mirror of
https://gitlab.nic.cz/knot/knot-dns.git
synced 2026-05-28 04:02:31 -04:00
126 lines
5.9 KiB
Bash
126 lines
5.9 KiB
Bash
#!/bin/sh
|
|
# Copyright (C) CZ.NIC, z.s.p.o. and contributors
|
|
# SPDX-License-Identifier: GPL-2.0-or-later
|
|
# For more information, see <https://www.knot-dns.cz/>
|
|
|
|
BUILDROOT="@top_builddir@"
|
|
SRCROOT="@top_srcdir@"
|
|
|
|
. "@top_srcdir@/tests/tap/libtap.sh"
|
|
|
|
TMPDIR=$(cd $(test_tmpdir) && pwd)
|
|
if [ -f /etc/crypto-policies/config ] || [ ${#TMPDIR} -gt 85 ]; then
|
|
diag "Test not compatible with strict crypto policy or too long unix socket paths"
|
|
skip_all
|
|
exit 0
|
|
fi
|
|
|
|
SCN=$TMPDIR/scenario.txt
|
|
CONF=$TMPDIR/knot.conf
|
|
RUNDIR=$TMPDIR/run
|
|
LISTEN=$RUNDIR/listen
|
|
LISTEN_CTL=$RUNDIR/ctl
|
|
VALGRIND=
|
|
|
|
if [ "$2" = "v" ]; then
|
|
VALGRIND="valgrind --leak-check=full --show-leak-kinds=all"
|
|
fi
|
|
|
|
cat << EOF > $SCN
|
|
delegation.signed deleg A NOK! DS.NODATA.*found x.deleg A NOK! DS.NODATA.*found
|
|
different_signer_name.signed dns1 A OK! answer.found dns1 TXT NOK! NODATA.*found
|
|
dname_apex_nsec3.signed foo A OK! limit.*of.*DNAME x TXT OK! limit.*of.*DNAME
|
|
dnskey_keytags.many dns1 A FAILED many.*keytag dns2 A FAILED many.*keytag
|
|
no_rrsig.signed dns1 AAAA NOK! missing.RRSIG.*NSEC dns2 A NOK! missing.RRSIG.*NSEC
|
|
no_rrsig_with_delegation.signed deleg A NOK! any.RRSIG deleg DS NOK! missing.RRSIG.*NSEC
|
|
nsec_broken_chain_01.signed eee A NOK! invalid.*RRSIG.*NSEC zzz A OK! wildcard.non.*proven
|
|
nsec_broken_chain_02.signed eee A OK! wildcard.non.*proven zzz A NOK! wrongly.proves.NXDOMAIN
|
|
nsec_missing.signed www AAAA NOK! NXDOMAIN.*missing dns2 A NOK! invalid.*RRSIG.*NSEC
|
|
nsec_multiple.signed www AAAA NOK! wrongly.proves.NXDOMAIN zzz A NOK! wrongly.proves.NXDOMAIN
|
|
nsec_nonauth.invalid nonauth.deleg NS NOK! invalid.*RRSIG.*DNSKEY nonauth.deleg DS NOK! invalid.*RRSIG.*DNSKEY
|
|
nsec_wrong_bitmap_01.signed www A OK! answer.found www AAAA NOK! NODATA.*missing
|
|
nsec_wrong_bitmap_02.signed www A OK! answer.found www AAAA NOK! invalid.*RRSIG.*NSEC
|
|
nsec3_chain_01.signed deleg A NOK! invalid.*RRSIG.*NSEC3 dns2 A NOK! overlapping.*NSEC3
|
|
nsec3_chain_02.signed deleg A OK! DS.NODATA.*found dns2 A NOK! overlapping.*NSEC3
|
|
nsec3_chain_03.signed deleg A NOK! invalid.*RRSIG.*NSEC3 dns2 A NOK! overlapping.*NSEC3
|
|
nsec3_missing.signed extra AAAA NOK! NXDOMAIN.*missing extrb A NOK! invalid.*RRSIG.*NSEC3
|
|
nsec3_optout_ent.all x.deleg2.ent A OK! opt-out.*found ent A OK! NODATA.*unprovable
|
|
nsec3_optout_ent.invalid x.deleg1.ent A OK! DS.NODATA.*found ent A OK! NODATA.*unprovable
|
|
nsec3_optout_ent.valid x.deleg1.ent A OK! DS.NODATA.*found ent A OK! NODATA.*found
|
|
nsec3_optout.signed zzz A NOK! DS.non.*missing xx.zzz A NOK! DS.non.*missing
|
|
nsec3_param_invalid.signed dns1 A OK! answer.found dns2 A NOK! any.RRSIG
|
|
nsec3_wrong_bitmap_01.signed example.com. DNSKEY OK! answer.found example.com. SSHFP NOK! wrongly.proves.NODATA
|
|
nsec3_wrong_bitmap_02.signed dns1 TXT NOK! invalid.*RRSIG.*NSEC3 dns1 NSEC NOK! NODATA.*missing
|
|
rrsig_rdata_ttl.signed dns1 A NOK! invalid.*RRSIG.*A dns1 TXT OK! NODATA.*found
|
|
rrsig_signed.signed dns1 A OK! answer.found dns1 RRSIG OK! answer.found
|
|
rrsig_ttl.signed dns1 A OK! answer.found dns1 AAAA OK! NODATA.*found
|
|
EOF
|
|
|
|
cat << EOF > $CONF
|
|
server:
|
|
rundir: $RUNDIR
|
|
listen: $LISTEN
|
|
tcp-workers: 1
|
|
udp-workers: 1
|
|
background-workers: 1
|
|
control:
|
|
listen: $LISTEN_CTL
|
|
database:
|
|
storage: $RUNDIR
|
|
timer-db-sync: never
|
|
zone:
|
|
- domain: example.com.
|
|
storage: $RUNDIR
|
|
file: example.com.zone
|
|
log:
|
|
- target: stdout
|
|
any: debug
|
|
EOF
|
|
|
|
plan $(( $(cat "$SCN" | wc -l) * 4 ))
|
|
|
|
q() {
|
|
QN="$2"
|
|
OUTCOME=$(echo "$4" | sed 's/NOK/Invalid/;s/OK/Valid/;s/FAILED/VALIDATION failed to proceed/')
|
|
case "$QN" in
|
|
*.) ;;
|
|
*) QN="$QN.example.com." ;;
|
|
esac
|
|
CMD="$VALGRIND $BUILDROOT/src/kdig @$LISTEN +tcp +validate +nocrypto $QN -t $3"
|
|
echo "$1 $CMD" >&2
|
|
RESP=$(sh -c "$CMD" 2>&1)
|
|
echo "$RESP" >&2
|
|
echo "$RESP" | grep -q "$OUTCOME"
|
|
ok "$1 outcome '$OUTCOME'" test $? -eq 0
|
|
echo "$RESP" | grep -q "$5"
|
|
ok "$1 point '$5'" test $? -eq 0
|
|
}
|
|
|
|
rm -rf $RUNDIR; mkdir $RUNDIR
|
|
$BUILDROOT/src/knotd -c $CONF > $RUNDIR/knot.log &
|
|
PID=$!
|
|
while ! grep -q 'server started' $RUNDIR/knot.log; do
|
|
sleep 0.02
|
|
continue
|
|
done
|
|
|
|
i=0
|
|
while read ZFILE QNAME QTYPE OUT POINT QNAME2 QTYPE2 OUT2 POINT2; do
|
|
i=$((i+1))
|
|
if [ -n "$1" ] && [ "$1" != "$i" ]; then
|
|
continue
|
|
fi
|
|
NLOADED_WAS=$(grep -c 'loaded, serial' $RUNDIR/knot.log)
|
|
cat $SRCROOT/tests/knot/semantic_check_data/$ZFILE > $RUNDIR/example.com.zone
|
|
$BUILDROOT/src/knotc -s $LISTEN_CTL -f zone-reload >&2
|
|
while [ $(grep -c 'loaded, serial' $RUNDIR/knot.log) = "$NLOADED_WAS" ]; do
|
|
sleep 0.02
|
|
done
|
|
q "(${i}a)" "$QNAME" "$QTYPE" "$OUT" "$POINT"
|
|
q "(${i}b)" "$QNAME2" "$QTYPE2" "$OUT2" "$POINT2"
|
|
done < "$SCN"
|
|
|
|
|
|
kill -TERM $PID
|
|
sleep 0.1
|
|
rm -rf $RUNDIR $SCN $CONF
|