264 lines
6.3 KiB
Bash
264 lines
6.3 KiB
Bash
#!/bin/sh -e
|
|
|
|
# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
|
#
|
|
# SPDX-License-Identifier: MPL-2.0
|
|
#
|
|
# This Source Code Form is subject to the terms of the Mozilla Public
|
|
# License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
# file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
|
#
|
|
# See the COPYRIGHT file distributed with this work for additional
|
|
# information regarding copyright ownership.
|
|
|
|
set -e
|
|
|
|
. ../conf.sh
|
|
|
|
status=0
|
|
n=0
|
|
fail() {
|
|
echo_i "failed"
|
|
status=$((status + 1))
|
|
}
|
|
|
|
runcmd() {
|
|
(
|
|
"$@" 1>out.$n 2>err.$n
|
|
echo $?
|
|
) || true
|
|
}
|
|
|
|
testcase() {
|
|
n=$((n + 1))
|
|
echo_i "$name ($n)"
|
|
expect=$1
|
|
shift
|
|
result=$(runcmd "$@")
|
|
check_stdout
|
|
check_stderr
|
|
if [ "$expect" -ne "$result" ]; then
|
|
echo_d "exit status does not match $expect"
|
|
fail
|
|
fi
|
|
unset name err out
|
|
}
|
|
|
|
check_stderr() {
|
|
if [ -n "${err:=}" ]; then
|
|
grep -E "$err" err.$n >/dev/null && return 0
|
|
echo_d "stderr did not match '$err'"
|
|
else
|
|
[ -s err.$n ] || return 0
|
|
fi
|
|
cat err.$n | cat_d
|
|
fail
|
|
}
|
|
|
|
check_stdout() {
|
|
diff out.$n "${out:-empty}" >/dev/null && return
|
|
echo_d "stdout did not match '$out'"
|
|
(
|
|
echo "wanted"
|
|
cat "$out"
|
|
echo "got"
|
|
cat out.$n
|
|
) | cat_d
|
|
fail
|
|
}
|
|
|
|
Z=cds.test
|
|
|
|
name='usage'
|
|
err='Usage'
|
|
testcase 1 $CDS
|
|
|
|
name='need a DS file'
|
|
err='DS pathname'
|
|
testcase 1 $CDS $Z
|
|
|
|
name='name of dsset in directory'
|
|
err="./dsset-$Z.: file not found"
|
|
testcase 1 $CDS -d . $Z
|
|
|
|
name='load a file'
|
|
err='could not find DS records'
|
|
testcase 1 $CDS -d empty $Z
|
|
|
|
name='load DS records'
|
|
err='path to file containing child data must be specified'
|
|
testcase 1 $CDS -d DS.1 $Z
|
|
|
|
name='missing DNSKEY'
|
|
err='could not find signed DNSKEY RRset'
|
|
testcase 1 $CDS -f db.null -d DS.1 $Z
|
|
|
|
name='sigs too old'
|
|
err='could not validate child DNSKEY RRset'
|
|
testcase 1 $CDS -f sig.null -d DS.1 $Z
|
|
|
|
name='sigs too old, verbosely'
|
|
err='skip RRSIG by key [0-9]+: too old'
|
|
testcase 1 $CDS -v1 -f sig.null -d DS.1 $Z
|
|
|
|
name='old sigs are allowed'
|
|
err='found RRSIG by key'
|
|
out=DS.1
|
|
testcase 0 $CDS -v1 -s -7200 -f sig.null -d DS.1 $Z
|
|
|
|
name='no CDS/CDNSKEY records'
|
|
out=DS.1
|
|
testcase 0 $CDS -s -7200 -f sig.null -d DS.1 $Z
|
|
|
|
name='no child records, verbosely'
|
|
err='has neither CDS nor CDNSKEY records'
|
|
out=DS.1
|
|
testcase 0 $CDS -v1 -s -7200 -f sig.null -d DS.1 $Z
|
|
|
|
name='unsigned CDS'
|
|
err='missing RRSIG CDS records'
|
|
testcase 1 $CDS -f brk.unsigned-cds -d DS.1 $Z
|
|
|
|
name='correct signature inception time'
|
|
$CDS -v3 -s -7200 -f sig.cds.1 -d DS.1 $Z 1>xout 2>xerr
|
|
testcase 0 $PERL checktime.pl 3600 xerr
|
|
|
|
name='in-place reads modification time'
|
|
testcase 0 $CDS -a1 -a2 -f sig.cds.1 -i.bak -d DS.inplace $Z
|
|
|
|
name='in-place output correct modification time'
|
|
testcase 0 $PERL checkmtime.pl 3600 DS.inplace
|
|
|
|
name='in-place backup correct modification time'
|
|
testcase 0 $PERL checkmtime.pl 7200 DS.inplace.bak
|
|
|
|
name='in-place correct output'
|
|
testcase 0 diff DS.1 DS.inplace
|
|
|
|
name='in-place backup unmodified'
|
|
testcase 0 diff DS.1 DS.inplace.bak
|
|
|
|
name='one mangled DS'
|
|
err='found RRSIG by key'
|
|
out=DS.1
|
|
testcase 0 $CDS -v1 -a1 -a2 -s -7200 -f sig.cds.1 -d DS.broke1 $Z
|
|
|
|
name='other mangled DS'
|
|
err='found RRSIG by key'
|
|
out=DS.1
|
|
testcase 0 $CDS -v1 -a1 -a2 -s -7200 -f sig.cds.1 -d DS.broke2 $Z
|
|
|
|
name='both mangled DS'
|
|
err='could not validate child DNSKEY RRset'
|
|
testcase 1 $CDS -v1 -a1 -a2 -s -7200 -f sig.cds.1 -d DS.broke12 $Z
|
|
|
|
name='mangle RRSIG CDS by ZSK'
|
|
err='found RRSIG by key'
|
|
out=DS.1
|
|
testcase 0 $CDS -v1 -a1 -a2 -s -7200 -f brk.rrsig.cds.zsk -d DS.1 $Z
|
|
|
|
name='mangle RRSIG CDS by KSK'
|
|
err='could not validate child CDS RRset'
|
|
testcase 1 $CDS -v1 -s -7200 -f brk.rrsig.cds.ksk -d DS.1 $Z
|
|
|
|
name='mangle CDS 1'
|
|
err='could not validate child DNSKEY RRset with new DS records'
|
|
testcase 1 $CDS -a1 -a2 -s -7200 -f sig.cds-mangled -d DS.1 $Z
|
|
|
|
name='inconsistent digests'
|
|
err='do not cover each key with the same set of digest types'
|
|
testcase 1 $CDS -a1 -a2 -s -7200 -f sig.bad-digests -d DS.1 $Z
|
|
|
|
name='inconsistent algorithms'
|
|
err='missing signature for algorithm'
|
|
testcase 1 $CDS -s -7200 -f sig.bad-algos -d DS.1 $Z
|
|
|
|
name='add DS records'
|
|
out=DS.both
|
|
$CDS -a1 -a2 -s -7200 -f sig.cds.both -d DS.1 $Z >DS.out
|
|
# sort to allow for numerical vs lexical order of key tags
|
|
testcase 0 sort DS.out
|
|
|
|
name='update add'
|
|
out=UP.add2
|
|
testcase 0 $CDS -a1 -a2 -u -s -7200 -f sig.cds.both -d DS.1 $Z
|
|
|
|
name='remove DS records'
|
|
out=DS.2
|
|
testcase 0 $CDS -a1 -a2 -s -7200 -f sig.cds.2 -d DS.both $Z
|
|
|
|
name='update del'
|
|
out=UP.del1
|
|
testcase 0 $CDS -a1 -a2 -u -s -7200 -f sig.cds.2 -d DS.both $Z
|
|
|
|
name='swap DS records'
|
|
out=DS.2
|
|
testcase 0 $CDS -a1 -a2 -s -7200 -f sig.cds.2 -d DS.1 $Z
|
|
|
|
name='update swap'
|
|
out=UP.swap
|
|
testcase 0 $CDS -a1 -a2 -u -s -7200 -f sig.cds.2 -d DS.1 $Z
|
|
|
|
name='TTL from -T'
|
|
out=DS.ttl2
|
|
testcase 0 $CDS -a1 -a2 -T 3600 -s -7200 -f sig.cds.2 -d DS.1 $Z
|
|
|
|
name='update TTL from -T'
|
|
out=UP.swapttl
|
|
testcase 0 $CDS -a1 -a2 -u -T 3600 -s -7200 -f sig.cds.2 -d DS.1 $Z
|
|
|
|
name='update TTL from dsset'
|
|
out=UP.swapttl
|
|
testcase 0 $CDS -a1 -a2 -u -s -7200 -f sig.cds.2 -d DS.ttl1 $Z
|
|
|
|
name='TTL from -T overrides dsset'
|
|
out=DS.ttlong2
|
|
testcase 0 $CDS -a1 -a2 -T 7200 -s -7200 -f sig.cds.2 -d DS.ttl1 $Z
|
|
|
|
name='stable DS record order (changes)'
|
|
out=DS.1
|
|
testcase 0 $CDS -a1 -a2 -s -7200 -f sig.cds.rev1 -d DS.2 $Z
|
|
|
|
name='CDNSKEY default algorithm'
|
|
out=DS.2-2
|
|
testcase 0 $CDS -s -7200 -f sig.cdnskey.2 -d DS.1 $Z
|
|
|
|
name='CDNSKEY SHA1'
|
|
out=DS.2-1
|
|
testcase 0 $CDS -a SHA1 -s -7200 -f sig.cdnskey.2 -d DS.1 $Z
|
|
|
|
name='CDNSKEY two algorithms'
|
|
out=DS.2
|
|
testcase 0 $CDS -a SHA1 -a SHA256 -s -7200 -f sig.cdnskey.2 -d DS.1 $Z
|
|
|
|
name='CDNSKEY two algorithms, reversed'
|
|
out=DS.2
|
|
testcase 0 $CDS -a SHA256 -a SHA1 -s -7200 -f sig.cdnskey.2 -d DS.1 $Z
|
|
|
|
name='CDNSKEY and CDS'
|
|
out=DS.2
|
|
testcase 0 $CDS -a1 -a2 -s -7200 -f sig.cds.cdnskey.2 -d DS.1 $Z
|
|
|
|
name='prefer CDNSKEY'
|
|
out=DS.2-2
|
|
testcase 0 $CDS -D -s -7200 -f sig.cds1.cdnskey2 -d DS.1 $Z
|
|
|
|
name='CDS subset default (SHA-256)'
|
|
out=DS.2-2
|
|
testcase 0 $CDS -s -7200 -f sig.cds.2 -d DS.1 $Z
|
|
|
|
name='CDS subset replace SHA1 with SHA2'
|
|
out=DS.2-2
|
|
testcase 0 $CDS -s -7200 -f sig.cds.cdnskey.2.sha1 -d DS.1 $Z
|
|
|
|
name='CDS subset mismatch'
|
|
err='do not match any -a digest types'
|
|
testcase 1 $CDS -s -7200 -f sig.cds.2.sha1 -d DS.1 $Z
|
|
|
|
name='CDS algorithm unavailable, use CDNSKEY'
|
|
err='using CDNSKEY instead'
|
|
out=DS.2-2
|
|
testcase 0 $CDS -v1 -a SHA256 -s -7200 -f sig.cds.cdnskey.2.sha1 -d DS.1 $Z
|
|
|
|
echo_i "exit status: $status"
|
|
[ $status -eq 0 ] || exit 1
|