1#!/bin/sh 2 3# Copyright (C) Internet Systems Consortium, Inc. ("ISC") 4# 5# SPDX-License-Identifier: MPL-2.0 6# 7# This Source Code Form is subject to the terms of the Mozilla Public 8# License, v. 2.0. If a copy of the MPL was not distributed with this 9# file, you can obtain one at https://mozilla.org/MPL/2.0/. 10# 11# See the COPYRIGHT file distributed with this work for additional 12# information regarding copyright ownership. 13 14SYSTEMTESTTOP=.. 15. $SYSTEMTESTTOP/conf.sh 16 17DIGOPTS="+tcp +dnssec -p ${PORT}" 18RNDCCMD="$RNDC -c $SYSTEMTESTTOP/common/rndc.conf -p ${CONTROLPORT} -s" 19 20dig_with_opts() { 21 $DIG $DIGOPTS "$@" 22} 23 24rndccmd() { 25 $RNDCCMD "$@" 26} 27 28wait_for_serial() ( 29 $DIG $DIGOPTS "@$1" "$2" SOA > "$4" 30 serial=$(awk '$4 == "SOA" { print $7 }' "$4") 31 [ "$3" -eq "${serial:--1}" ] 32) 33 34status=0 35n=0 36 37$RNDCCMD 10.53.0.3 signing -nsec3param 1 0 0 - nsec3 > /dev/null 2>&1 38 39for i in 1 2 3 4 5 6 7 8 9 0 40do 41 nsec3param=$($DIG $DIGOPTS +nodnssec +short @10.53.0.3 nsec3param nsec3.) 42 test "$nsec3param" = "1 0 0 -" && break 43 sleep 1 44done 45 46n=$((n + 1)) 47echo_i "checking that an unsupported algorithm is not used for signing ($n)" 48ret=0 49grep -q "algorithm is unsupported" ns3/named.run || ret=1 50if [ $ret != 0 ]; then echo_i "failed"; fi 51status=$((status + ret)) 52 53n=$((n + 1)) 54echo_i "checking that rrsigs are replaced with ksk only ($n)" 55ret=0 56$DIG $DIGOPTS @10.53.0.3 axfr nsec3. | 57 awk '/RRSIG NSEC3/ {a[$1]++} END { for (i in a) {if (a[i] != 1) exit (1)}}' || ret=1 58if [ $ret != 0 ]; then echo_i "failed"; fi 59status=$((status + ret)) 60 61n=$((n + 1)) 62echo_i "checking that the zone is signed on initial transfer ($n)" 63ret=0 64for i in 1 2 3 4 5 6 7 8 9 10 1 2 3 4 5 6 7 8 9 10 65do 66 ret=0 67 $RNDCCMD 10.53.0.3 signing -list bits > signing.out.test$n 2>&1 68 keys=$(grep '^Done signing' signing.out.test$n | wc -l) 69 [ $keys = 2 ] || ret=1 70 if [ $ret = 0 ]; then break; fi 71 sleep 1 72done 73if [ $ret != 0 ]; then echo_i "failed"; fi 74status=$((status + ret)) 75 76n=$((n + 1)) 77echo_i "checking expired signatures are updated on load ($n)" 78ret=0 79$DIG $DIGOPTS @10.53.0.3 +noall +answer +dnssec expired SOA > dig.out.ns3.test$n 80expiry=$(awk '$4 == "RRSIG" { print $9 }' dig.out.ns3.test$n) 81[ "$expiry" = "20110101000000" ] && ret=1 82if [ $ret != 0 ]; then echo_i "failed"; fi 83status=$((status + ret)) 84 85n=$((n + 1)) 86echo_i "checking removal of private type record via 'rndc signing -clear' ($n)" 87ret=0 88$RNDCCMD 10.53.0.3 signing -list bits > signing.out.test$n 2>&1 89keys=$(sed -n -e 's/Done signing with key \(.*\)$/\1/p' signing.out.test$n) 90for key in $keys; do 91 $RNDCCMD 10.53.0.3 signing -clear ${key} bits > /dev/null || ret=1 92 break; # We only want to remove 1 record for now. 93done 2>&1 |sed 's/^/ns3 /' | cat_i 94 95for i in 1 2 3 4 5 6 7 8 9 10 96do 97 ans=0 98 $RNDCCMD 10.53.0.3 signing -list bits > signing.out.test$n 2>&1 99 num=$(grep "Done signing with" signing.out.test$n | wc -l) 100 [ $num = 1 ] && break 101 sleep 1 102done 103[ $ans = 0 ] || ret=1 104 105if [ $ret != 0 ]; then echo_i "failed"; fi 106status=$((status + ret)) 107 108n=$((n + 1)) 109echo_i "checking private type was properly signed ($n)" 110ret=0 111$DIG $DIGOPTS @10.53.0.6 bits TYPE65534 > dig.out.ns6.test$n 112grep "ANSWER: 2," dig.out.ns6.test$n > /dev/null || ret=1 113grep "flags:.* ad[ ;]" dig.out.ns6.test$n > /dev/null || ret=1 114 115if [ $ret != 0 ]; then echo_i "failed"; fi 116status=$((status + ret)) 117 118n=$((n + 1)) 119echo_i "checking removal of remaining private type record via 'rndc signing -clear all' ($n)" 120ret=0 121$RNDCCMD 10.53.0.3 signing -clear all bits > /dev/null || ret=1 122 123for i in 1 2 3 4 5 6 7 8 9 10 124do 125 ans=0 126 $RNDCCMD 10.53.0.3 signing -list bits > signing.out.test$n 2>&1 127 grep "No signing records found" signing.out.test$n > /dev/null || ans=1 128 [ $ans = 1 ] || break 129 sleep 1 130done 131[ $ans = 0 ] || ret=1 132 133if [ $ret != 0 ]; then echo_i "failed"; fi 134status=$((status + ret)) 135 136n=$((n + 1)) 137echo_i "checking negative private type response was properly signed ($n)" 138ret=0 139sleep 1 140$DIG $DIGOPTS @10.53.0.6 bits TYPE65534 > dig.out.ns6.test$n 141grep "status: NOERROR" dig.out.ns6.test$n > /dev/null || ret=1 142grep "ANSWER: 0," dig.out.ns6.test$n > /dev/null || ret=1 143grep "flags:.* ad[ ;]" dig.out.ns6.test$n > /dev/null || ret=1 144 145if [ $ret != 0 ]; then echo_i "failed"; fi 146status=$((status + ret)) 147 148$NSUPDATE << EOF 149zone bits 150server 10.53.0.2 ${PORT} 151update add added.bits 0 A 1.2.3.4 152send 153EOF 154 155n=$((n + 1)) 156echo_i "checking that the record is added on the hidden primary ($n)" 157ret=0 158$DIG $DIGOPTS @10.53.0.2 added.bits A > dig.out.ns2.test$n 159grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1 160grep "ANSWER: 1," dig.out.ns2.test$n > /dev/null || ret=1 161if [ $ret != 0 ]; then echo_i "failed"; fi 162status=$((status + ret)) 163 164n=$((n + 1)) 165echo_i "checking that update has been transferred and has been signed ($n)" 166ret=0 167for i in 1 2 3 4 5 6 7 8 9 10 168do 169 ret=0 170 $DIG $DIGOPTS @10.53.0.3 added.bits A > dig.out.ns3.test$n 171 grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || ret=1 172 grep "ANSWER: 2," dig.out.ns3.test$n > /dev/null || ret=1 173 if [ $ret = 0 ]; then break; fi 174 sleep 1 175done 176if [ $ret != 0 ]; then echo_i "failed"; fi 177status=$((status + ret)) 178 179$NSUPDATE << EOF 180zone bits 181server 10.53.0.2 ${PORT} 182update add bits 0 SOA ns2.bits. . 2011072400 20 20 1814400 3600 183send 184EOF 185 186n=$((n + 1)) 187echo_i "checking YYYYMMDDVV (2011072400) serial on hidden primary ($n)" 188ret=0 189$DIG $DIGOPTS @10.53.0.2 bits SOA > dig.out.ns2.test$n 190grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1 191grep "ANSWER: 1," dig.out.ns2.test$n > /dev/null || ret=1 192grep "2011072400" dig.out.ns2.test$n > /dev/null || ret=1 193if [ $ret != 0 ]; then echo_i "failed"; fi 194status=$((status + ret)) 195 196n=$((n + 1)) 197echo_i "checking YYYYMMDDVV (2011072400) serial in signed zone ($n)" 198for i in 1 2 3 4 5 6 7 8 9 10 199do 200 ret=0 201 $DIG $DIGOPTS @10.53.0.3 bits SOA > dig.out.ns3.test$n 202 grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || ret=1 203 grep "ANSWER: 2," dig.out.ns3.test$n > /dev/null || ret=1 204 grep "2011072400" dig.out.ns3.test$n > /dev/null || ret=1 205 if [ $ret = 0 ]; then break; fi 206 sleep 1 207done 208if [ $ret != 0 ]; then echo_i "failed"; fi 209status=$((status + ret)) 210 211n=$((n + 1)) 212echo_i "checking that the zone is signed on initial transfer, noixfr ($n)" 213ret=0 214for i in 1 2 3 4 5 6 7 8 9 10 1 2 3 4 5 6 7 8 9 10 1 2 3 4 5 6 7 8 9 10 215do 216 ret=0 217 $RNDCCMD 10.53.0.3 signing -list noixfr > signing.out.test$n 2>&1 218 keys=$(grep '^Done signing' signing.out.test$n | wc -l) 219 [ $keys = 2 ] || ret=1 220 if [ $ret = 0 ]; then break; fi 221 sleep 1 222done 223if [ $ret != 0 ]; then echo_i "failed"; fi 224status=$((status + ret)) 225 226$NSUPDATE << EOF 227zone noixfr 228server 10.53.0.4 ${PORT} 229update add added.noixfr 0 A 1.2.3.4 230send 231EOF 232 233n=$((n + 1)) 234echo_i "checking that the record is added on the hidden primary, noixfr ($n)" 235ret=0 236$DIG $DIGOPTS @10.53.0.4 added.noixfr A > dig.out.ns4.test$n 237grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 238grep "ANSWER: 1," dig.out.ns4.test$n > /dev/null || ret=1 239if [ $ret != 0 ]; then echo_i "failed"; fi 240status=$((status + ret)) 241 242n=$((n + 1)) 243echo_i "checking that update has been transferred and has been signed, noixfr ($n)" 244ret=0 245for i in 1 2 3 4 5 6 7 8 9 10 1 2 3 4 5 6 7 8 9 10 1 2 3 4 5 6 7 8 9 10 246do 247 ret=0 248 $DIG $DIGOPTS @10.53.0.3 added.noixfr A > dig.out.ns3.test$n 249 grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || ret=1 250 grep "ANSWER: 2," dig.out.ns3.test$n > /dev/null || ret=1 251 if [ $ret = 0 ]; then break; fi 252 sleep 1 253done 254if [ $ret != 0 ]; then echo_i "failed"; fi 255status=$((status + ret)) 256 257$NSUPDATE << EOF 258zone noixfr 259server 10.53.0.4 ${PORT} 260update add noixfr 0 SOA ns4.noixfr. . 2011072400 20 20 1814400 3600 261send 262EOF 263 264n=$((n + 1)) 265echo_i "checking YYYYMMDDVV (2011072400) serial on hidden primary, noixfr ($n)" 266ret=0 267$DIG $DIGOPTS @10.53.0.4 noixfr SOA > dig.out.ns4.test$n 268grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 269grep "ANSWER: 1," dig.out.ns4.test$n > /dev/null || ret=1 270grep "2011072400" dig.out.ns4.test$n > /dev/null || ret=1 271if [ $ret != 0 ]; then echo_i "failed"; fi 272status=$((status + ret)) 273 274n=$((n + 1)) 275echo_i "checking YYYYMMDDVV (2011072400) serial in signed zone, noixfr ($n)" 276for i in 1 2 3 4 5 6 7 8 9 10 277do 278 ret=0 279 $DIG $DIGOPTS @10.53.0.3 noixfr SOA > dig.out.ns3.test$n 280 grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || ret=1 281 grep "ANSWER: 2," dig.out.ns3.test$n > /dev/null || ret=1 282 grep "2011072400" dig.out.ns3.test$n > /dev/null || ret=1 283 if [ $ret = 0 ]; then break; fi 284 sleep 1 285done 286if [ $ret != 0 ]; then echo_i "failed"; fi 287status=$((status + ret)) 288 289n=$((n + 1)) 290echo_i "checking that the primary zone signed on initial load ($n)" 291ret=0 292for i in 1 2 3 4 5 6 7 8 9 10 293do 294 ret=0 295 $RNDCCMD 10.53.0.3 signing -list master > signing.out.test$n 2>&1 296 keys=$(grep '^Done signing' signing.out.test$n | wc -l) 297 [ $keys = 2 ] || ret=1 298 if [ $ret = 0 ]; then break; fi 299 sleep 1 300done 301if [ $ret != 0 ]; then echo_i "failed"; fi 302status=$((status + ret)) 303 304n=$((n + 1)) 305echo_i "checking removal of private type record via 'rndc signing -clear' (primary) ($n)" 306ret=0 307$RNDCCMD 10.53.0.3 signing -list master > signing.out.test$n 2>&1 308keys=$(sed -n -e 's/Done signing with key \(.*\)$/\1/p' signing.out.test$n) 309for key in $keys; do 310 $RNDCCMD 10.53.0.3 signing -clear ${key} master > /dev/null || ret=1 311 break; # We only want to remove 1 record for now. 312done 2>&1 |sed 's/^/ns3 /' | cat_i 313 314for i in 1 2 3 4 5 6 7 8 9 315do 316 ans=0 317 $RNDCCMD 10.53.0.3 signing -list master > signing.out.test$n 2>&1 318 num=$(grep "Done signing with" signing.out.test$n | wc -l) 319 [ $num = 1 ] && break 320 sleep 1 321done 322[ $ans = 0 ] || ret=1 323 324if [ $ret != 0 ]; then echo_i "failed"; fi 325status=$((status + ret)) 326 327n=$((n + 1)) 328echo_i "checking private type was properly signed (primary) ($n)" 329ret=0 330$DIG $DIGOPTS @10.53.0.6 master TYPE65534 > dig.out.ns6.test$n 331grep "ANSWER: 2," dig.out.ns6.test$n > /dev/null || ret=1 332grep "flags:.* ad[ ;]" dig.out.ns6.test$n > /dev/null || ret=1 333 334if [ $ret != 0 ]; then echo_i "failed"; fi 335status=$((status + ret)) 336 337n=$((n + 1)) 338echo_i "checking removal of remaining private type record via 'rndc signing -clear' (primary) ($n)" 339ret=0 340$RNDCCMD 10.53.0.3 signing -clear all master > /dev/null || ret=1 341for i in 1 2 3 4 5 6 7 8 9 10 342do 343 ans=0 344 $RNDCCMD 10.53.0.3 signing -list master > signing.out.test$n 2>&1 345 grep "No signing records found" signing.out.test$n > /dev/null || ans=1 346 [ $ans = 1 ] || break 347 sleep 1 348done 349[ $ans = 0 ] || ret=1 350 351if [ $ret != 0 ]; then echo_i "failed"; fi 352status=$((status + ret)) 353 354n=$((n + 1)) 355echo_i "check adding of record to unsigned primary ($n)" 356ret=0 357cp ns3/master2.db.in ns3/master.db 358rndc_reload ns3 10.53.0.3 master 359for i in 1 2 3 4 5 6 7 8 9 360do 361 ans=0 362 $DIG $DIGOPTS @10.53.0.3 e.master A > dig.out.ns3.test$n 363 grep "10.0.0.5" dig.out.ns3.test$n > /dev/null || ans=1 364 grep "ANSWER: 2," dig.out.ns3.test$n > /dev/null || ans=1 365 [ $ans = 1 ] || break 366 sleep 1 367done 368[ $ans = 0 ] || ret=1 369if [ $ret != 0 ]; then echo_i "failed"; fi 370status=$((status + ret)) 371 372n=$((n + 1)) 373echo_i "check adding record fails when SOA serial not changed ($n)" 374ret=0 375echo "c A 10.0.0.3" >> ns3/master.db 376rndc_reload ns3 10.53.0.3 377sleep 1 378$DIG $DIGOPTS @10.53.0.3 c.master A > dig.out.ns3.test$n 379grep "NXDOMAIN" dig.out.ns3.test$n > /dev/null || ret=1 380if [ $ret != 0 ]; then echo_i "failed"; fi 381status=$((status + ret)) 382 383n=$((n + 1)) 384echo_i "check adding record works after updating SOA serial ($n)" 385ret=0 386cp ns3/master3.db.in ns3/master.db 387$RNDCCMD 10.53.0.3 reload master 2>&1 | sed 's/^/ns3 /' | cat_i 388for i in 1 2 3 4 5 6 7 8 9 389do 390 ans=0 391 $DIG $DIGOPTS @10.53.0.3 c.master A > dig.out.ns3.test$n 392 grep "10.0.0.3" dig.out.ns3.test$n > /dev/null || ans=1 393 grep "ANSWER: 2," dig.out.ns3.test$n > /dev/null || ans=1 394 [ $ans = 1 ] || break 395 sleep 1 396done 397[ $ans = 0 ] || ret=1 398if [ $ret != 0 ]; then echo_i "failed"; fi 399status=$((status + ret)) 400 401n=$((n + 1)) 402echo_i "check the added record was properly signed ($n)" 403ret=0 404$DIG $DIGOPTS @10.53.0.3 e.master A > dig.out.ns6.test$n 405grep "10.0.0.5" dig.out.ns6.test$n > /dev/null || ans=1 406grep "ANSWER: 2," dig.out.ns6.test$n > /dev/null || ans=1 407grep "flags:.* ad[ ;]" dig.out.ns6.test$n > /dev/null || ans=1 408if [ $ret != 0 ]; then echo_i "failed"; fi 409status=$((status + ret)) 410 411n=$((n + 1)) 412echo_i "checking that the dynamic primary zone signed on initial load ($n)" 413ret=0 414for i in 1 2 3 4 5 6 7 8 9 10 415do 416 ret=0 417 $RNDCCMD 10.53.0.3 signing -list dynamic > signing.out.test$n 2>&1 418 keys=$(grep '^Done signing' signing.out.test$n | wc -l) 419 [ $keys = 2 ] || ret=1 420 if [ $ret = 0 ]; then break; fi 421 sleep 1 422done 423if [ $ret != 0 ]; then echo_i "failed"; fi 424status=$((status + ret)) 425 426n=$((n + 1)) 427echo_i "checking primary zone that was updated while offline is correct ($n)" 428ret=0 429$DIG $DIGOPTS +nodnssec +short @10.53.0.3 updated SOA >dig.out.ns2.soa.test$n 430serial=$(awk '{print $3}' dig.out.ns2.soa.test$n) 431# serial should have changed 432[ "$serial" = "2000042407" ] && ret=1 433# e.updated should exist and should be signed 434$DIG $DIGOPTS @10.53.0.3 e.updated A > dig.out.ns3.test$n 435grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || ret=1 436grep "ANSWER: 2," dig.out.ns3.test$n > /dev/null || ret=1 437# updated.db.signed.jnl should exist, should have the source serial 438# of master2.db, and should show a minimal diff: no more than 8 added 439# records (SOA/RRSIG, 2 x NSEC/RRSIG, A/RRSIG), and 4 removed records 440# (SOA/RRSIG, NSEC/RRSIG). 441$JOURNALPRINT ns3/updated.db.signed.jnl >journalprint.out.test$n 442serial=$(awk '/Source serial =/ {print $4}' journalprint.out.test$n) 443[ "$serial" = "2000042408" ] || ret=1 444diffsize=$(wc -l < journalprint.out.test$n) 445[ "$diffsize" -le 13 ] || ret=1 446if [ $ret != 0 ]; then echo_i "failed"; fi 447status=$((status + ret)) 448 449n=$((n + 1)) 450echo_i "checking adding of record to unsigned primary using UPDATE ($n)" 451ret=0 452 453[ -f ns3/dynamic.db.jnl ] && { ret=1 ; echo_i "journal exists (pretest)" ; } 454 455$NSUPDATE << EOF 456zone dynamic 457server 10.53.0.3 ${PORT} 458update add e.dynamic 0 A 1.2.3.4 459send 460EOF 461 462[ -f ns3/dynamic.db.jnl ] || { ret=1 ; echo_i "journal does not exist (posttest)" ; } 463 464for i in 1 2 3 4 5 6 7 8 9 10 465do 466 ans=0 467 $DIG $DIGOPTS @10.53.0.3 e.dynamic > dig.out.ns3.test$n 468 grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || ans=1 469 grep "ANSWER: 2," dig.out.ns3.test$n > /dev/null || ans=1 470 grep "1.2.3.4" dig.out.ns3.test$n > /dev/null || ans=1 471 [ $ans = 0 ] && break 472 sleep 1 473done 474[ $ans = 0 ] || { ret=1; echo_i "signed record not found"; cat dig.out.ns3.test$n ; } 475 476if [ $ret != 0 ]; then echo_i "failed"; fi 477status=$((status + ret)) 478 479n=$((n + 1)) 480echo_i "stop bump in the wire signer server ($n)" 481ret=0 482stop_server ns3 || ret=1 483if [ $ret != 0 ]; then echo_i "failed"; fi 484status=$((status + ret)) 485 486n=$((n + 1)) 487echo_i "restart bump in the wire signer server ($n)" 488ret=0 489start_server --noclean --restart --port ${PORT} ns3 || ret=1 490if [ $ret != 0 ]; then echo_i "failed"; fi 491status=$((status + ret)) 492 493$NSUPDATE << EOF 494zone bits 495server 10.53.0.2 ${PORT} 496update add bits 0 SOA ns2.bits. . 2011072450 20 20 1814400 3600 497send 498EOF 499 500n=$((n + 1)) 501echo_i "checking YYYYMMDDVV (2011072450) serial on hidden primary ($n)" 502ret=0 503$DIG $DIGOPTS @10.53.0.2 bits SOA > dig.out.ns2.test$n 504grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1 505grep "ANSWER: 1," dig.out.ns2.test$n > /dev/null || ret=1 506grep "2011072450" dig.out.ns2.test$n > /dev/null || ret=1 507if [ $ret != 0 ]; then echo_i "failed"; fi 508status=$((status + ret)) 509 510n=$((n + 1)) 511echo_i "checking YYYYMMDDVV (2011072450) serial in signed zone ($n)" 512for i in 1 2 3 4 5 6 7 8 9 10 513do 514 ret=0 515 $DIG $DIGOPTS @10.53.0.3 bits SOA > dig.out.ns3.test$n 516 grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || ret=1 517 grep "ANSWER: 2," dig.out.ns3.test$n > /dev/null || ret=1 518 grep "2011072450" dig.out.ns3.test$n > /dev/null || ret=1 519 if [ $ret = 0 ]; then break; fi 520 sleep 1 521done 522if [ $ret != 0 ]; then echo_i "failed"; fi 523status=$((status + ret)) 524 525$NSUPDATE << EOF 526zone noixfr 527server 10.53.0.4 ${PORT} 528update add noixfr 0 SOA ns4.noixfr. . 2011072450 20 20 1814400 3600 529send 530EOF 531 532n=$((n + 1)) 533echo_i "checking YYYYMMDDVV (2011072450) serial on hidden primary, noixfr ($n)" 534ret=0 535$DIG $DIGOPTS @10.53.0.4 noixfr SOA > dig.out.ns4.test$n 536grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 537grep "ANSWER: 1," dig.out.ns4.test$n > /dev/null || ret=1 538grep "2011072450" dig.out.ns4.test$n > /dev/null || ret=1 539if [ $ret != 0 ]; then echo_i "failed"; fi 540status=$((status + ret)) 541 542n=$((n + 1)) 543echo_i "checking YYYYMMDDVV (2011072450) serial in signed zone, noixfr ($n)" 544for i in 1 2 3 4 5 6 7 8 9 10 545do 546 ret=0 547 $DIG $DIGOPTS @10.53.0.3 noixfr SOA > dig.out.ns3.test$n 548 grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || ret=1 549 grep "ANSWER: 2," dig.out.ns3.test$n > /dev/null || ret=1 550 grep "2011072450" dig.out.ns3.test$n > /dev/null || ret=1 551 if [ $ret = 0 ]; then break; fi 552 sleep 1 553done 554if [ $ret != 0 ]; then echo_i "failed"; fi 555status=$((status + ret)) 556 557$NSUPDATE << EOF 558zone bits 559server 10.53.0.3 ${PORT} 560update add bits 0 SOA ns2.bits. . 2011072460 20 20 1814400 3600 561send 562EOF 563 564n=$((n + 1)) 565echo_i "checking forwarded update on hidden primary ($n)" 566ret=0 567$DIG $DIGOPTS @10.53.0.2 bits SOA > dig.out.ns2.test$n 568grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1 569grep "ANSWER: 1," dig.out.ns2.test$n > /dev/null || ret=1 570grep "2011072460" dig.out.ns2.test$n > /dev/null || ret=1 571if [ $ret != 0 ]; then echo_i "failed"; fi 572status=$((status + ret)) 573 574n=$((n + 1)) 575echo_i "checking forwarded update on signed zone ($n)" 576for i in 1 2 3 4 5 6 7 8 9 10 577do 578 ret=0 579 $DIG $DIGOPTS @10.53.0.3 bits SOA > dig.out.ns3.test$n 580 grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || ret=1 581 grep "ANSWER: 2," dig.out.ns3.test$n > /dev/null || ret=1 582 grep "2011072460" dig.out.ns3.test$n > /dev/null || ret=1 583 if [ $ret = 0 ]; then break; fi 584 sleep 1 585done 586if [ $ret != 0 ]; then echo_i "failed"; fi 587status=$((status + ret)) 588 589$NSUPDATE << EOF 590zone noixfr 591server 10.53.0.3 ${PORT} 592update add noixfr 0 SOA ns4.noixfr. . 2011072460 20 20 1814400 3600 593send 594EOF 595 596n=$((n + 1)) 597echo_i "checking forwarded update on hidden primary, noixfr ($n)" 598ret=0 599$DIG $DIGOPTS @10.53.0.4 noixfr SOA > dig.out.ns4.test$n 600grep "status: NOERROR" dig.out.ns4.test$n > /dev/null || ret=1 601grep "ANSWER: 1," dig.out.ns4.test$n > /dev/null || ret=1 602grep "2011072460" dig.out.ns4.test$n > /dev/null || ret=1 603if [ $ret != 0 ]; then echo_i "failed"; fi 604status=$((status + ret)) 605 606n=$((n + 1)) 607echo_i "checking forwarded update on signed zone, noixfr ($n)" 608for i in 1 2 3 4 5 6 7 8 9 10 609do 610 ret=0 611 $DIG $DIGOPTS @10.53.0.3 noixfr SOA > dig.out.ns3.test$n 612 grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || ret=1 613 grep "ANSWER: 2," dig.out.ns3.test$n > /dev/null || ret=1 614 grep "2011072460" dig.out.ns3.test$n > /dev/null || ret=1 615 if [ $ret = 0 ]; then break; fi 616 sleep 1 617done 618if [ $ret != 0 ]; then echo_i "failed"; fi 619status=$((status + ret)) 620 621ret=0 622n=$((n + 1)) 623echo_i "checking turning on of inline signing in a secondary zone via reload ($n)" 624$DIG $DIGOPTS @10.53.0.5 +dnssec bits SOA > dig.out.ns5.test$n 625grep "status: NOERROR" dig.out.ns5.test$n > /dev/null || ret=1 626grep "ANSWER: 1," dig.out.ns5.test$n > /dev/null || ret=1 627if [ $ret != 0 ]; then echo_i "setup broken"; fi 628status=$((status + ret)) 629copy_setports ns5/named.conf.post ns5/named.conf 630(cd ns5; $KEYGEN -q -a ${DEFAULT_ALGORITHM} bits) > /dev/null 2>&1 631(cd ns5; $KEYGEN -q -a ${DEFAULT_ALGORITHM} -f KSK bits) > /dev/null 2>&1 632rndc_reload ns5 10.53.0.5 633for i in 1 2 3 4 5 6 7 8 9 10 634do 635 ret=0 636 $DIG $DIGOPTS @10.53.0.5 bits SOA > dig.out.ns5.test$n 637 grep "status: NOERROR" dig.out.ns5.test$n > /dev/null || ret=1 638 grep "ANSWER: 2," dig.out.ns5.test$n > /dev/null || ret=1 639 if [ $ret = 0 ]; then break; fi 640 sleep 1 641done 642if [ $ret != 0 ]; then echo_i "failed"; fi 643status=$((status + ret)) 644 645n=$((n + 1)) 646echo_i "checking rndc freeze/thaw of dynamic inline zone no change ($n)" 647ret=0 648$RNDCCMD 10.53.0.3 freeze dynamic > freeze.test$n 2>&1 || { echo_i "/' < freeze.test$n"; ret=1; } 649sleep 1 650$RNDCCMD 10.53.0.3 thaw dynamic > thaw.test$n 2>&1 || { echo_i "rndc thaw dynamic failed" ; ret=1; } 651sleep 1 652grep "zone dynamic/IN (unsigned): ixfr-from-differences: unchanged" ns3/named.run > /dev/null || ret=1 653if [ $ret != 0 ]; then echo_i "failed"; fi 654status=$((status + ret)) 655 656 657n=$((n + 1)) 658echo_i "checking rndc freeze/thaw of dynamic inline zone ($n)" 659ret=0 660$RNDCCMD 10.53.0.3 freeze dynamic > freeze.test$n 2>&1 || ret=1 661sleep 1 662awk '$2 == ";" && $3 ~ /serial/ { printf("%d %s %s\n", $1 + 1, $2, $3); next; } 663 { print; } 664 END { print "freeze1.dynamic. 0 TXT freeze1"; } ' ns3/dynamic.db > ns3/dynamic.db.new 665mv ns3/dynamic.db.new ns3/dynamic.db 666$RNDCCMD 10.53.0.3 thaw dynamic > thaw.test$n 2>&1 || ret=1 667if [ $ret != 0 ]; then echo_i "failed"; fi 668status=$((status + ret)) 669 670n=$((n + 1)) 671echo_i "check added record freeze1.dynamic ($n)" 672for i in 1 2 3 4 5 6 7 8 9 673do 674 ret=0 675 $DIG $DIGOPTS @10.53.0.3 freeze1.dynamic TXT > dig.out.ns3.test$n 676 grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || ret=1 677 grep "ANSWER: 2," dig.out.ns3.test$n > /dev/null || ret=1 678 test $ret = 0 && break 679 sleep 1 680done 681if [ $ret != 0 ]; then echo_i "failed"; fi 682status=$((status + ret)) 683 684# allow 1 second so that file time stamps change 685sleep 1 686 687n=$((n + 1)) 688echo_i "checking rndc freeze/thaw of server ($n)" 689ret=0 690$RNDCCMD 10.53.0.3 freeze > freeze.test$n 2>&1 || ret=1 691sleep 1 692awk '$2 == ";" && $3 ~ /serial/ { printf("%d %s %s\n", $1 + 1, $2, $3); next; } 693 { print; } 694 END { print "freeze2.dynamic. 0 TXT freeze2"; } ' ns3/dynamic.db > ns3/dynamic.db.new 695mv ns3/dynamic.db.new ns3/dynamic.db 696$RNDCCMD 10.53.0.3 thaw > thaw.test$n 2>&1 || ret=1 697if [ $ret != 0 ]; then echo_i "failed"; fi 698status=$((status + ret)) 699 700n=$((n + 1)) 701echo_i "check added record freeze2.dynamic ($n)" 702for i in 1 2 3 4 5 6 7 8 9 703do 704 ret=0 705 $DIG $DIGOPTS @10.53.0.3 freeze2.dynamic TXT > dig.out.ns3.test$n 706 grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || ret=1 707 grep "ANSWER: 2," dig.out.ns3.test$n > /dev/null || ret=1 708 test $ret = 0 && break 709 sleep 1 710done 711if [ $ret != 0 ]; then echo_i "failed"; fi 712status=$((status + ret)) 713 714n=$((n + 1)) 715echo_i "check rndc reload allows reuse of inline-signing zones ($n)" 716ret=0 717{ $RNDCCMD 10.53.0.3 reload 2>&1 || ret=1 ; } | sed 's/^/ns3 /' | cat_i 718grep "not reusable" ns3/named.run > /dev/null 2>&1 && ret=1 719if [ $ret != 0 ]; then echo_i "failed"; fi 720status=$((status + ret)) 721 722n=$((n + 1)) 723echo_i "check rndc sync removes both signed and unsigned journals ($n)" 724ret=0 725[ -f ns3/dynamic.db.jnl ] || ret=1 726[ -f ns3/dynamic.db.signed.jnl ] || ret=1 727$RNDCCMD 10.53.0.3 sync -clean dynamic 2>&1 || ret=1 728[ -f ns3/dynamic.db.jnl ] && ret=1 729[ -f ns3/dynamic.db.signed.jnl ] && ret=1 730if [ $ret != 0 ]; then echo_i "failed"; fi 731status=$((status + ret)) 732 733$NSUPDATE << EOF 734zone retransfer 735server 10.53.0.2 ${PORT} 736update add added.retransfer 0 A 1.2.3.4 737send 738 739EOF 740 741n=$((n + 1)) 742echo_i "checking that the retransfer record is added on the hidden primary ($n)" 743ret=0 744$DIG $DIGOPTS @10.53.0.2 added.retransfer A > dig.out.ns2.test$n 745grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1 746grep "ANSWER: 1," dig.out.ns2.test$n > /dev/null || ret=1 747if [ $ret != 0 ]; then echo_i "failed"; fi 748status=$((status + ret)) 749 750n=$((n + 1)) 751echo_i "checking that the change has not been transferred due to notify ($n)" 752ret=0 753for i in 0 1 2 3 4 5 6 7 8 9 754do 755 ans=0 756 $DIG $DIGOPTS @10.53.0.3 added.retransfer A > dig.out.ns3.test$n 757 grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || ans=1 758 [ $ans = 0 ] && break 759 sleep 1 760done 761if [ $ans != 1 ]; then echo_i "failed"; ret=1; fi 762status=$((status + ret)) 763 764n=$((n + 1)) 765echo_i "check rndc retransfer of a inline secondary zone works ($n)" 766ret=0 767$RNDCCMD 10.53.0.3 retransfer retransfer 2>&1 || ret=1 768for i in 0 1 2 3 4 5 6 7 8 9 769do 770 ans=0 771 $DIG $DIGOPTS @10.53.0.3 added.retransfer A > dig.out.ns3.test$n 772 grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || ans=1 773 grep "ANSWER: 2," dig.out.ns3.test$n > /dev/null || ans=1 774 [ $ans = 0 ] && break 775 sleep 1 776done 777[ $ans = 1 ] && ret=1 778if [ $ret != 0 ]; then echo_i "failed"; fi 779status=$((status + ret)) 780 781n=$((n + 1)) 782echo_i "check 'rndc signing -nsec3param' requests are queued for zones which are not loaded ($n)" 783ret=0 784# The "retransfer3" zone is configured with "allow-transfer { none; };" on ns2, 785# which means it should not yet be available on ns3. 786$DIG $DIGOPTS @10.53.0.3 retransfer3 SOA > dig.out.ns3.pre.test$n 787grep "status: SERVFAIL" dig.out.ns3.pre.test$n > /dev/null || ret=1 788# Switch the zone to NSEC3. An "NSEC3 -> NSEC -> NSEC3" sequence is used purely 789# to test that multiple queued "rndc signing -nsec3param" requests are handled 790# properly. 791$RNDCCMD 10.53.0.3 signing -nsec3param 1 0 0 - retransfer3 > /dev/null 2>&1 || ret=1 792$RNDCCMD 10.53.0.3 signing -nsec3param none retransfer3 > /dev/null 2>&1 || ret=1 793$RNDCCMD 10.53.0.3 signing -nsec3param 1 0 0 - retransfer3 > /dev/null 2>&1 || ret=1 794# Reconfigure ns2 to allow outgoing transfers for the "retransfer3" zone. 795sed "s|\(allow-transfer { none; };.*\)|// \1|;" ns2/named.conf > ns2/named.conf.new 796mv ns2/named.conf.new ns2/named.conf 797$RNDCCMD 10.53.0.2 reconfig || ret=1 798# Request ns3 to retransfer the "retransfer3" zone. 799$RNDCCMD 10.53.0.3 retransfer retransfer3 || ret=1 800# Check whether "retransfer3" uses NSEC3 as requested. 801for i in 0 1 2 3 4 5 6 7 8 9 802do 803 ret=0 804 $DIG $DIGOPTS @10.53.0.3 nonexist.retransfer3 A > dig.out.ns3.post.test$n.$i 805 grep "status: NXDOMAIN" dig.out.ns3.post.test$n.$i > /dev/null || ret=1 806 grep "NSEC3" dig.out.ns3.post.test$n.$i > /dev/null || ret=1 807 test $ret -eq 0 && break 808 sleep 1 809done 810if [ $ret != 0 ]; then echo_i "failed"; fi 811status=$((status + ret)) 812 813n=$((n + 1)) 814echo_i "check rndc retransfer of a inline nsec3 secondary retains nsec3 ($n)" 815ret=0 816$RNDCCMD 10.53.0.3 signing -nsec3param 1 0 0 - retransfer3 > /dev/null 2>&1 || ret=1 817for i in 0 1 2 3 4 5 6 7 8 9 818do 819 ans=0 820 $DIG $DIGOPTS @10.53.0.3 nonexist.retransfer3 A > dig.out.ns3.pre.test$n 821 grep "status: NXDOMAIN" dig.out.ns3.pre.test$n > /dev/null || ans=1 822 grep "NSEC3" dig.out.ns3.pre.test$n > /dev/null || ans=1 823 [ $ans = 0 ] && break 824 sleep 1 825done 826$RNDCCMD 10.53.0.3 retransfer retransfer3 2>&1 || ret=1 827for i in 0 1 2 3 4 5 6 7 8 9 828do 829 ans=0 830 $DIG $DIGOPTS @10.53.0.3 nonexist.retransfer3 A > dig.out.ns3.post.test$n 831 grep "status: NXDOMAIN" dig.out.ns3.post.test$n > /dev/null || ans=1 832 grep "NSEC3" dig.out.ns3.post.test$n > /dev/null || ans=1 833 [ $ans = 0 ] && break 834 sleep 1 835done 836[ $ans = 1 ] && ret=1 837if [ $ret != 0 ]; then echo_i "failed"; fi 838status=$((status + ret)) 839 840# NOTE: The test below should be considered fragile. More details can be found 841# in the comment inside ns7/named.conf. 842n=$((n + 1)) 843echo_i "check rndc retransfer of a inline nsec3 secondary does not trigger an infinite loop ($n)" 844ret=0 845zone=nsec3-loop 846# Add secondary zone using rndc 847$RNDCCMD 10.53.0.7 addzone $zone \ 848 '{ type secondary; primaries { 10.53.0.2; }; file "'$zone'.db"; inline-signing yes; auto-dnssec maintain; };' 849# Wait until secondary zone is fully signed using NSEC 850for i in 1 2 3 4 5 6 7 8 9 0 851do 852 ret=1 853 $RNDCCMD 10.53.0.7 signing -list $zone > signing.out.test$n 2>&1 854 keys=$(grep '^Done signing' signing.out.test$n | wc -l) 855 [ $keys -eq 3 ] && ret=0 && break 856 sleep 1 857done 858# Switch secondary zone to NSEC3 859$RNDCCMD 10.53.0.7 signing -nsec3param 1 0 2 12345678 $zone > /dev/null 2>&1 860# Wait until secondary zone is fully signed using NSEC3 861for i in 1 2 3 4 5 6 7 8 9 0 862do 863 ret=1 864 nsec3param=$($DIG $DIGOPTS +nodnssec +short @10.53.0.7 nsec3param $zone) 865 test "$nsec3param" = "1 0 2 12345678" && ret=0 && break 866 sleep 1 867done 868# Attempt to retransfer the secondary zone from primary 869$RNDCCMD 10.53.0.7 retransfer $zone 870# Check whether the signer managed to fully sign the retransferred zone by 871# waiting for a specific SOA serial number to appear in the logs; if this 872# specific SOA serial number does not appear in the logs, it means the signer 873# has either ran into an infinite loop or crashed; note that we check the logs 874# instead of sending SOA queries to the signer as these may influence its 875# behavior in a way which may prevent the desired scenario from being 876# reproduced (see comment in ns7/named.conf) 877for i in 1 2 3 4 5 6 7 8 9 0 878do 879 ret=1 880 grep "ns2.$zone. . 10 20 20 1814400 3600" ns7/named.run > /dev/null 2>&1 881 [ $? -eq 0 ] && ret=0 && break 882 sleep 1 883done 884if [ $ret != 0 ]; then echo_i "failed"; fi 885status=$((status + ret)) 886 887n=$((n + 1)) 888echo_i "stop bump in the wire signer server ($n)" 889ret=0 890stop_server ns3 || ret=1 891if [ $ret != 0 ]; then echo_i "failed"; fi 892status=$((status + ret)) 893 894echo_i "update SOA record while stopped" 895cp ns3/master4.db.in ns3/master.db 896rm ns3/master.db.jnl 897 898n=$((n + 1)) 899echo_i "restart bump in the wire signer server ($n)" 900ret=0 901start_server --noclean --restart --port ${PORT} ns3 || ret=1 902if [ $ret != 0 ]; then echo_i "failed"; fi 903status=$((status + ret)) 904 905n=$((n + 1)) 906echo_i "updates to SOA parameters other than serial while stopped are reflected in signed zone ($n)" 907ret=0 908for i in 1 2 3 4 5 6 7 8 9 909do 910 ans=0 911 $DIG $DIGOPTS @10.53.0.3 master SOA > dig.out.ns3.test$n 912 grep "hostmaster" dig.out.ns3.test$n > /dev/null || ans=1 913 grep "ANSWER: 2," dig.out.ns3.test$n > /dev/null || ans=1 914 [ $ans = 1 ] || break 915 sleep 1 916done 917[ $ans = 0 ] || ret=1 918if [ $ret != 0 ]; then echo_i "failed"; fi 919status=$((status + ret)) 920 921n=$((n + 1)) 922echo_i "check that reloading all zones does not cause zone maintenance to cease for inline-signed zones ($n)" 923ret=1 924# Ensure "rndc reload" attempts to load ns3/master.db by waiting 1 second so 925# that the file modification time has no possibility of being equal to 926# the one stored during server startup. 927sleep 1 928nextpart ns3/named.run > /dev/null 929cp ns3/master5.db.in ns3/master.db 930rndc_reload ns3 10.53.0.3 931for i in 1 2 3 4 5 6 7 8 9 10 932do 933 if nextpart ns3/named.run | grep "zone master.*sending notifies" > /dev/null; then 934 ret=0 935 break 936 fi 937 sleep 1 938done 939# Sanity check: file updates should be reflected in the signed zone, 940# i.e. SOA RNAME should no longer be set to "hostmaster". 941$DIG $DIGOPTS @10.53.0.3 master SOA > dig.out.ns3.test$n || ret=1 942grep "hostmaster" dig.out.ns3.test$n > /dev/null && ret=1 943if [ $ret != 0 ]; then echo_i "failed"; fi 944status=$((status + ret)) 945 946n=$((n + 1)) 947echo_i "check that reloading errors prevent synchronization ($n)" 948ret=1 949$DIG $DIGOPTS +short @10.53.0.3 master SOA > dig.out.ns3.test$n.1 || ret=1 950sleep 1 951nextpart ns3/named.run > /dev/null 952cp ns3/master6.db.in ns3/master.db 953rndc_reload ns3 10.53.0.3 954for i in 1 2 3 4 5 6 7 8 9 10 955do 956 if nextpart ns3/named.run | grep "not loaded due to errors" > /dev/null 957 then 958 ret=0 959 break 960 fi 961 sleep 1 962done 963# Sanity check: the SOA record should be unchanged 964$DIG $DIGOPTS +short @10.53.0.3 master SOA > dig.out.ns3.test$n.2 || ret=1 965$DIFF dig.out.ns3.test$n.1 dig.out.ns3.test$n.2 > /dev/null || ret=1 966if [ $ret != 0 ]; then echo_i "failed"; fi 967status=$((status + ret)) 968 969n=$((n + 1)) 970echo_i "check inline-signing with an include file ($n)" 971ret=0 972$DIG $DIGOPTS +short @10.53.0.3 master SOA > dig.out.ns3.test$n.1 || ret=1 973if [ $ret != 0 ]; then echo_i "failed"; fi 974status=$((status + ret)) 975sleep 1 976nextpart ns3/named.run > /dev/null 977cp ns3/master7.db.in ns3/master.db 978rndc_reload ns3 10.53.0.3 979_includefile_loaded() { 980 $DIG $DIGOPTS @10.53.0.3 f.master A > dig.out.ns3.test$n 981 grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || return 1 982 grep "ANSWER: 2," dig.out.ns3.test$n > /dev/null || return 1 983 grep "10\.0\.0\.7" dig.out.ns3.test$n > /dev/null || return 1 984 return 0 985} 986retry_quiet 10 _includefile_loaded 987# Sanity check: the SOA record should be changed 988$DIG $DIGOPTS +short @10.53.0.3 master SOA > dig.out.ns3.test$n.2 || ret=1 989$DIFF dig.out.ns3.test$n.1 dig.out.ns3.test$n.2 > /dev/null && ret=1 990if [ $ret != 0 ]; then echo_i "failed"; fi 991status=$((status + ret)) 992 993n=$((n + 1)) 994echo_i "test add/del zone combinations ($n)" 995ret=0 996for zone in a b c d e f g h i j k l m n o p q r s t u v w x y z 997do 998$RNDCCMD 10.53.0.2 addzone test-$zone \ 999 '{ type primary; file "bits.db.in"; allow-transfer { any; }; };' 1000$DIG $DIGOPTS @10.53.0.2 test-$zone SOA > dig.out.ns2.$zone.test$n 1001grep "status: NOERROR," dig.out.ns2.$zone.test$n > /dev/null || { ret=1; cat dig.out.ns2.$zone.test$n; } 1002$RNDCCMD 10.53.0.3 addzone test-$zone \ 1003 '{ type secondary; primaries { 10.53.0.2; }; file "'test-$zone.bk'"; inline-signing yes; auto-dnssec maintain; allow-transfer { any; }; };' 1004$RNDCCMD 10.53.0.3 delzone test-$zone > /dev/null 2>&1 1005done 1006if [ $ret != 0 ]; then echo_i "failed"; fi 1007status=$((status + ret)) 1008 1009n=$((n + 1)) 1010echo_i "testing adding external keys to a inline zone ($n)" 1011ret=0 1012$DIG $DIGOPTS @10.53.0.3 dnskey externalkey > dig.out.ns3.test$n 1013for alg in ${DEFAULT_ALGORITHM_NUMBER} ${ALTERNATIVE_ALGORITHM_NUMBER} 1014do 1015 [ $alg = 13 -a ! -f checkecdsa ] && continue; 1016 1017 case $alg in 1018 7) echo_i "checking NSEC3RSASHA1";; 1019 8) echo_i "checking RSASHA256";; 1020 13) echo_i "checking ECDSAP256SHA256";; 1021 *) echo_i "checking $alg";; 1022 esac 1023 1024 dnskeys=$(grep "IN.DNSKEY.25[67] [0-9]* $alg " dig.out.ns3.test$n | wc -l) 1025 rrsigs=$(grep "RRSIG.DNSKEY $alg " dig.out.ns3.test$n | wc -l) 1026 test ${dnskeys:-0} -eq 3 || { echo_i "failed $alg (dnskeys ${dnskeys:-0})"; ret=1; } 1027 test ${rrsigs:-0} -eq 2 || { echo_i "failed $alg (rrsigs ${rrsigs:-0})"; ret=1; } 1028done 1029if [ $ret != 0 ]; then echo_i "failed"; fi 1030status=$((status + ret)) 1031 1032n=$((n + 1)) 1033echo_i "testing imported key won't overwrite a private key ($n)" 1034ret=0 1035key=$($KEYGEN -q -a ${DEFAULT_ALGORITHM} import.example) 1036cp ${key}.key import.key 1037# import should fail 1038$IMPORTKEY -f import.key import.example > /dev/null 2>&1 && ret=1 1039rm -f ${key}.private 1040# private key removed; import should now succeed 1041$IMPORTKEY -f import.key import.example > /dev/null 2>&1 || ret=1 1042# now that it's an external key, re-import should succeed 1043$IMPORTKEY -f import.key import.example > /dev/null 2>&1 || ret=1 1044if [ $ret != 0 ]; then echo_i "failed"; fi 1045status=$((status + ret)) 1046 1047n=$((n + 1)) 1048echo_i "testing updating inline secure serial via 'rndc signing -serial' ($n)" 1049ret=0 1050$DIG $DIGOPTS nsec3. SOA @10.53.0.3 > dig.out.n3.pre.test$n 1051newserial=$($PERL -e 'while (<>) { chomp; my @field = split /\s+/; printf("%u\n", $field[6] + 10) if ($field[3] eq "SOA"); }' < dig.out.n3.pre.test$n) 1052$RNDCCMD 10.53.0.3 signing -serial ${newserial:-0} nsec3 > /dev/null 2>&1 1053retry_quiet 5 wait_for_serial 10.53.0.3 nsec3. "${newserial:-0}" dig.out.ns3.post.test$n || ret=1 1054if [ $ret != 0 ]; then echo_i "failed"; fi 1055status=$((status + ret)) 1056 1057n=$((n + 1)) 1058echo_i "testing updating inline secure serial via 'rndc signing -serial' with negative change ($n)" 1059ret=0 1060$DIG $DIGOPTS nsec3. SOA @10.53.0.3 > dig.out.n3.pre.test$n 1061oldserial=$(awk '$4 == "SOA" { print $7 }' dig.out.n3.pre.test$n) 1062newserial=$($PERL -e 'while (<>) { chomp; my @field = split /\s+/; printf("%u\n", $field[6] - 10) if ($field[3] eq "SOA"); }' < dig.out.n3.pre.test$n) 1063$RNDCCMD 10.53.0.3 signing -serial ${newserial:-0} nsec3 > /dev/null 2>&1 1064sleep 1 1065$DIG $DIGOPTS nsec3. SOA @10.53.0.3 > dig.out.ns3.post.test$n 1066serial=$(awk '$4 == "SOA" { print $7 }' dig.out.ns3.post.test$n) 1067[ ${oldserial:-0} -eq ${serial:-1} ] || ret=1 1068if [ $ret != 0 ]; then echo_i "failed"; fi 1069status=$((status + ret)) 1070 1071# 1072# Freezing only operates on the raw zone. 1073# 1074n=$((n + 1)) 1075echo_i "testing updating inline secure serial via 'rndc signing -serial' when frozen ($n)" 1076ret=0 1077$DIG $DIGOPTS nsec3. SOA @10.53.0.3 > dig.out.n3.pre.test$n 1078oldserial=$(awk '$4 == "SOA" { print $7 }' dig.out.n3.pre.test$n) 1079newserial=$($PERL -e 'while (<>) { chomp; my @field = split /\s+/; printf("%u\n", $field[6] + 10) if ($field[3] eq "SOA"); }' < dig.out.n3.pre.test$n) 1080$RNDCCMD 10.53.0.3 freeze nsec3 > /dev/null 2>&1 1081$RNDCCMD 10.53.0.3 signing -serial ${newserial:-0} nsec3 > /dev/null 2>&1 1082$RNDCCMD 10.53.0.3 thaw nsec3 > /dev/null 2>&1 1083retry_quiet 5 wait_for_serial 10.53.0.3 nsec3. "${newserial:-0}" dig.out.ns3.post1.test$n || ret=1 1084if [ $ret != 0 ]; then echo_i "failed"; fi 1085status=$((status + ret)) 1086 1087n=$((n + 1)) 1088echo_i "testing updating dynamic serial via 'rndc signing -serial' ($n)" 1089ret=0 1090$DIG $DIGOPTS bits. SOA @10.53.0.2 > dig.out.ns2.pre.test$n 1091newserial=$($PERL -e 'while (<>) { chomp; my @field = split /\s+/; printf("%u\n", $field[6] + 10) if ($field[3] eq "SOA"); }' < dig.out.ns2.pre.test$n) 1092$RNDCCMD 10.53.0.2 signing -serial ${newserial:-0} bits > /dev/null 2>&1 1093retry_quiet 5 wait_for_serial 10.53.0.2 bits. "${newserial:-0}" dig.out.ns2.post.test$n || ret=1 1094if [ $ret != 0 ]; then echo_i "failed"; fi 1095status=$((status + ret)) 1096 1097n=$((n + 1)) 1098echo_i "testing updating dynamic serial via 'rndc signing -serial' with negative change ($n)" 1099ret=0 1100$DIG $DIGOPTS bits. SOA @10.53.0.2 > dig.out.ns2.pre.test$n 1101oldserial=$(awk '$4 == "SOA" { print $7 }' dig.out.ns2.pre.test$n) 1102newserial=$($PERL -e 'while (<>) { chomp; my @field = split /\s+/; printf("%u\n", $field[6] - 10) if ($field[3] eq "SOA"); }' < dig.out.ns2.pre.test$n) 1103$RNDCCMD 10.53.0.2 signing -serial ${newserial:-0} bits > /dev/null 2>&1 1104retry_quiet 5 wait_for_serial 10.53.0.2 bits. "${newserial:-1}" dig.out.ns2.post1.test$n && ret=1 1105retry_quiet 5 wait_for_serial 10.53.0.2 bits. "${oldserial:-1}" dig.out.ns2.post2.test$n || ret=1 1106if [ $ret != 0 ]; then echo_i "failed"; fi 1107status=$((status + ret)) 1108 1109n=$((n + 1)) 1110echo_i "testing updating dynamic serial via 'rndc signing -serial' when frozen ($n)" 1111ret=0 1112$DIG $DIGOPTS bits. SOA @10.53.0.2 > dig.out.ns2.pre.test$n 1113oldserial=$(awk '$4 == "SOA" { print $7 }' dig.out.ns2.pre.test$n) 1114newserial=$($PERL -e 'while (<>) { chomp; my @field = split /\s+/; printf("%u\n", $field[6] + 10) if ($field[3] eq "SOA"); }' < dig.out.ns2.pre.test$n) 1115$RNDCCMD 10.53.0.2 freeze bits > /dev/null 2>&1 1116$RNDCCMD 10.53.0.2 signing -serial ${newserial:-0} bits > /dev/null 2>&1 1117$RNDCCMD 10.53.0.2 thaw bits > /dev/null 2>&1 1118retry_quiet 5 wait_for_serial 10.53.0.2 bits. "${newserial:-1}" dig.out.ns2.post1.test$n && ret=1 1119retry_quiet 5 wait_for_serial 10.53.0.2 bits. "${oldserial:-1}" dig.out.ns2.post2.test$n || ret=1 1120if [ $ret != 0 ]; then echo_i "failed"; fi 1121status=$((status + ret)) 1122 1123n=$((n + 1)) 1124echo_i "testing that inline signing works with inactive ZSK and active KSK ($n)" 1125ret=0 1126 1127$DIG $DIGOPTS @10.53.0.3 soa inactivezsk > dig.out.ns3.pre.test$n || ret=1 1128soa1=$(awk '$4 == "SOA" { print $7 }' dig.out.ns3.pre.test$n) 1129 1130$NSUPDATE << EOF 1131server 10.53.0.2 ${PORT} 1132update add added.inactivezsk 0 IN TXT added record 1133send 1134EOF 1135 1136for i in 1 2 3 4 5 6 7 8 9 10 1137do 1138 $DIG $DIGOPTS @10.53.0.3 soa inactivezsk > dig.out.ns3.post.test$n || ret=1 1139 soa2=$(awk '$4 == "SOA" { print $7 }' dig.out.ns3.post.test$n) 1140 test ${soa1:-0} -ne ${soa2:-0} && break 1141 sleep 1 1142done 1143test ${soa1:-0} -ne ${soa2:-0} || ret=1 1144 1145$DIG $DIGOPTS @10.53.0.3 txt added.inactivezsk > dig.out.ns3.test$n || ret=1 1146grep "ANSWER: 3," dig.out.ns3.test$n > /dev/null || ret=1 1147grep "RRSIG" dig.out.ns3.test$n > /dev/null || ret=1 1148grep "TXT ${DEFAULT_ALGORITHM_NUMBER} 2" dig.out.ns3.test$n > /dev/null || ret=1 1149grep "TXT ${ALTERNATIVE_ALGORITHM_NUMBER} 2" dig.out.ns3.test$n > /dev/null || ret=1 1150 1151if [ $ret != 0 ]; then echo_i "failed"; fi 1152status=$((status + ret)) 1153 1154n=$((n + 1)) 1155echo_i "testing that inline signing works with inactive KSK and active ZSK ($n)" 1156ret=0 1157 1158$DIG $DIGOPTS @10.53.0.3 axfr inactiveksk > dig.out.ns3.test$n 1159 1160# 1161# check that DNSKEY is signed with ZSK for default algorithm 1162# 1163awk='$4 == "DNSKEY" && $5 == 256 && $7 == alg { print }' 1164zskid=$(awk -v alg=${DEFAULT_ALGORITHM_NUMBER} "${awk}" dig.out.ns3.test$n | 1165 $DSFROMKEY -A -2 -f - inactiveksk | awk '{ print $4}' ) 1166grep "DNSKEY ${DEFAULT_ALGORITHM_NUMBER} 1 [0-9]* [0-9]* [0-9]* ${zskid} " dig.out.ns3.test$n > /dev/null || ret=1 1167awk='$4 == "DNSKEY" && $5 == 257 && $7 == alg { print }' 1168kskid=$(awk -v alg=${DEFAULT_ALGORITHM_NUMBER} "${awk}" dig.out.ns3.test$n | 1169 $DSFROMKEY -2 -f - inactiveksk | awk '{ print $4}' ) 1170grep "DNSKEY ${DEFAULT_ALGORITHM_NUMBER} 1 [0-9]* [0-9]* [0-9]* ${kskid} " dig.out.ns3.test$n > /dev/null && ret=1 1171 1172# 1173# check that DNSKEY is signed with KSK for alternative algorithm 1174# 1175awk='$4 == "DNSKEY" && $5 == 256 && $7 == alg { print }' 1176zskid=$(awk -v alg=${ALTERNATIVE_ALGORITHM_NUMBER} "${awk}" dig.out.ns3.test$n | 1177 $DSFROMKEY -A -2 -f - inactiveksk | awk '{ print $4}' ) 1178grep "DNSKEY ${ALTERNATIVE_ALGORITHM_NUMBER} 1 [0-9]* [0-9]* [0-9]* ${zskid} " dig.out.ns3.test$n > /dev/null && ret=1 1179awk='$4 == "DNSKEY" && $5 == 257 && $7 == alg { print }' 1180kskid=$(awk -v alg=${ALTERNATIVE_ALGORITHM_NUMBER} "${awk}" dig.out.ns3.test$n | 1181 $DSFROMKEY -2 -f - inactiveksk | awk '{ print $4}' ) 1182grep "DNSKEY ${ALTERNATIVE_ALGORITHM_NUMBER} 1 [0-9]* [0-9]* [0-9]* ${kskid} " dig.out.ns3.test$n > /dev/null || ret=1 1183 1184if [ $ret != 0 ]; then echo_i "failed"; fi 1185status=$((status + ret)) 1186 1187# Wait until an update to the raw part of a given inline signed zone is fully 1188# processed. As waiting for a fixed amount of time is suboptimal and there is 1189# no single message that would signify both a successful modification and an 1190# error in a race-free manner, instead wait until either notifies are sent 1191# (which means the secure zone was modified) or a receive_secure_serial() error 1192# is logged (which means the zone was not modified and will not be modified any 1193# further in response to the relevant raw zone update). 1194wait_until_raw_zone_update_is_processed() { 1195 zone="$1" 1196 for i in 1 2 3 4 5 6 7 8 9 10 1197 do 1198 if nextpart ns3/named.run | grep -E "zone ${zone}.*(sending notifies|receive_secure_serial)" > /dev/null; then 1199 return 1200 fi 1201 sleep 1 1202 done 1203} 1204 1205n=$((n + 1)) 1206echo_i "checking that changes to raw zone are applied to a previously unsigned secure zone ($n)" 1207ret=0 1208# Query for bar.nokeys/A and ensure the response is negative. As this zone 1209# does not have any signing keys set up, the response must be unsigned. 1210$DIG $DIGOPTS @10.53.0.3 bar.nokeys. A > dig.out.ns3.pre.test$n 2>&1 || ret=1 1211grep "status: NOERROR" dig.out.ns3.pre.test$n > /dev/null && ret=1 1212grep "RRSIG" dig.out.ns3.pre.test$n > /dev/null && ret=1 1213# Ensure the wait_until_raw_zone_update_is_processed() call below will ignore 1214# log messages generated before the raw zone is updated. 1215nextpart ns3/named.run > /dev/null 1216# Add a record to the raw zone on the primary. 1217$NSUPDATE << EOF || ret=1 1218zone nokeys. 1219server 10.53.0.2 ${PORT} 1220update add bar.nokeys. 0 A 127.0.0.1 1221send 1222EOF 1223wait_until_raw_zone_update_is_processed "nokeys" 1224# Query for bar.nokeys/A again and ensure the signer now returns a positive, 1225# yet still unsigned response. 1226$DIG $DIGOPTS @10.53.0.3 bar.nokeys. A > dig.out.ns3.post.test$n 2>&1 1227grep "status: NOERROR" dig.out.ns3.post.test$n > /dev/null || ret=1 1228grep "RRSIG" dig.out.ns3.pre.test$n > /dev/null && ret=1 1229if [ $ret != 0 ]; then echo_i "failed"; fi 1230status=$((status + ret)) 1231 1232n=$((n + 1)) 1233echo_i "checking that changes to raw zone are not applied to a previously signed secure zone with no keys available (primary) ($n)" 1234ret=0 1235# Query for bar.removedkeys-primary/A and ensure the response is negative. As 1236# this zone has signing keys set up, the response must be signed. 1237$DIG $DIGOPTS @10.53.0.3 bar.removedkeys-primary. A > dig.out.ns3.pre.test$n 2>&1 || ret=1 1238grep "status: NOERROR" dig.out.ns3.pre.test$n > /dev/null && ret=1 1239grep "RRSIG" dig.out.ns3.pre.test$n > /dev/null || ret=1 1240# Remove the signing keys for this zone. 1241mv -f ns3/Kremovedkeys-primary* ns3/removedkeys 1242# Ensure the wait_until_raw_zone_update_is_processed() call below will ignore 1243# log messages generated before the raw zone is updated. 1244nextpart ns3/named.run > /dev/null 1245# Add a record to the raw zone on the primary. 1246$NSUPDATE << EOF || ret=1 1247zone removedkeys-primary. 1248server 10.53.0.3 ${PORT} 1249update add bar.removedkeys-primary. 0 A 127.0.0.1 1250send 1251EOF 1252wait_until_raw_zone_update_is_processed "removedkeys-primary" 1253# Query for bar.removedkeys-primary/A again and ensure the signer still returns 1254# a negative, signed response. 1255$DIG $DIGOPTS @10.53.0.3 bar.removedkeys-primary. A > dig.out.ns3.post.test$n 2>&1 1256grep "status: NOERROR" dig.out.ns3.post.test$n > /dev/null && ret=1 1257grep "RRSIG" dig.out.ns3.pre.test$n > /dev/null || ret=1 1258if [ $ret != 0 ]; then echo_i "failed"; fi 1259status=$((status + ret)) 1260 1261n=$((n + 1)) 1262echo_i "checking that backlogged changes to raw zone are applied after keys become available (primary) ($n)" 1263ret=0 1264# Restore the signing keys for this zone. 1265mv ns3/removedkeys/Kremovedkeys-primary* ns3 1266$RNDCCMD 10.53.0.3 loadkeys removedkeys-primary > /dev/null 2>&1 1267# Determine what a SOA record with a bumped serial number should look like. 1268BUMPED_SOA=$(sed -n 's/.*\(add removedkeys-primary.*IN.*SOA\)/\1/p;' ns3/named.run | tail -1 | awk '{$8 += 1; print $0}') 1269# Ensure the wait_until_raw_zone_update_is_processed() call below will ignore 1270# log messages generated before the raw zone is updated. 1271nextpart ns3/named.run > /dev/null 1272# Bump the SOA serial number of the raw zone. 1273$NSUPDATE << EOF || ret=1 1274zone removedkeys-primary. 1275server 10.53.0.3 ${PORT} 1276update del removedkeys-primary. SOA 1277update ${BUMPED_SOA} 1278send 1279EOF 1280wait_until_raw_zone_update_is_processed "removedkeys-primary" 1281# Query for bar.removedkeys-primary/A again and ensure the signer now returns a 1282# positive, signed response. 1283$DIG $DIGOPTS @10.53.0.3 bar.removedkeys-primary. A > dig.out.ns3.test$n 2>&1 1284grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || ret=1 1285grep "RRSIG" dig.out.ns3.test$n > /dev/null || ret=1 1286if [ $ret != 0 ]; then echo_i "failed"; fi 1287status=$((status + ret)) 1288 1289n=$((n + 1)) 1290echo_i "checking that changes to raw zone are not applied to a previously signed secure zone with no keys available (secondary) ($n)" 1291ret=0 1292# Query for bar.removedkeys-secondary/A and ensure the response is negative. As this 1293# zone does have signing keys set up, the response must be signed. 1294$DIG $DIGOPTS @10.53.0.3 bar.removedkeys-secondary. A > dig.out.ns3.pre.test$n 2>&1 || ret=1 1295grep "status: NOERROR" dig.out.ns3.pre.test$n > /dev/null && ret=1 1296grep "RRSIG" dig.out.ns3.pre.test$n > /dev/null || ret=1 1297# Remove the signing keys for this zone. 1298mv -f ns3/Kremovedkeys-secondary* ns3/removedkeys 1299# Ensure the wait_until_raw_zone_update_is_processed() call below will ignore 1300# log messages generated before the raw zone is updated. 1301nextpart ns3/named.run > /dev/null 1302# Add a record to the raw zone on the primary. 1303$NSUPDATE << EOF || ret=1 1304zone removedkeys-secondary. 1305server 10.53.0.2 ${PORT} 1306update add bar.removedkeys-secondary. 0 A 127.0.0.1 1307send 1308EOF 1309wait_until_raw_zone_update_is_processed "removedkeys-secondary" 1310# Query for bar.removedkeys-secondary/A again and ensure the signer still returns a 1311# negative, signed response. 1312$DIG $DIGOPTS @10.53.0.3 bar.removedkeys-secondary. A > dig.out.ns3.post.test$n 2>&1 1313grep "status: NOERROR" dig.out.ns3.post.test$n > /dev/null && ret=1 1314grep "RRSIG" dig.out.ns3.pre.test$n > /dev/null || ret=1 1315if [ $ret != 0 ]; then echo_i "failed"; fi 1316status=$((status + ret)) 1317 1318n=$((n + 1)) 1319echo_i "checking that backlogged changes to raw zone are applied after keys become available (secondary) ($n)" 1320ret=0 1321# Restore the signing keys for this zone. 1322mv ns3/removedkeys/Kremovedkeys-secondary* ns3 1323$RNDCCMD 10.53.0.3 loadkeys removedkeys-secondary > /dev/null 2>&1 1324# Determine what a SOA record with a bumped serial number should look like. 1325BUMPED_SOA=$(sed -n 's/.*\(add removedkeys-secondary.*IN.*SOA\)/\1/p;' ns2/named.run | tail -1 | awk '{$8 += 1; print $0}') 1326# Ensure the wait_until_raw_zone_update_is_processed() call below will ignore 1327# log messages generated before the raw zone is updated. 1328nextpart ns3/named.run > /dev/null 1329# Bump the SOA serial number of the raw zone on the primary. 1330$NSUPDATE << EOF || ret=1 1331zone removedkeys-secondary. 1332server 10.53.0.2 ${PORT} 1333update del removedkeys-secondary. SOA 1334update ${BUMPED_SOA} 1335send 1336EOF 1337wait_until_raw_zone_update_is_processed "removedkeys-secondary" 1338# Query for bar.removedkeys-secondary/A again and ensure the signer now returns 1339# a positive, signed response. 1340$DIG $DIGOPTS @10.53.0.3 bar.removedkeys-secondary. A > dig.out.ns3.test$n 2>&1 1341grep "status: NOERROR" dig.out.ns3.test$n > /dev/null || ret=1 1342grep "RRSIG" dig.out.ns3.test$n > /dev/null || ret=1 1343if [ $ret != 0 ]; then echo_i "failed"; fi 1344status=$((status + ret)) 1345 1346# Check that the file $2 for zone $1 does not contain RRSIG records 1347# while the journal file for that zone does contain them. 1348ensure_sigs_only_in_journal() { 1349 origin="$1" 1350 masterfile="$2" 1351 $CHECKZONE -i none -f raw -D -o - "$origin" "$masterfile" 2>&1 | grep -w RRSIG > /dev/null && ret=1 1352 $CHECKZONE -j -i none -f raw -D -o - "$origin" "$masterfile" 2>&1 | grep -w RRSIG > /dev/null || ret=1 1353} 1354 1355n=$((n + 1)) 1356echo_i "checking that records added from a journal are scheduled to be resigned ($n)" 1357ret=0 1358# Signing keys for the "delayedkeys" zone are not yet accessible. Thus, the 1359# zone file for the signed version of the zone will contain no DNSSEC records. 1360# Move keys into place now and load them, which will cause DNSSEC records to 1361# only be present in the journal for the signed version of the zone. 1362mv Kdelayedkeys* ns3/ 1363$RNDCCMD 10.53.0.3 loadkeys delayedkeys > rndc.out.ns3.pre.test$n 2>&1 || ret=1 1364# Wait until the zone is signed. 1365check_done_signing () ( 1366 $RNDCCMD 10.53.0.3 signing -list delayedkeys > signing.out.test$n 2>&1 1367 num=$(grep "Done signing with" signing.out.test$n | wc -l) 1368 [ $num -eq 2 ] 1369) 1370retry_quiet 10 check_done_signing || ret=1 1371# Halt rather than stopping the server to prevent the file from being 1372# flushed upon shutdown since we specifically want to avoid it. 1373stop_server --use-rndc --halt --port ${CONTROLPORT} ns3 1374ensure_sigs_only_in_journal delayedkeys ns3/delayedkeys.db.signed 1375start_server --noclean --restart --port ${PORT} ns3 1376# At this point, the raw zone journal will not have a source serial set. Upon 1377# server startup, receive_secure_serial() will rectify that, update SOA, resign 1378# it, and schedule its future resign. This will cause "rndc zonestatus" to 1379# return delayedkeys/SOA as the next node to resign, so we restart the server 1380# once again; with the raw zone journal now having a source serial set, 1381# receive_secure_serial() should refrain from introducing any zone changes. 1382stop_server --use-rndc --halt --port ${CONTROLPORT} ns3 1383ensure_sigs_only_in_journal delayedkeys ns3/delayedkeys.db.signed 1384nextpart ns3/named.run > /dev/null 1385start_server --noclean --restart --port ${PORT} ns3 1386# We can now test whether the secure zone journal was correctly processed: 1387# unless the records contained in it were scheduled for resigning, no resigning 1388# event will be scheduled at all since the secure zone file contains no 1389# DNSSEC records. 1390wait_for_log 20 "all zones loaded" ns3/named.run || ret=1 1391$RNDCCMD 10.53.0.3 zonestatus delayedkeys > rndc.out.ns3.post.test$n 2>&1 || ret=1 1392grep "next resign node:" rndc.out.ns3.post.test$n > /dev/null || ret=1 1393if [ $ret != 0 ]; then echo_i "failed"; fi 1394status=$((status + ret)) 1395 1396n=$((n + 1)) 1397echo_i "check that zonestatus reports 'type: primary' for an inline primary zone ($n)" 1398ret=0 1399$RNDCCMD 10.53.0.3 zonestatus master > rndc.out.ns3.test$n 1400grep "type: primary" rndc.out.ns3.test$n > /dev/null || ret=1 1401if [ $ret != 0 ]; then echo_i "failed"; fi 1402status=$((status + ret)) 1403 1404n=$((n + 1)) 1405echo_i "check that zonestatus reports 'type: secondary' for an inline secondary zone ($n)" 1406ret=0 1407$RNDCCMD 10.53.0.3 zonestatus bits > rndc.out.ns3.test$n 1408grep "type: secondary" rndc.out.ns3.test$n > /dev/null || ret=1 1409if [ $ret != 0 ]; then echo_i "failed"; fi 1410status=$((status + ret)) 1411 1412n=$((n + 1)) 1413echo_i "checking reload of touched inline zones ($n)" 1414ret=0 1415echo_ic "pre-reload 'next key event'" 1416nextpart ns8/named.run > nextpart.pre$n.out 1417count=$(grep "zone example[0-9][0-9].com/IN (signed): next key event:" nextpart.pre$n.out | wc -l) 1418echo_ic "found: $count/16" 1419[ $count -eq 16 ] || ret=1 1420echo_ic "touch and reload" 1421touch ns8/example??.com.db 1422$RNDCCMD 10.53.0.8 reload 2>&1 | sed 's/^/ns3 /' | cat_i 1423sleep 5 1424echo_ic "post-reload 'next key event'" 1425nextpart ns8/named.run > nextpart.post$n.out 1426count=$(grep "zone example[0-9][0-9].com/IN (signed): next key event:" nextpart.post$n.out | wc -l) 1427echo_ic "found: $count/16" 1428[ $count -eq 16 ] || ret=1 1429if [ $ret != 0 ]; then echo_i "failed"; fi 1430status=$((status + ret)) 1431 1432n=$((n + 1)) 1433echo_i "checking second reload of touched inline zones ($n)" 1434ret=0 1435nextpart ns8/named.run > nextpart.pre$n.out 1436$RNDCCMD 10.53.0.8 reload 2>&1 | sed 's/^/ns3 /' | cat_i 1437sleep 5 1438nextpart ns8/named.run > nextpart.post$n.out 1439grep "ixfr-from-differences: unchanged" nextpart.post$n.out && ret=1 1440if [ $ret != 0 ]; then echo_i "failed"; fi 1441status=$((status + ret)) 1442 1443n=$((n+1)) 1444echo_i "Check that 'rndc reload' of just the serial updates the signed instance ($n)" 1445ret=0 1446dig_with_opts @10.53.0.8 example SOA > dig.out.ns8.test$n.soa1 || ret=1 1447cp ns8/example2.db.in ns8/example.db || ret=1 1448nextpart ns8/named.run > /dev/null 1449rndccmd 10.53.0.8 reload || ret=1 1450wait_for_log 3 "all zones loaded" ns8/named.run 1451sleep 1 1452dig_with_opts @10.53.0.8 example SOA > dig.out.ns8.test$n.soa2 || ret=1 1453soa1=$(awk '$4 == "SOA" { print $7 }' dig.out.ns8.test$n.soa1) 1454soa2=$(awk '$4 == "SOA" { print $7 }' dig.out.ns8.test$n.soa2) 1455ttl1=$(awk '$4 == "SOA" { print $2 }' dig.out.ns8.test$n.soa1) 1456ttl2=$(awk '$4 == "SOA" { print $2 }' dig.out.ns8.test$n.soa2) 1457test ${soa1:-1000} -lt ${soa2:-0} || ret=1 1458test ${ttl1:-0} -eq 300 || ret=1 1459test ${ttl2:-0} -eq 300 || ret=1 1460test "$ret" -eq 0 || echo_i "failed" 1461status=$((status+ret)) 1462 1463n=$((n+1)) 1464echo_i "Check that restart with zone changes and deleted journal works ($n)" 1465TSIG= 1466ret=0 1467dig_with_opts @10.53.0.8 example SOA > dig.out.ns8.test$n.soa1 || ret=1 1468stop_server --use-rndc --port ${CONTROLPORT} ns8 1469# TTL of all records change from 300 to 400 1470cp ns8/example3.db.in ns8/example.db || ret=1 1471rm ns8/example.db.jnl 1472nextpart ns8/named.run > /dev/null 1473start_server --noclean --restart --port ${PORT} ns8 1474wait_for_log 3 "all zones loaded" ns8/named.run 1475sleep 1 1476dig_with_opts @10.53.0.8 example SOA > dig.out.ns8.test$n.soa2 || ret=1 1477soa1=$(awk '$4 == "SOA" { print $7 }' dig.out.ns8.test$n.soa1) 1478soa2=$(awk '$4 == "SOA" { print $7 }' dig.out.ns8.test$n.soa2) 1479ttl1=$(awk '$4 == "SOA" { print $2 }' dig.out.ns8.test$n.soa1) 1480ttl2=$(awk '$4 == "SOA" { print $2 }' dig.out.ns8.test$n.soa2) 1481test ${soa1:-1000} -lt ${soa2:-0} || ret=1 1482test ${ttl1:-0} -eq 300 || ret=1 1483test ${ttl2:-0} -eq 400 || ret=1 1484test "$ret" -eq 0 || echo_i "failed" 1485status=$((status+ret)) 1486 1487echo_i "exit status: $status" 1488[ $status -eq 0 ] || exit 1 1489