tests.sh revision 1.1.1.3
1 #!/bin/sh 2 # 3 # Copyright (C) Internet Systems Consortium, Inc. ("ISC") 4 # 5 # This Source Code Form is subject to the terms of the Mozilla Public 6 # License, v. 2.0. If a copy of the MPL was not distributed with this 7 # file, You can obtain one at http://mozilla.org/MPL/2.0/. 8 # 9 # See the COPYRIGHT file distributed with this work for additional 10 # information regarding copyright ownership. 11 12 # shellcheck source=conf.sh 13 SYSTEMTESTTOP=.. 14 . "$SYSTEMTESTTOP/conf.sh" 15 16 set -e 17 18 status=0 19 n=1 20 21 rm -f dig.out.* 22 23 dig_with_opts() { 24 "$DIG" +tcp +noadd +nosea +nostat +nocmd +dnssec -p "$PORT" "$@" 25 } 26 27 dig_with_additionalopts() { 28 "$DIG" +noall +additional +dnssec -p "$PORT" "$@" 29 } 30 31 dig_with_answeropts() { 32 "$DIG" +noall +answer +dnssec -p "$PORT" "$@" 33 } 34 35 delv_with_opts() { 36 "$DELV" -a ns1/trusted.conf -p "$PORT" "$@" 37 } 38 39 rndccmd() { 40 "$RNDC" -c "$SYSTEMTESTTOP/common/rndc.conf" -p "$CONTROLPORT" -s "$@" 41 } 42 43 # convert private-type records to readable form 44 showprivate () { 45 echo "-- $* --" 46 dig_with_opts +nodnssec +short "@$2" -t type65534 "$1" | cut -f3 -d' ' | 47 while read -r record; do 48 # shellcheck disable=SC2016 49 $PERL -e 'my $rdata = pack("H*", @ARGV[0]); 50 die "invalid record" unless length($rdata) == 5; 51 my ($alg, $key, $remove, $complete) = unpack("CnCC", $rdata); 52 my $action = "signing"; 53 $action = "removing" if $remove; 54 my $state = " (incomplete)"; 55 $state = " (complete)" if $complete; 56 print ("$action: alg: $alg, key: $key$state\n");' "$record" 57 done 58 } 59 60 # check that signing records are marked as complete 61 checkprivate () { 62 for i in 1 2 3 4 5 6 7 8 9 10; do 63 showprivate "$@" | grep -q incomplete || return 0 64 sleep 1 65 done 66 echo_d "$1 signing incomplete" 67 return 1 68 } 69 70 # check that a zone file is raw format, version 0 71 israw0 () { 72 # shellcheck disable=SC2016 73 < "$1" $PERL -e 'binmode STDIN; 74 read(STDIN, $input, 8); 75 ($style, $version) = unpack("NN", $input); 76 exit 1 if ($style != 2 || $version != 0);' 77 return $? 78 } 79 80 # check that a zone file is raw format, version 1 81 israw1 () { 82 # shellcheck disable=SC2016 83 < "$1" $PERL -e 'binmode STDIN; 84 read(STDIN, $input, 8); 85 ($style, $version) = unpack("NN", $input); 86 exit 1 if ($style != 2 || $version != 1);' 87 return $? 88 } 89 90 # strip NS and RRSIG NS from input 91 stripns () { 92 awk '($4 == "NS") || ($4 == "RRSIG" && $5 == "NS") { next} { print }' "$1" 93 } 94 95 # Check that for a query against a validating resolver where the 96 # authoritative zone is unsigned (insecure delegation), glue is returned 97 # in the additional section 98 echo_i "checking that additional glue is returned for unsigned delegation ($n)" 99 ret=0 100 $DIG +tcp +dnssec -p "$PORT" a.insecure.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1 101 grep "ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2" dig.out.ns4.test$n > /dev/null || ret=1 102 grep "ns\\.insecure\\.example\\..*A.10\\.53\\.0\\.3" dig.out.ns4.test$n > /dev/null || ret=1 103 n=$((n+1)) 104 if [ "$ret" -ne 0 ]; then echo_i "failed"; fi 105 status=$((status+ret)) 106 107 # Check the example. domain 108 109 echo_i "checking that zone transfer worked ($n)" 110 for i in 1 2 3 4 5 6 7 8 9 111 do 112 ret=0 113 dig_with_opts a.example. @10.53.0.2 a > dig.out.ns2.test$n || ret=1 114 dig_with_opts a.example. @10.53.0.3 a > dig.out.ns3.test$n || ret=1 115 $PERL ../digcomp.pl dig.out.ns2.test$n dig.out.ns3.test$n > /dev/null || ret=1 116 [ "$ret" -eq 0 ] && break 117 sleep 1 118 done 119 digcomp dig.out.ns2.test$n dig.out.ns3.test$n > /dev/null || ret=1 120 n=$((n+1)) 121 test "$ret" -eq 0 || echo_i "failed" 122 status=$((status+ret)) 123 124 # test AD bit: 125 # - dig +adflag asks for authentication (ad in response) 126 echo_i "checking AD bit asking for validation ($n)" 127 ret=0 128 dig_with_opts +noauth +noadd +nodnssec +adflag a.example. @10.53.0.2 a > dig.out.ns2.test$n || ret=1 129 dig_with_opts +noauth +noadd +nodnssec +adflag a.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1 130 digcomp dig.out.ns2.test$n dig.out.ns4.test$n || ret=1 131 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 132 n=$((n+1)) 133 test "$ret" -eq 0 || echo_i "failed" 134 status=$((status+ret)) 135 136 # test AD bit: 137 # - dig +noadflag 138 echo_i "checking that AD is not set without +adflag or +dnssec ($n)" 139 ret=0 140 dig_with_opts +noauth +noadd +nodnssec +noadflag a.example. @10.53.0.2 a > dig.out.ns2.test$n || ret=1 141 dig_with_opts +noauth +noadd +nodnssec +noadflag a.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1 142 digcomp dig.out.ns2.test$n dig.out.ns4.test$n || ret=1 143 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 144 n=$((n+1)) 145 test "$ret" -eq 0 || echo_i "failed" 146 status=$((status+ret)) 147 148 echo_i "checking for AD in authoritative answer ($n)" 149 ret=0 150 dig_with_opts a.example. @10.53.0.2 a > dig.out.ns2.test$n || ret=1 151 grep "flags:.*ad.*QUERY" dig.out.ns2.test$n > /dev/null && ret=1 152 n=$((n+1)) 153 test "$ret" -eq 0 || echo_i "failed" 154 status=$((status+ret)) 155 156 echo_i "checking positive validation NSEC ($n)" 157 ret=0 158 dig_with_opts +noauth a.example. @10.53.0.2 a > dig.out.ns2.test$n || ret=1 159 dig_with_opts +noauth a.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1 160 digcomp dig.out.ns2.test$n dig.out.ns4.test$n || ret=1 161 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 162 n=$((n+1)) 163 test "$ret" -eq 0 || echo_i "failed" 164 status=$((status+ret)) 165 166 if [ -x ${DELV} ] ; then 167 ret=0 168 echo_i "checking positive validation NSEC using dns_client ($n)" 169 delv_with_opts @10.53.0.4 a a.example > delv.out$n || ret=1 170 grep "a.example..*10.0.0.1" delv.out$n > /dev/null || ret=1 171 grep "a.example..*.RRSIG.A [0-9][0-9]* 2 300 .*" delv.out$n > /dev/null || ret=1 172 n=$((n+1)) 173 test "$ret" -eq 0 || echo_i "failed" 174 status=$((status+ret)) 175 fi 176 177 echo_i "checking positive validation NSEC3 ($n)" 178 ret=0 179 dig_with_opts +noauth a.nsec3.example. \ 180 @10.53.0.3 a > dig.out.ns3.test$n || ret=1 181 dig_with_opts +noauth a.nsec3.example. \ 182 @10.53.0.4 a > dig.out.ns4.test$n || ret=1 183 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 184 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 185 n=$((n+1)) 186 test "$ret" -eq 0 || echo_i "failed" 187 status=$((status+ret)) 188 189 if [ -x ${DELV} ] ; then 190 ret=0 191 echo_i "checking positive validation NSEC3 using dns_client ($n)" 192 delv_with_opts @10.53.0.4 a a.nsec3.example > delv.out$n || ret=1 193 grep "a.nsec3.example..*10.0.0.1" delv.out$n > /dev/null || ret=1 194 grep "a.nsec3.example..*RRSIG.A [0-9][0-9]* 3 300.*" delv.out$n > /dev/null || ret=1 195 n=$((n+1)) 196 test "$ret" -eq 0 || echo_i "failed" 197 status=$((status+ret)) 198 fi 199 200 echo_i "checking positive validation OPTOUT ($n)" 201 ret=0 202 dig_with_opts +noauth a.optout.example. \ 203 @10.53.0.3 a > dig.out.ns3.test$n || ret=1 204 dig_with_opts +noauth a.optout.example. \ 205 @10.53.0.4 a > dig.out.ns4.test$n || ret=1 206 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 207 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 208 n=$((n+1)) 209 test "$ret" -eq 0 || echo_i "failed" 210 status=$((status+ret)) 211 212 SP="[[:space:]]+" 213 214 if [ -x ${DELV} ] ; then 215 ret=0 216 echo_i "checking positive validation OPTOUT using dns_client ($n)" 217 delv_with_opts @10.53.0.4 a a.optout.example > delv.out$n || ret=1 218 grep -Eq "^a\\.optout\\.example\\.""$SP""[0-9]+""$SP""IN""$SP""A""$SP""10.0.0.1" delv.out$n || ret=1 219 grep -Eq "^a\\.optout\\.example\\.""$SP""[0-9]+""$SP""IN""$SP""RRSIG""$SP""A""$SP""$DEFAULT_ALGORITHM_NUMBER""$SP""3""$SP""300" delv.out$n || ret=1 220 n=$((n+1)) 221 test "$ret" -eq 0 || echo_i "failed" 222 status=$((status+ret)) 223 fi 224 225 echo_i "checking positive wildcard validation NSEC ($n)" 226 ret=0 227 dig_with_opts a.wild.example. @10.53.0.3 a > dig.out.ns3.test$n || ret=1 228 dig_with_opts a.wild.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1 229 stripns dig.out.ns3.test$n > dig.out.ns3.stripped.test$n 230 stripns dig.out.ns4.test$n > dig.out.ns4.stripped.test$n 231 digcomp dig.out.ns3.stripped.test$n dig.out.ns4.stripped.test$n || ret=1 232 grep "\\*\\.wild\\.example\\..*RRSIG NSEC" dig.out.ns4.test$n > /dev/null || ret=1 233 grep "\\*\\.wild\\.example\\..*NSEC z\\.example" dig.out.ns4.test$n > /dev/null || ret=1 234 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 235 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 236 n=$((n+1)) 237 test "$ret" -eq 0 || echo_i "failed" 238 status=$((status+ret)) 239 240 if [ -x ${DELV} ] ; then 241 ret=0 242 echo_i "checking positive wildcard validation NSEC using dns_client ($n)" 243 delv_with_opts @10.53.0.4 a a.wild.example > delv.out$n || ret=1 244 grep "a.wild.example..*10.0.0.27" delv.out$n > /dev/null || ret=1 245 grep -E "a.wild.example..*RRSIG.A [0-9]+ 2 300.*" delv.out$n > /dev/null || ret=1 246 n=$((n+1)) 247 test "$ret" -eq 0 || echo_i "failed" 248 status=$((status+ret)) 249 fi 250 251 echo_i "checking positive wildcard answer NSEC3 ($n)" 252 ret=0 253 dig_with_opts a.wild.nsec3.example. @10.53.0.3 a > dig.out.ns3.test$n || ret=1 254 grep "AUTHORITY: 4," dig.out.ns3.test$n > /dev/null || ret=1 255 grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || ret=1 256 n=$((n+1)) 257 test "$ret" -eq 0 || echo_i "failed" 258 status=$((status+ret)) 259 260 echo_i "checking positive wildcard answer NSEC3 ($n)" 261 ret=0 262 dig_with_opts a.wild.nsec3.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1 263 grep "AUTHORITY: 4," dig.out.ns4.test$n > /dev/null || ret=1 264 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 265 n=$((n+1)) 266 test "$ret" -eq 0 || echo_i "failed" 267 status=$((status+ret)) 268 269 echo_i "checking positive wildcard validation NSEC3 ($n)" 270 ret=0 271 dig_with_opts a.wild.nsec3.example. @10.53.0.3 a > dig.out.ns3.test$n || ret=1 272 dig_with_opts a.wild.nsec3.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1 273 stripns dig.out.ns3.test$n > dig.out.ns3.stripped.test$n 274 stripns dig.out.ns4.test$n > dig.out.ns4.stripped.test$n 275 digcomp dig.out.ns3.stripped.test$n dig.out.ns4.stripped.test$n || ret=1 276 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 277 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 278 n=$((n+1)) 279 test "$ret" -eq 0 || echo_i "failed" 280 status=$((status+ret)) 281 282 if [ -x ${DELV} ] ; then 283 ret=0 284 echo_i "checking positive wildcard validation NSEC3 using dns_client ($n)" 285 delv_with_opts @10.53.0.4 a a.wild.nsec3.example > delv.out$n || ret=1 286 grep -E "a.wild.nsec3.example..*10.0.0.6" delv.out$n > /dev/null || ret=1 287 grep -E "a.wild.nsec3.example..*RRSIG.A [0-9][0-9]* 3 300.*" delv.out$n > /dev/null || ret=1 288 n=$((n+1)) 289 test "$ret" -eq 0 || echo_i "failed" 290 status=$((status+ret)) 291 fi 292 293 echo_i "checking positive wildcard validation OPTOUT ($n)" 294 ret=0 295 dig_with_opts a.wild.optout.example. \ 296 @10.53.0.3 a > dig.out.ns3.test$n || ret=1 297 dig_with_opts a.wild.optout.example. \ 298 @10.53.0.4 a > dig.out.ns4.test$n || ret=1 299 stripns dig.out.ns3.test$n > dig.out.ns3.stripped.test$n 300 stripns dig.out.ns4.test$n > dig.out.ns4.stripped.test$n 301 digcomp dig.out.ns3.stripped.test$n dig.out.ns4.stripped.test$n || ret=1 302 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 303 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 304 n=$((n+1)) 305 test "$ret" -eq 0 || echo_i "failed" 306 status=$((status+ret)) 307 308 if [ -x ${DELV} ] ; then 309 ret=0 310 echo_i "checking positive wildcard validation OPTOUT using dns_client ($n)" 311 delv_with_opts @10.53.0.4 a a.wild.optout.example > delv.out$n || ret=1 312 grep "a.wild.optout.example..*10.0.0.6" delv.out$n > /dev/null || ret=1 313 grep "a.wild.optout.example..*RRSIG.A [0-9][0-9]* 3 300.*" delv.out$n > /dev/null || ret=1 314 n=$((n+1)) 315 test "$ret" -eq 0 || echo_i "failed" 316 status=$((status+ret)) 317 fi 318 319 echo_i "checking negative validation NXDOMAIN NSEC ($n)" 320 ret=0 321 dig_with_opts +noauth q.example. @10.53.0.2 a > dig.out.ns2.test$n || ret=1 322 dig_with_opts +noauth q.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1 323 digcomp dig.out.ns2.test$n dig.out.ns4.test$n || ret=1 324 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 325 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1 326 n=$((n+1)) 327 test "$ret" -eq 0 || echo_i "failed" 328 status=$((status+ret)) 329 330 if [ -x ${DELV} ] ; then 331 ret=0 332 echo_i "checking negative validation NXDOMAIN NSEC using dns_client ($n)" 333 delv_with_opts @10.53.0.4 a q.example > delv.out$n 2>&1 || ret=1 334 grep "resolution failed: ncache nxdomain" delv.out$n > /dev/null || ret=1 335 n=$((n+1)) 336 test "$ret" -eq 0 || echo_i "failed" 337 status=$((status+ret)) 338 fi 339 340 echo_i "checking negative validation NXDOMAIN NSEC3 ($n)" 341 ret=0 342 dig_with_opts +noauth q.nsec3.example. \ 343 @10.53.0.3 a > dig.out.ns3.test$n || ret=1 344 dig_with_opts +noauth q.nsec3.example. \ 345 @10.53.0.4 a > dig.out.ns4.test$n || ret=1 346 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 347 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 348 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1 349 n=$((n+1)) 350 test "$ret" -eq 0 || echo_i "failed" 351 status=$((status+ret)) 352 353 if [ -x ${DELV} ] ; then 354 ret=0 355 echo_i "checking negative validation NXDOMAIN NSEC3 using dns_client ($n)" 356 delv_with_opts @10.53.0.4 a q.nsec3.example > delv.out$n 2>&1 || ret=1 357 grep "resolution failed: ncache nxdomain" delv.out$n > /dev/null || ret=1 358 n=$((n+1)) 359 test "$ret" -eq 0 || echo_i "failed" 360 status=$((status+ret)) 361 fi 362 363 echo_i "checking negative validation NXDOMAIN OPTOUT ($n)" 364 ret=0 365 dig_with_opts +noauth q.optout.example. \ 366 @10.53.0.3 a > dig.out.ns3.test$n || ret=1 367 dig_with_opts +noauth q.optout.example. \ 368 @10.53.0.4 a > dig.out.ns4.test$n || ret=1 369 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 370 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1 371 # Note - this is looking for failure, hence the && 372 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 373 n=$((n+1)) 374 test "$ret" -eq 0 || echo_i "failed" 375 status=$((status+ret)) 376 377 if [ -x ${DELV} ] ; then 378 ret=0 379 echo_i "checking negative validation NXDOMAIN OPTOUT using dns_client ($n)" 380 delv_with_opts @10.53.0.4 a q.optout.example > delv.out$n 2>&1 || ret=1 381 grep "resolution failed: ncache nxdomain" delv.out$n > /dev/null || ret=1 382 n=$((n+1)) 383 test "$ret" -eq 0 || echo_i "failed" 384 status=$((status+ret)) 385 fi 386 387 echo_i "checking negative validation NODATA NSEC ($n)" 388 ret=0 389 dig_with_opts +noauth a.example. @10.53.0.2 txt > dig.out.ns2.test$n || ret=1 390 dig_with_opts +noauth a.example. @10.53.0.4 txt > dig.out.ns4.test$n || ret=1 391 digcomp dig.out.ns2.test$n dig.out.ns4.test$n || ret=1 392 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 393 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 394 grep "ANSWER: 0" dig.out.ns4.test$n > /dev/null || ret=1 395 n=$((n+1)) 396 test "$ret" -eq 0 || echo_i "failed" 397 status=$((status+ret)) 398 399 if [ -x ${DELV} ] ; then 400 ret=0 401 echo_i "checking negative validation NODATA OPTOUT using dns_client ($n)" 402 delv_with_opts @10.53.0.4 txt a.example > delv.out$n 2>&1 || ret=1 403 grep "resolution failed: ncache nxrrset" delv.out$n > /dev/null || ret=1 404 n=$((n+1)) 405 test "$ret" -eq 0 || echo_i "failed" 406 status=$((status+ret)) 407 fi 408 409 echo_i "checking negative validation NODATA NSEC3 ($n)" 410 ret=0 411 dig_with_opts +noauth a.nsec3.example. \ 412 @10.53.0.3 txt > dig.out.ns3.test$n || ret=1 413 dig_with_opts +noauth a.nsec3.example. \ 414 @10.53.0.4 txt > dig.out.ns4.test$n || ret=1 415 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 416 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 417 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 418 grep "ANSWER: 0" dig.out.ns4.test$n > /dev/null || ret=1 419 n=$((n+1)) 420 test "$ret" -eq 0 || echo_i "failed" 421 status=$((status+ret)) 422 423 if [ -x ${DELV} ] ; then 424 ret=0 425 echo_i "checking negative validation NODATA NSEC3 using dns_client ($n)" 426 delv_with_opts @10.53.0.4 txt a.nsec3.example > delv.out$n 2>&1 || ret=1 427 grep "resolution failed: ncache nxrrset" delv.out$n > /dev/null || ret=1 428 n=$((n+1)) 429 test "$ret" -eq 0 || echo_i "failed" 430 status=$((status+ret)) 431 fi 432 433 echo_i "checking negative validation NODATA OPTOUT ($n)" 434 ret=0 435 dig_with_opts +noauth a.optout.example. \ 436 @10.53.0.3 txt > dig.out.ns3.test$n || ret=1 437 dig_with_opts +noauth a.optout.example. \ 438 @10.53.0.4 txt > dig.out.ns4.test$n || ret=1 439 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 440 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 441 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 442 grep "ANSWER: 0" dig.out.ns4.test$n > /dev/null || ret=1 443 n=$((n+1)) 444 test "$ret" -eq 0 || echo_i "failed" 445 status=$((status+ret)) 446 447 if [ -x ${DELV} ] ; then 448 ret=0 449 echo_i "checking negative validation NODATA OPTOUT using dns_client ($n)" 450 delv_with_opts @10.53.0.4 txt a.optout.example > delv.out$n 2>&1 || ret=1 451 grep "resolution failed: ncache nxrrset" delv.out$n > /dev/null || ret=1 452 n=$((n+1)) 453 test "$ret" -eq 0 || echo_i "failed" 454 status=$((status+ret)) 455 fi 456 457 echo_i "checking negative wildcard validation NSEC ($n)" 458 ret=0 459 dig_with_opts b.wild.example. @10.53.0.2 txt > dig.out.ns2.test$n || ret=1 460 dig_with_opts b.wild.example. @10.53.0.4 txt > dig.out.ns4.test$n || ret=1 461 digcomp dig.out.ns2.test$n dig.out.ns4.test$n || ret=1 462 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 463 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 464 n=$((n+1)) 465 test "$ret" -eq 0 || echo_i "failed" 466 status=$((status+ret)) 467 468 if [ -x ${DELV} ] ; then 469 ret=0 470 echo_i "checking negative wildcard validation NSEC using dns_client ($n)" 471 delv_with_opts @10.53.0.4 txt b.wild.example > delv.out$n 2>&1 || ret=1 472 grep "resolution failed: ncache nxrrset" delv.out$n > /dev/null || ret=1 473 n=$((n+1)) 474 test "$ret" -eq 0 || echo_i "failed" 475 status=$((status+ret)) 476 fi 477 478 echo_i "checking negative wildcard validation NSEC3 ($n)" 479 ret=0 480 dig_with_opts b.wild.nsec3.example. @10.53.0.3 txt > dig.out.ns3.test$n || ret=1 481 dig_with_opts b.wild.nsec3.example. @10.53.0.4 txt > dig.out.ns4.test$n || ret=1 482 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 483 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 484 n=$((n+1)) 485 test "$ret" -eq 0 || echo_i "failed" 486 status=$((status+ret)) 487 488 if [ -x ${DELV} ] ; then 489 ret=0 490 echo_i "checking negative wildcard validation NSEC3 using dns_client ($n)" 491 delv_with_opts @10.53.0.4 txt b.wild.nsec3.example > delv.out$n 2>&1 || ret=1 492 grep "resolution failed: ncache nxrrset" delv.out$n > /dev/null || ret=1 493 n=$((n+1)) 494 test "$ret" -eq 0 || echo_i "failed" 495 status=$((status+ret)) 496 fi 497 498 echo_i "checking negative wildcard validation OPTOUT ($n)" 499 ret=0 500 dig_with_opts b.wild.optout.example. \ 501 @10.53.0.3 txt > dig.out.ns3.test$n || ret=1 502 dig_with_opts b.wild.optout.example. \ 503 @10.53.0.4 txt > dig.out.ns4.test$n || ret=1 504 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 505 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 506 # Note - this is looking for failure, hence the && 507 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 508 n=$((n+1)) 509 test "$ret" -eq 0 || echo_i "failed" 510 status=$((status+ret)) 511 512 if [ -x ${DELV} ] ; then 513 ret=0 514 echo_i "checking negative wildcard validation OPTOUT using dns_client ($n)" 515 delv_with_opts @10.53.0.4 txt b.optout.nsec3.example > delv.out$n 2>&1 || ret=1 516 grep "resolution failed: ncache nxrrset" delv.out$n > /dev/null || ret=1 517 n=$((n+1)) 518 test "$ret" -eq 0 || echo_i "failed" 519 status=$((status+ret)) 520 fi 521 522 # Check the insecure.example domain 523 524 echo_i "checking 1-server insecurity proof NSEC ($n)" 525 ret=0 526 dig_with_opts +noauth a.insecure.example. @10.53.0.3 a > dig.out.ns3.test$n || ret=1 527 dig_with_opts +noauth a.insecure.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1 528 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 529 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 530 # Note - this is looking for failure, hence the && 531 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 532 n=$((n+1)) 533 test "$ret" -eq 0 || echo_i "failed" 534 status=$((status+ret)) 535 536 if [ -x ${DELV} ] ; then 537 ret=0 538 echo_i "checking 1-server insecurity proof NSEC using dns_client ($n)" 539 delv_with_opts @10.53.0.4 a a.insecure.example > delv.out$n || ret=1 540 grep "a.insecure.example..*10.0.0.1" delv.out$n > /dev/null || ret=1 541 n=$((n+1)) 542 test "$ret" -eq 0 || echo_i "failed" 543 status=$((status+ret)) 544 fi 545 546 echo_i "checking 1-server insecurity proof NSEC3 ($n)" 547 ret=0 548 dig_with_opts +noauth a.insecure.nsec3.example. @10.53.0.3 a > dig.out.ns3.test$n || ret=1 549 dig_with_opts +noauth a.insecure.nsec3.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1 550 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 551 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 552 # Note - this is looking for failure, hence the && 553 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 554 n=$((n+1)) 555 test "$ret" -eq 0 || echo_i "failed" 556 status=$((status+ret)) 557 558 if [ -x ${DELV} ] ; then 559 ret=0 560 echo_i "checking 1-server insecurity proof NSEC3 using dns_client ($n)" 561 delv_with_opts @10.53.0.4 a a.insecure.nsec3.example > delv.out$n || ret=1 562 grep "a.insecure.nsec3.example..*10.0.0.1" delv.out$n > /dev/null || ret=1 563 n=$((n+1)) 564 test "$ret" -eq 0 || echo_i "failed" 565 status=$((status+ret)) 566 fi 567 568 echo_i "checking 1-server insecurity proof OPTOUT ($n)" 569 ret=0 570 dig_with_opts +noauth a.insecure.optout.example. @10.53.0.3 a > dig.out.ns3.test$n || ret=1 571 dig_with_opts +noauth a.insecure.optout.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1 572 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 573 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 574 # Note - this is looking for failure, hence the && 575 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 576 n=$((n+1)) 577 test "$ret" -eq 0 || echo_i "failed" 578 status=$((status+ret)) 579 580 if [ -x ${DELV} ] ; then 581 ret=0 582 echo_i "checking 1-server insecurity proof OPTOUT using dns_client ($n)" 583 delv_with_opts @10.53.0.4 a a.insecure.optout.example > delv.out$n || ret=1 584 grep "a.insecure.optout.example..*10.0.0.1" delv.out$n > /dev/null || ret=1 585 n=$((n+1)) 586 test "$ret" -eq 0 || echo_i "failed" 587 status=$((status+ret)) 588 fi 589 590 echo_i "checking 1-server negative insecurity proof NSEC ($n)" 591 ret=0 592 dig_with_opts q.insecure.example. a @10.53.0.3 \ 593 > dig.out.ns3.test$n || ret=1 594 dig_with_opts q.insecure.example. a @10.53.0.4 \ 595 > dig.out.ns4.test$n || ret=1 596 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 597 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1 598 # Note - this is looking for failure, hence the && 599 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 600 n=$((n+1)) 601 test "$ret" -eq 0 || echo_i "failed" 602 status=$((status+ret)) 603 604 if [ -x ${DELV} ] ; then 605 ret=0 606 echo_i "checking 1-server negative insecurity proof NSEC using dns_client ($n)" 607 delv_with_opts @10.53.0.4 a q.insecure.example > delv.out$n 2>&1 || ret=1 608 grep "resolution failed: ncache nxdomain" delv.out$n > /dev/null || ret=1 609 n=$((n+1)) 610 test "$ret" -eq 0 || echo_i "failed" 611 status=$((status+ret)) 612 fi 613 614 echo_i "checking 1-server negative insecurity proof NSEC3 ($n)" 615 ret=0 616 dig_with_opts q.insecure.nsec3.example. a @10.53.0.3 \ 617 > dig.out.ns3.test$n || ret=1 618 dig_with_opts q.insecure.nsec3.example. a @10.53.0.4 \ 619 > dig.out.ns4.test$n || ret=1 620 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 621 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1 622 # Note - this is looking for failure, hence the && 623 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 624 n=$((n+1)) 625 test "$ret" -eq 0 || echo_i "failed" 626 status=$((status+ret)) 627 628 if [ -x ${DELV} ] ; then 629 ret=0 630 echo_i "checking 1-server negative insecurity proof NSEC3 using dns_client ($n)" 631 delv_with_opts @10.53.0.4 a q.insecure.nsec3.example > delv.out$n 2>&1 || ret=1 632 grep "resolution failed: ncache nxdomain" delv.out$n > /dev/null || ret=1 633 n=$((n+1)) 634 test "$ret" -eq 0 || echo_i "failed" 635 status=$((status+ret)) 636 fi 637 638 echo_i "checking 1-server negative insecurity proof OPTOUT ($n)" 639 ret=0 640 dig_with_opts q.insecure.optout.example. a @10.53.0.3 \ 641 > dig.out.ns3.test$n || ret=1 642 dig_with_opts q.insecure.optout.example. a @10.53.0.4 \ 643 > dig.out.ns4.test$n || ret=1 644 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 645 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1 646 # Note - this is looking for failure, hence the && 647 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 648 n=$((n+1)) 649 test "$ret" -eq 0 || echo_i "failed" 650 status=$((status+ret)) 651 652 if [ -x ${DELV} ] ; then 653 ret=0 654 echo_i "checking 1-server negative insecurity proof OPTOUT using dns_client ($n)" 655 delv_with_opts @10.53.0.4 a q.insecure.optout.example > delv.out$n 2>&1 || ret=1 656 grep "resolution failed: ncache nxdomain" delv.out$n > /dev/null || ret=1 657 n=$((n+1)) 658 test "$ret" -eq 0 || echo_i "failed" 659 status=$((status+ret)) 660 fi 661 662 echo_i "checking 1-server negative insecurity proof with SOA hack NSEC ($n)" 663 ret=0 664 dig_with_opts r.insecure.example. soa @10.53.0.3 \ 665 > dig.out.ns3.test$n || ret=1 666 dig_with_opts r.insecure.example. soa @10.53.0.4 \ 667 > dig.out.ns4.test$n || ret=1 668 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 669 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1 670 grep "0 IN SOA" dig.out.ns4.test$n > /dev/null || ret=1 671 # Note - this is looking for failure, hence the && 672 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 673 n=$((n+1)) 674 test "$ret" -eq 0 || echo_i "failed" 675 status=$((status+ret)) 676 677 echo_i "checking 1-server negative insecurity proof with SOA hack NSEC3 ($n)" 678 ret=0 679 dig_with_opts r.insecure.nsec3.example. soa @10.53.0.3 \ 680 > dig.out.ns3.test$n || ret=1 681 dig_with_opts r.insecure.nsec3.example. soa @10.53.0.4 \ 682 > dig.out.ns4.test$n || ret=1 683 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 684 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1 685 grep "0 IN SOA" dig.out.ns4.test$n > /dev/null || ret=1 686 # Note - this is looking for failure, hence the && 687 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 688 n=$((n+1)) 689 test "$ret" -eq 0 || echo_i "failed" 690 status=$((status+ret)) 691 692 echo_i "checking 1-server negative insecurity proof with SOA hack OPTOUT ($n)" 693 ret=0 694 dig_with_opts r.insecure.optout.example. soa @10.53.0.3 \ 695 > dig.out.ns3.test$n || ret=1 696 dig_with_opts r.insecure.optout.example. soa @10.53.0.4 \ 697 > dig.out.ns4.test$n || ret=1 698 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 699 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1 700 grep "0 IN SOA" dig.out.ns4.test$n > /dev/null || ret=1 701 # Note - this is looking for failure, hence the && 702 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 703 n=$((n+1)) 704 test "$ret" -eq 0 || echo_i "failed" 705 status=$((status+ret)) 706 707 # Check the secure.example domain 708 709 echo_i "checking multi-stage positive validation NSEC/NSEC ($n)" 710 ret=0 711 dig_with_opts +noauth a.secure.example. \ 712 @10.53.0.3 a > dig.out.ns3.test$n || ret=1 713 dig_with_opts +noauth a.secure.example. \ 714 @10.53.0.4 a > dig.out.ns4.test$n || ret=1 715 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 716 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 717 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 718 n=$((n+1)) 719 test "$ret" -eq 0 || echo_i "failed" 720 status=$((status+ret)) 721 722 echo_i "checking multi-stage positive validation NSEC/NSEC3 ($n)" 723 ret=0 724 dig_with_opts +noauth a.nsec3.example. \ 725 @10.53.0.3 a > dig.out.ns3.test$n || ret=1 726 dig_with_opts +noauth a.nsec3.example. \ 727 @10.53.0.4 a > dig.out.ns4.test$n || ret=1 728 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 729 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 730 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 731 n=$((n+1)) 732 test "$ret" -eq 0 || echo_i "failed" 733 status=$((status+ret)) 734 735 echo_i "checking multi-stage positive validation NSEC/OPTOUT ($n)" 736 ret=0 737 dig_with_opts +noauth a.optout.example. \ 738 @10.53.0.3 a > dig.out.ns3.test$n || ret=1 739 dig_with_opts +noauth a.optout.example. \ 740 @10.53.0.4 a > dig.out.ns4.test$n || ret=1 741 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 742 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 743 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 744 n=$((n+1)) 745 test "$ret" -eq 0 || echo_i "failed" 746 status=$((status+ret)) 747 748 echo_i "checking multi-stage positive validation NSEC3/NSEC ($n)" 749 ret=0 750 dig_with_opts +noauth a.secure.nsec3.example. \ 751 @10.53.0.3 a > dig.out.ns3.test$n || ret=1 752 dig_with_opts +noauth a.secure.nsec3.example. \ 753 @10.53.0.4 a > dig.out.ns4.test$n || ret=1 754 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 755 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 756 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 757 n=$((n+1)) 758 test "$ret" -eq 0 || echo_i "failed" 759 status=$((status+ret)) 760 761 echo_i "checking multi-stage positive validation NSEC3/NSEC3 ($n)" 762 ret=0 763 dig_with_opts +noauth a.nsec3.nsec3.example. \ 764 @10.53.0.3 a > dig.out.ns3.test$n || ret=1 765 dig_with_opts +noauth a.nsec3.nsec3.example. \ 766 @10.53.0.4 a > dig.out.ns4.test$n || ret=1 767 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 768 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 769 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 770 n=$((n+1)) 771 test "$ret" -eq 0 || echo_i "failed" 772 status=$((status+ret)) 773 774 echo_i "checking multi-stage positive validation NSEC3/OPTOUT ($n)" 775 ret=0 776 dig_with_opts +noauth a.optout.nsec3.example. \ 777 @10.53.0.3 a > dig.out.ns3.test$n || ret=1 778 dig_with_opts +noauth a.optout.nsec3.example. \ 779 @10.53.0.4 a > dig.out.ns4.test$n || ret=1 780 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 781 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 782 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 783 n=$((n+1)) 784 test "$ret" -eq 0 || echo_i "failed" 785 status=$((status+ret)) 786 787 echo_i "checking multi-stage positive validation OPTOUT/NSEC ($n)" 788 ret=0 789 dig_with_opts +noauth a.secure.optout.example. \ 790 @10.53.0.3 a > dig.out.ns3.test$n || ret=1 791 dig_with_opts +noauth a.secure.optout.example. \ 792 @10.53.0.4 a > dig.out.ns4.test$n || ret=1 793 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 794 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 795 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 796 n=$((n+1)) 797 test "$ret" -eq 0 || echo_i "failed" 798 status=$((status+ret)) 799 800 echo_i "checking multi-stage positive validation OPTOUT/NSEC3 ($n)" 801 ret=0 802 dig_with_opts +noauth a.nsec3.optout.example. \ 803 @10.53.0.3 a > dig.out.ns3.test$n || ret=1 804 dig_with_opts +noauth a.nsec3.optout.example. \ 805 @10.53.0.4 a > dig.out.ns4.test$n || ret=1 806 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 807 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 808 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 809 n=$((n+1)) 810 test "$ret" -eq 0 || echo_i "failed" 811 status=$((status+ret)) 812 813 echo_i "checking multi-stage positive validation OPTOUT/OPTOUT ($n)" 814 ret=0 815 dig_with_opts +noauth a.optout.optout.example. \ 816 @10.53.0.3 a > dig.out.ns3.test$n || ret=1 817 dig_with_opts +noauth a.optout.optout.example. \ 818 @10.53.0.4 a > dig.out.ns4.test$n || ret=1 819 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 820 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 821 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 822 n=$((n+1)) 823 test "$ret" -eq 0 || echo_i "failed" 824 status=$((status+ret)) 825 826 echo_i "checking empty NODATA OPTOUT ($n)" 827 ret=0 828 dig_with_opts +noauth empty.optout.example. \ 829 @10.53.0.3 a > dig.out.ns3.test$n || ret=1 830 dig_with_opts +noauth empty.optout.example. \ 831 @10.53.0.4 a > dig.out.ns4.test$n || ret=1 832 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 833 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 834 #grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 835 n=$((n+1)) 836 test "$ret" -eq 0 || echo_i "failed" 837 status=$((status+ret)) 838 839 # Check the bogus domain 840 841 echo_i "checking failed validation ($n)" 842 ret=0 843 dig_with_opts a.bogus.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1 844 grep "SERVFAIL" dig.out.ns4.test$n > /dev/null || ret=1 845 n=$((n+1)) 846 test "$ret" -eq 0 || echo_i "failed" 847 status=$((status+ret)) 848 849 if [ -x ${DELV} ] ; then 850 ret=0 851 echo_i "checking failed validation using dns_client ($n)" 852 delv_with_opts +cd @10.53.0.4 a a.bogus.example > delv.out$n 2>&1 || ret=1 853 grep "resolution failed: RRSIG failed to verify" delv.out$n > /dev/null || ret=1 854 n=$((n+1)) 855 test "$ret" -eq 0 || echo_i "failed" 856 status=$((status+ret)) 857 fi 858 859 # Try validating with a bad trusted key. 860 # This should fail. 861 862 echo_i "checking that validation fails with a misconfigured trusted key ($n)" 863 ret=0 864 dig_with_opts example. soa @10.53.0.5 > dig.out.ns5.test$n || ret=1 865 grep "SERVFAIL" dig.out.ns5.test$n > /dev/null || ret=1 866 n=$((n+1)) 867 test "$ret" -eq 0 || echo_i "failed" 868 status=$((status+ret)) 869 870 echo_i "checking that negative validation fails with a misconfigured trusted key ($n)" 871 ret=0 872 dig_with_opts example. ptr @10.53.0.5 > dig.out.ns5.test$n || ret=1 873 grep "SERVFAIL" dig.out.ns5.test$n > /dev/null || ret=1 874 n=$((n+1)) 875 test "$ret" -eq 0 || echo_i "failed" 876 status=$((status+ret)) 877 878 echo_i "checking that insecurity proofs fail with a misconfigured trusted key ($n)" 879 ret=0 880 dig_with_opts a.insecure.example. a @10.53.0.5 > dig.out.ns5.test$n || ret=1 881 grep "SERVFAIL" dig.out.ns5.test$n > /dev/null || ret=1 882 n=$((n+1)) 883 test "$ret" -eq 0 || echo_i "failed" 884 status=$((status+ret)) 885 886 echo_i "checking that validation fails when key record is missing ($n)" 887 ret=0 888 dig_with_opts a.b.keyless.example. a @10.53.0.4 > dig.out.ns4.test$n || ret=1 889 grep "SERVFAIL" dig.out.ns4.test$n > /dev/null || ret=1 890 n=$((n+1)) 891 test "$ret" -eq 0 || echo_i "failed" 892 status=$((status+ret)) 893 894 if [ -x ${DELV} ] ; then 895 ret=0 896 echo_i "checking that validation fails when key record is missing using dns_client ($n)" 897 delv_with_opts +cd @10.53.0.4 a a.b.keyless.example > delv.out$n 2>&1 || ret=1 898 grep "resolution failed: broken trust chain" delv.out$n > /dev/null || ret=1 899 n=$((n+1)) 900 test "$ret" -eq 0 || echo_i "failed" 901 status=$((status+ret)) 902 fi 903 904 echo_i "checking that validation succeeds when a revoked key is encountered ($n)" 905 ret=0 906 dig_with_opts revkey.example soa @10.53.0.4 > dig.out.ns4.test$n || ret=1 907 grep "NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 908 grep "flags: .* ad" dig.out.ns4.test$n > /dev/null || ret=1 909 n=$((n+1)) 910 test "$ret" -eq 0 || echo_i "failed" 911 status=$((status+ret)) 912 913 if [ -x ${DELV} ] ; then 914 ret=0 915 echo_i "checking that validation succeeds when a revoked key is encountered using dns_client ($n)" 916 delv_with_opts +cd @10.53.0.4 soa revkey.example > delv.out$n 2>&1 || ret=1 917 grep "fully validated" delv.out$n > /dev/null || ret=1 918 n=$((n+1)) 919 test "$ret" -eq 0 || echo_i "failed" 920 status=$((status+ret)) 921 fi 922 923 echo_i "Checking that a bad CNAME signature is caught after a +CD query ($n)" 924 ret=0 925 #prime 926 dig_with_opts +cd bad-cname.example. @10.53.0.4 > dig.out.ns4.prime$n || ret=1 927 #check: requery with +CD. pending data should be returned even if it's bogus 928 expect="a.example. 929 10.0.0.1" 930 ans=$(dig_with_opts +cd +nodnssec +short bad-cname.example. @10.53.0.4) || ret=1 931 test "$ans" = "$expect" || ret=1 932 test "$ret" -eq 0 || echo_i "failed, got '$ans', expected '$expect'" 933 #check: requery without +CD. bogus cached data should be rejected. 934 dig_with_opts +nodnssec bad-cname.example. @10.53.0.4 > dig.out.ns4.test$n || ret=1 935 grep "SERVFAIL" dig.out.ns4.test$n > /dev/null || ret=1 936 n=$((n+1)) 937 test "$ret" -eq 0 || echo_i "failed" 938 status=$((status+ret)) 939 940 echo_i "Checking that a bad DNAME signature is caught after a +CD query ($n)" 941 ret=0 942 #prime 943 dig_with_opts +cd a.bad-dname.example. @10.53.0.4 > dig.out.ns4.prime$n || ret=1 944 #check: requery with +CD. pending data should be returned even if it's bogus 945 expect="example. 946 a.example. 947 10.0.0.1" 948 ans=$(dig_with_opts +cd +nodnssec +short a.bad-dname.example. @10.53.0.4) || ret=1 949 test "$ans" = "$expect" || ret=1 950 test "$ret" -eq 0 || echo_i "failed, got '$ans', expected '$expect'" 951 #check: requery without +CD. bogus cached data should be rejected. 952 dig_with_opts +nodnssec a.bad-dname.example. @10.53.0.4 > dig.out.ns4.test$n || ret=1 953 grep "SERVFAIL" dig.out.ns4.test$n > /dev/null || ret=1 954 n=$((n+1)) 955 test "$ret" -eq 0 || echo_i "failed" 956 status=$((status+ret)) 957 958 # Check the insecure.secure.example domain (insecurity proof) 959 960 echo_i "checking 2-server insecurity proof ($n)" 961 ret=0 962 dig_with_opts +noauth a.insecure.secure.example. @10.53.0.2 a \ 963 > dig.out.ns2.test$n || ret=1 964 dig_with_opts +noauth a.insecure.secure.example. @10.53.0.4 a \ 965 > dig.out.ns4.test$n || ret=1 966 digcomp dig.out.ns2.test$n dig.out.ns4.test$n || ret=1 967 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 968 # Note - this is looking for failure, hence the && 969 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 970 n=$((n+1)) 971 test "$ret" -eq 0 || echo_i "failed" 972 status=$((status+ret)) 973 974 # Check a negative response in insecure.secure.example 975 976 echo_i "checking 2-server insecurity proof with a negative answer ($n)" 977 ret=0 978 dig_with_opts q.insecure.secure.example. @10.53.0.2 a > dig.out.ns2.test$n \ 979 || ret=1 980 dig_with_opts q.insecure.secure.example. @10.53.0.4 a > dig.out.ns4.test$n \ 981 || ret=1 982 digcomp dig.out.ns2.test$n dig.out.ns4.test$n || ret=1 983 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1 984 # Note - this is looking for failure, hence the && 985 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 986 n=$((n+1)) 987 test "$ret" -eq 0 || echo_i "failed" 988 status=$((status+ret)) 989 990 echo_i "checking 2-server insecurity proof with a negative answer and SOA hack ($n)" 991 ret=0 992 dig_with_opts r.insecure.secure.example. @10.53.0.2 soa > dig.out.ns2.test$n \ 993 || ret=1 994 dig_with_opts r.insecure.secure.example. @10.53.0.4 soa > dig.out.ns4.test$n \ 995 || ret=1 996 digcomp dig.out.ns2.test$n dig.out.ns4.test$n || ret=1 997 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1 998 # Note - this is looking for failure, hence the && 999 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 1000 n=$((n+1)) 1001 test "$ret" -eq 0 || echo_i "failed" 1002 status=$((status+ret)) 1003 1004 # Check that the query for a security root is successful and has ad set 1005 1006 echo_i "checking security root query ($n)" 1007 ret=0 1008 dig_with_opts . @10.53.0.4 key > dig.out.ns4.test$n || ret=1 1009 grep "NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 1010 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 1011 n=$((n+1)) 1012 test "$ret" -eq 0 || echo_i "failed" 1013 status=$((status+ret)) 1014 1015 # Check that the setting the cd bit works 1016 1017 echo_i "checking cd bit on a positive answer ($n)" 1018 ret=0 1019 dig_with_opts +noauth example. soa @10.53.0.4 \ 1020 > dig.out.ns4.test$n || ret=1 1021 dig_with_opts +noauth +cdflag example. soa @10.53.0.5 \ 1022 > dig.out.ns5.test$n || ret=1 1023 digcomp dig.out.ns4.test$n dig.out.ns5.test$n || ret=1 1024 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 1025 # Note - this is looking for failure, hence the && 1026 grep "flags:.*ad.*QUERY" dig.out.ns5.test$n > /dev/null && ret=1 1027 n=$((n+1)) 1028 test "$ret" -eq 0 || echo_i "failed" 1029 status=$((status+ret)) 1030 1031 echo_i "checking cd bit on a negative answer ($n)" 1032 ret=0 1033 dig_with_opts q.example. soa @10.53.0.4 > dig.out.ns4.test$n || ret=1 1034 dig_with_opts +cdflag q.example. soa @10.53.0.5 > dig.out.ns5.test$n || ret=1 1035 digcomp dig.out.ns4.test$n dig.out.ns5.test$n || ret=1 1036 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 1037 # Note - this is looking for failure, hence the && 1038 grep "flags:.*ad.*QUERY" dig.out.ns5.test$n > /dev/null && ret=1 1039 n=$((n+1)) 1040 test "$ret" -eq 0 || echo_i "failed" 1041 status=$((status+ret)) 1042 1043 echo_i "checking positive validation RSASHA256 NSEC ($n)" 1044 ret=0 1045 dig_with_opts +noauth a.rsasha256.example. @10.53.0.3 a > dig.out.ns3.test$n || ret=1 1046 dig_with_opts +noauth a.rsasha256.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1 1047 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 1048 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 1049 n=$((n+1)) 1050 test "$ret" -eq 0 || echo_i "failed" 1051 status=$((status+ret)) 1052 1053 echo_i "checking positive validation RSASHA512 NSEC ($n)" 1054 ret=0 1055 dig_with_opts +noauth a.rsasha512.example. @10.53.0.3 a > dig.out.ns3.test$n || ret=1 1056 dig_with_opts +noauth a.rsasha512.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1 1057 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 1058 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 1059 n=$((n+1)) 1060 test "$ret" -eq 0 || echo_i "failed" 1061 status=$((status+ret)) 1062 1063 echo_i "checking positive validation with KSK-only DNSKEY signature ($n)" 1064 ret=0 1065 dig_with_opts +noauth a.kskonly.example. @10.53.0.3 a > dig.out.ns3.test$n || ret=1 1066 dig_with_opts +noauth a.kskonly.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1 1067 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 1068 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 1069 n=$((n+1)) 1070 test "$ret" -eq 0 || echo_i "failed" 1071 status=$((status+ret)) 1072 1073 echo_i "checking cd bit on a query that should fail ($n)" 1074 ret=0 1075 dig_with_opts a.bogus.example. soa @10.53.0.4 \ 1076 > dig.out.ns4.test$n || ret=1 1077 dig_with_opts +cdflag a.bogus.example. soa @10.53.0.5 \ 1078 > dig.out.ns5.test$n || ret=1 1079 digcomp dig.out.ns4.test$n dig.out.ns5.test$n || ret=1 1080 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 1081 # Note - this is looking for failure, hence the && 1082 grep "flags:.*ad.*QUERY" dig.out.ns5.test$n > /dev/null && ret=1 1083 n=$((n+1)) 1084 test "$ret" -eq 0 || echo_i "failed" 1085 status=$((status+ret)) 1086 1087 echo_i "checking cd bit on an insecurity proof ($n)" 1088 ret=0 1089 dig_with_opts +noauth a.insecure.example. soa @10.53.0.4 \ 1090 > dig.out.ns4.test$n || ret=1 1091 dig_with_opts +noauth +cdflag a.insecure.example. soa @10.53.0.5 \ 1092 > dig.out.ns5.test$n || ret=1 1093 digcomp dig.out.ns4.test$n dig.out.ns5.test$n || ret=1 1094 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 1095 # Note - these are looking for failure, hence the && 1096 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 1097 grep "flags:.*ad.*QUERY" dig.out.ns5.test$n > /dev/null && ret=1 1098 n=$((n+1)) 1099 test "$ret" -eq 0 || echo_i "failed" 1100 status=$((status+ret)) 1101 1102 echo_i "checking cd bit on a negative insecurity proof ($n)" 1103 ret=0 1104 dig_with_opts q.insecure.example. a @10.53.0.4 \ 1105 > dig.out.ns4.test$n || ret=1 1106 dig_with_opts +cdflag q.insecure.example. a @10.53.0.5 \ 1107 > dig.out.ns5.test$n || ret=1 1108 digcomp dig.out.ns4.test$n dig.out.ns5.test$n || ret=1 1109 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1 1110 # Note - these are looking for failure, hence the && 1111 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 1112 grep "flags:.*ad.*QUERY" dig.out.ns5.test$n > /dev/null && ret=1 1113 n=$((n+1)) 1114 test "$ret" -eq 0 || echo_i "failed" 1115 status=$((status+ret)) 1116 1117 echo_i "checking that validation of an ANY query works ($n)" 1118 ret=0 1119 dig_with_opts +noauth foo.example. any @10.53.0.2 > dig.out.ns2.test$n || ret=1 1120 dig_with_opts +noauth foo.example. any @10.53.0.4 > dig.out.ns4.test$n || ret=1 1121 digcomp dig.out.ns2.test$n dig.out.ns4.test$n || ret=1 1122 grep "NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 1123 # 2 records in the zone, 1 NXT, 3 SIGs 1124 grep "ANSWER: 6" dig.out.ns4.test$n > /dev/null || ret=1 1125 n=$((n+1)) 1126 test "$ret" -eq 0 || echo_i "failed" 1127 status=$((status+ret)) 1128 1129 echo_i "checking that validation of a query returning a CNAME works ($n)" 1130 ret=0 1131 dig_with_opts +noauth cname1.example. txt @10.53.0.2 \ 1132 > dig.out.ns2.test$n || ret=1 1133 dig_with_opts +noauth cname1.example. txt @10.53.0.4 \ 1134 > dig.out.ns4.test$n || ret=1 1135 digcomp dig.out.ns2.test$n dig.out.ns4.test$n || ret=1 1136 grep "NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 1137 # the CNAME & its sig, the TXT and its SIG 1138 grep "ANSWER: 4" dig.out.ns4.test$n > /dev/null || ret=1 1139 n=$((n+1)) 1140 test "$ret" -eq 0 || echo_i "failed" 1141 status=$((status+ret)) 1142 1143 echo_i "checking that validation of a query returning a DNAME works ($n)" 1144 ret=0 1145 dig_with_opts +noauth foo.dname1.example. txt @10.53.0.2 \ 1146 > dig.out.ns2.test$n || ret=1 1147 dig_with_opts +noauth foo.dname1.example. txt @10.53.0.4 \ 1148 > dig.out.ns4.test$n || ret=1 1149 digcomp dig.out.ns2.test$n dig.out.ns4.test$n || ret=1 1150 grep "NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 1151 # The DNAME & its sig, the TXT and its SIG, and the synthesized CNAME. 1152 # It would be nice to test that the CNAME is being synthesized by the 1153 # recursive server and not cached, but I don't know how. 1154 grep "ANSWER: 5" dig.out.ns4.test$n > /dev/null || ret=1 1155 n=$((n+1)) 1156 test "$ret" -eq 0 || echo_i "failed" 1157 status=$((status+ret)) 1158 1159 echo_i "checking that validation of an ANY query returning a CNAME works ($n)" 1160 ret=0 1161 dig_with_opts +noauth cname2.example. any @10.53.0.2 \ 1162 > dig.out.ns2.test$n || ret=1 1163 dig_with_opts +noauth cname2.example. any @10.53.0.4 \ 1164 > dig.out.ns4.test$n || ret=1 1165 digcomp dig.out.ns2.test$n dig.out.ns4.test$n || ret=1 1166 grep "NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 1167 # The CNAME, NXT, and their SIGs 1168 grep "ANSWER: 4" dig.out.ns4.test$n > /dev/null || ret=1 1169 n=$((n+1)) 1170 test "$ret" -eq 0 || echo_i "failed" 1171 status=$((status+ret)) 1172 1173 echo_i "checking that validation of an ANY query returning a DNAME works ($n)" 1174 ret=0 1175 dig_with_opts +noauth foo.dname2.example. any @10.53.0.2 \ 1176 > dig.out.ns2.test$n || ret=1 1177 dig_with_opts +noauth foo.dname2.example. any @10.53.0.4 \ 1178 > dig.out.ns4.test$n || ret=1 1179 digcomp dig.out.ns2.test$n dig.out.ns4.test$n || ret=1 1180 grep "NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 1181 n=$((n+1)) 1182 test "$ret" -eq 0 || echo_i "failed" 1183 status=$((status+ret)) 1184 1185 echo_i "checking that positive validation in a privately secure zone works ($n)" 1186 ret=0 1187 dig_with_opts +noauth a.private.secure.example. a @10.53.0.2 \ 1188 > dig.out.ns2.test$n || ret=1 1189 dig_with_opts +noauth a.private.secure.example. a @10.53.0.4 \ 1190 > dig.out.ns4.test$n || ret=1 1191 digcomp dig.out.ns2.test$n dig.out.ns4.test$n || ret=1 1192 grep "NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 1193 # Note - this is looking for failure, hence the && 1194 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 1195 n=$((n+1)) 1196 test "$ret" -eq 0 || echo_i "failed" 1197 status=$((status+ret)) 1198 1199 echo_i "checking that negative validation in a privately secure zone works ($n)" 1200 ret=0 1201 dig_with_opts +noauth q.private.secure.example. a @10.53.0.2 \ 1202 > dig.out.ns2.test$n || ret=1 1203 dig_with_opts +noauth q.private.secure.example. a @10.53.0.4 \ 1204 > dig.out.ns4.test$n || ret=1 1205 digcomp dig.out.ns2.test$n dig.out.ns4.test$n || ret=1 1206 grep "NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1 1207 # Note - this is looking for failure, hence the && 1208 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 1209 n=$((n+1)) 1210 test "$ret" -eq 0 || echo_i "failed" 1211 status=$((status+ret)) 1212 1213 echo_i "checking that lookups succeed after disabling an algorithm ($n)" 1214 ret=0 1215 dig_with_opts +noauth example. SOA @10.53.0.2 \ 1216 > dig.out.ns2.test$n || ret=1 1217 dig_with_opts +noauth example. SOA @10.53.0.6 \ 1218 > dig.out.ns6.test$n || ret=1 1219 digcomp dig.out.ns2.test$n dig.out.ns6.test$n || ret=1 1220 # Note - this is looking for failure, hence the && 1221 grep "flags:.*ad.*QUERY" dig.out.ns6.test$n > /dev/null && ret=1 1222 n=$((n+1)) 1223 test "$ret" -eq 0 || echo_i "failed" 1224 status=$((status+ret)) 1225 1226 echo_i "checking privately secure to nxdomain works ($n)" 1227 ret=0 1228 dig_with_opts +noauth private2secure-nxdomain.private.secure.example. SOA @10.53.0.4 \ 1229 > dig.out.ns4.test$n || ret=1 1230 grep "NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1 1231 # Note - this is looking for failure, hence the && 1232 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 1233 n=$((n+1)) 1234 test "$ret" -eq 0 || echo_i "failed" 1235 status=$((status+ret)) 1236 1237 echo_i "checking privately secure wildcard to nxdomain works ($n)" 1238 ret=0 1239 dig_with_opts +noauth a.wild.private.secure.example. SOA @10.53.0.4 \ 1240 > dig.out.ns4.test$n || ret=1 1241 grep "NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1 1242 # Note - this is looking for failure, hence the && 1243 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 1244 n=$((n+1)) 1245 test "$ret" -eq 0 || echo_i "failed" 1246 status=$((status+ret)) 1247 1248 echo_i "checking a non-cachable NODATA works ($n)" 1249 ret=0 1250 dig_with_opts +noauth a.nosoa.secure.example. txt @10.53.0.7 \ 1251 > dig.out.ns7.test$n || ret=1 1252 grep "AUTHORITY: 0" dig.out.ns7.test$n > /dev/null || ret=1 1253 dig_with_opts +noauth a.nosoa.secure.example. txt @10.53.0.4 \ 1254 > dig.out.ns4.test$n || ret=1 1255 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 1256 n=$((n+1)) 1257 test "$ret" -eq 0 || echo_i "failed" 1258 status=$((status+ret)) 1259 1260 echo_i "checking a non-cachable NXDOMAIN works ($n)" 1261 ret=0 1262 dig_with_opts +noauth b.nosoa.secure.example. txt @10.53.0.7 \ 1263 > dig.out.ns7.test$n || ret=1 1264 grep "AUTHORITY: 0" dig.out.ns7.test$n > /dev/null || ret=1 1265 dig_with_opts +noauth b.nosoa.secure.example. txt @10.53.0.4 \ 1266 > dig.out.ns4.test$n || ret=1 1267 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1 1268 n=$((n+1)) 1269 test "$ret" -eq 0 || echo_i "failed" 1270 status=$((status+ret)) 1271 1272 # 1273 # private.secure.example is served by the same server as its 1274 # grand parent and there is not a secure delegation from secure.example 1275 # to private.secure.example. In addition secure.example is using a 1276 # algorithm which the validation does not support. 1277 # 1278 echo_i "checking dnssec-lookaside-validation works ($n)" 1279 ret=0 1280 dig_with_opts private.secure.example. SOA @10.53.0.6 \ 1281 > dig.out.ns6.test$n || ret=1 1282 grep "flags:.*ad.*QUERY" dig.out.ns6.test$n > /dev/null || ret=1 1283 n=$((n+1)) 1284 test "$ret" -eq 0 || echo_i "failed" 1285 status=$((status+ret)) 1286 1287 echo_i "checking that we can load a rfc2535 signed zone ($n)" 1288 ret=0 1289 dig_with_opts rfc2535.example. SOA @10.53.0.2 \ 1290 > dig.out.ns2.test$n || ret=1 1291 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1 1292 n=$((n+1)) 1293 test "$ret" -eq 0 || echo_i "failed" 1294 status=$((status+ret)) 1295 1296 echo_i "checking that we can transfer a rfc2535 signed zone ($n)" 1297 ret=0 1298 dig_with_opts rfc2535.example. SOA @10.53.0.3 \ 1299 > dig.out.ns3.test$n || ret=1 1300 grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || ret=1 1301 n=$((n+1)) 1302 test "$ret" -eq 0 || echo_i "failed" 1303 status=$((status+ret)) 1304 1305 echo_i "basic dnssec-signzone checks:" 1306 echo_i " two DNSKEYs ($n)" 1307 ret=0 1308 ( 1309 cd signer/general || exit 1 1310 rm -f signed.zone 1311 $SIGNER -f signed.zone -o example.com. test1.zone > signer.out.$n 2>&1 1312 test -f signed.zone 1313 ) || ret=1 1314 n=$((n+1)) 1315 test "$ret" -eq 0 || echo_i "failed" 1316 status=$((status+ret)) 1317 1318 echo_i " one non-KSK DNSKEY ($n)" 1319 ret=0 1320 ( 1321 cd signer/general || exit 1 1322 rm -f signed.zone 1323 $SIGNER -f signed.zone -o example.com. test2.zone > signer.out.$n 2>&1 1324 test -f signed.zone 1325 ) && ret=1 1326 n=$((n+1)) 1327 test "$ret" -eq 0 || echo_i "failed" 1328 status=$((status+ret)) 1329 1330 echo_i " one KSK DNSKEY ($n)" 1331 ret=0 1332 ( 1333 cd signer/general || exit 1 1334 rm -f signed.zone 1335 $SIGNER -f signed.zone -o example.com. test3.zone > signer.out.$n 2>&1 1336 test -f signed.zone 1337 ) && ret=1 1338 n=$((n+1)) 1339 test "$ret" -eq 0 || echo_i "failed" 1340 status=$((status+ret)) 1341 1342 echo_i " three DNSKEY ($n)" 1343 ret=0 1344 ( 1345 cd signer/general || exit 1 1346 rm -f signed.zone 1347 $SIGNER -f signed.zone -o example.com. test4.zone > signer.out.$n 2>&1 1348 test -f signed.zone 1349 ) || ret=1 1350 n=$((n+1)) 1351 test "$ret" -eq 0 || echo_i "failed" 1352 status=$((status+ret)) 1353 1354 echo_i " three DNSKEY, one private key missing ($n)" 1355 ret=0 1356 ( 1357 cd signer/general || exit 1 1358 rm -f signed.zone 1359 $SIGNER -f signed.zone -o example.com. test5.zone > signer.out.$n 2>&1 1360 test -f signed.zone 1361 ) || ret=1 1362 n=$((n+1)) 1363 test "$ret" -eq 0 || echo_i "failed" 1364 status=$((status+ret)) 1365 1366 echo_i " four DNSKEY ($n)" 1367 ret=0 1368 ( 1369 cd signer/general || exit 1 1370 rm -f signed.zone 1371 $SIGNER -f signed.zone -o example.com. test6.zone > signer.out.$n 2>&1 1372 test -f signed.zone 1373 ) || ret=1 1374 n=$((n+1)) 1375 test "$ret" -eq 0 || echo_i "failed" 1376 status=$((status+ret)) 1377 1378 echo_i " two DNSKEY, both private keys missing ($n)" 1379 ret=0 1380 ( 1381 cd signer/general || exit 1 1382 rm -f signed.zone 1383 $SIGNER -f signed.zone -o example.com. test7.zone > signer.out.$n 2>&1 1384 test -f signed.zone 1385 ) && ret=1 1386 n=$((n+1)) 1387 test "$ret" -eq 0 || echo_i "failed" 1388 status=$((status+ret)) 1389 1390 echo_i " two DNSKEY, one private key missing ($n)" 1391 ret=0 1392 ( 1393 cd signer/general || exit 1 1394 rm -f signed.zone 1395 $SIGNER -f signed.zone -o example.com. test8.zone > signer.out.$n 2>&1 1396 test -f signed.zone 1397 ) && ret=1 1398 n=$((n+1)) 1399 test "$ret" -eq 0 || echo_i "failed" 1400 status=$((status+ret)) 1401 1402 echo_i "checking that we can sign a zone with out-of-zone records ($n)" 1403 ret=0 1404 zone=example 1405 key1=$($KEYGEN -K signer -q -a NSEC3RSASHA1 -b 1024 -n zone $zone) 1406 key2=$($KEYGEN -K signer -q -f KSK -a NSEC3RSASHA1 -b 1024 -n zone $zone) 1407 ( 1408 cd signer || exit 1 1409 cat example.db.in "$key1.key" "$key2.key" > example.db 1410 $SIGNER -o example -f example.db example.db > /dev/null 2>&1 1411 ) || ret=1 1412 n=$((n+1)) 1413 test "$ret" -eq 0 || echo_i "failed" 1414 status=$((status+ret)) 1415 1416 echo_i "checking that we can sign a zone (NSEC3) with out-of-zone records ($n)" 1417 ret=0 1418 zone=example 1419 key1=$($KEYGEN -K signer -q -a NSEC3RSASHA1 -b 1024 -n zone $zone) 1420 key2=$($KEYGEN -K signer -q -f KSK -a NSEC3RSASHA1 -b 1024 -n zone $zone) 1421 ( 1422 cd signer || exit 1 1423 cat example.db.in "$key1.key" "$key2.key" > example.db 1424 $SIGNER -3 - -H 10 -o example -f example.db example.db > /dev/null 2>&1 1425 awk '/^IQF9LQTLK/ { 1426 printf("%s", $0); 1427 while (!index($0, ")")) { 1428 if (getline <= 0) 1429 break; 1430 printf (" %s", $0); 1431 } 1432 printf("\n"); 1433 }' example.db | sed 's/[ ][ ]*/ /g' > nsec3param.out 1434 1435 grep "IQF9LQTLKKNFK0KVIFELRAK4IC4QLTMG.example. 0 IN NSEC3 1 0 10 - ( IQF9LQTLKKNFK0KVIFELRAK4IC4QLTMG A NS SOA RRSIG DNSKEY NSEC3PARAM )" nsec3param.out > /dev/null 1436 ) || ret=1 1437 n=$((n+1)) 1438 test "$ret" -eq 0 || echo_i "failed" 1439 status=$((status+ret)) 1440 1441 echo_i "checking NSEC3 signing with empty nonterminals above a delegation ($n)" 1442 ret=0 1443 zone=example 1444 key1=$($KEYGEN -K signer -q -a NSEC3RSASHA1 -b 1024 -n zone $zone) 1445 key2=$($KEYGEN -K signer -q -f KSK -a NSEC3RSASHA1 -b 1024 -n zone $zone) 1446 ( 1447 cd signer || exit 1 1448 cat example.db.in "$key1.key" "$key2.key" > example3.db 1449 echo "some.empty.nonterminal.nodes.example 60 IN NS ns.example.tld" >> example3.db 1450 $SIGNER -3 - -A -H 10 -o example -f example3.db example3.db > /dev/null 2>&1 1451 awk '/^IQF9LQTLK/ { 1452 printf("%s", $0); 1453 while (!index($0, ")")) { 1454 if (getline <= 0) 1455 break; 1456 printf (" %s", $0); 1457 } 1458 printf("\n"); 1459 }' example.db | sed 's/[ ][ ]*/ /g' > nsec3param.out 1460 1461 grep "IQF9LQTLKKNFK0KVIFELRAK4IC4QLTMG.example. 0 IN NSEC3 1 0 10 - ( IQF9LQTLKKNFK0KVIFELRAK4IC4QLTMG A NS SOA RRSIG DNSKEY NSEC3PARAM )" nsec3param.out > /dev/null 1462 ) || ret=1 1463 n=$((n+1)) 1464 test "$ret" -eq 0 || echo_i "failed" 1465 status=$((status+ret)) 1466 1467 echo_i "checking that dnsssec-signzone updates originalttl on ttl changes ($n)" 1468 ret=0 1469 zone=example 1470 key1=$($KEYGEN -K signer -q -a RSASHA1 -b 1024 -n zone $zone) 1471 key2=$($KEYGEN -K signer -q -f KSK -a RSASHA1 -b 1024 -n zone $zone) 1472 ( 1473 cd signer || exit 1 1474 cat example.db.in "$key1.key" "$key2.key" > example.db 1475 $SIGNER -o example -f example.db.before example.db > /dev/null 2>&1 1476 sed 's/60.IN.SOA./50 IN SOA /' example.db.before > example.db.changed 1477 $SIGNER -o example -f example.db.after example.db.changed > /dev/null 2>&1 1478 ) 1479 grep "SOA 5 1 50" signer/example.db.after > /dev/null || ret=1 1480 n=$((n+1)) 1481 test "$ret" -eq 0 || echo_i "failed" 1482 status=$((status+ret)) 1483 1484 echo_i "checking dnssec-signzone keeps valid signatures from removed keys ($n)" 1485 ret=0 1486 zone=example 1487 key1=$($KEYGEN -K signer -q -f KSK -a RSASHA1 -b 1024 -n zone $zone) 1488 key2=$($KEYGEN -K signer -q -a RSASHA1 -b 1024 -n zone $zone) 1489 keyid2=$(echo "$key2" | sed 's/^Kexample.+005+0*\([0-9]\)/\1/') 1490 key3=$($KEYGEN -K signer -q -a RSASHA1 -b 1024 -n zone $zone) 1491 keyid3=$(echo "$key3" | sed 's/^Kexample.+005+0*\([0-9]\)/\1/') 1492 ( 1493 cd signer || exit 1 1494 cat example.db.in "$key1.key" "$key2.key" > example.db 1495 $SIGNER -D -o example example.db > /dev/null 2>&1 1496 1497 # now switch out key2 for key3 and resign the zone 1498 cat example.db.in "$key1.key" "$key3.key" > example.db 1499 echo "\$INCLUDE \"example.db.signed\"" >> example.db 1500 $SIGNER -D -o example example.db > /dev/null 2>&1 1501 ) || ret=1 1502 grep " $keyid2 " signer/example.db.signed > /dev/null 2>&1 || ret=1 1503 grep " $keyid3 " signer/example.db.signed > /dev/null 2>&1 || ret=1 1504 n=$((n+1)) 1505 test "$ret" -eq 0 || echo_i "failed" 1506 status=$((status+ret)) 1507 1508 echo_i "checking dnssec-signzone -R purges signatures from removed keys ($n)" 1509 ret=0 1510 ( 1511 cd signer || exit 1 1512 $SIGNER -RD -o example example.db > /dev/null 2>&1 1513 ) || ret=1 1514 grep " $keyid2 " signer/example.db.signed > /dev/null 2>&1 && ret=1 1515 grep " $keyid3 " signer/example.db.signed > /dev/null 2>&1 || ret=1 1516 n=$((n+1)) 1517 test "$ret" -eq 0 || echo_i "failed" 1518 status=$((status+ret)) 1519 1520 echo_i "checking dnssec-signzone keeps valid signatures from inactive keys ($n)" 1521 ret=0 1522 zone=example 1523 ( 1524 cd signer || exit 1 1525 cp -f example.db.in example.db 1526 $SIGNER -SD -o example example.db > /dev/null 2>&1 1527 echo "\$INCLUDE \"example.db.signed\"" >> example.db 1528 # now retire key2 and resign the zone 1529 $SETTIME -I now "$key2" > /dev/null 2>&1 1530 $SIGNER -SD -o example example.db > /dev/null 2>&1 1531 ) || ret=1 1532 grep " $keyid2 " signer/example.db.signed > /dev/null 2>&1 || ret=1 1533 grep " $keyid3 " signer/example.db.signed > /dev/null 2>&1 || ret=1 1534 n=$((n+1)) 1535 test "$ret" -eq 0 || echo_i "failed" 1536 status=$((status+ret)) 1537 1538 echo_i "checking dnssec-signzone -Q purges signatures from inactive keys ($n)" 1539 ret=0 1540 ( 1541 cd signer || exit 1 1542 $SIGNER -SDQ -o example example.db > /dev/null 2>&1 1543 ) || ret=1 1544 grep " $keyid2 " signer/example.db.signed > /dev/null 2>&1 && ret=1 1545 grep " $keyid3 " signer/example.db.signed > /dev/null 2>&1 || ret=1 1546 n=$((n+1)) 1547 test "$ret" -eq 0 || echo_i "failed" 1548 status=$((status+ret)) 1549 1550 echo_i "checking dnssec-signzone retains unexpired signatures ($n)" 1551 ret=0 1552 ( 1553 cd signer || exit 1 1554 $SIGNER -Sxt -o example example.db > signer.out.1 2>&1 1555 $SIGNER -Sxt -o example -f example.db.signed example.db.signed > signer.out.2 2>&1 1556 ) || ret=1 1557 gen1=$(awk '/generated/ {print $3}' signer/signer.out.1) 1558 retain1=$(awk '/retained/ {print $3}' signer/signer.out.1) 1559 gen2=$(awk '/generated/ {print $3}' signer/signer.out.2) 1560 retain2=$(awk '/retained/ {print $3}' signer/signer.out.2) 1561 drop2=$(awk '/dropped/ {print $3}' signer/signer.out.2) 1562 [ "$retain2" -eq $((gen1+retain1)) ] || ret=1 1563 [ "$gen2" -eq 0 ] || ret=1 1564 [ "$drop2" -eq 0 ] || ret=1 1565 n=$((n+1)) 1566 test "$ret" -eq 0 || echo_i "failed" 1567 status=$((status+ret)) 1568 1569 echo_i "checking dnssec-signzone purges RRSIGs from formerly-owned glue (nsec) ($n)" 1570 ret=0 1571 ( 1572 cd signer || exit 1 1573 # remove NSEC-only keys 1574 rm -f Kexample.+005* 1575 cp -f example.db.in example2.db 1576 cat << EOF >> example2.db 1577 sub1.example. IN A 10.53.0.1 1578 ns.sub2.example. IN A 10.53.0.2 1579 EOF 1580 echo "\$INCLUDE \"example2.db.signed\"" >> example2.db 1581 touch example2.db.signed 1582 $SIGNER -DS -O full -f example2.db.signed -o example example2.db > /dev/null 2>&1 1583 ) || ret=1 1584 grep "^sub1\\.example\\..*RRSIG[ ]A[ ]" signer/example2.db.signed > /dev/null 2>&1 || ret=1 1585 grep "^ns\\.sub2\\.example\\..*RRSIG[ ]A[ ]" signer/example2.db.signed > /dev/null 2>&1 || ret=1 1586 ( 1587 cd signer || exit 1 1588 cp -f example.db.in example2.db 1589 cat << EOF >> example2.db 1590 sub1.example. IN NS sub1.example. 1591 sub1.example. IN A 10.53.0.1 1592 sub2.example. IN NS ns.sub2.example. 1593 ns.sub2.example. IN A 10.53.0.2 1594 EOF 1595 echo "\$INCLUDE \"example2.db.signed\"" >> example2.db 1596 $SIGNER -DS -O full -f example2.db.signed -o example example2.db > /dev/null 2>&1 1597 ) || ret=1 1598 grep "^sub1\\.example\\..*RRSIG[ ]A[ ]" signer/example2.db.signed > /dev/null 2>&1 && ret=1 1599 grep "^ns\\.sub2\\.example\\..*RRSIG[ ]A[ ]" signer/example2.db.signed > /dev/null 2>&1 && ret=1 1600 n=$((n+1)) 1601 test "$ret" -eq 0 || echo_i "failed" 1602 status=$((status+ret)) 1603 1604 echo_i "checking dnssec-signzone purges RRSIGs from formerly-owned glue (nsec3) ($n)" 1605 ret=0 1606 ( 1607 cd signer || exit 1 1608 rm -f example2.db.signed 1609 cp -f example.db.in example2.db 1610 cat << EOF >> example2.db 1611 sub1.example. IN A 10.53.0.1 1612 ns.sub2.example. IN A 10.53.0.2 1613 EOF 1614 echo "\$INCLUDE \"example2.db.signed\"" >> example2.db 1615 touch example2.db.signed 1616 $SIGNER -DS -3 feedabee -O full -f example2.db.signed -o example example2.db > /dev/null 2>&1 1617 ) || ret=1 1618 grep "^sub1\\.example\\..*RRSIG[ ]A[ ]" signer/example2.db.signed > /dev/null 2>&1 || ret=1 1619 grep "^ns\\.sub2\\.example\\..*RRSIG[ ]A[ ]" signer/example2.db.signed > /dev/null 2>&1 || ret=1 1620 ( 1621 cd signer || exit 1 1622 cp -f example.db.in example2.db 1623 cat << EOF >> example2.db 1624 sub1.example. IN NS sub1.example. 1625 sub1.example. IN A 10.53.0.1 1626 sub2.example. IN NS ns.sub2.example. 1627 ns.sub2.example. IN A 10.53.0.2 1628 EOF 1629 echo "\$INCLUDE \"example2.db.signed\"" >> example2.db 1630 $SIGNER -DS -3 feedabee -O full -f example2.db.signed -o example example2.db > /dev/null 2>&1 1631 ) || ret=1 1632 grep "^sub1\\.example\\..*RRSIG[ ]A[ ]" signer/example2.db.signed > /dev/null 2>&1 && ret=1 1633 grep "^ns\\.sub2\\.example\\..*RRSIG[ ]A[ ]" signer/example2.db.signed > /dev/null 2>&1 && ret=1 1634 n=$((n+1)) 1635 test "$ret" -eq 0 || echo_i "failed" 1636 status=$((status+ret)) 1637 1638 echo_i "checking dnssec-signzone output format ($n)" 1639 ret=0 1640 ( 1641 cd signer || exit 1 1642 $SIGNER -O full -f - -Sxt -o example example.db > signer.out.3 2> /dev/null 1643 $SIGNER -O text -f - -Sxt -o example example.db > signer.out.4 2> /dev/null 1644 $SIGNER -O raw -f signer.out.5 -Sxt -o example example.db > /dev/null 2>&1 1645 $SIGNER -O raw=0 -f signer.out.6 -Sxt -o example example.db > /dev/null 2>&1 1646 $SIGNER -O raw -f - -Sxt -o example example.db > signer.out.7 2> /dev/null 1647 ) || ret=1 1648 awk '/IN *SOA/ {if (NF != 11) exit(1)}' signer/signer.out.3 || ret=1 1649 awk '/IN *SOA/ {if (NF != 7) exit(1)}' signer/signer.out.4 || ret=1 1650 israw1 signer/signer.out.5 || ret=1 1651 israw0 signer/signer.out.6 || ret=1 1652 israw1 signer/signer.out.7 || ret=1 1653 n=$((n+1)) 1654 test "$ret" -eq 0 || echo_i "failed" 1655 status=$((status+ret)) 1656 1657 echo_i "checking TTLs are capped by dnssec-signzone -M ($n)" 1658 ret=0 1659 ( 1660 cd signer || exit 1 1661 $SIGNER -O full -f signer.out.8 -S -M 30 -o example example.db > /dev/null 2>&1 1662 ) || ret=1 1663 awk '/^;/ { next; } $2 > 30 { exit 1; }' signer/signer.out.8 || ret=1 1664 n=$((n+1)) 1665 test "$ret" -eq 0 || echo_i "failed" 1666 status=$((status+ret)) 1667 1668 echo_i "checking dnssec-signzone -N date ($n)" 1669 ret=0 1670 ( 1671 cd signer || exit 1 1672 TZ=UTC $SIGNER -O full -f signer.out.9 -S -N date -o example example2.db > /dev/null 2>&1 1673 ) || ret=1 1674 # shellcheck disable=SC2016 1675 now=$(TZ=UTC $PERL -e '@lt=localtime(); printf "%.4d%0.2d%0.2d00\n",$lt[5]+1900,$lt[4]+1,$lt[3];') 1676 serial=$(awk '/^;/ { next; } $4 == "SOA" { print $7 }' signer/signer.out.9) 1677 [ "$now" -eq "$serial" ] || ret=1 1678 n=$((n+1)) 1679 test "$ret" -eq 0 || echo_i "failed" 1680 status=$((status+ret)) 1681 1682 echo_i "checking validated data are not cached longer than originalttl ($n)" 1683 ret=0 1684 dig_with_opts +ttl +noauth a.ttlpatch.example. @10.53.0.3 a > dig.out.ns3.test$n || ret=1 1685 dig_with_opts +ttl +noauth a.ttlpatch.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1 1686 grep "3600.IN" dig.out.ns3.test$n > /dev/null || ret=1 1687 grep "300.IN" dig.out.ns3.test$n > /dev/null && ret=1 1688 grep "300.IN" dig.out.ns4.test$n > /dev/null || ret=1 1689 grep "3600.IN" dig.out.ns4.test$n > /dev/null && ret=1 1690 n=$((n+1)) 1691 test "$ret" -eq 0 || echo_i "failed" 1692 status=$((status+ret)) 1693 1694 # Test that "rndc secroots" is able to dump trusted keys 1695 echo_i "checking rndc secroots ($n)" 1696 ret=0 1697 rndccmd 10.53.0.4 secroots 2>&1 | sed 's/^/ns4 /' | cat_i 1698 keyid=$(cat ns1/managed.key.id) 1699 cp ns4/named.secroots named.secroots.test$n 1700 linecount=$(grep -c "./${DEFAULT_ALGORITHM}/$keyid ; trusted" named.secroots.test$n || true) 1701 [ "$linecount" -eq 1 ] || ret=1 1702 linecount=$(< named.secroots.test$n wc -l) 1703 [ "$linecount" -eq 10 ] || ret=1 1704 n=$((n+1)) 1705 test "$ret" -eq 0 || echo_i "failed" 1706 status=$((status+ret)) 1707 1708 # Check direct query for RRSIG. If we first ask for normal (non RRSIG) 1709 # record, the corresponding RRSIG should be cached and subsequent query 1710 # for RRSIG will be returned with the cached record. 1711 echo_i "checking RRSIG query from cache ($n)" 1712 ret=0 1713 dig_with_opts normalthenrrsig.secure.example. @10.53.0.4 a > /dev/null || ret=1 1714 ans=$(dig_with_opts +short normalthenrrsig.secure.example. @10.53.0.4 rrsig) || ret=1 1715 expect=$(dig_with_opts +short normalthenrrsig.secure.example. @10.53.0.3 rrsig | grep '^A' ) || ret=1 1716 test "$ans" = "$expect" || ret=1 1717 # also check that RA is set 1718 dig_with_opts normalthenrrsig.secure.example. @10.53.0.4 rrsig > dig.out.ns4.test$n || ret=1 1719 grep "flags:.*ra.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 1720 n=$((n+1)) 1721 test "$ret" -eq 0 || echo_i "failed" 1722 status=$((status+ret)) 1723 1724 # Check direct query for RRSIG: If it's not cached with other records, 1725 # it should result in an empty response. 1726 echo_i "checking RRSIG query not in cache ($n)" 1727 ret=0 1728 ans=$(dig_with_opts +short rrsigonly.secure.example. @10.53.0.4 rrsig) || ret=1 1729 test -z "$ans" || ret=1 1730 # also check that RA is cleared 1731 dig_with_opts rrsigonly.secure.example. @10.53.0.4 rrsig > dig.out.ns4.test$n || ret=1 1732 grep "flags:.*ra.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 1733 n=$((n+1)) 1734 test "$ret" -eq 0 || echo_i "failed" 1735 status=$((status+ret)) 1736 1737 # 1738 # RT21868 regression test. 1739 # 1740 echo_i "checking NSEC3 zone with mismatched NSEC3PARAM / NSEC parameters ($n)" 1741 ret=0 1742 dig_with_opts non-exist.badparam. @10.53.0.2 a > dig.out.ns2.test$n || ret=1 1743 grep "status: NXDOMAIN" dig.out.ns2.test$n > /dev/null || ret=1 1744 n=$((n+1)) 1745 test "$ret" -eq 0 || echo_i "failed" 1746 status=$((status+ret)) 1747 1748 # 1749 # RT22007 regression test. 1750 # 1751 echo_i "checking optout NSEC3 referral with only insecure delegations ($n)" 1752 ret=0 1753 dig_with_opts +norec delegation.single-nsec3. @10.53.0.2 a > dig.out.ns2.test$n || ret=1 1754 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1 1755 grep "3KL3NK1HKQ4IUEEHBEF12VGFKUETNBAN.*NSEC3 1 1 1 - 3KL3NK1HKQ4IUEEHBEF12VGFKUETNBAN" dig.out.ns2.test$n > /dev/null || ret=1 1756 n=$((n+1)) 1757 test "$ret" -eq 0 || echo_i "failed" 1758 status=$((status+ret)) 1759 1760 echo_i "checking optout NSEC3 NXDOMAIN with only insecure delegations ($n)" 1761 ret=0 1762 dig_with_opts +norec nonexist.single-nsec3. @10.53.0.2 a > dig.out.ns2.test$n || ret=1 1763 grep "status: NXDOMAIN" dig.out.ns2.test$n > /dev/null || ret=1 1764 grep "3KL3NK1HKQ4IUEEHBEF12VGFKUETNBAN.*NSEC3 1 1 1 - 3KL3NK1HKQ4IUEEHBEF12VGFKUETNBAN" dig.out.ns2.test$n > /dev/null || ret=1 1765 n=$((n+1)) 1766 test "$ret" -eq 0 || echo_i "failed" 1767 1768 status=$((status+ret)) 1769 echo_i "checking optout NSEC3 nodata with only insecure delegations ($n)" 1770 ret=0 1771 dig_with_opts +norec single-nsec3. @10.53.0.2 a > dig.out.ns2.test$n || ret=1 1772 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1 1773 grep "3KL3NK1HKQ4IUEEHBEF12VGFKUETNBAN.*NSEC3 1 1 1 - 3KL3NK1HKQ4IUEEHBEF12VGFKUETNBAN" dig.out.ns2.test$n > /dev/null || ret=1 1774 n=$((n+1)) 1775 test "$ret" -eq 0 || echo_i "failed" 1776 status=$((status+ret)) 1777 1778 echo_i "checking that a zone finishing the transition from $ALTERNATIVE_ALGORITHM to $DEFAULT_ALGORITHM validates secure ($n)" 1779 ret=0 1780 dig_with_opts ns algroll. @10.53.0.4 > dig.out.ns4.test$n || ret=1 1781 grep "NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 1782 grep "flags:[^;]* ad[^;]*;" dig.out.ns4.test$n > /dev/null || ret=1 1783 n=$((n+1)) 1784 test "$ret" -eq 0 || echo_i "failed" 1785 status=$((status+ret)) 1786 1787 echo_i "checking validate-except in an insecure local domain ($n)" 1788 ret=0 1789 dig_with_opts ns www.corp @10.53.0.4 > dig.out.ns4.test$n || ret=1 1790 grep "NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 1791 grep "flags:[^;]* ad[^;]*;" dig.out.ns4.test$n > /dev/null && ret=1 1792 n=$((n+1)) 1793 test "$ret" -eq 0 || echo_i "failed" 1794 status=$((status+ret)) 1795 1796 echo_i "checking positive and negative validation with negative trust anchors ($n)" 1797 ret=0 1798 1799 # 1800 # check correct initial behavior 1801 # 1802 dig_with_opts a.bogus.example. a @10.53.0.4 > dig.out.ns4.test$n.1 || ret=1 1803 grep "status: SERVFAIL" dig.out.ns4.test$n.1 > /dev/null || ret=1 1804 dig_with_opts badds.example. soa @10.53.0.4 > dig.out.ns4.test$n.2 || ret=1 1805 grep "status: SERVFAIL" dig.out.ns4.test$n.2 > /dev/null || ret=1 1806 dig_with_opts a.secure.example. a @10.53.0.4 > dig.out.ns4.test$n.3 || ret=1 1807 grep "status: SERVFAIL" dig.out.ns4.test$n.3 > /dev/null && ret=1 1808 grep "flags:[^;]* ad[^;]*;" dig.out.ns4.test$n.3 > /dev/null || ret=1 1809 1810 if [ "$ret" -ne 0 ]; then echo_i "failed - checking initial state"; fi 1811 status=$((status+ret)) 1812 ret=0 1813 1814 # 1815 # add negative trust anchors 1816 # 1817 rndccmd 10.53.0.4 nta -f -l 20s bogus.example 2>&1 | sed 's/^/ns4 /' | cat_i 1818 rndccmd 10.53.0.4 nta badds.example 2>&1 | sed 's/^/ns4 /' | cat_i 1819 # reconfig should maintain NTAs 1820 rndccmd 10.53.0.4 reconfig 2>&1 | sed 's/^/ns4 /' | cat_i 1821 rndccmd 10.53.0.4 nta -d > rndc.out.ns4.test$n.1 1822 lines=$(wc -l < rndc.out.ns4.test$n.1) 1823 [ "$lines" -eq 2 ] || ret=1 1824 rndccmd 10.53.0.4 nta secure.example 2>&1 | sed 's/^/ns4 /' | cat_i 1825 rndccmd 10.53.0.4 nta fakenode.secure.example 2>&1 | sed 's/^/ns4 /' | cat_i 1826 # reload should maintain NTAs 1827 rndc_reload ns4 10.53.0.4 1828 rndccmd 10.53.0.4 nta -d > rndc.out.ns4.test$n.2 1829 lines=$(wc -l < rndc.out.ns4.test$n.2) 1830 [ "$lines" -eq 4 ] || ret=1 1831 # shellcheck disable=SC2016 1832 start=$($PERL -e 'print time()."\n";') 1833 1834 if [ "$ret" -ne 0 ]; then echo_i "failed - adding NTA's failed"; fi 1835 status=$((status+ret)) 1836 ret=0 1837 1838 # 1839 # check behavior with NTA's in place 1840 # 1841 dig_with_opts a.bogus.example. a @10.53.0.4 > dig.out.ns4.test$n.4 || ret=1 1842 grep "status: SERVFAIL" dig.out.ns4.test$n.4 > /dev/null && ret=1 1843 grep "flags:[^;]* ad[^;]*;" dig.out.ns4.test$n.4 > /dev/null && ret=1 1844 dig_with_opts badds.example. soa @10.53.0.4 > dig.out.ns4.test$n.5 || ret=1 1845 grep "status: SERVFAIL" dig.out.ns4.test$n.5 > /dev/null && ret=1 1846 grep "flags:[^;]* ad[^;]*;" dig.out.ns4.test$n.5 > /dev/null && ret=1 1847 dig_with_opts a.secure.example. a @10.53.0.4 > dig.out.ns4.test$n.6 || ret=1 1848 grep "status: SERVFAIL" dig.out.ns4.test$n.6 > /dev/null && ret=1 1849 grep "flags:[^;]* ad[^;]*;" dig.out.ns4.test$n.6 > /dev/null && ret=1 1850 dig_with_opts a.fakenode.secure.example. a @10.53.0.4 > dig.out.ns4.test$n.7 || ret=1 1851 grep "flags:[^;]* ad[^;]*;" dig.out.ns4.test$n.7 > /dev/null && ret=1 1852 echo_i "dumping secroots" 1853 rndccmd 10.53.0.4 secroots | sed 's/^/ns4 /' | cat_i 1854 grep "bogus.example: expiry" ns4/named.secroots > /dev/null || ret=1 1855 grep "badds.example: expiry" ns4/named.secroots > /dev/null || ret=1 1856 grep "secure.example: expiry" ns4/named.secroots > /dev/null || ret=1 1857 grep "fakenode.secure.example: expiry" ns4/named.secroots > /dev/null || ret=1 1858 1859 if [ "$ret" -ne 0 ]; then echo_i "failed - with NTA's in place failed"; fi 1860 status=$((status+ret)) 1861 ret=0 1862 1863 echo_i "waiting for NTA rechecks/expirations" 1864 1865 # 1866 # secure.example and badds.example used default nta-duration 1867 # (configured as 10s in ns4/named1.conf), but nta recheck interval 1868 # is configured to 7s, so at t=8 the NTAs for secure.example and 1869 # fakenode.secure.example should both be lifted, but badds.example 1870 # should still be going. 1871 # 1872 # shellcheck disable=SC2016 1873 $PERL -e 'my $delay = '"$start"' + 10 - time(); select(undef, undef, undef, $delay) if ($delay > 0);' 1874 dig_with_opts b.secure.example. a @10.53.0.4 > dig.out.ns4.test$n.8 || ret=1 1875 grep "status: SERVFAIL" dig.out.ns4.test$n.8 > /dev/null && ret=1 1876 grep "flags:[^;]* ad[^;]*;" dig.out.ns4.test$n.8 > /dev/null || ret=1 1877 dig_with_opts b.fakenode.secure.example. a @10.53.0.4 > dig.out.ns4.test$n.9 || ret=1 1878 grep "flags:[^;]* ad[^;]*;" dig.out.ns4.test$n.9 > /dev/null || ret=1 1879 grep "status: NXDOMAIN" dig.out.ns4.test$n.9 > /dev/null || ret=1 1880 dig_with_opts badds.example. soa @10.53.0.4 > dig.out.ns4.test$n.10 || ret=1 1881 grep "status: SERVFAIL" dig.out.ns4.test$n.10 > /dev/null && ret=1 1882 grep "flags:[^;]* ad[^;]*;" dig.out.ns4.test$n.10 > /dev/null && ret=1 1883 1884 if [ "$ret" -ne 0 ]; then echo_i "failed - checking that default nta's were lifted due to recheck"; fi 1885 status=$((status+ret)) 1886 ret=0 1887 1888 # 1889 # bogus.example was set to expire in 20s, so at t=11 1890 # it should still be NTA'd, but badds.example used the default 1891 # lifetime of 10s, so it should revert to SERVFAIL now. 1892 # 1893 # shellcheck disable=SC2016 1894 $PERL -e 'my $delay = '"$start"' + 13 - time(); select(undef, undef, undef, $delay) if ($delay > 0);' 1895 # check nta table 1896 rndccmd 10.53.0.4 nta -d > rndc.out.ns4.test$n._11 1897 lines=$(grep -c " expiry " rndc.out.ns4.test$n._11 || true) 1898 [ "$lines" -le 2 ] || ret=1 1899 grep "bogus.example/_default: expiry" rndc.out.ns4.test$n._11 > /dev/null || ret=1 1900 grep "badds.example/_default: expiry" rndc.out.ns4.test$n._11 > /dev/null && ret=1 1901 dig_with_opts b.bogus.example. a @10.53.0.4 > dig.out.ns4.test$n.11 || ret=1 1902 grep "status: SERVFAIL" dig.out.ns4.test$n.11 > /dev/null && ret=1 1903 dig_with_opts a.badds.example. a @10.53.0.4 > dig.out.ns4.test$n.12 || ret=1 1904 grep "status: SERVFAIL" dig.out.ns4.test$n.12 > /dev/null || ret=1 1905 grep "flags:[^;]* ad[^;]*;" dig.out.ns4.test$n.12 > /dev/null && ret=1 1906 dig_with_opts c.secure.example. a @10.53.0.4 > dig.out.ns4.test$n.13 || ret=1 1907 grep "status: SERVFAIL" dig.out.ns4.test$n.13 > /dev/null && ret=1 1908 grep "flags:[^;]* ad[^;]*;" dig.out.ns4.test$n.13 > /dev/null || ret=1 1909 1910 if [ "$ret" -ne 0 ]; then echo_i "failed - checking that default nta's were lifted due to lifetime"; fi 1911 status=$((status+ret)) 1912 ret=0 1913 1914 # 1915 # at t=21, all the NTAs should have expired. 1916 # 1917 # shellcheck disable=SC2016 1918 $PERL -e 'my $delay = '"$start"' + 21 - time(); select(undef, undef, undef, $delay) if ($delay > 0);' 1919 # check correct behavior after bogus.example expiry 1920 dig_with_opts d.secure.example. a @10.53.0.4 > dig.out.ns4.test$n.14 || ret=1 1921 grep "status: SERVFAIL" dig.out.ns4.test$n.14 > /dev/null && ret=1 1922 grep "flags:[^;]* ad[^;]*;" dig.out.ns4.test$n.14 > /dev/null || ret=1 1923 dig_with_opts c.bogus.example. a @10.53.0.4 > dig.out.ns4.test$n.15 || ret=1 1924 grep "status: SERVFAIL" dig.out.ns4.test$n.15 > /dev/null || ret=1 1925 # check nta table has been cleaned up now 1926 rndccmd 10.53.0.4 nta -d > rndc.out.ns4.test$n.3 1927 lines=$(grep -c " expiry " rndc.out.ns4.test$n.3 || true) 1928 [ "$lines" -eq 0 ] || ret=1 1929 n=$((n+1)) 1930 if [ "$ret" -ne 0 ]; then echo_i "failed - checking that all nta's have been lifted"; fi 1931 status=$((status+ret)) 1932 ret=0 1933 1934 echo_i "testing NTA removals ($n)" 1935 rndccmd 10.53.0.4 nta badds.example 2>&1 | sed 's/^/ns4 /' | cat_i 1936 rndccmd 10.53.0.4 nta -d > rndc.out.ns4.test$n.1 1937 grep "badds.example/_default: expiry" rndc.out.ns4.test$n.1 > /dev/null || ret=1 1938 dig_with_opts a.badds.example. a @10.53.0.4 > dig.out.ns4.test$n.1 || ret=1 1939 grep "status: SERVFAIL" dig.out.ns4.test$n.1 > /dev/null && ret=1 1940 grep "^a.badds.example." dig.out.ns4.test$n.1 > /dev/null || ret=1 1941 rndccmd 10.53.0.4 nta -remove badds.example > rndc.out.ns4.test$n.2 1942 grep "Negative trust anchor removed: badds.example/_default" rndc.out.ns4.test$n.2 > /dev/null || ret=1 1943 rndccmd 10.53.0.4 nta -d > rndc.out.ns4.test$n.3 1944 grep "badds.example/_default: expiry" rndc.out.ns4.test$n.3 > /dev/null && ret=1 1945 dig_with_opts a.badds.example. a @10.53.0.4 > dig.out.ns4.test$n.2 || ret=1 1946 grep "status: SERVFAIL" dig.out.ns4.test$n.2 > /dev/null || ret=1 1947 test "$ret" -eq 0 || echo_i "failed" 1948 status=$((status+ret)) 1949 ret=0 1950 1951 echo_i "remove non-existent NTA three times" 1952 rndccmd 10.53.0.4 nta -r foo > rndc.out.ns4.test$n.4 2>&1 1953 rndccmd 10.53.0.4 nta -remove foo > rndc.out.ns4.test$n.5 2>&1 1954 rndccmd 10.53.0.4 nta -r foo > rndc.out.ns4.test$n.6 2>&1 1955 grep "not found" rndc.out.ns4.test$n.6 > /dev/null || ret=1 1956 test "$ret" -eq 0 || echo_i "failed" 1957 status=$((status+ret)) 1958 ret=0 1959 1960 n=$((n+1)) 1961 echo_i "testing NTA with bogus lifetimes ($n)" 1962 echo_i "check with no nta lifetime specified" 1963 rndccmd 10.53.0.4 nta -l "" foo > rndc.out.ns4.test$n.1 2>&1 || true 1964 grep "'nta' failed: bad ttl" rndc.out.ns4.test$n.1 > /dev/null || ret=1 1965 test "$ret" -eq 0 || echo_i "failed" 1966 status=$((status+ret)) 1967 ret=0 1968 1969 echo_i "check with bad nta lifetime" 1970 rndccmd 10.53.0.4 nta -l garbage foo > rndc.out.ns4.test$n.2 2>&1 || true 1971 grep "'nta' failed: bad ttl" rndc.out.ns4.test$n.2 > /dev/null || ret=1 1972 test "$ret" -eq 0 || echo_i "failed" 1973 status=$((status+ret)) 1974 ret=0 1975 1976 echo_i "check with too long nta lifetime" 1977 rndccmd 10.53.0.4 nta -l 7d1h foo > rndc.out.ns4.test$n.3 2>&1 || true 1978 grep "'nta' failed: out of range" rndc.out.ns4.test$n.3 > /dev/null || ret=1 1979 test "$ret" -eq 0 || echo_i "failed" 1980 status=$((status+ret)) 1981 ret=0 1982 1983 # 1984 # check NTA persistence across restarts 1985 # 1986 n=$((n+1)) 1987 echo_i "testing NTA persistence across restarts ($n)" 1988 rndccmd 10.53.0.4 nta -d > rndc.out.ns4.test$n.1 1989 lines=$(grep -c " expiry " rndc.out.ns4.test$n.1 || true) 1990 [ "$lines" -eq 0 ] || ret=1 1991 rndccmd 10.53.0.4 nta -f -l 30s bogus.example 2>&1 | sed 's/^/ns4 /' | cat_i 1992 rndccmd 10.53.0.4 nta -f -l 10s badds.example 2>&1 | sed 's/^/ns4 /' | cat_i 1993 rndccmd 10.53.0.4 nta -d > rndc.out.ns4.test$n.2 1994 lines=$(grep -c " expiry " rndc.out.ns4.test$n.2 || true) 1995 [ "$lines" -eq 2 ] || ret=1 1996 # shellcheck disable=SC2016 1997 start=$($PERL -e 'print time()."\n";') 1998 1999 if [ "$ret" -ne 0 ]; then echo_i "failed - NTA persistence: adding NTA's failed"; fi 2000 status=$((status+ret)) 2001 ret=0 2002 2003 echo_i "killing ns4 with SIGTERM" 2004 $KILL -TERM "$(cat ns4/named.pid)" 2005 rm -f ns4/named.pid 2006 2007 # 2008 # ns4 has now shutdown. wait until t=14 when badds.example's NTA 2009 # (lifetime=10s) would have expired, and then restart ns4. 2010 # 2011 echo_i "waiting till 14s have passed since NTAs were added before restarting ns4" 2012 # shellcheck disable=SC2016 2013 $PERL -e 'my $delay = '"$start"' + 14 - time(); select(undef, undef, undef, $delay) if ($delay > 0);' 2014 2015 if 2016 $PERL "$SYSTEMTESTTOP/start.pl" --noclean --restart --port "$PORT" dnssec ns4 2017 then 2018 echo_i "restarted server ns4" 2019 else 2020 echo_i "could not restart server ns4" 2021 exit 1 2022 fi 2023 2024 echo_i "sleeping for an additional 4 seconds for ns4 to fully startup" 2025 sleep 4 2026 2027 # 2028 # ns4 should be back up now. The NTA for bogus.example should still be 2029 # valid, whereas badds.example should not have been added during named 2030 # startup (as it had already expired), the fact that it's ignored should 2031 # be logged. 2032 # 2033 rndccmd 10.53.0.4 nta -d > rndc.out.ns4.test$n.3 2034 lines=$(wc -l < rndc.out.ns4.test$n.3) 2035 [ "$lines" -eq 1 ] || ret=1 2036 grep "bogus.example/_default: expiry" rndc.out.ns4.test$n.3 > /dev/null || ret=1 2037 dig_with_opts b.bogus.example. a @10.53.0.4 > dig.out.ns4.test$n.4 || ret=1 2038 grep "status: SERVFAIL" dig.out.ns4.test$n.4 > /dev/null && ret=1 2039 grep "flags:[^;]* ad[^;]*;" dig.out.ns4.test$n.4 > /dev/null && ret=1 2040 dig_with_opts a.badds.example. a @10.53.0.4 > dig.out.ns4.test$n.5 || ret=1 2041 grep "status: SERVFAIL" dig.out.ns4.test$n.5 > /dev/null || ret=1 2042 grep "ignoring expired NTA at badds.example" ns4/named.run > /dev/null || ret=1 2043 2044 # cleanup 2045 rndccmd 10.53.0.4 nta -remove bogus.example > rndc.out.ns4.test$n.6 2046 2047 if [ "$ret" -ne 0 ]; then echo_i "failed - NTA persistence: restoring NTA failed"; fi 2048 status=$((status+ret)) 2049 ret=0 2050 2051 # 2052 # check "regular" attribute in NTA file works as expected at named 2053 # startup. 2054 # 2055 n=$((n+1)) 2056 echo_i "testing loading regular attribute from NTA file ($n)" 2057 rndccmd 10.53.0.4 nta -d > rndc.out.ns4.test$n.1 2>/dev/null 2058 lines=$(wc -l < rndc.out.ns4.test$n.1) 2059 [ "$lines" -eq 0 ] || ret=1 2060 # initially, secure.example. validates with AD=1 2061 dig_with_opts a.secure.example. a @10.53.0.4 > dig.out.ns4.test$n.2 || ret=1 2062 grep "status: SERVFAIL" dig.out.ns4.test$n.2 > /dev/null && ret=1 2063 grep "flags:[^;]* ad[^;]*;" dig.out.ns4.test$n.2 > /dev/null || ret=1 2064 2065 echo_i "killing ns4 with SIGTERM" 2066 $KILL -TERM "$(cat ns4/named.pid)" 2067 rm -f ns4/named.pid 2068 2069 echo_i "sleeping for an additional 4 seconds for ns4 to fully shutdown" 2070 sleep 4 2071 2072 # 2073 # ns4 has now shutdown. add NTA for secure.example. directly into the 2074 # _default.nta file with the regular attribute and some future timestamp. 2075 # 2076 future="$(($(date +%Y)+20))0101010000" 2077 echo "secure.example. regular $future" > ns4/_default.nta 2078 # shellcheck disable=SC2016 2079 start=$($PERL -e 'print time()."\n";') 2080 2081 if 2082 $PERL "$SYSTEMTESTTOP/start.pl" --noclean --restart --port "$PORT" dnssec ns4 2083 then 2084 echo_i "restarted server ns4" 2085 else 2086 echo_i "could not restart server ns4" 2087 exit 1 2088 fi 2089 2090 # nta-recheck is configured as 7s, so at t=10 the NTAs for 2091 # secure.example. should be lifted as it is not a forced NTA. 2092 echo_i "waiting till 10s have passed after ns4 was restarted" 2093 # shellcheck disable=SC2016 2094 $PERL -e 'my $delay = '"$start"' + 10 - time(); select(undef, undef, undef, $delay) if ($delay > 0);' 2095 2096 # secure.example. should now return an AD=1 answer (still validates) as 2097 # the NTA has been lifted. 2098 dig_with_opts a.secure.example. a @10.53.0.4 > dig.out.ns4.test$n.3 || ret=1 2099 grep "status: SERVFAIL" dig.out.ns4.test$n.3 > /dev/null && ret=1 2100 grep "flags:[^;]* ad[^;]*;" dig.out.ns4.test$n.3 > /dev/null || ret=1 2101 2102 # cleanup 2103 rndccmd 10.53.0.4 nta -remove secure.example > rndc.out.ns4.test$n.4 2>/dev/null 2104 2105 if [ "$ret" -ne 0 ]; then echo_i "failed - NTA persistence: loading regular NTAs failed"; fi 2106 status=$((status+ret)) 2107 ret=0 2108 2109 # 2110 # check "forced" attribute in NTA file works as expected at named 2111 # startup. 2112 # 2113 n=$((n+1)) 2114 echo_i "testing loading forced attribute from NTA file ($n)" 2115 rndccmd 10.53.0.4 nta -d > rndc.out.ns4.test$n.1 2>/dev/null 2116 lines=$(wc -l < rndc.out.ns4.test$n.1) 2117 [ "$lines" -eq 0 ] || ret=1 2118 # initially, secure.example. validates with AD=1 2119 dig_with_opts a.secure.example. a @10.53.0.4 > dig.out.ns4.test$n.2 || ret=1 2120 grep "status: SERVFAIL" dig.out.ns4.test$n.2 > /dev/null && ret=1 2121 grep "flags:[^;]* ad[^;]*;" dig.out.ns4.test$n.2 > /dev/null || ret=1 2122 2123 echo_i "killing ns4 with SIGTERM" 2124 $KILL -TERM "$(cat ns4/named.pid)" 2125 rm -f named.pid 2126 2127 echo_i "sleeping for an additional 4 seconds for ns4 to fully shutdown" 2128 sleep 4 2129 2130 # 2131 # ns4 has now shutdown. add NTA for secure.example. directly into the 2132 # _default.nta file with the forced attribute and some future timestamp. 2133 # 2134 echo "secure.example. forced $future" > ns4/_default.nta 2135 start=$($PERL -e 'print time()."\n";') 2136 2137 if 2138 $PERL "$SYSTEMTESTTOP/start.pl" --noclean --restart --port "$PORT" dnssec ns4 2139 then 2140 echo_i "restarted server ns4" 2141 else 2142 echo_i "could not restart server ns4" 2143 exit 1 2144 fi 2145 2146 # nta-recheck is configured as 7s, but even at t=10 the NTAs for 2147 # secure.example. should not be lifted as it is a forced NTA. 2148 echo_i "waiting till 10s have passed after ns4 was restarted" 2149 # shellcheck disable=SC2016 2150 $PERL -e 'my $delay = '"$start"' + 10 - time(); select(undef, undef, undef, $delay) if ($delay > 0);' 2151 2152 # secure.example. should now return an AD=0 answer (non-authenticated) 2153 # as the NTA is still there. 2154 dig_with_opts a.secure.example. a @10.53.0.4 > dig.out.ns4.test$n.3 || ret=1 2155 grep "status: SERVFAIL" dig.out.ns4.test$n.3 > /dev/null && ret=1 2156 grep "flags:[^;]* ad[^;]*;" dig.out.ns4.test$n.3 > /dev/null && ret=1 2157 2158 # cleanup 2159 rndccmd 10.53.0.4 nta -remove secure.example > rndc.out.ns4.test$n.4 2>/dev/null 2160 2161 if [ "$ret" -ne 0 ]; then echo_i "failed - NTA persistence: loading forced NTAs failed"; fi 2162 status=$((status+ret)) 2163 ret=0 2164 2165 # 2166 # check that NTA lifetime read from file is clamped to 1 week. 2167 # 2168 n=$((n+1)) 2169 echo_i "testing loading out of bounds lifetime from NTA file ($n)" 2170 2171 echo_i "killing ns4 with SIGTERM" 2172 $KILL -TERM "$(cat ns4/named.pid)" 2173 rm -f ns4/named.pid 2174 2175 echo_i "sleeping for an additional 4 seconds for ns4 to fully shutdown" 2176 sleep 4 2177 2178 # 2179 # ns4 has now shutdown. add NTA for secure.example. directly into the 2180 # _default.nta file with a lifetime well into the future. 2181 # 2182 echo "secure.example. forced $future" > ns4/_default.nta 2183 added=$($PERL -e 'print time()."\n";') 2184 2185 if 2186 $PERL "$SYSTEMTESTTOP/start.pl" --noclean --restart --port "$PORT" dnssec ns4 2187 then 2188 echo_i "restarted server ns4" 2189 else 2190 echo_i "could not restart server ns4" 2191 exit 1 2192 fi 2193 2194 echo_i "sleeping for an additional 4 seconds for ns4 to fully startup" 2195 sleep 4 2196 2197 # dump the NTA to a file (omit validate-except entries) 2198 echo_i "testing 'rndc nta'" 2199 rndccmd 10.53.0.4 nta -d > rndc.out.ns4.test$n.1 2>/dev/null 2200 # "corp" is configured as a validate-except domain and thus should be 2201 # omitted. only "secure.example" should be in the dump at this point. 2202 lines=$(wc -l < rndc.out.ns4.test$n.1) 2203 [ "$lines" -eq 1 ] || ret=1 2204 grep 'secure.example' rndc.out.ns4.test$n.1 > /dev/null || ret=1 2205 ts=$(awk '{print $3" "$4}' < rndc.out.ns4.test$n.1) 2206 # rndc nta outputs localtime, so append the timezone 2207 ts_with_zone="$ts $(date +%z)" 2208 echo "ts=$ts" > rndc.out.ns4.test$n.2 2209 echo "ts_with_zone=$ts_with_zone" >> rndc.out.ns4.test$n.2 2210 echo "added=$added" >> rndc.out.ns4.test$n.2 2211 if $PERL -e 'use Time::Piece; use Time::Seconds;' 2>/dev/null 2212 then 2213 # ntadiff.pl computes $ts_with_zone - ($added + 1week) 2214 d=$($PERL ./ntadiff.pl "$ts_with_zone" "$added") 2215 echo "d=$d" >> rndc.out.ns4.test$n.2 2216 # diff from $added(now) + 1week to the clamped NTA lifetime should be 2217 # less than a few seconds (handle daylight saving changes by adding 3600). 2218 [ "$d" -lt 3610 ] || ret=1 2219 else 2220 echo_i "skipped ntadiff test; install PERL module Time::Piece" 2221 fi 2222 2223 # cleanup 2224 rndccmd 10.53.0.4 nta -remove secure.example > rndc.out.ns4.test$n.3 2>/dev/null 2225 2226 if [ "$ret" -ne 0 ]; then echo_i "failed - NTA lifetime clamping failed"; fi 2227 status=$((status+ret)) 2228 ret=0 2229 2230 echo_i "completed NTA tests" 2231 2232 # Run a minimal update test if possible. This is really just 2233 # a regression test for RT #2399; more tests should be added. 2234 2235 if $PERL -e 'use Net::DNS;' 2>/dev/null 2236 then 2237 echo_i "running DNSSEC update test" 2238 ret=0 2239 output=$($PERL dnssec_update_test.pl -s 10.53.0.3 -p "$PORT" dynamic.example.) 2240 test "$?" -eq 0 || ret=1 2241 echo "$output" | cat_i 2242 [ $ret -eq 1 ] && status=1 2243 else 2244 echo_i "The DNSSEC update test requires the Net::DNS library." >&2 2245 fi 2246 2247 n=$((n+1)) 2248 echo_i "checking managed key maintenance has not started yet ($n)" 2249 ret=0 2250 [ -f "ns4/managed-keys.bind.jnl" ] && ret=1 2251 n=$((n+1)) 2252 test "$ret" -eq 0 || echo_i "failed" 2253 status=$((status+ret)) 2254 2255 # Reconfigure caching server to use "dnssec-validation auto", and repeat 2256 # some of the DNSSEC validation tests to ensure that it works correctly. 2257 echo_i "switching to automatic root key configuration" 2258 copy_setports ns4/named2.conf.in ns4/named.conf 2259 rndccmd 10.53.0.4 reconfig 2>&1 | sed 's/^/ns4 /' | cat_i 2260 sleep 5 2261 2262 echo_i "checking managed key maintenance timer has now started ($n)" 2263 ret=0 2264 [ -f "ns4/managed-keys.bind.jnl" ] || ret=1 2265 n=$((n+1)) 2266 test "$ret" -eq 0 || echo_i "failed" 2267 status=$((status+ret)) 2268 2269 echo_i "checking positive validation NSEC ($n)" 2270 ret=0 2271 dig_with_opts +noauth a.example. @10.53.0.2 a > dig.out.ns2.test$n || ret=1 2272 dig_with_opts +noauth a.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1 2273 digcomp dig.out.ns2.test$n dig.out.ns4.test$n || ret=1 2274 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 2275 n=$((n+1)) 2276 test "$ret" -eq 0 || echo_i "failed" 2277 status=$((status+ret)) 2278 2279 echo_i "checking positive validation NSEC3 ($n)" 2280 ret=0 2281 dig_with_opts +noauth a.nsec3.example. \ 2282 @10.53.0.3 a > dig.out.ns3.test$n || ret=1 2283 dig_with_opts +noauth a.nsec3.example. \ 2284 @10.53.0.4 a > dig.out.ns4.test$n || ret=1 2285 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 2286 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 2287 n=$((n+1)) 2288 test "$ret" -eq 0 || echo_i "failed" 2289 status=$((status+ret)) 2290 2291 echo_i "checking positive validation OPTOUT ($n)" 2292 ret=0 2293 dig_with_opts +noauth a.optout.example. \ 2294 @10.53.0.3 a > dig.out.ns3.test$n || ret=1 2295 dig_with_opts +noauth a.optout.example. \ 2296 @10.53.0.4 a > dig.out.ns4.test$n || ret=1 2297 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 2298 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 2299 n=$((n+1)) 2300 test "$ret" -eq 0 || echo_i "failed" 2301 status=$((status+ret)) 2302 2303 echo_i "checking negative validation ($n)" 2304 ret=0 2305 dig_with_opts +noauth q.example. @10.53.0.2 a > dig.out.ns2.test$n || ret=1 2306 dig_with_opts +noauth q.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1 2307 digcomp dig.out.ns2.test$n dig.out.ns4.test$n || ret=1 2308 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 2309 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1 2310 n=$((n+1)) 2311 test "$ret" -eq 0 || echo_i "failed" 2312 status=$((status+ret)) 2313 2314 echo_i "checking that root DS queries validate ($n)" 2315 ret=0 2316 dig_with_opts +noauth . @10.53.0.1 ds > dig.out.ns1.test$n || ret=1 2317 dig_with_opts +noauth . @10.53.0.4 ds > dig.out.ns4.test$n || ret=1 2318 digcomp dig.out.ns1.test$n dig.out.ns4.test$n || ret=1 2319 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 2320 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 2321 n=$((n+1)) 2322 test "$ret" -eq 0 || echo_i "failed" 2323 status=$((status+ret)) 2324 2325 echo_i "checking that DS at a RFC 1918 empty zone lookup succeeds ($n)" 2326 ret=0 2327 dig_with_opts +noauth 10.in-addr.arpa ds @10.53.0.2 >dig.out.ns2.test$n || ret=1 2328 dig_with_opts +noauth 10.in-addr.arpa ds @10.53.0.6 >dig.out.ns6.test$n || ret=1 2329 digcomp dig.out.ns2.test$n dig.out.ns6.test$n || ret=1 2330 grep "status: NOERROR" dig.out.ns6.test$n > /dev/null || ret=1 2331 n=$((n+1)) 2332 test "$ret" -eq 0 || echo_i "failed" 2333 status=$((status+ret)) 2334 2335 echo_i "checking expired signatures remain with "'"allow-update { none; };"'" and no keys available ($n)" 2336 ret=0 2337 dig_with_opts +noauth expired.example. +dnssec @10.53.0.3 soa > dig.out.ns3.test$n || ret=1 2338 grep "RRSIG.SOA" dig.out.ns3.test$n > /dev/null || ret=1 2339 n=$((n+1)) 2340 test "$ret" -eq 0 || echo_i "failed" 2341 2342 status=$((status+ret)) 2343 echo_i "checking expired signatures do not validate ($n)" 2344 ret=0 2345 dig_with_opts +noauth expired.example. +dnssec @10.53.0.4 soa > dig.out.ns4.test$n || ret=1 2346 grep "SERVFAIL" dig.out.ns4.test$n > /dev/null || ret=1 2347 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 2348 grep "expired.example/.*: RRSIG has expired" ns4/named.run > /dev/null || ret=1 2349 n=$((n+1)) 2350 test "$ret" -eq 0 || echo_i "failed" 2351 status=$((status+ret)) 2352 2353 echo_i "checking that the NSEC3 record for the apex is properly signed when a DNSKEY is added via UPDATE ($n)" 2354 ret=0 2355 ( 2356 cd ns3 || exit 1 2357 kskname=$($KEYGEN -q -3 -a RSASHA1 -fk update-nsec3.example) 2358 ( 2359 echo zone update-nsec3.example 2360 echo server 10.53.0.3 "$PORT" 2361 grep DNSKEY "${kskname}.key" | sed -e 's/^/update add /' -e 's/IN/300 IN/' 2362 echo send 2363 ) | $NSUPDATE 2364 ) 2365 dig_with_opts +dnssec a update-nsec3.example. @10.53.0.4 > dig.out.ns4.test$n || ret=1 2366 grep "NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 2367 grep "flags:.* ad[ ;]" dig.out.ns4.test$n > /dev/null || ret=1 2368 grep "NSEC3 .* TYPE65534" dig.out.ns4.test$n > /dev/null || ret=1 2369 n=$((n+1)) 2370 test "$ret" -eq 0 || echo_i "failed" 2371 status=$((status+ret)) 2372 2373 echo_i "checking that the NSEC record is properly generated when DNSKEY are added via auto-dnssec ($n)" 2374 ret=0 2375 dig_with_opts +dnssec a auto-nsec.example. @10.53.0.4 > dig.out.ns4.test$n || ret=1 2376 grep "NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 2377 grep "flags:.* ad[ ;]" dig.out.ns4.test$n > /dev/null || ret=1 2378 grep "IN.NSEC[^3].* DNSKEY" dig.out.ns4.test$n > /dev/null || ret=1 2379 n=$((n+1)) 2380 test "$ret" -eq 0 || echo_i "failed" 2381 status=$((status+ret)) 2382 2383 echo_i "checking that the NSEC3 record is properly generated when DNSKEY are added via auto-dnssec ($n)" 2384 ret=0 2385 dig_with_opts +dnssec a auto-nsec3.example. @10.53.0.4 > dig.out.ns4.test$n || ret=1 2386 grep "NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 2387 grep "flags:.* ad[ ;]" dig.out.ns4.test$n > /dev/null || ret=1 2388 grep "IN.NSEC3 .* DNSKEY" dig.out.ns4.test$n > /dev/null || ret=1 2389 n=$((n+1)) 2390 test "$ret" -eq 0 || echo_i "failed" 2391 status=$((status+ret)) 2392 2393 echo_i "checking that signing records have been marked as complete ($n)" 2394 ret=0 2395 checkprivate dynamic.example 10.53.0.3 || ret=1 2396 checkprivate update-nsec3.example 10.53.0.3 || ret=1 2397 checkprivate auto-nsec3.example 10.53.0.3 || ret=1 2398 checkprivate expiring.example 10.53.0.3 || ret=1 2399 checkprivate auto-nsec.example 10.53.0.3 || ret=1 2400 n=$((n+1)) 2401 test "$ret" -eq 0 || echo_i "failed" 2402 status=$((status+ret)) 2403 2404 echo_i "check that 'rndc signing' without arguments is handled ($n)" 2405 ret=0 2406 rndccmd 10.53.0.3 signing > /dev/null 2>&1 && ret=1 2407 rndccmd 10.53.0.3 status > /dev/null || ret=1 2408 n=$((n+1)) 2409 test "$ret" -eq 0 || echo_i "failed" 2410 status=$((status+ret)) 2411 2412 echo_i "check that 'rndc signing -list' without zone is handled ($n)" 2413 ret=0 2414 rndccmd 10.53.0.3 signing -list > /dev/null 2>&1 && ret=1 2415 rndccmd 10.53.0.3 status > /dev/null || ret=1 2416 n=$((n+1)) 2417 test "$ret" -eq 0 || echo_i "failed" 2418 status=$((status+ret)) 2419 2420 echo_i "check that 'rndc signing -clear' without additional arguments is handled ($n)" 2421 ret=0 2422 rndccmd 10.53.0.3 signing -clear > /dev/null 2>&1 && ret=1 2423 rndccmd 10.53.0.3 status > /dev/null || ret=1 2424 n=$((n+1)) 2425 test "$ret" -eq 0 || echo_i "failed" 2426 status=$((status+ret)) 2427 2428 echo_i "check that 'rndc signing -clear all' without zone is handled ($n)" 2429 ret=0 2430 rndccmd 10.53.0.3 signing -clear all > /dev/null 2>&1 && ret=1 2431 rndccmd 10.53.0.3 status > /dev/null || ret=1 2432 n=$((n+1)) 2433 test "$ret" -eq 0 || echo_i "failed" 2434 status=$((status+ret)) 2435 2436 echo_i "check that 'rndc signing -nsec3param' without additional arguments is handled ($n)" 2437 ret=0 2438 rndccmd 10.53.0.3 signing -nsec3param > /dev/null 2>&1 && ret=1 2439 rndccmd 10.53.0.3 status > /dev/null || ret=1 2440 n=$((n+1)) 2441 test "$ret" -eq 0 || echo_i "failed" 2442 status=$((status+ret)) 2443 2444 echo_i "check that 'rndc signing -nsec3param none' without zone is handled ($n)" 2445 ret=0 2446 rndccmd 10.53.0.3 signing -nsec3param none > /dev/null 2>&1 && ret=1 2447 rndccmd 10.53.0.3 status > /dev/null || ret=1 2448 n=$((n+1)) 2449 test "$ret" -eq 0 || echo_i "failed" 2450 status=$((status+ret)) 2451 2452 echo_i "check that 'rndc signing -nsec3param 1' without additional arguments is handled ($n)" 2453 ret=0 2454 rndccmd 10.53.0.3 signing -nsec3param 1 > /dev/null 2>&1 && ret=1 2455 rndccmd 10.53.0.3 status > /dev/null || ret=1 2456 n=$((n+1)) 2457 test "$ret" -eq 0 || echo_i "failed" 2458 status=$((status+ret)) 2459 2460 echo_i "check that 'rndc signing -nsec3param 1 0' without additional arguments is handled ($n)" 2461 ret=0 2462 rndccmd 10.53.0.3 signing -nsec3param 1 0 > /dev/null 2>&1 && ret=1 2463 rndccmd 10.53.0.3 status > /dev/null || ret=1 2464 n=$((n+1)) 2465 test "$ret" -eq 0 || echo_i "failed" 2466 status=$((status+ret)) 2467 2468 echo_i "check that 'rndc signing -nsec3param 1 0 0' without additional arguments is handled ($n)" 2469 ret=0 2470 rndccmd 10.53.0.3 signing -nsec3param 1 0 0 > /dev/null 2>&1 && ret=1 2471 rndccmd 10.53.0.3 status > /dev/null || ret=1 2472 n=$((n+1)) 2473 test "$ret" -eq 0 || echo_i "failed" 2474 status=$((status+ret)) 2475 2476 echo_i "check that 'rndc signing -nsec3param 1 0 0 -' without zone is handled ($n)" 2477 ret=0 2478 rndccmd 10.53.0.3 signing -nsec3param 1 0 0 - > /dev/null 2>&1 && ret=1 2479 rndccmd 10.53.0.3 status > /dev/null || ret=1 2480 n=$((n+1)) 2481 test "$ret" -eq 0 || echo_i "failed" 2482 status=$((status+ret)) 2483 2484 echo_i "check that 'rndc signing -nsec3param' works with salt ($n)" 2485 ret=0 2486 rndccmd 10.53.0.3 signing -nsec3param 1 0 0 ffff inline.example > /dev/null 2>&1 || ret=1 2487 rndccmd 10.53.0.3 status > /dev/null || ret=1 2488 for i in 1 2 3 4 5 6 7 8 9 10 ; do 2489 salt=$(dig_with_opts +nodnssec +short nsec3param inline.example. @10.53.0.3 | awk '{print $4}') 2490 if [ "$salt" = "FFFF" ]; then 2491 break; 2492 fi 2493 echo_i "sleeping ...." 2494 sleep 1 2495 done; 2496 [ "$salt" = "FFFF" ] || ret=1 2497 n=$((n+1)) 2498 test "$ret" -eq 0 || echo_i "failed" 2499 status=$((status+ret)) 2500 2501 echo_i "check that 'rndc signing -nsec3param' works without salt ($n)" 2502 ret=0 2503 rndccmd 10.53.0.3 signing -nsec3param 1 0 0 - inline.example > /dev/null 2>&1 || ret=1 2504 rndccmd 10.53.0.3 status > /dev/null || ret=1 2505 for i in 1 2 3 4 5 6 7 8 9 10 ; do 2506 salt=$(dig_with_opts +nodnssec +short nsec3param inline.example. @10.53.0.3 | awk '{print $4}') 2507 if [ "$salt" = "-" ]; then 2508 break; 2509 fi 2510 echo_i "sleeping ...." 2511 sleep 1 2512 done; 2513 [ "$salt" = "-" ] || ret=1 2514 n=$((n+1)) 2515 test "$ret" -eq 0 || echo_i "failed" 2516 status=$((status+ret)) 2517 2518 echo_i "check that 'rndc signing -nsec3param' works with 'auto' as salt ($n)" 2519 ret=0 2520 rndccmd 10.53.0.3 signing -nsec3param 1 0 0 auto inline.example > /dev/null 2>&1 || ret=1 2521 rndccmd 10.53.0.3 status > /dev/null || ret=1 2522 for i in 1 2 3 4 5 6 7 8 9 10 ; do 2523 salt=$(dig_with_opts +nodnssec +short nsec3param inline.example. @10.53.0.3 | awk '{print $4}') 2524 [ -n "$salt" ] && [ "$salt" != "-" ] && break 2525 echo_i "sleeping ...." 2526 sleep 1 2527 done; 2528 [ "$salt" != "-" ] || ret=1 2529 [ "${#salt}" -eq 16 ] || ret=1 2530 n=$((n+1)) 2531 test "$ret" -eq 0 || echo_i "failed" 2532 status=$((status+ret)) 2533 2534 echo_i "check that 'rndc signing -nsec3param' with 'auto' as salt again generates a different salt ($n)" 2535 ret=0 2536 oldsalt=$salt 2537 rndccmd 10.53.0.3 signing -nsec3param 1 0 0 auto inline.example > /dev/null 2>&1 || ret=1 2538 rndccmd 10.53.0.3 status > /dev/null || ret=1 2539 for i in 1 2 3 4 5 6 7 8 9 10 ; do 2540 salt=$(dig_with_opts +nodnssec +short nsec3param inline.example. @10.53.0.3 | awk '{print $4}') 2541 [ -n "$salt" ] && [ "$salt" != "$oldsalt" ] && break 2542 echo_i "sleeping ...." 2543 sleep 1 2544 done; 2545 [ "$salt" != "$oldsalt" ] || ret=1 2546 [ "${#salt}" -eq 16 ] || ret=1 2547 n=$((n+1)) 2548 test "$ret" -eq 0 || echo_i "failed" 2549 status=$((status+ret)) 2550 2551 echo_i "check rndc signing -list output ($n)" 2552 ret=0 2553 { rndccmd 10.53.0.3 signing -list dynamic.example > signing.out; } 2>&1 2554 grep -q "No signing records found" signing.out || { 2555 ret=1 2556 sed 's/^/ns3 /' signing.out | cat_i 2557 } 2558 { rndccmd 10.53.0.3 signing -list update-nsec3.example > signing.out; } 2>&1 2559 grep -q "Done signing with key .*/NSEC3RSASHA1" signing.out || { 2560 ret=1 2561 sed 's/^/ns3 /' signing.out | cat_i 2562 } 2563 n=$((n+1)) 2564 test "$ret" -eq 0 || echo_i "failed" 2565 status=$((status+ret)) 2566 2567 echo_i "clear signing records ($n)" 2568 { rndccmd 10.53.0.3 signing -clear all update-nsec3.example > /dev/null; } 2>&1 || ret=1 2569 sleep 1 2570 { rndccmd 10.53.0.3 signing -list update-nsec3.example > signing.out; } 2>&1 2571 grep -q "No signing records found" signing.out || { 2572 ret=1 2573 sed 's/^/ns3 /' signing.out | cat_i 2574 } 2575 n=$((n+1)) 2576 test "$ret" -eq 0 || echo_i "failed" 2577 status=$((status+ret)) 2578 2579 echo_i "checking that a insecure zone beneath a cname resolves ($n)" 2580 ret=0 2581 dig_with_opts soa insecure.below-cname.example. @10.53.0.4 > dig.out.ns4.test$n || ret=1 2582 grep "NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 2583 grep "ANSWER: 1," dig.out.ns4.test$n > /dev/null || ret=1 2584 n=$((n+1)) 2585 test "$ret" -eq 0 || echo_i "failed" 2586 status=$((status+ret)) 2587 2588 echo_i "checking that a secure zone beneath a cname resolves ($n)" 2589 ret=0 2590 dig_with_opts soa secure.below-cname.example. @10.53.0.4 > dig.out.ns4.test$n || ret=1 2591 grep "NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 2592 grep "ANSWER: 2," dig.out.ns4.test$n > /dev/null || ret=1 2593 grep "flags:.* ad[ ;]" dig.out.ns4.test$n > /dev/null || ret=1 2594 n=$((n+1)) 2595 test "$ret" -eq 0 || echo_i "failed" 2596 status=$((status+ret)) 2597 2598 my_dig() { 2599 "$DIG" +noadd +nosea +nostat +noquest +nocomm +nocmd -p "$PORT" @10.53.0.4 "$@" 2600 } 2601 2602 echo_i "checking dnskey query with no data still gets put in cache ($n)" 2603 ret=0 2604 firstVal=$(my_dig insecure.example. dnskey| awk '$1 != ";;" { print $2 }') 2605 sleep 1 2606 secondVal=$(my_dig insecure.example. dnskey| awk '$1 != ";;" { print $2 }') 2607 if [ "${firstVal:-0}" -eq "${secondVal:-0}" ] 2608 then 2609 sleep 1 2610 thirdVal=$(my_dig insecure.example. dnskey|awk '$1 != ";;" { print $2 }') 2611 if [ "${firstVal:-0}" -eq "${thirdVal:-0}" ] 2612 then 2613 echo_i "cannot confirm query answer still in cache" 2614 ret=1 2615 fi 2616 fi 2617 n=$((n+1)) 2618 test "$ret" -eq 0 || echo_i "failed" 2619 status=$((status+ret)) 2620 2621 echo_i "check that a split dnssec dnssec-signzone work ($n)" 2622 ret=0 2623 dig_with_opts soa split-dnssec.example. @10.53.0.4 > dig.out.ns4.test$n || ret=1 2624 grep "NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 2625 grep "ANSWER: 2," dig.out.ns4.test$n > /dev/null || ret=1 2626 grep "flags:.* ad[ ;]" dig.out.ns4.test$n > /dev/null || ret=1 2627 n=$((n+1)) 2628 test "$ret" -eq 0 || echo_i "failed" 2629 status=$((status+ret)) 2630 2631 echo_i "check that a smart split dnssec dnssec-signzone work ($n)" 2632 ret=0 2633 dig_with_opts soa split-smart.example. @10.53.0.4 > dig.out.ns4.test$n || ret=1 2634 grep "NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 2635 grep "ANSWER: 2," dig.out.ns4.test$n > /dev/null || ret=1 2636 grep "flags:.* ad[ ;]" dig.out.ns4.test$n > /dev/null || ret=1 2637 n=$((n+1)) 2638 test "$ret" -eq 0 || echo_i "failed" 2639 status=$((status+ret)) 2640 2641 echo_i "check that NOTIFY is sent at the end of NSEC3 chain generation ($n)" 2642 ret=0 2643 ( 2644 echo zone nsec3chain-test 2645 echo server 10.53.0.2 "$PORT" 2646 echo update add nsec3chain-test. 0 nsec3param 1 0 1 123456 2647 echo send 2648 ) | $NSUPDATE 2649 for i in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 2650 do 2651 dig_with_opts nsec3param nsec3chain-test @10.53.0.2 > dig.out.ns2.test$n || ret=1 2652 if grep "ANSWER: 3," dig.out.ns2.test$n >/dev/null 2653 then 2654 break; 2655 fi 2656 echo_i "sleeping ...." 2657 sleep 3 2658 done; 2659 grep "ANSWER: 3," dig.out.ns2.test$n > /dev/null || ret=1 2660 if [ "$ret" -ne 0 ]; then echo_i "nsec3 chain generation not complete"; fi 2661 dig_with_opts +noauth +nodnssec soa nsec3chain-test @10.53.0.2 > dig.out.ns2.test$n || ret=1 2662 s2=$(awk '$4 == "SOA" { print $7}' dig.out.ns2.test$n) 2663 for i in 1 2 3 4 5 6 7 8 9 10 2664 do 2665 dig_with_opts +noauth +nodnssec soa nsec3chain-test @10.53.0.3 > dig.out.ns3.test$n || ret=1 2666 s3=$(awk '$4 == "SOA" { print $7}' dig.out.ns3.test$n) 2667 test "$s2" = "$s3" && break 2668 sleep 1 2669 done 2670 digcomp dig.out.ns2.test$n dig.out.ns3.test$n || ret=1 2671 n=$((n+1)) 2672 test "$ret" -eq 0 || echo_i "failed" 2673 status=$((status+ret)) 2674 2675 echo_i "check dnssec-dsfromkey from stdin ($n)" 2676 ret=0 2677 dig_with_opts dnskey algroll. @10.53.0.2 | \ 2678 $DSFROMKEY -f - algroll. > dig.out.ns2.test$n || ret=1 2679 NF=$(awk '{print NF}' dig.out.ns2.test$n | sort -u) 2680 [ "${NF}" = 7 ] || ret=1 2681 # make canonical 2682 awk '{ 2683 for (i=1;i<7;i++) printf("%s ", $i); 2684 for (i=7;i<=NF;i++) printf("%s", $i); 2685 printf("\n"); 2686 }' < dig.out.ns2.test$n > canonical1.$n || ret=1 2687 awk '{ 2688 for (i=1;i<7;i++) printf("%s ", $i); 2689 for (i=7;i<=NF;i++) printf("%s", $i); 2690 printf("\n"); 2691 }' < ns1/dsset-algroll$TP > canonical2.$n || ret=1 2692 $DIFF -b canonical1.$n canonical2.$n > /dev/null 2>&1 || ret=1 2693 n=$((n+1)) 2694 test "$ret" -eq 0 || echo_i "failed" 2695 status=$((status+ret)) 2696 2697 # Intentionally strip ".key" from keyfile name to ensure the error message 2698 # includes it anyway to avoid confusion (RT #21731) 2699 echo_i "check dnssec-dsfromkey error message when keyfile is not found ($n)" 2700 ret=0 2701 key=$($KEYGEN -a RSASHA1 -q example.) || ret=1 2702 mv "$key.key" "$key" 2703 $DSFROMKEY "$key" > dsfromkey.out.$n 2>&1 && ret=1 2704 grep "$key.key: file not found" dsfromkey.out.$n > /dev/null || ret=1 2705 n=$((n+1)) 2706 test "$ret" -eq 0 || echo_i "failed" 2707 status=$((status+ret)) 2708 2709 echo_i "testing soon-to-expire RRSIGs without a replacement private key ($n)" 2710 ret=0 2711 dig_with_answeropts +nottlid expiring.example ns @10.53.0.3 | grep RRSIG > dig.out.ns3.test$n 2>&1 2712 # there must be a signature here 2713 [ -s dig.out.ns3.test$n ] || ret=1 2714 n=$((n+1)) 2715 test "$ret" -eq 0 || echo_i "failed" 2716 status=$((status+ret)) 2717 2718 echo_i "testing new records are signed with 'no-resign' ($n)" 2719 ret=0 2720 ( 2721 echo zone nosign.example 2722 echo server 10.53.0.3 "$PORT" 2723 echo update add new.nosign.example 300 in txt "hi there" 2724 echo send 2725 ) | $NSUPDATE 2726 sleep 1 2727 dig_with_answeropts +nottlid txt new.nosign.example @10.53.0.3 \ 2728 > dig.out.ns3.test$n 2>&1 2729 grep RRSIG dig.out.ns3.test$n > /dev/null 2>&1 || ret=1 2730 n=$((n+1)) 2731 test "$ret" -eq 0 || echo_i "failed" 2732 status=$((status+ret)) 2733 2734 echo_i "testing expiring records aren't resigned with 'no-resign' ($n)" 2735 ret=0 2736 dig_with_answeropts +nottlid nosign.example ns @10.53.0.3 | \ 2737 grep RRSIG | sed 's/[ ][ ]*/ /g' > dig.out.ns3.test$n 2>&1 2738 # the NS RRSIG should not be changed 2739 $DIFF nosign.before dig.out.ns3.test$n > /dev/null|| ret=1 2740 n=$((n+1)) 2741 test "$ret" -eq 0 || echo_i "failed" 2742 status=$((status+ret)) 2743 2744 echo_i "testing updates fail with no private key ($n)" 2745 ret=0 2746 rm -f ns3/Knosign.example.*.private 2747 ( 2748 echo zone nosign.example 2749 echo server 10.53.0.3 "$PORT" 2750 echo update add fail.nosign.example 300 in txt "reject me" 2751 echo send 2752 ) | $NSUPDATE > /dev/null 2>&1 && ret=1 2753 dig_with_answeropts +nottlid fail.nosign.example txt @10.53.0.3 \ 2754 > dig.out.ns3.test$n 2>&1 2755 [ -s dig.out.ns3.test$n ] && ret=1 2756 n=$((n+1)) 2757 test "$ret" -eq 0 || echo_i "failed" 2758 status=$((status+ret)) 2759 2760 echo_i "testing legacy upper case signer name validation ($n)" 2761 ret=0 2762 $DIG +tcp +noadd +noauth +dnssec -p "$PORT" soa upper.example @10.53.0.4 \ 2763 > dig.out.ns4.test$n 2>&1 2764 grep "flags:.* ad;" dig.out.ns4.test$n > /dev/null || ret=1 2765 grep "RRSIG.*SOA.* UPPER\\.EXAMPLE\\. " dig.out.ns4.test$n > /dev/null || ret=1 2766 n=$((n+1)) 2767 test "$ret" -eq 0 || echo_i "failed" 2768 status=$((status+ret)) 2769 2770 echo_i "testing that we lower case signer name ($n)" 2771 ret=0 2772 $DIG +tcp +noadd +noauth +dnssec -p "$PORT" soa LOWER.EXAMPLE @10.53.0.4 \ 2773 > dig.out.ns4.test$n 2>&1 2774 grep "flags:.* ad;" dig.out.ns4.test$n > /dev/null || ret=1 2775 grep "RRSIG.*SOA.* lower\\.example\\. " dig.out.ns4.test$n > /dev/null || ret=1 2776 n=$((n+1)) 2777 test "$ret" -eq 0 || echo_i "failed" 2778 status=$((status+ret)) 2779 2780 echo_i "testing TTL is capped at RRSIG expiry time ($n)" 2781 ret=0 2782 rndccmd 10.53.0.3 freeze expiring.example 2>&1 | sed 's/^/ns3 /' | cat_i 2783 ( 2784 cd ns3 || exit 1 2785 for file in K*.moved; do 2786 mv "$file" "$(basename "$file" .moved)" 2787 done 2788 $SIGNER -S -N increment -e now+1mi -o expiring.example expiring.example.db > /dev/null 2>&1 2789 ) || ret=1 2790 rndc_reload ns3 10.53.0.3 expiring.example 2791 2792 rndccmd 10.53.0.4 flush 2>&1 | sed 's/^/ns4 /' | cat_i 2793 dig_with_answeropts +cd expiring.example soa @10.53.0.4 > dig.out.ns4.1.$n 2794 dig_with_answeropts expiring.example soa @10.53.0.4 > dig.out.ns4.2.$n 2795 ttls=$(awk '$1 != ";;" {print $2}' dig.out.ns4.1.$n) 2796 ttls2=$(awk '$1 != ";;" {print $2}' dig.out.ns4.2.$n) 2797 for ttl in ${ttls:-0}; do 2798 [ "${ttl:-0}" -eq 300 ] || ret=1 2799 done 2800 for ttl in ${ttls2:-0}; do 2801 [ "${ttl:-0}" -le 60 ] || ret=1 2802 done 2803 n=$((n+1)) 2804 test "$ret" -eq 0 || echo_i "failed" 2805 status=$((status+ret)) 2806 2807 echo_i "testing TTL is capped at RRSIG expiry time for records in the additional section (NS) ($n)" 2808 ret=0 2809 rndccmd 10.53.0.4 flush 2>&1 | sed 's/^/ns4 /' | cat_i 2810 sleep 1 2811 dig_with_additionalopts +cd expiring.example ns @10.53.0.4 > dig.out.ns4.1.$n 2812 dig_with_additionalopts expiring.example ns @10.53.0.4 > dig.out.ns4.2.$n 2813 ttls=$(awk '$1 != ";;" {print $2}' dig.out.ns4.1.$n) 2814 ttls2=$(awk '$1 != ";;" {print $2}' dig.out.ns4.2.$n) 2815 for ttl in ${ttls:-300}; do 2816 [ "$ttl" -eq 300 ] || ret=1 2817 done 2818 for ttl in ${ttls2:-0}; do 2819 [ "$ttl" -le 60 ] || ret=1 2820 done 2821 n=$((n+1)) 2822 test "$ret" -eq 0 || echo_i "failed" 2823 status=$((status+ret)) 2824 2825 echo_i "testing TTL is capped at RRSIG expiry time for records in the additional section (MX) ($n)" 2826 ret=0 2827 rndccmd 10.53.0.4 flush 2>&1 | sed 's/^/ns4 /' | cat_i 2828 sleep 1 2829 dig_with_additionalopts +cd expiring.example mx @10.53.0.4 > dig.out.ns4.1.$n 2830 dig_with_additionalopts expiring.example mx @10.53.0.4 > dig.out.ns4.2.$n 2831 ttls=$(awk '$1 != ";;" {print $2}' dig.out.ns4.1.$n) 2832 ttls2=$(awk '$1 != ";;" {print $2}' dig.out.ns4.2.$n) 2833 for ttl in ${ttls:-300}; do 2834 [ "$ttl" -eq 300 ] || ret=1 2835 done 2836 for ttl in ${ttls2:-0}; do 2837 [ "$ttl" -le 60 ] || ret=1 2838 done 2839 n=$((n+1)) 2840 test "$ret" -eq 0 || echo_i "failed" 2841 status=$((status+ret)) 2842 2843 copy_setports ns4/named3.conf.in ns4/named.conf 2844 rndccmd 10.53.0.4 reconfig 2>&1 | sed 's/^/ns4 /' | cat_i 2845 sleep 3 2846 2847 echo_i "testing TTL of about to expire RRsets with dnssec-accept-expired yes; ($n)" 2848 ret=0 2849 rndccmd 10.53.0.4 flush 2>&1 | sed 's/^/ns4 /' | cat_i 2850 dig_with_answeropts +cd expiring.example soa @10.53.0.4 > dig.out.ns4.1.$n 2851 dig_with_answeropts expiring.example soa @10.53.0.4 > dig.out.ns4.2.$n 2852 ttls=$(awk '$1 != ";;" {print $2}' dig.out.ns4.1.$n) 2853 ttls2=$(awk '$1 != ";;" {print $2}' dig.out.ns4.2.$n) 2854 for ttl in ${ttls:-0}; do 2855 [ "$ttl" -eq 300 ] || ret=1 2856 done 2857 for ttl in ${ttls2:-0}; do 2858 [ "$ttl" -le 120 ] && [ "$ttl" -gt 60 ] || ret=1 2859 done 2860 n=$((n+1)) 2861 test "$ret" -eq 0 || echo_i "failed" 2862 status=$((status+ret)) 2863 2864 echo_i "testing TTL of expired RRsets with dnssec-accept-expired yes; ($n)" 2865 ret=0 2866 dig_with_answeropts +cd expired.example soa @10.53.0.4 > dig.out.ns4.1.$n 2867 dig_with_answeropts expired.example soa @10.53.0.4 > dig.out.ns4.2.$n 2868 ttls=$(awk '$1 != ";;" {print $2}' dig.out.ns4.1.$n) 2869 ttls2=$(awk '$1 != ";;" {print $2}' dig.out.ns4.2.$n) 2870 for ttl in ${ttls:-0}; do 2871 [ "$ttl" -eq 300 ] || ret=1 2872 done 2873 for ttl in ${ttls2:-0}; do 2874 [ "$ttl" -le 120 ] && [ "$ttl" -gt 60 ] || ret=1 2875 done 2876 n=$((n+1)) 2877 test "$ret" -eq 0 || echo_i "failed" 2878 status=$((status+ret)) 2879 2880 echo_i "testing TTL is capped at RRSIG expiry time for records in the additional section with dnssec-accept-expired yes; ($n)" 2881 ret=0 2882 rndccmd 10.53.0.4 flush 2>&1 | sed 's/^/ns4 /' | cat_i 2883 dig_with_answeropts +cd expiring.example mx @10.53.0.4 > dig.out.ns4.1.$n 2884 dig_with_answeropts expiring.example mx @10.53.0.4 > dig.out.ns4.2.$n 2885 ttls=$(awk '$1 != ";;" {print $2}' dig.out.ns4.1.$n) 2886 ttls2=$(awk '$1 != ";;" {print $2}' dig.out.ns4.2.$n) 2887 for ttl in ${ttls:-300}; do 2888 [ "$ttl" -eq 300 ] || ret=1 2889 done 2890 for ttl in ${ttls2:-0}; do 2891 [ "$ttl" -le 120 ] && [ "$ttl" -gt 60 ] || ret=1 2892 done 2893 n=$((n+1)) 2894 test "$ret" -eq 0 || echo_i "failed" 2895 status=$((status+ret)) 2896 2897 echo_i "testing DNSKEY lookup via CNAME ($n)" 2898 ret=0 2899 dig_with_opts +noauth cnameandkey.secure.example. \ 2900 @10.53.0.3 dnskey > dig.out.ns3.test$n || ret=1 2901 dig_with_opts +noauth cnameandkey.secure.example. \ 2902 @10.53.0.4 dnskey > dig.out.ns4.test$n || ret=1 2903 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 2904 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 2905 grep "CNAME" dig.out.ns4.test$n > /dev/null || ret=1 2906 n=$((n+1)) 2907 test "$ret" -eq 0 || echo_i "failed" 2908 status=$((status+ret)) 2909 2910 echo_i "testing KEY lookup at CNAME (present) ($n)" 2911 ret=0 2912 dig_with_opts +noauth cnameandkey.secure.example. \ 2913 @10.53.0.3 key > dig.out.ns3.test$n || ret=1 2914 dig_with_opts +noauth cnameandkey.secure.example. \ 2915 @10.53.0.4 key > dig.out.ns4.test$n || ret=1 2916 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 2917 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 2918 grep "CNAME" dig.out.ns4.test$n > /dev/null && ret=1 2919 n=$((n+1)) 2920 test "$ret" -eq 0 || echo_i "failed" 2921 status=$((status+ret)) 2922 2923 echo_i "testing KEY lookup at CNAME (not present) ($n)" 2924 ret=0 2925 dig_with_opts +noauth cnamenokey.secure.example. \ 2926 @10.53.0.3 key > dig.out.ns3.test$n || ret=1 2927 dig_with_opts +noauth cnamenokey.secure.example. \ 2928 @10.53.0.4 key > dig.out.ns4.test$n || ret=1 2929 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 2930 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 2931 grep "CNAME" dig.out.ns4.test$n > /dev/null && ret=1 2932 n=$((n+1)) 2933 test "$ret" -eq 0 || echo_i "failed" 2934 status=$((status+ret)) 2935 2936 echo_i "testing DNSKEY lookup via DNAME ($n)" 2937 ret=0 2938 dig_with_opts a.dnameandkey.secure.example. \ 2939 @10.53.0.3 dnskey > dig.out.ns3.test$n || ret=1 2940 dig_with_opts a.dnameandkey.secure.example. \ 2941 @10.53.0.4 dnskey > dig.out.ns4.test$n || ret=1 2942 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 2943 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 2944 grep "CNAME" dig.out.ns4.test$n > /dev/null || ret=1 2945 grep "DNAME" dig.out.ns4.test$n > /dev/null || ret=1 2946 n=$((n+1)) 2947 test "$ret" -eq 0 || echo_i "failed" 2948 status=$((status+ret)) 2949 2950 echo_i "testing KEY lookup via DNAME ($n)" 2951 ret=0 2952 dig_with_opts b.dnameandkey.secure.example. \ 2953 @10.53.0.3 key > dig.out.ns3.test$n || ret=1 2954 dig_with_opts b.dnameandkey.secure.example. \ 2955 @10.53.0.4 key > dig.out.ns4.test$n || ret=1 2956 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 2957 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 2958 grep "DNAME" dig.out.ns4.test$n > /dev/null || ret=1 2959 n=$((n+1)) 2960 test "$ret" -eq 0 || echo_i "failed" 2961 status=$((status+ret)) 2962 2963 echo_i "check that named doesn't loop when all private keys are not available ($n)" 2964 ret=0 2965 lines=$(grep -c "reading private key file expiring.example" ns3/named.run || true) 2966 test "${lines:-1000}" -lt 15 || ret=1 2967 n=$((n+1)) 2968 test "$ret" -eq 0 || echo_i "failed" 2969 status=$((status+ret)) 2970 2971 echo_i "check against against missing nearest provable proof ($n)" 2972 dig_with_opts +norec b.c.d.optout-tld. \ 2973 @10.53.0.6 ds > dig.out.ds.ns6.test$n || ret=1 2974 nsec3=$(grep -c "IN.NSEC3" dig.out.ds.ns6.test$n || true) 2975 [ "$nsec3" -eq 2 ] || ret=1 2976 dig_with_opts +norec b.c.d.optout-tld. \ 2977 @10.53.0.6 A > dig.out.ns6.test$n || ret=1 2978 nsec3=$(grep -c "IN.NSEC3" dig.out.ns6.test$n || true) 2979 [ "$nsec3" -eq 1 ] || ret=1 2980 dig_with_opts optout-tld. \ 2981 @10.53.0.4 SOA > dig.out.soa.ns4.test$n || ret=1 2982 grep "flags:.*ad.*QUERY" dig.out.soa.ns4.test$n > /dev/null || ret=1 2983 dig_with_opts b.c.d.optout-tld. \ 2984 @10.53.0.4 A > dig.out.ns4.test$n || ret=1 2985 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 2986 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 2987 n=$((n+1)) 2988 test "$ret" -eq 0 || echo_i "failed" 2989 status=$((status+ret)) 2990 2991 echo_i "check that key id are logged when dumping the cache ($n)" 2992 ret=0 2993 rndccmd 10.53.0.4 dumpdb 2>&1 | sed 's/^/ns4 /' | cat_i 2994 sleep 1 2995 grep "; key id = " ns4/named_dump.db > /dev/null || ret=1 2996 n=$((n+1)) 2997 test "$ret" -eq 0 || echo_i "failed" 2998 status=$((status+ret)) 2999 3000 echo_i "check KEYDATA records are printed in human readable form in key zone ($n)" 3001 # force the managed-keys zone to be written out 3002 rndccmd 10.53.0.4 managed-keys sync 2>&1 | sed 's/^/ns4 /' | cat_i 3003 for i in 1 2 3 4 5 6 7 8 9 3004 do 3005 ret=0 3006 if test -f ns4/managed-keys.bind 3007 then 3008 grep KEYDATA ns4/managed-keys.bind > /dev/null && 3009 grep "next refresh:" ns4/managed-keys.bind > /dev/null && 3010 break 3011 fi 3012 ret=1 3013 sleep 1 3014 done 3015 n=$((n+1)) 3016 test "$ret" -eq 0 || echo_i "failed" 3017 status=$((status+ret)) 3018 3019 echo_i "check dig's +nocrypto flag ($n)" 3020 ret=0 3021 dig_with_opts +norec +nocrypto DNSKEY . \ 3022 @10.53.0.1 > dig.out.dnskey.ns1.test$n || ret=1 3023 grep -E "256 [0-9]+ $DEFAULT_ALGORITHM_NUMBER \\[key id = [1-9][0-9]*]" dig.out.dnskey.ns1.test$n > /dev/null || ret=1 3024 grep -E "RRSIG.* \\[omitted]" dig.out.dnskey.ns1.test$n > /dev/null || ret=1 3025 dig_with_opts +norec +nocrypto DS example \ 3026 @10.53.0.1 > dig.out.ds.ns1.test$n || ret=1 3027 grep -E "DS.* [0-9]+ [12] \[omitted]" dig.out.ds.ns1.test$n > /dev/null || ret=1 3028 n=$((n+1)) 3029 test "$ret" -eq 0 || echo_i "failed" 3030 status=$((status+ret)) 3031 3032 echo_i "check simultaneous inactivation and publishing of dnskeys removes inactive signature ($n)" 3033 ret=0 3034 cnt=0 3035 while : 3036 do 3037 dig_with_opts publish-inactive.example @10.53.0.3 dnskey > dig.out.ns3.test$n 3038 keys=$(awk '$5 == 257 { print; }' dig.out.ns3.test$n | wc -l) 3039 test "$keys" -gt 2 && break 3040 cnt=$((cnt+1)) 3041 test "$cnt" -gt 120 && break 3042 sleep 1 3043 done 3044 test "$keys" -gt 2 || ret=1 3045 sigs=$(grep -c RRSIG dig.out.ns3.test$n || true) 3046 n=$((n+1)) 3047 test "$sigs" -eq 2 || ret=1 3048 if test "$ret" -ne 0 ; then echo_i "failed"; fi 3049 status=$((status+ret)) 3050 3051 echo_i "check that increasing the sig-validity-interval resigning triggers re-signing ($n)" 3052 ret=0 3053 before=$($DIG axfr siginterval.example -p "$PORT" @10.53.0.3 | grep RRSIG.SOA) 3054 cp ns3/siginterval2.conf ns3/siginterval.conf 3055 rndccmd 10.53.0.3 reconfig 2>&1 | sed 's/^/ns3 /' | cat_i 3056 i=10 3057 while [ "$i" -ge 0 ]; do 3058 after=$($DIG axfr siginterval.example -p "$PORT" @10.53.0.3 | grep RRSIG.SOA) 3059 test "$before" != "$after" && break 3060 sleep 1 3061 i=$((i-1)) 3062 done 3063 n=$((n+1)) 3064 if test "$before" = "$after" ; then echo_i "failed"; ret=1; fi 3065 status=$((status+ret)) 3066 3067 if [ -x "$PYTHON" ]; then 3068 echo_i "check dnskey-sig-validity sets longer expiry for DNSKEY ($n)" 3069 ret=0 3070 rndccmd 10.53.0.3 sign siginterval.example 2>&1 | sed 's/^/ns3 /' | cat_i 3071 # convert expiry date to a comma-separated list of integers python can 3072 # use as input to date(). strip leading 0s in months and days so 3073 # python3 will recognize them as integers. 3074 $DIG +dnssec +short -p "$PORT" @10.53.0.3 soa siginterval.example > dig.out.soa.test$n 3075 soaexpire=$(awk '$1 ~ /SOA/ { print $5 }' dig.out.soa.test$n | 3076 sed 's/\(....\)\(..\)\(..\).*/\1, \2, \3/' | 3077 sed 's/ 0/ /g') 3078 $DIG +dnssec +short -p "$PORT" @10.53.0.3 dnskey siginterval.example > dig.out.dnskey.test$n 3079 dnskeyexpire=$(awk '$1 ~ /DNSKEY/ { print $5; exit 0 }' dig.out.dnskey.test$n | 3080 sed 's/\(....\)\(..\)\(..\).*/\1, \2, \3/' | 3081 sed 's/ 0/ /g') 3082 $PYTHON > python.out.$n <<EOF 3083 from datetime import date; 3084 ke=date($dnskeyexpire) 3085 se=date($soaexpire) 3086 print((ke-se).days); 3087 EOF 3088 diff=$(cat python.out.$n) 3089 [ "$diff" -ge 55 ] || ret=1 3090 n=$((n+1)) 3091 test "$ret" -eq 0 || echo_i "failed" 3092 status=$((status+ret)) 3093 fi 3094 3095 copy_setports ns4/named4.conf.in ns4/named.conf 3096 rndccmd 10.53.0.4 reconfig 2>&1 | sed 's/^/ns4 /' | cat_i 3097 sleep 3 3098 3099 echo_i "check insecure delegation between static-stub zones ($n)" 3100 ret=0 3101 dig_with_opts ns insecure.secure.example \ 3102 @10.53.0.4 > dig.out.ns4.1.test$n || ret=1 3103 grep "SERVFAIL" dig.out.ns4.1.test$n > /dev/null && ret=1 3104 dig_with_opts ns secure.example \ 3105 @10.53.0.4 > dig.out.ns4.2.test$n || ret=1 3106 grep "SERVFAIL" dig.out.ns4.2.test$n > /dev/null && ret=1 3107 n=$((n+1)) 3108 test "$ret" -eq 0 || echo_i "failed" 3109 status=$((status+ret)) 3110 3111 echo_i "check the acceptance of seconds as inception and expiration times ($n)" 3112 ret=0 3113 in="NSEC 8 0 86400 1390003200 1389394800 33655 . NYWjZYBV1b+h4j0yu/SmPOOylR8P4IXKDzHX3NwEmU1SUp27aJ91dP+i+UBcnPmBib0hck4DrFVvpflCEpCnVQd2DexcN0GX+3PM7XobxhtDlmnU X1L47zJlbdHNwTqHuPaMM6Xy9HGMXps7O5JVyfggVhTz2C+G5OVxBdb2rOo=" 3114 3115 exp="NSEC 8 0 86400 20140118000000 20140110230000 33655 . NYWjZYBV1b+h4j0yu/SmPOOylR8P4IXKDzHX3NwEmU1SUp27aJ91dP+i +UBcnPmBib0hck4DrFVvpflCEpCnVQd2DexcN0GX+3PM7XobxhtDlmnU X1L47zJlbdHNwTqHuPaMM6Xy9HGMXps7O5JVyfggVhTz2C+G5OVxBdb2 rOo=" 3116 3117 out=$(echo "IN RRSIG $in" | $RRCHECKER -p | sed 's/^IN.RRSIG.//') 3118 [ "$out" = "$exp" ] || ret=1 3119 n=$((n+1)) 3120 test "$ret" -eq 0 || echo_i "failed" 3121 status=$((status+ret)) 3122 3123 echo_i "check the correct resigning time is reported in zonestatus ($n)" 3124 ret=0 3125 rndccmd 10.53.0.3 \ 3126 zonestatus secure.example > rndc.out.ns3.test$n 3127 # next resign node: secure.example/DNSKEY 3128 qname=$(awk '/next resign node:/ { print $4 }' rndc.out.ns3.test$n | sed 's,/.*,,') 3129 qtype=$(awk '/next resign node:/ { print $4 }' rndc.out.ns3.test$n | sed 's,.*/,,') 3130 # next resign time: Thu, 24 Apr 2014 10:38:16 GMT 3131 time=$(awk 'BEGIN { m["Jan"] = "01"; m["Feb"] = "02"; m["Mar"] = "03"; 3132 m["Apr"] = "04"; m["May"] = "05"; m["Jun"] = "06"; 3133 m["Jul"] = "07"; m["Aug"] = "08"; m["Sep"] = "09"; 3134 m["Oct"] = "10"; m["Nov"] = "11"; m["Dec"] = "12";} 3135 /next resign time:/ { printf "%d%s%02d%s\n", $7, m[$6], $5, $8 }' rndc.out.ns3.test$n | sed 's/://g') 3136 dig_with_opts +noall +answer "$qname" "$qtype" @10.53.0.3 > dig.out.test$n 3137 expire=$(awk '$4 == "RRSIG" { print $9 }' dig.out.test$n) 3138 inception=$(awk '$4 == "RRSIG" { print $10 }' dig.out.test$n) 3139 $PERL -e 'exit(0) if ("'"$time"'" lt "'"$expire"'" && "'"$time"'" gt "'"$inception"'"); exit(1);' || ret=1 3140 n=$((n+1)) 3141 test "$ret" -eq 0 || echo_i "failed" 3142 status=$((status+ret)) 3143 3144 echo_i "check that split rrsigs are handled ($n)" 3145 ret=0 3146 dig_with_opts split-rrsig soa @10.53.0.7 > dig.out.test$n || ret=1 3147 awk 'BEGIN { ok=0; } $4 == "SOA" { if ($7 > 1) ok=1; } END { if (!ok) exit(1); }' dig.out.test$n || ret=1 3148 n=$((n+1)) 3149 test "$ret" -eq 0 || echo_i "failed" 3150 status=$((status+ret)) 3151 3152 echo_i "check that 'dnssec-keygen -S' works for all supported algorithms ($n)" 3153 ret=0 3154 alg=1 3155 until test $alg -eq 256 3156 do 3157 case $alg in 3158 2) # Diffie Helman 3159 alg=$((alg+1)) 3160 continue;; 3161 157|160|161|162|163|164|165) # private - non standard 3162 alg=$((alg+1)) 3163 continue;; 3164 1|5|7|8|10) # RSA algorithms 3165 key1=$($KEYGEN -a "$alg" -b "1024" -n zone example 2> keygen.err || true) 3166 ;; 3167 *) 3168 key1=$($KEYGEN -a "$alg" -n zone example 2> keygen.err || true) 3169 esac 3170 if grep "unsupported algorithm" keygen.err > /dev/null 3171 then 3172 alg=$((alg+1)) 3173 continue 3174 fi 3175 if test -z "$key1" 3176 then 3177 echo_i "'$KEYGEN -a $alg': failed" 3178 cat keygen.err 3179 ret=1 3180 alg=$((alg+1)) 3181 continue 3182 fi 3183 $SETTIME -I now+4d "$key1.private" > /dev/null 3184 key2=$($KEYGEN -v 10 -i 3d -S "$key1.private" 2> /dev/null) 3185 test -f "$key2.key" -a -f "$key2.private" || { 3186 ret=1 3187 echo_i "'dnssec-keygen -S' failed for algorithm: $alg" 3188 } 3189 alg=$((alg+1)) 3190 done 3191 n=$((n+1)) 3192 test "$ret" -eq 0 || echo_i "failed" 3193 status=$((status+ret)) 3194 3195 echo_i "check that CDS records are signed using KSK by dnssec-signzone ($n)" 3196 ret=0 3197 dig_with_opts +noall +answer @10.53.0.2 cds cds.secure > dig.out.test$n 3198 lines=$(awk '$4 == "RRSIG" && $5 == "CDS" {print}' dig.out.test$n | wc -l) 3199 test "$lines" -eq 2 || ret=1 3200 n=$((n+1)) 3201 test "$ret" -eq 0 || echo_i "failed" 3202 status=$((status+ret)) 3203 3204 echo_i "check that CDS records are not signed using ZSK by dnssec-signzone -x ($n)" 3205 ret=0 3206 dig_with_opts +noall +answer @10.53.0.2 cds cds-x.secure > dig.out.test$n 3207 lines=$(awk '$4 == "RRSIG" && $5 == "CDS" {print}' dig.out.test$n | wc -l) 3208 test "$lines" -eq 1 || ret=1 3209 n=$((n+1)) 3210 test "$ret" -eq 0 || echo_i "failed" 3211 status=$((status+ret)) 3212 3213 echo_i "checking that positive unknown NSEC3 hash algorithm does validate ($n)" 3214 ret=0 3215 dig_with_opts +noauth +noadd +nodnssec +adflag @10.53.0.3 nsec3-unknown.example SOA > dig.out.ns3.test$n 3216 dig_with_opts +noauth +noadd +nodnssec +adflag @10.53.0.4 nsec3-unknown.example SOA > dig.out.ns4.test$n 3217 grep "status: NOERROR," dig.out.ns3.test$n > /dev/null || ret=1 3218 grep "status: NOERROR," dig.out.ns4.test$n > /dev/null || ret=1 3219 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 3220 grep "ANSWER: 1," dig.out.ns4.test$n > /dev/null || ret=1 3221 n=$((n+1)) 3222 test "$ret" -eq 0 || echo_i "failed" 3223 status=$((status+ret)) 3224 3225 echo_i "check that CDS records are signed using KSK by with dnssec-auto ($n)" 3226 ret=0 3227 dig_with_opts +noall +answer @10.53.0.2 cds cds-auto.secure > dig.out.test$n 3228 lines=$(awk '$4 == "RRSIG" && $5 == "CDS" {print}' dig.out.test$n | wc -l) 3229 test "$lines" -eq 2 || ret=1 3230 n=$((n+1)) 3231 test "$ret" -eq 0 || echo_i "failed" 3232 status=$((status+ret)) 3233 3234 echo_i "check that a lone non matching CDS record is rejected ($n)" 3235 ret=0 3236 ( 3237 echo zone cds-update.secure 3238 echo server 10.53.0.2 "$PORT" 3239 echo update delete cds-update.secure CDS 3240 dig_with_opts +noall +answer @10.53.0.2 dnskey cds-update.secure | 3241 grep "DNSKEY.257" | sed 's/DNSKEY.257/DNSKEY 258/' | 3242 $DSFROMKEY -C -A -f - -T 1 cds-update.secure | 3243 sed "s/^/update add /" 3244 echo send 3245 ) | $NSUPDATE > nsupdate.out.test$n 2>&1 || true 3246 grep "update failed: REFUSED" nsupdate.out.test$n > /dev/null || ret=1 3247 dig_with_opts +noall +answer @10.53.0.2 cds cds-update.secure > dig.out.test$n 3248 lines=$(awk '$4 == "CDS" {print}' dig.out.test$n | wc -l) 3249 test "${lines:-10}" -eq 0 || ret=1 3250 n=$((n+1)) 3251 test "$ret" -eq 0 || echo_i "failed" 3252 status=$((status+ret)) 3253 3254 echo_i "check that CDS records are signed using KSK when added by nsupdate ($n)" 3255 ret=0 3256 ( 3257 echo zone cds-update.secure 3258 echo server 10.53.0.2 "$PORT" 3259 echo update delete cds-update.secure CDS 3260 echo send 3261 dig_with_opts +noall +answer @10.53.0.2 dnskey cds-update.secure | 3262 grep "DNSKEY.257" | 3263 $DSFROMKEY -C -f - -T 1 cds-update.secure | 3264 sed "s/^/update add /" 3265 echo send 3266 ) | $NSUPDATE 3267 dig_with_opts +noall +answer @10.53.0.2 cds cds-update.secure > dig.out.test$n 3268 lines=$(awk '$4 == "RRSIG" && $5 == "CDS" {print}' dig.out.test$n | wc -l) 3269 test "$lines" -eq 2 || ret=1 3270 lines=$(awk '$4 == "CDS" {print}' dig.out.test$n | wc -l) 3271 test "$lines" -eq 2 || ret=1 3272 n=$((n+1)) 3273 test "$ret" -eq 0 || echo_i "failed" 3274 status=$((status+ret)) 3275 3276 echo_i "check that CDS records are signed only using KSK when added by" 3277 echo_i " nsupdate when dnssec-dnskey-kskonly is yes ($n)" 3278 ret=0 3279 ( 3280 echo zone cds-kskonly.secure 3281 echo server 10.53.0.2 "$PORT" 3282 echo update delete cds-kskonly.secure CDS 3283 echo send 3284 dig_with_opts +noall +answer @10.53.0.2 dnskey cds-kskonly.secure | 3285 grep "DNSKEY.257" | 3286 $DSFROMKEY -C -f - -T 1 cds-kskonly.secure | 3287 sed "s/^/update add /" 3288 echo send 3289 ) | $NSUPDATE 3290 dig_with_opts +noall +answer @10.53.0.2 cds cds-kskonly.secure > dig.out.test$n 3291 lines=$(awk '$4 == "RRSIG" && $5 == "CDS" {print}' dig.out.test$n | wc -l) 3292 test "$lines" -eq 1 || ret=1 3293 lines=$(awk '$4 == "CDS" {print}' dig.out.test$n | wc -l) 3294 test "$lines" -eq 2 || ret=1 3295 n=$((n+1)) 3296 test "$ret" -eq 0 || echo_i "failed" 3297 status=$((status+ret)) 3298 3299 echo_i "checking that positive unknown NSEC3 hash algorithm with OPTOUT does validate ($n)" 3300 ret=0 3301 dig_with_opts +noauth +noadd +nodnssec +adflag @10.53.0.3 optout-unknown.example SOA > dig.out.ns3.test$n 3302 dig_with_opts +noauth +noadd +nodnssec +adflag @10.53.0.4 optout-unknown.example SOA > dig.out.ns4.test$n 3303 grep "status: NOERROR," dig.out.ns3.test$n > /dev/null || ret=1 3304 grep "status: NOERROR," dig.out.ns4.test$n > /dev/null || ret=1 3305 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 3306 grep "ANSWER: 1," dig.out.ns4.test$n > /dev/null || ret=1 3307 n=$((n+1)) 3308 test "$ret" -eq 0 || echo_i "failed" 3309 status=$((status+ret)) 3310 3311 echo_i "check that a non matching CDS record is accepted with a matching CDS record ($n)" 3312 ret=0 3313 ( 3314 echo zone cds-update.secure 3315 echo server 10.53.0.2 "$PORT" 3316 echo update delete cds-update.secure CDS 3317 echo send 3318 dig_with_opts +noall +answer @10.53.0.2 dnskey cds-update.secure | 3319 grep "DNSKEY.257" | 3320 $DSFROMKEY -C -f - -T 1 cds-update.secure | 3321 sed "s/^/update add /" 3322 dig_with_opts +noall +answer @10.53.0.2 dnskey cds-update.secure | 3323 grep "DNSKEY.257" | sed 's/DNSKEY.257/DNSKEY 258/' | 3324 $DSFROMKEY -C -A -f - -T 1 cds-update.secure | 3325 sed "s/^/update add /" 3326 echo send 3327 ) | $NSUPDATE 3328 dig_with_opts +noall +answer @10.53.0.2 cds cds-update.secure > dig.out.test$n 3329 lines=$(awk '$4 == "RRSIG" && $5 == "CDS" {print}' dig.out.test$n | wc -l) 3330 test "$lines" -eq 2 || ret=1 3331 lines=$(awk '$4 == "CDS" {print}' dig.out.test$n | wc -l) 3332 test "$lines" -eq 4 || ret=1 3333 n=$((n+1)) 3334 test "$ret" -eq 0 || echo_i "failed" 3335 status=$((status+ret)) 3336 3337 echo_i "checking that negative unknown NSEC3 hash algorithm does not validate ($n)" 3338 ret=0 3339 dig_with_opts +noauth +noadd +nodnssec +adflag @10.53.0.3 nsec3-unknown.example A > dig.out.ns3.test$n 3340 dig_with_opts +noauth +noadd +nodnssec +adflag @10.53.0.4 nsec3-unknown.example A > dig.out.ns4.test$n 3341 grep "status: NOERROR," dig.out.ns3.test$n > /dev/null || ret=1 3342 grep "status: SERVFAIL," dig.out.ns4.test$n > /dev/null || ret=1 3343 n=$((n+1)) 3344 test "$ret" -eq 0 || echo_i "failed" 3345 status=$((status+ret)) 3346 3347 echo_i "check that CDNSKEY records are signed using KSK by dnssec-signzone ($n)" 3348 ret=0 3349 dig_with_opts +noall +answer @10.53.0.2 cdnskey cdnskey.secure > dig.out.test$n 3350 lines=$(awk '$4 == "RRSIG" && $5 == "CDNSKEY" {print}' dig.out.test$n | wc -l) 3351 test "$lines" -eq 2 || ret=1 3352 n=$((n+1)) 3353 test "$ret" -eq 0 || echo_i "failed" 3354 status=$((status+ret)) 3355 3356 echo_i "check that CDNSKEY records are not signed using ZSK by dnssec-signzone -x ($n)" 3357 ret=0 3358 dig_with_opts +noall +answer @10.53.0.2 cdnskey cdnskey-x.secure > dig.out.test$n 3359 lines=$(awk '$4 == "RRSIG" && $5 == "CDNSKEY" {print}' dig.out.test$n | wc -l) 3360 test "$lines" -eq 1 || ret=1 3361 n=$((n+1)) 3362 test "$ret" -eq 0 || echo_i "failed" 3363 status=$((status+ret)) 3364 3365 echo_i "checking that negative unknown NSEC3 hash algorithm with OPTOUT does not validate ($n)" 3366 ret=0 3367 dig_with_opts +noauth +noadd +nodnssec +adflag @10.53.0.3 optout-unknown.example A > dig.out.ns3.test$n 3368 dig_with_opts +noauth +noadd +nodnssec +adflag @10.53.0.4 optout-unknown.example A > dig.out.ns4.test$n 3369 grep "status: NOERROR," dig.out.ns3.test$n > /dev/null || ret=1 3370 grep "status: SERVFAIL," dig.out.ns4.test$n > /dev/null || ret=1 3371 n=$((n+1)) 3372 test "$ret" -eq 0 || echo_i "failed" 3373 status=$((status+ret)) 3374 3375 echo_i "check that CDNSKEY records are signed using KSK by with dnssec-auto ($n)" 3376 ret=0 3377 dig_with_opts +noall +answer @10.53.0.2 cdnskey cdnskey-auto.secure > dig.out.test$n 3378 lines=$(awk '$4 == "RRSIG" && $5 == "CDNSKEY" {print}' dig.out.test$n | wc -l) 3379 test "$lines" -eq 2 || ret=1 3380 n=$((n+1)) 3381 test "$ret" -eq 0 || echo_i "failed" 3382 status=$((status+ret)) 3383 3384 echo_i "checking that unknown DNSKEY algorithm validates as insecure ($n)" 3385 ret=0 3386 dig_with_opts +noauth +noadd +nodnssec +adflag @10.53.0.3 dnskey-unknown.example A > dig.out.ns3.test$n 3387 dig_with_opts +noauth +noadd +nodnssec +adflag @10.53.0.4 dnskey-unknown.example A > dig.out.ns4.test$n 3388 grep "status: NOERROR," dig.out.ns3.test$n > /dev/null || ret=1 3389 grep "status: NOERROR," dig.out.ns4.test$n > /dev/null || ret=1 3390 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 3391 n=$((n+1)) 3392 test "$ret" -eq 0 || echo_i "failed" 3393 status=$((status+ret)) 3394 3395 echo_i "checking that unsupported DNSKEY algorithm validates as insecure ($n)" 3396 ret=0 3397 dig_with_opts +noauth +noadd +nodnssec +adflag @10.53.0.3 dnskey-unsupported.example A > dig.out.ns3.test$n 3398 dig_with_opts +noauth +noadd +nodnssec +adflag @10.53.0.4 dnskey-unsupported.example A > dig.out.ns4.test$n 3399 grep "status: NOERROR," dig.out.ns3.test$n > /dev/null || ret=1 3400 grep "status: NOERROR," dig.out.ns4.test$n > /dev/null || ret=1 3401 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 3402 n=$((n+1)) 3403 test "$ret" -eq 0 || echo_i "failed" 3404 status=$((status+ret)) 3405 3406 echo_i "checking that unsupported DNSKEY algorithm is in DNSKEY RRset ($n)" 3407 ret=0 3408 dig_with_opts +noauth +noadd +nodnssec +adflag @10.53.0.3 dnskey-unsupported-2.example DNSKEY > dig.out.test$n 3409 grep "status: NOERROR," dig.out.test$n > /dev/null || ret=1 3410 grep "dnskey-unsupported-2\.example\..*IN.*DNSKEY.*257 3 255" dig.out.test$n > /dev/null || ret=1 3411 n=$((n+1)) 3412 test "$ret" -eq 0 || echo_i "failed" 3413 status=$((status+ret)) 3414 3415 echo_i "check that a lone non matching CDNSKEY record is rejected ($n)" 3416 ret=0 3417 ( 3418 echo zone cdnskey-update.secure 3419 echo server 10.53.0.2 "$PORT" 3420 echo update delete cdnskey-update.secure CDNSKEY 3421 echo send 3422 dig_with_opts +noall +answer @10.53.0.2 dnskey cdnskey-update.secure | 3423 sed -n -e "s/^/update add /" -e 's/DNSKEY.257/CDNSKEY 258/p' 3424 echo send 3425 ) | $NSUPDATE > nsupdate.out.test$n 2>&1 || true 3426 grep "update failed: REFUSED" nsupdate.out.test$n > /dev/null || ret=1 3427 dig_with_opts +noall +answer @10.53.0.2 cdnskey cdnskey-update.secure > dig.out.test$n 3428 lines=$(awk '$4 == "CDNSKEY" {print}' dig.out.test$n | wc -l) 3429 test "${lines:-10}" -eq 0 || ret=1 3430 n=$((n+1)) 3431 test "$ret" -eq 0 || echo_i "failed" 3432 status=$((status+ret)) 3433 3434 echo_i "checking that unknown DNSKEY algorithm + unknown NSEC3 has algorithm validates as insecure ($n)" 3435 ret=0 3436 dig_with_opts +noauth +noadd +nodnssec +adflag @10.53.0.3 dnskey-nsec3-unknown.example A > dig.out.ns3.test$n 3437 dig_with_opts +noauth +noadd +nodnssec +adflag @10.53.0.4 dnskey-nsec3-unknown.example A > dig.out.ns4.test$n 3438 grep "status: NOERROR," dig.out.ns3.test$n > /dev/null || ret=1 3439 grep "status: NOERROR," dig.out.ns4.test$n > /dev/null || ret=1 3440 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 3441 n=$((n+1)) 3442 test "$ret" -eq 0 || echo_i "failed" 3443 status=$((status+ret)) 3444 3445 echo_i "check that CDNSKEY records are signed using KSK when added by nsupdate ($n)" 3446 ret=0 3447 ( 3448 echo zone cdnskey-update.secure 3449 echo server 10.53.0.2 "$PORT" 3450 echo update delete cdnskey-update.secure CDNSKEY 3451 dig_with_opts +noall +answer @10.53.0.2 dnskey cdnskey-update.secure | 3452 sed -n -e "s/^/update add /" -e 's/DNSKEY.257/CDNSKEY 257/p' 3453 echo send 3454 ) | $NSUPDATE 3455 dig_with_opts +noall +answer @10.53.0.2 cdnskey cdnskey-update.secure > dig.out.test$n 3456 lines=$(awk '$4 == "RRSIG" && $5 == "CDNSKEY" {print}' dig.out.test$n | wc -l) 3457 test "$lines" -eq 2 || ret=1 3458 lines=$(awk '$4 == "CDNSKEY" {print}' dig.out.test$n | wc -l) 3459 test "$lines" -eq 1 || ret=1 3460 n=$((n+1)) 3461 test "$ret" -eq 0 || echo_i "failed" 3462 status=$((status+ret)) 3463 3464 echo_i "check that CDNSKEY records are signed only using KSK when added by" 3465 echo_i " nsupdate when dnssec-dnskey-kskonly is yes ($n)" 3466 ret=0 3467 ( 3468 echo zone cdnskey-kskonly.secure 3469 echo server 10.53.0.2 "$PORT" 3470 echo update delete cdnskey-kskonly.secure CDNSKEY 3471 dig_with_opts +noall +answer @10.53.0.2 dnskey cdnskey-kskonly.secure | 3472 sed -n -e "s/^/update add /" -e 's/DNSKEY.257/CDNSKEY 257/p' 3473 echo send 3474 ) | $NSUPDATE 3475 dig_with_opts +noall +answer @10.53.0.2 cdnskey cdnskey-kskonly.secure > dig.out.test$n 3476 lines=$(awk '$4 == "RRSIG" && $5 == "CDNSKEY" {print}' dig.out.test$n | wc -l) 3477 test "$lines" -eq 1 || ret=1 3478 lines=$(awk '$4 == "CDNSKEY" {print}' dig.out.test$n | wc -l) 3479 test "$lines" -eq 1 || ret=1 3480 n=$((n+1)) 3481 test "$ret" -eq 0 || echo_i "failed" 3482 status=$((status+ret)) 3483 3484 echo_i "checking initialization with a revoked managed key ($n)" 3485 ret=0 3486 copy_setports ns5/named2.conf.in ns5/named.conf 3487 rndccmd 10.53.0.5 reconfig 2>&1 | sed 's/^/ns5 /' | cat_i 3488 sleep 3 3489 dig_with_opts +dnssec @10.53.0.5 SOA . > dig.out.ns5.test$n 3490 grep "status: SERVFAIL" dig.out.ns5.test$n > /dev/null || ret=1 3491 n=$((n+1)) 3492 test "$ret" -eq 0 || echo_i "failed" 3493 status=$((status+ret)) 3494 3495 echo_i "check that a non matching CDNSKEY record is accepted with a matching CDNSKEY record ($n)" 3496 ret=0 3497 ( 3498 echo zone cdnskey-update.secure 3499 echo server 10.53.0.2 "$PORT" 3500 echo update delete cdnskey-update.secure CDNSKEY 3501 dig_with_opts +noall +answer @10.53.0.2 dnskey cdnskey-update.secure | 3502 sed -n -e "s/^/update add /" -e 's/DNSKEY.257/CDNSKEY 257/p' 3503 dig_with_opts +noall +answer @10.53.0.2 dnskey cdnskey-update.secure | 3504 sed -n -e "s/^/update add /" -e 's/DNSKEY.257/CDNSKEY 258/p' 3505 echo send 3506 ) | $NSUPDATE 3507 dig_with_opts +noall +answer @10.53.0.2 cdnskey cdnskey-update.secure > dig.out.test$n 3508 lines=$(awk '$4 == "RRSIG" && $5 == "CDNSKEY" {print}' dig.out.test$n | wc -l) 3509 test "$lines" -eq 2 || ret=1 3510 lines=$(awk '$4 == "CDNSKEY" {print}' dig.out.test$n | wc -l) 3511 test "$lines" -eq 2 || ret=1 3512 n=$((n+1)) 3513 test "$ret" -eq 0 || echo_i "failed" 3514 status=$((status+ret)) 3515 3516 echo_i "check that RRSIGs are correctly removed from apex when RRset is removed NSEC ($n)" 3517 ret=0 3518 # generate signed zone with MX and AAAA records at apex. 3519 ( 3520 cd signer || exit 1 3521 $KEYGEN -q -a RSASHA1 -3 -fK remove > /dev/null 3522 $KEYGEN -q -a RSASHA1 -33 remove > /dev/null 3523 echo > remove.db.signed 3524 $SIGNER -S -o remove -D -f remove.db.signed remove.db.in > signer.out.1.$n 2>&1 3525 ) 3526 grep "RRSIG MX" signer/remove.db.signed > /dev/null || { 3527 ret=1 ; cp signer/remove.db.signed signer/remove.db.signed.pre$n; 3528 } 3529 # re-generate signed zone without MX and AAAA records at apex. 3530 ( 3531 cd signer || exit 1 3532 $SIGNER -S -o remove -D -f remove.db.signed remove2.db.in > signer.out.2.$n 2>&1 3533 ) 3534 grep "RRSIG MX" signer/remove.db.signed > /dev/null && { 3535 ret=1 ; cp signer/remove.db.signed signer/remove.db.signed.post$n; 3536 } 3537 n=$((n+1)) 3538 test "$ret" -eq 0 || echo_i "failed" 3539 status=$((status+ret)) 3540 3541 echo_i "check that RRSIGs are correctly removed from apex when RRset is removed NSEC3 ($n)" 3542 ret=0 3543 # generate signed zone with MX and AAAA records at apex. 3544 ( 3545 cd signer || exit 1 3546 echo > remove.db.signed 3547 $SIGNER -3 - -S -o remove -D -f remove.db.signed remove.db.in > signer.out.1.$n 2>&1 3548 ) 3549 grep "RRSIG MX" signer/remove.db.signed > /dev/null || { 3550 ret=1 ; cp signer/remove.db.signed signer/remove.db.signed.pre$n; 3551 } 3552 # re-generate signed zone without MX and AAAA records at apex. 3553 ( 3554 cd signer || exit 1 3555 $SIGNER -3 - -S -o remove -D -f remove.db.signed remove2.db.in > signer.out.2.$n 2>&1 3556 ) 3557 grep "RRSIG MX" signer/remove.db.signed > /dev/null && { 3558 ret=1 ; cp signer/remove.db.signed signer/remove.db.signed.post$n; 3559 } 3560 n=$((n+1)) 3561 test "$ret" -eq 0 || echo_i "failed" 3562 status=$((status+ret)) 3563 3564 echo_i "check that a named managed zone that was signed 'in-the-future' is re-signed when loaded ($n)" 3565 ret=0 3566 dig_with_opts managed-future.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1 3567 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 3568 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 3569 n=$((n+1)) 3570 test "$ret" -eq 0 || echo_i "failed" 3571 status=$((status+ret)) 3572 3573 echo_i "check that trust-anchor-telemetry queries are logged ($n)" 3574 ret=0 3575 grep "sending trust-anchor-telemetry query '_ta-[0-9a-f]*/NULL" ns6/named.run > /dev/null || ret=1 3576 n=$((n+1)) 3577 test "$ret" -eq 0 || echo_i "failed" 3578 status=$((status+ret)) 3579 3580 echo_i "check that _ta-XXXX trust-anchor-telemetry queries are logged ($n)" 3581 ret=0 3582 grep "trust-anchor-telemetry '_ta-[0-9a-f]*/IN' from" ns1/named.run > /dev/null || ret=1 3583 n=$((n+1)) 3584 test "$ret" -eq 0 || echo_i "failed" 3585 status=$((status+ret)) 3586 3587 echo_i "check that _ta-AAAA trust-anchor-telemetry are not sent when disabled ($n)" 3588 ret=0 3589 grep "sending trust-anchor-telemetry query '_ta-[0-9a-f]*/IN" ns1/named.run > /dev/null && ret=1 3590 n=$((n+1)) 3591 test "$ret" -eq 0 || echo_i "failed" 3592 status=$((status+ret)) 3593 3594 echo_i "check that KEY-TAG trust-anchor-telemetry queries are logged ($n)" 3595 ret=0 3596 dig_with_opts . dnskey +ednsopt=KEY-TAG:ffff @10.53.0.1 > dig.out.ns1.test$n || ret=1 3597 grep "trust-anchor-telemetry './IN' from .* 65535" ns1/named.run > /dev/null || ret=1 3598 n=$((n+1)) 3599 test "$ret" -eq 0 || echo_i "failed" 3600 status=$((status+ret)) 3601 3602 echo_i "check that multiple KEY-TAG trust-anchor-telemetry options don't leak memory ($n)" 3603 ret=0 3604 dig_with_opts . dnskey +ednsopt=KEY-TAG:fffe +ednsopt=KEY-TAG:fffd @10.53.0.1 > dig.out.ns1.test$n || ret=1 3605 grep "trust-anchor-telemetry './IN' from .* 65534" ns1/named.run > /dev/null || ret=1 3606 grep "trust-anchor-telemetry './IN' from .* 65533" ns1/named.run > /dev/null && ret=1 3607 $PERL $SYSTEMTESTTOP/stop.pl dnssec ns1 || ret=1 3608 $PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port ${PORT} dnssec ns1 || ret=1 3609 n=$(($n+1)) 3610 test "$ret" -eq 0 || echo_i "failed" 3611 status=$((status+ret)) 3612 3613 echo_i "check that the view is logged in messages from the validator when using views ($n)" 3614 ret=0 3615 grep "view rec: *validat" ns4/named.run > /dev/null || ret=1 3616 n=$((n+1)) 3617 test "$ret" -eq 0 || echo_i "failed" 3618 status=$((status+ret)) 3619 3620 echo_i "check that DNAME at apex with NSEC3 is correctly signed (dnssec-signzone) ($n)" 3621 ret=0 3622 dig_with_opts txt dname-at-apex-nsec3.example @10.53.0.3 > dig.out.ns3.test$n || ret=1 3623 grep "RRSIG.NSEC3 ${DEFAULT_ALGORITHM_NUMBER} 3 3600" dig.out.ns3.test$n > /dev/null || ret=1 3624 n=$((n+1)) 3625 test "$ret" -eq 0 || echo_i "failed" 3626 status=$((status+ret)) 3627 3628 echo_i "check that DNSKEY and other occluded data are excluded from the delegating bitmap ($n)" 3629 ret=0 3630 dig_with_opts axfr occluded.example @10.53.0.3 > dig.out.ns3.test$n || ret=1 3631 grep "^delegation.occluded.example..*NSEC.*NS KEY DS RRSIG NSEC$" dig.out.ns3.test$n > /dev/null || ret=1 3632 grep "^delegation.occluded.example..*DNSKEY.*" dig.out.ns3.test$n > /dev/null || ret=1 3633 grep "^delegation.occluded.example..*AAAA.*" dig.out.ns3.test$n > /dev/null || ret=1 3634 n=$((n+1)) 3635 test "$ret" -eq 0 || echo_i "failed" 3636 status=$((status+ret)) 3637 3638 # Note: after this check, ns4 will not be validating any more; do not add any 3639 # further validation tests employing ns4 below this check. 3640 echo_i "check that validation defaults to off when dnssec-enable is off ($n)" 3641 ret=0 3642 # Sanity check - validation should be enabled. 3643 rndccmd 10.53.0.4 validation status | grep "enabled" > /dev/null || ret=1 3644 # Set "dnssec-enable" to "no" and reconfigure. 3645 copy_setports ns4/named5.conf.in ns4/named.conf 3646 rndccmd 10.53.0.4 reconfig 2>&1 | sed 's/^/ns4 /' | cat_i 3647 # Check validation status again. 3648 rndccmd 10.53.0.4 validation status | grep "disabled" > /dev/null || ret=1 3649 n=$((n+1)) 3650 test "$ret" -eq 0 || echo_i "failed" 3651 status=$((status+ret)) 3652 3653 echo_i "exit status: $status" 3654 [ $status -eq 0 ] || exit 1 3655
Indexes created Sun Aug 02 00:25:04 UTC 2026