From 5c9111fe779b44745256279052786e9cc499e57a Mon Sep 17 00:00:00 2001 From: Frantisek Sumsal Date: Fri, 8 Jul 2022 13:36:03 +0200 Subject: [PATCH 1/5] test: cover IPv6 in the resolved test suite --- test/knot-data/knot.conf | 3 + test/knot-data/zones/onlinesign.test.zone | 15 ++- test/knot-data/zones/root.zone | 8 +- test/knot-data/zones/signed.test.zone | 23 ++-- test/knot-data/zones/test.zone | 12 +- test/knot-data/zones/unsigned.test.zone | 12 +- test/knot-data/zones/untrusted.test.zone | 11 +- test/units/testsuite-75.sh | 135 ++++++++++++++++++---- 8 files changed, 169 insertions(+), 50 deletions(-) diff --git a/test/knot-data/knot.conf b/test/knot-data/knot.conf index e3de69d0f4..6ea0cca3db 100644 --- a/test/knot-data/knot.conf +++ b/test/knot-data/knot.conf @@ -4,6 +4,7 @@ server: rundir: "/run/knot" user: knot:knot listen: 10.0.0.1@53 + listen: fd00:dead:beef:cafe::1@53 log: - target: syslog @@ -15,11 +16,13 @@ database: acl: - id: update_acl address: 10.0.0.0/24 + address: fd00:dead:beef:cafe::/64 action: update remote: - id: parent_zone_server address: 10.0.0.1@53 + address: fd00:dead:beef:cafe::1@53 submission: - id: parent_zone_sbm diff --git a/test/knot-data/zones/onlinesign.test.zone b/test/knot-data/zones/onlinesign.test.zone index c12c6b3396..c8662fa3ed 100644 --- a/test/knot-data/zones/onlinesign.test.zone +++ b/test/knot-data/zones/onlinesign.test.zone @@ -11,12 +11,17 @@ $ORIGIN onlinesign.test. ) ; NS info - NS ns1.unsigned.test. + NS ns1.unsigned.test. - TXT "hello from onlinesign" + TXT "hello from onlinesign" -*.wild TXT "this is an onlinesign wildcard" +*.wild TXT "this is an onlinesign wildcard" ; No A/AAAA record for the $ORIGIN -sub A 10.0.0.133 -secondsub A 10.0.0.134 +sub A 10.0.0.133 +secondsub A 10.0.0.134 + +dual A 10.0.0.135 +dual AAAA fd00:dead:beef:cafe::135 + +ipv6 AAAA fd00:dead:beef:cafe::136 diff --git a/test/knot-data/zones/root.zone b/test/knot-data/zones/root.zone index 72439fdc55..f601e8676d 100644 --- a/test/knot-data/zones/root.zone +++ b/test/knot-data/zones/root.zone @@ -8,7 +8,9 @@ $TTL 300 1D ; minimum TTL ) -. NS ns1.unsigned.test -ns1.unsigned.test A 10.0.0.1 +. NS ns1.unsigned.test +; NS glue records +ns1.unsigned.test A 10.0.0.1 +ns1.unsigned.test AAAA fd00:dead:beef:cafe::1 -test NS ns1.unsigned.test +test NS ns1.unsigned.test diff --git a/test/knot-data/zones/signed.test.zone b/test/knot-data/zones/signed.test.zone index 38d8e2aa13..fa6706205a 100644 --- a/test/knot-data/zones/signed.test.zone +++ b/test/knot-data/zones/signed.test.zone @@ -11,18 +11,27 @@ $ORIGIN signed.test. ) ; NS info - NS ns1.unsigned.test. + NS ns1.unsigned.test. -*.wild TXT "this is a wildcard" +*.wild TXT "this is a wildcard" -@ MX 10 mail.signed.test. +@ MX 10 mail.signed.test. - A 10.0.0.10 -mail A 10.0.0.11 + A 10.0.0.10 +mail A 10.0.0.11 +mail AAAA fd00:dead:beef:cafe::11 ; https://github.com/systemd/systemd/issues/22002 -dupe A 10.0.0.12 -dupe A 10.0.0.13 +dupe A 10.0.0.12 +dupe A 10.0.0.13 +dupe-ipv6 AAAA fd00:dead:beef:cafe::12 +dupe-ipv6 AAAA fd00:dead:beef:cafe::13 +dupe-mixed A 10.0.0.15 +dupe-mixed A 10.0.0.16 +dupe-mixed A 10.0.0.17 +dupe-mixed AAAA fd00:dead:beef:cafe::15 +dupe-mixed AAAA fd00:dead:beef:cafe::16 +dupe-mixed AAAA fd00:dead:beef:cafe::17 ; CNAME_REDIRECTS_MAX is 16, so let's test something close to that cname-chain CNAME follow1.signed.test. diff --git a/test/knot-data/zones/test.zone b/test/knot-data/zones/test.zone index 6cc2633082..ba5fcebc2d 100644 --- a/test/knot-data/zones/test.zone +++ b/test/knot-data/zones/test.zone @@ -11,9 +11,11 @@ $ORIGIN test. ) ; NS info -@ NS ns1.unsigned -ns1.signed A 10.0.0.1 +@ NS ns1.unsigned +; NS glue records +ns1.unsigned A 10.0.0.1 +ns1.unsigned AAAA fd00:dead:beef:cafe::1 -onlinesign NS ns1.unsigned -signed NS ns1.unsigned -unsigned NS ns1.unsigned +onlinesign NS ns1.unsigned +signed NS ns1.unsigned +unsigned NS ns1.unsigned diff --git a/test/knot-data/zones/unsigned.test.zone b/test/knot-data/zones/unsigned.test.zone index 87d9437e2c..c5445d7672 100644 --- a/test/knot-data/zones/unsigned.test.zone +++ b/test/knot-data/zones/unsigned.test.zone @@ -11,10 +11,12 @@ $ORIGIN unsigned.test. ) ; NS info -@ NS ns1.unsigned.test. -ns1 A 10.0.0.1 +@ NS ns1 +ns1 A 10.0.0.1 +ns1 AAAA fd00:dead:beef:cafe::1 -@ MX 15 mail.unsigned.test. +@ MX 15 mail.unsigned.test. - A 10.0.0.101 -mail A 10.0.0.111 + A 10.0.0.101 + AAAA fd00:dead:beef:cafe::101 +mail A 10.0.0.111 diff --git a/test/knot-data/zones/untrusted.test.zone b/test/knot-data/zones/untrusted.test.zone index 6d29bd77fe..cf0dec5296 100644 --- a/test/knot-data/zones/untrusted.test.zone +++ b/test/knot-data/zones/untrusted.test.zone @@ -11,11 +11,12 @@ $ORIGIN untrusted.test. ) ; NS info -@ NS ns1.unsigned.test. +@ NS ns1.unsigned.test. -*.wild TXT "this is an untrusted wildcard" +*.wild TXT "this is an untrusted wildcard" -@ MX 10 mail.untrusted.test. +@ MX 10 mail.untrusted.test. - A 10.0.0.121 -mail A 10.0.0.121 + A 10.0.0.121 + AAAA fd00:dead:beef:cafe::121 +mail A 10.0.0.122 diff --git a/test/units/testsuite-75.sh b/test/units/testsuite-75.sh index 852caac605..76b8f5b3c7 100755 --- a/test/units/testsuite-75.sh +++ b/test/units/testsuite-75.sh @@ -2,6 +2,12 @@ # SPDX-License-Identifier: LGPL-2.1-or-later # vi: ts=4 sw=4 tw=0 et: +# TODO: +# - IPv6-only stack +# - mDNS +# - LLMNR +# - DoT/DoH + set -eux set -o pipefail @@ -16,6 +22,15 @@ run() { "$@" |& tee "$RUN_OUT" } +disable_ipv6() { + sysctl -w net.ipv6.conf.all.disable_ipv6=1 +} + +enable_ipv6() { + sysctl -w net.ipv6.conf.all.disable_ipv6=0 + networkctl reconfigure dns0 +} + monitor_check_rr() ( set +x set +o pipefail @@ -146,7 +161,10 @@ ip link del hoge.foo ### SETUP ### # Configure network hostnamectl hostname ns1.unsigned.test -echo "10.0.0.1 ns1.unsigned.test" >>/etc/hosts +{ + echo "10.0.0.1 ns1.unsigned.test" + echo "fd00:dead:beef:cafe::1 ns1.unsigned.test" +} >>/etc/hosts mkdir -p /etc/systemd/network cat >/etc/systemd/network/dns0.netdev < Date: Fri, 8 Jul 2022 18:12:47 +0200 Subject: [PATCH 2/5] test: add a couple of SRV records to check service resolution --- test/knot-data/zones/signed.test.zone | 8 ++++++++ test/knot-data/zones/untrusted.test.zone | 4 ++++ test/units/testsuite-75.sh | 17 +++++++++++++++++ 3 files changed, 29 insertions(+) diff --git a/test/knot-data/zones/signed.test.zone b/test/knot-data/zones/signed.test.zone index fa6706205a..6ddeb0048e 100644 --- a/test/knot-data/zones/signed.test.zone +++ b/test/knot-data/zones/signed.test.zone @@ -49,3 +49,11 @@ follow11.yet.so.far CNAME follow12.getting.hot.signed.test. follow12.getting.hot CNAME follow13.almost.final.signed.test. follow13.almost.final CNAME follow14.final.signed.test. follow14.final A 10.0.0.14 + +myservice A 10.0.0.20 +myservice AAAA fd00:dead:beef:cafe::17 +_mysvc._tcp SRV 10 5 1234 myservice + +_invalidsvc._udp SRV 5 5 1111 invalidservice + +_untrustedsvc._udp SRV 5 5 1111 myservice.untrusted.test. diff --git a/test/knot-data/zones/untrusted.test.zone b/test/knot-data/zones/untrusted.test.zone index cf0dec5296..a0dca62ca8 100644 --- a/test/knot-data/zones/untrusted.test.zone +++ b/test/knot-data/zones/untrusted.test.zone @@ -20,3 +20,7 @@ $ORIGIN untrusted.test. A 10.0.0.121 AAAA fd00:dead:beef:cafe::121 mail A 10.0.0.122 + +myservice A 10.0.0.123 + AAAA fd00:dead:beef:cafe::123 +_mysvc._tcp SRV 10 5 1234 myservice diff --git a/test/units/testsuite-75.sh b/test/units/testsuite-75.sh index 76b8f5b3c7..66cc6c9d66 100755 --- a/test/units/testsuite-75.sh +++ b/test/units/testsuite-75.sh @@ -367,6 +367,19 @@ grep -qF "status: NXDOMAIN" "$RUN_OUT" run resolvectl query -t TXT this.should.be.authenticated.wild.signed.test grep -qF 'this.should.be.authenticated.wild.signed.test IN TXT "this is a wildcard"' "$RUN_OUT" grep -qF "authenticated: yes" "$RUN_OUT" +# Check SRV support +run resolvectl service _mysvc._tcp signed.test +grep -qF "myservice.signed.test:1234" "$RUN_OUT" +grep -qF "10.0.0.20" "$RUN_OUT" +grep -qF "fd00:dead:beef:cafe::17" "$RUN_OUT" +grep -qF "authenticated: yes" "$RUN_OUT" +(! run resolvectl service _invalidsvc._udp signed.test) +grep -qE "invalidservice\.signed\.test' not found" "$RUN_OUT" +run resolvectl service _untrustedsvc._udp signed.test +grep -qF "myservice.untrusted.test:1111" "$RUN_OUT" +grep -qF "10.0.0.123" "$RUN_OUT" +grep -qF "fd00:dead:beef:cafe::123" "$RUN_OUT" +grep -qF "authenticated: yes" "$RUN_OUT" # DNSSEC validation with multiple records of the same type for the same name # Issue: https://github.com/systemd/systemd/issues/22002 @@ -479,6 +492,10 @@ grep -qF "untrusted.test:" "$RUN_OUT" grep -qF "10.0.0.121" "$RUN_OUT" grep -qF "fd00:dead:beef:cafe::121" "$RUN_OUT" grep -qF "authenticated: no" "$RUN_OUT" +run resolvectl service _mysvc._tcp untrusted.test +grep -qF "myservice.untrusted.test:1234" "$RUN_OUT" +grep -qF "10.0.0.123" "$RUN_OUT" +grep -qF "fd00:dead:beef:cafe::123" "$RUN_OUT" # Issue: https://github.com/systemd/systemd/issues/19472 # 1) Query for a non-existing RR should return NOERROR + NSEC (?), not NXDOMAIN From 05bb428952d0a91c53398e8b20801af9fb7530f1 Mon Sep 17 00:00:00 2001 From: Frantisek Sumsal Date: Fri, 8 Jul 2022 20:23:13 +0200 Subject: [PATCH 3/5] test: add a test for the OPENPGPKEY RR --- test/knot-data/zones/signed.test.zone | 14 ++++++++++++++ test/units/testsuite-75.sh | 6 ++++++ 2 files changed, 20 insertions(+) diff --git a/test/knot-data/zones/signed.test.zone b/test/knot-data/zones/signed.test.zone index 6ddeb0048e..a2baac4284 100644 --- a/test/knot-data/zones/signed.test.zone +++ b/test/knot-data/zones/signed.test.zone @@ -57,3 +57,17 @@ _mysvc._tcp SRV 10 5 1234 myservice _invalidsvc._udp SRV 5 5 1111 invalidservice _untrustedsvc._udp SRV 5 5 1111 myservice.untrusted.test. + +; OPENPGPKEY RR for mr.smith@signed.test +; The hash was generated using `echo -ne mr.smith | sha256sum | head -c56` +; and exported via `gpg --export mr.smith | base64` +5a786cdc59c161cdafd818143705026636962198c66ed4c5b3da321e._openpgpkey OPENPGPKEY ( + mDMEYshhzhYJKwYBBAHaRw8BAQdAuU2RxKaycSdaR5YZ/q+/yoHeil/1WNRDVbpjPSd6QBa0GW1y + LnNtaXRoQHNpZ25lZC50ZXN0LnpvbmWImQQTFggAQRYhBIOXLJwlwowvXQVeJ3d9yvMKUDBWBQJi + yGHOAhsDBQkDwmcABQsJCAcCAiICBhUKCQgLAgQWAgMBAh4HAheAAAoJEHd9yvMKUDBWo6MA/2oC + zdnzMlK9gM5bNCFfPyagJfFfv7fW1l7WXTve6FJtAP0faW24ahE1okjmrsTUwqZHvDThysW5zTSt + j49S3JQDA7g4BGLIYc4SCisGAQQBl1UBBQEBB0CuNcTAt5AUE3seFN/Gm2euC+8dgtztyzoO/78K + ictFLAMBCAeIeAQYFggAIBYhBIOXLJwlwowvXQVeJ3d9yvMKUDBWBQJiyGHOAhsMAAoJEHd9yvMK + UDBWtxkA/jlbUgHpSoTKFNNTeXYbTz9jnoupe9eT4O3tU55ofwO7AQCa5ntSIuzDJ1E2iy7oOLOZ + m2ocNqpC7SULHhSKYfUWDg== +) diff --git a/test/units/testsuite-75.sh b/test/units/testsuite-75.sh index 66cc6c9d66..d36cab2923 100755 --- a/test/units/testsuite-75.sh +++ b/test/units/testsuite-75.sh @@ -380,6 +380,12 @@ grep -qF "myservice.untrusted.test:1111" "$RUN_OUT" grep -qF "10.0.0.123" "$RUN_OUT" grep -qF "fd00:dead:beef:cafe::123" "$RUN_OUT" grep -qF "authenticated: yes" "$RUN_OUT" +# Check OPENPGPKEY support +run delv -t OPENPGPKEY 5a786cdc59c161cdafd818143705026636962198c66ed4c5b3da321e._openpgpkey.signed.test +grep -qF "; fully validated" "$RUN_OUT" +run resolvectl openpgp mr.smith@signed.test +grep -qF "5a786cdc59c161cdafd818143705026636962198c66ed4c5b3da321e._openpgpkey.signed.test" "$RUN_OUT" +grep -qF "authenticated: yes" "$RUN_OUT" # DNSSEC validation with multiple records of the same type for the same name # Issue: https://github.com/systemd/systemd/issues/22002 From 270e9dcdb8c7f0f3c8b56803d0ef7bbf867b9fd1 Mon Sep 17 00:00:00 2001 From: Frantisek Sumsal Date: Fri, 27 Jan 2023 14:29:42 +0100 Subject: [PATCH 4/5] test: don't hang indefinitely on no match --- test/units/testsuite-75.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/test/units/testsuite-75.sh b/test/units/testsuite-75.sh index d36cab2923..ddd86d09bb 100755 --- a/test/units/testsuite-75.sh +++ b/test/units/testsuite-75.sh @@ -41,7 +41,7 @@ monitor_check_rr() ( # displayed. We turn off pipefail for this, since we don't care about the # lhs of this pipe expression, we only care about the rhs' result to be # clean - journalctl -u resmontest.service --since "$since" -f --full | grep -m1 "$match" + timeout -v 30s journalctl -u resmontest.service --since "$since" -f --full | grep -m1 "$match" ) # Test for resolvectl, resolvconf From 42262f3e1b43eb3833adf71a3a030122b8f112b3 Mon Sep 17 00:00:00 2001 From: Frantisek Sumsal Date: Fri, 27 Jan 2023 15:34:36 +0100 Subject: [PATCH 5/5] test: wrap delv & dig when running with sanitizers On Arch both delv and dig pull in libnss_resolve: ``` $ grep resolve /etc/nsswitch.conf hosts: mymachines resolve [!UNAVAIL=return] files myhostname dns ``` --- test/test-functions | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/test/test-functions b/test/test-functions index ee44932a59..c4c192885e 100644 --- a/test/test-functions +++ b/test/test-functions @@ -2641,8 +2641,9 @@ inst_binary() { # chown, getent, login, su, useradd, userdel - dlopen()s (not only) systemd's PAM modules # ls, stat - pulls in nss_systemd with certain options (like ls -l) when # nsswitch.conf uses [SUCCESS=merge] (like on Arch Linux) + # delv, dig - pulls in nss_resolve if `resolve` is in nsswitch.conf # tar - called by machinectl in TEST-25 - if get_bool "$IS_BUILT_WITH_ASAN" && [[ "$bin" =~ /(chown|getent|login|ls|stat|su|tar|useradd|userdel)$ ]]; then + if get_bool "$IS_BUILT_WITH_ASAN" && [[ "$bin" =~ /(chown|delv|dig|getent|login|ls|stat|su|tar|useradd|userdel)$ ]]; then wrap_binary=1 fi