1 #!/bin/sh 2 3 # Copyright (C) Internet Systems Consortium, Inc. ("ISC") 4 # 5 # SPDX-License-Identifier: MPL-2.0 6 # 7 # This Source Code Form is subject to the terms of the Mozilla Public 8 # License, v. 2.0. If a copy of the MPL was not distributed with this 9 # file, you can obtain one at https://mozilla.org/MPL/2.0/. 10 # 11 # See the COPYRIGHT file distributed with this work for additional 12 # information regarding copyright ownership. 13 14 set -e 15 16 # shellcheck disable=SC2034 17 . ../conf.sh 18 19 dig_plus_opts() { 20 $DIG +tcp +noadd +nosea +nostat +noquest +nocomm +nocmd -p "${PORT}" "$@" 21 } 22 23 status=0 24 n=0 25 26 test_start() { 27 n=$((n + 1)) 28 echo_i "$* ($n)" 29 ret=0 30 } 31 32 test_end() { 33 [ $ret = 0 ] || echo_i "failed" 34 status=$((status + ret)) 35 } 36 37 # 38 # Wait up to 10 seconds for the servers to finish starting before testing. 39 # 40 for i in 1 2 3 4 5 6 7 8 9 10; do 41 ret=0 42 $DIG +tcp -p "${PORT}" example @10.53.0.2 soa >dig.out.ns2.test$n || ret=1 43 grep "status: NOERROR" dig.out.ns2.test$n >/dev/null || ret=1 44 grep "flags:.* aa[ ;]" dig.out.ns2.test$n >/dev/null || ret=1 45 $DIG +tcp -p "${PORT}" example @10.53.0.3 soa >dig.out.ns3.test$n || ret=1 46 grep "status: NOERROR" dig.out.ns3.test$n >/dev/null || ret=1 47 grep "flags:.* aa[ ;]" dig.out.ns3.test$n >/dev/null || ret=1 48 nr=$(grep -c 'x[0-9].*sending notify to' ns2/named.run) 49 [ "$nr" -ge 22 ] || ret=1 50 [ $ret = 0 ] && break 51 sleep 1 52 done 53 54 test_start "checking initial status" 55 56 dig_plus_opts a.example. @10.53.0.2 a >dig.out.ns2.test$n || ret=1 57 grep "10.0.0.1" dig.out.ns2.test$n >/dev/null || ret=1 58 59 dig_plus_opts a.example. @10.53.0.3 a >dig.out.ns3.test$n || ret=1 60 grep "10.0.0.1" dig.out.ns3.test$n >/dev/null || ret=1 61 62 digcomp dig.out.ns2.test$n dig.out.ns3.test$n || ret=1 63 64 test_end 65 66 test_start "checking startup notify rate limit" 67 awk '/x[0-9].*sending notify to/ { 68 split($2, a, ":"); 69 this = a[1] * 3600 + a[2] * 60 + a[3]; 70 if (lasta1 && lasta1 > a[1]) { 71 fix = 3600 * 24; 72 } 73 this += fix; 74 if (last) { 75 delta = this - last; 76 print delta; 77 78 total += delta; 79 if (!maxdelta || delta > maxdelta) { 80 maxdelta = delta; 81 } 82 if (!mindelta || delta < mindelta) { 83 mindelta = delta; 84 } 85 } 86 lasta1 = a[1]; 87 last = this; 88 count++; 89 } 90 END { 91 average = total / count; 92 print "mindelta:", mindelta; 93 print "maxdelta:" maxdelta; 94 print "count:", count; 95 print "average:", average; 96 if (average < 0.180) exit(1); 97 if (count < 22) exit(1); 98 }' ns2/named.run >awk.out.ns2.test$n || ret=1 99 test_end 100 101 # See [GL#4689] 102 test_start "checking server behaviour with invalid notify-source-v6 address" 103 grep "zone ./IN: sending notify to fd92:7065:b8e:fffe::a35:4#" ns1/named.run >/dev/null || ret=1 104 grep "dns_request_create: failed address not available" ns1/named.run >/dev/null || ret=1 105 test_end 106 107 nextpart ns3/named.run >/dev/null 108 109 sleep 1 # make sure filesystem time stamp is newer for reload. 110 rm -f ns2/example.db 111 cp -f ns2/example2.db ns2/example.db 112 echo_i "reloading with example2 using HUP and waiting up to 45 seconds" 113 kill -HUP "$(cat ns2/named.pid)" 114 wait_for_log_re 45 "transfer of 'example/IN' from 10.53.0.2#.*success" ns3/named.run 115 116 test_start "checking notify message was logged" 117 grep 'notify from 10.53.0.2#[0-9][0-9]*: serial 2$' ns3/named.run >/dev/null || ret=1 118 grep 'refused notify from non-primary: fd92:7065:b8e:ffff::2#[0-9][0-9]*$' ns3/named.run >/dev/null || ret=1 119 test_end 120 121 if $FEATURETEST --have-fips-dh; then 122 test_start "checking notify over TLS successful" 123 grep "zone tls-x1/IN: notify to 10.53.0.2#${TLSPORT} successful" ns3/named.run >/dev/null || ret=1 124 grep "zone tls-x2/IN: notify to 10.53.0.2#${EXTRAPORT1} successful" ns3/named.run >/dev/null || ret=1 125 grep "zone tls-x3/IN: notify to 10.53.0.2#${EXTRAPORT1} successful" ns3/named.run >/dev/null || ret=1 126 grep "zone tls-x5/IN: notify to 10.53.0.2#${EXTRAPORT3} successful" ns3/named.run >/dev/null || ret=1 127 test_end 128 129 test_start "checking notify over TLS failed" 130 grep "zone tls-x4/IN: notify to 10.53.0.2#${EXTRAPORT1} failed: TLS peer certificate verification failed" ns3/named.run >/dev/null || ret=1 131 grep "zone tls-x6/IN: notify to 10.53.0.2#${EXTRAPORT4} failed: TLS peer certificate verification failed" ns3/named.run >/dev/null || ret=1 132 test_end 133 fi 134 135 test_start "checking example2 loaded" 136 dig_plus_opts a.example. @10.53.0.2 a >dig.out.ns2.test$n || ret=1 137 grep "10.0.0.2" dig.out.ns2.test$n >/dev/null || ret=1 138 test_end 139 140 test_start "checking example2 contents have been transferred after HUP reload" 141 142 dig_plus_opts a.example. @10.53.0.2 a >dig.out.ns2.test$n || ret=1 143 grep "10.0.0.2" dig.out.ns2.test$n >/dev/null || ret=1 144 145 dig_plus_opts a.example. @10.53.0.3 a >dig.out.ns3.test$n || ret=1 146 grep "10.0.0.2" dig.out.ns3.test$n >/dev/null || ret=1 147 148 digcomp dig.out.ns2.test$n dig.out.ns3.test$n || ret=1 149 150 test_end 151 152 echo_i "stopping primary and restarting with example4 then waiting up to 45 seconds" 153 stop_server ns2 154 155 rm -f ns2/example.db 156 cp -f ns2/example4.db ns2/example.db 157 158 start_server --noclean --restart --port "${PORT}" ns2 159 wait_for_log_re 45 "transfer of 'example/IN' from 10.53.0.2#.*success" ns3/named.run 160 161 test_start "checking notify message was logged" 162 grep 'notify from 10.53.0.2#[0-9][0-9]*: serial 4$' ns3/named.run >/dev/null || ret=1 163 test_end 164 165 test_start "checking example4 loaded" 166 dig_plus_opts a.example. @10.53.0.2 a >dig.out.ns2.test$n || ret=1 167 grep "10.0.0.4" dig.out.ns2.test$n >/dev/null || ret=1 168 test_end 169 170 test_start "checking example4 contents have been transferred after restart" 171 172 dig_plus_opts a.example. @10.53.0.2 a >dig.out.ns2.test$n || ret=1 173 grep "10.0.0.4" dig.out.ns2.test$n >/dev/null || ret=1 174 175 dig_plus_opts a.example. @10.53.0.3 a >dig.out.ns3.test$n || ret=1 176 grep "10.0.0.4" dig.out.ns3.test$n >/dev/null || ret=1 177 178 digcomp dig.out.ns2.test$n dig.out.ns3.test$n || ret=1 179 180 test_end 181 182 test_start "checking notify to alternate port with primary server inheritance" 183 $NSUPDATE <<EOF 184 server 10.53.0.2 ${PORT} 185 zone x21 186 update add added.x21 0 in txt "test string" 187 send 188 EOF 189 fn="dig.out.ns4.test$n" 190 for i in 1 2 3 4 5 6 7 8 9; do 191 dig_plus_opts added.x21. @10.53.0.4 txt -p "$EXTRAPORT1" >"$fn" || ret=1 192 grep "test string" "$fn" >/dev/null && break 193 sleep 1 194 done 195 grep "test string" "$fn" >/dev/null || ret=1 196 test_end 197 198 test_start "checking notify to multiple views using tsig" 199 $NSUPDATE <<EOF 200 server 10.53.0.5 ${PORT} 201 zone x21 202 key $DEFAULT_HMAC:a aaaaaaaaaaaaaaaaaaaa 203 update add added.x21 0 in txt "test string" 204 send 205 EOF 206 fnb="dig.out.b.ns5.test$n" 207 fnc="dig.out.c.ns5.test$n" 208 for i in 1 2 3 4 5 6 7 8 9; do 209 dig_plus_opts added.x21. -y "${DEFAULT_HMAC}:b:bbbbbbbbbbbbbbbbbbbb" @10.53.0.5 \ 210 txt >"$fnb" || ret=1 211 dig_plus_opts added.x21. -y "${DEFAULT_HMAC}:c:cccccccccccccccccccc" @10.53.0.5 \ 212 txt >"$fnc" || ret=1 213 grep "test string" "$fnb" >/dev/null \ 214 && grep "test string" "$fnc" >/dev/null \ 215 && break 216 sleep 1 217 done 218 grep "test string" "$fnb" >/dev/null || ret=1 219 grep "test string" "$fnc" >/dev/null || ret=1 220 grep "sending notify to 10.53.0.5#[0-9]* : TSIG (b)" ns5/named.run >/dev/null || ret=1 221 grep "sending notify to 10.53.0.5#[0-9]* : TSIG (c)" ns5/named.run >/dev/null || ret=1 222 test_end 223 224 test_start "checking notify-source uses port option correctly" 225 grep "10.53.0.3#${EXTRAPORT2}: received notify for zone 'notify-source-port-test'" ns2/named.run >/dev/null || ret=1 226 test_end 227 228 # notify messages were sent to unresponsive 10.53.10.53 during the tests 229 # above, which should time out at some point; we need to wait for them to 230 # appear in the logs in case the tests run faster than the notify timeouts 231 232 test_start "checking notify to retry over TCP within 45 seconds" 233 nextpartreset ns3/named.run 234 wait_for_log 45 'retrying over TCP' ns3/named.run || ret=1 235 test_end 236 237 # the TCP timeout is set to 15 seconds, double that for some leeway 238 test_start "checking notify retries expire within 30 seconds" 239 nextpartreset ns3/named.run 240 wait_for_log 30 'retries exceeded' ns3/named.run || ret=1 241 test_end 242 243 echo_i "exit status: $status" 244 [ $status -eq 0 ] || exit 1 245
Indexes created Sun Mar 01 05:31:48 UTC 2026