external/bsd/bind/dist/bin/tests/system/dnssec/tests.sh

   1 #!/bin/sh
   2 #
   3 # Copyright (C) 2004-2009  Internet Systems Consortium, Inc. ("ISC")
   4 # Copyright (C) 2000-2002  Internet Software Consortium.
   5 #
   6 # Permission to use, copy, modify, and/or distribute this software for any
   7 # purpose with or without fee is hereby granted, provided that the above
   8 # copyright notice and this permission notice appear in all copies.
   9 #
  10 # THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
  11 # REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
  12 # AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
  13 # INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
  14 # LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
  15 # OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  16 # PERFORMANCE OF THIS SOFTWARE.
  17
  18 # Id: tests.sh,v 1.55 2009/10/27 23:47:44 tbox Exp
  19
  20 SYSTEMTESTTOP=..
  21 . $SYSTEMTESTTOP/conf.sh
  22
  23 status=0
  24 n=0
  25
  26 rm -f dig.out.*
  27
  28 DIGOPTS="+tcp +noadd +nosea +nostat +nocmd +dnssec -p 5300"
  29
  30 # Check the example. domain
  31
  32 echo "I:checking that zone transfer worked ($n)"
  33 ret=0
  34 $DIG $DIGOPTS a.example. @10.53.0.2 a > dig.out.ns2.test$n || ret=1
  35 $DIG $DIGOPTS a.example. @10.53.0.3 a > dig.out.ns3.test$n || ret=1
  36 $PERL ../digcomp.pl dig.out.ns2.test$n dig.out.ns3.test$n || ret=1
  37 n=`expr $n + 1`
  38 if [ $ret != 0 ]; then echo "I:failed"; fi
  39 status=`expr $status + $ret`
  40
  41 echo "I:checking positive validation NSEC ($n)"
  42 ret=0
  43 $DIG $DIGOPTS +noauth a.example. @10.53.0.2 a > dig.out.ns2.test$n || ret=1
  44 $DIG $DIGOPTS +noauth a.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1
  45 $PERL ../digcomp.pl dig.out.ns2.test$n dig.out.ns4.test$n || ret=1
  46 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
  47 n=`expr $n + 1`
  48 if [ $ret != 0 ]; then echo "I:failed"; fi
  49 status=`expr $status + $ret`
  50
  51 echo "I:checking positive validation NSEC3 ($n)"
  52 ret=0
  53 $DIG $DIGOPTS +noauth a.nsec3.example. \
  54         @10.53.0.3 a > dig.out.ns3.test$n || ret=1
  55 $DIG $DIGOPTS +noauth a.nsec3.example. \
  56         @10.53.0.4 a > dig.out.ns4.test$n || ret=1
  57 $PERL ../digcomp.pl dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
  58 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
  59 n=`expr $n + 1`
  60 if [ $ret != 0 ]; then echo "I:failed"; fi
  61 status=`expr $status + $ret`
  62
  63 echo "I:checking positive validation OPTOUT ($n)"
  64 ret=0
  65 $DIG $DIGOPTS +noauth a.optout.example. \
  66         @10.53.0.3 a > dig.out.ns3.test$n || ret=1
  67 $DIG $DIGOPTS +noauth a.optout.example. \
  68         @10.53.0.4 a > dig.out.ns4.test$n || ret=1
  69 $PERL ../digcomp.pl dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
  70 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
  71 n=`expr $n + 1`
  72 if [ $ret != 0 ]; then echo "I:failed"; fi
  73 status=`expr $status + $ret`
  74
  75 echo "I:checking positive wildcard validation NSEC ($n)"
  76 ret=0
  77 $DIG $DIGOPTS a.wild.example. @10.53.0.2 a > dig.out.ns2.test$n || ret=1
  78 $DIG $DIGOPTS a.wild.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1
  79 $PERL ../digcomp.pl dig.out.ns2.test$n dig.out.ns4.test$n || ret=1
  80 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
  81 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
  82 n=`expr $n + 1`
  83 if [ $ret != 0 ]; then echo "I:failed"; fi
  84 status=`expr $status + $ret`
  85
  86 echo "I:checking positive wildcard validation NSEC3 ($n)"
  87 ret=0
  88 $DIG $DIGOPTS a.wild.nsec3.example. @10.53.0.3 a > dig.out.ns3.test$n || ret=1
  89 $DIG $DIGOPTS a.wild.nsec3.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1
  90 $PERL ../digcomp.pl dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
  91 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
  92 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
  93 n=`expr $n + 1`
  94 if [ $ret != 0 ]; then echo "I:failed"; fi
  95 status=`expr $status + $ret`
  96
  97 echo "I:checking positive wildcard validation OPTOUT ($n)"
  98 ret=0
  99 $DIG $DIGOPTS a.wild.optout.example. \
 100         @10.53.0.3 a > dig.out.ns3.test$n || ret=1
 101 $DIG $DIGOPTS a.wild.optout.example. \
 102         @10.53.0.4 a > dig.out.ns4.test$n || ret=1
 103 $PERL ../digcomp.pl dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
 104 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
 105 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 106 n=`expr $n + 1`
 107 if [ $ret != 0 ]; then echo "I:failed"; fi
 108 status=`expr $status + $ret`
 109
 110 echo "I:checking negative validation NXDOMAIN NSEC ($n)"
 111 ret=0
 112 $DIG $DIGOPTS +noauth q.example. @10.53.0.2 a > dig.out.ns2.test$n || ret=1
 113 $DIG $DIGOPTS +noauth q.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1
 114 $PERL ../digcomp.pl dig.out.ns2.test$n dig.out.ns4.test$n || ret=1
 115 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
 116 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1
 117 n=`expr $n + 1`
 118 if [ $ret != 0 ]; then echo "I:failed"; fi
 119 status=`expr $status + $ret`
 120
 121 echo "I:checking negative validation NXDOMAIN NSEC3 ($n)"
 122 ret=0
 123 $DIG $DIGOPTS +noauth q.nsec3.example. \
 124         @10.53.0.3 a > dig.out.ns3.test$n || ret=1
 125 $DIG $DIGOPTS +noauth q.nsec3.example. \
 126         @10.53.0.4 a > dig.out.ns4.test$n || ret=1
 127 $PERL ../digcomp.pl dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
 128 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
 129 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1
 130 n=`expr $n + 1`
 131 if [ $ret != 0 ]; then echo "I:failed"; fi
 132 status=`expr $status + $ret`
 133
 134 echo "I:checking negative validation NXDOMAIN OPTOUT ($n)"
 135 ret=0
 136 $DIG $DIGOPTS +noauth q.optout.example. \
 137         @10.53.0.3 a > dig.out.ns3.test$n || ret=1
 138 $DIG $DIGOPTS +noauth q.optout.example. \
 139         @10.53.0.4 a > dig.out.ns4.test$n || ret=1
 140 $PERL ../digcomp.pl dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
 141 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1
 142 # Note - this is looking for failure, hence the &&
 143 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1
 144 n=`expr $n + 1`
 145 if [ $ret != 0 ]; then echo "I:failed"; fi
 146 status=`expr $status + $ret`
 147
 148 echo "I:checking negative validation NODATA NSEC ($n)"
 149 ret=0
 150 $DIG $DIGOPTS +noauth a.example. @10.53.0.2 txt > dig.out.ns2.test$n || ret=1
 151 $DIG $DIGOPTS +noauth a.example. @10.53.0.4 txt > dig.out.ns4.test$n || ret=1
 152 $PERL ../digcomp.pl dig.out.ns2.test$n dig.out.ns4.test$n || ret=1
 153 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
 154 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 155 grep "ANSWER: 0" dig.out.ns4.test$n > /dev/null || ret=1
 156 n=`expr $n + 1`
 157 if [ $ret != 0 ]; then echo "I:failed"; fi
 158 status=`expr $status + $ret`
 159
 160 echo "I:checking negative validation NODATA NSEC3 ($n)"
 161 ret=0
 162 $DIG $DIGOPTS +noauth a.nsec3.example. \
 163         @10.53.0.3 txt > dig.out.ns3.test$n || ret=1
 164 $DIG $DIGOPTS +noauth a.nsec3.example. \
 165         @10.53.0.4 txt > dig.out.ns4.test$n || ret=1
 166 $PERL ../digcomp.pl dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
 167 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
 168 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 169 grep "ANSWER: 0" dig.out.ns4.test$n > /dev/null || ret=1
 170 n=`expr $n + 1`
 171 if [ $ret != 0 ]; then echo "I:failed"; fi
 172 status=`expr $status + $ret`
 173
 174 echo "I:checking negative validation NODATA OPTOUT ($n)"
 175 ret=0
 176 $DIG $DIGOPTS +noauth a.optout.example. \
 177         @10.53.0.3 txt > dig.out.ns3.test$n || ret=1
 178 $DIG $DIGOPTS +noauth a.optout.example. \
 179         @10.53.0.4 txt > dig.out.ns4.test$n || ret=1
 180 $PERL ../digcomp.pl dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
 181 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
 182 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 183 grep "ANSWER: 0" dig.out.ns4.test$n > /dev/null || ret=1
 184 n=`expr $n + 1`
 185 if [ $ret != 0 ]; then echo "I:failed"; fi
 186 status=`expr $status + $ret`
 187
 188 echo "I:checking negative wildcard validation NSEC ($n)"
 189 ret=0
 190 $DIG $DIGOPTS b.wild.example. @10.53.0.2 txt > dig.out.ns2.test$n || ret=1
 191 $DIG $DIGOPTS b.wild.example. @10.53.0.4 txt > dig.out.ns4.test$n || ret=1
 192 $PERL ../digcomp.pl dig.out.ns2.test$n dig.out.ns4.test$n || ret=1
 193 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
 194 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 195 n=`expr $n + 1`
 196 if [ $ret != 0 ]; then echo "I:failed"; fi
 197 status=`expr $status + $ret`
 198
 199 echo "I:checking negative wildcard validation NSEC3 ($n)"
 200 ret=0
 201 $DIG $DIGOPTS b.wild.nsec3.example. @10.53.0.3 txt > dig.out.ns3.test$n || ret=1
 202 $DIG $DIGOPTS b.wild.nsec3.example. @10.53.0.4 txt > dig.out.ns4.test$n || ret=1
 203 $PERL ../digcomp.pl dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
 204 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
 205 n=`expr $n + 1`
 206 if [ $ret != 0 ]; then echo "I:failed"; fi
 207 status=`expr $status + $ret`
 208
 209 echo "I:checking negative wildcard validation OPTOUT ($n)"
 210 ret=0
 211 $DIG $DIGOPTS b.wild.optout.example. \
 212         @10.53.0.3 txt > dig.out.ns3.test$n || ret=1
 213 $DIG $DIGOPTS b.wild.optout.example. \
 214         @10.53.0.4 txt > dig.out.ns4.test$n || ret=1
 215 $PERL ../digcomp.pl dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
 216 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 217 # Note - this is looking for failure, hence the &&
 218 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1
 219 n=`expr $n + 1`
 220 if [ $ret != 0 ]; then echo "I:failed"; fi
 221 status=`expr $status + $ret`
 222
 223 # Check the insecure.example domain
 224
 225 echo "I:checking 1-server insecurity proof NSEC ($n)"
 226 ret=0
 227 $DIG $DIGOPTS +noauth a.insecure.example. @10.53.0.3 a > dig.out.ns3.test$n || ret=1
 228 $DIG $DIGOPTS +noauth a.insecure.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1
 229 $PERL ../digcomp.pl dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
 230 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 231 # Note - this is looking for failure, hence the &&
 232 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1
 233 n=`expr $n + 1`
 234 if [ $ret != 0 ]; then echo "I:failed"; fi
 235 status=`expr $status + $ret`
 236
 237 echo "I:checking 1-server insecurity proof NSEC3 ($n)"
 238 ret=0
 239 $DIG $DIGOPTS +noauth a.insecure.nsec3.example. @10.53.0.3 a > dig.out.ns3.test$n || ret=1
 240 $DIG $DIGOPTS +noauth a.insecure.nsec3.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1
 241 $PERL ../digcomp.pl dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
 242 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 243 # Note - this is looking for failure, hence the &&
 244 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1
 245 n=`expr $n + 1`
 246 if [ $ret != 0 ]; then echo "I:failed"; fi
 247 status=`expr $status + $ret`
 248
 249 echo "I:checking 1-server insecurity proof OPTOUT ($n)"
 250 ret=0
 251 $DIG $DIGOPTS +noauth a.insecure.optout.example. @10.53.0.3 a > dig.out.ns3.test$n || ret=1
 252 $DIG $DIGOPTS +noauth a.insecure.optout.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1
 253 $PERL ../digcomp.pl dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
 254 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 255 # Note - this is looking for failure, hence the &&
 256 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1
 257 n=`expr $n + 1`
 258 if [ $ret != 0 ]; then echo "I:failed"; fi
 259 status=`expr $status + $ret`
 260
 261 echo "I:checking 1-server negative insecurity proof NSEC ($n)"
 262 ret=0
 263 $DIG $DIGOPTS q.insecure.example. a @10.53.0.3 \
 264         > dig.out.ns3.test$n || ret=1
 265 $DIG $DIGOPTS q.insecure.example. a @10.53.0.4 \
 266         > dig.out.ns4.test$n || ret=1
 267 $PERL ../digcomp.pl dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
 268 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1
 269 # Note - this is looking for failure, hence the &&
 270 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1
 271 n=`expr $n + 1`
 272 if [ $ret != 0 ]; then echo "I:failed"; fi
 273 status=`expr $status + $ret`
 274
 275 echo "I:checking 1-server negative insecurity proof NSEC3 ($n)"
 276 ret=0
 277 $DIG $DIGOPTS q.insecure.nsec3.example. a @10.53.0.3 \
 278         > dig.out.ns3.test$n || ret=1
 279 $DIG $DIGOPTS q.insecure.nsec3.example. a @10.53.0.4 \
 280         > dig.out.ns4.test$n || ret=1
 281 $PERL ../digcomp.pl dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
 282 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1
 283 # Note - this is looking for failure, hence the &&
 284 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1
 285 n=`expr $n + 1`
 286 if [ $ret != 0 ]; then echo "I:failed"; fi
 287 status=`expr $status + $ret`
 288
 289 echo "I:checking 1-server negative insecurity proof OPTOUT ($n)"
 290 ret=0
 291 $DIG $DIGOPTS q.insecure.optout.example. a @10.53.0.3 \
 292         > dig.out.ns3.test$n || ret=1
 293 $DIG $DIGOPTS q.insecure.optout.example. a @10.53.0.4 \
 294         > dig.out.ns4.test$n || ret=1
 295 $PERL ../digcomp.pl dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
 296 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1
 297 # Note - this is looking for failure, hence the &&
 298 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1
 299 n=`expr $n + 1`
 300 if [ $ret != 0 ]; then echo "I:failed"; fi
 301 status=`expr $status + $ret`
 302
 303 echo "I:checking 1-server negative insecurity proof with SOA hack NSEC ($n)"
 304 ret=0
 305 $DIG $DIGOPTS r.insecure.example. soa @10.53.0.3 \
 306         > dig.out.ns3.test$n || ret=1
 307 $DIG $DIGOPTS r.insecure.example. soa @10.53.0.4 \
 308         > dig.out.ns4.test$n || ret=1
 309 $PERL ../digcomp.pl dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
 310 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1
 311 grep "0 IN      SOA" dig.out.ns4.test$n > /dev/null || ret=1
 312 # Note - this is looking for failure, hence the &&
 313 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1
 314 n=`expr $n + 1`
 315 if [ $ret != 0 ]; then echo "I:failed"; fi
 316 status=`expr $status + $ret`
 317
 318 echo "I:checking 1-server negative insecurity proof with SOA hack NSEC3 ($n)"
 319 ret=0
 320 $DIG $DIGOPTS r.insecure.nsec3.example. soa @10.53.0.3 \
 321         > dig.out.ns3.test$n || ret=1
 322 $DIG $DIGOPTS r.insecure.nsec3.example. soa @10.53.0.4 \
 323         > dig.out.ns4.test$n || ret=1
 324 $PERL ../digcomp.pl dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
 325 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1
 326 grep "0 IN      SOA" dig.out.ns4.test$n > /dev/null || ret=1
 327 # Note - this is looking for failure, hence the &&
 328 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1
 329 n=`expr $n + 1`
 330 if [ $ret != 0 ]; then echo "I:failed"; fi
 331 status=`expr $status + $ret`
 332
 333 echo "I:checking 1-server negative insecurity proof with SOA hack OPTOUT ($n)"
 334 ret=0
 335 $DIG $DIGOPTS r.insecure.optout.example. soa @10.53.0.3 \
 336         > dig.out.ns3.test$n || ret=1
 337 $DIG $DIGOPTS r.insecure.optout.example. soa @10.53.0.4 \
 338         > dig.out.ns4.test$n || ret=1
 339 $PERL ../digcomp.pl dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
 340 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1
 341 grep "0 IN      SOA" dig.out.ns4.test$n > /dev/null || ret=1
 342 # Note - this is looking for failure, hence the &&
 343 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1
 344 n=`expr $n + 1`
 345 if [ $ret != 0 ]; then echo "I:failed"; fi
 346 status=`expr $status + $ret`
 347
 348 # Check the secure.example domain
 349
 350 echo "I:checking multi-stage positive validation NSEC/NSEC ($n)"
 351 ret=0
 352 $DIG $DIGOPTS +noauth a.secure.example. \
 353         @10.53.0.3 a > dig.out.ns3.test$n || ret=1
 354 $DIG $DIGOPTS +noauth a.secure.example. \
 355         @10.53.0.4 a > dig.out.ns4.test$n || ret=1
 356 $PERL ../digcomp.pl dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
 357 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 358 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
 359 n=`expr $n + 1`
 360 if [ $ret != 0 ]; then echo "I:failed"; fi
 361 status=`expr $status + $ret`
 362
 363 echo "I:checking multi-stage positive validation NSEC/NSEC3 ($n)"
 364 ret=0
 365 $DIG $DIGOPTS +noauth a.nsec3.example. \
 366         @10.53.0.3 a > dig.out.ns3.test$n || ret=1
 367 $DIG $DIGOPTS +noauth a.nsec3.example. \
 368         @10.53.0.4 a > dig.out.ns4.test$n || ret=1
 369 $PERL ../digcomp.pl dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
 370 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 371 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
 372 n=`expr $n + 1`
 373 if [ $ret != 0 ]; then echo "I:failed"; fi
 374 status=`expr $status + $ret`
 375
 376 echo "I:checking multi-stage positive validation NSEC/OPTOUT ($n)"
 377 ret=0
 378 $DIG $DIGOPTS +noauth a.optout.example. \
 379         @10.53.0.3 a > dig.out.ns3.test$n || ret=1
 380 $DIG $DIGOPTS +noauth a.optout.example. \
 381         @10.53.0.4 a > dig.out.ns4.test$n || ret=1
 382 $PERL ../digcomp.pl dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
 383 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 384 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
 385 n=`expr $n + 1`
 386 if [ $ret != 0 ]; then echo "I:failed"; fi
 387 status=`expr $status + $ret`
 388
 389 echo "I:checking multi-stage positive validation NSEC3/NSEC ($n)"
 390 ret=0
 391 $DIG $DIGOPTS +noauth a.secure.nsec3.example. \
 392         @10.53.0.3 a > dig.out.ns3.test$n || ret=1
 393 $DIG $DIGOPTS +noauth a.secure.nsec3.example. \
 394         @10.53.0.4 a > dig.out.ns4.test$n || ret=1
 395 $PERL ../digcomp.pl dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
 396 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 397 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
 398 n=`expr $n + 1`
 399 if [ $ret != 0 ]; then echo "I:failed"; fi
 400 status=`expr $status + $ret`
 401
 402 echo "I:checking multi-stage positive validation NSEC3/NSEC3 ($n)"
 403 ret=0
 404 $DIG $DIGOPTS +noauth a.nsec3.nsec3.example. \
 405         @10.53.0.3 a > dig.out.ns3.test$n || ret=1
 406 $DIG $DIGOPTS +noauth a.nsec3.nsec3.example. \
 407         @10.53.0.4 a > dig.out.ns4.test$n || ret=1
 408 $PERL ../digcomp.pl dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
 409 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 410 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
 411 n=`expr $n + 1`
 412 if [ $ret != 0 ]; then echo "I:failed"; fi
 413 status=`expr $status + $ret`
 414
 415 echo "I:checking multi-stage positive validation NSEC3/OPTOUT ($n)"
 416 ret=0
 417 $DIG $DIGOPTS +noauth a.optout.nsec3.example. \
 418         @10.53.0.3 a > dig.out.ns3.test$n || ret=1
 419 $DIG $DIGOPTS +noauth a.optout.nsec3.example. \
 420         @10.53.0.4 a > dig.out.ns4.test$n || ret=1
 421 $PERL ../digcomp.pl dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
 422 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 423 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
 424 n=`expr $n + 1`
 425 if [ $ret != 0 ]; then echo "I:failed"; fi
 426 status=`expr $status + $ret`
 427
 428 echo "I:checking multi-stage positive validation OPTOUT/NSEC ($n)"
 429 ret=0
 430 $DIG $DIGOPTS +noauth a.secure.optout.example. \
 431         @10.53.0.3 a > dig.out.ns3.test$n || ret=1
 432 $DIG $DIGOPTS +noauth a.secure.optout.example. \
 433         @10.53.0.4 a > dig.out.ns4.test$n || ret=1
 434 $PERL ../digcomp.pl dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
 435 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 436 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
 437 n=`expr $n + 1`
 438 if [ $ret != 0 ]; then echo "I:failed"; fi
 439 status=`expr $status + $ret`
 440
 441 echo "I:checking multi-stage positive validation OPTOUT/NSEC3 ($n)"
 442 ret=0
 443 $DIG $DIGOPTS +noauth a.nsec3.optout.example. \
 444         @10.53.0.3 a > dig.out.ns3.test$n || ret=1
 445 $DIG $DIGOPTS +noauth a.nsec3.optout.example. \
 446         @10.53.0.4 a > dig.out.ns4.test$n || ret=1
 447 $PERL ../digcomp.pl dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
 448 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 449 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
 450 n=`expr $n + 1`
 451 if [ $ret != 0 ]; then echo "I:failed"; fi
 452 status=`expr $status + $ret`
 453
 454 echo "I:checking multi-stage positive validation OPTOUT/OPTOUT ($n)"
 455 ret=0
 456 $DIG $DIGOPTS +noauth a.optout.optout.example. \
 457         @10.53.0.3 a > dig.out.ns3.test$n || ret=1
 458 $DIG $DIGOPTS +noauth a.optout.optout.example. \
 459         @10.53.0.4 a > dig.out.ns4.test$n || ret=1
 460 $PERL ../digcomp.pl dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
 461 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 462 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
 463 n=`expr $n + 1`
 464 if [ $ret != 0 ]; then echo "I:failed"; fi
 465 status=`expr $status + $ret`
 466
 467 echo "I:checking empty NODATA OPTOUT ($n)"
 468 ret=0
 469 $DIG $DIGOPTS +noauth empty.optout.example. \
 470         @10.53.0.3 a > dig.out.ns3.test$n || ret=1
 471 $DIG $DIGOPTS +noauth empty.optout.example. \
 472         @10.53.0.4 a > dig.out.ns4.test$n || ret=1
 473 $PERL ../digcomp.pl dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
 474 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 475 #grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
 476 n=`expr $n + 1`
 477 if [ $ret != 0 ]; then echo "I:failed"; fi
 478 status=`expr $status + $ret`
 479
 480 # Check the bogus domain
 481
 482 echo "I:checking failed validation ($n)"
 483 ret=0
 484 $DIG $DIGOPTS a.bogus.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1
 485 grep "SERVFAIL" dig.out.ns4.test$n > /dev/null || ret=1
 486 n=`expr $n + 1`
 487 if [ $ret != 0 ]; then echo "I:failed"; fi
 488 status=`expr $status + $ret`
 489
 490 # Try validating with a bad trusted key.
 491 # This should fail.
 492
 493 echo "I:checking that validation fails with a misconfigured trusted key ($n)"
 494 ret=0
 495 $DIG $DIGOPTS example. soa @10.53.0.5 > dig.out.ns5.test$n || ret=1
 496 grep "SERVFAIL" dig.out.ns5.test$n > /dev/null || ret=1
 497 n=`expr $n + 1`
 498 if [ $ret != 0 ]; then echo "I:failed"; fi
 499 status=`expr $status + $ret`
 500
 501 echo "I:checking that negative validation fails with a misconfigured trusted key ($n)"
 502 ret=0
 503 $DIG $DIGOPTS example. ptr @10.53.0.5 > dig.out.ns5.test$n || ret=1
 504 grep "SERVFAIL" dig.out.ns5.test$n > /dev/null || ret=1
 505 n=`expr $n + 1`
 506 if [ $ret != 0 ]; then echo "I:failed"; fi
 507 status=`expr $status + $ret`
 508
 509 echo "I:checking that insecurity proofs fail with a misconfigured trusted key ($n)"
 510 ret=0
 511 $DIG $DIGOPTS a.insecure.example. a @10.53.0.5 > dig.out.ns5.test$n || ret=1
 512 grep "SERVFAIL" dig.out.ns5.test$n > /dev/null || ret=1
 513 n=`expr $n + 1`
 514 if [ $ret != 0 ]; then echo "I:failed"; fi
 515 status=`expr $status + $ret`
 516
 517 echo "I:checking that validation fails when key record is missing ($n)"
 518 ret=0
 519 $DIG $DIGOPTS a.b.keyless.example. a @10.53.0.4 > dig.out.ns4.test$n || ret=1
 520 grep "SERVFAIL" dig.out.ns4.test$n > /dev/null || ret=1
 521 n=`expr $n + 1`
 522 if [ $ret != 0 ]; then echo "I:failed"; fi
 523 status=`expr $status + $ret`
 524
 525 # Check the insecure.secure.example domain (insecurity proof)
 526
 527 echo "I:checking 2-server insecurity proof ($n)"
 528 ret=0
 529 $DIG $DIGOPTS +noauth a.insecure.secure.example. @10.53.0.2 a \
 530         > dig.out.ns2.test$n || ret=1
 531 $DIG $DIGOPTS +noauth a.insecure.secure.example. @10.53.0.4 a \
 532         > dig.out.ns4.test$n || ret=1
 533 $PERL ../digcomp.pl dig.out.ns2.test$n dig.out.ns4.test$n || ret=1
 534 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 535 # Note - this is looking for failure, hence the &&
 536 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1
 537 n=`expr $n + 1`
 538 if [ $ret != 0 ]; then echo "I:failed"; fi
 539 status=`expr $status + $ret`
 540
 541 # Check a negative response in insecure.secure.example
 542
 543 echo "I:checking 2-server insecurity proof with a negative answer ($n)"
 544 ret=0
 545 $DIG $DIGOPTS q.insecure.secure.example. @10.53.0.2 a > dig.out.ns2.test$n \
 546         || ret=1
 547 $DIG $DIGOPTS q.insecure.secure.example. @10.53.0.4 a > dig.out.ns4.test$n \
 548         || ret=1
 549 $PERL ../digcomp.pl dig.out.ns2.test$n dig.out.ns4.test$n || ret=1
 550 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1
 551 # Note - this is looking for failure, hence the &&
 552 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1
 553 n=`expr $n + 1`
 554 if [ $ret != 0 ]; then echo "I:failed"; fi
 555 status=`expr $status + $ret`
 556
 557 echo "I:checking 2-server insecurity proof with a negative answer and SOA hack ($n)"
 558 ret=0
 559 $DIG $DIGOPTS r.insecure.secure.example. @10.53.0.2 soa > dig.out.ns2.test$n \
 560         || ret=1
 561 $DIG $DIGOPTS r.insecure.secure.example. @10.53.0.4 soa > dig.out.ns4.test$n \
 562         || ret=1
 563 $PERL ../digcomp.pl dig.out.ns2.test$n dig.out.ns4.test$n || ret=1
 564 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1
 565 # Note - this is looking for failure, hence the &&
 566 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1
 567 n=`expr $n + 1`
 568 if [ $ret != 0 ]; then echo "I:failed"; fi
 569 status=`expr $status + $ret`
 570
 571 # Check that the query for a security root is successful and has ad set
 572
 573 echo "I:checking security root query ($n)"
 574 ret=0
 575 $DIG $DIGOPTS . @10.53.0.4 key > dig.out.ns4.test$n || ret=1
 576 grep "NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 577 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
 578 n=`expr $n + 1`
 579 if [ $ret != 0 ]; then echo "I:failed"; fi
 580 status=`expr $status + $ret`
 581
 582 # Check that the setting the cd bit works
 583
 584 echo "I:checking cd bit on a positive answer ($n)"
 585 ret=0
 586 $DIG $DIGOPTS +noauth example. soa @10.53.0.4 \
 587         > dig.out.ns4.test$n || ret=1
 588 $DIG $DIGOPTS +noauth +cdflag example. soa @10.53.0.5 \
 589         > dig.out.ns5.test$n || ret=1
 590 $PERL ../digcomp.pl dig.out.ns4.test$n dig.out.ns5.test$n || ret=1
 591 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
 592 # Note - this is looking for failure, hence the &&
 593 grep "flags:.*ad.*QUERY" dig.out.ns5.test$n > /dev/null && ret=1
 594 n=`expr $n + 1`
 595 if [ $ret != 0 ]; then echo "I:failed"; fi
 596 status=`expr $status + $ret`
 597
 598 echo "I:checking cd bit on a negative answer ($n)"
 599 ret=0
 600 $DIG $DIGOPTS q.example. soa @10.53.0.4 > dig.out.ns4.test$n || ret=1
 601 $DIG $DIGOPTS +cdflag q.example. soa @10.53.0.5 > dig.out.ns5.test$n || ret=1
 602 $PERL ../digcomp.pl dig.out.ns4.test$n dig.out.ns5.test$n || ret=1
 603 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
 604 # Note - this is looking for failure, hence the &&
 605 grep "flags:.*ad.*QUERY" dig.out.ns5.test$n > /dev/null && ret=1
 606 n=`expr $n + 1`
 607 if [ $ret != 0 ]; then echo "I:failed"; fi
 608 status=`expr $status + $ret`
 609
 610 echo "I:checking positive validation RSASHA256 NSEC ($n)"
 611 ret=0
 612 $DIG $DIGOPTS +noauth a.rsasha256.example. @10.53.0.3 a > dig.out.ns3.test$n || ret=1
 613 $DIG $DIGOPTS +noauth a.rsasha256.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1
 614 $PERL ../digcomp.pl dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
 615 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
 616 n=`expr $n + 1`
 617 if [ $ret != 0 ]; then echo "I:failed"; fi
 618 status=`expr $status + $ret`
 619
 620 echo "I:checking positive validation RSASHA512 NSEC ($n)"
 621 ret=0
 622 $DIG $DIGOPTS +noauth a.rsasha512.example. @10.53.0.3 a > dig.out.ns3.test$n || ret=1
 623 $DIG $DIGOPTS +noauth a.rsasha512.example. @10.53.0.4 a > dig.out.ns4.test$n || ret=1
 624 $PERL ../digcomp.pl dig.out.ns3.test$n dig.out.ns4.test$n || ret=1
 625 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
 626 n=`expr $n + 1`
 627 if [ $ret != 0 ]; then echo "I:failed"; fi
 628 status=`expr $status + $ret`
 629
 630 echo "I:checking cd bit on a query that should fail ($n)"
 631 ret=0
 632 $DIG $DIGOPTS a.bogus.example. soa @10.53.0.4 \
 633         > dig.out.ns4.test$n || ret=1
 634 $DIG $DIGOPTS +cdflag a.bogus.example. soa @10.53.0.5 \
 635         > dig.out.ns5.test$n || ret=1
 636 $PERL ../digcomp.pl dig.out.ns4.test$n dig.out.ns5.test$n || ret=1
 637 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null || ret=1
 638 # Note - this is looking for failure, hence the &&
 639 grep "flags:.*ad.*QUERY" dig.out.ns5.test$n > /dev/null && ret=1
 640 n=`expr $n + 1`
 641 if [ $ret != 0 ]; then echo "I:failed"; fi
 642 status=`expr $status + $ret`
 643
 644 echo "I:checking cd bit on an insecurity proof ($n)"
 645 ret=0
 646 $DIG $DIGOPTS +noauth a.insecure.example. soa @10.53.0.4 \
 647         > dig.out.ns4.test$n || ret=1
 648 $DIG $DIGOPTS +noauth +cdflag a.insecure.example. soa @10.53.0.5 \
 649         > dig.out.ns5.test$n || ret=1
 650 $PERL ../digcomp.pl dig.out.ns4.test$n dig.out.ns5.test$n || ret=1
 651 grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 652 # Note - these are looking for failure, hence the &&
 653 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1
 654 grep "flags:.*ad.*QUERY" dig.out.ns5.test$n > /dev/null && ret=1
 655 n=`expr $n + 1`
 656 if [ $ret != 0 ]; then echo "I:failed"; fi
 657 status=`expr $status + $ret`
 658
 659 echo "I:checking cd bit on a negative insecurity proof ($n)"
 660 ret=0
 661 $DIG $DIGOPTS q.insecure.example. a @10.53.0.4 \
 662         > dig.out.ns4.test$n || ret=1
 663 $DIG $DIGOPTS +cdflag q.insecure.example. a @10.53.0.5 \
 664         > dig.out.ns5.test$n || ret=1
 665 $PERL ../digcomp.pl dig.out.ns4.test$n dig.out.ns5.test$n || ret=1
 666 grep "status: NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1
 667 # Note - these are looking for failure, hence the &&
 668 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1
 669 grep "flags:.*ad.*QUERY" dig.out.ns5.test$n > /dev/null && ret=1
 670 n=`expr $n + 1`
 671 if [ $ret != 0 ]; then echo "I:failed"; fi
 672 status=`expr $status + $ret`
 673
 674 echo "I:checking that validation of an ANY query works ($n)"
 675 ret=0
 676 $DIG $DIGOPTS +noauth foo.example. any @10.53.0.2 > dig.out.ns2.test$n || ret=1
 677 $DIG $DIGOPTS +noauth foo.example. any @10.53.0.4 > dig.out.ns4.test$n || ret=1
 678 $PERL ../digcomp.pl dig.out.ns2.test$n dig.out.ns4.test$n || ret=1
 679 grep "NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 680 # 2 records in the zone, 1 NXT, 3 SIGs
 681 grep "ANSWER: 6" dig.out.ns4.test$n > /dev/null || ret=1
 682 n=`expr $n + 1`
 683 if [ $ret != 0 ]; then echo "I:failed"; fi
 684 status=`expr $status + $ret`
 685
 686 echo "I:checking that validation of a query returning a CNAME works ($n)"
 687 ret=0
 688 $DIG $DIGOPTS +noauth cname1.example. txt @10.53.0.2 \
 689         > dig.out.ns2.test$n || ret=1
 690 $DIG $DIGOPTS +noauth cname1.example. txt @10.53.0.4 \
 691         > dig.out.ns4.test$n || ret=1
 692 $PERL ../digcomp.pl dig.out.ns2.test$n dig.out.ns4.test$n || ret=1
 693 grep "NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 694 # the CNAME & its sig, the TXT and its SIG
 695 grep "ANSWER: 4" dig.out.ns4.test$n > /dev/null || ret=1
 696 n=`expr $n + 1`
 697 if [ $ret != 0 ]; then echo "I:failed"; fi
 698 status=`expr $status + $ret`
 699
 700 echo "I:checking that validation of a query returning a DNAME works ($n)"
 701 ret=0
 702 $DIG $DIGOPTS +noauth foo.dname1.example. txt @10.53.0.2 \
 703         > dig.out.ns2.test$n || ret=1
 704 $DIG $DIGOPTS +noauth foo.dname1.example. txt @10.53.0.4 \
 705         > dig.out.ns4.test$n || ret=1
 706 $PERL ../digcomp.pl dig.out.ns2.test$n dig.out.ns4.test$n || ret=1
 707 grep "NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 708 # The DNAME & its sig, the TXT and its SIG, and the synthesized CNAME.
 709 # It would be nice to test that the CNAME is being synthesized by the
 710 # recursive server and not cached, but I don't know how.
 711 grep "ANSWER: 5" dig.out.ns4.test$n > /dev/null || ret=1
 712 n=`expr $n + 1`
 713 if [ $ret != 0 ]; then echo "I:failed"; fi
 714 status=`expr $status + $ret`
 715
 716 echo "I:checking that validation of an ANY query returning a CNAME works ($n)"
 717 ret=0
 718 $DIG $DIGOPTS +noauth cname2.example. any @10.53.0.2 \
 719         > dig.out.ns2.test$n || ret=1
 720 $DIG $DIGOPTS +noauth cname2.example. any @10.53.0.4 \
 721         > dig.out.ns4.test$n || ret=1
 722 $PERL ../digcomp.pl dig.out.ns2.test$n dig.out.ns4.test$n || ret=1
 723 grep "NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 724 # The CNAME, NXT, and their SIGs
 725 grep "ANSWER: 4" dig.out.ns4.test$n > /dev/null || ret=1
 726 n=`expr $n + 1`
 727 if [ $ret != 0 ]; then echo "I:failed"; fi
 728 status=`expr $status + $ret`
 729
 730 echo "I:checking that validation of an ANY query returning a DNAME works ($n)"
 731 ret=0
 732 $DIG $DIGOPTS +noauth foo.dname2.example. any @10.53.0.2 \
 733         > dig.out.ns2.test$n || ret=1
 734 $DIG $DIGOPTS +noauth foo.dname2.example. any @10.53.0.4 \
 735         > dig.out.ns4.test$n || ret=1
 736 $PERL ../digcomp.pl dig.out.ns2.test$n dig.out.ns4.test$n || ret=1
 737 grep "NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 738 n=`expr $n + 1`
 739 if [ $ret != 0 ]; then echo "I:failed"; fi
 740 status=`expr $status + $ret`
 741
 742 echo "I:checking that positive validation in a privately secure zone works ($n)"
 743 ret=0
 744 $DIG $DIGOPTS +noauth a.private.secure.example. a @10.53.0.2 \
 745         > dig.out.ns2.test$n || ret=1
 746 $DIG $DIGOPTS +noauth a.private.secure.example. a @10.53.0.4 \
 747         > dig.out.ns4.test$n || ret=1
 748 $PERL ../digcomp.pl dig.out.ns2.test$n dig.out.ns4.test$n || ret=1
 749 grep "NOERROR" dig.out.ns4.test$n > /dev/null || ret=1
 750 # Note - this is looking for failure, hence the &&
 751 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1
 752 n=`expr $n + 1`
 753 if [ $ret != 0 ]; then echo "I:failed"; fi
 754 status=`expr $status + $ret`
 755
 756 echo "I:checking that negative validation in a privately secure zone works ($n)"
 757 ret=0
 758 $DIG $DIGOPTS +noauth q.private.secure.example. a @10.53.0.2 \
 759         > dig.out.ns2.test$n || ret=1
 760 $DIG $DIGOPTS +noauth q.private.secure.example. a @10.53.0.4 \
 761         > dig.out.ns4.test$n || ret=1
 762 $PERL ../digcomp.pl dig.out.ns2.test$n dig.out.ns4.test$n || ret=1
 763 grep "NXDOMAIN" dig.out.ns4.test$n > /dev/null || ret=1
 764 # Note - this is looking for failure, hence the &&
 765 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1
 766 n=`expr $n + 1`
 767 if [ $ret != 0 ]; then echo "I:failed"; fi
 768 status=`expr $status + $ret`
 769
 770 echo "I:checking that lookups succeed after disabling a algorithm works ($n)"
 771 ret=0
 772 $DIG $DIGOPTS +noauth example. SOA @10.53.0.2 \
 773         > dig.out.ns2.test$n || ret=1
 774 $DIG $DIGOPTS +noauth example. SOA @10.53.0.6 \
 775         > dig.out.ns6.test$n || ret=1
 776 $PERL ../digcomp.pl dig.out.ns2.test$n dig.out.ns6.test$n || ret=1
 777 # Note - this is looking for failure, hence the &&
 778 grep "flags:.*ad.*QUERY" dig.out.ns6.test$n > /dev/null && ret=1
 779 n=`expr $n + 1`
 780 if [ $ret != 0 ]; then echo "I:failed"; fi
 781 status=`expr $status + $ret`
 782
 783 echo "I:checking privately secure to nxdomain works ($n)"
 784 ret=0
 785 $DIG $DIGOPTS +noauth private2secure-nxdomain.private.secure.example. SOA @10.53.0.2 \
 786         > dig.out.ns2.test$n || ret=1
 787 $DIG $DIGOPTS +noauth private2secure-nxdomain.private.secure.example. SOA @10.53.0.4 \
 788         > dig.out.ns4.test$n || ret=1
 789 $PERL ../digcomp.pl dig.out.ns2.test$n dig.out.ns4.test$n || ret=1
 790 # Note - this is looking for failure, hence the &&
 791 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1
 792 n=`expr $n + 1`
 793 if [ $ret != 0 ]; then echo "I:failed"; fi
 794 status=`expr $status + $ret`
 795
 796 echo "I:checking privately secure wildcard to nxdomain works ($n)"
 797 ret=0
 798 $DIG $DIGOPTS +noauth a.wild.private.secure.example. SOA @10.53.0.2 \
 799         > dig.out.ns2.test$n || ret=1
 800 $DIG $DIGOPTS +noauth a.wild.private.secure.example. SOA @10.53.0.4 \
 801         > dig.out.ns4.test$n || ret=1
 802 $PERL ../digcomp.pl dig.out.ns2.test$n dig.out.ns4.test$n || ret=1
 803 # Note - this is looking for failure, hence the &&
 804 grep "flags:.*ad.*QUERY" dig.out.ns4.test$n > /dev/null && ret=1
 805 n=`expr $n + 1`
 806 if [ $ret != 0 ]; then echo "I:failed"; fi
 807 status=`expr $status + $ret`
 808
 809 #
 810 # private.secure.example is served by the same server as its
 811 # grand parent and there is not a secure delegation from secure.example
 812 # to private.secure.example.  In addition secure.example is using a
 813 # algorithm which the validation does not support.
 814 #
 815 echo "I:checking dnssec-lookaside-validation works ($n)"
 816 ret=0
 817 $DIG $DIGOPTS private.secure.example. SOA @10.53.0.6 \
 818         > dig.out.ns6.test$n || ret=1
 819 grep "flags:.*ad.*QUERY" dig.out.ns6.test$n > /dev/null || ret=1
 820 n=`expr $n + 1`
 821 if [ $ret != 0 ]; then echo "I:failed"; fi
 822 status=`expr $status + $ret`
 823
 824 echo "I:checking that we can load a rfc2535 signed zone ($n)"
 825 ret=0
 826 $DIG $DIGOPTS rfc2535.example. SOA @10.53.0.2 \
 827         > dig.out.ns2.test$n || ret=1
 828 grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
 829 n=`expr $n + 1`
 830 if [ $ret != 0 ]; then echo "I:failed"; fi
 831 status=`expr $status + $ret`
 832
 833 echo "I:checking that we can transfer a rfc2535 signed zone ($n)"
 834 ret=0
 835 $DIG $DIGOPTS rfc2535.example. SOA @10.53.0.3 \
 836         > dig.out.ns3.test$n || ret=1
 837 grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || ret=1
 838 n=`expr $n + 1`
 839 if [ $ret != 0 ]; then echo "I:failed"; fi
 840 status=`expr $status + $ret`
 841
 842 # Run a minimal update test if possible.  This is really just
 843 # a regression test for RT #2399; more tests should be added.
 844
 845 if $PERL -e 'use Net::DNS;' 2>/dev/null
 846 then
 847     echo "I:running DNSSEC update test"
 848     $PERL dnssec_update_test.pl -s 10.53.0.3 -p 5300 dynamic.example. || status=1
 849 else
 850     echo "I:The DNSSEC update test requires the Net::DNS library." >&2
 851 fi
 852
 853 echo "I:exit status: $status"
 854 exit $status