Skip to content

Commit c05a62c

Browse files
felbingerfelbinger
committed
tests/dns-knot*: init
1 parent 3c71f7b commit c05a62c

6 files changed

Lines changed: 631 additions & 0 deletions

File tree

‎tests/dns-knot-dnssec/default.nix‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
{ lib, pkgs, ... }:
2+
{
3+
name = "dns-knot-dnssec";
4+
5+
nodes = {
6+
machine = {
7+
networking.useDHCP = false;
8+
services.knot = {
9+
enable = true;
10+
settings = {
11+
server.listen = [ "127.0.0.1@53" ];
12+
policy = [
13+
{
14+
id = "custom";
15+
signing-threads = "4";
16+
algorithm = "ECDSAP256SHA256";
17+
zsk-lifetime = "60d";
18+
}
19+
];
20+
zone = [
21+
{
22+
domain = "example.com";
23+
file = pkgs.writeText "example.com" ''
24+
example.com. IN SOA a.example.com hostmaster.example.com. (2025031200 86400 600 864000 60)
25+
example.com. IN NS a.example.com.
26+
example.com. IN A 198.51.100.10
27+
'';
28+
dnssec-signing = "on";
29+
dnssec-policy = "custom";
30+
}
31+
];
32+
};
33+
};
34+
};
35+
};
36+
37+
testScript = ''
38+
start_all()
39+
40+
machine.wait_for_unit("network.target")
41+
machine.wait_for_unit("knot.service")
42+
43+
machine.succeed("${lib.getExe pkgs.dig} +short @127.0.0.1 A example.com | grep 198.51.100.10")
44+
45+
machine.succeed("${lib.getExe pkgs.dig} +dnssec @127.0.0.1 example.com RRSIG | grep RRSIG")
46+
machine.succeed("${lib.getExe pkgs.dig} +dnssec @127.0.0.1 example.com DNSKEY | grep DNSKEY")
47+
'';
48+
}

‎tests/dns-knot-xfr-dnssec/default.nix‎

Lines changed: 132 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,132 @@
1+
{ lib, pkgs, ... }:
2+
{
3+
name = "dns-knot-xfr-dnssec";
4+
5+
defaults = {
6+
services.knot = {
7+
enable = true;
8+
settings.server.listen = [ "0.0.0.0@53" ];
9+
};
10+
networking = {
11+
useDHCP = false;
12+
firewall = {
13+
allowedUDPPorts = [ 53 ];
14+
allowedTCPPorts = [ 53 ];
15+
};
16+
};
17+
};
18+
19+
nodes = {
20+
a = {
21+
networking.interfaces.eth1 = {
22+
ipv4.addresses = [
23+
{
24+
address = "192.0.2.10";
25+
prefixLength = 31;
26+
}
27+
];
28+
ipv6.addresses = [
29+
{
30+
address = "2001:db8::";
31+
prefixLength = 64;
32+
}
33+
];
34+
};
35+
services.knot = {
36+
settings = {
37+
server.automatic-acl = "on";
38+
39+
remote = [
40+
{
41+
id = "secondary";
42+
address = [
43+
"192.0.2.11"
44+
];
45+
}
46+
];
47+
48+
policy = [
49+
{
50+
id = "custom";
51+
signing-threads = "4";
52+
algorithm = "ECDSAP256SHA256";
53+
zsk-lifetime = "60d";
54+
}
55+
];
56+
57+
zone = [
58+
{
59+
domain = "example.com";
60+
notify = "secondary";
61+
file = pkgs.writeText "example.com" ''
62+
example.com. IN SOA a.example.com hostmaster.example.com. (2025031200 86400 600 864000 60)
63+
example.com. IN NS a.example.com.
64+
example.com. IN NS b.example.com.
65+
example.com. IN A 198.51.100.10
66+
'';
67+
dnssec-signing = "on";
68+
dnssec-policy = "custom";
69+
}
70+
];
71+
};
72+
};
73+
};
74+
b = {
75+
networking.interfaces.eth1 = {
76+
ipv4.addresses = [
77+
{
78+
address = "192.0.2.11";
79+
prefixLength = 31;
80+
}
81+
];
82+
ipv6.addresses = [
83+
{
84+
address = "2001:db8::1";
85+
prefixLength = 64;
86+
}
87+
];
88+
};
89+
services.knot = {
90+
settings = {
91+
server.automatic-acl = "on";
92+
93+
remote = [
94+
{
95+
id = "primary";
96+
address = [
97+
"192.0.2.10"
98+
];
99+
}
100+
];
101+
102+
zone = [
103+
{
104+
domain = "example.com";
105+
master = "primary";
106+
dnssec-signing = "on";
107+
}
108+
];
109+
};
110+
};
111+
};
112+
};
113+
114+
testScript = ''
115+
start_all()
116+
117+
for m in [a, b]:
118+
m.wait_for_unit("network.target")
119+
m.wait_for_unit("knot.service")
120+
121+
for m in [a, b]:
122+
m.wait_until_succeeds("${lib.getExe pkgs.dig} +short @127.0.0.1 A example.com | grep 198.51.100.10")
123+
124+
with subtest("ensure zone is signed on primary"):
125+
a.wait_until_succeeds("${lib.getExe pkgs.dig} +dnssec @127.0.0.1 example.com RRSIG | grep RRSIG")
126+
a.wait_until_succeeds("${lib.getExe pkgs.dig} +dnssec @127.0.0.1 example.com DNSKEY | grep DNSKEY")
127+
128+
with subtest("ensure zone is signed on secondary"):
129+
b.wait_until_succeeds("${lib.getExe pkgs.dig} +dnssec @127.0.0.1 example.com RRSIG | grep RRSIG")
130+
b.wait_until_succeeds("${lib.getExe pkgs.dig} +dnssec @127.0.0.1 example.com DNSKEY | grep DNSKEY")
131+
'';
132+
}

‎tests/dns-knot-xfr-tsig-explicit-notify/default.nix‎

Lines changed: 162 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,162 @@
1+
{ lib, pkgs, ... }:
2+
{
3+
name = "dns-knot-xfr-tsig-explicit-notify";
4+
5+
defaults = {
6+
services.knot = {
7+
enable = true;
8+
settings.server.listen = [ "0.0.0.0@53" ];
9+
};
10+
networking = {
11+
useDHCP = false;
12+
firewall = {
13+
allowedUDPPorts = [ 53 ];
14+
allowedTCPPorts = [ 53 ];
15+
};
16+
};
17+
};
18+
19+
nodes = {
20+
a = {
21+
networking.interfaces.eth1 = {
22+
ipv4.addresses = [
23+
{
24+
address = "192.0.2.10";
25+
prefixLength = 31;
26+
}
27+
];
28+
ipv6.addresses = [
29+
{
30+
address = "2001:db8::";
31+
prefixLength = 64;
32+
}
33+
];
34+
};
35+
services.knot = {
36+
settings = {
37+
key = [
38+
{
39+
id = "notify_key";
40+
algorithm = "hmac-sha256";
41+
secret = "bm90aWZ5LWludmFsaWQK";
42+
}
43+
{
44+
id = "xfr_key";
45+
algorithm = "hmac-sha256";
46+
secret = "eGZyLWludmFsaWQK";
47+
}
48+
];
49+
50+
remote = [
51+
{
52+
id = "secondary";
53+
address = [
54+
"192.0.2.11"
55+
];
56+
key = "xfr_key";
57+
}
58+
];
59+
60+
acl = [
61+
{
62+
id = "xfr_to_secondary";
63+
key = "xfr_key";
64+
action = "transfer";
65+
}
66+
{
67+
id = "notify_to_secondary";
68+
key = "notify_key";
69+
action = "notify";
70+
}
71+
];
72+
73+
zone = [
74+
{
75+
domain = "example.com";
76+
notify = "secondary";
77+
acl = [
78+
"xfr_to_secondary"
79+
"notify_to_secondary"
80+
];
81+
file = pkgs.writeText "example.com" ''
82+
example.com. IN SOA a.example.com hostmaster.example.com. (2025031200 86400 600 864000 60)
83+
example.com. IN NS a.example.com.
84+
example.com. IN NS b.example.com.
85+
example.com. IN A 198.51.100.10
86+
'';
87+
}
88+
];
89+
};
90+
};
91+
};
92+
b = {
93+
networking.interfaces.eth1 = {
94+
ipv4.addresses = [
95+
{
96+
address = "192.0.2.11";
97+
prefixLength = 31;
98+
}
99+
];
100+
ipv6.addresses = [
101+
{
102+
address = "2001:db8::1";
103+
prefixLength = 64;
104+
}
105+
];
106+
};
107+
services.knot = {
108+
settings = {
109+
key = [
110+
{
111+
id = "notify_key";
112+
algorithm = "hmac-sha256";
113+
secret = "bm90aWZ5LWludmFsaWQK";
114+
}
115+
{
116+
id = "xfr_key";
117+
algorithm = "hmac-sha256";
118+
secret = "eGZyLWludmFsaWQK";
119+
}
120+
];
121+
122+
remote = [
123+
{
124+
id = "primary";
125+
address = [
126+
"192.0.2.10"
127+
];
128+
key = "xfr_key";
129+
}
130+
];
131+
132+
acl = [
133+
{
134+
id = "notify_from_primary";
135+
key = "notify_key";
136+
action = "notify";
137+
}
138+
];
139+
140+
zone = [
141+
{
142+
domain = "example.com";
143+
master = "primary";
144+
acl = "notify_from_primary";
145+
}
146+
];
147+
};
148+
};
149+
};
150+
};
151+
152+
testScript = ''
153+
start_all()
154+
155+
for m in [a, b]:
156+
m.wait_for_unit("network.target")
157+
m.wait_for_unit("knot.service")
158+
159+
for m in [a, b]:
160+
m.wait_until_succeeds("${lib.getExe pkgs.dig} +short @127.0.0.1 A example.com | grep 198.51.100.10")
161+
'';
162+
}

0 commit comments

Comments
 (0)