mirror of
https://github.com/NLnetLabs/unbound.git
synced 2026-09-29 05:04:57 +02:00
127 lines
3.2 KiB
Plaintext
127 lines
3.2 KiB
Plaintext
# #-- svcb.test --#
|
|
# source the master var file when it's there
|
|
[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
|
|
# use .tpkg.var.test for in test variable passing
|
|
[ -f .tpkg.var.test ] && source .tpkg.var.test
|
|
|
|
. ../common.sh
|
|
get_random_port 2
|
|
UNBOUND_PORT=$RND_PORT
|
|
UNBOUND_PORT2=$(($RND_PORT + 1))
|
|
echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
|
|
echo "UNBOUND_PORT=2=$UNBOUND_PORT2" >> .tpkg.var.test
|
|
|
|
# rewrite config file with created ports
|
|
sed -e 's/@PORT\@/'$UNBOUND_PORT'/' < ede.conf > ub.conf
|
|
sed -e 's/@PORT2\@/'$UNBOUND_PORT2'/' < ede-auth.conf > ub2.conf
|
|
|
|
# start unbound in the background
|
|
PRE="../.."
|
|
$PRE/unbound -d -c ub.conf > unbound.log 2>&1 &
|
|
UNBOUND_PID=$!
|
|
echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
|
|
|
|
# start "authoritative unbound" in the background
|
|
$PRE/unbound -d -c ub.conf > unbound.log 2>&1 &
|
|
UNBOUND_PID2=$!
|
|
echo "UNBOUND_PID2=$UNBOUND_PID2" >> .tpkg.var.test
|
|
|
|
|
|
# query with bad edns keepalive
|
|
dig @127.0.0.1 -p $UNBOUND_PORT +tcp +ednsopt=11:010203 > keepalive.txt
|
|
|
|
if ! grep -q "OPT=15: 00 00 71 75 65 72 79 20 77 69 74 68 20 62 61 64 20 65 64 6e 73 20 6b 65 65 70 61 6c 69 76 65" keepalive.txt
|
|
then
|
|
echo "Incorect bad edns keepalive output"
|
|
exit 1
|
|
fi
|
|
|
|
# refused nonrec (cache snoop) (Not Auth)
|
|
dig @127.0.0.1 -p $UNBOUND_PORT +norec > snoop.txt
|
|
|
|
if ! grep -q "OPT=15: 00 14" snoop.txt
|
|
then
|
|
echo "Incorect cache snoop output"
|
|
exit 1
|
|
fi
|
|
|
|
# @TODO dnssec bogus local zones something
|
|
dig @127.0.0.1 -p $UNBOUND_PORT qwerqwer.hopsa.kidee. TXT +dnssec > bogus.txt
|
|
|
|
if ! grep -q "OPT=15: 00 0f" bogus.txt
|
|
then
|
|
echo "Incorect DNSSEC local zone output"
|
|
exit 1
|
|
fi
|
|
|
|
|
|
# DNAME expansion
|
|
# @TODO do we have this?
|
|
|
|
|
|
# RPZ DNAME expansion too long
|
|
dig @127.0.0.1 -p $UNBOUND_PORT www.qhqwer.qwer.qwer.h.example.com A > dname_expansion.txt
|
|
|
|
if ! grep -q "OPT=15: 00 00 44 4e 41 4d 45 20 65 78 70 61 6e 73 69 6f 6e 20 62 65 63 61 6d 65 20 74 6f 6f 20 6c 61 72 67 65" dname_expansion.txt
|
|
then
|
|
echo "No DNAME expansion for CNAME EDE message"
|
|
exit 1
|
|
fi
|
|
|
|
# RPZ always_null gets EDE forged
|
|
dig @127.0.0.1 -p $UNBOUND_PORT uva.nl A > always_null_forged.txt
|
|
|
|
if ! grep -q "OPT=15: 00 04" always_null_forged.txt
|
|
then
|
|
echo "local-zone always_null must have EDE forged code"
|
|
exit 1
|
|
fi
|
|
|
|
# RPZ always_refuse
|
|
dig @127.0.0.1 -p $UNBOUND_PORT hopsa.kidee. A > always_refuse.txt
|
|
|
|
if ! grep -q "OPT=15: 00 04" always_refuse.txt
|
|
then
|
|
echo "local-zone always_null must have EDE blocked code"
|
|
exit 1
|
|
fi
|
|
|
|
# @TODO what does this trigger?
|
|
dig @localhost hopsa.kidee. A
|
|
|
|
# @TODO trigger mesh DNSSEC bogus
|
|
dig @127.0.0.1 -p $UNBOUND_PORT servfail.nl > servfail.txt
|
|
|
|
if ! grep -q "OPT=15: 00 06" servfail.txt
|
|
then
|
|
echo "query to servfail.nl should return EDE DNSSEC bogus"
|
|
exit 1
|
|
fi
|
|
|
|
# local data forged answer
|
|
dig @127.0.0.1 -p $UNBOUND_PORT hopsa.nlnetlabs.nl TXT
|
|
|
|
# ACL refused, EDE prohibited
|
|
dig @127.0.0.1 -b 127.0.0.2 example.com > refused.txt
|
|
|
|
if ! grep -q "OPT=15: 00 12" refused.txt
|
|
then
|
|
echo "ACL refused does not give EDE prohibited"
|
|
exit 1
|
|
fi
|
|
|
|
|
|
|
|
# DNSSEC indeterminate
|
|
|
|
# ZONE KEY TOEVOEGEN AAN UNBOUND
|
|
# SIGNEN MET LDNS SIGNER
|
|
# MAKE ZONE RECORD WITH EXPIRED AND NOT INCEPTED RECORD
|
|
# zone aanmaken met auth-zone op een tweede unbound
|
|
|
|
|
|
|
|
|
|
# teardown
|
|
kill_pid $UNBOUND_PID
|
|
kill_pid $UNBOUND_PID2 |