external/bsd/bind/dist/bin/tests/system/acl/tests.sh

   1 #!/bin/sh
   2 #
   3 # Copyright (C) 2008  Internet Systems Consortium, Inc. ("ISC")
   4 #
   5 # Permission to use, copy, modify, and/or distribute this software for any
   6 # purpose with or without fee is hereby granted, provided that the above
   7 # copyright notice and this permission notice appear in all copies.
   8 #
   9 # THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
  10 # REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
  11 # AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
  12 # INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
  13 # LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
  14 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  15 # PERFORMANCE OF THIS SOFTWARE.
  16
  17 # Id: tests.sh,v 1.4 2008/07/19 00:02:14 each Exp
  18
  19 SYSTEMTESTTOP=..
  20 . $SYSTEMTESTTOP/conf.sh
  21
  22 DIGOPTS="+tcp +noadd +nosea +nostat +noquest +nocomm +nocmd"
  23
  24 status=0
  25 t=0
  26
  27 echo "I:testing basic ACL processing"
  28 # key "one" should fail
  29 t=`expr $t + 1`
  30 $DIG $DIGOPTS tsigzone. \
  31         @10.53.0.2 -b 10.53.0.1 axfr -y one:1234abcd8765 -p 5300 > dig.out
  32 grep "^;" dig.out > /dev/null 2>&1 || { echo "I:test $t failed" ; status=1; }
  33
  34 # any other key should be fine
  35 t=`expr $t + 1`
  36 $DIG $DIGOPTS tsigzone. \
  37         @10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 -p 5300 > dig.out
  38 grep "^;" dig.out > /dev/null 2>&1 && { echo "I:test $t failed" ; status=1; }
  39
  40 cp -f ns2/named2.conf ns2/named.conf
  41 $RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 reload 2>&1 | sed 's/^/I:ns2 /'
  42 sleep 5
  43
  44 # prefix 10/8 should fail
  45 t=`expr $t + 1`
  46 $DIG $DIGOPTS tsigzone. \
  47         @10.53.0.2 -b 10.53.0.1 axfr -y one:1234abcd8765 -p 5300 > dig.out
  48 grep "^;" dig.out > /dev/null 2>&1 || { echo "I:test $t failed" ; status=1; }
  49
  50 # any other address should work, as long as it sends key "one"
  51 t=`expr $t + 1`
  52 $DIG $DIGOPTS tsigzone. \
  53         @10.53.0.2 -b 127.0.0.1 axfr -y two:1234abcd8765 -p 5300 > dig.out
  54 grep "^;" dig.out > /dev/null 2>&1 || { echo "I:test $t failed" ; status=1; }
  55
  56 t=`expr $t + 1`
  57 $DIG $DIGOPTS tsigzone. \
  58         @10.53.0.2 -b 127.0.0.1 axfr -y one:1234abcd8765 -p 5300 > dig.out
  59 grep "^;" dig.out > /dev/null 2>&1 && { echo "I:test $t failed" ; status=1; }
  60
  61 echo "I:testing nested ACL processing"
  62 # all combinations of 10.53.0.{1|2} with key {one|two}, should succeed
  63 cp -f ns2/named3.conf ns2/named.conf
  64 $RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 reload 2>&1 | sed 's/^/I:ns2 /'
  65 sleep 5
  66
  67 # should succeed
  68 t=`expr $t + 1`
  69 $DIG $DIGOPTS tsigzone. \
  70         @10.53.0.2 -b 10.53.0.2 axfr -y two:1234abcd8765 -p 5300 > dig.out
  71 grep "^;" dig.out > /dev/null 2>&1 && { echo "I:test $t failed" ; status=1; }
  72
  73 # should succeed
  74 t=`expr $t + 1`
  75 $DIG $DIGOPTS tsigzone. \
  76         @10.53.0.2 -b 10.53.0.2 axfr -y one:1234abcd8765 -p 5300 > dig.out
  77 grep "^;" dig.out > /dev/null 2>&1 && { echo "I:test $t failed" ; status=1; }
  78
  79 # should succeed
  80 t=`expr $t + 1`
  81 $DIG $DIGOPTS tsigzone. \
  82         @10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 -p 5300 > dig.out
  83 grep "^;" dig.out > /dev/null 2>&1 && { echo "I:test $t failed" ; status=1; }
  84
  85 # should succeed
  86 t=`expr $t + 1`
  87 $DIG $DIGOPTS tsigzone. \
  88         @10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 -p 5300 > dig.out
  89 grep "^;" dig.out > /dev/null 2>&1 && { echo "I:test $t failed" ; status=1; }
  90
  91 # but only one or the other should fail
  92 t=`expr $t + 1`
  93 $DIG $DIGOPTS tsigzone. \
  94         @10.53.0.2 -b 127.0.0.1 axfr -y one:1234abcd8765 -p 5300 > dig.out
  95 grep "^;" dig.out > /dev/null 2>&1 || { echo "I:test $t failed" ; status=1; }
  96
  97 t=`expr $t + 1`
  98 $DIG $DIGOPTS tsigzone. \
  99         @10.53.0.2 -b 10.53.0.2 axfr -p 5300 > dig.out
 100 grep "^;" dig.out > /dev/null 2>&1 || { echo "I:test $tt failed" ; status=1; }
 101
 102 # and other values? right out
 103 t=`expr $t + 1`
 104 $DIG $DIGOPTS tsigzone. \
 105         @10.53.0.2 -b 127.0.0.1 axfr -y three:1234abcd8765 -p 5300 > dig.out
 106 grep "^;" dig.out > /dev/null 2>&1 || { echo "I:test $t failed" ; status=1; }
 107
 108 # now we only allow 10.53.0.1 *and* key one, or 10.53.0.2 *and* key two
 109 cp -f ns2/named4.conf ns2/named.conf
 110 $RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 reload 2>&1 | sed 's/^/I:ns2 /'
 111 sleep 5
 112
 113 # should succeed
 114 t=`expr $t + 1`
 115 $DIG $DIGOPTS tsigzone. \
 116         @10.53.0.2 -b 10.53.0.2 axfr -y two:1234abcd8765 -p 5300 > dig.out
 117 grep "^;" dig.out > /dev/null 2>&1 && { echo "I:test $t failed" ; status=1; }
 118
 119 # should succeed
 120 t=`expr $t + 1`
 121 $DIG $DIGOPTS tsigzone. \
 122         @10.53.0.2 -b 10.53.0.1 axfr -y one:1234abcd8765 -p 5300 > dig.out
 123 grep "^;" dig.out > /dev/null 2>&1 && { echo "I:test $t failed" ; status=1; }
 124
 125 # should fail
 126 t=`expr $t + 1`
 127 $DIG $DIGOPTS tsigzone. \
 128         @10.53.0.2 -b 10.53.0.2 axfr -y one:1234abcd8765 -p 5300 > dig.out
 129 grep "^;" dig.out > /dev/null 2>&1 || { echo "I:test $t failed" ; status=1; }
 130
 131 # should fail
 132 t=`expr $t + 1`
 133 $DIG $DIGOPTS tsigzone. \
 134         @10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 -p 5300 > dig.out
 135 grep "^;" dig.out > /dev/null 2>&1 || { echo "I:test $t failed" ; status=1; }
 136
 137 # should fail
 138 t=`expr $t + 1`
 139 $DIG $DIGOPTS tsigzone. \
 140         @10.53.0.2 -b 10.53.0.3 axfr -y one:1234abcd8765 -p 5300 > dig.out
 141 grep "^;" dig.out > /dev/null 2>&1 || { echo "I:test $t failed" ; status=1; }
 142
 143 echo "I:exit status: $status"
 144 exit $status