?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
No empty .Rs/.Re
[netbsd-mini2440.git] / external / bsd / bind / dist / bin / tests / system / autosign / tests.sh
bloba1f13e84098dc1f911dae40689e2ed0cf74a67c8
1 #!/bin/sh
2 #
3 # Copyright (C) 2009 Internet Systems Consortium, Inc. ("ISC")
4 #
5 # Permission to use, copy, modify, and/or distribute this software for any
6 # purpose with or without fee is hereby granted, provided that the above
7 # copyright notice and this permission notice appear in all copies.
8 #
9 # THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
10 # REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
11 # AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
12 # INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
13 # LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
14 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
15 # PERFORMANCE OF THIS SOFTWARE.
16
17 # Id: tests.sh,v 1.4 2009/12/02 05:42:15 each Exp
18
19 SYSTEMTESTTOP=..
20 . $SYSTEMTESTTOP/conf.sh
21
22 status=0
23 n=0
24
25
26 DIGOPTS="+tcp +noadd +nosea +nostat +nocmd +dnssec -p 5300"
27
28 echo "I:converting zones from nsec to nsec3"
29 $NSUPDATE > /dev/null <<END || status=1
30 server 10.53.0.3 5300
31 zone nsec3.nsec3.example.
32 update add nsec3.nsec3.example. 3600 NSEC3PARAM 1 0 10 BEEF
33 send
34 zone optout.nsec3.example.
35 update add optout.nsec3.example. 3600 NSEC3PARAM 1 1 10 BEEF
36 send
37 zone nsec3.example.
38 update add nsec3.example. 3600 NSEC3PARAM 1 0 10 BEEF
39 send
40 zone nsec3.optout.example.
41 update add nsec3.optout.example. 3600 NSEC3PARAM 1 0 10 BEEF
42 send
43 zone optout.optout.example.
44 update add optout.optout.example. 3600 NSEC3PARAM 1 1 10 BEEF
45 send
46 zone optout.example.
47 update add optout.example. 3600 NSEC3PARAM 1 1 10 BEEF
48 send
49 END
50
51 echo "I:waiting 30 seconds for key changes to take effect"
52 sleep 30
53
54 # Send rndc freeze command to ns1, ns2 and ns3, to force the dynamically
55 # signed zones to be dumped to their zone files
56 echo "I:dumping zone files"
57 $RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 freeze 2>&1 | sed 's/^/I:ns1 /'
58 $RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 freeze 2>&1 | sed 's/^/I:ns2 /'
59 $RNDC -c ../common/rndc.conf -s 10.53.0.3 -p 9953 freeze 2>&1 | sed 's/^/I:ns3 /'
60
61 # Check the example. domain
62
63 echo "I:checking that zone transfer worked ($n)"
64 ret=0
65 $DIG $DIGOPTS a.example. @10.53.0.2 a > dig.out.ns2.test$n || ret=1
66 $DIG $DIGOPTS a.example. @10.53.0.3 a > dig.out.ns3.test$n || ret=1
67 $PERL ../digcomp.pl dig.out.ns2.test$n dig.out.ns3.test$n || ret=1
68 n=`expr $n + 1`
69 if [ $ret != 0 ]; then echo "I:failed"; fi
70 status=`expr $status + $ret`
71
72 echo "I:checking positive validation NSEC ($n)"
73 ret=0
74 $DIG $DIGOPTS +noauth a.example. @10.53.0.2 a > dig.out.ns2.test$n || ret=1
75 $DIG $DIGOPTS +noauth a.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1
76 $PERL ../digcomp.pl dig.out.ns2.test$n dig.out.ns4.test$n || ret=1
77 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
78 n=`expr $n + 1`
79 if [ $ret != 0 ]; then echo "I:failed"; fi
80 status=`expr $status + $ret`
81
82 echo "I:checking positive validation NSEC3 ($n)"
83 ret=0
84 $DIG $DIGOPTS +noauth a.nsec3.example. \
85 @10.53.0.3 a > dig.out.ns3.test$n || ret=1
86 $DIG $DIGOPTS +noauth a.nsec3.example. \
87 @10.53.0.4 a > dig.out.ns4.test$n || ret=1
88 $PERL ../digcomp.pl dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
89 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
90 n=`expr $n + 1`
91 if [ $ret != 0 ]; then echo "I:failed"; fi
92 status=`expr $status + $ret`
93
94 echo "I:checking positive validation OPTOUT ($n)"
95 ret=0
96 $DIG $DIGOPTS +noauth a.optout.example. \
97 @10.53.0.3 a > dig.out.ns3.test$n || ret=1
98 $DIG $DIGOPTS +noauth a.optout.example. \
99 @10.53.0.4 a > dig.out.ns4.test$n || ret=1
100 $PERL ../digcomp.pl dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
101 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
102 n=`expr $n + 1`
103 if [ $ret != 0 ]; then echo "I:failed"; fi
104 status=`expr $status + $ret`
105
106 echo "I:checking negative validation NXDOMAIN NSEC ($n)"
107 ret=0
108 $DIG $DIGOPTS +noauth q.example. @10.53.0.2 a > dig.out.ns2.test$n || ret=1
109 $DIG $DIGOPTS +noauth q.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1
110 $PERL ../digcomp.pl dig.out.ns2.test$n dig.out.ns4.test$n || ret=1
111 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
112 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1
113 n=`expr $n + 1`
114 if [ $ret != 0 ]; then echo "I:failed"; fi
115 status=`expr $status + $ret`
116
117 echo "I:checking negative validation NXDOMAIN NSEC3 ($n)"
118 ret=0
119 $DIG $DIGOPTS +noauth q.nsec3.example. \
120 @10.53.0.3 a > dig.out.ns3.test$n || ret=1
121 $DIG $DIGOPTS +noauth q.nsec3.example. \
122 @10.53.0.4 a > dig.out.ns4.test$n || ret=1
123 $PERL ../digcomp.pl dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
124 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
125 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1
126 n=`expr $n + 1`
127 if [ $ret != 0 ]; then echo "I:failed"; fi
128 status=`expr $status + $ret`
129
130 echo "I:checking negative validation NXDOMAIN OPTOUT ($n)"
131 ret=0
132 $DIG $DIGOPTS +noauth q.optout.example. \
133 @10.53.0.3 a > dig.out.ns3.test$n || ret=1
134 $DIG $DIGOPTS +noauth q.optout.example. \
135 @10.53.0.4 a > dig.out.ns4.test$n || ret=1
136 $PERL ../digcomp.pl dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
137 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1
138 # Note - this is looking for failure, hence the &&
139 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1
140 n=`expr $n + 1`
141 if [ $ret != 0 ]; then echo "I:failed"; fi
142 status=`expr $status + $ret`
143
144 echo "I:checking negative validation NODATA NSEC ($n)"
145 ret=0
146 $DIG $DIGOPTS +noauth a.example. @10.53.0.2 txt > dig.out.ns2.test$n || ret=1
147 $DIG $DIGOPTS +noauth a.example. @10.53.0.4 txt > dig.out.ns4.test$n || ret=1
148 $PERL ../digcomp.pl dig.out.ns2.test$n dig.out.ns4.test$n || ret=1
149 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
150 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
151 grep "ANSWER: 0" dig.out.ns4.test$n > /dev/null || ret=1
152 n=`expr $n + 1`
153 if [ $ret != 0 ]; then echo "I:failed"; fi
154 status=`expr $status + $ret`
155
156 echo "I:checking negative validation NODATA NSEC3 ($n)"
157 ret=0
158 $DIG $DIGOPTS +noauth a.nsec3.example. \
159 @10.53.0.3 txt > dig.out.ns3.test$n || ret=1
160 $DIG $DIGOPTS +noauth a.nsec3.example. \
161 @10.53.0.4 txt > dig.out.ns4.test$n || ret=1
162 $PERL ../digcomp.pl dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
163 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
164 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
165 grep "ANSWER: 0" dig.out.ns4.test$n > /dev/null || ret=1
166 n=`expr $n + 1`
167 if [ $ret != 0 ]; then echo "I:failed"; fi
168 status=`expr $status + $ret`
169
170 echo "I:checking negative validation NODATA OPTOUT ($n)"
171 ret=0
172 $DIG $DIGOPTS +noauth a.optout.example. \
173 @10.53.0.3 txt > dig.out.ns3.test$n || ret=1
174 $DIG $DIGOPTS +noauth a.optout.example. \
175 @10.53.0.4 txt > dig.out.ns4.test$n || ret=1
176 $PERL ../digcomp.pl dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
177 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
178 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
179 grep "ANSWER: 0" dig.out.ns4.test$n > /dev/null || ret=1
180 n=`expr $n + 1`
181 if [ $ret != 0 ]; then echo "I:failed"; fi
182 status=`expr $status + $ret`
183
184 # Check the insecure.example domain
185
186 echo "I:checking 1-server insecurity proof NSEC ($n)"
187 ret=0
188 $DIG $DIGOPTS +noauth a.insecure.example. @10.53.0.3 a > dig.out.ns3.test$n || ret=1
189 $DIG $DIGOPTS +noauth a.insecure.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1
190 $PERL ../digcomp.pl dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
191 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
192 # Note - this is looking for failure, hence the &&
193 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1
194 n=`expr $n + 1`
195 if [ $ret != 0 ]; then echo "I:failed"; fi
196 status=`expr $status + $ret`
197
198 echo "I:checking 1-server negative insecurity proof NSEC ($n)"
199 ret=0
200 $DIG $DIGOPTS q.insecure.example. a @10.53.0.3 \
201 > dig.out.ns3.test$n || ret=1
202 $DIG $DIGOPTS q.insecure.example. a @10.53.0.4 \
203 > dig.out.ns4.test$n || ret=1
204 $PERL ../digcomp.pl dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
205 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1
206 # Note - this is looking for failure, hence the &&
207 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1
208 n=`expr $n + 1`
209 if [ $ret != 0 ]; then echo "I:failed"; fi
210 status=`expr $status + $ret`
211
212 # Check the secure.example domain
213
214 echo "I:checking multi-stage positive validation NSEC/NSEC ($n)"
215 ret=0
216 $DIG $DIGOPTS +noauth a.secure.example. \
217 @10.53.0.3 a > dig.out.ns3.test$n || ret=1
218 $DIG $DIGOPTS +noauth a.secure.example. \
219 @10.53.0.4 a > dig.out.ns4.test$n || ret=1
220 $PERL ../digcomp.pl dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
221 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
222 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
223 n=`expr $n + 1`
224 if [ $ret != 0 ]; then echo "I:failed"; fi
225 status=`expr $status + $ret`
226
227 echo "I:checking multi-stage positive validation NSEC/NSEC3 ($n)"
228 ret=0
229 $DIG $DIGOPTS +noauth a.nsec3.example. \
230 @10.53.0.3 a > dig.out.ns3.test$n || ret=1
231 $DIG $DIGOPTS +noauth a.nsec3.example. \
232 @10.53.0.4 a > dig.out.ns4.test$n || ret=1
233 $PERL ../digcomp.pl dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
234 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
235 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
236 n=`expr $n + 1`
237 if [ $ret != 0 ]; then echo "I:failed"; fi
238 status=`expr $status + $ret`
239
240 echo "I:checking multi-stage positive validation NSEC/OPTOUT ($n)"
241 ret=0
242 $DIG $DIGOPTS +noauth a.optout.example. \
243 @10.53.0.3 a > dig.out.ns3.test$n || ret=1
244 $DIG $DIGOPTS +noauth a.optout.example. \
245 @10.53.0.4 a > dig.out.ns4.test$n || ret=1
246 $PERL ../digcomp.pl dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
247 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
248 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
249 n=`expr $n + 1`
250 if [ $ret != 0 ]; then echo "I:failed"; fi
251 status=`expr $status + $ret`
252
253 echo "I:checking multi-stage positive validation NSEC3/NSEC ($n)"
254 ret=0
255 $DIG $DIGOPTS +noauth a.secure.nsec3.example. \
256 @10.53.0.3 a > dig.out.ns3.test$n || ret=1
257 $DIG $DIGOPTS +noauth a.secure.nsec3.example. \
258 @10.53.0.4 a > dig.out.ns4.test$n || ret=1
259 $PERL ../digcomp.pl dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
260 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
261 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
262 n=`expr $n + 1`
263 if [ $ret != 0 ]; then echo "I:failed"; fi
264 status=`expr $status + $ret`
265
266 echo "I:checking multi-stage positive validation NSEC3/NSEC3 ($n)"
267 ret=0
268 $DIG $DIGOPTS +noauth a.nsec3.nsec3.example. \
269 @10.53.0.3 a > dig.out.ns3.test$n || ret=1
270 $DIG $DIGOPTS +noauth a.nsec3.nsec3.example. \
271 @10.53.0.4 a > dig.out.ns4.test$n || ret=1
272 $PERL ../digcomp.pl dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
273 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
274 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
275 n=`expr $n + 1`
276 if [ $ret != 0 ]; then echo "I:failed"; fi
277 status=`expr $status + $ret`
278
279 echo "I:checking multi-stage positive validation NSEC3/OPTOUT ($n)"
280 ret=0
281 $DIG $DIGOPTS +noauth a.optout.nsec3.example. \
282 @10.53.0.3 a > dig.out.ns3.test$n || ret=1
283 $DIG $DIGOPTS +noauth a.optout.nsec3.example. \
284 @10.53.0.4 a > dig.out.ns4.test$n || ret=1
285 $PERL ../digcomp.pl dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
286 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
287 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
288 n=`expr $n + 1`
289 if [ $ret != 0 ]; then echo "I:failed"; fi
290 status=`expr $status + $ret`
291
292 echo "I:checking multi-stage positive validation OPTOUT/NSEC ($n)"
293 ret=0
294 $DIG $DIGOPTS +noauth a.secure.optout.example. \
295 @10.53.0.3 a > dig.out.ns3.test$n || ret=1
296 $DIG $DIGOPTS +noauth a.secure.optout.example. \
297 @10.53.0.4 a > dig.out.ns4.test$n || ret=1
298 $PERL ../digcomp.pl dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
299 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
300 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
301 n=`expr $n + 1`
302 if [ $ret != 0 ]; then echo "I:failed"; fi
303 status=`expr $status + $ret`
304
305 echo "I:checking multi-stage positive validation OPTOUT/NSEC3 ($n)"
306 ret=0
307 $DIG $DIGOPTS +noauth a.nsec3.optout.example. \
308 @10.53.0.3 a > dig.out.ns3.test$n || ret=1
309 $DIG $DIGOPTS +noauth a.nsec3.optout.example. \
310 @10.53.0.4 a > dig.out.ns4.test$n || ret=1
311 $PERL ../digcomp.pl dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
312 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
313 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
314 n=`expr $n + 1`
315 if [ $ret != 0 ]; then echo "I:failed"; fi
316 status=`expr $status + $ret`
317
318 echo "I:checking multi-stage positive validation OPTOUT/OPTOUT ($n)"
319 ret=0
320 $DIG $DIGOPTS +noauth a.optout.optout.example. \
321 @10.53.0.3 a > dig.out.ns3.test$n || ret=1
322 $DIG $DIGOPTS +noauth a.optout.optout.example. \
323 @10.53.0.4 a > dig.out.ns4.test$n || ret=1
324 $PERL ../digcomp.pl dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
325 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
326 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
327 n=`expr $n + 1`
328 if [ $ret != 0 ]; then echo "I:failed"; fi
329 status=`expr $status + $ret`
330
331 echo "I:checking empty NODATA OPTOUT ($n)"
332 ret=0
333 $DIG $DIGOPTS +noauth empty.optout.example. \
334 @10.53.0.3 a > dig.out.ns3.test$n || ret=1
335 $DIG $DIGOPTS +noauth empty.optout.example. \
336 @10.53.0.4 a > dig.out.ns4.test$n || ret=1
337 $PERL ../digcomp.pl dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
338 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
339 #grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
340 n=`expr $n + 1`
341 if [ $ret != 0 ]; then echo "I:failed"; fi
342 status=`expr $status + $ret`
343
344 # Check the insecure.secure.example domain (insecurity proof)
345
346 echo "I:checking 2-server insecurity proof ($n)"
347 ret=0
348 $DIG $DIGOPTS +noauth a.insecure.secure.example. @10.53.0.2 a \
349 > dig.out.ns2.test$n || ret=1
350 $DIG $DIGOPTS +noauth a.insecure.secure.example. @10.53.0.4 a \
351 > dig.out.ns4.test$n || ret=1
352 $PERL ../digcomp.pl dig.out.ns2.test$n dig.out.ns4.test$n || ret=1
353 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
354 # Note - this is looking for failure, hence the &&
355 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1
356 n=`expr $n + 1`
357 if [ $ret != 0 ]; then echo "I:failed"; fi
358 status=`expr $status + $ret`
359
360 # Check a negative response in insecure.secure.example
361
362 echo "I:checking 2-server insecurity proof with a negative answer ($n)"
363 ret=0
364 $DIG $DIGOPTS q.insecure.secure.example. @10.53.0.2 a > dig.out.ns2.test$n \
365 || ret=1
366 $DIG $DIGOPTS q.insecure.secure.example. @10.53.0.4 a > dig.out.ns4.test$n \
367 || ret=1
368 $PERL ../digcomp.pl dig.out.ns2.test$n dig.out.ns4.test$n || ret=1
369 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1
370 # Note - this is looking for failure, hence the &&
371 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1
372 n=`expr $n + 1`
373 if [ $ret != 0 ]; then echo "I:failed"; fi
374 status=`expr $status + $ret`
375
376 echo "I:checking security root query ($n)"
377 ret=0
378 $DIG $DIGOPTS . @10.53.0.4 key > dig.out.ns4.test$n || ret=1
379 grep "NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
380 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
381 n=`expr $n + 1`
382 if [ $ret != 0 ]; then echo "I:failed"; fi
383 status=`expr $status + $ret`
384
385 echo "I:checking positive validation RSASHA256 NSEC ($n)"
386 ret=0
387 $DIG $DIGOPTS +noauth a.rsasha256.example. @10.53.0.3 a > dig.out.ns3.test$n || ret=1
388 $DIG $DIGOPTS +noauth a.rsasha256.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1
389 $PERL ../digcomp.pl dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
390 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
391 n=`expr $n + 1`
392 if [ $ret != 0 ]; then echo "I:failed"; fi
393 status=`expr $status + $ret`
394
395 echo "I:checking positive validation RSASHA512 NSEC ($n)"
396 ret=0
397 $DIG $DIGOPTS +noauth a.rsasha512.example. @10.53.0.3 a > dig.out.ns3.test$n || ret=1
398 $DIG $DIGOPTS +noauth a.rsasha512.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1
399 $PERL ../digcomp.pl dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
400 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
401 n=`expr $n + 1`
402 if [ $ret != 0 ]; then echo "I:failed"; fi
403 status=`expr $status + $ret`
404
405 echo "I:checking that positive validation in a privately secure zone works ($n)"
406 ret=0
407 $DIG $DIGOPTS +noauth a.private.secure.example. a @10.53.0.2 \
408 > dig.out.ns2.test$n || ret=1
409 $DIG $DIGOPTS +noauth a.private.secure.example. a @10.53.0.4 \
410 > dig.out.ns4.test$n || ret=1
411 $PERL ../digcomp.pl dig.out.ns2.test$n dig.out.ns4.test$n || ret=1
412 grep "NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
413 # Note - this is looking for failure, hence the &&
414 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1
415 n=`expr $n + 1`
416 if [ $ret != 0 ]; then echo "I:failed"; fi
417 status=`expr $status + $ret`
418
419 echo "I:checking that negative validation in a privately secure zone works ($n)"
420 ret=0
421 $DIG $DIGOPTS +noauth q.private.secure.example. a @10.53.0.2 \
422 > dig.out.ns2.test$n || ret=1
423 $DIG $DIGOPTS +noauth q.private.secure.example. a @10.53.0.4 \
424 > dig.out.ns4.test$n || ret=1
425 $PERL ../digcomp.pl dig.out.ns2.test$n dig.out.ns4.test$n || ret=1
426 grep "NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1
427 # Note - this is looking for failure, hence the &&
428 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1
429 n=`expr $n + 1`
430 if [ $ret != 0 ]; then echo "I:failed"; fi
431 status=`expr $status + $ret`
432
433 echo "I:checking privately secure to nxdomain works ($n)"
434 ret=0
435 $DIG $DIGOPTS +noauth private2secure-nxdomain.private.secure.example. SOA @10.53.0.2 \
436 > dig.out.ns2.test$n || ret=1
437 $DIG $DIGOPTS +noauth private2secure-nxdomain.private.secure.example. SOA @10.53.0.4 \
438 > dig.out.ns4.test$n || ret=1
439 $PERL ../digcomp.pl dig.out.ns2.test$n dig.out.ns4.test$n || ret=1
440 # Note - this is looking for failure, hence the &&
441 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1
442 n=`expr $n + 1`
443 if [ $ret != 0 ]; then echo "I:failed"; fi
444 status=`expr $status + $ret`
445
446 # Try validating with a revoked trusted key.
447 # This should fail.
448
449 echo "I:checking that validation fails due to revoked trusted key ($n)"
450 ret=0
451 $DIG $DIGOPTS example. soa @10.53.0.5 > dig.out.ns5.test$n || ret=1
452 grep "SERVFAIL" dig.out.ns5.test$n > /dev/null || ret=1
453 n=`expr $n + 1`
454 if [ $ret != 0 ]; then echo "I:failed"; fi
455 status=`expr $status + $ret`
456
457 echo "I:checking that revoked key is present ($n)"
458 ret=0
459 id=`sed 's/^K.+005+0*//' < rev.key`
460 id=`expr $id + 128 % 65536`
461 $DIG $DIGOPTS +multi dnskey . @10.53.0.1 > dig.out.ns1.test$n || ret=1
462 grep '; key id = '"$id"'$' dig.out.ns1.test$n > /dev/null || ret=1
463 n=`expr $n + 1`
464 if [ $ret != 0 ]; then echo "I:failed"; fi
465 status=`expr $status + $ret`
466
467 echo "I:checking that revoked key self-signs ($n)"
468 ret=0
469 id=`sed 's/^K.+005+0*//' < rev.key`
470 id=`expr $id + 128 % 65536`
471 $DIG $DIGOPTS dnskey . @10.53.0.1 > dig.out.ns1.test$n || ret=1
472 grep 'RRSIG.*'" $id "'\. ' dig.out.ns1.test$n > /dev/null || ret=1
473 n=`expr $n + 1`
474 if [ $ret != 0 ]; then echo "I:failed"; fi
475 status=`expr $status + $ret`
476
477 echo "I:checking for unpublished key ($n)"
478 ret=0
479 id=`sed 's/^K.+005+0*//' < unpub.key`
480 $DIG $DIGOPTS +multi dnskey . @10.53.0.1 > dig.out.ns1.test$n || ret=1
481 grep '; key id = '"$id"'$' dig.out.ns1.test$n > /dev/null && ret=1
482 n=`expr $n + 1`
483 if [ $ret != 0 ]; then echo "I:failed"; fi
484 status=`expr $status + $ret`
485
486 echo "I:checking that standby key does not sign records ($n)"
487 ret=0
488 id=`sed 's/^K.+005+0*//' < standby.key`
489 $DIG $DIGOPTS dnskey . @10.53.0.1 > dig.out.ns1.test$n || ret=1
490 grep 'RRSIG.*'" $id "'\. ' dig.out.ns1.test$n > /dev/null && ret=1
491 n=`expr $n + 1`
492 if [ $ret != 0 ]; then echo "I:failed"; fi
493 status=`expr $status + $ret`
494
495 echo "I:checking that deactivated key does not sign records ($n)"
496 ret=0
497 id=`sed 's/^K.+005+0*//' < inact.key`
498 $DIG $DIGOPTS dnskey . @10.53.0.1 > dig.out.ns1.test$n || ret=1
499 grep 'RRSIG.*'" $id "'\. ' dig.out.ns1.test$n > /dev/null && ret=1
500 n=`expr $n + 1`
501 if [ $ret != 0 ]; then echo "I:failed"; fi
502 status=`expr $status + $ret`
503
504 echo "I:checking key deletion ($n)"
505 ret=0
506 id=`sed 's/^K.+005+0*//' < del.key`
507 $DIG $DIGOPTS +multi dnskey . @10.53.0.1 > dig.out.ns1.test$n || ret=1
508 grep '; key id = '"$id"'$' dig.out.ns1.test$n > /dev/null && ret=1
509 n=`expr $n + 1`
510 if [ $ret != 0 ]; then echo "I:failed"; fi
511 status=`expr $status + $ret`
512
513 echo "I:exit status: $status"
514
515 exit $status
NetBSD on the FriendlyARM MINI2440