296f5969a8dd6e3d1bb3761569c6a7070abd2e47Tinderbox User# Copyright (C) 2012, 2013, 2016, 2017 Internet Systems Consortium, Inc. ("ISC")
bf8267aa453e5d2a735ed732a043b77a0b355b20Mark Andrews#
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews# This Source Code Form is subject to the terms of the Mozilla Public
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews# License, v. 2.0. If a copy of the MPL was not distributed with this
0c27b3fe77ac1d5094ba3521e8142d9e7973133fMark Andrews# file, You can obtain one at http://mozilla.org/MPL/2.0/.
da5d53fb1401f5e17a77373af32d865489aa04a8Tinderbox User
da5d53fb1401f5e17a77373af32d865489aa04a8Tinderbox User# $Id$
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews
ad127d839d2e7aa542939a8a336691407e23397eMark AndrewsSYSTEMTESTTOP=..
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews. $SYSTEMTESTTOP/conf.sh
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewsfailed () {
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews cat verify.out.$n | sed 's/^/D:/';
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews echo "I:failed";
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews status=1;
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews}
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewsn=0
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewsstatus=0
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewsfor file in zones/*.good
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewsdo
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews n=`expr $n + 1`
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews zone=`expr "$file" : 'zones/\(.*\).good'`
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews echo "I:checking supposedly good zone: $zone ($n)"
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews ret=0
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews case $zone in
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews zsk-only.*) only=-z;;
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews ksk-only.*) only=-z;;
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews *) only=;;
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews esac
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews $VERIFY ${only} -o $zone $file > verify.out.$n 2>&1 || ret=1
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews [ $ret = 0 ] || failed
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewsdone
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewsfor file in zones/*.bad
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewsdo
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews n=`expr $n + 1`
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews zone=`expr "$file" : 'zones/\(.*\).bad'`
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews echo "I:checking supposedly bad zone: $zone ($n)"
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews ret=0
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews dumpit=0
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews case $zone in
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews zsk-only.*) only=-z;;
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews ksk-only.*) only=-z;;
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews *) only=;;
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews esac
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews expect1= expect2=
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews case $zone in
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews *.dnskeyonly)
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews expect1="DNSKEY is not signed"
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews ;;
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews *.expired)
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews expect1="signature has expired"
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews expect2="No self-signed .*DNSKEY found"
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews ;;
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews *.ksk-expired)
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews expect1="signature has expired"
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews expect2="No self-signed .*DNSKEY found"
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews ;;
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews *.out-of-zone-nsec|*.below-bottom-of-zone-nsec)
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews expect1="unexpected NSEC RRset at"
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews ;;
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews *.nsec.broken-chain)
9a0dd99a757c469d9530acd5cb11789b3b0af5ceEvan Hunt expect1="Bad NSEC record for.*, next name mismatch"
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews ;;
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews *.bad-bitmap)
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews expect1="bit map mismatch"
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews ;;
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews *.missing-empty)
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews expect1="Missing NSEC3 record for";
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews ;;
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews unsigned)
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews expect1="Zone contains no DNSSEC keys"
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews ;;
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews *.extra-nsec3)
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews expect1="Expected and found NSEC3 chains not equal";
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews ;;
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews *)
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews dumpit=1
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews ;;
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews esac
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews $VERIFY ${only} -o $zone $file > verify.out.$n 2>&1 && ret=1
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews grep "${expect1:-.}" verify.out.$n > /dev/null || ret=1
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews grep "${expect2:-.}" verify.out.$n > /dev/null || ret=1
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews [ $ret = 0 ] || failed
ad127d839d2e7aa542939a8a336691407e23397eMark Andrews [ $dumpit = 1 ] && cat verify.out.$n
ad127d839d2e7aa542939a8a336691407e23397eMark Andrewsdone
3635d8f9104e70e141a8f191a0e6c1502ceed2f3Mark Andrews
cbb33c87f4bcf415c840acb61c9d4642c3c2a8e0Michał Kępieńn=`expr $n + 1`
cbb33c87f4bcf415c840acb61c9d4642c3c2a8e0Michał Kępieńecho "I:checking error message when -o is not used and a SOA record not at top of zone is found ($n)"
cbb33c87f4bcf415c840acb61c9d4642c3c2a8e0Michał Kępieńret=0
cbb33c87f4bcf415c840acb61c9d4642c3c2a8e0Michał Kępień# When -o is not used, origin is set to zone file name, which should cause an error in this case
cbb33c87f4bcf415c840acb61c9d4642c3c2a8e0Michał Kępień$VERIFY zones/ksk+zsk.nsec.good > verify.out.$n 2>&1 && ret=1
cbb33c87f4bcf415c840acb61c9d4642c3c2a8e0Michał Kępieńgrep "not at top of zone" verify.out.$n > /dev/null || ret=1
cbb33c87f4bcf415c840acb61c9d4642c3c2a8e0Michał Kępieńgrep "use -o to specify a different zone origin" verify.out.$n > /dev/null || ret=1
cbb33c87f4bcf415c840acb61c9d4642c3c2a8e0Michał Kępień[ $ret = 0 ] || failed
cbb33c87f4bcf415c840acb61c9d4642c3c2a8e0Michał Kępień
cbb33c87f4bcf415c840acb61c9d4642c3c2a8e0Michał Kępieńn=`expr $n + 1`
cbb33c87f4bcf415c840acb61c9d4642c3c2a8e0Michał Kępieńecho "I:checking error message when an invalid -o is specified and a SOA record not at top of zone is found ($n)"
cbb33c87f4bcf415c840acb61c9d4642c3c2a8e0Michał Kępieńret=0
cbb33c87f4bcf415c840acb61c9d4642c3c2a8e0Michał Kępień$VERIFY -o invalid.origin zones/ksk+zsk.nsec.good > verify.out.$n 2>&1 && ret=1
cbb33c87f4bcf415c840acb61c9d4642c3c2a8e0Michał Kępieńgrep "not at top of zone" verify.out.$n > /dev/null || ret=1
cbb33c87f4bcf415c840acb61c9d4642c3c2a8e0Michał Kępieńgrep "use -o to specify a different zone origin" verify.out.$n > /dev/null && ret=1
cbb33c87f4bcf415c840acb61c9d4642c3c2a8e0Michał Kępień[ $ret = 0 ] || failed
cbb33c87f4bcf415c840acb61c9d4642c3c2a8e0Michał Kępień
3635d8f9104e70e141a8f191a0e6c1502ceed2f3Mark Andrewsecho "I:exit status: $status"
3635d8f9104e70e141a8f191a0e6c1502ceed2f3Mark Andrews[ $status -eq 0 ] || exit 1