dnsdist: Add a regression test for DoQ certs/keys reloading

diff --git a/regression-tests.dnsdist/.gitignore b/regression-tests.dnsdist/.gitignore
index 78d7bc1ccb7aec879ea7e992c5862f6a17369881..0b347c4993b5ba235eb1fe19dc6c77e37fccc182 100644 (file)
--- a/regression-tests.dnsdist/.gitignore
+++ b/regression-tests.dnsdist/.gitignore
@@ -15,16 +15,14 @@
 /server.key
 /server.pem
 /server.p12
+/server-doq.*
+/server-doh3.*
 /server-ocsp.chain
 /server-ocsp.csr
 /server-ocsp.key
 /server-ocsp.pem
 /server-ocsp.p12
-/server-tls.chain
-/server-tls.csr
-/server-tls.key
-/server-tls.pem
-/server-tls.p12
+/server-tls.*
 /server.ocsp
 /configs
 /dnsdist.log

diff --git a/regression-tests.dnsdist/dnsdisttests.py b/regression-tests.dnsdist/dnsdisttests.py
index d8e0cd9fff7e5368759c7fa2a083c2c7c388c1cd..c854cfab53005f3e13296381a3a402a4677e6fab 100644 (file)
--- a/regression-tests.dnsdist/dnsdisttests.py
+++ b/regression-tests.dnsdist/dnsdisttests.py
@@ -1116,7 +1116,7 @@ class DNSDistTest(AssertEqualDNSMessageMixin, unittest.TestCase):
             else:
                 cls._toResponderQueue.put(response, True, timeout)
 
-        message = quic_query(query, '127.0.0.1', timeout, port, verify=caFile, server_hostname=serverName)
+        (message, _) = quic_query(query, '127.0.0.1', timeout, port, verify=caFile, server_hostname=serverName)
 
         receivedQuery = None
 

diff --git a/regression-tests.dnsdist/doqclient.py b/regression-tests.dnsdist/doqclient.py
index 94fa7bdc8e1f2cff78818960081afb7f333491fb..2f0272630f3b9399a1ae9e20305fa6bacd51450c 100644 (file)
--- a/regression-tests.dnsdist/doqclient.py
+++ b/regression-tests.dnsdist/doqclient.py
@@ -4,6 +4,7 @@ import ssl
 import struct
 from typing import Any, Optional, cast
 import dns
+import dns.message
 import async_timeout
 
 from aioquic.quic.configuration import QuicConfiguration
@@ -77,9 +78,9 @@ async def async_quic_query(
         try:
             async with async_timeout.timeout(timeout):
                 answer = await client.query(query)
-                return answer
+                return (answer, client._quic.tls._peer_certificate.serial_number)
         except asyncio.TimeoutError as e:
-            return e
+            return (e, None)
 
 class StreamResetError(Exception):
     def __init__(self, error, message="Stream reset by peer"):
@@ -90,7 +91,7 @@ def quic_query(query, host='127.0.0.1', timeout=2, port=853, verify=None, server
     configuration = QuicConfiguration(alpn_protocols=["doq"], is_client=True)
     if verify:
         configuration.load_verify_locations(verify)
-    result = asyncio.run(
+    (result, serial) = asyncio.run(
         async_quic_query(
             configuration=configuration,
             host=host,
@@ -104,13 +105,13 @@ def quic_query(query, host='127.0.0.1', timeout=2, port=853, verify=None, server
         raise StreamResetError(result.error_code)
     if (isinstance(result, asyncio.TimeoutError)):
         raise TimeoutError()
-    return result
+    return (result, serial)
 
 def quic_bogus_query(query, host='127.0.0.1', timeout=2, port=853, verify=None, server_hostname=None):
     configuration = QuicConfiguration(alpn_protocols=["doq"], is_client=True)
     if verify:
         configuration.load_verify_locations(verify)
-    result = asyncio.run(
+    (result, _) = asyncio.run(
         async_quic_query(
             configuration=configuration,
             host=host,

diff --git a/regression-tests.dnsdist/test_DOQ.py b/regression-tests.dnsdist/test_DOQ.py
index 69d61dc7a1d39e1bdc9769780ea1540394d94337..9af5d8a9387bfceebd462feeea7a1ad59fdb599b 100644 (file)
--- a/regression-tests.dnsdist/test_DOQ.py
+++ b/regression-tests.dnsdist/test_DOQ.py
@@ -1,4 +1,5 @@
 #!/usr/bin/env python
+import base64
 import dns
 import clientsubnetoption
 
@@ -7,6 +8,7 @@ from dnsdisttests import pickAvailablePort
 from doqclient import quic_bogus_query
 from quictests import QUICTests, QUICWithCacheTests, QUICACLTests
 import doqclient
+from doqclient import quic_query
 
 class TestDOQBogus(DNSDistTest):
     _serverKey = 'server.key'
@@ -20,7 +22,6 @@ class TestDOQBogus(DNSDistTest):
     addDOQLocal("127.0.0.1:%d", "%s", "%s")
     """
     _config_params = ['_testServerPort', '_doqServerPort','_serverCert', '_serverKey']
-    _verboseMode = True
 
     def testDOQBogus(self):
         """
@@ -55,7 +56,6 @@ class TestDOQ(QUICTests, DNSDistTest):
     addDOQLocal("127.0.0.1:%d", "%s", "%s")
     """
     _config_params = ['_testServerPort', '_doqServerPort','_serverCert', '_serverKey']
-    _verboseMode = True
 
     def getQUICConnection(self):
         return self.getDOQConnection(self._doqServerPort, self._caCert)
@@ -78,7 +78,6 @@ class TestDOQWithCache(QUICWithCacheTests, DNSDistTest):
     getPool(""):setCache(pc)
     """
     _config_params = ['_testServerPort', '_doqServerPort','_serverCert', '_serverKey']
-    _verboseMode = True
 
     def getQUICConnection(self):
         return self.getDOQConnection(self._doqServerPort, self._caCert)
@@ -99,10 +98,47 @@ class TestDOQWithACL(QUICACLTests, DNSDistTest):
     addDOQLocal("127.0.0.1:%d", "%s", "%s")
     """
     _config_params = ['_testServerPort', '_doqServerPort','_serverCert', '_serverKey']
-    _verboseMode = True
 
     def getQUICConnection(self):
         return self.getDOQConnection(self._doqServerPort, self._caCert)
 
     def sendQUICQuery(self, query, response=None, useQueue=True, connection=None):
         return self.sendDOQQuery(self._doqServerPort, query, response=response, caFile=self._caCert, useQueue=useQueue, serverName=self._serverName, connection=connection)
+
+class TestDOQCertificateReloading(DNSDistTest):
+    _consoleKey = DNSDistTest.generateConsoleKey()
+    _consoleKeyB64 = base64.b64encode(_consoleKey).decode('ascii')
+    _serverKey = 'server-doq.key'
+    _serverCert = 'server-doq.chain'
+    _serverName = 'tls.tests.dnsdist.org'
+    _caCert = 'ca.pem'
+    _doqServerPort = pickAvailablePort()
+    _config_template = """
+    setKey("%s")
+    controlSocket("127.0.0.1:%s")
+
+    newServer{address="127.0.0.1:%d"}
+
+    addDOQLocal("127.0.0.1:%d", "%s", "%s")
+    """
+    _config_params = ['_consoleKeyB64', '_consolePort', '_testServerPort', '_doqServerPort','_serverCert', '_serverKey']
+
+    @classmethod
+    def setUpClass(cls):
+        cls.generateNewCertificateAndKey('server-doq')
+        cls.startResponders()
+        cls.startDNSDist()
+        cls.setUpSockets()
+
+    def testCertificateReloaded(self):
+        name = 'certificate-reload.doq.tests.powerdns.com.'
+        query = dns.message.make_query(name, 'A', 'IN', use_edns=False)
+        query.id = 0
+        (_, serial) = quic_query(query, '127.0.0.1', 0.5, self._doqServerPort, verify=self._caCert, server_hostname=self._serverName)
+
+        self.generateNewCertificateAndKey('server-doq')
+        self.sendConsoleCommand("reloadAllCertificates()")
+
+        (_, secondSerial) = quic_query(query, '127.0.0.1', 0.5, self._doqServerPort, verify=self._caCert, server_hostname=self._serverName)
+        # check that the serial is different
+        self.assertNotEqual(serial, secondSerial)