tests.sh revision 1.1.1.1.2.3
1 #!/bin/sh 2 # 3 # Copyright (C) Internet Systems Consortium, Inc. ("ISC") 4 # 5 # This Source Code Form is subject to the terms of the Mozilla Public 6 # License, v. 2.0. If a copy of the MPL was not distributed with this 7 # file, You can obtain one at http://mozilla.org/MPL/2.0/. 8 # 9 # See the COPYRIGHT file distributed with this work for additional 10 # information regarding copyright ownership. 11 12 SYSTEMTESTTOP=.. 13 . $SYSTEMTESTTOP/conf.sh 14 15 status=0 16 n=1 17 18 rm -f dig.out.* 19 20 DIGOPTS="+tcp +noadd +nosea +nostat +nocmd +dnssec -p ${PORT}" 21 ADDITIONALOPTS="+noall +additional +dnssec -p ${PORT}" 22 ANSWEROPTS="+noall +answer +dnssec -p ${PORT}" 23 DELVOPTS="-a ns1/trusted.conf -p ${PORT}" 24 RNDCCMD="$RNDC -c $SYSTEMTESTTOP/common/rndc.conf -p ${CONTROLPORT} -s" 25 26 # convert private-type records to readable form 27 showprivate () { 28 echo "-- $@ --" 29 $DIG $DIGOPTS +nodnssec +short @$2 -t type65534 $1 | cut -f3 -d' ' | 30 while read record; do 31 $PERL -e 'my $rdata = pack("H*", @ARGV[0]); 32 die "invalid record" unless length($rdata) == 5; 33 my ($alg, $key, $remove, $complete) = unpack("CnCC", $rdata); 34 my $action = "signing"; 35 $action = "removing" if $remove; 36 my $state = " (incomplete)"; 37 $state = " (complete)" if $complete; 38 print ("$action: alg: $alg, key: $key$state\n");' $record 39 done 40 } 41 42 # check that signing records are marked as complete 43 checkprivate () { 44 ret=0 45 x=`showprivate "$@"` 46 echo $x | grep incomplete >/dev/null 2>&1 && ret=1 47 [ $ret = 1 ] && { 48 echo "$x" 49 echo_i "failed" 50 } 51 return $ret 52 } 53 54 # check that a zone file is raw format, version 0 55 israw0 () { 56 cat $1 | $PERL -e 'binmode STDIN; 57 read(STDIN, $input, 8); 58 ($style, $version) = unpack("NN", $input); 59 exit 1 if ($style != 2 || $version != 0);' 60 return $? 61 } 62 63 # check that a zone file is raw format, version 1 64 israw1 () { 65 cat $1 | $PERL -e 'binmode STDIN; 66 read(STDIN, $input, 8); 67 ($style, $version) = unpack("NN", $input); 68 exit 1 if ($style != 2 || $version != 1);' 69 return $? 70 } 71 72 # strip NS and RRSIG NS from input 73 stripns () { 74 awk '($4 == "NS") || ($4 == "RRSIG" && $5 == "NS") { next} { print }' $1 75 } 76 77 # Check that for a query against a validating resolver where the 78 # authoritative zone is unsigned (insecure delegation), glue is returned 79 # in the additional section 80 echo_i "checking that additional glue is returned for unsigned delegation ($n)" 81 ret=0 82 $DIG +tcp +dnssec -p ${PORT} a.insecure.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1 83 grep "ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2" dig.out.ns4.test$n > /dev/null || ret=1 84 grep "ns\.insecure\.example\..*A.10\.53\.0\.3" dig.out.ns4.test$n > /dev/null || ret=1 85 n=`expr $n + 1` 86 if [ $ret != 0 ]; then echo_i "failed"; fi 87 status=`expr $status + $ret` 88 89 # Check the example. domain 90 91 echo_i "checking that zone transfer worked ($n)" 92 for i in 1 2 3 4 5 6 7 8 9 93 do 94 ret=0 95 $DIG $DIGOPTS a.example. @10.53.0.2 a > dig.out.ns2.test$n || ret=1 96 $DIG $DIGOPTS a.example. @10.53.0.3 a > dig.out.ns3.test$n || ret=1 97 $PERL ../digcomp.pl dig.out.ns2.test$n dig.out.ns3.test$n > /dev/null || ret=1 98 [ $ret = 0 ] && break 99 sleep 1 100 done 101 digcomp dig.out.ns2.test$n dig.out.ns3.test$n > /dev/null || ret=1 102 n=`expr $n + 1` 103 if [ $ret != 0 ]; then echo_i "failed"; fi 104 status=`expr $status + $ret` 105 106 # test AD bit: 107 # - dig +adflag asks for authentication (ad in response) 108 echo_i "checking AD bit asking for validation ($n)" 109 ret=0 110 $DIG $DIGOPTS +noauth +noadd +nodnssec +adflag a.example. @10.53.0.2 a > dig.out.ns2.test$n || ret=1 111 $DIG $DIGOPTS +noauth +noadd +nodnssec +adflag a.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1 112 digcomp dig.out.ns2.test$n dig.out.ns4.test$n || ret=1 113 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 114 n=`expr $n + 1` 115 if [ $ret != 0 ]; then echo_i "failed"; fi 116 status=`expr $status + $ret` 117 118 # test AD bit: 119 # - dig +noadflag 120 echo_i "checking that AD is not set without +adflag or +dnssec ($n)" 121 ret=0 122 $DIG $DIGOPTS +noauth +noadd +nodnssec +noadflag a.example. @10.53.0.2 a > dig.out.ns2.test$n || ret=1 123 $DIG $DIGOPTS +noauth +noadd +nodnssec +noadflag a.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1 124 digcomp dig.out.ns2.test$n dig.out.ns4.test$n || ret=1 125 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 126 n=`expr $n + 1` 127 if [ $ret != 0 ]; then echo_i "failed"; fi 128 status=`expr $status + $ret` 129 130 echo_i "checking for AD in authoritative answer ($n)" 131 ret=0 132 $DIG $DIGOPTS a.example. @10.53.0.2 a > dig.out.ns2.test$n || ret=1 133 grep "flags:.*ad.*QUERY" dig.out.ns2.test$n > /dev/null && ret=1 134 n=`expr $n + 1` 135 if [ $ret != 0 ]; then echo_i "failed"; fi 136 status=`expr $status + $ret` 137 138 echo_i "checking positive validation NSEC ($n)" 139 ret=0 140 $DIG $DIGOPTS +noauth a.example. @10.53.0.2 a > dig.out.ns2.test$n || ret=1 141 $DIG $DIGOPTS +noauth a.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1 142 digcomp dig.out.ns2.test$n dig.out.ns4.test$n || ret=1 143 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 144 n=`expr $n + 1` 145 if [ $ret != 0 ]; then echo_i "failed"; fi 146 status=`expr $status + $ret` 147 148 if [ -x ${DELV} ] ; then 149 ret=0 150 echo_i "checking positive validation NSEC using dns_client ($n)" 151 $DELV $DELVOPTS @10.53.0.4 a a.example > delv.out$n || ret=1 152 grep "a.example..*10.0.0.1" delv.out$n > /dev/null || ret=1 153 grep "a.example..*.RRSIG.A $DEFAULT_ALGORITHM_NUMBER 2 300 .*" delv.out$n > /dev/null || ret=1 154 n=`expr $n + 1` 155 if [ $ret != 0 ]; then echo_i "failed"; fi 156 status=`expr $status + $ret` 157 fi 158 159 echo_i "checking positive validation NSEC3 ($n)" 160 ret=0 161 $DIG $DIGOPTS +noauth a.nsec3.example. \ 162 @10.53.0.3 a > dig.out.ns3.test$n || ret=1 163 $DIG $DIGOPTS +noauth a.nsec3.example. \ 164 @10.53.0.4 a > dig.out.ns4.test$n || ret=1 165 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 166 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 167 n=`expr $n + 1` 168 if [ $ret != 0 ]; then echo_i "failed"; fi 169 status=`expr $status + $ret` 170 171 if [ -x ${DELV} ] ; then 172 ret=0 173 echo_i "checking positive validation NSEC3 using dns_client ($n)" 174 $DELV $DELVOPTS @10.53.0.4 a a.nsec3.example > delv.out$n || ret=1 175 grep "a.nsec3.example..*10.0.0.1" delv.out$n > /dev/null || ret=1 176 grep "a.nsec3.example..*RRSIG.A 7 3 300.*" delv.out$n > /dev/null || ret=1 177 n=`expr $n + 1` 178 if [ $ret != 0 ]; then echo_i "failed"; fi 179 status=`expr $status + $ret` 180 fi 181 182 echo_i "checking positive validation OPTOUT ($n)" 183 ret=0 184 $DIG $DIGOPTS +noauth a.optout.example. \ 185 @10.53.0.3 a > dig.out.ns3.test$n || ret=1 186 $DIG $DIGOPTS +noauth a.optout.example. \ 187 @10.53.0.4 a > dig.out.ns4.test$n || ret=1 188 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 189 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 190 n=`expr $n + 1` 191 if [ $ret != 0 ]; then echo_i "failed"; fi 192 status=`expr $status + $ret` 193 194 if [ -x ${DELV} ] ; then 195 ret=0 196 echo_i "checking positive validation OPTOUT using dns_client ($n)" 197 $DELV $DELVOPTS @10.53.0.4 a a.optout.example > delv.out$n || ret=1 198 grep "a.optout.example..*10.0.0.1" delv.out$n > /dev/null || ret=1 199 grep "a.optout.example..*RRSIG.A 7 3 300.*" delv.out$n > /dev/null || ret=1 200 n=`expr $n + 1` 201 if [ $ret != 0 ]; then echo_i "failed"; fi 202 status=`expr $status + $ret` 203 fi 204 205 echo_i "checking positive wildcard validation NSEC ($n)" 206 ret=0 207 $DIG $DIGOPTS a.wild.example. @10.53.0.3 a > dig.out.ns3.test$n || ret=1 208 $DIG $DIGOPTS a.wild.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1 209 stripns dig.out.ns3.test$n > dig.out.ns3.stripped.test$n 210 stripns dig.out.ns4.test$n > dig.out.ns4.stripped.test$n 211 digcomp dig.out.ns3.stripped.test$n dig.out.ns4.stripped.test$n || ret=1 212 grep "\*\.wild\.example\..*RRSIG NSEC" dig.out.ns4.test$n > /dev/null || ret=1 213 grep "\*\.wild\.example\..*NSEC z\.example" dig.out.ns4.test$n > /dev/null || ret=1 214 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 215 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 216 n=`expr $n + 1` 217 if [ $ret != 0 ]; then echo_i "failed"; fi 218 status=`expr $status + $ret` 219 220 if [ -x ${DELV} ] ; then 221 ret=0 222 echo_i "checking positive wildcard validation NSEC using dns_client ($n)" 223 $DELV $DELVOPTS @10.53.0.4 a a.wild.example > delv.out$n || ret=1 224 grep "a.wild.example..*10.0.0.27" delv.out$n > /dev/null || ret=1 225 grep -E "a.wild.example..*RRSIG.A [0-9]+ 2 300.*" delv.out$n > /dev/null || ret=1 226 n=`expr $n + 1` 227 if [ $ret != 0 ]; then echo_i "failed"; fi 228 status=`expr $status + $ret` 229 fi 230 231 echo_i "checking positive wildcard answer NSEC3 ($n)" 232 ret=0 233 $DIG $DIGOPTS a.wild.nsec3.example. @10.53.0.3 a > dig.out.ns3.test$n || ret=1 234 grep "AUTHORITY: 4," dig.out.ns3.test$n > /dev/null || ret=1 235 grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || ret=1 236 n=`expr $n + 1` 237 if [ $ret != 0 ]; then echo_i "failed"; fi 238 status=`expr $status + $ret` 239 240 echo_i "checking positive wildcard answer NSEC3 ($n)" 241 ret=0 242 $DIG $DIGOPTS a.wild.nsec3.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1 243 grep "AUTHORITY: 4," dig.out.ns4.test$n > /dev/null || ret=1 244 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 245 n=`expr $n + 1` 246 if [ $ret != 0 ]; then echo_i "failed"; fi 247 status=`expr $status + $ret` 248 249 echo_i "checking positive wildcard validation NSEC3 ($n)" 250 ret=0 251 $DIG $DIGOPTS a.wild.nsec3.example. @10.53.0.3 a > dig.out.ns3.test$n || ret=1 252 $DIG $DIGOPTS a.wild.nsec3.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1 253 stripns dig.out.ns3.test$n > dig.out.ns3.stripped.test$n 254 stripns dig.out.ns4.test$n > dig.out.ns4.stripped.test$n 255 digcomp dig.out.ns3.stripped.test$n dig.out.ns4.stripped.test$n || ret=1 256 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 257 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 258 n=`expr $n + 1` 259 if [ $ret != 0 ]; then echo_i "failed"; fi 260 status=`expr $status + $ret` 261 262 if [ -x ${DELV} ] ; then 263 ret=0 264 echo_i "checking positive wildcard validation NSEC3 using dns_client ($n)" 265 $DELV $DELVOPTS @10.53.0.4 a a.wild.nsec3.example > delv.out$n || ret=1 266 grep "a.wild.nsec3.example..*10.0.0.6" delv.out$n > /dev/null || ret=1 267 grep "a.wild.nsec3.example..*RRSIG.A 7 3 300.*" delv.out$n > /dev/null || ret=1 268 n=`expr $n + 1` 269 if [ $ret != 0 ]; then echo_i "failed"; fi 270 status=`expr $status + $ret` 271 fi 272 273 echo_i "checking positive wildcard validation OPTOUT ($n)" 274 ret=0 275 $DIG $DIGOPTS a.wild.optout.example. \ 276 @10.53.0.3 a > dig.out.ns3.test$n || ret=1 277 $DIG $DIGOPTS a.wild.optout.example. \ 278 @10.53.0.4 a > dig.out.ns4.test$n || ret=1 279 stripns dig.out.ns3.test$n > dig.out.ns3.stripped.test$n 280 stripns dig.out.ns4.test$n > dig.out.ns4.stripped.test$n 281 digcomp dig.out.ns3.stripped.test$n dig.out.ns4.stripped.test$n || ret=1 282 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 283 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 284 n=`expr $n + 1` 285 if [ $ret != 0 ]; then echo_i "failed"; fi 286 status=`expr $status + $ret` 287 288 if [ -x ${DELV} ] ; then 289 ret=0 290 echo_i "checking positive wildcard validation OPTOUT using dns_client ($n)" 291 $DELV $DELVOPTS @10.53.0.4 a a.wild.optout.example > delv.out$n || ret=1 292 grep "a.wild.optout.example..*10.0.0.6" delv.out$n > /dev/null || ret=1 293 grep "a.wild.optout.example..*RRSIG.A 7 3 300.*" delv.out$n > /dev/null || ret=1 294 n=`expr $n + 1` 295 if [ $ret != 0 ]; then echo_i "failed"; fi 296 status=`expr $status + $ret` 297 fi 298 299 echo_i "checking negative validation NXDOMAIN NSEC ($n)" 300 ret=0 301 $DIG $DIGOPTS +noauth q.example. @10.53.0.2 a > dig.out.ns2.test$n || ret=1 302 $DIG $DIGOPTS +noauth q.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1 303 digcomp dig.out.ns2.test$n dig.out.ns4.test$n || ret=1 304 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 305 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1 306 n=`expr $n + 1` 307 if [ $ret != 0 ]; then echo_i "failed"; fi 308 status=`expr $status + $ret` 309 310 if [ -x ${DELV} ] ; then 311 ret=0 312 echo_i "checking negative validation NXDOMAIN NSEC using dns_client ($n)" 313 $DELV $DELVOPTS @10.53.0.4 a q.example > delv.out$n 2>&1 || ret=1 314 grep "resolution failed: ncache nxdomain" delv.out$n > /dev/null || ret=1 315 n=`expr $n + 1` 316 if [ $ret != 0 ]; then echo_i "failed"; fi 317 status=`expr $status + $ret` 318 fi 319 320 echo_i "checking negative validation NXDOMAIN NSEC3 ($n)" 321 ret=0 322 $DIG $DIGOPTS +noauth q.nsec3.example. \ 323 @10.53.0.3 a > dig.out.ns3.test$n || ret=1 324 $DIG $DIGOPTS +noauth q.nsec3.example. \ 325 @10.53.0.4 a > dig.out.ns4.test$n || ret=1 326 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 327 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 328 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1 329 n=`expr $n + 1` 330 if [ $ret != 0 ]; then echo_i "failed"; fi 331 status=`expr $status + $ret` 332 333 if [ -x ${DELV} ] ; then 334 ret=0 335 echo_i "checking negative validation NXDOMAIN NSEC3 using dns_client ($n)" 336 $DELV $DELVOPTS @10.53.0.4 a q.nsec3.example > delv.out$n 2>&1 || ret=1 337 grep "resolution failed: ncache nxdomain" delv.out$n > /dev/null || ret=1 338 n=`expr $n + 1` 339 if [ $ret != 0 ]; then echo_i "failed"; fi 340 status=`expr $status + $ret` 341 fi 342 343 echo_i "checking negative validation NXDOMAIN OPTOUT ($n)" 344 ret=0 345 $DIG $DIGOPTS +noauth q.optout.example. \ 346 @10.53.0.3 a > dig.out.ns3.test$n || ret=1 347 $DIG $DIGOPTS +noauth q.optout.example. \ 348 @10.53.0.4 a > dig.out.ns4.test$n || ret=1 349 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 350 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1 351 # Note - this is looking for failure, hence the && 352 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 353 n=`expr $n + 1` 354 if [ $ret != 0 ]; then echo_i "failed"; fi 355 status=`expr $status + $ret` 356 357 if [ -x ${DELV} ] ; then 358 ret=0 359 echo_i "checking negative validation NXDOMAIN OPTOUT using dns_client ($n)" 360 $DELV $DELVOPTS @10.53.0.4 a q.optout.example > delv.out$n 2>&1 || ret=1 361 grep "resolution failed: ncache nxdomain" delv.out$n > /dev/null || ret=1 362 n=`expr $n + 1` 363 if [ $ret != 0 ]; then echo_i "failed"; fi 364 status=`expr $status + $ret` 365 fi 366 367 echo_i "checking negative validation NODATA NSEC ($n)" 368 ret=0 369 $DIG $DIGOPTS +noauth a.example. @10.53.0.2 txt > dig.out.ns2.test$n || ret=1 370 $DIG $DIGOPTS +noauth a.example. @10.53.0.4 txt > dig.out.ns4.test$n || ret=1 371 digcomp dig.out.ns2.test$n dig.out.ns4.test$n || ret=1 372 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 373 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 374 grep "ANSWER: 0" dig.out.ns4.test$n > /dev/null || ret=1 375 n=`expr $n + 1` 376 if [ $ret != 0 ]; then echo_i "failed"; fi 377 status=`expr $status + $ret` 378 379 if [ -x ${DELV} ] ; then 380 ret=0 381 echo_i "checking negative validation NODATA OPTOUT using dns_client ($n)" 382 $DELV $DELVOPTS @10.53.0.4 txt a.example > delv.out$n 2>&1 || ret=1 383 grep "resolution failed: ncache nxrrset" delv.out$n > /dev/null || ret=1 384 n=`expr $n + 1` 385 if [ $ret != 0 ]; then echo_i "failed"; fi 386 status=`expr $status + $ret` 387 fi 388 389 echo_i "checking negative validation NODATA NSEC3 ($n)" 390 ret=0 391 $DIG $DIGOPTS +noauth a.nsec3.example. \ 392 @10.53.0.3 txt > dig.out.ns3.test$n || ret=1 393 $DIG $DIGOPTS +noauth a.nsec3.example. \ 394 @10.53.0.4 txt > dig.out.ns4.test$n || ret=1 395 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 396 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 397 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 398 grep "ANSWER: 0" dig.out.ns4.test$n > /dev/null || ret=1 399 n=`expr $n + 1` 400 if [ $ret != 0 ]; then echo_i "failed"; fi 401 status=`expr $status + $ret` 402 403 if [ -x ${DELV} ] ; then 404 ret=0 405 echo_i "checking negative validation NODATA NSEC3 using dns_client ($n)" 406 $DELV $DELVOPTS @10.53.0.4 txt a.nsec3.example > delv.out$n 2>&1 || ret=1 407 grep "resolution failed: ncache nxrrset" delv.out$n > /dev/null || ret=1 408 n=`expr $n + 1` 409 if [ $ret != 0 ]; then echo_i "failed"; fi 410 status=`expr $status + $ret` 411 fi 412 413 echo_i "checking negative validation NODATA OPTOUT ($n)" 414 ret=0 415 $DIG $DIGOPTS +noauth a.optout.example. \ 416 @10.53.0.3 txt > dig.out.ns3.test$n || ret=1 417 $DIG $DIGOPTS +noauth a.optout.example. \ 418 @10.53.0.4 txt > dig.out.ns4.test$n || ret=1 419 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 420 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 421 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 422 grep "ANSWER: 0" dig.out.ns4.test$n > /dev/null || ret=1 423 n=`expr $n + 1` 424 if [ $ret != 0 ]; then echo_i "failed"; fi 425 status=`expr $status + $ret` 426 427 if [ -x ${DELV} ] ; then 428 ret=0 429 echo_i "checking negative validation NODATA OPTOUT using dns_client ($n)" 430 $DELV $DELVOPTS @10.53.0.4 txt a.optout.example > delv.out$n 2>&1 || ret=1 431 grep "resolution failed: ncache nxrrset" delv.out$n > /dev/null || ret=1 432 n=`expr $n + 1` 433 if [ $ret != 0 ]; then echo_i "failed"; fi 434 status=`expr $status + $ret` 435 fi 436 437 echo_i "checking negative wildcard validation NSEC ($n)" 438 ret=0 439 $DIG $DIGOPTS b.wild.example. @10.53.0.2 txt > dig.out.ns2.test$n || ret=1 440 $DIG $DIGOPTS b.wild.example. @10.53.0.4 txt > dig.out.ns4.test$n || ret=1 441 digcomp dig.out.ns2.test$n dig.out.ns4.test$n || ret=1 442 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 443 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 444 n=`expr $n + 1` 445 if [ $ret != 0 ]; then echo_i "failed"; fi 446 status=`expr $status + $ret` 447 448 if [ -x ${DELV} ] ; then 449 ret=0 450 echo_i "checking negative wildcard validation NSEC using dns_client ($n)" 451 $DELV $DELVOPTS @10.53.0.4 txt b.wild.example > delv.out$n 2>&1 || ret=1 452 grep "resolution failed: ncache nxrrset" delv.out$n > /dev/null || ret=1 453 n=`expr $n + 1` 454 if [ $ret != 0 ]; then echo_i "failed"; fi 455 status=`expr $status + $ret` 456 fi 457 458 echo_i "checking negative wildcard validation NSEC3 ($n)" 459 ret=0 460 $DIG $DIGOPTS b.wild.nsec3.example. @10.53.0.3 txt > dig.out.ns3.test$n || ret=1 461 $DIG $DIGOPTS b.wild.nsec3.example. @10.53.0.4 txt > dig.out.ns4.test$n || ret=1 462 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 463 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 464 n=`expr $n + 1` 465 if [ $ret != 0 ]; then echo_i "failed"; fi 466 status=`expr $status + $ret` 467 468 if [ -x ${DELV} ] ; then 469 ret=0 470 echo_i "checking negative wildcard validation NSEC3 using dns_client ($n)" 471 $DELV $DELVOPTS @10.53.0.4 txt b.wild.nsec3.example > delv.out$n 2>&1 || ret=1 472 grep "resolution failed: ncache nxrrset" delv.out$n > /dev/null || ret=1 473 n=`expr $n + 1` 474 if [ $ret != 0 ]; then echo_i "failed"; fi 475 status=`expr $status + $ret` 476 fi 477 478 echo_i "checking negative wildcard validation OPTOUT ($n)" 479 ret=0 480 $DIG $DIGOPTS b.wild.optout.example. \ 481 @10.53.0.3 txt > dig.out.ns3.test$n || ret=1 482 $DIG $DIGOPTS b.wild.optout.example. \ 483 @10.53.0.4 txt > dig.out.ns4.test$n || ret=1 484 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 485 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 486 # Note - this is looking for failure, hence the && 487 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 488 n=`expr $n + 1` 489 if [ $ret != 0 ]; then echo_i "failed"; fi 490 status=`expr $status + $ret` 491 492 if [ -x ${DELV} ] ; then 493 ret=0 494 echo_i "checking negative wildcard validation OPTOUT using dns_client ($n)" 495 $DELV $DELVOPTS @10.53.0.4 txt b.optout.nsec3.example > delv.out$n 2>&1 || ret=1 496 grep "resolution failed: ncache nxrrset" delv.out$n > /dev/null || ret=1 497 n=`expr $n + 1` 498 if [ $ret != 0 ]; then echo_i "failed"; fi 499 status=`expr $status + $ret` 500 fi 501 502 # Check the insecure.example domain 503 504 echo_i "checking 1-server insecurity proof NSEC ($n)" 505 ret=0 506 $DIG $DIGOPTS +noauth a.insecure.example. @10.53.0.3 a > dig.out.ns3.test$n || ret=1 507 $DIG $DIGOPTS +noauth a.insecure.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1 508 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 509 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 510 # Note - this is looking for failure, hence the && 511 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 512 n=`expr $n + 1` 513 if [ $ret != 0 ]; then echo_i "failed"; fi 514 status=`expr $status + $ret` 515 516 if [ -x ${DELV} ] ; then 517 ret=0 518 echo_i "checking 1-server insecurity proof NSEC using dns_client ($n)" 519 $DELV $DELVOPTS @10.53.0.4 a a.insecure.example > delv.out$n || ret=1 520 grep "a.insecure.example..*10.0.0.1" delv.out$n > /dev/null || ret=1 521 n=`expr $n + 1` 522 if [ $ret != 0 ]; then echo_i "failed"; fi 523 status=`expr $status + $ret` 524 fi 525 526 echo_i "checking 1-server insecurity proof NSEC3 ($n)" 527 ret=0 528 $DIG $DIGOPTS +noauth a.insecure.nsec3.example. @10.53.0.3 a > dig.out.ns3.test$n || ret=1 529 $DIG $DIGOPTS +noauth a.insecure.nsec3.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1 530 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 531 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 532 # Note - this is looking for failure, hence the && 533 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 534 n=`expr $n + 1` 535 if [ $ret != 0 ]; then echo_i "failed"; fi 536 status=`expr $status + $ret` 537 538 if [ -x ${DELV} ] ; then 539 ret=0 540 echo_i "checking 1-server insecurity proof NSEC3 using dns_client ($n)" 541 $DELV $DELVOPTS @10.53.0.4 a a.insecure.nsec3.example > delv.out$n || ret=1 542 grep "a.insecure.nsec3.example..*10.0.0.1" delv.out$n > /dev/null || ret=1 543 n=`expr $n + 1` 544 if [ $ret != 0 ]; then echo_i "failed"; fi 545 status=`expr $status + $ret` 546 fi 547 548 echo_i "checking 1-server insecurity proof OPTOUT ($n)" 549 ret=0 550 $DIG $DIGOPTS +noauth a.insecure.optout.example. @10.53.0.3 a > dig.out.ns3.test$n || ret=1 551 $DIG $DIGOPTS +noauth a.insecure.optout.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1 552 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 553 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 554 # Note - this is looking for failure, hence the && 555 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 556 n=`expr $n + 1` 557 if [ $ret != 0 ]; then echo_i "failed"; fi 558 status=`expr $status + $ret` 559 560 if [ -x ${DELV} ] ; then 561 ret=0 562 echo_i "checking 1-server insecurity proof OPTOUT using dns_client ($n)" 563 $DELV $DELVOPTS @10.53.0.4 a a.insecure.optout.example > delv.out$n || ret=1 564 grep "a.insecure.optout.example..*10.0.0.1" delv.out$n > /dev/null || ret=1 565 n=`expr $n + 1` 566 if [ $ret != 0 ]; then echo_i "failed"; fi 567 status=`expr $status + $ret` 568 fi 569 570 echo_i "checking 1-server negative insecurity proof NSEC ($n)" 571 ret=0 572 $DIG $DIGOPTS q.insecure.example. a @10.53.0.3 \ 573 > dig.out.ns3.test$n || ret=1 574 $DIG $DIGOPTS q.insecure.example. a @10.53.0.4 \ 575 > dig.out.ns4.test$n || ret=1 576 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 577 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1 578 # Note - this is looking for failure, hence the && 579 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 580 n=`expr $n + 1` 581 if [ $ret != 0 ]; then echo_i "failed"; fi 582 status=`expr $status + $ret` 583 584 if [ -x ${DELV} ] ; then 585 ret=0 586 echo_i "checking 1-server negative insecurity proof NSEC using dns_client ($n)" 587 $DELV $DELVOPTS @10.53.0.4 a q.insecure.example > delv.out$n 2>&1 || ret=1 588 grep "resolution failed: ncache nxdomain" delv.out$n > /dev/null || ret=1 589 n=`expr $n + 1` 590 if [ $ret != 0 ]; then echo_i "failed"; fi 591 status=`expr $status + $ret` 592 fi 593 594 echo_i "checking 1-server negative insecurity proof NSEC3 ($n)" 595 ret=0 596 $DIG $DIGOPTS q.insecure.nsec3.example. a @10.53.0.3 \ 597 > dig.out.ns3.test$n || ret=1 598 $DIG $DIGOPTS q.insecure.nsec3.example. a @10.53.0.4 \ 599 > dig.out.ns4.test$n || ret=1 600 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 601 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1 602 # Note - this is looking for failure, hence the && 603 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 604 n=`expr $n + 1` 605 if [ $ret != 0 ]; then echo_i "failed"; fi 606 status=`expr $status + $ret` 607 608 if [ -x ${DELV} ] ; then 609 ret=0 610 echo_i "checking 1-server negative insecurity proof NSEC3 using dns_client ($n)" 611 $DELV $DELVOPTS @10.53.0.4 a q.insecure.nsec3.example > delv.out$n 2>&1 || ret=1 612 grep "resolution failed: ncache nxdomain" delv.out$n > /dev/null || ret=1 613 n=`expr $n + 1` 614 if [ $ret != 0 ]; then echo_i "failed"; fi 615 status=`expr $status + $ret` 616 fi 617 618 echo_i "checking 1-server negative insecurity proof OPTOUT ($n)" 619 ret=0 620 $DIG $DIGOPTS q.insecure.optout.example. a @10.53.0.3 \ 621 > dig.out.ns3.test$n || ret=1 622 $DIG $DIGOPTS q.insecure.optout.example. a @10.53.0.4 \ 623 > dig.out.ns4.test$n || ret=1 624 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 625 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1 626 # Note - this is looking for failure, hence the && 627 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 628 n=`expr $n + 1` 629 if [ $ret != 0 ]; then echo_i "failed"; fi 630 status=`expr $status + $ret` 631 632 if [ -x ${DELV} ] ; then 633 ret=0 634 echo_i "checking 1-server negative insecurity proof OPTOUT using dns_client ($n)" 635 $DELV $DELVOPTS @10.53.0.4 a q.insecure.optout.example > delv.out$n 2>&1 || ret=1 636 grep "resolution failed: ncache nxdomain" delv.out$n > /dev/null || ret=1 637 n=`expr $n + 1` 638 if [ $ret != 0 ]; then echo_i "failed"; fi 639 status=`expr $status + $ret` 640 fi 641 642 echo_i "checking 1-server negative insecurity proof with SOA hack NSEC ($n)" 643 ret=0 644 $DIG $DIGOPTS r.insecure.example. soa @10.53.0.3 \ 645 > dig.out.ns3.test$n || ret=1 646 $DIG $DIGOPTS r.insecure.example. soa @10.53.0.4 \ 647 > dig.out.ns4.test$n || ret=1 648 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 649 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1 650 grep "0 IN SOA" dig.out.ns4.test$n > /dev/null || ret=1 651 # Note - this is looking for failure, hence the && 652 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 653 n=`expr $n + 1` 654 if [ $ret != 0 ]; then echo_i "failed"; fi 655 status=`expr $status + $ret` 656 657 echo_i "checking 1-server negative insecurity proof with SOA hack NSEC3 ($n)" 658 ret=0 659 $DIG $DIGOPTS r.insecure.nsec3.example. soa @10.53.0.3 \ 660 > dig.out.ns3.test$n || ret=1 661 $DIG $DIGOPTS r.insecure.nsec3.example. soa @10.53.0.4 \ 662 > dig.out.ns4.test$n || ret=1 663 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 664 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1 665 grep "0 IN SOA" dig.out.ns4.test$n > /dev/null || ret=1 666 # Note - this is looking for failure, hence the && 667 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 668 n=`expr $n + 1` 669 if [ $ret != 0 ]; then echo_i "failed"; fi 670 status=`expr $status + $ret` 671 672 echo_i "checking 1-server negative insecurity proof with SOA hack OPTOUT ($n)" 673 ret=0 674 $DIG $DIGOPTS r.insecure.optout.example. soa @10.53.0.3 \ 675 > dig.out.ns3.test$n || ret=1 676 $DIG $DIGOPTS r.insecure.optout.example. soa @10.53.0.4 \ 677 > dig.out.ns4.test$n || ret=1 678 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 679 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1 680 grep "0 IN SOA" dig.out.ns4.test$n > /dev/null || ret=1 681 # Note - this is looking for failure, hence the && 682 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 683 n=`expr $n + 1` 684 if [ $ret != 0 ]; then echo_i "failed"; fi 685 status=`expr $status + $ret` 686 687 # Check the secure.example domain 688 689 echo_i "checking multi-stage positive validation NSEC/NSEC ($n)" 690 ret=0 691 $DIG $DIGOPTS +noauth a.secure.example. \ 692 @10.53.0.3 a > dig.out.ns3.test$n || ret=1 693 $DIG $DIGOPTS +noauth a.secure.example. \ 694 @10.53.0.4 a > dig.out.ns4.test$n || ret=1 695 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 696 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 697 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 698 n=`expr $n + 1` 699 if [ $ret != 0 ]; then echo_i "failed"; fi 700 status=`expr $status + $ret` 701 702 echo_i "checking multi-stage positive validation NSEC/NSEC3 ($n)" 703 ret=0 704 $DIG $DIGOPTS +noauth a.nsec3.example. \ 705 @10.53.0.3 a > dig.out.ns3.test$n || ret=1 706 $DIG $DIGOPTS +noauth a.nsec3.example. \ 707 @10.53.0.4 a > dig.out.ns4.test$n || ret=1 708 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 709 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 710 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 711 n=`expr $n + 1` 712 if [ $ret != 0 ]; then echo_i "failed"; fi 713 status=`expr $status + $ret` 714 715 echo_i "checking multi-stage positive validation NSEC/OPTOUT ($n)" 716 ret=0 717 $DIG $DIGOPTS +noauth a.optout.example. \ 718 @10.53.0.3 a > dig.out.ns3.test$n || ret=1 719 $DIG $DIGOPTS +noauth a.optout.example. \ 720 @10.53.0.4 a > dig.out.ns4.test$n || ret=1 721 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 722 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 723 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 724 n=`expr $n + 1` 725 if [ $ret != 0 ]; then echo_i "failed"; fi 726 status=`expr $status + $ret` 727 728 echo_i "checking multi-stage positive validation NSEC3/NSEC ($n)" 729 ret=0 730 $DIG $DIGOPTS +noauth a.secure.nsec3.example. \ 731 @10.53.0.3 a > dig.out.ns3.test$n || ret=1 732 $DIG $DIGOPTS +noauth a.secure.nsec3.example. \ 733 @10.53.0.4 a > dig.out.ns4.test$n || ret=1 734 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 735 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 736 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 737 n=`expr $n + 1` 738 if [ $ret != 0 ]; then echo_i "failed"; fi 739 status=`expr $status + $ret` 740 741 echo_i "checking multi-stage positive validation NSEC3/NSEC3 ($n)" 742 ret=0 743 $DIG $DIGOPTS +noauth a.nsec3.nsec3.example. \ 744 @10.53.0.3 a > dig.out.ns3.test$n || ret=1 745 $DIG $DIGOPTS +noauth a.nsec3.nsec3.example. \ 746 @10.53.0.4 a > dig.out.ns4.test$n || ret=1 747 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 748 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 749 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 750 n=`expr $n + 1` 751 if [ $ret != 0 ]; then echo_i "failed"; fi 752 status=`expr $status + $ret` 753 754 echo_i "checking multi-stage positive validation NSEC3/OPTOUT ($n)" 755 ret=0 756 $DIG $DIGOPTS +noauth a.optout.nsec3.example. \ 757 @10.53.0.3 a > dig.out.ns3.test$n || ret=1 758 $DIG $DIGOPTS +noauth a.optout.nsec3.example. \ 759 @10.53.0.4 a > dig.out.ns4.test$n || ret=1 760 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 761 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 762 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 763 n=`expr $n + 1` 764 if [ $ret != 0 ]; then echo_i "failed"; fi 765 status=`expr $status + $ret` 766 767 echo_i "checking multi-stage positive validation OPTOUT/NSEC ($n)" 768 ret=0 769 $DIG $DIGOPTS +noauth a.secure.optout.example. \ 770 @10.53.0.3 a > dig.out.ns3.test$n || ret=1 771 $DIG $DIGOPTS +noauth a.secure.optout.example. \ 772 @10.53.0.4 a > dig.out.ns4.test$n || ret=1 773 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 774 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 775 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 776 n=`expr $n + 1` 777 if [ $ret != 0 ]; then echo_i "failed"; fi 778 status=`expr $status + $ret` 779 780 echo_i "checking multi-stage positive validation OPTOUT/NSEC3 ($n)" 781 ret=0 782 $DIG $DIGOPTS +noauth a.nsec3.optout.example. \ 783 @10.53.0.3 a > dig.out.ns3.test$n || ret=1 784 $DIG $DIGOPTS +noauth a.nsec3.optout.example. \ 785 @10.53.0.4 a > dig.out.ns4.test$n || ret=1 786 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 787 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 788 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 789 n=`expr $n + 1` 790 if [ $ret != 0 ]; then echo_i "failed"; fi 791 status=`expr $status + $ret` 792 793 echo_i "checking multi-stage positive validation OPTOUT/OPTOUT ($n)" 794 ret=0 795 $DIG $DIGOPTS +noauth a.optout.optout.example. \ 796 @10.53.0.3 a > dig.out.ns3.test$n || ret=1 797 $DIG $DIGOPTS +noauth a.optout.optout.example. \ 798 @10.53.0.4 a > dig.out.ns4.test$n || ret=1 799 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 800 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 801 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 802 n=`expr $n + 1` 803 if [ $ret != 0 ]; then echo_i "failed"; fi 804 status=`expr $status + $ret` 805 806 echo_i "checking empty NODATA OPTOUT ($n)" 807 ret=0 808 $DIG $DIGOPTS +noauth empty.optout.example. \ 809 @10.53.0.3 a > dig.out.ns3.test$n || ret=1 810 $DIG $DIGOPTS +noauth empty.optout.example. \ 811 @10.53.0.4 a > dig.out.ns4.test$n || ret=1 812 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 813 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 814 #grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 815 n=`expr $n + 1` 816 if [ $ret != 0 ]; then echo_i "failed"; fi 817 status=`expr $status + $ret` 818 819 # Check the bogus domain 820 821 echo_i "checking failed validation ($n)" 822 ret=0 823 $DIG $DIGOPTS a.bogus.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1 824 grep "SERVFAIL" dig.out.ns4.test$n > /dev/null || ret=1 825 n=`expr $n + 1` 826 if [ $ret != 0 ]; then echo_i "failed"; fi 827 status=`expr $status + $ret` 828 829 if [ -x ${DELV} ] ; then 830 ret=0 831 echo_i "checking failed validation using dns_client ($n)" 832 $DELV $DELVOPTS +cd @10.53.0.4 a a.bogus.example > delv.out$n 2>&1 || ret=1 833 grep "resolution failed: RRSIG failed to verify" delv.out$n > /dev/null || ret=1 834 n=`expr $n + 1` 835 if [ $ret != 0 ]; then echo_i "failed"; fi 836 status=`expr $status + $ret` 837 fi 838 839 # Try validating with a bad trusted key. 840 # This should fail. 841 842 echo_i "checking that validation fails with a misconfigured trusted key ($n)" 843 ret=0 844 $DIG $DIGOPTS example. soa @10.53.0.5 > dig.out.ns5.test$n || ret=1 845 grep "SERVFAIL" dig.out.ns5.test$n > /dev/null || ret=1 846 n=`expr $n + 1` 847 if [ $ret != 0 ]; then echo_i "failed"; fi 848 status=`expr $status + $ret` 849 850 echo_i "checking that negative validation fails with a misconfigured trusted key ($n)" 851 ret=0 852 $DIG $DIGOPTS example. ptr @10.53.0.5 > dig.out.ns5.test$n || ret=1 853 grep "SERVFAIL" dig.out.ns5.test$n > /dev/null || ret=1 854 n=`expr $n + 1` 855 if [ $ret != 0 ]; then echo_i "failed"; fi 856 status=`expr $status + $ret` 857 858 echo_i "checking that insecurity proofs fail with a misconfigured trusted key ($n)" 859 ret=0 860 $DIG $DIGOPTS a.insecure.example. a @10.53.0.5 > dig.out.ns5.test$n || ret=1 861 grep "SERVFAIL" dig.out.ns5.test$n > /dev/null || ret=1 862 n=`expr $n + 1` 863 if [ $ret != 0 ]; then echo_i "failed"; fi 864 status=`expr $status + $ret` 865 866 echo_i "checking that validation fails when key record is missing ($n)" 867 ret=0 868 $DIG $DIGOPTS a.b.keyless.example. a @10.53.0.4 > dig.out.ns4.test$n || ret=1 869 grep "SERVFAIL" dig.out.ns4.test$n > /dev/null || ret=1 870 n=`expr $n + 1` 871 if [ $ret != 0 ]; then echo_i "failed"; fi 872 status=`expr $status + $ret` 873 874 if [ -x ${DELV} ] ; then 875 ret=0 876 echo_i "checking that validation fails when key record is missing using dns_client ($n)" 877 $DELV $DELVOPTS +cd @10.53.0.4 a a.b.keyless.example > delv.out$n 2>&1 || ret=1 878 grep "resolution failed: broken trust chain" delv.out$n > /dev/null || ret=1 879 n=`expr $n + 1` 880 if [ $ret != 0 ]; then echo_i "failed"; fi 881 status=`expr $status + $ret` 882 fi 883 884 echo_i "checking that validation succeeds when a revoked key is encountered ($n)" 885 ret=0 886 $DIG $DIGOPTS revkey.example soa @10.53.0.4 > dig.out.ns4.test$n || ret=1 887 grep "NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 888 grep "flags: .* ad" dig.out.ns4.test$n > /dev/null || ret=1 889 n=`expr $n + 1` 890 if [ $ret != 0 ]; then echo_i "failed"; fi 891 status=`expr $status + $ret` 892 893 if [ -x ${DELV} ] ; then 894 ret=0 895 echo_i "checking that validation succeeds when a revoked key is encountered using dns_client ($n)" 896 $DELV $DELVOPTS +cd @10.53.0.4 soa revkey.example > delv.out$n 2>&1 || ret=1 897 grep "fully validated" delv.out$n > /dev/null || ret=1 898 n=`expr $n + 1` 899 if [ $ret != 0 ]; then echo_i "failed"; fi 900 status=`expr $status + $ret` 901 fi 902 903 echo_i "Checking that a bad CNAME signature is caught after a +CD query ($n)" 904 ret=0 905 #prime 906 $DIG $DIGOPTS +cd bad-cname.example. @10.53.0.4 > dig.out.ns4.prime$n || ret=1 907 #check: requery with +CD. pending data should be returned even if it's bogus 908 expect="a.example. 909 10.0.0.1" 910 ans=`$DIG $DIGOPTS +cd +nodnssec +short bad-cname.example. @10.53.0.4` || ret=1 911 test "$ans" = "$expect" || ret=1 912 test $ret = 0 || echo_i "failed, got '$ans', expected '$expect'" 913 #check: requery without +CD. bogus cached data should be rejected. 914 $DIG $DIGOPTS +nodnssec bad-cname.example. @10.53.0.4 > dig.out.ns4.test$n || ret=1 915 grep "SERVFAIL" dig.out.ns4.test$n > /dev/null || ret=1 916 n=`expr $n + 1` 917 if [ $ret != 0 ]; then echo_i "failed"; fi 918 status=`expr $status + $ret` 919 920 echo_i "Checking that a bad DNAME signature is caught after a +CD query ($n)" 921 ret=0 922 #prime 923 $DIG $DIGOPTS +cd a.bad-dname.example. @10.53.0.4 > dig.out.ns4.prime$n || ret=1 924 #check: requery with +CD. pending data should be returned even if it's bogus 925 expect="example. 926 a.example. 927 10.0.0.1" 928 ans=`$DIG $DIGOPTS +cd +nodnssec +short a.bad-dname.example. @10.53.0.4` || ret=1 929 test "$ans" = "$expect" || ret=1 930 test $ret = 0 || echo_i "failed, got '$ans', expected '$expect'" 931 #check: requery without +CD. bogus cached data should be rejected. 932 $DIG $DIGOPTS +nodnssec a.bad-dname.example. @10.53.0.4 > dig.out.ns4.test$n || ret=1 933 grep "SERVFAIL" dig.out.ns4.test$n > /dev/null || ret=1 934 n=`expr $n + 1` 935 if [ $ret != 0 ]; then echo_i "failed"; fi 936 status=`expr $status + $ret` 937 938 # Check the insecure.secure.example domain (insecurity proof) 939 940 echo_i "checking 2-server insecurity proof ($n)" 941 ret=0 942 $DIG $DIGOPTS +noauth a.insecure.secure.example. @10.53.0.2 a \ 943 > dig.out.ns2.test$n || ret=1 944 $DIG $DIGOPTS +noauth a.insecure.secure.example. @10.53.0.4 a \ 945 > dig.out.ns4.test$n || ret=1 946 digcomp dig.out.ns2.test$n dig.out.ns4.test$n || ret=1 947 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 948 # Note - this is looking for failure, hence the && 949 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 950 n=`expr $n + 1` 951 if [ $ret != 0 ]; then echo_i "failed"; fi 952 status=`expr $status + $ret` 953 954 # Check a negative response in insecure.secure.example 955 956 echo_i "checking 2-server insecurity proof with a negative answer ($n)" 957 ret=0 958 $DIG $DIGOPTS q.insecure.secure.example. @10.53.0.2 a > dig.out.ns2.test$n \ 959 || ret=1 960 $DIG $DIGOPTS q.insecure.secure.example. @10.53.0.4 a > dig.out.ns4.test$n \ 961 || ret=1 962 digcomp dig.out.ns2.test$n dig.out.ns4.test$n || ret=1 963 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1 964 # Note - this is looking for failure, hence the && 965 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 966 n=`expr $n + 1` 967 if [ $ret != 0 ]; then echo_i "failed"; fi 968 status=`expr $status + $ret` 969 970 echo_i "checking 2-server insecurity proof with a negative answer and SOA hack ($n)" 971 ret=0 972 $DIG $DIGOPTS r.insecure.secure.example. @10.53.0.2 soa > dig.out.ns2.test$n \ 973 || ret=1 974 $DIG $DIGOPTS r.insecure.secure.example. @10.53.0.4 soa > dig.out.ns4.test$n \ 975 || ret=1 976 digcomp dig.out.ns2.test$n dig.out.ns4.test$n || ret=1 977 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1 978 # Note - this is looking for failure, hence the && 979 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 980 n=`expr $n + 1` 981 if [ $ret != 0 ]; then echo_i "failed"; fi 982 status=`expr $status + $ret` 983 984 # Check that the query for a security root is successful and has ad set 985 986 echo_i "checking security root query ($n)" 987 ret=0 988 $DIG $DIGOPTS . @10.53.0.4 key > dig.out.ns4.test$n || ret=1 989 grep "NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 990 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 991 n=`expr $n + 1` 992 if [ $ret != 0 ]; then echo_i "failed"; fi 993 status=`expr $status + $ret` 994 995 # Check that the setting the cd bit works 996 997 echo_i "checking cd bit on a positive answer ($n)" 998 ret=0 999 $DIG $DIGOPTS +noauth example. soa @10.53.0.4 \ 1000 > dig.out.ns4.test$n || ret=1 1001 $DIG $DIGOPTS +noauth +cdflag example. soa @10.53.0.5 \ 1002 > dig.out.ns5.test$n || ret=1 1003 digcomp dig.out.ns4.test$n dig.out.ns5.test$n || ret=1 1004 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 1005 # Note - this is looking for failure, hence the && 1006 grep "flags:.*ad.*QUERY" dig.out.ns5.test$n > /dev/null && ret=1 1007 n=`expr $n + 1` 1008 if [ $ret != 0 ]; then echo_i "failed"; fi 1009 status=`expr $status + $ret` 1010 1011 echo_i "checking cd bit on a negative answer ($n)" 1012 ret=0 1013 $DIG $DIGOPTS q.example. soa @10.53.0.4 > dig.out.ns4.test$n || ret=1 1014 $DIG $DIGOPTS +cdflag q.example. soa @10.53.0.5 > dig.out.ns5.test$n || ret=1 1015 digcomp dig.out.ns4.test$n dig.out.ns5.test$n || ret=1 1016 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 1017 # Note - this is looking for failure, hence the && 1018 grep "flags:.*ad.*QUERY" dig.out.ns5.test$n > /dev/null && ret=1 1019 n=`expr $n + 1` 1020 if [ $ret != 0 ]; then echo_i "failed"; fi 1021 status=`expr $status + $ret` 1022 1023 echo_i "checking positive validation RSASHA256 NSEC ($n)" 1024 ret=0 1025 $DIG $DIGOPTS +noauth a.rsasha256.example. @10.53.0.3 a > dig.out.ns3.test$n || ret=1 1026 $DIG $DIGOPTS +noauth a.rsasha256.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1 1027 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 1028 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 1029 n=`expr $n + 1` 1030 if [ $ret != 0 ]; then echo_i "failed"; fi 1031 status=`expr $status + $ret` 1032 1033 echo_i "checking positive validation RSASHA512 NSEC ($n)" 1034 ret=0 1035 $DIG $DIGOPTS +noauth a.rsasha512.example. @10.53.0.3 a > dig.out.ns3.test$n || ret=1 1036 $DIG $DIGOPTS +noauth a.rsasha512.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1 1037 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 1038 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 1039 n=`expr $n + 1` 1040 if [ $ret != 0 ]; then echo_i "failed"; fi 1041 status=`expr $status + $ret` 1042 1043 echo_i "checking positive validation with KSK-only DNSKEY signature ($n)" 1044 ret=0 1045 $DIG $DIGOPTS +noauth a.kskonly.example. @10.53.0.3 a > dig.out.ns3.test$n || ret=1 1046 $DIG $DIGOPTS +noauth a.kskonly.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1 1047 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 1048 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 1049 n=`expr $n + 1` 1050 if [ $ret != 0 ]; then echo_i "failed"; fi 1051 status=`expr $status + $ret` 1052 1053 echo_i "checking cd bit on a query that should fail ($n)" 1054 ret=0 1055 $DIG $DIGOPTS a.bogus.example. soa @10.53.0.4 \ 1056 > dig.out.ns4.test$n || ret=1 1057 $DIG $DIGOPTS +cdflag a.bogus.example. soa @10.53.0.5 \ 1058 > dig.out.ns5.test$n || ret=1 1059 digcomp dig.out.ns4.test$n dig.out.ns5.test$n || ret=1 1060 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 1061 # Note - this is looking for failure, hence the && 1062 grep "flags:.*ad.*QUERY" dig.out.ns5.test$n > /dev/null && ret=1 1063 n=`expr $n + 1` 1064 if [ $ret != 0 ]; then echo_i "failed"; fi 1065 status=`expr $status + $ret` 1066 1067 echo_i "checking cd bit on an insecurity proof ($n)" 1068 ret=0 1069 $DIG $DIGOPTS +noauth a.insecure.example. soa @10.53.0.4 \ 1070 > dig.out.ns4.test$n || ret=1 1071 $DIG $DIGOPTS +noauth +cdflag a.insecure.example. soa @10.53.0.5 \ 1072 > dig.out.ns5.test$n || ret=1 1073 digcomp dig.out.ns4.test$n dig.out.ns5.test$n || ret=1 1074 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 1075 # Note - these are looking for failure, hence the && 1076 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 1077 grep "flags:.*ad.*QUERY" dig.out.ns5.test$n > /dev/null && ret=1 1078 n=`expr $n + 1` 1079 if [ $ret != 0 ]; then echo_i "failed"; fi 1080 status=`expr $status + $ret` 1081 1082 echo_i "checking cd bit on a negative insecurity proof ($n)" 1083 ret=0 1084 $DIG $DIGOPTS q.insecure.example. a @10.53.0.4 \ 1085 > dig.out.ns4.test$n || ret=1 1086 $DIG $DIGOPTS +cdflag q.insecure.example. a @10.53.0.5 \ 1087 > dig.out.ns5.test$n || ret=1 1088 digcomp dig.out.ns4.test$n dig.out.ns5.test$n || ret=1 1089 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1 1090 # Note - these are looking for failure, hence the && 1091 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 1092 grep "flags:.*ad.*QUERY" dig.out.ns5.test$n > /dev/null && ret=1 1093 n=`expr $n + 1` 1094 if [ $ret != 0 ]; then echo_i "failed"; fi 1095 status=`expr $status + $ret` 1096 1097 echo_i "checking that validation of an ANY query works ($n)" 1098 ret=0 1099 $DIG $DIGOPTS +noauth foo.example. any @10.53.0.2 > dig.out.ns2.test$n || ret=1 1100 $DIG $DIGOPTS +noauth foo.example. any @10.53.0.4 > dig.out.ns4.test$n || ret=1 1101 digcomp dig.out.ns2.test$n dig.out.ns4.test$n || ret=1 1102 grep "NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 1103 # 2 records in the zone, 1 NXT, 3 SIGs 1104 grep "ANSWER: 6" dig.out.ns4.test$n > /dev/null || ret=1 1105 n=`expr $n + 1` 1106 if [ $ret != 0 ]; then echo_i "failed"; fi 1107 status=`expr $status + $ret` 1108 1109 echo_i "checking that validation of a query returning a CNAME works ($n)" 1110 ret=0 1111 $DIG $DIGOPTS +noauth cname1.example. txt @10.53.0.2 \ 1112 > dig.out.ns2.test$n || ret=1 1113 $DIG $DIGOPTS +noauth cname1.example. txt @10.53.0.4 \ 1114 > dig.out.ns4.test$n || ret=1 1115 digcomp dig.out.ns2.test$n dig.out.ns4.test$n || ret=1 1116 grep "NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 1117 # the CNAME & its sig, the TXT and its SIG 1118 grep "ANSWER: 4" dig.out.ns4.test$n > /dev/null || ret=1 1119 n=`expr $n + 1` 1120 if [ $ret != 0 ]; then echo_i "failed"; fi 1121 status=`expr $status + $ret` 1122 1123 echo_i "checking that validation of a query returning a DNAME works ($n)" 1124 ret=0 1125 $DIG $DIGOPTS +noauth foo.dname1.example. txt @10.53.0.2 \ 1126 > dig.out.ns2.test$n || ret=1 1127 $DIG $DIGOPTS +noauth foo.dname1.example. txt @10.53.0.4 \ 1128 > dig.out.ns4.test$n || ret=1 1129 digcomp dig.out.ns2.test$n dig.out.ns4.test$n || ret=1 1130 grep "NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 1131 # The DNAME & its sig, the TXT and its SIG, and the synthesized CNAME. 1132 # It would be nice to test that the CNAME is being synthesized by the 1133 # recursive server and not cached, but I don't know how. 1134 grep "ANSWER: 5" dig.out.ns4.test$n > /dev/null || ret=1 1135 n=`expr $n + 1` 1136 if [ $ret != 0 ]; then echo_i "failed"; fi 1137 status=`expr $status + $ret` 1138 1139 echo_i "checking that validation of an ANY query returning a CNAME works ($n)" 1140 ret=0 1141 $DIG $DIGOPTS +noauth cname2.example. any @10.53.0.2 \ 1142 > dig.out.ns2.test$n || ret=1 1143 $DIG $DIGOPTS +noauth cname2.example. any @10.53.0.4 \ 1144 > dig.out.ns4.test$n || ret=1 1145 digcomp dig.out.ns2.test$n dig.out.ns4.test$n || ret=1 1146 grep "NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 1147 # The CNAME, NXT, and their SIGs 1148 grep "ANSWER: 4" dig.out.ns4.test$n > /dev/null || ret=1 1149 n=`expr $n + 1` 1150 if [ $ret != 0 ]; then echo_i "failed"; fi 1151 status=`expr $status + $ret` 1152 1153 echo_i "checking that validation of an ANY query returning a DNAME works ($n)" 1154 ret=0 1155 $DIG $DIGOPTS +noauth foo.dname2.example. any @10.53.0.2 \ 1156 > dig.out.ns2.test$n || ret=1 1157 $DIG $DIGOPTS +noauth foo.dname2.example. any @10.53.0.4 \ 1158 > dig.out.ns4.test$n || ret=1 1159 digcomp dig.out.ns2.test$n dig.out.ns4.test$n || ret=1 1160 grep "NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 1161 n=`expr $n + 1` 1162 if [ $ret != 0 ]; then echo_i "failed"; fi 1163 status=`expr $status + $ret` 1164 1165 echo_i "checking that positive validation in a privately secure zone works ($n)" 1166 ret=0 1167 $DIG $DIGOPTS +noauth a.private.secure.example. a @10.53.0.2 \ 1168 > dig.out.ns2.test$n || ret=1 1169 $DIG $DIGOPTS +noauth a.private.secure.example. a @10.53.0.4 \ 1170 > dig.out.ns4.test$n || ret=1 1171 digcomp dig.out.ns2.test$n dig.out.ns4.test$n || ret=1 1172 grep "NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 1173 # Note - this is looking for failure, hence the && 1174 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 1175 n=`expr $n + 1` 1176 if [ $ret != 0 ]; then echo_i "failed"; fi 1177 status=`expr $status + $ret` 1178 1179 echo_i "checking that negative validation in a privately secure zone works ($n)" 1180 ret=0 1181 $DIG $DIGOPTS +noauth q.private.secure.example. a @10.53.0.2 \ 1182 > dig.out.ns2.test$n || ret=1 1183 $DIG $DIGOPTS +noauth q.private.secure.example. a @10.53.0.4 \ 1184 > dig.out.ns4.test$n || ret=1 1185 digcomp dig.out.ns2.test$n dig.out.ns4.test$n || ret=1 1186 grep "NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1 1187 # Note - this is looking for failure, hence the && 1188 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 1189 n=`expr $n + 1` 1190 if [ $ret != 0 ]; then echo_i "failed"; fi 1191 status=`expr $status + $ret` 1192 1193 echo_i "checking that lookups succeed after disabling an algorithm ($n)" 1194 ret=0 1195 $DIG $DIGOPTS +noauth example. SOA @10.53.0.2 \ 1196 > dig.out.ns2.test$n || ret=1 1197 $DIG $DIGOPTS +noauth example. SOA @10.53.0.6 \ 1198 > dig.out.ns6.test$n || ret=1 1199 digcomp dig.out.ns2.test$n dig.out.ns6.test$n || ret=1 1200 # Note - this is looking for failure, hence the && 1201 grep "flags:.*ad.*QUERY" dig.out.ns6.test$n > /dev/null && ret=1 1202 n=`expr $n + 1` 1203 if [ $ret != 0 ]; then echo_i "failed"; fi 1204 status=`expr $status + $ret` 1205 1206 echo_i "checking privately secure to nxdomain works ($n)" 1207 ret=0 1208 $DIG $DIGOPTS +noauth private2secure-nxdomain.private.secure.example. SOA @10.53.0.4 \ 1209 > dig.out.ns4.test$n || ret=1 1210 grep "NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1 1211 # Note - this is looking for failure, hence the && 1212 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 1213 n=`expr $n + 1` 1214 if [ $ret != 0 ]; then echo_i "failed"; fi 1215 status=`expr $status + $ret` 1216 1217 echo_i "checking privately secure wildcard to nxdomain works ($n)" 1218 ret=0 1219 $DIG $DIGOPTS +noauth a.wild.private.secure.example. SOA @10.53.0.4 \ 1220 > dig.out.ns4.test$n || ret=1 1221 grep "NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1 1222 # Note - this is looking for failure, hence the && 1223 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 1224 n=`expr $n + 1` 1225 if [ $ret != 0 ]; then echo_i "failed"; fi 1226 status=`expr $status + $ret` 1227 1228 echo_i "checking a non-cachable NODATA works ($n)" 1229 ret=0 1230 $DIG $DIGOPTS +noauth a.nosoa.secure.example. txt @10.53.0.7 \ 1231 > dig.out.ns7.test$n || ret=1 1232 grep "AUTHORITY: 0" dig.out.ns7.test$n > /dev/null || ret=1 1233 $DIG $DIGOPTS +noauth a.nosoa.secure.example. txt @10.53.0.4 \ 1234 > dig.out.ns4.test$n || ret=1 1235 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 1236 n=`expr $n + 1` 1237 if [ $ret != 0 ]; then echo_i "failed"; fi 1238 status=`expr $status + $ret` 1239 1240 echo_i "checking a non-cachable NXDOMAIN works ($n)" 1241 ret=0 1242 $DIG $DIGOPTS +noauth b.nosoa.secure.example. txt @10.53.0.7 \ 1243 > dig.out.ns7.test$n || ret=1 1244 grep "AUTHORITY: 0" dig.out.ns7.test$n > /dev/null || ret=1 1245 $DIG $DIGOPTS +noauth b.nosoa.secure.example. txt @10.53.0.4 \ 1246 > dig.out.ns4.test$n || ret=1 1247 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1 1248 n=`expr $n + 1` 1249 if [ $ret != 0 ]; then echo_i "failed"; fi 1250 status=`expr $status + $ret` 1251 1252 # 1253 # private.secure.example is served by the same server as its 1254 # grand parent and there is not a secure delegation from secure.example 1255 # to private.secure.example. In addition secure.example is using a 1256 # algorithm which the validation does not support. 1257 # 1258 echo_i "checking dnssec-lookaside-validation works ($n)" 1259 ret=0 1260 $DIG $DIGOPTS private.secure.example. SOA @10.53.0.6 \ 1261 > dig.out.ns6.test$n || ret=1 1262 grep "flags:.*ad.*QUERY" dig.out.ns6.test$n > /dev/null || ret=1 1263 n=`expr $n + 1` 1264 if [ $ret != 0 ]; then echo_i "failed"; fi 1265 status=`expr $status + $ret` 1266 1267 echo_i "checking that we can load a rfc2535 signed zone ($n)" 1268 ret=0 1269 $DIG $DIGOPTS rfc2535.example. SOA @10.53.0.2 \ 1270 > dig.out.ns2.test$n || ret=1 1271 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1 1272 n=`expr $n + 1` 1273 if [ $ret != 0 ]; then echo_i "failed"; fi 1274 status=`expr $status + $ret` 1275 1276 echo_i "checking that we can transfer a rfc2535 signed zone ($n)" 1277 ret=0 1278 $DIG $DIGOPTS rfc2535.example. SOA @10.53.0.3 \ 1279 > dig.out.ns3.test$n || ret=1 1280 grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || ret=1 1281 n=`expr $n + 1` 1282 if [ $ret != 0 ]; then echo_i "failed"; fi 1283 status=`expr $status + $ret` 1284 1285 echo_i "basic dnssec-signzone checks:" 1286 echo_i " two DNSKEYs ($n)" 1287 ret=0 1288 ( 1289 cd signer/general 1290 rm -f signed.zone 1291 $SIGNER -f signed.zone -o example.com. test1.zone > signer.out.$n 2>&1 1292 test -f signed.zone 1293 ) || ret=1 1294 n=`expr $n + 1` 1295 if [ $ret != 0 ]; then echo_i "failed"; fi 1296 status=`expr $status + $ret` 1297 1298 echo_i " one non-KSK DNSKEY ($n)" 1299 ret=0 1300 ( 1301 cd signer/general 1302 rm -f signed.zone 1303 $SIGNER -f signed.zone -o example.com. test2.zone > signer.out.$n 2>&1 1304 test -f signed.zone 1305 ) && ret=1 1306 n=`expr $n + 1` 1307 if [ $ret != 0 ]; then echo_i "failed"; fi 1308 status=`expr $status + $ret` 1309 1310 echo_i " one KSK DNSKEY ($n)" 1311 ret=0 1312 ( 1313 cd signer/general 1314 rm -f signed.zone 1315 $SIGNER -f signed.zone -o example.com. test3.zone > signer.out.$n 2>&1 1316 test -f signed.zone 1317 ) && ret=1 1318 n=`expr $n + 1` 1319 if [ $ret != 0 ]; then echo_i "failed"; fi 1320 status=`expr $status + $ret` 1321 1322 echo_i " three DNSKEY ($n)" 1323 ret=0 1324 ( 1325 cd signer/general 1326 rm -f signed.zone 1327 $SIGNER -f signed.zone -o example.com. test4.zone > signer.out.$n 2>&1 1328 test -f signed.zone 1329 ) || ret=1 1330 n=`expr $n + 1` 1331 if [ $ret != 0 ]; then echo_i "failed"; fi 1332 status=`expr $status + $ret` 1333 1334 echo_i " three DNSKEY, one private key missing ($n)" 1335 ret=0 1336 ( 1337 cd signer/general 1338 rm -f signed.zone 1339 $SIGNER -f signed.zone -o example.com. test5.zone > signer.out.$n 2>&1 1340 test -f signed.zone 1341 ) || ret=1 1342 n=`expr $n + 1` 1343 if [ $ret != 0 ]; then echo_i "failed"; fi 1344 status=`expr $status + $ret` 1345 1346 echo_i " four DNSKEY ($n)" 1347 ret=0 1348 ( 1349 cd signer/general 1350 rm -f signed.zone 1351 $SIGNER -f signed.zone -o example.com. test6.zone > signer.out.$n 2>&1 1352 test -f signed.zone 1353 ) || ret=1 1354 n=`expr $n + 1` 1355 if [ $ret != 0 ]; then echo_i "failed"; fi 1356 status=`expr $status + $ret` 1357 1358 echo_i " two DNSKEY, both private keys missing ($n)" 1359 ret=0 1360 ( 1361 cd signer/general 1362 rm -f signed.zone 1363 $SIGNER -f signed.zone -o example.com. test7.zone > signer.out.$n 2>&1 1364 test -f signed.zone 1365 ) && ret=1 1366 n=`expr $n + 1` 1367 if [ $ret != 0 ]; then echo_i "failed"; fi 1368 status=`expr $status + $ret` 1369 1370 echo_i " two DNSKEY, one private key missing ($n)" 1371 ret=0 1372 ( 1373 cd signer/general 1374 rm -f signed.zone 1375 $SIGNER -f signed.zone -o example.com. test8.zone > signer.out.$n 2>&1 1376 test -f signed.zone 1377 ) && ret=1 1378 n=`expr $n + 1` 1379 if [ $ret != 0 ]; then echo_i "failed"; fi 1380 status=`expr $status + $ret` 1381 1382 echo_i "checking that we can sign a zone with out-of-zone records ($n)" 1383 ret=0 1384 zone=example 1385 key1=`$KEYGEN -K signer -q -a NSEC3RSASHA1 -b 1024 -n zone $zone` 1386 key2=`$KEYGEN -K signer -q -f KSK -a NSEC3RSASHA1 -b 1024 -n zone $zone` 1387 ( 1388 cd signer 1389 cat example.db.in $key1.key $key2.key > example.db 1390 $SIGNER -o example -f example.db example.db > /dev/null 2>&1 1391 ) || ret=1 1392 n=`expr $n + 1` 1393 if [ $ret != 0 ]; then echo_i "failed"; fi 1394 status=`expr $status + $ret` 1395 1396 echo_i "checking that we can sign a zone (NSEC3) with out-of-zone records ($n)" 1397 ret=0 1398 zone=example 1399 key1=`$KEYGEN -K signer -q -a NSEC3RSASHA1 -b 1024 -n zone $zone` 1400 key2=`$KEYGEN -K signer -q -f KSK -a NSEC3RSASHA1 -b 1024 -n zone $zone` 1401 ( 1402 cd signer 1403 cat example.db.in $key1.key $key2.key > example.db 1404 $SIGNER -3 - -H 10 -o example -f example.db example.db > /dev/null 2>&1 1405 awk '/^IQF9LQTLK/ { 1406 printf("%s", $0); 1407 while (!index($0, ")")) { 1408 if (getline <= 0) 1409 break; 1410 printf (" %s", $0); 1411 } 1412 printf("\n"); 1413 }' example.db | sed 's/[ ][ ]*/ /g' > nsec3param.out 1414 1415 grep "IQF9LQTLKKNFK0KVIFELRAK4IC4QLTMG.example. 0 IN NSEC3 1 0 10 - ( IQF9LQTLKKNFK0KVIFELRAK4IC4QLTMG A NS SOA RRSIG DNSKEY NSEC3PARAM )" nsec3param.out > /dev/null 1416 ) || ret=1 1417 n=`expr $n + 1` 1418 if [ $ret != 0 ]; then echo_i "failed"; fi 1419 status=`expr $status + $ret` 1420 1421 echo_i "checking NSEC3 signing with empty nonterminals above a delegation ($n)" 1422 ret=0 1423 zone=example 1424 key1=`$KEYGEN -K signer -q -a NSEC3RSASHA1 -b 1024 -n zone $zone` 1425 key2=`$KEYGEN -K signer -q -f KSK -a NSEC3RSASHA1 -b 1024 -n zone $zone` 1426 ( 1427 cd signer 1428 cat example.db.in $key1.key $key2.key > example3.db 1429 echo "some.empty.nonterminal.nodes.example 60 IN NS ns.example.tld" >> example3.db 1430 $SIGNER -3 - -A -H 10 -o example -f example3.db example3.db > /dev/null 2>&1 1431 awk '/^IQF9LQTLK/ { 1432 printf("%s", $0); 1433 while (!index($0, ")")) { 1434 if (getline <= 0) 1435 break; 1436 printf (" %s", $0); 1437 } 1438 printf("\n"); 1439 }' example.db | sed 's/[ ][ ]*/ /g' > nsec3param.out 1440 1441 grep "IQF9LQTLKKNFK0KVIFELRAK4IC4QLTMG.example. 0 IN NSEC3 1 0 10 - ( IQF9LQTLKKNFK0KVIFELRAK4IC4QLTMG A NS SOA RRSIG DNSKEY NSEC3PARAM )" nsec3param.out > /dev/null 1442 ) || ret=1 1443 n=`expr $n + 1` 1444 if [ $ret != 0 ]; then echo_i "failed"; fi 1445 status=`expr $status + $ret` 1446 1447 echo_i "checking that dnsssec-signzone updates originalttl on ttl changes ($n)" 1448 ret=0 1449 zone=example 1450 key1=`$KEYGEN -K signer -q -a RSASHA1 -b 1024 -n zone $zone` 1451 key2=`$KEYGEN -K signer -q -f KSK -a RSASHA1 -b 1024 -n zone $zone` 1452 ( 1453 cd signer 1454 cat example.db.in $key1.key $key2.key > example.db 1455 $SIGNER -o example -f example.db.before example.db > /dev/null 2>&1 1456 sed 's/60.IN.SOA./50 IN SOA /' example.db.before > example.db.changed 1457 $SIGNER -o example -f example.db.after example.db.changed > /dev/null 2>&1 1458 ) 1459 grep "SOA 5 1 50" signer/example.db.after > /dev/null || ret=1 1460 n=`expr $n + 1` 1461 if [ $ret != 0 ]; then echo_i "failed"; fi 1462 status=`expr $status + $ret` 1463 1464 echo_i "checking dnssec-signzone keeps valid signatures from removed keys ($n)" 1465 ret=0 1466 zone=example 1467 key1=`$KEYGEN -K signer -q -f KSK -a RSASHA1 -b 1024 -n zone $zone` 1468 key2=`$KEYGEN -K signer -q -a RSASHA1 -b 1024 -n zone $zone` 1469 keyid2=`echo $key2 | sed 's/^Kexample.+005+0*\([0-9]\)/\1/'` 1470 key3=`$KEYGEN -K signer -q -a RSASHA1 -b 1024 -n zone $zone` 1471 keyid3=`echo $key3 | sed 's/^Kexample.+005+0*\([0-9]\)/\1/'` 1472 ( 1473 cd signer 1474 cat example.db.in $key1.key $key2.key > example.db 1475 $SIGNER -D -o example example.db > /dev/null 2>&1 1476 1477 # now switch out key2 for key3 and resign the zone 1478 cat example.db.in $key1.key $key3.key > example.db 1479 echo '$INCLUDE "example.db.signed"' >> example.db 1480 $SIGNER -D -o example example.db > /dev/null 2>&1 1481 ) || ret=1 1482 grep " $keyid2 " signer/example.db.signed > /dev/null 2>&1 || ret=1 1483 grep " $keyid3 " signer/example.db.signed > /dev/null 2>&1 || ret=1 1484 n=`expr $n + 1` 1485 if [ $ret != 0 ]; then echo_i "failed"; fi 1486 status=`expr $status + $ret` 1487 1488 echo_i "checking dnssec-signzone -R purges signatures from removed keys ($n)" 1489 ret=0 1490 ( 1491 cd signer 1492 $SIGNER -RD -o example example.db > /dev/null 2>&1 1493 ) || ret=1 1494 grep " $keyid2 " signer/example.db.signed > /dev/null 2>&1 && ret=1 1495 grep " $keyid3 " signer/example.db.signed > /dev/null 2>&1 || ret=1 1496 n=`expr $n + 1` 1497 if [ $ret != 0 ]; then echo_i "failed"; fi 1498 status=`expr $status + $ret` 1499 1500 echo_i "checking dnssec-signzone keeps valid signatures from inactive keys ($n)" 1501 ret=0 1502 zone=example 1503 ( 1504 cd signer 1505 cp -f example.db.in example.db 1506 $SIGNER -SD -o example example.db > /dev/null 2>&1 1507 echo '$INCLUDE "example.db.signed"' >> example.db 1508 # now retire key2 and resign the zone 1509 $SETTIME -I now $key2 > /dev/null 2>&1 1510 $SIGNER -SD -o example example.db > /dev/null 2>&1 1511 ) || ret=1 1512 grep " $keyid2 " signer/example.db.signed > /dev/null 2>&1 || ret=1 1513 grep " $keyid3 " signer/example.db.signed > /dev/null 2>&1 || ret=1 1514 n=`expr $n + 1` 1515 if [ $ret != 0 ]; then echo_i "failed"; fi 1516 status=`expr $status + $ret` 1517 1518 echo_i "checking dnssec-signzone -Q purges signatures from inactive keys ($n)" 1519 ret=0 1520 ( 1521 cd signer 1522 $SIGNER -SDQ -o example example.db > /dev/null 2>&1 1523 ) || ret=1 1524 grep " $keyid2 " signer/example.db.signed > /dev/null 2>&1 && ret=1 1525 grep " $keyid3 " signer/example.db.signed > /dev/null 2>&1 || ret=1 1526 n=`expr $n + 1` 1527 if [ $ret != 0 ]; then echo_i "failed"; fi 1528 status=`expr $status + $ret` 1529 1530 echo_i "checking dnssec-signzone retains unexpired signatures ($n)" 1531 ret=0 1532 ( 1533 cd signer 1534 $SIGNER -Sxt -o example example.db > signer.out.1 2>&1 1535 $SIGNER -Sxt -o example -f example.db.signed example.db.signed > signer.out.2 2>&1 1536 ) || ret=1 1537 gen1=`awk '/generated/ {print $3}' signer/signer.out.1` 1538 retain1=`awk '/retained/ {print $3}' signer/signer.out.1` 1539 drop1=`awk '/dropped/ {print $3}' signer/signer.out.1` 1540 gen2=`awk '/generated/ {print $3}' signer/signer.out.2` 1541 retain2=`awk '/retained/ {print $3}' signer/signer.out.2` 1542 drop2=`awk '/dropped/ {print $3}' signer/signer.out.2` 1543 [ "$retain2" -eq `expr "$gen1" + "$retain1"` ] || ret=1 1544 [ "$gen2" -eq 0 ] || ret=1 1545 [ "$drop2" -eq 0 ] || ret=1 1546 n=`expr $n + 1` 1547 if [ $ret != 0 ]; then echo_i "failed"; fi 1548 status=`expr $status + $ret` 1549 1550 echo_i "checking dnssec-signzone purges RRSIGs from formerly-owned glue (nsec) ($n)" 1551 ret=0 1552 ( 1553 cd signer 1554 # remove NSEC-only keys 1555 rm -f Kexample.+005* 1556 cp -f example.db.in example2.db 1557 cat << EOF >> example2.db 1558 sub1.example. IN A 10.53.0.1 1559 ns.sub2.example. IN A 10.53.0.2 1560 EOF 1561 echo '$INCLUDE "example2.db.signed"' >> example2.db 1562 touch example2.db.signed 1563 $SIGNER -DS -O full -f example2.db.signed -o example example2.db > /dev/null 2>&1 1564 ) || ret=1 1565 grep "^sub1\.example\..*RRSIG[ ]A[ ]" signer/example2.db.signed > /dev/null 2>&1 || ret=1 1566 grep "^ns\.sub2\.example\..*RRSIG[ ]A[ ]" signer/example2.db.signed > /dev/null 2>&1 || ret=1 1567 ( 1568 cd signer 1569 cp -f example.db.in example2.db 1570 cat << EOF >> example2.db 1571 sub1.example. IN NS sub1.example. 1572 sub1.example. IN A 10.53.0.1 1573 sub2.example. IN NS ns.sub2.example. 1574 ns.sub2.example. IN A 10.53.0.2 1575 EOF 1576 echo '$INCLUDE "example2.db.signed"' >> example2.db 1577 $SIGNER -DS -O full -f example2.db.signed -o example example2.db > /dev/null 2>&1 1578 ) || ret=1 1579 grep "^sub1\.example\..*RRSIG[ ]A[ ]" signer/example2.db.signed > /dev/null 2>&1 && ret=1 1580 grep "^ns\.sub2\.example\..*RRSIG[ ]A[ ]" signer/example2.db.signed > /dev/null 2>&1 && ret=1 1581 n=`expr $n + 1` 1582 if [ $ret != 0 ]; then echo_i "failed"; fi 1583 status=`expr $status + $ret` 1584 1585 echo_i "checking dnssec-signzone purges RRSIGs from formerly-owned glue (nsec3) ($n)" 1586 ret=0 1587 ( 1588 cd signer 1589 rm -f example2.db.signed 1590 cp -f example.db.in example2.db 1591 cat << EOF >> example2.db 1592 sub1.example. IN A 10.53.0.1 1593 ns.sub2.example. IN A 10.53.0.2 1594 EOF 1595 echo '$INCLUDE "example2.db.signed"' >> example2.db 1596 touch example2.db.signed 1597 $SIGNER -DS -3 feedabee -O full -f example2.db.signed -o example example2.db > /dev/null 2>&1 1598 ) || ret=1 1599 grep "^sub1\.example\..*RRSIG[ ]A[ ]" signer/example2.db.signed > /dev/null 2>&1 || ret=1 1600 grep "^ns\.sub2\.example\..*RRSIG[ ]A[ ]" signer/example2.db.signed > /dev/null 2>&1 || ret=1 1601 ( 1602 cd signer 1603 cp -f example.db.in example2.db 1604 cat << EOF >> example2.db 1605 sub1.example. IN NS sub1.example. 1606 sub1.example. IN A 10.53.0.1 1607 sub2.example. IN NS ns.sub2.example. 1608 ns.sub2.example. IN A 10.53.0.2 1609 EOF 1610 echo '$INCLUDE "example2.db.signed"' >> example2.db 1611 $SIGNER -DS -3 feedabee -O full -f example2.db.signed -o example example2.db > /dev/null 2>&1 1612 ) || ret=1 1613 grep "^sub1\.example\..*RRSIG[ ]A[ ]" signer/example2.db.signed > /dev/null 2>&1 && ret=1 1614 grep "^ns\.sub2\.example\..*RRSIG[ ]A[ ]" signer/example2.db.signed > /dev/null 2>&1 && ret=1 1615 n=`expr $n + 1` 1616 if [ $ret != 0 ]; then echo_i "failed"; fi 1617 status=`expr $status + $ret` 1618 1619 echo_i "checking dnssec-signzone output format ($n)" 1620 ret=0 1621 ( 1622 cd signer 1623 $SIGNER -O full -f - -Sxt -o example example.db > signer.out.3 2> /dev/null 1624 $SIGNER -O text -f - -Sxt -o example example.db > signer.out.4 2> /dev/null 1625 $SIGNER -O raw -f signer.out.5 -Sxt -o example example.db > /dev/null 2>&1 1626 $SIGNER -O raw=0 -f signer.out.6 -Sxt -o example example.db > /dev/null 2>&1 1627 $SIGNER -O raw -f - -Sxt -o example example.db > signer.out.7 2> /dev/null 1628 ) || ret=1 1629 awk '/IN *SOA/ {if (NF != 11) exit(1)}' signer/signer.out.3 || ret=1 1630 awk '/IN *SOA/ {if (NF != 7) exit(1)}' signer/signer.out.4 || ret=1 1631 israw1 signer/signer.out.5 || ret=1 1632 israw0 signer/signer.out.6 || ret=1 1633 israw1 signer/signer.out.7 || ret=1 1634 n=`expr $n + 1` 1635 if [ $ret != 0 ]; then echo_i "failed"; fi 1636 status=`expr $status + $ret` 1637 1638 echo_i "checking TTLs are capped by dnssec-signzone -M ($n)" 1639 ret=0 1640 ( 1641 cd signer 1642 $SIGNER -O full -f signer.out.8 -S -M 30 -o example example.db > /dev/null 2>&1 1643 ) || ret=1 1644 awk '/^;/ { next; } $2 > 30 { exit 1; }' signer/signer.out.8 || ret=1 1645 n=`expr $n + 1` 1646 if [ $ret != 0 ]; then echo_i "failed"; fi 1647 status=`expr $status + $ret` 1648 1649 echo_i "checking dnssec-signzone -N date ($n)" 1650 ret=0 1651 ( 1652 cd signer 1653 $SIGNER -O full -f signer.out.9 -S -N date -o example example2.db > /dev/null 2>&1 1654 ) || ret=1 1655 now=`$PERL -e '@lt=localtime(); printf "%.4d%0.2d%0.2d00\n",$lt[5]+1900,$lt[4]+1,$lt[3];'` 1656 serial=`awk '/^;/ { next; } $4 == "SOA" { print $7 }' signer/signer.out.9` 1657 [ "$now" -eq "$serial" ] || ret=1 1658 n=`expr $n + 1` 1659 if [ $ret != 0 ]; then echo_i "failed"; fi 1660 status=`expr $status + $ret` 1661 1662 echo_i "checking validated data are not cached longer than originalttl ($n)" 1663 ret=0 1664 $DIG $DIGOPTS +ttl +noauth a.ttlpatch.example. @10.53.0.3 a > dig.out.ns3.test$n || ret=1 1665 $DIG $DIGOPTS +ttl +noauth a.ttlpatch.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1 1666 grep "3600.IN" dig.out.ns3.test$n > /dev/null || ret=1 1667 grep "300.IN" dig.out.ns3.test$n > /dev/null && ret=1 1668 grep "300.IN" dig.out.ns4.test$n > /dev/null || ret=1 1669 grep "3600.IN" dig.out.ns4.test$n > /dev/null && ret=1 1670 n=`expr $n + 1` 1671 if [ $ret != 0 ]; then echo_i "failed"; fi 1672 status=`expr $status + $ret` 1673 1674 # Test that "rndc secroots" is able to dump trusted keys 1675 echo_i "checking rndc secroots ($n)" 1676 ret=0 1677 $RNDCCMD 10.53.0.4 secroots 2>&1 | sed 's/^/ns4 /' | cat_i 1678 keyid=`cat ns1/managed.key.id` 1679 cp ns4/named.secroots named.secroots.test$n 1680 linecount=`grep "./RSAMD5/$keyid ; trusted" named.secroots.test$n | wc -l` 1681 [ "$linecount" -eq 1 ] || ret=1 1682 linecount=`cat named.secroots.test$n | wc -l` 1683 [ "$linecount" -eq 10 ] || ret=1 1684 n=`expr $n + 1` 1685 if [ $ret != 0 ]; then echo_i "failed"; fi 1686 status=`expr $status + $ret` 1687 1688 # Check direct query for RRSIG. If we first ask for normal (non RRSIG) 1689 # record, the corresponding RRSIG should be cached and subsequent query 1690 # for RRSIG will be returned with the cached record. 1691 echo_i "checking RRSIG query from cache ($n)" 1692 ret=0 1693 $DIG $DIGOPTS normalthenrrsig.secure.example. @10.53.0.4 a > /dev/null || ret=1 1694 ans=`$DIG $DIGOPTS +short normalthenrrsig.secure.example. @10.53.0.4 rrsig` || ret=1 1695 expect=`$DIG $DIGOPTS +short normalthenrrsig.secure.example. @10.53.0.3 rrsig | grep '^A' ` || ret=1 1696 test "$ans" = "$expect" || ret=1 1697 # also check that RA is set 1698 $DIG $DIGOPTS normalthenrrsig.secure.example. @10.53.0.4 rrsig > dig.out.ns4.test$n || ret=1 1699 grep "flags:.*ra.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 1700 n=`expr $n + 1` 1701 if [ $ret != 0 ]; then echo_i "failed"; fi 1702 status=`expr $status + $ret` 1703 1704 # Check direct query for RRSIG: If it's not cached with other records, 1705 # it should result in an empty response. 1706 echo_i "checking RRSIG query not in cache ($n)" 1707 ret=0 1708 ans=`$DIG $DIGOPTS +short rrsigonly.secure.example. @10.53.0.4 rrsig` || ret=1 1709 test -z "$ans" || ret=1 1710 # also check that RA is cleared 1711 $DIG $DIGOPTS rrsigonly.secure.example. @10.53.0.4 rrsig > dig.out.ns4.test$n || ret=1 1712 grep "flags:.*ra.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 1713 n=`expr $n + 1` 1714 if [ $ret != 0 ]; then echo_i "failed"; fi 1715 status=`expr $status + $ret` 1716 1717 # 1718 # RT21868 regression test. 1719 # 1720 echo_i "checking NSEC3 zone with mismatched NSEC3PARAM / NSEC parameters ($n)" 1721 ret=0 1722 $DIG $DIGOPTS non-exist.badparam. @10.53.0.2 a > dig.out.ns2.test$n || ret=1 1723 grep "status: NXDOMAIN" dig.out.ns2.test$n > /dev/null || ret=1 1724 n=`expr $n + 1` 1725 if [ $ret != 0 ]; then echo_i "failed"; fi 1726 status=`expr $status + $ret` 1727 1728 # 1729 # RT22007 regression test. 1730 # 1731 echo_i "checking optout NSEC3 referral with only insecure delegations ($n)" 1732 ret=0 1733 $DIG $DIGOPTS +norec delegation.single-nsec3. @10.53.0.2 a > dig.out.ns2.test$n || ret=1 1734 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1 1735 grep "3KL3NK1HKQ4IUEEHBEF12VGFKUETNBAN.*NSEC3 1 1 1 - 3KL3NK1HKQ4IUEEHBEF12VGFKUETNBAN" dig.out.ns2.test$n > /dev/null || ret=1 1736 n=`expr $n + 1` 1737 if [ $ret != 0 ]; then echo_i "failed"; fi 1738 status=`expr $status + $ret` 1739 1740 echo_i "checking optout NSEC3 NXDOMAIN with only insecure delegations ($n)" 1741 ret=0 1742 $DIG $DIGOPTS +norec nonexist.single-nsec3. @10.53.0.2 a > dig.out.ns2.test$n || ret=1 1743 grep "status: NXDOMAIN" dig.out.ns2.test$n > /dev/null || ret=1 1744 grep "3KL3NK1HKQ4IUEEHBEF12VGFKUETNBAN.*NSEC3 1 1 1 - 3KL3NK1HKQ4IUEEHBEF12VGFKUETNBAN" dig.out.ns2.test$n > /dev/null || ret=1 1745 n=`expr $n + 1` 1746 if [ $ret != 0 ]; then echo_i "failed"; fi 1747 1748 status=`expr $status + $ret` 1749 echo_i "checking optout NSEC3 nodata with only insecure delegations ($n)" 1750 ret=0 1751 $DIG $DIGOPTS +norec single-nsec3. @10.53.0.2 a > dig.out.ns2.test$n || ret=1 1752 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1 1753 grep "3KL3NK1HKQ4IUEEHBEF12VGFKUETNBAN.*NSEC3 1 1 1 - 3KL3NK1HKQ4IUEEHBEF12VGFKUETNBAN" dig.out.ns2.test$n > /dev/null || ret=1 1754 n=`expr $n + 1` 1755 if [ $ret != 0 ]; then echo_i "failed"; fi 1756 status=`expr $status + $ret` 1757 1758 echo_i "checking that a zone finishing the transition from RSASHA1 to RSASHA256 validates secure ($n)" 1759 ret=0 1760 $DIG $DIGOPTS ns algroll. @10.53.0.4 > dig.out.ns4.test$n || ret=1 1761 grep "NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 1762 grep "flags:[^;]* ad[^;]*;" dig.out.ns4.test$n > /dev/null || ret=1 1763 n=`expr $n + 1` 1764 if [ $ret != 0 ]; then echo_i "failed"; fi 1765 status=`expr $status + $ret` 1766 1767 echo_i "checking validate-except in an insecure local domain ($n)" 1768 ret=0 1769 $DIG $DIGOPTS ns www.corp @10.53.0.4 > dig.out.ns4.test$n || ret=1 1770 grep "NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 1771 grep "flags:[^;]* ad[^;]*;" dig.out.ns4.test$n > /dev/null && ret=1 1772 n=`expr $n + 1` 1773 if [ $ret != 0 ]; then echo_i "failed"; fi 1774 status=`expr $status + $ret` 1775 1776 echo_i "checking positive and negative validation with negative trust anchors ($n)" 1777 ret=0 1778 1779 # 1780 # check correct initial behavior 1781 # 1782 $DIG $DIGOPTS a.bogus.example. a @10.53.0.4 > dig.out.ns4.test$n.1 || ret=1 1783 grep "status: SERVFAIL" dig.out.ns4.test$n.1 > /dev/null || ret=1 1784 $DIG $DIGOPTS badds.example. soa @10.53.0.4 > dig.out.ns4.test$n.2 || ret=1 1785 grep "status: SERVFAIL" dig.out.ns4.test$n.2 > /dev/null || ret=1 1786 $DIG $DIGOPTS a.secure.example. a @10.53.0.4 > dig.out.ns4.test$n.3 || ret=1 1787 grep "status: SERVFAIL" dig.out.ns4.test$n.3 > /dev/null && ret=1 1788 grep "flags:[^;]* ad[^;]*;" dig.out.ns4.test$n.3 > /dev/null || ret=1 1789 1790 if [ $ret != 0 ]; then echo_i "failed - checking initial state"; fi 1791 status=`expr $status + $ret` 1792 ret=0 1793 1794 # 1795 # add negative trust anchors 1796 # 1797 $RNDCCMD 10.53.0.4 nta -f -l 20s bogus.example 2>&1 | sed 's/^/ns4 /' | cat_i 1798 $RNDCCMD 10.53.0.4 nta badds.example 2>&1 | sed 's/^/ns4 /' | cat_i 1799 # reconfig should maintain NTAs 1800 $RNDCCMD 10.53.0.4 reconfig 2>&1 | sed 's/^/ns4 /' | cat_i 1801 $RNDCCMD 10.53.0.4 nta -d > rndc.out.ns4.test$n.1 1802 lines=`wc -l < rndc.out.ns4.test$n.1` 1803 [ "$lines" -eq 2 ] || ret=1 1804 $RNDCCMD 10.53.0.4 nta secure.example 2>&1 | sed 's/^/ns4 /' | cat_i 1805 $RNDCCMD 10.53.0.4 nta fakenode.secure.example 2>&1 | sed 's/^/ns4 /' | cat_i 1806 # reload should maintain NTAs 1807 $RNDCCMD 10.53.0.4 reload 2>&1 | sed 's/^/ns4 /' | cat_i 1808 $RNDCCMD 10.53.0.4 nta -d > rndc.out.ns4.test$n.2 1809 lines=`wc -l < rndc.out.ns4.test$n.2` 1810 [ "$lines" -eq 4 ] || ret=1 1811 start=`$PERL -e 'print time()."\n";'` 1812 1813 if [ $ret != 0 ]; then echo_i "failed - adding NTA's failed"; fi 1814 status=`expr $status + $ret` 1815 ret=0 1816 1817 # 1818 # check behavior with NTA's in place 1819 # 1820 $DIG $DIGOPTS a.bogus.example. a @10.53.0.4 > dig.out.ns4.test$n.4 || ret=1 1821 grep "status: SERVFAIL" dig.out.ns4.test$n.4 > /dev/null && ret=1 1822 grep "flags:[^;]* ad[^;]*;" dig.out.ns4.test$n.4 > /dev/null && ret=1 1823 $DIG $DIGOPTS badds.example. soa @10.53.0.4 > dig.out.ns4.test$n.5 || ret=1 1824 grep "status: SERVFAIL" dig.out.ns4.test$n.5 > /dev/null && ret=1 1825 grep "flags:[^;]* ad[^;]*;" dig.out.ns4.test$n.5 > /dev/null && ret=1 1826 $DIG $DIGOPTS a.secure.example. a @10.53.0.4 > dig.out.ns4.test$n.6 || ret=1 1827 grep "status: SERVFAIL" dig.out.ns4.test$n.6 > /dev/null && ret=1 1828 grep "flags:[^;]* ad[^;]*;" dig.out.ns4.test$n.6 > /dev/null && ret=1 1829 $DIG $DIGOPTS a.fakenode.secure.example. a @10.53.0.4 > dig.out.ns4.test$n.7 || ret=1 1830 grep "flags:[^;]* ad[^;]*;" dig.out.ns4.test$n.7 > /dev/null && ret=1 1831 echo_i "dumping secroots" 1832 $RNDCCMD 10.53.0.4 secroots | sed 's/^/ns4 /' | cat_i 1833 grep "bogus.example: expiry" ns4/named.secroots > /dev/null || ret=1 1834 grep "badds.example: expiry" ns4/named.secroots > /dev/null || ret=1 1835 grep "secure.example: expiry" ns4/named.secroots > /dev/null || ret=1 1836 grep "fakenode.secure.example: expiry" ns4/named.secroots > /dev/null || ret=1 1837 1838 if [ $ret != 0 ]; then echo_i "failed - with NTA's in place failed"; fi 1839 status=`expr $status + $ret` 1840 ret=0 1841 1842 echo_i "waiting for NTA rechecks/expirations" 1843 1844 # 1845 # secure.example and badds.example used default nta-duration 1846 # (configured as 10s in ns4/named1.conf), but nta recheck interval 1847 # is configured to 7s, so at t=8 the NTAs for secure.example and 1848 # fakenode.secure.example should both be lifted, but badds.example 1849 # should still be going. 1850 # 1851 $PERL -e 'my $delay = '$start' + 10 - time(); select(undef, undef, undef, $delay) if ($delay > 0);' 1852 $DIG $DIGOPTS b.secure.example. a @10.53.0.4 > dig.out.ns4.test$n.8 || ret=1 1853 grep "status: SERVFAIL" dig.out.ns4.test$n.8 > /dev/null && ret=1 1854 grep "flags:[^;]* ad[^;]*;" dig.out.ns4.test$n.8 > /dev/null || ret=1 1855 $DIG $DIGOPTS b.fakenode.secure.example. a @10.53.0.4 > dig.out.ns4.test$n.9 || ret=1 1856 grep "flags:[^;]* ad[^;]*;" dig.out.ns4.test$n.9 > /dev/null || ret=1 1857 grep "status: NXDOMAIN" dig.out.ns4.test$n.9 > /dev/null || ret=1 1858 $DIG $DIGOPTS badds.example. soa @10.53.0.4 > dig.out.ns4.test$n.10 || ret=1 1859 grep "status: SERVFAIL" dig.out.ns4.test$n.10 > /dev/null && ret=1 1860 grep "flags:[^;]* ad[^;]*;" dig.out.ns4.test$n.10 > /dev/null && ret=1 1861 1862 if [ $ret != 0 ]; then echo_i "failed - checking that default nta's were lifted due to recheck"; fi 1863 status=`expr $status + $ret` 1864 ret=0 1865 1866 # 1867 # bogus.example was set to expire in 20s, so at t=11 1868 # it should still be NTA'd, but badds.example used the default 1869 # lifetime of 10s, so it should revert to SERVFAIL now. 1870 # 1871 $PERL -e 'my $delay = '$start' + 13 - time(); select(undef, undef, undef, $delay) if ($delay > 0);' 1872 # check nta table 1873 $RNDCCMD 10.53.0.4 nta -d > rndc.out.ns4.test$n._11 1874 lines=`grep " expiry " rndc.out.ns4.test$n._11 | wc -l` 1875 [ "$lines" -le 2 ] || ret=1 1876 grep "bogus.example/_default: expiry" rndc.out.ns4.test$n._11 > /dev/null || ret=1 1877 grep "badds.example/_default: expiry" rndc.out.ns4.test$n._11 > /dev/null && ret=1 1878 $DIG $DIGOPTS b.bogus.example. a @10.53.0.4 > dig.out.ns4.test$n.11 || ret=1 1879 grep "status: SERVFAIL" dig.out.ns4.test$n.11 > /dev/null && ret=1 1880 $DIG $DIGOPTS a.badds.example. a @10.53.0.4 > dig.out.ns4.test$n.12 || ret=1 1881 grep "status: SERVFAIL" dig.out.ns4.test$n.12 > /dev/null || ret=1 1882 grep "flags:[^;]* ad[^;]*;" dig.out.ns4.test$n.12 > /dev/null && ret=1 1883 $DIG $DIGOPTS c.secure.example. a @10.53.0.4 > dig.out.ns4.test$n.13 || ret=1 1884 grep "status: SERVFAIL" dig.out.ns4.test$n.13 > /dev/null && ret=1 1885 grep "flags:[^;]* ad[^;]*;" dig.out.ns4.test$n.13 > /dev/null || ret=1 1886 1887 if [ $ret != 0 ]; then echo_i "failed - checking that default nta's were lifted due to lifetime"; fi 1888 status=`expr $status + $ret` 1889 ret=0 1890 1891 # 1892 # at t=21, all the NTAs should have expired. 1893 # 1894 $PERL -e 'my $delay = '$start' + 21 - time(); select(undef, undef, undef, $delay) if ($delay > 0);' 1895 # check correct behavior after bogus.example expiry 1896 $DIG $DIGOPTS d.secure.example. a @10.53.0.4 > dig.out.ns4.test$n.14 || ret=1 1897 grep "status: SERVFAIL" dig.out.ns4.test$n.14 > /dev/null && ret=1 1898 grep "flags:[^;]* ad[^;]*;" dig.out.ns4.test$n.14 > /dev/null || ret=1 1899 $DIG $DIGOPTS c.bogus.example. a @10.53.0.4 > dig.out.ns4.test$n.15 || ret=1 1900 grep "status: SERVFAIL" dig.out.ns4.test$n.15 > /dev/null || ret=1 1901 # check nta table has been cleaned up now 1902 $RNDCCMD 10.53.0.4 nta -d > rndc.out.ns4.test$n.3 1903 lines=`grep " expiry " rndc.out.ns4.test$n.3 | wc -l` 1904 [ "$lines" -eq 0 ] || ret=1 1905 n=`expr $n + 1` 1906 if [ $ret != 0 ]; then echo_i "failed - checking that all nta's have been lifted"; fi 1907 status=`expr $status + $ret` 1908 ret=0 1909 1910 echo_i "testing NTA removals ($n)" 1911 $RNDCCMD 10.53.0.4 nta badds.example 2>&1 | sed 's/^/ns4 /' | cat_i 1912 $RNDCCMD 10.53.0.4 nta -d > rndc.out.ns4.test$n.1 1913 grep "badds.example/_default: expiry" rndc.out.ns4.test$n.1 > /dev/null || ret=1 1914 $DIG $DIGOPTS a.badds.example. a @10.53.0.4 > dig.out.ns4.test$n.1 || ret=1 1915 grep "status: SERVFAIL" dig.out.ns4.test$n.1 > /dev/null && ret=1 1916 grep "^a.badds.example." dig.out.ns4.test$n.1 > /dev/null || ret=1 1917 $RNDCCMD 10.53.0.4 nta -remove badds.example > rndc.out.ns4.test$n.2 1918 grep "Negative trust anchor removed: badds.example/_default" rndc.out.ns4.test$n.2 > /dev/null || ret=1 1919 $RNDCCMD 10.53.0.4 nta -d > rndc.out.ns4.test$n.3 1920 grep "badds.example/_default: expiry" rndc.out.ns4.test$n.3 > /dev/null && ret=1 1921 $DIG $DIGOPTS a.badds.example. a @10.53.0.4 > dig.out.ns4.test$n.2 || ret=1 1922 grep "status: SERVFAIL" dig.out.ns4.test$n.2 > /dev/null || ret=1 1923 if [ $ret != 0 ]; then echo_i "failed"; fi 1924 status=`expr $status + $ret` 1925 ret=0 1926 1927 echo_i "remove non-existent NTA three times" 1928 $RNDCCMD 10.53.0.4 nta -r foo > rndc.out.ns4.test$n.4 2>&1 1929 $RNDCCMD 10.53.0.4 nta -remove foo > rndc.out.ns4.test$n.5 2>&1 1930 $RNDCCMD 10.53.0.4 nta -r foo > rndc.out.ns4.test$n.6 2>&1 1931 grep "not found" rndc.out.ns4.test$n.6 > /dev/null || ret=1 1932 if [ $ret != 0 ]; then echo_i "failed"; fi 1933 status=`expr $status + $ret` 1934 ret=0 1935 1936 n=`expr $n + 1` 1937 echo_i "testing NTA with bogus lifetimes ($n)" 1938 echo_i "check with no nta lifetime specified" 1939 $RNDCCMD 10.53.0.4 nta -l "" foo > rndc.out.ns4.test$n.1 2>&1 1940 grep "'nta' failed: bad ttl" rndc.out.ns4.test$n.1 > /dev/null || ret=1 1941 if [ $ret != 0 ]; then echo_i "failed"; fi 1942 status=`expr $status + $ret` 1943 ret=0 1944 1945 echo_i "check with bad nta lifetime" 1946 $RNDCCMD 10.53.0.4 nta -l garbage foo > rndc.out.ns4.test$n.2 2>&1 1947 grep "'nta' failed: bad ttl" rndc.out.ns4.test$n.2 > /dev/null || ret=1 1948 if [ $ret != 0 ]; then echo_i "failed"; fi 1949 status=`expr $status + $ret` 1950 ret=0 1951 1952 echo_i "check with too long nta lifetime" 1953 $RNDCCMD 10.53.0.4 nta -l 7d1h foo > rndc.out.ns4.test$n.3 2>&1 1954 grep "'nta' failed: out of range" rndc.out.ns4.test$n.3 > /dev/null || ret=1 1955 if [ $ret != 0 ]; then echo_i "failed"; fi 1956 status=`expr $status + $ret` 1957 ret=0 1958 1959 # 1960 # check NTA persistence across restarts 1961 # 1962 n=`expr $n + 1` 1963 echo_i "testing NTA persistence across restarts ($n)" 1964 $RNDCCMD 10.53.0.4 nta -d > rndc.out.ns4.test$n.1 1965 lines=`grep " expiry " rndc.out.ns4.test$n.1 | wc -l` 1966 [ "$lines" -eq 0 ] || ret=1 1967 $RNDCCMD 10.53.0.4 nta -f -l 30s bogus.example 2>&1 | sed 's/^/ns4 /' | cat_i 1968 $RNDCCMD 10.53.0.4 nta -f -l 10s badds.example 2>&1 | sed 's/^/ns4 /' | cat_i 1969 $RNDCCMD 10.53.0.4 nta -d > rndc.out.ns4.test$n.2 1970 lines=`grep " expiry " rndc.out.ns4.test$n.2 | wc -l` 1971 [ "$lines" -eq 2 ] || ret=1 1972 start=`$PERL -e 'print time()."\n";'` 1973 1974 if [ $ret != 0 ]; then echo_i "failed - NTA persistence: adding NTA's failed"; fi 1975 status=`expr $status + $ret` 1976 ret=0 1977 1978 echo_i "killing ns4 with SIGTERM" 1979 cd ns4 1980 $KILL -TERM `cat named.pid` 1981 rm -f named.pid 1982 cd .. 1983 1984 # 1985 # ns4 has now shutdown. wait until t=14 when badds.example's NTA 1986 # (lifetime=10s) would have expired, and then restart ns4. 1987 # 1988 echo_i "waiting till 14s have passed since NTAs were added before restarting ns4" 1989 $PERL -e 'my $delay = '$start' + 14 - time(); select(undef, undef, undef, $delay) if ($delay > 0);' 1990 1991 if 1992 $PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port ${PORT} dnssec ns4 1993 then 1994 echo_i "restarted server ns4" 1995 else 1996 echo_i "could not restart server ns4" 1997 exit 1 1998 fi 1999 2000 echo_i "sleeping for an additional 4 seconds for ns4 to fully startup" 2001 sleep 4 2002 2003 # 2004 # ns4 should be back up now. The NTA for bogus.example should still be 2005 # valid, whereas badds.example should not have been added during named 2006 # startup (as it had already expired), the fact that it's ignored should 2007 # be logged. 2008 # 2009 $RNDCCMD 10.53.0.4 nta -d > rndc.out.ns4.test$n.3 2010 lines=`wc -l < rndc.out.ns4.test$n.3` 2011 [ "$lines" -eq 1 ] || ret=1 2012 grep "bogus.example/_default: expiry" rndc.out.ns4.test$n.3 > /dev/null || ret=1 2013 $DIG $DIGOPTS b.bogus.example. a @10.53.0.4 > dig.out.ns4.test$n.4 || ret=1 2014 grep "status: SERVFAIL" dig.out.ns4.test$n.4 > /dev/null && ret=1 2015 grep "flags:[^;]* ad[^;]*;" dig.out.ns4.test$n.4 > /dev/null && ret=1 2016 $DIG $DIGOPTS a.badds.example. a @10.53.0.4 > dig.out.ns4.test$n.5 || ret=1 2017 grep "status: SERVFAIL" dig.out.ns4.test$n.5 > /dev/null || ret=1 2018 grep "ignoring expired NTA at badds.example" ns4/named.run > /dev/null || ret=1 2019 2020 # cleanup 2021 $RNDCCMD 10.53.0.4 nta -remove bogus.example > rndc.out.ns4.test$n.6 2022 2023 if [ $ret != 0 ]; then echo_i "failed - NTA persistence: restoring NTA failed"; fi 2024 status=`expr $status + $ret` 2025 ret=0 2026 2027 # 2028 # check "regular" attribute in NTA file works as expected at named 2029 # startup. 2030 # 2031 n=`expr $n + 1` 2032 echo_i "testing loading regular attribute from NTA file ($n)" 2033 $RNDCCMD 10.53.0.4 nta -d > rndc.out.ns4.test$n.1 2>/dev/null 2034 lines=`wc -l < rndc.out.ns4.test$n.1` 2035 [ "$lines" -eq 0 ] || ret=1 2036 # initially, secure.example. validates with AD=1 2037 $DIG $DIGOPTS a.secure.example. a @10.53.0.4 > dig.out.ns4.test$n.2 || ret=1 2038 grep "status: SERVFAIL" dig.out.ns4.test$n.2 > /dev/null && ret=1 2039 grep "flags:[^;]* ad[^;]*;" dig.out.ns4.test$n.2 > /dev/null || ret=1 2040 2041 echo_i "killing ns4 with SIGTERM" 2042 cd ns4 2043 $KILL -TERM `cat named.pid` 2044 rm -f named.pid 2045 cd .. 2046 2047 echo_i "sleeping for an additional 4 seconds for ns4 to fully shutdown" 2048 sleep 4 2049 2050 # 2051 # ns4 has now shutdown. add NTA for secure.example. directly into the 2052 # _default.nta file with the regular attribute and some future timestamp. 2053 # 2054 year=`date +%Y` 2055 future="`expr 20 + ${year}`0101010000" 2056 echo "secure.example. regular $future" > ns4/_default.nta 2057 start=`$PERL -e 'print time()."\n";'` 2058 2059 if 2060 $PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port ${PORT} dnssec ns4 2061 then 2062 echo_i "restarted server ns4" 2063 else 2064 echo_i "could not restart server ns4" 2065 exit 1 2066 fi 2067 2068 # nta-recheck is configured as 7s, so at t=10 the NTAs for 2069 # secure.example. should be lifted as it is not a forced NTA. 2070 echo_i "waiting till 10s have passed after ns4 was restarted" 2071 $PERL -e 'my $delay = '$start' + 10 - time(); select(undef, undef, undef, $delay) if ($delay > 0);' 2072 2073 # secure.example. should now return an AD=1 answer (still validates) as 2074 # the NTA has been lifted. 2075 $DIG $DIGOPTS a.secure.example. a @10.53.0.4 > dig.out.ns4.test$n.3 || ret=1 2076 grep "status: SERVFAIL" dig.out.ns4.test$n.3 > /dev/null && ret=1 2077 grep "flags:[^;]* ad[^;]*;" dig.out.ns4.test$n.3 > /dev/null || ret=1 2078 2079 # cleanup 2080 $RNDCCMD 10.53.0.4 nta -remove secure.example > rndc.out.ns4.test$n.4 2>/dev/null 2081 2082 if [ $ret != 0 ]; then echo_i "failed - NTA persistence: loading regular NTAs failed"; fi 2083 status=`expr $status + $ret` 2084 ret=0 2085 2086 # 2087 # check "forced" attribute in NTA file works as expected at named 2088 # startup. 2089 # 2090 n=`expr $n + 1` 2091 echo_i "testing loading forced attribute from NTA file ($n)" 2092 $RNDCCMD 10.53.0.4 nta -d > rndc.out.ns4.test$n.1 2>/dev/null 2093 lines=`wc -l < rndc.out.ns4.test$n.1` 2094 [ "$lines" -eq 0 ] || ret=1 2095 # initially, secure.example. validates with AD=1 2096 $DIG $DIGOPTS a.secure.example. a @10.53.0.4 > dig.out.ns4.test$n.2 || ret=1 2097 grep "status: SERVFAIL" dig.out.ns4.test$n.2 > /dev/null && ret=1 2098 grep "flags:[^;]* ad[^;]*;" dig.out.ns4.test$n.2 > /dev/null || ret=1 2099 2100 echo_i "killing ns4 with SIGTERM" 2101 cd ns4 2102 $KILL -TERM `cat named.pid` 2103 rm -f named.pid 2104 cd .. 2105 2106 echo_i "sleeping for an additional 4 seconds for ns4 to fully shutdown" 2107 sleep 4 2108 2109 # 2110 # ns4 has now shutdown. add NTA for secure.example. directly into the 2111 # _default.nta file with the forced attribute and some future timestamp. 2112 # 2113 echo "secure.example. forced $future" > ns4/_default.nta 2114 start=`$PERL -e 'print time()."\n";'` 2115 2116 if 2117 $PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port ${PORT} dnssec ns4 2118 then 2119 echo_i "restarted server ns4" 2120 else 2121 echo_i "could not restart server ns4" 2122 exit 1 2123 fi 2124 2125 # nta-recheck is configured as 7s, but even at t=10 the NTAs for 2126 # secure.example. should not be lifted as it is a forced NTA. 2127 echo_i "waiting till 10s have passed after ns4 was restarted" 2128 $PERL -e 'my $delay = '$start' + 10 - time(); select(undef, undef, undef, $delay) if ($delay > 0);' 2129 2130 # secure.example. should now return an AD=0 answer (non-authenticated) 2131 # as the NTA is still there. 2132 $DIG $DIGOPTS a.secure.example. a @10.53.0.4 > dig.out.ns4.test$n.3 || ret=1 2133 grep "status: SERVFAIL" dig.out.ns4.test$n.3 > /dev/null && ret=1 2134 grep "flags:[^;]* ad[^;]*;" dig.out.ns4.test$n.3 > /dev/null && ret=1 2135 2136 # cleanup 2137 $RNDCCMD 10.53.0.4 nta -remove secure.example > rndc.out.ns4.test$n.4 2>/dev/null 2138 2139 if [ $ret != 0 ]; then echo_i "failed - NTA persistence: loading forced NTAs failed"; fi 2140 status=`expr $status + $ret` 2141 ret=0 2142 2143 # 2144 # check that NTA lifetime read from file is clamped to 1 week. 2145 # 2146 n=`expr $n + 1` 2147 echo_i "testing loading out of bounds lifetime from NTA file ($n)" 2148 2149 echo_i "killing ns4 with SIGTERM" 2150 cd ns4 2151 $KILL -TERM `cat named.pid` 2152 rm -f named.pid 2153 cd .. 2154 2155 echo_i "sleeping for an additional 4 seconds for ns4 to fully shutdown" 2156 sleep 4 2157 2158 # 2159 # ns4 has now shutdown. add NTA for secure.example. directly into the 2160 # _default.nta file with a lifetime well into the future. 2161 # 2162 echo "secure.example. forced $future" > ns4/_default.nta 2163 added=`$PERL -e 'print time()."\n";'` 2164 2165 if 2166 $PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port ${PORT} dnssec ns4 2167 then 2168 echo_i "restarted server ns4" 2169 else 2170 echo_i "could not restart server ns4" 2171 exit 1 2172 fi 2173 2174 echo_i "sleeping for an additional 4 seconds for ns4 to fully startup" 2175 sleep 4 2176 2177 # dump the NTA to a file (omit validate-except entries) 2178 echo_i "testing 'rndc nta'" 2179 $RNDCCMD 10.53.0.4 nta -d > rndc.out.ns4.test$n.1 2>/dev/null 2180 # "corp" is configured as a validate-except domain and thus should be 2181 # omitted. only "secure.example" should be in the dump at this point. 2182 lines=`wc -l < rndc.out.ns4.test$n.1` 2183 [ "$lines" -eq 1 ] || ret=1 2184 grep 'secure.example' rndc.out.ns4.test$n.1 > /dev/null || ret=1 2185 ts=`awk '{print $3" "$4}' < rndc.out.ns4.test$n.1` 2186 # rndc nta outputs localtime, so append the timezone 2187 ts_with_zone="$ts `date +%z`" 2188 echo "ts=$ts" > rndc.out.ns4.test$n.2 2189 echo "ts_with_zone=$ts_with_zone" >> rndc.out.ns4.test$n.2 2190 echo "added=$added" >> rndc.out.ns4.test$n.2 2191 if $PERL -e 'use Time::Piece; use Time::Seconds;' 2>/dev/null 2192 then 2193 # ntadiff.pl computes $ts_with_zone - ($added + 1week) 2194 d=`$PERL ./ntadiff.pl "$ts_with_zone" "$added"` 2195 echo "d=$d" >> rndc.out.ns4.test$n.2 2196 # diff from $added(now) + 1week to the clamped NTA lifetime should be 2197 # less than a few seconds (handle daylight saving changes by adding 3600). 2198 [ $d -lt 3610 ] || ret=1 2199 else 2200 echo_i "skipped ntadiff test; install PERL module Time::Piece" 2201 fi 2202 2203 # cleanup 2204 $RNDCCMD 10.53.0.4 nta -remove secure.example > rndc.out.ns4.test$n.3 2>/dev/null 2205 2206 if [ $ret != 0 ]; then echo_i "failed - NTA lifetime clamping failed"; fi 2207 status=`expr $status + $ret` 2208 ret=0 2209 2210 echo_i "completed NTA tests" 2211 2212 # Run a minimal update test if possible. This is really just 2213 # a regression test for RT #2399; more tests should be added. 2214 2215 if $PERL -e 'use Net::DNS;' 2>/dev/null 2216 then 2217 echo_i "running DNSSEC update test" 2218 ret=0 2219 { 2220 $PERL dnssec_update_test.pl -s 10.53.0.3 -p ${PORT} dynamic.example. || ret=1 2221 } | cat_i 2222 [ $ret -eq 1 ] && status=1 2223 else 2224 echo_i "The DNSSEC update test requires the Net::DNS library." >&2 2225 fi 2226 2227 n=`expr $n + 1` 2228 echo_i "checking managed key maintenance has not started yet ($n)" 2229 ret=0 2230 [ -f "ns4/managed-keys.bind.jnl" ] && ret=1 2231 n=`expr $n + 1` 2232 if [ $ret != 0 ]; then echo_i "failed"; fi 2233 status=`expr $status + $ret` 2234 2235 # Reconfigure caching server to use "dnssec-validation auto", and repeat 2236 # some of the DNSSEC validation tests to ensure that it works correctly. 2237 echo_i "switching to automatic root key configuration" 2238 copy_setports ns4/named2.conf.in ns4/named.conf 2239 $RNDCCMD 10.53.0.4 reconfig 2>&1 | sed 's/^/ns4 /' | cat_i 2240 sleep 5 2241 2242 echo_i "checking managed key maintenance timer has now started ($n)" 2243 ret=0 2244 [ -f "ns4/managed-keys.bind.jnl" ] || ret=1 2245 n=`expr $n + 1` 2246 if [ $ret != 0 ]; then echo_i "failed"; fi 2247 status=`expr $status + $ret` 2248 2249 echo_i "checking positive validation NSEC ($n)" 2250 ret=0 2251 $DIG $DIGOPTS +noauth a.example. @10.53.0.2 a > dig.out.ns2.test$n || ret=1 2252 $DIG $DIGOPTS +noauth a.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1 2253 digcomp dig.out.ns2.test$n dig.out.ns4.test$n || ret=1 2254 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 2255 n=`expr $n + 1` 2256 if [ $ret != 0 ]; then echo_i "failed"; fi 2257 status=`expr $status + $ret` 2258 2259 echo_i "checking positive validation NSEC3 ($n)" 2260 ret=0 2261 $DIG $DIGOPTS +noauth a.nsec3.example. \ 2262 @10.53.0.3 a > dig.out.ns3.test$n || ret=1 2263 $DIG $DIGOPTS +noauth a.nsec3.example. \ 2264 @10.53.0.4 a > dig.out.ns4.test$n || ret=1 2265 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 2266 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 2267 n=`expr $n + 1` 2268 if [ $ret != 0 ]; then echo_i "failed"; fi 2269 status=`expr $status + $ret` 2270 2271 echo_i "checking positive validation OPTOUT ($n)" 2272 ret=0 2273 $DIG $DIGOPTS +noauth a.optout.example. \ 2274 @10.53.0.3 a > dig.out.ns3.test$n || ret=1 2275 $DIG $DIGOPTS +noauth a.optout.example. \ 2276 @10.53.0.4 a > dig.out.ns4.test$n || ret=1 2277 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 2278 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 2279 n=`expr $n + 1` 2280 if [ $ret != 0 ]; then echo_i "failed"; fi 2281 status=`expr $status + $ret` 2282 2283 echo_i "checking negative validation ($n)" 2284 ret=0 2285 $DIG $DIGOPTS +noauth q.example. @10.53.0.2 a > dig.out.ns2.test$n || ret=1 2286 $DIG $DIGOPTS +noauth q.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1 2287 digcomp dig.out.ns2.test$n dig.out.ns4.test$n || ret=1 2288 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 2289 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1 2290 n=`expr $n + 1` 2291 if [ $ret != 0 ]; then echo_i "failed"; fi 2292 status=`expr $status + $ret` 2293 2294 echo_i "checking that root DS queries validate ($n)" 2295 ret=0 2296 $DIG $DIGOPTS +noauth . @10.53.0.1 ds > dig.out.ns1.test$n || ret=1 2297 $DIG $DIGOPTS +noauth . @10.53.0.4 ds > dig.out.ns4.test$n || ret=1 2298 digcomp dig.out.ns1.test$n dig.out.ns4.test$n || ret=1 2299 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 2300 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 2301 n=`expr $n + 1` 2302 if [ $ret != 0 ]; then echo_i "failed"; fi 2303 status=`expr $status + $ret` 2304 2305 echo_i "checking that DS at a RFC 1918 empty zone lookup succeeds ($n)" 2306 ret=0 2307 $DIG $DIGOPTS +noauth 10.in-addr.arpa ds @10.53.0.2 >dig.out.ns2.test$n || ret=1 2308 $DIG $DIGOPTS +noauth 10.in-addr.arpa ds @10.53.0.6 >dig.out.ns6.test$n || ret=1 2309 digcomp dig.out.ns2.test$n dig.out.ns6.test$n || ret=1 2310 grep "status: NOERROR" dig.out.ns6.test$n > /dev/null || ret=1 2311 n=`expr $n + 1` 2312 if [ $ret != 0 ]; then echo_i "failed"; fi 2313 status=`expr $status + $ret` 2314 2315 echo_i "checking expired signatures remain with "'"allow-update { none; };"'" and no keys available ($n)" 2316 ret=0 2317 $DIG $DIGOPTS +noauth expired.example. +dnssec @10.53.0.3 soa > dig.out.ns3.test$n || ret=1 2318 grep "RRSIG.SOA" dig.out.ns3.test$n > /dev/null || ret=1 2319 n=`expr $n + 1` 2320 if [ $ret != 0 ]; then echo_i "failed"; fi 2321 2322 status=`expr $status + $ret` 2323 echo_i "checking expired signatures do not validate ($n)" 2324 ret=0 2325 $DIG $DIGOPTS +noauth expired.example. +dnssec @10.53.0.4 soa > dig.out.ns4.test$n || ret=1 2326 grep "SERVFAIL" dig.out.ns4.test$n > /dev/null || ret=1 2327 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 2328 grep "expired.example/.*: RRSIG has expired" ns4/named.run > /dev/null || ret=1 2329 n=`expr $n + 1` 2330 if [ $ret != 0 ]; then echo_i "failed"; fi 2331 status=`expr $status + $ret` 2332 2333 echo_i "checking that the NSEC3 record for the apex is properly signed when a DNSKEY is added via UPDATE ($n)" 2334 ret=0 2335 ( 2336 cd ns3 2337 kskname=`$KEYGEN -q -3 -a RSASHA1 -fk update-nsec3.example` 2338 ( 2339 echo zone update-nsec3.example 2340 echo server 10.53.0.3 ${PORT} 2341 grep DNSKEY ${kskname}.key | sed -e 's/^/update add /' -e 's/IN/300 IN/' 2342 echo send 2343 ) | $NSUPDATE 2344 ) 2345 $DIG $DIGOPTS +dnssec a update-nsec3.example. @10.53.0.4 > dig.out.ns4.test$n || ret=1 2346 grep "NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 2347 grep "flags:.* ad[ ;]" dig.out.ns4.test$n > /dev/null || ret=1 2348 grep "NSEC3 .* TYPE65534" dig.out.ns4.test$n > /dev/null || ret=1 2349 n=`expr $n + 1` 2350 if [ $ret != 0 ]; then echo_i "failed"; fi 2351 status=`expr $status + $ret` 2352 2353 echo_i "checking that the NSEC record is properly generated when DNSKEY are added via auto-dnssec ($n)" 2354 ret=0 2355 $DIG $DIGOPTS +dnssec a auto-nsec.example. @10.53.0.4 > dig.out.ns4.test$n || ret=1 2356 grep "NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 2357 grep "flags:.* ad[ ;]" dig.out.ns4.test$n > /dev/null || ret=1 2358 grep "IN.NSEC[^3].* DNSKEY" dig.out.ns4.test$n > /dev/null || ret=1 2359 n=`expr $n + 1` 2360 if [ $ret != 0 ]; then echo_i "failed"; fi 2361 status=`expr $status + $ret` 2362 2363 echo_i "checking that the NSEC3 record is properly generated when DNSKEY are added via auto-dnssec ($n)" 2364 ret=0 2365 $DIG $DIGOPTS +dnssec a auto-nsec3.example. @10.53.0.4 > dig.out.ns4.test$n || ret=1 2366 grep "NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 2367 grep "flags:.* ad[ ;]" dig.out.ns4.test$n > /dev/null || ret=1 2368 grep "IN.NSEC3 .* DNSKEY" dig.out.ns4.test$n > /dev/null || ret=1 2369 n=`expr $n + 1` 2370 if [ $ret != 0 ]; then echo_i "failed"; fi 2371 status=`expr $status + $ret` 2372 2373 echo_i "checking that signing records have been marked as complete ($n)" 2374 ret=0 2375 checkprivate dynamic.example 10.53.0.3 || ret=1 2376 checkprivate update-nsec3.example 10.53.0.3 || ret=1 2377 checkprivate auto-nsec3.example 10.53.0.3 || ret=1 2378 checkprivate expiring.example 10.53.0.3 || ret=1 2379 checkprivate auto-nsec.example 10.53.0.3 || ret=1 2380 n=`expr $n + 1` 2381 if [ $ret != 0 ]; then echo_i "failed"; fi 2382 status=`expr $status + $ret` 2383 2384 echo_i "check that 'rndc signing' without arguments is handled ($n)" 2385 ret=0 2386 $RNDCCMD 10.53.0.3 signing > /dev/null 2>&1 && ret=1 2387 $RNDCCMD 10.53.0.3 status > /dev/null || ret=1 2388 n=`expr $n + 1` 2389 if [ $ret != 0 ]; then echo_i "failed"; fi 2390 status=`expr $status + $ret` 2391 2392 echo_i "check that 'rndc signing -list' without zone is handled ($n)" 2393 ret=0 2394 $RNDCCMD 10.53.0.3 signing -list > /dev/null 2>&1 && ret=1 2395 $RNDCCMD 10.53.0.3 status > /dev/null || ret=1 2396 n=`expr $n + 1` 2397 if [ $ret != 0 ]; then echo_i "failed"; fi 2398 status=`expr $status + $ret` 2399 2400 echo_i "check that 'rndc signing -clear' without additional arguments is handled ($n)" 2401 ret=0 2402 $RNDCCMD 10.53.0.3 signing -clear > /dev/null 2>&1 && ret=1 2403 $RNDCCMD 10.53.0.3 status > /dev/null || ret=1 2404 n=`expr $n + 1` 2405 if [ $ret != 0 ]; then echo_i "failed"; fi 2406 status=`expr $status + $ret` 2407 2408 echo_i "check that 'rndc signing -clear all' without zone is handled ($n)" 2409 ret=0 2410 $RNDCCMD 10.53.0.3 signing -clear all > /dev/null 2>&1 && ret=1 2411 $RNDCCMD 10.53.0.3 status > /dev/null || ret=1 2412 n=`expr $n + 1` 2413 if [ $ret != 0 ]; then echo_i "failed"; fi 2414 status=`expr $status + $ret` 2415 2416 echo_i "check that 'rndc signing -nsec3param' without additional arguments is handled ($n)" 2417 ret=0 2418 $RNDCCMD 10.53.0.3 signing -nsec3param > /dev/null 2>&1 && ret=1 2419 $RNDCCMD 10.53.0.3 status > /dev/null || ret=1 2420 n=`expr $n + 1` 2421 if [ $ret != 0 ]; then echo_i "failed"; fi 2422 status=`expr $status + $ret` 2423 2424 echo_i "check that 'rndc signing -nsec3param none' without zone is handled ($n)" 2425 ret=0 2426 $RNDCCMD 10.53.0.3 signing -nsec3param none > /dev/null 2>&1 && ret=1 2427 $RNDCCMD 10.53.0.3 status > /dev/null || ret=1 2428 n=`expr $n + 1` 2429 if [ $ret != 0 ]; then echo_i "failed"; fi 2430 status=`expr $status + $ret` 2431 2432 echo_i "check that 'rndc signing -nsec3param 1' without additional arguments is handled ($n)" 2433 ret=0 2434 $RNDCCMD 10.53.0.3 signing -nsec3param 1 > /dev/null 2>&1 && ret=1 2435 $RNDCCMD 10.53.0.3 status > /dev/null || ret=1 2436 n=`expr $n + 1` 2437 if [ $ret != 0 ]; then echo_i "failed"; fi 2438 status=`expr $status + $ret` 2439 2440 echo_i "check that 'rndc signing -nsec3param 1 0' without additional arguments is handled ($n)" 2441 ret=0 2442 $RNDCCMD 10.53.0.3 signing -nsec3param 1 0 > /dev/null 2>&1 && ret=1 2443 $RNDCCMD 10.53.0.3 status > /dev/null || ret=1 2444 n=`expr $n + 1` 2445 if [ $ret != 0 ]; then echo_i "failed"; fi 2446 status=`expr $status + $ret` 2447 2448 echo_i "check that 'rndc signing -nsec3param 1 0 0' without additional arguments is handled ($n)" 2449 ret=0 2450 $RNDCCMD 10.53.0.3 signing -nsec3param 1 0 0 > /dev/null 2>&1 && ret=1 2451 $RNDCCMD 10.53.0.3 status > /dev/null || ret=1 2452 n=`expr $n + 1` 2453 if [ $ret != 0 ]; then echo_i "failed"; fi 2454 status=`expr $status + $ret` 2455 2456 echo_i "check that 'rndc signing -nsec3param 1 0 0 -' without zone is handled ($n)" 2457 ret=0 2458 $RNDCCMD 10.53.0.3 signing -nsec3param 1 0 0 - > /dev/null 2>&1 && ret=1 2459 $RNDCCMD 10.53.0.3 status > /dev/null || ret=1 2460 n=`expr $n + 1` 2461 if [ $ret != 0 ]; then echo_i "failed"; fi 2462 status=`expr $status + $ret` 2463 2464 echo_i "check that 'rndc signing -nsec3param' works with salt ($n)" 2465 ret=0 2466 $RNDCCMD 10.53.0.3 signing -nsec3param 1 0 0 ffff inline.example > /dev/null 2>&1 || ret=1 2467 $RNDCCMD 10.53.0.3 status > /dev/null || ret=1 2468 for i in 1 2 3 4 5 6 7 8 9 10 ; do 2469 salt=`$DIG $DIGOPTS +nodnssec +short nsec3param inline.example. @10.53.0.3 | awk '{print $4}'` 2470 if [ "$salt" = "FFFF" ]; then 2471 break; 2472 fi 2473 echo_i "sleeping ...." 2474 sleep 1 2475 done; 2476 [ "$salt" = "FFFF" ] || ret=1 2477 n=`expr $n + 1` 2478 if [ $ret != 0 ]; then echo_i "failed"; fi 2479 status=`expr $status + $ret` 2480 2481 echo_i "check that 'rndc signing -nsec3param' works without salt ($n)" 2482 ret=0 2483 $RNDCCMD 10.53.0.3 signing -nsec3param 1 0 0 - inline.example > /dev/null 2>&1 || ret=1 2484 $RNDCCMD 10.53.0.3 status > /dev/null || ret=1 2485 for i in 1 2 3 4 5 6 7 8 9 10 ; do 2486 salt=`$DIG $DIGOPTS +nodnssec +short nsec3param inline.example. @10.53.0.3 | awk '{print $4}'` 2487 if [ "$salt" = "-" ]; then 2488 break; 2489 fi 2490 echo_i "sleeping ...." 2491 sleep 1 2492 done; 2493 [ "$salt" = "-" ] || ret=1 2494 n=`expr $n + 1` 2495 if [ $ret != 0 ]; then echo_i "failed"; fi 2496 status=`expr $status + $ret` 2497 2498 echo_i "check that 'rndc signing -nsec3param' works with 'auto' as salt ($n)" 2499 ret=0 2500 $RNDCCMD 10.53.0.3 signing -nsec3param 1 0 0 auto inline.example > /dev/null 2>&1 || ret=1 2501 $RNDCCMD 10.53.0.3 status > /dev/null || ret=1 2502 for i in 1 2 3 4 5 6 7 8 9 10 ; do 2503 salt=`$DIG $DIGOPTS +nodnssec +short nsec3param inline.example. @10.53.0.3 | awk '{print $4}'` 2504 [ -n "$salt" -a "$salt" != "-" ] && break 2505 echo_i "sleeping ...." 2506 sleep 1 2507 done; 2508 [ "$salt" != "-" ] || ret=1 2509 [ `expr "${salt}" : ".*"` -eq 16 ] || ret=1 2510 n=`expr $n + 1` 2511 if [ $ret != 0 ]; then echo_i "failed"; fi 2512 status=`expr $status + $ret` 2513 2514 echo_i "check that 'rndc signing -nsec3param' with 'auto' as salt again generates a different salt ($n)" 2515 ret=0 2516 oldsalt=$salt 2517 $RNDCCMD 10.53.0.3 signing -nsec3param 1 0 0 auto inline.example > /dev/null 2>&1 || ret=1 2518 $RNDCCMD 10.53.0.3 status > /dev/null || ret=1 2519 for i in 1 2 3 4 5 6 7 8 9 10 ; do 2520 salt=`$DIG $DIGOPTS +nodnssec +short nsec3param inline.example. @10.53.0.3 | awk '{print $4}'` 2521 [ -n "$salt" -a "$salt" != "$oldsalt" ] && break 2522 echo_i "sleeping ...." 2523 sleep 1 2524 done; 2525 [ "$salt" != "$oldsalt" ] || ret=1 2526 [ `expr "$salt" : ".*"` -eq 16 ] || ret=1 2527 n=`expr $n + 1` 2528 if [ $ret != 0 ]; then echo_i "failed"; fi 2529 status=`expr $status + $ret` 2530 2531 echo_i "check rndc signing -list output ($n)" 2532 ret=0 2533 $RNDCCMD 10.53.0.3 signing -list dynamic.example 2>&1 > signing.out 2534 grep "No signing records found" signing.out > /dev/null 2>&1 || { 2535 ret=1 2536 sed 's/^/ns3 /' signing.out | cat_i 2537 } 2538 $RNDCCMD 10.53.0.3 signing -list update-nsec3.example 2>&1 > signing.out 2539 grep "Done signing with key .*/NSEC3RSASHA1" signing.out > /dev/null 2>&1 || { 2540 ret=1 2541 sed 's/^/ns3 /' signing.out | cat_i 2542 } 2543 n=`expr $n + 1` 2544 if [ $ret != 0 ]; then echo_i "failed"; fi 2545 status=`expr $status + $ret` 2546 2547 echo_i "clear signing records ($n)" 2548 $RNDCCMD 10.53.0.3 signing -clear all update-nsec3.example > /dev/null || ret=1 2549 sleep 1 2550 $RNDCCMD 10.53.0.3 signing -list update-nsec3.example 2>&1 > signing.out 2551 grep "No signing records found" signing.out > /dev/null 2>&1 || { 2552 ret=1 2553 sed 's/^/ns3 /' signing.out | cat_i 2554 } 2555 n=`expr $n + 1` 2556 if [ $ret != 0 ]; then echo_i "failed"; fi 2557 status=`expr $status + $ret` 2558 2559 echo_i "checking that a insecure zone beneath a cname resolves ($n)" 2560 ret=0 2561 $DIG $DIGOPTS soa insecure.below-cname.example. @10.53.0.4 > dig.out.ns4.test$n || ret=1 2562 grep "NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 2563 grep "ANSWER: 1," dig.out.ns4.test$n > /dev/null || ret=1 2564 n=`expr $n + 1` 2565 if [ $ret != 0 ]; then echo_i "failed"; fi 2566 status=`expr $status + $ret` 2567 2568 echo_i "checking that a secure zone beneath a cname resolves ($n)" 2569 ret=0 2570 $DIG $DIGOPTS soa secure.below-cname.example. @10.53.0.4 > dig.out.ns4.test$n || ret=1 2571 grep "NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 2572 grep "ANSWER: 2," dig.out.ns4.test$n > /dev/null || ret=1 2573 grep "flags:.* ad[ ;]" dig.out.ns4.test$n > /dev/null || ret=1 2574 n=`expr $n + 1` 2575 if [ $ret != 0 ]; then echo_i "failed"; fi 2576 status=`expr $status + $ret` 2577 2578 echo_i "checking dnskey query with no data still gets put in cache ($n)" 2579 ret=0 2580 myDIGOPTS="+noadd +nosea +nostat +noquest +nocomm +nocmd -p ${PORT} @10.53.0.4" 2581 firstVal=`$DIG $myDIGOPTS insecure.example. dnskey| awk '$1 != ";;" { print $2 }'` 2582 sleep 1 2583 secondVal=`$DIG $myDIGOPTS insecure.example. dnskey| awk '$1 != ";;" { print $2 }'` 2584 if [ ${firstVal:-0} -eq ${secondVal:-0} ] 2585 then 2586 sleep 1 2587 thirdVal=`$DIG $myDIGOPTS insecure.example. dnskey|awk '$1 != ";;" { print $2 }'` 2588 if [ ${firstVal:-0} -eq ${thirdVal:-0} ] 2589 then 2590 echo_i "cannot confirm query answer still in cache" 2591 ret=1 2592 fi 2593 fi 2594 n=`expr $n + 1` 2595 if [ $ret != 0 ]; then echo_i "failed"; fi 2596 status=`expr $status + $ret` 2597 2598 echo_i "check that a split dnssec dnssec-signzone work ($n)" 2599 ret=0 2600 $DIG $DIGOPTS soa split-dnssec.example. @10.53.0.4 > dig.out.ns4.test$n || ret=1 2601 grep "NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 2602 grep "ANSWER: 2," dig.out.ns4.test$n > /dev/null || ret=1 2603 grep "flags:.* ad[ ;]" dig.out.ns4.test$n > /dev/null || ret=1 2604 n=`expr $n + 1` 2605 if [ $ret != 0 ]; then echo_i "failed"; fi 2606 status=`expr $status + $ret` 2607 2608 echo_i "check that a smart split dnssec dnssec-signzone work ($n)" 2609 ret=0 2610 $DIG $DIGOPTS soa split-smart.example. @10.53.0.4 > dig.out.ns4.test$n || ret=1 2611 grep "NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 2612 grep "ANSWER: 2," dig.out.ns4.test$n > /dev/null || ret=1 2613 grep "flags:.* ad[ ;]" dig.out.ns4.test$n > /dev/null || ret=1 2614 n=`expr $n + 1` 2615 if [ $ret != 0 ]; then echo_i "failed"; fi 2616 status=`expr $status + $ret` 2617 2618 echo_i "check that NOTIFY is sent at the end of NSEC3 chain generation ($n)" 2619 ret=0 2620 ( 2621 echo zone nsec3chain-test 2622 echo server 10.53.0.2 ${PORT} 2623 echo update add nsec3chain-test. 0 nsec3param 1 0 1 123456 2624 echo send 2625 ) | $NSUPDATE 2626 for i in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 2627 do 2628 $DIG $DIGOPTS nsec3param nsec3chain-test @10.53.0.2 > dig.out.ns2.test$n || ret=1 2629 if grep "ANSWER: 3," dig.out.ns2.test$n >/dev/null 2630 then 2631 break; 2632 fi 2633 echo_i "sleeping ...." 2634 sleep 3 2635 done; 2636 grep "ANSWER: 3," dig.out.ns2.test$n > /dev/null || ret=1 2637 if [ $ret != 0 ]; then echo_i "nsec3 chain generation not complete"; fi 2638 $DIG $DIGOPTS +noauth +nodnssec soa nsec3chain-test @10.53.0.2 > dig.out.ns2.test$n || ret=1 2639 s2=`awk '$4 == "SOA" { print $7}' dig.out.ns2.test$n` 2640 for i in 1 2 3 4 5 6 7 8 9 10 2641 do 2642 $DIG $DIGOPTS +noauth +nodnssec soa nsec3chain-test @10.53.0.3 > dig.out.ns3.test$n || ret=1 2643 s3=`awk '$4 == "SOA" { print $7}' dig.out.ns3.test$n` 2644 test "$s2" = "$s3" && break 2645 sleep 1 2646 done 2647 digcomp dig.out.ns2.test$n dig.out.ns3.test$n || ret=1 2648 n=`expr $n + 1` 2649 if [ $ret != 0 ]; then echo_i "failed"; fi 2650 status=`expr $status + $ret` 2651 2652 echo_i "check dnssec-dsfromkey from stdin ($n)" 2653 ret=0 2654 $DIG $DIGOPTS dnskey algroll. @10.53.0.2 | \ 2655 $DSFROMKEY -f - algroll. > dig.out.ns2.test$n || ret=1 2656 NF=`awk '{print NF}' dig.out.ns2.test$n | sort -u` 2657 [ "${NF}" = 7 ] || ret=1 2658 # make canonical 2659 awk '{ 2660 for (i=1;i<7;i++) printf("%s ", $i); 2661 for (i=7;i<=NF;i++) printf("%s", $i); 2662 printf("\n"); 2663 }' < dig.out.ns2.test$n > canonical1.$n || ret=1 2664 awk '{ 2665 for (i=1;i<7;i++) printf("%s ", $i); 2666 for (i=7;i<=NF;i++) printf("%s", $i); 2667 printf("\n"); 2668 }' < ns1/dsset-algroll$TP > canonical2.$n || ret=1 2669 diff -b canonical1.$n canonical2.$n > /dev/null 2>&1 || ret=1 2670 n=`expr $n + 1` 2671 if [ $ret != 0 ]; then echo_i "failed"; fi 2672 status=`expr $status + $ret` 2673 2674 # Intentionally strip ".key" from keyfile name to ensure the error message 2675 # includes it anyway to avoid confusion (RT #21731) 2676 echo_i "check dnssec-dsfromkey error message when keyfile is not found ($n)" 2677 ret=0 2678 key=`$KEYGEN -a RSASHA1 -q example.` || ret=1 2679 mv $key.key $key 2680 $DSFROMKEY $key > dsfromkey.out.$n 2>&1 && ret=1 2681 grep "$key.key: file not found" dsfromkey.out.$n > /dev/null || ret=1 2682 n=`expr $n + 1` 2683 if [ $ret != 0 ]; then echo_i "failed"; fi 2684 status=`expr $status + $ret` 2685 2686 echo_i "testing soon-to-expire RRSIGs without a replacement private key ($n)" 2687 ret=0 2688 $DIG $ANSWEROPTS +nottlid expiring.example ns @10.53.0.3 | grep RRSIG > dig.out.ns3.test$n 2>&1 2689 # there must be a signature here 2690 [ -s dig.out.ns3.test$n ] || ret=1 2691 n=`expr $n + 1` 2692 if [ $ret != 0 ]; then echo_i "failed"; fi 2693 status=`expr $status + $ret` 2694 2695 echo_i "testing new records are signed with 'no-resign' ($n)" 2696 ret=0 2697 ( 2698 echo zone nosign.example 2699 echo server 10.53.0.3 ${PORT} 2700 echo update add new.nosign.example 300 in txt "hi there" 2701 echo send 2702 ) | $NSUPDATE 2703 sleep 1 2704 $DIG $ANSWEROPTS +nottlid txt new.nosign.example @10.53.0.3 \ 2705 > dig.out.ns3.test$n 2>&1 2706 grep RRSIG dig.out.ns3.test$n > /dev/null 2>&1 || ret=1 2707 n=`expr $n + 1` 2708 if [ $ret != 0 ]; then echo_i "failed"; fi 2709 status=`expr $status + $ret` 2710 2711 echo_i "testing expiring records aren't resigned with 'no-resign' ($n)" 2712 ret=0 2713 $DIG $ANSWEROPTS +nottlid nosign.example ns @10.53.0.3 | \ 2714 grep RRSIG | sed 's/[ ][ ]*/ /g' > dig.out.ns3.test$n 2>&1 2715 # the NS RRSIG should not be changed 2716 cmp -s nosign.before dig.out.ns3.test$n || ret=1 2717 n=`expr $n + 1` 2718 if [ $ret != 0 ]; then echo_i "failed"; fi 2719 status=`expr $status + $ret` 2720 2721 echo_i "testing updates fail with no private key ($n)" 2722 ret=0 2723 rm -f ns3/Knosign.example.*.private 2724 ( 2725 echo zone nosign.example 2726 echo server 10.53.0.3 ${PORT} 2727 echo update add fail.nosign.example 300 in txt "reject me" 2728 echo send 2729 ) | $NSUPDATE > /dev/null 2>&1 && ret=1 2730 $DIG $ANSWEROPTS +nottlid fail.nosign.example txt @10.53.0.3 \ 2731 > dig.out.ns3.test$n 2>&1 2732 [ -s dig.out.ns3.test$n ] && ret=1 2733 n=`expr $n + 1` 2734 if [ $ret != 0 ]; then echo_i "failed"; fi 2735 status=`expr $status + $ret` 2736 2737 echo_i "testing legacy upper case signer name validation ($n)" 2738 ret=0 2739 $DIG +tcp +noadd +noauth +dnssec -p ${PORT} soa upper.example @10.53.0.4 \ 2740 > dig.out.ns4.test$n 2>&1 2741 grep 'flags:.* ad;' dig.out.ns4.test$n > /dev/null || ret=1 2742 grep 'RRSIG.*SOA.* UPPER\.EXAMPLE\. ' dig.out.ns4.test$n > /dev/null || ret=1 2743 n=`expr $n + 1` 2744 if [ $ret != 0 ]; then echo_i "failed"; fi 2745 status=`expr $status + $ret` 2746 2747 echo_i "testing that we lower case signer name ($n)" 2748 ret=0 2749 $DIG +tcp +noadd +noauth +dnssec -p ${PORT} soa LOWER.EXAMPLE @10.53.0.4 \ 2750 > dig.out.ns4.test$n 2>&1 2751 grep 'flags:.* ad;' dig.out.ns4.test$n > /dev/null || ret=1 2752 grep 'RRSIG.*SOA.* lower\.example\. ' dig.out.ns4.test$n > /dev/null || ret=1 2753 n=`expr $n + 1` 2754 if [ $ret != 0 ]; then echo_i "failed"; fi 2755 status=`expr $status + $ret` 2756 2757 echo_i "testing TTL is capped at RRSIG expiry time ($n)" 2758 ret=0 2759 $RNDCCMD 10.53.0.3 freeze expiring.example 2>&1 | sed 's/^/ns3 /' | cat_i 2760 ( 2761 cd ns3 2762 for file in K*.moved; do 2763 mv $file `basename $file .moved` 2764 done 2765 $SIGNER -S -N increment -e now+1mi -o expiring.example expiring.example.db > /dev/null 2>&1 2766 ) || ret=1 2767 $RNDCCMD 10.53.0.3 reload expiring.example 2>&1 | sed 's/^/ns3 /' | cat_i 2768 2769 $RNDCCMD 10.53.0.4 flush 2>&1 | sed 's/^/ns4 /' | cat_i 2770 $DIG $ANSWEROPTS +cd expiring.example soa @10.53.0.4 > dig.out.ns4.1.$n 2771 $DIG $ANSWEROPTS expiring.example soa @10.53.0.4 > dig.out.ns4.2.$n 2772 ttls=`awk '$1 != ";;" {print $2}' dig.out.ns4.1.$n` 2773 ttls2=`awk '$1 != ";;" {print $2}' dig.out.ns4.2.$n` 2774 for ttl in ${ttls:-0}; do 2775 [ ${ttl:-0} -eq 300 ] || ret=1 2776 done 2777 for ttl in ${ttls2:-0}; do 2778 [ ${ttl:-0} -le 60 ] || ret=1 2779 done 2780 n=`expr $n + 1` 2781 if [ $ret != 0 ]; then echo_i "failed"; fi 2782 status=`expr $status + $ret` 2783 2784 echo_i "testing TTL is capped at RRSIG expiry time for records in the additional section (NS) ($n)" 2785 ret=0 2786 $RNDCCMD 10.53.0.4 flush 2>&1 | sed 's/^/ns4 /' | cat_i 2787 sleep 1 2788 $DIG $ADDITIONALOPTS +cd expiring.example ns @10.53.0.4 > dig.out.ns4.1.$n 2789 $DIG $ADDITIONALOPTS expiring.example ns @10.53.0.4 > dig.out.ns4.2.$n 2790 ttls=`awk '$1 != ";;" {print $2}' dig.out.ns4.1.$n` 2791 ttls2=`awk '$1 != ";;" {print $2}' dig.out.ns4.2.$n` 2792 for ttl in ${ttls:-300}; do 2793 [ ${ttl:-0} -eq 300 ] || ret=1 2794 done 2795 for ttl in ${ttls2:-0}; do 2796 [ ${ttl:-0} -le 60 ] || ret=1 2797 done 2798 n=`expr $n + 1` 2799 if [ $ret != 0 ]; then echo_i "failed"; fi 2800 status=`expr $status + $ret` 2801 2802 echo_i "testing TTL is capped at RRSIG expiry time for records in the additional section (MX) ($n)" 2803 ret=0 2804 $RNDCCMD 10.53.0.4 flush 2>&1 | sed 's/^/ns4 /' | cat_i 2805 sleep 1 2806 $DIG $ADDITIONALOPTS +cd expiring.example mx @10.53.0.4 > dig.out.ns4.1.$n 2807 $DIG $ADDITIONALOPTS expiring.example mx @10.53.0.4 > dig.out.ns4.2.$n 2808 ttls=`awk '$1 != ";;" {print $2}' dig.out.ns4.1.$n` 2809 ttls2=`awk '$1 != ";;" {print $2}' dig.out.ns4.2.$n` 2810 for ttl in ${ttls:-300}; do 2811 [ ${ttl:-0} -eq 300 ] || ret=1 2812 done 2813 for ttl in ${ttls2:-0}; do 2814 [ ${ttl:-0} -le 60 ] || ret=1 2815 done 2816 n=`expr $n + 1` 2817 if [ $ret != 0 ]; then echo_i "failed"; fi 2818 status=`expr $status + $ret` 2819 2820 copy_setports ns4/named3.conf.in ns4/named.conf 2821 $RNDCCMD 10.53.0.4 reconfig 2>&1 | sed 's/^/ns4 /' | cat_i 2822 sleep 3 2823 2824 echo_i "testing TTL of about to expire RRsets with dnssec-accept-expired yes; ($n)" 2825 ret=0 2826 $RNDCCMD 10.53.0.4 flush 2>&1 | sed 's/^/ns4 /' | cat_i 2827 $DIG $ANSWEROPTS +cd expiring.example soa @10.53.0.4 > dig.out.ns4.1.$n 2828 $DIG $ANSWEROPTS expiring.example soa @10.53.0.4 > dig.out.ns4.2.$n 2829 ttls=`awk '$1 != ";;" {print $2}' dig.out.ns4.1.$n` 2830 ttls2=`awk '$1 != ";;" {print $2}' dig.out.ns4.2.$n` 2831 for ttl in ${ttls:-0}; do 2832 [ $ttl -eq 300 ] || ret=1 2833 done 2834 for ttl in ${ttls2:-0}; do 2835 [ $ttl -le 120 -a $ttl -gt 60 ] || ret=1 2836 done 2837 n=`expr $n + 1` 2838 if [ $ret != 0 ]; then echo_i "failed"; fi 2839 status=`expr $status + $ret` 2840 2841 echo_i "testing TTL of expired RRsets with dnssec-accept-expired yes; ($n)" 2842 ret=0 2843 $DIG $ANSWEROPTS +cd expired.example soa @10.53.0.4 > dig.out.ns4.1.$n 2844 $DIG $ANSWEROPTS expired.example soa @10.53.0.4 > dig.out.ns4.2.$n 2845 ttls=`awk '$1 != ";;" {print $2}' dig.out.ns4.1.$n` 2846 ttls2=`awk '$1 != ";;" {print $2}' dig.out.ns4.2.$n` 2847 for ttl in ${ttls:-0}; do 2848 [ $ttl -eq 300 ] || ret=1 2849 done 2850 for ttl in ${ttls2:-0}; do 2851 [ $ttl -le 120 -a $ttl -gt 60 ] || ret=1 2852 done 2853 n=`expr $n + 1` 2854 if [ $ret != 0 ]; then echo_i "failed"; fi 2855 status=`expr $status + $ret` 2856 2857 echo_i "testing TTL is capped at RRSIG expiry time for records in the additional section with dnssec-accept-expired yes; ($n)" 2858 ret=0 2859 $RNDCCMD 10.53.0.4 flush 2>&1 | sed 's/^/ns4 /' | cat_i 2860 $DIG $ANSWEROPTS +cd expiring.example mx @10.53.0.4 > dig.out.ns4.1.$n 2861 $DIG $ANSWEROPTS expiring.example mx @10.53.0.4 > dig.out.ns4.2.$n 2862 ttls=`awk '$1 != ";;" {print $2}' dig.out.ns4.1.$n` 2863 ttls2=`awk '$1 != ";;" {print $2}' dig.out.ns4.2.$n` 2864 for ttl in ${ttls:-300}; do 2865 [ $ttl -eq 300 ] || ret=1 2866 done 2867 for ttl in ${ttls2:-0}; do 2868 [ $ttl -le 120 -a $ttl -gt 60 ] || ret=1 2869 done 2870 n=`expr $n + 1` 2871 if [ $ret != 0 ]; then echo_i "failed"; fi 2872 status=`expr $status + $ret` 2873 2874 echo_i "testing DNSKEY lookup via CNAME ($n)" 2875 ret=0 2876 $DIG $DIGOPTS +noauth cnameandkey.secure.example. \ 2877 @10.53.0.3 dnskey > dig.out.ns3.test$n || ret=1 2878 $DIG $DIGOPTS +noauth cnameandkey.secure.example. \ 2879 @10.53.0.4 dnskey > dig.out.ns4.test$n || ret=1 2880 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 2881 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 2882 grep "CNAME" dig.out.ns4.test$n > /dev/null || ret=1 2883 n=`expr $n + 1` 2884 if [ $ret != 0 ]; then echo_i "failed"; fi 2885 status=`expr $status + $ret` 2886 2887 echo_i "testing KEY lookup at CNAME (present) ($n)" 2888 ret=0 2889 $DIG $DIGOPTS +noauth cnameandkey.secure.example. \ 2890 @10.53.0.3 key > dig.out.ns3.test$n || ret=1 2891 $DIG $DIGOPTS +noauth cnameandkey.secure.example. \ 2892 @10.53.0.4 key > dig.out.ns4.test$n || ret=1 2893 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 2894 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 2895 grep "CNAME" dig.out.ns4.test$n > /dev/null && ret=1 2896 n=`expr $n + 1` 2897 if [ $ret != 0 ]; then echo_i "failed"; fi 2898 status=`expr $status + $ret` 2899 2900 echo_i "testing KEY lookup at CNAME (not present) ($n)" 2901 ret=0 2902 $DIG $DIGOPTS +noauth cnamenokey.secure.example. \ 2903 @10.53.0.3 key > dig.out.ns3.test$n || ret=1 2904 $DIG $DIGOPTS +noauth cnamenokey.secure.example. \ 2905 @10.53.0.4 key > dig.out.ns4.test$n || ret=1 2906 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 2907 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 2908 grep "CNAME" dig.out.ns4.test$n > /dev/null && ret=1 2909 n=`expr $n + 1` 2910 if [ $ret != 0 ]; then echo_i "failed"; fi 2911 status=`expr $status + $ret` 2912 2913 echo_i "testing DNSKEY lookup via DNAME ($n)" 2914 ret=0 2915 $DIG $DIGOPTS a.dnameandkey.secure.example. \ 2916 @10.53.0.3 dnskey > dig.out.ns3.test$n || ret=1 2917 $DIG $DIGOPTS a.dnameandkey.secure.example. \ 2918 @10.53.0.4 dnskey > dig.out.ns4.test$n || ret=1 2919 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 2920 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 2921 grep "CNAME" dig.out.ns4.test$n > /dev/null || ret=1 2922 grep "DNAME" dig.out.ns4.test$n > /dev/null || ret=1 2923 n=`expr $n + 1` 2924 if [ $ret != 0 ]; then echo_i "failed"; fi 2925 status=`expr $status + $ret` 2926 2927 echo_i "testing KEY lookup via DNAME ($n)" 2928 ret=0 2929 $DIG $DIGOPTS b.dnameandkey.secure.example. \ 2930 @10.53.0.3 key > dig.out.ns3.test$n || ret=1 2931 $DIG $DIGOPTS b.dnameandkey.secure.example. \ 2932 @10.53.0.4 key > dig.out.ns4.test$n || ret=1 2933 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 2934 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 2935 grep "DNAME" dig.out.ns4.test$n > /dev/null || ret=1 2936 n=`expr $n + 1` 2937 if [ $ret != 0 ]; then echo_i "failed"; fi 2938 status=`expr $status + $ret` 2939 2940 echo_i "check that named doesn't loop when all private keys are not available ($n)" 2941 ret=0 2942 lines=`grep "reading private key file expiring.example" ns3/named.run | wc -l` 2943 test ${lines:-1000} -lt 15 || ret=1 2944 n=`expr $n + 1` 2945 if [ $ret != 0 ]; then echo_i "failed"; fi 2946 status=`expr $status + $ret` 2947 2948 echo_i "check against against missing nearest provable proof ($n)" 2949 $DIG $DIGOPTS +norec b.c.d.optout-tld. \ 2950 @10.53.0.6 ds > dig.out.ds.ns6.test$n || ret=1 2951 nsec3=`grep "IN.NSEC3" dig.out.ds.ns6.test$n | wc -l` 2952 [ $nsec3 -eq 2 ] || ret=1 2953 $DIG $DIGOPTS +norec b.c.d.optout-tld. \ 2954 @10.53.0.6 A > dig.out.ns6.test$n || ret=1 2955 nsec3=`grep "IN.NSEC3" dig.out.ns6.test$n | wc -l` 2956 [ $nsec3 -eq 1 ] || ret=1 2957 $DIG $DIGOPTS optout-tld. \ 2958 @10.53.0.4 SOA > dig.out.soa.ns4.test$n || ret=1 2959 grep "flags:.*ad.*QUERY" dig.out.soa.ns4.test$n > /dev/null || ret=1 2960 $DIG $DIGOPTS b.c.d.optout-tld. \ 2961 @10.53.0.4 A > dig.out.ns4.test$n || ret=1 2962 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 2963 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 2964 n=`expr $n + 1` 2965 if [ $ret != 0 ]; then echo_i "failed"; fi 2966 status=`expr $status + $ret` 2967 2968 echo_i "check that key id are logged when dumping the cache ($n)" 2969 ret=0 2970 $RNDCCMD 10.53.0.4 dumpdb 2>&1 | sed 's/^/ns4 /' | cat_i 2971 sleep 1 2972 grep "; key id = " ns4/named_dump.db > /dev/null || ret=1 2973 n=`expr $n + 1` 2974 if [ $ret != 0 ]; then echo_i "failed"; fi 2975 status=`expr $status + $ret` 2976 2977 echo_i "check KEYDATA records are printed in human readable form in key zone ($n)" 2978 # force the managed-keys zone to be written out 2979 $RNDCCMD 10.53.0.4 managed-keys sync 2>&1 | sed 's/^/ns4 /' | cat_i 2980 for i in 1 2 3 4 5 6 7 8 9 2981 do 2982 ret=0 2983 if test -f ns4/managed-keys.bind 2984 then 2985 grep KEYDATA ns4/managed-keys.bind > /dev/null && 2986 grep "next refresh:" ns4/managed-keys.bind > /dev/null && 2987 break 2988 fi 2989 ret=1 2990 sleep 1 2991 done 2992 n=`expr $n + 1` 2993 if [ $ret != 0 ]; then echo_i "failed"; fi 2994 status=`expr $status + $ret` 2995 2996 echo_i "check dig's +nocrypto flag ($n)" 2997 ret=0 2998 $DIG $DIGOPTS +norec +nocrypto DNSKEY . \ 2999 @10.53.0.1 > dig.out.dnskey.ns1.test$n || ret=1 3000 grep -E '256 [0-9]+ 1 \[key id = [1-9][0-9]*]' dig.out.dnskey.ns1.test$n > /dev/null || ret=1 3001 grep -E 'RRSIG.* \[omitted]' dig.out.dnskey.ns1.test$n > /dev/null || ret=1 3002 $DIG $DIGOPTS +norec +nocrypto DS example \ 3003 @10.53.0.1 > dig.out.ds.ns1.test$n || ret=1 3004 grep -E 'DS.* [0-9]+ [12] \[omitted]' dig.out.ds.ns1.test$n > /dev/null || ret=1 3005 n=`expr $n + 1` 3006 if [ $ret != 0 ]; then echo_i "failed"; fi 3007 status=`expr $status + $ret` 3008 3009 echo_i "check simultaneous inactivation and publishing of dnskeys removes inactive signature ($n)" 3010 ret=0 3011 cnt=0 3012 while : 3013 do 3014 $DIG $DIGOPTS publish-inactive.example @10.53.0.3 dnskey > dig.out.ns3.test$n 3015 keys=`awk '$5 == 257 { print; }' dig.out.ns3.test$n | wc -l` 3016 test $keys -gt 2 && break 3017 cnt=`expr $cnt + 1` 3018 test $cnt -gt 120 && break 3019 sleep 1 3020 done 3021 test $keys -gt 2 || ret=1 3022 sigs=`grep RRSIG dig.out.ns3.test$n | wc -l` 3023 sigs=`expr $sigs + 0` 3024 n=`expr $n + 1` 3025 test $sigs -eq 2 || ret=1 3026 if test $ret != 0 ; then echo_i "failed"; fi 3027 status=`expr $status + $ret` 3028 3029 echo_i "check that increasing the sig-validity-interval resigning triggers re-signing ($n)" 3030 ret=0 3031 before=`$DIG axfr siginterval.example -p ${PORT} @10.53.0.3 | grep RRSIG.SOA` 3032 cp ns3/siginterval2.conf ns3/siginterval.conf 3033 $RNDCCMD 10.53.0.3 reconfig 2>&1 | sed 's/^/ns3 /' | cat_i 3034 for i in 1 2 3 4 5 6 7 8 9 0 3035 do 3036 after=`$DIG axfr siginterval.example -p ${PORT} @10.53.0.3 | grep RRSIG.SOA` 3037 test "$before" != "$after" && break 3038 sleep 1 3039 done 3040 n=`expr $n + 1` 3041 if test "$before" = "$after" ; then echo_i "failed"; ret=1; fi 3042 status=`expr $status + $ret` 3043 3044 if [ -x "$PYTHON" ]; then 3045 echo_i "check dnskey-sig-validity sets longer expiry for DNSKEY ($n)" 3046 ret=0 3047 $RNDCCMD 10.53.0.3 sign siginterval.example 2>&1 | sed 's/^/ns3 /' | cat_i 3048 # convert expiry date to a comma-separated list of integers python can 3049 # use as input to date(). strip leading 0s in months and days so 3050 # python3 will recognize them as integers. 3051 $DIG +dnssec +short -p ${PORT} @10.53.0.3 soa siginterval.example > dig.out.soa.test$n 3052 soaexpire=`awk '$1 ~ /SOA/ { print $5 }' dig.out.soa.test$n | 3053 sed 's/\(....\)\(..\)\(..\).*/\1, \2, \3/' | 3054 sed 's/ 0/ /g'` 3055 $DIG +dnssec +short -p ${PORT} @10.53.0.3 dnskey siginterval.example > dig.out.dnskey.test$n 3056 dnskeyexpire=`awk '$1 ~ /DNSKEY/ { print $5; exit 0 }' dig.out.dnskey.test$n | 3057 sed 's/\(....\)\(..\)\(..\).*/\1, \2, \3/' | 3058 sed 's/ 0/ /g'` 3059 $PYTHON > python.out.$n <<EOF 3060 from datetime import date; 3061 ke=date($dnskeyexpire) 3062 se=date($soaexpire) 3063 print((ke-se).days); 3064 EOF 3065 diff=`cat python.out.$n` 3066 [ "$diff" -ge 55 ] || ret=1 3067 n=`expr $n + 1` 3068 if [ $ret != 0 ]; then echo_i "failed"; fi 3069 status=`expr $status + $ret` 3070 fi 3071 3072 copy_setports ns4/named4.conf.in ns4/named.conf 3073 $RNDCCMD 10.53.0.4 reconfig 2>&1 | sed 's/^/ns4 /' | cat_i 3074 sleep 3 3075 3076 echo_i "check insecure delegation between static-stub zones ($n)" 3077 ret=0 3078 $DIG $DIGOPTS ns insecure.secure.example \ 3079 @10.53.0.4 > dig.out.ns4.1.test$n || ret=1 3080 grep "SERVFAIL" dig.out.ns4.1.test$n > /dev/null && ret=1 3081 $DIG $DIGOPTS ns secure.example \ 3082 @10.53.0.4 > dig.out.ns4.2.test$n || ret=1 3083 grep "SERVFAIL" dig.out.ns4.2.test$n > /dev/null && ret=1 3084 n=`expr $n + 1` 3085 if [ $ret != 0 ]; then echo_i "failed"; fi 3086 status=`expr $status + $ret` 3087 3088 echo_i "check the acceptance of seconds as inception and expiration times ($n)" 3089 ret=0 3090 in="NSEC 8 0 86400 1390003200 1389394800 33655 . NYWjZYBV1b+h4j0yu/SmPOOylR8P4IXKDzHX3NwEmU1SUp27aJ91dP+i+UBcnPmBib0hck4DrFVvpflCEpCnVQd2DexcN0GX+3PM7XobxhtDlmnU X1L47zJlbdHNwTqHuPaMM6Xy9HGMXps7O5JVyfggVhTz2C+G5OVxBdb2rOo=" 3091 3092 exp="NSEC 8 0 86400 20140118000000 20140110230000 33655 . NYWjZYBV1b+h4j0yu/SmPOOylR8P4IXKDzHX3NwEmU1SUp27aJ91dP+i +UBcnPmBib0hck4DrFVvpflCEpCnVQd2DexcN0GX+3PM7XobxhtDlmnU X1L47zJlbdHNwTqHuPaMM6Xy9HGMXps7O5JVyfggVhTz2C+G5OVxBdb2 rOo=" 3093 3094 out=`echo "IN RRSIG $in" | $RRCHECKER -p | sed 's/^IN.RRSIG.//'` 3095 [ "$out" = "$exp" ] || ret=1 3096 n=`expr $n + 1` 3097 if [ $ret != 0 ]; then echo_i "failed"; fi 3098 status=`expr $status + $ret` 3099 3100 echo_i "check the correct resigning time is reported in zonestatus ($n)" 3101 ret=0 3102 $RNDCCMD 10.53.0.3 \ 3103 zonestatus secure.example > rndc.out.ns3.test$n 3104 # next resign node: secure.example/DNSKEY 3105 name=`awk '/next resign node:/ { print $4 }' rndc.out.ns3.test$n | sed 's;/; ;'` 3106 # next resign time: Thu, 24 Apr 2014 10:38:16 GMT 3107 time=`awk 'BEGIN { m["Jan"] = "01"; m["Feb"] = "02"; m["Mar"] = "03"; 3108 m["Apr"] = "04"; m["May"] = "05"; m["Jun"] = "06"; 3109 m["Jul"] = "07"; m["Aug"] = "08"; m["Sep"] = "09"; 3110 m["Oct"] = "10"; m["Nov"] = "11"; m["Dec"] = "12";} 3111 /next resign time:/ { printf "%d%s%02d%s\n", $7, m[$6], $5, $8 }' rndc.out.ns3.test$n | sed 's/://g'` 3112 $DIG $DIGOPTS +noall +answer $name @10.53.0.3 > dig.out.test$n 3113 expire=`awk '$4 == "RRSIG" { print $9 }' dig.out.test$n` 3114 inception=`awk '$4 == "RRSIG" { print $10 }' dig.out.test$n` 3115 $PERL -e 'exit(0) if ("'"$time"'" lt "'"$expire"'" && "'"$time"'" gt "'"$inception"'"); exit(1);' || ret=1 3116 n=`expr $n + 1` 3117 if [ $ret != 0 ]; then echo_i "failed"; fi 3118 status=`expr $status + $ret` 3119 3120 echo_i "check that split rrsigs are handled ($n)" 3121 ret=0 3122 $DIG $DIGOPTS split-rrsig soa @10.53.0.7 > dig.out.test$n || ret=1 3123 awk 'BEGIN { ok=0; } $4 == "SOA" { if ($7 > 1) ok=1; } END { if (!ok) exit(1); }' dig.out.test$n || ret=1 3124 n=`expr $n + 1` 3125 if [ $ret != 0 ]; then echo_i "failed"; fi 3126 status=`expr $status + $ret` 3127 3128 echo_i "check that 'dnssec-keygen -S' works for all supported algorithms ($n)" 3129 ret=0 3130 alg=1 3131 until test $alg = 256 3132 do 3133 size= 3134 case $alg in 3135 1) # RSA/MD5 3136 size="-b 1024";; 3137 2) # Diffie Helman 3138 alg=`expr $alg + 1` 3139 continue;; 3140 5) # RSA/SHA-1 3141 size="-b 1024";; 3142 7) # RSASHA1-NSEC3-SHA1 3143 size="-b 1024";; 3144 8) # RSA/SHA-256 3145 size="-b 1024";; 3146 10) # RSA/SHA-512 3147 size="-b 1024";; 3148 157|160|161|162|163|164|165) # private - non standard 3149 alg=`expr $alg + 1` 3150 continue;; 3151 esac 3152 key1=`$KEYGEN -a $alg $size -n zone example 2> keygen.err` 3153 if grep "unsupported algorithm" keygen.err > /dev/null 3154 then 3155 alg=`expr $alg + 1` 3156 continue 3157 fi 3158 if test -z "$key1" 3159 then 3160 echo_i "'$KEYGEN -a $alg': failed" 3161 cat keygen.err 3162 ret=1 3163 alg=`expr $alg + 1` 3164 continue 3165 fi 3166 $SETTIME -I now+4d $key1.private > /dev/null 3167 key2=`$KEYGEN -v 10 -i 3d -S $key1.private 2> /dev/null` 3168 test -f $key2.key -a -f $key2.private || { 3169 ret=1 3170 echo_i "'dnssec-keygen -S' failed for algorithm: $alg" 3171 } 3172 alg=`expr $alg + 1` 3173 done 3174 n=`expr $n + 1` 3175 if [ $ret != 0 ]; then echo_i "failed"; fi 3176 status=`expr $status + $ret` 3177 3178 echo_i "check that CDS records are signed using KSK by dnssec-signzone ($n)" 3179 ret=0 3180 $DIG $DIGOPTS +noall +answer @10.53.0.2 cds cds.secure > dig.out.test$n 3181 lines=`awk '$4 == "RRSIG" && $5 == "CDS" {print}' dig.out.test$n | wc -l` 3182 test ${lines:-0} -eq 2 || ret=1 3183 n=`expr $n + 1` 3184 if [ $ret != 0 ]; then echo_i "failed"; fi 3185 status=`expr $status + $ret` 3186 3187 echo_i "check that CDS records are not signed using ZSK by dnssec-signzone -x ($n)" 3188 ret=0 3189 $DIG $DIGOPTS +noall +answer @10.53.0.2 cds cds-x.secure > dig.out.test$n 3190 lines=`awk '$4 == "RRSIG" && $5 == "CDS" {print}' dig.out.test$n | wc -l` 3191 test ${lines:-0} -eq 1 || ret=1 3192 n=`expr $n + 1` 3193 if [ $ret != 0 ]; then echo_i "failed"; fi 3194 status=`expr $status + $ret` 3195 3196 echo_i "checking that positive unknown NSEC3 hash algorithm does validate ($n)" 3197 ret=0 3198 $DIG $DIGOPTS +noauth +noadd +nodnssec +adflag @10.53.0.3 nsec3-unknown.example SOA > dig.out.ns3.test$n 3199 $DIG $DIGOPTS +noauth +noadd +nodnssec +adflag @10.53.0.4 nsec3-unknown.example SOA > dig.out.ns4.test$n 3200 grep "status: NOERROR," dig.out.ns3.test$n > /dev/null || ret=1 3201 grep "status: NOERROR," dig.out.ns4.test$n > /dev/null || ret=1 3202 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 3203 grep "ANSWER: 1," dig.out.ns4.test$n > /dev/null || ret=1 3204 n=`expr $n + 1` 3205 if [ $ret != 0 ]; then echo_i "failed"; fi 3206 status=`expr $status + $ret` 3207 3208 echo_i "check that CDS records are signed using KSK by with dnssec-auto ($n)" 3209 ret=0 3210 $DIG $DIGOPTS +noall +answer @10.53.0.2 cds cds-auto.secure > dig.out.test$n 3211 lines=`awk '$4 == "RRSIG" && $5 == "CDS" {print}' dig.out.test$n | wc -l` 3212 test ${lines:-0} -eq 2 || ret=1 3213 n=`expr $n + 1` 3214 if [ $ret != 0 ]; then echo_i "failed"; fi 3215 status=`expr $status + $ret` 3216 3217 echo_i "check that a lone non matching CDS record is rejected ($n)" 3218 ret=0 3219 ( 3220 echo zone cds-update.secure 3221 echo server 10.53.0.2 ${PORT} 3222 echo update delete cds-update.secure CDS 3223 $DIG $DIGOPTS +noall +answer @10.53.0.2 dnskey cds-update.secure | 3224 grep "DNSKEY.257" | sed 's/DNSKEY.257/DNSKEY 258/' | 3225 $DSFROMKEY -C -A -f - -T 1 cds-update.secure | 3226 sed "s/^/update add /" 3227 echo send 3228 ) | $NSUPDATE > nsupdate.out.test$n 2>&1 3229 grep "update failed: REFUSED" nsupdate.out.test$n > /dev/null || ret=1 3230 $DIG $DIGOPTS +noall +answer @10.53.0.2 cds cds-update.secure > dig.out.test$n 3231 lines=`awk '$4 == "CDS" {print}' dig.out.test$n | wc -l` 3232 test ${lines:-10} -eq 0 || ret=1 3233 n=`expr $n + 1` 3234 if [ $ret != 0 ]; then echo_i "failed"; fi 3235 status=`expr $status + $ret` 3236 3237 echo_i "check that CDS records are signed using KSK when added by nsupdate ($n)" 3238 ret=0 3239 ( 3240 echo zone cds-update.secure 3241 echo server 10.53.0.2 ${PORT} 3242 echo update delete cds-update.secure CDS 3243 echo send 3244 $DIG $DIGOPTS +noall +answer @10.53.0.2 dnskey cds-update.secure | 3245 grep "DNSKEY.257" | 3246 $DSFROMKEY -C -f - -T 1 cds-update.secure | 3247 sed "s/^/update add /" 3248 echo send 3249 ) | $NSUPDATE 3250 $DIG $DIGOPTS +noall +answer @10.53.0.2 cds cds-update.secure > dig.out.test$n 3251 lines=`awk '$4 == "RRSIG" && $5 == "CDS" {print}' dig.out.test$n | wc -l` 3252 test ${lines:-0} -eq 2 || ret=1 3253 lines=`awk '$4 == "CDS" {print}' dig.out.test$n | wc -l` 3254 test ${lines:-0} -eq 2 || ret=1 3255 n=`expr $n + 1` 3256 if [ $ret != 0 ]; then echo_i "failed"; fi 3257 status=`expr $status + $ret` 3258 3259 echo_i "check that CDS records are signed only using KSK when added by" 3260 echo_i " nsupdate when dnssec-dnskey-kskonly is yes ($n)" 3261 ret=0 3262 ( 3263 echo zone cds-kskonly.secure 3264 echo server 10.53.0.2 ${PORT} 3265 echo update delete cds-kskonly.secure CDS 3266 echo send 3267 $DIG $DIGOPTS +noall +answer @10.53.0.2 dnskey cds-kskonly.secure | 3268 grep "DNSKEY.257" | 3269 $DSFROMKEY -C -f - -T 1 cds-kskonly.secure | 3270 sed "s/^/update add /" 3271 echo send 3272 ) | $NSUPDATE 3273 $DIG $DIGOPTS +noall +answer @10.53.0.2 cds cds-kskonly.secure > dig.out.test$n 3274 lines=`awk '$4 == "RRSIG" && $5 == "CDS" {print}' dig.out.test$n | wc -l` 3275 test ${lines:-0} -eq 1 || ret=1 3276 lines=`awk '$4 == "CDS" {print}' dig.out.test$n | wc -l` 3277 test ${lines:-0} -eq 2 || ret=1 3278 n=`expr $n + 1` 3279 if [ $ret != 0 ]; then echo_i "failed"; fi 3280 status=`expr $status + $ret` 3281 3282 echo_i "checking that positive unknown NSEC3 hash algorithm with OPTOUT does validate ($n)" 3283 ret=0 3284 $DIG $DIGOPTS +noauth +noadd +nodnssec +adflag @10.53.0.3 optout-unknown.example SOA > dig.out.ns3.test$n 3285 $DIG $DIGOPTS +noauth +noadd +nodnssec +adflag @10.53.0.4 optout-unknown.example SOA > dig.out.ns4.test$n 3286 grep "status: NOERROR," dig.out.ns3.test$n > /dev/null || ret=1 3287 grep "status: NOERROR," dig.out.ns4.test$n > /dev/null || ret=1 3288 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 3289 grep "ANSWER: 1," dig.out.ns4.test$n > /dev/null || ret=1 3290 n=`expr $n + 1` 3291 if [ $ret != 0 ]; then echo_i "failed"; fi 3292 status=`expr $status + $ret` 3293 3294 echo_i "check that a non matching CDS record is accepted with a matching CDS record ($n)" 3295 ret=0 3296 ( 3297 echo zone cds-update.secure 3298 echo server 10.53.0.2 ${PORT} 3299 echo update delete cds-update.secure CDS 3300 echo send 3301 $DIG $DIGOPTS +noall +answer @10.53.0.2 dnskey cds-update.secure | 3302 grep "DNSKEY.257" | 3303 $DSFROMKEY -C -f - -T 1 cds-update.secure | 3304 sed "s/^/update add /" 3305 $DIG $DIGOPTS +noall +answer @10.53.0.2 dnskey cds-update.secure | 3306 grep "DNSKEY.257" | sed 's/DNSKEY.257/DNSKEY 258/' | 3307 $DSFROMKEY -C -A -f - -T 1 cds-update.secure | 3308 sed "s/^/update add /" 3309 echo send 3310 ) | $NSUPDATE 3311 $DIG $DIGOPTS +noall +answer @10.53.0.2 cds cds-update.secure > dig.out.test$n 3312 lines=`awk '$4 == "RRSIG" && $5 == "CDS" {print}' dig.out.test$n | wc -l` 3313 test ${lines:-0} -eq 2 || ret=1 3314 lines=`awk '$4 == "CDS" {print}' dig.out.test$n | wc -l` 3315 test ${lines:-0} -eq 4 || ret=1 3316 n=`expr $n + 1` 3317 if [ $ret != 0 ]; then echo_i "failed"; fi 3318 status=`expr $status + $ret` 3319 3320 echo_i "checking that negative unknown NSEC3 hash algorithm does not validate ($n)" 3321 ret=0 3322 $DIG $DIGOPTS +noauth +noadd +nodnssec +adflag @10.53.0.3 nsec3-unknown.example A > dig.out.ns3.test$n 3323 $DIG $DIGOPTS +noauth +noadd +nodnssec +adflag @10.53.0.4 nsec3-unknown.example A > dig.out.ns4.test$n 3324 grep "status: NOERROR," dig.out.ns3.test$n > /dev/null || ret=1 3325 grep "status: SERVFAIL," dig.out.ns4.test$n > /dev/null || ret=1 3326 n=`expr $n + 1` 3327 if [ $ret != 0 ]; then echo_i "failed"; fi 3328 status=`expr $status + $ret` 3329 3330 echo_i "check that CDNSKEY records are signed using KSK by dnssec-signzone ($n)" 3331 ret=0 3332 $DIG $DIGOPTS +noall +answer @10.53.0.2 cdnskey cdnskey.secure > dig.out.test$n 3333 lines=`awk '$4 == "RRSIG" && $5 == "CDNSKEY" {print}' dig.out.test$n | wc -l` 3334 test ${lines:-0} -eq 2 || ret=1 3335 n=`expr $n + 1` 3336 if [ $ret != 0 ]; then echo_i "failed"; fi 3337 status=`expr $status + $ret` 3338 3339 echo_i "check that CDNSKEY records are not signed using ZSK by dnssec-signzone -x ($n)" 3340 ret=0 3341 $DIG $DIGOPTS +noall +answer @10.53.0.2 cdnskey cdnskey-x.secure > dig.out.test$n 3342 lines=`awk '$4 == "RRSIG" && $5 == "CDNSKEY" {print}' dig.out.test$n | wc -l` 3343 test ${lines:-0} -eq 1 || ret=1 3344 n=`expr $n + 1` 3345 if [ $ret != 0 ]; then echo_i "failed"; fi 3346 status=`expr $status + $ret` 3347 3348 echo_i "checking that negative unknown NSEC3 hash algorithm with OPTOUT does not validate ($n)" 3349 ret=0 3350 $DIG $DIGOPTS +noauth +noadd +nodnssec +adflag @10.53.0.3 optout-unknown.example A > dig.out.ns3.test$n 3351 $DIG $DIGOPTS +noauth +noadd +nodnssec +adflag @10.53.0.4 optout-unknown.example A > dig.out.ns4.test$n 3352 grep "status: NOERROR," dig.out.ns3.test$n > /dev/null || ret=1 3353 grep "status: SERVFAIL," dig.out.ns4.test$n > /dev/null || ret=1 3354 n=`expr $n + 1` 3355 if [ $ret != 0 ]; then echo_i "failed"; fi 3356 status=`expr $status + $ret` 3357 3358 echo_i "check that CDNSKEY records are signed using KSK by with dnssec-auto ($n)" 3359 ret=0 3360 $DIG $DIGOPTS +noall +answer @10.53.0.2 cdnskey cdnskey-auto.secure > dig.out.test$n 3361 lines=`awk '$4 == "RRSIG" && $5 == "CDNSKEY" {print}' dig.out.test$n | wc -l` 3362 test ${lines:-0} -eq 2 || ret=1 3363 n=`expr $n + 1` 3364 if [ $ret != 0 ]; then echo_i "failed"; fi 3365 status=`expr $status + $ret` 3366 3367 echo_i "checking that unknown DNSKEY algorithm validates as insecure ($n)" 3368 ret=0 3369 $DIG $DIGOPTS +noauth +noadd +nodnssec +adflag @10.53.0.3 dnskey-unknown.example A > dig.out.ns3.test$n 3370 $DIG $DIGOPTS +noauth +noadd +nodnssec +adflag @10.53.0.4 dnskey-unknown.example A > dig.out.ns4.test$n 3371 grep "status: NOERROR," dig.out.ns3.test$n > /dev/null || ret=1 3372 grep "status: NOERROR," dig.out.ns4.test$n > /dev/null || ret=1 3373 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 3374 n=`expr $n + 1` 3375 if [ $ret != 0 ]; then echo_i "failed"; fi 3376 status=`expr $status + $ret` 3377 3378 echo_i "check that a lone non matching CDNSKEY record is rejected ($n)" 3379 ret=0 3380 ( 3381 echo zone cdnskey-update.secure 3382 echo server 10.53.0.2 ${PORT} 3383 echo update delete cdnskey-update.secure CDNSKEY 3384 echo send 3385 $DIG $DIGOPTS +noall +answer @10.53.0.2 dnskey cdnskey-update.secure | 3386 sed -n -e "s/^/update add /" -e 's/DNSKEY.257/CDNSKEY 258/p' 3387 echo send 3388 ) | $NSUPDATE > nsupdate.out.test$n 2>&1 3389 grep "update failed: REFUSED" nsupdate.out.test$n > /dev/null || ret=1 3390 $DIG $DIGOPTS +noall +answer @10.53.0.2 cdnskey cdnskey-update.secure > dig.out.test$n 3391 lines=`awk '$4 == "CDNSKEY" {print}' dig.out.test$n | wc -l` 3392 test ${lines:-10} -eq 0 || ret=1 3393 n=`expr $n + 1` 3394 if [ $ret != 0 ]; then echo_i "failed"; fi 3395 status=`expr $status + $ret` 3396 3397 echo_i "checking that unknown DNSKEY algorithm + unknown NSEC3 has algorithm validates as insecure ($n)" 3398 ret=0 3399 $DIG $DIGOPTS +noauth +noadd +nodnssec +adflag @10.53.0.3 dnskey-nsec3-unknown.example A > dig.out.ns3.test$n 3400 $DIG $DIGOPTS +noauth +noadd +nodnssec +adflag @10.53.0.4 dnskey-nsec3-unknown.example A > dig.out.ns4.test$n 3401 grep "status: NOERROR," dig.out.ns3.test$n > /dev/null || ret=1 3402 grep "status: NOERROR," dig.out.ns4.test$n > /dev/null || ret=1 3403 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 3404 n=`expr $n + 1` 3405 if [ $ret != 0 ]; then echo_i "failed"; fi 3406 status=`expr $status + $ret` 3407 3408 echo_i "check that CDNSKEY records are signed using KSK when added by nsupdate ($n)" 3409 ret=0 3410 ( 3411 echo zone cdnskey-update.secure 3412 echo server 10.53.0.2 ${PORT} 3413 echo update delete cdnskey-update.secure CDNSKEY 3414 $DIG $DIGOPTS +noall +answer @10.53.0.2 dnskey cdnskey-update.secure | 3415 sed -n -e "s/^/update add /" -e 's/DNSKEY.257/CDNSKEY 257/p' 3416 echo send 3417 ) | $NSUPDATE 3418 $DIG $DIGOPTS +noall +answer @10.53.0.2 cdnskey cdnskey-update.secure > dig.out.test$n 3419 lines=`awk '$4 == "RRSIG" && $5 == "CDNSKEY" {print}' dig.out.test$n | wc -l` 3420 test ${lines:-0} -eq 2 || ret=1 3421 lines=`awk '$4 == "CDNSKEY" {print}' dig.out.test$n | wc -l` 3422 test ${lines:-0} -eq 1 || ret=1 3423 n=`expr $n + 1` 3424 if [ $ret != 0 ]; then echo_i "failed"; fi 3425 status=`expr $status + $ret` 3426 3427 echo_i "check that CDNSKEY records are signed only using KSK when added by" 3428 echo_i " nsupdate when dnssec-dnskey-kskonly is yes ($n)" 3429 ret=0 3430 ( 3431 echo zone cdnskey-kskonly.secure 3432 echo server 10.53.0.2 ${PORT} 3433 echo update delete cdnskey-kskonly.secure CDNSKEY 3434 $DIG $DIGOPTS +noall +answer @10.53.0.2 dnskey cdnskey-kskonly.secure | 3435 sed -n -e "s/^/update add /" -e 's/DNSKEY.257/CDNSKEY 257/p' 3436 echo send 3437 ) | $NSUPDATE 3438 $DIG $DIGOPTS +noall +answer @10.53.0.2 cdnskey cdnskey-kskonly.secure > dig.out.test$n 3439 lines=`awk '$4 == "RRSIG" && $5 == "CDNSKEY" {print}' dig.out.test$n | wc -l` 3440 test ${lines:-0} -eq 1 || ret=1 3441 lines=`awk '$4 == "CDNSKEY" {print}' dig.out.test$n | wc -l` 3442 test ${lines:-0} -eq 1 || ret=1 3443 n=`expr $n + 1` 3444 if [ $ret != 0 ]; then echo_i "failed"; fi 3445 status=`expr $status + $ret` 3446 3447 echo_i "checking initialization with a revoked managed key ($n)" 3448 ret=0 3449 copy_setports ns5/named2.conf.in ns5/named.conf 3450 $RNDCCMD 10.53.0.5 reconfig 2>&1 | sed 's/^/ns5 /' | cat_i 3451 sleep 3 3452 $DIG $DIGOPTS +dnssec @10.53.0.5 SOA . > dig.out.ns5.test$n 3453 grep "status: SERVFAIL" dig.out.ns5.test$n > /dev/null || ret=1 3454 n=`expr $n + 1` 3455 if [ $ret != 0 ]; then echo_i "failed"; fi 3456 status=`expr $status + $ret` 3457 3458 echo_i "check that a non matching CDNSKEY record is accepted with a matching CDNSKEY record ($n)" 3459 ret=0 3460 ( 3461 echo zone cdnskey-update.secure 3462 echo server 10.53.0.2 ${PORT} 3463 echo update delete cdnskey-update.secure CDNSKEY 3464 $DIG $DIGOPTS +noall +answer @10.53.0.2 dnskey cdnskey-update.secure | 3465 sed -n -e "s/^/update add /" -e 's/DNSKEY.257/CDNSKEY 257/p' 3466 $DIG $DIGOPTS +noall +answer @10.53.0.2 dnskey cdnskey-update.secure | 3467 sed -n -e "s/^/update add /" -e 's/DNSKEY.257/CDNSKEY 258/p' 3468 echo send 3469 ) | $NSUPDATE 3470 $DIG $DIGOPTS +noall +answer @10.53.0.2 cdnskey cdnskey-update.secure > dig.out.test$n 3471 lines=`awk '$4 == "RRSIG" && $5 == "CDNSKEY" {print}' dig.out.test$n | wc -l` 3472 test ${lines:-0} -eq 2 || ret=1 3473 lines=`awk '$4 == "CDNSKEY" {print}' dig.out.test$n | wc -l` 3474 test ${lines:-0} -eq 2 || ret=1 3475 n=`expr $n + 1` 3476 if [ $ret != 0 ]; then echo_i "failed"; fi 3477 status=`expr $status + $ret` 3478 3479 echo_i "check that RRSIGs are correctly removed from apex when RRset is removed NSEC ($n)" 3480 ret=0 3481 # generate signed zone with MX and AAAA records at apex. 3482 ( 3483 cd signer 3484 $KEYGEN -q -a RSASHA1 -3 -fK remove > /dev/null 3485 $KEYGEN -q -a RSASHA1 -33 remove > /dev/null 3486 echo > remove.db.signed 3487 $SIGNER -S -o remove -D -f remove.db.signed remove.db.in > signer.out.1.$n 2>&1 3488 ) 3489 grep "RRSIG MX" signer/remove.db.signed > /dev/null || { 3490 ret=1 ; cp signer/remove.db.signed signer/remove.db.signed.pre$n; 3491 } 3492 # re-generate signed zone without MX and AAAA records at apex. 3493 ( 3494 cd signer 3495 $SIGNER -S -o remove -D -f remove.db.signed remove2.db.in > signer.out.2.$n 2>&1 3496 ) 3497 grep "RRSIG MX" signer/remove.db.signed > /dev/null && { 3498 ret=1 ; cp signer/remove.db.signed signer/remove.db.signed.post$n; 3499 } 3500 n=`expr $n + 1` 3501 if [ $ret != 0 ]; then echo_i "failed"; fi 3502 status=`expr $status + $ret` 3503 3504 echo_i "check that RRSIGs are correctly removed from apex when RRset is removed NSEC3 ($n)" 3505 ret=0 3506 # generate signed zone with MX and AAAA records at apex. 3507 ( 3508 cd signer 3509 echo > remove.db.signed 3510 $SIGNER -3 - -S -o remove -D -f remove.db.signed remove.db.in > signer.out.1.$n 2>&1 3511 ) 3512 grep "RRSIG MX" signer/remove.db.signed > /dev/null || { 3513 ret=1 ; cp signer/remove.db.signed signer/remove.db.signed.pre$n; 3514 } 3515 # re-generate signed zone without MX and AAAA records at apex. 3516 ( 3517 cd signer 3518 $SIGNER -3 - -S -o remove -D -f remove.db.signed remove2.db.in > signer.out.2.$n 2>&1 3519 ) 3520 grep "RRSIG MX" signer/remove.db.signed > /dev/null && { 3521 ret=1 ; cp signer/remove.db.signed signer/remove.db.signed.post$n; 3522 } 3523 n=`expr $n + 1` 3524 if [ $ret != 0 ]; then echo_i "failed"; fi 3525 status=`expr $status + $ret` 3526 3527 echo_i "check that a named managed zone that was signed 'in-the-future' is re-signed when loaded ($n)" 3528 ret=0 3529 $DIG $DIGOPTS managed-future.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1 3530 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 3531 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 3532 n=`expr $n + 1` 3533 if [ $ret != 0 ]; then echo_i "failed"; fi 3534 status=`expr $status + $ret` 3535 3536 echo_i "check that trust-anchor-telemetry queries are logged ($n)" 3537 ret=0 3538 grep "sending trust-anchor-telemetry query '_ta-[0-9a-f]*/NULL" ns6/named.run > /dev/null || ret=1 3539 n=`expr $n + 1` 3540 if [ $ret != 0 ]; then echo_i "failed"; fi 3541 status=`expr $status + $ret` 3542 3543 echo_i "check that _ta-XXXX trust-anchor-telemetry queries are logged ($n)" 3544 ret=0 3545 grep "trust-anchor-telemetry '_ta-[0-9a-f]*/IN' from" ns1/named.run > /dev/null || ret=1 3546 n=`expr $n + 1` 3547 if [ $ret != 0 ]; then echo_i "failed"; fi 3548 status=`expr $status + $ret` 3549 3550 echo_i "check that _ta-AAAA trust-anchor-telemetry are not sent when disabled ($n)" 3551 ret=0 3552 grep "sending trust-anchor-telemetry query '_ta-[0-9a-f]*/IN" ns1/named.run > /dev/null && ret=1 3553 n=`expr $n + 1` 3554 if [ $ret != 0 ]; then echo_i "failed"; fi 3555 status=`expr $status + $ret` 3556 3557 echo_i "check that KEY-TAG trust-anchor-telemetry queries are logged ($n)" 3558 ret=0 3559 $DIG $DIGOPTS . dnskey +ednsopt=KEY-TAG:ffff @10.53.0.1 > dig.out.ns4.test$n || ret=1 3560 grep "trust-anchor-telemetry './IN' from .* 65535" ns1/named.run > /dev/null || ret=1 3561 n=`expr $n + 1` 3562 if [ $ret != 0 ]; then echo_i "failed"; fi 3563 status=`expr $status + $ret` 3564 3565 echo_i "check that the view is logged in messages from the validator when using views ($n)" 3566 ret=0 3567 grep "view rec: *validat" ns4/named.run > /dev/null || ret=1 3568 n=`expr $n + 1` 3569 if [ $ret != 0 ]; then echo_i "failed"; fi 3570 status=`expr $status + $ret` 3571 3572 # Note: after this check, ns4 will not be validating any more; do not add any 3573 # further validation tests employing ns4 below this check. 3574 echo_i "check that validation defaults to off when dnssec-enable is off ($n)" 3575 ret=0 3576 # Sanity check - validation should be enabled. 3577 $RNDCCMD 10.53.0.4 validation status | grep "enabled" > /dev/null || ret=1 3578 # Set "dnssec-enable" to "no" and reconfigure. 3579 copy_setports ns4/named5.conf.in ns4/named.conf 3580 $RNDCCMD 10.53.0.4 reconfig 2>&1 | sed 's/^/ns4 /' | cat_i 3581 # Check validation status again. 3582 $RNDCCMD 10.53.0.4 validation status | grep "disabled" > /dev/null || ret=1 3583 n=`expr $n + 1` 3584 if [ $ret != 0 ]; then echo_i "failed"; fi 3585 status=`expr $status + $ret` 3586 3587 echo_i "exit status: $status" 3588 [ $status -eq 0 ] || exit 1 3589
Indexes created Tue Aug 04 00:24:20 UTC 2026