tests.sh revision 1.1.1.8
1 #!/bin/sh 2 # 3 # Copyright (C) Internet Systems Consortium, Inc. ("ISC") 4 # 5 # This Source Code Form is subject to the terms of the Mozilla Public 6 # License, v. 2.0. If a copy of the MPL was not distributed with this 7 # file, You can obtain one at http://mozilla.org/MPL/2.0/. 8 # 9 # See the COPYRIGHT file distributed with this work for additional 10 # information regarding copyright ownership. 11 12 # shellcheck source=conf.sh 13 SYSTEMTESTTOP=.. 14 . "$SYSTEMTESTTOP/conf.sh" 15 16 set -e 17 18 status=0 19 n=1 20 21 rm -f dig.out.* 22 23 dig_with_opts() { 24 "$DIG" +tcp +noadd +nosea +nostat +nocmd +dnssec -p "$PORT" "$@" 25 } 26 27 dig_with_additionalopts() { 28 "$DIG" +noall +additional +dnssec -p "$PORT" "$@" 29 } 30 31 dig_with_answeropts() { 32 "$DIG" +noall +answer +dnssec -p "$PORT" "$@" 33 } 34 35 delv_with_opts() { 36 "$DELV" -a ns1/trusted.conf -p "$PORT" "$@" 37 } 38 39 rndccmd() { 40 "$RNDC" -c "$SYSTEMTESTTOP/common/rndc.conf" -p "$CONTROLPORT" -s "$@" 41 } 42 43 # TODO: Move loadkeys_on to conf.sh.common 44 dnssec_loadkeys_on() { 45 nsidx=$1 46 zone=$2 47 nextpart ns${nsidx}/named.run > /dev/null 48 rndccmd 10.53.0.${nsidx} loadkeys ${zone} | sed "s/^/ns${nsidx} /" | cat_i 49 wait_for_log 20 "next key event" ns${nsidx}/named.run || return 1 50 } 51 52 # convert private-type records to readable form 53 showprivate () { 54 echo "-- $* --" 55 dig_with_opts +nodnssec +short "@$2" -t type65534 "$1" | cut -f3 -d' ' | 56 while read -r record; do 57 # shellcheck disable=SC2016 58 $PERL -e 'my $rdata = pack("H*", @ARGV[0]); 59 die "invalid record" unless length($rdata) == 5; 60 my ($alg, $key, $remove, $complete) = unpack("CnCC", $rdata); 61 my $action = "signing"; 62 $action = "removing" if $remove; 63 my $state = " (incomplete)"; 64 $state = " (complete)" if $complete; 65 print ("$action: alg: $alg, key: $key$state\n");' "$record" 66 done 67 } 68 69 # check that signing records are marked as complete 70 checkprivate () { 71 for i in 1 2 3 4 5 6 7 8 9 10; do 72 showprivate "$@" | grep -q incomplete || return 0 73 sleep 1 74 done 75 echo_d "$1 signing incomplete" 76 return 1 77 } 78 79 # check that a zone file is raw format, version 0 80 israw0 () { 81 # shellcheck disable=SC2016 82 < "$1" $PERL -e 'binmode STDIN; 83 read(STDIN, $input, 8); 84 ($style, $version) = unpack("NN", $input); 85 exit 1 if ($style != 2 || $version != 0);' 86 return $? 87 } 88 89 # check that a zone file is raw format, version 1 90 israw1 () { 91 # shellcheck disable=SC2016 92 < "$1" $PERL -e 'binmode STDIN; 93 read(STDIN, $input, 8); 94 ($style, $version) = unpack("NN", $input); 95 exit 1 if ($style != 2 || $version != 1);' 96 return $? 97 } 98 99 # strip NS and RRSIG NS from input 100 stripns () { 101 awk '($4 == "NS") || ($4 == "RRSIG" && $5 == "NS") { next} { print }' "$1" 102 } 103 104 # 105 # Ensure there is not multiple consecutive blank lines. 106 # Ensure there is a blank line before "Start view" and 107 # "Negative trust anchors:". 108 # Ensure there is not a blank line before "Secure roots:". 109 # 110 check_secroots_layout () { 111 tr -d '\r' < "$1" | \ 112 awk '$0 == "" { if (empty) exit(1); empty=1; next } 113 /Start view/ { if (!empty) exit(1) } 114 /Secure roots:/ { if (empty) exit(1) } 115 /Negative trust anchors:/ { if (!empty) exit(1) } 116 { empty=0 }' 117 return $? 118 } 119 120 # Check that for a query against a validating resolver where the 121 # authoritative zone is unsigned (insecure delegation), glue is returned 122 # in the additional section 123 echo_i "checking that additional glue is returned for unsigned delegation ($n)" 124 ret=0 125 $DIG +tcp +dnssec -p "$PORT" a.insecure.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1 126 grep "ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 2" dig.out.ns4.test$n > /dev/null || ret=1 127 grep "ns\\.insecure\\.example\\..*A.10\\.53\\.0\\.3" dig.out.ns4.test$n > /dev/null || ret=1 128 n=$((n+1)) 129 if [ "$ret" -ne 0 ]; then echo_i "failed"; fi 130 status=$((status+ret)) 131 132 # Check the example. domain 133 134 echo_i "checking that zone transfer worked ($n)" 135 for i in 1 2 3 4 5 6 7 8 9 136 do 137 ret=0 138 dig_with_opts a.example. @10.53.0.2 a > dig.out.ns2.test$n || ret=1 139 dig_with_opts a.example. @10.53.0.3 a > dig.out.ns3.test$n || ret=1 140 $PERL ../digcomp.pl dig.out.ns2.test$n dig.out.ns3.test$n > /dev/null || ret=1 141 [ "$ret" -eq 0 ] && break 142 sleep 1 143 done 144 digcomp dig.out.ns2.test$n dig.out.ns3.test$n > /dev/null || ret=1 145 n=$((n+1)) 146 test "$ret" -eq 0 || echo_i "failed" 147 status=$((status+ret)) 148 149 # test AD bit: 150 # - dig +adflag asks for authentication (ad in response) 151 echo_i "checking AD bit asking for validation ($n)" 152 ret=0 153 dig_with_opts +noauth +noadd +nodnssec +adflag a.example. @10.53.0.2 a > dig.out.ns2.test$n || ret=1 154 dig_with_opts +noauth +noadd +nodnssec +adflag a.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1 155 digcomp dig.out.ns2.test$n dig.out.ns4.test$n || ret=1 156 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 157 n=$((n+1)) 158 test "$ret" -eq 0 || echo_i "failed" 159 status=$((status+ret)) 160 161 # test AD bit: 162 # - dig +noadflag 163 echo_i "checking that AD is not set without +adflag or +dnssec ($n)" 164 ret=0 165 dig_with_opts +noauth +noadd +nodnssec +noadflag a.example. @10.53.0.2 a > dig.out.ns2.test$n || ret=1 166 dig_with_opts +noauth +noadd +nodnssec +noadflag a.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1 167 digcomp dig.out.ns2.test$n dig.out.ns4.test$n || ret=1 168 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 169 n=$((n+1)) 170 test "$ret" -eq 0 || echo_i "failed" 171 status=$((status+ret)) 172 173 echo_i "checking for AD in authoritative answer ($n)" 174 ret=0 175 dig_with_opts a.example. @10.53.0.2 a > dig.out.ns2.test$n || ret=1 176 grep "flags:.*ad.*QUERY" dig.out.ns2.test$n > /dev/null && ret=1 177 n=$((n+1)) 178 test "$ret" -eq 0 || echo_i "failed" 179 status=$((status+ret)) 180 181 echo_i "checking positive validation NSEC ($n)" 182 ret=0 183 dig_with_opts +noauth a.example. @10.53.0.2 a > dig.out.ns2.test$n || ret=1 184 dig_with_opts +noauth a.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1 185 digcomp dig.out.ns2.test$n dig.out.ns4.test$n || ret=1 186 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 187 n=$((n+1)) 188 test "$ret" -eq 0 || echo_i "failed" 189 status=$((status+ret)) 190 191 echo_i "checking that 'example/DS' from the referral was used in previous validation ($n)" 192 ret=0 193 grep "query 'example/DS/IN' approved" ns1/named.run > /dev/null && ret=1 194 grep "fetch: example/DS" ns4/named.run > /dev/null && ret=1 195 grep "validating example/DS: starting" ns4/named.run > /dev/null || ret=1 196 n=$((n+1)) 197 test "$ret" -eq 0 || echo_i "failed" 198 status=$((status+ret)) 199 200 if [ -x ${DELV} ] ; then 201 ret=0 202 echo_i "checking positive validation NSEC using dns_client ($n)" 203 delv_with_opts @10.53.0.4 a a.example > delv.out$n || ret=1 204 grep "a.example..*10.0.0.1" delv.out$n > /dev/null || ret=1 205 grep "a.example..*.RRSIG.A [0-9][0-9]* 2 300 .*" delv.out$n > /dev/null || ret=1 206 n=$((n+1)) 207 test "$ret" -eq 0 || echo_i "failed" 208 status=$((status+ret)) 209 210 ret=0 211 echo_i "checking positive validation NSEC using dns_client (trusted-keys) ($n)" 212 "$DELV" -a ns1/trusted.keys -p "$PORT" @10.53.0.4 a a.example > delv.out$n || ret=1 213 grep "a.example..*10.0.0.1" delv.out$n > /dev/null || ret=1 214 grep "a.example..*.RRSIG.A [0-9][0-9]* 2 300 .*" delv.out$n > /dev/null || ret=1 215 n=$((n+1)) 216 test "$ret" -eq 0 || echo_i "failed" 217 status=$((status+ret)) 218 fi 219 220 echo_i "checking positive validation NSEC3 ($n)" 221 ret=0 222 dig_with_opts +noauth a.nsec3.example. \ 223 @10.53.0.3 a > dig.out.ns3.test$n || ret=1 224 dig_with_opts +noauth a.nsec3.example. \ 225 @10.53.0.4 a > dig.out.ns4.test$n || ret=1 226 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 227 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 228 n=$((n+1)) 229 test "$ret" -eq 0 || echo_i "failed" 230 status=$((status+ret)) 231 232 if [ -x ${DELV} ] ; then 233 ret=0 234 echo_i "checking positive validation NSEC3 using dns_client ($n)" 235 delv_with_opts @10.53.0.4 a a.nsec3.example > delv.out$n || ret=1 236 grep "a.nsec3.example..*10.0.0.1" delv.out$n > /dev/null || ret=1 237 grep "a.nsec3.example..*RRSIG.A [0-9][0-9]* 3 300.*" delv.out$n > /dev/null || ret=1 238 n=$((n+1)) 239 test "$ret" -eq 0 || echo_i "failed" 240 status=$((status+ret)) 241 fi 242 243 echo_i "checking positive validation OPTOUT ($n)" 244 ret=0 245 dig_with_opts +noauth a.optout.example. \ 246 @10.53.0.3 a > dig.out.ns3.test$n || ret=1 247 dig_with_opts +noauth a.optout.example. \ 248 @10.53.0.4 a > dig.out.ns4.test$n || ret=1 249 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 250 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 251 n=$((n+1)) 252 test "$ret" -eq 0 || echo_i "failed" 253 status=$((status+ret)) 254 255 SP="[[:space:]]+" 256 257 if [ -x ${DELV} ] ; then 258 ret=0 259 echo_i "checking positive validation OPTOUT using dns_client ($n)" 260 delv_with_opts @10.53.0.4 a a.optout.example > delv.out$n || ret=1 261 grep -Eq "^a\\.optout\\.example\\.""$SP""[0-9]+""$SP""IN""$SP""A""$SP""10.0.0.1" delv.out$n || ret=1 262 grep -Eq "^a\\.optout\\.example\\.""$SP""[0-9]+""$SP""IN""$SP""RRSIG""$SP""A""$SP""$DEFAULT_ALGORITHM_NUMBER""$SP""3""$SP""300" delv.out$n || ret=1 263 n=$((n+1)) 264 test "$ret" -eq 0 || echo_i "failed" 265 status=$((status+ret)) 266 fi 267 268 echo_i "checking positive wildcard validation NSEC ($n)" 269 ret=0 270 dig_with_opts a.wild.example. @10.53.0.3 a > dig.out.ns3.test$n || ret=1 271 dig_with_opts a.wild.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1 272 stripns dig.out.ns3.test$n > dig.out.ns3.stripped.test$n 273 stripns dig.out.ns4.test$n > dig.out.ns4.stripped.test$n 274 digcomp dig.out.ns3.stripped.test$n dig.out.ns4.stripped.test$n || ret=1 275 grep "\\*\\.wild\\.example\\..*RRSIG NSEC" dig.out.ns4.test$n > /dev/null || ret=1 276 grep "\\*\\.wild\\.example\\..*NSEC z\\.example" dig.out.ns4.test$n > /dev/null || ret=1 277 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 278 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 279 n=$((n+1)) 280 test "$ret" -eq 0 || echo_i "failed" 281 status=$((status+ret)) 282 283 if [ -x ${DELV} ] ; then 284 ret=0 285 echo_i "checking positive wildcard validation NSEC using dns_client ($n)" 286 delv_with_opts @10.53.0.4 a a.wild.example > delv.out$n || ret=1 287 grep "a.wild.example..*10.0.0.27" delv.out$n > /dev/null || ret=1 288 grep -E "a.wild.example..*RRSIG.A [0-9]+ 2 300.*" delv.out$n > /dev/null || ret=1 289 n=$((n+1)) 290 test "$ret" -eq 0 || echo_i "failed" 291 status=$((status+ret)) 292 fi 293 294 echo_i "checking positive wildcard answer NSEC3 ($n)" 295 ret=0 296 dig_with_opts a.wild.nsec3.example. @10.53.0.3 a > dig.out.ns3.test$n || ret=1 297 grep "AUTHORITY: 4," dig.out.ns3.test$n > /dev/null || ret=1 298 grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || ret=1 299 n=$((n+1)) 300 test "$ret" -eq 0 || echo_i "failed" 301 status=$((status+ret)) 302 303 echo_i "checking positive wildcard answer NSEC3 ($n)" 304 ret=0 305 dig_with_opts a.wild.nsec3.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1 306 grep "AUTHORITY: 4," dig.out.ns4.test$n > /dev/null || ret=1 307 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 308 n=$((n+1)) 309 test "$ret" -eq 0 || echo_i "failed" 310 status=$((status+ret)) 311 312 echo_i "checking positive wildcard validation NSEC3 ($n)" 313 ret=0 314 dig_with_opts a.wild.nsec3.example. @10.53.0.3 a > dig.out.ns3.test$n || ret=1 315 dig_with_opts a.wild.nsec3.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1 316 stripns dig.out.ns3.test$n > dig.out.ns3.stripped.test$n 317 stripns dig.out.ns4.test$n > dig.out.ns4.stripped.test$n 318 digcomp dig.out.ns3.stripped.test$n dig.out.ns4.stripped.test$n || ret=1 319 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 320 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 321 n=$((n+1)) 322 test "$ret" -eq 0 || echo_i "failed" 323 status=$((status+ret)) 324 325 if [ -x ${DELV} ] ; then 326 ret=0 327 echo_i "checking positive wildcard validation NSEC3 using dns_client ($n)" 328 delv_with_opts @10.53.0.4 a a.wild.nsec3.example > delv.out$n || ret=1 329 grep -E "a.wild.nsec3.example..*10.0.0.6" delv.out$n > /dev/null || ret=1 330 grep -E "a.wild.nsec3.example..*RRSIG.A [0-9][0-9]* 3 300.*" delv.out$n > /dev/null || ret=1 331 n=$((n+1)) 332 test "$ret" -eq 0 || echo_i "failed" 333 status=$((status+ret)) 334 fi 335 336 echo_i "checking positive wildcard validation OPTOUT ($n)" 337 ret=0 338 dig_with_opts a.wild.optout.example. \ 339 @10.53.0.3 a > dig.out.ns3.test$n || ret=1 340 dig_with_opts a.wild.optout.example. \ 341 @10.53.0.4 a > dig.out.ns4.test$n || ret=1 342 stripns dig.out.ns3.test$n > dig.out.ns3.stripped.test$n 343 stripns dig.out.ns4.test$n > dig.out.ns4.stripped.test$n 344 digcomp dig.out.ns3.stripped.test$n dig.out.ns4.stripped.test$n || ret=1 345 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 346 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 347 n=$((n+1)) 348 test "$ret" -eq 0 || echo_i "failed" 349 status=$((status+ret)) 350 351 if [ -x ${DELV} ] ; then 352 ret=0 353 echo_i "checking positive wildcard validation OPTOUT using dns_client ($n)" 354 delv_with_opts @10.53.0.4 a a.wild.optout.example > delv.out$n || ret=1 355 grep "a.wild.optout.example..*10.0.0.6" delv.out$n > /dev/null || ret=1 356 grep "a.wild.optout.example..*RRSIG.A [0-9][0-9]* 3 300.*" delv.out$n > /dev/null || ret=1 357 n=$((n+1)) 358 test "$ret" -eq 0 || echo_i "failed" 359 status=$((status+ret)) 360 fi 361 362 echo_i "checking negative validation NXDOMAIN NSEC ($n)" 363 ret=0 364 dig_with_opts +noauth q.example. @10.53.0.2 a > dig.out.ns2.test$n || ret=1 365 dig_with_opts +noauth q.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1 366 digcomp dig.out.ns2.test$n dig.out.ns4.test$n || ret=1 367 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 368 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1 369 n=$((n+1)) 370 test "$ret" -eq 0 || echo_i "failed" 371 status=$((status+ret)) 372 373 if [ -x ${DELV} ] ; then 374 ret=0 375 echo_i "checking negative validation NXDOMAIN NSEC using dns_client ($n)" 376 delv_with_opts @10.53.0.4 a q.example > delv.out$n 2>&1 || ret=1 377 grep "resolution failed: ncache nxdomain" delv.out$n > /dev/null || ret=1 378 n=$((n+1)) 379 test "$ret" -eq 0 || echo_i "failed" 380 status=$((status+ret)) 381 fi 382 383 echo_i "checking negative validation NXDOMAIN NSEC3 ($n)" 384 ret=0 385 dig_with_opts +noauth q.nsec3.example. \ 386 @10.53.0.3 a > dig.out.ns3.test$n || ret=1 387 dig_with_opts +noauth q.nsec3.example. \ 388 @10.53.0.4 a > dig.out.ns4.test$n || ret=1 389 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 390 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 391 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1 392 n=$((n+1)) 393 test "$ret" -eq 0 || echo_i "failed" 394 status=$((status+ret)) 395 396 if [ -x ${DELV} ] ; then 397 ret=0 398 echo_i "checking negative validation NXDOMAIN NSEC3 using dns_client ($n)" 399 delv_with_opts @10.53.0.4 a q.nsec3.example > delv.out$n 2>&1 || ret=1 400 grep "resolution failed: ncache nxdomain" delv.out$n > /dev/null || ret=1 401 n=$((n+1)) 402 test "$ret" -eq 0 || echo_i "failed" 403 status=$((status+ret)) 404 fi 405 406 echo_i "checking negative validation NXDOMAIN OPTOUT ($n)" 407 ret=0 408 dig_with_opts +noauth q.optout.example. \ 409 @10.53.0.3 a > dig.out.ns3.test$n || ret=1 410 dig_with_opts +noauth q.optout.example. \ 411 @10.53.0.4 a > dig.out.ns4.test$n || ret=1 412 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 413 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1 414 # Note - this is looking for failure, hence the && 415 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 416 n=$((n+1)) 417 test "$ret" -eq 0 || echo_i "failed" 418 status=$((status+ret)) 419 420 if [ -x ${DELV} ] ; then 421 ret=0 422 echo_i "checking negative validation NXDOMAIN OPTOUT using dns_client ($n)" 423 delv_with_opts @10.53.0.4 a q.optout.example > delv.out$n 2>&1 || ret=1 424 grep "resolution failed: ncache nxdomain" delv.out$n > /dev/null || ret=1 425 n=$((n+1)) 426 test "$ret" -eq 0 || echo_i "failed" 427 status=$((status+ret)) 428 fi 429 430 echo_i "checking negative validation NODATA NSEC ($n)" 431 ret=0 432 dig_with_opts +noauth a.example. @10.53.0.2 txt > dig.out.ns2.test$n || ret=1 433 dig_with_opts +noauth a.example. @10.53.0.4 txt > dig.out.ns4.test$n || ret=1 434 digcomp dig.out.ns2.test$n dig.out.ns4.test$n || ret=1 435 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 436 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 437 grep "ANSWER: 0" dig.out.ns4.test$n > /dev/null || ret=1 438 n=$((n+1)) 439 test "$ret" -eq 0 || echo_i "failed" 440 status=$((status+ret)) 441 442 if [ -x ${DELV} ] ; then 443 ret=0 444 echo_i "checking negative validation NODATA OPTOUT using dns_client ($n)" 445 delv_with_opts @10.53.0.4 txt a.example > delv.out$n 2>&1 || ret=1 446 grep "resolution failed: ncache nxrrset" delv.out$n > /dev/null || ret=1 447 n=$((n+1)) 448 test "$ret" -eq 0 || echo_i "failed" 449 status=$((status+ret)) 450 fi 451 452 echo_i "checking negative validation NODATA NSEC3 ($n)" 453 ret=0 454 dig_with_opts +noauth a.nsec3.example. \ 455 @10.53.0.3 txt > dig.out.ns3.test$n || ret=1 456 dig_with_opts +noauth a.nsec3.example. \ 457 @10.53.0.4 txt > dig.out.ns4.test$n || ret=1 458 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 459 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 460 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 461 grep "ANSWER: 0" dig.out.ns4.test$n > /dev/null || ret=1 462 n=$((n+1)) 463 test "$ret" -eq 0 || echo_i "failed" 464 status=$((status+ret)) 465 466 if [ -x ${DELV} ] ; then 467 ret=0 468 echo_i "checking negative validation NODATA NSEC3 using dns_client ($n)" 469 delv_with_opts @10.53.0.4 txt a.nsec3.example > delv.out$n 2>&1 || ret=1 470 grep "resolution failed: ncache nxrrset" delv.out$n > /dev/null || ret=1 471 n=$((n+1)) 472 test "$ret" -eq 0 || echo_i "failed" 473 status=$((status+ret)) 474 fi 475 476 echo_i "checking negative validation NODATA OPTOUT ($n)" 477 ret=0 478 dig_with_opts +noauth a.optout.example. \ 479 @10.53.0.3 txt > dig.out.ns3.test$n || ret=1 480 dig_with_opts +noauth a.optout.example. \ 481 @10.53.0.4 txt > dig.out.ns4.test$n || ret=1 482 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 483 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 484 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 485 grep "ANSWER: 0" dig.out.ns4.test$n > /dev/null || ret=1 486 n=$((n+1)) 487 test "$ret" -eq 0 || echo_i "failed" 488 status=$((status+ret)) 489 490 if [ -x ${DELV} ] ; then 491 ret=0 492 echo_i "checking negative validation NODATA OPTOUT using dns_client ($n)" 493 delv_with_opts @10.53.0.4 txt a.optout.example > delv.out$n 2>&1 || ret=1 494 grep "resolution failed: ncache nxrrset" delv.out$n > /dev/null || ret=1 495 n=$((n+1)) 496 test "$ret" -eq 0 || echo_i "failed" 497 status=$((status+ret)) 498 fi 499 500 echo_i "checking negative wildcard validation NSEC ($n)" 501 ret=0 502 dig_with_opts b.wild.example. @10.53.0.2 txt > dig.out.ns2.test$n || ret=1 503 dig_with_opts b.wild.example. @10.53.0.4 txt > dig.out.ns4.test$n || ret=1 504 digcomp dig.out.ns2.test$n dig.out.ns4.test$n || ret=1 505 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 506 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 507 n=$((n+1)) 508 test "$ret" -eq 0 || echo_i "failed" 509 status=$((status+ret)) 510 511 if [ -x ${DELV} ] ; then 512 ret=0 513 echo_i "checking negative wildcard validation NSEC using dns_client ($n)" 514 delv_with_opts @10.53.0.4 txt b.wild.example > delv.out$n 2>&1 || ret=1 515 grep "resolution failed: ncache nxrrset" delv.out$n > /dev/null || ret=1 516 n=$((n+1)) 517 test "$ret" -eq 0 || echo_i "failed" 518 status=$((status+ret)) 519 fi 520 521 echo_i "checking negative wildcard validation NSEC3 ($n)" 522 ret=0 523 dig_with_opts b.wild.nsec3.example. @10.53.0.3 txt > dig.out.ns3.test$n || ret=1 524 dig_with_opts b.wild.nsec3.example. @10.53.0.4 txt > dig.out.ns4.test$n || ret=1 525 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 526 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 527 n=$((n+1)) 528 test "$ret" -eq 0 || echo_i "failed" 529 status=$((status+ret)) 530 531 if [ -x ${DELV} ] ; then 532 ret=0 533 echo_i "checking negative wildcard validation NSEC3 using dns_client ($n)" 534 delv_with_opts @10.53.0.4 txt b.wild.nsec3.example > delv.out$n 2>&1 || ret=1 535 grep "resolution failed: ncache nxrrset" delv.out$n > /dev/null || ret=1 536 n=$((n+1)) 537 test "$ret" -eq 0 || echo_i "failed" 538 status=$((status+ret)) 539 fi 540 541 echo_i "checking negative wildcard validation OPTOUT ($n)" 542 ret=0 543 dig_with_opts b.wild.optout.example. \ 544 @10.53.0.3 txt > dig.out.ns3.test$n || ret=1 545 dig_with_opts b.wild.optout.example. \ 546 @10.53.0.4 txt > dig.out.ns4.test$n || ret=1 547 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 548 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 549 # Note - this is looking for failure, hence the && 550 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 551 n=$((n+1)) 552 test "$ret" -eq 0 || echo_i "failed" 553 status=$((status+ret)) 554 555 if [ -x ${DELV} ] ; then 556 ret=0 557 echo_i "checking negative wildcard validation OPTOUT using dns_client ($n)" 558 delv_with_opts @10.53.0.4 txt b.optout.nsec3.example > delv.out$n 2>&1 || ret=1 559 grep "resolution failed: ncache nxrrset" delv.out$n > /dev/null || ret=1 560 n=$((n+1)) 561 test "$ret" -eq 0 || echo_i "failed" 562 status=$((status+ret)) 563 fi 564 565 # Check the insecure.example domain 566 567 echo_i "checking 1-server insecurity proof NSEC ($n)" 568 ret=0 569 dig_with_opts +noauth a.insecure.example. @10.53.0.3 a > dig.out.ns3.test$n || ret=1 570 dig_with_opts +noauth a.insecure.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1 571 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 572 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 573 # Note - this is looking for failure, hence the && 574 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 575 n=$((n+1)) 576 test "$ret" -eq 0 || echo_i "failed" 577 status=$((status+ret)) 578 579 if [ -x ${DELV} ] ; then 580 ret=0 581 echo_i "checking 1-server insecurity proof NSEC using dns_client ($n)" 582 delv_with_opts @10.53.0.4 a a.insecure.example > delv.out$n || ret=1 583 grep "a.insecure.example..*10.0.0.1" delv.out$n > /dev/null || ret=1 584 n=$((n+1)) 585 test "$ret" -eq 0 || echo_i "failed" 586 status=$((status+ret)) 587 fi 588 589 echo_i "checking 1-server insecurity proof NSEC3 ($n)" 590 ret=0 591 dig_with_opts +noauth a.insecure.nsec3.example. @10.53.0.3 a > dig.out.ns3.test$n || ret=1 592 dig_with_opts +noauth a.insecure.nsec3.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1 593 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 594 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 595 # Note - this is looking for failure, hence the && 596 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 597 n=$((n+1)) 598 test "$ret" -eq 0 || echo_i "failed" 599 status=$((status+ret)) 600 601 if [ -x ${DELV} ] ; then 602 ret=0 603 echo_i "checking 1-server insecurity proof NSEC3 using dns_client ($n)" 604 delv_with_opts @10.53.0.4 a a.insecure.nsec3.example > delv.out$n || ret=1 605 grep "a.insecure.nsec3.example..*10.0.0.1" delv.out$n > /dev/null || ret=1 606 n=$((n+1)) 607 test "$ret" -eq 0 || echo_i "failed" 608 status=$((status+ret)) 609 fi 610 611 echo_i "checking 1-server insecurity proof OPTOUT ($n)" 612 ret=0 613 dig_with_opts +noauth a.insecure.optout.example. @10.53.0.3 a > dig.out.ns3.test$n || ret=1 614 dig_with_opts +noauth a.insecure.optout.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1 615 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 616 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 617 # Note - this is looking for failure, hence the && 618 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 619 n=$((n+1)) 620 test "$ret" -eq 0 || echo_i "failed" 621 status=$((status+ret)) 622 623 if [ -x ${DELV} ] ; then 624 ret=0 625 echo_i "checking 1-server insecurity proof OPTOUT using dns_client ($n)" 626 delv_with_opts @10.53.0.4 a a.insecure.optout.example > delv.out$n || ret=1 627 grep "a.insecure.optout.example..*10.0.0.1" delv.out$n > /dev/null || ret=1 628 n=$((n+1)) 629 test "$ret" -eq 0 || echo_i "failed" 630 status=$((status+ret)) 631 fi 632 633 echo_i "checking 1-server negative insecurity proof NSEC ($n)" 634 ret=0 635 dig_with_opts q.insecure.example. a @10.53.0.3 \ 636 > dig.out.ns3.test$n || ret=1 637 dig_with_opts q.insecure.example. a @10.53.0.4 \ 638 > dig.out.ns4.test$n || ret=1 639 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 640 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1 641 # Note - this is looking for failure, hence the && 642 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 643 n=$((n+1)) 644 test "$ret" -eq 0 || echo_i "failed" 645 status=$((status+ret)) 646 647 if [ -x ${DELV} ] ; then 648 ret=0 649 echo_i "checking 1-server negative insecurity proof NSEC using dns_client ($n)" 650 delv_with_opts @10.53.0.4 a q.insecure.example > delv.out$n 2>&1 || ret=1 651 grep "resolution failed: ncache nxdomain" delv.out$n > /dev/null || ret=1 652 n=$((n+1)) 653 test "$ret" -eq 0 || echo_i "failed" 654 status=$((status+ret)) 655 fi 656 657 echo_i "checking 1-server negative insecurity proof NSEC3 ($n)" 658 ret=0 659 dig_with_opts q.insecure.nsec3.example. a @10.53.0.3 \ 660 > dig.out.ns3.test$n || ret=1 661 dig_with_opts q.insecure.nsec3.example. a @10.53.0.4 \ 662 > dig.out.ns4.test$n || ret=1 663 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 664 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1 665 # Note - this is looking for failure, hence the && 666 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 667 n=$((n+1)) 668 test "$ret" -eq 0 || echo_i "failed" 669 status=$((status+ret)) 670 671 if [ -x ${DELV} ] ; then 672 ret=0 673 echo_i "checking 1-server negative insecurity proof NSEC3 using dns_client ($n)" 674 delv_with_opts @10.53.0.4 a q.insecure.nsec3.example > delv.out$n 2>&1 || ret=1 675 grep "resolution failed: ncache nxdomain" delv.out$n > /dev/null || ret=1 676 n=$((n+1)) 677 test "$ret" -eq 0 || echo_i "failed" 678 status=$((status+ret)) 679 fi 680 681 echo_i "checking 1-server negative insecurity proof OPTOUT ($n)" 682 ret=0 683 dig_with_opts q.insecure.optout.example. a @10.53.0.3 \ 684 > dig.out.ns3.test$n || ret=1 685 dig_with_opts q.insecure.optout.example. a @10.53.0.4 \ 686 > dig.out.ns4.test$n || ret=1 687 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 688 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1 689 # Note - this is looking for failure, hence the && 690 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 691 n=$((n+1)) 692 test "$ret" -eq 0 || echo_i "failed" 693 status=$((status+ret)) 694 695 if [ -x ${DELV} ] ; then 696 ret=0 697 echo_i "checking 1-server negative insecurity proof OPTOUT using dns_client ($n)" 698 delv_with_opts @10.53.0.4 a q.insecure.optout.example > delv.out$n 2>&1 || ret=1 699 grep "resolution failed: ncache nxdomain" delv.out$n > /dev/null || ret=1 700 n=$((n+1)) 701 test "$ret" -eq 0 || echo_i "failed" 702 status=$((status+ret)) 703 fi 704 705 echo_i "checking 1-server negative insecurity proof with SOA hack NSEC ($n)" 706 ret=0 707 dig_with_opts r.insecure.example. soa @10.53.0.3 \ 708 > dig.out.ns3.test$n || ret=1 709 dig_with_opts r.insecure.example. soa @10.53.0.4 \ 710 > dig.out.ns4.test$n || ret=1 711 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 712 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1 713 grep "0 IN SOA" dig.out.ns4.test$n > /dev/null || ret=1 714 # Note - this is looking for failure, hence the && 715 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 716 n=$((n+1)) 717 test "$ret" -eq 0 || echo_i "failed" 718 status=$((status+ret)) 719 720 echo_i "checking 1-server negative insecurity proof with SOA hack NSEC3 ($n)" 721 ret=0 722 dig_with_opts r.insecure.nsec3.example. soa @10.53.0.3 \ 723 > dig.out.ns3.test$n || ret=1 724 dig_with_opts r.insecure.nsec3.example. soa @10.53.0.4 \ 725 > dig.out.ns4.test$n || ret=1 726 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 727 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1 728 grep "0 IN SOA" dig.out.ns4.test$n > /dev/null || ret=1 729 # Note - this is looking for failure, hence the && 730 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 731 n=$((n+1)) 732 test "$ret" -eq 0 || echo_i "failed" 733 status=$((status+ret)) 734 735 echo_i "checking 1-server negative insecurity proof with SOA hack OPTOUT ($n)" 736 ret=0 737 dig_with_opts r.insecure.optout.example. soa @10.53.0.3 \ 738 > dig.out.ns3.test$n || ret=1 739 dig_with_opts r.insecure.optout.example. soa @10.53.0.4 \ 740 > dig.out.ns4.test$n || ret=1 741 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 742 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1 743 grep "0 IN SOA" dig.out.ns4.test$n > /dev/null || ret=1 744 # Note - this is looking for failure, hence the && 745 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 746 n=$((n+1)) 747 test "$ret" -eq 0 || echo_i "failed" 748 status=$((status+ret)) 749 750 # Check the secure.example domain 751 752 echo_i "checking multi-stage positive validation NSEC/NSEC ($n)" 753 ret=0 754 dig_with_opts +noauth a.secure.example. \ 755 @10.53.0.3 a > dig.out.ns3.test$n || ret=1 756 dig_with_opts +noauth a.secure.example. \ 757 @10.53.0.4 a > dig.out.ns4.test$n || ret=1 758 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 759 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 760 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 761 n=$((n+1)) 762 test "$ret" -eq 0 || echo_i "failed" 763 status=$((status+ret)) 764 765 echo_i "checking multi-stage positive validation NSEC/NSEC3 ($n)" 766 ret=0 767 dig_with_opts +noauth a.nsec3.example. \ 768 @10.53.0.3 a > dig.out.ns3.test$n || ret=1 769 dig_with_opts +noauth a.nsec3.example. \ 770 @10.53.0.4 a > dig.out.ns4.test$n || ret=1 771 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 772 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 773 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 774 n=$((n+1)) 775 test "$ret" -eq 0 || echo_i "failed" 776 status=$((status+ret)) 777 778 echo_i "checking multi-stage positive validation NSEC/OPTOUT ($n)" 779 ret=0 780 dig_with_opts +noauth a.optout.example. \ 781 @10.53.0.3 a > dig.out.ns3.test$n || ret=1 782 dig_with_opts +noauth a.optout.example. \ 783 @10.53.0.4 a > dig.out.ns4.test$n || ret=1 784 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 785 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 786 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 787 n=$((n+1)) 788 test "$ret" -eq 0 || echo_i "failed" 789 status=$((status+ret)) 790 791 echo_i "checking multi-stage positive validation NSEC3/NSEC ($n)" 792 ret=0 793 dig_with_opts +noauth a.secure.nsec3.example. \ 794 @10.53.0.3 a > dig.out.ns3.test$n || ret=1 795 dig_with_opts +noauth a.secure.nsec3.example. \ 796 @10.53.0.4 a > dig.out.ns4.test$n || ret=1 797 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 798 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 799 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 800 n=$((n+1)) 801 test "$ret" -eq 0 || echo_i "failed" 802 status=$((status+ret)) 803 804 echo_i "checking multi-stage positive validation NSEC3/NSEC3 ($n)" 805 ret=0 806 dig_with_opts +noauth a.nsec3.nsec3.example. \ 807 @10.53.0.3 a > dig.out.ns3.test$n || ret=1 808 dig_with_opts +noauth a.nsec3.nsec3.example. \ 809 @10.53.0.4 a > dig.out.ns4.test$n || ret=1 810 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 811 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 812 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 813 n=$((n+1)) 814 test "$ret" -eq 0 || echo_i "failed" 815 status=$((status+ret)) 816 817 echo_i "checking multi-stage positive validation NSEC3/OPTOUT ($n)" 818 ret=0 819 dig_with_opts +noauth a.optout.nsec3.example. \ 820 @10.53.0.3 a > dig.out.ns3.test$n || ret=1 821 dig_with_opts +noauth a.optout.nsec3.example. \ 822 @10.53.0.4 a > dig.out.ns4.test$n || ret=1 823 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 824 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 825 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 826 n=$((n+1)) 827 test "$ret" -eq 0 || echo_i "failed" 828 status=$((status+ret)) 829 830 echo_i "checking multi-stage positive validation OPTOUT/NSEC ($n)" 831 ret=0 832 dig_with_opts +noauth a.secure.optout.example. \ 833 @10.53.0.3 a > dig.out.ns3.test$n || ret=1 834 dig_with_opts +noauth a.secure.optout.example. \ 835 @10.53.0.4 a > dig.out.ns4.test$n || ret=1 836 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 837 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 838 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 839 n=$((n+1)) 840 test "$ret" -eq 0 || echo_i "failed" 841 status=$((status+ret)) 842 843 echo_i "checking multi-stage positive validation OPTOUT/NSEC3 ($n)" 844 ret=0 845 dig_with_opts +noauth a.nsec3.optout.example. \ 846 @10.53.0.3 a > dig.out.ns3.test$n || ret=1 847 dig_with_opts +noauth a.nsec3.optout.example. \ 848 @10.53.0.4 a > dig.out.ns4.test$n || ret=1 849 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 850 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 851 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 852 n=$((n+1)) 853 test "$ret" -eq 0 || echo_i "failed" 854 status=$((status+ret)) 855 856 echo_i "checking multi-stage positive validation OPTOUT/OPTOUT ($n)" 857 ret=0 858 dig_with_opts +noauth a.optout.optout.example. \ 859 @10.53.0.3 a > dig.out.ns3.test$n || ret=1 860 dig_with_opts +noauth a.optout.optout.example. \ 861 @10.53.0.4 a > dig.out.ns4.test$n || ret=1 862 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 863 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 864 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 865 n=$((n+1)) 866 test "$ret" -eq 0 || echo_i "failed" 867 status=$((status+ret)) 868 869 echo_i "checking empty NODATA OPTOUT ($n)" 870 ret=0 871 dig_with_opts +noauth empty.optout.example. \ 872 @10.53.0.3 a > dig.out.ns3.test$n || ret=1 873 dig_with_opts +noauth empty.optout.example. \ 874 @10.53.0.4 a > dig.out.ns4.test$n || ret=1 875 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 876 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 877 #grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 878 n=$((n+1)) 879 test "$ret" -eq 0 || echo_i "failed" 880 status=$((status+ret)) 881 882 # Check the bogus domain 883 884 echo_i "checking failed validation ($n)" 885 ret=0 886 dig_with_opts a.bogus.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1 887 grep "SERVFAIL" dig.out.ns4.test$n > /dev/null || ret=1 888 n=$((n+1)) 889 test "$ret" -eq 0 || echo_i "failed" 890 status=$((status+ret)) 891 892 if [ -x ${DELV} ] ; then 893 ret=0 894 echo_i "checking failed validation using dns_client ($n)" 895 delv_with_opts +cd @10.53.0.4 a a.bogus.example > delv.out$n 2>&1 || ret=1 896 grep "resolution failed: RRSIG failed to verify" delv.out$n > /dev/null || ret=1 897 n=$((n+1)) 898 test "$ret" -eq 0 || echo_i "failed" 899 status=$((status+ret)) 900 fi 901 902 # Try validating with a bad trusted key. 903 # This should fail. 904 905 echo_i "checking that validation fails with a misconfigured trusted key ($n)" 906 ret=0 907 dig_with_opts example. soa @10.53.0.5 > dig.out.ns5.test$n || ret=1 908 grep "SERVFAIL" dig.out.ns5.test$n > /dev/null || ret=1 909 n=$((n+1)) 910 test "$ret" -eq 0 || echo_i "failed" 911 status=$((status+ret)) 912 913 echo_i "checking that negative validation fails with a misconfigured trusted key ($n)" 914 ret=0 915 dig_with_opts example. ptr @10.53.0.5 > dig.out.ns5.test$n || ret=1 916 grep "SERVFAIL" dig.out.ns5.test$n > /dev/null || ret=1 917 n=$((n+1)) 918 test "$ret" -eq 0 || echo_i "failed" 919 status=$((status+ret)) 920 921 echo_i "checking that insecurity proofs fail with a misconfigured trusted key ($n)" 922 ret=0 923 dig_with_opts a.insecure.example. a @10.53.0.5 > dig.out.ns5.test$n || ret=1 924 grep "SERVFAIL" dig.out.ns5.test$n > /dev/null || ret=1 925 n=$((n+1)) 926 test "$ret" -eq 0 || echo_i "failed" 927 status=$((status+ret)) 928 929 echo_i "checking that validation fails when key record is missing ($n)" 930 ret=0 931 dig_with_opts a.b.keyless.example. a @10.53.0.4 > dig.out.ns4.test$n || ret=1 932 grep "SERVFAIL" dig.out.ns4.test$n > /dev/null || ret=1 933 n=$((n+1)) 934 test "$ret" -eq 0 || echo_i "failed" 935 status=$((status+ret)) 936 937 if [ -x ${DELV} ] ; then 938 ret=0 939 echo_i "checking that validation fails when key record is missing using dns_client ($n)" 940 delv_with_opts +cd @10.53.0.4 a a.b.keyless.example > delv.out$n 2>&1 || ret=1 941 grep "resolution failed: broken trust chain" delv.out$n > /dev/null || ret=1 942 n=$((n+1)) 943 test "$ret" -eq 0 || echo_i "failed" 944 status=$((status+ret)) 945 fi 946 947 echo_i "checking that validation succeeds when a revoked key is encountered ($n)" 948 ret=0 949 dig_with_opts revkey.example soa @10.53.0.4 > dig.out.ns4.test$n || ret=1 950 grep "NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 951 grep "flags: .* ad" dig.out.ns4.test$n > /dev/null || ret=1 952 n=$((n+1)) 953 test "$ret" -eq 0 || echo_i "failed" 954 status=$((status+ret)) 955 956 if [ -x ${DELV} ] ; then 957 ret=0 958 echo_i "checking that validation succeeds when a revoked key is encountered using dns_client ($n)" 959 delv_with_opts +cd @10.53.0.4 soa revkey.example > delv.out$n 2>&1 || ret=1 960 grep "fully validated" delv.out$n > /dev/null || ret=1 961 n=$((n+1)) 962 test "$ret" -eq 0 || echo_i "failed" 963 status=$((status+ret)) 964 fi 965 966 echo_i "Checking that a bad CNAME signature is caught after a +CD query ($n)" 967 ret=0 968 #prime 969 dig_with_opts +cd bad-cname.example. @10.53.0.4 > dig.out.ns4.prime$n || ret=1 970 #check: requery with +CD. pending data should be returned even if it's bogus 971 expect="a.example. 972 10.0.0.1" 973 ans=$(dig_with_opts +cd +nodnssec +short bad-cname.example. @10.53.0.4) || ret=1 974 test "$ans" = "$expect" || ret=1 975 test "$ret" -eq 0 || echo_i "failed, got '$ans', expected '$expect'" 976 #check: requery without +CD. bogus cached data should be rejected. 977 dig_with_opts +nodnssec bad-cname.example. @10.53.0.4 > dig.out.ns4.test$n || ret=1 978 grep "SERVFAIL" dig.out.ns4.test$n > /dev/null || ret=1 979 n=$((n+1)) 980 test "$ret" -eq 0 || echo_i "failed" 981 status=$((status+ret)) 982 983 echo_i "Checking that a bad DNAME signature is caught after a +CD query ($n)" 984 ret=0 985 #prime 986 dig_with_opts +cd a.bad-dname.example. @10.53.0.4 > dig.out.ns4.prime$n || ret=1 987 #check: requery with +CD. pending data should be returned even if it's bogus 988 expect="example. 989 a.example. 990 10.0.0.1" 991 ans=$(dig_with_opts +cd +nodnssec +short a.bad-dname.example. @10.53.0.4) || ret=1 992 test "$ans" = "$expect" || ret=1 993 test "$ret" -eq 0 || echo_i "failed, got '$ans', expected '$expect'" 994 #check: requery without +CD. bogus cached data should be rejected. 995 dig_with_opts +nodnssec a.bad-dname.example. @10.53.0.4 > dig.out.ns4.test$n || ret=1 996 grep "SERVFAIL" dig.out.ns4.test$n > /dev/null || ret=1 997 n=$((n+1)) 998 test "$ret" -eq 0 || echo_i "failed" 999 status=$((status+ret)) 1000 1001 # Check the insecure.secure.example domain (insecurity proof) 1002 1003 echo_i "checking 2-server insecurity proof ($n)" 1004 ret=0 1005 dig_with_opts +noauth a.insecure.secure.example. @10.53.0.2 a \ 1006 > dig.out.ns2.test$n || ret=1 1007 dig_with_opts +noauth a.insecure.secure.example. @10.53.0.4 a \ 1008 > dig.out.ns4.test$n || ret=1 1009 digcomp dig.out.ns2.test$n dig.out.ns4.test$n || ret=1 1010 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 1011 # Note - this is looking for failure, hence the && 1012 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 1013 n=$((n+1)) 1014 test "$ret" -eq 0 || echo_i "failed" 1015 status=$((status+ret)) 1016 1017 # Check a negative response in insecure.secure.example 1018 1019 echo_i "checking 2-server insecurity proof with a negative answer ($n)" 1020 ret=0 1021 dig_with_opts q.insecure.secure.example. @10.53.0.2 a > dig.out.ns2.test$n \ 1022 || ret=1 1023 dig_with_opts q.insecure.secure.example. @10.53.0.4 a > dig.out.ns4.test$n \ 1024 || ret=1 1025 digcomp dig.out.ns2.test$n dig.out.ns4.test$n || ret=1 1026 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1 1027 # Note - this is looking for failure, hence the && 1028 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 1029 n=$((n+1)) 1030 test "$ret" -eq 0 || echo_i "failed" 1031 status=$((status+ret)) 1032 1033 echo_i "checking 2-server insecurity proof with a negative answer and SOA hack ($n)" 1034 ret=0 1035 dig_with_opts r.insecure.secure.example. @10.53.0.2 soa > dig.out.ns2.test$n \ 1036 || ret=1 1037 dig_with_opts r.insecure.secure.example. @10.53.0.4 soa > dig.out.ns4.test$n \ 1038 || ret=1 1039 digcomp dig.out.ns2.test$n dig.out.ns4.test$n || ret=1 1040 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1 1041 # Note - this is looking for failure, hence the && 1042 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 1043 n=$((n+1)) 1044 test "$ret" -eq 0 || echo_i "failed" 1045 status=$((status+ret)) 1046 1047 # Check that the query for a security root is successful and has ad set 1048 1049 echo_i "checking security root query ($n)" 1050 ret=0 1051 dig_with_opts . @10.53.0.4 key > dig.out.ns4.test$n || ret=1 1052 grep "NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 1053 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 1054 n=$((n+1)) 1055 test "$ret" -eq 0 || echo_i "failed" 1056 status=$((status+ret)) 1057 1058 # Check that the setting the cd bit works 1059 1060 echo_i "checking cd bit on a positive answer ($n)" 1061 ret=0 1062 dig_with_opts +noauth example. soa @10.53.0.4 \ 1063 > dig.out.ns4.test$n || ret=1 1064 dig_with_opts +noauth +cdflag example. soa @10.53.0.5 \ 1065 > dig.out.ns5.test$n || ret=1 1066 digcomp dig.out.ns4.test$n dig.out.ns5.test$n || ret=1 1067 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 1068 # Note - this is looking for failure, hence the && 1069 grep "flags:.*ad.*QUERY" dig.out.ns5.test$n > /dev/null && ret=1 1070 n=$((n+1)) 1071 test "$ret" -eq 0 || echo_i "failed" 1072 status=$((status+ret)) 1073 1074 echo_i "checking cd bit on a negative answer ($n)" 1075 ret=0 1076 dig_with_opts q.example. soa @10.53.0.4 > dig.out.ns4.test$n || ret=1 1077 dig_with_opts +cdflag q.example. soa @10.53.0.5 > dig.out.ns5.test$n || ret=1 1078 digcomp dig.out.ns4.test$n dig.out.ns5.test$n || ret=1 1079 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 1080 # Note - this is looking for failure, hence the && 1081 grep "flags:.*ad.*QUERY" dig.out.ns5.test$n > /dev/null && ret=1 1082 n=$((n+1)) 1083 test "$ret" -eq 0 || echo_i "failed" 1084 status=$((status+ret)) 1085 1086 echo_i "checking insecurity proof works using negative cache ($n)" 1087 ret=0 1088 rndccmd 10.53.0.4 flush 2>&1 | sed 's/^/ns4 /' | cat_i 1089 dig_with_opts +cd @10.53.0.4 insecure.example. ds > dig.out.ns4.test$n.1 || ret=1 1090 for i in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 1091 do 1092 dig_with_opts @10.53.0.4 nonexistent.insecure.example. > dig.out.ns4.test$n.2 || ret=1 1093 if grep "status: NXDOMAIN" dig.out.ns4.test$n.2 >/dev/null; then 1094 break 1095 fi 1096 sleep 1 1097 done 1098 grep "status: NXDOMAIN" dig.out.ns4.test$n.2 >/dev/null || ret=1 1099 n=$((n+1)) 1100 test "$ret" -eq 0 || echo_i "failed" 1101 status=$((status+ret)) 1102 1103 echo_i "checking positive validation RSASHA256 NSEC ($n)" 1104 ret=0 1105 dig_with_opts +noauth a.rsasha256.example. @10.53.0.3 a > dig.out.ns3.test$n || ret=1 1106 dig_with_opts +noauth a.rsasha256.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1 1107 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 1108 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 1109 n=$((n+1)) 1110 test "$ret" -eq 0 || echo_i "failed" 1111 status=$((status+ret)) 1112 1113 echo_i "checking positive validation RSASHA512 NSEC ($n)" 1114 ret=0 1115 dig_with_opts +noauth a.rsasha512.example. @10.53.0.3 a > dig.out.ns3.test$n || ret=1 1116 dig_with_opts +noauth a.rsasha512.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1 1117 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 1118 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 1119 n=$((n+1)) 1120 test "$ret" -eq 0 || echo_i "failed" 1121 status=$((status+ret)) 1122 1123 echo_i "checking positive validation with KSK-only DNSKEY signature ($n)" 1124 ret=0 1125 dig_with_opts +noauth a.kskonly.example. @10.53.0.3 a > dig.out.ns3.test$n || ret=1 1126 dig_with_opts +noauth a.kskonly.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1 1127 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 1128 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 1129 n=$((n+1)) 1130 test "$ret" -eq 0 || echo_i "failed" 1131 status=$((status+ret)) 1132 1133 echo_i "checking cd bit on a query that should fail ($n)" 1134 ret=0 1135 dig_with_opts a.bogus.example. soa @10.53.0.4 \ 1136 > dig.out.ns4.test$n || ret=1 1137 dig_with_opts +cdflag a.bogus.example. soa @10.53.0.5 \ 1138 > dig.out.ns5.test$n || ret=1 1139 digcomp dig.out.ns4.test$n dig.out.ns5.test$n || ret=1 1140 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 1141 # Note - this is looking for failure, hence the && 1142 grep "flags:.*ad.*QUERY" dig.out.ns5.test$n > /dev/null && ret=1 1143 n=$((n+1)) 1144 test "$ret" -eq 0 || echo_i "failed" 1145 status=$((status+ret)) 1146 1147 echo_i "checking cd bit on an insecurity proof ($n)" 1148 ret=0 1149 dig_with_opts +noauth a.insecure.example. soa @10.53.0.4 \ 1150 > dig.out.ns4.test$n || ret=1 1151 dig_with_opts +noauth +cdflag a.insecure.example. soa @10.53.0.5 \ 1152 > dig.out.ns5.test$n || ret=1 1153 digcomp dig.out.ns4.test$n dig.out.ns5.test$n || ret=1 1154 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 1155 # Note - these are looking for failure, hence the && 1156 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 1157 grep "flags:.*ad.*QUERY" dig.out.ns5.test$n > /dev/null && ret=1 1158 n=$((n+1)) 1159 test "$ret" -eq 0 || echo_i "failed" 1160 status=$((status+ret)) 1161 1162 echo_i "checking cd bit on a negative insecurity proof ($n)" 1163 ret=0 1164 dig_with_opts q.insecure.example. a @10.53.0.4 \ 1165 > dig.out.ns4.test$n || ret=1 1166 dig_with_opts +cdflag q.insecure.example. a @10.53.0.5 \ 1167 > dig.out.ns5.test$n || ret=1 1168 digcomp dig.out.ns4.test$n dig.out.ns5.test$n || ret=1 1169 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1 1170 # Note - these are looking for failure, hence the && 1171 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 1172 grep "flags:.*ad.*QUERY" dig.out.ns5.test$n > /dev/null && ret=1 1173 n=$((n+1)) 1174 test "$ret" -eq 0 || echo_i "failed" 1175 status=$((status+ret)) 1176 1177 echo_i "checking that validation of an ANY query works ($n)" 1178 ret=0 1179 dig_with_opts +noauth foo.example. any @10.53.0.2 > dig.out.ns2.test$n || ret=1 1180 dig_with_opts +noauth foo.example. any @10.53.0.4 > dig.out.ns4.test$n || ret=1 1181 digcomp dig.out.ns2.test$n dig.out.ns4.test$n || ret=1 1182 grep "NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 1183 # 2 records in the zone, 1 NXT, 3 SIGs 1184 grep "ANSWER: 6" dig.out.ns4.test$n > /dev/null || ret=1 1185 n=$((n+1)) 1186 test "$ret" -eq 0 || echo_i "failed" 1187 status=$((status+ret)) 1188 1189 echo_i "checking that validation of a query returning a CNAME works ($n)" 1190 ret=0 1191 dig_with_opts +noauth cname1.example. txt @10.53.0.2 \ 1192 > dig.out.ns2.test$n || ret=1 1193 dig_with_opts +noauth cname1.example. txt @10.53.0.4 \ 1194 > dig.out.ns4.test$n || ret=1 1195 digcomp dig.out.ns2.test$n dig.out.ns4.test$n || ret=1 1196 grep "NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 1197 # the CNAME & its sig, the TXT and its SIG 1198 grep "ANSWER: 4" dig.out.ns4.test$n > /dev/null || ret=1 1199 n=$((n+1)) 1200 test "$ret" -eq 0 || echo_i "failed" 1201 status=$((status+ret)) 1202 1203 echo_i "checking that validation of a query returning a DNAME works ($n)" 1204 ret=0 1205 dig_with_opts +noauth foo.dname1.example. txt @10.53.0.2 \ 1206 > dig.out.ns2.test$n || ret=1 1207 dig_with_opts +noauth foo.dname1.example. txt @10.53.0.4 \ 1208 > dig.out.ns4.test$n || ret=1 1209 digcomp dig.out.ns2.test$n dig.out.ns4.test$n || ret=1 1210 grep "NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 1211 # The DNAME & its sig, the TXT and its SIG, and the synthesized CNAME. 1212 # It would be nice to test that the CNAME is being synthesized by the 1213 # recursive server and not cached, but I don't know how. 1214 grep "ANSWER: 5" dig.out.ns4.test$n > /dev/null || ret=1 1215 n=$((n+1)) 1216 test "$ret" -eq 0 || echo_i "failed" 1217 status=$((status+ret)) 1218 1219 echo_i "checking that validation of an ANY query returning a CNAME works ($n)" 1220 ret=0 1221 dig_with_opts +noauth cname2.example. any @10.53.0.2 \ 1222 > dig.out.ns2.test$n || ret=1 1223 dig_with_opts +noauth cname2.example. any @10.53.0.4 \ 1224 > dig.out.ns4.test$n || ret=1 1225 digcomp dig.out.ns2.test$n dig.out.ns4.test$n || ret=1 1226 grep "NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 1227 # The CNAME, NXT, and their SIGs 1228 grep "ANSWER: 4" dig.out.ns4.test$n > /dev/null || ret=1 1229 n=$((n+1)) 1230 test "$ret" -eq 0 || echo_i "failed" 1231 status=$((status+ret)) 1232 1233 echo_i "checking that validation of an ANY query returning a DNAME works ($n)" 1234 ret=0 1235 dig_with_opts +noauth foo.dname2.example. any @10.53.0.2 \ 1236 > dig.out.ns2.test$n || ret=1 1237 dig_with_opts +noauth foo.dname2.example. any @10.53.0.4 \ 1238 > dig.out.ns4.test$n || ret=1 1239 digcomp dig.out.ns2.test$n dig.out.ns4.test$n || ret=1 1240 grep "NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 1241 n=$((n+1)) 1242 test "$ret" -eq 0 || echo_i "failed" 1243 status=$((status+ret)) 1244 1245 echo_i "checking that lookups succeed after disabling an algorithm ($n)" 1246 ret=0 1247 dig_with_opts +noauth example. SOA @10.53.0.2 \ 1248 > dig.out.ns2.test$n || ret=1 1249 dig_with_opts +noauth example. SOA @10.53.0.6 \ 1250 > dig.out.ns6.test$n || ret=1 1251 digcomp dig.out.ns2.test$n dig.out.ns6.test$n || ret=1 1252 # Note - this is looking for failure, hence the && 1253 grep "flags:.*ad.*QUERY" dig.out.ns6.test$n > /dev/null && ret=1 1254 n=$((n+1)) 1255 test "$ret" -eq 0 || echo_i "failed" 1256 status=$((status+ret)) 1257 1258 echo_i "checking a non-cachable NODATA works ($n)" 1259 ret=0 1260 dig_with_opts +noauth a.nosoa.secure.example. txt @10.53.0.7 \ 1261 > dig.out.ns7.test$n || ret=1 1262 grep "AUTHORITY: 0" dig.out.ns7.test$n > /dev/null || ret=1 1263 dig_with_opts +noauth a.nosoa.secure.example. txt @10.53.0.4 \ 1264 > dig.out.ns4.test$n || ret=1 1265 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 1266 n=$((n+1)) 1267 test "$ret" -eq 0 || echo_i "failed" 1268 status=$((status+ret)) 1269 1270 echo_i "checking a non-cachable NXDOMAIN works ($n)" 1271 ret=0 1272 dig_with_opts +noauth b.nosoa.secure.example. txt @10.53.0.7 \ 1273 > dig.out.ns7.test$n || ret=1 1274 grep "AUTHORITY: 0" dig.out.ns7.test$n > /dev/null || ret=1 1275 dig_with_opts +noauth b.nosoa.secure.example. txt @10.53.0.4 \ 1276 > dig.out.ns4.test$n || ret=1 1277 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1 1278 n=$((n+1)) 1279 test "$ret" -eq 0 || echo_i "failed" 1280 status=$((status+ret)) 1281 1282 echo_i "checking that we can load a rfc2535 signed zone ($n)" 1283 ret=0 1284 dig_with_opts rfc2535.example. SOA @10.53.0.2 \ 1285 > dig.out.ns2.test$n || ret=1 1286 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1 1287 n=$((n+1)) 1288 test "$ret" -eq 0 || echo_i "failed" 1289 status=$((status+ret)) 1290 1291 echo_i "checking that we can transfer a rfc2535 signed zone ($n)" 1292 ret=0 1293 dig_with_opts rfc2535.example. SOA @10.53.0.3 \ 1294 > dig.out.ns3.test$n || ret=1 1295 grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || ret=1 1296 n=$((n+1)) 1297 test "$ret" -eq 0 || echo_i "failed" 1298 status=$((status+ret)) 1299 1300 echo_i "basic dnssec-signzone checks:" 1301 echo_ic "two DNSKEYs ($n)" 1302 ret=0 1303 ( 1304 cd signer/general || exit 1 1305 rm -f signed.zone 1306 $SIGNER -f signed.zone -o example.com. test1.zone > signer.out.$n 1307 test -f signed.zone 1308 ) || ret=1 1309 n=$((n+1)) 1310 test "$ret" -eq 0 || echo_i "failed" 1311 status=$((status+ret)) 1312 1313 echo_ic "one non-KSK DNSKEY ($n)" 1314 ret=0 1315 ( 1316 cd signer/general || exit 1 1317 rm -f signed.zone 1318 $SIGNER -f signed.zone -o example.com. test2.zone > signer.out.$n 1319 test -f signed.zone 1320 ) && ret=1 1321 n=$((n+1)) 1322 test "$ret" -eq 0 || echo_i "failed" 1323 status=$((status+ret)) 1324 1325 echo_ic "one KSK DNSKEY ($n)" 1326 ret=0 1327 ( 1328 cd signer/general || exit 1 1329 rm -f signed.zone 1330 $SIGNER -f signed.zone -o example.com. test3.zone > signer.out.$n 1331 test -f signed.zone 1332 ) && ret=1 1333 n=$((n+1)) 1334 test "$ret" -eq 0 || echo_i "failed" 1335 status=$((status+ret)) 1336 1337 echo_ic "three DNSKEY ($n)" 1338 ret=0 1339 ( 1340 cd signer/general || exit 1 1341 rm -f signed.zone 1342 $SIGNER -f signed.zone -o example.com. test4.zone > signer.out.$n 1343 test -f signed.zone 1344 ) || ret=1 1345 n=$((n+1)) 1346 test "$ret" -eq 0 || echo_i "failed" 1347 status=$((status+ret)) 1348 1349 echo_ic "three DNSKEY, one private key missing ($n)" 1350 ret=0 1351 ( 1352 cd signer/general || exit 1 1353 rm -f signed.zone 1354 $SIGNER -f signed.zone -o example.com. test5.zone > signer.out.$n 1355 test -f signed.zone 1356 ) || ret=1 1357 n=$((n+1)) 1358 test "$ret" -eq 0 || echo_i "failed" 1359 status=$((status+ret)) 1360 1361 echo_ic "four DNSKEY ($n)" 1362 ret=0 1363 ( 1364 cd signer/general || exit 1 1365 rm -f signed.zone 1366 $SIGNER -f signed.zone -o example.com. test6.zone > signer.out.$n 1367 test -f signed.zone 1368 ) || ret=1 1369 n=$((n+1)) 1370 test "$ret" -eq 0 || echo_i "failed" 1371 status=$((status+ret)) 1372 1373 echo_ic "two DNSKEY, both private keys missing ($n)" 1374 ret=0 1375 ( 1376 cd signer/general || exit 1 1377 rm -f signed.zone 1378 $SIGNER -f signed.zone -o example.com. test7.zone > signer.out.$n 1379 test -f signed.zone 1380 ) && ret=1 1381 n=$((n+1)) 1382 test "$ret" -eq 0 || echo_i "failed" 1383 status=$((status+ret)) 1384 1385 echo_ic "two DNSKEY, one private key missing ($n)" 1386 ret=0 1387 ( 1388 cd signer/general || exit 1 1389 rm -f signed.zone 1390 $SIGNER -f signed.zone -o example.com. test8.zone > signer.out.$n 1391 test -f signed.zone 1392 ) && ret=1 1393 n=$((n+1)) 1394 test "$ret" -eq 0 || echo_i "failed" 1395 status=$((status+ret)) 1396 1397 echo_i "checking that a key using an unsupported algorithm cannot be generated ($n)" 1398 ret=0 1399 zone=example 1400 # If dnssec-keygen fails, the test script will exit immediately. Prevent that 1401 # from happening, and also trigger a test failure if dnssec-keygen unexpectedly 1402 # succeeds, by using "&& ret=1". 1403 $KEYGEN -a 255 $zone > dnssectools.out.test$n 2>&1 && ret=1 1404 grep -q "unsupported algorithm: 255" dnssectools.out.test$n || ret=1 1405 n=$((n+1)) 1406 test "$ret" -eq 0 || echo_i "failed" 1407 status=$((status+ret)) 1408 1409 echo_i "checking that a DS record cannot be generated for a key using an unsupported algorithm ($n)" 1410 ret=0 1411 zone=example 1412 # Fake an unsupported algorithm key 1413 unsupportedkey=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -n zone "$zone") 1414 awk '$3 == "DNSKEY" { $6 = 255 } { print }' ${unsupportedkey}.key > ${unsupportedkey}.tmp 1415 mv ${unsupportedkey}.tmp ${unsupportedkey}.key 1416 # If dnssec-dsfromkey fails, the test script will exit immediately. Prevent 1417 # that from happening, and also trigger a test failure if dnssec-dsfromkey 1418 # unexpectedly succeeds, by using "&& ret=1". 1419 $DSFROMKEY ${unsupportedkey} > dnssectools.out.test$n 2>&1 && ret=1 1420 grep -q "algorithm is unsupported" dnssectools.out.test$n || ret=1 1421 n=$((n+1)) 1422 test "$ret" -eq 0 || echo_i "failed" 1423 status=$((status+ret)) 1424 1425 echo_i "checking that a zone cannot be signed with a key using an unsupported algorithm ($n)" 1426 ret=0 1427 ret=0 1428 cat signer/example.db.in "${unsupportedkey}.key" > signer/example.db 1429 # If dnssec-signzone fails, the test script will exit immediately. Prevent that 1430 # from happening, and also trigger a test failure if dnssec-signzone 1431 # unexpectedly succeeds, by using "&& ret=1". 1432 $SIGNER -o example signer/example.db ${unsupportedkey} > dnssectools.out.test$n 2>&1 && ret=1 1433 grep -q "algorithm is unsupported" dnssectools.out.test$n || ret=1 1434 n=$((n+1)) 1435 test "$ret" -eq 0 || echo_i "failed" 1436 status=$((status+ret)) 1437 1438 get_rsasha1_key_ids_from_sigs() { 1439 tr -d '\r' < signer/example.db.signed | \ 1440 awk ' 1441 NF < 8 { next } 1442 $(NF-5) != "RRSIG" { next } 1443 $(NF-3) != "5" { next } 1444 $NF != "(" { next } 1445 { 1446 getline; 1447 print $3; 1448 } 1449 ' | \ 1450 sort -u 1451 } 1452 1453 echo_i "checking that we can sign a zone with out-of-zone records ($n)" 1454 ret=0 1455 zone=example 1456 key1=$($KEYGEN -K signer -q -a NSEC3RSASHA1 -b 1024 -n zone $zone) 1457 key2=$($KEYGEN -K signer -q -f KSK -a NSEC3RSASHA1 -b 1024 -n zone $zone) 1458 ( 1459 cd signer || exit 1 1460 cat example.db.in "$key1.key" "$key2.key" > example.db 1461 $SIGNER -o example -f example.db example.db > /dev/null 1462 ) || ret=1 1463 n=$((n+1)) 1464 test "$ret" -eq 0 || echo_i "failed" 1465 status=$((status+ret)) 1466 1467 echo_i "checking that we can sign a zone (NSEC3) with out-of-zone records ($n)" 1468 ret=0 1469 zone=example 1470 key1=$($KEYGEN -K signer -q -a NSEC3RSASHA1 -b 1024 -n zone $zone) 1471 key2=$($KEYGEN -K signer -q -f KSK -a NSEC3RSASHA1 -b 1024 -n zone $zone) 1472 ( 1473 cd signer || exit 1 1474 cat example.db.in "$key1.key" "$key2.key" > example.db 1475 $SIGNER -3 - -H 10 -o example -f example.db example.db > /dev/null 1476 awk '/^IQF9LQTLK/ { 1477 printf("%s", $0); 1478 while (!index($0, ")")) { 1479 if (getline <= 0) 1480 break; 1481 printf (" %s", $0); 1482 } 1483 printf("\n"); 1484 }' example.db | sed 's/[ ][ ]*/ /g' > nsec3param.out 1485 1486 grep "IQF9LQTLKKNFK0KVIFELRAK4IC4QLTMG.example. 0 IN NSEC3 1 0 10 - ( IQF9LQTLKKNFK0KVIFELRAK4IC4QLTMG A NS SOA RRSIG DNSKEY NSEC3PARAM )" nsec3param.out > /dev/null 1487 ) || ret=1 1488 n=$((n+1)) 1489 test "$ret" -eq 0 || echo_i "failed" 1490 status=$((status+ret)) 1491 1492 echo_i "checking NSEC3 signing with empty nonterminals above a delegation ($n)" 1493 ret=0 1494 zone=example 1495 key1=$($KEYGEN -K signer -q -a NSEC3RSASHA1 -b 1024 -n zone $zone) 1496 key2=$($KEYGEN -K signer -q -f KSK -a NSEC3RSASHA1 -b 1024 -n zone $zone) 1497 ( 1498 cd signer || exit 1 1499 cat example.db.in "$key1.key" "$key2.key" > example3.db 1500 echo "some.empty.nonterminal.nodes.example 60 IN NS ns.example.tld" >> example3.db 1501 $SIGNER -3 - -A -H 10 -o example -f example3.db example3.db > /dev/null 1502 awk '/^IQF9LQTLK/ { 1503 printf("%s", $0); 1504 while (!index($0, ")")) { 1505 if (getline <= 0) 1506 break; 1507 printf (" %s", $0); 1508 } 1509 printf("\n"); 1510 }' example.db | sed 's/[ ][ ]*/ /g' > nsec3param.out 1511 1512 grep "IQF9LQTLKKNFK0KVIFELRAK4IC4QLTMG.example. 0 IN NSEC3 1 0 10 - ( IQF9LQTLKKNFK0KVIFELRAK4IC4QLTMG A NS SOA RRSIG DNSKEY NSEC3PARAM )" nsec3param.out > /dev/null 1513 ) || ret=1 1514 n=$((n+1)) 1515 test "$ret" -eq 0 || echo_i "failed" 1516 status=$((status+ret)) 1517 1518 echo_i "checking that dnssec-signzone updates originalttl on ttl changes ($n)" 1519 ret=0 1520 zone=example 1521 key1=$($KEYGEN -K signer -q -a RSASHA1 -b 1024 -n zone $zone) 1522 key2=$($KEYGEN -K signer -q -f KSK -a RSASHA1 -b 1024 -n zone $zone) 1523 ( 1524 cd signer || exit 1 1525 cat example.db.in "$key1.key" "$key2.key" > example.db 1526 $SIGNER -o example -f example.db.before example.db > /dev/null 1527 sed 's/60.IN.SOA./50 IN SOA /' example.db.before > example.db.changed 1528 $SIGNER -o example -f example.db.after example.db.changed > /dev/null 1529 ) 1530 grep "SOA 5 1 50" signer/example.db.after > /dev/null || ret=1 1531 n=$((n+1)) 1532 test "$ret" -eq 0 || echo_i "failed" 1533 status=$((status+ret)) 1534 1535 echo_i "checking dnssec-signzone keeps valid signatures from removed keys ($n)" 1536 ret=0 1537 zone=example 1538 key1=$($KEYGEN -K signer -q -f KSK -a RSASHA1 -b 1024 -n zone $zone) 1539 key2=$($KEYGEN -K signer -q -a RSASHA1 -b 1024 -n zone $zone) 1540 keyid2=$(keyfile_to_key_id "$key2") 1541 key3=$($KEYGEN -K signer -q -a RSASHA1 -b 1024 -n zone $zone) 1542 keyid3=$(keyfile_to_key_id "$key3") 1543 ( 1544 cd signer || exit 1 1545 cat example.db.in "$key1.key" "$key2.key" > example.db 1546 $SIGNER -D -o example example.db > /dev/null 1547 1548 # now switch out key2 for key3 and resign the zone 1549 cat example.db.in "$key1.key" "$key3.key" > example.db 1550 echo "\$INCLUDE \"example.db.signed\"" >> example.db 1551 $SIGNER -D -o example example.db > /dev/null 1552 ) || ret=1 1553 get_rsasha1_key_ids_from_sigs | grep "^$keyid2$" > /dev/null || ret=1 1554 get_rsasha1_key_ids_from_sigs | grep "^$keyid3$" > /dev/null || ret=1 1555 n=$((n+1)) 1556 test "$ret" -eq 0 || echo_i "failed" 1557 status=$((status+ret)) 1558 1559 echo_i "checking dnssec-signzone -R purges signatures from removed keys ($n)" 1560 ret=0 1561 ( 1562 cd signer || exit 1 1563 $SIGNER -RD -o example example.db > /dev/null 1564 ) || ret=1 1565 get_rsasha1_key_ids_from_sigs | grep "^$keyid2$" > /dev/null && ret=1 1566 get_rsasha1_key_ids_from_sigs | grep "^$keyid3$" > /dev/null || ret=1 1567 n=$((n+1)) 1568 test "$ret" -eq 0 || echo_i "failed" 1569 status=$((status+ret)) 1570 1571 echo_i "checking dnssec-signzone keeps valid signatures from inactive keys ($n)" 1572 ret=0 1573 zone=example 1574 ( 1575 cd signer || exit 1 1576 cp -f example.db.in example.db 1577 $SIGNER -SD -o example example.db > /dev/null 1578 echo "\$INCLUDE \"example.db.signed\"" >> example.db 1579 # now retire key2 and resign the zone 1580 $SETTIME -I now "$key2" > /dev/null 2>&1 1581 $SIGNER -SD -o example example.db > /dev/null 1582 ) || ret=1 1583 get_rsasha1_key_ids_from_sigs | grep "^$keyid2$" > /dev/null || ret=1 1584 get_rsasha1_key_ids_from_sigs | grep "^$keyid3$" > /dev/null || ret=1 1585 n=$((n+1)) 1586 test "$ret" -eq 0 || echo_i "failed" 1587 status=$((status+ret)) 1588 1589 echo_i "checking dnssec-signzone -Q purges signatures from inactive keys ($n)" 1590 ret=0 1591 ( 1592 cd signer || exit 1 1593 $SIGNER -SDQ -o example example.db > /dev/null 1594 ) || ret=1 1595 get_rsasha1_key_ids_from_sigs | grep "^$keyid2$" > /dev/null && ret=1 1596 get_rsasha1_key_ids_from_sigs | grep "^$keyid3$" > /dev/null || ret=1 1597 n=$((n+1)) 1598 test "$ret" -eq 0 || echo_i "failed" 1599 status=$((status+ret)) 1600 1601 echo_i "checking dnssec-signzone retains unexpired signatures ($n)" 1602 ret=0 1603 ( 1604 cd signer || exit 1 1605 $SIGNER -Sxt -o example example.db > signer.out.1 1606 $SIGNER -Sxt -o example -f example.db.signed example.db.signed > signer.out.2 1607 ) || ret=1 1608 gen1=$(awk '/generated/ {print $3}' signer/signer.out.1) 1609 retain1=$(awk '/retained/ {print $3}' signer/signer.out.1) 1610 gen2=$(awk '/generated/ {print $3}' signer/signer.out.2) 1611 retain2=$(awk '/retained/ {print $3}' signer/signer.out.2) 1612 drop2=$(awk '/dropped/ {print $3}' signer/signer.out.2) 1613 [ "$retain2" -eq $((gen1+retain1)) ] || ret=1 1614 [ "$gen2" -eq 0 ] || ret=1 1615 [ "$drop2" -eq 0 ] || ret=1 1616 n=$((n+1)) 1617 test "$ret" -eq 0 || echo_i "failed" 1618 status=$((status+ret)) 1619 1620 echo_i "checking dnssec-signzone purges RRSIGs from formerly-owned glue (nsec) ($n)" 1621 ret=0 1622 ( 1623 cd signer || exit 1 1624 # remove NSEC-only keys 1625 rm -f Kexample.+005* 1626 cp -f example.db.in example2.db 1627 cat << EOF >> example2.db 1628 sub1.example. IN A 10.53.0.1 1629 ns.sub2.example. IN A 10.53.0.2 1630 EOF 1631 echo "\$INCLUDE \"example2.db.signed\"" >> example2.db 1632 touch example2.db.signed 1633 $SIGNER -DS -O full -f example2.db.signed -o example example2.db > /dev/null 1634 ) || ret=1 1635 grep "^sub1\\.example\\..*RRSIG[ ]A[ ]" signer/example2.db.signed > /dev/null 2>&1 || ret=1 1636 grep "^ns\\.sub2\\.example\\..*RRSIG[ ]A[ ]" signer/example2.db.signed > /dev/null 2>&1 || ret=1 1637 ( 1638 cd signer || exit 1 1639 cp -f example.db.in example2.db 1640 cat << EOF >> example2.db 1641 sub1.example. IN NS sub1.example. 1642 sub1.example. IN A 10.53.0.1 1643 sub2.example. IN NS ns.sub2.example. 1644 ns.sub2.example. IN A 10.53.0.2 1645 EOF 1646 echo "\$INCLUDE \"example2.db.signed\"" >> example2.db 1647 $SIGNER -DS -O full -f example2.db.signed -o example example2.db > /dev/null 1648 ) || ret=1 1649 grep "^sub1\\.example\\..*RRSIG[ ]A[ ]" signer/example2.db.signed > /dev/null 2>&1 && ret=1 1650 grep "^ns\\.sub2\\.example\\..*RRSIG[ ]A[ ]" signer/example2.db.signed > /dev/null 2>&1 && ret=1 1651 n=$((n+1)) 1652 test "$ret" -eq 0 || echo_i "failed" 1653 status=$((status+ret)) 1654 1655 echo_i "checking dnssec-signzone purges RRSIGs from formerly-owned glue (nsec3) ($n)" 1656 ret=0 1657 ( 1658 cd signer || exit 1 1659 rm -f example2.db.signed 1660 cp -f example.db.in example2.db 1661 cat << EOF >> example2.db 1662 sub1.example. IN A 10.53.0.1 1663 ns.sub2.example. IN A 10.53.0.2 1664 EOF 1665 echo "\$INCLUDE \"example2.db.signed\"" >> example2.db 1666 touch example2.db.signed 1667 $SIGNER -DS -3 feedabee -O full -f example2.db.signed -o example example2.db > /dev/null 1668 ) || ret=1 1669 grep "^sub1\\.example\\..*RRSIG[ ]A[ ]" signer/example2.db.signed > /dev/null 2>&1 || ret=1 1670 grep "^ns\\.sub2\\.example\\..*RRSIG[ ]A[ ]" signer/example2.db.signed > /dev/null 2>&1 || ret=1 1671 ( 1672 cd signer || exit 1 1673 cp -f example.db.in example2.db 1674 cat << EOF >> example2.db 1675 sub1.example. IN NS sub1.example. 1676 sub1.example. IN A 10.53.0.1 1677 sub2.example. IN NS ns.sub2.example. 1678 ns.sub2.example. IN A 10.53.0.2 1679 EOF 1680 echo "\$INCLUDE \"example2.db.signed\"" >> example2.db 1681 $SIGNER -DS -3 feedabee -O full -f example2.db.signed -o example example2.db > /dev/null 1682 ) || ret=1 1683 grep "^sub1\\.example\\..*RRSIG[ ]A[ ]" signer/example2.db.signed > /dev/null 2>&1 && ret=1 1684 grep "^ns\\.sub2\\.example\\..*RRSIG[ ]A[ ]" signer/example2.db.signed > /dev/null 2>&1 && ret=1 1685 n=$((n+1)) 1686 test "$ret" -eq 0 || echo_i "failed" 1687 status=$((status+ret)) 1688 1689 echo_i "checking dnssec-signzone output format ($n)" 1690 ret=0 1691 ( 1692 cd signer || exit 1 1693 $SIGNER -O full -f - -Sxt -o example example.db > signer.out.3 2> /dev/null 1694 $SIGNER -O text -f - -Sxt -o example example.db > signer.out.4 2> /dev/null 1695 $SIGNER -O raw -f signer.out.5 -Sxt -o example example.db > /dev/null 1696 $SIGNER -O raw=0 -f signer.out.6 -Sxt -o example example.db > /dev/null 1697 $SIGNER -O raw -f - -Sxt -o example example.db > signer.out.7 2> /dev/null 1698 ) || ret=1 1699 awk '/IN *SOA/ {if (NF != 11) exit(1)}' signer/signer.out.3 || ret=1 1700 awk '/IN *SOA/ {if (NF != 7) exit(1)}' signer/signer.out.4 || ret=1 1701 israw1 signer/signer.out.5 || ret=1 1702 israw0 signer/signer.out.6 || ret=1 1703 israw1 signer/signer.out.7 || ret=1 1704 n=$((n+1)) 1705 test "$ret" -eq 0 || echo_i "failed" 1706 status=$((status+ret)) 1707 1708 echo_i "checking TTLs are capped by dnssec-signzone -M ($n)" 1709 ret=0 1710 ( 1711 cd signer || exit 1 1712 $SIGNER -O full -f signer.out.8 -S -M 30 -o example example.db > /dev/null 1713 ) || ret=1 1714 awk '/^;/ { next; } $2 > 30 { exit 1; }' signer/signer.out.8 || ret=1 1715 n=$((n+1)) 1716 test "$ret" -eq 0 || echo_i "failed" 1717 status=$((status+ret)) 1718 1719 echo_i "checking dnssec-signzone -N date ($n)" 1720 ret=0 1721 ( 1722 cd signer || exit 1 1723 TZ=UTC $SIGNER -O full -f signer.out.9 -S -N date -o example example2.db > /dev/null 1724 ) || ret=1 1725 # shellcheck disable=SC2016 1726 now=$(TZ=UTC $PERL -e '@lt=localtime(); printf "%.4d%0.2d%0.2d00\n",$lt[5]+1900,$lt[4]+1,$lt[3];') 1727 serial=$(awk '/^;/ { next; } $4 == "SOA" { print $7 }' signer/signer.out.9) 1728 [ "$now" -eq "$serial" ] || ret=1 1729 n=$((n+1)) 1730 test "$ret" -eq 0 || echo_i "failed" 1731 status=$((status+ret)) 1732 1733 echo_i "checking validated data are not cached longer than originalttl ($n)" 1734 ret=0 1735 dig_with_opts +ttl +noauth a.ttlpatch.example. @10.53.0.3 a > dig.out.ns3.test$n || ret=1 1736 dig_with_opts +ttl +noauth a.ttlpatch.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1 1737 grep "3600.IN" dig.out.ns3.test$n > /dev/null || ret=1 1738 grep "300.IN" dig.out.ns3.test$n > /dev/null && ret=1 1739 grep "300.IN" dig.out.ns4.test$n > /dev/null || ret=1 1740 grep "3600.IN" dig.out.ns4.test$n > /dev/null && ret=1 1741 n=$((n+1)) 1742 test "$ret" -eq 0 || echo_i "failed" 1743 status=$((status+ret)) 1744 1745 # Test that "rndc secroots" is able to dump trusted keys 1746 echo_i "checking rndc secroots ($n)" 1747 ret=0 1748 keyid=$(cat ns1/managed.key.id) 1749 rndccmd 10.53.0.4 secroots 2>&1 | sed 's/^/ns4 /' | cat_i 1750 cp ns4/named.secroots named.secroots.test$n 1751 check_secroots_layout named.secroots.test$n || ret=1 1752 linecount=$(grep -c "./${DEFAULT_ALGORITHM}/$keyid ; static" named.secroots.test$n || true) 1753 [ "$linecount" -eq 1 ] || ret=1 1754 linecount=$(< named.secroots.test$n wc -l) 1755 [ "$linecount" -eq 9 ] || ret=1 1756 n=$((n+1)) 1757 test "$ret" -eq 0 || echo_i "failed" 1758 status=$((status+ret)) 1759 1760 # Check direct query for RRSIG. If we first ask for normal (non RRSIG) 1761 # record, the corresponding RRSIG should be cached and subsequent query 1762 # for RRSIG will be returned with the cached record. 1763 echo_i "checking RRSIG query from cache ($n)" 1764 ret=0 1765 dig_with_opts normalthenrrsig.secure.example. @10.53.0.4 a > /dev/null || ret=1 1766 ans=$(dig_with_opts +short normalthenrrsig.secure.example. @10.53.0.4 rrsig) || ret=1 1767 expect=$(dig_with_opts +short normalthenrrsig.secure.example. @10.53.0.3 rrsig | grep '^A' ) || ret=1 1768 test "$ans" = "$expect" || ret=1 1769 # also check that RA is set 1770 dig_with_opts normalthenrrsig.secure.example. @10.53.0.4 rrsig > dig.out.ns4.test$n || ret=1 1771 grep "flags:.*ra.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 1772 n=$((n+1)) 1773 test "$ret" -eq 0 || echo_i "failed" 1774 status=$((status+ret)) 1775 1776 # Check direct query for RRSIG: If it's not cached with other records, 1777 # it should result in an empty response. 1778 echo_i "checking RRSIG query not in cache ($n)" 1779 ret=0 1780 ans=$(dig_with_opts +short rrsigonly.secure.example. @10.53.0.4 rrsig) || ret=1 1781 test -z "$ans" || ret=1 1782 # also check that RA is cleared 1783 dig_with_opts rrsigonly.secure.example. @10.53.0.4 rrsig > dig.out.ns4.test$n || ret=1 1784 grep "flags:.*ra.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 1785 n=$((n+1)) 1786 test "$ret" -eq 0 || echo_i "failed" 1787 status=$((status+ret)) 1788 1789 # 1790 # RT21868 regression test. 1791 # 1792 echo_i "checking NSEC3 zone with mismatched NSEC3PARAM / NSEC parameters ($n)" 1793 ret=0 1794 dig_with_opts non-exist.badparam. @10.53.0.2 a > dig.out.ns2.test$n || ret=1 1795 grep "status: NXDOMAIN" dig.out.ns2.test$n > /dev/null || ret=1 1796 n=$((n+1)) 1797 test "$ret" -eq 0 || echo_i "failed" 1798 status=$((status+ret)) 1799 1800 # 1801 # RT22007 regression test. 1802 # 1803 echo_i "checking optout NSEC3 referral with only insecure delegations ($n)" 1804 ret=0 1805 dig_with_opts +norec delegation.single-nsec3. @10.53.0.2 a > dig.out.ns2.test$n || ret=1 1806 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1 1807 grep "3KL3NK1HKQ4IUEEHBEF12VGFKUETNBAN.*NSEC3 1 1 1 - 3KL3NK1HKQ4IUEEHBEF12VGFKUETNBAN" dig.out.ns2.test$n > /dev/null || ret=1 1808 n=$((n+1)) 1809 test "$ret" -eq 0 || echo_i "failed" 1810 status=$((status+ret)) 1811 1812 echo_i "checking optout NSEC3 NXDOMAIN with only insecure delegations ($n)" 1813 ret=0 1814 dig_with_opts +norec nonexist.single-nsec3. @10.53.0.2 a > dig.out.ns2.test$n || ret=1 1815 grep "status: NXDOMAIN" dig.out.ns2.test$n > /dev/null || ret=1 1816 grep "3KL3NK1HKQ4IUEEHBEF12VGFKUETNBAN.*NSEC3 1 1 1 - 3KL3NK1HKQ4IUEEHBEF12VGFKUETNBAN" dig.out.ns2.test$n > /dev/null || ret=1 1817 n=$((n+1)) 1818 test "$ret" -eq 0 || echo_i "failed" 1819 1820 status=$((status+ret)) 1821 echo_i "checking optout NSEC3 nodata with only insecure delegations ($n)" 1822 ret=0 1823 dig_with_opts +norec single-nsec3. @10.53.0.2 a > dig.out.ns2.test$n || ret=1 1824 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1 1825 grep "3KL3NK1HKQ4IUEEHBEF12VGFKUETNBAN.*NSEC3 1 1 1 - 3KL3NK1HKQ4IUEEHBEF12VGFKUETNBAN" dig.out.ns2.test$n > /dev/null || ret=1 1826 n=$((n+1)) 1827 test "$ret" -eq 0 || echo_i "failed" 1828 status=$((status+ret)) 1829 1830 echo_i "checking that a zone finishing the transition from $ALTERNATIVE_ALGORITHM to $DEFAULT_ALGORITHM validates secure ($n)" 1831 ret=0 1832 dig_with_opts ns algroll. @10.53.0.4 > dig.out.ns4.test$n || ret=1 1833 grep "NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 1834 grep "flags:[^;]* ad[^;]*;" dig.out.ns4.test$n > /dev/null || ret=1 1835 n=$((n+1)) 1836 test "$ret" -eq 0 || echo_i "failed" 1837 status=$((status+ret)) 1838 1839 echo_i "checking validate-except in an insecure local domain ($n)" 1840 ret=0 1841 dig_with_opts ns www.corp @10.53.0.4 > dig.out.ns4.test$n || ret=1 1842 grep "NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 1843 grep "flags:[^;]* ad[^;]*;" dig.out.ns4.test$n > /dev/null && ret=1 1844 n=$((n+1)) 1845 test "$ret" -eq 0 || echo_i "failed" 1846 status=$((status+ret)) 1847 1848 echo_i "checking positive and negative validation with negative trust anchors ($n)" 1849 ret=0 1850 1851 # 1852 # check correct initial behavior 1853 # 1854 dig_with_opts a.bogus.example. a @10.53.0.4 > dig.out.ns4.test$n.1 || ret=1 1855 grep "status: SERVFAIL" dig.out.ns4.test$n.1 > /dev/null || ret=1 1856 dig_with_opts badds.example. soa @10.53.0.4 > dig.out.ns4.test$n.2 || ret=1 1857 grep "status: SERVFAIL" dig.out.ns4.test$n.2 > /dev/null || ret=1 1858 dig_with_opts a.secure.example. a @10.53.0.4 > dig.out.ns4.test$n.3 || ret=1 1859 grep "status: SERVFAIL" dig.out.ns4.test$n.3 > /dev/null && ret=1 1860 grep "flags:[^;]* ad[^;]*;" dig.out.ns4.test$n.3 > /dev/null || ret=1 1861 1862 if [ "$ret" -ne 0 ]; then echo_i "failed - checking initial state"; fi 1863 status=$((status+ret)) 1864 ret=0 1865 1866 # 1867 # add negative trust anchors 1868 # 1869 rndccmd 10.53.0.4 nta -f -l 20s bogus.example 2>&1 | sed 's/^/ns4 /' | cat_i 1870 rndccmd 10.53.0.4 nta badds.example 2>&1 | sed 's/^/ns4 /' | cat_i 1871 # reconfig should maintain NTAs 1872 rndccmd 10.53.0.4 reconfig 2>&1 | sed 's/^/ns4 /' | cat_i 1873 rndccmd 10.53.0.4 nta -d > rndc.out.ns4.test$n.1 1874 lines=$(wc -l < rndc.out.ns4.test$n.1) 1875 [ "$lines" -eq 2 ] || ret=1 1876 rndccmd 10.53.0.4 nta secure.example 2>&1 | sed 's/^/ns4 /' | cat_i 1877 rndccmd 10.53.0.4 nta fakenode.secure.example 2>&1 | sed 's/^/ns4 /' | cat_i 1878 # reload should maintain NTAs 1879 rndc_reload ns4 10.53.0.4 1880 rndccmd 10.53.0.4 nta -d > rndc.out.ns4.test$n.2 1881 lines=$(wc -l < rndc.out.ns4.test$n.2) 1882 [ "$lines" -eq 4 ] || ret=1 1883 # shellcheck disable=SC2016 1884 start=$($PERL -e 'print time()."\n";') 1885 1886 if [ "$ret" -ne 0 ]; then echo_i "failed - adding NTA's failed"; fi 1887 status=$((status+ret)) 1888 ret=0 1889 1890 # 1891 # check behavior with NTA's in place 1892 # 1893 dig_with_opts a.bogus.example. a @10.53.0.4 > dig.out.ns4.test$n.4 || ret=1 1894 grep "status: SERVFAIL" dig.out.ns4.test$n.4 > /dev/null && ret=1 1895 grep "flags:[^;]* ad[^;]*;" dig.out.ns4.test$n.4 > /dev/null && ret=1 1896 dig_with_opts badds.example. soa @10.53.0.4 > dig.out.ns4.test$n.5 || ret=1 1897 grep "status: SERVFAIL" dig.out.ns4.test$n.5 > /dev/null && ret=1 1898 grep "flags:[^;]* ad[^;]*;" dig.out.ns4.test$n.5 > /dev/null && ret=1 1899 dig_with_opts a.secure.example. a @10.53.0.4 > dig.out.ns4.test$n.6 || ret=1 1900 grep "status: SERVFAIL" dig.out.ns4.test$n.6 > /dev/null && ret=1 1901 grep "flags:[^;]* ad[^;]*;" dig.out.ns4.test$n.6 > /dev/null && ret=1 1902 dig_with_opts a.fakenode.secure.example. a @10.53.0.4 > dig.out.ns4.test$n.7 || ret=1 1903 grep "flags:[^;]* ad[^;]*;" dig.out.ns4.test$n.7 > /dev/null && ret=1 1904 echo_i "dumping secroots" 1905 rndccmd 10.53.0.4 secroots | sed 's/^/ns4 /' | cat_i 1906 cp ns4/named.secroots named.secroots.test$n 1907 check_secroots_layout named.secroots.test$n || ret=1 1908 grep "bogus.example: expiry" named.secroots.test$n > /dev/null || ret=1 1909 grep "badds.example: expiry" named.secroots.test$n > /dev/null || ret=1 1910 grep "secure.example: expiry" named.secroots.test$n > /dev/null || ret=1 1911 grep "fakenode.secure.example: expiry" named.secroots.test$n > /dev/null || ret=1 1912 1913 if [ "$ret" -ne 0 ]; then echo_i "failed - with NTA's in place failed"; fi 1914 status=$((status+ret)) 1915 ret=0 1916 1917 echo_i "waiting for NTA rechecks/expirations" 1918 1919 # 1920 # secure.example and badds.example used default nta-duration 1921 # (configured as 12s in ns4/named1.conf), but nta recheck interval 1922 # is configured to 9s, so at t=10 the NTAs for secure.example and 1923 # fakenode.secure.example should both be lifted, but badds.example 1924 # should still be going. 1925 # 1926 # shellcheck disable=SC2016 1927 $PERL -e 'my $delay = '"$start"' + 10 - time(); select(undef, undef, undef, $delay) if ($delay > 0);' 1928 dig_with_opts b.secure.example. a @10.53.0.4 > dig.out.ns4.test$n.8 || ret=1 1929 grep "status: SERVFAIL" dig.out.ns4.test$n.8 > /dev/null && ret=1 1930 grep "flags:[^;]* ad[^;]*;" dig.out.ns4.test$n.8 > /dev/null || ret=1 1931 dig_with_opts b.fakenode.secure.example. a @10.53.0.4 > dig.out.ns4.test$n.9 || ret=1 1932 grep "flags:[^;]* ad[^;]*;" dig.out.ns4.test$n.9 > /dev/null || ret=1 1933 grep "status: NXDOMAIN" dig.out.ns4.test$n.9 > /dev/null || ret=1 1934 dig_with_opts badds.example. soa @10.53.0.4 > dig.out.ns4.test$n.10 || ret=1 1935 grep "status: SERVFAIL" dig.out.ns4.test$n.10 > /dev/null && ret=1 1936 grep "flags:[^;]* ad[^;]*;" dig.out.ns4.test$n.10 > /dev/null && ret=1 1937 1938 if [ "$ret" -ne 0 ]; then echo_i "failed - checking that default nta's were lifted due to recheck"; fi 1939 status=$((status+ret)) 1940 ret=0 1941 1942 # 1943 # bogus.example was set to expire in 20s, so at t=13 1944 # it should still be NTA'd, but badds.example used the default 1945 # lifetime of 12s, so it should revert to SERVFAIL now. 1946 # 1947 # shellcheck disable=SC2016 1948 $PERL -e 'my $delay = '"$start"' + 13 - time(); select(undef, undef, undef, $delay) if ($delay > 0);' 1949 # check nta table 1950 rndccmd 10.53.0.4 nta -d > rndc.out.ns4.test$n._11 1951 lines=$(grep -c " expiry " rndc.out.ns4.test$n._11 || true) 1952 [ "$lines" -le 2 ] || ret=1 1953 grep "bogus.example/_default: expiry" rndc.out.ns4.test$n._11 > /dev/null || ret=1 1954 grep "badds.example/_default: expiry" rndc.out.ns4.test$n._11 > /dev/null && ret=1 1955 dig_with_opts b.bogus.example. a @10.53.0.4 > dig.out.ns4.test$n.11 || ret=1 1956 grep "status: SERVFAIL" dig.out.ns4.test$n.11 > /dev/null && ret=1 1957 dig_with_opts a.badds.example. a @10.53.0.4 > dig.out.ns4.test$n.12 || ret=1 1958 grep "status: SERVFAIL" dig.out.ns4.test$n.12 > /dev/null || ret=1 1959 grep "flags:[^;]* ad[^;]*;" dig.out.ns4.test$n.12 > /dev/null && ret=1 1960 dig_with_opts c.secure.example. a @10.53.0.4 > dig.out.ns4.test$n.13 || ret=1 1961 grep "status: SERVFAIL" dig.out.ns4.test$n.13 > /dev/null && ret=1 1962 grep "flags:[^;]* ad[^;]*;" dig.out.ns4.test$n.13 > /dev/null || ret=1 1963 1964 if [ "$ret" -ne 0 ]; then echo_i "failed - checking that default nta's were lifted due to lifetime"; fi 1965 status=$((status+ret)) 1966 ret=0 1967 1968 # 1969 # at t=21, all the NTAs should have expired. 1970 # 1971 # shellcheck disable=SC2016 1972 $PERL -e 'my $delay = '"$start"' + 21 - time(); select(undef, undef, undef, $delay) if ($delay > 0);' 1973 # check correct behavior after bogus.example expiry 1974 dig_with_opts d.secure.example. a @10.53.0.4 > dig.out.ns4.test$n.14 || ret=1 1975 grep "status: SERVFAIL" dig.out.ns4.test$n.14 > /dev/null && ret=1 1976 grep "flags:[^;]* ad[^;]*;" dig.out.ns4.test$n.14 > /dev/null || ret=1 1977 dig_with_opts c.bogus.example. a @10.53.0.4 > dig.out.ns4.test$n.15 || ret=1 1978 grep "status: SERVFAIL" dig.out.ns4.test$n.15 > /dev/null || ret=1 1979 # check nta table has been cleaned up now 1980 rndccmd 10.53.0.4 nta -d > rndc.out.ns4.test$n.3 1981 lines=$(grep -c " expiry " rndc.out.ns4.test$n.3 || true) 1982 [ "$lines" -eq 0 ] || ret=1 1983 n=$((n+1)) 1984 if [ "$ret" -ne 0 ]; then echo_i "failed - checking that all nta's have been lifted"; fi 1985 status=$((status+ret)) 1986 ret=0 1987 1988 echo_i "testing NTA removals ($n)" 1989 rndccmd 10.53.0.4 nta badds.example 2>&1 | sed 's/^/ns4 /' | cat_i 1990 rndccmd 10.53.0.4 nta -d > rndc.out.ns4.test$n.1 1991 grep "badds.example/_default: expiry" rndc.out.ns4.test$n.1 > /dev/null || ret=1 1992 dig_with_opts a.badds.example. a @10.53.0.4 > dig.out.ns4.test$n.1 || ret=1 1993 grep "status: SERVFAIL" dig.out.ns4.test$n.1 > /dev/null && ret=1 1994 grep "^a.badds.example." dig.out.ns4.test$n.1 > /dev/null || ret=1 1995 rndccmd 10.53.0.4 nta -remove badds.example > rndc.out.ns4.test$n.2 1996 grep "Negative trust anchor removed: badds.example/_default" rndc.out.ns4.test$n.2 > /dev/null || ret=1 1997 rndccmd 10.53.0.4 nta -d > rndc.out.ns4.test$n.3 1998 grep "badds.example/_default: expiry" rndc.out.ns4.test$n.3 > /dev/null && ret=1 1999 dig_with_opts a.badds.example. a @10.53.0.4 > dig.out.ns4.test$n.2 || ret=1 2000 grep "status: SERVFAIL" dig.out.ns4.test$n.2 > /dev/null || ret=1 2001 test "$ret" -eq 0 || echo_i "failed" 2002 status=$((status+ret)) 2003 ret=0 2004 2005 echo_i "remove non-existent NTA three times" 2006 rndccmd 10.53.0.4 nta -r foo > rndc.out.ns4.test$n.4 2>&1 2007 rndccmd 10.53.0.4 nta -remove foo > rndc.out.ns4.test$n.5 2>&1 2008 rndccmd 10.53.0.4 nta -r foo > rndc.out.ns4.test$n.6 2>&1 2009 grep "not found" rndc.out.ns4.test$n.6 > /dev/null || ret=1 2010 test "$ret" -eq 0 || echo_i "failed" 2011 status=$((status+ret)) 2012 ret=0 2013 2014 n=$((n+1)) 2015 echo_i "testing NTA with bogus lifetimes ($n)" 2016 echo_i "check with no nta lifetime specified" 2017 rndccmd 10.53.0.4 nta -l "" foo > rndc.out.ns4.test$n.1 2>&1 || true 2018 grep "'nta' failed: bad ttl" rndc.out.ns4.test$n.1 > /dev/null || ret=1 2019 test "$ret" -eq 0 || echo_i "failed" 2020 status=$((status+ret)) 2021 ret=0 2022 2023 echo_i "check with bad nta lifetime" 2024 rndccmd 10.53.0.4 nta -l garbage foo > rndc.out.ns4.test$n.2 2>&1 || true 2025 grep "'nta' failed: bad ttl" rndc.out.ns4.test$n.2 > /dev/null || ret=1 2026 test "$ret" -eq 0 || echo_i "failed" 2027 status=$((status+ret)) 2028 ret=0 2029 2030 echo_i "check with too long nta lifetime" 2031 rndccmd 10.53.0.4 nta -l 7d1h foo > rndc.out.ns4.test$n.3 2>&1 || true 2032 grep "'nta' failed: out of range" rndc.out.ns4.test$n.3 > /dev/null || ret=1 2033 test "$ret" -eq 0 || echo_i "failed" 2034 status=$((status+ret)) 2035 ret=0 2036 2037 # 2038 # check NTA persistence across restarts 2039 # 2040 n=$((n+1)) 2041 echo_i "testing NTA persistence across restarts ($n)" 2042 rndccmd 10.53.0.4 nta -d > rndc.out.ns4.test$n.1 2043 lines=$(grep -c " expiry " rndc.out.ns4.test$n.1 || true) 2044 [ "$lines" -eq 0 ] || ret=1 2045 rndccmd 10.53.0.4 nta -f -l 30s bogus.example 2>&1 | sed 's/^/ns4 /' | cat_i 2046 rndccmd 10.53.0.4 nta -f -l 10s badds.example 2>&1 | sed 's/^/ns4 /' | cat_i 2047 rndccmd 10.53.0.4 nta -d > rndc.out.ns4.test$n.2 2048 lines=$(grep -c " expiry " rndc.out.ns4.test$n.2 || true) 2049 [ "$lines" -eq 2 ] || ret=1 2050 # shellcheck disable=SC2016 2051 start=$($PERL -e 'print time()."\n";') 2052 2053 if [ "$ret" -ne 0 ]; then echo_i "failed - NTA persistence: adding NTA's failed"; fi 2054 status=$((status+ret)) 2055 ret=0 2056 2057 echo_i "killing ns4 with SIGTERM" 2058 $KILL -TERM "$(cat ns4/named.pid)" 2059 rm -f ns4/named.pid 2060 2061 # 2062 # ns4 has now shutdown. wait until t=14 when badds.example's NTA 2063 # (lifetime=10s) would have expired, and then restart ns4. 2064 # 2065 echo_i "waiting till 14s have passed since NTAs were added before restarting ns4" 2066 # shellcheck disable=SC2016 2067 $PERL -e 'my $delay = '"$start"' + 14 - time(); select(undef, undef, undef, $delay) if ($delay > 0);' 2068 2069 if 2070 $PERL "$SYSTEMTESTTOP/start.pl" --noclean --restart --port "$PORT" dnssec ns4 2071 then 2072 echo_i "restarted server ns4" 2073 else 2074 echo_i "could not restart server ns4" 2075 exit 1 2076 fi 2077 2078 echo_i "sleeping for an additional 4 seconds for ns4 to fully startup" 2079 sleep 4 2080 2081 # 2082 # ns4 should be back up now. The NTA for bogus.example should still be 2083 # valid, whereas badds.example should not have been added during named 2084 # startup (as it had already expired), the fact that it's ignored should 2085 # be logged. 2086 # 2087 rndccmd 10.53.0.4 nta -d > rndc.out.ns4.test$n.3 2088 lines=$(wc -l < rndc.out.ns4.test$n.3) 2089 [ "$lines" -eq 1 ] || ret=1 2090 grep "bogus.example/_default: expiry" rndc.out.ns4.test$n.3 > /dev/null || ret=1 2091 dig_with_opts b.bogus.example. a @10.53.0.4 > dig.out.ns4.test$n.4 || ret=1 2092 grep "status: SERVFAIL" dig.out.ns4.test$n.4 > /dev/null && ret=1 2093 grep "flags:[^;]* ad[^;]*;" dig.out.ns4.test$n.4 > /dev/null && ret=1 2094 dig_with_opts a.badds.example. a @10.53.0.4 > dig.out.ns4.test$n.5 || ret=1 2095 grep "status: SERVFAIL" dig.out.ns4.test$n.5 > /dev/null || ret=1 2096 grep "ignoring expired NTA at badds.example" ns4/named.run > /dev/null || ret=1 2097 2098 # cleanup 2099 rndccmd 10.53.0.4 nta -remove bogus.example > rndc.out.ns4.test$n.6 2100 2101 if [ "$ret" -ne 0 ]; then echo_i "failed - NTA persistence: restoring NTA failed"; fi 2102 status=$((status+ret)) 2103 ret=0 2104 2105 # 2106 # check "regular" attribute in NTA file works as expected at named 2107 # startup. 2108 # 2109 n=$((n+1)) 2110 echo_i "testing loading regular attribute from NTA file ($n)" 2111 rndccmd 10.53.0.4 nta -d > rndc.out.ns4.test$n.1 2>/dev/null 2112 lines=$(wc -l < rndc.out.ns4.test$n.1) 2113 [ "$lines" -eq 0 ] || ret=1 2114 # initially, secure.example. validates with AD=1 2115 dig_with_opts a.secure.example. a @10.53.0.4 > dig.out.ns4.test$n.2 || ret=1 2116 grep "status: SERVFAIL" dig.out.ns4.test$n.2 > /dev/null && ret=1 2117 grep "flags:[^;]* ad[^;]*;" dig.out.ns4.test$n.2 > /dev/null || ret=1 2118 2119 echo_i "killing ns4 with SIGTERM" 2120 $KILL -TERM "$(cat ns4/named.pid)" 2121 rm -f ns4/named.pid 2122 2123 echo_i "sleeping for an additional 4 seconds for ns4 to fully shutdown" 2124 sleep 4 2125 2126 # 2127 # ns4 has now shutdown. add NTA for secure.example. directly into the 2128 # _default.nta file with the regular attribute and some future timestamp. 2129 # 2130 future="$(($(date +%Y)+20))0101010000" 2131 echo "secure.example. regular $future" > ns4/_default.nta 2132 # shellcheck disable=SC2016 2133 start=$($PERL -e 'print time()."\n";') 2134 2135 if 2136 $PERL "$SYSTEMTESTTOP/start.pl" --noclean --restart --port "$PORT" dnssec ns4 2137 then 2138 echo_i "restarted server ns4" 2139 else 2140 echo_i "could not restart server ns4" 2141 exit 1 2142 fi 2143 2144 # nta-recheck is configured as 9s, so at t=12 the NTAs for 2145 # secure.example. should be lifted as it is not a forced NTA. 2146 echo_i "waiting till 12s have passed after ns4 was restarted" 2147 # shellcheck disable=SC2016 2148 $PERL -e 'my $delay = '"$start"' + 12 - time(); select(undef, undef, undef, $delay) if ($delay > 0);' 2149 2150 # secure.example. should now return an AD=1 answer (still validates) as 2151 # the NTA has been lifted. 2152 dig_with_opts a.secure.example. a @10.53.0.4 > dig.out.ns4.test$n.3 || ret=1 2153 grep "status: SERVFAIL" dig.out.ns4.test$n.3 > /dev/null && ret=1 2154 grep "flags:[^;]* ad[^;]*;" dig.out.ns4.test$n.3 > /dev/null || ret=1 2155 2156 # cleanup 2157 rndccmd 10.53.0.4 nta -remove secure.example > rndc.out.ns4.test$n.4 2>/dev/null 2158 2159 if [ "$ret" -ne 0 ]; then echo_i "failed - NTA persistence: loading regular NTAs failed"; fi 2160 status=$((status+ret)) 2161 ret=0 2162 2163 # 2164 # check "forced" attribute in NTA file works as expected at named 2165 # startup. 2166 # 2167 n=$((n+1)) 2168 echo_i "testing loading forced attribute from NTA file ($n)" 2169 rndccmd 10.53.0.4 nta -d > rndc.out.ns4.test$n.1 2>/dev/null 2170 lines=$(wc -l < rndc.out.ns4.test$n.1) 2171 [ "$lines" -eq 0 ] || ret=1 2172 # initially, secure.example. validates with AD=1 2173 dig_with_opts a.secure.example. a @10.53.0.4 > dig.out.ns4.test$n.2 || ret=1 2174 grep "status: SERVFAIL" dig.out.ns4.test$n.2 > /dev/null && ret=1 2175 grep "flags:[^;]* ad[^;]*;" dig.out.ns4.test$n.2 > /dev/null || ret=1 2176 2177 echo_i "killing ns4 with SIGTERM" 2178 $KILL -TERM "$(cat ns4/named.pid)" 2179 rm -f named.pid 2180 2181 echo_i "sleeping for an additional 4 seconds for ns4 to fully shutdown" 2182 sleep 4 2183 2184 # 2185 # ns4 has now shutdown. add NTA for secure.example. directly into the 2186 # _default.nta file with the forced attribute and some future timestamp. 2187 # 2188 echo "secure.example. forced $future" > ns4/_default.nta 2189 start=$($PERL -e 'print time()."\n";') 2190 2191 if 2192 $PERL "$SYSTEMTESTTOP/start.pl" --noclean --restart --port "$PORT" dnssec ns4 2193 then 2194 echo_i "restarted server ns4" 2195 else 2196 echo_i "could not restart server ns4" 2197 exit 1 2198 fi 2199 2200 # nta-recheck is configured as 9s, but even at t=12 the NTAs for 2201 # secure.example. should not be lifted as it is a forced NTA. 2202 echo_i "waiting till 12s have passed after ns4 was restarted" 2203 # shellcheck disable=SC2016 2204 $PERL -e 'my $delay = '"$start"' + 12 - time(); select(undef, undef, undef, $delay) if ($delay > 0);' 2205 2206 # secure.example. should now return an AD=0 answer (non-authenticated) 2207 # as the NTA is still there. 2208 dig_with_opts a.secure.example. a @10.53.0.4 > dig.out.ns4.test$n.3 || ret=1 2209 grep "status: SERVFAIL" dig.out.ns4.test$n.3 > /dev/null && ret=1 2210 grep "flags:[^;]* ad[^;]*;" dig.out.ns4.test$n.3 > /dev/null && ret=1 2211 2212 # cleanup 2213 rndccmd 10.53.0.4 nta -remove secure.example > rndc.out.ns4.test$n.4 2>/dev/null 2214 2215 if [ "$ret" -ne 0 ]; then echo_i "failed - NTA persistence: loading forced NTAs failed"; fi 2216 status=$((status+ret)) 2217 ret=0 2218 2219 # 2220 # check that NTA lifetime read from file is clamped to 1 week. 2221 # 2222 n=$((n+1)) 2223 echo_i "testing loading out of bounds lifetime from NTA file ($n)" 2224 2225 echo_i "killing ns4 with SIGTERM" 2226 $KILL -TERM "$(cat ns4/named.pid)" 2227 rm -f ns4/named.pid 2228 2229 echo_i "sleeping for an additional 4 seconds for ns4 to fully shutdown" 2230 sleep 4 2231 2232 # 2233 # ns4 has now shutdown. add NTA for secure.example. directly into the 2234 # _default.nta file with a lifetime well into the future. 2235 # 2236 echo "secure.example. forced $future" > ns4/_default.nta 2237 added=$($PERL -e 'print time()."\n";') 2238 2239 if 2240 $PERL "$SYSTEMTESTTOP/start.pl" --noclean --restart --port "$PORT" dnssec ns4 2241 then 2242 echo_i "restarted server ns4" 2243 else 2244 echo_i "could not restart server ns4" 2245 exit 1 2246 fi 2247 2248 echo_i "sleeping for an additional 4 seconds for ns4 to fully startup" 2249 sleep 4 2250 2251 # dump the NTA to a file (omit validate-except entries) 2252 echo_i "testing 'rndc nta'" 2253 rndccmd 10.53.0.4 nta -d > rndc.out.ns4.test$n.1 2>/dev/null 2254 # "corp" is configured as a validate-except domain and thus should be 2255 # omitted. only "secure.example" should be in the dump at this point. 2256 lines=$(wc -l < rndc.out.ns4.test$n.1) 2257 [ "$lines" -eq 1 ] || ret=1 2258 grep 'secure.example' rndc.out.ns4.test$n.1 > /dev/null || ret=1 2259 ts=$(awk '{print $3" "$4}' < rndc.out.ns4.test$n.1) 2260 # rndc nta outputs localtime, so append the timezone 2261 ts_with_zone="$ts $(date +%z)" 2262 echo "ts=$ts" > rndc.out.ns4.test$n.2 2263 echo "ts_with_zone=$ts_with_zone" >> rndc.out.ns4.test$n.2 2264 echo "added=$added" >> rndc.out.ns4.test$n.2 2265 if $PERL -e 'use Time::Piece; use Time::Seconds;' 2>/dev/null 2266 then 2267 # ntadiff.pl computes $ts_with_zone - ($added + 1week) 2268 d=$($PERL ./ntadiff.pl "$ts_with_zone" "$added") 2269 echo "d=$d" >> rndc.out.ns4.test$n.2 2270 # diff from $added(now) + 1week to the clamped NTA lifetime should be 2271 # less than a few seconds (handle daylight saving changes by adding 3600). 2272 [ "$d" -lt 3610 ] || ret=1 2273 else 2274 echo_i "skipped ntadiff test; install PERL module Time::Piece" 2275 fi 2276 2277 # cleanup 2278 rndccmd 10.53.0.4 nta -remove secure.example > rndc.out.ns4.test$n.3 2>/dev/null 2279 2280 n=$((n+1)) 2281 if [ "$ret" -ne 0 ]; then echo_i "failed - NTA lifetime clamping failed"; fi 2282 status=$((status+ret)) 2283 2284 echo_i "checking that NTAs work with 'forward only;' to a validating resolver ($n)" 2285 ret=0 2286 # Sanity check behavior without an NTA in place. 2287 dig_with_opts @10.53.0.9 badds.example. SOA > dig.out.ns9.test$n.1 || ret=1 2288 grep "SERVFAIL" dig.out.ns9.test$n.1 > /dev/null || ret=1 2289 grep "ANSWER: 0" dig.out.ns9.test$n.1 > /dev/null || ret=1 2290 grep "flags:[^;]* ad[ ;].*QUERY" dig.out.ns9.test$n.1 > /dev/null && ret=1 2291 # Add an NTA, expecting that to cause resolution to succeed. 2292 rndccmd 10.53.0.9 nta badds.example > rndc.out.ns9.test$n.1 2>&1 || ret=1 2293 dig_with_opts @10.53.0.9 badds.example. SOA > dig.out.ns9.test$n.2 || ret=1 2294 grep "NOERROR" dig.out.ns9.test$n.2 > /dev/null || ret=1 2295 grep "ANSWER: 2" dig.out.ns9.test$n.2 > /dev/null || ret=1 2296 grep "flags:[^;]* ad[ ;].*QUERY" dig.out.ns9.test$n.2 > /dev/null && ret=1 2297 # Remove the NTA, expecting that to cause resolution to fail again. 2298 rndccmd 10.53.0.9 nta -remove badds.example > rndc.out.ns9.test$n.2 2>&1 || ret=1 2299 dig_with_opts @10.53.0.9 badds.example. SOA > dig.out.ns9.test$n.3 || ret=1 2300 grep "SERVFAIL" dig.out.ns9.test$n.3 > /dev/null || ret=1 2301 grep "ANSWER: 0" dig.out.ns9.test$n.3 > /dev/null || ret=1 2302 grep "flags:[^;]* ad[ ;].*QUERY" dig.out.ns9.test$n.3 > /dev/null && ret=1 2303 if [ "$ret" -ne 0 ]; then echo_i "failed"; fi 2304 status=$((status+ret)) 2305 2306 echo_i "completed NTA tests" 2307 2308 # Run a minimal update test if possible. This is really just 2309 # a regression test for RT #2399; more tests should be added. 2310 2311 if $PERL -e 'use Net::DNS;' 2>/dev/null 2312 then 2313 echo_i "running DNSSEC update test" 2314 ret=0 2315 output=$($PERL dnssec_update_test.pl -s 10.53.0.3 -p "$PORT" dynamic.example.) 2316 test "$?" -eq 0 || ret=1 2317 echo "$output" | cat_i 2318 [ $ret -eq 1 ] && status=1 2319 else 2320 echo_i "The DNSSEC update test requires the Net::DNS library." >&2 2321 fi 2322 2323 n=$((n+1)) 2324 echo_i "checking managed key maintenance has not started yet ($n)" 2325 ret=0 2326 [ -f "ns4/managed-keys.bind.jnl" ] && ret=1 2327 n=$((n+1)) 2328 test "$ret" -eq 0 || echo_i "failed" 2329 status=$((status+ret)) 2330 2331 # Reconfigure caching server to use "dnssec-validation auto", and repeat 2332 # some of the DNSSEC validation tests to ensure that it works correctly. 2333 echo_i "switching to automatic root key configuration" 2334 copy_setports ns4/named2.conf.in ns4/named.conf 2335 rndccmd 10.53.0.4 reconfig 2>&1 | sed 's/^/ns4 /' | cat_i 2336 sleep 5 2337 2338 echo_i "checking managed key maintenance timer has now started ($n)" 2339 ret=0 2340 [ -f "ns4/managed-keys.bind.jnl" ] || ret=1 2341 n=$((n+1)) 2342 test "$ret" -eq 0 || echo_i "failed" 2343 status=$((status+ret)) 2344 2345 echo_i "checking positive validation NSEC ($n)" 2346 ret=0 2347 dig_with_opts +noauth a.example. @10.53.0.2 a > dig.out.ns2.test$n || ret=1 2348 dig_with_opts +noauth a.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1 2349 digcomp dig.out.ns2.test$n dig.out.ns4.test$n || ret=1 2350 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 2351 n=$((n+1)) 2352 test "$ret" -eq 0 || echo_i "failed" 2353 status=$((status+ret)) 2354 2355 echo_i "checking positive validation NSEC3 ($n)" 2356 ret=0 2357 dig_with_opts +noauth a.nsec3.example. \ 2358 @10.53.0.3 a > dig.out.ns3.test$n || ret=1 2359 dig_with_opts +noauth a.nsec3.example. \ 2360 @10.53.0.4 a > dig.out.ns4.test$n || ret=1 2361 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 2362 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 2363 n=$((n+1)) 2364 test "$ret" -eq 0 || echo_i "failed" 2365 status=$((status+ret)) 2366 2367 echo_i "checking positive validation OPTOUT ($n)" 2368 ret=0 2369 dig_with_opts +noauth a.optout.example. \ 2370 @10.53.0.3 a > dig.out.ns3.test$n || ret=1 2371 dig_with_opts +noauth a.optout.example. \ 2372 @10.53.0.4 a > dig.out.ns4.test$n || ret=1 2373 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 2374 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 2375 n=$((n+1)) 2376 test "$ret" -eq 0 || echo_i "failed" 2377 status=$((status+ret)) 2378 2379 echo_i "checking negative validation ($n)" 2380 ret=0 2381 dig_with_opts +noauth q.example. @10.53.0.2 a > dig.out.ns2.test$n || ret=1 2382 dig_with_opts +noauth q.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1 2383 digcomp dig.out.ns2.test$n dig.out.ns4.test$n || ret=1 2384 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 2385 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1 2386 n=$((n+1)) 2387 test "$ret" -eq 0 || echo_i "failed" 2388 status=$((status+ret)) 2389 2390 echo_i "checking that root DS queries validate ($n)" 2391 ret=0 2392 dig_with_opts +noauth . @10.53.0.1 ds > dig.out.ns1.test$n || ret=1 2393 dig_with_opts +noauth . @10.53.0.4 ds > dig.out.ns4.test$n || ret=1 2394 digcomp dig.out.ns1.test$n dig.out.ns4.test$n || ret=1 2395 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 2396 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 2397 n=$((n+1)) 2398 test "$ret" -eq 0 || echo_i "failed" 2399 status=$((status+ret)) 2400 2401 echo_i "checking that DS at a RFC 1918 empty zone lookup succeeds ($n)" 2402 ret=0 2403 dig_with_opts +noauth 10.in-addr.arpa ds @10.53.0.2 >dig.out.ns2.test$n || ret=1 2404 dig_with_opts +noauth 10.in-addr.arpa ds @10.53.0.4 >dig.out.ns6.test$n || ret=1 2405 digcomp dig.out.ns2.test$n dig.out.ns6.test$n || ret=1 2406 grep "status: NOERROR" dig.out.ns6.test$n > /dev/null || ret=1 2407 n=$((n+1)) 2408 test "$ret" -eq 0 || echo_i "failed" 2409 status=$((status+ret)) 2410 2411 echo_i "checking expired signatures remain with "'"allow-update { none; };"'" and no keys available ($n)" 2412 ret=0 2413 dig_with_opts +noauth expired.example. +dnssec @10.53.0.3 soa > dig.out.ns3.test$n || ret=1 2414 grep "RRSIG.SOA" dig.out.ns3.test$n > /dev/null || ret=1 2415 n=$((n+1)) 2416 test "$ret" -eq 0 || echo_i "failed" 2417 2418 status=$((status+ret)) 2419 echo_i "checking expired signatures do not validate ($n)" 2420 ret=0 2421 dig_with_opts +noauth expired.example. +dnssec @10.53.0.4 soa > dig.out.ns4.test$n || ret=1 2422 grep "SERVFAIL" dig.out.ns4.test$n > /dev/null || ret=1 2423 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 2424 grep "expired.example/.*: RRSIG has expired" ns4/named.run > /dev/null || ret=1 2425 n=$((n+1)) 2426 test "$ret" -eq 0 || echo_i "failed" 2427 status=$((status+ret)) 2428 2429 echo_i "checking that the NSEC3 record for the apex is properly signed when a DNSKEY is added via UPDATE ($n)" 2430 ret=0 2431 ( 2432 cd ns3 || exit 1 2433 kskname=$($KEYGEN -q -3 -a RSASHA1 -fk update-nsec3.example) 2434 ( 2435 echo zone update-nsec3.example 2436 echo server 10.53.0.3 "$PORT" 2437 grep DNSKEY "${kskname}.key" | sed -e 's/^/update add /' -e 's/IN/300 IN/' 2438 echo send 2439 ) | $NSUPDATE 2440 ) 2441 dig_with_opts +dnssec a update-nsec3.example. @10.53.0.4 > dig.out.ns4.test$n || ret=1 2442 grep "NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 2443 grep "flags:.* ad[ ;]" dig.out.ns4.test$n > /dev/null || ret=1 2444 grep "NSEC3 .* TYPE65534" dig.out.ns4.test$n > /dev/null || ret=1 2445 n=$((n+1)) 2446 test "$ret" -eq 0 || echo_i "failed" 2447 status=$((status+ret)) 2448 2449 echo_i "checking that the NSEC record is properly generated when DNSKEY are added via auto-dnssec ($n)" 2450 ret=0 2451 dig_with_opts +dnssec a auto-nsec.example. @10.53.0.4 > dig.out.ns4.test$n || ret=1 2452 grep "NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 2453 grep "flags:.* ad[ ;]" dig.out.ns4.test$n > /dev/null || ret=1 2454 grep "IN.NSEC[^3].* DNSKEY" dig.out.ns4.test$n > /dev/null || ret=1 2455 n=$((n+1)) 2456 test "$ret" -eq 0 || echo_i "failed" 2457 status=$((status+ret)) 2458 2459 echo_i "checking that the NSEC3 record is properly generated when DNSKEY are added via auto-dnssec ($n)" 2460 ret=0 2461 dig_with_opts +dnssec a auto-nsec3.example. @10.53.0.4 > dig.out.ns4.test$n || ret=1 2462 grep "NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 2463 grep "flags:.* ad[ ;]" dig.out.ns4.test$n > /dev/null || ret=1 2464 grep "IN.NSEC3 .* DNSKEY" dig.out.ns4.test$n > /dev/null || ret=1 2465 n=$((n+1)) 2466 test "$ret" -eq 0 || echo_i "failed" 2467 status=$((status+ret)) 2468 2469 echo_i "checking that signing records have been marked as complete ($n)" 2470 ret=0 2471 checkprivate dynamic.example 10.53.0.3 || ret=1 2472 checkprivate update-nsec3.example 10.53.0.3 || ret=1 2473 checkprivate auto-nsec3.example 10.53.0.3 || ret=1 2474 checkprivate expiring.example 10.53.0.3 || ret=1 2475 checkprivate auto-nsec.example 10.53.0.3 || ret=1 2476 n=$((n+1)) 2477 test "$ret" -eq 0 || echo_i "failed" 2478 status=$((status+ret)) 2479 2480 echo_i "check that 'rndc signing' without arguments is handled ($n)" 2481 ret=0 2482 rndccmd 10.53.0.3 signing > /dev/null 2>&1 && ret=1 2483 rndccmd 10.53.0.3 status > /dev/null || ret=1 2484 n=$((n+1)) 2485 test "$ret" -eq 0 || echo_i "failed" 2486 status=$((status+ret)) 2487 2488 echo_i "check that 'rndc signing -list' without zone is handled ($n)" 2489 ret=0 2490 rndccmd 10.53.0.3 signing -list > /dev/null 2>&1 && ret=1 2491 rndccmd 10.53.0.3 status > /dev/null || ret=1 2492 n=$((n+1)) 2493 test "$ret" -eq 0 || echo_i "failed" 2494 status=$((status+ret)) 2495 2496 echo_i "check that 'rndc signing -clear' without additional arguments is handled ($n)" 2497 ret=0 2498 rndccmd 10.53.0.3 signing -clear > /dev/null 2>&1 && ret=1 2499 rndccmd 10.53.0.3 status > /dev/null || ret=1 2500 n=$((n+1)) 2501 test "$ret" -eq 0 || echo_i "failed" 2502 status=$((status+ret)) 2503 2504 echo_i "check that 'rndc signing -clear all' without zone is handled ($n)" 2505 ret=0 2506 rndccmd 10.53.0.3 signing -clear all > /dev/null 2>&1 && ret=1 2507 rndccmd 10.53.0.3 status > /dev/null || ret=1 2508 n=$((n+1)) 2509 test "$ret" -eq 0 || echo_i "failed" 2510 status=$((status+ret)) 2511 2512 echo_i "check that 'rndc signing -nsec3param' without additional arguments is handled ($n)" 2513 ret=0 2514 rndccmd 10.53.0.3 signing -nsec3param > /dev/null 2>&1 && ret=1 2515 rndccmd 10.53.0.3 status > /dev/null || ret=1 2516 n=$((n+1)) 2517 test "$ret" -eq 0 || echo_i "failed" 2518 status=$((status+ret)) 2519 2520 echo_i "check that 'rndc signing -nsec3param none' without zone is handled ($n)" 2521 ret=0 2522 rndccmd 10.53.0.3 signing -nsec3param none > /dev/null 2>&1 && ret=1 2523 rndccmd 10.53.0.3 status > /dev/null || ret=1 2524 n=$((n+1)) 2525 test "$ret" -eq 0 || echo_i "failed" 2526 status=$((status+ret)) 2527 2528 echo_i "check that 'rndc signing -nsec3param 1' without additional arguments is handled ($n)" 2529 ret=0 2530 rndccmd 10.53.0.3 signing -nsec3param 1 > /dev/null 2>&1 && ret=1 2531 rndccmd 10.53.0.3 status > /dev/null || ret=1 2532 n=$((n+1)) 2533 test "$ret" -eq 0 || echo_i "failed" 2534 status=$((status+ret)) 2535 2536 echo_i "check that 'rndc signing -nsec3param 1 0' without additional arguments is handled ($n)" 2537 ret=0 2538 rndccmd 10.53.0.3 signing -nsec3param 1 0 > /dev/null 2>&1 && ret=1 2539 rndccmd 10.53.0.3 status > /dev/null || ret=1 2540 n=$((n+1)) 2541 test "$ret" -eq 0 || echo_i "failed" 2542 status=$((status+ret)) 2543 2544 echo_i "check that 'rndc signing -nsec3param 1 0 0' without additional arguments is handled ($n)" 2545 ret=0 2546 rndccmd 10.53.0.3 signing -nsec3param 1 0 0 > /dev/null 2>&1 && ret=1 2547 rndccmd 10.53.0.3 status > /dev/null || ret=1 2548 n=$((n+1)) 2549 test "$ret" -eq 0 || echo_i "failed" 2550 status=$((status+ret)) 2551 2552 echo_i "check that 'rndc signing -nsec3param 1 0 0 -' without zone is handled ($n)" 2553 ret=0 2554 rndccmd 10.53.0.3 signing -nsec3param 1 0 0 - > /dev/null 2>&1 && ret=1 2555 rndccmd 10.53.0.3 status > /dev/null || ret=1 2556 n=$((n+1)) 2557 test "$ret" -eq 0 || echo_i "failed" 2558 status=$((status+ret)) 2559 2560 echo_i "check that 'rndc signing -nsec3param' works with salt ($n)" 2561 ret=0 2562 rndccmd 10.53.0.3 signing -nsec3param 1 0 0 ffff inline.example > /dev/null 2>&1 || ret=1 2563 rndccmd 10.53.0.3 status > /dev/null || ret=1 2564 for i in 1 2 3 4 5 6 7 8 9 10 ; do 2565 salt=$(dig_with_opts +nodnssec +short nsec3param inline.example. @10.53.0.3 | awk '{print $4}') 2566 if [ "$salt" = "FFFF" ]; then 2567 break; 2568 fi 2569 echo_i "sleeping ...." 2570 sleep 1 2571 done; 2572 [ "$salt" = "FFFF" ] || ret=1 2573 n=$((n+1)) 2574 test "$ret" -eq 0 || echo_i "failed" 2575 status=$((status+ret)) 2576 2577 echo_i "check that 'rndc signing -nsec3param' works without salt ($n)" 2578 ret=0 2579 rndccmd 10.53.0.3 signing -nsec3param 1 0 0 - inline.example > /dev/null 2>&1 || ret=1 2580 rndccmd 10.53.0.3 status > /dev/null || ret=1 2581 for i in 1 2 3 4 5 6 7 8 9 10 ; do 2582 salt=$(dig_with_opts +nodnssec +short nsec3param inline.example. @10.53.0.3 | awk '{print $4}') 2583 if [ "$salt" = "-" ]; then 2584 break; 2585 fi 2586 echo_i "sleeping ...." 2587 sleep 1 2588 done; 2589 [ "$salt" = "-" ] || ret=1 2590 n=$((n+1)) 2591 test "$ret" -eq 0 || echo_i "failed" 2592 status=$((status+ret)) 2593 2594 echo_i "check that 'rndc signing -nsec3param' works with 'auto' as salt ($n)" 2595 ret=0 2596 rndccmd 10.53.0.3 signing -nsec3param 1 0 0 auto inline.example > /dev/null 2>&1 || ret=1 2597 rndccmd 10.53.0.3 status > /dev/null || ret=1 2598 for i in 1 2 3 4 5 6 7 8 9 10 ; do 2599 salt=$(dig_with_opts +nodnssec +short nsec3param inline.example. @10.53.0.3 | awk '{print $4}') 2600 [ -n "$salt" ] && [ "$salt" != "-" ] && break 2601 echo_i "sleeping ...." 2602 sleep 1 2603 done; 2604 [ "$salt" != "-" ] || ret=1 2605 [ "${#salt}" -eq 16 ] || ret=1 2606 n=$((n+1)) 2607 test "$ret" -eq 0 || echo_i "failed" 2608 status=$((status+ret)) 2609 2610 echo_i "check that 'rndc signing -nsec3param' with 'auto' as salt again generates a different salt ($n)" 2611 ret=0 2612 oldsalt=$salt 2613 rndccmd 10.53.0.3 signing -nsec3param 1 0 0 auto inline.example > /dev/null 2>&1 || ret=1 2614 rndccmd 10.53.0.3 status > /dev/null || ret=1 2615 for i in 1 2 3 4 5 6 7 8 9 10 ; do 2616 salt=$(dig_with_opts +nodnssec +short nsec3param inline.example. @10.53.0.3 | awk '{print $4}') 2617 [ -n "$salt" ] && [ "$salt" != "$oldsalt" ] && break 2618 echo_i "sleeping ...." 2619 sleep 1 2620 done; 2621 [ "$salt" != "$oldsalt" ] || ret=1 2622 [ "${#salt}" -eq 16 ] || ret=1 2623 n=$((n+1)) 2624 test "$ret" -eq 0 || echo_i "failed" 2625 status=$((status+ret)) 2626 2627 echo_i "check rndc signing -list output ($n)" 2628 ret=0 2629 { rndccmd 10.53.0.3 signing -list dynamic.example > signing.out; } 2>&1 2630 grep -q "No signing records found" signing.out || { 2631 ret=1 2632 sed 's/^/ns3 /' signing.out | cat_i 2633 } 2634 { rndccmd 10.53.0.3 signing -list update-nsec3.example > signing.out; } 2>&1 2635 grep -q "Done signing with key .*/NSEC3RSASHA1" signing.out || { 2636 ret=1 2637 sed 's/^/ns3 /' signing.out | cat_i 2638 } 2639 n=$((n+1)) 2640 test "$ret" -eq 0 || echo_i "failed" 2641 status=$((status+ret)) 2642 2643 echo_i "clear signing records ($n)" 2644 { rndccmd 10.53.0.3 signing -clear all update-nsec3.example > /dev/null; } 2>&1 || ret=1 2645 check_no_signing_record_found() { 2646 { rndccmd 10.53.0.3 signing -list update-nsec3.example > signing.out; } 2>&1 2647 grep -q "No signing records found" signing.out || { 2648 sed 's/^/ns3 /' signing.out | cat_i 2649 return 1 2650 } 2651 return 0 2652 } 2653 retry_quiet 5 check_no_signing_record_found || ret=1 2654 n=$((n+1)) 2655 test "$ret" -eq 0 || echo_i "failed" 2656 status=$((status+ret)) 2657 2658 echo_i "checking that a insecure zone beneath a cname resolves ($n)" 2659 ret=0 2660 dig_with_opts soa insecure.below-cname.example. @10.53.0.4 > dig.out.ns4.test$n || ret=1 2661 grep "NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 2662 grep "ANSWER: 1," dig.out.ns4.test$n > /dev/null || ret=1 2663 n=$((n+1)) 2664 test "$ret" -eq 0 || echo_i "failed" 2665 status=$((status+ret)) 2666 2667 echo_i "checking that a secure zone beneath a cname resolves ($n)" 2668 ret=0 2669 dig_with_opts soa secure.below-cname.example. @10.53.0.4 > dig.out.ns4.test$n || ret=1 2670 grep "NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 2671 grep "ANSWER: 2," dig.out.ns4.test$n > /dev/null || ret=1 2672 grep "flags:.* ad[ ;]" dig.out.ns4.test$n > /dev/null || ret=1 2673 n=$((n+1)) 2674 test "$ret" -eq 0 || echo_i "failed" 2675 status=$((status+ret)) 2676 2677 my_dig() { 2678 "$DIG" +noadd +nosea +nostat +noquest +nocomm +nocmd -p "$PORT" @10.53.0.4 "$@" 2679 } 2680 2681 echo_i "checking DNSKEY query with no data still gets put in cache ($n)" 2682 ret=0 2683 firstVal=$(my_dig insecure.example. dnskey| awk '$1 != ";;" { print $2 }') 2684 sleep 1 2685 secondVal=$(my_dig insecure.example. dnskey| awk '$1 != ";;" { print $2 }') 2686 if [ "${firstVal:-0}" -eq "${secondVal:-0}" ] 2687 then 2688 sleep 1 2689 thirdVal=$(my_dig insecure.example. dnskey|awk '$1 != ";;" { print $2 }') 2690 if [ "${firstVal:-0}" -eq "${thirdVal:-0}" ] 2691 then 2692 echo_i "cannot confirm query answer still in cache" 2693 ret=1 2694 fi 2695 fi 2696 n=$((n+1)) 2697 test "$ret" -eq 0 || echo_i "failed" 2698 status=$((status+ret)) 2699 2700 echo_i "check that a split dnssec dnssec-signzone work ($n)" 2701 ret=0 2702 dig_with_opts soa split-dnssec.example. @10.53.0.4 > dig.out.ns4.test$n || ret=1 2703 grep "NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 2704 grep "ANSWER: 2," dig.out.ns4.test$n > /dev/null || ret=1 2705 grep "flags:.* ad[ ;]" dig.out.ns4.test$n > /dev/null || ret=1 2706 n=$((n+1)) 2707 test "$ret" -eq 0 || echo_i "failed" 2708 status=$((status+ret)) 2709 2710 echo_i "check that a smart split dnssec dnssec-signzone work ($n)" 2711 ret=0 2712 dig_with_opts soa split-smart.example. @10.53.0.4 > dig.out.ns4.test$n || ret=1 2713 grep "NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 2714 grep "ANSWER: 2," dig.out.ns4.test$n > /dev/null || ret=1 2715 grep "flags:.* ad[ ;]" dig.out.ns4.test$n > /dev/null || ret=1 2716 n=$((n+1)) 2717 test "$ret" -eq 0 || echo_i "failed" 2718 status=$((status+ret)) 2719 2720 echo_i "check that NOTIFY is sent at the end of NSEC3 chain generation ($n)" 2721 ret=0 2722 ( 2723 echo zone nsec3chain-test 2724 echo server 10.53.0.2 "$PORT" 2725 echo update add nsec3chain-test. 0 nsec3param 1 0 1 123456 2726 echo send 2727 ) | $NSUPDATE 2728 for i in 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 2729 do 2730 dig_with_opts nsec3param nsec3chain-test @10.53.0.2 > dig.out.ns2.test$n || ret=1 2731 if grep "ANSWER: 3," dig.out.ns2.test$n >/dev/null 2732 then 2733 break; 2734 fi 2735 echo_i "sleeping ...." 2736 sleep 3 2737 done 2738 grep "ANSWER: 3," dig.out.ns2.test$n > /dev/null || ret=1 2739 if [ "$ret" -ne 0 ]; then echo_i "nsec3 chain generation not complete"; fi 2740 dig_with_opts +noauth +nodnssec soa nsec3chain-test @10.53.0.2 > dig.out.ns2.test$n || ret=1 2741 s2=$(awk '$4 == "SOA" { print $7}' dig.out.ns2.test$n) 2742 for i in 1 2 3 4 5 6 7 8 9 10 2743 do 2744 dig_with_opts +noauth +nodnssec soa nsec3chain-test @10.53.0.3 > dig.out.ns3.test$n || ret=1 2745 s3=$(awk '$4 == "SOA" { print $7}' dig.out.ns3.test$n) 2746 test "$s2" = "$s3" && break 2747 sleep 1 2748 done 2749 digcomp dig.out.ns2.test$n dig.out.ns3.test$n || ret=1 2750 n=$((n+1)) 2751 test "$ret" -eq 0 || echo_i "failed" 2752 status=$((status+ret)) 2753 2754 echo_i "check dnssec-dsfromkey from stdin ($n)" 2755 ret=0 2756 dig_with_opts dnskey algroll. @10.53.0.2 | \ 2757 $DSFROMKEY -f - algroll. > dig.out.ns2.test$n || ret=1 2758 NF=$(awk '{print NF}' dig.out.ns2.test$n | sort -u) 2759 [ "${NF}" = 7 ] || ret=1 2760 # make canonical 2761 awk '{ 2762 for (i=1;i<7;i++) printf("%s ", $i); 2763 for (i=7;i<=NF;i++) printf("%s", $i); 2764 printf("\n"); 2765 }' < dig.out.ns2.test$n > canonical1.$n || ret=1 2766 awk '{ 2767 for (i=1;i<7;i++) printf("%s ", $i); 2768 for (i=7;i<=NF;i++) printf("%s", $i); 2769 printf("\n"); 2770 }' < ns1/dsset-algroll$TP > canonical2.$n || ret=1 2771 $DIFF -b canonical1.$n canonical2.$n > /dev/null 2>&1 || ret=1 2772 n=$((n+1)) 2773 test "$ret" -eq 0 || echo_i "failed" 2774 status=$((status+ret)) 2775 2776 # Intentionally strip ".key" from keyfile name to ensure the error message 2777 # includes it anyway to avoid confusion (RT #21731) 2778 echo_i "check dnssec-dsfromkey error message when keyfile is not found ($n)" 2779 ret=0 2780 key=$($KEYGEN -a RSASHA1 -q example.) || ret=1 2781 mv "$key.key" "$key" 2782 $DSFROMKEY "$key" > dsfromkey.out.$n 2>&1 && ret=1 2783 grep "$key.key: file not found" dsfromkey.out.$n > /dev/null || ret=1 2784 n=$((n+1)) 2785 test "$ret" -eq 0 || echo_i "failed" 2786 status=$((status+ret)) 2787 2788 echo_i "testing soon-to-expire RRSIGs without a replacement private key ($n)" 2789 ret=0 2790 dig_with_answeropts +nottlid expiring.example ns @10.53.0.3 | grep RRSIG > dig.out.ns3.test$n 2>&1 2791 # there must be a signature here 2792 [ -s dig.out.ns3.test$n ] || ret=1 2793 n=$((n+1)) 2794 test "$ret" -eq 0 || echo_i "failed" 2795 status=$((status+ret)) 2796 2797 echo_i "testing new records are signed with 'no-resign' ($n)" 2798 ret=0 2799 ( 2800 echo zone nosign.example 2801 echo server 10.53.0.3 "$PORT" 2802 echo update add new.nosign.example 300 in txt "hi there" 2803 echo send 2804 ) | $NSUPDATE 2805 sleep 1 2806 dig_with_answeropts +nottlid txt new.nosign.example @10.53.0.3 \ 2807 > dig.out.ns3.test$n 2>&1 2808 grep RRSIG dig.out.ns3.test$n > /dev/null 2>&1 || ret=1 2809 n=$((n+1)) 2810 test "$ret" -eq 0 || echo_i "failed" 2811 status=$((status+ret)) 2812 2813 echo_i "testing expiring records aren't resigned with 'no-resign' ($n)" 2814 ret=0 2815 dig_with_answeropts +nottlid nosign.example ns @10.53.0.3 | \ 2816 grep RRSIG | sed 's/[ ][ ]*/ /g' > dig.out.ns3.test$n 2>&1 2817 # the NS RRSIG should not be changed 2818 $DIFF nosign.before dig.out.ns3.test$n > /dev/null|| ret=1 2819 n=$((n+1)) 2820 test "$ret" -eq 0 || echo_i "failed" 2821 status=$((status+ret)) 2822 2823 echo_i "testing updates fail with no private key ($n)" 2824 ret=0 2825 rm -f ns3/Knosign.example.*.private 2826 ( 2827 echo zone nosign.example 2828 echo server 10.53.0.3 "$PORT" 2829 echo update add fail.nosign.example 300 in txt "reject me" 2830 echo send 2831 ) | $NSUPDATE > /dev/null 2>&1 && ret=1 2832 dig_with_answeropts +nottlid fail.nosign.example txt @10.53.0.3 \ 2833 > dig.out.ns3.test$n 2>&1 2834 [ -s dig.out.ns3.test$n ] && ret=1 2835 n=$((n+1)) 2836 test "$ret" -eq 0 || echo_i "failed" 2837 status=$((status+ret)) 2838 2839 echo_i "testing legacy upper case signer name validation ($n)" 2840 ret=0 2841 $DIG +tcp +noadd +noauth +dnssec -p "$PORT" soa upper.example @10.53.0.4 \ 2842 > dig.out.ns4.test$n 2>&1 2843 grep "flags:.* ad;" dig.out.ns4.test$n > /dev/null || ret=1 2844 grep "RRSIG.*SOA.* UPPER\\.EXAMPLE\\. " dig.out.ns4.test$n > /dev/null || ret=1 2845 n=$((n+1)) 2846 test "$ret" -eq 0 || echo_i "failed" 2847 status=$((status+ret)) 2848 2849 echo_i "testing that we lower case signer name ($n)" 2850 ret=0 2851 $DIG +tcp +noadd +noauth +dnssec -p "$PORT" soa LOWER.EXAMPLE @10.53.0.4 \ 2852 > dig.out.ns4.test$n 2>&1 2853 grep "flags:.* ad;" dig.out.ns4.test$n > /dev/null || ret=1 2854 grep "RRSIG.*SOA.* lower\\.example\\. " dig.out.ns4.test$n > /dev/null || ret=1 2855 n=$((n+1)) 2856 test "$ret" -eq 0 || echo_i "failed" 2857 status=$((status+ret)) 2858 2859 echo_i "testing TTL is capped at RRSIG expiry time ($n)" 2860 ret=0 2861 rndccmd 10.53.0.3 freeze expiring.example 2>&1 | sed 's/^/ns3 /' | cat_i 2862 ( 2863 cd ns3 || exit 1 2864 for file in K*.moved; do 2865 mv "$file" "$(basename "$file" .moved)" 2866 done 2867 $SIGNER -S -N increment -e now+1mi -o expiring.example expiring.example.db > /dev/null 2868 ) || ret=1 2869 rndc_reload ns3 10.53.0.3 expiring.example 2870 2871 rndccmd 10.53.0.4 flush 2>&1 | sed 's/^/ns4 /' | cat_i 2872 dig_with_answeropts +cd expiring.example soa @10.53.0.4 > dig.out.ns4.1.$n 2873 dig_with_answeropts expiring.example soa @10.53.0.4 > dig.out.ns4.2.$n 2874 ttls=$(awk '$1 != ";;" {print $2}' dig.out.ns4.1.$n) 2875 ttls2=$(awk '$1 != ";;" {print $2}' dig.out.ns4.2.$n) 2876 for ttl in ${ttls:-0}; do 2877 [ "${ttl}" -eq 300 ] || ret=1 2878 done 2879 for ttl in ${ttls2:-0}; do 2880 [ "${ttl}" -le 60 ] || ret=1 2881 done 2882 n=$((n+1)) 2883 test "$ret" -eq 0 || echo_i "failed" 2884 status=$((status+ret)) 2885 2886 echo_i "testing TTL is capped at RRSIG expiry time for records in the additional section (NS) ($n)" 2887 ret=0 2888 rndccmd 10.53.0.4 flush 2>&1 | sed 's/^/ns4 /' | cat_i 2889 sleep 1 2890 dig_with_additionalopts +cd expiring.example ns @10.53.0.4 > dig.out.ns4.1.$n 2891 dig_with_additionalopts expiring.example ns @10.53.0.4 > dig.out.ns4.2.$n 2892 ttls=$(awk '$1 != ";;" {print $2}' dig.out.ns4.1.$n) 2893 ttls2=$(awk '$1 != ";;" {print $2}' dig.out.ns4.2.$n) 2894 for ttl in ${ttls:-300}; do 2895 [ "$ttl" -le 300 ] && [ "$ttl" -gt 240 ] || ret=1 2896 done 2897 for ttl in ${ttls2:-0}; do 2898 [ "$ttl" -le 60 ] || ret=1 2899 done 2900 n=$((n+1)) 2901 test "$ret" -eq 0 || echo_i "failed" 2902 status=$((status+ret)) 2903 2904 echo_i "testing TTL is capped at RRSIG expiry time for records in the additional section (MX) ($n)" 2905 ret=0 2906 rndccmd 10.53.0.4 flush 2>&1 | sed 's/^/ns4 /' | cat_i 2907 sleep 1 2908 dig_with_additionalopts +cd expiring.example mx @10.53.0.4 > dig.out.ns4.1.$n 2909 dig_with_additionalopts expiring.example mx @10.53.0.4 > dig.out.ns4.2.$n 2910 ttls=$(awk '$1 != ";;" {print $2}' dig.out.ns4.1.$n) 2911 ttls2=$(awk '$1 != ";;" {print $2}' dig.out.ns4.2.$n) 2912 for ttl in ${ttls:-300}; do 2913 [ "$ttl" -le 300 ] && [ "$ttl" -gt 240 ] || ret=1 2914 done 2915 for ttl in ${ttls2:-0}; do 2916 [ "$ttl" -le 60 ] || ret=1 2917 done 2918 n=$((n+1)) 2919 test "$ret" -eq 0 || echo_i "failed" 2920 status=$((status+ret)) 2921 2922 copy_setports ns4/named3.conf.in ns4/named.conf 2923 rndccmd 10.53.0.4 reconfig 2>&1 | sed 's/^/ns4 /' | cat_i 2924 sleep 3 2925 2926 echo_i "testing TTL of about to expire RRsets with dnssec-accept-expired yes; ($n)" 2927 ret=0 2928 rndccmd 10.53.0.4 flush 2>&1 | sed 's/^/ns4 /' | cat_i 2929 dig_with_answeropts +cd expiring.example soa @10.53.0.4 > dig.out.ns4.1.$n 2930 dig_with_answeropts expiring.example soa @10.53.0.4 > dig.out.ns4.2.$n 2931 ttls=$(awk '$1 != ";;" {print $2}' dig.out.ns4.1.$n) 2932 ttls2=$(awk '$1 != ";;" {print $2}' dig.out.ns4.2.$n) 2933 for ttl in ${ttls:-0}; do 2934 [ "$ttl" -eq 300 ] || ret=1 2935 done 2936 for ttl in ${ttls2:-0}; do 2937 [ "$ttl" -eq 120 ] || ret=1 2938 done 2939 n=$((n+1)) 2940 test "$ret" -eq 0 || echo_i "failed" 2941 status=$((status+ret)) 2942 2943 echo_i "testing TTL of expired RRsets with dnssec-accept-expired yes; ($n)" 2944 ret=0 2945 dig_with_answeropts +cd expired.example soa @10.53.0.4 > dig.out.ns4.1.$n 2946 dig_with_answeropts expired.example soa @10.53.0.4 > dig.out.ns4.2.$n 2947 ttls=$(awk '$1 != ";;" {print $2}' dig.out.ns4.1.$n) 2948 ttls2=$(awk '$1 != ";;" {print $2}' dig.out.ns4.2.$n) 2949 for ttl in ${ttls:-0}; do 2950 [ "$ttl" -eq 300 ] || ret=1 2951 done 2952 for ttl in ${ttls2:-0}; do 2953 [ "$ttl" -eq 120 ] || ret=1 2954 done 2955 n=$((n+1)) 2956 test "$ret" -eq 0 || echo_i "failed" 2957 status=$((status+ret)) 2958 2959 echo_i "testing TTL is capped at RRSIG expiry time for records in the additional section with dnssec-accept-expired yes; ($n)" 2960 ret=0 2961 rndccmd 10.53.0.4 flush 2>&1 | sed 's/^/ns4 /' | cat_i 2962 dig_with_additionalopts +cd expiring.example mx @10.53.0.4 > dig.out.ns4.1.$n 2963 dig_with_additionalopts expiring.example mx @10.53.0.4 > dig.out.ns4.2.$n 2964 ttls=$(awk '$1 != ";;" {print $2}' dig.out.ns4.1.$n) 2965 ttls2=$(awk '$1 != ";;" {print $2}' dig.out.ns4.2.$n) 2966 for ttl in ${ttls:-300}; do 2967 [ "$ttl" -le 300 ] && [ "$ttl" -gt 240 ] || ret=1 2968 done 2969 for ttl in ${ttls2:-0}; do 2970 [ "$ttl" -le 120 ] && [ "$ttl" -gt 60 ] || ret=1 2971 done 2972 n=$((n+1)) 2973 test "$ret" -eq 0 || echo_i "failed" 2974 status=$((status+ret)) 2975 2976 echo_i "testing DNSKEY lookup via CNAME ($n)" 2977 ret=0 2978 dig_with_opts +noauth cnameandkey.secure.example. \ 2979 @10.53.0.3 dnskey > dig.out.ns3.test$n || ret=1 2980 dig_with_opts +noauth cnameandkey.secure.example. \ 2981 @10.53.0.4 dnskey > dig.out.ns4.test$n || ret=1 2982 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 2983 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 2984 grep "CNAME" dig.out.ns4.test$n > /dev/null || ret=1 2985 n=$((n+1)) 2986 test "$ret" -eq 0 || echo_i "failed" 2987 status=$((status+ret)) 2988 2989 echo_i "testing KEY lookup at CNAME (present) ($n)" 2990 ret=0 2991 dig_with_opts +noauth cnameandkey.secure.example. \ 2992 @10.53.0.3 key > dig.out.ns3.test$n || ret=1 2993 dig_with_opts +noauth cnameandkey.secure.example. \ 2994 @10.53.0.4 key > dig.out.ns4.test$n || ret=1 2995 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 2996 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 2997 grep "CNAME" dig.out.ns4.test$n > /dev/null && ret=1 2998 n=$((n+1)) 2999 test "$ret" -eq 0 || echo_i "failed" 3000 status=$((status+ret)) 3001 3002 echo_i "testing KEY lookup at CNAME (not present) ($n)" 3003 ret=0 3004 dig_with_opts +noauth cnamenokey.secure.example. \ 3005 @10.53.0.3 key > dig.out.ns3.test$n || ret=1 3006 dig_with_opts +noauth cnamenokey.secure.example. \ 3007 @10.53.0.4 key > dig.out.ns4.test$n || ret=1 3008 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 3009 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 3010 grep "CNAME" dig.out.ns4.test$n > /dev/null && ret=1 3011 n=$((n+1)) 3012 test "$ret" -eq 0 || echo_i "failed" 3013 status=$((status+ret)) 3014 3015 echo_i "testing DNSKEY lookup via DNAME ($n)" 3016 ret=0 3017 dig_with_opts a.dnameandkey.secure.example. \ 3018 @10.53.0.3 dnskey > dig.out.ns3.test$n || ret=1 3019 dig_with_opts a.dnameandkey.secure.example. \ 3020 @10.53.0.4 dnskey > dig.out.ns4.test$n || ret=1 3021 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 3022 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 3023 grep "CNAME" dig.out.ns4.test$n > /dev/null || ret=1 3024 grep "DNAME" dig.out.ns4.test$n > /dev/null || ret=1 3025 n=$((n+1)) 3026 test "$ret" -eq 0 || echo_i "failed" 3027 status=$((status+ret)) 3028 3029 echo_i "testing KEY lookup via DNAME ($n)" 3030 ret=0 3031 dig_with_opts b.dnameandkey.secure.example. \ 3032 @10.53.0.3 key > dig.out.ns3.test$n || ret=1 3033 dig_with_opts b.dnameandkey.secure.example. \ 3034 @10.53.0.4 key > dig.out.ns4.test$n || ret=1 3035 digcomp dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 3036 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 3037 grep "DNAME" dig.out.ns4.test$n > /dev/null || ret=1 3038 n=$((n+1)) 3039 test "$ret" -eq 0 || echo_i "failed" 3040 status=$((status+ret)) 3041 3042 echo_i "check that named doesn't loop when all private keys are not available ($n)" 3043 ret=0 3044 lines=$(grep -c "reading private key file expiring.example" ns3/named.run || true) 3045 test "${lines:-1000}" -lt 15 || ret=1 3046 n=$((n+1)) 3047 test "$ret" -eq 0 || echo_i "failed" 3048 status=$((status+ret)) 3049 3050 echo_i "check against against missing nearest provable proof ($n)" 3051 dig_with_opts +norec b.c.d.optout-tld. \ 3052 @10.53.0.6 ds > dig.out.ds.ns6.test$n || ret=1 3053 nsec3=$(grep -c "IN.NSEC3" dig.out.ds.ns6.test$n || true) 3054 [ "$nsec3" -eq 2 ] || ret=1 3055 dig_with_opts +norec b.c.d.optout-tld. \ 3056 @10.53.0.6 A > dig.out.ns6.test$n || ret=1 3057 nsec3=$(grep -c "IN.NSEC3" dig.out.ns6.test$n || true) 3058 [ "$nsec3" -eq 1 ] || ret=1 3059 dig_with_opts optout-tld. \ 3060 @10.53.0.4 SOA > dig.out.soa.ns4.test$n || ret=1 3061 grep "flags:.*ad.*QUERY" dig.out.soa.ns4.test$n > /dev/null || ret=1 3062 dig_with_opts b.c.d.optout-tld. \ 3063 @10.53.0.4 A > dig.out.ns4.test$n || ret=1 3064 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 3065 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 3066 n=$((n+1)) 3067 test "$ret" -eq 0 || echo_i "failed" 3068 status=$((status+ret)) 3069 3070 echo_i "check that key id are logged when dumping the cache ($n)" 3071 ret=0 3072 rndc_dumpdb ns4 3073 grep "; key id = " ns4/named_dump.db.test$n > /dev/null || ret=1 3074 n=$((n+1)) 3075 test "$ret" -eq 0 || echo_i "failed" 3076 status=$((status+ret)) 3077 3078 echo_i "check KEYDATA records are printed in human readable form in key zone ($n)" 3079 # force the managed-keys zone to be written out 3080 rndccmd 10.53.0.4 managed-keys sync 2>&1 | sed 's/^/ns4 /' | cat_i 3081 for i in 1 2 3 4 5 6 7 8 9 3082 do 3083 ret=0 3084 if test -f ns4/managed-keys.bind 3085 then 3086 grep KEYDATA ns4/managed-keys.bind > /dev/null && 3087 grep "next refresh:" ns4/managed-keys.bind > /dev/null && 3088 break 3089 fi 3090 ret=1 3091 sleep 1 3092 done 3093 n=$((n+1)) 3094 test "$ret" -eq 0 || echo_i "failed" 3095 status=$((status+ret)) 3096 3097 echo_i "check dig's +nocrypto flag ($n)" 3098 ret=0 3099 dig_with_opts +norec +nocrypto DNSKEY . \ 3100 @10.53.0.1 > dig.out.dnskey.ns1.test$n || ret=1 3101 grep -E "256 [0-9]+ $DEFAULT_ALGORITHM_NUMBER \\[key id = [1-9][0-9]*]" dig.out.dnskey.ns1.test$n > /dev/null || ret=1 3102 grep -E "RRSIG.* \\[omitted]" dig.out.dnskey.ns1.test$n > /dev/null || ret=1 3103 dig_with_opts +norec +nocrypto DS example \ 3104 @10.53.0.1 > dig.out.ds.ns1.test$n || ret=1 3105 grep -E "DS.* [0-9]+ [12] \[omitted]" dig.out.ds.ns1.test$n > /dev/null || ret=1 3106 n=$((n+1)) 3107 test "$ret" -eq 0 || echo_i "failed" 3108 status=$((status+ret)) 3109 3110 echo_i "check simultaneous inactivation and publishing of dnskeys removes inactive signature ($n)" 3111 ret=0 3112 cnt=0 3113 while : 3114 do 3115 dig_with_opts publish-inactive.example @10.53.0.3 dnskey > dig.out.ns3.test$n 3116 keys=$(awk '$5 == 257 { print; }' dig.out.ns3.test$n | wc -l) 3117 test "$keys" -gt 2 && break 3118 cnt=$((cnt+1)) 3119 test "$cnt" -gt 120 && break 3120 sleep 1 3121 done 3122 test "$keys" -gt 2 || ret=1 3123 sigs=$(grep -c RRSIG dig.out.ns3.test$n || true) 3124 n=$((n+1)) 3125 test "$sigs" -eq 2 || ret=1 3126 if test "$ret" -ne 0 ; then echo_i "failed"; fi 3127 status=$((status+ret)) 3128 3129 echo_i "check that increasing the sig-validity-interval resigning triggers re-signing ($n)" 3130 ret=0 3131 before=$($DIG axfr siginterval.example -p "$PORT" @10.53.0.3 | grep RRSIG.SOA) 3132 cp ns3/siginterval2.conf ns3/siginterval.conf 3133 rndccmd 10.53.0.3 reconfig 2>&1 | sed 's/^/ns3 /' | cat_i 3134 i=10 3135 while [ "$i" -ge 0 ]; do 3136 after=$($DIG axfr siginterval.example -p "$PORT" @10.53.0.3 | grep RRSIG.SOA) 3137 test "$before" != "$after" && break 3138 sleep 1 3139 i=$((i-1)) 3140 done 3141 n=$((n+1)) 3142 if test "$before" = "$after" ; then echo_i "failed"; ret=1; fi 3143 status=$((status+ret)) 3144 3145 if [ -x "$PYTHON" ]; then 3146 echo_i "check dnskey-sig-validity sets longer expiry for DNSKEY ($n)" 3147 ret=0 3148 rndccmd 10.53.0.3 sign siginterval.example 2>&1 | sed 's/^/ns3 /' | cat_i 3149 # convert expiry date to a comma-separated list of integers python can 3150 # use as input to date(). strip leading 0s in months and days so 3151 # python3 will recognize them as integers. 3152 $DIG +dnssec +short -p "$PORT" @10.53.0.3 soa siginterval.example > dig.out.soa.test$n 3153 soaexpire=$(awk '$1 ~ /SOA/ { print $5 }' dig.out.soa.test$n | 3154 sed 's/\(....\)\(..\)\(..\).*/\1, \2, \3/' | 3155 sed 's/ 0/ /g') 3156 $DIG +dnssec +short -p "$PORT" @10.53.0.3 dnskey siginterval.example > dig.out.dnskey.test$n 3157 dnskeyexpire=$(awk '$1 ~ /DNSKEY/ { print $5; exit 0 }' dig.out.dnskey.test$n | 3158 sed 's/\(....\)\(..\)\(..\).*/\1, \2, \3/' | 3159 sed 's/ 0/ /g') 3160 $PYTHON > python.out.$n <<EOF 3161 from datetime import date; 3162 ke=date($dnskeyexpire) 3163 se=date($soaexpire) 3164 print((ke-se).days); 3165 EOF 3166 diff=$(cat python.out.$n) 3167 [ "$diff" -ge 55 ] || ret=1 3168 n=$((n+1)) 3169 test "$ret" -eq 0 || echo_i "failed" 3170 status=$((status+ret)) 3171 fi 3172 3173 copy_setports ns4/named4.conf.in ns4/named.conf 3174 rndccmd 10.53.0.4 reconfig 2>&1 | sed 's/^/ns4 /' | cat_i 3175 sleep 3 3176 3177 echo_i "check insecure delegation between static-stub zones ($n)" 3178 ret=0 3179 dig_with_opts ns insecure.secure.example \ 3180 @10.53.0.4 > dig.out.ns4.1.test$n || ret=1 3181 grep "SERVFAIL" dig.out.ns4.1.test$n > /dev/null && ret=1 3182 dig_with_opts ns secure.example \ 3183 @10.53.0.4 > dig.out.ns4.2.test$n || ret=1 3184 grep "SERVFAIL" dig.out.ns4.2.test$n > /dev/null && ret=1 3185 n=$((n+1)) 3186 test "$ret" -eq 0 || echo_i "failed" 3187 status=$((status+ret)) 3188 3189 echo_i "check the acceptance of seconds as inception and expiration times ($n)" 3190 ret=0 3191 in="NSEC 8 0 86400 1390003200 1389394800 33655 . NYWjZYBV1b+h4j0yu/SmPOOylR8P4IXKDzHX3NwEmU1SUp27aJ91dP+i+UBcnPmBib0hck4DrFVvpflCEpCnVQd2DexcN0GX+3PM7XobxhtDlmnU X1L47zJlbdHNwTqHuPaMM6Xy9HGMXps7O5JVyfggVhTz2C+G5OVxBdb2rOo=" 3192 3193 exp="NSEC 8 0 86400 20140118000000 20140110230000 33655 . NYWjZYBV1b+h4j0yu/SmPOOylR8P4IXKDzHX3NwEmU1SUp27aJ91dP+i +UBcnPmBib0hck4DrFVvpflCEpCnVQd2DexcN0GX+3PM7XobxhtDlmnU X1L47zJlbdHNwTqHuPaMM6Xy9HGMXps7O5JVyfggVhTz2C+G5OVxBdb2 rOo=" 3194 3195 out=$(echo "IN RRSIG $in" | $RRCHECKER -p | sed 's/^IN.RRSIG.//') 3196 [ "$out" = "$exp" ] || ret=1 3197 n=$((n+1)) 3198 test "$ret" -eq 0 || echo_i "failed" 3199 status=$((status+ret)) 3200 3201 echo_i "check the correct resigning time is reported in zonestatus ($n)" 3202 ret=0 3203 rndccmd 10.53.0.3 \ 3204 zonestatus secure.example > rndc.out.ns3.test$n 3205 # next resign node: secure.example/DNSKEY 3206 qname=$(awk '/next resign node:/ { print $4 }' rndc.out.ns3.test$n | sed 's,/.*,,') 3207 qtype=$(awk '/next resign node:/ { print $4 }' rndc.out.ns3.test$n | sed 's,.*/,,') 3208 # next resign time: Thu, 24 Apr 2014 10:38:16 GMT 3209 time=$(awk 'BEGIN { m["Jan"] = "01"; m["Feb"] = "02"; m["Mar"] = "03"; 3210 m["Apr"] = "04"; m["May"] = "05"; m["Jun"] = "06"; 3211 m["Jul"] = "07"; m["Aug"] = "08"; m["Sep"] = "09"; 3212 m["Oct"] = "10"; m["Nov"] = "11"; m["Dec"] = "12";} 3213 /next resign time:/ { printf "%d%s%02d%s\n", $7, m[$6], $5, $8 }' rndc.out.ns3.test$n | sed 's/://g') 3214 dig_with_opts +noall +answer "$qname" "$qtype" @10.53.0.3 > dig.out.test$n 3215 expire=$(awk '$4 == "RRSIG" { print $9 }' dig.out.test$n) 3216 inception=$(awk '$4 == "RRSIG" { print $10 }' dig.out.test$n) 3217 $PERL -e 'exit(0) if ("'"$time"'" lt "'"$expire"'" && "'"$time"'" gt "'"$inception"'"); exit(1);' || ret=1 3218 n=$((n+1)) 3219 test "$ret" -eq 0 || echo_i "failed" 3220 status=$((status+ret)) 3221 3222 echo_i "check that split rrsigs are handled ($n)" 3223 ret=0 3224 dig_with_opts split-rrsig soa @10.53.0.7 > dig.out.test$n || ret=1 3225 awk 'BEGIN { ok=0; } $4 == "SOA" { if ($7 > 1) ok=1; } END { if (!ok) exit(1); }' dig.out.test$n || ret=1 3226 n=$((n+1)) 3227 test "$ret" -eq 0 || echo_i "failed" 3228 status=$((status+ret)) 3229 3230 echo_i "check that 'dnssec-keygen -S' works for all supported algorithms ($n)" 3231 ret=0 3232 alg=1 3233 until test $alg -eq 256 3234 do 3235 zone="keygen-$alg." 3236 case $alg in 3237 2) # Diffie Helman 3238 alg=$((alg+1)) 3239 continue;; 3240 157|160|161|162|163|164|165) # private - non standard 3241 alg=$((alg+1)) 3242 continue;; 3243 1|5|7|8|10) # RSA algorithms 3244 key1=$($KEYGEN -a "$alg" -b "1024" -n zone "$zone" 2> "keygen-$alg.err" || true) 3245 ;; 3246 15|16) 3247 key1=$($KEYGEN -a "$alg" -n zone "$zone" 2> "keygen-$alg.err" || true) 3248 # Soft-fail in case HSM doesn't support Edwards curves 3249 if grep "not found" "keygen-$alg.err" > /dev/null && [ "$CRYPTO" = "pkcs11" ]; then 3250 echo_i "Algorithm $alg not supported by HSM: skipping" 3251 alg=$((alg+1)) 3252 continue 3253 fi 3254 ;; 3255 *) 3256 key1=$($KEYGEN -a "$alg" -n zone "$zone" 2> "keygen-$alg.err" || true) 3257 esac 3258 if grep "unsupported algorithm" "keygen-$alg.err" > /dev/null 3259 then 3260 alg=$((alg+1)) 3261 continue 3262 fi 3263 if test -z "$key1" 3264 then 3265 echo_i "'$KEYGEN -a $alg': failed" 3266 cat "keygen-$alg.err" 3267 ret=1 3268 alg=$((alg+1)) 3269 continue 3270 fi 3271 $SETTIME -I now+4d "$key1.private" > /dev/null 3272 key2=$($KEYGEN -v 10 -i 3d -S "$key1.private" 2> /dev/null) 3273 test -f "$key2.key" -a -f "$key2.private" || { 3274 ret=1 3275 echo_i "'dnssec-keygen -S' failed for algorithm: $alg" 3276 } 3277 alg=$((alg+1)) 3278 done 3279 n=$((n+1)) 3280 test "$ret" -eq 0 || echo_i "failed" 3281 status=$((status+ret)) 3282 3283 echo_i "check that CDS records are signed using KSK by dnssec-signzone ($n)" 3284 ret=0 3285 dig_with_opts +noall +answer @10.53.0.2 cds cds.secure > dig.out.test$n 3286 lines=$(awk '$4 == "RRSIG" && $5 == "CDS" {print}' dig.out.test$n | wc -l) 3287 test "$lines" -eq 2 || ret=1 3288 n=$((n+1)) 3289 test "$ret" -eq 0 || echo_i "failed" 3290 status=$((status+ret)) 3291 3292 echo_i "check that CDS records are not signed using ZSK by dnssec-signzone -x ($n)" 3293 ret=0 3294 dig_with_opts +noall +answer @10.53.0.2 cds cds-x.secure > dig.out.test$n 3295 lines=$(awk '$4 == "RRSIG" && $5 == "CDS" {print}' dig.out.test$n | wc -l) 3296 test "$lines" -eq 2 || ret=1 3297 n=$((n+1)) 3298 test "$ret" -eq 0 || echo_i "failed" 3299 status=$((status+ret)) 3300 3301 echo_i "checking that positive unknown NSEC3 hash algorithm does validate ($n)" 3302 ret=0 3303 dig_with_opts +noauth +noadd +nodnssec +adflag @10.53.0.3 nsec3-unknown.example SOA > dig.out.ns3.test$n 3304 dig_with_opts +noauth +noadd +nodnssec +adflag @10.53.0.4 nsec3-unknown.example SOA > dig.out.ns4.test$n 3305 grep "status: NOERROR," dig.out.ns3.test$n > /dev/null || ret=1 3306 grep "status: NOERROR," dig.out.ns4.test$n > /dev/null || ret=1 3307 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 3308 grep "ANSWER: 1," dig.out.ns4.test$n > /dev/null || ret=1 3309 n=$((n+1)) 3310 test "$ret" -eq 0 || echo_i "failed" 3311 status=$((status+ret)) 3312 3313 echo_i "check that CDS records are signed using KSK by with dnssec-auto ($n)" 3314 ret=0 3315 dig_with_opts +noall +answer @10.53.0.2 cds cds-auto.secure > dig.out.test$n 3316 lines=$(awk '$4 == "RRSIG" && $5 == "CDS" {print}' dig.out.test$n | wc -l) 3317 test "$lines" -eq 2 || ret=1 3318 n=$((n+1)) 3319 test "$ret" -eq 0 || echo_i "failed" 3320 status=$((status+ret)) 3321 3322 echo_i "check that a lone non matching CDS record is rejected ($n)" 3323 ret=0 3324 ( 3325 echo zone cds-update.secure 3326 echo server 10.53.0.2 "$PORT" 3327 echo update delete cds-update.secure CDS 3328 dig_with_opts +noall +answer @10.53.0.2 dnskey cds-update.secure | 3329 grep "DNSKEY.257" | sed 's/DNSKEY.257/DNSKEY 258/' | 3330 $DSFROMKEY -C -A -f - -T 1 cds-update.secure | 3331 sed "s/^/update add /" 3332 echo send 3333 ) | $NSUPDATE > nsupdate.out.test$n 2>&1 || true 3334 grep "update failed: REFUSED" nsupdate.out.test$n > /dev/null || ret=1 3335 dig_with_opts +noall +answer @10.53.0.2 cds cds-update.secure > dig.out.test$n 3336 lines=$(awk '$4 == "CDS" {print}' dig.out.test$n | wc -l) 3337 test "${lines:-10}" -eq 0 || ret=1 3338 n=$((n+1)) 3339 test "$ret" -eq 0 || echo_i "failed" 3340 status=$((status+ret)) 3341 3342 echo_i "check that a CDS deletion record is accepted ($n)" 3343 ret=0 3344 ( 3345 echo zone cds-update.secure 3346 echo server 10.53.0.2 "$PORT" 3347 echo update delete cds-update.secure CDS 3348 echo update add cds-update.secure 0 CDS 0 0 0 00 3349 echo send 3350 ) | $NSUPDATE > nsupdate.out.test$n 2>&1 3351 dig_with_opts +noall +answer @10.53.0.2 cds cds-update.secure > dig.out.test$n 3352 lines=$(awk '$4 == "CDS" {print}' dig.out.test$n | wc -l) 3353 test "${lines:-10}" -eq 1 || ret=1 3354 lines=$(tr -d '\r' < dig.out.test$n | awk '$4 == "CDS" && $5 == "0" && $6 == "0" && $7 == "0" && $8 == "00" {print}' | wc -l) 3355 test "$lines" -eq 1 || ret=1 3356 n=$((n+1)) 3357 test "$ret" -eq 0 || echo_i "failed" 3358 status=$((status+ret)) 3359 3360 echo_i "check that CDS records are signed using KSK when added by nsupdate ($n)" 3361 ret=0 3362 ( 3363 echo zone cds-update.secure 3364 echo server 10.53.0.2 "$PORT" 3365 echo update delete cds-update.secure CDS 3366 echo send 3367 dig_with_opts +noall +answer @10.53.0.2 dnskey cds-update.secure | 3368 grep "DNSKEY.257" | 3369 $DSFROMKEY -12 -C -f - -T 1 cds-update.secure | 3370 sed "s/^/update add /" 3371 echo send 3372 ) | $NSUPDATE 3373 dig_with_opts +noall +answer @10.53.0.2 cds cds-update.secure > dig.out.test$n 3374 lines=$(awk '$4 == "RRSIG" && $5 == "CDS" {print}' dig.out.test$n | wc -l) 3375 test "$lines" -eq 2 || ret=1 3376 lines=$(awk '$4 == "CDS" {print}' dig.out.test$n | wc -l) 3377 test "$lines" -eq 2 || ret=1 3378 n=$((n+1)) 3379 test "$ret" -eq 0 || echo_i "failed" 3380 status=$((status+ret)) 3381 3382 echo_i "check that CDS records are signed only using KSK when added by" 3383 echo_ic "nsupdate when dnssec-dnskey-kskonly is yes ($n)" 3384 ret=0 3385 keyid=$(cat ns2/cds-kskonly.secure.id) 3386 ( 3387 echo zone cds-kskonly.secure 3388 echo server 10.53.0.2 "$PORT" 3389 echo update delete cds-kskonly.secure CDS 3390 echo send 3391 dig_with_opts +noall +answer @10.53.0.2 dnskey cds-kskonly.secure | 3392 grep "DNSKEY.257" | 3393 $DSFROMKEY -12 -C -f - -T 1 cds-kskonly.secure | 3394 sed "s/^/update add /" 3395 echo send 3396 ) | $NSUPDATE 3397 dig_with_opts +noall +answer @10.53.0.2 cds cds-kskonly.secure > dig.out.test$n 3398 lines=$(awk '$4 == "RRSIG" && $5 == "CDS" {print}' dig.out.test$n | wc -l) 3399 test "$lines" -eq 1 || ret=1 3400 lines=$(awk -v id="${keyid}" '$4 == "RRSIG" && $5 == "CDS" && $11 == id {print}' dig.out.test$n | wc -l) 3401 test "$lines" -eq 1 || ret=1 3402 lines=$(awk '$4 == "CDS" {print}' dig.out.test$n | wc -l) 3403 test "$lines" -eq 2 || ret=1 3404 n=$((n+1)) 3405 test "$ret" -eq 0 || echo_i "failed" 3406 status=$((status+ret)) 3407 3408 echo_i "check that CDS deletion records are signed only using KSK when added by" 3409 echo_ic "nsupdate when dnssec-dnskey-kskonly is yes ($n)" 3410 ret=0 3411 keyid=$(cat ns2/cds-kskonly.secure.id) 3412 ( 3413 echo zone cds-kskonly.secure 3414 echo server 10.53.0.2 "$PORT" 3415 echo update delete cds-kskonly.secure CDS 3416 echo update add cds-kskonly.secure 0 CDS 0 0 0 00 3417 echo send 3418 ) | $NSUPDATE 3419 dig_with_opts +noall +answer @10.53.0.2 cds cds-kskonly.secure > dig.out.test$n 3420 lines=$(awk '$4 == "RRSIG" && $5 == "CDS" {print}' dig.out.test$n | wc -l) 3421 test "$lines" -eq 1 || ret=1 3422 lines=$(awk -v id="${keyid}" '$4 == "RRSIG" && $5 == "CDS" && $11 == id {print}' dig.out.test$n | wc -l) 3423 test "$lines" -eq 1 || ret=1 3424 lines=$(awk '$4 == "CDS" {print}' dig.out.test$n | wc -l) 3425 test "$lines" -eq 1 || ret=1 3426 lines=$(tr -d '\r' < dig.out.test$n | awk '$4 == "CDS" && $5 == "0" && $6 == "0" && $7 == "0" && $8 == "00" {print}' | wc -l) 3427 test "$lines" -eq 1 || ret=1 3428 n=$((n+1)) 3429 test "$ret" -eq 0 || echo_i "failed" 3430 status=$((status+ret)) 3431 3432 echo_i "checking that positive unknown NSEC3 hash algorithm with OPTOUT does validate ($n)" 3433 ret=0 3434 dig_with_opts +noauth +noadd +nodnssec +adflag @10.53.0.3 optout-unknown.example SOA > dig.out.ns3.test$n 3435 dig_with_opts +noauth +noadd +nodnssec +adflag @10.53.0.4 optout-unknown.example SOA > dig.out.ns4.test$n 3436 grep "status: NOERROR," dig.out.ns3.test$n > /dev/null || ret=1 3437 grep "status: NOERROR," dig.out.ns4.test$n > /dev/null || ret=1 3438 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 3439 grep "ANSWER: 1," dig.out.ns4.test$n > /dev/null || ret=1 3440 n=$((n+1)) 3441 test "$ret" -eq 0 || echo_i "failed" 3442 status=$((status+ret)) 3443 3444 echo_i "check that a non matching CDS record is accepted with a matching CDS record ($n)" 3445 ret=0 3446 ( 3447 echo zone cds-update.secure 3448 echo server 10.53.0.2 "$PORT" 3449 echo update delete cds-update.secure CDS 3450 echo send 3451 dig_with_opts +noall +answer @10.53.0.2 dnskey cds-update.secure | 3452 grep "DNSKEY.257" | 3453 $DSFROMKEY -12 -C -f - -T 1 cds-update.secure | 3454 sed "s/^/update add /" 3455 dig_with_opts +noall +answer @10.53.0.2 dnskey cds-update.secure | 3456 grep "DNSKEY.257" | sed 's/DNSKEY.257/DNSKEY 258/' | 3457 $DSFROMKEY -12 -C -A -f - -T 1 cds-update.secure | 3458 sed "s/^/update add /" 3459 echo send 3460 ) | $NSUPDATE 3461 dig_with_opts +noall +answer @10.53.0.2 cds cds-update.secure > dig.out.test$n 3462 lines=$(awk '$4 == "RRSIG" && $5 == "CDS" {print}' dig.out.test$n | wc -l) 3463 test "$lines" -eq 2 || ret=1 3464 lines=$(awk '$4 == "CDS" {print}' dig.out.test$n | wc -l) 3465 test "$lines" -eq 4 || ret=1 3466 n=$((n+1)) 3467 test "$ret" -eq 0 || echo_i "failed" 3468 status=$((status+ret)) 3469 3470 echo_i "checking that negative unknown NSEC3 hash algorithm does not validate ($n)" 3471 ret=0 3472 dig_with_opts +noauth +noadd +nodnssec +adflag @10.53.0.3 nsec3-unknown.example A > dig.out.ns3.test$n 3473 dig_with_opts +noauth +noadd +nodnssec +adflag @10.53.0.4 nsec3-unknown.example A > dig.out.ns4.test$n 3474 grep "status: NOERROR," dig.out.ns3.test$n > /dev/null || ret=1 3475 grep "status: SERVFAIL," dig.out.ns4.test$n > /dev/null || ret=1 3476 n=$((n+1)) 3477 test "$ret" -eq 0 || echo_i "failed" 3478 status=$((status+ret)) 3479 3480 echo_i "check that CDNSKEY records are signed using KSK by dnssec-signzone ($n)" 3481 ret=0 3482 dig_with_opts +noall +answer @10.53.0.2 cdnskey cdnskey.secure > dig.out.test$n 3483 lines=$(awk '$4 == "RRSIG" && $5 == "CDNSKEY" {print}' dig.out.test$n | wc -l) 3484 test "$lines" -eq 2 || ret=1 3485 n=$((n+1)) 3486 test "$ret" -eq 0 || echo_i "failed" 3487 status=$((status+ret)) 3488 3489 echo_i "check that CDNSKEY records are not signed using ZSK by dnssec-signzone -x ($n)" 3490 ret=0 3491 dig_with_opts +noall +answer @10.53.0.2 cdnskey cdnskey-x.secure > dig.out.test$n 3492 lines=$(awk '$4 == "RRSIG" && $5 == "CDNSKEY" {print}' dig.out.test$n | wc -l) 3493 test "$lines" -eq 2 || ret=1 3494 n=$((n+1)) 3495 test "$ret" -eq 0 || echo_i "failed" 3496 status=$((status+ret)) 3497 3498 echo_i "checking that negative unknown NSEC3 hash algorithm with OPTOUT does not validate ($n)" 3499 ret=0 3500 dig_with_opts +noauth +noadd +nodnssec +adflag @10.53.0.3 optout-unknown.example A > dig.out.ns3.test$n 3501 dig_with_opts +noauth +noadd +nodnssec +adflag @10.53.0.4 optout-unknown.example A > dig.out.ns4.test$n 3502 grep "status: NOERROR," dig.out.ns3.test$n > /dev/null || ret=1 3503 grep "status: SERVFAIL," dig.out.ns4.test$n > /dev/null || ret=1 3504 n=$((n+1)) 3505 test "$ret" -eq 0 || echo_i "failed" 3506 status=$((status+ret)) 3507 3508 echo_i "check that CDNSKEY records are signed using KSK by with dnssec-auto ($n)" 3509 ret=0 3510 dig_with_opts +noall +answer @10.53.0.2 cdnskey cdnskey-auto.secure > dig.out.test$n 3511 lines=$(awk '$4 == "RRSIG" && $5 == "CDNSKEY" {print}' dig.out.test$n | wc -l) 3512 test "$lines" -eq 2 || ret=1 3513 n=$((n+1)) 3514 test "$ret" -eq 0 || echo_i "failed" 3515 status=$((status+ret)) 3516 3517 echo_i "checking that unknown DNSKEY algorithm validates as insecure ($n)" 3518 ret=0 3519 dig_with_opts +noauth +noadd +nodnssec +adflag @10.53.0.3 dnskey-unknown.example A > dig.out.ns3.test$n 3520 dig_with_opts +noauth +noadd +nodnssec +adflag @10.53.0.4 dnskey-unknown.example A > dig.out.ns4.test$n 3521 grep "status: NOERROR," dig.out.ns3.test$n > /dev/null || ret=1 3522 grep "status: NOERROR," dig.out.ns4.test$n > /dev/null || ret=1 3523 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 3524 n=$((n+1)) 3525 test "$ret" -eq 0 || echo_i "failed" 3526 status=$((status+ret)) 3527 3528 echo_i "checking that unsupported DNSKEY algorithm validates as insecure ($n)" 3529 ret=0 3530 dig_with_opts +noauth +noadd +nodnssec +adflag @10.53.0.3 dnskey-unsupported.example A > dig.out.ns3.test$n 3531 dig_with_opts +noauth +noadd +nodnssec +adflag @10.53.0.4 dnskey-unsupported.example A > dig.out.ns4.test$n 3532 grep "status: NOERROR," dig.out.ns3.test$n > /dev/null || ret=1 3533 grep "status: NOERROR," dig.out.ns4.test$n > /dev/null || ret=1 3534 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 3535 n=$((n+1)) 3536 test "$ret" -eq 0 || echo_i "failed" 3537 status=$((status+ret)) 3538 3539 echo_i "checking that unsupported DNSKEY algorithm is in DNSKEY RRset ($n)" 3540 ret=0 3541 dig_with_opts +noauth +noadd +nodnssec +adflag @10.53.0.3 dnskey-unsupported-2.example DNSKEY > dig.out.test$n 3542 grep "status: NOERROR," dig.out.test$n > /dev/null || ret=1 3543 grep "dnskey-unsupported-2\.example\..*IN.*DNSKEY.*257 3 255" dig.out.test$n > /dev/null || ret=1 3544 n=$((n+1)) 3545 test "$ret" -eq 0 || echo_i "failed" 3546 status=$((status+ret)) 3547 3548 # TODO: test case for GL #1689. 3549 # If we allow the dnssec tools to use deprecated algorithms (such as RSAMD5) 3550 # we could write a test that signs a zone with supported and unsupported 3551 # algorithm, apply a fixed rrset order such that the unsupported algorithm 3552 # precedes the supported one in the DNSKEY RRset, and verify the result still 3553 # validates succesfully. 3554 3555 echo_i "check that a lone non matching CDNSKEY record is rejected ($n)" 3556 ret=0 3557 ( 3558 echo zone cdnskey-update.secure 3559 echo server 10.53.0.2 "$PORT" 3560 echo update delete cdnskey-update.secure CDNSKEY 3561 echo send 3562 dig_with_opts +noall +answer @10.53.0.2 dnskey cdnskey-update.secure | 3563 sed -n -e "s/^/update add /" -e 's/DNSKEY.257/CDNSKEY 258/p' 3564 echo send 3565 ) | $NSUPDATE > nsupdate.out.test$n 2>&1 || true 3566 grep "update failed: REFUSED" nsupdate.out.test$n > /dev/null || ret=1 3567 dig_with_opts +noall +answer @10.53.0.2 cdnskey cdnskey-update.secure > dig.out.test$n 3568 lines=$(awk '$4 == "CDNSKEY" {print}' dig.out.test$n | wc -l) 3569 test "${lines:-10}" -eq 0 || ret=1 3570 n=$((n+1)) 3571 test "$ret" -eq 0 || echo_i "failed" 3572 status=$((status+ret)) 3573 3574 echo_i "check that a CDNSKEY deletion record is accepted ($n)" 3575 ret=0 3576 ( 3577 echo zone cdnskey-update.secure 3578 echo server 10.53.0.2 "$PORT" 3579 echo update delete cdnskey-update.secure CDNSKEY 3580 echo update add cdnskey-update.secure 0 CDNSKEY 0 3 0 AA== 3581 echo send 3582 ) | $NSUPDATE > nsupdate.out.test$n 2>&1 3583 dig_with_opts +noall +answer @10.53.0.2 cdnskey cdnskey-update.secure > dig.out.test$n 3584 lines=$(awk '$4 == "CDNSKEY" {print}' dig.out.test$n | wc -l) 3585 test "${lines:-10}" -eq 1 || ret=1 3586 lines=$(tr -d '\r' < dig.out.test$n | awk '$4 == "CDNSKEY" && $5 == "0" && $6 == "3" && $7 == "0" && $8 == "AA==" {print}' | wc -l) 3587 test "${lines:-10}" -eq 1 || ret=1 3588 n=$((n+1)) 3589 test "$ret" -eq 0 || echo_i "failed" 3590 status=$((status+ret)) 3591 3592 echo_i "checking that unknown DNSKEY algorithm + unknown NSEC3 has algorithm validates as insecure ($n)" 3593 ret=0 3594 dig_with_opts +noauth +noadd +nodnssec +adflag @10.53.0.3 dnskey-nsec3-unknown.example A > dig.out.ns3.test$n 3595 dig_with_opts +noauth +noadd +nodnssec +adflag @10.53.0.4 dnskey-nsec3-unknown.example A > dig.out.ns4.test$n 3596 grep "status: NOERROR," dig.out.ns3.test$n > /dev/null || ret=1 3597 grep "status: NOERROR," dig.out.ns4.test$n > /dev/null || ret=1 3598 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1 3599 n=$((n+1)) 3600 test "$ret" -eq 0 || echo_i "failed" 3601 status=$((status+ret)) 3602 3603 echo_i "check that CDNSKEY records are signed using KSK when added by nsupdate ($n)" 3604 ret=0 3605 ( 3606 echo zone cdnskey-update.secure 3607 echo server 10.53.0.2 "$PORT" 3608 echo update delete cdnskey-update.secure CDNSKEY 3609 dig_with_opts +noall +answer @10.53.0.2 dnskey cdnskey-update.secure | 3610 sed -n -e "s/^/update add /" -e 's/DNSKEY.257/CDNSKEY 257/p' 3611 echo send 3612 ) | $NSUPDATE 3613 dig_with_opts +noall +answer @10.53.0.2 cdnskey cdnskey-update.secure > dig.out.test$n 3614 lines=$(awk '$4 == "RRSIG" && $5 == "CDNSKEY" {print}' dig.out.test$n | wc -l) 3615 test "$lines" -eq 2 || ret=1 3616 lines=$(awk '$4 == "CDNSKEY" {print}' dig.out.test$n | wc -l) 3617 test "$lines" -eq 1 || ret=1 3618 n=$((n+1)) 3619 test "$ret" -eq 0 || echo_i "failed" 3620 status=$((status+ret)) 3621 3622 echo_i "check that CDNSKEY records are signed only using KSK when added by" 3623 echo_ic "nsupdate when dnssec-dnskey-kskonly is yes ($n)" 3624 ret=0 3625 keyid=$(cat ns2/cdnskey-kskonly.secure.id) 3626 ( 3627 echo zone cdnskey-kskonly.secure 3628 echo server 10.53.0.2 "$PORT" 3629 echo update delete cdnskey-kskonly.secure CDNSKEY 3630 dig_with_opts +noall +answer @10.53.0.2 dnskey cdnskey-kskonly.secure | 3631 sed -n -e "s/^/update add /" -e 's/DNSKEY.257/CDNSKEY 257/p' 3632 echo send 3633 ) | $NSUPDATE 3634 dig_with_opts +noall +answer @10.53.0.2 cdnskey cdnskey-kskonly.secure > dig.out.test$n 3635 lines=$(awk '$4 == "RRSIG" && $5 == "CDNSKEY" {print}' dig.out.test$n | wc -l) 3636 test "$lines" -eq 1 || ret=1 3637 lines=$(awk -v id="${keyid}" '$4 == "RRSIG" && $5 == "CDNSKEY" && $11 == id {print}' dig.out.test$n | wc -l) 3638 test "$lines" -eq 1 || ret=1 3639 lines=$(awk '$4 == "CDNSKEY" {print}' dig.out.test$n | wc -l) 3640 test "$lines" -eq 1 || ret=1 3641 n=$((n+1)) 3642 test "$ret" -eq 0 || echo_i "failed" 3643 status=$((status+ret)) 3644 3645 echo_i "check that CDNSKEY deletion records are signed only using KSK when added by" 3646 echo_ic "nsupdate when dnssec-dnskey-kskonly is yes ($n)" 3647 ret=0 3648 keyid=$(cat ns2/cdnskey-kskonly.secure.id) 3649 ( 3650 echo zone cdnskey-kskonly.secure 3651 echo server 10.53.0.2 "$PORT" 3652 echo update delete cdnskey-kskonly.secure CDNSKEY 3653 echo update add cdnskey-kskonly.secure 0 CDNSKEY 0 3 0 AA== 3654 echo send 3655 ) | $NSUPDATE 3656 dig_with_opts +noall +answer @10.53.0.2 cdnskey cdnskey-kskonly.secure > dig.out.test$n 3657 lines=$(awk '$4 == "RRSIG" && $5 == "CDNSKEY" {print}' dig.out.test$n | wc -l) 3658 test "$lines" -eq 1 || ret=1 3659 lines=$(awk -v id="${keyid}" '$4 == "RRSIG" && $5 == "CDNSKEY" && $11 == id {print}' dig.out.test$n | wc -l) 3660 test "$lines" -eq 1 || ret=1 3661 lines=$(awk '$4 == "CDNSKEY" {print}' dig.out.test$n | wc -l) 3662 test "$lines" -eq 1 || ret=1 3663 lines=$(tr -d '\r' < dig.out.test$n | awk '$4 == "CDNSKEY" && $5 == "0" && $6 == "3" && $7 == "0" && $8 == "AA==" {print}' | wc -l) 3664 test "${lines:-10}" -eq 1 || ret=1 3665 n=$((n+1)) 3666 test "$ret" -eq 0 || echo_i "failed" 3667 status=$((status+ret)) 3668 3669 echo_i "checking initialization with a revoked managed key ($n)" 3670 ret=0 3671 copy_setports ns5/named2.conf.in ns5/named.conf 3672 rndccmd 10.53.0.5 reconfig 2>&1 | sed 's/^/ns5 /' | cat_i 3673 sleep 3 3674 dig_with_opts +dnssec @10.53.0.5 SOA . > dig.out.ns5.test$n 3675 grep "status: SERVFAIL" dig.out.ns5.test$n > /dev/null || ret=1 3676 n=$((n+1)) 3677 test "$ret" -eq 0 || echo_i "failed" 3678 status=$((status+ret)) 3679 3680 echo_i "check that a non matching CDNSKEY record is accepted with a matching CDNSKEY record ($n)" 3681 ret=0 3682 ( 3683 echo zone cdnskey-update.secure 3684 echo server 10.53.0.2 "$PORT" 3685 echo update delete cdnskey-update.secure CDNSKEY 3686 dig_with_opts +noall +answer @10.53.0.2 dnskey cdnskey-update.secure | 3687 sed -n -e "s/^/update add /" -e 's/DNSKEY.257/CDNSKEY 257/p' 3688 dig_with_opts +noall +answer @10.53.0.2 dnskey cdnskey-update.secure | 3689 sed -n -e "s/^/update add /" -e 's/DNSKEY.257/CDNSKEY 258/p' 3690 echo send 3691 ) | $NSUPDATE 3692 dig_with_opts +noall +answer @10.53.0.2 cdnskey cdnskey-update.secure > dig.out.test$n 3693 lines=$(awk '$4 == "RRSIG" && $5 == "CDNSKEY" {print}' dig.out.test$n | wc -l) 3694 test "$lines" -eq 2 || ret=1 3695 lines=$(awk '$4 == "CDNSKEY" {print}' dig.out.test$n | wc -l) 3696 test "$lines" -eq 2 || ret=1 3697 n=$((n+1)) 3698 test "$ret" -eq 0 || echo_i "failed" 3699 status=$((status+ret)) 3700 3701 echo_i "check that RRSIGs are correctly removed from apex when RRset is removed NSEC ($n)" 3702 ret=0 3703 # generate signed zone with MX and AAAA records at apex. 3704 ( 3705 cd signer || exit 1 3706 $KEYGEN -q -a RSASHA1 -3 -fK remove > /dev/null 3707 $KEYGEN -q -a RSASHA1 -33 remove > /dev/null 3708 echo > remove.db.signed 3709 $SIGNER -S -o remove -D -f remove.db.signed remove.db.in > signer.out.1.$n 3710 ) 3711 grep "RRSIG MX" signer/remove.db.signed > /dev/null || { 3712 ret=1 ; cp signer/remove.db.signed signer/remove.db.signed.pre$n; 3713 } 3714 # re-generate signed zone without MX and AAAA records at apex. 3715 ( 3716 cd signer || exit 1 3717 $SIGNER -S -o remove -D -f remove.db.signed remove2.db.in > signer.out.2.$n 3718 ) 3719 grep "RRSIG MX" signer/remove.db.signed > /dev/null && { 3720 ret=1 ; cp signer/remove.db.signed signer/remove.db.signed.post$n; 3721 } 3722 n=$((n+1)) 3723 test "$ret" -eq 0 || echo_i "failed" 3724 status=$((status+ret)) 3725 3726 echo_i "check that RRSIGs are correctly removed from apex when RRset is removed NSEC3 ($n)" 3727 ret=0 3728 # generate signed zone with MX and AAAA records at apex. 3729 ( 3730 cd signer || exit 1 3731 echo > remove.db.signed 3732 $SIGNER -3 - -S -o remove -D -f remove.db.signed remove.db.in > signer.out.1.$n 3733 ) 3734 grep "RRSIG MX" signer/remove.db.signed > /dev/null || { 3735 ret=1 ; cp signer/remove.db.signed signer/remove.db.signed.pre$n; 3736 } 3737 # re-generate signed zone without MX and AAAA records at apex. 3738 ( 3739 cd signer || exit 1 3740 $SIGNER -3 - -S -o remove -D -f remove.db.signed remove2.db.in > signer.out.2.$n 3741 ) 3742 grep "RRSIG MX" signer/remove.db.signed > /dev/null && { 3743 ret=1 ; cp signer/remove.db.signed signer/remove.db.signed.post$n; 3744 } 3745 n=$((n+1)) 3746 test "$ret" -eq 0 || echo_i "failed" 3747 status=$((status+ret)) 3748 3749 echo_i "check that a named managed zone that was signed 'in-the-future' is re-signed when loaded ($n)" 3750 ret=0 3751 dig_with_opts managed-future.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1 3752 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1 3753 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 3754 n=$((n+1)) 3755 test "$ret" -eq 0 || echo_i "failed" 3756 status=$((status+ret)) 3757 3758 echo_i "check that trust-anchor-telemetry queries are logged ($n)" 3759 ret=0 3760 grep "sending trust-anchor-telemetry query '_ta-[0-9a-f]*/NULL" ns6/named.run > /dev/null || ret=1 3761 n=$((n+1)) 3762 test "$ret" -eq 0 || echo_i "failed" 3763 status=$((status+ret)) 3764 3765 echo_i "check that _ta-XXXX trust-anchor-telemetry queries are logged ($n)" 3766 ret=0 3767 grep "trust-anchor-telemetry '_ta-[0-9a-f]*/IN' from" ns1/named.run > /dev/null || ret=1 3768 n=$((n+1)) 3769 test "$ret" -eq 0 || echo_i "failed" 3770 status=$((status+ret)) 3771 3772 echo_i "check that _ta-AAAA trust-anchor-telemetry are not sent when disabled ($n)" 3773 ret=0 3774 grep "sending trust-anchor-telemetry query '_ta-[0-9a-f]*/IN" ns1/named.run > /dev/null && ret=1 3775 n=$((n+1)) 3776 test "$ret" -eq 0 || echo_i "failed" 3777 status=$((status+ret)) 3778 3779 echo_i "check that KEY-TAG trust-anchor-telemetry queries are logged ($n)" 3780 ret=0 3781 dig_with_opts . dnskey +ednsopt=KEY-TAG:ffff @10.53.0.1 > dig.out.ns1.test$n || ret=1 3782 grep "trust-anchor-telemetry './IN' from .* 65535" ns1/named.run > /dev/null || ret=1 3783 n=$((n+1)) 3784 test "$ret" -eq 0 || echo_i "failed" 3785 status=$((status+ret)) 3786 3787 echo_i "check that multiple KEY-TAG trust-anchor-telemetry options don't leak memory ($n)" 3788 ret=0 3789 dig_with_opts . dnskey +ednsopt=KEY-TAG:fffe +ednsopt=KEY-TAG:fffd @10.53.0.1 > dig.out.ns1.test$n || ret=1 3790 grep "trust-anchor-telemetry './IN' from .* 65534" ns1/named.run > /dev/null || ret=1 3791 grep "trust-anchor-telemetry './IN' from .* 65533" ns1/named.run > /dev/null && ret=1 3792 $PERL $SYSTEMTESTTOP/stop.pl dnssec ns1 || ret=1 3793 nextpart ns1/named.run > /dev/null 3794 $PERL $SYSTEMTESTTOP/start.pl --noclean --restart --port ${PORT} dnssec ns1 || ret=1 3795 n=$(($n+1)) 3796 test "$ret" -eq 0 || echo_i "failed" 3797 status=$((status+ret)) 3798 3799 echo_i "waiting for root server to finish reloading ($n)" 3800 ret=0 3801 wait_for_log 20 "all zones loaded" ns1/named.run || ret=1 3802 n=$(($n+1)) 3803 test "$ret" -eq 0 || echo_i "failed" 3804 status=$((status+ret)) 3805 3806 echo_i "check that the view is logged in messages from the validator when using views ($n)" 3807 ret=0 3808 grep "view rec: *validat" ns4/named.run > /dev/null || ret=1 3809 n=$((n+1)) 3810 test "$ret" -eq 0 || echo_i "failed" 3811 status=$((status+ret)) 3812 3813 echo_i "check that DNAME at apex with NSEC3 is correctly signed (dnssec-signzone) ($n)" 3814 ret=0 3815 dig_with_opts txt dname-at-apex-nsec3.example @10.53.0.3 > dig.out.ns3.test$n || ret=1 3816 grep "RRSIG.NSEC3 ${DEFAULT_ALGORITHM_NUMBER} 3 3600" dig.out.ns3.test$n > /dev/null || ret=1 3817 n=$((n+1)) 3818 test "$ret" -eq 0 || echo_i "failed" 3819 status=$((status+ret)) 3820 3821 echo_i "check that DNSKEY and other occluded data are excluded from the delegating bitmap ($n)" 3822 ret=0 3823 dig_with_opts axfr occluded.example @10.53.0.3 > dig.out.ns3.test$n || ret=1 3824 grep "^delegation.occluded.example..*NSEC.*NS KEY DS RRSIG NSEC$" dig.out.ns3.test$n > /dev/null || ret=1 3825 grep "^delegation.occluded.example..*DNSKEY.*" dig.out.ns3.test$n > /dev/null || ret=1 3826 grep "^delegation.occluded.example..*AAAA.*" dig.out.ns3.test$n > /dev/null || ret=1 3827 n=$((n+1)) 3828 test "$ret" -eq 0 || echo_i "failed" 3829 status=$((status+ret)) 3830 3831 echo_i "checking DNSSEC records are occluded from ANY in an insecure zone ($n)" 3832 ret=0 3833 dig_with_opts any x.insecure.example. @10.53.0.3 > dig.out.ns3.1.test$n || ret=1 3834 grep "status: NOERROR" dig.out.ns3.1.test$n > /dev/null || ret=1 3835 grep "ANSWER: 0," dig.out.ns3.1.test$n > /dev/null || ret=1 3836 dig_with_opts any zz.secure.example. @10.53.0.3 > dig.out.ns3.2.test$n || ret=1 3837 grep "status: NOERROR" dig.out.ns3.2.test$n > /dev/null || ret=1 3838 # DNSKEY+RRSIG, NSEC+RRSIG 3839 grep "ANSWER: 4," dig.out.ns3.2.test$n > /dev/null || ret=1 3840 n=$((n+1)) 3841 test "$ret" -eq 0 || echo_i "failed" 3842 status=$((status+ret)) 3843 3844 # 3845 # DNSSEC tests related to unsupported, disabled and revoked trust anchors. 3846 # 3847 3848 # This nameserver (ns8) is loaded with a bunch of trust anchors. Some of 3849 # them are good (enabled.managed, enabled.trusted, secure.managed, 3850 # secure.trusted), and some of them are bad (disabled.managed, 3851 # revoked.managed, unsupported.managed, disabled.trusted, revoked.trusted, 3852 # unsupported.trusted). Make sure that the bad trust anchors are ignored. 3853 # This is tested by looking for the corresponding lines in the logfile. 3854 echo_i "checking that keys with unsupported algorithms and disabled algorithms are ignored ($n)" 3855 ret=0 3856 grep -q "ignoring static-key for 'disabled\.trusted\.': algorithm is disabled" ns8/named.run || ret=1 3857 grep -q "ignoring static-key for 'unsupported\.trusted\.': algorithm is unsupported" ns8/named.run || ret=1 3858 grep -q "ignoring static-key for 'revoked\.trusted\.': bad key type" ns8/named.run || ret=1 3859 grep -q "ignoring initial-key for 'disabled\.managed\.': algorithm is disabled" ns8/named.run || ret=1 3860 grep -q "ignoring initial-key for 'unsupported\.managed\.': algorithm is unsupported" ns8/named.run || ret=1 3861 grep -q "ignoring initial-key for 'revoked\.managed\.': bad key type" ns8/named.run || ret=1 3862 n=$((n+1)) 3863 test "$ret" -eq 0 || echo_i "failed" 3864 status=$((status+ret)) 3865 3866 # The next two tests are fairly normal DNSSEC queries to signed zones with a 3867 # default algorithm. First, a query is made against the server that is 3868 # authoritative for the given zone (ns3). Second, a query is made against a 3869 # resolver with trust anchors for the given zone (ns8). Both are expected to 3870 # return an authentic data positive response. 3871 echo_i "checking that a trusted key using a supported algorithm validates as secure ($n)" 3872 ret=0 3873 dig_with_opts @10.53.0.3 a.secure.trusted A > dig.out.ns3.test$n 3874 dig_with_opts @10.53.0.8 a.secure.trusted A > dig.out.ns8.test$n 3875 grep "status: NOERROR," dig.out.ns3.test$n > /dev/null || ret=1 3876 grep "status: NOERROR," dig.out.ns8.test$n > /dev/null || ret=1 3877 grep "flags:.*ad.*QUERY" dig.out.ns8.test$n > /dev/null || ret=1 3878 n=$((n+1)) 3879 test "$ret" -eq 0 || echo_i "failed" 3880 status=$((status+ret)) 3881 3882 echo_i "checking that a managed key using a supported algorithm validates as secure ($n)" 3883 ret=0 3884 dig_with_opts @10.53.0.3 a.secure.managed A > dig.out.ns3.test$n 3885 dig_with_opts @10.53.0.8 a.secure.managed A > dig.out.ns8.test$n 3886 grep "status: NOERROR," dig.out.ns3.test$n > /dev/null || ret=1 3887 grep "status: NOERROR," dig.out.ns8.test$n > /dev/null || ret=1 3888 grep "flags:.*ad.*QUERY" dig.out.ns8.test$n > /dev/null || ret=1 3889 n=$((n+1)) 3890 test "$ret" -eq 0 || echo_i "failed" 3891 status=$((status+ret)) 3892 3893 # The next two queries ensure that a zone signed with a DNSKEY with an unsupported 3894 # algorithm will yield insecure positive responses. These trust anchors in ns8 are 3895 # ignored and so this domain is treated as insecure. The AD bit should not be set 3896 # in the response. 3897 echo_i "checking that a trusted key using an unsupported algorithm validates as insecure ($n)" 3898 ret=0 3899 dig_with_opts @10.53.0.3 a.unsupported.trusted A > dig.out.ns3.test$n 3900 dig_with_opts @10.53.0.8 a.unsupported.trusted A > dig.out.ns8.test$n 3901 grep "status: NOERROR," dig.out.ns3.test$n > /dev/null || ret=1 3902 grep "status: NOERROR," dig.out.ns8.test$n > /dev/null || ret=1 3903 grep "flags:.*ad.*QUERY" dig.out.ns8.test$n > /dev/null && ret=1 3904 n=$((n+1)) 3905 test "$ret" -eq 0 || echo_i "failed" 3906 status=$((status+ret)) 3907 3908 echo_i "checking that a managed key using an unsupported algorithm validates as insecure ($n)" 3909 ret=0 3910 dig_with_opts @10.53.0.3 a.unsupported.managed A > dig.out.ns3.test$n 3911 dig_with_opts @10.53.0.8 a.unsupported.managed A > dig.out.ns8.test$n 3912 grep "status: NOERROR," dig.out.ns3.test$n > /dev/null || ret=1 3913 grep "status: NOERROR," dig.out.ns8.test$n > /dev/null || ret=1 3914 grep "flags:.*ad.*QUERY" dig.out.ns8.test$n > /dev/null && ret=1 3915 n=$((n+1)) 3916 test "$ret" -eq 0 || echo_i "failed" 3917 status=$((status+ret)) 3918 3919 # The next two queries ensure that a zone signed with a DNSKEY that the nameserver 3920 # has a disabled algorithm match for will yield insecure positive responses. 3921 # These trust anchors in ns8 are ignored and so this domain is treated as insecure. 3922 # The AD bit should not be set in the response. 3923 echo_i "checking that a trusted key using a disabled algorithm validates as insecure ($n)" 3924 ret=0 3925 dig_with_opts @10.53.0.3 a.disabled.trusted A > dig.out.ns3.test$n 3926 dig_with_opts @10.53.0.8 a.disabled.trusted A > dig.out.ns8.test$n 3927 grep "status: NOERROR," dig.out.ns3.test$n > /dev/null || ret=1 3928 grep "status: NOERROR," dig.out.ns8.test$n > /dev/null || ret=1 3929 grep "flags:.*ad.*QUERY" dig.out.ns8.test$n > /dev/null && ret=1 3930 n=$((n+1)) 3931 test "$ret" -eq 0 || echo_i "failed" 3932 status=$((status+ret)) 3933 3934 echo_i "checking that a managed key using a disabled algorithm validates as insecure ($n)" 3935 ret=0 3936 dig_with_opts @10.53.0.3 a.disabled.managed A > dig.out.ns3.test$n 3937 dig_with_opts @10.53.0.8 a.disabled.managed A > dig.out.ns8.test$n 3938 grep "status: NOERROR," dig.out.ns3.test$n > /dev/null || ret=1 3939 grep "status: NOERROR," dig.out.ns8.test$n > /dev/null || ret=1 3940 grep "flags:.*ad.*QUERY" dig.out.ns8.test$n > /dev/null && ret=1 3941 n=$((n+1)) 3942 test "$ret" -eq 0 || echo_i "failed" 3943 status=$((status+ret)) 3944 3945 # The next two queries ensure that a zone signed with a DNSKEY that the 3946 # nameserver has a disabled algorithm for, but for a different domain, will 3947 # yield secure positive responses. Since "enabled.trusted." and 3948 # "enabled.managed." do not match the "disable-algorithms" option, no 3949 # special rules apply and these zones should validate as secure, with the AD 3950 # bit set. 3951 echo_i "checking that a trusted key using an algorithm disabled for another domain validates as secure ($n)" 3952 ret=0 3953 dig_with_opts @10.53.0.3 a.enabled.trusted A > dig.out.ns3.test$n 3954 dig_with_opts @10.53.0.8 a.enabled.trusted A > dig.out.ns8.test$n 3955 grep "status: NOERROR," dig.out.ns3.test$n > /dev/null || ret=1 3956 grep "status: NOERROR," dig.out.ns8.test$n > /dev/null || ret=1 3957 grep "flags:.*ad.*QUERY" dig.out.ns8.test$n > /dev/null || ret=1 3958 n=$((n+1)) 3959 test "$ret" -eq 0 || echo_i "failed" 3960 status=$((status+ret)) 3961 3962 echo_i "checking that a managed key using an algorithm disabled for another domain validates as secure ($n)" 3963 ret=0 3964 dig_with_opts @10.53.0.3 a.enabled.managed A > dig.out.ns3.test$n 3965 dig_with_opts @10.53.0.8 a.enabled.managed A > dig.out.ns8.test$n 3966 grep "status: NOERROR," dig.out.ns3.test$n > /dev/null || ret=1 3967 grep "status: NOERROR," dig.out.ns8.test$n > /dev/null || ret=1 3968 grep "flags:.*ad.*QUERY" dig.out.ns8.test$n > /dev/null || ret=1 3969 n=$((n+1)) 3970 test "$ret" -eq 0 || echo_i "failed" 3971 status=$((status+ret)) 3972 3973 # A configured revoked trust anchor is ignored and thus the two queries below 3974 # should result in insecure responses, since no trust points for the 3975 # "revoked.trusted." and "revoked.managed." zones are created. 3976 echo_i "checking that a trusted key that is revoked validates as insecure ($n)" 3977 ret=0 3978 dig_with_opts @10.53.0.3 a.revoked.trusted A > dig.out.ns3.test$n 3979 dig_with_opts @10.53.0.8 a.revoked.trusted A > dig.out.ns8.test$n 3980 grep "status: NOERROR," dig.out.ns3.test$n > /dev/null || ret=1 3981 grep "status: NOERROR," dig.out.ns8.test$n > /dev/null || ret=1 3982 grep "flags:.*ad.*QUERY" dig.out.ns8.test$n > /dev/null && ret=1 3983 n=$((n+1)) 3984 test "$ret" -eq 0 || echo_i "failed" 3985 status=$((status+ret)) 3986 3987 echo_i "checking that a managed key that is revoked validates as insecure ($n)" 3988 ret=0 3989 dig_with_opts @10.53.0.3 a.revoked.managed A > dig.out.ns3.test$n 3990 dig_with_opts @10.53.0.8 a.revoked.managed A > dig.out.ns8.test$n 3991 grep "status: NOERROR," dig.out.ns3.test$n > /dev/null || ret=1 3992 grep "status: NOERROR," dig.out.ns8.test$n > /dev/null || ret=1 3993 grep "flags:.*ad.*QUERY" dig.out.ns8.test$n > /dev/null && ret=1 3994 n=$((n+1)) 3995 test "$ret" -eq 0 || echo_i "failed" 3996 status=$((status+ret)) 3997 3998 ### 3999 ### Additional checks for when the KSK is offline. 4000 ### 4001 4002 # Save some useful information 4003 zone="updatecheck-kskonly.secure" 4004 KSK=`cat ns2/${zone}.ksk.key` 4005 ZSK=`cat ns2/${zone}.zsk.key` 4006 KSK_ID=`cat ns2/${zone}.ksk.id` 4007 ZSK_ID=`cat ns2/${zone}.zsk.id` 4008 SECTIONS="+answer +noauthority +noadditional" 4009 echo_i "testing zone $zone KSK=$KSK_ID ZSK=$ZSK_ID" 4010 4011 # Print IDs of keys used for generating RRSIG records for RRsets of type $1 4012 # found in dig output file $2. 4013 get_keys_which_signed() { 4014 qtype=$1 4015 output=$2 4016 # The key ID is the 11th column of the RRSIG record line. 4017 awk -v qt="$qtype" '$4 == "RRSIG" && $5 == qt {print $11}' < "$output" 4018 } 4019 4020 # Basic checks to make sure everything is fine before the KSK is made offline. 4021 for qtype in "DNSKEY" "CDNSKEY" "CDS" 4022 do 4023 echo_i "checking $qtype RRset is signed with KSK only (update-check-ksk, dnssec-ksk-only) ($n)" 4024 ret=0 4025 dig_with_opts $SECTIONS @10.53.0.2 $qtype $zone > dig.out.test$n 4026 lines=$(get_keys_which_signed $qtype dig.out.test$n | wc -l) 4027 test "$lines" -eq 1 || ret=1 4028 get_keys_which_signed $qtype dig.out.test$n | grep "^$KSK_ID$" > /dev/null || ret=1 4029 get_keys_which_signed $qtype dig.out.test$n | grep "^$ZSK_ID$" > /dev/null && ret=1 4030 n=$((n+1)) 4031 test "$ret" -eq 0 || echo_i "failed" 4032 status=$((status+ret)) 4033 done 4034 4035 echo_i "checking SOA RRset is signed with ZSK only (update-check-ksk and dnssec-ksk-only) ($n)" 4036 ret=0 4037 dig_with_opts $SECTIONS @10.53.0.2 soa $zone > dig.out.test$n 4038 lines=$(get_keys_which_signed "SOA" dig.out.test$n | wc -l) 4039 test "$lines" -eq 1 || ret=1 4040 get_keys_which_signed "SOA" dig.out.test$n | grep "^$KSK_ID$" > /dev/null && ret=1 4041 get_keys_which_signed "SOA" dig.out.test$n | grep "^$ZSK_ID$" > /dev/null || ret=1 4042 n=$((n+1)) 4043 test "$ret" -eq 0 || echo_i "failed" 4044 status=$((status+ret)) 4045 4046 # Roll the ZSK. 4047 zsk2=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -K ns2 -n zone "$zone") 4048 keyfile_to_key_id "$zsk2" > ns2/$zone.zsk.id2 4049 ZSK_ID2=`cat ns2/$zone.zsk.id2` 4050 4051 echo_i "load new ZSK $ZSK_ID2 for $zone ($n)" 4052 ret=0 4053 dnssec_loadkeys_on 2 $zone || ret=1 4054 n=$((n+1)) 4055 test "$ret" -eq 0 || echo_i "failed" 4056 status=$((status+ret)) 4057 4058 # Make new ZSK active. 4059 echo_i "make ZSK $ZSK_ID inactive and make new ZSK $ZSK_ID2 active for zone $zone ($n)" 4060 ret=0 4061 $SETTIME -I now -K ns2 $ZSK > /dev/null 4062 $SETTIME -A now -K ns2 $zsk2 > /dev/null 4063 dnssec_loadkeys_on 2 $zone || ret=1 4064 n=$((n+1)) 4065 test "$ret" -eq 0 || echo_i "failed" 4066 status=$((status+ret)) 4067 4068 # Remove the KSK from disk. 4069 echo_i "remove the KSK $KSK_ID for zone $zone from disk" 4070 mv ns2/$KSK.key ns2/$KSK.key.bak 4071 mv ns2/$KSK.private ns2/$KSK.private.bak 4072 4073 # Update the zone that requires a resign of the SOA RRset. 4074 echo_i "update the zone with $zone IN TXT nsupdate added me" 4075 ( 4076 echo zone $zone 4077 echo server 10.53.0.2 "$PORT" 4078 echo update add $zone. 300 in txt "nsupdate added me" 4079 echo send 4080 ) | $NSUPDATE 4081 4082 # Redo the tests now that the zone is updated and the KSK is offline. 4083 for qtype in "DNSKEY" "CDNSKEY" "CDS" 4084 do 4085 echo_i "checking $qtype RRset is signed with KSK only, KSK offline (update-check-ksk, dnssec-ksk-only) ($n)" 4086 ret=0 4087 dig_with_opts $SECTIONS @10.53.0.2 $qtype $zone > dig.out.test$n 4088 lines=$(get_keys_which_signed $qtype dig.out.test$n | wc -l) 4089 test "$lines" -eq 1 || ret=1 4090 get_keys_which_signed $qtype dig.out.test$n | grep "^$KSK_ID$" > /dev/null || ret=1 4091 get_keys_which_signed $qtype dig.out.test$n | grep "^$ZSK_ID$" > /dev/null && ret=1 4092 get_keys_which_signed $qtype dig.out.test$n | grep "^$ZSK_ID2$" > /dev/null && ret=1 4093 n=$((n+1)) 4094 test "$ret" -eq 0 || echo_i "failed" 4095 status=$((status+ret)) 4096 done 4097 4098 for qtype in "SOA" "TXT" 4099 do 4100 echo_i "checking $qtype RRset is signed with ZSK only, KSK offline (update-check-ksk and dnssec-ksk-only) ($n)" 4101 ret=0 4102 dig_with_opts $SECTIONS @10.53.0.2 $qtype $zone > dig.out.test$n 4103 lines=$(get_keys_which_signed $qtype dig.out.test$n | wc -l) 4104 test "$lines" -eq 1 || ret=1 4105 get_keys_which_signed $qtype dig.out.test$n | grep "^$KSK_ID$" > /dev/null && ret=1 4106 get_keys_which_signed $qtype dig.out.test$n | grep "^$ZSK_ID$" > /dev/null && ret=1 4107 get_keys_which_signed $qtype dig.out.test$n | grep "^$ZSK_ID2$" > /dev/null || ret=1 4108 n=$((n+1)) 4109 test "$ret" -eq 0 || echo_i "failed" 4110 status=$((status+ret)) 4111 done 4112 4113 # Put back the KSK. 4114 echo_i "put back the KSK $KSK_ID for zone $zone from disk" 4115 mv ns2/$KSK.key.bak ns2/$KSK.key 4116 mv ns2/$KSK.private.bak ns2/$KSK.private 4117 4118 # Roll the ZSK again. 4119 zsk3=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -K ns2 -n zone "$zone") 4120 keyfile_to_key_id "$zsk3" > ns2/$zone.zsk.id3 4121 ZSK_ID3=`cat ns2/$zone.zsk.id3` 4122 4123 # Schedule the new ZSK (ZSK3) to become active. 4124 echo_i "delete old ZSK $ZSK_ID schedule ZSK $ZSK_ID2 inactive and new ZSK $ZSK_ID3 active for zone $zone ($n)" 4125 $SETTIME -D now -K ns2 $ZSK > /dev/null 4126 $SETTIME -I +3600 -K ns2 $zsk2 > /dev/null 4127 $SETTIME -A +3600 -K ns2 $zsk3 > /dev/null 4128 dnssec_loadkeys_on 2 $zone || ret=1 4129 n=$((n+1)) 4130 test "$ret" -eq 0 || echo_i "failed" 4131 status=$((status+ret)) 4132 4133 # Remove the KSK from disk. 4134 echo_i "remove the KSK $KSK_ID for zone $zone from disk" 4135 mv ns2/$KSK.key ns2/$KSK.key.bak 4136 mv ns2/$KSK.private ns2/$KSK.private.bak 4137 4138 # Update the zone that requires a resign of the SOA RRset. 4139 echo_i "update the zone with $zone IN TXT nsupdate added me again" 4140 ( 4141 echo zone $zone 4142 echo server 10.53.0.2 "$PORT" 4143 echo update add $zone. 300 in txt "nsupdate added me again" 4144 echo send 4145 ) | $NSUPDATE 4146 4147 # Redo the tests now that the ZSK roll has deleted the old key. 4148 for qtype in "DNSKEY" "CDNSKEY" "CDS" 4149 do 4150 echo_i "checking $qtype RRset is signed with KSK only, old ZSK deleted (update-check-ksk, dnssec-ksk-only) ($n)" 4151 ret=0 4152 dig_with_opts $SECTIONS @10.53.0.2 $qtype $zone > dig.out.test$n 4153 lines=$(get_keys_which_signed $qtype dig.out.test$n | wc -l) 4154 test "$lines" -eq 1 || ret=1 4155 get_keys_which_signed $qtype dig.out.test$n | grep "^$KSK_ID$" > /dev/null || ret=1 4156 get_keys_which_signed $qtype dig.out.test$n | grep "^$ZSK_ID$" > /dev/null && ret=1 4157 get_keys_which_signed $qtype dig.out.test$n | grep "^$ZSK_ID2$" > /dev/null && ret=1 4158 get_keys_which_signed $qtype dig.out.test$n | grep "^$ZSK_ID3$" > /dev/null && ret=1 4159 n=$((n+1)) 4160 test "$ret" -eq 0 || echo_i "failed" 4161 status=$((status+ret)) 4162 done 4163 4164 for qtype in "SOA" "TXT" 4165 do 4166 echo_i "checking $qtype RRset is signed with ZSK only, old ZSK deleted (update-check-ksk and dnssec-ksk-only) ($n)" 4167 ret=0 4168 dig_with_opts $SECTIONS @10.53.0.2 $qtype $zone > dig.out.test$n 4169 lines=$(get_keys_which_signed $qtype dig.out.test$n | wc -l) 4170 test "$lines" -eq 1 || ret=1 4171 get_keys_which_signed $qtype dig.out.test$n | grep "^$KSK_ID$" > /dev/null && ret=1 4172 get_keys_which_signed $qtype dig.out.test$n | grep "^$ZSK_ID$" > /dev/null && ret=1 4173 get_keys_which_signed $qtype dig.out.test$n | grep "^$ZSK_ID2$" > /dev/null || ret=1 4174 get_keys_which_signed $qtype dig.out.test$n | grep "^$ZSK_ID3$" > /dev/null && ret=1 4175 n=$((n+1)) 4176 test "$ret" -eq 0 || echo_i "failed" 4177 status=$((status+ret)) 4178 done 4179 4180 # Make the new ZSK (ZSK3) active. 4181 echo_i "make new ZSK $ZSK_ID3 active for zone $zone ($n)" 4182 $SETTIME -I +1 -K ns2 $zsk2 > /dev/null 4183 $SETTIME -A +1 -K ns2 $zsk3 > /dev/null 4184 dnssec_loadkeys_on 2 $zone || ret=1 4185 n=$((n+1)) 4186 test "$ret" -eq 0 || echo_i "failed" 4187 status=$((status+ret)) 4188 4189 # Wait for newest ZSK to become active. 4190 echo_i "wait until new ZSK $ZSK_ID3 active and ZSK $ZSK_ID2 inactive" 4191 for i in 1 2 3 4 5 6 7 8 9 10; do 4192 ret=0 4193 grep "DNSKEY $zone/$DEFAULT_ALGORITHM/$ZSK_ID3 (ZSK) is now active" ns2/named.run > /dev/null || ret=1 4194 grep "DNSKEY $zone/$DEFAULT_ALGORITHM/$ZSK_ID2 (ZSK) is now inactive" ns2/named.run > /dev/null || ret=1 4195 [ "$ret" -eq 0 ] && break 4196 sleep 1 4197 done 4198 n=$((n+1)) 4199 test "$ret" -eq 0 || echo_i "failed" 4200 status=$((status+ret)) 4201 4202 # Update the zone that requires a resign of the SOA RRset. 4203 echo_i "update the zone with $zone IN TXT nsupdate added me one more time" 4204 ( 4205 echo zone $zone 4206 echo server 10.53.0.2 "$PORT" 4207 echo update add $zone. 300 in txt "nsupdate added me one more time" 4208 echo send 4209 ) | $NSUPDATE 4210 n=$((n+1)) 4211 test "$ret" -eq 0 || echo_i "failed" 4212 status=$((status+ret)) 4213 4214 # Redo the tests one more time. 4215 for qtype in "DNSKEY" "CDNSKEY" "CDS" 4216 do 4217 echo_i "checking $qtype RRset is signed with KSK only, new ZSK active (update-check-ksk, dnssec-ksk-only) ($n)" 4218 ret=0 4219 dig_with_opts $SECTIONS @10.53.0.2 $qtype $zone > dig.out.test$n 4220 lines=$(get_keys_which_signed $qtype dig.out.test$n | wc -l) 4221 test "$lines" -eq 1 || ret=1 4222 get_keys_which_signed $qtype dig.out.test$n | grep "^$KSK_ID$" > /dev/null || ret=1 4223 get_keys_which_signed $qtype dig.out.test$n | grep "^$ZSK_ID$" > /dev/null && ret=1 4224 get_keys_which_signed $qtype dig.out.test$n | grep "^$ZSK_ID2$" > /dev/null && ret=1 4225 get_keys_which_signed $qtype dig.out.test$n | grep "^$ZSK_ID3$" > /dev/null && ret=1 4226 n=$((n+1)) 4227 test "$ret" -eq 0 || echo_i "failed" 4228 status=$((status+ret)) 4229 done 4230 4231 for qtype in "SOA" "TXT" 4232 do 4233 echo_i "checking $qtype RRset is signed with ZSK only, new ZSK active (update-check-ksk and dnssec-ksk-only) ($n)" 4234 ret=0 4235 dig_with_opts $SECTIONS @10.53.0.2 $qtype $zone > dig.out.test$n 4236 lines=$(get_keys_which_signed $qtype dig.out.test$n | wc -l) 4237 test "$lines" -eq 1 || ret=1 4238 get_keys_which_signed $qtype dig.out.test$n | grep "^$KSK_ID$" > /dev/null && ret=1 4239 get_keys_which_signed $qtype dig.out.test$n | grep "^$ZSK_ID$" > /dev/null && ret=1 4240 get_keys_which_signed $qtype dig.out.test$n | grep "^$ZSK_ID2$" > /dev/null && ret=1 4241 get_keys_which_signed $qtype dig.out.test$n | grep "^$ZSK_ID3$" > /dev/null || ret=1 4242 n=$((n+1)) 4243 test "$ret" -eq 0 || echo_i "failed" 4244 status=$((status+ret)) 4245 done 4246 4247 echo_i "checking secroots output with multiple views ($n)" 4248 ret=0 4249 rndccmd 10.53.0.4 secroots 2>&1 | sed 's/^/ns4 /' | cat_i 4250 cp ns4/named.secroots named.secroots.test$n 4251 check_secroots_layout named.secroots.test$n || ret=1 4252 n=$((n+1)) 4253 test "$ret" -eq 0 || echo_i "failed" 4254 status=$((status+ret)) 4255 4256 echo_i "exit status: $status" 4257 [ $status -eq 0 ] || exit 1 4258
Indexes created Sun Aug 02 00:25:04 UTC 2026