138 lines
5.2 KiB
Bash
Executable File
138 lines
5.2 KiB
Bash
Executable File
#!/usr/local/bin/bash
|
|
#nscheck.sh - Simple script to do fairly good DNS diagnostics, to determine: Failing/slow nameservers, result inconsistency and so on.
|
|
|
|
# Copyright (c) 2012, Matthew Connelly
|
|
# All rights reserved.
|
|
#
|
|
# Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
|
|
# - Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
|
|
# - Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
|
|
# - Neither the name of the software nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
|
|
#
|
|
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
|
|
|
#TODO
|
|
# - Handle multiple results for single record names (DNS round-robin)
|
|
|
|
#Configurables
|
|
TIMEOUT=1
|
|
|
|
#Binary locations
|
|
DIG_BIN="/usr/bin/dig"
|
|
|
|
#Internal variables
|
|
DIG_RECORD_TYPE="A"
|
|
VERSION="0.2"
|
|
ZONE=""
|
|
if [ "$1" == "-6" ]; then
|
|
DIG_RECORD_TYPE="AAAA"
|
|
ZONE=$2
|
|
elif [ "$1" == "-4" ]; then
|
|
ZONE=$2
|
|
elif [ "$1" == "-t" ]; then
|
|
DIG_RECORD_TYPE=$2
|
|
ZONE=$3
|
|
elif [ "$1" == "-h" -o -z "$1" ]; then
|
|
echo "$0 $VERSION: Bash script to do DNS diagnosis.
|
|
NOTE: This script will not, at present, function properly for DNS queries which result in more than one record of the same type (ie, DNS round robins)
|
|
|
|
Usage: $0 [-4|-6|-t RTYPE] DNS.ENTITY
|
|
$0 -h: Show this usage.
|
|
$0 -4: Use IPv4 [Default].
|
|
$0 -6: Use IPv6.
|
|
$0 -t: Ask for specified record type, rather than A or AAAA."
|
|
exit 0
|
|
else
|
|
ZONE=$1
|
|
fi
|
|
DOMAIN=$ZONE
|
|
IPS_REPORTED=""
|
|
NS_REPORTED=""
|
|
FAILED_NS=""
|
|
IPS_CHECKED=""
|
|
SUCCESS_OUT="NS | NS-IP | NS-REVERSE | IP | REVERSE"
|
|
FAIL_OUT="NS | NS-IP | NS-REVERSE"
|
|
|
|
#Because this is a DNS debugging script, we don't rely on a domain's nameservers themselves for a list of nameservers. Instead, we query root and TLD nameservers.
|
|
|
|
#First we make sure we're querying the nameservers for the actual domain and not a subdomain. Also; remove trailing dot.
|
|
OUT=$($DIG_BIN $ZONE SOA|grep "^;; ANSWER" -A1|tail -n1|awk '{print $1}'|sed -e 's/.$//g')
|
|
if [ -z "$OUT" ]; then
|
|
#Try again.
|
|
OUT=$($DIG_BIN $ZONE SOA|grep "^;; AUTH" -A1|grep "SOA"|tail -n1|awk '{print $1}'|sed -e 's/.$//g')
|
|
fi
|
|
if [ -z "$OUT" ]; then
|
|
#Try again.
|
|
OUT=$($DIG_BIN $ZONE SOA|grep "^;; ANSWER" -A6|grep "SOA"|tail -n1|awk '{print $1}'|sed -e 's/.$//g')
|
|
fi
|
|
if [[ $OUT != $ZONE && ! -z "$OUT" ]]; then
|
|
ZONE=$OUT
|
|
fi
|
|
for ns in $($DIG_BIN +short $ZONE NS); do
|
|
if [[ $NS_REPORTED != *"$ns"* ]]; then
|
|
NS_REPORTED="$NS_REPORTED$ns "
|
|
fi
|
|
for ip in $($DIG_BIN +short $ns $DIG_RECORD_TYPE); do
|
|
if [[ $IPS_CHECKED != *"$ip"* ]]; then
|
|
IPS_CHECKED="$IPS_CHECKED $ip"
|
|
#We need to use tail here in order to stop dig from being fucking retarded and providing a cname as well as the result
|
|
OUT="$($DIG_BIN +short +time=$TIMEOUT @$ip $DOMAIN $DIG_RECORD_TYPE|tail -n1)"
|
|
REVERSE=$($DIG_BIN +short -x $ip|tail -n1)
|
|
if [ -z "$REVERSE" ]; then
|
|
REVERSE="no-reverse"
|
|
fi
|
|
if [[ $OUT == ";;"* && $FAILED_NS != *"$ip"* ]]; then
|
|
FAILED_NS="$FAILED_NS$ip "
|
|
elif [[ $OUT != ";;"* && $IPS_REPORTED != *"$OUT"* ]]; then
|
|
IPS_REPORTED="$IPS_REPORTED$OUT "
|
|
fi
|
|
if [[ $OUT != ";;"* ]]; then
|
|
REVOUT=""
|
|
if [ -z "$OUT" ]; then
|
|
OUT="no-record"
|
|
else
|
|
REVOUT="$($DIG_BIN +short -x $OUT|tail -n1)"
|
|
fi
|
|
if [ -z "$REVOUT" ]; then
|
|
REVOUT="no-reverse"
|
|
fi
|
|
SUCCESS_OUT="$SUCCESS_OUT
|
|
$ns | $ip | $REVERSE | $OUT | $REVOUT"
|
|
else
|
|
FAIL_OUT="$FAIL_OUT
|
|
$ns | $ip | $REVERSE"
|
|
fi
|
|
fi
|
|
done
|
|
done
|
|
if [[ $ZONE != $DOMAIN ]]; then
|
|
echo "Found root zone for $DOMAIN: $ZONE"
|
|
fi
|
|
if [ ! -z "$NS_REPORTED" ]; then
|
|
echo "Nameserver records found for $ZONE: $(echo $NS_REPORTED|sort)"
|
|
else
|
|
echo "No nameserver records were found for $ZONE."
|
|
exit 1
|
|
fi
|
|
if [ -z "$IPS_REPORTED" ]; then
|
|
echo "No IP addresses were returned for $DOMAIN"
|
|
else
|
|
echo "IPs reported for $DOMAIN: $(echo $IPS_REPORTED|sort -n)"
|
|
fi
|
|
if [ -z "$FAILED_NS" ]; then
|
|
echo "No nameservers for $DOMAIN failed to respond."
|
|
else
|
|
echo "The following nameservers for $DOMAIN failed to respond: $(echo $FAILED_NS|sort -n)"
|
|
fi
|
|
if [ ! -z "$IPS_REPORTED" ]; then
|
|
echo
|
|
echo "Full DNS output of each nameserver IP:"
|
|
echo "$SUCCESS_OUT"|sort -n|uniq|column -t
|
|
fi
|
|
if [ ! -z "$FAILED_NS" ]; then
|
|
echo
|
|
echo "Reverse DNS for every unresponsive nameserver IP:"
|
|
echo "$FAIL_OUT"|sort -n|uniq|column -t
|
|
fi
|
|
echo
|