Mirrors/coredns
1
0
Fork 0
mirror of https://github.com/coredns/coredns.git synced 2025-10-30 01:34:21 -04:00
Code Issues Packages Projects Releases Wiki Activity
Files
8c9b9edac10955c67eb0a3927cdf098c92d7e457
coredns/plugin/file/dname_test.go

301 lines
9.9 KiB
Go
Raw Normal View History

middleware/file: add DNAME support (#651) * Test DNAME handling If the DNAME itself matches the QTYPE, and the owner name matches QNAME, the relevant DNAME RR should be included in the answer section. Other parts of RFC 6672 are not implemented yet and hence left untested. * Implement the DNAME substitution As specified in RFC 6672, a DNAME substitution is performed by replacing the suffix labels of the name being sought matching the owner name of the DNAME resource record with the string of labels in the RDATA field. The matching labels end with the root label in all cases. Only whole labels are replaced. * Handle DNAME redirection A CNAME RR is created on-the-fly for the DNAME redirection. Be aware that we do not have all the edge cases covered yet. * Test DNAME owner name matching the QNAME A DNAME RR redirects DNS names subordinate to its owner name; the owner name of a DNAME is NOT redirected itself. * Ignore names next to and below a DNAME record According to RFC 6672, resource records MUST NOT exist at any subdomain of the owner of a DNAME RR. When loading a zone, those names below the DNAME RR will be quietly ignored. * Streamline DNAME processing Instead of checking DNAMEs during lookup, we use a preloaded list of DNAME RRs to streamline the process without any runtime performance penalty: * When loading the zone, keep a record of any DNAME RRs. * If there aren't any DNAMEs in the zone, just do the lookup as usual. * Only when the zone has one or more DNAME records, we look for the matching DNAME and ignore confronting subdomain(s) in the process. * Make it easier to trace back through test errors * Make DNAME handling part of lookup routine DNAME processing is invoked only if the zone has at least one DNAME RR. * Put DNAME resolution inside the searching of a hit We can drop some of the other ideas; we don't need to track if we have DNAMEs in the zone it just follows naturally from the current lookup code. See also: #664
2017-05-26 17:37:06 +08:00
package file
Default to upstream to self (#2436) * Default to upstream to self This is a backwards incompatible change. This is a massive (cleanup) PR where we default to resolving external names by the coredns process itself, instead of directly forwarding them to some upstream. This ignores any arguments `upstream` may have had and makes it depend on proxy/forward configuration in the Corefile. This allows resolved upstream names to be cached and we have better healthchecking of the upstreams. It also means there is only one way to resolve names, by either using the proxy or forward plugin. The proxy/forward lookup.go functions have been removed. This also lessen the dependency on proxy, meaning deprecating proxy will become easier. Some tests have been removed as well, or moved to the top-level test directory as they now require a full coredns process instead of just the plugin. For the etcd plugin, the entire StubZone resolving is *dropped*! This was a hacky (but working) solution to say the least. If someone cares deeply it can be brought back (maybe)? The pkg/upstream is now very small and almost does nothing. Also the New() function was changed to return a pointer to upstream.Upstream. It also returns only one parameter, so any stragglers using it will encounter a compile error. All documentation has been adapted. This affected the following plugins: * etcd * file * auto * secondary * federation * template * route53 A followup PR will make any upstream directives with arguments an error, right now they are ignored. Signed-off-by: Miek Gieben <miek@miek.nl> * Fix etcd build - probably still fails unit test Signed-off-by: Miek Gieben <miek@miek.nl> * Slightly smarter lookup check in upstream Signed-off-by: Miek Gieben <miek@miek.nl> * Compilez Signed-off-by: Miek Gieben <miek@miek.nl>
2019-01-13 16:54:49 +00:00
/*
TODO(miek): move to test/ for full server testing
middleware/file: add DNAME support (#651) * Test DNAME handling If the DNAME itself matches the QTYPE, and the owner name matches QNAME, the relevant DNAME RR should be included in the answer section. Other parts of RFC 6672 are not implemented yet and hence left untested. * Implement the DNAME substitution As specified in RFC 6672, a DNAME substitution is performed by replacing the suffix labels of the name being sought matching the owner name of the DNAME resource record with the string of labels in the RDATA field. The matching labels end with the root label in all cases. Only whole labels are replaced. * Handle DNAME redirection A CNAME RR is created on-the-fly for the DNAME redirection. Be aware that we do not have all the edge cases covered yet. * Test DNAME owner name matching the QNAME A DNAME RR redirects DNS names subordinate to its owner name; the owner name of a DNAME is NOT redirected itself. * Ignore names next to and below a DNAME record According to RFC 6672, resource records MUST NOT exist at any subdomain of the owner of a DNAME RR. When loading a zone, those names below the DNAME RR will be quietly ignored. * Streamline DNAME processing Instead of checking DNAMEs during lookup, we use a preloaded list of DNAME RRs to streamline the process without any runtime performance penalty: * When loading the zone, keep a record of any DNAME RRs. * If there aren't any DNAMEs in the zone, just do the lookup as usual. * Only when the zone has one or more DNAME records, we look for the matching DNAME and ignore confronting subdomain(s) in the process. * Make it easier to trace back through test errors * Make DNAME handling part of lookup routine DNAME processing is invoked only if the zone has at least one DNAME RR. * Put DNAME resolution inside the searching of a hit We can drop some of the other ideas; we don't need to track if we have DNAMEs in the zone it just follows naturally from the current lookup code. See also: #664
2017-05-26 17:37:06 +08:00
import (
all: fix plugin import ordering (#1717) Got a bit messed up with stb lib "context" usage.
2018-04-22 08:34:35 +01:00
"context"
middleware/file: add DNAME support (#651) * Test DNAME handling If the DNAME itself matches the QTYPE, and the owner name matches QNAME, the relevant DNAME RR should be included in the answer section. Other parts of RFC 6672 are not implemented yet and hence left untested. * Implement the DNAME substitution As specified in RFC 6672, a DNAME substitution is performed by replacing the suffix labels of the name being sought matching the owner name of the DNAME resource record with the string of labels in the RDATA field. The matching labels end with the root label in all cases. Only whole labels are replaced. * Handle DNAME redirection A CNAME RR is created on-the-fly for the DNAME redirection. Be aware that we do not have all the edge cases covered yet. * Test DNAME owner name matching the QNAME A DNAME RR redirects DNS names subordinate to its owner name; the owner name of a DNAME is NOT redirected itself. * Ignore names next to and below a DNAME record According to RFC 6672, resource records MUST NOT exist at any subdomain of the owner of a DNAME RR. When loading a zone, those names below the DNAME RR will be quietly ignored. * Streamline DNAME processing Instead of checking DNAMEs during lookup, we use a preloaded list of DNAME RRs to streamline the process without any runtime performance penalty: * When loading the zone, keep a record of any DNAME RRs. * If there aren't any DNAMEs in the zone, just do the lookup as usual. * Only when the zone has one or more DNAME records, we look for the matching DNAME and ignore confronting subdomain(s) in the process. * Make it easier to trace back through test errors * Make DNAME handling part of lookup routine DNAME processing is invoked only if the zone has at least one DNAME RR. * Put DNAME resolution inside the searching of a hit We can drop some of the other ideas; we don't need to track if we have DNAMEs in the zone it just follows naturally from the current lookup code. See also: #664
2017-05-26 17:37:06 +08:00
"strings"
"testing"
pkg: add dnstest (#1098) Add a full test server impl in this new package + tests. Move dnsrecorder into this package as well and finish up the commented out tests that were left in the old dnsrecorder package. Update all callers and tests.
2017-09-21 15:15:47 +01:00
"github.com/coredns/coredns/plugin/pkg/dnstest"
Remove the word middleware (#1067) * Rename middleware to plugin first pass; mostly used 'sed', few spots where I manually changed text. This still builds a coredns binary. * fmt error * Rename AddMiddleware to AddPlugin * Readd AddMiddleware to remain backwards compat
2017-09-14 09:36:06 +01:00
"github.com/coredns/coredns/plugin/test"
middleware/file: add DNAME support (#651) * Test DNAME handling If the DNAME itself matches the QTYPE, and the owner name matches QNAME, the relevant DNAME RR should be included in the answer section. Other parts of RFC 6672 are not implemented yet and hence left untested. * Implement the DNAME substitution As specified in RFC 6672, a DNAME substitution is performed by replacing the suffix labels of the name being sought matching the owner name of the DNAME resource record with the string of labels in the RDATA field. The matching labels end with the root label in all cases. Only whole labels are replaced. * Handle DNAME redirection A CNAME RR is created on-the-fly for the DNAME redirection. Be aware that we do not have all the edge cases covered yet. * Test DNAME owner name matching the QNAME A DNAME RR redirects DNS names subordinate to its owner name; the owner name of a DNAME is NOT redirected itself. * Ignore names next to and below a DNAME record According to RFC 6672, resource records MUST NOT exist at any subdomain of the owner of a DNAME RR. When loading a zone, those names below the DNAME RR will be quietly ignored. * Streamline DNAME processing Instead of checking DNAMEs during lookup, we use a preloaded list of DNAME RRs to streamline the process without any runtime performance penalty: * When loading the zone, keep a record of any DNAME RRs. * If there aren't any DNAMEs in the zone, just do the lookup as usual. * Only when the zone has one or more DNAME records, we look for the matching DNAME and ignore confronting subdomain(s) in the process. * Make it easier to trace back through test errors * Make DNAME handling part of lookup routine DNAME processing is invoked only if the zone has at least one DNAME RR. * Put DNAME resolution inside the searching of a hit We can drop some of the other ideas; we don't need to track if we have DNAMEs in the zone it just follows naturally from the current lookup code. See also: #664
2017-05-26 17:37:06 +08:00
"github.com/miekg/dns"
)
// RFC 6672, Section 2.2. Assuming QTYPE != DNAME.
var dnameSubstitutionTestCases = []struct {
qname string
owner string
target string
expected string
}{
{"com.", "example.com.", "example.net.", ""},
{"example.com.", "example.com.", "example.net.", ""},
{"a.example.com.", "example.com.", "example.net.", "a.example.net."},
{"a.b.example.com.", "example.com.", "example.net.", "a.b.example.net."},
{"ab.example.com.", "b.example.com.", "example.net.", ""},
{"foo.example.com.", "example.com.", "example.net.", "foo.example.net."},
{"a.x.example.com.", "x.example.com.", "example.net.", "a.example.net."},
{"a.example.com.", "example.com.", "y.example.net.", "a.y.example.net."},
{"cyc.example.com.", "example.com.", "example.com.", "cyc.example.com."},
{"cyc.example.com.", "example.com.", "c.example.com.", "cyc.c.example.com."},
{"shortloop.x.x.", "x.", ".", "shortloop.x."},
{"shortloop.x.", "x.", ".", "shortloop."},
}
func TestDNAMESubstitution(t *testing.T) {
for i, tc := range dnameSubstitutionTestCases {
result := substituteDNAME(tc.qname, tc.owner, tc.target)
if result != tc.expected {
if result == "" {
result = "<no match>"
}
t.Errorf("Case %d: Expected %s -> %s, got %v", i, tc.qname, tc.expected, result)
return
}
}
}
var dnameTestCases = []test.Case{
{
Qname: "dname.miek.nl.", Qtype: dns.TypeDNAME,
Answer: []dns.RR{
test.DNAME("dname.miek.nl. 1800 IN DNAME test.miek.nl."),
},
Ns: miekAuth,
},
{
Qname: "dname.miek.nl.", Qtype: dns.TypeA,
Answer: []dns.RR{
test.A("dname.miek.nl. 1800 IN A 127.0.0.1"),
},
Ns: miekAuth,
},
{
Qname: "dname.miek.nl.", Qtype: dns.TypeMX,
Answer: []dns.RR{},
Ns: []dns.RR{
test.SOA("miek.nl. 1800 IN SOA linode.atoom.net. miek.miek.nl. 1282630057 14400 3600 604800 14400"),
},
},
{
Qname: "a.dname.miek.nl.", Qtype: dns.TypeA,
Answer: []dns.RR{
test.CNAME("a.dname.miek.nl. 1800 IN CNAME a.test.miek.nl."),
test.A("a.test.miek.nl. 1800 IN A 139.162.196.78"),
test.DNAME("dname.miek.nl. 1800 IN DNAME test.miek.nl."),
},
Ns: miekAuth,
},
{
Qname: "www.dname.miek.nl.", Qtype: dns.TypeA,
Answer: []dns.RR{
test.A("a.test.miek.nl. 1800 IN A 139.162.196.78"),
test.DNAME("dname.miek.nl. 1800 IN DNAME test.miek.nl."),
test.CNAME("www.dname.miek.nl. 1800 IN CNAME www.test.miek.nl."),
test.CNAME("www.test.miek.nl. 1800 IN CNAME a.test.miek.nl."),
},
Ns: miekAuth,
},
}
func TestLookupDNAME(t *testing.T) {
middleware/file: don't reload zone when SOA isn't changed (#707) * middleware/file: don't reload zone when SOA isn't changed Give Parse an extra argument which is the SOA's serial, if > 0 we check against the just parsed SOA and then just return. Most notable use is in reload.go which is both used in the file and auto middleware. Fixes #415 * PR comments
2017-06-08 18:43:11 +01:00
zone, err := Parse(strings.NewReader(dbMiekNLDNAME), testzone, "stdin", 0)
middleware/file: add DNAME support (#651) * Test DNAME handling If the DNAME itself matches the QTYPE, and the owner name matches QNAME, the relevant DNAME RR should be included in the answer section. Other parts of RFC 6672 are not implemented yet and hence left untested. * Implement the DNAME substitution As specified in RFC 6672, a DNAME substitution is performed by replacing the suffix labels of the name being sought matching the owner name of the DNAME resource record with the string of labels in the RDATA field. The matching labels end with the root label in all cases. Only whole labels are replaced. * Handle DNAME redirection A CNAME RR is created on-the-fly for the DNAME redirection. Be aware that we do not have all the edge cases covered yet. * Test DNAME owner name matching the QNAME A DNAME RR redirects DNS names subordinate to its owner name; the owner name of a DNAME is NOT redirected itself. * Ignore names next to and below a DNAME record According to RFC 6672, resource records MUST NOT exist at any subdomain of the owner of a DNAME RR. When loading a zone, those names below the DNAME RR will be quietly ignored. * Streamline DNAME processing Instead of checking DNAMEs during lookup, we use a preloaded list of DNAME RRs to streamline the process without any runtime performance penalty: * When loading the zone, keep a record of any DNAME RRs. * If there aren't any DNAMEs in the zone, just do the lookup as usual. * Only when the zone has one or more DNAME records, we look for the matching DNAME and ignore confronting subdomain(s) in the process. * Make it easier to trace back through test errors * Make DNAME handling part of lookup routine DNAME processing is invoked only if the zone has at least one DNAME RR. * Put DNAME resolution inside the searching of a hit We can drop some of the other ideas; we don't need to track if we have DNAMEs in the zone it just follows naturally from the current lookup code. See also: #664
2017-05-26 17:37:06 +08:00
if err != nil {
t.Fatalf("Expect no error when reading zone, got %q", err)
}
fm := File{Next: test.ErrorHandler(), Zones: Zones{Z: map[string]*Zone{testzone: zone}, Names: []string{testzone}}}
ctx := context.TODO()
for _, tc := range dnameTestCases {
m := tc.Msg()
pkg: add dnstest (#1098) Add a full test server impl in this new package + tests. Move dnsrecorder into this package as well and finish up the commented out tests that were left in the old dnsrecorder package. Update all callers and tests.
2017-09-21 15:15:47 +01:00
rec := dnstest.NewRecorder(&test.ResponseWriter{})
middleware/file: add DNAME support (#651) * Test DNAME handling If the DNAME itself matches the QTYPE, and the owner name matches QNAME, the relevant DNAME RR should be included in the answer section. Other parts of RFC 6672 are not implemented yet and hence left untested. * Implement the DNAME substitution As specified in RFC 6672, a DNAME substitution is performed by replacing the suffix labels of the name being sought matching the owner name of the DNAME resource record with the string of labels in the RDATA field. The matching labels end with the root label in all cases. Only whole labels are replaced. * Handle DNAME redirection A CNAME RR is created on-the-fly for the DNAME redirection. Be aware that we do not have all the edge cases covered yet. * Test DNAME owner name matching the QNAME A DNAME RR redirects DNS names subordinate to its owner name; the owner name of a DNAME is NOT redirected itself. * Ignore names next to and below a DNAME record According to RFC 6672, resource records MUST NOT exist at any subdomain of the owner of a DNAME RR. When loading a zone, those names below the DNAME RR will be quietly ignored. * Streamline DNAME processing Instead of checking DNAMEs during lookup, we use a preloaded list of DNAME RRs to streamline the process without any runtime performance penalty: * When loading the zone, keep a record of any DNAME RRs. * If there aren't any DNAMEs in the zone, just do the lookup as usual. * Only when the zone has one or more DNAME records, we look for the matching DNAME and ignore confronting subdomain(s) in the process. * Make it easier to trace back through test errors * Make DNAME handling part of lookup routine DNAME processing is invoked only if the zone has at least one DNAME RR. * Put DNAME resolution inside the searching of a hit We can drop some of the other ideas; we don't need to track if we have DNAMEs in the zone it just follows naturally from the current lookup code. See also: #664
2017-05-26 17:37:06 +08:00
_, err := fm.ServeDNS(ctx, rec, m)
if err != nil {
Stop importing testing in the main binary (#2479) * Stop importing testing in the main binary Stop importing "testing" into the main binary: * test/helpers.go imported it; remote that and change function signature * update all tests that use this Signed-off-by: Miek Gieben <miek@miek.nl> * Drop import testing from metrics plugin Signed-off-by: Miek Gieben <miek@miek.nl> * more fiddling Signed-off-by: Miek Gieben <miek@miek.nl>
2019-01-19 11:23:13 +00:00
t.Errorf("Expected no error, got %v", err)
middleware/file: add DNAME support (#651) * Test DNAME handling If the DNAME itself matches the QTYPE, and the owner name matches QNAME, the relevant DNAME RR should be included in the answer section. Other parts of RFC 6672 are not implemented yet and hence left untested. * Implement the DNAME substitution As specified in RFC 6672, a DNAME substitution is performed by replacing the suffix labels of the name being sought matching the owner name of the DNAME resource record with the string of labels in the RDATA field. The matching labels end with the root label in all cases. Only whole labels are replaced. * Handle DNAME redirection A CNAME RR is created on-the-fly for the DNAME redirection. Be aware that we do not have all the edge cases covered yet. * Test DNAME owner name matching the QNAME A DNAME RR redirects DNS names subordinate to its owner name; the owner name of a DNAME is NOT redirected itself. * Ignore names next to and below a DNAME record According to RFC 6672, resource records MUST NOT exist at any subdomain of the owner of a DNAME RR. When loading a zone, those names below the DNAME RR will be quietly ignored. * Streamline DNAME processing Instead of checking DNAMEs during lookup, we use a preloaded list of DNAME RRs to streamline the process without any runtime performance penalty: * When loading the zone, keep a record of any DNAME RRs. * If there aren't any DNAMEs in the zone, just do the lookup as usual. * Only when the zone has one or more DNAME records, we look for the matching DNAME and ignore confronting subdomain(s) in the process. * Make it easier to trace back through test errors * Make DNAME handling part of lookup routine DNAME processing is invoked only if the zone has at least one DNAME RR. * Put DNAME resolution inside the searching of a hit We can drop some of the other ideas; we don't need to track if we have DNAMEs in the zone it just follows naturally from the current lookup code. See also: #664
2017-05-26 17:37:06 +08:00
return
}
resp := rec.Msg
tests: add SortAndCheck helper (#926) There was quite some code duplication in a lot of tests to check if an answer was considered Ok. Created a test.SortAndCheck helper function that takes care of this.
2017-08-16 15:30:58 +01:00
test.SortAndCheck(t, resp, tc)
middleware/file: add DNAME support (#651) * Test DNAME handling If the DNAME itself matches the QTYPE, and the owner name matches QNAME, the relevant DNAME RR should be included in the answer section. Other parts of RFC 6672 are not implemented yet and hence left untested. * Implement the DNAME substitution As specified in RFC 6672, a DNAME substitution is performed by replacing the suffix labels of the name being sought matching the owner name of the DNAME resource record with the string of labels in the RDATA field. The matching labels end with the root label in all cases. Only whole labels are replaced. * Handle DNAME redirection A CNAME RR is created on-the-fly for the DNAME redirection. Be aware that we do not have all the edge cases covered yet. * Test DNAME owner name matching the QNAME A DNAME RR redirects DNS names subordinate to its owner name; the owner name of a DNAME is NOT redirected itself. * Ignore names next to and below a DNAME record According to RFC 6672, resource records MUST NOT exist at any subdomain of the owner of a DNAME RR. When loading a zone, those names below the DNAME RR will be quietly ignored. * Streamline DNAME processing Instead of checking DNAMEs during lookup, we use a preloaded list of DNAME RRs to streamline the process without any runtime performance penalty: * When loading the zone, keep a record of any DNAME RRs. * If there aren't any DNAMEs in the zone, just do the lookup as usual. * Only when the zone has one or more DNAME records, we look for the matching DNAME and ignore confronting subdomain(s) in the process. * Make it easier to trace back through test errors * Make DNAME handling part of lookup routine DNAME processing is invoked only if the zone has at least one DNAME RR. * Put DNAME resolution inside the searching of a hit We can drop some of the other ideas; we don't need to track if we have DNAMEs in the zone it just follows naturally from the current lookup code. See also: #664
2017-05-26 17:37:06 +08:00
}
}
middleware/file: add DNSSEC support (#697) * middleware/file: add DNSSEC support Add tests for DNSSEC and check if everything is working. * add signatures * tweak * Add DNSSEC signing tests for DNAME * Just sign it all
2017-06-02 17:18:58 +01:00
var dnameDnssecTestCases = []test.Case{
{
// We have no auth section, because the test zone does not have nameservers.
Qname: "ns.example.org.", Qtype: dns.TypeA,
Answer: []dns.RR{
test.A("ns.example.org. 1800 IN A 127.0.0.1"),
},
},
{
Default to scrubbing replies in the server (#2012) Every plugin needs to deal with EDNS0 and should call Scrub to make a message fit the client's buffer. Move this functionality into the server and wrapping the ResponseWriter into a ScrubWriter that handles these bits for us. Result: Less code and faster, because multiple chained plugins could all be calling scrub and SizeAndDo - now there is just one place. Most tests in file/* and dnssec/* needed adjusting because in those unit tests you don't see OPT RRs anymore. The DNSSEC signer was also looking at the returned OPT RR to see if it needed to sign - as those are now added by the server (and thus later), this needed to change slightly. Scrub itself still exist (for backward compat reasons), but has been made a noop. Scrub has been renamed to scrub as it should not be used by external plugins. Fixes: #2010 Signed-off-by: Miek Gieben <miek@miek.nl>
2018-08-29 12:26:22 +01:00
Qname: "dname.example.org.", Qtype: dns.TypeDNAME, Do: true,
middleware/file: add DNSSEC support (#697) * middleware/file: add DNSSEC support Add tests for DNSSEC and check if everything is working. * add signatures * tweak * Add DNSSEC signing tests for DNAME * Just sign it all
2017-06-02 17:18:58 +01:00
Answer: []dns.RR{
test.DNAME("dname.example.org. 1800 IN DNAME test.example.org."),
test.RRSIG("dname.example.org. 1800 IN RRSIG DNAME 5 3 1800 20170702091734 20170602091734 54282 example.org. HvXtiBM="),
},
},
{
Default to scrubbing replies in the server (#2012) Every plugin needs to deal with EDNS0 and should call Scrub to make a message fit the client's buffer. Move this functionality into the server and wrapping the ResponseWriter into a ScrubWriter that handles these bits for us. Result: Less code and faster, because multiple chained plugins could all be calling scrub and SizeAndDo - now there is just one place. Most tests in file/* and dnssec/* needed adjusting because in those unit tests you don't see OPT RRs anymore. The DNSSEC signer was also looking at the returned OPT RR to see if it needed to sign - as those are now added by the server (and thus later), this needed to change slightly. Scrub itself still exist (for backward compat reasons), but has been made a noop. Scrub has been renamed to scrub as it should not be used by external plugins. Fixes: #2010 Signed-off-by: Miek Gieben <miek@miek.nl>
2018-08-29 12:26:22 +01:00
Qname: "a.dname.example.org.", Qtype: dns.TypeA, Do: true,
middleware/file: add DNSSEC support (#697) * middleware/file: add DNSSEC support Add tests for DNSSEC and check if everything is working. * add signatures * tweak * Add DNSSEC signing tests for DNAME * Just sign it all
2017-06-02 17:18:58 +01:00
Answer: []dns.RR{
test.CNAME("a.dname.example.org. 1800 IN CNAME a.test.example.org."),
test.DNAME("dname.example.org. 1800 IN DNAME test.example.org."),
test.RRSIG("dname.example.org. 1800 IN RRSIG DNAME 5 3 1800 20170702091734 20170602091734 54282 example.org. HvXtiBM="),
},
},
}
func TestLookupDNAMEDNSSEC(t *testing.T) {
middleware/file: don't reload zone when SOA isn't changed (#707) * middleware/file: don't reload zone when SOA isn't changed Give Parse an extra argument which is the SOA's serial, if > 0 we check against the just parsed SOA and then just return. Most notable use is in reload.go which is both used in the file and auto middleware. Fixes #415 * PR comments
2017-06-08 18:43:11 +01:00
zone, err := Parse(strings.NewReader(dbExampleDNAMESigned), testzone, "stdin", 0)
middleware/file: add DNSSEC support (#697) * middleware/file: add DNSSEC support Add tests for DNSSEC and check if everything is working. * add signatures * tweak * Add DNSSEC signing tests for DNAME * Just sign it all
2017-06-02 17:18:58 +01:00
if err != nil {
t.Fatalf("Expect no error when reading zone, got %q", err)
}
fm := File{Next: test.ErrorHandler(), Zones: Zones{Z: map[string]*Zone{"example.org.": zone}, Names: []string{"example.org."}}}
ctx := context.TODO()
for _, tc := range dnameDnssecTestCases {
m := tc.Msg()
pkg: add dnstest (#1098) Add a full test server impl in this new package + tests. Move dnsrecorder into this package as well and finish up the commented out tests that were left in the old dnsrecorder package. Update all callers and tests.
2017-09-21 15:15:47 +01:00
rec := dnstest.NewRecorder(&test.ResponseWriter{})
middleware/file: add DNSSEC support (#697) * middleware/file: add DNSSEC support Add tests for DNSSEC and check if everything is working. * add signatures * tweak * Add DNSSEC signing tests for DNAME * Just sign it all
2017-06-02 17:18:58 +01:00
_, err := fm.ServeDNS(ctx, rec, m)
if err != nil {
Stop importing testing in the main binary (#2479) * Stop importing testing in the main binary Stop importing "testing" into the main binary: * test/helpers.go imported it; remote that and change function signature * update all tests that use this Signed-off-by: Miek Gieben <miek@miek.nl> * Drop import testing from metrics plugin Signed-off-by: Miek Gieben <miek@miek.nl> * more fiddling Signed-off-by: Miek Gieben <miek@miek.nl>
2019-01-19 11:23:13 +00:00
t.Errorf("Expected no error, got %v", err)
middleware/file: add DNSSEC support (#697) * middleware/file: add DNSSEC support Add tests for DNSSEC and check if everything is working. * add signatures * tweak * Add DNSSEC signing tests for DNAME * Just sign it all
2017-06-02 17:18:58 +01:00
return
}
resp := rec.Msg
tests: add SortAndCheck helper (#926) There was quite some code duplication in a lot of tests to check if an answer was considered Ok. Created a test.SortAndCheck helper function that takes care of this.
2017-08-16 15:30:58 +01:00
test.SortAndCheck(t, resp, tc)
middleware/file: add DNSSEC support (#697) * middleware/file: add DNSSEC support Add tests for DNSSEC and check if everything is working. * add signatures * tweak * Add DNSSEC signing tests for DNAME * Just sign it all
2017-06-02 17:18:58 +01:00
}
}
middleware/file: add DNAME support (#651) * Test DNAME handling If the DNAME itself matches the QTYPE, and the owner name matches QNAME, the relevant DNAME RR should be included in the answer section. Other parts of RFC 6672 are not implemented yet and hence left untested. * Implement the DNAME substitution As specified in RFC 6672, a DNAME substitution is performed by replacing the suffix labels of the name being sought matching the owner name of the DNAME resource record with the string of labels in the RDATA field. The matching labels end with the root label in all cases. Only whole labels are replaced. * Handle DNAME redirection A CNAME RR is created on-the-fly for the DNAME redirection. Be aware that we do not have all the edge cases covered yet. * Test DNAME owner name matching the QNAME A DNAME RR redirects DNS names subordinate to its owner name; the owner name of a DNAME is NOT redirected itself. * Ignore names next to and below a DNAME record According to RFC 6672, resource records MUST NOT exist at any subdomain of the owner of a DNAME RR. When loading a zone, those names below the DNAME RR will be quietly ignored. * Streamline DNAME processing Instead of checking DNAMEs during lookup, we use a preloaded list of DNAME RRs to streamline the process without any runtime performance penalty: * When loading the zone, keep a record of any DNAME RRs. * If there aren't any DNAMEs in the zone, just do the lookup as usual. * Only when the zone has one or more DNAME records, we look for the matching DNAME and ignore confronting subdomain(s) in the process. * Make it easier to trace back through test errors * Make DNAME handling part of lookup routine DNAME processing is invoked only if the zone has at least one DNAME RR. * Put DNAME resolution inside the searching of a hit We can drop some of the other ideas; we don't need to track if we have DNAMEs in the zone it just follows naturally from the current lookup code. See also: #664
2017-05-26 17:37:06 +08:00
const dbMiekNLDNAME = `
$TTL 30M
$ORIGIN miek.nl.
@ IN SOA linode.atoom.net. miek.miek.nl. (
1282630057 ; Serial
4H ; Refresh
1H ; Retry
7D ; Expire
4H ) ; Negative Cache TTL
IN NS linode.atoom.net.
IN NS ns-ext.nlnetlabs.nl.
IN NS omval.tednet.nl.
IN NS ext.ns.whyscream.net.
test IN MX 1 aspmx.l.google.com.
IN MX 5 alt1.aspmx.l.google.com.
IN MX 5 alt2.aspmx.l.google.com.
IN MX 10 aspmx2.googlemail.com.
IN MX 10 aspmx3.googlemail.com.
a.test IN A 139.162.196.78
IN AAAA 2a01:7e00::f03c:91ff:fef1:6735
www.test IN CNAME a.test
dname IN DNAME test
dname IN A 127.0.0.1
a.dname IN A 127.0.0.1
`
middleware/file: add DNSSEC support (#697) * middleware/file: add DNSSEC support Add tests for DNSSEC and check if everything is working. * add signatures * tweak * Add DNSSEC signing tests for DNAME * Just sign it all
2017-06-02 17:18:58 +01:00
const dbExampleDNAMESigned = `
; File written on Fri Jun 2 10:17:34 2017
; dnssec_signzone version 9.10.3-P4-Debian
example.org. 1800 IN SOA a.example.org. b.example.org. (
1282630057 ; serial
14400 ; refresh (4 hours)
3600 ; retry (1 hour)
604800 ; expire (1 week)
14400 ; minimum (4 hours)
)
1800 RRSIG SOA 5 2 1800 (
20170702091734 20170602091734 54282 example.org.
mr5eQtFs1GubgwaCcqrpiF6Cgi822OkESPeV
X0OJYq3JzthJjHw8TfYAJWQ2yGqhlePHir9h
FT/uFZdYyytHq+qgIUbJ9IVCrq0gZISZdHML
Ry1DNffMR9CpD77KocOAUABfopcvH/3UGOHn
TFxkAr447zPaaoC68JYGxYLfZk8= )
1800 NS ns.example.org.
1800 RRSIG NS 5 2 1800 (
20170702091734 20170602091734 54282 example.org.
McM4UdMxkscVQkJnnEbdqwyjpPgq5a/EuOLA
r2MvG43/cwOaWULiZoNzLi5Rjzhf+GTeVTan
jw6EsL3gEuYI1nznwlLQ04/G0XAHjbq5VvJc
rlscBD+dzf774yfaTjRNoeo2xTem6S7nyYPW
Y+1f6xkrsQPLYJfZ6VZ9QqyupBw= )
14400 NSEC dname.example.org. NS SOA RRSIG NSEC DNSKEY
14400 RRSIG NSEC 5 2 14400 (
20170702091734 20170602091734 54282 example.org.
VT+IbjDFajM0doMKFipdX3+UXfCn3iHIxg5x
LElp4Q/YddTbX+6tZf53+EO+G8Kye3JDLwEl
o8VceijNeF3igZ+LiZuXCei5Qg/TJ7IAUnAO
xd85IWwEYwyKkKd6Z2kXbAN2pdcHE8EmboQd
wfTr9oyWhpZk1Z+pN8vdejPrG0M= )
1800 DNSKEY 256 3 5 (
AwEAAczLlmTk5bMXUzpBo/Jta6MWSZYy3Nfw
gz8t/pkfSh4IlFF6vyXZhEqCeQsCBdD7ltkD
h5qd4A+nFrYOMwsi5XIjoHMlJN15xwFS9EgS
ZrZmuxePIEiYB5KccEf9JQMgM1t07Iu1FnrY
02OuAqGWcO4tuyTLaK3QP4MLQOfAgKqf
) ; ZSK; alg = RSASHA1; key id = 54282
1800 RRSIG DNSKEY 5 2 1800 (
20170702091734 20170602091734 54282 example.org.
MBgSRtZ6idJblLIHxZWpWL/1oqIwImb1mkl7
hDFxqV6Hw19yLX06P7gcJEWiisdZBkVEfcOK
LeMJly05vgKfrMzLgIu2Ry4bL8AMKc8NMXBG
b1VDCEBW69P2omogj2KnORHDCZQr/BX9+wBU
5rIMTTKlMSI5sT6ecJHHEymtiac= )
dname.example.org. 1800 IN A 127.0.0.1
1800 RRSIG A 5 3 1800 (
20170702091734 20170602091734 54282 example.org.
LPCK2nLyDdGwvmzGLkUO2atEUjoc+aEspkC3
keZCdXZaLnAwBH7dNAjvvXzzy0WrgWeiyDb4
+rJ2N0oaKEZicM4QQDHKhugJblKbU5G4qTey
LSEaV3vvQnzGd0S6dCqnwfPj9czagFN7Zlf5
DmLtdxx0aiDPCUpqT0+H/vuGPfk= )
1800 DNAME test.example.org.
1800 RRSIG DNAME 5 3 1800 (
20170702091734 20170602091734 54282 example.org.
HvX79T1flWJ8H9/1XZjX6gz8rP/o2jbfPXJ9
vC7ids/ZJilSReabLru4DCqcw1IV2DM/CZdE
tBnED/T2PJXvMut9tnYMrz+ZFPxoV6XyA3Z7
bok3B0OuxizzAN2EXdol04VdbMHoWUzjQCzi
0Ri12zLGRPzDepZ7FolgD+JtiBM= )
14400 NSEC a.dname.example.org. A DNAME RRSIG NSEC
14400 RRSIG NSEC 5 3 14400 (
20170702091734 20170602091734 54282 example.org.
U3ZPYMUBJl3wF2SazQv/kBf6ec0CH+7n0Hr9
w6lBKkiXz7P9WQzJDVnTHEZOrbDI6UetFGyC
6qcaADCASZ9Wxc+riyK1Hl4ox+Y/CHJ97WHy
oS2X//vEf6qmbHQXin0WQtFdU/VCRYF40X5v
8VfqOmrr8iKiEqXND8XNVf58mTw= )
a.dname.example.org. 1800 IN A 127.0.0.1
1800 RRSIG A 5 4 1800 (
20170702091734 20170602091734 54282 example.org.
y7RHBWZwli8SJQ4BgTmdXmYS3KGHZ7AitJCx
zXFksMQtNoOfVEQBwnFqjAb8ezcV5u92h1gN
i1EcuxCFiElML1XFT8dK2GnlPAga9w3oIwd5
wzW/YHcnR0P9lF56Sl7RoIt6+jJqOdRfixS6
TDoLoXsNbOxQ+qV3B8pU2Tam204= )
14400 NSEC ns.example.org. A RRSIG NSEC
14400 RRSIG NSEC 5 4 14400 (
20170702091734 20170602091734 54282 example.org.
Tmu27q3+xfONSZZtZLhejBUVtEw+83ZU1AFb
Rsxctjry/x5r2JSxw/sgSAExxX/7tx/okZ8J
oJqtChpsr91Kiw3eEBgINi2lCYIpMJlW4cWz
8bYlHfR81VsKYgy/cRgrq1RRvBoJnw+nwSty
mKPIvUtt67LAvLxJheSCEMZLCKI= )
ns.example.org. 1800 IN A 127.0.0.1
1800 RRSIG A 5 3 1800 (
20170702091734 20170602091734 54282 example.org.
mhi1SGaaAt+ndQEg5uKWKCH0HMzaqh/9dUK3
p2wWMBrLbTZrcWyz10zRnvehicXDCasbBrer
ZpDQnz5AgxYYBURvdPfUzx1XbNuRJRE4l5PN
CEUTlTWcqCXnlSoPKEJE5HRf7v0xg2BrBUfM
4mZnW2bFLwjrRQ5mm/mAmHmTROk= )
14400 NSEC example.org. A RRSIG NSEC
14400 RRSIG NSEC 5 3 14400 (
20170702091734 20170602091734 54282 example.org.
loHcdjX+NIWLAkUDfPSy2371wrfUvrBQTfMO
17eO2Y9E/6PE935NF5bjQtZBRRghyxzrFJhm
vY1Ad5ZTb+NLHvdSWbJQJog+eCc7QWp64WzR
RXpMdvaE6ZDwalWldLjC3h8QDywDoFdndoRY
eHOsmTvvtWWqtO6Fa5A8gmHT5HA= )
`
Default to upstream to self (#2436) * Default to upstream to self This is a backwards incompatible change. This is a massive (cleanup) PR where we default to resolving external names by the coredns process itself, instead of directly forwarding them to some upstream. This ignores any arguments `upstream` may have had and makes it depend on proxy/forward configuration in the Corefile. This allows resolved upstream names to be cached and we have better healthchecking of the upstreams. It also means there is only one way to resolve names, by either using the proxy or forward plugin. The proxy/forward lookup.go functions have been removed. This also lessen the dependency on proxy, meaning deprecating proxy will become easier. Some tests have been removed as well, or moved to the top-level test directory as they now require a full coredns process instead of just the plugin. For the etcd plugin, the entire StubZone resolving is *dropped*! This was a hacky (but working) solution to say the least. If someone cares deeply it can be brought back (maybe)? The pkg/upstream is now very small and almost does nothing. Also the New() function was changed to return a pointer to upstream.Upstream. It also returns only one parameter, so any stragglers using it will encounter a compile error. All documentation has been adapted. This affected the following plugins: * etcd * file * auto * secondary * federation * template * route53 A followup PR will make any upstream directives with arguments an error, right now they are ignored. Signed-off-by: Miek Gieben <miek@miek.nl> * Fix etcd build - probably still fails unit test Signed-off-by: Miek Gieben <miek@miek.nl> * Slightly smarter lookup check in upstream Signed-off-by: Miek Gieben <miek@miek.nl> * Compilez Signed-off-by: Miek Gieben <miek@miek.nl>
2019-01-13 16:54:49 +00:00
*/
Reference in New Issue Copy Permalink