synopsis
Verify ICMPv6 Time Exceeded packet is sent when incoming Hop Limit is 0 or 1 on WAN icmpv6_32 Verify ICMPv6 Time Exceeded packet is sent when incoming Hop Limit is 0 or 1 on WAN


    step 1. Set the IPv6 Hop Limit on the IPv6 WAN remote host to 0
    step 2. Forward an IPv6 packet from a LAN client to the IPv6 WAN remote host
    step 3. Send response from the IPv6 WAN remote host to the LAN client with
            an IPv6 Hop Limit of 0
    step 4. Verify that the DUT sends an ICMPv6 Time Exceeded packet to the IPv6
            WAN remote host
    step 5. Verify the ICMPv6 Time Exceeded packet contains the IPv6 header of
            the original packet
    step 6. Repeat steps 1 through 5 using an IPv6 Hop Limit of 1

    Note: This test is similar to icmpv6_10. The primary difference is that
    icmpv6_10 verifies that the DUT sends an ICMPv6 Time Exceeded when it
    receives a packet with a Hop Limit of 0 or 1 on the LAN side while this test
    verifies that the DUT sends an ICMPv6 Time Exceeded when it receives a
    packet with a Hop Limit of 0 or 1 on the WAN side.


    References:

    IETF RFC 4443 "Internet Control Message Protocol (ICMPv6) for the Internet Protocol Version 6 (IPv6) Specification" Section 3.3: Time Exceeded Message

    If a router receives a packet with a Hop Limit of zero, or if a
    router decrements a packet's Hop Limit to zero, it MUST discard the
    packet and originate an ICMPv6 Time Exceeded message with Code 0 to
    the source of the packet.  This indicates either a routing loop or
    too small an initial Hop Limit value.

    https://tools.ietf.org/html/rfc4443#section-3.3
Test Name Synopsis
Verify DUT responds to ICMPv6 Echo Request with Hop Limit of 0 on the LAN icmpv6_33 Verify DUT responds to ICMPv6 Echo Request with Hop Limit of 0 on the LAN


    step 1. Determine expected DUT global address
    step 2. Initiate an inbound ICMPv6 Echo Request to the DUT's global address
            from the LAN with Hop Limit of 0
    step 3. Verify the device responds to the ICMPv6 Echo Request


    References:

    IETF RFC 8200 "Internet Protocol, Version 6 (IPv6) Specification" Section 3: IPv6 Header Format

    When forwarding, the packet is discarded if Hop Limit was zero
    when received or is decremented to zero.  A node that is the
    destination of a packet should not discard a packet with Hop Limit
    equal to zero; it should process the packet normally.

    https://tools.ietf.org/html/rfc8200#section-3
Test Name Synopsis
Verify DUT responds to ICMPv6 Echo Request with Hop Limit of 0 on the WAN icmpv6_34 Verify DUT responds to ICMPv6 Echo Request with Hop Limit of 0 on the WAN


    step 1. Determine expected DUT global address
    step 2. Initiate an inbound ICMPv6 Echo Request to the DUT's global address
            from the WAN with Hop Limit of 0
    step 3. Verify the device behaves as expected

    Note: the testvar ipv6WanPingRespond is used to determine if pinging the WAN
    side of the DUT is expected to work or not.  It defaults to "no" which
    signifies that the device will not respond to IPv6 pings on its WAN
    interface.


    References:

    IETF RFC 8200 "Internet Protocol, Version 6 (IPv6) Specification" Section 3: IPv6 Header Format

    When forwarding, the packet is discarded if Hop Limit was zero
    when received or is decremented to zero.  A node that is the
    destination of a packet should not discard a packet with Hop Limit
    equal to zero; it should process the packet normally.

    https://tools.ietf.org/html/rfc8200#section-3

firewall-v6.tcl

IPv6 Firewall tests including port scans

Test Name Synopsis
Inbound TCP connections to public side HTTP port are blocked ipv6_firewall_1 Inbound TCP connections to public side HTTP port are blocked


    step 1. Initiate a WAN TCP connection to the DUT's global IPv6 address management port
    step 2. Verify the connection is not established

    NOTE: The value of the DUT's IPv6 address management port is taken
          from the default insecure management port defined as the
          first port in the value of testvar dutMgmtPort.  Please read
          the documentation for dutMgmtPort for more information about
          the default insecure management port concept and its usage.
Test Name Synopsis
Inbound TCP connections to LAN hosts are blocked ipv6_firewall_2 Inbound TCP connections to LAN hosts are blocked


    step 1. Initiate a WAN TCP connection to a LAN client address
    step 2. Verify that the TCP connection is not established and that the DUT
            drops the initial TCP Syn packet
Test Name Synopsis
TCP port scan the LAN Client from WAN to verify the DUT does not forward unsolicited packets ipv6_firewall_100 TCP port scan the LAN Client from WAN to verify the DUT does not forward unsolicited packets


    step 1. Send TCP SYN packets from WAN to each port of the LAN Client in the port scan range
    step 2. Verify that each packet is not forwarded to the LAN IPv6 Client,
            unless the port is configured as open.

    NOTE: The speed of the scan can be adjusted using the 'portScanDelay'
    testvar. By default, it is set to 1. The value indicates the number of
    milliseconds to wait in between the sending of each packet:

    testvar portScanDelay 100

    NOTE: The list of closed and open ports can be configured using the
    'ipv6FirewallTcpClosedPorts' and 'ipv6FirewallTcpOpenPorts' testvars:

    testvar ipv6FirewallTcpClosedPorts "2323"
    testvar ipv6FirewallTcpOpenPorts "22 443"
Test Name Synopsis
UDP port scan the LAN Client from WAN to verify the DUT does not forward unsolicited packets ipv6_firewall_101 UDP port scan the LAN Client from WAN to verify the DUT does not forward unsolicited packets


    step 1. Send UDP packets from WAN to each port of the LAN Client in the port scan range
    step 2. Verify that each packet is not forwarded to the LAN IPv6 Client,
            unless the port is configured as open.

    NOTE: The speed of the scan can be adjusted using the 'portScanDelay'
    testvar. By default, it is set to 1. The value indicates the number of
    milliseconds to wait in between the sending of each packet:

    testvar portScanDelay 100

    NOTE: The list of closed and open ports can be configured using the
    'ipv6FirewallTcpClosedPorts' and 'ipv6FirewallTcpOpenPorts' testvars:

    testvar ipv6FirewallUdpClosedPorts "2323"
    testvar ipv6FirewallUdpOpenPorts "22 443"
Test Name Synopsis
TCP fragmentation port scan test to verify the DUT does not forward unsolicited packets ipv6_firewall_110 TCP fragmentation port scan test to verify the DUT does not forward unsolicited packets


    step 1. Set the IPv6 fragmentation size to 56 bytes
    step 2. Send TCP SYN packets from WAN to each port in the port scan range
            of the LAN Client
    step 3. Verify packets are not forwarded to LAN Client
    step 4. Verify the router does not accept the TCP connection or
            send a RST for the TCP connection unless the port has
            been configured as an open or closed port
    step 5. Do not flag ports that have port forwarding configured

    NOTE: The speed of the scan can be adjusted using the 'portScanDelay'
    testvar. By default, it is set to 1. The value indicates the number of
    milliseconds to wait in between the sending of each packet:

    testvar portScanDelay 100

    NOTE: The list of closed and open ports can be configured using the
    'firewallTcpClosedPorts' and 'firewallTclOpenPorts' testvars:

    testvar ipv6FirewallTcpClosedPorts "2323"
    testvar ipv6FirewallTcpOpenPorts "22 443"
Test Name Synopsis
Verify firewall blocks/accepts piggyback TCP SYN connections from WAN ipv6_firewall_301 Verify firewall blocks/accepts piggyback TCP SYN connections from WAN


    step 1. Send a TCP SYN from LAN host to IP address on WAN
    step 2. Send a TCP SYN from the WAN host to the original LAN host
            using the same TCP source port
    step 3. If the router blocks simultaneous TCP SYNs
            (testvar 'natSimultaneousTcp' is set to no), verify the TCP
            SYN from the WAN is dropped

            OR

            If the router supports simultaneous TCP SYNs
            (testvar 'natSimultaneousTcp' is set to yes), verify the TCP
            SYN from the WAN is forwarded to the LAN

    step 4. Repeat step 1 using new TCP port numbers
    step 5. Send a TCP SYN from the WAN host to the original LAN host
            using a new TCP source port
    step 6. Verify the TCP SYN from the WAN is dropped

    NOTE: This test verifies that the firewall only allows TCP packets
    for established TCP sessions. If simultaneous TCP open is supported through
    the firewall, this test will verify that TCP SYN packets from the WAN are
    forwarded to the LAN. If simultaneous TCP open through the firewall is
    not supported, the test will verify that no TCP SYN packets are allowed
    from the WAN to the LAN for sessions that have been initiated from the LAN.

    NOTE: The testvar natSimultaneousTcp originates from IPv4 concepts. However,
    this testvar is used to indicate if this same behavior exists for IPv6.
Test Name Synopsis
Verify outbound packets with forbidden source addresses are not forwarded onto the WAN ipv6_firewall_505 Verify outbound packets with forbidden source addresses are not forwarded onto the WAN


    step 1. Configure a variety of invalid source addresses for traffic
    step 2. Send traffic with these addresses to the WAN
    step 3. Verify packets are not forwarded


    References:

    IETF RFC 6092 "Simple Security in IPv6 Gateway CPE" Section 3.1: Stateless Filters

    REC-1: Packets bearing multicast source addresses in their outer IPv6
    headers MUST NOT be forwarded or transmitted on any interface.

    REC-2: Packets bearing multicast destination addresses in their outer
    IPv6 headers of equal or narrower scope (see "IPv6 Scoped Address
    Architecture" [RFC4007]) than the configured scope boundary level of
    the gateway MUST NOT be forwarded in any direction.  The DEFAULT
    scope boundary level SHOULD be organization-local scope, and it
    SHOULD be configurable by the network administrator.

    https://tools.ietf.org/html/rfc6092#section-3.1
Test Name Synopsis
Verify inbound packets with forbidden source addresses are not forwarded onto the LAN ipv6_firewall_506 Verify inbound packets with forbidden source addresses are not forwarded onto the LAN


    Step 1. Create a new vnode on the RemoteHostv6
    Step 2. Send UDP traffic to the LAN with forbidden sources from vnode
    Step 3. Verify traffic is not forwarded onto the LAN


    References:

    IETF RFC 6092 "Simple Security in IPv6 Gateway CPE" Section 3.1: Stateless Filters

    REC-1: Packets bearing multicast source addresses in their outer IPv6
    headers MUST NOT be forwarded or transmitted on any interface.

    REC-2: Packets bearing multicast destination addresses in their outer
    IPv6 headers of equal or narrower scope (see "IPv6 Scoped Address
    Architecture" [RFC4007]) than the configured scope boundary level of
    the gateway MUST NOT be forwarded in any direction.  The DEFAULT
    scope boundary level SHOULD be organization-local scope, and it
    SHOULD be configurable by the network administrator.

    https://tools.ietf.org/html/rfc6092#section-3.1
Test Name Synopsis
Verify outbound packets are not forwarded if the source address is not a prefix of the interior network ipv6_firewall_508 Verify outbound packets are not forwarded if the source address is not a prefix of the interior network


    step 1. Create a new LAN client
    step 2. Assign a different global prefix to the LAN
    step 3. Send traffic to the WAN from the martian source address
    step 4. Verify traffic is not forwarded


    References:

    IETF RFC 6092 "Simple Security in IPv6 Gateway CPE" Section 3.1: Stateless Filters

    REC-5: Outbound packets MUST NOT be forwarded if the source address
    in their outer IPv6 header does not have a unicast prefix configured
    for use by globally reachable nodes on the interior network.

    https://tools.ietf.org/html/rfc6092#section-3.1
Test Name Synopsis
Verify inbound packets are not forwarded if the source address is assigned for use on the interior network ipv6_firewall_509 Verify inbound packets are not forwarded if the source address is assigned for use on the interior network


    step 1. Create a new stack on the remoteHost
    step 2. Assign the stack the same global prefix as is used on the LAN
    step 3. Send traffic to the LAN from the remote stack
    step 4. Verify traffic is NOT forwarded to the LAN


    References:

    IETF RFC 6092 "Simple Security in IPv6 Gateway CPE" Section 3.1: Stateless Filters

    REC-6: Inbound packets MUST NOT be forwarded if the source address in
    their outer IPv6 header has a global unicast prefix assigned for use
    by globally reachable nodes on the interior network.

    https://tools.ietf.org/html/rfc6092#section-3.1
Test Name Synopsis
Verify outbound packets with link local source addresses are not forwarded to the WAN ipv6_firewall_510 Verify outbound packets with link local source addresses are not forwarded to the WAN


    step 1. Send traffic from the LAN to the WAN with a link-local source address
    step 2. Verify traffic is not forwarded to the WAN
Test Name Synopsis
Verify inbound packets with link local source addresses are not forwarded to the LAN ipv6_firewall_511 Verify inbound packets with link local source addresses are not forwarded to the LAN


    step 1. Initiate a new UDP session with the device to allow inbound traffic
    step 2. Configure a new stack on the WAN with a link-local prefix as the source
    step 3. Send traffic from this new stack to the LAN
    step 4. Verify traffic is not forwarded to the LAN
Test Name Synopsis
Verify inbound IPv6 DNS queries on the WAN are not processed by DNS proxy ipv6_firewall_512 Verify inbound IPv6 DNS queries on the WAN are not processed by DNS proxy


    step 1. Initiate an AAAA IPv6 DNS query from the LAN client to the DUT's
            global IPv6 address
    step 2. Verify that the query is received by either the primary or backup
            DNS server on the WAN
    step 3. Verify that the DNS response is received by the LAN client
    step 4. Initiate an AAAA IPv6 DNS query from a remote host on the WAN to the
            DUT's global IPv6 address
    step 5. Verify that a DNS response is not received by the remote host on the
            WAN that initiated the original request


    References:

    IETF RFC 6092 "Simple Security in IPv6 Gateway CPE" Section 3.1: Stateless Filters

    REC-8: By DEFAULT, inbound DNS queries received on exterior
    interfaces MUST NOT be processed by any integrated DNS resolving
    server.

    https://tools.ietf.org/html/rfc6092#section-3.1
Test Name Synopsis
Verify inbound DHCPv6 discovery packets on the WAN are not processed by DHCPv6 server ipv6_firewall_513 Verify inbound DHCPv6 discovery packets on the WAN are not processed by DHCPv6 server


    step 1. Start new DHCPv6 client on WAN interface
    step 2. Verify new client does not obtain an IPv6 address via DHCPv6 from
            the DUT
    step 3. Send three pings from LAN to WAN to verify that the DUT is still
            operating properly


    References:

    IETF RFC 6092 "Simple Security in IPv6 Gateway CPE" Section 3.1: Stateless Filters

    REC-9: Inbound DHCPv6 discovery packets [RFC3315] received on
    exterior interfaces MUST NOT be processed by any integrated DHCPv6
    server or relay agent.

    https://tools.ietf.org/html/rfc6092#section-3.1
Test Name Synopsis
Verify ICMPv6 Destination Unreachable message from WAN does not destroy UDP firewall state ipv6_firewall_540 Verify ICMPv6 Destination Unreachable message from WAN does not destroy UDP firewall state


    step 1. Send IPv6 UDP packet from LAN to WAN
    step 2. Verify UDP packet is received on the WAN and return an ICMPv6 Destination Unreachable message
    step 3. Verify ICMPv6 Destination Unreachable message is received on the LAN
    step 4. Send UDP response from WAN to LAN
    step 5. Verify UDP response is received on LAN since IPv6 firewall state is still present


    References:

    IETF RFC 6092 "Simple Security in IPv6 Gateway CPE" Section 3.2.3: UDP Filters

    REC-18: If a gateway forwards a UDP flow, it MUST also forward ICMPv6
    "Destination Unreachable" and "Packet Too Big" messages containing
    UDP headers that match the flow state record.

    REC-19: Receipt of any sort of ICMPv6 message MUST NOT terminate the
    state record for a UDP flow.

    https://tools.ietf.org/html/rfc6092#section-3.2.3
Test Name Synopsis
Verify ICMPv6 Destination Unreachable message from WAN does not destroy TCP firewall state ipv6_firewall_541 Verify ICMPv6 Destination Unreachable message from WAN does not destroy TCP firewall state


    step 1. Establish TCP connection from LAN to WAN
    step 2. Send an ICMPv6 Destination Unreachable message from the WAN for the connection
    step 3. Verify ICMPv6 Destination Unreachable message is received on the LAN
    step 4. Send TCP data segment from WAN to LAN for the session
    step 5. Verify TCP data segment is received on LAN since IPv6 firewall state is still present


    References:

    IETF RFC 6092 "Simple Security in IPv6 Gateway CPE" Section 3.3.1: TCP Filters

    REC-36: If a gateway forwards a TCP flow, it MUST also forward ICMPv6
    "Destination Unreachable" and "Packet Too Big" messages containing
    TCP headers that match the flow state record.

    REC-37: Receipt of any sort of ICMPv6 message MUST NOT terminate the
    state record for a TCP flow.

    https://tools.ietf.org/html/rfc6092#section-3.3.1
Test Name Synopsis
Verify ICMPv6 Packet Too Big message from WAN does not destroy UDP firewall state ipv6_firewall_542 Verify ICMPv6 Packet Too Big message from WAN does not destroy UDP firewall state


    step 1. Send IPv6 UDP packet from LAN to WAN
    step 2. Verify UDP packet is received on the WAN and return an ICMPv6 Packet Too Big message
    step 3. Verify ICMPv6 Too Big message is received on the LAN
    step 4. Send UDP response from WAN to LAN
    step 5. Verify UDP response is received on LAN since IPv6 firewall state is still present


    References:

    IETF RFC 6092 "Simple Security in IPv6 Gateway CPE" Section 3.2.3: UDP Filters

    REC-18: If a gateway forwards a UDP flow, it MUST also forward ICMPv6
    "Destination Unreachable" and "Packet Too Big" messages containing
    UDP headers that match the flow state record.

    REC-19: Receipt of any sort of ICMPv6 message MUST NOT terminate the
    state record for a UDP flow.

    https://tools.ietf.org/html/rfc6092#section-3.2.3
Test Name Synopsis
Verify ICMPv6 Packet Too Big message from WAN does not destroy TCP firewall state ipv6_firewall_543 Verify ICMPv6 Packet Too Big message from WAN does not destroy TCP firewall state


    step 1. Establish TCP connection from LAN to WAN
    step 2. Send an ICMPv6 Packet Too Big message from the WAN for the connection
    step 3. Verify ICMPv6 Packet Too Big message is received on the LAN
    step 4. Send TCP data segment from WAN to LAN for the session
    step 5. Verify TCP data segment is received on LAN since IPv6 firewall state is still present


    References:

    IETF RFC 6092 "Simple Security in IPv6 Gateway CPE" Section 3.3.1: TCP Filters

    REC-36: If a gateway forwards a TCP flow, it MUST also forward ICMPv6
    "Destination Unreachable" and "Packet Too Big" messages containing
    TCP headers that match the flow state record.

    REC-37: Receipt of any sort of ICMPv6 message MUST NOT terminate the
    state record for a TCP flow.

    https://tools.ietf.org/html/rfc6092#section-3.3.1

firewall-out-v6.tcl

IPv6 Firewall tests for limiting outbound access to services

Test Name Synopsis
Verify CPE does not forward outbound TCP packets to ports that have been administratively blocked ipv6_firewall_outbound_1 Verify CPE does not forward outbound TCP packets to ports that have been administratively blocked


    step 1. Configure the DUT to block outbound access from the LAN to specific
            TCP ports
    step 2. Send a TCP SYN packet from the LAN to each blocked port
    step 3. Verify the DUT does not forward TCP packets to any of the blocked
            ports

    The ipv6FirewallOutBlockedTcpPorts testvar is used to determine the list of
    TCP ports  that the DUT has been configured to block access to.
Test Name Synopsis
Verify CPE does not forward outbound UDP packets to ports that have been administratively blocked ipv6_firewall_outbound_2 Verify CPE does not forward outbound UDP packets to ports that have been administratively blocked


    step 1. Configure the DUT to block outbound access from the LAN to specific
            UDP ports
    step 2. Send a UDP packet from the LAN to each blocked port
    step 3. Verify the DUT does not forward UDP packets to any of the blocked
            ports

    The ipv6FirewallOutBlockedUdpPorts testvar is used to determine the list of
    UDP ports  that the DUT has been configured to block access to.
Test Name Synopsis
Verify CPE does not forward outbound IP packets for protocols that have been administratively blocked ipv6_firewall_outbound_3 Verify CPE does not forward outbound IP packets for protocols that have been administratively blocked


    step 1. Configure the DUT to block outbound access from the LAN to specific
            IP Protocol types
    step 2. Send an IP packet from the LAN to the WAN for each blocked IP
            protocol
    step 3. Verify the DUT does not forward any of the blocked IP protocols

    The ipv6FirewallOutBlockedIpProtos testvar is used to determine the list of
    IP Protocol types that the DUT has been configured to block access to.

apps-v6.tcl

Application tests for IPv6

Test Name Synopsis
Verify IPv6 HTTP session through the router ipv6_app_100 Verify IPv6 HTTP session through the router


    step 1. Initiate an outbound TCP connection to HTTP server over IPv6
    step 2. Verify the TCP connection is established
    step 3. Verify the IPv6 source address on the WAN side is the LAN client's address
    step 4. Send HTTP GET request to server
    step 5. Verify HTTP response is received
    step 6. Close TCP connection from LAN side
Test Name Synopsis
Verify IPv6 HTTPS session through the router ipv6_app_110 Verify IPv6 HTTPS session through the router


    step 1. Initiate an outbound TCP connection to HTTPS server over IPv6
    step 2. Verify the TCP connection is established
    step 3. Verify the IPv6 source address on the WAN side is the LAN client's address
    step 4. Verify the TLS session is established
    step 5. Send HTTPS GET request to server
    step 6. Verify HTTPS response is received
    step 7. Close TCP connection from LAN side
Test Name Synopsis
Verify IPv6 DNS query through the router ipv6_app_112 Verify IPv6 DNS query through the router


    step 1. Enable a DNS server on the IPv6 remoteHost
    step 2. Initiate an AAAA IPv6 DNS query to the IPv6 remoteHost
    step 3. Verify the query is received by the correct DNS server
            (depends on the value of dnsCaptive) on the WAN side
    step 4. Send a return response back to LAN
    step 5. Verify the response is received by LAN client

    NOTE: The router must support some type of DNS relay or proxy to
    pass this test case. The DNS relay or proxy must understand IPv6 DNS
    type AAAA lookups.

    NOTE: If the testvar dnsCaptive is set to yes, the test will expect
    DNS queries to be sent to the original WAN side DNS servers and
    not the 3rd party DNS server.


    References:

    IETF RFC 4074 "Common Misbehavior Against DNS Queries for IPv6 Addresses"

    https://tools.ietf.org/html/rfc4074
Test Name Synopsis
Verify IPv6 FTP session through the router ipv6_app_114 Verify IPv6 FTP session through the router


    step 1. Initiate an outbound TCP connection to FTP server port
    step 2. Verify the connection is established
    step 3. Send the FTP EPRT command using all upper case letters
    step 4. Verify router translates EPRT command using router's address
    step 5. Initiate inbound TCP connection for FTP data connection
    step 6. Verify inbound TCP connection is established
    step 7. Close both connections


    References:

    IETF RFC 2428 "FTP Extensions for IPv6 and NATs"

    https://tools.ietf.org/html/rfc2428
Test Name Synopsis
Verify IPv6 SMTP session through the router ipv6_app_120 Verify IPv6 SMTP session through the router


    step 1. Initiate an outbound TCP connection to SMTP server
    step 2. Send email message using SMTP server
    step 3. Verify SMTP server correctly receives email message
    step 4. Close SMTP session from LAN side


    References:

    IETF RFC 821 "SIMPLE MAIL TRANSFER PROTOCOL"

    https://tools.ietf.org/html/rfc821
Test Name Synopsis
Verify IPv6 POP3 session through the router ipv6_app_122 Verify IPv6 POP3 session through the router


    step 1. Initiate an outbound TCP connection to POP3 server
    step 2. Retreive email messages using POP3 protocol
    step 3. Verify POP3 server correctly returns email messages
    step 4. Close POP3 session from LAN side


    References:

    IETF RFC 1939 "Post Office Protocol - Version 3"

    https://tools.ietf.org/html/rfc1939
Test Name Synopsis
Verify IPv6 TFTP session through the router ipv6_app_124 Verify IPv6 TFTP session through the router


    step 1. Startup a TFTP server on the WAN
    step 2. Initiate an outbound TFTP connection to TFTP server from LAN
    step 3. Send TFTP GET to receive file via TFTP
    step 4. Verify TFTP server correctly returns file via TFTP
    step 5. Close TFTP session from LAN side


    References:

    IETF RFC 1350 "THE TFTP PROTOCOL (REVISION 2)"

    https://tools.ietf.org/html/rfc1350
Test Name Synopsis
Verify IPv6 NTP session through the router ipv6_app_126 Verify IPv6 NTP session through the router


    step 1. Initiate an outbound NTP connection to NTP server
    step 2. Verify NTP request is sent to the WAN
    step 3. Verify NTP response is sent to LAN client
Test Name Synopsis
Verify IPv6 STUN session through the router ipv6_app_130 Verify IPv6 STUN session through the router


    step 1. Initiate an outbound STUN Binding Request to remoteHost
    step 2. Verify STUN Binding Response is received
    step 3. Verify the STUN MAPPED-ADDRESS matches the expected global IPv6
            address of the STUN client


    References:

    IETF RFC 3489 "STUN - Simple Traversal of User Datagram Protocol (UDP) Through Network Address Translators (NATs)"

    https://tools.ietf.org/html/rfc3489
Test Name Synopsis
Verify IPv6 authenticated STUN session through the router ipv6_app_131 Verify IPv6 authenticated STUN session through the router


    step 1. Configure STUN server and client to use authentication
    step 2. Initiate an outbound STUN Binding Request to remoteHost
    step 3. STUN server should sent back a 401 Binding Error Response
    step 4. STUN client retransmits Binding Request using message-integrity attribute
    step 5. Verify STUN Binding Response is received
    step 6. Verify the STUN MAPPED-ADDRESS matches the expected global IPv6
            address of the STUN client


    References:

    IETF RFC 3489 "STUN - Simple Traversal of User Datagram Protocol (UDP) Through Network Address Translators (NATs)"

    https://tools.ietf.org/html/rfc3489
Test Name Synopsis
Verify IPv6 L2GRE session through the router ipv6_app_140 Verify IPv6 L2GRE session through the router


    step 1. Enable L2GRE endpoint on the LAN client
    step 2. Create a new IPv6 address on the WAN for the other L2GRE endpoint
    step 3. Initiate an ICMPv6 ping from LAN to WAN using L2GRE tunnel
    step 4. Verify the ICMPv6 is successful


    References:

    IETF RFC 2784 "Generic Routing Encapsulation (GRE)"

    https://tools.ietf.org/html/rfc2784
Test Name Synopsis
Verify a Multipath TCP connection can be opened (IPv6) ipv6_mptcp_1 Verify a Multipath TCP connection can be opened (IPv6)


        step 1. Initiate MPTCP connection from LAN client to WAN server
        step 2. Verify MPTCP connection is established
        step 3. Verify MPTCP connection attributes on LAN client and
                WAN server match
        step 4. Close MPTCP connection


    References:

    IETF RFC 8684 "TCP Extensions for Multipath Operation with Multiple Addresses"

    https://tools.ietf.org/html/rfc8684
Test Name Synopsis
Verify a Multipath TCP connection with two subflows can be opened (IPv6) ipv6_mptcp_2 Verify a Multipath TCP connection with two subflows can be opened (IPv6)


        step 1. Initiate MPTCP connection from LAN client to WAN server
        step 2. Verify MPTCP connection is established
        step 3. Verify MPTCP connection attributes on LAN client and
                WAN server match
        step 4. Transmit data on MPTCP connection from LAN client
        step 5. Verify data is received by WAN server
        step 6. Initiate new MPTCP subflow on MPTCP connection from
                step 1
        step 7. Verify new MPTCP subflow is established
        step 8. Verify MPTCP subflow attributes on LAN client and WAN
                server match
        step 9. Transmit data on MPTCP connection from LAN client
        step 10. Verify data is received by WAN server
        step 11. Close MPTCP connection


    References:

    IETF RFC 8684 "TCP Extensions for Multipath Operation with Multiple Addresses"

    https://tools.ietf.org/html/rfc8684

forward-v6.tcl

IPv6 forwarding tests with different packet sizes and directions

Test Name Synopsis
Verify IPv6 Hop Limit is decremented for forwarded packets ipv6_forward_1 Verify IPv6 Hop Limit is decremented for forwarded packets

    step 1. Forward an IPv6 packet from a LAN client to the WAN
    step 2. Verify the Hop Limit of the packet is decremented by 1

    NOTE: Decremented by 1 by each node that forwards the packet.


    References:

    IETF RFC 2460 "Internet Protocol, Version 6 (IPv6) Specification" Section 3: IPv6 Header Format

    https://tools.ietf.org/html/rfc2460#section-3
Test Name Synopsis
Verify IPv6 packet is not forwarded when IPv6 Hop Limit is 1 or 0 ipv6_forward_2 Verify IPv6 packet is not forwarded when IPv6 Hop Limit is 1 or 0

    step 1. Set the IPv6 Hop Limit of outbound packets to 1
    step 2. Forward an IPv6 packet from a LAN client to the WAN
    step 3. Verify the packet is not forwarded
    step 4. Repeat the test with a Hop Limit of 0

    NOTE: The packet is discarded if Hop Limit is decremented to zero.


    References:

    IETF RFC 2460 "Internet Protocol, Version 6 (IPv6) Specification" Section 3: IPv6 Header Format

    https://tools.ietf.org/html/rfc2460#section-3
Test Name Synopsis
Verify IPv6 packet can be forwarded back through incoming LAN interface ipv6_forward_3 Verify IPv6 packet can be forwarded back through incoming LAN interface

    step 1. Forward an IP packet from a LAN client to another LAN client
    step 2. Forward packet using router's MAC address
    step 3. Verify packet is forwarded back out the LAN interface

    NOTE: The router may send an ICMP Redirect back to the originator.
Test Name Synopsis
Forward IPv6 UDP packets with various packet lengths (LAN to WAN) ipv6_forward_10 Forward IPv6 UDP packets with various packet lengths (LAN to WAN)

    step 1. Initiate an outbound UDP connection with UDP data length of 4
    step 2. Verify packets are received on the WAN interface
    step 3. Continue forwarding until the maximum unfragmented packet length is reached

    NOTE: Some routers will stop forwarding IP traffic while they renew their
    WAN side IPv4/IPv6 address. This can cause this test to fail.

    NOTE: Some routers allow static configuration of the MTU size. This may
    default to 1492 even for routers running DHCP on the WAN side.

    NOTE: This test will stop if the number of max failures is reached. This
    value may be configured using testvar forwardingMaxFailures. Setting this
    value to 0 will test each packet size regardless of the result.

    testvar forwardingMaxFailures 20
Test Name Synopsis
Forward IPv6 UDP packets with various packet lengths (WAN to LAN) ipv6_forward_11 Forward IPv6 UDP packets with various packet lengths (WAN to LAN)

    step 1. Initiate an outbound UDP connection with UDP data length of 4
    step 2. Verify packet is received on the WAN interface
    step 3. Forward a return packet from the WAN to the LAN
    step 4. Verify packets are received on the LAN interface
    step 5. Continue forwarding until the maximum unfragmented packet length is reached

    NOTE: Some routers will stop forwarding IP traffic while they renew their
    WAN side IPv6/IPv6 address. This can cause this test to fail.

    NOTE: Some routers allow static configuration of the MTU size. This may
    default to 1492 even for routers running DHCP on the WAN side.

    NOTE: This test will stop if the number of max failures is reached. This
    value may be configured using testvar forwardingMaxFailures. Setting this
    value to 0 will test each packet size regardless of the result.

    testvar forwardingMaxFailures 20

jumbo-v6.tcl

Jumbo MTU IPv6 forwarding tests with different packet sizes and directions

Test Name Synopsis
Verify IPv6 Hop Limit is decremented for forwarded jumbo MTU packets ipv6_jumbo_1 Verify IPv6 Hop Limit is decremented for forwarded jumbo MTU packets

    step 1. Forward an IPv6 packet from a LAN client to the WAN that utilizes
            the maximum supported jumbo mtu of both interfaces
    step 2. Verify the Hop Limit of the packet is decremented by 1

    NOTE: Decremented by 1 by each node that forwards the packet.

    NOTE: The maximum jumbo packet size is configured using the testvar
    jumboMtu.


    References:

    IETF RFC 2460 "Internet Protocol, Version 6 (IPv6) Specification" Section 3: Header Format

    https://tools.ietf.org/html/rfc2460#section-3
Test Name Synopsis
Verify jumbo MTU IPv6 packet is not forwarded when IPv6 Hop Limit is 1 or 0 ipv6_jumbo_2 Verify jumbo MTU IPv6 packet is not forwarded when IPv6 Hop Limit is 1 or 0

    step 1. Set the IPv6 Hop Limit of outbound packets to 1
    step 2. Forward an IPv6 packet from a LAN client to the WAN that utilizes
            the maximum supported jumbo mtu of both interfaces
    step 3. Verify the packet is not forwarded
    step 4. Repeat the test with a Hop Limit of 0

    NOTE: The packet is discarded if Hop Limit is decremented to zero.

    NOTE: The maximum jumbo packet size is configured using the testvar
    jumboMtu.


    References:

    IETF RFC 2460 "Internet Protocol, Version 6 (IPv6) Specification" Section 3: IPv6 Header Format

    https://tools.ietf.org/html/rfc2460#section-3
Test Name Synopsis
Verify jumbo MTU IPv6 packet can be forwarded back through incoming LAN interface ipv6_jumbo_3 Verify jumbo MTU IPv6 packet can be forwarded back through incoming LAN interface

    step 1. Forward an IP packet from a LAN client to another LAN client that
            utilizes the maximum supported jumbo mtu of both interfaces
    step 2. Forward packet using router's MAC address
    step 3. Verify packet is forwarded back out the LAN interface

    NOTE: The router may send an ICMP Redirect back to the originator.

    NOTE: The maximum jumbo packet size is configured using the testvar
    jumboMtu.
Test Name Synopsis
Forward jumbo MTU IPv6 UDP packets with various packet lengths (LAN to WAN) ipv6_jumbo_10 Forward jumbo MTU IPv6 UDP packets with various packet lengths (LAN to WAN)

    step 1. Initiate an outbound UDP connection with UDP packet that
            utilizes the maximum supported standard mtu of both interfaces
    step 2. Verify packets are received on the WAN interface
    step 3. Continue forwarding until the maximum unfragmented packet length is
            reached, i.e. maximum supported jumbo mtu of both interfaces

    NOTE: Some routers will stop forwarding IP traffic while they renew their
    WAN side IPv4/IPv6 address. This can cause this test to fail.

    NOTE: The maximum jumbo packet size is configured using the testvar
    jumboMtu.

    NOTE: This test will stop if the number of max failures is reached. This
    value may be configured using testvar forwardingMaxFailures. Setting this
    value to 0 will test each packet size regardless of the result.

    testvar forwardingMaxFailures 20
Test Name Synopsis
Forward jumbo MTU IPv6 UDP packets with various packet lengths (WAN to LAN) ipv6_jumbo_11 Forward jumbo MTU IPv6 UDP packets with various packet lengths (WAN to LAN)

    step 1. Initiate an outbound UDP connection with UDP packet that utilizes
            the maximum supported standard mtu of both interfaces
    step 2. Verify packet is received on the WAN interface
    step 3. Forward a return packet from the WAN to the LAN that utilizes the
            maximum supported standard mtu of both interfaces
    step 4. Verify packets are received on the LAN interface
    step 5. Continue forwarding until the maximum unfragmented packet length is
            reached, i.e maximum supported jumbo mtu of both interfaces

    NOTE: Some routers will stop forwarding IP traffic while they renew their
    WAN side IPv6/IPv6 address. This can cause this test to fail.

    NOTE: The maximum jumbo packet size is configured using the testvar
    jumboMtu.

    NOTE: This test will stop if the number of max failures is reached. This
    value may be configured using testvar forwardingMaxFailures. Setting this
    value to 0 will test each packet size regardless of the result.

    testvar forwardingMaxFailures 20

scaling-v6.tcl

Scaling tests for maximum number of IPv6 clients and connections (TCP, HTTP, etc)

Test Name Synopsis
Verify all IPv6 clients obtain an IPv6 address via autoconf or DHCPv6 and are operational ipv6_scale_1 Verify all IPv6 clients obtain an IPv6 address via autoconf or DHCPv6 and are operational


    step 1. Determine the size of the LAN IPv6 address pool
    step 2. Create a new client for each available address within the pool
    step 3. Verify the client obtains an IPv6 address via autoconfiguration or DHCPv6
    step 4. Verify there are no address conflicts
    step 5. Verify each client can establish an outbound HTTP connection
    step 6. Verify each client can send/receive data over the connection
    step 7. Close each TCP connection

    NOTE: The DHCPv6 address pool size is set in your configuration file using
    the 'ipv6DhcpClientStart' and 'ipv6DhcpClientEnd' testvars. One of the addresses
    remains in use through the test run for a host on the LAN side. This test
    will attempt to create clients for the pool size - 1. If you are using
    multiple LAN interfaces, the number of DHCPv6 clients from each interface
    will also be subtracted from the DHCPv6 pool size.


    References:

    IETF RFC 3315 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)"

    https://tools.ietf.org/html/rfc3315

    IETF RFC 4862 "IPv6 Stateless Address Autoconfiguration"

    https://tools.ietf.org/html/rfc4862
Test Name Synopsis
Verify all IPv6 clients with multiple TCP connections ipv6_scale_2 Verify all IPv6 clients with multiple TCP connections


    step 1. Determine the size of the IPv6 LAN address pool.
    step 2. Create a client for each available IPv6 address for a
            total of <num_hosts> clients.
    step 3. Verify each client obtains an IPv6 address via autoconf or
            DHCPv6.
    step 4. Verify there are no address conflicts.
    step 5. Determine <num_conns>, the number of TCP connections to
            create across all <num_hosts> clients, from the testvar
            scaleTcpConns.
    step 6. Determine <conns_per_host>, the number of TCP connections
            to create for each client by evenly dividing all
            <num_conns> connections across all <num_hosts> clients.
    step 7. Determine <num_web_servers>, the number of WAN HTTP
            servers to create, by selecting the smaller of
            <conns_per_host>, the size of the free network range and
            a maximum limit of 25 servers.
    step 8. Verify all <num_hosts> clients can establish
            <conns_per_host> outbound HTTP connections made to
            <num_web_servers> WAN HTTP servers on port 80 for a total
            of <num_conns> connections; each new connection is made to
            a different WAN HTTP server in a round-robin fashion.
    step 9. Verify each client can send/receive data over each connection.
    step 10. Close each TCP connection.

    NOTE: If the deprecated testvar scaleTcpConnsPerHost is not set to
    "auto", the value of the scaleTcpConns testvar is ignored and the
    this test behaves similarly to how it did prior to CDRouter 13.12
    before scaleTcpConns was introduced.  Namely, <conns_per_host> is
    set to the smaller of scaleTcpConnsPerHost and the size of the
    free network range, <num_web_servers> is set to <conns_per_host>,
    and <num_conns> is set to <conns_per_host> multiplied by
    <num_hosts>.  This backwards compatibility functionality will be
    removed in a future release.  Users should migrate to the
    scaleTcpConns testvar as soon as possible by setting
    scaleTcpConnsPerHost to the special value "auto" and then setting
    scaleTcpConns to the maximum number of TCP connections which
    should be created across all clients during the scaling tests.

    NOTE: The DHCPv6 address pool size is set in your configuration file using
    the 'ipv6DhcpClientStart' and 'ipv6DhcpClientEnd' testvars. One of the addresses
    remains in use through the test run for a host on the LAN side. This test
    will attempt to create clients for the pool size - 1. If you are using
    multiple LAN interfaces, the number of DHCPv6 clients from each interface
    will also be subtracted from the DHCPv6 pool size.


    References:

    IETF RFC 3315 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)"

    https://tools.ietf.org/html/rfc3315

    IETF RFC 4862 "IPv6 Stateless Address Autoconfiguration"

    https://tools.ietf.org/html/rfc4862
Test Name Synopsis
Verify all IPv6 clients with single UDP connection ipv6_scale_3 Verify all IPv6 clients with single UDP connection


    step 1. Determine the size of the IPv6 LAN address pool
    step 2. Determine the maximum number of UDP connections to create for
            each DHCP client
    step 3. Create a DHCP client for each available address within the pool
    step 4. Verify each client obtains an IP address within the range
    step 5. Verify there are no address conflicts
    step 6. Verify each client can establish one outbound UDP connection
    step 7. Verify each client can send/receive data over each connection
    step 8. Release all new DHCP client leases

    NOTE: The DHCPv6 address pool size is set in your configuration file using
    the 'ipv6DhcpClientStart' and 'ipv6DhcpClientEnd' testvars. One of the addresses
    remains in use through the test run for a host on the LAN side. This test
    will attempt to create clients for the pool size - 1. If you are using
    multiple LAN interfaces, the number of DHCPv6 clients from each interface
    will also be subtracted from the DHCPv6 pool size.


    References:

    IETF RFC 3315 "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)"

    https://tools.ietf.org/html/rfc3315

    IETF RFC 4862 "IPv6 Stateless Address Autoconfiguration"

    https://tools.ietf.org/html/rfc4862

dslite.tcl

DS-Lite tests for tunneling IPv4 over IPv6

Test Name Synopsis
Verify NAT is not enabled on DS-Lite B4 interface dslite_1 Verify NAT is not enabled on DS-Lite B4 interface


    step 1. Initiate an outbound TCP connection to HTTP server
    step 2. Verify the connection is established
    step 3. Send HTTP GET request to server
    step 4. Verify HTTP response is received
    step 5. Verify the IPv4 source address on the WAN side is original LAN address
    step 6. Close TCP connection from LAN side


    References:

    IETF RFC 6333 "Dual-Stack Lite Broadband Deployments Following IPv4 Exhaustion" Section 4.2: CPE

    A DS-Lite CPE SHOULD NOT operate a NAT function between an internal
    interface and a B4 interface, as the NAT function will be performed
    by the AFTR in the service provider's network.  This will avoid
    accidentally operating in a double-NAT environment.

    https://tools.ietf.org/html/rfc6333#section-4.2
Test Name Synopsis
Verify B4 Element announces itself as the IPv4 default gateway using DHCPv4 dslite_10 Verify B4 Element announces itself as the IPv4 default gateway using DHCPv4


    step 1. Send a DHCPREQUEST for the current IP address
    step 2. Verify DHCP server sends DHCPACK
    step 3. Verify the gateway address is the router's LAN IPv4 address


    References:

    IETF RFC 6333 "Dual-Stack Lite Broadband Deployments Following IPv4 Exhaustion" Section 4.2: CPE

    A DS-Lite CPE SHOULD NOT operate a NAT function between an internal
    interface and a B4 interface, as the NAT function will be performed
    by the AFTR in the service provider's network.  This will avoid
    accidentally operating in a double-NAT environment.

    However, it SHOULD operate its own DHCP(v4) server handing out
    [RFC1918] address space (e.g. 192.168.0.0/16) to hosts in the home.
    It SHOULD advertise itself as the default IPv4 router to those home
    hosts.  It SHOULD also advertise itself as a DNS server in the DHCP
    Option 6 (DNS Server).  Additionally, it SHOULD operate a DNS proxy
    to accept DNS IPv4 requests from home hosts and send them using IPv6
    to the service provider DNS servers, as described in Section 5.5.

    https://tools.ietf.org/html/rfc6333#section-4.2
Test Name Synopsis
Verify B4 Element announces itself as the IPv4 DNS server using DHCPv4 dslite_11 Verify B4 Element announces itself as the IPv4 DNS server using DHCPv4


    step 1. Send a DHCPREQUEST for the current IP address
    step 2. Verify DHCP server sends DHCPACK
    step 3. Verify the DNS server address is the router's LAN IPv4 address


    References:

    IETF RFC 6333 "Dual-Stack Lite Broadband Deployments Following IPv4 Exhaustion" Section 4.2: CPE

    A DS-Lite CPE SHOULD NOT operate a NAT function between an internal
    interface and a B4 interface, as the NAT function will be performed
    by the AFTR in the service provider's network.  This will avoid
    accidentally operating in a double-NAT environment.

    However, it SHOULD operate its own DHCP(v4) server handing out
    [RFC1918] address space (e.g. 192.168.0.0/16) to hosts in the home.
    It SHOULD advertise itself as the default IPv4 router to those home
    hosts.  It SHOULD also advertise itself as a DNS server in the DHCP
    Option 6 (DNS Server).  Additionally, it SHOULD operate a DNS proxy
    to accept DNS IPv4 requests from home hosts and send them using IPv6
    to the service provider DNS servers, as described in Section 5.5.

    https://tools.ietf.org/html/rfc6333#section-4.2
Test Name Synopsis
Verify DS-Lite packet fragmentation occurs at IPv6 layer and not the IPv4 layer dslite_20 Verify DS-Lite packet fragmentation occurs at IPv6 layer and not the IPv4 layer


    step 1. Forward an IPv4 packet from a LAN client to the WAN with packet size 1496
    step 2. Verify the packet is received on the WAN
    step 3. Verify the packet results in IPv6 fragments and no IPv4 fragments


    References:

    IETF RFC 2473 "Generic Packet Tunneling in IPv6 Specification" Section 7.2: IPv4 Tunnel Packet Fragmentation

    (b)  if in the original packet header the Don't Fragment - DF  -
         bit flag is CLEAR, the tunnel entry-point node encapsulates
         the original packet, and subsequently fragments the
         resulting IPv6 tunnel packet into IPv6 fragments that do
         not exceed the Path MTU to the tunnel exit-point.

    https://tools.ietf.org/html/rfc2473#section-7.2

    IETF RFC 6333 "Dual-Stack Lite Broadband Deployments Following IPv4 Exhaustion" Section 5.3: Fragmentation and Reassembly

    Using an encapsulation (IPv4-in-IPv6 or anything else) to carry IPv4
    traffic over IPv6 will reduce the effective MTU of the datagram.
    Unfortunately, path MTU discovery [RFC1191] is not a reliable method
    to deal with this problem.

    A solution to deal with this problem is for the service provider to
    increase the MTU size of all the links between the B4 element and the
    AFTR elements by at least 40 bytes to accommodate both the IPv6
    encapsulation header and the IPv4 datagram without fragmenting the
    IPv6 packet.

    However, as not all service providers will be able to increase their
    link MTU, the B4 element MUST perform fragmentation and reassembly if
    the outgoing link MTU cannot accommodate the extra IPv6 header.  The
    original IPv4 packet is not oversized.  The packet is oversized after
    the IPv6 encapsulation.  The inner IPv4 packet MUST NOT be
    fragmented.  Fragmentation MUST happen after the encapsulation of the
    IPv6 packet.  Reassembly MUST happen before the decapsulation of the
    IPv4 packet.  A detailed procedure has been specified in [RFC2473]
    Section 7.2.

    https://tools.ietf.org/html/rfc6333#section-5.3
Test Name Synopsis
Verify IPv4 ICMP Unreachable is generated if DF=1 and packet would fragment dslite_21 Verify IPv4 ICMP Unreachable is generated if DF=1 and packet would fragment


    step 1. Forward an IPv4 packet from a LAN client to the WAN with packet size 1496
    step 2. Verify an ICMP unreachable with code 4 is received on the LAN


    References:

    IETF RFC 2473 "Generic Packet Tunneling in IPv6 Specification" Section 7.2: IPv4 Tunnel Packet Fragmentation

    (b)  if in the original packet header the Don't Fragment - DF  -
         bit flag is CLEAR, the tunnel entry-point node encapsulates
         the original packet, and subsequently fragments the
         resulting IPv6 tunnel packet into IPv6 fragments that do
         not exceed the Path MTU to the tunnel exit-point.

    https://tools.ietf.org/html/rfc2473#section-7.2

    IETF RFC 6333 "Dual-Stack Lite Broadband Deployments Following IPv4 Exhaustion" Section 5.3: Fragmentation and Reassembly

    Using an encapsulation (IPv4-in-IPv6 or anything else) to carry IPv4
    traffic over IPv6 will reduce the effective MTU of the datagram.
    Unfortunately, path MTU discovery [RFC1191] is not a reliable method
    to deal with this problem.

    A solution to deal with this problem is for the service provider to
    increase the MTU size of all the links between the B4 element and the
    AFTR elements by at least 40 bytes to accommodate both the IPv6
    encapsulation header and the IPv4 datagram without fragmenting the
    IPv6 packet.

    However, as not all service providers will be able to increase their
    link MTU, the B4 element MUST perform fragmentation and reassembly if
    the outgoing link MTU cannot accommodate the extra IPv6 header.  The
    original IPv4 packet is not oversized.  The packet is oversized after
    the IPv6 encapsulation.  The inner IPv4 packet MUST NOT be
    fragmented.  Fragmentation MUST happen after the encapsulation of the
    IPv6 packet.  Reassembly MUST happen before the decapsulation of the
    IPv4 packet.  A detailed procedure has been specified in [RFC2473]
    Section 7.2.

    https://tools.ietf.org/html/rfc6333#section-5.3
Test Name Synopsis
Verify IPv4 packet is dropped if DF=1 and packet would fragment dslite_22 Verify IPv4 packet is dropped if DF=1 and packet would fragment


    step 1. Forward an IPv4 packet from a LAN client to the WAN with packet size 1496
    step 2. Verify packet is not forwarded to the WAN


    References:

    IETF RFC 2473 "Generic Packet Tunneling in IPv6 Specification" Section 7.2: IPv4 Tunnel Packet Fragmentation

    (b)  if in the original packet header the Don't Fragment - DF  -
         bit flag is CLEAR, the tunnel entry-point node encapsulates
         the original packet, and subsequently fragments the
         resulting IPv6 tunnel packet into IPv6 fragments that do
         not exceed the Path MTU to the tunnel exit-point.

    https://tools.ietf.org/html/rfc2473#section-7.2

    IETF RFC 6333 "Dual-Stack Lite Broadband Deployments Following IPv4 Exhaustion" Section 5.3: Fragmentation and Reassembly

    Using an encapsulation (IPv4-in-IPv6 or anything else) to carry IPv4
    traffic over IPv6 will reduce the effective MTU of the datagram.
    Unfortunately, path MTU discovery [RFC1191] is not a reliable method
    to deal with this problem.

    A solution to deal with this problem is for the service provider to
    increase the MTU size of all the links between the B4 element and the
    AFTR elements by at least 40 bytes to accommodate both the IPv6
    encapsulation header and the IPv4 datagram without fragmenting the
    IPv6 packet.

    However, as not all service providers will be able to increase their
    link MTU, the B4 element MUST perform fragmentation and reassembly if
    the outgoing link MTU cannot accommodate the extra IPv6 header.  The
    original IPv4 packet is not oversized.  The packet is oversized after
    the IPv6 encapsulation.  The inner IPv4 packet MUST NOT be
    fragmented.  Fragmentation MUST happen after the encapsulation of the
    IPv6 packet.  Reassembly MUST happen before the decapsulation of the
    IPv4 packet.  A detailed procedure has been specified in [RFC2473]
    Section 7.2.

    https://tools.ietf.org/html/rfc6333#section-5.3
Test Name Synopsis
Verify DNS queries sent to router over IPv4 are forwarded to IPv6 DNS server dslite_30 Verify DNS queries sent to router over IPv4 are forwarded to IPv6 DNS server


    step 1. Initiate a DNS query to the router's LAN ip address
    step 2. Verify the query is received by real DNS server on the WAN side
    step 3. The query may be received by the primary or backup DNS server
    step 4. Verify the DNS query is using IPv6 and not IPv4
    step 5. Send a return response back to LAN
    step 6. Verify the response is received by the LAN client

    NOTE: The router must support some type of DNS relay or proxy to
          pass this test case.


    References:

    IETF RFC 6333 "Dual-Stack Lite Broadband Deployments Following IPv4 Exhaustion" Section 5.5: DNS

    A B4 element is only configured from the service provider with IPv6.
    As such, it can only learn the address of a DNS recursive server
    through DHCPv6 (or other similar method over IPv6).  As DHCPv6 only
    defines an option to get the IPv6 address of such a DNS recursive
    server, the B4 element cannot easily discover the IPv4 address of
    such a recursive DNS server, and as such will have to perform all DNS
    resolution over IPv6.

    https://tools.ietf.org/html/rfc6333#section-5.5
Test Name Synopsis
Verify LAN clients can reach the IPv4 address of DS-Lite AFTR dslite_40 Verify LAN clients can reach the IPv4 address of DS-Lite AFTR


    step 1. Initiate an outbound ICMP Echo Request to the IPv4 address of the WAN (AFTR)
    step 2. Verify ICMP Echo Reply (ping response) is received


    References:

    IETF RFC 6333 "Dual-Stack Lite Broadband Deployments Following IPv4 Exhaustion" Section 6.5: Well-Known IPv4 Address

    The AFTR SHOULD use the well-known IPv4 address 192.0.0.1 reserved by
    IANA to configure the IPv4-in-IPv6 tunnel.  That address can then be
    used to report ICMP problems and will appear in traceroute outputs.

    The following testvars are used to configure the AFTR and B4 addresses:
        AFTR: testvar wanIspIp        192.0.0.1
          B4: testvar wanIspAssignIp  192.0.0.2

    https://tools.ietf.org/html/rfc6333#section-6.5
Test Name Synopsis
Verify LAN clients can reach the IPv4 address of DS-Lite B4 dslite_41 Verify LAN clients can reach the IPv4 address of DS-Lite B4


    step 1. Initiate an outbound ICMP Echo Request to the IPv4 address of the CPE WAN (B4)
    step 2. Verify ICMP Echo Reply (ping response) is received


    References:

    IETF RFC 6333 "Dual-Stack Lite Broadband Deployments Following IPv4 Exhaustion" Section 5.7: Well-Known IPv4 Address

    Any locally unique IPv4 address could be configured on the IPv4-in-
    IPv6 tunnel to represent the B4 element.  Configuring such an address
    is often necessary when the B4 element is sourcing IPv4 datagrams
    directly over the tunnel.  In order to avoid conflicts with any other
    address, IANA has defined a well-known range, 192.0.0.0/29.

    192.0.0.0 is the reserved subnet address.  192.0.0.1 is reserved for
    the AFTR element, and 192.0.0.2 is reserved for the B4 element.  If a
    service provider has a special configuration that prevents the B4
    element from using 192.0.0.2, the B4 element MAY use any other
    addresses within the 192.0.0.0/29 range.

    Note: A range of addresses has been reserved for this purpose.  The
    intent is to accommodate nodes implementing multiple B4 elements.

    The following testvars are used to configure the AFTR and B4 addresses:
        AFTR: testvar wanIspIp        192.0.0.1
          B4: testvar wanIspAssignIp  192.0.0.2

    https://tools.ietf.org/html/rfc6333#section-5.7
Test Name Synopsis
Verify IPv4 TOS is copied to IPv6 Traffic Class dslite_42 Verify IPv4 TOS is copied to IPv6 Traffic Class


    step 1. Forward an IPv4 packet from a LAN client to the WAN with a specific TOS
    step 2. Verify the packet is received on the WAN (AFTR)
    step 3. Verify that the IPv4 TOS and IPv6 Traffic Class are set to
            the IPv4 TOS from step 1
    step 4. Forward an IPv4 packet from the WAN to a LAN client with a specific TOS
    step 5. Verify the packet is received by the LAN client
    step 6. Verify that the IPv4 TOS are set to the IPv4 TOS from step 4
    step 7. Repeat steps 1 to 7 with several different IPv4 TOS values


    References:

    IETF RFC 6333 "Dual-Stack Lite Broadband Deployments Following IPv4 Exhaustion" Section 7.1: Tunneling

    Tunneling MUST be done in accordance to [RFC2473] and [RFC4213].
    Traffic classes ([RFC2474]) from the IPv4 headers MUST be carried
    over to the IPv6 headers and vice versa.

    https://tools.ietf.org/html/rfc6333#section-7.1

dns-v6.tcl

IPv6 DNS proxy and DNS failover related tests

Test Name Synopsis
Verify IPv6 DNS proxy does not cache DNS entry when DNS TTL is 0 ipv6_dns_10 Verify IPv6 DNS proxy does not cache DNS entry when DNS TTL is 0


    step 1. Initiate a DNS lookup for a new unique hostname from the LAN
            client to the configured DNS server
    step 2. Return DNS response with TTL set to 0 from WAN DNS server
    step 3. Change the IP address on the DNS server for the new hostname
    step 4. Initiate a new DNS lookup for the same hostname
    step 5. Verify a new DNS request is sent to the primary or backup
            DNS servers

    NOTE: Zero values are interpreted to mean that the RR can only be
    used for the transaction in progress, and should not be cached.


    References:

    IETF RFC 1035 "DOMAIN NAMES - IMPLEMENTATION AND SPECIFICATION" Section 3.2.1: Format

    https://tools.ietf.org/html/rfc1035#section-3.2.1
Test Name Synopsis
Verify IPv6 DNS proxy returns TTL of 0 when returned DNS TTL is 0 ipv6_dns_11 Verify IPv6 DNS proxy returns TTL of 0 when returned DNS TTL is 0


    step 1. Initiate a DNS lookup for a new unique hostname from the LAN
            client to the configured DNS server
    step 2. Return DNS response with TTL set to 0 from WAN DNS server
    step 3. Verify the returned TTL from the DNS proxy is 0

    NOTE: Zero values are interpreted to mean that the RR can only be
    used for the transaction in progress, and should not be cached.


    References:

    IETF RFC 1035 "DOMAIN NAMES - IMPLEMENTATION AND SPECIFICATION" Section 3.2.1: Format

    https://tools.ietf.org/html/rfc1035#section-3.2.1
Test Name Synopsis
Verify AAAA IPv6 DNS queries to router are forwarded to real DNS server ipv6_dns_40 Verify AAAA IPv6 DNS queries to router are forwarded to real DNS server


    step 1. Initiate an AAAA IPv6 DNS query from the LAN client to the
            configured DNS server
    step 2. Verify the query is received by real DNS server on the WAN
            side
    step 3. The query may be received by the primary or backup DNS
            server
    step 4. Send a return response back to LAN
    step 5. Verify the response is received by LAN client

    NOTE: The router must support some type of DNS relay or proxy to
    pass this test case. The DNS relay or proxy must understand IPv6 DNS
    type AAAA lookups.


    References:

    IETF RFC 4074 "Common Misbehavior Against DNS Queries for IPv6 Addresses"

    https://tools.ietf.org/html/rfc4074
Test Name Synopsis
Verify AAAA IPv6 DNS queries can return no address for IPv6 to IPv4 failover ipv6_dns_41 Verify AAAA IPv6 DNS queries can return no address for IPv6 to IPv4 failover


    step 1. Initiate an AAAA IPv6 DNS query from the LAN client to the
            configured DNS server
    step 2. Verify the query is received by real DNS server on the WAN
            side
    step 3. The query may be received by the primary or backup DNS
            server
    step 4. Send an empty return response back to LAN
    step 5. Verify the response is received by LAN client

    NOTE: The router must support some type of DNS relay or proxy to
    pass this test case. The DNS relay or proxy must understand IPv6
    DNS type AAAA lookups.


    References:

    IETF RFC 4074 "Common Misbehavior Against DNS Queries for IPv6 Addresses"

    https://tools.ietf.org/html/rfc4074
Test Name Synopsis
Verify IPv6 DNS failover when non-zero error codes are received in non-authoritative DNS response ipv6_dns_45 Verify IPv6 DNS failover when non-zero error codes are received in non-authoritative DNS response


    step 1. Verify DNS error codes from 1 - 15.
    step 2. For each error code, send 3 DNS queries for a unique
            hostname to the DUT's LAN IP address.
    step 3. Verify a valid DNS response was received for all 3 DNS
            queries.
    step 4. Verify that all 3 DNS queries were received on the same
            WAN DNS server address, known as the current primary DNS
            server address.
    step 5. Configure DNS queries sent to the current primary DNS
            server address to return the error code, and all other DNS
            server addresses to return the normal response.
    step 6. All error responses from the current primary DNS server
            address will have the authoritative bit not set.
    step 7. Send 3 DNS queries for another unique hostname to the
            DUT's LAN IP address.
    step 8. Verify a valid DNS response is received if the error code
            is expected to trigger DNS failover.
    step 9. Verify that a DNS query was received on the current
            primary DNS server address.

    NOTE: Most DNS clients that support multiple DNS servers (primary and
    backup) use some type of failover for certain DNS error codes. The behavior
    for each error code is implementation dependent. The list of error codes
    that will cause DNS failover can be configured using the testvar
    'dnsFailoverAuth'. If no DNS error codes will cause failover, the testvar
    should be configured with the keyword 'none'.

    Example:

    testvar dnsFailoverNonAuth "2 4 5"

    Example with no failover support:

    testvar dnsFailoverNonAuth none

    NOTE: Unix OSes based on bind will normally failover if DNS error
    codes 2, 4, or 5 are received. Windows based OSes will normally
    failover on all DNS error codes except 3 (No Such Name).

    NOTE: In most configurations the DUT will learn the IPv4 and/or IPv6
    addresses of several DNS servers on the WAN. While CDRouter will Initiate
    all DNS queries on the LAN over IPv4 in this test, the DUT may use any of
    the DNS servers in its list (IPv4 of IPv6) for final resolution.
Test Name Synopsis
Verify IPv6 DNS failover when non-zero error codes are received in authoritative DNS response ipv6_dns_46 Verify IPv6 DNS failover when non-zero error codes are received in authoritative DNS response


    step 1. Verify DNS error codes from 1 - 15.
    step 2. For each error code, send 3 DNS queries for a unique
            hostname to the DUT's LAN IP address.
    step 3. Verify a valid DNS response was received for all 3 DNS
            queries.
    step 4. Verify that all 3 DNS queries were received on the same
            WAN DNS server address, known as the current primary DNS
            server address.
    step 5. Configure DNS queries sent to the current primary DNS
            server address to return the error code, and all other DNS
            server addresses to return the normal response.
    step 6. All error responses from the current primary DNS server
            address will have the authoritative bit set.
    step 7. Send 3 DNS queries for another unique hostname to the
            DUT's LAN IP address.
    step 8. Verify a valid DNS response is received if the error code
            is expected to trigger DNS failover.
    step 9. Verify that a DNS query was received on the current
            primary DNS server address.

    NOTE: Most DNS clients that support multiple DNS servers (primary and
    backup) use some type of failover for certain DNS error codes. The behavior
    for each error code is implementation dependent. The list of error codes
    that will cause DNS failover can be configured using the testvar
    'dnsFailoverAuth'. If no DNS error codes will cause failover, the testvar
    should be configured with the keyword 'none'.

    Example:

    testvar dnsFailoverAuth "2 4 5"

    Example with no failover support:

    testvar dnsFailoverAuth none

    NOTE: Unix OSes based on bind will normally failover if DNS error
    codes 2, 4, or 5 are received. Windows based OSes will normally
    failover on all DNS error codes except 3 (No Such Name).

    NOTE: In most configurations the DUT will learn the IPv4 and/or IPv6
    addresses of several DNS servers on the WAN. While CDRouter will Initiate
    all DNS queries on the LAN over IPv4 in this test, the DUT may use any of
    the DNS servers in its list (IPv4 of IPv6) for final resolution.
Test Name Synopsis
Verify Reverse PTR DNS queries to router are forwarded to real DNS server ipv6_dns_50 Verify Reverse PTR DNS queries to router are forwarded to real DNS server


    step 1. Initiate a reverse DNS query from the LAN client to the
            configured DNS server
    step 2. Verify the query is received by real DNS server on the WAN
            side
    step 3. The query may be received by the primary or backup DNS
            server
    step 4. Send a return response back to LAN
    step 5. Verify the response is received by LAN client

    NOTE: The router must support some type of DNS relay or proxy to
    pass this test case.
Test Name Synopsis
Verify Reverse AAAA IPv6 DNS queries to router are forwarded to real DNS server ipv6_dns_51 Verify Reverse AAAA IPv6 DNS queries to router are forwarded to real DNS server


    step 1. Initiate a reverse AAAA IPv6 DNS query from the LAN client
            to the configured DNS server
    step 2. Verify the query is received by real DNS server on the WAN
            side
    step 3. The query may be received by the primary or backup DNS
            server
    step 4. Send a return response back to LAN
    step 5. Verify the response is received by LAN client

    NOTE: The router must support some type of DNS relay or proxy to
    pass this test case.
Test Name Synopsis
Verify IPv6 DNS proxy fails over when new primary DNS server is learned ipv6_dns_60 Verify IPv6 DNS proxy fails over when new primary DNS server is learned


    step 1. Create a new primary and backup DNS server
    step 2. Terminate the WAN link and bring back up
    step 3. Issue DNS query from the LAN client to the DUT's LAN IP
            address
    step 4. Verify LAN client receives response from new DNS servers
    step 5. If DNS query fails, make additional attempts to allow
            possible failover
    step 6. Terminate the WAN link and bring back up with original DNS
            servers

    NOTE: This test is only run when the WAN mode is dynamic.

    NOTE: The amount of time to wait before checking that DNS has
    been updated after the WAN link is restored can be configured
    using the testvar 'dnsFailoverDelay'. The default is 10 seconds.

    NOTE: In IPv4 and IPv6 dual stack scenarios, the DUT may switch
    over to IPv6 DNS server addresses which have not changed. These
    servers are also unresponsive during the test and the DUT should
    fail over to the new IPv4 DNS servers. The number of DNS queries
    attempted may be configured using the testvar 'dnsFailoverAttempts'.
Test Name Synopsis
Verify IPv6 DNS lookups with multiple IPv4 responses ipv6_dns_70 Verify IPv6 DNS lookups with multiple IPv4 responses


    step 1. Initiate a DNS lookup for a new unique hostname from the LAN
            client to the configured DNS server
    step 2. Return DNS response with multiple IPv4 answers from WAN DNS
            server
    step 3. Verify LAN client learns all IPv4 answers from DNS lookup


    References:

    IETF RFC 1035 "DOMAIN NAMES - IMPLEMENTATION AND SPECIFICATION"

    https://tools.ietf.org/html/rfc1035
Test Name Synopsis
Verify IPv6 DNS proxy recovers after DNS server outage ipv6_dns_100 Verify IPv6 DNS proxy recovers after DNS server outage


    step 1. Verify initial DNS lookup is working
    step 2. Disable all DNS servers
    step 3. Initiate 3 DNS lookups for new domains which should fail
            from the LAN client to the DUT's LAN IP address
    step 4. Enable all DNS servers
    step 5. Verify DNS lookups start working again

    NOTE: Zero values are interpreted to mean that the RR can only be
    used for the transaction in progress, and should not be cached.
Test Name Synopsis
Verify IPv6 DNS queries including the EDNS0 option ipv6_dns_110 Verify IPv6 DNS queries including the EDNS0 option


    step 1. Initiate a DNS lookup containing EDNS0 option for a new
            unique hostname from the LAN client to the configured DNS
            server
    step 2. Return DNS response with TTL set to 0 from WAN DNS server
    step 3. Change the IP address on the DNS server for the new hostname
    step 4. Initiate a new DNS lookup containing EDNS0 option for the
            same hostname
    step 5. Verify a new DNS request is sent to the primary or backup
            DNS servers; inclusion of EDNS0 option should not affect
            ability to successfully resolve hostnames

    NOTE: Zero values are interpreted to mean that the RR can only be
    used for the transaction in progress, and should not be cached.


    References:

    IETF RFC 1035 "DOMAIN NAMES - IMPLEMENTATION AND SPECIFICATION" Section 3.2.1: Format

    https://tools.ietf.org/html/rfc1035#section-3.2.1
Test Name Synopsis
Verify large DNS responses using EDNS0 option ipv6_dns_120 Verify large DNS responses using EDNS0 option


    step 1. Configure a DNS entry with 200 IPv4 matching records that
            requires a UDP response slightly less than 4096
    step 2. Initiate a DNS lookup for a new unique hostname from the LAN
            client to the configured DNS server using EDNS0 option
            announcing a UDP buffer size of 4096
    step 3. Return DNS response with multiple IPv4 answers from WAN DNS
            server
    step 4. Verify LAN client learns all IPv4 answers from DNS lookup


    References:

    IETF RFC 6891 "Extension Mechanisms for DNS (EDNS0)"

    https://tools.ietf.org/html/rfc6891
Test Name Synopsis
Verify maximum UDP payload value in EDNS0 option ipv6_dns_121 Verify maximum UDP payload value in EDNS0 option


    step 1. Initiate a DNS lookup for a unique hostname from the LAN
            client to the configured DNS server using EDNS0 option
            announcing a UDP buffer size of 4096
    step 2. Verify DNS response contains EDNS0 option
    step 3. Configure a DNS entry with enough matching IPv4 records that
            requires a UDP response slightly less than the EDNS0 UDP
            buffer size seen in step 2
    step 4. Initiate a DNS lookup for the same hostname from LAN client
            using EDNS0 option announcing a UDP buffer size of 4096
    step 5. Return DNS response with multiple IPv4 answers from WAN DNS
            server
    step 6. Verify LAN client learns all IPv4 answers from DNS lookup


    References:

    IETF RFC 6891 "Extension Mechanisms for DNS (EDNS0)"

    https://tools.ietf.org/html/rfc6891
Test Name Synopsis
Verify IPv6 DNS queries for TXT records ipv6_dns_130 Verify IPv6 DNS queries for TXT records


    step 1. Initiate a DNS TXT query from the LAN client to the
            configured DNS server
    step 2. Verify the query is received by real DNS server on the WAN
            side
    step 3. The query may be received by the primary or backup DNS server
    step 4. Send a return TXT response back to LAN
    step 5. Verify the response is received by LAN client

    Reference: RFC 1035 Domain names - implementation and specification
Test Name Synopsis
Verify DNS queries for CNAME records ipv6_dns_132 Verify DNS queries for CNAME records


    step 1. Initiate a DNS CNAME query from the LAN client to the
            configured DNS server
    step 2. Verify the query is received by real DNS server on the WAN
            side
    step 3. The query may be received by the primary or backup DNS server
    step 4. Send a return CNAME response back to LAN
    step 5. Verify the response is received by LAN client


    References:

    IETF RFC 1035 "DOMAIN NAMES - IMPLEMENTATION AND SPECIFICATION"

    https://tools.ietf.org/html/rfc1035
Test Name Synopsis
Verify DNS queries for responses returning both CNAME and A records ipv6_dns_133 Verify DNS queries for responses returning both CNAME and A records


    step 1. Initiate a DNS query from the LAN client to the
            configured DNS server
    step 2. Verify the query is received by real DNS server on the WAN
            side
    step 3. The query may be received by the primary or backup DNS server
    step 4. Send both a CNAME and A records response back to LAN
    step 5. Verify the response is received by LAN client with both CNAME
            and A records


    References:

    IETF RFC 1035 "DOMAIN NAMES - IMPLEMENTATION AND SPECIFICATION"

    https://tools.ietf.org/html/rfc1035
Test Name Synopsis
Verify DNS queries for responses returning both CNAME and AAAA records ipv6_dns_134 Verify DNS queries for responses returning both CNAME and AAAA records


    step 1. Initiate a DNS query from the LAN client to the
            configured DNS server
    step 2. Verify the query is received by real DNS server on the WAN
            side
    step 3. The query may be received by the primary or backup DNS server
    step 4. Send both a CNAME and AAAA records response back to LAN
    step 5. Verify the response is received by LAN client with both CNAME
            and AAAA records


    References:

    IETF RFC 1035 "DOMAIN NAMES - IMPLEMENTATION AND SPECIFICATION"

    https://tools.ietf.org/html/rfc1035
Test Name Synopsis
Verify IPv6 DNS queries for SPF records ipv6_dns_140 Verify IPv6 DNS queries for SPF records


    step 1. Initiate a DNS SPF query from the LAN client to the
            configured DNS server
    step 2. Verify the query is received by real DNS server on the WAN
            side
    step 3. The query may be received by the primary or backup DNS
            server
    step 4. Send a return SPF response back to LAN
    step 5. Verify the response is received by LAN client


    References:

    IETF RFC 4408 "Sender Policy Framework (SPF) for Authorizing Use of Domains in E-Mail, Version 1"

    https://tools.ietf.org/html/rfc4408
Test Name Synopsis
Verify IPv6 DNS queries for SRV records ipv6_dns_141 Verify IPv6 DNS queries for SRV records


    step 1. Initiate a DNS SRV query from the LAN client to the
            configured DNS server
    step 2. Verify the query is received by real DNS server on the WAN
            side
    step 3. The query may be received by the primary or backup DNS
            server
    step 4. Send a return SRV response back to LAN
    step 5. Verify the response is received by LAN client
    step 6. Verify the response priority, weight, port and target fields


    References:

    IETF RFC 2782 "A DNS RR for specifying the location of services (DNS SRV)"

    https://tools.ietf.org/html/rfc2782
Test Name Synopsis
Verify DNS proxy behavior for DNS server status requests ipv6_dns_150 Verify DNS proxy behavior for DNS server status requests


    step 1. Send a DNS server status request from the LAN client to the
            configured DNS server
    step 2. Verify that the DNS proxy either forwards the server status request
            to the real DNS server or drops it based on the proxy's expected
            behavior

    NOTE: Scanning tools including Nmap utilize DNS server status requests when
    probing a host. Some DNS proxy implementations will drop DNS server status
    requests for security reasons. The testvar dnsForwardServerStatus should be
    set to a value of **no** if this is the expected behavior of the DUT's DNS
    proxy. For DNS proxy implementations that forward server status request
    messages upstream, the testvar dnsForwardServerStatus should be set to a
    value of **yes**.


    References:

    IETF RFC 5625 "DNS Proxy Implementation Guidelines" Section 3: Transparency Principle

    https://tools.ietf.org/html/rfc5625#section-3

    The DNS Status OPCODE Section 6: Security Considerations

    http://www.eric-a-hall.com/specs/draft-hall-status-opcode-00-1.txt6
Test Name Synopsis
Verify IPv6 DNS proxy does not mangle DNSSEC queries ipv6_dns_200 Verify IPv6 DNS proxy does not mangle DNSSEC queries


    step 1. Initiate a DNSKEY query from the LAN client to the
            configured DNS server
    step 2. The query may be received by the primary or backup DNS
            server
    step 3. Send a DNSKEY response back to LAN
    step 4. Verify the response is received by LAN client and all fields
            are correct
    step 5. Repeat steps 1-5 for RRSIG, DS, and NSEC queries

    NOTE: The router must support some type of DNS relay or proxy to
    pass this test case.


    References:

    IETF RFC 4034 "Resource Records for the DNS Security Extensions"

    https://tools.ietf.org/html/rfc4034
Test Name Synopsis
Verify IPv6 DNS proxy does not mangle large DNSSEC responses ipv6_dns_201 Verify IPv6 DNS proxy does not mangle large DNSSEC responses


    step 1. Initiate a DNSKEY query from the LAN client to the
            configured DNS server
    step 2. The query may be received by the primary or backup DNS
            server
    step 3. Send a large RRSIG response (greater than 1220 bytes) back
            to LAN
    step 4. Verify full response is received by LAN client and all
            fields are correct

    NOTE: The router must support some type of DNS relay or proxy to
    pass this test case.


    References:

    IETF RFC 4035 "Protocol Modifications for the DNS Security Extensions" Section 4.1: EDNS Support

    https://tools.ietf.org/html/rfc4035#section-4.1
Test Name Synopsis
Verify IPv6 DNS proxy honors TTL values when caching responses ipv6_dns_300 Verify IPv6 DNS proxy honors TTL values when caching responses


    step 1. Initiate a DNS lookup for a hostname from the LAN client to
            the DUT's LAN IP address
    step 2. Verify DUT's DNS proxy forwards the query to the WAN DNS
            server
    step 3. Change the address on the WAN DNS server for the new
            hostname
    step 4. Wait half the TTL value of the response
    step 5. Perform a DNS lookup on the same hostname from the LAN
    step 6. If supportsDnsCaching is yes, verify DUT's DNS proxy returns
            cached response from step 2 and does not forward the query
            to the WAN DNS server.  If supportsDnsCaching is no, verify
            DUT's DNS proxy forwards the query to the WAN DNS server
    step 7. Wait long enough for the TTL value of the response from
            step 2 to have elapsed
    step 8. Perform a DNS lookup on the same hostname from the LAN
    step 9. Verify DUT's DNS proxy forwards the query to the WAN DNS
            server


    References:

    IETF RFC 1035 "DOMAIN NAMES - IMPLEMENTATION AND SPECIFICATION" Section 4.1.3: Resource Record Format

    https://tools.ietf.org/html/rfc1035#section-4.1.3
Test Name Synopsis
Verify maximum number of cached DNS responses ipv6_dns_301 Verify maximum number of cached DNS responses


    step 1. Initiate a DNS lookup for a new unique hostname from the LAN
            client to the DUT's LAN IP address
    step 2. Verify that the DUT's DNS proxy forwards the query to the
            WAN DNS server
    step 3. Send a valid response to the DUT on the WAN and verify that
            DUT's DNS proxy forwards this response to the LAN client
    step 4. Repeat steps 1 through 3 (dnsCacheSize + 10) times
    step 5. Repeat steps 1 through 4 but look up the hostnames in
            reverse order
    step 6. Verify that the last 10 hostname lookups are not cached by
            the DUT's DNS proxy

    NOTE: The testvar dnsCacheSize should be configured to match the
    size of the DUT's DNS cache.
Test Name Synopsis
Verify parallel DNS queries ipv6_dns_400 Verify parallel DNS queries


    step 1. Initiate a DNS A record lookup for a new unique hostname
            from the LAN client to the configured DNS server.
    step 2. Initiate a DNS AAAA record lookup from the LAN client for
            the same hostname used in step 1 to the configured DNS
            server on the same socket as used in step 1.
    step 3. Verify that DNS responses are received for both DNS
            queries.
Test Name Synopsis
Verify DNS does not deploy NXDOMAIN hijacking for type A records ipv6_dns_410 Verify DNS does not deploy NXDOMAIN hijacking for type A records


    step 1. Initiate a DNS lookup for a new unique type A DNS record from
            the LAN client to the configured DNS server
    step 2. Return DNS response with NXDOMAIN (No such domain reply code)
    step 3. Verify the NXDOMAIN response is returned to the LAN client


    References:

    DNS NXDOMAIN Hijacking

    http://en.wikipedia.org/wiki/DNS_hijacking
Test Name Synopsis
Verify DNS does not deploy NXDOMAIN hijacking for type AAAA records ipv6_dns_411 Verify DNS does not deploy NXDOMAIN hijacking for type AAAA records


    step 1. Initiate a DNS lookup for a new unique type AAAA DNS record from
            the LAN client to the configured DNS server
    step 2. Return DNS response with NXDOMAIN (No such domain reply code)
    step 3. Verify the NXDOMAIN response is returned to the LAN client


    References:

    DNS NXDOMAIN Hijacking

    http://en.wikipedia.org/wiki/DNS_hijacking
Test Name Synopsis
Verify DNS proxy handles use of bit 0x20 in DNS labels ipv6_dns_420 Verify DNS proxy handles use of bit 0x20 in DNS labels


    step 1. Add a new DNS hostname to the DNS servers on the WAN
    step 2. Create a new bit 0x20 version of the DNS hostname    
    step 3. Initiate a DNS lookup from the LAN client using the bit 0x20 DNS label
    step 4. Verify the LAN client receives a valid DNS response
    step 5. Repeat this process for 100 variations of the bit 0x20 DNS label


    References:

    IETF Internet-Draft draft-vixie-dnsext-dns0x20-00 "Use of Bit 0x20 in DNS Labels to Improve Transaction Identity"

    https://tools.ietf.org/html/draft-vixie-dnsext-dns0x20-00
Test Name Synopsis
Verify DNS proxy enforces DNS strict privacy usage profile ipv6_dns_500 Verify DNS proxy enforces DNS strict privacy usage profile


    step 1. Add a new DNS hostname to the DNS servers on the WAN
    step 2. Initiate a DNS lookup for the new unique hostname from the LAN
            client to the DUT's DNS proxy
    step 3. Verify the LAN client receives a valid DNS response
    step 4. Verify a new DNS request is sent to the primary or backup
            DNS servers using DNS over TLS

    NOTE: The list of secure transports (i.e. TLS, HTTPS (DoH) or
    both) which the DUT is expected to use when sending DNS queries
    can be configured via the testvar
    dnsUsageProfileStrictPrivacyTransports.


    References:

    IETF RFC 8310 "Usage Profiles for DNS over (D)TLS" Section 5: Usage Profiles

    https://tools.ietf.org/html/rfc8310#section-5

dns-https-v6.tcl

IPv6 DNS over HTTPS (DoH) proxy and DNS failover related tests

Test Name Synopsis
Verify IPv6 DNS proxy does not cache DNS entry when DNS TTL is 0 ipv6_dns_https_10 Verify IPv6 DNS proxy does not cache DNS entry when DNS TTL is 0


    step 1. Initiate a DNS lookup for a new unique hostname from the LAN
            client to the configured DNS server
    step 2. Return DNS response with TTL set to 0 from WAN DNS server
    step 3. Change the IP address on the DNS server for the new hostname
    step 4. Initiate a new DNS lookup for the same hostname
    step 5. Verify a new DNS request is sent to the primary or backup
            DNS servers

    NOTE: Zero values are interpreted to mean that the RR can only be
    used for the transaction in progress, and should not be cached.


    References:

    IETF RFC 8484 "DNS Queries over HTTPS (DoH)"

    https://tools.ietf.org/html/rfc8484

    IETF RFC 1035 "DOMAIN NAMES - IMPLEMENTATION AND SPECIFICATION" Section 3.2.1: Format

    https://tools.ietf.org/html/rfc1035#section-3.2.1
Test Name Synopsis
Verify IPv6 DNS proxy returns TTL of 0 when returned DNS TTL is 0 ipv6_dns_https_11 Verify IPv6 DNS proxy returns TTL of 0 when returned DNS TTL is 0


    step 1. Initiate a DNS lookup for a new unique hostname from the LAN
            client to the configured DNS server
    step 2. Return DNS response with TTL set to 0 from WAN DNS server
    step 3. Verify the returned TTL from the DNS proxy is 0

    NOTE: Zero values are interpreted to mean that the RR can only be
    used for the transaction in progress, and should not be cached.


    References:

    IETF RFC 8484 "DNS Queries over HTTPS (DoH)"

    https://tools.ietf.org/html/rfc8484

    IETF RFC 1035 "DOMAIN NAMES - IMPLEMENTATION AND SPECIFICATION" Section 3.2.1: Format

    https://tools.ietf.org/html/rfc1035#section-3.2.1
Test Name Synopsis
Verify AAAA IPv6 DNS queries to router are forwarded to real DNS server ipv6_dns_https_40 Verify AAAA IPv6 DNS queries to router are forwarded to real DNS server


    step 1. Initiate an AAAA IPv6 DNS query from the LAN client to the
            configured DNS server
    step 2. Verify the query is received by real DNS server on the WAN
            side
    step 3. The query may be received by the primary or backup DNS
            server
    step 4. Send a return response back to LAN
    step 5. Verify the response is received by LAN client

    NOTE: The router must support some type of DNS relay or proxy to
    pass this test case. The DNS relay or proxy must understand IPv6 DNS
    type AAAA lookups.


    References:

    IETF RFC 8484 "DNS Queries over HTTPS (DoH)"

    https://tools.ietf.org/html/rfc8484

    IETF RFC 4074 "Common Misbehavior Against DNS Queries for IPv6 Addresses"

    https://tools.ietf.org/html/rfc4074
Test Name Synopsis
Verify AAAA IPv6 DNS queries can return no address for IPv6 to IPv4 failover ipv6_dns_https_41 Verify AAAA IPv6 DNS queries can return no address for IPv6 to IPv4 failover


    step 1. Initiate an AAAA IPv6 DNS query from the LAN client to the
            configured DNS server
    step 2. Verify the query is received by real DNS server on the WAN
            side
    step 3. The query may be received by the primary or backup DNS
            server
    step 4. Send an empty return response back to LAN
    step 5. Verify the response is received by LAN client

    NOTE: The router must support some type of DNS relay or proxy to
    pass this test case. The DNS relay or proxy must understand IPv6
    DNS type AAAA lookups.


    References:

    IETF RFC 8484 "DNS Queries over HTTPS (DoH)"

    https://tools.ietf.org/html/rfc8484

    IETF RFC 4074 "Common Misbehavior Against DNS Queries for IPv6 Addresses"

    https://tools.ietf.org/html/rfc4074
Test Name Synopsis
Verify IPv6 DNS failover when non-zero error codes are received in non-authoritative DNS response ipv6_dns_https_45 Verify IPv6 DNS failover when non-zero error codes are received in non-authoritative DNS response


    step 1. Verify DNS error codes from 1 - 15.
    step 2. For each error code, send 3 DNS queries for a unique
            hostname to the DUT's LAN IP address.
    step 3. Verify a valid DNS response was received for all 3 DNS
            queries.
    step 4. Verify that all 3 DNS queries were received on the same
            WAN DNS server address, known as the current primary DNS
            server address.
    step 5. Configure DNS queries sent to the current primary DNS
            server address to return the error code, and all other DNS
            server addresses to return the normal response.
    step 6. All error responses from the current primary DNS server
            address will have the authoritative bit not set.
    step 7. Send 3 DNS queries for another unique hostname to the
            DUT's LAN IP address.
    step 8. Verify a valid DNS response is received if the error code
            is expected to trigger DNS failover.
    step 9. Verify that a DNS query was received on the current
            primary DNS server address.

    NOTE: Most DNS clients that support multiple DNS servers (primary and
    backup) use some type of failover for certain DNS error codes. The behavior
    for each error code is implementation dependent. The list of error codes
    that will cause DNS failover can be configured using the testvar
    'dnsFailoverAuth'. If no DNS error codes will cause failover, the testvar
    should be configured with the keyword 'none'.

    Example:

    testvar dnsFailoverNonAuth "2 4 5"

    Example with no failover support:

    testvar dnsFailoverNonAuth none

    NOTE: Unix OSes based on bind will normally failover if DNS error
    codes 2, 4, or 5 are received. Windows based OSes will normally
    failover on all DNS error codes except 3 (No Such Name).

    NOTE: In most configurations the DUT will learn the IPv4 and/or IPv6
    addresses of several DNS servers on the WAN. While CDRouter will Initiate
    all DNS queries on the LAN over IPv4 in this test, the DUT may use any of
    the DNS servers in its list (IPv4 of IPv6) for final resolution.


    References:

    IETF RFC 8484 "DNS Queries over HTTPS (DoH)"

    https://tools.ietf.org/html/rfc8484
Test Name Synopsis
Verify IPv6 DNS failover when non-zero error codes are received in authoritative DNS response ipv6_dns_https_46 Verify IPv6 DNS failover when non-zero error codes are received in authoritative DNS response


    step 1. Verify DNS error codes from 1 - 15.
    step 2. For each error code, send 3 DNS queries for a unique
            hostname to the DUT's LAN IP address.
    step 3. Verify a valid DNS response was received for all 3 DNS
            queries.
    step 4. Verify that all 3 DNS queries were received on the same
            WAN DNS server address, known as the current primary DNS
            server address.
    step 5. Configure DNS queries sent to the current primary DNS
            server address to return the error code, and all other DNS
            server addresses to return the normal response.
    step 6. All error responses from the current primary DNS server
            address will have the authoritative bit set.
    step 7. Send 3 DNS queries for another unique hostname to the
            DUT's LAN IP address.
    step 8. Verify a valid DNS response is received if the error code
            is expected to trigger DNS failover.
    step 9. Verify that a DNS query was received on the current
            primary DNS server address.

    NOTE: Most DNS clients that support multiple DNS servers (primary and
    backup) use some type of failover for certain DNS error codes. The behavior
    for each error code is implementation dependent. The list of error codes
    that will cause DNS failover can be configured using the testvar
    'dnsFailoverAuth'. If no DNS error codes will cause failover, the testvar
    should be configured with the keyword 'none'.

    Example:

    testvar dnsFailoverAuth "2 4 5"

    Example with no failover support:

    testvar dnsFailoverAuth none

    NOTE: Unix OSes based on bind will normally failover if DNS error
    codes 2, 4, or 5 are received. Windows based OSes will normally
    failover on all DNS error codes except 3 (No Such Name).

    NOTE: In most configurations the DUT will learn the IPv4 and/or IPv6
    addresses of several DNS servers on the WAN. While CDRouter will Initiate
    all DNS queries on the LAN over IPv4 in this test, the DUT may use any of
    the DNS servers in its list (IPv4 of IPv6) for final resolution.


    References:

    IETF RFC 8484 "DNS Queries over HTTPS (DoH)"

    https://tools.ietf.org/html/rfc8484
Test Name Synopsis
Verify Reverse PTR DNS queries to router are forwarded to real DNS server ipv6_dns_https_50 Verify Reverse PTR DNS queries to router are forwarded to real DNS server


    step 1. Initiate a reverse DNS query from the LAN client to the
            configured DNS server
    step 2. Verify the query is received by real DNS server on the WAN
            side
    step 3. The query may be received by the primary or backup DNS
            server
    step 4. Send a return response back to LAN
    step 5. Verify the response is received by LAN client

    NOTE: The router must support some type of DNS relay or proxy to
    pass this test case.


    References:

    IETF RFC 8484 "DNS Queries over HTTPS (DoH)"

    https://tools.ietf.org/html/rfc8484
Test Name Synopsis
Verify Reverse AAAA IPv6 DNS queries to router are forwarded to real DNS server ipv6_dns_https_51 Verify Reverse AAAA IPv6 DNS queries to router are forwarded to real DNS server


    step 1. Initiate a reverse AAAA IPv6 DNS query from the LAN client
            to the configured DNS server
    step 2. Verify the query is received by real DNS server on the WAN
            side
    step 3. The query may be received by the primary or backup DNS
            server
    step 4. Send a return response back to LAN
    step 5. Verify the response is received by LAN client

    NOTE: The router must support some type of DNS relay or proxy to
    pass this test case.


    References:

    IETF RFC 8484 "DNS Queries over HTTPS (DoH)"

    https://tools.ietf.org/html/rfc8484
Test Name Synopsis
Verify IPv6 DNS proxy fails over when new primary DNS server is learned ipv6_dns_https_60 Verify IPv6 DNS proxy fails over when new primary DNS server is learned


    step 1. Create a new primary and backup DNS server
    step 2. Terminate the WAN link and bring back up
    step 3. Issue DNS query from the LAN client to the DUT's LAN IP
            address
    step 4. Verify LAN client receives response from new DNS servers
    step 5. If DNS query fails, make additional attempts to allow
            possible failover
    step 6. Terminate the WAN link and bring back up with original DNS
            servers

    NOTE: This test is only run when the WAN mode is dynamic.

    NOTE: The amount of time to wait before checking that DNS has
    been updated after the WAN link is restored can be configured
    using the testvar 'dnsFailoverDelay'. The default is 10 seconds.

    NOTE: In IPv4 and IPv6 dual stack scenarios, the DUT may switch
    over to IPv6 DNS server addresses which have not changed. These
    servers are also unresponsive during the test and the DUT should
    fail over to the new IPv4 DNS servers. The number of DNS queries
    attempted may be configured using the testvar 'dnsFailoverAttempts'.


    References:

    IETF RFC 8484 "DNS Queries over HTTPS (DoH)"

    https://tools.ietf.org/html/rfc8484
Test Name Synopsis
Verify IPv6 DNS lookups with multiple IPv4 responses ipv6_dns_https_70 Verify IPv6 DNS lookups with multiple IPv4 responses


    step 1. Initiate a DNS lookup for a new unique hostname from the LAN
            client to the configured DNS server
    step 2. Return DNS response with multiple IPv4 answers from WAN DNS
            server
    step 3. Verify LAN client learns all IPv4 answers from DNS lookup


    References:

    IETF RFC 8484 "DNS Queries over HTTPS (DoH)"

    https://tools.ietf.org/html/rfc8484

    IETF RFC 1035 "DOMAIN NAMES - IMPLEMENTATION AND SPECIFICATION"

    https://tools.ietf.org/html/rfc1035
Test Name Synopsis
Verify IPv6 DNS proxy recovers after DNS server outage ipv6_dns_https_100 Verify IPv6 DNS proxy recovers after DNS server outage


    step 1. Verify initial DNS lookup is working
    step 2. Disable all DNS servers
    step 3. Initiate 3 DNS lookups for new domains which should fail
            from the LAN client to the DUT's LAN IP address
    step 4. Enable all DNS servers
    step 5. Verify DNS lookups start working again

    NOTE: Zero values are interpreted to mean that the RR can only be
    used for the transaction in progress, and should not be cached.


    References:

    IETF RFC 8484 "DNS Queries over HTTPS (DoH)"

    https://tools.ietf.org/html/rfc8484
Test Name Synopsis
Verify IPv6 DNS queries including the EDNS0 option ipv6_dns_https_110 Verify IPv6 DNS queries including the EDNS0 option


    step 1. Initiate a DNS lookup containing EDNS0 option for a new
            unique hostname from the LAN client to the configured DNS
            server
    step 2. Return DNS response with TTL set to 0 from WAN DNS server
    step 3. Change the IP address on the DNS server for the new hostname
    step 4. Initiate a new DNS lookup containing EDNS0 option for the
            same hostname
    step 5. Verify a new DNS request is sent to the primary or backup
            DNS servers; inclusion of EDNS0 option should not affect
            ability to successfully resolve hostnames

    NOTE: Zero values are interpreted to mean that the RR can only be
    used for the transaction in progress, and should not be cached.


    References:

    IETF RFC 8484 "DNS Queries over HTTPS (DoH)"

    https://tools.ietf.org/html/rfc8484

    IETF RFC 1035 "DOMAIN NAMES - IMPLEMENTATION AND SPECIFICATION" Section 3.2.1: Format

    https://tools.ietf.org/html/rfc1035#section-3.2.1
Test Name Synopsis
Verify large DNS responses using EDNS0 option ipv6_dns_https_120 Verify large DNS responses using EDNS0 option


    step 1. Configure a DNS entry with 200 IPv4 matching records that
            requires a UDP response slightly less than 4096
    step 2. Initiate a DNS lookup for a new unique hostname from the LAN
            client to the configured DNS server using EDNS0 option
            announcing a UDP buffer size of 4096
    step 3. Return DNS response with multiple IPv4 answers from WAN DNS
            server
    step 4. Verify LAN client learns all IPv4 answers from DNS lookup


    References:

    IETF RFC 8484 "DNS Queries over HTTPS (DoH)"

    https://tools.ietf.org/html/rfc8484

    IETF RFC 6891 "Extension Mechanisms for DNS (EDNS0)"

    https://tools.ietf.org/html/rfc6891
Test Name Synopsis
Verify maximum UDP payload value in EDNS0 option ipv6_dns_https_121 Verify maximum UDP payload value in EDNS0 option


    step 1. Initiate a DNS lookup for a unique hostname from the LAN
            client to the configured DNS server using EDNS0 option
            announcing a UDP buffer size of 4096
    step 2. Verify DNS response contains EDNS0 option
    step 3. Configure a DNS entry with enough matching IPv4 records that
            requires a UDP response slightly less than the EDNS0 UDP
            buffer size seen in step 2
    step 4. Initiate a DNS lookup for the same hostname from LAN client
            using EDNS0 option announcing a UDP buffer size of 4096
    step 5. Return DNS response with multiple IPv4 answers from WAN DNS
            server
    step 6. Verify LAN client learns all IPv4 answers from DNS lookup


    References:

    IETF RFC 8484 "DNS Queries over HTTPS (DoH)"

    https://tools.ietf.org/html/rfc8484

    IETF RFC 6891 "Extension Mechanisms for DNS (EDNS0)"

    https://tools.ietf.org/html/rfc6891
Test Name Synopsis
Verify IPv6 DNS queries for TXT records ipv6_dns_https_130 Verify IPv6 DNS queries for TXT records


    step 1. Initiate a DNS TXT query from the LAN client to the
            configured DNS server
    step 2. Verify the query is received by real DNS server on the WAN
            side
    step 3. The query may be received by the primary or backup DNS server
    step 4. Send a return TXT response back to LAN
    step 5. Verify the response is received by LAN client

    Reference: RFC 1035 Domain names - implementation and specification


    References:

    IETF RFC 8484 "DNS Queries over HTTPS (DoH)"

    https://tools.ietf.org/html/rfc8484
Test Name Synopsis
Verify DNS queries for CNAME records ipv6_dns_https_132 Verify DNS queries for CNAME records


    step 1. Initiate a DNS CNAME query from the LAN client to the
            configured DNS server
    step 2. Verify the query is received by real DNS server on the WAN
            side
    step 3. The query may be received by the primary or backup DNS server
    step 4. Send a return CNAME response back to LAN
    step 5. Verify the response is received by LAN client


    References:

    IETF RFC 8484 "DNS Queries over HTTPS (DoH)"

    https://tools.ietf.org/html/rfc8484

    IETF RFC 1035 "DOMAIN NAMES - IMPLEMENTATION AND SPECIFICATION"

    https://tools.ietf.org/html/rfc1035
Test Name Synopsis
Verify DNS queries for responses returning both CNAME and A records ipv6_dns_https_133 Verify DNS queries for responses returning both CNAME and A records


    step 1. Initiate a DNS query from the LAN client to the
            configured DNS server
    step 2. Verify the query is received by real DNS server on the WAN
            side
    step 3. The query may be received by the primary or backup DNS server
    step 4. Send both a CNAME and A records response back to LAN
    step 5. Verify the response is received by LAN client with both CNAME
            and A records


    References:

    IETF RFC 8484 "DNS Queries over HTTPS (DoH)"

    https://tools.ietf.org/html/rfc8484

    IETF RFC 1035 "DOMAIN NAMES - IMPLEMENTATION AND SPECIFICATION"

    https://tools.ietf.org/html/rfc1035
Test Name Synopsis
Verify DNS queries for responses returning both CNAME and AAAA records ipv6_dns_https_134 Verify DNS queries for responses returning both CNAME and AAAA records


    step 1. Initiate a DNS query from the LAN client to the
            configured DNS server
    step 2. Verify the query is received by real DNS server on the WAN
            side
    step 3. The query may be received by the primary or backup DNS server
    step 4. Send both a CNAME and AAAA records response back to LAN
    step 5. Verify the response is received by LAN client with both CNAME
            and AAAA records


    References:

    IETF RFC 8484 "DNS Queries over HTTPS (DoH)"

    https://tools.ietf.org/html/rfc8484

    IETF RFC 1035 "DOMAIN NAMES - IMPLEMENTATION AND SPECIFICATION"

    https://tools.ietf.org/html/rfc1035
Test Name Synopsis
Verify IPv6 DNS queries for SPF records ipv6_dns_https_140 Verify IPv6 DNS queries for SPF records


    step 1. Initiate a DNS SPF query from the LAN client to the
            configured DNS server
    step 2. Verify the query is received by real DNS server on the WAN
            side
    step 3. The query may be received by the primary or backup DNS
            server
    step 4. Send a return SPF response back to LAN
    step 5. Verify the response is received by LAN client


    References:

    IETF RFC 8484 "DNS Queries over HTTPS (DoH)"

    https://tools.ietf.org/html/rfc8484

    IETF RFC 4408 "Sender Policy Framework (SPF) for Authorizing Use of Domains in E-Mail, Version 1"

    https://tools.ietf.org/html/rfc4408
Test Name Synopsis
Verify IPv6 DNS queries for SRV records ipv6_dns_https_141 Verify IPv6 DNS queries for SRV records


    step 1. Initiate a DNS SRV query from the LAN client to the
            configured DNS server
    step 2. Verify the query is received by real DNS server on the WAN
            side
    step 3. The query may be received by the primary or backup DNS
            server
    step 4. Send a return SRV response back to LAN
    step 5. Verify the response is received by LAN client
    step 6. Verify the response priority, weight, port and target fields


    References:

    IETF RFC 8484 "DNS Queries over HTTPS (DoH)"

    https://tools.ietf.org/html/rfc8484

    IETF RFC 2782 "A DNS RR for specifying the location of services (DNS SRV)"

    https://tools.ietf.org/html/rfc2782
Test Name Synopsis
Verify DNS proxy behavior for DNS server status requests ipv6_dns_https_150 Verify DNS proxy behavior for DNS server status requests


    step 1. Send a DNS server status request from the LAN client to the
            configured DNS server
    step 2. Verify that the DNS proxy either forwards the server status request
            to the real DNS server or drops it based on the proxy's expected
            behavior

    NOTE: Scanning tools including Nmap utilize DNS server status requests when
    probing a host. Some DNS proxy implementations will drop DNS server status
    requests for security reasons. The testvar dnsForwardServerStatus should be
    set to a value of **no** if this is the expected behavior of the DUT's DNS
    proxy. For DNS proxy implementations that forward server status request
    messages upstream, the testvar dnsForwardServerStatus should be set to av
    alue of **yes**.


    References:

    IETF RFC 8484 "DNS Queries over HTTPS (DoH)"

    https://tools.ietf.org/html/rfc8484

    IETF RFC 5625 "DNS Proxy Implementation Guidelines" Section 3: Transparency Principle

    https://tools.ietf.org/html/rfc5625#section-3

    The DNS Status OPCODE Section 6: Security Considerations

    http://www.eric-a-hall.com/specs/draft-hall-status-opcode-00-1.txt6
Test Name Synopsis
Verify IPv6 DNS proxy does not mangle DNSSEC queries ipv6_dns_https_200 Verify IPv6 DNS proxy does not mangle DNSSEC queries


    step 1. Initiate a DNSKEY query from the LAN client to the
            configured DNS server
    step 2. The query may be received by the primary or backup DNS
            server
    step 3. Send a DNSKEY response back to LAN
    step 4. Verify the response is received by LAN client and all fields
            are correct
    step 5. Repeat steps 1-5 for RRSIG, DS, and NSEC queries

    NOTE: The router must support some type of DNS relay or proxy to
    pass this test case.


    References:

    IETF RFC 8484 "DNS Queries over HTTPS (DoH)"

    https://tools.ietf.org/html/rfc8484

    IETF RFC 4034 "Resource Records for the DNS Security Extensions"

    https://tools.ietf.org/html/rfc4034
Test Name Synopsis
Verify IPv6 DNS proxy does not mangle large DNSSEC responses ipv6_dns_https_201 Verify IPv6 DNS proxy does not mangle large DNSSEC responses


    step 1. Initiate a DNSKEY query from the LAN client to the
            configured DNS server
    step 2. The query may be received by the primary or backup DNS
            server
    step 3. Send a large RRSIG response (greater than 1220 bytes) back
            to LAN
    step 4. Verify full response is received by LAN client and all
            fields are correct

    NOTE: The router must support some type of DNS relay or proxy to
    pass this test case.


    References:

    IETF RFC 8484 "DNS Queries over HTTPS (DoH)"

    https://tools.ietf.org/html/rfc8484

    IETF RFC 4035 "Protocol Modifications for the DNS Security Extensions" Section 4.1: EDNS Support

    https://tools.ietf.org/html/rfc4035#section-4.1
Test Name Synopsis
Verify IPv6 DNS proxy honors TTL values when caching responses ipv6_dns_https_300 Verify IPv6 DNS proxy honors TTL values when caching responses


    step 1. Initiate a DNS lookup for a hostname from the LAN client to
            the DUT's LAN IP address
    step 2. Verify DUT's DNS proxy forwards the query to the WAN DNS
            server
    step 3. Change the address on the WAN DNS server for the new
            hostname
    step 4. Wait half the TTL value of the response
    step 5. Perform a DNS lookup on the same hostname from the LAN
    step 6. If supportsDnsCaching is yes, verify DUT's DNS proxy returns
            cached response from step 2 and does not forward the query
            to the WAN DNS server.  If supportsDnsCaching is no, verify
            DUT's DNS proxy forwards the query to the WAN DNS server
    step 7. Wait long enough for the TTL value of the response from
            step 2 to have elapsed
    step 8. Perform a DNS lookup on the same hostname from the LAN
    step 9. Verify DUT's DNS proxy forwards the query to the WAN DNS
            server


    References:

    IETF RFC 8484 "DNS Queries over HTTPS (DoH)"

    https://tools.ietf.org/html/rfc8484

    IETF RFC 1035 "DOMAIN NAMES - IMPLEMENTATION AND SPECIFICATION" Section 4.1.3: Resource Record Format

    https://tools.ietf.org/html/rfc1035#section-4.1.3
Test Name Synopsis
Verify maximum number of cached DNS responses ipv6_dns_https_301 Verify maximum number of cached DNS responses


    step 1. Initiate a DNS lookup for a new unique hostname from the LAN
            client to the DUT's LAN IP address
    step 2. Verify that the DUT's DNS proxy forwards the query to the
            WAN DNS server
    step 3. Send a valid response to the DUT on the WAN and verify that
            DUT's DNS proxy forwards this response to the LAN client
    step 4. Repeat steps 1 through 3 (dnsCacheSize + 10) times
    step 5. Repeat steps 1 through 4 but look up the hostnames in
            reverse order
    step 6. Verify that the last 10 hostname lookups are not cached by
            the DUT's DNS proxy

    NOTE: The testvar dnsCacheSize should be configured to match the
    size of the DUT's DNS cache.


    References:

    IETF RFC 8484 "DNS Queries over HTTPS (DoH)"

    https://tools.ietf.org/html/rfc8484
Test Name Synopsis
Verify parallel DNS queries ipv6_dns_https_400 Verify parallel DNS queries


    step 1. Initiate a DNS A record lookup for a new unique hostname
            from the LAN client to the configured DNS server.
    step 2. Initiate a DNS AAAA record lookup from the LAN client for
            the same hostname used in step 1 to the configured DNS
            server on the same socket as used in step 1.
    step 3. Verify that DNS responses are received for both DNS
            queries.


    References:

    IETF RFC 8484 "DNS Queries over HTTPS (DoH)"

    https://tools.ietf.org/html/rfc8484
Test Name Synopsis
Verify DNS does not deploy NXDOMAIN hijacking for type A records ipv6_dns_https_410 Verify DNS does not deploy NXDOMAIN hijacking for type A records


    step 1. Initiate a DNS lookup for a new unique type A DNS record from
            the LAN client to the configured DNS server
    step 2. Return DNS response with NXDOMAIN (No such domain reply code)
    step 3. Verify the NXDOMAIN response is returned to the LAN client


    References:

    IETF RFC 8484 "DNS Queries over HTTPS (DoH)"

    https://tools.ietf.org/html/rfc8484

    DNS NXDOMAIN Hijacking

    http://en.wikipedia.org/wiki/DNS_hijacking
Test Name Synopsis
Verify DNS does not deploy NXDOMAIN hijacking for type AAAA records ipv6_dns_https_411 Verify DNS does not deploy NXDOMAIN hijacking for type AAAA records


    step 1. Initiate a DNS lookup for a new unique type AAAA DNS record from
            the LAN client to the configured DNS server
    step 2. Return DNS response with NXDOMAIN (No such domain reply code)
    step 3. Verify the NXDOMAIN response is returned to the LAN client


    References:

    IETF RFC 8484 "DNS Queries over HTTPS (DoH)"

    https://tools.ietf.org/html/rfc8484

    DNS NXDOMAIN Hijacking

    http://en.wikipedia.org/wiki/DNS_hijacking
Test Name Synopsis
Verify DNS proxy handles use of bit 0x20 in DNS labels ipv6_dns_https_420 Verify DNS proxy handles use of bit 0x20 in DNS labels


    step 1. Add a new DNS hostname to the DNS servers on the WAN
    step 2. Create a new bit 0x20 version of the DNS hostname
    step 3. Initiate a DNS lookup from the LAN client using the bit 0x20 DNS label
    step 4. Verify the LAN client receives a valid DNS response
    step 5. Repeat this process for 100 variations of the bit 0x20 DNS label


    References:

    IETF RFC 8484 "DNS Queries over HTTPS (DoH)"

    https://tools.ietf.org/html/rfc8484

    IETF Internet-Draft draft-vixie-dnsext-dns0x20-00 "Use of Bit 0x20 in DNS Labels to Improve Transaction Identity"

    https://tools.ietf.org/html/draft-vixie-dnsext-dns0x20-00
Test Name Synopsis
Verify DNS proxy enforces DNS strict privacy usage profile ipv6_dns_https_500 Verify DNS proxy enforces DNS strict privacy usage profile


    step 1. Add a new DNS hostname to the DNS servers on the WAN
    step 2. Initiate a DNS lookup for the new unique hostname from the LAN
            client to the DUT's DNS proxy
    step 3. Verify the LAN client receives a valid DNS response
    step 4. Verify a new DNS request is sent to the primary or backup
            DNS servers using DNS over TLS

    NOTE: The list of secure transports (i.e. TLS, HTTPS (DoH) or
    both) which the DUT is expected to use when sending DNS queries
    can be configured via the testvar
    dnsUsageProfileStrictPrivacyTransports.


    References:

    IETF RFC 8484 "DNS Queries over HTTPS (DoH)"

    https://tools.ietf.org/html/rfc8484

    IETF RFC 8310 "Usage Profiles for DNS over (D)TLS" Section 5: Usage Profiles

    https://tools.ietf.org/html/rfc8310#section-5

dns-tcp-v6.tcl

IPv6 DNS over TCP proxy and DNS failover related tests

Test Name Synopsis
Verify IPv6 DNS proxy does not cache DNS entry when DNS TTL is 0 ipv6_dns_tcp_10 Verify IPv6 DNS proxy does not cache DNS entry when DNS TTL is 0


    step 1. Initiate a DNS lookup for a new unique hostname from the LAN
            client to the configured DNS server
    step 2. Return DNS response with TTL set to 0 from WAN DNS server
    step 3. Change the IP address on the DNS server for the new hostname
    step 4. Initiate a new DNS lookup for the same hostname
    step 5. Verify a new DNS request is sent to the primary or backup
            DNS servers

    NOTE: Zero values are interpreted to mean that the RR can only be
    used for the transaction in progress, and should not be cached.


    References:

    IETF RFC 1035 "DOMAIN NAMES - IMPLEMENTATION AND SPECIFICATION" Section 3.2.1: Format

    https://tools.ietf.org/html/rfc1035#section-3.2.1
Test Name Synopsis
Verify IPv6 DNS proxy returns TTL of 0 when returned DNS TTL is 0 ipv6_dns_tcp_11 Verify IPv6 DNS proxy returns TTL of 0 when returned DNS TTL is 0


    step 1. Initiate a DNS lookup for a new unique hostname from the LAN
            client to the configured DNS server
    step 2. Return DNS response with TTL set to 0 from WAN DNS server
    step 3. Verify the returned TTL from the DNS proxy is 0

    NOTE: Zero values are interpreted to mean that the RR can only be
    used for the transaction in progress, and should not be cached.


    References:

    IETF RFC 1035 "DOMAIN NAMES - IMPLEMENTATION AND SPECIFICATION" Section 3.2.1: Format

    https://tools.ietf.org/html/rfc1035#section-3.2.1
Test Name Synopsis
Verify AAAA IPv6 DNS queries to router are forwarded to real DNS server ipv6_dns_tcp_40 Verify AAAA IPv6 DNS queries to router are forwarded to real DNS server


    step 1. Initiate an AAAA IPv6 DNS query from the LAN client to the
            configured DNS server
    step 2. Verify the query is received by real DNS server on the WAN
            side
    step 3. The query may be received by the primary or backup DNS
            server
    step 4. Send a return response back to LAN
    step 5. Verify the response is received by LAN client

    NOTE: The router must support some type of DNS relay or proxy to
    pass this test case. The DNS relay or proxy must understand IPv6 DNS
    type AAAA lookups.


    References:

    IETF RFC 4074 "Common Misbehavior Against DNS Queries for IPv6 Addresses"

    https://tools.ietf.org/html/rfc4074
Test Name Synopsis
Verify AAAA IPv6 DNS queries can return no address for IPv6 to IPv4 failover ipv6_dns_tcp_41 Verify AAAA IPv6 DNS queries can return no address for IPv6 to IPv4 failover


    step 1. Initiate an AAAA IPv6 DNS query from the LAN client to the
            configured DNS server
    step 2. Verify the query is received by real DNS server on the WAN
            side
    step 3. The query may be received by the primary or backup DNS
            server
    step 4. Send an empty return response back to LAN
    step 5. Verify the response is received by LAN client

    NOTE: The router must support some type of DNS relay or proxy to
    pass this test case. The DNS relay or proxy must understand IPv6
    DNS type AAAA lookups.


    References:

    IETF RFC 4074 "Common Misbehavior Against DNS Queries for IPv6 Addresses"

    https://tools.ietf.org/html/rfc4074
Test Name Synopsis
Verify IPv6 DNS failover when non-zero error codes are received in non-authoritative DNS response ipv6_dns_tcp_45 Verify IPv6 DNS failover when non-zero error codes are received in non-authoritative DNS response


    step 1. Verify DNS error codes from 1 - 15.
    step 2. For each error code, send 3 DNS queries for a unique
            hostname to the DUT's LAN IP address.
    step 3. Verify a valid DNS response was received for all 3 DNS
            queries.
    step 4. Verify that all 3 DNS queries were received on the same
            WAN DNS server address, known as the current primary DNS
            server address.
    step 5. Configure DNS queries sent to the current primary DNS
            server address to return the error code, and all other DNS
            server addresses to return the normal response.
    step 6. All error responses from the current primary DNS server
            address will have the authoritative bit not set.
    step 7. Send 3 DNS queries for another unique hostname to the
            DUT's LAN IP address.
    step 8. Verify a valid DNS response is received if the error code
            is expected to trigger DNS failover.
    step 9. Verify that a DNS query was received on the current
            primary DNS server address.

    NOTE: Most DNS clients that support multiple DNS servers (primary and
    backup) use some type of failover for certain DNS error codes. The behavior
    for each error code is implementation dependent. The list of error codes
    that will cause DNS failover can be configured using the testvar
    'dnsFailoverAuth'. If no DNS error codes will cause failover, the testvar
    should be configured with the keyword 'none'.

    Example:

    testvar dnsFailoverNonAuth "2 4 5"

    Example with no failover support:

    testvar dnsFailoverNonAuth none

    NOTE: Unix OSes based on bind will normally failover if DNS error
    codes 2, 4, or 5 are received. Windows based OSes will normally
    failover on all DNS error codes except 3 (No Such Name).

    NOTE: In most configurations the DUT will learn the IPv4 and/or IPv6
    addresses of several DNS servers on the WAN. While CDRouter will Initiate
    all DNS queries on the LAN over IPv4 in this test, the DUT may use any of
    the DNS servers in its list (IPv4 of IPv6) for final resolution.
Test Name Synopsis
Verify IPv6 DNS failover when non-zero error codes are received in authoritative DNS response ipv6_dns_tcp_46 Verify IPv6 DNS failover when non-zero error codes are received in authoritative DNS response


    step 1. Verify DNS error codes from 1 - 15.
    step 2. For each error code, send 3 DNS queries for a unique
            hostname to the DUT's LAN IP address.
    step 3. Verify a valid DNS response was received for all 3 DNS
            queries.
    step 4. Verify that all 3 DNS queries were received on the same
            WAN DNS server address, known as the current primary DNS
            server address.
    step 5. Configure DNS queries sent to the current primary DNS
            server address to return the error code, and all other DNS
            server addresses to return the normal response.
    step 6. All error responses from the current primary DNS server
            address will have the authoritative bit set.
    step 7. Send 3 DNS queries for another unique hostname to the
            DUT's LAN IP address.
    step 8. Verify a valid DNS response is received if the error code
            is expected to trigger DNS failover.
    step 9. Verify that a DNS query was received on the current
            primary DNS server address.

    NOTE: Most DNS clients that support multiple DNS servers (primary and
    backup) use some type of failover for certain DNS error codes. The behavior
    for each error code is implementation dependent. The list of error codes
    that will cause DNS failover can be configured using the testvar
    'dnsFailoverAuth'. If no DNS error codes will cause failover, the testvar
    should be configured with the keyword 'none'.

    Example:

    testvar dnsFailoverAuth "2 4 5"

    Example with no failover support:

    testvar dnsFailoverAuth none

    NOTE: Unix OSes based on bind will normally failover if DNS error
    codes 2, 4, or 5 are received. Windows based OSes will normally
    failover on all DNS error codes except 3 (No Such Name).

    NOTE: In most configurations the DUT will learn the IPv4 and/or IPv6
    addresses of several DNS servers on the WAN. While CDRouter will Initiate
    all DNS queries on the LAN over IPv4 in this test, the DUT may use any of
    the DNS servers in its list (IPv4 of IPv6) for final resolution.
Test Name Synopsis
Verify Reverse PTR DNS queries to router are forwarded to real DNS server ipv6_dns_tcp_50 Verify Reverse PTR DNS queries to router are forwarded to real DNS server


    step 1. Initiate a reverse DNS query from the LAN client to the
            configured DNS server
    step 2. Verify the query is received by real DNS server on the WAN
            side
    step 3. The query may be received by the primary or backup DNS
            server
    step 4. Send a return response back to LAN
    step 5. Verify the response is received by LAN client

    NOTE: The router must support some type of DNS relay or proxy to
    pass this test case.
Test Name Synopsis
Verify Reverse AAAA IPv6 DNS queries to router are forwarded to real DNS server ipv6_dns_tcp_51 Verify Reverse AAAA IPv6 DNS queries to router are forwarded to real DNS server


    step 1. Initiate a reverse AAAA IPv6 DNS query from the LAN client
            to the configured DNS server
    step 2. Verify the query is received by real DNS server on the WAN
            side
    step 3. The query may be received by the primary or backup DNS
            server
    step 4. Send a return response back to LAN
    step 5. Verify the response is received by LAN client

    NOTE: The router must support some type of DNS relay or proxy to
    pass this test case.
Test Name Synopsis
Verify IPv6 DNS proxy fails over when new primary DNS server is learned ipv6_dns_tcp_60 Verify IPv6 DNS proxy fails over when new primary DNS server is learned


    step 1. Create a new primary and backup DNS server
    step 2. Terminate the WAN link and bring back up
    step 3. Issue DNS query from the LAN client to the DUT's LAN IP
            address
    step 4. Verify LAN client receives response from new DNS servers
    step 5. If DNS query fails, make additional attempts to allow
            possible failover
    step 6. Terminate the WAN link and bring back up with original DNS
            servers

    NOTE: This test is only run when the WAN mode is dynamic.

    NOTE: The amount of time to wait before checking that DNS has
    been updated after the WAN link is restored can be configured
    using the testvar 'dnsFailoverDelay'. The default is 10 seconds.

    NOTE: In IPv4 and IPv6 dual stack scenarios, the DUT may switch
    over to IPv6 DNS server addresses which have not changed. These
    servers are also unresponsive during the test and the DUT should
    fail over to the new IPv4 DNS servers. The number of DNS queries
    attempted may be configured using the testvar 'dnsFailoverAttempts'.
Test Name Synopsis
Verify IPv6 DNS lookups with multiple IPv4 responses ipv6_dns_tcp_70 Verify IPv6 DNS lookups with multiple IPv4 responses


    step 1. Initiate a DNS lookup for a new unique hostname from the LAN
            client to the configured DNS server
    step 2. Return DNS response with multiple IPv4 answers from WAN DNS
            server
    step 3. Verify LAN client learns all IPv4 answers from DNS lookup


    References:

    IETF RFC 1035 "DOMAIN NAMES - IMPLEMENTATION AND SPECIFICATION"

    https://tools.ietf.org/html/rfc1035
Test Name Synopsis
Verify IPv6 DNS proxy recovers after DNS server outage ipv6_dns_tcp_100 Verify IPv6 DNS proxy recovers after DNS server outage


    step 1. Verify initial DNS lookup is working
    step 2. Disable all DNS servers
    step 3. Initiate 3 DNS lookups for new domains which should fail
            from the LAN client to the DUT's LAN IP address
    step 4. Enable all DNS servers
    step 5. Verify DNS lookups start working again

    NOTE: Zero values are interpreted to mean that the RR can only be
    used for the transaction in progress, and should not be cached.
Test Name Synopsis
Verify IPv6 DNS queries including the EDNS0 option ipv6_dns_tcp_110 Verify IPv6 DNS queries including the EDNS0 option


    step 1. Initiate a DNS lookup containing EDNS0 option for a new
            unique hostname from the LAN client to the configured DNS
            server
    step 2. Return DNS response with TTL set to 0 from WAN DNS server
    step 3. Change the IP address on the DNS server for the new hostname
    step 4. Initiate a new DNS lookup containing EDNS0 option for the
            same hostname
    step 5. Verify a new DNS request is sent to the primary or backup
            DNS servers; inclusion of EDNS0 option should not affect
            ability to successfully resolve hostnames

    NOTE: Zero values are interpreted to mean that the RR can only be
    used for the transaction in progress, and should not be cached.


    References:

    IETF RFC 1035 "DOMAIN NAMES - IMPLEMENTATION AND SPECIFICATION" Section 3.2.1: Format

    https://tools.ietf.org/html/rfc1035#section-3.2.1
Test Name Synopsis
Verify large DNS responses using EDNS0 option ipv6_dns_tcp_120 Verify large DNS responses using EDNS0 option


    step 1. Configure a DNS entry with 200 IPv4 matching records that
            requires a UDP response slightly less than 4096
    step 2. Initiate a DNS lookup for a new unique hostname from the LAN
            client to the configured DNS server using EDNS0 option
            announcing a UDP buffer size of 4096
    step 3. Return DNS response with multiple IPv4 answers from WAN DNS
            server
    step 4. Verify LAN client learns all IPv4 answers from DNS lookup

    Reference: RFC 6891 Extension Mechanisms for DNS (EDNS0)
Test Name Synopsis
Verify maximum UDP payload value in EDNS0 option ipv6_dns_tcp_121 Verify maximum UDP payload value in EDNS0 option


    step 1. Initiate a DNS lookup for a unique hostname from the LAN
            client to the configured DNS server using EDNS0 option
            announcing a UDP buffer size of 4096
    step 2. Verify DNS response contains EDNS0 option
    step 3. Configure a DNS entry with enough matching IPv4 records that
            requires a UDP response slightly less than the EDNS0 UDP
            buffer size seen in step 2
    step 4. Initiate a DNS lookup for the same hostname from LAN client
            using EDNS0 option announcing a UDP buffer size of 4096
    step 5. Return DNS response with multiple IPv4 answers from WAN DNS
            server
    step 6. Verify LAN client learns all IPv4 answers from DNS lookup


    References:

    IETF RFC 6891 "Extension Mechanisms for DNS (EDNS0)"

    https://tools.ietf.org/html/rfc6891
Test Name Synopsis
Verify IPv6 DNS queries for TXT records ipv6_dns_tcp_130 Verify IPv6 DNS queries for TXT records


    step 1. Initiate a DNS TXT query from the LAN client to the
            configured DNS server
    step 2. Verify the query is received by real DNS server on the WAN
            side
    step 3. The query may be received by the primary or backup DNS server
    step 4. Send a return TXT response back to LAN
    step 5. Verify the response is received by LAN client


    References:

    IETF RFC 6891 "Extension Mechanisms for DNS (EDNS0)"

    https://tools.ietf.org/html/rfc6891
Test Name Synopsis
Verify DNS queries for CNAME records ipv6_dns_tcp_132 Verify DNS queries for CNAME records


    step 1. Initiate a DNS CNAME query from the LAN client to the
            configured DNS server
    step 2. Verify the query is received by real DNS server on the WAN
            side
    step 3. The query may be received by the primary or backup DNS server
    step 4. Send a return CNAME response back to LAN
    step 5. Verify the response is received by LAN client

    Reference: RFC 1035 Domain names - implementation and specification
Test Name Synopsis
Verify DNS queries for responses returning both CNAME and A records ipv6_dns_tcp_133 Verify DNS queries for responses returning both CNAME and A records


    step 1. Initiate a DNS query from the LAN client to the
            configured DNS server
    step 2. Verify the query is received by real DNS server on the WAN
            side
    step 3. The query may be received by the primary or backup DNS server
    step 4. Send both a CNAME and A records response back to LAN
    step 5. Verify the response is received by LAN client with both CNAME
            and A records


    References:

    IETF RFC 1035 "DOMAIN NAMES - IMPLEMENTATION AND SPECIFICATION"

    https://tools.ietf.org/html/rfc1035
Test Name Synopsis
Verify DNS queries for responses returning both CNAME and AAAA records ipv6_dns_tcp_134 Verify DNS queries for responses returning both CNAME and AAAA records


    step 1. Initiate a DNS query from the LAN client to the
            configured DNS server
    step 2. Verify the query is received by real DNS server on the WAN
            side
    step 3. The query may be received by the primary or backup DNS server
    step 4. Send both a CNAME and AAAA records response back to LAN
    step 5. Verify the response is received by LAN client with both CNAME
            and AAAA records


    References:

    IETF RFC 1035 "DOMAIN NAMES - IMPLEMENTATION AND SPECIFICATION"

    https://tools.ietf.org/html/rfc1035
Test Name Synopsis
Verify IPv6 DNS queries for SPF records ipv6_dns_tcp_140 Verify IPv6 DNS queries for SPF records


    step 1. Initiate a DNS SPF query from the LAN client to the
            configured DNS server
    step 2. Verify the query is received by real DNS server on the WAN
            side
    step 3. The query may be received by the primary or backup DNS
            server
    step 4. Send a return SPF response back to LAN
    step 5. Verify the response is received by LAN client


    References:

    IETF RFC 4408 "Sender Policy Framework (SPF) for Authorizing Use of Domains in E-Mail, Version 1"

    https://tools.ietf.org/html/rfc4408
Test Name Synopsis
Verify IPv6 DNS queries for SRV records ipv6_dns_tcp_141 Verify IPv6 DNS queries for SRV records


    step 1. Initiate a DNS SRV query from the LAN client to the
            configured DNS server
    step 2. Verify the query is received by real DNS server on the WAN
            side
    step 3. The query may be received by the primary or backup DNS
            server
    step 4. Send a return SRV response back to LAN
    step 5. Verify the response is received by LAN client
    step 6. Verify the response priority, weight, port and target fields


    References:

    IETF RFC 2782 "A DNS RR for specifying the location of services (DNS SRV)"

    https://tools.ietf.org/html/rfc2782
Test Name Synopsis
Verify DNS proxy behavior for DNS server status requests ipv6_dns_tcp_150 Verify DNS proxy behavior for DNS server status requests


    step 1. Send a DNS server status request from the LAN client to the
            configured DNS server
    step 2. Verify that the DNS proxy either forwards the server status request
            to the real DNS server or drops it based on the proxy's expected
            behavior

    NOTE: Scanning tools including Nmap utilize DNS server status requests when
    probing a host. Some DNS proxy implementations will drop DNS server status
    requests for security reasons. The testvar dnsForwardServerStatus should be
    set to a value of **no** if this is the expected behavior of the DUT's DNS
    proxy. For DNS proxy implementations that forward server status request
    messages upstream, the testvar dnsForwardServerStatus should be set to a
    value of **yes**.


    References:

    IETF RFC 5625 "DNS Proxy Implementation Guidelines" Section 3: Transparency Principle

    https://tools.ietf.org/html/rfc5625#section-3

    The DNS Status OPCODE Section 6: Security Considerations

    http://www.eric-a-hall.com/specs/draft-hall-status-opcode-00-1.txt6
Test Name Synopsis
Verify IPv6 DNS proxy does not mangle DNSSEC queries ipv6_dns_tcp_200 Verify IPv6 DNS proxy does not mangle DNSSEC queries


    step 1. Initiate a DNSKEY query from the LAN client to the
            configured DNS server
    step 2. The query may be received by the primary or backup DNS
            server
    step 3. Send a DNSKEY response back to LAN
    step 4. Verify the response is received by LAN client and all fields
            are correct
    step 5. Repeat steps 1-5 for RRSIG, DS, and NSEC queries

    NOTE: The router must support some type of DNS relay or proxy to
    pass this test case.


    References:

    IETF RFC 4034 "Resource Records for the DNS Security Extensions"

    https://tools.ietf.org/html/rfc4034
Test Name Synopsis
Verify IPv6 DNS proxy does not mangle large DNSSEC responses ipv6_dns_tcp_201 Verify IPv6 DNS proxy does not mangle large DNSSEC responses


    step 1. Initiate a DNSKEY query from the LAN client to the
            configured DNS server
    step 2. The query may be received by the primary or backup DNS
            server
    step 3. Send a large RRSIG response (greater than 1220 bytes) back
            to LAN
    step 4. Verify full response is received by LAN client and all
            fields are correct

    NOTE: The router must support some type of DNS relay or proxy to
    pass this test case.


    References:

    IETF RFC 4035 "Protocol Modifications for the DNS Security Extensions" Section 4.1: EDNS Support

    https://tools.ietf.org/html/rfc4035#section-4.1
Test Name Synopsis
Verify IPv6 DNS proxy honors TTL values when caching responses ipv6_dns_tcp_300 Verify IPv6 DNS proxy honors TTL values when caching responses


    step 1. Initiate a DNS lookup for a hostname from the LAN client to
            the DUT's LAN IP address
    step 2. Verify DUT's DNS proxy forwards the query to the WAN DNS
            server
    step 3. Change the address on the WAN DNS server for the new
            hostname
    step 4. Wait half the TTL value of the response
    step 5. Perform a DNS lookup on the same hostname from the LAN
    step 6. If supportsDnsCaching is yes, verify DUT's DNS proxy returns
            cached response from step 2 and does not forward the query
            to the WAN DNS server.  If supportsDnsCaching is no, verify
            DUT's DNS proxy forwards the query to the WAN DNS server
    step 7. Wait long enough for the TTL value of the response from
            step 2 to have elapsed
    step 8. Perform a DNS lookup on the same hostname from the LAN
    step 9. Verify DUT's DNS proxy forwards the query to the WAN DNS
            server


    References:

    IETF RFC 1035 "DOMAIN NAMES - IMPLEMENTATION AND SPECIFICATION" Section 4.1.3: Resource Record Format

    https://tools.ietf.org/html/rfc1035#section-4.1.3
Test Name Synopsis
Verify maximum number of cached DNS responses ipv6_dns_tcp_301 Verify maximum number of cached DNS responses


    step 1. Initiate a DNS lookup for a new unique hostname from the LAN
            client to the DUT's LAN IP address
    step 2. Verify that the DUT's DNS proxy forwards the query to the
            WAN DNS server
    step 3. Send a valid response to the DUT on the WAN and verify that
            DUT's DNS proxy forwards this response to the LAN client
    step 4. Repeat steps 1 through 3 (dnsCacheSize + 10) times
    step 5. Repeat steps 1 through 4 but look up the hostnames in
            reverse order
    step 6. Verify that the last 10 hostname lookups are not cached by
            the DUT's DNS proxy

    NOTE: The testvar dnsCacheSize should be configured to match the
    size of the DUT's DNS cache.
Test Name Synopsis
Verify parallel DNS queries ipv6_dns_tcp_400 Verify parallel DNS queries


    step 1. Initiate a DNS A record lookup for a new unique hostname
            from the LAN client to the configured DNS server.
    step 2. Initiate a DNS AAAA record lookup from the LAN client for
            the same hostname used in step 1 to the configured DNS
            server on the same socket as used in step 1.
    step 3. Verify that DNS responses are received for both DNS
            queries.
Test Name Synopsis
Verify DNS does not deploy NXDOMAIN hijacking for type A records ipv6_dns_tcp_410 Verify DNS does not deploy NXDOMAIN hijacking for type A records


    step 1. Initiate a DNS lookup for a new unique type A DNS record from
            the LAN client to the configured DNS server
    step 2. Return DNS response with NXDOMAIN (No such domain reply code)
    step 3. Verify the NXDOMAIN response is returned to the LAN client


    References:

    DNS NXDOMAIN Hijacking

    http://en.wikipedia.org/wiki/DNS_hijacking
Test Name Synopsis
Verify DNS does not deploy NXDOMAIN hijacking for type AAAA records ipv6_dns_tcp_411 Verify DNS does not deploy NXDOMAIN hijacking for type AAAA records


    step 1. Initiate a DNS lookup for a new unique type AAAA DNS record from
            the LAN client to the configured DNS server
    step 2. Return DNS response with NXDOMAIN (No such domain reply code)
    step 3. Verify the NXDOMAIN response is returned to the LAN client


    References:

    DNS NXDOMAIN Hijacking

    http://en.wikipedia.org/wiki/DNS_hijacking
Test Name Synopsis
Verify DNS proxy handles use of bit 0x20 in DNS labels ipv6_dns_tcp_420 Verify DNS proxy handles use of bit 0x20 in DNS labels


    step 1. Add a new DNS hostname to the DNS servers on the WAN
    step 2. Create a new bit 0x20 version of the DNS hostname    
    step 3. Initiate a DNS lookup from the LAN client using the bit 0x20 DNS label
    step 4. Verify the LAN client receives a valid DNS response
    step 5. Repeat this process for 100 variations of the bit 0x20 DNS label


    References:

    IETF Internet-Draft draft-vixie-dnsext-dns0x20-00 "Use of Bit 0x20 in DNS Labels to Improve Transaction Identity"

    https://tools.ietf.org/html/draft-vixie-dnsext-dns0x20-00
Test Name Synopsis
Verify DNS proxy enforces DNS strict privacy usage profile ipv6_dns_tcp_500 Verify DNS proxy enforces DNS strict privacy usage profile


    step 1. Add a new DNS hostname to the DNS servers on the WAN
    step 2. Initiate a DNS lookup for the new unique hostname from the LAN
            client to the DUT's DNS proxy
    step 3. Verify the LAN client receives a valid DNS response
    step 4. Verify a new DNS request is sent to the primary or backup
            DNS servers using DNS over TLS

    NOTE: The list of secure transports (i.e. TLS, HTTPS (DoH) or
    both) which the DUT is expected to use when sending DNS queries
    can be configured via the testvar
    dnsUsageProfileStrictPrivacyTransports.


    References:

    IETF RFC 8310 "Usage Profiles for DNS over (D)TLS" Section 5: Usage Profiles

    https://tools.ietf.org/html/rfc8310#section-5

dns-tls-v6.tcl

IPv6 DNS over TLS proxy and DNS failover related tests

Test Name Synopsis
Verify IPv6 DNS proxy does not cache DNS entry when DNS TTL is 0 ipv6_dns_tls_10 Verify IPv6 DNS proxy does not cache DNS entry when DNS TTL is 0


    step 1. Initiate a DNS lookup for a new unique hostname from the LAN
            client to the configured DNS server
    step 2. Return DNS response with TTL set to 0 from WAN DNS server
    step 3. Change the IP address on the DNS server for the new hostname
    step 4. Initiate a new DNS lookup for the same hostname
    step 5. Verify a new DNS request is sent to the primary or backup
            DNS servers

    NOTE: Zero values are interpreted to mean that the RR can only be
    used for the transaction in progress, and should not be cached.


    References:

    IETF RFC 1035 "DOMAIN NAMES - IMPLEMENTATION AND SPECIFICATION" Section 3.2.1: Format

    https://tools.ietf.org/html/rfc1035#section-3.2.1
Test Name Synopsis
Verify IPv6 DNS proxy returns TTL of 0 when returned DNS TTL is 0 ipv6_dns_tls_11 Verify IPv6 DNS proxy returns TTL of 0 when returned DNS TTL is 0


    step 1. Initiate a DNS lookup for a new unique hostname from the LAN
            client to the configured DNS server
    step 2. Return DNS response with TTL set to 0 from WAN DNS server
    step 3. Verify the returned TTL from the DNS proxy is 0

    NOTE: Zero values are interpreted to mean that the RR can only be
    used for the transaction in progress, and should not be cached.


    References:

    IETF RFC 1035 "DOMAIN NAMES - IMPLEMENTATION AND SPECIFICATION" Section 3.2.1: Format

    https://tools.ietf.org/html/rfc1035#section-3.2.1
Test Name Synopsis
Verify AAAA IPv6 DNS queries to router are forwarded to real DNS server ipv6_dns_tls_40 Verify AAAA IPv6 DNS queries to router are forwarded to real DNS server


    step 1. Initiate an AAAA IPv6 DNS query from the LAN client to the
            configured DNS server
    step 2. Verify the query is received by real DNS server on the WAN
            side
    step 3. The query may be received by the primary or backup DNS
            server
    step 4. Send a return response back to LAN
    step 5. Verify the response is received by LAN client

    NOTE: The router must support some type of DNS relay or proxy to
    pass this test case. The DNS relay or proxy must understand IPv6 DNS
    type AAAA lookups.


    References:

    IETF RFC 4074 "Common Misbehavior Against DNS Queries for IPv6 Addresses"

    https://tools.ietf.org/html/rfc4074
Test Name Synopsis
Verify AAAA IPv6 DNS queries can return no address for IPv6 to IPv4 failover ipv6_dns_tls_41 Verify AAAA IPv6 DNS queries can return no address for IPv6 to IPv4 failover


    step 1. Initiate an AAAA IPv6 DNS query from the LAN client to the
            configured DNS server
    step 2. Verify the query is received by real DNS server on the WAN
            side
    step 3. The query may be received by the primary or backup DNS
            server
    step 4. Send an empty return response back to LAN
    step 5. Verify the response is received by LAN client

    NOTE: The router must support some type of DNS relay or proxy to
    pass this test case. The DNS relay or proxy must understand IPv6
    DNS type AAAA lookups.


    References:

    IETF RFC 4074 "Common Misbehavior Against DNS Queries for IPv6 Addresses"

    https://tools.ietf.org/html/rfc4074
Test Name Synopsis
Verify IPv6 DNS failover when non-zero error codes are received in non-authoritative DNS response ipv6_dns_tls_45 Verify IPv6 DNS failover when non-zero error codes are received in non-authoritative DNS response


    step 1. Verify DNS error codes from 1 - 15.
    step 2. For each error code, send 3 DNS queries for a unique
            hostname to the DUT's LAN IP address.
    step 3. Verify a valid DNS response was received for all 3 DNS
            queries.
    step 4. Verify that all 3 DNS queries were received on the same
            WAN DNS server address, known as the current primary DNS
            server address.
    step 5. Configure DNS queries sent to the current primary DNS
            server address to return the error code, and all other DNS
            server addresses to return the normal response.
    step 6. All error responses from the current primary DNS server
            address will have the authoritative bit not set.
    step 7. Send 3 DNS queries for another unique hostname to the
            DUT's LAN IP address.
    step 8. Verify a valid DNS response is received if the error code
            is expected to trigger DNS failover.
    step 9. Verify that a DNS query was received on the current
            primary DNS server address.

    NOTE: Most DNS clients that support multiple DNS servers (primary and
    backup) use some type of failover for certain DNS error codes. The behavior
    for each error code is implementation dependent. The list of error codes
    that will cause DNS failover can be configured using the testvar
    'dnsFailoverAuth'. If no DNS error codes will cause failover, the testvar
    should be configured with the keyword 'none'.

    Example:

    testvar dnsFailoverNonAuth "2 4 5"

    Example with no failover support:

    testvar dnsFailoverNonAuth none

    NOTE: Unix OSes based on bind will normally failover if DNS error
    codes 2, 4, or 5 are received. Windows based OSes will normally
    failover on all DNS error codes except 3 (No Such Name).

    NOTE: In most configurations the DUT will learn the IPv4 and/or IPv6
    addresses of several DNS servers on the WAN. While CDRouter will Initiate
    all DNS queries on the LAN over IPv4 in this test, the DUT may use any of
    the DNS servers in its list (IPv4 of IPv6) for final resolution.
Test Name Synopsis
Verify IPv6 DNS failover when non-zero error codes are received in authoritative DNS response ipv6_dns_tls_46 Verify IPv6 DNS failover when non-zero error codes are received in authoritative DNS response


    step 1. Verify DNS error codes from 1 - 15.
    step 2. For each error code, send 3 DNS queries for a unique
            hostname to the DUT's LAN IP address.
    step 3. Verify a valid DNS response was received for all 3 DNS
            queries.
    step 4. Verify that all 3 DNS queries were received on the same
            WAN DNS server address, known as the current primary DNS
            server address.
    step 5. Configure DNS queries sent to the current primary DNS
            server address to return the error code, and all other DNS
            server addresses to return the normal response.
    step 6. All error responses from the current primary DNS server
            address will have the authoritative bit set.
    step 7. Send 3 DNS queries for another unique hostname to the
            DUT's LAN IP address.
    step 8. Verify a valid DNS response is received if the error code
            is expected to trigger DNS failover.
    step 9. Verify that a DNS query was received on the current
            primary DNS server address.

    NOTE: Most DNS clients that support multiple DNS servers (primary and
    backup) use some type of failover for certain DNS error codes. The behavior
    for each error code is implementation dependent. The list of error codes
    that will cause DNS failover can be configured using the testvar
    'dnsFailoverAuth'. If no DNS error codes will cause failover, the testvar
    should be configured with the keyword 'none'.

    Example:

    testvar dnsFailoverAuth "2 4 5"

    Example with no failover support:

    testvar dnsFailoverAuth none

    NOTE: Unix OSes based on bind will normally failover if DNS error
    codes 2, 4, or 5 are received. Windows based OSes will normally
    failover on all DNS error codes except 3 (No Such Name).

    NOTE: In most configurations the DUT will learn the IPv4 and/or IPv6
    addresses of several DNS servers on the WAN. While CDRouter will Initiate
    all DNS queries on the LAN over IPv4 in this test, the DUT may use any of
    the DNS servers in its list (IPv4 of IPv6) for final resolution.
Test Name Synopsis
Verify Reverse PTR DNS queries to router are forwarded to real DNS server ipv6_dns_tls_50 Verify Reverse PTR DNS queries to router are forwarded to real DNS server


    step 1. Initiate a reverse DNS query from the LAN client to the
            configured DNS server
    step 2. Verify the query is received by real DNS server on the WAN
            side
    step 3. The query may be received by the primary or backup DNS
            server
    step 4. Send a return response back to LAN
    step 5. Verify the response is received by LAN client

    NOTE: The router must support some type of DNS relay or proxy to
    pass this test case.
Test Name Synopsis
Verify Reverse AAAA IPv6 DNS queries to router are forwarded to real DNS server ipv6_dns_tls_51 Verify Reverse AAAA IPv6 DNS queries to router are forwarded to real DNS server


    step 1. Initiate a reverse AAAA IPv6 DNS query from the LAN client
            to the configured DNS server
    step 2. Verify the query is received by real DNS server on the WAN
            side
    step 3. The query may be received by the primary or backup DNS
            server
    step 4. Send a return response back to LAN
    step 5. Verify the response is received by LAN client

    NOTE: The router must support some type of DNS relay or proxy to
    pass this test case.
Test Name Synopsis
Verify IPv6 DNS proxy fails over when new primary DNS server is learned ipv6_dns_tls_60 Verify IPv6 DNS proxy fails over when new primary DNS server is learned


    step 1. Create a new primary and backup DNS server
    step 2. Terminate the WAN link and bring back up
    step 3. Issue DNS query from the LAN client to the DUT's LAN IP
            address
    step 4. Verify LAN client receives response from new DNS servers
    step 5. If DNS query fails, make additional attempts to allow
            possible failover
    step 6. Terminate the WAN link and bring back up with original DNS
            servers

    NOTE: This test is only run when the WAN mode is dynamic.

    NOTE: The amount of time to wait before checking that DNS has
    been updated after the WAN link is restored can be configured
    using the testvar 'dnsFailoverDelay'. The default is 10 seconds.

    NOTE: In IPv4 and IPv6 dual stack scenarios, the DUT may switch
    over to IPv6 DNS server addresses which have not changed. These
    servers are also unresponsive during the test and the DUT should
    fail over to the new IPv4 DNS servers. The number of DNS queries
    attempted may be configured using the testvar 'dnsFailoverAttempts'.
Test Name Synopsis
Verify IPv6 DNS lookups with multiple IPv4 responses ipv6_dns_tls_70 Verify IPv6 DNS lookups with multiple IPv4 responses


    step 1. Initiate a DNS lookup for a new unique hostname from the LAN
            client to the configured DNS server
    step 2. Return DNS response with multiple IPv4 answers from WAN DNS
            server
    step 3. Verify LAN client learns all IPv4 answers from DNS lookup


    References:

    IETF RFC 1035 "DOMAIN NAMES - IMPLEMENTATION AND SPECIFICATION"

    https://tools.ietf.org/html/rfc1035
Test Name Synopsis
Verify IPv6 DNS proxy recovers after DNS server outage ipv6_dns_tls_100 Verify IPv6 DNS proxy recovers after DNS server outage


    step 1. Verify initial DNS lookup is working
    step 2. Disable all DNS servers
    step 3. Initiate 3 DNS lookups for new domains which should fail
            from the LAN client to the DUT's LAN IP address
    step 4. Enable all DNS servers
    step 5. Verify DNS lookups start working again

    NOTE: Zero values are interpreted to mean that the RR can only be
    used for the transaction in progress, and should not be cached.
Test Name Synopsis
Verify IPv6 DNS queries including the EDNS0 option ipv6_dns_tls_110 Verify IPv6 DNS queries including the EDNS0 option


    step 1. Initiate a DNS lookup containing EDNS0 option for a new
            unique hostname from the LAN client to the configured DNS
            server
    step 2. Return DNS response with TTL set to 0 from WAN DNS server
    step 3. Change the IP address on the DNS server for the new hostname
    step 4. Initiate a new DNS lookup containing EDNS0 option for the
            same hostname
    step 5. Verify a new DNS request is sent to the primary or backup
            DNS servers; inclusion of EDNS0 option should not affect
            ability to successfully resolve hostnames

    NOTE: Zero values are interpreted to mean that the RR can only be
    used for the transaction in progress, and should not be cached.


    References:

    IETF RFC 1035 "DOMAIN NAMES - IMPLEMENTATION AND SPECIFICATION" Section 3.2.1: Format

    https://tools.ietf.org/html/rfc1035#section-3.2.1
Test Name Synopsis
Verify large DNS responses using EDNS0 option ipv6_dns_tls_120 Verify large DNS responses using EDNS0 option


    step 1. Configure a DNS entry with 200 IPv4 matching records that
            requires a UDP response slightly less than 4096
    step 2. Initiate a DNS lookup for a new unique hostname from the LAN
            client to the configured DNS server using EDNS0 option
            announcing a UDP buffer size of 4096
    step 3. Return DNS response with multiple IPv4 answers from WAN DNS
            server
    step 4. Verify LAN client learns all IPv4 answers from DNS lookup


    References:

    IETF RFC 6891 "Extension Mechanisms for DNS (EDNS0)"

    https://tools.ietf.org/html/rfc6891
Test Name Synopsis
Verify maximum UDP payload value in EDNS0 option ipv6_dns_tls_121 Verify maximum UDP payload value in EDNS0 option


    step 1. Initiate a DNS lookup for a unique hostname from the LAN
            client to the configured DNS server using EDNS0 option
            announcing a UDP buffer size of 4096
    step 2. Verify DNS response contains EDNS0 option
    step 3. Configure a DNS entry with enough matching IPv4 records that
            requires a UDP response slightly less than the EDNS0 UDP
            buffer size seen in step 2
    step 4. Initiate a DNS lookup for the same hostname from LAN client
            using EDNS0 option announcing a UDP buffer size of 4096
    step 5. Return DNS response with multiple IPv4 answers from WAN DNS
            server
    step 6. Verify LAN client learns all IPv4 answers from DNS lookup


    References:

    IETF RFC 6891 "Extension Mechanisms for DNS (EDNS0)"

    https://tools.ietf.org/html/rfc6891
Test Name Synopsis
Verify IPv6 DNS queries for TXT records ipv6_dns_tls_130 Verify IPv6 DNS queries for TXT records


    step 1. Initiate a DNS TXT query from the LAN client to the
            configured DNS server
    step 2. Verify the query is received by real DNS server on the WAN
            side
    step 3. The query may be received by the primary or backup DNS server
    step 4. Send a return TXT response back to LAN
    step 5. Verify the response is received by LAN client

    Reference: RFC 1035 Domain names - implementation and specification
Test Name Synopsis
Verify DNS queries for CNAME records ipv6_dns_tls_132 Verify DNS queries for CNAME records


    step 1. Initiate a DNS CNAME query from the LAN client to the
            configured DNS server
    step 2. Verify the query is received by real DNS server on the WAN
            side
    step 3. The query may be received by the primary or backup DNS server
    step 4. Send a return CNAME response back to LAN
    step 5. Verify the response is received by LAN client


    References:

    IETF RFC 1035 "DOMAIN NAMES - IMPLEMENTATION AND SPECIFICATION"

    https://tools.ietf.org/html/rfc1035
Test Name Synopsis
Verify DNS queries for responses returning both CNAME and A records ipv6_dns_tls_133 Verify DNS queries for responses returning both CNAME and A records


    step 1. Initiate a DNS query from the LAN client to the
            configured DNS server
    step 2. Verify the query is received by real DNS server on the WAN
            side
    step 3. The query may be received by the primary or backup DNS server
    step 4. Send both a CNAME and A records response back to LAN
    step 5. Verify the response is received by LAN client with both CNAME
            and A records


    References:

    IETF RFC 1035 "DOMAIN NAMES - IMPLEMENTATION AND SPECIFICATION"

    https://tools.ietf.org/html/rfc1035
Test Name Synopsis
Verify DNS queries for responses returning both CNAME and AAAA records ipv6_dns_tls_134 Verify DNS queries for responses returning both CNAME and AAAA records


    step 1. Initiate a DNS query from the LAN client to the
            configured DNS server
    step 2. Verify the query is received by real DNS server on the WAN
            side
    step 3. The query may be received by the primary or backup DNS server
    step 4. Send both a CNAME and AAAA records response back to LAN
    step 5. Verify the response is received by LAN client with both CNAME
            and AAAA records


    References:

    IETF RFC 1035 "DOMAIN NAMES - IMPLEMENTATION AND SPECIFICATION"

    https://tools.ietf.org/html/rfc1035
Test Name Synopsis
Verify IPv6 DNS queries for SPF records ipv6_dns_tls_140 Verify IPv6 DNS queries for SPF records


    step 1. Initiate a DNS SPF query from the LAN client to the
            configured DNS server
    step 2. Verify the query is received by real DNS server on the WAN
            side
    step 3. The query may be received by the primary or backup DNS
            server
    step 4. Send a return SPF response back to LAN
    step 5. Verify the response is received by LAN client


    References:

    IETF RFC 4408 "Sender Policy Framework (SPF) for Authorizing Use of Domains in E-Mail, Version 1"

    https://tools.ietf.org/html/rfc4408
Test Name Synopsis
Verify IPv6 DNS queries for SRV records ipv6_dns_tls_141 Verify IPv6 DNS queries for SRV records


    step 1. Initiate a DNS SRV query from the LAN client to the
            configured DNS server
    step 2. Verify the query is received by real DNS server on the WAN
            side
    step 3. The query may be received by the primary or backup DNS
            server
    step 4. Send a return SRV response back to LAN
    step 5. Verify the response is received by LAN client
    step 6. Verify the response priority, weight, port and target fields


    References:

    IETF RFC 2782 "A DNS RR for specifying the location of services (DNS SRV)"

    https://tools.ietf.org/html/rfc2782
Test Name Synopsis
Verify DNS proxy behavior for DNS server status requests ipv6_dns_tls_150 Verify DNS proxy behavior for DNS server status requests


    step 1. Send a DNS server status request from the LAN client to the
            configured DNS server
    step 2. Verify that the DNS proxy either forwards the server status request
            to the real DNS server or drops it based on the proxy's expected
            behavior

    NOTE: Scanning tools including Nmap utilize DNS server status requests when
    probing a host. Some DNS proxy implementations will drop DNS server status
    requests for security reasons. The testvar dnsForwardServerStatus should be
    set to a value of **no** if this is the expected behavior of the DUT's DNS
    proxy. For DNS proxy implementations that forward server status request
    messages upstream, the testvar dnsForwardServerStatus should be set to a
    value of **yes**.


    References:

    IETF RFC 5625 "DNS Proxy Implementation Guidelines" Section 3: Transparency Principle

    https://tools.ietf.org/html/rfc5625#section-3

    The DNS Status OPCODE Section 6: Security Considerations

    http://www.eric-a-hall.com/specs/draft-hall-status-opcode-00-1.txt6
Test Name Synopsis
Verify IPv6 DNS proxy does not mangle DNSSEC queries ipv6_dns_tls_200 Verify IPv6 DNS proxy does not mangle DNSSEC queries


    step 1. Initiate a DNSKEY query from the LAN client to the
            configured DNS server
    step 2. The query may be received by the primary or backup DNS
            server
    step 3. Send a DNSKEY response back to LAN
    step 4. Verify the response is received by LAN client and all fields
            are correct
    step 5. Repeat steps 1-5 for RRSIG, DS, and NSEC queries

    NOTE: The router must support some type of DNS relay or proxy to
    pass this test case.


    References:

    IETF RFC 4034 "Resource Records for the DNS Security Extensions"

    https://tools.ietf.org/html/rfc4034
Test Name Synopsis
Verify IPv6 DNS proxy does not mangle large DNSSEC responses ipv6_dns_tls_201 Verify IPv6 DNS proxy does not mangle large DNSSEC responses


    step 1. Initiate a DNSKEY query from the LAN client to the
            configured DNS server
    step 2. The query may be received by the primary or backup DNS
            server
    step 3. Send a large RRSIG response (greater than 1220 bytes) back
            to LAN
    step 4. Verify full response is received by LAN client and all
            fields are correct

    NOTE: The router must support some type of DNS relay or proxy to
    pass this test case.


    References:

    IETF RFC 4035 "Protocol Modifications for the DNS Security Extensions" Section 4.1: EDNS Support

    https://tools.ietf.org/html/rfc4035#section-4.1
Test Name Synopsis
Verify IPv6 DNS proxy honors TTL values when caching responses ipv6_dns_tls_300 Verify IPv6 DNS proxy honors TTL values when caching responses


    step 1. Initiate a DNS lookup for a hostname from the LAN client to
            the DUT's LAN IP address
    step 2. Verify DUT's DNS proxy forwards the query to the WAN DNS
            server
    step 3. Change the address on the WAN DNS server for the new
            hostname
    step 4. Wait half the TTL value of the response
    step 5. Perform a DNS lookup on the same hostname from the LAN
    step 6. If supportsDnsCaching is yes, verify DUT's DNS proxy returns
            cached response from step 2 and does not forward the query
            to the WAN DNS server.  If supportsDnsCaching is no, verify
            DUT's DNS proxy forwards the query to the WAN DNS server
    step 7. Wait long enough for the TTL value of the response from
            step 2 to have elapsed
    step 8. Perform a DNS lookup on the same hostname from the LAN
    step 9. Verify DUT's DNS proxy forwards the query to the WAN DNS
            server


    References:

    IETF RFC 1035 "DOMAIN NAMES - IMPLEMENTATION AND SPECIFICATION" Section 4.1.3: Resource Record Format

    https://tools.ietf.org/html/rfc1035#section-4.1.3
Test Name Synopsis
Verify maximum number of cached DNS responses ipv6_dns_tls_301 Verify maximum number of cached DNS responses


    step 1. Initiate a DNS lookup for a new unique hostname from the LAN
            client to the DUT's LAN IP address
    step 2. Verify that the DUT's DNS proxy forwards the query to the
            WAN DNS server
    step 3. Send a valid response to the DUT on the WAN and verify that
            DUT's DNS proxy forwards this response to the LAN client
    step 4. Repeat steps 1 through 3 (dnsCacheSize + 10) times
    step 5. Repeat steps 1 through 4 but look up the hostnames in
            reverse order
    step 6. Verify that the last 10 hostname lookups are not cached by
            the DUT's DNS proxy

    NOTE: The testvar dnsCacheSize should be configured to match the
    size of the DUT's DNS cache.
Test Name Synopsis
Verify parallel DNS queries ipv6_dns_tls_400 Verify parallel DNS queries


    step 1. Initiate a DNS A record lookup for a new unique hostname
            from the LAN client to the configured DNS server.
    step 2. Initiate a DNS AAAA record lookup from the LAN client for
            the same hostname used in step 1 to the configured DNS
            server on the same socket as used in step 1.
    step 3. Verify that DNS responses are received for both DNS
            queries.
Test Name Synopsis
Verify DNS does not deploy NXDOMAIN hijacking for type A records ipv6_dns_tls_410 Verify DNS does not deploy NXDOMAIN hijacking for type A records


    step 1. Initiate a DNS lookup for a new unique type A DNS record from
            the LAN client to the configured DNS server
    step 2. Return DNS response with NXDOMAIN (No such domain reply code)
    step 3. Verify the NXDOMAIN response is returned to the LAN client


    References:

    DNS NXDOMAIN Hijacking

    http://en.wikipedia.org/wiki/DNS_hijacking
Test Name Synopsis
Verify DNS does not deploy NXDOMAIN hijacking for type AAAA records ipv6_dns_tls_411 Verify DNS does not deploy NXDOMAIN hijacking for type AAAA records


    step 1. Initiate a DNS lookup for a new unique type AAAA DNS record from
            the LAN client to the configured DNS server
    step 2. Return DNS response with NXDOMAIN (No such domain reply code)
    step 3. Verify the NXDOMAIN response is returned to the LAN client


    References:

    DNS NXDOMAIN Hijacking

    http://en.wikipedia.org/wiki/DNS_hijacking
Test Name Synopsis
Verify DNS proxy handles use of bit 0x20 in DNS labels ipv6_dns_tls_420 Verify DNS proxy handles use of bit 0x20 in DNS labels


    step 1. Add a new DNS hostname to the DNS servers on the WAN
    step 2. Create a new bit 0x20 version of the DNS hostname
    step 3. Initiate a DNS lookup from the LAN client using the bit 0x20 DNS label
    step 4. Verify the LAN client receives a valid DNS response
    step 5. Repeat this process for 100 variations of the bit 0x20 DNS label


    References:

    IETF Internet-Draft draft-vixie-dnsext-dns0x20-00 "Use of Bit 0x20 in DNS Labels to Improve Transaction Identity"

    https://tools.ietf.org/html/draft-vixie-dnsext-dns0x20-00
Test Name Synopsis
Verify DNS proxy enforces DNS strict privacy usage profile ipv6_dns_tls_500 Verify DNS proxy enforces DNS strict privacy usage profile


    step 1. Add a new DNS hostname to the DNS servers on the WAN
    step 2. Initiate a DNS lookup for the new unique hostname from the LAN
            client to the DUT's DNS proxy
    step 3. Verify the LAN client receives a valid DNS response
    step 4. Verify a new DNS request is sent to the primary or backup
            DNS servers using DNS over TLS

    NOTE: The list of secure transports (i.e. TLS, HTTPS (DoH) or
    both) which the DUT is expected to use when sending DNS queries
    can be configured via the testvar
    dnsUsageProfileStrictPrivacyTransports.


    References:

    IETF RFC 8310 "Usage Profiles for DNS over (D)TLS" Section 5: Usage Profiles

    https://tools.ietf.org/html/rfc8310#section-5

url-filter-v6.tcl

IPv6 URL filtering tests for LAN side HTTP clients

Test Name Synopsis
Verify HTTP GETs to filtered URLs over IPv6 are blocked ipv6_urlfilter_10 Verify HTTP GETs to filtered URLs over IPv6 are blocked


    step 1. Set up new web server on WAN side using IPv6 free network address
    step 2. Resolve domain IPv6 address using DNS AAAA lookup from LAN client
    step 3. Initiate IPv6 TCP connection to web server from LAN client
    step 4. Verify TCP connection is opened
    step 5. Send HTTP GET from LAN client to new server for requested URL
    step 6. URL is considered blocked if one of the following occurs:
              a. The LAN client does not receive a page from the webserver
              b. The LAN client receives a page from the webserver, but
                 the HTTP status code is not 200 "OK"
              c. The LAN client receives a page from the webserver with
                 an HTTP status code of 200, but the returned page contains
                 text indicating that the page was administratively blocked,
                 as defined by the testvar 'urlFilterBlockedText'
    step 7. Repeat for each configured filtered URL
    step 8. Verify that each configured non-filtered URL returns a valid
            webpage

    NOTE: This test is only performed if the testvar 'urlFilterSupported'
    is set to "yes". The testvars 'filtered-urls' and 'non-filtered-urls'
    are used to specify which URLs are used during this test.

    NOTE: This test allows the CPE to block a URL by preventing establishment
    of the TCP connection in step 4, using a proxy to return a non-200 HTTP
    status code in step 6, or using a proxy to return a 200 HTTP status code
    in step 6 with alternate webpage text indicating that the page was
    admninistratively blocked. The testvar 'urlFilterBlockedText' should be
    configured with a portion of the expected text returned when a page is
    blocked by the CPE.
Test Name Synopsis
Verify HTTP GETs to filtered URLs over IPv6 are blocked without DNS lookups ipv6_urlfilter_12 Verify HTTP GETs to filtered URLs over IPv6 are blocked without DNS lookups


    step 1. Set up new web server on WAN side using IPv6 free network address
    step 2. Resolve only domain IPv6 addresses for non-filtered URLs using AAAA
            lookup from LAN client
    step 3. Initiate IPv6 TCP connection to web server from LAN client
    step 4. Verify TCP connection is opened
    step 5. Send HTTP GET from LAN client to new server for requested URL
    step 6. URL is considered blocked if one of the following occurs:
              a. The LAN client does not receive a page from the webserver
              b. The LAN client receives a page from the webserver, but
                 the HTTP status code is not 200 "OK"
              c. The LAN client receives a page from the webserver with
                 an HTTP status code of 200, but the returned page contains
                 text indicating that the page was administratively blocked,
                 as defined by the testvar 'urlFilterBlockedText'
    step 7. Repeat for each configured filtered URL
    step 8. Verify that each configured non-filtered URL returns a valid
            webpage

    NOTE: This test is only performed if the testvar 'urlFilterSupported'
    is set to "yes". The testvars 'filtered-urls' and 'non-filtered-urls'
    are used to specify which URLs are used during this test.

    NOTE: This test allows the CPE to block a URL by preventing establishment
    of the TCP connection in step 4, using a proxy to return a non-200 HTTP
    status code in step 6, or using a proxy to return a 200 HTTP status code
    in step 6 with alternate webpage text indicating that the page was
    admninistratively blocked. The testvar 'urlFilterBlockedText' should be
    configured with a portion of the expected text returned when a page is
    blocked by the CPE.
Test Name Synopsis
Verify HTTP HEADs to filtered URLs over IPv6 are blocked ipv6_urlfilter_15 Verify HTTP HEADs to filtered URLs over IPv6 are blocked


    step 1. Set up new web server on WAN side using IPv6 free network address
    step 2. Resolve domain IPv6 address using DNS AAAA lookup from LAN client
    step 3. Initiate IPv6 TCP connection to web server from LAN client
    step 4. Verify TCP connection is opened
    step 5. Send HTTP HEAD from LAN client to new server for requested URL
    step 6. URL is considered blocked if one of the following occurs:
              a. The LAN client does not receive a page from the webserver
              b. The LAN client receives a page from the webserver, but
                 the HTTP status code is not 200 "OK"
              c. The LAN client receives a page from the webserver with
                 an HTTP status code of 200, but the returned page contains
                 text indicating that the page was administratively blocked,
                 as defined by the testvar 'urlFilterBlockedText'
    step 7. Repeat for each configured filtered URL
    step 8. Verify that each configured non-filtered URL returns a valid
            webpage

    NOTE: This test is only performed if the testvar 'urlFilterSupported'
    is set to "yes". The testvars 'filtered-urls' and 'non-filtered-urls'
    are used to specify which URLs are used during this test.

    NOTE: This test allows the CPE to block a URL by preventing establishment
    of the TCP connection in step 4, using a proxy to return a non-200 HTTP
    status code in step 6, or using a proxy to return a 200 HTTP status code
    in step 6 with alternate webpage text indicating that the page was
    admninistratively blocked. The testvar 'urlFilterBlockedText' should be
    configured with a portion of the expected text returned when a page is
    blocked by the CPE.
Test Name Synopsis
Verify HTTP POSTs to filtered URLs over IPv6 are blocked ipv6_urlfilter_20 Verify HTTP POSTs to filtered URLs over IPv6 are blocked


    step 1. Set up new web server on WAN side using IPv6 free network address
    step 2. Resolve domain IPv6 address using DNS AAAA lookup from LAN client
    step 3. Initiate IPv6 TCP connection to web server from LAN client
    step 4. Verify TCP connection is opened
    step 5. Send HTTP POST from LAN client to new server for requested URL
    step 6. URL is considered blocked if one of the following occurs:
              a. The LAN client does not receive a page from the webserver
              b. The LAN client receives a page from the webserver, but
                 the HTTP status code is not 200 "OK"
              c. The LAN client receives a page from the webserver with
                 an HTTP status code of 200, but the returned page contains
                 text indicating that the page was administratively blocked,
                 as defined by the testvar 'urlFilterBlockedText'
    step 7. Repeat for each configured filtered URL
    step 8. Verify that each configured non-filtered URL returns a valid
            webpage

    NOTE: This test is only performed if the testvar 'urlFilterSupported'
    is set to "yes". The testvars 'filtered-urls' and 'non-filtered-urls'
    are used to specify which URLs are used during this test.

    NOTE: This test allows the CPE to block a URL by preventing establishment
    of the TCP connection in step 4, using a proxy to return a non-200 HTTP
    status code in step 6, or using a proxy to return a 200 HTTP status code
    in step 6 with alternate webpage text indicating that the page was
    admninistratively blocked. The testvar 'urlFilterBlockedText' should be
    configured with a portion of the expected text returned when a page is
    blocked by the CPE.
Test Name Synopsis
Verify URL filtering over IPv6 does not look at Cookie data ipv6_urlfilter_30 Verify URL filtering over IPv6 does not look at Cookie data


    step 1. Set up new web server on WAN side using IPv6 free network address
    step 2. Resolve domain IPv6 address using DNS AAAA lookup from LAN client
    step 3. Initiate IPv6 TCP connection to web server from LAN client
    step 4. Verify TCP connection is opened
    step 5. Send HTTP GET from LAN client to new server for requested URL
    step 6. Use one of the filtered URLs as the cookie data
    step 7. Verify webserver does return a response
    step 8. Repeat for each configured allowed URL

    NOTE: This test is only performed if the testvar 'urlFilterSupported'
    is set to "yes". The testvars 'filtered-urls' and 'non-filtered-urls'
    are used to specify which URLs are used during this test.
Test Name Synopsis
Verify HTTPS GETs to filtered URLs over IPv6 are blocked ipv6_urlfilter_40 Verify HTTPS GETs to filtered URLs over IPv6 are blocked


    step 1. Set up new HTTPS server on WAN side using IPv6 free network address
    step 2. Resolve domain IPv6 address using DNS AAAA lookup from LAN client
    step 3. Initiate IPv6 TCP connection to web server from LAN client
    step 4. If TCP connection is not established, skip to step 9
    step 5. Verify TCP connection is opened
    step 6.  Establish SSL connection to server
    step 7.  Send HTTPS GET from LAN client to new server for requested URL
    step 8.  URL is considered blocked if one of the following occurs:
              a. The LAN client does not receive a page from the webserver
              b. The LAN client receives a page from the webserver, but
                 the HTTP status code is not 200 "OK"
              c. The LAN client receives a page from the webserver with
                 an HTTP status code of 200, but the returned page contains
                 text indicating that the page was administratively blocked,
                 as defined by the testvar 'urlFilterBlockedText'
    step 9.  Repeat for each configured filtered URL
    step 10. Verify that each configured non-filtered URL returns a valid
             webpage

    NOTE: This test is only performed if the testvar 'urlFilterSupported'
    is set to "yes". The testvars 'filtered-urls' and 'non-filtered-urls'
    are used to specify which URLs are used during this test.

    NOTE: This test allows the CPE to block a URL by preventing establishment
    of the TCP connection in step 4, using a proxy to return a non-200 HTTP
    status code in step 8, or using a proxy to return a 200 HTTP status code
    in step 8 with alternate webpage text indicating that the page was
    admninistratively blocked. The testvar 'urlFilterBlockedText' should be
    configured with a portion of the expected text returned when a page is
    blocked by the CPE.

mcast-v6.tcl

MLDv1/v2 and multicast data tests for IPv6 MLD proxy

Test Name Synopsis
MLD packets from LAN are proxied to WAN interface ipv6_mcast_1 MLD packets from LAN are proxied to WAN interface


    step 1. Send an MLDv1/2 Query on the WAN to allow device to detect MLD version
    step 2. Send an MLDv1/2 Membership Report packet on the LAN interface
    step 3. Verify an MLDv1/2 Membership Report packet is received on the WAN interface
    step 4. For MLDv2, verify group record is CHANGE_TO_EXCLUDE_MODE for the group
            with an empty source list.
    step 5. Repeat test using an MLDv1 Leave packet or MLDv2 Memebership Report
            to leave the multicast group
    step 6. For MLDv2, verify group record is CHANGE_TO_INCLUDE_MODE for the group
            with an empty source list.

    NOTE: Some routers may send an MLD query on the LAN interface after the
    MLD Leave from the LAN client. The MLD Leave may not be sent on the
    WAN interface until the LAN side has made multiple queries.

    The amount of time this test case should wait before expecting the
    MLD Leave on the WAN interface may be configured by setting the
    testvar 'ipv6MulticastCacheTimeout'.

    Example:

    testvar ipv6MulticastCacheTimeout 30


    References:

    IETF RFC 2710 "Multicast Listener Discovery (MLD) for IPv6"

    https://tools.ietf.org/html/rfc2710

    IETF RFC 3810 "Multicast Listener Discovery Version 2 (MLDv2) for IPv6"

    https://tools.ietf.org/html/rfc3810
Test Name Synopsis
Verify IPv6 Hop-Limit is decremented for multicast packets ipv6_mcast_2 Verify IPv6 Hop-Limit is decremented for multicast packets


    step 1. Send an MLDv1/2 Query on the WAN to allow device to detect MLD version
    step 2. Join a multicast group on the LAN interface
    step 3. Send a UDP packet to the multicast group from the WAN
    step 4. Verify the multicast packet is received on the LAN
    step 5. Verify the TTL is decremented by the expected IP hop count

    NOTE: This test will work with either a multicast pass through implementation
    or a multicast proxy implementation.

    NOTE: The number of expected IP hops can be configured using the testvar
    'IPv6HopCount'. The default is 1 IP hop. If the device is using bridge
    mode, the expected IPv6HopCount is 0.

    NOTE: The testvar ipv6MulticastJoinDelay can be used to control how long
    the test waits to verify the multicast traffic after receiving the
    MLD report. The default value is 2 seconds.

    testvar ipv6MulticastJoinDelay 2

    References:

    IETF RFC 2710 "Multicast Listener Discovery (MLD) for IPv6"

    https://tools.ietf.org/html/rfc2710

    IETF RFC 3810 "Multicast Listener Discovery Version 2 (MLDv2) for IPv6"

    https://tools.ietf.org/html/rfc3810
Test Name Synopsis
Forward Multicast IPv6 UDP packets with various packet lengths (LAN to WAN) ipv6_mcast_11 Forward Multicast IPv6 UDP packets with various packet lengths (LAN to WAN)


    step 1. Send an MLDv1/2 Query on the WAN to allow device to detect MLD version
    step 2. Join a multicast group on the WAN interface
    step 3. Forward a multicast UDP packet from the LAN with UDP length 4
    step 4. Verify the packet is received on the WAN interface
    step 5. Repeat for all packet sizes up to the max MTU

    NOTE: This test will work with either a multicast pass through implementation
    or a multicast proxy implementation.

    NOTE: The testvar ipv6MulticastJoinDelay can be used to control how long
    the test waits to verify the multicast traffic after receiving the
    MLD report. The default value is 2 seconds.

    testvar ipv6MulticastJoinDelay 2

    NOTE: If the device does not support forwarding multiast traffic
    to the WAN, this test case may be skipped by setting
    the testvar supportsIPv6MulticastOut to no.

    For examp