Evan Hunt
f46168b879
3408. [bug] Some DNSSEC-related options (update-check-ksk, dnssec-loadkeys-interval, dnssec-dnskey-kskonly) are now legal in slave zones as long as inline-signing is in use. [RT #31078]
109 lines
3.6 KiB
Bash
109 lines
3.6 KiB
Bash
# Copyright (C) 2005, 2007, 2010-2012 Internet Systems Consortium, Inc. ("ISC")
|
|
#
|
|
# Permission to use, copy, modify, and/or distribute this software for any
|
|
# purpose with or without fee is hereby granted, provided that the above
|
|
# copyright notice and this permission notice appear in all copies.
|
|
#
|
|
# THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
|
|
# REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
|
|
# AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
|
|
# INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
|
|
# LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
|
|
# OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
|
|
# PERFORMANCE OF THIS SOFTWARE.
|
|
|
|
# $Id$
|
|
|
|
SYSTEMTESTTOP=..
|
|
. $SYSTEMTESTTOP/conf.sh
|
|
|
|
status=0
|
|
|
|
echo "I: checking that named-checkconf handles a known good config"
|
|
ret=0
|
|
$CHECKCONF good.conf > /dev/null 2>&1 || ret=1
|
|
if [ $ret != 0 ]; then echo "I:failed"; fi
|
|
status=`expr $status + $ret`
|
|
|
|
echo "I: checking that named-checkconf prints a known good config"
|
|
ret=0
|
|
awk 'BEGIN { ok = 0; } /cut here/ { ok = 1; getline } ok == 1 { print }' good.conf > good.conf.in
|
|
[ -s good.conf.in ] || ret=1
|
|
$CHECKCONF -p good.conf.in | grep -v '^good.conf.in:' > good.conf.out 2>&1 || ret=1
|
|
cmp good.conf.in good.conf.out || ret=1
|
|
if [ $ret != 0 ]; then echo "I:failed"; fi
|
|
status=`expr $status + $ret`
|
|
|
|
for bad in bad*.conf
|
|
do
|
|
ret=0
|
|
echo "I: checking that named-checkconf detects error in $bad"
|
|
$CHECKCONF $bad > /dev/null 2>&1
|
|
if [ $? != 1 ]; then echo "I:failed"; ret=1; fi
|
|
status=`expr $status + $ret`
|
|
done
|
|
|
|
echo "I: checking named-checkconf dnssec warnings"
|
|
ret=0
|
|
$CHECKCONF dnssec.1 2>&1 | grep 'validation yes.*enable no' > /dev/null || ret=1
|
|
$CHECKCONF dnssec.2 2>&1 | grep 'auto-dnssec may only be ' > /dev/null || ret=1
|
|
$CHECKCONF dnssec.2 2>&1 | grep 'validation auto.*enable no' > /dev/null || ret=1
|
|
$CHECKCONF dnssec.2 2>&1 | grep 'validation yes.*enable no' > /dev/null || ret=1
|
|
# this one should have no warnings
|
|
$CHECKCONF dnssec.3 2>&1 | grep '.*' && ret=1
|
|
if [ $ret != 0 ]; then echo "I:failed"; fi
|
|
status=`expr $status + $ret`
|
|
|
|
echo "I: range checking fields that do not allow zero"
|
|
ret=0
|
|
for field in max-retry-time min-retry-time max-refresh-time min-refresh-time; do
|
|
cat > badzero.conf << EOF
|
|
options {
|
|
$field 0;
|
|
};
|
|
EOF
|
|
$CHECKCONF badzero.conf > /dev/null 2>&1
|
|
[ $? -eq 1 ] || { echo "I: options $field failed" ; ret=1; }
|
|
cat > badzero.conf << EOF
|
|
view dummy {
|
|
$field 0;
|
|
};
|
|
EOF
|
|
$CHECKCONF badzero.conf > /dev/null 2>&1
|
|
[ $? -eq 1 ] || { echo "I: view $field failed" ; ret=1; }
|
|
cat > badzero.conf << EOF
|
|
options {
|
|
$field 0;
|
|
};
|
|
view dummy {
|
|
};
|
|
EOF
|
|
$CHECKCONF badzero.conf > /dev/null 2>&1
|
|
[ $? -eq 1 ] || { echo "I: options + view $field failed" ; ret=1; }
|
|
cat > badzero.conf << EOF
|
|
zone dummy {
|
|
type slave;
|
|
masters { 0.0.0.0; };
|
|
$field 0;
|
|
};
|
|
EOF
|
|
$CHECKCONF badzero.conf > /dev/null 2>&1
|
|
[ $? -eq 1 ] || { echo "I: zone $field failed" ; ret=1; }
|
|
done
|
|
if [ $ret != 0 ]; then echo "I:failed"; fi
|
|
status=`expr $status + $ret`
|
|
|
|
echo "I: checking options allowed in inline-signing slaves"
|
|
ret=0
|
|
n=`$CHECKCONF bad-dnssec.conf 2>&1 | grep "dnssec-dnskey-kskonly.*requires inline" | wc -l`
|
|
[ $n -eq 1 ] || ret=1
|
|
n=`$CHECKCONF bad-dnssec.conf 2>&1 | grep "dnssec-loadkeys-interval.*requires inline" | wc -l`
|
|
[ $n -eq 1 ] || ret=1
|
|
n=`$CHECKCONF bad-dnssec.conf 2>&1 | grep "update-check-ksk.*requires inline" | wc -l`
|
|
[ $n -eq 1 ] || ret=1
|
|
if [ $ret != 0 ]; then echo "I:failed"; fi
|
|
status=`expr $status + $ret`
|
|
|
|
echo "I:exit status: $status"
|
|
exit $status
|