1*00b67f09SDavid van Moolenbroek#!/bin/sh 2*00b67f09SDavid van Moolenbroek# 3*00b67f09SDavid van Moolenbroek# Copyright (C) 2012 Internet Systems Consortium, Inc. ("ISC") 4*00b67f09SDavid van Moolenbroek# 5*00b67f09SDavid van Moolenbroek# Permission to use, copy, modify, and/or distribute this software for any 6*00b67f09SDavid van Moolenbroek# purpose with or without fee is hereby granted, provided that the above 7*00b67f09SDavid van Moolenbroek# copyright notice and this permission notice appear in all copies. 8*00b67f09SDavid van Moolenbroek# 9*00b67f09SDavid van Moolenbroek# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH 10*00b67f09SDavid van Moolenbroek# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY 11*00b67f09SDavid van Moolenbroek# AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT, 12*00b67f09SDavid van Moolenbroek# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM 13*00b67f09SDavid van Moolenbroek# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE 14*00b67f09SDavid van Moolenbroek# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR 15*00b67f09SDavid van Moolenbroek# PERFORMANCE OF THIS SOFTWARE. 16*00b67f09SDavid van Moolenbroek 17*00b67f09SDavid van Moolenbroek# Id 18*00b67f09SDavid van Moolenbroek 19*00b67f09SDavid van MoolenbroekSYSTEMTESTTOP=.. 20*00b67f09SDavid van Moolenbroek. $SYSTEMTESTTOP/conf.sh 21*00b67f09SDavid van Moolenbroek 22*00b67f09SDavid van Moolenbroekstatus=0 23*00b67f09SDavid van Moolenbroek 24*00b67f09SDavid van Moolenbroekrm -f dig.out.* 25*00b67f09SDavid van Moolenbroek 26*00b67f09SDavid van MoolenbroekDIGOPTS="+tcp +noadd +nosea +nostat +nocmd +dnssec -p 5300" 27*00b67f09SDavid van Moolenbroek 28*00b67f09SDavid van Moolenbroek# Check the good. domain 29*00b67f09SDavid van Moolenbroek 30*00b67f09SDavid van Moolenbroekecho "I:checking that validation with enabled digest types works" 31*00b67f09SDavid van Moolenbroekret=0 32*00b67f09SDavid van Moolenbroek$DIG $DIGOPTS a.good. @10.53.0.3 a > dig.out.good || ret=1 33*00b67f09SDavid van Moolenbroekgrep "status: NOERROR" dig.out.good > /dev/null || ret=1 34*00b67f09SDavid van Moolenbroekgrep "flags:[^;]* ad[ ;]" dig.out.good > /dev/null || ret=1 35*00b67f09SDavid van Moolenbroekif [ $ret != 0 ]; then echo "I:failed"; fi 36*00b67f09SDavid van Moolenbroekstatus=`expr $status + $ret` 37*00b67f09SDavid van Moolenbroek 38*00b67f09SDavid van Moolenbroek# Check the bad. domain 39*00b67f09SDavid van Moolenbroek 40*00b67f09SDavid van Moolenbroekecho "I:checking that validation with no supported digest types and must-be-secure results in SERVFAIL" 41*00b67f09SDavid van Moolenbroekret=0 42*00b67f09SDavid van Moolenbroek$DIG $DIGOPTS a.bad. @10.53.0.3 a > dig.out.bad || ret=1 43*00b67f09SDavid van Moolenbroekgrep "SERVFAIL" dig.out.bad > /dev/null || ret=1 44*00b67f09SDavid van Moolenbroekif [ $ret != 0 ]; then echo "I:failed"; fi 45*00b67f09SDavid van Moolenbroekstatus=`expr $status + $ret` 46*00b67f09SDavid van Moolenbroek 47*00b67f09SDavid van Moolenbroekecho "I:checking that validation with no supported digest algorithms results in insecure" 48*00b67f09SDavid van Moolenbroekret=0 49*00b67f09SDavid van Moolenbroek$DIG $DIGOPTS bad. @10.53.0.4 ds > dig.out.ds || ret=1 50*00b67f09SDavid van Moolenbroekgrep "NOERROR" dig.out.ds > /dev/null || ret=1 51*00b67f09SDavid van Moolenbroekgrep "flags:[^;]* ad[ ;]" dig.out.ds > /dev/null || ret=1 52*00b67f09SDavid van Moolenbroek$DIG $DIGOPTS a.bad. @10.53.0.4 a > dig.out.insecure || ret=1 53*00b67f09SDavid van Moolenbroekgrep "NOERROR" dig.out.insecure > /dev/null || ret=1 54*00b67f09SDavid van Moolenbroekgrep "flags:[^;]* ad[ ;]" dig.out.insecure > /dev/null && ret=1 55*00b67f09SDavid van Moolenbroekif [ $ret != 0 ]; then echo "I:failed"; fi 56*00b67f09SDavid van Moolenbroekstatus=`expr $status + $ret` 57*00b67f09SDavid van Moolenbroekecho "I:exit status: $status" 58*00b67f09SDavid van Moolenbroek 59*00b67f09SDavid van Moolenbroekexit $status 60