1#!/bin/sh 2# 3# Copyright (C) Internet Systems Consortium, Inc. ("ISC") 4# 5# This Source Code Form is subject to the terms of the Mozilla Public 6# License, v. 2.0. If a copy of the MPL was not distributed with this 7# file, You can obtain one at http://mozilla.org/MPL/2.0/. 8# 9# See the COPYRIGHT file distributed with this work for additional 10# information regarding copyright ownership. 11 12SYSTEMTESTTOP=.. 13. $SYSTEMTESTTOP/conf.sh 14 15# replace_data dname RR old_data new_data 16replace_data() 17{ 18 if [ $# -ne 4 ]; then 19 echo_i "unexpected input for replace_data" 20 return 1 21 fi 22 23 _dname=$1 24 _rr=$2 25 _olddata=$3 26 _newdata=$4 27 28 _ret=0 29 $NSUPDATE -d <<END >> nsupdate.out.test 2>&1 || _ret=1 30server 10.53.0.2 ${PORT} 31update delete ${_dname} 30 ${_rr} ${_olddata} 32update add ${_dname} 30 ${_rr} ${_newdata} 33send 34END 35 36 if [ $_ret != 0 ]; then 37 echo_i "failed to update the test data" 38 return 1 39 fi 40 41 return 0 42} 43 44status=0 45n=0 46 47DIGOPTS="+short +tcp -p ${PORT}" 48DIGOPTS_CD="$DIGOPTS +cd" 49 50echo_i "Priming cache." 51ret=0 52expect="10 mail.example." 53ans=`$DIG $DIGOPTS_CD @10.53.0.4 hostile MX` || ret=1 54test "$ans" = "$expect" || ret=1 55test $ret = 0 || echo_i "failed, got '$ans', expected '$expect'" 56status=`expr $status + $ret` 57 58echo_i "Checking that bogus additional is not returned with +CD." 59ret=0 60expect="10.0.0.2" 61ans=`$DIG $DIGOPTS_CD @10.53.0.4 mail.example A` || ret=1 62test "$ans" = "$expect" || ret=1 63test $ret = 0 || echo_i "failed, got '$ans', expected '$expect'" 64status=`expr $status + $ret` 65 66# 67# Prime cache with pending additional records. These should not be promoted 68# to answer. 69# 70echo_i "Priming cache (pending additional A and AAAA)" 71ret=0 72expect="10 mail.example.com." 73ans=`$DIG $DIGOPTS @10.53.0.4 example.com MX` || ret=1 74test "$ans" = "$expect" || ret=1 75test $ret = 0 || echo_i "failed, got '$ans', expected '$expect'" 76status=`expr $status + $ret` 77 78echo_i "Replacing pending A" 79ret=0 80replace_data mail.example.com. A 192.0.2.2 192.0.2.3 || ret=1 81status=`expr $status + $ret` 82 83echo_i "Replacing pending AAAA" 84ret=0 85replace_data mail.example.com. AAAA 2001:db8::2 2001:db8::3 || ret=1 86status=`expr $status + $ret` 87 88echo_i "Checking updated data to be returned (without CD)" 89ret=0 90expect="192.0.2.3" 91ans=`$DIG $DIGOPTS @10.53.0.4 mail.example.com A` || ret=1 92test "$ans" = "$expect" || ret=1 93test $ret = 0 || echo_i "failed, got '$ans', expected '$expect'" 94status=`expr $status + $ret` 95 96echo_i "Checking updated data to be returned (with CD)" 97ret=0 98expect="2001:db8::3" 99ans=`$DIG $DIGOPTS_CD @10.53.0.4 mail.example.com AAAA` || ret=1 100test "$ans" = "$expect" || ret=1 101test $ret = 0 || echo_i "failed, got '$ans', expected '$expect'" 102status=`expr $status + $ret` 103 104# 105# Prime cache with a pending answer record. It can be returned (without 106# validation) with +CD. 107# 108echo_i "Priming cache (pending answer)" 109ret=0 110expect="192.0.2.2" 111ans=`$DIG $DIGOPTS_CD @10.53.0.4 pending-ok.example.com A` || ret=1 112test "$ans" = "$expect" || ret=1 113test $ret = 0 || echo_i "failed, got '$ans', expected '$expect'" 114status=`expr $status + $ret` 115 116echo_i "Replacing pending data" 117ret=0 118replace_data pending-ok.example.com. A 192.0.2.2 192.0.2.3 || ret=1 119status=`expr $status + $ret` 120 121echo_i "Confirming cached pending data to be returned with CD" 122ret=0 123expect="192.0.2.2" 124ans=`$DIG $DIGOPTS_CD @10.53.0.4 pending-ok.example.com A` || ret=1 125test "$ans" = "$expect" || ret=1 126test $ret = 0 || echo_i "failed, got '$ans', expected '$expect'" 127status=`expr $status + $ret` 128 129# 130# Prime cache with a pending answer record. It should not be returned 131# to no-DNSSEC clients. 132# 133echo_i "Priming cache (pending answer)" 134ret=0 135expect="192.0.2.102" 136ans=`$DIG $DIGOPTS_CD @10.53.0.4 pending-ng.example.com A` || ret=1 137test "$ans" = "$expect" || ret=1 138test $ret = 0 || echo_i "failed, got '$ans', expected '$expect'" 139status=`expr $status + $ret` 140 141echo_i "Replacing pending data" 142ret=0 143replace_data pending-ng.example.com. A 192.0.2.102 192.0.2.103 || ret=1 144status=`expr $status + $ret` 145 146echo_i "Confirming updated data returned, not the cached one, without CD" 147ret=0 148expect="192.0.2.103" 149ans=`$DIG $DIGOPTS @10.53.0.4 pending-ng.example.com A` || ret=1 150test "$ans" = "$expect" || ret=1 151test $ret = 0 || echo_i "failed, got '$ans', expected '$expect'" 152status=`expr $status + $ret` 153 154# 155# Try to fool the resolver with an out-of-bailiwick CNAME 156# 157echo_i "Trying to Prime out-of-bailiwick pending answer with CD" 158ret=0 159expect="10.10.10.10" 160ans=`$DIG $DIGOPTS_CD @10.53.0.4 bad.example. A` || ret=1 161ans=`echo $ans | awk '{print $NF}'` 162test "$ans" = "$expect" || ret=1 163test $ret = 0 || echo_i "failed, got '$ans', expected '$expect'" 164status=`expr $status + $ret` 165 166echo_i "Confirming the out-of-bailiwick answer is not cached or reused with CD" 167ret=0 168expect="10.10.10.10" 169ans=`$DIG $DIGOPTS_CD @10.53.0.4 nice.good. A` || ret=1 170ans=`echo $ans | awk '{print $NF}'` 171test "$ans" = "$expect" || ret=1 172test $ret = 0 || echo_i "failed, got '$ans', expected '$expect'" 173status=`expr $status + $ret` 174 175# 176# Make sure the resolver doesn't cache bogus NXDOMAIN 177# 178echo_i "Trying to Prime bogus NXDOMAIN" 179ret=0 180expect="SERVFAIL" 181ans=`$DIG +tcp -p ${PORT} @10.53.0.4 removed.example.com. A` || ret=1 182ans=`echo $ans | sed 's/^.*status: \([A-Z][A-Z]*\).*$/\1/'` 183test "$ans" = "$expect" || ret=1 184test $ret = 0 || echo_i "failed, got '$ans', expected '$expect'" 185status=`expr $status + $ret` 186 187echo_i "Confirming the bogus NXDOMAIN was not cached" 188ret=0 189expect="SERVFAIL" 190ans=`$DIG +tcp -p ${PORT} @10.53.0.4 removed.example.com. A` || ret=1 191ans=`echo $ans | sed 's/^.*status: \([A-Z][A-Z]*\).*$/\1/'` 192test "$ans" = "$expect" || ret=1 193test $ret = 0 || echo_i "failed, got '$ans', expected '$expect'" 194status=`expr $status + $ret` 195 196echo_i "exit status: $status" 197[ $status -eq 0 ] || exit 1 198