shaba/systemd-stable
1
1
Fork 0
mirror of https://github.com/systemd/systemd-stable.git synced 2025-01-11 05:17:44 +03:00
Code

networkd-test: reenable dnssec while testing

Browse Source 
We need to list the synthesized domains as NTAs, otherwise the DNSSEC
validation of course cannot succeed.

Fixes: #10487 #5029
This commit is contained in:
Lennart Poettering 2020-11-16 21:06:56 +01:00 committed by Luca Boccassi
parent 2a5095af0c
commit 489344f24b
1 changed files with 17 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
test/networkd-test.py
View File

@ -609,11 +609,11 @@ class DnsmasqClientTest(ClientTestBase, unittest.TestCase):
def test_resolved_domain_restricted_dns(self): def test_resolved_domain_restricted_dns(self):
'''resolved: domain-restricted DNS servers''' '''resolved: domain-restricted DNS servers'''
# FIXME: resolvectl query fails with enabled DNSSEC against our dnsmasq # enable DNSSEC in allow downgrade mode, and turn off stuff we don't want to test to make looking at logs easier
conf = '/run/systemd/resolved.conf.d/test-disable-dnssec.conf' conf = '/run/systemd/resolved.conf.d/test-enable-dnssec.conf'
os.makedirs(os.path.dirname(conf), exist_ok=True) os.makedirs(os.path.dirname(conf), exist_ok=True)
with open(conf, 'w') as f: with open(conf, 'w') as f:
f.write('[Resolve]\nDNSSEC=no\n') f.write('[Resolve]\nDNSSEC=allow-downgrade\nLLMNR=no\nMulticastDNS=no\nDNSOverTLS=no\n')
self.addCleanup(os.remove, conf) self.addCleanup(os.remove, conf)
# create interface for generic connections; this will map all DNS names # create interface for generic connections; this will map all DNS names
@ -625,6 +625,7 @@ Name={}
[Network] [Network]
DHCP=ipv4 DHCP=ipv4
IPv6AcceptRA=False IPv6AcceptRA=False
DNSSECNegativeTrustAnchors=megasearch.net
'''.format(self.iface)) '''.format(self.iface))
# create second device/dnsmasq for a .company/.lab VPN interface # create second device/dnsmasq for a .company/.lab VPN interface
@ -651,7 +652,8 @@ Name=testvpnclient
IPv6AcceptRA=False IPv6AcceptRA=False
Address=10.241.3.2/24 Address=10.241.3.2/24
DNS=10.241.3.1 DNS=10.241.3.1
Domains= ~company ~lab Domains=~company ~lab
DNSSECNegativeTrustAnchors=company lab
''') ''')
self.start_unit('systemd-networkd') self.start_unit('systemd-networkd')
@ -690,21 +692,27 @@ Domains= ~company ~lab
def test_resolved_etc_hosts(self): def test_resolved_etc_hosts(self):
'''resolved queries to /etc/hosts''' '''resolved queries to /etc/hosts'''
# FIXME: -t MX query fails with enabled DNSSEC (even when using # enabled DNSSEC in allow-downgrade mode
# the known negative trust anchor .internal instead of .example.com) conf = '/run/systemd/resolved.conf.d/test-enable-dnssec.conf'
conf = '/run/systemd/resolved.conf.d/test-disable-dnssec.conf'
os.makedirs(os.path.dirname(conf), exist_ok=True) os.makedirs(os.path.dirname(conf), exist_ok=True)
with open(conf, 'w') as f: with open(conf, 'w') as f:
f.write('[Resolve]\nDNSSEC=no\nLLMNR=no\nMulticastDNS=no\n') f.write('[Resolve]\nDNSSEC=allow-downgrade\nLLMNR=no\nMulticastDNS=no\nDNSOverTLS=no\n')
self.addCleanup(os.remove, conf) self.addCleanup(os.remove, conf)
# Add example.com to NTA list for this test
negative = '/run/dnssec-trust-anchors.d/example.com.negative'
os.makedirs(os.path.dirname(negative), exist_ok=True)
with open(negative, 'w') as f:
f.write('example.com\n16.172.in-addr.arpa\n')
self.addCleanup(os.remove, negative)
# create /etc/hosts bind mount which resolves my.example.com for IPv4 # create /etc/hosts bind mount which resolves my.example.com for IPv4
hosts = os.path.join(self.workdir, 'hosts') hosts = os.path.join(self.workdir, 'hosts')
with open(hosts, 'w') as f: with open(hosts, 'w') as f:
f.write('172.16.99.99 my.example.com\n') f.write('172.16.99.99 my.example.com\n')
subprocess.check_call(['mount', '--bind', hosts, '/etc/hosts']) subprocess.check_call(['mount', '--bind', hosts, '/etc/hosts'])
self.addCleanup(subprocess.call, ['umount', '/etc/hosts']) self.addCleanup(subprocess.call, ['umount', '/etc/hosts'])
subprocess.check_call(['systemctl', 'stop', 'systemd-resolved.service']) subprocess.check_call(['systemctl', 'restart', 'systemd-resolved.service'])
# note: different IPv4 address here, so that it's easy to tell apart # note: different IPv4 address here, so that it's easy to tell apart
# what resolved the query # what resolved the query