#!/bin/sh # Copyright (C) Internet Systems Consortium, Inc. ("ISC") # # SPDX-License-Identifier: MPL-2.0 # # This Source Code Form is subject to the terms of the Mozilla Public # License, v. 2.0. If a copy of the MPL was not distributed with this # file, you can obtain one at https://mozilla.org/MPL/2.0/. # # See the COPYRIGHT file distributed with this work for additional # information regarding copyright ownership. set -e . ../conf.sh # replace_data dname RR old_data new_data replace_data() { if [ $# -ne 4 ]; then echo_i "unexpected input for replace_data" return 1 fi _dname=$1 _rr=$2 _olddata=$3 _newdata=$4 _ret=0 $NSUPDATE -d <>nsupdate.out.test 2>&1 || _ret=1 server 10.53.0.2 ${PORT} update delete ${_dname} 30 ${_rr} ${_olddata} update add ${_dname} 30 ${_rr} ${_newdata} send END if [ $_ret != 0 ]; then echo_i "failed to update the test data" return 1 fi return 0 } status=0 n=0 DIGOPTS="+short +tcp -p ${PORT}" DIGOPTS_CD="$DIGOPTS +cd" echo_i "Priming cache." ret=0 expect="10 mail.example." ans=$($DIG $DIGOPTS_CD @10.53.0.4 hostile MX) || ret=1 test "$ans" = "$expect" || ret=1 test $ret = 0 || echo_i "failed, got '$ans', expected '$expect'" status=$((status + ret)) echo_i "Checking that bogus additional is not returned with +CD." ret=0 expect="10.0.0.2" ans=$($DIG $DIGOPTS_CD @10.53.0.4 mail.example A) || ret=1 test "$ans" = "$expect" || ret=1 test $ret = 0 || echo_i "failed, got '$ans', expected '$expect'" status=$((status + ret)) # # Prime cache with pending additional records. These should not be promoted # to answer. # echo_i "Priming cache (pending additional A and AAAA)" ret=0 expect="10 mail.example.com." ans=$($DIG $DIGOPTS @10.53.0.4 example.com MX) || ret=1 test "$ans" = "$expect" || ret=1 test $ret = 0 || echo_i "failed, got '$ans', expected '$expect'" status=$((status + ret)) echo_i "Replacing pending A" ret=0 replace_data mail.example.com. A 192.0.2.2 192.0.2.3 || ret=1 status=$((status + ret)) echo_i "Replacing pending AAAA" ret=0 replace_data mail.example.com. AAAA 2001:db8::2 2001:db8::3 || ret=1 status=$((status + ret)) echo_i "Checking updated data to be returned (without CD)" ret=0 expect="192.0.2.3" ans=$($DIG $DIGOPTS @10.53.0.4 mail.example.com A) || ret=1 test "$ans" = "$expect" || ret=1 test $ret = 0 || echo_i "failed, got '$ans', expected '$expect'" status=$((status + ret)) echo_i "Checking updated data to be returned (with CD)" ret=0 expect="2001:db8::3" ans=$($DIG $DIGOPTS_CD @10.53.0.4 mail.example.com AAAA) || ret=1 test "$ans" = "$expect" || ret=1 test $ret = 0 || echo_i "failed, got '$ans', expected '$expect'" status=$((status + ret)) # # Prime cache with a pending answer record. It can be returned (without # validation) with +CD. # echo_i "Priming cache (pending answer)" ret=0 expect="192.0.2.2" ans=$($DIG $DIGOPTS_CD @10.53.0.4 pending-ok.example.com A) || ret=1 test "$ans" = "$expect" || ret=1 test $ret = 0 || echo_i "failed, got '$ans', expected '$expect'" status=$((status + ret)) echo_i "Replacing pending data" ret=0 replace_data pending-ok.example.com. A 192.0.2.2 192.0.2.3 || ret=1 status=$((status + ret)) echo_i "Confirming cached pending data to be returned with CD" ret=0 expect="192.0.2.2" ans=$($DIG $DIGOPTS_CD @10.53.0.4 pending-ok.example.com A) || ret=1 test "$ans" = "$expect" || ret=1 test $ret = 0 || echo_i "failed, got '$ans', expected '$expect'" status=$((status + ret)) # # Prime cache with a pending answer record. It should not be returned # to no-DNSSEC clients. # echo_i "Priming cache (pending answer)" ret=0 expect="192.0.2.102" ans=$($DIG $DIGOPTS_CD @10.53.0.4 pending-ng.example.com A) || ret=1 test "$ans" = "$expect" || ret=1 test $ret = 0 || echo_i "failed, got '$ans', expected '$expect'" status=$((status + ret)) echo_i "Replacing pending data" ret=0 replace_data pending-ng.example.com. A 192.0.2.102 192.0.2.103 || ret=1 status=$((status + ret)) echo_i "Confirming updated data returned, not the cached one, without CD" ret=0 expect="192.0.2.103" ans=$($DIG $DIGOPTS @10.53.0.4 pending-ng.example.com A) || ret=1 test "$ans" = "$expect" || ret=1 test $ret = 0 || echo_i "failed, got '$ans', expected '$expect'" status=$((status + ret)) # # Try to fool the resolver with an out-of-bailiwick CNAME # echo_i "Trying to Prime out-of-bailiwick pending answer with CD" ret=0 expect="10.10.10.10" ans=$($DIG $DIGOPTS_CD @10.53.0.4 bad.example. A) || ret=1 ans=$(echo $ans | awk '{print $NF}') test "$ans" = "$expect" || ret=1 test $ret = 0 || echo_i "failed, got '$ans', expected '$expect'" status=$((status + ret)) echo_i "Confirming the out-of-bailiwick answer is not cached or reused with CD" ret=0 expect="10.10.10.10" ans=$($DIG $DIGOPTS_CD @10.53.0.4 nice.good. A) || ret=1 ans=$(echo $ans | awk '{print $NF}') test "$ans" = "$expect" || ret=1 test $ret = 0 || echo_i "failed, got '$ans', expected '$expect'" status=$((status + ret)) # # Make sure the resolver doesn't cache bogus NXDOMAIN # echo_i "Trying to Prime bogus NXDOMAIN" ret=0 expect="SERVFAIL" ans=$($DIG +tcp -p ${PORT} @10.53.0.4 removed.example.com. A) || ret=1 ans=$(echo $ans | sed 's/^.*status: \([A-Z][A-Z]*\).*$/\1/') test "$ans" = "$expect" || ret=1 test $ret = 0 || echo_i "failed, got '$ans', expected '$expect'" status=$((status + ret)) echo_i "Confirming the bogus NXDOMAIN was not cached" ret=0 expect="SERVFAIL" ans=$($DIG +tcp -p ${PORT} @10.53.0.4 removed.example.com. A) || ret=1 ans=$(echo $ans | sed 's/^.*status: \([A-Z][A-Z]*\).*$/\1/') test "$ans" = "$expect" || ret=1 test $ret = 0 || echo_i "failed, got '$ans', expected '$expect'" status=$((status + ret)) echo_i "exit status: $status" [ $status -eq 0 ] || exit 1