2 # SPDX-License-Identifier: LGPL-2.1-or-later
3 # vi: ts=4 sw=4 tw=0 et:
14 # shellcheck source=test/units/util.sh
15 .
"$(dirname "$0")"/util.sh
17 # We need at least Knot 3.0 which support (among others) the ds-push directive
18 if ! knotc
-c /usr
/lib
/systemd
/tests
/testdata
/knot-data
/knot.conf conf-check
; then
19 echo "This test requires at least Knot 3.0. skipping..." |
tee --append /skipped
26 "$@" |
& tee "$RUN_OUT"
30 # Since [0] delv no longer loads /etc/(bind/)bind.keys by default, so we
31 # have to do that explicitly for each invocation
32 run delv
-a /etc
/bind.keys
"$@"
36 sysctl
-w net.ipv6.conf.all.disable_ipv6
=1
40 sysctl
-w net.ipv6.conf.all.disable_ipv6
=0
41 networkctl reconfigure dns0
42 /usr
/lib
/systemd
/systemd-networkd-wait-online
--ipv4 --ipv6 --interface=dns0
:routable
--timeout=30
51 # Wait until the first mention of the specified log message is
52 # displayed. We turn off pipefail for this, since we don't care about the
53 # lhs of this pipe expression, we only care about the rhs' result to be
55 timeout
-v 30s journalctl
-u resolvectl-monitor.service
--since "$since" -f --full |
grep -m1 "$match"
59 systemctl stop systemd-resolved.service
60 (! systemctl is-failed systemd-resolved.service
)
61 # Reset the restart counter since we call this method a bunch of times
62 # and can occasionally hit the default rate limit
63 systemctl reset-failed systemd-resolved.service
64 systemctl start systemd-resolved.service
65 systemctl service-log-level systemd-resolved.service debug
68 # Test for resolvectl, resolvconf
69 systemctl unmask systemd-resolved.service
70 systemctl
enable --now systemd-resolved.service
71 systemctl service-log-level systemd-resolved.service debug
72 ip link add hoge
type dummy
73 ip link add hoge.foo
type dummy
74 resolvectl dns hoge
10.0.0.1 10.0.0.2
75 resolvectl dns hoge.foo
10.0.0.3 10.0.0.4
76 assert_in
'10.0.0.1 10.0.0.2' "$(resolvectl dns hoge)"
77 assert_in
'10.0.0.3 10.0.0.4' "$(resolvectl dns hoge.foo)"
78 resolvectl dns hoge
10.0.1.1 10.0.1.2
79 resolvectl dns hoge.foo
10.0.1.3 10.0.1.4
80 assert_in
'10.0.1.1 10.0.1.2' "$(resolvectl dns hoge)"
81 assert_in
'10.0.1.3 10.0.1.4' "$(resolvectl dns hoge.foo)"
82 if ! RESOLVCONF
=$
(command -v resolvconf
2>/dev
/null
); then
83 TMPDIR
=$
(mktemp
-d -p /tmp resolvconf-tests.XXXXXX
)
84 RESOLVCONF
="$TMPDIR"/resolvconf
85 ln -s "$(command -v resolvectl 2>/dev/null)" "$RESOLVCONF"
87 echo nameserver
10.0.2.1 10.0.2.2 |
"$RESOLVCONF" -a hoge
88 echo nameserver
10.0.2.3 10.0.2.4 |
"$RESOLVCONF" -a hoge.foo
89 assert_in
'10.0.2.1 10.0.2.2' "$(resolvectl dns hoge)"
90 assert_in
'10.0.2.3 10.0.2.4' "$(resolvectl dns hoge.foo)"
91 echo nameserver
10.0.3.1 10.0.3.2 |
"$RESOLVCONF" -a hoge.inet.ipsec
.192.168.35
92 echo nameserver
10.0.3.3 10.0.3.4 |
"$RESOLVCONF" -a hoge.foo.dhcp
93 assert_in
'10.0.3.1 10.0.3.2' "$(resolvectl dns hoge)"
94 assert_in
'10.0.3.3 10.0.3.4' "$(resolvectl dns hoge.foo)"
96 # Tests for _localdnsstub and _localdnsproxy
97 assert_in
'127.0.0.53' "$(resolvectl query _localdnsstub)"
98 assert_in
'_localdnsstub' "$(resolvectl query 127.0.0.53)"
99 assert_in
'127.0.0.54' "$(resolvectl query _localdnsproxy)"
100 assert_in
'_localdnsproxy' "$(resolvectl query 127.0.0.54)"
102 assert_in
'127.0.0.53' "$(dig @127.0.0.53 _localdnsstub)"
103 assert_in
'_localdnsstub' "$(dig @127.0.0.53 -x 127.0.0.53)"
104 assert_in
'127.0.0.54' "$(dig @127.0.0.53 _localdnsproxy)"
105 assert_in
'_localdnsproxy' "$(dig @127.0.0.53 -x 127.0.0.54)"
107 # Tests for mDNS and LLMNR settings
108 mkdir
-p /run
/systemd
/resolved.conf.d
111 echo "MulticastDNS=no"
113 } >/run
/systemd
/resolved.conf.d
/mdns-llmnr.conf
115 # make sure networkd is not running.
116 systemctl stop systemd-networkd.service
117 assert_in
'no' "$(resolvectl mdns hoge)"
118 assert_in
'no' "$(resolvectl llmnr hoge)"
119 # Tests that reloading works
122 echo "MulticastDNS=yes"
124 } >/run
/systemd
/resolved.conf.d
/mdns-llmnr.conf
125 systemctl reload systemd-resolved.service
126 # defaults to yes (both the global and per-link settings are yes)
127 assert_in
'yes' "$(resolvectl mdns hoge)"
128 assert_in
'yes' "$(resolvectl llmnr hoge)"
129 # set per-link setting
130 resolvectl mdns hoge
yes
131 resolvectl llmnr hoge
yes
132 assert_in
'yes' "$(resolvectl mdns hoge)"
133 assert_in
'yes' "$(resolvectl llmnr hoge)"
134 resolvectl mdns hoge resolve
135 resolvectl llmnr hoge resolve
136 assert_in
'resolve' "$(resolvectl mdns hoge)"
137 assert_in
'resolve' "$(resolvectl llmnr hoge)"
138 resolvectl mdns hoge no
139 resolvectl llmnr hoge no
140 assert_in
'no' "$(resolvectl mdns hoge)"
141 assert_in
'no' "$(resolvectl llmnr hoge)"
142 # downgrade global setting to resolve
145 echo "MulticastDNS=resolve"
147 } >/run
/systemd
/resolved.conf.d
/mdns-llmnr.conf
148 systemctl reload systemd-resolved.service
149 # set per-link setting
150 resolvectl mdns hoge
yes
151 resolvectl llmnr hoge
yes
152 assert_in
'resolve' "$(resolvectl mdns hoge)"
153 assert_in
'resolve' "$(resolvectl llmnr hoge)"
154 resolvectl mdns hoge resolve
155 resolvectl llmnr hoge resolve
156 assert_in
'resolve' "$(resolvectl mdns hoge)"
157 assert_in
'resolve' "$(resolvectl llmnr hoge)"
158 resolvectl mdns hoge no
159 resolvectl llmnr hoge no
160 assert_in
'no' "$(resolvectl mdns hoge)"
161 assert_in
'no' "$(resolvectl llmnr hoge)"
162 # downgrade global setting to no
165 echo "MulticastDNS=no"
167 } >/run
/systemd
/resolved.conf.d
/mdns-llmnr.conf
168 systemctl reload systemd-resolved.service
169 # set per-link setting
170 resolvectl mdns hoge
yes
171 resolvectl llmnr hoge
yes
172 assert_in
'no' "$(resolvectl mdns hoge)"
173 assert_in
'no' "$(resolvectl llmnr hoge)"
174 resolvectl mdns hoge resolve
175 resolvectl llmnr hoge resolve
176 assert_in
'no' "$(resolvectl mdns hoge)"
177 assert_in
'no' "$(resolvectl llmnr hoge)"
178 resolvectl mdns hoge no
179 resolvectl llmnr hoge no
180 assert_in
'no' "$(resolvectl mdns hoge)"
181 assert_in
'no' "$(resolvectl llmnr hoge)"
184 rm -f /run
/systemd
/resolved.conf.d
/mdns-llmnr.conf
190 hostnamectl hostname ns1.unsigned.
test
191 cat >>/etc
/hosts
<<EOF
192 10.0.0.1 ns1.unsigned.test
193 fd00:dead:beef:cafe::1 ns1.unsigned.test
195 127.128.0.5 localhost5 localhost5.localdomain localhost5.localdomain4 localhost.localdomain5 localhost5.localdomain5
198 mkdir
-p /run
/systemd
/network
199 cat >/run
/systemd
/network
/10-dns0.netdev
<<EOF
204 cat >/run
/systemd
/network
/10-dns0.network
<<EOF
211 Address=fd00:dead:beef:cafe::1/64
212 DNSSEC=allow-downgrade
214 DNS=fd00:dead:beef:cafe::1
216 cat >/run
/systemd
/network
/10-dns1.netdev
<<EOF
221 cat >/run
/systemd
/network
/10-dns1.network
<<EOF
230 systemctl edit
--stdin --full --runtime --force "resolved-dummy-server.service" <<EOF
233 Environment=SYSTEMD_LOG_LEVEL=debug
234 ExecStart=/usr/lib/systemd/tests/unit-tests/manual/test-resolved-dummy-server 10.99.0.1:53
239 "fd00:dead:beef:cafe::1"
242 mkdir
-p /run
/systemd
/resolved.conf.d
246 echo "DNSSEC=allow-downgrade"
247 echo "DNSOverTLS=opportunistic"
248 } >/run
/systemd
/resolved.conf.d
/test.conf
249 ln -svf /run
/systemd
/resolve
/stub-resolv.conf
/etc
/resolv.conf
250 # Override the default NTA list, which turns off DNSSEC validation for (among
251 # others) the test. domain
252 mkdir
-p "/etc/dnssec-trust-anchors.d/"
253 echo local >/etc
/dnssec-trust-anchors.d
/local.negative
255 # Copy over our knot configuration
256 mkdir
-p /var
/lib
/knot
/zones
/ /etc
/knot
/
257 cp -rfv /usr
/lib
/systemd
/tests
/testdata
/knot-data
/zones
/* /var
/lib
/knot
/zones
/
258 cp -fv /usr
/lib
/systemd
/tests
/testdata
/knot-data
/knot.conf
/etc
/knot
/knot.conf
259 chgrp
-R knot
/etc
/knot
/ /var
/lib
/knot
/
260 chmod -R ug
+rwX
/var
/lib
/knot
/
261 chmod -R g
+r
/etc
/knot
/
264 keymgr . generate algorithm
=ECDSAP256SHA256 ksk
=yes zsk
=yes
265 # Create a trust anchor for resolved with our root zone
266 keymgr . ds |
sed 's/ DS/ IN DS/g' >/etc
/dnssec-trust-anchors.d
/root.positive
267 # Create a bind-compatible trust anchor (for delv)
268 # Note: the trust-anchors directive is relatively new, so use the original
269 # managed-keys one until it's widespread enough
271 echo 'managed-keys {'
272 keymgr . dnskey |
sed -r 's/^\. DNSKEY ([0-9]+ [0-9]+ [0-9]+) (.+)$/. static-key \1 "\2";/g'
275 # Create an /etc/bind/bind.keys symlink, which is used by delv on Ubuntu
277 ln -svf /etc
/bind.keys
/etc
/bind
/bind.keys
280 systemctl unmask systemd-networkd
281 systemctl restart systemd-networkd
282 /usr
/lib
/systemd
/systemd-networkd-wait-online
--interface=dns1
:routable
--timeout=60
283 systemctl reload systemd-resolved
284 systemctl start resolved-dummy-server
286 # Create knot's runtime dir, since from certain version it's provided only by
287 # the package and not created by tmpfiles/systemd
288 if [[ ! -d /run
/knot
]]; then
290 chown
-R knot
:knot
/run
/knot
293 # Wait a bit for the keys to propagate
296 systemctl status resolved-dummy-server
299 resolvectl log-level debug
301 # Start monitoring queries
302 systemd-run
-u resolvectl-monitor.service
-p Type
=notify resolvectl monitor
303 systemd-run
-u resolvectl-monitor-json.service
-p Type
=notify resolvectl monitor
--json=short
305 # FIXME: knot, unfortunately, incorrectly complains about missing zone files for zones
306 # that are forwarded using the `dnsproxy` module. Until the issue is resolved,
307 # let's fall back to pre-processing the `zone-check` output a bit before checking it
309 # See: https://gitlab.nic.cz/knot/knot-dns/-/issues/913
310 run knotc zone-check ||
:
311 sed -i '/forwarded.test./d' "$RUN_OUT"
312 [[ ! -s "$RUN_OUT" ]]
313 # We need to manually propagate the DS records of onlinesign.test. to the parent
314 # zone, since they're generated online
315 knotc zone-begin
test.
316 if knotc zone-get
test. onlinesign.
test. ds |
grep .
; then
317 # Drop any old DS records, if present (e.g. on test re-run)
318 knotc zone-unset
test. onlinesign.
test. ds
320 # Propagate the new DS records
321 while read -ra line
; do
322 knotc zone-set
test.
"${line[0]}" 600 "${line[@]:1}"
323 done < <(keymgr onlinesign.
test. ds
)
324 knotc zone-commit
test.
331 : "--- nss-resolve/nss-myhostname tests"
333 TIMESTAMP
=$
(date '+%F %T')
334 # Issue: https://github.com/systemd/systemd/issues/23951
336 run getent
-s resolve ahosts ns1.unsigned.
test
337 grep -qE "^fd00:dead:beef:cafe::1\s+STREAM\s+ns1\.unsigned\.test" "$RUN_OUT"
338 monitor_check_rr
"$TIMESTAMP" "ns1.unsigned.test IN AAAA fd00:dead:beef:cafe::1"
340 # Issue: https://github.com/systemd/systemd/issues/23951
342 run getent
-s resolve ahosts ns1.unsigned.
test
343 grep -qE "^10\.0\.0\.1\s+STREAM\s+ns1\.unsigned\.test" "$RUN_OUT"
344 (! grep -qE "fd00:dead:beef:cafe::1" "$RUN_OUT")
345 monitor_check_rr
"$TIMESTAMP" "ns1.unsigned.test IN A 10.0.0.1"
348 # Issue: https://github.com/systemd/systemd/issues/18812
349 # PR: https://github.com/systemd/systemd/pull/18896
350 # Follow-up issue: https://github.com/systemd/systemd/issues/23152
351 # Follow-up PR: https://github.com/systemd/systemd/pull/23161
353 run getent
-s resolve ahosts localhost
354 grep -qE "^::1\s+STREAM\s+localhost" "$RUN_OUT"
355 run getent
-s myhostname ahosts localhost
356 grep -qE "^::1\s+STREAM\s+localhost" "$RUN_OUT"
359 run getent
-s resolve ahosts localhost
360 grep -qE "^127\.0\.0\.1\s+STREAM\s+localhost" "$RUN_OUT"
361 (! grep -qE "::1" "$RUN_OUT")
362 run getent
-s myhostname ahosts localhost
363 grep -qE "^127\.0\.0\.1\s+STREAM\s+localhost" "$RUN_OUT"
366 # Issue: https://github.com/systemd/systemd/issues/25088
367 run getent
-s resolve hosts
127.128.0.5
368 grep -qEx '127\.128\.0\.5\s+localhost5(\s+localhost5?\.localdomain[45]?){4}' "$RUN_OUT"
369 [ "$(wc -l <"$RUN_OUT")" -eq 1 ]
371 # Issue: https://github.com/systemd/systemd/issues/20158
372 run
dig +noall
+answer
+additional localhost5.
373 grep -qEx 'localhost5\.\s+0\s+IN\s+A\s+127\.128\.0\.5' "$RUN_OUT"
374 [ "$(wc -l <"$RUN_OUT")" -eq 1 ]
375 run
dig +noall
+answer
+additional localhost5.localdomain4.
376 grep -qEx 'localhost5\.localdomain4\.\s+0\s+IN\s+CNAME\s+localhost5\.' "$RUN_OUT"
377 grep -qEx 'localhost5\.\s+0\s+IN\s+A\s+127\.128\.0\.5' "$RUN_OUT"
378 [ "$(wc -l <"$RUN_OUT")" -eq 2 ]
380 : "--- Basic resolved tests ---"
381 # Issue: https://github.com/systemd/systemd/issues/22229
382 # PR: https://github.com/systemd/systemd/pull/22231
385 "255.255.255.255.in-addr.arpa"
386 "0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa"
391 for name
in "${FILTERED_NAMES[@]}"; do
393 grep -qF "NXDOMAIN" "$RUN_OUT"
397 # Issue: https://github.com/systemd/systemd/issues/22401
398 # PR: https://github.com/systemd/systemd/pull/22414
399 run
dig +noall
+authority
+comments SRV .
400 grep -qF "status: NOERROR" "$RUN_OUT"
401 grep -qE "IN\s+SOA\s+ns1\.unsigned\.test\." "$RUN_OUT"
403 run resolvectl query
-t SVCB svcb.
test
404 grep -qF 'alpn="dot"' "$RUN_OUT"
405 grep -qF "ipv4hint=10.0.0.1" "$RUN_OUT"
407 run resolvectl query
-t HTTPS https.
test
408 grep -qF 'alpn="h2,h3"' "$RUN_OUT"
410 : "--- ZONE: unsigned.test. ---"
411 run
dig @ns1.unsigned.
test +short unsigned.
test A unsigned.
test AAAA
412 grep -qF "10.0.0.101" "$RUN_OUT"
413 grep -qF "fd00:dead:beef:cafe::101" "$RUN_OUT"
414 run resolvectl query unsigned.
test
415 grep -qF "10.0.0.10" "$RUN_OUT"
416 grep -qF "fd00:dead:beef:cafe::101" "$RUN_OUT"
417 grep -qF "authenticated: no" "$RUN_OUT"
418 run
dig @ns1.unsigned.
test +short MX unsigned.
test
419 grep -qF "15 mail.unsigned.test." "$RUN_OUT"
420 run resolvectl query
--legend=no
-t MX unsigned.
test
421 grep -qF "unsigned.test IN MX 15 mail.unsigned.test" "$RUN_OUT"
424 : "--- ZONE: signed.test (static DNSSEC) ---"
425 # Check the trust chain (with and without systemd-resolved in between
426 # Issue: https://github.com/systemd/systemd/issues/22002
427 # PR: https://github.com/systemd/systemd/pull/23289
428 run_delv @ns1.unsigned.
test signed.
test
429 grep -qF "; fully validated" "$RUN_OUT"
431 grep -qF "; fully validated" "$RUN_OUT"
433 for addr
in "${DNS_ADDRESSES[@]}"; do
434 run_delv
"@$addr" -t A
mail.signed.
test
435 grep -qF "; fully validated" "$RUN_OUT"
436 run_delv
"@$addr" -t AAAA
mail.signed.
test
437 grep -qF "; fully validated" "$RUN_OUT"
439 run resolvectl query
mail.signed.
test
440 grep -qF "10.0.0.11" "$RUN_OUT"
441 grep -qF "fd00:dead:beef:cafe::11" "$RUN_OUT"
442 grep -qF "authenticated: yes" "$RUN_OUT"
444 run
dig +short signed.
test
445 grep -qF "10.0.0.10" "$RUN_OUT"
446 run resolvectl query signed.
test
447 grep -qF "signed.test: 10.0.0.10" "$RUN_OUT"
448 grep -qF "authenticated: yes" "$RUN_OUT"
449 run
dig @ns1.unsigned.
test +short MX signed.
test
450 grep -qF "10 mail.signed.test." "$RUN_OUT"
451 run resolvectl query
--legend=no
-t MX signed.
test
452 grep -qF "signed.test IN MX 10 mail.signed.test" "$RUN_OUT"
453 # Check a non-existent domain
454 run
dig +dnssec this.does.not.exist.signed.
test
455 grep -qF "status: NXDOMAIN" "$RUN_OUT"
456 # Check a wildcard record
457 run resolvectl query
-t TXT this.should.be.authenticated.wild.signed.
test
458 grep -qF 'this.should.be.authenticated.wild.signed.test IN TXT "this is a wildcard"' "$RUN_OUT"
459 grep -qF "authenticated: yes" "$RUN_OUT"
461 run resolvectl service _mysvc._tcp signed.
test
462 grep -qF "myservice.signed.test:1234" "$RUN_OUT"
463 grep -qF "10.0.0.20" "$RUN_OUT"
464 grep -qF "fd00:dead:beef:cafe::17" "$RUN_OUT"
465 grep -qF "authenticated: yes" "$RUN_OUT"
467 # Test service resolve over Varlink
468 run varlinkctl call
/run
/systemd
/resolve
/io.systemd.Resolve io.systemd.Resolve.ResolveService
'{"name":"","type":"_mysvc._tcp","domain":"signed.test"}'
469 grep -qF '"services":[{"priority":10,"weight":5,"port":1234,"hostname":"myservice.signed.test","canonicalName":"myservice.signed.test","addresses":[{"ifindex":' "$RUN_OUT"
470 grep -qF '"family":10,"address":[253,0,222,173,190,239,202,254,0,0,0,0,0,0,0,23]' "$RUN_OUT"
471 grep -qF '"family":2,"address":[10,0,0,20]' "$RUN_OUT"
472 grep -qF '}]}],"txt":["This is TXT for myservice"],"canonical":{"name":null,"type":"_mysvc._tcp","domain":"signed.test"},"flags":' "$RUN_OUT"
475 run varlinkctl call
/run
/systemd
/resolve
/io.systemd.Resolve io.systemd.Resolve.ResolveService
'{"type":"_mysvc._tcp","domain":"signed.test"}'
476 # without txt (SD_RESOLVE_NO_TXT)
477 run varlinkctl call
/run
/systemd
/resolve
/io.systemd.Resolve io.systemd.Resolve.ResolveService
'{"type":"_mysvc._tcp","domain":"signed.test","flags":64}'
478 (! grep -qF '"txt"' "$RUN_OUT")
479 # without address (SD_RESOLVE_NO_ADDRESS)
480 run varlinkctl call
/run
/systemd
/resolve
/io.systemd.Resolve io.systemd.Resolve.ResolveService
'{"type":"_mysvc._tcp","domain":"signed.test","flags":128}'
481 (! grep -qF '"addresses"' "$RUN_OUT")
482 # without txt and address
483 run varlinkctl call
/run
/systemd
/resolve
/io.systemd.Resolve io.systemd.Resolve.ResolveService
'{"type":"_mysvc._tcp","domain":"signed.test","flags":192}'
484 (! grep -qF '"txt"' "$RUN_OUT")
485 (! grep -qF '"addresses"' "$RUN_OUT")
487 (! run resolvectl service _invalidsvc._udp signed.
test)
488 grep -qE "invalidservice\.signed\.test' not found" "$RUN_OUT"
489 run resolvectl service _untrustedsvc._udp signed.
test
490 grep -qF "myservice.untrusted.test:1111" "$RUN_OUT"
491 grep -qF "10.0.0.123" "$RUN_OUT"
492 grep -qF "fd00:dead:beef:cafe::123" "$RUN_OUT"
493 grep -qF "authenticated: yes" "$RUN_OUT"
494 # Check OPENPGPKEY support
495 run_delv
-t OPENPGPKEY
5a786cdc59c161cdafd818143705026636962198c66ed4c5b3da321e._openpgpkey.signed.
test
496 grep -qF "; fully validated" "$RUN_OUT"
497 run resolvectl openpgp mr.smith@signed.
test
498 grep -qF "5a786cdc59c161cdafd818143705026636962198c66ed4c5b3da321e._openpgpkey.signed.test" "$RUN_OUT"
499 grep -qF "authenticated: yes" "$RUN_OUT"
500 # Check zone transfers (AXFR/IXFR)
501 # Note: since resolved doesn't support zone transfers, let's just make sure it
502 # simply refuses such requests without choking on them
503 # See: https://github.com/systemd/systemd/pull/30809#issuecomment-1880102804
504 run
dig @ns1.unsigned.
test AXFR signed.
test
505 grep -qE "SOA\s+ns1.unsigned.test. root.unsigned.test." "$RUN_OUT"
506 run
dig AXFR signed.
test
507 grep -qF "; Transfer failed" "$RUN_OUT"
508 run
dig @ns1.unsigned.
test IXFR
=43 signed.
test
509 grep -qE "SOA\s+ns1.unsigned.test. root.unsigned.test." "$RUN_OUT"
510 run
dig IXFR
=43 signed.
test
511 grep -qF "; Transfer failed" "$RUN_OUT"
513 # DNSSEC validation with multiple records of the same type for the same name
514 # Issue: https://github.com/systemd/systemd/issues/22002
515 # PR: https://github.com/systemd/systemd/pull/23289
517 local domain
="${1:?}"
518 local record
="${2:?}"
519 local message
="${3:?}"
522 for addr
in "${DNS_ADDRESSES[@]}"; do
523 run_delv
"@$addr" -t "$record" "$domain"
524 grep -qF "$message" "$RUN_OUT"
527 run_delv
-t "$record" "$domain"
528 grep -qF "$message" "$RUN_OUT"
530 run resolvectl query
"$domain"
531 grep -qF "authenticated: yes" "$RUN_OUT"
534 check_domain
"dupe.signed.test" "A" "; fully validated"
535 check_domain
"dupe.signed.test" "AAAA" "; negative response, fully validated"
536 check_domain
"dupe-ipv6.signed.test" "AAAA" "; fully validated"
537 check_domain
"dupe-ipv6.signed.test" "A" "; negative response, fully validated"
538 check_domain
"dupe-mixed.signed.test" "A" "; fully validated"
539 check_domain
"dupe-mixed.signed.test" "AAAA" "; fully validated"
541 # Test resolution of CNAME chains
542 TIMESTAMP
=$
(date '+%F %T')
543 run resolvectl query
-t A cname-chain.signed.
test
544 grep -qF "follow14.final.signed.test IN A 10.0.0.14" "$RUN_OUT"
545 grep -qF "authenticated: yes" "$RUN_OUT"
547 monitor_check_rr
"$TIMESTAMP" "follow10.so.close.signed.test IN CNAME follow11.yet.so.far.signed.test"
548 monitor_check_rr
"$TIMESTAMP" "follow11.yet.so.far.signed.test IN CNAME follow12.getting.hot.signed.test"
549 monitor_check_rr
"$TIMESTAMP" "follow12.getting.hot.signed.test IN CNAME follow13.almost.final.signed.test"
550 monitor_check_rr
"$TIMESTAMP" "follow13.almost.final.signed.test IN CNAME follow14.final.signed.test"
551 monitor_check_rr
"$TIMESTAMP" "follow14.final.signed.test IN A 10.0.0.14"
553 # Non-existing RR + CNAME chain
554 #run dig +dnssec AAAA cname-chain.signed.test
555 #grep -qF "status: NOERROR" "$RUN_OUT"
556 #grep -qE "^follow14\.final\.signed\.test\..+IN\s+NSEC\s+" "$RUN_OUT"
559 : "--- ZONE: onlinesign.test (dynamic DNSSEC) ---"
560 # Check the trust chain (with and without systemd-resolved in between
561 # Issue: https://github.com/systemd/systemd/issues/22002
562 # PR: https://github.com/systemd/systemd/pull/23289
563 run_delv @ns1.unsigned.
test sub.onlinesign.
test
564 grep -qF "; fully validated" "$RUN_OUT"
565 run_delv sub.onlinesign.
test
566 grep -qF "; fully validated" "$RUN_OUT"
568 run
dig +short sub.onlinesign.
test
569 grep -qF "10.0.0.133" "$RUN_OUT"
570 run resolvectl query sub.onlinesign.
test
571 grep -qF "sub.onlinesign.test: 10.0.0.133" "$RUN_OUT"
572 grep -qF "authenticated: yes" "$RUN_OUT"
573 run
dig @ns1.unsigned.
test +short TXT onlinesign.
test
574 grep -qF '"hello from onlinesign"' "$RUN_OUT"
575 run resolvectl query
--legend=no
-t TXT onlinesign.
test
576 grep -qF 'onlinesign.test IN TXT "hello from onlinesign"' "$RUN_OUT"
578 for addr
in "${DNS_ADDRESSES[@]}"; do
579 run_delv
"@$addr" -t A dual.onlinesign.
test
580 grep -qF "10.0.0.135" "$RUN_OUT"
581 run_delv
"@$addr" -t AAAA dual.onlinesign.
test
582 grep -qF "fd00:dead:beef:cafe::135" "$RUN_OUT"
583 run_delv
"@$addr" -t ANY ipv6.onlinesign.
test
584 grep -qF "fd00:dead:beef:cafe::136" "$RUN_OUT"
586 run resolvectl query dual.onlinesign.
test
587 grep -qF "10.0.0.135" "$RUN_OUT"
588 grep -qF "fd00:dead:beef:cafe::135" "$RUN_OUT"
589 grep -qF "authenticated: yes" "$RUN_OUT"
590 run resolvectl query ipv6.onlinesign.
test
591 grep -qF "fd00:dead:beef:cafe::136" "$RUN_OUT"
592 grep -qF "authenticated: yes" "$RUN_OUT"
594 # Check a non-existent domain
595 # Note: mod-onlinesign utilizes Minimally Covering NSEC Records, hence the
596 # different response than with "standard" DNSSEC
597 run
dig +dnssec this.does.not.exist.onlinesign.
test
598 grep -qF "status: NOERROR" "$RUN_OUT"
599 grep -qF "NSEC \\000.this.does.not.exist.onlinesign.test." "$RUN_OUT"
600 # Check a wildcard record
601 run resolvectl query
-t TXT this.should.be.authenticated.wild.onlinesign.
test
602 grep -qF 'this.should.be.authenticated.wild.onlinesign.test IN TXT "this is an onlinesign wildcard"' "$RUN_OUT"
603 grep -qF "authenticated: yes" "$RUN_OUT"
605 # Resolve via dbus method
606 TIMESTAMP
=$
(date '+%F %T')
607 run busctl call org.freedesktop.resolve1
/org
/freedesktop
/resolve1 org.freedesktop.resolve1.Manager ResolveHostname
'isit' 0 secondsub.onlinesign.
test 0 0
608 grep -qF '10 0 0 134 "secondsub.onlinesign.test"' "$RUN_OUT"
609 monitor_check_rr
"$TIMESTAMP" "secondsub.onlinesign.test IN A 10.0.0.134"
612 : "--- ZONE: untrusted.test (DNSSEC without propagated DS records) ---"
613 # Issue: https://github.com/systemd/systemd/issues/23955
615 resolvectl flush-caches
616 #run dig +short untrusted.test A untrusted.test AAAA
617 #grep -qF "10.0.0.121" "$RUN_OUT"
618 #grep -qF "fd00:dead:beef:cafe::121" "$RUN_OUT"
619 run resolvectl query untrusted.
test
620 grep -qF "untrusted.test:" "$RUN_OUT"
621 grep -qF "10.0.0.121" "$RUN_OUT"
622 grep -qF "fd00:dead:beef:cafe::121" "$RUN_OUT"
623 grep -qF "authenticated: no" "$RUN_OUT"
624 run resolvectl service _mysvc._tcp untrusted.
test
625 grep -qF "myservice.untrusted.test:1234" "$RUN_OUT"
626 grep -qF "10.0.0.123" "$RUN_OUT"
627 grep -qF "fd00:dead:beef:cafe::123" "$RUN_OUT"
629 # Issue: https://github.com/systemd/systemd/issues/19472
630 # 1) Query for a non-existing RR should return NOERROR + NSEC (?), not NXDOMAIN
631 # FIXME: re-enable once the issue is resolved
632 #run dig +dnssec AAAA untrusted.test
633 #grep -qF "status: NOERROR" "$RUN_OUT"
634 #grep -qE "^untrusted\.test\..+IN\s+NSEC\s+" "$RUN_OUT"
635 ## 2) Query for a non-existing name should return NXDOMAIN, not SERVFAIL
636 #run dig +dnssec this.does.not.exist.untrusted.test
637 #grep -qF "status: NXDOMAIN" "$RUN_OUT"
639 : "--- ZONE: forwarded.test (queries forwarded to our dummy test server) ---"
640 JOURNAL_CURSOR
="$(mktemp)"
641 journalctl
-n0 -q --cursor-file="$JOURNAL_CURSOR"
643 # See "test-resolved-dummy-server.c" for the server part
644 (! run resolvectl query nope.forwarded.
test)
645 grep -qF "nope.forwarded.test" "$RUN_OUT"
646 grep -qF "not found" "$RUN_OUT"
648 # SERVFAIL + EDE code 6: DNSSEC Bogus
649 (! run resolvectl query edns-bogus-dnssec.forwarded.
test)
650 grep -qE "^edns-bogus-dnssec.forwarded.test:.+: upstream-failure \(DNSSEC Bogus\)" "$RUN_OUT"
651 # Same thing, but over Varlink
652 (! run varlinkctl call
/run
/systemd
/resolve
/io.systemd.Resolve io.systemd.Resolve.ResolveHostname
'{"name" : "edns-bogus-dnssec.forwarded.test"}')
653 grep -qF "io.systemd.Resolve.DNSSECValidationFailed" "$RUN_OUT"
654 grep -qF '{"result":"upstream-failure","extendedDNSErrorCode":6}' "$RUN_OUT"
656 journalctl
-u systemd-resolved.service
--cursor-file="$JOURNAL_CURSOR" --grep "Server returned error: SERVFAIL \(DNSSEC Bogus\). Lookup failed."
658 # SERVFAIL + EDE code 16: Censored + extra text
659 (! run resolvectl query edns-extra-text.forwarded.
test)
660 grep -qE "^edns-extra-text.forwarded.test.+: SERVFAIL \(Censored: Nothing to see here!\)" "$RUN_OUT"
661 (! run varlinkctl call
/run
/systemd
/resolve
/io.systemd.Resolve io.systemd.Resolve.ResolveHostname
'{"name" : "edns-extra-text.forwarded.test"}')
662 grep -qF "io.systemd.Resolve.DNSError" "$RUN_OUT"
663 grep -qF '{"rcode":2,"extendedDNSErrorCode":16,"extendedDNSErrorMessage":"Nothing to see here!"}' "$RUN_OUT"
665 journalctl
-u systemd-resolved.service
--cursor-file="$JOURNAL_CURSOR" --grep "Server returned error: SERVFAIL \(Censored: Nothing to see here!\)"
667 # SERVFAIL + EDE code 0: Other + extra text
668 (! run resolvectl query edns-code-zero.forwarded.
test)
669 grep -qE "^edns-code-zero.forwarded.test:.+: SERVFAIL \(Other: 🐱\)" "$RUN_OUT"
670 (! run varlinkctl call
/run
/systemd
/resolve
/io.systemd.Resolve io.systemd.Resolve.ResolveHostname
'{"name" : "edns-code-zero.forwarded.test"}')
671 grep -qF "io.systemd.Resolve.DNSError" "$RUN_OUT"
672 grep -qF '{"rcode":2,"extendedDNSErrorCode":0,"extendedDNSErrorMessage":"🐱"}' "$RUN_OUT"
674 journalctl
-u systemd-resolved.service
--cursor-file="$JOURNAL_CURSOR" --grep "Server returned error: SERVFAIL \(Other: 🐱\)"
676 # SERVFAIL + invalid EDE code
677 (! run resolvectl query edns-invalid-code.forwarded.
test)
678 grep -qE "^edns-invalid-code.forwarded.test:.+: SERVFAIL \([0-9]+\)" "$RUN_OUT"
679 (! run varlinkctl call
/run
/systemd
/resolve
/io.systemd.Resolve io.systemd.Resolve.ResolveHostname
'{"name" : "edns-invalid-code.forwarded.test"}')
680 grep -qF "io.systemd.Resolve.DNSError" "$RUN_OUT"
681 grep -qE '{"rcode":2,"extendedDNSErrorCode":[0-9]+}' "$RUN_OUT"
683 journalctl
-u systemd-resolved.service
--cursor-file="$JOURNAL_CURSOR" --grep "Server returned error: SERVFAIL \(\d+\)"
685 # SERVFAIL + invalid EDE code + extra text
686 (! run resolvectl query edns-invalid-code-with-extra-text.forwarded.
test)
687 grep -qE '^edns-invalid-code-with-extra-text.forwarded.test:.+: SERVFAIL \([0-9]+: Hello \[#\]\$%~ World\)' "$RUN_OUT"
688 (! run varlinkctl call
/run
/systemd
/resolve
/io.systemd.Resolve io.systemd.Resolve.ResolveHostname
'{"name" : "edns-invalid-code-with-extra-text.forwarded.test"}')
689 grep -qF "io.systemd.Resolve.DNSError" "$RUN_OUT"
690 grep -qE '{"rcode":2,"extendedDNSErrorCode":[0-9]+,"extendedDNSErrorMessage":"Hello \[#\]\$%~ World"}' "$RUN_OUT"
692 journalctl
-u systemd-resolved.service
--cursor-file="$JOURNAL_CURSOR" --grep "Server returned error: SERVFAIL \(\d+: Hello \[\#\]\\$%~ World\)"
694 ### Test resolvectl show-cache
695 run resolvectl show-cache
696 run resolvectl show-cache
--json=short
697 run resolvectl show-cache
--json=pretty
699 # Issue: https://github.com/systemd/systemd/issues/29580 (part #1)
700 dig @
127.0.0.54 signed.
test
702 systemctl stop resolvectl-monitor.service
703 systemctl stop resolvectl-monitor-json.service
705 # Issue: https://github.com/systemd/systemd/issues/29580 (part #2)
707 # Check for any warnings regarding malformed messages
708 (! journalctl
-u resolvectl-monitor.service
-u reseolvectl-monitor-json.service
-p warning
--grep malformed
)
709 # Verify that all queries recorded by `resolvectl monitor --json` produced a valid JSON
710 # with expected fields
711 journalctl
-p info
-o cat _SYSTEMD_UNIT
="resolvectl-monitor-json.service" |
while read -r line
; do
712 # Check that both "question" and "answer" fields are arrays
714 # The expression is slightly more complicated due to the fact that the "answer" field is optional,
715 # so we need to select it only if it's present, otherwise the type == "array" check would fail
716 echo "$line" | jq
-e '[. | .question, (select(has("answer")) | .answer) | type == "array"] | all'
719 # Test serve stale feature and NFTSet= if nftables is installed
720 if command -v nft
>/dev
/null
; then
721 ### Test without serve stale feature ###
722 NFT_FILTER_NAME
=dns_port_filter
724 drop_dns_outbound_traffic
() {
725 nft add table inet
$NFT_FILTER_NAME
726 nft add chain inet
$NFT_FILTER_NAME output \
{ type filter hook output priority
0 \
; \
}
727 nft add rule inet
$NFT_FILTER_NAME output ip daddr
10.0.0.1 udp dport
53 drop
728 nft add rule inet
$NFT_FILTER_NAME output ip daddr
10.0.0.1 tcp dport
53 drop
729 nft add rule inet
$NFT_FILTER_NAME output ip6 daddr fd00
:dead
:beef
:cafe
::1 udp dport
53 drop
730 nft add rule inet
$NFT_FILTER_NAME output ip6 daddr fd00
:dead
:beef
:cafe
::1 tcp dport
53 drop
733 run
dig stale1.unsigned.
test -t A
734 grep -qE "NOERROR" "$RUN_OUT"
736 drop_dns_outbound_traffic
738 # Make sure we give sd-resolved enough time to timeout (5-10s) before giving up
739 # See: https://github.com/systemd/systemd/issues/31639#issuecomment-2009152617
740 run
dig +tries
=1 +timeout
=15 stale1.unsigned.
test -t A
742 grep -qE "no servers could be reached" "$RUN_OUT"
745 ### Test TIMEOUT with serve stale feature ###
747 mkdir
-p /run
/systemd
/resolved.conf.d
750 echo "StaleRetentionSec=1d"
751 } >/run
/systemd
/resolved.conf.d
/test.conf
752 ln -svf /run
/systemd
/resolve
/stub-resolv.conf
/etc
/resolv.conf
753 systemctl reload systemd-resolved.service
755 run
dig stale1.unsigned.
test -t A
756 grep -qE "NOERROR" "$RUN_OUT"
758 drop_dns_outbound_traffic
759 # Make sure we give sd-resolved enough time to timeout (5-10s) and serve the stale data (see above)
760 run
dig +tries
=1 +timeout
=15 stale1.unsigned.
test -t A
761 grep -qE "NOERROR" "$RUN_OUT"
762 grep -qE "10.0.0.112" "$RUN_OUT"
766 ### Test NXDOMAIN with serve stale feature ###
767 # NXDOMAIN response should replace the cache with NXDOMAIN response
768 run
dig stale1.unsigned.
test -t A
769 grep -qE "NOERROR" "$RUN_OUT"
770 # Delete stale1 record from zone
771 knotc zone-begin unsigned.
test
772 knotc zone-unset unsigned.
test stale1 A
773 knotc zone-commit unsigned.
test
776 run
dig stale1.unsigned.
test -t A
777 grep -qE "NXDOMAIN" "$RUN_OUT"
782 nft add table inet sd_test
783 nft add
set inet sd_test c
'{ type cgroupsv2; }'
784 nft add
set inet sd_test u
'{ typeof meta skuid; }'
785 nft add
set inet sd_test g
'{ typeof meta skgid; }'
788 systemd-run
--unit test-nft.service
--service-type=exec -p DynamicUser
=yes \
789 -p 'NFTSet=cgroup:inet:sd_test:c user:inet:sd_test:u group:inet:sd_test:g' sleep 10000
790 run nft list
set inet sd_test c
791 grep -qF "test-nft.service" "$RUN_OUT"
792 uid
=$
(getent passwd test-nft | cut
-d':' -f3)
793 run nft list
set inet sd_test u
794 grep -qF "$uid" "$RUN_OUT"
795 gid
=$
(getent passwd test-nft | cut
-d':' -f4)
796 run nft list
set inet sd_test g
797 grep -qF "$gid" "$RUN_OUT"
798 systemctl stop test-nft.service
801 run systemd-run
--scope -u test-nft.scope
-p 'NFTSet=cgroup:inet:sd_test:c' nft list
set inet sd_test c
802 grep -qF "test-nft.scope" "$RUN_OUT"
804 mkdir
-p /run
/systemd
/system
808 echo "ListenStream=12345"
809 echo "BindToDevice=lo"
810 echo "NFTSet=cgroup:inet:sd_test:c"
811 } >/run
/systemd
/system
/test-nft.socket
814 echo "ExecStart=/usr/bin/sleep 10000"
815 } >/run
/systemd
/system
/test-nft.service
816 systemctl daemon-reload
817 systemctl start test-nft.socket
818 systemctl status test-nft.socket
819 run nft list
set inet sd_test c
820 grep -qF "test-nft.socket" "$RUN_OUT"
821 systemctl stop test-nft.socket
822 rm -f /run
/systemd
/system
/test-nft.
{socket
,service
}
825 mkdir
/run
/systemd
/system
/system.slice.d
828 echo "NFTSet=cgroup:inet:sd_test:c"
829 } >/run
/systemd
/system
/system.slice.d
/00-test-nft.conf
830 systemctl daemon-reload
831 run nft list
set inet sd_test c
832 grep -qF "system.slice" "$RUN_OUT"
833 rm -rf /run
/systemd
/system
/system.slice.d
837 echo "nftables is not installed. Skipped serve stale feature and NFTSet= tests."
840 ### Test resolvectl show-server-state ###
841 run resolvectl show-server-state
842 grep -qF "10.0.0.1" "$RUN_OUT"
843 grep -qF "Interface" "$RUN_OUT"
845 run resolvectl show-server-state
--json=short
846 grep -qF "10.0.0.1" "$RUN_OUT"
847 grep -qF "Interface" "$RUN_OUT"
849 run resolvectl show-server-state
--json=pretty
850 grep -qF "10.0.0.1" "$RUN_OUT"
851 grep -qF "Interface" "$RUN_OUT"
853 ### Test resolvectl statistics ###
854 run resolvectl statistics
855 grep -qF "Transactions" "$RUN_OUT"
856 grep -qF "Cache" "$RUN_OUT"
857 grep -qF "Failure Transactions" "$RUN_OUT"
858 grep -qF "DNSSEC Verdicts" "$RUN_OUT"
860 run resolvectl statistics
--json=short
861 grep -qF "transactions" "$RUN_OUT"
862 grep -qF "cache" "$RUN_OUT"
863 grep -qF "dnssec" "$RUN_OUT"
865 run resolvectl statistics
--json=pretty
866 grep -qF "transactions" "$RUN_OUT"
867 grep -qF "cache" "$RUN_OUT"
868 grep -qF "dnssec" "$RUN_OUT"
870 ### Test resolvectl reset-statistics ###
871 run resolvectl reset-statistics
873 run resolvectl reset-statistics
--json=pretty
875 run resolvectl reset-statistics
--json=short
877 test "$(resolvectl --json=short query -t AAAA localhost)" == '{"key":{"class":1,"type":28,"name":"localhost"},"address":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1]}'
878 test "$(resolvectl --json=short query -t A localhost)" == '{"key":{"class":1,"type":1,"name":"localhost"},"address":[127,0,0,1]}'
880 # Test ResolveRecord RR resolving via Varlink
881 test "$(varlinkctl call /run/systemd/resolve/io.systemd.Resolve io.systemd.Resolve.ResolveRecord '{"name
":"localhost
","type":1}' --json=short)" == '{"rrs":[{"ifindex":1,"rr":{"key":{"class":1,"type":1,"name":"localhost"},"address":[127,0,0,1]},"raw":"CWxvY2FsaG9zdAAAAQABAAAAAAAEfwAAAQ=="}],"flags":786945}'
882 test "$(varlinkctl call /run/systemd/resolve/io.systemd.Resolve io.systemd.Resolve.ResolveRecord '{"name
":"localhost
","type":28}' --json=short)" == '{"rrs":[{"ifindex":1,"rr":{"key":{"class":1,"type":28,"name":"localhost"},"address":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1]},"raw":"CWxvY2FsaG9zdAAAHAABAAAAAAAQAAAAAAAAAAAAAAAAAAAAAQ=="}],"flags":786945}'
884 # Ensure that reloading keeps the manually configured address
888 } >/run
/systemd
/resolved.conf.d
/reload.conf
889 resolvectl dns dns0
1.1.1.1
890 systemctl reload systemd-resolved.service
892 resolvectl dns dns0 |
grep -qF "1.1.1.1"
893 # For some reason piping this last command to grep fails with:
894 # 'resolvectl[1378]: Failed to print table: Broken pipe'
895 # so use an intermediate file in /tmp/
896 resolvectl
>/tmp
/output
897 grep -qF "DNS Servers: 8.8.8.8" /tmp
/output
899 # Check if resolved exits cleanly.