From 6592c9c850675fb20236271efc4f65acbe3bfa00 Mon Sep 17 00:00:00 2001 From: Martin Pitt Date: Thu, 21 Feb 2019 12:24:16 +0100 Subject: [PATCH 1/3] networkd-test: disable DNSSEC in domain-restricted DNS test dnsmasq 2.80 changed behaviour when being queried by resolved with enabled DNSSEC: It returns errors for SOA and DS queries which cause the entire query to fail. As we don't configure DNSSEC in this test anyway, just disable it so that we retain compatibility with old and new dnsmasq versions. --- test/networkd-test.py | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/test/networkd-test.py b/test/networkd-test.py index 7011abc965..71ee06f279 100755 --- a/test/networkd-test.py +++ b/test/networkd-test.py @@ -575,6 +575,13 @@ class DnsmasqClientTest(ClientTestBase, unittest.TestCase): def test_resolved_domain_restricted_dns(self): '''resolved: domain-restricted DNS servers''' + # FIXME: resolvectl query fails with enabled DNSSEC against our dnsmasq + conf = '/run/systemd/resolved.conf.d/test-disable-dnssec.conf' + os.makedirs(os.path.dirname(conf), exist_ok=True) + with open(conf, 'w') as f: + f.write('[Resolve]\nDNSSEC=no\n') + self.addCleanup(os.remove, conf) + # create interface for generic connections; this will map all DNS names # to 192.168.42.1 self.create_iface(dnsmasq_opts=['--address=/#/192.168.42.1']) From ca56805c8de43fc21ab4657cf5ebd1e0248527ac Mon Sep 17 00:00:00 2001 From: Martin Pitt Date: Thu, 21 Feb 2019 12:26:44 +0100 Subject: [PATCH 2/3] networkd-test: use a complete domain name in test_route_only_dns() Since version 241 (commit ea4678?), querying MX type records for single-label domains does not actually forward the query to the DNS server any more. Use "example.com" instead, which is the recommended test domain anyway. --- test/networkd-test.py | 32 ++++++++++++++++---------------- 1 file changed, 16 insertions(+), 16 deletions(-) diff --git a/test/networkd-test.py b/test/networkd-test.py index 71ee06f279..c03e76052f 100755 --- a/test/networkd-test.py +++ b/test/networkd-test.py @@ -655,52 +655,52 @@ Domains= ~company ~lab''') '''resolved queries to /etc/hosts''' # FIXME: -t MX query fails with enabled DNSSEC (even when using - # the known negative trust anchor .internal instead of .example) + # the known negative trust anchor .internal instead of .example.com) conf = '/run/systemd/resolved.conf.d/test-disable-dnssec.conf' os.makedirs(os.path.dirname(conf), exist_ok=True) with open(conf, 'w') as f: f.write('[Resolve]\nDNSSEC=no\nLLMNR=no\nMulticastDNS=no\n') self.addCleanup(os.remove, conf) - # create /etc/hosts bind mount which resolves my.example for IPv4 + # create /etc/hosts bind mount which resolves my.example.com for IPv4 hosts = os.path.join(self.workdir, 'hosts') with open(hosts, 'w') as f: - f.write('172.16.99.99 my.example\n') + f.write('172.16.99.99 my.example.com\n') subprocess.check_call(['mount', '--bind', hosts, '/etc/hosts']) self.addCleanup(subprocess.call, ['umount', '/etc/hosts']) subprocess.check_call(['systemctl', 'stop', 'systemd-resolved.service']) # note: different IPv4 address here, so that it's easy to tell apart # what resolved the query - self.create_iface(dnsmasq_opts=['--host-record=my.example,172.16.99.1,2600::99:99', - '--host-record=other.example,172.16.0.42,2600::42', - '--mx-host=example,mail.example'], + self.create_iface(dnsmasq_opts=['--host-record=my.example.com,172.16.99.1,2600::99:99', + '--host-record=other.example.com,172.16.0.42,2600::42', + '--mx-host=example.com,mail.example.com'], ipv6=True) self.do_test(coldplug=None, ipv6=True) try: # family specific queries - out = subprocess.check_output(['resolvectl', 'query', '-4', 'my.example']) - self.assertIn(b'my.example: 172.16.99.99', out) + out = subprocess.check_output(['resolvectl', 'query', '-4', 'my.example.com']) + self.assertIn(b'my.example.com: 172.16.99.99', out) # we don't expect an IPv6 answer; if /etc/hosts has any IP address, # it's considered a sufficient source - self.assertNotEqual(subprocess.call(['resolvectl', 'query', '-6', 'my.example']), 0) + self.assertNotEqual(subprocess.call(['resolvectl', 'query', '-6', 'my.example.com']), 0) # "any family" query; IPv4 should come from /etc/hosts - out = subprocess.check_output(['resolvectl', 'query', 'my.example']) - self.assertIn(b'my.example: 172.16.99.99', out) + out = subprocess.check_output(['resolvectl', 'query', 'my.example.com']) + self.assertIn(b'my.example.com: 172.16.99.99', out) # IP → name lookup; again, takes the /etc/hosts one out = subprocess.check_output(['resolvectl', 'query', '172.16.99.99']) - self.assertIn(b'172.16.99.99: my.example', out) + self.assertIn(b'172.16.99.99: my.example.com', out) # non-address RRs should fall back to DNS - out = subprocess.check_output(['resolvectl', 'query', '--type=MX', 'example']) - self.assertIn(b'example IN MX 1 mail.example', out) + out = subprocess.check_output(['resolvectl', 'query', '--type=MX', 'example.com']) + self.assertIn(b'example.com IN MX 1 mail.example.com', out) # other domains query DNS - out = subprocess.check_output(['resolvectl', 'query', 'other.example']) + out = subprocess.check_output(['resolvectl', 'query', 'other.example.com']) self.assertIn(b'172.16.0.42', out) out = subprocess.check_output(['resolvectl', 'query', '172.16.0.42']) - self.assertIn(b'172.16.0.42: other.example', out) + self.assertIn(b'172.16.0.42: other.example.com', out) except (AssertionError, subprocess.CalledProcessError): self.show_journal('systemd-resolved.service') self.print_server_log() From f5cf985e9cc6fff747ca17acadb1b4751076103b Mon Sep 17 00:00:00 2001 From: Martin Pitt Date: Thu, 21 Feb 2019 12:34:23 +0100 Subject: [PATCH 3/3] networkd-test: fix test_dropin() - This test needs resolved, so make sure it is started. In some Debian environments it is not. - It was an unnecessary, and now failing assumption that name servers get atomically written to the resolved's resolv.conf. Wait until both expected name servers are in the file. --- test/networkd-test.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/test/networkd-test.py b/test/networkd-test.py index c03e76052f..9487910b71 100755 --- a/test/networkd-test.py +++ b/test/networkd-test.py @@ -950,12 +950,12 @@ DNS=192.168.42.1''') [Network] DNS=127.0.0.1''') - subprocess.check_call(['systemctl', 'start', 'systemd-networkd']) + subprocess.check_call(['systemctl', 'start', 'systemd-resolved', 'systemd-networkd']) for timeout in range(50): with open(RESOLV_CONF) as f: contents = f.read() - if ' 127.0.0.1' in contents: + if ' 127.0.0.1' in contents and '192.168.42.1' in contents: break time.sleep(0.1) self.assertIn('nameserver 192.168.42.1\n', contents)