[master] 5011 tests and fixes
4056. [bug] Expanded automatic testing of trust anchor management and fixed several small bugs including a memory leak and a possible loss of key state information. [RT #38458] 4055. [func] "rndc managed-keys" can be used to check status of trust anchors or to force keys to be refreshed, Also, the managed keys data file has easier-to-read comments. [RT #38458]
This commit is contained in:
Evan Hunt
435
bin/tests/system/mkeys/tests.sh
Normal file
435
bin/tests/system/mkeys/tests.sh
Normal file
@@ -0,0 +1,435 @@
|
||||
#!/bin/sh
|
||||
#
|
||||
# Copyright (C) 2004-2015 Internet Systems Consortium, Inc. ("ISC")
|
||||
# Copyright (C) 2000-2002 Internet Software Consortium.
|
||||
#
|
||||
# Permission to use, copy, modify, and/or distribute this software for any
|
||||
# purpose with or without fee is hereby granted, provided that the above
|
||||
# copyright notice and this permission notice appear in all copies.
|
||||
#
|
||||
# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
|
||||
# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
|
||||
# AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
|
||||
# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
|
||||
# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
|
||||
# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
||||
# PERFORMANCE OF THIS SOFTWARE.
|
||||
|
||||
SYSTEMTESTTOP=..
|
||||
. $SYSTEMTESTTOP/conf.sh
|
||||
|
||||
status=0
|
||||
n=1
|
||||
|
||||
rm -f dig.out.*
|
||||
|
||||
DIGOPTS="+tcp +noadd +nosea +nostat +nocmd +dnssec -p 5300"
|
||||
DELVOPTS="-a ns1/trusted.conf -p 5300"
|
||||
|
||||
echo "I: check for signed record ($n)"
|
||||
ret=0
|
||||
$DIG $DIGOPTS +norec example. @10.53.0.1 TXT > dig.out.ns1.test$n || ret=1
|
||||
grep "^example\.[[:space:]]*[0-9].*[[:space:]]*IN[[:space:]]*TXT[[:space:]]*\"This is a test\.\"" dig.out.ns1.test$n > /dev/null || ret=1
|
||||
grep "^example\.[[:space:]]*[0-9].*[[:space:]]*IN[[:space:]]*RRSIG[[:space:]]*TXT[[:space:]]" dig.out.ns1.test$n > /dev/null || ret=1
|
||||
if [ $ret != 0 ]; then echo "I:failed"; fi
|
||||
status=`expr $status + $ret`
|
||||
|
||||
n=`expr $n + 1`
|
||||
echo "I: check positive validation with valid trust anchor ($n)"
|
||||
ret=0
|
||||
$DIG $DIGOPTS +noauth example. @10.53.0.2 txt > dig.out.ns2.test$n || ret=1
|
||||
grep "flags:.*ad.*QUERY" dig.out.ns2.test$n > /dev/null || ret=1
|
||||
grep "example..*.RRSIG..*TXT" dig.out.ns2.test$n > /dev/null || ret=1
|
||||
if [ $ret != 0 ]; then echo "I:failed"; fi
|
||||
status=`expr $status + $ret`
|
||||
|
||||
n=`expr $n + 1`
|
||||
ret=0
|
||||
echo "I: check positive validation using delv ($n)"
|
||||
$DELV $DELVOPTS @10.53.0.1 txt example > delv.out$n || ret=1
|
||||
grep "; fully validated" delv.out$n > /dev/null || ret=1 # redundant
|
||||
grep "example..*TXT.*This is a test" delv.out$n > /dev/null || ret=1
|
||||
grep "example..*.RRSIG..*TXT" delv.out$n > /dev/null || ret=1
|
||||
if [ $ret != 0 ]; then echo "I:failed"; fi
|
||||
status=`expr $status + $ret`
|
||||
|
||||
n=`expr $n + 1`
|
||||
echo "I: check for failed validation due to wrong key in managed-keys ($n)"
|
||||
ret=0
|
||||
$DIG $DIGOPTS +noauth example. @10.53.0.3 txt > dig.out.ns3.test$n || ret=1
|
||||
grep "flags:.*ad.*QUERY" dig.out.ns3.test$n > /dev/null && ret=1
|
||||
grep "example..*.RRSIG..*TXT" dig.out.ns3.test$n > /dev/null && ret=1
|
||||
grep "opcode: QUERY, status: SERVFAIL, id" dig.out.ns3.test$n > /dev/null || ret=1
|
||||
if [ $ret != 0 ]; then echo "I:failed"; fi
|
||||
status=`expr $status + $ret`
|
||||
|
||||
n=`expr $n + 1`
|
||||
echo "I: check new trust anchor can be added ($n)"
|
||||
ret=0
|
||||
standby1=`$KEYGEN -qfk -r $RANDFILE -K ns1 .`
|
||||
$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 loadkeys . | sed 's/^/I: ns1 /'
|
||||
sleep 5
|
||||
$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys refresh | sed 's/^/I: ns2 /'
|
||||
$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys sync | sed 's/^/I: ns2 /'
|
||||
$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.$n 2>&1
|
||||
# there should be two keys listed now
|
||||
count=`grep -c "keyid: " rndc.out.$n`
|
||||
[ "$count" -eq 2 ] || ret=1
|
||||
# two lines indicating trust status
|
||||
count=`grep -c "trust" rndc.out.$n`
|
||||
[ "$count" -eq 2 ] || ret=1
|
||||
# one indicates current trust
|
||||
count=`grep -c "trusted since" rndc.out.$n`
|
||||
[ "$count" -eq 1 ] || ret=1
|
||||
# one indicates pending trust
|
||||
count=`grep -c "trust pending" rndc.out.$n`
|
||||
[ "$count" -eq 1 ] || ret=1
|
||||
if [ $ret != 0 ]; then echo "I:failed"; fi
|
||||
status=`expr $status + $ret`
|
||||
|
||||
n=`expr $n + 1`
|
||||
echo "I: check new trust anchor can't be added with bad initial key ($n)"
|
||||
ret=0
|
||||
$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p 9953 managed-keys refresh | sed 's/^/I: ns3 /'
|
||||
sleep 1
|
||||
$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p 9953 managed-keys sync | sed 's/^/I: ns3 /'
|
||||
$RNDC -c ../common/rndc.conf -s 10.53.0.3 -p 9953 managed-keys status > rndc.out.$n 2>&1
|
||||
# there should be one key listed now
|
||||
count=`grep -c "keyid: " rndc.out.$n`
|
||||
[ "$count" -eq 1 ] || ret=1
|
||||
# one line indicating trust status
|
||||
count=`grep -c "trust" rndc.out.$n`
|
||||
[ "$count" -eq 1 ] || ret=1
|
||||
# ... and the key is not trusted
|
||||
count=`grep -c "no trust" rndc.out.$n`
|
||||
[ "$count" -eq 1 ] || ret=1
|
||||
if [ $ret != 0 ]; then echo "I:failed"; fi
|
||||
status=`expr $status + $ret`
|
||||
|
||||
n=`expr $n + 1`
|
||||
echo "I: remove untrusted standby key, check timer restarts ($n)"
|
||||
ret=0
|
||||
$SETTIME -D now -K ns1 $standby1 > /dev/null
|
||||
t1=`grep "trust pending" ns2/managed-keys.bind`
|
||||
$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 loadkeys . | sed 's/^/I: ns1 /'
|
||||
sleep 3
|
||||
$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys refresh | sed 's/^/I: ns2 /'
|
||||
sleep 1
|
||||
$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys sync | sed 's/^/I: ns2 /'
|
||||
sleep 1
|
||||
t2=`grep "trust pending" ns2/managed-keys.bind`
|
||||
# trust pending date must be different
|
||||
[ -n "$t2" ] || ret=1
|
||||
[ "$t1" = "$t2" ] && ret=1
|
||||
if [ $ret != 0 ]; then echo "I:failed"; fi
|
||||
status=`expr $status + $ret`
|
||||
|
||||
n=`expr $n + 1`
|
||||
ret=0
|
||||
echo "I: restore untrusted standby key, revoke original key ($n)"
|
||||
t1=$t2
|
||||
$SETTIME -D none -K ns1 $standby1 > /dev/null
|
||||
$SETTIME -R now -K ns1 `cat ns1/managed.key` > /dev/null
|
||||
$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 loadkeys . | sed 's/^/I: ns1 /'
|
||||
sleep 3
|
||||
$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys refresh | sed 's/^/I: ns2 /'
|
||||
sleep 1
|
||||
$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys sync | sed 's/^/I: ns2 /'
|
||||
$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.$n 2>&1
|
||||
# two keys listed
|
||||
count=`grep -c "keyid: " rndc.out.$n`
|
||||
[ "$count" -eq 2 ] || ret=1
|
||||
# two lines indicating trust status
|
||||
count=`grep -c "trust" rndc.out.$n`
|
||||
[ "$count" -eq 2 ] || ret=1
|
||||
# trust is revoked
|
||||
count=`grep -c "trust revoked" rndc.out.$n`
|
||||
[ "$count" -eq 1 ] || ret=1
|
||||
# removal scheduled
|
||||
count=`grep -c "remove at" rndc.out.$n`
|
||||
[ "$count" -eq 1 ] || ret=1
|
||||
# trust is still pending on the standby key
|
||||
count=`grep -c "trust pending" rndc.out.$n`
|
||||
[ "$count" -eq 1 ] || ret=1
|
||||
# pending date moved forward for the standby key
|
||||
t2=`grep "trust pending" ns2/managed-keys.bind`
|
||||
[ -n "$t2" ] || ret=1
|
||||
[ "$t1" = "$t2" ] && ret=1
|
||||
if [ $ret != 0 ]; then echo "I:failed"; fi
|
||||
status=`expr $status + $ret`
|
||||
|
||||
n=`expr $n + 1`
|
||||
ret=0
|
||||
echo "I: refresh managed-keys, ensure same result ($n)"
|
||||
t1=$t2
|
||||
sleep 2
|
||||
$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys refresh | sed 's/^/I: ns2 /'
|
||||
$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys sync | sed 's/^/I: ns2 /'
|
||||
$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.$n 2>&1
|
||||
# two keys listed
|
||||
count=`grep -c "keyid: " rndc.out.$n`
|
||||
[ "$count" -eq 2 ] || ret=1
|
||||
# two lines indicating trust status
|
||||
count=`grep -c "trust" rndc.out.$n`
|
||||
[ "$count" -eq 2 ] || ret=1
|
||||
# trust is revoked
|
||||
count=`grep -c "trust revoked" rndc.out.$n`
|
||||
[ "$count" -eq 1 ] || ret=1
|
||||
# removal scheduled
|
||||
count=`grep -c "remove at" rndc.out.$n`
|
||||
[ "$count" -eq 1 ] || ret=1
|
||||
# trust is still pending on the standby key
|
||||
count=`grep -c "trust pending" rndc.out.$n`
|
||||
[ "$count" -eq 1 ] || ret=1
|
||||
# pending date moved forward for the standby key
|
||||
t2=`grep "trust pending" ns2/managed-keys.bind`
|
||||
[ -n "$t2" ] || ret=1
|
||||
[ "$t1" = "$t2" ] && ret=1
|
||||
if [ $ret != 0 ]; then echo "I:failed"; fi
|
||||
status=`expr $status + $ret`
|
||||
|
||||
n=`expr $n + 1`
|
||||
ret=0
|
||||
echo "I: restore revoked key, ensure same result ($n)"
|
||||
t1=$t2
|
||||
$SETTIME -R none -D now -K ns1 `cat ns1/managed.key` > /dev/null
|
||||
$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 loadkeys . | sed 's/^/I: ns1 /'
|
||||
sleep 3
|
||||
$SETTIME -D none -K ns1 `cat ns1/managed.key` > /dev/null
|
||||
$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 loadkeys . | sed 's/^/I: ns1 /'
|
||||
sleep 3
|
||||
$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys refresh | sed 's/^/I: ns2 /'
|
||||
sleep 1
|
||||
$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys sync | sed 's/^/I: ns2 /'
|
||||
$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.$n 2>&1
|
||||
# two keys listed
|
||||
count=`grep -c "keyid: " rndc.out.$n`
|
||||
[ "$count" -eq 2 ] || ret=1
|
||||
# two lines indicating trust status
|
||||
count=`grep -c "trust" rndc.out.$n`
|
||||
[ "$count" -eq 2 ] || ret=1
|
||||
# trust is revoked
|
||||
count=`grep -c "trust revoked" rndc.out.$n`
|
||||
[ "$count" -eq 1 ] || ret=1
|
||||
# removal scheduled
|
||||
count=`grep -c "remove at" rndc.out.$n`
|
||||
[ "$count" -eq 1 ] || ret=1
|
||||
# trust is still pending on the standby key
|
||||
count=`grep -c "trust pending" rndc.out.$n`
|
||||
[ "$count" -eq 1 ] || ret=1
|
||||
# pending date moved forward for the standby key
|
||||
t2=`grep "trust pending" ns2/managed-keys.bind`
|
||||
[ -n "$t2" ] || ret=1
|
||||
[ "$t1" = "$t2" ] && ret=1
|
||||
if [ $ret != 0 ]; then echo "I:failed"; fi
|
||||
status=`expr $status + $ret`
|
||||
|
||||
echo "I: reinitialize trust anchors"
|
||||
$PERL $SYSTEMTESTTOP/stop.pl --use-rndc . ns2
|
||||
rm -f ns2/managed-keys.bind*
|
||||
$PERL $SYSTEMTESTTOP/start.pl --noclean --restart . ns2
|
||||
|
||||
n=`expr $n + 1`
|
||||
echo "I: check that standby key is now trusted ($n)"
|
||||
ret=0
|
||||
sleep 3
|
||||
$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys sync | sed 's/^/I: ns2 /'
|
||||
$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.$n 2>&1
|
||||
# two keys listed
|
||||
count=`grep -c "keyid: " rndc.out.$n`
|
||||
[ "$count" -eq 2 ] || ret=1
|
||||
# two lines indicating trust status
|
||||
count=`grep -c "trust" rndc.out.$n`
|
||||
[ "$count" -eq 2 ] || ret=1
|
||||
# both indicate current trust
|
||||
count=`grep -c "trusted since" rndc.out.$n`
|
||||
[ "$count" -eq 2 ] || ret=1
|
||||
if [ $ret != 0 ]; then echo "I:failed"; fi
|
||||
status=`expr $status + $ret`
|
||||
|
||||
n=`expr $n + 1`
|
||||
echo "I: revoke original key, add new standby ($n)"
|
||||
ret=0
|
||||
standby2=`$KEYGEN -qfk -r $RANDFILE -K ns1 .`
|
||||
$SETTIME -R now -K ns1 `cat ns1/managed.key` > /dev/null
|
||||
$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 loadkeys . | sed 's/^/I: ns1 /'
|
||||
sleep 3
|
||||
$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys refresh | sed 's/^/I: ns2 /'
|
||||
sleep 1
|
||||
$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys sync | sed 's/^/I: ns2 /'
|
||||
$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.$n 2>&1
|
||||
# three keys listed
|
||||
count=`grep -c "keyid: " rndc.out.$n`
|
||||
[ "$count" -eq 3 ] || ret=1
|
||||
# one is revoked
|
||||
count=`grep -c "REVOKE" rndc.out.$n`
|
||||
[ "$count" -eq 1 ] || ret=1
|
||||
# three lines indicating trust status
|
||||
count=`grep -c "trust" rndc.out.$n`
|
||||
[ "$count" -eq 3 ] || ret=1
|
||||
# one indicates current trust
|
||||
count=`grep -c "trusted since" rndc.out.$n`
|
||||
[ "$count" -eq 1 ] || ret=1
|
||||
# one indicates revoked trust
|
||||
count=`grep -c "trust revoked" rndc.out.$n`
|
||||
[ "$count" -eq 1 ] || ret=1
|
||||
# one indicates trust pending
|
||||
count=`grep -c "trust pending" rndc.out.$n`
|
||||
[ "$count" -eq 1 ] || ret=1
|
||||
# removal scheduled
|
||||
count=`grep -c "remove at" rndc.out.$n`
|
||||
[ "$count" -eq 1 ] || ret=1
|
||||
if [ $ret != 0 ]; then echo "I:failed"; fi
|
||||
status=`expr $status + $ret`
|
||||
|
||||
n=`expr $n + 1`
|
||||
echo "I: wait 15 seconds for key add/remove holddowns to expire ($n)"
|
||||
ret=0
|
||||
sleep 15
|
||||
$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys refresh | sed 's/^/I: ns2 /'
|
||||
sleep 1
|
||||
$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys sync | sed 's/^/I: ns2 /'
|
||||
$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.$n 2>&1
|
||||
# two keys listed
|
||||
count=`grep -c "keyid: " rndc.out.$n`
|
||||
[ "$count" -eq 2 ] || ret=1
|
||||
# none revoked
|
||||
count=`grep -c "REVOKE" rndc.out.$n`
|
||||
[ "$count" -eq 0 ] || ret=1
|
||||
# two lines indicating trust status
|
||||
count=`grep -c "trust" rndc.out.$n`
|
||||
[ "$count" -eq 2 ] || ret=1
|
||||
# both indicate current trust
|
||||
count=`grep -c "trusted since" rndc.out.$n`
|
||||
[ "$count" -eq 2 ] || ret=1
|
||||
if [ $ret != 0 ]; then echo "I:failed"; fi
|
||||
status=`expr $status + $ret`
|
||||
|
||||
n=`expr $n + 1`
|
||||
echo "I: revoke all keys, confirm roll to insecure ($n)"
|
||||
ret=0
|
||||
$SETTIME -D now -K ns1 `cat ns1/managed.key` > /dev/null
|
||||
$SETTIME -R now -K ns1 $standby1 > /dev/null
|
||||
$SETTIME -R now -K ns1 $standby2 > /dev/null
|
||||
$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 loadkeys . | sed 's/^/I: ns1 /'
|
||||
sleep 3
|
||||
$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys refresh | sed 's/^/I: ns2 /'
|
||||
sleep 1
|
||||
$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys sync | sed 's/^/I: ns2 /'
|
||||
$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.$n 2>&1
|
||||
# two keys listed
|
||||
count=`grep -c "keyid: " rndc.out.$n`
|
||||
[ "$count" -eq 2 ] || ret=1
|
||||
# both revoked
|
||||
count=`grep -c "REVOKE" rndc.out.$n`
|
||||
[ "$count" -eq 2 ] || ret=1
|
||||
# two lines indicating trust status
|
||||
count=`grep -c "trust" rndc.out.$n`
|
||||
[ "$count" -eq 2 ] || ret=1
|
||||
# both indicate trust revoked
|
||||
count=`grep -c "trust revoked" rndc.out.$n`
|
||||
[ "$count" -eq 2 ] || ret=1
|
||||
# both have removal scheduled
|
||||
count=`grep -c "remove at" rndc.out.$n`
|
||||
[ "$count" -eq 2 ] || ret=1
|
||||
if [ $ret != 0 ]; then echo "I:failed"; fi
|
||||
status=`expr $status + $ret`
|
||||
|
||||
n=`expr $n + 1`
|
||||
echo "I: check for insecure response ($n)"
|
||||
ret=0
|
||||
$DIG $DIGOPTS +noauth example. @10.53.0.2 txt > dig.out.ns2.test$n || ret=1
|
||||
grep "status: NOERROR" dig.out.ns2.test$n > /dev/null || ret=1
|
||||
grep "example..*.RRSIG..*TXT" dig.out.ns2.test$n > /dev/null || ret=1
|
||||
if [ $ret != 0 ]; then echo "I:failed"; fi
|
||||
status=`expr $status + $ret`
|
||||
|
||||
echo "I: reset the root server"
|
||||
$SETTIME -D none -R none -K ns1 `cat ns1/managed.key` > /dev/null
|
||||
$SETTIME -D now -K ns1 $standby1 > /dev/null
|
||||
$SETTIME -D now -K ns1 $standby2 > /dev/null
|
||||
$SIGNER -Sg -K ns1 -N unixtime -r $RANDFILE -o . ns1/root.db > /dev/null 2>&-
|
||||
cp ns1/named2.conf ns1/named.conf
|
||||
$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 reconfig
|
||||
|
||||
echo "I: reinitialize trust anchors"
|
||||
$PERL $SYSTEMTESTTOP/stop.pl --use-rndc . ns2
|
||||
rm -f ns2/managed-keys.bind*
|
||||
$PERL $SYSTEMTESTTOP/start.pl --noclean --restart . ns2
|
||||
|
||||
n=`expr $n + 1`
|
||||
echo "I: check positive validation ($n)"
|
||||
ret=0
|
||||
$DIG $DIGOPTS +noauth example. @10.53.0.2 txt > dig.out.ns2.test$n || ret=1
|
||||
grep "flags:.*ad.*QUERY" dig.out.ns2.test$n > /dev/null || ret=1
|
||||
grep "example..*.RRSIG..*TXT" dig.out.ns2.test$n > /dev/null || ret=1
|
||||
if [ $ret != 0 ]; then echo "I:failed"; fi
|
||||
status=`expr $status + $ret`
|
||||
|
||||
|
||||
n=`expr $n + 1`
|
||||
echo "I: revoke key with bad signature, check revocation is ignored ($n)"
|
||||
ret=0
|
||||
orig=`cat ns1/managed.key`
|
||||
keyid=`cat ns1/managed.key.id`
|
||||
revoked=`$REVOKE -K ns1 $orig`
|
||||
rkeyid=`expr $revoked : 'ns1/K\.+00.+\([0-9]*\)'`
|
||||
$SETTIME -R none -D none -K ns1 $standby1 > /dev/null
|
||||
$SIGNER -Sg -K ns1 -N unixtime -r $RANDFILE -O full -o . -f signer.out.$n ns1/root.db > /dev/null 2>&-
|
||||
cp -f ns1/root.db.signed ns1/root.db.tmp
|
||||
BADSIG="SVn2tLDzpNX2rxR4xRceiCsiTqcWNKh7NQ0EQfCrVzp9WEmLw60sQ5kP xGk4FS/xSKfh89hO2O/H20Bzp0lMdtr2tKy8IMdU/mBZxQf2PXhUWRkg V2buVBKugTiOPTJSnaqYCN3rSfV1o7NtC1VNHKKK/D5g6bpDehdn5Gaq kpBhN+MSCCh9OZP2IT20luS1ARXxLlvuSVXJ3JYuuhTsQXUbX/SQpNoB Lo6ahCE55szJnmAxZEbb2KOVnSlZRA6ZBHDhdtO0S4OkvcmTutvcVV+7 w53CbKdaXhirvHIh0mZXmYk2PbPLDY7PU9wSH40UiWPOB9f00wwn6hUe uEQ1Qg=="
|
||||
sed -e "/ $rkeyid \./s, \. .*$, . $BADSIG," signer.out.$n > ns1/root.db.signed
|
||||
$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 reload . | sed 's/^/I: ns1 /'
|
||||
sleep 3
|
||||
$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys refresh | sed 's/^/I: ns2 /'
|
||||
sleep 1
|
||||
$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys sync | sed 's/^/I: ns2 /'
|
||||
$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.$n 2>&1
|
||||
# one key listed
|
||||
count=`grep -c "keyid: " rndc.out.$n`
|
||||
[ "$count" -eq 1 ] || ret=1
|
||||
# it's the original key id
|
||||
count=`grep -c "keyid: $keyid" rndc.out.$n`
|
||||
[ "$count" -eq 1 ] || ret=1
|
||||
# not revoked
|
||||
count=`grep -c "REVOKE" rndc.out.$n`
|
||||
[ "$count" -eq 0 ] || ret=1
|
||||
# trust is still current
|
||||
count=`grep -c "trust" rndc.out.$n`
|
||||
[ "$count" -eq 1 ] || ret=1
|
||||
count=`grep -c "trusted since" rndc.out.$n`
|
||||
[ "$count" -eq 1 ] || ret=1
|
||||
if [ $ret != 0 ]; then echo "I:failed"; fi
|
||||
status=`expr $status + $ret`
|
||||
|
||||
n=`expr $n + 1`
|
||||
echo "I: check validation fails with bad DNSKEY rrset ($n)"
|
||||
ret=0
|
||||
$DIG $DIGOPTS +noauth example. @10.53.0.2 txt > dig.out.ns2.test$n || ret=1
|
||||
grep "status: SERVFAIL" dig.out.ns2.test$n > /dev/null || ret=1
|
||||
if [ $ret != 0 ]; then echo "I:failed"; fi
|
||||
status=`expr $status + $ret`
|
||||
|
||||
n=`expr $n + 1`
|
||||
echo "I: restore DNSKEY rrset, check validation succeeds again ($n)"
|
||||
ret=0
|
||||
rm -f ${revoked}.key ${revoked}.private
|
||||
$SETTIME -D none -R none -K ns1 `cat ns1/managed.key` > /dev/null
|
||||
$SETTIME -D now -K ns1 $standby1 > /dev/null
|
||||
$SETTIME -D now -K ns1 $standby2 > /dev/null
|
||||
$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 flush | sed 's/^/I: ns1 /'
|
||||
sleep 1
|
||||
$SIGNER -Sg -K ns1 -N unixtime -r $RANDFILE -o . ns1/root.db > /dev/null 2>&-
|
||||
$RNDC -c ../common/rndc.conf -s 10.53.0.1 -p 9953 reload . | sed 's/^/I: ns1 /'
|
||||
sleep 3
|
||||
$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys refresh | sed 's/^/I: ns2 /'
|
||||
sleep 1
|
||||
$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p 9953 managed-keys status > rndc.out.$n 2>&1
|
||||
$DIG $DIGOPTS +noauth example. @10.53.0.2 txt > dig.out.ns2.test$n || ret=1
|
||||
grep "flags:.*ad.*QUERY" dig.out.ns2.test$n > /dev/null || ret=1
|
||||
grep "example..*.RRSIG..*TXT" dig.out.ns2.test$n > /dev/null || ret=1
|
||||
if [ $ret != 0 ]; then echo "I:failed"; fi
|
||||
status=`expr $status + $ret`
|
||||
|
||||
echo "I:exit status: $status"
|
||||
exit $status
|
||||
Reference in New Issue
Block a user