1#!/bin/sh 2 3# Copyright (C) Internet Systems Consortium, Inc. ("ISC") 4# 5# SPDX-License-Identifier: MPL-2.0 6# 7# This Source Code Form is subject to the terms of the Mozilla Public 8# License, v. 2.0. If a copy of the MPL was not distributed with this 9# file, you can obtain one at https://mozilla.org/MPL/2.0/. 10# 11# See the COPYRIGHT file distributed with this work for additional 12# information regarding copyright ownership. 13 14set -e 15 16. ../conf.sh 17 18DIGOPTS="+tcp -p ${PORT}" 19 20status=0 21n=0 22 23n=$((n + 1)) 24echo_i "wait for zones to finish transferring to ns2 ($n)" 25for i in 1 2 3 4 5 6 7 8 9 10; do 26 ret=0 27 for zone in example.com example.net; do 28 $DIG $DIGOPTS @10.53.0.2 soa $zone >dig.out.test$n || ret=1 29 grep "ANSWER: 1," dig.out.test$n >/dev/null || ret=1 30 done 31 [ $ret -eq 0 ] && break 32 sleep 1 33done 34[ $ret -eq 0 ] || echo_i "failed" 35status=$((status + ret)) 36 37# 38# If recursion is unrequested or unavailable, then cross-zone CNAME records 39# should not be followed. If both requested and available, they should be. 40# 41n=$((n + 1)) 42echo_i "check that cross-zone CNAME record does not return target data (rd=0/ra=0) ($n)" 43ret=0 44$DIG $DIGOPTS +norec @10.53.0.1 www.example.com >dig.out.test$n || ret=1 45grep "ANSWER: 1," dig.out.test$n >/dev/null || ret=1 46grep "flags: qr aa;" dig.out.test$n >/dev/null || ret=1 47grep "www.example.com.*CNAME.*server.example.net" dig.out.test$n >/dev/null || ret=1 48grep "server.example.net.*A.*10.53.0.100" dig.out.test$n >/dev/null && ret=1 49[ $ret -eq 0 ] || echo_i "failed" 50status=$((status + ret)) 51 52n=$((n + 1)) 53echo_i "check that cross-zone CNAME record does not return target data (rd=1/ra=0) ($n)" 54ret=0 55$DIG $DIGOPTS +rec @10.53.0.1 www.example.com >dig.out.test$n || ret=1 56grep "ANSWER: 1," dig.out.test$n >/dev/null || ret=1 57grep "flags: qr aa rd;" dig.out.test$n >/dev/null || ret=1 58grep "www.example.com.*CNAME.*server.example.net" dig.out.test$n >/dev/null || ret=1 59grep "server.example.net.*A.*10.53.0.100" dig.out.test$n >/dev/null && ret=1 60[ $ret -eq 0 ] || echo_i "failed" 61status=$((status + ret)) 62 63n=$((n + 1)) 64echo_i "check that cross-zone CNAME record does not return target data (rd=0/ra=1) ($n)" 65ret=0 66$DIG $DIGOPTS +norec @10.53.0.2 www.example.com >dig.out.test$n || ret=1 67grep "ANSWER: 1," dig.out.test$n >/dev/null || ret=1 68grep "flags: qr aa ra;" dig.out.test$n >/dev/null || ret=1 69grep "www.example.com.*CNAME.*server.example.net" dig.out.test$n >/dev/null || ret=1 70grep "server.example.net.*A.*10.53.0.100" dig.out.test$n >/dev/null && ret=1 71[ $ret -eq 0 ] || echo_i "failed" 72status=$((status + ret)) 73 74n=$((n + 1)) 75echo_i "check that cross-zone CNAME records return target data (rd=1/ra=1) ($n)" 76ret=0 77$DIG $DIGOPTS @10.53.0.2 www.example.com >dig.out.test$n || ret=1 78grep "ANSWER: 2," dig.out.test$n >/dev/null || ret=1 79grep "flags: qr aa rd ra;" dig.out.test$n >/dev/null || ret=1 80grep "www.example.com.*CNAME.*server.example.net" dig.out.test$n >/dev/null || ret=1 81grep "server.example.net.*A.*10.53.0.100" dig.out.test$n >/dev/null || ret=1 82[ $ret -eq 0 ] || echo_i "failed" 83status=$((status + ret)) 84 85# 86# In-zone CNAME records should always be followed regardless of RD and RA. 87# 88n=$((n + 1)) 89echo_i "check that in-zone CNAME records return target data (rd=0/ra=0) ($n)" 90ret=0 91$DIG $DIGOPTS +norec @10.53.0.1 inzone.example.com >dig.out.test$n || ret=1 92grep "ANSWER: 2," dig.out.test$n >/dev/null || ret=1 93grep "flags: qr aa;" dig.out.test$n >/dev/null || ret=1 94grep "inzone.example.com.*CNAME.*a.example.com" dig.out.test$n >/dev/null || ret=1 95grep "a.example.com.*A.*10.53.0.1" dig.out.test$n >/dev/null || ret=1 96[ $ret -eq 0 ] || echo_i "failed" 97status=$((status + ret)) 98 99n=$((n + 1)) 100echo_i "check that in-zone CNAME records returns target data (rd=1/ra=0) ($n)" 101ret=0 102$DIG $DIGOPTS +rec @10.53.0.1 inzone.example.com >dig.out.test$n || ret=1 103grep "ANSWER: 2," dig.out.test$n >/dev/null || ret=1 104grep "flags: qr aa rd;" dig.out.test$n >/dev/null || ret=1 105grep "inzone.example.com.*CNAME.*a.example.com" dig.out.test$n >/dev/null || ret=1 106grep "a.example.com.*A.*10.53.0.1" dig.out.test$n >/dev/null || ret=1 107[ $ret -eq 0 ] || echo_i "failed" 108status=$((status + ret)) 109 110n=$((n + 1)) 111echo_i "check that in-zone CNAME records return target data (rd=0/ra=1) ($n)" 112ret=0 113$DIG $DIGOPTS +norec @10.53.0.2 inzone.example.com >dig.out.test$n || ret=1 114grep "ANSWER: 2," dig.out.test$n >/dev/null || ret=1 115grep "flags: qr aa ra;" dig.out.test$n >/dev/null || ret=1 116grep "inzone.example.com.*CNAME.*a.example.com" dig.out.test$n >/dev/null || ret=1 117grep "a.example.com.*A.*10.53.0.1" dig.out.test$n >/dev/null || ret=1 118[ $ret -eq 0 ] || echo_i "failed" 119status=$((status + ret)) 120 121n=$((n + 1)) 122echo_i "check that in-zone CNAME records return target data (rd=1/ra=1) ($n)" 123ret=0 124$DIG $DIGOPTS @10.53.0.2 inzone.example.com >dig.out.test$n || ret=1 125grep "ANSWER: 2," dig.out.test$n >/dev/null || ret=1 126grep "flags: qr aa rd ra;" dig.out.test$n >/dev/null || ret=1 127grep "inzone.example.com.*CNAME.*a.example.com" dig.out.test$n >/dev/null || ret=1 128grep "a.example.com.*A.*10.53.0.1" dig.out.test$n >/dev/null || ret=1 129[ $ret -eq 0 ] || echo_i "failed" 130status=$((status + ret)) 131 132n=$((n + 1)) 133echo_i "check that in-zone CNAME records does not return target data when QTYPE is CNAME (rd=1/ra=1) ($n)" 134ret=0 135$DIG $DIGOPTS @10.53.0.2 -t cname inzone.example.com >dig.out.test$n || ret=1 136grep 'ANSWER: 1,' dig.out.test$n >/dev/null || ret=1 137grep 'flags: qr aa rd ra;' dig.out.test$n >/dev/null || ret=1 138grep 'inzone\.example\.com\..*CNAME.a\.example\.com\.' dig.out.test$n >/dev/null || ret=1 139grep 'a\.example\.com\..*A.10\.53\.0\.1' dig.out.test$n >/dev/null && ret=1 140[ $ret -eq 0 ] || echo_i "failed" 141status=$((status + ret)) 142 143n=$((n + 1)) 144echo_i "check that in-zone CNAME records does not return target data when QTYPE is ANY (rd=1/ra=1) ($n)" 145ret=0 146$DIG $DIGOPTS @10.53.0.2 -t any inzone.example.com >dig.out.test$n || ret=1 147grep 'ANSWER: 1,' dig.out.test$n >/dev/null || ret=1 148grep 'flags: qr aa rd ra;' dig.out.test$n >/dev/null || ret=1 149grep 'inzone\.example\.com\..*CNAME.a\.example\.com\.' dig.out.test$n >/dev/null || ret=1 150grep 'a\.example\.com\..*A.10\.53\.0\.1' dig.out.test$n >/dev/null && ret=1 151[ $ret -eq 0 ] || echo_i "failed" 152status=$((status + ret)) 153 154n=$((n + 1)) 155echo_i "check that in-zone DNAME records does not return target data when QTYPE is CNAME (rd=1/ra=1) ($n)" 156ret=0 157$DIG $DIGOPTS @10.53.0.2 -t cname inzone.dname.example.com >dig.out.test$n || ret=1 158grep 'ANSWER: 2,' dig.out.test$n >/dev/null || ret=1 159grep 'flags: qr aa rd ra;' dig.out.test$n >/dev/null || ret=1 160grep 'dname\.example\.com\..*DNAME.example\.com\.' dig.out.test$n >/dev/null || ret=1 161grep 'inzone\.dname\.example\.com\..*CNAME.inzone\.example\.com\.' dig.out.test$n >/dev/null || ret=1 162grep 'inzone\.example\.com\..*CNAME.a\.example\.com\.' dig.out.test$n >/dev/null && ret=1 163grep 'a\.example\.com\..*A.10\.53\.0\.1' dig.out.test$n >/dev/null && ret=1 164[ $ret -eq 0 ] || echo_i "failed" 165status=$((status + ret)) 166 167n=$((n + 1)) 168echo_i "check that in-zone DNAME records does not return target data when QTYPE is ANY (rd=1/ra=1) ($n)" 169ret=0 170$DIG $DIGOPTS @10.53.0.2 -t any inzone.dname.example.com >dig.out.test$n || ret=1 171grep 'ANSWER: 2,' dig.out.test$n >/dev/null || ret=1 172grep 'flags: qr aa rd ra;' dig.out.test$n >/dev/null || ret=1 173grep 'dname\.example\.com\..*DNAME.example\.com\.' dig.out.test$n >/dev/null || ret=1 174grep 'inzone\.dname\.example\.com\..*CNAME.inzone\.example\.com\.' dig.out.test$n >/dev/null || ret=1 175grep 'inzone\.example\.com.*CNAME.a\.example\.com\.' dig.out.test$n >/dev/null && ret=1 176grep 'a\.example\.com.*A.10\.53\.0\.1' dig.out.test$n >/dev/null && ret=1 177[ $ret -eq 0 ] || echo_i "failed" 178status=$((status + ret)) 179 180n=$((n + 1)) 181echo_i "check that CHAOS addresses are compared correctly ($n)" 182ret=0 183$DIG $DIGOPTS @10.53.0.1 +noall +answer ch test.example.chaos >dig.out.test$n || ret=1 184lines=$(wc -l <dig.out.test$n) 185[ ${lines:-0} -eq 2 ] || ret=1 186[ $ret -eq 0 ] || echo_i "failed" 187status=$((status + ret)) 188 189echo_i "exit status: $status" 190[ $status -eq 0 ] || exit 1 191